sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_pcb.h>
  38 #include <netinet/sctputil.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #ifdef INET6
  42 #include <netinet6/sctp6_var.h>
  43 #endif
  44 #include <netinet/sctp_header.h>
  45 #include <netinet/sctp_output.h>
  46 #include <netinet/sctp_uio.h>
  47 #include <netinet/sctp_timer.h>
  48 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
  49 #include <netinet/sctp_auth.h>
  50 #include <netinet/sctp_asconf.h>
  51 #include <netinet/sctp_bsd_addr.h>
  52 #include <netinet/udp.h>
  53 #include <netinet/udp_var.h>
  54 #include <sys/proc.h>
  55
  56
  57 #ifndef KTR_SCTP
  58 #define KTR_SCTP KTR_SUBSYS
  59 #endif
  60
  61 extern struct sctp_cc_functions sctp_cc_functions[];
  62 extern struct sctp_ss_functions sctp_ss_functions[];
  63
  64 void
  65 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  66 {
  67         struct sctp_cwnd_log sctp_clog;
  68
  69         sctp_clog.x.sb.stcb = stcb;
  70         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  71         if (stcb)
  72                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  73         else
  74                 sctp_clog.x.sb.stcb_sbcc = 0;
  75         sctp_clog.x.sb.incr = incr;
  76         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  77             SCTP_LOG_EVENT_SB,
  78             from,
  79             sctp_clog.x.misc.log1,
  80             sctp_clog.x.misc.log2,
  81             sctp_clog.x.misc.log3,
  82             sctp_clog.x.misc.log4);
  83 }
  84
  85 void
  86 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  87 {
  88         struct sctp_cwnd_log sctp_clog;
  89
  90         sctp_clog.x.close.inp = (void *)inp;
  91         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
  92         if (stcb) {
  93                 sctp_clog.x.close.stcb = (void *)stcb;
  94                 sctp_clog.x.close.state = (uint16_t) stcb->asoc.state;
  95         } else {
  96                 sctp_clog.x.close.stcb = 0;
  97                 sctp_clog.x.close.state = 0;
  98         }
  99         sctp_clog.x.close.loc = loc;
 100         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 101             SCTP_LOG_EVENT_CLOSE,
 102             0,
 103             sctp_clog.x.misc.log1,
 104             sctp_clog.x.misc.log2,
 105             sctp_clog.x.misc.log3,
 106             sctp_clog.x.misc.log4);
 107 }
 108
 109 void
 110 rto_logging(struct sctp_nets *net, int from)
 111 {
 112         struct sctp_cwnd_log sctp_clog;
 113
 114         memset(&sctp_clog, 0, sizeof(sctp_clog));
 115         sctp_clog.x.rto.net = (void *)net;
 116         sctp_clog.x.rto.rtt = net->rtt / 1000;
 117         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 118             SCTP_LOG_EVENT_RTT,
 119             from,
 120             sctp_clog.x.misc.log1,
 121             sctp_clog.x.misc.log2,
 122             sctp_clog.x.misc.log3,
 123             sctp_clog.x.misc.log4);
 124 }
 125
 126 void
 127 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 128 {
 129         struct sctp_cwnd_log sctp_clog;
 130
 131         sctp_clog.x.strlog.stcb = stcb;
 132         sctp_clog.x.strlog.n_tsn = tsn;
 133         sctp_clog.x.strlog.n_sseq = sseq;
 134         sctp_clog.x.strlog.e_tsn = 0;
 135         sctp_clog.x.strlog.e_sseq = 0;
 136         sctp_clog.x.strlog.strm = stream;
 137         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 138             SCTP_LOG_EVENT_STRM,
 139             from,
 140             sctp_clog.x.misc.log1,
 141             sctp_clog.x.misc.log2,
 142             sctp_clog.x.misc.log3,
 143             sctp_clog.x.misc.log4);
 144 }
 145
 146 void
 147 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 148 {
 149         struct sctp_cwnd_log sctp_clog;
 150
 151         sctp_clog.x.nagle.stcb = (void *)stcb;
 152         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 153         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 154         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 155         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 156         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 157             SCTP_LOG_EVENT_NAGLE,
 158             action,
 159             sctp_clog.x.misc.log1,
 160             sctp_clog.x.misc.log2,
 161             sctp_clog.x.misc.log3,
 162             sctp_clog.x.misc.log4);
 163 }
 164
 165 void
 166 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 167 {
 168         struct sctp_cwnd_log sctp_clog;
 169
 170         sctp_clog.x.sack.cumack = cumack;
 171         sctp_clog.x.sack.oldcumack = old_cumack;
 172         sctp_clog.x.sack.tsn = tsn;
 173         sctp_clog.x.sack.numGaps = gaps;
 174         sctp_clog.x.sack.numDups = dups;
 175         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 176             SCTP_LOG_EVENT_SACK,
 177             from,
 178             sctp_clog.x.misc.log1,
 179             sctp_clog.x.misc.log2,
 180             sctp_clog.x.misc.log3,
 181             sctp_clog.x.misc.log4);
 182 }
 183
 184 void
 185 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 186 {
 187         struct sctp_cwnd_log sctp_clog;
 188
 189         memset(&sctp_clog, 0, sizeof(sctp_clog));
 190         sctp_clog.x.map.base = map;
 191         sctp_clog.x.map.cum = cum;
 192         sctp_clog.x.map.high = high;
 193         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 194             SCTP_LOG_EVENT_MAP,
 195             from,
 196             sctp_clog.x.misc.log1,
 197             sctp_clog.x.misc.log2,
 198             sctp_clog.x.misc.log3,
 199             sctp_clog.x.misc.log4);
 200 }
 201
 202 void
 203 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 204 {
 205         struct sctp_cwnd_log sctp_clog;
 206
 207         memset(&sctp_clog, 0, sizeof(sctp_clog));
 208         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 209         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 210         sctp_clog.x.fr.tsn = tsn;
 211         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 212             SCTP_LOG_EVENT_FR,
 213             from,
 214             sctp_clog.x.misc.log1,
 215             sctp_clog.x.misc.log2,
 216             sctp_clog.x.misc.log3,
 217             sctp_clog.x.misc.log4);
 218 }
 219
 220 void
 221 sctp_log_mb(struct mbuf *m, int from)
 222 {
 223         struct sctp_cwnd_log sctp_clog;
 224
 225         sctp_clog.x.mb.mp = m;
 226         sctp_clog.x.mb.mbuf_flags = (uint8_t) (SCTP_BUF_GET_FLAGS(m));
 227         sctp_clog.x.mb.size = (uint16_t) (SCTP_BUF_LEN(m));
 228         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 229         if (SCTP_BUF_IS_EXTENDED(m)) {
 230                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 231                 sctp_clog.x.mb.refcnt = (uint8_t) (SCTP_BUF_EXTEND_REFCNT(m));
 232         } else {
 233                 sctp_clog.x.mb.ext = 0;
 234                 sctp_clog.x.mb.refcnt = 0;
 235         }
 236         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 237             SCTP_LOG_EVENT_MBUF,
 238             from,
 239             sctp_clog.x.misc.log1,
 240             sctp_clog.x.misc.log2,
 241             sctp_clog.x.misc.log3,
 242             sctp_clog.x.misc.log4);
 243 }
 244
 245 void
 246 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 247 {
 248         struct sctp_cwnd_log sctp_clog;
 249
 250         if (control == NULL) {
 251                 SCTP_PRINTF("Gak log of NULL?\n");
 252                 return;
 253         }
 254         sctp_clog.x.strlog.stcb = control->stcb;
 255         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 256         sctp_clog.x.strlog.n_sseq = control->sinfo_ssn;
 257         sctp_clog.x.strlog.strm = control->sinfo_stream;
 258         if (poschk != NULL) {
 259                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 260                 sctp_clog.x.strlog.e_sseq = poschk->sinfo_ssn;
 261         } else {
 262                 sctp_clog.x.strlog.e_tsn = 0;
 263                 sctp_clog.x.strlog.e_sseq = 0;
 264         }
 265         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 266             SCTP_LOG_EVENT_STRM,
 267             from,
 268             sctp_clog.x.misc.log1,
 269             sctp_clog.x.misc.log2,
 270             sctp_clog.x.misc.log3,
 271             sctp_clog.x.misc.log4);
 272 }
 273
 274 void
 275 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 276 {
 277         struct sctp_cwnd_log sctp_clog;
 278
 279         sctp_clog.x.cwnd.net = net;
 280         if (stcb->asoc.send_queue_cnt > 255)
 281                 sctp_clog.x.cwnd.cnt_in_send = 255;
 282         else
 283                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 284         if (stcb->asoc.stream_queue_cnt > 255)
 285                 sctp_clog.x.cwnd.cnt_in_str = 255;
 286         else
 287                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 288
 289         if (net) {
 290                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 291                 sctp_clog.x.cwnd.inflight = net->flight_size;
 292                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 293                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 294                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 295         }
 296         if (SCTP_CWNDLOG_PRESEND == from) {
 297                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 298         }
 299         sctp_clog.x.cwnd.cwnd_augment = augment;
 300         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 301             SCTP_LOG_EVENT_CWND,
 302             from,
 303             sctp_clog.x.misc.log1,
 304             sctp_clog.x.misc.log2,
 305             sctp_clog.x.misc.log3,
 306             sctp_clog.x.misc.log4);
 307 }
 308
 309 void
 310 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 311 {
 312         struct sctp_cwnd_log sctp_clog;
 313
 314         memset(&sctp_clog, 0, sizeof(sctp_clog));
 315         if (inp) {
 316                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 317
 318         } else {
 319                 sctp_clog.x.lock.sock = (void *)NULL;
 320         }
 321         sctp_clog.x.lock.inp = (void *)inp;
 322         if (stcb) {
 323                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 324         } else {
 325                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 326         }
 327         if (inp) {
 328                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 329                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 330         } else {
 331                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 332                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 333         }
 334         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 335         if (inp && (inp->sctp_socket)) {
 336                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 337                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 338                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 339         } else {
 340                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 341                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 342                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 343         }
 344         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 345             SCTP_LOG_LOCK_EVENT,
 346             from,
 347             sctp_clog.x.misc.log1,
 348             sctp_clog.x.misc.log2,
 349             sctp_clog.x.misc.log3,
 350             sctp_clog.x.misc.log4);
 351 }
 352
 353 void
 354 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 355 {
 356         struct sctp_cwnd_log sctp_clog;
 357
 358         memset(&sctp_clog, 0, sizeof(sctp_clog));
 359         sctp_clog.x.cwnd.net = net;
 360         sctp_clog.x.cwnd.cwnd_new_value = error;
 361         sctp_clog.x.cwnd.inflight = net->flight_size;
 362         sctp_clog.x.cwnd.cwnd_augment = burst;
 363         if (stcb->asoc.send_queue_cnt > 255)
 364                 sctp_clog.x.cwnd.cnt_in_send = 255;
 365         else
 366                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 367         if (stcb->asoc.stream_queue_cnt > 255)
 368                 sctp_clog.x.cwnd.cnt_in_str = 255;
 369         else
 370                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 371         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 372             SCTP_LOG_EVENT_MAXBURST,
 373             from,
 374             sctp_clog.x.misc.log1,
 375             sctp_clog.x.misc.log2,
 376             sctp_clog.x.misc.log3,
 377             sctp_clog.x.misc.log4);
 378 }
 379
 380 void
 381 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 382 {
 383         struct sctp_cwnd_log sctp_clog;
 384
 385         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 386         sctp_clog.x.rwnd.send_size = snd_size;
 387         sctp_clog.x.rwnd.overhead = overhead;
 388         sctp_clog.x.rwnd.new_rwnd = 0;
 389         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 390             SCTP_LOG_EVENT_RWND,
 391             from,
 392             sctp_clog.x.misc.log1,
 393             sctp_clog.x.misc.log2,
 394             sctp_clog.x.misc.log3,
 395             sctp_clog.x.misc.log4);
 396 }
 397
 398 void
 399 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 400 {
 401         struct sctp_cwnd_log sctp_clog;
 402
 403         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 404         sctp_clog.x.rwnd.send_size = flight_size;
 405         sctp_clog.x.rwnd.overhead = overhead;
 406         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 407         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 408             SCTP_LOG_EVENT_RWND,
 409             from,
 410             sctp_clog.x.misc.log1,
 411             sctp_clog.x.misc.log2,
 412             sctp_clog.x.misc.log3,
 413             sctp_clog.x.misc.log4);
 414 }
 415
 416 void
 417 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 418 {
 419         struct sctp_cwnd_log sctp_clog;
 420
 421         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 422         sctp_clog.x.mbcnt.size_change = book;
 423         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 424         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 425         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 426             SCTP_LOG_EVENT_MBCNT,
 427             from,
 428             sctp_clog.x.misc.log1,
 429             sctp_clog.x.misc.log2,
 430             sctp_clog.x.misc.log3,
 431             sctp_clog.x.misc.log4);
 432 }
 433
 434 void
 435 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 436 {
 437         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 438             SCTP_LOG_MISC_EVENT,
 439             from,
 440             a, b, c, d);
 441 }
 442
 443 void
 444 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 445 {
 446         struct sctp_cwnd_log sctp_clog;
 447
 448         sctp_clog.x.wake.stcb = (void *)stcb;
 449         sctp_clog.x.wake.wake_cnt = wake_cnt;
 450         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 451         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 452         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 453
 454         if (stcb->asoc.stream_queue_cnt < 0xff)
 455                 sctp_clog.x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt;
 456         else
 457                 sctp_clog.x.wake.stream_qcnt = 0xff;
 458
 459         if (stcb->asoc.chunks_on_out_queue < 0xff)
 460                 sctp_clog.x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue;
 461         else
 462                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 463
 464         sctp_clog.x.wake.sctpflags = 0;
 465         /* set in the defered mode stuff */
 466         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 467                 sctp_clog.x.wake.sctpflags |= 1;
 468         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 469                 sctp_clog.x.wake.sctpflags |= 2;
 470         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 471                 sctp_clog.x.wake.sctpflags |= 4;
 472         /* what about the sb */
 473         if (stcb->sctp_socket) {
 474                 struct socket *so = stcb->sctp_socket;
 475
 476                 sctp_clog.x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff));
 477         } else {
 478                 sctp_clog.x.wake.sbflags = 0xff;
 479         }
 480         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 481             SCTP_LOG_EVENT_WAKE,
 482             from,
 483             sctp_clog.x.misc.log1,
 484             sctp_clog.x.misc.log2,
 485             sctp_clog.x.misc.log3,
 486             sctp_clog.x.misc.log4);
 487 }
 488
 489 void
 490 sctp_log_block(uint8_t from, struct sctp_association *asoc, int sendlen)
 491 {
 492         struct sctp_cwnd_log sctp_clog;
 493
 494         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 495         sctp_clog.x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt);
 496         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 497         sctp_clog.x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt;
 498         sctp_clog.x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue;
 499         sctp_clog.x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024);
 500         sctp_clog.x.blk.sndlen = sendlen;
 501         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 502             SCTP_LOG_EVENT_BLOCK,
 503             from,
 504             sctp_clog.x.misc.log1,
 505             sctp_clog.x.misc.log2,
 506             sctp_clog.x.misc.log3,
 507             sctp_clog.x.misc.log4);
 508 }
 509
 510 int
 511 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 512 {
 513         /* May need to fix this if ktrdump does not work */
 514         return (0);
 515 }
 516
 517 #ifdef SCTP_AUDITING_ENABLED
 518 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 519 static int sctp_audit_indx = 0;
 520
 521 static
 522 void
 523 sctp_print_audit_report(void)
 524 {
 525         int i;
 526         int cnt;
 527
 528         cnt = 0;
 529         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 530                 if ((sctp_audit_data[i][0] == 0xe0) &&
 531                     (sctp_audit_data[i][1] == 0x01)) {
 532                         cnt = 0;
 533                         SCTP_PRINTF("\n");
 534                 } else if (sctp_audit_data[i][0] == 0xf0) {
 535                         cnt = 0;
 536                         SCTP_PRINTF("\n");
 537                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 538                     (sctp_audit_data[i][1] == 0x01)) {
 539                         SCTP_PRINTF("\n");
 540                         cnt = 0;
 541                 }
 542                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 543                     (uint32_t) sctp_audit_data[i][1]);
 544                 cnt++;
 545                 if ((cnt % 14) == 0)
 546                         SCTP_PRINTF("\n");
 547         }
 548         for (i = 0; i < sctp_audit_indx; i++) {
 549                 if ((sctp_audit_data[i][0] == 0xe0) &&
 550                     (sctp_audit_data[i][1] == 0x01)) {
 551                         cnt = 0;
 552                         SCTP_PRINTF("\n");
 553                 } else if (sctp_audit_data[i][0] == 0xf0) {
 554                         cnt = 0;
 555                         SCTP_PRINTF("\n");
 556                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 557                     (sctp_audit_data[i][1] == 0x01)) {
 558                         SCTP_PRINTF("\n");
 559                         cnt = 0;
 560                 }
 561                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 562                     (uint32_t) sctp_audit_data[i][1]);
 563                 cnt++;
 564                 if ((cnt % 14) == 0)
 565                         SCTP_PRINTF("\n");
 566         }
 567         SCTP_PRINTF("\n");
 568 }
 569
 570 void
 571 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 572     struct sctp_nets *net)
 573 {
 574         int resend_cnt, tot_out, rep, tot_book_cnt;
 575         struct sctp_nets *lnet;
 576         struct sctp_tmit_chunk *chk;
 577
 578         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 579         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 580         sctp_audit_indx++;
 581         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 582                 sctp_audit_indx = 0;
 583         }
 584         if (inp == NULL) {
 585                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 586                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 587                 sctp_audit_indx++;
 588                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 589                         sctp_audit_indx = 0;
 590                 }
 591                 return;
 592         }
 593         if (stcb == NULL) {
 594                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 595                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 596                 sctp_audit_indx++;
 597                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 598                         sctp_audit_indx = 0;
 599                 }
 600                 return;
 601         }
 602         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 603         sctp_audit_data[sctp_audit_indx][1] =
 604             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 605         sctp_audit_indx++;
 606         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 607                 sctp_audit_indx = 0;
 608         }
 609         rep = 0;
 610         tot_book_cnt = 0;
 611         resend_cnt = tot_out = 0;
 612         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 613                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 614                         resend_cnt++;
 615                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 616                         tot_out += chk->book_size;
 617                         tot_book_cnt++;
 618                 }
 619         }
 620         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 621                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 622                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 623                 sctp_audit_indx++;
 624                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 625                         sctp_audit_indx = 0;
 626                 }
 627                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 628                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 629                 rep = 1;
 630                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 631                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 632                 sctp_audit_data[sctp_audit_indx][1] =
 633                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 634                 sctp_audit_indx++;
 635                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 636                         sctp_audit_indx = 0;
 637                 }
 638         }
 639         if (tot_out != stcb->asoc.total_flight) {
 640                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 641                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 642                 sctp_audit_indx++;
 643                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 644                         sctp_audit_indx = 0;
 645                 }
 646                 rep = 1;
 647                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 648                     (int)stcb->asoc.total_flight);
 649                 stcb->asoc.total_flight = tot_out;
 650         }
 651         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 652                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 653                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 654                 sctp_audit_indx++;
 655                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 656                         sctp_audit_indx = 0;
 657                 }
 658                 rep = 1;
 659                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 660
 661                 stcb->asoc.total_flight_count = tot_book_cnt;
 662         }
 663         tot_out = 0;
 664         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 665                 tot_out += lnet->flight_size;
 666         }
 667         if (tot_out != stcb->asoc.total_flight) {
 668                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 669                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 670                 sctp_audit_indx++;
 671                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 672                         sctp_audit_indx = 0;
 673                 }
 674                 rep = 1;
 675                 SCTP_PRINTF("real flight:%d net total was %d\n",
 676                     stcb->asoc.total_flight, tot_out);
 677                 /* now corrective action */
 678                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 679
 680                         tot_out = 0;
 681                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 682                                 if ((chk->whoTo == lnet) &&
 683                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 684                                         tot_out += chk->book_size;
 685                                 }
 686                         }
 687                         if (lnet->flight_size != tot_out) {
 688                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 689                                     (void *)lnet, lnet->flight_size,
 690                                     tot_out);
 691                                 lnet->flight_size = tot_out;
 692                         }
 693                 }
 694         }
 695         if (rep) {
 696                 sctp_print_audit_report();
 697         }
 698 }
 699
 700 void
 701 sctp_audit_log(uint8_t ev, uint8_t fd)
 702 {
 703
 704         sctp_audit_data[sctp_audit_indx][0] = ev;
 705         sctp_audit_data[sctp_audit_indx][1] = fd;
 706         sctp_audit_indx++;
 707         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 708                 sctp_audit_indx = 0;
 709         }
 710 }
 711
 712 #endif
 713
 714 /*
 715  * sctp_stop_timers_for_shutdown() should be called
 716  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 717  * state to make sure that all timers are stopped.
 718  */
 719 void
 720 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 721 {
 722         struct sctp_association *asoc;
 723         struct sctp_nets *net;
 724
 725         asoc = &stcb->asoc;
 726
 727         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 728         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 729         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 730         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 731         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 732         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 733                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 734                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 735         }
 736 }
 737
 738 /*
 739  * a list of sizes based on typical mtu's, used only if next hop size not
 740  * returned.
 741  */
 742 static uint32_t sctp_mtu_sizes[] = {
 743         68,
 744         296,
 745         508,
 746         512,
 747         544,
 748         576,
 749         1006,
 750         1492,
 751         1500,
 752         1536,
 753         2002,
 754         2048,
 755         4352,
 756         4464,
 757         8166,
 758         17914,
 759         32000,
 760         65535
 761 };
 762
 763 /*
 764  * Return the largest MTU smaller than val. If there is no
 765  * entry, just return val.
 766  */
 767 uint32_t
 768 sctp_get_prev_mtu(uint32_t val)
 769 {
 770         uint32_t i;
 771
 772         if (val <= sctp_mtu_sizes[0]) {
 773                 return (val);
 774         }
 775         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 776                 if (val <= sctp_mtu_sizes[i]) {
 777                         break;
 778                 }
 779         }
 780         return (sctp_mtu_sizes[i - 1]);
 781 }
 782
 783 /*
 784  * Return the smallest MTU larger than val. If there is no
 785  * entry, just return val.
 786  */
 787 uint32_t
 788 sctp_get_next_mtu(uint32_t val)
 789 {
 790         /* select another MTU that is just bigger than this one */
 791         uint32_t i;
 792
 793         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 794                 if (val < sctp_mtu_sizes[i]) {
 795                         return (sctp_mtu_sizes[i]);
 796                 }
 797         }
 798         return (val);
 799 }
 800
 801 void
 802 sctp_fill_random_store(struct sctp_pcb *m)
 803 {
 804         /*
 805          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 806          * our counter. The result becomes our good random numbers and we
 807          * then setup to give these out. Note that we do no locking to
 808          * protect this. This is ok, since if competing folks call this we
 809          * will get more gobbled gook in the random store which is what we
 810          * want. There is a danger that two guys will use the same random
 811          * numbers, but thats ok too since that is random as well :->
 812          */
 813         m->store_at = 0;
 814         (void)sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers,
 815             sizeof(m->random_numbers), (uint8_t *) & m->random_counter,
 816             sizeof(m->random_counter), (uint8_t *) m->random_store);
 817         m->random_counter++;
 818 }
 819
 820 uint32_t
 821 sctp_select_initial_TSN(struct sctp_pcb *inp)
 822 {
 823         /*
 824          * A true implementation should use random selection process to get
 825          * the initial stream sequence number, using RFC1750 as a good
 826          * guideline
 827          */
 828         uint32_t x, *xp;
 829         uint8_t *p;
 830         int store_at, new_store;
 831
 832         if (inp->initial_sequence_debug != 0) {
 833                 uint32_t ret;
 834
 835                 ret = inp->initial_sequence_debug;
 836                 inp->initial_sequence_debug++;
 837                 return (ret);
 838         }
 839 retry:
 840         store_at = inp->store_at;
 841         new_store = store_at + sizeof(uint32_t);
 842         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 843                 new_store = 0;
 844         }
 845         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 846                 goto retry;
 847         }
 848         if (new_store == 0) {
 849                 /* Refill the random store */
 850                 sctp_fill_random_store(inp);
 851         }
 852         p = &inp->random_store[store_at];
 853         xp = (uint32_t *) p;
 854         x = *xp;
 855         return (x);
 856 }
 857
 858 uint32_t
 859 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
 860 {
 861         uint32_t x;
 862         struct timeval now;
 863
 864         if (check) {
 865                 (void)SCTP_GETTIME_TIMEVAL(&now);
 866         }
 867         for (;;) {
 868                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 869                 if (x == 0) {
 870                         /* we never use 0 */
 871                         continue;
 872                 }
 873                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 874                         break;
 875                 }
 876         }
 877         return (x);
 878 }
 879
 880 int
 881 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 882     uint32_t override_tag, uint32_t vrf_id)
 883 {
 884         struct sctp_association *asoc;
 885
 886         /*
 887          * Anything set to zero is taken care of by the allocation routine's
 888          * bzero
 889          */
 890
 891         /*
 892          * Up front select what scoping to apply on addresses I tell my peer
 893          * Not sure what to do with these right now, we will need to come up
 894          * with a way to set them. We may need to pass them through from the
 895          * caller in the sctp_aloc_assoc() function.
 896          */
 897         int i;
 898
 899 #if defined(SCTP_DETAILED_STR_STATS)
 900         int j;
 901
 902 #endif
 903
 904         asoc = &stcb->asoc;
 905         /* init all variables to a known value. */
 906         SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE);
 907         asoc->max_burst = inp->sctp_ep.max_burst;
 908         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
 909         asoc->heart_beat_delay = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
 910         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
 911         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
 912         asoc->ecn_supported = inp->ecn_supported;
 913         asoc->prsctp_supported = inp->prsctp_supported;
 914         asoc->auth_supported = inp->auth_supported;
 915         asoc->asconf_supported = inp->asconf_supported;
 916         asoc->reconfig_supported = inp->reconfig_supported;
 917         asoc->nrsack_supported = inp->nrsack_supported;
 918         asoc->pktdrop_supported = inp->pktdrop_supported;
 919         asoc->sctp_cmt_pf = (uint8_t) 0;
 920         asoc->sctp_frag_point = inp->sctp_frag_point;
 921         asoc->sctp_features = inp->sctp_features;
 922         asoc->default_dscp = inp->sctp_ep.default_dscp;
 923 #ifdef INET6
 924         if (inp->sctp_ep.default_flowlabel) {
 925                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
 926         } else {
 927                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
 928                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
 929                         asoc->default_flowlabel &= 0x000fffff;
 930                         asoc->default_flowlabel |= 0x80000000;
 931                 } else {
 932                         asoc->default_flowlabel = 0;
 933                 }
 934         }
 935 #endif
 936         asoc->sb_send_resv = 0;
 937         if (override_tag) {
 938                 asoc->my_vtag = override_tag;
 939         } else {
 940                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 941         }
 942         /* Get the nonce tags */
 943         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 944         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 945         asoc->vrf_id = vrf_id;
 946
 947 #ifdef SCTP_ASOCLOG_OF_TSNS
 948         asoc->tsn_in_at = 0;
 949         asoc->tsn_out_at = 0;
 950         asoc->tsn_in_wrapped = 0;
 951         asoc->tsn_out_wrapped = 0;
 952         asoc->cumack_log_at = 0;
 953         asoc->cumack_log_atsnt = 0;
 954 #endif
 955 #ifdef SCTP_FS_SPEC_LOG
 956         asoc->fs_index = 0;
 957 #endif
 958         asoc->refcnt = 0;
 959         asoc->assoc_up_sent = 0;
 960         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
 961             sctp_select_initial_TSN(&inp->sctp_ep);
 962         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 963         /* we are optimisitic here */
 964         asoc->peer_supports_nat = 0;
 965         asoc->sent_queue_retran_cnt = 0;
 966
 967         /* for CMT */
 968         asoc->last_net_cmt_send_started = NULL;
 969
 970         /* This will need to be adjusted */
 971         asoc->last_acked_seq = asoc->init_seq_number - 1;
 972         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 973         asoc->asconf_seq_in = asoc->last_acked_seq;
 974
 975         /* here we are different, we hold the next one we expect */
 976         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
 977
 978         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
 979         asoc->initial_rto = inp->sctp_ep.initial_rto;
 980
 981         asoc->max_init_times = inp->sctp_ep.max_init_times;
 982         asoc->max_send_times = inp->sctp_ep.max_send_times;
 983         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
 984         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
 985         asoc->free_chunk_cnt = 0;
 986
 987         asoc->iam_blocking = 0;
 988         asoc->context = inp->sctp_context;
 989         asoc->local_strreset_support = inp->local_strreset_support;
 990         asoc->def_send = inp->def_send;
 991         asoc->delayed_ack = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
 992         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
 993         asoc->pr_sctp_cnt = 0;
 994         asoc->total_output_queue_size = 0;
 995
 996         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
 997                 asoc->scope.ipv6_addr_legal = 1;
 998                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
 999                         asoc->scope.ipv4_addr_legal = 1;
1000                 } else {
1001                         asoc->scope.ipv4_addr_legal = 0;
1002                 }
1003         } else {
1004                 asoc->scope.ipv6_addr_legal = 0;
1005                 asoc->scope.ipv4_addr_legal = 1;
1006         }
1007
1008         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1009         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1010
1011         asoc->smallest_mtu = inp->sctp_frag_point;
1012         asoc->minrto = inp->sctp_ep.sctp_minrto;
1013         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1014
1015         asoc->locked_on_sending = NULL;
1016         asoc->stream_locked_on = 0;
1017         asoc->ecn_echo_cnt_onq = 0;
1018         asoc->stream_locked = 0;
1019
1020         asoc->send_sack = 1;
1021
1022         LIST_INIT(&asoc->sctp_restricted_addrs);
1023
1024         TAILQ_INIT(&asoc->nets);
1025         TAILQ_INIT(&asoc->pending_reply_queue);
1026         TAILQ_INIT(&asoc->asconf_ack_sent);
1027         /* Setup to fill the hb random cache at first HB */
1028         asoc->hb_random_idx = 4;
1029
1030         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1031
1032         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1033         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1034
1035         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1036         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1037
1038         /*
1039          * Now the stream parameters, here we allocate space for all streams
1040          * that we request by default.
1041          */
1042         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1043             inp->sctp_ep.pre_open_stream_count;
1044         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1045             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1046             SCTP_M_STRMO);
1047         if (asoc->strmout == NULL) {
1048                 /* big trouble no memory */
1049                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1050                 return (ENOMEM);
1051         }
1052         for (i = 0; i < asoc->streamoutcnt; i++) {
1053                 /*
1054                  * inbound side must be set to 0xffff, also NOTE when we get
1055                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1056                  * count (streamoutcnt) but first check if we sent to any of
1057                  * the upper streams that were dropped (if some were). Those
1058                  * that were dropped must be notified to the upper layer as
1059                  * failed to send.
1060                  */
1061                 asoc->strmout[i].next_sequence_send = 0x0;
1062                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1063                 asoc->strmout[i].chunks_on_queues = 0;
1064 #if defined(SCTP_DETAILED_STR_STATS)
1065                 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1066                         asoc->strmout[i].abandoned_sent[j] = 0;
1067                         asoc->strmout[i].abandoned_unsent[j] = 0;
1068                 }
1069 #else
1070                 asoc->strmout[i].abandoned_sent[0] = 0;
1071                 asoc->strmout[i].abandoned_unsent[0] = 0;
1072 #endif
1073                 asoc->strmout[i].stream_no = i;
1074                 asoc->strmout[i].last_msg_incomplete = 0;
1075                 asoc->ss_functions.sctp_ss_init_stream(&asoc->strmout[i], NULL);
1076         }
1077         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1078
1079         /* Now the mapping array */
1080         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1081         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1082             SCTP_M_MAP);
1083         if (asoc->mapping_array == NULL) {
1084                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1085                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1086                 return (ENOMEM);
1087         }
1088         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1089         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1090             SCTP_M_MAP);
1091         if (asoc->nr_mapping_array == NULL) {
1092                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1093                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1094                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1095                 return (ENOMEM);
1096         }
1097         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1098
1099         /* Now the init of the other outqueues */
1100         TAILQ_INIT(&asoc->free_chunks);
1101         TAILQ_INIT(&asoc->control_send_queue);
1102         TAILQ_INIT(&asoc->asconf_send_queue);
1103         TAILQ_INIT(&asoc->send_queue);
1104         TAILQ_INIT(&asoc->sent_queue);
1105         TAILQ_INIT(&asoc->reasmqueue);
1106         TAILQ_INIT(&asoc->resetHead);
1107         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1108         TAILQ_INIT(&asoc->asconf_queue);
1109         /* authentication fields */
1110         asoc->authinfo.random = NULL;
1111         asoc->authinfo.active_keyid = 0;
1112         asoc->authinfo.assoc_key = NULL;
1113         asoc->authinfo.assoc_keyid = 0;
1114         asoc->authinfo.recv_key = NULL;
1115         asoc->authinfo.recv_keyid = 0;
1116         LIST_INIT(&asoc->shared_keys);
1117         asoc->marked_retrans = 0;
1118         asoc->port = inp->sctp_ep.port;
1119         asoc->timoinit = 0;
1120         asoc->timodata = 0;
1121         asoc->timosack = 0;
1122         asoc->timoshutdown = 0;
1123         asoc->timoheartbeat = 0;
1124         asoc->timocookie = 0;
1125         asoc->timoshutdownack = 0;
1126         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1127         asoc->discontinuity_time = asoc->start_time;
1128         for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1129                 asoc->abandoned_unsent[i] = 0;
1130                 asoc->abandoned_sent[i] = 0;
1131         }
1132         /*
1133          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1134          * freed later when the association is freed.
1135          */
1136         return (0);
1137 }
1138
1139 void
1140 sctp_print_mapping_array(struct sctp_association *asoc)
1141 {
1142         unsigned int i, limit;
1143
1144         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1145             asoc->mapping_array_size,
1146             asoc->mapping_array_base_tsn,
1147             asoc->cumulative_tsn,
1148             asoc->highest_tsn_inside_map,
1149             asoc->highest_tsn_inside_nr_map);
1150         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1151                 if (asoc->mapping_array[limit - 1] != 0) {
1152                         break;
1153                 }
1154         }
1155         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1156         for (i = 0; i < limit; i++) {
1157                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1158         }
1159         if (limit % 16)
1160                 SCTP_PRINTF("\n");
1161         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1162                 if (asoc->nr_mapping_array[limit - 1]) {
1163                         break;
1164                 }
1165         }
1166         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1167         for (i = 0; i < limit; i++) {
1168                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1169         }
1170         if (limit % 16)
1171                 SCTP_PRINTF("\n");
1172 }
1173
1174 int
1175 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1176 {
1177         /* mapping array needs to grow */
1178         uint8_t *new_array1, *new_array2;
1179         uint32_t new_size;
1180
1181         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1182         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1183         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1184         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1185                 /* can't get more, forget it */
1186                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1187                 if (new_array1) {
1188                         SCTP_FREE(new_array1, SCTP_M_MAP);
1189                 }
1190                 if (new_array2) {
1191                         SCTP_FREE(new_array2, SCTP_M_MAP);
1192                 }
1193                 return (-1);
1194         }
1195         memset(new_array1, 0, new_size);
1196         memset(new_array2, 0, new_size);
1197         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1198         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1199         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1200         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1201         asoc->mapping_array = new_array1;
1202         asoc->nr_mapping_array = new_array2;
1203         asoc->mapping_array_size = new_size;
1204         return (0);
1205 }
1206
1207
1208 static void
1209 sctp_iterator_work(struct sctp_iterator *it)
1210 {
1211         int iteration_count = 0;
1212         int inp_skip = 0;
1213         int first_in = 1;
1214         struct sctp_inpcb *tinp;
1215
1216         SCTP_INP_INFO_RLOCK();
1217         SCTP_ITERATOR_LOCK();
1218         if (it->inp) {
1219                 SCTP_INP_RLOCK(it->inp);
1220                 SCTP_INP_DECR_REF(it->inp);
1221         }
1222         if (it->inp == NULL) {
1223                 /* iterator is complete */
1224 done_with_iterator:
1225                 SCTP_ITERATOR_UNLOCK();
1226                 SCTP_INP_INFO_RUNLOCK();
1227                 if (it->function_atend != NULL) {
1228                         (*it->function_atend) (it->pointer, it->val);
1229                 }
1230                 SCTP_FREE(it, SCTP_M_ITER);
1231                 return;
1232         }
1233 select_a_new_ep:
1234         if (first_in) {
1235                 first_in = 0;
1236         } else {
1237                 SCTP_INP_RLOCK(it->inp);
1238         }
1239         while (((it->pcb_flags) &&
1240             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1241             ((it->pcb_features) &&
1242             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1243                 /* endpoint flags or features don't match, so keep looking */
1244                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1245                         SCTP_INP_RUNLOCK(it->inp);
1246                         goto done_with_iterator;
1247                 }
1248                 tinp = it->inp;
1249                 it->inp = LIST_NEXT(it->inp, sctp_list);
1250                 SCTP_INP_RUNLOCK(tinp);
1251                 if (it->inp == NULL) {
1252                         goto done_with_iterator;
1253                 }
1254                 SCTP_INP_RLOCK(it->inp);
1255         }
1256         /* now go through each assoc which is in the desired state */
1257         if (it->done_current_ep == 0) {
1258                 if (it->function_inp != NULL)
1259                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1260                 it->done_current_ep = 1;
1261         }
1262         if (it->stcb == NULL) {
1263                 /* run the per instance function */
1264                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1265         }
1266         if ((inp_skip) || it->stcb == NULL) {
1267                 if (it->function_inp_end != NULL) {
1268                         inp_skip = (*it->function_inp_end) (it->inp,
1269                             it->pointer,
1270                             it->val);
1271                 }
1272                 SCTP_INP_RUNLOCK(it->inp);
1273                 goto no_stcb;
1274         }
1275         while (it->stcb) {
1276                 SCTP_TCB_LOCK(it->stcb);
1277                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1278                         /* not in the right state... keep looking */
1279                         SCTP_TCB_UNLOCK(it->stcb);
1280                         goto next_assoc;
1281                 }
1282                 /* see if we have limited out the iterator loop */
1283                 iteration_count++;
1284                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1285                         /* Pause to let others grab the lock */
1286                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1287                         SCTP_TCB_UNLOCK(it->stcb);
1288                         SCTP_INP_INCR_REF(it->inp);
1289                         SCTP_INP_RUNLOCK(it->inp);
1290                         SCTP_ITERATOR_UNLOCK();
1291                         SCTP_INP_INFO_RUNLOCK();
1292                         SCTP_INP_INFO_RLOCK();
1293                         SCTP_ITERATOR_LOCK();
1294                         if (sctp_it_ctl.iterator_flags) {
1295                                 /* We won't be staying here */
1296                                 SCTP_INP_DECR_REF(it->inp);
1297                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1298                                 if (sctp_it_ctl.iterator_flags &
1299                                     SCTP_ITERATOR_STOP_CUR_IT) {
1300                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1301                                         goto done_with_iterator;
1302                                 }
1303                                 if (sctp_it_ctl.iterator_flags &
1304                                     SCTP_ITERATOR_STOP_CUR_INP) {
1305                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1306                                         goto no_stcb;
1307                                 }
1308                                 /* If we reach here huh? */
1309                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1310                                     sctp_it_ctl.iterator_flags);
1311                                 sctp_it_ctl.iterator_flags = 0;
1312                         }
1313                         SCTP_INP_RLOCK(it->inp);
1314                         SCTP_INP_DECR_REF(it->inp);
1315                         SCTP_TCB_LOCK(it->stcb);
1316                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1317                         iteration_count = 0;
1318                 }
1319                 /* run function on this one */
1320                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1321
1322                 /*
1323                  * we lie here, it really needs to have its own type but
1324                  * first I must verify that this won't effect things :-0
1325                  */
1326                 if (it->no_chunk_output == 0)
1327                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1328
1329                 SCTP_TCB_UNLOCK(it->stcb);
1330 next_assoc:
1331                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1332                 if (it->stcb == NULL) {
1333                         /* Run last function */
1334                         if (it->function_inp_end != NULL) {
1335                                 inp_skip = (*it->function_inp_end) (it->inp,
1336                                     it->pointer,
1337                                     it->val);
1338                         }
1339                 }
1340         }
1341         SCTP_INP_RUNLOCK(it->inp);
1342 no_stcb:
1343         /* done with all assocs on this endpoint, move on to next endpoint */
1344         it->done_current_ep = 0;
1345         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1346                 it->inp = NULL;
1347         } else {
1348                 it->inp = LIST_NEXT(it->inp, sctp_list);
1349         }
1350         if (it->inp == NULL) {
1351                 goto done_with_iterator;
1352         }
1353         goto select_a_new_ep;
1354 }
1355
1356 void
1357 sctp_iterator_worker(void)
1358 {
1359         struct sctp_iterator *it, *nit;
1360
1361         /* This function is called with the WQ lock in place */
1362
1363         sctp_it_ctl.iterator_running = 1;
1364         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1365                 sctp_it_ctl.cur_it = it;
1366                 /* now lets work on this one */
1367                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1368                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1369                 CURVNET_SET(it->vn);
1370                 sctp_iterator_work(it);
1371                 sctp_it_ctl.cur_it = NULL;
1372                 CURVNET_RESTORE();
1373                 SCTP_IPI_ITERATOR_WQ_LOCK();
1374                 /* sa_ignore FREED_MEMORY */
1375         }
1376         sctp_it_ctl.iterator_running = 0;
1377         return;
1378 }
1379
1380
1381 static void
1382 sctp_handle_addr_wq(void)
1383 {
1384         /* deal with the ADDR wq from the rtsock calls */
1385         struct sctp_laddr *wi, *nwi;
1386         struct sctp_asconf_iterator *asc;
1387
1388         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1389             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1390         if (asc == NULL) {
1391                 /* Try later, no memory */
1392                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1393                     (struct sctp_inpcb *)NULL,
1394                     (struct sctp_tcb *)NULL,
1395                     (struct sctp_nets *)NULL);
1396                 return;
1397         }
1398         LIST_INIT(&asc->list_of_work);
1399         asc->cnt = 0;
1400
1401         SCTP_WQ_ADDR_LOCK();
1402         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1403                 LIST_REMOVE(wi, sctp_nxt_addr);
1404                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1405                 asc->cnt++;
1406         }
1407         SCTP_WQ_ADDR_UNLOCK();
1408
1409         if (asc->cnt == 0) {
1410                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1411         } else {
1412                 (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
1413                     sctp_asconf_iterator_stcb,
1414                     NULL,       /* No ep end for boundall */
1415                     SCTP_PCB_FLAGS_BOUNDALL,
1416                     SCTP_PCB_ANY_FEATURES,
1417                     SCTP_ASOC_ANY_STATE,
1418                     (void *)asc, 0,
1419                     sctp_asconf_iterator_end, NULL, 0);
1420         }
1421 }
1422
1423 void
1424 sctp_timeout_handler(void *t)
1425 {
1426         struct sctp_inpcb *inp;
1427         struct sctp_tcb *stcb;
1428         struct sctp_nets *net;
1429         struct sctp_timer *tmr;
1430
1431 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1432         struct socket *so;
1433
1434 #endif
1435         int did_output, type;
1436
1437         tmr = (struct sctp_timer *)t;
1438         inp = (struct sctp_inpcb *)tmr->ep;
1439         stcb = (struct sctp_tcb *)tmr->tcb;
1440         net = (struct sctp_nets *)tmr->net;
1441         CURVNET_SET((struct vnet *)tmr->vnet);
1442         did_output = 1;
1443
1444 #ifdef SCTP_AUDITING_ENABLED
1445         sctp_audit_log(0xF0, (uint8_t) tmr->type);
1446         sctp_auditing(3, inp, stcb, net);
1447 #endif
1448
1449         /* sanity checks... */
1450         if (tmr->self != (void *)tmr) {
1451                 /*
1452                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1453                  * (void *)tmr);
1454                  */
1455                 CURVNET_RESTORE();
1456                 return;
1457         }
1458         tmr->stopped_from = 0xa001;
1459         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1460                 /*
1461                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1462                  * tmr->type);
1463                  */
1464                 CURVNET_RESTORE();
1465                 return;
1466         }
1467         tmr->stopped_from = 0xa002;
1468         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1469                 CURVNET_RESTORE();
1470                 return;
1471         }
1472         /* if this is an iterator timeout, get the struct and clear inp */
1473         tmr->stopped_from = 0xa003;
1474         type = tmr->type;
1475         if (inp) {
1476                 SCTP_INP_INCR_REF(inp);
1477                 if ((inp->sctp_socket == NULL) &&
1478                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1479                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1480                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1481                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1482                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1483                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1484                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1485                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1486                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))
1487                     ) {
1488                         SCTP_INP_DECR_REF(inp);
1489                         CURVNET_RESTORE();
1490                         return;
1491                 }
1492         }
1493         tmr->stopped_from = 0xa004;
1494         if (stcb) {
1495                 atomic_add_int(&stcb->asoc.refcnt, 1);
1496                 if (stcb->asoc.state == 0) {
1497                         atomic_add_int(&stcb->asoc.refcnt, -1);
1498                         if (inp) {
1499                                 SCTP_INP_DECR_REF(inp);
1500                         }
1501                         CURVNET_RESTORE();
1502                         return;
1503                 }
1504         }
1505         tmr->stopped_from = 0xa005;
1506         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", tmr->type);
1507         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1508                 if (inp) {
1509                         SCTP_INP_DECR_REF(inp);
1510                 }
1511                 if (stcb) {
1512                         atomic_add_int(&stcb->asoc.refcnt, -1);
1513                 }
1514                 CURVNET_RESTORE();
1515                 return;
1516         }
1517         tmr->stopped_from = 0xa006;
1518
1519         if (stcb) {
1520                 SCTP_TCB_LOCK(stcb);
1521                 atomic_add_int(&stcb->asoc.refcnt, -1);
1522                 if ((tmr->type != SCTP_TIMER_TYPE_ASOCKILL) &&
1523                     ((stcb->asoc.state == 0) ||
1524                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1525                         SCTP_TCB_UNLOCK(stcb);
1526                         if (inp) {
1527                                 SCTP_INP_DECR_REF(inp);
1528                         }
1529                         CURVNET_RESTORE();
1530                         return;
1531                 }
1532         }
1533         /* record in stopped what t-o occured */
1534         tmr->stopped_from = tmr->type;
1535
1536         /* mark as being serviced now */
1537         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1538                 /*
1539                  * Callout has been rescheduled.
1540                  */
1541                 goto get_out;
1542         }
1543         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1544                 /*
1545                  * Not active, so no action.
1546                  */
1547                 goto get_out;
1548         }
1549         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1550
1551         /* call the handler for the appropriate timer type */
1552         switch (tmr->type) {
1553         case SCTP_TIMER_TYPE_ZERO_COPY:
1554                 if (inp == NULL) {
1555                         break;
1556                 }
1557                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1558                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
1559                 }
1560                 break;
1561         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1562                 if (inp == NULL) {
1563                         break;
1564                 }
1565                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1566                         SCTP_ZERO_COPY_SENDQ_EVENT(inp, inp->sctp_socket);
1567                 }
1568                 break;
1569         case SCTP_TIMER_TYPE_ADDR_WQ:
1570                 sctp_handle_addr_wq();
1571                 break;
1572         case SCTP_TIMER_TYPE_SEND:
1573                 if ((stcb == NULL) || (inp == NULL)) {
1574                         break;
1575                 }
1576                 SCTP_STAT_INCR(sctps_timodata);
1577                 stcb->asoc.timodata++;
1578                 stcb->asoc.num_send_timers_up--;
1579                 if (stcb->asoc.num_send_timers_up < 0) {
1580                         stcb->asoc.num_send_timers_up = 0;
1581                 }
1582                 SCTP_TCB_LOCK_ASSERT(stcb);
1583                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1584                         /* no need to unlock on tcb its gone */
1585
1586                         goto out_decr;
1587                 }
1588                 SCTP_TCB_LOCK_ASSERT(stcb);
1589 #ifdef SCTP_AUDITING_ENABLED
1590                 sctp_auditing(4, inp, stcb, net);
1591 #endif
1592                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1593                 if ((stcb->asoc.num_send_timers_up == 0) &&
1594                     (stcb->asoc.sent_queue_cnt > 0)) {
1595                         struct sctp_tmit_chunk *chk;
1596
1597                         /*
1598                          * safeguard. If there on some on the sent queue
1599                          * somewhere but no timers running something is
1600                          * wrong... so we start a timer on the first chunk
1601                          * on the send queue on whatever net it is sent to.
1602                          */
1603                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1604                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1605                             chk->whoTo);
1606                 }
1607                 break;
1608         case SCTP_TIMER_TYPE_INIT:
1609                 if ((stcb == NULL) || (inp == NULL)) {
1610                         break;
1611                 }
1612                 SCTP_STAT_INCR(sctps_timoinit);
1613                 stcb->asoc.timoinit++;
1614                 if (sctp_t1init_timer(inp, stcb, net)) {
1615                         /* no need to unlock on tcb its gone */
1616                         goto out_decr;
1617                 }
1618                 /* We do output but not here */
1619                 did_output = 0;
1620                 break;
1621         case SCTP_TIMER_TYPE_RECV:
1622                 if ((stcb == NULL) || (inp == NULL)) {
1623                         break;
1624                 }
1625                 SCTP_STAT_INCR(sctps_timosack);
1626                 stcb->asoc.timosack++;
1627                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1628 #ifdef SCTP_AUDITING_ENABLED
1629                 sctp_auditing(4, inp, stcb, net);
1630 #endif
1631                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1632                 break;
1633         case SCTP_TIMER_TYPE_SHUTDOWN:
1634                 if ((stcb == NULL) || (inp == NULL)) {
1635                         break;
1636                 }
1637                 if (sctp_shutdown_timer(inp, stcb, net)) {
1638                         /* no need to unlock on tcb its gone */
1639                         goto out_decr;
1640                 }
1641                 SCTP_STAT_INCR(sctps_timoshutdown);
1642                 stcb->asoc.timoshutdown++;
1643 #ifdef SCTP_AUDITING_ENABLED
1644                 sctp_auditing(4, inp, stcb, net);
1645 #endif
1646                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1647                 break;
1648         case SCTP_TIMER_TYPE_HEARTBEAT:
1649                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1650                         break;
1651                 }
1652                 SCTP_STAT_INCR(sctps_timoheartbeat);
1653                 stcb->asoc.timoheartbeat++;
1654                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1655                         /* no need to unlock on tcb its gone */
1656                         goto out_decr;
1657                 }
1658 #ifdef SCTP_AUDITING_ENABLED
1659                 sctp_auditing(4, inp, stcb, net);
1660 #endif
1661                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1662                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1663                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1664                 }
1665                 break;
1666         case SCTP_TIMER_TYPE_COOKIE:
1667                 if ((stcb == NULL) || (inp == NULL)) {
1668                         break;
1669                 }
1670                 if (sctp_cookie_timer(inp, stcb, net)) {
1671                         /* no need to unlock on tcb its gone */
1672                         goto out_decr;
1673                 }
1674                 SCTP_STAT_INCR(sctps_timocookie);
1675                 stcb->asoc.timocookie++;
1676 #ifdef SCTP_AUDITING_ENABLED
1677                 sctp_auditing(4, inp, stcb, net);
1678 #endif
1679                 /*
1680                  * We consider T3 and Cookie timer pretty much the same with
1681                  * respect to where from in chunk_output.
1682                  */
1683                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1684                 break;
1685         case SCTP_TIMER_TYPE_NEWCOOKIE:
1686                 {
1687                         struct timeval tv;
1688                         int i, secret;
1689
1690                         if (inp == NULL) {
1691                                 break;
1692                         }
1693                         SCTP_STAT_INCR(sctps_timosecret);
1694                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1695                         SCTP_INP_WLOCK(inp);
1696                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1697                         inp->sctp_ep.last_secret_number =
1698                             inp->sctp_ep.current_secret_number;
1699                         inp->sctp_ep.current_secret_number++;
1700                         if (inp->sctp_ep.current_secret_number >=
1701                             SCTP_HOW_MANY_SECRETS) {
1702                                 inp->sctp_ep.current_secret_number = 0;
1703                         }
1704                         secret = (int)inp->sctp_ep.current_secret_number;
1705                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1706                                 inp->sctp_ep.secret_key[secret][i] =
1707                                     sctp_select_initial_TSN(&inp->sctp_ep);
1708                         }
1709                         SCTP_INP_WUNLOCK(inp);
1710                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1711                 }
1712                 did_output = 0;
1713                 break;
1714         case SCTP_TIMER_TYPE_PATHMTURAISE:
1715                 if ((stcb == NULL) || (inp == NULL)) {
1716                         break;
1717                 }
1718                 SCTP_STAT_INCR(sctps_timopathmtu);
1719                 sctp_pathmtu_timer(inp, stcb, net);
1720                 did_output = 0;
1721                 break;
1722         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1723                 if ((stcb == NULL) || (inp == NULL)) {
1724                         break;
1725                 }
1726                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1727                         /* no need to unlock on tcb its gone */
1728                         goto out_decr;
1729                 }
1730                 SCTP_STAT_INCR(sctps_timoshutdownack);
1731                 stcb->asoc.timoshutdownack++;
1732 #ifdef SCTP_AUDITING_ENABLED
1733                 sctp_auditing(4, inp, stcb, net);
1734 #endif
1735                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1736                 break;
1737         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1738                 if ((stcb == NULL) || (inp == NULL)) {
1739                         break;
1740                 }
1741                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1742                 sctp_abort_an_association(inp, stcb, NULL, SCTP_SO_NOT_LOCKED);
1743                 /* no need to unlock on tcb its gone */
1744                 goto out_decr;
1745
1746         case SCTP_TIMER_TYPE_STRRESET:
1747                 if ((stcb == NULL) || (inp == NULL)) {
1748                         break;
1749                 }
1750                 if (sctp_strreset_timer(inp, stcb, net)) {
1751                         /* no need to unlock on tcb its gone */
1752                         goto out_decr;
1753                 }
1754                 SCTP_STAT_INCR(sctps_timostrmrst);
1755                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1756                 break;
1757         case SCTP_TIMER_TYPE_ASCONF:
1758                 if ((stcb == NULL) || (inp == NULL)) {
1759                         break;
1760                 }
1761                 if (sctp_asconf_timer(inp, stcb, net)) {
1762                         /* no need to unlock on tcb its gone */
1763                         goto out_decr;
1764                 }
1765                 SCTP_STAT_INCR(sctps_timoasconf);
1766 #ifdef SCTP_AUDITING_ENABLED
1767                 sctp_auditing(4, inp, stcb, net);
1768 #endif
1769                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1770                 break;
1771         case SCTP_TIMER_TYPE_PRIM_DELETED:
1772                 if ((stcb == NULL) || (inp == NULL)) {
1773                         break;
1774                 }
1775                 sctp_delete_prim_timer(inp, stcb, net);
1776                 SCTP_STAT_INCR(sctps_timodelprim);
1777                 break;
1778
1779         case SCTP_TIMER_TYPE_AUTOCLOSE:
1780                 if ((stcb == NULL) || (inp == NULL)) {
1781                         break;
1782                 }
1783                 SCTP_STAT_INCR(sctps_timoautoclose);
1784                 sctp_autoclose_timer(inp, stcb, net);
1785                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1786                 did_output = 0;
1787                 break;
1788         case SCTP_TIMER_TYPE_ASOCKILL:
1789                 if ((stcb == NULL) || (inp == NULL)) {
1790                         break;
1791                 }
1792                 SCTP_STAT_INCR(sctps_timoassockill);
1793                 /* Can we free it yet? */
1794                 SCTP_INP_DECR_REF(inp);
1795                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1796 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1797                 so = SCTP_INP_SO(inp);
1798                 atomic_add_int(&stcb->asoc.refcnt, 1);
1799                 SCTP_TCB_UNLOCK(stcb);
1800                 SCTP_SOCKET_LOCK(so, 1);
1801                 SCTP_TCB_LOCK(stcb);
1802                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1803 #endif
1804                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1805 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1806                 SCTP_SOCKET_UNLOCK(so, 1);
1807 #endif
1808                 /*
1809                  * free asoc, always unlocks (or destroy's) so prevent
1810                  * duplicate unlock or unlock of a free mtx :-0
1811                  */
1812                 stcb = NULL;
1813                 goto out_no_decr;
1814         case SCTP_TIMER_TYPE_INPKILL:
1815                 SCTP_STAT_INCR(sctps_timoinpkill);
1816                 if (inp == NULL) {
1817                         break;
1818                 }
1819                 /*
1820                  * special case, take away our increment since WE are the
1821                  * killer
1822                  */
1823                 SCTP_INP_DECR_REF(inp);
1824                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1825                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1826                     SCTP_CALLED_FROM_INPKILL_TIMER);
1827                 inp = NULL;
1828                 goto out_no_decr;
1829         default:
1830                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1831                     tmr->type);
1832                 break;
1833         }
1834 #ifdef SCTP_AUDITING_ENABLED
1835         sctp_audit_log(0xF1, (uint8_t) tmr->type);
1836         if (inp)
1837                 sctp_auditing(5, inp, stcb, net);
1838 #endif
1839         if ((did_output) && stcb) {
1840                 /*
1841                  * Now we need to clean up the control chunk chain if an
1842                  * ECNE is on it. It must be marked as UNSENT again so next
1843                  * call will continue to send it until such time that we get
1844                  * a CWR, to remove it. It is, however, less likely that we
1845                  * will find a ecn echo on the chain though.
1846                  */
1847                 sctp_fix_ecn_echo(&stcb->asoc);
1848         }
1849 get_out:
1850         if (stcb) {
1851                 SCTP_TCB_UNLOCK(stcb);
1852         }
1853 out_decr:
1854         if (inp) {
1855                 SCTP_INP_DECR_REF(inp);
1856         }
1857 out_no_decr:
1858         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type %d)\n",
1859             type);
1860         CURVNET_RESTORE();
1861 }
1862
1863 void
1864 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1865     struct sctp_nets *net)
1866 {
1867         uint32_t to_ticks;
1868         struct sctp_timer *tmr;
1869
1870         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1871                 return;
1872
1873         tmr = NULL;
1874         if (stcb) {
1875                 SCTP_TCB_LOCK_ASSERT(stcb);
1876         }
1877         switch (t_type) {
1878         case SCTP_TIMER_TYPE_ZERO_COPY:
1879                 tmr = &inp->sctp_ep.zero_copy_timer;
1880                 to_ticks = SCTP_ZERO_COPY_TICK_DELAY;
1881                 break;
1882         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1883                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
1884                 to_ticks = SCTP_ZERO_COPY_SENDQ_TICK_DELAY;
1885                 break;
1886         case SCTP_TIMER_TYPE_ADDR_WQ:
1887                 /* Only 1 tick away :-) */
1888                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
1889                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
1890                 break;
1891         case SCTP_TIMER_TYPE_SEND:
1892                 /* Here we use the RTO timer */
1893                 {
1894                         int rto_val;
1895
1896                         if ((stcb == NULL) || (net == NULL)) {
1897                                 return;
1898                         }
1899                         tmr = &net->rxt_timer;
1900                         if (net->RTO == 0) {
1901                                 rto_val = stcb->asoc.initial_rto;
1902                         } else {
1903                                 rto_val = net->RTO;
1904                         }
1905                         to_ticks = MSEC_TO_TICKS(rto_val);
1906                 }
1907                 break;
1908         case SCTP_TIMER_TYPE_INIT:
1909                 /*
1910                  * Here we use the INIT timer default usually about 1
1911                  * minute.
1912                  */
1913                 if ((stcb == NULL) || (net == NULL)) {
1914                         return;
1915                 }
1916                 tmr = &net->rxt_timer;
1917                 if (net->RTO == 0) {
1918                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1919                 } else {
1920                         to_ticks = MSEC_TO_TICKS(net->RTO);
1921                 }
1922                 break;
1923         case SCTP_TIMER_TYPE_RECV:
1924                 /*
1925                  * Here we use the Delayed-Ack timer value from the inp
1926                  * ususually about 200ms.
1927                  */
1928                 if (stcb == NULL) {
1929                         return;
1930                 }
1931                 tmr = &stcb->asoc.dack_timer;
1932                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
1933                 break;
1934         case SCTP_TIMER_TYPE_SHUTDOWN:
1935                 /* Here we use the RTO of the destination. */
1936                 if ((stcb == NULL) || (net == NULL)) {
1937                         return;
1938                 }
1939                 if (net->RTO == 0) {
1940                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1941                 } else {
1942                         to_ticks = MSEC_TO_TICKS(net->RTO);
1943                 }
1944                 tmr = &net->rxt_timer;
1945                 break;
1946         case SCTP_TIMER_TYPE_HEARTBEAT:
1947                 /*
1948                  * the net is used here so that we can add in the RTO. Even
1949                  * though we use a different timer. We also add the HB timer
1950                  * PLUS a random jitter.
1951                  */
1952                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
1953                         return;
1954                 } else {
1955                         uint32_t rndval;
1956                         uint32_t jitter;
1957
1958                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
1959                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
1960                                 return;
1961                         }
1962                         if (net->RTO == 0) {
1963                                 to_ticks = stcb->asoc.initial_rto;
1964                         } else {
1965                                 to_ticks = net->RTO;
1966                         }
1967                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
1968                         jitter = rndval % to_ticks;
1969                         if (jitter >= (to_ticks >> 1)) {
1970                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
1971                         } else {
1972                                 to_ticks = to_ticks - jitter;
1973                         }
1974                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1975                             !(net->dest_state & SCTP_ADDR_PF)) {
1976                                 to_ticks += net->heart_beat_delay;
1977                         }
1978                         /*
1979                          * Now we must convert the to_ticks that are now in
1980                          * ms to ticks.
1981                          */
1982                         to_ticks = MSEC_TO_TICKS(to_ticks);
1983                         tmr = &net->hb_timer;
1984                 }
1985                 break;
1986         case SCTP_TIMER_TYPE_COOKIE:
1987                 /*
1988                  * Here we can use the RTO timer from the network since one
1989                  * RTT was compelete. If a retran happened then we will be
1990                  * using the RTO initial value.
1991                  */
1992                 if ((stcb == NULL) || (net == NULL)) {
1993                         return;
1994                 }
1995                 if (net->RTO == 0) {
1996                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1997                 } else {
1998                         to_ticks = MSEC_TO_TICKS(net->RTO);
1999                 }
2000                 tmr = &net->rxt_timer;
2001                 break;
2002         case SCTP_TIMER_TYPE_NEWCOOKIE:
2003                 /*
2004                  * nothing needed but the endpoint here ususually about 60
2005                  * minutes.
2006                  */
2007                 if (inp == NULL) {
2008                         return;
2009                 }
2010                 tmr = &inp->sctp_ep.signature_change;
2011                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2012                 break;
2013         case SCTP_TIMER_TYPE_ASOCKILL:
2014                 if (stcb == NULL) {
2015                         return;
2016                 }
2017                 tmr = &stcb->asoc.strreset_timer;
2018                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2019                 break;
2020         case SCTP_TIMER_TYPE_INPKILL:
2021                 /*
2022                  * The inp is setup to die. We re-use the signature_chage
2023                  * timer since that has stopped and we are in the GONE
2024                  * state.
2025                  */
2026                 if (inp == NULL) {
2027                         return;
2028                 }
2029                 tmr = &inp->sctp_ep.signature_change;
2030                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2031                 break;
2032         case SCTP_TIMER_TYPE_PATHMTURAISE:
2033                 /*
2034                  * Here we use the value found in the EP for PMTU ususually
2035                  * about 10 minutes.
2036                  */
2037                 if ((stcb == NULL) || (inp == NULL)) {
2038                         return;
2039                 }
2040                 if (net == NULL) {
2041                         return;
2042                 }
2043                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2044                         return;
2045                 }
2046                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2047                 tmr = &net->pmtu_timer;
2048                 break;
2049         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2050                 /* Here we use the RTO of the destination */
2051                 if ((stcb == NULL) || (net == NULL)) {
2052                         return;
2053                 }
2054                 if (net->RTO == 0) {
2055                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2056                 } else {
2057                         to_ticks = MSEC_TO_TICKS(net->RTO);
2058                 }
2059                 tmr = &net->rxt_timer;
2060                 break;
2061         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2062                 /*
2063                  * Here we use the endpoints shutdown guard timer usually
2064                  * about 3 minutes.
2065                  */
2066                 if ((inp == NULL) || (stcb == NULL)) {
2067                         return;
2068                 }
2069                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2070                 tmr = &stcb->asoc.shut_guard_timer;
2071                 break;
2072         case SCTP_TIMER_TYPE_STRRESET:
2073                 /*
2074                  * Here the timer comes from the stcb but its value is from
2075                  * the net's RTO.
2076                  */
2077                 if ((stcb == NULL) || (net == NULL)) {
2078                         return;
2079                 }
2080                 if (net->RTO == 0) {
2081                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2082                 } else {
2083                         to_ticks = MSEC_TO_TICKS(net->RTO);
2084                 }
2085                 tmr = &stcb->asoc.strreset_timer;
2086                 break;
2087         case SCTP_TIMER_TYPE_ASCONF:
2088                 /*
2089                  * Here the timer comes from the stcb but its value is from
2090                  * the net's RTO.
2091                  */
2092                 if ((stcb == NULL) || (net == NULL)) {
2093                         return;
2094                 }
2095                 if (net->RTO == 0) {
2096                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2097                 } else {
2098                         to_ticks = MSEC_TO_TICKS(net->RTO);
2099                 }
2100                 tmr = &stcb->asoc.asconf_timer;
2101                 break;
2102         case SCTP_TIMER_TYPE_PRIM_DELETED:
2103                 if ((stcb == NULL) || (net != NULL)) {
2104                         return;
2105                 }
2106                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2107                 tmr = &stcb->asoc.delete_prim_timer;
2108                 break;
2109         case SCTP_TIMER_TYPE_AUTOCLOSE:
2110                 if (stcb == NULL) {
2111                         return;
2112                 }
2113                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2114                         /*
2115                          * Really an error since stcb is NOT set to
2116                          * autoclose
2117                          */
2118                         return;
2119                 }
2120                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2121                 tmr = &stcb->asoc.autoclose_timer;
2122                 break;
2123         default:
2124                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2125                     __FUNCTION__, t_type);
2126                 return;
2127                 break;
2128         }
2129         if ((to_ticks <= 0) || (tmr == NULL)) {
2130                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2131                     __FUNCTION__, t_type, to_ticks, (void *)tmr);
2132                 return;
2133         }
2134         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2135                 /*
2136                  * we do NOT allow you to have it already running. if it is
2137                  * we leave the current one up unchanged
2138                  */
2139                 return;
2140         }
2141         /* At this point we can proceed */
2142         if (t_type == SCTP_TIMER_TYPE_SEND) {
2143                 stcb->asoc.num_send_timers_up++;
2144         }
2145         tmr->stopped_from = 0;
2146         tmr->type = t_type;
2147         tmr->ep = (void *)inp;
2148         tmr->tcb = (void *)stcb;
2149         tmr->net = (void *)net;
2150         tmr->self = (void *)tmr;
2151         tmr->vnet = (void *)curvnet;
2152         tmr->ticks = sctp_get_tick_count();
2153         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2154         return;
2155 }
2156
2157 void
2158 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2159     struct sctp_nets *net, uint32_t from)
2160 {
2161         struct sctp_timer *tmr;
2162
2163         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2164             (inp == NULL))
2165                 return;
2166
2167         tmr = NULL;
2168         if (stcb) {
2169                 SCTP_TCB_LOCK_ASSERT(stcb);
2170         }
2171         switch (t_type) {
2172         case SCTP_TIMER_TYPE_ZERO_COPY:
2173                 tmr = &inp->sctp_ep.zero_copy_timer;
2174                 break;
2175         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
2176                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
2177                 break;
2178         case SCTP_TIMER_TYPE_ADDR_WQ:
2179                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2180                 break;
2181         case SCTP_TIMER_TYPE_SEND:
2182                 if ((stcb == NULL) || (net == NULL)) {
2183                         return;
2184                 }
2185                 tmr = &net->rxt_timer;
2186                 break;
2187         case SCTP_TIMER_TYPE_INIT:
2188                 if ((stcb == NULL) || (net == NULL)) {
2189                         return;
2190                 }
2191                 tmr = &net->rxt_timer;
2192                 break;
2193         case SCTP_TIMER_TYPE_RECV:
2194                 if (stcb == NULL) {
2195                         return;
2196                 }
2197                 tmr = &stcb->asoc.dack_timer;
2198                 break;
2199         case SCTP_TIMER_TYPE_SHUTDOWN:
2200                 if ((stcb == NULL) || (net == NULL)) {
2201                         return;
2202                 }
2203                 tmr = &net->rxt_timer;
2204                 break;
2205         case SCTP_TIMER_TYPE_HEARTBEAT:
2206                 if ((stcb == NULL) || (net == NULL)) {
2207                         return;
2208                 }
2209                 tmr = &net->hb_timer;
2210                 break;
2211         case SCTP_TIMER_TYPE_COOKIE:
2212                 if ((stcb == NULL) || (net == NULL)) {
2213                         return;
2214                 }
2215                 tmr = &net->rxt_timer;
2216                 break;
2217         case SCTP_TIMER_TYPE_NEWCOOKIE:
2218                 /* nothing needed but the endpoint here */
2219                 tmr = &inp->sctp_ep.signature_change;
2220                 /*
2221                  * We re-use the newcookie timer for the INP kill timer. We
2222                  * must assure that we do not kill it by accident.
2223                  */
2224                 break;
2225         case SCTP_TIMER_TYPE_ASOCKILL:
2226                 /*
2227                  * Stop the asoc kill timer.
2228                  */
2229                 if (stcb == NULL) {
2230                         return;
2231                 }
2232                 tmr = &stcb->asoc.strreset_timer;
2233                 break;
2234
2235         case SCTP_TIMER_TYPE_INPKILL:
2236                 /*
2237                  * The inp is setup to die. We re-use the signature_chage
2238                  * timer since that has stopped and we are in the GONE
2239                  * state.
2240                  */
2241                 tmr = &inp->sctp_ep.signature_change;
2242                 break;
2243         case SCTP_TIMER_TYPE_PATHMTURAISE:
2244                 if ((stcb == NULL) || (net == NULL)) {
2245                         return;
2246                 }
2247                 tmr = &net->pmtu_timer;
2248                 break;
2249         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2250                 if ((stcb == NULL) || (net == NULL)) {
2251                         return;
2252                 }
2253                 tmr = &net->rxt_timer;
2254                 break;
2255         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2256                 if (stcb == NULL) {
2257                         return;
2258                 }
2259                 tmr = &stcb->asoc.shut_guard_timer;
2260                 break;
2261         case SCTP_TIMER_TYPE_STRRESET:
2262                 if (stcb == NULL) {
2263                         return;
2264                 }
2265                 tmr = &stcb->asoc.strreset_timer;
2266                 break;
2267         case SCTP_TIMER_TYPE_ASCONF:
2268                 if (stcb == NULL) {
2269                         return;
2270                 }
2271                 tmr = &stcb->asoc.asconf_timer;
2272                 break;
2273         case SCTP_TIMER_TYPE_PRIM_DELETED:
2274                 if (stcb == NULL) {
2275                         return;
2276                 }
2277                 tmr = &stcb->asoc.delete_prim_timer;
2278                 break;
2279         case SCTP_TIMER_TYPE_AUTOCLOSE:
2280                 if (stcb == NULL) {
2281                         return;
2282                 }
2283                 tmr = &stcb->asoc.autoclose_timer;
2284                 break;
2285         default:
2286                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2287                     __FUNCTION__, t_type);
2288                 break;
2289         }
2290         if (tmr == NULL) {
2291                 return;
2292         }
2293         if ((tmr->type != t_type) && tmr->type) {
2294                 /*
2295                  * Ok we have a timer that is under joint use. Cookie timer
2296                  * per chance with the SEND timer. We therefore are NOT
2297                  * running the timer that the caller wants stopped.  So just
2298                  * return.
2299                  */
2300                 return;
2301         }
2302         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2303                 stcb->asoc.num_send_timers_up--;
2304                 if (stcb->asoc.num_send_timers_up < 0) {
2305                         stcb->asoc.num_send_timers_up = 0;
2306                 }
2307         }
2308         tmr->self = NULL;
2309         tmr->stopped_from = from;
2310         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2311         return;
2312 }
2313
2314 uint32_t
2315 sctp_calculate_len(struct mbuf *m)
2316 {
2317         uint32_t tlen = 0;
2318         struct mbuf *at;
2319
2320         at = m;
2321         while (at) {
2322                 tlen += SCTP_BUF_LEN(at);
2323                 at = SCTP_BUF_NEXT(at);
2324         }
2325         return (tlen);
2326 }
2327
2328 void
2329 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2330     struct sctp_association *asoc, uint32_t mtu)
2331 {
2332         /*
2333          * Reset the P-MTU size on this association, this involves changing
2334          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2335          * allow the DF flag to be cleared.
2336          */
2337         struct sctp_tmit_chunk *chk;
2338         unsigned int eff_mtu, ovh;
2339
2340         asoc->smallest_mtu = mtu;
2341         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2342                 ovh = SCTP_MIN_OVERHEAD;
2343         } else {
2344                 ovh = SCTP_MIN_V4_OVERHEAD;
2345         }
2346         eff_mtu = mtu - ovh;
2347         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2348                 if (chk->send_size > eff_mtu) {
2349                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2350                 }
2351         }
2352         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2353                 if (chk->send_size > eff_mtu) {
2354                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2355                 }
2356         }
2357 }
2358
2359
2360 /*
2361  * given an association and starting time of the current RTT period return
2362  * RTO in number of msecs net should point to the current network
2363  */
2364
2365 uint32_t
2366 sctp_calculate_rto(struct sctp_tcb *stcb,
2367     struct sctp_association *asoc,
2368     struct sctp_nets *net,
2369     struct timeval *told,
2370     int safe, int rtt_from_sack)
2371 {
2372         /*-
2373          * given an association and the starting time of the current RTT
2374          * period (in value1/value2) return RTO in number of msecs.
2375          */
2376         int32_t rtt;            /* RTT in ms */
2377         uint32_t new_rto;
2378         int first_measure = 0;
2379         struct timeval now, then, *old;
2380
2381         /* Copy it out for sparc64 */
2382         if (safe == sctp_align_unsafe_makecopy) {
2383                 old = &then;
2384                 memcpy(&then, told, sizeof(struct timeval));
2385         } else if (safe == sctp_align_safe_nocopy) {
2386                 old = told;
2387         } else {
2388                 /* error */
2389                 SCTP_PRINTF("Huh, bad rto calc call\n");
2390                 return (0);
2391         }
2392         /************************/
2393         /* 1. calculate new RTT */
2394         /************************/
2395         /* get the current time */
2396         if (stcb->asoc.use_precise_time) {
2397                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2398         } else {
2399                 (void)SCTP_GETTIME_TIMEVAL(&now);
2400         }
2401         timevalsub(&now, old);
2402         /* store the current RTT in us */
2403         net->rtt = (uint64_t) 1000000 *(uint64_t) now.tv_sec +
2404                 (uint64_t) now.tv_usec;
2405
2406         /* compute rtt in ms */
2407         rtt = (int32_t) (net->rtt / 1000);
2408         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2409                 /*
2410                  * Tell the CC module that a new update has just occurred
2411                  * from a sack
2412                  */
2413                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2414         }
2415         /*
2416          * Do we need to determine the lan? We do this only on sacks i.e.
2417          * RTT being determined from data not non-data (HB/INIT->INITACK).
2418          */
2419         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2420             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2421                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2422                         net->lan_type = SCTP_LAN_INTERNET;
2423                 } else {
2424                         net->lan_type = SCTP_LAN_LOCAL;
2425                 }
2426         }
2427         /***************************/
2428         /* 2. update RTTVAR & SRTT */
2429         /***************************/
2430         /*-
2431          * Compute the scaled average lastsa and the
2432          * scaled variance lastsv as described in van Jacobson
2433          * Paper "Congestion Avoidance and Control", Annex A.
2434          *
2435          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2436          * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar
2437          */
2438         if (net->RTO_measured) {
2439                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2440                 net->lastsa += rtt;
2441                 if (rtt < 0) {
2442                         rtt = -rtt;
2443                 }
2444                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2445                 net->lastsv += rtt;
2446                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2447                         rto_logging(net, SCTP_LOG_RTTVAR);
2448                 }
2449         } else {
2450                 /* First RTO measurment */
2451                 net->RTO_measured = 1;
2452                 first_measure = 1;
2453                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2454                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2455                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2456                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2457                 }
2458         }
2459         if (net->lastsv == 0) {
2460                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2461         }
2462         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2463         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2464             (stcb->asoc.sat_network_lockout == 0)) {
2465                 stcb->asoc.sat_network = 1;
2466         } else if ((!first_measure) && stcb->asoc.sat_network) {
2467                 stcb->asoc.sat_network = 0;
2468                 stcb->asoc.sat_network_lockout = 1;
2469         }
2470         /* bound it, per C6/C7 in Section 5.3.1 */
2471         if (new_rto < stcb->asoc.minrto) {
2472                 new_rto = stcb->asoc.minrto;
2473         }
2474         if (new_rto > stcb->asoc.maxrto) {
2475                 new_rto = stcb->asoc.maxrto;
2476         }
2477         /* we are now returning the RTO */
2478         return (new_rto);
2479 }
2480
2481 /*
2482  * return a pointer to a contiguous piece of data from the given mbuf chain
2483  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2484  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2485  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2486  */
2487 caddr_t
2488 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
2489 {
2490         uint32_t count;
2491         uint8_t *ptr;
2492
2493         ptr = in_ptr;
2494         if ((off < 0) || (len <= 0))
2495                 return (NULL);
2496
2497         /* find the desired start location */
2498         while ((m != NULL) && (off > 0)) {
2499                 if (off < SCTP_BUF_LEN(m))
2500                         break;
2501                 off -= SCTP_BUF_LEN(m);
2502                 m = SCTP_BUF_NEXT(m);
2503         }
2504         if (m == NULL)
2505                 return (NULL);
2506
2507         /* is the current mbuf large enough (eg. contiguous)? */
2508         if ((SCTP_BUF_LEN(m) - off) >= len) {
2509                 return (mtod(m, caddr_t)+off);
2510         } else {
2511                 /* else, it spans more than one mbuf, so save a temp copy... */
2512                 while ((m != NULL) && (len > 0)) {
2513                         count = min(SCTP_BUF_LEN(m) - off, len);
2514                         bcopy(mtod(m, caddr_t)+off, ptr, count);
2515                         len -= count;
2516                         ptr += count;
2517                         off = 0;
2518                         m = SCTP_BUF_NEXT(m);
2519                 }
2520                 if ((m == NULL) && (len > 0))
2521                         return (NULL);
2522                 else
2523                         return ((caddr_t)in_ptr);
2524         }
2525 }
2526
2527
2528
2529 struct sctp_paramhdr *
2530 sctp_get_next_param(struct mbuf *m,
2531     int offset,
2532     struct sctp_paramhdr *pull,
2533     int pull_limit)
2534 {
2535         /* This just provides a typed signature to Peter's Pull routine */
2536         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2537             (uint8_t *) pull));
2538 }
2539
2540
2541 struct mbuf *
2542 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2543 {
2544         struct mbuf *m_last;
2545         caddr_t dp;
2546
2547         if (padlen > 3) {
2548                 return (NULL);
2549         }
2550         if (padlen <= M_TRAILINGSPACE(m)) {
2551                 /*
2552                  * The easy way. We hope the majority of the time we hit
2553                  * here :)
2554                  */
2555                 m_last = m;
2556         } else {
2557                 /* Hard way we must grow the mbuf chain */
2558                 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
2559                 if (m_last == NULL) {
2560                         return (NULL);
2561                 }
2562                 SCTP_BUF_LEN(m_last) = 0;
2563                 SCTP_BUF_NEXT(m_last) = NULL;
2564                 SCTP_BUF_NEXT(m) = m_last;
2565         }
2566         dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
2567         SCTP_BUF_LEN(m_last) += padlen;
2568         memset(dp, 0, padlen);
2569         return (m_last);
2570 }
2571
2572 struct mbuf *
2573 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2574 {
2575         /* find the last mbuf in chain and pad it */
2576         struct mbuf *m_at;
2577
2578         if (last_mbuf != NULL) {
2579                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2580         } else {
2581                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
2582                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2583                                 return (sctp_add_pad_tombuf(m_at, padval));
2584                         }
2585                 }
2586         }
2587         return (NULL);
2588 }
2589
2590 static void
2591 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
2592     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
2593 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2594     SCTP_UNUSED
2595 #endif
2596 )
2597 {
2598         struct mbuf *m_notify;
2599         struct sctp_assoc_change *sac;
2600         struct sctp_queued_to_read *control;
2601         size_t notif_len, abort_len;
2602         unsigned int i;
2603
2604 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2605         struct socket *so;
2606
2607 #endif
2608
2609         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2610                 notif_len = sizeof(struct sctp_assoc_change);
2611                 if (abort != NULL) {
2612                         abort_len = ntohs(abort->ch.chunk_length);
2613                 } else {
2614                         abort_len = 0;
2615                 }
2616                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2617                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
2618                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2619                         notif_len += abort_len;
2620                 }
2621                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2622                 if (m_notify == NULL) {
2623                         /* Retry with smaller value. */
2624                         notif_len = sizeof(struct sctp_assoc_change);
2625                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2626                         if (m_notify == NULL) {
2627                                 goto set_error;
2628                         }
2629                 }
2630                 SCTP_BUF_NEXT(m_notify) = NULL;
2631                 sac = mtod(m_notify, struct sctp_assoc_change *);
2632                 memset(sac, 0, notif_len);
2633                 sac->sac_type = SCTP_ASSOC_CHANGE;
2634                 sac->sac_flags = 0;
2635                 sac->sac_length = sizeof(struct sctp_assoc_change);
2636                 sac->sac_state = state;
2637                 sac->sac_error = error;
2638                 /* XXX verify these stream counts */
2639                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2640                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
2641                 sac->sac_assoc_id = sctp_get_associd(stcb);
2642                 if (notif_len > sizeof(struct sctp_assoc_change)) {
2643                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2644                                 i = 0;
2645                                 if (stcb->asoc.prsctp_supported == 1) {
2646                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2647                                 }
2648                                 if (stcb->asoc.auth_supported == 1) {
2649                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2650                                 }
2651                                 if (stcb->asoc.asconf_supported == 1) {
2652                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2653                                 }
2654                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2655                                 if (stcb->asoc.reconfig_supported == 1) {
2656                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2657                                 }
2658                                 sac->sac_length += i;
2659                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2660                                 memcpy(sac->sac_info, abort, abort_len);
2661                                 sac->sac_length += abort_len;
2662                         }
2663                 }
2664                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
2665                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2666                     0, 0, stcb->asoc.context, 0, 0, 0,
2667                     m_notify);
2668                 if (control != NULL) {
2669                         control->length = SCTP_BUF_LEN(m_notify);
2670                         /* not that we need this */
2671                         control->tail_mbuf = m_notify;
2672                         control->spec_flags = M_NOTIFICATION;
2673                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2674                             control,
2675                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2676                             so_locked);
2677                 } else {
2678                         sctp_m_freem(m_notify);
2679                 }
2680         }
2681         /*
2682          * For 1-to-1 style sockets, we send up and error when an ABORT
2683          * comes in.
2684          */
2685 set_error:
2686         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2687             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2688             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2689                 SOCK_LOCK(stcb->sctp_socket);
2690                 if (from_peer) {
2691                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
2692                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2693                                 stcb->sctp_socket->so_error = ECONNREFUSED;
2694                         } else {
2695                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2696                                 stcb->sctp_socket->so_error = ECONNRESET;
2697                         }
2698                 } else {
2699                         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) ||
2700                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
2701                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
2702                                 stcb->sctp_socket->so_error = ETIMEDOUT;
2703                         } else {
2704                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
2705                                 stcb->sctp_socket->so_error = ECONNABORTED;
2706                         }
2707                 }
2708         }
2709         /* Wake ANY sleepers */
2710 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2711         so = SCTP_INP_SO(stcb->sctp_ep);
2712         if (!so_locked) {
2713                 atomic_add_int(&stcb->asoc.refcnt, 1);
2714                 SCTP_TCB_UNLOCK(stcb);
2715                 SCTP_SOCKET_LOCK(so, 1);
2716                 SCTP_TCB_LOCK(stcb);
2717                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2718                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2719                         SCTP_SOCKET_UNLOCK(so, 1);
2720                         return;
2721                 }
2722         }
2723 #endif
2724         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2725             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2726             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2727                 socantrcvmore_locked(stcb->sctp_socket);
2728         }
2729         sorwakeup(stcb->sctp_socket);
2730         sowwakeup(stcb->sctp_socket);
2731 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2732         if (!so_locked) {
2733                 SCTP_SOCKET_UNLOCK(so, 1);
2734         }
2735 #endif
2736 }
2737
2738 static void
2739 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2740     struct sockaddr *sa, uint32_t error)
2741 {
2742         struct mbuf *m_notify;
2743         struct sctp_paddr_change *spc;
2744         struct sctp_queued_to_read *control;
2745
2746         if ((stcb == NULL) ||
2747             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2748                 /* event not enabled */
2749                 return;
2750         }
2751         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
2752         if (m_notify == NULL)
2753                 return;
2754         SCTP_BUF_LEN(m_notify) = 0;
2755         spc = mtod(m_notify, struct sctp_paddr_change *);
2756         memset(spc, 0, sizeof(struct sctp_paddr_change));
2757         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2758         spc->spc_flags = 0;
2759         spc->spc_length = sizeof(struct sctp_paddr_change);
2760         switch (sa->sa_family) {
2761 #ifdef INET
2762         case AF_INET:
2763 #ifdef INET6
2764                 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
2765                         in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
2766                             (struct sockaddr_in6 *)&spc->spc_aaddr);
2767                 } else {
2768                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2769                 }
2770 #else
2771                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2772 #endif
2773                 break;
2774 #endif
2775 #ifdef INET6
2776         case AF_INET6:
2777                 {
2778                         struct sockaddr_in6 *sin6;
2779
2780                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2781
2782                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2783                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2784                                 if (sin6->sin6_scope_id == 0) {
2785                                         /* recover scope_id for user */
2786                                         (void)sa6_recoverscope(sin6);
2787                                 } else {
2788                                         /* clear embedded scope_id for user */
2789                                         in6_clearscope(&sin6->sin6_addr);
2790                                 }
2791                         }
2792                         break;
2793                 }
2794 #endif
2795         default:
2796                 /* TSNH */
2797                 break;
2798         }
2799         spc->spc_state = state;
2800         spc->spc_error = error;
2801         spc->spc_assoc_id = sctp_get_associd(stcb);
2802
2803         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2804         SCTP_BUF_NEXT(m_notify) = NULL;
2805
2806         /* append to socket */
2807         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2808             0, 0, stcb->asoc.context, 0, 0, 0,
2809             m_notify);
2810         if (control == NULL) {
2811                 /* no memory */
2812                 sctp_m_freem(m_notify);
2813                 return;
2814         }
2815         control->length = SCTP_BUF_LEN(m_notify);
2816         control->spec_flags = M_NOTIFICATION;
2817         /* not that we need this */
2818         control->tail_mbuf = m_notify;
2819         sctp_add_to_readq(stcb->sctp_ep, stcb,
2820             control,
2821             &stcb->sctp_socket->so_rcv, 1,
2822             SCTP_READ_LOCK_NOT_HELD,
2823             SCTP_SO_NOT_LOCKED);
2824 }
2825
2826
2827 static void
2828 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
2829     struct sctp_tmit_chunk *chk, int so_locked
2830 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2831     SCTP_UNUSED
2832 #endif
2833 )
2834 {
2835         struct mbuf *m_notify;
2836         struct sctp_send_failed *ssf;
2837         struct sctp_send_failed_event *ssfe;
2838         struct sctp_queued_to_read *control;
2839         int length;
2840
2841         if ((stcb == NULL) ||
2842             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2843             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2844                 /* event not enabled */
2845                 return;
2846         }
2847         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2848                 length = sizeof(struct sctp_send_failed_event);
2849         } else {
2850                 length = sizeof(struct sctp_send_failed);
2851         }
2852         m_notify = sctp_get_mbuf_for_msg(length, 0, M_NOWAIT, 1, MT_DATA);
2853         if (m_notify == NULL)
2854                 /* no space left */
2855                 return;
2856         SCTP_BUF_LEN(m_notify) = 0;
2857         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2858                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2859                 memset(ssfe, 0, length);
2860                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2861                 if (sent) {
2862                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2863                 } else {
2864                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2865                 }
2866                 length += chk->send_size;
2867                 length -= sizeof(struct sctp_data_chunk);
2868                 ssfe->ssfe_length = length;
2869                 ssfe->ssfe_error = error;
2870                 /* not exactly what the user sent in, but should be close :) */
2871                 ssfe->ssfe_info.snd_sid = chk->rec.data.stream_number;
2872                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
2873                 ssfe->ssfe_info.snd_ppid = chk->rec.data.payloadtype;
2874                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
2875                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2876                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2877                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event);
2878         } else {
2879                 ssf = mtod(m_notify, struct sctp_send_failed *);
2880                 memset(ssf, 0, length);
2881                 ssf->ssf_type = SCTP_SEND_FAILED;
2882                 if (sent) {
2883                         ssf->ssf_flags = SCTP_DATA_SENT;
2884                 } else {
2885                         ssf->ssf_flags = SCTP_DATA_UNSENT;
2886                 }
2887                 length += chk->send_size;
2888                 length -= sizeof(struct sctp_data_chunk);
2889                 ssf->ssf_length = length;
2890                 ssf->ssf_error = error;
2891                 /* not exactly what the user sent in, but should be close :) */
2892                 bzero(&ssf->ssf_info, sizeof(ssf->ssf_info));
2893                 ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number;
2894                 ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq;
2895                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2896                 ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype;
2897                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
2898                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2899                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2900                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
2901         }
2902         if (chk->data) {
2903                 /*
2904                  * trim off the sctp chunk header(it should be there)
2905                  */
2906                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
2907                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
2908                         sctp_mbuf_crush(chk->data);
2909                         chk->send_size -= sizeof(struct sctp_data_chunk);
2910                 }
2911         }
2912         SCTP_BUF_NEXT(m_notify) = chk->data;
2913         /* Steal off the mbuf */
2914         chk->data = NULL;
2915         /*
2916          * For this case, we check the actual socket buffer, since the assoc
2917          * is going away we don't want to overfill the socket buffer for a
2918          * non-reader
2919          */
2920         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
2921                 sctp_m_freem(m_notify);
2922                 return;
2923         }
2924         /* append to socket */
2925         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2926             0, 0, stcb->asoc.context, 0, 0, 0,
2927             m_notify);
2928         if (control == NULL) {
2929                 /* no memory */
2930                 sctp_m_freem(m_notify);
2931                 return;
2932         }
2933         control->spec_flags = M_NOTIFICATION;
2934         sctp_add_to_readq(stcb->sctp_ep, stcb,
2935             control,
2936             &stcb->sctp_socket->so_rcv, 1,
2937             SCTP_READ_LOCK_NOT_HELD,
2938             so_locked);
2939 }
2940
2941
2942 static void
2943 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
2944     struct sctp_stream_queue_pending *sp, int so_locked
2945 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2946     SCTP_UNUSED
2947 #endif
2948 )
2949 {
2950         struct mbuf *m_notify;
2951         struct sctp_send_failed *ssf;
2952         struct sctp_send_failed_event *ssfe;
2953         struct sctp_queued_to_read *control;
2954         int length;
2955
2956         if ((stcb == NULL) ||
2957             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2958             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2959                 /* event not enabled */
2960                 return;
2961         }
2962         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2963                 length = sizeof(struct sctp_send_failed_event);
2964         } else {
2965                 length = sizeof(struct sctp_send_failed);
2966         }
2967         m_notify = sctp_get_mbuf_for_msg(length, 0, M_NOWAIT, 1, MT_DATA);
2968         if (m_notify == NULL) {
2969                 /* no space left */
2970                 return;
2971         }
2972         SCTP_BUF_LEN(m_notify) = 0;
2973         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2974                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2975                 memset(ssfe, 0, length);
2976                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2977                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2978                 length += sp->length;
2979                 ssfe->ssfe_length = length;
2980                 ssfe->ssfe_error = error;
2981                 /* not exactly what the user sent in, but should be close :) */
2982                 ssfe->ssfe_info.snd_sid = sp->stream;
2983                 if (sp->some_taken) {
2984                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
2985                 } else {
2986                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
2987                 }
2988                 ssfe->ssfe_info.snd_ppid = sp->ppid;
2989                 ssfe->ssfe_info.snd_context = sp->context;
2990                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2991                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2992                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event);
2993         } else {
2994                 ssf = mtod(m_notify, struct sctp_send_failed *);
2995                 memset(ssf, 0, length);
2996                 ssf->ssf_type = SCTP_SEND_FAILED;
2997                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2998                 length += sp->length;
2999                 ssf->ssf_length = length;
3000                 ssf->ssf_error = error;
3001                 /* not exactly what the user sent in, but should be close :) */
3002                 ssf->ssf_info.sinfo_stream = sp->stream;
3003                 ssf->ssf_info.sinfo_ssn = 0;
3004                 if (sp->some_taken) {
3005                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3006                 } else {
3007                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3008                 }
3009                 ssf->ssf_info.sinfo_ppid = sp->ppid;
3010                 ssf->ssf_info.sinfo_context = sp->context;
3011                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3012                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3013                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
3014         }
3015         SCTP_BUF_NEXT(m_notify) = sp->data;
3016
3017         /* Steal off the mbuf */
3018         sp->data = NULL;
3019         /*
3020          * For this case, we check the actual socket buffer, since the assoc
3021          * is going away we don't want to overfill the socket buffer for a
3022          * non-reader
3023          */
3024         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3025                 sctp_m_freem(m_notify);
3026                 return;
3027         }
3028         /* append to socket */
3029         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3030             0, 0, stcb->asoc.context, 0, 0, 0,
3031             m_notify);
3032         if (control == NULL) {
3033                 /* no memory */
3034                 sctp_m_freem(m_notify);
3035                 return;
3036         }
3037         control->spec_flags = M_NOTIFICATION;
3038         sctp_add_to_readq(stcb->sctp_ep, stcb,
3039             control,
3040             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3041 }
3042
3043
3044
3045 static void
3046 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3047 {
3048         struct mbuf *m_notify;
3049         struct sctp_adaptation_event *sai;
3050         struct sctp_queued_to_read *control;
3051
3052         if ((stcb == NULL) ||
3053             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3054                 /* event not enabled */
3055                 return;
3056         }
3057         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3058         if (m_notify == NULL)
3059                 /* no space left */
3060                 return;
3061         SCTP_BUF_LEN(m_notify) = 0;
3062         sai = mtod(m_notify, struct sctp_adaptation_event *);
3063         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3064         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3065         sai->sai_flags = 0;
3066         sai->sai_length = sizeof(struct sctp_adaptation_event);
3067         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3068         sai->sai_assoc_id = sctp_get_associd(stcb);
3069
3070         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3071         SCTP_BUF_NEXT(m_notify) = NULL;
3072
3073         /* append to socket */
3074         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3075             0, 0, stcb->asoc.context, 0, 0, 0,
3076             m_notify);
3077         if (control == NULL) {
3078                 /* no memory */
3079                 sctp_m_freem(m_notify);
3080                 return;
3081         }
3082         control->length = SCTP_BUF_LEN(m_notify);
3083         control->spec_flags = M_NOTIFICATION;
3084         /* not that we need this */
3085         control->tail_mbuf = m_notify;
3086         sctp_add_to_readq(stcb->sctp_ep, stcb,
3087             control,
3088             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3089 }
3090
3091 /* This always must be called with the read-queue LOCKED in the INP */
3092 static void
3093 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3094     uint32_t val, int so_locked
3095 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3096     SCTP_UNUSED
3097 #endif
3098 )
3099 {
3100         struct mbuf *m_notify;
3101         struct sctp_pdapi_event *pdapi;
3102         struct sctp_queued_to_read *control;
3103         struct sockbuf *sb;
3104
3105         if ((stcb == NULL) ||
3106             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3107                 /* event not enabled */
3108                 return;
3109         }
3110         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3111                 return;
3112         }
3113         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3114         if (m_notify == NULL)
3115                 /* no space left */
3116                 return;
3117         SCTP_BUF_LEN(m_notify) = 0;
3118         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3119         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3120         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3121         pdapi->pdapi_flags = 0;
3122         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3123         pdapi->pdapi_indication = error;
3124         pdapi->pdapi_stream = (val >> 16);
3125         pdapi->pdapi_seq = (val & 0x0000ffff);
3126         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3127
3128         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3129         SCTP_BUF_NEXT(m_notify) = NULL;
3130         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3131             0, 0, stcb->asoc.context, 0, 0, 0,
3132             m_notify);
3133         if (control == NULL) {
3134                 /* no memory */
3135                 sctp_m_freem(m_notify);
3136                 return;
3137         }
3138         control->spec_flags = M_NOTIFICATION;
3139         control->length = SCTP_BUF_LEN(m_notify);
3140         /* not that we need this */
3141         control->tail_mbuf = m_notify;
3142         control->held_length = 0;
3143         control->length = 0;
3144         sb = &stcb->sctp_socket->so_rcv;
3145         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3146                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3147         }
3148         sctp_sballoc(stcb, sb, m_notify);
3149         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3150                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3151         }
3152         atomic_add_int(&control->length, SCTP_BUF_LEN(m_notify));
3153         control->end_added = 1;
3154         if (stcb->asoc.control_pdapi)
3155                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3156         else {
3157                 /* we really should not see this case */
3158                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3159         }
3160         if (stcb->sctp_ep && stcb->sctp_socket) {
3161                 /* This should always be the case */
3162 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3163                 struct socket *so;
3164
3165                 so = SCTP_INP_SO(stcb->sctp_ep);
3166                 if (!so_locked) {
3167                         atomic_add_int(&stcb->asoc.refcnt, 1);
3168                         SCTP_TCB_UNLOCK(stcb);
3169                         SCTP_SOCKET_LOCK(so, 1);
3170                         SCTP_TCB_LOCK(stcb);
3171                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3172                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3173                                 SCTP_SOCKET_UNLOCK(so, 1);
3174                                 return;
3175                         }
3176                 }
3177 #endif
3178                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3179 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3180                 if (!so_locked) {
3181                         SCTP_SOCKET_UNLOCK(so, 1);
3182                 }
3183 #endif
3184         }
3185 }
3186
3187 static void
3188 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3189 {
3190         struct mbuf *m_notify;
3191         struct sctp_shutdown_event *sse;
3192         struct sctp_queued_to_read *control;
3193
3194         /*
3195          * For TCP model AND UDP connected sockets we will send an error up
3196          * when an SHUTDOWN completes
3197          */
3198         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3199             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3200                 /* mark socket closed for read/write and wakeup! */
3201 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3202                 struct socket *so;
3203
3204                 so = SCTP_INP_SO(stcb->sctp_ep);
3205                 atomic_add_int(&stcb->asoc.refcnt, 1);
3206                 SCTP_TCB_UNLOCK(stcb);
3207                 SCTP_SOCKET_LOCK(so, 1);
3208                 SCTP_TCB_LOCK(stcb);
3209                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3210                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3211                         SCTP_SOCKET_UNLOCK(so, 1);
3212                         return;
3213                 }
3214 #endif
3215                 socantsendmore(stcb->sctp_socket);
3216 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3217                 SCTP_SOCKET_UNLOCK(so, 1);
3218 #endif
3219         }
3220         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3221                 /* event not enabled */
3222                 return;
3223         }
3224         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3225         if (m_notify == NULL)
3226                 /* no space left */
3227                 return;
3228         sse = mtod(m_notify, struct sctp_shutdown_event *);
3229         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3230         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3231         sse->sse_flags = 0;
3232         sse->sse_length = sizeof(struct sctp_shutdown_event);
3233         sse->sse_assoc_id = sctp_get_associd(stcb);
3234
3235         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3236         SCTP_BUF_NEXT(m_notify) = NULL;
3237
3238         /* append to socket */
3239         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3240             0, 0, stcb->asoc.context, 0, 0, 0,
3241             m_notify);
3242         if (control == NULL) {
3243                 /* no memory */
3244                 sctp_m_freem(m_notify);
3245                 return;
3246         }
3247         control->spec_flags = M_NOTIFICATION;
3248         control->length = SCTP_BUF_LEN(m_notify);
3249         /* not that we need this */
3250         control->tail_mbuf = m_notify;
3251         sctp_add_to_readq(stcb->sctp_ep, stcb,
3252             control,
3253             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3254 }
3255
3256 static void
3257 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3258     int so_locked
3259 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3260     SCTP_UNUSED
3261 #endif
3262 )
3263 {
3264         struct mbuf *m_notify;
3265         struct sctp_sender_dry_event *event;
3266         struct sctp_queued_to_read *control;
3267
3268         if ((stcb == NULL) ||
3269             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3270                 /* event not enabled */
3271                 return;
3272         }
3273         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3274         if (m_notify == NULL) {
3275                 /* no space left */
3276                 return;
3277         }
3278         SCTP_BUF_LEN(m_notify) = 0;
3279         event = mtod(m_notify, struct sctp_sender_dry_event *);
3280         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3281         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3282         event->sender_dry_flags = 0;
3283         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3284         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3285
3286         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3287         SCTP_BUF_NEXT(m_notify) = NULL;
3288
3289         /* append to socket */
3290         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3291             0, 0, stcb->asoc.context, 0, 0, 0,
3292             m_notify);
3293         if (control == NULL) {
3294                 /* no memory */
3295                 sctp_m_freem(m_notify);
3296                 return;
3297         }
3298         control->length = SCTP_BUF_LEN(m_notify);
3299         control->spec_flags = M_NOTIFICATION;
3300         /* not that we need this */
3301         control->tail_mbuf = m_notify;
3302         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3303             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3304 }
3305
3306
3307 void
3308 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3309 {
3310         struct mbuf *m_notify;
3311         struct sctp_queued_to_read *control;
3312         struct sctp_stream_change_event *stradd;
3313
3314         if ((stcb == NULL) ||
3315             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3316                 /* event not enabled */
3317                 return;
3318         }
3319         if ((stcb->asoc.peer_req_out) && flag) {
3320                 /* Peer made the request, don't tell the local user */
3321                 stcb->asoc.peer_req_out = 0;
3322                 return;
3323         }
3324         stcb->asoc.peer_req_out = 0;
3325         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3326         if (m_notify == NULL)
3327                 /* no space left */
3328                 return;
3329         SCTP_BUF_LEN(m_notify) = 0;
3330         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3331         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3332         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3333         stradd->strchange_flags = flag;
3334         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3335         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3336         stradd->strchange_instrms = numberin;
3337         stradd->strchange_outstrms = numberout;
3338         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3339         SCTP_BUF_NEXT(m_notify) = NULL;
3340         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3341                 /* no space */
3342                 sctp_m_freem(m_notify);
3343                 return;
3344         }
3345         /* append to socket */
3346         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3347             0, 0, stcb->asoc.context, 0, 0, 0,
3348             m_notify);
3349         if (control == NULL) {
3350                 /* no memory */
3351                 sctp_m_freem(m_notify);
3352                 return;
3353         }
3354         control->spec_flags = M_NOTIFICATION;
3355         control->length = SCTP_BUF_LEN(m_notify);
3356         /* not that we need this */
3357         control->tail_mbuf = m_notify;
3358         sctp_add_to_readq(stcb->sctp_ep, stcb,
3359             control,
3360             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3361 }
3362
3363 void
3364 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3365 {
3366         struct mbuf *m_notify;
3367         struct sctp_queued_to_read *control;
3368         struct sctp_assoc_reset_event *strasoc;
3369
3370         if ((stcb == NULL) ||
3371             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3372                 /* event not enabled */
3373                 return;
3374         }
3375         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3376         if (m_notify == NULL)
3377                 /* no space left */
3378                 return;
3379         SCTP_BUF_LEN(m_notify) = 0;
3380         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3381         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3382         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3383         strasoc->assocreset_flags = flag;
3384         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3385         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3386         strasoc->assocreset_local_tsn = sending_tsn;
3387         strasoc->assocreset_remote_tsn = recv_tsn;
3388         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3389         SCTP_BUF_NEXT(m_notify) = NULL;
3390         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3391                 /* no space */
3392                 sctp_m_freem(m_notify);
3393                 return;
3394         }
3395         /* append to socket */
3396         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3397             0, 0, stcb->asoc.context, 0, 0, 0,
3398             m_notify);
3399         if (control == NULL) {
3400                 /* no memory */
3401                 sctp_m_freem(m_notify);
3402                 return;
3403         }
3404         control->spec_flags = M_NOTIFICATION;
3405         control->length = SCTP_BUF_LEN(m_notify);
3406         /* not that we need this */
3407         control->tail_mbuf = m_notify;
3408         sctp_add_to_readq(stcb->sctp_ep, stcb,
3409             control,
3410             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3411 }
3412
3413
3414
3415 static void
3416 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3417     int number_entries, uint16_t * list, int flag)
3418 {
3419         struct mbuf *m_notify;
3420         struct sctp_queued_to_read *control;
3421         struct sctp_stream_reset_event *strreset;
3422         int len;
3423
3424         if ((stcb == NULL) ||
3425             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3426                 /* event not enabled */
3427                 return;
3428         }
3429         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3430         if (m_notify == NULL)
3431                 /* no space left */
3432                 return;
3433         SCTP_BUF_LEN(m_notify) = 0;
3434         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3435         if (len > M_TRAILINGSPACE(m_notify)) {
3436                 /* never enough room */
3437                 sctp_m_freem(m_notify);
3438                 return;
3439         }
3440         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3441         memset(strreset, 0, len);
3442         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3443         strreset->strreset_flags = flag;
3444         strreset->strreset_length = len;
3445         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3446         if (number_entries) {
3447                 int i;
3448
3449                 for (i = 0; i < number_entries; i++) {
3450                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3451                 }
3452         }
3453         SCTP_BUF_LEN(m_notify) = len;
3454         SCTP_BUF_NEXT(m_notify) = NULL;
3455         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3456                 /* no space */
3457                 sctp_m_freem(m_notify);
3458                 return;
3459         }
3460         /* append to socket */
3461         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3462             0, 0, stcb->asoc.context, 0, 0, 0,
3463             m_notify);
3464         if (control == NULL) {
3465                 /* no memory */
3466                 sctp_m_freem(m_notify);
3467                 return;
3468         }
3469         control->spec_flags = M_NOTIFICATION;
3470         control->length = SCTP_BUF_LEN(m_notify);
3471         /* not that we need this */
3472         control->tail_mbuf = m_notify;
3473         sctp_add_to_readq(stcb->sctp_ep, stcb,
3474             control,
3475             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3476 }
3477
3478
3479 static void
3480 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3481 {
3482         struct mbuf *m_notify;
3483         struct sctp_remote_error *sre;
3484         struct sctp_queued_to_read *control;
3485         size_t notif_len, chunk_len;
3486
3487         if ((stcb == NULL) ||
3488             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3489                 return;
3490         }
3491         if (chunk != NULL) {
3492                 chunk_len = ntohs(chunk->ch.chunk_length);
3493         } else {
3494                 chunk_len = 0;
3495         }
3496         notif_len = sizeof(struct sctp_remote_error) + chunk_len;
3497         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3498         if (m_notify == NULL) {
3499                 /* Retry with smaller value. */
3500                 notif_len = sizeof(struct sctp_remote_error);
3501                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3502                 if (m_notify == NULL) {
3503                         return;
3504                 }
3505         }
3506         SCTP_BUF_NEXT(m_notify) = NULL;
3507         sre = mtod(m_notify, struct sctp_remote_error *);
3508         memset(sre, 0, notif_len);
3509         sre->sre_type = SCTP_REMOTE_ERROR;
3510         sre->sre_flags = 0;
3511         sre->sre_length = sizeof(struct sctp_remote_error);
3512         sre->sre_error = error;
3513         sre->sre_assoc_id = sctp_get_associd(stcb);
3514         if (notif_len > sizeof(struct sctp_remote_error)) {
3515                 memcpy(sre->sre_data, chunk, chunk_len);
3516                 sre->sre_length += chunk_len;
3517         }
3518         SCTP_BUF_LEN(m_notify) = sre->sre_length;
3519         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3520             0, 0, stcb->asoc.context, 0, 0, 0,
3521             m_notify);
3522         if (control != NULL) {
3523                 control->length = SCTP_BUF_LEN(m_notify);
3524                 /* not that we need this */
3525                 control->tail_mbuf = m_notify;
3526                 control->spec_flags = M_NOTIFICATION;
3527                 sctp_add_to_readq(stcb->sctp_ep, stcb,
3528                     control,
3529                     &stcb->sctp_socket->so_rcv, 1,
3530                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3531         } else {
3532                 sctp_m_freem(m_notify);
3533         }
3534 }
3535
3536
3537 void
3538 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3539     uint32_t error, void *data, int so_locked
3540 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3541     SCTP_UNUSED
3542 #endif
3543 )
3544 {
3545         if ((stcb == NULL) ||
3546             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3547             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3548             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3549                 /* If the socket is gone we are out of here */
3550                 return;
3551         }
3552         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3553                 return;
3554         }
3555         if ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) ||
3556             (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED)) {
3557                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3558                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3559                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3560                         /* Don't report these in front states */
3561                         return;
3562                 }
3563         }
3564         switch (notification) {
3565         case SCTP_NOTIFY_ASSOC_UP:
3566                 if (stcb->asoc.assoc_up_sent == 0) {
3567                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
3568                         stcb->asoc.assoc_up_sent = 1;
3569                 }
3570                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3571                         sctp_notify_adaptation_layer(stcb);
3572                 }
3573                 if (stcb->asoc.auth_supported == 0) {
3574                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3575                             NULL, so_locked);
3576                 }
3577                 break;
3578         case SCTP_NOTIFY_ASSOC_DOWN:
3579                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
3580                 break;
3581         case SCTP_NOTIFY_INTERFACE_DOWN:
3582                 {
3583                         struct sctp_nets *net;
3584
3585                         net = (struct sctp_nets *)data;
3586                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3587                             (struct sockaddr *)&net->ro._l_addr, error);
3588                         break;
3589                 }
3590         case SCTP_NOTIFY_INTERFACE_UP:
3591                 {
3592                         struct sctp_nets *net;
3593
3594                         net = (struct sctp_nets *)data;
3595                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3596                             (struct sockaddr *)&net->ro._l_addr, error);
3597                         break;
3598                 }
3599         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3600                 {
3601                         struct sctp_nets *net;
3602
3603                         net = (struct sctp_nets *)data;
3604                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3605                             (struct sockaddr *)&net->ro._l_addr, error);
3606                         break;
3607                 }
3608         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3609                 sctp_notify_send_failed2(stcb, error,
3610                     (struct sctp_stream_queue_pending *)data, so_locked);
3611                 break;
3612         case SCTP_NOTIFY_SENT_DG_FAIL:
3613                 sctp_notify_send_failed(stcb, 1, error,
3614                     (struct sctp_tmit_chunk *)data, so_locked);
3615                 break;
3616         case SCTP_NOTIFY_UNSENT_DG_FAIL:
3617                 sctp_notify_send_failed(stcb, 0, error,
3618                     (struct sctp_tmit_chunk *)data, so_locked);
3619                 break;
3620         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3621                 {
3622                         uint32_t val;
3623
3624                         val = *((uint32_t *) data);
3625
3626                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3627                         break;
3628                 }
3629         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
3630                 if (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3631                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED)) {
3632                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
3633                 } else {
3634                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
3635                 }
3636                 break;
3637         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
3638                 if (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3639                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED)) {
3640                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
3641                 } else {
3642                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
3643                 }
3644                 break;
3645         case SCTP_NOTIFY_ASSOC_RESTART:
3646                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
3647                 if (stcb->asoc.auth_supported == 0) {
3648                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3649                             NULL, so_locked);
3650                 }
3651                 break;
3652         case SCTP_NOTIFY_STR_RESET_SEND:
3653                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_OUTGOING_SSN);
3654                 break;
3655         case SCTP_NOTIFY_STR_RESET_RECV:
3656                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_INCOMING);
3657                 break;
3658         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3659                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3660                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3661                 break;
3662         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3663                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3664                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3665                 break;
3666         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3667                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3668                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3669                 break;
3670         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3671                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3672                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3673                 break;
3674         case SCTP_NOTIFY_ASCONF_ADD_IP:
3675                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3676                     error);
3677                 break;
3678         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3679                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3680                     error);
3681                 break;
3682         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3683                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3684                     error);
3685                 break;
3686         case SCTP_NOTIFY_PEER_SHUTDOWN:
3687                 sctp_notify_shutdown_event(stcb);
3688                 break;
3689         case SCTP_NOTIFY_AUTH_NEW_KEY:
3690                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3691                     (uint16_t) (uintptr_t) data,
3692                     so_locked);
3693                 break;
3694         case SCTP_NOTIFY_AUTH_FREE_KEY:
3695                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3696                     (uint16_t) (uintptr_t) data,
3697                     so_locked);
3698                 break;
3699         case SCTP_NOTIFY_NO_PEER_AUTH:
3700                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3701                     (uint16_t) (uintptr_t) data,
3702                     so_locked);
3703                 break;
3704         case SCTP_NOTIFY_SENDER_DRY:
3705                 sctp_notify_sender_dry_event(stcb, so_locked);
3706                 break;
3707         case SCTP_NOTIFY_REMOTE_ERROR:
3708                 sctp_notify_remote_error(stcb, error, data);
3709                 break;
3710         default:
3711                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3712                     __FUNCTION__, notification, notification);
3713                 break;
3714         }                       /* end switch */
3715 }
3716
3717 void
3718 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int holds_lock, int so_locked
3719 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3720     SCTP_UNUSED
3721 #endif
3722 )
3723 {
3724         struct sctp_association *asoc;
3725         struct sctp_stream_out *outs;
3726         struct sctp_tmit_chunk *chk, *nchk;
3727         struct sctp_stream_queue_pending *sp, *nsp;
3728         int i;
3729
3730         if (stcb == NULL) {
3731                 return;
3732         }
3733         asoc = &stcb->asoc;
3734         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3735                 /* already being freed */
3736                 return;
3737         }
3738         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3739             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3740             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3741                 return;
3742         }
3743         /* now through all the gunk freeing chunks */
3744         if (holds_lock == 0) {
3745                 SCTP_TCB_SEND_LOCK(stcb);
3746         }
3747         /* sent queue SHOULD be empty */
3748         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3749                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3750                 asoc->sent_queue_cnt--;
3751                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
3752                         if (asoc->strmout[chk->rec.data.stream_number].chunks_on_queues > 0) {
3753                                 asoc->strmout[chk->rec.data.stream_number].chunks_on_queues--;
3754 #ifdef INVARIANTS
3755                         } else {
3756                                 panic("No chunks on the queues for sid %u.", chk->rec.data.stream_number);
3757 #endif
3758                         }
3759                 }
3760                 if (chk->data != NULL) {
3761                         sctp_free_bufspace(stcb, asoc, chk, 1);
3762                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
3763                             error, chk, so_locked);
3764                         if (chk->data) {
3765                                 sctp_m_freem(chk->data);
3766                                 chk->data = NULL;
3767                         }
3768                 }
3769                 sctp_free_a_chunk(stcb, chk, so_locked);
3770                 /* sa_ignore FREED_MEMORY */
3771         }
3772         /* pending send queue SHOULD be empty */
3773         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3774                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3775                 asoc->send_queue_cnt--;
3776                 if (asoc->strmout[chk->rec.data.stream_number].chunks_on_queues > 0) {
3777                         asoc->strmout[chk->rec.data.stream_number].chunks_on_queues--;
3778 #ifdef INVARIANTS
3779                 } else {
3780                         panic("No chunks on the queues for sid %u.", chk->rec.data.stream_number);
3781 #endif
3782                 }
3783                 if (chk->data != NULL) {
3784                         sctp_free_bufspace(stcb, asoc, chk, 1);
3785                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
3786                             error, chk, so_locked);
3787                         if (chk->data) {
3788                                 sctp_m_freem(chk->data);
3789                                 chk->data = NULL;
3790                         }
3791                 }
3792                 sctp_free_a_chunk(stcb, chk, so_locked);
3793                 /* sa_ignore FREED_MEMORY */
3794         }
3795         for (i = 0; i < asoc->streamoutcnt; i++) {
3796                 /* For each stream */
3797                 outs = &asoc->strmout[i];
3798                 /* clean up any sends there */
3799                 asoc->locked_on_sending = NULL;
3800                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3801                         asoc->stream_queue_cnt--;
3802                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3803                         sctp_free_spbufspace(stcb, asoc, sp);
3804                         if (sp->data) {
3805                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3806                                     error, (void *)sp, so_locked);
3807                                 if (sp->data) {
3808                                         sctp_m_freem(sp->data);
3809                                         sp->data = NULL;
3810                                         sp->tail_mbuf = NULL;
3811                                         sp->length = 0;
3812                                 }
3813                         }
3814                         if (sp->net) {
3815                                 sctp_free_remote_addr(sp->net);
3816                                 sp->net = NULL;
3817                         }
3818                         /* Free the chunk */
3819                         sctp_free_a_strmoq(stcb, sp, so_locked);
3820                         /* sa_ignore FREED_MEMORY */
3821                 }
3822         }
3823
3824         if (holds_lock == 0) {
3825                 SCTP_TCB_SEND_UNLOCK(stcb);
3826         }
3827 }
3828
3829 void
3830 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
3831     struct sctp_abort_chunk *abort, int so_locked
3832 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3833     SCTP_UNUSED
3834 #endif
3835 )
3836 {
3837         if (stcb == NULL) {
3838                 return;
3839         }
3840         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3841             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3842             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3843                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3844         }
3845         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3846             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3847             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3848                 return;
3849         }
3850         /* Tell them we lost the asoc */
3851         sctp_report_all_outbound(stcb, error, 1, so_locked);
3852         if (from_peer) {
3853                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
3854         } else {
3855                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
3856         }
3857 }
3858
3859 void
3860 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3861     struct mbuf *m, int iphlen,
3862     struct sockaddr *src, struct sockaddr *dst,
3863     struct sctphdr *sh, struct mbuf *op_err,
3864     uint8_t mflowtype, uint32_t mflowid,
3865     uint32_t vrf_id, uint16_t port)
3866 {
3867         uint32_t vtag;
3868
3869 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3870         struct socket *so;
3871
3872 #endif
3873
3874         vtag = 0;
3875         if (stcb != NULL) {
3876                 /* We have a TCB to abort, send notification too */
3877                 vtag = stcb->asoc.peer_vtag;
3878                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
3879                 /* get the assoc vrf id and table id */
3880                 vrf_id = stcb->asoc.vrf_id;
3881                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3882         }
3883         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
3884             mflowtype, mflowid,
3885             vrf_id, port);
3886         if (stcb != NULL) {
3887                 /* Ok, now lets free it */
3888 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3889                 so = SCTP_INP_SO(inp);
3890                 atomic_add_int(&stcb->asoc.refcnt, 1);
3891                 SCTP_TCB_UNLOCK(stcb);
3892                 SCTP_SOCKET_LOCK(so, 1);
3893                 SCTP_TCB_LOCK(stcb);
3894                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3895 #endif
3896                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3897                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3898                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3899                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3900                 }
3901                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
3902 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3903                 SCTP_SOCKET_UNLOCK(so, 1);
3904 #endif
3905         }
3906 }
3907
3908 #ifdef SCTP_ASOCLOG_OF_TSNS
3909 void
3910 sctp_print_out_track_log(struct sctp_tcb *stcb)
3911 {
3912 #ifdef NOSIY_PRINTS
3913         int i;
3914
3915         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
3916         SCTP_PRINTF("IN bound TSN log-aaa\n");
3917         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
3918                 SCTP_PRINTF("None rcvd\n");
3919                 goto none_in;
3920         }
3921         if (stcb->asoc.tsn_in_wrapped) {
3922                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
3923                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3924                             stcb->asoc.in_tsnlog[i].tsn,
3925                             stcb->asoc.in_tsnlog[i].strm,
3926                             stcb->asoc.in_tsnlog[i].seq,
3927                             stcb->asoc.in_tsnlog[i].flgs,
3928                             stcb->asoc.in_tsnlog[i].sz);
3929                 }
3930         }
3931         if (stcb->asoc.tsn_in_at) {
3932                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
3933                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3934                             stcb->asoc.in_tsnlog[i].tsn,
3935                             stcb->asoc.in_tsnlog[i].strm,
3936                             stcb->asoc.in_tsnlog[i].seq,
3937                             stcb->asoc.in_tsnlog[i].flgs,
3938                             stcb->asoc.in_tsnlog[i].sz);
3939                 }
3940         }
3941 none_in:
3942         SCTP_PRINTF("OUT bound TSN log-aaa\n");
3943         if ((stcb->asoc.tsn_out_at == 0) &&
3944             (stcb->asoc.tsn_out_wrapped == 0)) {
3945                 SCTP_PRINTF("None sent\n");
3946         }
3947         if (stcb->asoc.tsn_out_wrapped) {
3948                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
3949                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3950                             stcb->asoc.out_tsnlog[i].tsn,
3951                             stcb->asoc.out_tsnlog[i].strm,
3952                             stcb->asoc.out_tsnlog[i].seq,
3953                             stcb->asoc.out_tsnlog[i].flgs,
3954                             stcb->asoc.out_tsnlog[i].sz);
3955                 }
3956         }
3957         if (stcb->asoc.tsn_out_at) {
3958                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
3959                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3960                             stcb->asoc.out_tsnlog[i].tsn,
3961                             stcb->asoc.out_tsnlog[i].strm,
3962                             stcb->asoc.out_tsnlog[i].seq,
3963                             stcb->asoc.out_tsnlog[i].flgs,
3964                             stcb->asoc.out_tsnlog[i].sz);
3965                 }
3966         }
3967 #endif
3968 }
3969
3970 #endif
3971
3972 void
3973 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3974     struct mbuf *op_err,
3975     int so_locked
3976 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3977     SCTP_UNUSED
3978 #endif
3979 )
3980 {
3981 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3982         struct socket *so;
3983
3984 #endif
3985
3986 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3987         so = SCTP_INP_SO(inp);
3988 #endif
3989         if (stcb == NULL) {
3990                 /* Got to have a TCB */
3991                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3992                         if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3993                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
3994                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
3995                         }
3996                 }
3997                 return;
3998         } else {
3999                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
4000         }
4001         /* notify the ulp */
4002         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4003                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
4004         }
4005         /* notify the peer */
4006         sctp_send_abort_tcb(stcb, op_err, so_locked);
4007         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4008         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
4009             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4010                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4011         }
4012         /* now free the asoc */
4013 #ifdef SCTP_ASOCLOG_OF_TSNS
4014         sctp_print_out_track_log(stcb);
4015 #endif
4016 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4017         if (!so_locked) {
4018                 atomic_add_int(&stcb->asoc.refcnt, 1);
4019                 SCTP_TCB_UNLOCK(stcb);
4020                 SCTP_SOCKET_LOCK(so, 1);
4021                 SCTP_TCB_LOCK(stcb);
4022                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4023         }
4024 #endif
4025         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4026 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4027         if (!so_locked) {
4028                 SCTP_SOCKET_UNLOCK(so, 1);
4029         }
4030 #endif
4031 }
4032
4033 void
4034 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4035     struct sockaddr *src, struct sockaddr *dst,
4036     struct sctphdr *sh, struct sctp_inpcb *inp,
4037     struct mbuf *cause,
4038     uint8_t mflowtype, uint32_t mflowid,
4039     uint32_t vrf_id, uint16_t port)
4040 {
4041         struct sctp_chunkhdr *ch, chunk_buf;
4042         unsigned int chk_length;
4043         int contains_init_chunk;
4044
4045         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4046         /* Generate a TO address for future reference */
4047         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4048                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4049                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4050                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4051                 }
4052         }
4053         contains_init_chunk = 0;
4054         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4055             sizeof(*ch), (uint8_t *) & chunk_buf);
4056         while (ch != NULL) {
4057                 chk_length = ntohs(ch->chunk_length);
4058                 if (chk_length < sizeof(*ch)) {
4059                         /* break to abort land */
4060                         break;
4061                 }
4062                 switch (ch->chunk_type) {
4063                 case SCTP_INIT:
4064                         contains_init_chunk = 1;
4065                         break;
4066                 case SCTP_PACKET_DROPPED:
4067                         /* we don't respond to pkt-dropped */
4068                         return;
4069                 case SCTP_ABORT_ASSOCIATION:
4070                         /* we don't respond with an ABORT to an ABORT */
4071                         return;
4072                 case SCTP_SHUTDOWN_COMPLETE:
4073                         /*
4074                          * we ignore it since we are not waiting for it and
4075                          * peer is gone
4076                          */
4077                         return;
4078                 case SCTP_SHUTDOWN_ACK:
4079                         sctp_send_shutdown_complete2(src, dst, sh,
4080                             mflowtype, mflowid,
4081                             vrf_id, port);
4082                         return;
4083                 default:
4084                         break;
4085                 }
4086                 offset += SCTP_SIZE32(chk_length);
4087                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4088                     sizeof(*ch), (uint8_t *) & chunk_buf);
4089         }
4090         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4091             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4092             (contains_init_chunk == 0))) {
4093                 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4094                     mflowtype, mflowid,
4095                     vrf_id, port);
4096         }
4097 }
4098
4099 /*
4100  * check the inbound datagram to make sure there is not an abort inside it,
4101  * if there is return 1, else return 0.
4102  */
4103 int
4104 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill)
4105 {
4106         struct sctp_chunkhdr *ch;
4107         struct sctp_init_chunk *init_chk, chunk_buf;
4108         int offset;
4109         unsigned int chk_length;
4110
4111         offset = iphlen + sizeof(struct sctphdr);
4112         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4113             (uint8_t *) & chunk_buf);
4114         while (ch != NULL) {
4115                 chk_length = ntohs(ch->chunk_length);
4116                 if (chk_length < sizeof(*ch)) {
4117                         /* packet is probably corrupt */
4118                         break;
4119                 }
4120                 /* we seem to be ok, is it an abort? */
4121                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4122                         /* yep, tell them */
4123                         return (1);
4124                 }
4125                 if (ch->chunk_type == SCTP_INITIATION) {
4126                         /* need to update the Vtag */
4127                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4128                             offset, sizeof(*init_chk), (uint8_t *) & chunk_buf);
4129                         if (init_chk != NULL) {
4130                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4131                         }
4132                 }
4133                 /* Nope, move to the next chunk */
4134                 offset += SCTP_SIZE32(chk_length);
4135                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4136                     sizeof(*ch), (uint8_t *) & chunk_buf);
4137         }
4138         return (0);
4139 }
4140
4141 /*
4142  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4143  * set (i.e. it's 0) so, create this function to compare link local scopes
4144  */
4145 #ifdef INET6
4146 uint32_t
4147 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4148 {
4149         struct sockaddr_in6 a, b;
4150
4151         /* save copies */
4152         a = *addr1;
4153         b = *addr2;
4154
4155         if (a.sin6_scope_id == 0)
4156                 if (sa6_recoverscope(&a)) {
4157                         /* can't get scope, so can't match */
4158                         return (0);
4159                 }
4160         if (b.sin6_scope_id == 0)
4161                 if (sa6_recoverscope(&b)) {
4162                         /* can't get scope, so can't match */
4163                         return (0);
4164                 }
4165         if (a.sin6_scope_id != b.sin6_scope_id)
4166                 return (0);
4167
4168         return (1);
4169 }
4170
4171 /*
4172  * returns a sockaddr_in6 with embedded scope recovered and removed
4173  */
4174 struct sockaddr_in6 *
4175 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4176 {
4177         /* check and strip embedded scope junk */
4178         if (addr->sin6_family == AF_INET6) {
4179                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4180                         if (addr->sin6_scope_id == 0) {
4181                                 *store = *addr;
4182                                 if (!sa6_recoverscope(store)) {
4183                                         /* use the recovered scope */
4184                                         addr = store;
4185                                 }
4186                         } else {
4187                                 /* else, return the original "to" addr */
4188                                 in6_clearscope(&addr->sin6_addr);
4189                         }
4190                 }
4191         }
4192         return (addr);
4193 }
4194
4195 #endif
4196
4197 /*
4198  * are the two addresses the same?  currently a "scopeless" check returns: 1
4199  * if same, 0 if not
4200  */
4201 int
4202 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4203 {
4204
4205         /* must be valid */
4206         if (sa1 == NULL || sa2 == NULL)
4207                 return (0);
4208
4209         /* must be the same family */
4210         if (sa1->sa_family != sa2->sa_family)
4211                 return (0);
4212
4213         switch (sa1->sa_family) {
4214 #ifdef INET6
4215         case AF_INET6:
4216                 {
4217                         /* IPv6 addresses */
4218                         struct sockaddr_in6 *sin6_1, *sin6_2;
4219
4220                         sin6_1 = (struct sockaddr_in6 *)sa1;
4221                         sin6_2 = (struct sockaddr_in6 *)sa2;
4222                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4223                             sin6_2));
4224                 }
4225 #endif
4226 #ifdef INET
4227         case AF_INET:
4228                 {
4229                         /* IPv4 addresses */
4230                         struct sockaddr_in *sin_1, *sin_2;
4231
4232                         sin_1 = (struct sockaddr_in *)sa1;
4233                         sin_2 = (struct sockaddr_in *)sa2;
4234                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4235                 }
4236 #endif
4237         default:
4238                 /* we don't do these... */
4239                 return (0);
4240         }
4241 }
4242
4243 void
4244 sctp_print_address(struct sockaddr *sa)
4245 {
4246 #ifdef INET6
4247         char ip6buf[INET6_ADDRSTRLEN];
4248
4249 #endif
4250
4251         switch (sa->sa_family) {
4252 #ifdef INET6
4253         case AF_INET6:
4254                 {
4255                         struct sockaddr_in6 *sin6;
4256
4257                         sin6 = (struct sockaddr_in6 *)sa;
4258                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4259                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4260                             ntohs(sin6->sin6_port),
4261                             sin6->sin6_scope_id);
4262                         break;
4263                 }
4264 #endif
4265 #ifdef INET
4266         case AF_INET:
4267                 {
4268                         struct sockaddr_in *sin;
4269                         unsigned char *p;
4270
4271                         sin = (struct sockaddr_in *)sa;
4272                         p = (unsigned char *)&sin->sin_addr;
4273                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4274                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4275                         break;
4276                 }
4277 #endif
4278         default:
4279                 SCTP_PRINTF("?\n");
4280                 break;
4281         }
4282 }
4283
4284 void
4285 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4286     struct sctp_inpcb *new_inp,
4287     struct sctp_tcb *stcb,
4288     int waitflags)
4289 {
4290         /*
4291          * go through our old INP and pull off any control structures that
4292          * belong to stcb and move then to the new inp.
4293          */
4294         struct socket *old_so, *new_so;
4295         struct sctp_queued_to_read *control, *nctl;
4296         struct sctp_readhead tmp_queue;
4297         struct mbuf *m;
4298         int error = 0;
4299
4300         old_so = old_inp->sctp_socket;
4301         new_so = new_inp->sctp_socket;
4302         TAILQ_INIT(&tmp_queue);
4303         error = sblock(&old_so->so_rcv, waitflags);
4304         if (error) {
4305                 /*
4306                  * Gak, can't get sblock, we have a problem. data will be
4307                  * left stranded.. and we don't dare look at it since the
4308                  * other thread may be reading something. Oh well, its a
4309                  * screwed up app that does a peeloff OR a accept while
4310                  * reading from the main socket... actually its only the
4311                  * peeloff() case, since I think read will fail on a
4312                  * listening socket..
4313                  */
4314                 return;
4315         }
4316         /* lock the socket buffers */
4317         SCTP_INP_READ_LOCK(old_inp);
4318         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4319                 /* Pull off all for out target stcb */
4320                 if (control->stcb == stcb) {
4321                         /* remove it we want it */
4322                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4323                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4324                         m = control->data;
4325                         while (m) {
4326                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4327                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4328                                 }
4329                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4330                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4331                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4332                                 }
4333                                 m = SCTP_BUF_NEXT(m);
4334                         }
4335                 }
4336         }
4337         SCTP_INP_READ_UNLOCK(old_inp);
4338         /* Remove the sb-lock on the old socket */
4339
4340         sbunlock(&old_so->so_rcv);
4341         /* Now we move them over to the new socket buffer */
4342         SCTP_INP_READ_LOCK(new_inp);
4343         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4344                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4345                 m = control->data;
4346                 while (m) {
4347                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4348                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4349                         }
4350                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4351                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4352                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4353                         }
4354                         m = SCTP_BUF_NEXT(m);
4355                 }
4356         }
4357         SCTP_INP_READ_UNLOCK(new_inp);
4358 }
4359
4360 void
4361 sctp_add_to_readq(struct sctp_inpcb *inp,
4362     struct sctp_tcb *stcb,
4363     struct sctp_queued_to_read *control,
4364     struct sockbuf *sb,
4365     int end,
4366     int inp_read_lock_held,
4367     int so_locked
4368 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4369     SCTP_UNUSED
4370 #endif
4371 )
4372 {
4373         /*
4374          * Here we must place the control on the end of the socket read
4375          * queue AND increment sb_cc so that select will work properly on
4376          * read.
4377          */
4378         struct mbuf *m, *prev = NULL;
4379
4380         if (inp == NULL) {
4381                 /* Gak, TSNH!! */
4382 #ifdef INVARIANTS
4383                 panic("Gak, inp NULL on add_to_readq");
4384 #endif
4385                 return;
4386         }
4387         if (inp_read_lock_held == 0)
4388                 SCTP_INP_READ_LOCK(inp);
4389         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4390                 sctp_free_remote_addr(control->whoFrom);
4391                 if (control->data) {
4392                         sctp_m_freem(control->data);
4393                         control->data = NULL;
4394                 }
4395                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4396                 if (inp_read_lock_held == 0)
4397                         SCTP_INP_READ_UNLOCK(inp);
4398                 return;
4399         }
4400         if (!(control->spec_flags & M_NOTIFICATION)) {
4401                 atomic_add_int(&inp->total_recvs, 1);
4402                 if (!control->do_not_ref_stcb) {
4403                         atomic_add_int(&stcb->total_recvs, 1);
4404                 }
4405         }
4406         m = control->data;
4407         control->held_length = 0;
4408         control->length = 0;
4409         while (m) {
4410                 if (SCTP_BUF_LEN(m) == 0) {
4411                         /* Skip mbufs with NO length */
4412                         if (prev == NULL) {
4413                                 /* First one */
4414                                 control->data = sctp_m_free(m);
4415                                 m = control->data;
4416                         } else {
4417                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4418                                 m = SCTP_BUF_NEXT(prev);
4419                         }
4420                         if (m == NULL) {
4421                                 control->tail_mbuf = prev;
4422                         }
4423                         continue;
4424                 }
4425                 prev = m;
4426                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4427                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4428                 }
4429                 sctp_sballoc(stcb, sb, m);
4430                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4431                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4432                 }
4433                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4434                 m = SCTP_BUF_NEXT(m);
4435         }
4436         if (prev != NULL) {
4437                 control->tail_mbuf = prev;
4438         } else {
4439                 /* Everything got collapsed out?? */
4440                 sctp_free_remote_addr(control->whoFrom);
4441                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4442                 if (inp_read_lock_held == 0)
4443                         SCTP_INP_READ_UNLOCK(inp);
4444                 return;
4445         }
4446         if (end) {
4447                 control->end_added = 1;
4448         }
4449         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4450         if (inp_read_lock_held == 0)
4451                 SCTP_INP_READ_UNLOCK(inp);
4452         if (inp && inp->sctp_socket) {
4453                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4454                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4455                 } else {
4456 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4457                         struct socket *so;
4458
4459                         so = SCTP_INP_SO(inp);
4460                         if (!so_locked) {
4461                                 if (stcb) {
4462                                         atomic_add_int(&stcb->asoc.refcnt, 1);
4463                                         SCTP_TCB_UNLOCK(stcb);
4464                                 }
4465                                 SCTP_SOCKET_LOCK(so, 1);
4466                                 if (stcb) {
4467                                         SCTP_TCB_LOCK(stcb);
4468                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4469                                 }
4470                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4471                                         SCTP_SOCKET_UNLOCK(so, 1);
4472                                         return;
4473                                 }
4474                         }
4475 #endif
4476                         sctp_sorwakeup(inp, inp->sctp_socket);
4477 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4478                         if (!so_locked) {
4479                                 SCTP_SOCKET_UNLOCK(so, 1);
4480                         }
4481 #endif
4482                 }
4483         }
4484 }
4485
4486
4487 int
4488 sctp_append_to_readq(struct sctp_inpcb *inp,
4489     struct sctp_tcb *stcb,
4490     struct sctp_queued_to_read *control,
4491     struct mbuf *m,
4492     int end,
4493     int ctls_cumack,
4494     struct sockbuf *sb)
4495 {
4496         /*
4497          * A partial delivery API event is underway. OR we are appending on
4498          * the reassembly queue.
4499          *
4500          * If PDAPI this means we need to add m to the end of the data.
4501          * Increase the length in the control AND increment the sb_cc.
4502          * Otherwise sb is NULL and all we need to do is put it at the end
4503          * of the mbuf chain.
4504          */
4505         int len = 0;
4506         struct mbuf *mm, *tail = NULL, *prev = NULL;
4507
4508         if (inp) {
4509                 SCTP_INP_READ_LOCK(inp);
4510         }
4511         if (control == NULL) {
4512 get_out:
4513                 if (inp) {
4514                         SCTP_INP_READ_UNLOCK(inp);
4515                 }
4516                 return (-1);
4517         }
4518         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ)) {
4519                 SCTP_INP_READ_UNLOCK(inp);
4520                 return (0);
4521         }
4522         if (control->end_added) {
4523                 /* huh this one is complete? */
4524                 goto get_out;
4525         }
4526         mm = m;
4527         if (mm == NULL) {
4528                 goto get_out;
4529         }
4530         while (mm) {
4531                 if (SCTP_BUF_LEN(mm) == 0) {
4532                         /* Skip mbufs with NO lenght */
4533                         if (prev == NULL) {
4534                                 /* First one */
4535                                 m = sctp_m_free(mm);
4536                                 mm = m;
4537                         } else {
4538                                 SCTP_BUF_NEXT(prev) = sctp_m_free(mm);
4539                                 mm = SCTP_BUF_NEXT(prev);
4540                         }
4541                         continue;
4542                 }
4543                 prev = mm;
4544                 len += SCTP_BUF_LEN(mm);
4545                 if (sb) {
4546                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4547                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(mm));
4548                         }
4549                         sctp_sballoc(stcb, sb, mm);
4550                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4551                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4552                         }
4553                 }
4554                 mm = SCTP_BUF_NEXT(mm);
4555         }
4556         if (prev) {
4557                 tail = prev;
4558         } else {
4559                 /* Really there should always be a prev */
4560                 if (m == NULL) {
4561                         /* Huh nothing left? */
4562 #ifdef INVARIANTS
4563                         panic("Nothing left to add?");
4564 #else
4565                         goto get_out;
4566 #endif
4567                 }
4568                 tail = m;
4569         }
4570         if (control->tail_mbuf) {
4571                 /* append */
4572                 SCTP_BUF_NEXT(control->tail_mbuf) = m;
4573                 control->tail_mbuf = tail;
4574         } else {
4575                 /* nothing there */
4576 #ifdef INVARIANTS
4577                 if (control->data != NULL) {
4578                         panic("This should NOT happen");
4579                 }
4580 #endif
4581                 control->data = m;
4582                 control->tail_mbuf = tail;
4583         }
4584         atomic_add_int(&control->length, len);
4585         if (end) {
4586                 /* message is complete */
4587                 if (stcb && (control == stcb->asoc.control_pdapi)) {
4588                         stcb->asoc.control_pdapi = NULL;
4589                 }
4590                 control->held_length = 0;
4591                 control->end_added = 1;
4592         }
4593         if (stcb == NULL) {
4594                 control->do_not_ref_stcb = 1;
4595         }
4596         /*
4597          * When we are appending in partial delivery, the cum-ack is used
4598          * for the actual pd-api highest tsn on this mbuf. The true cum-ack
4599          * is populated in the outbound sinfo structure from the true cumack
4600          * if the association exists...
4601          */
4602         control->sinfo_tsn = control->sinfo_cumtsn = ctls_cumack;
4603         if (inp) {
4604                 SCTP_INP_READ_UNLOCK(inp);
4605         }
4606         if (inp && inp->sctp_socket) {
4607                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4608                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4609                 } else {
4610 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4611                         struct socket *so;
4612
4613                         so = SCTP_INP_SO(inp);
4614                         if (stcb) {
4615                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4616                                 SCTP_TCB_UNLOCK(stcb);
4617                         }
4618                         SCTP_SOCKET_LOCK(so, 1);
4619                         if (stcb) {
4620                                 SCTP_TCB_LOCK(stcb);
4621                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4622                         }
4623                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4624                                 SCTP_SOCKET_UNLOCK(so, 1);
4625                                 return (0);
4626                         }
4627 #endif
4628                         sctp_sorwakeup(inp, inp->sctp_socket);
4629 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4630                         SCTP_SOCKET_UNLOCK(so, 1);
4631 #endif
4632                 }
4633         }
4634         return (0);
4635 }
4636
4637
4638
4639 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4640  *************ALTERNATE ROUTING CODE
4641  */
4642
4643 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4644  *************ALTERNATE ROUTING CODE
4645  */
4646
4647 struct mbuf *
4648 sctp_generate_cause(uint16_t code, char *info)
4649 {
4650         struct mbuf *m;
4651         struct sctp_gen_error_cause *cause;
4652         size_t info_len, len;
4653
4654         if ((code == 0) || (info == NULL)) {
4655                 return (NULL);
4656         }
4657         info_len = strlen(info);
4658         len = sizeof(struct sctp_paramhdr) + info_len;
4659         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4660         if (m != NULL) {
4661                 SCTP_BUF_LEN(m) = len;
4662                 cause = mtod(m, struct sctp_gen_error_cause *);
4663                 cause->code = htons(code);
4664                 cause->length = htons((uint16_t) len);
4665                 memcpy(cause->info, info, info_len);
4666         }
4667         return (m);
4668 }
4669
4670 struct mbuf *
4671 sctp_generate_no_user_data_cause(uint32_t tsn)
4672 {
4673         struct mbuf *m;
4674         struct sctp_error_no_user_data *no_user_data_cause;
4675         size_t len;
4676
4677         len = sizeof(struct sctp_error_no_user_data);
4678         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4679         if (m != NULL) {
4680                 SCTP_BUF_LEN(m) = len;
4681                 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
4682                 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
4683                 no_user_data_cause->cause.length = htons((uint16_t) len);
4684                 no_user_data_cause->tsn = tsn;  /* tsn is passed in as NBO */
4685         }
4686         return (m);
4687 }
4688
4689 #ifdef SCTP_MBCNT_LOGGING
4690 void
4691 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4692     struct sctp_tmit_chunk *tp1, int chk_cnt)
4693 {
4694         if (tp1->data == NULL) {
4695                 return;
4696         }
4697         asoc->chunks_on_out_queue -= chk_cnt;
4698         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4699                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4700                     asoc->total_output_queue_size,
4701                     tp1->book_size,
4702                     0,
4703                     tp1->mbcnt);
4704         }
4705         if (asoc->total_output_queue_size >= tp1->book_size) {
4706                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4707         } else {
4708                 asoc->total_output_queue_size = 0;
4709         }
4710
4711         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4712             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4713                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4714                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4715                 } else {
4716                         stcb->sctp_socket->so_snd.sb_cc = 0;
4717
4718                 }
4719         }
4720 }
4721
4722 #endif
4723
4724 int
4725 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4726     uint8_t sent, int so_locked
4727 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4728     SCTP_UNUSED
4729 #endif
4730 )
4731 {
4732         struct sctp_stream_out *strq;
4733         struct sctp_tmit_chunk *chk = NULL, *tp2;
4734         struct sctp_stream_queue_pending *sp;
4735         uint16_t stream = 0, seq = 0;
4736         uint8_t foundeom = 0;
4737         int ret_sz = 0;
4738         int notdone;
4739         int do_wakeup_routine = 0;
4740
4741         stream = tp1->rec.data.stream_number;
4742         seq = tp1->rec.data.stream_seq;
4743         if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
4744                 stcb->asoc.abandoned_sent[0]++;
4745                 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4746                 stcb->asoc.strmout[stream].abandoned_sent[0]++;
4747 #if defined(SCTP_DETAILED_STR_STATS)
4748                 stcb->asoc.strmout[stream].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4749 #endif
4750         } else {
4751                 stcb->asoc.abandoned_unsent[0]++;
4752                 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4753                 stcb->asoc.strmout[stream].abandoned_unsent[0]++;
4754 #if defined(SCTP_DETAILED_STR_STATS)
4755                 stcb->asoc.strmout[stream].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4756 #endif
4757         }
4758         do {
4759                 ret_sz += tp1->book_size;
4760                 if (tp1->data != NULL) {
4761                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4762                                 sctp_flight_size_decrease(tp1);
4763                                 sctp_total_flight_decrease(stcb, tp1);
4764                         }
4765                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4766                         stcb->asoc.peers_rwnd += tp1->send_size;
4767                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4768                         if (sent) {
4769                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4770                         } else {
4771                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4772                         }
4773                         if (tp1->data) {
4774                                 sctp_m_freem(tp1->data);
4775                                 tp1->data = NULL;
4776                         }
4777                         do_wakeup_routine = 1;
4778                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4779                                 stcb->asoc.sent_queue_cnt_removeable--;
4780                         }
4781                 }
4782                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4783                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4784                     SCTP_DATA_NOT_FRAG) {
4785                         /* not frag'ed we ae done   */
4786                         notdone = 0;
4787                         foundeom = 1;
4788                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4789                         /* end of frag, we are done */
4790                         notdone = 0;
4791                         foundeom = 1;
4792                 } else {
4793                         /*
4794                          * Its a begin or middle piece, we must mark all of
4795                          * it
4796                          */
4797                         notdone = 1;
4798                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4799                 }
4800         } while (tp1 && notdone);
4801         if (foundeom == 0) {
4802                 /*
4803                  * The multi-part message was scattered across the send and
4804                  * sent queue.
4805                  */
4806                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4807                         if ((tp1->rec.data.stream_number != stream) ||
4808                             (tp1->rec.data.stream_seq != seq)) {
4809                                 break;
4810                         }
4811                         /*
4812                          * save to chk in case we have some on stream out
4813                          * queue. If so and we have an un-transmitted one we
4814                          * don't have to fudge the TSN.
4815                          */
4816                         chk = tp1;
4817                         ret_sz += tp1->book_size;
4818                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4819                         if (sent) {
4820                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4821                         } else {
4822                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4823                         }
4824                         if (tp1->data) {
4825                                 sctp_m_freem(tp1->data);
4826                                 tp1->data = NULL;
4827                         }
4828                         /* No flight involved here book the size to 0 */
4829                         tp1->book_size = 0;
4830                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4831                                 foundeom = 1;
4832                         }
4833                         do_wakeup_routine = 1;
4834                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4835                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4836                         /*
4837                          * on to the sent queue so we can wait for it to be
4838                          * passed by.
4839                          */
4840                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4841                             sctp_next);
4842                         stcb->asoc.send_queue_cnt--;
4843                         stcb->asoc.sent_queue_cnt++;
4844                 }
4845         }
4846         if (foundeom == 0) {
4847                 /*
4848                  * Still no eom found. That means there is stuff left on the
4849                  * stream out queue.. yuck.
4850                  */
4851                 SCTP_TCB_SEND_LOCK(stcb);
4852                 strq = &stcb->asoc.strmout[stream];
4853                 sp = TAILQ_FIRST(&strq->outqueue);
4854                 if (sp != NULL) {
4855                         sp->discard_rest = 1;
4856                         /*
4857                          * We may need to put a chunk on the queue that
4858                          * holds the TSN that would have been sent with the
4859                          * LAST bit.
4860                          */
4861                         if (chk == NULL) {
4862                                 /* Yep, we have to */
4863                                 sctp_alloc_a_chunk(stcb, chk);
4864                                 if (chk == NULL) {
4865                                         /*
4866                                          * we are hosed. All we can do is
4867                                          * nothing.. which will cause an
4868                                          * abort if the peer is paying
4869                                          * attention.
4870                                          */
4871                                         goto oh_well;
4872                                 }
4873                                 memset(chk, 0, sizeof(*chk));
4874                                 chk->rec.data.rcv_flags = SCTP_DATA_LAST_FRAG;
4875                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
4876                                 chk->asoc = &stcb->asoc;
4877                                 chk->rec.data.stream_seq = strq->next_sequence_send;
4878                                 chk->rec.data.stream_number = sp->stream;
4879                                 chk->rec.data.payloadtype = sp->ppid;
4880                                 chk->rec.data.context = sp->context;
4881                                 chk->flags = sp->act_flags;
4882                                 if (sp->net)
4883                                         chk->whoTo = sp->net;
4884                                 else
4885                                         chk->whoTo = stcb->asoc.primary_destination;
4886                                 atomic_add_int(&chk->whoTo->ref_count, 1);
4887                                 chk->rec.data.TSN_seq = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4888                                 stcb->asoc.pr_sctp_cnt++;
4889                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4890                                 stcb->asoc.sent_queue_cnt++;
4891                                 stcb->asoc.pr_sctp_cnt++;
4892                         } else {
4893                                 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4894                         }
4895                         strq->next_sequence_send++;
4896         oh_well:
4897                         if (sp->data) {
4898                                 /*
4899                                  * Pull any data to free up the SB and allow
4900                                  * sender to "add more" while we will throw
4901                                  * away :-)
4902                                  */
4903                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
4904                                 ret_sz += sp->length;
4905                                 do_wakeup_routine = 1;
4906                                 sp->some_taken = 1;
4907                                 sctp_m_freem(sp->data);
4908                                 sp->data = NULL;
4909                                 sp->tail_mbuf = NULL;
4910                                 sp->length = 0;
4911                         }
4912                 }
4913                 SCTP_TCB_SEND_UNLOCK(stcb);
4914         }
4915         if (do_wakeup_routine) {
4916 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4917                 struct socket *so;
4918
4919                 so = SCTP_INP_SO(stcb->sctp_ep);
4920                 if (!so_locked) {
4921                         atomic_add_int(&stcb->asoc.refcnt, 1);
4922                         SCTP_TCB_UNLOCK(stcb);
4923                         SCTP_SOCKET_LOCK(so, 1);
4924                         SCTP_TCB_LOCK(stcb);
4925                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4926                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4927                                 /* assoc was freed while we were unlocked */
4928                                 SCTP_SOCKET_UNLOCK(so, 1);
4929                                 return (ret_sz);
4930                         }
4931                 }
4932 #endif
4933                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4934 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4935                 if (!so_locked) {
4936                         SCTP_SOCKET_UNLOCK(so, 1);
4937                 }
4938 #endif
4939         }
4940         return (ret_sz);
4941 }
4942
4943 /*
4944  * checks to see if the given address, sa, is one that is currently known by
4945  * the kernel note: can't distinguish the same address on multiple interfaces
4946  * and doesn't handle multiple addresses with different zone/scope id's note:
4947  * ifa_ifwithaddr() compares the entire sockaddr struct
4948  */
4949 struct sctp_ifa *
4950 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4951     int holds_lock)
4952 {
4953         struct sctp_laddr *laddr;
4954
4955         if (holds_lock == 0) {
4956                 SCTP_INP_RLOCK(inp);
4957         }
4958         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4959                 if (laddr->ifa == NULL)
4960                         continue;
4961                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4962                         continue;
4963 #ifdef INET
4964                 if (addr->sa_family == AF_INET) {
4965                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4966                             laddr->ifa->address.sin.sin_addr.s_addr) {
4967                                 /* found him. */
4968                                 if (holds_lock == 0) {
4969                                         SCTP_INP_RUNLOCK(inp);
4970                                 }
4971                                 return (laddr->ifa);
4972                                 break;
4973                         }
4974                 }
4975 #endif
4976 #ifdef INET6
4977                 if (addr->sa_family == AF_INET6) {
4978                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4979                             &laddr->ifa->address.sin6)) {
4980                                 /* found him. */
4981                                 if (holds_lock == 0) {
4982                                         SCTP_INP_RUNLOCK(inp);
4983                                 }
4984                                 return (laddr->ifa);
4985                                 break;
4986                         }
4987                 }
4988 #endif
4989         }
4990         if (holds_lock == 0) {
4991                 SCTP_INP_RUNLOCK(inp);
4992         }
4993         return (NULL);
4994 }
4995
4996 uint32_t
4997 sctp_get_ifa_hash_val(struct sockaddr *addr)
4998 {
4999         switch (addr->sa_family) {
5000 #ifdef INET
5001         case AF_INET:
5002                 {
5003                         struct sockaddr_in *sin;
5004
5005                         sin = (struct sockaddr_in *)addr;
5006                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
5007                 }
5008 #endif
5009 #ifdef INET6
5010         case AF_INET6:
5011                 {
5012                         struct sockaddr_in6 *sin6;
5013                         uint32_t hash_of_addr;
5014
5015                         sin6 = (struct sockaddr_in6 *)addr;
5016                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
5017                             sin6->sin6_addr.s6_addr32[1] +
5018                             sin6->sin6_addr.s6_addr32[2] +
5019                             sin6->sin6_addr.s6_addr32[3]);
5020                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
5021                         return (hash_of_addr);
5022                 }
5023 #endif
5024         default:
5025                 break;
5026         }
5027         return (0);
5028 }
5029
5030 struct sctp_ifa *
5031 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
5032 {
5033         struct sctp_ifa *sctp_ifap;
5034         struct sctp_vrf *vrf;
5035         struct sctp_ifalist *hash_head;
5036         uint32_t hash_of_addr;
5037
5038         if (holds_lock == 0)
5039                 SCTP_IPI_ADDR_RLOCK();
5040
5041         vrf = sctp_find_vrf(vrf_id);
5042         if (vrf == NULL) {
5043 stage_right:
5044                 if (holds_lock == 0)
5045                         SCTP_IPI_ADDR_RUNLOCK();
5046                 return (NULL);
5047         }
5048         hash_of_addr = sctp_get_ifa_hash_val(addr);
5049
5050         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5051         if (hash_head == NULL) {
5052                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5053                     hash_of_addr, (uint32_t) vrf->vrf_addr_hashmark,
5054                     (uint32_t) (hash_of_addr & vrf->vrf_addr_hashmark));
5055                 sctp_print_address(addr);
5056                 SCTP_PRINTF("No such bucket for address\n");
5057                 if (holds_lock == 0)
5058                         SCTP_IPI_ADDR_RUNLOCK();
5059
5060                 return (NULL);
5061         }
5062         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5063                 if (sctp_ifap == NULL) {
5064 #ifdef INVARIANTS
5065                         panic("Huh LIST_FOREACH corrupt");
5066                         goto stage_right;
5067 #else
5068                         SCTP_PRINTF("LIST corrupt of sctp_ifap's?\n");
5069                         goto stage_right;
5070 #endif
5071                 }
5072                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5073                         continue;
5074 #ifdef INET
5075                 if (addr->sa_family == AF_INET) {
5076                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5077                             sctp_ifap->address.sin.sin_addr.s_addr) {
5078                                 /* found him. */
5079                                 if (holds_lock == 0)
5080                                         SCTP_IPI_ADDR_RUNLOCK();
5081                                 return (sctp_ifap);
5082                                 break;
5083                         }
5084                 }
5085 #endif
5086 #ifdef INET6
5087                 if (addr->sa_family == AF_INET6) {
5088                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5089                             &sctp_ifap->address.sin6)) {
5090                                 /* found him. */
5091                                 if (holds_lock == 0)
5092                                         SCTP_IPI_ADDR_RUNLOCK();
5093                                 return (sctp_ifap);
5094                                 break;
5095                         }
5096                 }
5097 #endif
5098         }
5099         if (holds_lock == 0)
5100                 SCTP_IPI_ADDR_RUNLOCK();
5101         return (NULL);
5102 }
5103
5104 static void
5105 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t * freed_so_far, int hold_rlock,
5106     uint32_t rwnd_req)
5107 {
5108         /* User pulled some data, do we need a rwnd update? */
5109         int r_unlocked = 0;
5110         uint32_t dif, rwnd;
5111         struct socket *so = NULL;
5112
5113         if (stcb == NULL)
5114                 return;
5115
5116         atomic_add_int(&stcb->asoc.refcnt, 1);
5117
5118         if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED |
5119             SCTP_STATE_SHUTDOWN_RECEIVED |
5120             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5121                 /* Pre-check If we are freeing no update */
5122                 goto no_lock;
5123         }
5124         SCTP_INP_INCR_REF(stcb->sctp_ep);
5125         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5126             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5127                 goto out;
5128         }
5129         so = stcb->sctp_socket;
5130         if (so == NULL) {
5131                 goto out;
5132         }
5133         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5134         /* Have you have freed enough to look */
5135         *freed_so_far = 0;
5136         /* Yep, its worth a look and the lock overhead */
5137
5138         /* Figure out what the rwnd would be */
5139         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5140         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5141                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5142         } else {
5143                 dif = 0;
5144         }
5145         if (dif >= rwnd_req) {
5146                 if (hold_rlock) {
5147                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5148                         r_unlocked = 1;
5149                 }
5150                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5151                         /*
5152                          * One last check before we allow the guy possibly
5153                          * to get in. There is a race, where the guy has not
5154                          * reached the gate. In that case
5155                          */
5156                         goto out;
5157                 }
5158                 SCTP_TCB_LOCK(stcb);
5159                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5160                         /* No reports here */
5161                         SCTP_TCB_UNLOCK(stcb);
5162                         goto out;
5163                 }
5164                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5165                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5166
5167                 sctp_chunk_output(stcb->sctp_ep, stcb,
5168                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5169                 /* make sure no timer is running */
5170                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5171                 SCTP_TCB_UNLOCK(stcb);
5172         } else {
5173                 /* Update how much we have pending */
5174                 stcb->freed_by_sorcv_sincelast = dif;
5175         }
5176 out:
5177         if (so && r_unlocked && hold_rlock) {
5178                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5179         }
5180         SCTP_INP_DECR_REF(stcb->sctp_ep);
5181 no_lock:
5182         atomic_add_int(&stcb->asoc.refcnt, -1);
5183         return;
5184 }
5185
5186 int
5187 sctp_sorecvmsg(struct socket *so,
5188     struct uio *uio,
5189     struct mbuf **mp,
5190     struct sockaddr *from,
5191     int fromlen,
5192     int *msg_flags,
5193     struct sctp_sndrcvinfo *sinfo,
5194     int filling_sinfo)
5195 {
5196         /*
5197          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5198          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5199          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5200          * On the way out we may send out any combination of:
5201          * MSG_NOTIFICATION MSG_EOR
5202          *
5203          */
5204         struct sctp_inpcb *inp = NULL;
5205         int my_len = 0;
5206         int cp_len = 0, error = 0;
5207         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5208         struct mbuf *m = NULL;
5209         struct sctp_tcb *stcb = NULL;
5210         int wakeup_read_socket = 0;
5211         int freecnt_applied = 0;
5212         int out_flags = 0, in_flags = 0;
5213         int block_allowed = 1;
5214         uint32_t freed_so_far = 0;
5215         uint32_t copied_so_far = 0;
5216         int in_eeor_mode = 0;
5217         int no_rcv_needed = 0;
5218         uint32_t rwnd_req = 0;
5219         int hold_sblock = 0;
5220         int hold_rlock = 0;
5221         int slen = 0;
5222         uint32_t held_length = 0;
5223         int sockbuf_lock = 0;
5224
5225         if (uio == NULL) {
5226                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5227                 return (EINVAL);
5228         }
5229         if (msg_flags) {
5230                 in_flags = *msg_flags;
5231                 if (in_flags & MSG_PEEK)
5232                         SCTP_STAT_INCR(sctps_read_peeks);
5233         } else {
5234                 in_flags = 0;
5235         }
5236         slen = uio->uio_resid;
5237
5238         /* Pull in and set up our int flags */
5239         if (in_flags & MSG_OOB) {
5240                 /* Out of band's NOT supported */
5241                 return (EOPNOTSUPP);
5242         }
5243         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5244                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5245                 return (EINVAL);
5246         }
5247         if ((in_flags & (MSG_DONTWAIT
5248             | MSG_NBIO
5249             )) ||
5250             SCTP_SO_IS_NBIO(so)) {
5251                 block_allowed = 0;
5252         }
5253         /* setup the endpoint */
5254         inp = (struct sctp_inpcb *)so->so_pcb;
5255         if (inp == NULL) {
5256                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5257                 return (EFAULT);
5258         }
5259         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5260         /* Must be at least a MTU's worth */
5261         if (rwnd_req < SCTP_MIN_RWND)
5262                 rwnd_req = SCTP_MIN_RWND;
5263         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5264         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5265                 sctp_misc_ints(SCTP_SORECV_ENTER,
5266                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid);
5267         }
5268         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5269                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5270                     rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid);
5271         }
5272         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5273         if (error) {
5274                 goto release_unlocked;
5275         }
5276         sockbuf_lock = 1;
5277 restart:
5278
5279
5280 restart_nosblocks:
5281         if (hold_sblock == 0) {
5282                 SOCKBUF_LOCK(&so->so_rcv);
5283                 hold_sblock = 1;
5284         }
5285         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5286             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5287                 goto out;
5288         }
5289         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5290                 if (so->so_error) {
5291                         error = so->so_error;
5292                         if ((in_flags & MSG_PEEK) == 0)
5293                                 so->so_error = 0;
5294                         goto out;
5295                 } else {
5296                         if (so->so_rcv.sb_cc == 0) {
5297                                 /* indicate EOF */
5298                                 error = 0;
5299                                 goto out;
5300                         }
5301                 }
5302         }
5303         if ((so->so_rcv.sb_cc <= held_length) && block_allowed) {
5304                 /* we need to wait for data */
5305                 if ((so->so_rcv.sb_cc == 0) &&
5306                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5307                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5308                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5309                                 /*
5310                                  * For active open side clear flags for
5311                                  * re-use passive open is blocked by
5312                                  * connect.
5313                                  */
5314                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5315                                         /*
5316                                          * You were aborted, passive side
5317                                          * always hits here
5318                                          */
5319                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5320                                         error = ECONNRESET;
5321                                 }
5322                                 so->so_state &= ~(SS_ISCONNECTING |
5323                                     SS_ISDISCONNECTING |
5324                                     SS_ISCONFIRMING |
5325                                     SS_ISCONNECTED);
5326                                 if (error == 0) {
5327                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5328                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5329                                                 error = ENOTCONN;
5330                                         }
5331                                 }
5332                                 goto out;
5333                         }
5334                 }
5335                 error = sbwait(&so->so_rcv);
5336                 if (error) {
5337                         goto out;
5338                 }
5339                 held_length = 0;
5340                 goto restart_nosblocks;
5341         } else if (so->so_rcv.sb_cc == 0) {
5342                 if (so->so_error) {
5343                         error = so->so_error;
5344                         if ((in_flags & MSG_PEEK) == 0)
5345                                 so->so_error = 0;
5346                 } else {
5347                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5348                             (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5349                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5350                                         /*
5351                                          * For active open side clear flags
5352                                          * for re-use passive open is
5353                                          * blocked by connect.
5354                                          */
5355                                         if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5356                                                 /*
5357                                                  * You were aborted, passive
5358                                                  * side always hits here
5359                                                  */
5360                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5361                                                 error = ECONNRESET;
5362                                         }
5363                                         so->so_state &= ~(SS_ISCONNECTING |
5364                                             SS_ISDISCONNECTING |
5365                                             SS_ISCONFIRMING |
5366                                             SS_ISCONNECTED);
5367                                         if (error == 0) {
5368                                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5369                                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5370                                                         error = ENOTCONN;
5371                                                 }
5372                                         }
5373                                         goto out;
5374                                 }
5375                         }
5376                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5377                         error = EWOULDBLOCK;
5378                 }
5379                 goto out;
5380         }
5381         if (hold_sblock == 1) {
5382                 SOCKBUF_UNLOCK(&so->so_rcv);
5383                 hold_sblock = 0;
5384         }
5385         /* we possibly have data we can read */
5386         /* sa_ignore FREED_MEMORY */
5387         control = TAILQ_FIRST(&inp->read_queue);
5388         if (control == NULL) {
5389                 /*
5390                  * This could be happening since the appender did the
5391                  * increment but as not yet did the tailq insert onto the
5392                  * read_queue
5393                  */
5394                 if (hold_rlock == 0) {
5395                         SCTP_INP_READ_LOCK(inp);
5396                 }
5397                 control = TAILQ_FIRST(&inp->read_queue);
5398                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5399 #ifdef INVARIANTS
5400                         panic("Huh, its non zero and nothing on control?");
5401 #endif
5402                         so->so_rcv.sb_cc = 0;
5403                 }
5404                 SCTP_INP_READ_UNLOCK(inp);
5405                 hold_rlock = 0;
5406                 goto restart;
5407         }
5408         if ((control->length == 0) &&
5409             (control->do_not_ref_stcb)) {
5410                 /*
5411                  * Clean up code for freeing assoc that left behind a
5412                  * pdapi.. maybe a peer in EEOR that just closed after
5413                  * sending and never indicated a EOR.
5414                  */
5415                 if (hold_rlock == 0) {
5416                         hold_rlock = 1;
5417                         SCTP_INP_READ_LOCK(inp);
5418                 }
5419                 control->held_length = 0;
5420                 if (control->data) {
5421                         /* Hmm there is data here .. fix */
5422                         struct mbuf *m_tmp;
5423                         int cnt = 0;
5424
5425                         m_tmp = control->data;
5426                         while (m_tmp) {
5427                                 cnt += SCTP_BUF_LEN(m_tmp);
5428                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5429                                         control->tail_mbuf = m_tmp;
5430                                         control->end_added = 1;
5431                                 }
5432                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5433                         }
5434                         control->length = cnt;
5435                 } else {
5436                         /* remove it */
5437                         TAILQ_REMOVE(&inp->read_queue, control, next);
5438                         /* Add back any hiddend data */
5439                         sctp_free_remote_addr(control->whoFrom);
5440                         sctp_free_a_readq(stcb, control);
5441                 }
5442                 if (hold_rlock) {
5443                         hold_rlock = 0;
5444                         SCTP_INP_READ_UNLOCK(inp);
5445                 }
5446                 goto restart;
5447         }
5448         if ((control->length == 0) &&
5449             (control->end_added == 1)) {
5450                 /*
5451                  * Do we also need to check for (control->pdapi_aborted ==
5452                  * 1)?
5453                  */
5454                 if (hold_rlock == 0) {
5455                         hold_rlock = 1;
5456                         SCTP_INP_READ_LOCK(inp);
5457                 }
5458                 TAILQ_REMOVE(&inp->read_queue, control, next);
5459                 if (control->data) {
5460 #ifdef INVARIANTS
5461                         panic("control->data not null but control->length == 0");
5462 #else
5463                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5464                         sctp_m_freem(control->data);
5465                         control->data = NULL;
5466 #endif
5467                 }
5468                 if (control->aux_data) {
5469                         sctp_m_free(control->aux_data);
5470                         control->aux_data = NULL;
5471                 }
5472                 sctp_free_remote_addr(control->whoFrom);
5473                 sctp_free_a_readq(stcb, control);
5474                 if (hold_rlock) {
5475                         hold_rlock = 0;
5476                         SCTP_INP_READ_UNLOCK(inp);
5477                 }
5478                 goto restart;
5479         }
5480         if (control->length == 0) {
5481                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5482                     (filling_sinfo)) {
5483                         /* find a more suitable one then this */
5484                         ctl = TAILQ_NEXT(control, next);
5485                         while (ctl) {
5486                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5487                                     (ctl->some_taken ||
5488                                     (ctl->spec_flags & M_NOTIFICATION) ||
5489                                     ((ctl->do_not_ref_stcb == 0) &&
5490                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5491                                     ) {
5492                                         /*-
5493                                          * If we have a different TCB next, and there is data
5494                                          * present. If we have already taken some (pdapi), OR we can
5495                                          * ref the tcb and no delivery as started on this stream, we
5496                                          * take it. Note we allow a notification on a different
5497                                          * assoc to be delivered..
5498                                          */
5499                                         control = ctl;
5500                                         goto found_one;
5501                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5502                                             (ctl->length) &&
5503                                             ((ctl->some_taken) ||
5504                                             ((ctl->do_not_ref_stcb == 0) &&
5505                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5506                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5507                                         /*-
5508                                          * If we have the same tcb, and there is data present, and we
5509                                          * have the strm interleave feature present. Then if we have
5510                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5511                                          * not started a delivery for this stream, we can take it.
5512                                          * Note we do NOT allow a notificaiton on the same assoc to
5513                                          * be delivered.
5514                                          */
5515                                         control = ctl;
5516                                         goto found_one;
5517                                 }
5518                                 ctl = TAILQ_NEXT(ctl, next);
5519                         }
5520                 }
5521                 /*
5522                  * if we reach here, not suitable replacement is available
5523                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5524                  * into the our held count, and its time to sleep again.
5525                  */
5526                 held_length = so->so_rcv.sb_cc;
5527                 control->held_length = so->so_rcv.sb_cc;
5528                 goto restart;
5529         }
5530         /* Clear the held length since there is something to read */
5531         control->held_length = 0;
5532         if (hold_rlock) {
5533                 SCTP_INP_READ_UNLOCK(inp);
5534                 hold_rlock = 0;
5535         }
5536 found_one:
5537         /*
5538          * If we reach here, control has a some data for us to read off.
5539          * Note that stcb COULD be NULL.
5540          */
5541         control->some_taken++;
5542         if (hold_sblock) {
5543                 SOCKBUF_UNLOCK(&so->so_rcv);
5544                 hold_sblock = 0;
5545         }
5546         stcb = control->stcb;
5547         if (stcb) {
5548                 if ((control->do_not_ref_stcb == 0) &&
5549                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5550                         if (freecnt_applied == 0)
5551                                 stcb = NULL;
5552                 } else if (control->do_not_ref_stcb == 0) {
5553                         /* you can't free it on me please */
5554                         /*
5555                          * The lock on the socket buffer protects us so the
5556                          * free code will stop. But since we used the
5557                          * socketbuf lock and the sender uses the tcb_lock
5558                          * to increment, we need to use the atomic add to
5559                          * the refcnt
5560                          */
5561                         if (freecnt_applied) {
5562 #ifdef INVARIANTS
5563                                 panic("refcnt already incremented");
5564 #else
5565                                 SCTP_PRINTF("refcnt already incremented?\n");
5566 #endif
5567                         } else {
5568                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5569                                 freecnt_applied = 1;
5570                         }
5571                         /*
5572                          * Setup to remember how much we have not yet told
5573                          * the peer our rwnd has opened up. Note we grab the
5574                          * value from the tcb from last time. Note too that
5575                          * sack sending clears this when a sack is sent,
5576                          * which is fine. Once we hit the rwnd_req, we then
5577                          * will go to the sctp_user_rcvd() that will not
5578                          * lock until it KNOWs it MUST send a WUP-SACK.
5579                          */
5580                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5581                         stcb->freed_by_sorcv_sincelast = 0;
5582                 }
5583         }
5584         if (stcb &&
5585             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5586             control->do_not_ref_stcb == 0) {
5587                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5588         }
5589         /* First lets get off the sinfo and sockaddr info */
5590         if ((sinfo) && filling_sinfo) {
5591                 memcpy(sinfo, control, sizeof(struct sctp_nonpad_sndrcvinfo));
5592                 nxt = TAILQ_NEXT(control, next);
5593                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5594                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5595                         struct sctp_extrcvinfo *s_extra;
5596
5597                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5598                         if ((nxt) &&
5599                             (nxt->length)) {
5600                                 s_extra->sreinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5601                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5602                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5603                                 }
5604                                 if (nxt->spec_flags & M_NOTIFICATION) {
5605                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5606                                 }
5607                                 s_extra->sreinfo_next_aid = nxt->sinfo_assoc_id;
5608                                 s_extra->sreinfo_next_length = nxt->length;
5609                                 s_extra->sreinfo_next_ppid = nxt->sinfo_ppid;
5610                                 s_extra->sreinfo_next_stream = nxt->sinfo_stream;
5611                                 if (nxt->tail_mbuf != NULL) {
5612                                         if (nxt->end_added) {
5613                                                 s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5614                                         }
5615                                 }
5616                         } else {
5617                                 /*
5618                                  * we explicitly 0 this, since the memcpy
5619                                  * got some other things beyond the older
5620                                  * sinfo_ that is on the control's structure
5621                                  * :-D
5622                                  */
5623                                 nxt = NULL;
5624                                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
5625                                 s_extra->sreinfo_next_aid = 0;
5626                                 s_extra->sreinfo_next_length = 0;
5627                                 s_extra->sreinfo_next_ppid = 0;
5628                                 s_extra->sreinfo_next_stream = 0;
5629                         }
5630                 }
5631                 /*
5632                  * update off the real current cum-ack, if we have an stcb.
5633                  */
5634                 if ((control->do_not_ref_stcb == 0) && stcb)
5635                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5636                 /*
5637                  * mask off the high bits, we keep the actual chunk bits in
5638                  * there.
5639                  */
5640                 sinfo->sinfo_flags &= 0x00ff;
5641                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5642                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5643                 }
5644         }
5645 #ifdef SCTP_ASOCLOG_OF_TSNS
5646         {
5647                 int index, newindex;
5648                 struct sctp_pcbtsn_rlog *entry;
5649
5650                 do {
5651                         index = inp->readlog_index;
5652                         newindex = index + 1;
5653                         if (newindex >= SCTP_READ_LOG_SIZE) {
5654                                 newindex = 0;
5655                         }
5656                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5657                 entry = &inp->readlog[index];
5658                 entry->vtag = control->sinfo_assoc_id;
5659                 entry->strm = control->sinfo_stream;
5660                 entry->seq = control->sinfo_ssn;
5661                 entry->sz = control->length;
5662                 entry->flgs = control->sinfo_flags;
5663         }
5664 #endif
5665         if ((fromlen > 0) && (from != NULL)) {
5666                 union sctp_sockstore store;
5667                 size_t len;
5668
5669                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5670 #ifdef INET6
5671                 case AF_INET6:
5672                         len = sizeof(struct sockaddr_in6);
5673                         store.sin6 = control->whoFrom->ro._l_addr.sin6;
5674                         store.sin6.sin6_port = control->port_from;
5675                         break;
5676 #endif
5677 #ifdef INET
5678                 case AF_INET:
5679 #ifdef INET6
5680                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5681                                 len = sizeof(struct sockaddr_in6);
5682                                 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5683                                     &store.sin6);
5684                                 store.sin6.sin6_port = control->port_from;
5685                         } else {
5686                                 len = sizeof(struct sockaddr_in);
5687                                 store.sin = control->whoFrom->ro._l_addr.sin;
5688                                 store.sin.sin_port = control->port_from;
5689                         }
5690 #else
5691                         len = sizeof(struct sockaddr_in);
5692                         store.sin = control->whoFrom->ro._l_addr.sin;
5693                         store.sin.sin_port = control->port_from;
5694 #endif
5695                         break;
5696 #endif
5697                 default:
5698                         len = 0;
5699                         break;
5700                 }
5701                 memcpy(from, &store, min((size_t)fromlen, len));
5702 #ifdef INET6
5703                 {
5704                         struct sockaddr_in6 lsa6, *from6;
5705
5706                         from6 = (struct sockaddr_in6 *)from;
5707                         sctp_recover_scope_mac(from6, (&lsa6));
5708                 }
5709 #endif
5710         }
5711         /* now copy out what data we can */
5712         if (mp == NULL) {
5713                 /* copy out each mbuf in the chain up to length */
5714 get_more_data:
5715                 m = control->data;
5716                 while (m) {
5717                         /* Move out all we can */
5718                         cp_len = (int)uio->uio_resid;
5719                         my_len = (int)SCTP_BUF_LEN(m);
5720                         if (cp_len > my_len) {
5721                                 /* not enough in this buf */
5722                                 cp_len = my_len;
5723                         }
5724                         if (hold_rlock) {
5725                                 SCTP_INP_READ_UNLOCK(inp);
5726                                 hold_rlock = 0;
5727                         }
5728                         if (cp_len > 0)
5729                                 error = uiomove(mtod(m, char *), cp_len, uio);
5730                         /* re-read */
5731                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5732                                 goto release;
5733                         }
5734                         if ((control->do_not_ref_stcb == 0) && stcb &&
5735                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5736                                 no_rcv_needed = 1;
5737                         }
5738                         if (error) {
5739                                 /* error we are out of here */
5740                                 goto release;
5741                         }
5742                         if ((SCTP_BUF_NEXT(m) == NULL) &&
5743                             (cp_len >= SCTP_BUF_LEN(m)) &&
5744                             ((control->end_added == 0) ||
5745                             (control->end_added &&
5746                             (TAILQ_NEXT(control, next) == NULL)))
5747                             ) {
5748                                 SCTP_INP_READ_LOCK(inp);
5749                                 hold_rlock = 1;
5750                         }
5751                         if (cp_len == SCTP_BUF_LEN(m)) {
5752                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5753                                     (control->end_added)) {
5754                                         out_flags |= MSG_EOR;
5755                                         if ((control->do_not_ref_stcb == 0) &&
5756                                             (control->stcb != NULL) &&
5757                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5758                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5759                                 }
5760                                 if (control->spec_flags & M_NOTIFICATION) {
5761                                         out_flags |= MSG_NOTIFICATION;
5762                                 }
5763                                 /* we ate up the mbuf */
5764                                 if (in_flags & MSG_PEEK) {
5765                                         /* just looking */
5766                                         m = SCTP_BUF_NEXT(m);
5767                                         copied_so_far += cp_len;
5768                                 } else {
5769                                         /* dispose of the mbuf */
5770                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5771                                                 sctp_sblog(&so->so_rcv,
5772                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5773                                         }
5774                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5775                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5776                                                 sctp_sblog(&so->so_rcv,
5777                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5778                                         }
5779                                         copied_so_far += cp_len;
5780                                         freed_so_far += cp_len;
5781                                         freed_so_far += MSIZE;
5782                                         atomic_subtract_int(&control->length, cp_len);
5783                                         control->data = sctp_m_free(m);
5784                                         m = control->data;
5785                                         /*
5786                                          * been through it all, must hold sb
5787                                          * lock ok to null tail
5788                                          */
5789                                         if (control->data == NULL) {
5790 #ifdef INVARIANTS
5791                                                 if ((control->end_added == 0) ||
5792                                                     (TAILQ_NEXT(control, next) == NULL)) {
5793                                                         /*
5794                                                          * If the end is not
5795                                                          * added, OR the
5796                                                          * next is NOT null
5797                                                          * we MUST have the
5798                                                          * lock.
5799                                                          */
5800                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5801                                                                 panic("Hmm we don't own the lock?");
5802                                                         }
5803                                                 }
5804 #endif
5805                                                 control->tail_mbuf = NULL;
5806 #ifdef INVARIANTS
5807                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5808                                                         panic("end_added, nothing left and no MSG_EOR");
5809                                                 }
5810 #endif
5811                                         }
5812                                 }
5813                         } else {
5814                                 /* Do we need to trim the mbuf? */
5815                                 if (control->spec_flags & M_NOTIFICATION) {
5816                                         out_flags |= MSG_NOTIFICATION;
5817                                 }
5818                                 if ((in_flags & MSG_PEEK) == 0) {
5819                                         SCTP_BUF_RESV_UF(m, cp_len);
5820                                         SCTP_BUF_LEN(m) -= cp_len;
5821                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5822                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5823                                         }
5824                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5825                                         if ((control->do_not_ref_stcb == 0) &&
5826                                             stcb) {
5827                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5828                                         }
5829                                         copied_so_far += cp_len;
5830                                         freed_so_far += cp_len;
5831                                         freed_so_far += MSIZE;
5832                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5833                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5834                                                     SCTP_LOG_SBRESULT, 0);
5835                                         }
5836                                         atomic_subtract_int(&control->length, cp_len);
5837                                 } else {
5838                                         copied_so_far += cp_len;
5839                                 }
5840                         }
5841                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5842                                 break;
5843                         }
5844                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5845                             (control->do_not_ref_stcb == 0) &&
5846                             (freed_so_far >= rwnd_req)) {
5847                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5848                         }
5849                 }               /* end while(m) */
5850                 /*
5851                  * At this point we have looked at it all and we either have
5852                  * a MSG_EOR/or read all the user wants... <OR>
5853                  * control->length == 0.
5854                  */
5855                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5856                         /* we are done with this control */
5857                         if (control->length == 0) {
5858                                 if (control->data) {
5859 #ifdef INVARIANTS
5860                                         panic("control->data not null at read eor?");
5861 #else
5862                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5863                                         sctp_m_freem(control->data);
5864                                         control->data = NULL;
5865 #endif
5866                                 }
5867                 done_with_control:
5868                                 if (TAILQ_NEXT(control, next) == NULL) {
5869                                         /*
5870                                          * If we don't have a next we need a
5871                                          * lock, if there is a next
5872                                          * interrupt is filling ahead of us
5873                                          * and we don't need a lock to
5874                                          * remove this guy (which is the
5875                                          * head of the queue).
5876                                          */
5877                                         if (hold_rlock == 0) {
5878                                                 SCTP_INP_READ_LOCK(inp);
5879                                                 hold_rlock = 1;
5880                                         }
5881                                 }
5882                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5883                                 /* Add back any hiddend data */
5884                                 if (control->held_length) {
5885                                         held_length = 0;
5886                                         control->held_length = 0;
5887                                         wakeup_read_socket = 1;
5888                                 }
5889                                 if (control->aux_data) {
5890                                         sctp_m_free(control->aux_data);
5891                                         control->aux_data = NULL;
5892                                 }
5893                                 no_rcv_needed = control->do_not_ref_stcb;
5894                                 sctp_free_remote_addr(control->whoFrom);
5895                                 control->data = NULL;
5896                                 sctp_free_a_readq(stcb, control);
5897                                 control = NULL;
5898                                 if ((freed_so_far >= rwnd_req) &&
5899                                     (no_rcv_needed == 0))
5900                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5901
5902                         } else {
5903                                 /*
5904                                  * The user did not read all of this
5905                                  * message, turn off the returned MSG_EOR
5906                                  * since we are leaving more behind on the
5907                                  * control to read.
5908                                  */
5909 #ifdef INVARIANTS
5910                                 if (control->end_added &&
5911                                     (control->data == NULL) &&
5912                                     (control->tail_mbuf == NULL)) {
5913                                         panic("Gak, control->length is corrupt?");
5914                                 }
5915 #endif
5916                                 no_rcv_needed = control->do_not_ref_stcb;
5917                                 out_flags &= ~MSG_EOR;
5918                         }
5919                 }
5920                 if (out_flags & MSG_EOR) {
5921                         goto release;
5922                 }
5923                 if ((uio->uio_resid == 0) ||
5924                     ((in_eeor_mode) &&
5925                     (copied_so_far >= (uint32_t) max(so->so_rcv.sb_lowat, 1)))) {
5926                         goto release;
5927                 }
5928                 /*
5929                  * If I hit here the receiver wants more and this message is
5930                  * NOT done (pd-api). So two questions. Can we block? if not
5931                  * we are done. Did the user NOT set MSG_WAITALL?
5932                  */
5933                 if (block_allowed == 0) {
5934                         goto release;
5935                 }
5936                 /*
5937                  * We need to wait for more data a few things: - We don't
5938                  * sbunlock() so we don't get someone else reading. - We
5939                  * must be sure to account for the case where what is added
5940                  * is NOT to our control when we wakeup.
5941                  */
5942
5943                 /*
5944                  * Do we need to tell the transport a rwnd update might be
5945                  * needed before we go to sleep?
5946                  */
5947                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5948                     ((freed_so_far >= rwnd_req) &&
5949                     (control->do_not_ref_stcb == 0) &&
5950                     (no_rcv_needed == 0))) {
5951                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5952                 }
5953 wait_some_more:
5954                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5955                         goto release;
5956                 }
5957                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5958                         goto release;
5959
5960                 if (hold_rlock == 1) {
5961                         SCTP_INP_READ_UNLOCK(inp);
5962                         hold_rlock = 0;
5963                 }
5964                 if (hold_sblock == 0) {
5965                         SOCKBUF_LOCK(&so->so_rcv);
5966                         hold_sblock = 1;
5967                 }
5968                 if ((copied_so_far) && (control->length == 0) &&
5969                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5970                         goto release;
5971                 }
5972                 if (so->so_rcv.sb_cc <= control->held_length) {
5973                         error = sbwait(&so->so_rcv);
5974                         if (error) {
5975                                 goto release;
5976                         }
5977                         control->held_length = 0;
5978                 }
5979                 if (hold_sblock) {
5980                         SOCKBUF_UNLOCK(&so->so_rcv);
5981                         hold_sblock = 0;
5982                 }
5983                 if (control->length == 0) {
5984                         /* still nothing here */
5985                         if (control->end_added == 1) {
5986                                 /* he aborted, or is done i.e.did a shutdown */
5987                                 out_flags |= MSG_EOR;
5988                                 if (control->pdapi_aborted) {
5989                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5990                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5991
5992                                         out_flags |= MSG_TRUNC;
5993                                 } else {
5994                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5995                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5996                                 }
5997                                 goto done_with_control;
5998                         }
5999                         if (so->so_rcv.sb_cc > held_length) {
6000                                 control->held_length = so->so_rcv.sb_cc;
6001                                 held_length = 0;
6002                         }
6003                         goto wait_some_more;
6004                 } else if (control->data == NULL) {
6005                         /*
6006                          * we must re-sync since data is probably being
6007                          * added
6008                          */
6009                         SCTP_INP_READ_LOCK(inp);
6010                         if ((control->length > 0) && (control->data == NULL)) {
6011                                 /*
6012                                  * big trouble.. we have the lock and its
6013                                  * corrupt?
6014                                  */
6015 #ifdef INVARIANTS
6016                                 panic("Impossible data==NULL length !=0");
6017 #endif
6018                                 out_flags |= MSG_EOR;
6019                                 out_flags |= MSG_TRUNC;
6020                                 control->length = 0;
6021                                 SCTP_INP_READ_UNLOCK(inp);
6022                                 goto done_with_control;
6023                         }
6024                         SCTP_INP_READ_UNLOCK(inp);
6025                         /* We will fall around to get more data */
6026                 }
6027                 goto get_more_data;
6028         } else {
6029                 /*-
6030                  * Give caller back the mbuf chain,
6031                  * store in uio_resid the length
6032                  */
6033                 wakeup_read_socket = 0;
6034                 if ((control->end_added == 0) ||
6035                     (TAILQ_NEXT(control, next) == NULL)) {
6036                         /* Need to get rlock */
6037                         if (hold_rlock == 0) {
6038                                 SCTP_INP_READ_LOCK(inp);
6039                                 hold_rlock = 1;
6040                         }
6041                 }
6042                 if (control->end_added) {
6043                         out_flags |= MSG_EOR;
6044                         if ((control->do_not_ref_stcb == 0) &&
6045                             (control->stcb != NULL) &&
6046                             ((control->spec_flags & M_NOTIFICATION) == 0))
6047                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6048                 }
6049                 if (control->spec_flags & M_NOTIFICATION) {
6050                         out_flags |= MSG_NOTIFICATION;
6051                 }
6052                 uio->uio_resid = control->length;
6053                 *mp = control->data;
6054                 m = control->data;
6055                 while (m) {
6056                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6057                                 sctp_sblog(&so->so_rcv,
6058                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6059                         }
6060                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6061                         freed_so_far += SCTP_BUF_LEN(m);
6062                         freed_so_far += MSIZE;
6063                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6064                                 sctp_sblog(&so->so_rcv,
6065                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6066                         }
6067                         m = SCTP_BUF_NEXT(m);
6068                 }
6069                 control->data = control->tail_mbuf = NULL;
6070                 control->length = 0;
6071                 if (out_flags & MSG_EOR) {
6072                         /* Done with this control */
6073                         goto done_with_control;
6074                 }
6075         }
6076 release:
6077         if (hold_rlock == 1) {
6078                 SCTP_INP_READ_UNLOCK(inp);
6079                 hold_rlock = 0;
6080         }
6081         if (hold_sblock == 1) {
6082                 SOCKBUF_UNLOCK(&so->so_rcv);
6083                 hold_sblock = 0;
6084         }
6085         sbunlock(&so->so_rcv);
6086         sockbuf_lock = 0;
6087
6088 release_unlocked:
6089         if (hold_sblock) {
6090                 SOCKBUF_UNLOCK(&so->so_rcv);
6091                 hold_sblock = 0;
6092         }
6093         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6094                 if ((freed_so_far >= rwnd_req) &&
6095                     (control && (control->do_not_ref_stcb == 0)) &&
6096                     (no_rcv_needed == 0))
6097                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6098         }
6099 out:
6100         if (msg_flags) {
6101                 *msg_flags = out_flags;
6102         }
6103         if (((out_flags & MSG_EOR) == 0) &&
6104             ((in_flags & MSG_PEEK) == 0) &&
6105             (sinfo) &&
6106             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6107             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6108                 struct sctp_extrcvinfo *s_extra;
6109
6110                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6111                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
6112         }
6113         if (hold_rlock == 1) {
6114                 SCTP_INP_READ_UNLOCK(inp);
6115         }
6116         if (hold_sblock) {
6117                 SOCKBUF_UNLOCK(&so->so_rcv);
6118         }
6119         if (sockbuf_lock) {
6120                 sbunlock(&so->so_rcv);
6121         }
6122         if (freecnt_applied) {
6123                 /*
6124                  * The lock on the socket buffer protects us so the free
6125                  * code will stop. But since we used the socketbuf lock and
6126                  * the sender uses the tcb_lock to increment, we need to use
6127                  * the atomic add to the refcnt.
6128                  */
6129                 if (stcb == NULL) {
6130 #ifdef INVARIANTS
6131                         panic("stcb for refcnt has gone NULL?");
6132                         goto stage_left;
6133 #else
6134                         goto stage_left;
6135 #endif
6136                 }
6137                 atomic_add_int(&stcb->asoc.refcnt, -1);
6138                 /* Save the value back for next time */
6139                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6140         }
6141         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6142                 if (stcb) {
6143                         sctp_misc_ints(SCTP_SORECV_DONE,
6144                             freed_so_far,
6145                             ((uio) ? (slen - uio->uio_resid) : slen),
6146                             stcb->asoc.my_rwnd,
6147                             so->so_rcv.sb_cc);
6148                 } else {
6149                         sctp_misc_ints(SCTP_SORECV_DONE,
6150                             freed_so_far,
6151                             ((uio) ? (slen - uio->uio_resid) : slen),
6152                             0,
6153                             so->so_rcv.sb_cc);
6154                 }
6155         }
6156 stage_left:
6157         if (wakeup_read_socket) {
6158                 sctp_sorwakeup(inp, so);
6159         }
6160         return (error);
6161 }
6162
6163
6164 #ifdef SCTP_MBUF_LOGGING
6165 struct mbuf *
6166 sctp_m_free(struct mbuf *m)
6167 {
6168         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6169                 if (SCTP_BUF_IS_EXTENDED(m)) {
6170                         sctp_log_mb(m, SCTP_MBUF_IFREE);
6171                 }
6172         }
6173         return (m_free(m));
6174 }
6175
6176 void
6177 sctp_m_freem(struct mbuf *mb)
6178 {
6179         while (mb != NULL)
6180                 mb = sctp_m_free(mb);
6181 }
6182
6183 #endif
6184
6185 int
6186 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6187 {
6188         /*
6189          * Given a local address. For all associations that holds the
6190          * address, request a peer-set-primary.
6191          */
6192         struct sctp_ifa *ifa;
6193         struct sctp_laddr *wi;
6194
6195         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6196         if (ifa == NULL) {
6197                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6198                 return (EADDRNOTAVAIL);
6199         }
6200         /*
6201          * Now that we have the ifa we must awaken the iterator with this
6202          * message.
6203          */
6204         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6205         if (wi == NULL) {
6206                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6207                 return (ENOMEM);
6208         }
6209         /* Now incr the count and int wi structure */
6210         SCTP_INCR_LADDR_COUNT();
6211         bzero(wi, sizeof(*wi));
6212         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6213         wi->ifa = ifa;
6214         wi->action = SCTP_SET_PRIM_ADDR;
6215         atomic_add_int(&ifa->refcount, 1);
6216
6217         /* Now add it to the work queue */
6218         SCTP_WQ_ADDR_LOCK();
6219         /*
6220          * Should this really be a tailq? As it is we will process the
6221          * newest first :-0
6222          */
6223         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6224         SCTP_WQ_ADDR_UNLOCK();
6225         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6226             (struct sctp_inpcb *)NULL,
6227             (struct sctp_tcb *)NULL,
6228             (struct sctp_nets *)NULL);
6229         return (0);
6230 }
6231
6232
6233 int
6234 sctp_soreceive(struct socket *so,
6235     struct sockaddr **psa,
6236     struct uio *uio,
6237     struct mbuf **mp0,
6238     struct mbuf **controlp,
6239     int *flagsp)
6240 {
6241         int error, fromlen;
6242         uint8_t sockbuf[256];
6243         struct sockaddr *from;
6244         struct sctp_extrcvinfo sinfo;
6245         int filling_sinfo = 1;
6246         struct sctp_inpcb *inp;
6247
6248         inp = (struct sctp_inpcb *)so->so_pcb;
6249         /* pickup the assoc we are reading from */
6250         if (inp == NULL) {
6251                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6252                 return (EINVAL);
6253         }
6254         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6255             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6256             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6257             (controlp == NULL)) {
6258                 /* user does not want the sndrcv ctl */
6259                 filling_sinfo = 0;
6260         }
6261         if (psa) {
6262                 from = (struct sockaddr *)sockbuf;
6263                 fromlen = sizeof(sockbuf);
6264                 from->sa_len = 0;
6265         } else {
6266                 from = NULL;
6267                 fromlen = 0;
6268         }
6269
6270         if (filling_sinfo) {
6271                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6272         }
6273         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
6274             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6275         if (controlp != NULL) {
6276                 /* copy back the sinfo in a CMSG format */
6277                 if (filling_sinfo)
6278                         *controlp = sctp_build_ctl_nchunk(inp,
6279                             (struct sctp_sndrcvinfo *)&sinfo);
6280                 else
6281                         *controlp = NULL;
6282         }
6283         if (psa) {
6284                 /* copy back the address info */
6285                 if (from && from->sa_len) {
6286                         *psa = sodupsockaddr(from, M_NOWAIT);
6287                 } else {
6288                         *psa = NULL;
6289                 }
6290         }
6291         return (error);
6292 }
6293
6294
6295
6296
6297
6298 int
6299 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6300     int totaddr, int *error)
6301 {
6302         int added = 0;
6303         int i;
6304         struct sctp_inpcb *inp;
6305         struct sockaddr *sa;
6306         size_t incr = 0;
6307
6308 #ifdef INET
6309         struct sockaddr_in *sin;
6310
6311 #endif
6312 #ifdef INET6
6313         struct sockaddr_in6 *sin6;
6314
6315 #endif
6316
6317         sa = addr;
6318         inp = stcb->sctp_ep;
6319         *error = 0;
6320         for (i = 0; i < totaddr; i++) {
6321                 switch (sa->sa_family) {
6322 #ifdef INET
6323                 case AF_INET:
6324                         incr = sizeof(struct sockaddr_in);
6325                         sin = (struct sockaddr_in *)sa;
6326                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6327                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6328                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6329                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6330                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6331                                 *error = EINVAL;
6332                                 goto out_now;
6333                         }
6334                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6335                                 /* assoc gone no un-lock */
6336                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6337                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6338                                 *error = ENOBUFS;
6339                                 goto out_now;
6340                         }
6341                         added++;
6342                         break;
6343 #endif
6344 #ifdef INET6
6345                 case AF_INET6:
6346                         incr = sizeof(struct sockaddr_in6);
6347                         sin6 = (struct sockaddr_in6 *)sa;
6348                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6349                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6350                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6351                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6352                                 *error = EINVAL;
6353                                 goto out_now;
6354                         }
6355                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6356                                 /* assoc gone no un-lock */
6357                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6358                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6359                                 *error = ENOBUFS;
6360                                 goto out_now;
6361                         }
6362                         added++;
6363                         break;
6364 #endif
6365                 default:
6366                         break;
6367                 }
6368                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6369         }
6370 out_now:
6371         return (added);
6372 }
6373
6374 struct sctp_tcb *
6375 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6376     int *totaddr, int *num_v4, int *num_v6, int *error,
6377     int limit, int *bad_addr)
6378 {
6379         struct sockaddr *sa;
6380         struct sctp_tcb *stcb = NULL;
6381         size_t incr, at, i;
6382
6383         at = incr = 0;
6384         sa = addr;
6385
6386         *error = *num_v6 = *num_v4 = 0;
6387         /* account and validate addresses */
6388         for (i = 0; i < (size_t)*totaddr; i++) {
6389                 switch (sa->sa_family) {
6390 #ifdef INET
6391                 case AF_INET:
6392                         (*num_v4) += 1;
6393                         incr = sizeof(struct sockaddr_in);
6394                         if (sa->sa_len != incr) {
6395                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6396                                 *error = EINVAL;
6397                                 *bad_addr = 1;
6398                                 return (NULL);
6399                         }
6400                         break;
6401 #endif
6402 #ifdef INET6
6403                 case AF_INET6:
6404                         {
6405                                 struct sockaddr_in6 *sin6;
6406
6407                                 sin6 = (struct sockaddr_in6 *)sa;
6408                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6409                                         /* Must be non-mapped for connectx */
6410                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6411                                         *error = EINVAL;
6412                                         *bad_addr = 1;
6413                                         return (NULL);
6414                                 }
6415                                 (*num_v6) += 1;
6416                                 incr = sizeof(struct sockaddr_in6);
6417                                 if (sa->sa_len != incr) {
6418                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6419                                         *error = EINVAL;
6420                                         *bad_addr = 1;
6421                                         return (NULL);
6422                                 }
6423                                 break;
6424                         }
6425 #endif
6426                 default:
6427                         *totaddr = i;
6428                         /* we are done */
6429                         break;
6430                 }
6431                 if (i == (size_t)*totaddr) {
6432                         break;
6433                 }
6434                 SCTP_INP_INCR_REF(inp);
6435                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6436                 if (stcb != NULL) {
6437                         /* Already have or am bring up an association */
6438                         return (stcb);
6439                 } else {
6440                         SCTP_INP_DECR_REF(inp);
6441                 }
6442                 if ((at + incr) > (size_t)limit) {
6443                         *totaddr = i;
6444                         break;
6445                 }
6446                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6447         }
6448         return ((struct sctp_tcb *)NULL);
6449 }
6450
6451 /*
6452  * sctp_bindx(ADD) for one address.
6453  * assumes all arguments are valid/checked by caller.
6454  */
6455 void
6456 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6457     struct sockaddr *sa, sctp_assoc_t assoc_id,
6458     uint32_t vrf_id, int *error, void *p)
6459 {
6460         struct sockaddr *addr_touse;
6461
6462 #if defined(INET) && defined(INET6)
6463         struct sockaddr_in sin;
6464
6465 #endif
6466
6467         /* see if we're bound all already! */
6468         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6469                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6470                 *error = EINVAL;
6471                 return;
6472         }
6473         addr_touse = sa;
6474 #ifdef INET6
6475         if (sa->sa_family == AF_INET6) {
6476 #ifdef INET
6477                 struct sockaddr_in6 *sin6;
6478
6479 #endif
6480                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6481                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6482                         *error = EINVAL;
6483                         return;
6484                 }
6485                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6486                         /* can only bind v6 on PF_INET6 sockets */
6487                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6488                         *error = EINVAL;
6489                         return;
6490                 }
6491 #ifdef INET
6492                 sin6 = (struct sockaddr_in6 *)addr_touse;
6493                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6494                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6495                             SCTP_IPV6_V6ONLY(inp)) {
6496                                 /* can't bind v4-mapped on PF_INET sockets */
6497                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6498                                 *error = EINVAL;
6499                                 return;
6500                         }
6501                         in6_sin6_2_sin(&sin, sin6);
6502                         addr_touse = (struct sockaddr *)&sin;
6503                 }
6504 #endif
6505         }
6506 #endif
6507 #ifdef INET
6508         if (sa->sa_family == AF_INET) {
6509                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6510                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6511                         *error = EINVAL;
6512                         return;
6513                 }
6514                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6515                     SCTP_IPV6_V6ONLY(inp)) {
6516                         /* can't bind v4 on PF_INET sockets */
6517                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6518                         *error = EINVAL;
6519                         return;
6520                 }
6521         }
6522 #endif
6523         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6524                 if (p == NULL) {
6525                         /* Can't get proc for Net/Open BSD */
6526                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6527                         *error = EINVAL;
6528                         return;
6529                 }
6530                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6531                 return;
6532         }
6533         /*
6534          * No locks required here since bind and mgmt_ep_sa all do their own
6535          * locking. If we do something for the FIX: below we may need to
6536          * lock in that case.
6537          */
6538         if (assoc_id == 0) {
6539                 /* add the address */
6540                 struct sctp_inpcb *lep;
6541                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6542
6543                 /* validate the incoming port */
6544                 if ((lsin->sin_port != 0) &&
6545                     (lsin->sin_port != inp->sctp_lport)) {
6546                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6547                         *error = EINVAL;
6548                         return;
6549                 } else {
6550                         /* user specified 0 port, set it to existing port */
6551                         lsin->sin_port = inp->sctp_lport;
6552                 }
6553
6554                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6555                 if (lep != NULL) {
6556                         /*
6557                          * We must decrement the refcount since we have the
6558                          * ep already and are binding. No remove going on
6559                          * here.
6560                          */
6561                         SCTP_INP_DECR_REF(lep);
6562                 }
6563                 if (lep == inp) {
6564                         /* already bound to it.. ok */
6565                         return;
6566                 } else if (lep == NULL) {
6567                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6568                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6569                             SCTP_ADD_IP_ADDRESS,
6570                             vrf_id, NULL);
6571                 } else {
6572                         *error = EADDRINUSE;
6573                 }
6574                 if (*error)
6575                         return;
6576         } else {
6577                 /*
6578                  * FIX: decide whether we allow assoc based bindx
6579                  */
6580         }
6581 }
6582
6583 /*
6584  * sctp_bindx(DELETE) for one address.
6585  * assumes all arguments are valid/checked by caller.
6586  */
6587 void
6588 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6589     struct sockaddr *sa, sctp_assoc_t assoc_id,
6590     uint32_t vrf_id, int *error)
6591 {
6592         struct sockaddr *addr_touse;
6593
6594 #if defined(INET) && defined(INET6)
6595         struct sockaddr_in sin;
6596
6597 #endif
6598
6599         /* see if we're bound all already! */
6600         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6601                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6602                 *error = EINVAL;
6603                 return;
6604         }
6605         addr_touse = sa;
6606 #ifdef INET6
6607         if (sa->sa_family == AF_INET6) {
6608 #ifdef INET
6609                 struct sockaddr_in6 *sin6;
6610
6611 #endif
6612
6613                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6614                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6615                         *error = EINVAL;
6616                         return;
6617                 }
6618                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6619                         /* can only bind v6 on PF_INET6 sockets */
6620                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6621                         *error = EINVAL;
6622                         return;
6623                 }
6624 #ifdef INET
6625                 sin6 = (struct sockaddr_in6 *)addr_touse;
6626                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6627                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6628                             SCTP_IPV6_V6ONLY(inp)) {
6629                                 /* can't bind mapped-v4 on PF_INET sockets */
6630                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6631                                 *error = EINVAL;
6632                                 return;
6633                         }
6634                         in6_sin6_2_sin(&sin, sin6);
6635                         addr_touse = (struct sockaddr *)&sin;
6636                 }
6637 #endif
6638         }
6639 #endif
6640 #ifdef INET
6641         if (sa->sa_family == AF_INET) {
6642                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6643                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6644                         *error = EINVAL;
6645                         return;
6646                 }
6647                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6648                     SCTP_IPV6_V6ONLY(inp)) {
6649                         /* can't bind v4 on PF_INET sockets */
6650                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6651                         *error = EINVAL;
6652                         return;
6653                 }
6654         }
6655 #endif
6656         /*
6657          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6658          * below is ever changed we may need to lock before calling
6659          * association level binding.
6660          */
6661         if (assoc_id == 0) {
6662                 /* delete the address */
6663                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6664                     SCTP_DEL_IP_ADDRESS,
6665                     vrf_id, NULL);
6666         } else {
6667                 /*
6668                  * FIX: decide whether we allow assoc based bindx
6669                  */
6670         }
6671 }
6672
6673 /*
6674  * returns the valid local address count for an assoc, taking into account
6675  * all scoping rules
6676  */
6677 int
6678 sctp_local_addr_count(struct sctp_tcb *stcb)
6679 {
6680         int loopback_scope;
6681
6682 #if defined(INET)
6683         int ipv4_local_scope, ipv4_addr_legal;
6684
6685 #endif
6686 #if defined (INET6)
6687         int local_scope, site_scope, ipv6_addr_legal;
6688
6689 #endif
6690         struct sctp_vrf *vrf;
6691         struct sctp_ifn *sctp_ifn;
6692         struct sctp_ifa *sctp_ifa;
6693         int count = 0;
6694
6695         /* Turn on all the appropriate scopes */
6696         loopback_scope = stcb->asoc.scope.loopback_scope;
6697 #if defined(INET)
6698         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6699         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6700 #endif
6701 #if defined(INET6)
6702         local_scope = stcb->asoc.scope.local_scope;
6703         site_scope = stcb->asoc.scope.site_scope;
6704         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6705 #endif
6706         SCTP_IPI_ADDR_RLOCK();
6707         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6708         if (vrf == NULL) {
6709                 /* no vrf, no addresses */
6710                 SCTP_IPI_ADDR_RUNLOCK();
6711                 return (0);
6712         }
6713         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6714                 /*
6715                  * bound all case: go through all ifns on the vrf
6716                  */
6717                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6718                         if ((loopback_scope == 0) &&
6719                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6720                                 continue;
6721                         }
6722                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6723                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6724                                         continue;
6725                                 switch (sctp_ifa->address.sa.sa_family) {
6726 #ifdef INET
6727                                 case AF_INET:
6728                                         if (ipv4_addr_legal) {
6729                                                 struct sockaddr_in *sin;
6730
6731                                                 sin = &sctp_ifa->address.sin;
6732                                                 if (sin->sin_addr.s_addr == 0) {
6733                                                         /*
6734                                                          * skip unspecified
6735                                                          * addrs
6736                                                          */
6737                                                         continue;
6738                                                 }
6739                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
6740                                                     &sin->sin_addr) != 0) {
6741                                                         continue;
6742                                                 }
6743                                                 if ((ipv4_local_scope == 0) &&
6744                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6745                                                         continue;
6746                                                 }
6747                                                 /* count this one */
6748                                                 count++;
6749                                         } else {
6750                                                 continue;
6751                                         }
6752                                         break;
6753 #endif
6754 #ifdef INET6
6755                                 case AF_INET6:
6756                                         if (ipv6_addr_legal) {
6757                                                 struct sockaddr_in6 *sin6;
6758
6759                                                 sin6 = &sctp_ifa->address.sin6;
6760                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6761                                                         continue;
6762                                                 }
6763                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
6764                                                     &sin6->sin6_addr) != 0) {
6765                                                         continue;
6766                                                 }
6767                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6768                                                         if (local_scope == 0)
6769                                                                 continue;
6770                                                         if (sin6->sin6_scope_id == 0) {
6771                                                                 if (sa6_recoverscope(sin6) != 0)
6772                                                                         /*
6773                                                                          *
6774                                                                          * bad
6775                                                                          *
6776                                                                          * li
6777                                                                          * nk
6778                                                                          *
6779                                                                          * loc
6780                                                                          * al
6781                                                                          *
6782                                                                          * add
6783                                                                          * re
6784                                                                          * ss
6785                                                                          * */
6786                                                                         continue;
6787                                                         }
6788                                                 }
6789                                                 if ((site_scope == 0) &&
6790                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6791                                                         continue;
6792                                                 }
6793                                                 /* count this one */
6794                                                 count++;
6795                                         }
6796                                         break;
6797 #endif
6798                                 default:
6799                                         /* TSNH */
6800                                         break;
6801                                 }
6802                         }
6803                 }
6804         } else {
6805                 /*
6806                  * subset bound case
6807                  */
6808                 struct sctp_laddr *laddr;
6809
6810                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6811                     sctp_nxt_addr) {
6812                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6813                                 continue;
6814                         }
6815                         /* count this one */
6816                         count++;
6817                 }
6818         }
6819         SCTP_IPI_ADDR_RUNLOCK();
6820         return (count);
6821 }
6822
6823 #if defined(SCTP_LOCAL_TRACE_BUF)
6824
6825 void
6826 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6827 {
6828         uint32_t saveindex, newindex;
6829
6830         do {
6831                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6832                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6833                         newindex = 1;
6834                 } else {
6835                         newindex = saveindex + 1;
6836                 }
6837         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6838         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6839                 saveindex = 0;
6840         }
6841         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6842         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6843         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6844         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6845         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6846         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6847         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6848         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6849 }
6850
6851 #endif
6852 static void
6853 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *ignored,
6854     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
6855 {
6856         struct ip *iph;
6857
6858 #ifdef INET6
6859         struct ip6_hdr *ip6;
6860
6861 #endif
6862         struct mbuf *sp, *last;
6863         struct udphdr *uhdr;
6864         uint16_t port;
6865
6866         if ((m->m_flags & M_PKTHDR) == 0) {
6867                 /* Can't handle one that is not a pkt hdr */
6868                 goto out;
6869         }
6870         /* Pull the src port */
6871         iph = mtod(m, struct ip *);
6872         uhdr = (struct udphdr *)((caddr_t)iph + off);
6873         port = uhdr->uh_sport;
6874         /*
6875          * Split out the mbuf chain. Leave the IP header in m, place the
6876          * rest in the sp.
6877          */
6878         sp = m_split(m, off, M_NOWAIT);
6879         if (sp == NULL) {
6880                 /* Gak, drop packet, we can't do a split */
6881                 goto out;
6882         }
6883         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
6884                 /* Gak, packet can't have an SCTP header in it - too small */
6885                 m_freem(sp);
6886                 goto out;
6887         }
6888         /* Now pull up the UDP header and SCTP header together */
6889         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
6890         if (sp == NULL) {
6891                 /* Gak pullup failed */
6892                 goto out;
6893         }
6894         /* Trim out the UDP header */
6895         m_adj(sp, sizeof(struct udphdr));
6896
6897         /* Now reconstruct the mbuf chain */
6898         for (last = m; last->m_next; last = last->m_next);
6899         last->m_next = sp;
6900         m->m_pkthdr.len += sp->m_pkthdr.len;
6901         iph = mtod(m, struct ip *);
6902         switch (iph->ip_v) {
6903 #ifdef INET
6904         case IPVERSION:
6905                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
6906                 sctp_input_with_port(m, off, port);
6907                 break;
6908 #endif
6909 #ifdef INET6
6910         case IPV6_VERSION >> 4:
6911                 ip6 = mtod(m, struct ip6_hdr *);
6912                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
6913                 sctp6_input_with_port(&m, &off, port);
6914                 break;
6915 #endif
6916         default:
6917                 goto out;
6918                 break;
6919         }
6920         return;
6921 out:
6922         m_freem(m);
6923 }
6924
6925 void
6926 sctp_over_udp_stop(void)
6927 {
6928         /*
6929          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6930          * for writting!
6931          */
6932 #ifdef INET
6933         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
6934                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
6935                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
6936         }
6937 #endif
6938 #ifdef INET6
6939         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
6940                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
6941                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
6942         }
6943 #endif
6944 }
6945
6946 int
6947 sctp_over_udp_start(void)
6948 {
6949         uint16_t port;
6950         int ret;
6951
6952 #ifdef INET
6953         struct sockaddr_in sin;
6954
6955 #endif
6956 #ifdef INET6
6957         struct sockaddr_in6 sin6;
6958
6959 #endif
6960         /*
6961          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6962          * for writting!
6963          */
6964         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
6965         if (ntohs(port) == 0) {
6966                 /* Must have a port set */
6967                 return (EINVAL);
6968         }
6969 #ifdef INET
6970         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
6971                 /* Already running -- must stop first */
6972                 return (EALREADY);
6973         }
6974 #endif
6975 #ifdef INET6
6976         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
6977                 /* Already running -- must stop first */
6978                 return (EALREADY);
6979         }
6980 #endif
6981 #ifdef INET
6982         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
6983             SOCK_DGRAM, IPPROTO_UDP,
6984             curthread->td_ucred, curthread))) {
6985                 sctp_over_udp_stop();
6986                 return (ret);
6987         }
6988         /* Call the special UDP hook. */
6989         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
6990             sctp_recv_udp_tunneled_packet, NULL))) {
6991                 sctp_over_udp_stop();
6992                 return (ret);
6993         }
6994         /* Ok, we have a socket, bind it to the port. */
6995         memset(&sin, 0, sizeof(struct sockaddr_in));
6996         sin.sin_len = sizeof(struct sockaddr_in);
6997         sin.sin_family = AF_INET;
6998         sin.sin_port = htons(port);
6999         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7000             (struct sockaddr *)&sin, curthread))) {
7001                 sctp_over_udp_stop();
7002                 return (ret);
7003         }
7004 #endif
7005 #ifdef INET6
7006         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7007             SOCK_DGRAM, IPPROTO_UDP,
7008             curthread->td_ucred, curthread))) {
7009                 sctp_over_udp_stop();
7010                 return (ret);
7011         }
7012         /* Call the special UDP hook. */
7013         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7014             sctp_recv_udp_tunneled_packet, NULL))) {
7015                 sctp_over_udp_stop();
7016                 return (ret);
7017         }
7018         /* Ok, we have a socket, bind it to the port. */
7019         memset(&sin6, 0, sizeof(struct sockaddr_in6));
7020         sin6.sin6_len = sizeof(struct sockaddr_in6);
7021         sin6.sin6_family = AF_INET6;
7022         sin6.sin6_port = htons(port);
7023         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7024             (struct sockaddr *)&sin6, curthread))) {
7025                 sctp_over_udp_stop();
7026                 return (ret);
7027         }
7028 #endif
7029         return (0);
7030 }