sys/netinet/sctputil.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctputil.h>
  41 #include <netinet/sctp_var.h>
  42 #include <netinet/sctp_sysctl.h>
  43 #ifdef INET6
  44 #include <netinet6/sctp6_var.h>
  45 #endif
  46 #include <netinet/sctp_header.h>
  47 #include <netinet/sctp_output.h>
  48 #include <netinet/sctp_uio.h>
  49 #include <netinet/sctp_timer.h>
  50 #include <netinet/sctp_indata.h>
  51 #include <netinet/sctp_auth.h>
  52 #include <netinet/sctp_asconf.h>
  53 #include <netinet/sctp_bsd_addr.h>
  54 #include <netinet/sctp_kdtrace.h>
  55 #if defined(INET6) || defined(INET)
  56 #include <netinet/tcp_var.h>
  57 #endif
  58 #include <netinet/udp.h>
  59 #include <netinet/udp_var.h>
  60 #include <sys/proc.h>
  61 #ifdef INET6
  62 #include <netinet/icmp6.h>
  63 #endif
  64
  65 #ifndef KTR_SCTP
  66 #define KTR_SCTP KTR_SUBSYS
  67 #endif
  68
  69 extern const struct sctp_cc_functions sctp_cc_functions[];
  70 extern const struct sctp_ss_functions sctp_ss_functions[];
  71
  72 void
  73 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  74 {
  75 #if defined(SCTP_LOCAL_TRACE_BUF)
  76         struct sctp_cwnd_log sctp_clog;
  77
  78         sctp_clog.x.sb.stcb = stcb;
  79         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  80         if (stcb)
  81                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  82         else
  83                 sctp_clog.x.sb.stcb_sbcc = 0;
  84         sctp_clog.x.sb.incr = incr;
  85         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  86             SCTP_LOG_EVENT_SB,
  87             from,
  88             sctp_clog.x.misc.log1,
  89             sctp_clog.x.misc.log2,
  90             sctp_clog.x.misc.log3,
  91             sctp_clog.x.misc.log4);
  92 #endif
  93 }
  94
  95 void
  96 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  97 {
  98 #if defined(SCTP_LOCAL_TRACE_BUF)
  99         struct sctp_cwnd_log sctp_clog;
 100
 101         sctp_clog.x.close.inp = (void *)inp;
 102         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
 103         if (stcb) {
 104                 sctp_clog.x.close.stcb = (void *)stcb;
 105                 sctp_clog.x.close.state = (uint16_t)stcb->asoc.state;
 106         } else {
 107                 sctp_clog.x.close.stcb = 0;
 108                 sctp_clog.x.close.state = 0;
 109         }
 110         sctp_clog.x.close.loc = loc;
 111         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 112             SCTP_LOG_EVENT_CLOSE,
 113             0,
 114             sctp_clog.x.misc.log1,
 115             sctp_clog.x.misc.log2,
 116             sctp_clog.x.misc.log3,
 117             sctp_clog.x.misc.log4);
 118 #endif
 119 }
 120
 121 void
 122 rto_logging(struct sctp_nets *net, int from)
 123 {
 124 #if defined(SCTP_LOCAL_TRACE_BUF)
 125         struct sctp_cwnd_log sctp_clog;
 126
 127         memset(&sctp_clog, 0, sizeof(sctp_clog));
 128         sctp_clog.x.rto.net = (void *)net;
 129         sctp_clog.x.rto.rtt = net->rtt / 1000;
 130         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 131             SCTP_LOG_EVENT_RTT,
 132             from,
 133             sctp_clog.x.misc.log1,
 134             sctp_clog.x.misc.log2,
 135             sctp_clog.x.misc.log3,
 136             sctp_clog.x.misc.log4);
 137 #endif
 138 }
 139
 140 void
 141 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 142 {
 143 #if defined(SCTP_LOCAL_TRACE_BUF)
 144         struct sctp_cwnd_log sctp_clog;
 145
 146         sctp_clog.x.strlog.stcb = stcb;
 147         sctp_clog.x.strlog.n_tsn = tsn;
 148         sctp_clog.x.strlog.n_sseq = sseq;
 149         sctp_clog.x.strlog.e_tsn = 0;
 150         sctp_clog.x.strlog.e_sseq = 0;
 151         sctp_clog.x.strlog.strm = stream;
 152         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 153             SCTP_LOG_EVENT_STRM,
 154             from,
 155             sctp_clog.x.misc.log1,
 156             sctp_clog.x.misc.log2,
 157             sctp_clog.x.misc.log3,
 158             sctp_clog.x.misc.log4);
 159 #endif
 160 }
 161
 162 void
 163 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 164 {
 165 #if defined(SCTP_LOCAL_TRACE_BUF)
 166         struct sctp_cwnd_log sctp_clog;
 167
 168         sctp_clog.x.nagle.stcb = (void *)stcb;
 169         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 170         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 171         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 172         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 173         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 174             SCTP_LOG_EVENT_NAGLE,
 175             action,
 176             sctp_clog.x.misc.log1,
 177             sctp_clog.x.misc.log2,
 178             sctp_clog.x.misc.log3,
 179             sctp_clog.x.misc.log4);
 180 #endif
 181 }
 182
 183 void
 184 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 185 {
 186 #if defined(SCTP_LOCAL_TRACE_BUF)
 187         struct sctp_cwnd_log sctp_clog;
 188
 189         sctp_clog.x.sack.cumack = cumack;
 190         sctp_clog.x.sack.oldcumack = old_cumack;
 191         sctp_clog.x.sack.tsn = tsn;
 192         sctp_clog.x.sack.numGaps = gaps;
 193         sctp_clog.x.sack.numDups = dups;
 194         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 195             SCTP_LOG_EVENT_SACK,
 196             from,
 197             sctp_clog.x.misc.log1,
 198             sctp_clog.x.misc.log2,
 199             sctp_clog.x.misc.log3,
 200             sctp_clog.x.misc.log4);
 201 #endif
 202 }
 203
 204 void
 205 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 206 {
 207 #if defined(SCTP_LOCAL_TRACE_BUF)
 208         struct sctp_cwnd_log sctp_clog;
 209
 210         memset(&sctp_clog, 0, sizeof(sctp_clog));
 211         sctp_clog.x.map.base = map;
 212         sctp_clog.x.map.cum = cum;
 213         sctp_clog.x.map.high = high;
 214         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 215             SCTP_LOG_EVENT_MAP,
 216             from,
 217             sctp_clog.x.misc.log1,
 218             sctp_clog.x.misc.log2,
 219             sctp_clog.x.misc.log3,
 220             sctp_clog.x.misc.log4);
 221 #endif
 222 }
 223
 224 void
 225 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 226 {
 227 #if defined(SCTP_LOCAL_TRACE_BUF)
 228         struct sctp_cwnd_log sctp_clog;
 229
 230         memset(&sctp_clog, 0, sizeof(sctp_clog));
 231         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 232         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 233         sctp_clog.x.fr.tsn = tsn;
 234         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 235             SCTP_LOG_EVENT_FR,
 236             from,
 237             sctp_clog.x.misc.log1,
 238             sctp_clog.x.misc.log2,
 239             sctp_clog.x.misc.log3,
 240             sctp_clog.x.misc.log4);
 241 #endif
 242 }
 243
 244 #ifdef SCTP_MBUF_LOGGING
 245 void
 246 sctp_log_mb(struct mbuf *m, int from)
 247 {
 248 #if defined(SCTP_LOCAL_TRACE_BUF)
 249         struct sctp_cwnd_log sctp_clog;
 250
 251         sctp_clog.x.mb.mp = m;
 252         sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m));
 253         sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m));
 254         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 255         if (SCTP_BUF_IS_EXTENDED(m)) {
 256                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 257                 sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m));
 258         } else {
 259                 sctp_clog.x.mb.ext = 0;
 260                 sctp_clog.x.mb.refcnt = 0;
 261         }
 262         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 263             SCTP_LOG_EVENT_MBUF,
 264             from,
 265             sctp_clog.x.misc.log1,
 266             sctp_clog.x.misc.log2,
 267             sctp_clog.x.misc.log3,
 268             sctp_clog.x.misc.log4);
 269 #endif
 270 }
 271
 272 void
 273 sctp_log_mbc(struct mbuf *m, int from)
 274 {
 275         struct mbuf *mat;
 276
 277         for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
 278                 sctp_log_mb(mat, from);
 279         }
 280 }
 281 #endif
 282
 283 void
 284 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 285 {
 286 #if defined(SCTP_LOCAL_TRACE_BUF)
 287         struct sctp_cwnd_log sctp_clog;
 288
 289         if (control == NULL) {
 290                 SCTP_PRINTF("Gak log of NULL?\n");
 291                 return;
 292         }
 293         sctp_clog.x.strlog.stcb = control->stcb;
 294         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 295         sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid;
 296         sctp_clog.x.strlog.strm = control->sinfo_stream;
 297         if (poschk != NULL) {
 298                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 299                 sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid;
 300         } else {
 301                 sctp_clog.x.strlog.e_tsn = 0;
 302                 sctp_clog.x.strlog.e_sseq = 0;
 303         }
 304         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 305             SCTP_LOG_EVENT_STRM,
 306             from,
 307             sctp_clog.x.misc.log1,
 308             sctp_clog.x.misc.log2,
 309             sctp_clog.x.misc.log3,
 310             sctp_clog.x.misc.log4);
 311 #endif
 312 }
 313
 314 void
 315 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 316 {
 317 #if defined(SCTP_LOCAL_TRACE_BUF)
 318         struct sctp_cwnd_log sctp_clog;
 319
 320         sctp_clog.x.cwnd.net = net;
 321         if (stcb->asoc.send_queue_cnt > 255)
 322                 sctp_clog.x.cwnd.cnt_in_send = 255;
 323         else
 324                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 325         if (stcb->asoc.stream_queue_cnt > 255)
 326                 sctp_clog.x.cwnd.cnt_in_str = 255;
 327         else
 328                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 329
 330         if (net) {
 331                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 332                 sctp_clog.x.cwnd.inflight = net->flight_size;
 333                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 334                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 335                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 336         }
 337         if (SCTP_CWNDLOG_PRESEND == from) {
 338                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 339         }
 340         sctp_clog.x.cwnd.cwnd_augment = augment;
 341         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 342             SCTP_LOG_EVENT_CWND,
 343             from,
 344             sctp_clog.x.misc.log1,
 345             sctp_clog.x.misc.log2,
 346             sctp_clog.x.misc.log3,
 347             sctp_clog.x.misc.log4);
 348 #endif
 349 }
 350
 351 void
 352 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 353 {
 354 #if defined(SCTP_LOCAL_TRACE_BUF)
 355         struct sctp_cwnd_log sctp_clog;
 356
 357         memset(&sctp_clog, 0, sizeof(sctp_clog));
 358         if (inp) {
 359                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 360
 361         } else {
 362                 sctp_clog.x.lock.sock = (void *)NULL;
 363         }
 364         sctp_clog.x.lock.inp = (void *)inp;
 365         if (stcb) {
 366                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 367         } else {
 368                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 369         }
 370         if (inp) {
 371                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 372                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 373         } else {
 374                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 375                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 376         }
 377         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 378         if (inp && (inp->sctp_socket)) {
 379                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 380                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 381                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 382         } else {
 383                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 384                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 385                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 386         }
 387         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 388             SCTP_LOG_LOCK_EVENT,
 389             from,
 390             sctp_clog.x.misc.log1,
 391             sctp_clog.x.misc.log2,
 392             sctp_clog.x.misc.log3,
 393             sctp_clog.x.misc.log4);
 394 #endif
 395 }
 396
 397 void
 398 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 399 {
 400 #if defined(SCTP_LOCAL_TRACE_BUF)
 401         struct sctp_cwnd_log sctp_clog;
 402
 403         memset(&sctp_clog, 0, sizeof(sctp_clog));
 404         sctp_clog.x.cwnd.net = net;
 405         sctp_clog.x.cwnd.cwnd_new_value = error;
 406         sctp_clog.x.cwnd.inflight = net->flight_size;
 407         sctp_clog.x.cwnd.cwnd_augment = burst;
 408         if (stcb->asoc.send_queue_cnt > 255)
 409                 sctp_clog.x.cwnd.cnt_in_send = 255;
 410         else
 411                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 412         if (stcb->asoc.stream_queue_cnt > 255)
 413                 sctp_clog.x.cwnd.cnt_in_str = 255;
 414         else
 415                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 416         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 417             SCTP_LOG_EVENT_MAXBURST,
 418             from,
 419             sctp_clog.x.misc.log1,
 420             sctp_clog.x.misc.log2,
 421             sctp_clog.x.misc.log3,
 422             sctp_clog.x.misc.log4);
 423 #endif
 424 }
 425
 426 void
 427 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 428 {
 429 #if defined(SCTP_LOCAL_TRACE_BUF)
 430         struct sctp_cwnd_log sctp_clog;
 431
 432         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 433         sctp_clog.x.rwnd.send_size = snd_size;
 434         sctp_clog.x.rwnd.overhead = overhead;
 435         sctp_clog.x.rwnd.new_rwnd = 0;
 436         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 437             SCTP_LOG_EVENT_RWND,
 438             from,
 439             sctp_clog.x.misc.log1,
 440             sctp_clog.x.misc.log2,
 441             sctp_clog.x.misc.log3,
 442             sctp_clog.x.misc.log4);
 443 #endif
 444 }
 445
 446 void
 447 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 448 {
 449 #if defined(SCTP_LOCAL_TRACE_BUF)
 450         struct sctp_cwnd_log sctp_clog;
 451
 452         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 453         sctp_clog.x.rwnd.send_size = flight_size;
 454         sctp_clog.x.rwnd.overhead = overhead;
 455         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 456         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 457             SCTP_LOG_EVENT_RWND,
 458             from,
 459             sctp_clog.x.misc.log1,
 460             sctp_clog.x.misc.log2,
 461             sctp_clog.x.misc.log3,
 462             sctp_clog.x.misc.log4);
 463 #endif
 464 }
 465
 466 #ifdef SCTP_MBCNT_LOGGING
 467 static void
 468 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 469 {
 470 #if defined(SCTP_LOCAL_TRACE_BUF)
 471         struct sctp_cwnd_log sctp_clog;
 472
 473         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 474         sctp_clog.x.mbcnt.size_change = book;
 475         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 476         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 477         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 478             SCTP_LOG_EVENT_MBCNT,
 479             from,
 480             sctp_clog.x.misc.log1,
 481             sctp_clog.x.misc.log2,
 482             sctp_clog.x.misc.log3,
 483             sctp_clog.x.misc.log4);
 484 #endif
 485 }
 486 #endif
 487
 488 void
 489 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 490 {
 491 #if defined(SCTP_LOCAL_TRACE_BUF)
 492         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 493             SCTP_LOG_MISC_EVENT,
 494             from,
 495             a, b, c, d);
 496 #endif
 497 }
 498
 499 void
 500 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 501 {
 502 #if defined(SCTP_LOCAL_TRACE_BUF)
 503         struct sctp_cwnd_log sctp_clog;
 504
 505         sctp_clog.x.wake.stcb = (void *)stcb;
 506         sctp_clog.x.wake.wake_cnt = wake_cnt;
 507         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 508         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 509         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 510
 511         if (stcb->asoc.stream_queue_cnt < 0xff)
 512                 sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt;
 513         else
 514                 sctp_clog.x.wake.stream_qcnt = 0xff;
 515
 516         if (stcb->asoc.chunks_on_out_queue < 0xff)
 517                 sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue;
 518         else
 519                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 520
 521         sctp_clog.x.wake.sctpflags = 0;
 522         /* set in the defered mode stuff */
 523         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 524                 sctp_clog.x.wake.sctpflags |= 1;
 525         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 526                 sctp_clog.x.wake.sctpflags |= 2;
 527         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 528                 sctp_clog.x.wake.sctpflags |= 4;
 529         /* what about the sb */
 530         if (stcb->sctp_socket) {
 531                 struct socket *so = stcb->sctp_socket;
 532
 533                 sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff));
 534         } else {
 535                 sctp_clog.x.wake.sbflags = 0xff;
 536         }
 537         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 538             SCTP_LOG_EVENT_WAKE,
 539             from,
 540             sctp_clog.x.misc.log1,
 541             sctp_clog.x.misc.log2,
 542             sctp_clog.x.misc.log3,
 543             sctp_clog.x.misc.log4);
 544 #endif
 545 }
 546
 547 void
 548 sctp_log_block(uint8_t from, struct sctp_association *asoc, ssize_t sendlen)
 549 {
 550 #if defined(SCTP_LOCAL_TRACE_BUF)
 551         struct sctp_cwnd_log sctp_clog;
 552
 553         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 554         sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt);
 555         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 556         sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt;
 557         sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue;
 558         sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024);
 559         sctp_clog.x.blk.sndlen = (uint32_t)sendlen;
 560         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 561             SCTP_LOG_EVENT_BLOCK,
 562             from,
 563             sctp_clog.x.misc.log1,
 564             sctp_clog.x.misc.log2,
 565             sctp_clog.x.misc.log3,
 566             sctp_clog.x.misc.log4);
 567 #endif
 568 }
 569
 570 int
 571 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 572 {
 573         /* May need to fix this if ktrdump does not work */
 574         return (0);
 575 }
 576
 577 #ifdef SCTP_AUDITING_ENABLED
 578 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 579 static int sctp_audit_indx = 0;
 580
 581 static
 582 void
 583 sctp_print_audit_report(void)
 584 {
 585         int i;
 586         int cnt;
 587
 588         cnt = 0;
 589         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 590                 if ((sctp_audit_data[i][0] == 0xe0) &&
 591                     (sctp_audit_data[i][1] == 0x01)) {
 592                         cnt = 0;
 593                         SCTP_PRINTF("\n");
 594                 } else if (sctp_audit_data[i][0] == 0xf0) {
 595                         cnt = 0;
 596                         SCTP_PRINTF("\n");
 597                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 598                     (sctp_audit_data[i][1] == 0x01)) {
 599                         SCTP_PRINTF("\n");
 600                         cnt = 0;
 601                 }
 602                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 603                     (uint32_t)sctp_audit_data[i][1]);
 604                 cnt++;
 605                 if ((cnt % 14) == 0)
 606                         SCTP_PRINTF("\n");
 607         }
 608         for (i = 0; i < sctp_audit_indx; i++) {
 609                 if ((sctp_audit_data[i][0] == 0xe0) &&
 610                     (sctp_audit_data[i][1] == 0x01)) {
 611                         cnt = 0;
 612                         SCTP_PRINTF("\n");
 613                 } else if (sctp_audit_data[i][0] == 0xf0) {
 614                         cnt = 0;
 615                         SCTP_PRINTF("\n");
 616                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 617                     (sctp_audit_data[i][1] == 0x01)) {
 618                         SCTP_PRINTF("\n");
 619                         cnt = 0;
 620                 }
 621                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 622                     (uint32_t)sctp_audit_data[i][1]);
 623                 cnt++;
 624                 if ((cnt % 14) == 0)
 625                         SCTP_PRINTF("\n");
 626         }
 627         SCTP_PRINTF("\n");
 628 }
 629
 630 void
 631 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 632     struct sctp_nets *net)
 633 {
 634         int resend_cnt, tot_out, rep, tot_book_cnt;
 635         struct sctp_nets *lnet;
 636         struct sctp_tmit_chunk *chk;
 637
 638         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 639         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 640         sctp_audit_indx++;
 641         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 642                 sctp_audit_indx = 0;
 643         }
 644         if (inp == NULL) {
 645                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 646                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 647                 sctp_audit_indx++;
 648                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 649                         sctp_audit_indx = 0;
 650                 }
 651                 return;
 652         }
 653         if (stcb == NULL) {
 654                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 655                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 656                 sctp_audit_indx++;
 657                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 658                         sctp_audit_indx = 0;
 659                 }
 660                 return;
 661         }
 662         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 663         sctp_audit_data[sctp_audit_indx][1] =
 664             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 665         sctp_audit_indx++;
 666         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 667                 sctp_audit_indx = 0;
 668         }
 669         rep = 0;
 670         tot_book_cnt = 0;
 671         resend_cnt = tot_out = 0;
 672         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 673                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 674                         resend_cnt++;
 675                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 676                         tot_out += chk->book_size;
 677                         tot_book_cnt++;
 678                 }
 679         }
 680         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 681                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 682                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 683                 sctp_audit_indx++;
 684                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 685                         sctp_audit_indx = 0;
 686                 }
 687                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 688                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 689                 rep = 1;
 690                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 691                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 692                 sctp_audit_data[sctp_audit_indx][1] =
 693                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 694                 sctp_audit_indx++;
 695                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 696                         sctp_audit_indx = 0;
 697                 }
 698         }
 699         if (tot_out != stcb->asoc.total_flight) {
 700                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 701                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 702                 sctp_audit_indx++;
 703                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 704                         sctp_audit_indx = 0;
 705                 }
 706                 rep = 1;
 707                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 708                     (int)stcb->asoc.total_flight);
 709                 stcb->asoc.total_flight = tot_out;
 710         }
 711         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 712                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 713                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 714                 sctp_audit_indx++;
 715                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 716                         sctp_audit_indx = 0;
 717                 }
 718                 rep = 1;
 719                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 720
 721                 stcb->asoc.total_flight_count = tot_book_cnt;
 722         }
 723         tot_out = 0;
 724         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 725                 tot_out += lnet->flight_size;
 726         }
 727         if (tot_out != stcb->asoc.total_flight) {
 728                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 729                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 730                 sctp_audit_indx++;
 731                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 732                         sctp_audit_indx = 0;
 733                 }
 734                 rep = 1;
 735                 SCTP_PRINTF("real flight:%d net total was %d\n",
 736                     stcb->asoc.total_flight, tot_out);
 737                 /* now corrective action */
 738                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 739                         tot_out = 0;
 740                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 741                                 if ((chk->whoTo == lnet) &&
 742                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 743                                         tot_out += chk->book_size;
 744                                 }
 745                         }
 746                         if (lnet->flight_size != tot_out) {
 747                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 748                                     (void *)lnet, lnet->flight_size,
 749                                     tot_out);
 750                                 lnet->flight_size = tot_out;
 751                         }
 752                 }
 753         }
 754         if (rep) {
 755                 sctp_print_audit_report();
 756         }
 757 }
 758
 759 void
 760 sctp_audit_log(uint8_t ev, uint8_t fd)
 761 {
 762
 763         sctp_audit_data[sctp_audit_indx][0] = ev;
 764         sctp_audit_data[sctp_audit_indx][1] = fd;
 765         sctp_audit_indx++;
 766         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 767                 sctp_audit_indx = 0;
 768         }
 769 }
 770
 771 #endif
 772
 773 /*
 774  * The conversion from time to ticks and vice versa is done by rounding
 775  * upwards. This way we can test in the code the time to be positive and
 776  * know that this corresponds to a positive number of ticks.
 777  */
 778
 779 uint32_t
 780 sctp_msecs_to_ticks(uint32_t msecs)
 781 {
 782         uint64_t temp;
 783         uint32_t ticks;
 784
 785         if (hz == 1000) {
 786                 ticks = msecs;
 787         } else {
 788                 temp = (((uint64_t)msecs * hz) + 999) / 1000;
 789                 if (temp > UINT32_MAX) {
 790                         ticks = UINT32_MAX;
 791                 } else {
 792                         ticks = (uint32_t)temp;
 793                 }
 794         }
 795         return (ticks);
 796 }
 797
 798 uint32_t
 799 sctp_ticks_to_msecs(uint32_t ticks)
 800 {
 801         uint64_t temp;
 802         uint32_t msecs;
 803
 804         if (hz == 1000) {
 805                 msecs = ticks;
 806         } else {
 807                 temp = (((uint64_t)ticks * 1000) + (hz - 1)) / hz;
 808                 if (temp > UINT32_MAX) {
 809                         msecs = UINT32_MAX;
 810                 } else {
 811                         msecs = (uint32_t)temp;
 812                 }
 813         }
 814         return (msecs);
 815 }
 816
 817 uint32_t
 818 sctp_secs_to_ticks(uint32_t secs)
 819 {
 820         uint64_t temp;
 821         uint32_t ticks;
 822
 823         temp = (uint64_t)secs * hz;
 824         if (temp > UINT32_MAX) {
 825                 ticks = UINT32_MAX;
 826         } else {
 827                 ticks = (uint32_t)temp;
 828         }
 829         return (ticks);
 830 }
 831
 832 uint32_t
 833 sctp_ticks_to_secs(uint32_t ticks)
 834 {
 835         uint64_t temp;
 836         uint32_t secs;
 837
 838         temp = ((uint64_t)ticks + (hz - 1)) / hz;
 839         if (temp > UINT32_MAX) {
 840                 secs = UINT32_MAX;
 841         } else {
 842                 secs = (uint32_t)temp;
 843         }
 844         return (secs);
 845 }
 846
 847 /*
 848  * sctp_stop_timers_for_shutdown() should be called
 849  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 850  * state to make sure that all timers are stopped.
 851  */
 852 void
 853 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 854 {
 855         struct sctp_inpcb *inp;
 856         struct sctp_nets *net;
 857
 858         inp = stcb->sctp_ep;
 859
 860         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL,
 861             SCTP_FROM_SCTPUTIL + SCTP_LOC_12);
 862         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL,
 863             SCTP_FROM_SCTPUTIL + SCTP_LOC_13);
 864         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL,
 865             SCTP_FROM_SCTPUTIL + SCTP_LOC_14);
 866         sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL,
 867             SCTP_FROM_SCTPUTIL + SCTP_LOC_15);
 868         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 869                 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
 870                     SCTP_FROM_SCTPUTIL + SCTP_LOC_16);
 871                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
 872                     SCTP_FROM_SCTPUTIL + SCTP_LOC_17);
 873         }
 874 }
 875
 876 void
 877 sctp_stop_association_timers(struct sctp_tcb *stcb, bool stop_assoc_kill_timer)
 878 {
 879         struct sctp_inpcb *inp;
 880         struct sctp_nets *net;
 881
 882         inp = stcb->sctp_ep;
 883         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL,
 884             SCTP_FROM_SCTPUTIL + SCTP_LOC_18);
 885         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL,
 886             SCTP_FROM_SCTPUTIL + SCTP_LOC_19);
 887         if (stop_assoc_kill_timer) {
 888                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
 889                     SCTP_FROM_SCTPUTIL + SCTP_LOC_20);
 890         }
 891         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL,
 892             SCTP_FROM_SCTPUTIL + SCTP_LOC_21);
 893         sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL,
 894             SCTP_FROM_SCTPUTIL + SCTP_LOC_22);
 895         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNGUARD, inp, stcb, NULL,
 896             SCTP_FROM_SCTPUTIL + SCTP_LOC_23);
 897         /* Mobility adaptation */
 898         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, inp, stcb, NULL,
 899             SCTP_FROM_SCTPUTIL + SCTP_LOC_24);
 900         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 901                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net,
 902                     SCTP_FROM_SCTPUTIL + SCTP_LOC_25);
 903                 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net,
 904                     SCTP_FROM_SCTPUTIL + SCTP_LOC_26);
 905                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, inp, stcb, net,
 906                     SCTP_FROM_SCTPUTIL + SCTP_LOC_27);
 907                 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net,
 908                     SCTP_FROM_SCTPUTIL + SCTP_LOC_28);
 909                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, inp, stcb, net,
 910                     SCTP_FROM_SCTPUTIL + SCTP_LOC_29);
 911                 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
 912                     SCTP_FROM_SCTPUTIL + SCTP_LOC_30);
 913                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
 914                     SCTP_FROM_SCTPUTIL + SCTP_LOC_31);
 915         }
 916 }
 917
 918 /*
 919  * A list of sizes based on typical mtu's, used only if next hop size not
 920  * returned. These values MUST be multiples of 4 and MUST be ordered.
 921  */
 922 static uint32_t sctp_mtu_sizes[] = {
 923         68,
 924         296,
 925         508,
 926         512,
 927         544,
 928         576,
 929         1004,
 930         1492,
 931         1500,
 932         1536,
 933         2000,
 934         2048,
 935         4352,
 936         4464,
 937         8168,
 938         17912,
 939         32000,
 940         65532
 941 };
 942
 943 /*
 944  * Return the largest MTU in sctp_mtu_sizes smaller than val.
 945  * If val is smaller than the minimum, just return the largest
 946  * multiple of 4 smaller or equal to val.
 947  * Ensure that the result is a multiple of 4.
 948  */
 949 uint32_t
 950 sctp_get_prev_mtu(uint32_t val)
 951 {
 952         uint32_t i;
 953
 954         val &= 0xfffffffc;
 955         if (val <= sctp_mtu_sizes[0]) {
 956                 return (val);
 957         }
 958         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 959                 if (val <= sctp_mtu_sizes[i]) {
 960                         break;
 961                 }
 962         }
 963         KASSERT((sctp_mtu_sizes[i - 1] & 0x00000003) == 0,
 964             ("sctp_mtu_sizes[%u] not a multiple of 4", i - 1));
 965         return (sctp_mtu_sizes[i - 1]);
 966 }
 967
 968 /*
 969  * Return the smallest MTU in sctp_mtu_sizes larger than val.
 970  * If val is larger than the maximum, just return the largest multiple of 4 smaller
 971  * or equal to val.
 972  * Ensure that the result is a multiple of 4.
 973  */
 974 uint32_t
 975 sctp_get_next_mtu(uint32_t val)
 976 {
 977         /* select another MTU that is just bigger than this one */
 978         uint32_t i;
 979
 980         val &= 0xfffffffc;
 981         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 982                 if (val < sctp_mtu_sizes[i]) {
 983                         KASSERT((sctp_mtu_sizes[i] & 0x00000003) == 0,
 984                             ("sctp_mtu_sizes[%u] not a multiple of 4", i));
 985                         return (sctp_mtu_sizes[i]);
 986                 }
 987         }
 988         return (val);
 989 }
 990
 991 void
 992 sctp_fill_random_store(struct sctp_pcb *m)
 993 {
 994         /*
 995          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 996          * our counter. The result becomes our good random numbers and we
 997          * then setup to give these out. Note that we do no locking to
 998          * protect this. This is ok, since if competing folks call this we
 999          * will get more gobbled gook in the random store which is what we
1000          * want. There is a danger that two guys will use the same random
1001          * numbers, but thats ok too since that is random as well :->
1002          */
1003         m->store_at = 0;
1004         (void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers,
1005             sizeof(m->random_numbers), (uint8_t *)&m->random_counter,
1006             sizeof(m->random_counter), (uint8_t *)m->random_store);
1007         m->random_counter++;
1008 }
1009
1010 uint32_t
1011 sctp_select_initial_TSN(struct sctp_pcb *inp)
1012 {
1013         /*
1014          * A true implementation should use random selection process to get
1015          * the initial stream sequence number, using RFC1750 as a good
1016          * guideline
1017          */
1018         uint32_t x, *xp;
1019         uint8_t *p;
1020         int store_at, new_store;
1021
1022         if (inp->initial_sequence_debug != 0) {
1023                 uint32_t ret;
1024
1025                 ret = inp->initial_sequence_debug;
1026                 inp->initial_sequence_debug++;
1027                 return (ret);
1028         }
1029 retry:
1030         store_at = inp->store_at;
1031         new_store = store_at + sizeof(uint32_t);
1032         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
1033                 new_store = 0;
1034         }
1035         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
1036                 goto retry;
1037         }
1038         if (new_store == 0) {
1039                 /* Refill the random store */
1040                 sctp_fill_random_store(inp);
1041         }
1042         p = &inp->random_store[store_at];
1043         xp = (uint32_t *)p;
1044         x = *xp;
1045         return (x);
1046 }
1047
1048 uint32_t
1049 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
1050 {
1051         uint32_t x;
1052         struct timeval now;
1053
1054         if (check) {
1055                 (void)SCTP_GETTIME_TIMEVAL(&now);
1056         }
1057         for (;;) {
1058                 x = sctp_select_initial_TSN(&inp->sctp_ep);
1059                 if (x == 0) {
1060                         /* we never use 0 */
1061                         continue;
1062                 }
1063                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
1064                         break;
1065                 }
1066         }
1067         return (x);
1068 }
1069
1070 int32_t
1071 sctp_map_assoc_state(int kernel_state)
1072 {
1073         int32_t user_state;
1074
1075         if (kernel_state & SCTP_STATE_WAS_ABORTED) {
1076                 user_state = SCTP_CLOSED;
1077         } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) {
1078                 user_state = SCTP_SHUTDOWN_PENDING;
1079         } else {
1080                 switch (kernel_state & SCTP_STATE_MASK) {
1081                 case SCTP_STATE_EMPTY:
1082                         user_state = SCTP_CLOSED;
1083                         break;
1084                 case SCTP_STATE_INUSE:
1085                         user_state = SCTP_CLOSED;
1086                         break;
1087                 case SCTP_STATE_COOKIE_WAIT:
1088                         user_state = SCTP_COOKIE_WAIT;
1089                         break;
1090                 case SCTP_STATE_COOKIE_ECHOED:
1091                         user_state = SCTP_COOKIE_ECHOED;
1092                         break;
1093                 case SCTP_STATE_OPEN:
1094                         user_state = SCTP_ESTABLISHED;
1095                         break;
1096                 case SCTP_STATE_SHUTDOWN_SENT:
1097                         user_state = SCTP_SHUTDOWN_SENT;
1098                         break;
1099                 case SCTP_STATE_SHUTDOWN_RECEIVED:
1100                         user_state = SCTP_SHUTDOWN_RECEIVED;
1101                         break;
1102                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
1103                         user_state = SCTP_SHUTDOWN_ACK_SENT;
1104                         break;
1105                 default:
1106                         user_state = SCTP_CLOSED;
1107                         break;
1108                 }
1109         }
1110         return (user_state);
1111 }
1112
1113 int
1114 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1115     uint32_t override_tag, uint32_t vrf_id, uint16_t o_strms)
1116 {
1117         struct sctp_association *asoc;
1118
1119         /*
1120          * Anything set to zero is taken care of by the allocation routine's
1121          * bzero
1122          */
1123
1124         /*
1125          * Up front select what scoping to apply on addresses I tell my peer
1126          * Not sure what to do with these right now, we will need to come up
1127          * with a way to set them. We may need to pass them through from the
1128          * caller in the sctp_aloc_assoc() function.
1129          */
1130         int i;
1131 #if defined(SCTP_DETAILED_STR_STATS)
1132         int j;
1133 #endif
1134
1135         asoc = &stcb->asoc;
1136         /* init all variables to a known value. */
1137         SCTP_SET_STATE(stcb, SCTP_STATE_INUSE);
1138         asoc->max_burst = inp->sctp_ep.max_burst;
1139         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
1140         asoc->heart_beat_delay = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
1141         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
1142         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
1143         asoc->ecn_supported = inp->ecn_supported;
1144         asoc->prsctp_supported = inp->prsctp_supported;
1145         asoc->auth_supported = inp->auth_supported;
1146         asoc->asconf_supported = inp->asconf_supported;
1147         asoc->reconfig_supported = inp->reconfig_supported;
1148         asoc->nrsack_supported = inp->nrsack_supported;
1149         asoc->pktdrop_supported = inp->pktdrop_supported;
1150         asoc->idata_supported = inp->idata_supported;
1151         asoc->sctp_cmt_pf = (uint8_t)0;
1152         asoc->sctp_frag_point = inp->sctp_frag_point;
1153         asoc->sctp_features = inp->sctp_features;
1154         asoc->default_dscp = inp->sctp_ep.default_dscp;
1155         asoc->max_cwnd = inp->max_cwnd;
1156 #ifdef INET6
1157         if (inp->sctp_ep.default_flowlabel) {
1158                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
1159         } else {
1160                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
1161                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
1162                         asoc->default_flowlabel &= 0x000fffff;
1163                         asoc->default_flowlabel |= 0x80000000;
1164                 } else {
1165                         asoc->default_flowlabel = 0;
1166                 }
1167         }
1168 #endif
1169         asoc->sb_send_resv = 0;
1170         if (override_tag) {
1171                 asoc->my_vtag = override_tag;
1172         } else {
1173                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
1174         }
1175         /* Get the nonce tags */
1176         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1177         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1178         asoc->vrf_id = vrf_id;
1179
1180 #ifdef SCTP_ASOCLOG_OF_TSNS
1181         asoc->tsn_in_at = 0;
1182         asoc->tsn_out_at = 0;
1183         asoc->tsn_in_wrapped = 0;
1184         asoc->tsn_out_wrapped = 0;
1185         asoc->cumack_log_at = 0;
1186         asoc->cumack_log_atsnt = 0;
1187 #endif
1188 #ifdef SCTP_FS_SPEC_LOG
1189         asoc->fs_index = 0;
1190 #endif
1191         asoc->refcnt = 0;
1192         asoc->assoc_up_sent = 0;
1193         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1194             sctp_select_initial_TSN(&inp->sctp_ep);
1195         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1196         /* we are optimisitic here */
1197         asoc->peer_supports_nat = 0;
1198         asoc->sent_queue_retran_cnt = 0;
1199
1200         /* for CMT */
1201         asoc->last_net_cmt_send_started = NULL;
1202
1203         /* This will need to be adjusted */
1204         asoc->last_acked_seq = asoc->init_seq_number - 1;
1205         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1206         asoc->asconf_seq_in = asoc->last_acked_seq;
1207
1208         /* here we are different, we hold the next one we expect */
1209         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1210
1211         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
1212         asoc->initial_rto = inp->sctp_ep.initial_rto;
1213
1214         asoc->default_mtu = inp->sctp_ep.default_mtu;
1215         asoc->max_init_times = inp->sctp_ep.max_init_times;
1216         asoc->max_send_times = inp->sctp_ep.max_send_times;
1217         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
1218         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
1219         asoc->free_chunk_cnt = 0;
1220
1221         asoc->iam_blocking = 0;
1222         asoc->context = inp->sctp_context;
1223         asoc->local_strreset_support = inp->local_strreset_support;
1224         asoc->def_send = inp->def_send;
1225         asoc->delayed_ack = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1226         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
1227         asoc->pr_sctp_cnt = 0;
1228         asoc->total_output_queue_size = 0;
1229
1230         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1231                 asoc->scope.ipv6_addr_legal = 1;
1232                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
1233                         asoc->scope.ipv4_addr_legal = 1;
1234                 } else {
1235                         asoc->scope.ipv4_addr_legal = 0;
1236                 }
1237         } else {
1238                 asoc->scope.ipv6_addr_legal = 0;
1239                 asoc->scope.ipv4_addr_legal = 1;
1240         }
1241
1242         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1243         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1244
1245         asoc->smallest_mtu = inp->sctp_frag_point;
1246         asoc->minrto = inp->sctp_ep.sctp_minrto;
1247         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1248
1249         asoc->stream_locked_on = 0;
1250         asoc->ecn_echo_cnt_onq = 0;
1251         asoc->stream_locked = 0;
1252
1253         asoc->send_sack = 1;
1254
1255         LIST_INIT(&asoc->sctp_restricted_addrs);
1256
1257         TAILQ_INIT(&asoc->nets);
1258         TAILQ_INIT(&asoc->pending_reply_queue);
1259         TAILQ_INIT(&asoc->asconf_ack_sent);
1260         /* Setup to fill the hb random cache at first HB */
1261         asoc->hb_random_idx = 4;
1262
1263         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1264
1265         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1266         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1267
1268         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1269         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1270
1271         /*
1272          * Now the stream parameters, here we allocate space for all streams
1273          * that we request by default.
1274          */
1275         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1276             o_strms;
1277         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1278             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1279             SCTP_M_STRMO);
1280         if (asoc->strmout == NULL) {
1281                 /* big trouble no memory */
1282                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1283                 return (ENOMEM);
1284         }
1285         for (i = 0; i < asoc->streamoutcnt; i++) {
1286                 /*
1287                  * inbound side must be set to 0xffff, also NOTE when we get
1288                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1289                  * count (streamoutcnt) but first check if we sent to any of
1290                  * the upper streams that were dropped (if some were). Those
1291                  * that were dropped must be notified to the upper layer as
1292                  * failed to send.
1293                  */
1294                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1295                 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL);
1296                 asoc->strmout[i].chunks_on_queues = 0;
1297 #if defined(SCTP_DETAILED_STR_STATS)
1298                 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1299                         asoc->strmout[i].abandoned_sent[j] = 0;
1300                         asoc->strmout[i].abandoned_unsent[j] = 0;
1301                 }
1302 #else
1303                 asoc->strmout[i].abandoned_sent[0] = 0;
1304                 asoc->strmout[i].abandoned_unsent[0] = 0;
1305 #endif
1306                 asoc->strmout[i].next_mid_ordered = 0;
1307                 asoc->strmout[i].next_mid_unordered = 0;
1308                 asoc->strmout[i].sid = i;
1309                 asoc->strmout[i].last_msg_incomplete = 0;
1310                 asoc->strmout[i].state = SCTP_STREAM_OPENING;
1311         }
1312         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1313
1314         /* Now the mapping array */
1315         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1316         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1317             SCTP_M_MAP);
1318         if (asoc->mapping_array == NULL) {
1319                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1320                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1321                 return (ENOMEM);
1322         }
1323         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1324         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1325             SCTP_M_MAP);
1326         if (asoc->nr_mapping_array == NULL) {
1327                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1328                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1329                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1330                 return (ENOMEM);
1331         }
1332         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1333
1334         /* Now the init of the other outqueues */
1335         TAILQ_INIT(&asoc->free_chunks);
1336         TAILQ_INIT(&asoc->control_send_queue);
1337         TAILQ_INIT(&asoc->asconf_send_queue);
1338         TAILQ_INIT(&asoc->send_queue);
1339         TAILQ_INIT(&asoc->sent_queue);
1340         TAILQ_INIT(&asoc->resetHead);
1341         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1342         TAILQ_INIT(&asoc->asconf_queue);
1343         /* authentication fields */
1344         asoc->authinfo.random = NULL;
1345         asoc->authinfo.active_keyid = 0;
1346         asoc->authinfo.assoc_key = NULL;
1347         asoc->authinfo.assoc_keyid = 0;
1348         asoc->authinfo.recv_key = NULL;
1349         asoc->authinfo.recv_keyid = 0;
1350         LIST_INIT(&asoc->shared_keys);
1351         asoc->marked_retrans = 0;
1352         asoc->port = inp->sctp_ep.port;
1353         asoc->timoinit = 0;
1354         asoc->timodata = 0;
1355         asoc->timosack = 0;
1356         asoc->timoshutdown = 0;
1357         asoc->timoheartbeat = 0;
1358         asoc->timocookie = 0;
1359         asoc->timoshutdownack = 0;
1360         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1361         asoc->discontinuity_time = asoc->start_time;
1362         for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1363                 asoc->abandoned_unsent[i] = 0;
1364                 asoc->abandoned_sent[i] = 0;
1365         }
1366         /*
1367          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1368          * freed later when the association is freed.
1369          */
1370         return (0);
1371 }
1372
1373 void
1374 sctp_print_mapping_array(struct sctp_association *asoc)
1375 {
1376         unsigned int i, limit;
1377
1378         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1379             asoc->mapping_array_size,
1380             asoc->mapping_array_base_tsn,
1381             asoc->cumulative_tsn,
1382             asoc->highest_tsn_inside_map,
1383             asoc->highest_tsn_inside_nr_map);
1384         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1385                 if (asoc->mapping_array[limit - 1] != 0) {
1386                         break;
1387                 }
1388         }
1389         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1390         for (i = 0; i < limit; i++) {
1391                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1392         }
1393         if (limit % 16)
1394                 SCTP_PRINTF("\n");
1395         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1396                 if (asoc->nr_mapping_array[limit - 1]) {
1397                         break;
1398                 }
1399         }
1400         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1401         for (i = 0; i < limit; i++) {
1402                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1403         }
1404         if (limit % 16)
1405                 SCTP_PRINTF("\n");
1406 }
1407
1408 int
1409 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1410 {
1411         /* mapping array needs to grow */
1412         uint8_t *new_array1, *new_array2;
1413         uint32_t new_size;
1414
1415         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1416         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1417         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1418         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1419                 /* can't get more, forget it */
1420                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1421                 if (new_array1) {
1422                         SCTP_FREE(new_array1, SCTP_M_MAP);
1423                 }
1424                 if (new_array2) {
1425                         SCTP_FREE(new_array2, SCTP_M_MAP);
1426                 }
1427                 return (-1);
1428         }
1429         memset(new_array1, 0, new_size);
1430         memset(new_array2, 0, new_size);
1431         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1432         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1433         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1434         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1435         asoc->mapping_array = new_array1;
1436         asoc->nr_mapping_array = new_array2;
1437         asoc->mapping_array_size = new_size;
1438         return (0);
1439 }
1440
1441 static void
1442 sctp_iterator_work(struct sctp_iterator *it)
1443 {
1444         struct epoch_tracker et;
1445         struct sctp_inpcb *tinp;
1446         int iteration_count = 0;
1447         int inp_skip = 0;
1448         int first_in = 1;
1449
1450         NET_EPOCH_ENTER(et);
1451         SCTP_INP_INFO_RLOCK();
1452         SCTP_ITERATOR_LOCK();
1453         sctp_it_ctl.cur_it = it;
1454         if (it->inp) {
1455                 SCTP_INP_RLOCK(it->inp);
1456                 SCTP_INP_DECR_REF(it->inp);
1457         }
1458         if (it->inp == NULL) {
1459                 /* iterator is complete */
1460 done_with_iterator:
1461                 sctp_it_ctl.cur_it = NULL;
1462                 SCTP_ITERATOR_UNLOCK();
1463                 SCTP_INP_INFO_RUNLOCK();
1464                 if (it->function_atend != NULL) {
1465                         (*it->function_atend) (it->pointer, it->val);
1466                 }
1467                 SCTP_FREE(it, SCTP_M_ITER);
1468                 NET_EPOCH_EXIT(et);
1469                 return;
1470         }
1471 select_a_new_ep:
1472         if (first_in) {
1473                 first_in = 0;
1474         } else {
1475                 SCTP_INP_RLOCK(it->inp);
1476         }
1477         while (((it->pcb_flags) &&
1478             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1479             ((it->pcb_features) &&
1480             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1481                 /* endpoint flags or features don't match, so keep looking */
1482                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1483                         SCTP_INP_RUNLOCK(it->inp);
1484                         goto done_with_iterator;
1485                 }
1486                 tinp = it->inp;
1487                 it->inp = LIST_NEXT(it->inp, sctp_list);
1488                 it->stcb = NULL;
1489                 SCTP_INP_RUNLOCK(tinp);
1490                 if (it->inp == NULL) {
1491                         goto done_with_iterator;
1492                 }
1493                 SCTP_INP_RLOCK(it->inp);
1494         }
1495         /* now go through each assoc which is in the desired state */
1496         if (it->done_current_ep == 0) {
1497                 if (it->function_inp != NULL)
1498                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1499                 it->done_current_ep = 1;
1500         }
1501         if (it->stcb == NULL) {
1502                 /* run the per instance function */
1503                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1504         }
1505         if ((inp_skip) || it->stcb == NULL) {
1506                 if (it->function_inp_end != NULL) {
1507                         inp_skip = (*it->function_inp_end) (it->inp,
1508                             it->pointer,
1509                             it->val);
1510                 }
1511                 SCTP_INP_RUNLOCK(it->inp);
1512                 goto no_stcb;
1513         }
1514         while (it->stcb) {
1515                 SCTP_TCB_LOCK(it->stcb);
1516                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1517                         /* not in the right state... keep looking */
1518                         SCTP_TCB_UNLOCK(it->stcb);
1519                         goto next_assoc;
1520                 }
1521                 /* see if we have limited out the iterator loop */
1522                 iteration_count++;
1523                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1524                         /* Pause to let others grab the lock */
1525                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1526                         SCTP_TCB_UNLOCK(it->stcb);
1527                         SCTP_INP_INCR_REF(it->inp);
1528                         SCTP_INP_RUNLOCK(it->inp);
1529                         SCTP_ITERATOR_UNLOCK();
1530                         SCTP_INP_INFO_RUNLOCK();
1531                         SCTP_INP_INFO_RLOCK();
1532                         SCTP_ITERATOR_LOCK();
1533                         if (sctp_it_ctl.iterator_flags) {
1534                                 /* We won't be staying here */
1535                                 SCTP_INP_DECR_REF(it->inp);
1536                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1537                                 if (sctp_it_ctl.iterator_flags &
1538                                     SCTP_ITERATOR_STOP_CUR_IT) {
1539                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1540                                         goto done_with_iterator;
1541                                 }
1542                                 if (sctp_it_ctl.iterator_flags &
1543                                     SCTP_ITERATOR_STOP_CUR_INP) {
1544                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1545                                         goto no_stcb;
1546                                 }
1547                                 /* If we reach here huh? */
1548                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1549                                     sctp_it_ctl.iterator_flags);
1550                                 sctp_it_ctl.iterator_flags = 0;
1551                         }
1552                         SCTP_INP_RLOCK(it->inp);
1553                         SCTP_INP_DECR_REF(it->inp);
1554                         SCTP_TCB_LOCK(it->stcb);
1555                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1556                         iteration_count = 0;
1557                 }
1558                 KASSERT(it->inp == it->stcb->sctp_ep,
1559                     ("%s: stcb %p does not belong to inp %p, but inp %p",
1560                     __func__, it->stcb, it->inp, it->stcb->sctp_ep));
1561
1562                 /* run function on this one */
1563                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1564
1565                 /*
1566                  * we lie here, it really needs to have its own type but
1567                  * first I must verify that this won't effect things :-0
1568                  */
1569                 if (it->no_chunk_output == 0)
1570                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1571
1572                 SCTP_TCB_UNLOCK(it->stcb);
1573 next_assoc:
1574                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1575                 if (it->stcb == NULL) {
1576                         /* Run last function */
1577                         if (it->function_inp_end != NULL) {
1578                                 inp_skip = (*it->function_inp_end) (it->inp,
1579                                     it->pointer,
1580                                     it->val);
1581                         }
1582                 }
1583         }
1584         SCTP_INP_RUNLOCK(it->inp);
1585 no_stcb:
1586         /* done with all assocs on this endpoint, move on to next endpoint */
1587         it->done_current_ep = 0;
1588         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1589                 it->inp = NULL;
1590         } else {
1591                 it->inp = LIST_NEXT(it->inp, sctp_list);
1592         }
1593         it->stcb = NULL;
1594         if (it->inp == NULL) {
1595                 goto done_with_iterator;
1596         }
1597         goto select_a_new_ep;
1598 }
1599
1600 void
1601 sctp_iterator_worker(void)
1602 {
1603         struct sctp_iterator *it;
1604
1605         /* This function is called with the WQ lock in place */
1606         sctp_it_ctl.iterator_running = 1;
1607         while ((it = TAILQ_FIRST(&sctp_it_ctl.iteratorhead)) != NULL) {
1608                 /* now lets work on this one */
1609                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1610                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1611                 CURVNET_SET(it->vn);
1612                 sctp_iterator_work(it);
1613                 CURVNET_RESTORE();
1614                 SCTP_IPI_ITERATOR_WQ_LOCK();
1615                 /* sa_ignore FREED_MEMORY */
1616         }
1617         sctp_it_ctl.iterator_running = 0;
1618         return;
1619 }
1620
1621 static void
1622 sctp_handle_addr_wq(void)
1623 {
1624         /* deal with the ADDR wq from the rtsock calls */
1625         struct sctp_laddr *wi, *nwi;
1626         struct sctp_asconf_iterator *asc;
1627
1628         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1629             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1630         if (asc == NULL) {
1631                 /* Try later, no memory */
1632                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1633                     (struct sctp_inpcb *)NULL,
1634                     (struct sctp_tcb *)NULL,
1635                     (struct sctp_nets *)NULL);
1636                 return;
1637         }
1638         LIST_INIT(&asc->list_of_work);
1639         asc->cnt = 0;
1640
1641         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1642                 LIST_REMOVE(wi, sctp_nxt_addr);
1643                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1644                 asc->cnt++;
1645         }
1646
1647         if (asc->cnt == 0) {
1648                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1649         } else {
1650                 int ret;
1651
1652                 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
1653                     sctp_asconf_iterator_stcb,
1654                     NULL,       /* No ep end for boundall */
1655                     SCTP_PCB_FLAGS_BOUNDALL,
1656                     SCTP_PCB_ANY_FEATURES,
1657                     SCTP_ASOC_ANY_STATE,
1658                     (void *)asc, 0,
1659                     sctp_asconf_iterator_end, NULL, 0);
1660                 if (ret) {
1661                         SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n");
1662                         /*
1663                          * Freeing if we are stopping or put back on the
1664                          * addr_wq.
1665                          */
1666                         if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
1667                                 sctp_asconf_iterator_end(asc, 0);
1668                         } else {
1669                                 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) {
1670                                         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
1671                                 }
1672                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1673                         }
1674                 }
1675         }
1676 }
1677
1678 /*-
1679  * The following table shows which pointers for the inp, stcb, or net are
1680  * stored for each timer after it was started.
1681  *
1682  *|Name                         |Timer                        |inp |stcb|net |
1683  *|-----------------------------|-----------------------------|----|----|----|
1684  *|SCTP_TIMER_TYPE_SEND         |net->rxt_timer               |Yes |Yes |Yes |
1685  *|SCTP_TIMER_TYPE_INIT         |net->rxt_timer               |Yes |Yes |Yes |
1686  *|SCTP_TIMER_TYPE_RECV         |stcb->asoc.dack_timer        |Yes |Yes |No  |
1687  *|SCTP_TIMER_TYPE_SHUTDOWN     |net->rxt_timer               |Yes |Yes |Yes |
1688  *|SCTP_TIMER_TYPE_HEARTBEAT    |net->hb_timer                |Yes |Yes |Yes |
1689  *|SCTP_TIMER_TYPE_COOKIE       |net->rxt_timer               |Yes |Yes |Yes |
1690  *|SCTP_TIMER_TYPE_NEWCOOKIE    |inp->sctp_ep.signature_change|Yes |No  |No  |
1691  *|SCTP_TIMER_TYPE_PATHMTURAISE |net->pmtu_timer              |Yes |Yes |Yes |
1692  *|SCTP_TIMER_TYPE_SHUTDOWNACK  |net->rxt_timer               |Yes |Yes |Yes |
1693  *|SCTP_TIMER_TYPE_ASCONF       |stcb->asoc.asconf_timer      |Yes |Yes |Yes |
1694  *|SCTP_TIMER_TYPE_SHUTDOWNGUARD|stcb->asoc.shut_guard_timer  |Yes |Yes |No  |
1695  *|SCTP_TIMER_TYPE_AUTOCLOSE    |stcb->asoc.autoclose_timer   |Yes |Yes |No  |
1696  *|SCTP_TIMER_TYPE_STRRESET     |stcb->asoc.strreset_timer    |Yes |Yes |No  |
1697  *|SCTP_TIMER_TYPE_INPKILL      |inp->sctp_ep.signature_change|Yes |No  |No  |
1698  *|SCTP_TIMER_TYPE_ASOCKILL     |stcb->asoc.strreset_timer    |Yes |Yes |No  |
1699  *|SCTP_TIMER_TYPE_ADDR_WQ      |SCTP_BASE_INFO(addr_wq_timer)|No  |No  |No  |
1700  *|SCTP_TIMER_TYPE_PRIM_DELETED |stcb->asoc.delete_prim_timer |Yes |Yes |No  |
1701  */
1702
1703 void
1704 sctp_timeout_handler(void *t)
1705 {
1706         struct epoch_tracker et;
1707         struct timeval tv;
1708         struct sctp_inpcb *inp;
1709         struct sctp_tcb *stcb;
1710         struct sctp_nets *net;
1711         struct sctp_timer *tmr;
1712         struct mbuf *op_err;
1713         int type;
1714         int i, secret;
1715         bool did_output, released_asoc_reference;
1716
1717         /*
1718          * If inp, stcb or net are not NULL, then references to these were
1719          * added when the timer was started, and must be released before
1720          * this function returns.
1721          */
1722         tmr = (struct sctp_timer *)t;
1723         inp = (struct sctp_inpcb *)tmr->ep;
1724         stcb = (struct sctp_tcb *)tmr->tcb;
1725         net = (struct sctp_nets *)tmr->net;
1726         CURVNET_SET((struct vnet *)tmr->vnet);
1727         NET_EPOCH_ENTER(et);
1728         released_asoc_reference = false;
1729
1730 #ifdef SCTP_AUDITING_ENABLED
1731         sctp_audit_log(0xF0, (uint8_t)tmr->type);
1732         sctp_auditing(3, inp, stcb, net);
1733 #endif
1734
1735         /* sanity checks... */
1736         KASSERT(tmr->self == NULL || tmr->self == tmr,
1737             ("sctp_timeout_handler: tmr->self corrupted"));
1738         KASSERT(SCTP_IS_TIMER_TYPE_VALID(tmr->type),
1739             ("sctp_timeout_handler: invalid timer type %d", tmr->type));
1740         type = tmr->type;
1741         KASSERT(stcb == NULL || stcb->sctp_ep == inp,
1742             ("sctp_timeout_handler of type %d: inp = %p, stcb->sctp_ep %p",
1743             type, stcb, stcb->sctp_ep));
1744         tmr->stopped_from = 0xa001;
1745         if ((stcb != NULL) && (stcb->asoc.state == SCTP_STATE_EMPTY)) {
1746                 SCTPDBG(SCTP_DEBUG_TIMER2,
1747                     "Timer type %d handler exiting due to CLOSED association.\n",
1748                     type);
1749                 goto out_decr;
1750         }
1751         tmr->stopped_from = 0xa002;
1752         SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d goes off.\n", type);
1753         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1754                 SCTPDBG(SCTP_DEBUG_TIMER2,
1755                     "Timer type %d handler exiting due to not being active.\n",
1756                     type);
1757                 goto out_decr;
1758         }
1759
1760         tmr->stopped_from = 0xa003;
1761         if (stcb) {
1762                 SCTP_TCB_LOCK(stcb);
1763                 /*
1764                  * Release reference so that association can be freed if
1765                  * necessary below. This is safe now that we have acquired
1766                  * the lock.
1767                  */
1768                 atomic_add_int(&stcb->asoc.refcnt, -1);
1769                 released_asoc_reference = true;
1770                 if ((type != SCTP_TIMER_TYPE_ASOCKILL) &&
1771                     ((stcb->asoc.state == SCTP_STATE_EMPTY) ||
1772                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1773                         SCTPDBG(SCTP_DEBUG_TIMER2,
1774                             "Timer type %d handler exiting due to CLOSED association.\n",
1775                             type);
1776                         goto out;
1777                 }
1778         } else if (inp != NULL) {
1779                 SCTP_INP_WLOCK(inp);
1780         } else {
1781                 SCTP_WQ_ADDR_LOCK();
1782         }
1783
1784         /* Record in stopped_from which timeout occurred. */
1785         tmr->stopped_from = type;
1786         /* mark as being serviced now */
1787         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1788                 /*
1789                  * Callout has been rescheduled.
1790                  */
1791                 goto out;
1792         }
1793         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1794                 /*
1795                  * Not active, so no action.
1796                  */
1797                 goto out;
1798         }
1799         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1800
1801         /* call the handler for the appropriate timer type */
1802         switch (type) {
1803         case SCTP_TIMER_TYPE_SEND:
1804                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1805                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1806                     type, inp, stcb, net));
1807                 SCTP_STAT_INCR(sctps_timodata);
1808                 stcb->asoc.timodata++;
1809                 stcb->asoc.num_send_timers_up--;
1810                 if (stcb->asoc.num_send_timers_up < 0) {
1811                         stcb->asoc.num_send_timers_up = 0;
1812                 }
1813                 SCTP_TCB_LOCK_ASSERT(stcb);
1814                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1815                         /* no need to unlock on tcb its gone */
1816
1817                         goto out_decr;
1818                 }
1819                 SCTP_TCB_LOCK_ASSERT(stcb);
1820 #ifdef SCTP_AUDITING_ENABLED
1821                 sctp_auditing(4, inp, stcb, net);
1822 #endif
1823                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1824                 did_output = true;
1825                 if ((stcb->asoc.num_send_timers_up == 0) &&
1826                     (stcb->asoc.sent_queue_cnt > 0)) {
1827                         struct sctp_tmit_chunk *chk;
1828
1829                         /*
1830                          * Safeguard. If there on some on the sent queue
1831                          * somewhere but no timers running something is
1832                          * wrong... so we start a timer on the first chunk
1833                          * on the send queue on whatever net it is sent to.
1834                          */
1835                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1836                                 if (chk->whoTo != NULL) {
1837                                         break;
1838                                 }
1839                         }
1840                         if (chk != NULL) {
1841                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
1842                         }
1843                 }
1844                 break;
1845         case SCTP_TIMER_TYPE_INIT:
1846                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1847                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1848                     type, inp, stcb, net));
1849                 SCTP_STAT_INCR(sctps_timoinit);
1850                 stcb->asoc.timoinit++;
1851                 if (sctp_t1init_timer(inp, stcb, net)) {
1852                         /* no need to unlock on tcb its gone */
1853                         goto out_decr;
1854                 }
1855                 did_output = false;
1856                 break;
1857         case SCTP_TIMER_TYPE_RECV:
1858                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
1859                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1860                     type, inp, stcb, net));
1861                 SCTP_STAT_INCR(sctps_timosack);
1862                 stcb->asoc.timosack++;
1863                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1864 #ifdef SCTP_AUDITING_ENABLED
1865                 sctp_auditing(4, inp, stcb, NULL);
1866 #endif
1867                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1868                 did_output = true;
1869                 break;
1870         case SCTP_TIMER_TYPE_SHUTDOWN:
1871                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1872                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1873                     type, inp, stcb, net));
1874                 SCTP_STAT_INCR(sctps_timoshutdown);
1875                 stcb->asoc.timoshutdown++;
1876                 if (sctp_shutdown_timer(inp, stcb, net)) {
1877                         /* no need to unlock on tcb its gone */
1878                         goto out_decr;
1879                 }
1880 #ifdef SCTP_AUDITING_ENABLED
1881                 sctp_auditing(4, inp, stcb, net);
1882 #endif
1883                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1884                 did_output = true;
1885                 break;
1886         case SCTP_TIMER_TYPE_HEARTBEAT:
1887                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1888                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1889                     type, inp, stcb, net));
1890                 SCTP_STAT_INCR(sctps_timoheartbeat);
1891                 stcb->asoc.timoheartbeat++;
1892                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1893                         /* no need to unlock on tcb its gone */
1894                         goto out_decr;
1895                 }
1896 #ifdef SCTP_AUDITING_ENABLED
1897                 sctp_auditing(4, inp, stcb, net);
1898 #endif
1899                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1900                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1901                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1902                         did_output = true;
1903                 } else {
1904                         did_output = false;
1905                 }
1906                 break;
1907         case SCTP_TIMER_TYPE_COOKIE:
1908                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1909                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1910                     type, inp, stcb, net));
1911                 SCTP_STAT_INCR(sctps_timocookie);
1912                 stcb->asoc.timocookie++;
1913                 if (sctp_cookie_timer(inp, stcb, net)) {
1914                         /* no need to unlock on tcb its gone */
1915                         goto out_decr;
1916                 }
1917 #ifdef SCTP_AUDITING_ENABLED
1918                 sctp_auditing(4, inp, stcb, net);
1919 #endif
1920                 /*
1921                  * We consider T3 and Cookie timer pretty much the same with
1922                  * respect to where from in chunk_output.
1923                  */
1924                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1925                 did_output = true;
1926                 break;
1927         case SCTP_TIMER_TYPE_NEWCOOKIE:
1928                 KASSERT(inp != NULL && stcb == NULL && net == NULL,
1929                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1930                     type, inp, stcb, net));
1931                 SCTP_STAT_INCR(sctps_timosecret);
1932                 (void)SCTP_GETTIME_TIMEVAL(&tv);
1933                 inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1934                 inp->sctp_ep.last_secret_number =
1935                     inp->sctp_ep.current_secret_number;
1936                 inp->sctp_ep.current_secret_number++;
1937                 if (inp->sctp_ep.current_secret_number >=
1938                     SCTP_HOW_MANY_SECRETS) {
1939                         inp->sctp_ep.current_secret_number = 0;
1940                 }
1941                 secret = (int)inp->sctp_ep.current_secret_number;
1942                 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1943                         inp->sctp_ep.secret_key[secret][i] =
1944                             sctp_select_initial_TSN(&inp->sctp_ep);
1945                 }
1946                 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
1947                 did_output = false;
1948                 break;
1949         case SCTP_TIMER_TYPE_PATHMTURAISE:
1950                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1951                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1952                     type, inp, stcb, net));
1953                 SCTP_STAT_INCR(sctps_timopathmtu);
1954                 sctp_pathmtu_timer(inp, stcb, net);
1955                 did_output = false;
1956                 break;
1957         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1958                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1959                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1960                     type, inp, stcb, net));
1961                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1962                         /* no need to unlock on tcb its gone */
1963                         goto out_decr;
1964                 }
1965                 SCTP_STAT_INCR(sctps_timoshutdownack);
1966                 stcb->asoc.timoshutdownack++;
1967 #ifdef SCTP_AUDITING_ENABLED
1968                 sctp_auditing(4, inp, stcb, net);
1969 #endif
1970                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1971                 did_output = true;
1972                 break;
1973         case SCTP_TIMER_TYPE_ASCONF:
1974                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1975                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1976                     type, inp, stcb, net));
1977                 SCTP_STAT_INCR(sctps_timoasconf);
1978                 if (sctp_asconf_timer(inp, stcb, net)) {
1979                         /* no need to unlock on tcb its gone */
1980                         goto out_decr;
1981                 }
1982 #ifdef SCTP_AUDITING_ENABLED
1983                 sctp_auditing(4, inp, stcb, net);
1984 #endif
1985                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1986                 did_output = true;
1987                 break;
1988         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1989                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
1990                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1991                     type, inp, stcb, net));
1992                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1993                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1994                     "Shutdown guard timer expired");
1995                 sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
1996                 /* no need to unlock on tcb its gone */
1997                 goto out_decr;
1998         case SCTP_TIMER_TYPE_AUTOCLOSE:
1999                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2000                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2001                     type, inp, stcb, net));
2002                 SCTP_STAT_INCR(sctps_timoautoclose);
2003                 sctp_autoclose_timer(inp, stcb);
2004                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
2005                 did_output = true;
2006                 break;
2007         case SCTP_TIMER_TYPE_STRRESET:
2008                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2009                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2010                     type, inp, stcb, net));
2011                 SCTP_STAT_INCR(sctps_timostrmrst);
2012                 if (sctp_strreset_timer(inp, stcb)) {
2013                         /* no need to unlock on tcb its gone */
2014                         goto out_decr;
2015                 }
2016                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
2017                 did_output = true;
2018                 break;
2019         case SCTP_TIMER_TYPE_INPKILL:
2020                 KASSERT(inp != NULL && stcb == NULL && net == NULL,
2021                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2022                     type, inp, stcb, net));
2023                 SCTP_STAT_INCR(sctps_timoinpkill);
2024                 /*
2025                  * special case, take away our increment since WE are the
2026                  * killer
2027                  */
2028                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL,
2029                     SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
2030                 SCTP_INP_DECR_REF(inp);
2031                 SCTP_INP_WUNLOCK(inp);
2032                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
2033                     SCTP_CALLED_FROM_INPKILL_TIMER);
2034                 inp = NULL;
2035                 goto out_decr;
2036         case SCTP_TIMER_TYPE_ASOCKILL:
2037                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2038                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2039                     type, inp, stcb, net));
2040                 SCTP_STAT_INCR(sctps_timoassockill);
2041                 /* Can we free it yet? */
2042                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
2043                     SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
2044                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2045                     SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
2046                 /*
2047                  * free asoc, always unlocks (or destroy's) so prevent
2048                  * duplicate unlock or unlock of a free mtx :-0
2049                  */
2050                 stcb = NULL;
2051                 goto out_decr;
2052         case SCTP_TIMER_TYPE_ADDR_WQ:
2053                 KASSERT(inp == NULL && stcb == NULL && net == NULL,
2054                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2055                     type, inp, stcb, net));
2056                 sctp_handle_addr_wq();
2057                 did_output = true;
2058                 break;
2059         case SCTP_TIMER_TYPE_PRIM_DELETED:
2060                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2061                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2062                     type, inp, stcb, net));
2063                 SCTP_STAT_INCR(sctps_timodelprim);
2064                 sctp_delete_prim_timer(inp, stcb);
2065                 did_output = false;
2066                 break;
2067         default:
2068 #ifdef INVARIANTS
2069                 panic("Unknown timer type %d", type);
2070 #else
2071                 goto out;
2072 #endif
2073         }
2074 #ifdef SCTP_AUDITING_ENABLED
2075         sctp_audit_log(0xF1, (uint8_t)type);
2076         if (inp != NULL)
2077                 sctp_auditing(5, inp, stcb, net);
2078 #endif
2079         if (did_output && (stcb != NULL)) {
2080                 /*
2081                  * Now we need to clean up the control chunk chain if an
2082                  * ECNE is on it. It must be marked as UNSENT again so next
2083                  * call will continue to send it until such time that we get
2084                  * a CWR, to remove it. It is, however, less likely that we
2085                  * will find a ecn echo on the chain though.
2086                  */
2087                 sctp_fix_ecn_echo(&stcb->asoc);
2088         }
2089 out:
2090         if (stcb != NULL) {
2091                 SCTP_TCB_UNLOCK(stcb);
2092         } else if (inp != NULL) {
2093                 SCTP_INP_WUNLOCK(inp);
2094         } else {
2095                 SCTP_WQ_ADDR_UNLOCK();
2096         }
2097
2098 out_decr:
2099         /* These reference counts were incremented in sctp_timer_start(). */
2100         if (inp != NULL) {
2101                 SCTP_INP_DECR_REF(inp);
2102         }
2103         if ((stcb != NULL) && !released_asoc_reference) {
2104                 atomic_add_int(&stcb->asoc.refcnt, -1);
2105         }
2106         if (net != NULL) {
2107                 sctp_free_remote_addr(net);
2108         }
2109         SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d handler finished.\n", type);
2110         CURVNET_RESTORE();
2111         NET_EPOCH_EXIT(et);
2112 }
2113
2114 /*-
2115  * The following table shows which parameters must be provided
2116  * when calling sctp_timer_start(). For parameters not being
2117  * provided, NULL must be used.
2118  *
2119  * |Name                         |inp |stcb|net |
2120  * |-----------------------------|----|----|----|
2121  * |SCTP_TIMER_TYPE_SEND         |Yes |Yes |Yes |
2122  * |SCTP_TIMER_TYPE_INIT         |Yes |Yes |Yes |
2123  * |SCTP_TIMER_TYPE_RECV         |Yes |Yes |No  |
2124  * |SCTP_TIMER_TYPE_SHUTDOWN     |Yes |Yes |Yes |
2125  * |SCTP_TIMER_TYPE_HEARTBEAT    |Yes |Yes |Yes |
2126  * |SCTP_TIMER_TYPE_COOKIE       |Yes |Yes |Yes |
2127  * |SCTP_TIMER_TYPE_NEWCOOKIE    |Yes |No  |No  |
2128  * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes |
2129  * |SCTP_TIMER_TYPE_SHUTDOWNACK  |Yes |Yes |Yes |
2130  * |SCTP_TIMER_TYPE_ASCONF       |Yes |Yes |Yes |
2131  * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No  |
2132  * |SCTP_TIMER_TYPE_AUTOCLOSE    |Yes |Yes |No  |
2133  * |SCTP_TIMER_TYPE_STRRESET     |Yes |Yes |Yes |
2134  * |SCTP_TIMER_TYPE_INPKILL      |Yes |No  |No  |
2135  * |SCTP_TIMER_TYPE_ASOCKILL     |Yes |Yes |No  |
2136  * |SCTP_TIMER_TYPE_ADDR_WQ      |No  |No  |No  |
2137  * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No  |
2138  *
2139  */
2140
2141 void
2142 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2143     struct sctp_nets *net)
2144 {
2145         struct sctp_timer *tmr;
2146         uint32_t to_ticks;
2147         uint32_t rndval, jitter;
2148
2149         KASSERT(stcb == NULL || stcb->sctp_ep == inp,
2150             ("sctp_timer_start of type %d: inp = %p, stcb->sctp_ep %p",
2151             t_type, stcb, stcb->sctp_ep));
2152         tmr = NULL;
2153         if (stcb != NULL) {
2154                 SCTP_TCB_LOCK_ASSERT(stcb);
2155         } else if (inp != NULL) {
2156                 SCTP_INP_WLOCK_ASSERT(inp);
2157         } else {
2158                 SCTP_WQ_ADDR_LOCK_ASSERT();
2159         }
2160         if (stcb != NULL) {
2161                 /*
2162                  * Don't restart timer on association that's about to be
2163                  * killed.
2164                  */
2165                 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
2166                     (t_type != SCTP_TIMER_TYPE_ASOCKILL)) {
2167                         SCTPDBG(SCTP_DEBUG_TIMER2,
2168                             "Timer type %d not started: inp=%p, stcb=%p, net=%p (stcb deleted).\n",
2169                             t_type, inp, stcb, net);
2170                         return;
2171                 }
2172                 /* Don't restart timer on net that's been removed. */
2173                 if (net != NULL && (net->dest_state & SCTP_ADDR_BEING_DELETED)) {
2174                         SCTPDBG(SCTP_DEBUG_TIMER2,
2175                             "Timer type %d not started: inp=%p, stcb=%p, net=%p (net deleted).\n",
2176                             t_type, inp, stcb, net);
2177                         return;
2178                 }
2179         }
2180         switch (t_type) {
2181         case SCTP_TIMER_TYPE_SEND:
2182                 /* Here we use the RTO timer. */
2183                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2184 #ifdef INVARIANTS
2185                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2186                             t_type, inp, stcb, net);
2187 #else
2188                         return;
2189 #endif
2190                 }
2191                 tmr = &net->rxt_timer;
2192                 if (net->RTO == 0) {
2193                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2194                 } else {
2195                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2196                 }
2197                 break;
2198         case SCTP_TIMER_TYPE_INIT:
2199                 /*
2200                  * Here we use the INIT timer default usually about 1
2201                  * second.
2202                  */
2203                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2204 #ifdef INVARIANTS
2205                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2206                             t_type, inp, stcb, net);
2207 #else
2208                         return;
2209 #endif
2210                 }
2211                 tmr = &net->rxt_timer;
2212                 if (net->RTO == 0) {
2213                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2214                 } else {
2215                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2216                 }
2217                 break;
2218         case SCTP_TIMER_TYPE_RECV:
2219                 /*
2220                  * Here we use the Delayed-Ack timer value from the inp,
2221                  * ususually about 200ms.
2222                  */
2223                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2224 #ifdef INVARIANTS
2225                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2226                             t_type, inp, stcb, net);
2227 #else
2228                         return;
2229 #endif
2230                 }
2231                 tmr = &stcb->asoc.dack_timer;
2232                 to_ticks = sctp_msecs_to_ticks(stcb->asoc.delayed_ack);
2233                 break;
2234         case SCTP_TIMER_TYPE_SHUTDOWN:
2235                 /* Here we use the RTO of the destination. */
2236                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2237 #ifdef INVARIANTS
2238                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2239                             t_type, inp, stcb, net);
2240 #else
2241                         return;
2242 #endif
2243                 }
2244                 tmr = &net->rxt_timer;
2245                 if (net->RTO == 0) {
2246                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2247                 } else {
2248                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2249                 }
2250                 break;
2251         case SCTP_TIMER_TYPE_HEARTBEAT:
2252                 /*
2253                  * The net is used here so that we can add in the RTO. Even
2254                  * though we use a different timer. We also add the HB timer
2255                  * PLUS a random jitter.
2256                  */
2257                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2258 #ifdef INVARIANTS
2259                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2260                             t_type, inp, stcb, net);
2261 #else
2262                         return;
2263 #endif
2264                 }
2265                 if ((net->dest_state & SCTP_ADDR_NOHB) &&
2266                     !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
2267                         SCTPDBG(SCTP_DEBUG_TIMER2,
2268                             "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n",
2269                             t_type, inp, stcb, net);
2270                         return;
2271                 }
2272                 tmr = &net->hb_timer;
2273                 if (net->RTO == 0) {
2274                         to_ticks = stcb->asoc.initial_rto;
2275                 } else {
2276                         to_ticks = net->RTO;
2277                 }
2278                 rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2279                 jitter = rndval % to_ticks;
2280                 if (to_ticks > 1) {
2281                         to_ticks >>= 1;
2282                 }
2283                 if (jitter < (UINT32_MAX - to_ticks)) {
2284                         to_ticks += jitter;
2285                 } else {
2286                         to_ticks = UINT32_MAX;
2287                 }
2288                 if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2289                     !(net->dest_state & SCTP_ADDR_PF)) {
2290                         if (net->heart_beat_delay < (UINT32_MAX - to_ticks)) {
2291                                 to_ticks += net->heart_beat_delay;
2292                         } else {
2293                                 to_ticks = UINT32_MAX;
2294                         }
2295                 }
2296                 /*
2297                  * Now we must convert the to_ticks that are now in ms to
2298                  * ticks.
2299                  */
2300                 to_ticks = sctp_msecs_to_ticks(to_ticks);
2301                 break;
2302         case SCTP_TIMER_TYPE_COOKIE:
2303                 /*
2304                  * Here we can use the RTO timer from the network since one
2305                  * RTT was complete. If a retransmission happened then we
2306                  * will be using the RTO initial value.
2307                  */
2308                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2309 #ifdef INVARIANTS
2310                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2311                             t_type, inp, stcb, net);
2312 #else
2313                         return;
2314 #endif
2315                 }
2316                 tmr = &net->rxt_timer;
2317                 if (net->RTO == 0) {
2318                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2319                 } else {
2320                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2321                 }
2322                 break;
2323         case SCTP_TIMER_TYPE_NEWCOOKIE:
2324                 /*
2325                  * Nothing needed but the endpoint here ususually about 60
2326                  * minutes.
2327                  */
2328                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2329 #ifdef INVARIANTS
2330                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2331                             t_type, inp, stcb, net);
2332 #else
2333                         return;
2334 #endif
2335                 }
2336                 tmr = &inp->sctp_ep.signature_change;
2337                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2338                 break;
2339         case SCTP_TIMER_TYPE_PATHMTURAISE:
2340                 /*
2341                  * Here we use the value found in the EP for PMTUD,
2342                  * ususually about 10 minutes.
2343                  */
2344                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2345 #ifdef INVARIANTS
2346                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2347                             t_type, inp, stcb, net);
2348 #else
2349                         return;
2350 #endif
2351                 }
2352                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2353                         SCTPDBG(SCTP_DEBUG_TIMER2,
2354                             "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n",
2355                             t_type, inp, stcb, net);
2356                         return;
2357                 }
2358                 tmr = &net->pmtu_timer;
2359                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2360                 break;
2361         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2362                 /* Here we use the RTO of the destination. */
2363                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2364 #ifdef INVARIANTS
2365                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2366                             t_type, inp, stcb, net);
2367 #else
2368                         return;
2369 #endif
2370                 }
2371                 tmr = &net->rxt_timer;
2372                 if (net->RTO == 0) {
2373                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2374                 } else {
2375                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2376                 }
2377                 break;
2378         case SCTP_TIMER_TYPE_ASCONF:
2379                 /*
2380                  * Here the timer comes from the stcb but its value is from
2381                  * the net's RTO.
2382                  */
2383                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2384 #ifdef INVARIANTS
2385                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2386                             t_type, inp, stcb, net);
2387 #else
2388                         return;
2389 #endif
2390                 }
2391                 tmr = &stcb->asoc.asconf_timer;
2392                 if (net->RTO == 0) {
2393                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2394                 } else {
2395                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2396                 }
2397                 break;
2398         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2399                 /*
2400                  * Here we use the endpoints shutdown guard timer usually
2401                  * about 3 minutes.
2402                  */
2403                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2404 #ifdef INVARIANTS
2405                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2406                             t_type, inp, stcb, net);
2407 #else
2408                         return;
2409 #endif
2410                 }
2411                 tmr = &stcb->asoc.shut_guard_timer;
2412                 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) {
2413                         if (stcb->asoc.maxrto < UINT32_MAX / 5) {
2414                                 to_ticks = sctp_msecs_to_ticks(5 * stcb->asoc.maxrto);
2415                         } else {
2416                                 to_ticks = sctp_msecs_to_ticks(UINT32_MAX);
2417                         }
2418                 } else {
2419                         to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2420                 }
2421                 break;
2422         case SCTP_TIMER_TYPE_AUTOCLOSE:
2423                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2424 #ifdef INVARIANTS
2425                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2426                             t_type, inp, stcb, net);
2427 #else
2428                         return;
2429 #endif
2430                 }
2431                 tmr = &stcb->asoc.autoclose_timer;
2432                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2433                 break;
2434         case SCTP_TIMER_TYPE_STRRESET:
2435                 /*
2436                  * Here the timer comes from the stcb but its value is from
2437                  * the net's RTO.
2438                  */
2439                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2440 #ifdef INVARIANTS
2441                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2442                             t_type, inp, stcb, net);
2443 #else
2444                         return;
2445 #endif
2446                 }
2447                 tmr = &stcb->asoc.strreset_timer;
2448                 if (net->RTO == 0) {
2449                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2450                 } else {
2451                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2452                 }
2453                 break;
2454         case SCTP_TIMER_TYPE_INPKILL:
2455                 /*
2456                  * The inp is setup to die. We re-use the signature_chage
2457                  * timer since that has stopped and we are in the GONE
2458                  * state.
2459                  */
2460                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2461 #ifdef INVARIANTS
2462                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2463                             t_type, inp, stcb, net);
2464 #else
2465                         return;
2466 #endif
2467                 }
2468                 tmr = &inp->sctp_ep.signature_change;
2469                 to_ticks = sctp_msecs_to_ticks(SCTP_INP_KILL_TIMEOUT);
2470                 break;
2471         case SCTP_TIMER_TYPE_ASOCKILL:
2472                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2473 #ifdef INVARIANTS
2474                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2475                             t_type, inp, stcb, net);
2476 #else
2477                         return;
2478 #endif
2479                 }
2480                 tmr = &stcb->asoc.strreset_timer;
2481                 to_ticks = sctp_msecs_to_ticks(SCTP_ASOC_KILL_TIMEOUT);
2482                 break;
2483         case SCTP_TIMER_TYPE_ADDR_WQ:
2484                 if ((inp != NULL) || (stcb != NULL) || (net != NULL)) {
2485 #ifdef INVARIANTS
2486                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2487                             t_type, inp, stcb, net);
2488 #else
2489                         return;
2490 #endif
2491                 }
2492                 /* Only 1 tick away :-) */
2493                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2494                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
2495                 break;
2496         case SCTP_TIMER_TYPE_PRIM_DELETED:
2497                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2498 #ifdef INVARIANTS
2499                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2500                             t_type, inp, stcb, net);
2501 #else
2502                         return;
2503 #endif
2504                 }
2505                 tmr = &stcb->asoc.delete_prim_timer;
2506                 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2507                 break;
2508         default:
2509 #ifdef INVARIANTS
2510                 panic("Unknown timer type %d", t_type);
2511 #else
2512                 return;
2513 #endif
2514         }
2515         KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type));
2516         KASSERT(to_ticks > 0, ("to_ticks == 0 for timer type %d", t_type));
2517         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2518                 /*
2519                  * We do NOT allow you to have it already running. If it is,
2520                  * we leave the current one up unchanged.
2521                  */
2522                 SCTPDBG(SCTP_DEBUG_TIMER2,
2523                     "Timer type %d already running: inp=%p, stcb=%p, net=%p.\n",
2524                     t_type, inp, stcb, net);
2525                 return;
2526         }
2527         /* At this point we can proceed. */
2528         if (t_type == SCTP_TIMER_TYPE_SEND) {
2529                 stcb->asoc.num_send_timers_up++;
2530         }
2531         tmr->stopped_from = 0;
2532         tmr->type = t_type;
2533         tmr->ep = (void *)inp;
2534         tmr->tcb = (void *)stcb;
2535         if (t_type == SCTP_TIMER_TYPE_STRRESET) {
2536                 tmr->net = NULL;
2537         } else {
2538                 tmr->net = (void *)net;
2539         }
2540         tmr->self = (void *)tmr;
2541         tmr->vnet = (void *)curvnet;
2542         tmr->ticks = sctp_get_tick_count();
2543         if (SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr) == 0) {
2544                 SCTPDBG(SCTP_DEBUG_TIMER2,
2545                     "Timer type %d started: ticks=%u, inp=%p, stcb=%p, net=%p.\n",
2546                     t_type, to_ticks, inp, stcb, net);
2547                 /*
2548                  * If this is a newly scheduled callout, as opposed to a
2549                  * rescheduled one, increment relevant reference counts.
2550                  */
2551                 if (tmr->ep != NULL) {
2552                         SCTP_INP_INCR_REF(inp);
2553                 }
2554                 if (tmr->tcb != NULL) {
2555                         atomic_add_int(&stcb->asoc.refcnt, 1);
2556                 }
2557                 if (tmr->net != NULL) {
2558                         atomic_add_int(&net->ref_count, 1);
2559                 }
2560         } else {
2561                 /*
2562                  * This should not happen, since we checked for pending
2563                  * above.
2564                  */
2565                 SCTPDBG(SCTP_DEBUG_TIMER2,
2566                     "Timer type %d restarted: ticks=%u, inp=%p, stcb=%p, net=%p.\n",
2567                     t_type, to_ticks, inp, stcb, net);
2568         }
2569         return;
2570 }
2571
2572 /*-
2573  * The following table shows which parameters must be provided
2574  * when calling sctp_timer_stop(). For parameters not being
2575  * provided, NULL must be used.
2576  *
2577  * |Name                         |inp |stcb|net |
2578  * |-----------------------------|----|----|----|
2579  * |SCTP_TIMER_TYPE_SEND         |Yes |Yes |Yes |
2580  * |SCTP_TIMER_TYPE_INIT         |Yes |Yes |Yes |
2581  * |SCTP_TIMER_TYPE_RECV         |Yes |Yes |No  |
2582  * |SCTP_TIMER_TYPE_SHUTDOWN     |Yes |Yes |Yes |
2583  * |SCTP_TIMER_TYPE_HEARTBEAT    |Yes |Yes |Yes |
2584  * |SCTP_TIMER_TYPE_COOKIE       |Yes |Yes |Yes |
2585  * |SCTP_TIMER_TYPE_NEWCOOKIE    |Yes |No  |No  |
2586  * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes |
2587  * |SCTP_TIMER_TYPE_SHUTDOWNACK  |Yes |Yes |Yes |
2588  * |SCTP_TIMER_TYPE_ASCONF       |Yes |Yes |No  |
2589  * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No  |
2590  * |SCTP_TIMER_TYPE_AUTOCLOSE    |Yes |Yes |No  |
2591  * |SCTP_TIMER_TYPE_STRRESET     |Yes |Yes |No  |
2592  * |SCTP_TIMER_TYPE_INPKILL      |Yes |No  |No  |
2593  * |SCTP_TIMER_TYPE_ASOCKILL     |Yes |Yes |No  |
2594  * |SCTP_TIMER_TYPE_ADDR_WQ      |No  |No  |No  |
2595  * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No  |
2596  *
2597  */
2598
2599 void
2600 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2601     struct sctp_nets *net, uint32_t from)
2602 {
2603         struct sctp_timer *tmr;
2604
2605         KASSERT(stcb == NULL || stcb->sctp_ep == inp,
2606             ("sctp_timer_stop of type %d: inp = %p, stcb->sctp_ep %p",
2607             t_type, stcb, stcb->sctp_ep));
2608         if (stcb != NULL) {
2609                 SCTP_TCB_LOCK_ASSERT(stcb);
2610         } else if (inp != NULL) {
2611                 SCTP_INP_WLOCK_ASSERT(inp);
2612         } else {
2613                 SCTP_WQ_ADDR_LOCK_ASSERT();
2614         }
2615         tmr = NULL;
2616         switch (t_type) {
2617         case SCTP_TIMER_TYPE_SEND:
2618                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2619 #ifdef INVARIANTS
2620                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2621                             t_type, inp, stcb, net);
2622 #else
2623                         return;
2624 #endif
2625                 }
2626                 tmr = &net->rxt_timer;
2627                 break;
2628         case SCTP_TIMER_TYPE_INIT:
2629                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2630 #ifdef INVARIANTS
2631                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2632                             t_type, inp, stcb, net);
2633 #else
2634                         return;
2635 #endif
2636                 }
2637                 tmr = &net->rxt_timer;
2638                 break;
2639         case SCTP_TIMER_TYPE_RECV:
2640                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2641 #ifdef INVARIANTS
2642                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2643                             t_type, inp, stcb, net);
2644 #else
2645                         return;
2646 #endif
2647                 }
2648                 tmr = &stcb->asoc.dack_timer;
2649                 break;
2650         case SCTP_TIMER_TYPE_SHUTDOWN:
2651                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2652 #ifdef INVARIANTS
2653                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2654                             t_type, inp, stcb, net);
2655 #else
2656                         return;
2657 #endif
2658                 }
2659                 tmr = &net->rxt_timer;
2660                 break;
2661         case SCTP_TIMER_TYPE_HEARTBEAT:
2662                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2663 #ifdef INVARIANTS
2664                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2665                             t_type, inp, stcb, net);
2666 #else
2667                         return;
2668 #endif
2669                 }
2670                 tmr = &net->hb_timer;
2671                 break;
2672         case SCTP_TIMER_TYPE_COOKIE:
2673                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2674 #ifdef INVARIANTS
2675                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2676                             t_type, inp, stcb, net);
2677 #else
2678                         return;
2679 #endif
2680                 }
2681                 tmr = &net->rxt_timer;
2682                 break;
2683         case SCTP_TIMER_TYPE_NEWCOOKIE:
2684                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2685 #ifdef INVARIANTS
2686                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2687                             t_type, inp, stcb, net);
2688 #else
2689                         return;
2690 #endif
2691                 }
2692                 tmr = &inp->sctp_ep.signature_change;
2693                 break;
2694         case SCTP_TIMER_TYPE_PATHMTURAISE:
2695                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2696 #ifdef INVARIANTS
2697                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2698                             t_type, inp, stcb, net);
2699 #else
2700                         return;
2701 #endif
2702                 }
2703                 tmr = &net->pmtu_timer;
2704                 break;
2705         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2706                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2707 #ifdef INVARIANTS
2708                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2709                             t_type, inp, stcb, net);
2710 #else
2711                         return;
2712 #endif
2713                 }
2714                 tmr = &net->rxt_timer;
2715                 break;
2716         case SCTP_TIMER_TYPE_ASCONF:
2717                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2718 #ifdef INVARIANTS
2719                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2720                             t_type, inp, stcb, net);
2721 #else
2722                         return;
2723 #endif
2724                 }
2725                 tmr = &stcb->asoc.asconf_timer;
2726                 break;
2727         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2728                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2729 #ifdef INVARIANTS
2730                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2731                             t_type, inp, stcb, net);
2732 #else
2733                         return;
2734 #endif
2735                 }
2736                 tmr = &stcb->asoc.shut_guard_timer;
2737                 break;
2738         case SCTP_TIMER_TYPE_AUTOCLOSE:
2739                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2740 #ifdef INVARIANTS
2741                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2742                             t_type, inp, stcb, net);
2743 #else
2744                         return;
2745 #endif
2746                 }
2747                 tmr = &stcb->asoc.autoclose_timer;
2748                 break;
2749         case SCTP_TIMER_TYPE_STRRESET:
2750                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2751 #ifdef INVARIANTS
2752                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2753                             t_type, inp, stcb, net);
2754 #else
2755                         return;
2756 #endif
2757                 }
2758                 tmr = &stcb->asoc.strreset_timer;
2759                 break;
2760         case SCTP_TIMER_TYPE_INPKILL:
2761                 /*
2762                  * The inp is setup to die. We re-use the signature_chage
2763                  * timer since that has stopped and we are in the GONE
2764                  * state.
2765                  */
2766                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2767 #ifdef INVARIANTS
2768                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2769                             t_type, inp, stcb, net);
2770 #else
2771                         return;
2772 #endif
2773                 }
2774                 tmr = &inp->sctp_ep.signature_change;
2775                 break;
2776         case SCTP_TIMER_TYPE_ASOCKILL:
2777                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2778 #ifdef INVARIANTS
2779                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2780                             t_type, inp, stcb, net);
2781 #else
2782                         return;
2783 #endif
2784                 }
2785                 tmr = &stcb->asoc.strreset_timer;
2786                 break;
2787         case SCTP_TIMER_TYPE_ADDR_WQ:
2788                 if ((inp != NULL) || (stcb != NULL) || (net != NULL)) {
2789 #ifdef INVARIANTS
2790                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2791                             t_type, inp, stcb, net);
2792 #else
2793                         return;
2794 #endif
2795                 }
2796                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2797                 break;
2798         case SCTP_TIMER_TYPE_PRIM_DELETED:
2799                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2800 #ifdef INVARIANTS
2801                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2802                             t_type, inp, stcb, net);
2803 #else
2804                         return;
2805 #endif
2806                 }
2807                 tmr = &stcb->asoc.delete_prim_timer;
2808                 break;
2809         default:
2810 #ifdef INVARIANTS
2811                 panic("Unknown timer type %d", t_type);
2812 #else
2813                 return;
2814 #endif
2815         }
2816         KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type));
2817         if ((tmr->type != SCTP_TIMER_TYPE_NONE) &&
2818             (tmr->type != t_type)) {
2819                 /*
2820                  * Ok we have a timer that is under joint use. Cookie timer
2821                  * per chance with the SEND timer. We therefore are NOT
2822                  * running the timer that the caller wants stopped.  So just
2823                  * return.
2824                  */
2825                 SCTPDBG(SCTP_DEBUG_TIMER2,
2826                     "Shared timer type %d not running: inp=%p, stcb=%p, net=%p.\n",
2827                     t_type, inp, stcb, net);
2828                 return;
2829         }
2830         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2831                 stcb->asoc.num_send_timers_up--;
2832                 if (stcb->asoc.num_send_timers_up < 0) {
2833                         stcb->asoc.num_send_timers_up = 0;
2834                 }
2835         }
2836         tmr->self = NULL;
2837         tmr->stopped_from = from;
2838         if (SCTP_OS_TIMER_STOP(&tmr->timer) == 1) {
2839                 KASSERT(tmr->ep == inp,
2840                     ("sctp_timer_stop of type %d: inp = %p, tmr->inp = %p",
2841                     t_type, inp, tmr->ep));
2842                 KASSERT(tmr->tcb == stcb,
2843                     ("sctp_timer_stop of type %d: stcb = %p, tmr->stcb = %p",
2844                     t_type, stcb, tmr->tcb));
2845                 KASSERT(((t_type == SCTP_TIMER_TYPE_ASCONF) && (tmr->net != NULL)) ||
2846                     ((t_type != SCTP_TIMER_TYPE_ASCONF) && (tmr->net == net)),
2847                     ("sctp_timer_stop of type %d: net = %p, tmr->net = %p",
2848                     t_type, net, tmr->net));
2849                 SCTPDBG(SCTP_DEBUG_TIMER2,
2850                     "Timer type %d stopped: inp=%p, stcb=%p, net=%p.\n",
2851                     t_type, inp, stcb, net);
2852                 /*
2853                  * If the timer was actually stopped, decrement reference
2854                  * counts that were incremented in sctp_timer_start().
2855                  */
2856                 if (tmr->ep != NULL) {
2857                         SCTP_INP_DECR_REF(inp);
2858                         tmr->ep = NULL;
2859                 }
2860                 if (tmr->tcb != NULL) {
2861                         atomic_add_int(&stcb->asoc.refcnt, -1);
2862                         tmr->tcb = NULL;
2863                 }
2864                 if (tmr->net != NULL) {
2865                         /*
2866                          * Can't use net, since it doesn't work for
2867                          * SCTP_TIMER_TYPE_ASCONF.
2868                          */
2869                         sctp_free_remote_addr((struct sctp_nets *)tmr->net);
2870                         tmr->net = NULL;
2871                 }
2872         } else {
2873                 SCTPDBG(SCTP_DEBUG_TIMER2,
2874                     "Timer type %d not stopped: inp=%p, stcb=%p, net=%p.\n",
2875                     t_type, inp, stcb, net);
2876         }
2877         return;
2878 }
2879
2880 uint32_t
2881 sctp_calculate_len(struct mbuf *m)
2882 {
2883         uint32_t tlen = 0;
2884         struct mbuf *at;
2885
2886         at = m;
2887         while (at) {
2888                 tlen += SCTP_BUF_LEN(at);
2889                 at = SCTP_BUF_NEXT(at);
2890         }
2891         return (tlen);
2892 }
2893
2894 void
2895 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2896     struct sctp_association *asoc, uint32_t mtu)
2897 {
2898         /*
2899          * Reset the P-MTU size on this association, this involves changing
2900          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2901          * allow the DF flag to be cleared.
2902          */
2903         struct sctp_tmit_chunk *chk;
2904         unsigned int eff_mtu, ovh;
2905
2906         asoc->smallest_mtu = mtu;
2907         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2908                 ovh = SCTP_MIN_OVERHEAD;
2909         } else {
2910                 ovh = SCTP_MIN_V4_OVERHEAD;
2911         }
2912         eff_mtu = mtu - ovh;
2913         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2914                 if (chk->send_size > eff_mtu) {
2915                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2916                 }
2917         }
2918         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2919                 if (chk->send_size > eff_mtu) {
2920                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2921                 }
2922         }
2923 }
2924
2925 /*
2926  * Given an association and starting time of the current RTT period, update
2927  * RTO in number of msecs. net should point to the current network.
2928  * Return 1, if an RTO update was performed, return 0 if no update was
2929  * performed due to invalid starting point.
2930  */
2931
2932 int
2933 sctp_calculate_rto(struct sctp_tcb *stcb,
2934     struct sctp_association *asoc,
2935     struct sctp_nets *net,
2936     struct timeval *old,
2937     int rtt_from_sack)
2938 {
2939         struct timeval now;
2940         uint64_t rtt_us;        /* RTT in us */
2941         int32_t rtt;            /* RTT in ms */
2942         uint32_t new_rto;
2943         int first_measure = 0;
2944
2945         /************************/
2946         /* 1. calculate new RTT */
2947         /************************/
2948         /* get the current time */
2949         if (stcb->asoc.use_precise_time) {
2950                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2951         } else {
2952                 (void)SCTP_GETTIME_TIMEVAL(&now);
2953         }
2954         if ((old->tv_sec > now.tv_sec) ||
2955             ((old->tv_sec == now.tv_sec) && (old->tv_usec > now.tv_usec))) {
2956                 /* The starting point is in the future. */
2957                 return (0);
2958         }
2959         timevalsub(&now, old);
2960         rtt_us = (uint64_t)1000000 * (uint64_t)now.tv_sec + (uint64_t)now.tv_usec;
2961         if (rtt_us > SCTP_RTO_UPPER_BOUND * 1000) {
2962                 /* The RTT is larger than a sane value. */
2963                 return (0);
2964         }
2965         /* store the current RTT in us */
2966         net->rtt = rtt_us;
2967         /* compute rtt in ms */
2968         rtt = (int32_t)(net->rtt / 1000);
2969         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2970                 /*
2971                  * Tell the CC module that a new update has just occurred
2972                  * from a sack
2973                  */
2974                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2975         }
2976         /*
2977          * Do we need to determine the lan? We do this only on sacks i.e.
2978          * RTT being determined from data not non-data (HB/INIT->INITACK).
2979          */
2980         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2981             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2982                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2983                         net->lan_type = SCTP_LAN_INTERNET;
2984                 } else {
2985                         net->lan_type = SCTP_LAN_LOCAL;
2986                 }
2987         }
2988
2989         /***************************/
2990         /* 2. update RTTVAR & SRTT */
2991         /***************************/
2992         /*-
2993          * Compute the scaled average lastsa and the
2994          * scaled variance lastsv as described in van Jacobson
2995          * Paper "Congestion Avoidance and Control", Annex A.
2996          *
2997          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2998          * (net->lastsv >> SCTP_RTT_VAR_SHIFT) is the rttvar
2999          */
3000         if (net->RTO_measured) {
3001                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
3002                 net->lastsa += rtt;
3003                 if (rtt < 0) {
3004                         rtt = -rtt;
3005                 }
3006                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
3007                 net->lastsv += rtt;
3008                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
3009                         rto_logging(net, SCTP_LOG_RTTVAR);
3010                 }
3011         } else {
3012                 /* First RTO measurment */
3013                 net->RTO_measured = 1;
3014                 first_measure = 1;
3015                 net->lastsa = rtt << SCTP_RTT_SHIFT;
3016                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
3017                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
3018                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
3019                 }
3020         }
3021         if (net->lastsv == 0) {
3022                 net->lastsv = SCTP_CLOCK_GRANULARITY;
3023         }
3024         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
3025         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
3026             (stcb->asoc.sat_network_lockout == 0)) {
3027                 stcb->asoc.sat_network = 1;
3028         } else if ((!first_measure) && stcb->asoc.sat_network) {
3029                 stcb->asoc.sat_network = 0;
3030                 stcb->asoc.sat_network_lockout = 1;
3031         }
3032         /* bound it, per C6/C7 in Section 5.3.1 */
3033         if (new_rto < stcb->asoc.minrto) {
3034                 new_rto = stcb->asoc.minrto;
3035         }
3036         if (new_rto > stcb->asoc.maxrto) {
3037                 new_rto = stcb->asoc.maxrto;
3038         }
3039         net->RTO = new_rto;
3040         return (1);
3041 }
3042
3043 /*
3044  * return a pointer to a contiguous piece of data from the given mbuf chain
3045  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
3046  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
3047  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
3048  */
3049 caddr_t
3050 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr)
3051 {
3052         uint32_t count;
3053         uint8_t *ptr;
3054
3055         ptr = in_ptr;
3056         if ((off < 0) || (len <= 0))
3057                 return (NULL);
3058
3059         /* find the desired start location */
3060         while ((m != NULL) && (off > 0)) {
3061                 if (off < SCTP_BUF_LEN(m))
3062                         break;
3063                 off -= SCTP_BUF_LEN(m);
3064                 m = SCTP_BUF_NEXT(m);
3065         }
3066         if (m == NULL)
3067                 return (NULL);
3068
3069         /* is the current mbuf large enough (eg. contiguous)? */
3070         if ((SCTP_BUF_LEN(m) - off) >= len) {
3071                 return (mtod(m, caddr_t)+off);
3072         } else {
3073                 /* else, it spans more than one mbuf, so save a temp copy... */
3074                 while ((m != NULL) && (len > 0)) {
3075                         count = min(SCTP_BUF_LEN(m) - off, len);
3076                         memcpy(ptr, mtod(m, caddr_t)+off, count);
3077                         len -= count;
3078                         ptr += count;
3079                         off = 0;
3080                         m = SCTP_BUF_NEXT(m);
3081                 }
3082                 if ((m == NULL) && (len > 0))
3083                         return (NULL);
3084                 else
3085                         return ((caddr_t)in_ptr);
3086         }
3087 }
3088
3089 struct sctp_paramhdr *
3090 sctp_get_next_param(struct mbuf *m,
3091     int offset,
3092     struct sctp_paramhdr *pull,
3093     int pull_limit)
3094 {
3095         /* This just provides a typed signature to Peter's Pull routine */
3096         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
3097             (uint8_t *)pull));
3098 }
3099
3100 struct mbuf *
3101 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
3102 {
3103         struct mbuf *m_last;
3104         caddr_t dp;
3105
3106         if (padlen > 3) {
3107                 return (NULL);
3108         }
3109         if (padlen <= M_TRAILINGSPACE(m)) {
3110                 /*
3111                  * The easy way. We hope the majority of the time we hit
3112                  * here :)
3113                  */
3114                 m_last = m;
3115         } else {
3116                 /* Hard way we must grow the mbuf chain */
3117                 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
3118                 if (m_last == NULL) {
3119                         return (NULL);
3120                 }
3121                 SCTP_BUF_LEN(m_last) = 0;
3122                 SCTP_BUF_NEXT(m_last) = NULL;
3123                 SCTP_BUF_NEXT(m) = m_last;
3124         }
3125         dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
3126         SCTP_BUF_LEN(m_last) += padlen;
3127         memset(dp, 0, padlen);
3128         return (m_last);
3129 }
3130
3131 struct mbuf *
3132 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
3133 {
3134         /* find the last mbuf in chain and pad it */
3135         struct mbuf *m_at;
3136
3137         if (last_mbuf != NULL) {
3138                 return (sctp_add_pad_tombuf(last_mbuf, padval));
3139         } else {
3140                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
3141                         if (SCTP_BUF_NEXT(m_at) == NULL) {
3142                                 return (sctp_add_pad_tombuf(m_at, padval));
3143                         }
3144                 }
3145         }
3146         return (NULL);
3147 }
3148
3149 static void
3150 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
3151     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked)
3152 {
3153         struct mbuf *m_notify;
3154         struct sctp_assoc_change *sac;
3155         struct sctp_queued_to_read *control;
3156         unsigned int notif_len;
3157         uint16_t abort_len;
3158         unsigned int i;
3159
3160         if (stcb == NULL) {
3161                 return;
3162         }
3163         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
3164                 notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
3165                 if (abort != NULL) {
3166                         abort_len = ntohs(abort->ch.chunk_length);
3167                         /*
3168                          * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
3169                          * contiguous.
3170                          */
3171                         if (abort_len > SCTP_CHUNK_BUFFER_SIZE) {
3172                                 abort_len = SCTP_CHUNK_BUFFER_SIZE;
3173                         }
3174                 } else {
3175                         abort_len = 0;
3176                 }
3177                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
3178                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
3179                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
3180                         notif_len += abort_len;
3181                 }
3182                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3183                 if (m_notify == NULL) {
3184                         /* Retry with smaller value. */
3185                         notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
3186                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3187                         if (m_notify == NULL) {
3188                                 goto set_error;
3189                         }
3190                 }
3191                 SCTP_BUF_NEXT(m_notify) = NULL;
3192                 sac = mtod(m_notify, struct sctp_assoc_change *);
3193                 memset(sac, 0, notif_len);
3194                 sac->sac_type = SCTP_ASSOC_CHANGE;
3195                 sac->sac_flags = 0;
3196                 sac->sac_length = sizeof(struct sctp_assoc_change);
3197                 sac->sac_state = state;
3198                 sac->sac_error = error;
3199                 /* XXX verify these stream counts */
3200                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
3201                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
3202                 sac->sac_assoc_id = sctp_get_associd(stcb);
3203                 if (notif_len > sizeof(struct sctp_assoc_change)) {
3204                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
3205                                 i = 0;
3206                                 if (stcb->asoc.prsctp_supported == 1) {
3207                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
3208                                 }
3209                                 if (stcb->asoc.auth_supported == 1) {
3210                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
3211                                 }
3212                                 if (stcb->asoc.asconf_supported == 1) {
3213                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
3214                                 }
3215                                 if (stcb->asoc.idata_supported == 1) {
3216                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING;
3217                                 }
3218                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
3219                                 if (stcb->asoc.reconfig_supported == 1) {
3220                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
3221                                 }
3222                                 sac->sac_length += i;
3223                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
3224                                 memcpy(sac->sac_info, abort, abort_len);
3225                                 sac->sac_length += abort_len;
3226                         }
3227                 }
3228                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
3229                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3230                     0, 0, stcb->asoc.context, 0, 0, 0,
3231                     m_notify);
3232                 if (control != NULL) {
3233                         control->length = SCTP_BUF_LEN(m_notify);
3234                         control->spec_flags = M_NOTIFICATION;
3235                         /* not that we need this */
3236                         control->tail_mbuf = m_notify;
3237                         sctp_add_to_readq(stcb->sctp_ep, stcb,
3238                             control,
3239                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
3240                             so_locked);
3241                 } else {
3242                         sctp_m_freem(m_notify);
3243                 }
3244         }
3245         /*
3246          * For 1-to-1 style sockets, we send up and error when an ABORT
3247          * comes in.
3248          */
3249 set_error:
3250         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3251             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
3252             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
3253                 SOCK_LOCK(stcb->sctp_socket);
3254                 if (from_peer) {
3255                         if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {
3256                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
3257                                 stcb->sctp_socket->so_error = ECONNREFUSED;
3258                         } else {
3259                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
3260                                 stcb->sctp_socket->so_error = ECONNRESET;
3261                         }
3262                 } else {
3263                         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
3264                             (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
3265                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
3266                                 stcb->sctp_socket->so_error = ETIMEDOUT;
3267                         } else {
3268                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
3269                                 stcb->sctp_socket->so_error = ECONNABORTED;
3270                         }
3271                 }
3272                 SOCK_UNLOCK(stcb->sctp_socket);
3273         }
3274         /* Wake ANY sleepers */
3275         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3276             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
3277             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
3278                 socantrcvmore(stcb->sctp_socket);
3279         }
3280         sorwakeup(stcb->sctp_socket);
3281         sowwakeup(stcb->sctp_socket);
3282 }
3283
3284 static void
3285 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
3286     struct sockaddr *sa, uint32_t error, int so_locked)
3287 {
3288         struct mbuf *m_notify;
3289         struct sctp_paddr_change *spc;
3290         struct sctp_queued_to_read *control;
3291
3292         if ((stcb == NULL) ||
3293             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
3294                 /* event not enabled */
3295                 return;
3296         }
3297         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
3298         if (m_notify == NULL)
3299                 return;
3300         SCTP_BUF_LEN(m_notify) = 0;
3301         spc = mtod(m_notify, struct sctp_paddr_change *);
3302         memset(spc, 0, sizeof(struct sctp_paddr_change));
3303         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
3304         spc->spc_flags = 0;
3305         spc->spc_length = sizeof(struct sctp_paddr_change);
3306         switch (sa->sa_family) {
3307 #ifdef INET
3308         case AF_INET:
3309 #ifdef INET6
3310                 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
3311                         in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
3312                             (struct sockaddr_in6 *)&spc->spc_aaddr);
3313                 } else {
3314                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
3315                 }
3316 #else
3317                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
3318 #endif
3319                 break;
3320 #endif
3321 #ifdef INET6
3322         case AF_INET6:
3323                 {
3324                         struct sockaddr_in6 *sin6;
3325
3326                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
3327
3328                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
3329                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
3330                                 if (sin6->sin6_scope_id == 0) {
3331                                         /* recover scope_id for user */
3332                                         (void)sa6_recoverscope(sin6);
3333                                 } else {
3334                                         /* clear embedded scope_id for user */
3335                                         in6_clearscope(&sin6->sin6_addr);
3336                                 }
3337                         }
3338                         break;
3339                 }
3340 #endif
3341         default:
3342                 /* TSNH */
3343                 break;
3344         }
3345         spc->spc_state = state;
3346         spc->spc_error = error;
3347         spc->spc_assoc_id = sctp_get_associd(stcb);
3348
3349         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
3350         SCTP_BUF_NEXT(m_notify) = NULL;
3351
3352         /* append to socket */
3353         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3354             0, 0, stcb->asoc.context, 0, 0, 0,
3355             m_notify);
3356         if (control == NULL) {
3357                 /* no memory */
3358                 sctp_m_freem(m_notify);
3359                 return;
3360         }
3361         control->length = SCTP_BUF_LEN(m_notify);
3362         control->spec_flags = M_NOTIFICATION;
3363         /* not that we need this */
3364         control->tail_mbuf = m_notify;
3365         sctp_add_to_readq(stcb->sctp_ep, stcb,
3366             control,
3367             &stcb->sctp_socket->so_rcv, 1,
3368             SCTP_READ_LOCK_NOT_HELD,
3369             so_locked);
3370 }
3371
3372 static void
3373 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
3374     struct sctp_tmit_chunk *chk, int so_locked)
3375 {
3376         struct mbuf *m_notify;
3377         struct sctp_send_failed *ssf;
3378         struct sctp_send_failed_event *ssfe;
3379         struct sctp_queued_to_read *control;
3380         struct sctp_chunkhdr *chkhdr;
3381         int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len;
3382
3383         if ((stcb == NULL) ||
3384             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3385             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3386                 /* event not enabled */
3387                 return;
3388         }
3389
3390         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3391                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3392         } else {
3393                 notifhdr_len = sizeof(struct sctp_send_failed);
3394         }
3395         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3396         if (m_notify == NULL)
3397                 /* no space left */
3398                 return;
3399         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3400         if (stcb->asoc.idata_supported) {
3401                 chkhdr_len = sizeof(struct sctp_idata_chunk);
3402         } else {
3403                 chkhdr_len = sizeof(struct sctp_data_chunk);
3404         }
3405         /* Use some defaults in case we can't access the chunk header */
3406         if (chk->send_size >= chkhdr_len) {
3407                 payload_len = chk->send_size - chkhdr_len;
3408         } else {
3409                 payload_len = 0;
3410         }
3411         padding_len = 0;
3412         if (chk->data != NULL) {
3413                 chkhdr = mtod(chk->data, struct sctp_chunkhdr *);
3414                 if (chkhdr != NULL) {
3415                         chk_len = ntohs(chkhdr->chunk_length);
3416                         if ((chk_len >= chkhdr_len) &&
3417                             (chk->send_size >= chk_len) &&
3418                             (chk->send_size - chk_len < 4)) {
3419                                 padding_len = chk->send_size - chk_len;
3420                                 payload_len = chk->send_size - chkhdr_len - padding_len;
3421                         }
3422                 }
3423         }
3424         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3425                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3426                 memset(ssfe, 0, notifhdr_len);
3427                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3428                 if (sent) {
3429                         ssfe->ssfe_flags = SCTP_DATA_SENT;
3430                 } else {
3431                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3432                 }
3433                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len);
3434                 ssfe->ssfe_error = error;
3435                 /* not exactly what the user sent in, but should be close :) */
3436                 ssfe->ssfe_info.snd_sid = chk->rec.data.sid;
3437                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
3438                 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid;
3439                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
3440                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3441                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3442         } else {
3443                 ssf = mtod(m_notify, struct sctp_send_failed *);
3444                 memset(ssf, 0, notifhdr_len);
3445                 ssf->ssf_type = SCTP_SEND_FAILED;
3446                 if (sent) {
3447                         ssf->ssf_flags = SCTP_DATA_SENT;
3448                 } else {
3449                         ssf->ssf_flags = SCTP_DATA_UNSENT;
3450                 }
3451                 ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len);
3452                 ssf->ssf_error = error;
3453                 /* not exactly what the user sent in, but should be close :) */
3454                 ssf->ssf_info.sinfo_stream = chk->rec.data.sid;
3455                 ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid;
3456                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
3457                 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid;
3458                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
3459                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3460                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3461         }
3462         if (chk->data != NULL) {
3463                 /* Trim off the sctp chunk header (it should be there) */
3464                 if (chk->send_size == chkhdr_len + payload_len + padding_len) {
3465                         m_adj(chk->data, chkhdr_len);
3466                         m_adj(chk->data, -padding_len);
3467                         sctp_mbuf_crush(chk->data);
3468                         chk->send_size -= (chkhdr_len + padding_len);
3469                 }
3470         }
3471         SCTP_BUF_NEXT(m_notify) = chk->data;
3472         /* Steal off the mbuf */
3473         chk->data = NULL;
3474         /*
3475          * For this case, we check the actual socket buffer, since the assoc
3476          * is going away we don't want to overfill the socket buffer for a
3477          * non-reader
3478          */
3479         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3480                 sctp_m_freem(m_notify);
3481                 return;
3482         }
3483         /* append to socket */
3484         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3485             0, 0, stcb->asoc.context, 0, 0, 0,
3486             m_notify);
3487         if (control == NULL) {
3488                 /* no memory */
3489                 sctp_m_freem(m_notify);
3490                 return;
3491         }
3492         control->length = SCTP_BUF_LEN(m_notify);
3493         control->spec_flags = M_NOTIFICATION;
3494         /* not that we need this */
3495         control->tail_mbuf = m_notify;
3496         sctp_add_to_readq(stcb->sctp_ep, stcb,
3497             control,
3498             &stcb->sctp_socket->so_rcv, 1,
3499             SCTP_READ_LOCK_NOT_HELD,
3500             so_locked);
3501 }
3502
3503 static void
3504 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3505     struct sctp_stream_queue_pending *sp, int so_locked)
3506 {
3507         struct mbuf *m_notify;
3508         struct sctp_send_failed *ssf;
3509         struct sctp_send_failed_event *ssfe;
3510         struct sctp_queued_to_read *control;
3511         int notifhdr_len;
3512
3513         if ((stcb == NULL) ||
3514             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3515             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3516                 /* event not enabled */
3517                 return;
3518         }
3519         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3520                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3521         } else {
3522                 notifhdr_len = sizeof(struct sctp_send_failed);
3523         }
3524         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3525         if (m_notify == NULL) {
3526                 /* no space left */
3527                 return;
3528         }
3529         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3530         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3531                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3532                 memset(ssfe, 0, notifhdr_len);
3533                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3534                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3535                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length);
3536                 ssfe->ssfe_error = error;
3537                 /* not exactly what the user sent in, but should be close :) */
3538                 ssfe->ssfe_info.snd_sid = sp->sid;
3539                 if (sp->some_taken) {
3540                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
3541                 } else {
3542                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
3543                 }
3544                 ssfe->ssfe_info.snd_ppid = sp->ppid;
3545                 ssfe->ssfe_info.snd_context = sp->context;
3546                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3547                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3548         } else {
3549                 ssf = mtod(m_notify, struct sctp_send_failed *);
3550                 memset(ssf, 0, notifhdr_len);
3551                 ssf->ssf_type = SCTP_SEND_FAILED;
3552                 ssf->ssf_flags = SCTP_DATA_UNSENT;
3553                 ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length);
3554                 ssf->ssf_error = error;
3555                 /* not exactly what the user sent in, but should be close :) */
3556                 ssf->ssf_info.sinfo_stream = sp->sid;
3557                 ssf->ssf_info.sinfo_ssn = 0;
3558                 if (sp->some_taken) {
3559                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3560                 } else {
3561                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3562                 }
3563                 ssf->ssf_info.sinfo_ppid = sp->ppid;
3564                 ssf->ssf_info.sinfo_context = sp->context;
3565                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3566                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3567         }
3568         SCTP_BUF_NEXT(m_notify) = sp->data;
3569
3570         /* Steal off the mbuf */
3571         sp->data = NULL;
3572         /*
3573          * For this case, we check the actual socket buffer, since the assoc
3574          * is going away we don't want to overfill the socket buffer for a
3575          * non-reader
3576          */
3577         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3578                 sctp_m_freem(m_notify);
3579                 return;
3580         }
3581         /* append to socket */
3582         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3583             0, 0, stcb->asoc.context, 0, 0, 0,
3584             m_notify);
3585         if (control == NULL) {
3586                 /* no memory */
3587                 sctp_m_freem(m_notify);
3588                 return;
3589         }
3590         control->length = SCTP_BUF_LEN(m_notify);
3591         control->spec_flags = M_NOTIFICATION;
3592         /* not that we need this */
3593         control->tail_mbuf = m_notify;
3594         sctp_add_to_readq(stcb->sctp_ep, stcb,
3595             control,
3596             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3597 }
3598
3599 static void
3600 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3601 {
3602         struct mbuf *m_notify;
3603         struct sctp_adaptation_event *sai;
3604         struct sctp_queued_to_read *control;
3605
3606         if ((stcb == NULL) ||
3607             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3608                 /* event not enabled */
3609                 return;
3610         }
3611
3612         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3613         if (m_notify == NULL)
3614                 /* no space left */
3615                 return;
3616         SCTP_BUF_LEN(m_notify) = 0;
3617         sai = mtod(m_notify, struct sctp_adaptation_event *);
3618         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3619         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3620         sai->sai_flags = 0;
3621         sai->sai_length = sizeof(struct sctp_adaptation_event);
3622         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3623         sai->sai_assoc_id = sctp_get_associd(stcb);
3624
3625         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3626         SCTP_BUF_NEXT(m_notify) = NULL;
3627
3628         /* append to socket */
3629         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3630             0, 0, stcb->asoc.context, 0, 0, 0,
3631             m_notify);
3632         if (control == NULL) {
3633                 /* no memory */
3634                 sctp_m_freem(m_notify);
3635                 return;
3636         }
3637         control->length = SCTP_BUF_LEN(m_notify);
3638         control->spec_flags = M_NOTIFICATION;
3639         /* not that we need this */
3640         control->tail_mbuf = m_notify;
3641         sctp_add_to_readq(stcb->sctp_ep, stcb,
3642             control,
3643             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3644 }
3645
3646 /* This always must be called with the read-queue LOCKED in the INP */
3647 static void
3648 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3649     uint32_t val, int so_locked)
3650 {
3651         struct mbuf *m_notify;
3652         struct sctp_pdapi_event *pdapi;
3653         struct sctp_queued_to_read *control;
3654         struct sockbuf *sb;
3655
3656         if ((stcb == NULL) ||
3657             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3658                 /* event not enabled */
3659                 return;
3660         }
3661         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3662                 return;
3663         }
3664
3665         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3666         if (m_notify == NULL)
3667                 /* no space left */
3668                 return;
3669         SCTP_BUF_LEN(m_notify) = 0;
3670         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3671         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3672         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3673         pdapi->pdapi_flags = 0;
3674         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3675         pdapi->pdapi_indication = error;
3676         pdapi->pdapi_stream = (val >> 16);
3677         pdapi->pdapi_seq = (val & 0x0000ffff);
3678         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3679
3680         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3681         SCTP_BUF_NEXT(m_notify) = NULL;
3682         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3683             0, 0, stcb->asoc.context, 0, 0, 0,
3684             m_notify);
3685         if (control == NULL) {
3686                 /* no memory */
3687                 sctp_m_freem(m_notify);
3688                 return;
3689         }
3690         control->length = SCTP_BUF_LEN(m_notify);
3691         control->spec_flags = M_NOTIFICATION;
3692         /* not that we need this */
3693         control->tail_mbuf = m_notify;
3694         sb = &stcb->sctp_socket->so_rcv;
3695         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3696                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3697         }
3698         sctp_sballoc(stcb, sb, m_notify);
3699         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3700                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3701         }
3702         control->end_added = 1;
3703         if (stcb->asoc.control_pdapi)
3704                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3705         else {
3706                 /* we really should not see this case */
3707                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3708         }
3709         if (stcb->sctp_ep && stcb->sctp_socket) {
3710                 /* This should always be the case */
3711                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3712         }
3713 }
3714
3715 static void
3716 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3717 {
3718         struct mbuf *m_notify;
3719         struct sctp_shutdown_event *sse;
3720         struct sctp_queued_to_read *control;
3721
3722         /*
3723          * For TCP model AND UDP connected sockets we will send an error up
3724          * when an SHUTDOWN completes
3725          */
3726         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3727             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3728                 /* mark socket closed for read/write and wakeup! */
3729                 socantsendmore(stcb->sctp_socket);
3730         }
3731         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3732                 /* event not enabled */
3733                 return;
3734         }
3735
3736         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3737         if (m_notify == NULL)
3738                 /* no space left */
3739                 return;
3740         sse = mtod(m_notify, struct sctp_shutdown_event *);
3741         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3742         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3743         sse->sse_flags = 0;
3744         sse->sse_length = sizeof(struct sctp_shutdown_event);
3745         sse->sse_assoc_id = sctp_get_associd(stcb);
3746
3747         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3748         SCTP_BUF_NEXT(m_notify) = NULL;
3749
3750         /* append to socket */
3751         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3752             0, 0, stcb->asoc.context, 0, 0, 0,
3753             m_notify);
3754         if (control == NULL) {
3755                 /* no memory */
3756                 sctp_m_freem(m_notify);
3757                 return;
3758         }
3759         control->length = SCTP_BUF_LEN(m_notify);
3760         control->spec_flags = M_NOTIFICATION;
3761         /* not that we need this */
3762         control->tail_mbuf = m_notify;
3763         sctp_add_to_readq(stcb->sctp_ep, stcb,
3764             control,
3765             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3766 }
3767
3768 static void
3769 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3770     int so_locked)
3771 {
3772         struct mbuf *m_notify;
3773         struct sctp_sender_dry_event *event;
3774         struct sctp_queued_to_read *control;
3775
3776         if ((stcb == NULL) ||
3777             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3778                 /* event not enabled */
3779                 return;
3780         }
3781
3782         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3783         if (m_notify == NULL) {
3784                 /* no space left */
3785                 return;
3786         }
3787         SCTP_BUF_LEN(m_notify) = 0;
3788         event = mtod(m_notify, struct sctp_sender_dry_event *);
3789         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3790         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3791         event->sender_dry_flags = 0;
3792         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3793         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3794
3795         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3796         SCTP_BUF_NEXT(m_notify) = NULL;
3797
3798         /* append to socket */
3799         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3800             0, 0, stcb->asoc.context, 0, 0, 0,
3801             m_notify);
3802         if (control == NULL) {
3803                 /* no memory */
3804                 sctp_m_freem(m_notify);
3805                 return;
3806         }
3807         control->length = SCTP_BUF_LEN(m_notify);
3808         control->spec_flags = M_NOTIFICATION;
3809         /* not that we need this */
3810         control->tail_mbuf = m_notify;
3811         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3812             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3813 }
3814
3815 void
3816 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3817 {
3818         struct mbuf *m_notify;
3819         struct sctp_queued_to_read *control;
3820         struct sctp_stream_change_event *stradd;
3821
3822         if ((stcb == NULL) ||
3823             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3824                 /* event not enabled */
3825                 return;
3826         }
3827         if ((stcb->asoc.peer_req_out) && flag) {
3828                 /* Peer made the request, don't tell the local user */
3829                 stcb->asoc.peer_req_out = 0;
3830                 return;
3831         }
3832         stcb->asoc.peer_req_out = 0;
3833         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3834         if (m_notify == NULL)
3835                 /* no space left */
3836                 return;
3837         SCTP_BUF_LEN(m_notify) = 0;
3838         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3839         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3840         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3841         stradd->strchange_flags = flag;
3842         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3843         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3844         stradd->strchange_instrms = numberin;
3845         stradd->strchange_outstrms = numberout;
3846         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3847         SCTP_BUF_NEXT(m_notify) = NULL;
3848         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3849                 /* no space */
3850                 sctp_m_freem(m_notify);
3851                 return;
3852         }
3853         /* append to socket */
3854         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3855             0, 0, stcb->asoc.context, 0, 0, 0,
3856             m_notify);
3857         if (control == NULL) {
3858                 /* no memory */
3859                 sctp_m_freem(m_notify);
3860                 return;
3861         }
3862         control->length = SCTP_BUF_LEN(m_notify);
3863         control->spec_flags = M_NOTIFICATION;
3864         /* not that we need this */
3865         control->tail_mbuf = m_notify;
3866         sctp_add_to_readq(stcb->sctp_ep, stcb,
3867             control,
3868             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3869 }
3870
3871 void
3872 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3873 {
3874         struct mbuf *m_notify;
3875         struct sctp_queued_to_read *control;
3876         struct sctp_assoc_reset_event *strasoc;
3877
3878         if ((stcb == NULL) ||
3879             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3880                 /* event not enabled */
3881                 return;
3882         }
3883         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3884         if (m_notify == NULL)
3885                 /* no space left */
3886                 return;
3887         SCTP_BUF_LEN(m_notify) = 0;
3888         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3889         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3890         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3891         strasoc->assocreset_flags = flag;
3892         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3893         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3894         strasoc->assocreset_local_tsn = sending_tsn;
3895         strasoc->assocreset_remote_tsn = recv_tsn;
3896         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3897         SCTP_BUF_NEXT(m_notify) = NULL;
3898         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3899                 /* no space */
3900                 sctp_m_freem(m_notify);
3901                 return;
3902         }
3903         /* append to socket */
3904         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3905             0, 0, stcb->asoc.context, 0, 0, 0,
3906             m_notify);
3907         if (control == NULL) {
3908                 /* no memory */
3909                 sctp_m_freem(m_notify);
3910                 return;
3911         }
3912         control->length = SCTP_BUF_LEN(m_notify);
3913         control->spec_flags = M_NOTIFICATION;
3914         /* not that we need this */
3915         control->tail_mbuf = m_notify;
3916         sctp_add_to_readq(stcb->sctp_ep, stcb,
3917             control,
3918             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3919 }
3920
3921 static void
3922 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3923     int number_entries, uint16_t *list, int flag)
3924 {
3925         struct mbuf *m_notify;
3926         struct sctp_queued_to_read *control;
3927         struct sctp_stream_reset_event *strreset;
3928         int len;
3929
3930         if ((stcb == NULL) ||
3931             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3932                 /* event not enabled */
3933                 return;
3934         }
3935
3936         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3937         if (m_notify == NULL)
3938                 /* no space left */
3939                 return;
3940         SCTP_BUF_LEN(m_notify) = 0;
3941         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3942         if (len > M_TRAILINGSPACE(m_notify)) {
3943                 /* never enough room */
3944                 sctp_m_freem(m_notify);
3945                 return;
3946         }
3947         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3948         memset(strreset, 0, len);
3949         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3950         strreset->strreset_flags = flag;
3951         strreset->strreset_length = len;
3952         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3953         if (number_entries) {
3954                 int i;
3955
3956                 for (i = 0; i < number_entries; i++) {
3957                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3958                 }
3959         }
3960         SCTP_BUF_LEN(m_notify) = len;
3961         SCTP_BUF_NEXT(m_notify) = NULL;
3962         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3963                 /* no space */
3964                 sctp_m_freem(m_notify);
3965                 return;
3966         }
3967         /* append to socket */
3968         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3969             0, 0, stcb->asoc.context, 0, 0, 0,
3970             m_notify);
3971         if (control == NULL) {
3972                 /* no memory */
3973                 sctp_m_freem(m_notify);
3974                 return;
3975         }
3976         control->length = SCTP_BUF_LEN(m_notify);
3977         control->spec_flags = M_NOTIFICATION;
3978         /* not that we need this */
3979         control->tail_mbuf = m_notify;
3980         sctp_add_to_readq(stcb->sctp_ep, stcb,
3981             control,
3982             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3983 }
3984
3985 static void
3986 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3987 {
3988         struct mbuf *m_notify;
3989         struct sctp_remote_error *sre;
3990         struct sctp_queued_to_read *control;
3991         unsigned int notif_len;
3992         uint16_t chunk_len;
3993
3994         if ((stcb == NULL) ||
3995             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3996                 return;
3997         }
3998         if (chunk != NULL) {
3999                 chunk_len = ntohs(chunk->ch.chunk_length);
4000                 /*
4001                  * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
4002                  * contiguous.
4003                  */
4004                 if (chunk_len > SCTP_CHUNK_BUFFER_SIZE) {
4005                         chunk_len = SCTP_CHUNK_BUFFER_SIZE;
4006                 }
4007         } else {
4008                 chunk_len = 0;
4009         }
4010         notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len);
4011         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
4012         if (m_notify == NULL) {
4013                 /* Retry with smaller value. */
4014                 notif_len = (unsigned int)sizeof(struct sctp_remote_error);
4015                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
4016                 if (m_notify == NULL) {
4017                         return;
4018                 }
4019         }
4020         SCTP_BUF_NEXT(m_notify) = NULL;
4021         sre = mtod(m_notify, struct sctp_remote_error *);
4022         memset(sre, 0, notif_len);
4023         sre->sre_type = SCTP_REMOTE_ERROR;
4024         sre->sre_flags = 0;
4025         sre->sre_length = sizeof(struct sctp_remote_error);
4026         sre->sre_error = error;
4027         sre->sre_assoc_id = sctp_get_associd(stcb);
4028         if (notif_len > sizeof(struct sctp_remote_error)) {
4029                 memcpy(sre->sre_data, chunk, chunk_len);
4030                 sre->sre_length += chunk_len;
4031         }
4032         SCTP_BUF_LEN(m_notify) = sre->sre_length;
4033         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
4034             0, 0, stcb->asoc.context, 0, 0, 0,
4035             m_notify);
4036         if (control != NULL) {
4037                 control->length = SCTP_BUF_LEN(m_notify);
4038                 control->spec_flags = M_NOTIFICATION;
4039                 /* not that we need this */
4040                 control->tail_mbuf = m_notify;
4041                 sctp_add_to_readq(stcb->sctp_ep, stcb,
4042                     control,
4043                     &stcb->sctp_socket->so_rcv, 1,
4044                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
4045         } else {
4046                 sctp_m_freem(m_notify);
4047         }
4048 }
4049
4050 void
4051 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
4052     uint32_t error, void *data, int so_locked)
4053 {
4054         if ((stcb == NULL) ||
4055             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4056             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4057             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
4058                 /* If the socket is gone we are out of here */
4059                 return;
4060         }
4061         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
4062                 return;
4063         }
4064         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4065             (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4066                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
4067                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
4068                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
4069                         /* Don't report these in front states */
4070                         return;
4071                 }
4072         }
4073         switch (notification) {
4074         case SCTP_NOTIFY_ASSOC_UP:
4075                 if (stcb->asoc.assoc_up_sent == 0) {
4076                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
4077                         stcb->asoc.assoc_up_sent = 1;
4078                 }
4079                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
4080                         sctp_notify_adaptation_layer(stcb);
4081                 }
4082                 if (stcb->asoc.auth_supported == 0) {
4083                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
4084                             NULL, so_locked);
4085                 }
4086                 break;
4087         case SCTP_NOTIFY_ASSOC_DOWN:
4088                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
4089                 break;
4090         case SCTP_NOTIFY_INTERFACE_DOWN:
4091                 {
4092                         struct sctp_nets *net;
4093
4094                         net = (struct sctp_nets *)data;
4095                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
4096                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4097                         break;
4098                 }
4099         case SCTP_NOTIFY_INTERFACE_UP:
4100                 {
4101                         struct sctp_nets *net;
4102
4103                         net = (struct sctp_nets *)data;
4104                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
4105                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4106                         break;
4107                 }
4108         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
4109                 {
4110                         struct sctp_nets *net;
4111
4112                         net = (struct sctp_nets *)data;
4113                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
4114                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4115                         break;
4116                 }
4117         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
4118                 sctp_notify_send_failed2(stcb, error,
4119                     (struct sctp_stream_queue_pending *)data, so_locked);
4120                 break;
4121         case SCTP_NOTIFY_SENT_DG_FAIL:
4122                 sctp_notify_send_failed(stcb, 1, error,
4123                     (struct sctp_tmit_chunk *)data, so_locked);
4124                 break;
4125         case SCTP_NOTIFY_UNSENT_DG_FAIL:
4126                 sctp_notify_send_failed(stcb, 0, error,
4127                     (struct sctp_tmit_chunk *)data, so_locked);
4128                 break;
4129         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
4130                 {
4131                         uint32_t val;
4132
4133                         val = *((uint32_t *)data);
4134
4135                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
4136                         break;
4137                 }
4138         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
4139                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4140                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4141                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
4142                 } else {
4143                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
4144                 }
4145                 break;
4146         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
4147                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4148                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4149                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
4150                 } else {
4151                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
4152                 }
4153                 break;
4154         case SCTP_NOTIFY_ASSOC_RESTART:
4155                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
4156                 if (stcb->asoc.auth_supported == 0) {
4157                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
4158                             NULL, so_locked);
4159                 }
4160                 break;
4161         case SCTP_NOTIFY_STR_RESET_SEND:
4162                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN);
4163                 break;
4164         case SCTP_NOTIFY_STR_RESET_RECV:
4165                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING);
4166                 break;
4167         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
4168                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4169                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
4170                 break;
4171         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
4172                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4173                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
4174                 break;
4175         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
4176                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4177                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
4178                 break;
4179         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
4180                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4181                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
4182                 break;
4183         case SCTP_NOTIFY_ASCONF_ADD_IP:
4184                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
4185                     error, so_locked);
4186                 break;
4187         case SCTP_NOTIFY_ASCONF_DELETE_IP:
4188                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
4189                     error, so_locked);
4190                 break;
4191         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
4192                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
4193                     error, so_locked);
4194                 break;
4195         case SCTP_NOTIFY_PEER_SHUTDOWN:
4196                 sctp_notify_shutdown_event(stcb);
4197                 break;
4198         case SCTP_NOTIFY_AUTH_NEW_KEY:
4199                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
4200                     (uint16_t)(uintptr_t)data,
4201                     so_locked);
4202                 break;
4203         case SCTP_NOTIFY_AUTH_FREE_KEY:
4204                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
4205                     (uint16_t)(uintptr_t)data,
4206                     so_locked);
4207                 break;
4208         case SCTP_NOTIFY_NO_PEER_AUTH:
4209                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
4210                     (uint16_t)(uintptr_t)data,
4211                     so_locked);
4212                 break;
4213         case SCTP_NOTIFY_SENDER_DRY:
4214                 sctp_notify_sender_dry_event(stcb, so_locked);
4215                 break;
4216         case SCTP_NOTIFY_REMOTE_ERROR:
4217                 sctp_notify_remote_error(stcb, error, data);
4218                 break;
4219         default:
4220                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
4221                     __func__, notification, notification);
4222                 break;
4223         }                       /* end switch */
4224 }
4225
4226 void
4227 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int so_locked)
4228 {
4229         struct sctp_association *asoc;
4230         struct sctp_stream_out *outs;
4231         struct sctp_tmit_chunk *chk, *nchk;
4232         struct sctp_stream_queue_pending *sp, *nsp;
4233         int i;
4234
4235         if (stcb == NULL) {
4236                 return;
4237         }
4238         asoc = &stcb->asoc;
4239         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4240                 /* already being freed */
4241                 return;
4242         }
4243         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4244             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4245             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
4246                 return;
4247         }
4248         /* now through all the gunk freeing chunks */
4249         /* sent queue SHOULD be empty */
4250         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
4251                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
4252                 asoc->sent_queue_cnt--;
4253                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
4254                         if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
4255                                 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
4256 #ifdef INVARIANTS
4257                         } else {
4258                                 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
4259 #endif
4260                         }
4261                 }
4262                 if (chk->data != NULL) {
4263                         sctp_free_bufspace(stcb, asoc, chk, 1);
4264                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
4265                             error, chk, so_locked);
4266                         if (chk->data) {
4267                                 sctp_m_freem(chk->data);
4268                                 chk->data = NULL;
4269                         }
4270                 }
4271                 sctp_free_a_chunk(stcb, chk, so_locked);
4272                 /* sa_ignore FREED_MEMORY */
4273         }
4274         /* pending send queue SHOULD be empty */
4275         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
4276                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
4277                 asoc->send_queue_cnt--;
4278                 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
4279                         asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
4280 #ifdef INVARIANTS
4281                 } else {
4282                         panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
4283 #endif
4284                 }
4285                 if (chk->data != NULL) {
4286                         sctp_free_bufspace(stcb, asoc, chk, 1);
4287                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
4288                             error, chk, so_locked);
4289                         if (chk->data) {
4290                                 sctp_m_freem(chk->data);
4291                                 chk->data = NULL;
4292                         }
4293                 }
4294                 sctp_free_a_chunk(stcb, chk, so_locked);
4295                 /* sa_ignore FREED_MEMORY */
4296         }
4297         for (i = 0; i < asoc->streamoutcnt; i++) {
4298                 /* For each stream */
4299                 outs = &asoc->strmout[i];
4300                 /* clean up any sends there */
4301                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
4302                         atomic_subtract_int(&asoc->stream_queue_cnt, 1);
4303                         TAILQ_REMOVE(&outs->outqueue, sp, next);
4304                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
4305                         sctp_free_spbufspace(stcb, asoc, sp);
4306                         if (sp->data) {
4307                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
4308                                     error, (void *)sp, so_locked);
4309                                 if (sp->data) {
4310                                         sctp_m_freem(sp->data);
4311                                         sp->data = NULL;
4312                                         sp->tail_mbuf = NULL;
4313                                         sp->length = 0;
4314                                 }
4315                         }
4316                         if (sp->net) {
4317                                 sctp_free_remote_addr(sp->net);
4318                                 sp->net = NULL;
4319                         }
4320                         /* Free the chunk */
4321                         sctp_free_a_strmoq(stcb, sp, so_locked);
4322                         /* sa_ignore FREED_MEMORY */
4323                 }
4324         }
4325 }
4326
4327 void
4328 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
4329     struct sctp_abort_chunk *abort, int so_locked)
4330 {
4331         if (stcb == NULL) {
4332                 return;
4333         }
4334         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
4335             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
4336             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
4337                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
4338         }
4339         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4340             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4341             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
4342                 return;
4343         }
4344         SCTP_TCB_SEND_LOCK(stcb);
4345         SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED);
4346         /* Tell them we lost the asoc */
4347         sctp_report_all_outbound(stcb, error, so_locked);
4348         SCTP_TCB_SEND_UNLOCK(stcb);
4349         if (from_peer) {
4350                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
4351         } else {
4352                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
4353         }
4354 }
4355
4356 void
4357 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4358     struct mbuf *m, int iphlen,
4359     struct sockaddr *src, struct sockaddr *dst,
4360     struct sctphdr *sh, struct mbuf *op_err,
4361     uint8_t mflowtype, uint32_t mflowid,
4362     uint32_t vrf_id, uint16_t port)
4363 {
4364         uint32_t vtag;
4365
4366         vtag = 0;
4367         if (stcb != NULL) {
4368                 vtag = stcb->asoc.peer_vtag;
4369                 vrf_id = stcb->asoc.vrf_id;
4370         }
4371         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
4372             mflowtype, mflowid, inp->fibnum,
4373             vrf_id, port);
4374         if (stcb != NULL) {
4375                 /* We have a TCB to abort, send notification too */
4376                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
4377                 /* Ok, now lets free it */
4378                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4379                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4380                     (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4381                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4382                 }
4383                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4384                     SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
4385         }
4386 }
4387 #ifdef SCTP_ASOCLOG_OF_TSNS
4388 void
4389 sctp_print_out_track_log(struct sctp_tcb *stcb)
4390 {
4391 #ifdef NOSIY_PRINTS
4392         int i;
4393
4394         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
4395         SCTP_PRINTF("IN bound TSN log-aaa\n");
4396         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
4397                 SCTP_PRINTF("None rcvd\n");
4398                 goto none_in;
4399         }
4400         if (stcb->asoc.tsn_in_wrapped) {
4401                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
4402                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4403                             stcb->asoc.in_tsnlog[i].tsn,
4404                             stcb->asoc.in_tsnlog[i].strm,
4405                             stcb->asoc.in_tsnlog[i].seq,
4406                             stcb->asoc.in_tsnlog[i].flgs,
4407                             stcb->asoc.in_tsnlog[i].sz);
4408                 }
4409         }
4410         if (stcb->asoc.tsn_in_at) {
4411                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
4412                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4413                             stcb->asoc.in_tsnlog[i].tsn,
4414                             stcb->asoc.in_tsnlog[i].strm,
4415                             stcb->asoc.in_tsnlog[i].seq,
4416                             stcb->asoc.in_tsnlog[i].flgs,
4417                             stcb->asoc.in_tsnlog[i].sz);
4418                 }
4419         }
4420 none_in:
4421         SCTP_PRINTF("OUT bound TSN log-aaa\n");
4422         if ((stcb->asoc.tsn_out_at == 0) &&
4423             (stcb->asoc.tsn_out_wrapped == 0)) {
4424                 SCTP_PRINTF("None sent\n");
4425         }
4426         if (stcb->asoc.tsn_out_wrapped) {
4427                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
4428                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4429                             stcb->asoc.out_tsnlog[i].tsn,
4430                             stcb->asoc.out_tsnlog[i].strm,
4431                             stcb->asoc.out_tsnlog[i].seq,
4432                             stcb->asoc.out_tsnlog[i].flgs,
4433                             stcb->asoc.out_tsnlog[i].sz);
4434                 }
4435         }
4436         if (stcb->asoc.tsn_out_at) {
4437                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
4438                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4439                             stcb->asoc.out_tsnlog[i].tsn,
4440                             stcb->asoc.out_tsnlog[i].strm,
4441                             stcb->asoc.out_tsnlog[i].seq,
4442                             stcb->asoc.out_tsnlog[i].flgs,
4443                             stcb->asoc.out_tsnlog[i].sz);
4444                 }
4445         }
4446 #endif
4447 }
4448 #endif
4449
4450 void
4451 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4452     struct mbuf *op_err,
4453     int so_locked)
4454 {
4455
4456         if (stcb == NULL) {
4457                 /* Got to have a TCB */
4458                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4459                         if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4460                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4461                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
4462                         }
4463                 }
4464                 return;
4465         }
4466         /* notify the peer */
4467         sctp_send_abort_tcb(stcb, op_err, so_locked);
4468         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4469         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4470             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4471                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4472         }
4473         /* notify the ulp */
4474         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4475                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
4476         }
4477         /* now free the asoc */
4478 #ifdef SCTP_ASOCLOG_OF_TSNS
4479         sctp_print_out_track_log(stcb);
4480 #endif
4481         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4482             SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4483 }
4484
4485 void
4486 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4487     struct sockaddr *src, struct sockaddr *dst,
4488     struct sctphdr *sh, struct sctp_inpcb *inp,
4489     struct mbuf *cause,
4490     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4491     uint32_t vrf_id, uint16_t port)
4492 {
4493         struct sctp_chunkhdr *ch, chunk_buf;
4494         unsigned int chk_length;
4495         int contains_init_chunk;
4496
4497         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4498         /* Generate a TO address for future reference */
4499         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4500                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4501                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4502                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4503                 }
4504         }
4505         contains_init_chunk = 0;
4506         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4507             sizeof(*ch), (uint8_t *)&chunk_buf);
4508         while (ch != NULL) {
4509                 chk_length = ntohs(ch->chunk_length);
4510                 if (chk_length < sizeof(*ch)) {
4511                         /* break to abort land */
4512                         break;
4513                 }
4514                 switch (ch->chunk_type) {
4515                 case SCTP_INIT:
4516                         contains_init_chunk = 1;
4517                         break;
4518                 case SCTP_PACKET_DROPPED:
4519                         /* we don't respond to pkt-dropped */
4520                         return;
4521                 case SCTP_ABORT_ASSOCIATION:
4522                         /* we don't respond with an ABORT to an ABORT */
4523                         return;
4524                 case SCTP_SHUTDOWN_COMPLETE:
4525                         /*
4526                          * we ignore it since we are not waiting for it and
4527                          * peer is gone
4528                          */
4529                         return;
4530                 case SCTP_SHUTDOWN_ACK:
4531                         sctp_send_shutdown_complete2(src, dst, sh,
4532                             mflowtype, mflowid, fibnum,
4533                             vrf_id, port);
4534                         return;
4535                 default:
4536                         break;
4537                 }
4538                 offset += SCTP_SIZE32(chk_length);
4539                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4540                     sizeof(*ch), (uint8_t *)&chunk_buf);
4541         }
4542         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4543             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4544             (contains_init_chunk == 0))) {
4545                 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4546                     mflowtype, mflowid, fibnum,
4547                     vrf_id, port);
4548         }
4549 }
4550
4551 /*
4552  * check the inbound datagram to make sure there is not an abort inside it,
4553  * if there is return 1, else return 0.
4554  */
4555 int
4556 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtagfill)
4557 {
4558         struct sctp_chunkhdr *ch;
4559         struct sctp_init_chunk *init_chk, chunk_buf;
4560         int offset;
4561         unsigned int chk_length;
4562
4563         offset = iphlen + sizeof(struct sctphdr);
4564         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4565             (uint8_t *)&chunk_buf);
4566         while (ch != NULL) {
4567                 chk_length = ntohs(ch->chunk_length);
4568                 if (chk_length < sizeof(*ch)) {
4569                         /* packet is probably corrupt */
4570                         break;
4571                 }
4572                 /* we seem to be ok, is it an abort? */
4573                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4574                         /* yep, tell them */
4575                         return (1);
4576                 }
4577                 if (ch->chunk_type == SCTP_INITIATION) {
4578                         /* need to update the Vtag */
4579                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4580                             offset, sizeof(*init_chk), (uint8_t *)&chunk_buf);
4581                         if (init_chk != NULL) {
4582                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4583                         }
4584                 }
4585                 /* Nope, move to the next chunk */
4586                 offset += SCTP_SIZE32(chk_length);
4587                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4588                     sizeof(*ch), (uint8_t *)&chunk_buf);
4589         }
4590         return (0);
4591 }
4592
4593 /*
4594  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4595  * set (i.e. it's 0) so, create this function to compare link local scopes
4596  */
4597 #ifdef INET6
4598 uint32_t
4599 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4600 {
4601         struct sockaddr_in6 a, b;
4602
4603         /* save copies */
4604         a = *addr1;
4605         b = *addr2;
4606
4607         if (a.sin6_scope_id == 0)
4608                 if (sa6_recoverscope(&a)) {
4609                         /* can't get scope, so can't match */
4610                         return (0);
4611                 }
4612         if (b.sin6_scope_id == 0)
4613                 if (sa6_recoverscope(&b)) {
4614                         /* can't get scope, so can't match */
4615                         return (0);
4616                 }
4617         if (a.sin6_scope_id != b.sin6_scope_id)
4618                 return (0);
4619
4620         return (1);
4621 }
4622
4623 /*
4624  * returns a sockaddr_in6 with embedded scope recovered and removed
4625  */
4626 struct sockaddr_in6 *
4627 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4628 {
4629         /* check and strip embedded scope junk */
4630         if (addr->sin6_family == AF_INET6) {
4631                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4632                         if (addr->sin6_scope_id == 0) {
4633                                 *store = *addr;
4634                                 if (!sa6_recoverscope(store)) {
4635                                         /* use the recovered scope */
4636                                         addr = store;
4637                                 }
4638                         } else {
4639                                 /* else, return the original "to" addr */
4640                                 in6_clearscope(&addr->sin6_addr);
4641                         }
4642                 }
4643         }
4644         return (addr);
4645 }
4646 #endif
4647
4648 /*
4649  * are the two addresses the same?  currently a "scopeless" check returns: 1
4650  * if same, 0 if not
4651  */
4652 int
4653 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4654 {
4655
4656         /* must be valid */
4657         if (sa1 == NULL || sa2 == NULL)
4658                 return (0);
4659
4660         /* must be the same family */
4661         if (sa1->sa_family != sa2->sa_family)
4662                 return (0);
4663
4664         switch (sa1->sa_family) {
4665 #ifdef INET6
4666         case AF_INET6:
4667                 {
4668                         /* IPv6 addresses */
4669                         struct sockaddr_in6 *sin6_1, *sin6_2;
4670
4671                         sin6_1 = (struct sockaddr_in6 *)sa1;
4672                         sin6_2 = (struct sockaddr_in6 *)sa2;
4673                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4674                             sin6_2));
4675                 }
4676 #endif
4677 #ifdef INET
4678         case AF_INET:
4679                 {
4680                         /* IPv4 addresses */
4681                         struct sockaddr_in *sin_1, *sin_2;
4682
4683                         sin_1 = (struct sockaddr_in *)sa1;
4684                         sin_2 = (struct sockaddr_in *)sa2;
4685                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4686                 }
4687 #endif
4688         default:
4689                 /* we don't do these... */
4690                 return (0);
4691         }
4692 }
4693
4694 void
4695 sctp_print_address(struct sockaddr *sa)
4696 {
4697 #ifdef INET6
4698         char ip6buf[INET6_ADDRSTRLEN];
4699 #endif
4700
4701         switch (sa->sa_family) {
4702 #ifdef INET6
4703         case AF_INET6:
4704                 {
4705                         struct sockaddr_in6 *sin6;
4706
4707                         sin6 = (struct sockaddr_in6 *)sa;
4708                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4709                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4710                             ntohs(sin6->sin6_port),
4711                             sin6->sin6_scope_id);
4712                         break;
4713                 }
4714 #endif
4715 #ifdef INET
4716         case AF_INET:
4717                 {
4718                         struct sockaddr_in *sin;
4719                         unsigned char *p;
4720
4721                         sin = (struct sockaddr_in *)sa;
4722                         p = (unsigned char *)&sin->sin_addr;
4723                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4724                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4725                         break;
4726                 }
4727 #endif
4728         default:
4729                 SCTP_PRINTF("?\n");
4730                 break;
4731         }
4732 }
4733
4734 void
4735 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4736     struct sctp_inpcb *new_inp,
4737     struct sctp_tcb *stcb,
4738     int waitflags)
4739 {
4740         /*
4741          * go through our old INP and pull off any control structures that
4742          * belong to stcb and move then to the new inp.
4743          */
4744         struct socket *old_so, *new_so;
4745         struct sctp_queued_to_read *control, *nctl;
4746         struct sctp_readhead tmp_queue;
4747         struct mbuf *m;
4748         int error = 0;
4749
4750         old_so = old_inp->sctp_socket;
4751         new_so = new_inp->sctp_socket;
4752         TAILQ_INIT(&tmp_queue);
4753         error = sblock(&old_so->so_rcv, waitflags);
4754         if (error) {
4755                 /*
4756                  * Gak, can't get sblock, we have a problem. data will be
4757                  * left stranded.. and we don't dare look at it since the
4758                  * other thread may be reading something. Oh well, its a
4759                  * screwed up app that does a peeloff OR a accept while
4760                  * reading from the main socket... actually its only the
4761                  * peeloff() case, since I think read will fail on a
4762                  * listening socket..
4763                  */
4764                 return;
4765         }
4766         /* lock the socket buffers */
4767         SCTP_INP_READ_LOCK(old_inp);
4768         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4769                 /* Pull off all for out target stcb */
4770                 if (control->stcb == stcb) {
4771                         /* remove it we want it */
4772                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4773                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4774                         m = control->data;
4775                         while (m) {
4776                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4777                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4778                                 }
4779                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4780                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4781                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4782                                 }
4783                                 m = SCTP_BUF_NEXT(m);
4784                         }
4785                 }
4786         }
4787         SCTP_INP_READ_UNLOCK(old_inp);
4788         /* Remove the sb-lock on the old socket */
4789
4790         sbunlock(&old_so->so_rcv);
4791         /* Now we move them over to the new socket buffer */
4792         SCTP_INP_READ_LOCK(new_inp);
4793         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4794                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4795                 m = control->data;
4796                 while (m) {
4797                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4798                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4799                         }
4800                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4801                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4802                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4803                         }
4804                         m = SCTP_BUF_NEXT(m);
4805                 }
4806         }
4807         SCTP_INP_READ_UNLOCK(new_inp);
4808 }
4809
4810 void
4811 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
4812     struct sctp_tcb *stcb,
4813     int so_locked
4814     SCTP_UNUSED
4815 )
4816 {
4817         if ((inp != NULL) && (inp->sctp_socket != NULL)) {
4818                 sctp_sorwakeup(inp, inp->sctp_socket);
4819         }
4820 }
4821
4822 void
4823 sctp_add_to_readq(struct sctp_inpcb *inp,
4824     struct sctp_tcb *stcb,
4825     struct sctp_queued_to_read *control,
4826     struct sockbuf *sb,
4827     int end,
4828     int inp_read_lock_held,
4829     int so_locked)
4830 {
4831         /*
4832          * Here we must place the control on the end of the socket read
4833          * queue AND increment sb_cc so that select will work properly on
4834          * read.
4835          */
4836         struct mbuf *m, *prev = NULL;
4837
4838         if (inp == NULL) {
4839                 /* Gak, TSNH!! */
4840 #ifdef INVARIANTS
4841                 panic("Gak, inp NULL on add_to_readq");
4842 #endif
4843                 return;
4844         }
4845         if (inp_read_lock_held == 0)
4846                 SCTP_INP_READ_LOCK(inp);
4847         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4848                 if (!control->on_strm_q) {
4849                         sctp_free_remote_addr(control->whoFrom);
4850                         if (control->data) {
4851                                 sctp_m_freem(control->data);
4852                                 control->data = NULL;
4853                         }
4854                         sctp_free_a_readq(stcb, control);
4855                 }
4856                 if (inp_read_lock_held == 0)
4857                         SCTP_INP_READ_UNLOCK(inp);
4858                 return;
4859         }
4860         if (!(control->spec_flags & M_NOTIFICATION)) {
4861                 atomic_add_int(&inp->total_recvs, 1);
4862                 if (!control->do_not_ref_stcb) {
4863                         atomic_add_int(&stcb->total_recvs, 1);
4864                 }
4865         }
4866         m = control->data;
4867         control->held_length = 0;
4868         control->length = 0;
4869         while (m) {
4870                 if (SCTP_BUF_LEN(m) == 0) {
4871                         /* Skip mbufs with NO length */
4872                         if (prev == NULL) {
4873                                 /* First one */
4874                                 control->data = sctp_m_free(m);
4875                                 m = control->data;
4876                         } else {
4877                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4878                                 m = SCTP_BUF_NEXT(prev);
4879                         }
4880                         if (m == NULL) {
4881                                 control->tail_mbuf = prev;
4882                         }
4883                         continue;
4884                 }
4885                 prev = m;
4886                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4887                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4888                 }
4889                 sctp_sballoc(stcb, sb, m);
4890                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4891                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4892                 }
4893                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4894                 m = SCTP_BUF_NEXT(m);
4895         }
4896         if (prev != NULL) {
4897                 control->tail_mbuf = prev;
4898         } else {
4899                 /* Everything got collapsed out?? */
4900                 if (!control->on_strm_q) {
4901                         sctp_free_remote_addr(control->whoFrom);
4902                         sctp_free_a_readq(stcb, control);
4903                 }
4904                 if (inp_read_lock_held == 0)
4905                         SCTP_INP_READ_UNLOCK(inp);
4906                 return;
4907         }
4908         if (end) {
4909                 control->end_added = 1;
4910         }
4911         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4912         control->on_read_q = 1;
4913         if (inp_read_lock_held == 0)
4914                 SCTP_INP_READ_UNLOCK(inp);
4915         if (inp && inp->sctp_socket) {
4916                 sctp_wakeup_the_read_socket(inp, stcb, so_locked);
4917         }
4918 }
4919
4920 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4921  *************ALTERNATE ROUTING CODE
4922  */
4923
4924 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4925  *************ALTERNATE ROUTING CODE
4926  */
4927
4928 struct mbuf *
4929 sctp_generate_cause(uint16_t code, char *info)
4930 {
4931         struct mbuf *m;
4932         struct sctp_gen_error_cause *cause;
4933         size_t info_len;
4934         uint16_t len;
4935
4936         if ((code == 0) || (info == NULL)) {
4937                 return (NULL);
4938         }
4939         info_len = strlen(info);
4940         if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) {
4941                 return (NULL);
4942         }
4943         len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len);
4944         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4945         if (m != NULL) {
4946                 SCTP_BUF_LEN(m) = len;
4947                 cause = mtod(m, struct sctp_gen_error_cause *);
4948                 cause->code = htons(code);
4949                 cause->length = htons(len);
4950                 memcpy(cause->info, info, info_len);
4951         }
4952         return (m);
4953 }
4954
4955 struct mbuf *
4956 sctp_generate_no_user_data_cause(uint32_t tsn)
4957 {
4958         struct mbuf *m;
4959         struct sctp_error_no_user_data *no_user_data_cause;
4960         uint16_t len;
4961
4962         len = (uint16_t)sizeof(struct sctp_error_no_user_data);
4963         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4964         if (m != NULL) {
4965                 SCTP_BUF_LEN(m) = len;
4966                 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
4967                 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
4968                 no_user_data_cause->cause.length = htons(len);
4969                 no_user_data_cause->tsn = htonl(tsn);
4970         }
4971         return (m);
4972 }
4973
4974 #ifdef SCTP_MBCNT_LOGGING
4975 void
4976 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4977     struct sctp_tmit_chunk *tp1, int chk_cnt)
4978 {
4979         if (tp1->data == NULL) {
4980                 return;
4981         }
4982         asoc->chunks_on_out_queue -= chk_cnt;
4983         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4984                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4985                     asoc->total_output_queue_size,
4986                     tp1->book_size,
4987                     0,
4988                     tp1->mbcnt);
4989         }
4990         if (asoc->total_output_queue_size >= tp1->book_size) {
4991                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4992         } else {
4993                 asoc->total_output_queue_size = 0;
4994         }
4995
4996         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4997             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4998                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4999                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
5000                 } else {
5001                         stcb->sctp_socket->so_snd.sb_cc = 0;
5002                 }
5003         }
5004 }
5005
5006 #endif
5007
5008 int
5009 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
5010     uint8_t sent, int so_locked)
5011 {
5012         struct sctp_stream_out *strq;
5013         struct sctp_tmit_chunk *chk = NULL, *tp2;
5014         struct sctp_stream_queue_pending *sp;
5015         uint32_t mid;
5016         uint16_t sid;
5017         uint8_t foundeom = 0;
5018         int ret_sz = 0;
5019         int notdone;
5020         int do_wakeup_routine = 0;
5021
5022         sid = tp1->rec.data.sid;
5023         mid = tp1->rec.data.mid;
5024         if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
5025                 stcb->asoc.abandoned_sent[0]++;
5026                 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
5027                 stcb->asoc.strmout[sid].abandoned_sent[0]++;
5028 #if defined(SCTP_DETAILED_STR_STATS)
5029                 stcb->asoc.strmout[sid].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
5030 #endif
5031         } else {
5032                 stcb->asoc.abandoned_unsent[0]++;
5033                 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
5034                 stcb->asoc.strmout[sid].abandoned_unsent[0]++;
5035 #if defined(SCTP_DETAILED_STR_STATS)
5036                 stcb->asoc.strmout[sid].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
5037 #endif
5038         }
5039         do {
5040                 ret_sz += tp1->book_size;
5041                 if (tp1->data != NULL) {
5042                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
5043                                 sctp_flight_size_decrease(tp1);
5044                                 sctp_total_flight_decrease(stcb, tp1);
5045                         }
5046                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
5047                         stcb->asoc.peers_rwnd += tp1->send_size;
5048                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
5049                         if (sent) {
5050                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
5051                         } else {
5052                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
5053                         }
5054                         if (tp1->data) {
5055                                 sctp_m_freem(tp1->data);
5056                                 tp1->data = NULL;
5057                         }
5058                         do_wakeup_routine = 1;
5059                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
5060                                 stcb->asoc.sent_queue_cnt_removeable--;
5061                         }
5062                 }
5063                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
5064                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
5065                     SCTP_DATA_NOT_FRAG) {
5066                         /* not frag'ed we ae done   */
5067                         notdone = 0;
5068                         foundeom = 1;
5069                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5070                         /* end of frag, we are done */
5071                         notdone = 0;
5072                         foundeom = 1;
5073                 } else {
5074                         /*
5075                          * Its a begin or middle piece, we must mark all of
5076                          * it
5077                          */
5078                         notdone = 1;
5079                         tp1 = TAILQ_NEXT(tp1, sctp_next);
5080                 }
5081         } while (tp1 && notdone);
5082         if (foundeom == 0) {
5083                 /*
5084                  * The multi-part message was scattered across the send and
5085                  * sent queue.
5086                  */
5087                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
5088                         if ((tp1->rec.data.sid != sid) ||
5089                             (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) {
5090                                 break;
5091                         }
5092                         /*
5093                          * save to chk in case we have some on stream out
5094                          * queue. If so and we have an un-transmitted one we
5095                          * don't have to fudge the TSN.
5096                          */
5097                         chk = tp1;
5098                         ret_sz += tp1->book_size;
5099                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
5100                         if (sent) {
5101                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
5102                         } else {
5103                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
5104                         }
5105                         if (tp1->data) {
5106                                 sctp_m_freem(tp1->data);
5107                                 tp1->data = NULL;
5108                         }
5109                         /* No flight involved here book the size to 0 */
5110                         tp1->book_size = 0;
5111                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5112                                 foundeom = 1;
5113                         }
5114                         do_wakeup_routine = 1;
5115                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
5116                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
5117                         /*
5118                          * on to the sent queue so we can wait for it to be
5119                          * passed by.
5120                          */
5121                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
5122                             sctp_next);
5123                         stcb->asoc.send_queue_cnt--;
5124                         stcb->asoc.sent_queue_cnt++;
5125                 }
5126         }
5127         if (foundeom == 0) {
5128                 /*
5129                  * Still no eom found. That means there is stuff left on the
5130                  * stream out queue.. yuck.
5131                  */
5132                 SCTP_TCB_SEND_LOCK(stcb);
5133                 strq = &stcb->asoc.strmout[sid];
5134                 sp = TAILQ_FIRST(&strq->outqueue);
5135                 if (sp != NULL) {
5136                         sp->discard_rest = 1;
5137                         /*
5138                          * We may need to put a chunk on the queue that
5139                          * holds the TSN that would have been sent with the
5140                          * LAST bit.
5141                          */
5142                         if (chk == NULL) {
5143                                 /* Yep, we have to */
5144                                 sctp_alloc_a_chunk(stcb, chk);
5145                                 if (chk == NULL) {
5146                                         /*
5147                                          * we are hosed. All we can do is
5148                                          * nothing.. which will cause an
5149                                          * abort if the peer is paying
5150                                          * attention.
5151                                          */
5152                                         goto oh_well;
5153                                 }
5154                                 memset(chk, 0, sizeof(*chk));
5155                                 chk->rec.data.rcv_flags = 0;
5156                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
5157                                 chk->asoc = &stcb->asoc;
5158                                 if (stcb->asoc.idata_supported == 0) {
5159                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
5160                                                 chk->rec.data.mid = 0;
5161                                         } else {
5162                                                 chk->rec.data.mid = strq->next_mid_ordered;
5163                                         }
5164                                 } else {
5165                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
5166                                                 chk->rec.data.mid = strq->next_mid_unordered;
5167                                         } else {
5168                                                 chk->rec.data.mid = strq->next_mid_ordered;
5169                                         }
5170                                 }
5171                                 chk->rec.data.sid = sp->sid;
5172                                 chk->rec.data.ppid = sp->ppid;
5173                                 chk->rec.data.context = sp->context;
5174                                 chk->flags = sp->act_flags;
5175                                 chk->whoTo = NULL;
5176                                 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
5177                                 strq->chunks_on_queues++;
5178                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
5179                                 stcb->asoc.sent_queue_cnt++;
5180                                 stcb->asoc.pr_sctp_cnt++;
5181                         }
5182                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
5183                         if (sp->sinfo_flags & SCTP_UNORDERED) {
5184                                 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED;
5185                         }
5186                         if (stcb->asoc.idata_supported == 0) {
5187                                 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) {
5188                                         strq->next_mid_ordered++;
5189                                 }
5190                         } else {
5191                                 if (sp->sinfo_flags & SCTP_UNORDERED) {
5192                                         strq->next_mid_unordered++;
5193                                 } else {
5194                                         strq->next_mid_ordered++;
5195                                 }
5196                         }
5197         oh_well:
5198                         if (sp->data) {
5199                                 /*
5200                                  * Pull any data to free up the SB and allow
5201                                  * sender to "add more" while we will throw
5202                                  * away :-)
5203                                  */
5204                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
5205                                 ret_sz += sp->length;
5206                                 do_wakeup_routine = 1;
5207                                 sp->some_taken = 1;
5208                                 sctp_m_freem(sp->data);
5209                                 sp->data = NULL;
5210                                 sp->tail_mbuf = NULL;
5211                                 sp->length = 0;
5212                         }
5213                 }
5214                 SCTP_TCB_SEND_UNLOCK(stcb);
5215         }
5216         if (do_wakeup_routine) {
5217                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
5218         }
5219         return (ret_sz);
5220 }
5221
5222 /*
5223  * checks to see if the given address, sa, is one that is currently known by
5224  * the kernel note: can't distinguish the same address on multiple interfaces
5225  * and doesn't handle multiple addresses with different zone/scope id's note:
5226  * ifa_ifwithaddr() compares the entire sockaddr struct
5227  */
5228 struct sctp_ifa *
5229 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
5230     int holds_lock)
5231 {
5232         struct sctp_laddr *laddr;
5233
5234         if (holds_lock == 0) {
5235                 SCTP_INP_RLOCK(inp);
5236         }
5237
5238         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
5239                 if (laddr->ifa == NULL)
5240                         continue;
5241                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
5242                         continue;
5243 #ifdef INET
5244                 if (addr->sa_family == AF_INET) {
5245                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5246                             laddr->ifa->address.sin.sin_addr.s_addr) {
5247                                 /* found him. */
5248                                 break;
5249                         }
5250                 }
5251 #endif
5252 #ifdef INET6
5253                 if (addr->sa_family == AF_INET6) {
5254                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5255                             &laddr->ifa->address.sin6)) {
5256                                 /* found him. */
5257                                 break;
5258                         }
5259                 }
5260 #endif
5261         }
5262         if (holds_lock == 0) {
5263                 SCTP_INP_RUNLOCK(inp);
5264         }
5265         if (laddr != NULL) {
5266                 return (laddr->ifa);
5267         } else {
5268                 return (NULL);
5269         }
5270 }
5271
5272 uint32_t
5273 sctp_get_ifa_hash_val(struct sockaddr *addr)
5274 {
5275         switch (addr->sa_family) {
5276 #ifdef INET
5277         case AF_INET:
5278                 {
5279                         struct sockaddr_in *sin;
5280
5281                         sin = (struct sockaddr_in *)addr;
5282                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
5283                 }
5284 #endif
5285 #ifdef INET6
5286         case AF_INET6:
5287                 {
5288                         struct sockaddr_in6 *sin6;
5289                         uint32_t hash_of_addr;
5290
5291                         sin6 = (struct sockaddr_in6 *)addr;
5292                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
5293                             sin6->sin6_addr.s6_addr32[1] +
5294                             sin6->sin6_addr.s6_addr32[2] +
5295                             sin6->sin6_addr.s6_addr32[3]);
5296                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
5297                         return (hash_of_addr);
5298                 }
5299 #endif
5300         default:
5301                 break;
5302         }
5303         return (0);
5304 }
5305
5306 struct sctp_ifa *
5307 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
5308 {
5309         struct sctp_ifa *sctp_ifap;
5310         struct sctp_vrf *vrf;
5311         struct sctp_ifalist *hash_head;
5312         uint32_t hash_of_addr;
5313
5314         if (holds_lock == 0) {
5315                 SCTP_IPI_ADDR_RLOCK();
5316         } else {
5317                 SCTP_IPI_ADDR_LOCK_ASSERT();
5318         }
5319
5320         vrf = sctp_find_vrf(vrf_id);
5321         if (vrf == NULL) {
5322                 if (holds_lock == 0)
5323                         SCTP_IPI_ADDR_RUNLOCK();
5324                 return (NULL);
5325         }
5326
5327         hash_of_addr = sctp_get_ifa_hash_val(addr);
5328
5329         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5330         if (hash_head == NULL) {
5331                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5332                     hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark,
5333                     (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark));
5334                 sctp_print_address(addr);
5335                 SCTP_PRINTF("No such bucket for address\n");
5336                 if (holds_lock == 0)
5337                         SCTP_IPI_ADDR_RUNLOCK();
5338
5339                 return (NULL);
5340         }
5341         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5342                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5343                         continue;
5344 #ifdef INET
5345                 if (addr->sa_family == AF_INET) {
5346                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5347                             sctp_ifap->address.sin.sin_addr.s_addr) {
5348                                 /* found him. */
5349                                 break;
5350                         }
5351                 }
5352 #endif
5353 #ifdef INET6
5354                 if (addr->sa_family == AF_INET6) {
5355                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5356                             &sctp_ifap->address.sin6)) {
5357                                 /* found him. */
5358                                 break;
5359                         }
5360                 }
5361 #endif
5362         }
5363         if (holds_lock == 0)
5364                 SCTP_IPI_ADDR_RUNLOCK();
5365         return (sctp_ifap);
5366 }
5367
5368 static void
5369 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock,
5370     uint32_t rwnd_req)
5371 {
5372         /* User pulled some data, do we need a rwnd update? */
5373         struct epoch_tracker et;
5374         int r_unlocked = 0;
5375         uint32_t dif, rwnd;
5376         struct socket *so = NULL;
5377
5378         if (stcb == NULL)
5379                 return;
5380
5381         atomic_add_int(&stcb->asoc.refcnt, 1);
5382
5383         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
5384             (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED | SCTP_STATE_SHUTDOWN_RECEIVED))) {
5385                 /* Pre-check If we are freeing no update */
5386                 goto no_lock;
5387         }
5388         SCTP_INP_INCR_REF(stcb->sctp_ep);
5389         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5390             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5391                 goto out;
5392         }
5393         so = stcb->sctp_socket;
5394         if (so == NULL) {
5395                 goto out;
5396         }
5397         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5398         /* Have you have freed enough to look */
5399         *freed_so_far = 0;
5400         /* Yep, its worth a look and the lock overhead */
5401
5402         /* Figure out what the rwnd would be */
5403         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5404         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5405                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5406         } else {
5407                 dif = 0;
5408         }
5409         if (dif >= rwnd_req) {
5410                 if (hold_rlock) {
5411                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5412                         r_unlocked = 1;
5413                 }
5414                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5415                         /*
5416                          * One last check before we allow the guy possibly
5417                          * to get in. There is a race, where the guy has not
5418                          * reached the gate. In that case
5419                          */
5420                         goto out;
5421                 }
5422                 SCTP_TCB_LOCK(stcb);
5423                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5424                         /* No reports here */
5425                         SCTP_TCB_UNLOCK(stcb);
5426                         goto out;
5427                 }
5428                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5429                 NET_EPOCH_ENTER(et);
5430                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5431
5432                 sctp_chunk_output(stcb->sctp_ep, stcb,
5433                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5434                 /* make sure no timer is running */
5435                 NET_EPOCH_EXIT(et);
5436                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
5437                     SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5438                 SCTP_TCB_UNLOCK(stcb);
5439         } else {
5440                 /* Update how much we have pending */
5441                 stcb->freed_by_sorcv_sincelast = dif;
5442         }
5443 out:
5444         if (so && r_unlocked && hold_rlock) {
5445                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5446         }
5447
5448         SCTP_INP_DECR_REF(stcb->sctp_ep);
5449 no_lock:
5450         atomic_add_int(&stcb->asoc.refcnt, -1);
5451         return;
5452 }
5453
5454 int
5455 sctp_sorecvmsg(struct socket *so,
5456     struct uio *uio,
5457     struct mbuf **mp,
5458     struct sockaddr *from,
5459     int fromlen,
5460     int *msg_flags,
5461     struct sctp_sndrcvinfo *sinfo,
5462     int filling_sinfo)
5463 {
5464         /*
5465          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5466          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5467          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5468          * On the way out we may send out any combination of:
5469          * MSG_NOTIFICATION MSG_EOR
5470          *
5471          */
5472         struct sctp_inpcb *inp = NULL;
5473         ssize_t my_len = 0;
5474         ssize_t cp_len = 0;
5475         int error = 0;
5476         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5477         struct mbuf *m = NULL;
5478         struct sctp_tcb *stcb = NULL;
5479         int wakeup_read_socket = 0;
5480         int freecnt_applied = 0;
5481         int out_flags = 0, in_flags = 0;
5482         int block_allowed = 1;
5483         uint32_t freed_so_far = 0;
5484         ssize_t copied_so_far = 0;
5485         int in_eeor_mode = 0;
5486         int no_rcv_needed = 0;
5487         uint32_t rwnd_req = 0;
5488         int hold_sblock = 0;
5489         int hold_rlock = 0;
5490         ssize_t slen = 0;
5491         uint32_t held_length = 0;
5492         int sockbuf_lock = 0;
5493
5494         if (uio == NULL) {
5495                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5496                 return (EINVAL);
5497         }
5498
5499         if (msg_flags) {
5500                 in_flags = *msg_flags;
5501                 if (in_flags & MSG_PEEK)
5502                         SCTP_STAT_INCR(sctps_read_peeks);
5503         } else {
5504                 in_flags = 0;
5505         }
5506         slen = uio->uio_resid;
5507
5508         /* Pull in and set up our int flags */
5509         if (in_flags & MSG_OOB) {
5510                 /* Out of band's NOT supported */
5511                 return (EOPNOTSUPP);
5512         }
5513         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5514                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5515                 return (EINVAL);
5516         }
5517         if ((in_flags & (MSG_DONTWAIT
5518             | MSG_NBIO
5519             )) ||
5520             SCTP_SO_IS_NBIO(so)) {
5521                 block_allowed = 0;
5522         }
5523         /* setup the endpoint */
5524         inp = (struct sctp_inpcb *)so->so_pcb;
5525         if (inp == NULL) {
5526                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5527                 return (EFAULT);
5528         }
5529         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5530         /* Must be at least a MTU's worth */
5531         if (rwnd_req < SCTP_MIN_RWND)
5532                 rwnd_req = SCTP_MIN_RWND;
5533         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5534         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5535                 sctp_misc_ints(SCTP_SORECV_ENTER,
5536                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5537         }
5538         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5539                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5540                     rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5541         }
5542
5543         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5544         if (error) {
5545                 goto release_unlocked;
5546         }
5547         sockbuf_lock = 1;
5548 restart:
5549
5550 restart_nosblocks:
5551         if (hold_sblock == 0) {
5552                 SOCKBUF_LOCK(&so->so_rcv);
5553                 hold_sblock = 1;
5554         }
5555         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5556             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5557                 goto out;
5558         }
5559         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5560                 if (so->so_error) {
5561                         error = so->so_error;
5562                         if ((in_flags & MSG_PEEK) == 0)
5563                                 so->so_error = 0;
5564                         goto out;
5565                 } else {
5566                         if (so->so_rcv.sb_cc == 0) {
5567                                 /* indicate EOF */
5568                                 error = 0;
5569                                 goto out;
5570                         }
5571                 }
5572         }
5573         if (so->so_rcv.sb_cc <= held_length) {
5574                 if (so->so_error) {
5575                         error = so->so_error;
5576                         if ((in_flags & MSG_PEEK) == 0) {
5577                                 so->so_error = 0;
5578                         }
5579                         goto out;
5580                 }
5581                 if ((so->so_rcv.sb_cc == 0) &&
5582                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5583                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5584                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5585                                 /*
5586                                  * For active open side clear flags for
5587                                  * re-use passive open is blocked by
5588                                  * connect.
5589                                  */
5590                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5591                                         /*
5592                                          * You were aborted, passive side
5593                                          * always hits here
5594                                          */
5595                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5596                                         error = ECONNRESET;
5597                                 }
5598                                 so->so_state &= ~(SS_ISCONNECTING |
5599                                     SS_ISDISCONNECTING |
5600                                     SS_ISCONFIRMING |
5601                                     SS_ISCONNECTED);
5602                                 if (error == 0) {
5603                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5604                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5605                                                 error = ENOTCONN;
5606                                         }
5607                                 }
5608                                 goto out;
5609                         }
5610                 }
5611                 if (block_allowed) {
5612                         error = sbwait(&so->so_rcv);
5613                         if (error) {
5614                                 goto out;
5615                         }
5616                         held_length = 0;
5617                         goto restart_nosblocks;
5618                 } else {
5619                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5620                         error = EWOULDBLOCK;
5621                         goto out;
5622                 }
5623         }
5624         if (hold_sblock == 1) {
5625                 SOCKBUF_UNLOCK(&so->so_rcv);
5626                 hold_sblock = 0;
5627         }
5628         /* we possibly have data we can read */
5629         /* sa_ignore FREED_MEMORY */
5630         control = TAILQ_FIRST(&inp->read_queue);
5631         if (control == NULL) {
5632                 /*
5633                  * This could be happening since the appender did the
5634                  * increment but as not yet did the tailq insert onto the
5635                  * read_queue
5636                  */
5637                 if (hold_rlock == 0) {
5638                         SCTP_INP_READ_LOCK(inp);
5639                 }
5640                 control = TAILQ_FIRST(&inp->read_queue);
5641                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5642 #ifdef INVARIANTS
5643                         panic("Huh, its non zero and nothing on control?");
5644 #endif
5645                         so->so_rcv.sb_cc = 0;
5646                 }
5647                 SCTP_INP_READ_UNLOCK(inp);
5648                 hold_rlock = 0;
5649                 goto restart;
5650         }
5651
5652         if ((control->length == 0) &&
5653             (control->do_not_ref_stcb)) {
5654                 /*
5655                  * Clean up code for freeing assoc that left behind a
5656                  * pdapi.. maybe a peer in EEOR that just closed after
5657                  * sending and never indicated a EOR.
5658                  */
5659                 if (hold_rlock == 0) {
5660                         hold_rlock = 1;
5661                         SCTP_INP_READ_LOCK(inp);
5662                 }
5663                 control->held_length = 0;
5664                 if (control->data) {
5665                         /* Hmm there is data here .. fix */
5666                         struct mbuf *m_tmp;
5667                         int cnt = 0;
5668
5669                         m_tmp = control->data;
5670                         while (m_tmp) {
5671                                 cnt += SCTP_BUF_LEN(m_tmp);
5672                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5673                                         control->tail_mbuf = m_tmp;
5674                                         control->end_added = 1;
5675                                 }
5676                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5677                         }
5678                         control->length = cnt;
5679                 } else {
5680                         /* remove it */
5681                         TAILQ_REMOVE(&inp->read_queue, control, next);
5682                         /* Add back any hiddend data */
5683                         sctp_free_remote_addr(control->whoFrom);
5684                         sctp_free_a_readq(stcb, control);
5685                 }
5686                 if (hold_rlock) {
5687                         hold_rlock = 0;
5688                         SCTP_INP_READ_UNLOCK(inp);
5689                 }
5690                 goto restart;
5691         }
5692         if ((control->length == 0) &&
5693             (control->end_added == 1)) {
5694                 /*
5695                  * Do we also need to check for (control->pdapi_aborted ==
5696                  * 1)?
5697                  */
5698                 if (hold_rlock == 0) {
5699                         hold_rlock = 1;
5700                         SCTP_INP_READ_LOCK(inp);
5701                 }
5702                 TAILQ_REMOVE(&inp->read_queue, control, next);
5703                 if (control->data) {
5704 #ifdef INVARIANTS
5705                         panic("control->data not null but control->length == 0");
5706 #else
5707                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5708                         sctp_m_freem(control->data);
5709                         control->data = NULL;
5710 #endif
5711                 }
5712                 if (control->aux_data) {
5713                         sctp_m_free(control->aux_data);
5714                         control->aux_data = NULL;
5715                 }
5716 #ifdef INVARIANTS
5717                 if (control->on_strm_q) {
5718                         panic("About to free ctl:%p so:%p and its in %d",
5719                             control, so, control->on_strm_q);
5720                 }
5721 #endif
5722                 sctp_free_remote_addr(control->whoFrom);
5723                 sctp_free_a_readq(stcb, control);
5724                 if (hold_rlock) {
5725                         hold_rlock = 0;
5726                         SCTP_INP_READ_UNLOCK(inp);
5727                 }
5728                 goto restart;
5729         }
5730         if (control->length == 0) {
5731                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5732                     (filling_sinfo)) {
5733                         /* find a more suitable one then this */
5734                         ctl = TAILQ_NEXT(control, next);
5735                         while (ctl) {
5736                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5737                                     (ctl->some_taken ||
5738                                     (ctl->spec_flags & M_NOTIFICATION) ||
5739                                     ((ctl->do_not_ref_stcb == 0) &&
5740                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5741                                     ) {
5742                                         /*-
5743                                          * If we have a different TCB next, and there is data
5744                                          * present. If we have already taken some (pdapi), OR we can
5745                                          * ref the tcb and no delivery as started on this stream, we
5746                                          * take it. Note we allow a notification on a different
5747                                          * assoc to be delivered..
5748                                          */
5749                                         control = ctl;
5750                                         goto found_one;
5751                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5752                                             (ctl->length) &&
5753                                             ((ctl->some_taken) ||
5754                                             ((ctl->do_not_ref_stcb == 0) &&
5755                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5756                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5757                                         /*-
5758                                          * If we have the same tcb, and there is data present, and we
5759                                          * have the strm interleave feature present. Then if we have
5760                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5761                                          * not started a delivery for this stream, we can take it.
5762                                          * Note we do NOT allow a notificaiton on the same assoc to
5763                                          * be delivered.
5764                                          */
5765                                         control = ctl;
5766                                         goto found_one;
5767                                 }
5768                                 ctl = TAILQ_NEXT(ctl, next);
5769                         }
5770                 }
5771                 /*
5772                  * if we reach here, not suitable replacement is available
5773                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5774                  * into the our held count, and its time to sleep again.
5775                  */
5776                 held_length = so->so_rcv.sb_cc;
5777                 control->held_length = so->so_rcv.sb_cc;
5778                 goto restart;
5779         }
5780         /* Clear the held length since there is something to read */
5781         control->held_length = 0;
5782 found_one:
5783         /*
5784          * If we reach here, control has a some data for us to read off.
5785          * Note that stcb COULD be NULL.
5786          */
5787         if (hold_rlock == 0) {
5788                 hold_rlock = 1;
5789                 SCTP_INP_READ_LOCK(inp);
5790         }
5791         control->some_taken++;
5792         stcb = control->stcb;
5793         if (stcb) {
5794                 if ((control->do_not_ref_stcb == 0) &&
5795                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5796                         if (freecnt_applied == 0)
5797                                 stcb = NULL;
5798                 } else if (control->do_not_ref_stcb == 0) {
5799                         /* you can't free it on me please */
5800                         /*
5801                          * The lock on the socket buffer protects us so the
5802                          * free code will stop. But since we used the
5803                          * socketbuf lock and the sender uses the tcb_lock
5804                          * to increment, we need to use the atomic add to
5805                          * the refcnt
5806                          */
5807                         if (freecnt_applied) {
5808 #ifdef INVARIANTS
5809                                 panic("refcnt already incremented");
5810 #else
5811                                 SCTP_PRINTF("refcnt already incremented?\n");
5812 #endif
5813                         } else {
5814                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5815                                 freecnt_applied = 1;
5816                         }
5817                         /*
5818                          * Setup to remember how much we have not yet told
5819                          * the peer our rwnd has opened up. Note we grab the
5820                          * value from the tcb from last time. Note too that
5821                          * sack sending clears this when a sack is sent,
5822                          * which is fine. Once we hit the rwnd_req, we then
5823                          * will go to the sctp_user_rcvd() that will not
5824                          * lock until it KNOWs it MUST send a WUP-SACK.
5825                          */
5826                         freed_so_far = (uint32_t)stcb->freed_by_sorcv_sincelast;
5827                         stcb->freed_by_sorcv_sincelast = 0;
5828                 }
5829         }
5830         if (stcb &&
5831             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5832             control->do_not_ref_stcb == 0) {
5833                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5834         }
5835
5836         /* First lets get off the sinfo and sockaddr info */
5837         if ((sinfo != NULL) && (filling_sinfo != 0)) {
5838                 sinfo->sinfo_stream = control->sinfo_stream;
5839                 sinfo->sinfo_ssn = (uint16_t)control->mid;
5840                 sinfo->sinfo_flags = control->sinfo_flags;
5841                 sinfo->sinfo_ppid = control->sinfo_ppid;
5842                 sinfo->sinfo_context = control->sinfo_context;
5843                 sinfo->sinfo_timetolive = control->sinfo_timetolive;
5844                 sinfo->sinfo_tsn = control->sinfo_tsn;
5845                 sinfo->sinfo_cumtsn = control->sinfo_cumtsn;
5846                 sinfo->sinfo_assoc_id = control->sinfo_assoc_id;
5847                 nxt = TAILQ_NEXT(control, next);
5848                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5849                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5850                         struct sctp_extrcvinfo *s_extra;
5851
5852                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5853                         if ((nxt) &&
5854                             (nxt->length)) {
5855                                 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5856                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5857                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5858                                 }
5859                                 if (nxt->spec_flags & M_NOTIFICATION) {
5860                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5861                                 }
5862                                 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id;
5863                                 s_extra->serinfo_next_length = nxt->length;
5864                                 s_extra->serinfo_next_ppid = nxt->sinfo_ppid;
5865                                 s_extra->serinfo_next_stream = nxt->sinfo_stream;
5866                                 if (nxt->tail_mbuf != NULL) {
5867                                         if (nxt->end_added) {
5868                                                 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5869                                         }
5870                                 }
5871                         } else {
5872                                 /*
5873                                  * we explicitly 0 this, since the memcpy
5874                                  * got some other things beyond the older
5875                                  * sinfo_ that is on the control's structure
5876                                  * :-D
5877                                  */
5878                                 nxt = NULL;
5879                                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
5880                                 s_extra->serinfo_next_aid = 0;
5881                                 s_extra->serinfo_next_length = 0;
5882                                 s_extra->serinfo_next_ppid = 0;
5883                                 s_extra->serinfo_next_stream = 0;
5884                         }
5885                 }
5886                 /*
5887                  * update off the real current cum-ack, if we have an stcb.
5888                  */
5889                 if ((control->do_not_ref_stcb == 0) && stcb)
5890                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5891                 /*
5892                  * mask off the high bits, we keep the actual chunk bits in
5893                  * there.
5894                  */
5895                 sinfo->sinfo_flags &= 0x00ff;
5896                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5897                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5898                 }
5899         }
5900 #ifdef SCTP_ASOCLOG_OF_TSNS
5901         {
5902                 int index, newindex;
5903                 struct sctp_pcbtsn_rlog *entry;
5904
5905                 do {
5906                         index = inp->readlog_index;
5907                         newindex = index + 1;
5908                         if (newindex >= SCTP_READ_LOG_SIZE) {
5909                                 newindex = 0;
5910                         }
5911                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5912                 entry = &inp->readlog[index];
5913                 entry->vtag = control->sinfo_assoc_id;
5914                 entry->strm = control->sinfo_stream;
5915                 entry->seq = (uint16_t)control->mid;
5916                 entry->sz = control->length;
5917                 entry->flgs = control->sinfo_flags;
5918         }
5919 #endif
5920         if ((fromlen > 0) && (from != NULL)) {
5921                 union sctp_sockstore store;
5922                 size_t len;
5923
5924                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5925 #ifdef INET6
5926                 case AF_INET6:
5927                         len = sizeof(struct sockaddr_in6);
5928                         store.sin6 = control->whoFrom->ro._l_addr.sin6;
5929                         store.sin6.sin6_port = control->port_from;
5930                         break;
5931 #endif
5932 #ifdef INET
5933                 case AF_INET:
5934 #ifdef INET6
5935                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5936                                 len = sizeof(struct sockaddr_in6);
5937                                 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5938                                     &store.sin6);
5939                                 store.sin6.sin6_port = control->port_from;
5940                         } else {
5941                                 len = sizeof(struct sockaddr_in);
5942                                 store.sin = control->whoFrom->ro._l_addr.sin;
5943                                 store.sin.sin_port = control->port_from;
5944                         }
5945 #else
5946                         len = sizeof(struct sockaddr_in);
5947                         store.sin = control->whoFrom->ro._l_addr.sin;
5948                         store.sin.sin_port = control->port_from;
5949 #endif
5950                         break;
5951 #endif
5952                 default:
5953                         len = 0;
5954                         break;
5955                 }
5956                 memcpy(from, &store, min((size_t)fromlen, len));
5957 #ifdef INET6
5958                 {
5959                         struct sockaddr_in6 lsa6, *from6;
5960
5961                         from6 = (struct sockaddr_in6 *)from;
5962                         sctp_recover_scope_mac(from6, (&lsa6));
5963                 }
5964 #endif
5965         }
5966         if (hold_rlock) {
5967                 SCTP_INP_READ_UNLOCK(inp);
5968                 hold_rlock = 0;
5969         }
5970         if (hold_sblock) {
5971                 SOCKBUF_UNLOCK(&so->so_rcv);
5972                 hold_sblock = 0;
5973         }
5974         /* now copy out what data we can */
5975         if (mp == NULL) {
5976                 /* copy out each mbuf in the chain up to length */
5977 get_more_data:
5978                 m = control->data;
5979                 while (m) {
5980                         /* Move out all we can */
5981                         cp_len = uio->uio_resid;
5982                         my_len = SCTP_BUF_LEN(m);
5983                         if (cp_len > my_len) {
5984                                 /* not enough in this buf */
5985                                 cp_len = my_len;
5986                         }
5987                         if (hold_rlock) {
5988                                 SCTP_INP_READ_UNLOCK(inp);
5989                                 hold_rlock = 0;
5990                         }
5991                         if (cp_len > 0)
5992                                 error = uiomove(mtod(m, char *), (int)cp_len, uio);
5993                         /* re-read */
5994                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5995                                 goto release;
5996                         }
5997
5998                         if ((control->do_not_ref_stcb == 0) && stcb &&
5999                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
6000                                 no_rcv_needed = 1;
6001                         }
6002                         if (error) {
6003                                 /* error we are out of here */
6004                                 goto release;
6005                         }
6006                         SCTP_INP_READ_LOCK(inp);
6007                         hold_rlock = 1;
6008                         if (cp_len == SCTP_BUF_LEN(m)) {
6009                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
6010                                     (control->end_added)) {
6011                                         out_flags |= MSG_EOR;
6012                                         if ((control->do_not_ref_stcb == 0) &&
6013                                             (control->stcb != NULL) &&
6014                                             ((control->spec_flags & M_NOTIFICATION) == 0))
6015                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6016                                 }
6017                                 if (control->spec_flags & M_NOTIFICATION) {
6018                                         out_flags |= MSG_NOTIFICATION;
6019                                 }
6020                                 /* we ate up the mbuf */
6021                                 if (in_flags & MSG_PEEK) {
6022                                         /* just looking */
6023                                         m = SCTP_BUF_NEXT(m);
6024                                         copied_so_far += cp_len;
6025                                 } else {
6026                                         /* dispose of the mbuf */
6027                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6028                                                 sctp_sblog(&so->so_rcv,
6029                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6030                                         }
6031                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6032                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6033                                                 sctp_sblog(&so->so_rcv,
6034                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6035                                         }
6036                                         copied_so_far += cp_len;
6037                                         freed_so_far += (uint32_t)cp_len;
6038                                         freed_so_far += MSIZE;
6039                                         atomic_subtract_int(&control->length, cp_len);
6040                                         control->data = sctp_m_free(m);
6041                                         m = control->data;
6042                                         /*
6043                                          * been through it all, must hold sb
6044                                          * lock ok to null tail
6045                                          */
6046                                         if (control->data == NULL) {
6047 #ifdef INVARIANTS
6048                                                 if ((control->end_added == 0) ||
6049                                                     (TAILQ_NEXT(control, next) == NULL)) {
6050                                                         /*
6051                                                          * If the end is not
6052                                                          * added, OR the
6053                                                          * next is NOT null
6054                                                          * we MUST have the
6055                                                          * lock.
6056                                                          */
6057                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
6058                                                                 panic("Hmm we don't own the lock?");
6059                                                         }
6060                                                 }
6061 #endif
6062                                                 control->tail_mbuf = NULL;
6063 #ifdef INVARIANTS
6064                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
6065                                                         panic("end_added, nothing left and no MSG_EOR");
6066                                                 }
6067 #endif
6068                                         }
6069                                 }
6070                         } else {
6071                                 /* Do we need to trim the mbuf? */
6072                                 if (control->spec_flags & M_NOTIFICATION) {
6073                                         out_flags |= MSG_NOTIFICATION;
6074                                 }
6075                                 if ((in_flags & MSG_PEEK) == 0) {
6076                                         SCTP_BUF_RESV_UF(m, cp_len);
6077                                         SCTP_BUF_LEN(m) -= (int)cp_len;
6078                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6079                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, (int)cp_len);
6080                                         }
6081                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
6082                                         if ((control->do_not_ref_stcb == 0) &&
6083                                             stcb) {
6084                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
6085                                         }
6086                                         copied_so_far += cp_len;
6087                                         freed_so_far += (uint32_t)cp_len;
6088                                         freed_so_far += MSIZE;
6089                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6090                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
6091                                                     SCTP_LOG_SBRESULT, 0);
6092                                         }
6093                                         atomic_subtract_int(&control->length, cp_len);
6094                                 } else {
6095                                         copied_so_far += cp_len;
6096                                 }
6097                         }
6098                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
6099                                 break;
6100                         }
6101                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
6102                             (control->do_not_ref_stcb == 0) &&
6103                             (freed_so_far >= rwnd_req)) {
6104                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6105                         }
6106                 }               /* end while(m) */
6107                 /*
6108                  * At this point we have looked at it all and we either have
6109                  * a MSG_EOR/or read all the user wants... <OR>
6110                  * control->length == 0.
6111                  */
6112                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
6113                         /* we are done with this control */
6114                         if (control->length == 0) {
6115                                 if (control->data) {
6116 #ifdef INVARIANTS
6117                                         panic("control->data not null at read eor?");
6118 #else
6119                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
6120                                         sctp_m_freem(control->data);
6121                                         control->data = NULL;
6122 #endif
6123                                 }
6124                 done_with_control:
6125                                 if (hold_rlock == 0) {
6126                                         SCTP_INP_READ_LOCK(inp);
6127                                         hold_rlock = 1;
6128                                 }
6129                                 TAILQ_REMOVE(&inp->read_queue, control, next);
6130                                 /* Add back any hiddend data */
6131                                 if (control->held_length) {
6132                                         held_length = 0;
6133                                         control->held_length = 0;
6134                                         wakeup_read_socket = 1;
6135                                 }
6136                                 if (control->aux_data) {
6137                                         sctp_m_free(control->aux_data);
6138                                         control->aux_data = NULL;
6139                                 }
6140                                 no_rcv_needed = control->do_not_ref_stcb;
6141                                 sctp_free_remote_addr(control->whoFrom);
6142                                 control->data = NULL;
6143 #ifdef INVARIANTS
6144                                 if (control->on_strm_q) {
6145                                         panic("About to free ctl:%p so:%p and its in %d",
6146                                             control, so, control->on_strm_q);
6147                                 }
6148 #endif
6149                                 sctp_free_a_readq(stcb, control);
6150                                 control = NULL;
6151                                 if ((freed_so_far >= rwnd_req) &&
6152                                     (no_rcv_needed == 0))
6153                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6154
6155                         } else {
6156                                 /*
6157                                  * The user did not read all of this
6158                                  * message, turn off the returned MSG_EOR
6159                                  * since we are leaving more behind on the
6160                                  * control to read.
6161                                  */
6162 #ifdef INVARIANTS
6163                                 if (control->end_added &&
6164                                     (control->data == NULL) &&
6165                                     (control->tail_mbuf == NULL)) {
6166                                         panic("Gak, control->length is corrupt?");
6167                                 }
6168 #endif
6169                                 no_rcv_needed = control->do_not_ref_stcb;
6170                                 out_flags &= ~MSG_EOR;
6171                         }
6172                 }
6173                 if (out_flags & MSG_EOR) {
6174                         goto release;
6175                 }
6176                 if ((uio->uio_resid == 0) ||
6177                     ((in_eeor_mode) &&
6178                     (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))) {
6179                         goto release;
6180                 }
6181                 /*
6182                  * If I hit here the receiver wants more and this message is
6183                  * NOT done (pd-api). So two questions. Can we block? if not
6184                  * we are done. Did the user NOT set MSG_WAITALL?
6185                  */
6186                 if (block_allowed == 0) {
6187                         goto release;
6188                 }
6189                 /*
6190                  * We need to wait for more data a few things: - We don't
6191                  * sbunlock() so we don't get someone else reading. - We
6192                  * must be sure to account for the case where what is added
6193                  * is NOT to our control when we wakeup.
6194                  */
6195
6196                 /*
6197                  * Do we need to tell the transport a rwnd update might be
6198                  * needed before we go to sleep?
6199                  */
6200                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
6201                     ((freed_so_far >= rwnd_req) &&
6202                     (control->do_not_ref_stcb == 0) &&
6203                     (no_rcv_needed == 0))) {
6204                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6205                 }
6206 wait_some_more:
6207                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
6208                         goto release;
6209                 }
6210
6211                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
6212                         goto release;
6213
6214                 if (hold_rlock == 1) {
6215                         SCTP_INP_READ_UNLOCK(inp);
6216                         hold_rlock = 0;
6217                 }
6218                 if (hold_sblock == 0) {
6219                         SOCKBUF_LOCK(&so->so_rcv);
6220                         hold_sblock = 1;
6221                 }
6222                 if ((copied_so_far) && (control->length == 0) &&
6223                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
6224                         goto release;
6225                 }
6226                 if (so->so_rcv.sb_cc <= control->held_length) {
6227                         error = sbwait(&so->so_rcv);
6228                         if (error) {
6229                                 goto release;
6230                         }
6231                         control->held_length = 0;
6232                 }
6233                 if (hold_sblock) {
6234                         SOCKBUF_UNLOCK(&so->so_rcv);
6235                         hold_sblock = 0;
6236                 }
6237                 if (control->length == 0) {
6238                         /* still nothing here */
6239                         if (control->end_added == 1) {
6240                                 /* he aborted, or is done i.e.did a shutdown */
6241                                 out_flags |= MSG_EOR;
6242                                 if (control->pdapi_aborted) {
6243                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6244                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6245
6246                                         out_flags |= MSG_TRUNC;
6247                                 } else {
6248                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6249                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6250                                 }
6251                                 goto done_with_control;
6252                         }
6253                         if (so->so_rcv.sb_cc > held_length) {
6254                                 control->held_length = so->so_rcv.sb_cc;
6255                                 held_length = 0;
6256                         }
6257                         goto wait_some_more;
6258                 } else if (control->data == NULL) {
6259                         /*
6260                          * we must re-sync since data is probably being
6261                          * added
6262                          */
6263                         SCTP_INP_READ_LOCK(inp);
6264                         if ((control->length > 0) && (control->data == NULL)) {
6265                                 /*
6266                                  * big trouble.. we have the lock and its
6267                                  * corrupt?
6268                                  */
6269 #ifdef INVARIANTS
6270                                 panic("Impossible data==NULL length !=0");
6271 #endif
6272                                 out_flags |= MSG_EOR;
6273                                 out_flags |= MSG_TRUNC;
6274                                 control->length = 0;
6275                                 SCTP_INP_READ_UNLOCK(inp);
6276                                 goto done_with_control;
6277                         }
6278                         SCTP_INP_READ_UNLOCK(inp);
6279                         /* We will fall around to get more data */
6280                 }
6281                 goto get_more_data;
6282         } else {
6283                 /*-
6284                  * Give caller back the mbuf chain,
6285                  * store in uio_resid the length
6286                  */
6287                 wakeup_read_socket = 0;
6288                 if ((control->end_added == 0) ||
6289                     (TAILQ_NEXT(control, next) == NULL)) {
6290                         /* Need to get rlock */
6291                         if (hold_rlock == 0) {
6292                                 SCTP_INP_READ_LOCK(inp);
6293                                 hold_rlock = 1;
6294                         }
6295                 }
6296                 if (control->end_added) {
6297                         out_flags |= MSG_EOR;
6298                         if ((control->do_not_ref_stcb == 0) &&
6299                             (control->stcb != NULL) &&
6300                             ((control->spec_flags & M_NOTIFICATION) == 0))
6301                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6302                 }
6303                 if (control->spec_flags & M_NOTIFICATION) {
6304                         out_flags |= MSG_NOTIFICATION;
6305                 }
6306                 uio->uio_resid = control->length;
6307                 *mp = control->data;
6308                 m = control->data;
6309                 while (m) {
6310                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6311                                 sctp_sblog(&so->so_rcv,
6312                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6313                         }
6314                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6315                         freed_so_far += (uint32_t)SCTP_BUF_LEN(m);
6316                         freed_so_far += MSIZE;
6317                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6318                                 sctp_sblog(&so->so_rcv,
6319                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6320                         }
6321                         m = SCTP_BUF_NEXT(m);
6322                 }
6323                 control->data = control->tail_mbuf = NULL;
6324                 control->length = 0;
6325                 if (out_flags & MSG_EOR) {
6326                         /* Done with this control */
6327                         goto done_with_control;
6328                 }
6329         }
6330 release:
6331         if (hold_rlock == 1) {
6332                 SCTP_INP_READ_UNLOCK(inp);
6333                 hold_rlock = 0;
6334         }
6335         if (hold_sblock == 1) {
6336                 SOCKBUF_UNLOCK(&so->so_rcv);
6337                 hold_sblock = 0;
6338         }
6339
6340         sbunlock(&so->so_rcv);
6341         sockbuf_lock = 0;
6342
6343 release_unlocked:
6344         if (hold_sblock) {
6345                 SOCKBUF_UNLOCK(&so->so_rcv);
6346                 hold_sblock = 0;
6347         }
6348         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6349                 if ((freed_so_far >= rwnd_req) &&
6350                     (control && (control->do_not_ref_stcb == 0)) &&
6351                     (no_rcv_needed == 0))
6352                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6353         }
6354 out:
6355         if (msg_flags) {
6356                 *msg_flags = out_flags;
6357         }
6358         if (((out_flags & MSG_EOR) == 0) &&
6359             ((in_flags & MSG_PEEK) == 0) &&
6360             (sinfo) &&
6361             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6362             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6363                 struct sctp_extrcvinfo *s_extra;
6364
6365                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6366                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
6367         }
6368         if (hold_rlock == 1) {
6369                 SCTP_INP_READ_UNLOCK(inp);
6370         }
6371         if (hold_sblock) {
6372                 SOCKBUF_UNLOCK(&so->so_rcv);
6373         }
6374         if (sockbuf_lock) {
6375                 sbunlock(&so->so_rcv);
6376         }
6377
6378         if (freecnt_applied) {
6379                 /*
6380                  * The lock on the socket buffer protects us so the free
6381                  * code will stop. But since we used the socketbuf lock and
6382                  * the sender uses the tcb_lock to increment, we need to use
6383                  * the atomic add to the refcnt.
6384                  */
6385                 if (stcb == NULL) {
6386 #ifdef INVARIANTS
6387                         panic("stcb for refcnt has gone NULL?");
6388                         goto stage_left;
6389 #else
6390                         goto stage_left;
6391 #endif
6392                 }
6393                 /* Save the value back for next time */
6394                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6395                 atomic_add_int(&stcb->asoc.refcnt, -1);
6396         }
6397         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6398                 if (stcb) {
6399                         sctp_misc_ints(SCTP_SORECV_DONE,
6400                             freed_so_far,
6401                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6402                             stcb->asoc.my_rwnd,
6403                             so->so_rcv.sb_cc);
6404                 } else {
6405                         sctp_misc_ints(SCTP_SORECV_DONE,
6406                             freed_so_far,
6407                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6408                             0,
6409                             so->so_rcv.sb_cc);
6410                 }
6411         }
6412 stage_left:
6413         if (wakeup_read_socket) {
6414                 sctp_sorwakeup(inp, so);
6415         }
6416         return (error);
6417 }
6418
6419 #ifdef SCTP_MBUF_LOGGING
6420 struct mbuf *
6421 sctp_m_free(struct mbuf *m)
6422 {
6423         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6424                 sctp_log_mb(m, SCTP_MBUF_IFREE);
6425         }
6426         return (m_free(m));
6427 }
6428
6429 void
6430 sctp_m_freem(struct mbuf *mb)
6431 {
6432         while (mb != NULL)
6433                 mb = sctp_m_free(mb);
6434 }
6435
6436 #endif
6437
6438 int
6439 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6440 {
6441         /*
6442          * Given a local address. For all associations that holds the
6443          * address, request a peer-set-primary.
6444          */
6445         struct sctp_ifa *ifa;
6446         struct sctp_laddr *wi;
6447
6448         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
6449         if (ifa == NULL) {
6450                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6451                 return (EADDRNOTAVAIL);
6452         }
6453         /*
6454          * Now that we have the ifa we must awaken the iterator with this
6455          * message.
6456          */
6457         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6458         if (wi == NULL) {
6459                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6460                 return (ENOMEM);
6461         }
6462         /* Now incr the count and int wi structure */
6463         SCTP_INCR_LADDR_COUNT();
6464         memset(wi, 0, sizeof(*wi));
6465         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6466         wi->ifa = ifa;
6467         wi->action = SCTP_SET_PRIM_ADDR;
6468         atomic_add_int(&ifa->refcount, 1);
6469
6470         /* Now add it to the work queue */
6471         SCTP_WQ_ADDR_LOCK();
6472         /*
6473          * Should this really be a tailq? As it is we will process the
6474          * newest first :-0
6475          */
6476         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6477         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6478             (struct sctp_inpcb *)NULL,
6479             (struct sctp_tcb *)NULL,
6480             (struct sctp_nets *)NULL);
6481         SCTP_WQ_ADDR_UNLOCK();
6482         return (0);
6483 }
6484
6485 int
6486 sctp_soreceive(struct socket *so,
6487     struct sockaddr **psa,
6488     struct uio *uio,
6489     struct mbuf **mp0,
6490     struct mbuf **controlp,
6491     int *flagsp)
6492 {
6493         int error, fromlen;
6494         uint8_t sockbuf[256];
6495         struct sockaddr *from;
6496         struct sctp_extrcvinfo sinfo;
6497         int filling_sinfo = 1;
6498         int flags;
6499         struct sctp_inpcb *inp;
6500
6501         inp = (struct sctp_inpcb *)so->so_pcb;
6502         /* pickup the assoc we are reading from */
6503         if (inp == NULL) {
6504                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6505                 return (EINVAL);
6506         }
6507         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6508             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6509             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6510             (controlp == NULL)) {
6511                 /* user does not want the sndrcv ctl */
6512                 filling_sinfo = 0;
6513         }
6514         if (psa) {
6515                 from = (struct sockaddr *)sockbuf;
6516                 fromlen = sizeof(sockbuf);
6517                 from->sa_len = 0;
6518         } else {
6519                 from = NULL;
6520                 fromlen = 0;
6521         }
6522
6523         if (filling_sinfo) {
6524                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6525         }
6526         if (flagsp != NULL) {
6527                 flags = *flagsp;
6528         } else {
6529                 flags = 0;
6530         }
6531         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, &flags,
6532             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6533         if (flagsp != NULL) {
6534                 *flagsp = flags;
6535         }
6536         if (controlp != NULL) {
6537                 /* copy back the sinfo in a CMSG format */
6538                 if (filling_sinfo && ((flags & MSG_NOTIFICATION) == 0)) {
6539                         *controlp = sctp_build_ctl_nchunk(inp,
6540                             (struct sctp_sndrcvinfo *)&sinfo);
6541                 } else {
6542                         *controlp = NULL;
6543                 }
6544         }
6545         if (psa) {
6546                 /* copy back the address info */
6547                 if (from && from->sa_len) {
6548                         *psa = sodupsockaddr(from, M_NOWAIT);
6549                 } else {
6550                         *psa = NULL;
6551                 }
6552         }
6553         return (error);
6554 }
6555
6556 int
6557 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6558     int totaddr, int *error)
6559 {
6560         int added = 0;
6561         int i;
6562         struct sctp_inpcb *inp;
6563         struct sockaddr *sa;
6564         size_t incr = 0;
6565 #ifdef INET
6566         struct sockaddr_in *sin;
6567 #endif
6568 #ifdef INET6
6569         struct sockaddr_in6 *sin6;
6570 #endif
6571
6572         sa = addr;
6573         inp = stcb->sctp_ep;
6574         *error = 0;
6575         for (i = 0; i < totaddr; i++) {
6576                 switch (sa->sa_family) {
6577 #ifdef INET
6578                 case AF_INET:
6579                         incr = sizeof(struct sockaddr_in);
6580                         sin = (struct sockaddr_in *)sa;
6581                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6582                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6583                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6584                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6585                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6586                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_7);
6587                                 *error = EINVAL;
6588                                 goto out_now;
6589                         }
6590                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6591                             SCTP_DONOT_SETSCOPE,
6592                             SCTP_ADDR_IS_CONFIRMED)) {
6593                                 /* assoc gone no un-lock */
6594                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6595                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6596                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_8);
6597                                 *error = ENOBUFS;
6598                                 goto out_now;
6599                         }
6600                         added++;
6601                         break;
6602 #endif
6603 #ifdef INET6
6604                 case AF_INET6:
6605                         incr = sizeof(struct sockaddr_in6);
6606                         sin6 = (struct sockaddr_in6 *)sa;
6607                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6608                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6609                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6610                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6611                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_9);
6612                                 *error = EINVAL;
6613                                 goto out_now;
6614                         }
6615                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6616                             SCTP_DONOT_SETSCOPE,
6617                             SCTP_ADDR_IS_CONFIRMED)) {
6618                                 /* assoc gone no un-lock */
6619                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6620                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6621                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_10);
6622                                 *error = ENOBUFS;
6623                                 goto out_now;
6624                         }
6625                         added++;
6626                         break;
6627 #endif
6628                 default:
6629                         break;
6630                 }
6631                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6632         }
6633 out_now:
6634         return (added);
6635 }
6636
6637 int
6638 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6639     unsigned int totaddr,
6640     unsigned int *num_v4, unsigned int *num_v6,
6641     unsigned int limit)
6642 {
6643         struct sockaddr *sa;
6644         struct sctp_tcb *stcb;
6645         unsigned int incr, at, i;
6646
6647         at = 0;
6648         sa = addr;
6649         *num_v6 = *num_v4 = 0;
6650         /* account and validate addresses */
6651         if (totaddr == 0) {
6652                 return (EINVAL);
6653         }
6654         for (i = 0; i < totaddr; i++) {
6655                 if (at + sizeof(struct sockaddr) > limit) {
6656                         return (EINVAL);
6657                 }
6658                 switch (sa->sa_family) {
6659 #ifdef INET
6660                 case AF_INET:
6661                         incr = (unsigned int)sizeof(struct sockaddr_in);
6662                         if (sa->sa_len != incr) {
6663                                 return (EINVAL);
6664                         }
6665                         (*num_v4) += 1;
6666                         break;
6667 #endif
6668 #ifdef INET6
6669                 case AF_INET6:
6670                         {
6671                                 struct sockaddr_in6 *sin6;
6672
6673                                 sin6 = (struct sockaddr_in6 *)sa;
6674                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6675                                         /* Must be non-mapped for connectx */
6676                                         return (EINVAL);
6677                                 }
6678                                 incr = (unsigned int)sizeof(struct sockaddr_in6);
6679                                 if (sa->sa_len != incr) {
6680                                         return (EINVAL);
6681                                 }
6682                                 (*num_v6) += 1;
6683                                 break;
6684                         }
6685 #endif
6686                 default:
6687                         return (EINVAL);
6688                 }
6689                 if ((at + incr) > limit) {
6690                         return (EINVAL);
6691                 }
6692                 SCTP_INP_INCR_REF(inp);
6693                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6694                 if (stcb != NULL) {
6695                         SCTP_TCB_UNLOCK(stcb);
6696                         return (EALREADY);
6697                 } else {
6698                         SCTP_INP_DECR_REF(inp);
6699                 }
6700                 at += incr;
6701                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6702         }
6703         return (0);
6704 }
6705
6706 /*
6707  * sctp_bindx(ADD) for one address.
6708  * assumes all arguments are valid/checked by caller.
6709  */
6710 void
6711 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6712     struct sockaddr *sa, uint32_t vrf_id, int *error,
6713     void *p)
6714 {
6715 #if defined(INET) && defined(INET6)
6716         struct sockaddr_in sin;
6717 #endif
6718 #ifdef INET6
6719         struct sockaddr_in6 *sin6;
6720 #endif
6721 #ifdef INET
6722         struct sockaddr_in *sinp;
6723 #endif
6724         struct sockaddr *addr_to_use;
6725         struct sctp_inpcb *lep;
6726         uint16_t port;
6727
6728         /* see if we're bound all already! */
6729         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6730                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6731                 *error = EINVAL;
6732                 return;
6733         }
6734         switch (sa->sa_family) {
6735 #ifdef INET6
6736         case AF_INET6:
6737                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6738                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6739                         *error = EINVAL;
6740                         return;
6741                 }
6742                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6743                         /* can only bind v6 on PF_INET6 sockets */
6744                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6745                         *error = EINVAL;
6746                         return;
6747                 }
6748                 sin6 = (struct sockaddr_in6 *)sa;
6749                 port = sin6->sin6_port;
6750 #ifdef INET
6751                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6752                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6753                             SCTP_IPV6_V6ONLY(inp)) {
6754                                 /* can't bind v4-mapped on PF_INET sockets */
6755                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6756                                 *error = EINVAL;
6757                                 return;
6758                         }
6759                         in6_sin6_2_sin(&sin, sin6);
6760                         addr_to_use = (struct sockaddr *)&sin;
6761                 } else {
6762                         addr_to_use = sa;
6763                 }
6764 #else
6765                 addr_to_use = sa;
6766 #endif
6767                 break;
6768 #endif
6769 #ifdef INET
6770         case AF_INET:
6771                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6772                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6773                         *error = EINVAL;
6774                         return;
6775                 }
6776                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6777                     SCTP_IPV6_V6ONLY(inp)) {
6778                         /* can't bind v4 on PF_INET sockets */
6779                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6780                         *error = EINVAL;
6781                         return;
6782                 }
6783                 sinp = (struct sockaddr_in *)sa;
6784                 port = sinp->sin_port;
6785                 addr_to_use = sa;
6786                 break;
6787 #endif
6788         default:
6789                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6790                 *error = EINVAL;
6791                 return;
6792         }
6793         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6794                 if (p == NULL) {
6795                         /* Can't get proc for Net/Open BSD */
6796                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6797                         *error = EINVAL;
6798                         return;
6799                 }
6800                 *error = sctp_inpcb_bind(so, addr_to_use, NULL, p);
6801                 return;
6802         }
6803         /* Validate the incoming port. */
6804         if ((port != 0) && (port != inp->sctp_lport)) {
6805                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6806                 *error = EINVAL;
6807                 return;
6808         }
6809         lep = sctp_pcb_findep(addr_to_use, 1, 0, vrf_id);
6810         if (lep == NULL) {
6811                 /* add the address */
6812                 *error = sctp_addr_mgmt_ep_sa(inp, addr_to_use,
6813                     SCTP_ADD_IP_ADDRESS, vrf_id);
6814         } else {
6815                 if (lep != inp) {
6816                         *error = EADDRINUSE;
6817                 }
6818                 SCTP_INP_DECR_REF(lep);
6819         }
6820 }
6821
6822 /*
6823  * sctp_bindx(DELETE) for one address.
6824  * assumes all arguments are valid/checked by caller.
6825  */
6826 void
6827 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6828     struct sockaddr *sa, uint32_t vrf_id, int *error)
6829 {
6830         struct sockaddr *addr_to_use;
6831 #if defined(INET) && defined(INET6)
6832         struct sockaddr_in6 *sin6;
6833         struct sockaddr_in sin;
6834 #endif
6835
6836         /* see if we're bound all already! */
6837         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6838                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6839                 *error = EINVAL;
6840                 return;
6841         }
6842         switch (sa->sa_family) {
6843 #ifdef INET6
6844         case AF_INET6:
6845                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6846                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6847                         *error = EINVAL;
6848                         return;
6849                 }
6850                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6851                         /* can only bind v6 on PF_INET6 sockets */
6852                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6853                         *error = EINVAL;
6854                         return;
6855                 }
6856 #ifdef INET
6857                 sin6 = (struct sockaddr_in6 *)sa;
6858                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6859                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6860                             SCTP_IPV6_V6ONLY(inp)) {
6861                                 /* can't bind mapped-v4 on PF_INET sockets */
6862                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6863                                 *error = EINVAL;
6864                                 return;
6865                         }
6866                         in6_sin6_2_sin(&sin, sin6);
6867                         addr_to_use = (struct sockaddr *)&sin;
6868                 } else {
6869                         addr_to_use = sa;
6870                 }
6871 #else
6872                 addr_to_use = sa;
6873 #endif
6874                 break;
6875 #endif
6876 #ifdef INET
6877         case AF_INET:
6878                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6879                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6880                         *error = EINVAL;
6881                         return;
6882                 }
6883                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6884                     SCTP_IPV6_V6ONLY(inp)) {
6885                         /* can't bind v4 on PF_INET sockets */
6886                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6887                         *error = EINVAL;
6888                         return;
6889                 }
6890                 addr_to_use = sa;
6891                 break;
6892 #endif
6893         default:
6894                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6895                 *error = EINVAL;
6896                 return;
6897         }
6898         /* No lock required mgmt_ep_sa does its own locking. */
6899         *error = sctp_addr_mgmt_ep_sa(inp, addr_to_use, SCTP_DEL_IP_ADDRESS,
6900             vrf_id);
6901 }
6902
6903 /*
6904  * returns the valid local address count for an assoc, taking into account
6905  * all scoping rules
6906  */
6907 int
6908 sctp_local_addr_count(struct sctp_tcb *stcb)
6909 {
6910         int loopback_scope;
6911 #if defined(INET)
6912         int ipv4_local_scope, ipv4_addr_legal;
6913 #endif
6914 #if defined(INET6)
6915         int local_scope, site_scope, ipv6_addr_legal;
6916 #endif
6917         struct sctp_vrf *vrf;
6918         struct sctp_ifn *sctp_ifn;
6919         struct sctp_ifa *sctp_ifa;
6920         int count = 0;
6921
6922         /* Turn on all the appropriate scopes */
6923         loopback_scope = stcb->asoc.scope.loopback_scope;
6924 #if defined(INET)
6925         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6926         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6927 #endif
6928 #if defined(INET6)
6929         local_scope = stcb->asoc.scope.local_scope;
6930         site_scope = stcb->asoc.scope.site_scope;
6931         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6932 #endif
6933         SCTP_IPI_ADDR_RLOCK();
6934         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6935         if (vrf == NULL) {
6936                 /* no vrf, no addresses */
6937                 SCTP_IPI_ADDR_RUNLOCK();
6938                 return (0);
6939         }
6940
6941         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6942                 /*
6943                  * bound all case: go through all ifns on the vrf
6944                  */
6945                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6946                         if ((loopback_scope == 0) &&
6947                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6948                                 continue;
6949                         }
6950                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6951                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6952                                         continue;
6953                                 switch (sctp_ifa->address.sa.sa_family) {
6954 #ifdef INET
6955                                 case AF_INET:
6956                                         if (ipv4_addr_legal) {
6957                                                 struct sockaddr_in *sin;
6958
6959                                                 sin = &sctp_ifa->address.sin;
6960                                                 if (sin->sin_addr.s_addr == 0) {
6961                                                         /*
6962                                                          * skip unspecified
6963                                                          * addrs
6964                                                          */
6965                                                         continue;
6966                                                 }
6967                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
6968                                                     &sin->sin_addr) != 0) {
6969                                                         continue;
6970                                                 }
6971                                                 if ((ipv4_local_scope == 0) &&
6972                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6973                                                         continue;
6974                                                 }
6975                                                 /* count this one */
6976                                                 count++;
6977                                         } else {
6978                                                 continue;
6979                                         }
6980                                         break;
6981 #endif
6982 #ifdef INET6
6983                                 case AF_INET6:
6984                                         if (ipv6_addr_legal) {
6985                                                 struct sockaddr_in6 *sin6;
6986
6987                                                 sin6 = &sctp_ifa->address.sin6;
6988                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6989                                                         continue;
6990                                                 }
6991                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
6992                                                     &sin6->sin6_addr) != 0) {
6993                                                         continue;
6994                                                 }
6995                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6996                                                         if (local_scope == 0)
6997                                                                 continue;
6998                                                         if (sin6->sin6_scope_id == 0) {
6999                                                                 if (sa6_recoverscope(sin6) != 0)
7000                                                                         /*
7001                                                                          *
7002                                                                          * bad
7003                                                                          * link
7004                                                                          *
7005                                                                          * local
7006                                                                          *
7007                                                                          * address
7008                                                                          */
7009                                                                         continue;
7010                                                         }
7011                                                 }
7012                                                 if ((site_scope == 0) &&
7013                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
7014                                                         continue;
7015                                                 }
7016                                                 /* count this one */
7017                                                 count++;
7018                                         }
7019                                         break;
7020 #endif
7021                                 default:
7022                                         /* TSNH */
7023                                         break;
7024                                 }
7025                         }
7026                 }
7027         } else {
7028                 /*
7029                  * subset bound case
7030                  */
7031                 struct sctp_laddr *laddr;
7032
7033                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
7034                     sctp_nxt_addr) {
7035                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
7036                                 continue;
7037                         }
7038                         /* count this one */
7039                         count++;
7040                 }
7041         }
7042         SCTP_IPI_ADDR_RUNLOCK();
7043         return (count);
7044 }
7045
7046 #if defined(SCTP_LOCAL_TRACE_BUF)
7047
7048 void
7049 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
7050 {
7051         uint32_t saveindex, newindex;
7052
7053         do {
7054                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
7055                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
7056                         newindex = 1;
7057                 } else {
7058                         newindex = saveindex + 1;
7059                 }
7060         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
7061         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
7062                 saveindex = 0;
7063         }
7064         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
7065         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
7066         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
7067         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
7068         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
7069         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
7070         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
7071         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
7072 }
7073
7074 #endif
7075 static void
7076 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,
7077     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
7078 {
7079         struct ip *iph;
7080 #ifdef INET6
7081         struct ip6_hdr *ip6;
7082 #endif
7083         struct mbuf *sp, *last;
7084         struct udphdr *uhdr;
7085         uint16_t port;
7086
7087         if ((m->m_flags & M_PKTHDR) == 0) {
7088                 /* Can't handle one that is not a pkt hdr */
7089                 goto out;
7090         }
7091         /* Pull the src port */
7092         iph = mtod(m, struct ip *);
7093         uhdr = (struct udphdr *)((caddr_t)iph + off);
7094         port = uhdr->uh_sport;
7095         /*
7096          * Split out the mbuf chain. Leave the IP header in m, place the
7097          * rest in the sp.
7098          */
7099         sp = m_split(m, off, M_NOWAIT);
7100         if (sp == NULL) {
7101                 /* Gak, drop packet, we can't do a split */
7102                 goto out;
7103         }
7104         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
7105                 /* Gak, packet can't have an SCTP header in it - too small */
7106                 m_freem(sp);
7107                 goto out;
7108         }
7109         /* Now pull up the UDP header and SCTP header together */
7110         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
7111         if (sp == NULL) {
7112                 /* Gak pullup failed */
7113                 goto out;
7114         }
7115         /* Trim out the UDP header */
7116         m_adj(sp, sizeof(struct udphdr));
7117
7118         /* Now reconstruct the mbuf chain */
7119         for (last = m; last->m_next; last = last->m_next);
7120         last->m_next = sp;
7121         m->m_pkthdr.len += sp->m_pkthdr.len;
7122         /*
7123          * The CSUM_DATA_VALID flags indicates that the HW checked the UDP
7124          * checksum and it was valid. Since CSUM_DATA_VALID ==
7125          * CSUM_SCTP_VALID this would imply that the HW also verified the
7126          * SCTP checksum. Therefore, clear the bit.
7127          */
7128         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
7129             "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n",
7130             m->m_pkthdr.len,
7131             if_name(m->m_pkthdr.rcvif),
7132             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
7133         m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
7134         iph = mtod(m, struct ip *);
7135         switch (iph->ip_v) {
7136 #ifdef INET
7137         case IPVERSION:
7138                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
7139                 sctp_input_with_port(m, off, port);
7140                 break;
7141 #endif
7142 #ifdef INET6
7143         case IPV6_VERSION >> 4:
7144                 ip6 = mtod(m, struct ip6_hdr *);
7145                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
7146                 sctp6_input_with_port(&m, &off, port);
7147                 break;
7148 #endif
7149         default:
7150                 goto out;
7151                 break;
7152         }
7153         return;
7154 out:
7155         m_freem(m);
7156 }
7157
7158 #ifdef INET
7159 static void
7160 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED)
7161 {
7162         struct ip *outer_ip, *inner_ip;
7163         struct sctphdr *sh;
7164         struct icmp *icmp;
7165         struct udphdr *udp;
7166         struct sctp_inpcb *inp;
7167         struct sctp_tcb *stcb;
7168         struct sctp_nets *net;
7169         struct sctp_init_chunk *ch;
7170         struct sockaddr_in src, dst;
7171         uint8_t type, code;
7172
7173         inner_ip = (struct ip *)vip;
7174         icmp = (struct icmp *)((caddr_t)inner_ip -
7175             (sizeof(struct icmp) - sizeof(struct ip)));
7176         outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
7177         if (ntohs(outer_ip->ip_len) <
7178             sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) {
7179                 return;
7180         }
7181         udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
7182         sh = (struct sctphdr *)(udp + 1);
7183         memset(&src, 0, sizeof(struct sockaddr_in));
7184         src.sin_family = AF_INET;
7185         src.sin_len = sizeof(struct sockaddr_in);
7186         src.sin_port = sh->src_port;
7187         src.sin_addr = inner_ip->ip_src;
7188         memset(&dst, 0, sizeof(struct sockaddr_in));
7189         dst.sin_family = AF_INET;
7190         dst.sin_len = sizeof(struct sockaddr_in);
7191         dst.sin_port = sh->dest_port;
7192         dst.sin_addr = inner_ip->ip_dst;
7193         /*
7194          * 'dst' holds the dest of the packet that failed to be sent. 'src'
7195          * holds our local endpoint address. Thus we reverse the dst and the
7196          * src in the lookup.
7197          */
7198         inp = NULL;
7199         net = NULL;
7200         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7201             (struct sockaddr *)&src,
7202             &inp, &net, 1,
7203             SCTP_DEFAULT_VRFID);
7204         if ((stcb != NULL) &&
7205             (net != NULL) &&
7206             (inp != NULL)) {
7207                 /* Check the UDP port numbers */
7208                 if ((udp->uh_dport != net->port) ||
7209                     (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7210                         SCTP_TCB_UNLOCK(stcb);
7211                         return;
7212                 }
7213                 /* Check the verification tag */
7214                 if (ntohl(sh->v_tag) != 0) {
7215                         /*
7216                          * This must be the verification tag used for
7217                          * sending out packets. We don't consider packets
7218                          * reflecting the verification tag.
7219                          */
7220                         if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) {
7221                                 SCTP_TCB_UNLOCK(stcb);
7222                                 return;
7223                         }
7224                 } else {
7225                         if (ntohs(outer_ip->ip_len) >=
7226                             sizeof(struct ip) +
7227                             8 + (inner_ip->ip_hl << 2) + 8 + 20) {
7228                                 /*
7229                                  * In this case we can check if we got an
7230                                  * INIT chunk and if the initiate tag
7231                                  * matches.
7232                                  */
7233                                 ch = (struct sctp_init_chunk *)(sh + 1);
7234                                 if ((ch->ch.chunk_type != SCTP_INITIATION) ||
7235                                     (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) {
7236                                         SCTP_TCB_UNLOCK(stcb);
7237                                         return;
7238                                 }
7239                         } else {
7240                                 SCTP_TCB_UNLOCK(stcb);
7241                                 return;
7242                         }
7243                 }
7244                 type = icmp->icmp_type;
7245                 code = icmp->icmp_code;
7246                 if ((type == ICMP_UNREACH) &&
7247                     (code == ICMP_UNREACH_PORT)) {
7248                         code = ICMP_UNREACH_PROTOCOL;
7249                 }
7250                 sctp_notify(inp, stcb, net, type, code,
7251                     ntohs(inner_ip->ip_len),
7252                     (uint32_t)ntohs(icmp->icmp_nextmtu));
7253         } else {
7254                 if ((stcb == NULL) && (inp != NULL)) {
7255                         /* reduce ref-count */
7256                         SCTP_INP_WLOCK(inp);
7257                         SCTP_INP_DECR_REF(inp);
7258                         SCTP_INP_WUNLOCK(inp);
7259                 }
7260                 if (stcb) {
7261                         SCTP_TCB_UNLOCK(stcb);
7262                 }
7263         }
7264         return;
7265 }
7266 #endif
7267
7268 #ifdef INET6
7269 static void
7270 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED)
7271 {
7272         struct ip6ctlparam *ip6cp;
7273         struct sctp_inpcb *inp;
7274         struct sctp_tcb *stcb;
7275         struct sctp_nets *net;
7276         struct sctphdr sh;
7277         struct udphdr udp;
7278         struct sockaddr_in6 src, dst;
7279         uint8_t type, code;
7280
7281         ip6cp = (struct ip6ctlparam *)d;
7282         /*
7283          * XXX: We assume that when IPV6 is non NULL, M and OFF are valid.
7284          */
7285         if (ip6cp->ip6c_m == NULL) {
7286                 return;
7287         }
7288         /*
7289          * Check if we can safely examine the ports and the verification tag
7290          * of the SCTP common header.
7291          */
7292         if (ip6cp->ip6c_m->m_pkthdr.len <
7293             ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) {
7294                 return;
7295         }
7296         /* Copy out the UDP header. */
7297         memset(&udp, 0, sizeof(struct udphdr));
7298         m_copydata(ip6cp->ip6c_m,
7299             ip6cp->ip6c_off,
7300             sizeof(struct udphdr),
7301             (caddr_t)&udp);
7302         /* Copy out the port numbers and the verification tag. */
7303         memset(&sh, 0, sizeof(struct sctphdr));
7304         m_copydata(ip6cp->ip6c_m,
7305             ip6cp->ip6c_off + sizeof(struct udphdr),
7306             sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t),
7307             (caddr_t)&sh);
7308         memset(&src, 0, sizeof(struct sockaddr_in6));
7309         src.sin6_family = AF_INET6;
7310         src.sin6_len = sizeof(struct sockaddr_in6);
7311         src.sin6_port = sh.src_port;
7312         src.sin6_addr = ip6cp->ip6c_ip6->ip6_src;
7313         if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7314                 return;
7315         }
7316         memset(&dst, 0, sizeof(struct sockaddr_in6));
7317         dst.sin6_family = AF_INET6;
7318         dst.sin6_len = sizeof(struct sockaddr_in6);
7319         dst.sin6_port = sh.dest_port;
7320         dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst;
7321         if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7322                 return;
7323         }
7324         inp = NULL;
7325         net = NULL;
7326         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7327             (struct sockaddr *)&src,
7328             &inp, &net, 1, SCTP_DEFAULT_VRFID);
7329         if ((stcb != NULL) &&
7330             (net != NULL) &&
7331             (inp != NULL)) {
7332                 /* Check the UDP port numbers */
7333                 if ((udp.uh_dport != net->port) ||
7334                     (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7335                         SCTP_TCB_UNLOCK(stcb);
7336                         return;
7337                 }
7338                 /* Check the verification tag */
7339                 if (ntohl(sh.v_tag) != 0) {
7340                         /*
7341                          * This must be the verification tag used for
7342                          * sending out packets. We don't consider packets
7343                          * reflecting the verification tag.
7344                          */
7345                         if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) {
7346                                 SCTP_TCB_UNLOCK(stcb);
7347                                 return;
7348                         }
7349                 } else {
7350                         if (ip6cp->ip6c_m->m_pkthdr.len >=
7351                             ip6cp->ip6c_off + sizeof(struct udphdr) +
7352                             sizeof(struct sctphdr) +
7353                             sizeof(struct sctp_chunkhdr) +
7354                             offsetof(struct sctp_init, a_rwnd)) {
7355                                 /*
7356                                  * In this case we can check if we got an
7357                                  * INIT chunk and if the initiate tag
7358                                  * matches.
7359                                  */
7360                                 uint32_t initiate_tag;
7361                                 uint8_t chunk_type;
7362
7363                                 m_copydata(ip6cp->ip6c_m,
7364                                     ip6cp->ip6c_off +
7365                                     sizeof(struct udphdr) +
7366                                     sizeof(struct sctphdr),
7367                                     sizeof(uint8_t),
7368                                     (caddr_t)&chunk_type);
7369                                 m_copydata(ip6cp->ip6c_m,
7370                                     ip6cp->ip6c_off +
7371                                     sizeof(struct udphdr) +
7372                                     sizeof(struct sctphdr) +
7373                                     sizeof(struct sctp_chunkhdr),
7374                                     sizeof(uint32_t),
7375                                     (caddr_t)&initiate_tag);
7376                                 if ((chunk_type != SCTP_INITIATION) ||
7377                                     (ntohl(initiate_tag) != stcb->asoc.my_vtag)) {
7378                                         SCTP_TCB_UNLOCK(stcb);
7379                                         return;
7380                                 }
7381                         } else {
7382                                 SCTP_TCB_UNLOCK(stcb);
7383                                 return;
7384                         }
7385                 }
7386                 type = ip6cp->ip6c_icmp6->icmp6_type;
7387                 code = ip6cp->ip6c_icmp6->icmp6_code;
7388                 if ((type == ICMP6_DST_UNREACH) &&
7389                     (code == ICMP6_DST_UNREACH_NOPORT)) {
7390                         type = ICMP6_PARAM_PROB;
7391                         code = ICMP6_PARAMPROB_NEXTHEADER;
7392                 }
7393                 sctp6_notify(inp, stcb, net, type, code,
7394                     ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
7395         } else {
7396                 if ((stcb == NULL) && (inp != NULL)) {
7397                         /* reduce inp's ref-count */
7398                         SCTP_INP_WLOCK(inp);
7399                         SCTP_INP_DECR_REF(inp);
7400                         SCTP_INP_WUNLOCK(inp);
7401                 }
7402                 if (stcb) {
7403                         SCTP_TCB_UNLOCK(stcb);
7404                 }
7405         }
7406 }
7407 #endif
7408
7409 void
7410 sctp_over_udp_stop(void)
7411 {
7412         /*
7413          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7414          * for writting!
7415          */
7416 #ifdef INET
7417         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7418                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
7419                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
7420         }
7421 #endif
7422 #ifdef INET6
7423         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7424                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
7425                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
7426         }
7427 #endif
7428 }
7429
7430 int
7431 sctp_over_udp_start(void)
7432 {
7433         uint16_t port;
7434         int ret;
7435 #ifdef INET
7436         struct sockaddr_in sin;
7437 #endif
7438 #ifdef INET6
7439         struct sockaddr_in6 sin6;
7440 #endif
7441         /*
7442          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7443          * for writting!
7444          */
7445         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
7446         if (ntohs(port) == 0) {
7447                 /* Must have a port set */
7448                 return (EINVAL);
7449         }
7450 #ifdef INET
7451         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7452                 /* Already running -- must stop first */
7453                 return (EALREADY);
7454         }
7455 #endif
7456 #ifdef INET6
7457         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7458                 /* Already running -- must stop first */
7459                 return (EALREADY);
7460         }
7461 #endif
7462 #ifdef INET
7463         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
7464             SOCK_DGRAM, IPPROTO_UDP,
7465             curthread->td_ucred, curthread))) {
7466                 sctp_over_udp_stop();
7467                 return (ret);
7468         }
7469         /* Call the special UDP hook. */
7470         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
7471             sctp_recv_udp_tunneled_packet,
7472             sctp_recv_icmp_tunneled_packet,
7473             NULL))) {
7474                 sctp_over_udp_stop();
7475                 return (ret);
7476         }
7477         /* Ok, we have a socket, bind it to the port. */
7478         memset(&sin, 0, sizeof(struct sockaddr_in));
7479         sin.sin_len = sizeof(struct sockaddr_in);
7480         sin.sin_family = AF_INET;
7481         sin.sin_port = htons(port);
7482         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7483             (struct sockaddr *)&sin, curthread))) {
7484                 sctp_over_udp_stop();
7485                 return (ret);
7486         }
7487 #endif
7488 #ifdef INET6
7489         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7490             SOCK_DGRAM, IPPROTO_UDP,
7491             curthread->td_ucred, curthread))) {
7492                 sctp_over_udp_stop();
7493                 return (ret);
7494         }
7495         /* Call the special UDP hook. */
7496         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7497             sctp_recv_udp_tunneled_packet,
7498             sctp_recv_icmp6_tunneled_packet,
7499             NULL))) {
7500                 sctp_over_udp_stop();
7501                 return (ret);
7502         }
7503         /* Ok, we have a socket, bind it to the port. */
7504         memset(&sin6, 0, sizeof(struct sockaddr_in6));
7505         sin6.sin6_len = sizeof(struct sockaddr_in6);
7506         sin6.sin6_family = AF_INET6;
7507         sin6.sin6_port = htons(port);
7508         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7509             (struct sockaddr *)&sin6, curthread))) {
7510                 sctp_over_udp_stop();
7511                 return (ret);
7512         }
7513 #endif
7514         return (0);
7515 }
7516
7517 /*
7518  * sctp_min_mtu ()returns the minimum of all non-zero arguments.
7519  * If all arguments are zero, zero is returned.
7520  */
7521 uint32_t
7522 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3)
7523 {
7524         if (mtu1 > 0) {
7525                 if (mtu2 > 0) {
7526                         if (mtu3 > 0) {
7527                                 return (min(mtu1, min(mtu2, mtu3)));
7528                         } else {
7529                                 return (min(mtu1, mtu2));
7530                         }
7531                 } else {
7532                         if (mtu3 > 0) {
7533                                 return (min(mtu1, mtu3));
7534                         } else {
7535                                 return (mtu1);
7536                         }
7537                 }
7538         } else {
7539                 if (mtu2 > 0) {
7540                         if (mtu3 > 0) {
7541                                 return (min(mtu2, mtu3));
7542                         } else {
7543                                 return (mtu2);
7544                         }
7545                 } else {
7546                         return (mtu3);
7547                 }
7548         }
7549 }
7550
7551 void
7552 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu)
7553 {
7554         struct in_conninfo inc;
7555
7556         memset(&inc, 0, sizeof(struct in_conninfo));
7557         inc.inc_fibnum = fibnum;
7558         switch (addr->sa.sa_family) {
7559 #ifdef INET
7560         case AF_INET:
7561                 inc.inc_faddr = addr->sin.sin_addr;
7562                 break;
7563 #endif
7564 #ifdef INET6
7565         case AF_INET6:
7566                 inc.inc_flags |= INC_ISIPV6;
7567                 inc.inc6_faddr = addr->sin6.sin6_addr;
7568                 break;
7569 #endif
7570         default:
7571                 return;
7572         }
7573         tcp_hc_updatemtu(&inc, (u_long)mtu);
7574 }
7575
7576 uint32_t
7577 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum)
7578 {
7579         struct in_conninfo inc;
7580
7581         memset(&inc, 0, sizeof(struct in_conninfo));
7582         inc.inc_fibnum = fibnum;
7583         switch (addr->sa.sa_family) {
7584 #ifdef INET
7585         case AF_INET:
7586                 inc.inc_faddr = addr->sin.sin_addr;
7587                 break;
7588 #endif
7589 #ifdef INET6
7590         case AF_INET6:
7591                 inc.inc_flags |= INC_ISIPV6;
7592                 inc.inc6_faddr = addr->sin6.sin6_addr;
7593                 break;
7594 #endif
7595         default:
7596                 return (0);
7597         }
7598         return ((uint32_t)tcp_hc_getmtu(&inc));
7599 }
7600
7601 void
7602 sctp_set_state(struct sctp_tcb *stcb, int new_state)
7603 {
7604 #if defined(KDTRACE_HOOKS)
7605         int old_state = stcb->asoc.state;
7606 #endif
7607
7608         KASSERT((new_state & ~SCTP_STATE_MASK) == 0,
7609             ("sctp_set_state: Can't set substate (new_state = %x)",
7610             new_state));
7611         stcb->asoc.state = (stcb->asoc.state & ~SCTP_STATE_MASK) | new_state;
7612         if ((new_state == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7613             (new_state == SCTP_STATE_SHUTDOWN_SENT) ||
7614             (new_state == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
7615                 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING);
7616         }
7617 #if defined(KDTRACE_HOOKS)
7618         if (((old_state & SCTP_STATE_MASK) != new_state) &&
7619             !(((old_state & SCTP_STATE_MASK) == SCTP_STATE_EMPTY) &&
7620             (new_state == SCTP_STATE_INUSE))) {
7621                 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state);
7622         }
7623 #endif
7624 }
7625
7626 void
7627 sctp_add_substate(struct sctp_tcb *stcb, int substate)
7628 {
7629 #if defined(KDTRACE_HOOKS)
7630         int old_state = stcb->asoc.state;
7631 #endif
7632
7633         KASSERT((substate & SCTP_STATE_MASK) == 0,
7634             ("sctp_add_substate: Can't set state (substate = %x)",
7635             substate));
7636         stcb->asoc.state |= substate;
7637 #if defined(KDTRACE_HOOKS)
7638         if (((substate & SCTP_STATE_ABOUT_TO_BE_FREED) &&
7639             ((old_state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) ||
7640             ((substate & SCTP_STATE_SHUTDOWN_PENDING) &&
7641             ((old_state & SCTP_STATE_SHUTDOWN_PENDING) == 0))) {
7642                 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state);
7643         }
7644 #endif
7645 }