sys/netinet/sctputil.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctputil.h>
  41 #include <netinet/sctp_var.h>
  42 #include <netinet/sctp_sysctl.h>
  43 #ifdef INET6
  44 #include <netinet6/sctp6_var.h>
  45 #endif
  46 #include <netinet/sctp_header.h>
  47 #include <netinet/sctp_output.h>
  48 #include <netinet/sctp_uio.h>
  49 #include <netinet/sctp_timer.h>
  50 #include <netinet/sctp_indata.h>
  51 #include <netinet/sctp_auth.h>
  52 #include <netinet/sctp_asconf.h>
  53 #include <netinet/sctp_bsd_addr.h>
  54 #include <netinet/sctp_kdtrace.h>
  55 #if defined(INET6) || defined(INET)
  56 #include <netinet/tcp_var.h>
  57 #endif
  58 #include <netinet/udp.h>
  59 #include <netinet/udp_var.h>
  60 #include <sys/proc.h>
  61 #ifdef INET6
  62 #include <netinet/icmp6.h>
  63 #endif
  64
  65
  66 #ifndef KTR_SCTP
  67 #define KTR_SCTP KTR_SUBSYS
  68 #endif
  69
  70 extern const struct sctp_cc_functions sctp_cc_functions[];
  71 extern const struct sctp_ss_functions sctp_ss_functions[];
  72
  73 void
  74 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  75 {
  76 #if defined(SCTP_LOCAL_TRACE_BUF)
  77         struct sctp_cwnd_log sctp_clog;
  78
  79         sctp_clog.x.sb.stcb = stcb;
  80         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  81         if (stcb)
  82                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  83         else
  84                 sctp_clog.x.sb.stcb_sbcc = 0;
  85         sctp_clog.x.sb.incr = incr;
  86         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  87             SCTP_LOG_EVENT_SB,
  88             from,
  89             sctp_clog.x.misc.log1,
  90             sctp_clog.x.misc.log2,
  91             sctp_clog.x.misc.log3,
  92             sctp_clog.x.misc.log4);
  93 #endif
  94 }
  95
  96 void
  97 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  98 {
  99 #if defined(SCTP_LOCAL_TRACE_BUF)
 100         struct sctp_cwnd_log sctp_clog;
 101
 102         sctp_clog.x.close.inp = (void *)inp;
 103         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
 104         if (stcb) {
 105                 sctp_clog.x.close.stcb = (void *)stcb;
 106                 sctp_clog.x.close.state = (uint16_t)stcb->asoc.state;
 107         } else {
 108                 sctp_clog.x.close.stcb = 0;
 109                 sctp_clog.x.close.state = 0;
 110         }
 111         sctp_clog.x.close.loc = loc;
 112         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 113             SCTP_LOG_EVENT_CLOSE,
 114             0,
 115             sctp_clog.x.misc.log1,
 116             sctp_clog.x.misc.log2,
 117             sctp_clog.x.misc.log3,
 118             sctp_clog.x.misc.log4);
 119 #endif
 120 }
 121
 122 void
 123 rto_logging(struct sctp_nets *net, int from)
 124 {
 125 #if defined(SCTP_LOCAL_TRACE_BUF)
 126         struct sctp_cwnd_log sctp_clog;
 127
 128         memset(&sctp_clog, 0, sizeof(sctp_clog));
 129         sctp_clog.x.rto.net = (void *)net;
 130         sctp_clog.x.rto.rtt = net->rtt / 1000;
 131         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 132             SCTP_LOG_EVENT_RTT,
 133             from,
 134             sctp_clog.x.misc.log1,
 135             sctp_clog.x.misc.log2,
 136             sctp_clog.x.misc.log3,
 137             sctp_clog.x.misc.log4);
 138 #endif
 139 }
 140
 141 void
 142 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 143 {
 144 #if defined(SCTP_LOCAL_TRACE_BUF)
 145         struct sctp_cwnd_log sctp_clog;
 146
 147         sctp_clog.x.strlog.stcb = stcb;
 148         sctp_clog.x.strlog.n_tsn = tsn;
 149         sctp_clog.x.strlog.n_sseq = sseq;
 150         sctp_clog.x.strlog.e_tsn = 0;
 151         sctp_clog.x.strlog.e_sseq = 0;
 152         sctp_clog.x.strlog.strm = stream;
 153         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 154             SCTP_LOG_EVENT_STRM,
 155             from,
 156             sctp_clog.x.misc.log1,
 157             sctp_clog.x.misc.log2,
 158             sctp_clog.x.misc.log3,
 159             sctp_clog.x.misc.log4);
 160 #endif
 161 }
 162
 163 void
 164 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 165 {
 166 #if defined(SCTP_LOCAL_TRACE_BUF)
 167         struct sctp_cwnd_log sctp_clog;
 168
 169         sctp_clog.x.nagle.stcb = (void *)stcb;
 170         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 171         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 172         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 173         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 174         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 175             SCTP_LOG_EVENT_NAGLE,
 176             action,
 177             sctp_clog.x.misc.log1,
 178             sctp_clog.x.misc.log2,
 179             sctp_clog.x.misc.log3,
 180             sctp_clog.x.misc.log4);
 181 #endif
 182 }
 183
 184 void
 185 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 186 {
 187 #if defined(SCTP_LOCAL_TRACE_BUF)
 188         struct sctp_cwnd_log sctp_clog;
 189
 190         sctp_clog.x.sack.cumack = cumack;
 191         sctp_clog.x.sack.oldcumack = old_cumack;
 192         sctp_clog.x.sack.tsn = tsn;
 193         sctp_clog.x.sack.numGaps = gaps;
 194         sctp_clog.x.sack.numDups = dups;
 195         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 196             SCTP_LOG_EVENT_SACK,
 197             from,
 198             sctp_clog.x.misc.log1,
 199             sctp_clog.x.misc.log2,
 200             sctp_clog.x.misc.log3,
 201             sctp_clog.x.misc.log4);
 202 #endif
 203 }
 204
 205 void
 206 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 207 {
 208 #if defined(SCTP_LOCAL_TRACE_BUF)
 209         struct sctp_cwnd_log sctp_clog;
 210
 211         memset(&sctp_clog, 0, sizeof(sctp_clog));
 212         sctp_clog.x.map.base = map;
 213         sctp_clog.x.map.cum = cum;
 214         sctp_clog.x.map.high = high;
 215         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 216             SCTP_LOG_EVENT_MAP,
 217             from,
 218             sctp_clog.x.misc.log1,
 219             sctp_clog.x.misc.log2,
 220             sctp_clog.x.misc.log3,
 221             sctp_clog.x.misc.log4);
 222 #endif
 223 }
 224
 225 void
 226 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 227 {
 228 #if defined(SCTP_LOCAL_TRACE_BUF)
 229         struct sctp_cwnd_log sctp_clog;
 230
 231         memset(&sctp_clog, 0, sizeof(sctp_clog));
 232         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 233         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 234         sctp_clog.x.fr.tsn = tsn;
 235         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 236             SCTP_LOG_EVENT_FR,
 237             from,
 238             sctp_clog.x.misc.log1,
 239             sctp_clog.x.misc.log2,
 240             sctp_clog.x.misc.log3,
 241             sctp_clog.x.misc.log4);
 242 #endif
 243 }
 244
 245 #ifdef SCTP_MBUF_LOGGING
 246 void
 247 sctp_log_mb(struct mbuf *m, int from)
 248 {
 249 #if defined(SCTP_LOCAL_TRACE_BUF)
 250         struct sctp_cwnd_log sctp_clog;
 251
 252         sctp_clog.x.mb.mp = m;
 253         sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m));
 254         sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m));
 255         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 256         if (SCTP_BUF_IS_EXTENDED(m)) {
 257                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 258                 sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m));
 259         } else {
 260                 sctp_clog.x.mb.ext = 0;
 261                 sctp_clog.x.mb.refcnt = 0;
 262         }
 263         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 264             SCTP_LOG_EVENT_MBUF,
 265             from,
 266             sctp_clog.x.misc.log1,
 267             sctp_clog.x.misc.log2,
 268             sctp_clog.x.misc.log3,
 269             sctp_clog.x.misc.log4);
 270 #endif
 271 }
 272
 273 void
 274 sctp_log_mbc(struct mbuf *m, int from)
 275 {
 276         struct mbuf *mat;
 277
 278         for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
 279                 sctp_log_mb(mat, from);
 280         }
 281 }
 282 #endif
 283
 284 void
 285 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 286 {
 287 #if defined(SCTP_LOCAL_TRACE_BUF)
 288         struct sctp_cwnd_log sctp_clog;
 289
 290         if (control == NULL) {
 291                 SCTP_PRINTF("Gak log of NULL?\n");
 292                 return;
 293         }
 294         sctp_clog.x.strlog.stcb = control->stcb;
 295         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 296         sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid;
 297         sctp_clog.x.strlog.strm = control->sinfo_stream;
 298         if (poschk != NULL) {
 299                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 300                 sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid;
 301         } else {
 302                 sctp_clog.x.strlog.e_tsn = 0;
 303                 sctp_clog.x.strlog.e_sseq = 0;
 304         }
 305         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 306             SCTP_LOG_EVENT_STRM,
 307             from,
 308             sctp_clog.x.misc.log1,
 309             sctp_clog.x.misc.log2,
 310             sctp_clog.x.misc.log3,
 311             sctp_clog.x.misc.log4);
 312 #endif
 313 }
 314
 315 void
 316 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 317 {
 318 #if defined(SCTP_LOCAL_TRACE_BUF)
 319         struct sctp_cwnd_log sctp_clog;
 320
 321         sctp_clog.x.cwnd.net = net;
 322         if (stcb->asoc.send_queue_cnt > 255)
 323                 sctp_clog.x.cwnd.cnt_in_send = 255;
 324         else
 325                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 326         if (stcb->asoc.stream_queue_cnt > 255)
 327                 sctp_clog.x.cwnd.cnt_in_str = 255;
 328         else
 329                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 330
 331         if (net) {
 332                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 333                 sctp_clog.x.cwnd.inflight = net->flight_size;
 334                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 335                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 336                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 337         }
 338         if (SCTP_CWNDLOG_PRESEND == from) {
 339                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 340         }
 341         sctp_clog.x.cwnd.cwnd_augment = augment;
 342         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 343             SCTP_LOG_EVENT_CWND,
 344             from,
 345             sctp_clog.x.misc.log1,
 346             sctp_clog.x.misc.log2,
 347             sctp_clog.x.misc.log3,
 348             sctp_clog.x.misc.log4);
 349 #endif
 350 }
 351
 352 void
 353 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 354 {
 355 #if defined(SCTP_LOCAL_TRACE_BUF)
 356         struct sctp_cwnd_log sctp_clog;
 357
 358         memset(&sctp_clog, 0, sizeof(sctp_clog));
 359         if (inp) {
 360                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 361
 362         } else {
 363                 sctp_clog.x.lock.sock = (void *)NULL;
 364         }
 365         sctp_clog.x.lock.inp = (void *)inp;
 366         if (stcb) {
 367                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 368         } else {
 369                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 370         }
 371         if (inp) {
 372                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 373                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 374         } else {
 375                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 376                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 377         }
 378         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 379         if (inp && (inp->sctp_socket)) {
 380                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 381                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 382                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 383         } else {
 384                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 385                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 386                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 387         }
 388         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 389             SCTP_LOG_LOCK_EVENT,
 390             from,
 391             sctp_clog.x.misc.log1,
 392             sctp_clog.x.misc.log2,
 393             sctp_clog.x.misc.log3,
 394             sctp_clog.x.misc.log4);
 395 #endif
 396 }
 397
 398 void
 399 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 400 {
 401 #if defined(SCTP_LOCAL_TRACE_BUF)
 402         struct sctp_cwnd_log sctp_clog;
 403
 404         memset(&sctp_clog, 0, sizeof(sctp_clog));
 405         sctp_clog.x.cwnd.net = net;
 406         sctp_clog.x.cwnd.cwnd_new_value = error;
 407         sctp_clog.x.cwnd.inflight = net->flight_size;
 408         sctp_clog.x.cwnd.cwnd_augment = burst;
 409         if (stcb->asoc.send_queue_cnt > 255)
 410                 sctp_clog.x.cwnd.cnt_in_send = 255;
 411         else
 412                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 413         if (stcb->asoc.stream_queue_cnt > 255)
 414                 sctp_clog.x.cwnd.cnt_in_str = 255;
 415         else
 416                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 417         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 418             SCTP_LOG_EVENT_MAXBURST,
 419             from,
 420             sctp_clog.x.misc.log1,
 421             sctp_clog.x.misc.log2,
 422             sctp_clog.x.misc.log3,
 423             sctp_clog.x.misc.log4);
 424 #endif
 425 }
 426
 427 void
 428 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 429 {
 430 #if defined(SCTP_LOCAL_TRACE_BUF)
 431         struct sctp_cwnd_log sctp_clog;
 432
 433         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 434         sctp_clog.x.rwnd.send_size = snd_size;
 435         sctp_clog.x.rwnd.overhead = overhead;
 436         sctp_clog.x.rwnd.new_rwnd = 0;
 437         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 438             SCTP_LOG_EVENT_RWND,
 439             from,
 440             sctp_clog.x.misc.log1,
 441             sctp_clog.x.misc.log2,
 442             sctp_clog.x.misc.log3,
 443             sctp_clog.x.misc.log4);
 444 #endif
 445 }
 446
 447 void
 448 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 449 {
 450 #if defined(SCTP_LOCAL_TRACE_BUF)
 451         struct sctp_cwnd_log sctp_clog;
 452
 453         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 454         sctp_clog.x.rwnd.send_size = flight_size;
 455         sctp_clog.x.rwnd.overhead = overhead;
 456         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 457         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 458             SCTP_LOG_EVENT_RWND,
 459             from,
 460             sctp_clog.x.misc.log1,
 461             sctp_clog.x.misc.log2,
 462             sctp_clog.x.misc.log3,
 463             sctp_clog.x.misc.log4);
 464 #endif
 465 }
 466
 467 #ifdef SCTP_MBCNT_LOGGING
 468 static void
 469 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 470 {
 471 #if defined(SCTP_LOCAL_TRACE_BUF)
 472         struct sctp_cwnd_log sctp_clog;
 473
 474         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 475         sctp_clog.x.mbcnt.size_change = book;
 476         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 477         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 478         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 479             SCTP_LOG_EVENT_MBCNT,
 480             from,
 481             sctp_clog.x.misc.log1,
 482             sctp_clog.x.misc.log2,
 483             sctp_clog.x.misc.log3,
 484             sctp_clog.x.misc.log4);
 485 #endif
 486 }
 487 #endif
 488
 489 void
 490 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 491 {
 492 #if defined(SCTP_LOCAL_TRACE_BUF)
 493         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 494             SCTP_LOG_MISC_EVENT,
 495             from,
 496             a, b, c, d);
 497 #endif
 498 }
 499
 500 void
 501 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 502 {
 503 #if defined(SCTP_LOCAL_TRACE_BUF)
 504         struct sctp_cwnd_log sctp_clog;
 505
 506         sctp_clog.x.wake.stcb = (void *)stcb;
 507         sctp_clog.x.wake.wake_cnt = wake_cnt;
 508         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 509         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 510         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 511
 512         if (stcb->asoc.stream_queue_cnt < 0xff)
 513                 sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt;
 514         else
 515                 sctp_clog.x.wake.stream_qcnt = 0xff;
 516
 517         if (stcb->asoc.chunks_on_out_queue < 0xff)
 518                 sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue;
 519         else
 520                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 521
 522         sctp_clog.x.wake.sctpflags = 0;
 523         /* set in the defered mode stuff */
 524         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 525                 sctp_clog.x.wake.sctpflags |= 1;
 526         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 527                 sctp_clog.x.wake.sctpflags |= 2;
 528         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 529                 sctp_clog.x.wake.sctpflags |= 4;
 530         /* what about the sb */
 531         if (stcb->sctp_socket) {
 532                 struct socket *so = stcb->sctp_socket;
 533
 534                 sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff));
 535         } else {
 536                 sctp_clog.x.wake.sbflags = 0xff;
 537         }
 538         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 539             SCTP_LOG_EVENT_WAKE,
 540             from,
 541             sctp_clog.x.misc.log1,
 542             sctp_clog.x.misc.log2,
 543             sctp_clog.x.misc.log3,
 544             sctp_clog.x.misc.log4);
 545 #endif
 546 }
 547
 548 void
 549 sctp_log_block(uint8_t from, struct sctp_association *asoc, ssize_t sendlen)
 550 {
 551 #if defined(SCTP_LOCAL_TRACE_BUF)
 552         struct sctp_cwnd_log sctp_clog;
 553
 554         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 555         sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt);
 556         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 557         sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt;
 558         sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue;
 559         sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024);
 560         sctp_clog.x.blk.sndlen = (uint32_t)sendlen;
 561         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 562             SCTP_LOG_EVENT_BLOCK,
 563             from,
 564             sctp_clog.x.misc.log1,
 565             sctp_clog.x.misc.log2,
 566             sctp_clog.x.misc.log3,
 567             sctp_clog.x.misc.log4);
 568 #endif
 569 }
 570
 571 int
 572 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 573 {
 574         /* May need to fix this if ktrdump does not work */
 575         return (0);
 576 }
 577
 578 #ifdef SCTP_AUDITING_ENABLED
 579 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 580 static int sctp_audit_indx = 0;
 581
 582 static
 583 void
 584 sctp_print_audit_report(void)
 585 {
 586         int i;
 587         int cnt;
 588
 589         cnt = 0;
 590         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 591                 if ((sctp_audit_data[i][0] == 0xe0) &&
 592                     (sctp_audit_data[i][1] == 0x01)) {
 593                         cnt = 0;
 594                         SCTP_PRINTF("\n");
 595                 } else if (sctp_audit_data[i][0] == 0xf0) {
 596                         cnt = 0;
 597                         SCTP_PRINTF("\n");
 598                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 599                     (sctp_audit_data[i][1] == 0x01)) {
 600                         SCTP_PRINTF("\n");
 601                         cnt = 0;
 602                 }
 603                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 604                     (uint32_t)sctp_audit_data[i][1]);
 605                 cnt++;
 606                 if ((cnt % 14) == 0)
 607                         SCTP_PRINTF("\n");
 608         }
 609         for (i = 0; i < sctp_audit_indx; i++) {
 610                 if ((sctp_audit_data[i][0] == 0xe0) &&
 611                     (sctp_audit_data[i][1] == 0x01)) {
 612                         cnt = 0;
 613                         SCTP_PRINTF("\n");
 614                 } else if (sctp_audit_data[i][0] == 0xf0) {
 615                         cnt = 0;
 616                         SCTP_PRINTF("\n");
 617                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 618                     (sctp_audit_data[i][1] == 0x01)) {
 619                         SCTP_PRINTF("\n");
 620                         cnt = 0;
 621                 }
 622                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 623                     (uint32_t)sctp_audit_data[i][1]);
 624                 cnt++;
 625                 if ((cnt % 14) == 0)
 626                         SCTP_PRINTF("\n");
 627         }
 628         SCTP_PRINTF("\n");
 629 }
 630
 631 void
 632 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 633     struct sctp_nets *net)
 634 {
 635         int resend_cnt, tot_out, rep, tot_book_cnt;
 636         struct sctp_nets *lnet;
 637         struct sctp_tmit_chunk *chk;
 638
 639         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 640         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 641         sctp_audit_indx++;
 642         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 643                 sctp_audit_indx = 0;
 644         }
 645         if (inp == NULL) {
 646                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 647                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 648                 sctp_audit_indx++;
 649                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 650                         sctp_audit_indx = 0;
 651                 }
 652                 return;
 653         }
 654         if (stcb == NULL) {
 655                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 656                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 657                 sctp_audit_indx++;
 658                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 659                         sctp_audit_indx = 0;
 660                 }
 661                 return;
 662         }
 663         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 664         sctp_audit_data[sctp_audit_indx][1] =
 665             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 666         sctp_audit_indx++;
 667         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 668                 sctp_audit_indx = 0;
 669         }
 670         rep = 0;
 671         tot_book_cnt = 0;
 672         resend_cnt = tot_out = 0;
 673         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 674                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 675                         resend_cnt++;
 676                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 677                         tot_out += chk->book_size;
 678                         tot_book_cnt++;
 679                 }
 680         }
 681         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 682                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 683                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 684                 sctp_audit_indx++;
 685                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 686                         sctp_audit_indx = 0;
 687                 }
 688                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 689                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 690                 rep = 1;
 691                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 692                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 693                 sctp_audit_data[sctp_audit_indx][1] =
 694                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 695                 sctp_audit_indx++;
 696                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 697                         sctp_audit_indx = 0;
 698                 }
 699         }
 700         if (tot_out != stcb->asoc.total_flight) {
 701                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 702                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 703                 sctp_audit_indx++;
 704                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 705                         sctp_audit_indx = 0;
 706                 }
 707                 rep = 1;
 708                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 709                     (int)stcb->asoc.total_flight);
 710                 stcb->asoc.total_flight = tot_out;
 711         }
 712         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 713                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 714                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 715                 sctp_audit_indx++;
 716                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 717                         sctp_audit_indx = 0;
 718                 }
 719                 rep = 1;
 720                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 721
 722                 stcb->asoc.total_flight_count = tot_book_cnt;
 723         }
 724         tot_out = 0;
 725         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 726                 tot_out += lnet->flight_size;
 727         }
 728         if (tot_out != stcb->asoc.total_flight) {
 729                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 730                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 731                 sctp_audit_indx++;
 732                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 733                         sctp_audit_indx = 0;
 734                 }
 735                 rep = 1;
 736                 SCTP_PRINTF("real flight:%d net total was %d\n",
 737                     stcb->asoc.total_flight, tot_out);
 738                 /* now corrective action */
 739                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 740
 741                         tot_out = 0;
 742                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 743                                 if ((chk->whoTo == lnet) &&
 744                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 745                                         tot_out += chk->book_size;
 746                                 }
 747                         }
 748                         if (lnet->flight_size != tot_out) {
 749                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 750                                     (void *)lnet, lnet->flight_size,
 751                                     tot_out);
 752                                 lnet->flight_size = tot_out;
 753                         }
 754                 }
 755         }
 756         if (rep) {
 757                 sctp_print_audit_report();
 758         }
 759 }
 760
 761 void
 762 sctp_audit_log(uint8_t ev, uint8_t fd)
 763 {
 764
 765         sctp_audit_data[sctp_audit_indx][0] = ev;
 766         sctp_audit_data[sctp_audit_indx][1] = fd;
 767         sctp_audit_indx++;
 768         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 769                 sctp_audit_indx = 0;
 770         }
 771 }
 772
 773 #endif
 774
 775 /*
 776  * The conversion from time to ticks and vice versa is done by rounding
 777  * upwards. This way we can test in the code the time to be positive and
 778  * know that this corresponds to a positive number of ticks.
 779  */
 780
 781 uint32_t
 782 sctp_msecs_to_ticks(uint32_t msecs)
 783 {
 784         uint64_t temp;
 785         uint32_t ticks;
 786
 787         if (hz == 1000) {
 788                 ticks = msecs;
 789         } else {
 790                 temp = (((uint64_t)msecs * hz) + 999) / 1000;
 791                 if (temp > UINT32_MAX) {
 792                         ticks = UINT32_MAX;
 793                 } else {
 794                         ticks = (uint32_t)temp;
 795                 }
 796         }
 797         return (ticks);
 798 }
 799
 800 uint32_t
 801 sctp_ticks_to_msecs(uint32_t ticks)
 802 {
 803         uint64_t temp;
 804         uint32_t msecs;
 805
 806         if (hz == 1000) {
 807                 msecs = ticks;
 808         } else {
 809                 temp = (((uint64_t)ticks * 1000) + (hz - 1)) / hz;
 810                 if (temp > UINT32_MAX) {
 811                         msecs = UINT32_MAX;
 812                 } else {
 813                         msecs = (uint32_t)temp;
 814                 }
 815         }
 816         return (msecs);
 817 }
 818
 819 uint32_t
 820 sctp_secs_to_ticks(uint32_t secs)
 821 {
 822         uint64_t temp;
 823         uint32_t ticks;
 824
 825         temp = (uint64_t)secs * hz;
 826         if (temp > UINT32_MAX) {
 827                 ticks = UINT32_MAX;
 828         } else {
 829                 ticks = (uint32_t)temp;
 830         }
 831         return (ticks);
 832 }
 833
 834 uint32_t
 835 sctp_ticks_to_secs(uint32_t ticks)
 836 {
 837         uint64_t temp;
 838         uint32_t secs;
 839
 840         temp = ((uint64_t)ticks + (hz - 1)) / hz;
 841         if (temp > UINT32_MAX) {
 842                 secs = UINT32_MAX;
 843         } else {
 844                 secs = (uint32_t)temp;
 845         }
 846         return (secs);
 847 }
 848
 849 /*
 850  * sctp_stop_timers_for_shutdown() should be called
 851  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 852  * state to make sure that all timers are stopped.
 853  */
 854 void
 855 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 856 {
 857         struct sctp_inpcb *inp;
 858         struct sctp_nets *net;
 859
 860         inp = stcb->sctp_ep;
 861
 862         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL,
 863             SCTP_FROM_SCTPUTIL + SCTP_LOC_12);
 864         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL,
 865             SCTP_FROM_SCTPUTIL + SCTP_LOC_13);
 866         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL,
 867             SCTP_FROM_SCTPUTIL + SCTP_LOC_14);
 868         sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL,
 869             SCTP_FROM_SCTPUTIL + SCTP_LOC_15);
 870         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 871                 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
 872                     SCTP_FROM_SCTPUTIL + SCTP_LOC_16);
 873                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
 874                     SCTP_FROM_SCTPUTIL + SCTP_LOC_17);
 875         }
 876 }
 877
 878 void
 879 sctp_stop_association_timers(struct sctp_tcb *stcb, bool stop_assoc_kill_timer)
 880 {
 881         struct sctp_inpcb *inp;
 882         struct sctp_nets *net;
 883
 884         inp = stcb->sctp_ep;
 885         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL,
 886             SCTP_FROM_SCTPUTIL + SCTP_LOC_18);
 887         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL,
 888             SCTP_FROM_SCTPUTIL + SCTP_LOC_19);
 889         if (stop_assoc_kill_timer) {
 890                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
 891                     SCTP_FROM_SCTPUTIL + SCTP_LOC_20);
 892         }
 893         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL,
 894             SCTP_FROM_SCTPUTIL + SCTP_LOC_21);
 895         sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL,
 896             SCTP_FROM_SCTPUTIL + SCTP_LOC_22);
 897         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNGUARD, inp, stcb, NULL,
 898             SCTP_FROM_SCTPUTIL + SCTP_LOC_23);
 899         /* Mobility adaptation */
 900         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, inp, stcb, NULL,
 901             SCTP_FROM_SCTPUTIL + SCTP_LOC_24);
 902         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 903                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net,
 904                     SCTP_FROM_SCTPUTIL + SCTP_LOC_25);
 905                 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net,
 906                     SCTP_FROM_SCTPUTIL + SCTP_LOC_26);
 907                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, inp, stcb, net,
 908                     SCTP_FROM_SCTPUTIL + SCTP_LOC_27);
 909                 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net,
 910                     SCTP_FROM_SCTPUTIL + SCTP_LOC_28);
 911                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, inp, stcb, net,
 912                     SCTP_FROM_SCTPUTIL + SCTP_LOC_29);
 913                 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
 914                     SCTP_FROM_SCTPUTIL + SCTP_LOC_30);
 915                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
 916                     SCTP_FROM_SCTPUTIL + SCTP_LOC_31);
 917         }
 918 }
 919
 920 /*
 921  * A list of sizes based on typical mtu's, used only if next hop size not
 922  * returned. These values MUST be multiples of 4 and MUST be ordered.
 923  */
 924 static uint32_t sctp_mtu_sizes[] = {
 925         68,
 926         296,
 927         508,
 928         512,
 929         544,
 930         576,
 931         1004,
 932         1492,
 933         1500,
 934         1536,
 935         2000,
 936         2048,
 937         4352,
 938         4464,
 939         8168,
 940         17912,
 941         32000,
 942         65532
 943 };
 944
 945 /*
 946  * Return the largest MTU in sctp_mtu_sizes smaller than val.
 947  * If val is smaller than the minimum, just return the largest
 948  * multiple of 4 smaller or equal to val.
 949  * Ensure that the result is a multiple of 4.
 950  */
 951 uint32_t
 952 sctp_get_prev_mtu(uint32_t val)
 953 {
 954         uint32_t i;
 955
 956         val &= 0xfffffffc;
 957         if (val <= sctp_mtu_sizes[0]) {
 958                 return (val);
 959         }
 960         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 961                 if (val <= sctp_mtu_sizes[i]) {
 962                         break;
 963                 }
 964         }
 965         KASSERT((sctp_mtu_sizes[i - 1] & 0x00000003) == 0,
 966             ("sctp_mtu_sizes[%u] not a multiple of 4", i - 1));
 967         return (sctp_mtu_sizes[i - 1]);
 968 }
 969
 970 /*
 971  * Return the smallest MTU in sctp_mtu_sizes larger than val.
 972  * If val is larger than the maximum, just return the largest multiple of 4 smaller
 973  * or equal to val.
 974  * Ensure that the result is a multiple of 4.
 975  */
 976 uint32_t
 977 sctp_get_next_mtu(uint32_t val)
 978 {
 979         /* select another MTU that is just bigger than this one */
 980         uint32_t i;
 981
 982         val &= 0xfffffffc;
 983         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 984                 if (val < sctp_mtu_sizes[i]) {
 985                         KASSERT((sctp_mtu_sizes[i] & 0x00000003) == 0,
 986                             ("sctp_mtu_sizes[%u] not a multiple of 4", i));
 987                         return (sctp_mtu_sizes[i]);
 988                 }
 989         }
 990         return (val);
 991 }
 992
 993 void
 994 sctp_fill_random_store(struct sctp_pcb *m)
 995 {
 996         /*
 997          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 998          * our counter. The result becomes our good random numbers and we
 999          * then setup to give these out. Note that we do no locking to
1000          * protect this. This is ok, since if competing folks call this we
1001          * will get more gobbled gook in the random store which is what we
1002          * want. There is a danger that two guys will use the same random
1003          * numbers, but thats ok too since that is random as well :->
1004          */
1005         m->store_at = 0;
1006         (void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers,
1007             sizeof(m->random_numbers), (uint8_t *)&m->random_counter,
1008             sizeof(m->random_counter), (uint8_t *)m->random_store);
1009         m->random_counter++;
1010 }
1011
1012 uint32_t
1013 sctp_select_initial_TSN(struct sctp_pcb *inp)
1014 {
1015         /*
1016          * A true implementation should use random selection process to get
1017          * the initial stream sequence number, using RFC1750 as a good
1018          * guideline
1019          */
1020         uint32_t x, *xp;
1021         uint8_t *p;
1022         int store_at, new_store;
1023
1024         if (inp->initial_sequence_debug != 0) {
1025                 uint32_t ret;
1026
1027                 ret = inp->initial_sequence_debug;
1028                 inp->initial_sequence_debug++;
1029                 return (ret);
1030         }
1031 retry:
1032         store_at = inp->store_at;
1033         new_store = store_at + sizeof(uint32_t);
1034         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
1035                 new_store = 0;
1036         }
1037         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
1038                 goto retry;
1039         }
1040         if (new_store == 0) {
1041                 /* Refill the random store */
1042                 sctp_fill_random_store(inp);
1043         }
1044         p = &inp->random_store[store_at];
1045         xp = (uint32_t *)p;
1046         x = *xp;
1047         return (x);
1048 }
1049
1050 uint32_t
1051 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
1052 {
1053         uint32_t x;
1054         struct timeval now;
1055
1056         if (check) {
1057                 (void)SCTP_GETTIME_TIMEVAL(&now);
1058         }
1059         for (;;) {
1060                 x = sctp_select_initial_TSN(&inp->sctp_ep);
1061                 if (x == 0) {
1062                         /* we never use 0 */
1063                         continue;
1064                 }
1065                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
1066                         break;
1067                 }
1068         }
1069         return (x);
1070 }
1071
1072 int32_t
1073 sctp_map_assoc_state(int kernel_state)
1074 {
1075         int32_t user_state;
1076
1077         if (kernel_state & SCTP_STATE_WAS_ABORTED) {
1078                 user_state = SCTP_CLOSED;
1079         } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) {
1080                 user_state = SCTP_SHUTDOWN_PENDING;
1081         } else {
1082                 switch (kernel_state & SCTP_STATE_MASK) {
1083                 case SCTP_STATE_EMPTY:
1084                         user_state = SCTP_CLOSED;
1085                         break;
1086                 case SCTP_STATE_INUSE:
1087                         user_state = SCTP_CLOSED;
1088                         break;
1089                 case SCTP_STATE_COOKIE_WAIT:
1090                         user_state = SCTP_COOKIE_WAIT;
1091                         break;
1092                 case SCTP_STATE_COOKIE_ECHOED:
1093                         user_state = SCTP_COOKIE_ECHOED;
1094                         break;
1095                 case SCTP_STATE_OPEN:
1096                         user_state = SCTP_ESTABLISHED;
1097                         break;
1098                 case SCTP_STATE_SHUTDOWN_SENT:
1099                         user_state = SCTP_SHUTDOWN_SENT;
1100                         break;
1101                 case SCTP_STATE_SHUTDOWN_RECEIVED:
1102                         user_state = SCTP_SHUTDOWN_RECEIVED;
1103                         break;
1104                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
1105                         user_state = SCTP_SHUTDOWN_ACK_SENT;
1106                         break;
1107                 default:
1108                         user_state = SCTP_CLOSED;
1109                         break;
1110                 }
1111         }
1112         return (user_state);
1113 }
1114
1115 int
1116 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1117     uint32_t override_tag, uint32_t vrf_id, uint16_t o_strms)
1118 {
1119         struct sctp_association *asoc;
1120
1121         /*
1122          * Anything set to zero is taken care of by the allocation routine's
1123          * bzero
1124          */
1125
1126         /*
1127          * Up front select what scoping to apply on addresses I tell my peer
1128          * Not sure what to do with these right now, we will need to come up
1129          * with a way to set them. We may need to pass them through from the
1130          * caller in the sctp_aloc_assoc() function.
1131          */
1132         int i;
1133 #if defined(SCTP_DETAILED_STR_STATS)
1134         int j;
1135 #endif
1136
1137         asoc = &stcb->asoc;
1138         /* init all variables to a known value. */
1139         SCTP_SET_STATE(stcb, SCTP_STATE_INUSE);
1140         asoc->max_burst = inp->sctp_ep.max_burst;
1141         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
1142         asoc->heart_beat_delay = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
1143         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
1144         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
1145         asoc->ecn_supported = inp->ecn_supported;
1146         asoc->prsctp_supported = inp->prsctp_supported;
1147         asoc->auth_supported = inp->auth_supported;
1148         asoc->asconf_supported = inp->asconf_supported;
1149         asoc->reconfig_supported = inp->reconfig_supported;
1150         asoc->nrsack_supported = inp->nrsack_supported;
1151         asoc->pktdrop_supported = inp->pktdrop_supported;
1152         asoc->idata_supported = inp->idata_supported;
1153         asoc->sctp_cmt_pf = (uint8_t)0;
1154         asoc->sctp_frag_point = inp->sctp_frag_point;
1155         asoc->sctp_features = inp->sctp_features;
1156         asoc->default_dscp = inp->sctp_ep.default_dscp;
1157         asoc->max_cwnd = inp->max_cwnd;
1158 #ifdef INET6
1159         if (inp->sctp_ep.default_flowlabel) {
1160                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
1161         } else {
1162                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
1163                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
1164                         asoc->default_flowlabel &= 0x000fffff;
1165                         asoc->default_flowlabel |= 0x80000000;
1166                 } else {
1167                         asoc->default_flowlabel = 0;
1168                 }
1169         }
1170 #endif
1171         asoc->sb_send_resv = 0;
1172         if (override_tag) {
1173                 asoc->my_vtag = override_tag;
1174         } else {
1175                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
1176         }
1177         /* Get the nonce tags */
1178         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1179         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1180         asoc->vrf_id = vrf_id;
1181
1182 #ifdef SCTP_ASOCLOG_OF_TSNS
1183         asoc->tsn_in_at = 0;
1184         asoc->tsn_out_at = 0;
1185         asoc->tsn_in_wrapped = 0;
1186         asoc->tsn_out_wrapped = 0;
1187         asoc->cumack_log_at = 0;
1188         asoc->cumack_log_atsnt = 0;
1189 #endif
1190 #ifdef SCTP_FS_SPEC_LOG
1191         asoc->fs_index = 0;
1192 #endif
1193         asoc->refcnt = 0;
1194         asoc->assoc_up_sent = 0;
1195         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1196             sctp_select_initial_TSN(&inp->sctp_ep);
1197         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1198         /* we are optimisitic here */
1199         asoc->peer_supports_nat = 0;
1200         asoc->sent_queue_retran_cnt = 0;
1201
1202         /* for CMT */
1203         asoc->last_net_cmt_send_started = NULL;
1204
1205         /* This will need to be adjusted */
1206         asoc->last_acked_seq = asoc->init_seq_number - 1;
1207         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1208         asoc->asconf_seq_in = asoc->last_acked_seq;
1209
1210         /* here we are different, we hold the next one we expect */
1211         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1212
1213         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
1214         asoc->initial_rto = inp->sctp_ep.initial_rto;
1215
1216         asoc->default_mtu = inp->sctp_ep.default_mtu;
1217         asoc->max_init_times = inp->sctp_ep.max_init_times;
1218         asoc->max_send_times = inp->sctp_ep.max_send_times;
1219         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
1220         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
1221         asoc->free_chunk_cnt = 0;
1222
1223         asoc->iam_blocking = 0;
1224         asoc->context = inp->sctp_context;
1225         asoc->local_strreset_support = inp->local_strreset_support;
1226         asoc->def_send = inp->def_send;
1227         asoc->delayed_ack = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1228         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
1229         asoc->pr_sctp_cnt = 0;
1230         asoc->total_output_queue_size = 0;
1231
1232         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1233                 asoc->scope.ipv6_addr_legal = 1;
1234                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
1235                         asoc->scope.ipv4_addr_legal = 1;
1236                 } else {
1237                         asoc->scope.ipv4_addr_legal = 0;
1238                 }
1239         } else {
1240                 asoc->scope.ipv6_addr_legal = 0;
1241                 asoc->scope.ipv4_addr_legal = 1;
1242         }
1243
1244         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1245         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1246
1247         asoc->smallest_mtu = inp->sctp_frag_point;
1248         asoc->minrto = inp->sctp_ep.sctp_minrto;
1249         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1250
1251         asoc->stream_locked_on = 0;
1252         asoc->ecn_echo_cnt_onq = 0;
1253         asoc->stream_locked = 0;
1254
1255         asoc->send_sack = 1;
1256
1257         LIST_INIT(&asoc->sctp_restricted_addrs);
1258
1259         TAILQ_INIT(&asoc->nets);
1260         TAILQ_INIT(&asoc->pending_reply_queue);
1261         TAILQ_INIT(&asoc->asconf_ack_sent);
1262         /* Setup to fill the hb random cache at first HB */
1263         asoc->hb_random_idx = 4;
1264
1265         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1266
1267         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1268         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1269
1270         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1271         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1272
1273         /*
1274          * Now the stream parameters, here we allocate space for all streams
1275          * that we request by default.
1276          */
1277         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1278             o_strms;
1279         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1280             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1281             SCTP_M_STRMO);
1282         if (asoc->strmout == NULL) {
1283                 /* big trouble no memory */
1284                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1285                 return (ENOMEM);
1286         }
1287         for (i = 0; i < asoc->streamoutcnt; i++) {
1288                 /*
1289                  * inbound side must be set to 0xffff, also NOTE when we get
1290                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1291                  * count (streamoutcnt) but first check if we sent to any of
1292                  * the upper streams that were dropped (if some were). Those
1293                  * that were dropped must be notified to the upper layer as
1294                  * failed to send.
1295                  */
1296                 asoc->strmout[i].next_mid_ordered = 0;
1297                 asoc->strmout[i].next_mid_unordered = 0;
1298                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1299                 asoc->strmout[i].chunks_on_queues = 0;
1300 #if defined(SCTP_DETAILED_STR_STATS)
1301                 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1302                         asoc->strmout[i].abandoned_sent[j] = 0;
1303                         asoc->strmout[i].abandoned_unsent[j] = 0;
1304                 }
1305 #else
1306                 asoc->strmout[i].abandoned_sent[0] = 0;
1307                 asoc->strmout[i].abandoned_unsent[0] = 0;
1308 #endif
1309                 asoc->strmout[i].sid = i;
1310                 asoc->strmout[i].last_msg_incomplete = 0;
1311                 asoc->strmout[i].state = SCTP_STREAM_OPENING;
1312                 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL);
1313         }
1314         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1315
1316         /* Now the mapping array */
1317         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1318         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1319             SCTP_M_MAP);
1320         if (asoc->mapping_array == NULL) {
1321                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1322                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1323                 return (ENOMEM);
1324         }
1325         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1326         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1327             SCTP_M_MAP);
1328         if (asoc->nr_mapping_array == NULL) {
1329                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1330                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1331                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1332                 return (ENOMEM);
1333         }
1334         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1335
1336         /* Now the init of the other outqueues */
1337         TAILQ_INIT(&asoc->free_chunks);
1338         TAILQ_INIT(&asoc->control_send_queue);
1339         TAILQ_INIT(&asoc->asconf_send_queue);
1340         TAILQ_INIT(&asoc->send_queue);
1341         TAILQ_INIT(&asoc->sent_queue);
1342         TAILQ_INIT(&asoc->resetHead);
1343         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1344         TAILQ_INIT(&asoc->asconf_queue);
1345         /* authentication fields */
1346         asoc->authinfo.random = NULL;
1347         asoc->authinfo.active_keyid = 0;
1348         asoc->authinfo.assoc_key = NULL;
1349         asoc->authinfo.assoc_keyid = 0;
1350         asoc->authinfo.recv_key = NULL;
1351         asoc->authinfo.recv_keyid = 0;
1352         LIST_INIT(&asoc->shared_keys);
1353         asoc->marked_retrans = 0;
1354         asoc->port = inp->sctp_ep.port;
1355         asoc->timoinit = 0;
1356         asoc->timodata = 0;
1357         asoc->timosack = 0;
1358         asoc->timoshutdown = 0;
1359         asoc->timoheartbeat = 0;
1360         asoc->timocookie = 0;
1361         asoc->timoshutdownack = 0;
1362         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1363         asoc->discontinuity_time = asoc->start_time;
1364         for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1365                 asoc->abandoned_unsent[i] = 0;
1366                 asoc->abandoned_sent[i] = 0;
1367         }
1368         /*
1369          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1370          * freed later when the association is freed.
1371          */
1372         return (0);
1373 }
1374
1375 void
1376 sctp_print_mapping_array(struct sctp_association *asoc)
1377 {
1378         unsigned int i, limit;
1379
1380         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1381             asoc->mapping_array_size,
1382             asoc->mapping_array_base_tsn,
1383             asoc->cumulative_tsn,
1384             asoc->highest_tsn_inside_map,
1385             asoc->highest_tsn_inside_nr_map);
1386         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1387                 if (asoc->mapping_array[limit - 1] != 0) {
1388                         break;
1389                 }
1390         }
1391         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1392         for (i = 0; i < limit; i++) {
1393                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1394         }
1395         if (limit % 16)
1396                 SCTP_PRINTF("\n");
1397         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1398                 if (asoc->nr_mapping_array[limit - 1]) {
1399                         break;
1400                 }
1401         }
1402         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1403         for (i = 0; i < limit; i++) {
1404                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1405         }
1406         if (limit % 16)
1407                 SCTP_PRINTF("\n");
1408 }
1409
1410 int
1411 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1412 {
1413         /* mapping array needs to grow */
1414         uint8_t *new_array1, *new_array2;
1415         uint32_t new_size;
1416
1417         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1418         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1419         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1420         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1421                 /* can't get more, forget it */
1422                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1423                 if (new_array1) {
1424                         SCTP_FREE(new_array1, SCTP_M_MAP);
1425                 }
1426                 if (new_array2) {
1427                         SCTP_FREE(new_array2, SCTP_M_MAP);
1428                 }
1429                 return (-1);
1430         }
1431         memset(new_array1, 0, new_size);
1432         memset(new_array2, 0, new_size);
1433         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1434         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1435         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1436         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1437         asoc->mapping_array = new_array1;
1438         asoc->nr_mapping_array = new_array2;
1439         asoc->mapping_array_size = new_size;
1440         return (0);
1441 }
1442
1443
1444 static void
1445 sctp_iterator_work(struct sctp_iterator *it)
1446 {
1447         struct epoch_tracker et;
1448         struct sctp_inpcb *tinp;
1449         int iteration_count = 0;
1450         int inp_skip = 0;
1451         int first_in = 1;
1452
1453         NET_EPOCH_ENTER(et);
1454         SCTP_INP_INFO_RLOCK();
1455         SCTP_ITERATOR_LOCK();
1456         sctp_it_ctl.cur_it = it;
1457         if (it->inp) {
1458                 SCTP_INP_RLOCK(it->inp);
1459                 SCTP_INP_DECR_REF(it->inp);
1460         }
1461         if (it->inp == NULL) {
1462                 /* iterator is complete */
1463 done_with_iterator:
1464                 sctp_it_ctl.cur_it = NULL;
1465                 SCTP_ITERATOR_UNLOCK();
1466                 SCTP_INP_INFO_RUNLOCK();
1467                 if (it->function_atend != NULL) {
1468                         (*it->function_atend) (it->pointer, it->val);
1469                 }
1470                 SCTP_FREE(it, SCTP_M_ITER);
1471                 NET_EPOCH_EXIT(et);
1472                 return;
1473         }
1474 select_a_new_ep:
1475         if (first_in) {
1476                 first_in = 0;
1477         } else {
1478                 SCTP_INP_RLOCK(it->inp);
1479         }
1480         while (((it->pcb_flags) &&
1481             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1482             ((it->pcb_features) &&
1483             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1484                 /* endpoint flags or features don't match, so keep looking */
1485                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1486                         SCTP_INP_RUNLOCK(it->inp);
1487                         goto done_with_iterator;
1488                 }
1489                 tinp = it->inp;
1490                 it->inp = LIST_NEXT(it->inp, sctp_list);
1491                 it->stcb = NULL;
1492                 SCTP_INP_RUNLOCK(tinp);
1493                 if (it->inp == NULL) {
1494                         goto done_with_iterator;
1495                 }
1496                 SCTP_INP_RLOCK(it->inp);
1497         }
1498         /* now go through each assoc which is in the desired state */
1499         if (it->done_current_ep == 0) {
1500                 if (it->function_inp != NULL)
1501                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1502                 it->done_current_ep = 1;
1503         }
1504         if (it->stcb == NULL) {
1505                 /* run the per instance function */
1506                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1507         }
1508         if ((inp_skip) || it->stcb == NULL) {
1509                 if (it->function_inp_end != NULL) {
1510                         inp_skip = (*it->function_inp_end) (it->inp,
1511                             it->pointer,
1512                             it->val);
1513                 }
1514                 SCTP_INP_RUNLOCK(it->inp);
1515                 goto no_stcb;
1516         }
1517         while (it->stcb) {
1518                 SCTP_TCB_LOCK(it->stcb);
1519                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1520                         /* not in the right state... keep looking */
1521                         SCTP_TCB_UNLOCK(it->stcb);
1522                         goto next_assoc;
1523                 }
1524                 /* see if we have limited out the iterator loop */
1525                 iteration_count++;
1526                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1527                         /* Pause to let others grab the lock */
1528                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1529                         SCTP_TCB_UNLOCK(it->stcb);
1530                         SCTP_INP_INCR_REF(it->inp);
1531                         SCTP_INP_RUNLOCK(it->inp);
1532                         SCTP_ITERATOR_UNLOCK();
1533                         SCTP_INP_INFO_RUNLOCK();
1534                         SCTP_INP_INFO_RLOCK();
1535                         SCTP_ITERATOR_LOCK();
1536                         if (sctp_it_ctl.iterator_flags) {
1537                                 /* We won't be staying here */
1538                                 SCTP_INP_DECR_REF(it->inp);
1539                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1540                                 if (sctp_it_ctl.iterator_flags &
1541                                     SCTP_ITERATOR_STOP_CUR_IT) {
1542                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1543                                         goto done_with_iterator;
1544                                 }
1545                                 if (sctp_it_ctl.iterator_flags &
1546                                     SCTP_ITERATOR_STOP_CUR_INP) {
1547                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1548                                         goto no_stcb;
1549                                 }
1550                                 /* If we reach here huh? */
1551                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1552                                     sctp_it_ctl.iterator_flags);
1553                                 sctp_it_ctl.iterator_flags = 0;
1554                         }
1555                         SCTP_INP_RLOCK(it->inp);
1556                         SCTP_INP_DECR_REF(it->inp);
1557                         SCTP_TCB_LOCK(it->stcb);
1558                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1559                         iteration_count = 0;
1560                 }
1561                 KASSERT(it->inp == it->stcb->sctp_ep,
1562                     ("%s: stcb %p does not belong to inp %p, but inp %p",
1563                     __func__, it->stcb, it->inp, it->stcb->sctp_ep));
1564
1565                 /* run function on this one */
1566                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1567
1568                 /*
1569                  * we lie here, it really needs to have its own type but
1570                  * first I must verify that this won't effect things :-0
1571                  */
1572                 if (it->no_chunk_output == 0)
1573                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1574
1575                 SCTP_TCB_UNLOCK(it->stcb);
1576 next_assoc:
1577                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1578                 if (it->stcb == NULL) {
1579                         /* Run last function */
1580                         if (it->function_inp_end != NULL) {
1581                                 inp_skip = (*it->function_inp_end) (it->inp,
1582                                     it->pointer,
1583                                     it->val);
1584                         }
1585                 }
1586         }
1587         SCTP_INP_RUNLOCK(it->inp);
1588 no_stcb:
1589         /* done with all assocs on this endpoint, move on to next endpoint */
1590         it->done_current_ep = 0;
1591         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1592                 it->inp = NULL;
1593         } else {
1594                 it->inp = LIST_NEXT(it->inp, sctp_list);
1595         }
1596         it->stcb = NULL;
1597         if (it->inp == NULL) {
1598                 goto done_with_iterator;
1599         }
1600         goto select_a_new_ep;
1601 }
1602
1603 void
1604 sctp_iterator_worker(void)
1605 {
1606         struct sctp_iterator *it;
1607
1608         /* This function is called with the WQ lock in place */
1609         sctp_it_ctl.iterator_running = 1;
1610         while ((it = TAILQ_FIRST(&sctp_it_ctl.iteratorhead)) != NULL) {
1611                 /* now lets work on this one */
1612                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1613                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1614                 CURVNET_SET(it->vn);
1615                 sctp_iterator_work(it);
1616                 CURVNET_RESTORE();
1617                 SCTP_IPI_ITERATOR_WQ_LOCK();
1618                 /* sa_ignore FREED_MEMORY */
1619         }
1620         sctp_it_ctl.iterator_running = 0;
1621         return;
1622 }
1623
1624
1625 static void
1626 sctp_handle_addr_wq(void)
1627 {
1628         /* deal with the ADDR wq from the rtsock calls */
1629         struct sctp_laddr *wi, *nwi;
1630         struct sctp_asconf_iterator *asc;
1631
1632         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1633             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1634         if (asc == NULL) {
1635                 /* Try later, no memory */
1636                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1637                     (struct sctp_inpcb *)NULL,
1638                     (struct sctp_tcb *)NULL,
1639                     (struct sctp_nets *)NULL);
1640                 return;
1641         }
1642         LIST_INIT(&asc->list_of_work);
1643         asc->cnt = 0;
1644
1645         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1646                 LIST_REMOVE(wi, sctp_nxt_addr);
1647                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1648                 asc->cnt++;
1649         }
1650
1651         if (asc->cnt == 0) {
1652                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1653         } else {
1654                 int ret;
1655
1656                 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
1657                     sctp_asconf_iterator_stcb,
1658                     NULL,       /* No ep end for boundall */
1659                     SCTP_PCB_FLAGS_BOUNDALL,
1660                     SCTP_PCB_ANY_FEATURES,
1661                     SCTP_ASOC_ANY_STATE,
1662                     (void *)asc, 0,
1663                     sctp_asconf_iterator_end, NULL, 0);
1664                 if (ret) {
1665                         SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n");
1666                         /*
1667                          * Freeing if we are stopping or put back on the
1668                          * addr_wq.
1669                          */
1670                         if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
1671                                 sctp_asconf_iterator_end(asc, 0);
1672                         } else {
1673                                 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) {
1674                                         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
1675                                 }
1676                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1677                         }
1678                 }
1679         }
1680 }
1681
1682 /*-
1683  * The following table shows which pointers for the inp, stcb, or net are
1684  * stored for each timer after it was started.
1685  *
1686  *|Name                         |Timer                        |inp |stcb|net |
1687  *|-----------------------------|-----------------------------|----|----|----|
1688  *|SCTP_TIMER_TYPE_SEND         |net->rxt_timer               |Yes |Yes |Yes |
1689  *|SCTP_TIMER_TYPE_INIT         |net->rxt_timer               |Yes |Yes |Yes |
1690  *|SCTP_TIMER_TYPE_RECV         |stcb->asoc.dack_timer        |Yes |Yes |No  |
1691  *|SCTP_TIMER_TYPE_SHUTDOWN     |net->rxt_timer               |Yes |Yes |Yes |
1692  *|SCTP_TIMER_TYPE_HEARTBEAT    |net->hb_timer                |Yes |Yes |Yes |
1693  *|SCTP_TIMER_TYPE_COOKIE       |net->rxt_timer               |Yes |Yes |Yes |
1694  *|SCTP_TIMER_TYPE_NEWCOOKIE    |inp->sctp_ep.signature_change|Yes |No  |No  |
1695  *|SCTP_TIMER_TYPE_PATHMTURAISE |net->pmtu_timer              |Yes |Yes |Yes |
1696  *|SCTP_TIMER_TYPE_SHUTDOWNACK  |net->rxt_timer               |Yes |Yes |Yes |
1697  *|SCTP_TIMER_TYPE_ASCONF       |stcb->asoc.asconf_timer      |Yes |Yes |Yes |
1698  *|SCTP_TIMER_TYPE_SHUTDOWNGUARD|stcb->asoc.shut_guard_timer  |Yes |Yes |No  |
1699  *|SCTP_TIMER_TYPE_AUTOCLOSE    |stcb->asoc.autoclose_timer   |Yes |Yes |No  |
1700  *|SCTP_TIMER_TYPE_STRRESET     |stcb->asoc.strreset_timer    |Yes |Yes |No  |
1701  *|SCTP_TIMER_TYPE_INPKILL      |inp->sctp_ep.signature_change|Yes |No  |No  |
1702  *|SCTP_TIMER_TYPE_ASOCKILL     |stcb->asoc.strreset_timer    |Yes |Yes |No  |
1703  *|SCTP_TIMER_TYPE_ADDR_WQ      |SCTP_BASE_INFO(addr_wq_timer)|No  |No  |No  |
1704  *|SCTP_TIMER_TYPE_PRIM_DELETED |stcb->asoc.delete_prim_timer |Yes |Yes |No  |
1705  */
1706
1707 void
1708 sctp_timeout_handler(void *t)
1709 {
1710         struct epoch_tracker et;
1711         struct timeval tv;
1712         struct sctp_inpcb *inp;
1713         struct sctp_tcb *stcb;
1714         struct sctp_nets *net;
1715         struct sctp_timer *tmr;
1716         struct mbuf *op_err;
1717         int did_output;
1718         int type;
1719         int i, secret;
1720
1721         tmr = (struct sctp_timer *)t;
1722         inp = (struct sctp_inpcb *)tmr->ep;
1723         stcb = (struct sctp_tcb *)tmr->tcb;
1724         net = (struct sctp_nets *)tmr->net;
1725         CURVNET_SET((struct vnet *)tmr->vnet);
1726         did_output = 1;
1727
1728 #ifdef SCTP_AUDITING_ENABLED
1729         sctp_audit_log(0xF0, (uint8_t)tmr->type);
1730         sctp_auditing(3, inp, stcb, net);
1731 #endif
1732
1733         /* sanity checks... */
1734         KASSERT(tmr->self == tmr,
1735             ("sctp_timeout_handler: tmr->self corrupted"));
1736         KASSERT(SCTP_IS_TIMER_TYPE_VALID(tmr->type),
1737             ("sctp_timeout_handler: invalid timer type %d", tmr->type));
1738         type = tmr->type;
1739         KASSERT(stcb == NULL || stcb->sctp_ep == inp,
1740             ("sctp_timeout_handler of type %d: inp = %p, stcb->sctp_ep %p",
1741             type, stcb, stcb->sctp_ep));
1742         if (inp) {
1743                 SCTP_INP_INCR_REF(inp);
1744         }
1745         tmr->stopped_from = 0xa001;
1746         if (stcb) {
1747                 atomic_add_int(&stcb->asoc.refcnt, 1);
1748                 if (stcb->asoc.state == 0) {
1749                         atomic_add_int(&stcb->asoc.refcnt, -1);
1750                         if (inp) {
1751                                 SCTP_INP_DECR_REF(inp);
1752                         }
1753                         SCTPDBG(SCTP_DEBUG_TIMER2,
1754                             "Timer type %d handler exiting due to CLOSED association.\n",
1755                             type);
1756                         CURVNET_RESTORE();
1757                         return;
1758                 }
1759         }
1760         tmr->stopped_from = 0xa002;
1761         SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d goes off.\n", type);
1762         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1763                 if (inp) {
1764                         SCTP_INP_DECR_REF(inp);
1765                 }
1766                 if (stcb) {
1767                         atomic_add_int(&stcb->asoc.refcnt, -1);
1768                 }
1769                 SCTPDBG(SCTP_DEBUG_TIMER2,
1770                     "Timer type %d handler exiting due to not being active.\n",
1771                     type);
1772                 CURVNET_RESTORE();
1773                 return;
1774         }
1775
1776         tmr->stopped_from = 0xa003;
1777         if (stcb) {
1778                 SCTP_TCB_LOCK(stcb);
1779                 atomic_add_int(&stcb->asoc.refcnt, -1);
1780                 if ((type != SCTP_TIMER_TYPE_ASOCKILL) &&
1781                     ((stcb->asoc.state == 0) ||
1782                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1783                         SCTP_TCB_UNLOCK(stcb);
1784                         if (inp) {
1785                                 SCTP_INP_DECR_REF(inp);
1786                         }
1787                         SCTPDBG(SCTP_DEBUG_TIMER2,
1788                             "Timer type %d handler exiting due to CLOSED association.\n",
1789                             type);
1790                         CURVNET_RESTORE();
1791                         return;
1792                 }
1793         } else if (inp != NULL) {
1794                 SCTP_INP_WLOCK(inp);
1795         } else {
1796                 SCTP_WQ_ADDR_LOCK();
1797         }
1798
1799         /* Record in stopped_from which timeout occurred. */
1800         tmr->stopped_from = type;
1801         NET_EPOCH_ENTER(et);
1802         /* mark as being serviced now */
1803         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1804                 /*
1805                  * Callout has been rescheduled.
1806                  */
1807                 goto get_out;
1808         }
1809         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1810                 /*
1811                  * Not active, so no action.
1812                  */
1813                 goto get_out;
1814         }
1815         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1816
1817         /* call the handler for the appropriate timer type */
1818         switch (type) {
1819         case SCTP_TIMER_TYPE_SEND:
1820                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1821                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1822                     type, inp, stcb, net));
1823                 SCTP_STAT_INCR(sctps_timodata);
1824                 stcb->asoc.timodata++;
1825                 stcb->asoc.num_send_timers_up--;
1826                 if (stcb->asoc.num_send_timers_up < 0) {
1827                         stcb->asoc.num_send_timers_up = 0;
1828                 }
1829                 SCTP_TCB_LOCK_ASSERT(stcb);
1830                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1831                         /* no need to unlock on tcb its gone */
1832
1833                         goto out_decr;
1834                 }
1835                 SCTP_TCB_LOCK_ASSERT(stcb);
1836 #ifdef SCTP_AUDITING_ENABLED
1837                 sctp_auditing(4, inp, stcb, net);
1838 #endif
1839                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1840                 if ((stcb->asoc.num_send_timers_up == 0) &&
1841                     (stcb->asoc.sent_queue_cnt > 0)) {
1842                         struct sctp_tmit_chunk *chk;
1843
1844                         /*
1845                          * Safeguard. If there on some on the sent queue
1846                          * somewhere but no timers running something is
1847                          * wrong... so we start a timer on the first chunk
1848                          * on the send queue on whatever net it is sent to.
1849                          */
1850                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1851                                 if (chk->whoTo != NULL) {
1852                                         break;
1853                                 }
1854                         }
1855                         if (chk != NULL) {
1856                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
1857                         }
1858                 }
1859                 break;
1860         case SCTP_TIMER_TYPE_INIT:
1861                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1862                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1863                     type, inp, stcb, net));
1864                 SCTP_STAT_INCR(sctps_timoinit);
1865                 stcb->asoc.timoinit++;
1866                 if (sctp_t1init_timer(inp, stcb, net)) {
1867                         /* no need to unlock on tcb its gone */
1868                         goto out_decr;
1869                 }
1870                 /* We do output but not here */
1871                 did_output = 0;
1872                 break;
1873         case SCTP_TIMER_TYPE_RECV:
1874                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
1875                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1876                     type, inp, stcb, net));
1877                 SCTP_STAT_INCR(sctps_timosack);
1878                 stcb->asoc.timosack++;
1879                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1880 #ifdef SCTP_AUDITING_ENABLED
1881                 sctp_auditing(4, inp, stcb, NULL);
1882 #endif
1883                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1884                 break;
1885         case SCTP_TIMER_TYPE_SHUTDOWN:
1886                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1887                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1888                     type, inp, stcb, net));
1889                 SCTP_STAT_INCR(sctps_timoshutdown);
1890                 stcb->asoc.timoshutdown++;
1891                 if (sctp_shutdown_timer(inp, stcb, net)) {
1892                         /* no need to unlock on tcb its gone */
1893                         goto out_decr;
1894                 }
1895 #ifdef SCTP_AUDITING_ENABLED
1896                 sctp_auditing(4, inp, stcb, net);
1897 #endif
1898                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1899                 break;
1900         case SCTP_TIMER_TYPE_HEARTBEAT:
1901                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1902                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1903                     type, inp, stcb, net));
1904                 SCTP_STAT_INCR(sctps_timoheartbeat);
1905                 stcb->asoc.timoheartbeat++;
1906                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1907                         /* no need to unlock on tcb its gone */
1908                         goto out_decr;
1909                 }
1910 #ifdef SCTP_AUDITING_ENABLED
1911                 sctp_auditing(4, inp, stcb, net);
1912 #endif
1913                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1914                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1915                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1916                 }
1917                 break;
1918         case SCTP_TIMER_TYPE_COOKIE:
1919                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1920                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1921                     type, inp, stcb, net));
1922                 SCTP_STAT_INCR(sctps_timocookie);
1923                 stcb->asoc.timocookie++;
1924                 if (sctp_cookie_timer(inp, stcb, net)) {
1925                         /* no need to unlock on tcb its gone */
1926                         goto out_decr;
1927                 }
1928 #ifdef SCTP_AUDITING_ENABLED
1929                 sctp_auditing(4, inp, stcb, net);
1930 #endif
1931                 /*
1932                  * We consider T3 and Cookie timer pretty much the same with
1933                  * respect to where from in chunk_output.
1934                  */
1935                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1936                 break;
1937         case SCTP_TIMER_TYPE_NEWCOOKIE:
1938                 KASSERT(inp != NULL && stcb == NULL && net == NULL,
1939                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1940                     type, inp, stcb, net));
1941                 SCTP_STAT_INCR(sctps_timosecret);
1942                 (void)SCTP_GETTIME_TIMEVAL(&tv);
1943                 inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1944                 inp->sctp_ep.last_secret_number =
1945                     inp->sctp_ep.current_secret_number;
1946                 inp->sctp_ep.current_secret_number++;
1947                 if (inp->sctp_ep.current_secret_number >=
1948                     SCTP_HOW_MANY_SECRETS) {
1949                         inp->sctp_ep.current_secret_number = 0;
1950                 }
1951                 secret = (int)inp->sctp_ep.current_secret_number;
1952                 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1953                         inp->sctp_ep.secret_key[secret][i] =
1954                             sctp_select_initial_TSN(&inp->sctp_ep);
1955                 }
1956                 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
1957                 did_output = 0;
1958                 break;
1959         case SCTP_TIMER_TYPE_PATHMTURAISE:
1960                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1961                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1962                     type, inp, stcb, net));
1963                 SCTP_STAT_INCR(sctps_timopathmtu);
1964                 sctp_pathmtu_timer(inp, stcb, net);
1965                 did_output = 0;
1966                 break;
1967         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1968                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1969                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1970                     type, inp, stcb, net));
1971                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1972                         /* no need to unlock on tcb its gone */
1973                         goto out_decr;
1974                 }
1975                 SCTP_STAT_INCR(sctps_timoshutdownack);
1976                 stcb->asoc.timoshutdownack++;
1977 #ifdef SCTP_AUDITING_ENABLED
1978                 sctp_auditing(4, inp, stcb, net);
1979 #endif
1980                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1981                 break;
1982         case SCTP_TIMER_TYPE_ASCONF:
1983                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1984                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1985                     type, inp, stcb, net));
1986                 SCTP_STAT_INCR(sctps_timoasconf);
1987                 if (sctp_asconf_timer(inp, stcb, net)) {
1988                         /* no need to unlock on tcb its gone */
1989                         goto out_decr;
1990                 }
1991 #ifdef SCTP_AUDITING_ENABLED
1992                 sctp_auditing(4, inp, stcb, net);
1993 #endif
1994                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1995                 break;
1996         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1997                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
1998                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1999                     type, inp, stcb, net));
2000                 SCTP_STAT_INCR(sctps_timoshutdownguard);
2001                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
2002                     "Shutdown guard timer expired");
2003                 sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2004                 /* no need to unlock on tcb its gone */
2005                 goto out_decr;
2006         case SCTP_TIMER_TYPE_AUTOCLOSE:
2007                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2008                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2009                     type, inp, stcb, net));
2010                 SCTP_STAT_INCR(sctps_timoautoclose);
2011                 sctp_autoclose_timer(inp, stcb);
2012                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
2013                 did_output = 0;
2014                 break;
2015         case SCTP_TIMER_TYPE_STRRESET:
2016                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2017                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2018                     type, inp, stcb, net));
2019                 SCTP_STAT_INCR(sctps_timostrmrst);
2020                 if (sctp_strreset_timer(inp, stcb)) {
2021                         /* no need to unlock on tcb its gone */
2022                         goto out_decr;
2023                 }
2024                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
2025                 break;
2026         case SCTP_TIMER_TYPE_INPKILL:
2027                 KASSERT(inp != NULL && stcb == NULL && net == NULL,
2028                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2029                     type, inp, stcb, net));
2030                 SCTP_STAT_INCR(sctps_timoinpkill);
2031                 /*
2032                  * special case, take away our increment since WE are the
2033                  * killer
2034                  */
2035                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL,
2036                     SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
2037                 SCTP_INP_DECR_REF(inp);
2038                 SCTP_INP_WUNLOCK(inp);
2039                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
2040                     SCTP_CALLED_FROM_INPKILL_TIMER);
2041                 inp = NULL;
2042                 goto out_no_decr;
2043         case SCTP_TIMER_TYPE_ASOCKILL:
2044                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2045                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2046                     type, inp, stcb, net));
2047                 SCTP_STAT_INCR(sctps_timoassockill);
2048                 /* Can we free it yet? */
2049                 SCTP_INP_DECR_REF(inp);
2050                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
2051                     SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
2052                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2053                     SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
2054                 /*
2055                  * free asoc, always unlocks (or destroy's) so prevent
2056                  * duplicate unlock or unlock of a free mtx :-0
2057                  */
2058                 stcb = NULL;
2059                 goto out_no_decr;
2060         case SCTP_TIMER_TYPE_ADDR_WQ:
2061                 KASSERT(inp == NULL && stcb == NULL && net == NULL,
2062                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2063                     type, inp, stcb, net));
2064                 sctp_handle_addr_wq();
2065                 break;
2066         case SCTP_TIMER_TYPE_PRIM_DELETED:
2067                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2068                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2069                     type, inp, stcb, net));
2070                 SCTP_STAT_INCR(sctps_timodelprim);
2071                 sctp_delete_prim_timer(inp, stcb);
2072                 break;
2073         default:
2074 #ifdef INVARIANTS
2075                 panic("Unknown timer type %d", type);
2076 #else
2077                 goto get_out;
2078 #endif
2079         }
2080 #ifdef SCTP_AUDITING_ENABLED
2081         sctp_audit_log(0xF1, (uint8_t)type);
2082         if (inp)
2083                 sctp_auditing(5, inp, stcb, net);
2084 #endif
2085         if ((did_output) && stcb) {
2086                 /*
2087                  * Now we need to clean up the control chunk chain if an
2088                  * ECNE is on it. It must be marked as UNSENT again so next
2089                  * call will continue to send it until such time that we get
2090                  * a CWR, to remove it. It is, however, less likely that we
2091                  * will find a ecn echo on the chain though.
2092                  */
2093                 sctp_fix_ecn_echo(&stcb->asoc);
2094         }
2095 get_out:
2096         if (stcb) {
2097                 SCTP_TCB_UNLOCK(stcb);
2098         } else if (inp != NULL) {
2099                 SCTP_INP_WUNLOCK(inp);
2100         } else {
2101                 SCTP_WQ_ADDR_UNLOCK();
2102         }
2103
2104 out_decr:
2105         if (inp) {
2106                 SCTP_INP_DECR_REF(inp);
2107         }
2108
2109 out_no_decr:
2110         SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d handler finished.\n", type);
2111         CURVNET_RESTORE();
2112         NET_EPOCH_EXIT(et);
2113 }
2114
2115 /*-
2116  * The following table shows which parameters must be provided
2117  * when calling sctp_timer_start(). For parameters not being
2118  * provided, NULL must be used.
2119  *
2120  * |Name                         |inp |stcb|net |
2121  * |-----------------------------|----|----|----|
2122  * |SCTP_TIMER_TYPE_SEND         |Yes |Yes |Yes |
2123  * |SCTP_TIMER_TYPE_INIT         |Yes |Yes |Yes |
2124  * |SCTP_TIMER_TYPE_RECV         |Yes |Yes |No  |
2125  * |SCTP_TIMER_TYPE_SHUTDOWN     |Yes |Yes |Yes |
2126  * |SCTP_TIMER_TYPE_HEARTBEAT    |Yes |Yes |Yes |
2127  * |SCTP_TIMER_TYPE_COOKIE       |Yes |Yes |Yes |
2128  * |SCTP_TIMER_TYPE_NEWCOOKIE    |Yes |No  |No  |
2129  * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes |
2130  * |SCTP_TIMER_TYPE_SHUTDOWNACK  |Yes |Yes |Yes |
2131  * |SCTP_TIMER_TYPE_ASCONF       |Yes |Yes |Yes |
2132  * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No  |
2133  * |SCTP_TIMER_TYPE_AUTOCLOSE    |Yes |Yes |No  |
2134  * |SCTP_TIMER_TYPE_STRRESET     |Yes |Yes |Yes |
2135  * |SCTP_TIMER_TYPE_INPKILL      |Yes |No  |No  |
2136  * |SCTP_TIMER_TYPE_ASOCKILL     |Yes |Yes |No  |
2137  * |SCTP_TIMER_TYPE_ADDR_WQ      |No  |No  |No  |
2138  * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No  |
2139  *
2140  */
2141
2142 void
2143 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2144     struct sctp_nets *net)
2145 {
2146         struct sctp_timer *tmr;
2147         uint32_t to_ticks;
2148         uint32_t rndval, jitter;
2149
2150         KASSERT(stcb == NULL || stcb->sctp_ep == inp,
2151             ("sctp_timer_start of type %d: inp = %p, stcb->sctp_ep %p",
2152             t_type, stcb, stcb->sctp_ep));
2153         tmr = NULL;
2154         to_ticks = 0;
2155         if (stcb != NULL) {
2156                 SCTP_TCB_LOCK_ASSERT(stcb);
2157         } else if (inp != NULL) {
2158                 SCTP_INP_WLOCK_ASSERT(inp);
2159         } else {
2160                 SCTP_WQ_ADDR_LOCK_ASSERT();
2161         }
2162         if (stcb != NULL) {
2163                 /*
2164                  * Don't restart timer on association that's about to be
2165                  * killed.
2166                  */
2167                 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
2168                     (t_type != SCTP_TIMER_TYPE_ASOCKILL)) {
2169                         SCTPDBG(SCTP_DEBUG_TIMER2,
2170                             "Timer type %d not started: inp=%p, stcb=%p, net=%p (stcb deleted).\n",
2171                             t_type, inp, stcb, net);
2172                         return;
2173                 }
2174                 /* Don't restart timer on net that's been removed. */
2175                 if (net != NULL && (net->dest_state & SCTP_ADDR_BEING_DELETED)) {
2176                         SCTPDBG(SCTP_DEBUG_TIMER2,
2177                             "Timer type %d not started: inp=%p, stcb=%p, net=%p (net deleted).\n",
2178                             t_type, inp, stcb, net);
2179                         return;
2180                 }
2181         }
2182         switch (t_type) {
2183         case SCTP_TIMER_TYPE_SEND:
2184                 /* Here we use the RTO timer. */
2185                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2186 #ifdef INVARIANTS
2187                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2188                             t_type, inp, stcb, net);
2189 #else
2190                         return;
2191 #endif
2192                 }
2193                 tmr = &net->rxt_timer;
2194                 if (net->RTO == 0) {
2195                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2196                 } else {
2197                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2198                 }
2199                 break;
2200         case SCTP_TIMER_TYPE_INIT:
2201                 /*
2202                  * Here we use the INIT timer default usually about 1
2203                  * second.
2204                  */
2205                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2206 #ifdef INVARIANTS
2207                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2208                             t_type, inp, stcb, net);
2209 #else
2210                         return;
2211 #endif
2212                 }
2213                 tmr = &net->rxt_timer;
2214                 if (net->RTO == 0) {
2215                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2216                 } else {
2217                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2218                 }
2219                 break;
2220         case SCTP_TIMER_TYPE_RECV:
2221                 /*
2222                  * Here we use the Delayed-Ack timer value from the inp,
2223                  * ususually about 200ms.
2224                  */
2225                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2226 #ifdef INVARIANTS
2227                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2228                             t_type, inp, stcb, net);
2229 #else
2230                         return;
2231 #endif
2232                 }
2233                 tmr = &stcb->asoc.dack_timer;
2234                 to_ticks = sctp_msecs_to_ticks(stcb->asoc.delayed_ack);
2235                 break;
2236         case SCTP_TIMER_TYPE_SHUTDOWN:
2237                 /* Here we use the RTO of the destination. */
2238                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2239 #ifdef INVARIANTS
2240                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2241                             t_type, inp, stcb, net);
2242 #else
2243                         return;
2244 #endif
2245                 }
2246                 tmr = &net->rxt_timer;
2247                 if (net->RTO == 0) {
2248                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2249                 } else {
2250                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2251                 }
2252                 break;
2253         case SCTP_TIMER_TYPE_HEARTBEAT:
2254                 /*
2255                  * The net is used here so that we can add in the RTO. Even
2256                  * though we use a different timer. We also add the HB timer
2257                  * PLUS a random jitter.
2258                  */
2259                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2260 #ifdef INVARIANTS
2261                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2262                             t_type, inp, stcb, net);
2263 #else
2264                         return;
2265 #endif
2266                 }
2267                 if ((net->dest_state & SCTP_ADDR_NOHB) &&
2268                     !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
2269                         SCTPDBG(SCTP_DEBUG_TIMER2,
2270                             "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n",
2271                             t_type, inp, stcb, net);
2272                         return;
2273                 }
2274                 tmr = &net->hb_timer;
2275                 if (net->RTO == 0) {
2276                         to_ticks = stcb->asoc.initial_rto;
2277                 } else {
2278                         to_ticks = net->RTO;
2279                 }
2280                 rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2281                 jitter = rndval % to_ticks;
2282                 if (jitter >= (to_ticks >> 1)) {
2283                         to_ticks = to_ticks + (jitter - (to_ticks >> 1));
2284                 } else {
2285                         to_ticks = to_ticks - jitter;
2286                 }
2287                 if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2288                     !(net->dest_state & SCTP_ADDR_PF)) {
2289                         to_ticks += net->heart_beat_delay;
2290                 }
2291                 /*
2292                  * Now we must convert the to_ticks that are now in ms to
2293                  * ticks.
2294                  */
2295                 to_ticks = sctp_msecs_to_ticks(to_ticks);
2296                 break;
2297         case SCTP_TIMER_TYPE_COOKIE:
2298                 /*
2299                  * Here we can use the RTO timer from the network since one
2300                  * RTT was complete. If a retransmission happened then we
2301                  * will be using the RTO initial value.
2302                  */
2303                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2304 #ifdef INVARIANTS
2305                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2306                             t_type, inp, stcb, net);
2307 #else
2308                         return;
2309 #endif
2310                 }
2311                 tmr = &net->rxt_timer;
2312                 if (net->RTO == 0) {
2313                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2314                 } else {
2315                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2316                 }
2317                 break;
2318         case SCTP_TIMER_TYPE_NEWCOOKIE:
2319                 /*
2320                  * Nothing needed but the endpoint here ususually about 60
2321                  * minutes.
2322                  */
2323                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2324 #ifdef INVARIANTS
2325                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2326                             t_type, inp, stcb, net);
2327 #else
2328                         return;
2329 #endif
2330                 }
2331                 tmr = &inp->sctp_ep.signature_change;
2332                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2333                 break;
2334         case SCTP_TIMER_TYPE_PATHMTURAISE:
2335                 /*
2336                  * Here we use the value found in the EP for PMTUD,
2337                  * ususually about 10 minutes.
2338                  */
2339                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2340 #ifdef INVARIANTS
2341                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2342                             t_type, inp, stcb, net);
2343 #else
2344                         return;
2345 #endif
2346                 }
2347                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2348                         SCTPDBG(SCTP_DEBUG_TIMER2,
2349                             "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n",
2350                             t_type, inp, stcb, net);
2351                         return;
2352                 }
2353                 tmr = &net->pmtu_timer;
2354                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2355                 break;
2356         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2357                 /* Here we use the RTO of the destination. */
2358                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2359 #ifdef INVARIANTS
2360                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2361                             t_type, inp, stcb, net);
2362 #else
2363                         return;
2364 #endif
2365                 }
2366                 tmr = &net->rxt_timer;
2367                 if (net->RTO == 0) {
2368                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2369                 } else {
2370                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2371                 }
2372                 break;
2373         case SCTP_TIMER_TYPE_ASCONF:
2374                 /*
2375                  * Here the timer comes from the stcb but its value is from
2376                  * the net's RTO.
2377                  */
2378                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2379 #ifdef INVARIANTS
2380                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2381                             t_type, inp, stcb, net);
2382 #else
2383                         return;
2384 #endif
2385                 }
2386                 tmr = &stcb->asoc.asconf_timer;
2387                 if (net->RTO == 0) {
2388                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2389                 } else {
2390                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2391                 }
2392                 break;
2393         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2394                 /*
2395                  * Here we use the endpoints shutdown guard timer usually
2396                  * about 3 minutes.
2397                  */
2398                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2399 #ifdef INVARIANTS
2400                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2401                             t_type, inp, stcb, net);
2402 #else
2403                         return;
2404 #endif
2405                 }
2406                 tmr = &stcb->asoc.shut_guard_timer;
2407                 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) {
2408                         if (stcb->asoc.maxrto < UINT32_MAX / 5) {
2409                                 to_ticks = sctp_msecs_to_ticks(5 * stcb->asoc.maxrto);
2410                         } else {
2411                                 to_ticks = sctp_msecs_to_ticks(UINT32_MAX);
2412                         }
2413                 } else {
2414                         to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2415                 }
2416                 break;
2417         case SCTP_TIMER_TYPE_AUTOCLOSE:
2418                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2419 #ifdef INVARIANTS
2420                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2421                             t_type, inp, stcb, net);
2422 #else
2423                         return;
2424 #endif
2425                 }
2426                 tmr = &stcb->asoc.autoclose_timer;
2427                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2428                 break;
2429         case SCTP_TIMER_TYPE_STRRESET:
2430                 /*
2431                  * Here the timer comes from the stcb but its value is from
2432                  * the net's RTO.
2433                  */
2434                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2435 #ifdef INVARIANTS
2436                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2437                             t_type, inp, stcb, net);
2438 #else
2439                         return;
2440 #endif
2441                 }
2442                 tmr = &stcb->asoc.strreset_timer;
2443                 if (net->RTO == 0) {
2444                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2445                 } else {
2446                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2447                 }
2448                 break;
2449         case SCTP_TIMER_TYPE_INPKILL:
2450                 /*
2451                  * The inp is setup to die. We re-use the signature_chage
2452                  * timer since that has stopped and we are in the GONE
2453                  * state.
2454                  */
2455                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2456 #ifdef INVARIANTS
2457                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2458                             t_type, inp, stcb, net);
2459 #else
2460                         return;
2461 #endif
2462                 }
2463                 tmr = &inp->sctp_ep.signature_change;
2464                 to_ticks = sctp_msecs_to_ticks(SCTP_INP_KILL_TIMEOUT);
2465                 break;
2466         case SCTP_TIMER_TYPE_ASOCKILL:
2467                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2468 #ifdef INVARIANTS
2469                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2470                             t_type, inp, stcb, net);
2471 #else
2472                         return;
2473 #endif
2474                 }
2475                 tmr = &stcb->asoc.strreset_timer;
2476                 to_ticks = sctp_msecs_to_ticks(SCTP_ASOC_KILL_TIMEOUT);
2477                 break;
2478         case SCTP_TIMER_TYPE_ADDR_WQ:
2479                 if ((inp != NULL) || (stcb != NULL) || (net != NULL)) {
2480 #ifdef INVARIANTS
2481                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2482                             t_type, inp, stcb, net);
2483 #else
2484                         return;
2485 #endif
2486                 }
2487                 /* Only 1 tick away :-) */
2488                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2489                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
2490                 break;
2491         case SCTP_TIMER_TYPE_PRIM_DELETED:
2492                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2493 #ifdef INVARIANTS
2494                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2495                             t_type, inp, stcb, net);
2496 #else
2497                         return;
2498 #endif
2499                 }
2500                 tmr = &stcb->asoc.delete_prim_timer;
2501                 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2502                 break;
2503         default:
2504 #ifdef INVARIANTS
2505                 panic("Unknown timer type %d", t_type);
2506 #else
2507                 return;
2508 #endif
2509         }
2510         KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type));
2511         KASSERT(to_ticks > 0, ("to_ticks == 0 for timer type %d", t_type));
2512         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2513                 /*
2514                  * We do NOT allow you to have it already running. If it is,
2515                  * we leave the current one up unchanged.
2516                  */
2517                 SCTPDBG(SCTP_DEBUG_TIMER2,
2518                     "Timer type %d already running: inp=%p, stcb=%p, net=%p.\n",
2519                     t_type, inp, stcb, net);
2520                 return;
2521         }
2522         /* At this point we can proceed. */
2523         if (t_type == SCTP_TIMER_TYPE_SEND) {
2524                 stcb->asoc.num_send_timers_up++;
2525         }
2526         tmr->stopped_from = 0;
2527         tmr->type = t_type;
2528         tmr->ep = (void *)inp;
2529         tmr->tcb = (void *)stcb;
2530         if (t_type == SCTP_TIMER_TYPE_STRRESET) {
2531                 tmr->net = NULL;
2532         } else {
2533                 tmr->net = (void *)net;
2534         }
2535         tmr->self = (void *)tmr;
2536         tmr->vnet = (void *)curvnet;
2537         tmr->ticks = sctp_get_tick_count();
2538         if (SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr) == 0) {
2539                 SCTPDBG(SCTP_DEBUG_TIMER2,
2540                     "Timer type %d started: ticks=%u, inp=%p, stcb=%p, net=%p.\n",
2541                     t_type, to_ticks, inp, stcb, net);
2542         } else {
2543                 /*
2544                  * This should not happen, since we checked for pending
2545                  * above.
2546                  */
2547                 SCTPDBG(SCTP_DEBUG_TIMER2,
2548                     "Timer type %d restarted: ticks=%u, inp=%p, stcb=%p, net=%p.\n",
2549                     t_type, to_ticks, inp, stcb, net);
2550         }
2551         return;
2552 }
2553
2554 /*-
2555  * The following table shows which parameters must be provided
2556  * when calling sctp_timer_stop(). For parameters not being
2557  * provided, NULL must be used.
2558  *
2559  * |Name                         |inp |stcb|net |
2560  * |-----------------------------|----|----|----|
2561  * |SCTP_TIMER_TYPE_SEND         |Yes |Yes |Yes |
2562  * |SCTP_TIMER_TYPE_INIT         |Yes |Yes |Yes |
2563  * |SCTP_TIMER_TYPE_RECV         |Yes |Yes |No  |
2564  * |SCTP_TIMER_TYPE_SHUTDOWN     |Yes |Yes |Yes |
2565  * |SCTP_TIMER_TYPE_HEARTBEAT    |Yes |Yes |Yes |
2566  * |SCTP_TIMER_TYPE_COOKIE       |Yes |Yes |Yes |
2567  * |SCTP_TIMER_TYPE_NEWCOOKIE    |Yes |No  |No  |
2568  * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes |
2569  * |SCTP_TIMER_TYPE_SHUTDOWNACK  |Yes |Yes |Yes |
2570  * |SCTP_TIMER_TYPE_ASCONF       |Yes |Yes |No  |
2571  * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No  |
2572  * |SCTP_TIMER_TYPE_AUTOCLOSE    |Yes |Yes |No  |
2573  * |SCTP_TIMER_TYPE_STRRESET     |Yes |Yes |No  |
2574  * |SCTP_TIMER_TYPE_INPKILL      |Yes |No  |No  |
2575  * |SCTP_TIMER_TYPE_ASOCKILL     |Yes |Yes |No  |
2576  * |SCTP_TIMER_TYPE_ADDR_WQ      |No  |No  |No  |
2577  * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No  |
2578  *
2579  */
2580
2581 void
2582 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2583     struct sctp_nets *net, uint32_t from)
2584 {
2585         struct sctp_timer *tmr;
2586
2587         KASSERT(stcb == NULL || stcb->sctp_ep == inp,
2588             ("sctp_timer_stop of type %d: inp = %p, stcb->sctp_ep %p",
2589             t_type, stcb, stcb->sctp_ep));
2590         if (stcb != NULL) {
2591                 SCTP_TCB_LOCK_ASSERT(stcb);
2592         } else if (inp != NULL) {
2593                 SCTP_INP_WLOCK_ASSERT(inp);
2594         } else {
2595                 SCTP_WQ_ADDR_LOCK_ASSERT();
2596         }
2597         tmr = NULL;
2598         switch (t_type) {
2599         case SCTP_TIMER_TYPE_SEND:
2600                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2601 #ifdef INVARIANTS
2602                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2603                             t_type, inp, stcb, net);
2604 #else
2605                         return;
2606 #endif
2607                 }
2608                 tmr = &net->rxt_timer;
2609                 break;
2610         case SCTP_TIMER_TYPE_INIT:
2611                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2612 #ifdef INVARIANTS
2613                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2614                             t_type, inp, stcb, net);
2615 #else
2616                         return;
2617 #endif
2618                 }
2619                 tmr = &net->rxt_timer;
2620                 break;
2621         case SCTP_TIMER_TYPE_RECV:
2622                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2623 #ifdef INVARIANTS
2624                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2625                             t_type, inp, stcb, net);
2626 #else
2627                         return;
2628 #endif
2629                 }
2630                 tmr = &stcb->asoc.dack_timer;
2631                 break;
2632         case SCTP_TIMER_TYPE_SHUTDOWN:
2633                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2634 #ifdef INVARIANTS
2635                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2636                             t_type, inp, stcb, net);
2637 #else
2638                         return;
2639 #endif
2640                 }
2641                 tmr = &net->rxt_timer;
2642                 break;
2643         case SCTP_TIMER_TYPE_HEARTBEAT:
2644                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2645 #ifdef INVARIANTS
2646                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2647                             t_type, inp, stcb, net);
2648 #else
2649                         return;
2650 #endif
2651                 }
2652                 tmr = &net->hb_timer;
2653                 break;
2654         case SCTP_TIMER_TYPE_COOKIE:
2655                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2656 #ifdef INVARIANTS
2657                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2658                             t_type, inp, stcb, net);
2659 #else
2660                         return;
2661 #endif
2662                 }
2663                 tmr = &net->rxt_timer;
2664                 break;
2665         case SCTP_TIMER_TYPE_NEWCOOKIE:
2666                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2667 #ifdef INVARIANTS
2668                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2669                             t_type, inp, stcb, net);
2670 #else
2671                         return;
2672 #endif
2673                 }
2674                 tmr = &inp->sctp_ep.signature_change;
2675                 break;
2676         case SCTP_TIMER_TYPE_PATHMTURAISE:
2677                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2678 #ifdef INVARIANTS
2679                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2680                             t_type, inp, stcb, net);
2681 #else
2682                         return;
2683 #endif
2684                 }
2685                 tmr = &net->pmtu_timer;
2686                 break;
2687         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2688                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2689 #ifdef INVARIANTS
2690                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2691                             t_type, inp, stcb, net);
2692 #else
2693                         return;
2694 #endif
2695                 }
2696                 tmr = &net->rxt_timer;
2697                 break;
2698         case SCTP_TIMER_TYPE_ASCONF:
2699                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2700 #ifdef INVARIANTS
2701                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2702                             t_type, inp, stcb, net);
2703 #else
2704                         return;
2705 #endif
2706                 }
2707                 tmr = &stcb->asoc.asconf_timer;
2708                 break;
2709         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2710                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2711 #ifdef INVARIANTS
2712                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2713                             t_type, inp, stcb, net);
2714 #else
2715                         return;
2716 #endif
2717                 }
2718                 tmr = &stcb->asoc.shut_guard_timer;
2719                 break;
2720         case SCTP_TIMER_TYPE_AUTOCLOSE:
2721                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2722 #ifdef INVARIANTS
2723                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2724                             t_type, inp, stcb, net);
2725 #else
2726                         return;
2727 #endif
2728                 }
2729                 tmr = &stcb->asoc.autoclose_timer;
2730                 break;
2731         case SCTP_TIMER_TYPE_STRRESET:
2732                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2733 #ifdef INVARIANTS
2734                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2735                             t_type, inp, stcb, net);
2736 #else
2737                         return;
2738 #endif
2739                 }
2740                 tmr = &stcb->asoc.strreset_timer;
2741                 break;
2742         case SCTP_TIMER_TYPE_INPKILL:
2743                 /*
2744                  * The inp is setup to die. We re-use the signature_chage
2745                  * timer since that has stopped and we are in the GONE
2746                  * state.
2747                  */
2748                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2749 #ifdef INVARIANTS
2750                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2751                             t_type, inp, stcb, net);
2752 #else
2753                         return;
2754 #endif
2755                 }
2756                 tmr = &inp->sctp_ep.signature_change;
2757                 break;
2758         case SCTP_TIMER_TYPE_ASOCKILL:
2759                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2760 #ifdef INVARIANTS
2761                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2762                             t_type, inp, stcb, net);
2763 #else
2764                         return;
2765 #endif
2766                 }
2767                 tmr = &stcb->asoc.strreset_timer;
2768                 break;
2769         case SCTP_TIMER_TYPE_ADDR_WQ:
2770                 if ((inp != NULL) || (stcb != NULL) || (net != NULL)) {
2771 #ifdef INVARIANTS
2772                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2773                             t_type, inp, stcb, net);
2774 #else
2775                         return;
2776 #endif
2777                 }
2778                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2779                 break;
2780         case SCTP_TIMER_TYPE_PRIM_DELETED:
2781                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2782 #ifdef INVARIANTS
2783                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2784                             t_type, inp, stcb, net);
2785 #else
2786                         return;
2787 #endif
2788                 }
2789                 tmr = &stcb->asoc.delete_prim_timer;
2790                 break;
2791         default:
2792 #ifdef INVARIANTS
2793                 panic("Unknown timer type %d", t_type);
2794 #else
2795                 return;
2796 #endif
2797         }
2798         KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type));
2799         if ((tmr->type != SCTP_TIMER_TYPE_NONE) &&
2800             (tmr->type != t_type)) {
2801                 /*
2802                  * Ok we have a timer that is under joint use. Cookie timer
2803                  * per chance with the SEND timer. We therefore are NOT
2804                  * running the timer that the caller wants stopped.  So just
2805                  * return.
2806                  */
2807                 SCTPDBG(SCTP_DEBUG_TIMER2,
2808                     "Shared timer type %d not running: inp=%p, stcb=%p, net=%p.\n",
2809                     t_type, inp, stcb, net);
2810                 return;
2811         }
2812         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2813                 stcb->asoc.num_send_timers_up--;
2814                 if (stcb->asoc.num_send_timers_up < 0) {
2815                         stcb->asoc.num_send_timers_up = 0;
2816                 }
2817         }
2818         tmr->self = NULL;
2819         tmr->stopped_from = from;
2820         if (SCTP_OS_TIMER_STOP(&tmr->timer) == 1) {
2821                 KASSERT(tmr->ep == inp,
2822                     ("sctp_timer_stop of type %d: inp = %p, tmr->inp = %p",
2823                     t_type, inp, tmr->ep));
2824                 KASSERT(tmr->tcb == stcb,
2825                     ("sctp_timer_stop of type %d: stcb = %p, tmr->stcb = %p",
2826                     t_type, stcb, tmr->tcb));
2827                 KASSERT(((t_type == SCTP_TIMER_TYPE_ASCONF) && (tmr->net != NULL)) ||
2828                     ((t_type != SCTP_TIMER_TYPE_ASCONF) && (tmr->net == net)),
2829                     ("sctp_timer_stop of type %d: net = %p, tmr->net = %p",
2830                     t_type, net, tmr->net));
2831                 SCTPDBG(SCTP_DEBUG_TIMER2,
2832                     "Timer type %d stopped: inp=%p, stcb=%p, net=%p.\n",
2833                     t_type, inp, stcb, net);
2834                 tmr->ep = NULL;
2835                 tmr->tcb = NULL;
2836                 tmr->net = NULL;
2837         } else {
2838                 SCTPDBG(SCTP_DEBUG_TIMER2,
2839                     "Timer type %d not stopped: inp=%p, stcb=%p, net=%p.\n",
2840                     t_type, inp, stcb, net);
2841         }
2842         return;
2843 }
2844
2845 uint32_t
2846 sctp_calculate_len(struct mbuf *m)
2847 {
2848         uint32_t tlen = 0;
2849         struct mbuf *at;
2850
2851         at = m;
2852         while (at) {
2853                 tlen += SCTP_BUF_LEN(at);
2854                 at = SCTP_BUF_NEXT(at);
2855         }
2856         return (tlen);
2857 }
2858
2859 void
2860 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2861     struct sctp_association *asoc, uint32_t mtu)
2862 {
2863         /*
2864          * Reset the P-MTU size on this association, this involves changing
2865          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2866          * allow the DF flag to be cleared.
2867          */
2868         struct sctp_tmit_chunk *chk;
2869         unsigned int eff_mtu, ovh;
2870
2871         asoc->smallest_mtu = mtu;
2872         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2873                 ovh = SCTP_MIN_OVERHEAD;
2874         } else {
2875                 ovh = SCTP_MIN_V4_OVERHEAD;
2876         }
2877         eff_mtu = mtu - ovh;
2878         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2879                 if (chk->send_size > eff_mtu) {
2880                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2881                 }
2882         }
2883         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2884                 if (chk->send_size > eff_mtu) {
2885                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2886                 }
2887         }
2888 }
2889
2890
2891 /*
2892  * Given an association and starting time of the current RTT period, update
2893  * RTO in number of msecs. net should point to the current network.
2894  * Return 1, if an RTO update was performed, return 0 if no update was
2895  * performed due to invalid starting point.
2896  */
2897
2898 int
2899 sctp_calculate_rto(struct sctp_tcb *stcb,
2900     struct sctp_association *asoc,
2901     struct sctp_nets *net,
2902     struct timeval *old,
2903     int rtt_from_sack)
2904 {
2905         struct timeval now;
2906         uint64_t rtt_us;        /* RTT in us */
2907         int32_t rtt;            /* RTT in ms */
2908         uint32_t new_rto;
2909         int first_measure = 0;
2910
2911         /************************/
2912         /* 1. calculate new RTT */
2913         /************************/
2914         /* get the current time */
2915         if (stcb->asoc.use_precise_time) {
2916                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2917         } else {
2918                 (void)SCTP_GETTIME_TIMEVAL(&now);
2919         }
2920         if ((old->tv_sec > now.tv_sec) ||
2921             ((old->tv_sec == now.tv_sec) && (old->tv_usec > now.tv_usec))) {
2922                 /* The starting point is in the future. */
2923                 return (0);
2924         }
2925         timevalsub(&now, old);
2926         rtt_us = (uint64_t)1000000 * (uint64_t)now.tv_sec + (uint64_t)now.tv_usec;
2927         if (rtt_us > SCTP_RTO_UPPER_BOUND * 1000) {
2928                 /* The RTT is larger than a sane value. */
2929                 return (0);
2930         }
2931         /* store the current RTT in us */
2932         net->rtt = rtt_us;
2933         /* compute rtt in ms */
2934         rtt = (int32_t)(net->rtt / 1000);
2935         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2936                 /*
2937                  * Tell the CC module that a new update has just occurred
2938                  * from a sack
2939                  */
2940                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2941         }
2942         /*
2943          * Do we need to determine the lan? We do this only on sacks i.e.
2944          * RTT being determined from data not non-data (HB/INIT->INITACK).
2945          */
2946         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2947             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2948                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2949                         net->lan_type = SCTP_LAN_INTERNET;
2950                 } else {
2951                         net->lan_type = SCTP_LAN_LOCAL;
2952                 }
2953         }
2954
2955         /***************************/
2956         /* 2. update RTTVAR & SRTT */
2957         /***************************/
2958         /*-
2959          * Compute the scaled average lastsa and the
2960          * scaled variance lastsv as described in van Jacobson
2961          * Paper "Congestion Avoidance and Control", Annex A.
2962          *
2963          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2964          * (net->lastsv >> SCTP_RTT_VAR_SHIFT) is the rttvar
2965          */
2966         if (net->RTO_measured) {
2967                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2968                 net->lastsa += rtt;
2969                 if (rtt < 0) {
2970                         rtt = -rtt;
2971                 }
2972                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2973                 net->lastsv += rtt;
2974                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2975                         rto_logging(net, SCTP_LOG_RTTVAR);
2976                 }
2977         } else {
2978                 /* First RTO measurment */
2979                 net->RTO_measured = 1;
2980                 first_measure = 1;
2981                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2982                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2983                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2984                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2985                 }
2986         }
2987         if (net->lastsv == 0) {
2988                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2989         }
2990         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2991         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2992             (stcb->asoc.sat_network_lockout == 0)) {
2993                 stcb->asoc.sat_network = 1;
2994         } else if ((!first_measure) && stcb->asoc.sat_network) {
2995                 stcb->asoc.sat_network = 0;
2996                 stcb->asoc.sat_network_lockout = 1;
2997         }
2998         /* bound it, per C6/C7 in Section 5.3.1 */
2999         if (new_rto < stcb->asoc.minrto) {
3000                 new_rto = stcb->asoc.minrto;
3001         }
3002         if (new_rto > stcb->asoc.maxrto) {
3003                 new_rto = stcb->asoc.maxrto;
3004         }
3005         net->RTO = new_rto;
3006         return (1);
3007 }
3008
3009 /*
3010  * return a pointer to a contiguous piece of data from the given mbuf chain
3011  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
3012  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
3013  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
3014  */
3015 caddr_t
3016 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr)
3017 {
3018         uint32_t count;
3019         uint8_t *ptr;
3020
3021         ptr = in_ptr;
3022         if ((off < 0) || (len <= 0))
3023                 return (NULL);
3024
3025         /* find the desired start location */
3026         while ((m != NULL) && (off > 0)) {
3027                 if (off < SCTP_BUF_LEN(m))
3028                         break;
3029                 off -= SCTP_BUF_LEN(m);
3030                 m = SCTP_BUF_NEXT(m);
3031         }
3032         if (m == NULL)
3033                 return (NULL);
3034
3035         /* is the current mbuf large enough (eg. contiguous)? */
3036         if ((SCTP_BUF_LEN(m) - off) >= len) {
3037                 return (mtod(m, caddr_t)+off);
3038         } else {
3039                 /* else, it spans more than one mbuf, so save a temp copy... */
3040                 while ((m != NULL) && (len > 0)) {
3041                         count = min(SCTP_BUF_LEN(m) - off, len);
3042                         memcpy(ptr, mtod(m, caddr_t)+off, count);
3043                         len -= count;
3044                         ptr += count;
3045                         off = 0;
3046                         m = SCTP_BUF_NEXT(m);
3047                 }
3048                 if ((m == NULL) && (len > 0))
3049                         return (NULL);
3050                 else
3051                         return ((caddr_t)in_ptr);
3052         }
3053 }
3054
3055
3056
3057 struct sctp_paramhdr *
3058 sctp_get_next_param(struct mbuf *m,
3059     int offset,
3060     struct sctp_paramhdr *pull,
3061     int pull_limit)
3062 {
3063         /* This just provides a typed signature to Peter's Pull routine */
3064         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
3065             (uint8_t *)pull));
3066 }
3067
3068
3069 struct mbuf *
3070 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
3071 {
3072         struct mbuf *m_last;
3073         caddr_t dp;
3074
3075         if (padlen > 3) {
3076                 return (NULL);
3077         }
3078         if (padlen <= M_TRAILINGSPACE(m)) {
3079                 /*
3080                  * The easy way. We hope the majority of the time we hit
3081                  * here :)
3082                  */
3083                 m_last = m;
3084         } else {
3085                 /* Hard way we must grow the mbuf chain */
3086                 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
3087                 if (m_last == NULL) {
3088                         return (NULL);
3089                 }
3090                 SCTP_BUF_LEN(m_last) = 0;
3091                 SCTP_BUF_NEXT(m_last) = NULL;
3092                 SCTP_BUF_NEXT(m) = m_last;
3093         }
3094         dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
3095         SCTP_BUF_LEN(m_last) += padlen;
3096         memset(dp, 0, padlen);
3097         return (m_last);
3098 }
3099
3100 struct mbuf *
3101 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
3102 {
3103         /* find the last mbuf in chain and pad it */
3104         struct mbuf *m_at;
3105
3106         if (last_mbuf != NULL) {
3107                 return (sctp_add_pad_tombuf(last_mbuf, padval));
3108         } else {
3109                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
3110                         if (SCTP_BUF_NEXT(m_at) == NULL) {
3111                                 return (sctp_add_pad_tombuf(m_at, padval));
3112                         }
3113                 }
3114         }
3115         return (NULL);
3116 }
3117
3118 static void
3119 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
3120     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
3121     SCTP_UNUSED
3122 )
3123 {
3124         struct mbuf *m_notify;
3125         struct sctp_assoc_change *sac;
3126         struct sctp_queued_to_read *control;
3127         unsigned int notif_len;
3128         uint16_t abort_len;
3129         unsigned int i;
3130
3131         if (stcb == NULL) {
3132                 return;
3133         }
3134         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
3135                 notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
3136                 if (abort != NULL) {
3137                         abort_len = ntohs(abort->ch.chunk_length);
3138                         /*
3139                          * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
3140                          * contiguous.
3141                          */
3142                         if (abort_len > SCTP_CHUNK_BUFFER_SIZE) {
3143                                 abort_len = SCTP_CHUNK_BUFFER_SIZE;
3144                         }
3145                 } else {
3146                         abort_len = 0;
3147                 }
3148                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
3149                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
3150                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
3151                         notif_len += abort_len;
3152                 }
3153                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3154                 if (m_notify == NULL) {
3155                         /* Retry with smaller value. */
3156                         notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
3157                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3158                         if (m_notify == NULL) {
3159                                 goto set_error;
3160                         }
3161                 }
3162                 SCTP_BUF_NEXT(m_notify) = NULL;
3163                 sac = mtod(m_notify, struct sctp_assoc_change *);
3164                 memset(sac, 0, notif_len);
3165                 sac->sac_type = SCTP_ASSOC_CHANGE;
3166                 sac->sac_flags = 0;
3167                 sac->sac_length = sizeof(struct sctp_assoc_change);
3168                 sac->sac_state = state;
3169                 sac->sac_error = error;
3170                 /* XXX verify these stream counts */
3171                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
3172                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
3173                 sac->sac_assoc_id = sctp_get_associd(stcb);
3174                 if (notif_len > sizeof(struct sctp_assoc_change)) {
3175                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
3176                                 i = 0;
3177                                 if (stcb->asoc.prsctp_supported == 1) {
3178                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
3179                                 }
3180                                 if (stcb->asoc.auth_supported == 1) {
3181                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
3182                                 }
3183                                 if (stcb->asoc.asconf_supported == 1) {
3184                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
3185                                 }
3186                                 if (stcb->asoc.idata_supported == 1) {
3187                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING;
3188                                 }
3189                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
3190                                 if (stcb->asoc.reconfig_supported == 1) {
3191                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
3192                                 }
3193                                 sac->sac_length += i;
3194                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
3195                                 memcpy(sac->sac_info, abort, abort_len);
3196                                 sac->sac_length += abort_len;
3197                         }
3198                 }
3199                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
3200                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3201                     0, 0, stcb->asoc.context, 0, 0, 0,
3202                     m_notify);
3203                 if (control != NULL) {
3204                         control->length = SCTP_BUF_LEN(m_notify);
3205                         control->spec_flags = M_NOTIFICATION;
3206                         /* not that we need this */
3207                         control->tail_mbuf = m_notify;
3208                         sctp_add_to_readq(stcb->sctp_ep, stcb,
3209                             control,
3210                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
3211                             so_locked);
3212                 } else {
3213                         sctp_m_freem(m_notify);
3214                 }
3215         }
3216         /*
3217          * For 1-to-1 style sockets, we send up and error when an ABORT
3218          * comes in.
3219          */
3220 set_error:
3221         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3222             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
3223             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
3224                 SOCK_LOCK(stcb->sctp_socket);
3225                 if (from_peer) {
3226                         if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {
3227                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
3228                                 stcb->sctp_socket->so_error = ECONNREFUSED;
3229                         } else {
3230                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
3231                                 stcb->sctp_socket->so_error = ECONNRESET;
3232                         }
3233                 } else {
3234                         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
3235                             (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
3236                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
3237                                 stcb->sctp_socket->so_error = ETIMEDOUT;
3238                         } else {
3239                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
3240                                 stcb->sctp_socket->so_error = ECONNABORTED;
3241                         }
3242                 }
3243                 SOCK_UNLOCK(stcb->sctp_socket);
3244         }
3245         /* Wake ANY sleepers */
3246         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3247             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
3248             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
3249                 socantrcvmore(stcb->sctp_socket);
3250         }
3251         sorwakeup(stcb->sctp_socket);
3252         sowwakeup(stcb->sctp_socket);
3253 }
3254
3255 static void
3256 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
3257     struct sockaddr *sa, uint32_t error, int so_locked
3258     SCTP_UNUSED
3259 )
3260 {
3261         struct mbuf *m_notify;
3262         struct sctp_paddr_change *spc;
3263         struct sctp_queued_to_read *control;
3264
3265         if ((stcb == NULL) ||
3266             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
3267                 /* event not enabled */
3268                 return;
3269         }
3270         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
3271         if (m_notify == NULL)
3272                 return;
3273         SCTP_BUF_LEN(m_notify) = 0;
3274         spc = mtod(m_notify, struct sctp_paddr_change *);
3275         memset(spc, 0, sizeof(struct sctp_paddr_change));
3276         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
3277         spc->spc_flags = 0;
3278         spc->spc_length = sizeof(struct sctp_paddr_change);
3279         switch (sa->sa_family) {
3280 #ifdef INET
3281         case AF_INET:
3282 #ifdef INET6
3283                 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
3284                         in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
3285                             (struct sockaddr_in6 *)&spc->spc_aaddr);
3286                 } else {
3287                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
3288                 }
3289 #else
3290                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
3291 #endif
3292                 break;
3293 #endif
3294 #ifdef INET6
3295         case AF_INET6:
3296                 {
3297                         struct sockaddr_in6 *sin6;
3298
3299                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
3300
3301                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
3302                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
3303                                 if (sin6->sin6_scope_id == 0) {
3304                                         /* recover scope_id for user */
3305                                         (void)sa6_recoverscope(sin6);
3306                                 } else {
3307                                         /* clear embedded scope_id for user */
3308                                         in6_clearscope(&sin6->sin6_addr);
3309                                 }
3310                         }
3311                         break;
3312                 }
3313 #endif
3314         default:
3315                 /* TSNH */
3316                 break;
3317         }
3318         spc->spc_state = state;
3319         spc->spc_error = error;
3320         spc->spc_assoc_id = sctp_get_associd(stcb);
3321
3322         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
3323         SCTP_BUF_NEXT(m_notify) = NULL;
3324
3325         /* append to socket */
3326         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3327             0, 0, stcb->asoc.context, 0, 0, 0,
3328             m_notify);
3329         if (control == NULL) {
3330                 /* no memory */
3331                 sctp_m_freem(m_notify);
3332                 return;
3333         }
3334         control->length = SCTP_BUF_LEN(m_notify);
3335         control->spec_flags = M_NOTIFICATION;
3336         /* not that we need this */
3337         control->tail_mbuf = m_notify;
3338         sctp_add_to_readq(stcb->sctp_ep, stcb,
3339             control,
3340             &stcb->sctp_socket->so_rcv, 1,
3341             SCTP_READ_LOCK_NOT_HELD,
3342             so_locked);
3343 }
3344
3345
3346 static void
3347 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
3348     struct sctp_tmit_chunk *chk, int so_locked
3349     SCTP_UNUSED
3350 )
3351 {
3352         struct mbuf *m_notify;
3353         struct sctp_send_failed *ssf;
3354         struct sctp_send_failed_event *ssfe;
3355         struct sctp_queued_to_read *control;
3356         struct sctp_chunkhdr *chkhdr;
3357         int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len;
3358
3359         if ((stcb == NULL) ||
3360             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3361             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3362                 /* event not enabled */
3363                 return;
3364         }
3365
3366         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3367                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3368         } else {
3369                 notifhdr_len = sizeof(struct sctp_send_failed);
3370         }
3371         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3372         if (m_notify == NULL)
3373                 /* no space left */
3374                 return;
3375         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3376         if (stcb->asoc.idata_supported) {
3377                 chkhdr_len = sizeof(struct sctp_idata_chunk);
3378         } else {
3379                 chkhdr_len = sizeof(struct sctp_data_chunk);
3380         }
3381         /* Use some defaults in case we can't access the chunk header */
3382         if (chk->send_size >= chkhdr_len) {
3383                 payload_len = chk->send_size - chkhdr_len;
3384         } else {
3385                 payload_len = 0;
3386         }
3387         padding_len = 0;
3388         if (chk->data != NULL) {
3389                 chkhdr = mtod(chk->data, struct sctp_chunkhdr *);
3390                 if (chkhdr != NULL) {
3391                         chk_len = ntohs(chkhdr->chunk_length);
3392                         if ((chk_len >= chkhdr_len) &&
3393                             (chk->send_size >= chk_len) &&
3394                             (chk->send_size - chk_len < 4)) {
3395                                 padding_len = chk->send_size - chk_len;
3396                                 payload_len = chk->send_size - chkhdr_len - padding_len;
3397                         }
3398                 }
3399         }
3400         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3401                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3402                 memset(ssfe, 0, notifhdr_len);
3403                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3404                 if (sent) {
3405                         ssfe->ssfe_flags = SCTP_DATA_SENT;
3406                 } else {
3407                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3408                 }
3409                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len);
3410                 ssfe->ssfe_error = error;
3411                 /* not exactly what the user sent in, but should be close :) */
3412                 ssfe->ssfe_info.snd_sid = chk->rec.data.sid;
3413                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
3414                 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid;
3415                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
3416                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3417                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3418         } else {
3419                 ssf = mtod(m_notify, struct sctp_send_failed *);
3420                 memset(ssf, 0, notifhdr_len);
3421                 ssf->ssf_type = SCTP_SEND_FAILED;
3422                 if (sent) {
3423                         ssf->ssf_flags = SCTP_DATA_SENT;
3424                 } else {
3425                         ssf->ssf_flags = SCTP_DATA_UNSENT;
3426                 }
3427                 ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len);
3428                 ssf->ssf_error = error;
3429                 /* not exactly what the user sent in, but should be close :) */
3430                 ssf->ssf_info.sinfo_stream = chk->rec.data.sid;
3431                 ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid;
3432                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
3433                 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid;
3434                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
3435                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3436                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3437         }
3438         if (chk->data != NULL) {
3439                 /* Trim off the sctp chunk header (it should be there) */
3440                 if (chk->send_size == chkhdr_len + payload_len + padding_len) {
3441                         m_adj(chk->data, chkhdr_len);
3442                         m_adj(chk->data, -padding_len);
3443                         sctp_mbuf_crush(chk->data);
3444                         chk->send_size -= (chkhdr_len + padding_len);
3445                 }
3446         }
3447         SCTP_BUF_NEXT(m_notify) = chk->data;
3448         /* Steal off the mbuf */
3449         chk->data = NULL;
3450         /*
3451          * For this case, we check the actual socket buffer, since the assoc
3452          * is going away we don't want to overfill the socket buffer for a
3453          * non-reader
3454          */
3455         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3456                 sctp_m_freem(m_notify);
3457                 return;
3458         }
3459         /* append to socket */
3460         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3461             0, 0, stcb->asoc.context, 0, 0, 0,
3462             m_notify);
3463         if (control == NULL) {
3464                 /* no memory */
3465                 sctp_m_freem(m_notify);
3466                 return;
3467         }
3468         control->length = SCTP_BUF_LEN(m_notify);
3469         control->spec_flags = M_NOTIFICATION;
3470         /* not that we need this */
3471         control->tail_mbuf = m_notify;
3472         sctp_add_to_readq(stcb->sctp_ep, stcb,
3473             control,
3474             &stcb->sctp_socket->so_rcv, 1,
3475             SCTP_READ_LOCK_NOT_HELD,
3476             so_locked);
3477 }
3478
3479
3480 static void
3481 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3482     struct sctp_stream_queue_pending *sp, int so_locked
3483     SCTP_UNUSED
3484 )
3485 {
3486         struct mbuf *m_notify;
3487         struct sctp_send_failed *ssf;
3488         struct sctp_send_failed_event *ssfe;
3489         struct sctp_queued_to_read *control;
3490         int notifhdr_len;
3491
3492         if ((stcb == NULL) ||
3493             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3494             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3495                 /* event not enabled */
3496                 return;
3497         }
3498         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3499                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3500         } else {
3501                 notifhdr_len = sizeof(struct sctp_send_failed);
3502         }
3503         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3504         if (m_notify == NULL) {
3505                 /* no space left */
3506                 return;
3507         }
3508         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3509         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3510                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3511                 memset(ssfe, 0, notifhdr_len);
3512                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3513                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3514                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length);
3515                 ssfe->ssfe_error = error;
3516                 /* not exactly what the user sent in, but should be close :) */
3517                 ssfe->ssfe_info.snd_sid = sp->sid;
3518                 if (sp->some_taken) {
3519                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
3520                 } else {
3521                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
3522                 }
3523                 ssfe->ssfe_info.snd_ppid = sp->ppid;
3524                 ssfe->ssfe_info.snd_context = sp->context;
3525                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3526                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3527         } else {
3528                 ssf = mtod(m_notify, struct sctp_send_failed *);
3529                 memset(ssf, 0, notifhdr_len);
3530                 ssf->ssf_type = SCTP_SEND_FAILED;
3531                 ssf->ssf_flags = SCTP_DATA_UNSENT;
3532                 ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length);
3533                 ssf->ssf_error = error;
3534                 /* not exactly what the user sent in, but should be close :) */
3535                 ssf->ssf_info.sinfo_stream = sp->sid;
3536                 ssf->ssf_info.sinfo_ssn = 0;
3537                 if (sp->some_taken) {
3538                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3539                 } else {
3540                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3541                 }
3542                 ssf->ssf_info.sinfo_ppid = sp->ppid;
3543                 ssf->ssf_info.sinfo_context = sp->context;
3544                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3545                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3546         }
3547         SCTP_BUF_NEXT(m_notify) = sp->data;
3548
3549         /* Steal off the mbuf */
3550         sp->data = NULL;
3551         /*
3552          * For this case, we check the actual socket buffer, since the assoc
3553          * is going away we don't want to overfill the socket buffer for a
3554          * non-reader
3555          */
3556         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3557                 sctp_m_freem(m_notify);
3558                 return;
3559         }
3560         /* append to socket */
3561         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3562             0, 0, stcb->asoc.context, 0, 0, 0,
3563             m_notify);
3564         if (control == NULL) {
3565                 /* no memory */
3566                 sctp_m_freem(m_notify);
3567                 return;
3568         }
3569         control->length = SCTP_BUF_LEN(m_notify);
3570         control->spec_flags = M_NOTIFICATION;
3571         /* not that we need this */
3572         control->tail_mbuf = m_notify;
3573         sctp_add_to_readq(stcb->sctp_ep, stcb,
3574             control,
3575             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3576 }
3577
3578
3579
3580 static void
3581 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3582 {
3583         struct mbuf *m_notify;
3584         struct sctp_adaptation_event *sai;
3585         struct sctp_queued_to_read *control;
3586
3587         if ((stcb == NULL) ||
3588             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3589                 /* event not enabled */
3590                 return;
3591         }
3592
3593         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3594         if (m_notify == NULL)
3595                 /* no space left */
3596                 return;
3597         SCTP_BUF_LEN(m_notify) = 0;
3598         sai = mtod(m_notify, struct sctp_adaptation_event *);
3599         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3600         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3601         sai->sai_flags = 0;
3602         sai->sai_length = sizeof(struct sctp_adaptation_event);
3603         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3604         sai->sai_assoc_id = sctp_get_associd(stcb);
3605
3606         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3607         SCTP_BUF_NEXT(m_notify) = NULL;
3608
3609         /* append to socket */
3610         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3611             0, 0, stcb->asoc.context, 0, 0, 0,
3612             m_notify);
3613         if (control == NULL) {
3614                 /* no memory */
3615                 sctp_m_freem(m_notify);
3616                 return;
3617         }
3618         control->length = SCTP_BUF_LEN(m_notify);
3619         control->spec_flags = M_NOTIFICATION;
3620         /* not that we need this */
3621         control->tail_mbuf = m_notify;
3622         sctp_add_to_readq(stcb->sctp_ep, stcb,
3623             control,
3624             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3625 }
3626
3627 /* This always must be called with the read-queue LOCKED in the INP */
3628 static void
3629 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3630     uint32_t val, int so_locked
3631     SCTP_UNUSED
3632 )
3633 {
3634         struct mbuf *m_notify;
3635         struct sctp_pdapi_event *pdapi;
3636         struct sctp_queued_to_read *control;
3637         struct sockbuf *sb;
3638
3639         if ((stcb == NULL) ||
3640             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3641                 /* event not enabled */
3642                 return;
3643         }
3644         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3645                 return;
3646         }
3647
3648         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3649         if (m_notify == NULL)
3650                 /* no space left */
3651                 return;
3652         SCTP_BUF_LEN(m_notify) = 0;
3653         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3654         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3655         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3656         pdapi->pdapi_flags = 0;
3657         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3658         pdapi->pdapi_indication = error;
3659         pdapi->pdapi_stream = (val >> 16);
3660         pdapi->pdapi_seq = (val & 0x0000ffff);
3661         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3662
3663         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3664         SCTP_BUF_NEXT(m_notify) = NULL;
3665         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3666             0, 0, stcb->asoc.context, 0, 0, 0,
3667             m_notify);
3668         if (control == NULL) {
3669                 /* no memory */
3670                 sctp_m_freem(m_notify);
3671                 return;
3672         }
3673         control->length = SCTP_BUF_LEN(m_notify);
3674         control->spec_flags = M_NOTIFICATION;
3675         /* not that we need this */
3676         control->tail_mbuf = m_notify;
3677         sb = &stcb->sctp_socket->so_rcv;
3678         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3679                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3680         }
3681         sctp_sballoc(stcb, sb, m_notify);
3682         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3683                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3684         }
3685         control->end_added = 1;
3686         if (stcb->asoc.control_pdapi)
3687                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3688         else {
3689                 /* we really should not see this case */
3690                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3691         }
3692         if (stcb->sctp_ep && stcb->sctp_socket) {
3693                 /* This should always be the case */
3694                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3695         }
3696 }
3697
3698 static void
3699 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3700 {
3701         struct mbuf *m_notify;
3702         struct sctp_shutdown_event *sse;
3703         struct sctp_queued_to_read *control;
3704
3705         /*
3706          * For TCP model AND UDP connected sockets we will send an error up
3707          * when an SHUTDOWN completes
3708          */
3709         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3710             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3711                 /* mark socket closed for read/write and wakeup! */
3712                 socantsendmore(stcb->sctp_socket);
3713         }
3714         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3715                 /* event not enabled */
3716                 return;
3717         }
3718
3719         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3720         if (m_notify == NULL)
3721                 /* no space left */
3722                 return;
3723         sse = mtod(m_notify, struct sctp_shutdown_event *);
3724         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3725         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3726         sse->sse_flags = 0;
3727         sse->sse_length = sizeof(struct sctp_shutdown_event);
3728         sse->sse_assoc_id = sctp_get_associd(stcb);
3729
3730         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3731         SCTP_BUF_NEXT(m_notify) = NULL;
3732
3733         /* append to socket */
3734         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3735             0, 0, stcb->asoc.context, 0, 0, 0,
3736             m_notify);
3737         if (control == NULL) {
3738                 /* no memory */
3739                 sctp_m_freem(m_notify);
3740                 return;
3741         }
3742         control->length = SCTP_BUF_LEN(m_notify);
3743         control->spec_flags = M_NOTIFICATION;
3744         /* not that we need this */
3745         control->tail_mbuf = m_notify;
3746         sctp_add_to_readq(stcb->sctp_ep, stcb,
3747             control,
3748             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3749 }
3750
3751 static void
3752 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3753     int so_locked
3754     SCTP_UNUSED
3755 )
3756 {
3757         struct mbuf *m_notify;
3758         struct sctp_sender_dry_event *event;
3759         struct sctp_queued_to_read *control;
3760
3761         if ((stcb == NULL) ||
3762             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3763                 /* event not enabled */
3764                 return;
3765         }
3766
3767         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3768         if (m_notify == NULL) {
3769                 /* no space left */
3770                 return;
3771         }
3772         SCTP_BUF_LEN(m_notify) = 0;
3773         event = mtod(m_notify, struct sctp_sender_dry_event *);
3774         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3775         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3776         event->sender_dry_flags = 0;
3777         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3778         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3779
3780         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3781         SCTP_BUF_NEXT(m_notify) = NULL;
3782
3783         /* append to socket */
3784         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3785             0, 0, stcb->asoc.context, 0, 0, 0,
3786             m_notify);
3787         if (control == NULL) {
3788                 /* no memory */
3789                 sctp_m_freem(m_notify);
3790                 return;
3791         }
3792         control->length = SCTP_BUF_LEN(m_notify);
3793         control->spec_flags = M_NOTIFICATION;
3794         /* not that we need this */
3795         control->tail_mbuf = m_notify;
3796         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3797             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3798 }
3799
3800
3801 void
3802 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3803 {
3804         struct mbuf *m_notify;
3805         struct sctp_queued_to_read *control;
3806         struct sctp_stream_change_event *stradd;
3807
3808         if ((stcb == NULL) ||
3809             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3810                 /* event not enabled */
3811                 return;
3812         }
3813         if ((stcb->asoc.peer_req_out) && flag) {
3814                 /* Peer made the request, don't tell the local user */
3815                 stcb->asoc.peer_req_out = 0;
3816                 return;
3817         }
3818         stcb->asoc.peer_req_out = 0;
3819         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3820         if (m_notify == NULL)
3821                 /* no space left */
3822                 return;
3823         SCTP_BUF_LEN(m_notify) = 0;
3824         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3825         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3826         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3827         stradd->strchange_flags = flag;
3828         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3829         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3830         stradd->strchange_instrms = numberin;
3831         stradd->strchange_outstrms = numberout;
3832         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3833         SCTP_BUF_NEXT(m_notify) = NULL;
3834         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3835                 /* no space */
3836                 sctp_m_freem(m_notify);
3837                 return;
3838         }
3839         /* append to socket */
3840         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3841             0, 0, stcb->asoc.context, 0, 0, 0,
3842             m_notify);
3843         if (control == NULL) {
3844                 /* no memory */
3845                 sctp_m_freem(m_notify);
3846                 return;
3847         }
3848         control->length = SCTP_BUF_LEN(m_notify);
3849         control->spec_flags = M_NOTIFICATION;
3850         /* not that we need this */
3851         control->tail_mbuf = m_notify;
3852         sctp_add_to_readq(stcb->sctp_ep, stcb,
3853             control,
3854             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3855 }
3856
3857 void
3858 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3859 {
3860         struct mbuf *m_notify;
3861         struct sctp_queued_to_read *control;
3862         struct sctp_assoc_reset_event *strasoc;
3863
3864         if ((stcb == NULL) ||
3865             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3866                 /* event not enabled */
3867                 return;
3868         }
3869         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3870         if (m_notify == NULL)
3871                 /* no space left */
3872                 return;
3873         SCTP_BUF_LEN(m_notify) = 0;
3874         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3875         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3876         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3877         strasoc->assocreset_flags = flag;
3878         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3879         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3880         strasoc->assocreset_local_tsn = sending_tsn;
3881         strasoc->assocreset_remote_tsn = recv_tsn;
3882         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3883         SCTP_BUF_NEXT(m_notify) = NULL;
3884         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3885                 /* no space */
3886                 sctp_m_freem(m_notify);
3887                 return;
3888         }
3889         /* append to socket */
3890         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3891             0, 0, stcb->asoc.context, 0, 0, 0,
3892             m_notify);
3893         if (control == NULL) {
3894                 /* no memory */
3895                 sctp_m_freem(m_notify);
3896                 return;
3897         }
3898         control->length = SCTP_BUF_LEN(m_notify);
3899         control->spec_flags = M_NOTIFICATION;
3900         /* not that we need this */
3901         control->tail_mbuf = m_notify;
3902         sctp_add_to_readq(stcb->sctp_ep, stcb,
3903             control,
3904             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3905 }
3906
3907
3908
3909 static void
3910 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3911     int number_entries, uint16_t *list, int flag)
3912 {
3913         struct mbuf *m_notify;
3914         struct sctp_queued_to_read *control;
3915         struct sctp_stream_reset_event *strreset;
3916         int len;
3917
3918         if ((stcb == NULL) ||
3919             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3920                 /* event not enabled */
3921                 return;
3922         }
3923
3924         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3925         if (m_notify == NULL)
3926                 /* no space left */
3927                 return;
3928         SCTP_BUF_LEN(m_notify) = 0;
3929         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3930         if (len > M_TRAILINGSPACE(m_notify)) {
3931                 /* never enough room */
3932                 sctp_m_freem(m_notify);
3933                 return;
3934         }
3935         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3936         memset(strreset, 0, len);
3937         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3938         strreset->strreset_flags = flag;
3939         strreset->strreset_length = len;
3940         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3941         if (number_entries) {
3942                 int i;
3943
3944                 for (i = 0; i < number_entries; i++) {
3945                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3946                 }
3947         }
3948         SCTP_BUF_LEN(m_notify) = len;
3949         SCTP_BUF_NEXT(m_notify) = NULL;
3950         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3951                 /* no space */
3952                 sctp_m_freem(m_notify);
3953                 return;
3954         }
3955         /* append to socket */
3956         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3957             0, 0, stcb->asoc.context, 0, 0, 0,
3958             m_notify);
3959         if (control == NULL) {
3960                 /* no memory */
3961                 sctp_m_freem(m_notify);
3962                 return;
3963         }
3964         control->length = SCTP_BUF_LEN(m_notify);
3965         control->spec_flags = M_NOTIFICATION;
3966         /* not that we need this */
3967         control->tail_mbuf = m_notify;
3968         sctp_add_to_readq(stcb->sctp_ep, stcb,
3969             control,
3970             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3971 }
3972
3973
3974 static void
3975 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3976 {
3977         struct mbuf *m_notify;
3978         struct sctp_remote_error *sre;
3979         struct sctp_queued_to_read *control;
3980         unsigned int notif_len;
3981         uint16_t chunk_len;
3982
3983         if ((stcb == NULL) ||
3984             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3985                 return;
3986         }
3987         if (chunk != NULL) {
3988                 chunk_len = ntohs(chunk->ch.chunk_length);
3989                 /*
3990                  * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
3991                  * contiguous.
3992                  */
3993                 if (chunk_len > SCTP_CHUNK_BUFFER_SIZE) {
3994                         chunk_len = SCTP_CHUNK_BUFFER_SIZE;
3995                 }
3996         } else {
3997                 chunk_len = 0;
3998         }
3999         notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len);
4000         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
4001         if (m_notify == NULL) {
4002                 /* Retry with smaller value. */
4003                 notif_len = (unsigned int)sizeof(struct sctp_remote_error);
4004                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
4005                 if (m_notify == NULL) {
4006                         return;
4007                 }
4008         }
4009         SCTP_BUF_NEXT(m_notify) = NULL;
4010         sre = mtod(m_notify, struct sctp_remote_error *);
4011         memset(sre, 0, notif_len);
4012         sre->sre_type = SCTP_REMOTE_ERROR;
4013         sre->sre_flags = 0;
4014         sre->sre_length = sizeof(struct sctp_remote_error);
4015         sre->sre_error = error;
4016         sre->sre_assoc_id = sctp_get_associd(stcb);
4017         if (notif_len > sizeof(struct sctp_remote_error)) {
4018                 memcpy(sre->sre_data, chunk, chunk_len);
4019                 sre->sre_length += chunk_len;
4020         }
4021         SCTP_BUF_LEN(m_notify) = sre->sre_length;
4022         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
4023             0, 0, stcb->asoc.context, 0, 0, 0,
4024             m_notify);
4025         if (control != NULL) {
4026                 control->length = SCTP_BUF_LEN(m_notify);
4027                 control->spec_flags = M_NOTIFICATION;
4028                 /* not that we need this */
4029                 control->tail_mbuf = m_notify;
4030                 sctp_add_to_readq(stcb->sctp_ep, stcb,
4031                     control,
4032                     &stcb->sctp_socket->so_rcv, 1,
4033                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
4034         } else {
4035                 sctp_m_freem(m_notify);
4036         }
4037 }
4038
4039
4040 void
4041 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
4042     uint32_t error, void *data, int so_locked
4043     SCTP_UNUSED
4044 )
4045 {
4046         if ((stcb == NULL) ||
4047             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4048             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4049             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
4050                 /* If the socket is gone we are out of here */
4051                 return;
4052         }
4053         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
4054                 return;
4055         }
4056         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4057             (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4058                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
4059                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
4060                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
4061                         /* Don't report these in front states */
4062                         return;
4063                 }
4064         }
4065         switch (notification) {
4066         case SCTP_NOTIFY_ASSOC_UP:
4067                 if (stcb->asoc.assoc_up_sent == 0) {
4068                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
4069                         stcb->asoc.assoc_up_sent = 1;
4070                 }
4071                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
4072                         sctp_notify_adaptation_layer(stcb);
4073                 }
4074                 if (stcb->asoc.auth_supported == 0) {
4075                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
4076                             NULL, so_locked);
4077                 }
4078                 break;
4079         case SCTP_NOTIFY_ASSOC_DOWN:
4080                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
4081                 break;
4082         case SCTP_NOTIFY_INTERFACE_DOWN:
4083                 {
4084                         struct sctp_nets *net;
4085
4086                         net = (struct sctp_nets *)data;
4087                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
4088                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4089                         break;
4090                 }
4091         case SCTP_NOTIFY_INTERFACE_UP:
4092                 {
4093                         struct sctp_nets *net;
4094
4095                         net = (struct sctp_nets *)data;
4096                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
4097                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4098                         break;
4099                 }
4100         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
4101                 {
4102                         struct sctp_nets *net;
4103
4104                         net = (struct sctp_nets *)data;
4105                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
4106                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4107                         break;
4108                 }
4109         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
4110                 sctp_notify_send_failed2(stcb, error,
4111                     (struct sctp_stream_queue_pending *)data, so_locked);
4112                 break;
4113         case SCTP_NOTIFY_SENT_DG_FAIL:
4114                 sctp_notify_send_failed(stcb, 1, error,
4115                     (struct sctp_tmit_chunk *)data, so_locked);
4116                 break;
4117         case SCTP_NOTIFY_UNSENT_DG_FAIL:
4118                 sctp_notify_send_failed(stcb, 0, error,
4119                     (struct sctp_tmit_chunk *)data, so_locked);
4120                 break;
4121         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
4122                 {
4123                         uint32_t val;
4124
4125                         val = *((uint32_t *)data);
4126
4127                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
4128                         break;
4129                 }
4130         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
4131                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4132                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4133                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
4134                 } else {
4135                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
4136                 }
4137                 break;
4138         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
4139                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4140                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4141                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
4142                 } else {
4143                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
4144                 }
4145                 break;
4146         case SCTP_NOTIFY_ASSOC_RESTART:
4147                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
4148                 if (stcb->asoc.auth_supported == 0) {
4149                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
4150                             NULL, so_locked);
4151                 }
4152                 break;
4153         case SCTP_NOTIFY_STR_RESET_SEND:
4154                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN);
4155                 break;
4156         case SCTP_NOTIFY_STR_RESET_RECV:
4157                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING);
4158                 break;
4159         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
4160                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4161                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
4162                 break;
4163         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
4164                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4165                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
4166                 break;
4167         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
4168                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4169                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
4170                 break;
4171         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
4172                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4173                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
4174                 break;
4175         case SCTP_NOTIFY_ASCONF_ADD_IP:
4176                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
4177                     error, so_locked);
4178                 break;
4179         case SCTP_NOTIFY_ASCONF_DELETE_IP:
4180                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
4181                     error, so_locked);
4182                 break;
4183         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
4184                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
4185                     error, so_locked);
4186                 break;
4187         case SCTP_NOTIFY_PEER_SHUTDOWN:
4188                 sctp_notify_shutdown_event(stcb);
4189                 break;
4190         case SCTP_NOTIFY_AUTH_NEW_KEY:
4191                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
4192                     (uint16_t)(uintptr_t)data,
4193                     so_locked);
4194                 break;
4195         case SCTP_NOTIFY_AUTH_FREE_KEY:
4196                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
4197                     (uint16_t)(uintptr_t)data,
4198                     so_locked);
4199                 break;
4200         case SCTP_NOTIFY_NO_PEER_AUTH:
4201                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
4202                     (uint16_t)(uintptr_t)data,
4203                     so_locked);
4204                 break;
4205         case SCTP_NOTIFY_SENDER_DRY:
4206                 sctp_notify_sender_dry_event(stcb, so_locked);
4207                 break;
4208         case SCTP_NOTIFY_REMOTE_ERROR:
4209                 sctp_notify_remote_error(stcb, error, data);
4210                 break;
4211         default:
4212                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
4213                     __func__, notification, notification);
4214                 break;
4215         }                       /* end switch */
4216 }
4217
4218 void
4219 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int holds_lock, int so_locked
4220     SCTP_UNUSED
4221 )
4222 {
4223         struct sctp_association *asoc;
4224         struct sctp_stream_out *outs;
4225         struct sctp_tmit_chunk *chk, *nchk;
4226         struct sctp_stream_queue_pending *sp, *nsp;
4227         int i;
4228
4229         if (stcb == NULL) {
4230                 return;
4231         }
4232         asoc = &stcb->asoc;
4233         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4234                 /* already being freed */
4235                 return;
4236         }
4237         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4238             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4239             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
4240                 return;
4241         }
4242         /* now through all the gunk freeing chunks */
4243         if (holds_lock == 0) {
4244                 SCTP_TCB_SEND_LOCK(stcb);
4245         }
4246         /* sent queue SHOULD be empty */
4247         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
4248                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
4249                 asoc->sent_queue_cnt--;
4250                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
4251                         if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
4252                                 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
4253 #ifdef INVARIANTS
4254                         } else {
4255                                 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
4256 #endif
4257                         }
4258                 }
4259                 if (chk->data != NULL) {
4260                         sctp_free_bufspace(stcb, asoc, chk, 1);
4261                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
4262                             error, chk, so_locked);
4263                         if (chk->data) {
4264                                 sctp_m_freem(chk->data);
4265                                 chk->data = NULL;
4266                         }
4267                 }
4268                 sctp_free_a_chunk(stcb, chk, so_locked);
4269                 /* sa_ignore FREED_MEMORY */
4270         }
4271         /* pending send queue SHOULD be empty */
4272         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
4273                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
4274                 asoc->send_queue_cnt--;
4275                 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
4276                         asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
4277 #ifdef INVARIANTS
4278                 } else {
4279                         panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
4280 #endif
4281                 }
4282                 if (chk->data != NULL) {
4283                         sctp_free_bufspace(stcb, asoc, chk, 1);
4284                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
4285                             error, chk, so_locked);
4286                         if (chk->data) {
4287                                 sctp_m_freem(chk->data);
4288                                 chk->data = NULL;
4289                         }
4290                 }
4291                 sctp_free_a_chunk(stcb, chk, so_locked);
4292                 /* sa_ignore FREED_MEMORY */
4293         }
4294         for (i = 0; i < asoc->streamoutcnt; i++) {
4295                 /* For each stream */
4296                 outs = &asoc->strmout[i];
4297                 /* clean up any sends there */
4298                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
4299                         atomic_subtract_int(&asoc->stream_queue_cnt, 1);
4300                         TAILQ_REMOVE(&outs->outqueue, sp, next);
4301                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
4302                         sctp_free_spbufspace(stcb, asoc, sp);
4303                         if (sp->data) {
4304                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
4305                                     error, (void *)sp, so_locked);
4306                                 if (sp->data) {
4307                                         sctp_m_freem(sp->data);
4308                                         sp->data = NULL;
4309                                         sp->tail_mbuf = NULL;
4310                                         sp->length = 0;
4311                                 }
4312                         }
4313                         if (sp->net) {
4314                                 sctp_free_remote_addr(sp->net);
4315                                 sp->net = NULL;
4316                         }
4317                         /* Free the chunk */
4318                         sctp_free_a_strmoq(stcb, sp, so_locked);
4319                         /* sa_ignore FREED_MEMORY */
4320                 }
4321         }
4322
4323         if (holds_lock == 0) {
4324                 SCTP_TCB_SEND_UNLOCK(stcb);
4325         }
4326 }
4327
4328 void
4329 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
4330     struct sctp_abort_chunk *abort, int so_locked
4331     SCTP_UNUSED
4332 )
4333 {
4334         if (stcb == NULL) {
4335                 return;
4336         }
4337         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
4338             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
4339             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
4340                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
4341         }
4342         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4343             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4344             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
4345                 return;
4346         }
4347         /* Tell them we lost the asoc */
4348         sctp_report_all_outbound(stcb, error, 0, so_locked);
4349         if (from_peer) {
4350                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
4351         } else {
4352                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
4353         }
4354 }
4355
4356 void
4357 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4358     struct mbuf *m, int iphlen,
4359     struct sockaddr *src, struct sockaddr *dst,
4360     struct sctphdr *sh, struct mbuf *op_err,
4361     uint8_t mflowtype, uint32_t mflowid,
4362     uint32_t vrf_id, uint16_t port)
4363 {
4364         uint32_t vtag;
4365
4366         vtag = 0;
4367         if (stcb != NULL) {
4368                 vtag = stcb->asoc.peer_vtag;
4369                 vrf_id = stcb->asoc.vrf_id;
4370         }
4371         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
4372             mflowtype, mflowid, inp->fibnum,
4373             vrf_id, port);
4374         if (stcb != NULL) {
4375                 /* We have a TCB to abort, send notification too */
4376                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
4377                 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED);
4378                 /* Ok, now lets free it */
4379                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4380                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4381                     (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4382                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4383                 }
4384                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4385                     SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
4386         }
4387 }
4388 #ifdef SCTP_ASOCLOG_OF_TSNS
4389 void
4390 sctp_print_out_track_log(struct sctp_tcb *stcb)
4391 {
4392 #ifdef NOSIY_PRINTS
4393         int i;
4394
4395         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
4396         SCTP_PRINTF("IN bound TSN log-aaa\n");
4397         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
4398                 SCTP_PRINTF("None rcvd\n");
4399                 goto none_in;
4400         }
4401         if (stcb->asoc.tsn_in_wrapped) {
4402                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
4403                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4404                             stcb->asoc.in_tsnlog[i].tsn,
4405                             stcb->asoc.in_tsnlog[i].strm,
4406                             stcb->asoc.in_tsnlog[i].seq,
4407                             stcb->asoc.in_tsnlog[i].flgs,
4408                             stcb->asoc.in_tsnlog[i].sz);
4409                 }
4410         }
4411         if (stcb->asoc.tsn_in_at) {
4412                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
4413                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4414                             stcb->asoc.in_tsnlog[i].tsn,
4415                             stcb->asoc.in_tsnlog[i].strm,
4416                             stcb->asoc.in_tsnlog[i].seq,
4417                             stcb->asoc.in_tsnlog[i].flgs,
4418                             stcb->asoc.in_tsnlog[i].sz);
4419                 }
4420         }
4421 none_in:
4422         SCTP_PRINTF("OUT bound TSN log-aaa\n");
4423         if ((stcb->asoc.tsn_out_at == 0) &&
4424             (stcb->asoc.tsn_out_wrapped == 0)) {
4425                 SCTP_PRINTF("None sent\n");
4426         }
4427         if (stcb->asoc.tsn_out_wrapped) {
4428                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
4429                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4430                             stcb->asoc.out_tsnlog[i].tsn,
4431                             stcb->asoc.out_tsnlog[i].strm,
4432                             stcb->asoc.out_tsnlog[i].seq,
4433                             stcb->asoc.out_tsnlog[i].flgs,
4434                             stcb->asoc.out_tsnlog[i].sz);
4435                 }
4436         }
4437         if (stcb->asoc.tsn_out_at) {
4438                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
4439                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4440                             stcb->asoc.out_tsnlog[i].tsn,
4441                             stcb->asoc.out_tsnlog[i].strm,
4442                             stcb->asoc.out_tsnlog[i].seq,
4443                             stcb->asoc.out_tsnlog[i].flgs,
4444                             stcb->asoc.out_tsnlog[i].sz);
4445                 }
4446         }
4447 #endif
4448 }
4449 #endif
4450
4451 void
4452 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4453     struct mbuf *op_err,
4454     int so_locked
4455     SCTP_UNUSED
4456 )
4457 {
4458
4459         if (stcb == NULL) {
4460                 /* Got to have a TCB */
4461                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4462                         if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4463                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4464                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
4465                         }
4466                 }
4467                 return;
4468         } else {
4469                 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED);
4470         }
4471         /* notify the peer */
4472         sctp_send_abort_tcb(stcb, op_err, so_locked);
4473         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4474         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4475             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4476                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4477         }
4478         /* notify the ulp */
4479         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4480                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
4481         }
4482         /* now free the asoc */
4483 #ifdef SCTP_ASOCLOG_OF_TSNS
4484         sctp_print_out_track_log(stcb);
4485 #endif
4486         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4487             SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4488 }
4489
4490 void
4491 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4492     struct sockaddr *src, struct sockaddr *dst,
4493     struct sctphdr *sh, struct sctp_inpcb *inp,
4494     struct mbuf *cause,
4495     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4496     uint32_t vrf_id, uint16_t port)
4497 {
4498         struct sctp_chunkhdr *ch, chunk_buf;
4499         unsigned int chk_length;
4500         int contains_init_chunk;
4501
4502         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4503         /* Generate a TO address for future reference */
4504         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4505                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4506                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4507                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4508                 }
4509         }
4510         contains_init_chunk = 0;
4511         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4512             sizeof(*ch), (uint8_t *)&chunk_buf);
4513         while (ch != NULL) {
4514                 chk_length = ntohs(ch->chunk_length);
4515                 if (chk_length < sizeof(*ch)) {
4516                         /* break to abort land */
4517                         break;
4518                 }
4519                 switch (ch->chunk_type) {
4520                 case SCTP_INIT:
4521                         contains_init_chunk = 1;
4522                         break;
4523                 case SCTP_PACKET_DROPPED:
4524                         /* we don't respond to pkt-dropped */
4525                         return;
4526                 case SCTP_ABORT_ASSOCIATION:
4527                         /* we don't respond with an ABORT to an ABORT */
4528                         return;
4529                 case SCTP_SHUTDOWN_COMPLETE:
4530                         /*
4531                          * we ignore it since we are not waiting for it and
4532                          * peer is gone
4533                          */
4534                         return;
4535                 case SCTP_SHUTDOWN_ACK:
4536                         sctp_send_shutdown_complete2(src, dst, sh,
4537                             mflowtype, mflowid, fibnum,
4538                             vrf_id, port);
4539                         return;
4540                 default:
4541                         break;
4542                 }
4543                 offset += SCTP_SIZE32(chk_length);
4544                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4545                     sizeof(*ch), (uint8_t *)&chunk_buf);
4546         }
4547         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4548             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4549             (contains_init_chunk == 0))) {
4550                 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4551                     mflowtype, mflowid, fibnum,
4552                     vrf_id, port);
4553         }
4554 }
4555
4556 /*
4557  * check the inbound datagram to make sure there is not an abort inside it,
4558  * if there is return 1, else return 0.
4559  */
4560 int
4561 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtagfill)
4562 {
4563         struct sctp_chunkhdr *ch;
4564         struct sctp_init_chunk *init_chk, chunk_buf;
4565         int offset;
4566         unsigned int chk_length;
4567
4568         offset = iphlen + sizeof(struct sctphdr);
4569         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4570             (uint8_t *)&chunk_buf);
4571         while (ch != NULL) {
4572                 chk_length = ntohs(ch->chunk_length);
4573                 if (chk_length < sizeof(*ch)) {
4574                         /* packet is probably corrupt */
4575                         break;
4576                 }
4577                 /* we seem to be ok, is it an abort? */
4578                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4579                         /* yep, tell them */
4580                         return (1);
4581                 }
4582                 if (ch->chunk_type == SCTP_INITIATION) {
4583                         /* need to update the Vtag */
4584                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4585                             offset, sizeof(*init_chk), (uint8_t *)&chunk_buf);
4586                         if (init_chk != NULL) {
4587                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4588                         }
4589                 }
4590                 /* Nope, move to the next chunk */
4591                 offset += SCTP_SIZE32(chk_length);
4592                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4593                     sizeof(*ch), (uint8_t *)&chunk_buf);
4594         }
4595         return (0);
4596 }
4597
4598 /*
4599  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4600  * set (i.e. it's 0) so, create this function to compare link local scopes
4601  */
4602 #ifdef INET6
4603 uint32_t
4604 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4605 {
4606         struct sockaddr_in6 a, b;
4607
4608         /* save copies */
4609         a = *addr1;
4610         b = *addr2;
4611
4612         if (a.sin6_scope_id == 0)
4613                 if (sa6_recoverscope(&a)) {
4614                         /* can't get scope, so can't match */
4615                         return (0);
4616                 }
4617         if (b.sin6_scope_id == 0)
4618                 if (sa6_recoverscope(&b)) {
4619                         /* can't get scope, so can't match */
4620                         return (0);
4621                 }
4622         if (a.sin6_scope_id != b.sin6_scope_id)
4623                 return (0);
4624
4625         return (1);
4626 }
4627
4628 /*
4629  * returns a sockaddr_in6 with embedded scope recovered and removed
4630  */
4631 struct sockaddr_in6 *
4632 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4633 {
4634         /* check and strip embedded scope junk */
4635         if (addr->sin6_family == AF_INET6) {
4636                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4637                         if (addr->sin6_scope_id == 0) {
4638                                 *store = *addr;
4639                                 if (!sa6_recoverscope(store)) {
4640                                         /* use the recovered scope */
4641                                         addr = store;
4642                                 }
4643                         } else {
4644                                 /* else, return the original "to" addr */
4645                                 in6_clearscope(&addr->sin6_addr);
4646                         }
4647                 }
4648         }
4649         return (addr);
4650 }
4651 #endif
4652
4653 /*
4654  * are the two addresses the same?  currently a "scopeless" check returns: 1
4655  * if same, 0 if not
4656  */
4657 int
4658 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4659 {
4660
4661         /* must be valid */
4662         if (sa1 == NULL || sa2 == NULL)
4663                 return (0);
4664
4665         /* must be the same family */
4666         if (sa1->sa_family != sa2->sa_family)
4667                 return (0);
4668
4669         switch (sa1->sa_family) {
4670 #ifdef INET6
4671         case AF_INET6:
4672                 {
4673                         /* IPv6 addresses */
4674                         struct sockaddr_in6 *sin6_1, *sin6_2;
4675
4676                         sin6_1 = (struct sockaddr_in6 *)sa1;
4677                         sin6_2 = (struct sockaddr_in6 *)sa2;
4678                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4679                             sin6_2));
4680                 }
4681 #endif
4682 #ifdef INET
4683         case AF_INET:
4684                 {
4685                         /* IPv4 addresses */
4686                         struct sockaddr_in *sin_1, *sin_2;
4687
4688                         sin_1 = (struct sockaddr_in *)sa1;
4689                         sin_2 = (struct sockaddr_in *)sa2;
4690                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4691                 }
4692 #endif
4693         default:
4694                 /* we don't do these... */
4695                 return (0);
4696         }
4697 }
4698
4699 void
4700 sctp_print_address(struct sockaddr *sa)
4701 {
4702 #ifdef INET6
4703         char ip6buf[INET6_ADDRSTRLEN];
4704 #endif
4705
4706         switch (sa->sa_family) {
4707 #ifdef INET6
4708         case AF_INET6:
4709                 {
4710                         struct sockaddr_in6 *sin6;
4711
4712                         sin6 = (struct sockaddr_in6 *)sa;
4713                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4714                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4715                             ntohs(sin6->sin6_port),
4716                             sin6->sin6_scope_id);
4717                         break;
4718                 }
4719 #endif
4720 #ifdef INET
4721         case AF_INET:
4722                 {
4723                         struct sockaddr_in *sin;
4724                         unsigned char *p;
4725
4726                         sin = (struct sockaddr_in *)sa;
4727                         p = (unsigned char *)&sin->sin_addr;
4728                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4729                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4730                         break;
4731                 }
4732 #endif
4733         default:
4734                 SCTP_PRINTF("?\n");
4735                 break;
4736         }
4737 }
4738
4739 void
4740 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4741     struct sctp_inpcb *new_inp,
4742     struct sctp_tcb *stcb,
4743     int waitflags)
4744 {
4745         /*
4746          * go through our old INP and pull off any control structures that
4747          * belong to stcb and move then to the new inp.
4748          */
4749         struct socket *old_so, *new_so;
4750         struct sctp_queued_to_read *control, *nctl;
4751         struct sctp_readhead tmp_queue;
4752         struct mbuf *m;
4753         int error = 0;
4754
4755         old_so = old_inp->sctp_socket;
4756         new_so = new_inp->sctp_socket;
4757         TAILQ_INIT(&tmp_queue);
4758         error = sblock(&old_so->so_rcv, waitflags);
4759         if (error) {
4760                 /*
4761                  * Gak, can't get sblock, we have a problem. data will be
4762                  * left stranded.. and we don't dare look at it since the
4763                  * other thread may be reading something. Oh well, its a
4764                  * screwed up app that does a peeloff OR a accept while
4765                  * reading from the main socket... actually its only the
4766                  * peeloff() case, since I think read will fail on a
4767                  * listening socket..
4768                  */
4769                 return;
4770         }
4771         /* lock the socket buffers */
4772         SCTP_INP_READ_LOCK(old_inp);
4773         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4774                 /* Pull off all for out target stcb */
4775                 if (control->stcb == stcb) {
4776                         /* remove it we want it */
4777                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4778                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4779                         m = control->data;
4780                         while (m) {
4781                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4782                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4783                                 }
4784                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4785                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4786                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4787                                 }
4788                                 m = SCTP_BUF_NEXT(m);
4789                         }
4790                 }
4791         }
4792         SCTP_INP_READ_UNLOCK(old_inp);
4793         /* Remove the sb-lock on the old socket */
4794
4795         sbunlock(&old_so->so_rcv);
4796         /* Now we move them over to the new socket buffer */
4797         SCTP_INP_READ_LOCK(new_inp);
4798         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4799                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4800                 m = control->data;
4801                 while (m) {
4802                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4803                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4804                         }
4805                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4806                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4807                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4808                         }
4809                         m = SCTP_BUF_NEXT(m);
4810                 }
4811         }
4812         SCTP_INP_READ_UNLOCK(new_inp);
4813 }
4814
4815 void
4816 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
4817     struct sctp_tcb *stcb,
4818     int so_locked
4819     SCTP_UNUSED
4820 )
4821 {
4822         if ((inp != NULL) && (inp->sctp_socket != NULL)) {
4823                 sctp_sorwakeup(inp, inp->sctp_socket);
4824         }
4825 }
4826
4827 void
4828 sctp_add_to_readq(struct sctp_inpcb *inp,
4829     struct sctp_tcb *stcb,
4830     struct sctp_queued_to_read *control,
4831     struct sockbuf *sb,
4832     int end,
4833     int inp_read_lock_held,
4834     int so_locked
4835     SCTP_UNUSED
4836 )
4837 {
4838         /*
4839          * Here we must place the control on the end of the socket read
4840          * queue AND increment sb_cc so that select will work properly on
4841          * read.
4842          */
4843         struct mbuf *m, *prev = NULL;
4844
4845         if (inp == NULL) {
4846                 /* Gak, TSNH!! */
4847 #ifdef INVARIANTS
4848                 panic("Gak, inp NULL on add_to_readq");
4849 #endif
4850                 return;
4851         }
4852         if (inp_read_lock_held == 0)
4853                 SCTP_INP_READ_LOCK(inp);
4854         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4855                 if (!control->on_strm_q) {
4856                         sctp_free_remote_addr(control->whoFrom);
4857                         if (control->data) {
4858                                 sctp_m_freem(control->data);
4859                                 control->data = NULL;
4860                         }
4861                         sctp_free_a_readq(stcb, control);
4862                 }
4863                 if (inp_read_lock_held == 0)
4864                         SCTP_INP_READ_UNLOCK(inp);
4865                 return;
4866         }
4867         if (!(control->spec_flags & M_NOTIFICATION)) {
4868                 atomic_add_int(&inp->total_recvs, 1);
4869                 if (!control->do_not_ref_stcb) {
4870                         atomic_add_int(&stcb->total_recvs, 1);
4871                 }
4872         }
4873         m = control->data;
4874         control->held_length = 0;
4875         control->length = 0;
4876         while (m) {
4877                 if (SCTP_BUF_LEN(m) == 0) {
4878                         /* Skip mbufs with NO length */
4879                         if (prev == NULL) {
4880                                 /* First one */
4881                                 control->data = sctp_m_free(m);
4882                                 m = control->data;
4883                         } else {
4884                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4885                                 m = SCTP_BUF_NEXT(prev);
4886                         }
4887                         if (m == NULL) {
4888                                 control->tail_mbuf = prev;
4889                         }
4890                         continue;
4891                 }
4892                 prev = m;
4893                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4894                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4895                 }
4896                 sctp_sballoc(stcb, sb, m);
4897                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4898                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4899                 }
4900                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4901                 m = SCTP_BUF_NEXT(m);
4902         }
4903         if (prev != NULL) {
4904                 control->tail_mbuf = prev;
4905         } else {
4906                 /* Everything got collapsed out?? */
4907                 if (!control->on_strm_q) {
4908                         sctp_free_remote_addr(control->whoFrom);
4909                         sctp_free_a_readq(stcb, control);
4910                 }
4911                 if (inp_read_lock_held == 0)
4912                         SCTP_INP_READ_UNLOCK(inp);
4913                 return;
4914         }
4915         if (end) {
4916                 control->end_added = 1;
4917         }
4918         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4919         control->on_read_q = 1;
4920         if (inp_read_lock_held == 0)
4921                 SCTP_INP_READ_UNLOCK(inp);
4922         if (inp && inp->sctp_socket) {
4923                 sctp_wakeup_the_read_socket(inp, stcb, so_locked);
4924         }
4925 }
4926
4927 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4928  *************ALTERNATE ROUTING CODE
4929  */
4930
4931 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4932  *************ALTERNATE ROUTING CODE
4933  */
4934
4935 struct mbuf *
4936 sctp_generate_cause(uint16_t code, char *info)
4937 {
4938         struct mbuf *m;
4939         struct sctp_gen_error_cause *cause;
4940         size_t info_len;
4941         uint16_t len;
4942
4943         if ((code == 0) || (info == NULL)) {
4944                 return (NULL);
4945         }
4946         info_len = strlen(info);
4947         if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) {
4948                 return (NULL);
4949         }
4950         len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len);
4951         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4952         if (m != NULL) {
4953                 SCTP_BUF_LEN(m) = len;
4954                 cause = mtod(m, struct sctp_gen_error_cause *);
4955                 cause->code = htons(code);
4956                 cause->length = htons(len);
4957                 memcpy(cause->info, info, info_len);
4958         }
4959         return (m);
4960 }
4961
4962 struct mbuf *
4963 sctp_generate_no_user_data_cause(uint32_t tsn)
4964 {
4965         struct mbuf *m;
4966         struct sctp_error_no_user_data *no_user_data_cause;
4967         uint16_t len;
4968
4969         len = (uint16_t)sizeof(struct sctp_error_no_user_data);
4970         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4971         if (m != NULL) {
4972                 SCTP_BUF_LEN(m) = len;
4973                 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
4974                 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
4975                 no_user_data_cause->cause.length = htons(len);
4976                 no_user_data_cause->tsn = htonl(tsn);
4977         }
4978         return (m);
4979 }
4980
4981 #ifdef SCTP_MBCNT_LOGGING
4982 void
4983 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4984     struct sctp_tmit_chunk *tp1, int chk_cnt)
4985 {
4986         if (tp1->data == NULL) {
4987                 return;
4988         }
4989         asoc->chunks_on_out_queue -= chk_cnt;
4990         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4991                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4992                     asoc->total_output_queue_size,
4993                     tp1->book_size,
4994                     0,
4995                     tp1->mbcnt);
4996         }
4997         if (asoc->total_output_queue_size >= tp1->book_size) {
4998                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4999         } else {
5000                 asoc->total_output_queue_size = 0;
5001         }
5002
5003         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
5004             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
5005                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
5006                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
5007                 } else {
5008                         stcb->sctp_socket->so_snd.sb_cc = 0;
5009
5010                 }
5011         }
5012 }
5013
5014 #endif
5015
5016 int
5017 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
5018     uint8_t sent, int so_locked
5019     SCTP_UNUSED
5020 )
5021 {
5022         struct sctp_stream_out *strq;
5023         struct sctp_tmit_chunk *chk = NULL, *tp2;
5024         struct sctp_stream_queue_pending *sp;
5025         uint32_t mid;
5026         uint16_t sid;
5027         uint8_t foundeom = 0;
5028         int ret_sz = 0;
5029         int notdone;
5030         int do_wakeup_routine = 0;
5031
5032         sid = tp1->rec.data.sid;
5033         mid = tp1->rec.data.mid;
5034         if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
5035                 stcb->asoc.abandoned_sent[0]++;
5036                 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
5037                 stcb->asoc.strmout[sid].abandoned_sent[0]++;
5038 #if defined(SCTP_DETAILED_STR_STATS)
5039                 stcb->asoc.strmout[sid].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
5040 #endif
5041         } else {
5042                 stcb->asoc.abandoned_unsent[0]++;
5043                 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
5044                 stcb->asoc.strmout[sid].abandoned_unsent[0]++;
5045 #if defined(SCTP_DETAILED_STR_STATS)
5046                 stcb->asoc.strmout[sid].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
5047 #endif
5048         }
5049         do {
5050                 ret_sz += tp1->book_size;
5051                 if (tp1->data != NULL) {
5052                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
5053                                 sctp_flight_size_decrease(tp1);
5054                                 sctp_total_flight_decrease(stcb, tp1);
5055                         }
5056                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
5057                         stcb->asoc.peers_rwnd += tp1->send_size;
5058                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
5059                         if (sent) {
5060                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
5061                         } else {
5062                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
5063                         }
5064                         if (tp1->data) {
5065                                 sctp_m_freem(tp1->data);
5066                                 tp1->data = NULL;
5067                         }
5068                         do_wakeup_routine = 1;
5069                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
5070                                 stcb->asoc.sent_queue_cnt_removeable--;
5071                         }
5072                 }
5073                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
5074                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
5075                     SCTP_DATA_NOT_FRAG) {
5076                         /* not frag'ed we ae done   */
5077                         notdone = 0;
5078                         foundeom = 1;
5079                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5080                         /* end of frag, we are done */
5081                         notdone = 0;
5082                         foundeom = 1;
5083                 } else {
5084                         /*
5085                          * Its a begin or middle piece, we must mark all of
5086                          * it
5087                          */
5088                         notdone = 1;
5089                         tp1 = TAILQ_NEXT(tp1, sctp_next);
5090                 }
5091         } while (tp1 && notdone);
5092         if (foundeom == 0) {
5093                 /*
5094                  * The multi-part message was scattered across the send and
5095                  * sent queue.
5096                  */
5097                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
5098                         if ((tp1->rec.data.sid != sid) ||
5099                             (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) {
5100                                 break;
5101                         }
5102                         /*
5103                          * save to chk in case we have some on stream out
5104                          * queue. If so and we have an un-transmitted one we
5105                          * don't have to fudge the TSN.
5106                          */
5107                         chk = tp1;
5108                         ret_sz += tp1->book_size;
5109                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
5110                         if (sent) {
5111                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
5112                         } else {
5113                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
5114                         }
5115                         if (tp1->data) {
5116                                 sctp_m_freem(tp1->data);
5117                                 tp1->data = NULL;
5118                         }
5119                         /* No flight involved here book the size to 0 */
5120                         tp1->book_size = 0;
5121                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5122                                 foundeom = 1;
5123                         }
5124                         do_wakeup_routine = 1;
5125                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
5126                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
5127                         /*
5128                          * on to the sent queue so we can wait for it to be
5129                          * passed by.
5130                          */
5131                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
5132                             sctp_next);
5133                         stcb->asoc.send_queue_cnt--;
5134                         stcb->asoc.sent_queue_cnt++;
5135                 }
5136         }
5137         if (foundeom == 0) {
5138                 /*
5139                  * Still no eom found. That means there is stuff left on the
5140                  * stream out queue.. yuck.
5141                  */
5142                 SCTP_TCB_SEND_LOCK(stcb);
5143                 strq = &stcb->asoc.strmout[sid];
5144                 sp = TAILQ_FIRST(&strq->outqueue);
5145                 if (sp != NULL) {
5146                         sp->discard_rest = 1;
5147                         /*
5148                          * We may need to put a chunk on the queue that
5149                          * holds the TSN that would have been sent with the
5150                          * LAST bit.
5151                          */
5152                         if (chk == NULL) {
5153                                 /* Yep, we have to */
5154                                 sctp_alloc_a_chunk(stcb, chk);
5155                                 if (chk == NULL) {
5156                                         /*
5157                                          * we are hosed. All we can do is
5158                                          * nothing.. which will cause an
5159                                          * abort if the peer is paying
5160                                          * attention.
5161                                          */
5162                                         goto oh_well;
5163                                 }
5164                                 memset(chk, 0, sizeof(*chk));
5165                                 chk->rec.data.rcv_flags = 0;
5166                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
5167                                 chk->asoc = &stcb->asoc;
5168                                 if (stcb->asoc.idata_supported == 0) {
5169                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
5170                                                 chk->rec.data.mid = 0;
5171                                         } else {
5172                                                 chk->rec.data.mid = strq->next_mid_ordered;
5173                                         }
5174                                 } else {
5175                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
5176                                                 chk->rec.data.mid = strq->next_mid_unordered;
5177                                         } else {
5178                                                 chk->rec.data.mid = strq->next_mid_ordered;
5179                                         }
5180                                 }
5181                                 chk->rec.data.sid = sp->sid;
5182                                 chk->rec.data.ppid = sp->ppid;
5183                                 chk->rec.data.context = sp->context;
5184                                 chk->flags = sp->act_flags;
5185                                 chk->whoTo = NULL;
5186                                 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
5187                                 strq->chunks_on_queues++;
5188                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
5189                                 stcb->asoc.sent_queue_cnt++;
5190                                 stcb->asoc.pr_sctp_cnt++;
5191                         }
5192                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
5193                         if (sp->sinfo_flags & SCTP_UNORDERED) {
5194                                 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED;
5195                         }
5196                         if (stcb->asoc.idata_supported == 0) {
5197                                 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) {
5198                                         strq->next_mid_ordered++;
5199                                 }
5200                         } else {
5201                                 if (sp->sinfo_flags & SCTP_UNORDERED) {
5202                                         strq->next_mid_unordered++;
5203                                 } else {
5204                                         strq->next_mid_ordered++;
5205                                 }
5206                         }
5207         oh_well:
5208                         if (sp->data) {
5209                                 /*
5210                                  * Pull any data to free up the SB and allow
5211                                  * sender to "add more" while we will throw
5212                                  * away :-)
5213                                  */
5214                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
5215                                 ret_sz += sp->length;
5216                                 do_wakeup_routine = 1;
5217                                 sp->some_taken = 1;
5218                                 sctp_m_freem(sp->data);
5219                                 sp->data = NULL;
5220                                 sp->tail_mbuf = NULL;
5221                                 sp->length = 0;
5222                         }
5223                 }
5224                 SCTP_TCB_SEND_UNLOCK(stcb);
5225         }
5226         if (do_wakeup_routine) {
5227                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
5228         }
5229         return (ret_sz);
5230 }
5231
5232 /*
5233  * checks to see if the given address, sa, is one that is currently known by
5234  * the kernel note: can't distinguish the same address on multiple interfaces
5235  * and doesn't handle multiple addresses with different zone/scope id's note:
5236  * ifa_ifwithaddr() compares the entire sockaddr struct
5237  */
5238 struct sctp_ifa *
5239 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
5240     int holds_lock)
5241 {
5242         struct sctp_laddr *laddr;
5243
5244         if (holds_lock == 0) {
5245                 SCTP_INP_RLOCK(inp);
5246         }
5247
5248         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
5249                 if (laddr->ifa == NULL)
5250                         continue;
5251                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
5252                         continue;
5253 #ifdef INET
5254                 if (addr->sa_family == AF_INET) {
5255                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5256                             laddr->ifa->address.sin.sin_addr.s_addr) {
5257                                 /* found him. */
5258                                 if (holds_lock == 0) {
5259                                         SCTP_INP_RUNLOCK(inp);
5260                                 }
5261                                 return (laddr->ifa);
5262                                 break;
5263                         }
5264                 }
5265 #endif
5266 #ifdef INET6
5267                 if (addr->sa_family == AF_INET6) {
5268                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5269                             &laddr->ifa->address.sin6)) {
5270                                 /* found him. */
5271                                 if (holds_lock == 0) {
5272                                         SCTP_INP_RUNLOCK(inp);
5273                                 }
5274                                 return (laddr->ifa);
5275                                 break;
5276                         }
5277                 }
5278 #endif
5279         }
5280         if (holds_lock == 0) {
5281                 SCTP_INP_RUNLOCK(inp);
5282         }
5283         return (NULL);
5284 }
5285
5286 uint32_t
5287 sctp_get_ifa_hash_val(struct sockaddr *addr)
5288 {
5289         switch (addr->sa_family) {
5290 #ifdef INET
5291         case AF_INET:
5292                 {
5293                         struct sockaddr_in *sin;
5294
5295                         sin = (struct sockaddr_in *)addr;
5296                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
5297                 }
5298 #endif
5299 #ifdef INET6
5300         case AF_INET6:
5301                 {
5302                         struct sockaddr_in6 *sin6;
5303                         uint32_t hash_of_addr;
5304
5305                         sin6 = (struct sockaddr_in6 *)addr;
5306                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
5307                             sin6->sin6_addr.s6_addr32[1] +
5308                             sin6->sin6_addr.s6_addr32[2] +
5309                             sin6->sin6_addr.s6_addr32[3]);
5310                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
5311                         return (hash_of_addr);
5312                 }
5313 #endif
5314         default:
5315                 break;
5316         }
5317         return (0);
5318 }
5319
5320 struct sctp_ifa *
5321 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
5322 {
5323         struct sctp_ifa *sctp_ifap;
5324         struct sctp_vrf *vrf;
5325         struct sctp_ifalist *hash_head;
5326         uint32_t hash_of_addr;
5327
5328         if (holds_lock == 0)
5329                 SCTP_IPI_ADDR_RLOCK();
5330
5331         vrf = sctp_find_vrf(vrf_id);
5332         if (vrf == NULL) {
5333                 if (holds_lock == 0)
5334                         SCTP_IPI_ADDR_RUNLOCK();
5335                 return (NULL);
5336         }
5337
5338         hash_of_addr = sctp_get_ifa_hash_val(addr);
5339
5340         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5341         if (hash_head == NULL) {
5342                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5343                     hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark,
5344                     (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark));
5345                 sctp_print_address(addr);
5346                 SCTP_PRINTF("No such bucket for address\n");
5347                 if (holds_lock == 0)
5348                         SCTP_IPI_ADDR_RUNLOCK();
5349
5350                 return (NULL);
5351         }
5352         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5353                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5354                         continue;
5355 #ifdef INET
5356                 if (addr->sa_family == AF_INET) {
5357                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5358                             sctp_ifap->address.sin.sin_addr.s_addr) {
5359                                 /* found him. */
5360                                 if (holds_lock == 0)
5361                                         SCTP_IPI_ADDR_RUNLOCK();
5362                                 return (sctp_ifap);
5363                                 break;
5364                         }
5365                 }
5366 #endif
5367 #ifdef INET6
5368                 if (addr->sa_family == AF_INET6) {
5369                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5370                             &sctp_ifap->address.sin6)) {
5371                                 /* found him. */
5372                                 if (holds_lock == 0)
5373                                         SCTP_IPI_ADDR_RUNLOCK();
5374                                 return (sctp_ifap);
5375                                 break;
5376                         }
5377                 }
5378 #endif
5379         }
5380         if (holds_lock == 0)
5381                 SCTP_IPI_ADDR_RUNLOCK();
5382         return (NULL);
5383 }
5384
5385 static void
5386 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock,
5387     uint32_t rwnd_req)
5388 {
5389         /* User pulled some data, do we need a rwnd update? */
5390         struct epoch_tracker et;
5391         int r_unlocked = 0;
5392         uint32_t dif, rwnd;
5393         struct socket *so = NULL;
5394
5395         if (stcb == NULL)
5396                 return;
5397
5398         atomic_add_int(&stcb->asoc.refcnt, 1);
5399
5400         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
5401             (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED | SCTP_STATE_SHUTDOWN_RECEIVED))) {
5402                 /* Pre-check If we are freeing no update */
5403                 goto no_lock;
5404         }
5405         SCTP_INP_INCR_REF(stcb->sctp_ep);
5406         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5407             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5408                 goto out;
5409         }
5410         so = stcb->sctp_socket;
5411         if (so == NULL) {
5412                 goto out;
5413         }
5414         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5415         /* Have you have freed enough to look */
5416         *freed_so_far = 0;
5417         /* Yep, its worth a look and the lock overhead */
5418
5419         /* Figure out what the rwnd would be */
5420         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5421         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5422                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5423         } else {
5424                 dif = 0;
5425         }
5426         if (dif >= rwnd_req) {
5427                 if (hold_rlock) {
5428                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5429                         r_unlocked = 1;
5430                 }
5431                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5432                         /*
5433                          * One last check before we allow the guy possibly
5434                          * to get in. There is a race, where the guy has not
5435                          * reached the gate. In that case
5436                          */
5437                         goto out;
5438                 }
5439                 SCTP_TCB_LOCK(stcb);
5440                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5441                         /* No reports here */
5442                         SCTP_TCB_UNLOCK(stcb);
5443                         goto out;
5444                 }
5445                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5446                 NET_EPOCH_ENTER(et);
5447                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5448
5449                 sctp_chunk_output(stcb->sctp_ep, stcb,
5450                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5451                 /* make sure no timer is running */
5452                 NET_EPOCH_EXIT(et);
5453                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
5454                     SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5455                 SCTP_TCB_UNLOCK(stcb);
5456         } else {
5457                 /* Update how much we have pending */
5458                 stcb->freed_by_sorcv_sincelast = dif;
5459         }
5460 out:
5461         if (so && r_unlocked && hold_rlock) {
5462                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5463         }
5464
5465         SCTP_INP_DECR_REF(stcb->sctp_ep);
5466 no_lock:
5467         atomic_add_int(&stcb->asoc.refcnt, -1);
5468         return;
5469 }
5470
5471 int
5472 sctp_sorecvmsg(struct socket *so,
5473     struct uio *uio,
5474     struct mbuf **mp,
5475     struct sockaddr *from,
5476     int fromlen,
5477     int *msg_flags,
5478     struct sctp_sndrcvinfo *sinfo,
5479     int filling_sinfo)
5480 {
5481         /*
5482          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5483          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5484          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5485          * On the way out we may send out any combination of:
5486          * MSG_NOTIFICATION MSG_EOR
5487          *
5488          */
5489         struct sctp_inpcb *inp = NULL;
5490         ssize_t my_len = 0;
5491         ssize_t cp_len = 0;
5492         int error = 0;
5493         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5494         struct mbuf *m = NULL;
5495         struct sctp_tcb *stcb = NULL;
5496         int wakeup_read_socket = 0;
5497         int freecnt_applied = 0;
5498         int out_flags = 0, in_flags = 0;
5499         int block_allowed = 1;
5500         uint32_t freed_so_far = 0;
5501         ssize_t copied_so_far = 0;
5502         int in_eeor_mode = 0;
5503         int no_rcv_needed = 0;
5504         uint32_t rwnd_req = 0;
5505         int hold_sblock = 0;
5506         int hold_rlock = 0;
5507         ssize_t slen = 0;
5508         uint32_t held_length = 0;
5509         int sockbuf_lock = 0;
5510
5511         if (uio == NULL) {
5512                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5513                 return (EINVAL);
5514         }
5515
5516         if (msg_flags) {
5517                 in_flags = *msg_flags;
5518                 if (in_flags & MSG_PEEK)
5519                         SCTP_STAT_INCR(sctps_read_peeks);
5520         } else {
5521                 in_flags = 0;
5522         }
5523         slen = uio->uio_resid;
5524
5525         /* Pull in and set up our int flags */
5526         if (in_flags & MSG_OOB) {
5527                 /* Out of band's NOT supported */
5528                 return (EOPNOTSUPP);
5529         }
5530         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5531                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5532                 return (EINVAL);
5533         }
5534         if ((in_flags & (MSG_DONTWAIT
5535             | MSG_NBIO
5536             )) ||
5537             SCTP_SO_IS_NBIO(so)) {
5538                 block_allowed = 0;
5539         }
5540         /* setup the endpoint */
5541         inp = (struct sctp_inpcb *)so->so_pcb;
5542         if (inp == NULL) {
5543                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5544                 return (EFAULT);
5545         }
5546         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5547         /* Must be at least a MTU's worth */
5548         if (rwnd_req < SCTP_MIN_RWND)
5549                 rwnd_req = SCTP_MIN_RWND;
5550         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5551         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5552                 sctp_misc_ints(SCTP_SORECV_ENTER,
5553                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5554         }
5555         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5556                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5557                     rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5558         }
5559
5560
5561         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5562         if (error) {
5563                 goto release_unlocked;
5564         }
5565         sockbuf_lock = 1;
5566 restart:
5567
5568 restart_nosblocks:
5569         if (hold_sblock == 0) {
5570                 SOCKBUF_LOCK(&so->so_rcv);
5571                 hold_sblock = 1;
5572         }
5573         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5574             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5575                 goto out;
5576         }
5577         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5578                 if (so->so_error) {
5579                         error = so->so_error;
5580                         if ((in_flags & MSG_PEEK) == 0)
5581                                 so->so_error = 0;
5582                         goto out;
5583                 } else {
5584                         if (so->so_rcv.sb_cc == 0) {
5585                                 /* indicate EOF */
5586                                 error = 0;
5587                                 goto out;
5588                         }
5589                 }
5590         }
5591         if (so->so_rcv.sb_cc <= held_length) {
5592                 if (so->so_error) {
5593                         error = so->so_error;
5594                         if ((in_flags & MSG_PEEK) == 0) {
5595                                 so->so_error = 0;
5596                         }
5597                         goto out;
5598                 }
5599                 if ((so->so_rcv.sb_cc == 0) &&
5600                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5601                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5602                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5603                                 /*
5604                                  * For active open side clear flags for
5605                                  * re-use passive open is blocked by
5606                                  * connect.
5607                                  */
5608                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5609                                         /*
5610                                          * You were aborted, passive side
5611                                          * always hits here
5612                                          */
5613                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5614                                         error = ECONNRESET;
5615                                 }
5616                                 so->so_state &= ~(SS_ISCONNECTING |
5617                                     SS_ISDISCONNECTING |
5618                                     SS_ISCONFIRMING |
5619                                     SS_ISCONNECTED);
5620                                 if (error == 0) {
5621                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5622                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5623                                                 error = ENOTCONN;
5624                                         }
5625                                 }
5626                                 goto out;
5627                         }
5628                 }
5629                 if (block_allowed) {
5630                         error = sbwait(&so->so_rcv);
5631                         if (error) {
5632                                 goto out;
5633                         }
5634                         held_length = 0;
5635                         goto restart_nosblocks;
5636                 } else {
5637                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5638                         error = EWOULDBLOCK;
5639                         goto out;
5640                 }
5641         }
5642         if (hold_sblock == 1) {
5643                 SOCKBUF_UNLOCK(&so->so_rcv);
5644                 hold_sblock = 0;
5645         }
5646         /* we possibly have data we can read */
5647         /* sa_ignore FREED_MEMORY */
5648         control = TAILQ_FIRST(&inp->read_queue);
5649         if (control == NULL) {
5650                 /*
5651                  * This could be happening since the appender did the
5652                  * increment but as not yet did the tailq insert onto the
5653                  * read_queue
5654                  */
5655                 if (hold_rlock == 0) {
5656                         SCTP_INP_READ_LOCK(inp);
5657                 }
5658                 control = TAILQ_FIRST(&inp->read_queue);
5659                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5660 #ifdef INVARIANTS
5661                         panic("Huh, its non zero and nothing on control?");
5662 #endif
5663                         so->so_rcv.sb_cc = 0;
5664                 }
5665                 SCTP_INP_READ_UNLOCK(inp);
5666                 hold_rlock = 0;
5667                 goto restart;
5668         }
5669
5670         if ((control->length == 0) &&
5671             (control->do_not_ref_stcb)) {
5672                 /*
5673                  * Clean up code for freeing assoc that left behind a
5674                  * pdapi.. maybe a peer in EEOR that just closed after
5675                  * sending and never indicated a EOR.
5676                  */
5677                 if (hold_rlock == 0) {
5678                         hold_rlock = 1;
5679                         SCTP_INP_READ_LOCK(inp);
5680                 }
5681                 control->held_length = 0;
5682                 if (control->data) {
5683                         /* Hmm there is data here .. fix */
5684                         struct mbuf *m_tmp;
5685                         int cnt = 0;
5686
5687                         m_tmp = control->data;
5688                         while (m_tmp) {
5689                                 cnt += SCTP_BUF_LEN(m_tmp);
5690                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5691                                         control->tail_mbuf = m_tmp;
5692                                         control->end_added = 1;
5693                                 }
5694                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5695                         }
5696                         control->length = cnt;
5697                 } else {
5698                         /* remove it */
5699                         TAILQ_REMOVE(&inp->read_queue, control, next);
5700                         /* Add back any hiddend data */
5701                         sctp_free_remote_addr(control->whoFrom);
5702                         sctp_free_a_readq(stcb, control);
5703                 }
5704                 if (hold_rlock) {
5705                         hold_rlock = 0;
5706                         SCTP_INP_READ_UNLOCK(inp);
5707                 }
5708                 goto restart;
5709         }
5710         if ((control->length == 0) &&
5711             (control->end_added == 1)) {
5712                 /*
5713                  * Do we also need to check for (control->pdapi_aborted ==
5714                  * 1)?
5715                  */
5716                 if (hold_rlock == 0) {
5717                         hold_rlock = 1;
5718                         SCTP_INP_READ_LOCK(inp);
5719                 }
5720                 TAILQ_REMOVE(&inp->read_queue, control, next);
5721                 if (control->data) {
5722 #ifdef INVARIANTS
5723                         panic("control->data not null but control->length == 0");
5724 #else
5725                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5726                         sctp_m_freem(control->data);
5727                         control->data = NULL;
5728 #endif
5729                 }
5730                 if (control->aux_data) {
5731                         sctp_m_free(control->aux_data);
5732                         control->aux_data = NULL;
5733                 }
5734 #ifdef INVARIANTS
5735                 if (control->on_strm_q) {
5736                         panic("About to free ctl:%p so:%p and its in %d",
5737                             control, so, control->on_strm_q);
5738                 }
5739 #endif
5740                 sctp_free_remote_addr(control->whoFrom);
5741                 sctp_free_a_readq(stcb, control);
5742                 if (hold_rlock) {
5743                         hold_rlock = 0;
5744                         SCTP_INP_READ_UNLOCK(inp);
5745                 }
5746                 goto restart;
5747         }
5748         if (control->length == 0) {
5749                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5750                     (filling_sinfo)) {
5751                         /* find a more suitable one then this */
5752                         ctl = TAILQ_NEXT(control, next);
5753                         while (ctl) {
5754                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5755                                     (ctl->some_taken ||
5756                                     (ctl->spec_flags & M_NOTIFICATION) ||
5757                                     ((ctl->do_not_ref_stcb == 0) &&
5758                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5759                                     ) {
5760                                         /*-
5761                                          * If we have a different TCB next, and there is data
5762                                          * present. If we have already taken some (pdapi), OR we can
5763                                          * ref the tcb and no delivery as started on this stream, we
5764                                          * take it. Note we allow a notification on a different
5765                                          * assoc to be delivered..
5766                                          */
5767                                         control = ctl;
5768                                         goto found_one;
5769                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5770                                             (ctl->length) &&
5771                                             ((ctl->some_taken) ||
5772                                             ((ctl->do_not_ref_stcb == 0) &&
5773                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5774                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5775                                         /*-
5776                                          * If we have the same tcb, and there is data present, and we
5777                                          * have the strm interleave feature present. Then if we have
5778                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5779                                          * not started a delivery for this stream, we can take it.
5780                                          * Note we do NOT allow a notificaiton on the same assoc to
5781                                          * be delivered.
5782                                          */
5783                                         control = ctl;
5784                                         goto found_one;
5785                                 }
5786                                 ctl = TAILQ_NEXT(ctl, next);
5787                         }
5788                 }
5789                 /*
5790                  * if we reach here, not suitable replacement is available
5791                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5792                  * into the our held count, and its time to sleep again.
5793                  */
5794                 held_length = so->so_rcv.sb_cc;
5795                 control->held_length = so->so_rcv.sb_cc;
5796                 goto restart;
5797         }
5798         /* Clear the held length since there is something to read */
5799         control->held_length = 0;
5800 found_one:
5801         /*
5802          * If we reach here, control has a some data for us to read off.
5803          * Note that stcb COULD be NULL.
5804          */
5805         if (hold_rlock == 0) {
5806                 hold_rlock = 1;
5807                 SCTP_INP_READ_LOCK(inp);
5808         }
5809         control->some_taken++;
5810         stcb = control->stcb;
5811         if (stcb) {
5812                 if ((control->do_not_ref_stcb == 0) &&
5813                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5814                         if (freecnt_applied == 0)
5815                                 stcb = NULL;
5816                 } else if (control->do_not_ref_stcb == 0) {
5817                         /* you can't free it on me please */
5818                         /*
5819                          * The lock on the socket buffer protects us so the
5820                          * free code will stop. But since we used the
5821                          * socketbuf lock and the sender uses the tcb_lock
5822                          * to increment, we need to use the atomic add to
5823                          * the refcnt
5824                          */
5825                         if (freecnt_applied) {
5826 #ifdef INVARIANTS
5827                                 panic("refcnt already incremented");
5828 #else
5829                                 SCTP_PRINTF("refcnt already incremented?\n");
5830 #endif
5831                         } else {
5832                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5833                                 freecnt_applied = 1;
5834                         }
5835                         /*
5836                          * Setup to remember how much we have not yet told
5837                          * the peer our rwnd has opened up. Note we grab the
5838                          * value from the tcb from last time. Note too that
5839                          * sack sending clears this when a sack is sent,
5840                          * which is fine. Once we hit the rwnd_req, we then
5841                          * will go to the sctp_user_rcvd() that will not
5842                          * lock until it KNOWs it MUST send a WUP-SACK.
5843                          */
5844                         freed_so_far = (uint32_t)stcb->freed_by_sorcv_sincelast;
5845                         stcb->freed_by_sorcv_sincelast = 0;
5846                 }
5847         }
5848         if (stcb &&
5849             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5850             control->do_not_ref_stcb == 0) {
5851                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5852         }
5853
5854         /* First lets get off the sinfo and sockaddr info */
5855         if ((sinfo != NULL) && (filling_sinfo != 0)) {
5856                 sinfo->sinfo_stream = control->sinfo_stream;
5857                 sinfo->sinfo_ssn = (uint16_t)control->mid;
5858                 sinfo->sinfo_flags = control->sinfo_flags;
5859                 sinfo->sinfo_ppid = control->sinfo_ppid;
5860                 sinfo->sinfo_context = control->sinfo_context;
5861                 sinfo->sinfo_timetolive = control->sinfo_timetolive;
5862                 sinfo->sinfo_tsn = control->sinfo_tsn;
5863                 sinfo->sinfo_cumtsn = control->sinfo_cumtsn;
5864                 sinfo->sinfo_assoc_id = control->sinfo_assoc_id;
5865                 nxt = TAILQ_NEXT(control, next);
5866                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5867                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5868                         struct sctp_extrcvinfo *s_extra;
5869
5870                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5871                         if ((nxt) &&
5872                             (nxt->length)) {
5873                                 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5874                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5875                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5876                                 }
5877                                 if (nxt->spec_flags & M_NOTIFICATION) {
5878                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5879                                 }
5880                                 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id;
5881                                 s_extra->serinfo_next_length = nxt->length;
5882                                 s_extra->serinfo_next_ppid = nxt->sinfo_ppid;
5883                                 s_extra->serinfo_next_stream = nxt->sinfo_stream;
5884                                 if (nxt->tail_mbuf != NULL) {
5885                                         if (nxt->end_added) {
5886                                                 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5887                                         }
5888                                 }
5889                         } else {
5890                                 /*
5891                                  * we explicitly 0 this, since the memcpy
5892                                  * got some other things beyond the older
5893                                  * sinfo_ that is on the control's structure
5894                                  * :-D
5895                                  */
5896                                 nxt = NULL;
5897                                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
5898                                 s_extra->serinfo_next_aid = 0;
5899                                 s_extra->serinfo_next_length = 0;
5900                                 s_extra->serinfo_next_ppid = 0;
5901                                 s_extra->serinfo_next_stream = 0;
5902                         }
5903                 }
5904                 /*
5905                  * update off the real current cum-ack, if we have an stcb.
5906                  */
5907                 if ((control->do_not_ref_stcb == 0) && stcb)
5908                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5909                 /*
5910                  * mask off the high bits, we keep the actual chunk bits in
5911                  * there.
5912                  */
5913                 sinfo->sinfo_flags &= 0x00ff;
5914                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5915                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5916                 }
5917         }
5918 #ifdef SCTP_ASOCLOG_OF_TSNS
5919         {
5920                 int index, newindex;
5921                 struct sctp_pcbtsn_rlog *entry;
5922
5923                 do {
5924                         index = inp->readlog_index;
5925                         newindex = index + 1;
5926                         if (newindex >= SCTP_READ_LOG_SIZE) {
5927                                 newindex = 0;
5928                         }
5929                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5930                 entry = &inp->readlog[index];
5931                 entry->vtag = control->sinfo_assoc_id;
5932                 entry->strm = control->sinfo_stream;
5933                 entry->seq = (uint16_t)control->mid;
5934                 entry->sz = control->length;
5935                 entry->flgs = control->sinfo_flags;
5936         }
5937 #endif
5938         if ((fromlen > 0) && (from != NULL)) {
5939                 union sctp_sockstore store;
5940                 size_t len;
5941
5942                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5943 #ifdef INET6
5944                 case AF_INET6:
5945                         len = sizeof(struct sockaddr_in6);
5946                         store.sin6 = control->whoFrom->ro._l_addr.sin6;
5947                         store.sin6.sin6_port = control->port_from;
5948                         break;
5949 #endif
5950 #ifdef INET
5951                 case AF_INET:
5952 #ifdef INET6
5953                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5954                                 len = sizeof(struct sockaddr_in6);
5955                                 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5956                                     &store.sin6);
5957                                 store.sin6.sin6_port = control->port_from;
5958                         } else {
5959                                 len = sizeof(struct sockaddr_in);
5960                                 store.sin = control->whoFrom->ro._l_addr.sin;
5961                                 store.sin.sin_port = control->port_from;
5962                         }
5963 #else
5964                         len = sizeof(struct sockaddr_in);
5965                         store.sin = control->whoFrom->ro._l_addr.sin;
5966                         store.sin.sin_port = control->port_from;
5967 #endif
5968                         break;
5969 #endif
5970                 default:
5971                         len = 0;
5972                         break;
5973                 }
5974                 memcpy(from, &store, min((size_t)fromlen, len));
5975 #ifdef INET6
5976                 {
5977                         struct sockaddr_in6 lsa6, *from6;
5978
5979                         from6 = (struct sockaddr_in6 *)from;
5980                         sctp_recover_scope_mac(from6, (&lsa6));
5981                 }
5982 #endif
5983         }
5984         if (hold_rlock) {
5985                 SCTP_INP_READ_UNLOCK(inp);
5986                 hold_rlock = 0;
5987         }
5988         if (hold_sblock) {
5989                 SOCKBUF_UNLOCK(&so->so_rcv);
5990                 hold_sblock = 0;
5991         }
5992         /* now copy out what data we can */
5993         if (mp == NULL) {
5994                 /* copy out each mbuf in the chain up to length */
5995 get_more_data:
5996                 m = control->data;
5997                 while (m) {
5998                         /* Move out all we can */
5999                         cp_len = uio->uio_resid;
6000                         my_len = SCTP_BUF_LEN(m);
6001                         if (cp_len > my_len) {
6002                                 /* not enough in this buf */
6003                                 cp_len = my_len;
6004                         }
6005                         if (hold_rlock) {
6006                                 SCTP_INP_READ_UNLOCK(inp);
6007                                 hold_rlock = 0;
6008                         }
6009                         if (cp_len > 0)
6010                                 error = uiomove(mtod(m, char *), (int)cp_len, uio);
6011                         /* re-read */
6012                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
6013                                 goto release;
6014                         }
6015
6016                         if ((control->do_not_ref_stcb == 0) && stcb &&
6017                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
6018                                 no_rcv_needed = 1;
6019                         }
6020                         if (error) {
6021                                 /* error we are out of here */
6022                                 goto release;
6023                         }
6024                         SCTP_INP_READ_LOCK(inp);
6025                         hold_rlock = 1;
6026                         if (cp_len == SCTP_BUF_LEN(m)) {
6027                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
6028                                     (control->end_added)) {
6029                                         out_flags |= MSG_EOR;
6030                                         if ((control->do_not_ref_stcb == 0) &&
6031                                             (control->stcb != NULL) &&
6032                                             ((control->spec_flags & M_NOTIFICATION) == 0))
6033                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6034                                 }
6035                                 if (control->spec_flags & M_NOTIFICATION) {
6036                                         out_flags |= MSG_NOTIFICATION;
6037                                 }
6038                                 /* we ate up the mbuf */
6039                                 if (in_flags & MSG_PEEK) {
6040                                         /* just looking */
6041                                         m = SCTP_BUF_NEXT(m);
6042                                         copied_so_far += cp_len;
6043                                 } else {
6044                                         /* dispose of the mbuf */
6045                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6046                                                 sctp_sblog(&so->so_rcv,
6047                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6048                                         }
6049                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6050                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6051                                                 sctp_sblog(&so->so_rcv,
6052                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6053                                         }
6054                                         copied_so_far += cp_len;
6055                                         freed_so_far += (uint32_t)cp_len;
6056                                         freed_so_far += MSIZE;
6057                                         atomic_subtract_int(&control->length, cp_len);
6058                                         control->data = sctp_m_free(m);
6059                                         m = control->data;
6060                                         /*
6061                                          * been through it all, must hold sb
6062                                          * lock ok to null tail
6063                                          */
6064                                         if (control->data == NULL) {
6065 #ifdef INVARIANTS
6066                                                 if ((control->end_added == 0) ||
6067                                                     (TAILQ_NEXT(control, next) == NULL)) {
6068                                                         /*
6069                                                          * If the end is not
6070                                                          * added, OR the
6071                                                          * next is NOT null
6072                                                          * we MUST have the
6073                                                          * lock.
6074                                                          */
6075                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
6076                                                                 panic("Hmm we don't own the lock?");
6077                                                         }
6078                                                 }
6079 #endif
6080                                                 control->tail_mbuf = NULL;
6081 #ifdef INVARIANTS
6082                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
6083                                                         panic("end_added, nothing left and no MSG_EOR");
6084                                                 }
6085 #endif
6086                                         }
6087                                 }
6088                         } else {
6089                                 /* Do we need to trim the mbuf? */
6090                                 if (control->spec_flags & M_NOTIFICATION) {
6091                                         out_flags |= MSG_NOTIFICATION;
6092                                 }
6093                                 if ((in_flags & MSG_PEEK) == 0) {
6094                                         SCTP_BUF_RESV_UF(m, cp_len);
6095                                         SCTP_BUF_LEN(m) -= (int)cp_len;
6096                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6097                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, (int)cp_len);
6098                                         }
6099                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
6100                                         if ((control->do_not_ref_stcb == 0) &&
6101                                             stcb) {
6102                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
6103                                         }
6104                                         copied_so_far += cp_len;
6105                                         freed_so_far += (uint32_t)cp_len;
6106                                         freed_so_far += MSIZE;
6107                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6108                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
6109                                                     SCTP_LOG_SBRESULT, 0);
6110                                         }
6111                                         atomic_subtract_int(&control->length, cp_len);
6112                                 } else {
6113                                         copied_so_far += cp_len;
6114                                 }
6115                         }
6116                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
6117                                 break;
6118                         }
6119                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
6120                             (control->do_not_ref_stcb == 0) &&
6121                             (freed_so_far >= rwnd_req)) {
6122                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6123                         }
6124                 }               /* end while(m) */
6125                 /*
6126                  * At this point we have looked at it all and we either have
6127                  * a MSG_EOR/or read all the user wants... <OR>
6128                  * control->length == 0.
6129                  */
6130                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
6131                         /* we are done with this control */
6132                         if (control->length == 0) {
6133                                 if (control->data) {
6134 #ifdef INVARIANTS
6135                                         panic("control->data not null at read eor?");
6136 #else
6137                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
6138                                         sctp_m_freem(control->data);
6139                                         control->data = NULL;
6140 #endif
6141                                 }
6142                 done_with_control:
6143                                 if (hold_rlock == 0) {
6144                                         SCTP_INP_READ_LOCK(inp);
6145                                         hold_rlock = 1;
6146                                 }
6147                                 TAILQ_REMOVE(&inp->read_queue, control, next);
6148                                 /* Add back any hiddend data */
6149                                 if (control->held_length) {
6150                                         held_length = 0;
6151                                         control->held_length = 0;
6152                                         wakeup_read_socket = 1;
6153                                 }
6154                                 if (control->aux_data) {
6155                                         sctp_m_free(control->aux_data);
6156                                         control->aux_data = NULL;
6157                                 }
6158                                 no_rcv_needed = control->do_not_ref_stcb;
6159                                 sctp_free_remote_addr(control->whoFrom);
6160                                 control->data = NULL;
6161 #ifdef INVARIANTS
6162                                 if (control->on_strm_q) {
6163                                         panic("About to free ctl:%p so:%p and its in %d",
6164                                             control, so, control->on_strm_q);
6165                                 }
6166 #endif
6167                                 sctp_free_a_readq(stcb, control);
6168                                 control = NULL;
6169                                 if ((freed_so_far >= rwnd_req) &&
6170                                     (no_rcv_needed == 0))
6171                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6172
6173                         } else {
6174                                 /*
6175                                  * The user did not read all of this
6176                                  * message, turn off the returned MSG_EOR
6177                                  * since we are leaving more behind on the
6178                                  * control to read.
6179                                  */
6180 #ifdef INVARIANTS
6181                                 if (control->end_added &&
6182                                     (control->data == NULL) &&
6183                                     (control->tail_mbuf == NULL)) {
6184                                         panic("Gak, control->length is corrupt?");
6185                                 }
6186 #endif
6187                                 no_rcv_needed = control->do_not_ref_stcb;
6188                                 out_flags &= ~MSG_EOR;
6189                         }
6190                 }
6191                 if (out_flags & MSG_EOR) {
6192                         goto release;
6193                 }
6194                 if ((uio->uio_resid == 0) ||
6195                     ((in_eeor_mode) &&
6196                     (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))) {
6197                         goto release;
6198                 }
6199                 /*
6200                  * If I hit here the receiver wants more and this message is
6201                  * NOT done (pd-api). So two questions. Can we block? if not
6202                  * we are done. Did the user NOT set MSG_WAITALL?
6203                  */
6204                 if (block_allowed == 0) {
6205                         goto release;
6206                 }
6207                 /*
6208                  * We need to wait for more data a few things: - We don't
6209                  * sbunlock() so we don't get someone else reading. - We
6210                  * must be sure to account for the case where what is added
6211                  * is NOT to our control when we wakeup.
6212                  */
6213
6214                 /*
6215                  * Do we need to tell the transport a rwnd update might be
6216                  * needed before we go to sleep?
6217                  */
6218                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
6219                     ((freed_so_far >= rwnd_req) &&
6220                     (control->do_not_ref_stcb == 0) &&
6221                     (no_rcv_needed == 0))) {
6222                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6223                 }
6224 wait_some_more:
6225                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
6226                         goto release;
6227                 }
6228
6229                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
6230                         goto release;
6231
6232                 if (hold_rlock == 1) {
6233                         SCTP_INP_READ_UNLOCK(inp);
6234                         hold_rlock = 0;
6235                 }
6236                 if (hold_sblock == 0) {
6237                         SOCKBUF_LOCK(&so->so_rcv);
6238                         hold_sblock = 1;
6239                 }
6240                 if ((copied_so_far) && (control->length == 0) &&
6241                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
6242                         goto release;
6243                 }
6244                 if (so->so_rcv.sb_cc <= control->held_length) {
6245                         error = sbwait(&so->so_rcv);
6246                         if (error) {
6247                                 goto release;
6248                         }
6249                         control->held_length = 0;
6250                 }
6251                 if (hold_sblock) {
6252                         SOCKBUF_UNLOCK(&so->so_rcv);
6253                         hold_sblock = 0;
6254                 }
6255                 if (control->length == 0) {
6256                         /* still nothing here */
6257                         if (control->end_added == 1) {
6258                                 /* he aborted, or is done i.e.did a shutdown */
6259                                 out_flags |= MSG_EOR;
6260                                 if (control->pdapi_aborted) {
6261                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6262                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6263
6264                                         out_flags |= MSG_TRUNC;
6265                                 } else {
6266                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6267                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6268                                 }
6269                                 goto done_with_control;
6270                         }
6271                         if (so->so_rcv.sb_cc > held_length) {
6272                                 control->held_length = so->so_rcv.sb_cc;
6273                                 held_length = 0;
6274                         }
6275                         goto wait_some_more;
6276                 } else if (control->data == NULL) {
6277                         /*
6278                          * we must re-sync since data is probably being
6279                          * added
6280                          */
6281                         SCTP_INP_READ_LOCK(inp);
6282                         if ((control->length > 0) && (control->data == NULL)) {
6283                                 /*
6284                                  * big trouble.. we have the lock and its
6285                                  * corrupt?
6286                                  */
6287 #ifdef INVARIANTS
6288                                 panic("Impossible data==NULL length !=0");
6289 #endif
6290                                 out_flags |= MSG_EOR;
6291                                 out_flags |= MSG_TRUNC;
6292                                 control->length = 0;
6293                                 SCTP_INP_READ_UNLOCK(inp);
6294                                 goto done_with_control;
6295                         }
6296                         SCTP_INP_READ_UNLOCK(inp);
6297                         /* We will fall around to get more data */
6298                 }
6299                 goto get_more_data;
6300         } else {
6301                 /*-
6302                  * Give caller back the mbuf chain,
6303                  * store in uio_resid the length
6304                  */
6305                 wakeup_read_socket = 0;
6306                 if ((control->end_added == 0) ||
6307                     (TAILQ_NEXT(control, next) == NULL)) {
6308                         /* Need to get rlock */
6309                         if (hold_rlock == 0) {
6310                                 SCTP_INP_READ_LOCK(inp);
6311                                 hold_rlock = 1;
6312                         }
6313                 }
6314                 if (control->end_added) {
6315                         out_flags |= MSG_EOR;
6316                         if ((control->do_not_ref_stcb == 0) &&
6317                             (control->stcb != NULL) &&
6318                             ((control->spec_flags & M_NOTIFICATION) == 0))
6319                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6320                 }
6321                 if (control->spec_flags & M_NOTIFICATION) {
6322                         out_flags |= MSG_NOTIFICATION;
6323                 }
6324                 uio->uio_resid = control->length;
6325                 *mp = control->data;
6326                 m = control->data;
6327                 while (m) {
6328                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6329                                 sctp_sblog(&so->so_rcv,
6330                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6331                         }
6332                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6333                         freed_so_far += (uint32_t)SCTP_BUF_LEN(m);
6334                         freed_so_far += MSIZE;
6335                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6336                                 sctp_sblog(&so->so_rcv,
6337                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6338                         }
6339                         m = SCTP_BUF_NEXT(m);
6340                 }
6341                 control->data = control->tail_mbuf = NULL;
6342                 control->length = 0;
6343                 if (out_flags & MSG_EOR) {
6344                         /* Done with this control */
6345                         goto done_with_control;
6346                 }
6347         }
6348 release:
6349         if (hold_rlock == 1) {
6350                 SCTP_INP_READ_UNLOCK(inp);
6351                 hold_rlock = 0;
6352         }
6353         if (hold_sblock == 1) {
6354                 SOCKBUF_UNLOCK(&so->so_rcv);
6355                 hold_sblock = 0;
6356         }
6357
6358         sbunlock(&so->so_rcv);
6359         sockbuf_lock = 0;
6360
6361 release_unlocked:
6362         if (hold_sblock) {
6363                 SOCKBUF_UNLOCK(&so->so_rcv);
6364                 hold_sblock = 0;
6365         }
6366         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6367                 if ((freed_so_far >= rwnd_req) &&
6368                     (control && (control->do_not_ref_stcb == 0)) &&
6369                     (no_rcv_needed == 0))
6370                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6371         }
6372 out:
6373         if (msg_flags) {
6374                 *msg_flags = out_flags;
6375         }
6376         if (((out_flags & MSG_EOR) == 0) &&
6377             ((in_flags & MSG_PEEK) == 0) &&
6378             (sinfo) &&
6379             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6380             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6381                 struct sctp_extrcvinfo *s_extra;
6382
6383                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6384                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
6385         }
6386         if (hold_rlock == 1) {
6387                 SCTP_INP_READ_UNLOCK(inp);
6388         }
6389         if (hold_sblock) {
6390                 SOCKBUF_UNLOCK(&so->so_rcv);
6391         }
6392         if (sockbuf_lock) {
6393                 sbunlock(&so->so_rcv);
6394         }
6395
6396         if (freecnt_applied) {
6397                 /*
6398                  * The lock on the socket buffer protects us so the free
6399                  * code will stop. But since we used the socketbuf lock and
6400                  * the sender uses the tcb_lock to increment, we need to use
6401                  * the atomic add to the refcnt.
6402                  */
6403                 if (stcb == NULL) {
6404 #ifdef INVARIANTS
6405                         panic("stcb for refcnt has gone NULL?");
6406                         goto stage_left;
6407 #else
6408                         goto stage_left;
6409 #endif
6410                 }
6411                 /* Save the value back for next time */
6412                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6413                 atomic_add_int(&stcb->asoc.refcnt, -1);
6414         }
6415         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6416                 if (stcb) {
6417                         sctp_misc_ints(SCTP_SORECV_DONE,
6418                             freed_so_far,
6419                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6420                             stcb->asoc.my_rwnd,
6421                             so->so_rcv.sb_cc);
6422                 } else {
6423                         sctp_misc_ints(SCTP_SORECV_DONE,
6424                             freed_so_far,
6425                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6426                             0,
6427                             so->so_rcv.sb_cc);
6428                 }
6429         }
6430 stage_left:
6431         if (wakeup_read_socket) {
6432                 sctp_sorwakeup(inp, so);
6433         }
6434         return (error);
6435 }
6436
6437
6438 #ifdef SCTP_MBUF_LOGGING
6439 struct mbuf *
6440 sctp_m_free(struct mbuf *m)
6441 {
6442         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6443                 sctp_log_mb(m, SCTP_MBUF_IFREE);
6444         }
6445         return (m_free(m));
6446 }
6447
6448 void
6449 sctp_m_freem(struct mbuf *mb)
6450 {
6451         while (mb != NULL)
6452                 mb = sctp_m_free(mb);
6453 }
6454
6455 #endif
6456
6457 int
6458 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6459 {
6460         /*
6461          * Given a local address. For all associations that holds the
6462          * address, request a peer-set-primary.
6463          */
6464         struct sctp_ifa *ifa;
6465         struct sctp_laddr *wi;
6466
6467         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6468         if (ifa == NULL) {
6469                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6470                 return (EADDRNOTAVAIL);
6471         }
6472         /*
6473          * Now that we have the ifa we must awaken the iterator with this
6474          * message.
6475          */
6476         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6477         if (wi == NULL) {
6478                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6479                 return (ENOMEM);
6480         }
6481         /* Now incr the count and int wi structure */
6482         SCTP_INCR_LADDR_COUNT();
6483         memset(wi, 0, sizeof(*wi));
6484         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6485         wi->ifa = ifa;
6486         wi->action = SCTP_SET_PRIM_ADDR;
6487         atomic_add_int(&ifa->refcount, 1);
6488
6489         /* Now add it to the work queue */
6490         SCTP_WQ_ADDR_LOCK();
6491         /*
6492          * Should this really be a tailq? As it is we will process the
6493          * newest first :-0
6494          */
6495         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6496         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6497             (struct sctp_inpcb *)NULL,
6498             (struct sctp_tcb *)NULL,
6499             (struct sctp_nets *)NULL);
6500         SCTP_WQ_ADDR_UNLOCK();
6501         return (0);
6502 }
6503
6504
6505 int
6506 sctp_soreceive(struct socket *so,
6507     struct sockaddr **psa,
6508     struct uio *uio,
6509     struct mbuf **mp0,
6510     struct mbuf **controlp,
6511     int *flagsp)
6512 {
6513         int error, fromlen;
6514         uint8_t sockbuf[256];
6515         struct sockaddr *from;
6516         struct sctp_extrcvinfo sinfo;
6517         int filling_sinfo = 1;
6518         int flags;
6519         struct sctp_inpcb *inp;
6520
6521         inp = (struct sctp_inpcb *)so->so_pcb;
6522         /* pickup the assoc we are reading from */
6523         if (inp == NULL) {
6524                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6525                 return (EINVAL);
6526         }
6527         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6528             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6529             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6530             (controlp == NULL)) {
6531                 /* user does not want the sndrcv ctl */
6532                 filling_sinfo = 0;
6533         }
6534         if (psa) {
6535                 from = (struct sockaddr *)sockbuf;
6536                 fromlen = sizeof(sockbuf);
6537                 from->sa_len = 0;
6538         } else {
6539                 from = NULL;
6540                 fromlen = 0;
6541         }
6542
6543         if (filling_sinfo) {
6544                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6545         }
6546         if (flagsp != NULL) {
6547                 flags = *flagsp;
6548         } else {
6549                 flags = 0;
6550         }
6551         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, &flags,
6552             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6553         if (flagsp != NULL) {
6554                 *flagsp = flags;
6555         }
6556         if (controlp != NULL) {
6557                 /* copy back the sinfo in a CMSG format */
6558                 if (filling_sinfo && ((flags & MSG_NOTIFICATION) == 0)) {
6559                         *controlp = sctp_build_ctl_nchunk(inp,
6560                             (struct sctp_sndrcvinfo *)&sinfo);
6561                 } else {
6562                         *controlp = NULL;
6563                 }
6564         }
6565         if (psa) {
6566                 /* copy back the address info */
6567                 if (from && from->sa_len) {
6568                         *psa = sodupsockaddr(from, M_NOWAIT);
6569                 } else {
6570                         *psa = NULL;
6571                 }
6572         }
6573         return (error);
6574 }
6575
6576
6577
6578
6579
6580 int
6581 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6582     int totaddr, int *error)
6583 {
6584         int added = 0;
6585         int i;
6586         struct sctp_inpcb *inp;
6587         struct sockaddr *sa;
6588         size_t incr = 0;
6589 #ifdef INET
6590         struct sockaddr_in *sin;
6591 #endif
6592 #ifdef INET6
6593         struct sockaddr_in6 *sin6;
6594 #endif
6595
6596         sa = addr;
6597         inp = stcb->sctp_ep;
6598         *error = 0;
6599         for (i = 0; i < totaddr; i++) {
6600                 switch (sa->sa_family) {
6601 #ifdef INET
6602                 case AF_INET:
6603                         incr = sizeof(struct sockaddr_in);
6604                         sin = (struct sockaddr_in *)sa;
6605                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6606                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6607                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6608                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6609                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6610                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_7);
6611                                 *error = EINVAL;
6612                                 goto out_now;
6613                         }
6614                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6615                             SCTP_DONOT_SETSCOPE,
6616                             SCTP_ADDR_IS_CONFIRMED)) {
6617                                 /* assoc gone no un-lock */
6618                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6619                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6620                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_8);
6621                                 *error = ENOBUFS;
6622                                 goto out_now;
6623                         }
6624                         added++;
6625                         break;
6626 #endif
6627 #ifdef INET6
6628                 case AF_INET6:
6629                         incr = sizeof(struct sockaddr_in6);
6630                         sin6 = (struct sockaddr_in6 *)sa;
6631                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6632                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6633                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6634                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6635                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_9);
6636                                 *error = EINVAL;
6637                                 goto out_now;
6638                         }
6639                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6640                             SCTP_DONOT_SETSCOPE,
6641                             SCTP_ADDR_IS_CONFIRMED)) {
6642                                 /* assoc gone no un-lock */
6643                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6644                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6645                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_10);
6646                                 *error = ENOBUFS;
6647                                 goto out_now;
6648                         }
6649                         added++;
6650                         break;
6651 #endif
6652                 default:
6653                         break;
6654                 }
6655                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6656         }
6657 out_now:
6658         return (added);
6659 }
6660
6661 int
6662 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6663     unsigned int totaddr,
6664     unsigned int *num_v4, unsigned int *num_v6,
6665     unsigned int limit)
6666 {
6667         struct sockaddr *sa;
6668         struct sctp_tcb *stcb;
6669         unsigned int incr, at, i;
6670
6671         at = 0;
6672         sa = addr;
6673         *num_v6 = *num_v4 = 0;
6674         /* account and validate addresses */
6675         if (totaddr == 0) {
6676                 return (EINVAL);
6677         }
6678         for (i = 0; i < totaddr; i++) {
6679                 if (at + sizeof(struct sockaddr) > limit) {
6680                         return (EINVAL);
6681                 }
6682                 switch (sa->sa_family) {
6683 #ifdef INET
6684                 case AF_INET:
6685                         incr = (unsigned int)sizeof(struct sockaddr_in);
6686                         if (sa->sa_len != incr) {
6687                                 return (EINVAL);
6688                         }
6689                         (*num_v4) += 1;
6690                         break;
6691 #endif
6692 #ifdef INET6
6693                 case AF_INET6:
6694                         {
6695                                 struct sockaddr_in6 *sin6;
6696
6697                                 sin6 = (struct sockaddr_in6 *)sa;
6698                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6699                                         /* Must be non-mapped for connectx */
6700                                         return (EINVAL);
6701                                 }
6702                                 incr = (unsigned int)sizeof(struct sockaddr_in6);
6703                                 if (sa->sa_len != incr) {
6704                                         return (EINVAL);
6705                                 }
6706                                 (*num_v6) += 1;
6707                                 break;
6708                         }
6709 #endif
6710                 default:
6711                         return (EINVAL);
6712                 }
6713                 if ((at + incr) > limit) {
6714                         return (EINVAL);
6715                 }
6716                 SCTP_INP_INCR_REF(inp);
6717                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6718                 if (stcb != NULL) {
6719                         SCTP_TCB_UNLOCK(stcb);
6720                         return (EALREADY);
6721                 } else {
6722                         SCTP_INP_DECR_REF(inp);
6723                 }
6724                 at += incr;
6725                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6726         }
6727         return (0);
6728 }
6729
6730 /*
6731  * sctp_bindx(ADD) for one address.
6732  * assumes all arguments are valid/checked by caller.
6733  */
6734 void
6735 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6736     struct sockaddr *sa, sctp_assoc_t assoc_id,
6737     uint32_t vrf_id, int *error, void *p)
6738 {
6739         struct sockaddr *addr_touse;
6740 #if defined(INET) && defined(INET6)
6741         struct sockaddr_in sin;
6742 #endif
6743
6744         /* see if we're bound all already! */
6745         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6746                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6747                 *error = EINVAL;
6748                 return;
6749         }
6750         addr_touse = sa;
6751 #ifdef INET6
6752         if (sa->sa_family == AF_INET6) {
6753 #ifdef INET
6754                 struct sockaddr_in6 *sin6;
6755
6756 #endif
6757                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6758                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6759                         *error = EINVAL;
6760                         return;
6761                 }
6762                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6763                         /* can only bind v6 on PF_INET6 sockets */
6764                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6765                         *error = EINVAL;
6766                         return;
6767                 }
6768 #ifdef INET
6769                 sin6 = (struct sockaddr_in6 *)addr_touse;
6770                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6771                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6772                             SCTP_IPV6_V6ONLY(inp)) {
6773                                 /* can't bind v4-mapped on PF_INET sockets */
6774                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6775                                 *error = EINVAL;
6776                                 return;
6777                         }
6778                         in6_sin6_2_sin(&sin, sin6);
6779                         addr_touse = (struct sockaddr *)&sin;
6780                 }
6781 #endif
6782         }
6783 #endif
6784 #ifdef INET
6785         if (sa->sa_family == AF_INET) {
6786                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6787                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6788                         *error = EINVAL;
6789                         return;
6790                 }
6791                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6792                     SCTP_IPV6_V6ONLY(inp)) {
6793                         /* can't bind v4 on PF_INET sockets */
6794                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6795                         *error = EINVAL;
6796                         return;
6797                 }
6798         }
6799 #endif
6800         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6801                 if (p == NULL) {
6802                         /* Can't get proc for Net/Open BSD */
6803                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6804                         *error = EINVAL;
6805                         return;
6806                 }
6807                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6808                 return;
6809         }
6810         /*
6811          * No locks required here since bind and mgmt_ep_sa all do their own
6812          * locking. If we do something for the FIX: below we may need to
6813          * lock in that case.
6814          */
6815         if (assoc_id == 0) {
6816                 /* add the address */
6817                 struct sctp_inpcb *lep;
6818                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6819
6820                 /* validate the incoming port */
6821                 if ((lsin->sin_port != 0) &&
6822                     (lsin->sin_port != inp->sctp_lport)) {
6823                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6824                         *error = EINVAL;
6825                         return;
6826                 } else {
6827                         /* user specified 0 port, set it to existing port */
6828                         lsin->sin_port = inp->sctp_lport;
6829                 }
6830
6831                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6832                 if (lep != NULL) {
6833                         /*
6834                          * We must decrement the refcount since we have the
6835                          * ep already and are binding. No remove going on
6836                          * here.
6837                          */
6838                         SCTP_INP_DECR_REF(lep);
6839                 }
6840                 if (lep == inp) {
6841                         /* already bound to it.. ok */
6842                         return;
6843                 } else if (lep == NULL) {
6844                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6845                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6846                             SCTP_ADD_IP_ADDRESS,
6847                             vrf_id, NULL);
6848                 } else {
6849                         *error = EADDRINUSE;
6850                 }
6851                 if (*error)
6852                         return;
6853         } else {
6854                 /*
6855                  * FIX: decide whether we allow assoc based bindx
6856                  */
6857         }
6858 }
6859
6860 /*
6861  * sctp_bindx(DELETE) for one address.
6862  * assumes all arguments are valid/checked by caller.
6863  */
6864 void
6865 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6866     struct sockaddr *sa, sctp_assoc_t assoc_id,
6867     uint32_t vrf_id, int *error)
6868 {
6869         struct sockaddr *addr_touse;
6870 #if defined(INET) && defined(INET6)
6871         struct sockaddr_in sin;
6872 #endif
6873
6874         /* see if we're bound all already! */
6875         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6876                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6877                 *error = EINVAL;
6878                 return;
6879         }
6880         addr_touse = sa;
6881 #ifdef INET6
6882         if (sa->sa_family == AF_INET6) {
6883 #ifdef INET
6884                 struct sockaddr_in6 *sin6;
6885 #endif
6886
6887                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6888                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6889                         *error = EINVAL;
6890                         return;
6891                 }
6892                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6893                         /* can only bind v6 on PF_INET6 sockets */
6894                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6895                         *error = EINVAL;
6896                         return;
6897                 }
6898 #ifdef INET
6899                 sin6 = (struct sockaddr_in6 *)addr_touse;
6900                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6901                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6902                             SCTP_IPV6_V6ONLY(inp)) {
6903                                 /* can't bind mapped-v4 on PF_INET sockets */
6904                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6905                                 *error = EINVAL;
6906                                 return;
6907                         }
6908                         in6_sin6_2_sin(&sin, sin6);
6909                         addr_touse = (struct sockaddr *)&sin;
6910                 }
6911 #endif
6912         }
6913 #endif
6914 #ifdef INET
6915         if (sa->sa_family == AF_INET) {
6916                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6917                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6918                         *error = EINVAL;
6919                         return;
6920                 }
6921                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6922                     SCTP_IPV6_V6ONLY(inp)) {
6923                         /* can't bind v4 on PF_INET sockets */
6924                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6925                         *error = EINVAL;
6926                         return;
6927                 }
6928         }
6929 #endif
6930         /*
6931          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6932          * below is ever changed we may need to lock before calling
6933          * association level binding.
6934          */
6935         if (assoc_id == 0) {
6936                 /* delete the address */
6937                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6938                     SCTP_DEL_IP_ADDRESS,
6939                     vrf_id, NULL);
6940         } else {
6941                 /*
6942                  * FIX: decide whether we allow assoc based bindx
6943                  */
6944         }
6945 }
6946
6947 /*
6948  * returns the valid local address count for an assoc, taking into account
6949  * all scoping rules
6950  */
6951 int
6952 sctp_local_addr_count(struct sctp_tcb *stcb)
6953 {
6954         int loopback_scope;
6955 #if defined(INET)
6956         int ipv4_local_scope, ipv4_addr_legal;
6957 #endif
6958 #if defined (INET6)
6959         int local_scope, site_scope, ipv6_addr_legal;
6960 #endif
6961         struct sctp_vrf *vrf;
6962         struct sctp_ifn *sctp_ifn;
6963         struct sctp_ifa *sctp_ifa;
6964         int count = 0;
6965
6966         /* Turn on all the appropriate scopes */
6967         loopback_scope = stcb->asoc.scope.loopback_scope;
6968 #if defined(INET)
6969         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6970         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6971 #endif
6972 #if defined(INET6)
6973         local_scope = stcb->asoc.scope.local_scope;
6974         site_scope = stcb->asoc.scope.site_scope;
6975         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6976 #endif
6977         SCTP_IPI_ADDR_RLOCK();
6978         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6979         if (vrf == NULL) {
6980                 /* no vrf, no addresses */
6981                 SCTP_IPI_ADDR_RUNLOCK();
6982                 return (0);
6983         }
6984
6985         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6986                 /*
6987                  * bound all case: go through all ifns on the vrf
6988                  */
6989                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6990                         if ((loopback_scope == 0) &&
6991                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6992                                 continue;
6993                         }
6994                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6995                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6996                                         continue;
6997                                 switch (sctp_ifa->address.sa.sa_family) {
6998 #ifdef INET
6999                                 case AF_INET:
7000                                         if (ipv4_addr_legal) {
7001                                                 struct sockaddr_in *sin;
7002
7003                                                 sin = &sctp_ifa->address.sin;
7004                                                 if (sin->sin_addr.s_addr == 0) {
7005                                                         /*
7006                                                          * skip unspecified
7007                                                          * addrs
7008                                                          */
7009                                                         continue;
7010                                                 }
7011                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
7012                                                     &sin->sin_addr) != 0) {
7013                                                         continue;
7014                                                 }
7015                                                 if ((ipv4_local_scope == 0) &&
7016                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
7017                                                         continue;
7018                                                 }
7019                                                 /* count this one */
7020                                                 count++;
7021                                         } else {
7022                                                 continue;
7023                                         }
7024                                         break;
7025 #endif
7026 #ifdef INET6
7027                                 case AF_INET6:
7028                                         if (ipv6_addr_legal) {
7029                                                 struct sockaddr_in6 *sin6;
7030
7031                                                 sin6 = &sctp_ifa->address.sin6;
7032                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
7033                                                         continue;
7034                                                 }
7035                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
7036                                                     &sin6->sin6_addr) != 0) {
7037                                                         continue;
7038                                                 }
7039                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
7040                                                         if (local_scope == 0)
7041                                                                 continue;
7042                                                         if (sin6->sin6_scope_id == 0) {
7043                                                                 if (sa6_recoverscope(sin6) != 0)
7044                                                                         /*
7045                                                                          *
7046                                                                          * bad
7047                                                                          * link
7048                                                                          *
7049                                                                          * local
7050                                                                          *
7051                                                                          * address
7052                                                                          */
7053                                                                         continue;
7054                                                         }
7055                                                 }
7056                                                 if ((site_scope == 0) &&
7057                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
7058                                                         continue;
7059                                                 }
7060                                                 /* count this one */
7061                                                 count++;
7062                                         }
7063                                         break;
7064 #endif
7065                                 default:
7066                                         /* TSNH */
7067                                         break;
7068                                 }
7069                         }
7070                 }
7071         } else {
7072                 /*
7073                  * subset bound case
7074                  */
7075                 struct sctp_laddr *laddr;
7076
7077                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
7078                     sctp_nxt_addr) {
7079                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
7080                                 continue;
7081                         }
7082                         /* count this one */
7083                         count++;
7084                 }
7085         }
7086         SCTP_IPI_ADDR_RUNLOCK();
7087         return (count);
7088 }
7089
7090 #if defined(SCTP_LOCAL_TRACE_BUF)
7091
7092 void
7093 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
7094 {
7095         uint32_t saveindex, newindex;
7096
7097         do {
7098                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
7099                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
7100                         newindex = 1;
7101                 } else {
7102                         newindex = saveindex + 1;
7103                 }
7104         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
7105         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
7106                 saveindex = 0;
7107         }
7108         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
7109         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
7110         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
7111         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
7112         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
7113         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
7114         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
7115         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
7116 }
7117
7118 #endif
7119 static void
7120 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,
7121     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
7122 {
7123         struct ip *iph;
7124 #ifdef INET6
7125         struct ip6_hdr *ip6;
7126 #endif
7127         struct mbuf *sp, *last;
7128         struct udphdr *uhdr;
7129         uint16_t port;
7130
7131         if ((m->m_flags & M_PKTHDR) == 0) {
7132                 /* Can't handle one that is not a pkt hdr */
7133                 goto out;
7134         }
7135         /* Pull the src port */
7136         iph = mtod(m, struct ip *);
7137         uhdr = (struct udphdr *)((caddr_t)iph + off);
7138         port = uhdr->uh_sport;
7139         /*
7140          * Split out the mbuf chain. Leave the IP header in m, place the
7141          * rest in the sp.
7142          */
7143         sp = m_split(m, off, M_NOWAIT);
7144         if (sp == NULL) {
7145                 /* Gak, drop packet, we can't do a split */
7146                 goto out;
7147         }
7148         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
7149                 /* Gak, packet can't have an SCTP header in it - too small */
7150                 m_freem(sp);
7151                 goto out;
7152         }
7153         /* Now pull up the UDP header and SCTP header together */
7154         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
7155         if (sp == NULL) {
7156                 /* Gak pullup failed */
7157                 goto out;
7158         }
7159         /* Trim out the UDP header */
7160         m_adj(sp, sizeof(struct udphdr));
7161
7162         /* Now reconstruct the mbuf chain */
7163         for (last = m; last->m_next; last = last->m_next);
7164         last->m_next = sp;
7165         m->m_pkthdr.len += sp->m_pkthdr.len;
7166         /*
7167          * The CSUM_DATA_VALID flags indicates that the HW checked the UDP
7168          * checksum and it was valid. Since CSUM_DATA_VALID ==
7169          * CSUM_SCTP_VALID this would imply that the HW also verified the
7170          * SCTP checksum. Therefore, clear the bit.
7171          */
7172         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
7173             "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n",
7174             m->m_pkthdr.len,
7175             if_name(m->m_pkthdr.rcvif),
7176             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
7177         m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
7178         iph = mtod(m, struct ip *);
7179         switch (iph->ip_v) {
7180 #ifdef INET
7181         case IPVERSION:
7182                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
7183                 sctp_input_with_port(m, off, port);
7184                 break;
7185 #endif
7186 #ifdef INET6
7187         case IPV6_VERSION >> 4:
7188                 ip6 = mtod(m, struct ip6_hdr *);
7189                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
7190                 sctp6_input_with_port(&m, &off, port);
7191                 break;
7192 #endif
7193         default:
7194                 goto out;
7195                 break;
7196         }
7197         return;
7198 out:
7199         m_freem(m);
7200 }
7201
7202 #ifdef INET
7203 static void
7204 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED)
7205 {
7206         struct ip *outer_ip, *inner_ip;
7207         struct sctphdr *sh;
7208         struct icmp *icmp;
7209         struct udphdr *udp;
7210         struct sctp_inpcb *inp;
7211         struct sctp_tcb *stcb;
7212         struct sctp_nets *net;
7213         struct sctp_init_chunk *ch;
7214         struct sockaddr_in src, dst;
7215         uint8_t type, code;
7216
7217         inner_ip = (struct ip *)vip;
7218         icmp = (struct icmp *)((caddr_t)inner_ip -
7219             (sizeof(struct icmp) - sizeof(struct ip)));
7220         outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
7221         if (ntohs(outer_ip->ip_len) <
7222             sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) {
7223                 return;
7224         }
7225         udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
7226         sh = (struct sctphdr *)(udp + 1);
7227         memset(&src, 0, sizeof(struct sockaddr_in));
7228         src.sin_family = AF_INET;
7229         src.sin_len = sizeof(struct sockaddr_in);
7230         src.sin_port = sh->src_port;
7231         src.sin_addr = inner_ip->ip_src;
7232         memset(&dst, 0, sizeof(struct sockaddr_in));
7233         dst.sin_family = AF_INET;
7234         dst.sin_len = sizeof(struct sockaddr_in);
7235         dst.sin_port = sh->dest_port;
7236         dst.sin_addr = inner_ip->ip_dst;
7237         /*
7238          * 'dst' holds the dest of the packet that failed to be sent. 'src'
7239          * holds our local endpoint address. Thus we reverse the dst and the
7240          * src in the lookup.
7241          */
7242         inp = NULL;
7243         net = NULL;
7244         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7245             (struct sockaddr *)&src,
7246             &inp, &net, 1,
7247             SCTP_DEFAULT_VRFID);
7248         if ((stcb != NULL) &&
7249             (net != NULL) &&
7250             (inp != NULL)) {
7251                 /* Check the UDP port numbers */
7252                 if ((udp->uh_dport != net->port) ||
7253                     (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7254                         SCTP_TCB_UNLOCK(stcb);
7255                         return;
7256                 }
7257                 /* Check the verification tag */
7258                 if (ntohl(sh->v_tag) != 0) {
7259                         /*
7260                          * This must be the verification tag used for
7261                          * sending out packets. We don't consider packets
7262                          * reflecting the verification tag.
7263                          */
7264                         if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) {
7265                                 SCTP_TCB_UNLOCK(stcb);
7266                                 return;
7267                         }
7268                 } else {
7269                         if (ntohs(outer_ip->ip_len) >=
7270                             sizeof(struct ip) +
7271                             8 + (inner_ip->ip_hl << 2) + 8 + 20) {
7272                                 /*
7273                                  * In this case we can check if we got an
7274                                  * INIT chunk and if the initiate tag
7275                                  * matches.
7276                                  */
7277                                 ch = (struct sctp_init_chunk *)(sh + 1);
7278                                 if ((ch->ch.chunk_type != SCTP_INITIATION) ||
7279                                     (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) {
7280                                         SCTP_TCB_UNLOCK(stcb);
7281                                         return;
7282                                 }
7283                         } else {
7284                                 SCTP_TCB_UNLOCK(stcb);
7285                                 return;
7286                         }
7287                 }
7288                 type = icmp->icmp_type;
7289                 code = icmp->icmp_code;
7290                 if ((type == ICMP_UNREACH) &&
7291                     (code == ICMP_UNREACH_PORT)) {
7292                         code = ICMP_UNREACH_PROTOCOL;
7293                 }
7294                 sctp_notify(inp, stcb, net, type, code,
7295                     ntohs(inner_ip->ip_len),
7296                     (uint32_t)ntohs(icmp->icmp_nextmtu));
7297         } else {
7298                 if ((stcb == NULL) && (inp != NULL)) {
7299                         /* reduce ref-count */
7300                         SCTP_INP_WLOCK(inp);
7301                         SCTP_INP_DECR_REF(inp);
7302                         SCTP_INP_WUNLOCK(inp);
7303                 }
7304                 if (stcb) {
7305                         SCTP_TCB_UNLOCK(stcb);
7306                 }
7307         }
7308         return;
7309 }
7310 #endif
7311
7312 #ifdef INET6
7313 static void
7314 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED)
7315 {
7316         struct ip6ctlparam *ip6cp;
7317         struct sctp_inpcb *inp;
7318         struct sctp_tcb *stcb;
7319         struct sctp_nets *net;
7320         struct sctphdr sh;
7321         struct udphdr udp;
7322         struct sockaddr_in6 src, dst;
7323         uint8_t type, code;
7324
7325         ip6cp = (struct ip6ctlparam *)d;
7326         /*
7327          * XXX: We assume that when IPV6 is non NULL, M and OFF are valid.
7328          */
7329         if (ip6cp->ip6c_m == NULL) {
7330                 return;
7331         }
7332         /*
7333          * Check if we can safely examine the ports and the verification tag
7334          * of the SCTP common header.
7335          */
7336         if (ip6cp->ip6c_m->m_pkthdr.len <
7337             ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) {
7338                 return;
7339         }
7340         /* Copy out the UDP header. */
7341         memset(&udp, 0, sizeof(struct udphdr));
7342         m_copydata(ip6cp->ip6c_m,
7343             ip6cp->ip6c_off,
7344             sizeof(struct udphdr),
7345             (caddr_t)&udp);
7346         /* Copy out the port numbers and the verification tag. */
7347         memset(&sh, 0, sizeof(struct sctphdr));
7348         m_copydata(ip6cp->ip6c_m,
7349             ip6cp->ip6c_off + sizeof(struct udphdr),
7350             sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t),
7351             (caddr_t)&sh);
7352         memset(&src, 0, sizeof(struct sockaddr_in6));
7353         src.sin6_family = AF_INET6;
7354         src.sin6_len = sizeof(struct sockaddr_in6);
7355         src.sin6_port = sh.src_port;
7356         src.sin6_addr = ip6cp->ip6c_ip6->ip6_src;
7357         if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7358                 return;
7359         }
7360         memset(&dst, 0, sizeof(struct sockaddr_in6));
7361         dst.sin6_family = AF_INET6;
7362         dst.sin6_len = sizeof(struct sockaddr_in6);
7363         dst.sin6_port = sh.dest_port;
7364         dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst;
7365         if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7366                 return;
7367         }
7368         inp = NULL;
7369         net = NULL;
7370         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7371             (struct sockaddr *)&src,
7372             &inp, &net, 1, SCTP_DEFAULT_VRFID);
7373         if ((stcb != NULL) &&
7374             (net != NULL) &&
7375             (inp != NULL)) {
7376                 /* Check the UDP port numbers */
7377                 if ((udp.uh_dport != net->port) ||
7378                     (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7379                         SCTP_TCB_UNLOCK(stcb);
7380                         return;
7381                 }
7382                 /* Check the verification tag */
7383                 if (ntohl(sh.v_tag) != 0) {
7384                         /*
7385                          * This must be the verification tag used for
7386                          * sending out packets. We don't consider packets
7387                          * reflecting the verification tag.
7388                          */
7389                         if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) {
7390                                 SCTP_TCB_UNLOCK(stcb);
7391                                 return;
7392                         }
7393                 } else {
7394                         if (ip6cp->ip6c_m->m_pkthdr.len >=
7395                             ip6cp->ip6c_off + sizeof(struct udphdr) +
7396                             sizeof(struct sctphdr) +
7397                             sizeof(struct sctp_chunkhdr) +
7398                             offsetof(struct sctp_init, a_rwnd)) {
7399                                 /*
7400                                  * In this case we can check if we got an
7401                                  * INIT chunk and if the initiate tag
7402                                  * matches.
7403                                  */
7404                                 uint32_t initiate_tag;
7405                                 uint8_t chunk_type;
7406
7407                                 m_copydata(ip6cp->ip6c_m,
7408                                     ip6cp->ip6c_off +
7409                                     sizeof(struct udphdr) +
7410                                     sizeof(struct sctphdr),
7411                                     sizeof(uint8_t),
7412                                     (caddr_t)&chunk_type);
7413                                 m_copydata(ip6cp->ip6c_m,
7414                                     ip6cp->ip6c_off +
7415                                     sizeof(struct udphdr) +
7416                                     sizeof(struct sctphdr) +
7417                                     sizeof(struct sctp_chunkhdr),
7418                                     sizeof(uint32_t),
7419                                     (caddr_t)&initiate_tag);
7420                                 if ((chunk_type != SCTP_INITIATION) ||
7421                                     (ntohl(initiate_tag) != stcb->asoc.my_vtag)) {
7422                                         SCTP_TCB_UNLOCK(stcb);
7423                                         return;
7424                                 }
7425                         } else {
7426                                 SCTP_TCB_UNLOCK(stcb);
7427                                 return;
7428                         }
7429                 }
7430                 type = ip6cp->ip6c_icmp6->icmp6_type;
7431                 code = ip6cp->ip6c_icmp6->icmp6_code;
7432                 if ((type == ICMP6_DST_UNREACH) &&
7433                     (code == ICMP6_DST_UNREACH_NOPORT)) {
7434                         type = ICMP6_PARAM_PROB;
7435                         code = ICMP6_PARAMPROB_NEXTHEADER;
7436                 }
7437                 sctp6_notify(inp, stcb, net, type, code,
7438                     ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
7439         } else {
7440                 if ((stcb == NULL) && (inp != NULL)) {
7441                         /* reduce inp's ref-count */
7442                         SCTP_INP_WLOCK(inp);
7443                         SCTP_INP_DECR_REF(inp);
7444                         SCTP_INP_WUNLOCK(inp);
7445                 }
7446                 if (stcb) {
7447                         SCTP_TCB_UNLOCK(stcb);
7448                 }
7449         }
7450 }
7451 #endif
7452
7453 void
7454 sctp_over_udp_stop(void)
7455 {
7456         /*
7457          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7458          * for writting!
7459          */
7460 #ifdef INET
7461         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7462                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
7463                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
7464         }
7465 #endif
7466 #ifdef INET6
7467         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7468                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
7469                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
7470         }
7471 #endif
7472 }
7473
7474 int
7475 sctp_over_udp_start(void)
7476 {
7477         uint16_t port;
7478         int ret;
7479 #ifdef INET
7480         struct sockaddr_in sin;
7481 #endif
7482 #ifdef INET6
7483         struct sockaddr_in6 sin6;
7484 #endif
7485         /*
7486          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7487          * for writting!
7488          */
7489         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
7490         if (ntohs(port) == 0) {
7491                 /* Must have a port set */
7492                 return (EINVAL);
7493         }
7494 #ifdef INET
7495         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7496                 /* Already running -- must stop first */
7497                 return (EALREADY);
7498         }
7499 #endif
7500 #ifdef INET6
7501         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7502                 /* Already running -- must stop first */
7503                 return (EALREADY);
7504         }
7505 #endif
7506 #ifdef INET
7507         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
7508             SOCK_DGRAM, IPPROTO_UDP,
7509             curthread->td_ucred, curthread))) {
7510                 sctp_over_udp_stop();
7511                 return (ret);
7512         }
7513         /* Call the special UDP hook. */
7514         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
7515             sctp_recv_udp_tunneled_packet,
7516             sctp_recv_icmp_tunneled_packet,
7517             NULL))) {
7518                 sctp_over_udp_stop();
7519                 return (ret);
7520         }
7521         /* Ok, we have a socket, bind it to the port. */
7522         memset(&sin, 0, sizeof(struct sockaddr_in));
7523         sin.sin_len = sizeof(struct sockaddr_in);
7524         sin.sin_family = AF_INET;
7525         sin.sin_port = htons(port);
7526         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7527             (struct sockaddr *)&sin, curthread))) {
7528                 sctp_over_udp_stop();
7529                 return (ret);
7530         }
7531 #endif
7532 #ifdef INET6
7533         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7534             SOCK_DGRAM, IPPROTO_UDP,
7535             curthread->td_ucred, curthread))) {
7536                 sctp_over_udp_stop();
7537                 return (ret);
7538         }
7539         /* Call the special UDP hook. */
7540         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7541             sctp_recv_udp_tunneled_packet,
7542             sctp_recv_icmp6_tunneled_packet,
7543             NULL))) {
7544                 sctp_over_udp_stop();
7545                 return (ret);
7546         }
7547         /* Ok, we have a socket, bind it to the port. */
7548         memset(&sin6, 0, sizeof(struct sockaddr_in6));
7549         sin6.sin6_len = sizeof(struct sockaddr_in6);
7550         sin6.sin6_family = AF_INET6;
7551         sin6.sin6_port = htons(port);
7552         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7553             (struct sockaddr *)&sin6, curthread))) {
7554                 sctp_over_udp_stop();
7555                 return (ret);
7556         }
7557 #endif
7558         return (0);
7559 }
7560
7561 /*
7562  * sctp_min_mtu ()returns the minimum of all non-zero arguments.
7563  * If all arguments are zero, zero is returned.
7564  */
7565 uint32_t
7566 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3)
7567 {
7568         if (mtu1 > 0) {
7569                 if (mtu2 > 0) {
7570                         if (mtu3 > 0) {
7571                                 return (min(mtu1, min(mtu2, mtu3)));
7572                         } else {
7573                                 return (min(mtu1, mtu2));
7574                         }
7575                 } else {
7576                         if (mtu3 > 0) {
7577                                 return (min(mtu1, mtu3));
7578                         } else {
7579                                 return (mtu1);
7580                         }
7581                 }
7582         } else {
7583                 if (mtu2 > 0) {
7584                         if (mtu3 > 0) {
7585                                 return (min(mtu2, mtu3));
7586                         } else {
7587                                 return (mtu2);
7588                         }
7589                 } else {
7590                         return (mtu3);
7591                 }
7592         }
7593 }
7594
7595 void
7596 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu)
7597 {
7598         struct in_conninfo inc;
7599
7600         memset(&inc, 0, sizeof(struct in_conninfo));
7601         inc.inc_fibnum = fibnum;
7602         switch (addr->sa.sa_family) {
7603 #ifdef INET
7604         case AF_INET:
7605                 inc.inc_faddr = addr->sin.sin_addr;
7606                 break;
7607 #endif
7608 #ifdef INET6
7609         case AF_INET6:
7610                 inc.inc_flags |= INC_ISIPV6;
7611                 inc.inc6_faddr = addr->sin6.sin6_addr;
7612                 break;
7613 #endif
7614         default:
7615                 return;
7616         }
7617         tcp_hc_updatemtu(&inc, (u_long)mtu);
7618 }
7619
7620 uint32_t
7621 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum)
7622 {
7623         struct in_conninfo inc;
7624
7625         memset(&inc, 0, sizeof(struct in_conninfo));
7626         inc.inc_fibnum = fibnum;
7627         switch (addr->sa.sa_family) {
7628 #ifdef INET
7629         case AF_INET:
7630                 inc.inc_faddr = addr->sin.sin_addr;
7631                 break;
7632 #endif
7633 #ifdef INET6
7634         case AF_INET6:
7635                 inc.inc_flags |= INC_ISIPV6;
7636                 inc.inc6_faddr = addr->sin6.sin6_addr;
7637                 break;
7638 #endif
7639         default:
7640                 return (0);
7641         }
7642         return ((uint32_t)tcp_hc_getmtu(&inc));
7643 }
7644
7645 void
7646 sctp_set_state(struct sctp_tcb *stcb, int new_state)
7647 {
7648 #if defined(KDTRACE_HOOKS)
7649         int old_state = stcb->asoc.state;
7650 #endif
7651
7652         KASSERT((new_state & ~SCTP_STATE_MASK) == 0,
7653             ("sctp_set_state: Can't set substate (new_state = %x)",
7654             new_state));
7655         stcb->asoc.state = (stcb->asoc.state & ~SCTP_STATE_MASK) | new_state;
7656         if ((new_state == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7657             (new_state == SCTP_STATE_SHUTDOWN_SENT) ||
7658             (new_state == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
7659                 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING);
7660         }
7661 #if defined(KDTRACE_HOOKS)
7662         if (((old_state & SCTP_STATE_MASK) != new_state) &&
7663             !(((old_state & SCTP_STATE_MASK) == SCTP_STATE_EMPTY) &&
7664             (new_state == SCTP_STATE_INUSE))) {
7665                 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state);
7666         }
7667 #endif
7668 }
7669
7670 void
7671 sctp_add_substate(struct sctp_tcb *stcb, int substate)
7672 {
7673 #if defined(KDTRACE_HOOKS)
7674         int old_state = stcb->asoc.state;
7675 #endif
7676
7677         KASSERT((substate & SCTP_STATE_MASK) == 0,
7678             ("sctp_add_substate: Can't set state (substate = %x)",
7679             substate));
7680         stcb->asoc.state |= substate;
7681 #if defined(KDTRACE_HOOKS)
7682         if (((substate & SCTP_STATE_ABOUT_TO_BE_FREED) &&
7683             ((old_state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) ||
7684             ((substate & SCTP_STATE_SHUTDOWN_PENDING) &&
7685             ((old_state & SCTP_STATE_SHUTDOWN_PENDING) == 0))) {
7686                 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state);
7687         }
7688 #endif
7689 }