sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctputil.c,v 1.37 2005/03/07 23:26:09 itojun Exp $     */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36
  37 #include "opt_ipsec.h"
  38 #include "opt_compat.h"
  39 #include "opt_inet6.h"
  40 #include "opt_inet.h"
  41 #include "opt_sctp.h"
  42
  43 #include <sys/param.h>
  44 #include <sys/systm.h>
  45 #include <sys/fcntl.h>
  46 #include <sys/lock.h>
  47 #include <sys/malloc.h>
  48 #include <sys/mbuf.h>
  49 #include <sys/domain.h>
  50 #include <sys/file.h>           /* for struct knote */
  51 #include <sys/kernel.h>
  52 #include <sys/event.h>
  53 #include <sys/poll.h>
  54
  55 #include <sys/protosw.h>
  56 #include <sys/socket.h>
  57 #include <sys/socketvar.h>
  58 #include <sys/proc.h>
  59 #include <sys/kernel.h>
  60 #include <sys/resourcevar.h>
  61 #include <sys/signalvar.h>
  62 #include <sys/sysctl.h>
  63 #include <sys/uio.h>
  64 #include <sys/jail.h>
  65
  66 #include <sys/callout.h>
  67
  68 #include <net/radix.h>
  69 #include <net/route.h>
  70
  71 #ifdef INET6
  72 #include <sys/domain.h>
  73 #endif
  74
  75 #include <sys/limits.h>
  76 #include <sys/mac.h>
  77 #include <sys/mutex.h>
  78
  79 #include <net/if.h>
  80 #include <net/if_types.h>
  81 #include <net/route.h>
  82
  83 #include <netinet/in.h>
  84 #include <netinet/in_systm.h>
  85 #include <netinet/ip.h>
  86 #include <netinet/in_pcb.h>
  87 #include <netinet/in_var.h>
  88 #include <netinet/ip_var.h>
  89
  90 #ifdef INET6
  91 #include <netinet/ip6.h>
  92 #include <netinet6/ip6_var.h>
  93
  94 #include <netinet6/in6_pcb.h>
  95
  96 #include <netinet6/scope6_var.h>
  97 #endif                          /* INET6 */
  98
  99 #ifdef IPSEC
 100 #include <netinet6/ipsec.h>
 101 #include <netkey/key.h>
 102 #endif                          /* IPSEC */
 103
 104 #include <netinet/sctp_os.h>
 105 #include <netinet/sctp_pcb.h>
 106 #include <netinet/sctputil.h>
 107 #include <netinet/sctp_var.h>
 108 #ifdef INET6
 109 #include <netinet6/sctp6_var.h>
 110 #endif
 111 #include <netinet/sctp_header.h>
 112 #include <netinet/sctp_output.h>
 113 #include <netinet/sctp_uio.h>
 114 #include <netinet/sctp_timer.h>
 115 #include <netinet/sctp_crc32.h>
 116 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
 117 #include <netinet/sctp_auth.h>
 118 #include <netinet/sctp_asconf.h>
 119
 120 extern int sctp_warm_the_crc32_table;
 121
 122 #define NUMBER_OF_MTU_SIZES 18
 123
 124 #ifdef SCTP_DEBUG
 125 extern uint32_t sctp_debug_on;
 126
 127 #endif
 128
 129
 130 #ifdef SCTP_STAT_LOGGING
 131 int global_sctp_cwnd_log_at = 0;
 132 int global_sctp_cwnd_log_rolled = 0;
 133 struct sctp_cwnd_log sctp_clog[SCTP_STAT_LOG_SIZE];
 134
 135 static uint32_t
 136 sctp_get_time_of_event(void)
 137 {
 138         struct timeval now;
 139         uint32_t timeval;
 140
 141         SCTP_GETPTIME_TIMEVAL(&now);
 142         timeval = (now.tv_sec % 0x00000fff);
 143         timeval <<= 20;
 144         timeval |= now.tv_usec & 0xfffff;
 145         return (timeval);
 146 }
 147
 148
 149 void
 150 sctp_clr_stat_log(void)
 151 {
 152         global_sctp_cwnd_log_at = 0;
 153         global_sctp_cwnd_log_rolled = 0;
 154 }
 155
 156
 157 void
 158 sctp_sblog(struct sockbuf *sb,
 159     struct sctp_tcb *stcb, int from, int incr)
 160 {
 161         int sctp_cwnd_log_at;
 162
 163         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 164         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 165         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 166         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_SB;
 167         sctp_clog[sctp_cwnd_log_at].x.sb.stcb = stcb;
 168         sctp_clog[sctp_cwnd_log_at].x.sb.so_sbcc = sb->sb_cc;
 169         if (stcb)
 170                 sctp_clog[sctp_cwnd_log_at].x.sb.stcb_sbcc = stcb->asoc.sb_cc;
 171         else
 172                 sctp_clog[sctp_cwnd_log_at].x.sb.stcb_sbcc = 0;
 173         sctp_clog[sctp_cwnd_log_at].x.sb.incr = incr;
 174 }
 175
 176 void
 177 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
 178 {
 179         int sctp_cwnd_log_at;
 180
 181         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 182         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 183         sctp_clog[sctp_cwnd_log_at].from = 0;
 184         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_CLOSE;
 185         sctp_clog[sctp_cwnd_log_at].x.close.inp = (void *)inp;
 186         sctp_clog[sctp_cwnd_log_at].x.close.sctp_flags = inp->sctp_flags;
 187         if (stcb) {
 188                 sctp_clog[sctp_cwnd_log_at].x.close.stcb = (void *)stcb;
 189                 sctp_clog[sctp_cwnd_log_at].x.close.state = (uint16_t) stcb->asoc.state;
 190         } else {
 191                 sctp_clog[sctp_cwnd_log_at].x.close.stcb = 0;
 192                 sctp_clog[sctp_cwnd_log_at].x.close.state = 0;
 193         }
 194         sctp_clog[sctp_cwnd_log_at].x.close.loc = loc;
 195 }
 196
 197
 198 void
 199 rto_logging(struct sctp_nets *net, int from)
 200 {
 201         int sctp_cwnd_log_at;
 202
 203         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 204         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 205         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 206         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_RTT;
 207         sctp_clog[sctp_cwnd_log_at].x.rto.net = (void *)net;
 208         sctp_clog[sctp_cwnd_log_at].x.rto.rtt = net->prev_rtt;
 209         sctp_clog[sctp_cwnd_log_at].x.rto.rttvar = net->rtt_variance;
 210         sctp_clog[sctp_cwnd_log_at].x.rto.direction = net->rto_variance_dir;
 211 }
 212
 213 void
 214 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 215 {
 216         int sctp_cwnd_log_at;
 217
 218         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 219         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 220         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 221         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_STRM;
 222         sctp_clog[sctp_cwnd_log_at].x.strlog.stcb = stcb;
 223         sctp_clog[sctp_cwnd_log_at].x.strlog.n_tsn = tsn;
 224         sctp_clog[sctp_cwnd_log_at].x.strlog.n_sseq = sseq;
 225         sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = 0;
 226         sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = 0;
 227         sctp_clog[sctp_cwnd_log_at].x.strlog.strm = stream;
 228 }
 229
 230 void
 231 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 232 {
 233         int sctp_cwnd_log_at;
 234
 235         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 236         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 237         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) action;
 238         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_NAGLE;
 239         sctp_clog[sctp_cwnd_log_at].x.nagle.stcb = (void *)stcb;
 240         sctp_clog[sctp_cwnd_log_at].x.nagle.total_flight = stcb->asoc.total_flight;
 241         sctp_clog[sctp_cwnd_log_at].x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 242         sctp_clog[sctp_cwnd_log_at].x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 243         sctp_clog[sctp_cwnd_log_at].x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 244 }
 245
 246
 247 void
 248 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 249 {
 250         int sctp_cwnd_log_at;
 251
 252         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 253         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 254         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 255         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_SACK;
 256         sctp_clog[sctp_cwnd_log_at].x.sack.cumack = cumack;
 257         sctp_clog[sctp_cwnd_log_at].x.sack.oldcumack = old_cumack;
 258         sctp_clog[sctp_cwnd_log_at].x.sack.tsn = tsn;
 259         sctp_clog[sctp_cwnd_log_at].x.sack.numGaps = gaps;
 260         sctp_clog[sctp_cwnd_log_at].x.sack.numDups = dups;
 261 }
 262
 263 void
 264 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 265 {
 266         int sctp_cwnd_log_at;
 267
 268         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 269         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 270         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 271         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MAP;
 272         sctp_clog[sctp_cwnd_log_at].x.map.base = map;
 273         sctp_clog[sctp_cwnd_log_at].x.map.cum = cum;
 274         sctp_clog[sctp_cwnd_log_at].x.map.high = high;
 275 }
 276
 277 void
 278 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn,
 279     int from)
 280 {
 281         int sctp_cwnd_log_at;
 282
 283         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 284         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 285         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 286         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_FR;
 287         sctp_clog[sctp_cwnd_log_at].x.fr.largest_tsn = biggest_tsn;
 288         sctp_clog[sctp_cwnd_log_at].x.fr.largest_new_tsn = biggest_new_tsn;
 289         sctp_clog[sctp_cwnd_log_at].x.fr.tsn = tsn;
 290 }
 291
 292
 293 void
 294 sctp_log_mb(struct mbuf *m, int from)
 295 {
 296         int sctp_cwnd_log_at;
 297
 298         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 299         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 300         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 301         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MBUF;
 302         sctp_clog[sctp_cwnd_log_at].x.mb.mp = m;
 303         sctp_clog[sctp_cwnd_log_at].x.mb.mbuf_flags = (uint8_t) (m->m_flags);
 304         sctp_clog[sctp_cwnd_log_at].x.mb.size = (uint16_t) (m->m_len);
 305         sctp_clog[sctp_cwnd_log_at].x.mb.data = m->m_data;
 306         if (m->m_flags & M_EXT) {
 307                 sctp_clog[sctp_cwnd_log_at].x.mb.ext = m->m_ext.ext_buf;
 308                 sctp_clog[sctp_cwnd_log_at].x.mb.refcnt = (uint8_t) (*m->m_ext.ref_cnt);
 309         } else {
 310                 sctp_clog[sctp_cwnd_log_at].x.mb.ext = 0;
 311                 sctp_clog[sctp_cwnd_log_at].x.mb.refcnt = 0;
 312         }
 313 }
 314
 315
 316 void
 317 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk,
 318     int from)
 319 {
 320         int sctp_cwnd_log_at;
 321
 322         if (control == NULL) {
 323                 printf("Gak log of NULL?\n");
 324                 return;
 325         }
 326         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 327         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 328         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 329         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_STRM;
 330         sctp_clog[sctp_cwnd_log_at].x.strlog.stcb = control->stcb;
 331         sctp_clog[sctp_cwnd_log_at].x.strlog.n_tsn = control->sinfo_tsn;
 332         sctp_clog[sctp_cwnd_log_at].x.strlog.n_sseq = control->sinfo_ssn;
 333         sctp_clog[sctp_cwnd_log_at].x.strlog.strm = control->sinfo_stream;
 334         if (poschk != NULL) {
 335                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = poschk->sinfo_tsn;
 336                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = poschk->sinfo_ssn;
 337         } else {
 338                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = 0;
 339                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = 0;
 340         }
 341 }
 342
 343 void
 344 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 345 {
 346         int sctp_cwnd_log_at;
 347
 348         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 349         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 350         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 351         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_CWND;
 352         sctp_clog[sctp_cwnd_log_at].x.cwnd.net = net;
 353         if (stcb->asoc.send_queue_cnt > 255)
 354                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = 255;
 355         else
 356                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 357         if (stcb->asoc.stream_queue_cnt > 255)
 358                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = 255;
 359         else
 360                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 361
 362         if (net) {
 363                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_new_value = net->cwnd;
 364                 sctp_clog[sctp_cwnd_log_at].x.cwnd.inflight = net->flight_size;
 365                 sctp_clog[sctp_cwnd_log_at].x.cwnd.pseudo_cumack = net->pseudo_cumack;
 366                 sctp_clog[sctp_cwnd_log_at].x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 367                 sctp_clog[sctp_cwnd_log_at].x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 368         }
 369         if (SCTP_CWNDLOG_PRESEND == from) {
 370                 sctp_clog[sctp_cwnd_log_at].x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 371         }
 372         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_augment = augment;
 373 }
 374
 375 void
 376 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 377 {
 378         int sctp_cwnd_log_at;
 379
 380         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 381         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 382         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 383         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_LOCK_EVENT;
 384         if (inp) {
 385                 sctp_clog[sctp_cwnd_log_at].x.lock.sock = (void *)inp->sctp_socket;
 386
 387         } else {
 388                 sctp_clog[sctp_cwnd_log_at].x.lock.sock = (void *)NULL;
 389         }
 390         sctp_clog[sctp_cwnd_log_at].x.lock.inp = (void *)inp;
 391         if (stcb) {
 392                 sctp_clog[sctp_cwnd_log_at].x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 393         } else {
 394                 sctp_clog[sctp_cwnd_log_at].x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 395         }
 396         if (inp) {
 397                 sctp_clog[sctp_cwnd_log_at].x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 398                 sctp_clog[sctp_cwnd_log_at].x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 399         } else {
 400                 sctp_clog[sctp_cwnd_log_at].x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 401                 sctp_clog[sctp_cwnd_log_at].x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 402         }
 403         sctp_clog[sctp_cwnd_log_at].x.lock.info_lock = mtx_owned(&sctppcbinfo.ipi_ep_mtx);
 404         if (inp->sctp_socket) {
 405                 sctp_clog[sctp_cwnd_log_at].x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 406                 sctp_clog[sctp_cwnd_log_at].x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 407                 sctp_clog[sctp_cwnd_log_at].x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 408         } else {
 409                 sctp_clog[sctp_cwnd_log_at].x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 410                 sctp_clog[sctp_cwnd_log_at].x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 411                 sctp_clog[sctp_cwnd_log_at].x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 412         }
 413 }
 414
 415 void
 416 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 417 {
 418         int sctp_cwnd_log_at;
 419
 420         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 421         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 422         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 423         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MAXBURST;
 424         sctp_clog[sctp_cwnd_log_at].x.cwnd.net = net;
 425         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_new_value = error;
 426         sctp_clog[sctp_cwnd_log_at].x.cwnd.inflight = net->flight_size;
 427         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_augment = burst;
 428         if (stcb->asoc.send_queue_cnt > 255)
 429                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = 255;
 430         else
 431                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 432         if (stcb->asoc.stream_queue_cnt > 255)
 433                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = 255;
 434         else
 435                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 436 }
 437
 438 void
 439 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 440 {
 441         int sctp_cwnd_log_at;
 442
 443         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 444         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 445         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 446         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_RWND;
 447         sctp_clog[sctp_cwnd_log_at].x.rwnd.rwnd = peers_rwnd;
 448         sctp_clog[sctp_cwnd_log_at].x.rwnd.send_size = snd_size;
 449         sctp_clog[sctp_cwnd_log_at].x.rwnd.overhead = overhead;
 450         sctp_clog[sctp_cwnd_log_at].x.rwnd.new_rwnd = 0;
 451 }
 452
 453 void
 454 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 455 {
 456         int sctp_cwnd_log_at;
 457
 458         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 459         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 460         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 461         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_RWND;
 462         sctp_clog[sctp_cwnd_log_at].x.rwnd.rwnd = peers_rwnd;
 463         sctp_clog[sctp_cwnd_log_at].x.rwnd.send_size = flight_size;
 464         sctp_clog[sctp_cwnd_log_at].x.rwnd.overhead = overhead;
 465         sctp_clog[sctp_cwnd_log_at].x.rwnd.new_rwnd = a_rwndval;
 466 }
 467
 468 void
 469 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 470 {
 471         int sctp_cwnd_log_at;
 472
 473         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 474         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 475         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 476         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MBCNT;
 477         sctp_clog[sctp_cwnd_log_at].x.mbcnt.total_queue_size = total_oq;
 478         sctp_clog[sctp_cwnd_log_at].x.mbcnt.size_change = book;
 479         sctp_clog[sctp_cwnd_log_at].x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 480         sctp_clog[sctp_cwnd_log_at].x.mbcnt.mbcnt_change = mbcnt;
 481 }
 482
 483 void
 484 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 485 {
 486         int sctp_cwnd_log_at;
 487
 488         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 489         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 490         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 491         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_MISC_EVENT;
 492         sctp_clog[sctp_cwnd_log_at].x.misc.log1 = a;
 493         sctp_clog[sctp_cwnd_log_at].x.misc.log2 = b;
 494         sctp_clog[sctp_cwnd_log_at].x.misc.log3 = c;
 495         sctp_clog[sctp_cwnd_log_at].x.misc.log4 = d;
 496 }
 497
 498 void
 499 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t cumtsn, uint32_t wake_cnt, int from)
 500 {
 501         int sctp_cwnd_log_at;
 502
 503         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 504         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 505         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 506         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_WAKE;
 507         sctp_clog[sctp_cwnd_log_at].x.wake.stcb = (void *)stcb;
 508         sctp_clog[sctp_cwnd_log_at].x.wake.wake_cnt = wake_cnt;
 509         sctp_clog[sctp_cwnd_log_at].x.wake.flight = stcb->asoc.total_flight_count;
 510         sctp_clog[sctp_cwnd_log_at].x.wake.send_q = stcb->asoc.send_queue_cnt;
 511         sctp_clog[sctp_cwnd_log_at].x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 512
 513         if (stcb->asoc.stream_queue_cnt < 0xff)
 514                 sctp_clog[sctp_cwnd_log_at].x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt;
 515         else
 516                 sctp_clog[sctp_cwnd_log_at].x.wake.stream_qcnt = 0xff;
 517
 518         if (stcb->asoc.chunks_on_out_queue < 0xff)
 519                 sctp_clog[sctp_cwnd_log_at].x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue;
 520         else
 521                 sctp_clog[sctp_cwnd_log_at].x.wake.chunks_on_oque = 0xff;
 522
 523         sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags = 0;
 524         /* set in the defered mode stuff */
 525         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 526                 sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags |= 1;
 527         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 528                 sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags |= 2;
 529         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 530                 sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags |= 4;
 531         /* what about the sb */
 532         if (stcb->sctp_socket) {
 533                 struct socket *so = stcb->sctp_socket;
 534
 535                 sctp_clog[sctp_cwnd_log_at].x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff));
 536         } else {
 537                 sctp_clog[sctp_cwnd_log_at].x.wake.sbflags = 0xff;
 538         }
 539 }
 540
 541 void
 542 sctp_log_block(uint8_t from, struct socket *so, struct sctp_association *asoc, int sendlen)
 543 {
 544         int sctp_cwnd_log_at;
 545
 546         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 547         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 548         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 549         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_BLOCK;
 550         sctp_clog[sctp_cwnd_log_at].x.blk.onsb = asoc->total_output_queue_size;
 551         sctp_clog[sctp_cwnd_log_at].x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt);
 552         sctp_clog[sctp_cwnd_log_at].x.blk.peer_rwnd = asoc->peers_rwnd;
 553         sctp_clog[sctp_cwnd_log_at].x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt;
 554         sctp_clog[sctp_cwnd_log_at].x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue;
 555         sctp_clog[sctp_cwnd_log_at].x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024);
 556         sctp_clog[sctp_cwnd_log_at].x.blk.sndlen = sendlen;
 557 }
 558
 559 int
 560 sctp_fill_stat_log(struct mbuf *m)
 561 {
 562         int sctp_cwnd_log_at;
 563         struct sctp_cwnd_log_req *req;
 564         size_t size_limit;
 565         int num, i, at, cnt_out = 0;
 566
 567         if (m == NULL)
 568                 return (EINVAL);
 569
 570         size_limit = (m->m_len - sizeof(struct sctp_cwnd_log_req));
 571         if (size_limit < sizeof(struct sctp_cwnd_log)) {
 572                 return (EINVAL);
 573         }
 574         sctp_cwnd_log_at = global_sctp_cwnd_log_at;
 575         req = mtod(m, struct sctp_cwnd_log_req *);
 576         num = size_limit / sizeof(struct sctp_cwnd_log);
 577         if (global_sctp_cwnd_log_rolled) {
 578                 req->num_in_log = SCTP_STAT_LOG_SIZE;
 579         } else {
 580                 req->num_in_log = sctp_cwnd_log_at;
 581                 /*
 582                  * if the log has not rolled, we don't let you have old
 583                  * data.
 584                  */
 585                 if (req->end_at > sctp_cwnd_log_at) {
 586                         req->end_at = sctp_cwnd_log_at;
 587                 }
 588         }
 589         if ((num < SCTP_STAT_LOG_SIZE) &&
 590             ((global_sctp_cwnd_log_rolled) || (sctp_cwnd_log_at > num))) {
 591                 /* we can't return all of it */
 592                 if (((req->start_at == 0) && (req->end_at == 0)) ||
 593                     (req->start_at >= SCTP_STAT_LOG_SIZE) ||
 594                     (req->end_at >= SCTP_STAT_LOG_SIZE)) {
 595                         /* No user request or user is wacked. */
 596                         req->num_ret = num;
 597                         req->end_at = sctp_cwnd_log_at - 1;
 598                         if ((sctp_cwnd_log_at - num) < 0) {
 599                                 int cc;
 600
 601                                 cc = num - sctp_cwnd_log_at;
 602                                 req->start_at = SCTP_STAT_LOG_SIZE - cc;
 603                         } else {
 604                                 req->start_at = sctp_cwnd_log_at - num;
 605                         }
 606                 } else {
 607                         /* a user request */
 608                         int cc;
 609
 610                         if (req->start_at > req->end_at) {
 611                                 cc = (SCTP_STAT_LOG_SIZE - req->start_at) +
 612                                     (req->end_at + 1);
 613                         } else {
 614
 615                                 cc = (req->end_at - req->start_at) + 1;
 616                         }
 617                         if (cc < num) {
 618                                 num = cc;
 619                         }
 620                         req->num_ret = num;
 621                 }
 622         } else {
 623                 /* We can return all  of it */
 624                 req->start_at = 0;
 625                 req->end_at = sctp_cwnd_log_at - 1;
 626                 req->num_ret = sctp_cwnd_log_at;
 627         }
 628 #ifdef INVARIENTS
 629         if (req->num_ret > num) {
 630                 panic("Bad statlog get?");
 631         }
 632 #endif
 633         for (i = 0, at = req->start_at; i < req->num_ret; i++) {
 634                 req->log[i] = sctp_clog[at];
 635                 cnt_out++;
 636                 at++;
 637                 if (at >= SCTP_STAT_LOG_SIZE)
 638                         at = 0;
 639         }
 640         m->m_len = (cnt_out * sizeof(struct sctp_cwnd_log)) + sizeof(struct sctp_cwnd_log_req);
 641         return (0);
 642 }
 643
 644 #endif
 645
 646 #ifdef SCTP_AUDITING_ENABLED
 647 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 648 static int sctp_audit_indx = 0;
 649
 650 static
 651 void
 652 sctp_print_audit_report(void)
 653 {
 654         int i;
 655         int cnt;
 656
 657         cnt = 0;
 658         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 659                 if ((sctp_audit_data[i][0] == 0xe0) &&
 660                     (sctp_audit_data[i][1] == 0x01)) {
 661                         cnt = 0;
 662                         printf("\n");
 663                 } else if (sctp_audit_data[i][0] == 0xf0) {
 664                         cnt = 0;
 665                         printf("\n");
 666                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 667                     (sctp_audit_data[i][1] == 0x01)) {
 668                         printf("\n");
 669                         cnt = 0;
 670                 }
 671                 printf("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 672                     (uint32_t) sctp_audit_data[i][1]);
 673                 cnt++;
 674                 if ((cnt % 14) == 0)
 675                         printf("\n");
 676         }
 677         for (i = 0; i < sctp_audit_indx; i++) {
 678                 if ((sctp_audit_data[i][0] == 0xe0) &&
 679                     (sctp_audit_data[i][1] == 0x01)) {
 680                         cnt = 0;
 681                         printf("\n");
 682                 } else if (sctp_audit_data[i][0] == 0xf0) {
 683                         cnt = 0;
 684                         printf("\n");
 685                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 686                     (sctp_audit_data[i][1] == 0x01)) {
 687                         printf("\n");
 688                         cnt = 0;
 689                 }
 690                 printf("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 691                     (uint32_t) sctp_audit_data[i][1]);
 692                 cnt++;
 693                 if ((cnt % 14) == 0)
 694                         printf("\n");
 695         }
 696         printf("\n");
 697 }
 698
 699 void
 700 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 701     struct sctp_nets *net)
 702 {
 703         int resend_cnt, tot_out, rep, tot_book_cnt;
 704         struct sctp_nets *lnet;
 705         struct sctp_tmit_chunk *chk;
 706
 707         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 708         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 709         sctp_audit_indx++;
 710         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 711                 sctp_audit_indx = 0;
 712         }
 713         if (inp == NULL) {
 714                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 715                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 716                 sctp_audit_indx++;
 717                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 718                         sctp_audit_indx = 0;
 719                 }
 720                 return;
 721         }
 722         if (stcb == NULL) {
 723                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 724                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 725                 sctp_audit_indx++;
 726                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 727                         sctp_audit_indx = 0;
 728                 }
 729                 return;
 730         }
 731         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 732         sctp_audit_data[sctp_audit_indx][1] =
 733             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 734         sctp_audit_indx++;
 735         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 736                 sctp_audit_indx = 0;
 737         }
 738         rep = 0;
 739         tot_book_cnt = 0;
 740         resend_cnt = tot_out = 0;
 741         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 742                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 743                         resend_cnt++;
 744                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 745                         tot_out += chk->book_size;
 746                         tot_book_cnt++;
 747                 }
 748         }
 749         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 750                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 751                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 752                 sctp_audit_indx++;
 753                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 754                         sctp_audit_indx = 0;
 755                 }
 756                 printf("resend_cnt:%d asoc-tot:%d\n",
 757                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 758                 rep = 1;
 759                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 760                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 761                 sctp_audit_data[sctp_audit_indx][1] =
 762                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 763                 sctp_audit_indx++;
 764                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 765                         sctp_audit_indx = 0;
 766                 }
 767         }
 768         if (tot_out != stcb->asoc.total_flight) {
 769                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 770                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 771                 sctp_audit_indx++;
 772                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 773                         sctp_audit_indx = 0;
 774                 }
 775                 rep = 1;
 776                 printf("tot_flt:%d asoc_tot:%d\n", tot_out,
 777                     (int)stcb->asoc.total_flight);
 778                 stcb->asoc.total_flight = tot_out;
 779         }
 780         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 781                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 782                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 783                 sctp_audit_indx++;
 784                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 785                         sctp_audit_indx = 0;
 786                 }
 787                 rep = 1;
 788                 printf("tot_flt_book:%d\n", tot_book);
 789
 790                 stcb->asoc.total_flight_count = tot_book_cnt;
 791         }
 792         tot_out = 0;
 793         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 794                 tot_out += lnet->flight_size;
 795         }
 796         if (tot_out != stcb->asoc.total_flight) {
 797                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 798                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 799                 sctp_audit_indx++;
 800                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 801                         sctp_audit_indx = 0;
 802                 }
 803                 rep = 1;
 804                 printf("real flight:%d net total was %d\n",
 805                     stcb->asoc.total_flight, tot_out);
 806                 /* now corrective action */
 807                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 808
 809                         tot_out = 0;
 810                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 811                                 if ((chk->whoTo == lnet) &&
 812                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 813                                         tot_out += chk->book_size;
 814                                 }
 815                         }
 816                         if (lnet->flight_size != tot_out) {
 817                                 printf("net:%x flight was %d corrected to %d\n",
 818                                     (uint32_t) lnet, lnet->flight_size, tot_out);
 819                                 lnet->flight_size = tot_out;
 820                         }
 821                 }
 822         }
 823         if (rep) {
 824                 sctp_print_audit_report();
 825         }
 826 }
 827
 828 void
 829 sctp_audit_log(uint8_t ev, uint8_t fd)
 830 {
 831         int s;
 832
 833         s = splnet();
 834         sctp_audit_data[sctp_audit_indx][0] = ev;
 835         sctp_audit_data[sctp_audit_indx][1] = fd;
 836         sctp_audit_indx++;
 837         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 838                 sctp_audit_indx = 0;
 839         }
 840         splx(s);
 841 }
 842
 843 #endif
 844
 845 /*
 846  * a list of sizes based on typical mtu's, used only if next hop size not
 847  * returned.
 848  */
 849 static int sctp_mtu_sizes[] = {
 850         68,
 851         296,
 852         508,
 853         512,
 854         544,
 855         576,
 856         1006,
 857         1492,
 858         1500,
 859         1536,
 860         2002,
 861         2048,
 862         4352,
 863         4464,
 864         8166,
 865         17914,
 866         32000,
 867         65535
 868 };
 869
 870 void
 871 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 872 {
 873         struct sctp_association *asoc;
 874         struct sctp_nets *net;
 875
 876         asoc = &stcb->asoc;
 877
 878         callout_stop(&asoc->hb_timer.timer);
 879         callout_stop(&asoc->dack_timer.timer);
 880         callout_stop(&asoc->strreset_timer.timer);
 881         callout_stop(&asoc->asconf_timer.timer);
 882         callout_stop(&asoc->autoclose_timer.timer);
 883         callout_stop(&asoc->delayed_event_timer.timer);
 884         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 885                 callout_stop(&net->fr_timer.timer);
 886                 callout_stop(&net->pmtu_timer.timer);
 887         }
 888 }
 889
 890 int
 891 find_next_best_mtu(int totsz)
 892 {
 893         int i, perfer;
 894
 895         /*
 896          * if we are in here we must find the next best fit based on the
 897          * size of the dg that failed to be sent.
 898          */
 899         perfer = 0;
 900         for (i = 0; i < NUMBER_OF_MTU_SIZES; i++) {
 901                 if (totsz < sctp_mtu_sizes[i]) {
 902                         perfer = i - 1;
 903                         if (perfer < 0)
 904                                 perfer = 0;
 905                         break;
 906                 }
 907         }
 908         return (sctp_mtu_sizes[perfer]);
 909 }
 910
 911 void
 912 sctp_fill_random_store(struct sctp_pcb *m)
 913 {
 914         /*
 915          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 916          * our counter. The result becomes our good random numbers and we
 917          * then setup to give these out. Note that we do no locking to
 918          * protect this. This is ok, since if competing folks call this we
 919          * will get more gobbled gook in the random store whic is what we
 920          * want. There is a danger that two guys will use the same random
 921          * numbers, but thats ok too since that is random as well :->
 922          */
 923         m->store_at = 0;
 924         sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers,
 925             sizeof(m->random_numbers), (uint8_t *) & m->random_counter,
 926             sizeof(m->random_counter), (uint8_t *) m->random_store);
 927         m->random_counter++;
 928 }
 929
 930 uint32_t
 931 sctp_select_initial_TSN(struct sctp_pcb *m)
 932 {
 933         /*
 934          * A true implementation should use random selection process to get
 935          * the initial stream sequence number, using RFC1750 as a good
 936          * guideline
 937          */
 938         u_long x, *xp;
 939         uint8_t *p;
 940
 941         if (m->initial_sequence_debug != 0) {
 942                 uint32_t ret;
 943
 944                 ret = m->initial_sequence_debug;
 945                 m->initial_sequence_debug++;
 946                 return (ret);
 947         }
 948         if ((m->store_at + sizeof(u_long)) > SCTP_SIGNATURE_SIZE) {
 949                 /* Refill the random store */
 950                 sctp_fill_random_store(m);
 951         }
 952         p = &m->random_store[(int)m->store_at];
 953         xp = (u_long *)p;
 954         x = *xp;
 955         m->store_at += sizeof(u_long);
 956         return (x);
 957 }
 958
 959 uint32_t
 960 sctp_select_a_tag(struct sctp_inpcb *m)
 961 {
 962         u_long x, not_done;
 963         struct timeval now;
 964
 965         SCTP_GETTIME_TIMEVAL(&now);
 966         not_done = 1;
 967         while (not_done) {
 968                 x = sctp_select_initial_TSN(&m->sctp_ep);
 969                 if (x == 0) {
 970                         /* we never use 0 */
 971                         continue;
 972                 }
 973                 if (sctp_is_vtag_good(m, x, &now)) {
 974                         not_done = 0;
 975                 }
 976         }
 977         return (x);
 978 }
 979
 980
 981 int
 982 sctp_init_asoc(struct sctp_inpcb *m, struct sctp_association *asoc,
 983     int for_a_init, uint32_t override_tag)
 984 {
 985         /*
 986          * Anything set to zero is taken care of by the allocation routine's
 987          * bzero
 988          */
 989
 990         /*
 991          * Up front select what scoping to apply on addresses I tell my peer
 992          * Not sure what to do with these right now, we will need to come up
 993          * with a way to set them. We may need to pass them through from the
 994          * caller in the sctp_aloc_assoc() function.
 995          */
 996         int i;
 997
 998         /* init all variables to a known value. */
 999         asoc->state = SCTP_STATE_INUSE;
1000         asoc->max_burst = m->sctp_ep.max_burst;
1001         asoc->heart_beat_delay = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
1002         asoc->cookie_life = m->sctp_ep.def_cookie_life;
1003         asoc->sctp_cmt_on_off = (uint8_t) sctp_cmt_on_off;
1004 #ifdef AF_INET
1005         asoc->default_tos = m->ip_inp.inp.inp_ip_tos;
1006 #else
1007         asoc->default_tos = 0;
1008 #endif
1009
1010 #ifdef AF_INET6
1011         asoc->default_flowlabel = ((struct in6pcb *)m)->in6p_flowinfo;
1012 #else
1013         asoc->default_flowlabel = 0;
1014 #endif
1015         if (override_tag) {
1016                 struct timeval now;
1017
1018                 if (sctp_is_vtag_good(m, override_tag, &now)) {
1019                         asoc->my_vtag = override_tag;
1020                 } else {
1021                         return (ENOMEM);
1022                 }
1023
1024         } else {
1025                 asoc->my_vtag = sctp_select_a_tag(m);
1026         }
1027         /* Get the nonce tags */
1028         asoc->my_vtag_nonce = sctp_select_a_tag(m);
1029         asoc->peer_vtag_nonce = sctp_select_a_tag(m);
1030
1031         if (sctp_is_feature_on(m, SCTP_PCB_FLAGS_DONOT_HEARTBEAT))
1032                 asoc->hb_is_disabled = 1;
1033         else
1034                 asoc->hb_is_disabled = 0;
1035
1036         asoc->refcnt = 0;
1037         asoc->assoc_up_sent = 0;
1038         asoc->assoc_id = asoc->my_vtag;
1039         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1040             sctp_select_initial_TSN(&m->sctp_ep);
1041         /* we are optimisitic here */
1042         asoc->peer_supports_pktdrop = 1;
1043
1044         asoc->sent_queue_retran_cnt = 0;
1045
1046         /* for CMT */
1047         asoc->last_net_data_came_from = NULL;
1048
1049         /* This will need to be adjusted */
1050         asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1051         asoc->last_acked_seq = asoc->init_seq_number - 1;
1052         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1053         asoc->asconf_seq_in = asoc->last_acked_seq;
1054
1055         /* here we are different, we hold the next one we expect */
1056         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1057
1058         asoc->initial_init_rto_max = m->sctp_ep.initial_init_rto_max;
1059         asoc->initial_rto = m->sctp_ep.initial_rto;
1060
1061         asoc->max_init_times = m->sctp_ep.max_init_times;
1062         asoc->max_send_times = m->sctp_ep.max_send_times;
1063         asoc->def_net_failure = m->sctp_ep.def_net_failure;
1064         asoc->free_chunk_cnt = 0;
1065
1066         asoc->iam_blocking = 0;
1067         /* ECN Nonce initialization */
1068         asoc->context = m->sctp_context;
1069         asoc->def_send = m->def_send;
1070         asoc->ecn_nonce_allowed = 0;
1071         asoc->receiver_nonce_sum = 1;
1072         asoc->nonce_sum_expect_base = 1;
1073         asoc->nonce_sum_check = 1;
1074         asoc->nonce_resync_tsn = 0;
1075         asoc->nonce_wait_for_ecne = 0;
1076         asoc->nonce_wait_tsn = 0;
1077         asoc->delayed_ack = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1078         asoc->pr_sctp_cnt = 0;
1079         asoc->total_output_queue_size = 0;
1080
1081         if (m->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1082                 struct in6pcb *inp6;
1083
1084
1085                 /* Its a V6 socket */
1086                 inp6 = (struct in6pcb *)m;
1087                 asoc->ipv6_addr_legal = 1;
1088                 /* Now look at the binding flag to see if V4 will be legal */
1089                 if (
1090                     (inp6->inp_flags & IN6P_IPV6_V6ONLY)
1091                     == 0) {
1092                         asoc->ipv4_addr_legal = 1;
1093                 } else {
1094                         /* V4 addresses are NOT legal on the association */
1095                         asoc->ipv4_addr_legal = 0;
1096                 }
1097         } else {
1098                 /* Its a V4 socket, no - V6 */
1099                 asoc->ipv4_addr_legal = 1;
1100                 asoc->ipv6_addr_legal = 0;
1101         }
1102
1103
1104         asoc->my_rwnd = max(m->sctp_socket->so_rcv.sb_hiwat, SCTP_MINIMAL_RWND);
1105         asoc->peers_rwnd = m->sctp_socket->so_rcv.sb_hiwat;
1106
1107         asoc->smallest_mtu = m->sctp_frag_point;
1108         asoc->minrto = m->sctp_ep.sctp_minrto;
1109         asoc->maxrto = m->sctp_ep.sctp_maxrto;
1110
1111         asoc->locked_on_sending = NULL;
1112         asoc->stream_locked_on = 0;
1113         asoc->ecn_echo_cnt_onq = 0;
1114         asoc->stream_locked = 0;
1115
1116         LIST_INIT(&asoc->sctp_local_addr_list);
1117         TAILQ_INIT(&asoc->nets);
1118         TAILQ_INIT(&asoc->pending_reply_queue);
1119         asoc->last_asconf_ack_sent = NULL;
1120         /* Setup to fill the hb random cache at first HB */
1121         asoc->hb_random_idx = 4;
1122
1123         asoc->sctp_autoclose_ticks = m->sctp_ep.auto_close_time;
1124
1125         /*
1126          * Now the stream parameters, here we allocate space for all streams
1127          * that we request by default.
1128          */
1129         asoc->streamoutcnt = asoc->pre_open_streams =
1130             m->sctp_ep.pre_open_stream_count;
1131         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1132             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1133             "StreamsOut");
1134         if (asoc->strmout == NULL) {
1135                 /* big trouble no memory */
1136                 return (ENOMEM);
1137         }
1138         for (i = 0; i < asoc->streamoutcnt; i++) {
1139                 /*
1140                  * inbound side must be set to 0xffff, also NOTE when we get
1141                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1142                  * count (streamoutcnt) but first check if we sent to any of
1143                  * the upper streams that were dropped (if some were). Those
1144                  * that were dropped must be notified to the upper layer as
1145                  * failed to send.
1146                  */
1147                 asoc->strmout[i].next_sequence_sent = 0x0;
1148                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1149                 asoc->strmout[i].stream_no = i;
1150                 asoc->strmout[i].last_msg_incomplete = 0;
1151                 asoc->strmout[i].next_spoke.tqe_next = 0;
1152                 asoc->strmout[i].next_spoke.tqe_prev = 0;
1153         }
1154         /* Now the mapping array */
1155         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1156         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1157             "MappingArray");
1158         if (asoc->mapping_array == NULL) {
1159                 SCTP_FREE(asoc->strmout);
1160                 return (ENOMEM);
1161         }
1162         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1163         /* Now the init of the other outqueues */
1164         TAILQ_INIT(&asoc->free_chunks);
1165         TAILQ_INIT(&asoc->free_strmoq);
1166         TAILQ_INIT(&asoc->out_wheel);
1167         TAILQ_INIT(&asoc->control_send_queue);
1168         TAILQ_INIT(&asoc->send_queue);
1169         TAILQ_INIT(&asoc->sent_queue);
1170         TAILQ_INIT(&asoc->reasmqueue);
1171         TAILQ_INIT(&asoc->resetHead);
1172         asoc->max_inbound_streams = m->sctp_ep.max_open_streams_intome;
1173         TAILQ_INIT(&asoc->asconf_queue);
1174         /* authentication fields */
1175         asoc->authinfo.random = NULL;
1176         asoc->authinfo.assoc_key = NULL;
1177         asoc->authinfo.assoc_keyid = 0;
1178         asoc->authinfo.recv_key = NULL;
1179         asoc->authinfo.recv_keyid = 0;
1180         LIST_INIT(&asoc->shared_keys);
1181
1182         return (0);
1183 }
1184
1185 int
1186 sctp_expand_mapping_array(struct sctp_association *asoc)
1187 {
1188         /* mapping array needs to grow */
1189         uint8_t *new_array;
1190         uint16_t new_size;
1191
1192         new_size = asoc->mapping_array_size + SCTP_MAPPING_ARRAY_INCR;
1193         SCTP_MALLOC(new_array, uint8_t *, new_size, "MappingArray");
1194         if (new_array == NULL) {
1195                 /* can't get more, forget it */
1196                 printf("No memory for expansion of SCTP mapping array %d\n",
1197                     new_size);
1198                 return (-1);
1199         }
1200         memset(new_array, 0, new_size);
1201         memcpy(new_array, asoc->mapping_array, asoc->mapping_array_size);
1202         SCTP_FREE(asoc->mapping_array);
1203         asoc->mapping_array = new_array;
1204         asoc->mapping_array_size = new_size;
1205         return (0);
1206 }
1207
1208 extern unsigned int sctp_early_fr_msec;
1209
1210 static void
1211 sctp_handle_addr_wq(void)
1212 {
1213         /* deal with the ADDR wq from the rtsock calls */
1214         struct sctp_laddr *wi;
1215
1216         SCTP_IPI_ADDR_LOCK();
1217         wi = LIST_FIRST(&sctppcbinfo.addr_wq);
1218         if (wi == NULL) {
1219                 SCTP_IPI_ADDR_UNLOCK();
1220                 return;
1221         }
1222         LIST_REMOVE(wi, sctp_nxt_addr);
1223         if (!LIST_EMPTY(&sctppcbinfo.addr_wq)) {
1224                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1225                     (struct sctp_inpcb *)NULL,
1226                     (struct sctp_tcb *)NULL,
1227                     (struct sctp_nets *)NULL);
1228         }
1229         SCTP_IPI_ADDR_UNLOCK();
1230         if (wi->action == RTM_ADD) {
1231                 sctp_add_ip_address(wi->ifa);
1232         } else if (wi->action == RTM_DELETE) {
1233                 sctp_delete_ip_address(wi->ifa);
1234         }
1235         IFAFREE(wi->ifa);
1236         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, wi);
1237         SCTP_DECR_LADDR_COUNT();
1238 }
1239
1240 void
1241 sctp_timeout_handler(void *t)
1242 {
1243         struct sctp_inpcb *inp;
1244         struct sctp_tcb *stcb;
1245         struct sctp_nets *net;
1246         struct sctp_timer *tmr;
1247         int s, did_output;
1248         struct sctp_iterator *it = NULL;
1249
1250
1251         s = splnet();
1252         tmr = (struct sctp_timer *)t;
1253         inp = (struct sctp_inpcb *)tmr->ep;
1254         stcb = (struct sctp_tcb *)tmr->tcb;
1255         net = (struct sctp_nets *)tmr->net;
1256         did_output = 1;
1257
1258 #ifdef SCTP_AUDITING_ENABLED
1259         sctp_audit_log(0xF0, (uint8_t) tmr->type);
1260         sctp_auditing(3, inp, stcb, net);
1261 #endif
1262
1263         /* sanity checks... */
1264         if (tmr->self != (void *)tmr) {
1265                 /*
1266                  * printf("Stale SCTP timer fired (%p), ignoring...\n",
1267                  * tmr);
1268                  */
1269                 splx(s);
1270                 return;
1271         }
1272         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1273                 /*
1274                  * printf("SCTP timer fired with invalid type: 0x%x\n",
1275                  * tmr->type);
1276                  */
1277                 splx(s);
1278                 return;
1279         }
1280         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1281                 splx(s);
1282                 return;
1283         }
1284         /* if this is an iterator timeout, get the struct and clear inp */
1285         if (tmr->type == SCTP_TIMER_TYPE_ITERATOR) {
1286                 it = (struct sctp_iterator *)inp;
1287                 inp = NULL;
1288         }
1289         if (inp) {
1290                 SCTP_INP_INCR_REF(inp);
1291                 if ((inp->sctp_socket == 0) &&
1292                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1293                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1294                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1295                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1296                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))
1297                     ) {
1298                         splx(s);
1299                         SCTP_INP_DECR_REF(inp);
1300                         return;
1301                 }
1302         }
1303         if (stcb) {
1304                 if (stcb->asoc.state == 0) {
1305                         splx(s);
1306                         if (inp) {
1307                                 SCTP_INP_DECR_REF(inp);
1308                         }
1309                         return;
1310                 }
1311         }
1312 #ifdef SCTP_DEBUG
1313         if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1314                 printf("Timer type %d goes off\n", tmr->type);
1315         }
1316 #endif                          /* SCTP_DEBUG */
1317         if (!callout_active(&tmr->timer)) {
1318                 splx(s);
1319                 if (inp) {
1320                         SCTP_INP_DECR_REF(inp);
1321                 }
1322                 return;
1323         }
1324         if (stcb) {
1325                 atomic_add_int(&stcb->asoc.refcnt, 1);
1326                 SCTP_TCB_LOCK(stcb);
1327                 atomic_add_int(&stcb->asoc.refcnt, -1);
1328         }
1329         /* mark as being serviced now */
1330         callout_deactivate(&tmr->timer);
1331
1332         /* call the handler for the appropriate timer type */
1333         switch (tmr->type) {
1334         case SCTP_TIMER_TYPE_ADDR_WQ:
1335                 sctp_handle_addr_wq();
1336                 break;
1337         case SCTP_TIMER_TYPE_ITERATOR:
1338                 SCTP_STAT_INCR(sctps_timoiterator);
1339                 sctp_iterator_timer(it);
1340                 break;
1341         case SCTP_TIMER_TYPE_SEND:
1342                 SCTP_STAT_INCR(sctps_timodata);
1343                 stcb->asoc.num_send_timers_up--;
1344                 if (stcb->asoc.num_send_timers_up < 0) {
1345                         stcb->asoc.num_send_timers_up = 0;
1346                 }
1347                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1348                         /* no need to unlock on tcb its gone */
1349
1350                         goto out_decr;
1351                 }
1352 #ifdef SCTP_AUDITING_ENABLED
1353                 sctp_auditing(4, inp, stcb, net);
1354 #endif
1355                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3);
1356                 if ((stcb->asoc.num_send_timers_up == 0) &&
1357                     (stcb->asoc.sent_queue_cnt > 0)
1358                     ) {
1359                         struct sctp_tmit_chunk *chk;
1360
1361                         /*
1362                          * safeguard. If there on some on the sent queue
1363                          * somewhere but no timers running something is
1364                          * wrong... so we start a timer on the first chunk
1365                          * on the send queue on whatever net it is sent to.
1366                          */
1367                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1368                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1369                             chk->whoTo);
1370                 }
1371                 break;
1372         case SCTP_TIMER_TYPE_INIT:
1373                 SCTP_STAT_INCR(sctps_timoinit);
1374                 if (sctp_t1init_timer(inp, stcb, net)) {
1375                         /* no need to unlock on tcb its gone */
1376                         goto out_decr;
1377                 }
1378                 /* We do output but not here */
1379                 did_output = 0;
1380                 break;
1381         case SCTP_TIMER_TYPE_RECV:
1382                 SCTP_STAT_INCR(sctps_timosack);
1383                 sctp_send_sack(stcb);
1384 #ifdef SCTP_AUDITING_ENABLED
1385                 sctp_auditing(4, inp, stcb, net);
1386 #endif
1387                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR);
1388                 break;
1389         case SCTP_TIMER_TYPE_SHUTDOWN:
1390                 if (sctp_shutdown_timer(inp, stcb, net)) {
1391                         /* no need to unlock on tcb its gone */
1392                         goto out_decr;
1393                 }
1394                 SCTP_STAT_INCR(sctps_timoshutdown);
1395 #ifdef SCTP_AUDITING_ENABLED
1396                 sctp_auditing(4, inp, stcb, net);
1397 #endif
1398                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR);
1399                 break;
1400         case SCTP_TIMER_TYPE_HEARTBEAT:
1401                 {
1402                         struct sctp_nets *net;
1403                         int cnt_of_unconf = 0;
1404
1405                         SCTP_STAT_INCR(sctps_timoheartbeat);
1406                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1407                                 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1408                                     (net->dest_state & SCTP_ADDR_REACHABLE)) {
1409                                         cnt_of_unconf++;
1410                                 }
1411                         }
1412                         if (cnt_of_unconf == 0) {
1413                                 if (sctp_heartbeat_timer(inp, stcb, net, cnt_of_unconf)) {
1414                                         /* no need to unlock on tcb its gone */
1415                                         goto out_decr;
1416                                 }
1417                         }
1418 #ifdef SCTP_AUDITING_ENABLED
1419                         sctp_auditing(4, inp, stcb, net);
1420 #endif
1421                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
1422                             stcb, net);
1423                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR);
1424                 }
1425                 break;
1426         case SCTP_TIMER_TYPE_COOKIE:
1427                 if (sctp_cookie_timer(inp, stcb, net)) {
1428                         /* no need to unlock on tcb its gone */
1429                         goto out_decr;
1430                 }
1431                 SCTP_STAT_INCR(sctps_timocookie);
1432 #ifdef SCTP_AUDITING_ENABLED
1433                 sctp_auditing(4, inp, stcb, net);
1434 #endif
1435                 /*
1436                  * We consider T3 and Cookie timer pretty much the same with
1437                  * respect to where from in chunk_output.
1438                  */
1439                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3);
1440                 break;
1441         case SCTP_TIMER_TYPE_NEWCOOKIE:
1442                 {
1443                         struct timeval tv;
1444                         int i, secret;
1445
1446                         SCTP_STAT_INCR(sctps_timosecret);
1447                         SCTP_GETTIME_TIMEVAL(&tv);
1448                         SCTP_INP_WLOCK(inp);
1449                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1450                         inp->sctp_ep.last_secret_number =
1451                             inp->sctp_ep.current_secret_number;
1452                         inp->sctp_ep.current_secret_number++;
1453                         if (inp->sctp_ep.current_secret_number >=
1454                             SCTP_HOW_MANY_SECRETS) {
1455                                 inp->sctp_ep.current_secret_number = 0;
1456                         }
1457                         secret = (int)inp->sctp_ep.current_secret_number;
1458                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1459                                 inp->sctp_ep.secret_key[secret][i] =
1460                                     sctp_select_initial_TSN(&inp->sctp_ep);
1461                         }
1462                         SCTP_INP_WUNLOCK(inp);
1463                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1464                 }
1465                 did_output = 0;
1466                 break;
1467         case SCTP_TIMER_TYPE_PATHMTURAISE:
1468                 SCTP_STAT_INCR(sctps_timopathmtu);
1469                 sctp_pathmtu_timer(inp, stcb, net);
1470                 did_output = 0;
1471                 break;
1472         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1473                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1474                         /* no need to unlock on tcb its gone */
1475                         goto out_decr;
1476                 }
1477                 SCTP_STAT_INCR(sctps_timoshutdownack);
1478 #ifdef SCTP_AUDITING_ENABLED
1479                 sctp_auditing(4, inp, stcb, net);
1480 #endif
1481                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR);
1482                 break;
1483         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1484                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1485                 sctp_abort_an_association(inp, stcb,
1486                     SCTP_SHUTDOWN_GUARD_EXPIRES, NULL);
1487                 /* no need to unlock on tcb its gone */
1488                 goto out_decr;
1489                 break;
1490
1491         case SCTP_TIMER_TYPE_STRRESET:
1492                 if (sctp_strreset_timer(inp, stcb, net)) {
1493                         /* no need to unlock on tcb its gone */
1494                         goto out_decr;
1495                 }
1496                 SCTP_STAT_INCR(sctps_timostrmrst);
1497                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR);
1498                 break;
1499         case SCTP_TIMER_TYPE_EARLYFR:
1500                 /* Need to do FR of things for net */
1501                 SCTP_STAT_INCR(sctps_timoearlyfr);
1502                 sctp_early_fr_timer(inp, stcb, net);
1503                 break;
1504         case SCTP_TIMER_TYPE_ASCONF:
1505                 if (sctp_asconf_timer(inp, stcb, net)) {
1506                         /* no need to unlock on tcb its gone */
1507                         goto out_decr;
1508                 }
1509                 SCTP_STAT_INCR(sctps_timoasconf);
1510 #ifdef SCTP_AUDITING_ENABLED
1511                 sctp_auditing(4, inp, stcb, net);
1512 #endif
1513                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR);
1514                 break;
1515
1516         case SCTP_TIMER_TYPE_AUTOCLOSE:
1517                 SCTP_STAT_INCR(sctps_timoautoclose);
1518                 sctp_autoclose_timer(inp, stcb, net);
1519                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR);
1520                 did_output = 0;
1521                 break;
1522         case SCTP_TIMER_TYPE_ASOCKILL:
1523                 SCTP_STAT_INCR(sctps_timoassockill);
1524                 /* Can we free it yet? */
1525                 SCTP_INP_DECR_REF(inp);
1526                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
1527                 sctp_free_assoc(inp, stcb, 0);
1528                 /*
1529                  * free asoc, always unlocks (or destroy's) so prevent
1530                  * duplicate unlock or unlock of a free mtx :-0
1531                  */
1532                 stcb = NULL;
1533                 goto out_no_decr;
1534                 break;
1535         case SCTP_TIMER_TYPE_INPKILL:
1536                 SCTP_STAT_INCR(sctps_timoinpkill);
1537                 /*
1538                  * special case, take away our increment since WE are the
1539                  * killer
1540                  */
1541                 SCTP_INP_DECR_REF(inp);
1542                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
1543                 sctp_inpcb_free(inp, 1, 0);
1544                 goto out_no_decr;
1545                 break;
1546         default:
1547 #ifdef SCTP_DEBUG
1548                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1549                         printf("sctp_timeout_handler:unknown timer %d\n",
1550                             tmr->type);
1551                 }
1552 #endif                          /* SCTP_DEBUG */
1553                 break;
1554         };
1555 #ifdef SCTP_AUDITING_ENABLED
1556         sctp_audit_log(0xF1, (uint8_t) tmr->type);
1557         if (inp)
1558                 sctp_auditing(5, inp, stcb, net);
1559 #endif
1560         if ((did_output) && stcb) {
1561                 /*
1562                  * Now we need to clean up the control chunk chain if an
1563                  * ECNE is on it. It must be marked as UNSENT again so next
1564                  * call will continue to send it until such time that we get
1565                  * a CWR, to remove it. It is, however, less likely that we
1566                  * will find a ecn echo on the chain though.
1567                  */
1568                 sctp_fix_ecn_echo(&stcb->asoc);
1569         }
1570         if (stcb) {
1571                 SCTP_TCB_UNLOCK(stcb);
1572         }
1573 out_decr:
1574         if (inp) {
1575                 SCTP_INP_DECR_REF(inp);
1576         }
1577 out_no_decr:
1578
1579 #ifdef SCTP_DEBUG
1580         if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1581                 printf("Timer now complete (type %d)\n", tmr->type);
1582         }
1583 #endif                          /* SCTP_DEBUG */
1584         splx(s);
1585         if (inp) {
1586         }
1587 }
1588
1589 int
1590 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1591     struct sctp_nets *net)
1592 {
1593         int to_ticks;
1594         struct sctp_timer *tmr;
1595
1596
1597         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
1598             (inp == NULL))
1599                 return (EFAULT);
1600
1601         to_ticks = 0;
1602
1603         tmr = NULL;
1604         if (stcb) {
1605                 SCTP_TCB_LOCK_ASSERT(stcb);
1606         }
1607         switch (t_type) {
1608         case SCTP_TIMER_TYPE_ADDR_WQ:
1609                 /* Only 1 tick away :-) */
1610                 tmr = &sctppcbinfo.addr_wq_timer;
1611                 to_ticks = 1;
1612                 break;
1613         case SCTP_TIMER_TYPE_ITERATOR:
1614                 {
1615                         struct sctp_iterator *it;
1616
1617                         it = (struct sctp_iterator *)inp;
1618                         tmr = &it->tmr;
1619                         to_ticks = SCTP_ITERATOR_TICKS;
1620                 }
1621                 break;
1622         case SCTP_TIMER_TYPE_SEND:
1623                 /* Here we use the RTO timer */
1624                 {
1625                         int rto_val;
1626
1627                         if ((stcb == NULL) || (net == NULL)) {
1628                                 return (EFAULT);
1629                         }
1630                         tmr = &net->rxt_timer;
1631                         if (net->RTO == 0) {
1632                                 rto_val = stcb->asoc.initial_rto;
1633                         } else {
1634                                 rto_val = net->RTO;
1635                         }
1636                         to_ticks = MSEC_TO_TICKS(rto_val);
1637                 }
1638                 break;
1639         case SCTP_TIMER_TYPE_INIT:
1640                 /*
1641                  * Here we use the INIT timer default usually about 1
1642                  * minute.
1643                  */
1644                 if ((stcb == NULL) || (net == NULL)) {
1645                         return (EFAULT);
1646                 }
1647                 tmr = &net->rxt_timer;
1648                 if (net->RTO == 0) {
1649                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1650                 } else {
1651                         to_ticks = MSEC_TO_TICKS(net->RTO);
1652                 }
1653                 break;
1654         case SCTP_TIMER_TYPE_RECV:
1655                 /*
1656                  * Here we use the Delayed-Ack timer value from the inp
1657                  * ususually about 200ms.
1658                  */
1659                 if (stcb == NULL) {
1660                         return (EFAULT);
1661                 }
1662                 tmr = &stcb->asoc.dack_timer;
1663                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
1664                 break;
1665         case SCTP_TIMER_TYPE_SHUTDOWN:
1666                 /* Here we use the RTO of the destination. */
1667                 if ((stcb == NULL) || (net == NULL)) {
1668                         return (EFAULT);
1669                 }
1670                 if (net->RTO == 0) {
1671                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1672                 } else {
1673                         to_ticks = MSEC_TO_TICKS(net->RTO);
1674                 }
1675                 tmr = &net->rxt_timer;
1676                 break;
1677         case SCTP_TIMER_TYPE_HEARTBEAT:
1678                 /*
1679                  * the net is used here so that we can add in the RTO. Even
1680                  * though we use a different timer. We also add the HB timer
1681                  * PLUS a random jitter.
1682                  */
1683                 if (stcb == NULL) {
1684                         return (EFAULT);
1685                 } {
1686                         uint32_t rndval;
1687                         uint8_t this_random;
1688                         int cnt_of_unconf = 0;
1689                         struct sctp_nets *lnet;
1690
1691                         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
1692                                 if ((lnet->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1693                                     (lnet->dest_state & SCTP_ADDR_REACHABLE)) {
1694                                         cnt_of_unconf++;
1695                                 }
1696                         }
1697                         if (cnt_of_unconf) {
1698                                 lnet = NULL;
1699                                 sctp_heartbeat_timer(inp, stcb, lnet, cnt_of_unconf);
1700                         }
1701                         if (stcb->asoc.hb_random_idx > 3) {
1702                                 rndval = sctp_select_initial_TSN(&inp->sctp_ep);
1703                                 memcpy(stcb->asoc.hb_random_values, &rndval,
1704                                     sizeof(stcb->asoc.hb_random_values));
1705                                 this_random = stcb->asoc.hb_random_values[0];
1706                                 stcb->asoc.hb_random_idx = 0;
1707                                 stcb->asoc.hb_ect_randombit = 0;
1708                         } else {
1709                                 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
1710                                 stcb->asoc.hb_random_idx++;
1711                                 stcb->asoc.hb_ect_randombit = 0;
1712                         }
1713                         /*
1714                          * this_random will be 0 - 256 ms RTO is in ms.
1715                          */
1716                         if ((stcb->asoc.hb_is_disabled) &&
1717                             (cnt_of_unconf == 0)) {
1718                                 return (0);
1719                         }
1720                         if (net) {
1721                                 struct sctp_nets *lnet;
1722                                 int delay;
1723
1724                                 delay = stcb->asoc.heart_beat_delay;
1725                                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
1726                                         if ((lnet->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1727                                             ((lnet->dest_state & SCTP_ADDR_OUT_OF_SCOPE) == 0) &&
1728                                             (lnet->dest_state & SCTP_ADDR_REACHABLE)) {
1729                                                 delay = 0;
1730                                         }
1731                                 }
1732                                 if (net->RTO == 0) {
1733                                         /* Never been checked */
1734                                         to_ticks = this_random + stcb->asoc.initial_rto + delay;
1735                                 } else {
1736                                         /* set rto_val to the ms */
1737                                         to_ticks = delay + net->RTO + this_random;
1738                                 }
1739                         } else {
1740                                 if (cnt_of_unconf) {
1741                                         to_ticks = this_random + stcb->asoc.initial_rto;
1742                                 } else {
1743                                         to_ticks = stcb->asoc.heart_beat_delay + this_random + stcb->asoc.initial_rto;
1744                                 }
1745                         }
1746                         /*
1747                          * Now we must convert the to_ticks that are now in
1748                          * ms to ticks.
1749                          */
1750                         to_ticks = MSEC_TO_TICKS(to_ticks);
1751                         tmr = &stcb->asoc.hb_timer;
1752                 }
1753                 break;
1754         case SCTP_TIMER_TYPE_COOKIE:
1755                 /*
1756                  * Here we can use the RTO timer from the network since one
1757                  * RTT was compelete. If a retran happened then we will be
1758                  * using the RTO initial value.
1759                  */
1760                 if ((stcb == NULL) || (net == NULL)) {
1761                         return (EFAULT);
1762                 }
1763                 if (net->RTO == 0) {
1764                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1765                 } else {
1766                         to_ticks = MSEC_TO_TICKS(net->RTO);
1767                 }
1768                 tmr = &net->rxt_timer;
1769                 break;
1770         case SCTP_TIMER_TYPE_NEWCOOKIE:
1771                 /*
1772                  * nothing needed but the endpoint here ususually about 60
1773                  * minutes.
1774                  */
1775                 tmr = &inp->sctp_ep.signature_change;
1776                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
1777                 break;
1778         case SCTP_TIMER_TYPE_ASOCKILL:
1779                 if (stcb == NULL) {
1780                         return (EFAULT);
1781                 }
1782                 tmr = &stcb->asoc.strreset_timer;
1783                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
1784                 break;
1785         case SCTP_TIMER_TYPE_INPKILL:
1786                 /*
1787                  * The inp is setup to die. We re-use the signature_chage
1788                  * timer since that has stopped and we are in the GONE
1789                  * state.
1790                  */
1791                 tmr = &inp->sctp_ep.signature_change;
1792                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
1793                 break;
1794         case SCTP_TIMER_TYPE_PATHMTURAISE:
1795                 /*
1796                  * Here we use the value found in the EP for PMTU ususually
1797                  * about 10 minutes.
1798                  */
1799                 if (stcb == NULL) {
1800                         return (EFAULT);
1801                 }
1802                 if (net == NULL) {
1803                         return (EFAULT);
1804                 }
1805                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
1806                 tmr = &net->pmtu_timer;
1807                 break;
1808         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1809                 /* Here we use the RTO of the destination */
1810                 if ((stcb == NULL) || (net == NULL)) {
1811                         return (EFAULT);
1812                 }
1813                 if (net->RTO == 0) {
1814                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1815                 } else {
1816                         to_ticks = MSEC_TO_TICKS(net->RTO);
1817                 }
1818                 tmr = &net->rxt_timer;
1819                 break;
1820         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1821                 /*
1822                  * Here we use the endpoints shutdown guard timer usually
1823                  * about 3 minutes.
1824                  */
1825                 if (stcb == NULL) {
1826                         return (EFAULT);
1827                 }
1828                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
1829                 tmr = &stcb->asoc.shut_guard_timer;
1830                 break;
1831         case SCTP_TIMER_TYPE_STRRESET:
1832                 /*
1833                  * Here the timer comes from the inp but its value is from
1834                  * the RTO.
1835                  */
1836                 if ((stcb == NULL) || (net == NULL)) {
1837                         return (EFAULT);
1838                 }
1839                 if (net->RTO == 0) {
1840                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1841                 } else {
1842                         to_ticks = MSEC_TO_TICKS(net->RTO);
1843                 }
1844                 tmr = &stcb->asoc.strreset_timer;
1845                 break;
1846
1847         case SCTP_TIMER_TYPE_EARLYFR:
1848                 {
1849                         unsigned int msec;
1850
1851                         if ((stcb == NULL) || (net == NULL)) {
1852                                 return (EFAULT);
1853                         }
1854                         if (net->flight_size > net->cwnd) {
1855                                 /* no need to start */
1856                                 return (0);
1857                         }
1858                         SCTP_STAT_INCR(sctps_earlyfrstart);
1859                         if (net->lastsa == 0) {
1860                                 /* Hmm no rtt estimate yet? */
1861                                 msec = stcb->asoc.initial_rto >> 2;
1862                         } else {
1863                                 msec = ((net->lastsa >> 2) + net->lastsv) >> 1;
1864                         }
1865                         if (msec < sctp_early_fr_msec) {
1866                                 msec = sctp_early_fr_msec;
1867                                 if (msec < SCTP_MINFR_MSEC_FLOOR) {
1868                                         msec = SCTP_MINFR_MSEC_FLOOR;
1869                                 }
1870                         }
1871                         to_ticks = MSEC_TO_TICKS(msec);
1872                         tmr = &net->fr_timer;
1873                 }
1874                 break;
1875         case SCTP_TIMER_TYPE_ASCONF:
1876                 /*
1877                  * Here the timer comes from the inp but its value is from
1878                  * the RTO.
1879                  */
1880                 if ((stcb == NULL) || (net == NULL)) {
1881                         return (EFAULT);
1882                 }
1883                 if (net->RTO == 0) {
1884                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1885                 } else {
1886                         to_ticks = MSEC_TO_TICKS(net->RTO);
1887                 }
1888                 tmr = &stcb->asoc.asconf_timer;
1889                 break;
1890         case SCTP_TIMER_TYPE_AUTOCLOSE:
1891                 if (stcb == NULL) {
1892                         return (EFAULT);
1893                 }
1894                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
1895                         /*
1896                          * Really an error since stcb is NOT set to
1897                          * autoclose
1898                          */
1899                         return (0);
1900                 }
1901                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
1902                 tmr = &stcb->asoc.autoclose_timer;
1903                 break;
1904         default:
1905 #ifdef SCTP_DEBUG
1906                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1907                         printf("sctp_timer_start:Unknown timer type %d\n",
1908                             t_type);
1909                 }
1910 #endif                          /* SCTP_DEBUG */
1911                 return (EFAULT);
1912                 break;
1913         };
1914         if ((to_ticks <= 0) || (tmr == NULL)) {
1915 #ifdef SCTP_DEBUG
1916                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1917                         printf("sctp_timer_start:%d:software error to_ticks:%d tmr:%p not set ??\n",
1918                             t_type, to_ticks, tmr);
1919                 }
1920 #endif                          /* SCTP_DEBUG */
1921                 return (EFAULT);
1922         }
1923         if (callout_pending(&tmr->timer)) {
1924                 /*
1925                  * we do NOT allow you to have it already running. if it is
1926                  * we leave the current one up unchanged
1927                  */
1928                 return (EALREADY);
1929         }
1930         /* At this point we can proceed */
1931         if (t_type == SCTP_TIMER_TYPE_SEND) {
1932                 stcb->asoc.num_send_timers_up++;
1933         }
1934         tmr->type = t_type;
1935         tmr->ep = (void *)inp;
1936         tmr->tcb = (void *)stcb;
1937         tmr->net = (void *)net;
1938         tmr->self = (void *)tmr;
1939         tmr->ticks = ticks;
1940         callout_reset(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
1941         return (0);
1942 }
1943
1944 int
1945 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1946     struct sctp_nets *net)
1947 {
1948         struct sctp_timer *tmr;
1949
1950         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
1951             (inp == NULL))
1952                 return (EFAULT);
1953
1954         tmr = NULL;
1955         if (stcb) {
1956                 SCTP_TCB_LOCK_ASSERT(stcb);
1957         }
1958         switch (t_type) {
1959         case SCTP_TIMER_TYPE_ADDR_WQ:
1960                 tmr = &sctppcbinfo.addr_wq_timer;
1961                 break;
1962         case SCTP_TIMER_TYPE_EARLYFR:
1963                 if ((stcb == NULL) || (net == NULL)) {
1964                         return (EFAULT);
1965                 }
1966                 tmr = &net->fr_timer;
1967                 SCTP_STAT_INCR(sctps_earlyfrstop);
1968                 break;
1969         case SCTP_TIMER_TYPE_ITERATOR:
1970                 {
1971                         struct sctp_iterator *it;
1972
1973                         it = (struct sctp_iterator *)inp;
1974                         tmr = &it->tmr;
1975                 }
1976                 break;
1977         case SCTP_TIMER_TYPE_SEND:
1978                 if ((stcb == NULL) || (net == NULL)) {
1979                         return (EFAULT);
1980                 }
1981                 tmr = &net->rxt_timer;
1982                 break;
1983         case SCTP_TIMER_TYPE_INIT:
1984                 if ((stcb == NULL) || (net == NULL)) {
1985                         return (EFAULT);
1986                 }
1987                 tmr = &net->rxt_timer;
1988                 break;
1989         case SCTP_TIMER_TYPE_RECV:
1990                 if (stcb == NULL) {
1991                         return (EFAULT);
1992                 }
1993                 tmr = &stcb->asoc.dack_timer;
1994                 break;
1995         case SCTP_TIMER_TYPE_SHUTDOWN:
1996                 if ((stcb == NULL) || (net == NULL)) {
1997                         return (EFAULT);
1998                 }
1999                 tmr = &net->rxt_timer;
2000                 break;
2001         case SCTP_TIMER_TYPE_HEARTBEAT:
2002                 if (stcb == NULL) {
2003                         return (EFAULT);
2004                 }
2005                 tmr = &stcb->asoc.hb_timer;
2006                 break;
2007         case SCTP_TIMER_TYPE_COOKIE:
2008                 if ((stcb == NULL) || (net == NULL)) {
2009                         return (EFAULT);
2010                 }
2011                 tmr = &net->rxt_timer;
2012                 break;
2013         case SCTP_TIMER_TYPE_NEWCOOKIE:
2014                 /* nothing needed but the endpoint here */
2015                 tmr = &inp->sctp_ep.signature_change;
2016                 /*
2017                  * We re-use the newcookie timer for the INP kill timer. We
2018                  * must assure that we do not kill it by accident.
2019                  */
2020                 break;
2021         case SCTP_TIMER_TYPE_ASOCKILL:
2022                 /*
2023                  * Stop the asoc kill timer.
2024                  */
2025                 if (stcb == NULL) {
2026                         return (EFAULT);
2027                 }
2028                 tmr = &stcb->asoc.strreset_timer;
2029                 break;
2030
2031         case SCTP_TIMER_TYPE_INPKILL:
2032                 /*
2033                  * The inp is setup to die. We re-use the signature_chage
2034                  * timer since that has stopped and we are in the GONE
2035                  * state.
2036                  */
2037                 tmr = &inp->sctp_ep.signature_change;
2038                 break;
2039         case SCTP_TIMER_TYPE_PATHMTURAISE:
2040                 if ((stcb == NULL) || (net == NULL)) {
2041                         return (EFAULT);
2042                 }
2043                 tmr = &net->pmtu_timer;
2044                 break;
2045         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2046                 if ((stcb == NULL) || (net == NULL)) {
2047                         return (EFAULT);
2048                 }
2049                 tmr = &net->rxt_timer;
2050                 break;
2051         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2052                 if (stcb == NULL) {
2053                         return (EFAULT);
2054                 }
2055                 tmr = &stcb->asoc.shut_guard_timer;
2056                 break;
2057         case SCTP_TIMER_TYPE_STRRESET:
2058                 if (stcb == NULL) {
2059                         return (EFAULT);
2060                 }
2061                 tmr = &stcb->asoc.strreset_timer;
2062                 break;
2063         case SCTP_TIMER_TYPE_ASCONF:
2064                 if (stcb == NULL) {
2065                         return (EFAULT);
2066                 }
2067                 tmr = &stcb->asoc.asconf_timer;
2068                 break;
2069         case SCTP_TIMER_TYPE_AUTOCLOSE:
2070                 if (stcb == NULL) {
2071                         return (EFAULT);
2072                 }
2073                 tmr = &stcb->asoc.autoclose_timer;
2074                 break;
2075         default:
2076 #ifdef SCTP_DEBUG
2077                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
2078                         printf("sctp_timer_stop:Unknown timer type %d\n",
2079                             t_type);
2080                 }
2081 #endif                          /* SCTP_DEBUG */
2082                 break;
2083         };
2084         if (tmr == NULL) {
2085                 return (EFAULT);
2086         }
2087         if ((tmr->type != t_type) && tmr->type) {
2088                 /*
2089                  * Ok we have a timer that is under joint use. Cookie timer
2090                  * per chance with the SEND timer. We therefore are NOT
2091                  * running the timer that the caller wants stopped.  So just
2092                  * return.
2093                  */
2094                 return (0);
2095         }
2096         if (t_type == SCTP_TIMER_TYPE_SEND) {
2097                 stcb->asoc.num_send_timers_up--;
2098                 if (stcb->asoc.num_send_timers_up < 0) {
2099                         stcb->asoc.num_send_timers_up = 0;
2100                 }
2101         }
2102         tmr->self = NULL;
2103         callout_stop(&tmr->timer);
2104         return (0);
2105 }
2106
2107 #ifdef SCTP_USE_ADLER32
2108 static uint32_t
2109 update_adler32(uint32_t adler, uint8_t * buf, int32_t len)
2110 {
2111         uint32_t s1 = adler & 0xffff;
2112         uint32_t s2 = (adler >> 16) & 0xffff;
2113         int n;
2114
2115         for (n = 0; n < len; n++, buf++) {
2116                 /* s1 = (s1 + buf[n]) % BASE */
2117                 /* first we add */
2118                 s1 = (s1 + *buf);
2119                 /*
2120                  * now if we need to, we do a mod by subtracting. It seems a
2121                  * bit faster since I really will only ever do one subtract
2122                  * at the MOST, since buf[n] is a max of 255.
2123                  */
2124                 if (s1 >= SCTP_ADLER32_BASE) {
2125                         s1 -= SCTP_ADLER32_BASE;
2126                 }
2127                 /* s2 = (s2 + s1) % BASE */
2128                 /* first we add */
2129                 s2 = (s2 + s1);
2130                 /*
2131                  * again, it is more efficent (it seems) to subtract since
2132                  * the most s2 will ever be is (BASE-1 + BASE-1) in the
2133                  * worse case. This would then be (2 * BASE) - 2, which will
2134                  * still only do one subtract. On Intel this is much better
2135                  * to do this way and avoid the divide. Have not -pg'd on
2136                  * sparc.
2137                  */
2138                 if (s2 >= SCTP_ADLER32_BASE) {
2139                         s2 -= SCTP_ADLER32_BASE;
2140                 }
2141         }
2142         /* Return the adler32 of the bytes buf[0..len-1] */
2143         return ((s2 << 16) + s1);
2144 }
2145
2146 #endif
2147
2148
2149 uint32_t
2150 sctp_calculate_len(struct mbuf *m)
2151 {
2152         uint32_t tlen = 0;
2153         struct mbuf *at;
2154
2155         at = m;
2156         while (at) {
2157                 tlen += at->m_len;
2158                 at = at->m_next;
2159         }
2160         return (tlen);
2161 }
2162
2163 #if defined(SCTP_WITH_NO_CSUM)
2164
2165 uint32_t
2166 sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
2167 {
2168         /*
2169          * given a mbuf chain with a packetheader offset by 'offset'
2170          * pointing at a sctphdr (with csum set to 0) go through the chain
2171          * of m_next's and calculate the SCTP checksum. This is currently
2172          * Adler32 but will change to CRC32x soon. Also has a side bonus
2173          * calculate the total length of the mbuf chain. Note: if offset is
2174          * greater than the total mbuf length, checksum=1, pktlen=0 is
2175          * returned (ie. no real error code)
2176          */
2177         if (pktlen == NULL)
2178                 return (0);
2179         *pktlen = sctp_calculate_len(m);
2180         return (0);
2181 }
2182
2183 #elif defined(SCTP_USE_INCHKSUM)
2184
2185 #include <machine/in_cksum.h>
2186
2187 uint32_t
2188 sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
2189 {
2190         /*
2191          * given a mbuf chain with a packetheader offset by 'offset'
2192          * pointing at a sctphdr (with csum set to 0) go through the chain
2193          * of m_next's and calculate the SCTP checksum. This is currently
2194          * Adler32 but will change to CRC32x soon. Also has a side bonus
2195          * calculate the total length of the mbuf chain. Note: if offset is
2196          * greater than the total mbuf length, checksum=1, pktlen=0 is
2197          * returned (ie. no real error code)
2198          */
2199         int32_t tlen = 0;
2200         struct mbuf *at;
2201         uint32_t the_sum, retsum;
2202
2203         at = m;
2204         while (at) {
2205                 tlen += at->m_len;
2206                 at = at->m_next;
2207         }
2208         the_sum = (uint32_t) (in_cksum_skip(m, tlen, offset));
2209         if (pktlen != NULL)
2210                 *pktlen = (tlen - offset);
2211         retsum = htons(the_sum);
2212         return (the_sum);
2213 }
2214
2215 #else
2216
2217 uint32_t
2218 sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
2219 {
2220         /*
2221          * given a mbuf chain with a packetheader offset by 'offset'
2222          * pointing at a sctphdr (with csum set to 0) go through the chain
2223          * of m_next's and calculate the SCTP checksum. This is currently
2224          * Adler32 but will change to CRC32x soon. Also has a side bonus
2225          * calculate the total length of the mbuf chain. Note: if offset is
2226          * greater than the total mbuf length, checksum=1, pktlen=0 is
2227          * returned (ie. no real error code)
2228          */
2229         int32_t tlen = 0;
2230
2231 #ifdef SCTP_USE_ADLER32
2232         uint32_t base = 1L;
2233
2234 #else
2235         uint32_t base = 0xffffffff;
2236
2237 #endif                          /* SCTP_USE_ADLER32 */
2238         struct mbuf *at;
2239
2240         at = m;
2241         /* find the correct mbuf and offset into mbuf */
2242         while ((at != NULL) && (offset > (uint32_t) at->m_len)) {
2243                 offset -= at->m_len;    /* update remaining offset left */
2244                 at = at->m_next;
2245         }
2246         while (at != NULL) {
2247                 if ((at->m_len - offset) > 0) {
2248 #ifdef SCTP_USE_ADLER32
2249                         base = update_adler32(base,
2250                             (unsigned char *)(at->m_data + offset),
2251                             (unsigned int)(at->m_len - offset));
2252 #else
2253                         if ((at->m_len - offset) < 4) {
2254                                 /* Use old method if less than 4 bytes */
2255                                 base = old_update_crc32(base,
2256                                     (unsigned char *)(at->m_data + offset),
2257                                     (unsigned int)(at->m_len - offset));
2258                         } else {
2259                                 base = update_crc32(base,
2260                                     (unsigned char *)(at->m_data + offset),
2261                                     (unsigned int)(at->m_len - offset));
2262                         }
2263 #endif                          /* SCTP_USE_ADLER32 */
2264                         tlen += at->m_len - offset;
2265                         /* we only offset once into the first mbuf */
2266                 }
2267                 if (offset) {
2268                         if (offset < at->m_len)
2269                                 offset = 0;
2270                         else
2271                                 offset -= at->m_len;
2272                 }
2273                 at = at->m_next;
2274         }
2275         if (pktlen != NULL) {
2276                 *pktlen = tlen;
2277         }
2278 #ifdef SCTP_USE_ADLER32
2279         /* Adler32 */
2280         base = htonl(base);
2281 #else
2282         /* CRC-32c */
2283         base = sctp_csum_finalize(base);
2284 #endif
2285         return (base);
2286 }
2287
2288
2289 #endif
2290
2291 void
2292 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2293     struct sctp_association *asoc, u_long mtu)
2294 {
2295         /*
2296          * Reset the P-MTU size on this association, this involves changing
2297          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2298          * allow the DF flag to be cleared.
2299          */
2300         struct sctp_tmit_chunk *chk;
2301         unsigned int eff_mtu, ovh;
2302
2303         asoc->smallest_mtu = mtu;
2304         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2305                 ovh = SCTP_MIN_OVERHEAD;
2306         } else {
2307                 ovh = SCTP_MIN_V4_OVERHEAD;
2308         }
2309         eff_mtu = mtu - ovh;
2310         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2311
2312                 if (chk->send_size > eff_mtu) {
2313                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2314                 }
2315         }
2316         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2317                 if (chk->send_size > eff_mtu) {
2318                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2319                 }
2320         }
2321 }
2322
2323
2324 /*
2325  * given an association and starting time of the current RTT period return
2326  * RTO in number of usecs net should point to the current network
2327  */
2328 uint32_t
2329 sctp_calculate_rto(struct sctp_tcb *stcb,
2330     struct sctp_association *asoc,
2331     struct sctp_nets *net,
2332     struct timeval *old)
2333 {
2334         /*
2335          * given an association and the starting time of the current RTT
2336          * period (in value1/value2) return RTO in number of usecs.
2337          */
2338         int calc_time = 0;
2339         int o_calctime;
2340         unsigned int new_rto = 0;
2341         int first_measure = 0;
2342         struct timeval now;
2343
2344         /************************/
2345         /* 1. calculate new RTT */
2346         /************************/
2347         /* get the current time */
2348         SCTP_GETTIME_TIMEVAL(&now);
2349         /* compute the RTT value */
2350         if ((u_long)now.tv_sec > (u_long)old->tv_sec) {
2351                 calc_time = ((u_long)now.tv_sec - (u_long)old->tv_sec) * 1000;
2352                 if ((u_long)now.tv_usec > (u_long)old->tv_usec) {
2353                         calc_time += (((u_long)now.tv_usec -
2354                             (u_long)old->tv_usec) / 1000);
2355                 } else if ((u_long)now.tv_usec < (u_long)old->tv_usec) {
2356                         /* Borrow 1,000ms from current calculation */
2357                         calc_time -= 1000;
2358                         /* Add in the slop over */
2359                         calc_time += ((int)now.tv_usec / 1000);
2360                         /* Add in the pre-second ms's */
2361                         calc_time += (((int)1000000 - (int)old->tv_usec) / 1000);
2362                 }
2363         } else if ((u_long)now.tv_sec == (u_long)old->tv_sec) {
2364                 if ((u_long)now.tv_usec > (u_long)old->tv_usec) {
2365                         calc_time = ((u_long)now.tv_usec -
2366                             (u_long)old->tv_usec) / 1000;
2367                 } else if ((u_long)now.tv_usec < (u_long)old->tv_usec) {
2368                         /* impossible .. garbage in nothing out */
2369                         return (((net->lastsa >> 2) + net->lastsv) >> 1);
2370                 } else {
2371                         /* impossible .. garbage in nothing out */
2372                         return (((net->lastsa >> 2) + net->lastsv) >> 1);
2373                 }
2374         } else {
2375                 /* Clock wrapped? */
2376                 return (((net->lastsa >> 2) + net->lastsv) >> 1);
2377         }
2378         /***************************/
2379         /* 2. update RTTVAR & SRTT */
2380         /***************************/
2381 #if 0
2382         /* if (net->lastsv || net->lastsa) { */
2383         /* per Section 5.3.1 C3 in SCTP */
2384         /* net->lastsv = (int)   *//* RTTVAR */
2385         /*
2386          * (((double)(1.0 - 0.25) * (double)net->lastsv) + (double)(0.25 *
2387          * (double)abs(net->lastsa - calc_time))); net->lastsa = (int)
2388 *//* SRTT */
2389         /*
2390          * (((double)(1.0 - 0.125) * (double)net->lastsa) + (double)(0.125 *
2391          * (double)calc_time)); } else {
2392 *//* the first RTT calculation, per C2 Section 5.3.1 */
2393         /* net->lastsa = calc_time;      *//* SRTT */
2394         /* net->lastsv = calc_time / 2;  *//* RTTVAR */
2395         /* } */
2396         /* if RTTVAR goes to 0 you set to clock grainularity */
2397         /*
2398          * if (net->lastsv == 0) { net->lastsv = SCTP_CLOCK_GRANULARITY; }
2399          * new_rto = net->lastsa + 4 * net->lastsv;
2400          */
2401 #endif
2402         o_calctime = calc_time;
2403         /* this is Van Jacobson's integer version */
2404         if (net->RTO) {
2405                 calc_time -= (net->lastsa >> 3);
2406                 if ((int)net->prev_rtt > o_calctime) {
2407                         net->rtt_variance = net->prev_rtt - o_calctime;
2408                         /* decreasing */
2409                         net->rto_variance_dir = 0;
2410                 } else {
2411                         /* increasing */
2412                         net->rtt_variance = o_calctime - net->prev_rtt;
2413                         net->rto_variance_dir = 1;
2414                 }
2415 #ifdef SCTP_RTTVAR_LOGGING
2416                 rto_logging(net, SCTP_LOG_RTTVAR);
2417 #endif
2418                 net->prev_rtt = o_calctime;
2419                 net->lastsa += calc_time;
2420                 if (calc_time < 0) {
2421                         calc_time = -calc_time;
2422                 }
2423                 calc_time -= (net->lastsv >> 2);
2424                 net->lastsv += calc_time;
2425                 if (net->lastsv == 0) {
2426                         net->lastsv = SCTP_CLOCK_GRANULARITY;
2427                 }
2428         } else {
2429                 /* First RTO measurment */
2430                 net->lastsa = calc_time;
2431                 net->lastsv = calc_time >> 1;
2432                 first_measure = 1;
2433                 net->rto_variance_dir = 1;
2434                 net->prev_rtt = o_calctime;
2435                 net->rtt_variance = 0;
2436 #ifdef SCTP_RTTVAR_LOGGING
2437                 rto_logging(net, SCTP_LOG_INITIAL_RTT);
2438 #endif
2439         }
2440         new_rto = ((net->lastsa >> 2) + net->lastsv) >> 1;
2441         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2442             (stcb->asoc.sat_network_lockout == 0)) {
2443                 stcb->asoc.sat_network = 1;
2444         } else if ((!first_measure) && stcb->asoc.sat_network) {
2445                 stcb->asoc.sat_network = 0;
2446                 stcb->asoc.sat_network_lockout = 1;
2447         }
2448         /* bound it, per C6/C7 in Section 5.3.1 */
2449         if (new_rto < stcb->asoc.minrto) {
2450                 new_rto = stcb->asoc.minrto;
2451         }
2452         if (new_rto > stcb->asoc.maxrto) {
2453                 new_rto = stcb->asoc.maxrto;
2454         }
2455         /* we are now returning the RTT Smoothed */
2456         return ((uint32_t) new_rto);
2457 }
2458
2459
2460 /*
2461  * return a pointer to a contiguous piece of data from the given mbuf chain
2462  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2463  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2464  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2465  */
2466 __inline caddr_t
2467 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
2468 {
2469         uint32_t count;
2470         uint8_t *ptr;
2471
2472         ptr = in_ptr;
2473         if ((off < 0) || (len <= 0))
2474                 return (NULL);
2475
2476         /* find the desired start location */
2477         while ((m != NULL) && (off > 0)) {
2478                 if (off < m->m_len)
2479                         break;
2480                 off -= m->m_len;
2481                 m = m->m_next;
2482         }
2483         if (m == NULL)
2484                 return (NULL);
2485
2486         /* is the current mbuf large enough (eg. contiguous)? */
2487         if ((m->m_len - off) >= len) {
2488                 return (mtod(m, caddr_t)+off);
2489         } else {
2490                 /* else, it spans more than one mbuf, so save a temp copy... */
2491                 while ((m != NULL) && (len > 0)) {
2492                         count = min(m->m_len - off, len);
2493                         bcopy(mtod(m, caddr_t)+off, ptr, count);
2494                         len -= count;
2495                         ptr += count;
2496                         off = 0;
2497                         m = m->m_next;
2498                 }
2499                 if ((m == NULL) && (len > 0))
2500                         return (NULL);
2501                 else
2502                         return ((caddr_t)in_ptr);
2503         }
2504 }
2505
2506
2507 struct sctp_paramhdr *
2508 sctp_get_next_param(struct mbuf *m,
2509     int offset,
2510     struct sctp_paramhdr *pull,
2511     int pull_limit)
2512 {
2513         /* This just provides a typed signature to Peter's Pull routine */
2514         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2515             (uint8_t *) pull));
2516 }
2517
2518
2519 int
2520 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2521 {
2522         /*
2523          * add padlen bytes of 0 filled padding to the end of the mbuf. If
2524          * padlen is > 3 this routine will fail.
2525          */
2526         uint8_t *dp;
2527         int i;
2528
2529         if (padlen > 3) {
2530                 return (ENOBUFS);
2531         }
2532         if (M_TRAILINGSPACE(m)) {
2533                 /*
2534                  * The easy way. We hope the majority of the time we hit
2535                  * here :)
2536                  */
2537                 dp = (uint8_t *) (mtod(m, caddr_t)+m->m_len);
2538                 m->m_len += padlen;
2539         } else {
2540                 /* Hard way we must grow the mbuf */
2541                 struct mbuf *tmp;
2542
2543                 tmp = sctp_get_mbuf_for_msg(padlen, 0, M_DONTWAIT, 1, MT_DATA);
2544                 if (tmp == NULL) {
2545                         /* Out of space GAK! we are in big trouble. */
2546                         return (ENOSPC);
2547                 }
2548                 /* setup and insert in middle */
2549                 tmp->m_next = m->m_next;
2550                 tmp->m_len = padlen;
2551                 m->m_next = tmp;
2552                 dp = mtod(tmp, uint8_t *);
2553         }
2554         /* zero out the pad */
2555         for (i = 0; i < padlen; i++) {
2556                 *dp = 0;
2557                 dp++;
2558         }
2559         return (0);
2560 }
2561
2562 int
2563 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2564 {
2565         /* find the last mbuf in chain and pad it */
2566         struct mbuf *m_at;
2567
2568         m_at = m;
2569         if (last_mbuf) {
2570                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2571         } else {
2572                 while (m_at) {
2573                         if (m_at->m_next == NULL) {
2574                                 return (sctp_add_pad_tombuf(m_at, padval));
2575                         }
2576                         m_at = m_at->m_next;
2577                 }
2578         }
2579         return (EFAULT);
2580 }
2581
2582 int sctp_asoc_change_wake = 0;
2583
2584 static void
2585 sctp_notify_assoc_change(uint32_t event, struct sctp_tcb *stcb,
2586     uint32_t error, void *data)
2587 {
2588         struct mbuf *m_notify;
2589         struct sctp_assoc_change *sac;
2590         struct sctp_queued_to_read *control;
2591
2592         /*
2593          * First if we are are going down dump everything we can to the
2594          * socket rcv queue.
2595          */
2596
2597         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
2598             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
2599             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)
2600             ) {
2601                 /* If the socket is gone we are out of here */
2602                 return;
2603         }
2604         /*
2605          * For TCP model AND UDP connected sockets we will send an error up
2606          * when an ABORT comes in.
2607          */
2608         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2609             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2610             (event == SCTP_COMM_LOST)) {
2611                 if (TAILQ_EMPTY(&stcb->sctp_ep->read_queue)) {
2612                         stcb->sctp_socket->so_error = ECONNRESET;
2613                 }
2614                 /* Wake ANY sleepers */
2615                 sorwakeup(stcb->sctp_socket);
2616                 sowwakeup(stcb->sctp_socket);
2617                 sctp_asoc_change_wake++;
2618         }
2619         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2620                 /* event not enabled */
2621                 return;
2622         }
2623         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_change), 1, M_DONTWAIT, 1, MT_DATA);
2624         if (m_notify == NULL)
2625                 /* no space left */
2626                 return;
2627         m_notify->m_len = 0;
2628
2629         sac = mtod(m_notify, struct sctp_assoc_change *);
2630         sac->sac_type = SCTP_ASSOC_CHANGE;
2631         sac->sac_flags = 0;
2632         sac->sac_length = sizeof(struct sctp_assoc_change);
2633         sac->sac_state = event;
2634         sac->sac_error = error;
2635         /* XXX verify these stream counts */
2636         sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2637         sac->sac_inbound_streams = stcb->asoc.streamincnt;
2638         sac->sac_assoc_id = sctp_get_associd(stcb);
2639         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2640         m_notify->m_pkthdr.len = sizeof(struct sctp_assoc_change);
2641         m_notify->m_pkthdr.rcvif = 0;
2642         m_notify->m_len = sizeof(struct sctp_assoc_change);
2643         m_notify->m_next = NULL;
2644         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2645             0, 0, 0, 0, 0, 0,
2646             m_notify);
2647         if (control == NULL) {
2648                 /* no memory */
2649                 sctp_m_freem(m_notify);
2650                 return;
2651         }
2652         control->length = m_notify->m_len;
2653         /* not that we need this */
2654         control->tail_mbuf = m_notify;
2655         sctp_add_to_readq(stcb->sctp_ep, stcb,
2656             control,
2657             &stcb->sctp_socket->so_rcv, 1);
2658         if (event == SCTP_COMM_LOST) {
2659                 /* Wake up any sleeper */
2660                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
2661         }
2662 }
2663
2664 static void
2665 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2666     struct sockaddr *sa, uint32_t error)
2667 {
2668         struct mbuf *m_notify;
2669         struct sctp_paddr_change *spc;
2670         struct sctp_queued_to_read *control;
2671
2672         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVPADDREVNT))
2673                 /* event not enabled */
2674                 return;
2675
2676         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 1, M_DONTWAIT, 1, MT_DATA);
2677         if (m_notify == NULL)
2678                 return;
2679         m_notify->m_len = 0;
2680         spc = mtod(m_notify, struct sctp_paddr_change *);
2681         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2682         spc->spc_flags = 0;
2683         spc->spc_length = sizeof(struct sctp_paddr_change);
2684         if (sa->sa_family == AF_INET) {
2685                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2686         } else {
2687                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2688         }
2689         spc->spc_state = state;
2690         spc->spc_error = error;
2691         spc->spc_assoc_id = sctp_get_associd(stcb);
2692
2693         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2694         m_notify->m_pkthdr.len = sizeof(struct sctp_paddr_change);
2695         m_notify->m_pkthdr.rcvif = 0;
2696         m_notify->m_len = sizeof(struct sctp_paddr_change);
2697         m_notify->m_next = NULL;
2698
2699         /* append to socket */
2700         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2701             0, 0, 0, 0, 0, 0,
2702             m_notify);
2703         if (control == NULL) {
2704                 /* no memory */
2705                 sctp_m_freem(m_notify);
2706                 return;
2707         }
2708         control->length = m_notify->m_len;
2709         /* not that we need this */
2710         control->tail_mbuf = m_notify;
2711         sctp_add_to_readq(stcb->sctp_ep, stcb,
2712             control,
2713             &stcb->sctp_socket->so_rcv, 1);
2714 }
2715
2716
2717 static void
2718 sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error,
2719     struct sctp_tmit_chunk *chk)
2720 {
2721         struct mbuf *m_notify;
2722         struct sctp_send_failed *ssf;
2723         struct sctp_queued_to_read *control;
2724         int length;
2725
2726         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSENDFAILEVNT))
2727                 /* event not enabled */
2728                 return;
2729
2730         length = sizeof(struct sctp_send_failed) + chk->send_size;
2731         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_send_failed), 1, M_DONTWAIT, 1, MT_DATA);
2732         if (m_notify == NULL)
2733                 /* no space left */
2734                 return;
2735         m_notify->m_len = 0;
2736         ssf = mtod(m_notify, struct sctp_send_failed *);
2737         ssf->ssf_type = SCTP_SEND_FAILED;
2738         if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2739                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2740         else
2741                 ssf->ssf_flags = SCTP_DATA_SENT;
2742         ssf->ssf_length = length;
2743         ssf->ssf_error = error;
2744         /* not exactly what the user sent in, but should be close :) */
2745         ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number;
2746         ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq;
2747         ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2748         ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype;
2749         ssf->ssf_info.sinfo_context = chk->rec.data.context;
2750         ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2751         ssf->ssf_assoc_id = sctp_get_associd(stcb);
2752         m_notify->m_next = chk->data;
2753         m_notify->m_flags |= M_NOTIFICATION;
2754         m_notify->m_pkthdr.len = length;
2755         m_notify->m_pkthdr.rcvif = 0;
2756         m_notify->m_len = sizeof(struct sctp_send_failed);
2757
2758         /* Steal off the mbuf */
2759         chk->data = NULL;
2760         /*
2761          * For this case, we check the actual socket buffer, since the assoc
2762          * is going away we don't want to overfill the socket buffer for a
2763          * non-reader
2764          */
2765         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2766                 sctp_m_freem(m_notify);
2767                 return;
2768         }
2769         /* append to socket */
2770         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2771             0, 0, 0, 0, 0, 0,
2772             m_notify);
2773         if (control == NULL) {
2774                 /* no memory */
2775                 sctp_m_freem(m_notify);
2776                 return;
2777         }
2778         sctp_add_to_readq(stcb->sctp_ep, stcb,
2779             control,
2780             &stcb->sctp_socket->so_rcv, 1);
2781 }
2782
2783
2784 static void
2785 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
2786     struct sctp_stream_queue_pending *sp)
2787 {
2788         struct mbuf *m_notify;
2789         struct sctp_send_failed *ssf;
2790         struct sctp_queued_to_read *control;
2791         int length;
2792
2793         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSENDFAILEVNT))
2794                 /* event not enabled */
2795                 return;
2796
2797         length = sizeof(struct sctp_send_failed) + sp->length;
2798         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 1, M_DONTWAIT, 1, MT_DATA);
2799         if (m_notify == NULL)
2800                 /* no space left */
2801                 return;
2802         m_notify->m_len = 0;
2803         ssf = mtod(m_notify, struct sctp_send_failed *);
2804         ssf->ssf_type = SCTP_SEND_FAILED;
2805         if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2806                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2807         else
2808                 ssf->ssf_flags = SCTP_DATA_SENT;
2809         ssf->ssf_length = length;
2810         ssf->ssf_error = error;
2811         /* not exactly what the user sent in, but should be close :) */
2812         ssf->ssf_info.sinfo_stream = sp->stream;
2813         ssf->ssf_info.sinfo_ssn = sp->strseq;
2814         ssf->ssf_info.sinfo_flags = sp->sinfo_flags;
2815         ssf->ssf_info.sinfo_ppid = sp->ppid;
2816         ssf->ssf_info.sinfo_context = sp->context;
2817         ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2818         ssf->ssf_assoc_id = sctp_get_associd(stcb);
2819         m_notify->m_next = sp->data;
2820         m_notify->m_flags |= M_NOTIFICATION;
2821         m_notify->m_pkthdr.len = length;
2822         m_notify->m_pkthdr.rcvif = 0;
2823         m_notify->m_len = sizeof(struct sctp_send_failed);
2824
2825         /* Steal off the mbuf */
2826         sp->data = NULL;
2827         /*
2828          * For this case, we check the actual socket buffer, since the assoc
2829          * is going away we don't want to overfill the socket buffer for a
2830          * non-reader
2831          */
2832         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2833                 sctp_m_freem(m_notify);
2834                 return;
2835         }
2836         /* append to socket */
2837         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2838             0, 0, 0, 0, 0, 0,
2839             m_notify);
2840         if (control == NULL) {
2841                 /* no memory */
2842                 sctp_m_freem(m_notify);
2843                 return;
2844         }
2845         sctp_add_to_readq(stcb->sctp_ep, stcb,
2846             control,
2847             &stcb->sctp_socket->so_rcv, 1);
2848 }
2849
2850
2851
2852 static void
2853 sctp_notify_adaptation_layer(struct sctp_tcb *stcb,
2854     uint32_t error)
2855 {
2856         struct mbuf *m_notify;
2857         struct sctp_adaptation_event *sai;
2858         struct sctp_queued_to_read *control;
2859
2860         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_ADAPTATIONEVNT))
2861                 /* event not enabled */
2862                 return;
2863
2864         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 1, M_DONTWAIT, 1, MT_DATA);
2865         if (m_notify == NULL)
2866                 /* no space left */
2867                 return;
2868         m_notify->m_len = 0;
2869         sai = mtod(m_notify, struct sctp_adaptation_event *);
2870         sai->sai_type = SCTP_ADAPTATION_INDICATION;
2871         sai->sai_flags = 0;
2872         sai->sai_length = sizeof(struct sctp_adaptation_event);
2873         sai->sai_adaptation_ind = error;
2874         sai->sai_assoc_id = sctp_get_associd(stcb);
2875
2876         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2877         m_notify->m_pkthdr.len = sizeof(struct sctp_adaptation_event);
2878         m_notify->m_pkthdr.rcvif = 0;
2879         m_notify->m_len = sizeof(struct sctp_adaptation_event);
2880         m_notify->m_next = NULL;
2881
2882         /* append to socket */
2883         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2884             0, 0, 0, 0, 0, 0,
2885             m_notify);
2886         if (control == NULL) {
2887                 /* no memory */
2888                 sctp_m_freem(m_notify);
2889                 return;
2890         }
2891         control->length = m_notify->m_len;
2892         /* not that we need this */
2893         control->tail_mbuf = m_notify;
2894         sctp_add_to_readq(stcb->sctp_ep, stcb,
2895             control,
2896             &stcb->sctp_socket->so_rcv, 1);
2897 }
2898
2899 /* This always must be called with the read-queue LOCKED in the INP */
2900 void
2901 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb,
2902     uint32_t error, int nolock)
2903 {
2904         struct mbuf *m_notify;
2905         struct sctp_pdapi_event *pdapi;
2906         struct sctp_queued_to_read *control;
2907         struct sockbuf *sb;
2908
2909         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_PDAPIEVNT))
2910                 /* event not enabled */
2911                 return;
2912
2913         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 1, M_DONTWAIT, 1, MT_DATA);
2914         if (m_notify == NULL)
2915                 /* no space left */
2916                 return;
2917         m_notify->m_len = 0;
2918         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
2919         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
2920         pdapi->pdapi_flags = 0;
2921         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
2922         pdapi->pdapi_indication = error;
2923         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
2924
2925         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2926         m_notify->m_pkthdr.len = sizeof(struct sctp_pdapi_event);
2927         m_notify->m_pkthdr.rcvif = 0;
2928         m_notify->m_len = sizeof(struct sctp_pdapi_event);
2929         m_notify->m_next = NULL;
2930         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2931             0, 0, 0, 0, 0, 0,
2932             m_notify);
2933         if (control == NULL) {
2934                 /* no memory */
2935                 sctp_m_freem(m_notify);
2936                 return;
2937         }
2938         control->length = m_notify->m_len;
2939         /* not that we need this */
2940         control->tail_mbuf = m_notify;
2941         control->held_length = 0;
2942         control->length = 0;
2943         if (nolock == 0) {
2944                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
2945         }
2946         sb = &stcb->sctp_socket->so_rcv;
2947 #ifdef SCTP_SB_LOGGING
2948         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m_notify->m_len);
2949 #endif
2950         sctp_sballoc(stcb, sb, m_notify);
2951 #ifdef SCTP_SB_LOGGING
2952         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
2953 #endif
2954         atomic_add_int(&control->length, m_notify->m_len);
2955         control->end_added = 1;
2956         if (stcb->asoc.control_pdapi)
2957                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
2958         else {
2959                 /* we really should not see this case */
2960                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
2961         }
2962         if (nolock == 0) {
2963                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
2964         }
2965         if (stcb->sctp_ep && stcb->sctp_socket) {
2966                 /* This should always be the case */
2967                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2968         }
2969 }
2970
2971 static void
2972 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
2973 {
2974         struct mbuf *m_notify;
2975         struct sctp_shutdown_event *sse;
2976         struct sctp_queued_to_read *control;
2977
2978         /*
2979          * For TCP model AND UDP connected sockets we will send an error up
2980          * when an SHUTDOWN completes
2981          */
2982         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2983             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2984                 /* mark socket closed for read/write and wakeup! */
2985                 socantsendmore(stcb->sctp_socket);
2986         }
2987         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT))
2988                 /* event not enabled */
2989                 return;
2990
2991         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 1, M_DONTWAIT, 1, MT_DATA);
2992         if (m_notify == NULL)
2993                 /* no space left */
2994                 return;
2995         m_notify->m_len = 0;
2996         sse = mtod(m_notify, struct sctp_shutdown_event *);
2997         sse->sse_type = SCTP_SHUTDOWN_EVENT;
2998         sse->sse_flags = 0;
2999         sse->sse_length = sizeof(struct sctp_shutdown_event);
3000         sse->sse_assoc_id = sctp_get_associd(stcb);
3001
3002         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
3003         m_notify->m_pkthdr.len = sizeof(struct sctp_shutdown_event);
3004         m_notify->m_pkthdr.rcvif = 0;
3005         m_notify->m_len = sizeof(struct sctp_shutdown_event);
3006         m_notify->m_next = NULL;
3007
3008         /* append to socket */
3009         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3010             0, 0, 0, 0, 0, 0,
3011             m_notify);
3012         if (control == NULL) {
3013                 /* no memory */
3014                 sctp_m_freem(m_notify);
3015                 return;
3016         }
3017         control->length = m_notify->m_len;
3018         /* not that we need this */
3019         control->tail_mbuf = m_notify;
3020         sctp_add_to_readq(stcb->sctp_ep, stcb,
3021             control,
3022             &stcb->sctp_socket->so_rcv, 1);
3023 }
3024
3025 static void
3026 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3027     int number_entries, uint16_t * list, int flag)
3028 {
3029         struct mbuf *m_notify;
3030         struct sctp_queued_to_read *control;
3031         struct sctp_stream_reset_event *strreset;
3032         int len;
3033
3034         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_STREAM_RESETEVNT))
3035                 /* event not enabled */
3036                 return;
3037
3038         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_DONTWAIT, 1, MT_DATA);
3039         if (m_notify == NULL)
3040                 /* no space left */
3041                 return;
3042         m_notify->m_len = 0;
3043         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3044         if (len > M_TRAILINGSPACE(m_notify)) {
3045                 /* never enough room */
3046                 sctp_m_freem(m_notify);
3047                 return;
3048         }
3049         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3050         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3051         if (number_entries == 0) {
3052                 strreset->strreset_flags = flag | SCTP_STRRESET_ALL_STREAMS;
3053         } else {
3054                 strreset->strreset_flags = flag | SCTP_STRRESET_STREAM_LIST;
3055         }
3056         strreset->strreset_length = len;
3057         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3058         if (number_entries) {
3059                 int i;
3060
3061                 for (i = 0; i < number_entries; i++) {
3062                         strreset->strreset_list[i] = ntohs(list[i]);
3063                 }
3064         }
3065         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
3066         m_notify->m_pkthdr.len = len;
3067         m_notify->m_pkthdr.rcvif = 0;
3068         m_notify->m_len = len;
3069         m_notify->m_next = NULL;
3070         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < m_notify->m_len) {
3071                 /* no space */
3072                 sctp_m_freem(m_notify);
3073                 return;
3074         }
3075         /* append to socket */
3076         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3077             0, 0, 0, 0, 0, 0,
3078             m_notify);
3079         if (control == NULL) {
3080                 /* no memory */
3081                 sctp_m_freem(m_notify);
3082                 return;
3083         }
3084         control->length = m_notify->m_len;
3085         /* not that we need this */
3086         control->tail_mbuf = m_notify;
3087         sctp_add_to_readq(stcb->sctp_ep, stcb,
3088             control,
3089             &stcb->sctp_socket->so_rcv, 1);
3090 }
3091
3092
3093 void
3094 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3095     uint32_t error, void *data)
3096 {
3097         if (stcb == NULL) {
3098                 /* unlikely but */
3099                 return;
3100         }
3101         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3102             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3103             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)
3104             ) {
3105                 /* No notifications up when we are in a no socket state */
3106                 return;
3107         }
3108         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3109                 /* Can't send up to a closed socket any notifications */
3110                 return;
3111         }
3112         if (stcb && (stcb->asoc.assoc_up_sent == 0) && (notification != SCTP_NOTIFY_ASSOC_UP)) {
3113                 if ((notification != SCTP_NOTIFY_ASSOC_DOWN) &&
3114                     (notification != SCTP_NOTIFY_ASSOC_ABORTED) &&
3115                     (notification != SCTP_NOTIFY_SPECIAL_SP_FAIL) &&
3116                     (notification != SCTP_NOTIFY_DG_FAIL) &&
3117                     (notification != SCTP_NOTIFY_PEER_SHUTDOWN)) {
3118                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, 0, NULL);
3119                         stcb->asoc.assoc_up_sent = 1;
3120                 }
3121         }
3122         switch (notification) {
3123         case SCTP_NOTIFY_ASSOC_UP:
3124                 if (stcb->asoc.assoc_up_sent == 0) {
3125                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL);
3126                         stcb->asoc.assoc_up_sent = 1;
3127                 }
3128                 break;
3129         case SCTP_NOTIFY_ASSOC_DOWN:
3130                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL);
3131                 break;
3132         case SCTP_NOTIFY_INTERFACE_DOWN:
3133                 {
3134                         struct sctp_nets *net;
3135
3136                         net = (struct sctp_nets *)data;
3137                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3138                             (struct sockaddr *)&net->ro._l_addr, error);
3139                         break;
3140                 }
3141         case SCTP_NOTIFY_INTERFACE_UP:
3142                 {
3143                         struct sctp_nets *net;
3144
3145                         net = (struct sctp_nets *)data;
3146                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3147                             (struct sockaddr *)&net->ro._l_addr, error);
3148                         break;
3149                 }
3150         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3151                 {
3152                         struct sctp_nets *net;
3153
3154                         net = (struct sctp_nets *)data;
3155                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3156                             (struct sockaddr *)&net->ro._l_addr, error);
3157                         break;
3158                 }
3159         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3160                 sctp_notify_send_failed2(stcb, error,
3161                     (struct sctp_stream_queue_pending *)data);
3162                 break;
3163         case SCTP_NOTIFY_DG_FAIL:
3164                 sctp_notify_send_failed(stcb, error,
3165                     (struct sctp_tmit_chunk *)data);
3166                 break;
3167         case SCTP_NOTIFY_ADAPTATION_INDICATION:
3168                 /* Here the error is the adaptation indication */
3169                 sctp_notify_adaptation_layer(stcb, error);
3170                 break;
3171         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3172                 sctp_notify_partial_delivery_indication(stcb, error, 0);
3173                 break;
3174         case SCTP_NOTIFY_STRDATA_ERR:
3175                 break;
3176         case SCTP_NOTIFY_ASSOC_ABORTED:
3177                 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, NULL);
3178                 break;
3179         case SCTP_NOTIFY_PEER_OPENED_STREAM:
3180                 break;
3181         case SCTP_NOTIFY_STREAM_OPENED_OK:
3182                 break;
3183         case SCTP_NOTIFY_ASSOC_RESTART:
3184                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, data);
3185                 break;
3186         case SCTP_NOTIFY_HB_RESP:
3187                 break;
3188         case SCTP_NOTIFY_STR_RESET_SEND:
3189                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STRRESET_OUTBOUND_STR);
3190                 break;
3191         case SCTP_NOTIFY_STR_RESET_RECV:
3192                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STRRESET_INBOUND_STR);
3193                 break;
3194         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3195                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), (SCTP_STRRESET_OUTBOUND_STR | SCTP_STRRESET_INBOUND_STR));
3196                 break;
3197
3198         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3199                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), (SCTP_STRRESET_INBOUND_STR | SCTP_STRRESET_INBOUND_STR));
3200                 break;
3201
3202         case SCTP_NOTIFY_ASCONF_ADD_IP:
3203                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3204                     error);
3205                 break;
3206         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3207                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3208                     error);
3209                 break;
3210         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3211                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3212                     error);
3213                 break;
3214         case SCTP_NOTIFY_ASCONF_SUCCESS:
3215                 break;
3216         case SCTP_NOTIFY_ASCONF_FAILED:
3217                 break;
3218         case SCTP_NOTIFY_PEER_SHUTDOWN:
3219                 sctp_notify_shutdown_event(stcb);
3220                 break;
3221         case SCTP_NOTIFY_AUTH_NEW_KEY:
3222                 sctp_notify_authentication(stcb, SCTP_AUTH_NEWKEY, error,
3223                     (uint16_t) (uintptr_t) data);
3224                 break;
3225 #if 0
3226         case SCTP_NOTIFY_AUTH_KEY_CONFLICT:
3227                 sctp_notify_authentication(stcb, SCTP_AUTH_KEY_CONFLICT,
3228                     error, (uint16_t) (uintptr_t) data);
3229                 break;
3230 #endif                          /* not yet? remove? */
3231
3232
3233         default:
3234 #ifdef SCTP_DEBUG
3235                 if (sctp_debug_on & SCTP_DEBUG_UTIL1) {
3236                         printf("NOTIFY: unknown notification %xh (%u)\n",
3237                             notification, notification);
3238                 }
3239 #endif                          /* SCTP_DEBUG */
3240                 break;
3241         }                       /* end switch */
3242 }
3243
3244 void
3245 sctp_report_all_outbound(struct sctp_tcb *stcb)
3246 {
3247         struct sctp_association *asoc;
3248         struct sctp_stream_out *outs;
3249         struct sctp_tmit_chunk *chk;
3250         struct sctp_stream_queue_pending *sp;
3251
3252         asoc = &stcb->asoc;
3253
3254         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3255             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3256             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3257                 return;
3258         }
3259         /* now through all the gunk freeing chunks */
3260
3261         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
3262                 /* now clean up any chunks here */
3263                 stcb->asoc.locked_on_sending = NULL;
3264                 sp = TAILQ_FIRST(&outs->outqueue);
3265                 while (sp) {
3266                         stcb->asoc.stream_queue_cnt--;
3267                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3268                         sctp_free_spbufspace(stcb, asoc, sp);
3269                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3270                             SCTP_NOTIFY_DATAGRAM_UNSENT, (void *)sp);
3271                         if (sp->data) {
3272                                 sctp_m_freem(sp->data);
3273                                 sp->data = NULL;
3274                         }
3275                         if (sp->net)
3276                                 sctp_free_remote_addr(sp->net);
3277                         sp->net = NULL;
3278                         /* Free the chunk */
3279                         sctp_free_a_strmoq(stcb, sp);
3280                         sp = TAILQ_FIRST(&outs->outqueue);
3281                 }
3282         }
3283
3284         /* pending send queue SHOULD be empty */
3285         if (!TAILQ_EMPTY(&asoc->send_queue)) {
3286                 chk = TAILQ_FIRST(&asoc->send_queue);
3287                 while (chk) {
3288                         TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3289                         if (chk->data) {
3290                                 /*
3291                                  * trim off the sctp chunk header(it should
3292                                  * be there)
3293                                  */
3294                                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
3295                                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
3296                                         sctp_mbuf_crush(chk->data);
3297                                 }
3298                         }
3299                         sctp_free_bufspace(stcb, asoc, chk, 1);
3300                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, SCTP_NOTIFY_DATAGRAM_UNSENT, chk);
3301                         if (chk->data) {
3302                                 sctp_m_freem(chk->data);
3303                                 chk->data = NULL;
3304                         }
3305                         if (chk->whoTo)
3306                                 sctp_free_remote_addr(chk->whoTo);
3307                         chk->whoTo = NULL;
3308                         sctp_free_a_chunk(stcb, chk);
3309                         chk = TAILQ_FIRST(&asoc->send_queue);
3310                 }
3311         }
3312         /* sent queue SHOULD be empty */
3313         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3314                 chk = TAILQ_FIRST(&asoc->sent_queue);
3315                 while (chk) {
3316                         TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3317                         if (chk->data) {
3318                                 /*
3319                                  * trim off the sctp chunk header(it should
3320                                  * be there)
3321                                  */
3322                                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
3323                                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
3324                                         sctp_mbuf_crush(chk->data);
3325                                 }
3326                         }
3327                         sctp_free_bufspace(stcb, asoc, chk, 1);
3328                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3329                             SCTP_NOTIFY_DATAGRAM_SENT, chk);
3330                         if (chk->data) {
3331                                 sctp_m_freem(chk->data);
3332                                 chk->data = NULL;
3333                         }
3334                         if (chk->whoTo)
3335                                 sctp_free_remote_addr(chk->whoTo);
3336                         chk->whoTo = NULL;
3337                         sctp_free_a_chunk(stcb, chk);
3338                         chk = TAILQ_FIRST(&asoc->sent_queue);
3339                 }
3340         }
3341 }
3342
3343 void
3344 sctp_abort_notification(struct sctp_tcb *stcb, int error)
3345 {
3346
3347         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3348             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3349             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3350                 return;
3351         }
3352         /* Tell them we lost the asoc */
3353         sctp_report_all_outbound(stcb);
3354         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3355             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3356             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3357                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3358         }
3359         sctp_ulp_notify(SCTP_NOTIFY_ASSOC_ABORTED, stcb, error, NULL);
3360 }
3361
3362 void
3363 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3364     struct mbuf *m, int iphlen, struct sctphdr *sh, struct mbuf *op_err)
3365 {
3366         uint32_t vtag;
3367
3368         vtag = 0;
3369         if (stcb != NULL) {
3370                 /* We have a TCB to abort, send notification too */
3371                 vtag = stcb->asoc.peer_vtag;
3372                 sctp_abort_notification(stcb, 0);
3373         }
3374         sctp_send_abort(m, iphlen, sh, vtag, op_err);
3375         if (stcb != NULL) {
3376                 /* Ok, now lets free it */
3377                 sctp_free_assoc(inp, stcb, 0);
3378         } else {
3379                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3380                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3381                                 sctp_inpcb_free(inp, 1, 0);
3382                         }
3383                 }
3384         }
3385 }
3386
3387 void
3388 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3389     int error, struct mbuf *op_err)
3390 {
3391         uint32_t vtag;
3392
3393         if (stcb == NULL) {
3394                 /* Got to have a TCB */
3395                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3396                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3397                                 sctp_inpcb_free(inp, 1, 0);
3398                         }
3399                 }
3400                 return;
3401         }
3402         vtag = stcb->asoc.peer_vtag;
3403         /* notify the ulp */
3404         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0)
3405                 sctp_abort_notification(stcb, error);
3406         /* notify the peer */
3407         sctp_send_abort_tcb(stcb, op_err);
3408         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3409         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3410             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3411                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3412         }
3413         /* now free the asoc */
3414         sctp_free_assoc(inp, stcb, 0);
3415 }
3416
3417 void
3418 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
3419     struct sctp_inpcb *inp, struct mbuf *op_err)
3420 {
3421         struct sctp_chunkhdr *ch, chunk_buf;
3422         unsigned int chk_length;
3423
3424         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
3425         /* Generate a TO address for future reference */
3426         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
3427                 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3428                         sctp_inpcb_free(inp, 1, 0);
3429                 }
3430         }
3431         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3432             sizeof(*ch), (uint8_t *) & chunk_buf);
3433         while (ch != NULL) {
3434                 chk_length = ntohs(ch->chunk_length);
3435                 if (chk_length < sizeof(*ch)) {
3436                         /* break to abort land */
3437                         break;
3438                 }
3439                 switch (ch->chunk_type) {
3440                 case SCTP_PACKET_DROPPED:
3441                         /* we don't respond to pkt-dropped */
3442                         return;
3443                 case SCTP_ABORT_ASSOCIATION:
3444                         /* we don't respond with an ABORT to an ABORT */
3445                         return;
3446                 case SCTP_SHUTDOWN_COMPLETE:
3447                         /*
3448                          * we ignore it since we are not waiting for it and
3449                          * peer is gone
3450                          */
3451                         return;
3452                 case SCTP_SHUTDOWN_ACK:
3453                         sctp_send_shutdown_complete2(m, iphlen, sh);
3454                         return;
3455                 default:
3456                         break;
3457                 }
3458                 offset += SCTP_SIZE32(chk_length);
3459                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3460                     sizeof(*ch), (uint8_t *) & chunk_buf);
3461         }
3462         sctp_send_abort(m, iphlen, sh, 0, op_err);
3463 }
3464
3465 /*
3466  * check the inbound datagram to make sure there is not an abort inside it,
3467  * if there is return 1, else return 0.
3468  */
3469 int
3470 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill)
3471 {
3472         struct sctp_chunkhdr *ch;
3473         struct sctp_init_chunk *init_chk, chunk_buf;
3474         int offset;
3475         unsigned int chk_length;
3476
3477         offset = iphlen + sizeof(struct sctphdr);
3478         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
3479             (uint8_t *) & chunk_buf);
3480         while (ch != NULL) {
3481                 chk_length = ntohs(ch->chunk_length);
3482                 if (chk_length < sizeof(*ch)) {
3483                         /* packet is probably corrupt */
3484                         break;
3485                 }
3486                 /* we seem to be ok, is it an abort? */
3487                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
3488                         /* yep, tell them */
3489                         return (1);
3490                 }
3491                 if (ch->chunk_type == SCTP_INITIATION) {
3492                         /* need to update the Vtag */
3493                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
3494                             offset, sizeof(*init_chk), (uint8_t *) & chunk_buf);
3495                         if (init_chk != NULL) {
3496                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
3497                         }
3498                 }
3499                 /* Nope, move to the next chunk */
3500                 offset += SCTP_SIZE32(chk_length);
3501                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3502                     sizeof(*ch), (uint8_t *) & chunk_buf);
3503         }
3504         return (0);
3505 }
3506
3507 /*
3508  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
3509  * set (i.e. it's 0) so, create this function to compare link local scopes
3510  */
3511 uint32_t
3512 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
3513 {
3514         struct sockaddr_in6 a, b;
3515
3516         /* save copies */
3517         a = *addr1;
3518         b = *addr2;
3519
3520         if (a.sin6_scope_id == 0)
3521                 if (sa6_recoverscope(&a)) {
3522                         /* can't get scope, so can't match */
3523                         return (0);
3524                 }
3525         if (b.sin6_scope_id == 0)
3526                 if (sa6_recoverscope(&b)) {
3527                         /* can't get scope, so can't match */
3528                         return (0);
3529                 }
3530         if (a.sin6_scope_id != b.sin6_scope_id)
3531                 return (0);
3532
3533         return (1);
3534 }
3535
3536 /*
3537  * returns a sockaddr_in6 with embedded scope recovered and removed
3538  */
3539 struct sockaddr_in6 *
3540 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
3541 {
3542
3543         /* check and strip embedded scope junk */
3544         if (addr->sin6_family == AF_INET6) {
3545                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
3546                         if (addr->sin6_scope_id == 0) {
3547                                 *store = *addr;
3548                                 if (!sa6_recoverscope(store)) {
3549                                         /* use the recovered scope */
3550                                         addr = store;
3551                                 }
3552                                 /* else, return the original "to" addr */
3553                         }
3554                 }
3555         }
3556         return (addr);
3557 }
3558
3559 /*
3560  * are the two addresses the same?  currently a "scopeless" check returns: 1
3561  * if same, 0 if not
3562  */
3563 __inline int
3564 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
3565 {
3566
3567         /* must be valid */
3568         if (sa1 == NULL || sa2 == NULL)
3569                 return (0);
3570
3571         /* must be the same family */
3572         if (sa1->sa_family != sa2->sa_family)
3573                 return (0);
3574
3575         if (sa1->sa_family == AF_INET6) {
3576                 /* IPv6 addresses */
3577                 struct sockaddr_in6 *sin6_1, *sin6_2;
3578
3579                 sin6_1 = (struct sockaddr_in6 *)sa1;
3580                 sin6_2 = (struct sockaddr_in6 *)sa2;
3581                 return (SCTP6_ARE_ADDR_EQUAL(&sin6_1->sin6_addr,
3582                     &sin6_2->sin6_addr));
3583         } else if (sa1->sa_family == AF_INET) {
3584                 /* IPv4 addresses */
3585                 struct sockaddr_in *sin_1, *sin_2;
3586
3587                 sin_1 = (struct sockaddr_in *)sa1;
3588                 sin_2 = (struct sockaddr_in *)sa2;
3589                 return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
3590         } else {
3591                 /* we don't do these... */
3592                 return (0);
3593         }
3594 }
3595
3596 void
3597 sctp_print_address(struct sockaddr *sa)
3598 {
3599
3600         if (sa->sa_family == AF_INET6) {
3601                 struct sockaddr_in6 *sin6;
3602
3603                 sin6 = (struct sockaddr_in6 *)sa;
3604                 printf("IPv6 address: %s:%d scope:%u\n",
3605                     ip6_sprintf(&sin6->sin6_addr), ntohs(sin6->sin6_port),
3606                     sin6->sin6_scope_id);
3607         } else if (sa->sa_family == AF_INET) {
3608                 struct sockaddr_in *sin;
3609                 unsigned char *p;
3610
3611                 sin = (struct sockaddr_in *)sa;
3612                 p = (unsigned char *)&sin->sin_addr;
3613                 printf("IPv4 address: %u.%u.%u.%u:%d\n",
3614                     p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
3615         } else {
3616                 printf("?\n");
3617         }
3618 }
3619
3620 void
3621 sctp_print_address_pkt(struct ip *iph, struct sctphdr *sh)
3622 {
3623         if (iph->ip_v == IPVERSION) {
3624                 struct sockaddr_in lsa, fsa;
3625
3626                 bzero(&lsa, sizeof(lsa));
3627                 lsa.sin_len = sizeof(lsa);
3628                 lsa.sin_family = AF_INET;
3629                 lsa.sin_addr = iph->ip_src;
3630                 lsa.sin_port = sh->src_port;
3631                 bzero(&fsa, sizeof(fsa));
3632                 fsa.sin_len = sizeof(fsa);
3633                 fsa.sin_family = AF_INET;
3634                 fsa.sin_addr = iph->ip_dst;
3635                 fsa.sin_port = sh->dest_port;
3636                 printf("src: ");
3637                 sctp_print_address((struct sockaddr *)&lsa);
3638                 printf("dest: ");
3639                 sctp_print_address((struct sockaddr *)&fsa);
3640         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3641                 struct ip6_hdr *ip6;
3642                 struct sockaddr_in6 lsa6, fsa6;
3643
3644                 ip6 = (struct ip6_hdr *)iph;
3645                 bzero(&lsa6, sizeof(lsa6));
3646                 lsa6.sin6_len = sizeof(lsa6);
3647                 lsa6.sin6_family = AF_INET6;
3648                 lsa6.sin6_addr = ip6->ip6_src;
3649                 lsa6.sin6_port = sh->src_port;
3650                 bzero(&fsa6, sizeof(fsa6));
3651                 fsa6.sin6_len = sizeof(fsa6);
3652                 fsa6.sin6_family = AF_INET6;
3653                 fsa6.sin6_addr = ip6->ip6_dst;
3654                 fsa6.sin6_port = sh->dest_port;
3655                 printf("src: ");
3656                 sctp_print_address((struct sockaddr *)&lsa6);
3657                 printf("dest: ");
3658                 sctp_print_address((struct sockaddr *)&fsa6);
3659         }
3660 }
3661
3662 #if defined(HAVE_SCTP_SO_LASTRECORD)
3663
3664 /* cloned from uipc_socket.c */
3665
3666 #define SCTP_SBLINKRECORD(sb, m0) do {                                  \
3667         if ((sb)->sb_lastrecord != NULL)                                \
3668                 (sb)->sb_lastrecord->m_nextpkt = (m0);                  \
3669         else                                                            \
3670                 (sb)->sb_mb = (m0);                                     \
3671         (sb)->sb_lastrecord = (m0);                                     \
3672 } while (/*CONSTCOND*/0)
3673 #endif
3674
3675 void
3676 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
3677     struct sctp_inpcb *new_inp,
3678     struct sctp_tcb *stcb)
3679 {
3680         /*
3681          * go through our old INP and pull off any control structures that
3682          * belong to stcb and move then to the new inp.
3683          */
3684         struct socket *old_so, *new_so;
3685         struct sctp_queued_to_read *control, *nctl;
3686         struct sctp_readhead tmp_queue;
3687         struct mbuf *m;
3688         int error;
3689
3690         old_so = old_inp->sctp_socket;
3691         new_so = new_inp->sctp_socket;
3692         TAILQ_INIT(&tmp_queue);
3693
3694         SOCKBUF_LOCK(&(old_so->so_rcv));
3695
3696         error = sblock(&old_so->so_rcv, 0);
3697
3698         SOCKBUF_UNLOCK(&(old_so->so_rcv));
3699         if (error) {
3700                 /*
3701                  * Gak, can't get sblock, we have a problem. data will be
3702                  * left stranded.. and we don't dare look at it since the
3703                  * other thread may be reading something. Oh well, its a
3704                  * screwed up app that does a peeloff OR a accept while
3705                  * reading from the main socket... actually its only the
3706                  * peeloff() case, since I think read will fail on a
3707                  * listening socket..
3708                  */
3709                 return;
3710         }
3711         /* lock the socket buffers */
3712         SCTP_INP_READ_LOCK(old_inp);
3713         control = TAILQ_FIRST(&old_inp->read_queue);
3714         /* Pull off all for out target stcb */
3715         while (control) {
3716                 nctl = TAILQ_NEXT(control, next);
3717                 if (control->stcb == stcb) {
3718                         /* remove it we want it */
3719                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
3720                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
3721                         m = control->data;
3722                         while (m) {
3723 #ifdef SCTP_SB_LOGGING
3724                                 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
3725 #endif
3726                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
3727 #ifdef SCTP_SB_LOGGING
3728                                 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3729 #endif
3730                                 m = m->m_next;
3731                         }
3732                 }
3733                 control = nctl;
3734         }
3735         SCTP_INP_READ_UNLOCK(old_inp);
3736
3737         /* Remove the sb-lock on the old socket */
3738         SOCKBUF_LOCK(&(old_so->so_rcv));
3739
3740         sbunlock(&old_so->so_rcv);
3741         SOCKBUF_UNLOCK(&(old_so->so_rcv));
3742
3743         /* Now we move them over to the new socket buffer */
3744         control = TAILQ_FIRST(&tmp_queue);
3745         SCTP_INP_READ_LOCK(new_inp);
3746         while (control) {
3747                 nctl = TAILQ_NEXT(control, next);
3748                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
3749                 m = control->data;
3750                 while (m) {
3751 #ifdef SCTP_SB_LOGGING
3752                         sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m->m_len);
3753 #endif
3754                         sctp_sballoc(stcb, &new_so->so_rcv, m);
3755 #ifdef SCTP_SB_LOGGING
3756                         sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3757 #endif
3758                         m = m->m_next;
3759                 }
3760                 control = nctl;
3761         }
3762         SCTP_INP_READ_UNLOCK(new_inp);
3763 }
3764
3765
3766 void
3767 sctp_add_to_readq(struct sctp_inpcb *inp,
3768     struct sctp_tcb *stcb,
3769     struct sctp_queued_to_read *control,
3770     struct sockbuf *sb,
3771     int end)
3772 {
3773         /*
3774          * Here we must place the control on the end of the socket read
3775          * queue AND increment sb_cc so that select will work properly on
3776          * read.
3777          */
3778         struct mbuf *m, *prev = NULL;
3779
3780         if (inp == NULL) {
3781                 /* Gak, TSNH!! */
3782 #ifdef INVARIENTS
3783                 panic("Gak, inp NULL on add_to_readq");
3784 #endif
3785                 return;
3786         }
3787         SCTP_INP_READ_LOCK(inp);
3788         m = control->data;
3789         control->held_length = 0;
3790         control->length = 0;
3791         while (m) {
3792                 if (m->m_len == 0) {
3793                         /* Skip mbufs with NO length */
3794                         if (prev == NULL) {
3795                                 /* First one */
3796                                 control->data = sctp_m_free(m);
3797                                 m = control->data;
3798                         } else {
3799                                 prev->m_next = sctp_m_free(m);
3800                                 m = prev->m_next;
3801                         }
3802                         if (m == NULL) {
3803                                 control->tail_mbuf = prev;;
3804                         }
3805                         continue;
3806                 }
3807                 prev = m;
3808 #ifdef SCTP_SB_LOGGING
3809                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m->m_len);
3810 #endif
3811                 sctp_sballoc(stcb, sb, m);
3812 #ifdef SCTP_SB_LOGGING
3813                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3814 #endif
3815                 atomic_add_int(&control->length, m->m_len);
3816                 m = m->m_next;
3817         }
3818         if (prev != NULL) {
3819                 control->tail_mbuf = prev;
3820                 if (end) {
3821                         prev->m_flags |= M_EOR;
3822                 }
3823         } else {
3824                 return;
3825         }
3826         if (end) {
3827                 control->end_added = 1;
3828         }
3829         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
3830         SCTP_INP_READ_UNLOCK(inp);
3831         if (inp && inp->sctp_socket) {
3832                 sctp_sorwakeup(inp, inp->sctp_socket);
3833         }
3834 }
3835
3836
3837 int
3838 sctp_append_to_readq(struct sctp_inpcb *inp,
3839     struct sctp_tcb *stcb,
3840     struct sctp_queued_to_read *control,
3841     struct mbuf *m,
3842     int end,
3843     int ctls_cumack,
3844     struct sockbuf *sb)
3845 {
3846         /*
3847          * A partial delivery API event is underway. OR we are appending on
3848          * the reassembly queue.
3849          *
3850          * If PDAPI this means we need to add m to the end of the data.
3851          * Increase the length in the control AND increment the sb_cc.
3852          * Otherwise sb is NULL and all we need to do is put it at the end
3853          * of the mbuf chain.
3854          */
3855         int len = 0;
3856         struct mbuf *mm, *tail = NULL, *prev = NULL;
3857
3858         if (inp) {
3859                 SCTP_INP_READ_LOCK(inp);
3860         }
3861         if (control == NULL) {
3862 get_out:
3863                 if (inp) {
3864                         SCTP_INP_READ_UNLOCK(inp);
3865                 }
3866                 return (-1);
3867         }
3868         if ((control->tail_mbuf) &&
3869             (control->tail_mbuf->m_flags & M_EOR)) {
3870                 /* huh this one is complete? */
3871                 goto get_out;
3872         }
3873         mm = m;
3874         if (mm == NULL) {
3875                 goto get_out;
3876         }
3877         while (mm) {
3878                 if (mm->m_len == 0) {
3879                         /* Skip mbufs with NO lenght */
3880                         if (prev == NULL) {
3881                                 /* First one */
3882                                 m = sctp_m_free(mm);
3883                                 mm = m;
3884                         } else {
3885                                 prev->m_next = sctp_m_free(mm);
3886                                 mm = prev->m_next;
3887                         }
3888                         continue;
3889                 }
3890                 prev = mm;
3891                 len += mm->m_len;
3892                 if (sb) {
3893 #ifdef SCTP_SB_LOGGING
3894                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, mm->m_len);
3895 #endif
3896                         sctp_sballoc(stcb, sb, mm);
3897 #ifdef SCTP_SB_LOGGING
3898                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3899 #endif
3900                 }
3901                 mm = mm->m_next;
3902         }
3903         if (prev) {
3904                 tail = prev;
3905         } else {
3906                 /* Really there should always be a prev */
3907                 if (m == NULL) {
3908                         /* Huh nothing left? */
3909 #ifdef INVARIENTS
3910                         panic("Nothing left to add?");
3911 #else
3912                         goto get_out;
3913 #endif
3914                 }
3915                 tail = m;
3916         }
3917         if (end) {
3918                 /* message is complete */
3919                 tail->m_flags |= M_EOR;
3920                 if (control == stcb->asoc.control_pdapi) {
3921                         stcb->asoc.control_pdapi = NULL;
3922                 }
3923                 control->held_length = 0;
3924                 control->end_added = 1;
3925         }
3926         atomic_add_int(&control->length, len);
3927         if (control->tail_mbuf) {
3928                 /* append */
3929                 control->tail_mbuf->m_next = m;
3930                 control->tail_mbuf = tail;
3931         } else {
3932                 /* nothing there */
3933 #ifdef INVARIENTS
3934                 if (control->data != NULL) {
3935                         panic("This should NOT happen");
3936                 }
3937 #endif
3938                 control->data = m;
3939                 control->tail_mbuf = tail;
3940         }
3941         /*
3942          * When we are appending in partial delivery, the cum-ack is used
3943          * for the actual pd-api highest tsn on this mbuf. The true cum-ack
3944          * is populated in the outbound sinfo structure from the true cumack
3945          * if the association exists...
3946          */
3947         control->sinfo_tsn = control->sinfo_cumtsn = ctls_cumack;
3948         if (inp) {
3949                 SCTP_INP_READ_UNLOCK(inp);
3950         }
3951         if (inp && inp->sctp_socket) {
3952                 sctp_sorwakeup(inp, inp->sctp_socket);
3953         }
3954         return (0);
3955 }
3956
3957
3958
3959 /*************HOLD THIS COMMENT FOR PATCH FILE OF
3960  *************ALTERNATE ROUTING CODE
3961  */
3962
3963 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
3964  *************ALTERNATE ROUTING CODE
3965  */
3966
3967 struct mbuf *
3968 sctp_generate_invmanparam(int err)
3969 {
3970         /* Return a MBUF with a invalid mandatory parameter */
3971         struct mbuf *m;
3972
3973         m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_DONTWAIT, 1, MT_DATA);
3974         if (m) {
3975                 struct sctp_paramhdr *ph;
3976
3977                 m->m_len = sizeof(struct sctp_paramhdr);
3978                 ph = mtod(m, struct sctp_paramhdr *);
3979                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
3980                 ph->param_type = htons(err);
3981         }
3982         return (m);
3983 }
3984
3985 #ifdef SCTP_MBCNT_LOGGING
3986 void
3987 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
3988     struct sctp_tmit_chunk *tp1, int chk_cnt)
3989 {
3990         if (tp1->data == NULL) {
3991                 return;
3992         }
3993         asoc->chunks_on_out_queue -= chk_cnt;
3994         sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
3995             asoc->total_output_queue_size,
3996             tp1->book_size,
3997             0,
3998             tp1->mbcnt);
3999         if (asoc->total_output_queue_size >= tp1->book_size) {
4000                 asoc->total_output_queue_size -= tp1->book_size;
4001         } else {
4002                 asoc->total_output_queue_size = 0;
4003         }
4004
4005         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4006             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4007                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4008                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4009                 } else {
4010                         stcb->sctp_socket->so_snd.sb_cc = 0;
4011
4012                 }
4013         }
4014 }
4015
4016 #endif
4017
4018 int
4019 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4020     int reason, struct sctpchunk_listhead *queue)
4021 {
4022         int ret_sz = 0;
4023         int notdone;
4024         uint8_t foundeom = 0;
4025
4026         do {
4027                 ret_sz += tp1->book_size;
4028                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4029                 if (tp1->data) {
4030                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4031                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1);
4032                         sctp_m_freem(tp1->data);
4033                         tp1->data = NULL;
4034                         sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4035                 }
4036                 if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4037                         stcb->asoc.sent_queue_cnt_removeable--;
4038                 }
4039                 if (queue == &stcb->asoc.send_queue) {
4040                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4041                         /* on to the sent queue */
4042                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4043                             sctp_next);
4044                         stcb->asoc.sent_queue_cnt++;
4045                 }
4046                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4047                     SCTP_DATA_NOT_FRAG) {
4048                         /* not frag'ed we ae done   */
4049                         notdone = 0;
4050                         foundeom = 1;
4051                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4052                         /* end of frag, we are done */
4053                         notdone = 0;
4054                         foundeom = 1;
4055                 } else {
4056                         /*
4057                          * Its a begin or middle piece, we must mark all of
4058                          * it
4059                          */
4060                         notdone = 1;
4061                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4062                 }
4063         } while (tp1 && notdone);
4064         if ((foundeom == 0) && (queue == &stcb->asoc.sent_queue)) {
4065                 /*
4066                  * The multi-part message was scattered across the send and
4067                  * sent queue.
4068                  */
4069                 tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
4070                 /*
4071                  * recurse throught the send_queue too, starting at the
4072                  * beginning.
4073                  */
4074                 if (tp1) {
4075                         ret_sz += sctp_release_pr_sctp_chunk(stcb, tp1, reason,
4076                             &stcb->asoc.send_queue);
4077                 } else {
4078                         printf("hmm, nothing on the send queue and no EOM?\n");
4079                 }
4080         }
4081         return (ret_sz);
4082 }
4083
4084 /*
4085  * checks to see if the given address, sa, is one that is currently known by
4086  * the kernel note: can't distinguish the same address on multiple interfaces
4087  * and doesn't handle multiple addresses with different zone/scope id's note:
4088  * ifa_ifwithaddr() compares the entire sockaddr struct
4089  */
4090 struct ifaddr *
4091 sctp_find_ifa_by_addr(struct sockaddr *sa)
4092 {
4093         struct ifnet *ifn;
4094         struct ifaddr *ifa;
4095
4096         /* go through all our known interfaces */
4097         TAILQ_FOREACH(ifn, &ifnet, if_list) {
4098                 /* go through each interface addresses */
4099                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
4100                         /* correct family? */
4101                         if (ifa->ifa_addr->sa_family != sa->sa_family)
4102                                 continue;
4103
4104 #ifdef INET6
4105                         if (ifa->ifa_addr->sa_family == AF_INET6) {
4106                                 /* IPv6 address */
4107                                 struct sockaddr_in6 *sin1, *sin2, sin6_tmp;
4108
4109                                 sin1 = (struct sockaddr_in6 *)ifa->ifa_addr;
4110                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin1->sin6_addr)) {
4111                                         /* create a copy and clear scope */
4112                                         memcpy(&sin6_tmp, sin1,
4113                                             sizeof(struct sockaddr_in6));
4114                                         sin1 = &sin6_tmp;
4115                                         in6_clearscope(&sin1->sin6_addr);
4116                                 }
4117                                 sin2 = (struct sockaddr_in6 *)sa;
4118                                 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr,
4119                                     sizeof(struct in6_addr)) == 0) {
4120                                         /* found it */
4121                                         return (ifa);
4122                                 }
4123                         } else
4124 #endif
4125                         if (ifa->ifa_addr->sa_family == AF_INET) {
4126                                 /* IPv4 address */
4127                                 struct sockaddr_in *sin1, *sin2;
4128
4129                                 sin1 = (struct sockaddr_in *)ifa->ifa_addr;
4130                                 sin2 = (struct sockaddr_in *)sa;
4131                                 if (sin1->sin_addr.s_addr ==
4132                                     sin2->sin_addr.s_addr) {
4133                                         /* found it */
4134                                         return (ifa);
4135                                 }
4136                         }
4137                         /* else, not AF_INET or AF_INET6, so skip */
4138                 }               /* end foreach ifa */
4139         }                       /* end foreach ifn */
4140         /* not found! */
4141         return (NULL);
4142 }
4143
4144
4145
4146
4147
4148
4149
4150
4151 static void
4152 sctp_user_rcvd(struct sctp_tcb *stcb, int *freed_so_far, int hold_rlock,
4153     uint32_t rwnd_req)
4154 {
4155         /* User pulled some data, do we need a rwnd update? */
4156         int r_unlocked = 0;
4157         uint32_t dif, rwnd;
4158         struct socket *so = NULL;
4159
4160         if (stcb == NULL)
4161                 return;
4162
4163         atomic_add_int(&stcb->asoc.refcnt, 1);
4164
4165         if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4166                 /* Pre-check If we are freeing no update */
4167                 goto no_lock;
4168         }
4169         SCTP_INP_INCR_REF(stcb->sctp_ep);
4170         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4171             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4172                 goto out;
4173         }
4174         so = stcb->sctp_socket;
4175         if (so == NULL) {
4176                 goto out;
4177         }
4178         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
4179         /* Have you have freed enough to look */
4180 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4181         sctp_misc_ints(SCTP_ENTER_USER_RECV,
4182             (stcb->asoc.my_rwnd - stcb->asoc.my_last_reported_rwnd),
4183             *freed_so_far,
4184             stcb->freed_by_sorcv_sincelast,
4185             rwnd_req);
4186 #endif
4187         *freed_so_far = 0;
4188         /* Yep, its worth a look and the lock overhead */
4189
4190         /* Figure out what the rwnd would be */
4191         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
4192         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
4193                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
4194         } else {
4195                 dif = 0;
4196         }
4197         if (dif >= rwnd_req) {
4198                 if (hold_rlock) {
4199                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
4200                         r_unlocked = 1;
4201                 }
4202                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4203                         /*
4204                          * One last check before we allow the guy possibly
4205                          * to get in. There is a race, where the guy has not
4206                          * reached the gate. In that case
4207                          */
4208                         goto out;
4209                 }
4210                 SCTP_TCB_LOCK(stcb);
4211                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4212                         /* No reports here */
4213                         SCTP_TCB_UNLOCK(stcb);
4214                         goto out;
4215                 }
4216 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4217                 sctp_misc_ints(SCTP_USER_RECV_SACKS,
4218                     stcb->asoc.my_rwnd,
4219                     stcb->asoc.my_last_reported_rwnd,
4220                     stcb->freed_by_sorcv_sincelast,
4221                     dif);
4222 #endif
4223                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
4224                 sctp_send_sack(stcb);
4225                 sctp_chunk_output(stcb->sctp_ep, stcb,
4226                     SCTP_OUTPUT_FROM_USR_RCVD);
4227                 /* make sure no timer is running */
4228                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL);
4229                 SCTP_TCB_UNLOCK(stcb);
4230         } else {
4231                 /* Update how much we have pending */
4232                 stcb->freed_by_sorcv_sincelast = dif;
4233 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4234                 sctp_misc_ints(SCTP_USER_RECV_SACKS,
4235                     stcb->asoc.my_rwnd,
4236                     stcb->asoc.my_last_reported_rwnd,
4237                     stcb->freed_by_sorcv_sincelast,
4238                     0);
4239 #endif
4240         }
4241 out:
4242         if (so && r_unlocked && hold_rlock) {
4243                 SCTP_STAT_INCR(sctps_locks_in_rcv);
4244                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
4245         }
4246         SCTP_INP_DECR_REF(stcb->sctp_ep);
4247 no_lock:
4248         atomic_add_int(&stcb->asoc.refcnt, -1);
4249         return;
4250 }
4251
4252 int
4253 sctp_sorecvmsg(struct socket *so,
4254     struct uio *uio,
4255     struct mbuf **mp,
4256     struct sockaddr *from,
4257     int fromlen,
4258     int *msg_flags,
4259     struct sctp_sndrcvinfo *sinfo,
4260     int filling_sinfo)
4261 {
4262         /*
4263          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
4264          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
4265          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
4266          * On the way out we may send out any combination of:
4267          * MSG_NOTIFICATION MSG_EOR
4268          *
4269          */
4270         struct sctp_inpcb *inp = NULL;
4271         int my_len = 0;
4272         int cp_len = 0, error = 0;
4273         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
4274         struct mbuf *m = NULL, *embuf = NULL;
4275         struct sctp_tcb *stcb = NULL;
4276         int wakeup_read_socket = 0;
4277         int freecnt_applied = 0;
4278         int out_flags = 0, in_flags = 0;
4279         int block_allowed = 1;
4280         int freed_so_far = 0;
4281         int copied_so_far = 0;
4282         int s, in_eeor_mode = 0;
4283         int no_rcv_needed = 0;
4284         uint32_t rwnd_req = 0;
4285         int hold_sblock = 0;
4286         int hold_rlock = 0;
4287         int alen = 0, slen = 0;
4288         int held_length = 0;
4289
4290         if (msg_flags) {
4291                 in_flags = *msg_flags;
4292         } else {
4293                 in_flags = 0;
4294         }
4295         slen = uio->uio_resid;
4296         /* Pull in and set up our int flags */
4297         if (in_flags & MSG_OOB) {
4298                 /* Out of band's NOT supported */
4299                 return (EOPNOTSUPP);
4300         }
4301         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
4302                 return (EINVAL);
4303         }
4304         if ((in_flags & (MSG_DONTWAIT
4305             | MSG_NBIO
4306             )) ||
4307             (so->so_state & SS_NBIO)) {
4308                 block_allowed = 0;
4309         }
4310         /* setup the endpoint */
4311         inp = (struct sctp_inpcb *)so->so_pcb;
4312         if (inp == NULL) {
4313                 return (EFAULT);
4314         }
4315         s = splnet();
4316         rwnd_req = (so->so_rcv.sb_hiwat >> SCTP_RWND_HIWAT_SHIFT);
4317         /* Must be at least a MTU's worth */
4318         if (rwnd_req < SCTP_MIN_RWND)
4319                 rwnd_req = SCTP_MIN_RWND;
4320         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
4321 #ifdef SCTP_RECV_RWND_LOGGING
4322         sctp_misc_ints(SCTP_SORECV_ENTER,
4323             rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid);
4324 #endif
4325         SOCKBUF_LOCK(&so->so_rcv);
4326         hold_sblock = 1;
4327 #ifdef SCTP_RECV_RWND_LOGGING
4328         sctp_misc_ints(SCTP_SORECV_ENTERPL,
4329             rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid);
4330 #endif
4331
4332
4333         error = sblock(&so->so_rcv, (block_allowed ? M_WAITOK : 0));
4334         if (error) {
4335                 goto release_unlocked;
4336         }
4337 restart:
4338         if (hold_sblock == 0) {
4339                 SOCKBUF_LOCK(&so->so_rcv);
4340                 hold_sblock = 1;
4341         }
4342         sbunlock(&so->so_rcv);
4343
4344 restart_nosblocks:
4345         if (hold_sblock == 0) {
4346                 SOCKBUF_LOCK(&so->so_rcv);
4347                 hold_sblock = 1;
4348         }
4349         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4350             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4351                 goto out;
4352         }
4353         if (so->so_error || so->so_rcv.sb_state & SBS_CANTRCVMORE) {
4354                 if (so->so_error) {
4355                         error = so->so_error;
4356                 } else {
4357                         error = ENOTCONN;
4358                 }
4359                 goto out;
4360         }
4361         if ((so->so_rcv.sb_cc <= held_length) && block_allowed) {
4362                 /* we need to wait for data */
4363 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4364                 sctp_misc_ints(SCTP_SORECV_BLOCKSA,
4365                     0, 0, so->so_rcv.sb_cc, uio->uio_resid);
4366 #endif
4367                 if ((so->so_rcv.sb_cc == 0) &&
4368                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4369                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
4370                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
4371                                 /*
4372                                  * For active open side clear flags for
4373                                  * re-use passive open is blocked by
4374                                  * connect.
4375                                  */
4376                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
4377                                         /*
4378                                          * You were aborted, passive side
4379                                          * always hits here
4380                                          */
4381                                         error = ECONNRESET;
4382                                         /*
4383                                          * You get this once if you are
4384                                          * active open side
4385                                          */
4386                                         if (!(inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4387                                                 /*
4388                                                  * Remove flag if on the
4389                                                  * active open side
4390                                                  */
4391                                                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAS_ABORTED;
4392                                         }
4393                                 }
4394                                 so->so_state &= ~(SS_ISCONNECTING |
4395                                     SS_ISDISCONNECTING |
4396                                     SS_ISCONFIRMING |
4397                                     SS_ISCONNECTED);
4398                                 if (error == 0) {
4399                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
4400                                                 error = ENOTCONN;
4401                                         } else {
4402                                                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAS_CONNECTED;
4403                                         }
4404                                 }
4405                                 goto out;
4406                         }
4407                 }
4408                 error = sbwait(&so->so_rcv);
4409                 if (error) {
4410                         goto out;
4411                 }
4412                 held_length = 0;
4413                 goto restart_nosblocks;
4414         } else if (so->so_rcv.sb_cc == 0) {
4415                 error = EWOULDBLOCK;
4416                 goto out;
4417         }
4418         error = sblock(&so->so_rcv, (block_allowed ? M_WAITOK : 0));
4419         /* we possibly have data we can read */
4420         control = TAILQ_FIRST(&inp->read_queue);
4421         if (control == NULL) {
4422                 /*
4423                  * This could be happening since the appender did the
4424                  * increment but as not yet did the tailq insert onto the
4425                  * read_queue
4426                  */
4427                 if (hold_rlock == 0) {
4428                         SCTP_INP_READ_LOCK(inp);
4429                         hold_rlock = 1;
4430                 }
4431                 control = TAILQ_FIRST(&inp->read_queue);
4432                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
4433 #ifdef INVARIENTS
4434                         panic("Huh, its non zero and nothing on control?");
4435 #endif
4436                         so->so_rcv.sb_cc = 0;
4437                 }
4438                 SCTP_INP_READ_UNLOCK(inp);
4439                 hold_rlock = 0;
4440                 goto restart;
4441         }
4442         if ((control->length == 0) &&
4443             (control->do_not_ref_stcb)) {
4444                 /*
4445                  * Clean up code for freeing assoc that left behind a
4446                  * pdapi.. maybe a peer in EEOR that just closed after
4447                  * sending and never indicated a EOR.
4448                  */
4449                 SCTP_STAT_INCR(sctps_locks_in_rcva);
4450                 if (hold_rlock == 0) {
4451                         hold_rlock = 1;
4452                         SCTP_INP_READ_LOCK(inp);
4453                 }
4454                 control->held_length = 0;
4455                 if (control->data) {
4456                         /* Hmm there is data here .. fix */
4457                         struct mbuf *m;
4458                         int cnt = 0;
4459
4460                         m = control->data;
4461                         while (m) {
4462                                 cnt += m->m_len;
4463                                 if (m->m_next == NULL) {
4464                                         control->tail_mbuf = m;
4465                                         m->m_flags |= M_EOR;
4466                                         control->end_added = 1;
4467                                 }
4468                                 m = m->m_next;
4469                         }
4470                         control->length = cnt;
4471                 } else {
4472                         /* remove it */
4473                         TAILQ_REMOVE(&inp->read_queue, control, next);
4474                         /* Add back any hiddend data */
4475                         sctp_free_remote_addr(control->whoFrom);
4476                         sctp_free_a_readq(stcb, control);
4477                 }
4478                 if (hold_rlock) {
4479                         hold_rlock = 0;
4480                         SCTP_INP_READ_UNLOCK(inp);
4481                 }
4482                 goto restart;
4483         }
4484         if (control->length == 0) {
4485                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
4486                     (filling_sinfo)) {
4487                         /* find a more suitable one then this */
4488                         ctl = TAILQ_NEXT(control, next);
4489                         while (ctl) {
4490                                 if ((ctl->stcb != control->stcb) && (ctl->length)) {
4491                                         /* found one */
4492                                         control = ctl;
4493                                         goto found_one;
4494                                 }
4495                                 ctl = TAILQ_NEXT(ctl, next);
4496                         }
4497                 }
4498                 /*
4499                  * if we reach here, not suitable replacement is available
4500                  * <or> fragment interleave is NOT on. So stuff the sb_cc
4501                  * into the our held count, and its time to sleep again.
4502                  */
4503                 held_length = so->so_rcv.sb_cc;
4504                 control->held_length = so->so_rcv.sb_cc;
4505                 goto restart;
4506         }
4507         /* Clear the held length since there is something to read */
4508         control->held_length = 0;
4509         if (hold_rlock) {
4510                 SCTP_INP_READ_UNLOCK(inp);
4511                 hold_rlock = 0;
4512         }
4513 found_one:
4514         /*
4515          * If we reach here, control has a some data for us to read off.
4516          * Note that stcb COULD be NULL.
4517          */
4518         if (hold_sblock) {
4519                 SOCKBUF_UNLOCK(&so->so_rcv);
4520                 hold_sblock = 0;
4521         }
4522         stcb = control->stcb;
4523         if (stcb) {
4524                 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
4525                     (control->do_not_ref_stcb == 0)) {
4526                         if (freecnt_applied == 0)
4527                                 stcb = NULL;
4528                 } else if (control->do_not_ref_stcb == 0) {
4529                         /* you can't free it on me please */
4530                         /*
4531                          * The lock on the socket buffer protects us so the
4532                          * free code will stop. But since we used the
4533                          * socketbuf lock and the sender uses the tcb_lock
4534                          * to increment, we need to use the atomic add to
4535                          * the refcnt
4536                          */
4537                         atomic_add_int(&stcb->asoc.refcnt, 1);
4538                         freecnt_applied = 1;
4539                         /*
4540                          * Setup to remember how much we have not yet told
4541                          * the peer our rwnd has opened up. Note we grab the
4542                          * value from the tcb from last time. Note too that
4543                          * sack sending clears this when a sack is sent..
4544                          * which is fine. Once we hit the rwnd_req, we then
4545                          * will go to the sctp_user_rcvd() that will not
4546                          * lock until it KNOWs it MUST send a WUP-SACK.
4547                          *
4548                          */
4549                         freed_so_far = stcb->freed_by_sorcv_sincelast;
4550                         stcb->freed_by_sorcv_sincelast = 0;
4551                 }
4552         }
4553         /* First lets get off the sinfo and sockaddr info */
4554         if ((sinfo) && filling_sinfo) {
4555                 memcpy(sinfo, control, sizeof(struct sctp_nonpad_sndrcvinfo));
4556                 nxt = TAILQ_NEXT(control, next);
4557                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO)) {
4558                         struct sctp_extrcvinfo *s_extra;
4559
4560                         s_extra = (struct sctp_extrcvinfo *)sinfo;
4561                         if (nxt) {
4562                                 s_extra->next_flags = SCTP_NEXT_MSG_AVAIL;
4563                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
4564                                         s_extra->next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
4565                                 }
4566                                 s_extra->next_asocid = nxt->sinfo_assoc_id;
4567                                 s_extra->next_length = nxt->length;
4568                                 s_extra->next_ppid = nxt->sinfo_ppid;
4569                                 s_extra->next_stream = nxt->sinfo_stream;
4570                                 if (nxt->tail_mbuf != NULL) {
4571                                         if (nxt->tail_mbuf->m_flags & M_EOR) {
4572                                                 s_extra->next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
4573                                         }
4574                                 }
4575                         } else {
4576                                 /*
4577                                  * we explicitly 0 this, since the memcpy
4578                                  * got some other things beyond the older
4579                                  * sinfo_ that is on the control's structure
4580                                  * :-D
4581                                  */
4582                                 s_extra->next_flags = SCTP_NO_NEXT_MSG;
4583                                 s_extra->next_asocid = 0;
4584                                 s_extra->next_length = 0;
4585                                 s_extra->next_ppid = 0;
4586                                 s_extra->next_stream = 0;
4587                         }
4588                 }
4589                 /*
4590                  * update off the real current cum-ack, if we have an stcb.
4591                  */
4592                 if (stcb)
4593                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
4594                 /*
4595                  * mask off the high bits, we keep the actual chunk bits in
4596                  * there.
4597                  */
4598                 sinfo->sinfo_flags &= 0x00ff;
4599         }
4600         if (fromlen && from) {
4601                 struct sockaddr *to;
4602
4603 #ifdef AF_INET
4604                 cp_len = min(fromlen, control->whoFrom->ro._l_addr.sin.sin_len);
4605                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
4606                 ((struct sockaddr_in *)from)->sin_port = control->port_from;
4607 #else
4608                 /* No AF_INET use AF_INET6 */
4609                 cp_len = min(fromlen, control->whoFrom->ro._l_addr.sin6.sin6_len);
4610                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
4611                 ((struct sockaddr_in6 *)from)->sin6_port = control->port_from;
4612 #endif
4613
4614                 to = from;
4615 #if defined(AF_INET) && defined(AF_INET6)
4616                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
4617                     (to->sa_family == AF_INET) &&
4618                     ((size_t)fromlen >= sizeof(struct sockaddr_in6))) {
4619                         struct sockaddr_in *sin;
4620                         struct sockaddr_in6 sin6;
4621
4622                         sin = (struct sockaddr_in *)to;
4623                         bzero(&sin6, sizeof(sin6));
4624                         sin6.sin6_family = AF_INET6;
4625                         sin6.sin6_len = sizeof(struct sockaddr_in6);
4626                         sin6.sin6_addr.s6_addr16[2] = 0xffff;
4627                         bcopy(&sin->sin_addr,
4628                             &sin6.sin6_addr.s6_addr16[3],
4629                             sizeof(sin6.sin6_addr.s6_addr16[3]));
4630                         sin6.sin6_port = sin->sin_port;
4631                         memcpy(from, (caddr_t)&sin6, sizeof(sin6));
4632                 }
4633 #endif
4634 #if defined(AF_INET6)
4635                 {
4636                         struct sockaddr_in6 lsa6, *to6;
4637
4638                         to6 = (struct sockaddr_in6 *)to;
4639                         sctp_recover_scope_mac(to6, (&lsa6));
4640
4641                 }
4642 #endif
4643         }
4644         /* now copy out what data we can */
4645         if (mp == NULL) {
4646                 /* copy out each mbuf in the chain up to length */
4647 get_more_data:
4648                 m = control->data;
4649                 while (m) {
4650                         /* Move out all we can */
4651                         cp_len = (int)uio->uio_resid;
4652                         my_len = (int)m->m_len;
4653                         if (cp_len > my_len) {
4654                                 /* not enough in this buf */
4655                                 cp_len = my_len;
4656                         }
4657                         if (hold_rlock) {
4658                                 SCTP_INP_READ_UNLOCK(inp);
4659                                 hold_rlock = 0;
4660                         }
4661                         splx(s);
4662                         if (cp_len > 0)
4663                                 error = uiomove(mtod(m, char *), cp_len, uio);
4664                         s = splnet();
4665 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4666                         sctp_misc_ints(SCTP_SORCV_DOESCPY,
4667                             so->so_rcv.sb_cc,
4668                             cp_len,
4669                             0,
4670                             0);
4671 #endif
4672                         /* re-read */
4673                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4674                                 goto release;
4675                         }
4676                         if (stcb &&
4677                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4678                                 no_rcv_needed = 1;
4679                         }
4680                         if (error) {
4681                                 /* error we are out of here */
4682                                 goto release;
4683                         }
4684                         if ((m->m_next == NULL) &&
4685                             (cp_len >= m->m_len) &&
4686                             ((control->end_added == 0) ||
4687                             (control->end_added && (TAILQ_NEXT(control, next) == NULL)))
4688                             ) {
4689 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4690                                 sctp_misc_ints(SCTP_SORCV_DOESLCK,
4691                                     so->so_rcv.sb_cc,
4692                                     cp_len,
4693                                     m->m_len,
4694                                     control->length);
4695 #endif
4696                                 SCTP_STAT_INCR(sctps_locks_in_rcvb);
4697                                 SCTP_INP_READ_LOCK(inp);
4698                                 hold_rlock = 1;
4699                         }
4700                         if (cp_len == m->m_len) {
4701 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4702                                 sctp_misc_ints(SCTP_SORCV_DOESADJ,
4703                                     so->so_rcv.sb_cc,
4704                                     control->length,
4705                                     cp_len,
4706                                     0);
4707 #endif
4708                                 if (m->m_flags & M_EOR) {
4709                                         out_flags |= MSG_EOR;
4710                                 }
4711                                 if (m->m_flags & M_NOTIFICATION) {
4712                                         out_flags |= MSG_NOTIFICATION;
4713                                 }
4714                                 /* we ate up the mbuf */
4715                                 if (in_flags & MSG_PEEK) {
4716                                         /* just looking */
4717                                         m = m->m_next;
4718                                         copied_so_far += cp_len;
4719                                 } else {
4720                                         /* dispose of the mbuf */
4721 #ifdef SCTP_SB_LOGGING
4722                                         sctp_sblog(&so->so_rcv,
4723                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
4724 #endif
4725                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
4726 #ifdef SCTP_SB_LOGGING
4727                                         sctp_sblog(&so->so_rcv,
4728                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4729 #endif
4730                                         embuf = m;
4731                                         copied_so_far += cp_len;
4732                                         freed_so_far += cp_len;
4733                                         alen = atomic_fetchadd_int(&control->length, -(cp_len));
4734                                         if (alen < cp_len) {
4735                                                 panic("Control length goes negative?");
4736                                         }
4737 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4738                                         sctp_misc_ints(SCTP_SORCV_PASSBF,
4739                                             so->so_rcv.sb_cc,
4740                                             control->length,
4741                                             0,
4742                                             0);
4743 #endif
4744                                         control->data = sctp_m_free(m);
4745                                         m = control->data;
4746                                         /*
4747                                          * been through it all, must hold sb
4748                                          * lock ok to null tail
4749                                          */
4750                                         if (control->data == NULL) {
4751 #ifdef INVARIENTS
4752                                                 if ((control->end_added == 0) ||
4753                                                     (TAILQ_NEXT(control, next) == NULL)) {
4754                                                         /*
4755                                                          * If the end is not
4756                                                          * added, OR the
4757                                                          * next is NOT null
4758                                                          * we MUST have the
4759                                                          * lock.
4760                                                          */
4761                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
4762                                                                 panic("Hmm we don't own the lock?");
4763                                                         }
4764                                                 }
4765 #endif
4766                                                 control->tail_mbuf = NULL;
4767 #ifdef INVARIENTS
4768                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
4769                                                         panic("end_added, nothing left and no MSG_EOR");
4770                                                 }
4771 #endif
4772                                         }
4773 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4774                                         sctp_misc_ints(SCTP_SORCV_ADJD,
4775                                             so->so_rcv.sb_cc,
4776                                             control->length,
4777                                             0,
4778                                             0);
4779 #endif
4780                                 }
4781                         } else {
4782                                 /* Do we need to trim the mbuf? */
4783                                 if (m->m_flags & M_NOTIFICATION) {
4784                                         out_flags |= MSG_NOTIFICATION;
4785                                 }
4786                                 if ((in_flags & MSG_PEEK) == 0) {
4787                                         if (out_flags & MSG_NOTIFICATION) {
4788                                                 /*
4789                                                  * remark this one with the
4790                                                  * notify flag, they read
4791                                                  * only part of the
4792                                                  * notification.
4793                                                  */
4794                                                 m->m_flags |= M_NOTIFICATION;
4795                                         }
4796                                         m->m_data += cp_len;
4797                                         m->m_len -= cp_len;
4798 #ifdef SCTP_SB_LOGGING
4799                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
4800 #endif
4801                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
4802                                         if (stcb) {
4803                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
4804                                         }
4805                                         copied_so_far += cp_len;
4806                                         embuf = m;
4807                                         freed_so_far += cp_len;
4808 #ifdef SCTP_SB_LOGGING
4809                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
4810                                             SCTP_LOG_SBRESULT, 0);
4811 #endif
4812                                         alen = atomic_fetchadd_int(&control->length, -(cp_len));
4813                                         if (alen < cp_len) {
4814                                                 panic("Control length goes negative2?");
4815                                         }
4816                                 } else {
4817                                         copied_so_far += cp_len;
4818                                 }
4819                         }
4820                         if ((out_flags & MSG_EOR) ||
4821                             (uio->uio_resid == 0)
4822                             ) {
4823                                 break;
4824                         }
4825                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
4826                             (control->do_not_ref_stcb == 0) &&
4827                             (freed_so_far >= rwnd_req)) {
4828                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
4829                         }
4830 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4831                         sctp_misc_ints(SCTP_SORCV_BOTWHILE,
4832                             so->so_rcv.sb_cc,
4833                             control->length,
4834                             0,
4835                             0);
4836 #endif
4837
4838                 }               /* end while(m) */
4839                 /*
4840                  * At this point we have looked at it all and we either have
4841                  * a MSG_EOR/or read all the user wants... <OR>
4842                  * control->length == 0.
4843                  */
4844                 if ((out_flags & MSG_EOR) &&
4845                     ((in_flags & MSG_PEEK) == 0)) {
4846                         /* we are done with this control */
4847                         if (control->length == 0) {
4848                                 if (control->data) {
4849 #ifdef INVARIENTS
4850                                         panic("control->data not null at read eor?");
4851 #else
4852                                         printf("Strange, data left in the control buffer .. invarients would panic?\n");
4853                                         sctp_m_freem(control->data);
4854                                         control->data = NULL;
4855 #endif
4856                                 }
4857                 done_with_control:
4858 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4859                                 sctp_misc_ints(SCTP_SORCV_FREECTL,
4860                                     so->so_rcv.sb_cc,
4861                                     0,
4862                                     0,
4863                                     0);
4864 #endif
4865                                 if (TAILQ_NEXT(control, next) == NULL) {
4866                                         /*
4867                                          * If we don't have a next we need a
4868                                          * lock, if there is a next interupt
4869                                          * is filling ahead of us and we
4870                                          * don't need a lock to remove this
4871                                          * guy (which is the head of the
4872                                          * queue).
4873                                          */
4874                                         if (hold_rlock == 0) {
4875                                                 SCTP_STAT_INCR(sctps_locks_in_rcvc);
4876                                                 SCTP_INP_READ_LOCK(inp);
4877                                                 hold_rlock = 1;
4878                                         }
4879                                 }
4880                                 TAILQ_REMOVE(&inp->read_queue, control, next);
4881                                 /* Add back any hiddend data */
4882                                 if (control->held_length) {
4883                                         held_length = 0;
4884                                         control->held_length = 0;
4885                                         wakeup_read_socket = 1;
4886                                 }
4887                                 no_rcv_needed = control->do_not_ref_stcb;
4888                                 sctp_free_remote_addr(control->whoFrom);
4889                                 control->data = NULL;
4890                                 sctp_free_a_readq(stcb, control);
4891                                 control = NULL;
4892                                 if ((freed_so_far >= rwnd_req) && (no_rcv_needed == 0))
4893                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
4894
4895                         } else {
4896                                 /*
4897                                  * The user did not read all of this
4898                                  * message, turn off the returned MSG_EOR
4899                                  * since we are leaving more behind on the
4900                                  * control to read.
4901                                  */
4902 #ifdef INVARIENTS
4903                                 if (control->end_added && (control->data == NULL) &&
4904                                     (control->tail_mbuf == NULL)) {
4905                                         panic("Gak, control->length is corrupt?");
4906                                 }
4907 #endif
4908                                 no_rcv_needed = control->do_not_ref_stcb;
4909                                 out_flags &= ~MSG_EOR;
4910                         }
4911                 }
4912                 if (out_flags & MSG_EOR) {
4913                         goto release;
4914                 }
4915                 if ((uio->uio_resid == 0) ||
4916                     ((in_eeor_mode) && (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))
4917                     ) {
4918                         goto release;
4919                 }
4920                 /*
4921                  * If I hit here the receiver wants more and this message is
4922                  * NOT done (pd-api). So two questions. Can we block? if not
4923                  * we are done. Did the user NOT set MSG_WAITALL?
4924                  */
4925                 if (block_allowed == 0) {
4926                         goto release;
4927                 }
4928                 /*
4929                  * We need to wait for more data a few things: - We don't
4930                  * sbunlock() so we don't get someone else reading. - We
4931                  * must be sure to account for the case where what is added
4932                  * is NOT to our control when we wakeup.
4933                  */
4934
4935                 /*
4936                  * Do we need to tell the transport a rwnd update might be
4937                  * needed before we go to sleep?
4938                  */
4939                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
4940                     ((freed_so_far >= rwnd_req) &&
4941                     (control->do_not_ref_stcb == 0) &&
4942                     (no_rcv_needed == 0))) {
4943                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
4944                 }
4945 wait_some_more:
4946                 if (so->so_error || so->so_rcv.sb_state & SBS_CANTRCVMORE) {
4947                         goto release;
4948                 }
4949                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
4950                         goto release;
4951
4952                 if (hold_rlock == 1) {
4953                         SCTP_INP_READ_UNLOCK(inp);
4954                         hold_rlock = 0;
4955                 }
4956                 if (hold_sblock == 0) {
4957                         SOCKBUF_LOCK(&so->so_rcv);
4958                         hold_sblock = 1;
4959                 }
4960 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4961                 if (stcb)
4962                         sctp_misc_ints(SCTP_SORECV_BLOCKSB,
4963                             freed_so_far,
4964                             stcb->asoc.my_rwnd,
4965                             so->so_rcv.sb_cc,
4966                             uio->uio_resid);
4967                 else
4968                         sctp_misc_ints(SCTP_SORECV_BLOCKSB,
4969                             freed_so_far,
4970                             0,
4971                             so->so_rcv.sb_cc,
4972                             uio->uio_resid);
4973 #endif
4974                 if (so->so_rcv.sb_cc <= control->held_length) {
4975                         error = sbwait(&so->so_rcv);
4976                         if (error) {
4977                                 goto release;
4978                         }
4979                         control->held_length = 0;
4980                 }
4981                 if (hold_sblock) {
4982                         SOCKBUF_UNLOCK(&so->so_rcv);
4983                         hold_sblock = 0;
4984                 }
4985                 if (control->length == 0) {
4986                         /* still nothing here */
4987                         if (control->end_added == 1) {
4988                                 /* he aborted, or is done i.e.did a shutdown */
4989                                 out_flags |= MSG_EOR;
4990                                 if (control->pdapi_aborted)
4991                                         out_flags |= MSG_TRUNC;
4992                                 goto done_with_control;
4993                         }
4994                         if (so->so_rcv.sb_cc > held_length) {
4995                                 SCTP_STAT_INCR(sctps_locks_in_rcvf);
4996                                 control->held_length = so->so_rcv.sb_cc;
4997                                 held_length = 0;
4998                         }
4999                         goto wait_some_more;
5000                 } else if (control->data == NULL) {
5001                         /*
5002                          * we must re-sync since data is probably being
5003                          * added
5004                          */
5005                         SCTP_INP_READ_LOCK(inp);
5006                         if ((control->length > 0) && (control->data == NULL)) {
5007                                 /*
5008                                  * big trouble.. we have the lock and its
5009                                  * corrupt?
5010                                  */
5011                                 panic("Impossible data==NULL length !=0");
5012                         }
5013                         SCTP_INP_READ_UNLOCK(inp);
5014                         /* We will fall around to get more data */
5015                 }
5016                 goto get_more_data;
5017         } else {
5018                 /* copy out the mbuf chain */
5019 get_more_data2:
5020                 /*
5021                  * Do we have a uio, I doubt it if so we grab the size from
5022                  * it, if not you get it all
5023                  */
5024                 if (uio)
5025                         cp_len = uio->uio_resid;
5026                 else
5027                         cp_len = control->length;
5028
5029                 if ((uint32_t) cp_len >= control->length) {
5030                         /* easy way */
5031                         if ((control->end_added == 0) ||
5032                             (TAILQ_NEXT(control, next) == NULL)) {
5033                                 /* Need to get rlock */
5034                                 if (hold_rlock == 0) {
5035                                         SCTP_INP_READ_LOCK(inp);
5036                                         hold_rlock = 1;
5037                                 }
5038                         }
5039                         if (control->tail_mbuf->m_flags & M_EOR) {
5040                                 out_flags |= MSG_EOR;
5041                         }
5042                         if (control->data->m_flags & M_NOTIFICATION) {
5043                                 out_flags |= MSG_NOTIFICATION;
5044                         }
5045                         if (uio)
5046                                 uio->uio_resid -= control->length;
5047                         *mp = control->data;
5048                         m = control->data;
5049                         while (m) {
5050 #ifdef SCTP_SB_LOGGING
5051                                 sctp_sblog(&so->so_rcv,
5052                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
5053 #endif
5054                                 sctp_sbfree(control, stcb, &so->so_rcv, m);
5055                                 freed_so_far += m->m_len;
5056 #ifdef SCTP_SB_LOGGING
5057                                 sctp_sblog(&so->so_rcv,
5058                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5059 #endif
5060                                 m = m->m_next;
5061                         }
5062                         control->data = control->tail_mbuf = NULL;
5063                         control->length = 0;
5064                         if (out_flags & MSG_EOR) {
5065                                 /* Done with this control */
5066                                 goto done_with_control;
5067                         }
5068                         /* still more to do with this conntrol */
5069                         /* do we really support msg_waitall here? */
5070                         if ((block_allowed == 0) ||
5071                             ((in_flags & MSG_WAITALL) == 0)) {
5072                                 goto release;
5073                         }
5074         wait_some_more2:
5075                         if (so->so_error || so->so_rcv.sb_state & SBS_CANTRCVMORE)
5076                                 goto release;
5077                         if (hold_rlock == 1) {
5078                                 SCTP_INP_READ_UNLOCK(inp);
5079                                 hold_rlock = 0;
5080                         }
5081                         if (hold_sblock == 0) {
5082                                 SOCKBUF_LOCK(&so->so_rcv);
5083                                 hold_sblock = 1;
5084                         }
5085                         if (so->so_rcv.sb_cc <= control->held_length) {
5086                                 error = sbwait(&so->so_rcv);
5087                                 if (error) {
5088                                         goto release;
5089                                 }
5090                         }
5091                         if (hold_sblock) {
5092                                 SOCKBUF_UNLOCK(&so->so_rcv);
5093                                 hold_sblock = 0;
5094                         }
5095                         if (control->length == 0) {
5096                                 /* still nothing here */
5097                                 if (control->end_added == 1) {
5098                                         /*
5099                                          * he aborted, or is done i.e.
5100                                          * shutdown
5101                                          */
5102                                         out_flags |= MSG_EOR;
5103                                         if (control->pdapi_aborted)
5104                                                 out_flags |= MSG_TRUNC;
5105                                         goto done_with_control;
5106                                 }
5107                                 if (so->so_rcv.sb_cc > held_length) {
5108                                         control->held_length = so->so_rcv.sb_cc;
5109                                         /*
5110                                          * We don't use held_length while
5111                                          * getting a message
5112                                          */
5113                                         held_length = 0;
5114                                 }
5115                                 goto wait_some_more2;
5116                         }
5117                         goto get_more_data2;
5118                 } else {
5119                         /* hard way mbuf by mbuf */
5120                         m = control->data;
5121                         if (control->end_added == 0) {
5122                                 /* need the rlock */
5123                                 if (hold_rlock == 0) {
5124                                         SCTP_INP_READ_LOCK(inp);
5125                                         hold_rlock = 1;
5126                                 }
5127                         }
5128                         if (m->m_flags & M_NOTIFICATION) {
5129                                 out_flags |= MSG_NOTIFICATION;
5130                         }
5131                         while ((m) && (cp_len > 0)) {
5132                                 if (cp_len >= m->m_len) {
5133                                         *mp = m;
5134                                         atomic_subtract_int(&control->length, m->m_len);
5135                                         if (uio)
5136                                                 uio->uio_resid -= m->m_len;
5137                                         cp_len -= m->m_len;
5138                                         control->data = m->m_next;
5139                                         m->m_next = NULL;
5140 #ifdef SCTP_SB_LOGGING
5141                                         sctp_sblog(&so->so_rcv,
5142                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
5143 #endif
5144                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5145                                         freed_so_far += m->m_len;
5146 #ifdef SCTP_SB_LOGGING
5147                                         sctp_sblog(&so->so_rcv,
5148                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5149 #endif
5150                                         mp = &m->m_next;
5151                                         m = control->data;
5152                                 } else {
5153                                         /*
5154                                          * got all he wants and its part of
5155                                          * this mbuf only.
5156                                          */
5157                                         if (uio)
5158                                                 uio->uio_resid -= m->m_len;
5159                                         cp_len -= m->m_len;
5160                                         if (hold_rlock) {
5161                                                 SCTP_INP_READ_UNLOCK(inp);
5162                                                 hold_rlock = 0;
5163                                         }
5164                                         if (hold_sblock) {
5165                                                 SOCKBUF_UNLOCK(&so->so_rcv);
5166                                                 hold_sblock = 0;
5167                                         }
5168                                         splx(s);
5169                                         *mp = sctp_m_copym(m, 0, cp_len,
5170                                             M_TRYWAIT
5171                                             );
5172                                         s = splnet();
5173 #ifdef SCTP_LOCK_LOGGING
5174                                         sctp_log_lock(inp, stcb, SCTP_LOG_LOCK_SOCKBUF_R);
5175 #endif
5176                                         if (hold_sblock == 0) {
5177                                                 SOCKBUF_LOCK(&so->so_rcv);
5178                                                 hold_sblock = 1;
5179                                         }
5180                                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5181                                                 goto release;
5182
5183                                         if (stcb &&
5184                                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5185                                                 no_rcv_needed = 1;
5186                                         }
5187                                         m->m_data += cp_len;
5188                                         m->m_len -= cp_len;
5189 #ifdef SCTP_SB_LOGGING
5190                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5191 #endif
5192                                         freed_so_far += cp_len;
5193                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5194                                         if (stcb) {
5195                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5196                                                 if ((freed_so_far >= rwnd_req) &&
5197                                                     (control->do_not_ref_stcb == 0) &&
5198                                                     (no_rcv_needed == 0))
5199                                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5200                                         }
5201 #ifdef SCTP_SB_LOGGING
5202                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5203                                             SCTP_LOG_SBRESULT, 0);
5204 #endif
5205                                         if (out_flags & MSG_NOTIFICATION) {
5206                                                 /*
5207                                                  * remark the first mbuf if
5208                                                  * they took a partial read.
5209                                                  */
5210                                                 control->data->m_flags |= M_NOTIFICATION;
5211                                         }
5212                                         goto release;
5213                                 }
5214                         }
5215                 }
5216         }
5217 release:
5218         if (hold_rlock == 1) {
5219                 SCTP_INP_READ_UNLOCK(inp);
5220                 hold_rlock = 0;
5221         }
5222         if (hold_sblock == 0) {
5223                 SOCKBUF_LOCK(&so->so_rcv);
5224                 hold_sblock = 1;
5225         }
5226         sbunlock(&so->so_rcv);
5227
5228 release_unlocked:
5229         if (hold_sblock) {
5230                 SOCKBUF_UNLOCK(&so->so_rcv);
5231                 hold_sblock = 0;
5232         }
5233         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
5234                 if ((freed_so_far >= rwnd_req) &&
5235                     (control && (control->do_not_ref_stcb == 0)) &&
5236                     (no_rcv_needed == 0))
5237                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5238         }
5239         if (msg_flags)
5240                 *msg_flags |= out_flags;
5241 out:
5242         if (hold_rlock == 1) {
5243                 SCTP_INP_READ_UNLOCK(inp);
5244                 hold_rlock = 0;
5245         }
5246         if (hold_sblock) {
5247                 SOCKBUF_UNLOCK(&so->so_rcv);
5248                 hold_sblock = 0;
5249         }
5250         if (freecnt_applied) {
5251                 /*
5252                  * The lock on the socket buffer protects us so the free
5253                  * code will stop. But since we used the socketbuf lock and
5254                  * the sender uses the tcb_lock to increment, we need to use
5255                  * the atomic add to the refcnt.
5256                  */
5257                 if (stcb == NULL) {
5258                         panic("stcb for refcnt has gone NULL?");
5259                 }
5260                 atomic_add_int(&stcb->asoc.refcnt, -1);
5261                 freecnt_applied = 0;
5262                 /* Save the value back for next time */
5263                 stcb->freed_by_sorcv_sincelast = freed_so_far;
5264         }
5265         splx(s);
5266 #ifdef SCTP_RECV_RWND_LOGGING
5267         if (stcb) {
5268                 sctp_misc_ints(SCTP_SORECV_DONE,
5269                     freed_so_far,
5270                     ((uio) ? (slen - uio->uio_resid) : slen),
5271                     stcb->asoc.my_rwnd,
5272                     so->so_rcv.sb_cc);
5273         } else {
5274                 sctp_misc_ints(SCTP_SORECV_DONE,
5275                     freed_so_far,
5276                     ((uio) ? (slen - uio->uio_resid) : slen),
5277                     0,
5278                     so->so_rcv.sb_cc);
5279         }
5280 #endif
5281         if (wakeup_read_socket) {
5282                 sctp_sorwakeup(inp, so);
5283         }
5284         return (error);
5285 }
5286
5287
5288 #ifdef SCTP_MBUF_LOGGING
5289 struct mbuf *
5290 sctp_m_free(struct mbuf *m)
5291 {
5292         if (m->m_flags & M_EXT) {
5293                 sctp_log_mb(m, SCTP_MBUF_IFREE);
5294         }
5295         return (m_free(m));
5296 }
5297
5298 void
5299 sctp_m_freem(struct mbuf *mb)
5300 {
5301         while (mb != NULL)
5302                 mb = sctp_m_free(mb);
5303 }
5304
5305 #endif
5306
5307
5308 int
5309 sctp_soreceive(so, psa, uio, mp0, controlp, flagsp)
5310         struct socket *so;
5311         struct sockaddr **psa;
5312         struct uio *uio;
5313         struct mbuf **mp0;
5314         struct mbuf **controlp;
5315         int *flagsp;
5316 {
5317         int error, fromlen;
5318         uint8_t sockbuf[256];
5319         struct sockaddr *from;
5320         struct sctp_extrcvinfo sinfo;
5321         int filling_sinfo = 1;
5322         struct sctp_inpcb *inp;
5323
5324         inp = (struct sctp_inpcb *)so->so_pcb;
5325         /* pickup the assoc we are reading from */
5326         if (inp == NULL) {
5327                 return (EINVAL);
5328         }
5329         if ((sctp_is_feature_off(inp,
5330             SCTP_PCB_FLAGS_RECVDATAIOEVNT)) ||
5331             (controlp == NULL)) {
5332                 /* user does not want the sndrcv ctl */
5333                 filling_sinfo = 0;
5334         }
5335         if (psa) {
5336                 from = (struct sockaddr *)sockbuf;
5337                 fromlen = sizeof(sockbuf);
5338                 from->sa_len = 0;
5339         } else {
5340                 from = NULL;
5341                 fromlen = 0;
5342         }
5343
5344         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
5345             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
5346         if ((controlp) && (filling_sinfo)) {
5347                 /* copy back the sinfo in a CMSG format */
5348                 if (filling_sinfo)
5349                         *controlp = sctp_build_ctl_nchunk(inp,
5350                             (struct sctp_sndrcvinfo *)&sinfo);
5351                 else
5352                         *controlp = NULL;
5353         }
5354         if (psa) {
5355                 /* copy back the address info */
5356                 if (from && from->sa_len) {
5357                         *psa = sodupsockaddr(from, M_NOWAIT);
5358                 } else {
5359                         *psa = NULL;
5360                 }
5361         }
5362         return (error);
5363 }