sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_pcb.h>
  38 #include <netinet/sctputil.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #ifdef INET6
  42 #include <netinet6/sctp6_var.h>
  43 #endif
  44 #include <netinet/sctp_header.h>
  45 #include <netinet/sctp_output.h>
  46 #include <netinet/sctp_uio.h>
  47 #include <netinet/sctp_timer.h>
  48 #include <netinet/sctp_indata.h>
  49 #include <netinet/sctp_auth.h>
  50 #include <netinet/sctp_asconf.h>
  51 #include <netinet/sctp_bsd_addr.h>
  52 #if defined(INET6) || defined(INET)
  53 #include <netinet/tcp_var.h>
  54 #endif
  55 #include <netinet/udp.h>
  56 #include <netinet/udp_var.h>
  57 #include <sys/proc.h>
  58 #ifdef INET6
  59 #include <netinet/icmp6.h>
  60 #endif
  61
  62
  63 #ifndef KTR_SCTP
  64 #define KTR_SCTP KTR_SUBSYS
  65 #endif
  66
  67 extern const struct sctp_cc_functions sctp_cc_functions[];
  68 extern const struct sctp_ss_functions sctp_ss_functions[];
  69
  70 void
  71 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  72 {
  73 #if defined(SCTP_LOCAL_TRACE_BUF)
  74         struct sctp_cwnd_log sctp_clog;
  75
  76         sctp_clog.x.sb.stcb = stcb;
  77         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  78         if (stcb)
  79                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  80         else
  81                 sctp_clog.x.sb.stcb_sbcc = 0;
  82         sctp_clog.x.sb.incr = incr;
  83         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  84             SCTP_LOG_EVENT_SB,
  85             from,
  86             sctp_clog.x.misc.log1,
  87             sctp_clog.x.misc.log2,
  88             sctp_clog.x.misc.log3,
  89             sctp_clog.x.misc.log4);
  90 #endif
  91 }
  92
  93 void
  94 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  95 {
  96 #if defined(SCTP_LOCAL_TRACE_BUF)
  97         struct sctp_cwnd_log sctp_clog;
  98
  99         sctp_clog.x.close.inp = (void *)inp;
 100         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
 101         if (stcb) {
 102                 sctp_clog.x.close.stcb = (void *)stcb;
 103                 sctp_clog.x.close.state = (uint16_t)stcb->asoc.state;
 104         } else {
 105                 sctp_clog.x.close.stcb = 0;
 106                 sctp_clog.x.close.state = 0;
 107         }
 108         sctp_clog.x.close.loc = loc;
 109         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 110             SCTP_LOG_EVENT_CLOSE,
 111             0,
 112             sctp_clog.x.misc.log1,
 113             sctp_clog.x.misc.log2,
 114             sctp_clog.x.misc.log3,
 115             sctp_clog.x.misc.log4);
 116 #endif
 117 }
 118
 119 void
 120 rto_logging(struct sctp_nets *net, int from)
 121 {
 122 #if defined(SCTP_LOCAL_TRACE_BUF)
 123         struct sctp_cwnd_log sctp_clog;
 124
 125         memset(&sctp_clog, 0, sizeof(sctp_clog));
 126         sctp_clog.x.rto.net = (void *)net;
 127         sctp_clog.x.rto.rtt = net->rtt / 1000;
 128         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 129             SCTP_LOG_EVENT_RTT,
 130             from,
 131             sctp_clog.x.misc.log1,
 132             sctp_clog.x.misc.log2,
 133             sctp_clog.x.misc.log3,
 134             sctp_clog.x.misc.log4);
 135 #endif
 136 }
 137
 138 void
 139 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 140 {
 141 #if defined(SCTP_LOCAL_TRACE_BUF)
 142         struct sctp_cwnd_log sctp_clog;
 143
 144         sctp_clog.x.strlog.stcb = stcb;
 145         sctp_clog.x.strlog.n_tsn = tsn;
 146         sctp_clog.x.strlog.n_sseq = sseq;
 147         sctp_clog.x.strlog.e_tsn = 0;
 148         sctp_clog.x.strlog.e_sseq = 0;
 149         sctp_clog.x.strlog.strm = stream;
 150         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 151             SCTP_LOG_EVENT_STRM,
 152             from,
 153             sctp_clog.x.misc.log1,
 154             sctp_clog.x.misc.log2,
 155             sctp_clog.x.misc.log3,
 156             sctp_clog.x.misc.log4);
 157 #endif
 158 }
 159
 160 void
 161 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 162 {
 163 #if defined(SCTP_LOCAL_TRACE_BUF)
 164         struct sctp_cwnd_log sctp_clog;
 165
 166         sctp_clog.x.nagle.stcb = (void *)stcb;
 167         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 168         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 169         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 170         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 171         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 172             SCTP_LOG_EVENT_NAGLE,
 173             action,
 174             sctp_clog.x.misc.log1,
 175             sctp_clog.x.misc.log2,
 176             sctp_clog.x.misc.log3,
 177             sctp_clog.x.misc.log4);
 178 #endif
 179 }
 180
 181 void
 182 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 183 {
 184 #if defined(SCTP_LOCAL_TRACE_BUF)
 185         struct sctp_cwnd_log sctp_clog;
 186
 187         sctp_clog.x.sack.cumack = cumack;
 188         sctp_clog.x.sack.oldcumack = old_cumack;
 189         sctp_clog.x.sack.tsn = tsn;
 190         sctp_clog.x.sack.numGaps = gaps;
 191         sctp_clog.x.sack.numDups = dups;
 192         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 193             SCTP_LOG_EVENT_SACK,
 194             from,
 195             sctp_clog.x.misc.log1,
 196             sctp_clog.x.misc.log2,
 197             sctp_clog.x.misc.log3,
 198             sctp_clog.x.misc.log4);
 199 #endif
 200 }
 201
 202 void
 203 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 204 {
 205 #if defined(SCTP_LOCAL_TRACE_BUF)
 206         struct sctp_cwnd_log sctp_clog;
 207
 208         memset(&sctp_clog, 0, sizeof(sctp_clog));
 209         sctp_clog.x.map.base = map;
 210         sctp_clog.x.map.cum = cum;
 211         sctp_clog.x.map.high = high;
 212         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 213             SCTP_LOG_EVENT_MAP,
 214             from,
 215             sctp_clog.x.misc.log1,
 216             sctp_clog.x.misc.log2,
 217             sctp_clog.x.misc.log3,
 218             sctp_clog.x.misc.log4);
 219 #endif
 220 }
 221
 222 void
 223 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 224 {
 225 #if defined(SCTP_LOCAL_TRACE_BUF)
 226         struct sctp_cwnd_log sctp_clog;
 227
 228         memset(&sctp_clog, 0, sizeof(sctp_clog));
 229         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 230         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 231         sctp_clog.x.fr.tsn = tsn;
 232         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 233             SCTP_LOG_EVENT_FR,
 234             from,
 235             sctp_clog.x.misc.log1,
 236             sctp_clog.x.misc.log2,
 237             sctp_clog.x.misc.log3,
 238             sctp_clog.x.misc.log4);
 239 #endif
 240 }
 241
 242 #ifdef SCTP_MBUF_LOGGING
 243 void
 244 sctp_log_mb(struct mbuf *m, int from)
 245 {
 246 #if defined(SCTP_LOCAL_TRACE_BUF)
 247         struct sctp_cwnd_log sctp_clog;
 248
 249         sctp_clog.x.mb.mp = m;
 250         sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m));
 251         sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m));
 252         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 253         if (SCTP_BUF_IS_EXTENDED(m)) {
 254                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 255                 sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m));
 256         } else {
 257                 sctp_clog.x.mb.ext = 0;
 258                 sctp_clog.x.mb.refcnt = 0;
 259         }
 260         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 261             SCTP_LOG_EVENT_MBUF,
 262             from,
 263             sctp_clog.x.misc.log1,
 264             sctp_clog.x.misc.log2,
 265             sctp_clog.x.misc.log3,
 266             sctp_clog.x.misc.log4);
 267 #endif
 268 }
 269
 270 void
 271 sctp_log_mbc(struct mbuf *m, int from)
 272 {
 273         struct mbuf *mat;
 274
 275         for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
 276                 sctp_log_mb(mat, from);
 277         }
 278 }
 279 #endif
 280
 281 void
 282 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 283 {
 284 #if defined(SCTP_LOCAL_TRACE_BUF)
 285         struct sctp_cwnd_log sctp_clog;
 286
 287         if (control == NULL) {
 288                 SCTP_PRINTF("Gak log of NULL?\n");
 289                 return;
 290         }
 291         sctp_clog.x.strlog.stcb = control->stcb;
 292         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 293         sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid;
 294         sctp_clog.x.strlog.strm = control->sinfo_stream;
 295         if (poschk != NULL) {
 296                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 297                 sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid;
 298         } else {
 299                 sctp_clog.x.strlog.e_tsn = 0;
 300                 sctp_clog.x.strlog.e_sseq = 0;
 301         }
 302         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 303             SCTP_LOG_EVENT_STRM,
 304             from,
 305             sctp_clog.x.misc.log1,
 306             sctp_clog.x.misc.log2,
 307             sctp_clog.x.misc.log3,
 308             sctp_clog.x.misc.log4);
 309 #endif
 310 }
 311
 312 void
 313 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 314 {
 315 #if defined(SCTP_LOCAL_TRACE_BUF)
 316         struct sctp_cwnd_log sctp_clog;
 317
 318         sctp_clog.x.cwnd.net = net;
 319         if (stcb->asoc.send_queue_cnt > 255)
 320                 sctp_clog.x.cwnd.cnt_in_send = 255;
 321         else
 322                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 323         if (stcb->asoc.stream_queue_cnt > 255)
 324                 sctp_clog.x.cwnd.cnt_in_str = 255;
 325         else
 326                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 327
 328         if (net) {
 329                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 330                 sctp_clog.x.cwnd.inflight = net->flight_size;
 331                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 332                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 333                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 334         }
 335         if (SCTP_CWNDLOG_PRESEND == from) {
 336                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 337         }
 338         sctp_clog.x.cwnd.cwnd_augment = augment;
 339         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 340             SCTP_LOG_EVENT_CWND,
 341             from,
 342             sctp_clog.x.misc.log1,
 343             sctp_clog.x.misc.log2,
 344             sctp_clog.x.misc.log3,
 345             sctp_clog.x.misc.log4);
 346 #endif
 347 }
 348
 349 void
 350 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 351 {
 352 #if defined(SCTP_LOCAL_TRACE_BUF)
 353         struct sctp_cwnd_log sctp_clog;
 354
 355         memset(&sctp_clog, 0, sizeof(sctp_clog));
 356         if (inp) {
 357                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 358
 359         } else {
 360                 sctp_clog.x.lock.sock = (void *)NULL;
 361         }
 362         sctp_clog.x.lock.inp = (void *)inp;
 363         if (stcb) {
 364                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 365         } else {
 366                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 367         }
 368         if (inp) {
 369                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 370                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 371         } else {
 372                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 373                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 374         }
 375         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 376         if (inp && (inp->sctp_socket)) {
 377                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 378                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 379                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 380         } else {
 381                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 382                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 383                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 384         }
 385         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 386             SCTP_LOG_LOCK_EVENT,
 387             from,
 388             sctp_clog.x.misc.log1,
 389             sctp_clog.x.misc.log2,
 390             sctp_clog.x.misc.log3,
 391             sctp_clog.x.misc.log4);
 392 #endif
 393 }
 394
 395 void
 396 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 397 {
 398 #if defined(SCTP_LOCAL_TRACE_BUF)
 399         struct sctp_cwnd_log sctp_clog;
 400
 401         memset(&sctp_clog, 0, sizeof(sctp_clog));
 402         sctp_clog.x.cwnd.net = net;
 403         sctp_clog.x.cwnd.cwnd_new_value = error;
 404         sctp_clog.x.cwnd.inflight = net->flight_size;
 405         sctp_clog.x.cwnd.cwnd_augment = burst;
 406         if (stcb->asoc.send_queue_cnt > 255)
 407                 sctp_clog.x.cwnd.cnt_in_send = 255;
 408         else
 409                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 410         if (stcb->asoc.stream_queue_cnt > 255)
 411                 sctp_clog.x.cwnd.cnt_in_str = 255;
 412         else
 413                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 414         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 415             SCTP_LOG_EVENT_MAXBURST,
 416             from,
 417             sctp_clog.x.misc.log1,
 418             sctp_clog.x.misc.log2,
 419             sctp_clog.x.misc.log3,
 420             sctp_clog.x.misc.log4);
 421 #endif
 422 }
 423
 424 void
 425 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 426 {
 427 #if defined(SCTP_LOCAL_TRACE_BUF)
 428         struct sctp_cwnd_log sctp_clog;
 429
 430         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 431         sctp_clog.x.rwnd.send_size = snd_size;
 432         sctp_clog.x.rwnd.overhead = overhead;
 433         sctp_clog.x.rwnd.new_rwnd = 0;
 434         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 435             SCTP_LOG_EVENT_RWND,
 436             from,
 437             sctp_clog.x.misc.log1,
 438             sctp_clog.x.misc.log2,
 439             sctp_clog.x.misc.log3,
 440             sctp_clog.x.misc.log4);
 441 #endif
 442 }
 443
 444 void
 445 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 446 {
 447 #if defined(SCTP_LOCAL_TRACE_BUF)
 448         struct sctp_cwnd_log sctp_clog;
 449
 450         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 451         sctp_clog.x.rwnd.send_size = flight_size;
 452         sctp_clog.x.rwnd.overhead = overhead;
 453         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 454         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 455             SCTP_LOG_EVENT_RWND,
 456             from,
 457             sctp_clog.x.misc.log1,
 458             sctp_clog.x.misc.log2,
 459             sctp_clog.x.misc.log3,
 460             sctp_clog.x.misc.log4);
 461 #endif
 462 }
 463
 464 #ifdef SCTP_MBCNT_LOGGING
 465 static void
 466 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 467 {
 468 #if defined(SCTP_LOCAL_TRACE_BUF)
 469         struct sctp_cwnd_log sctp_clog;
 470
 471         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 472         sctp_clog.x.mbcnt.size_change = book;
 473         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 474         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 475         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 476             SCTP_LOG_EVENT_MBCNT,
 477             from,
 478             sctp_clog.x.misc.log1,
 479             sctp_clog.x.misc.log2,
 480             sctp_clog.x.misc.log3,
 481             sctp_clog.x.misc.log4);
 482 #endif
 483 }
 484 #endif
 485
 486 void
 487 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 488 {
 489 #if defined(SCTP_LOCAL_TRACE_BUF)
 490         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 491             SCTP_LOG_MISC_EVENT,
 492             from,
 493             a, b, c, d);
 494 #endif
 495 }
 496
 497 void
 498 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 499 {
 500 #if defined(SCTP_LOCAL_TRACE_BUF)
 501         struct sctp_cwnd_log sctp_clog;
 502
 503         sctp_clog.x.wake.stcb = (void *)stcb;
 504         sctp_clog.x.wake.wake_cnt = wake_cnt;
 505         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 506         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 507         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 508
 509         if (stcb->asoc.stream_queue_cnt < 0xff)
 510                 sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt;
 511         else
 512                 sctp_clog.x.wake.stream_qcnt = 0xff;
 513
 514         if (stcb->asoc.chunks_on_out_queue < 0xff)
 515                 sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue;
 516         else
 517                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 518
 519         sctp_clog.x.wake.sctpflags = 0;
 520         /* set in the defered mode stuff */
 521         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 522                 sctp_clog.x.wake.sctpflags |= 1;
 523         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 524                 sctp_clog.x.wake.sctpflags |= 2;
 525         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 526                 sctp_clog.x.wake.sctpflags |= 4;
 527         /* what about the sb */
 528         if (stcb->sctp_socket) {
 529                 struct socket *so = stcb->sctp_socket;
 530
 531                 sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff));
 532         } else {
 533                 sctp_clog.x.wake.sbflags = 0xff;
 534         }
 535         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 536             SCTP_LOG_EVENT_WAKE,
 537             from,
 538             sctp_clog.x.misc.log1,
 539             sctp_clog.x.misc.log2,
 540             sctp_clog.x.misc.log3,
 541             sctp_clog.x.misc.log4);
 542 #endif
 543 }
 544
 545 void
 546 sctp_log_block(uint8_t from, struct sctp_association *asoc, size_t sendlen)
 547 {
 548 #if defined(SCTP_LOCAL_TRACE_BUF)
 549         struct sctp_cwnd_log sctp_clog;
 550
 551         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 552         sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt);
 553         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 554         sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt;
 555         sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue;
 556         sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024);
 557         sctp_clog.x.blk.sndlen = (uint32_t)sendlen;
 558         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 559             SCTP_LOG_EVENT_BLOCK,
 560             from,
 561             sctp_clog.x.misc.log1,
 562             sctp_clog.x.misc.log2,
 563             sctp_clog.x.misc.log3,
 564             sctp_clog.x.misc.log4);
 565 #endif
 566 }
 567
 568 int
 569 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 570 {
 571         /* May need to fix this if ktrdump does not work */
 572         return (0);
 573 }
 574
 575 #ifdef SCTP_AUDITING_ENABLED
 576 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 577 static int sctp_audit_indx = 0;
 578
 579 static
 580 void
 581 sctp_print_audit_report(void)
 582 {
 583         int i;
 584         int cnt;
 585
 586         cnt = 0;
 587         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 588                 if ((sctp_audit_data[i][0] == 0xe0) &&
 589                     (sctp_audit_data[i][1] == 0x01)) {
 590                         cnt = 0;
 591                         SCTP_PRINTF("\n");
 592                 } else if (sctp_audit_data[i][0] == 0xf0) {
 593                         cnt = 0;
 594                         SCTP_PRINTF("\n");
 595                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 596                     (sctp_audit_data[i][1] == 0x01)) {
 597                         SCTP_PRINTF("\n");
 598                         cnt = 0;
 599                 }
 600                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 601                     (uint32_t)sctp_audit_data[i][1]);
 602                 cnt++;
 603                 if ((cnt % 14) == 0)
 604                         SCTP_PRINTF("\n");
 605         }
 606         for (i = 0; i < sctp_audit_indx; i++) {
 607                 if ((sctp_audit_data[i][0] == 0xe0) &&
 608                     (sctp_audit_data[i][1] == 0x01)) {
 609                         cnt = 0;
 610                         SCTP_PRINTF("\n");
 611                 } else if (sctp_audit_data[i][0] == 0xf0) {
 612                         cnt = 0;
 613                         SCTP_PRINTF("\n");
 614                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 615                     (sctp_audit_data[i][1] == 0x01)) {
 616                         SCTP_PRINTF("\n");
 617                         cnt = 0;
 618                 }
 619                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 620                     (uint32_t)sctp_audit_data[i][1]);
 621                 cnt++;
 622                 if ((cnt % 14) == 0)
 623                         SCTP_PRINTF("\n");
 624         }
 625         SCTP_PRINTF("\n");
 626 }
 627
 628 void
 629 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 630     struct sctp_nets *net)
 631 {
 632         int resend_cnt, tot_out, rep, tot_book_cnt;
 633         struct sctp_nets *lnet;
 634         struct sctp_tmit_chunk *chk;
 635
 636         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 637         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 638         sctp_audit_indx++;
 639         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 640                 sctp_audit_indx = 0;
 641         }
 642         if (inp == NULL) {
 643                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 644                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 645                 sctp_audit_indx++;
 646                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 647                         sctp_audit_indx = 0;
 648                 }
 649                 return;
 650         }
 651         if (stcb == NULL) {
 652                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 653                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 654                 sctp_audit_indx++;
 655                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 656                         sctp_audit_indx = 0;
 657                 }
 658                 return;
 659         }
 660         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 661         sctp_audit_data[sctp_audit_indx][1] =
 662             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 663         sctp_audit_indx++;
 664         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 665                 sctp_audit_indx = 0;
 666         }
 667         rep = 0;
 668         tot_book_cnt = 0;
 669         resend_cnt = tot_out = 0;
 670         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 671                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 672                         resend_cnt++;
 673                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 674                         tot_out += chk->book_size;
 675                         tot_book_cnt++;
 676                 }
 677         }
 678         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 679                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 680                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 681                 sctp_audit_indx++;
 682                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 683                         sctp_audit_indx = 0;
 684                 }
 685                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 686                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 687                 rep = 1;
 688                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 689                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 690                 sctp_audit_data[sctp_audit_indx][1] =
 691                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 692                 sctp_audit_indx++;
 693                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 694                         sctp_audit_indx = 0;
 695                 }
 696         }
 697         if (tot_out != stcb->asoc.total_flight) {
 698                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 699                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 700                 sctp_audit_indx++;
 701                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 702                         sctp_audit_indx = 0;
 703                 }
 704                 rep = 1;
 705                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 706                     (int)stcb->asoc.total_flight);
 707                 stcb->asoc.total_flight = tot_out;
 708         }
 709         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 710                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 711                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 712                 sctp_audit_indx++;
 713                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 714                         sctp_audit_indx = 0;
 715                 }
 716                 rep = 1;
 717                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 718
 719                 stcb->asoc.total_flight_count = tot_book_cnt;
 720         }
 721         tot_out = 0;
 722         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 723                 tot_out += lnet->flight_size;
 724         }
 725         if (tot_out != stcb->asoc.total_flight) {
 726                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 727                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 728                 sctp_audit_indx++;
 729                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 730                         sctp_audit_indx = 0;
 731                 }
 732                 rep = 1;
 733                 SCTP_PRINTF("real flight:%d net total was %d\n",
 734                     stcb->asoc.total_flight, tot_out);
 735                 /* now corrective action */
 736                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 737
 738                         tot_out = 0;
 739                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 740                                 if ((chk->whoTo == lnet) &&
 741                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 742                                         tot_out += chk->book_size;
 743                                 }
 744                         }
 745                         if (lnet->flight_size != tot_out) {
 746                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 747                                     (void *)lnet, lnet->flight_size,
 748                                     tot_out);
 749                                 lnet->flight_size = tot_out;
 750                         }
 751                 }
 752         }
 753         if (rep) {
 754                 sctp_print_audit_report();
 755         }
 756 }
 757
 758 void
 759 sctp_audit_log(uint8_t ev, uint8_t fd)
 760 {
 761
 762         sctp_audit_data[sctp_audit_indx][0] = ev;
 763         sctp_audit_data[sctp_audit_indx][1] = fd;
 764         sctp_audit_indx++;
 765         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 766                 sctp_audit_indx = 0;
 767         }
 768 }
 769
 770 #endif
 771
 772 /*
 773  * sctp_stop_timers_for_shutdown() should be called
 774  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 775  * state to make sure that all timers are stopped.
 776  */
 777 void
 778 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 779 {
 780         struct sctp_association *asoc;
 781         struct sctp_nets *net;
 782
 783         asoc = &stcb->asoc;
 784
 785         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 786         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 787         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 788         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 789         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 790         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 791                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 792                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 793         }
 794 }
 795
 796 /*
 797  * A list of sizes based on typical mtu's, used only if next hop size not
 798  * returned. These values MUST be multiples of 4 and MUST be ordered.
 799  */
 800 static uint32_t sctp_mtu_sizes[] = {
 801         68,
 802         296,
 803         508,
 804         512,
 805         544,
 806         576,
 807         1004,
 808         1492,
 809         1500,
 810         1536,
 811         2000,
 812         2048,
 813         4352,
 814         4464,
 815         8166,
 816         17912,
 817         32000,
 818         65532
 819 };
 820
 821 /*
 822  * Return the largest MTU in sctp_mtu_sizes smaller than val.
 823  * If val is smaller than the minimum, just return the largest
 824  * multiple of 4 smaller or equal to val.
 825  * Ensure that the result is a multiple of 4.
 826  */
 827 uint32_t
 828 sctp_get_prev_mtu(uint32_t val)
 829 {
 830         uint32_t i;
 831
 832         val &= 0xfffffffc;
 833         if (val <= sctp_mtu_sizes[0]) {
 834                 return (val);
 835         }
 836         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 837                 if (val <= sctp_mtu_sizes[i]) {
 838                         break;
 839                 }
 840         }
 841         KASSERT((sctp_mtu_sizes[i - 1] & 0x00000003) == 0,
 842             ("sctp_mtu_sizes[%u] not a multiple of 4", i - 1));
 843         return (sctp_mtu_sizes[i - 1]);
 844 }
 845
 846 /*
 847  * Return the smallest MTU in sctp_mtu_sizes larger than val.
 848  * If val is larger than the maximum, just return the largest multiple of 4 smaller
 849  * or equal to val.
 850  * Ensure that the result is a multiple of 4.
 851  */
 852 uint32_t
 853 sctp_get_next_mtu(uint32_t val)
 854 {
 855         /* select another MTU that is just bigger than this one */
 856         uint32_t i;
 857
 858         val &= 0xfffffffc;
 859         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 860                 if (val < sctp_mtu_sizes[i]) {
 861                         KASSERT((sctp_mtu_sizes[i] & 0x00000003) == 0,
 862                             ("sctp_mtu_sizes[%u] not a multiple of 4", i));
 863                         return (sctp_mtu_sizes[i]);
 864                 }
 865         }
 866         return (val);
 867 }
 868
 869 void
 870 sctp_fill_random_store(struct sctp_pcb *m)
 871 {
 872         /*
 873          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 874          * our counter. The result becomes our good random numbers and we
 875          * then setup to give these out. Note that we do no locking to
 876          * protect this. This is ok, since if competing folks call this we
 877          * will get more gobbled gook in the random store which is what we
 878          * want. There is a danger that two guys will use the same random
 879          * numbers, but thats ok too since that is random as well :->
 880          */
 881         m->store_at = 0;
 882         (void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers,
 883             sizeof(m->random_numbers), (uint8_t *)&m->random_counter,
 884             sizeof(m->random_counter), (uint8_t *)m->random_store);
 885         m->random_counter++;
 886 }
 887
 888 uint32_t
 889 sctp_select_initial_TSN(struct sctp_pcb *inp)
 890 {
 891         /*
 892          * A true implementation should use random selection process to get
 893          * the initial stream sequence number, using RFC1750 as a good
 894          * guideline
 895          */
 896         uint32_t x, *xp;
 897         uint8_t *p;
 898         int store_at, new_store;
 899
 900         if (inp->initial_sequence_debug != 0) {
 901                 uint32_t ret;
 902
 903                 ret = inp->initial_sequence_debug;
 904                 inp->initial_sequence_debug++;
 905                 return (ret);
 906         }
 907 retry:
 908         store_at = inp->store_at;
 909         new_store = store_at + sizeof(uint32_t);
 910         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 911                 new_store = 0;
 912         }
 913         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 914                 goto retry;
 915         }
 916         if (new_store == 0) {
 917                 /* Refill the random store */
 918                 sctp_fill_random_store(inp);
 919         }
 920         p = &inp->random_store[store_at];
 921         xp = (uint32_t *)p;
 922         x = *xp;
 923         return (x);
 924 }
 925
 926 uint32_t
 927 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
 928 {
 929         uint32_t x;
 930         struct timeval now;
 931
 932         if (check) {
 933                 (void)SCTP_GETTIME_TIMEVAL(&now);
 934         }
 935         for (;;) {
 936                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 937                 if (x == 0) {
 938                         /* we never use 0 */
 939                         continue;
 940                 }
 941                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 942                         break;
 943                 }
 944         }
 945         return (x);
 946 }
 947
 948 int32_t
 949 sctp_map_assoc_state(int kernel_state)
 950 {
 951         int32_t user_state;
 952
 953         if (kernel_state & SCTP_STATE_WAS_ABORTED) {
 954                 user_state = SCTP_CLOSED;
 955         } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) {
 956                 user_state = SCTP_SHUTDOWN_PENDING;
 957         } else {
 958                 switch (kernel_state & SCTP_STATE_MASK) {
 959                 case SCTP_STATE_EMPTY:
 960                         user_state = SCTP_CLOSED;
 961                         break;
 962                 case SCTP_STATE_INUSE:
 963                         user_state = SCTP_CLOSED;
 964                         break;
 965                 case SCTP_STATE_COOKIE_WAIT:
 966                         user_state = SCTP_COOKIE_WAIT;
 967                         break;
 968                 case SCTP_STATE_COOKIE_ECHOED:
 969                         user_state = SCTP_COOKIE_ECHOED;
 970                         break;
 971                 case SCTP_STATE_OPEN:
 972                         user_state = SCTP_ESTABLISHED;
 973                         break;
 974                 case SCTP_STATE_SHUTDOWN_SENT:
 975                         user_state = SCTP_SHUTDOWN_SENT;
 976                         break;
 977                 case SCTP_STATE_SHUTDOWN_RECEIVED:
 978                         user_state = SCTP_SHUTDOWN_RECEIVED;
 979                         break;
 980                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
 981                         user_state = SCTP_SHUTDOWN_ACK_SENT;
 982                         break;
 983                 default:
 984                         user_state = SCTP_CLOSED;
 985                         break;
 986                 }
 987         }
 988         return (user_state);
 989 }
 990
 991 int
 992 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 993     uint32_t override_tag, uint32_t vrf_id, uint16_t o_strms)
 994 {
 995         struct sctp_association *asoc;
 996
 997         /*
 998          * Anything set to zero is taken care of by the allocation routine's
 999          * bzero
1000          */
1001
1002         /*
1003          * Up front select what scoping to apply on addresses I tell my peer
1004          * Not sure what to do with these right now, we will need to come up
1005          * with a way to set them. We may need to pass them through from the
1006          * caller in the sctp_aloc_assoc() function.
1007          */
1008         int i;
1009 #if defined(SCTP_DETAILED_STR_STATS)
1010         int j;
1011 #endif
1012
1013         asoc = &stcb->asoc;
1014         /* init all variables to a known value. */
1015         SCTP_SET_STATE(stcb, SCTP_STATE_INUSE);
1016         asoc->max_burst = inp->sctp_ep.max_burst;
1017         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
1018         asoc->heart_beat_delay = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
1019         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
1020         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
1021         asoc->ecn_supported = inp->ecn_supported;
1022         asoc->prsctp_supported = inp->prsctp_supported;
1023         asoc->idata_supported = inp->idata_supported;
1024         asoc->auth_supported = inp->auth_supported;
1025         asoc->asconf_supported = inp->asconf_supported;
1026         asoc->reconfig_supported = inp->reconfig_supported;
1027         asoc->nrsack_supported = inp->nrsack_supported;
1028         asoc->pktdrop_supported = inp->pktdrop_supported;
1029         asoc->idata_supported = inp->idata_supported;
1030         asoc->sctp_cmt_pf = (uint8_t)0;
1031         asoc->sctp_frag_point = inp->sctp_frag_point;
1032         asoc->sctp_features = inp->sctp_features;
1033         asoc->default_dscp = inp->sctp_ep.default_dscp;
1034         asoc->max_cwnd = inp->max_cwnd;
1035 #ifdef INET6
1036         if (inp->sctp_ep.default_flowlabel) {
1037                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
1038         } else {
1039                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
1040                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
1041                         asoc->default_flowlabel &= 0x000fffff;
1042                         asoc->default_flowlabel |= 0x80000000;
1043                 } else {
1044                         asoc->default_flowlabel = 0;
1045                 }
1046         }
1047 #endif
1048         asoc->sb_send_resv = 0;
1049         if (override_tag) {
1050                 asoc->my_vtag = override_tag;
1051         } else {
1052                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
1053         }
1054         /* Get the nonce tags */
1055         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1056         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1057         asoc->vrf_id = vrf_id;
1058
1059 #ifdef SCTP_ASOCLOG_OF_TSNS
1060         asoc->tsn_in_at = 0;
1061         asoc->tsn_out_at = 0;
1062         asoc->tsn_in_wrapped = 0;
1063         asoc->tsn_out_wrapped = 0;
1064         asoc->cumack_log_at = 0;
1065         asoc->cumack_log_atsnt = 0;
1066 #endif
1067 #ifdef SCTP_FS_SPEC_LOG
1068         asoc->fs_index = 0;
1069 #endif
1070         asoc->refcnt = 0;
1071         asoc->assoc_up_sent = 0;
1072         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1073             sctp_select_initial_TSN(&inp->sctp_ep);
1074         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1075         /* we are optimisitic here */
1076         asoc->peer_supports_nat = 0;
1077         asoc->sent_queue_retran_cnt = 0;
1078
1079         /* for CMT */
1080         asoc->last_net_cmt_send_started = NULL;
1081
1082         /* This will need to be adjusted */
1083         asoc->last_acked_seq = asoc->init_seq_number - 1;
1084         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1085         asoc->asconf_seq_in = asoc->last_acked_seq;
1086
1087         /* here we are different, we hold the next one we expect */
1088         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1089
1090         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
1091         asoc->initial_rto = inp->sctp_ep.initial_rto;
1092
1093         asoc->default_mtu = inp->sctp_ep.default_mtu;
1094         asoc->max_init_times = inp->sctp_ep.max_init_times;
1095         asoc->max_send_times = inp->sctp_ep.max_send_times;
1096         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
1097         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
1098         asoc->free_chunk_cnt = 0;
1099
1100         asoc->iam_blocking = 0;
1101         asoc->context = inp->sctp_context;
1102         asoc->local_strreset_support = inp->local_strreset_support;
1103         asoc->def_send = inp->def_send;
1104         asoc->delayed_ack = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1105         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
1106         asoc->pr_sctp_cnt = 0;
1107         asoc->total_output_queue_size = 0;
1108
1109         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1110                 asoc->scope.ipv6_addr_legal = 1;
1111                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
1112                         asoc->scope.ipv4_addr_legal = 1;
1113                 } else {
1114                         asoc->scope.ipv4_addr_legal = 0;
1115                 }
1116         } else {
1117                 asoc->scope.ipv6_addr_legal = 0;
1118                 asoc->scope.ipv4_addr_legal = 1;
1119         }
1120
1121         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1122         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1123
1124         asoc->smallest_mtu = inp->sctp_frag_point;
1125         asoc->minrto = inp->sctp_ep.sctp_minrto;
1126         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1127
1128         asoc->stream_locked_on = 0;
1129         asoc->ecn_echo_cnt_onq = 0;
1130         asoc->stream_locked = 0;
1131
1132         asoc->send_sack = 1;
1133
1134         LIST_INIT(&asoc->sctp_restricted_addrs);
1135
1136         TAILQ_INIT(&asoc->nets);
1137         TAILQ_INIT(&asoc->pending_reply_queue);
1138         TAILQ_INIT(&asoc->asconf_ack_sent);
1139         /* Setup to fill the hb random cache at first HB */
1140         asoc->hb_random_idx = 4;
1141
1142         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1143
1144         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1145         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1146
1147         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1148         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1149
1150         /*
1151          * Now the stream parameters, here we allocate space for all streams
1152          * that we request by default.
1153          */
1154         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1155             o_strms;
1156         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1157             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1158             SCTP_M_STRMO);
1159         if (asoc->strmout == NULL) {
1160                 /* big trouble no memory */
1161                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1162                 return (ENOMEM);
1163         }
1164         for (i = 0; i < asoc->streamoutcnt; i++) {
1165                 /*
1166                  * inbound side must be set to 0xffff, also NOTE when we get
1167                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1168                  * count (streamoutcnt) but first check if we sent to any of
1169                  * the upper streams that were dropped (if some were). Those
1170                  * that were dropped must be notified to the upper layer as
1171                  * failed to send.
1172                  */
1173                 asoc->strmout[i].next_mid_ordered = 0;
1174                 asoc->strmout[i].next_mid_unordered = 0;
1175                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1176                 asoc->strmout[i].chunks_on_queues = 0;
1177 #if defined(SCTP_DETAILED_STR_STATS)
1178                 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1179                         asoc->strmout[i].abandoned_sent[j] = 0;
1180                         asoc->strmout[i].abandoned_unsent[j] = 0;
1181                 }
1182 #else
1183                 asoc->strmout[i].abandoned_sent[0] = 0;
1184                 asoc->strmout[i].abandoned_unsent[0] = 0;
1185 #endif
1186                 asoc->strmout[i].sid = i;
1187                 asoc->strmout[i].last_msg_incomplete = 0;
1188                 asoc->strmout[i].state = SCTP_STREAM_OPENING;
1189                 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL);
1190         }
1191         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1192
1193         /* Now the mapping array */
1194         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1195         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1196             SCTP_M_MAP);
1197         if (asoc->mapping_array == NULL) {
1198                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1199                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1200                 return (ENOMEM);
1201         }
1202         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1203         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1204             SCTP_M_MAP);
1205         if (asoc->nr_mapping_array == NULL) {
1206                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1207                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1208                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1209                 return (ENOMEM);
1210         }
1211         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1212
1213         /* Now the init of the other outqueues */
1214         TAILQ_INIT(&asoc->free_chunks);
1215         TAILQ_INIT(&asoc->control_send_queue);
1216         TAILQ_INIT(&asoc->asconf_send_queue);
1217         TAILQ_INIT(&asoc->send_queue);
1218         TAILQ_INIT(&asoc->sent_queue);
1219         TAILQ_INIT(&asoc->resetHead);
1220         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1221         TAILQ_INIT(&asoc->asconf_queue);
1222         /* authentication fields */
1223         asoc->authinfo.random = NULL;
1224         asoc->authinfo.active_keyid = 0;
1225         asoc->authinfo.assoc_key = NULL;
1226         asoc->authinfo.assoc_keyid = 0;
1227         asoc->authinfo.recv_key = NULL;
1228         asoc->authinfo.recv_keyid = 0;
1229         LIST_INIT(&asoc->shared_keys);
1230         asoc->marked_retrans = 0;
1231         asoc->port = inp->sctp_ep.port;
1232         asoc->timoinit = 0;
1233         asoc->timodata = 0;
1234         asoc->timosack = 0;
1235         asoc->timoshutdown = 0;
1236         asoc->timoheartbeat = 0;
1237         asoc->timocookie = 0;
1238         asoc->timoshutdownack = 0;
1239         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1240         asoc->discontinuity_time = asoc->start_time;
1241         for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1242                 asoc->abandoned_unsent[i] = 0;
1243                 asoc->abandoned_sent[i] = 0;
1244         }
1245         /*
1246          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1247          * freed later when the association is freed.
1248          */
1249         return (0);
1250 }
1251
1252 void
1253 sctp_print_mapping_array(struct sctp_association *asoc)
1254 {
1255         unsigned int i, limit;
1256
1257         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1258             asoc->mapping_array_size,
1259             asoc->mapping_array_base_tsn,
1260             asoc->cumulative_tsn,
1261             asoc->highest_tsn_inside_map,
1262             asoc->highest_tsn_inside_nr_map);
1263         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1264                 if (asoc->mapping_array[limit - 1] != 0) {
1265                         break;
1266                 }
1267         }
1268         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1269         for (i = 0; i < limit; i++) {
1270                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1271         }
1272         if (limit % 16)
1273                 SCTP_PRINTF("\n");
1274         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1275                 if (asoc->nr_mapping_array[limit - 1]) {
1276                         break;
1277                 }
1278         }
1279         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1280         for (i = 0; i < limit; i++) {
1281                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1282         }
1283         if (limit % 16)
1284                 SCTP_PRINTF("\n");
1285 }
1286
1287 int
1288 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1289 {
1290         /* mapping array needs to grow */
1291         uint8_t *new_array1, *new_array2;
1292         uint32_t new_size;
1293
1294         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1295         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1296         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1297         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1298                 /* can't get more, forget it */
1299                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1300                 if (new_array1) {
1301                         SCTP_FREE(new_array1, SCTP_M_MAP);
1302                 }
1303                 if (new_array2) {
1304                         SCTP_FREE(new_array2, SCTP_M_MAP);
1305                 }
1306                 return (-1);
1307         }
1308         memset(new_array1, 0, new_size);
1309         memset(new_array2, 0, new_size);
1310         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1311         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1312         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1313         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1314         asoc->mapping_array = new_array1;
1315         asoc->nr_mapping_array = new_array2;
1316         asoc->mapping_array_size = new_size;
1317         return (0);
1318 }
1319
1320
1321 static void
1322 sctp_iterator_work(struct sctp_iterator *it)
1323 {
1324         int iteration_count = 0;
1325         int inp_skip = 0;
1326         int first_in = 1;
1327         struct sctp_inpcb *tinp;
1328
1329         SCTP_INP_INFO_RLOCK();
1330         SCTP_ITERATOR_LOCK();
1331         sctp_it_ctl.cur_it = it;
1332         if (it->inp) {
1333                 SCTP_INP_RLOCK(it->inp);
1334                 SCTP_INP_DECR_REF(it->inp);
1335         }
1336         if (it->inp == NULL) {
1337                 /* iterator is complete */
1338 done_with_iterator:
1339                 sctp_it_ctl.cur_it = NULL;
1340                 SCTP_ITERATOR_UNLOCK();
1341                 SCTP_INP_INFO_RUNLOCK();
1342                 if (it->function_atend != NULL) {
1343                         (*it->function_atend) (it->pointer, it->val);
1344                 }
1345                 SCTP_FREE(it, SCTP_M_ITER);
1346                 return;
1347         }
1348 select_a_new_ep:
1349         if (first_in) {
1350                 first_in = 0;
1351         } else {
1352                 SCTP_INP_RLOCK(it->inp);
1353         }
1354         while (((it->pcb_flags) &&
1355             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1356             ((it->pcb_features) &&
1357             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1358                 /* endpoint flags or features don't match, so keep looking */
1359                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1360                         SCTP_INP_RUNLOCK(it->inp);
1361                         goto done_with_iterator;
1362                 }
1363                 tinp = it->inp;
1364                 it->inp = LIST_NEXT(it->inp, sctp_list);
1365                 SCTP_INP_RUNLOCK(tinp);
1366                 if (it->inp == NULL) {
1367                         goto done_with_iterator;
1368                 }
1369                 SCTP_INP_RLOCK(it->inp);
1370         }
1371         /* now go through each assoc which is in the desired state */
1372         if (it->done_current_ep == 0) {
1373                 if (it->function_inp != NULL)
1374                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1375                 it->done_current_ep = 1;
1376         }
1377         if (it->stcb == NULL) {
1378                 /* run the per instance function */
1379                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1380         }
1381         if ((inp_skip) || it->stcb == NULL) {
1382                 if (it->function_inp_end != NULL) {
1383                         inp_skip = (*it->function_inp_end) (it->inp,
1384                             it->pointer,
1385                             it->val);
1386                 }
1387                 SCTP_INP_RUNLOCK(it->inp);
1388                 goto no_stcb;
1389         }
1390         while (it->stcb) {
1391                 SCTP_TCB_LOCK(it->stcb);
1392                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1393                         /* not in the right state... keep looking */
1394                         SCTP_TCB_UNLOCK(it->stcb);
1395                         goto next_assoc;
1396                 }
1397                 /* see if we have limited out the iterator loop */
1398                 iteration_count++;
1399                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1400                         /* Pause to let others grab the lock */
1401                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1402                         SCTP_TCB_UNLOCK(it->stcb);
1403                         SCTP_INP_INCR_REF(it->inp);
1404                         SCTP_INP_RUNLOCK(it->inp);
1405                         SCTP_ITERATOR_UNLOCK();
1406                         SCTP_INP_INFO_RUNLOCK();
1407                         SCTP_INP_INFO_RLOCK();
1408                         SCTP_ITERATOR_LOCK();
1409                         if (sctp_it_ctl.iterator_flags) {
1410                                 /* We won't be staying here */
1411                                 SCTP_INP_DECR_REF(it->inp);
1412                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1413                                 if (sctp_it_ctl.iterator_flags &
1414                                     SCTP_ITERATOR_STOP_CUR_IT) {
1415                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1416                                         goto done_with_iterator;
1417                                 }
1418                                 if (sctp_it_ctl.iterator_flags &
1419                                     SCTP_ITERATOR_STOP_CUR_INP) {
1420                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1421                                         goto no_stcb;
1422                                 }
1423                                 /* If we reach here huh? */
1424                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1425                                     sctp_it_ctl.iterator_flags);
1426                                 sctp_it_ctl.iterator_flags = 0;
1427                         }
1428                         SCTP_INP_RLOCK(it->inp);
1429                         SCTP_INP_DECR_REF(it->inp);
1430                         SCTP_TCB_LOCK(it->stcb);
1431                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1432                         iteration_count = 0;
1433                 }
1434
1435                 /* run function on this one */
1436                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1437
1438                 /*
1439                  * we lie here, it really needs to have its own type but
1440                  * first I must verify that this won't effect things :-0
1441                  */
1442                 if (it->no_chunk_output == 0)
1443                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1444
1445                 SCTP_TCB_UNLOCK(it->stcb);
1446 next_assoc:
1447                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1448                 if (it->stcb == NULL) {
1449                         /* Run last function */
1450                         if (it->function_inp_end != NULL) {
1451                                 inp_skip = (*it->function_inp_end) (it->inp,
1452                                     it->pointer,
1453                                     it->val);
1454                         }
1455                 }
1456         }
1457         SCTP_INP_RUNLOCK(it->inp);
1458 no_stcb:
1459         /* done with all assocs on this endpoint, move on to next endpoint */
1460         it->done_current_ep = 0;
1461         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1462                 it->inp = NULL;
1463         } else {
1464                 it->inp = LIST_NEXT(it->inp, sctp_list);
1465         }
1466         if (it->inp == NULL) {
1467                 goto done_with_iterator;
1468         }
1469         goto select_a_new_ep;
1470 }
1471
1472 void
1473 sctp_iterator_worker(void)
1474 {
1475         struct sctp_iterator *it, *nit;
1476
1477         /* This function is called with the WQ lock in place */
1478
1479         sctp_it_ctl.iterator_running = 1;
1480         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1481                 /* now lets work on this one */
1482                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1483                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1484                 CURVNET_SET(it->vn);
1485                 sctp_iterator_work(it);
1486                 CURVNET_RESTORE();
1487                 SCTP_IPI_ITERATOR_WQ_LOCK();
1488                 /* sa_ignore FREED_MEMORY */
1489         }
1490         sctp_it_ctl.iterator_running = 0;
1491         return;
1492 }
1493
1494
1495 static void
1496 sctp_handle_addr_wq(void)
1497 {
1498         /* deal with the ADDR wq from the rtsock calls */
1499         struct sctp_laddr *wi, *nwi;
1500         struct sctp_asconf_iterator *asc;
1501
1502         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1503             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1504         if (asc == NULL) {
1505                 /* Try later, no memory */
1506                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1507                     (struct sctp_inpcb *)NULL,
1508                     (struct sctp_tcb *)NULL,
1509                     (struct sctp_nets *)NULL);
1510                 return;
1511         }
1512         LIST_INIT(&asc->list_of_work);
1513         asc->cnt = 0;
1514
1515         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1516                 LIST_REMOVE(wi, sctp_nxt_addr);
1517                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1518                 asc->cnt++;
1519         }
1520
1521         if (asc->cnt == 0) {
1522                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1523         } else {
1524                 int ret;
1525
1526                 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
1527                     sctp_asconf_iterator_stcb,
1528                     NULL,       /* No ep end for boundall */
1529                     SCTP_PCB_FLAGS_BOUNDALL,
1530                     SCTP_PCB_ANY_FEATURES,
1531                     SCTP_ASOC_ANY_STATE,
1532                     (void *)asc, 0,
1533                     sctp_asconf_iterator_end, NULL, 0);
1534                 if (ret) {
1535                         SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n");
1536                         /*
1537                          * Freeing if we are stopping or put back on the
1538                          * addr_wq.
1539                          */
1540                         if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
1541                                 sctp_asconf_iterator_end(asc, 0);
1542                         } else {
1543                                 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) {
1544                                         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
1545                                 }
1546                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1547                         }
1548                 }
1549         }
1550 }
1551
1552 void
1553 sctp_timeout_handler(void *t)
1554 {
1555         struct sctp_inpcb *inp;
1556         struct sctp_tcb *stcb;
1557         struct sctp_nets *net;
1558         struct sctp_timer *tmr;
1559         struct mbuf *op_err;
1560 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1561         struct socket *so;
1562 #endif
1563         int did_output;
1564         int type;
1565
1566         tmr = (struct sctp_timer *)t;
1567         inp = (struct sctp_inpcb *)tmr->ep;
1568         stcb = (struct sctp_tcb *)tmr->tcb;
1569         net = (struct sctp_nets *)tmr->net;
1570         CURVNET_SET((struct vnet *)tmr->vnet);
1571         did_output = 1;
1572
1573 #ifdef SCTP_AUDITING_ENABLED
1574         sctp_audit_log(0xF0, (uint8_t)tmr->type);
1575         sctp_auditing(3, inp, stcb, net);
1576 #endif
1577
1578         /* sanity checks... */
1579         if (tmr->self != (void *)tmr) {
1580                 /*
1581                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1582                  * (void *)tmr);
1583                  */
1584                 CURVNET_RESTORE();
1585                 return;
1586         }
1587         tmr->stopped_from = 0xa001;
1588         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1589                 /*
1590                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1591                  * tmr->type);
1592                  */
1593                 CURVNET_RESTORE();
1594                 return;
1595         }
1596         tmr->stopped_from = 0xa002;
1597         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1598                 CURVNET_RESTORE();
1599                 return;
1600         }
1601         /* if this is an iterator timeout, get the struct and clear inp */
1602         tmr->stopped_from = 0xa003;
1603         if (inp) {
1604                 SCTP_INP_INCR_REF(inp);
1605                 if ((inp->sctp_socket == NULL) &&
1606                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1607                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1608                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1609                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1610                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1611                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1612                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1613                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1614                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))) {
1615                         SCTP_INP_DECR_REF(inp);
1616                         CURVNET_RESTORE();
1617                         return;
1618                 }
1619         }
1620         tmr->stopped_from = 0xa004;
1621         if (stcb) {
1622                 atomic_add_int(&stcb->asoc.refcnt, 1);
1623                 if (stcb->asoc.state == 0) {
1624                         atomic_add_int(&stcb->asoc.refcnt, -1);
1625                         if (inp) {
1626                                 SCTP_INP_DECR_REF(inp);
1627                         }
1628                         CURVNET_RESTORE();
1629                         return;
1630                 }
1631         }
1632         type = tmr->type;
1633         tmr->stopped_from = 0xa005;
1634         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", type);
1635         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1636                 if (inp) {
1637                         SCTP_INP_DECR_REF(inp);
1638                 }
1639                 if (stcb) {
1640                         atomic_add_int(&stcb->asoc.refcnt, -1);
1641                 }
1642                 CURVNET_RESTORE();
1643                 return;
1644         }
1645         tmr->stopped_from = 0xa006;
1646
1647         if (stcb) {
1648                 SCTP_TCB_LOCK(stcb);
1649                 atomic_add_int(&stcb->asoc.refcnt, -1);
1650                 if ((type != SCTP_TIMER_TYPE_ASOCKILL) &&
1651                     ((stcb->asoc.state == 0) ||
1652                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1653                         SCTP_TCB_UNLOCK(stcb);
1654                         if (inp) {
1655                                 SCTP_INP_DECR_REF(inp);
1656                         }
1657                         CURVNET_RESTORE();
1658                         return;
1659                 }
1660         } else if (inp != NULL) {
1661                 if (type != SCTP_TIMER_TYPE_INPKILL) {
1662                         SCTP_INP_WLOCK(inp);
1663                 }
1664         } else {
1665                 SCTP_WQ_ADDR_LOCK();
1666         }
1667         /* record in stopped what t-o occurred */
1668         tmr->stopped_from = type;
1669
1670         /* mark as being serviced now */
1671         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1672                 /*
1673                  * Callout has been rescheduled.
1674                  */
1675                 goto get_out;
1676         }
1677         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1678                 /*
1679                  * Not active, so no action.
1680                  */
1681                 goto get_out;
1682         }
1683         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1684
1685         /* call the handler for the appropriate timer type */
1686         switch (type) {
1687         case SCTP_TIMER_TYPE_ADDR_WQ:
1688                 sctp_handle_addr_wq();
1689                 break;
1690         case SCTP_TIMER_TYPE_SEND:
1691                 if ((stcb == NULL) || (inp == NULL)) {
1692                         break;
1693                 }
1694                 SCTP_STAT_INCR(sctps_timodata);
1695                 stcb->asoc.timodata++;
1696                 stcb->asoc.num_send_timers_up--;
1697                 if (stcb->asoc.num_send_timers_up < 0) {
1698                         stcb->asoc.num_send_timers_up = 0;
1699                 }
1700                 SCTP_TCB_LOCK_ASSERT(stcb);
1701                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1702                         /* no need to unlock on tcb its gone */
1703
1704                         goto out_decr;
1705                 }
1706                 SCTP_TCB_LOCK_ASSERT(stcb);
1707 #ifdef SCTP_AUDITING_ENABLED
1708                 sctp_auditing(4, inp, stcb, net);
1709 #endif
1710                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1711                 if ((stcb->asoc.num_send_timers_up == 0) &&
1712                     (stcb->asoc.sent_queue_cnt > 0)) {
1713                         struct sctp_tmit_chunk *chk;
1714
1715                         /*
1716                          * safeguard. If there on some on the sent queue
1717                          * somewhere but no timers running something is
1718                          * wrong... so we start a timer on the first chunk
1719                          * on the send queue on whatever net it is sent to.
1720                          */
1721                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1722                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1723                             chk->whoTo);
1724                 }
1725                 break;
1726         case SCTP_TIMER_TYPE_INIT:
1727                 if ((stcb == NULL) || (inp == NULL)) {
1728                         break;
1729                 }
1730                 SCTP_STAT_INCR(sctps_timoinit);
1731                 stcb->asoc.timoinit++;
1732                 if (sctp_t1init_timer(inp, stcb, net)) {
1733                         /* no need to unlock on tcb its gone */
1734                         goto out_decr;
1735                 }
1736                 /* We do output but not here */
1737                 did_output = 0;
1738                 break;
1739         case SCTP_TIMER_TYPE_RECV:
1740                 if ((stcb == NULL) || (inp == NULL)) {
1741                         break;
1742                 }
1743                 SCTP_STAT_INCR(sctps_timosack);
1744                 stcb->asoc.timosack++;
1745                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1746 #ifdef SCTP_AUDITING_ENABLED
1747                 sctp_auditing(4, inp, stcb, net);
1748 #endif
1749                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1750                 break;
1751         case SCTP_TIMER_TYPE_SHUTDOWN:
1752                 if ((stcb == NULL) || (inp == NULL)) {
1753                         break;
1754                 }
1755                 if (sctp_shutdown_timer(inp, stcb, net)) {
1756                         /* no need to unlock on tcb its gone */
1757                         goto out_decr;
1758                 }
1759                 SCTP_STAT_INCR(sctps_timoshutdown);
1760                 stcb->asoc.timoshutdown++;
1761 #ifdef SCTP_AUDITING_ENABLED
1762                 sctp_auditing(4, inp, stcb, net);
1763 #endif
1764                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1765                 break;
1766         case SCTP_TIMER_TYPE_HEARTBEAT:
1767                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1768                         break;
1769                 }
1770                 SCTP_STAT_INCR(sctps_timoheartbeat);
1771                 stcb->asoc.timoheartbeat++;
1772                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1773                         /* no need to unlock on tcb its gone */
1774                         goto out_decr;
1775                 }
1776 #ifdef SCTP_AUDITING_ENABLED
1777                 sctp_auditing(4, inp, stcb, net);
1778 #endif
1779                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1780                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1781                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1782                 }
1783                 break;
1784         case SCTP_TIMER_TYPE_COOKIE:
1785                 if ((stcb == NULL) || (inp == NULL)) {
1786                         break;
1787                 }
1788
1789                 if (sctp_cookie_timer(inp, stcb, net)) {
1790                         /* no need to unlock on tcb its gone */
1791                         goto out_decr;
1792                 }
1793                 SCTP_STAT_INCR(sctps_timocookie);
1794                 stcb->asoc.timocookie++;
1795 #ifdef SCTP_AUDITING_ENABLED
1796                 sctp_auditing(4, inp, stcb, net);
1797 #endif
1798                 /*
1799                  * We consider T3 and Cookie timer pretty much the same with
1800                  * respect to where from in chunk_output.
1801                  */
1802                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1803                 break;
1804         case SCTP_TIMER_TYPE_NEWCOOKIE:
1805                 {
1806                         struct timeval tv;
1807                         int i, secret;
1808
1809                         if (inp == NULL) {
1810                                 break;
1811                         }
1812                         SCTP_STAT_INCR(sctps_timosecret);
1813                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1814                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1815                         inp->sctp_ep.last_secret_number =
1816                             inp->sctp_ep.current_secret_number;
1817                         inp->sctp_ep.current_secret_number++;
1818                         if (inp->sctp_ep.current_secret_number >=
1819                             SCTP_HOW_MANY_SECRETS) {
1820                                 inp->sctp_ep.current_secret_number = 0;
1821                         }
1822                         secret = (int)inp->sctp_ep.current_secret_number;
1823                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1824                                 inp->sctp_ep.secret_key[secret][i] =
1825                                     sctp_select_initial_TSN(&inp->sctp_ep);
1826                         }
1827                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1828                 }
1829                 did_output = 0;
1830                 break;
1831         case SCTP_TIMER_TYPE_PATHMTURAISE:
1832                 if ((stcb == NULL) || (inp == NULL)) {
1833                         break;
1834                 }
1835                 SCTP_STAT_INCR(sctps_timopathmtu);
1836                 sctp_pathmtu_timer(inp, stcb, net);
1837                 did_output = 0;
1838                 break;
1839         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1840                 if ((stcb == NULL) || (inp == NULL)) {
1841                         break;
1842                 }
1843                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1844                         /* no need to unlock on tcb its gone */
1845                         goto out_decr;
1846                 }
1847                 SCTP_STAT_INCR(sctps_timoshutdownack);
1848                 stcb->asoc.timoshutdownack++;
1849 #ifdef SCTP_AUDITING_ENABLED
1850                 sctp_auditing(4, inp, stcb, net);
1851 #endif
1852                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1853                 break;
1854         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1855                 if ((stcb == NULL) || (inp == NULL)) {
1856                         break;
1857                 }
1858                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1859                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1860                     "Shutdown guard timer expired");
1861                 sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
1862                 /* no need to unlock on tcb its gone */
1863                 goto out_decr;
1864
1865         case SCTP_TIMER_TYPE_STRRESET:
1866                 if ((stcb == NULL) || (inp == NULL)) {
1867                         break;
1868                 }
1869                 if (sctp_strreset_timer(inp, stcb, net)) {
1870                         /* no need to unlock on tcb its gone */
1871                         goto out_decr;
1872                 }
1873                 SCTP_STAT_INCR(sctps_timostrmrst);
1874                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1875                 break;
1876         case SCTP_TIMER_TYPE_ASCONF:
1877                 if ((stcb == NULL) || (inp == NULL)) {
1878                         break;
1879                 }
1880                 if (sctp_asconf_timer(inp, stcb, net)) {
1881                         /* no need to unlock on tcb its gone */
1882                         goto out_decr;
1883                 }
1884                 SCTP_STAT_INCR(sctps_timoasconf);
1885 #ifdef SCTP_AUDITING_ENABLED
1886                 sctp_auditing(4, inp, stcb, net);
1887 #endif
1888                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1889                 break;
1890         case SCTP_TIMER_TYPE_PRIM_DELETED:
1891                 if ((stcb == NULL) || (inp == NULL)) {
1892                         break;
1893                 }
1894                 sctp_delete_prim_timer(inp, stcb, net);
1895                 SCTP_STAT_INCR(sctps_timodelprim);
1896                 break;
1897
1898         case SCTP_TIMER_TYPE_AUTOCLOSE:
1899                 if ((stcb == NULL) || (inp == NULL)) {
1900                         break;
1901                 }
1902                 SCTP_STAT_INCR(sctps_timoautoclose);
1903                 sctp_autoclose_timer(inp, stcb, net);
1904                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1905                 did_output = 0;
1906                 break;
1907         case SCTP_TIMER_TYPE_ASOCKILL:
1908                 if ((stcb == NULL) || (inp == NULL)) {
1909                         break;
1910                 }
1911                 SCTP_STAT_INCR(sctps_timoassockill);
1912                 /* Can we free it yet? */
1913                 SCTP_INP_DECR_REF(inp);
1914                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
1915                     SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1916 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1917                 so = SCTP_INP_SO(inp);
1918                 atomic_add_int(&stcb->asoc.refcnt, 1);
1919                 SCTP_TCB_UNLOCK(stcb);
1920                 SCTP_SOCKET_LOCK(so, 1);
1921                 SCTP_TCB_LOCK(stcb);
1922                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1923 #endif
1924                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
1925                     SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1926 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1927                 SCTP_SOCKET_UNLOCK(so, 1);
1928 #endif
1929                 /*
1930                  * free asoc, always unlocks (or destroy's) so prevent
1931                  * duplicate unlock or unlock of a free mtx :-0
1932                  */
1933                 stcb = NULL;
1934                 goto out_no_decr;
1935         case SCTP_TIMER_TYPE_INPKILL:
1936                 SCTP_STAT_INCR(sctps_timoinpkill);
1937                 if (inp == NULL) {
1938                         break;
1939                 }
1940                 /*
1941                  * special case, take away our increment since WE are the
1942                  * killer
1943                  */
1944                 SCTP_INP_DECR_REF(inp);
1945                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL,
1946                     SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1947                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1948                     SCTP_CALLED_FROM_INPKILL_TIMER);
1949                 inp = NULL;
1950                 goto out_no_decr;
1951         default:
1952                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1953                     type);
1954                 break;
1955         }
1956 #ifdef SCTP_AUDITING_ENABLED
1957         sctp_audit_log(0xF1, (uint8_t)type);
1958         if (inp)
1959                 sctp_auditing(5, inp, stcb, net);
1960 #endif
1961         if ((did_output) && stcb) {
1962                 /*
1963                  * Now we need to clean up the control chunk chain if an
1964                  * ECNE is on it. It must be marked as UNSENT again so next
1965                  * call will continue to send it until such time that we get
1966                  * a CWR, to remove it. It is, however, less likely that we
1967                  * will find a ecn echo on the chain though.
1968                  */
1969                 sctp_fix_ecn_echo(&stcb->asoc);
1970         }
1971 get_out:
1972         if (stcb) {
1973                 SCTP_TCB_UNLOCK(stcb);
1974         } else if (inp != NULL) {
1975                 SCTP_INP_WUNLOCK(inp);
1976         } else {
1977                 SCTP_WQ_ADDR_UNLOCK();
1978         }
1979
1980 out_decr:
1981         if (inp) {
1982                 SCTP_INP_DECR_REF(inp);
1983         }
1984
1985 out_no_decr:
1986         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type = %d)\n", type);
1987         CURVNET_RESTORE();
1988 }
1989
1990 void
1991 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1992     struct sctp_nets *net)
1993 {
1994         uint32_t to_ticks;
1995         struct sctp_timer *tmr;
1996
1997         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1998                 return;
1999
2000         tmr = NULL;
2001         if (stcb) {
2002                 SCTP_TCB_LOCK_ASSERT(stcb);
2003         }
2004         switch (t_type) {
2005         case SCTP_TIMER_TYPE_ADDR_WQ:
2006                 /* Only 1 tick away :-) */
2007                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2008                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
2009                 break;
2010         case SCTP_TIMER_TYPE_SEND:
2011                 /* Here we use the RTO timer */
2012                 {
2013                         int rto_val;
2014
2015                         if ((stcb == NULL) || (net == NULL)) {
2016                                 return;
2017                         }
2018                         tmr = &net->rxt_timer;
2019                         if (net->RTO == 0) {
2020                                 rto_val = stcb->asoc.initial_rto;
2021                         } else {
2022                                 rto_val = net->RTO;
2023                         }
2024                         to_ticks = MSEC_TO_TICKS(rto_val);
2025                 }
2026                 break;
2027         case SCTP_TIMER_TYPE_INIT:
2028                 /*
2029                  * Here we use the INIT timer default usually about 1
2030                  * minute.
2031                  */
2032                 if ((stcb == NULL) || (net == NULL)) {
2033                         return;
2034                 }
2035                 tmr = &net->rxt_timer;
2036                 if (net->RTO == 0) {
2037                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2038                 } else {
2039                         to_ticks = MSEC_TO_TICKS(net->RTO);
2040                 }
2041                 break;
2042         case SCTP_TIMER_TYPE_RECV:
2043                 /*
2044                  * Here we use the Delayed-Ack timer value from the inp
2045                  * ususually about 200ms.
2046                  */
2047                 if (stcb == NULL) {
2048                         return;
2049                 }
2050                 tmr = &stcb->asoc.dack_timer;
2051                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
2052                 break;
2053         case SCTP_TIMER_TYPE_SHUTDOWN:
2054                 /* Here we use the RTO of the destination. */
2055                 if ((stcb == NULL) || (net == NULL)) {
2056                         return;
2057                 }
2058                 if (net->RTO == 0) {
2059                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2060                 } else {
2061                         to_ticks = MSEC_TO_TICKS(net->RTO);
2062                 }
2063                 tmr = &net->rxt_timer;
2064                 break;
2065         case SCTP_TIMER_TYPE_HEARTBEAT:
2066                 /*
2067                  * the net is used here so that we can add in the RTO. Even
2068                  * though we use a different timer. We also add the HB timer
2069                  * PLUS a random jitter.
2070                  */
2071                 if ((stcb == NULL) || (net == NULL)) {
2072                         return;
2073                 } else {
2074                         uint32_t rndval;
2075                         uint32_t jitter;
2076
2077                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
2078                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
2079                                 return;
2080                         }
2081                         if (net->RTO == 0) {
2082                                 to_ticks = stcb->asoc.initial_rto;
2083                         } else {
2084                                 to_ticks = net->RTO;
2085                         }
2086                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2087                         jitter = rndval % to_ticks;
2088                         if (jitter >= (to_ticks >> 1)) {
2089                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
2090                         } else {
2091                                 to_ticks = to_ticks - jitter;
2092                         }
2093                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2094                             !(net->dest_state & SCTP_ADDR_PF)) {
2095                                 to_ticks += net->heart_beat_delay;
2096                         }
2097                         /*
2098                          * Now we must convert the to_ticks that are now in
2099                          * ms to ticks.
2100                          */
2101                         to_ticks = MSEC_TO_TICKS(to_ticks);
2102                         tmr = &net->hb_timer;
2103                 }
2104                 break;
2105         case SCTP_TIMER_TYPE_COOKIE:
2106                 /*
2107                  * Here we can use the RTO timer from the network since one
2108                  * RTT was compelete. If a retran happened then we will be
2109                  * using the RTO initial value.
2110                  */
2111                 if ((stcb == NULL) || (net == NULL)) {
2112                         return;
2113                 }
2114                 if (net->RTO == 0) {
2115                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2116                 } else {
2117                         to_ticks = MSEC_TO_TICKS(net->RTO);
2118                 }
2119                 tmr = &net->rxt_timer;
2120                 break;
2121         case SCTP_TIMER_TYPE_NEWCOOKIE:
2122                 /*
2123                  * nothing needed but the endpoint here ususually about 60
2124                  * minutes.
2125                  */
2126                 tmr = &inp->sctp_ep.signature_change;
2127                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2128                 break;
2129         case SCTP_TIMER_TYPE_ASOCKILL:
2130                 if (stcb == NULL) {
2131                         return;
2132                 }
2133                 tmr = &stcb->asoc.strreset_timer;
2134                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2135                 break;
2136         case SCTP_TIMER_TYPE_INPKILL:
2137                 /*
2138                  * The inp is setup to die. We re-use the signature_chage
2139                  * timer since that has stopped and we are in the GONE
2140                  * state.
2141                  */
2142                 tmr = &inp->sctp_ep.signature_change;
2143                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2144                 break;
2145         case SCTP_TIMER_TYPE_PATHMTURAISE:
2146                 /*
2147                  * Here we use the value found in the EP for PMTU ususually
2148                  * about 10 minutes.
2149                  */
2150                 if ((stcb == NULL) || (net == NULL)) {
2151                         return;
2152                 }
2153                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2154                         return;
2155                 }
2156                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2157                 tmr = &net->pmtu_timer;
2158                 break;
2159         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2160                 /* Here we use the RTO of the destination */
2161                 if ((stcb == NULL) || (net == NULL)) {
2162                         return;
2163                 }
2164                 if (net->RTO == 0) {
2165                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2166                 } else {
2167                         to_ticks = MSEC_TO_TICKS(net->RTO);
2168                 }
2169                 tmr = &net->rxt_timer;
2170                 break;
2171         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2172                 /*
2173                  * Here we use the endpoints shutdown guard timer usually
2174                  * about 3 minutes.
2175                  */
2176                 if (stcb == NULL) {
2177                         return;
2178                 }
2179                 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) {
2180                         to_ticks = 5 * MSEC_TO_TICKS(stcb->asoc.maxrto);
2181                 } else {
2182                         to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2183                 }
2184                 tmr = &stcb->asoc.shut_guard_timer;
2185                 break;
2186         case SCTP_TIMER_TYPE_STRRESET:
2187                 /*
2188                  * Here the timer comes from the stcb but its value is from
2189                  * the net's RTO.
2190                  */
2191                 if ((stcb == NULL) || (net == NULL)) {
2192                         return;
2193                 }
2194                 if (net->RTO == 0) {
2195                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2196                 } else {
2197                         to_ticks = MSEC_TO_TICKS(net->RTO);
2198                 }
2199                 tmr = &stcb->asoc.strreset_timer;
2200                 break;
2201         case SCTP_TIMER_TYPE_ASCONF:
2202                 /*
2203                  * Here the timer comes from the stcb but its value is from
2204                  * the net's RTO.
2205                  */
2206                 if ((stcb == NULL) || (net == NULL)) {
2207                         return;
2208                 }
2209                 if (net->RTO == 0) {
2210                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2211                 } else {
2212                         to_ticks = MSEC_TO_TICKS(net->RTO);
2213                 }
2214                 tmr = &stcb->asoc.asconf_timer;
2215                 break;
2216         case SCTP_TIMER_TYPE_PRIM_DELETED:
2217                 if ((stcb == NULL) || (net != NULL)) {
2218                         return;
2219                 }
2220                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2221                 tmr = &stcb->asoc.delete_prim_timer;
2222                 break;
2223         case SCTP_TIMER_TYPE_AUTOCLOSE:
2224                 if (stcb == NULL) {
2225                         return;
2226                 }
2227                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2228                         /*
2229                          * Really an error since stcb is NOT set to
2230                          * autoclose
2231                          */
2232                         return;
2233                 }
2234                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2235                 tmr = &stcb->asoc.autoclose_timer;
2236                 break;
2237         default:
2238                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2239                     __func__, t_type);
2240                 return;
2241                 break;
2242         }
2243         if ((to_ticks <= 0) || (tmr == NULL)) {
2244                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2245                     __func__, t_type, to_ticks, (void *)tmr);
2246                 return;
2247         }
2248         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2249                 /*
2250                  * we do NOT allow you to have it already running. if it is
2251                  * we leave the current one up unchanged
2252                  */
2253                 return;
2254         }
2255         /* At this point we can proceed */
2256         if (t_type == SCTP_TIMER_TYPE_SEND) {
2257                 stcb->asoc.num_send_timers_up++;
2258         }
2259         tmr->stopped_from = 0;
2260         tmr->type = t_type;
2261         tmr->ep = (void *)inp;
2262         tmr->tcb = (void *)stcb;
2263         tmr->net = (void *)net;
2264         tmr->self = (void *)tmr;
2265         tmr->vnet = (void *)curvnet;
2266         tmr->ticks = sctp_get_tick_count();
2267         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2268         return;
2269 }
2270
2271 void
2272 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2273     struct sctp_nets *net, uint32_t from)
2274 {
2275         struct sctp_timer *tmr;
2276
2277         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2278             (inp == NULL))
2279                 return;
2280
2281         tmr = NULL;
2282         if (stcb) {
2283                 SCTP_TCB_LOCK_ASSERT(stcb);
2284         }
2285         switch (t_type) {
2286         case SCTP_TIMER_TYPE_ADDR_WQ:
2287                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2288                 break;
2289         case SCTP_TIMER_TYPE_SEND:
2290                 if ((stcb == NULL) || (net == NULL)) {
2291                         return;
2292                 }
2293                 tmr = &net->rxt_timer;
2294                 break;
2295         case SCTP_TIMER_TYPE_INIT:
2296                 if ((stcb == NULL) || (net == NULL)) {
2297                         return;
2298                 }
2299                 tmr = &net->rxt_timer;
2300                 break;
2301         case SCTP_TIMER_TYPE_RECV:
2302                 if (stcb == NULL) {
2303                         return;
2304                 }
2305                 tmr = &stcb->asoc.dack_timer;
2306                 break;
2307         case SCTP_TIMER_TYPE_SHUTDOWN:
2308                 if ((stcb == NULL) || (net == NULL)) {
2309                         return;
2310                 }
2311                 tmr = &net->rxt_timer;
2312                 break;
2313         case SCTP_TIMER_TYPE_HEARTBEAT:
2314                 if ((stcb == NULL) || (net == NULL)) {
2315                         return;
2316                 }
2317                 tmr = &net->hb_timer;
2318                 break;
2319         case SCTP_TIMER_TYPE_COOKIE:
2320                 if ((stcb == NULL) || (net == NULL)) {
2321                         return;
2322                 }
2323                 tmr = &net->rxt_timer;
2324                 break;
2325         case SCTP_TIMER_TYPE_NEWCOOKIE:
2326                 /* nothing needed but the endpoint here */
2327                 tmr = &inp->sctp_ep.signature_change;
2328                 /*
2329                  * We re-use the newcookie timer for the INP kill timer. We
2330                  * must assure that we do not kill it by accident.
2331                  */
2332                 break;
2333         case SCTP_TIMER_TYPE_ASOCKILL:
2334                 /*
2335                  * Stop the asoc kill timer.
2336                  */
2337                 if (stcb == NULL) {
2338                         return;
2339                 }
2340                 tmr = &stcb->asoc.strreset_timer;
2341                 break;
2342
2343         case SCTP_TIMER_TYPE_INPKILL:
2344                 /*
2345                  * The inp is setup to die. We re-use the signature_chage
2346                  * timer since that has stopped and we are in the GONE
2347                  * state.
2348                  */
2349                 tmr = &inp->sctp_ep.signature_change;
2350                 break;
2351         case SCTP_TIMER_TYPE_PATHMTURAISE:
2352                 if ((stcb == NULL) || (net == NULL)) {
2353                         return;
2354                 }
2355                 tmr = &net->pmtu_timer;
2356                 break;
2357         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2358                 if ((stcb == NULL) || (net == NULL)) {
2359                         return;
2360                 }
2361                 tmr = &net->rxt_timer;
2362                 break;
2363         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2364                 if (stcb == NULL) {
2365                         return;
2366                 }
2367                 tmr = &stcb->asoc.shut_guard_timer;
2368                 break;
2369         case SCTP_TIMER_TYPE_STRRESET:
2370                 if (stcb == NULL) {
2371                         return;
2372                 }
2373                 tmr = &stcb->asoc.strreset_timer;
2374                 break;
2375         case SCTP_TIMER_TYPE_ASCONF:
2376                 if (stcb == NULL) {
2377                         return;
2378                 }
2379                 tmr = &stcb->asoc.asconf_timer;
2380                 break;
2381         case SCTP_TIMER_TYPE_PRIM_DELETED:
2382                 if (stcb == NULL) {
2383                         return;
2384                 }
2385                 tmr = &stcb->asoc.delete_prim_timer;
2386                 break;
2387         case SCTP_TIMER_TYPE_AUTOCLOSE:
2388                 if (stcb == NULL) {
2389                         return;
2390                 }
2391                 tmr = &stcb->asoc.autoclose_timer;
2392                 break;
2393         default:
2394                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2395                     __func__, t_type);
2396                 break;
2397         }
2398         if (tmr == NULL) {
2399                 return;
2400         }
2401         if ((tmr->type != t_type) && tmr->type) {
2402                 /*
2403                  * Ok we have a timer that is under joint use. Cookie timer
2404                  * per chance with the SEND timer. We therefore are NOT
2405                  * running the timer that the caller wants stopped.  So just
2406                  * return.
2407                  */
2408                 return;
2409         }
2410         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2411                 stcb->asoc.num_send_timers_up--;
2412                 if (stcb->asoc.num_send_timers_up < 0) {
2413                         stcb->asoc.num_send_timers_up = 0;
2414                 }
2415         }
2416         tmr->self = NULL;
2417         tmr->stopped_from = from;
2418         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2419         return;
2420 }
2421
2422 uint32_t
2423 sctp_calculate_len(struct mbuf *m)
2424 {
2425         uint32_t tlen = 0;
2426         struct mbuf *at;
2427
2428         at = m;
2429         while (at) {
2430                 tlen += SCTP_BUF_LEN(at);
2431                 at = SCTP_BUF_NEXT(at);
2432         }
2433         return (tlen);
2434 }
2435
2436 void
2437 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2438     struct sctp_association *asoc, uint32_t mtu)
2439 {
2440         /*
2441          * Reset the P-MTU size on this association, this involves changing
2442          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2443          * allow the DF flag to be cleared.
2444          */
2445         struct sctp_tmit_chunk *chk;
2446         unsigned int eff_mtu, ovh;
2447
2448         asoc->smallest_mtu = mtu;
2449         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2450                 ovh = SCTP_MIN_OVERHEAD;
2451         } else {
2452                 ovh = SCTP_MIN_V4_OVERHEAD;
2453         }
2454         eff_mtu = mtu - ovh;
2455         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2456                 if (chk->send_size > eff_mtu) {
2457                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2458                 }
2459         }
2460         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2461                 if (chk->send_size > eff_mtu) {
2462                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2463                 }
2464         }
2465 }
2466
2467
2468 /*
2469  * given an association and starting time of the current RTT period return
2470  * RTO in number of msecs net should point to the current network
2471  */
2472
2473 uint32_t
2474 sctp_calculate_rto(struct sctp_tcb *stcb,
2475     struct sctp_association *asoc,
2476     struct sctp_nets *net,
2477     struct timeval *old,
2478     int rtt_from_sack)
2479 {
2480         /*-
2481          * given an association and the starting time of the current RTT
2482          * period (in value1/value2) return RTO in number of msecs.
2483          */
2484         int32_t rtt;            /* RTT in ms */
2485         uint32_t new_rto;
2486         int first_measure = 0;
2487         struct timeval now;
2488
2489         /************************/
2490         /* 1. calculate new RTT */
2491         /************************/
2492         /* get the current time */
2493         if (stcb->asoc.use_precise_time) {
2494                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2495         } else {
2496                 (void)SCTP_GETTIME_TIMEVAL(&now);
2497         }
2498         timevalsub(&now, old);
2499         /* store the current RTT in us */
2500         net->rtt = (uint64_t)1000000 * (uint64_t)now.tv_sec +
2501             (uint64_t)now.tv_usec;
2502         /* compute rtt in ms */
2503         rtt = (int32_t)(net->rtt / 1000);
2504         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2505                 /*
2506                  * Tell the CC module that a new update has just occurred
2507                  * from a sack
2508                  */
2509                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2510         }
2511         /*
2512          * Do we need to determine the lan? We do this only on sacks i.e.
2513          * RTT being determined from data not non-data (HB/INIT->INITACK).
2514          */
2515         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2516             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2517                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2518                         net->lan_type = SCTP_LAN_INTERNET;
2519                 } else {
2520                         net->lan_type = SCTP_LAN_LOCAL;
2521                 }
2522         }
2523
2524         /***************************/
2525         /* 2. update RTTVAR & SRTT */
2526         /***************************/
2527         /*-
2528          * Compute the scaled average lastsa and the
2529          * scaled variance lastsv as described in van Jacobson
2530          * Paper "Congestion Avoidance and Control", Annex A.
2531          *
2532          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2533          * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar
2534          */
2535         if (net->RTO_measured) {
2536                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2537                 net->lastsa += rtt;
2538                 if (rtt < 0) {
2539                         rtt = -rtt;
2540                 }
2541                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2542                 net->lastsv += rtt;
2543                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2544                         rto_logging(net, SCTP_LOG_RTTVAR);
2545                 }
2546         } else {
2547                 /* First RTO measurment */
2548                 net->RTO_measured = 1;
2549                 first_measure = 1;
2550                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2551                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2552                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2553                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2554                 }
2555         }
2556         if (net->lastsv == 0) {
2557                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2558         }
2559         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2560         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2561             (stcb->asoc.sat_network_lockout == 0)) {
2562                 stcb->asoc.sat_network = 1;
2563         } else if ((!first_measure) && stcb->asoc.sat_network) {
2564                 stcb->asoc.sat_network = 0;
2565                 stcb->asoc.sat_network_lockout = 1;
2566         }
2567         /* bound it, per C6/C7 in Section 5.3.1 */
2568         if (new_rto < stcb->asoc.minrto) {
2569                 new_rto = stcb->asoc.minrto;
2570         }
2571         if (new_rto > stcb->asoc.maxrto) {
2572                 new_rto = stcb->asoc.maxrto;
2573         }
2574         /* we are now returning the RTO */
2575         return (new_rto);
2576 }
2577
2578 /*
2579  * return a pointer to a contiguous piece of data from the given mbuf chain
2580  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2581  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2582  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2583  */
2584 caddr_t
2585 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr)
2586 {
2587         uint32_t count;
2588         uint8_t *ptr;
2589
2590         ptr = in_ptr;
2591         if ((off < 0) || (len <= 0))
2592                 return (NULL);
2593
2594         /* find the desired start location */
2595         while ((m != NULL) && (off > 0)) {
2596                 if (off < SCTP_BUF_LEN(m))
2597                         break;
2598                 off -= SCTP_BUF_LEN(m);
2599                 m = SCTP_BUF_NEXT(m);
2600         }
2601         if (m == NULL)
2602                 return (NULL);
2603
2604         /* is the current mbuf large enough (eg. contiguous)? */
2605         if ((SCTP_BUF_LEN(m) - off) >= len) {
2606                 return (mtod(m, caddr_t)+off);
2607         } else {
2608                 /* else, it spans more than one mbuf, so save a temp copy... */
2609                 while ((m != NULL) && (len > 0)) {
2610                         count = min(SCTP_BUF_LEN(m) - off, len);
2611                         memcpy(ptr, mtod(m, caddr_t)+off, count);
2612                         len -= count;
2613                         ptr += count;
2614                         off = 0;
2615                         m = SCTP_BUF_NEXT(m);
2616                 }
2617                 if ((m == NULL) && (len > 0))
2618                         return (NULL);
2619                 else
2620                         return ((caddr_t)in_ptr);
2621         }
2622 }
2623
2624
2625
2626 struct sctp_paramhdr *
2627 sctp_get_next_param(struct mbuf *m,
2628     int offset,
2629     struct sctp_paramhdr *pull,
2630     int pull_limit)
2631 {
2632         /* This just provides a typed signature to Peter's Pull routine */
2633         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2634             (uint8_t *)pull));
2635 }
2636
2637
2638 struct mbuf *
2639 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2640 {
2641         struct mbuf *m_last;
2642         caddr_t dp;
2643
2644         if (padlen > 3) {
2645                 return (NULL);
2646         }
2647         if (padlen <= M_TRAILINGSPACE(m)) {
2648                 /*
2649                  * The easy way. We hope the majority of the time we hit
2650                  * here :)
2651                  */
2652                 m_last = m;
2653         } else {
2654                 /* Hard way we must grow the mbuf chain */
2655                 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
2656                 if (m_last == NULL) {
2657                         return (NULL);
2658                 }
2659                 SCTP_BUF_LEN(m_last) = 0;
2660                 SCTP_BUF_NEXT(m_last) = NULL;
2661                 SCTP_BUF_NEXT(m) = m_last;
2662         }
2663         dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
2664         SCTP_BUF_LEN(m_last) += padlen;
2665         memset(dp, 0, padlen);
2666         return (m_last);
2667 }
2668
2669 struct mbuf *
2670 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2671 {
2672         /* find the last mbuf in chain and pad it */
2673         struct mbuf *m_at;
2674
2675         if (last_mbuf != NULL) {
2676                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2677         } else {
2678                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
2679                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2680                                 return (sctp_add_pad_tombuf(m_at, padval));
2681                         }
2682                 }
2683         }
2684         return (NULL);
2685 }
2686
2687 static void
2688 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
2689     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
2690 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2691     SCTP_UNUSED
2692 #endif
2693 )
2694 {
2695         struct mbuf *m_notify;
2696         struct sctp_assoc_change *sac;
2697         struct sctp_queued_to_read *control;
2698         unsigned int notif_len;
2699         uint16_t abort_len;
2700         unsigned int i;
2701 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2702         struct socket *so;
2703 #endif
2704
2705         if (stcb == NULL) {
2706                 return;
2707         }
2708         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2709                 notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2710                 if (abort != NULL) {
2711                         abort_len = ntohs(abort->ch.chunk_length);
2712                         /*
2713                          * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
2714                          * contiguous.
2715                          */
2716                         if (abort_len > SCTP_CHUNK_BUFFER_SIZE) {
2717                                 abort_len = SCTP_CHUNK_BUFFER_SIZE;
2718                         }
2719                 } else {
2720                         abort_len = 0;
2721                 }
2722                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2723                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
2724                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2725                         notif_len += abort_len;
2726                 }
2727                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2728                 if (m_notify == NULL) {
2729                         /* Retry with smaller value. */
2730                         notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2731                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2732                         if (m_notify == NULL) {
2733                                 goto set_error;
2734                         }
2735                 }
2736                 SCTP_BUF_NEXT(m_notify) = NULL;
2737                 sac = mtod(m_notify, struct sctp_assoc_change *);
2738                 memset(sac, 0, notif_len);
2739                 sac->sac_type = SCTP_ASSOC_CHANGE;
2740                 sac->sac_flags = 0;
2741                 sac->sac_length = sizeof(struct sctp_assoc_change);
2742                 sac->sac_state = state;
2743                 sac->sac_error = error;
2744                 /* XXX verify these stream counts */
2745                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2746                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
2747                 sac->sac_assoc_id = sctp_get_associd(stcb);
2748                 if (notif_len > sizeof(struct sctp_assoc_change)) {
2749                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2750                                 i = 0;
2751                                 if (stcb->asoc.prsctp_supported == 1) {
2752                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2753                                 }
2754                                 if (stcb->asoc.auth_supported == 1) {
2755                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2756                                 }
2757                                 if (stcb->asoc.asconf_supported == 1) {
2758                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2759                                 }
2760                                 if (stcb->asoc.idata_supported == 1) {
2761                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING;
2762                                 }
2763                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2764                                 if (stcb->asoc.reconfig_supported == 1) {
2765                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2766                                 }
2767                                 sac->sac_length += i;
2768                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2769                                 memcpy(sac->sac_info, abort, abort_len);
2770                                 sac->sac_length += abort_len;
2771                         }
2772                 }
2773                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
2774                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2775                     0, 0, stcb->asoc.context, 0, 0, 0,
2776                     m_notify);
2777                 if (control != NULL) {
2778                         control->length = SCTP_BUF_LEN(m_notify);
2779                         control->spec_flags = M_NOTIFICATION;
2780                         /* not that we need this */
2781                         control->tail_mbuf = m_notify;
2782                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2783                             control,
2784                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2785                             so_locked);
2786                 } else {
2787                         sctp_m_freem(m_notify);
2788                 }
2789         }
2790         /*
2791          * For 1-to-1 style sockets, we send up and error when an ABORT
2792          * comes in.
2793          */
2794 set_error:
2795         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2796             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2797             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2798                 SOCK_LOCK(stcb->sctp_socket);
2799                 if (from_peer) {
2800                         if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {
2801                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2802                                 stcb->sctp_socket->so_error = ECONNREFUSED;
2803                         } else {
2804                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2805                                 stcb->sctp_socket->so_error = ECONNRESET;
2806                         }
2807                 } else {
2808                         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
2809                             (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
2810                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
2811                                 stcb->sctp_socket->so_error = ETIMEDOUT;
2812                         } else {
2813                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
2814                                 stcb->sctp_socket->so_error = ECONNABORTED;
2815                         }
2816                 }
2817         }
2818         /* Wake ANY sleepers */
2819 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2820         so = SCTP_INP_SO(stcb->sctp_ep);
2821         if (!so_locked) {
2822                 atomic_add_int(&stcb->asoc.refcnt, 1);
2823                 SCTP_TCB_UNLOCK(stcb);
2824                 SCTP_SOCKET_LOCK(so, 1);
2825                 SCTP_TCB_LOCK(stcb);
2826                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2827                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2828                         SCTP_SOCKET_UNLOCK(so, 1);
2829                         return;
2830                 }
2831         }
2832 #endif
2833         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2834             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2835             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2836                 socantrcvmore_locked(stcb->sctp_socket);
2837         }
2838         sorwakeup(stcb->sctp_socket);
2839         sowwakeup(stcb->sctp_socket);
2840 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2841         if (!so_locked) {
2842                 SCTP_SOCKET_UNLOCK(so, 1);
2843         }
2844 #endif
2845 }
2846
2847 static void
2848 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2849     struct sockaddr *sa, uint32_t error, int so_locked
2850 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2851     SCTP_UNUSED
2852 #endif
2853 )
2854 {
2855         struct mbuf *m_notify;
2856         struct sctp_paddr_change *spc;
2857         struct sctp_queued_to_read *control;
2858
2859         if ((stcb == NULL) ||
2860             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2861                 /* event not enabled */
2862                 return;
2863         }
2864         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
2865         if (m_notify == NULL)
2866                 return;
2867         SCTP_BUF_LEN(m_notify) = 0;
2868         spc = mtod(m_notify, struct sctp_paddr_change *);
2869         memset(spc, 0, sizeof(struct sctp_paddr_change));
2870         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2871         spc->spc_flags = 0;
2872         spc->spc_length = sizeof(struct sctp_paddr_change);
2873         switch (sa->sa_family) {
2874 #ifdef INET
2875         case AF_INET:
2876 #ifdef INET6
2877                 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
2878                         in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
2879                             (struct sockaddr_in6 *)&spc->spc_aaddr);
2880                 } else {
2881                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2882                 }
2883 #else
2884                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2885 #endif
2886                 break;
2887 #endif
2888 #ifdef INET6
2889         case AF_INET6:
2890                 {
2891                         struct sockaddr_in6 *sin6;
2892
2893                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2894
2895                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2896                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2897                                 if (sin6->sin6_scope_id == 0) {
2898                                         /* recover scope_id for user */
2899                                         (void)sa6_recoverscope(sin6);
2900                                 } else {
2901                                         /* clear embedded scope_id for user */
2902                                         in6_clearscope(&sin6->sin6_addr);
2903                                 }
2904                         }
2905                         break;
2906                 }
2907 #endif
2908         default:
2909                 /* TSNH */
2910                 break;
2911         }
2912         spc->spc_state = state;
2913         spc->spc_error = error;
2914         spc->spc_assoc_id = sctp_get_associd(stcb);
2915
2916         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2917         SCTP_BUF_NEXT(m_notify) = NULL;
2918
2919         /* append to socket */
2920         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2921             0, 0, stcb->asoc.context, 0, 0, 0,
2922             m_notify);
2923         if (control == NULL) {
2924                 /* no memory */
2925                 sctp_m_freem(m_notify);
2926                 return;
2927         }
2928         control->length = SCTP_BUF_LEN(m_notify);
2929         control->spec_flags = M_NOTIFICATION;
2930         /* not that we need this */
2931         control->tail_mbuf = m_notify;
2932         sctp_add_to_readq(stcb->sctp_ep, stcb,
2933             control,
2934             &stcb->sctp_socket->so_rcv, 1,
2935             SCTP_READ_LOCK_NOT_HELD,
2936             so_locked);
2937 }
2938
2939
2940 static void
2941 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
2942     struct sctp_tmit_chunk *chk, int so_locked
2943 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2944     SCTP_UNUSED
2945 #endif
2946 )
2947 {
2948         struct mbuf *m_notify;
2949         struct sctp_send_failed *ssf;
2950         struct sctp_send_failed_event *ssfe;
2951         struct sctp_queued_to_read *control;
2952         struct sctp_chunkhdr *chkhdr;
2953         int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len;
2954
2955         if ((stcb == NULL) ||
2956             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2957             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2958                 /* event not enabled */
2959                 return;
2960         }
2961
2962         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2963                 notifhdr_len = sizeof(struct sctp_send_failed_event);
2964         } else {
2965                 notifhdr_len = sizeof(struct sctp_send_failed);
2966         }
2967         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
2968         if (m_notify == NULL)
2969                 /* no space left */
2970                 return;
2971         SCTP_BUF_LEN(m_notify) = notifhdr_len;
2972         if (stcb->asoc.idata_supported) {
2973                 chkhdr_len = sizeof(struct sctp_idata_chunk);
2974         } else {
2975                 chkhdr_len = sizeof(struct sctp_data_chunk);
2976         }
2977         /* Use some defaults in case we can't access the chunk header */
2978         if (chk->send_size >= chkhdr_len) {
2979                 payload_len = chk->send_size - chkhdr_len;
2980         } else {
2981                 payload_len = 0;
2982         }
2983         padding_len = 0;
2984         if (chk->data != NULL) {
2985                 chkhdr = mtod(chk->data, struct sctp_chunkhdr *);
2986                 if (chkhdr != NULL) {
2987                         chk_len = ntohs(chkhdr->chunk_length);
2988                         if ((chk_len >= chkhdr_len) &&
2989                             (chk->send_size >= chk_len) &&
2990                             (chk->send_size - chk_len < 4)) {
2991                                 padding_len = chk->send_size - chk_len;
2992                                 payload_len = chk->send_size - chkhdr_len - padding_len;
2993                         }
2994                 }
2995         }
2996         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2997                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2998                 memset(ssfe, 0, notifhdr_len);
2999                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3000                 if (sent) {
3001                         ssfe->ssfe_flags = SCTP_DATA_SENT;
3002                 } else {
3003                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3004                 }
3005                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len);
3006                 ssfe->ssfe_error = error;
3007                 /* not exactly what the user sent in, but should be close :) */
3008                 ssfe->ssfe_info.snd_sid = chk->rec.data.sid;
3009                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
3010                 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid;
3011                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
3012                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3013                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3014         } else {
3015                 ssf = mtod(m_notify, struct sctp_send_failed *);
3016                 memset(ssf, 0, notifhdr_len);
3017                 ssf->ssf_type = SCTP_SEND_FAILED;
3018                 if (sent) {
3019                         ssf->ssf_flags = SCTP_DATA_SENT;
3020                 } else {
3021                         ssf->ssf_flags = SCTP_DATA_UNSENT;
3022                 }
3023                 ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len);
3024                 ssf->ssf_error = error;
3025                 /* not exactly what the user sent in, but should be close :) */
3026                 ssf->ssf_info.sinfo_stream = chk->rec.data.sid;
3027                 ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid;
3028                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
3029                 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid;
3030                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
3031                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3032                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3033         }
3034         if (chk->data != NULL) {
3035                 /* Trim off the sctp chunk header (it should be there) */
3036                 if (chk->send_size == chkhdr_len + payload_len + padding_len) {
3037                         m_adj(chk->data, chkhdr_len);
3038                         m_adj(chk->data, -padding_len);
3039                         sctp_mbuf_crush(chk->data);
3040                         chk->send_size -= (chkhdr_len + padding_len);
3041                 }
3042         }
3043         SCTP_BUF_NEXT(m_notify) = chk->data;
3044         /* Steal off the mbuf */
3045         chk->data = NULL;
3046         /*
3047          * For this case, we check the actual socket buffer, since the assoc
3048          * is going away we don't want to overfill the socket buffer for a
3049          * non-reader
3050          */
3051         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3052                 sctp_m_freem(m_notify);
3053                 return;
3054         }
3055         /* append to socket */
3056         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3057             0, 0, stcb->asoc.context, 0, 0, 0,
3058             m_notify);
3059         if (control == NULL) {
3060                 /* no memory */
3061                 sctp_m_freem(m_notify);
3062                 return;
3063         }
3064         control->length = SCTP_BUF_LEN(m_notify);
3065         control->spec_flags = M_NOTIFICATION;
3066         /* not that we need this */
3067         control->tail_mbuf = m_notify;
3068         sctp_add_to_readq(stcb->sctp_ep, stcb,
3069             control,
3070             &stcb->sctp_socket->so_rcv, 1,
3071             SCTP_READ_LOCK_NOT_HELD,
3072             so_locked);
3073 }
3074
3075
3076 static void
3077 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3078     struct sctp_stream_queue_pending *sp, int so_locked
3079 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3080     SCTP_UNUSED
3081 #endif
3082 )
3083 {
3084         struct mbuf *m_notify;
3085         struct sctp_send_failed *ssf;
3086         struct sctp_send_failed_event *ssfe;
3087         struct sctp_queued_to_read *control;
3088         int notifhdr_len;
3089
3090         if ((stcb == NULL) ||
3091             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3092             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3093                 /* event not enabled */
3094                 return;
3095         }
3096         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3097                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3098         } else {
3099                 notifhdr_len = sizeof(struct sctp_send_failed);
3100         }
3101         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3102         if (m_notify == NULL) {
3103                 /* no space left */
3104                 return;
3105         }
3106         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3107         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3108                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3109                 memset(ssfe, 0, notifhdr_len);
3110                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3111                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3112                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length);
3113                 ssfe->ssfe_error = error;
3114                 /* not exactly what the user sent in, but should be close :) */
3115                 ssfe->ssfe_info.snd_sid = sp->sid;
3116                 if (sp->some_taken) {
3117                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
3118                 } else {
3119                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
3120                 }
3121                 ssfe->ssfe_info.snd_ppid = sp->ppid;
3122                 ssfe->ssfe_info.snd_context = sp->context;
3123                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3124                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3125         } else {
3126                 ssf = mtod(m_notify, struct sctp_send_failed *);
3127                 memset(ssf, 0, notifhdr_len);
3128                 ssf->ssf_type = SCTP_SEND_FAILED;
3129                 ssf->ssf_flags = SCTP_DATA_UNSENT;
3130                 ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length);
3131                 ssf->ssf_error = error;
3132                 /* not exactly what the user sent in, but should be close :) */
3133                 ssf->ssf_info.sinfo_stream = sp->sid;
3134                 ssf->ssf_info.sinfo_ssn = 0;
3135                 if (sp->some_taken) {
3136                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3137                 } else {
3138                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3139                 }
3140                 ssf->ssf_info.sinfo_ppid = sp->ppid;
3141                 ssf->ssf_info.sinfo_context = sp->context;
3142                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3143                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3144         }
3145         SCTP_BUF_NEXT(m_notify) = sp->data;
3146
3147         /* Steal off the mbuf */
3148         sp->data = NULL;
3149         /*
3150          * For this case, we check the actual socket buffer, since the assoc
3151          * is going away we don't want to overfill the socket buffer for a
3152          * non-reader
3153          */
3154         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3155                 sctp_m_freem(m_notify);
3156                 return;
3157         }
3158         /* append to socket */
3159         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3160             0, 0, stcb->asoc.context, 0, 0, 0,
3161             m_notify);
3162         if (control == NULL) {
3163                 /* no memory */
3164                 sctp_m_freem(m_notify);
3165                 return;
3166         }
3167         control->length = SCTP_BUF_LEN(m_notify);
3168         control->spec_flags = M_NOTIFICATION;
3169         /* not that we need this */
3170         control->tail_mbuf = m_notify;
3171         sctp_add_to_readq(stcb->sctp_ep, stcb,
3172             control,
3173             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3174 }
3175
3176
3177
3178 static void
3179 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3180 {
3181         struct mbuf *m_notify;
3182         struct sctp_adaptation_event *sai;
3183         struct sctp_queued_to_read *control;
3184
3185         if ((stcb == NULL) ||
3186             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3187                 /* event not enabled */
3188                 return;
3189         }
3190
3191         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3192         if (m_notify == NULL)
3193                 /* no space left */
3194                 return;
3195         SCTP_BUF_LEN(m_notify) = 0;
3196         sai = mtod(m_notify, struct sctp_adaptation_event *);
3197         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3198         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3199         sai->sai_flags = 0;
3200         sai->sai_length = sizeof(struct sctp_adaptation_event);
3201         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3202         sai->sai_assoc_id = sctp_get_associd(stcb);
3203
3204         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3205         SCTP_BUF_NEXT(m_notify) = NULL;
3206
3207         /* append to socket */
3208         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3209             0, 0, stcb->asoc.context, 0, 0, 0,
3210             m_notify);
3211         if (control == NULL) {
3212                 /* no memory */
3213                 sctp_m_freem(m_notify);
3214                 return;
3215         }
3216         control->length = SCTP_BUF_LEN(m_notify);
3217         control->spec_flags = M_NOTIFICATION;
3218         /* not that we need this */
3219         control->tail_mbuf = m_notify;
3220         sctp_add_to_readq(stcb->sctp_ep, stcb,
3221             control,
3222             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3223 }
3224
3225 /* This always must be called with the read-queue LOCKED in the INP */
3226 static void
3227 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3228     uint32_t val, int so_locked
3229 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3230     SCTP_UNUSED
3231 #endif
3232 )
3233 {
3234         struct mbuf *m_notify;
3235         struct sctp_pdapi_event *pdapi;
3236         struct sctp_queued_to_read *control;
3237         struct sockbuf *sb;
3238
3239         if ((stcb == NULL) ||
3240             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3241                 /* event not enabled */
3242                 return;
3243         }
3244         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3245                 return;
3246         }
3247
3248         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3249         if (m_notify == NULL)
3250                 /* no space left */
3251                 return;
3252         SCTP_BUF_LEN(m_notify) = 0;
3253         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3254         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3255         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3256         pdapi->pdapi_flags = 0;
3257         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3258         pdapi->pdapi_indication = error;
3259         pdapi->pdapi_stream = (val >> 16);
3260         pdapi->pdapi_seq = (val & 0x0000ffff);
3261         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3262
3263         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3264         SCTP_BUF_NEXT(m_notify) = NULL;
3265         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3266             0, 0, stcb->asoc.context, 0, 0, 0,
3267             m_notify);
3268         if (control == NULL) {
3269                 /* no memory */
3270                 sctp_m_freem(m_notify);
3271                 return;
3272         }
3273         control->length = SCTP_BUF_LEN(m_notify);
3274         control->spec_flags = M_NOTIFICATION;
3275         /* not that we need this */
3276         control->tail_mbuf = m_notify;
3277         sb = &stcb->sctp_socket->so_rcv;
3278         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3279                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3280         }
3281         sctp_sballoc(stcb, sb, m_notify);
3282         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3283                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3284         }
3285         control->end_added = 1;
3286         if (stcb->asoc.control_pdapi)
3287                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3288         else {
3289                 /* we really should not see this case */
3290                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3291         }
3292         if (stcb->sctp_ep && stcb->sctp_socket) {
3293                 /* This should always be the case */
3294 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3295                 struct socket *so;
3296
3297                 so = SCTP_INP_SO(stcb->sctp_ep);
3298                 if (!so_locked) {
3299                         atomic_add_int(&stcb->asoc.refcnt, 1);
3300                         SCTP_TCB_UNLOCK(stcb);
3301                         SCTP_SOCKET_LOCK(so, 1);
3302                         SCTP_TCB_LOCK(stcb);
3303                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3304                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3305                                 SCTP_SOCKET_UNLOCK(so, 1);
3306                                 return;
3307                         }
3308                 }
3309 #endif
3310                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3311 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3312                 if (!so_locked) {
3313                         SCTP_SOCKET_UNLOCK(so, 1);
3314                 }
3315 #endif
3316         }
3317 }
3318
3319 static void
3320 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3321 {
3322         struct mbuf *m_notify;
3323         struct sctp_shutdown_event *sse;
3324         struct sctp_queued_to_read *control;
3325
3326         /*
3327          * For TCP model AND UDP connected sockets we will send an error up
3328          * when an SHUTDOWN completes
3329          */
3330         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3331             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3332                 /* mark socket closed for read/write and wakeup! */
3333 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3334                 struct socket *so;
3335
3336                 so = SCTP_INP_SO(stcb->sctp_ep);
3337                 atomic_add_int(&stcb->asoc.refcnt, 1);
3338                 SCTP_TCB_UNLOCK(stcb);
3339                 SCTP_SOCKET_LOCK(so, 1);
3340                 SCTP_TCB_LOCK(stcb);
3341                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3342                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3343                         SCTP_SOCKET_UNLOCK(so, 1);
3344                         return;
3345                 }
3346 #endif
3347                 socantsendmore(stcb->sctp_socket);
3348 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3349                 SCTP_SOCKET_UNLOCK(so, 1);
3350 #endif
3351         }
3352         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3353                 /* event not enabled */
3354                 return;
3355         }
3356
3357         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3358         if (m_notify == NULL)
3359                 /* no space left */
3360                 return;
3361         sse = mtod(m_notify, struct sctp_shutdown_event *);
3362         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3363         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3364         sse->sse_flags = 0;
3365         sse->sse_length = sizeof(struct sctp_shutdown_event);
3366         sse->sse_assoc_id = sctp_get_associd(stcb);
3367
3368         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3369         SCTP_BUF_NEXT(m_notify) = NULL;
3370
3371         /* append to socket */
3372         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3373             0, 0, stcb->asoc.context, 0, 0, 0,
3374             m_notify);
3375         if (control == NULL) {
3376                 /* no memory */
3377                 sctp_m_freem(m_notify);
3378                 return;
3379         }
3380         control->length = SCTP_BUF_LEN(m_notify);
3381         control->spec_flags = M_NOTIFICATION;
3382         /* not that we need this */
3383         control->tail_mbuf = m_notify;
3384         sctp_add_to_readq(stcb->sctp_ep, stcb,
3385             control,
3386             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3387 }
3388
3389 static void
3390 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3391     int so_locked
3392 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3393     SCTP_UNUSED
3394 #endif
3395 )
3396 {
3397         struct mbuf *m_notify;
3398         struct sctp_sender_dry_event *event;
3399         struct sctp_queued_to_read *control;
3400
3401         if ((stcb == NULL) ||
3402             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3403                 /* event not enabled */
3404                 return;
3405         }
3406
3407         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3408         if (m_notify == NULL) {
3409                 /* no space left */
3410                 return;
3411         }
3412         SCTP_BUF_LEN(m_notify) = 0;
3413         event = mtod(m_notify, struct sctp_sender_dry_event *);
3414         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3415         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3416         event->sender_dry_flags = 0;
3417         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3418         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3419
3420         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3421         SCTP_BUF_NEXT(m_notify) = NULL;
3422
3423         /* append to socket */
3424         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3425             0, 0, stcb->asoc.context, 0, 0, 0,
3426             m_notify);
3427         if (control == NULL) {
3428                 /* no memory */
3429                 sctp_m_freem(m_notify);
3430                 return;
3431         }
3432         control->length = SCTP_BUF_LEN(m_notify);
3433         control->spec_flags = M_NOTIFICATION;
3434         /* not that we need this */
3435         control->tail_mbuf = m_notify;
3436         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3437             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3438 }
3439
3440
3441 void
3442 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3443 {
3444         struct mbuf *m_notify;
3445         struct sctp_queued_to_read *control;
3446         struct sctp_stream_change_event *stradd;
3447
3448         if ((stcb == NULL) ||
3449             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3450                 /* event not enabled */
3451                 return;
3452         }
3453         if ((stcb->asoc.peer_req_out) && flag) {
3454                 /* Peer made the request, don't tell the local user */
3455                 stcb->asoc.peer_req_out = 0;
3456                 return;
3457         }
3458         stcb->asoc.peer_req_out = 0;
3459         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3460         if (m_notify == NULL)
3461                 /* no space left */
3462                 return;
3463         SCTP_BUF_LEN(m_notify) = 0;
3464         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3465         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3466         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3467         stradd->strchange_flags = flag;
3468         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3469         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3470         stradd->strchange_instrms = numberin;
3471         stradd->strchange_outstrms = numberout;
3472         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3473         SCTP_BUF_NEXT(m_notify) = NULL;
3474         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3475                 /* no space */
3476                 sctp_m_freem(m_notify);
3477                 return;
3478         }
3479         /* append to socket */
3480         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3481             0, 0, stcb->asoc.context, 0, 0, 0,
3482             m_notify);
3483         if (control == NULL) {
3484                 /* no memory */
3485                 sctp_m_freem(m_notify);
3486                 return;
3487         }
3488         control->length = SCTP_BUF_LEN(m_notify);
3489         control->spec_flags = M_NOTIFICATION;
3490         /* not that we need this */
3491         control->tail_mbuf = m_notify;
3492         sctp_add_to_readq(stcb->sctp_ep, stcb,
3493             control,
3494             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3495 }
3496
3497 void
3498 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3499 {
3500         struct mbuf *m_notify;
3501         struct sctp_queued_to_read *control;
3502         struct sctp_assoc_reset_event *strasoc;
3503
3504         if ((stcb == NULL) ||
3505             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3506                 /* event not enabled */
3507                 return;
3508         }
3509         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3510         if (m_notify == NULL)
3511                 /* no space left */
3512                 return;
3513         SCTP_BUF_LEN(m_notify) = 0;
3514         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3515         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3516         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3517         strasoc->assocreset_flags = flag;
3518         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3519         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3520         strasoc->assocreset_local_tsn = sending_tsn;
3521         strasoc->assocreset_remote_tsn = recv_tsn;
3522         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3523         SCTP_BUF_NEXT(m_notify) = NULL;
3524         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3525                 /* no space */
3526                 sctp_m_freem(m_notify);
3527                 return;
3528         }
3529         /* append to socket */
3530         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3531             0, 0, stcb->asoc.context, 0, 0, 0,
3532             m_notify);
3533         if (control == NULL) {
3534                 /* no memory */
3535                 sctp_m_freem(m_notify);
3536                 return;
3537         }
3538         control->length = SCTP_BUF_LEN(m_notify);
3539         control->spec_flags = M_NOTIFICATION;
3540         /* not that we need this */
3541         control->tail_mbuf = m_notify;
3542         sctp_add_to_readq(stcb->sctp_ep, stcb,
3543             control,
3544             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3545 }
3546
3547
3548
3549 static void
3550 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3551     int number_entries, uint16_t *list, int flag)
3552 {
3553         struct mbuf *m_notify;
3554         struct sctp_queued_to_read *control;
3555         struct sctp_stream_reset_event *strreset;
3556         int len;
3557
3558         if ((stcb == NULL) ||
3559             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3560                 /* event not enabled */
3561                 return;
3562         }
3563
3564         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3565         if (m_notify == NULL)
3566                 /* no space left */
3567                 return;
3568         SCTP_BUF_LEN(m_notify) = 0;
3569         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3570         if (len > M_TRAILINGSPACE(m_notify)) {
3571                 /* never enough room */
3572                 sctp_m_freem(m_notify);
3573                 return;
3574         }
3575         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3576         memset(strreset, 0, len);
3577         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3578         strreset->strreset_flags = flag;
3579         strreset->strreset_length = len;
3580         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3581         if (number_entries) {
3582                 int i;
3583
3584                 for (i = 0; i < number_entries; i++) {
3585                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3586                 }
3587         }
3588         SCTP_BUF_LEN(m_notify) = len;
3589         SCTP_BUF_NEXT(m_notify) = NULL;
3590         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3591                 /* no space */
3592                 sctp_m_freem(m_notify);
3593                 return;
3594         }
3595         /* append to socket */
3596         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3597             0, 0, stcb->asoc.context, 0, 0, 0,
3598             m_notify);
3599         if (control == NULL) {
3600                 /* no memory */
3601                 sctp_m_freem(m_notify);
3602                 return;
3603         }
3604         control->length = SCTP_BUF_LEN(m_notify);
3605         control->spec_flags = M_NOTIFICATION;
3606         /* not that we need this */
3607         control->tail_mbuf = m_notify;
3608         sctp_add_to_readq(stcb->sctp_ep, stcb,
3609             control,
3610             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3611 }
3612
3613
3614 static void
3615 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3616 {
3617         struct mbuf *m_notify;
3618         struct sctp_remote_error *sre;
3619         struct sctp_queued_to_read *control;
3620         unsigned int notif_len;
3621         uint16_t chunk_len;
3622
3623         if ((stcb == NULL) ||
3624             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3625                 return;
3626         }
3627         if (chunk != NULL) {
3628                 chunk_len = ntohs(chunk->ch.chunk_length);
3629                 /*
3630                  * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
3631                  * contiguous.
3632                  */
3633                 if (chunk_len > SCTP_CHUNK_BUFFER_SIZE) {
3634                         chunk_len = SCTP_CHUNK_BUFFER_SIZE;
3635                 }
3636         } else {
3637                 chunk_len = 0;
3638         }
3639         notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len);
3640         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3641         if (m_notify == NULL) {
3642                 /* Retry with smaller value. */
3643                 notif_len = (unsigned int)sizeof(struct sctp_remote_error);
3644                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3645                 if (m_notify == NULL) {
3646                         return;
3647                 }
3648         }
3649         SCTP_BUF_NEXT(m_notify) = NULL;
3650         sre = mtod(m_notify, struct sctp_remote_error *);
3651         memset(sre, 0, notif_len);
3652         sre->sre_type = SCTP_REMOTE_ERROR;
3653         sre->sre_flags = 0;
3654         sre->sre_length = sizeof(struct sctp_remote_error);
3655         sre->sre_error = error;
3656         sre->sre_assoc_id = sctp_get_associd(stcb);
3657         if (notif_len > sizeof(struct sctp_remote_error)) {
3658                 memcpy(sre->sre_data, chunk, chunk_len);
3659                 sre->sre_length += chunk_len;
3660         }
3661         SCTP_BUF_LEN(m_notify) = sre->sre_length;
3662         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3663             0, 0, stcb->asoc.context, 0, 0, 0,
3664             m_notify);
3665         if (control != NULL) {
3666                 control->length = SCTP_BUF_LEN(m_notify);
3667                 control->spec_flags = M_NOTIFICATION;
3668                 /* not that we need this */
3669                 control->tail_mbuf = m_notify;
3670                 sctp_add_to_readq(stcb->sctp_ep, stcb,
3671                     control,
3672                     &stcb->sctp_socket->so_rcv, 1,
3673                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3674         } else {
3675                 sctp_m_freem(m_notify);
3676         }
3677 }
3678
3679
3680 void
3681 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3682     uint32_t error, void *data, int so_locked
3683 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3684     SCTP_UNUSED
3685 #endif
3686 )
3687 {
3688         if ((stcb == NULL) ||
3689             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3690             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3691             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3692                 /* If the socket is gone we are out of here */
3693                 return;
3694         }
3695         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3696                 return;
3697         }
3698         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
3699             (SCTP_GET_STATE(stcb) ==  SCTP_STATE_COOKIE_ECHOED)) {
3700                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3701                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3702                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3703                         /* Don't report these in front states */
3704                         return;
3705                 }
3706         }
3707         switch (notification) {
3708         case SCTP_NOTIFY_ASSOC_UP:
3709                 if (stcb->asoc.assoc_up_sent == 0) {
3710                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
3711                         stcb->asoc.assoc_up_sent = 1;
3712                 }
3713                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3714                         sctp_notify_adaptation_layer(stcb);
3715                 }
3716                 if (stcb->asoc.auth_supported == 0) {
3717                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3718                             NULL, so_locked);
3719                 }
3720                 break;
3721         case SCTP_NOTIFY_ASSOC_DOWN:
3722                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
3723                 break;
3724         case SCTP_NOTIFY_INTERFACE_DOWN:
3725                 {
3726                         struct sctp_nets *net;
3727
3728                         net = (struct sctp_nets *)data;
3729                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3730                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3731                         break;
3732                 }
3733         case SCTP_NOTIFY_INTERFACE_UP:
3734                 {
3735                         struct sctp_nets *net;
3736
3737                         net = (struct sctp_nets *)data;
3738                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3739                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3740                         break;
3741                 }
3742         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3743                 {
3744                         struct sctp_nets *net;
3745
3746                         net = (struct sctp_nets *)data;
3747                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3748                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3749                         break;
3750                 }
3751         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3752                 sctp_notify_send_failed2(stcb, error,
3753                     (struct sctp_stream_queue_pending *)data, so_locked);
3754                 break;
3755         case SCTP_NOTIFY_SENT_DG_FAIL:
3756                 sctp_notify_send_failed(stcb, 1, error,
3757                     (struct sctp_tmit_chunk *)data, so_locked);
3758                 break;
3759         case SCTP_NOTIFY_UNSENT_DG_FAIL:
3760                 sctp_notify_send_failed(stcb, 0, error,
3761                     (struct sctp_tmit_chunk *)data, so_locked);
3762                 break;
3763         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3764                 {
3765                         uint32_t val;
3766
3767                         val = *((uint32_t *)data);
3768
3769                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3770                         break;
3771                 }
3772         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
3773                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
3774                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
3775                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
3776                 } else {
3777                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
3778                 }
3779                 break;
3780         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
3781                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
3782                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
3783                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
3784                 } else {
3785                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
3786                 }
3787                 break;
3788         case SCTP_NOTIFY_ASSOC_RESTART:
3789                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
3790                 if (stcb->asoc.auth_supported == 0) {
3791                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3792                             NULL, so_locked);
3793                 }
3794                 break;
3795         case SCTP_NOTIFY_STR_RESET_SEND:
3796                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN);
3797                 break;
3798         case SCTP_NOTIFY_STR_RESET_RECV:
3799                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING);
3800                 break;
3801         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3802                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3803                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3804                 break;
3805         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3806                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3807                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3808                 break;
3809         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3810                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3811                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3812                 break;
3813         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3814                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3815                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3816                 break;
3817         case SCTP_NOTIFY_ASCONF_ADD_IP:
3818                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3819                     error, so_locked);
3820                 break;
3821         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3822                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3823                     error, so_locked);
3824                 break;
3825         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3826                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3827                     error, so_locked);
3828                 break;
3829         case SCTP_NOTIFY_PEER_SHUTDOWN:
3830                 sctp_notify_shutdown_event(stcb);
3831                 break;
3832         case SCTP_NOTIFY_AUTH_NEW_KEY:
3833                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3834                     (uint16_t)(uintptr_t)data,
3835                     so_locked);
3836                 break;
3837         case SCTP_NOTIFY_AUTH_FREE_KEY:
3838                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3839                     (uint16_t)(uintptr_t)data,
3840                     so_locked);
3841                 break;
3842         case SCTP_NOTIFY_NO_PEER_AUTH:
3843                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3844                     (uint16_t)(uintptr_t)data,
3845                     so_locked);
3846                 break;
3847         case SCTP_NOTIFY_SENDER_DRY:
3848                 sctp_notify_sender_dry_event(stcb, so_locked);
3849                 break;
3850         case SCTP_NOTIFY_REMOTE_ERROR:
3851                 sctp_notify_remote_error(stcb, error, data);
3852                 break;
3853         default:
3854                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3855                     __func__, notification, notification);
3856                 break;
3857         }                       /* end switch */
3858 }
3859
3860 void
3861 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int holds_lock, int so_locked
3862 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3863     SCTP_UNUSED
3864 #endif
3865 )
3866 {
3867         struct sctp_association *asoc;
3868         struct sctp_stream_out *outs;
3869         struct sctp_tmit_chunk *chk, *nchk;
3870         struct sctp_stream_queue_pending *sp, *nsp;
3871         int i;
3872
3873         if (stcb == NULL) {
3874                 return;
3875         }
3876         asoc = &stcb->asoc;
3877         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3878                 /* already being freed */
3879                 return;
3880         }
3881         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3882             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3883             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3884                 return;
3885         }
3886         /* now through all the gunk freeing chunks */
3887         if (holds_lock == 0) {
3888                 SCTP_TCB_SEND_LOCK(stcb);
3889         }
3890         /* sent queue SHOULD be empty */
3891         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3892                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3893                 asoc->sent_queue_cnt--;
3894                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
3895                         if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3896                                 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3897 #ifdef INVARIANTS
3898                         } else {
3899                                 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3900 #endif
3901                         }
3902                 }
3903                 if (chk->data != NULL) {
3904                         sctp_free_bufspace(stcb, asoc, chk, 1);
3905                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
3906                             error, chk, so_locked);
3907                         if (chk->data) {
3908                                 sctp_m_freem(chk->data);
3909                                 chk->data = NULL;
3910                         }
3911                 }
3912                 sctp_free_a_chunk(stcb, chk, so_locked);
3913                 /* sa_ignore FREED_MEMORY */
3914         }
3915         /* pending send queue SHOULD be empty */
3916         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3917                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3918                 asoc->send_queue_cnt--;
3919                 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3920                         asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3921 #ifdef INVARIANTS
3922                 } else {
3923                         panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3924 #endif
3925                 }
3926                 if (chk->data != NULL) {
3927                         sctp_free_bufspace(stcb, asoc, chk, 1);
3928                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
3929                             error, chk, so_locked);
3930                         if (chk->data) {
3931                                 sctp_m_freem(chk->data);
3932                                 chk->data = NULL;
3933                         }
3934                 }
3935                 sctp_free_a_chunk(stcb, chk, so_locked);
3936                 /* sa_ignore FREED_MEMORY */
3937         }
3938         for (i = 0; i < asoc->streamoutcnt; i++) {
3939                 /* For each stream */
3940                 outs = &asoc->strmout[i];
3941                 /* clean up any sends there */
3942                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3943                         atomic_subtract_int(&asoc->stream_queue_cnt, 1);
3944                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3945                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, holds_lock);
3946                         sctp_free_spbufspace(stcb, asoc, sp);
3947                         if (sp->data) {
3948                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3949                                     error, (void *)sp, so_locked);
3950                                 if (sp->data) {
3951                                         sctp_m_freem(sp->data);
3952                                         sp->data = NULL;
3953                                         sp->tail_mbuf = NULL;
3954                                         sp->length = 0;
3955                                 }
3956                         }
3957                         if (sp->net) {
3958                                 sctp_free_remote_addr(sp->net);
3959                                 sp->net = NULL;
3960                         }
3961                         /* Free the chunk */
3962                         sctp_free_a_strmoq(stcb, sp, so_locked);
3963                         /* sa_ignore FREED_MEMORY */
3964                 }
3965         }
3966
3967         if (holds_lock == 0) {
3968                 SCTP_TCB_SEND_UNLOCK(stcb);
3969         }
3970 }
3971
3972 void
3973 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
3974     struct sctp_abort_chunk *abort, int so_locked
3975 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3976     SCTP_UNUSED
3977 #endif
3978 )
3979 {
3980         if (stcb == NULL) {
3981                 return;
3982         }
3983         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3984             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3985             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3986                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3987         }
3988         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3989             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3990             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3991                 return;
3992         }
3993         /* Tell them we lost the asoc */
3994         sctp_report_all_outbound(stcb, error, 1, so_locked);
3995         if (from_peer) {
3996                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
3997         } else {
3998                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
3999         }
4000 }
4001
4002 void
4003 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4004     struct mbuf *m, int iphlen,
4005     struct sockaddr *src, struct sockaddr *dst,
4006     struct sctphdr *sh, struct mbuf *op_err,
4007     uint8_t mflowtype, uint32_t mflowid,
4008     uint32_t vrf_id, uint16_t port)
4009 {
4010         uint32_t vtag;
4011 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4012         struct socket *so;
4013 #endif
4014
4015         vtag = 0;
4016         if (stcb != NULL) {
4017                 vtag = stcb->asoc.peer_vtag;
4018                 vrf_id = stcb->asoc.vrf_id;
4019         }
4020         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
4021             mflowtype, mflowid, inp->fibnum,
4022             vrf_id, port);
4023         if (stcb != NULL) {
4024                 /* We have a TCB to abort, send notification too */
4025                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
4026                 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED);
4027                 /* Ok, now lets free it */
4028 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4029                 so = SCTP_INP_SO(inp);
4030                 atomic_add_int(&stcb->asoc.refcnt, 1);
4031                 SCTP_TCB_UNLOCK(stcb);
4032                 SCTP_SOCKET_LOCK(so, 1);
4033                 SCTP_TCB_LOCK(stcb);
4034                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4035 #endif
4036                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4037                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4038                     (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4039                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4040                 }
4041                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4042                     SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
4043 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4044                 SCTP_SOCKET_UNLOCK(so, 1);
4045 #endif
4046         }
4047 }
4048 #ifdef SCTP_ASOCLOG_OF_TSNS
4049 void
4050 sctp_print_out_track_log(struct sctp_tcb *stcb)
4051 {
4052 #ifdef NOSIY_PRINTS
4053         int i;
4054
4055         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
4056         SCTP_PRINTF("IN bound TSN log-aaa\n");
4057         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
4058                 SCTP_PRINTF("None rcvd\n");
4059                 goto none_in;
4060         }
4061         if (stcb->asoc.tsn_in_wrapped) {
4062                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
4063                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4064                             stcb->asoc.in_tsnlog[i].tsn,
4065                             stcb->asoc.in_tsnlog[i].strm,
4066                             stcb->asoc.in_tsnlog[i].seq,
4067                             stcb->asoc.in_tsnlog[i].flgs,
4068                             stcb->asoc.in_tsnlog[i].sz);
4069                 }
4070         }
4071         if (stcb->asoc.tsn_in_at) {
4072                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
4073                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4074                             stcb->asoc.in_tsnlog[i].tsn,
4075                             stcb->asoc.in_tsnlog[i].strm,
4076                             stcb->asoc.in_tsnlog[i].seq,
4077                             stcb->asoc.in_tsnlog[i].flgs,
4078                             stcb->asoc.in_tsnlog[i].sz);
4079                 }
4080         }
4081 none_in:
4082         SCTP_PRINTF("OUT bound TSN log-aaa\n");
4083         if ((stcb->asoc.tsn_out_at == 0) &&
4084             (stcb->asoc.tsn_out_wrapped == 0)) {
4085                 SCTP_PRINTF("None sent\n");
4086         }
4087         if (stcb->asoc.tsn_out_wrapped) {
4088                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
4089                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4090                             stcb->asoc.out_tsnlog[i].tsn,
4091                             stcb->asoc.out_tsnlog[i].strm,
4092                             stcb->asoc.out_tsnlog[i].seq,
4093                             stcb->asoc.out_tsnlog[i].flgs,
4094                             stcb->asoc.out_tsnlog[i].sz);
4095                 }
4096         }
4097         if (stcb->asoc.tsn_out_at) {
4098                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
4099                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4100                             stcb->asoc.out_tsnlog[i].tsn,
4101                             stcb->asoc.out_tsnlog[i].strm,
4102                             stcb->asoc.out_tsnlog[i].seq,
4103                             stcb->asoc.out_tsnlog[i].flgs,
4104                             stcb->asoc.out_tsnlog[i].sz);
4105                 }
4106         }
4107 #endif
4108 }
4109 #endif
4110
4111 void
4112 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4113     struct mbuf *op_err,
4114     int so_locked
4115 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4116     SCTP_UNUSED
4117 #endif
4118 )
4119 {
4120 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4121         struct socket *so;
4122 #endif
4123
4124 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4125         so = SCTP_INP_SO(inp);
4126 #endif
4127         if (stcb == NULL) {
4128                 /* Got to have a TCB */
4129                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4130                         if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4131                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4132                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
4133                         }
4134                 }
4135                 return;
4136         } else {
4137                 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED);
4138         }
4139         /* notify the peer */
4140         sctp_send_abort_tcb(stcb, op_err, so_locked);
4141         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4142         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4143             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4144                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4145         }
4146         /* notify the ulp */
4147         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4148                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
4149         }
4150         /* now free the asoc */
4151 #ifdef SCTP_ASOCLOG_OF_TSNS
4152         sctp_print_out_track_log(stcb);
4153 #endif
4154 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4155         if (!so_locked) {
4156                 atomic_add_int(&stcb->asoc.refcnt, 1);
4157                 SCTP_TCB_UNLOCK(stcb);
4158                 SCTP_SOCKET_LOCK(so, 1);
4159                 SCTP_TCB_LOCK(stcb);
4160                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4161         }
4162 #endif
4163         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4164             SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4165 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4166         if (!so_locked) {
4167                 SCTP_SOCKET_UNLOCK(so, 1);
4168         }
4169 #endif
4170 }
4171
4172 void
4173 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4174     struct sockaddr *src, struct sockaddr *dst,
4175     struct sctphdr *sh, struct sctp_inpcb *inp,
4176     struct mbuf *cause,
4177     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4178     uint32_t vrf_id, uint16_t port)
4179 {
4180         struct sctp_chunkhdr *ch, chunk_buf;
4181         unsigned int chk_length;
4182         int contains_init_chunk;
4183
4184         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4185         /* Generate a TO address for future reference */
4186         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4187                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4188                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4189                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4190                 }
4191         }
4192         contains_init_chunk = 0;
4193         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4194             sizeof(*ch), (uint8_t *)&chunk_buf);
4195         while (ch != NULL) {
4196                 chk_length = ntohs(ch->chunk_length);
4197                 if (chk_length < sizeof(*ch)) {
4198                         /* break to abort land */
4199                         break;
4200                 }
4201                 switch (ch->chunk_type) {
4202                 case SCTP_INIT:
4203                         contains_init_chunk = 1;
4204                         break;
4205                 case SCTP_PACKET_DROPPED:
4206                         /* we don't respond to pkt-dropped */
4207                         return;
4208                 case SCTP_ABORT_ASSOCIATION:
4209                         /* we don't respond with an ABORT to an ABORT */
4210                         return;
4211                 case SCTP_SHUTDOWN_COMPLETE:
4212                         /*
4213                          * we ignore it since we are not waiting for it and
4214                          * peer is gone
4215                          */
4216                         return;
4217                 case SCTP_SHUTDOWN_ACK:
4218                         sctp_send_shutdown_complete2(src, dst, sh,
4219                             mflowtype, mflowid, fibnum,
4220                             vrf_id, port);
4221                         return;
4222                 default:
4223                         break;
4224                 }
4225                 offset += SCTP_SIZE32(chk_length);
4226                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4227                     sizeof(*ch), (uint8_t *)&chunk_buf);
4228         }
4229         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4230             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4231             (contains_init_chunk == 0))) {
4232                 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4233                     mflowtype, mflowid, fibnum,
4234                     vrf_id, port);
4235         }
4236 }
4237
4238 /*
4239  * check the inbound datagram to make sure there is not an abort inside it,
4240  * if there is return 1, else return 0.
4241  */
4242 int
4243 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtagfill)
4244 {
4245         struct sctp_chunkhdr *ch;
4246         struct sctp_init_chunk *init_chk, chunk_buf;
4247         int offset;
4248         unsigned int chk_length;
4249
4250         offset = iphlen + sizeof(struct sctphdr);
4251         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4252             (uint8_t *)&chunk_buf);
4253         while (ch != NULL) {
4254                 chk_length = ntohs(ch->chunk_length);
4255                 if (chk_length < sizeof(*ch)) {
4256                         /* packet is probably corrupt */
4257                         break;
4258                 }
4259                 /* we seem to be ok, is it an abort? */
4260                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4261                         /* yep, tell them */
4262                         return (1);
4263                 }
4264                 if (ch->chunk_type == SCTP_INITIATION) {
4265                         /* need to update the Vtag */
4266                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4267                             offset, sizeof(*init_chk), (uint8_t *)&chunk_buf);
4268                         if (init_chk != NULL) {
4269                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4270                         }
4271                 }
4272                 /* Nope, move to the next chunk */
4273                 offset += SCTP_SIZE32(chk_length);
4274                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4275                     sizeof(*ch), (uint8_t *)&chunk_buf);
4276         }
4277         return (0);
4278 }
4279
4280 /*
4281  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4282  * set (i.e. it's 0) so, create this function to compare link local scopes
4283  */
4284 #ifdef INET6
4285 uint32_t
4286 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4287 {
4288         struct sockaddr_in6 a, b;
4289
4290         /* save copies */
4291         a = *addr1;
4292         b = *addr2;
4293
4294         if (a.sin6_scope_id == 0)
4295                 if (sa6_recoverscope(&a)) {
4296                         /* can't get scope, so can't match */
4297                         return (0);
4298                 }
4299         if (b.sin6_scope_id == 0)
4300                 if (sa6_recoverscope(&b)) {
4301                         /* can't get scope, so can't match */
4302                         return (0);
4303                 }
4304         if (a.sin6_scope_id != b.sin6_scope_id)
4305                 return (0);
4306
4307         return (1);
4308 }
4309
4310 /*
4311  * returns a sockaddr_in6 with embedded scope recovered and removed
4312  */
4313 struct sockaddr_in6 *
4314 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4315 {
4316         /* check and strip embedded scope junk */
4317         if (addr->sin6_family == AF_INET6) {
4318                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4319                         if (addr->sin6_scope_id == 0) {
4320                                 *store = *addr;
4321                                 if (!sa6_recoverscope(store)) {
4322                                         /* use the recovered scope */
4323                                         addr = store;
4324                                 }
4325                         } else {
4326                                 /* else, return the original "to" addr */
4327                                 in6_clearscope(&addr->sin6_addr);
4328                         }
4329                 }
4330         }
4331         return (addr);
4332 }
4333 #endif
4334
4335 /*
4336  * are the two addresses the same?  currently a "scopeless" check returns: 1
4337  * if same, 0 if not
4338  */
4339 int
4340 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4341 {
4342
4343         /* must be valid */
4344         if (sa1 == NULL || sa2 == NULL)
4345                 return (0);
4346
4347         /* must be the same family */
4348         if (sa1->sa_family != sa2->sa_family)
4349                 return (0);
4350
4351         switch (sa1->sa_family) {
4352 #ifdef INET6
4353         case AF_INET6:
4354                 {
4355                         /* IPv6 addresses */
4356                         struct sockaddr_in6 *sin6_1, *sin6_2;
4357
4358                         sin6_1 = (struct sockaddr_in6 *)sa1;
4359                         sin6_2 = (struct sockaddr_in6 *)sa2;
4360                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4361                             sin6_2));
4362                 }
4363 #endif
4364 #ifdef INET
4365         case AF_INET:
4366                 {
4367                         /* IPv4 addresses */
4368                         struct sockaddr_in *sin_1, *sin_2;
4369
4370                         sin_1 = (struct sockaddr_in *)sa1;
4371                         sin_2 = (struct sockaddr_in *)sa2;
4372                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4373                 }
4374 #endif
4375         default:
4376                 /* we don't do these... */
4377                 return (0);
4378         }
4379 }
4380
4381 void
4382 sctp_print_address(struct sockaddr *sa)
4383 {
4384 #ifdef INET6
4385         char ip6buf[INET6_ADDRSTRLEN];
4386 #endif
4387
4388         switch (sa->sa_family) {
4389 #ifdef INET6
4390         case AF_INET6:
4391                 {
4392                         struct sockaddr_in6 *sin6;
4393
4394                         sin6 = (struct sockaddr_in6 *)sa;
4395                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4396                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4397                             ntohs(sin6->sin6_port),
4398                             sin6->sin6_scope_id);
4399                         break;
4400                 }
4401 #endif
4402 #ifdef INET
4403         case AF_INET:
4404                 {
4405                         struct sockaddr_in *sin;
4406                         unsigned char *p;
4407
4408                         sin = (struct sockaddr_in *)sa;
4409                         p = (unsigned char *)&sin->sin_addr;
4410                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4411                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4412                         break;
4413                 }
4414 #endif
4415         default:
4416                 SCTP_PRINTF("?\n");
4417                 break;
4418         }
4419 }
4420
4421 void
4422 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4423     struct sctp_inpcb *new_inp,
4424     struct sctp_tcb *stcb,
4425     int waitflags)
4426 {
4427         /*
4428          * go through our old INP and pull off any control structures that
4429          * belong to stcb and move then to the new inp.
4430          */
4431         struct socket *old_so, *new_so;
4432         struct sctp_queued_to_read *control, *nctl;
4433         struct sctp_readhead tmp_queue;
4434         struct mbuf *m;
4435         int error = 0;
4436
4437         old_so = old_inp->sctp_socket;
4438         new_so = new_inp->sctp_socket;
4439         TAILQ_INIT(&tmp_queue);
4440         error = sblock(&old_so->so_rcv, waitflags);
4441         if (error) {
4442                 /*
4443                  * Gak, can't get sblock, we have a problem. data will be
4444                  * left stranded.. and we don't dare look at it since the
4445                  * other thread may be reading something. Oh well, its a
4446                  * screwed up app that does a peeloff OR a accept while
4447                  * reading from the main socket... actually its only the
4448                  * peeloff() case, since I think read will fail on a
4449                  * listening socket..
4450                  */
4451                 return;
4452         }
4453         /* lock the socket buffers */
4454         SCTP_INP_READ_LOCK(old_inp);
4455         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4456                 /* Pull off all for out target stcb */
4457                 if (control->stcb == stcb) {
4458                         /* remove it we want it */
4459                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4460                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4461                         m = control->data;
4462                         while (m) {
4463                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4464                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4465                                 }
4466                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4467                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4468                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4469                                 }
4470                                 m = SCTP_BUF_NEXT(m);
4471                         }
4472                 }
4473         }
4474         SCTP_INP_READ_UNLOCK(old_inp);
4475         /* Remove the sb-lock on the old socket */
4476
4477         sbunlock(&old_so->so_rcv);
4478         /* Now we move them over to the new socket buffer */
4479         SCTP_INP_READ_LOCK(new_inp);
4480         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4481                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4482                 m = control->data;
4483                 while (m) {
4484                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4485                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4486                         }
4487                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4488                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4489                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4490                         }
4491                         m = SCTP_BUF_NEXT(m);
4492                 }
4493         }
4494         SCTP_INP_READ_UNLOCK(new_inp);
4495 }
4496
4497 void
4498 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
4499     struct sctp_tcb *stcb,
4500     int so_locked
4501 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4502     SCTP_UNUSED
4503 #endif
4504 )
4505 {
4506         if ((inp != NULL) && (inp->sctp_socket != NULL)) {
4507 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4508                 struct socket *so;
4509
4510                 so = SCTP_INP_SO(inp);
4511                 if (!so_locked) {
4512                         if (stcb) {
4513                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4514                                 SCTP_TCB_UNLOCK(stcb);
4515                         }
4516                         SCTP_SOCKET_LOCK(so, 1);
4517                         if (stcb) {
4518                                 SCTP_TCB_LOCK(stcb);
4519                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4520                         }
4521                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4522                                 SCTP_SOCKET_UNLOCK(so, 1);
4523                                 return;
4524                         }
4525                 }
4526 #endif
4527                 sctp_sorwakeup(inp, inp->sctp_socket);
4528 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4529                 if (!so_locked) {
4530                         SCTP_SOCKET_UNLOCK(so, 1);
4531                 }
4532 #endif
4533         }
4534 }
4535
4536 void
4537 sctp_add_to_readq(struct sctp_inpcb *inp,
4538     struct sctp_tcb *stcb,
4539     struct sctp_queued_to_read *control,
4540     struct sockbuf *sb,
4541     int end,
4542     int inp_read_lock_held,
4543     int so_locked
4544 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4545     SCTP_UNUSED
4546 #endif
4547 )
4548 {
4549         /*
4550          * Here we must place the control on the end of the socket read
4551          * queue AND increment sb_cc so that select will work properly on
4552          * read.
4553          */
4554         struct mbuf *m, *prev = NULL;
4555
4556         if (inp == NULL) {
4557                 /* Gak, TSNH!! */
4558 #ifdef INVARIANTS
4559                 panic("Gak, inp NULL on add_to_readq");
4560 #endif
4561                 return;
4562         }
4563         if (inp_read_lock_held == 0)
4564                 SCTP_INP_READ_LOCK(inp);
4565         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4566                 sctp_free_remote_addr(control->whoFrom);
4567                 if (control->data) {
4568                         sctp_m_freem(control->data);
4569                         control->data = NULL;
4570                 }
4571                 sctp_free_a_readq(stcb, control);
4572                 if (inp_read_lock_held == 0)
4573                         SCTP_INP_READ_UNLOCK(inp);
4574                 return;
4575         }
4576         if (!(control->spec_flags & M_NOTIFICATION)) {
4577                 atomic_add_int(&inp->total_recvs, 1);
4578                 if (!control->do_not_ref_stcb) {
4579                         atomic_add_int(&stcb->total_recvs, 1);
4580                 }
4581         }
4582         m = control->data;
4583         control->held_length = 0;
4584         control->length = 0;
4585         while (m) {
4586                 if (SCTP_BUF_LEN(m) == 0) {
4587                         /* Skip mbufs with NO length */
4588                         if (prev == NULL) {
4589                                 /* First one */
4590                                 control->data = sctp_m_free(m);
4591                                 m = control->data;
4592                         } else {
4593                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4594                                 m = SCTP_BUF_NEXT(prev);
4595                         }
4596                         if (m == NULL) {
4597                                 control->tail_mbuf = prev;
4598                         }
4599                         continue;
4600                 }
4601                 prev = m;
4602                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4603                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4604                 }
4605                 sctp_sballoc(stcb, sb, m);
4606                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4607                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4608                 }
4609                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4610                 m = SCTP_BUF_NEXT(m);
4611         }
4612         if (prev != NULL) {
4613                 control->tail_mbuf = prev;
4614         } else {
4615                 /* Everything got collapsed out?? */
4616                 sctp_free_remote_addr(control->whoFrom);
4617                 sctp_free_a_readq(stcb, control);
4618                 if (inp_read_lock_held == 0)
4619                         SCTP_INP_READ_UNLOCK(inp);
4620                 return;
4621         }
4622         if (end) {
4623                 control->end_added = 1;
4624         }
4625         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4626         control->on_read_q = 1;
4627         if (inp_read_lock_held == 0)
4628                 SCTP_INP_READ_UNLOCK(inp);
4629         if (inp && inp->sctp_socket) {
4630                 sctp_wakeup_the_read_socket(inp, stcb, so_locked);
4631         }
4632 }
4633
4634 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4635  *************ALTERNATE ROUTING CODE
4636  */
4637
4638 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4639  *************ALTERNATE ROUTING CODE
4640  */
4641
4642 struct mbuf *
4643 sctp_generate_cause(uint16_t code, char *info)
4644 {
4645         struct mbuf *m;
4646         struct sctp_gen_error_cause *cause;
4647         size_t info_len;
4648         uint16_t len;
4649
4650         if ((code == 0) || (info == NULL)) {
4651                 return (NULL);
4652         }
4653         info_len = strlen(info);
4654         if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) {
4655                 return (NULL);
4656         }
4657         len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len);
4658         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4659         if (m != NULL) {
4660                 SCTP_BUF_LEN(m) = len;
4661                 cause = mtod(m, struct sctp_gen_error_cause *);
4662                 cause->code = htons(code);
4663                 cause->length = htons(len);
4664                 memcpy(cause->info, info, info_len);
4665         }
4666         return (m);
4667 }
4668
4669 struct mbuf *
4670 sctp_generate_no_user_data_cause(uint32_t tsn)
4671 {
4672         struct mbuf *m;
4673         struct sctp_error_no_user_data *no_user_data_cause;
4674         uint16_t len;
4675
4676         len = (uint16_t)sizeof(struct sctp_error_no_user_data);
4677         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4678         if (m != NULL) {
4679                 SCTP_BUF_LEN(m) = len;
4680                 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
4681                 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
4682                 no_user_data_cause->cause.length = htons(len);
4683                 no_user_data_cause->tsn = htonl(tsn);
4684         }
4685         return (m);
4686 }
4687
4688 #ifdef SCTP_MBCNT_LOGGING
4689 void
4690 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4691     struct sctp_tmit_chunk *tp1, int chk_cnt)
4692 {
4693         if (tp1->data == NULL) {
4694                 return;
4695         }
4696         asoc->chunks_on_out_queue -= chk_cnt;
4697         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4698                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4699                     asoc->total_output_queue_size,
4700                     tp1->book_size,
4701                     0,
4702                     tp1->mbcnt);
4703         }
4704         if (asoc->total_output_queue_size >= tp1->book_size) {
4705                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4706         } else {
4707                 asoc->total_output_queue_size = 0;
4708         }
4709
4710         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4711             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4712                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4713                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4714                 } else {
4715                         stcb->sctp_socket->so_snd.sb_cc = 0;
4716
4717                 }
4718         }
4719 }
4720
4721 #endif
4722
4723 int
4724 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4725     uint8_t sent, int so_locked
4726 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4727     SCTP_UNUSED
4728 #endif
4729 )
4730 {
4731         struct sctp_stream_out *strq;
4732         struct sctp_tmit_chunk *chk = NULL, *tp2;
4733         struct sctp_stream_queue_pending *sp;
4734         uint32_t mid;
4735         uint16_t sid;
4736         uint8_t foundeom = 0;
4737         int ret_sz = 0;
4738         int notdone;
4739         int do_wakeup_routine = 0;
4740
4741         sid = tp1->rec.data.sid;
4742         mid = tp1->rec.data.mid;
4743         if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
4744                 stcb->asoc.abandoned_sent[0]++;
4745                 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4746                 stcb->asoc.strmout[sid].abandoned_sent[0]++;
4747 #if defined(SCTP_DETAILED_STR_STATS)
4748                 stcb->asoc.strmout[stream].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4749 #endif
4750         } else {
4751                 stcb->asoc.abandoned_unsent[0]++;
4752                 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4753                 stcb->asoc.strmout[sid].abandoned_unsent[0]++;
4754 #if defined(SCTP_DETAILED_STR_STATS)
4755                 stcb->asoc.strmout[stream].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4756 #endif
4757         }
4758         do {
4759                 ret_sz += tp1->book_size;
4760                 if (tp1->data != NULL) {
4761                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4762                                 sctp_flight_size_decrease(tp1);
4763                                 sctp_total_flight_decrease(stcb, tp1);
4764                         }
4765                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4766                         stcb->asoc.peers_rwnd += tp1->send_size;
4767                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4768                         if (sent) {
4769                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4770                         } else {
4771                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4772                         }
4773                         if (tp1->data) {
4774                                 sctp_m_freem(tp1->data);
4775                                 tp1->data = NULL;
4776                         }
4777                         do_wakeup_routine = 1;
4778                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4779                                 stcb->asoc.sent_queue_cnt_removeable--;
4780                         }
4781                 }
4782                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4783                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4784                     SCTP_DATA_NOT_FRAG) {
4785                         /* not frag'ed we ae done   */
4786                         notdone = 0;
4787                         foundeom = 1;
4788                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4789                         /* end of frag, we are done */
4790                         notdone = 0;
4791                         foundeom = 1;
4792                 } else {
4793                         /*
4794                          * Its a begin or middle piece, we must mark all of
4795                          * it
4796                          */
4797                         notdone = 1;
4798                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4799                 }
4800         } while (tp1 && notdone);
4801         if (foundeom == 0) {
4802                 /*
4803                  * The multi-part message was scattered across the send and
4804                  * sent queue.
4805                  */
4806                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4807                         if ((tp1->rec.data.sid != sid) ||
4808                             (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) {
4809                                 break;
4810                         }
4811                         /*
4812                          * save to chk in case we have some on stream out
4813                          * queue. If so and we have an un-transmitted one we
4814                          * don't have to fudge the TSN.
4815                          */
4816                         chk = tp1;
4817                         ret_sz += tp1->book_size;
4818                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4819                         if (sent) {
4820                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4821                         } else {
4822                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4823                         }
4824                         if (tp1->data) {
4825                                 sctp_m_freem(tp1->data);
4826                                 tp1->data = NULL;
4827                         }
4828                         /* No flight involved here book the size to 0 */
4829                         tp1->book_size = 0;
4830                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4831                                 foundeom = 1;
4832                         }
4833                         do_wakeup_routine = 1;
4834                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4835                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4836                         /*
4837                          * on to the sent queue so we can wait for it to be
4838                          * passed by.
4839                          */
4840                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4841                             sctp_next);
4842                         stcb->asoc.send_queue_cnt--;
4843                         stcb->asoc.sent_queue_cnt++;
4844                 }
4845         }
4846         if (foundeom == 0) {
4847                 /*
4848                  * Still no eom found. That means there is stuff left on the
4849                  * stream out queue.. yuck.
4850                  */
4851                 SCTP_TCB_SEND_LOCK(stcb);
4852                 strq = &stcb->asoc.strmout[sid];
4853                 sp = TAILQ_FIRST(&strq->outqueue);
4854                 if (sp != NULL) {
4855                         sp->discard_rest = 1;
4856                         /*
4857                          * We may need to put a chunk on the queue that
4858                          * holds the TSN that would have been sent with the
4859                          * LAST bit.
4860                          */
4861                         if (chk == NULL) {
4862                                 /* Yep, we have to */
4863                                 sctp_alloc_a_chunk(stcb, chk);
4864                                 if (chk == NULL) {
4865                                         /*
4866                                          * we are hosed. All we can do is
4867                                          * nothing.. which will cause an
4868                                          * abort if the peer is paying
4869                                          * attention.
4870                                          */
4871                                         goto oh_well;
4872                                 }
4873                                 memset(chk, 0, sizeof(*chk));
4874                                 chk->rec.data.rcv_flags = 0;
4875                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
4876                                 chk->asoc = &stcb->asoc;
4877                                 if (stcb->asoc.idata_supported == 0) {
4878                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4879                                                 chk->rec.data.mid = 0;
4880                                         } else {
4881                                                 chk->rec.data.mid = strq->next_mid_ordered;
4882                                         }
4883                                 } else {
4884                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4885                                                 chk->rec.data.mid = strq->next_mid_unordered;
4886                                         } else {
4887                                                 chk->rec.data.mid = strq->next_mid_ordered;
4888                                         }
4889                                 }
4890                                 chk->rec.data.sid = sp->sid;
4891                                 chk->rec.data.ppid = sp->ppid;
4892                                 chk->rec.data.context = sp->context;
4893                                 chk->flags = sp->act_flags;
4894                                 chk->whoTo = NULL;
4895                                 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4896                                 strq->chunks_on_queues++;
4897                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4898                                 stcb->asoc.sent_queue_cnt++;
4899                                 stcb->asoc.pr_sctp_cnt++;
4900                         }
4901                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4902                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4903                                 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED;
4904                         }
4905                         if (stcb->asoc.idata_supported == 0) {
4906                                 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) {
4907                                         strq->next_mid_ordered++;
4908                                 }
4909                         } else {
4910                                 if (sp->sinfo_flags & SCTP_UNORDERED) {
4911                                         strq->next_mid_unordered++;
4912                                 } else {
4913                                         strq->next_mid_ordered++;
4914                                 }
4915                         }
4916         oh_well:
4917                         if (sp->data) {
4918                                 /*
4919                                  * Pull any data to free up the SB and allow
4920                                  * sender to "add more" while we will throw
4921                                  * away :-)
4922                                  */
4923                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
4924                                 ret_sz += sp->length;
4925                                 do_wakeup_routine = 1;
4926                                 sp->some_taken = 1;
4927                                 sctp_m_freem(sp->data);
4928                                 sp->data = NULL;
4929                                 sp->tail_mbuf = NULL;
4930                                 sp->length = 0;
4931                         }
4932                 }
4933                 SCTP_TCB_SEND_UNLOCK(stcb);
4934         }
4935         if (do_wakeup_routine) {
4936 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4937                 struct socket *so;
4938
4939                 so = SCTP_INP_SO(stcb->sctp_ep);
4940                 if (!so_locked) {
4941                         atomic_add_int(&stcb->asoc.refcnt, 1);
4942                         SCTP_TCB_UNLOCK(stcb);
4943                         SCTP_SOCKET_LOCK(so, 1);
4944                         SCTP_TCB_LOCK(stcb);
4945                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4946                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4947                                 /* assoc was freed while we were unlocked */
4948                                 SCTP_SOCKET_UNLOCK(so, 1);
4949                                 return (ret_sz);
4950                         }
4951                 }
4952 #endif
4953                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4954 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4955                 if (!so_locked) {
4956                         SCTP_SOCKET_UNLOCK(so, 1);
4957                 }
4958 #endif
4959         }
4960         return (ret_sz);
4961 }
4962
4963 /*
4964  * checks to see if the given address, sa, is one that is currently known by
4965  * the kernel note: can't distinguish the same address on multiple interfaces
4966  * and doesn't handle multiple addresses with different zone/scope id's note:
4967  * ifa_ifwithaddr() compares the entire sockaddr struct
4968  */
4969 struct sctp_ifa *
4970 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4971     int holds_lock)
4972 {
4973         struct sctp_laddr *laddr;
4974
4975         if (holds_lock == 0) {
4976                 SCTP_INP_RLOCK(inp);
4977         }
4978
4979         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4980                 if (laddr->ifa == NULL)
4981                         continue;
4982                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4983                         continue;
4984 #ifdef INET
4985                 if (addr->sa_family == AF_INET) {
4986                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4987                             laddr->ifa->address.sin.sin_addr.s_addr) {
4988                                 /* found him. */
4989                                 if (holds_lock == 0) {
4990                                         SCTP_INP_RUNLOCK(inp);
4991                                 }
4992                                 return (laddr->ifa);
4993                                 break;
4994                         }
4995                 }
4996 #endif
4997 #ifdef INET6
4998                 if (addr->sa_family == AF_INET6) {
4999                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5000                             &laddr->ifa->address.sin6)) {
5001                                 /* found him. */
5002                                 if (holds_lock == 0) {
5003                                         SCTP_INP_RUNLOCK(inp);
5004                                 }
5005                                 return (laddr->ifa);
5006                                 break;
5007                         }
5008                 }
5009 #endif
5010         }
5011         if (holds_lock == 0) {
5012                 SCTP_INP_RUNLOCK(inp);
5013         }
5014         return (NULL);
5015 }
5016
5017 uint32_t
5018 sctp_get_ifa_hash_val(struct sockaddr *addr)
5019 {
5020         switch (addr->sa_family) {
5021 #ifdef INET
5022         case AF_INET:
5023                 {
5024                         struct sockaddr_in *sin;
5025
5026                         sin = (struct sockaddr_in *)addr;
5027                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
5028                 }
5029 #endif
5030 #ifdef INET6
5031         case AF_INET6:
5032                 {
5033                         struct sockaddr_in6 *sin6;
5034                         uint32_t hash_of_addr;
5035
5036                         sin6 = (struct sockaddr_in6 *)addr;
5037                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
5038                             sin6->sin6_addr.s6_addr32[1] +
5039                             sin6->sin6_addr.s6_addr32[2] +
5040                             sin6->sin6_addr.s6_addr32[3]);
5041                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
5042                         return (hash_of_addr);
5043                 }
5044 #endif
5045         default:
5046                 break;
5047         }
5048         return (0);
5049 }
5050
5051 struct sctp_ifa *
5052 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
5053 {
5054         struct sctp_ifa *sctp_ifap;
5055         struct sctp_vrf *vrf;
5056         struct sctp_ifalist *hash_head;
5057         uint32_t hash_of_addr;
5058
5059         if (holds_lock == 0)
5060                 SCTP_IPI_ADDR_RLOCK();
5061
5062         vrf = sctp_find_vrf(vrf_id);
5063         if (vrf == NULL) {
5064                 if (holds_lock == 0)
5065                         SCTP_IPI_ADDR_RUNLOCK();
5066                 return (NULL);
5067         }
5068
5069         hash_of_addr = sctp_get_ifa_hash_val(addr);
5070
5071         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5072         if (hash_head == NULL) {
5073                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5074                     hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark,
5075                     (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark));
5076                 sctp_print_address(addr);
5077                 SCTP_PRINTF("No such bucket for address\n");
5078                 if (holds_lock == 0)
5079                         SCTP_IPI_ADDR_RUNLOCK();
5080
5081                 return (NULL);
5082         }
5083         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5084                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5085                         continue;
5086 #ifdef INET
5087                 if (addr->sa_family == AF_INET) {
5088                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5089                             sctp_ifap->address.sin.sin_addr.s_addr) {
5090                                 /* found him. */
5091                                 if (holds_lock == 0)
5092                                         SCTP_IPI_ADDR_RUNLOCK();
5093                                 return (sctp_ifap);
5094                                 break;
5095                         }
5096                 }
5097 #endif
5098 #ifdef INET6
5099                 if (addr->sa_family == AF_INET6) {
5100                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5101                             &sctp_ifap->address.sin6)) {
5102                                 /* found him. */
5103                                 if (holds_lock == 0)
5104                                         SCTP_IPI_ADDR_RUNLOCK();
5105                                 return (sctp_ifap);
5106                                 break;
5107                         }
5108                 }
5109 #endif
5110         }
5111         if (holds_lock == 0)
5112                 SCTP_IPI_ADDR_RUNLOCK();
5113         return (NULL);
5114 }
5115
5116 static void
5117 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock,
5118     uint32_t rwnd_req)
5119 {
5120         /* User pulled some data, do we need a rwnd update? */
5121         int r_unlocked = 0;
5122         uint32_t dif, rwnd;
5123         struct socket *so = NULL;
5124
5125         if (stcb == NULL)
5126                 return;
5127
5128         atomic_add_int(&stcb->asoc.refcnt, 1);
5129
5130         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
5131             (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED | SCTP_STATE_SHUTDOWN_RECEIVED))) {
5132                 /* Pre-check If we are freeing no update */
5133                 goto no_lock;
5134         }
5135         SCTP_INP_INCR_REF(stcb->sctp_ep);
5136         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5137             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5138                 goto out;
5139         }
5140         so = stcb->sctp_socket;
5141         if (so == NULL) {
5142                 goto out;
5143         }
5144         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5145         /* Have you have freed enough to look */
5146         *freed_so_far = 0;
5147         /* Yep, its worth a look and the lock overhead */
5148
5149         /* Figure out what the rwnd would be */
5150         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5151         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5152                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5153         } else {
5154                 dif = 0;
5155         }
5156         if (dif >= rwnd_req) {
5157                 if (hold_rlock) {
5158                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5159                         r_unlocked = 1;
5160                 }
5161                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5162                         /*
5163                          * One last check before we allow the guy possibly
5164                          * to get in. There is a race, where the guy has not
5165                          * reached the gate. In that case
5166                          */
5167                         goto out;
5168                 }
5169                 SCTP_TCB_LOCK(stcb);
5170                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5171                         /* No reports here */
5172                         SCTP_TCB_UNLOCK(stcb);
5173                         goto out;
5174                 }
5175                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5176                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5177
5178                 sctp_chunk_output(stcb->sctp_ep, stcb,
5179                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5180                 /* make sure no timer is running */
5181                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
5182                     SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5183                 SCTP_TCB_UNLOCK(stcb);
5184         } else {
5185                 /* Update how much we have pending */
5186                 stcb->freed_by_sorcv_sincelast = dif;
5187         }
5188 out:
5189         if (so && r_unlocked && hold_rlock) {
5190                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5191         }
5192
5193         SCTP_INP_DECR_REF(stcb->sctp_ep);
5194 no_lock:
5195         atomic_add_int(&stcb->asoc.refcnt, -1);
5196         return;
5197 }
5198
5199 int
5200 sctp_sorecvmsg(struct socket *so,
5201     struct uio *uio,
5202     struct mbuf **mp,
5203     struct sockaddr *from,
5204     int fromlen,
5205     int *msg_flags,
5206     struct sctp_sndrcvinfo *sinfo,
5207     int filling_sinfo)
5208 {
5209         /*
5210          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5211          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5212          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5213          * On the way out we may send out any combination of:
5214          * MSG_NOTIFICATION MSG_EOR
5215          *
5216          */
5217         struct sctp_inpcb *inp = NULL;
5218         int my_len = 0;
5219         int cp_len = 0, error = 0;
5220         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5221         struct mbuf *m = NULL;
5222         struct sctp_tcb *stcb = NULL;
5223         int wakeup_read_socket = 0;
5224         int freecnt_applied = 0;
5225         int out_flags = 0, in_flags = 0;
5226         int block_allowed = 1;
5227         uint32_t freed_so_far = 0;
5228         uint32_t copied_so_far = 0;
5229         int in_eeor_mode = 0;
5230         int no_rcv_needed = 0;
5231         uint32_t rwnd_req = 0;
5232         int hold_sblock = 0;
5233         int hold_rlock = 0;
5234         ssize_t slen = 0;
5235         uint32_t held_length = 0;
5236         int sockbuf_lock = 0;
5237
5238         if (uio == NULL) {
5239                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5240                 return (EINVAL);
5241         }
5242
5243         if (msg_flags) {
5244                 in_flags = *msg_flags;
5245                 if (in_flags & MSG_PEEK)
5246                         SCTP_STAT_INCR(sctps_read_peeks);
5247         } else {
5248                 in_flags = 0;
5249         }
5250         slen = uio->uio_resid;
5251
5252         /* Pull in and set up our int flags */
5253         if (in_flags & MSG_OOB) {
5254                 /* Out of band's NOT supported */
5255                 return (EOPNOTSUPP);
5256         }
5257         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5258                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5259                 return (EINVAL);
5260         }
5261         if ((in_flags & (MSG_DONTWAIT
5262             | MSG_NBIO
5263             )) ||
5264             SCTP_SO_IS_NBIO(so)) {
5265                 block_allowed = 0;
5266         }
5267         /* setup the endpoint */
5268         inp = (struct sctp_inpcb *)so->so_pcb;
5269         if (inp == NULL) {
5270                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5271                 return (EFAULT);
5272         }
5273         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5274         /* Must be at least a MTU's worth */
5275         if (rwnd_req < SCTP_MIN_RWND)
5276                 rwnd_req = SCTP_MIN_RWND;
5277         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5278         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5279                 sctp_misc_ints(SCTP_SORECV_ENTER,
5280                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5281         }
5282         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5283                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5284                     rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5285         }
5286
5287
5288         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5289         if (error) {
5290                 goto release_unlocked;
5291         }
5292         sockbuf_lock = 1;
5293 restart:
5294
5295
5296 restart_nosblocks:
5297         if (hold_sblock == 0) {
5298                 SOCKBUF_LOCK(&so->so_rcv);
5299                 hold_sblock = 1;
5300         }
5301         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5302             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5303                 goto out;
5304         }
5305         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5306                 if (so->so_error) {
5307                         error = so->so_error;
5308                         if ((in_flags & MSG_PEEK) == 0)
5309                                 so->so_error = 0;
5310                         goto out;
5311                 } else {
5312                         if (so->so_rcv.sb_cc == 0) {
5313                                 /* indicate EOF */
5314                                 error = 0;
5315                                 goto out;
5316                         }
5317                 }
5318         }
5319         if (so->so_rcv.sb_cc <= held_length) {
5320                 if (so->so_error) {
5321                         error = so->so_error;
5322                         if ((in_flags & MSG_PEEK) == 0) {
5323                                 so->so_error = 0;
5324                         }
5325                         goto out;
5326                 }
5327                 if ((so->so_rcv.sb_cc == 0) &&
5328                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5329                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5330                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5331                                 /*
5332                                  * For active open side clear flags for
5333                                  * re-use passive open is blocked by
5334                                  * connect.
5335                                  */
5336                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5337                                         /*
5338                                          * You were aborted, passive side
5339                                          * always hits here
5340                                          */
5341                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5342                                         error = ECONNRESET;
5343                                 }
5344                                 so->so_state &= ~(SS_ISCONNECTING |
5345                                     SS_ISDISCONNECTING |
5346                                     SS_ISCONFIRMING |
5347                                     SS_ISCONNECTED);
5348                                 if (error == 0) {
5349                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5350                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5351                                                 error = ENOTCONN;
5352                                         }
5353                                 }
5354                                 goto out;
5355                         }
5356                 }
5357                 if (block_allowed) {
5358                         error = sbwait(&so->so_rcv);
5359                         if (error) {
5360                                 goto out;
5361                         }
5362                         held_length = 0;
5363                         goto restart_nosblocks;
5364                 } else {
5365                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5366                         error = EWOULDBLOCK;
5367                         goto out;
5368                 }
5369         }
5370         if (hold_sblock == 1) {
5371                 SOCKBUF_UNLOCK(&so->so_rcv);
5372                 hold_sblock = 0;
5373         }
5374         /* we possibly have data we can read */
5375         /* sa_ignore FREED_MEMORY */
5376         control = TAILQ_FIRST(&inp->read_queue);
5377         if (control == NULL) {
5378                 /*
5379                  * This could be happening since the appender did the
5380                  * increment but as not yet did the tailq insert onto the
5381                  * read_queue
5382                  */
5383                 if (hold_rlock == 0) {
5384                         SCTP_INP_READ_LOCK(inp);
5385                 }
5386                 control = TAILQ_FIRST(&inp->read_queue);
5387                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5388 #ifdef INVARIANTS
5389                         panic("Huh, its non zero and nothing on control?");
5390 #endif
5391                         so->so_rcv.sb_cc = 0;
5392                 }
5393                 SCTP_INP_READ_UNLOCK(inp);
5394                 hold_rlock = 0;
5395                 goto restart;
5396         }
5397
5398         if ((control->length == 0) &&
5399             (control->do_not_ref_stcb)) {
5400                 /*
5401                  * Clean up code for freeing assoc that left behind a
5402                  * pdapi.. maybe a peer in EEOR that just closed after
5403                  * sending and never indicated a EOR.
5404                  */
5405                 if (hold_rlock == 0) {
5406                         hold_rlock = 1;
5407                         SCTP_INP_READ_LOCK(inp);
5408                 }
5409                 control->held_length = 0;
5410                 if (control->data) {
5411                         /* Hmm there is data here .. fix */
5412                         struct mbuf *m_tmp;
5413                         int cnt = 0;
5414
5415                         m_tmp = control->data;
5416                         while (m_tmp) {
5417                                 cnt += SCTP_BUF_LEN(m_tmp);
5418                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5419                                         control->tail_mbuf = m_tmp;
5420                                         control->end_added = 1;
5421                                 }
5422                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5423                         }
5424                         control->length = cnt;
5425                 } else {
5426                         /* remove it */
5427                         TAILQ_REMOVE(&inp->read_queue, control, next);
5428                         /* Add back any hiddend data */
5429                         sctp_free_remote_addr(control->whoFrom);
5430                         sctp_free_a_readq(stcb, control);
5431                 }
5432                 if (hold_rlock) {
5433                         hold_rlock = 0;
5434                         SCTP_INP_READ_UNLOCK(inp);
5435                 }
5436                 goto restart;
5437         }
5438         if ((control->length == 0) &&
5439             (control->end_added == 1)) {
5440                 /*
5441                  * Do we also need to check for (control->pdapi_aborted ==
5442                  * 1)?
5443                  */
5444                 if (hold_rlock == 0) {
5445                         hold_rlock = 1;
5446                         SCTP_INP_READ_LOCK(inp);
5447                 }
5448                 TAILQ_REMOVE(&inp->read_queue, control, next);
5449                 if (control->data) {
5450 #ifdef INVARIANTS
5451                         panic("control->data not null but control->length == 0");
5452 #else
5453                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5454                         sctp_m_freem(control->data);
5455                         control->data = NULL;
5456 #endif
5457                 }
5458                 if (control->aux_data) {
5459                         sctp_m_free(control->aux_data);
5460                         control->aux_data = NULL;
5461                 }
5462 #ifdef INVARIANTS
5463                 if (control->on_strm_q) {
5464                         panic("About to free ctl:%p so:%p and its in %d",
5465                             control, so, control->on_strm_q);
5466                 }
5467 #endif
5468                 sctp_free_remote_addr(control->whoFrom);
5469                 sctp_free_a_readq(stcb, control);
5470                 if (hold_rlock) {
5471                         hold_rlock = 0;
5472                         SCTP_INP_READ_UNLOCK(inp);
5473                 }
5474                 goto restart;
5475         }
5476         if (control->length == 0) {
5477                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5478                     (filling_sinfo)) {
5479                         /* find a more suitable one then this */
5480                         ctl = TAILQ_NEXT(control, next);
5481                         while (ctl) {
5482                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5483                                     (ctl->some_taken ||
5484                                     (ctl->spec_flags & M_NOTIFICATION) ||
5485                                     ((ctl->do_not_ref_stcb == 0) &&
5486                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5487                                     ) {
5488                                         /*-
5489                                          * If we have a different TCB next, and there is data
5490                                          * present. If we have already taken some (pdapi), OR we can
5491                                          * ref the tcb and no delivery as started on this stream, we
5492                                          * take it. Note we allow a notification on a different
5493                                          * assoc to be delivered..
5494                                          */
5495                                         control = ctl;
5496                                         goto found_one;
5497                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5498                                             (ctl->length) &&
5499                                             ((ctl->some_taken) ||
5500                                             ((ctl->do_not_ref_stcb == 0) &&
5501                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5502                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5503                                         /*-
5504                                          * If we have the same tcb, and there is data present, and we
5505                                          * have the strm interleave feature present. Then if we have
5506                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5507                                          * not started a delivery for this stream, we can take it.
5508                                          * Note we do NOT allow a notificaiton on the same assoc to
5509                                          * be delivered.
5510                                          */
5511                                         control = ctl;
5512                                         goto found_one;
5513                                 }
5514                                 ctl = TAILQ_NEXT(ctl, next);
5515                         }
5516                 }
5517                 /*
5518                  * if we reach here, not suitable replacement is available
5519                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5520                  * into the our held count, and its time to sleep again.
5521                  */
5522                 held_length = so->so_rcv.sb_cc;
5523                 control->held_length = so->so_rcv.sb_cc;
5524                 goto restart;
5525         }
5526         /* Clear the held length since there is something to read */
5527         control->held_length = 0;
5528 found_one:
5529         /*
5530          * If we reach here, control has a some data for us to read off.
5531          * Note that stcb COULD be NULL.
5532          */
5533         if (hold_rlock == 0) {
5534                 hold_rlock = 1;
5535                 SCTP_INP_READ_LOCK(inp);
5536         }
5537         control->some_taken++;
5538         stcb = control->stcb;
5539         if (stcb) {
5540                 if ((control->do_not_ref_stcb == 0) &&
5541                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5542                         if (freecnt_applied == 0)
5543                                 stcb = NULL;
5544                 } else if (control->do_not_ref_stcb == 0) {
5545                         /* you can't free it on me please */
5546                         /*
5547                          * The lock on the socket buffer protects us so the
5548                          * free code will stop. But since we used the
5549                          * socketbuf lock and the sender uses the tcb_lock
5550                          * to increment, we need to use the atomic add to
5551                          * the refcnt
5552                          */
5553                         if (freecnt_applied) {
5554 #ifdef INVARIANTS
5555                                 panic("refcnt already incremented");
5556 #else
5557                                 SCTP_PRINTF("refcnt already incremented?\n");
5558 #endif
5559                         } else {
5560                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5561                                 freecnt_applied = 1;
5562                         }
5563                         /*
5564                          * Setup to remember how much we have not yet told
5565                          * the peer our rwnd has opened up. Note we grab the
5566                          * value from the tcb from last time. Note too that
5567                          * sack sending clears this when a sack is sent,
5568                          * which is fine. Once we hit the rwnd_req, we then
5569                          * will go to the sctp_user_rcvd() that will not
5570                          * lock until it KNOWs it MUST send a WUP-SACK.
5571                          */
5572                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5573                         stcb->freed_by_sorcv_sincelast = 0;
5574                 }
5575         }
5576         if (stcb &&
5577             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5578             control->do_not_ref_stcb == 0) {
5579                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5580         }
5581
5582         /* First lets get off the sinfo and sockaddr info */
5583         if ((sinfo != NULL) && (filling_sinfo != 0)) {
5584                 sinfo->sinfo_stream = control->sinfo_stream;
5585                 sinfo->sinfo_ssn = (uint16_t)control->mid;
5586                 sinfo->sinfo_flags = control->sinfo_flags;
5587                 sinfo->sinfo_ppid = control->sinfo_ppid;
5588                 sinfo->sinfo_context = control->sinfo_context;
5589                 sinfo->sinfo_timetolive = control->sinfo_timetolive;
5590                 sinfo->sinfo_tsn = control->sinfo_tsn;
5591                 sinfo->sinfo_cumtsn = control->sinfo_cumtsn;
5592                 sinfo->sinfo_assoc_id = control->sinfo_assoc_id;
5593                 nxt = TAILQ_NEXT(control, next);
5594                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5595                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5596                         struct sctp_extrcvinfo *s_extra;
5597
5598                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5599                         if ((nxt) &&
5600                             (nxt->length)) {
5601                                 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5602                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5603                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5604                                 }
5605                                 if (nxt->spec_flags & M_NOTIFICATION) {
5606                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5607                                 }
5608                                 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id;
5609                                 s_extra->serinfo_next_length = nxt->length;
5610                                 s_extra->serinfo_next_ppid = nxt->sinfo_ppid;
5611                                 s_extra->serinfo_next_stream = nxt->sinfo_stream;
5612                                 if (nxt->tail_mbuf != NULL) {
5613                                         if (nxt->end_added) {
5614                                                 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5615                                         }
5616                                 }
5617                         } else {
5618                                 /*
5619                                  * we explicitly 0 this, since the memcpy
5620                                  * got some other things beyond the older
5621                                  * sinfo_ that is on the control's structure
5622                                  * :-D
5623                                  */
5624                                 nxt = NULL;
5625                                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
5626                                 s_extra->serinfo_next_aid = 0;
5627                                 s_extra->serinfo_next_length = 0;
5628                                 s_extra->serinfo_next_ppid = 0;
5629                                 s_extra->serinfo_next_stream = 0;
5630                         }
5631                 }
5632                 /*
5633                  * update off the real current cum-ack, if we have an stcb.
5634                  */
5635                 if ((control->do_not_ref_stcb == 0) && stcb)
5636                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5637                 /*
5638                  * mask off the high bits, we keep the actual chunk bits in
5639                  * there.
5640                  */
5641                 sinfo->sinfo_flags &= 0x00ff;
5642                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5643                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5644                 }
5645         }
5646 #ifdef SCTP_ASOCLOG_OF_TSNS
5647         {
5648                 int index, newindex;
5649                 struct sctp_pcbtsn_rlog *entry;
5650
5651                 do {
5652                         index = inp->readlog_index;
5653                         newindex = index + 1;
5654                         if (newindex >= SCTP_READ_LOG_SIZE) {
5655                                 newindex = 0;
5656                         }
5657                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5658                 entry = &inp->readlog[index];
5659                 entry->vtag = control->sinfo_assoc_id;
5660                 entry->strm = control->sinfo_stream;
5661                 entry->seq = (uint16_t)control->mid;
5662                 entry->sz = control->length;
5663                 entry->flgs = control->sinfo_flags;
5664         }
5665 #endif
5666         if ((fromlen > 0) && (from != NULL)) {
5667                 union sctp_sockstore store;
5668                 size_t len;
5669
5670                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5671 #ifdef INET6
5672                 case AF_INET6:
5673                         len = sizeof(struct sockaddr_in6);
5674                         store.sin6 = control->whoFrom->ro._l_addr.sin6;
5675                         store.sin6.sin6_port = control->port_from;
5676                         break;
5677 #endif
5678 #ifdef INET
5679                 case AF_INET:
5680 #ifdef INET6
5681                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5682                                 len = sizeof(struct sockaddr_in6);
5683                                 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5684                                     &store.sin6);
5685                                 store.sin6.sin6_port = control->port_from;
5686                         } else {
5687                                 len = sizeof(struct sockaddr_in);
5688                                 store.sin = control->whoFrom->ro._l_addr.sin;
5689                                 store.sin.sin_port = control->port_from;
5690                         }
5691 #else
5692                         len = sizeof(struct sockaddr_in);
5693                         store.sin = control->whoFrom->ro._l_addr.sin;
5694                         store.sin.sin_port = control->port_from;
5695 #endif
5696                         break;
5697 #endif
5698                 default:
5699                         len = 0;
5700                         break;
5701                 }
5702                 memcpy(from, &store, min((size_t)fromlen, len));
5703 #ifdef INET6
5704                 {
5705                         struct sockaddr_in6 lsa6, *from6;
5706
5707                         from6 = (struct sockaddr_in6 *)from;
5708                         sctp_recover_scope_mac(from6, (&lsa6));
5709                 }
5710 #endif
5711         }
5712         if (hold_rlock) {
5713                 SCTP_INP_READ_UNLOCK(inp);
5714                 hold_rlock = 0;
5715         }
5716         if (hold_sblock) {
5717                 SOCKBUF_UNLOCK(&so->so_rcv);
5718                 hold_sblock = 0;
5719         }
5720         /* now copy out what data we can */
5721         if (mp == NULL) {
5722                 /* copy out each mbuf in the chain up to length */
5723 get_more_data:
5724                 m = control->data;
5725                 while (m) {
5726                         /* Move out all we can */
5727                         cp_len = (int)uio->uio_resid;
5728                         my_len = (int)SCTP_BUF_LEN(m);
5729                         if (cp_len > my_len) {
5730                                 /* not enough in this buf */
5731                                 cp_len = my_len;
5732                         }
5733                         if (hold_rlock) {
5734                                 SCTP_INP_READ_UNLOCK(inp);
5735                                 hold_rlock = 0;
5736                         }
5737                         if (cp_len > 0)
5738                                 error = uiomove(mtod(m, char *), cp_len, uio);
5739                         /* re-read */
5740                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5741                                 goto release;
5742                         }
5743
5744                         if ((control->do_not_ref_stcb == 0) && stcb &&
5745                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5746                                 no_rcv_needed = 1;
5747                         }
5748                         if (error) {
5749                                 /* error we are out of here */
5750                                 goto release;
5751                         }
5752                         SCTP_INP_READ_LOCK(inp);
5753                         hold_rlock = 1;
5754                         if (cp_len == SCTP_BUF_LEN(m)) {
5755                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5756                                     (control->end_added)) {
5757                                         out_flags |= MSG_EOR;
5758                                         if ((control->do_not_ref_stcb == 0) &&
5759                                             (control->stcb != NULL) &&
5760                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5761                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5762                                 }
5763                                 if (control->spec_flags & M_NOTIFICATION) {
5764                                         out_flags |= MSG_NOTIFICATION;
5765                                 }
5766                                 /* we ate up the mbuf */
5767                                 if (in_flags & MSG_PEEK) {
5768                                         /* just looking */
5769                                         m = SCTP_BUF_NEXT(m);
5770                                         copied_so_far += cp_len;
5771                                 } else {
5772                                         /* dispose of the mbuf */
5773                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5774                                                 sctp_sblog(&so->so_rcv,
5775                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5776                                         }
5777                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5778                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5779                                                 sctp_sblog(&so->so_rcv,
5780                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5781                                         }
5782                                         copied_so_far += cp_len;
5783                                         freed_so_far += cp_len;
5784                                         freed_so_far += MSIZE;
5785                                         atomic_subtract_int(&control->length, cp_len);
5786                                         control->data = sctp_m_free(m);
5787                                         m = control->data;
5788                                         /*
5789                                          * been through it all, must hold sb
5790                                          * lock ok to null tail
5791                                          */
5792                                         if (control->data == NULL) {
5793 #ifdef INVARIANTS
5794                                                 if ((control->end_added == 0) ||
5795                                                     (TAILQ_NEXT(control, next) == NULL)) {
5796                                                         /*
5797                                                          * If the end is not
5798                                                          * added, OR the
5799                                                          * next is NOT null
5800                                                          * we MUST have the
5801                                                          * lock.
5802                                                          */
5803                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5804                                                                 panic("Hmm we don't own the lock?");
5805                                                         }
5806                                                 }
5807 #endif
5808                                                 control->tail_mbuf = NULL;
5809 #ifdef INVARIANTS
5810                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5811                                                         panic("end_added, nothing left and no MSG_EOR");
5812                                                 }
5813 #endif
5814                                         }
5815                                 }
5816                         } else {
5817                                 /* Do we need to trim the mbuf? */
5818                                 if (control->spec_flags & M_NOTIFICATION) {
5819                                         out_flags |= MSG_NOTIFICATION;
5820                                 }
5821                                 if ((in_flags & MSG_PEEK) == 0) {
5822                                         SCTP_BUF_RESV_UF(m, cp_len);
5823                                         SCTP_BUF_LEN(m) -= cp_len;
5824                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5825                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5826                                         }
5827                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5828                                         if ((control->do_not_ref_stcb == 0) &&
5829                                             stcb) {
5830                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5831                                         }
5832                                         copied_so_far += cp_len;
5833                                         freed_so_far += cp_len;
5834                                         freed_so_far += MSIZE;
5835                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5836                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5837                                                     SCTP_LOG_SBRESULT, 0);
5838                                         }
5839                                         atomic_subtract_int(&control->length, cp_len);
5840                                 } else {
5841                                         copied_so_far += cp_len;
5842                                 }
5843                         }
5844                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5845                                 break;
5846                         }
5847                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5848                             (control->do_not_ref_stcb == 0) &&
5849                             (freed_so_far >= rwnd_req)) {
5850                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5851                         }
5852                 }               /* end while(m) */
5853                 /*
5854                  * At this point we have looked at it all and we either have
5855                  * a MSG_EOR/or read all the user wants... <OR>
5856                  * control->length == 0.
5857                  */
5858                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5859                         /* we are done with this control */
5860                         if (control->length == 0) {
5861                                 if (control->data) {
5862 #ifdef INVARIANTS
5863                                         panic("control->data not null at read eor?");
5864 #else
5865                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5866                                         sctp_m_freem(control->data);
5867                                         control->data = NULL;
5868 #endif
5869                                 }
5870                 done_with_control:
5871                                 if (hold_rlock == 0) {
5872                                         SCTP_INP_READ_LOCK(inp);
5873                                         hold_rlock = 1;
5874                                 }
5875                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5876                                 /* Add back any hiddend data */
5877                                 if (control->held_length) {
5878                                         held_length = 0;
5879                                         control->held_length = 0;
5880                                         wakeup_read_socket = 1;
5881                                 }
5882                                 if (control->aux_data) {
5883                                         sctp_m_free(control->aux_data);
5884                                         control->aux_data = NULL;
5885                                 }
5886                                 no_rcv_needed = control->do_not_ref_stcb;
5887                                 sctp_free_remote_addr(control->whoFrom);
5888                                 control->data = NULL;
5889 #ifdef INVARIANTS
5890                                 if (control->on_strm_q) {
5891                                         panic("About to free ctl:%p so:%p and its in %d",
5892                                             control, so, control->on_strm_q);
5893                                 }
5894 #endif
5895                                 sctp_free_a_readq(stcb, control);
5896                                 control = NULL;
5897                                 if ((freed_so_far >= rwnd_req) &&
5898                                     (no_rcv_needed == 0))
5899                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5900
5901                         } else {
5902                                 /*
5903                                  * The user did not read all of this
5904                                  * message, turn off the returned MSG_EOR
5905                                  * since we are leaving more behind on the
5906                                  * control to read.
5907                                  */
5908 #ifdef INVARIANTS
5909                                 if (control->end_added &&
5910                                     (control->data == NULL) &&
5911                                     (control->tail_mbuf == NULL)) {
5912                                         panic("Gak, control->length is corrupt?");
5913                                 }
5914 #endif
5915                                 no_rcv_needed = control->do_not_ref_stcb;
5916                                 out_flags &= ~MSG_EOR;
5917                         }
5918                 }
5919                 if (out_flags & MSG_EOR) {
5920                         goto release;
5921                 }
5922                 if ((uio->uio_resid == 0) ||
5923                     ((in_eeor_mode) &&
5924                     (copied_so_far >= (uint32_t)max(so->so_rcv.sb_lowat, 1)))) {
5925                         goto release;
5926                 }
5927                 /*
5928                  * If I hit here the receiver wants more and this message is
5929                  * NOT done (pd-api). So two questions. Can we block? if not
5930                  * we are done. Did the user NOT set MSG_WAITALL?
5931                  */
5932                 if (block_allowed == 0) {
5933                         goto release;
5934                 }
5935                 /*
5936                  * We need to wait for more data a few things: - We don't
5937                  * sbunlock() so we don't get someone else reading. - We
5938                  * must be sure to account for the case where what is added
5939                  * is NOT to our control when we wakeup.
5940                  */
5941
5942                 /*
5943                  * Do we need to tell the transport a rwnd update might be
5944                  * needed before we go to sleep?
5945                  */
5946                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5947                     ((freed_so_far >= rwnd_req) &&
5948                     (control->do_not_ref_stcb == 0) &&
5949                     (no_rcv_needed == 0))) {
5950                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5951                 }
5952 wait_some_more:
5953                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5954                         goto release;
5955                 }
5956
5957                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5958                         goto release;
5959
5960                 if (hold_rlock == 1) {
5961                         SCTP_INP_READ_UNLOCK(inp);
5962                         hold_rlock = 0;
5963                 }
5964                 if (hold_sblock == 0) {
5965                         SOCKBUF_LOCK(&so->so_rcv);
5966                         hold_sblock = 1;
5967                 }
5968                 if ((copied_so_far) && (control->length == 0) &&
5969                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5970                         goto release;
5971                 }
5972                 if (so->so_rcv.sb_cc <= control->held_length) {
5973                         error = sbwait(&so->so_rcv);
5974                         if (error) {
5975                                 goto release;
5976                         }
5977                         control->held_length = 0;
5978                 }
5979                 if (hold_sblock) {
5980                         SOCKBUF_UNLOCK(&so->so_rcv);
5981                         hold_sblock = 0;
5982                 }
5983                 if (control->length == 0) {
5984                         /* still nothing here */
5985                         if (control->end_added == 1) {
5986                                 /* he aborted, or is done i.e.did a shutdown */
5987                                 out_flags |= MSG_EOR;
5988                                 if (control->pdapi_aborted) {
5989                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5990                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5991
5992                                         out_flags |= MSG_TRUNC;
5993                                 } else {
5994                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5995                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5996                                 }
5997                                 goto done_with_control;
5998                         }
5999                         if (so->so_rcv.sb_cc > held_length) {
6000                                 control->held_length = so->so_rcv.sb_cc;
6001                                 held_length = 0;
6002                         }
6003                         goto wait_some_more;
6004                 } else if (control->data == NULL) {
6005                         /*
6006                          * we must re-sync since data is probably being
6007                          * added
6008                          */
6009                         SCTP_INP_READ_LOCK(inp);
6010                         if ((control->length > 0) && (control->data == NULL)) {
6011                                 /*
6012                                  * big trouble.. we have the lock and its
6013                                  * corrupt?
6014                                  */
6015 #ifdef INVARIANTS
6016                                 panic("Impossible data==NULL length !=0");
6017 #endif
6018                                 out_flags |= MSG_EOR;
6019                                 out_flags |= MSG_TRUNC;
6020                                 control->length = 0;
6021                                 SCTP_INP_READ_UNLOCK(inp);
6022                                 goto done_with_control;
6023                         }
6024                         SCTP_INP_READ_UNLOCK(inp);
6025                         /* We will fall around to get more data */
6026                 }
6027                 goto get_more_data;
6028         } else {
6029                 /*-
6030                  * Give caller back the mbuf chain,
6031                  * store in uio_resid the length
6032                  */
6033                 wakeup_read_socket = 0;
6034                 if ((control->end_added == 0) ||
6035                     (TAILQ_NEXT(control, next) == NULL)) {
6036                         /* Need to get rlock */
6037                         if (hold_rlock == 0) {
6038                                 SCTP_INP_READ_LOCK(inp);
6039                                 hold_rlock = 1;
6040                         }
6041                 }
6042                 if (control->end_added) {
6043                         out_flags |= MSG_EOR;
6044                         if ((control->do_not_ref_stcb == 0) &&
6045                             (control->stcb != NULL) &&
6046                             ((control->spec_flags & M_NOTIFICATION) == 0))
6047                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6048                 }
6049                 if (control->spec_flags & M_NOTIFICATION) {
6050                         out_flags |= MSG_NOTIFICATION;
6051                 }
6052                 uio->uio_resid = control->length;
6053                 *mp = control->data;
6054                 m = control->data;
6055                 while (m) {
6056                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6057                                 sctp_sblog(&so->so_rcv,
6058                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6059                         }
6060                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6061                         freed_so_far += SCTP_BUF_LEN(m);
6062                         freed_so_far += MSIZE;
6063                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6064                                 sctp_sblog(&so->so_rcv,
6065                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6066                         }
6067                         m = SCTP_BUF_NEXT(m);
6068                 }
6069                 control->data = control->tail_mbuf = NULL;
6070                 control->length = 0;
6071                 if (out_flags & MSG_EOR) {
6072                         /* Done with this control */
6073                         goto done_with_control;
6074                 }
6075         }
6076 release:
6077         if (hold_rlock == 1) {
6078                 SCTP_INP_READ_UNLOCK(inp);
6079                 hold_rlock = 0;
6080         }
6081         if (hold_sblock == 1) {
6082                 SOCKBUF_UNLOCK(&so->so_rcv);
6083                 hold_sblock = 0;
6084         }
6085
6086         sbunlock(&so->so_rcv);
6087         sockbuf_lock = 0;
6088
6089 release_unlocked:
6090         if (hold_sblock) {
6091                 SOCKBUF_UNLOCK(&so->so_rcv);
6092                 hold_sblock = 0;
6093         }
6094         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6095                 if ((freed_so_far >= rwnd_req) &&
6096                     (control && (control->do_not_ref_stcb == 0)) &&
6097                     (no_rcv_needed == 0))
6098                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6099         }
6100 out:
6101         if (msg_flags) {
6102                 *msg_flags = out_flags;
6103         }
6104         if (((out_flags & MSG_EOR) == 0) &&
6105             ((in_flags & MSG_PEEK) == 0) &&
6106             (sinfo) &&
6107             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6108             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6109                 struct sctp_extrcvinfo *s_extra;
6110
6111                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6112                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
6113         }
6114         if (hold_rlock == 1) {
6115                 SCTP_INP_READ_UNLOCK(inp);
6116         }
6117         if (hold_sblock) {
6118                 SOCKBUF_UNLOCK(&so->so_rcv);
6119         }
6120         if (sockbuf_lock) {
6121                 sbunlock(&so->so_rcv);
6122         }
6123
6124         if (freecnt_applied) {
6125                 /*
6126                  * The lock on the socket buffer protects us so the free
6127                  * code will stop. But since we used the socketbuf lock and
6128                  * the sender uses the tcb_lock to increment, we need to use
6129                  * the atomic add to the refcnt.
6130                  */
6131                 if (stcb == NULL) {
6132 #ifdef INVARIANTS
6133                         panic("stcb for refcnt has gone NULL?");
6134                         goto stage_left;
6135 #else
6136                         goto stage_left;
6137 #endif
6138                 }
6139                 /* Save the value back for next time */
6140                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6141                 atomic_add_int(&stcb->asoc.refcnt, -1);
6142         }
6143         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6144                 if (stcb) {
6145                         sctp_misc_ints(SCTP_SORECV_DONE,
6146                             freed_so_far,
6147                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6148                             stcb->asoc.my_rwnd,
6149                             so->so_rcv.sb_cc);
6150                 } else {
6151                         sctp_misc_ints(SCTP_SORECV_DONE,
6152                             freed_so_far,
6153                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6154                             0,
6155                             so->so_rcv.sb_cc);
6156                 }
6157         }
6158 stage_left:
6159         if (wakeup_read_socket) {
6160                 sctp_sorwakeup(inp, so);
6161         }
6162         return (error);
6163 }
6164
6165
6166 #ifdef SCTP_MBUF_LOGGING
6167 struct mbuf *
6168 sctp_m_free(struct mbuf *m)
6169 {
6170         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6171                 sctp_log_mb(m, SCTP_MBUF_IFREE);
6172         }
6173         return (m_free(m));
6174 }
6175
6176 void
6177 sctp_m_freem(struct mbuf *mb)
6178 {
6179         while (mb != NULL)
6180                 mb = sctp_m_free(mb);
6181 }
6182
6183 #endif
6184
6185 int
6186 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6187 {
6188         /*
6189          * Given a local address. For all associations that holds the
6190          * address, request a peer-set-primary.
6191          */
6192         struct sctp_ifa *ifa;
6193         struct sctp_laddr *wi;
6194
6195         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6196         if (ifa == NULL) {
6197                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6198                 return (EADDRNOTAVAIL);
6199         }
6200         /*
6201          * Now that we have the ifa we must awaken the iterator with this
6202          * message.
6203          */
6204         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6205         if (wi == NULL) {
6206                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6207                 return (ENOMEM);
6208         }
6209         /* Now incr the count and int wi structure */
6210         SCTP_INCR_LADDR_COUNT();
6211         memset(wi, 0, sizeof(*wi));
6212         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6213         wi->ifa = ifa;
6214         wi->action = SCTP_SET_PRIM_ADDR;
6215         atomic_add_int(&ifa->refcount, 1);
6216
6217         /* Now add it to the work queue */
6218         SCTP_WQ_ADDR_LOCK();
6219         /*
6220          * Should this really be a tailq? As it is we will process the
6221          * newest first :-0
6222          */
6223         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6224         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6225             (struct sctp_inpcb *)NULL,
6226             (struct sctp_tcb *)NULL,
6227             (struct sctp_nets *)NULL);
6228         SCTP_WQ_ADDR_UNLOCK();
6229         return (0);
6230 }
6231
6232
6233 int
6234 sctp_soreceive(struct socket *so,
6235     struct sockaddr **psa,
6236     struct uio *uio,
6237     struct mbuf **mp0,
6238     struct mbuf **controlp,
6239     int *flagsp)
6240 {
6241         int error, fromlen;
6242         uint8_t sockbuf[256];
6243         struct sockaddr *from;
6244         struct sctp_extrcvinfo sinfo;
6245         int filling_sinfo = 1;
6246         int flags;
6247         struct sctp_inpcb *inp;
6248
6249         inp = (struct sctp_inpcb *)so->so_pcb;
6250         /* pickup the assoc we are reading from */
6251         if (inp == NULL) {
6252                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6253                 return (EINVAL);
6254         }
6255         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6256             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6257             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6258             (controlp == NULL)) {
6259                 /* user does not want the sndrcv ctl */
6260                 filling_sinfo = 0;
6261         }
6262         if (psa) {
6263                 from = (struct sockaddr *)sockbuf;
6264                 fromlen = sizeof(sockbuf);
6265                 from->sa_len = 0;
6266         } else {
6267                 from = NULL;
6268                 fromlen = 0;
6269         }
6270
6271         if (filling_sinfo) {
6272                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6273         }
6274         if (flagsp != NULL) {
6275                 flags = *flagsp;
6276         } else {
6277                 flags = 0;
6278         }
6279         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, &flags,
6280             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6281         if (flagsp != NULL) {
6282                 *flagsp = flags;
6283         }
6284         if (controlp != NULL) {
6285                 /* copy back the sinfo in a CMSG format */
6286                 if (filling_sinfo && ((flags & MSG_NOTIFICATION) == 0)) {
6287                         *controlp = sctp_build_ctl_nchunk(inp,
6288                             (struct sctp_sndrcvinfo *)&sinfo);
6289                 } else {
6290                         *controlp = NULL;
6291                 }
6292         }
6293         if (psa) {
6294                 /* copy back the address info */
6295                 if (from && from->sa_len) {
6296                         *psa = sodupsockaddr(from, M_NOWAIT);
6297                 } else {
6298                         *psa = NULL;
6299                 }
6300         }
6301         return (error);
6302 }
6303
6304
6305
6306
6307
6308 int
6309 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6310     int totaddr, int *error)
6311 {
6312         int added = 0;
6313         int i;
6314         struct sctp_inpcb *inp;
6315         struct sockaddr *sa;
6316         size_t incr = 0;
6317 #ifdef INET
6318         struct sockaddr_in *sin;
6319 #endif
6320 #ifdef INET6
6321         struct sockaddr_in6 *sin6;
6322 #endif
6323
6324         sa = addr;
6325         inp = stcb->sctp_ep;
6326         *error = 0;
6327         for (i = 0; i < totaddr; i++) {
6328                 switch (sa->sa_family) {
6329 #ifdef INET
6330                 case AF_INET:
6331                         incr = sizeof(struct sockaddr_in);
6332                         sin = (struct sockaddr_in *)sa;
6333                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6334                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6335                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6336                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6337                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6338                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_7);
6339                                 *error = EINVAL;
6340                                 goto out_now;
6341                         }
6342                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6343                             SCTP_DONOT_SETSCOPE,
6344                             SCTP_ADDR_IS_CONFIRMED)) {
6345                                 /* assoc gone no un-lock */
6346                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6347                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6348                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_8);
6349                                 *error = ENOBUFS;
6350                                 goto out_now;
6351                         }
6352                         added++;
6353                         break;
6354 #endif
6355 #ifdef INET6
6356                 case AF_INET6:
6357                         incr = sizeof(struct sockaddr_in6);
6358                         sin6 = (struct sockaddr_in6 *)sa;
6359                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6360                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6361                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6362                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6363                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_9);
6364                                 *error = EINVAL;
6365                                 goto out_now;
6366                         }
6367                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6368                             SCTP_DONOT_SETSCOPE,
6369                             SCTP_ADDR_IS_CONFIRMED)) {
6370                                 /* assoc gone no un-lock */
6371                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6372                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6373                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_10);
6374                                 *error = ENOBUFS;
6375                                 goto out_now;
6376                         }
6377                         added++;
6378                         break;
6379 #endif
6380                 default:
6381                         break;
6382                 }
6383                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6384         }
6385 out_now:
6386         return (added);
6387 }
6388
6389 struct sctp_tcb *
6390 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6391     unsigned int *totaddr,
6392     unsigned int *num_v4, unsigned int *num_v6, int *error,
6393     unsigned int limit, int *bad_addr)
6394 {
6395         struct sockaddr *sa;
6396         struct sctp_tcb *stcb = NULL;
6397         unsigned int incr, at, i;
6398
6399         at = 0;
6400         sa = addr;
6401         *error = *num_v6 = *num_v4 = 0;
6402         /* account and validate addresses */
6403         for (i = 0; i < *totaddr; i++) {
6404                 switch (sa->sa_family) {
6405 #ifdef INET
6406                 case AF_INET:
6407                         incr = (unsigned int)sizeof(struct sockaddr_in);
6408                         if (sa->sa_len != incr) {
6409                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6410                                 *error = EINVAL;
6411                                 *bad_addr = 1;
6412                                 return (NULL);
6413                         }
6414                         (*num_v4) += 1;
6415                         break;
6416 #endif
6417 #ifdef INET6
6418                 case AF_INET6:
6419                         {
6420                                 struct sockaddr_in6 *sin6;
6421
6422                                 sin6 = (struct sockaddr_in6 *)sa;
6423                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6424                                         /* Must be non-mapped for connectx */
6425                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6426                                         *error = EINVAL;
6427                                         *bad_addr = 1;
6428                                         return (NULL);
6429                                 }
6430                                 incr = (unsigned int)sizeof(struct sockaddr_in6);
6431                                 if (sa->sa_len != incr) {
6432                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6433                                         *error = EINVAL;
6434                                         *bad_addr = 1;
6435                                         return (NULL);
6436                                 }
6437                                 (*num_v6) += 1;
6438                                 break;
6439                         }
6440 #endif
6441                 default:
6442                         *totaddr = i;
6443                         incr = 0;
6444                         /* we are done */
6445                         break;
6446                 }
6447                 if (i == *totaddr) {
6448                         break;
6449                 }
6450                 SCTP_INP_INCR_REF(inp);
6451                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6452                 if (stcb != NULL) {
6453                         /* Already have or am bring up an association */
6454                         return (stcb);
6455                 } else {
6456                         SCTP_INP_DECR_REF(inp);
6457                 }
6458                 if ((at + incr) > limit) {
6459                         *totaddr = i;
6460                         break;
6461                 }
6462                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6463         }
6464         return ((struct sctp_tcb *)NULL);
6465 }
6466
6467 /*
6468  * sctp_bindx(ADD) for one address.
6469  * assumes all arguments are valid/checked by caller.
6470  */
6471 void
6472 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6473     struct sockaddr *sa, sctp_assoc_t assoc_id,
6474     uint32_t vrf_id, int *error, void *p)
6475 {
6476         struct sockaddr *addr_touse;
6477 #if defined(INET) && defined(INET6)
6478         struct sockaddr_in sin;
6479 #endif
6480
6481         /* see if we're bound all already! */
6482         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6483                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6484                 *error = EINVAL;
6485                 return;
6486         }
6487         addr_touse = sa;
6488 #ifdef INET6
6489         if (sa->sa_family == AF_INET6) {
6490 #ifdef INET
6491                 struct sockaddr_in6 *sin6;
6492
6493 #endif
6494                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6495                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6496                         *error = EINVAL;
6497                         return;
6498                 }
6499                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6500                         /* can only bind v6 on PF_INET6 sockets */
6501                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6502                         *error = EINVAL;
6503                         return;
6504                 }
6505 #ifdef INET
6506                 sin6 = (struct sockaddr_in6 *)addr_touse;
6507                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6508                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6509                             SCTP_IPV6_V6ONLY(inp)) {
6510                                 /* can't bind v4-mapped on PF_INET sockets */
6511                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6512                                 *error = EINVAL;
6513                                 return;
6514                         }
6515                         in6_sin6_2_sin(&sin, sin6);
6516                         addr_touse = (struct sockaddr *)&sin;
6517                 }
6518 #endif
6519         }
6520 #endif
6521 #ifdef INET
6522         if (sa->sa_family == AF_INET) {
6523                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6524                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6525                         *error = EINVAL;
6526                         return;
6527                 }
6528                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6529                     SCTP_IPV6_V6ONLY(inp)) {
6530                         /* can't bind v4 on PF_INET sockets */
6531                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6532                         *error = EINVAL;
6533                         return;
6534                 }
6535         }
6536 #endif
6537         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6538                 if (p == NULL) {
6539                         /* Can't get proc for Net/Open BSD */
6540                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6541                         *error = EINVAL;
6542                         return;
6543                 }
6544                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6545                 return;
6546         }
6547         /*
6548          * No locks required here since bind and mgmt_ep_sa all do their own
6549          * locking. If we do something for the FIX: below we may need to
6550          * lock in that case.
6551          */
6552         if (assoc_id == 0) {
6553                 /* add the address */
6554                 struct sctp_inpcb *lep;
6555                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6556
6557                 /* validate the incoming port */
6558                 if ((lsin->sin_port != 0) &&
6559                     (lsin->sin_port != inp->sctp_lport)) {
6560                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6561                         *error = EINVAL;
6562                         return;
6563                 } else {
6564                         /* user specified 0 port, set it to existing port */
6565                         lsin->sin_port = inp->sctp_lport;
6566                 }
6567
6568                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6569                 if (lep != NULL) {
6570                         /*
6571                          * We must decrement the refcount since we have the
6572                          * ep already and are binding. No remove going on
6573                          * here.
6574                          */
6575                         SCTP_INP_DECR_REF(lep);
6576                 }
6577                 if (lep == inp) {
6578                         /* already bound to it.. ok */
6579                         return;
6580                 } else if (lep == NULL) {
6581                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6582                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6583                             SCTP_ADD_IP_ADDRESS,
6584                             vrf_id, NULL);
6585                 } else {
6586                         *error = EADDRINUSE;
6587                 }
6588                 if (*error)
6589                         return;
6590         } else {
6591                 /*
6592                  * FIX: decide whether we allow assoc based bindx
6593                  */
6594         }
6595 }
6596
6597 /*
6598  * sctp_bindx(DELETE) for one address.
6599  * assumes all arguments are valid/checked by caller.
6600  */
6601 void
6602 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6603     struct sockaddr *sa, sctp_assoc_t assoc_id,
6604     uint32_t vrf_id, int *error)
6605 {
6606         struct sockaddr *addr_touse;
6607 #if defined(INET) && defined(INET6)
6608         struct sockaddr_in sin;
6609 #endif
6610
6611         /* see if we're bound all already! */
6612         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6613                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6614                 *error = EINVAL;
6615                 return;
6616         }
6617         addr_touse = sa;
6618 #ifdef INET6
6619         if (sa->sa_family == AF_INET6) {
6620 #ifdef INET
6621                 struct sockaddr_in6 *sin6;
6622 #endif
6623
6624                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6625                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6626                         *error = EINVAL;
6627                         return;
6628                 }
6629                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6630                         /* can only bind v6 on PF_INET6 sockets */
6631                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6632                         *error = EINVAL;
6633                         return;
6634                 }
6635 #ifdef INET
6636                 sin6 = (struct sockaddr_in6 *)addr_touse;
6637                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6638                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6639                             SCTP_IPV6_V6ONLY(inp)) {
6640                                 /* can't bind mapped-v4 on PF_INET sockets */
6641                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6642                                 *error = EINVAL;
6643                                 return;
6644                         }
6645                         in6_sin6_2_sin(&sin, sin6);
6646                         addr_touse = (struct sockaddr *)&sin;
6647                 }
6648 #endif
6649         }
6650 #endif
6651 #ifdef INET
6652         if (sa->sa_family == AF_INET) {
6653                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6654                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6655                         *error = EINVAL;
6656                         return;
6657                 }
6658                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6659                     SCTP_IPV6_V6ONLY(inp)) {
6660                         /* can't bind v4 on PF_INET sockets */
6661                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6662                         *error = EINVAL;
6663                         return;
6664                 }
6665         }
6666 #endif
6667         /*
6668          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6669          * below is ever changed we may need to lock before calling
6670          * association level binding.
6671          */
6672         if (assoc_id == 0) {
6673                 /* delete the address */
6674                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6675                     SCTP_DEL_IP_ADDRESS,
6676                     vrf_id, NULL);
6677         } else {
6678                 /*
6679                  * FIX: decide whether we allow assoc based bindx
6680                  */
6681         }
6682 }
6683
6684 /*
6685  * returns the valid local address count for an assoc, taking into account
6686  * all scoping rules
6687  */
6688 int
6689 sctp_local_addr_count(struct sctp_tcb *stcb)
6690 {
6691         int loopback_scope;
6692 #if defined(INET)
6693         int ipv4_local_scope, ipv4_addr_legal;
6694 #endif
6695 #if defined (INET6)
6696         int local_scope, site_scope, ipv6_addr_legal;
6697 #endif
6698         struct sctp_vrf *vrf;
6699         struct sctp_ifn *sctp_ifn;
6700         struct sctp_ifa *sctp_ifa;
6701         int count = 0;
6702
6703         /* Turn on all the appropriate scopes */
6704         loopback_scope = stcb->asoc.scope.loopback_scope;
6705 #if defined(INET)
6706         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6707         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6708 #endif
6709 #if defined(INET6)
6710         local_scope = stcb->asoc.scope.local_scope;
6711         site_scope = stcb->asoc.scope.site_scope;
6712         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6713 #endif
6714         SCTP_IPI_ADDR_RLOCK();
6715         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6716         if (vrf == NULL) {
6717                 /* no vrf, no addresses */
6718                 SCTP_IPI_ADDR_RUNLOCK();
6719                 return (0);
6720         }
6721
6722         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6723                 /*
6724                  * bound all case: go through all ifns on the vrf
6725                  */
6726                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6727                         if ((loopback_scope == 0) &&
6728                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6729                                 continue;
6730                         }
6731                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6732                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6733                                         continue;
6734                                 switch (sctp_ifa->address.sa.sa_family) {
6735 #ifdef INET
6736                                 case AF_INET:
6737                                         if (ipv4_addr_legal) {
6738                                                 struct sockaddr_in *sin;
6739
6740                                                 sin = &sctp_ifa->address.sin;
6741                                                 if (sin->sin_addr.s_addr == 0) {
6742                                                         /*
6743                                                          * skip unspecified
6744                                                          * addrs
6745                                                          */
6746                                                         continue;
6747                                                 }
6748                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
6749                                                     &sin->sin_addr) != 0) {
6750                                                         continue;
6751                                                 }
6752                                                 if ((ipv4_local_scope == 0) &&
6753                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6754                                                         continue;
6755                                                 }
6756                                                 /* count this one */
6757                                                 count++;
6758                                         } else {
6759                                                 continue;
6760                                         }
6761                                         break;
6762 #endif
6763 #ifdef INET6
6764                                 case AF_INET6:
6765                                         if (ipv6_addr_legal) {
6766                                                 struct sockaddr_in6 *sin6;
6767
6768                                                 sin6 = &sctp_ifa->address.sin6;
6769                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6770                                                         continue;
6771                                                 }
6772                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
6773                                                     &sin6->sin6_addr) != 0) {
6774                                                         continue;
6775                                                 }
6776                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6777                                                         if (local_scope == 0)
6778                                                                 continue;
6779                                                         if (sin6->sin6_scope_id == 0) {
6780                                                                 if (sa6_recoverscope(sin6) != 0)
6781                                                                         /*
6782                                                                          *
6783                                                                          * bad
6784                                                                          * link
6785                                                                          *
6786                                                                          * local
6787                                                                          *
6788                                                                          * address
6789                                                                          */
6790                                                                         continue;
6791                                                         }
6792                                                 }
6793                                                 if ((site_scope == 0) &&
6794                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6795                                                         continue;
6796                                                 }
6797                                                 /* count this one */
6798                                                 count++;
6799                                         }
6800                                         break;
6801 #endif
6802                                 default:
6803                                         /* TSNH */
6804                                         break;
6805                                 }
6806                         }
6807                 }
6808         } else {
6809                 /*
6810                  * subset bound case
6811                  */
6812                 struct sctp_laddr *laddr;
6813
6814                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6815                     sctp_nxt_addr) {
6816                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6817                                 continue;
6818                         }
6819                         /* count this one */
6820                         count++;
6821                 }
6822         }
6823         SCTP_IPI_ADDR_RUNLOCK();
6824         return (count);
6825 }
6826
6827 #if defined(SCTP_LOCAL_TRACE_BUF)
6828
6829 void
6830 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6831 {
6832         uint32_t saveindex, newindex;
6833
6834         do {
6835                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6836                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6837                         newindex = 1;
6838                 } else {
6839                         newindex = saveindex + 1;
6840                 }
6841         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6842         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6843                 saveindex = 0;
6844         }
6845         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6846         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6847         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6848         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6849         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6850         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6851         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6852         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6853 }
6854
6855 #endif
6856 static void
6857 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,
6858     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
6859 {
6860         struct ip *iph;
6861 #ifdef INET6
6862         struct ip6_hdr *ip6;
6863 #endif
6864         struct mbuf *sp, *last;
6865         struct udphdr *uhdr;
6866         uint16_t port;
6867
6868         if ((m->m_flags & M_PKTHDR) == 0) {
6869                 /* Can't handle one that is not a pkt hdr */
6870                 goto out;
6871         }
6872         /* Pull the src port */
6873         iph = mtod(m, struct ip *);
6874         uhdr = (struct udphdr *)((caddr_t)iph + off);
6875         port = uhdr->uh_sport;
6876         /*
6877          * Split out the mbuf chain. Leave the IP header in m, place the
6878          * rest in the sp.
6879          */
6880         sp = m_split(m, off, M_NOWAIT);
6881         if (sp == NULL) {
6882                 /* Gak, drop packet, we can't do a split */
6883                 goto out;
6884         }
6885         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
6886                 /* Gak, packet can't have an SCTP header in it - too small */
6887                 m_freem(sp);
6888                 goto out;
6889         }
6890         /* Now pull up the UDP header and SCTP header together */
6891         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
6892         if (sp == NULL) {
6893                 /* Gak pullup failed */
6894                 goto out;
6895         }
6896         /* Trim out the UDP header */
6897         m_adj(sp, sizeof(struct udphdr));
6898
6899         /* Now reconstruct the mbuf chain */
6900         for (last = m; last->m_next; last = last->m_next);
6901         last->m_next = sp;
6902         m->m_pkthdr.len += sp->m_pkthdr.len;
6903         /*
6904          * The CSUM_DATA_VALID flags indicates that the HW checked the UDP
6905          * checksum and it was valid. Since CSUM_DATA_VALID ==
6906          * CSUM_SCTP_VALID this would imply that the HW also verified the
6907          * SCTP checksum. Therefore, clear the bit.
6908          */
6909         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6910             "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n",
6911             m->m_pkthdr.len,
6912             if_name(m->m_pkthdr.rcvif),
6913             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
6914         m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
6915         iph = mtod(m, struct ip *);
6916         switch (iph->ip_v) {
6917 #ifdef INET
6918         case IPVERSION:
6919                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
6920                 sctp_input_with_port(m, off, port);
6921                 break;
6922 #endif
6923 #ifdef INET6
6924         case IPV6_VERSION >> 4:
6925                 ip6 = mtod(m, struct ip6_hdr *);
6926                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
6927                 sctp6_input_with_port(&m, &off, port);
6928                 break;
6929 #endif
6930         default:
6931                 goto out;
6932                 break;
6933         }
6934         return;
6935 out:
6936         m_freem(m);
6937 }
6938
6939 #ifdef INET
6940 static void
6941 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED)
6942 {
6943         struct ip *outer_ip, *inner_ip;
6944         struct sctphdr *sh;
6945         struct icmp *icmp;
6946         struct udphdr *udp;
6947         struct sctp_inpcb *inp;
6948         struct sctp_tcb *stcb;
6949         struct sctp_nets *net;
6950         struct sctp_init_chunk *ch;
6951         struct sockaddr_in src, dst;
6952         uint8_t type, code;
6953
6954         inner_ip = (struct ip *)vip;
6955         icmp = (struct icmp *)((caddr_t)inner_ip -
6956             (sizeof(struct icmp) - sizeof(struct ip)));
6957         outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
6958         if (ntohs(outer_ip->ip_len) <
6959             sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) {
6960                 return;
6961         }
6962         udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
6963         sh = (struct sctphdr *)(udp + 1);
6964         memset(&src, 0, sizeof(struct sockaddr_in));
6965         src.sin_family = AF_INET;
6966         src.sin_len = sizeof(struct sockaddr_in);
6967         src.sin_port = sh->src_port;
6968         src.sin_addr = inner_ip->ip_src;
6969         memset(&dst, 0, sizeof(struct sockaddr_in));
6970         dst.sin_family = AF_INET;
6971         dst.sin_len = sizeof(struct sockaddr_in);
6972         dst.sin_port = sh->dest_port;
6973         dst.sin_addr = inner_ip->ip_dst;
6974         /*
6975          * 'dst' holds the dest of the packet that failed to be sent. 'src'
6976          * holds our local endpoint address. Thus we reverse the dst and the
6977          * src in the lookup.
6978          */
6979         inp = NULL;
6980         net = NULL;
6981         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
6982             (struct sockaddr *)&src,
6983             &inp, &net, 1,
6984             SCTP_DEFAULT_VRFID);
6985         if ((stcb != NULL) &&
6986             (net != NULL) &&
6987             (inp != NULL)) {
6988                 /* Check the UDP port numbers */
6989                 if ((udp->uh_dport != net->port) ||
6990                     (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
6991                         SCTP_TCB_UNLOCK(stcb);
6992                         return;
6993                 }
6994                 /* Check the verification tag */
6995                 if (ntohl(sh->v_tag) != 0) {
6996                         /*
6997                          * This must be the verification tag used for
6998                          * sending out packets. We don't consider packets
6999                          * reflecting the verification tag.
7000                          */
7001                         if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) {
7002                                 SCTP_TCB_UNLOCK(stcb);
7003                                 return;
7004                         }
7005                 } else {
7006                         if (ntohs(outer_ip->ip_len) >=
7007                             sizeof(struct ip) +
7008                             8 + (inner_ip->ip_hl << 2) + 8 + 20) {
7009                                 /*
7010                                  * In this case we can check if we got an
7011                                  * INIT chunk and if the initiate tag
7012                                  * matches.
7013                                  */
7014                                 ch = (struct sctp_init_chunk *)(sh + 1);
7015                                 if ((ch->ch.chunk_type != SCTP_INITIATION) ||
7016                                     (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) {
7017                                         SCTP_TCB_UNLOCK(stcb);
7018                                         return;
7019                                 }
7020                         } else {
7021                                 SCTP_TCB_UNLOCK(stcb);
7022                                 return;
7023                         }
7024                 }
7025                 type = icmp->icmp_type;
7026                 code = icmp->icmp_code;
7027                 if ((type == ICMP_UNREACH) &&
7028                     (code == ICMP_UNREACH_PORT)) {
7029                         code = ICMP_UNREACH_PROTOCOL;
7030                 }
7031                 sctp_notify(inp, stcb, net, type, code,
7032                     ntohs(inner_ip->ip_len),
7033                     (uint32_t)ntohs(icmp->icmp_nextmtu));
7034         } else {
7035                 if ((stcb == NULL) && (inp != NULL)) {
7036                         /* reduce ref-count */
7037                         SCTP_INP_WLOCK(inp);
7038                         SCTP_INP_DECR_REF(inp);
7039                         SCTP_INP_WUNLOCK(inp);
7040                 }
7041                 if (stcb) {
7042                         SCTP_TCB_UNLOCK(stcb);
7043                 }
7044         }
7045         return;
7046 }
7047 #endif
7048
7049 #ifdef INET6
7050 static void
7051 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED)
7052 {
7053         struct ip6ctlparam *ip6cp;
7054         struct sctp_inpcb *inp;
7055         struct sctp_tcb *stcb;
7056         struct sctp_nets *net;
7057         struct sctphdr sh;
7058         struct udphdr udp;
7059         struct sockaddr_in6 src, dst;
7060         uint8_t type, code;
7061
7062         ip6cp = (struct ip6ctlparam *)d;
7063         /*
7064          * XXX: We assume that when IPV6 is non NULL, M and OFF are valid.
7065          */
7066         if (ip6cp->ip6c_m == NULL) {
7067                 return;
7068         }
7069         /*
7070          * Check if we can safely examine the ports and the verification tag
7071          * of the SCTP common header.
7072          */
7073         if (ip6cp->ip6c_m->m_pkthdr.len <
7074             ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) {
7075                 return;
7076         }
7077         /* Copy out the UDP header. */
7078         memset(&udp, 0, sizeof(struct udphdr));
7079         m_copydata(ip6cp->ip6c_m,
7080             ip6cp->ip6c_off,
7081             sizeof(struct udphdr),
7082             (caddr_t)&udp);
7083         /* Copy out the port numbers and the verification tag. */
7084         memset(&sh, 0, sizeof(struct sctphdr));
7085         m_copydata(ip6cp->ip6c_m,
7086             ip6cp->ip6c_off + sizeof(struct udphdr),
7087             sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t),
7088             (caddr_t)&sh);
7089         memset(&src, 0, sizeof(struct sockaddr_in6));
7090         src.sin6_family = AF_INET6;
7091         src.sin6_len = sizeof(struct sockaddr_in6);
7092         src.sin6_port = sh.src_port;
7093         src.sin6_addr = ip6cp->ip6c_ip6->ip6_src;
7094         if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7095                 return;
7096         }
7097         memset(&dst, 0, sizeof(struct sockaddr_in6));
7098         dst.sin6_family = AF_INET6;
7099         dst.sin6_len = sizeof(struct sockaddr_in6);
7100         dst.sin6_port = sh.dest_port;
7101         dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst;
7102         if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7103                 return;
7104         }
7105         inp = NULL;
7106         net = NULL;
7107         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7108             (struct sockaddr *)&src,
7109             &inp, &net, 1, SCTP_DEFAULT_VRFID);
7110         if ((stcb != NULL) &&
7111             (net != NULL) &&
7112             (inp != NULL)) {
7113                 /* Check the UDP port numbers */
7114                 if ((udp.uh_dport != net->port) ||
7115                     (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7116                         SCTP_TCB_UNLOCK(stcb);
7117                         return;
7118                 }
7119                 /* Check the verification tag */
7120                 if (ntohl(sh.v_tag) != 0) {
7121                         /*
7122                          * This must be the verification tag used for
7123                          * sending out packets. We don't consider packets
7124                          * reflecting the verification tag.
7125                          */
7126                         if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) {
7127                                 SCTP_TCB_UNLOCK(stcb);
7128                                 return;
7129                         }
7130                 } else {
7131                         if (ip6cp->ip6c_m->m_pkthdr.len >=
7132                             ip6cp->ip6c_off + sizeof(struct udphdr) +
7133                             sizeof(struct sctphdr) +
7134                             sizeof(struct sctp_chunkhdr) +
7135                             offsetof(struct sctp_init, a_rwnd)) {
7136                                 /*
7137                                  * In this case we can check if we got an
7138                                  * INIT chunk and if the initiate tag
7139                                  * matches.
7140                                  */
7141                                 uint32_t initiate_tag;
7142                                 uint8_t chunk_type;
7143
7144                                 m_copydata(ip6cp->ip6c_m,
7145                                     ip6cp->ip6c_off +
7146                                     sizeof(struct udphdr) +
7147                                     sizeof(struct sctphdr),
7148                                     sizeof(uint8_t),
7149                                     (caddr_t)&chunk_type);
7150                                 m_copydata(ip6cp->ip6c_m,
7151                                     ip6cp->ip6c_off +
7152                                     sizeof(struct udphdr) +
7153                                     sizeof(struct sctphdr) +
7154                                     sizeof(struct sctp_chunkhdr),
7155                                     sizeof(uint32_t),
7156                                     (caddr_t)&initiate_tag);
7157                                 if ((chunk_type != SCTP_INITIATION) ||
7158                                     (ntohl(initiate_tag) != stcb->asoc.my_vtag)) {
7159                                         SCTP_TCB_UNLOCK(stcb);
7160                                         return;
7161                                 }
7162                         } else {
7163                                 SCTP_TCB_UNLOCK(stcb);
7164                                 return;
7165                         }
7166                 }
7167                 type = ip6cp->ip6c_icmp6->icmp6_type;
7168                 code = ip6cp->ip6c_icmp6->icmp6_code;
7169                 if ((type == ICMP6_DST_UNREACH) &&
7170                     (code == ICMP6_DST_UNREACH_NOPORT)) {
7171                         type = ICMP6_PARAM_PROB;
7172                         code = ICMP6_PARAMPROB_NEXTHEADER;
7173                 }
7174                 sctp6_notify(inp, stcb, net, type, code,
7175                     ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
7176         } else {
7177                 if ((stcb == NULL) && (inp != NULL)) {
7178                         /* reduce inp's ref-count */
7179                         SCTP_INP_WLOCK(inp);
7180                         SCTP_INP_DECR_REF(inp);
7181                         SCTP_INP_WUNLOCK(inp);
7182                 }
7183                 if (stcb) {
7184                         SCTP_TCB_UNLOCK(stcb);
7185                 }
7186         }
7187 }
7188 #endif
7189
7190 void
7191 sctp_over_udp_stop(void)
7192 {
7193         /*
7194          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7195          * for writting!
7196          */
7197 #ifdef INET
7198         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7199                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
7200                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
7201         }
7202 #endif
7203 #ifdef INET6
7204         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7205                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
7206                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
7207         }
7208 #endif
7209 }
7210
7211 int
7212 sctp_over_udp_start(void)
7213 {
7214         uint16_t port;
7215         int ret;
7216 #ifdef INET
7217         struct sockaddr_in sin;
7218 #endif
7219 #ifdef INET6
7220         struct sockaddr_in6 sin6;
7221 #endif
7222         /*
7223          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7224          * for writting!
7225          */
7226         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
7227         if (ntohs(port) == 0) {
7228                 /* Must have a port set */
7229                 return (EINVAL);
7230         }
7231 #ifdef INET
7232         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7233                 /* Already running -- must stop first */
7234                 return (EALREADY);
7235         }
7236 #endif
7237 #ifdef INET6
7238         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7239                 /* Already running -- must stop first */
7240                 return (EALREADY);
7241         }
7242 #endif
7243 #ifdef INET
7244         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
7245             SOCK_DGRAM, IPPROTO_UDP,
7246             curthread->td_ucred, curthread))) {
7247                 sctp_over_udp_stop();
7248                 return (ret);
7249         }
7250         /* Call the special UDP hook. */
7251         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
7252             sctp_recv_udp_tunneled_packet,
7253             sctp_recv_icmp_tunneled_packet,
7254             NULL))) {
7255                 sctp_over_udp_stop();
7256                 return (ret);
7257         }
7258         /* Ok, we have a socket, bind it to the port. */
7259         memset(&sin, 0, sizeof(struct sockaddr_in));
7260         sin.sin_len = sizeof(struct sockaddr_in);
7261         sin.sin_family = AF_INET;
7262         sin.sin_port = htons(port);
7263         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7264             (struct sockaddr *)&sin, curthread))) {
7265                 sctp_over_udp_stop();
7266                 return (ret);
7267         }
7268 #endif
7269 #ifdef INET6
7270         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7271             SOCK_DGRAM, IPPROTO_UDP,
7272             curthread->td_ucred, curthread))) {
7273                 sctp_over_udp_stop();
7274                 return (ret);
7275         }
7276         /* Call the special UDP hook. */
7277         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7278             sctp_recv_udp_tunneled_packet,
7279             sctp_recv_icmp6_tunneled_packet,
7280             NULL))) {
7281                 sctp_over_udp_stop();
7282                 return (ret);
7283         }
7284         /* Ok, we have a socket, bind it to the port. */
7285         memset(&sin6, 0, sizeof(struct sockaddr_in6));
7286         sin6.sin6_len = sizeof(struct sockaddr_in6);
7287         sin6.sin6_family = AF_INET6;
7288         sin6.sin6_port = htons(port);
7289         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7290             (struct sockaddr *)&sin6, curthread))) {
7291                 sctp_over_udp_stop();
7292                 return (ret);
7293         }
7294 #endif
7295         return (0);
7296 }
7297
7298 #if defined(INET6) || defined(INET)
7299
7300 /*
7301  * sctp_min_mtu ()returns the minimum of all non-zero arguments.
7302  * If all arguments are zero, zero is returned.
7303  */
7304 uint32_t
7305 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3)
7306 {
7307         if (mtu1 > 0) {
7308                 if (mtu2 > 0) {
7309                         if (mtu3 > 0) {
7310                                 return (min(mtu1, min(mtu2, mtu3)));
7311                         } else {
7312                                 return (min(mtu1, mtu2));
7313                         }
7314                 } else {
7315                         if (mtu3 > 0) {
7316                                 return (min(mtu1, mtu3));
7317                         } else {
7318                                 return (mtu1);
7319                         }
7320                 }
7321         } else {
7322                 if (mtu2 > 0) {
7323                         if (mtu3 > 0) {
7324                                 return (min(mtu2, mtu3));
7325                         } else {
7326                                 return (mtu2);
7327                         }
7328                 } else {
7329                         return (mtu3);
7330                 }
7331         }
7332 }
7333
7334 void
7335 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu)
7336 {
7337         struct in_conninfo inc;
7338
7339         memset(&inc, 0, sizeof(struct in_conninfo));
7340         inc.inc_fibnum = fibnum;
7341         switch (addr->sa.sa_family) {
7342 #ifdef INET
7343         case AF_INET:
7344                 inc.inc_faddr = addr->sin.sin_addr;
7345                 break;
7346 #endif
7347 #ifdef INET6
7348         case AF_INET6:
7349                 inc.inc_flags |= INC_ISIPV6;
7350                 inc.inc6_faddr = addr->sin6.sin6_addr;
7351                 break;
7352 #endif
7353         default:
7354                 return;
7355         }
7356         tcp_hc_updatemtu(&inc, (u_long)mtu);
7357 }
7358
7359 uint32_t
7360 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum)
7361 {
7362         struct in_conninfo inc;
7363
7364         memset(&inc, 0, sizeof(struct in_conninfo));
7365         inc.inc_fibnum = fibnum;
7366         switch (addr->sa.sa_family) {
7367 #ifdef INET
7368         case AF_INET:
7369                 inc.inc_faddr = addr->sin.sin_addr;
7370                 break;
7371 #endif
7372 #ifdef INET6
7373         case AF_INET6:
7374                 inc.inc_flags |= INC_ISIPV6;
7375                 inc.inc6_faddr = addr->sin6.sin6_addr;
7376                 break;
7377 #endif
7378         default:
7379                 return (0);
7380         }
7381         return ((uint32_t)tcp_hc_getmtu(&inc));
7382 }
7383 #endif