sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_pcb.h>
  38 #include <netinet/sctputil.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #ifdef INET6
  42 #endif
  43 #include <netinet/sctp_header.h>
  44 #include <netinet/sctp_output.h>
  45 #include <netinet/sctp_uio.h>
  46 #include <netinet/sctp_timer.h>
  47 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
  48 #include <netinet/sctp_auth.h>
  49 #include <netinet/sctp_asconf.h>
  50 #include <netinet/sctp_bsd_addr.h>
  51
  52
  53 #ifndef KTR_SCTP
  54 #define KTR_SCTP KTR_SUBSYS
  55 #endif
  56
  57 extern struct sctp_cc_functions sctp_cc_functions[];
  58 extern struct sctp_ss_functions sctp_ss_functions[];
  59
  60 void
  61 sctp_sblog(struct sockbuf *sb,
  62     struct sctp_tcb *stcb, int from, int incr)
  63 {
  64         struct sctp_cwnd_log sctp_clog;
  65
  66         sctp_clog.x.sb.stcb = stcb;
  67         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  68         if (stcb)
  69                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  70         else
  71                 sctp_clog.x.sb.stcb_sbcc = 0;
  72         sctp_clog.x.sb.incr = incr;
  73         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  74             SCTP_LOG_EVENT_SB,
  75             from,
  76             sctp_clog.x.misc.log1,
  77             sctp_clog.x.misc.log2,
  78             sctp_clog.x.misc.log3,
  79             sctp_clog.x.misc.log4);
  80 }
  81
  82 void
  83 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  84 {
  85         struct sctp_cwnd_log sctp_clog;
  86
  87         sctp_clog.x.close.inp = (void *)inp;
  88         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
  89         if (stcb) {
  90                 sctp_clog.x.close.stcb = (void *)stcb;
  91                 sctp_clog.x.close.state = (uint16_t) stcb->asoc.state;
  92         } else {
  93                 sctp_clog.x.close.stcb = 0;
  94                 sctp_clog.x.close.state = 0;
  95         }
  96         sctp_clog.x.close.loc = loc;
  97         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  98             SCTP_LOG_EVENT_CLOSE,
  99             0,
 100             sctp_clog.x.misc.log1,
 101             sctp_clog.x.misc.log2,
 102             sctp_clog.x.misc.log3,
 103             sctp_clog.x.misc.log4);
 104 }
 105
 106
 107 void
 108 rto_logging(struct sctp_nets *net, int from)
 109 {
 110         struct sctp_cwnd_log sctp_clog;
 111
 112         memset(&sctp_clog, 0, sizeof(sctp_clog));
 113         sctp_clog.x.rto.net = (void *)net;
 114         sctp_clog.x.rto.rtt = net->rtt / 1000;
 115         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 116             SCTP_LOG_EVENT_RTT,
 117             from,
 118             sctp_clog.x.misc.log1,
 119             sctp_clog.x.misc.log2,
 120             sctp_clog.x.misc.log3,
 121             sctp_clog.x.misc.log4);
 122 }
 123
 124 void
 125 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 126 {
 127         struct sctp_cwnd_log sctp_clog;
 128
 129         sctp_clog.x.strlog.stcb = stcb;
 130         sctp_clog.x.strlog.n_tsn = tsn;
 131         sctp_clog.x.strlog.n_sseq = sseq;
 132         sctp_clog.x.strlog.e_tsn = 0;
 133         sctp_clog.x.strlog.e_sseq = 0;
 134         sctp_clog.x.strlog.strm = stream;
 135         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 136             SCTP_LOG_EVENT_STRM,
 137             from,
 138             sctp_clog.x.misc.log1,
 139             sctp_clog.x.misc.log2,
 140             sctp_clog.x.misc.log3,
 141             sctp_clog.x.misc.log4);
 142 }
 143
 144 void
 145 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 146 {
 147         struct sctp_cwnd_log sctp_clog;
 148
 149         sctp_clog.x.nagle.stcb = (void *)stcb;
 150         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 151         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 152         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 153         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 154         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 155             SCTP_LOG_EVENT_NAGLE,
 156             action,
 157             sctp_clog.x.misc.log1,
 158             sctp_clog.x.misc.log2,
 159             sctp_clog.x.misc.log3,
 160             sctp_clog.x.misc.log4);
 161 }
 162
 163 void
 164 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 165 {
 166         struct sctp_cwnd_log sctp_clog;
 167
 168         sctp_clog.x.sack.cumack = cumack;
 169         sctp_clog.x.sack.oldcumack = old_cumack;
 170         sctp_clog.x.sack.tsn = tsn;
 171         sctp_clog.x.sack.numGaps = gaps;
 172         sctp_clog.x.sack.numDups = dups;
 173         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 174             SCTP_LOG_EVENT_SACK,
 175             from,
 176             sctp_clog.x.misc.log1,
 177             sctp_clog.x.misc.log2,
 178             sctp_clog.x.misc.log3,
 179             sctp_clog.x.misc.log4);
 180 }
 181
 182 void
 183 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 184 {
 185         struct sctp_cwnd_log sctp_clog;
 186
 187         memset(&sctp_clog, 0, sizeof(sctp_clog));
 188         sctp_clog.x.map.base = map;
 189         sctp_clog.x.map.cum = cum;
 190         sctp_clog.x.map.high = high;
 191         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 192             SCTP_LOG_EVENT_MAP,
 193             from,
 194             sctp_clog.x.misc.log1,
 195             sctp_clog.x.misc.log2,
 196             sctp_clog.x.misc.log3,
 197             sctp_clog.x.misc.log4);
 198 }
 199
 200 void
 201 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn,
 202     int from)
 203 {
 204         struct sctp_cwnd_log sctp_clog;
 205
 206         memset(&sctp_clog, 0, sizeof(sctp_clog));
 207         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 208         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 209         sctp_clog.x.fr.tsn = tsn;
 210         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 211             SCTP_LOG_EVENT_FR,
 212             from,
 213             sctp_clog.x.misc.log1,
 214             sctp_clog.x.misc.log2,
 215             sctp_clog.x.misc.log3,
 216             sctp_clog.x.misc.log4);
 217 }
 218
 219 void
 220 sctp_log_mb(struct mbuf *m, int from)
 221 {
 222         struct sctp_cwnd_log sctp_clog;
 223
 224         sctp_clog.x.mb.mp = m;
 225         sctp_clog.x.mb.mbuf_flags = (uint8_t) (SCTP_BUF_GET_FLAGS(m));
 226         sctp_clog.x.mb.size = (uint16_t) (SCTP_BUF_LEN(m));
 227         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 228         if (SCTP_BUF_IS_EXTENDED(m)) {
 229                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 230                 sctp_clog.x.mb.refcnt = (uint8_t) (SCTP_BUF_EXTEND_REFCNT(m));
 231         } else {
 232                 sctp_clog.x.mb.ext = 0;
 233                 sctp_clog.x.mb.refcnt = 0;
 234         }
 235         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 236             SCTP_LOG_EVENT_MBUF,
 237             from,
 238             sctp_clog.x.misc.log1,
 239             sctp_clog.x.misc.log2,
 240             sctp_clog.x.misc.log3,
 241             sctp_clog.x.misc.log4);
 242 }
 243
 244 void
 245 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk,
 246     int from)
 247 {
 248         struct sctp_cwnd_log sctp_clog;
 249
 250         if (control == NULL) {
 251                 SCTP_PRINTF("Gak log of NULL?\n");
 252                 return;
 253         }
 254         sctp_clog.x.strlog.stcb = control->stcb;
 255         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 256         sctp_clog.x.strlog.n_sseq = control->sinfo_ssn;
 257         sctp_clog.x.strlog.strm = control->sinfo_stream;
 258         if (poschk != NULL) {
 259                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 260                 sctp_clog.x.strlog.e_sseq = poschk->sinfo_ssn;
 261         } else {
 262                 sctp_clog.x.strlog.e_tsn = 0;
 263                 sctp_clog.x.strlog.e_sseq = 0;
 264         }
 265         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 266             SCTP_LOG_EVENT_STRM,
 267             from,
 268             sctp_clog.x.misc.log1,
 269             sctp_clog.x.misc.log2,
 270             sctp_clog.x.misc.log3,
 271             sctp_clog.x.misc.log4);
 272 }
 273
 274 void
 275 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 276 {
 277         struct sctp_cwnd_log sctp_clog;
 278
 279         sctp_clog.x.cwnd.net = net;
 280         if (stcb->asoc.send_queue_cnt > 255)
 281                 sctp_clog.x.cwnd.cnt_in_send = 255;
 282         else
 283                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 284         if (stcb->asoc.stream_queue_cnt > 255)
 285                 sctp_clog.x.cwnd.cnt_in_str = 255;
 286         else
 287                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 288
 289         if (net) {
 290                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 291                 sctp_clog.x.cwnd.inflight = net->flight_size;
 292                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 293                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 294                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 295         }
 296         if (SCTP_CWNDLOG_PRESEND == from) {
 297                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 298         }
 299         sctp_clog.x.cwnd.cwnd_augment = augment;
 300         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 301             SCTP_LOG_EVENT_CWND,
 302             from,
 303             sctp_clog.x.misc.log1,
 304             sctp_clog.x.misc.log2,
 305             sctp_clog.x.misc.log3,
 306             sctp_clog.x.misc.log4);
 307 }
 308
 309 void
 310 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 311 {
 312         struct sctp_cwnd_log sctp_clog;
 313
 314         memset(&sctp_clog, 0, sizeof(sctp_clog));
 315         if (inp) {
 316                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 317
 318         } else {
 319                 sctp_clog.x.lock.sock = (void *)NULL;
 320         }
 321         sctp_clog.x.lock.inp = (void *)inp;
 322         if (stcb) {
 323                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 324         } else {
 325                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 326         }
 327         if (inp) {
 328                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 329                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 330         } else {
 331                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 332                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 333         }
 334         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 335         if (inp && (inp->sctp_socket)) {
 336                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 337                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 338                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 339         } else {
 340                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 341                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 342                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 343         }
 344         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 345             SCTP_LOG_LOCK_EVENT,
 346             from,
 347             sctp_clog.x.misc.log1,
 348             sctp_clog.x.misc.log2,
 349             sctp_clog.x.misc.log3,
 350             sctp_clog.x.misc.log4);
 351 }
 352
 353 void
 354 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 355 {
 356         struct sctp_cwnd_log sctp_clog;
 357
 358         memset(&sctp_clog, 0, sizeof(sctp_clog));
 359         sctp_clog.x.cwnd.net = net;
 360         sctp_clog.x.cwnd.cwnd_new_value = error;
 361         sctp_clog.x.cwnd.inflight = net->flight_size;
 362         sctp_clog.x.cwnd.cwnd_augment = burst;
 363         if (stcb->asoc.send_queue_cnt > 255)
 364                 sctp_clog.x.cwnd.cnt_in_send = 255;
 365         else
 366                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 367         if (stcb->asoc.stream_queue_cnt > 255)
 368                 sctp_clog.x.cwnd.cnt_in_str = 255;
 369         else
 370                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 371         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 372             SCTP_LOG_EVENT_MAXBURST,
 373             from,
 374             sctp_clog.x.misc.log1,
 375             sctp_clog.x.misc.log2,
 376             sctp_clog.x.misc.log3,
 377             sctp_clog.x.misc.log4);
 378 }
 379
 380 void
 381 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 382 {
 383         struct sctp_cwnd_log sctp_clog;
 384
 385         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 386         sctp_clog.x.rwnd.send_size = snd_size;
 387         sctp_clog.x.rwnd.overhead = overhead;
 388         sctp_clog.x.rwnd.new_rwnd = 0;
 389         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 390             SCTP_LOG_EVENT_RWND,
 391             from,
 392             sctp_clog.x.misc.log1,
 393             sctp_clog.x.misc.log2,
 394             sctp_clog.x.misc.log3,
 395             sctp_clog.x.misc.log4);
 396 }
 397
 398 void
 399 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 400 {
 401         struct sctp_cwnd_log sctp_clog;
 402
 403         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 404         sctp_clog.x.rwnd.send_size = flight_size;
 405         sctp_clog.x.rwnd.overhead = overhead;
 406         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 407         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 408             SCTP_LOG_EVENT_RWND,
 409             from,
 410             sctp_clog.x.misc.log1,
 411             sctp_clog.x.misc.log2,
 412             sctp_clog.x.misc.log3,
 413             sctp_clog.x.misc.log4);
 414 }
 415
 416 void
 417 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 418 {
 419         struct sctp_cwnd_log sctp_clog;
 420
 421         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 422         sctp_clog.x.mbcnt.size_change = book;
 423         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 424         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 425         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 426             SCTP_LOG_EVENT_MBCNT,
 427             from,
 428             sctp_clog.x.misc.log1,
 429             sctp_clog.x.misc.log2,
 430             sctp_clog.x.misc.log3,
 431             sctp_clog.x.misc.log4);
 432 }
 433
 434 void
 435 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 436 {
 437         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 438             SCTP_LOG_MISC_EVENT,
 439             from,
 440             a, b, c, d);
 441 }
 442
 443 void
 444 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 445 {
 446         struct sctp_cwnd_log sctp_clog;
 447
 448         sctp_clog.x.wake.stcb = (void *)stcb;
 449         sctp_clog.x.wake.wake_cnt = wake_cnt;
 450         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 451         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 452         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 453
 454         if (stcb->asoc.stream_queue_cnt < 0xff)
 455                 sctp_clog.x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt;
 456         else
 457                 sctp_clog.x.wake.stream_qcnt = 0xff;
 458
 459         if (stcb->asoc.chunks_on_out_queue < 0xff)
 460                 sctp_clog.x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue;
 461         else
 462                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 463
 464         sctp_clog.x.wake.sctpflags = 0;
 465         /* set in the defered mode stuff */
 466         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 467                 sctp_clog.x.wake.sctpflags |= 1;
 468         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 469                 sctp_clog.x.wake.sctpflags |= 2;
 470         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 471                 sctp_clog.x.wake.sctpflags |= 4;
 472         /* what about the sb */
 473         if (stcb->sctp_socket) {
 474                 struct socket *so = stcb->sctp_socket;
 475
 476                 sctp_clog.x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff));
 477         } else {
 478                 sctp_clog.x.wake.sbflags = 0xff;
 479         }
 480         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 481             SCTP_LOG_EVENT_WAKE,
 482             from,
 483             sctp_clog.x.misc.log1,
 484             sctp_clog.x.misc.log2,
 485             sctp_clog.x.misc.log3,
 486             sctp_clog.x.misc.log4);
 487 }
 488
 489 void
 490 sctp_log_block(uint8_t from, struct sctp_association *asoc, int sendlen)
 491 {
 492         struct sctp_cwnd_log sctp_clog;
 493
 494         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 495         sctp_clog.x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt);
 496         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 497         sctp_clog.x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt;
 498         sctp_clog.x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue;
 499         sctp_clog.x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024);
 500         sctp_clog.x.blk.sndlen = sendlen;
 501         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 502             SCTP_LOG_EVENT_BLOCK,
 503             from,
 504             sctp_clog.x.misc.log1,
 505             sctp_clog.x.misc.log2,
 506             sctp_clog.x.misc.log3,
 507             sctp_clog.x.misc.log4);
 508 }
 509
 510 int
 511 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 512 {
 513         /* May need to fix this if ktrdump does not work */
 514         return (0);
 515 }
 516
 517 #ifdef SCTP_AUDITING_ENABLED
 518 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 519 static int sctp_audit_indx = 0;
 520
 521 static
 522 void
 523 sctp_print_audit_report(void)
 524 {
 525         int i;
 526         int cnt;
 527
 528         cnt = 0;
 529         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 530                 if ((sctp_audit_data[i][0] == 0xe0) &&
 531                     (sctp_audit_data[i][1] == 0x01)) {
 532                         cnt = 0;
 533                         SCTP_PRINTF("\n");
 534                 } else if (sctp_audit_data[i][0] == 0xf0) {
 535                         cnt = 0;
 536                         SCTP_PRINTF("\n");
 537                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 538                     (sctp_audit_data[i][1] == 0x01)) {
 539                         SCTP_PRINTF("\n");
 540                         cnt = 0;
 541                 }
 542                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 543                     (uint32_t) sctp_audit_data[i][1]);
 544                 cnt++;
 545                 if ((cnt % 14) == 0)
 546                         SCTP_PRINTF("\n");
 547         }
 548         for (i = 0; i < sctp_audit_indx; i++) {
 549                 if ((sctp_audit_data[i][0] == 0xe0) &&
 550                     (sctp_audit_data[i][1] == 0x01)) {
 551                         cnt = 0;
 552                         SCTP_PRINTF("\n");
 553                 } else if (sctp_audit_data[i][0] == 0xf0) {
 554                         cnt = 0;
 555                         SCTP_PRINTF("\n");
 556                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 557                     (sctp_audit_data[i][1] == 0x01)) {
 558                         SCTP_PRINTF("\n");
 559                         cnt = 0;
 560                 }
 561                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 562                     (uint32_t) sctp_audit_data[i][1]);
 563                 cnt++;
 564                 if ((cnt % 14) == 0)
 565                         SCTP_PRINTF("\n");
 566         }
 567         SCTP_PRINTF("\n");
 568 }
 569
 570 void
 571 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 572     struct sctp_nets *net)
 573 {
 574         int resend_cnt, tot_out, rep, tot_book_cnt;
 575         struct sctp_nets *lnet;
 576         struct sctp_tmit_chunk *chk;
 577
 578         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 579         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 580         sctp_audit_indx++;
 581         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 582                 sctp_audit_indx = 0;
 583         }
 584         if (inp == NULL) {
 585                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 586                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 587                 sctp_audit_indx++;
 588                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 589                         sctp_audit_indx = 0;
 590                 }
 591                 return;
 592         }
 593         if (stcb == NULL) {
 594                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 595                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 596                 sctp_audit_indx++;
 597                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 598                         sctp_audit_indx = 0;
 599                 }
 600                 return;
 601         }
 602         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 603         sctp_audit_data[sctp_audit_indx][1] =
 604             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 605         sctp_audit_indx++;
 606         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 607                 sctp_audit_indx = 0;
 608         }
 609         rep = 0;
 610         tot_book_cnt = 0;
 611         resend_cnt = tot_out = 0;
 612         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 613                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 614                         resend_cnt++;
 615                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 616                         tot_out += chk->book_size;
 617                         tot_book_cnt++;
 618                 }
 619         }
 620         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 621                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 622                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 623                 sctp_audit_indx++;
 624                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 625                         sctp_audit_indx = 0;
 626                 }
 627                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 628                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 629                 rep = 1;
 630                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 631                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 632                 sctp_audit_data[sctp_audit_indx][1] =
 633                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 634                 sctp_audit_indx++;
 635                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 636                         sctp_audit_indx = 0;
 637                 }
 638         }
 639         if (tot_out != stcb->asoc.total_flight) {
 640                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 641                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 642                 sctp_audit_indx++;
 643                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 644                         sctp_audit_indx = 0;
 645                 }
 646                 rep = 1;
 647                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 648                     (int)stcb->asoc.total_flight);
 649                 stcb->asoc.total_flight = tot_out;
 650         }
 651         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 652                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 653                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 654                 sctp_audit_indx++;
 655                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 656                         sctp_audit_indx = 0;
 657                 }
 658                 rep = 1;
 659                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 660
 661                 stcb->asoc.total_flight_count = tot_book_cnt;
 662         }
 663         tot_out = 0;
 664         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 665                 tot_out += lnet->flight_size;
 666         }
 667         if (tot_out != stcb->asoc.total_flight) {
 668                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 669                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 670                 sctp_audit_indx++;
 671                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 672                         sctp_audit_indx = 0;
 673                 }
 674                 rep = 1;
 675                 SCTP_PRINTF("real flight:%d net total was %d\n",
 676                     stcb->asoc.total_flight, tot_out);
 677                 /* now corrective action */
 678                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 679
 680                         tot_out = 0;
 681                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 682                                 if ((chk->whoTo == lnet) &&
 683                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 684                                         tot_out += chk->book_size;
 685                                 }
 686                         }
 687                         if (lnet->flight_size != tot_out) {
 688                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 689                                     lnet, lnet->flight_size,
 690                                     tot_out);
 691                                 lnet->flight_size = tot_out;
 692                         }
 693                 }
 694         }
 695         if (rep) {
 696                 sctp_print_audit_report();
 697         }
 698 }
 699
 700 void
 701 sctp_audit_log(uint8_t ev, uint8_t fd)
 702 {
 703
 704         sctp_audit_data[sctp_audit_indx][0] = ev;
 705         sctp_audit_data[sctp_audit_indx][1] = fd;
 706         sctp_audit_indx++;
 707         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 708                 sctp_audit_indx = 0;
 709         }
 710 }
 711
 712 #endif
 713
 714 /*
 715  * sctp_stop_timers_for_shutdown() should be called
 716  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 717  * state to make sure that all timers are stopped.
 718  */
 719 void
 720 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 721 {
 722         struct sctp_association *asoc;
 723         struct sctp_nets *net;
 724
 725         asoc = &stcb->asoc;
 726
 727         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 728         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 729         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 730         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 731         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 732         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 733                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 734                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 735         }
 736 }
 737
 738 /*
 739  * a list of sizes based on typical mtu's, used only if next hop size not
 740  * returned.
 741  */
 742 static uint32_t sctp_mtu_sizes[] = {
 743         68,
 744         296,
 745         508,
 746         512,
 747         544,
 748         576,
 749         1006,
 750         1492,
 751         1500,
 752         1536,
 753         2002,
 754         2048,
 755         4352,
 756         4464,
 757         8166,
 758         17914,
 759         32000,
 760         65535
 761 };
 762
 763 /*
 764  * Return the largest MTU smaller than val. If there is no
 765  * entry, just return val.
 766  */
 767 uint32_t
 768 sctp_get_prev_mtu(uint32_t val)
 769 {
 770         uint32_t i;
 771
 772         if (val <= sctp_mtu_sizes[0]) {
 773                 return (val);
 774         }
 775         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 776                 if (val <= sctp_mtu_sizes[i]) {
 777                         break;
 778                 }
 779         }
 780         return (sctp_mtu_sizes[i - 1]);
 781 }
 782
 783 /*
 784  * Return the smallest MTU larger than val. If there is no
 785  * entry, just return val.
 786  */
 787 uint32_t
 788 sctp_get_next_mtu(uint32_t val)
 789 {
 790         /* select another MTU that is just bigger than this one */
 791         uint32_t i;
 792
 793         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 794                 if (val < sctp_mtu_sizes[i]) {
 795                         return (sctp_mtu_sizes[i]);
 796                 }
 797         }
 798         return (val);
 799 }
 800
 801 void
 802 sctp_fill_random_store(struct sctp_pcb *m)
 803 {
 804         /*
 805          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 806          * our counter. The result becomes our good random numbers and we
 807          * then setup to give these out. Note that we do no locking to
 808          * protect this. This is ok, since if competing folks call this we
 809          * will get more gobbled gook in the random store which is what we
 810          * want. There is a danger that two guys will use the same random
 811          * numbers, but thats ok too since that is random as well :->
 812          */
 813         m->store_at = 0;
 814         (void)sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers,
 815             sizeof(m->random_numbers), (uint8_t *) & m->random_counter,
 816             sizeof(m->random_counter), (uint8_t *) m->random_store);
 817         m->random_counter++;
 818 }
 819
 820 uint32_t
 821 sctp_select_initial_TSN(struct sctp_pcb *inp)
 822 {
 823         /*
 824          * A true implementation should use random selection process to get
 825          * the initial stream sequence number, using RFC1750 as a good
 826          * guideline
 827          */
 828         uint32_t x, *xp;
 829         uint8_t *p;
 830         int store_at, new_store;
 831
 832         if (inp->initial_sequence_debug != 0) {
 833                 uint32_t ret;
 834
 835                 ret = inp->initial_sequence_debug;
 836                 inp->initial_sequence_debug++;
 837                 return (ret);
 838         }
 839 retry:
 840         store_at = inp->store_at;
 841         new_store = store_at + sizeof(uint32_t);
 842         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 843                 new_store = 0;
 844         }
 845         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 846                 goto retry;
 847         }
 848         if (new_store == 0) {
 849                 /* Refill the random store */
 850                 sctp_fill_random_store(inp);
 851         }
 852         p = &inp->random_store[store_at];
 853         xp = (uint32_t *) p;
 854         x = *xp;
 855         return (x);
 856 }
 857
 858 uint32_t
 859 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
 860 {
 861         uint32_t x;
 862         struct timeval now;
 863
 864         if (check) {
 865                 (void)SCTP_GETTIME_TIMEVAL(&now);
 866         }
 867         for (;;) {
 868                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 869                 if (x == 0) {
 870                         /* we never use 0 */
 871                         continue;
 872                 }
 873                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 874                         break;
 875                 }
 876         }
 877         return (x);
 878 }
 879
 880 int
 881 sctp_init_asoc(struct sctp_inpcb *m, struct sctp_tcb *stcb,
 882     uint32_t override_tag, uint32_t vrf_id)
 883 {
 884         struct sctp_association *asoc;
 885
 886         /*
 887          * Anything set to zero is taken care of by the allocation routine's
 888          * bzero
 889          */
 890
 891         /*
 892          * Up front select what scoping to apply on addresses I tell my peer
 893          * Not sure what to do with these right now, we will need to come up
 894          * with a way to set them. We may need to pass them through from the
 895          * caller in the sctp_aloc_assoc() function.
 896          */
 897         int i;
 898
 899         asoc = &stcb->asoc;
 900         /* init all variables to a known value. */
 901         SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE);
 902         asoc->max_burst = m->sctp_ep.max_burst;
 903         asoc->fr_max_burst = m->sctp_ep.fr_max_burst;
 904         asoc->heart_beat_delay = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
 905         asoc->cookie_life = m->sctp_ep.def_cookie_life;
 906         asoc->sctp_cmt_on_off = m->sctp_cmt_on_off;
 907         asoc->ecn_allowed = m->sctp_ecn_enable;
 908         asoc->sctp_nr_sack_on_off = (uint8_t) SCTP_BASE_SYSCTL(sctp_nr_sack_on_off);
 909         asoc->sctp_cmt_pf = (uint8_t) 0;
 910         asoc->sctp_frag_point = m->sctp_frag_point;
 911         asoc->sctp_features = m->sctp_features;
 912         asoc->default_dscp = m->sctp_ep.default_dscp;
 913 #ifdef INET6
 914         if (m->sctp_ep.default_flowlabel) {
 915                 asoc->default_flowlabel = m->sctp_ep.default_flowlabel;
 916         } else {
 917                 if (m->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
 918                         asoc->default_flowlabel = sctp_select_initial_TSN(&m->sctp_ep);
 919                         asoc->default_flowlabel &= 0x000fffff;
 920                         asoc->default_flowlabel |= 0x80000000;
 921                 } else {
 922                         asoc->default_flowlabel = 0;
 923                 }
 924         }
 925 #endif
 926         asoc->sb_send_resv = 0;
 927         if (override_tag) {
 928                 asoc->my_vtag = override_tag;
 929         } else {
 930                 asoc->my_vtag = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 931         }
 932         /* Get the nonce tags */
 933         asoc->my_vtag_nonce = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 934         asoc->peer_vtag_nonce = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 935         asoc->vrf_id = vrf_id;
 936
 937 #ifdef SCTP_ASOCLOG_OF_TSNS
 938         asoc->tsn_in_at = 0;
 939         asoc->tsn_out_at = 0;
 940         asoc->tsn_in_wrapped = 0;
 941         asoc->tsn_out_wrapped = 0;
 942         asoc->cumack_log_at = 0;
 943         asoc->cumack_log_atsnt = 0;
 944 #endif
 945 #ifdef SCTP_FS_SPEC_LOG
 946         asoc->fs_index = 0;
 947 #endif
 948         asoc->refcnt = 0;
 949         asoc->assoc_up_sent = 0;
 950         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
 951             sctp_select_initial_TSN(&m->sctp_ep);
 952         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 953         /* we are optimisitic here */
 954         asoc->peer_supports_pktdrop = 1;
 955         asoc->peer_supports_nat = 0;
 956         asoc->sent_queue_retran_cnt = 0;
 957
 958         /* for CMT */
 959         asoc->last_net_cmt_send_started = NULL;
 960
 961         /* This will need to be adjusted */
 962         asoc->last_acked_seq = asoc->init_seq_number - 1;
 963         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 964         asoc->asconf_seq_in = asoc->last_acked_seq;
 965
 966         /* here we are different, we hold the next one we expect */
 967         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
 968
 969         asoc->initial_init_rto_max = m->sctp_ep.initial_init_rto_max;
 970         asoc->initial_rto = m->sctp_ep.initial_rto;
 971
 972         asoc->max_init_times = m->sctp_ep.max_init_times;
 973         asoc->max_send_times = m->sctp_ep.max_send_times;
 974         asoc->def_net_failure = m->sctp_ep.def_net_failure;
 975         asoc->def_net_pf_threshold = m->sctp_ep.def_net_pf_threshold;
 976         asoc->free_chunk_cnt = 0;
 977
 978         asoc->iam_blocking = 0;
 979         asoc->context = m->sctp_context;
 980         asoc->local_strreset_support = m->local_strreset_support;
 981         asoc->def_send = m->def_send;
 982         asoc->delayed_ack = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
 983         asoc->sack_freq = m->sctp_ep.sctp_sack_freq;
 984         asoc->pr_sctp_cnt = 0;
 985         asoc->total_output_queue_size = 0;
 986
 987         if (m->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
 988                 struct in6pcb *inp6;
 989
 990                 /* Its a V6 socket */
 991                 inp6 = (struct in6pcb *)m;
 992                 asoc->ipv6_addr_legal = 1;
 993                 /* Now look at the binding flag to see if V4 will be legal */
 994                 if (SCTP_IPV6_V6ONLY(inp6) == 0) {
 995                         asoc->ipv4_addr_legal = 1;
 996                 } else {
 997                         /* V4 addresses are NOT legal on the association */
 998                         asoc->ipv4_addr_legal = 0;
 999                 }
1000         } else {
1001                 /* Its a V4 socket, no - V6 */
1002                 asoc->ipv4_addr_legal = 1;
1003                 asoc->ipv6_addr_legal = 0;
1004         }
1005
1006         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(m->sctp_socket), SCTP_MINIMAL_RWND);
1007         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(m->sctp_socket);
1008
1009         asoc->smallest_mtu = m->sctp_frag_point;
1010         asoc->minrto = m->sctp_ep.sctp_minrto;
1011         asoc->maxrto = m->sctp_ep.sctp_maxrto;
1012
1013         asoc->locked_on_sending = NULL;
1014         asoc->stream_locked_on = 0;
1015         asoc->ecn_echo_cnt_onq = 0;
1016         asoc->stream_locked = 0;
1017
1018         asoc->send_sack = 1;
1019
1020         LIST_INIT(&asoc->sctp_restricted_addrs);
1021
1022         TAILQ_INIT(&asoc->nets);
1023         TAILQ_INIT(&asoc->pending_reply_queue);
1024         TAILQ_INIT(&asoc->asconf_ack_sent);
1025         /* Setup to fill the hb random cache at first HB */
1026         asoc->hb_random_idx = 4;
1027
1028         asoc->sctp_autoclose_ticks = m->sctp_ep.auto_close_time;
1029
1030         stcb->asoc.congestion_control_module = m->sctp_ep.sctp_default_cc_module;
1031         stcb->asoc.cc_functions = sctp_cc_functions[m->sctp_ep.sctp_default_cc_module];
1032
1033         stcb->asoc.stream_scheduling_module = m->sctp_ep.sctp_default_ss_module;
1034         stcb->asoc.ss_functions = sctp_ss_functions[m->sctp_ep.sctp_default_ss_module];
1035
1036         /*
1037          * Now the stream parameters, here we allocate space for all streams
1038          * that we request by default.
1039          */
1040         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1041             m->sctp_ep.pre_open_stream_count;
1042         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1043             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1044             SCTP_M_STRMO);
1045         if (asoc->strmout == NULL) {
1046                 /* big trouble no memory */
1047                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1048                 return (ENOMEM);
1049         }
1050         for (i = 0; i < asoc->streamoutcnt; i++) {
1051                 /*
1052                  * inbound side must be set to 0xffff, also NOTE when we get
1053                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1054                  * count (streamoutcnt) but first check if we sent to any of
1055                  * the upper streams that were dropped (if some were). Those
1056                  * that were dropped must be notified to the upper layer as
1057                  * failed to send.
1058                  */
1059                 asoc->strmout[i].next_sequence_sent = 0x0;
1060                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1061                 asoc->strmout[i].stream_no = i;
1062                 asoc->strmout[i].last_msg_incomplete = 0;
1063                 asoc->ss_functions.sctp_ss_init_stream(&asoc->strmout[i], NULL);
1064         }
1065         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1066
1067         /* Now the mapping array */
1068         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1069         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1070             SCTP_M_MAP);
1071         if (asoc->mapping_array == NULL) {
1072                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1073                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1074                 return (ENOMEM);
1075         }
1076         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1077         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1078             SCTP_M_MAP);
1079         if (asoc->nr_mapping_array == NULL) {
1080                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1081                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1082                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1083                 return (ENOMEM);
1084         }
1085         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1086
1087         /* Now the init of the other outqueues */
1088         TAILQ_INIT(&asoc->free_chunks);
1089         TAILQ_INIT(&asoc->control_send_queue);
1090         TAILQ_INIT(&asoc->asconf_send_queue);
1091         TAILQ_INIT(&asoc->send_queue);
1092         TAILQ_INIT(&asoc->sent_queue);
1093         TAILQ_INIT(&asoc->reasmqueue);
1094         TAILQ_INIT(&asoc->resetHead);
1095         asoc->max_inbound_streams = m->sctp_ep.max_open_streams_intome;
1096         TAILQ_INIT(&asoc->asconf_queue);
1097         /* authentication fields */
1098         asoc->authinfo.random = NULL;
1099         asoc->authinfo.active_keyid = 0;
1100         asoc->authinfo.assoc_key = NULL;
1101         asoc->authinfo.assoc_keyid = 0;
1102         asoc->authinfo.recv_key = NULL;
1103         asoc->authinfo.recv_keyid = 0;
1104         LIST_INIT(&asoc->shared_keys);
1105         asoc->marked_retrans = 0;
1106         asoc->port = m->sctp_ep.port;
1107         asoc->timoinit = 0;
1108         asoc->timodata = 0;
1109         asoc->timosack = 0;
1110         asoc->timoshutdown = 0;
1111         asoc->timoheartbeat = 0;
1112         asoc->timocookie = 0;
1113         asoc->timoshutdownack = 0;
1114         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1115         asoc->discontinuity_time = asoc->start_time;
1116         /*
1117          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1118          * freed later when the association is freed.
1119          */
1120         return (0);
1121 }
1122
1123 void
1124 sctp_print_mapping_array(struct sctp_association *asoc)
1125 {
1126         unsigned int i, limit;
1127
1128         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1129             asoc->mapping_array_size,
1130             asoc->mapping_array_base_tsn,
1131             asoc->cumulative_tsn,
1132             asoc->highest_tsn_inside_map,
1133             asoc->highest_tsn_inside_nr_map);
1134         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1135                 if (asoc->mapping_array[limit - 1] != 0) {
1136                         break;
1137                 }
1138         }
1139         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1140         for (i = 0; i < limit; i++) {
1141                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1142         }
1143         if (limit % 16)
1144                 SCTP_PRINTF("\n");
1145         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1146                 if (asoc->nr_mapping_array[limit - 1]) {
1147                         break;
1148                 }
1149         }
1150         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1151         for (i = 0; i < limit; i++) {
1152                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1153         }
1154         if (limit % 16)
1155                 SCTP_PRINTF("\n");
1156 }
1157
1158 int
1159 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1160 {
1161         /* mapping array needs to grow */
1162         uint8_t *new_array1, *new_array2;
1163         uint32_t new_size;
1164
1165         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1166         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1167         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1168         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1169                 /* can't get more, forget it */
1170                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1171                 if (new_array1) {
1172                         SCTP_FREE(new_array1, SCTP_M_MAP);
1173                 }
1174                 if (new_array2) {
1175                         SCTP_FREE(new_array2, SCTP_M_MAP);
1176                 }
1177                 return (-1);
1178         }
1179         memset(new_array1, 0, new_size);
1180         memset(new_array2, 0, new_size);
1181         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1182         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1183         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1184         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1185         asoc->mapping_array = new_array1;
1186         asoc->nr_mapping_array = new_array2;
1187         asoc->mapping_array_size = new_size;
1188         return (0);
1189 }
1190
1191
1192 static void
1193 sctp_iterator_work(struct sctp_iterator *it)
1194 {
1195         int iteration_count = 0;
1196         int inp_skip = 0;
1197         int first_in = 1;
1198         struct sctp_inpcb *tinp;
1199
1200         SCTP_INP_INFO_RLOCK();
1201         SCTP_ITERATOR_LOCK();
1202         if (it->inp) {
1203                 SCTP_INP_RLOCK(it->inp);
1204                 SCTP_INP_DECR_REF(it->inp);
1205         }
1206         if (it->inp == NULL) {
1207                 /* iterator is complete */
1208 done_with_iterator:
1209                 SCTP_ITERATOR_UNLOCK();
1210                 SCTP_INP_INFO_RUNLOCK();
1211                 if (it->function_atend != NULL) {
1212                         (*it->function_atend) (it->pointer, it->val);
1213                 }
1214                 SCTP_FREE(it, SCTP_M_ITER);
1215                 return;
1216         }
1217 select_a_new_ep:
1218         if (first_in) {
1219                 first_in = 0;
1220         } else {
1221                 SCTP_INP_RLOCK(it->inp);
1222         }
1223         while (((it->pcb_flags) &&
1224             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1225             ((it->pcb_features) &&
1226             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1227                 /* endpoint flags or features don't match, so keep looking */
1228                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1229                         SCTP_INP_RUNLOCK(it->inp);
1230                         goto done_with_iterator;
1231                 }
1232                 tinp = it->inp;
1233                 it->inp = LIST_NEXT(it->inp, sctp_list);
1234                 SCTP_INP_RUNLOCK(tinp);
1235                 if (it->inp == NULL) {
1236                         goto done_with_iterator;
1237                 }
1238                 SCTP_INP_RLOCK(it->inp);
1239         }
1240         /* now go through each assoc which is in the desired state */
1241         if (it->done_current_ep == 0) {
1242                 if (it->function_inp != NULL)
1243                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1244                 it->done_current_ep = 1;
1245         }
1246         if (it->stcb == NULL) {
1247                 /* run the per instance function */
1248                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1249         }
1250         if ((inp_skip) || it->stcb == NULL) {
1251                 if (it->function_inp_end != NULL) {
1252                         inp_skip = (*it->function_inp_end) (it->inp,
1253                             it->pointer,
1254                             it->val);
1255                 }
1256                 SCTP_INP_RUNLOCK(it->inp);
1257                 goto no_stcb;
1258         }
1259         while (it->stcb) {
1260                 SCTP_TCB_LOCK(it->stcb);
1261                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1262                         /* not in the right state... keep looking */
1263                         SCTP_TCB_UNLOCK(it->stcb);
1264                         goto next_assoc;
1265                 }
1266                 /* see if we have limited out the iterator loop */
1267                 iteration_count++;
1268                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1269                         /* Pause to let others grab the lock */
1270                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1271                         SCTP_TCB_UNLOCK(it->stcb);
1272                         SCTP_INP_INCR_REF(it->inp);
1273                         SCTP_INP_RUNLOCK(it->inp);
1274                         SCTP_ITERATOR_UNLOCK();
1275                         SCTP_INP_INFO_RUNLOCK();
1276                         SCTP_INP_INFO_RLOCK();
1277                         SCTP_ITERATOR_LOCK();
1278                         if (sctp_it_ctl.iterator_flags) {
1279                                 /* We won't be staying here */
1280                                 SCTP_INP_DECR_REF(it->inp);
1281                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1282                                 if (sctp_it_ctl.iterator_flags &
1283                                     SCTP_ITERATOR_STOP_CUR_IT) {
1284                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1285                                         goto done_with_iterator;
1286                                 }
1287                                 if (sctp_it_ctl.iterator_flags &
1288                                     SCTP_ITERATOR_STOP_CUR_INP) {
1289                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1290                                         goto no_stcb;
1291                                 }
1292                                 /* If we reach here huh? */
1293                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1294                                     sctp_it_ctl.iterator_flags);
1295                                 sctp_it_ctl.iterator_flags = 0;
1296                         }
1297                         SCTP_INP_RLOCK(it->inp);
1298                         SCTP_INP_DECR_REF(it->inp);
1299                         SCTP_TCB_LOCK(it->stcb);
1300                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1301                         iteration_count = 0;
1302                 }
1303                 /* run function on this one */
1304                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1305
1306                 /*
1307                  * we lie here, it really needs to have its own type but
1308                  * first I must verify that this won't effect things :-0
1309                  */
1310                 if (it->no_chunk_output == 0)
1311                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1312
1313                 SCTP_TCB_UNLOCK(it->stcb);
1314 next_assoc:
1315                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1316                 if (it->stcb == NULL) {
1317                         /* Run last function */
1318                         if (it->function_inp_end != NULL) {
1319                                 inp_skip = (*it->function_inp_end) (it->inp,
1320                                     it->pointer,
1321                                     it->val);
1322                         }
1323                 }
1324         }
1325         SCTP_INP_RUNLOCK(it->inp);
1326 no_stcb:
1327         /* done with all assocs on this endpoint, move on to next endpoint */
1328         it->done_current_ep = 0;
1329         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1330                 it->inp = NULL;
1331         } else {
1332                 it->inp = LIST_NEXT(it->inp, sctp_list);
1333         }
1334         if (it->inp == NULL) {
1335                 goto done_with_iterator;
1336         }
1337         goto select_a_new_ep;
1338 }
1339
1340 void
1341 sctp_iterator_worker(void)
1342 {
1343         struct sctp_iterator *it, *nit;
1344
1345         /* This function is called with the WQ lock in place */
1346
1347         sctp_it_ctl.iterator_running = 1;
1348         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1349                 sctp_it_ctl.cur_it = it;
1350                 /* now lets work on this one */
1351                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1352                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1353                 CURVNET_SET(it->vn);
1354                 sctp_iterator_work(it);
1355                 sctp_it_ctl.cur_it = NULL;
1356                 CURVNET_RESTORE();
1357                 SCTP_IPI_ITERATOR_WQ_LOCK();
1358                 /* sa_ignore FREED_MEMORY */
1359         }
1360         sctp_it_ctl.iterator_running = 0;
1361         return;
1362 }
1363
1364
1365 static void
1366 sctp_handle_addr_wq(void)
1367 {
1368         /* deal with the ADDR wq from the rtsock calls */
1369         struct sctp_laddr *wi, *nwi;
1370         struct sctp_asconf_iterator *asc;
1371
1372         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1373             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1374         if (asc == NULL) {
1375                 /* Try later, no memory */
1376                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1377                     (struct sctp_inpcb *)NULL,
1378                     (struct sctp_tcb *)NULL,
1379                     (struct sctp_nets *)NULL);
1380                 return;
1381         }
1382         LIST_INIT(&asc->list_of_work);
1383         asc->cnt = 0;
1384
1385         SCTP_WQ_ADDR_LOCK();
1386         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1387                 LIST_REMOVE(wi, sctp_nxt_addr);
1388                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1389                 asc->cnt++;
1390         }
1391         SCTP_WQ_ADDR_UNLOCK();
1392
1393         if (asc->cnt == 0) {
1394                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1395         } else {
1396                 (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
1397                     sctp_asconf_iterator_stcb,
1398                     NULL,       /* No ep end for boundall */
1399                     SCTP_PCB_FLAGS_BOUNDALL,
1400                     SCTP_PCB_ANY_FEATURES,
1401                     SCTP_ASOC_ANY_STATE,
1402                     (void *)asc, 0,
1403                     sctp_asconf_iterator_end, NULL, 0);
1404         }
1405 }
1406
1407 void
1408 sctp_timeout_handler(void *t)
1409 {
1410         struct sctp_inpcb *inp;
1411         struct sctp_tcb *stcb;
1412         struct sctp_nets *net;
1413         struct sctp_timer *tmr;
1414
1415 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1416         struct socket *so;
1417
1418 #endif
1419         int did_output, type;
1420
1421         tmr = (struct sctp_timer *)t;
1422         inp = (struct sctp_inpcb *)tmr->ep;
1423         stcb = (struct sctp_tcb *)tmr->tcb;
1424         net = (struct sctp_nets *)tmr->net;
1425         CURVNET_SET((struct vnet *)tmr->vnet);
1426         did_output = 1;
1427
1428 #ifdef SCTP_AUDITING_ENABLED
1429         sctp_audit_log(0xF0, (uint8_t) tmr->type);
1430         sctp_auditing(3, inp, stcb, net);
1431 #endif
1432
1433         /* sanity checks... */
1434         if (tmr->self != (void *)tmr) {
1435                 /*
1436                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1437                  * tmr);
1438                  */
1439                 CURVNET_RESTORE();
1440                 return;
1441         }
1442         tmr->stopped_from = 0xa001;
1443         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1444                 /*
1445                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1446                  * tmr->type);
1447                  */
1448                 CURVNET_RESTORE();
1449                 return;
1450         }
1451         tmr->stopped_from = 0xa002;
1452         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1453                 CURVNET_RESTORE();
1454                 return;
1455         }
1456         /* if this is an iterator timeout, get the struct and clear inp */
1457         tmr->stopped_from = 0xa003;
1458         type = tmr->type;
1459         if (inp) {
1460                 SCTP_INP_INCR_REF(inp);
1461                 if ((inp->sctp_socket == NULL) &&
1462                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1463                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1464                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1465                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1466                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1467                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1468                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1469                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1470                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))
1471                     ) {
1472                         SCTP_INP_DECR_REF(inp);
1473                         CURVNET_RESTORE();
1474                         return;
1475                 }
1476         }
1477         tmr->stopped_from = 0xa004;
1478         if (stcb) {
1479                 atomic_add_int(&stcb->asoc.refcnt, 1);
1480                 if (stcb->asoc.state == 0) {
1481                         atomic_add_int(&stcb->asoc.refcnt, -1);
1482                         if (inp) {
1483                                 SCTP_INP_DECR_REF(inp);
1484                         }
1485                         CURVNET_RESTORE();
1486                         return;
1487                 }
1488         }
1489         tmr->stopped_from = 0xa005;
1490         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", tmr->type);
1491         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1492                 if (inp) {
1493                         SCTP_INP_DECR_REF(inp);
1494                 }
1495                 if (stcb) {
1496                         atomic_add_int(&stcb->asoc.refcnt, -1);
1497                 }
1498                 CURVNET_RESTORE();
1499                 return;
1500         }
1501         tmr->stopped_from = 0xa006;
1502
1503         if (stcb) {
1504                 SCTP_TCB_LOCK(stcb);
1505                 atomic_add_int(&stcb->asoc.refcnt, -1);
1506                 if ((tmr->type != SCTP_TIMER_TYPE_ASOCKILL) &&
1507                     ((stcb->asoc.state == 0) ||
1508                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1509                         SCTP_TCB_UNLOCK(stcb);
1510                         if (inp) {
1511                                 SCTP_INP_DECR_REF(inp);
1512                         }
1513                         CURVNET_RESTORE();
1514                         return;
1515                 }
1516         }
1517         /* record in stopped what t-o occured */
1518         tmr->stopped_from = tmr->type;
1519
1520         /* mark as being serviced now */
1521         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1522                 /*
1523                  * Callout has been rescheduled.
1524                  */
1525                 goto get_out;
1526         }
1527         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1528                 /*
1529                  * Not active, so no action.
1530                  */
1531                 goto get_out;
1532         }
1533         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1534
1535         /* call the handler for the appropriate timer type */
1536         switch (tmr->type) {
1537         case SCTP_TIMER_TYPE_ZERO_COPY:
1538                 if (inp == NULL) {
1539                         break;
1540                 }
1541                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1542                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
1543                 }
1544                 break;
1545         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1546                 if (inp == NULL) {
1547                         break;
1548                 }
1549                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1550                         SCTP_ZERO_COPY_SENDQ_EVENT(inp, inp->sctp_socket);
1551                 }
1552                 break;
1553         case SCTP_TIMER_TYPE_ADDR_WQ:
1554                 sctp_handle_addr_wq();
1555                 break;
1556         case SCTP_TIMER_TYPE_SEND:
1557                 if ((stcb == NULL) || (inp == NULL)) {
1558                         break;
1559                 }
1560                 SCTP_STAT_INCR(sctps_timodata);
1561                 stcb->asoc.timodata++;
1562                 stcb->asoc.num_send_timers_up--;
1563                 if (stcb->asoc.num_send_timers_up < 0) {
1564                         stcb->asoc.num_send_timers_up = 0;
1565                 }
1566                 SCTP_TCB_LOCK_ASSERT(stcb);
1567                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1568                         /* no need to unlock on tcb its gone */
1569
1570                         goto out_decr;
1571                 }
1572                 SCTP_TCB_LOCK_ASSERT(stcb);
1573 #ifdef SCTP_AUDITING_ENABLED
1574                 sctp_auditing(4, inp, stcb, net);
1575 #endif
1576                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1577                 if ((stcb->asoc.num_send_timers_up == 0) &&
1578                     (stcb->asoc.sent_queue_cnt > 0)) {
1579                         struct sctp_tmit_chunk *chk;
1580
1581                         /*
1582                          * safeguard. If there on some on the sent queue
1583                          * somewhere but no timers running something is
1584                          * wrong... so we start a timer on the first chunk
1585                          * on the send queue on whatever net it is sent to.
1586                          */
1587                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1588                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1589                             chk->whoTo);
1590                 }
1591                 break;
1592         case SCTP_TIMER_TYPE_INIT:
1593                 if ((stcb == NULL) || (inp == NULL)) {
1594                         break;
1595                 }
1596                 SCTP_STAT_INCR(sctps_timoinit);
1597                 stcb->asoc.timoinit++;
1598                 if (sctp_t1init_timer(inp, stcb, net)) {
1599                         /* no need to unlock on tcb its gone */
1600                         goto out_decr;
1601                 }
1602                 /* We do output but not here */
1603                 did_output = 0;
1604                 break;
1605         case SCTP_TIMER_TYPE_RECV:
1606                 if ((stcb == NULL) || (inp == NULL)) {
1607                         break;
1608                 }
1609                 SCTP_STAT_INCR(sctps_timosack);
1610                 stcb->asoc.timosack++;
1611                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1612 #ifdef SCTP_AUDITING_ENABLED
1613                 sctp_auditing(4, inp, stcb, net);
1614 #endif
1615                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1616                 break;
1617         case SCTP_TIMER_TYPE_SHUTDOWN:
1618                 if ((stcb == NULL) || (inp == NULL)) {
1619                         break;
1620                 }
1621                 if (sctp_shutdown_timer(inp, stcb, net)) {
1622                         /* no need to unlock on tcb its gone */
1623                         goto out_decr;
1624                 }
1625                 SCTP_STAT_INCR(sctps_timoshutdown);
1626                 stcb->asoc.timoshutdown++;
1627 #ifdef SCTP_AUDITING_ENABLED
1628                 sctp_auditing(4, inp, stcb, net);
1629 #endif
1630                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1631                 break;
1632         case SCTP_TIMER_TYPE_HEARTBEAT:
1633                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1634                         break;
1635                 }
1636                 SCTP_STAT_INCR(sctps_timoheartbeat);
1637                 stcb->asoc.timoheartbeat++;
1638                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1639                         /* no need to unlock on tcb its gone */
1640                         goto out_decr;
1641                 }
1642 #ifdef SCTP_AUDITING_ENABLED
1643                 sctp_auditing(4, inp, stcb, net);
1644 #endif
1645                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1646                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1647                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1648                 }
1649                 break;
1650         case SCTP_TIMER_TYPE_COOKIE:
1651                 if ((stcb == NULL) || (inp == NULL)) {
1652                         break;
1653                 }
1654                 if (sctp_cookie_timer(inp, stcb, net)) {
1655                         /* no need to unlock on tcb its gone */
1656                         goto out_decr;
1657                 }
1658                 SCTP_STAT_INCR(sctps_timocookie);
1659                 stcb->asoc.timocookie++;
1660 #ifdef SCTP_AUDITING_ENABLED
1661                 sctp_auditing(4, inp, stcb, net);
1662 #endif
1663                 /*
1664                  * We consider T3 and Cookie timer pretty much the same with
1665                  * respect to where from in chunk_output.
1666                  */
1667                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1668                 break;
1669         case SCTP_TIMER_TYPE_NEWCOOKIE:
1670                 {
1671                         struct timeval tv;
1672                         int i, secret;
1673
1674                         if (inp == NULL) {
1675                                 break;
1676                         }
1677                         SCTP_STAT_INCR(sctps_timosecret);
1678                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1679                         SCTP_INP_WLOCK(inp);
1680                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1681                         inp->sctp_ep.last_secret_number =
1682                             inp->sctp_ep.current_secret_number;
1683                         inp->sctp_ep.current_secret_number++;
1684                         if (inp->sctp_ep.current_secret_number >=
1685                             SCTP_HOW_MANY_SECRETS) {
1686                                 inp->sctp_ep.current_secret_number = 0;
1687                         }
1688                         secret = (int)inp->sctp_ep.current_secret_number;
1689                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1690                                 inp->sctp_ep.secret_key[secret][i] =
1691                                     sctp_select_initial_TSN(&inp->sctp_ep);
1692                         }
1693                         SCTP_INP_WUNLOCK(inp);
1694                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1695                 }
1696                 did_output = 0;
1697                 break;
1698         case SCTP_TIMER_TYPE_PATHMTURAISE:
1699                 if ((stcb == NULL) || (inp == NULL)) {
1700                         break;
1701                 }
1702                 SCTP_STAT_INCR(sctps_timopathmtu);
1703                 sctp_pathmtu_timer(inp, stcb, net);
1704                 did_output = 0;
1705                 break;
1706         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1707                 if ((stcb == NULL) || (inp == NULL)) {
1708                         break;
1709                 }
1710                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1711                         /* no need to unlock on tcb its gone */
1712                         goto out_decr;
1713                 }
1714                 SCTP_STAT_INCR(sctps_timoshutdownack);
1715                 stcb->asoc.timoshutdownack++;
1716 #ifdef SCTP_AUDITING_ENABLED
1717                 sctp_auditing(4, inp, stcb, net);
1718 #endif
1719                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1720                 break;
1721         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1722                 if ((stcb == NULL) || (inp == NULL)) {
1723                         break;
1724                 }
1725                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1726                 sctp_abort_an_association(inp, stcb, NULL, SCTP_SO_NOT_LOCKED);
1727                 /* no need to unlock on tcb its gone */
1728                 goto out_decr;
1729
1730         case SCTP_TIMER_TYPE_STRRESET:
1731                 if ((stcb == NULL) || (inp == NULL)) {
1732                         break;
1733                 }
1734                 if (sctp_strreset_timer(inp, stcb, net)) {
1735                         /* no need to unlock on tcb its gone */
1736                         goto out_decr;
1737                 }
1738                 SCTP_STAT_INCR(sctps_timostrmrst);
1739                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1740                 break;
1741         case SCTP_TIMER_TYPE_ASCONF:
1742                 if ((stcb == NULL) || (inp == NULL)) {
1743                         break;
1744                 }
1745                 if (sctp_asconf_timer(inp, stcb, net)) {
1746                         /* no need to unlock on tcb its gone */
1747                         goto out_decr;
1748                 }
1749                 SCTP_STAT_INCR(sctps_timoasconf);
1750 #ifdef SCTP_AUDITING_ENABLED
1751                 sctp_auditing(4, inp, stcb, net);
1752 #endif
1753                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1754                 break;
1755         case SCTP_TIMER_TYPE_PRIM_DELETED:
1756                 if ((stcb == NULL) || (inp == NULL)) {
1757                         break;
1758                 }
1759                 sctp_delete_prim_timer(inp, stcb, net);
1760                 SCTP_STAT_INCR(sctps_timodelprim);
1761                 break;
1762
1763         case SCTP_TIMER_TYPE_AUTOCLOSE:
1764                 if ((stcb == NULL) || (inp == NULL)) {
1765                         break;
1766                 }
1767                 SCTP_STAT_INCR(sctps_timoautoclose);
1768                 sctp_autoclose_timer(inp, stcb, net);
1769                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1770                 did_output = 0;
1771                 break;
1772         case SCTP_TIMER_TYPE_ASOCKILL:
1773                 if ((stcb == NULL) || (inp == NULL)) {
1774                         break;
1775                 }
1776                 SCTP_STAT_INCR(sctps_timoassockill);
1777                 /* Can we free it yet? */
1778                 SCTP_INP_DECR_REF(inp);
1779                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1780 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1781                 so = SCTP_INP_SO(inp);
1782                 atomic_add_int(&stcb->asoc.refcnt, 1);
1783                 SCTP_TCB_UNLOCK(stcb);
1784                 SCTP_SOCKET_LOCK(so, 1);
1785                 SCTP_TCB_LOCK(stcb);
1786                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1787 #endif
1788                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1789 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1790                 SCTP_SOCKET_UNLOCK(so, 1);
1791 #endif
1792                 /*
1793                  * free asoc, always unlocks (or destroy's) so prevent
1794                  * duplicate unlock or unlock of a free mtx :-0
1795                  */
1796                 stcb = NULL;
1797                 goto out_no_decr;
1798         case SCTP_TIMER_TYPE_INPKILL:
1799                 SCTP_STAT_INCR(sctps_timoinpkill);
1800                 if (inp == NULL) {
1801                         break;
1802                 }
1803                 /*
1804                  * special case, take away our increment since WE are the
1805                  * killer
1806                  */
1807                 SCTP_INP_DECR_REF(inp);
1808                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1809                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1810                     SCTP_CALLED_FROM_INPKILL_TIMER);
1811                 inp = NULL;
1812                 goto out_no_decr;
1813         default:
1814                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1815                     tmr->type);
1816                 break;
1817         }
1818 #ifdef SCTP_AUDITING_ENABLED
1819         sctp_audit_log(0xF1, (uint8_t) tmr->type);
1820         if (inp)
1821                 sctp_auditing(5, inp, stcb, net);
1822 #endif
1823         if ((did_output) && stcb) {
1824                 /*
1825                  * Now we need to clean up the control chunk chain if an
1826                  * ECNE is on it. It must be marked as UNSENT again so next
1827                  * call will continue to send it until such time that we get
1828                  * a CWR, to remove it. It is, however, less likely that we
1829                  * will find a ecn echo on the chain though.
1830                  */
1831                 sctp_fix_ecn_echo(&stcb->asoc);
1832         }
1833 get_out:
1834         if (stcb) {
1835                 SCTP_TCB_UNLOCK(stcb);
1836         }
1837 out_decr:
1838         if (inp) {
1839                 SCTP_INP_DECR_REF(inp);
1840         }
1841 out_no_decr:
1842         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type %d)\n",
1843             type);
1844         CURVNET_RESTORE();
1845 }
1846
1847 void
1848 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1849     struct sctp_nets *net)
1850 {
1851         uint32_t to_ticks;
1852         struct sctp_timer *tmr;
1853
1854         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1855                 return;
1856
1857         tmr = NULL;
1858         if (stcb) {
1859                 SCTP_TCB_LOCK_ASSERT(stcb);
1860         }
1861         switch (t_type) {
1862         case SCTP_TIMER_TYPE_ZERO_COPY:
1863                 tmr = &inp->sctp_ep.zero_copy_timer;
1864                 to_ticks = SCTP_ZERO_COPY_TICK_DELAY;
1865                 break;
1866         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1867                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
1868                 to_ticks = SCTP_ZERO_COPY_SENDQ_TICK_DELAY;
1869                 break;
1870         case SCTP_TIMER_TYPE_ADDR_WQ:
1871                 /* Only 1 tick away :-) */
1872                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
1873                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
1874                 break;
1875         case SCTP_TIMER_TYPE_SEND:
1876                 /* Here we use the RTO timer */
1877                 {
1878                         int rto_val;
1879
1880                         if ((stcb == NULL) || (net == NULL)) {
1881                                 return;
1882                         }
1883                         tmr = &net->rxt_timer;
1884                         if (net->RTO == 0) {
1885                                 rto_val = stcb->asoc.initial_rto;
1886                         } else {
1887                                 rto_val = net->RTO;
1888                         }
1889                         to_ticks = MSEC_TO_TICKS(rto_val);
1890                 }
1891                 break;
1892         case SCTP_TIMER_TYPE_INIT:
1893                 /*
1894                  * Here we use the INIT timer default usually about 1
1895                  * minute.
1896                  */
1897                 if ((stcb == NULL) || (net == NULL)) {
1898                         return;
1899                 }
1900                 tmr = &net->rxt_timer;
1901                 if (net->RTO == 0) {
1902                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1903                 } else {
1904                         to_ticks = MSEC_TO_TICKS(net->RTO);
1905                 }
1906                 break;
1907         case SCTP_TIMER_TYPE_RECV:
1908                 /*
1909                  * Here we use the Delayed-Ack timer value from the inp
1910                  * ususually about 200ms.
1911                  */
1912                 if (stcb == NULL) {
1913                         return;
1914                 }
1915                 tmr = &stcb->asoc.dack_timer;
1916                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
1917                 break;
1918         case SCTP_TIMER_TYPE_SHUTDOWN:
1919                 /* Here we use the RTO of the destination. */
1920                 if ((stcb == NULL) || (net == NULL)) {
1921                         return;
1922                 }
1923                 if (net->RTO == 0) {
1924                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1925                 } else {
1926                         to_ticks = MSEC_TO_TICKS(net->RTO);
1927                 }
1928                 tmr = &net->rxt_timer;
1929                 break;
1930         case SCTP_TIMER_TYPE_HEARTBEAT:
1931                 /*
1932                  * the net is used here so that we can add in the RTO. Even
1933                  * though we use a different timer. We also add the HB timer
1934                  * PLUS a random jitter.
1935                  */
1936                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
1937                         return;
1938                 } else {
1939                         uint32_t rndval;
1940                         uint32_t jitter;
1941
1942                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
1943                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
1944                                 return;
1945                         }
1946                         if (net->RTO == 0) {
1947                                 to_ticks = stcb->asoc.initial_rto;
1948                         } else {
1949                                 to_ticks = net->RTO;
1950                         }
1951                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
1952                         jitter = rndval % to_ticks;
1953                         if (jitter >= (to_ticks >> 1)) {
1954                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
1955                         } else {
1956                                 to_ticks = to_ticks - jitter;
1957                         }
1958                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1959                             !(net->dest_state & SCTP_ADDR_PF)) {
1960                                 to_ticks += net->heart_beat_delay;
1961                         }
1962                         /*
1963                          * Now we must convert the to_ticks that are now in
1964                          * ms to ticks.
1965                          */
1966                         to_ticks = MSEC_TO_TICKS(to_ticks);
1967                         tmr = &net->hb_timer;
1968                 }
1969                 break;
1970         case SCTP_TIMER_TYPE_COOKIE:
1971                 /*
1972                  * Here we can use the RTO timer from the network since one
1973                  * RTT was compelete. If a retran happened then we will be
1974                  * using the RTO initial value.
1975                  */
1976                 if ((stcb == NULL) || (net == NULL)) {
1977                         return;
1978                 }
1979                 if (net->RTO == 0) {
1980                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1981                 } else {
1982                         to_ticks = MSEC_TO_TICKS(net->RTO);
1983                 }
1984                 tmr = &net->rxt_timer;
1985                 break;
1986         case SCTP_TIMER_TYPE_NEWCOOKIE:
1987                 /*
1988                  * nothing needed but the endpoint here ususually about 60
1989                  * minutes.
1990                  */
1991                 if (inp == NULL) {
1992                         return;
1993                 }
1994                 tmr = &inp->sctp_ep.signature_change;
1995                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
1996                 break;
1997         case SCTP_TIMER_TYPE_ASOCKILL:
1998                 if (stcb == NULL) {
1999                         return;
2000                 }
2001                 tmr = &stcb->asoc.strreset_timer;
2002                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2003                 break;
2004         case SCTP_TIMER_TYPE_INPKILL:
2005                 /*
2006                  * The inp is setup to die. We re-use the signature_chage
2007                  * timer since that has stopped and we are in the GONE
2008                  * state.
2009                  */
2010                 if (inp == NULL) {
2011                         return;
2012                 }
2013                 tmr = &inp->sctp_ep.signature_change;
2014                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2015                 break;
2016         case SCTP_TIMER_TYPE_PATHMTURAISE:
2017                 /*
2018                  * Here we use the value found in the EP for PMTU ususually
2019                  * about 10 minutes.
2020                  */
2021                 if ((stcb == NULL) || (inp == NULL)) {
2022                         return;
2023                 }
2024                 if (net == NULL) {
2025                         return;
2026                 }
2027                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2028                         return;
2029                 }
2030                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2031                 tmr = &net->pmtu_timer;
2032                 break;
2033         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2034                 /* Here we use the RTO of the destination */
2035                 if ((stcb == NULL) || (net == NULL)) {
2036                         return;
2037                 }
2038                 if (net->RTO == 0) {
2039                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2040                 } else {
2041                         to_ticks = MSEC_TO_TICKS(net->RTO);
2042                 }
2043                 tmr = &net->rxt_timer;
2044                 break;
2045         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2046                 /*
2047                  * Here we use the endpoints shutdown guard timer usually
2048                  * about 3 minutes.
2049                  */
2050                 if ((inp == NULL) || (stcb == NULL)) {
2051                         return;
2052                 }
2053                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2054                 tmr = &stcb->asoc.shut_guard_timer;
2055                 break;
2056         case SCTP_TIMER_TYPE_STRRESET:
2057                 /*
2058                  * Here the timer comes from the stcb but its value is from
2059                  * the net's RTO.
2060                  */
2061                 if ((stcb == NULL) || (net == NULL)) {
2062                         return;
2063                 }
2064                 if (net->RTO == 0) {
2065                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2066                 } else {
2067                         to_ticks = MSEC_TO_TICKS(net->RTO);
2068                 }
2069                 tmr = &stcb->asoc.strreset_timer;
2070                 break;
2071         case SCTP_TIMER_TYPE_ASCONF:
2072                 /*
2073                  * Here the timer comes from the stcb but its value is from
2074                  * the net's RTO.
2075                  */
2076                 if ((stcb == NULL) || (net == NULL)) {
2077                         return;
2078                 }
2079                 if (net->RTO == 0) {
2080                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2081                 } else {
2082                         to_ticks = MSEC_TO_TICKS(net->RTO);
2083                 }
2084                 tmr = &stcb->asoc.asconf_timer;
2085                 break;
2086         case SCTP_TIMER_TYPE_PRIM_DELETED:
2087                 if ((stcb == NULL) || (net != NULL)) {
2088                         return;
2089                 }
2090                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2091                 tmr = &stcb->asoc.delete_prim_timer;
2092                 break;
2093         case SCTP_TIMER_TYPE_AUTOCLOSE:
2094                 if (stcb == NULL) {
2095                         return;
2096                 }
2097                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2098                         /*
2099                          * Really an error since stcb is NOT set to
2100                          * autoclose
2101                          */
2102                         return;
2103                 }
2104                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2105                 tmr = &stcb->asoc.autoclose_timer;
2106                 break;
2107         default:
2108                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2109                     __FUNCTION__, t_type);
2110                 return;
2111                 break;
2112         }
2113         if ((to_ticks <= 0) || (tmr == NULL)) {
2114                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2115                     __FUNCTION__, t_type, to_ticks, tmr);
2116                 return;
2117         }
2118         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2119                 /*
2120                  * we do NOT allow you to have it already running. if it is
2121                  * we leave the current one up unchanged
2122                  */
2123                 return;
2124         }
2125         /* At this point we can proceed */
2126         if (t_type == SCTP_TIMER_TYPE_SEND) {
2127                 stcb->asoc.num_send_timers_up++;
2128         }
2129         tmr->stopped_from = 0;
2130         tmr->type = t_type;
2131         tmr->ep = (void *)inp;
2132         tmr->tcb = (void *)stcb;
2133         tmr->net = (void *)net;
2134         tmr->self = (void *)tmr;
2135         tmr->vnet = (void *)curvnet;
2136         tmr->ticks = sctp_get_tick_count();
2137         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2138         return;
2139 }
2140
2141 void
2142 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2143     struct sctp_nets *net, uint32_t from)
2144 {
2145         struct sctp_timer *tmr;
2146
2147         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2148             (inp == NULL))
2149                 return;
2150
2151         tmr = NULL;
2152         if (stcb) {
2153                 SCTP_TCB_LOCK_ASSERT(stcb);
2154         }
2155         switch (t_type) {
2156         case SCTP_TIMER_TYPE_ZERO_COPY:
2157                 tmr = &inp->sctp_ep.zero_copy_timer;
2158                 break;
2159         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
2160                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
2161                 break;
2162         case SCTP_TIMER_TYPE_ADDR_WQ:
2163                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2164                 break;
2165         case SCTP_TIMER_TYPE_SEND:
2166                 if ((stcb == NULL) || (net == NULL)) {
2167                         return;
2168                 }
2169                 tmr = &net->rxt_timer;
2170                 break;
2171         case SCTP_TIMER_TYPE_INIT:
2172                 if ((stcb == NULL) || (net == NULL)) {
2173                         return;
2174                 }
2175                 tmr = &net->rxt_timer;
2176                 break;
2177         case SCTP_TIMER_TYPE_RECV:
2178                 if (stcb == NULL) {
2179                         return;
2180                 }
2181                 tmr = &stcb->asoc.dack_timer;
2182                 break;
2183         case SCTP_TIMER_TYPE_SHUTDOWN:
2184                 if ((stcb == NULL) || (net == NULL)) {
2185                         return;
2186                 }
2187                 tmr = &net->rxt_timer;
2188                 break;
2189         case SCTP_TIMER_TYPE_HEARTBEAT:
2190                 if ((stcb == NULL) || (net == NULL)) {
2191                         return;
2192                 }
2193                 tmr = &net->hb_timer;
2194                 break;
2195         case SCTP_TIMER_TYPE_COOKIE:
2196                 if ((stcb == NULL) || (net == NULL)) {
2197                         return;
2198                 }
2199                 tmr = &net->rxt_timer;
2200                 break;
2201         case SCTP_TIMER_TYPE_NEWCOOKIE:
2202                 /* nothing needed but the endpoint here */
2203                 tmr = &inp->sctp_ep.signature_change;
2204                 /*
2205                  * We re-use the newcookie timer for the INP kill timer. We
2206                  * must assure that we do not kill it by accident.
2207                  */
2208                 break;
2209         case SCTP_TIMER_TYPE_ASOCKILL:
2210                 /*
2211                  * Stop the asoc kill timer.
2212                  */
2213                 if (stcb == NULL) {
2214                         return;
2215                 }
2216                 tmr = &stcb->asoc.strreset_timer;
2217                 break;
2218
2219         case SCTP_TIMER_TYPE_INPKILL:
2220                 /*
2221                  * The inp is setup to die. We re-use the signature_chage
2222                  * timer since that has stopped and we are in the GONE
2223                  * state.
2224                  */
2225                 tmr = &inp->sctp_ep.signature_change;
2226                 break;
2227         case SCTP_TIMER_TYPE_PATHMTURAISE:
2228                 if ((stcb == NULL) || (net == NULL)) {
2229                         return;
2230                 }
2231                 tmr = &net->pmtu_timer;
2232                 break;
2233         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2234                 if ((stcb == NULL) || (net == NULL)) {
2235                         return;
2236                 }
2237                 tmr = &net->rxt_timer;
2238                 break;
2239         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2240                 if (stcb == NULL) {
2241                         return;
2242                 }
2243                 tmr = &stcb->asoc.shut_guard_timer;
2244                 break;
2245         case SCTP_TIMER_TYPE_STRRESET:
2246                 if (stcb == NULL) {
2247                         return;
2248                 }
2249                 tmr = &stcb->asoc.strreset_timer;
2250                 break;
2251         case SCTP_TIMER_TYPE_ASCONF:
2252                 if (stcb == NULL) {
2253                         return;
2254                 }
2255                 tmr = &stcb->asoc.asconf_timer;
2256                 break;
2257         case SCTP_TIMER_TYPE_PRIM_DELETED:
2258                 if (stcb == NULL) {
2259                         return;
2260                 }
2261                 tmr = &stcb->asoc.delete_prim_timer;
2262                 break;
2263         case SCTP_TIMER_TYPE_AUTOCLOSE:
2264                 if (stcb == NULL) {
2265                         return;
2266                 }
2267                 tmr = &stcb->asoc.autoclose_timer;
2268                 break;
2269         default:
2270                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2271                     __FUNCTION__, t_type);
2272                 break;
2273         }
2274         if (tmr == NULL) {
2275                 return;
2276         }
2277         if ((tmr->type != t_type) && tmr->type) {
2278                 /*
2279                  * Ok we have a timer that is under joint use. Cookie timer
2280                  * per chance with the SEND timer. We therefore are NOT
2281                  * running the timer that the caller wants stopped.  So just
2282                  * return.
2283                  */
2284                 return;
2285         }
2286         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2287                 stcb->asoc.num_send_timers_up--;
2288                 if (stcb->asoc.num_send_timers_up < 0) {
2289                         stcb->asoc.num_send_timers_up = 0;
2290                 }
2291         }
2292         tmr->self = NULL;
2293         tmr->stopped_from = from;
2294         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2295         return;
2296 }
2297
2298 uint32_t
2299 sctp_calculate_len(struct mbuf *m)
2300 {
2301         uint32_t tlen = 0;
2302         struct mbuf *at;
2303
2304         at = m;
2305         while (at) {
2306                 tlen += SCTP_BUF_LEN(at);
2307                 at = SCTP_BUF_NEXT(at);
2308         }
2309         return (tlen);
2310 }
2311
2312 void
2313 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2314     struct sctp_association *asoc, uint32_t mtu)
2315 {
2316         /*
2317          * Reset the P-MTU size on this association, this involves changing
2318          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2319          * allow the DF flag to be cleared.
2320          */
2321         struct sctp_tmit_chunk *chk;
2322         unsigned int eff_mtu, ovh;
2323
2324         asoc->smallest_mtu = mtu;
2325         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2326                 ovh = SCTP_MIN_OVERHEAD;
2327         } else {
2328                 ovh = SCTP_MIN_V4_OVERHEAD;
2329         }
2330         eff_mtu = mtu - ovh;
2331         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2332                 if (chk->send_size > eff_mtu) {
2333                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2334                 }
2335         }
2336         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2337                 if (chk->send_size > eff_mtu) {
2338                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2339                 }
2340         }
2341 }
2342
2343
2344 /*
2345  * given an association and starting time of the current RTT period return
2346  * RTO in number of msecs net should point to the current network
2347  */
2348
2349 uint32_t
2350 sctp_calculate_rto(struct sctp_tcb *stcb,
2351     struct sctp_association *asoc,
2352     struct sctp_nets *net,
2353     struct timeval *told,
2354     int safe, int rtt_from_sack)
2355 {
2356         /*-
2357          * given an association and the starting time of the current RTT
2358          * period (in value1/value2) return RTO in number of msecs.
2359          */
2360         int32_t rtt;            /* RTT in ms */
2361         uint32_t new_rto;
2362         int first_measure = 0;
2363         struct timeval now, then, *old;
2364
2365         /* Copy it out for sparc64 */
2366         if (safe == sctp_align_unsafe_makecopy) {
2367                 old = &then;
2368                 memcpy(&then, told, sizeof(struct timeval));
2369         } else if (safe == sctp_align_safe_nocopy) {
2370                 old = told;
2371         } else {
2372                 /* error */
2373                 SCTP_PRINTF("Huh, bad rto calc call\n");
2374                 return (0);
2375         }
2376         /************************/
2377         /* 1. calculate new RTT */
2378         /************************/
2379         /* get the current time */
2380         if (stcb->asoc.use_precise_time) {
2381                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2382         } else {
2383                 (void)SCTP_GETTIME_TIMEVAL(&now);
2384         }
2385         timevalsub(&now, old);
2386         /* store the current RTT in us */
2387         net->rtt = (uint64_t) 1000000 *(uint64_t) now.tv_sec +
2388                  (uint64_t) now.tv_usec;
2389
2390         /* computer rtt in ms */
2391         rtt = net->rtt / 1000;
2392         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2393                 /*
2394                  * Tell the CC module that a new update has just occurred
2395                  * from a sack
2396                  */
2397                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2398         }
2399         /*
2400          * Do we need to determine the lan? We do this only on sacks i.e.
2401          * RTT being determined from data not non-data (HB/INIT->INITACK).
2402          */
2403         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2404             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2405                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2406                         net->lan_type = SCTP_LAN_INTERNET;
2407                 } else {
2408                         net->lan_type = SCTP_LAN_LOCAL;
2409                 }
2410         }
2411         /***************************/
2412         /* 2. update RTTVAR & SRTT */
2413         /***************************/
2414         /*-
2415          * Compute the scaled average lastsa and the
2416          * scaled variance lastsv as described in van Jacobson
2417          * Paper "Congestion Avoidance and Control", Annex A.
2418          *
2419          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2420          * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar
2421          */
2422         if (net->RTO_measured) {
2423                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2424                 net->lastsa += rtt;
2425                 if (rtt < 0) {
2426                         rtt = -rtt;
2427                 }
2428                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2429                 net->lastsv += rtt;
2430                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2431                         rto_logging(net, SCTP_LOG_RTTVAR);
2432                 }
2433         } else {
2434                 /* First RTO measurment */
2435                 net->RTO_measured = 1;
2436                 first_measure = 1;
2437                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2438                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2439                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2440                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2441                 }
2442         }
2443         if (net->lastsv == 0) {
2444                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2445         }
2446         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2447         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2448             (stcb->asoc.sat_network_lockout == 0)) {
2449                 stcb->asoc.sat_network = 1;
2450         } else if ((!first_measure) && stcb->asoc.sat_network) {
2451                 stcb->asoc.sat_network = 0;
2452                 stcb->asoc.sat_network_lockout = 1;
2453         }
2454         /* bound it, per C6/C7 in Section 5.3.1 */
2455         if (new_rto < stcb->asoc.minrto) {
2456                 new_rto = stcb->asoc.minrto;
2457         }
2458         if (new_rto > stcb->asoc.maxrto) {
2459                 new_rto = stcb->asoc.maxrto;
2460         }
2461         /* we are now returning the RTO */
2462         return (new_rto);
2463 }
2464
2465 /*
2466  * return a pointer to a contiguous piece of data from the given mbuf chain
2467  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2468  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2469  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2470  */
2471 caddr_t
2472 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
2473 {
2474         uint32_t count;
2475         uint8_t *ptr;
2476
2477         ptr = in_ptr;
2478         if ((off < 0) || (len <= 0))
2479                 return (NULL);
2480
2481         /* find the desired start location */
2482         while ((m != NULL) && (off > 0)) {
2483                 if (off < SCTP_BUF_LEN(m))
2484                         break;
2485                 off -= SCTP_BUF_LEN(m);
2486                 m = SCTP_BUF_NEXT(m);
2487         }
2488         if (m == NULL)
2489                 return (NULL);
2490
2491         /* is the current mbuf large enough (eg. contiguous)? */
2492         if ((SCTP_BUF_LEN(m) - off) >= len) {
2493                 return (mtod(m, caddr_t)+off);
2494         } else {
2495                 /* else, it spans more than one mbuf, so save a temp copy... */
2496                 while ((m != NULL) && (len > 0)) {
2497                         count = min(SCTP_BUF_LEN(m) - off, len);
2498                         bcopy(mtod(m, caddr_t)+off, ptr, count);
2499                         len -= count;
2500                         ptr += count;
2501                         off = 0;
2502                         m = SCTP_BUF_NEXT(m);
2503                 }
2504                 if ((m == NULL) && (len > 0))
2505                         return (NULL);
2506                 else
2507                         return ((caddr_t)in_ptr);
2508         }
2509 }
2510
2511
2512
2513 struct sctp_paramhdr *
2514 sctp_get_next_param(struct mbuf *m,
2515     int offset,
2516     struct sctp_paramhdr *pull,
2517     int pull_limit)
2518 {
2519         /* This just provides a typed signature to Peter's Pull routine */
2520         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2521             (uint8_t *) pull));
2522 }
2523
2524
2525 int
2526 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2527 {
2528         /*
2529          * add padlen bytes of 0 filled padding to the end of the mbuf. If
2530          * padlen is > 3 this routine will fail.
2531          */
2532         uint8_t *dp;
2533         int i;
2534
2535         if (padlen > 3) {
2536                 SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
2537                 return (ENOBUFS);
2538         }
2539         if (padlen <= M_TRAILINGSPACE(m)) {
2540                 /*
2541                  * The easy way. We hope the majority of the time we hit
2542                  * here :)
2543                  */
2544                 dp = (uint8_t *) (mtod(m, caddr_t)+SCTP_BUF_LEN(m));
2545                 SCTP_BUF_LEN(m) += padlen;
2546         } else {
2547                 /* Hard way we must grow the mbuf */
2548                 struct mbuf *tmp;
2549
2550                 tmp = sctp_get_mbuf_for_msg(padlen, 0, M_DONTWAIT, 1, MT_DATA);
2551                 if (tmp == NULL) {
2552                         /* Out of space GAK! we are in big trouble. */
2553                         SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
2554                         return (ENOBUFS);
2555                 }
2556                 /* setup and insert in middle */
2557                 SCTP_BUF_LEN(tmp) = padlen;
2558                 SCTP_BUF_NEXT(tmp) = NULL;
2559                 SCTP_BUF_NEXT(m) = tmp;
2560                 dp = mtod(tmp, uint8_t *);
2561         }
2562         /* zero out the pad */
2563         for (i = 0; i < padlen; i++) {
2564                 *dp = 0;
2565                 dp++;
2566         }
2567         return (0);
2568 }
2569
2570 int
2571 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2572 {
2573         /* find the last mbuf in chain and pad it */
2574         struct mbuf *m_at;
2575
2576         if (last_mbuf) {
2577                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2578         } else {
2579                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
2580                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2581                                 return (sctp_add_pad_tombuf(m_at, padval));
2582                         }
2583                 }
2584         }
2585         SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
2586         return (EFAULT);
2587 }
2588
2589 static void
2590 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
2591     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
2592 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2593     SCTP_UNUSED
2594 #endif
2595 )
2596 {
2597         struct mbuf *m_notify;
2598         struct sctp_assoc_change *sac;
2599         struct sctp_queued_to_read *control;
2600         size_t notif_len, abort_len;
2601         unsigned int i;
2602
2603 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2604         struct socket *so;
2605
2606 #endif
2607
2608         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2609                 notif_len = sizeof(struct sctp_assoc_change);
2610                 if (abort != NULL) {
2611                         abort_len = htons(abort->ch.chunk_length);
2612                 } else {
2613                         abort_len = 0;
2614                 }
2615                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2616                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
2617                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2618                         notif_len += abort_len;
2619                 }
2620                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_DONTWAIT, 1, MT_DATA);
2621                 if (m_notify == NULL) {
2622                         /* Retry with smaller value. */
2623                         notif_len = sizeof(struct sctp_assoc_change);
2624                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_DONTWAIT, 1, MT_DATA);
2625                         if (m_notify == NULL) {
2626                                 goto set_error;
2627                         }
2628                 }
2629                 SCTP_BUF_NEXT(m_notify) = NULL;
2630                 sac = mtod(m_notify, struct sctp_assoc_change *);
2631                 memset(sac, 0, notif_len);
2632                 sac->sac_type = SCTP_ASSOC_CHANGE;
2633                 sac->sac_flags = 0;
2634                 sac->sac_length = sizeof(struct sctp_assoc_change);
2635                 sac->sac_state = state;
2636                 sac->sac_error = error;
2637                 /* XXX verify these stream counts */
2638                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2639                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
2640                 sac->sac_assoc_id = sctp_get_associd(stcb);
2641                 if (notif_len > sizeof(struct sctp_assoc_change)) {
2642                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2643                                 i = 0;
2644                                 if (stcb->asoc.peer_supports_prsctp) {
2645                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2646                                 }
2647                                 if (stcb->asoc.peer_supports_auth) {
2648                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2649                                 }
2650                                 if (stcb->asoc.peer_supports_asconf) {
2651                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2652                                 }
2653                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2654                                 if (stcb->asoc.peer_supports_strreset) {
2655                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2656                                 }
2657                                 sac->sac_length += i;
2658                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2659                                 memcpy(sac->sac_info, abort, abort_len);
2660                                 sac->sac_length += abort_len;
2661                         }
2662                 }
2663                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
2664                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2665                     0, 0, stcb->asoc.context, 0, 0, 0,
2666                     m_notify);
2667                 if (control != NULL) {
2668                         control->length = SCTP_BUF_LEN(m_notify);
2669                         /* not that we need this */
2670                         control->tail_mbuf = m_notify;
2671                         control->spec_flags = M_NOTIFICATION;
2672                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2673                             control,
2674                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2675                             so_locked);
2676                 } else {
2677                         sctp_m_freem(m_notify);
2678                 }
2679         }
2680         /*
2681          * For 1-to-1 style sockets, we send up and error when an ABORT
2682          * comes in.
2683          */
2684 set_error:
2685         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2686             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2687             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2688                 if (from_peer) {
2689                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
2690                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2691                                 stcb->sctp_socket->so_error = ECONNREFUSED;
2692                         } else {
2693                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2694                                 stcb->sctp_socket->so_error = ECONNRESET;
2695                         }
2696                 } else {
2697                         SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
2698                         stcb->sctp_socket->so_error = ECONNABORTED;
2699                 }
2700         }
2701         /* Wake ANY sleepers */
2702 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2703         so = SCTP_INP_SO(stcb->sctp_ep);
2704         if (!so_locked) {
2705                 atomic_add_int(&stcb->asoc.refcnt, 1);
2706                 SCTP_TCB_UNLOCK(stcb);
2707                 SCTP_SOCKET_LOCK(so, 1);
2708                 SCTP_TCB_LOCK(stcb);
2709                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2710                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2711                         SCTP_SOCKET_UNLOCK(so, 1);
2712                         return;
2713                 }
2714         }
2715 #endif
2716         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2717             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2718             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2719                 socantrcvmore(stcb->sctp_socket);
2720         }
2721         sorwakeup(stcb->sctp_socket);
2722         sowwakeup(stcb->sctp_socket);
2723 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2724         if (!so_locked) {
2725                 SCTP_SOCKET_UNLOCK(so, 1);
2726         }
2727 #endif
2728 }
2729
2730 static void
2731 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2732     struct sockaddr *sa, uint32_t error)
2733 {
2734         struct mbuf *m_notify;
2735         struct sctp_paddr_change *spc;
2736         struct sctp_queued_to_read *control;
2737
2738         if ((stcb == NULL) ||
2739             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2740                 /* event not enabled */
2741                 return;
2742         }
2743         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_DONTWAIT, 1, MT_DATA);
2744         if (m_notify == NULL)
2745                 return;
2746         SCTP_BUF_LEN(m_notify) = 0;
2747         spc = mtod(m_notify, struct sctp_paddr_change *);
2748         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2749         spc->spc_flags = 0;
2750         spc->spc_length = sizeof(struct sctp_paddr_change);
2751         switch (sa->sa_family) {
2752 #ifdef INET
2753         case AF_INET:
2754                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2755                 break;
2756 #endif
2757 #ifdef INET6
2758         case AF_INET6:
2759                 {
2760                         struct sockaddr_in6 *sin6;
2761
2762                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2763
2764                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2765                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2766                                 if (sin6->sin6_scope_id == 0) {
2767                                         /* recover scope_id for user */
2768                                         (void)sa6_recoverscope(sin6);
2769                                 } else {
2770                                         /* clear embedded scope_id for user */
2771                                         in6_clearscope(&sin6->sin6_addr);
2772                                 }
2773                         }
2774                         break;
2775                 }
2776 #endif
2777         default:
2778                 /* TSNH */
2779                 break;
2780         }
2781         spc->spc_state = state;
2782         spc->spc_error = error;
2783         spc->spc_assoc_id = sctp_get_associd(stcb);
2784
2785         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2786         SCTP_BUF_NEXT(m_notify) = NULL;
2787
2788         /* append to socket */
2789         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2790             0, 0, stcb->asoc.context, 0, 0, 0,
2791             m_notify);
2792         if (control == NULL) {
2793                 /* no memory */
2794                 sctp_m_freem(m_notify);
2795                 return;
2796         }
2797         control->length = SCTP_BUF_LEN(m_notify);
2798         control->spec_flags = M_NOTIFICATION;
2799         /* not that we need this */
2800         control->tail_mbuf = m_notify;
2801         sctp_add_to_readq(stcb->sctp_ep, stcb,
2802             control,
2803             &stcb->sctp_socket->so_rcv, 1,
2804             SCTP_READ_LOCK_NOT_HELD,
2805             SCTP_SO_NOT_LOCKED);
2806 }
2807
2808
2809 static void
2810 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
2811     struct sctp_tmit_chunk *chk, int so_locked
2812 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2813     SCTP_UNUSED
2814 #endif
2815 )
2816 {
2817         struct mbuf *m_notify;
2818         struct sctp_send_failed *ssf;
2819         struct sctp_send_failed_event *ssfe;
2820         struct sctp_queued_to_read *control;
2821         int length;
2822
2823         if ((stcb == NULL) ||
2824             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2825             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2826                 /* event not enabled */
2827                 return;
2828         }
2829         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2830                 length = sizeof(struct sctp_send_failed_event);
2831         } else {
2832                 length = sizeof(struct sctp_send_failed);
2833         }
2834         m_notify = sctp_get_mbuf_for_msg(length, 0, M_DONTWAIT, 1, MT_DATA);
2835         if (m_notify == NULL)
2836                 /* no space left */
2837                 return;
2838         SCTP_BUF_LEN(m_notify) = 0;
2839         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2840                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2841                 memset(ssfe, 0, length);
2842                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2843                 if (sent) {
2844                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2845                 } else {
2846                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2847                 }
2848                 length += chk->send_size;
2849                 length -= sizeof(struct sctp_data_chunk);
2850                 ssfe->ssfe_length = length;
2851                 ssfe->ssfe_error = error;
2852                 /* not exactly what the user sent in, but should be close :) */
2853                 ssfe->ssfe_info.snd_sid = chk->rec.data.stream_number;
2854                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
2855                 ssfe->ssfe_info.snd_ppid = chk->rec.data.payloadtype;
2856                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
2857                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2858                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2859                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event);
2860         } else {
2861                 ssf = mtod(m_notify, struct sctp_send_failed *);
2862                 memset(ssf, 0, length);
2863                 ssf->ssf_type = SCTP_SEND_FAILED;
2864                 if (sent) {
2865                         ssf->ssf_flags = SCTP_DATA_SENT;
2866                 } else {
2867                         ssf->ssf_flags = SCTP_DATA_UNSENT;
2868                 }
2869                 length += chk->send_size;
2870                 length -= sizeof(struct sctp_data_chunk);
2871                 ssf->ssf_length = length;
2872                 ssf->ssf_error = error;
2873                 /* not exactly what the user sent in, but should be close :) */
2874                 bzero(&ssf->ssf_info, sizeof(ssf->ssf_info));
2875                 ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number;
2876                 ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq;
2877                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2878                 ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype;
2879                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
2880                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2881                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2882                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
2883         }
2884         if (chk->data) {
2885                 /*
2886                  * trim off the sctp chunk header(it should be there)
2887                  */
2888                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
2889                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
2890                         sctp_mbuf_crush(chk->data);
2891                         chk->send_size -= sizeof(struct sctp_data_chunk);
2892                 }
2893         }
2894         SCTP_BUF_NEXT(m_notify) = chk->data;
2895         /* Steal off the mbuf */
2896         chk->data = NULL;
2897         /*
2898          * For this case, we check the actual socket buffer, since the assoc
2899          * is going away we don't want to overfill the socket buffer for a
2900          * non-reader
2901          */
2902         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
2903                 sctp_m_freem(m_notify);
2904                 return;
2905         }
2906         /* append to socket */
2907         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2908             0, 0, stcb->asoc.context, 0, 0, 0,
2909             m_notify);
2910         if (control == NULL) {
2911                 /* no memory */
2912                 sctp_m_freem(m_notify);
2913                 return;
2914         }
2915         control->spec_flags = M_NOTIFICATION;
2916         sctp_add_to_readq(stcb->sctp_ep, stcb,
2917             control,
2918             &stcb->sctp_socket->so_rcv, 1,
2919             SCTP_READ_LOCK_NOT_HELD,
2920             so_locked);
2921 }
2922
2923
2924 static void
2925 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
2926     struct sctp_stream_queue_pending *sp, int so_locked
2927 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2928     SCTP_UNUSED
2929 #endif
2930 )
2931 {
2932         struct mbuf *m_notify;
2933         struct sctp_send_failed *ssf;
2934         struct sctp_send_failed_event *ssfe;
2935         struct sctp_queued_to_read *control;
2936         int length;
2937
2938         if ((stcb == NULL) ||
2939             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2940             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2941                 /* event not enabled */
2942                 return;
2943         }
2944         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2945                 length = sizeof(struct sctp_send_failed_event);
2946         } else {
2947                 length = sizeof(struct sctp_send_failed);
2948         }
2949         m_notify = sctp_get_mbuf_for_msg(length, 0, M_DONTWAIT, 1, MT_DATA);
2950         if (m_notify == NULL) {
2951                 /* no space left */
2952                 return;
2953         }
2954         SCTP_BUF_LEN(m_notify) = 0;
2955         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2956                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2957                 memset(ssfe, 0, length);
2958                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2959                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2960                 length += sp->length;
2961                 ssfe->ssfe_length = length;
2962                 ssfe->ssfe_error = error;
2963                 /* not exactly what the user sent in, but should be close :) */
2964                 ssfe->ssfe_info.snd_sid = sp->stream;
2965                 if (sp->some_taken) {
2966                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
2967                 } else {
2968                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
2969                 }
2970                 ssfe->ssfe_info.snd_ppid = sp->ppid;
2971                 ssfe->ssfe_info.snd_context = sp->context;
2972                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2973                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2974                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event);
2975         } else {
2976                 ssf = mtod(m_notify, struct sctp_send_failed *);
2977                 memset(ssf, 0, length);
2978                 ssf->ssf_type = SCTP_SEND_FAILED;
2979                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2980                 length += sp->length;
2981                 ssf->ssf_length = length;
2982                 ssf->ssf_error = error;
2983                 /* not exactly what the user sent in, but should be close :) */
2984                 ssf->ssf_info.sinfo_stream = sp->stream;
2985                 ssf->ssf_info.sinfo_ssn = sp->strseq;
2986                 if (sp->some_taken) {
2987                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
2988                 } else {
2989                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
2990                 }
2991                 ssf->ssf_info.sinfo_ppid = sp->ppid;
2992                 ssf->ssf_info.sinfo_context = sp->context;
2993                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2994                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2995                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
2996         }
2997         SCTP_BUF_NEXT(m_notify) = sp->data;
2998
2999         /* Steal off the mbuf */
3000         sp->data = NULL;
3001         /*
3002          * For this case, we check the actual socket buffer, since the assoc
3003          * is going away we don't want to overfill the socket buffer for a
3004          * non-reader
3005          */
3006         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3007                 sctp_m_freem(m_notify);
3008                 return;
3009         }
3010         /* append to socket */
3011         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3012             0, 0, stcb->asoc.context, 0, 0, 0,
3013             m_notify);
3014         if (control == NULL) {
3015                 /* no memory */
3016                 sctp_m_freem(m_notify);
3017                 return;
3018         }
3019         control->spec_flags = M_NOTIFICATION;
3020         sctp_add_to_readq(stcb->sctp_ep, stcb,
3021             control,
3022             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3023 }
3024
3025
3026
3027 static void
3028 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3029 {
3030         struct mbuf *m_notify;
3031         struct sctp_adaptation_event *sai;
3032         struct sctp_queued_to_read *control;
3033
3034         if ((stcb == NULL) ||
3035             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3036                 /* event not enabled */
3037                 return;
3038         }
3039         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_DONTWAIT, 1, MT_DATA);
3040         if (m_notify == NULL)
3041                 /* no space left */
3042                 return;
3043         SCTP_BUF_LEN(m_notify) = 0;
3044         sai = mtod(m_notify, struct sctp_adaptation_event *);
3045         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3046         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3047         sai->sai_flags = 0;
3048         sai->sai_length = sizeof(struct sctp_adaptation_event);
3049         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3050         sai->sai_assoc_id = sctp_get_associd(stcb);
3051
3052         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3053         SCTP_BUF_NEXT(m_notify) = NULL;
3054
3055         /* append to socket */
3056         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3057             0, 0, stcb->asoc.context, 0, 0, 0,
3058             m_notify);
3059         if (control == NULL) {
3060                 /* no memory */
3061                 sctp_m_freem(m_notify);
3062                 return;
3063         }
3064         control->length = SCTP_BUF_LEN(m_notify);
3065         control->spec_flags = M_NOTIFICATION;
3066         /* not that we need this */
3067         control->tail_mbuf = m_notify;
3068         sctp_add_to_readq(stcb->sctp_ep, stcb,
3069             control,
3070             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3071 }
3072
3073 /* This always must be called with the read-queue LOCKED in the INP */
3074 static void
3075 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3076     uint32_t val, int so_locked
3077 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3078     SCTP_UNUSED
3079 #endif
3080 )
3081 {
3082         struct mbuf *m_notify;
3083         struct sctp_pdapi_event *pdapi;
3084         struct sctp_queued_to_read *control;
3085         struct sockbuf *sb;
3086
3087         if ((stcb == NULL) ||
3088             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3089                 /* event not enabled */
3090                 return;
3091         }
3092         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3093                 return;
3094         }
3095         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_DONTWAIT, 1, MT_DATA);
3096         if (m_notify == NULL)
3097                 /* no space left */
3098                 return;
3099         SCTP_BUF_LEN(m_notify) = 0;
3100         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3101         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3102         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3103         pdapi->pdapi_flags = 0;
3104         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3105         pdapi->pdapi_indication = error;
3106         pdapi->pdapi_stream = (val >> 16);
3107         pdapi->pdapi_seq = (val & 0x0000ffff);
3108         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3109
3110         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3111         SCTP_BUF_NEXT(m_notify) = NULL;
3112         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3113             0, 0, stcb->asoc.context, 0, 0, 0,
3114             m_notify);
3115         if (control == NULL) {
3116                 /* no memory */
3117                 sctp_m_freem(m_notify);
3118                 return;
3119         }
3120         control->spec_flags = M_NOTIFICATION;
3121         control->length = SCTP_BUF_LEN(m_notify);
3122         /* not that we need this */
3123         control->tail_mbuf = m_notify;
3124         control->held_length = 0;
3125         control->length = 0;
3126         sb = &stcb->sctp_socket->so_rcv;
3127         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3128                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3129         }
3130         sctp_sballoc(stcb, sb, m_notify);
3131         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3132                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3133         }
3134         atomic_add_int(&control->length, SCTP_BUF_LEN(m_notify));
3135         control->end_added = 1;
3136         if (stcb->asoc.control_pdapi)
3137                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3138         else {
3139                 /* we really should not see this case */
3140                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3141         }
3142         if (stcb->sctp_ep && stcb->sctp_socket) {
3143                 /* This should always be the case */
3144 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3145                 struct socket *so;
3146
3147                 so = SCTP_INP_SO(stcb->sctp_ep);
3148                 if (!so_locked) {
3149                         atomic_add_int(&stcb->asoc.refcnt, 1);
3150                         SCTP_TCB_UNLOCK(stcb);
3151                         SCTP_SOCKET_LOCK(so, 1);
3152                         SCTP_TCB_LOCK(stcb);
3153                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3154                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3155                                 SCTP_SOCKET_UNLOCK(so, 1);
3156                                 return;
3157                         }
3158                 }
3159 #endif
3160                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3161 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3162                 if (!so_locked) {
3163                         SCTP_SOCKET_UNLOCK(so, 1);
3164                 }
3165 #endif
3166         }
3167 }
3168
3169 static void
3170 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3171 {
3172         struct mbuf *m_notify;
3173         struct sctp_shutdown_event *sse;
3174         struct sctp_queued_to_read *control;
3175
3176         /*
3177          * For TCP model AND UDP connected sockets we will send an error up
3178          * when an SHUTDOWN completes
3179          */
3180         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3181             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3182                 /* mark socket closed for read/write and wakeup! */
3183 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3184                 struct socket *so;
3185
3186                 so = SCTP_INP_SO(stcb->sctp_ep);
3187                 atomic_add_int(&stcb->asoc.refcnt, 1);
3188                 SCTP_TCB_UNLOCK(stcb);
3189                 SCTP_SOCKET_LOCK(so, 1);
3190                 SCTP_TCB_LOCK(stcb);
3191                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3192                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3193                         SCTP_SOCKET_UNLOCK(so, 1);
3194                         return;
3195                 }
3196 #endif
3197                 socantsendmore(stcb->sctp_socket);
3198 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3199                 SCTP_SOCKET_UNLOCK(so, 1);
3200 #endif
3201         }
3202         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3203                 /* event not enabled */
3204                 return;
3205         }
3206         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_DONTWAIT, 1, MT_DATA);
3207         if (m_notify == NULL)
3208                 /* no space left */
3209                 return;
3210         sse = mtod(m_notify, struct sctp_shutdown_event *);
3211         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3212         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3213         sse->sse_flags = 0;
3214         sse->sse_length = sizeof(struct sctp_shutdown_event);
3215         sse->sse_assoc_id = sctp_get_associd(stcb);
3216
3217         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3218         SCTP_BUF_NEXT(m_notify) = NULL;
3219
3220         /* append to socket */
3221         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3222             0, 0, stcb->asoc.context, 0, 0, 0,
3223             m_notify);
3224         if (control == NULL) {
3225                 /* no memory */
3226                 sctp_m_freem(m_notify);
3227                 return;
3228         }
3229         control->spec_flags = M_NOTIFICATION;
3230         control->length = SCTP_BUF_LEN(m_notify);
3231         /* not that we need this */
3232         control->tail_mbuf = m_notify;
3233         sctp_add_to_readq(stcb->sctp_ep, stcb,
3234             control,
3235             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3236 }
3237
3238 static void
3239 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3240     int so_locked
3241 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3242     SCTP_UNUSED
3243 #endif
3244 )
3245 {
3246         struct mbuf *m_notify;
3247         struct sctp_sender_dry_event *event;
3248         struct sctp_queued_to_read *control;
3249
3250         if ((stcb == NULL) ||
3251             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3252                 /* event not enabled */
3253                 return;
3254         }
3255         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_DONTWAIT, 1, MT_DATA);
3256         if (m_notify == NULL) {
3257                 /* no space left */
3258                 return;
3259         }
3260         SCTP_BUF_LEN(m_notify) = 0;
3261         event = mtod(m_notify, struct sctp_sender_dry_event *);
3262         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3263         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3264         event->sender_dry_flags = 0;
3265         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3266         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3267
3268         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3269         SCTP_BUF_NEXT(m_notify) = NULL;
3270
3271         /* append to socket */
3272         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3273             0, 0, stcb->asoc.context, 0, 0, 0,
3274             m_notify);
3275         if (control == NULL) {
3276                 /* no memory */
3277                 sctp_m_freem(m_notify);
3278                 return;
3279         }
3280         control->length = SCTP_BUF_LEN(m_notify);
3281         control->spec_flags = M_NOTIFICATION;
3282         /* not that we need this */
3283         control->tail_mbuf = m_notify;
3284         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3285             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3286 }
3287
3288
3289 void
3290 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3291 {
3292         struct mbuf *m_notify;
3293         struct sctp_queued_to_read *control;
3294         struct sctp_stream_change_event *stradd;
3295
3296         if ((stcb == NULL) ||
3297             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3298                 /* event not enabled */
3299                 return;
3300         }
3301         if ((stcb->asoc.peer_req_out) && flag) {
3302                 /* Peer made the request, don't tell the local user */
3303                 stcb->asoc.peer_req_out = 0;
3304                 return;
3305         }
3306         stcb->asoc.peer_req_out = 0;
3307         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_DONTWAIT, 1, MT_DATA);
3308         if (m_notify == NULL)
3309                 /* no space left */
3310                 return;
3311         SCTP_BUF_LEN(m_notify) = 0;
3312         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3313         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3314         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3315         stradd->strchange_flags = flag;
3316         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3317         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3318         stradd->strchange_instrms = numberin;
3319         stradd->strchange_outstrms = numberout;
3320         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3321         SCTP_BUF_NEXT(m_notify) = NULL;
3322         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3323                 /* no space */
3324                 sctp_m_freem(m_notify);
3325                 return;
3326         }
3327         /* append to socket */
3328         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3329             0, 0, stcb->asoc.context, 0, 0, 0,
3330             m_notify);
3331         if (control == NULL) {
3332                 /* no memory */
3333                 sctp_m_freem(m_notify);
3334                 return;
3335         }
3336         control->spec_flags = M_NOTIFICATION;
3337         control->length = SCTP_BUF_LEN(m_notify);
3338         /* not that we need this */
3339         control->tail_mbuf = m_notify;
3340         sctp_add_to_readq(stcb->sctp_ep, stcb,
3341             control,
3342             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3343 }
3344
3345 void
3346 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3347 {
3348         struct mbuf *m_notify;
3349         struct sctp_queued_to_read *control;
3350         struct sctp_assoc_reset_event *strasoc;
3351
3352         if ((stcb == NULL) ||
3353             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3354                 /* event not enabled */
3355                 return;
3356         }
3357         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_DONTWAIT, 1, MT_DATA);
3358         if (m_notify == NULL)
3359                 /* no space left */
3360                 return;
3361         SCTP_BUF_LEN(m_notify) = 0;
3362         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3363         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3364         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3365         strasoc->assocreset_flags = flag;
3366         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3367         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3368         strasoc->assocreset_local_tsn = sending_tsn;
3369         strasoc->assocreset_remote_tsn = recv_tsn;
3370         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3371         SCTP_BUF_NEXT(m_notify) = NULL;
3372         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3373                 /* no space */
3374                 sctp_m_freem(m_notify);
3375                 return;
3376         }
3377         /* append to socket */
3378         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3379             0, 0, stcb->asoc.context, 0, 0, 0,
3380             m_notify);
3381         if (control == NULL) {
3382                 /* no memory */
3383                 sctp_m_freem(m_notify);
3384                 return;
3385         }
3386         control->spec_flags = M_NOTIFICATION;
3387         control->length = SCTP_BUF_LEN(m_notify);
3388         /* not that we need this */
3389         control->tail_mbuf = m_notify;
3390         sctp_add_to_readq(stcb->sctp_ep, stcb,
3391             control,
3392             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3393 }
3394
3395
3396
3397 static void
3398 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3399     int number_entries, uint16_t * list, int flag)
3400 {
3401         struct mbuf *m_notify;
3402         struct sctp_queued_to_read *control;
3403         struct sctp_stream_reset_event *strreset;
3404         int len;
3405
3406         if ((stcb == NULL) ||
3407             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3408                 /* event not enabled */
3409                 return;
3410         }
3411         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3412         if (m_notify == NULL)
3413                 /* no space left */
3414                 return;
3415         SCTP_BUF_LEN(m_notify) = 0;
3416         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3417         if (len > M_TRAILINGSPACE(m_notify)) {
3418                 /* never enough room */
3419                 sctp_m_freem(m_notify);
3420                 return;
3421         }
3422         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3423         memset(strreset, 0, len);
3424         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3425         strreset->strreset_flags = flag;
3426         strreset->strreset_length = len;
3427         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3428         if (number_entries) {
3429                 int i;
3430
3431                 for (i = 0; i < number_entries; i++) {
3432                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3433                 }
3434         }
3435         SCTP_BUF_LEN(m_notify) = len;
3436         SCTP_BUF_NEXT(m_notify) = NULL;
3437         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3438                 /* no space */
3439                 sctp_m_freem(m_notify);
3440                 return;
3441         }
3442         /* append to socket */
3443         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3444             0, 0, stcb->asoc.context, 0, 0, 0,
3445             m_notify);
3446         if (control == NULL) {
3447                 /* no memory */
3448                 sctp_m_freem(m_notify);
3449                 return;
3450         }
3451         control->spec_flags = M_NOTIFICATION;
3452         control->length = SCTP_BUF_LEN(m_notify);
3453         /* not that we need this */
3454         control->tail_mbuf = m_notify;
3455         sctp_add_to_readq(stcb->sctp_ep, stcb,
3456             control,
3457             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3458 }
3459
3460
3461 static void
3462 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3463 {
3464         struct mbuf *m_notify;
3465         struct sctp_remote_error *sre;
3466         struct sctp_queued_to_read *control;
3467         size_t notif_len, chunk_len;
3468
3469         if ((stcb == NULL) ||
3470             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3471                 return;
3472         }
3473         if (chunk != NULL) {
3474                 chunk_len = htons(chunk->ch.chunk_length);
3475         } else {
3476                 chunk_len = 0;
3477         }
3478         notif_len = sizeof(struct sctp_remote_error) + chunk_len;
3479         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_DONTWAIT, 1, MT_DATA);
3480         if (m_notify == NULL) {
3481                 /* Retry with smaller value. */
3482                 notif_len = sizeof(struct sctp_remote_error);
3483                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_DONTWAIT, 1, MT_DATA);
3484                 if (m_notify == NULL) {
3485                         return;
3486                 }
3487         }
3488         SCTP_BUF_NEXT(m_notify) = NULL;
3489         sre = mtod(m_notify, struct sctp_remote_error *);
3490         sre->sre_type = SCTP_REMOTE_ERROR;
3491         sre->sre_flags = 0;
3492         sre->sre_length = sizeof(struct sctp_remote_error);
3493         sre->sre_error = error;
3494         sre->sre_assoc_id = sctp_get_associd(stcb);
3495         if (notif_len > sizeof(struct sctp_remote_error)) {
3496                 memcpy(sre->sre_data, chunk, chunk_len);
3497                 sre->sre_length += chunk_len;
3498         }
3499         SCTP_BUF_LEN(m_notify) = sre->sre_length;
3500         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3501             0, 0, stcb->asoc.context, 0, 0, 0,
3502             m_notify);
3503         if (control != NULL) {
3504                 control->length = SCTP_BUF_LEN(m_notify);
3505                 /* not that we need this */
3506                 control->tail_mbuf = m_notify;
3507                 control->spec_flags = M_NOTIFICATION;
3508                 sctp_add_to_readq(stcb->sctp_ep, stcb,
3509                     control,
3510                     &stcb->sctp_socket->so_rcv, 1,
3511                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3512         } else {
3513                 sctp_m_freem(m_notify);
3514         }
3515 }
3516
3517
3518 void
3519 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3520     uint32_t error, void *data, int so_locked
3521 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3522     SCTP_UNUSED
3523 #endif
3524 )
3525 {
3526         if ((stcb == NULL) ||
3527             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3528             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3529             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3530                 /* If the socket is gone we are out of here */
3531                 return;
3532         }
3533         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3534                 return;
3535         }
3536         if (stcb && ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) ||
3537             (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED))) {
3538                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3539                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3540                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3541                         /* Don't report these in front states */
3542                         return;
3543                 }
3544         }
3545         switch (notification) {
3546         case SCTP_NOTIFY_ASSOC_UP:
3547                 if (stcb->asoc.assoc_up_sent == 0) {
3548                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
3549                         stcb->asoc.assoc_up_sent = 1;
3550                 }
3551                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3552                         sctp_notify_adaptation_layer(stcb);
3553                 }
3554                 if (stcb->asoc.peer_supports_auth == 0) {
3555                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3556                             NULL, so_locked);
3557                 }
3558                 break;
3559         case SCTP_NOTIFY_ASSOC_DOWN:
3560                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
3561                 break;
3562         case SCTP_NOTIFY_INTERFACE_DOWN:
3563                 {
3564                         struct sctp_nets *net;
3565
3566                         net = (struct sctp_nets *)data;
3567                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3568                             (struct sockaddr *)&net->ro._l_addr, error);
3569                         break;
3570                 }
3571         case SCTP_NOTIFY_INTERFACE_UP:
3572                 {
3573                         struct sctp_nets *net;
3574
3575                         net = (struct sctp_nets *)data;
3576                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3577                             (struct sockaddr *)&net->ro._l_addr, error);
3578                         break;
3579                 }
3580         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3581                 {
3582                         struct sctp_nets *net;
3583
3584                         net = (struct sctp_nets *)data;
3585                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3586                             (struct sockaddr *)&net->ro._l_addr, error);
3587                         break;
3588                 }
3589         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3590                 sctp_notify_send_failed2(stcb, error,
3591                     (struct sctp_stream_queue_pending *)data, so_locked);
3592                 break;
3593         case SCTP_NOTIFY_SENT_DG_FAIL:
3594                 sctp_notify_send_failed(stcb, 1, error,
3595                     (struct sctp_tmit_chunk *)data, so_locked);
3596                 break;
3597         case SCTP_NOTIFY_UNSENT_DG_FAIL:
3598                 sctp_notify_send_failed(stcb, 0, error,
3599                     (struct sctp_tmit_chunk *)data, so_locked);
3600                 break;
3601         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3602                 {
3603                         uint32_t val;
3604
3605                         val = *((uint32_t *) data);
3606
3607                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3608                         break;
3609                 }
3610         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
3611                 if ((stcb) && (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3612                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED))) {
3613                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
3614                 } else {
3615                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
3616                 }
3617                 break;
3618         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
3619                 if ((stcb) && (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3620                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED))) {
3621                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
3622                 } else {
3623                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
3624                 }
3625                 break;
3626         case SCTP_NOTIFY_ASSOC_RESTART:
3627                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
3628                 if (stcb->asoc.peer_supports_auth == 0) {
3629                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3630                             NULL, so_locked);
3631                 }
3632                 break;
3633         case SCTP_NOTIFY_STR_RESET_SEND:
3634                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_OUTGOING_SSN);
3635                 break;
3636         case SCTP_NOTIFY_STR_RESET_RECV:
3637                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_INCOMING);
3638                 break;
3639         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3640                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3641                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3642                 break;
3643         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3644                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3645                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3646                 break;
3647         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3648                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3649                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3650                 break;
3651         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3652                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3653                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3654                 break;
3655         case SCTP_NOTIFY_ASCONF_ADD_IP:
3656                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3657                     error);
3658                 break;
3659         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3660                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3661                     error);
3662                 break;
3663         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3664                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3665                     error);
3666                 break;
3667         case SCTP_NOTIFY_PEER_SHUTDOWN:
3668                 sctp_notify_shutdown_event(stcb);
3669                 break;
3670         case SCTP_NOTIFY_AUTH_NEW_KEY:
3671                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3672                     (uint16_t) (uintptr_t) data,
3673                     so_locked);
3674                 break;
3675         case SCTP_NOTIFY_AUTH_FREE_KEY:
3676                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3677                     (uint16_t) (uintptr_t) data,
3678                     so_locked);
3679                 break;
3680         case SCTP_NOTIFY_NO_PEER_AUTH:
3681                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3682                     (uint16_t) (uintptr_t) data,
3683                     so_locked);
3684                 break;
3685         case SCTP_NOTIFY_SENDER_DRY:
3686                 sctp_notify_sender_dry_event(stcb, so_locked);
3687                 break;
3688         case SCTP_NOTIFY_REMOTE_ERROR:
3689                 sctp_notify_remote_error(stcb, error, data);
3690                 break;
3691         default:
3692                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3693                     __FUNCTION__, notification, notification);
3694                 break;
3695         }                       /* end switch */
3696 }
3697
3698 void
3699 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int holds_lock, int so_locked
3700 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3701     SCTP_UNUSED
3702 #endif
3703 )
3704 {
3705         struct sctp_association *asoc;
3706         struct sctp_stream_out *outs;
3707         struct sctp_tmit_chunk *chk, *nchk;
3708         struct sctp_stream_queue_pending *sp, *nsp;
3709         int i;
3710
3711         if (stcb == NULL) {
3712                 return;
3713         }
3714         asoc = &stcb->asoc;
3715         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3716                 /* already being freed */
3717                 return;
3718         }
3719         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3720             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3721             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3722                 return;
3723         }
3724         /* now through all the gunk freeing chunks */
3725         if (holds_lock == 0) {
3726                 SCTP_TCB_SEND_LOCK(stcb);
3727         }
3728         /* sent queue SHOULD be empty */
3729         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3730                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3731                 asoc->sent_queue_cnt--;
3732                 if (chk->data != NULL) {
3733                         sctp_free_bufspace(stcb, asoc, chk, 1);
3734                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
3735                             error, chk, so_locked);
3736                         if (chk->data) {
3737                                 sctp_m_freem(chk->data);
3738                                 chk->data = NULL;
3739                         }
3740                 }
3741                 sctp_free_a_chunk(stcb, chk, so_locked);
3742                 /* sa_ignore FREED_MEMORY */
3743         }
3744         /* pending send queue SHOULD be empty */
3745         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3746                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3747                 asoc->send_queue_cnt--;
3748                 if (chk->data != NULL) {
3749                         sctp_free_bufspace(stcb, asoc, chk, 1);
3750                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
3751                             error, chk, so_locked);
3752                         if (chk->data) {
3753                                 sctp_m_freem(chk->data);
3754                                 chk->data = NULL;
3755                         }
3756                 }
3757                 sctp_free_a_chunk(stcb, chk, so_locked);
3758                 /* sa_ignore FREED_MEMORY */
3759         }
3760         for (i = 0; i < asoc->streamoutcnt; i++) {
3761                 /* For each stream */
3762                 outs = &asoc->strmout[i];
3763                 /* clean up any sends there */
3764                 asoc->locked_on_sending = NULL;
3765                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3766                         asoc->stream_queue_cnt--;
3767                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3768                         sctp_free_spbufspace(stcb, asoc, sp);
3769                         if (sp->data) {
3770                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3771                                     error, (void *)sp, so_locked);
3772                                 if (sp->data) {
3773                                         sctp_m_freem(sp->data);
3774                                         sp->data = NULL;
3775                                         sp->tail_mbuf = NULL;
3776                                         sp->length = 0;
3777                                 }
3778                         }
3779                         if (sp->net) {
3780                                 sctp_free_remote_addr(sp->net);
3781                                 sp->net = NULL;
3782                         }
3783                         /* Free the chunk */
3784                         sctp_free_a_strmoq(stcb, sp, so_locked);
3785                         /* sa_ignore FREED_MEMORY */
3786                 }
3787         }
3788
3789         if (holds_lock == 0) {
3790                 SCTP_TCB_SEND_UNLOCK(stcb);
3791         }
3792 }
3793
3794 void
3795 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
3796     struct sctp_abort_chunk *abort, int so_locked
3797 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3798     SCTP_UNUSED
3799 #endif
3800 )
3801 {
3802         if (stcb == NULL) {
3803                 return;
3804         }
3805         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3806             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3807             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3808                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3809         }
3810         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3811             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3812             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3813                 return;
3814         }
3815         /* Tell them we lost the asoc */
3816         sctp_report_all_outbound(stcb, error, 1, so_locked);
3817         if (from_peer) {
3818                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
3819         } else {
3820                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
3821         }
3822 }
3823
3824 void
3825 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3826     struct mbuf *m, int iphlen, struct sctphdr *sh,
3827     struct mbuf *op_err,
3828     uint8_t use_mflowid, uint32_t mflowid,
3829     uint32_t vrf_id, uint16_t port)
3830 {
3831         uint32_t vtag;
3832
3833 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3834         struct socket *so;
3835
3836 #endif
3837
3838         vtag = 0;
3839         if (stcb != NULL) {
3840                 /* We have a TCB to abort, send notification too */
3841                 vtag = stcb->asoc.peer_vtag;
3842                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
3843                 /* get the assoc vrf id and table id */
3844                 vrf_id = stcb->asoc.vrf_id;
3845                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3846         }
3847         sctp_send_abort(m, iphlen, sh, vtag, op_err,
3848             use_mflowid, mflowid,
3849             vrf_id, port);
3850         if (stcb != NULL) {
3851                 /* Ok, now lets free it */
3852 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3853                 so = SCTP_INP_SO(inp);
3854                 atomic_add_int(&stcb->asoc.refcnt, 1);
3855                 SCTP_TCB_UNLOCK(stcb);
3856                 SCTP_SOCKET_LOCK(so, 1);
3857                 SCTP_TCB_LOCK(stcb);
3858                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3859 #endif
3860                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3861                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3862                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3863                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3864                 }
3865                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
3866 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3867                 SCTP_SOCKET_UNLOCK(so, 1);
3868 #endif
3869         }
3870 }
3871
3872 #ifdef SCTP_ASOCLOG_OF_TSNS
3873 void
3874 sctp_print_out_track_log(struct sctp_tcb *stcb)
3875 {
3876 #ifdef NOSIY_PRINTS
3877         int i;
3878
3879         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
3880         SCTP_PRINTF("IN bound TSN log-aaa\n");
3881         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
3882                 SCTP_PRINTF("None rcvd\n");
3883                 goto none_in;
3884         }
3885         if (stcb->asoc.tsn_in_wrapped) {
3886                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
3887                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3888                             stcb->asoc.in_tsnlog[i].tsn,
3889                             stcb->asoc.in_tsnlog[i].strm,
3890                             stcb->asoc.in_tsnlog[i].seq,
3891                             stcb->asoc.in_tsnlog[i].flgs,
3892                             stcb->asoc.in_tsnlog[i].sz);
3893                 }
3894         }
3895         if (stcb->asoc.tsn_in_at) {
3896                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
3897                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3898                             stcb->asoc.in_tsnlog[i].tsn,
3899                             stcb->asoc.in_tsnlog[i].strm,
3900                             stcb->asoc.in_tsnlog[i].seq,
3901                             stcb->asoc.in_tsnlog[i].flgs,
3902                             stcb->asoc.in_tsnlog[i].sz);
3903                 }
3904         }
3905 none_in:
3906         SCTP_PRINTF("OUT bound TSN log-aaa\n");
3907         if ((stcb->asoc.tsn_out_at == 0) &&
3908             (stcb->asoc.tsn_out_wrapped == 0)) {
3909                 SCTP_PRINTF("None sent\n");
3910         }
3911         if (stcb->asoc.tsn_out_wrapped) {
3912                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
3913                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3914                             stcb->asoc.out_tsnlog[i].tsn,
3915                             stcb->asoc.out_tsnlog[i].strm,
3916                             stcb->asoc.out_tsnlog[i].seq,
3917                             stcb->asoc.out_tsnlog[i].flgs,
3918                             stcb->asoc.out_tsnlog[i].sz);
3919                 }
3920         }
3921         if (stcb->asoc.tsn_out_at) {
3922                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
3923                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3924                             stcb->asoc.out_tsnlog[i].tsn,
3925                             stcb->asoc.out_tsnlog[i].strm,
3926                             stcb->asoc.out_tsnlog[i].seq,
3927                             stcb->asoc.out_tsnlog[i].flgs,
3928                             stcb->asoc.out_tsnlog[i].sz);
3929                 }
3930         }
3931 #endif
3932 }
3933
3934 #endif
3935
3936 void
3937 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3938     struct mbuf *op_err,
3939     int so_locked
3940 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3941     SCTP_UNUSED
3942 #endif
3943 )
3944 {
3945 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3946         struct socket *so;
3947
3948 #endif
3949
3950 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3951         so = SCTP_INP_SO(inp);
3952 #endif
3953         if (stcb == NULL) {
3954                 /* Got to have a TCB */
3955                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3956                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3957                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
3958                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
3959                         }
3960                 }
3961                 return;
3962         } else {
3963                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3964         }
3965         /* notify the ulp */
3966         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
3967                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
3968         }
3969         /* notify the peer */
3970         sctp_send_abort_tcb(stcb, op_err, so_locked);
3971         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3972         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3973             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3974                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3975         }
3976         /* now free the asoc */
3977 #ifdef SCTP_ASOCLOG_OF_TSNS
3978         sctp_print_out_track_log(stcb);
3979 #endif
3980 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3981         if (!so_locked) {
3982                 atomic_add_int(&stcb->asoc.refcnt, 1);
3983                 SCTP_TCB_UNLOCK(stcb);
3984                 SCTP_SOCKET_LOCK(so, 1);
3985                 SCTP_TCB_LOCK(stcb);
3986                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3987         }
3988 #endif
3989         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
3990 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3991         if (!so_locked) {
3992                 SCTP_SOCKET_UNLOCK(so, 1);
3993         }
3994 #endif
3995 }
3996
3997 void
3998 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
3999     struct sctp_inpcb *inp,
4000     uint8_t use_mflowid, uint32_t mflowid,
4001     uint32_t vrf_id, uint16_t port)
4002 {
4003         struct sctp_chunkhdr *ch, chunk_buf;
4004         unsigned int chk_length;
4005         int contains_init_chunk;
4006
4007         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4008         /* Generate a TO address for future reference */
4009         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4010                 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
4011                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4012                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4013                 }
4014         }
4015         contains_init_chunk = 0;
4016         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4017             sizeof(*ch), (uint8_t *) & chunk_buf);
4018         while (ch != NULL) {
4019                 chk_length = ntohs(ch->chunk_length);
4020                 if (chk_length < sizeof(*ch)) {
4021                         /* break to abort land */
4022                         break;
4023                 }
4024                 switch (ch->chunk_type) {
4025                 case SCTP_INIT:
4026                         contains_init_chunk = 1;
4027                         break;
4028                 case SCTP_COOKIE_ECHO:
4029                         /* We hit here only if the assoc is being freed */
4030                         return;
4031                 case SCTP_PACKET_DROPPED:
4032                         /* we don't respond to pkt-dropped */
4033                         return;
4034                 case SCTP_ABORT_ASSOCIATION:
4035                         /* we don't respond with an ABORT to an ABORT */
4036                         return;
4037                 case SCTP_SHUTDOWN_COMPLETE:
4038                         /*
4039                          * we ignore it since we are not waiting for it and
4040                          * peer is gone
4041                          */
4042                         return;
4043                 case SCTP_SHUTDOWN_ACK:
4044                         sctp_send_shutdown_complete2(m, sh,
4045                             use_mflowid, mflowid,
4046                             vrf_id, port);
4047                         return;
4048                 default:
4049                         break;
4050                 }
4051                 offset += SCTP_SIZE32(chk_length);
4052                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4053                     sizeof(*ch), (uint8_t *) & chunk_buf);
4054         }
4055         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4056             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4057             (contains_init_chunk == 0))) {
4058                 sctp_send_abort(m, iphlen, sh, 0, NULL,
4059                     use_mflowid, mflowid,
4060                     vrf_id, port);
4061         }
4062 }
4063
4064 /*
4065  * check the inbound datagram to make sure there is not an abort inside it,
4066  * if there is return 1, else return 0.
4067  */
4068 int
4069 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill)
4070 {
4071         struct sctp_chunkhdr *ch;
4072         struct sctp_init_chunk *init_chk, chunk_buf;
4073         int offset;
4074         unsigned int chk_length;
4075
4076         offset = iphlen + sizeof(struct sctphdr);
4077         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4078             (uint8_t *) & chunk_buf);
4079         while (ch != NULL) {
4080                 chk_length = ntohs(ch->chunk_length);
4081                 if (chk_length < sizeof(*ch)) {
4082                         /* packet is probably corrupt */
4083                         break;
4084                 }
4085                 /* we seem to be ok, is it an abort? */
4086                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4087                         /* yep, tell them */
4088                         return (1);
4089                 }
4090                 if (ch->chunk_type == SCTP_INITIATION) {
4091                         /* need to update the Vtag */
4092                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4093                             offset, sizeof(*init_chk), (uint8_t *) & chunk_buf);
4094                         if (init_chk != NULL) {
4095                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4096                         }
4097                 }
4098                 /* Nope, move to the next chunk */
4099                 offset += SCTP_SIZE32(chk_length);
4100                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4101                     sizeof(*ch), (uint8_t *) & chunk_buf);
4102         }
4103         return (0);
4104 }
4105
4106 /*
4107  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4108  * set (i.e. it's 0) so, create this function to compare link local scopes
4109  */
4110 #ifdef INET6
4111 uint32_t
4112 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4113 {
4114         struct sockaddr_in6 a, b;
4115
4116         /* save copies */
4117         a = *addr1;
4118         b = *addr2;
4119
4120         if (a.sin6_scope_id == 0)
4121                 if (sa6_recoverscope(&a)) {
4122                         /* can't get scope, so can't match */
4123                         return (0);
4124                 }
4125         if (b.sin6_scope_id == 0)
4126                 if (sa6_recoverscope(&b)) {
4127                         /* can't get scope, so can't match */
4128                         return (0);
4129                 }
4130         if (a.sin6_scope_id != b.sin6_scope_id)
4131                 return (0);
4132
4133         return (1);
4134 }
4135
4136 /*
4137  * returns a sockaddr_in6 with embedded scope recovered and removed
4138  */
4139 struct sockaddr_in6 *
4140 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4141 {
4142         /* check and strip embedded scope junk */
4143         if (addr->sin6_family == AF_INET6) {
4144                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4145                         if (addr->sin6_scope_id == 0) {
4146                                 *store = *addr;
4147                                 if (!sa6_recoverscope(store)) {
4148                                         /* use the recovered scope */
4149                                         addr = store;
4150                                 }
4151                         } else {
4152                                 /* else, return the original "to" addr */
4153                                 in6_clearscope(&addr->sin6_addr);
4154                         }
4155                 }
4156         }
4157         return (addr);
4158 }
4159
4160 #endif
4161
4162 /*
4163  * are the two addresses the same?  currently a "scopeless" check returns: 1
4164  * if same, 0 if not
4165  */
4166 int
4167 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4168 {
4169
4170         /* must be valid */
4171         if (sa1 == NULL || sa2 == NULL)
4172                 return (0);
4173
4174         /* must be the same family */
4175         if (sa1->sa_family != sa2->sa_family)
4176                 return (0);
4177
4178         switch (sa1->sa_family) {
4179 #ifdef INET6
4180         case AF_INET6:
4181                 {
4182                         /* IPv6 addresses */
4183                         struct sockaddr_in6 *sin6_1, *sin6_2;
4184
4185                         sin6_1 = (struct sockaddr_in6 *)sa1;
4186                         sin6_2 = (struct sockaddr_in6 *)sa2;
4187                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4188                             sin6_2));
4189                 }
4190 #endif
4191 #ifdef INET
4192         case AF_INET:
4193                 {
4194                         /* IPv4 addresses */
4195                         struct sockaddr_in *sin_1, *sin_2;
4196
4197                         sin_1 = (struct sockaddr_in *)sa1;
4198                         sin_2 = (struct sockaddr_in *)sa2;
4199                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4200                 }
4201 #endif
4202         default:
4203                 /* we don't do these... */
4204                 return (0);
4205         }
4206 }
4207
4208 void
4209 sctp_print_address(struct sockaddr *sa)
4210 {
4211 #ifdef INET6
4212         char ip6buf[INET6_ADDRSTRLEN];
4213
4214         ip6buf[0] = 0;
4215 #endif
4216
4217         switch (sa->sa_family) {
4218 #ifdef INET6
4219         case AF_INET6:
4220                 {
4221                         struct sockaddr_in6 *sin6;
4222
4223                         sin6 = (struct sockaddr_in6 *)sa;
4224                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4225                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4226                             ntohs(sin6->sin6_port),
4227                             sin6->sin6_scope_id);
4228                         break;
4229                 }
4230 #endif
4231 #ifdef INET
4232         case AF_INET:
4233                 {
4234                         struct sockaddr_in *sin;
4235                         unsigned char *p;
4236
4237                         sin = (struct sockaddr_in *)sa;
4238                         p = (unsigned char *)&sin->sin_addr;
4239                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4240                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4241                         break;
4242                 }
4243 #endif
4244         default:
4245                 SCTP_PRINTF("?\n");
4246                 break;
4247         }
4248 }
4249
4250 void
4251 sctp_print_address_pkt(struct ip *iph, struct sctphdr *sh)
4252 {
4253         switch (iph->ip_v) {
4254 #ifdef INET
4255         case IPVERSION:
4256                 {
4257                         struct sockaddr_in lsa, fsa;
4258
4259                         bzero(&lsa, sizeof(lsa));
4260                         lsa.sin_len = sizeof(lsa);
4261                         lsa.sin_family = AF_INET;
4262                         lsa.sin_addr = iph->ip_src;
4263                         lsa.sin_port = sh->src_port;
4264                         bzero(&fsa, sizeof(fsa));
4265                         fsa.sin_len = sizeof(fsa);
4266                         fsa.sin_family = AF_INET;
4267                         fsa.sin_addr = iph->ip_dst;
4268                         fsa.sin_port = sh->dest_port;
4269                         SCTP_PRINTF("src: ");
4270                         sctp_print_address((struct sockaddr *)&lsa);
4271                         SCTP_PRINTF("dest: ");
4272                         sctp_print_address((struct sockaddr *)&fsa);
4273                         break;
4274                 }
4275 #endif
4276 #ifdef INET6
4277         case IPV6_VERSION >> 4:
4278                 {
4279                         struct ip6_hdr *ip6;
4280                         struct sockaddr_in6 lsa6, fsa6;
4281
4282                         ip6 = (struct ip6_hdr *)iph;
4283                         bzero(&lsa6, sizeof(lsa6));
4284                         lsa6.sin6_len = sizeof(lsa6);
4285                         lsa6.sin6_family = AF_INET6;
4286                         lsa6.sin6_addr = ip6->ip6_src;
4287                         lsa6.sin6_port = sh->src_port;
4288                         bzero(&fsa6, sizeof(fsa6));
4289                         fsa6.sin6_len = sizeof(fsa6);
4290                         fsa6.sin6_family = AF_INET6;
4291                         fsa6.sin6_addr = ip6->ip6_dst;
4292                         fsa6.sin6_port = sh->dest_port;
4293                         SCTP_PRINTF("src: ");
4294                         sctp_print_address((struct sockaddr *)&lsa6);
4295                         SCTP_PRINTF("dest: ");
4296                         sctp_print_address((struct sockaddr *)&fsa6);
4297                         break;
4298                 }
4299 #endif
4300         default:
4301                 /* TSNH */
4302                 break;
4303         }
4304 }
4305
4306 void
4307 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4308     struct sctp_inpcb *new_inp,
4309     struct sctp_tcb *stcb,
4310     int waitflags)
4311 {
4312         /*
4313          * go through our old INP and pull off any control structures that
4314          * belong to stcb and move then to the new inp.
4315          */
4316         struct socket *old_so, *new_so;
4317         struct sctp_queued_to_read *control, *nctl;
4318         struct sctp_readhead tmp_queue;
4319         struct mbuf *m;
4320         int error = 0;
4321
4322         old_so = old_inp->sctp_socket;
4323         new_so = new_inp->sctp_socket;
4324         TAILQ_INIT(&tmp_queue);
4325         error = sblock(&old_so->so_rcv, waitflags);
4326         if (error) {
4327                 /*
4328                  * Gak, can't get sblock, we have a problem. data will be
4329                  * left stranded.. and we don't dare look at it since the
4330                  * other thread may be reading something. Oh well, its a
4331                  * screwed up app that does a peeloff OR a accept while
4332                  * reading from the main socket... actually its only the
4333                  * peeloff() case, since I think read will fail on a
4334                  * listening socket..
4335                  */
4336                 return;
4337         }
4338         /* lock the socket buffers */
4339         SCTP_INP_READ_LOCK(old_inp);
4340         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4341                 /* Pull off all for out target stcb */
4342                 if (control->stcb == stcb) {
4343                         /* remove it we want it */
4344                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4345                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4346                         m = control->data;
4347                         while (m) {
4348                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4349                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4350                                 }
4351                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4352                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4353                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4354                                 }
4355                                 m = SCTP_BUF_NEXT(m);
4356                         }
4357                 }
4358         }
4359         SCTP_INP_READ_UNLOCK(old_inp);
4360         /* Remove the sb-lock on the old socket */
4361
4362         sbunlock(&old_so->so_rcv);
4363         /* Now we move them over to the new socket buffer */
4364         SCTP_INP_READ_LOCK(new_inp);
4365         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4366                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4367                 m = control->data;
4368                 while (m) {
4369                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4370                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4371                         }
4372                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4373                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4374                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4375                         }
4376                         m = SCTP_BUF_NEXT(m);
4377                 }
4378         }
4379         SCTP_INP_READ_UNLOCK(new_inp);
4380 }
4381
4382 void
4383 sctp_add_to_readq(struct sctp_inpcb *inp,
4384     struct sctp_tcb *stcb,
4385     struct sctp_queued_to_read *control,
4386     struct sockbuf *sb,
4387     int end,
4388     int inp_read_lock_held,
4389     int so_locked
4390 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4391     SCTP_UNUSED
4392 #endif
4393 )
4394 {
4395         /*
4396          * Here we must place the control on the end of the socket read
4397          * queue AND increment sb_cc so that select will work properly on
4398          * read.
4399          */
4400         struct mbuf *m, *prev = NULL;
4401
4402         if (inp == NULL) {
4403                 /* Gak, TSNH!! */
4404 #ifdef INVARIANTS
4405                 panic("Gak, inp NULL on add_to_readq");
4406 #endif
4407                 return;
4408         }
4409         if (inp_read_lock_held == 0)
4410                 SCTP_INP_READ_LOCK(inp);
4411         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4412                 sctp_free_remote_addr(control->whoFrom);
4413                 if (control->data) {
4414                         sctp_m_freem(control->data);
4415                         control->data = NULL;
4416                 }
4417                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4418                 if (inp_read_lock_held == 0)
4419                         SCTP_INP_READ_UNLOCK(inp);
4420                 return;
4421         }
4422         if (!(control->spec_flags & M_NOTIFICATION)) {
4423                 atomic_add_int(&inp->total_recvs, 1);
4424                 if (!control->do_not_ref_stcb) {
4425                         atomic_add_int(&stcb->total_recvs, 1);
4426                 }
4427         }
4428         m = control->data;
4429         control->held_length = 0;
4430         control->length = 0;
4431         while (m) {
4432                 if (SCTP_BUF_LEN(m) == 0) {
4433                         /* Skip mbufs with NO length */
4434                         if (prev == NULL) {
4435                                 /* First one */
4436                                 control->data = sctp_m_free(m);
4437                                 m = control->data;
4438                         } else {
4439                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4440                                 m = SCTP_BUF_NEXT(prev);
4441                         }
4442                         if (m == NULL) {
4443                                 control->tail_mbuf = prev;
4444                         }
4445                         continue;
4446                 }
4447                 prev = m;
4448                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4449                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4450                 }
4451                 sctp_sballoc(stcb, sb, m);
4452                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4453                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4454                 }
4455                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4456                 m = SCTP_BUF_NEXT(m);
4457         }
4458         if (prev != NULL) {
4459                 control->tail_mbuf = prev;
4460         } else {
4461                 /* Everything got collapsed out?? */
4462                 sctp_free_remote_addr(control->whoFrom);
4463                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4464                 if (inp_read_lock_held == 0)
4465                         SCTP_INP_READ_UNLOCK(inp);
4466                 return;
4467         }
4468         if (end) {
4469                 control->end_added = 1;
4470         }
4471         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4472         if (inp_read_lock_held == 0)
4473                 SCTP_INP_READ_UNLOCK(inp);
4474         if (inp && inp->sctp_socket) {
4475                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4476                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4477                 } else {
4478 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4479                         struct socket *so;
4480
4481                         so = SCTP_INP_SO(inp);
4482                         if (!so_locked) {
4483                                 if (stcb) {
4484                                         atomic_add_int(&stcb->asoc.refcnt, 1);
4485                                         SCTP_TCB_UNLOCK(stcb);
4486                                 }
4487                                 SCTP_SOCKET_LOCK(so, 1);
4488                                 if (stcb) {
4489                                         SCTP_TCB_LOCK(stcb);
4490                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4491                                 }
4492                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4493                                         SCTP_SOCKET_UNLOCK(so, 1);
4494                                         return;
4495                                 }
4496                         }
4497 #endif
4498                         sctp_sorwakeup(inp, inp->sctp_socket);
4499 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4500                         if (!so_locked) {
4501                                 SCTP_SOCKET_UNLOCK(so, 1);
4502                         }
4503 #endif
4504                 }
4505         }
4506 }
4507
4508
4509 int
4510 sctp_append_to_readq(struct sctp_inpcb *inp,
4511     struct sctp_tcb *stcb,
4512     struct sctp_queued_to_read *control,
4513     struct mbuf *m,
4514     int end,
4515     int ctls_cumack,
4516     struct sockbuf *sb)
4517 {
4518         /*
4519          * A partial delivery API event is underway. OR we are appending on
4520          * the reassembly queue.
4521          *
4522          * If PDAPI this means we need to add m to the end of the data.
4523          * Increase the length in the control AND increment the sb_cc.
4524          * Otherwise sb is NULL and all we need to do is put it at the end
4525          * of the mbuf chain.
4526          */
4527         int len = 0;
4528         struct mbuf *mm, *tail = NULL, *prev = NULL;
4529
4530         if (inp) {
4531                 SCTP_INP_READ_LOCK(inp);
4532         }
4533         if (control == NULL) {
4534 get_out:
4535                 if (inp) {
4536                         SCTP_INP_READ_UNLOCK(inp);
4537                 }
4538                 return (-1);
4539         }
4540         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ)) {
4541                 SCTP_INP_READ_UNLOCK(inp);
4542                 return (0);
4543         }
4544         if (control->end_added) {
4545                 /* huh this one is complete? */
4546                 goto get_out;
4547         }
4548         mm = m;
4549         if (mm == NULL) {
4550                 goto get_out;
4551         }
4552         while (mm) {
4553                 if (SCTP_BUF_LEN(mm) == 0) {
4554                         /* Skip mbufs with NO lenght */
4555                         if (prev == NULL) {
4556                                 /* First one */
4557                                 m = sctp_m_free(mm);
4558                                 mm = m;
4559                         } else {
4560                                 SCTP_BUF_NEXT(prev) = sctp_m_free(mm);
4561                                 mm = SCTP_BUF_NEXT(prev);
4562                         }
4563                         continue;
4564                 }
4565                 prev = mm;
4566                 len += SCTP_BUF_LEN(mm);
4567                 if (sb) {
4568                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4569                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(mm));
4570                         }
4571                         sctp_sballoc(stcb, sb, mm);
4572                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4573                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4574                         }
4575                 }
4576                 mm = SCTP_BUF_NEXT(mm);
4577         }
4578         if (prev) {
4579                 tail = prev;
4580         } else {
4581                 /* Really there should always be a prev */
4582                 if (m == NULL) {
4583                         /* Huh nothing left? */
4584 #ifdef INVARIANTS
4585                         panic("Nothing left to add?");
4586 #else
4587                         goto get_out;
4588 #endif
4589                 }
4590                 tail = m;
4591         }
4592         if (control->tail_mbuf) {
4593                 /* append */
4594                 SCTP_BUF_NEXT(control->tail_mbuf) = m;
4595                 control->tail_mbuf = tail;
4596         } else {
4597                 /* nothing there */
4598 #ifdef INVARIANTS
4599                 if (control->data != NULL) {
4600                         panic("This should NOT happen");
4601                 }
4602 #endif
4603                 control->data = m;
4604                 control->tail_mbuf = tail;
4605         }
4606         atomic_add_int(&control->length, len);
4607         if (end) {
4608                 /* message is complete */
4609                 if (stcb && (control == stcb->asoc.control_pdapi)) {
4610                         stcb->asoc.control_pdapi = NULL;
4611                 }
4612                 control->held_length = 0;
4613                 control->end_added = 1;
4614         }
4615         if (stcb == NULL) {
4616                 control->do_not_ref_stcb = 1;
4617         }
4618         /*
4619          * When we are appending in partial delivery, the cum-ack is used
4620          * for the actual pd-api highest tsn on this mbuf. The true cum-ack
4621          * is populated in the outbound sinfo structure from the true cumack
4622          * if the association exists...
4623          */
4624         control->sinfo_tsn = control->sinfo_cumtsn = ctls_cumack;
4625         if (inp) {
4626                 SCTP_INP_READ_UNLOCK(inp);
4627         }
4628         if (inp && inp->sctp_socket) {
4629                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4630                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4631                 } else {
4632 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4633                         struct socket *so;
4634
4635                         so = SCTP_INP_SO(inp);
4636                         if (stcb) {
4637                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4638                                 SCTP_TCB_UNLOCK(stcb);
4639                         }
4640                         SCTP_SOCKET_LOCK(so, 1);
4641                         if (stcb) {
4642                                 SCTP_TCB_LOCK(stcb);
4643                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4644                         }
4645                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4646                                 SCTP_SOCKET_UNLOCK(so, 1);
4647                                 return (0);
4648                         }
4649 #endif
4650                         sctp_sorwakeup(inp, inp->sctp_socket);
4651 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4652                         SCTP_SOCKET_UNLOCK(so, 1);
4653 #endif
4654                 }
4655         }
4656         return (0);
4657 }
4658
4659
4660
4661 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4662  *************ALTERNATE ROUTING CODE
4663  */
4664
4665 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4666  *************ALTERNATE ROUTING CODE
4667  */
4668
4669 struct mbuf *
4670 sctp_generate_invmanparam(int err)
4671 {
4672         /* Return a MBUF with a invalid mandatory parameter */
4673         struct mbuf *m;
4674
4675         m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_DONTWAIT, 1, MT_DATA);
4676         if (m) {
4677                 struct sctp_paramhdr *ph;
4678
4679                 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr);
4680                 ph = mtod(m, struct sctp_paramhdr *);
4681                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
4682                 ph->param_type = htons(err);
4683         }
4684         return (m);
4685 }
4686
4687 #ifdef SCTP_MBCNT_LOGGING
4688 void
4689 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4690     struct sctp_tmit_chunk *tp1, int chk_cnt)
4691 {
4692         if (tp1->data == NULL) {
4693                 return;
4694         }
4695         asoc->chunks_on_out_queue -= chk_cnt;
4696         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4697                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4698                     asoc->total_output_queue_size,
4699                     tp1->book_size,
4700                     0,
4701                     tp1->mbcnt);
4702         }
4703         if (asoc->total_output_queue_size >= tp1->book_size) {
4704                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4705         } else {
4706                 asoc->total_output_queue_size = 0;
4707         }
4708
4709         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4710             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4711                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4712                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4713                 } else {
4714                         stcb->sctp_socket->so_snd.sb_cc = 0;
4715
4716                 }
4717         }
4718 }
4719
4720 #endif
4721
4722 int
4723 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4724     uint8_t sent, int so_locked
4725 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4726     SCTP_UNUSED
4727 #endif
4728 )
4729 {
4730         struct sctp_stream_out *strq;
4731         struct sctp_tmit_chunk *chk = NULL, *tp2;
4732         struct sctp_stream_queue_pending *sp;
4733         uint16_t stream = 0, seq = 0;
4734         uint8_t foundeom = 0;
4735         int ret_sz = 0;
4736         int notdone;
4737         int do_wakeup_routine = 0;
4738
4739         stream = tp1->rec.data.stream_number;
4740         seq = tp1->rec.data.stream_seq;
4741         do {
4742                 ret_sz += tp1->book_size;
4743                 if (tp1->data != NULL) {
4744                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4745                                 sctp_flight_size_decrease(tp1);
4746                                 sctp_total_flight_decrease(stcb, tp1);
4747                         }
4748                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4749                         stcb->asoc.peers_rwnd += tp1->send_size;
4750                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4751                         if (sent) {
4752                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4753                         } else {
4754                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4755                         }
4756                         if (tp1->data) {
4757                                 sctp_m_freem(tp1->data);
4758                                 tp1->data = NULL;
4759                         }
4760                         do_wakeup_routine = 1;
4761                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4762                                 stcb->asoc.sent_queue_cnt_removeable--;
4763                         }
4764                 }
4765                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4766                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4767                     SCTP_DATA_NOT_FRAG) {
4768                         /* not frag'ed we ae done   */
4769                         notdone = 0;
4770                         foundeom = 1;
4771                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4772                         /* end of frag, we are done */
4773                         notdone = 0;
4774                         foundeom = 1;
4775                 } else {
4776                         /*
4777                          * Its a begin or middle piece, we must mark all of
4778                          * it
4779                          */
4780                         notdone = 1;
4781                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4782                 }
4783         } while (tp1 && notdone);
4784         if (foundeom == 0) {
4785                 /*
4786                  * The multi-part message was scattered across the send and
4787                  * sent queue.
4788                  */
4789                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4790                         if ((tp1->rec.data.stream_number != stream) ||
4791                             (tp1->rec.data.stream_seq != seq)) {
4792                                 break;
4793                         }
4794                         /*
4795                          * save to chk in case we have some on stream out
4796                          * queue. If so and we have an un-transmitted one we
4797                          * don't have to fudge the TSN.
4798                          */
4799                         chk = tp1;
4800                         ret_sz += tp1->book_size;
4801                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4802                         if (sent) {
4803                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4804                         } else {
4805                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4806                         }
4807                         if (tp1->data) {
4808                                 sctp_m_freem(tp1->data);
4809                                 tp1->data = NULL;
4810                         }
4811                         /* No flight involved here book the size to 0 */
4812                         tp1->book_size = 0;
4813                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4814                                 foundeom = 1;
4815                         }
4816                         do_wakeup_routine = 1;
4817                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4818                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4819                         /*
4820                          * on to the sent queue so we can wait for it to be
4821                          * passed by.
4822                          */
4823                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4824                             sctp_next);
4825                         stcb->asoc.send_queue_cnt--;
4826                         stcb->asoc.sent_queue_cnt++;
4827                 }
4828         }
4829         if (foundeom == 0) {
4830                 /*
4831                  * Still no eom found. That means there is stuff left on the
4832                  * stream out queue.. yuck.
4833                  */
4834                 strq = &stcb->asoc.strmout[stream];
4835                 SCTP_TCB_SEND_LOCK(stcb);
4836                 TAILQ_FOREACH(sp, &strq->outqueue, next) {
4837                         /* FIXME: Shouldn't this be a serial number check? */
4838                         if (sp->strseq > seq) {
4839                                 break;
4840                         }
4841                         /* Check if its our SEQ */
4842                         if (sp->strseq == seq) {
4843                                 sp->discard_rest = 1;
4844                                 /*
4845                                  * We may need to put a chunk on the queue
4846                                  * that holds the TSN that would have been
4847                                  * sent with the LAST bit.
4848                                  */
4849                                 if (chk == NULL) {
4850                                         /* Yep, we have to */
4851                                         sctp_alloc_a_chunk(stcb, chk);
4852                                         if (chk == NULL) {
4853                                                 /*
4854                                                  * we are hosed. All we can
4855                                                  * do is nothing.. which
4856                                                  * will cause an abort if
4857                                                  * the peer is paying
4858                                                  * attention.
4859                                                  */
4860                                                 goto oh_well;
4861                                         }
4862                                         memset(chk, 0, sizeof(*chk));
4863                                         chk->rec.data.rcv_flags = SCTP_DATA_LAST_FRAG;
4864                                         chk->sent = SCTP_FORWARD_TSN_SKIP;
4865                                         chk->asoc = &stcb->asoc;
4866                                         chk->rec.data.stream_seq = sp->strseq;
4867                                         chk->rec.data.stream_number = sp->stream;
4868                                         chk->rec.data.payloadtype = sp->ppid;
4869                                         chk->rec.data.context = sp->context;
4870                                         chk->flags = sp->act_flags;
4871                                         if (sp->net)
4872                                                 chk->whoTo = sp->net;
4873                                         else
4874                                                 chk->whoTo = stcb->asoc.primary_destination;
4875                                         atomic_add_int(&chk->whoTo->ref_count, 1);
4876                                         chk->rec.data.TSN_seq = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4877                                         stcb->asoc.pr_sctp_cnt++;
4878                                         chk->pr_sctp_on = 1;
4879                                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4880                                         stcb->asoc.sent_queue_cnt++;
4881                                         stcb->asoc.pr_sctp_cnt++;
4882                                 } else {
4883                                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4884                                 }
4885                 oh_well:
4886                                 if (sp->data) {
4887                                         /*
4888                                          * Pull any data to free up the SB
4889                                          * and allow sender to "add more"
4890                                          * while we will throw away :-)
4891                                          */
4892                                         sctp_free_spbufspace(stcb, &stcb->asoc,
4893                                             sp);
4894                                         ret_sz += sp->length;
4895                                         do_wakeup_routine = 1;
4896                                         sp->some_taken = 1;
4897                                         sctp_m_freem(sp->data);
4898                                         sp->data = NULL;
4899                                         sp->tail_mbuf = NULL;
4900                                         sp->length = 0;
4901                                 }
4902                                 break;
4903                         }
4904                 }               /* End tailq_foreach */
4905                 SCTP_TCB_SEND_UNLOCK(stcb);
4906         }
4907         if (do_wakeup_routine) {
4908 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4909                 struct socket *so;
4910
4911                 so = SCTP_INP_SO(stcb->sctp_ep);
4912                 if (!so_locked) {
4913                         atomic_add_int(&stcb->asoc.refcnt, 1);
4914                         SCTP_TCB_UNLOCK(stcb);
4915                         SCTP_SOCKET_LOCK(so, 1);
4916                         SCTP_TCB_LOCK(stcb);
4917                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4918                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4919                                 /* assoc was freed while we were unlocked */
4920                                 SCTP_SOCKET_UNLOCK(so, 1);
4921                                 return (ret_sz);
4922                         }
4923                 }
4924 #endif
4925                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4926 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4927                 if (!so_locked) {
4928                         SCTP_SOCKET_UNLOCK(so, 1);
4929                 }
4930 #endif
4931         }
4932         return (ret_sz);
4933 }
4934
4935 /*
4936  * checks to see if the given address, sa, is one that is currently known by
4937  * the kernel note: can't distinguish the same address on multiple interfaces
4938  * and doesn't handle multiple addresses with different zone/scope id's note:
4939  * ifa_ifwithaddr() compares the entire sockaddr struct
4940  */
4941 struct sctp_ifa *
4942 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4943     int holds_lock)
4944 {
4945         struct sctp_laddr *laddr;
4946
4947         if (holds_lock == 0) {
4948                 SCTP_INP_RLOCK(inp);
4949         }
4950         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4951                 if (laddr->ifa == NULL)
4952                         continue;
4953                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4954                         continue;
4955 #ifdef INET
4956                 if (addr->sa_family == AF_INET) {
4957                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4958                             laddr->ifa->address.sin.sin_addr.s_addr) {
4959                                 /* found him. */
4960                                 if (holds_lock == 0) {
4961                                         SCTP_INP_RUNLOCK(inp);
4962                                 }
4963                                 return (laddr->ifa);
4964                                 break;
4965                         }
4966                 }
4967 #endif
4968 #ifdef INET6
4969                 if (addr->sa_family == AF_INET6) {
4970                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4971                             &laddr->ifa->address.sin6)) {
4972                                 /* found him. */
4973                                 if (holds_lock == 0) {
4974                                         SCTP_INP_RUNLOCK(inp);
4975                                 }
4976                                 return (laddr->ifa);
4977                                 break;
4978                         }
4979                 }
4980 #endif
4981         }
4982         if (holds_lock == 0) {
4983                 SCTP_INP_RUNLOCK(inp);
4984         }
4985         return (NULL);
4986 }
4987
4988 uint32_t
4989 sctp_get_ifa_hash_val(struct sockaddr *addr)
4990 {
4991         switch (addr->sa_family) {
4992 #ifdef INET
4993         case AF_INET:
4994                 {
4995                         struct sockaddr_in *sin;
4996
4997                         sin = (struct sockaddr_in *)addr;
4998                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
4999                 }
5000 #endif
5001 #ifdef INET6
5002         case INET6:
5003                 {
5004                         struct sockaddr_in6 *sin6;
5005                         uint32_t hash_of_addr;
5006
5007                         sin6 = (struct sockaddr_in6 *)addr;
5008                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
5009                             sin6->sin6_addr.s6_addr32[1] +
5010                             sin6->sin6_addr.s6_addr32[2] +
5011                             sin6->sin6_addr.s6_addr32[3]);
5012                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
5013                         return (hash_of_addr);
5014                 }
5015 #endif
5016         default:
5017                 break;
5018         }
5019         return (0);
5020 }
5021
5022 struct sctp_ifa *
5023 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
5024 {
5025         struct sctp_ifa *sctp_ifap;
5026         struct sctp_vrf *vrf;
5027         struct sctp_ifalist *hash_head;
5028         uint32_t hash_of_addr;
5029
5030         if (holds_lock == 0)
5031                 SCTP_IPI_ADDR_RLOCK();
5032
5033         vrf = sctp_find_vrf(vrf_id);
5034         if (vrf == NULL) {
5035 stage_right:
5036                 if (holds_lock == 0)
5037                         SCTP_IPI_ADDR_RUNLOCK();
5038                 return (NULL);
5039         }
5040         hash_of_addr = sctp_get_ifa_hash_val(addr);
5041
5042         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5043         if (hash_head == NULL) {
5044                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5045                     hash_of_addr, (uint32_t) vrf->vrf_addr_hashmark,
5046                     (uint32_t) (hash_of_addr & vrf->vrf_addr_hashmark));
5047                 sctp_print_address(addr);
5048                 SCTP_PRINTF("No such bucket for address\n");
5049                 if (holds_lock == 0)
5050                         SCTP_IPI_ADDR_RUNLOCK();
5051
5052                 return (NULL);
5053         }
5054         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5055                 if (sctp_ifap == NULL) {
5056 #ifdef INVARIANTS
5057                         panic("Huh LIST_FOREACH corrupt");
5058                         goto stage_right;
5059 #else
5060                         SCTP_PRINTF("LIST corrupt of sctp_ifap's?\n");
5061                         goto stage_right;
5062 #endif
5063                 }
5064                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5065                         continue;
5066 #ifdef INET
5067                 if (addr->sa_family == AF_INET) {
5068                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5069                             sctp_ifap->address.sin.sin_addr.s_addr) {
5070                                 /* found him. */
5071                                 if (holds_lock == 0)
5072                                         SCTP_IPI_ADDR_RUNLOCK();
5073                                 return (sctp_ifap);
5074                                 break;
5075                         }
5076                 }
5077 #endif
5078 #ifdef INET6
5079                 if (addr->sa_family == AF_INET6) {
5080                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5081                             &sctp_ifap->address.sin6)) {
5082                                 /* found him. */
5083                                 if (holds_lock == 0)
5084                                         SCTP_IPI_ADDR_RUNLOCK();
5085                                 return (sctp_ifap);
5086                                 break;
5087                         }
5088                 }
5089 #endif
5090         }
5091         if (holds_lock == 0)
5092                 SCTP_IPI_ADDR_RUNLOCK();
5093         return (NULL);
5094 }
5095
5096 static void
5097 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t * freed_so_far, int hold_rlock,
5098     uint32_t rwnd_req)
5099 {
5100         /* User pulled some data, do we need a rwnd update? */
5101         int r_unlocked = 0;
5102         uint32_t dif, rwnd;
5103         struct socket *so = NULL;
5104
5105         if (stcb == NULL)
5106                 return;
5107
5108         atomic_add_int(&stcb->asoc.refcnt, 1);
5109
5110         if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED |
5111             SCTP_STATE_SHUTDOWN_RECEIVED |
5112             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5113                 /* Pre-check If we are freeing no update */
5114                 goto no_lock;
5115         }
5116         SCTP_INP_INCR_REF(stcb->sctp_ep);
5117         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5118             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5119                 goto out;
5120         }
5121         so = stcb->sctp_socket;
5122         if (so == NULL) {
5123                 goto out;
5124         }
5125         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5126         /* Have you have freed enough to look */
5127         *freed_so_far = 0;
5128         /* Yep, its worth a look and the lock overhead */
5129
5130         /* Figure out what the rwnd would be */
5131         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5132         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5133                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5134         } else {
5135                 dif = 0;
5136         }
5137         if (dif >= rwnd_req) {
5138                 if (hold_rlock) {
5139                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5140                         r_unlocked = 1;
5141                 }
5142                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5143                         /*
5144                          * One last check before we allow the guy possibly
5145                          * to get in. There is a race, where the guy has not
5146                          * reached the gate. In that case
5147                          */
5148                         goto out;
5149                 }
5150                 SCTP_TCB_LOCK(stcb);
5151                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5152                         /* No reports here */
5153                         SCTP_TCB_UNLOCK(stcb);
5154                         goto out;
5155                 }
5156                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5157                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5158
5159                 sctp_chunk_output(stcb->sctp_ep, stcb,
5160                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5161                 /* make sure no timer is running */
5162                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5163                 SCTP_TCB_UNLOCK(stcb);
5164         } else {
5165                 /* Update how much we have pending */
5166                 stcb->freed_by_sorcv_sincelast = dif;
5167         }
5168 out:
5169         if (so && r_unlocked && hold_rlock) {
5170                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5171         }
5172         SCTP_INP_DECR_REF(stcb->sctp_ep);
5173 no_lock:
5174         atomic_add_int(&stcb->asoc.refcnt, -1);
5175         return;
5176 }
5177
5178 int
5179 sctp_sorecvmsg(struct socket *so,
5180     struct uio *uio,
5181     struct mbuf **mp,
5182     struct sockaddr *from,
5183     int fromlen,
5184     int *msg_flags,
5185     struct sctp_sndrcvinfo *sinfo,
5186     int filling_sinfo)
5187 {
5188         /*
5189          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5190          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5191          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5192          * On the way out we may send out any combination of:
5193          * MSG_NOTIFICATION MSG_EOR
5194          *
5195          */
5196         struct sctp_inpcb *inp = NULL;
5197         int my_len = 0;
5198         int cp_len = 0, error = 0;
5199         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5200         struct mbuf *m = NULL;
5201         struct sctp_tcb *stcb = NULL;
5202         int wakeup_read_socket = 0;
5203         int freecnt_applied = 0;
5204         int out_flags = 0, in_flags = 0;
5205         int block_allowed = 1;
5206         uint32_t freed_so_far = 0;
5207         uint32_t copied_so_far = 0;
5208         int in_eeor_mode = 0;
5209         int no_rcv_needed = 0;
5210         uint32_t rwnd_req = 0;
5211         int hold_sblock = 0;
5212         int hold_rlock = 0;
5213         int slen = 0;
5214         uint32_t held_length = 0;
5215         int sockbuf_lock = 0;
5216
5217         if (uio == NULL) {
5218                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5219                 return (EINVAL);
5220         }
5221         if (msg_flags) {
5222                 in_flags = *msg_flags;
5223                 if (in_flags & MSG_PEEK)
5224                         SCTP_STAT_INCR(sctps_read_peeks);
5225         } else {
5226                 in_flags = 0;
5227         }
5228         slen = uio->uio_resid;
5229
5230         /* Pull in and set up our int flags */
5231         if (in_flags & MSG_OOB) {
5232                 /* Out of band's NOT supported */
5233                 return (EOPNOTSUPP);
5234         }
5235         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5236                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5237                 return (EINVAL);
5238         }
5239         if ((in_flags & (MSG_DONTWAIT
5240             | MSG_NBIO
5241             )) ||
5242             SCTP_SO_IS_NBIO(so)) {
5243                 block_allowed = 0;
5244         }
5245         /* setup the endpoint */
5246         inp = (struct sctp_inpcb *)so->so_pcb;
5247         if (inp == NULL) {
5248                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5249                 return (EFAULT);
5250         }
5251         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5252         /* Must be at least a MTU's worth */
5253         if (rwnd_req < SCTP_MIN_RWND)
5254                 rwnd_req = SCTP_MIN_RWND;
5255         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5256         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5257                 sctp_misc_ints(SCTP_SORECV_ENTER,
5258                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid);
5259         }
5260         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5261                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5262                     rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid);
5263         }
5264         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5265         sockbuf_lock = 1;
5266         if (error) {
5267                 goto release_unlocked;
5268         }
5269 restart:
5270
5271
5272 restart_nosblocks:
5273         if (hold_sblock == 0) {
5274                 SOCKBUF_LOCK(&so->so_rcv);
5275                 hold_sblock = 1;
5276         }
5277         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5278             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5279                 goto out;
5280         }
5281         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5282                 if (so->so_error) {
5283                         error = so->so_error;
5284                         if ((in_flags & MSG_PEEK) == 0)
5285                                 so->so_error = 0;
5286                         goto out;
5287                 } else {
5288                         if (so->so_rcv.sb_cc == 0) {
5289                                 /* indicate EOF */
5290                                 error = 0;
5291                                 goto out;
5292                         }
5293                 }
5294         }
5295         if ((so->so_rcv.sb_cc <= held_length) && block_allowed) {
5296                 /* we need to wait for data */
5297                 if ((so->so_rcv.sb_cc == 0) &&
5298                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5299                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5300                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5301                                 /*
5302                                  * For active open side clear flags for
5303                                  * re-use passive open is blocked by
5304                                  * connect.
5305                                  */
5306                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5307                                         /*
5308                                          * You were aborted, passive side
5309                                          * always hits here
5310                                          */
5311                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5312                                         error = ECONNRESET;
5313                                 }
5314                                 so->so_state &= ~(SS_ISCONNECTING |
5315                                     SS_ISDISCONNECTING |
5316                                     SS_ISCONFIRMING |
5317                                     SS_ISCONNECTED);
5318                                 if (error == 0) {
5319                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5320                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5321                                                 error = ENOTCONN;
5322                                         }
5323                                 }
5324                                 goto out;
5325                         }
5326                 }
5327                 error = sbwait(&so->so_rcv);
5328                 if (error) {
5329                         goto out;
5330                 }
5331                 held_length = 0;
5332                 goto restart_nosblocks;
5333         } else if (so->so_rcv.sb_cc == 0) {
5334                 if (so->so_error) {
5335                         error = so->so_error;
5336                         if ((in_flags & MSG_PEEK) == 0)
5337                                 so->so_error = 0;
5338                 } else {
5339                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5340                             (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5341                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5342                                         /*
5343                                          * For active open side clear flags
5344                                          * for re-use passive open is
5345                                          * blocked by connect.
5346                                          */
5347                                         if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5348                                                 /*
5349                                                  * You were aborted, passive
5350                                                  * side always hits here
5351                                                  */
5352                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5353                                                 error = ECONNRESET;
5354                                         }
5355                                         so->so_state &= ~(SS_ISCONNECTING |
5356                                             SS_ISDISCONNECTING |
5357                                             SS_ISCONFIRMING |
5358                                             SS_ISCONNECTED);
5359                                         if (error == 0) {
5360                                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5361                                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5362                                                         error = ENOTCONN;
5363                                                 }
5364                                         }
5365                                         goto out;
5366                                 }
5367                         }
5368                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5369                         error = EWOULDBLOCK;
5370                 }
5371                 goto out;
5372         }
5373         if (hold_sblock == 1) {
5374                 SOCKBUF_UNLOCK(&so->so_rcv);
5375                 hold_sblock = 0;
5376         }
5377         /* we possibly have data we can read */
5378         /* sa_ignore FREED_MEMORY */
5379         control = TAILQ_FIRST(&inp->read_queue);
5380         if (control == NULL) {
5381                 /*
5382                  * This could be happening since the appender did the
5383                  * increment but as not yet did the tailq insert onto the
5384                  * read_queue
5385                  */
5386                 if (hold_rlock == 0) {
5387                         SCTP_INP_READ_LOCK(inp);
5388                 }
5389                 control = TAILQ_FIRST(&inp->read_queue);
5390                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5391 #ifdef INVARIANTS
5392                         panic("Huh, its non zero and nothing on control?");
5393 #endif
5394                         so->so_rcv.sb_cc = 0;
5395                 }
5396                 SCTP_INP_READ_UNLOCK(inp);
5397                 hold_rlock = 0;
5398                 goto restart;
5399         }
5400         if ((control->length == 0) &&
5401             (control->do_not_ref_stcb)) {
5402                 /*
5403                  * Clean up code for freeing assoc that left behind a
5404                  * pdapi.. maybe a peer in EEOR that just closed after
5405                  * sending and never indicated a EOR.
5406                  */
5407                 if (hold_rlock == 0) {
5408                         hold_rlock = 1;
5409                         SCTP_INP_READ_LOCK(inp);
5410                 }
5411                 control->held_length = 0;
5412                 if (control->data) {
5413                         /* Hmm there is data here .. fix */
5414                         struct mbuf *m_tmp;
5415                         int cnt = 0;
5416
5417                         m_tmp = control->data;
5418                         while (m_tmp) {
5419                                 cnt += SCTP_BUF_LEN(m_tmp);
5420                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5421                                         control->tail_mbuf = m_tmp;
5422                                         control->end_added = 1;
5423                                 }
5424                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5425                         }
5426                         control->length = cnt;
5427                 } else {
5428                         /* remove it */
5429                         TAILQ_REMOVE(&inp->read_queue, control, next);
5430                         /* Add back any hiddend data */
5431                         sctp_free_remote_addr(control->whoFrom);
5432                         sctp_free_a_readq(stcb, control);
5433                 }
5434                 if (hold_rlock) {
5435                         hold_rlock = 0;
5436                         SCTP_INP_READ_UNLOCK(inp);
5437                 }
5438                 goto restart;
5439         }
5440         if ((control->length == 0) &&
5441             (control->end_added == 1)) {
5442                 /*
5443                  * Do we also need to check for (control->pdapi_aborted ==
5444                  * 1)?
5445                  */
5446                 if (hold_rlock == 0) {
5447                         hold_rlock = 1;
5448                         SCTP_INP_READ_LOCK(inp);
5449                 }
5450                 TAILQ_REMOVE(&inp->read_queue, control, next);
5451                 if (control->data) {
5452 #ifdef INVARIANTS
5453                         panic("control->data not null but control->length == 0");
5454 #else
5455                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5456                         sctp_m_freem(control->data);
5457                         control->data = NULL;
5458 #endif
5459                 }
5460                 if (control->aux_data) {
5461                         sctp_m_free(control->aux_data);
5462                         control->aux_data = NULL;
5463                 }
5464                 sctp_free_remote_addr(control->whoFrom);
5465                 sctp_free_a_readq(stcb, control);
5466                 if (hold_rlock) {
5467                         hold_rlock = 0;
5468                         SCTP_INP_READ_UNLOCK(inp);
5469                 }
5470                 goto restart;
5471         }
5472         if (control->length == 0) {
5473                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5474                     (filling_sinfo)) {
5475                         /* find a more suitable one then this */
5476                         ctl = TAILQ_NEXT(control, next);
5477                         while (ctl) {
5478                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5479                                     (ctl->some_taken ||
5480                                     (ctl->spec_flags & M_NOTIFICATION) ||
5481                                     ((ctl->do_not_ref_stcb == 0) &&
5482                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5483                                     ) {
5484                                         /*-
5485                                          * If we have a different TCB next, and there is data
5486                                          * present. If we have already taken some (pdapi), OR we can
5487                                          * ref the tcb and no delivery as started on this stream, we
5488                                          * take it. Note we allow a notification on a different
5489                                          * assoc to be delivered..
5490                                          */
5491                                         control = ctl;
5492                                         goto found_one;
5493                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5494                                             (ctl->length) &&
5495                                             ((ctl->some_taken) ||
5496                                             ((ctl->do_not_ref_stcb == 0) &&
5497                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5498                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5499                                         /*-
5500                                          * If we have the same tcb, and there is data present, and we
5501                                          * have the strm interleave feature present. Then if we have
5502                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5503                                          * not started a delivery for this stream, we can take it.
5504                                          * Note we do NOT allow a notificaiton on the same assoc to
5505                                          * be delivered.
5506                                          */
5507                                         control = ctl;
5508                                         goto found_one;
5509                                 }
5510                                 ctl = TAILQ_NEXT(ctl, next);
5511                         }
5512                 }
5513                 /*
5514                  * if we reach here, not suitable replacement is available
5515                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5516                  * into the our held count, and its time to sleep again.
5517                  */
5518                 held_length = so->so_rcv.sb_cc;
5519                 control->held_length = so->so_rcv.sb_cc;
5520                 goto restart;
5521         }
5522         /* Clear the held length since there is something to read */
5523         control->held_length = 0;
5524         if (hold_rlock) {
5525                 SCTP_INP_READ_UNLOCK(inp);
5526                 hold_rlock = 0;
5527         }
5528 found_one:
5529         /*
5530          * If we reach here, control has a some data for us to read off.
5531          * Note that stcb COULD be NULL.
5532          */
5533         control->some_taken++;
5534         if (hold_sblock) {
5535                 SOCKBUF_UNLOCK(&so->so_rcv);
5536                 hold_sblock = 0;
5537         }
5538         stcb = control->stcb;
5539         if (stcb) {
5540                 if ((control->do_not_ref_stcb == 0) &&
5541                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5542                         if (freecnt_applied == 0)
5543                                 stcb = NULL;
5544                 } else if (control->do_not_ref_stcb == 0) {
5545                         /* you can't free it on me please */
5546                         /*
5547                          * The lock on the socket buffer protects us so the
5548                          * free code will stop. But since we used the
5549                          * socketbuf lock and the sender uses the tcb_lock
5550                          * to increment, we need to use the atomic add to
5551                          * the refcnt
5552                          */
5553                         if (freecnt_applied) {
5554 #ifdef INVARIANTS
5555                                 panic("refcnt already incremented");
5556 #else
5557                                 SCTP_PRINTF("refcnt already incremented?\n");
5558 #endif
5559                         } else {
5560                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5561                                 freecnt_applied = 1;
5562                         }
5563                         /*
5564                          * Setup to remember how much we have not yet told
5565                          * the peer our rwnd has opened up. Note we grab the
5566                          * value from the tcb from last time. Note too that
5567                          * sack sending clears this when a sack is sent,
5568                          * which is fine. Once we hit the rwnd_req, we then
5569                          * will go to the sctp_user_rcvd() that will not
5570                          * lock until it KNOWs it MUST send a WUP-SACK.
5571                          */
5572                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5573                         stcb->freed_by_sorcv_sincelast = 0;
5574                 }
5575         }
5576         if (stcb &&
5577             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5578             control->do_not_ref_stcb == 0) {
5579                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5580         }
5581         /* First lets get off the sinfo and sockaddr info */
5582         if ((sinfo) && filling_sinfo) {
5583                 memcpy(sinfo, control, sizeof(struct sctp_nonpad_sndrcvinfo));
5584                 nxt = TAILQ_NEXT(control, next);
5585                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5586                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5587                         struct sctp_extrcvinfo *s_extra;
5588
5589                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5590                         if ((nxt) &&
5591                             (nxt->length)) {
5592                                 s_extra->sreinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5593                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5594                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5595                                 }
5596                                 if (nxt->spec_flags & M_NOTIFICATION) {
5597                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5598                                 }
5599                                 s_extra->sreinfo_next_aid = nxt->sinfo_assoc_id;
5600                                 s_extra->sreinfo_next_length = nxt->length;
5601                                 s_extra->sreinfo_next_ppid = nxt->sinfo_ppid;
5602                                 s_extra->sreinfo_next_stream = nxt->sinfo_stream;
5603                                 if (nxt->tail_mbuf != NULL) {
5604                                         if (nxt->end_added) {
5605                                                 s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5606                                         }
5607                                 }
5608                         } else {
5609                                 /*
5610                                  * we explicitly 0 this, since the memcpy
5611                                  * got some other things beyond the older
5612                                  * sinfo_ that is on the control's structure
5613                                  * :-D
5614                                  */
5615                                 nxt = NULL;
5616                                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
5617                                 s_extra->sreinfo_next_aid = 0;
5618                                 s_extra->sreinfo_next_length = 0;
5619                                 s_extra->sreinfo_next_ppid = 0;
5620                                 s_extra->sreinfo_next_stream = 0;
5621                         }
5622                 }
5623                 /*
5624                  * update off the real current cum-ack, if we have an stcb.
5625                  */
5626                 if ((control->do_not_ref_stcb == 0) && stcb)
5627                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5628                 /*
5629                  * mask off the high bits, we keep the actual chunk bits in
5630                  * there.
5631                  */
5632                 sinfo->sinfo_flags &= 0x00ff;
5633                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5634                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5635                 }
5636         }
5637 #ifdef SCTP_ASOCLOG_OF_TSNS
5638         {
5639                 int index, newindex;
5640                 struct sctp_pcbtsn_rlog *entry;
5641
5642                 do {
5643                         index = inp->readlog_index;
5644                         newindex = index + 1;
5645                         if (newindex >= SCTP_READ_LOG_SIZE) {
5646                                 newindex = 0;
5647                         }
5648                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5649                 entry = &inp->readlog[index];
5650                 entry->vtag = control->sinfo_assoc_id;
5651                 entry->strm = control->sinfo_stream;
5652                 entry->seq = control->sinfo_ssn;
5653                 entry->sz = control->length;
5654                 entry->flgs = control->sinfo_flags;
5655         }
5656 #endif
5657         if (fromlen && from) {
5658                 cp_len = min((size_t)fromlen, (size_t)control->whoFrom->ro._l_addr.sa.sa_len);
5659                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5660 #ifdef INET6
5661                 case AF_INET6:
5662                         ((struct sockaddr_in6 *)from)->sin6_port = control->port_from;
5663                         break;
5664 #endif
5665 #ifdef INET
5666                 case AF_INET:
5667                         ((struct sockaddr_in *)from)->sin_port = control->port_from;
5668                         break;
5669 #endif
5670                 default:
5671                         break;
5672                 }
5673                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
5674
5675 #if defined(INET) && defined(INET6)
5676                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) &&
5677                     (from->sa_family == AF_INET) &&
5678                     ((size_t)fromlen >= sizeof(struct sockaddr_in6))) {
5679                         struct sockaddr_in *sin;
5680                         struct sockaddr_in6 sin6;
5681
5682                         sin = (struct sockaddr_in *)from;
5683                         bzero(&sin6, sizeof(sin6));
5684                         sin6.sin6_family = AF_INET6;
5685                         sin6.sin6_len = sizeof(struct sockaddr_in6);
5686                         sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
5687                         bcopy(&sin->sin_addr,
5688                             &sin6.sin6_addr.s6_addr32[3],
5689                             sizeof(sin6.sin6_addr.s6_addr32[3]));
5690                         sin6.sin6_port = sin->sin_port;
5691                         memcpy(from, &sin6, sizeof(struct sockaddr_in6));
5692                 }
5693 #endif
5694 #ifdef INET6
5695                 {
5696                         struct sockaddr_in6 lsa6, *from6;
5697
5698                         from6 = (struct sockaddr_in6 *)from;
5699                         sctp_recover_scope_mac(from6, (&lsa6));
5700                 }
5701 #endif
5702         }
5703         /* now copy out what data we can */
5704         if (mp == NULL) {
5705                 /* copy out each mbuf in the chain up to length */
5706 get_more_data:
5707                 m = control->data;
5708                 while (m) {
5709                         /* Move out all we can */
5710                         cp_len = (int)uio->uio_resid;
5711                         my_len = (int)SCTP_BUF_LEN(m);
5712                         if (cp_len > my_len) {
5713                                 /* not enough in this buf */
5714                                 cp_len = my_len;
5715                         }
5716                         if (hold_rlock) {
5717                                 SCTP_INP_READ_UNLOCK(inp);
5718                                 hold_rlock = 0;
5719                         }
5720                         if (cp_len > 0)
5721                                 error = uiomove(mtod(m, char *), cp_len, uio);
5722                         /* re-read */
5723                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5724                                 goto release;
5725                         }
5726                         if ((control->do_not_ref_stcb == 0) && stcb &&
5727                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5728                                 no_rcv_needed = 1;
5729                         }
5730                         if (error) {
5731                                 /* error we are out of here */
5732                                 goto release;
5733                         }
5734                         if ((SCTP_BUF_NEXT(m) == NULL) &&
5735                             (cp_len >= SCTP_BUF_LEN(m)) &&
5736                             ((control->end_added == 0) ||
5737                             (control->end_added &&
5738                             (TAILQ_NEXT(control, next) == NULL)))
5739                             ) {
5740                                 SCTP_INP_READ_LOCK(inp);
5741                                 hold_rlock = 1;
5742                         }
5743                         if (cp_len == SCTP_BUF_LEN(m)) {
5744                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5745                                     (control->end_added)) {
5746                                         out_flags |= MSG_EOR;
5747                                         if ((control->do_not_ref_stcb == 0) &&
5748                                             (control->stcb != NULL) &&
5749                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5750                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5751                                 }
5752                                 if (control->spec_flags & M_NOTIFICATION) {
5753                                         out_flags |= MSG_NOTIFICATION;
5754                                 }
5755                                 /* we ate up the mbuf */
5756                                 if (in_flags & MSG_PEEK) {
5757                                         /* just looking */
5758                                         m = SCTP_BUF_NEXT(m);
5759                                         copied_so_far += cp_len;
5760                                 } else {
5761                                         /* dispose of the mbuf */
5762                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5763                                                 sctp_sblog(&so->so_rcv,
5764                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5765                                         }
5766                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5767                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5768                                                 sctp_sblog(&so->so_rcv,
5769                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5770                                         }
5771                                         copied_so_far += cp_len;
5772                                         freed_so_far += cp_len;
5773                                         freed_so_far += MSIZE;
5774                                         atomic_subtract_int(&control->length, cp_len);
5775                                         control->data = sctp_m_free(m);
5776                                         m = control->data;
5777                                         /*
5778                                          * been through it all, must hold sb
5779                                          * lock ok to null tail
5780                                          */
5781                                         if (control->data == NULL) {
5782 #ifdef INVARIANTS
5783                                                 if ((control->end_added == 0) ||
5784                                                     (TAILQ_NEXT(control, next) == NULL)) {
5785                                                         /*
5786                                                          * If the end is not
5787                                                          * added, OR the
5788                                                          * next is NOT null
5789                                                          * we MUST have the
5790                                                          * lock.
5791                                                          */
5792                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5793                                                                 panic("Hmm we don't own the lock?");
5794                                                         }
5795                                                 }
5796 #endif
5797                                                 control->tail_mbuf = NULL;
5798 #ifdef INVARIANTS
5799                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5800                                                         panic("end_added, nothing left and no MSG_EOR");
5801                                                 }
5802 #endif
5803                                         }
5804                                 }
5805                         } else {
5806                                 /* Do we need to trim the mbuf? */
5807                                 if (control->spec_flags & M_NOTIFICATION) {
5808                                         out_flags |= MSG_NOTIFICATION;
5809                                 }
5810                                 if ((in_flags & MSG_PEEK) == 0) {
5811                                         SCTP_BUF_RESV_UF(m, cp_len);
5812                                         SCTP_BUF_LEN(m) -= cp_len;
5813                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5814                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5815                                         }
5816                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5817                                         if ((control->do_not_ref_stcb == 0) &&
5818                                             stcb) {
5819                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5820                                         }
5821                                         copied_so_far += cp_len;
5822                                         freed_so_far += cp_len;
5823                                         freed_so_far += MSIZE;
5824                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5825                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5826                                                     SCTP_LOG_SBRESULT, 0);
5827                                         }
5828                                         atomic_subtract_int(&control->length, cp_len);
5829                                 } else {
5830                                         copied_so_far += cp_len;
5831                                 }
5832                         }
5833                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5834                                 break;
5835                         }
5836                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5837                             (control->do_not_ref_stcb == 0) &&
5838                             (freed_so_far >= rwnd_req)) {
5839                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5840                         }
5841                 }               /* end while(m) */
5842                 /*
5843                  * At this point we have looked at it all and we either have
5844                  * a MSG_EOR/or read all the user wants... <OR>
5845                  * control->length == 0.
5846                  */
5847                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5848                         /* we are done with this control */
5849                         if (control->length == 0) {
5850                                 if (control->data) {
5851 #ifdef INVARIANTS
5852                                         panic("control->data not null at read eor?");
5853 #else
5854                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5855                                         sctp_m_freem(control->data);
5856                                         control->data = NULL;
5857 #endif
5858                                 }
5859                 done_with_control:
5860                                 if (TAILQ_NEXT(control, next) == NULL) {
5861                                         /*
5862                                          * If we don't have a next we need a
5863                                          * lock, if there is a next
5864                                          * interrupt is filling ahead of us
5865                                          * and we don't need a lock to
5866                                          * remove this guy (which is the
5867                                          * head of the queue).
5868                                          */
5869                                         if (hold_rlock == 0) {
5870                                                 SCTP_INP_READ_LOCK(inp);
5871                                                 hold_rlock = 1;
5872                                         }
5873                                 }
5874                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5875                                 /* Add back any hiddend data */
5876                                 if (control->held_length) {
5877                                         held_length = 0;
5878                                         control->held_length = 0;
5879                                         wakeup_read_socket = 1;
5880                                 }
5881                                 if (control->aux_data) {
5882                                         sctp_m_free(control->aux_data);
5883                                         control->aux_data = NULL;
5884                                 }
5885                                 no_rcv_needed = control->do_not_ref_stcb;
5886                                 sctp_free_remote_addr(control->whoFrom);
5887                                 control->data = NULL;
5888                                 sctp_free_a_readq(stcb, control);
5889                                 control = NULL;
5890                                 if ((freed_so_far >= rwnd_req) &&
5891                                     (no_rcv_needed == 0))
5892                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5893
5894                         } else {
5895                                 /*
5896                                  * The user did not read all of this
5897                                  * message, turn off the returned MSG_EOR
5898                                  * since we are leaving more behind on the
5899                                  * control to read.
5900                                  */
5901 #ifdef INVARIANTS
5902                                 if (control->end_added &&
5903                                     (control->data == NULL) &&
5904                                     (control->tail_mbuf == NULL)) {
5905                                         panic("Gak, control->length is corrupt?");
5906                                 }
5907 #endif
5908                                 no_rcv_needed = control->do_not_ref_stcb;
5909                                 out_flags &= ~MSG_EOR;
5910                         }
5911                 }
5912                 if (out_flags & MSG_EOR) {
5913                         goto release;
5914                 }
5915                 if ((uio->uio_resid == 0) ||
5916                     ((in_eeor_mode) && (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))
5917                     ) {
5918                         goto release;
5919                 }
5920                 /*
5921                  * If I hit here the receiver wants more and this message is
5922                  * NOT done (pd-api). So two questions. Can we block? if not
5923                  * we are done. Did the user NOT set MSG_WAITALL?
5924                  */
5925                 if (block_allowed == 0) {
5926                         goto release;
5927                 }
5928                 /*
5929                  * We need to wait for more data a few things: - We don't
5930                  * sbunlock() so we don't get someone else reading. - We
5931                  * must be sure to account for the case where what is added
5932                  * is NOT to our control when we wakeup.
5933                  */
5934
5935                 /*
5936                  * Do we need to tell the transport a rwnd update might be
5937                  * needed before we go to sleep?
5938                  */
5939                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5940                     ((freed_so_far >= rwnd_req) &&
5941                     (control->do_not_ref_stcb == 0) &&
5942                     (no_rcv_needed == 0))) {
5943                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5944                 }
5945 wait_some_more:
5946                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5947                         goto release;
5948                 }
5949                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5950                         goto release;
5951
5952                 if (hold_rlock == 1) {
5953                         SCTP_INP_READ_UNLOCK(inp);
5954                         hold_rlock = 0;
5955                 }
5956                 if (hold_sblock == 0) {
5957                         SOCKBUF_LOCK(&so->so_rcv);
5958                         hold_sblock = 1;
5959                 }
5960                 if ((copied_so_far) && (control->length == 0) &&
5961                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5962                         goto release;
5963                 }
5964                 if (so->so_rcv.sb_cc <= control->held_length) {
5965                         error = sbwait(&so->so_rcv);
5966                         if (error) {
5967                                 goto release;
5968                         }
5969                         control->held_length = 0;
5970                 }
5971                 if (hold_sblock) {
5972                         SOCKBUF_UNLOCK(&so->so_rcv);
5973                         hold_sblock = 0;
5974                 }
5975                 if (control->length == 0) {
5976                         /* still nothing here */
5977                         if (control->end_added == 1) {
5978                                 /* he aborted, or is done i.e.did a shutdown */
5979                                 out_flags |= MSG_EOR;
5980                                 if (control->pdapi_aborted) {
5981                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5982                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5983
5984                                         out_flags |= MSG_TRUNC;
5985                                 } else {
5986                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5987                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5988                                 }
5989                                 goto done_with_control;
5990                         }
5991                         if (so->so_rcv.sb_cc > held_length) {
5992                                 control->held_length = so->so_rcv.sb_cc;
5993                                 held_length = 0;
5994                         }
5995                         goto wait_some_more;
5996                 } else if (control->data == NULL) {
5997                         /*
5998                          * we must re-sync since data is probably being
5999                          * added
6000                          */
6001                         SCTP_INP_READ_LOCK(inp);
6002                         if ((control->length > 0) && (control->data == NULL)) {
6003                                 /*
6004                                  * big trouble.. we have the lock and its
6005                                  * corrupt?
6006                                  */
6007 #ifdef INVARIANTS
6008                                 panic("Impossible data==NULL length !=0");
6009 #endif
6010                                 out_flags |= MSG_EOR;
6011                                 out_flags |= MSG_TRUNC;
6012                                 control->length = 0;
6013                                 SCTP_INP_READ_UNLOCK(inp);
6014                                 goto done_with_control;
6015                         }
6016                         SCTP_INP_READ_UNLOCK(inp);
6017                         /* We will fall around to get more data */
6018                 }
6019                 goto get_more_data;
6020         } else {
6021                 /*-
6022                  * Give caller back the mbuf chain,
6023                  * store in uio_resid the length
6024                  */
6025                 wakeup_read_socket = 0;
6026                 if ((control->end_added == 0) ||
6027                     (TAILQ_NEXT(control, next) == NULL)) {
6028                         /* Need to get rlock */
6029                         if (hold_rlock == 0) {
6030                                 SCTP_INP_READ_LOCK(inp);
6031                                 hold_rlock = 1;
6032                         }
6033                 }
6034                 if (control->end_added) {
6035                         out_flags |= MSG_EOR;
6036                         if ((control->do_not_ref_stcb == 0) &&
6037                             (control->stcb != NULL) &&
6038                             ((control->spec_flags & M_NOTIFICATION) == 0))
6039                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6040                 }
6041                 if (control->spec_flags & M_NOTIFICATION) {
6042                         out_flags |= MSG_NOTIFICATION;
6043                 }
6044                 uio->uio_resid = control->length;
6045                 *mp = control->data;
6046                 m = control->data;
6047                 while (m) {
6048                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6049                                 sctp_sblog(&so->so_rcv,
6050                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6051                         }
6052                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6053                         freed_so_far += SCTP_BUF_LEN(m);
6054                         freed_so_far += MSIZE;
6055                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6056                                 sctp_sblog(&so->so_rcv,
6057                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6058                         }
6059                         m = SCTP_BUF_NEXT(m);
6060                 }
6061                 control->data = control->tail_mbuf = NULL;
6062                 control->length = 0;
6063                 if (out_flags & MSG_EOR) {
6064                         /* Done with this control */
6065                         goto done_with_control;
6066                 }
6067         }
6068 release:
6069         if (hold_rlock == 1) {
6070                 SCTP_INP_READ_UNLOCK(inp);
6071                 hold_rlock = 0;
6072         }
6073         if (hold_sblock == 1) {
6074                 SOCKBUF_UNLOCK(&so->so_rcv);
6075                 hold_sblock = 0;
6076         }
6077         sbunlock(&so->so_rcv);
6078         sockbuf_lock = 0;
6079
6080 release_unlocked:
6081         if (hold_sblock) {
6082                 SOCKBUF_UNLOCK(&so->so_rcv);
6083                 hold_sblock = 0;
6084         }
6085         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6086                 if ((freed_so_far >= rwnd_req) &&
6087                     (control && (control->do_not_ref_stcb == 0)) &&
6088                     (no_rcv_needed == 0))
6089                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6090         }
6091 out:
6092         if (msg_flags) {
6093                 *msg_flags = out_flags;
6094         }
6095         if (((out_flags & MSG_EOR) == 0) &&
6096             ((in_flags & MSG_PEEK) == 0) &&
6097             (sinfo) &&
6098             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6099             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6100                 struct sctp_extrcvinfo *s_extra;
6101
6102                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6103                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
6104         }
6105         if (hold_rlock == 1) {
6106                 SCTP_INP_READ_UNLOCK(inp);
6107         }
6108         if (hold_sblock) {
6109                 SOCKBUF_UNLOCK(&so->so_rcv);
6110         }
6111         if (sockbuf_lock) {
6112                 sbunlock(&so->so_rcv);
6113         }
6114         if (freecnt_applied) {
6115                 /*
6116                  * The lock on the socket buffer protects us so the free
6117                  * code will stop. But since we used the socketbuf lock and
6118                  * the sender uses the tcb_lock to increment, we need to use
6119                  * the atomic add to the refcnt.
6120                  */
6121                 if (stcb == NULL) {
6122 #ifdef INVARIANTS
6123                         panic("stcb for refcnt has gone NULL?");
6124                         goto stage_left;
6125 #else
6126                         goto stage_left;
6127 #endif
6128                 }
6129                 atomic_add_int(&stcb->asoc.refcnt, -1);
6130                 /* Save the value back for next time */
6131                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6132         }
6133         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6134                 if (stcb) {
6135                         sctp_misc_ints(SCTP_SORECV_DONE,
6136                             freed_so_far,
6137                             ((uio) ? (slen - uio->uio_resid) : slen),
6138                             stcb->asoc.my_rwnd,
6139                             so->so_rcv.sb_cc);
6140                 } else {
6141                         sctp_misc_ints(SCTP_SORECV_DONE,
6142                             freed_so_far,
6143                             ((uio) ? (slen - uio->uio_resid) : slen),
6144                             0,
6145                             so->so_rcv.sb_cc);
6146                 }
6147         }
6148 stage_left:
6149         if (wakeup_read_socket) {
6150                 sctp_sorwakeup(inp, so);
6151         }
6152         return (error);
6153 }
6154
6155
6156 #ifdef SCTP_MBUF_LOGGING
6157 struct mbuf *
6158 sctp_m_free(struct mbuf *m)
6159 {
6160         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6161                 if (SCTP_BUF_IS_EXTENDED(m)) {
6162                         sctp_log_mb(m, SCTP_MBUF_IFREE);
6163                 }
6164         }
6165         return (m_free(m));
6166 }
6167
6168 void
6169 sctp_m_freem(struct mbuf *mb)
6170 {
6171         while (mb != NULL)
6172                 mb = sctp_m_free(mb);
6173 }
6174
6175 #endif
6176
6177 int
6178 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6179 {
6180         /*
6181          * Given a local address. For all associations that holds the
6182          * address, request a peer-set-primary.
6183          */
6184         struct sctp_ifa *ifa;
6185         struct sctp_laddr *wi;
6186
6187         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6188         if (ifa == NULL) {
6189                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6190                 return (EADDRNOTAVAIL);
6191         }
6192         /*
6193          * Now that we have the ifa we must awaken the iterator with this
6194          * message.
6195          */
6196         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6197         if (wi == NULL) {
6198                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6199                 return (ENOMEM);
6200         }
6201         /* Now incr the count and int wi structure */
6202         SCTP_INCR_LADDR_COUNT();
6203         bzero(wi, sizeof(*wi));
6204         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6205         wi->ifa = ifa;
6206         wi->action = SCTP_SET_PRIM_ADDR;
6207         atomic_add_int(&ifa->refcount, 1);
6208
6209         /* Now add it to the work queue */
6210         SCTP_WQ_ADDR_LOCK();
6211         /*
6212          * Should this really be a tailq? As it is we will process the
6213          * newest first :-0
6214          */
6215         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6216         SCTP_WQ_ADDR_UNLOCK();
6217         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6218             (struct sctp_inpcb *)NULL,
6219             (struct sctp_tcb *)NULL,
6220             (struct sctp_nets *)NULL);
6221         return (0);
6222 }
6223
6224
6225 int
6226 sctp_soreceive(struct socket *so,
6227     struct sockaddr **psa,
6228     struct uio *uio,
6229     struct mbuf **mp0,
6230     struct mbuf **controlp,
6231     int *flagsp)
6232 {
6233         int error, fromlen;
6234         uint8_t sockbuf[256];
6235         struct sockaddr *from;
6236         struct sctp_extrcvinfo sinfo;
6237         int filling_sinfo = 1;
6238         struct sctp_inpcb *inp;
6239
6240         inp = (struct sctp_inpcb *)so->so_pcb;
6241         /* pickup the assoc we are reading from */
6242         if (inp == NULL) {
6243                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6244                 return (EINVAL);
6245         }
6246         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6247             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6248             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6249             (controlp == NULL)) {
6250                 /* user does not want the sndrcv ctl */
6251                 filling_sinfo = 0;
6252         }
6253         if (psa) {
6254                 from = (struct sockaddr *)sockbuf;
6255                 fromlen = sizeof(sockbuf);
6256                 from->sa_len = 0;
6257         } else {
6258                 from = NULL;
6259                 fromlen = 0;
6260         }
6261
6262         if (filling_sinfo) {
6263                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6264         }
6265         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
6266             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6267         if (controlp != NULL) {
6268                 /* copy back the sinfo in a CMSG format */
6269                 if (filling_sinfo)
6270                         *controlp = sctp_build_ctl_nchunk(inp,
6271                             (struct sctp_sndrcvinfo *)&sinfo);
6272                 else
6273                         *controlp = NULL;
6274         }
6275         if (psa) {
6276                 /* copy back the address info */
6277                 if (from && from->sa_len) {
6278                         *psa = sodupsockaddr(from, M_NOWAIT);
6279                 } else {
6280                         *psa = NULL;
6281                 }
6282         }
6283         return (error);
6284 }
6285
6286
6287
6288
6289
6290 int
6291 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6292     int totaddr, int *error)
6293 {
6294         int added = 0;
6295         int i;
6296         struct sctp_inpcb *inp;
6297         struct sockaddr *sa;
6298         size_t incr = 0;
6299
6300 #ifdef INET
6301         struct sockaddr_in *sin;
6302
6303 #endif
6304 #ifdef INET6
6305         struct sockaddr_in6 *sin6;
6306
6307 #endif
6308
6309         sa = addr;
6310         inp = stcb->sctp_ep;
6311         *error = 0;
6312         for (i = 0; i < totaddr; i++) {
6313                 switch (sa->sa_family) {
6314 #ifdef INET
6315                 case AF_INET:
6316                         incr = sizeof(struct sockaddr_in);
6317                         sin = (struct sockaddr_in *)sa;
6318                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6319                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6320                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6321                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6322                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6323                                 *error = EINVAL;
6324                                 goto out_now;
6325                         }
6326                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6327                                 /* assoc gone no un-lock */
6328                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6329                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6330                                 *error = ENOBUFS;
6331                                 goto out_now;
6332                         }
6333                         added++;
6334                         break;
6335 #endif
6336 #ifdef INET6
6337                 case AF_INET6:
6338                         incr = sizeof(struct sockaddr_in6);
6339                         sin6 = (struct sockaddr_in6 *)sa;
6340                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6341                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6342                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6343                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6344                                 *error = EINVAL;
6345                                 goto out_now;
6346                         }
6347                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6348                                 /* assoc gone no un-lock */
6349                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6350                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6351                                 *error = ENOBUFS;
6352                                 goto out_now;
6353                         }
6354                         added++;
6355                         break;
6356 #endif
6357                 default:
6358                         break;
6359                 }
6360                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6361         }
6362 out_now:
6363         return (added);
6364 }
6365
6366 struct sctp_tcb *
6367 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6368     int *totaddr, int *num_v4, int *num_v6, int *error,
6369     int limit, int *bad_addr)
6370 {
6371         struct sockaddr *sa;
6372         struct sctp_tcb *stcb = NULL;
6373         size_t incr, at, i;
6374
6375         at = incr = 0;
6376         sa = addr;
6377
6378         *error = *num_v6 = *num_v4 = 0;
6379         /* account and validate addresses */
6380         for (i = 0; i < (size_t)*totaddr; i++) {
6381                 switch (sa->sa_family) {
6382 #ifdef INET
6383                 case AF_INET:
6384                         (*num_v4) += 1;
6385                         incr = sizeof(struct sockaddr_in);
6386                         if (sa->sa_len != incr) {
6387                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6388                                 *error = EINVAL;
6389                                 *bad_addr = 1;
6390                                 return (NULL);
6391                         }
6392                         break;
6393 #endif
6394 #ifdef INET6
6395                 case AF_INET6:
6396                         {
6397                                 struct sockaddr_in6 *sin6;
6398
6399                                 sin6 = (struct sockaddr_in6 *)sa;
6400                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6401                                         /* Must be non-mapped for connectx */
6402                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6403                                         *error = EINVAL;
6404                                         *bad_addr = 1;
6405                                         return (NULL);
6406                                 }
6407                                 (*num_v6) += 1;
6408                                 incr = sizeof(struct sockaddr_in6);
6409                                 if (sa->sa_len != incr) {
6410                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6411                                         *error = EINVAL;
6412                                         *bad_addr = 1;
6413                                         return (NULL);
6414                                 }
6415                                 break;
6416                         }
6417 #endif
6418                 default:
6419                         *totaddr = i;
6420                         /* we are done */
6421                         break;
6422                 }
6423                 if (i == (size_t)*totaddr) {
6424                         break;
6425                 }
6426                 SCTP_INP_INCR_REF(inp);
6427                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6428                 if (stcb != NULL) {
6429                         /* Already have or am bring up an association */
6430                         return (stcb);
6431                 } else {
6432                         SCTP_INP_DECR_REF(inp);
6433                 }
6434                 if ((at + incr) > (size_t)limit) {
6435                         *totaddr = i;
6436                         break;
6437                 }
6438                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6439         }
6440         return ((struct sctp_tcb *)NULL);
6441 }
6442
6443 /*
6444  * sctp_bindx(ADD) for one address.
6445  * assumes all arguments are valid/checked by caller.
6446  */
6447 void
6448 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6449     struct sockaddr *sa, sctp_assoc_t assoc_id,
6450     uint32_t vrf_id, int *error, void *p)
6451 {
6452         struct sockaddr *addr_touse;
6453
6454 #ifdef INET6
6455         struct sockaddr_in sin;
6456
6457 #endif
6458
6459         /* see if we're bound all already! */
6460         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6461                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6462                 *error = EINVAL;
6463                 return;
6464         }
6465         addr_touse = sa;
6466 #ifdef INET6
6467         if (sa->sa_family == AF_INET6) {
6468                 struct sockaddr_in6 *sin6;
6469
6470                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6471                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6472                         *error = EINVAL;
6473                         return;
6474                 }
6475                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6476                         /* can only bind v6 on PF_INET6 sockets */
6477                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6478                         *error = EINVAL;
6479                         return;
6480                 }
6481                 sin6 = (struct sockaddr_in6 *)addr_touse;
6482                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6483                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6484                             SCTP_IPV6_V6ONLY(inp)) {
6485                                 /* can't bind v4-mapped on PF_INET sockets */
6486                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6487                                 *error = EINVAL;
6488                                 return;
6489                         }
6490                         in6_sin6_2_sin(&sin, sin6);
6491                         addr_touse = (struct sockaddr *)&sin;
6492                 }
6493         }
6494 #endif
6495 #ifdef INET
6496         if (sa->sa_family == AF_INET) {
6497                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6498                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6499                         *error = EINVAL;
6500                         return;
6501                 }
6502                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6503                     SCTP_IPV6_V6ONLY(inp)) {
6504                         /* can't bind v4 on PF_INET sockets */
6505                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6506                         *error = EINVAL;
6507                         return;
6508                 }
6509         }
6510 #endif
6511         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6512                 if (p == NULL) {
6513                         /* Can't get proc for Net/Open BSD */
6514                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6515                         *error = EINVAL;
6516                         return;
6517                 }
6518                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6519                 return;
6520         }
6521         /*
6522          * No locks required here since bind and mgmt_ep_sa all do their own
6523          * locking. If we do something for the FIX: below we may need to
6524          * lock in that case.
6525          */
6526         if (assoc_id == 0) {
6527                 /* add the address */
6528                 struct sctp_inpcb *lep;
6529                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6530
6531                 /* validate the incoming port */
6532                 if ((lsin->sin_port != 0) &&
6533                     (lsin->sin_port != inp->sctp_lport)) {
6534                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6535                         *error = EINVAL;
6536                         return;
6537                 } else {
6538                         /* user specified 0 port, set it to existing port */
6539                         lsin->sin_port = inp->sctp_lport;
6540                 }
6541
6542                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6543                 if (lep != NULL) {
6544                         /*
6545                          * We must decrement the refcount since we have the
6546                          * ep already and are binding. No remove going on
6547                          * here.
6548                          */
6549                         SCTP_INP_DECR_REF(lep);
6550                 }
6551                 if (lep == inp) {
6552                         /* already bound to it.. ok */
6553                         return;
6554                 } else if (lep == NULL) {
6555                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6556                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6557                             SCTP_ADD_IP_ADDRESS,
6558                             vrf_id, NULL);
6559                 } else {
6560                         *error = EADDRINUSE;
6561                 }
6562                 if (*error)
6563                         return;
6564         } else {
6565                 /*
6566                  * FIX: decide whether we allow assoc based bindx
6567                  */
6568         }
6569 }
6570
6571 /*
6572  * sctp_bindx(DELETE) for one address.
6573  * assumes all arguments are valid/checked by caller.
6574  */
6575 void
6576 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6577     struct sockaddr *sa, sctp_assoc_t assoc_id,
6578     uint32_t vrf_id, int *error)
6579 {
6580         struct sockaddr *addr_touse;
6581
6582 #ifdef INET6
6583         struct sockaddr_in sin;
6584
6585 #endif
6586
6587         /* see if we're bound all already! */
6588         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6589                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6590                 *error = EINVAL;
6591                 return;
6592         }
6593         addr_touse = sa;
6594 #ifdef INET6
6595         if (sa->sa_family == AF_INET6) {
6596                 struct sockaddr_in6 *sin6;
6597
6598                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6599                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6600                         *error = EINVAL;
6601                         return;
6602                 }
6603                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6604                         /* can only bind v6 on PF_INET6 sockets */
6605                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6606                         *error = EINVAL;
6607                         return;
6608                 }
6609                 sin6 = (struct sockaddr_in6 *)addr_touse;
6610                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6611                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6612                             SCTP_IPV6_V6ONLY(inp)) {
6613                                 /* can't bind mapped-v4 on PF_INET sockets */
6614                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6615                                 *error = EINVAL;
6616                                 return;
6617                         }
6618                         in6_sin6_2_sin(&sin, sin6);
6619                         addr_touse = (struct sockaddr *)&sin;
6620                 }
6621         }
6622 #endif
6623 #ifdef INET
6624         if (sa->sa_family == AF_INET) {
6625                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6626                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6627                         *error = EINVAL;
6628                         return;
6629                 }
6630                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6631                     SCTP_IPV6_V6ONLY(inp)) {
6632                         /* can't bind v4 on PF_INET sockets */
6633                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6634                         *error = EINVAL;
6635                         return;
6636                 }
6637         }
6638 #endif
6639         /*
6640          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6641          * below is ever changed we may need to lock before calling
6642          * association level binding.
6643          */
6644         if (assoc_id == 0) {
6645                 /* delete the address */
6646                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6647                     SCTP_DEL_IP_ADDRESS,
6648                     vrf_id, NULL);
6649         } else {
6650                 /*
6651                  * FIX: decide whether we allow assoc based bindx
6652                  */
6653         }
6654 }
6655
6656 /*
6657  * returns the valid local address count for an assoc, taking into account
6658  * all scoping rules
6659  */
6660 int
6661 sctp_local_addr_count(struct sctp_tcb *stcb)
6662 {
6663         int loopback_scope, ipv4_local_scope, local_scope, site_scope;
6664         int ipv4_addr_legal, ipv6_addr_legal;
6665         struct sctp_vrf *vrf;
6666         struct sctp_ifn *sctp_ifn;
6667         struct sctp_ifa *sctp_ifa;
6668         int count = 0;
6669
6670         /* Turn on all the appropriate scopes */
6671         loopback_scope = stcb->asoc.loopback_scope;
6672         ipv4_local_scope = stcb->asoc.ipv4_local_scope;
6673         local_scope = stcb->asoc.local_scope;
6674         site_scope = stcb->asoc.site_scope;
6675         ipv4_addr_legal = ipv6_addr_legal = 0;
6676         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6677                 ipv6_addr_legal = 1;
6678                 if (SCTP_IPV6_V6ONLY(stcb->sctp_ep) == 0) {
6679                         ipv4_addr_legal = 1;
6680                 }
6681         } else {
6682                 ipv4_addr_legal = 1;
6683         }
6684
6685         SCTP_IPI_ADDR_RLOCK();
6686         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6687         if (vrf == NULL) {
6688                 /* no vrf, no addresses */
6689                 SCTP_IPI_ADDR_RUNLOCK();
6690                 return (0);
6691         }
6692         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6693                 /*
6694                  * bound all case: go through all ifns on the vrf
6695                  */
6696                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6697                         if ((loopback_scope == 0) &&
6698                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6699                                 continue;
6700                         }
6701                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6702                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6703                                         continue;
6704                                 switch (sctp_ifa->address.sa.sa_family) {
6705 #ifdef INET
6706                                 case AF_INET:
6707                                         if (ipv4_addr_legal) {
6708                                                 struct sockaddr_in *sin;
6709
6710                                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
6711                                                 if (sin->sin_addr.s_addr == 0) {
6712                                                         /*
6713                                                          * skip unspecified
6714                                                          * addrs
6715                                                          */
6716                                                         continue;
6717                                                 }
6718                                                 if ((ipv4_local_scope == 0) &&
6719                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6720                                                         continue;
6721                                                 }
6722                                                 /* count this one */
6723                                                 count++;
6724                                         } else {
6725                                                 continue;
6726                                         }
6727                                         break;
6728 #endif
6729 #ifdef INET6
6730                                 case AF_INET6:
6731                                         if (ipv6_addr_legal) {
6732                                                 struct sockaddr_in6 *sin6;
6733
6734                                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
6735                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6736                                                         continue;
6737                                                 }
6738                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6739                                                         if (local_scope == 0)
6740                                                                 continue;
6741                                                         if (sin6->sin6_scope_id == 0) {
6742                                                                 if (sa6_recoverscope(sin6) != 0)
6743                                                                         /*
6744                                                                          *
6745                                                                          * bad
6746                                                                          *
6747                                                                          * li
6748                                                                          * nk
6749                                                                          *
6750                                                                          * loc
6751                                                                          * al
6752                                                                          *
6753                                                                          * add
6754                                                                          * re
6755                                                                          * ss
6756                                                                          * */
6757                                                                         continue;
6758                                                         }
6759                                                 }
6760                                                 if ((site_scope == 0) &&
6761                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6762                                                         continue;
6763                                                 }
6764                                                 /* count this one */
6765                                                 count++;
6766                                         }
6767                                         break;
6768 #endif
6769                                 default:
6770                                         /* TSNH */
6771                                         break;
6772                                 }
6773                         }
6774                 }
6775         } else {
6776                 /*
6777                  * subset bound case
6778                  */
6779                 struct sctp_laddr *laddr;
6780
6781                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6782                     sctp_nxt_addr) {
6783                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6784                                 continue;
6785                         }
6786                         /* count this one */
6787                         count++;
6788                 }
6789         }
6790         SCTP_IPI_ADDR_RUNLOCK();
6791         return (count);
6792 }
6793
6794 #if defined(SCTP_LOCAL_TRACE_BUF)
6795
6796 void
6797 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6798 {
6799         uint32_t saveindex, newindex;
6800
6801         do {
6802                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6803                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6804                         newindex = 1;
6805                 } else {
6806                         newindex = saveindex + 1;
6807                 }
6808         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6809         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6810                 saveindex = 0;
6811         }
6812         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6813         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6814         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6815         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6816         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6817         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6818         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6819         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6820 }
6821
6822 #endif
6823 /* XXX: Remove the #ifdef after tunneling over IPv6 works also on FreeBSD. */
6824 #ifdef INET
6825 /* We will need to add support
6826  * to bind the ports and such here
6827  * so we can do UDP tunneling. In
6828  * the mean-time, we return error
6829  */
6830 #include <netinet/udp.h>
6831 #include <netinet/udp_var.h>
6832 #include <sys/proc.h>
6833 #ifdef INET6
6834 #include <netinet6/sctp6_var.h>
6835 #endif
6836
6837 static void
6838 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *ignored)
6839 {
6840         struct ip *iph;
6841         struct mbuf *sp, *last;
6842         struct udphdr *uhdr;
6843         uint16_t port;
6844
6845         if ((m->m_flags & M_PKTHDR) == 0) {
6846                 /* Can't handle one that is not a pkt hdr */
6847                 goto out;
6848         }
6849         /* Pull the src port */
6850         iph = mtod(m, struct ip *);
6851         uhdr = (struct udphdr *)((caddr_t)iph + off);
6852         port = uhdr->uh_sport;
6853         /*
6854          * Split out the mbuf chain. Leave the IP header in m, place the
6855          * rest in the sp.
6856          */
6857         sp = m_split(m, off, M_DONTWAIT);
6858         if (sp == NULL) {
6859                 /* Gak, drop packet, we can't do a split */
6860                 goto out;
6861         }
6862         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
6863                 /* Gak, packet can't have an SCTP header in it - too small */
6864                 m_freem(sp);
6865                 goto out;
6866         }
6867         /* Now pull up the UDP header and SCTP header together */
6868         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
6869         if (sp == NULL) {
6870                 /* Gak pullup failed */
6871                 goto out;
6872         }
6873         /* Trim out the UDP header */
6874         m_adj(sp, sizeof(struct udphdr));
6875
6876         /* Now reconstruct the mbuf chain */
6877         for (last = m; last->m_next; last = last->m_next);
6878         last->m_next = sp;
6879         m->m_pkthdr.len += sp->m_pkthdr.len;
6880         iph = mtod(m, struct ip *);
6881         switch (iph->ip_v) {
6882 #ifdef INET
6883         case IPVERSION:
6884                 iph->ip_len -= sizeof(struct udphdr);
6885                 sctp_input_with_port(m, off, port);
6886                 break;
6887 #endif
6888 #ifdef INET6
6889         case IPV6_VERSION >> 4:
6890                 /* Not yet supported. */
6891                 goto out;
6892                 break;
6893
6894 #endif
6895         default:
6896                 goto out;
6897                 break;
6898         }
6899         return;
6900 out:
6901         m_freem(m);
6902 }
6903
6904 void
6905 sctp_over_udp_stop(void)
6906 {
6907         struct socket *sop;
6908
6909         /*
6910          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6911          * for writting!
6912          */
6913         if (SCTP_BASE_INFO(udp_tun_socket) == NULL) {
6914                 /* Nothing to do */
6915                 return;
6916         }
6917         sop = SCTP_BASE_INFO(udp_tun_socket);
6918         soclose(sop);
6919         SCTP_BASE_INFO(udp_tun_socket) = NULL;
6920 }
6921
6922 int
6923 sctp_over_udp_start(void)
6924 {
6925         uint16_t port;
6926         int ret;
6927         struct sockaddr_in sin;
6928         struct socket *sop = NULL;
6929         struct thread *th;
6930         struct ucred *cred;
6931
6932         /*
6933          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6934          * for writting!
6935          */
6936         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
6937         if (port == 0) {
6938                 /* Must have a port set */
6939                 return (EINVAL);
6940         }
6941         if (SCTP_BASE_INFO(udp_tun_socket) != NULL) {
6942                 /* Already running -- must stop first */
6943                 return (EALREADY);
6944         }
6945         th = curthread;
6946         cred = th->td_ucred;
6947         if ((ret = socreate(PF_INET, &sop,
6948             SOCK_DGRAM, IPPROTO_UDP, cred, th))) {
6949                 return (ret);
6950         }
6951         SCTP_BASE_INFO(udp_tun_socket) = sop;
6952         /* call the special UDP hook */
6953         ret = udp_set_kernel_tunneling(sop, sctp_recv_udp_tunneled_packet);
6954         if (ret) {
6955                 goto exit_stage_left;
6956         }
6957         /* Ok we have a socket, bind it to the port */
6958         memset(&sin, 0, sizeof(sin));
6959         sin.sin_len = sizeof(sin);
6960         sin.sin_family = AF_INET;
6961         sin.sin_port = htons(port);
6962         ret = sobind(sop, (struct sockaddr *)&sin, th);
6963         if (ret) {
6964                 /* Close up we cant get the port */
6965 exit_stage_left:
6966                 sctp_over_udp_stop();
6967                 return (ret);
6968         }
6969         /*
6970          * Ok we should now get UDP packets directly to our input routine
6971          * sctp_recv_upd_tunneled_packet().
6972          */
6973         return (0);
6974 }
6975
6976 #endif