xref: /freebsd/sys/netinet/sctputil.c (revision b406897911ea6c18c401907a076c4642dac46127)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions are met:
10  *
11  * a) Redistributions of source code must retain the above copyright notice,
12  *    this list of conditions and the following disclaimer.
13  *
14  * b) Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in
16  *    the documentation and/or other materials provided with the distribution.
17  *
18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
19  *    contributors may be used to endorse or promote products derived
20  *    from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD$");
37 
38 #include <netinet/sctp_os.h>
39 #include <netinet/sctp_pcb.h>
40 #include <netinet/sctputil.h>
41 #include <netinet/sctp_var.h>
42 #include <netinet/sctp_sysctl.h>
43 #ifdef INET6
44 #include <netinet6/sctp6_var.h>
45 #endif
46 #include <netinet/sctp_header.h>
47 #include <netinet/sctp_output.h>
48 #include <netinet/sctp_uio.h>
49 #include <netinet/sctp_timer.h>
50 #include <netinet/sctp_indata.h>
51 #include <netinet/sctp_auth.h>
52 #include <netinet/sctp_asconf.h>
53 #include <netinet/sctp_bsd_addr.h>
54 #include <netinet/sctp_kdtrace.h>
55 #if defined(INET6) || defined(INET)
56 #include <netinet/tcp_var.h>
57 #endif
58 #include <netinet/udp.h>
59 #include <netinet/udp_var.h>
60 #include <sys/proc.h>
61 #ifdef INET6
62 #include <netinet/icmp6.h>
63 #endif
64 
65 #ifndef KTR_SCTP
66 #define KTR_SCTP KTR_SUBSYS
67 #endif
68 
69 extern const struct sctp_cc_functions sctp_cc_functions[];
70 extern const struct sctp_ss_functions sctp_ss_functions[];
71 
72 void
73 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
74 {
75 #if defined(SCTP_LOCAL_TRACE_BUF)
76 	struct sctp_cwnd_log sctp_clog;
77 
78 	sctp_clog.x.sb.stcb = stcb;
79 	sctp_clog.x.sb.so_sbcc = sb->sb_cc;
80 	if (stcb)
81 		sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
82 	else
83 		sctp_clog.x.sb.stcb_sbcc = 0;
84 	sctp_clog.x.sb.incr = incr;
85 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
86 	    SCTP_LOG_EVENT_SB,
87 	    from,
88 	    sctp_clog.x.misc.log1,
89 	    sctp_clog.x.misc.log2,
90 	    sctp_clog.x.misc.log3,
91 	    sctp_clog.x.misc.log4);
92 #endif
93 }
94 
95 void
96 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
97 {
98 #if defined(SCTP_LOCAL_TRACE_BUF)
99 	struct sctp_cwnd_log sctp_clog;
100 
101 	sctp_clog.x.close.inp = (void *)inp;
102 	sctp_clog.x.close.sctp_flags = inp->sctp_flags;
103 	if (stcb) {
104 		sctp_clog.x.close.stcb = (void *)stcb;
105 		sctp_clog.x.close.state = (uint16_t)stcb->asoc.state;
106 	} else {
107 		sctp_clog.x.close.stcb = 0;
108 		sctp_clog.x.close.state = 0;
109 	}
110 	sctp_clog.x.close.loc = loc;
111 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
112 	    SCTP_LOG_EVENT_CLOSE,
113 	    0,
114 	    sctp_clog.x.misc.log1,
115 	    sctp_clog.x.misc.log2,
116 	    sctp_clog.x.misc.log3,
117 	    sctp_clog.x.misc.log4);
118 #endif
119 }
120 
121 void
122 rto_logging(struct sctp_nets *net, int from)
123 {
124 #if defined(SCTP_LOCAL_TRACE_BUF)
125 	struct sctp_cwnd_log sctp_clog;
126 
127 	memset(&sctp_clog, 0, sizeof(sctp_clog));
128 	sctp_clog.x.rto.net = (void *)net;
129 	sctp_clog.x.rto.rtt = net->rtt / 1000;
130 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
131 	    SCTP_LOG_EVENT_RTT,
132 	    from,
133 	    sctp_clog.x.misc.log1,
134 	    sctp_clog.x.misc.log2,
135 	    sctp_clog.x.misc.log3,
136 	    sctp_clog.x.misc.log4);
137 #endif
138 }
139 
140 void
141 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
142 {
143 #if defined(SCTP_LOCAL_TRACE_BUF)
144 	struct sctp_cwnd_log sctp_clog;
145 
146 	sctp_clog.x.strlog.stcb = stcb;
147 	sctp_clog.x.strlog.n_tsn = tsn;
148 	sctp_clog.x.strlog.n_sseq = sseq;
149 	sctp_clog.x.strlog.e_tsn = 0;
150 	sctp_clog.x.strlog.e_sseq = 0;
151 	sctp_clog.x.strlog.strm = stream;
152 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
153 	    SCTP_LOG_EVENT_STRM,
154 	    from,
155 	    sctp_clog.x.misc.log1,
156 	    sctp_clog.x.misc.log2,
157 	    sctp_clog.x.misc.log3,
158 	    sctp_clog.x.misc.log4);
159 #endif
160 }
161 
162 void
163 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
164 {
165 #if defined(SCTP_LOCAL_TRACE_BUF)
166 	struct sctp_cwnd_log sctp_clog;
167 
168 	sctp_clog.x.nagle.stcb = (void *)stcb;
169 	sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
170 	sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
171 	sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
172 	sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
173 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
174 	    SCTP_LOG_EVENT_NAGLE,
175 	    action,
176 	    sctp_clog.x.misc.log1,
177 	    sctp_clog.x.misc.log2,
178 	    sctp_clog.x.misc.log3,
179 	    sctp_clog.x.misc.log4);
180 #endif
181 }
182 
183 void
184 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
185 {
186 #if defined(SCTP_LOCAL_TRACE_BUF)
187 	struct sctp_cwnd_log sctp_clog;
188 
189 	sctp_clog.x.sack.cumack = cumack;
190 	sctp_clog.x.sack.oldcumack = old_cumack;
191 	sctp_clog.x.sack.tsn = tsn;
192 	sctp_clog.x.sack.numGaps = gaps;
193 	sctp_clog.x.sack.numDups = dups;
194 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
195 	    SCTP_LOG_EVENT_SACK,
196 	    from,
197 	    sctp_clog.x.misc.log1,
198 	    sctp_clog.x.misc.log2,
199 	    sctp_clog.x.misc.log3,
200 	    sctp_clog.x.misc.log4);
201 #endif
202 }
203 
204 void
205 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
206 {
207 #if defined(SCTP_LOCAL_TRACE_BUF)
208 	struct sctp_cwnd_log sctp_clog;
209 
210 	memset(&sctp_clog, 0, sizeof(sctp_clog));
211 	sctp_clog.x.map.base = map;
212 	sctp_clog.x.map.cum = cum;
213 	sctp_clog.x.map.high = high;
214 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
215 	    SCTP_LOG_EVENT_MAP,
216 	    from,
217 	    sctp_clog.x.misc.log1,
218 	    sctp_clog.x.misc.log2,
219 	    sctp_clog.x.misc.log3,
220 	    sctp_clog.x.misc.log4);
221 #endif
222 }
223 
224 void
225 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
226 {
227 #if defined(SCTP_LOCAL_TRACE_BUF)
228 	struct sctp_cwnd_log sctp_clog;
229 
230 	memset(&sctp_clog, 0, sizeof(sctp_clog));
231 	sctp_clog.x.fr.largest_tsn = biggest_tsn;
232 	sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
233 	sctp_clog.x.fr.tsn = tsn;
234 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
235 	    SCTP_LOG_EVENT_FR,
236 	    from,
237 	    sctp_clog.x.misc.log1,
238 	    sctp_clog.x.misc.log2,
239 	    sctp_clog.x.misc.log3,
240 	    sctp_clog.x.misc.log4);
241 #endif
242 }
243 
244 #ifdef SCTP_MBUF_LOGGING
245 void
246 sctp_log_mb(struct mbuf *m, int from)
247 {
248 #if defined(SCTP_LOCAL_TRACE_BUF)
249 	struct sctp_cwnd_log sctp_clog;
250 
251 	sctp_clog.x.mb.mp = m;
252 	sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m));
253 	sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m));
254 	sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
255 	if (SCTP_BUF_IS_EXTENDED(m)) {
256 		sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
257 		sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m));
258 	} else {
259 		sctp_clog.x.mb.ext = 0;
260 		sctp_clog.x.mb.refcnt = 0;
261 	}
262 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
263 	    SCTP_LOG_EVENT_MBUF,
264 	    from,
265 	    sctp_clog.x.misc.log1,
266 	    sctp_clog.x.misc.log2,
267 	    sctp_clog.x.misc.log3,
268 	    sctp_clog.x.misc.log4);
269 #endif
270 }
271 
272 void
273 sctp_log_mbc(struct mbuf *m, int from)
274 {
275 	struct mbuf *mat;
276 
277 	for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
278 		sctp_log_mb(mat, from);
279 	}
280 }
281 #endif
282 
283 void
284 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
285 {
286 #if defined(SCTP_LOCAL_TRACE_BUF)
287 	struct sctp_cwnd_log sctp_clog;
288 
289 	if (control == NULL) {
290 		SCTP_PRINTF("Gak log of NULL?\n");
291 		return;
292 	}
293 	sctp_clog.x.strlog.stcb = control->stcb;
294 	sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
295 	sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid;
296 	sctp_clog.x.strlog.strm = control->sinfo_stream;
297 	if (poschk != NULL) {
298 		sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
299 		sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid;
300 	} else {
301 		sctp_clog.x.strlog.e_tsn = 0;
302 		sctp_clog.x.strlog.e_sseq = 0;
303 	}
304 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
305 	    SCTP_LOG_EVENT_STRM,
306 	    from,
307 	    sctp_clog.x.misc.log1,
308 	    sctp_clog.x.misc.log2,
309 	    sctp_clog.x.misc.log3,
310 	    sctp_clog.x.misc.log4);
311 #endif
312 }
313 
314 void
315 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
316 {
317 #if defined(SCTP_LOCAL_TRACE_BUF)
318 	struct sctp_cwnd_log sctp_clog;
319 
320 	sctp_clog.x.cwnd.net = net;
321 	if (stcb->asoc.send_queue_cnt > 255)
322 		sctp_clog.x.cwnd.cnt_in_send = 255;
323 	else
324 		sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
325 	if (stcb->asoc.stream_queue_cnt > 255)
326 		sctp_clog.x.cwnd.cnt_in_str = 255;
327 	else
328 		sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
329 
330 	if (net) {
331 		sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
332 		sctp_clog.x.cwnd.inflight = net->flight_size;
333 		sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
334 		sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
335 		sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
336 	}
337 	if (SCTP_CWNDLOG_PRESEND == from) {
338 		sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
339 	}
340 	sctp_clog.x.cwnd.cwnd_augment = augment;
341 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
342 	    SCTP_LOG_EVENT_CWND,
343 	    from,
344 	    sctp_clog.x.misc.log1,
345 	    sctp_clog.x.misc.log2,
346 	    sctp_clog.x.misc.log3,
347 	    sctp_clog.x.misc.log4);
348 #endif
349 }
350 
351 void
352 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
353 {
354 #if defined(SCTP_LOCAL_TRACE_BUF)
355 	struct sctp_cwnd_log sctp_clog;
356 
357 	memset(&sctp_clog, 0, sizeof(sctp_clog));
358 	if (inp) {
359 		sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
360 
361 	} else {
362 		sctp_clog.x.lock.sock = (void *)NULL;
363 	}
364 	sctp_clog.x.lock.inp = (void *)inp;
365 	if (stcb) {
366 		sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
367 	} else {
368 		sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
369 	}
370 	if (inp) {
371 		sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
372 		sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
373 	} else {
374 		sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
375 		sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
376 	}
377 	sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
378 	if (inp && (inp->sctp_socket)) {
379 		sctp_clog.x.lock.sock_lock = mtx_owned(SOCK_MTX(inp->sctp_socket));
380 		sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(SOCKBUF_MTX(&inp->sctp_socket->so_rcv));
381 		sctp_clog.x.lock.socksndbuf_lock = mtx_owned(SOCKBUF_MTX(&inp->sctp_socket->so_snd));
382 	} else {
383 		sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
384 		sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
385 		sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
386 	}
387 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
388 	    SCTP_LOG_LOCK_EVENT,
389 	    from,
390 	    sctp_clog.x.misc.log1,
391 	    sctp_clog.x.misc.log2,
392 	    sctp_clog.x.misc.log3,
393 	    sctp_clog.x.misc.log4);
394 #endif
395 }
396 
397 void
398 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
399 {
400 #if defined(SCTP_LOCAL_TRACE_BUF)
401 	struct sctp_cwnd_log sctp_clog;
402 
403 	memset(&sctp_clog, 0, sizeof(sctp_clog));
404 	sctp_clog.x.cwnd.net = net;
405 	sctp_clog.x.cwnd.cwnd_new_value = error;
406 	sctp_clog.x.cwnd.inflight = net->flight_size;
407 	sctp_clog.x.cwnd.cwnd_augment = burst;
408 	if (stcb->asoc.send_queue_cnt > 255)
409 		sctp_clog.x.cwnd.cnt_in_send = 255;
410 	else
411 		sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
412 	if (stcb->asoc.stream_queue_cnt > 255)
413 		sctp_clog.x.cwnd.cnt_in_str = 255;
414 	else
415 		sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
416 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
417 	    SCTP_LOG_EVENT_MAXBURST,
418 	    from,
419 	    sctp_clog.x.misc.log1,
420 	    sctp_clog.x.misc.log2,
421 	    sctp_clog.x.misc.log3,
422 	    sctp_clog.x.misc.log4);
423 #endif
424 }
425 
426 void
427 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
428 {
429 #if defined(SCTP_LOCAL_TRACE_BUF)
430 	struct sctp_cwnd_log sctp_clog;
431 
432 	sctp_clog.x.rwnd.rwnd = peers_rwnd;
433 	sctp_clog.x.rwnd.send_size = snd_size;
434 	sctp_clog.x.rwnd.overhead = overhead;
435 	sctp_clog.x.rwnd.new_rwnd = 0;
436 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
437 	    SCTP_LOG_EVENT_RWND,
438 	    from,
439 	    sctp_clog.x.misc.log1,
440 	    sctp_clog.x.misc.log2,
441 	    sctp_clog.x.misc.log3,
442 	    sctp_clog.x.misc.log4);
443 #endif
444 }
445 
446 void
447 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
448 {
449 #if defined(SCTP_LOCAL_TRACE_BUF)
450 	struct sctp_cwnd_log sctp_clog;
451 
452 	sctp_clog.x.rwnd.rwnd = peers_rwnd;
453 	sctp_clog.x.rwnd.send_size = flight_size;
454 	sctp_clog.x.rwnd.overhead = overhead;
455 	sctp_clog.x.rwnd.new_rwnd = a_rwndval;
456 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
457 	    SCTP_LOG_EVENT_RWND,
458 	    from,
459 	    sctp_clog.x.misc.log1,
460 	    sctp_clog.x.misc.log2,
461 	    sctp_clog.x.misc.log3,
462 	    sctp_clog.x.misc.log4);
463 #endif
464 }
465 
466 #ifdef SCTP_MBCNT_LOGGING
467 static void
468 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
469 {
470 #if defined(SCTP_LOCAL_TRACE_BUF)
471 	struct sctp_cwnd_log sctp_clog;
472 
473 	sctp_clog.x.mbcnt.total_queue_size = total_oq;
474 	sctp_clog.x.mbcnt.size_change = book;
475 	sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
476 	sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
477 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
478 	    SCTP_LOG_EVENT_MBCNT,
479 	    from,
480 	    sctp_clog.x.misc.log1,
481 	    sctp_clog.x.misc.log2,
482 	    sctp_clog.x.misc.log3,
483 	    sctp_clog.x.misc.log4);
484 #endif
485 }
486 #endif
487 
488 void
489 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
490 {
491 #if defined(SCTP_LOCAL_TRACE_BUF)
492 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
493 	    SCTP_LOG_MISC_EVENT,
494 	    from,
495 	    a, b, c, d);
496 #endif
497 }
498 
499 void
500 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
501 {
502 #if defined(SCTP_LOCAL_TRACE_BUF)
503 	struct sctp_cwnd_log sctp_clog;
504 
505 	sctp_clog.x.wake.stcb = (void *)stcb;
506 	sctp_clog.x.wake.wake_cnt = wake_cnt;
507 	sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
508 	sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
509 	sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
510 
511 	if (stcb->asoc.stream_queue_cnt < 0xff)
512 		sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt;
513 	else
514 		sctp_clog.x.wake.stream_qcnt = 0xff;
515 
516 	if (stcb->asoc.chunks_on_out_queue < 0xff)
517 		sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue;
518 	else
519 		sctp_clog.x.wake.chunks_on_oque = 0xff;
520 
521 	sctp_clog.x.wake.sctpflags = 0;
522 	/* set in the defered mode stuff */
523 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
524 		sctp_clog.x.wake.sctpflags |= 1;
525 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
526 		sctp_clog.x.wake.sctpflags |= 2;
527 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
528 		sctp_clog.x.wake.sctpflags |= 4;
529 	/* what about the sb */
530 	if (stcb->sctp_socket) {
531 		struct socket *so = stcb->sctp_socket;
532 
533 		sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff));
534 	} else {
535 		sctp_clog.x.wake.sbflags = 0xff;
536 	}
537 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
538 	    SCTP_LOG_EVENT_WAKE,
539 	    from,
540 	    sctp_clog.x.misc.log1,
541 	    sctp_clog.x.misc.log2,
542 	    sctp_clog.x.misc.log3,
543 	    sctp_clog.x.misc.log4);
544 #endif
545 }
546 
547 void
548 sctp_log_block(uint8_t from, struct sctp_association *asoc, ssize_t sendlen)
549 {
550 #if defined(SCTP_LOCAL_TRACE_BUF)
551 	struct sctp_cwnd_log sctp_clog;
552 
553 	sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
554 	sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt);
555 	sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
556 	sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt;
557 	sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue;
558 	sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024);
559 	sctp_clog.x.blk.sndlen = (uint32_t)sendlen;
560 	SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
561 	    SCTP_LOG_EVENT_BLOCK,
562 	    from,
563 	    sctp_clog.x.misc.log1,
564 	    sctp_clog.x.misc.log2,
565 	    sctp_clog.x.misc.log3,
566 	    sctp_clog.x.misc.log4);
567 #endif
568 }
569 
570 int
571 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
572 {
573 	/* May need to fix this if ktrdump does not work */
574 	return (0);
575 }
576 
577 #ifdef SCTP_AUDITING_ENABLED
578 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
579 static int sctp_audit_indx = 0;
580 
581 static
582 void
583 sctp_print_audit_report(void)
584 {
585 	int i;
586 	int cnt;
587 
588 	cnt = 0;
589 	for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
590 		if ((sctp_audit_data[i][0] == 0xe0) &&
591 		    (sctp_audit_data[i][1] == 0x01)) {
592 			cnt = 0;
593 			SCTP_PRINTF("\n");
594 		} else if (sctp_audit_data[i][0] == 0xf0) {
595 			cnt = 0;
596 			SCTP_PRINTF("\n");
597 		} else if ((sctp_audit_data[i][0] == 0xc0) &&
598 		    (sctp_audit_data[i][1] == 0x01)) {
599 			SCTP_PRINTF("\n");
600 			cnt = 0;
601 		}
602 		SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
603 		    (uint32_t)sctp_audit_data[i][1]);
604 		cnt++;
605 		if ((cnt % 14) == 0)
606 			SCTP_PRINTF("\n");
607 	}
608 	for (i = 0; i < sctp_audit_indx; i++) {
609 		if ((sctp_audit_data[i][0] == 0xe0) &&
610 		    (sctp_audit_data[i][1] == 0x01)) {
611 			cnt = 0;
612 			SCTP_PRINTF("\n");
613 		} else if (sctp_audit_data[i][0] == 0xf0) {
614 			cnt = 0;
615 			SCTP_PRINTF("\n");
616 		} else if ((sctp_audit_data[i][0] == 0xc0) &&
617 		    (sctp_audit_data[i][1] == 0x01)) {
618 			SCTP_PRINTF("\n");
619 			cnt = 0;
620 		}
621 		SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
622 		    (uint32_t)sctp_audit_data[i][1]);
623 		cnt++;
624 		if ((cnt % 14) == 0)
625 			SCTP_PRINTF("\n");
626 	}
627 	SCTP_PRINTF("\n");
628 }
629 
630 void
631 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
632     struct sctp_nets *net)
633 {
634 	int resend_cnt, tot_out, rep, tot_book_cnt;
635 	struct sctp_nets *lnet;
636 	struct sctp_tmit_chunk *chk;
637 
638 	sctp_audit_data[sctp_audit_indx][0] = 0xAA;
639 	sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
640 	sctp_audit_indx++;
641 	if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
642 		sctp_audit_indx = 0;
643 	}
644 	if (inp == NULL) {
645 		sctp_audit_data[sctp_audit_indx][0] = 0xAF;
646 		sctp_audit_data[sctp_audit_indx][1] = 0x01;
647 		sctp_audit_indx++;
648 		if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
649 			sctp_audit_indx = 0;
650 		}
651 		return;
652 	}
653 	if (stcb == NULL) {
654 		sctp_audit_data[sctp_audit_indx][0] = 0xAF;
655 		sctp_audit_data[sctp_audit_indx][1] = 0x02;
656 		sctp_audit_indx++;
657 		if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
658 			sctp_audit_indx = 0;
659 		}
660 		return;
661 	}
662 	sctp_audit_data[sctp_audit_indx][0] = 0xA1;
663 	sctp_audit_data[sctp_audit_indx][1] =
664 	    (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
665 	sctp_audit_indx++;
666 	if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
667 		sctp_audit_indx = 0;
668 	}
669 	rep = 0;
670 	tot_book_cnt = 0;
671 	resend_cnt = tot_out = 0;
672 	TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
673 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
674 			resend_cnt++;
675 		} else if (chk->sent < SCTP_DATAGRAM_RESEND) {
676 			tot_out += chk->book_size;
677 			tot_book_cnt++;
678 		}
679 	}
680 	if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
681 		sctp_audit_data[sctp_audit_indx][0] = 0xAF;
682 		sctp_audit_data[sctp_audit_indx][1] = 0xA1;
683 		sctp_audit_indx++;
684 		if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
685 			sctp_audit_indx = 0;
686 		}
687 		SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
688 		    resend_cnt, stcb->asoc.sent_queue_retran_cnt);
689 		rep = 1;
690 		stcb->asoc.sent_queue_retran_cnt = resend_cnt;
691 		sctp_audit_data[sctp_audit_indx][0] = 0xA2;
692 		sctp_audit_data[sctp_audit_indx][1] =
693 		    (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
694 		sctp_audit_indx++;
695 		if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
696 			sctp_audit_indx = 0;
697 		}
698 	}
699 	if (tot_out != stcb->asoc.total_flight) {
700 		sctp_audit_data[sctp_audit_indx][0] = 0xAF;
701 		sctp_audit_data[sctp_audit_indx][1] = 0xA2;
702 		sctp_audit_indx++;
703 		if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
704 			sctp_audit_indx = 0;
705 		}
706 		rep = 1;
707 		SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
708 		    (int)stcb->asoc.total_flight);
709 		stcb->asoc.total_flight = tot_out;
710 	}
711 	if (tot_book_cnt != stcb->asoc.total_flight_count) {
712 		sctp_audit_data[sctp_audit_indx][0] = 0xAF;
713 		sctp_audit_data[sctp_audit_indx][1] = 0xA5;
714 		sctp_audit_indx++;
715 		if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
716 			sctp_audit_indx = 0;
717 		}
718 		rep = 1;
719 		SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
720 
721 		stcb->asoc.total_flight_count = tot_book_cnt;
722 	}
723 	tot_out = 0;
724 	TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
725 		tot_out += lnet->flight_size;
726 	}
727 	if (tot_out != stcb->asoc.total_flight) {
728 		sctp_audit_data[sctp_audit_indx][0] = 0xAF;
729 		sctp_audit_data[sctp_audit_indx][1] = 0xA3;
730 		sctp_audit_indx++;
731 		if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
732 			sctp_audit_indx = 0;
733 		}
734 		rep = 1;
735 		SCTP_PRINTF("real flight:%d net total was %d\n",
736 		    stcb->asoc.total_flight, tot_out);
737 		/* now corrective action */
738 		TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
739 			tot_out = 0;
740 			TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
741 				if ((chk->whoTo == lnet) &&
742 				    (chk->sent < SCTP_DATAGRAM_RESEND)) {
743 					tot_out += chk->book_size;
744 				}
745 			}
746 			if (lnet->flight_size != tot_out) {
747 				SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
748 				    (void *)lnet, lnet->flight_size,
749 				    tot_out);
750 				lnet->flight_size = tot_out;
751 			}
752 		}
753 	}
754 	if (rep) {
755 		sctp_print_audit_report();
756 	}
757 }
758 
759 void
760 sctp_audit_log(uint8_t ev, uint8_t fd)
761 {
762 
763 	sctp_audit_data[sctp_audit_indx][0] = ev;
764 	sctp_audit_data[sctp_audit_indx][1] = fd;
765 	sctp_audit_indx++;
766 	if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
767 		sctp_audit_indx = 0;
768 	}
769 }
770 
771 #endif
772 
773 /*
774  * The conversion from time to ticks and vice versa is done by rounding
775  * upwards. This way we can test in the code the time to be positive and
776  * know that this corresponds to a positive number of ticks.
777  */
778 
779 uint32_t
780 sctp_msecs_to_ticks(uint32_t msecs)
781 {
782 	uint64_t temp;
783 	uint32_t ticks;
784 
785 	if (hz == 1000) {
786 		ticks = msecs;
787 	} else {
788 		temp = (((uint64_t)msecs * hz) + 999) / 1000;
789 		if (temp > UINT32_MAX) {
790 			ticks = UINT32_MAX;
791 		} else {
792 			ticks = (uint32_t)temp;
793 		}
794 	}
795 	return (ticks);
796 }
797 
798 uint32_t
799 sctp_ticks_to_msecs(uint32_t ticks)
800 {
801 	uint64_t temp;
802 	uint32_t msecs;
803 
804 	if (hz == 1000) {
805 		msecs = ticks;
806 	} else {
807 		temp = (((uint64_t)ticks * 1000) + (hz - 1)) / hz;
808 		if (temp > UINT32_MAX) {
809 			msecs = UINT32_MAX;
810 		} else {
811 			msecs = (uint32_t)temp;
812 		}
813 	}
814 	return (msecs);
815 }
816 
817 uint32_t
818 sctp_secs_to_ticks(uint32_t secs)
819 {
820 	uint64_t temp;
821 	uint32_t ticks;
822 
823 	temp = (uint64_t)secs * hz;
824 	if (temp > UINT32_MAX) {
825 		ticks = UINT32_MAX;
826 	} else {
827 		ticks = (uint32_t)temp;
828 	}
829 	return (ticks);
830 }
831 
832 uint32_t
833 sctp_ticks_to_secs(uint32_t ticks)
834 {
835 	uint64_t temp;
836 	uint32_t secs;
837 
838 	temp = ((uint64_t)ticks + (hz - 1)) / hz;
839 	if (temp > UINT32_MAX) {
840 		secs = UINT32_MAX;
841 	} else {
842 		secs = (uint32_t)temp;
843 	}
844 	return (secs);
845 }
846 
847 /*
848  * sctp_stop_timers_for_shutdown() should be called
849  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
850  * state to make sure that all timers are stopped.
851  */
852 void
853 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
854 {
855 	struct sctp_inpcb *inp;
856 	struct sctp_nets *net;
857 
858 	inp = stcb->sctp_ep;
859 
860 	sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL,
861 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_12);
862 	sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL,
863 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_13);
864 	sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL,
865 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_14);
866 	sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL,
867 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_15);
868 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
869 		sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
870 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_16);
871 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
872 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_17);
873 	}
874 }
875 
876 void
877 sctp_stop_association_timers(struct sctp_tcb *stcb, bool stop_assoc_kill_timer)
878 {
879 	struct sctp_inpcb *inp;
880 	struct sctp_nets *net;
881 
882 	inp = stcb->sctp_ep;
883 	sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL,
884 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_18);
885 	sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL,
886 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_19);
887 	if (stop_assoc_kill_timer) {
888 		sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
889 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_20);
890 	}
891 	sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL,
892 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_21);
893 	sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL,
894 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_22);
895 	sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNGUARD, inp, stcb, NULL,
896 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_23);
897 	/* Mobility adaptation */
898 	sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, inp, stcb, NULL,
899 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_24);
900 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
901 		sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net,
902 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_25);
903 		sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net,
904 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_26);
905 		sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, inp, stcb, net,
906 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_27);
907 		sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net,
908 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_28);
909 		sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, inp, stcb, net,
910 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_29);
911 		sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
912 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_30);
913 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
914 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_31);
915 	}
916 }
917 
918 /*
919  * A list of sizes based on typical mtu's, used only if next hop size not
920  * returned. These values MUST be multiples of 4 and MUST be ordered.
921  */
922 static uint32_t sctp_mtu_sizes[] = {
923 	68,
924 	296,
925 	508,
926 	512,
927 	544,
928 	576,
929 	1004,
930 	1492,
931 	1500,
932 	1536,
933 	2000,
934 	2048,
935 	4352,
936 	4464,
937 	8168,
938 	17912,
939 	32000,
940 	65532
941 };
942 
943 /*
944  * Return the largest MTU in sctp_mtu_sizes smaller than val.
945  * If val is smaller than the minimum, just return the largest
946  * multiple of 4 smaller or equal to val.
947  * Ensure that the result is a multiple of 4.
948  */
949 uint32_t
950 sctp_get_prev_mtu(uint32_t val)
951 {
952 	uint32_t i;
953 
954 	val &= 0xfffffffc;
955 	if (val <= sctp_mtu_sizes[0]) {
956 		return (val);
957 	}
958 	for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
959 		if (val <= sctp_mtu_sizes[i]) {
960 			break;
961 		}
962 	}
963 	KASSERT((sctp_mtu_sizes[i - 1] & 0x00000003) == 0,
964 	    ("sctp_mtu_sizes[%u] not a multiple of 4", i - 1));
965 	return (sctp_mtu_sizes[i - 1]);
966 }
967 
968 /*
969  * Return the smallest MTU in sctp_mtu_sizes larger than val.
970  * If val is larger than the maximum, just return the largest multiple of 4 smaller
971  * or equal to val.
972  * Ensure that the result is a multiple of 4.
973  */
974 uint32_t
975 sctp_get_next_mtu(uint32_t val)
976 {
977 	/* select another MTU that is just bigger than this one */
978 	uint32_t i;
979 
980 	val &= 0xfffffffc;
981 	for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
982 		if (val < sctp_mtu_sizes[i]) {
983 			KASSERT((sctp_mtu_sizes[i] & 0x00000003) == 0,
984 			    ("sctp_mtu_sizes[%u] not a multiple of 4", i));
985 			return (sctp_mtu_sizes[i]);
986 		}
987 	}
988 	return (val);
989 }
990 
991 void
992 sctp_fill_random_store(struct sctp_pcb *m)
993 {
994 	/*
995 	 * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
996 	 * our counter. The result becomes our good random numbers and we
997 	 * then setup to give these out. Note that we do no locking to
998 	 * protect this. This is ok, since if competing folks call this we
999 	 * will get more gobbled gook in the random store which is what we
1000 	 * want. There is a danger that two guys will use the same random
1001 	 * numbers, but thats ok too since that is random as well :->
1002 	 */
1003 	m->store_at = 0;
1004 	(void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers,
1005 	    sizeof(m->random_numbers), (uint8_t *)&m->random_counter,
1006 	    sizeof(m->random_counter), (uint8_t *)m->random_store);
1007 	m->random_counter++;
1008 }
1009 
1010 uint32_t
1011 sctp_select_initial_TSN(struct sctp_pcb *inp)
1012 {
1013 	/*
1014 	 * A true implementation should use random selection process to get
1015 	 * the initial stream sequence number, using RFC1750 as a good
1016 	 * guideline
1017 	 */
1018 	uint32_t x, *xp;
1019 	uint8_t *p;
1020 	int store_at, new_store;
1021 
1022 	if (inp->initial_sequence_debug != 0) {
1023 		uint32_t ret;
1024 
1025 		ret = inp->initial_sequence_debug;
1026 		inp->initial_sequence_debug++;
1027 		return (ret);
1028 	}
1029 retry:
1030 	store_at = inp->store_at;
1031 	new_store = store_at + sizeof(uint32_t);
1032 	if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
1033 		new_store = 0;
1034 	}
1035 	if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
1036 		goto retry;
1037 	}
1038 	if (new_store == 0) {
1039 		/* Refill the random store */
1040 		sctp_fill_random_store(inp);
1041 	}
1042 	p = &inp->random_store[store_at];
1043 	xp = (uint32_t *)p;
1044 	x = *xp;
1045 	return (x);
1046 }
1047 
1048 uint32_t
1049 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
1050 {
1051 	uint32_t x;
1052 	struct timeval now;
1053 
1054 	if (check) {
1055 		(void)SCTP_GETTIME_TIMEVAL(&now);
1056 	}
1057 	for (;;) {
1058 		x = sctp_select_initial_TSN(&inp->sctp_ep);
1059 		if (x == 0) {
1060 			/* we never use 0 */
1061 			continue;
1062 		}
1063 		if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
1064 			break;
1065 		}
1066 	}
1067 	return (x);
1068 }
1069 
1070 int32_t
1071 sctp_map_assoc_state(int kernel_state)
1072 {
1073 	int32_t user_state;
1074 
1075 	if (kernel_state & SCTP_STATE_WAS_ABORTED) {
1076 		user_state = SCTP_CLOSED;
1077 	} else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) {
1078 		user_state = SCTP_SHUTDOWN_PENDING;
1079 	} else {
1080 		switch (kernel_state & SCTP_STATE_MASK) {
1081 		case SCTP_STATE_EMPTY:
1082 			user_state = SCTP_CLOSED;
1083 			break;
1084 		case SCTP_STATE_INUSE:
1085 			user_state = SCTP_CLOSED;
1086 			break;
1087 		case SCTP_STATE_COOKIE_WAIT:
1088 			user_state = SCTP_COOKIE_WAIT;
1089 			break;
1090 		case SCTP_STATE_COOKIE_ECHOED:
1091 			user_state = SCTP_COOKIE_ECHOED;
1092 			break;
1093 		case SCTP_STATE_OPEN:
1094 			user_state = SCTP_ESTABLISHED;
1095 			break;
1096 		case SCTP_STATE_SHUTDOWN_SENT:
1097 			user_state = SCTP_SHUTDOWN_SENT;
1098 			break;
1099 		case SCTP_STATE_SHUTDOWN_RECEIVED:
1100 			user_state = SCTP_SHUTDOWN_RECEIVED;
1101 			break;
1102 		case SCTP_STATE_SHUTDOWN_ACK_SENT:
1103 			user_state = SCTP_SHUTDOWN_ACK_SENT;
1104 			break;
1105 		default:
1106 			user_state = SCTP_CLOSED;
1107 			break;
1108 		}
1109 	}
1110 	return (user_state);
1111 }
1112 
1113 int
1114 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1115     uint32_t override_tag, uint32_t initial_tsn, uint32_t vrf_id,
1116     uint16_t o_strms)
1117 {
1118 	struct sctp_association *asoc;
1119 
1120 	/*
1121 	 * Anything set to zero is taken care of by the allocation routine's
1122 	 * bzero
1123 	 */
1124 
1125 	/*
1126 	 * Up front select what scoping to apply on addresses I tell my peer
1127 	 * Not sure what to do with these right now, we will need to come up
1128 	 * with a way to set them. We may need to pass them through from the
1129 	 * caller in the sctp_aloc_assoc() function.
1130 	 */
1131 	int i;
1132 #if defined(SCTP_DETAILED_STR_STATS)
1133 	int j;
1134 #endif
1135 
1136 	asoc = &stcb->asoc;
1137 	/* init all variables to a known value. */
1138 	SCTP_SET_STATE(stcb, SCTP_STATE_INUSE);
1139 	asoc->max_burst = inp->sctp_ep.max_burst;
1140 	asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
1141 	asoc->heart_beat_delay = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
1142 	asoc->cookie_life = inp->sctp_ep.def_cookie_life;
1143 	asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
1144 	asoc->ecn_supported = inp->ecn_supported;
1145 	asoc->prsctp_supported = inp->prsctp_supported;
1146 	asoc->auth_supported = inp->auth_supported;
1147 	asoc->asconf_supported = inp->asconf_supported;
1148 	asoc->reconfig_supported = inp->reconfig_supported;
1149 	asoc->nrsack_supported = inp->nrsack_supported;
1150 	asoc->pktdrop_supported = inp->pktdrop_supported;
1151 	asoc->idata_supported = inp->idata_supported;
1152 	asoc->sctp_cmt_pf = (uint8_t)0;
1153 	asoc->sctp_frag_point = inp->sctp_frag_point;
1154 	asoc->sctp_features = inp->sctp_features;
1155 	asoc->default_dscp = inp->sctp_ep.default_dscp;
1156 	asoc->max_cwnd = inp->max_cwnd;
1157 #ifdef INET6
1158 	if (inp->sctp_ep.default_flowlabel) {
1159 		asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
1160 	} else {
1161 		if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
1162 			asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
1163 			asoc->default_flowlabel &= 0x000fffff;
1164 			asoc->default_flowlabel |= 0x80000000;
1165 		} else {
1166 			asoc->default_flowlabel = 0;
1167 		}
1168 	}
1169 #endif
1170 	asoc->sb_send_resv = 0;
1171 	if (override_tag) {
1172 		asoc->my_vtag = override_tag;
1173 	} else {
1174 		asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
1175 	}
1176 	/* Get the nonce tags */
1177 	asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1178 	asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1179 	asoc->vrf_id = vrf_id;
1180 
1181 #ifdef SCTP_ASOCLOG_OF_TSNS
1182 	asoc->tsn_in_at = 0;
1183 	asoc->tsn_out_at = 0;
1184 	asoc->tsn_in_wrapped = 0;
1185 	asoc->tsn_out_wrapped = 0;
1186 	asoc->cumack_log_at = 0;
1187 	asoc->cumack_log_atsnt = 0;
1188 #endif
1189 #ifdef SCTP_FS_SPEC_LOG
1190 	asoc->fs_index = 0;
1191 #endif
1192 	asoc->refcnt = 0;
1193 	asoc->assoc_up_sent = 0;
1194 	if (override_tag) {
1195 		asoc->init_seq_number = initial_tsn;
1196 	} else {
1197 		asoc->init_seq_number = sctp_select_initial_TSN(&inp->sctp_ep);
1198 	}
1199 	asoc->asconf_seq_out = asoc->init_seq_number;
1200 	asoc->str_reset_seq_out = asoc->init_seq_number;
1201 	asoc->sending_seq = asoc->init_seq_number;
1202 	asoc->asconf_seq_out_acked = asoc->init_seq_number - 1;
1203 	/* we are optimisitic here */
1204 	asoc->peer_supports_nat = 0;
1205 	asoc->sent_queue_retran_cnt = 0;
1206 
1207 	/* for CMT */
1208 	asoc->last_net_cmt_send_started = NULL;
1209 
1210 	asoc->last_acked_seq = asoc->init_seq_number - 1;
1211 	asoc->advanced_peer_ack_point = asoc->init_seq_number - 1;
1212 	asoc->asconf_seq_in = asoc->init_seq_number - 1;
1213 
1214 	/* here we are different, we hold the next one we expect */
1215 	asoc->str_reset_seq_in = asoc->init_seq_number;
1216 
1217 	asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
1218 	asoc->initial_rto = inp->sctp_ep.initial_rto;
1219 
1220 	asoc->default_mtu = inp->sctp_ep.default_mtu;
1221 	asoc->max_init_times = inp->sctp_ep.max_init_times;
1222 	asoc->max_send_times = inp->sctp_ep.max_send_times;
1223 	asoc->def_net_failure = inp->sctp_ep.def_net_failure;
1224 	asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
1225 	asoc->free_chunk_cnt = 0;
1226 
1227 	asoc->iam_blocking = 0;
1228 	asoc->context = inp->sctp_context;
1229 	asoc->local_strreset_support = inp->local_strreset_support;
1230 	asoc->def_send = inp->def_send;
1231 	asoc->delayed_ack = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1232 	asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
1233 	asoc->pr_sctp_cnt = 0;
1234 	asoc->total_output_queue_size = 0;
1235 
1236 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1237 		asoc->scope.ipv6_addr_legal = 1;
1238 		if (SCTP_IPV6_V6ONLY(inp) == 0) {
1239 			asoc->scope.ipv4_addr_legal = 1;
1240 		} else {
1241 			asoc->scope.ipv4_addr_legal = 0;
1242 		}
1243 	} else {
1244 		asoc->scope.ipv6_addr_legal = 0;
1245 		asoc->scope.ipv4_addr_legal = 1;
1246 	}
1247 
1248 	asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1249 	asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1250 
1251 	asoc->smallest_mtu = 0;
1252 	asoc->minrto = inp->sctp_ep.sctp_minrto;
1253 	asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1254 
1255 	asoc->stream_locked_on = 0;
1256 	asoc->ecn_echo_cnt_onq = 0;
1257 	asoc->stream_locked = 0;
1258 
1259 	asoc->send_sack = 1;
1260 
1261 	LIST_INIT(&asoc->sctp_restricted_addrs);
1262 
1263 	TAILQ_INIT(&asoc->nets);
1264 	TAILQ_INIT(&asoc->pending_reply_queue);
1265 	TAILQ_INIT(&asoc->asconf_ack_sent);
1266 	/* Setup to fill the hb random cache at first HB */
1267 	asoc->hb_random_idx = 4;
1268 
1269 	asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1270 
1271 	stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1272 	stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1273 
1274 	stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1275 	stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1276 
1277 	/*
1278 	 * Now the stream parameters, here we allocate space for all streams
1279 	 * that we request by default.
1280 	 */
1281 	asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1282 	    o_strms;
1283 	SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1284 	    asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1285 	    SCTP_M_STRMO);
1286 	if (asoc->strmout == NULL) {
1287 		/* big trouble no memory */
1288 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1289 		return (ENOMEM);
1290 	}
1291 	SCTP_TCB_SEND_LOCK(stcb);
1292 	for (i = 0; i < asoc->streamoutcnt; i++) {
1293 		/*
1294 		 * inbound side must be set to 0xffff, also NOTE when we get
1295 		 * the INIT-ACK back (for INIT sender) we MUST reduce the
1296 		 * count (streamoutcnt) but first check if we sent to any of
1297 		 * the upper streams that were dropped (if some were). Those
1298 		 * that were dropped must be notified to the upper layer as
1299 		 * failed to send.
1300 		 */
1301 		TAILQ_INIT(&asoc->strmout[i].outqueue);
1302 		asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL);
1303 		asoc->strmout[i].chunks_on_queues = 0;
1304 #if defined(SCTP_DETAILED_STR_STATS)
1305 		for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1306 			asoc->strmout[i].abandoned_sent[j] = 0;
1307 			asoc->strmout[i].abandoned_unsent[j] = 0;
1308 		}
1309 #else
1310 		asoc->strmout[i].abandoned_sent[0] = 0;
1311 		asoc->strmout[i].abandoned_unsent[0] = 0;
1312 #endif
1313 		asoc->strmout[i].next_mid_ordered = 0;
1314 		asoc->strmout[i].next_mid_unordered = 0;
1315 		asoc->strmout[i].sid = i;
1316 		asoc->strmout[i].last_msg_incomplete = 0;
1317 		asoc->strmout[i].state = SCTP_STREAM_OPENING;
1318 	}
1319 	asoc->ss_functions.sctp_ss_init(stcb, asoc);
1320 	SCTP_TCB_SEND_UNLOCK(stcb);
1321 
1322 	/* Now the mapping array */
1323 	asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1324 	SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1325 	    SCTP_M_MAP);
1326 	if (asoc->mapping_array == NULL) {
1327 		SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1328 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1329 		return (ENOMEM);
1330 	}
1331 	memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1332 	SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1333 	    SCTP_M_MAP);
1334 	if (asoc->nr_mapping_array == NULL) {
1335 		SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1336 		SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1337 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1338 		return (ENOMEM);
1339 	}
1340 	memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1341 
1342 	/* Now the init of the other outqueues */
1343 	TAILQ_INIT(&asoc->free_chunks);
1344 	TAILQ_INIT(&asoc->control_send_queue);
1345 	TAILQ_INIT(&asoc->asconf_send_queue);
1346 	TAILQ_INIT(&asoc->send_queue);
1347 	TAILQ_INIT(&asoc->sent_queue);
1348 	TAILQ_INIT(&asoc->resetHead);
1349 	asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1350 	TAILQ_INIT(&asoc->asconf_queue);
1351 	/* authentication fields */
1352 	asoc->authinfo.random = NULL;
1353 	asoc->authinfo.active_keyid = 0;
1354 	asoc->authinfo.assoc_key = NULL;
1355 	asoc->authinfo.assoc_keyid = 0;
1356 	asoc->authinfo.recv_key = NULL;
1357 	asoc->authinfo.recv_keyid = 0;
1358 	LIST_INIT(&asoc->shared_keys);
1359 	asoc->marked_retrans = 0;
1360 	asoc->port = inp->sctp_ep.port;
1361 	asoc->timoinit = 0;
1362 	asoc->timodata = 0;
1363 	asoc->timosack = 0;
1364 	asoc->timoshutdown = 0;
1365 	asoc->timoheartbeat = 0;
1366 	asoc->timocookie = 0;
1367 	asoc->timoshutdownack = 0;
1368 	(void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1369 	asoc->discontinuity_time = asoc->start_time;
1370 	for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1371 		asoc->abandoned_unsent[i] = 0;
1372 		asoc->abandoned_sent[i] = 0;
1373 	}
1374 	/*
1375 	 * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1376 	 * freed later when the association is freed.
1377 	 */
1378 	return (0);
1379 }
1380 
1381 void
1382 sctp_print_mapping_array(struct sctp_association *asoc)
1383 {
1384 	unsigned int i, limit;
1385 
1386 	SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1387 	    asoc->mapping_array_size,
1388 	    asoc->mapping_array_base_tsn,
1389 	    asoc->cumulative_tsn,
1390 	    asoc->highest_tsn_inside_map,
1391 	    asoc->highest_tsn_inside_nr_map);
1392 	for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1393 		if (asoc->mapping_array[limit - 1] != 0) {
1394 			break;
1395 		}
1396 	}
1397 	SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1398 	for (i = 0; i < limit; i++) {
1399 		SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1400 	}
1401 	if (limit % 16)
1402 		SCTP_PRINTF("\n");
1403 	for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1404 		if (asoc->nr_mapping_array[limit - 1]) {
1405 			break;
1406 		}
1407 	}
1408 	SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1409 	for (i = 0; i < limit; i++) {
1410 		SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1411 	}
1412 	if (limit % 16)
1413 		SCTP_PRINTF("\n");
1414 }
1415 
1416 int
1417 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1418 {
1419 	/* mapping array needs to grow */
1420 	uint8_t *new_array1, *new_array2;
1421 	uint32_t new_size;
1422 
1423 	new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1424 	SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1425 	SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1426 	if ((new_array1 == NULL) || (new_array2 == NULL)) {
1427 		/* can't get more, forget it */
1428 		SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1429 		if (new_array1) {
1430 			SCTP_FREE(new_array1, SCTP_M_MAP);
1431 		}
1432 		if (new_array2) {
1433 			SCTP_FREE(new_array2, SCTP_M_MAP);
1434 		}
1435 		return (-1);
1436 	}
1437 	memset(new_array1, 0, new_size);
1438 	memset(new_array2, 0, new_size);
1439 	memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1440 	memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1441 	SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1442 	SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1443 	asoc->mapping_array = new_array1;
1444 	asoc->nr_mapping_array = new_array2;
1445 	asoc->mapping_array_size = new_size;
1446 	return (0);
1447 }
1448 
1449 static void
1450 sctp_iterator_work(struct sctp_iterator *it)
1451 {
1452 	struct epoch_tracker et;
1453 	struct sctp_inpcb *tinp;
1454 	int iteration_count = 0;
1455 	int inp_skip = 0;
1456 	int first_in = 1;
1457 
1458 	NET_EPOCH_ENTER(et);
1459 	SCTP_INP_INFO_RLOCK();
1460 	SCTP_ITERATOR_LOCK();
1461 	sctp_it_ctl.cur_it = it;
1462 	if (it->inp) {
1463 		SCTP_INP_RLOCK(it->inp);
1464 		SCTP_INP_DECR_REF(it->inp);
1465 	}
1466 	if (it->inp == NULL) {
1467 		/* iterator is complete */
1468 done_with_iterator:
1469 		sctp_it_ctl.cur_it = NULL;
1470 		SCTP_ITERATOR_UNLOCK();
1471 		SCTP_INP_INFO_RUNLOCK();
1472 		if (it->function_atend != NULL) {
1473 			(*it->function_atend) (it->pointer, it->val);
1474 		}
1475 		SCTP_FREE(it, SCTP_M_ITER);
1476 		NET_EPOCH_EXIT(et);
1477 		return;
1478 	}
1479 select_a_new_ep:
1480 	if (first_in) {
1481 		first_in = 0;
1482 	} else {
1483 		SCTP_INP_RLOCK(it->inp);
1484 	}
1485 	while (((it->pcb_flags) &&
1486 	    ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1487 	    ((it->pcb_features) &&
1488 	    ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1489 		/* endpoint flags or features don't match, so keep looking */
1490 		if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1491 			SCTP_INP_RUNLOCK(it->inp);
1492 			goto done_with_iterator;
1493 		}
1494 		tinp = it->inp;
1495 		it->inp = LIST_NEXT(it->inp, sctp_list);
1496 		it->stcb = NULL;
1497 		SCTP_INP_RUNLOCK(tinp);
1498 		if (it->inp == NULL) {
1499 			goto done_with_iterator;
1500 		}
1501 		SCTP_INP_RLOCK(it->inp);
1502 	}
1503 	/* now go through each assoc which is in the desired state */
1504 	if (it->done_current_ep == 0) {
1505 		if (it->function_inp != NULL)
1506 			inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1507 		it->done_current_ep = 1;
1508 	}
1509 	if (it->stcb == NULL) {
1510 		/* run the per instance function */
1511 		it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1512 	}
1513 	if ((inp_skip) || it->stcb == NULL) {
1514 		if (it->function_inp_end != NULL) {
1515 			inp_skip = (*it->function_inp_end) (it->inp,
1516 			    it->pointer,
1517 			    it->val);
1518 		}
1519 		SCTP_INP_RUNLOCK(it->inp);
1520 		goto no_stcb;
1521 	}
1522 	while (it->stcb != NULL) {
1523 		SCTP_TCB_LOCK(it->stcb);
1524 		if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1525 			/* not in the right state... keep looking */
1526 			SCTP_TCB_UNLOCK(it->stcb);
1527 			goto next_assoc;
1528 		}
1529 		/* see if we have limited out the iterator loop */
1530 		iteration_count++;
1531 		if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1532 			/* Pause to let others grab the lock */
1533 			atomic_add_int(&it->stcb->asoc.refcnt, 1);
1534 			SCTP_TCB_UNLOCK(it->stcb);
1535 			SCTP_INP_INCR_REF(it->inp);
1536 			SCTP_INP_RUNLOCK(it->inp);
1537 			SCTP_ITERATOR_UNLOCK();
1538 			SCTP_INP_INFO_RUNLOCK();
1539 			SCTP_INP_INFO_RLOCK();
1540 			SCTP_ITERATOR_LOCK();
1541 			if (sctp_it_ctl.iterator_flags) {
1542 				/* We won't be staying here */
1543 				SCTP_INP_DECR_REF(it->inp);
1544 				atomic_subtract_int(&it->stcb->asoc.refcnt, 1);
1545 				if (sctp_it_ctl.iterator_flags &
1546 				    SCTP_ITERATOR_STOP_CUR_IT) {
1547 					sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1548 					goto done_with_iterator;
1549 				}
1550 				if (sctp_it_ctl.iterator_flags &
1551 				    SCTP_ITERATOR_STOP_CUR_INP) {
1552 					sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1553 					goto no_stcb;
1554 				}
1555 				/* If we reach here huh? */
1556 				SCTP_PRINTF("Unknown it ctl flag %x\n",
1557 				    sctp_it_ctl.iterator_flags);
1558 				sctp_it_ctl.iterator_flags = 0;
1559 			}
1560 			SCTP_INP_RLOCK(it->inp);
1561 			SCTP_INP_DECR_REF(it->inp);
1562 			SCTP_TCB_LOCK(it->stcb);
1563 			atomic_subtract_int(&it->stcb->asoc.refcnt, 1);
1564 			iteration_count = 0;
1565 		}
1566 		KASSERT(it->inp == it->stcb->sctp_ep,
1567 		    ("%s: stcb %p does not belong to inp %p, but inp %p",
1568 		    __func__, it->stcb, it->inp, it->stcb->sctp_ep));
1569 		SCTP_INP_RLOCK_ASSERT(it->inp);
1570 		SCTP_TCB_LOCK_ASSERT(it->stcb);
1571 
1572 		/* run function on this one */
1573 		(*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1574 		SCTP_INP_RLOCK_ASSERT(it->inp);
1575 		SCTP_TCB_LOCK_ASSERT(it->stcb);
1576 
1577 		/*
1578 		 * we lie here, it really needs to have its own type but
1579 		 * first I must verify that this won't effect things :-0
1580 		 */
1581 		if (it->no_chunk_output == 0) {
1582 			sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1583 			SCTP_INP_RLOCK_ASSERT(it->inp);
1584 			SCTP_TCB_LOCK_ASSERT(it->stcb);
1585 		}
1586 
1587 		SCTP_TCB_UNLOCK(it->stcb);
1588 next_assoc:
1589 		it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1590 		if (it->stcb == NULL) {
1591 			/* Run last function */
1592 			if (it->function_inp_end != NULL) {
1593 				inp_skip = (*it->function_inp_end) (it->inp,
1594 				    it->pointer,
1595 				    it->val);
1596 			}
1597 		}
1598 	}
1599 	SCTP_INP_RUNLOCK(it->inp);
1600 no_stcb:
1601 	/* done with all assocs on this endpoint, move on to next endpoint */
1602 	it->done_current_ep = 0;
1603 	if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1604 		it->inp = NULL;
1605 	} else {
1606 		it->inp = LIST_NEXT(it->inp, sctp_list);
1607 	}
1608 	it->stcb = NULL;
1609 	if (it->inp == NULL) {
1610 		goto done_with_iterator;
1611 	}
1612 	goto select_a_new_ep;
1613 }
1614 
1615 void
1616 sctp_iterator_worker(void)
1617 {
1618 	struct sctp_iterator *it;
1619 
1620 	/* This function is called with the WQ lock in place */
1621 	sctp_it_ctl.iterator_running = 1;
1622 	while ((it = TAILQ_FIRST(&sctp_it_ctl.iteratorhead)) != NULL) {
1623 		/* now lets work on this one */
1624 		TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1625 		SCTP_IPI_ITERATOR_WQ_UNLOCK();
1626 		CURVNET_SET(it->vn);
1627 		sctp_iterator_work(it);
1628 		CURVNET_RESTORE();
1629 		SCTP_IPI_ITERATOR_WQ_LOCK();
1630 		/* sa_ignore FREED_MEMORY */
1631 	}
1632 	sctp_it_ctl.iterator_running = 0;
1633 	return;
1634 }
1635 
1636 static void
1637 sctp_handle_addr_wq(void)
1638 {
1639 	/* deal with the ADDR wq from the rtsock calls */
1640 	struct sctp_laddr *wi, *nwi;
1641 	struct sctp_asconf_iterator *asc;
1642 
1643 	SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1644 	    sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1645 	if (asc == NULL) {
1646 		/* Try later, no memory */
1647 		sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1648 		    (struct sctp_inpcb *)NULL,
1649 		    (struct sctp_tcb *)NULL,
1650 		    (struct sctp_nets *)NULL);
1651 		return;
1652 	}
1653 	LIST_INIT(&asc->list_of_work);
1654 	asc->cnt = 0;
1655 
1656 	LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1657 		LIST_REMOVE(wi, sctp_nxt_addr);
1658 		LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1659 		asc->cnt++;
1660 	}
1661 
1662 	if (asc->cnt == 0) {
1663 		SCTP_FREE(asc, SCTP_M_ASC_IT);
1664 	} else {
1665 		int ret;
1666 
1667 		ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
1668 		    sctp_asconf_iterator_stcb,
1669 		    NULL,	/* No ep end for boundall */
1670 		    SCTP_PCB_FLAGS_BOUNDALL,
1671 		    SCTP_PCB_ANY_FEATURES,
1672 		    SCTP_ASOC_ANY_STATE,
1673 		    (void *)asc, 0,
1674 		    sctp_asconf_iterator_end, NULL, 0);
1675 		if (ret) {
1676 			SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n");
1677 			/*
1678 			 * Freeing if we are stopping or put back on the
1679 			 * addr_wq.
1680 			 */
1681 			if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
1682 				sctp_asconf_iterator_end(asc, 0);
1683 			} else {
1684 				LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) {
1685 					LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
1686 				}
1687 				SCTP_FREE(asc, SCTP_M_ASC_IT);
1688 			}
1689 		}
1690 	}
1691 }
1692 
1693 /*-
1694  * The following table shows which pointers for the inp, stcb, or net are
1695  * stored for each timer after it was started.
1696  *
1697  *|Name                         |Timer                        |inp |stcb|net |
1698  *|-----------------------------|-----------------------------|----|----|----|
1699  *|SCTP_TIMER_TYPE_SEND         |net->rxt_timer               |Yes |Yes |Yes |
1700  *|SCTP_TIMER_TYPE_INIT         |net->rxt_timer               |Yes |Yes |Yes |
1701  *|SCTP_TIMER_TYPE_RECV         |stcb->asoc.dack_timer        |Yes |Yes |No  |
1702  *|SCTP_TIMER_TYPE_SHUTDOWN     |net->rxt_timer               |Yes |Yes |Yes |
1703  *|SCTP_TIMER_TYPE_HEARTBEAT    |net->hb_timer                |Yes |Yes |Yes |
1704  *|SCTP_TIMER_TYPE_COOKIE       |net->rxt_timer               |Yes |Yes |Yes |
1705  *|SCTP_TIMER_TYPE_NEWCOOKIE    |inp->sctp_ep.signature_change|Yes |No  |No  |
1706  *|SCTP_TIMER_TYPE_PATHMTURAISE |net->pmtu_timer              |Yes |Yes |Yes |
1707  *|SCTP_TIMER_TYPE_SHUTDOWNACK  |net->rxt_timer               |Yes |Yes |Yes |
1708  *|SCTP_TIMER_TYPE_ASCONF       |stcb->asoc.asconf_timer      |Yes |Yes |Yes |
1709  *|SCTP_TIMER_TYPE_SHUTDOWNGUARD|stcb->asoc.shut_guard_timer  |Yes |Yes |No  |
1710  *|SCTP_TIMER_TYPE_AUTOCLOSE    |stcb->asoc.autoclose_timer   |Yes |Yes |No  |
1711  *|SCTP_TIMER_TYPE_STRRESET     |stcb->asoc.strreset_timer    |Yes |Yes |No  |
1712  *|SCTP_TIMER_TYPE_INPKILL      |inp->sctp_ep.signature_change|Yes |No  |No  |
1713  *|SCTP_TIMER_TYPE_ASOCKILL     |stcb->asoc.strreset_timer    |Yes |Yes |No  |
1714  *|SCTP_TIMER_TYPE_ADDR_WQ      |SCTP_BASE_INFO(addr_wq_timer)|No  |No  |No  |
1715  *|SCTP_TIMER_TYPE_PRIM_DELETED |stcb->asoc.delete_prim_timer |Yes |Yes |No  |
1716  */
1717 
1718 void
1719 sctp_timeout_handler(void *t)
1720 {
1721 	struct epoch_tracker et;
1722 	struct timeval tv;
1723 	struct sctp_inpcb *inp;
1724 	struct sctp_tcb *stcb;
1725 	struct sctp_nets *net;
1726 	struct sctp_timer *tmr;
1727 	struct mbuf *op_err;
1728 	int type;
1729 	int i, secret;
1730 	bool did_output, released_asoc_reference;
1731 
1732 	/*
1733 	 * If inp, stcb or net are not NULL, then references to these were
1734 	 * added when the timer was started, and must be released before
1735 	 * this function returns.
1736 	 */
1737 	tmr = (struct sctp_timer *)t;
1738 	inp = (struct sctp_inpcb *)tmr->ep;
1739 	stcb = (struct sctp_tcb *)tmr->tcb;
1740 	net = (struct sctp_nets *)tmr->net;
1741 	CURVNET_SET((struct vnet *)tmr->vnet);
1742 	NET_EPOCH_ENTER(et);
1743 	released_asoc_reference = false;
1744 
1745 #ifdef SCTP_AUDITING_ENABLED
1746 	sctp_audit_log(0xF0, (uint8_t)tmr->type);
1747 	sctp_auditing(3, inp, stcb, net);
1748 #endif
1749 
1750 	/* sanity checks... */
1751 	KASSERT(tmr->self == NULL || tmr->self == tmr,
1752 	    ("sctp_timeout_handler: tmr->self corrupted"));
1753 	KASSERT(SCTP_IS_TIMER_TYPE_VALID(tmr->type),
1754 	    ("sctp_timeout_handler: invalid timer type %d", tmr->type));
1755 	type = tmr->type;
1756 	KASSERT(stcb == NULL || stcb->sctp_ep == inp,
1757 	    ("sctp_timeout_handler of type %d: inp = %p, stcb->sctp_ep %p",
1758 	    type, stcb, stcb->sctp_ep));
1759 	tmr->stopped_from = 0xa001;
1760 	if ((stcb != NULL) && (stcb->asoc.state == SCTP_STATE_EMPTY)) {
1761 		SCTPDBG(SCTP_DEBUG_TIMER2,
1762 		    "Timer type %d handler exiting due to CLOSED association.\n",
1763 		    type);
1764 		goto out_decr;
1765 	}
1766 	tmr->stopped_from = 0xa002;
1767 	SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d goes off.\n", type);
1768 	if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1769 		SCTPDBG(SCTP_DEBUG_TIMER2,
1770 		    "Timer type %d handler exiting due to not being active.\n",
1771 		    type);
1772 		goto out_decr;
1773 	}
1774 
1775 	tmr->stopped_from = 0xa003;
1776 	if (stcb) {
1777 		SCTP_TCB_LOCK(stcb);
1778 		/*
1779 		 * Release reference so that association can be freed if
1780 		 * necessary below. This is safe now that we have acquired
1781 		 * the lock.
1782 		 */
1783 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
1784 		released_asoc_reference = true;
1785 		if ((type != SCTP_TIMER_TYPE_ASOCKILL) &&
1786 		    ((stcb->asoc.state == SCTP_STATE_EMPTY) ||
1787 		    (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1788 			SCTPDBG(SCTP_DEBUG_TIMER2,
1789 			    "Timer type %d handler exiting due to CLOSED association.\n",
1790 			    type);
1791 			goto out;
1792 		}
1793 	} else if (inp != NULL) {
1794 		SCTP_INP_WLOCK(inp);
1795 	} else {
1796 		SCTP_WQ_ADDR_LOCK();
1797 	}
1798 
1799 	/* Record in stopped_from which timeout occurred. */
1800 	tmr->stopped_from = type;
1801 	/* mark as being serviced now */
1802 	if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1803 		/*
1804 		 * Callout has been rescheduled.
1805 		 */
1806 		goto out;
1807 	}
1808 	if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1809 		/*
1810 		 * Not active, so no action.
1811 		 */
1812 		goto out;
1813 	}
1814 	SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1815 
1816 	/* call the handler for the appropriate timer type */
1817 	switch (type) {
1818 	case SCTP_TIMER_TYPE_SEND:
1819 		KASSERT(inp != NULL && stcb != NULL && net != NULL,
1820 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1821 		    type, inp, stcb, net));
1822 		SCTP_STAT_INCR(sctps_timodata);
1823 		stcb->asoc.timodata++;
1824 		stcb->asoc.num_send_timers_up--;
1825 		if (stcb->asoc.num_send_timers_up < 0) {
1826 			stcb->asoc.num_send_timers_up = 0;
1827 		}
1828 		SCTP_TCB_LOCK_ASSERT(stcb);
1829 		if (sctp_t3rxt_timer(inp, stcb, net)) {
1830 			/* no need to unlock on tcb its gone */
1831 
1832 			goto out_decr;
1833 		}
1834 		SCTP_TCB_LOCK_ASSERT(stcb);
1835 #ifdef SCTP_AUDITING_ENABLED
1836 		sctp_auditing(4, inp, stcb, net);
1837 #endif
1838 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1839 		did_output = true;
1840 		if ((stcb->asoc.num_send_timers_up == 0) &&
1841 		    (stcb->asoc.sent_queue_cnt > 0)) {
1842 			struct sctp_tmit_chunk *chk;
1843 
1844 			/*
1845 			 * Safeguard. If there on some on the sent queue
1846 			 * somewhere but no timers running something is
1847 			 * wrong... so we start a timer on the first chunk
1848 			 * on the send queue on whatever net it is sent to.
1849 			 */
1850 			TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1851 				if (chk->whoTo != NULL) {
1852 					break;
1853 				}
1854 			}
1855 			if (chk != NULL) {
1856 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
1857 			}
1858 		}
1859 		break;
1860 	case SCTP_TIMER_TYPE_INIT:
1861 		KASSERT(inp != NULL && stcb != NULL && net != NULL,
1862 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1863 		    type, inp, stcb, net));
1864 		SCTP_STAT_INCR(sctps_timoinit);
1865 		stcb->asoc.timoinit++;
1866 		if (sctp_t1init_timer(inp, stcb, net)) {
1867 			/* no need to unlock on tcb its gone */
1868 			goto out_decr;
1869 		}
1870 		did_output = false;
1871 		break;
1872 	case SCTP_TIMER_TYPE_RECV:
1873 		KASSERT(inp != NULL && stcb != NULL && net == NULL,
1874 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1875 		    type, inp, stcb, net));
1876 		SCTP_STAT_INCR(sctps_timosack);
1877 		stcb->asoc.timosack++;
1878 		sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1879 #ifdef SCTP_AUDITING_ENABLED
1880 		sctp_auditing(4, inp, stcb, NULL);
1881 #endif
1882 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1883 		did_output = true;
1884 		break;
1885 	case SCTP_TIMER_TYPE_SHUTDOWN:
1886 		KASSERT(inp != NULL && stcb != NULL && net != NULL,
1887 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1888 		    type, inp, stcb, net));
1889 		SCTP_STAT_INCR(sctps_timoshutdown);
1890 		stcb->asoc.timoshutdown++;
1891 		if (sctp_shutdown_timer(inp, stcb, net)) {
1892 			/* no need to unlock on tcb its gone */
1893 			goto out_decr;
1894 		}
1895 #ifdef SCTP_AUDITING_ENABLED
1896 		sctp_auditing(4, inp, stcb, net);
1897 #endif
1898 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1899 		did_output = true;
1900 		break;
1901 	case SCTP_TIMER_TYPE_HEARTBEAT:
1902 		KASSERT(inp != NULL && stcb != NULL && net != NULL,
1903 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1904 		    type, inp, stcb, net));
1905 		SCTP_STAT_INCR(sctps_timoheartbeat);
1906 		stcb->asoc.timoheartbeat++;
1907 		if (sctp_heartbeat_timer(inp, stcb, net)) {
1908 			/* no need to unlock on tcb its gone */
1909 			goto out_decr;
1910 		}
1911 #ifdef SCTP_AUDITING_ENABLED
1912 		sctp_auditing(4, inp, stcb, net);
1913 #endif
1914 		if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1915 			sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1916 			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1917 			did_output = true;
1918 		} else {
1919 			did_output = false;
1920 		}
1921 		break;
1922 	case SCTP_TIMER_TYPE_COOKIE:
1923 		KASSERT(inp != NULL && stcb != NULL && net != NULL,
1924 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1925 		    type, inp, stcb, net));
1926 		SCTP_STAT_INCR(sctps_timocookie);
1927 		stcb->asoc.timocookie++;
1928 		if (sctp_cookie_timer(inp, stcb, net)) {
1929 			/* no need to unlock on tcb its gone */
1930 			goto out_decr;
1931 		}
1932 #ifdef SCTP_AUDITING_ENABLED
1933 		sctp_auditing(4, inp, stcb, net);
1934 #endif
1935 		/*
1936 		 * We consider T3 and Cookie timer pretty much the same with
1937 		 * respect to where from in chunk_output.
1938 		 */
1939 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1940 		did_output = true;
1941 		break;
1942 	case SCTP_TIMER_TYPE_NEWCOOKIE:
1943 		KASSERT(inp != NULL && stcb == NULL && net == NULL,
1944 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1945 		    type, inp, stcb, net));
1946 		SCTP_STAT_INCR(sctps_timosecret);
1947 		(void)SCTP_GETTIME_TIMEVAL(&tv);
1948 		inp->sctp_ep.time_of_secret_change = (unsigned int)tv.tv_sec;
1949 		inp->sctp_ep.last_secret_number =
1950 		    inp->sctp_ep.current_secret_number;
1951 		inp->sctp_ep.current_secret_number++;
1952 		if (inp->sctp_ep.current_secret_number >=
1953 		    SCTP_HOW_MANY_SECRETS) {
1954 			inp->sctp_ep.current_secret_number = 0;
1955 		}
1956 		secret = (int)inp->sctp_ep.current_secret_number;
1957 		for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1958 			inp->sctp_ep.secret_key[secret][i] =
1959 			    sctp_select_initial_TSN(&inp->sctp_ep);
1960 		}
1961 		sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
1962 		did_output = false;
1963 		break;
1964 	case SCTP_TIMER_TYPE_PATHMTURAISE:
1965 		KASSERT(inp != NULL && stcb != NULL && net != NULL,
1966 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1967 		    type, inp, stcb, net));
1968 		SCTP_STAT_INCR(sctps_timopathmtu);
1969 		sctp_pathmtu_timer(inp, stcb, net);
1970 		did_output = false;
1971 		break;
1972 	case SCTP_TIMER_TYPE_SHUTDOWNACK:
1973 		KASSERT(inp != NULL && stcb != NULL && net != NULL,
1974 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1975 		    type, inp, stcb, net));
1976 		if (sctp_shutdownack_timer(inp, stcb, net)) {
1977 			/* no need to unlock on tcb its gone */
1978 			goto out_decr;
1979 		}
1980 		SCTP_STAT_INCR(sctps_timoshutdownack);
1981 		stcb->asoc.timoshutdownack++;
1982 #ifdef SCTP_AUDITING_ENABLED
1983 		sctp_auditing(4, inp, stcb, net);
1984 #endif
1985 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1986 		did_output = true;
1987 		break;
1988 	case SCTP_TIMER_TYPE_ASCONF:
1989 		KASSERT(inp != NULL && stcb != NULL && net != NULL,
1990 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1991 		    type, inp, stcb, net));
1992 		SCTP_STAT_INCR(sctps_timoasconf);
1993 		if (sctp_asconf_timer(inp, stcb, net)) {
1994 			/* no need to unlock on tcb its gone */
1995 			goto out_decr;
1996 		}
1997 #ifdef SCTP_AUDITING_ENABLED
1998 		sctp_auditing(4, inp, stcb, net);
1999 #endif
2000 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
2001 		did_output = true;
2002 		break;
2003 	case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2004 		KASSERT(inp != NULL && stcb != NULL && net == NULL,
2005 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2006 		    type, inp, stcb, net));
2007 		SCTP_STAT_INCR(sctps_timoshutdownguard);
2008 		op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
2009 		    "Shutdown guard timer expired");
2010 		sctp_abort_an_association(inp, stcb, op_err, true, SCTP_SO_NOT_LOCKED);
2011 		/* no need to unlock on tcb its gone */
2012 		goto out_decr;
2013 	case SCTP_TIMER_TYPE_AUTOCLOSE:
2014 		KASSERT(inp != NULL && stcb != NULL && net == NULL,
2015 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2016 		    type, inp, stcb, net));
2017 		SCTP_STAT_INCR(sctps_timoautoclose);
2018 		sctp_autoclose_timer(inp, stcb);
2019 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
2020 		did_output = true;
2021 		break;
2022 	case SCTP_TIMER_TYPE_STRRESET:
2023 		KASSERT(inp != NULL && stcb != NULL && net == NULL,
2024 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2025 		    type, inp, stcb, net));
2026 		SCTP_STAT_INCR(sctps_timostrmrst);
2027 		if (sctp_strreset_timer(inp, stcb)) {
2028 			/* no need to unlock on tcb its gone */
2029 			goto out_decr;
2030 		}
2031 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
2032 		did_output = true;
2033 		break;
2034 	case SCTP_TIMER_TYPE_INPKILL:
2035 		KASSERT(inp != NULL && stcb == NULL && net == NULL,
2036 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2037 		    type, inp, stcb, net));
2038 		SCTP_STAT_INCR(sctps_timoinpkill);
2039 		/*
2040 		 * special case, take away our increment since WE are the
2041 		 * killer
2042 		 */
2043 		sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL,
2044 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
2045 		SCTP_INP_DECR_REF(inp);
2046 		SCTP_INP_WUNLOCK(inp);
2047 		sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
2048 		    SCTP_CALLED_FROM_INPKILL_TIMER);
2049 		inp = NULL;
2050 		goto out_decr;
2051 	case SCTP_TIMER_TYPE_ASOCKILL:
2052 		KASSERT(inp != NULL && stcb != NULL && net == NULL,
2053 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2054 		    type, inp, stcb, net));
2055 		SCTP_STAT_INCR(sctps_timoassockill);
2056 		/* Can we free it yet? */
2057 		sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
2058 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
2059 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2060 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
2061 		/*
2062 		 * free asoc, always unlocks (or destroy's) so prevent
2063 		 * duplicate unlock or unlock of a free mtx :-0
2064 		 */
2065 		stcb = NULL;
2066 		goto out_decr;
2067 	case SCTP_TIMER_TYPE_ADDR_WQ:
2068 		KASSERT(inp == NULL && stcb == NULL && net == NULL,
2069 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2070 		    type, inp, stcb, net));
2071 		sctp_handle_addr_wq();
2072 		did_output = true;
2073 		break;
2074 	case SCTP_TIMER_TYPE_PRIM_DELETED:
2075 		KASSERT(inp != NULL && stcb != NULL && net == NULL,
2076 		    ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2077 		    type, inp, stcb, net));
2078 		SCTP_STAT_INCR(sctps_timodelprim);
2079 		sctp_delete_prim_timer(inp, stcb);
2080 		did_output = false;
2081 		break;
2082 	default:
2083 #ifdef INVARIANTS
2084 		panic("Unknown timer type %d", type);
2085 #else
2086 		goto out;
2087 #endif
2088 	}
2089 #ifdef SCTP_AUDITING_ENABLED
2090 	sctp_audit_log(0xF1, (uint8_t)type);
2091 	if (inp != NULL)
2092 		sctp_auditing(5, inp, stcb, net);
2093 #endif
2094 	if (did_output && (stcb != NULL)) {
2095 		/*
2096 		 * Now we need to clean up the control chunk chain if an
2097 		 * ECNE is on it. It must be marked as UNSENT again so next
2098 		 * call will continue to send it until such time that we get
2099 		 * a CWR, to remove it. It is, however, less likely that we
2100 		 * will find a ecn echo on the chain though.
2101 		 */
2102 		sctp_fix_ecn_echo(&stcb->asoc);
2103 	}
2104 out:
2105 	if (stcb != NULL) {
2106 		SCTP_TCB_UNLOCK(stcb);
2107 	} else if (inp != NULL) {
2108 		SCTP_INP_WUNLOCK(inp);
2109 	} else {
2110 		SCTP_WQ_ADDR_UNLOCK();
2111 	}
2112 
2113 out_decr:
2114 	/* These reference counts were incremented in sctp_timer_start(). */
2115 	if (inp != NULL) {
2116 		SCTP_INP_DECR_REF(inp);
2117 	}
2118 	if ((stcb != NULL) && !released_asoc_reference) {
2119 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
2120 	}
2121 	if (net != NULL) {
2122 		sctp_free_remote_addr(net);
2123 	}
2124 	SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d handler finished.\n", type);
2125 	CURVNET_RESTORE();
2126 	NET_EPOCH_EXIT(et);
2127 }
2128 
2129 /*-
2130  * The following table shows which parameters must be provided
2131  * when calling sctp_timer_start(). For parameters not being
2132  * provided, NULL must be used.
2133  *
2134  * |Name                         |inp |stcb|net |
2135  * |-----------------------------|----|----|----|
2136  * |SCTP_TIMER_TYPE_SEND         |Yes |Yes |Yes |
2137  * |SCTP_TIMER_TYPE_INIT         |Yes |Yes |Yes |
2138  * |SCTP_TIMER_TYPE_RECV         |Yes |Yes |No  |
2139  * |SCTP_TIMER_TYPE_SHUTDOWN     |Yes |Yes |Yes |
2140  * |SCTP_TIMER_TYPE_HEARTBEAT    |Yes |Yes |Yes |
2141  * |SCTP_TIMER_TYPE_COOKIE       |Yes |Yes |Yes |
2142  * |SCTP_TIMER_TYPE_NEWCOOKIE    |Yes |No  |No  |
2143  * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes |
2144  * |SCTP_TIMER_TYPE_SHUTDOWNACK  |Yes |Yes |Yes |
2145  * |SCTP_TIMER_TYPE_ASCONF       |Yes |Yes |Yes |
2146  * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No  |
2147  * |SCTP_TIMER_TYPE_AUTOCLOSE    |Yes |Yes |No  |
2148  * |SCTP_TIMER_TYPE_STRRESET     |Yes |Yes |Yes |
2149  * |SCTP_TIMER_TYPE_INPKILL      |Yes |No  |No  |
2150  * |SCTP_TIMER_TYPE_ASOCKILL     |Yes |Yes |No  |
2151  * |SCTP_TIMER_TYPE_ADDR_WQ      |No  |No  |No  |
2152  * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No  |
2153  *
2154  */
2155 
2156 void
2157 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2158     struct sctp_nets *net)
2159 {
2160 	struct sctp_timer *tmr;
2161 	uint32_t to_ticks;
2162 	uint32_t rndval, jitter;
2163 
2164 	KASSERT(stcb == NULL || stcb->sctp_ep == inp,
2165 	    ("sctp_timer_start of type %d: inp = %p, stcb->sctp_ep %p",
2166 	    t_type, stcb, stcb->sctp_ep));
2167 	tmr = NULL;
2168 	if (stcb != NULL) {
2169 		SCTP_TCB_LOCK_ASSERT(stcb);
2170 	} else if (inp != NULL) {
2171 		SCTP_INP_WLOCK_ASSERT(inp);
2172 	} else {
2173 		SCTP_WQ_ADDR_LOCK_ASSERT();
2174 	}
2175 	if (stcb != NULL) {
2176 		/*
2177 		 * Don't restart timer on association that's about to be
2178 		 * killed.
2179 		 */
2180 		if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
2181 		    (t_type != SCTP_TIMER_TYPE_ASOCKILL)) {
2182 			SCTPDBG(SCTP_DEBUG_TIMER2,
2183 			    "Timer type %d not started: inp=%p, stcb=%p, net=%p (stcb deleted).\n",
2184 			    t_type, inp, stcb, net);
2185 			return;
2186 		}
2187 		/* Don't restart timer on net that's been removed. */
2188 		if (net != NULL && (net->dest_state & SCTP_ADDR_BEING_DELETED)) {
2189 			SCTPDBG(SCTP_DEBUG_TIMER2,
2190 			    "Timer type %d not started: inp=%p, stcb=%p, net=%p (net deleted).\n",
2191 			    t_type, inp, stcb, net);
2192 			return;
2193 		}
2194 	}
2195 	switch (t_type) {
2196 	case SCTP_TIMER_TYPE_SEND:
2197 		/* Here we use the RTO timer. */
2198 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2199 #ifdef INVARIANTS
2200 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2201 			    t_type, inp, stcb, net);
2202 #else
2203 			return;
2204 #endif
2205 		}
2206 		tmr = &net->rxt_timer;
2207 		if (net->RTO == 0) {
2208 			to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2209 		} else {
2210 			to_ticks = sctp_msecs_to_ticks(net->RTO);
2211 		}
2212 		break;
2213 	case SCTP_TIMER_TYPE_INIT:
2214 		/*
2215 		 * Here we use the INIT timer default usually about 1
2216 		 * second.
2217 		 */
2218 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2219 #ifdef INVARIANTS
2220 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2221 			    t_type, inp, stcb, net);
2222 #else
2223 			return;
2224 #endif
2225 		}
2226 		tmr = &net->rxt_timer;
2227 		if (net->RTO == 0) {
2228 			to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2229 		} else {
2230 			to_ticks = sctp_msecs_to_ticks(net->RTO);
2231 		}
2232 		break;
2233 	case SCTP_TIMER_TYPE_RECV:
2234 		/*
2235 		 * Here we use the Delayed-Ack timer value from the inp,
2236 		 * ususually about 200ms.
2237 		 */
2238 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2239 #ifdef INVARIANTS
2240 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2241 			    t_type, inp, stcb, net);
2242 #else
2243 			return;
2244 #endif
2245 		}
2246 		tmr = &stcb->asoc.dack_timer;
2247 		to_ticks = sctp_msecs_to_ticks(stcb->asoc.delayed_ack);
2248 		break;
2249 	case SCTP_TIMER_TYPE_SHUTDOWN:
2250 		/* Here we use the RTO of the destination. */
2251 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2252 #ifdef INVARIANTS
2253 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2254 			    t_type, inp, stcb, net);
2255 #else
2256 			return;
2257 #endif
2258 		}
2259 		tmr = &net->rxt_timer;
2260 		if (net->RTO == 0) {
2261 			to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2262 		} else {
2263 			to_ticks = sctp_msecs_to_ticks(net->RTO);
2264 		}
2265 		break;
2266 	case SCTP_TIMER_TYPE_HEARTBEAT:
2267 		/*
2268 		 * The net is used here so that we can add in the RTO. Even
2269 		 * though we use a different timer. We also add the HB timer
2270 		 * PLUS a random jitter.
2271 		 */
2272 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2273 #ifdef INVARIANTS
2274 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2275 			    t_type, inp, stcb, net);
2276 #else
2277 			return;
2278 #endif
2279 		}
2280 		if ((net->dest_state & SCTP_ADDR_NOHB) &&
2281 		    !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
2282 			SCTPDBG(SCTP_DEBUG_TIMER2,
2283 			    "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n",
2284 			    t_type, inp, stcb, net);
2285 			return;
2286 		}
2287 		tmr = &net->hb_timer;
2288 		if (net->RTO == 0) {
2289 			to_ticks = stcb->asoc.initial_rto;
2290 		} else {
2291 			to_ticks = net->RTO;
2292 		}
2293 		rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2294 		jitter = rndval % to_ticks;
2295 		if (to_ticks > 1) {
2296 			to_ticks >>= 1;
2297 		}
2298 		if (jitter < (UINT32_MAX - to_ticks)) {
2299 			to_ticks += jitter;
2300 		} else {
2301 			to_ticks = UINT32_MAX;
2302 		}
2303 		if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2304 		    !(net->dest_state & SCTP_ADDR_PF)) {
2305 			if (net->heart_beat_delay < (UINT32_MAX - to_ticks)) {
2306 				to_ticks += net->heart_beat_delay;
2307 			} else {
2308 				to_ticks = UINT32_MAX;
2309 			}
2310 		}
2311 		/*
2312 		 * Now we must convert the to_ticks that are now in ms to
2313 		 * ticks.
2314 		 */
2315 		to_ticks = sctp_msecs_to_ticks(to_ticks);
2316 		break;
2317 	case SCTP_TIMER_TYPE_COOKIE:
2318 		/*
2319 		 * Here we can use the RTO timer from the network since one
2320 		 * RTT was complete. If a retransmission happened then we
2321 		 * will be using the RTO initial value.
2322 		 */
2323 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2324 #ifdef INVARIANTS
2325 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2326 			    t_type, inp, stcb, net);
2327 #else
2328 			return;
2329 #endif
2330 		}
2331 		tmr = &net->rxt_timer;
2332 		if (net->RTO == 0) {
2333 			to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2334 		} else {
2335 			to_ticks = sctp_msecs_to_ticks(net->RTO);
2336 		}
2337 		break;
2338 	case SCTP_TIMER_TYPE_NEWCOOKIE:
2339 		/*
2340 		 * Nothing needed but the endpoint here ususually about 60
2341 		 * minutes.
2342 		 */
2343 		if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2344 #ifdef INVARIANTS
2345 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2346 			    t_type, inp, stcb, net);
2347 #else
2348 			return;
2349 #endif
2350 		}
2351 		tmr = &inp->sctp_ep.signature_change;
2352 		to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2353 		break;
2354 	case SCTP_TIMER_TYPE_PATHMTURAISE:
2355 		/*
2356 		 * Here we use the value found in the EP for PMTUD,
2357 		 * ususually about 10 minutes.
2358 		 */
2359 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2360 #ifdef INVARIANTS
2361 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2362 			    t_type, inp, stcb, net);
2363 #else
2364 			return;
2365 #endif
2366 		}
2367 		if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2368 			SCTPDBG(SCTP_DEBUG_TIMER2,
2369 			    "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n",
2370 			    t_type, inp, stcb, net);
2371 			return;
2372 		}
2373 		tmr = &net->pmtu_timer;
2374 		to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2375 		break;
2376 	case SCTP_TIMER_TYPE_SHUTDOWNACK:
2377 		/* Here we use the RTO of the destination. */
2378 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2379 #ifdef INVARIANTS
2380 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2381 			    t_type, inp, stcb, net);
2382 #else
2383 			return;
2384 #endif
2385 		}
2386 		tmr = &net->rxt_timer;
2387 		if (net->RTO == 0) {
2388 			to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2389 		} else {
2390 			to_ticks = sctp_msecs_to_ticks(net->RTO);
2391 		}
2392 		break;
2393 	case SCTP_TIMER_TYPE_ASCONF:
2394 		/*
2395 		 * Here the timer comes from the stcb but its value is from
2396 		 * the net's RTO.
2397 		 */
2398 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2399 #ifdef INVARIANTS
2400 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2401 			    t_type, inp, stcb, net);
2402 #else
2403 			return;
2404 #endif
2405 		}
2406 		tmr = &stcb->asoc.asconf_timer;
2407 		if (net->RTO == 0) {
2408 			to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2409 		} else {
2410 			to_ticks = sctp_msecs_to_ticks(net->RTO);
2411 		}
2412 		break;
2413 	case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2414 		/*
2415 		 * Here we use the endpoints shutdown guard timer usually
2416 		 * about 3 minutes.
2417 		 */
2418 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2419 #ifdef INVARIANTS
2420 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2421 			    t_type, inp, stcb, net);
2422 #else
2423 			return;
2424 #endif
2425 		}
2426 		tmr = &stcb->asoc.shut_guard_timer;
2427 		if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) {
2428 			if (stcb->asoc.maxrto < UINT32_MAX / 5) {
2429 				to_ticks = sctp_msecs_to_ticks(5 * stcb->asoc.maxrto);
2430 			} else {
2431 				to_ticks = sctp_msecs_to_ticks(UINT32_MAX);
2432 			}
2433 		} else {
2434 			to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2435 		}
2436 		break;
2437 	case SCTP_TIMER_TYPE_AUTOCLOSE:
2438 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2439 #ifdef INVARIANTS
2440 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2441 			    t_type, inp, stcb, net);
2442 #else
2443 			return;
2444 #endif
2445 		}
2446 		tmr = &stcb->asoc.autoclose_timer;
2447 		to_ticks = stcb->asoc.sctp_autoclose_ticks;
2448 		break;
2449 	case SCTP_TIMER_TYPE_STRRESET:
2450 		/*
2451 		 * Here the timer comes from the stcb but its value is from
2452 		 * the net's RTO.
2453 		 */
2454 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2455 #ifdef INVARIANTS
2456 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2457 			    t_type, inp, stcb, net);
2458 #else
2459 			return;
2460 #endif
2461 		}
2462 		tmr = &stcb->asoc.strreset_timer;
2463 		if (net->RTO == 0) {
2464 			to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2465 		} else {
2466 			to_ticks = sctp_msecs_to_ticks(net->RTO);
2467 		}
2468 		break;
2469 	case SCTP_TIMER_TYPE_INPKILL:
2470 		/*
2471 		 * The inp is setup to die. We re-use the signature_chage
2472 		 * timer since that has stopped and we are in the GONE
2473 		 * state.
2474 		 */
2475 		if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2476 #ifdef INVARIANTS
2477 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2478 			    t_type, inp, stcb, net);
2479 #else
2480 			return;
2481 #endif
2482 		}
2483 		tmr = &inp->sctp_ep.signature_change;
2484 		to_ticks = sctp_msecs_to_ticks(SCTP_INP_KILL_TIMEOUT);
2485 		break;
2486 	case SCTP_TIMER_TYPE_ASOCKILL:
2487 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2488 #ifdef INVARIANTS
2489 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2490 			    t_type, inp, stcb, net);
2491 #else
2492 			return;
2493 #endif
2494 		}
2495 		tmr = &stcb->asoc.strreset_timer;
2496 		to_ticks = sctp_msecs_to_ticks(SCTP_ASOC_KILL_TIMEOUT);
2497 		break;
2498 	case SCTP_TIMER_TYPE_ADDR_WQ:
2499 		if ((inp != NULL) || (stcb != NULL) || (net != NULL)) {
2500 #ifdef INVARIANTS
2501 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2502 			    t_type, inp, stcb, net);
2503 #else
2504 			return;
2505 #endif
2506 		}
2507 		/* Only 1 tick away :-) */
2508 		tmr = &SCTP_BASE_INFO(addr_wq_timer);
2509 		to_ticks = SCTP_ADDRESS_TICK_DELAY;
2510 		break;
2511 	case SCTP_TIMER_TYPE_PRIM_DELETED:
2512 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2513 #ifdef INVARIANTS
2514 			panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2515 			    t_type, inp, stcb, net);
2516 #else
2517 			return;
2518 #endif
2519 		}
2520 		tmr = &stcb->asoc.delete_prim_timer;
2521 		to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2522 		break;
2523 	default:
2524 #ifdef INVARIANTS
2525 		panic("Unknown timer type %d", t_type);
2526 #else
2527 		return;
2528 #endif
2529 	}
2530 	KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type));
2531 	KASSERT(to_ticks > 0, ("to_ticks == 0 for timer type %d", t_type));
2532 	if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2533 		/*
2534 		 * We do NOT allow you to have it already running. If it is,
2535 		 * we leave the current one up unchanged.
2536 		 */
2537 		SCTPDBG(SCTP_DEBUG_TIMER2,
2538 		    "Timer type %d already running: inp=%p, stcb=%p, net=%p.\n",
2539 		    t_type, inp, stcb, net);
2540 		return;
2541 	}
2542 	/* At this point we can proceed. */
2543 	if (t_type == SCTP_TIMER_TYPE_SEND) {
2544 		stcb->asoc.num_send_timers_up++;
2545 	}
2546 	tmr->stopped_from = 0;
2547 	tmr->type = t_type;
2548 	tmr->ep = (void *)inp;
2549 	tmr->tcb = (void *)stcb;
2550 	if (t_type == SCTP_TIMER_TYPE_STRRESET) {
2551 		tmr->net = NULL;
2552 	} else {
2553 		tmr->net = (void *)net;
2554 	}
2555 	tmr->self = (void *)tmr;
2556 	tmr->vnet = (void *)curvnet;
2557 	tmr->ticks = sctp_get_tick_count();
2558 	if (SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr) == 0) {
2559 		SCTPDBG(SCTP_DEBUG_TIMER2,
2560 		    "Timer type %d started: ticks=%u, inp=%p, stcb=%p, net=%p.\n",
2561 		    t_type, to_ticks, inp, stcb, net);
2562 		/*
2563 		 * If this is a newly scheduled callout, as opposed to a
2564 		 * rescheduled one, increment relevant reference counts.
2565 		 */
2566 		if (tmr->ep != NULL) {
2567 			SCTP_INP_INCR_REF(inp);
2568 		}
2569 		if (tmr->tcb != NULL) {
2570 			atomic_add_int(&stcb->asoc.refcnt, 1);
2571 		}
2572 		if (tmr->net != NULL) {
2573 			atomic_add_int(&net->ref_count, 1);
2574 		}
2575 	} else {
2576 		/*
2577 		 * This should not happen, since we checked for pending
2578 		 * above.
2579 		 */
2580 		SCTPDBG(SCTP_DEBUG_TIMER2,
2581 		    "Timer type %d restarted: ticks=%u, inp=%p, stcb=%p, net=%p.\n",
2582 		    t_type, to_ticks, inp, stcb, net);
2583 	}
2584 	return;
2585 }
2586 
2587 /*-
2588  * The following table shows which parameters must be provided
2589  * when calling sctp_timer_stop(). For parameters not being
2590  * provided, NULL must be used.
2591  *
2592  * |Name                         |inp |stcb|net |
2593  * |-----------------------------|----|----|----|
2594  * |SCTP_TIMER_TYPE_SEND         |Yes |Yes |Yes |
2595  * |SCTP_TIMER_TYPE_INIT         |Yes |Yes |Yes |
2596  * |SCTP_TIMER_TYPE_RECV         |Yes |Yes |No  |
2597  * |SCTP_TIMER_TYPE_SHUTDOWN     |Yes |Yes |Yes |
2598  * |SCTP_TIMER_TYPE_HEARTBEAT    |Yes |Yes |Yes |
2599  * |SCTP_TIMER_TYPE_COOKIE       |Yes |Yes |Yes |
2600  * |SCTP_TIMER_TYPE_NEWCOOKIE    |Yes |No  |No  |
2601  * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes |
2602  * |SCTP_TIMER_TYPE_SHUTDOWNACK  |Yes |Yes |Yes |
2603  * |SCTP_TIMER_TYPE_ASCONF       |Yes |Yes |No  |
2604  * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No  |
2605  * |SCTP_TIMER_TYPE_AUTOCLOSE    |Yes |Yes |No  |
2606  * |SCTP_TIMER_TYPE_STRRESET     |Yes |Yes |No  |
2607  * |SCTP_TIMER_TYPE_INPKILL      |Yes |No  |No  |
2608  * |SCTP_TIMER_TYPE_ASOCKILL     |Yes |Yes |No  |
2609  * |SCTP_TIMER_TYPE_ADDR_WQ      |No  |No  |No  |
2610  * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No  |
2611  *
2612  */
2613 
2614 void
2615 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2616     struct sctp_nets *net, uint32_t from)
2617 {
2618 	struct sctp_timer *tmr;
2619 
2620 	KASSERT(stcb == NULL || stcb->sctp_ep == inp,
2621 	    ("sctp_timer_stop of type %d: inp = %p, stcb->sctp_ep %p",
2622 	    t_type, stcb, stcb->sctp_ep));
2623 	if (stcb != NULL) {
2624 		SCTP_TCB_LOCK_ASSERT(stcb);
2625 	} else if (inp != NULL) {
2626 		SCTP_INP_WLOCK_ASSERT(inp);
2627 	} else {
2628 		SCTP_WQ_ADDR_LOCK_ASSERT();
2629 	}
2630 	tmr = NULL;
2631 	switch (t_type) {
2632 	case SCTP_TIMER_TYPE_SEND:
2633 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2634 #ifdef INVARIANTS
2635 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2636 			    t_type, inp, stcb, net);
2637 #else
2638 			return;
2639 #endif
2640 		}
2641 		tmr = &net->rxt_timer;
2642 		break;
2643 	case SCTP_TIMER_TYPE_INIT:
2644 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2645 #ifdef INVARIANTS
2646 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2647 			    t_type, inp, stcb, net);
2648 #else
2649 			return;
2650 #endif
2651 		}
2652 		tmr = &net->rxt_timer;
2653 		break;
2654 	case SCTP_TIMER_TYPE_RECV:
2655 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2656 #ifdef INVARIANTS
2657 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2658 			    t_type, inp, stcb, net);
2659 #else
2660 			return;
2661 #endif
2662 		}
2663 		tmr = &stcb->asoc.dack_timer;
2664 		break;
2665 	case SCTP_TIMER_TYPE_SHUTDOWN:
2666 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2667 #ifdef INVARIANTS
2668 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2669 			    t_type, inp, stcb, net);
2670 #else
2671 			return;
2672 #endif
2673 		}
2674 		tmr = &net->rxt_timer;
2675 		break;
2676 	case SCTP_TIMER_TYPE_HEARTBEAT:
2677 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2678 #ifdef INVARIANTS
2679 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2680 			    t_type, inp, stcb, net);
2681 #else
2682 			return;
2683 #endif
2684 		}
2685 		tmr = &net->hb_timer;
2686 		break;
2687 	case SCTP_TIMER_TYPE_COOKIE:
2688 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2689 #ifdef INVARIANTS
2690 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2691 			    t_type, inp, stcb, net);
2692 #else
2693 			return;
2694 #endif
2695 		}
2696 		tmr = &net->rxt_timer;
2697 		break;
2698 	case SCTP_TIMER_TYPE_NEWCOOKIE:
2699 		if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2700 #ifdef INVARIANTS
2701 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2702 			    t_type, inp, stcb, net);
2703 #else
2704 			return;
2705 #endif
2706 		}
2707 		tmr = &inp->sctp_ep.signature_change;
2708 		break;
2709 	case SCTP_TIMER_TYPE_PATHMTURAISE:
2710 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2711 #ifdef INVARIANTS
2712 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2713 			    t_type, inp, stcb, net);
2714 #else
2715 			return;
2716 #endif
2717 		}
2718 		tmr = &net->pmtu_timer;
2719 		break;
2720 	case SCTP_TIMER_TYPE_SHUTDOWNACK:
2721 		if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2722 #ifdef INVARIANTS
2723 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2724 			    t_type, inp, stcb, net);
2725 #else
2726 			return;
2727 #endif
2728 		}
2729 		tmr = &net->rxt_timer;
2730 		break;
2731 	case SCTP_TIMER_TYPE_ASCONF:
2732 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2733 #ifdef INVARIANTS
2734 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2735 			    t_type, inp, stcb, net);
2736 #else
2737 			return;
2738 #endif
2739 		}
2740 		tmr = &stcb->asoc.asconf_timer;
2741 		break;
2742 	case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2743 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2744 #ifdef INVARIANTS
2745 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2746 			    t_type, inp, stcb, net);
2747 #else
2748 			return;
2749 #endif
2750 		}
2751 		tmr = &stcb->asoc.shut_guard_timer;
2752 		break;
2753 	case SCTP_TIMER_TYPE_AUTOCLOSE:
2754 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2755 #ifdef INVARIANTS
2756 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2757 			    t_type, inp, stcb, net);
2758 #else
2759 			return;
2760 #endif
2761 		}
2762 		tmr = &stcb->asoc.autoclose_timer;
2763 		break;
2764 	case SCTP_TIMER_TYPE_STRRESET:
2765 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2766 #ifdef INVARIANTS
2767 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2768 			    t_type, inp, stcb, net);
2769 #else
2770 			return;
2771 #endif
2772 		}
2773 		tmr = &stcb->asoc.strreset_timer;
2774 		break;
2775 	case SCTP_TIMER_TYPE_INPKILL:
2776 		/*
2777 		 * The inp is setup to die. We re-use the signature_chage
2778 		 * timer since that has stopped and we are in the GONE
2779 		 * state.
2780 		 */
2781 		if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2782 #ifdef INVARIANTS
2783 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2784 			    t_type, inp, stcb, net);
2785 #else
2786 			return;
2787 #endif
2788 		}
2789 		tmr = &inp->sctp_ep.signature_change;
2790 		break;
2791 	case SCTP_TIMER_TYPE_ASOCKILL:
2792 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2793 #ifdef INVARIANTS
2794 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2795 			    t_type, inp, stcb, net);
2796 #else
2797 			return;
2798 #endif
2799 		}
2800 		tmr = &stcb->asoc.strreset_timer;
2801 		break;
2802 	case SCTP_TIMER_TYPE_ADDR_WQ:
2803 		if ((inp != NULL) || (stcb != NULL) || (net != NULL)) {
2804 #ifdef INVARIANTS
2805 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2806 			    t_type, inp, stcb, net);
2807 #else
2808 			return;
2809 #endif
2810 		}
2811 		tmr = &SCTP_BASE_INFO(addr_wq_timer);
2812 		break;
2813 	case SCTP_TIMER_TYPE_PRIM_DELETED:
2814 		if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2815 #ifdef INVARIANTS
2816 			panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2817 			    t_type, inp, stcb, net);
2818 #else
2819 			return;
2820 #endif
2821 		}
2822 		tmr = &stcb->asoc.delete_prim_timer;
2823 		break;
2824 	default:
2825 #ifdef INVARIANTS
2826 		panic("Unknown timer type %d", t_type);
2827 #else
2828 		return;
2829 #endif
2830 	}
2831 	KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type));
2832 	if ((tmr->type != SCTP_TIMER_TYPE_NONE) &&
2833 	    (tmr->type != t_type)) {
2834 		/*
2835 		 * Ok we have a timer that is under joint use. Cookie timer
2836 		 * per chance with the SEND timer. We therefore are NOT
2837 		 * running the timer that the caller wants stopped.  So just
2838 		 * return.
2839 		 */
2840 		SCTPDBG(SCTP_DEBUG_TIMER2,
2841 		    "Shared timer type %d not running: inp=%p, stcb=%p, net=%p.\n",
2842 		    t_type, inp, stcb, net);
2843 		return;
2844 	}
2845 	if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2846 		stcb->asoc.num_send_timers_up--;
2847 		if (stcb->asoc.num_send_timers_up < 0) {
2848 			stcb->asoc.num_send_timers_up = 0;
2849 		}
2850 	}
2851 	tmr->self = NULL;
2852 	tmr->stopped_from = from;
2853 	if (SCTP_OS_TIMER_STOP(&tmr->timer) == 1) {
2854 		KASSERT(tmr->ep == inp,
2855 		    ("sctp_timer_stop of type %d: inp = %p, tmr->inp = %p",
2856 		    t_type, inp, tmr->ep));
2857 		KASSERT(tmr->tcb == stcb,
2858 		    ("sctp_timer_stop of type %d: stcb = %p, tmr->stcb = %p",
2859 		    t_type, stcb, tmr->tcb));
2860 		KASSERT(((t_type == SCTP_TIMER_TYPE_ASCONF) && (tmr->net != NULL)) ||
2861 		    ((t_type != SCTP_TIMER_TYPE_ASCONF) && (tmr->net == net)),
2862 		    ("sctp_timer_stop of type %d: net = %p, tmr->net = %p",
2863 		    t_type, net, tmr->net));
2864 		SCTPDBG(SCTP_DEBUG_TIMER2,
2865 		    "Timer type %d stopped: inp=%p, stcb=%p, net=%p.\n",
2866 		    t_type, inp, stcb, net);
2867 		/*
2868 		 * If the timer was actually stopped, decrement reference
2869 		 * counts that were incremented in sctp_timer_start().
2870 		 */
2871 		if (tmr->ep != NULL) {
2872 			SCTP_INP_DECR_REF(inp);
2873 			tmr->ep = NULL;
2874 		}
2875 		if (tmr->tcb != NULL) {
2876 			atomic_subtract_int(&stcb->asoc.refcnt, 1);
2877 			tmr->tcb = NULL;
2878 		}
2879 		if (tmr->net != NULL) {
2880 			/*
2881 			 * Can't use net, since it doesn't work for
2882 			 * SCTP_TIMER_TYPE_ASCONF.
2883 			 */
2884 			sctp_free_remote_addr((struct sctp_nets *)tmr->net);
2885 			tmr->net = NULL;
2886 		}
2887 	} else {
2888 		SCTPDBG(SCTP_DEBUG_TIMER2,
2889 		    "Timer type %d not stopped: inp=%p, stcb=%p, net=%p.\n",
2890 		    t_type, inp, stcb, net);
2891 	}
2892 	return;
2893 }
2894 
2895 uint32_t
2896 sctp_calculate_len(struct mbuf *m)
2897 {
2898 	struct mbuf *at;
2899 	uint32_t tlen;
2900 
2901 	tlen = 0;
2902 	for (at = m; at != NULL; at = SCTP_BUF_NEXT(at)) {
2903 		tlen += SCTP_BUF_LEN(at);
2904 	}
2905 	return (tlen);
2906 }
2907 
2908 void
2909 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2910     struct sctp_association *asoc, uint32_t mtu)
2911 {
2912 	/*
2913 	 * Reset the P-MTU size on this association, this involves changing
2914 	 * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2915 	 * allow the DF flag to be cleared.
2916 	 */
2917 	struct sctp_tmit_chunk *chk;
2918 	unsigned int eff_mtu, ovh;
2919 
2920 	asoc->smallest_mtu = mtu;
2921 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2922 		ovh = SCTP_MIN_OVERHEAD;
2923 	} else {
2924 		ovh = SCTP_MIN_V4_OVERHEAD;
2925 	}
2926 	eff_mtu = mtu - ovh;
2927 	TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2928 		if (chk->send_size > eff_mtu) {
2929 			chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2930 		}
2931 	}
2932 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2933 		if (chk->send_size > eff_mtu) {
2934 			chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2935 		}
2936 	}
2937 }
2938 
2939 /*
2940  * Given an association and starting time of the current RTT period, update
2941  * RTO in number of msecs. net should point to the current network.
2942  * Return 1, if an RTO update was performed, return 0 if no update was
2943  * performed due to invalid starting point.
2944  */
2945 
2946 int
2947 sctp_calculate_rto(struct sctp_tcb *stcb,
2948     struct sctp_association *asoc,
2949     struct sctp_nets *net,
2950     struct timeval *old,
2951     int rtt_from_sack)
2952 {
2953 	struct timeval now;
2954 	uint64_t rtt_us;	/* RTT in us */
2955 	int32_t rtt;		/* RTT in ms */
2956 	uint32_t new_rto;
2957 	int first_measure = 0;
2958 
2959 	/************************/
2960 	/* 1. calculate new RTT */
2961 	/************************/
2962 	/* get the current time */
2963 	if (stcb->asoc.use_precise_time) {
2964 		(void)SCTP_GETPTIME_TIMEVAL(&now);
2965 	} else {
2966 		(void)SCTP_GETTIME_TIMEVAL(&now);
2967 	}
2968 	if ((old->tv_sec > now.tv_sec) ||
2969 	    ((old->tv_sec == now.tv_sec) && (old->tv_usec > now.tv_usec))) {
2970 		/* The starting point is in the future. */
2971 		return (0);
2972 	}
2973 	timevalsub(&now, old);
2974 	rtt_us = (uint64_t)1000000 * (uint64_t)now.tv_sec + (uint64_t)now.tv_usec;
2975 	if (rtt_us > SCTP_RTO_UPPER_BOUND * 1000) {
2976 		/* The RTT is larger than a sane value. */
2977 		return (0);
2978 	}
2979 	/* store the current RTT in us */
2980 	net->rtt = rtt_us;
2981 	/* compute rtt in ms */
2982 	rtt = (int32_t)(net->rtt / 1000);
2983 	if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2984 		/*
2985 		 * Tell the CC module that a new update has just occurred
2986 		 * from a sack
2987 		 */
2988 		(*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2989 	}
2990 	/*
2991 	 * Do we need to determine the lan? We do this only on sacks i.e.
2992 	 * RTT being determined from data not non-data (HB/INIT->INITACK).
2993 	 */
2994 	if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2995 	    (net->lan_type == SCTP_LAN_UNKNOWN)) {
2996 		if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2997 			net->lan_type = SCTP_LAN_INTERNET;
2998 		} else {
2999 			net->lan_type = SCTP_LAN_LOCAL;
3000 		}
3001 	}
3002 
3003 	/***************************/
3004 	/* 2. update RTTVAR & SRTT */
3005 	/***************************/
3006 	/*-
3007 	 * Compute the scaled average lastsa and the
3008 	 * scaled variance lastsv as described in van Jacobson
3009 	 * Paper "Congestion Avoidance and Control", Annex A.
3010 	 *
3011 	 * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
3012 	 * (net->lastsv >> SCTP_RTT_VAR_SHIFT) is the rttvar
3013 	 */
3014 	if (net->RTO_measured) {
3015 		rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
3016 		net->lastsa += rtt;
3017 		if (rtt < 0) {
3018 			rtt = -rtt;
3019 		}
3020 		rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
3021 		net->lastsv += rtt;
3022 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
3023 			rto_logging(net, SCTP_LOG_RTTVAR);
3024 		}
3025 	} else {
3026 		/* First RTO measurment */
3027 		net->RTO_measured = 1;
3028 		first_measure = 1;
3029 		net->lastsa = rtt << SCTP_RTT_SHIFT;
3030 		net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
3031 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
3032 			rto_logging(net, SCTP_LOG_INITIAL_RTT);
3033 		}
3034 	}
3035 	if (net->lastsv == 0) {
3036 		net->lastsv = SCTP_CLOCK_GRANULARITY;
3037 	}
3038 	new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
3039 	if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
3040 	    (stcb->asoc.sat_network_lockout == 0)) {
3041 		stcb->asoc.sat_network = 1;
3042 	} else if ((!first_measure) && stcb->asoc.sat_network) {
3043 		stcb->asoc.sat_network = 0;
3044 		stcb->asoc.sat_network_lockout = 1;
3045 	}
3046 	/* bound it, per C6/C7 in Section 5.3.1 */
3047 	if (new_rto < stcb->asoc.minrto) {
3048 		new_rto = stcb->asoc.minrto;
3049 	}
3050 	if (new_rto > stcb->asoc.maxrto) {
3051 		new_rto = stcb->asoc.maxrto;
3052 	}
3053 	net->RTO = new_rto;
3054 	return (1);
3055 }
3056 
3057 /*
3058  * return a pointer to a contiguous piece of data from the given mbuf chain
3059  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
3060  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
3061  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
3062  */
3063 caddr_t
3064 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr)
3065 {
3066 	uint32_t count;
3067 	uint8_t *ptr;
3068 
3069 	ptr = in_ptr;
3070 	if ((off < 0) || (len <= 0))
3071 		return (NULL);
3072 
3073 	/* find the desired start location */
3074 	while ((m != NULL) && (off > 0)) {
3075 		if (off < SCTP_BUF_LEN(m))
3076 			break;
3077 		off -= SCTP_BUF_LEN(m);
3078 		m = SCTP_BUF_NEXT(m);
3079 	}
3080 	if (m == NULL)
3081 		return (NULL);
3082 
3083 	/* is the current mbuf large enough (eg. contiguous)? */
3084 	if ((SCTP_BUF_LEN(m) - off) >= len) {
3085 		return (mtod(m, caddr_t)+off);
3086 	} else {
3087 		/* else, it spans more than one mbuf, so save a temp copy... */
3088 		while ((m != NULL) && (len > 0)) {
3089 			count = min(SCTP_BUF_LEN(m) - off, len);
3090 			memcpy(ptr, mtod(m, caddr_t)+off, count);
3091 			len -= count;
3092 			ptr += count;
3093 			off = 0;
3094 			m = SCTP_BUF_NEXT(m);
3095 		}
3096 		if ((m == NULL) && (len > 0))
3097 			return (NULL);
3098 		else
3099 			return ((caddr_t)in_ptr);
3100 	}
3101 }
3102 
3103 struct sctp_paramhdr *
3104 sctp_get_next_param(struct mbuf *m,
3105     int offset,
3106     struct sctp_paramhdr *pull,
3107     int pull_limit)
3108 {
3109 	/* This just provides a typed signature to Peter's Pull routine */
3110 	return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
3111 	    (uint8_t *)pull));
3112 }
3113 
3114 struct mbuf *
3115 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
3116 {
3117 	struct mbuf *m_last;
3118 	caddr_t dp;
3119 
3120 	if (padlen > 3) {
3121 		return (NULL);
3122 	}
3123 	if (padlen <= M_TRAILINGSPACE(m)) {
3124 		/*
3125 		 * The easy way. We hope the majority of the time we hit
3126 		 * here :)
3127 		 */
3128 		m_last = m;
3129 	} else {
3130 		/* Hard way we must grow the mbuf chain */
3131 		m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
3132 		if (m_last == NULL) {
3133 			return (NULL);
3134 		}
3135 		SCTP_BUF_LEN(m_last) = 0;
3136 		SCTP_BUF_NEXT(m_last) = NULL;
3137 		SCTP_BUF_NEXT(m) = m_last;
3138 	}
3139 	dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
3140 	SCTP_BUF_LEN(m_last) += padlen;
3141 	memset(dp, 0, padlen);
3142 	return (m_last);
3143 }
3144 
3145 struct mbuf *
3146 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
3147 {
3148 	/* find the last mbuf in chain and pad it */
3149 	struct mbuf *m_at;
3150 
3151 	if (last_mbuf != NULL) {
3152 		return (sctp_add_pad_tombuf(last_mbuf, padval));
3153 	} else {
3154 		for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
3155 			if (SCTP_BUF_NEXT(m_at) == NULL) {
3156 				return (sctp_add_pad_tombuf(m_at, padval));
3157 			}
3158 		}
3159 	}
3160 	return (NULL);
3161 }
3162 
3163 static void
3164 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
3165     uint16_t error, struct sctp_abort_chunk *abort,
3166     bool from_peer, bool timedout, int so_locked)
3167 {
3168 	struct mbuf *m_notify;
3169 	struct sctp_assoc_change *sac;
3170 	struct sctp_queued_to_read *control;
3171 	unsigned int notif_len;
3172 	uint16_t abort_len;
3173 	unsigned int i;
3174 
3175 	KASSERT(abort == NULL || from_peer,
3176 	    ("sctp_notify_assoc_change: ABORT chunk provided for local termination"));
3177 	KASSERT(!from_peer || !timedout,
3178 	    ("sctp_notify_assoc_change: timeouts can only be local"));
3179 	if (stcb == NULL) {
3180 		return;
3181 	}
3182 	if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
3183 		notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
3184 		if (abort != NULL) {
3185 			abort_len = ntohs(abort->ch.chunk_length);
3186 			/*
3187 			 * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
3188 			 * contiguous.
3189 			 */
3190 			if (abort_len > SCTP_CHUNK_BUFFER_SIZE) {
3191 				abort_len = SCTP_CHUNK_BUFFER_SIZE;
3192 			}
3193 		} else {
3194 			abort_len = 0;
3195 		}
3196 		if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
3197 			notif_len += SCTP_ASSOC_SUPPORTS_MAX;
3198 		} else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
3199 			notif_len += abort_len;
3200 		}
3201 		m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3202 		if (m_notify == NULL) {
3203 			/* Retry with smaller value. */
3204 			notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
3205 			m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3206 			if (m_notify == NULL) {
3207 				goto set_error;
3208 			}
3209 		}
3210 		SCTP_BUF_NEXT(m_notify) = NULL;
3211 		sac = mtod(m_notify, struct sctp_assoc_change *);
3212 		memset(sac, 0, notif_len);
3213 		sac->sac_type = SCTP_ASSOC_CHANGE;
3214 		sac->sac_flags = 0;
3215 		sac->sac_length = sizeof(struct sctp_assoc_change);
3216 		sac->sac_state = state;
3217 		sac->sac_error = error;
3218 		if (state == SCTP_CANT_STR_ASSOC) {
3219 			sac->sac_outbound_streams = 0;
3220 			sac->sac_inbound_streams = 0;
3221 		} else {
3222 			sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
3223 			sac->sac_inbound_streams = stcb->asoc.streamincnt;
3224 		}
3225 		sac->sac_assoc_id = sctp_get_associd(stcb);
3226 		if (notif_len > sizeof(struct sctp_assoc_change)) {
3227 			if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
3228 				i = 0;
3229 				if (stcb->asoc.prsctp_supported == 1) {
3230 					sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
3231 				}
3232 				if (stcb->asoc.auth_supported == 1) {
3233 					sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
3234 				}
3235 				if (stcb->asoc.asconf_supported == 1) {
3236 					sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
3237 				}
3238 				if (stcb->asoc.idata_supported == 1) {
3239 					sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING;
3240 				}
3241 				sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
3242 				if (stcb->asoc.reconfig_supported == 1) {
3243 					sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
3244 				}
3245 				sac->sac_length += i;
3246 			} else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
3247 				memcpy(sac->sac_info, abort, abort_len);
3248 				sac->sac_length += abort_len;
3249 			}
3250 		}
3251 		SCTP_BUF_LEN(m_notify) = sac->sac_length;
3252 		control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3253 		    0, 0, stcb->asoc.context, 0, 0, 0,
3254 		    m_notify);
3255 		if (control != NULL) {
3256 			control->length = SCTP_BUF_LEN(m_notify);
3257 			control->spec_flags = M_NOTIFICATION;
3258 			/* not that we need this */
3259 			control->tail_mbuf = m_notify;
3260 			sctp_add_to_readq(stcb->sctp_ep, stcb,
3261 			    control,
3262 			    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
3263 			    so_locked);
3264 		} else {
3265 			sctp_m_freem(m_notify);
3266 		}
3267 	}
3268 	/*
3269 	 * For 1-to-1 style sockets, we send up and error when an ABORT
3270 	 * comes in.
3271 	 */
3272 set_error:
3273 	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3274 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
3275 	    ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
3276 		SOCK_LOCK(stcb->sctp_socket);
3277 		if (from_peer) {
3278 			if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {
3279 				SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
3280 				stcb->sctp_socket->so_error = ECONNREFUSED;
3281 			} else {
3282 				SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
3283 				stcb->sctp_socket->so_error = ECONNRESET;
3284 			}
3285 		} else {
3286 			if (timedout) {
3287 				SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
3288 				stcb->sctp_socket->so_error = ETIMEDOUT;
3289 			} else {
3290 				SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
3291 				stcb->sctp_socket->so_error = ECONNABORTED;
3292 			}
3293 		}
3294 		SOCK_UNLOCK(stcb->sctp_socket);
3295 	}
3296 	/* Wake ANY sleepers */
3297 	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3298 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
3299 	    ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
3300 		socantrcvmore(stcb->sctp_socket);
3301 	}
3302 	sorwakeup(stcb->sctp_socket);
3303 	sowwakeup(stcb->sctp_socket);
3304 }
3305 
3306 static void
3307 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
3308     struct sockaddr *sa, uint32_t error, int so_locked)
3309 {
3310 	struct mbuf *m_notify;
3311 	struct sctp_paddr_change *spc;
3312 	struct sctp_queued_to_read *control;
3313 
3314 	if ((stcb == NULL) ||
3315 	    sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
3316 		/* event not enabled */
3317 		return;
3318 	}
3319 	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
3320 	if (m_notify == NULL)
3321 		return;
3322 	SCTP_BUF_LEN(m_notify) = 0;
3323 	spc = mtod(m_notify, struct sctp_paddr_change *);
3324 	memset(spc, 0, sizeof(struct sctp_paddr_change));
3325 	spc->spc_type = SCTP_PEER_ADDR_CHANGE;
3326 	spc->spc_flags = 0;
3327 	spc->spc_length = sizeof(struct sctp_paddr_change);
3328 	switch (sa->sa_family) {
3329 #ifdef INET
3330 	case AF_INET:
3331 #ifdef INET6
3332 		if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
3333 			in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
3334 			    (struct sockaddr_in6 *)&spc->spc_aaddr);
3335 		} else {
3336 			memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
3337 		}
3338 #else
3339 		memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
3340 #endif
3341 		break;
3342 #endif
3343 #ifdef INET6
3344 	case AF_INET6:
3345 		{
3346 			struct sockaddr_in6 *sin6;
3347 
3348 			memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
3349 
3350 			sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
3351 			if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
3352 				if (sin6->sin6_scope_id == 0) {
3353 					/* recover scope_id for user */
3354 					(void)sa6_recoverscope(sin6);
3355 				} else {
3356 					/* clear embedded scope_id for user */
3357 					in6_clearscope(&sin6->sin6_addr);
3358 				}
3359 			}
3360 			break;
3361 		}
3362 #endif
3363 	default:
3364 		/* TSNH */
3365 		break;
3366 	}
3367 	spc->spc_state = state;
3368 	spc->spc_error = error;
3369 	spc->spc_assoc_id = sctp_get_associd(stcb);
3370 
3371 	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
3372 	SCTP_BUF_NEXT(m_notify) = NULL;
3373 
3374 	/* append to socket */
3375 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3376 	    0, 0, stcb->asoc.context, 0, 0, 0,
3377 	    m_notify);
3378 	if (control == NULL) {
3379 		/* no memory */
3380 		sctp_m_freem(m_notify);
3381 		return;
3382 	}
3383 	control->length = SCTP_BUF_LEN(m_notify);
3384 	control->spec_flags = M_NOTIFICATION;
3385 	/* not that we need this */
3386 	control->tail_mbuf = m_notify;
3387 	sctp_add_to_readq(stcb->sctp_ep, stcb,
3388 	    control,
3389 	    &stcb->sctp_socket->so_rcv, 1,
3390 	    SCTP_READ_LOCK_NOT_HELD,
3391 	    so_locked);
3392 }
3393 
3394 static void
3395 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
3396     struct sctp_tmit_chunk *chk, int so_locked)
3397 {
3398 	struct mbuf *m_notify;
3399 	struct sctp_send_failed *ssf;
3400 	struct sctp_send_failed_event *ssfe;
3401 	struct sctp_queued_to_read *control;
3402 	struct sctp_chunkhdr *chkhdr;
3403 	int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len;
3404 
3405 	if ((stcb == NULL) ||
3406 	    (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3407 	    sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3408 		/* event not enabled */
3409 		return;
3410 	}
3411 
3412 	if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3413 		notifhdr_len = sizeof(struct sctp_send_failed_event);
3414 	} else {
3415 		notifhdr_len = sizeof(struct sctp_send_failed);
3416 	}
3417 	m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3418 	if (m_notify == NULL)
3419 		/* no space left */
3420 		return;
3421 	SCTP_BUF_LEN(m_notify) = notifhdr_len;
3422 	if (stcb->asoc.idata_supported) {
3423 		chkhdr_len = sizeof(struct sctp_idata_chunk);
3424 	} else {
3425 		chkhdr_len = sizeof(struct sctp_data_chunk);
3426 	}
3427 	/* Use some defaults in case we can't access the chunk header */
3428 	if (chk->send_size >= chkhdr_len) {
3429 		payload_len = chk->send_size - chkhdr_len;
3430 	} else {
3431 		payload_len = 0;
3432 	}
3433 	padding_len = 0;
3434 	if (chk->data != NULL) {
3435 		chkhdr = mtod(chk->data, struct sctp_chunkhdr *);
3436 		if (chkhdr != NULL) {
3437 			chk_len = ntohs(chkhdr->chunk_length);
3438 			if ((chk_len >= chkhdr_len) &&
3439 			    (chk->send_size >= chk_len) &&
3440 			    (chk->send_size - chk_len < 4)) {
3441 				padding_len = chk->send_size - chk_len;
3442 				payload_len = chk->send_size - chkhdr_len - padding_len;
3443 			}
3444 		}
3445 	}
3446 	if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3447 		ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3448 		memset(ssfe, 0, notifhdr_len);
3449 		ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3450 		if (sent) {
3451 			ssfe->ssfe_flags = SCTP_DATA_SENT;
3452 		} else {
3453 			ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3454 		}
3455 		ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len);
3456 		ssfe->ssfe_error = error;
3457 		/* not exactly what the user sent in, but should be close :) */
3458 		ssfe->ssfe_info.snd_sid = chk->rec.data.sid;
3459 		ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
3460 		ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid;
3461 		ssfe->ssfe_info.snd_context = chk->rec.data.context;
3462 		ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3463 		ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3464 	} else {
3465 		ssf = mtod(m_notify, struct sctp_send_failed *);
3466 		memset(ssf, 0, notifhdr_len);
3467 		ssf->ssf_type = SCTP_SEND_FAILED;
3468 		if (sent) {
3469 			ssf->ssf_flags = SCTP_DATA_SENT;
3470 		} else {
3471 			ssf->ssf_flags = SCTP_DATA_UNSENT;
3472 		}
3473 		ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len);
3474 		ssf->ssf_error = error;
3475 		/* not exactly what the user sent in, but should be close :) */
3476 		ssf->ssf_info.sinfo_stream = chk->rec.data.sid;
3477 		ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid;
3478 		ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
3479 		ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid;
3480 		ssf->ssf_info.sinfo_context = chk->rec.data.context;
3481 		ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3482 		ssf->ssf_assoc_id = sctp_get_associd(stcb);
3483 	}
3484 	if (chk->data != NULL) {
3485 		/* Trim off the sctp chunk header (it should be there) */
3486 		if (chk->send_size == chkhdr_len + payload_len + padding_len) {
3487 			m_adj(chk->data, chkhdr_len);
3488 			m_adj(chk->data, -padding_len);
3489 			sctp_mbuf_crush(chk->data);
3490 			chk->send_size -= (chkhdr_len + padding_len);
3491 		}
3492 	}
3493 	SCTP_BUF_NEXT(m_notify) = chk->data;
3494 	/* Steal off the mbuf */
3495 	chk->data = NULL;
3496 	/*
3497 	 * For this case, we check the actual socket buffer, since the assoc
3498 	 * is going away we don't want to overfill the socket buffer for a
3499 	 * non-reader
3500 	 */
3501 	if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3502 		sctp_m_freem(m_notify);
3503 		return;
3504 	}
3505 	/* append to socket */
3506 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3507 	    0, 0, stcb->asoc.context, 0, 0, 0,
3508 	    m_notify);
3509 	if (control == NULL) {
3510 		/* no memory */
3511 		sctp_m_freem(m_notify);
3512 		return;
3513 	}
3514 	control->length = SCTP_BUF_LEN(m_notify);
3515 	control->spec_flags = M_NOTIFICATION;
3516 	/* not that we need this */
3517 	control->tail_mbuf = m_notify;
3518 	sctp_add_to_readq(stcb->sctp_ep, stcb,
3519 	    control,
3520 	    &stcb->sctp_socket->so_rcv, 1,
3521 	    SCTP_READ_LOCK_NOT_HELD,
3522 	    so_locked);
3523 }
3524 
3525 static void
3526 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3527     struct sctp_stream_queue_pending *sp, int so_locked)
3528 {
3529 	struct mbuf *m_notify;
3530 	struct sctp_send_failed *ssf;
3531 	struct sctp_send_failed_event *ssfe;
3532 	struct sctp_queued_to_read *control;
3533 	int notifhdr_len;
3534 
3535 	if ((stcb == NULL) ||
3536 	    (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3537 	    sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3538 		/* event not enabled */
3539 		return;
3540 	}
3541 	if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3542 		notifhdr_len = sizeof(struct sctp_send_failed_event);
3543 	} else {
3544 		notifhdr_len = sizeof(struct sctp_send_failed);
3545 	}
3546 	m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3547 	if (m_notify == NULL) {
3548 		/* no space left */
3549 		return;
3550 	}
3551 	SCTP_BUF_LEN(m_notify) = notifhdr_len;
3552 	if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3553 		ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3554 		memset(ssfe, 0, notifhdr_len);
3555 		ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3556 		ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3557 		ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length);
3558 		ssfe->ssfe_error = error;
3559 		/* not exactly what the user sent in, but should be close :) */
3560 		ssfe->ssfe_info.snd_sid = sp->sid;
3561 		if (sp->some_taken) {
3562 			ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
3563 		} else {
3564 			ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
3565 		}
3566 		ssfe->ssfe_info.snd_ppid = sp->ppid;
3567 		ssfe->ssfe_info.snd_context = sp->context;
3568 		ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3569 		ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3570 	} else {
3571 		ssf = mtod(m_notify, struct sctp_send_failed *);
3572 		memset(ssf, 0, notifhdr_len);
3573 		ssf->ssf_type = SCTP_SEND_FAILED;
3574 		ssf->ssf_flags = SCTP_DATA_UNSENT;
3575 		ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length);
3576 		ssf->ssf_error = error;
3577 		/* not exactly what the user sent in, but should be close :) */
3578 		ssf->ssf_info.sinfo_stream = sp->sid;
3579 		ssf->ssf_info.sinfo_ssn = 0;
3580 		if (sp->some_taken) {
3581 			ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3582 		} else {
3583 			ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3584 		}
3585 		ssf->ssf_info.sinfo_ppid = sp->ppid;
3586 		ssf->ssf_info.sinfo_context = sp->context;
3587 		ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3588 		ssf->ssf_assoc_id = sctp_get_associd(stcb);
3589 	}
3590 	SCTP_BUF_NEXT(m_notify) = sp->data;
3591 
3592 	/* Steal off the mbuf */
3593 	sp->data = NULL;
3594 	/*
3595 	 * For this case, we check the actual socket buffer, since the assoc
3596 	 * is going away we don't want to overfill the socket buffer for a
3597 	 * non-reader
3598 	 */
3599 	if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3600 		sctp_m_freem(m_notify);
3601 		return;
3602 	}
3603 	/* append to socket */
3604 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3605 	    0, 0, stcb->asoc.context, 0, 0, 0,
3606 	    m_notify);
3607 	if (control == NULL) {
3608 		/* no memory */
3609 		sctp_m_freem(m_notify);
3610 		return;
3611 	}
3612 	control->length = SCTP_BUF_LEN(m_notify);
3613 	control->spec_flags = M_NOTIFICATION;
3614 	/* not that we need this */
3615 	control->tail_mbuf = m_notify;
3616 	sctp_add_to_readq(stcb->sctp_ep, stcb,
3617 	    control,
3618 	    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3619 }
3620 
3621 static void
3622 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3623 {
3624 	struct mbuf *m_notify;
3625 	struct sctp_adaptation_event *sai;
3626 	struct sctp_queued_to_read *control;
3627 
3628 	if ((stcb == NULL) ||
3629 	    sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3630 		/* event not enabled */
3631 		return;
3632 	}
3633 
3634 	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3635 	if (m_notify == NULL)
3636 		/* no space left */
3637 		return;
3638 	SCTP_BUF_LEN(m_notify) = 0;
3639 	sai = mtod(m_notify, struct sctp_adaptation_event *);
3640 	memset(sai, 0, sizeof(struct sctp_adaptation_event));
3641 	sai->sai_type = SCTP_ADAPTATION_INDICATION;
3642 	sai->sai_flags = 0;
3643 	sai->sai_length = sizeof(struct sctp_adaptation_event);
3644 	sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3645 	sai->sai_assoc_id = sctp_get_associd(stcb);
3646 
3647 	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3648 	SCTP_BUF_NEXT(m_notify) = NULL;
3649 
3650 	/* append to socket */
3651 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3652 	    0, 0, stcb->asoc.context, 0, 0, 0,
3653 	    m_notify);
3654 	if (control == NULL) {
3655 		/* no memory */
3656 		sctp_m_freem(m_notify);
3657 		return;
3658 	}
3659 	control->length = SCTP_BUF_LEN(m_notify);
3660 	control->spec_flags = M_NOTIFICATION;
3661 	/* not that we need this */
3662 	control->tail_mbuf = m_notify;
3663 	sctp_add_to_readq(stcb->sctp_ep, stcb,
3664 	    control,
3665 	    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3666 }
3667 
3668 /* This always must be called with the read-queue LOCKED in the INP */
3669 static void
3670 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3671     uint32_t val, int so_locked)
3672 {
3673 	struct mbuf *m_notify;
3674 	struct sctp_pdapi_event *pdapi;
3675 	struct sctp_queued_to_read *control;
3676 	struct sockbuf *sb;
3677 
3678 	if ((stcb == NULL) ||
3679 	    sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3680 		/* event not enabled */
3681 		return;
3682 	}
3683 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3684 		return;
3685 	}
3686 
3687 	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3688 	if (m_notify == NULL)
3689 		/* no space left */
3690 		return;
3691 	SCTP_BUF_LEN(m_notify) = 0;
3692 	pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3693 	memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3694 	pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3695 	pdapi->pdapi_flags = 0;
3696 	pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3697 	pdapi->pdapi_indication = error;
3698 	pdapi->pdapi_stream = (val >> 16);
3699 	pdapi->pdapi_seq = (val & 0x0000ffff);
3700 	pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3701 
3702 	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3703 	SCTP_BUF_NEXT(m_notify) = NULL;
3704 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3705 	    0, 0, stcb->asoc.context, 0, 0, 0,
3706 	    m_notify);
3707 	if (control == NULL) {
3708 		/* no memory */
3709 		sctp_m_freem(m_notify);
3710 		return;
3711 	}
3712 	control->length = SCTP_BUF_LEN(m_notify);
3713 	control->spec_flags = M_NOTIFICATION;
3714 	/* not that we need this */
3715 	control->tail_mbuf = m_notify;
3716 	sb = &stcb->sctp_socket->so_rcv;
3717 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3718 		sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3719 	}
3720 	sctp_sballoc(stcb, sb, m_notify);
3721 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3722 		sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3723 	}
3724 	control->end_added = 1;
3725 	if (stcb->asoc.control_pdapi)
3726 		TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3727 	else {
3728 		/* we really should not see this case */
3729 		TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3730 	}
3731 	if (stcb->sctp_ep && stcb->sctp_socket) {
3732 		/* This should always be the case */
3733 		sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3734 	}
3735 }
3736 
3737 static void
3738 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3739 {
3740 	struct mbuf *m_notify;
3741 	struct sctp_shutdown_event *sse;
3742 	struct sctp_queued_to_read *control;
3743 
3744 	/*
3745 	 * For TCP model AND UDP connected sockets we will send an error up
3746 	 * when an SHUTDOWN completes
3747 	 */
3748 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3749 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3750 		/* mark socket closed for read/write and wakeup! */
3751 		socantsendmore(stcb->sctp_socket);
3752 	}
3753 	if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3754 		/* event not enabled */
3755 		return;
3756 	}
3757 
3758 	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3759 	if (m_notify == NULL)
3760 		/* no space left */
3761 		return;
3762 	sse = mtod(m_notify, struct sctp_shutdown_event *);
3763 	memset(sse, 0, sizeof(struct sctp_shutdown_event));
3764 	sse->sse_type = SCTP_SHUTDOWN_EVENT;
3765 	sse->sse_flags = 0;
3766 	sse->sse_length = sizeof(struct sctp_shutdown_event);
3767 	sse->sse_assoc_id = sctp_get_associd(stcb);
3768 
3769 	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3770 	SCTP_BUF_NEXT(m_notify) = NULL;
3771 
3772 	/* append to socket */
3773 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3774 	    0, 0, stcb->asoc.context, 0, 0, 0,
3775 	    m_notify);
3776 	if (control == NULL) {
3777 		/* no memory */
3778 		sctp_m_freem(m_notify);
3779 		return;
3780 	}
3781 	control->length = SCTP_BUF_LEN(m_notify);
3782 	control->spec_flags = M_NOTIFICATION;
3783 	/* not that we need this */
3784 	control->tail_mbuf = m_notify;
3785 	sctp_add_to_readq(stcb->sctp_ep, stcb,
3786 	    control,
3787 	    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3788 }
3789 
3790 static void
3791 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3792     int so_locked)
3793 {
3794 	struct mbuf *m_notify;
3795 	struct sctp_sender_dry_event *event;
3796 	struct sctp_queued_to_read *control;
3797 
3798 	if ((stcb == NULL) ||
3799 	    sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3800 		/* event not enabled */
3801 		return;
3802 	}
3803 
3804 	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3805 	if (m_notify == NULL) {
3806 		/* no space left */
3807 		return;
3808 	}
3809 	SCTP_BUF_LEN(m_notify) = 0;
3810 	event = mtod(m_notify, struct sctp_sender_dry_event *);
3811 	memset(event, 0, sizeof(struct sctp_sender_dry_event));
3812 	event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3813 	event->sender_dry_flags = 0;
3814 	event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3815 	event->sender_dry_assoc_id = sctp_get_associd(stcb);
3816 
3817 	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3818 	SCTP_BUF_NEXT(m_notify) = NULL;
3819 
3820 	/* append to socket */
3821 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3822 	    0, 0, stcb->asoc.context, 0, 0, 0,
3823 	    m_notify);
3824 	if (control == NULL) {
3825 		/* no memory */
3826 		sctp_m_freem(m_notify);
3827 		return;
3828 	}
3829 	control->length = SCTP_BUF_LEN(m_notify);
3830 	control->spec_flags = M_NOTIFICATION;
3831 	/* not that we need this */
3832 	control->tail_mbuf = m_notify;
3833 	sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3834 	    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3835 }
3836 
3837 void
3838 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3839 {
3840 	struct mbuf *m_notify;
3841 	struct sctp_queued_to_read *control;
3842 	struct sctp_stream_change_event *stradd;
3843 
3844 	if ((stcb == NULL) ||
3845 	    (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3846 		/* event not enabled */
3847 		return;
3848 	}
3849 	if ((stcb->asoc.peer_req_out) && flag) {
3850 		/* Peer made the request, don't tell the local user */
3851 		stcb->asoc.peer_req_out = 0;
3852 		return;
3853 	}
3854 	stcb->asoc.peer_req_out = 0;
3855 	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3856 	if (m_notify == NULL)
3857 		/* no space left */
3858 		return;
3859 	SCTP_BUF_LEN(m_notify) = 0;
3860 	stradd = mtod(m_notify, struct sctp_stream_change_event *);
3861 	memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3862 	stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3863 	stradd->strchange_flags = flag;
3864 	stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3865 	stradd->strchange_assoc_id = sctp_get_associd(stcb);
3866 	stradd->strchange_instrms = numberin;
3867 	stradd->strchange_outstrms = numberout;
3868 	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3869 	SCTP_BUF_NEXT(m_notify) = NULL;
3870 	if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3871 		/* no space */
3872 		sctp_m_freem(m_notify);
3873 		return;
3874 	}
3875 	/* append to socket */
3876 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3877 	    0, 0, stcb->asoc.context, 0, 0, 0,
3878 	    m_notify);
3879 	if (control == NULL) {
3880 		/* no memory */
3881 		sctp_m_freem(m_notify);
3882 		return;
3883 	}
3884 	control->length = SCTP_BUF_LEN(m_notify);
3885 	control->spec_flags = M_NOTIFICATION;
3886 	/* not that we need this */
3887 	control->tail_mbuf = m_notify;
3888 	sctp_add_to_readq(stcb->sctp_ep, stcb,
3889 	    control,
3890 	    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3891 }
3892 
3893 void
3894 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3895 {
3896 	struct mbuf *m_notify;
3897 	struct sctp_queued_to_read *control;
3898 	struct sctp_assoc_reset_event *strasoc;
3899 
3900 	if ((stcb == NULL) ||
3901 	    (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3902 		/* event not enabled */
3903 		return;
3904 	}
3905 	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3906 	if (m_notify == NULL)
3907 		/* no space left */
3908 		return;
3909 	SCTP_BUF_LEN(m_notify) = 0;
3910 	strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3911 	memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3912 	strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3913 	strasoc->assocreset_flags = flag;
3914 	strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3915 	strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3916 	strasoc->assocreset_local_tsn = sending_tsn;
3917 	strasoc->assocreset_remote_tsn = recv_tsn;
3918 	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3919 	SCTP_BUF_NEXT(m_notify) = NULL;
3920 	if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3921 		/* no space */
3922 		sctp_m_freem(m_notify);
3923 		return;
3924 	}
3925 	/* append to socket */
3926 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3927 	    0, 0, stcb->asoc.context, 0, 0, 0,
3928 	    m_notify);
3929 	if (control == NULL) {
3930 		/* no memory */
3931 		sctp_m_freem(m_notify);
3932 		return;
3933 	}
3934 	control->length = SCTP_BUF_LEN(m_notify);
3935 	control->spec_flags = M_NOTIFICATION;
3936 	/* not that we need this */
3937 	control->tail_mbuf = m_notify;
3938 	sctp_add_to_readq(stcb->sctp_ep, stcb,
3939 	    control,
3940 	    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3941 }
3942 
3943 static void
3944 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3945     int number_entries, uint16_t *list, int flag)
3946 {
3947 	struct mbuf *m_notify;
3948 	struct sctp_queued_to_read *control;
3949 	struct sctp_stream_reset_event *strreset;
3950 	int len;
3951 
3952 	if ((stcb == NULL) ||
3953 	    (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3954 		/* event not enabled */
3955 		return;
3956 	}
3957 
3958 	m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3959 	if (m_notify == NULL)
3960 		/* no space left */
3961 		return;
3962 	SCTP_BUF_LEN(m_notify) = 0;
3963 	len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3964 	if (len > M_TRAILINGSPACE(m_notify)) {
3965 		/* never enough room */
3966 		sctp_m_freem(m_notify);
3967 		return;
3968 	}
3969 	strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3970 	memset(strreset, 0, len);
3971 	strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3972 	strreset->strreset_flags = flag;
3973 	strreset->strreset_length = len;
3974 	strreset->strreset_assoc_id = sctp_get_associd(stcb);
3975 	if (number_entries) {
3976 		int i;
3977 
3978 		for (i = 0; i < number_entries; i++) {
3979 			strreset->strreset_stream_list[i] = ntohs(list[i]);
3980 		}
3981 	}
3982 	SCTP_BUF_LEN(m_notify) = len;
3983 	SCTP_BUF_NEXT(m_notify) = NULL;
3984 	if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3985 		/* no space */
3986 		sctp_m_freem(m_notify);
3987 		return;
3988 	}
3989 	/* append to socket */
3990 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3991 	    0, 0, stcb->asoc.context, 0, 0, 0,
3992 	    m_notify);
3993 	if (control == NULL) {
3994 		/* no memory */
3995 		sctp_m_freem(m_notify);
3996 		return;
3997 	}
3998 	control->length = SCTP_BUF_LEN(m_notify);
3999 	control->spec_flags = M_NOTIFICATION;
4000 	/* not that we need this */
4001 	control->tail_mbuf = m_notify;
4002 	sctp_add_to_readq(stcb->sctp_ep, stcb,
4003 	    control,
4004 	    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
4005 }
4006 
4007 static void
4008 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
4009 {
4010 	struct mbuf *m_notify;
4011 	struct sctp_remote_error *sre;
4012 	struct sctp_queued_to_read *control;
4013 	unsigned int notif_len;
4014 	uint16_t chunk_len;
4015 
4016 	if ((stcb == NULL) ||
4017 	    sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
4018 		return;
4019 	}
4020 	if (chunk != NULL) {
4021 		chunk_len = ntohs(chunk->ch.chunk_length);
4022 		/*
4023 		 * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
4024 		 * contiguous.
4025 		 */
4026 		if (chunk_len > SCTP_CHUNK_BUFFER_SIZE) {
4027 			chunk_len = SCTP_CHUNK_BUFFER_SIZE;
4028 		}
4029 	} else {
4030 		chunk_len = 0;
4031 	}
4032 	notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len);
4033 	m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
4034 	if (m_notify == NULL) {
4035 		/* Retry with smaller value. */
4036 		notif_len = (unsigned int)sizeof(struct sctp_remote_error);
4037 		m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
4038 		if (m_notify == NULL) {
4039 			return;
4040 		}
4041 	}
4042 	SCTP_BUF_NEXT(m_notify) = NULL;
4043 	sre = mtod(m_notify, struct sctp_remote_error *);
4044 	memset(sre, 0, notif_len);
4045 	sre->sre_type = SCTP_REMOTE_ERROR;
4046 	sre->sre_flags = 0;
4047 	sre->sre_length = sizeof(struct sctp_remote_error);
4048 	sre->sre_error = error;
4049 	sre->sre_assoc_id = sctp_get_associd(stcb);
4050 	if (notif_len > sizeof(struct sctp_remote_error)) {
4051 		memcpy(sre->sre_data, chunk, chunk_len);
4052 		sre->sre_length += chunk_len;
4053 	}
4054 	SCTP_BUF_LEN(m_notify) = sre->sre_length;
4055 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
4056 	    0, 0, stcb->asoc.context, 0, 0, 0,
4057 	    m_notify);
4058 	if (control != NULL) {
4059 		control->length = SCTP_BUF_LEN(m_notify);
4060 		control->spec_flags = M_NOTIFICATION;
4061 		/* not that we need this */
4062 		control->tail_mbuf = m_notify;
4063 		sctp_add_to_readq(stcb->sctp_ep, stcb,
4064 		    control,
4065 		    &stcb->sctp_socket->so_rcv, 1,
4066 		    SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
4067 	} else {
4068 		sctp_m_freem(m_notify);
4069 	}
4070 }
4071 
4072 void
4073 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
4074     uint32_t error, void *data, int so_locked)
4075 {
4076 	if ((stcb == NULL) ||
4077 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4078 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4079 	    (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
4080 		/* If the socket is gone we are out of here */
4081 		return;
4082 	}
4083 	if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
4084 		return;
4085 	}
4086 	if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4087 	    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4088 		if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
4089 		    (notification == SCTP_NOTIFY_INTERFACE_UP) ||
4090 		    (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
4091 			/* Don't report these in front states */
4092 			return;
4093 		}
4094 	}
4095 	switch (notification) {
4096 	case SCTP_NOTIFY_ASSOC_UP:
4097 		if (stcb->asoc.assoc_up_sent == 0) {
4098 			sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, false, false, so_locked);
4099 			stcb->asoc.assoc_up_sent = 1;
4100 		}
4101 		if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
4102 			sctp_notify_adaptation_layer(stcb);
4103 		}
4104 		if (stcb->asoc.auth_supported == 0) {
4105 			sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
4106 			    NULL, so_locked);
4107 		}
4108 		break;
4109 	case SCTP_NOTIFY_ASSOC_DOWN:
4110 		sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, false, false, so_locked);
4111 		break;
4112 	case SCTP_NOTIFY_INTERFACE_DOWN:
4113 		{
4114 			struct sctp_nets *net;
4115 
4116 			net = (struct sctp_nets *)data;
4117 			sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
4118 			    (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4119 			break;
4120 		}
4121 	case SCTP_NOTIFY_INTERFACE_UP:
4122 		{
4123 			struct sctp_nets *net;
4124 
4125 			net = (struct sctp_nets *)data;
4126 			sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
4127 			    (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4128 			break;
4129 		}
4130 	case SCTP_NOTIFY_INTERFACE_CONFIRMED:
4131 		{
4132 			struct sctp_nets *net;
4133 
4134 			net = (struct sctp_nets *)data;
4135 			sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
4136 			    (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4137 			break;
4138 		}
4139 	case SCTP_NOTIFY_SPECIAL_SP_FAIL:
4140 		sctp_notify_send_failed2(stcb, error,
4141 		    (struct sctp_stream_queue_pending *)data, so_locked);
4142 		break;
4143 	case SCTP_NOTIFY_SENT_DG_FAIL:
4144 		sctp_notify_send_failed(stcb, 1, error,
4145 		    (struct sctp_tmit_chunk *)data, so_locked);
4146 		break;
4147 	case SCTP_NOTIFY_UNSENT_DG_FAIL:
4148 		sctp_notify_send_failed(stcb, 0, error,
4149 		    (struct sctp_tmit_chunk *)data, so_locked);
4150 		break;
4151 	case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
4152 		{
4153 			uint32_t val;
4154 
4155 			val = *((uint32_t *)data);
4156 
4157 			sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
4158 			break;
4159 		}
4160 	case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
4161 		if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4162 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4163 			sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, false, false, so_locked);
4164 		} else {
4165 			sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, false, false, so_locked);
4166 		}
4167 		break;
4168 	case SCTP_NOTIFY_ASSOC_REM_ABORTED:
4169 		if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4170 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4171 			sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, true, false, so_locked);
4172 		} else {
4173 			sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, true, false, so_locked);
4174 		}
4175 		break;
4176 	case SCTP_NOTIFY_ASSOC_TIMEDOUT:
4177 		if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4178 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4179 			sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, false, true, so_locked);
4180 		} else {
4181 			sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, false, true, so_locked);
4182 		}
4183 		break;
4184 	case SCTP_NOTIFY_ASSOC_RESTART:
4185 		sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, false, false, so_locked);
4186 		if (stcb->asoc.auth_supported == 0) {
4187 			sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
4188 			    NULL, so_locked);
4189 		}
4190 		break;
4191 	case SCTP_NOTIFY_STR_RESET_SEND:
4192 		sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN);
4193 		break;
4194 	case SCTP_NOTIFY_STR_RESET_RECV:
4195 		sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING);
4196 		break;
4197 	case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
4198 		sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4199 		    (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
4200 		break;
4201 	case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
4202 		sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4203 		    (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
4204 		break;
4205 	case SCTP_NOTIFY_STR_RESET_FAILED_IN:
4206 		sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4207 		    (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
4208 		break;
4209 	case SCTP_NOTIFY_STR_RESET_DENIED_IN:
4210 		sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4211 		    (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
4212 		break;
4213 	case SCTP_NOTIFY_ASCONF_ADD_IP:
4214 		sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
4215 		    error, so_locked);
4216 		break;
4217 	case SCTP_NOTIFY_ASCONF_DELETE_IP:
4218 		sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
4219 		    error, so_locked);
4220 		break;
4221 	case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
4222 		sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
4223 		    error, so_locked);
4224 		break;
4225 	case SCTP_NOTIFY_PEER_SHUTDOWN:
4226 		sctp_notify_shutdown_event(stcb);
4227 		break;
4228 	case SCTP_NOTIFY_AUTH_NEW_KEY:
4229 		sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
4230 		    (uint16_t)(uintptr_t)data,
4231 		    so_locked);
4232 		break;
4233 	case SCTP_NOTIFY_AUTH_FREE_KEY:
4234 		sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
4235 		    (uint16_t)(uintptr_t)data,
4236 		    so_locked);
4237 		break;
4238 	case SCTP_NOTIFY_NO_PEER_AUTH:
4239 		sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
4240 		    (uint16_t)(uintptr_t)data,
4241 		    so_locked);
4242 		break;
4243 	case SCTP_NOTIFY_SENDER_DRY:
4244 		sctp_notify_sender_dry_event(stcb, so_locked);
4245 		break;
4246 	case SCTP_NOTIFY_REMOTE_ERROR:
4247 		sctp_notify_remote_error(stcb, error, data);
4248 		break;
4249 	default:
4250 		SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
4251 		    __func__, notification, notification);
4252 		break;
4253 	}			/* end switch */
4254 }
4255 
4256 void
4257 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int so_locked)
4258 {
4259 	struct sctp_association *asoc;
4260 	struct sctp_stream_out *outs;
4261 	struct sctp_tmit_chunk *chk, *nchk;
4262 	struct sctp_stream_queue_pending *sp, *nsp;
4263 	int i;
4264 
4265 	if (stcb == NULL) {
4266 		return;
4267 	}
4268 	asoc = &stcb->asoc;
4269 	if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4270 		/* already being freed */
4271 		return;
4272 	}
4273 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4274 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4275 	    (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
4276 		return;
4277 	}
4278 	/* now through all the gunk freeing chunks */
4279 	/* sent queue SHOULD be empty */
4280 	TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
4281 		TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
4282 		asoc->sent_queue_cnt--;
4283 		if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
4284 			if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
4285 				asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
4286 #ifdef INVARIANTS
4287 			} else {
4288 				panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
4289 #endif
4290 			}
4291 		}
4292 		if (chk->data != NULL) {
4293 			sctp_free_bufspace(stcb, asoc, chk, 1);
4294 			sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
4295 			    error, chk, so_locked);
4296 			if (chk->data) {
4297 				sctp_m_freem(chk->data);
4298 				chk->data = NULL;
4299 			}
4300 		}
4301 		sctp_free_a_chunk(stcb, chk, so_locked);
4302 		/* sa_ignore FREED_MEMORY */
4303 	}
4304 	/* pending send queue SHOULD be empty */
4305 	TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
4306 		TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
4307 		asoc->send_queue_cnt--;
4308 		if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
4309 			asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
4310 #ifdef INVARIANTS
4311 		} else {
4312 			panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
4313 #endif
4314 		}
4315 		if (chk->data != NULL) {
4316 			sctp_free_bufspace(stcb, asoc, chk, 1);
4317 			sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
4318 			    error, chk, so_locked);
4319 			if (chk->data) {
4320 				sctp_m_freem(chk->data);
4321 				chk->data = NULL;
4322 			}
4323 		}
4324 		sctp_free_a_chunk(stcb, chk, so_locked);
4325 		/* sa_ignore FREED_MEMORY */
4326 	}
4327 	for (i = 0; i < asoc->streamoutcnt; i++) {
4328 		/* For each stream */
4329 		outs = &asoc->strmout[i];
4330 		/* clean up any sends there */
4331 		TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
4332 			atomic_subtract_int(&asoc->stream_queue_cnt, 1);
4333 			TAILQ_REMOVE(&outs->outqueue, sp, next);
4334 			stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp);
4335 			sctp_free_spbufspace(stcb, asoc, sp);
4336 			if (sp->data) {
4337 				sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
4338 				    error, (void *)sp, so_locked);
4339 				if (sp->data) {
4340 					sctp_m_freem(sp->data);
4341 					sp->data = NULL;
4342 					sp->tail_mbuf = NULL;
4343 					sp->length = 0;
4344 				}
4345 			}
4346 			if (sp->net) {
4347 				sctp_free_remote_addr(sp->net);
4348 				sp->net = NULL;
4349 			}
4350 			/* Free the chunk */
4351 			sctp_free_a_strmoq(stcb, sp, so_locked);
4352 			/* sa_ignore FREED_MEMORY */
4353 		}
4354 	}
4355 }
4356 
4357 void
4358 sctp_abort_notification(struct sctp_tcb *stcb, bool from_peer, bool timeout,
4359     uint16_t error, struct sctp_abort_chunk *abort,
4360     int so_locked)
4361 {
4362 	if (stcb == NULL) {
4363 		return;
4364 	}
4365 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
4366 	    ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
4367 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
4368 		stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
4369 	}
4370 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4371 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4372 	    (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
4373 		return;
4374 	}
4375 	SCTP_TCB_SEND_LOCK(stcb);
4376 	SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED);
4377 	/* Tell them we lost the asoc */
4378 	sctp_report_all_outbound(stcb, error, so_locked);
4379 	SCTP_TCB_SEND_UNLOCK(stcb);
4380 	if (from_peer) {
4381 		sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
4382 	} else {
4383 		if (timeout) {
4384 			sctp_ulp_notify(SCTP_NOTIFY_ASSOC_TIMEDOUT, stcb, error, abort, so_locked);
4385 		} else {
4386 			sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
4387 		}
4388 	}
4389 }
4390 
4391 void
4392 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4393     struct mbuf *m, int iphlen,
4394     struct sockaddr *src, struct sockaddr *dst,
4395     struct sctphdr *sh, struct mbuf *op_err,
4396     uint8_t mflowtype, uint32_t mflowid,
4397     uint32_t vrf_id, uint16_t port)
4398 {
4399 	struct sctp_gen_error_cause *cause;
4400 	uint32_t vtag;
4401 	uint16_t cause_code;
4402 
4403 	if (stcb != NULL) {
4404 		vtag = stcb->asoc.peer_vtag;
4405 		vrf_id = stcb->asoc.vrf_id;
4406 		if (op_err != NULL) {
4407 			/* Read the cause code from the error cause. */
4408 			cause = mtod(op_err, struct sctp_gen_error_cause *);
4409 			cause_code = ntohs(cause->code);
4410 		} else {
4411 			cause_code = 0;
4412 		}
4413 	} else {
4414 		vtag = 0;
4415 	}
4416 	sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
4417 	    mflowtype, mflowid, inp->fibnum,
4418 	    vrf_id, port);
4419 	if (stcb != NULL) {
4420 		/* We have a TCB to abort, send notification too */
4421 		sctp_abort_notification(stcb, false, false, cause_code, NULL, SCTP_SO_NOT_LOCKED);
4422 		/* Ok, now lets free it */
4423 		SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4424 		if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4425 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4426 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4427 		}
4428 		(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4429 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
4430 	}
4431 }
4432 #ifdef SCTP_ASOCLOG_OF_TSNS
4433 void
4434 sctp_print_out_track_log(struct sctp_tcb *stcb)
4435 {
4436 #ifdef NOSIY_PRINTS
4437 	int i;
4438 
4439 	SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
4440 	SCTP_PRINTF("IN bound TSN log-aaa\n");
4441 	if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
4442 		SCTP_PRINTF("None rcvd\n");
4443 		goto none_in;
4444 	}
4445 	if (stcb->asoc.tsn_in_wrapped) {
4446 		for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
4447 			SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4448 			    stcb->asoc.in_tsnlog[i].tsn,
4449 			    stcb->asoc.in_tsnlog[i].strm,
4450 			    stcb->asoc.in_tsnlog[i].seq,
4451 			    stcb->asoc.in_tsnlog[i].flgs,
4452 			    stcb->asoc.in_tsnlog[i].sz);
4453 		}
4454 	}
4455 	if (stcb->asoc.tsn_in_at) {
4456 		for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
4457 			SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4458 			    stcb->asoc.in_tsnlog[i].tsn,
4459 			    stcb->asoc.in_tsnlog[i].strm,
4460 			    stcb->asoc.in_tsnlog[i].seq,
4461 			    stcb->asoc.in_tsnlog[i].flgs,
4462 			    stcb->asoc.in_tsnlog[i].sz);
4463 		}
4464 	}
4465 none_in:
4466 	SCTP_PRINTF("OUT bound TSN log-aaa\n");
4467 	if ((stcb->asoc.tsn_out_at == 0) &&
4468 	    (stcb->asoc.tsn_out_wrapped == 0)) {
4469 		SCTP_PRINTF("None sent\n");
4470 	}
4471 	if (stcb->asoc.tsn_out_wrapped) {
4472 		for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
4473 			SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4474 			    stcb->asoc.out_tsnlog[i].tsn,
4475 			    stcb->asoc.out_tsnlog[i].strm,
4476 			    stcb->asoc.out_tsnlog[i].seq,
4477 			    stcb->asoc.out_tsnlog[i].flgs,
4478 			    stcb->asoc.out_tsnlog[i].sz);
4479 		}
4480 	}
4481 	if (stcb->asoc.tsn_out_at) {
4482 		for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
4483 			SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4484 			    stcb->asoc.out_tsnlog[i].tsn,
4485 			    stcb->asoc.out_tsnlog[i].strm,
4486 			    stcb->asoc.out_tsnlog[i].seq,
4487 			    stcb->asoc.out_tsnlog[i].flgs,
4488 			    stcb->asoc.out_tsnlog[i].sz);
4489 		}
4490 	}
4491 #endif
4492 }
4493 #endif
4494 
4495 void
4496 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4497     struct mbuf *op_err, bool timedout, int so_locked)
4498 {
4499 	struct sctp_gen_error_cause *cause;
4500 	uint16_t cause_code;
4501 
4502 	if (stcb == NULL) {
4503 		/* Got to have a TCB */
4504 		if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4505 			if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4506 				sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4507 				    SCTP_CALLED_DIRECTLY_NOCMPSET);
4508 			}
4509 		}
4510 		return;
4511 	}
4512 	if (op_err != NULL) {
4513 		/* Read the cause code from the error cause. */
4514 		cause = mtod(op_err, struct sctp_gen_error_cause *);
4515 		cause_code = ntohs(cause->code);
4516 	} else {
4517 		cause_code = 0;
4518 	}
4519 	/* notify the peer */
4520 	sctp_send_abort_tcb(stcb, op_err, so_locked);
4521 	SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4522 	if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4523 	    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4524 		SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4525 	}
4526 	/* notify the ulp */
4527 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4528 		sctp_abort_notification(stcb, false, timedout, cause_code, NULL, so_locked);
4529 	}
4530 	/* now free the asoc */
4531 #ifdef SCTP_ASOCLOG_OF_TSNS
4532 	sctp_print_out_track_log(stcb);
4533 #endif
4534 	(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4535 	    SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4536 }
4537 
4538 void
4539 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4540     struct sockaddr *src, struct sockaddr *dst,
4541     struct sctphdr *sh, struct sctp_inpcb *inp,
4542     struct mbuf *cause,
4543     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4544     uint32_t vrf_id, uint16_t port)
4545 {
4546 	struct sctp_chunkhdr *ch, chunk_buf;
4547 	unsigned int chk_length;
4548 	int contains_init_chunk;
4549 
4550 	SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4551 	/* Generate a TO address for future reference */
4552 	if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4553 		if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4554 			sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4555 			    SCTP_CALLED_DIRECTLY_NOCMPSET);
4556 		}
4557 	}
4558 	contains_init_chunk = 0;
4559 	ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4560 	    sizeof(*ch), (uint8_t *)&chunk_buf);
4561 	while (ch != NULL) {
4562 		chk_length = ntohs(ch->chunk_length);
4563 		if (chk_length < sizeof(*ch)) {
4564 			/* break to abort land */
4565 			break;
4566 		}
4567 		switch (ch->chunk_type) {
4568 		case SCTP_INIT:
4569 			contains_init_chunk = 1;
4570 			break;
4571 		case SCTP_PACKET_DROPPED:
4572 			/* we don't respond to pkt-dropped */
4573 			return;
4574 		case SCTP_ABORT_ASSOCIATION:
4575 			/* we don't respond with an ABORT to an ABORT */
4576 			return;
4577 		case SCTP_SHUTDOWN_COMPLETE:
4578 			/*
4579 			 * we ignore it since we are not waiting for it and
4580 			 * peer is gone
4581 			 */
4582 			return;
4583 		case SCTP_SHUTDOWN_ACK:
4584 			sctp_send_shutdown_complete2(src, dst, sh,
4585 			    mflowtype, mflowid, fibnum,
4586 			    vrf_id, port);
4587 			return;
4588 		default:
4589 			break;
4590 		}
4591 		offset += SCTP_SIZE32(chk_length);
4592 		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4593 		    sizeof(*ch), (uint8_t *)&chunk_buf);
4594 	}
4595 	if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4596 	    ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4597 	    (contains_init_chunk == 0))) {
4598 		sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4599 		    mflowtype, mflowid, fibnum,
4600 		    vrf_id, port);
4601 	}
4602 }
4603 
4604 /*
4605  * check the inbound datagram to make sure there is not an abort inside it,
4606  * if there is return 1, else return 0.
4607  */
4608 int
4609 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtag)
4610 {
4611 	struct sctp_chunkhdr *ch;
4612 	struct sctp_init_chunk *init_chk, chunk_buf;
4613 	int offset;
4614 	unsigned int chk_length;
4615 
4616 	offset = iphlen + sizeof(struct sctphdr);
4617 	ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4618 	    (uint8_t *)&chunk_buf);
4619 	while (ch != NULL) {
4620 		chk_length = ntohs(ch->chunk_length);
4621 		if (chk_length < sizeof(*ch)) {
4622 			/* packet is probably corrupt */
4623 			break;
4624 		}
4625 		/* we seem to be ok, is it an abort? */
4626 		if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4627 			/* yep, tell them */
4628 			return (1);
4629 		}
4630 		if ((ch->chunk_type == SCTP_INITIATION) ||
4631 		    (ch->chunk_type == SCTP_INITIATION_ACK)) {
4632 			/* need to update the Vtag */
4633 			init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4634 			    offset, sizeof(struct sctp_init_chunk), (uint8_t *)&chunk_buf);
4635 			if (init_chk != NULL) {
4636 				*vtag = ntohl(init_chk->init.initiate_tag);
4637 			}
4638 		}
4639 		/* Nope, move to the next chunk */
4640 		offset += SCTP_SIZE32(chk_length);
4641 		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4642 		    sizeof(*ch), (uint8_t *)&chunk_buf);
4643 	}
4644 	return (0);
4645 }
4646 
4647 /*
4648  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4649  * set (i.e. it's 0) so, create this function to compare link local scopes
4650  */
4651 #ifdef INET6
4652 uint32_t
4653 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4654 {
4655 	struct sockaddr_in6 a, b;
4656 
4657 	/* save copies */
4658 	a = *addr1;
4659 	b = *addr2;
4660 
4661 	if (a.sin6_scope_id == 0)
4662 		if (sa6_recoverscope(&a)) {
4663 			/* can't get scope, so can't match */
4664 			return (0);
4665 		}
4666 	if (b.sin6_scope_id == 0)
4667 		if (sa6_recoverscope(&b)) {
4668 			/* can't get scope, so can't match */
4669 			return (0);
4670 		}
4671 	if (a.sin6_scope_id != b.sin6_scope_id)
4672 		return (0);
4673 
4674 	return (1);
4675 }
4676 
4677 /*
4678  * returns a sockaddr_in6 with embedded scope recovered and removed
4679  */
4680 struct sockaddr_in6 *
4681 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4682 {
4683 	/* check and strip embedded scope junk */
4684 	if (addr->sin6_family == AF_INET6) {
4685 		if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4686 			if (addr->sin6_scope_id == 0) {
4687 				*store = *addr;
4688 				if (!sa6_recoverscope(store)) {
4689 					/* use the recovered scope */
4690 					addr = store;
4691 				}
4692 			} else {
4693 				/* else, return the original "to" addr */
4694 				in6_clearscope(&addr->sin6_addr);
4695 			}
4696 		}
4697 	}
4698 	return (addr);
4699 }
4700 #endif
4701 
4702 /*
4703  * are the two addresses the same?  currently a "scopeless" check returns: 1
4704  * if same, 0 if not
4705  */
4706 int
4707 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4708 {
4709 
4710 	/* must be valid */
4711 	if (sa1 == NULL || sa2 == NULL)
4712 		return (0);
4713 
4714 	/* must be the same family */
4715 	if (sa1->sa_family != sa2->sa_family)
4716 		return (0);
4717 
4718 	switch (sa1->sa_family) {
4719 #ifdef INET6
4720 	case AF_INET6:
4721 		{
4722 			/* IPv6 addresses */
4723 			struct sockaddr_in6 *sin6_1, *sin6_2;
4724 
4725 			sin6_1 = (struct sockaddr_in6 *)sa1;
4726 			sin6_2 = (struct sockaddr_in6 *)sa2;
4727 			return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4728 			    sin6_2));
4729 		}
4730 #endif
4731 #ifdef INET
4732 	case AF_INET:
4733 		{
4734 			/* IPv4 addresses */
4735 			struct sockaddr_in *sin_1, *sin_2;
4736 
4737 			sin_1 = (struct sockaddr_in *)sa1;
4738 			sin_2 = (struct sockaddr_in *)sa2;
4739 			return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4740 		}
4741 #endif
4742 	default:
4743 		/* we don't do these... */
4744 		return (0);
4745 	}
4746 }
4747 
4748 void
4749 sctp_print_address(struct sockaddr *sa)
4750 {
4751 #ifdef INET6
4752 	char ip6buf[INET6_ADDRSTRLEN];
4753 #endif
4754 
4755 	switch (sa->sa_family) {
4756 #ifdef INET6
4757 	case AF_INET6:
4758 		{
4759 			struct sockaddr_in6 *sin6;
4760 
4761 			sin6 = (struct sockaddr_in6 *)sa;
4762 			SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4763 			    ip6_sprintf(ip6buf, &sin6->sin6_addr),
4764 			    ntohs(sin6->sin6_port),
4765 			    sin6->sin6_scope_id);
4766 			break;
4767 		}
4768 #endif
4769 #ifdef INET
4770 	case AF_INET:
4771 		{
4772 			struct sockaddr_in *sin;
4773 			unsigned char *p;
4774 
4775 			sin = (struct sockaddr_in *)sa;
4776 			p = (unsigned char *)&sin->sin_addr;
4777 			SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4778 			    p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4779 			break;
4780 		}
4781 #endif
4782 	default:
4783 		SCTP_PRINTF("?\n");
4784 		break;
4785 	}
4786 }
4787 
4788 void
4789 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4790     struct sctp_inpcb *new_inp,
4791     struct sctp_tcb *stcb,
4792     int waitflags)
4793 {
4794 	/*
4795 	 * go through our old INP and pull off any control structures that
4796 	 * belong to stcb and move then to the new inp.
4797 	 */
4798 	struct socket *old_so, *new_so;
4799 	struct sctp_queued_to_read *control, *nctl;
4800 	struct sctp_readhead tmp_queue;
4801 	struct mbuf *m;
4802 	int error = 0;
4803 
4804 	old_so = old_inp->sctp_socket;
4805 	new_so = new_inp->sctp_socket;
4806 	TAILQ_INIT(&tmp_queue);
4807 	error = SOCK_IO_RECV_LOCK(old_so, waitflags);
4808 	if (error) {
4809 		/*
4810 		 * Gak, can't get I/O lock, we have a problem. data will be
4811 		 * left stranded.. and we don't dare look at it since the
4812 		 * other thread may be reading something. Oh well, its a
4813 		 * screwed up app that does a peeloff OR a accept while
4814 		 * reading from the main socket... actually its only the
4815 		 * peeloff() case, since I think read will fail on a
4816 		 * listening socket..
4817 		 */
4818 		return;
4819 	}
4820 	/* lock the socket buffers */
4821 	SCTP_INP_READ_LOCK(old_inp);
4822 	TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4823 		/* Pull off all for out target stcb */
4824 		if (control->stcb == stcb) {
4825 			/* remove it we want it */
4826 			TAILQ_REMOVE(&old_inp->read_queue, control, next);
4827 			TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4828 			m = control->data;
4829 			while (m) {
4830 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4831 					sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4832 				}
4833 				sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4834 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4835 					sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4836 				}
4837 				m = SCTP_BUF_NEXT(m);
4838 			}
4839 		}
4840 	}
4841 	SCTP_INP_READ_UNLOCK(old_inp);
4842 	/* Remove the recv-lock on the old socket */
4843 	SOCK_IO_RECV_UNLOCK(old_so);
4844 	/* Now we move them over to the new socket buffer */
4845 	SCTP_INP_READ_LOCK(new_inp);
4846 	TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4847 		TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4848 		m = control->data;
4849 		while (m) {
4850 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4851 				sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4852 			}
4853 			sctp_sballoc(stcb, &new_so->so_rcv, m);
4854 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4855 				sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4856 			}
4857 			m = SCTP_BUF_NEXT(m);
4858 		}
4859 	}
4860 	SCTP_INP_READ_UNLOCK(new_inp);
4861 }
4862 
4863 void
4864 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
4865     struct sctp_tcb *stcb,
4866     int so_locked
4867     SCTP_UNUSED
4868 )
4869 {
4870 	if ((inp != NULL) && (inp->sctp_socket != NULL)) {
4871 		sctp_sorwakeup(inp, inp->sctp_socket);
4872 	}
4873 }
4874 
4875 void
4876 sctp_add_to_readq(struct sctp_inpcb *inp,
4877     struct sctp_tcb *stcb,
4878     struct sctp_queued_to_read *control,
4879     struct sockbuf *sb,
4880     int end,
4881     int inp_read_lock_held,
4882     int so_locked)
4883 {
4884 	/*
4885 	 * Here we must place the control on the end of the socket read
4886 	 * queue AND increment sb_cc so that select will work properly on
4887 	 * read.
4888 	 */
4889 	struct mbuf *m, *prev = NULL;
4890 
4891 	if (inp == NULL) {
4892 		/* Gak, TSNH!! */
4893 #ifdef INVARIANTS
4894 		panic("Gak, inp NULL on add_to_readq");
4895 #endif
4896 		return;
4897 	}
4898 	if (inp_read_lock_held == 0)
4899 		SCTP_INP_READ_LOCK(inp);
4900 	if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4901 		if (!control->on_strm_q) {
4902 			sctp_free_remote_addr(control->whoFrom);
4903 			if (control->data) {
4904 				sctp_m_freem(control->data);
4905 				control->data = NULL;
4906 			}
4907 			sctp_free_a_readq(stcb, control);
4908 		}
4909 		if (inp_read_lock_held == 0)
4910 			SCTP_INP_READ_UNLOCK(inp);
4911 		return;
4912 	}
4913 	if (!(control->spec_flags & M_NOTIFICATION)) {
4914 		atomic_add_int(&inp->total_recvs, 1);
4915 		if (!control->do_not_ref_stcb) {
4916 			atomic_add_int(&stcb->total_recvs, 1);
4917 		}
4918 	}
4919 	m = control->data;
4920 	control->held_length = 0;
4921 	control->length = 0;
4922 	while (m) {
4923 		if (SCTP_BUF_LEN(m) == 0) {
4924 			/* Skip mbufs with NO length */
4925 			if (prev == NULL) {
4926 				/* First one */
4927 				control->data = sctp_m_free(m);
4928 				m = control->data;
4929 			} else {
4930 				SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4931 				m = SCTP_BUF_NEXT(prev);
4932 			}
4933 			if (m == NULL) {
4934 				control->tail_mbuf = prev;
4935 			}
4936 			continue;
4937 		}
4938 		prev = m;
4939 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4940 			sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4941 		}
4942 		sctp_sballoc(stcb, sb, m);
4943 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4944 			sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4945 		}
4946 		atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4947 		m = SCTP_BUF_NEXT(m);
4948 	}
4949 	if (prev != NULL) {
4950 		control->tail_mbuf = prev;
4951 	} else {
4952 		/* Everything got collapsed out?? */
4953 		if (!control->on_strm_q) {
4954 			sctp_free_remote_addr(control->whoFrom);
4955 			sctp_free_a_readq(stcb, control);
4956 		}
4957 		if (inp_read_lock_held == 0)
4958 			SCTP_INP_READ_UNLOCK(inp);
4959 		return;
4960 	}
4961 	if (end) {
4962 		control->end_added = 1;
4963 	}
4964 	TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4965 	control->on_read_q = 1;
4966 	if (inp_read_lock_held == 0)
4967 		SCTP_INP_READ_UNLOCK(inp);
4968 	if (inp && inp->sctp_socket) {
4969 		sctp_wakeup_the_read_socket(inp, stcb, so_locked);
4970 	}
4971 }
4972 
4973 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4974  *************ALTERNATE ROUTING CODE
4975  */
4976 
4977 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4978  *************ALTERNATE ROUTING CODE
4979  */
4980 
4981 struct mbuf *
4982 sctp_generate_cause(uint16_t code, char *info)
4983 {
4984 	struct mbuf *m;
4985 	struct sctp_gen_error_cause *cause;
4986 	size_t info_len;
4987 	uint16_t len;
4988 
4989 	if ((code == 0) || (info == NULL)) {
4990 		return (NULL);
4991 	}
4992 	info_len = strlen(info);
4993 	if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) {
4994 		return (NULL);
4995 	}
4996 	len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len);
4997 	m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4998 	if (m != NULL) {
4999 		SCTP_BUF_LEN(m) = len;
5000 		cause = mtod(m, struct sctp_gen_error_cause *);
5001 		cause->code = htons(code);
5002 		cause->length = htons(len);
5003 		memcpy(cause->info, info, info_len);
5004 	}
5005 	return (m);
5006 }
5007 
5008 struct mbuf *
5009 sctp_generate_no_user_data_cause(uint32_t tsn)
5010 {
5011 	struct mbuf *m;
5012 	struct sctp_error_no_user_data *no_user_data_cause;
5013 	uint16_t len;
5014 
5015 	len = (uint16_t)sizeof(struct sctp_error_no_user_data);
5016 	m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
5017 	if (m != NULL) {
5018 		SCTP_BUF_LEN(m) = len;
5019 		no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
5020 		no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
5021 		no_user_data_cause->cause.length = htons(len);
5022 		no_user_data_cause->tsn = htonl(tsn);
5023 	}
5024 	return (m);
5025 }
5026 
5027 #ifdef SCTP_MBCNT_LOGGING
5028 void
5029 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
5030     struct sctp_tmit_chunk *tp1, int chk_cnt)
5031 {
5032 	if (tp1->data == NULL) {
5033 		return;
5034 	}
5035 	asoc->chunks_on_out_queue -= chk_cnt;
5036 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
5037 		sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
5038 		    asoc->total_output_queue_size,
5039 		    tp1->book_size,
5040 		    0,
5041 		    tp1->mbcnt);
5042 	}
5043 	if (asoc->total_output_queue_size >= tp1->book_size) {
5044 		atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
5045 	} else {
5046 		asoc->total_output_queue_size = 0;
5047 	}
5048 
5049 	if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
5050 	    ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
5051 		if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
5052 			stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
5053 		} else {
5054 			stcb->sctp_socket->so_snd.sb_cc = 0;
5055 		}
5056 	}
5057 }
5058 
5059 #endif
5060 
5061 int
5062 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
5063     uint8_t sent, int so_locked)
5064 {
5065 	struct sctp_stream_out *strq;
5066 	struct sctp_tmit_chunk *chk = NULL, *tp2;
5067 	struct sctp_stream_queue_pending *sp;
5068 	uint32_t mid;
5069 	uint16_t sid;
5070 	uint8_t foundeom = 0;
5071 	int ret_sz = 0;
5072 	int notdone;
5073 	int do_wakeup_routine = 0;
5074 
5075 	sid = tp1->rec.data.sid;
5076 	mid = tp1->rec.data.mid;
5077 	if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
5078 		stcb->asoc.abandoned_sent[0]++;
5079 		stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
5080 		stcb->asoc.strmout[sid].abandoned_sent[0]++;
5081 #if defined(SCTP_DETAILED_STR_STATS)
5082 		stcb->asoc.strmout[sid].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
5083 #endif
5084 	} else {
5085 		stcb->asoc.abandoned_unsent[0]++;
5086 		stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
5087 		stcb->asoc.strmout[sid].abandoned_unsent[0]++;
5088 #if defined(SCTP_DETAILED_STR_STATS)
5089 		stcb->asoc.strmout[sid].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
5090 #endif
5091 	}
5092 	do {
5093 		ret_sz += tp1->book_size;
5094 		if (tp1->data != NULL) {
5095 			if (tp1->sent < SCTP_DATAGRAM_RESEND) {
5096 				sctp_flight_size_decrease(tp1);
5097 				sctp_total_flight_decrease(stcb, tp1);
5098 			}
5099 			sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
5100 			stcb->asoc.peers_rwnd += tp1->send_size;
5101 			stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
5102 			if (sent) {
5103 				sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
5104 			} else {
5105 				sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
5106 			}
5107 			if (tp1->data) {
5108 				sctp_m_freem(tp1->data);
5109 				tp1->data = NULL;
5110 			}
5111 			do_wakeup_routine = 1;
5112 			if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
5113 				stcb->asoc.sent_queue_cnt_removeable--;
5114 			}
5115 		}
5116 		tp1->sent = SCTP_FORWARD_TSN_SKIP;
5117 		if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
5118 		    SCTP_DATA_NOT_FRAG) {
5119 			/* not frag'ed we ae done   */
5120 			notdone = 0;
5121 			foundeom = 1;
5122 		} else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5123 			/* end of frag, we are done */
5124 			notdone = 0;
5125 			foundeom = 1;
5126 		} else {
5127 			/*
5128 			 * Its a begin or middle piece, we must mark all of
5129 			 * it
5130 			 */
5131 			notdone = 1;
5132 			tp1 = TAILQ_NEXT(tp1, sctp_next);
5133 		}
5134 	} while (tp1 && notdone);
5135 	if (foundeom == 0) {
5136 		/*
5137 		 * The multi-part message was scattered across the send and
5138 		 * sent queue.
5139 		 */
5140 		TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
5141 			if ((tp1->rec.data.sid != sid) ||
5142 			    (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) {
5143 				break;
5144 			}
5145 			/*
5146 			 * save to chk in case we have some on stream out
5147 			 * queue. If so and we have an un-transmitted one we
5148 			 * don't have to fudge the TSN.
5149 			 */
5150 			chk = tp1;
5151 			ret_sz += tp1->book_size;
5152 			sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
5153 			if (sent) {
5154 				sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
5155 			} else {
5156 				sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
5157 			}
5158 			if (tp1->data) {
5159 				sctp_m_freem(tp1->data);
5160 				tp1->data = NULL;
5161 			}
5162 			/* No flight involved here book the size to 0 */
5163 			tp1->book_size = 0;
5164 			if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5165 				foundeom = 1;
5166 			}
5167 			do_wakeup_routine = 1;
5168 			tp1->sent = SCTP_FORWARD_TSN_SKIP;
5169 			TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
5170 			/*
5171 			 * on to the sent queue so we can wait for it to be
5172 			 * passed by.
5173 			 */
5174 			TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
5175 			    sctp_next);
5176 			stcb->asoc.send_queue_cnt--;
5177 			stcb->asoc.sent_queue_cnt++;
5178 		}
5179 	}
5180 	if (foundeom == 0) {
5181 		/*
5182 		 * Still no eom found. That means there is stuff left on the
5183 		 * stream out queue.. yuck.
5184 		 */
5185 		SCTP_TCB_SEND_LOCK(stcb);
5186 		strq = &stcb->asoc.strmout[sid];
5187 		sp = TAILQ_FIRST(&strq->outqueue);
5188 		if (sp != NULL) {
5189 			sp->discard_rest = 1;
5190 			/*
5191 			 * We may need to put a chunk on the queue that
5192 			 * holds the TSN that would have been sent with the
5193 			 * LAST bit.
5194 			 */
5195 			if (chk == NULL) {
5196 				/* Yep, we have to */
5197 				sctp_alloc_a_chunk(stcb, chk);
5198 				if (chk == NULL) {
5199 					/*
5200 					 * we are hosed. All we can do is
5201 					 * nothing.. which will cause an
5202 					 * abort if the peer is paying
5203 					 * attention.
5204 					 */
5205 					goto oh_well;
5206 				}
5207 				memset(chk, 0, sizeof(*chk));
5208 				chk->rec.data.rcv_flags = 0;
5209 				chk->sent = SCTP_FORWARD_TSN_SKIP;
5210 				chk->asoc = &stcb->asoc;
5211 				if (stcb->asoc.idata_supported == 0) {
5212 					if (sp->sinfo_flags & SCTP_UNORDERED) {
5213 						chk->rec.data.mid = 0;
5214 					} else {
5215 						chk->rec.data.mid = strq->next_mid_ordered;
5216 					}
5217 				} else {
5218 					if (sp->sinfo_flags & SCTP_UNORDERED) {
5219 						chk->rec.data.mid = strq->next_mid_unordered;
5220 					} else {
5221 						chk->rec.data.mid = strq->next_mid_ordered;
5222 					}
5223 				}
5224 				chk->rec.data.sid = sp->sid;
5225 				chk->rec.data.ppid = sp->ppid;
5226 				chk->rec.data.context = sp->context;
5227 				chk->flags = sp->act_flags;
5228 				chk->whoTo = NULL;
5229 				chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
5230 				strq->chunks_on_queues++;
5231 				TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
5232 				stcb->asoc.sent_queue_cnt++;
5233 				stcb->asoc.pr_sctp_cnt++;
5234 			}
5235 			chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
5236 			if (sp->sinfo_flags & SCTP_UNORDERED) {
5237 				chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED;
5238 			}
5239 			if (stcb->asoc.idata_supported == 0) {
5240 				if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) {
5241 					strq->next_mid_ordered++;
5242 				}
5243 			} else {
5244 				if (sp->sinfo_flags & SCTP_UNORDERED) {
5245 					strq->next_mid_unordered++;
5246 				} else {
5247 					strq->next_mid_ordered++;
5248 				}
5249 			}
5250 	oh_well:
5251 			if (sp->data) {
5252 				/*
5253 				 * Pull any data to free up the SB and allow
5254 				 * sender to "add more" while we will throw
5255 				 * away :-)
5256 				 */
5257 				sctp_free_spbufspace(stcb, &stcb->asoc, sp);
5258 				ret_sz += sp->length;
5259 				do_wakeup_routine = 1;
5260 				sp->some_taken = 1;
5261 				sctp_m_freem(sp->data);
5262 				sp->data = NULL;
5263 				sp->tail_mbuf = NULL;
5264 				sp->length = 0;
5265 			}
5266 		}
5267 		SCTP_TCB_SEND_UNLOCK(stcb);
5268 	}
5269 	if (do_wakeup_routine) {
5270 		sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
5271 	}
5272 	return (ret_sz);
5273 }
5274 
5275 /*
5276  * checks to see if the given address, sa, is one that is currently known by
5277  * the kernel note: can't distinguish the same address on multiple interfaces
5278  * and doesn't handle multiple addresses with different zone/scope id's note:
5279  * ifa_ifwithaddr() compares the entire sockaddr struct
5280  */
5281 struct sctp_ifa *
5282 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
5283     int holds_lock)
5284 {
5285 	struct sctp_laddr *laddr;
5286 
5287 	if (holds_lock == 0) {
5288 		SCTP_INP_RLOCK(inp);
5289 	}
5290 
5291 	LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
5292 		if (laddr->ifa == NULL)
5293 			continue;
5294 		if (addr->sa_family != laddr->ifa->address.sa.sa_family)
5295 			continue;
5296 #ifdef INET
5297 		if (addr->sa_family == AF_INET) {
5298 			if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5299 			    laddr->ifa->address.sin.sin_addr.s_addr) {
5300 				/* found him. */
5301 				break;
5302 			}
5303 		}
5304 #endif
5305 #ifdef INET6
5306 		if (addr->sa_family == AF_INET6) {
5307 			if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5308 			    &laddr->ifa->address.sin6)) {
5309 				/* found him. */
5310 				break;
5311 			}
5312 		}
5313 #endif
5314 	}
5315 	if (holds_lock == 0) {
5316 		SCTP_INP_RUNLOCK(inp);
5317 	}
5318 	if (laddr != NULL) {
5319 		return (laddr->ifa);
5320 	} else {
5321 		return (NULL);
5322 	}
5323 }
5324 
5325 uint32_t
5326 sctp_get_ifa_hash_val(struct sockaddr *addr)
5327 {
5328 	switch (addr->sa_family) {
5329 #ifdef INET
5330 	case AF_INET:
5331 		{
5332 			struct sockaddr_in *sin;
5333 
5334 			sin = (struct sockaddr_in *)addr;
5335 			return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
5336 		}
5337 #endif
5338 #ifdef INET6
5339 	case AF_INET6:
5340 		{
5341 			struct sockaddr_in6 *sin6;
5342 			uint32_t hash_of_addr;
5343 
5344 			sin6 = (struct sockaddr_in6 *)addr;
5345 			hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
5346 			    sin6->sin6_addr.s6_addr32[1] +
5347 			    sin6->sin6_addr.s6_addr32[2] +
5348 			    sin6->sin6_addr.s6_addr32[3]);
5349 			hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
5350 			return (hash_of_addr);
5351 		}
5352 #endif
5353 	default:
5354 		break;
5355 	}
5356 	return (0);
5357 }
5358 
5359 struct sctp_ifa *
5360 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
5361 {
5362 	struct sctp_ifa *sctp_ifap;
5363 	struct sctp_vrf *vrf;
5364 	struct sctp_ifalist *hash_head;
5365 	uint32_t hash_of_addr;
5366 
5367 	if (holds_lock == 0) {
5368 		SCTP_IPI_ADDR_RLOCK();
5369 	} else {
5370 		SCTP_IPI_ADDR_LOCK_ASSERT();
5371 	}
5372 
5373 	vrf = sctp_find_vrf(vrf_id);
5374 	if (vrf == NULL) {
5375 		if (holds_lock == 0)
5376 			SCTP_IPI_ADDR_RUNLOCK();
5377 		return (NULL);
5378 	}
5379 
5380 	hash_of_addr = sctp_get_ifa_hash_val(addr);
5381 
5382 	hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5383 	if (hash_head == NULL) {
5384 		SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5385 		    hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark,
5386 		    (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark));
5387 		sctp_print_address(addr);
5388 		SCTP_PRINTF("No such bucket for address\n");
5389 		if (holds_lock == 0)
5390 			SCTP_IPI_ADDR_RUNLOCK();
5391 
5392 		return (NULL);
5393 	}
5394 	LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5395 		if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5396 			continue;
5397 #ifdef INET
5398 		if (addr->sa_family == AF_INET) {
5399 			if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5400 			    sctp_ifap->address.sin.sin_addr.s_addr) {
5401 				/* found him. */
5402 				break;
5403 			}
5404 		}
5405 #endif
5406 #ifdef INET6
5407 		if (addr->sa_family == AF_INET6) {
5408 			if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5409 			    &sctp_ifap->address.sin6)) {
5410 				/* found him. */
5411 				break;
5412 			}
5413 		}
5414 #endif
5415 	}
5416 	if (holds_lock == 0)
5417 		SCTP_IPI_ADDR_RUNLOCK();
5418 	return (sctp_ifap);
5419 }
5420 
5421 static void
5422 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock,
5423     uint32_t rwnd_req)
5424 {
5425 	/* User pulled some data, do we need a rwnd update? */
5426 	struct epoch_tracker et;
5427 	int r_unlocked = 0;
5428 	uint32_t dif, rwnd;
5429 	struct socket *so = NULL;
5430 
5431 	if (stcb == NULL)
5432 		return;
5433 
5434 	atomic_add_int(&stcb->asoc.refcnt, 1);
5435 
5436 	if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
5437 	    (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED | SCTP_STATE_SHUTDOWN_RECEIVED))) {
5438 		/* Pre-check If we are freeing no update */
5439 		goto no_lock;
5440 	}
5441 	SCTP_INP_INCR_REF(stcb->sctp_ep);
5442 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5443 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5444 		goto out;
5445 	}
5446 	so = stcb->sctp_socket;
5447 	if (so == NULL) {
5448 		goto out;
5449 	}
5450 	atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5451 	/* Have you have freed enough to look */
5452 	*freed_so_far = 0;
5453 	/* Yep, its worth a look and the lock overhead */
5454 
5455 	/* Figure out what the rwnd would be */
5456 	rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5457 	if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5458 		dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5459 	} else {
5460 		dif = 0;
5461 	}
5462 	if (dif >= rwnd_req) {
5463 		if (hold_rlock) {
5464 			SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5465 			r_unlocked = 1;
5466 		}
5467 		if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5468 			/*
5469 			 * One last check before we allow the guy possibly
5470 			 * to get in. There is a race, where the guy has not
5471 			 * reached the gate. In that case
5472 			 */
5473 			goto out;
5474 		}
5475 		SCTP_TCB_LOCK(stcb);
5476 		if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5477 			/* No reports here */
5478 			SCTP_TCB_UNLOCK(stcb);
5479 			goto out;
5480 		}
5481 		SCTP_STAT_INCR(sctps_wu_sacks_sent);
5482 		NET_EPOCH_ENTER(et);
5483 		sctp_send_sack(stcb, SCTP_SO_LOCKED);
5484 
5485 		sctp_chunk_output(stcb->sctp_ep, stcb,
5486 		    SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5487 		/* make sure no timer is running */
5488 		NET_EPOCH_EXIT(et);
5489 		sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
5490 		    SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5491 		SCTP_TCB_UNLOCK(stcb);
5492 	} else {
5493 		/* Update how much we have pending */
5494 		stcb->freed_by_sorcv_sincelast = dif;
5495 	}
5496 out:
5497 	if (so && r_unlocked && hold_rlock) {
5498 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
5499 	}
5500 
5501 	SCTP_INP_DECR_REF(stcb->sctp_ep);
5502 no_lock:
5503 	atomic_subtract_int(&stcb->asoc.refcnt, 1);
5504 	return;
5505 }
5506 
5507 int
5508 sctp_sorecvmsg(struct socket *so,
5509     struct uio *uio,
5510     struct mbuf **mp,
5511     struct sockaddr *from,
5512     int fromlen,
5513     int *msg_flags,
5514     struct sctp_sndrcvinfo *sinfo,
5515     int filling_sinfo)
5516 {
5517 	/*
5518 	 * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5519 	 * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5520 	 * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5521 	 * On the way out we may send out any combination of:
5522 	 * MSG_NOTIFICATION MSG_EOR
5523 	 *
5524 	 */
5525 	struct sctp_inpcb *inp = NULL;
5526 	ssize_t my_len = 0;
5527 	ssize_t cp_len = 0;
5528 	int error = 0;
5529 	struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5530 	struct mbuf *m = NULL;
5531 	struct sctp_tcb *stcb = NULL;
5532 	int wakeup_read_socket = 0;
5533 	int freecnt_applied = 0;
5534 	int out_flags = 0, in_flags = 0;
5535 	int block_allowed = 1;
5536 	uint32_t freed_so_far = 0;
5537 	ssize_t copied_so_far = 0;
5538 	int in_eeor_mode = 0;
5539 	int no_rcv_needed = 0;
5540 	uint32_t rwnd_req = 0;
5541 	int hold_sblock = 0;
5542 	int hold_rlock = 0;
5543 	ssize_t slen = 0;
5544 	uint32_t held_length = 0;
5545 	int sockbuf_lock = 0;
5546 
5547 	if (uio == NULL) {
5548 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5549 		return (EINVAL);
5550 	}
5551 
5552 	if (msg_flags) {
5553 		in_flags = *msg_flags;
5554 		if (in_flags & MSG_PEEK)
5555 			SCTP_STAT_INCR(sctps_read_peeks);
5556 	} else {
5557 		in_flags = 0;
5558 	}
5559 	slen = uio->uio_resid;
5560 
5561 	/* Pull in and set up our int flags */
5562 	if (in_flags & MSG_OOB) {
5563 		/* Out of band's NOT supported */
5564 		return (EOPNOTSUPP);
5565 	}
5566 	if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5567 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5568 		return (EINVAL);
5569 	}
5570 	if ((in_flags & (MSG_DONTWAIT
5571 	    | MSG_NBIO
5572 	    )) ||
5573 	    SCTP_SO_IS_NBIO(so)) {
5574 		block_allowed = 0;
5575 	}
5576 	/* setup the endpoint */
5577 	inp = (struct sctp_inpcb *)so->so_pcb;
5578 	if (inp == NULL) {
5579 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5580 		return (EFAULT);
5581 	}
5582 	rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5583 	/* Must be at least a MTU's worth */
5584 	if (rwnd_req < SCTP_MIN_RWND)
5585 		rwnd_req = SCTP_MIN_RWND;
5586 	in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5587 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5588 		sctp_misc_ints(SCTP_SORECV_ENTER,
5589 		    rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5590 	}
5591 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5592 		sctp_misc_ints(SCTP_SORECV_ENTERPL,
5593 		    rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5594 	}
5595 
5596 	error = SOCK_IO_RECV_LOCK(so, SBLOCKWAIT(in_flags));
5597 	if (error) {
5598 		goto release_unlocked;
5599 	}
5600 	sockbuf_lock = 1;
5601 restart:
5602 
5603 restart_nosblocks:
5604 	if (hold_sblock == 0) {
5605 		SOCKBUF_LOCK(&so->so_rcv);
5606 		hold_sblock = 1;
5607 	}
5608 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5609 	    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5610 		goto out;
5611 	}
5612 	if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5613 		if (so->so_error) {
5614 			error = so->so_error;
5615 			if ((in_flags & MSG_PEEK) == 0)
5616 				so->so_error = 0;
5617 			goto out;
5618 		} else {
5619 			if (so->so_rcv.sb_cc == 0) {
5620 				/* indicate EOF */
5621 				error = 0;
5622 				goto out;
5623 			}
5624 		}
5625 	}
5626 	if (so->so_rcv.sb_cc <= held_length) {
5627 		if (so->so_error) {
5628 			error = so->so_error;
5629 			if ((in_flags & MSG_PEEK) == 0) {
5630 				so->so_error = 0;
5631 			}
5632 			goto out;
5633 		}
5634 		if ((so->so_rcv.sb_cc == 0) &&
5635 		    ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5636 		    (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5637 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5638 				/*
5639 				 * For active open side clear flags for
5640 				 * re-use passive open is blocked by
5641 				 * connect.
5642 				 */
5643 				if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5644 					/*
5645 					 * You were aborted, passive side
5646 					 * always hits here
5647 					 */
5648 					SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5649 					error = ECONNRESET;
5650 				}
5651 				so->so_state &= ~(SS_ISCONNECTING |
5652 				    SS_ISDISCONNECTING |
5653 				    SS_ISCONFIRMING |
5654 				    SS_ISCONNECTED);
5655 				if (error == 0) {
5656 					if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5657 						SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5658 						error = ENOTCONN;
5659 					}
5660 				}
5661 				goto out;
5662 			}
5663 		}
5664 		if (block_allowed) {
5665 			error = sbwait(&so->so_rcv);
5666 			if (error) {
5667 				goto out;
5668 			}
5669 			held_length = 0;
5670 			goto restart_nosblocks;
5671 		} else {
5672 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5673 			error = EWOULDBLOCK;
5674 			goto out;
5675 		}
5676 	}
5677 	if (hold_sblock == 1) {
5678 		SOCKBUF_UNLOCK(&so->so_rcv);
5679 		hold_sblock = 0;
5680 	}
5681 	/* we possibly have data we can read */
5682 	/* sa_ignore FREED_MEMORY */
5683 	control = TAILQ_FIRST(&inp->read_queue);
5684 	if (control == NULL) {
5685 		/*
5686 		 * This could be happening since the appender did the
5687 		 * increment but as not yet did the tailq insert onto the
5688 		 * read_queue
5689 		 */
5690 		if (hold_rlock == 0) {
5691 			SCTP_INP_READ_LOCK(inp);
5692 		}
5693 		control = TAILQ_FIRST(&inp->read_queue);
5694 		if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5695 #ifdef INVARIANTS
5696 			panic("Huh, its non zero and nothing on control?");
5697 #endif
5698 			so->so_rcv.sb_cc = 0;
5699 		}
5700 		SCTP_INP_READ_UNLOCK(inp);
5701 		hold_rlock = 0;
5702 		goto restart;
5703 	}
5704 
5705 	if ((control->length == 0) &&
5706 	    (control->do_not_ref_stcb)) {
5707 		/*
5708 		 * Clean up code for freeing assoc that left behind a
5709 		 * pdapi.. maybe a peer in EEOR that just closed after
5710 		 * sending and never indicated a EOR.
5711 		 */
5712 		if (hold_rlock == 0) {
5713 			hold_rlock = 1;
5714 			SCTP_INP_READ_LOCK(inp);
5715 		}
5716 		control->held_length = 0;
5717 		if (control->data) {
5718 			/* Hmm there is data here .. fix */
5719 			struct mbuf *m_tmp;
5720 			int cnt = 0;
5721 
5722 			m_tmp = control->data;
5723 			while (m_tmp) {
5724 				cnt += SCTP_BUF_LEN(m_tmp);
5725 				if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5726 					control->tail_mbuf = m_tmp;
5727 					control->end_added = 1;
5728 				}
5729 				m_tmp = SCTP_BUF_NEXT(m_tmp);
5730 			}
5731 			control->length = cnt;
5732 		} else {
5733 			/* remove it */
5734 			TAILQ_REMOVE(&inp->read_queue, control, next);
5735 			/* Add back any hiddend data */
5736 			sctp_free_remote_addr(control->whoFrom);
5737 			sctp_free_a_readq(stcb, control);
5738 		}
5739 		if (hold_rlock) {
5740 			hold_rlock = 0;
5741 			SCTP_INP_READ_UNLOCK(inp);
5742 		}
5743 		goto restart;
5744 	}
5745 	if ((control->length == 0) &&
5746 	    (control->end_added == 1)) {
5747 		/*
5748 		 * Do we also need to check for (control->pdapi_aborted ==
5749 		 * 1)?
5750 		 */
5751 		if (hold_rlock == 0) {
5752 			hold_rlock = 1;
5753 			SCTP_INP_READ_LOCK(inp);
5754 		}
5755 		TAILQ_REMOVE(&inp->read_queue, control, next);
5756 		if (control->data) {
5757 #ifdef INVARIANTS
5758 			panic("control->data not null but control->length == 0");
5759 #else
5760 			SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5761 			sctp_m_freem(control->data);
5762 			control->data = NULL;
5763 #endif
5764 		}
5765 		if (control->aux_data) {
5766 			sctp_m_free(control->aux_data);
5767 			control->aux_data = NULL;
5768 		}
5769 #ifdef INVARIANTS
5770 		if (control->on_strm_q) {
5771 			panic("About to free ctl:%p so:%p and its in %d",
5772 			    control, so, control->on_strm_q);
5773 		}
5774 #endif
5775 		sctp_free_remote_addr(control->whoFrom);
5776 		sctp_free_a_readq(stcb, control);
5777 		if (hold_rlock) {
5778 			hold_rlock = 0;
5779 			SCTP_INP_READ_UNLOCK(inp);
5780 		}
5781 		goto restart;
5782 	}
5783 	if (control->length == 0) {
5784 		if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5785 		    (filling_sinfo)) {
5786 			/* find a more suitable one then this */
5787 			ctl = TAILQ_NEXT(control, next);
5788 			while (ctl) {
5789 				if ((ctl->stcb != control->stcb) && (ctl->length) &&
5790 				    (ctl->some_taken ||
5791 				    (ctl->spec_flags & M_NOTIFICATION) ||
5792 				    ((ctl->do_not_ref_stcb == 0) &&
5793 				    (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5794 				    ) {
5795 					/*-
5796 					 * If we have a different TCB next, and there is data
5797 					 * present. If we have already taken some (pdapi), OR we can
5798 					 * ref the tcb and no delivery as started on this stream, we
5799 					 * take it. Note we allow a notification on a different
5800 					 * assoc to be delivered..
5801 					 */
5802 					control = ctl;
5803 					goto found_one;
5804 				} else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5805 					    (ctl->length) &&
5806 					    ((ctl->some_taken) ||
5807 					    ((ctl->do_not_ref_stcb == 0) &&
5808 					    ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5809 				    (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5810 					/*-
5811 					 * If we have the same tcb, and there is data present, and we
5812 					 * have the strm interleave feature present. Then if we have
5813 					 * taken some (pdapi) or we can refer to tht tcb AND we have
5814 					 * not started a delivery for this stream, we can take it.
5815 					 * Note we do NOT allow a notificaiton on the same assoc to
5816 					 * be delivered.
5817 					 */
5818 					control = ctl;
5819 					goto found_one;
5820 				}
5821 				ctl = TAILQ_NEXT(ctl, next);
5822 			}
5823 		}
5824 		/*
5825 		 * if we reach here, not suitable replacement is available
5826 		 * <or> fragment interleave is NOT on. So stuff the sb_cc
5827 		 * into the our held count, and its time to sleep again.
5828 		 */
5829 		held_length = so->so_rcv.sb_cc;
5830 		control->held_length = so->so_rcv.sb_cc;
5831 		goto restart;
5832 	}
5833 	/* Clear the held length since there is something to read */
5834 	control->held_length = 0;
5835 found_one:
5836 	/*
5837 	 * If we reach here, control has a some data for us to read off.
5838 	 * Note that stcb COULD be NULL.
5839 	 */
5840 	if (hold_rlock == 0) {
5841 		hold_rlock = 1;
5842 		SCTP_INP_READ_LOCK(inp);
5843 	}
5844 	control->some_taken++;
5845 	stcb = control->stcb;
5846 	if (stcb) {
5847 		if ((control->do_not_ref_stcb == 0) &&
5848 		    (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5849 			if (freecnt_applied == 0)
5850 				stcb = NULL;
5851 		} else if (control->do_not_ref_stcb == 0) {
5852 			/* you can't free it on me please */
5853 			/*
5854 			 * The lock on the socket buffer protects us so the
5855 			 * free code will stop. But since we used the
5856 			 * socketbuf lock and the sender uses the tcb_lock
5857 			 * to increment, we need to use the atomic add to
5858 			 * the refcnt
5859 			 */
5860 			if (freecnt_applied) {
5861 #ifdef INVARIANTS
5862 				panic("refcnt already incremented");
5863 #else
5864 				SCTP_PRINTF("refcnt already incremented?\n");
5865 #endif
5866 			} else {
5867 				atomic_add_int(&stcb->asoc.refcnt, 1);
5868 				freecnt_applied = 1;
5869 			}
5870 			/*
5871 			 * Setup to remember how much we have not yet told
5872 			 * the peer our rwnd has opened up. Note we grab the
5873 			 * value from the tcb from last time. Note too that
5874 			 * sack sending clears this when a sack is sent,
5875 			 * which is fine. Once we hit the rwnd_req, we then
5876 			 * will go to the sctp_user_rcvd() that will not
5877 			 * lock until it KNOWs it MUST send a WUP-SACK.
5878 			 */
5879 			freed_so_far = (uint32_t)stcb->freed_by_sorcv_sincelast;
5880 			stcb->freed_by_sorcv_sincelast = 0;
5881 		}
5882 	}
5883 	if (stcb &&
5884 	    ((control->spec_flags & M_NOTIFICATION) == 0) &&
5885 	    control->do_not_ref_stcb == 0) {
5886 		stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5887 	}
5888 
5889 	/* First lets get off the sinfo and sockaddr info */
5890 	if ((sinfo != NULL) && (filling_sinfo != 0)) {
5891 		sinfo->sinfo_stream = control->sinfo_stream;
5892 		sinfo->sinfo_ssn = (uint16_t)control->mid;
5893 		sinfo->sinfo_flags = control->sinfo_flags;
5894 		sinfo->sinfo_ppid = control->sinfo_ppid;
5895 		sinfo->sinfo_context = control->sinfo_context;
5896 		sinfo->sinfo_timetolive = control->sinfo_timetolive;
5897 		sinfo->sinfo_tsn = control->sinfo_tsn;
5898 		sinfo->sinfo_cumtsn = control->sinfo_cumtsn;
5899 		sinfo->sinfo_assoc_id = control->sinfo_assoc_id;
5900 		nxt = TAILQ_NEXT(control, next);
5901 		if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5902 		    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5903 			struct sctp_extrcvinfo *s_extra;
5904 
5905 			s_extra = (struct sctp_extrcvinfo *)sinfo;
5906 			if ((nxt) &&
5907 			    (nxt->length)) {
5908 				s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5909 				if (nxt->sinfo_flags & SCTP_UNORDERED) {
5910 					s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5911 				}
5912 				if (nxt->spec_flags & M_NOTIFICATION) {
5913 					s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5914 				}
5915 				s_extra->serinfo_next_aid = nxt->sinfo_assoc_id;
5916 				s_extra->serinfo_next_length = nxt->length;
5917 				s_extra->serinfo_next_ppid = nxt->sinfo_ppid;
5918 				s_extra->serinfo_next_stream = nxt->sinfo_stream;
5919 				if (nxt->tail_mbuf != NULL) {
5920 					if (nxt->end_added) {
5921 						s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5922 					}
5923 				}
5924 			} else {
5925 				/*
5926 				 * we explicitly 0 this, since the memcpy
5927 				 * got some other things beyond the older
5928 				 * sinfo_ that is on the control's structure
5929 				 * :-D
5930 				 */
5931 				nxt = NULL;
5932 				s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
5933 				s_extra->serinfo_next_aid = 0;
5934 				s_extra->serinfo_next_length = 0;
5935 				s_extra->serinfo_next_ppid = 0;
5936 				s_extra->serinfo_next_stream = 0;
5937 			}
5938 		}
5939 		/*
5940 		 * update off the real current cum-ack, if we have an stcb.
5941 		 */
5942 		if ((control->do_not_ref_stcb == 0) && stcb)
5943 			sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5944 		/*
5945 		 * mask off the high bits, we keep the actual chunk bits in
5946 		 * there.
5947 		 */
5948 		sinfo->sinfo_flags &= 0x00ff;
5949 		if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5950 			sinfo->sinfo_flags |= SCTP_UNORDERED;
5951 		}
5952 	}
5953 #ifdef SCTP_ASOCLOG_OF_TSNS
5954 	{
5955 		int index, newindex;
5956 		struct sctp_pcbtsn_rlog *entry;
5957 
5958 		do {
5959 			index = inp->readlog_index;
5960 			newindex = index + 1;
5961 			if (newindex >= SCTP_READ_LOG_SIZE) {
5962 				newindex = 0;
5963 			}
5964 		} while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5965 		entry = &inp->readlog[index];
5966 		entry->vtag = control->sinfo_assoc_id;
5967 		entry->strm = control->sinfo_stream;
5968 		entry->seq = (uint16_t)control->mid;
5969 		entry->sz = control->length;
5970 		entry->flgs = control->sinfo_flags;
5971 	}
5972 #endif
5973 	if ((fromlen > 0) && (from != NULL)) {
5974 		union sctp_sockstore store;
5975 		size_t len;
5976 
5977 		switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5978 #ifdef INET6
5979 		case AF_INET6:
5980 			len = sizeof(struct sockaddr_in6);
5981 			store.sin6 = control->whoFrom->ro._l_addr.sin6;
5982 			store.sin6.sin6_port = control->port_from;
5983 			break;
5984 #endif
5985 #ifdef INET
5986 		case AF_INET:
5987 #ifdef INET6
5988 			if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5989 				len = sizeof(struct sockaddr_in6);
5990 				in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5991 				    &store.sin6);
5992 				store.sin6.sin6_port = control->port_from;
5993 			} else {
5994 				len = sizeof(struct sockaddr_in);
5995 				store.sin = control->whoFrom->ro._l_addr.sin;
5996 				store.sin.sin_port = control->port_from;
5997 			}
5998 #else
5999 			len = sizeof(struct sockaddr_in);
6000 			store.sin = control->whoFrom->ro._l_addr.sin;
6001 			store.sin.sin_port = control->port_from;
6002 #endif
6003 			break;
6004 #endif
6005 		default:
6006 			len = 0;
6007 			break;
6008 		}
6009 		memcpy(from, &store, min((size_t)fromlen, len));
6010 #ifdef INET6
6011 		{
6012 			struct sockaddr_in6 lsa6, *from6;
6013 
6014 			from6 = (struct sockaddr_in6 *)from;
6015 			sctp_recover_scope_mac(from6, (&lsa6));
6016 		}
6017 #endif
6018 	}
6019 	if (hold_rlock) {
6020 		SCTP_INP_READ_UNLOCK(inp);
6021 		hold_rlock = 0;
6022 	}
6023 	if (hold_sblock) {
6024 		SOCKBUF_UNLOCK(&so->so_rcv);
6025 		hold_sblock = 0;
6026 	}
6027 	/* now copy out what data we can */
6028 	if (mp == NULL) {
6029 		/* copy out each mbuf in the chain up to length */
6030 get_more_data:
6031 		m = control->data;
6032 		while (m) {
6033 			/* Move out all we can */
6034 			cp_len = uio->uio_resid;
6035 			my_len = SCTP_BUF_LEN(m);
6036 			if (cp_len > my_len) {
6037 				/* not enough in this buf */
6038 				cp_len = my_len;
6039 			}
6040 			if (hold_rlock) {
6041 				SCTP_INP_READ_UNLOCK(inp);
6042 				hold_rlock = 0;
6043 			}
6044 			if (cp_len > 0)
6045 				error = uiomove(mtod(m, char *), (int)cp_len, uio);
6046 			/* re-read */
6047 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
6048 				goto release;
6049 			}
6050 
6051 			if ((control->do_not_ref_stcb == 0) && stcb &&
6052 			    stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
6053 				no_rcv_needed = 1;
6054 			}
6055 			if (error) {
6056 				/* error we are out of here */
6057 				goto release;
6058 			}
6059 			SCTP_INP_READ_LOCK(inp);
6060 			hold_rlock = 1;
6061 			if (cp_len == SCTP_BUF_LEN(m)) {
6062 				if ((SCTP_BUF_NEXT(m) == NULL) &&
6063 				    (control->end_added)) {
6064 					out_flags |= MSG_EOR;
6065 					if ((control->do_not_ref_stcb == 0) &&
6066 					    (control->stcb != NULL) &&
6067 					    ((control->spec_flags & M_NOTIFICATION) == 0))
6068 						control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6069 				}
6070 				if (control->spec_flags & M_NOTIFICATION) {
6071 					out_flags |= MSG_NOTIFICATION;
6072 				}
6073 				/* we ate up the mbuf */
6074 				if (in_flags & MSG_PEEK) {
6075 					/* just looking */
6076 					m = SCTP_BUF_NEXT(m);
6077 					copied_so_far += cp_len;
6078 				} else {
6079 					/* dispose of the mbuf */
6080 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6081 						sctp_sblog(&so->so_rcv,
6082 						    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6083 					}
6084 					sctp_sbfree(control, stcb, &so->so_rcv, m);
6085 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6086 						sctp_sblog(&so->so_rcv,
6087 						    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6088 					}
6089 					copied_so_far += cp_len;
6090 					freed_so_far += (uint32_t)cp_len;
6091 					freed_so_far += MSIZE;
6092 					atomic_subtract_int(&control->length, (int)cp_len);
6093 					control->data = sctp_m_free(m);
6094 					m = control->data;
6095 					/*
6096 					 * been through it all, must hold sb
6097 					 * lock ok to null tail
6098 					 */
6099 					if (control->data == NULL) {
6100 #ifdef INVARIANTS
6101 						if ((control->end_added == 0) ||
6102 						    (TAILQ_NEXT(control, next) == NULL)) {
6103 							/*
6104 							 * If the end is not
6105 							 * added, OR the
6106 							 * next is NOT null
6107 							 * we MUST have the
6108 							 * lock.
6109 							 */
6110 							if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
6111 								panic("Hmm we don't own the lock?");
6112 							}
6113 						}
6114 #endif
6115 						control->tail_mbuf = NULL;
6116 #ifdef INVARIANTS
6117 						if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
6118 							panic("end_added, nothing left and no MSG_EOR");
6119 						}
6120 #endif
6121 					}
6122 				}
6123 			} else {
6124 				/* Do we need to trim the mbuf? */
6125 				if (control->spec_flags & M_NOTIFICATION) {
6126 					out_flags |= MSG_NOTIFICATION;
6127 				}
6128 				if ((in_flags & MSG_PEEK) == 0) {
6129 					SCTP_BUF_RESV_UF(m, cp_len);
6130 					SCTP_BUF_LEN(m) -= (int)cp_len;
6131 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6132 						sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, (int)cp_len);
6133 					}
6134 					atomic_subtract_int(&so->so_rcv.sb_cc, (int)cp_len);
6135 					if ((control->do_not_ref_stcb == 0) &&
6136 					    stcb) {
6137 						atomic_subtract_int(&stcb->asoc.sb_cc, (int)cp_len);
6138 					}
6139 					copied_so_far += cp_len;
6140 					freed_so_far += (uint32_t)cp_len;
6141 					freed_so_far += MSIZE;
6142 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6143 						sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
6144 						    SCTP_LOG_SBRESULT, 0);
6145 					}
6146 					atomic_subtract_int(&control->length, (int)cp_len);
6147 				} else {
6148 					copied_so_far += cp_len;
6149 				}
6150 			}
6151 			if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
6152 				break;
6153 			}
6154 			if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
6155 			    (control->do_not_ref_stcb == 0) &&
6156 			    (freed_so_far >= rwnd_req)) {
6157 				sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6158 			}
6159 		}		/* end while(m) */
6160 		/*
6161 		 * At this point we have looked at it all and we either have
6162 		 * a MSG_EOR/or read all the user wants... <OR>
6163 		 * control->length == 0.
6164 		 */
6165 		if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
6166 			/* we are done with this control */
6167 			if (control->length == 0) {
6168 				if (control->data) {
6169 #ifdef INVARIANTS
6170 					panic("control->data not null at read eor?");
6171 #else
6172 					SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
6173 					sctp_m_freem(control->data);
6174 					control->data = NULL;
6175 #endif
6176 				}
6177 		done_with_control:
6178 				if (hold_rlock == 0) {
6179 					SCTP_INP_READ_LOCK(inp);
6180 					hold_rlock = 1;
6181 				}
6182 				TAILQ_REMOVE(&inp->read_queue, control, next);
6183 				/* Add back any hiddend data */
6184 				if (control->held_length) {
6185 					held_length = 0;
6186 					control->held_length = 0;
6187 					wakeup_read_socket = 1;
6188 				}
6189 				if (control->aux_data) {
6190 					sctp_m_free(control->aux_data);
6191 					control->aux_data = NULL;
6192 				}
6193 				no_rcv_needed = control->do_not_ref_stcb;
6194 				sctp_free_remote_addr(control->whoFrom);
6195 				control->data = NULL;
6196 #ifdef INVARIANTS
6197 				if (control->on_strm_q) {
6198 					panic("About to free ctl:%p so:%p and its in %d",
6199 					    control, so, control->on_strm_q);
6200 				}
6201 #endif
6202 				sctp_free_a_readq(stcb, control);
6203 				control = NULL;
6204 				if ((freed_so_far >= rwnd_req) &&
6205 				    (no_rcv_needed == 0))
6206 					sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6207 
6208 			} else {
6209 				/*
6210 				 * The user did not read all of this
6211 				 * message, turn off the returned MSG_EOR
6212 				 * since we are leaving more behind on the
6213 				 * control to read.
6214 				 */
6215 #ifdef INVARIANTS
6216 				if (control->end_added &&
6217 				    (control->data == NULL) &&
6218 				    (control->tail_mbuf == NULL)) {
6219 					panic("Gak, control->length is corrupt?");
6220 				}
6221 #endif
6222 				no_rcv_needed = control->do_not_ref_stcb;
6223 				out_flags &= ~MSG_EOR;
6224 			}
6225 		}
6226 		if (out_flags & MSG_EOR) {
6227 			goto release;
6228 		}
6229 		if ((uio->uio_resid == 0) ||
6230 		    ((in_eeor_mode) &&
6231 		    (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))) {
6232 			goto release;
6233 		}
6234 		/*
6235 		 * If I hit here the receiver wants more and this message is
6236 		 * NOT done (pd-api). So two questions. Can we block? if not
6237 		 * we are done. Did the user NOT set MSG_WAITALL?
6238 		 */
6239 		if (block_allowed == 0) {
6240 			goto release;
6241 		}
6242 		/*
6243 		 * We need to wait for more data a few things: - We don't
6244 		 * release the I/O lock so we don't get someone else
6245 		 * reading. - We must be sure to account for the case where
6246 		 * what is added is NOT to our control when we wakeup.
6247 		 */
6248 
6249 		/*
6250 		 * Do we need to tell the transport a rwnd update might be
6251 		 * needed before we go to sleep?
6252 		 */
6253 		if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
6254 		    ((freed_so_far >= rwnd_req) &&
6255 		    (control->do_not_ref_stcb == 0) &&
6256 		    (no_rcv_needed == 0))) {
6257 			sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6258 		}
6259 wait_some_more:
6260 		if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
6261 			goto release;
6262 		}
6263 
6264 		if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
6265 			goto release;
6266 
6267 		if (hold_rlock == 1) {
6268 			SCTP_INP_READ_UNLOCK(inp);
6269 			hold_rlock = 0;
6270 		}
6271 		if (hold_sblock == 0) {
6272 			SOCKBUF_LOCK(&so->so_rcv);
6273 			hold_sblock = 1;
6274 		}
6275 		if ((copied_so_far) && (control->length == 0) &&
6276 		    (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
6277 			goto release;
6278 		}
6279 		if (so->so_rcv.sb_cc <= control->held_length) {
6280 			error = sbwait(&so->so_rcv);
6281 			if (error) {
6282 				goto release;
6283 			}
6284 			control->held_length = 0;
6285 		}
6286 		if (hold_sblock) {
6287 			SOCKBUF_UNLOCK(&so->so_rcv);
6288 			hold_sblock = 0;
6289 		}
6290 		if (control->length == 0) {
6291 			/* still nothing here */
6292 			if (control->end_added == 1) {
6293 				/* he aborted, or is done i.e.did a shutdown */
6294 				out_flags |= MSG_EOR;
6295 				if (control->pdapi_aborted) {
6296 					if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6297 						control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6298 
6299 					out_flags |= MSG_TRUNC;
6300 				} else {
6301 					if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6302 						control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6303 				}
6304 				goto done_with_control;
6305 			}
6306 			if (so->so_rcv.sb_cc > held_length) {
6307 				control->held_length = so->so_rcv.sb_cc;
6308 				held_length = 0;
6309 			}
6310 			goto wait_some_more;
6311 		} else if (control->data == NULL) {
6312 			/*
6313 			 * we must re-sync since data is probably being
6314 			 * added
6315 			 */
6316 			SCTP_INP_READ_LOCK(inp);
6317 			if ((control->length > 0) && (control->data == NULL)) {
6318 				/*
6319 				 * big trouble.. we have the lock and its
6320 				 * corrupt?
6321 				 */
6322 #ifdef INVARIANTS
6323 				panic("Impossible data==NULL length !=0");
6324 #endif
6325 				out_flags |= MSG_EOR;
6326 				out_flags |= MSG_TRUNC;
6327 				control->length = 0;
6328 				SCTP_INP_READ_UNLOCK(inp);
6329 				goto done_with_control;
6330 			}
6331 			SCTP_INP_READ_UNLOCK(inp);
6332 			/* We will fall around to get more data */
6333 		}
6334 		goto get_more_data;
6335 	} else {
6336 		/*-
6337 		 * Give caller back the mbuf chain,
6338 		 * store in uio_resid the length
6339 		 */
6340 		wakeup_read_socket = 0;
6341 		if ((control->end_added == 0) ||
6342 		    (TAILQ_NEXT(control, next) == NULL)) {
6343 			/* Need to get rlock */
6344 			if (hold_rlock == 0) {
6345 				SCTP_INP_READ_LOCK(inp);
6346 				hold_rlock = 1;
6347 			}
6348 		}
6349 		if (control->end_added) {
6350 			out_flags |= MSG_EOR;
6351 			if ((control->do_not_ref_stcb == 0) &&
6352 			    (control->stcb != NULL) &&
6353 			    ((control->spec_flags & M_NOTIFICATION) == 0))
6354 				control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6355 		}
6356 		if (control->spec_flags & M_NOTIFICATION) {
6357 			out_flags |= MSG_NOTIFICATION;
6358 		}
6359 		uio->uio_resid = control->length;
6360 		*mp = control->data;
6361 		m = control->data;
6362 		while (m) {
6363 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6364 				sctp_sblog(&so->so_rcv,
6365 				    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6366 			}
6367 			sctp_sbfree(control, stcb, &so->so_rcv, m);
6368 			freed_so_far += (uint32_t)SCTP_BUF_LEN(m);
6369 			freed_so_far += MSIZE;
6370 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6371 				sctp_sblog(&so->so_rcv,
6372 				    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6373 			}
6374 			m = SCTP_BUF_NEXT(m);
6375 		}
6376 		control->data = control->tail_mbuf = NULL;
6377 		control->length = 0;
6378 		if (out_flags & MSG_EOR) {
6379 			/* Done with this control */
6380 			goto done_with_control;
6381 		}
6382 	}
6383 release:
6384 	if (hold_rlock == 1) {
6385 		SCTP_INP_READ_UNLOCK(inp);
6386 		hold_rlock = 0;
6387 	}
6388 	if (hold_sblock == 1) {
6389 		SOCKBUF_UNLOCK(&so->so_rcv);
6390 		hold_sblock = 0;
6391 	}
6392 
6393 	SOCK_IO_RECV_UNLOCK(so);
6394 	sockbuf_lock = 0;
6395 
6396 release_unlocked:
6397 	if (hold_sblock) {
6398 		SOCKBUF_UNLOCK(&so->so_rcv);
6399 		hold_sblock = 0;
6400 	}
6401 	if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6402 		if ((freed_so_far >= rwnd_req) &&
6403 		    (control && (control->do_not_ref_stcb == 0)) &&
6404 		    (no_rcv_needed == 0))
6405 			sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6406 	}
6407 out:
6408 	if (msg_flags) {
6409 		*msg_flags = out_flags;
6410 	}
6411 	if (((out_flags & MSG_EOR) == 0) &&
6412 	    ((in_flags & MSG_PEEK) == 0) &&
6413 	    (sinfo) &&
6414 	    (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6415 	    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6416 		struct sctp_extrcvinfo *s_extra;
6417 
6418 		s_extra = (struct sctp_extrcvinfo *)sinfo;
6419 		s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
6420 	}
6421 	if (hold_rlock == 1) {
6422 		SCTP_INP_READ_UNLOCK(inp);
6423 	}
6424 	if (hold_sblock) {
6425 		SOCKBUF_UNLOCK(&so->so_rcv);
6426 	}
6427 	if (sockbuf_lock) {
6428 		SOCK_IO_RECV_UNLOCK(so);
6429 	}
6430 
6431 	if (freecnt_applied) {
6432 		/*
6433 		 * The lock on the socket buffer protects us so the free
6434 		 * code will stop. But since we used the socketbuf lock and
6435 		 * the sender uses the tcb_lock to increment, we need to use
6436 		 * the atomic add to the refcnt.
6437 		 */
6438 		if (stcb == NULL) {
6439 #ifdef INVARIANTS
6440 			panic("stcb for refcnt has gone NULL?");
6441 			goto stage_left;
6442 #else
6443 			goto stage_left;
6444 #endif
6445 		}
6446 		/* Save the value back for next time */
6447 		stcb->freed_by_sorcv_sincelast = freed_so_far;
6448 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
6449 	}
6450 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6451 		if (stcb) {
6452 			sctp_misc_ints(SCTP_SORECV_DONE,
6453 			    freed_so_far,
6454 			    (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6455 			    stcb->asoc.my_rwnd,
6456 			    so->so_rcv.sb_cc);
6457 		} else {
6458 			sctp_misc_ints(SCTP_SORECV_DONE,
6459 			    freed_so_far,
6460 			    (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6461 			    0,
6462 			    so->so_rcv.sb_cc);
6463 		}
6464 	}
6465 stage_left:
6466 	if (wakeup_read_socket) {
6467 		sctp_sorwakeup(inp, so);
6468 	}
6469 	return (error);
6470 }
6471 
6472 #ifdef SCTP_MBUF_LOGGING
6473 struct mbuf *
6474 sctp_m_free(struct mbuf *m)
6475 {
6476 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6477 		sctp_log_mb(m, SCTP_MBUF_IFREE);
6478 	}
6479 	return (m_free(m));
6480 }
6481 
6482 void
6483 sctp_m_freem(struct mbuf *mb)
6484 {
6485 	while (mb != NULL)
6486 		mb = sctp_m_free(mb);
6487 }
6488 
6489 #endif
6490 
6491 int
6492 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6493 {
6494 	/*
6495 	 * Given a local address. For all associations that holds the
6496 	 * address, request a peer-set-primary.
6497 	 */
6498 	struct sctp_ifa *ifa;
6499 	struct sctp_laddr *wi;
6500 
6501 	ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
6502 	if (ifa == NULL) {
6503 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6504 		return (EADDRNOTAVAIL);
6505 	}
6506 	/*
6507 	 * Now that we have the ifa we must awaken the iterator with this
6508 	 * message.
6509 	 */
6510 	wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6511 	if (wi == NULL) {
6512 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6513 		return (ENOMEM);
6514 	}
6515 	/* Now incr the count and int wi structure */
6516 	SCTP_INCR_LADDR_COUNT();
6517 	memset(wi, 0, sizeof(*wi));
6518 	(void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6519 	wi->ifa = ifa;
6520 	wi->action = SCTP_SET_PRIM_ADDR;
6521 	atomic_add_int(&ifa->refcount, 1);
6522 
6523 	/* Now add it to the work queue */
6524 	SCTP_WQ_ADDR_LOCK();
6525 	/*
6526 	 * Should this really be a tailq? As it is we will process the
6527 	 * newest first :-0
6528 	 */
6529 	LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6530 	sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6531 	    (struct sctp_inpcb *)NULL,
6532 	    (struct sctp_tcb *)NULL,
6533 	    (struct sctp_nets *)NULL);
6534 	SCTP_WQ_ADDR_UNLOCK();
6535 	return (0);
6536 }
6537 
6538 int
6539 sctp_soreceive(struct socket *so,
6540     struct sockaddr **psa,
6541     struct uio *uio,
6542     struct mbuf **mp0,
6543     struct mbuf **controlp,
6544     int *flagsp)
6545 {
6546 	int error, fromlen;
6547 	uint8_t sockbuf[256];
6548 	struct sockaddr *from;
6549 	struct sctp_extrcvinfo sinfo;
6550 	int filling_sinfo = 1;
6551 	int flags;
6552 	struct sctp_inpcb *inp;
6553 
6554 	inp = (struct sctp_inpcb *)so->so_pcb;
6555 	/* pickup the assoc we are reading from */
6556 	if (inp == NULL) {
6557 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6558 		return (EINVAL);
6559 	}
6560 	if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6561 	    sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6562 	    sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6563 	    (controlp == NULL)) {
6564 		/* user does not want the sndrcv ctl */
6565 		filling_sinfo = 0;
6566 	}
6567 	if (psa) {
6568 		from = (struct sockaddr *)sockbuf;
6569 		fromlen = sizeof(sockbuf);
6570 		from->sa_len = 0;
6571 	} else {
6572 		from = NULL;
6573 		fromlen = 0;
6574 	}
6575 
6576 	if (filling_sinfo) {
6577 		memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6578 	}
6579 	if (flagsp != NULL) {
6580 		flags = *flagsp;
6581 	} else {
6582 		flags = 0;
6583 	}
6584 	error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, &flags,
6585 	    (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6586 	if (flagsp != NULL) {
6587 		*flagsp = flags;
6588 	}
6589 	if (controlp != NULL) {
6590 		/* copy back the sinfo in a CMSG format */
6591 		if (filling_sinfo && ((flags & MSG_NOTIFICATION) == 0)) {
6592 			*controlp = sctp_build_ctl_nchunk(inp,
6593 			    (struct sctp_sndrcvinfo *)&sinfo);
6594 		} else {
6595 			*controlp = NULL;
6596 		}
6597 	}
6598 	if (psa) {
6599 		/* copy back the address info */
6600 		if (from && from->sa_len) {
6601 			*psa = sodupsockaddr(from, M_NOWAIT);
6602 		} else {
6603 			*psa = NULL;
6604 		}
6605 	}
6606 	return (error);
6607 }
6608 
6609 int
6610 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6611     int totaddr, int *error)
6612 {
6613 	int added = 0;
6614 	int i;
6615 	struct sctp_inpcb *inp;
6616 	struct sockaddr *sa;
6617 	size_t incr = 0;
6618 #ifdef INET
6619 	struct sockaddr_in *sin;
6620 #endif
6621 #ifdef INET6
6622 	struct sockaddr_in6 *sin6;
6623 #endif
6624 
6625 	sa = addr;
6626 	inp = stcb->sctp_ep;
6627 	*error = 0;
6628 	for (i = 0; i < totaddr; i++) {
6629 		switch (sa->sa_family) {
6630 #ifdef INET
6631 		case AF_INET:
6632 			incr = sizeof(struct sockaddr_in);
6633 			sin = (struct sockaddr_in *)sa;
6634 			if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6635 			    (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6636 			    IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6637 				SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6638 				(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6639 				    SCTP_FROM_SCTPUTIL + SCTP_LOC_7);
6640 				*error = EINVAL;
6641 				goto out_now;
6642 			}
6643 			if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6644 			    SCTP_DONOT_SETSCOPE,
6645 			    SCTP_ADDR_IS_CONFIRMED)) {
6646 				/* assoc gone no un-lock */
6647 				SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6648 				(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6649 				    SCTP_FROM_SCTPUTIL + SCTP_LOC_8);
6650 				*error = ENOBUFS;
6651 				goto out_now;
6652 			}
6653 			added++;
6654 			break;
6655 #endif
6656 #ifdef INET6
6657 		case AF_INET6:
6658 			incr = sizeof(struct sockaddr_in6);
6659 			sin6 = (struct sockaddr_in6 *)sa;
6660 			if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6661 			    IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6662 				SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6663 				(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6664 				    SCTP_FROM_SCTPUTIL + SCTP_LOC_9);
6665 				*error = EINVAL;
6666 				goto out_now;
6667 			}
6668 			if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6669 			    SCTP_DONOT_SETSCOPE,
6670 			    SCTP_ADDR_IS_CONFIRMED)) {
6671 				/* assoc gone no un-lock */
6672 				SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6673 				(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6674 				    SCTP_FROM_SCTPUTIL + SCTP_LOC_10);
6675 				*error = ENOBUFS;
6676 				goto out_now;
6677 			}
6678 			added++;
6679 			break;
6680 #endif
6681 		default:
6682 			break;
6683 		}
6684 		sa = (struct sockaddr *)((caddr_t)sa + incr);
6685 	}
6686 out_now:
6687 	return (added);
6688 }
6689 
6690 int
6691 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6692     unsigned int totaddr,
6693     unsigned int *num_v4, unsigned int *num_v6,
6694     unsigned int limit)
6695 {
6696 	struct sockaddr *sa;
6697 	struct sctp_tcb *stcb;
6698 	unsigned int incr, at, i;
6699 
6700 	at = 0;
6701 	sa = addr;
6702 	*num_v6 = *num_v4 = 0;
6703 	/* account and validate addresses */
6704 	if (totaddr == 0) {
6705 		return (EINVAL);
6706 	}
6707 	for (i = 0; i < totaddr; i++) {
6708 		if (at + sizeof(struct sockaddr) > limit) {
6709 			return (EINVAL);
6710 		}
6711 		switch (sa->sa_family) {
6712 #ifdef INET
6713 		case AF_INET:
6714 			incr = (unsigned int)sizeof(struct sockaddr_in);
6715 			if (sa->sa_len != incr) {
6716 				return (EINVAL);
6717 			}
6718 			(*num_v4) += 1;
6719 			break;
6720 #endif
6721 #ifdef INET6
6722 		case AF_INET6:
6723 			{
6724 				struct sockaddr_in6 *sin6;
6725 
6726 				incr = (unsigned int)sizeof(struct sockaddr_in6);
6727 				if (sa->sa_len != incr) {
6728 					return (EINVAL);
6729 				}
6730 				sin6 = (struct sockaddr_in6 *)sa;
6731 				if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6732 					/* Must be non-mapped for connectx */
6733 					return (EINVAL);
6734 				}
6735 				(*num_v6) += 1;
6736 				break;
6737 			}
6738 #endif
6739 		default:
6740 			return (EINVAL);
6741 		}
6742 		if ((at + incr) > limit) {
6743 			return (EINVAL);
6744 		}
6745 		SCTP_INP_INCR_REF(inp);
6746 		stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6747 		if (stcb != NULL) {
6748 			SCTP_TCB_UNLOCK(stcb);
6749 			return (EALREADY);
6750 		} else {
6751 			SCTP_INP_DECR_REF(inp);
6752 		}
6753 		at += incr;
6754 		sa = (struct sockaddr *)((caddr_t)sa + incr);
6755 	}
6756 	return (0);
6757 }
6758 
6759 /*
6760  * sctp_bindx(ADD) for one address.
6761  * assumes all arguments are valid/checked by caller.
6762  */
6763 void
6764 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6765     struct sockaddr *sa, uint32_t vrf_id, int *error,
6766     void *p)
6767 {
6768 #if defined(INET) && defined(INET6)
6769 	struct sockaddr_in sin;
6770 #endif
6771 #ifdef INET6
6772 	struct sockaddr_in6 *sin6;
6773 #endif
6774 #ifdef INET
6775 	struct sockaddr_in *sinp;
6776 #endif
6777 	struct sockaddr *addr_to_use;
6778 	struct sctp_inpcb *lep;
6779 	uint16_t port;
6780 
6781 	/* see if we're bound all already! */
6782 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6783 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6784 		*error = EINVAL;
6785 		return;
6786 	}
6787 	switch (sa->sa_family) {
6788 #ifdef INET6
6789 	case AF_INET6:
6790 		if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6791 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6792 			*error = EINVAL;
6793 			return;
6794 		}
6795 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6796 			/* can only bind v6 on PF_INET6 sockets */
6797 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6798 			*error = EINVAL;
6799 			return;
6800 		}
6801 		sin6 = (struct sockaddr_in6 *)sa;
6802 		port = sin6->sin6_port;
6803 #ifdef INET
6804 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6805 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6806 			    SCTP_IPV6_V6ONLY(inp)) {
6807 				/* can't bind v4-mapped on PF_INET sockets */
6808 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6809 				*error = EINVAL;
6810 				return;
6811 			}
6812 			in6_sin6_2_sin(&sin, sin6);
6813 			addr_to_use = (struct sockaddr *)&sin;
6814 		} else {
6815 			addr_to_use = sa;
6816 		}
6817 #else
6818 		addr_to_use = sa;
6819 #endif
6820 		break;
6821 #endif
6822 #ifdef INET
6823 	case AF_INET:
6824 		if (sa->sa_len != sizeof(struct sockaddr_in)) {
6825 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6826 			*error = EINVAL;
6827 			return;
6828 		}
6829 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6830 		    SCTP_IPV6_V6ONLY(inp)) {
6831 			/* can't bind v4 on PF_INET sockets */
6832 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6833 			*error = EINVAL;
6834 			return;
6835 		}
6836 		sinp = (struct sockaddr_in *)sa;
6837 		port = sinp->sin_port;
6838 		addr_to_use = sa;
6839 		break;
6840 #endif
6841 	default:
6842 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6843 		*error = EINVAL;
6844 		return;
6845 	}
6846 	if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6847 		if (p == NULL) {
6848 			/* Can't get proc for Net/Open BSD */
6849 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6850 			*error = EINVAL;
6851 			return;
6852 		}
6853 		*error = sctp_inpcb_bind(so, addr_to_use, NULL, p);
6854 		return;
6855 	}
6856 	/* Validate the incoming port. */
6857 	if ((port != 0) && (port != inp->sctp_lport)) {
6858 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6859 		*error = EINVAL;
6860 		return;
6861 	}
6862 	lep = sctp_pcb_findep(addr_to_use, 1, 0, vrf_id);
6863 	if (lep == NULL) {
6864 		/* add the address */
6865 		*error = sctp_addr_mgmt_ep_sa(inp, addr_to_use,
6866 		    SCTP_ADD_IP_ADDRESS, vrf_id);
6867 	} else {
6868 		if (lep != inp) {
6869 			*error = EADDRINUSE;
6870 		}
6871 		SCTP_INP_DECR_REF(lep);
6872 	}
6873 }
6874 
6875 /*
6876  * sctp_bindx(DELETE) for one address.
6877  * assumes all arguments are valid/checked by caller.
6878  */
6879 void
6880 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6881     struct sockaddr *sa, uint32_t vrf_id, int *error)
6882 {
6883 	struct sockaddr *addr_to_use;
6884 #if defined(INET) && defined(INET6)
6885 	struct sockaddr_in6 *sin6;
6886 	struct sockaddr_in sin;
6887 #endif
6888 
6889 	/* see if we're bound all already! */
6890 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6891 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6892 		*error = EINVAL;
6893 		return;
6894 	}
6895 	switch (sa->sa_family) {
6896 #ifdef INET6
6897 	case AF_INET6:
6898 		if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6899 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6900 			*error = EINVAL;
6901 			return;
6902 		}
6903 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6904 			/* can only bind v6 on PF_INET6 sockets */
6905 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6906 			*error = EINVAL;
6907 			return;
6908 		}
6909 #ifdef INET
6910 		sin6 = (struct sockaddr_in6 *)sa;
6911 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6912 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6913 			    SCTP_IPV6_V6ONLY(inp)) {
6914 				/* can't bind mapped-v4 on PF_INET sockets */
6915 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6916 				*error = EINVAL;
6917 				return;
6918 			}
6919 			in6_sin6_2_sin(&sin, sin6);
6920 			addr_to_use = (struct sockaddr *)&sin;
6921 		} else {
6922 			addr_to_use = sa;
6923 		}
6924 #else
6925 		addr_to_use = sa;
6926 #endif
6927 		break;
6928 #endif
6929 #ifdef INET
6930 	case AF_INET:
6931 		if (sa->sa_len != sizeof(struct sockaddr_in)) {
6932 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6933 			*error = EINVAL;
6934 			return;
6935 		}
6936 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6937 		    SCTP_IPV6_V6ONLY(inp)) {
6938 			/* can't bind v4 on PF_INET sockets */
6939 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6940 			*error = EINVAL;
6941 			return;
6942 		}
6943 		addr_to_use = sa;
6944 		break;
6945 #endif
6946 	default:
6947 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6948 		*error = EINVAL;
6949 		return;
6950 	}
6951 	/* No lock required mgmt_ep_sa does its own locking. */
6952 	*error = sctp_addr_mgmt_ep_sa(inp, addr_to_use, SCTP_DEL_IP_ADDRESS,
6953 	    vrf_id);
6954 }
6955 
6956 /*
6957  * returns the valid local address count for an assoc, taking into account
6958  * all scoping rules
6959  */
6960 int
6961 sctp_local_addr_count(struct sctp_tcb *stcb)
6962 {
6963 	int loopback_scope;
6964 #if defined(INET)
6965 	int ipv4_local_scope, ipv4_addr_legal;
6966 #endif
6967 #if defined(INET6)
6968 	int local_scope, site_scope, ipv6_addr_legal;
6969 #endif
6970 	struct sctp_vrf *vrf;
6971 	struct sctp_ifn *sctp_ifn;
6972 	struct sctp_ifa *sctp_ifa;
6973 	int count = 0;
6974 
6975 	/* Turn on all the appropriate scopes */
6976 	loopback_scope = stcb->asoc.scope.loopback_scope;
6977 #if defined(INET)
6978 	ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6979 	ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6980 #endif
6981 #if defined(INET6)
6982 	local_scope = stcb->asoc.scope.local_scope;
6983 	site_scope = stcb->asoc.scope.site_scope;
6984 	ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6985 #endif
6986 	SCTP_IPI_ADDR_RLOCK();
6987 	vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6988 	if (vrf == NULL) {
6989 		/* no vrf, no addresses */
6990 		SCTP_IPI_ADDR_RUNLOCK();
6991 		return (0);
6992 	}
6993 
6994 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6995 		/*
6996 		 * bound all case: go through all ifns on the vrf
6997 		 */
6998 		LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6999 			if ((loopback_scope == 0) &&
7000 			    SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
7001 				continue;
7002 			}
7003 			LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
7004 				if (sctp_is_addr_restricted(stcb, sctp_ifa))
7005 					continue;
7006 				switch (sctp_ifa->address.sa.sa_family) {
7007 #ifdef INET
7008 				case AF_INET:
7009 					if (ipv4_addr_legal) {
7010 						struct sockaddr_in *sin;
7011 
7012 						sin = &sctp_ifa->address.sin;
7013 						if (sin->sin_addr.s_addr == 0) {
7014 							/*
7015 							 * skip unspecified
7016 							 * addrs
7017 							 */
7018 							continue;
7019 						}
7020 						if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
7021 						    &sin->sin_addr) != 0) {
7022 							continue;
7023 						}
7024 						if ((ipv4_local_scope == 0) &&
7025 						    (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
7026 							continue;
7027 						}
7028 						/* count this one */
7029 						count++;
7030 					} else {
7031 						continue;
7032 					}
7033 					break;
7034 #endif
7035 #ifdef INET6
7036 				case AF_INET6:
7037 					if (ipv6_addr_legal) {
7038 						struct sockaddr_in6 *sin6;
7039 
7040 						sin6 = &sctp_ifa->address.sin6;
7041 						if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
7042 							continue;
7043 						}
7044 						if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
7045 						    &sin6->sin6_addr) != 0) {
7046 							continue;
7047 						}
7048 						if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
7049 							if (local_scope == 0)
7050 								continue;
7051 							if (sin6->sin6_scope_id == 0) {
7052 								if (sa6_recoverscope(sin6) != 0)
7053 									/*
7054 									 *
7055 									 * bad
7056 									 * link
7057 									 *
7058 									 * local
7059 									 *
7060 									 * address
7061 									 */
7062 									continue;
7063 							}
7064 						}
7065 						if ((site_scope == 0) &&
7066 						    (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
7067 							continue;
7068 						}
7069 						/* count this one */
7070 						count++;
7071 					}
7072 					break;
7073 #endif
7074 				default:
7075 					/* TSNH */
7076 					break;
7077 				}
7078 			}
7079 		}
7080 	} else {
7081 		/*
7082 		 * subset bound case
7083 		 */
7084 		struct sctp_laddr *laddr;
7085 
7086 		LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
7087 		    sctp_nxt_addr) {
7088 			if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
7089 				continue;
7090 			}
7091 			/* count this one */
7092 			count++;
7093 		}
7094 	}
7095 	SCTP_IPI_ADDR_RUNLOCK();
7096 	return (count);
7097 }
7098 
7099 #if defined(SCTP_LOCAL_TRACE_BUF)
7100 
7101 void
7102 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
7103 {
7104 	uint32_t saveindex, newindex;
7105 
7106 	do {
7107 		saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
7108 		if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
7109 			newindex = 1;
7110 		} else {
7111 			newindex = saveindex + 1;
7112 		}
7113 	} while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
7114 	if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
7115 		saveindex = 0;
7116 	}
7117 	SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
7118 	SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
7119 	SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
7120 	SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
7121 	SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
7122 	SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
7123 	SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
7124 	SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
7125 }
7126 
7127 #endif
7128 static void
7129 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,
7130     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
7131 {
7132 	struct ip *iph;
7133 #ifdef INET6
7134 	struct ip6_hdr *ip6;
7135 #endif
7136 	struct mbuf *sp, *last;
7137 	struct udphdr *uhdr;
7138 	uint16_t port;
7139 
7140 	if ((m->m_flags & M_PKTHDR) == 0) {
7141 		/* Can't handle one that is not a pkt hdr */
7142 		goto out;
7143 	}
7144 	/* Pull the src port */
7145 	iph = mtod(m, struct ip *);
7146 	uhdr = (struct udphdr *)((caddr_t)iph + off);
7147 	port = uhdr->uh_sport;
7148 	/*
7149 	 * Split out the mbuf chain. Leave the IP header in m, place the
7150 	 * rest in the sp.
7151 	 */
7152 	sp = m_split(m, off, M_NOWAIT);
7153 	if (sp == NULL) {
7154 		/* Gak, drop packet, we can't do a split */
7155 		goto out;
7156 	}
7157 	if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
7158 		/* Gak, packet can't have an SCTP header in it - too small */
7159 		m_freem(sp);
7160 		goto out;
7161 	}
7162 	/* Now pull up the UDP header and SCTP header together */
7163 	sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
7164 	if (sp == NULL) {
7165 		/* Gak pullup failed */
7166 		goto out;
7167 	}
7168 	/* Trim out the UDP header */
7169 	m_adj(sp, sizeof(struct udphdr));
7170 
7171 	/* Now reconstruct the mbuf chain */
7172 	for (last = m; last->m_next; last = last->m_next);
7173 	last->m_next = sp;
7174 	m->m_pkthdr.len += sp->m_pkthdr.len;
7175 	/*
7176 	 * The CSUM_DATA_VALID flags indicates that the HW checked the UDP
7177 	 * checksum and it was valid. Since CSUM_DATA_VALID ==
7178 	 * CSUM_SCTP_VALID this would imply that the HW also verified the
7179 	 * SCTP checksum. Therefore, clear the bit.
7180 	 */
7181 	SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
7182 	    "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n",
7183 	    m->m_pkthdr.len,
7184 	    if_name(m->m_pkthdr.rcvif),
7185 	    (int)m->m_pkthdr.csum_flags, CSUM_BITS);
7186 	m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
7187 	iph = mtod(m, struct ip *);
7188 	switch (iph->ip_v) {
7189 #ifdef INET
7190 	case IPVERSION:
7191 		iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
7192 		sctp_input_with_port(m, off, port);
7193 		break;
7194 #endif
7195 #ifdef INET6
7196 	case IPV6_VERSION >> 4:
7197 		ip6 = mtod(m, struct ip6_hdr *);
7198 		ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
7199 		sctp6_input_with_port(&m, &off, port);
7200 		break;
7201 #endif
7202 	default:
7203 		goto out;
7204 		break;
7205 	}
7206 	return;
7207 out:
7208 	m_freem(m);
7209 }
7210 
7211 #ifdef INET
7212 static void
7213 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED)
7214 {
7215 	struct ip *outer_ip, *inner_ip;
7216 	struct sctphdr *sh;
7217 	struct icmp *icmp;
7218 	struct udphdr *udp;
7219 	struct sctp_inpcb *inp;
7220 	struct sctp_tcb *stcb;
7221 	struct sctp_nets *net;
7222 	struct sctp_init_chunk *ch;
7223 	struct sockaddr_in src, dst;
7224 	uint8_t type, code;
7225 
7226 	inner_ip = (struct ip *)vip;
7227 	icmp = (struct icmp *)((caddr_t)inner_ip -
7228 	    (sizeof(struct icmp) - sizeof(struct ip)));
7229 	outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
7230 	if (ntohs(outer_ip->ip_len) <
7231 	    sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) {
7232 		return;
7233 	}
7234 	udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
7235 	sh = (struct sctphdr *)(udp + 1);
7236 	memset(&src, 0, sizeof(struct sockaddr_in));
7237 	src.sin_family = AF_INET;
7238 	src.sin_len = sizeof(struct sockaddr_in);
7239 	src.sin_port = sh->src_port;
7240 	src.sin_addr = inner_ip->ip_src;
7241 	memset(&dst, 0, sizeof(struct sockaddr_in));
7242 	dst.sin_family = AF_INET;
7243 	dst.sin_len = sizeof(struct sockaddr_in);
7244 	dst.sin_port = sh->dest_port;
7245 	dst.sin_addr = inner_ip->ip_dst;
7246 	/*
7247 	 * 'dst' holds the dest of the packet that failed to be sent. 'src'
7248 	 * holds our local endpoint address. Thus we reverse the dst and the
7249 	 * src in the lookup.
7250 	 */
7251 	inp = NULL;
7252 	net = NULL;
7253 	stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7254 	    (struct sockaddr *)&src,
7255 	    &inp, &net, 1,
7256 	    SCTP_DEFAULT_VRFID);
7257 	if ((stcb != NULL) &&
7258 	    (net != NULL) &&
7259 	    (inp != NULL)) {
7260 		/* Check the UDP port numbers */
7261 		if ((udp->uh_dport != net->port) ||
7262 		    (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7263 			SCTP_TCB_UNLOCK(stcb);
7264 			return;
7265 		}
7266 		/* Check the verification tag */
7267 		if (ntohl(sh->v_tag) != 0) {
7268 			/*
7269 			 * This must be the verification tag used for
7270 			 * sending out packets. We don't consider packets
7271 			 * reflecting the verification tag.
7272 			 */
7273 			if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) {
7274 				SCTP_TCB_UNLOCK(stcb);
7275 				return;
7276 			}
7277 		} else {
7278 			if (ntohs(outer_ip->ip_len) >=
7279 			    sizeof(struct ip) +
7280 			    8 + (inner_ip->ip_hl << 2) + 8 + 20) {
7281 				/*
7282 				 * In this case we can check if we got an
7283 				 * INIT chunk and if the initiate tag
7284 				 * matches.
7285 				 */
7286 				ch = (struct sctp_init_chunk *)(sh + 1);
7287 				if ((ch->ch.chunk_type != SCTP_INITIATION) ||
7288 				    (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) {
7289 					SCTP_TCB_UNLOCK(stcb);
7290 					return;
7291 				}
7292 			} else {
7293 				SCTP_TCB_UNLOCK(stcb);
7294 				return;
7295 			}
7296 		}
7297 		type = icmp->icmp_type;
7298 		code = icmp->icmp_code;
7299 		if ((type == ICMP_UNREACH) &&
7300 		    (code == ICMP_UNREACH_PORT)) {
7301 			code = ICMP_UNREACH_PROTOCOL;
7302 		}
7303 		sctp_notify(inp, stcb, net, type, code,
7304 		    ntohs(inner_ip->ip_len),
7305 		    (uint32_t)ntohs(icmp->icmp_nextmtu));
7306 	} else {
7307 		if ((stcb == NULL) && (inp != NULL)) {
7308 			/* reduce ref-count */
7309 			SCTP_INP_WLOCK(inp);
7310 			SCTP_INP_DECR_REF(inp);
7311 			SCTP_INP_WUNLOCK(inp);
7312 		}
7313 		if (stcb) {
7314 			SCTP_TCB_UNLOCK(stcb);
7315 		}
7316 	}
7317 	return;
7318 }
7319 #endif
7320 
7321 #ifdef INET6
7322 static void
7323 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED)
7324 {
7325 	struct ip6ctlparam *ip6cp;
7326 	struct sctp_inpcb *inp;
7327 	struct sctp_tcb *stcb;
7328 	struct sctp_nets *net;
7329 	struct sctphdr sh;
7330 	struct udphdr udp;
7331 	struct sockaddr_in6 src, dst;
7332 	uint8_t type, code;
7333 
7334 	ip6cp = (struct ip6ctlparam *)d;
7335 	/*
7336 	 * XXX: We assume that when IPV6 is non NULL, M and OFF are valid.
7337 	 */
7338 	if (ip6cp->ip6c_m == NULL) {
7339 		return;
7340 	}
7341 	/*
7342 	 * Check if we can safely examine the ports and the verification tag
7343 	 * of the SCTP common header.
7344 	 */
7345 	if (ip6cp->ip6c_m->m_pkthdr.len <
7346 	    ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) {
7347 		return;
7348 	}
7349 	/* Copy out the UDP header. */
7350 	memset(&udp, 0, sizeof(struct udphdr));
7351 	m_copydata(ip6cp->ip6c_m,
7352 	    ip6cp->ip6c_off,
7353 	    sizeof(struct udphdr),
7354 	    (caddr_t)&udp);
7355 	/* Copy out the port numbers and the verification tag. */
7356 	memset(&sh, 0, sizeof(struct sctphdr));
7357 	m_copydata(ip6cp->ip6c_m,
7358 	    ip6cp->ip6c_off + sizeof(struct udphdr),
7359 	    sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t),
7360 	    (caddr_t)&sh);
7361 	memset(&src, 0, sizeof(struct sockaddr_in6));
7362 	src.sin6_family = AF_INET6;
7363 	src.sin6_len = sizeof(struct sockaddr_in6);
7364 	src.sin6_port = sh.src_port;
7365 	src.sin6_addr = ip6cp->ip6c_ip6->ip6_src;
7366 	if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7367 		return;
7368 	}
7369 	memset(&dst, 0, sizeof(struct sockaddr_in6));
7370 	dst.sin6_family = AF_INET6;
7371 	dst.sin6_len = sizeof(struct sockaddr_in6);
7372 	dst.sin6_port = sh.dest_port;
7373 	dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst;
7374 	if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7375 		return;
7376 	}
7377 	inp = NULL;
7378 	net = NULL;
7379 	stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7380 	    (struct sockaddr *)&src,
7381 	    &inp, &net, 1, SCTP_DEFAULT_VRFID);
7382 	if ((stcb != NULL) &&
7383 	    (net != NULL) &&
7384 	    (inp != NULL)) {
7385 		/* Check the UDP port numbers */
7386 		if ((udp.uh_dport != net->port) ||
7387 		    (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7388 			SCTP_TCB_UNLOCK(stcb);
7389 			return;
7390 		}
7391 		/* Check the verification tag */
7392 		if (ntohl(sh.v_tag) != 0) {
7393 			/*
7394 			 * This must be the verification tag used for
7395 			 * sending out packets. We don't consider packets
7396 			 * reflecting the verification tag.
7397 			 */
7398 			if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) {
7399 				SCTP_TCB_UNLOCK(stcb);
7400 				return;
7401 			}
7402 		} else {
7403 			if (ip6cp->ip6c_m->m_pkthdr.len >=
7404 			    ip6cp->ip6c_off + sizeof(struct udphdr) +
7405 			    sizeof(struct sctphdr) +
7406 			    sizeof(struct sctp_chunkhdr) +
7407 			    offsetof(struct sctp_init, a_rwnd)) {
7408 				/*
7409 				 * In this case we can check if we got an
7410 				 * INIT chunk and if the initiate tag
7411 				 * matches.
7412 				 */
7413 				uint32_t initiate_tag;
7414 				uint8_t chunk_type;
7415 
7416 				m_copydata(ip6cp->ip6c_m,
7417 				    ip6cp->ip6c_off +
7418 				    sizeof(struct udphdr) +
7419 				    sizeof(struct sctphdr),
7420 				    sizeof(uint8_t),
7421 				    (caddr_t)&chunk_type);
7422 				m_copydata(ip6cp->ip6c_m,
7423 				    ip6cp->ip6c_off +
7424 				    sizeof(struct udphdr) +
7425 				    sizeof(struct sctphdr) +
7426 				    sizeof(struct sctp_chunkhdr),
7427 				    sizeof(uint32_t),
7428 				    (caddr_t)&initiate_tag);
7429 				if ((chunk_type != SCTP_INITIATION) ||
7430 				    (ntohl(initiate_tag) != stcb->asoc.my_vtag)) {
7431 					SCTP_TCB_UNLOCK(stcb);
7432 					return;
7433 				}
7434 			} else {
7435 				SCTP_TCB_UNLOCK(stcb);
7436 				return;
7437 			}
7438 		}
7439 		type = ip6cp->ip6c_icmp6->icmp6_type;
7440 		code = ip6cp->ip6c_icmp6->icmp6_code;
7441 		if ((type == ICMP6_DST_UNREACH) &&
7442 		    (code == ICMP6_DST_UNREACH_NOPORT)) {
7443 			type = ICMP6_PARAM_PROB;
7444 			code = ICMP6_PARAMPROB_NEXTHEADER;
7445 		}
7446 		sctp6_notify(inp, stcb, net, type, code,
7447 		    ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
7448 	} else {
7449 		if ((stcb == NULL) && (inp != NULL)) {
7450 			/* reduce inp's ref-count */
7451 			SCTP_INP_WLOCK(inp);
7452 			SCTP_INP_DECR_REF(inp);
7453 			SCTP_INP_WUNLOCK(inp);
7454 		}
7455 		if (stcb) {
7456 			SCTP_TCB_UNLOCK(stcb);
7457 		}
7458 	}
7459 }
7460 #endif
7461 
7462 void
7463 sctp_over_udp_stop(void)
7464 {
7465 	/*
7466 	 * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7467 	 * for writing!
7468 	 */
7469 #ifdef INET
7470 	if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7471 		soclose(SCTP_BASE_INFO(udp4_tun_socket));
7472 		SCTP_BASE_INFO(udp4_tun_socket) = NULL;
7473 	}
7474 #endif
7475 #ifdef INET6
7476 	if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7477 		soclose(SCTP_BASE_INFO(udp6_tun_socket));
7478 		SCTP_BASE_INFO(udp6_tun_socket) = NULL;
7479 	}
7480 #endif
7481 }
7482 
7483 int
7484 sctp_over_udp_start(void)
7485 {
7486 	uint16_t port;
7487 	int ret;
7488 #ifdef INET
7489 	struct sockaddr_in sin;
7490 #endif
7491 #ifdef INET6
7492 	struct sockaddr_in6 sin6;
7493 #endif
7494 	/*
7495 	 * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7496 	 * for writing!
7497 	 */
7498 	port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
7499 	if (ntohs(port) == 0) {
7500 		/* Must have a port set */
7501 		return (EINVAL);
7502 	}
7503 #ifdef INET
7504 	if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7505 		/* Already running -- must stop first */
7506 		return (EALREADY);
7507 	}
7508 #endif
7509 #ifdef INET6
7510 	if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7511 		/* Already running -- must stop first */
7512 		return (EALREADY);
7513 	}
7514 #endif
7515 #ifdef INET
7516 	if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
7517 	    SOCK_DGRAM, IPPROTO_UDP,
7518 	    curthread->td_ucred, curthread))) {
7519 		sctp_over_udp_stop();
7520 		return (ret);
7521 	}
7522 	/* Call the special UDP hook. */
7523 	if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
7524 	    sctp_recv_udp_tunneled_packet,
7525 	    sctp_recv_icmp_tunneled_packet,
7526 	    NULL))) {
7527 		sctp_over_udp_stop();
7528 		return (ret);
7529 	}
7530 	/* Ok, we have a socket, bind it to the port. */
7531 	memset(&sin, 0, sizeof(struct sockaddr_in));
7532 	sin.sin_len = sizeof(struct sockaddr_in);
7533 	sin.sin_family = AF_INET;
7534 	sin.sin_port = htons(port);
7535 	if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7536 	    (struct sockaddr *)&sin, curthread))) {
7537 		sctp_over_udp_stop();
7538 		return (ret);
7539 	}
7540 #endif
7541 #ifdef INET6
7542 	if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7543 	    SOCK_DGRAM, IPPROTO_UDP,
7544 	    curthread->td_ucred, curthread))) {
7545 		sctp_over_udp_stop();
7546 		return (ret);
7547 	}
7548 	/* Call the special UDP hook. */
7549 	if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7550 	    sctp_recv_udp_tunneled_packet,
7551 	    sctp_recv_icmp6_tunneled_packet,
7552 	    NULL))) {
7553 		sctp_over_udp_stop();
7554 		return (ret);
7555 	}
7556 	/* Ok, we have a socket, bind it to the port. */
7557 	memset(&sin6, 0, sizeof(struct sockaddr_in6));
7558 	sin6.sin6_len = sizeof(struct sockaddr_in6);
7559 	sin6.sin6_family = AF_INET6;
7560 	sin6.sin6_port = htons(port);
7561 	if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7562 	    (struct sockaddr *)&sin6, curthread))) {
7563 		sctp_over_udp_stop();
7564 		return (ret);
7565 	}
7566 #endif
7567 	return (0);
7568 }
7569 
7570 /*
7571  * sctp_min_mtu ()returns the minimum of all non-zero arguments.
7572  * If all arguments are zero, zero is returned.
7573  */
7574 uint32_t
7575 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3)
7576 {
7577 	if (mtu1 > 0) {
7578 		if (mtu2 > 0) {
7579 			if (mtu3 > 0) {
7580 				return (min(mtu1, min(mtu2, mtu3)));
7581 			} else {
7582 				return (min(mtu1, mtu2));
7583 			}
7584 		} else {
7585 			if (mtu3 > 0) {
7586 				return (min(mtu1, mtu3));
7587 			} else {
7588 				return (mtu1);
7589 			}
7590 		}
7591 	} else {
7592 		if (mtu2 > 0) {
7593 			if (mtu3 > 0) {
7594 				return (min(mtu2, mtu3));
7595 			} else {
7596 				return (mtu2);
7597 			}
7598 		} else {
7599 			return (mtu3);
7600 		}
7601 	}
7602 }
7603 
7604 void
7605 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu)
7606 {
7607 	struct in_conninfo inc;
7608 
7609 	memset(&inc, 0, sizeof(struct in_conninfo));
7610 	inc.inc_fibnum = fibnum;
7611 	switch (addr->sa.sa_family) {
7612 #ifdef INET
7613 	case AF_INET:
7614 		inc.inc_faddr = addr->sin.sin_addr;
7615 		break;
7616 #endif
7617 #ifdef INET6
7618 	case AF_INET6:
7619 		inc.inc_flags |= INC_ISIPV6;
7620 		inc.inc6_faddr = addr->sin6.sin6_addr;
7621 		break;
7622 #endif
7623 	default:
7624 		return;
7625 	}
7626 	tcp_hc_updatemtu(&inc, (u_long)mtu);
7627 }
7628 
7629 uint32_t
7630 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum)
7631 {
7632 	struct in_conninfo inc;
7633 
7634 	memset(&inc, 0, sizeof(struct in_conninfo));
7635 	inc.inc_fibnum = fibnum;
7636 	switch (addr->sa.sa_family) {
7637 #ifdef INET
7638 	case AF_INET:
7639 		inc.inc_faddr = addr->sin.sin_addr;
7640 		break;
7641 #endif
7642 #ifdef INET6
7643 	case AF_INET6:
7644 		inc.inc_flags |= INC_ISIPV6;
7645 		inc.inc6_faddr = addr->sin6.sin6_addr;
7646 		break;
7647 #endif
7648 	default:
7649 		return (0);
7650 	}
7651 	return ((uint32_t)tcp_hc_getmtu(&inc));
7652 }
7653 
7654 void
7655 sctp_set_state(struct sctp_tcb *stcb, int new_state)
7656 {
7657 #if defined(KDTRACE_HOOKS)
7658 	int old_state = stcb->asoc.state;
7659 #endif
7660 
7661 	KASSERT((new_state & ~SCTP_STATE_MASK) == 0,
7662 	    ("sctp_set_state: Can't set substate (new_state = %x)",
7663 	    new_state));
7664 	stcb->asoc.state = (stcb->asoc.state & ~SCTP_STATE_MASK) | new_state;
7665 	if ((new_state == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7666 	    (new_state == SCTP_STATE_SHUTDOWN_SENT) ||
7667 	    (new_state == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
7668 		SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING);
7669 	}
7670 #if defined(KDTRACE_HOOKS)
7671 	if (((old_state & SCTP_STATE_MASK) != new_state) &&
7672 	    !(((old_state & SCTP_STATE_MASK) == SCTP_STATE_EMPTY) &&
7673 	    (new_state == SCTP_STATE_INUSE))) {
7674 		SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state);
7675 	}
7676 #endif
7677 }
7678 
7679 void
7680 sctp_add_substate(struct sctp_tcb *stcb, int substate)
7681 {
7682 #if defined(KDTRACE_HOOKS)
7683 	int old_state = stcb->asoc.state;
7684 #endif
7685 
7686 	KASSERT((substate & SCTP_STATE_MASK) == 0,
7687 	    ("sctp_add_substate: Can't set state (substate = %x)",
7688 	    substate));
7689 	stcb->asoc.state |= substate;
7690 #if defined(KDTRACE_HOOKS)
7691 	if (((substate & SCTP_STATE_ABOUT_TO_BE_FREED) &&
7692 	    ((old_state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) ||
7693 	    ((substate & SCTP_STATE_SHUTDOWN_PENDING) &&
7694 	    ((old_state & SCTP_STATE_SHUTDOWN_PENDING) == 0))) {
7695 		SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state);
7696 	}
7697 #endif
7698 }
7699