sys/netinet/sctputil.c

   1 /*      $KAME: sctputil.c,v 1.36 2005/03/06 16:04:19 itojun Exp $       */
   2 /*      $DragonFly: src/sys/netinet/sctputil.c,v 1.9 2008/03/07 11:34:20 sephe Exp $    */
   3
   4 /*
   5  * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. All advertising materials mentioning features or use of this software
  17  *    must display the following acknowledgement:
  18  *      This product includes software developed by Cisco Systems, Inc.
  19  * 4. Neither the name of the project nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY CISCO SYSTEMS AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL CISCO SYSTEMS OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #if !(defined(__OpenBSD__) || defined(__APPLE__))
  37 #include "opt_ipsec.h"
  38 #endif
  39 #if defined(__FreeBSD__) || defined(__DragonFly__)
  40 #include "opt_compat.h"
  41 #include "opt_inet6.h"
  42 #include "opt_inet.h"
  43 #if !(defined(SCTP_BASE_FREEBSD) || defined(__DragonFly__))
  44 #include "opt_mpath.h"
  45 #endif /* SCTP_BASE_FREEBSD || __DragonFly__ */
  46 #endif /* FreeBSD */
  47 #if defined(__NetBSD__)
  48 #include "opt_inet.h"
  49 #endif
  50 #ifdef __APPLE__
  51 #include <sctp.h>
  52 #elif !defined(__OpenBSD__)
  53 #include "opt_sctp.h"
  54 #endif
  55
  56 #include <sys/param.h>
  57 #include <sys/systm.h>
  58 #include <sys/malloc.h>
  59 #include <sys/mbuf.h>
  60 #include <sys/domain.h>
  61 #include <sys/protosw.h>
  62 #include <sys/socket.h>
  63 #include <sys/socketvar.h>
  64 #include <sys/proc.h>
  65 #include <sys/kernel.h>
  66 #include <sys/sysctl.h>
  67 #include <sys/thread2.h>
  68
  69 #if defined(__FreeBSD__) || defined(__DragonFly__)
  70 #include <sys/callout.h>
  71 #else
  72 #include <netinet/sctp_callout.h>       /* for callout_active() */
  73 #endif
  74
  75 #include <net/radix.h>
  76 #include <net/route.h>
  77
  78 #ifdef INET6
  79 #ifndef __OpenBSD__
  80 #include <sys/domain.h>
  81 #endif
  82 #endif
  83
  84 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
  85 #include <sys/limits.h>
  86 #else
  87 #include <machine/limits.h>
  88 #endif
  89
  90 #include <net/if.h>
  91 #include <net/if_types.h>
  92 #include <net/route.h>
  93
  94 #include <netinet/in.h>
  95 #include <netinet/in_systm.h>
  96 #include <netinet/ip.h>
  97 #include <netinet/in_pcb.h>
  98 #include <netinet/in_var.h>
  99 #include <netinet/ip_var.h>
 100
 101 #ifdef INET6
 102 #include <netinet/ip6.h>
 103 #include <netinet6/ip6_var.h>
 104
 105 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__APPLE__) || defined(__DragonFly_)
 106 #include <netinet6/in6_pcb.h>
 107 #elif defined(__OpenBSD__)
 108 #include <netinet/in_pcb.h>
 109 #endif
 110
 111 #endif /* INET6 */
 112
 113 #include <netinet/sctp_pcb.h>
 114
 115 #ifdef IPSEC
 116 #ifndef __OpenBSD__
 117 #include <netinet6/ipsec.h>
 118 #include <netproto/key/key.h>
 119 #else
 120 #undef IPSEC
 121 #endif
 122 #endif /* IPSEC */
 123
 124 #include <netinet/sctputil.h>
 125 #include <netinet/sctp_var.h>
 126 #ifdef INET6
 127 #include <netinet6/sctp6_var.h>
 128 #endif
 129 #include <netinet/sctp_header.h>
 130 #include <netinet/sctp_output.h>
 131 #include <netinet/sctp_hashdriver.h>
 132 #include <netinet/sctp_uio.h>
 133 #include <netinet/sctp_timer.h>
 134 #include <netinet/sctp_crc32.h>
 135 #include <netinet/sctp_indata.h>        /* for sctp_deliver_data() */
 136 #define NUMBER_OF_MTU_SIZES 18
 137
 138 #ifdef SCTP_DEBUG
 139 extern u_int32_t sctp_debug_on;
 140 #endif
 141
 142 #ifdef SCTP_STAT_LOGGING
 143 int sctp_cwnd_log_at=0;
 144 int sctp_cwnd_log_rolled=0;
 145 struct sctp_cwnd_log sctp_clog[SCTP_STAT_LOG_SIZE];
 146
 147 void
 148 sctp_clr_stat_log(void)
 149 {
 150         sctp_cwnd_log_at=0;
 151         sctp_cwnd_log_rolled=0;
 152 }
 153
 154 void
 155 sctp_log_strm_del_alt(u_int32_t tsn, u_int16_t sseq, int from)
 156 {
 157
 158         sctp_clog[sctp_cwnd_log_at].from = (u_int8_t)from;
 159         sctp_clog[sctp_cwnd_log_at].event_type = (u_int8_t)SCTP_LOG_EVENT_STRM;
 160         sctp_clog[sctp_cwnd_log_at].x.strlog.n_tsn = tsn;
 161         sctp_clog[sctp_cwnd_log_at].x.strlog.n_sseq = sseq;
 162         sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = 0;
 163         sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = 0;
 164         sctp_cwnd_log_at++;
 165         if (sctp_cwnd_log_at >= SCTP_STAT_LOG_SIZE) {
 166                 sctp_cwnd_log_at = 0;
 167                 sctp_cwnd_log_rolled = 1;
 168         }
 169
 170
 171 }
 172
 173 void
 174 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 175 {
 176
 177         sctp_clog[sctp_cwnd_log_at].from = (u_int8_t)from;
 178         sctp_clog[sctp_cwnd_log_at].event_type = (u_int8_t)SCTP_LOG_EVENT_MAP;
 179         sctp_clog[sctp_cwnd_log_at].x.map.base = map;
 180         sctp_clog[sctp_cwnd_log_at].x.map.cum = cum;
 181         sctp_clog[sctp_cwnd_log_at].x.map.high = high;
 182         sctp_cwnd_log_at++;
 183         if (sctp_cwnd_log_at >= SCTP_STAT_LOG_SIZE) {
 184                 sctp_cwnd_log_at = 0;
 185                 sctp_cwnd_log_rolled = 1;
 186         }
 187 }
 188
 189 void
 190 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn,
 191     int from)
 192 {
 193
 194         sctp_clog[sctp_cwnd_log_at].from = (u_int8_t)from;
 195         sctp_clog[sctp_cwnd_log_at].event_type = (u_int8_t)SCTP_LOG_EVENT_FR;
 196         sctp_clog[sctp_cwnd_log_at].x.fr.largest_tsn = biggest_tsn;
 197         sctp_clog[sctp_cwnd_log_at].x.fr.largest_new_tsn = biggest_new_tsn;
 198         sctp_clog[sctp_cwnd_log_at].x.fr.tsn = tsn;
 199         sctp_cwnd_log_at++;
 200         if (sctp_cwnd_log_at >= SCTP_STAT_LOG_SIZE) {
 201                 sctp_cwnd_log_at = 0;
 202                 sctp_cwnd_log_rolled = 1;
 203         }
 204 }
 205
 206 void
 207 sctp_log_strm_del(struct sctp_tmit_chunk *chk, struct sctp_tmit_chunk *poschk,
 208     int from)
 209 {
 210
 211         if (chk == NULL) {
 212                 kprintf("Gak log of NULL?\n");
 213                 return;
 214         }
 215         sctp_clog[sctp_cwnd_log_at].from = (u_int8_t)from;
 216         sctp_clog[sctp_cwnd_log_at].event_type = (u_int8_t)SCTP_LOG_EVENT_STRM;
 217         sctp_clog[sctp_cwnd_log_at].x.strlog.n_tsn = chk->rec.data.TSN_seq;
 218         sctp_clog[sctp_cwnd_log_at].x.strlog.n_sseq = chk->rec.data.stream_seq;
 219         if (poschk != NULL) {
 220                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn =
 221                     poschk->rec.data.TSN_seq;
 222                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq =
 223                     poschk->rec.data.stream_seq;
 224         } else {
 225                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = 0;
 226                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = 0;
 227         }
 228         sctp_cwnd_log_at++;
 229         if (sctp_cwnd_log_at >= SCTP_STAT_LOG_SIZE) {
 230                 sctp_cwnd_log_at = 0;
 231                 sctp_cwnd_log_rolled = 1;
 232         }
 233 }
 234
 235 void
 236 sctp_log_cwnd(struct sctp_nets *net, int augment, uint8_t from)
 237 {
 238
 239         sctp_clog[sctp_cwnd_log_at].from = (u_int8_t)from;
 240         sctp_clog[sctp_cwnd_log_at].event_type = (u_int8_t)SCTP_LOG_EVENT_CWND;
 241         sctp_clog[sctp_cwnd_log_at].x.cwnd.net = net;
 242         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_new_value = net->cwnd;
 243         sctp_clog[sctp_cwnd_log_at].x.cwnd.inflight = net->flight_size;
 244         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_augment = augment;
 245         sctp_cwnd_log_at++;
 246         if (sctp_cwnd_log_at >= SCTP_STAT_LOG_SIZE) {
 247                 sctp_cwnd_log_at = 0;
 248                 sctp_cwnd_log_rolled = 1;
 249         }
 250 }
 251
 252 void
 253 sctp_log_maxburst(struct sctp_nets *net, int error, int burst, uint8_t from)
 254 {
 255         sctp_clog[sctp_cwnd_log_at].from = (u_int8_t)from;
 256         sctp_clog[sctp_cwnd_log_at].event_type = (u_int8_t)SCTP_LOG_EVENT_MAXBURST;
 257         sctp_clog[sctp_cwnd_log_at].x.cwnd.net = net;
 258         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_new_value = error;
 259         sctp_clog[sctp_cwnd_log_at].x.cwnd.inflight = net->flight_size;
 260         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_augment = burst;
 261         sctp_cwnd_log_at++;
 262         if (sctp_cwnd_log_at >= SCTP_STAT_LOG_SIZE) {
 263                 sctp_cwnd_log_at = 0;
 264                 sctp_cwnd_log_rolled = 1;
 265         }
 266 }
 267
 268 void
 269 sctp_log_rwnd(uint8_t from, u_int32_t peers_rwnd , u_int32_t snd_size, u_int32_t overhead)
 270 {
 271         sctp_clog[sctp_cwnd_log_at].from = (u_int8_t)from;
 272         sctp_clog[sctp_cwnd_log_at].event_type = (u_int8_t)SCTP_LOG_EVENT_RWND;
 273         sctp_clog[sctp_cwnd_log_at].x.rwnd.rwnd = peers_rwnd;
 274         sctp_clog[sctp_cwnd_log_at].x.rwnd.send_size = snd_size;
 275         sctp_clog[sctp_cwnd_log_at].x.rwnd.overhead = overhead;
 276         sctp_clog[sctp_cwnd_log_at].x.rwnd.new_rwnd = 0;
 277         sctp_cwnd_log_at++;
 278         if (sctp_cwnd_log_at >= SCTP_STAT_LOG_SIZE) {
 279                 sctp_cwnd_log_at = 0;
 280                 sctp_cwnd_log_rolled = 1;
 281         }
 282 }
 283
 284 void
 285 sctp_log_rwnd_set(uint8_t from, u_int32_t peers_rwnd , u_int32_t flight_size, u_int32_t overhead, u_int32_t a_rwndval)
 286 {
 287         sctp_clog[sctp_cwnd_log_at].from = (u_int8_t)from;
 288         sctp_clog[sctp_cwnd_log_at].event_type = (u_int8_t)SCTP_LOG_EVENT_RWND;
 289         sctp_clog[sctp_cwnd_log_at].x.rwnd.rwnd = peers_rwnd;
 290         sctp_clog[sctp_cwnd_log_at].x.rwnd.send_size = flight_size;
 291         sctp_clog[sctp_cwnd_log_at].x.rwnd.overhead = overhead;
 292         sctp_clog[sctp_cwnd_log_at].x.rwnd.new_rwnd = a_rwndval;
 293         sctp_cwnd_log_at++;
 294         if (sctp_cwnd_log_at >= SCTP_STAT_LOG_SIZE) {
 295                 sctp_cwnd_log_at = 0;
 296                 sctp_cwnd_log_rolled = 1;
 297         }
 298 }
 299
 300 void
 301 sctp_log_mbcnt(uint8_t from, u_int32_t total_oq , u_int32_t book, u_int32_t total_mbcnt_q, u_int32_t mbcnt)
 302 {
 303         sctp_clog[sctp_cwnd_log_at].from = (u_int8_t)from;
 304         sctp_clog[sctp_cwnd_log_at].event_type = (u_int8_t)SCTP_LOG_EVENT_MBCNT;
 305         sctp_clog[sctp_cwnd_log_at].x.mbcnt.total_queue_size = total_oq;
 306         sctp_clog[sctp_cwnd_log_at].x.mbcnt.size_change  = book;
 307         sctp_clog[sctp_cwnd_log_at].x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 308         sctp_clog[sctp_cwnd_log_at].x.mbcnt.mbcnt_change = mbcnt;
 309         sctp_cwnd_log_at++;
 310         if (sctp_cwnd_log_at >= SCTP_STAT_LOG_SIZE) {
 311                 sctp_cwnd_log_at = 0;
 312                 sctp_cwnd_log_rolled = 1;
 313         }
 314 }
 315
 316 void
 317 sctp_log_block(uint8_t from, struct socket *so, struct sctp_association *asoc)
 318 {
 319
 320         sctp_clog[sctp_cwnd_log_at].from = (u_int8_t)from;
 321         sctp_clog[sctp_cwnd_log_at].event_type = (u_int8_t)SCTP_LOG_EVENT_BLOCK;
 322         sctp_clog[sctp_cwnd_log_at].x.blk.maxmb = (u_int16_t)(so->so_snd.ssb_mbmax/1024);
 323         sctp_clog[sctp_cwnd_log_at].x.blk.onmb = asoc->total_output_mbuf_queue_size;
 324         sctp_clog[sctp_cwnd_log_at].x.blk.maxsb = (u_int16_t)(so->so_snd.ssb_hiwat/1024);
 325         sctp_clog[sctp_cwnd_log_at].x.blk.onsb = asoc->total_output_queue_size;
 326         sctp_clog[sctp_cwnd_log_at].x.blk.send_sent_qcnt = (u_int16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt);
 327         sctp_clog[sctp_cwnd_log_at].x.blk.stream_qcnt = (u_int16_t)asoc->stream_queue_cnt;
 328         sctp_cwnd_log_at++;
 329         if (sctp_cwnd_log_at >= SCTP_STAT_LOG_SIZE) {
 330                 sctp_cwnd_log_at = 0;
 331                 sctp_cwnd_log_rolled = 1;
 332         }
 333 }
 334
 335 int
 336 sctp_fill_stat_log(struct mbuf *m)
 337 {
 338         struct sctp_cwnd_log_req *req;
 339         int size_limit, num, i, at, cnt_out=0;
 340
 341         if (m == NULL)
 342                 return (EINVAL);
 343
 344         size_limit = (m->m_len - sizeof(struct sctp_cwnd_log_req));
 345         if (size_limit < sizeof(struct sctp_cwnd_log)) {
 346                 return (EINVAL);
 347         }
 348         req = mtod(m, struct sctp_cwnd_log_req *);
 349         num = size_limit/sizeof(struct sctp_cwnd_log);
 350         if (sctp_cwnd_log_rolled) {
 351                 req->num_in_log = SCTP_STAT_LOG_SIZE;
 352         } else {
 353                 req->num_in_log = sctp_cwnd_log_at;
 354                 /* if the log has not rolled, we don't
 355                  * let you have old data.
 356                  */
 357                 if (req->end_at > sctp_cwnd_log_at) {
 358                         req->end_at = sctp_cwnd_log_at;
 359                 }
 360         }
 361         if ((num < SCTP_STAT_LOG_SIZE) &&
 362             ((sctp_cwnd_log_rolled) || (sctp_cwnd_log_at > num))) {
 363                 /* we can't return all of it */
 364                 if (((req->start_at == 0) && (req->end_at == 0)) ||
 365                     (req->start_at >= SCTP_STAT_LOG_SIZE) ||
 366                     (req->end_at >= SCTP_STAT_LOG_SIZE)) {
 367                         /* No user request or user is wacked. */
 368                         req->num_ret = num;
 369                         req->end_at = sctp_cwnd_log_at - 1;
 370                         if ((sctp_cwnd_log_at - num) < 0) {
 371                                 int cc;
 372                                 cc = num - sctp_cwnd_log_at;
 373                                 req->start_at = SCTP_STAT_LOG_SIZE - cc;
 374                         } else {
 375                                 req->start_at = sctp_cwnd_log_at - num;
 376                         }
 377                 } else {
 378                         /* a user request */
 379                         int cc;
 380                         if (req->start_at > req->end_at) {
 381                                 cc = (SCTP_STAT_LOG_SIZE - req->start_at) +
 382                                     (req->end_at + 1);
 383                         } else {
 384
 385                                 cc = req->end_at - req->start_at;
 386                         }
 387                         if (cc < num) {
 388                                 num = cc;
 389                         }
 390                         req->num_ret = num;
 391                 }
 392         } else {
 393                 /* We can return all  of it */
 394                 req->start_at = 0;
 395                 req->end_at = sctp_cwnd_log_at - 1;
 396                 req->num_ret = sctp_cwnd_log_at;
 397         }
 398         for (i = 0, at = req->start_at; i < req->num_ret; i++) {
 399                 req->log[i] = sctp_clog[at];
 400                 cnt_out++;
 401                 at++;
 402                 if (at >= SCTP_STAT_LOG_SIZE)
 403                         at = 0;
 404         }
 405         m->m_len = (cnt_out * sizeof(struct sctp_cwnd_log_req)) + sizeof(struct sctp_cwnd_log_req);
 406         return (0);
 407 }
 408
 409 #endif
 410
 411 #ifdef SCTP_AUDITING_ENABLED
 412 u_int8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 413 static int sctp_audit_indx = 0;
 414
 415 static void
 416 sctp_print_audit_report(void)
 417 {
 418         int i;
 419         int cnt;
 420         cnt = 0;
 421         for (i=sctp_audit_indx;i<SCTP_AUDIT_SIZE;i++) {
 422                 if ((sctp_audit_data[i][0] == 0xe0) &&
 423                     (sctp_audit_data[i][1] == 0x01)) {
 424                         cnt = 0;
 425                         kprintf("\n");
 426                 } else if (sctp_audit_data[i][0] == 0xf0) {
 427                         cnt = 0;
 428                         kprintf("\n");
 429                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 430                     (sctp_audit_data[i][1] == 0x01)) {
 431                         kprintf("\n");
 432                         cnt = 0;
 433                 }
 434                 kprintf("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 435                     (uint32_t)sctp_audit_data[i][1]);
 436                 cnt++;
 437                 if ((cnt % 14) == 0)
 438                         kprintf("\n");
 439         }
 440         for (i=0;i<sctp_audit_indx;i++) {
 441                 if ((sctp_audit_data[i][0] == 0xe0) &&
 442                     (sctp_audit_data[i][1] == 0x01)) {
 443                         cnt = 0;
 444                         kprintf("\n");
 445                 } else if (sctp_audit_data[i][0] == 0xf0) {
 446                         cnt = 0;
 447                         kprintf("\n");
 448                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 449                          (sctp_audit_data[i][1] == 0x01)) {
 450                         kprintf("\n");
 451                         cnt = 0;
 452                 }
 453                 kprintf("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 454                     (uint32_t)sctp_audit_data[i][1]);
 455                 cnt++;
 456                 if ((cnt % 14) == 0)
 457                         kprintf("\n");
 458         }
 459         kprintf("\n");
 460 }
 461
 462 void
 463 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 464               struct sctp_nets *net)
 465 {
 466         int resend_cnt, tot_out, rep, tot_book_cnt;
 467         struct sctp_nets *lnet;
 468         struct sctp_tmit_chunk *chk;
 469
 470         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 471         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 472         sctp_audit_indx++;
 473         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 474                 sctp_audit_indx = 0;
 475         }
 476         if (inp == NULL) {
 477                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 478                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 479                 sctp_audit_indx++;
 480                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 481                         sctp_audit_indx = 0;
 482                 }
 483                 return;
 484         }
 485         if (stcb == NULL) {
 486                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 487                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 488                 sctp_audit_indx++;
 489                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 490                         sctp_audit_indx = 0;
 491                 }
 492                 return;
 493         }
 494         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 495         sctp_audit_data[sctp_audit_indx][1] =
 496             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 497         sctp_audit_indx++;
 498         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 499                 sctp_audit_indx = 0;
 500         }
 501         rep = 0;
 502         tot_book_cnt = 0;
 503         resend_cnt = tot_out = 0;
 504         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 505                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 506                         resend_cnt++;
 507                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 508                         tot_out += chk->book_size;
 509                         tot_book_cnt++;
 510                 }
 511         }
 512         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 513                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 514                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 515                 sctp_audit_indx++;
 516                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 517                         sctp_audit_indx = 0;
 518                 }
 519                 kprintf("resend_cnt:%d asoc-tot:%d\n",
 520                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 521                 rep = 1;
 522                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 523                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 524                 sctp_audit_data[sctp_audit_indx][1] =
 525                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 526                 sctp_audit_indx++;
 527                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 528                         sctp_audit_indx = 0;
 529                 }
 530         }
 531         if (tot_out != stcb->asoc.total_flight) {
 532                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 533                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 534                 sctp_audit_indx++;
 535                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 536                         sctp_audit_indx = 0;
 537                 }
 538                 rep = 1;
 539                 kprintf("tot_flt:%d asoc_tot:%d\n", tot_out,
 540                     (int)stcb->asoc.total_flight);
 541                 stcb->asoc.total_flight = tot_out;
 542         }
 543         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 544                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 545                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 546                 sctp_audit_indx++;
 547                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 548                         sctp_audit_indx = 0;
 549                 }
 550                 rep = 1;
 551                 kprintf("tot_flt_book:%d\n", tot_book);
 552
 553                 stcb->asoc.total_flight_count = tot_book_cnt;
 554         }
 555         tot_out = 0;
 556         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 557                 tot_out += lnet->flight_size;
 558         }
 559         if (tot_out != stcb->asoc.total_flight) {
 560                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 561                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 562                 sctp_audit_indx++;
 563                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 564                         sctp_audit_indx = 0;
 565                 }
 566                 rep = 1;
 567                 kprintf("real flight:%d net total was %d\n",
 568                     stcb->asoc.total_flight, tot_out);
 569                 /* now corrective action */
 570                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 571                         tot_out = 0;
 572                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 573                                 if ((chk->whoTo == lnet) &&
 574                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 575                                         tot_out += chk->book_size;
 576                                 }
 577                         }
 578                         if (lnet->flight_size != tot_out) {
 579                                 kprintf("net:%x flight was %d corrected to %d\n",
 580                                     (uint32_t)lnet, lnet->flight_size, tot_out);
 581                                 lnet->flight_size = tot_out;
 582                         }
 583
 584                 }
 585         }
 586
 587         if (rep) {
 588                 sctp_print_audit_report();
 589         }
 590 }
 591
 592 void
 593 sctp_audit_log(u_int8_t ev, u_int8_t fd)
 594 {
 595         crit_enter();
 596         sctp_audit_data[sctp_audit_indx][0] = ev;
 597         sctp_audit_data[sctp_audit_indx][1] = fd;
 598         sctp_audit_indx++;
 599         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 600                 sctp_audit_indx = 0;
 601         }
 602         crit_exit();
 603 }
 604
 605 #endif
 606
 607 /*
 608  * a list of sizes based on typical mtu's, used only if next hop
 609  * size not returned.
 610  */
 611 static int sctp_mtu_sizes[] = {
 612         68,
 613         296,
 614         508,
 615         512,
 616         544,
 617         576,
 618         1006,
 619         1492,
 620         1500,
 621         1536,
 622         2002,
 623         2048,
 624         4352,
 625         4464,
 626         8166,
 627         17914,
 628         32000,
 629         65535
 630 };
 631
 632 int
 633 find_next_best_mtu(int totsz)
 634 {
 635         int i, perfer;
 636         /*
 637          * if we are in here we must find the next best fit based on the
 638          * size of the dg that failed to be sent.
 639          */
 640         perfer = 0;
 641         for (i = 0; i < NUMBER_OF_MTU_SIZES; i++) {
 642                 if (totsz < sctp_mtu_sizes[i]) {
 643                         perfer = i - 1;
 644                         if (perfer < 0)
 645                                 perfer = 0;
 646                         break;
 647                 }
 648         }
 649         return (sctp_mtu_sizes[perfer]);
 650 }
 651
 652 void
 653 sctp_fill_random_store(struct sctp_pcb *m)
 654 {
 655         /*
 656          * Here we use the MD5/SHA-1 to hash with our good randomNumbers
 657          * and our counter. The result becomes our good random numbers and
 658          * we then setup to give these out. Note that we do no lockig
 659          * to protect this. This is ok, since if competing folks call
 660          * this we will get more gobbled gook in the random store whic
 661          * is what we want. There is a danger that two guys will use
 662          * the same random numbers, but thats ok too since that
 663          * is random as well :->
 664          */
 665         m->store_at = 0;
 666         sctp_hash_digest((char *)m->random_numbers, sizeof(m->random_numbers),
 667                          (char *)&m->random_counter, sizeof(m->random_counter),
 668                          (char *)m->random_store);
 669         m->random_counter++;
 670 }
 671
 672 uint32_t
 673 sctp_select_initial_TSN(struct sctp_pcb *m)
 674 {
 675         /*
 676          * A true implementation should use random selection process to
 677          * get the initial stream sequence number, using RFC1750 as a
 678          * good guideline
 679          */
 680         u_long x, *xp;
 681         uint8_t *p;
 682
 683         if (m->initial_sequence_debug != 0) {
 684                 u_int32_t ret;
 685                 ret = m->initial_sequence_debug;
 686                 m->initial_sequence_debug++;
 687                 return (ret);
 688         }
 689         if ((m->store_at+sizeof(u_long)) > SCTP_SIGNATURE_SIZE) {
 690                 /* Refill the random store */
 691                 sctp_fill_random_store(m);
 692         }
 693         p = &m->random_store[(int)m->store_at];
 694         xp = (u_long *)p;
 695         x = *xp;
 696         m->store_at += sizeof(u_long);
 697         return (x);
 698 }
 699
 700 u_int32_t
 701 sctp_select_a_tag(struct sctp_inpcb *m)
 702 {
 703         u_long x, not_done;
 704         struct timeval now;
 705
 706         SCTP_GETTIME_TIMEVAL(&now);
 707         not_done = 1;
 708         while (not_done) {
 709                 x = sctp_select_initial_TSN(&m->sctp_ep);
 710                 if (x == 0) {
 711                         /* we never use 0 */
 712                         continue;
 713                 }
 714                 if (sctp_is_vtag_good(m, x, &now)) {
 715                         not_done = 0;
 716                 }
 717         }
 718         return (x);
 719 }
 720
 721
 722 int
 723 sctp_init_asoc(struct sctp_inpcb *m, struct sctp_association *asoc,
 724                int for_a_init, uint32_t override_tag )
 725 {
 726         /*
 727          * Anything set to zero is taken care of by the allocation
 728          * routine's bzero
 729          */
 730
 731         /*
 732          * Up front select what scoping to apply on addresses I tell my peer
 733          * Not sure what to do with these right now, we will need to come up
 734          * with a way to set them. We may need to pass them through from the
 735          * caller in the sctp_aloc_assoc() function.
 736          */
 737         int i;
 738         /* init all variables to a known value.*/
 739         asoc->state = SCTP_STATE_INUSE;
 740         asoc->max_burst = m->sctp_ep.max_burst;
 741         asoc->heart_beat_delay = m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT];
 742         asoc->cookie_life = m->sctp_ep.def_cookie_life;
 743
 744         if (override_tag) {
 745                 asoc->my_vtag = override_tag;
 746         } else {
 747                 asoc->my_vtag = sctp_select_a_tag(m);
 748         }
 749         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
 750                 sctp_select_initial_TSN(&m->sctp_ep);
 751         asoc->t3timeout_highest_marked = asoc->asconf_seq_out;
 752         /* we are opptimisitic here */
 753         asoc->peer_supports_asconf = 1;
 754         asoc->peer_supports_asconf_setprim = 1;
 755         asoc->peer_supports_pktdrop = 1;
 756
 757         asoc->sent_queue_retran_cnt = 0;
 758         /* This will need to be adjusted */
 759         asoc->last_cwr_tsn = asoc->init_seq_number - 1;
 760         asoc->last_acked_seq = asoc->init_seq_number - 1;
 761         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 762         asoc->asconf_seq_in = asoc->last_acked_seq;
 763
 764         /* here we are different, we hold the next one we expect */
 765         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
 766
 767         asoc->initial_init_rto_max = m->sctp_ep.initial_init_rto_max;
 768         asoc->initial_rto = m->sctp_ep.initial_rto;
 769
 770         asoc->max_init_times = m->sctp_ep.max_init_times;
 771         asoc->max_send_times = m->sctp_ep.max_send_times;
 772         asoc->def_net_failure = m->sctp_ep.def_net_failure;
 773
 774         /* ECN Nonce initialization */
 775         asoc->ecn_nonce_allowed = 0;
 776         asoc->receiver_nonce_sum = 1;
 777         asoc->nonce_sum_expect_base = 1;
 778         asoc->nonce_sum_check = 1;
 779         asoc->nonce_resync_tsn = 0;
 780         asoc->nonce_wait_for_ecne = 0;
 781         asoc->nonce_wait_tsn = 0;
 782
 783         if (m->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
 784                 struct in6pcb *inp6;
 785
 786
 787                 /* Its a V6 socket */
 788                 inp6 = (struct in6pcb *)m;
 789                 asoc->ipv6_addr_legal = 1;
 790                 /* Now look at the binding flag to see if V4 will be legal */
 791         if (
 792 #if defined(__OpenBSD__)
 793                 (0) /* we always do dual bind */
 794 #elif defined (__NetBSD__)
 795                 (inp6->in6p_flags & IN6P_IPV6_V6ONLY)
 796 #else
 797                 (inp6->inp_flags & IN6P_IPV6_V6ONLY)
 798 #endif
 799              == 0) {
 800                         asoc->ipv4_addr_legal = 1;
 801                 } else {
 802                         /* V4 addresses are NOT legal on the association */
 803                         asoc->ipv4_addr_legal = 0;
 804                 }
 805         } else {
 806                 /* Its a V4 socket, no - V6 */
 807                 asoc->ipv4_addr_legal = 1;
 808                 asoc->ipv6_addr_legal = 0;
 809         }
 810
 811
 812         asoc->my_rwnd = max(m->sctp_socket->so_rcv.ssb_hiwat, SCTP_MINIMAL_RWND);
 813         asoc->peers_rwnd = m->sctp_socket->so_rcv.ssb_hiwat;
 814
 815         asoc->smallest_mtu = m->sctp_frag_point;
 816         asoc->minrto = m->sctp_ep.sctp_minrto;
 817         asoc->maxrto = m->sctp_ep.sctp_maxrto;
 818
 819         LIST_INIT(&asoc->sctp_local_addr_list);
 820         TAILQ_INIT(&asoc->nets);
 821         TAILQ_INIT(&asoc->pending_reply_queue);
 822         asoc->last_asconf_ack_sent = NULL;
 823         /* Setup to fill the hb random cache at first HB */
 824         asoc->hb_random_idx = 4;
 825
 826         asoc->sctp_autoclose_ticks = m->sctp_ep.auto_close_time;
 827
 828         /*
 829          * Now the stream parameters, here we allocate space for all
 830          * streams that we request by default.
 831          */
 832         asoc->streamoutcnt = asoc->pre_open_streams =
 833             m->sctp_ep.pre_open_stream_count;
 834         MALLOC(asoc->strmout, struct sctp_stream_out *, asoc->streamoutcnt *
 835             sizeof(struct sctp_stream_out), M_PCB, M_NOWAIT);
 836         if (asoc->strmout == NULL) {
 837                 /* big trouble no memory */
 838                 return (ENOMEM);
 839         }
 840         for (i = 0; i < asoc->streamoutcnt; i++) {
 841                 /*
 842                  * inbound side must be set to 0xffff,
 843                  * also NOTE when we get the INIT-ACK back (for INIT sender)
 844                  * we MUST reduce the count (streamoutcnt) but first check
 845                  * if we sent to any of the upper streams that were dropped
 846                  * (if some were). Those that were dropped must be notified
 847                  * to the upper layer as failed to send.
 848                  */
 849                 asoc->strmout[i].next_sequence_sent = 0x0;
 850                 TAILQ_INIT(&asoc->strmout[i].outqueue);
 851                 asoc->strmout[i].stream_no = i;
 852                 asoc->strmout[i].next_spoke.tqe_next = 0;
 853                 asoc->strmout[i].next_spoke.tqe_prev = 0;
 854         }
 855         /* Now the mapping array */
 856         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
 857 #ifdef __NetBSD__
 858         MALLOC(asoc->mapping_array, u_int8_t *, SCTP_INITIAL_MAPPING_ARRAY,
 859                M_PCB, M_NOWAIT);
 860 #else
 861         MALLOC(asoc->mapping_array, u_int8_t *, asoc->mapping_array_size,
 862                M_PCB, M_NOWAIT);
 863 #endif
 864         if (asoc->mapping_array == NULL) {
 865                 FREE(asoc->strmout, M_PCB);
 866                 return (ENOMEM);
 867         }
 868         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
 869         /* Now the init of the other outqueues */
 870         TAILQ_INIT(&asoc->out_wheel);
 871         TAILQ_INIT(&asoc->control_send_queue);
 872         TAILQ_INIT(&asoc->send_queue);
 873         TAILQ_INIT(&asoc->sent_queue);
 874         TAILQ_INIT(&asoc->reasmqueue);
 875         TAILQ_INIT(&asoc->delivery_queue);
 876         asoc->max_inbound_streams = m->sctp_ep.max_open_streams_intome;
 877
 878         TAILQ_INIT(&asoc->asconf_queue);
 879         return (0);
 880 }
 881
 882 int
 883 sctp_expand_mapping_array(struct sctp_association *asoc)
 884 {
 885         /* mapping array needs to grow */
 886         u_int8_t *new_array;
 887         uint16_t new_size;
 888
 889         new_size = asoc->mapping_array_size + SCTP_MAPPING_ARRAY_INCR;
 890 #ifdef __NetBSD__
 891         MALLOC(new_array, u_int8_t *, asoc->mapping_array_size
 892                 + SCTP_MAPPING_ARRAY_INCR, M_PCB, M_NOWAIT);
 893 #else
 894         MALLOC(new_array, u_int8_t *, new_size, M_PCB, M_NOWAIT);
 895 #endif
 896         if (new_array == NULL) {
 897                 /* can't get more, forget it */
 898                 kprintf("No memory for expansion of SCTP mapping array %d\n",
 899                        new_size);
 900                 return (-1);
 901         }
 902         memset(new_array, 0, new_size);
 903         memcpy(new_array, asoc->mapping_array, asoc->mapping_array_size);
 904         FREE(asoc->mapping_array, M_PCB);
 905         asoc->mapping_array = new_array;
 906         asoc->mapping_array_size = new_size;
 907         return (0);
 908 }
 909
 910 static void
 911 sctp_timeout_handler(void *t)
 912 {
 913         struct sctp_inpcb *inp;
 914         struct sctp_tcb *stcb;
 915         struct sctp_nets *net;
 916         struct sctp_timer *tmr;
 917         int did_output, typ;
 918 #if defined(__APPLE__)
 919         boolean_t funnel_state;
 920
 921         /* get BSD kernel funnel/mutex */
 922         funnel_state = thread_funnel_set(network_flock, TRUE);
 923 #endif
 924
 925         crit_enter();
 926         tmr = (struct sctp_timer *)t;
 927         inp = (struct sctp_inpcb *)tmr->ep;
 928         stcb = (struct sctp_tcb *)tmr->tcb;
 929         net = (struct sctp_nets *)tmr->net;
 930         did_output = 1;
 931
 932
 933 #ifdef SCTP_AUDITING_ENABLED
 934         sctp_audit_log(0xF0, (u_int8_t)tmr->type);
 935         sctp_auditing(3, inp, stcb, net);
 936 #endif
 937         sctp_pegs[SCTP_TIMERS_EXP]++;
 938
 939         if (inp == NULL) {
 940                 return;
 941         }
 942
 943         SCTP_INP_WLOCK(inp);
 944         if (inp->sctp_socket == 0) {
 945                 crit_exit();
 946 #if defined(__APPLE__)
 947                 /* release BSD kernel funnel/mutex */
 948                 thread_funnel_set(network_flock, FALSE);
 949 #endif
 950                 SCTP_INP_WUNLOCK(inp);
 951                 return;
 952         }
 953         if (stcb) {
 954                 if (stcb->asoc.state == 0) {
 955                         crit_exit();
 956 #if defined(__APPLE__)
 957                         /* release BSD kernel funnel/mutex */
 958                         thread_funnel_set(network_flock, FALSE);
 959 #endif
 960                         SCTP_INP_WUNLOCK(inp);
 961                         return;
 962                 }
 963         }
 964 #ifdef SCTP_DEBUG
 965         if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
 966                 kprintf("Timer type %d goes off\n", tmr->type);
 967         }
 968 #endif /* SCTP_DEBUG */
 969 #ifndef __NetBSD__
 970         if (!callout_active(&tmr->timer)) {
 971                 crit_exit();
 972 #if defined(__APPLE__)
 973                 /* release BSD kernel funnel/mutex */
 974                 thread_funnel_set(network_flock, FALSE);
 975 #endif
 976                 SCTP_INP_WUNLOCK(inp);
 977                 return;
 978         }
 979 #endif
 980 #if defined(__APPLE__)
 981         /* clear the callout pending status here */
 982         callout_stop(&tmr->timer);
 983 #endif
 984         if (stcb) {
 985                 SCTP_TCB_LOCK(stcb);
 986         }
 987         SCTP_INP_INCR_REF(inp);
 988         SCTP_INP_WUNLOCK(inp);
 989
 990         typ = tmr->type;
 991         switch (tmr->type) {
 992         case SCTP_TIMER_TYPE_ITERATOR:
 993         {
 994                 struct sctp_iterator *it;
 995                 it = (struct sctp_iterator *)inp;
 996                 sctp_iterator_timer(it);
 997         }
 998         break;
 999         /* call the handler for the appropriate timer type */
1000         case SCTP_TIMER_TYPE_SEND:
1001                 sctp_pegs[SCTP_TMIT_TIMER]++;
1002                 stcb->asoc.num_send_timers_up--;
1003                 if (stcb->asoc.num_send_timers_up < 0) {
1004                         stcb->asoc.num_send_timers_up = 0;
1005                 }
1006                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1007                         /* no need to unlock on tcb its gone */
1008
1009                         goto out_decr;
1010                 }
1011 #ifdef SCTP_AUDITING_ENABLED
1012                 sctp_auditing(4, inp, stcb, net);
1013 #endif
1014                 sctp_chunk_output(inp, stcb, 1);
1015                 if ((stcb->asoc.num_send_timers_up == 0) &&
1016                     (stcb->asoc.sent_queue_cnt > 0)
1017                         ) {
1018                         struct sctp_tmit_chunk *chk;
1019                         /*
1020                          * safeguard. If there on some on the sent queue
1021                          * somewhere but no timers running something is
1022                          * wrong... so we start a timer on the first chunk
1023                          * on the send queue on whatever net it is sent to.
1024                          */
1025                         sctp_pegs[SCTP_T3_SAFEGRD]++;
1026                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1027                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1028                                          chk->whoTo);
1029                 }
1030                 break;
1031         case SCTP_TIMER_TYPE_INIT:
1032                 if (sctp_t1init_timer(inp, stcb, net)) {
1033                         /* no need to unlock on tcb its gone */
1034                         goto out_decr;
1035                 }
1036                 /* We do output but not here */
1037                 did_output = 0;
1038                 break;
1039         case SCTP_TIMER_TYPE_RECV:
1040                 sctp_pegs[SCTP_RECV_TIMER]++;
1041                 sctp_send_sack(stcb);
1042 #ifdef SCTP_AUDITING_ENABLED
1043                 sctp_auditing(4, inp, stcb, net);
1044 #endif
1045                 sctp_chunk_output(inp, stcb, 4);
1046                 break;
1047         case SCTP_TIMER_TYPE_SHUTDOWN:
1048                 if (sctp_shutdown_timer(inp, stcb, net) ) {
1049                         /* no need to unlock on tcb its gone */
1050                         goto out_decr;
1051                 }
1052 #ifdef SCTP_AUDITING_ENABLED
1053                 sctp_auditing(4, inp, stcb, net);
1054 #endif
1055                 sctp_chunk_output(inp, stcb, 5);
1056                 break;
1057         case SCTP_TIMER_TYPE_HEARTBEAT:
1058                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1059                         /* no need to unlock on tcb its gone */
1060                         goto out_decr;
1061                 }
1062 #ifdef SCTP_AUDITING_ENABLED
1063                 sctp_auditing(4, inp, stcb, net);
1064 #endif
1065                 sctp_chunk_output(inp, stcb, 6);
1066                 break;
1067         case SCTP_TIMER_TYPE_COOKIE:
1068                 if (sctp_cookie_timer(inp, stcb, net)) {
1069                         /* no need to unlock on tcb its gone */
1070                         goto out_decr;
1071                 }
1072 #ifdef SCTP_AUDITING_ENABLED
1073                 sctp_auditing(4, inp, stcb, net);
1074 #endif
1075                 sctp_chunk_output(inp, stcb, 1);
1076                 break;
1077         case SCTP_TIMER_TYPE_NEWCOOKIE:
1078         {
1079                 struct timeval tv;
1080                 int i, secret;
1081                 SCTP_GETTIME_TIMEVAL(&tv);
1082                 SCTP_INP_WLOCK(inp);
1083                 inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1084                 inp->sctp_ep.last_secret_number =
1085                         inp->sctp_ep.current_secret_number;
1086                 inp->sctp_ep.current_secret_number++;
1087                 if (inp->sctp_ep.current_secret_number >=
1088                     SCTP_HOW_MANY_SECRETS) {
1089                         inp->sctp_ep.current_secret_number = 0;
1090                 }
1091                 secret = (int)inp->sctp_ep.current_secret_number;
1092                 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1093                         inp->sctp_ep.secret_key[secret][i] =
1094                                 sctp_select_initial_TSN(&inp->sctp_ep);
1095                 }
1096                 SCTP_INP_WUNLOCK(inp);
1097                 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1098         }
1099         did_output = 0;
1100         break;
1101         case SCTP_TIMER_TYPE_PATHMTURAISE:
1102                 sctp_pathmtu_timer(inp, stcb, net);
1103                 did_output = 0;
1104                 break;
1105         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1106                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1107                         /* no need to unlock on tcb its gone */
1108                         goto out_decr;
1109                 }
1110 #ifdef SCTP_AUDITING_ENABLED
1111                 sctp_auditing(4, inp, stcb, net);
1112 #endif
1113                 sctp_chunk_output(inp, stcb, 7);
1114                 break;
1115         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1116                 sctp_abort_an_association(inp, stcb,
1117                                           SCTP_SHUTDOWN_GUARD_EXPIRES, NULL);
1118                 /* no need to unlock on tcb its gone */
1119                 goto out_decr;
1120                 break;
1121
1122         case SCTP_TIMER_TYPE_STRRESET:
1123                 if (sctp_strreset_timer(inp, stcb, net)) {
1124                         /* no need to unlock on tcb its gone */
1125                         goto out_decr;
1126                 }
1127                 sctp_chunk_output(inp, stcb, 9);
1128                 break;
1129
1130         case SCTP_TIMER_TYPE_ASCONF:
1131                 if (sctp_asconf_timer(inp, stcb, net)) {
1132                         /* no need to unlock on tcb its gone */
1133                         goto out_decr;
1134                 }
1135 #ifdef SCTP_AUDITING_ENABLED
1136                 sctp_auditing(4, inp, stcb, net);
1137 #endif
1138                 sctp_chunk_output(inp, stcb, 8);
1139                 break;
1140
1141         case SCTP_TIMER_TYPE_AUTOCLOSE:
1142                 sctp_autoclose_timer(inp, stcb, net);
1143                 sctp_chunk_output(inp, stcb, 10);
1144                 did_output = 0;
1145                 break;
1146         case SCTP_TIMER_TYPE_INPKILL:
1147                 /* special case, take away our
1148                  * increment since WE are the killer
1149                  */
1150                 SCTP_INP_WLOCK(inp);
1151                 SCTP_INP_DECR_REF(inp);
1152                 SCTP_INP_WUNLOCK(inp);
1153                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
1154                 sctp_inpcb_free(inp, 1);
1155                 goto out_no_decr;
1156                 break;
1157         default:
1158 #ifdef SCTP_DEBUG
1159                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1160                         kprintf("sctp_timeout_handler:unknown timer %d\n",
1161                                tmr->type);
1162                 }
1163 #endif /* SCTP_DEBUG */
1164                 break;
1165         };
1166 #ifdef SCTP_AUDITING_ENABLED
1167         sctp_audit_log(0xF1, (u_int8_t)tmr->type);
1168         sctp_auditing(5, inp, stcb, net);
1169 #endif
1170         if (did_output) {
1171                 /*
1172                  * Now we need to clean up the control chunk chain if an
1173                  * ECNE is on it. It must be marked as UNSENT again so next
1174                  * call will continue to send it until such time that we get
1175                  * a CWR, to remove it. It is, however, less likely that we
1176                  * will find a ecn echo on the chain though.
1177                  */
1178                 sctp_fix_ecn_echo(&stcb->asoc);
1179         }
1180         if (stcb) {
1181                 SCTP_TCB_UNLOCK(stcb);
1182         }
1183  out_decr:
1184         SCTP_INP_WLOCK(inp);
1185         SCTP_INP_DECR_REF(inp);
1186         SCTP_INP_WUNLOCK(inp);
1187
1188  out_no_decr:
1189
1190 #ifdef SCTP_DEBUG
1191         if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1192                 kprintf("Timer now complete (type %d)\n", typ);
1193         }
1194 #endif /* SCTP_DEBUG */
1195
1196         crit_exit();
1197 #if defined(__APPLE__)
1198         /* release BSD kernel funnel/mutex */
1199         thread_funnel_set(network_flock, FALSE);
1200 #endif
1201 }
1202
1203 int
1204 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1205     struct sctp_nets *net)
1206 {
1207         int to_ticks;
1208         struct sctp_timer *tmr;
1209
1210         if (inp == NULL)
1211                 return (EFAULT);
1212
1213         to_ticks = 0;
1214
1215         tmr = NULL;
1216         switch (t_type) {
1217         case SCTP_TIMER_TYPE_ITERATOR:
1218         {
1219                 struct sctp_iterator *it;
1220                 it = (struct sctp_iterator *)inp;
1221                 tmr = &it->tmr;
1222                 to_ticks = SCTP_ITERATOR_TICKS;
1223         }
1224         break;
1225         case SCTP_TIMER_TYPE_SEND:
1226                 /* Here we use the RTO timer */
1227         {
1228                 int rto_val;
1229                 if ((stcb == NULL) || (net == NULL)) {
1230                         return (EFAULT);
1231                 }
1232                 tmr = &net->rxt_timer;
1233                 if (net->RTO == 0) {
1234                         rto_val = stcb->asoc.initial_rto;
1235                 } else {
1236                         rto_val = net->RTO;
1237                 }
1238                 to_ticks = MSEC_TO_TICKS(rto_val);
1239         }
1240         break;
1241         case SCTP_TIMER_TYPE_INIT:
1242                 /*
1243                  * Here we use the INIT timer default
1244                  * usually about 1 minute.
1245                  */
1246                 if ((stcb == NULL) || (net == NULL)) {
1247                         return (EFAULT);
1248                 }
1249                 tmr = &net->rxt_timer;
1250                 if (net->RTO == 0) {
1251                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1252                 } else {
1253                         to_ticks = MSEC_TO_TICKS(net->RTO);
1254                 }
1255                 break;
1256         case SCTP_TIMER_TYPE_RECV:
1257                 /*
1258                  * Here we use the Delayed-Ack timer value from the inp
1259                  * ususually about 200ms.
1260                  */
1261                 if (stcb == NULL) {
1262                         return (EFAULT);
1263                 }
1264                 tmr = &stcb->asoc.dack_timer;
1265                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV];
1266                 break;
1267         case SCTP_TIMER_TYPE_SHUTDOWN:
1268                 /* Here we use the RTO of the destination. */
1269                 if ((stcb == NULL) || (net == NULL)) {
1270                         return (EFAULT);
1271                 }
1272
1273                 if (net->RTO == 0) {
1274                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1275                 } else {
1276                         to_ticks = MSEC_TO_TICKS(net->RTO);
1277                 }
1278                 tmr = &net->rxt_timer;
1279                 break;
1280         case SCTP_TIMER_TYPE_HEARTBEAT:
1281                 /*
1282                  * the net is used here so that we can add in the RTO.
1283                  * Even though we use a different timer. We also add the
1284                  * HB timer PLUS a random jitter.
1285                  */
1286                 if (stcb == NULL) {
1287                         return (EFAULT);
1288                 }
1289                 {
1290                         uint32_t rndval;
1291                         uint8_t this_random;
1292                         int cnt_of_unconf=0;
1293                         struct sctp_nets *lnet;
1294
1295                         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
1296                                 if (lnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
1297                                         cnt_of_unconf++;
1298                                 }
1299                         }
1300 #ifdef SCTP_DEBUG
1301                         if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1302                                 kprintf("HB timer to start unconfirmed:%d hb_delay:%d\n",
1303                                        cnt_of_unconf, stcb->asoc.heart_beat_delay);
1304                         }
1305 #endif
1306                         if (stcb->asoc.hb_random_idx > 3) {
1307                                 rndval = sctp_select_initial_TSN(&inp->sctp_ep);
1308                                 memcpy(stcb->asoc.hb_random_values, &rndval,
1309                                        sizeof(stcb->asoc.hb_random_values));
1310                                 this_random = stcb->asoc.hb_random_values[0];
1311                                 stcb->asoc.hb_random_idx = 0;
1312                                 stcb->asoc.hb_ect_randombit = 0;
1313                         } else {
1314                                 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
1315                                 stcb->asoc.hb_random_idx++;
1316                                 stcb->asoc.hb_ect_randombit = 0;
1317                         }
1318                         /*
1319                          * this_random will be 0 - 256 ms
1320                          * RTO is in ms.
1321                          */
1322                         if ((stcb->asoc.heart_beat_delay == 0) &&
1323                             (cnt_of_unconf == 0)) {
1324                                 /* no HB on this inp after confirmations */
1325                                 return (0);
1326                         }
1327                         if (net) {
1328                                 struct sctp_nets *lnet;
1329                                 int delay;
1330                                 delay = stcb->asoc.heart_beat_delay;
1331                                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
1332                                         if ((lnet->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1333                                             ((lnet->dest_state & SCTP_ADDR_OUT_OF_SCOPE) == 0) &&
1334                                             (lnet->dest_state & SCTP_ADDR_REACHABLE)) {
1335                                             delay = 0;
1336                                         }
1337                                 }
1338                                 if (net->RTO == 0) {
1339                                         /* Never been checked */
1340                                         to_ticks = this_random + stcb->asoc.initial_rto + delay;
1341                                 } else {
1342                                         /* set rto_val to the ms */
1343                                         to_ticks = delay + net->RTO + this_random;
1344                                 }
1345                         } else {
1346                                 if (cnt_of_unconf) {
1347                                         to_ticks = this_random + stcb->asoc.initial_rto;
1348                                 } else {
1349                                         to_ticks = stcb->asoc.heart_beat_delay + this_random + stcb->asoc.initial_rto;
1350                                 }
1351                         }
1352                         /*
1353                          * Now we must convert the to_ticks that are now in
1354                          * ms to ticks.
1355                          */
1356                         to_ticks *= hz;
1357                         to_ticks /= 1000;
1358 #ifdef SCTP_DEBUG
1359                         if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1360                                 kprintf("Timer to expire in %d ticks\n", to_ticks);
1361                         }
1362 #endif
1363                         tmr = &stcb->asoc.hb_timer;
1364                 }
1365                 break;
1366         case SCTP_TIMER_TYPE_COOKIE:
1367                 /*
1368                  * Here we can use the RTO timer from the network since
1369                  * one RTT was compelete. If a retran happened then we will
1370                  * be using the RTO initial value.
1371                  */
1372                 if ((stcb == NULL) || (net == NULL)) {
1373                         return (EFAULT);
1374                 }
1375                 if (net->RTO == 0) {
1376                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1377                 } else {
1378                         to_ticks = MSEC_TO_TICKS(net->RTO);
1379                 }
1380                 tmr = &net->rxt_timer;
1381                 break;
1382         case SCTP_TIMER_TYPE_NEWCOOKIE:
1383                 /*
1384                  * nothing needed but the endpoint here
1385                  * ususually about 60 minutes.
1386                  */
1387                 tmr = &inp->sctp_ep.signature_change;
1388                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
1389                 break;
1390         case SCTP_TIMER_TYPE_INPKILL:
1391                 /*
1392                  * The inp is setup to die. We re-use the
1393                  * signature_chage timer since that has
1394                  * stopped and we are in the GONE state.
1395                  */
1396                 tmr = &inp->sctp_ep.signature_change;
1397                 to_ticks = (SCTP_INP_KILL_TIMEOUT * hz) / 1000;
1398                 break;
1399         case SCTP_TIMER_TYPE_PATHMTURAISE:
1400                 /*
1401                  * Here we use the value found in the EP for PMTU
1402                  * ususually about 10 minutes.
1403                  */
1404                 if (stcb == NULL) {
1405                         return (EFAULT);
1406                 }
1407                 if (net == NULL) {
1408                         return (EFAULT);
1409                 }
1410                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
1411                 tmr = &net->pmtu_timer;
1412                 break;
1413         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1414                 /* Here we use the RTO of the destination */
1415                 if ((stcb == NULL) || (net == NULL)) {
1416                         return (EFAULT);
1417                 }
1418                 if (net->RTO == 0) {
1419                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1420                 } else {
1421                         to_ticks = MSEC_TO_TICKS(net->RTO);
1422                 }
1423                 tmr = &net->rxt_timer;
1424                 break;
1425         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1426                 /*
1427                  * Here we use the endpoints shutdown guard timer
1428                  * usually about 3 minutes.
1429                  */
1430                 if (stcb == NULL) {
1431                         return (EFAULT);
1432                 }
1433                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
1434                 tmr = &stcb->asoc.shut_guard_timer;
1435                 break;
1436         case SCTP_TIMER_TYPE_STRRESET:
1437                 /*
1438                  * Here the timer comes from the inp
1439                  * but its value is from the RTO.
1440                  */
1441                 if ((stcb == NULL) || (net == NULL)) {
1442                         return (EFAULT);
1443                 }
1444                 if (net->RTO == 0) {
1445                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1446                 } else {
1447                         to_ticks = MSEC_TO_TICKS(net->RTO);
1448                 }
1449                 tmr = &stcb->asoc.strreset_timer;
1450                 break;
1451
1452         case SCTP_TIMER_TYPE_ASCONF:
1453                 /*
1454                  * Here the timer comes from the inp
1455                  * but its value is from the RTO.
1456                  */
1457                 if ((stcb == NULL) || (net == NULL)) {
1458                         return (EFAULT);
1459                 }
1460                 if (net->RTO == 0) {
1461                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1462                 } else {
1463                         to_ticks = MSEC_TO_TICKS(net->RTO);
1464                 }
1465                 tmr = &stcb->asoc.asconf_timer;
1466                 break;
1467         case SCTP_TIMER_TYPE_AUTOCLOSE:
1468                 if (stcb == NULL) {
1469                         return (EFAULT);
1470                 }
1471                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
1472                         /* Really an error since stcb is NOT set to autoclose */
1473                         return (0);
1474                 }
1475                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
1476                 tmr = &stcb->asoc.autoclose_timer;
1477                 break;
1478         default:
1479 #ifdef SCTP_DEBUG
1480                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1481                         kprintf("sctp_timer_start:Unknown timer type %d\n",
1482                                t_type);
1483                 }
1484 #endif /* SCTP_DEBUG */
1485                 return (EFAULT);
1486                 break;
1487         };
1488         if ((to_ticks <= 0) || (tmr == NULL)) {
1489 #ifdef SCTP_DEBUG
1490                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1491                         kprintf("sctp_timer_start:%d:software error to_ticks:%d tmr:%p not set ??\n",
1492                                t_type, to_ticks, tmr);
1493                 }
1494 #endif /* SCTP_DEBUG */
1495                 return (EFAULT);
1496         }
1497         if (callout_pending(&tmr->timer)) {
1498                 /*
1499                  * we do NOT allow you to have it already running.
1500                  * if it is we leave the current one up unchanged
1501                  */
1502                 return (EALREADY);
1503         }
1504         /* At this point we can proceed */
1505         if (t_type == SCTP_TIMER_TYPE_SEND) {
1506                 stcb->asoc.num_send_timers_up++;
1507         }
1508         tmr->type = t_type;
1509         tmr->ep = (void *)inp;
1510         tmr->tcb = (void *)stcb;
1511         tmr->net = (void *)net;
1512         callout_reset(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
1513         return (0);
1514 }
1515
1516 int
1517 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1518                 struct sctp_nets *net)
1519 {
1520         struct sctp_timer *tmr;
1521
1522         if (inp == NULL)
1523                 return (EFAULT);
1524
1525         tmr = NULL;
1526         switch (t_type) {
1527         case SCTP_TIMER_TYPE_ITERATOR:
1528         {
1529                 struct sctp_iterator *it;
1530                 it = (struct sctp_iterator *)inp;
1531                 tmr = &it->tmr;
1532         }
1533         break;
1534         case SCTP_TIMER_TYPE_SEND:
1535                 if ((stcb == NULL) || (net == NULL)) {
1536                         return (EFAULT);
1537                 }
1538                 tmr = &net->rxt_timer;
1539                 break;
1540         case SCTP_TIMER_TYPE_INIT:
1541                 if ((stcb == NULL) || (net == NULL)) {
1542                         return (EFAULT);
1543                 }
1544                 tmr = &net->rxt_timer;
1545                 break;
1546         case SCTP_TIMER_TYPE_RECV:
1547                 if (stcb == NULL) {
1548                         return (EFAULT);
1549                 }
1550                 tmr = &stcb->asoc.dack_timer;
1551                 break;
1552         case SCTP_TIMER_TYPE_SHUTDOWN:
1553                 if ((stcb == NULL) || (net == NULL)) {
1554                         return (EFAULT);
1555                 }
1556                 tmr = &net->rxt_timer;
1557                 break;
1558         case SCTP_TIMER_TYPE_HEARTBEAT:
1559                 if (stcb == NULL) {
1560                         return (EFAULT);
1561                 }
1562                 tmr = &stcb->asoc.hb_timer;
1563                 break;
1564         case SCTP_TIMER_TYPE_COOKIE:
1565                 if ((stcb == NULL) || (net == NULL)) {
1566                         return (EFAULT);
1567                 }
1568                 tmr = &net->rxt_timer;
1569                 break;
1570         case SCTP_TIMER_TYPE_NEWCOOKIE:
1571                 /* nothing needed but the endpoint here */
1572                 tmr = &inp->sctp_ep.signature_change;
1573                 /* We re-use the newcookie timer for
1574                  * the INP kill timer. We must assure
1575                  * that we do not kill it by accident.
1576                  */
1577                 break;
1578         case SCTP_TIMER_TYPE_INPKILL:
1579                 /*
1580                  * The inp is setup to die. We re-use the
1581                  * signature_chage timer since that has
1582                  * stopped and we are in the GONE state.
1583                  */
1584                 tmr = &inp->sctp_ep.signature_change;
1585                 break;
1586         case SCTP_TIMER_TYPE_PATHMTURAISE:
1587                 if (stcb == NULL) {
1588                         return (EFAULT);
1589                 }
1590                 if (net == NULL) {
1591                         return (EFAULT);
1592                 }
1593                 tmr = &net->pmtu_timer;
1594                 break;
1595         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1596                 if ((stcb == NULL) || (net == NULL)) {
1597                         return (EFAULT);
1598                 }
1599                 tmr = &net->rxt_timer;
1600                 break;
1601         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1602                 if (stcb == NULL) {
1603                         return (EFAULT);
1604                 }
1605                 tmr = &stcb->asoc.shut_guard_timer;
1606                 break;
1607         case SCTP_TIMER_TYPE_STRRESET:
1608                 if (stcb == NULL) {
1609                         return (EFAULT);
1610                 }
1611                 tmr = &stcb->asoc.strreset_timer;
1612                 break;
1613         case SCTP_TIMER_TYPE_ASCONF:
1614                 if (stcb == NULL) {
1615                         return (EFAULT);
1616                 }
1617                 tmr = &stcb->asoc.asconf_timer;
1618                 break;
1619         case SCTP_TIMER_TYPE_AUTOCLOSE:
1620                 if (stcb == NULL) {
1621                         return (EFAULT);
1622                 }
1623                 tmr = &stcb->asoc.autoclose_timer;
1624                 break;
1625         default:
1626 #ifdef SCTP_DEBUG
1627                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1628                         kprintf("sctp_timer_stop:Unknown timer type %d\n",
1629                                t_type);
1630                 }
1631 #endif /* SCTP_DEBUG */
1632                 break;
1633         };
1634         if (tmr == NULL)
1635                 return (EFAULT);
1636
1637         if ((tmr->type != t_type) && tmr->type) {
1638                 /*
1639                  * Ok we have a timer that is under joint use. Cookie timer
1640                  * per chance with the SEND timer. We therefore are NOT
1641                  * running the timer that the caller wants stopped.  So just
1642                  * return.
1643                  */
1644                 return (0);
1645         }
1646         if (t_type == SCTP_TIMER_TYPE_SEND) {
1647                 stcb->asoc.num_send_timers_up--;
1648                 if (stcb->asoc.num_send_timers_up < 0) {
1649                         stcb->asoc.num_send_timers_up = 0;
1650                 }
1651         }
1652         callout_stop(&tmr->timer);
1653         return (0);
1654 }
1655
1656 #ifdef SCTP_USE_ADLER32
1657 static uint32_t
1658 update_adler32(uint32_t adler, uint8_t *buf, int32_t len)
1659 {
1660         u_int32_t s1 = adler & 0xffff;
1661         u_int32_t s2 = (adler >> 16) & 0xffff;
1662         int n;
1663
1664         for (n = 0; n < len; n++, buf++) {
1665                 /* s1 = (s1 + buf[n]) % BASE */
1666                 /* first we add */
1667                 s1 = (s1 + *buf);
1668                 /*
1669                  * now if we need to, we do a mod by subtracting. It seems
1670                  * a bit faster since I really will only ever do one subtract
1671                  * at the MOST, since buf[n] is a max of 255.
1672                  */
1673                 if (s1 >= SCTP_ADLER32_BASE) {
1674                         s1 -= SCTP_ADLER32_BASE;
1675                 }
1676                 /* s2 = (s2 + s1) % BASE */
1677                 /* first we add */
1678                 s2 = (s2 + s1);
1679                 /*
1680                  * again, it is more efficent (it seems) to subtract since
1681                  * the most s2 will ever be is (BASE-1 + BASE-1) in the worse
1682                  * case. This would then be (2 * BASE) - 2, which will still
1683                  * only do one subtract. On Intel this is much better to do
1684                  * this way and avoid the divide. Have not -pg'd on sparc.
1685                  */
1686                 if (s2 >= SCTP_ADLER32_BASE) {
1687                         s2 -= SCTP_ADLER32_BASE;
1688                 }
1689         }
1690         /* Return the adler32 of the bytes buf[0..len-1] */
1691         return ((s2 << 16) + s1);
1692 }
1693
1694 #endif
1695
1696
1697 u_int32_t
1698 sctp_calculate_len(struct mbuf *m)
1699 {
1700         u_int32_t tlen=0;
1701         struct mbuf *at;
1702         at = m;
1703         while (at) {
1704                 tlen += at->m_len;
1705                 at = at->m_next;
1706         }
1707         return (tlen);
1708 }
1709
1710 #if defined(SCTP_WITH_NO_CSUM)
1711
1712 uint32_t
1713 sctp_calculate_sum(struct mbuf *m, int32_t *pktlen, uint32_t offset)
1714 {
1715         /*
1716          * given a mbuf chain with a packetheader offset by 'offset'
1717          * pointing at a sctphdr (with csum set to 0) go through
1718          * the chain of m_next's and calculate the SCTP checksum.
1719          * This is currently Adler32 but will change to CRC32x
1720          * soon. Also has a side bonus calculate the total length
1721          * of the mbuf chain.
1722          * Note: if offset is greater than the total mbuf length,
1723          * checksum=1, pktlen=0 is returned (ie. no real error code)
1724          */
1725         if (pktlen == NULL)
1726                 return (0);
1727         *pktlen = sctp_calculate_len(m);
1728         return (0);
1729 }
1730
1731 #elif defined(SCTP_USE_INCHKSUM)
1732
1733 #include <machine/in_cksum.h>
1734
1735 uint32_t
1736 sctp_calculate_sum(struct mbuf *m, int32_t *pktlen, uint32_t offset)
1737 {
1738         /*
1739          * given a mbuf chain with a packetheader offset by 'offset'
1740          * pointing at a sctphdr (with csum set to 0) go through
1741          * the chain of m_next's and calculate the SCTP checksum.
1742          * This is currently Adler32 but will change to CRC32x
1743          * soon. Also has a side bonus calculate the total length
1744          * of the mbuf chain.
1745          * Note: if offset is greater than the total mbuf length,
1746          * checksum=1, pktlen=0 is returned (ie. no real error code)
1747          */
1748         int32_t tlen=0;
1749         struct mbuf *at;
1750         uint32_t the_sum, retsum;
1751
1752         at = m;
1753         while (at) {
1754                 tlen += at->m_len;
1755                 at = at->m_next;
1756         }
1757         the_sum = (uint32_t)(in_cksum_skip(m, tlen, offset));
1758         if (pktlen != NULL)
1759                 *pktlen = (tlen-offset);
1760         retsum = htons(the_sum);
1761         return (the_sum);
1762 }
1763
1764 #else
1765
1766 uint32_t
1767 sctp_calculate_sum(struct mbuf *m, int32_t *pktlen, uint32_t offset)
1768 {
1769         /*
1770          * given a mbuf chain with a packetheader offset by 'offset'
1771          * pointing at a sctphdr (with csum set to 0) go through
1772          * the chain of m_next's and calculate the SCTP checksum.
1773          * This is currently Adler32 but will change to CRC32x
1774          * soon. Also has a side bonus calculate the total length
1775          * of the mbuf chain.
1776          * Note: if offset is greater than the total mbuf length,
1777          * checksum=1, pktlen=0 is returned (ie. no real error code)
1778          */
1779         int32_t tlen=0;
1780 #ifdef SCTP_USE_ADLER32
1781         uint32_t base = 1L;
1782 #else
1783         uint32_t base = 0xffffffff;
1784 #endif /* SCTP_USE_ADLER32 */
1785         struct mbuf *at;
1786         at = m;
1787         /* find the correct mbuf and offset into mbuf */
1788         while ((at != NULL) && (offset > (uint32_t)at->m_len)) {
1789                 offset -= at->m_len;    /* update remaining offset left */
1790                 at = at->m_next;
1791         }
1792
1793         while (at != NULL) {
1794 #ifdef SCTP_USE_ADLER32
1795                 base = update_adler32(base, at->m_data + offset,
1796                     at->m_len - offset);
1797 #else
1798                 base = update_crc32(base, at->m_data + offset,
1799                     at->m_len - offset);
1800 #endif /* SCTP_USE_ADLER32 */
1801                 tlen += at->m_len - offset;
1802                 /* we only offset once into the first mbuf */
1803                 if (offset) {
1804                         offset = 0;
1805                 }
1806                 at = at->m_next;
1807         }
1808         if (pktlen != NULL) {
1809                 *pktlen = tlen;
1810         }
1811 #ifdef SCTP_USE_ADLER32
1812         /* Adler32 */
1813         base = htonl(base);
1814 #else
1815         /* CRC-32c */
1816         base = sctp_csum_finalize(base);
1817 #endif
1818         return (base);
1819 }
1820
1821
1822 #endif
1823
1824 void
1825 sctp_mtu_size_reset(struct sctp_inpcb *inp,
1826                     struct sctp_association *asoc, u_long mtu)
1827 {
1828         /*
1829          * Reset the P-MTU size on this association, this involves changing
1830          * the asoc MTU, going through ANY chunk+overhead larger than mtu
1831          * to allow the DF flag to be cleared.
1832          */
1833         struct sctp_tmit_chunk *chk;
1834         struct sctp_stream_out *strm;
1835         unsigned int eff_mtu, ovh;
1836         asoc->smallest_mtu = mtu;
1837         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1838                 ovh = SCTP_MIN_OVERHEAD;
1839         } else {
1840                 ovh = SCTP_MIN_V4_OVERHEAD;
1841         }
1842         eff_mtu = mtu - ovh;
1843         /* Now mark any chunks that need to let IP fragment */
1844         TAILQ_FOREACH(strm, &asoc->out_wheel, next_spoke) {
1845                 TAILQ_FOREACH(chk, &strm->outqueue, sctp_next) {
1846                         if (chk->send_size > eff_mtu) {
1847                                 chk->flags &= SCTP_DONT_FRAGMENT;
1848                                 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
1849                         }
1850                 }
1851         }
1852         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
1853                 if (chk->send_size > eff_mtu) {
1854                         chk->flags &= SCTP_DONT_FRAGMENT;
1855                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
1856                 }
1857         }
1858         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
1859                 if (chk->send_size > eff_mtu) {
1860                         chk->flags &= SCTP_DONT_FRAGMENT;
1861                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
1862                 }
1863         }
1864 }
1865
1866
1867 /*
1868  * given an association and starting time of the current RTT period
1869  * return RTO in number of usecs
1870  * net should point to the current network
1871  */
1872 u_int32_t
1873 sctp_calculate_rto(struct sctp_tcb *stcb,
1874                    struct sctp_association *asoc,
1875                    struct sctp_nets *net,
1876                    struct timeval *old)
1877 {
1878         /*
1879          * given an association and the starting time of the current RTT
1880          * period (in value1/value2) return RTO in number of usecs.
1881          */
1882         int calc_time = 0;
1883         int o_calctime;
1884         unsigned int new_rto = 0;
1885         int first_measure = 0;
1886         struct timeval now;
1887
1888         /************************/
1889         /* 1. calculate new RTT */
1890         /************************/
1891         /* get the current time */
1892         SCTP_GETTIME_TIMEVAL(&now);
1893         /* compute the RTT value */
1894         if ((u_long)now.tv_sec > (u_long)old->tv_sec) {
1895                 calc_time = ((u_long)now.tv_sec - (u_long)old->tv_sec) * 1000;
1896                 if ((u_long)now.tv_usec > (u_long)old->tv_usec) {
1897                         calc_time += (((u_long)now.tv_usec -
1898                                        (u_long)old->tv_usec)/1000);
1899                 } else if ((u_long)now.tv_usec < (u_long)old->tv_usec) {
1900                         /* Borrow 1,000ms from current calculation */
1901                         calc_time -= 1000;
1902                         /* Add in the slop over */
1903                         calc_time += ((int)now.tv_usec/1000);
1904                         /* Add in the pre-second ms's */
1905                         calc_time += (((int)1000000 - (int)old->tv_usec)/1000);
1906                 }
1907         } else if ((u_long)now.tv_sec == (u_long)old->tv_sec) {
1908                 if ((u_long)now.tv_usec > (u_long)old->tv_usec) {
1909                         calc_time = ((u_long)now.tv_usec -
1910                                      (u_long)old->tv_usec)/1000;
1911                 } else if ((u_long)now.tv_usec < (u_long)old->tv_usec) {
1912                         /* impossible .. garbage in nothing out */
1913                         return (((net->lastsa >> 2) + net->lastsv) >> 1);
1914                 } else {
1915                         /* impossible .. garbage in nothing out */
1916                         return (((net->lastsa >> 2) + net->lastsv) >> 1);
1917                 }
1918         } else {
1919                 /* Clock wrapped? */
1920                 return (((net->lastsa >> 2) + net->lastsv) >> 1);
1921         }
1922         /***************************/
1923         /* 2. update RTTVAR & SRTT */
1924         /***************************/
1925 #if 0
1926         /*      if (net->lastsv || net->lastsa) {*/
1927         /* per Section 5.3.1 C3 in SCTP */
1928         /*              net->lastsv = (int)     *//* RTTVAR */
1929         /*                      (((double)(1.0 - 0.25) * (double)net->lastsv) +
1930                                 (double)(0.25 * (double)abs(net->lastsa - calc_time)));
1931                                 net->lastsa = (int) */  /* SRTT */
1932         /*(((double)(1.0 - 0.125) * (double)net->lastsa) +
1933           (double)(0.125 * (double)calc_time));
1934           } else {
1935         *//* the first RTT calculation, per C2 Section 5.3.1 */
1936         /*              net->lastsa = calc_time;        *//* SRTT */
1937         /*              net->lastsv = calc_time / 2;    *//* RTTVAR */
1938         /*      }*/
1939         /* if RTTVAR goes to 0 you set to clock grainularity */
1940         /*      if (net->lastsv == 0) {
1941                 net->lastsv = SCTP_CLOCK_GRANULARITY;
1942                 }
1943                 new_rto = net->lastsa + 4 * net->lastsv;
1944         */
1945 #endif
1946         o_calctime = calc_time;
1947         /* this is Van Jacobson's integer version */
1948         if (net->RTO) {
1949                 calc_time -= (net->lastsa >> 3);
1950                 net->lastsa += calc_time;
1951                 if (calc_time < 0) {
1952                         calc_time = -calc_time;
1953                 }
1954                 calc_time -= (net->lastsv >> 2);
1955                 net->lastsv += calc_time;
1956                 if (net->lastsv == 0) {
1957                         net->lastsv = SCTP_CLOCK_GRANULARITY;
1958                 }
1959         } else {
1960                 /* First RTO measurment */
1961                 net->lastsa = calc_time;
1962                 net->lastsv = calc_time >> 1;
1963                 first_measure = 1;
1964         }
1965         new_rto = ((net->lastsa >> 2) + net->lastsv) >> 1;
1966         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
1967             (stcb->asoc.sat_network_lockout == 0)) {
1968                 stcb->asoc.sat_network = 1;
1969         } else  if ((!first_measure) && stcb->asoc.sat_network) {
1970                 stcb->asoc.sat_network = 0;
1971                 stcb->asoc.sat_network_lockout = 1;
1972         }
1973         /* bound it, per C6/C7 in Section 5.3.1 */
1974         if (new_rto < stcb->asoc.minrto) {
1975                 new_rto = stcb->asoc.minrto;
1976         }
1977         if (new_rto > stcb->asoc.maxrto) {
1978                 new_rto = stcb->asoc.maxrto;
1979         }
1980         /* we are now returning the RTT Smoothed */
1981         return ((u_int32_t)new_rto);
1982 }
1983
1984
1985 /*
1986  * return a pointer to a contiguous piece of data from the given
1987  * mbuf chain starting at 'off' for 'len' bytes.  If the desired
1988  * piece spans more than one mbuf, a copy is made at 'ptr'.
1989  * caller must ensure that the buffer size is >= 'len'
1990  * returns NULL if there there isn't 'len' bytes in the chain.
1991  */
1992 caddr_t
1993 sctp_m_getptr(struct mbuf *m, int off, int len, u_int8_t *in_ptr)
1994 {
1995         uint32_t count;
1996         uint8_t *ptr;
1997         ptr = in_ptr;
1998         if ((off < 0) || (len <= 0))
1999                 return (NULL);
2000
2001         /* find the desired start location */
2002         while ((m != NULL) && (off > 0)) {
2003                 if (off < m->m_len)
2004                         break;
2005                 off -= m->m_len;
2006                 m = m->m_next;
2007         }
2008         if (m == NULL)
2009                 return (NULL);
2010
2011         /* is the current mbuf large enough (eg. contiguous)? */
2012         if ((m->m_len - off) >= len) {
2013                 return (mtod(m, caddr_t) + off);
2014         } else {
2015                 /* else, it spans more than one mbuf, so save a temp copy... */
2016                 while ((m != NULL) && (len > 0)) {
2017                         count = min(m->m_len - off, len);
2018                         bcopy(mtod(m, caddr_t) + off, ptr, count);
2019                         len -= count;
2020                         ptr += count;
2021                         off = 0;
2022                         m = m->m_next;
2023                 }
2024                 if ((m == NULL) && (len > 0))
2025                         return (NULL);
2026                 else
2027                         return ((caddr_t)in_ptr);
2028         }
2029 }
2030
2031
2032 struct sctp_paramhdr *
2033 sctp_get_next_param(struct mbuf *m,
2034                     int offset,
2035                     struct sctp_paramhdr *pull,
2036                     int pull_limit)
2037 {
2038         /* This just provides a typed signature to Peter's Pull routine */
2039         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2040             (u_int8_t *)pull));
2041 }
2042
2043
2044 int
2045 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2046 {
2047         /*
2048          * add padlen bytes of 0 filled padding to the end of the mbuf.
2049          * If padlen is > 3 this routine will fail.
2050          */
2051         u_int8_t *dp;
2052         int i;
2053         if (padlen > 3) {
2054                 return (ENOBUFS);
2055         }
2056         if (M_TRAILINGSPACE(m)) {
2057                 /*
2058                  * The easy way.
2059                  * We hope the majority of the time we hit here :)
2060                  */
2061                 dp = (u_int8_t *)(mtod(m, caddr_t) + m->m_len);
2062                 m->m_len += padlen;
2063         } else {
2064                 /* Hard way we must grow the mbuf */
2065                 struct mbuf *tmp;
2066                 MGET(tmp, MB_DONTWAIT, MT_DATA);
2067                 if (tmp == NULL) {
2068                         /* Out of space GAK! we are in big trouble. */
2069                         return (ENOSPC);
2070                 }
2071                 /* setup and insert in middle */
2072                 tmp->m_next = m->m_next;
2073                 tmp->m_len = padlen;
2074                 m->m_next = tmp;
2075                 dp = mtod(tmp, u_int8_t *);
2076         }
2077         /* zero out the pad */
2078         for (i=  0; i < padlen; i++) {
2079                 *dp = 0;
2080                 dp++;
2081         }
2082         return (0);
2083 }
2084
2085 int
2086 sctp_pad_lastmbuf(struct mbuf *m, int padval)
2087 {
2088         /* find the last mbuf in chain and pad it */
2089         struct mbuf *m_at;
2090         m_at = m;
2091         while (m_at) {
2092                 if (m_at->m_next == NULL) {
2093                         return (sctp_add_pad_tombuf(m_at, padval));
2094                 }
2095                 m_at = m_at->m_next;
2096         }
2097         return (EFAULT);
2098 }
2099
2100 static void
2101 sctp_notify_assoc_change(u_int32_t event, struct sctp_tcb *stcb,
2102     u_int32_t error)
2103 {
2104         struct mbuf *m_notify;
2105         struct sctp_assoc_change *sac;
2106         struct sockaddr *to;
2107         struct sockaddr_in6 sin6, lsa6;
2108
2109         /*
2110          * First if we are are going down dump everything we
2111          * can to the socket rcv queue.
2112          */
2113         if ((event == SCTP_SHUTDOWN_COMP) || (event == SCTP_COMM_LOST)) {
2114                 sctp_deliver_data(stcb, &stcb->asoc, NULL, 0);
2115         }
2116
2117         /*
2118          * For TCP model AND UDP connected sockets we will send
2119          * an error up when an ABORT comes in.
2120          */
2121         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2122              (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2123             (event == SCTP_COMM_LOST)) {
2124                 stcb->sctp_socket->so_error = ECONNRESET;
2125                 /* Wake ANY sleepers */
2126                 sowwakeup(stcb->sctp_socket);
2127                 sorwakeup(stcb->sctp_socket);
2128         }
2129 #if 0
2130         if ((event == SCTP_COMM_UP) &&
2131             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
2132             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED)) {
2133                  soisconnected(stcb->sctp_socket);
2134         }
2135 #endif
2136         if (!(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2137                 /* event not enabled */
2138                 return;
2139         }
2140         MGETHDR(m_notify, MB_DONTWAIT, MT_DATA);
2141         if (m_notify == NULL)
2142                 /* no space left */
2143                 return;
2144         m_notify->m_len = 0;
2145
2146         sac = mtod(m_notify, struct sctp_assoc_change *);
2147         sac->sac_type = SCTP_ASSOC_CHANGE;
2148         sac->sac_flags = 0;
2149         sac->sac_length = sizeof(struct sctp_assoc_change);
2150         sac->sac_state = event;
2151         sac->sac_error = error;
2152         /* XXX verify these stream counts */
2153         sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2154         sac->sac_inbound_streams = stcb->asoc.streamincnt;
2155         sac->sac_assoc_id = sctp_get_associd(stcb);
2156
2157         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2158         m_notify->m_pkthdr.len = sizeof(struct sctp_assoc_change);
2159         m_notify->m_pkthdr.rcvif = 0;
2160         m_notify->m_len = sizeof(struct sctp_assoc_change);
2161         m_notify->m_next = NULL;
2162
2163         /* append to socket */
2164         to = (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr;
2165         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
2166             to->sa_family == AF_INET) {
2167                 struct sockaddr_in *sin;
2168
2169                 sin = (struct sockaddr_in *)to;
2170                 bzero(&sin6, sizeof(sin6));
2171                 sin6.sin6_family = AF_INET6;
2172                 sin6.sin6_len = sizeof(struct sockaddr_in6);
2173                 sin6.sin6_addr.s6_addr16[2] = 0xffff;
2174                 bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3],
2175                     sizeof(sin6.sin6_addr.s6_addr16[3]));
2176                 sin6.sin6_port = sin->sin_port;
2177                 to = (struct sockaddr *)&sin6;
2178         }
2179         /* check and strip embedded scope junk */
2180         to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
2181                                                    &lsa6);
2182         /*
2183          * We need to always notify comm changes.
2184          * if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2185          *      sctp_m_freem(m_notify);
2186          *      return;
2187          * }
2188         */
2189         SCTP_TCB_UNLOCK(stcb);
2190         SCTP_INP_WLOCK(stcb->sctp_ep);
2191         SCTP_TCB_LOCK(stcb);
2192         lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
2193         if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv,
2194             to, m_notify, NULL, stcb->asoc.my_vtag, stcb->sctp_ep)) {
2195                 /* not enough room */
2196                 sctp_m_freem(m_notify);
2197                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2198                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2199                 return;
2200         }
2201         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2202         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) &&
2203            ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)){
2204                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
2205                         stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2206                 }
2207         } else {
2208                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2209         }
2210         SCTP_INP_WUNLOCK(stcb->sctp_ep);
2211         /* Wake up any sleeper */
2212         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2213         sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
2214 }
2215
2216 static void
2217 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2218     struct sockaddr *sa, uint32_t error)
2219 {
2220         struct mbuf *m_notify;
2221         struct sctp_paddr_change *spc;
2222         struct sockaddr *to;
2223         struct sockaddr_in6 sin6, lsa6;
2224
2225         if (!(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVPADDREVNT))
2226                 /* event not enabled */
2227                 return;
2228
2229         MGETHDR(m_notify, MB_DONTWAIT, MT_DATA);
2230         if (m_notify == NULL)
2231                 return;
2232         m_notify->m_len = 0;
2233
2234         MCLGET(m_notify, MB_DONTWAIT);
2235         if ((m_notify->m_flags & M_EXT) != M_EXT) {
2236                 sctp_m_freem(m_notify);
2237                 return;
2238         }
2239
2240         spc = mtod(m_notify, struct sctp_paddr_change *);
2241         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2242         spc->spc_flags = 0;
2243         spc->spc_length = sizeof(struct sctp_paddr_change);
2244         if (sa->sa_family == AF_INET) {
2245                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2246         } else {
2247                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2248         }
2249         spc->spc_state = state;
2250         spc->spc_error = error;
2251         spc->spc_assoc_id = sctp_get_associd(stcb);
2252
2253         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2254         m_notify->m_pkthdr.len = sizeof(struct sctp_paddr_change);
2255         m_notify->m_pkthdr.rcvif = 0;
2256         m_notify->m_len = sizeof(struct sctp_paddr_change);
2257         m_notify->m_next = NULL;
2258
2259         to = (struct sockaddr *)(struct sockaddr *)
2260             &stcb->asoc.primary_destination->ro._l_addr;
2261         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
2262             to->sa_family == AF_INET) {
2263                 struct sockaddr_in *sin;
2264
2265                 sin = (struct sockaddr_in *)to;
2266                 bzero(&sin6, sizeof(sin6));
2267                 sin6.sin6_family = AF_INET6;
2268                 sin6.sin6_len = sizeof(struct sockaddr_in6);
2269                 sin6.sin6_addr.s6_addr16[2] = 0xffff;
2270                 bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3],
2271                     sizeof(sin6.sin6_addr.s6_addr16[3]));
2272                 sin6.sin6_port = sin->sin_port;
2273                 to = (struct sockaddr *)&sin6;
2274         }
2275         /* check and strip embedded scope junk */
2276         to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
2277             &lsa6);
2278
2279         if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2280                 sctp_m_freem(m_notify);
2281                 return;
2282         }
2283         /* append to socket */
2284         SCTP_TCB_UNLOCK(stcb);
2285         SCTP_INP_WLOCK(stcb->sctp_ep);
2286         SCTP_TCB_LOCK(stcb);
2287         lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
2288         if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, to,
2289             m_notify, NULL, stcb->asoc.my_vtag, stcb->sctp_ep)) {
2290                 /* not enough room */
2291                 sctp_m_freem(m_notify);
2292                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2293                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2294                 return;
2295         }
2296         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2297         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) &&
2298            ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)){
2299                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
2300                         stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2301                 }
2302         } else {
2303                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2304         }
2305         SCTP_INP_WUNLOCK(stcb->sctp_ep);
2306         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2307 }
2308
2309
2310 static void
2311 sctp_notify_send_failed(struct sctp_tcb *stcb, u_int32_t error,
2312                         struct sctp_tmit_chunk *chk)
2313 {
2314         struct mbuf *m_notify;
2315         struct sctp_send_failed *ssf;
2316         struct sockaddr_in6 sin6, lsa6;
2317         struct sockaddr *to;
2318         int length;
2319
2320         if (!(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVSENDFAILEVNT))
2321                 /* event not enabled */
2322                 return;
2323
2324         length = sizeof(struct sctp_send_failed) + chk->send_size;
2325         MGETHDR(m_notify, MB_DONTWAIT, MT_DATA);
2326         if (m_notify == NULL)
2327                 /* no space left */
2328                 return;
2329         m_notify->m_len = 0;
2330         ssf = mtod(m_notify, struct sctp_send_failed *);
2331         ssf->ssf_type = SCTP_SEND_FAILED;
2332         if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2333                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2334         else
2335                 ssf->ssf_flags = SCTP_DATA_SENT;
2336         ssf->ssf_length = length;
2337         ssf->ssf_error = error;
2338         /* not exactly what the user sent in, but should be close :) */
2339         ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number;
2340         ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq;
2341         ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2342         ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype;
2343         ssf->ssf_info.sinfo_context = chk->rec.data.context;
2344         ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2345         ssf->ssf_assoc_id = sctp_get_associd(stcb);
2346         m_notify->m_next = chk->data;
2347         if (m_notify->m_next == NULL)
2348                 m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2349         else {
2350                 struct mbuf *m;
2351                 m_notify->m_flags |= M_NOTIFICATION;
2352                 m = m_notify;
2353                 while (m->m_next != NULL)
2354                         m = m->m_next;
2355                 m->m_flags |= M_EOR;
2356         }
2357         m_notify->m_pkthdr.len = length;
2358         m_notify->m_pkthdr.rcvif = 0;
2359         m_notify->m_len = sizeof(struct sctp_send_failed);
2360
2361         /* Steal off the mbuf */
2362         chk->data = NULL;
2363         to = (struct sockaddr *)(struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr;
2364         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
2365             to->sa_family == AF_INET) {
2366                 struct sockaddr_in *sin;
2367
2368                 sin = (struct sockaddr_in *)to;
2369                 bzero(&sin6, sizeof(sin6));
2370                 sin6.sin6_family = AF_INET6;
2371                 sin6.sin6_len = sizeof(struct sockaddr_in6);
2372                 sin6.sin6_addr.s6_addr16[2] = 0xffff;
2373                 bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3],
2374                     sizeof(sin6.sin6_addr.s6_addr16[3]));
2375                 sin6.sin6_port = sin->sin_port;
2376                 to = (struct sockaddr *)&sin6;
2377         }
2378         /* check and strip embedded scope junk */
2379         to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
2380                                                    &lsa6);
2381
2382         if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2383                 sctp_m_freem(m_notify);
2384                 return;
2385         }
2386
2387         /* append to socket */
2388         SCTP_TCB_UNLOCK(stcb);
2389         SCTP_INP_WLOCK(stcb->sctp_ep);
2390         SCTP_TCB_LOCK(stcb);
2391         lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
2392         if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, to,
2393             m_notify, NULL, stcb->asoc.my_vtag, stcb->sctp_ep)) {
2394                 /* not enough room */
2395                 sctp_m_freem(m_notify);
2396                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2397                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2398                 return;
2399         }
2400         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2401         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) &&
2402            ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)){
2403                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
2404                         stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2405                 }
2406         } else {
2407                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2408         }
2409         SCTP_INP_WUNLOCK(stcb->sctp_ep);
2410         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2411 }
2412
2413 static void
2414 sctp_notify_adaption_layer(struct sctp_tcb *stcb,
2415                            u_int32_t error)
2416 {
2417         struct mbuf *m_notify;
2418         struct sctp_adaption_event *sai;
2419         struct sockaddr_in6 sin6, lsa6;
2420         struct sockaddr *to;
2421
2422         if (!(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT))
2423                 /* event not enabled */
2424                 return;
2425
2426         MGETHDR(m_notify, MB_DONTWAIT, MT_DATA);
2427         if (m_notify == NULL)
2428                 /* no space left */
2429                 return;
2430         m_notify->m_len = 0;
2431         sai = mtod(m_notify, struct sctp_adaption_event *);
2432         sai->sai_type = SCTP_ADAPTION_INDICATION;
2433         sai->sai_flags = 0;
2434         sai->sai_length = sizeof(struct sctp_adaption_event);
2435         sai->sai_adaption_ind = error;
2436         sai->sai_assoc_id = sctp_get_associd(stcb);
2437
2438         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2439         m_notify->m_pkthdr.len = sizeof(struct sctp_adaption_event);
2440         m_notify->m_pkthdr.rcvif = 0;
2441         m_notify->m_len = sizeof(struct sctp_adaption_event);
2442         m_notify->m_next = NULL;
2443
2444         to = (struct sockaddr *)(struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr;
2445         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
2446             (to->sa_family == AF_INET)) {
2447                 struct sockaddr_in *sin;
2448
2449                 sin = (struct sockaddr_in *)to;
2450                 bzero(&sin6, sizeof(sin6));
2451                 sin6.sin6_family = AF_INET6;
2452                 sin6.sin6_len = sizeof(struct sockaddr_in6);
2453                 sin6.sin6_addr.s6_addr16[2] = 0xffff;
2454                 bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3],
2455                     sizeof(sin6.sin6_addr.s6_addr16[3]));
2456                 sin6.sin6_port = sin->sin_port;
2457                 to = (struct sockaddr *)&sin6;
2458         }
2459         /* check and strip embedded scope junk */
2460         to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
2461                                                    &lsa6);
2462         if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2463                 sctp_m_freem(m_notify);
2464                 return;
2465         }
2466         /* append to socket */
2467         SCTP_TCB_UNLOCK(stcb);
2468         SCTP_INP_WLOCK(stcb->sctp_ep);
2469         SCTP_TCB_LOCK(stcb);
2470         lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
2471         if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, to,
2472             m_notify, NULL, stcb->asoc.my_vtag, stcb->sctp_ep)) {
2473                 /* not enough room */
2474                 sctp_m_freem(m_notify);
2475                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2476                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2477                 return;
2478         }
2479         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2480         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) &&
2481            ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)){
2482                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
2483                         stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2484                 }
2485         } else {
2486                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2487         }
2488         SCTP_INP_WUNLOCK(stcb->sctp_ep);
2489         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2490 }
2491
2492 static void
2493 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb,
2494                                         u_int32_t error)
2495 {
2496         struct mbuf *m_notify;
2497         struct sctp_pdapi_event *pdapi;
2498         struct sockaddr_in6 sin6, lsa6;
2499         struct sockaddr *to;
2500
2501         if (!(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_PDAPIEVNT))
2502                 /* event not enabled */
2503                 return;
2504
2505         MGETHDR(m_notify, MB_DONTWAIT, MT_DATA);
2506         if (m_notify == NULL)
2507                 /* no space left */
2508                 return;
2509         m_notify->m_len = 0;
2510         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
2511         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
2512         pdapi->pdapi_flags = 0;
2513         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
2514         pdapi->pdapi_indication = error;
2515         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
2516
2517         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2518         m_notify->m_pkthdr.len = sizeof(struct sctp_pdapi_event);
2519         m_notify->m_pkthdr.rcvif = 0;
2520         m_notify->m_len = sizeof(struct sctp_pdapi_event);
2521         m_notify->m_next = NULL;
2522
2523         to = (struct sockaddr *)(struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr;
2524         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
2525             (to->sa_family == AF_INET)) {
2526                 struct sockaddr_in *sin;
2527
2528                 sin = (struct sockaddr_in *)to;
2529                 bzero(&sin6, sizeof(sin6));
2530                 sin6.sin6_family = AF_INET6;
2531                 sin6.sin6_len = sizeof(struct sockaddr_in6);
2532                 sin6.sin6_addr.s6_addr16[2] = 0xffff;
2533                 bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3],
2534                     sizeof(sin6.sin6_addr.s6_addr16[3]));
2535                 sin6.sin6_port = sin->sin_port;
2536                 to = (struct sockaddr *)&sin6;
2537         }
2538         /* check and strip embedded scope junk */
2539         to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
2540                                                    &lsa6);
2541         if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2542                 sctp_m_freem(m_notify);
2543                 return;
2544         }
2545         /* append to socket */
2546         SCTP_TCB_UNLOCK(stcb);
2547         SCTP_INP_WLOCK(stcb->sctp_ep);
2548         SCTP_TCB_LOCK(stcb);
2549         lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
2550         if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, to,
2551             m_notify, NULL, stcb->asoc.my_vtag, stcb->sctp_ep)) {
2552                 /* not enough room */
2553                 sctp_m_freem(m_notify);
2554                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2555                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2556                 return;
2557         }
2558         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2559         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) &&
2560            ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)){
2561                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
2562                         stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2563                 }
2564         } else {
2565                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2566         }
2567         SCTP_INP_WUNLOCK(stcb->sctp_ep);
2568         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2569 }
2570
2571 static void
2572 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
2573 {
2574         struct mbuf *m_notify;
2575         struct sctp_shutdown_event *sse;
2576         struct sockaddr_in6 sin6, lsa6;
2577         struct sockaddr *to;
2578
2579         /*
2580          * For TCP model AND UDP connected sockets we will send
2581          * an error up when an SHUTDOWN completes
2582          */
2583         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2584             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2585                 /* mark socket closed for read/write and wakeup! */
2586                 socantrcvmore(stcb->sctp_socket);
2587                 socantsendmore(stcb->sctp_socket);
2588         }
2589
2590         if (!(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT))
2591                 /* event not enabled */
2592                 return;
2593
2594         MGETHDR(m_notify, MB_DONTWAIT, MT_DATA);
2595         if (m_notify == NULL)
2596                 /* no space left */
2597                 return;
2598         m_notify->m_len = 0;
2599         sse = mtod(m_notify, struct sctp_shutdown_event *);
2600         sse->sse_type = SCTP_SHUTDOWN_EVENT;
2601         sse->sse_flags = 0;
2602         sse->sse_length = sizeof(struct sctp_shutdown_event);
2603         sse->sse_assoc_id = sctp_get_associd(stcb);
2604
2605         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2606         m_notify->m_pkthdr.len = sizeof(struct sctp_shutdown_event);
2607         m_notify->m_pkthdr.rcvif = 0;
2608         m_notify->m_len = sizeof(struct sctp_shutdown_event);
2609         m_notify->m_next = NULL;
2610
2611         to = (struct sockaddr *)(struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr;
2612         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
2613             to->sa_family == AF_INET) {
2614                 struct sockaddr_in *sin;
2615
2616                 sin = (struct sockaddr_in *)to;
2617                 bzero(&sin6, sizeof(sin6));
2618                 sin6.sin6_family = AF_INET6;
2619                 sin6.sin6_len = sizeof(struct sockaddr_in6);
2620                 sin6.sin6_addr.s6_addr16[2] = 0xffff;
2621                 bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3],
2622                     sizeof(sin6.sin6_addr.s6_addr16[3]));
2623                 sin6.sin6_port = sin->sin_port;
2624                 to = (struct sockaddr *)&sin6;
2625         }
2626         /* check and strip embedded scope junk */
2627         to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
2628             &lsa6);
2629         if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2630                 sctp_m_freem(m_notify);
2631                 return;
2632         }
2633         /* append to socket */
2634         SCTP_TCB_UNLOCK(stcb);
2635         SCTP_INP_WLOCK(stcb->sctp_ep);
2636         SCTP_TCB_LOCK(stcb);
2637         lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
2638         if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, to,
2639             m_notify, NULL, stcb->asoc.my_vtag, stcb->sctp_ep)) {
2640                 /* not enough room */
2641                 sctp_m_freem(m_notify);
2642                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2643                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2644                 return;
2645         }
2646         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2647         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) &&
2648            ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)){
2649                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
2650                         stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2651                 }
2652         } else {
2653                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2654         }
2655         SCTP_INP_WUNLOCK(stcb->sctp_ep);
2656         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2657 }
2658
2659 static void
2660 sctp_notify_stream_reset(struct sctp_tcb *stcb,
2661     int number_entries, uint16_t *list, int flag)
2662 {
2663         struct mbuf *m_notify;
2664         struct sctp_stream_reset_event *strreset;
2665         struct sockaddr_in6 sin6, lsa6;
2666         struct sockaddr *to;
2667         int len;
2668
2669         if (!(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_STREAM_RESETEVNT))
2670                 /* event not enabled */
2671                 return;
2672
2673         MGETHDR(m_notify, MB_DONTWAIT, MT_DATA);
2674         if (m_notify == NULL)
2675                 /* no space left */
2676                 return;
2677         m_notify->m_len = 0;
2678         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
2679         if (len > M_TRAILINGSPACE(m_notify)) {
2680                 MCLGET(m_notify, MB_WAIT);
2681         }
2682         if (m_notify == NULL)
2683                 /* no clusters */
2684                 return;
2685
2686         if (len > M_TRAILINGSPACE(m_notify)) {
2687                 /* never enough room */
2688                 m_freem(m_notify);
2689                 return;
2690         }
2691         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
2692         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
2693         if (number_entries == 0) {
2694                 strreset->strreset_flags = flag | SCTP_STRRESET_ALL_STREAMS;
2695         } else {
2696                 strreset->strreset_flags = flag | SCTP_STRRESET_STREAM_LIST;
2697         }
2698         strreset->strreset_length = len;
2699         strreset->strreset_assoc_id = sctp_get_associd(stcb);
2700         if (number_entries) {
2701                 int i;
2702                 for (i=0; i<number_entries; i++) {
2703                         strreset->strreset_list[i] = list[i];
2704                 }
2705         }
2706         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2707         m_notify->m_pkthdr.len = len;
2708         m_notify->m_pkthdr.rcvif = 0;
2709         m_notify->m_len = len;
2710         m_notify->m_next = NULL;
2711         if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2712                 /* no space */
2713                 sctp_m_freem(m_notify);
2714                 return;
2715         }
2716         to = (struct sockaddr *)(struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr;
2717         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
2718             to->sa_family == AF_INET) {
2719                 struct sockaddr_in *sin;
2720
2721                 sin = (struct sockaddr_in *)to;
2722                 bzero(&sin6, sizeof(sin6));
2723                 sin6.sin6_family = AF_INET6;
2724                 sin6.sin6_len = sizeof(struct sockaddr_in6);
2725                 sin6.sin6_addr.s6_addr16[2] = 0xffff;
2726                 bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3],
2727                     sizeof(sin6.sin6_addr.s6_addr16[3]));
2728                 sin6.sin6_port = sin->sin_port;
2729                 to = (struct sockaddr *)&sin6;
2730         }
2731         /* check and strip embedded scope junk */
2732         to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
2733             &lsa6);
2734         /* append to socket */
2735         SCTP_TCB_UNLOCK(stcb);
2736         SCTP_INP_WLOCK(stcb->sctp_ep);
2737         SCTP_TCB_LOCK(stcb);
2738         lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
2739         if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, to,
2740             m_notify, NULL, stcb->asoc.my_vtag, stcb->sctp_ep)) {
2741                 /* not enough room */
2742                 sctp_m_freem(m_notify);
2743                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2744                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2745                 return;
2746         }
2747         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2748         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) &&
2749            ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)){
2750                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
2751                         stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2752                 }
2753         } else {
2754                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2755         }
2756         SCTP_INP_WUNLOCK(stcb->sctp_ep);
2757         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2758 }
2759
2760
2761 void
2762 sctp_ulp_notify(u_int32_t notification, struct sctp_tcb *stcb,
2763                 u_int32_t error, void *data)
2764 {
2765         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2766                 /* No notifications up when we are in a no socket state */
2767                 return;
2768         }
2769         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2770                 /* Can't send up to a closed socket any notifications */
2771                 return;
2772         }
2773         switch (notification) {
2774         case SCTP_NOTIFY_ASSOC_UP:
2775                 sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error);
2776                 break;
2777         case SCTP_NOTIFY_ASSOC_DOWN:
2778                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error);
2779                 break;
2780         case SCTP_NOTIFY_INTERFACE_DOWN:
2781         {
2782                 struct sctp_nets *net;
2783                 net = (struct sctp_nets *)data;
2784                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
2785                     (struct sockaddr *)&net->ro._l_addr, error);
2786                 break;
2787         }
2788         case SCTP_NOTIFY_INTERFACE_UP:
2789         {
2790                 struct sctp_nets *net;
2791                 net = (struct sctp_nets *)data;
2792                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
2793                     (struct sockaddr *)&net->ro._l_addr, error);
2794                 break;
2795         }
2796         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
2797         {
2798                 struct sctp_nets *net;
2799                 net = (struct sctp_nets *)data;
2800                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
2801                     (struct sockaddr *)&net->ro._l_addr, error);
2802                 break;
2803         }
2804         case SCTP_NOTIFY_DG_FAIL:
2805                 sctp_notify_send_failed(stcb, error,
2806                     (struct sctp_tmit_chunk *)data);
2807                 break;
2808         case SCTP_NOTIFY_ADAPTION_INDICATION:
2809                 /* Here the error is the adaption indication */
2810                 sctp_notify_adaption_layer(stcb, error);
2811                 break;
2812         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
2813                 sctp_notify_partial_delivery_indication(stcb, error);
2814                 break;
2815         case SCTP_NOTIFY_STRDATA_ERR:
2816                 break;
2817         case SCTP_NOTIFY_ASSOC_ABORTED:
2818                 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error);
2819                 break;
2820         case SCTP_NOTIFY_PEER_OPENED_STREAM:
2821                 break;
2822         case SCTP_NOTIFY_STREAM_OPENED_OK:
2823                 break;
2824         case SCTP_NOTIFY_ASSOC_RESTART:
2825                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error);
2826                 break;
2827         case SCTP_NOTIFY_HB_RESP:
2828                 break;
2829         case SCTP_NOTIFY_STR_RESET_SEND:
2830                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STRRESET_OUTBOUND_STR);
2831                 break;
2832         case SCTP_NOTIFY_STR_RESET_RECV:
2833                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STRRESET_INBOUND_STR);
2834                 break;
2835         case SCTP_NOTIFY_ASCONF_ADD_IP:
2836                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
2837                     error);
2838                 break;
2839         case SCTP_NOTIFY_ASCONF_DELETE_IP:
2840                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
2841                     error);
2842                 break;
2843         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
2844                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
2845                     error);
2846                 break;
2847         case SCTP_NOTIFY_ASCONF_SUCCESS:
2848                 break;
2849         case SCTP_NOTIFY_ASCONF_FAILED:
2850                 break;
2851         case SCTP_NOTIFY_PEER_SHUTDOWN:
2852                 sctp_notify_shutdown_event(stcb);
2853                 break;
2854         default:
2855 #ifdef SCTP_DEBUG
2856                 if (sctp_debug_on & SCTP_DEBUG_UTIL1) {
2857                         kprintf("NOTIFY: unknown notification %xh (%u)\n",
2858                             notification, notification);
2859                 }
2860 #endif /* SCTP_DEBUG */
2861                 break;
2862         } /* end switch */
2863 }
2864
2865 void
2866 sctp_report_all_outbound(struct sctp_tcb *stcb)
2867 {
2868         struct sctp_association *asoc;
2869         struct sctp_stream_out *outs;
2870         struct sctp_tmit_chunk *chk;
2871
2872         asoc = &stcb->asoc;
2873
2874         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2875                 return;
2876         }
2877         /* now through all the gunk freeing chunks */
2878         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
2879                 /* now clean up any chunks here */
2880                 chk = TAILQ_FIRST(&outs->outqueue);
2881                 while (chk) {
2882                         stcb->asoc.stream_queue_cnt--;
2883                         TAILQ_REMOVE(&outs->outqueue, chk, sctp_next);
2884                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
2885                             SCTP_NOTIFY_DATAGRAM_UNSENT, chk);
2886                         if (chk->data) {
2887                                 sctp_m_freem(chk->data);
2888                                 chk->data = NULL;
2889                         }
2890                         if (chk->whoTo)
2891                                 sctp_free_remote_addr(chk->whoTo);
2892                         chk->whoTo = NULL;
2893                         chk->asoc = NULL;
2894                         /* Free the chunk */
2895                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
2896                         sctppcbinfo.ipi_count_chunk--;
2897                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
2898                                 panic("Chunk count is negative");
2899                         }
2900                         sctppcbinfo.ipi_gencnt_chunk++;
2901                         chk = TAILQ_FIRST(&outs->outqueue);
2902                 }
2903         }
2904         /* pending send queue SHOULD be empty */
2905         if (!TAILQ_EMPTY(&asoc->send_queue)) {
2906                 chk = TAILQ_FIRST(&asoc->send_queue);
2907                 while (chk) {
2908                         TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
2909                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, SCTP_NOTIFY_DATAGRAM_UNSENT, chk);
2910                         if (chk->data) {
2911                                 sctp_m_freem(chk->data);
2912                                 chk->data = NULL;
2913                         }
2914                         if (chk->whoTo)
2915                                 sctp_free_remote_addr(chk->whoTo);
2916                         chk->whoTo = NULL;
2917                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
2918                         sctppcbinfo.ipi_count_chunk--;
2919                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
2920                                 panic("Chunk count is negative");
2921                         }
2922                         sctppcbinfo.ipi_gencnt_chunk++;
2923                         chk = TAILQ_FIRST(&asoc->send_queue);
2924                 }
2925         }
2926         /* sent queue SHOULD be empty */
2927         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
2928                 chk = TAILQ_FIRST(&asoc->sent_queue);
2929                 while (chk) {
2930                         TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
2931                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
2932                             SCTP_NOTIFY_DATAGRAM_SENT, chk);
2933                         if (chk->data) {
2934                                 sctp_m_freem(chk->data);
2935                                 chk->data = NULL;
2936                         }
2937                         if (chk->whoTo)
2938                                 sctp_free_remote_addr(chk->whoTo);
2939                         chk->whoTo = NULL;
2940                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
2941                         sctppcbinfo.ipi_count_chunk--;
2942                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
2943                                 panic("Chunk count is negative");
2944                         }
2945                         sctppcbinfo.ipi_gencnt_chunk++;
2946                         chk = TAILQ_FIRST(&asoc->sent_queue);
2947                 }
2948         }
2949 }
2950
2951 void
2952 sctp_abort_notification(struct sctp_tcb *stcb, int error)
2953 {
2954
2955         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2956                 return;
2957         }
2958         /* Tell them we lost the asoc */
2959         sctp_report_all_outbound(stcb);
2960         sctp_ulp_notify(SCTP_NOTIFY_ASSOC_ABORTED, stcb, error, NULL);
2961 }
2962
2963 void
2964 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2965     struct mbuf *m, int iphlen, struct sctphdr *sh, struct mbuf *op_err)
2966 {
2967         u_int32_t vtag;
2968
2969         vtag = 0;
2970         if (stcb != NULL) {
2971                 /* We have a TCB to abort, send notification too */
2972                 vtag = stcb->asoc.peer_vtag;
2973                 sctp_abort_notification(stcb, 0);
2974         }
2975         sctp_send_abort(m, iphlen, sh, vtag, op_err);
2976         if (stcb != NULL) {
2977                 /* Ok, now lets free it */
2978                 sctp_free_assoc(inp, stcb);
2979         } else {
2980                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2981                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
2982                                 sctp_inpcb_free(inp, 1);
2983                         }
2984                 }
2985         }
2986 }
2987
2988 void
2989 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2990     int error, struct mbuf *op_err)
2991 {
2992         u_int32_t vtag;
2993
2994         if (stcb == NULL) {
2995                 /* Got to have a TCB */
2996                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2997                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
2998                                 sctp_inpcb_free(inp, 1);
2999                         }
3000                 }
3001                 return;
3002         }
3003         vtag = stcb->asoc.peer_vtag;
3004         /* notify the ulp */
3005         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0)
3006                 sctp_abort_notification(stcb, error);
3007         /* notify the peer */
3008         sctp_send_abort_tcb(stcb, op_err);
3009         /* now free the asoc */
3010         sctp_free_assoc(inp, stcb);
3011 }
3012
3013 void
3014 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
3015     struct sctp_inpcb *inp, struct mbuf *op_err)
3016 {
3017         struct sctp_chunkhdr *ch, chunk_buf;
3018         unsigned int chk_length;
3019
3020         /* Generate a TO address for future reference */
3021         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
3022                 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3023                         sctp_inpcb_free(inp, 1);
3024                 }
3025         }
3026         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3027             sizeof(*ch), (u_int8_t *)&chunk_buf);
3028         while (ch != NULL) {
3029                 chk_length = ntohs(ch->chunk_length);
3030                 if (chk_length < sizeof(*ch)) {
3031                         /* break to abort land */
3032                         break;
3033                 }
3034                 switch (ch->chunk_type) {
3035                 case SCTP_PACKET_DROPPED:
3036                         /* we don't respond to pkt-dropped */
3037                         return;
3038                 case SCTP_ABORT_ASSOCIATION:
3039                         /* we don't respond with an ABORT to an ABORT */
3040                         return;
3041                 case SCTP_SHUTDOWN_COMPLETE:
3042                         /*
3043                          * we ignore it since we are not waiting for it
3044                          * and peer is gone
3045                          */
3046                         return;
3047                 case SCTP_SHUTDOWN_ACK:
3048                         sctp_send_shutdown_complete2(m, iphlen, sh);
3049                         return;
3050                 default:
3051                         break;
3052                 }
3053                 offset += SCTP_SIZE32(chk_length);
3054                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3055                     sizeof(*ch), (u_int8_t *)&chunk_buf);
3056         }
3057         sctp_send_abort(m, iphlen, sh, 0, op_err);
3058 }
3059
3060 /*
3061  * check the inbound datagram to make sure there is not an abort
3062  * inside it, if there is return 1, else return 0.
3063  */
3064 int
3065 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, int *vtagfill)
3066 {
3067         struct sctp_chunkhdr *ch;
3068         struct sctp_init_chunk *init_chk, chunk_buf;
3069         int offset;
3070         unsigned int chk_length;
3071
3072         offset = iphlen + sizeof(struct sctphdr);
3073         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
3074             (u_int8_t *)&chunk_buf);
3075         while (ch != NULL) {
3076                 chk_length = ntohs(ch->chunk_length);
3077                 if (chk_length < sizeof(*ch)) {
3078                         /* packet is probably corrupt */
3079                         break;
3080                 }
3081                 /* we seem to be ok, is it an abort? */
3082                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
3083                         /* yep, tell them */
3084                         return (1);
3085                 }
3086                 if (ch->chunk_type == SCTP_INITIATION) {
3087                         /* need to update the Vtag */
3088                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
3089                             offset, sizeof(*init_chk), (u_int8_t *)&chunk_buf);
3090                         if (init_chk != NULL) {
3091                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
3092                         }
3093                 }
3094                 /* Nope, move to the next chunk */
3095                 offset += SCTP_SIZE32(chk_length);
3096                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3097                     sizeof(*ch), (u_int8_t *)&chunk_buf);
3098         }
3099         return (0);
3100 }
3101
3102 /*
3103  * currently (2/02), ifa_addr embeds scope_id's and don't
3104  * have sin6_scope_id set (i.e. it's 0)
3105  * so, create this function to compare link local scopes
3106  */
3107 uint32_t
3108 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
3109 {
3110         struct sockaddr_in6 a, b;
3111
3112         /* save copies */
3113         a = *addr1;
3114         b = *addr2;
3115
3116         if (a.sin6_scope_id == 0)
3117                 if (in6_recoverscope(&a, &a.sin6_addr, NULL)) {
3118                         /* can't get scope, so can't match */
3119                         return (0);
3120                 }
3121         if (b.sin6_scope_id == 0)
3122                 if (in6_recoverscope(&b, &b.sin6_addr, NULL)) {
3123                         /* can't get scope, so can't match */
3124                         return (0);
3125                 }
3126         if (a.sin6_scope_id != b.sin6_scope_id)
3127                 return (0);
3128
3129         return (1);
3130 }
3131
3132 /*
3133  * returns a sockaddr_in6 with embedded scope recovered and removed
3134  */
3135 struct sockaddr_in6 *
3136 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
3137 {
3138
3139         /* check and strip embedded scope junk */
3140         if (addr->sin6_family == AF_INET6) {
3141                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
3142                         if (addr->sin6_scope_id == 0) {
3143                                 *store = *addr;
3144                                 if (!in6_recoverscope(store, &store->sin6_addr,
3145                                     NULL)) {
3146                                         /* use the recovered scope */
3147                                         addr = store;
3148                                 }
3149                                 /* else, return the original "to" addr */
3150                         }
3151                 }
3152         }
3153         return (addr);
3154 }
3155
3156 /*
3157  * are the two addresses the same?  currently a "scopeless" check
3158  * returns: 1 if same, 0 if not
3159  */
3160 int
3161 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
3162 {
3163
3164         /* must be valid */
3165         if (sa1 == NULL || sa2 == NULL)
3166                 return (0);
3167
3168         /* must be the same family */
3169         if (sa1->sa_family != sa2->sa_family)
3170                 return (0);
3171
3172         if (sa1->sa_family == AF_INET6) {
3173                 /* IPv6 addresses */
3174                 struct sockaddr_in6 *sin6_1, *sin6_2;
3175
3176                 sin6_1 = (struct sockaddr_in6 *)sa1;
3177                 sin6_2 = (struct sockaddr_in6 *)sa2;
3178                 return (SCTP6_ARE_ADDR_EQUAL(&sin6_1->sin6_addr,
3179                     &sin6_2->sin6_addr));
3180         } else if (sa1->sa_family == AF_INET) {
3181                 /* IPv4 addresses */
3182                 struct sockaddr_in *sin_1, *sin_2;
3183
3184                 sin_1 = (struct sockaddr_in *)sa1;
3185                 sin_2 = (struct sockaddr_in *)sa2;
3186                 return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
3187         } else {
3188                 /* we don't do these... */
3189                 return (0);
3190         }
3191 }
3192
3193 void
3194 sctp_print_address(struct sockaddr *sa)
3195 {
3196
3197         if (sa->sa_family == AF_INET6) {
3198                 struct sockaddr_in6 *sin6;
3199                 sin6 = (struct sockaddr_in6 *)sa;
3200                 kprintf("IPv6 address: %s:%d scope:%u\n",
3201                     ip6_sprintf(&sin6->sin6_addr), ntohs(sin6->sin6_port),
3202                     sin6->sin6_scope_id);
3203         } else if (sa->sa_family == AF_INET) {
3204                 struct sockaddr_in *sin;
3205                 sin = (struct sockaddr_in *)sa;
3206                 kprintf("IPv4 address: %s:%d\n", inet_ntoa(sin->sin_addr),
3207                     ntohs(sin->sin_port));
3208         } else {
3209                 kprintf("?\n");
3210         }
3211 }
3212
3213 void
3214 sctp_print_address_pkt(struct ip *iph, struct sctphdr *sh)
3215 {
3216         if (iph->ip_v == IPVERSION) {
3217                 struct sockaddr_in lsa, fsa;
3218
3219                 bzero(&lsa, sizeof(lsa));
3220                 lsa.sin_len = sizeof(lsa);
3221                 lsa.sin_family = AF_INET;
3222                 lsa.sin_addr = iph->ip_src;
3223                 lsa.sin_port = sh->src_port;
3224                 bzero(&fsa, sizeof(fsa));
3225                 fsa.sin_len = sizeof(fsa);
3226                 fsa.sin_family = AF_INET;
3227                 fsa.sin_addr = iph->ip_dst;
3228                 fsa.sin_port = sh->dest_port;
3229                 kprintf("src: ");
3230                 sctp_print_address((struct sockaddr *)&lsa);
3231                 kprintf("dest: ");
3232                 sctp_print_address((struct sockaddr *)&fsa);
3233         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3234                 struct ip6_hdr *ip6;
3235                 struct sockaddr_in6 lsa6, fsa6;
3236
3237                 ip6 = (struct ip6_hdr *)iph;
3238                 bzero(&lsa6, sizeof(lsa6));
3239                 lsa6.sin6_len = sizeof(lsa6);
3240                 lsa6.sin6_family = AF_INET6;
3241                 lsa6.sin6_addr = ip6->ip6_src;
3242                 lsa6.sin6_port = sh->src_port;
3243                 bzero(&fsa6, sizeof(fsa6));
3244                 fsa6.sin6_len = sizeof(fsa6);
3245                 fsa6.sin6_family = AF_INET6;
3246                 fsa6.sin6_addr = ip6->ip6_dst;
3247                 fsa6.sin6_port = sh->dest_port;
3248                 kprintf("src: ");
3249                 sctp_print_address((struct sockaddr *)&lsa6);
3250                 kprintf("dest: ");
3251                 sctp_print_address((struct sockaddr *)&fsa6);
3252         }
3253 }
3254
3255 #if defined(__FreeBSD__) || defined(__APPLE__)
3256
3257 /* cloned from uipc_socket.c */
3258
3259 #define SCTP_SBLINKRECORD(sb, m0) do {                                  \
3260         if ((sb)->sb_lastrecord != NULL)                                \
3261                 (sb)->sb_lastrecord->m_nextpkt = (m0);                  \
3262         else                                                            \
3263                 (sb)->sb_mb = (m0);                                     \
3264         (sb)->sb_lastrecord = (m0);                                     \
3265 } while (/*CONSTCOND*/0)
3266 #endif
3267
3268
3269 int
3270 sctp_sbappendaddr_nocheck(struct signalsockbuf *ssb, struct sockaddr *asa, struct mbuf *m0,
3271                      struct mbuf *control, u_int32_t tag,
3272                      struct sctp_inpcb *inp)
3273 {
3274         struct mbuf *m, *n, *nlast;
3275         int cnt=0;
3276
3277         if (m0 && (m0->m_flags & M_PKTHDR) == 0)
3278                 panic("sctp_sbappendaddr_nocheck");
3279
3280         for (n = control; n; n = n->m_next) {
3281                 if (n->m_next == 0)     /* get pointer to last control buf */
3282                         break;
3283         }
3284         if (((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) == 0) ||
3285             ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)== 0)) {
3286                 uint32_t len = asa->sa_len;     /* workaround GCC stupidity */
3287                 if (len > MHLEN)
3288                         return (0);
3289  try_again:
3290                 MGETHDR(m, MB_DONTWAIT, MT_SONAME);
3291                 if (m == 0)
3292                         return (0);
3293                 m->m_len = 0;
3294                 /* safety */
3295                 if (m == m0) {
3296                         kprintf("Duplicate mbuf allocated %p in and mget returned %p?\n",
3297                                m0, m);
3298                         if (cnt) {
3299                                 panic("more than once");
3300                         }
3301                         cnt++;
3302                         goto try_again;
3303                 }
3304                 m->m_len = asa->sa_len;
3305                 bcopy((caddr_t)asa, mtod(m, caddr_t), asa->sa_len);
3306         }
3307         else {
3308                 m = NULL;
3309         }
3310         if (n)
3311                 n->m_next = m0;         /* concatenate data to control */
3312         else
3313                 control = m0;
3314         if (m)
3315                 m->m_next = control;
3316         else
3317                 m = control;
3318         m->m_pkthdr.csum_data = (int)tag;
3319
3320         SOCKBUF_LOCK(ssb);
3321         for (n = m; n; n = n->m_next)
3322                 sballoc(&ssb->sb, n);
3323         nlast = n;
3324         if (ssb->ssb_mb == NULL) {
3325                 inp->sctp_vtag_first = tag;
3326         }
3327         if ((n = ssb->ssb_mb) != NULL) {
3328                 if ((n->m_nextpkt != inp->sb_last_mpkt) && (n->m_nextpkt == NULL)) {
3329                         inp->sb_last_mpkt = NULL;
3330                 }
3331                 if (inp->sb_last_mpkt)
3332                         inp->sb_last_mpkt->m_nextpkt = m;
3333                 else {
3334                         while (n->m_nextpkt) {
3335                                 n = n->m_nextpkt;
3336                         }
3337                         n->m_nextpkt = m;
3338                 }
3339                 inp->sb_last_mpkt = m;
3340         } else {
3341                 inp->sb_last_mpkt = ssb->ssb_mb = m;
3342                 inp->sctp_vtag_first = tag;
3343         }
3344         SOCKBUF_UNLOCK(ssb);
3345         return (1);
3346 }
3347
3348 /*************HOLD THIS COMMENT FOR PATCH FILE OF
3349  *************ALTERNATE ROUTING CODE
3350  */
3351
3352 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
3353  *************ALTERNATE ROUTING CODE
3354  */
3355
3356 struct mbuf *
3357 sctp_generate_invmanparam(int err)
3358 {
3359         /* Return a MBUF with a invalid mandatory parameter */
3360         struct mbuf *m;
3361
3362         MGET(m, MB_DONTWAIT, MT_DATA);
3363         if (m) {
3364                 struct sctp_paramhdr *ph;
3365                 m->m_len = sizeof(struct sctp_paramhdr);
3366                 ph = mtod(m, struct sctp_paramhdr *);
3367                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
3368                 ph->param_type = htons(err);
3369         }
3370         return (m);
3371 }
3372
3373 static int
3374 sctp_should_be_moved(struct mbuf *this, struct sctp_association *asoc)
3375 {
3376         struct mbuf *m;
3377         /*
3378          * given a mbuf chain, look through it finding
3379          * the M_PKTHDR and return 1 if it belongs to
3380          * the association given. We tell this by
3381          * a kludge where we stuff the my_vtag of the asoc
3382          * into the m->m_pkthdr.csum_data/csum field.
3383          */
3384         m = this;
3385         while (m) {
3386                 if (m->m_flags & M_PKTHDR) {
3387                         /* check it */
3388 #if defined(__OpenBSD__)
3389                         if ((u_int32_t)m->m_pkthdr.csum == asoc->my_vtag)
3390 #else
3391                         if ((u_int32_t)m->m_pkthdr.csum_data == asoc->my_vtag)
3392 #endif
3393                         {
3394                                 /* Yep */
3395                                 return (1);
3396                         }
3397                 }
3398                 m = m->m_next;
3399         }
3400         return (0);
3401 }
3402
3403 u_int32_t
3404 sctp_get_first_vtag_from_sb(struct socket *so)
3405 {
3406         struct mbuf *this, *at;
3407         u_int32_t retval;
3408
3409         retval = 0;
3410         lwkt_gettoken(&so->so_rcv.ssb_token);
3411         if (so->so_rcv.ssb_mb) {
3412                 /* grubbing time */
3413                 this = so->so_rcv.ssb_mb;
3414                 while (this) {
3415                         at = this;
3416                         /* get to the m_pkthdr */
3417                         while (at) {
3418                                 if (at->m_flags & M_PKTHDR)
3419                                         break;
3420                                 else {
3421                                         at = at->m_next;
3422                                 }
3423                         }
3424                         /* now do we have a m_pkthdr */
3425                         if (at && (at->m_flags & M_PKTHDR)) {
3426                                 /* check it */
3427 #if defined(__OpenBSD__)
3428                                 if ((u_int32_t)at->m_pkthdr.csum != 0)
3429 #else
3430                                 if ((u_int32_t)at->m_pkthdr.csum_data != 0)
3431 #endif
3432                                 {
3433                                         /* its the one */
3434 #if defined(__OpenBSD__)
3435                                         retval = (u_int32_t)at->m_pkthdr.csum;
3436 #else
3437                                         retval =
3438                                             (u_int32_t)at->m_pkthdr.csum_data;
3439 #endif
3440                                         break;
3441                                 }
3442                         }
3443                         this = this->m_nextpkt;
3444                 }
3445
3446         }
3447         lwkt_reltoken(&so->so_rcv.ssb_token);
3448         return (retval);
3449
3450 }
3451 void
3452 sctp_grub_through_socket_buffer(struct sctp_inpcb *inp, struct socket *old,
3453     struct socket *new, struct sctp_tcb *stcb)
3454 {
3455         struct mbuf **put, **take, *next, *this;
3456         struct signalsockbuf *old_sb, *new_sb;
3457         struct sctp_association *asoc;
3458         int moved_top = 0;
3459
3460         asoc = &stcb->asoc;
3461         old_sb = &old->so_rcv;
3462         new_sb = &new->so_rcv;
3463         if (old_sb->ssb_mb == NULL) {
3464                 /* Nothing to move */
3465                 return;
3466         }
3467         SOCKBUF_LOCK(old_sb);
3468         SOCKBUF_LOCK(new_sb);
3469         lwkt_gettoken(&old_sb->ssb_token);
3470         lwkt_gettoken(&new_sb->ssb_token);
3471
3472         if (inp->sctp_vtag_first == asoc->my_vtag) {
3473                 /* First one must be moved */
3474                 struct mbuf *mm;
3475                 for (mm = old_sb->ssb_mb; mm; mm = mm->m_next) {
3476                         /*
3477                          * Go down the chain and fix
3478                          * the space allocation of the
3479                          * two sockets.
3480                          */
3481                         sbfree(&old_sb->sb, mm);
3482                         sballoc(&new_sb->sb, mm);
3483                 }
3484                 new_sb->ssb_mb = old_sb->ssb_mb;
3485                 old_sb->ssb_mb = new_sb->ssb_mb->m_nextpkt;
3486                 new_sb->ssb_mb->m_nextpkt = NULL;
3487                 put = &new_sb->ssb_mb->m_nextpkt;
3488                 moved_top = 1;
3489         } else {
3490                 put = &new_sb->ssb_mb;
3491         }
3492
3493         take = &old_sb->ssb_mb;
3494         next = old_sb->ssb_mb;
3495         while (next) {
3496                 this = next;
3497                 /* postion for next one */
3498                 next = this->m_nextpkt;
3499                 /* check the tag of this packet */
3500                 if (sctp_should_be_moved(this, asoc)) {
3501                         /* yes this needs to be moved */
3502                         struct mbuf *mm;
3503                         *take = this->m_nextpkt;
3504                         this->m_nextpkt = NULL;
3505                         *put = this;
3506                         for (mm = this; mm; mm = mm->m_next) {
3507                                 /*
3508                                  * Go down the chain and fix
3509                                  * the space allocation of the
3510                                  * two sockets.
3511                                  */
3512                                 sbfree(&old_sb->sb, mm);
3513                                 sballoc(&new_sb->sb, mm);
3514                         }
3515                         put = &this->m_nextpkt;
3516
3517                 } else {
3518                         /* no advance our take point. */
3519                         take = &this->m_nextpkt;
3520                 }
3521         }
3522         if (moved_top) {
3523                 /*
3524                  * Ok so now we must re-postion vtag_first to
3525                  * match the new first one since we moved the
3526                  * mbuf at the top.
3527                  */
3528                 inp->sctp_vtag_first = sctp_get_first_vtag_from_sb(old);
3529         }
3530         lwkt_reltoken(&new_sb->ssb_token);
3531         lwkt_reltoken(&old_sb->ssb_token);
3532         SOCKBUF_UNLOCK(old_sb);
3533         SOCKBUF_UNLOCK(new_sb);
3534 }
3535
3536 void
3537 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
3538     struct sctp_tmit_chunk *tp1)
3539 {
3540         if (tp1->data == NULL) {
3541                 return;
3542         }
3543 #ifdef SCTP_MBCNT_LOGGING
3544         sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
3545                        asoc->total_output_queue_size,
3546                        tp1->book_size,
3547                        asoc->total_output_mbuf_queue_size,
3548                        tp1->mbcnt);
3549 #endif
3550         if (asoc->total_output_queue_size >= tp1->book_size) {
3551                 asoc->total_output_queue_size -= tp1->book_size;
3552         } else {
3553                 asoc->total_output_queue_size = 0;
3554         }
3555
3556         /* Now free the mbuf */
3557         if (asoc->total_output_mbuf_queue_size >= tp1->mbcnt) {
3558                 asoc->total_output_mbuf_queue_size -= tp1->mbcnt;
3559         } else {
3560                 asoc->total_output_mbuf_queue_size = 0;
3561         }
3562         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3563             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3564                 if (stcb->sctp_socket->so_snd.ssb_cc >= tp1->book_size) {
3565                         stcb->sctp_socket->so_snd.ssb_cc -= tp1->book_size;
3566                 } else {
3567                         stcb->sctp_socket->so_snd.ssb_cc = 0;
3568
3569                 }
3570                 if (stcb->sctp_socket->so_snd.ssb_mbcnt >= tp1->mbcnt) {
3571                         stcb->sctp_socket->so_snd.ssb_mbcnt -= tp1->mbcnt;
3572                 } else {
3573                         stcb->sctp_socket->so_snd.ssb_mbcnt = 0;
3574                 }
3575         }
3576 }
3577
3578 int
3579 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
3580     int reason, struct sctpchunk_listhead *queue)
3581 {
3582         int ret_sz = 0;
3583         int notdone;
3584         uint8_t foundeom = 0;
3585
3586         do {
3587                 ret_sz += tp1->book_size;
3588                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
3589                 if (tp1->data) {
3590                         sctp_free_bufspace(stcb, &stcb->asoc, tp1);
3591                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1);
3592                         sctp_m_freem(tp1->data);
3593                         tp1->data = NULL;
3594                         sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
3595                 }
3596                 if (tp1->flags & SCTP_PR_SCTP_BUFFER) {
3597                         stcb->asoc.sent_queue_cnt_removeable--;
3598                 }
3599                 if (queue == &stcb->asoc.send_queue) {
3600                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
3601                         /* on to the sent queue */
3602                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
3603                             sctp_next);
3604                         stcb->asoc.sent_queue_cnt++;
3605                 }
3606                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
3607                     SCTP_DATA_NOT_FRAG) {
3608                         /* not frag'ed we ae done   */
3609                         notdone = 0;
3610                         foundeom = 1;
3611                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
3612                         /* end of frag, we are done */
3613                         notdone = 0;
3614                         foundeom = 1;
3615                 } else {
3616                         /* Its a begin or middle piece, we must mark all of it */
3617                         notdone = 1;
3618                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3619                 }
3620         } while (tp1 && notdone);
3621         if ((foundeom == 0) && (queue == &stcb->asoc.sent_queue)) {
3622                 /*
3623                  * The multi-part message was scattered
3624                  * across the send and sent queue.
3625                  */
3626                 tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
3627                 /*
3628                  * recurse throught the send_queue too, starting at the
3629                  * beginning.
3630                  */
3631                 if (tp1) {
3632                         ret_sz += sctp_release_pr_sctp_chunk(stcb, tp1, reason,
3633                             &stcb->asoc.send_queue);
3634                 } else {
3635                         kprintf("hmm, nothing on the send queue and no EOM?\n");
3636                 }
3637         }
3638         return (ret_sz);
3639 }
3640
3641 /*
3642  * checks to see if the given address, sa, is one that is currently
3643  * known by the kernel
3644  * note: can't distinguish the same address on multiple interfaces and
3645  *       doesn't handle multiple addresses with different zone/scope id's
3646  * note: ifa_ifwithaddr() compares the entire sockaddr struct
3647  */
3648 struct ifaddr *
3649 sctp_find_ifa_by_addr(struct sockaddr *sa)
3650 {
3651         struct ifnet *ifn;
3652
3653         /* go through all our known interfaces */
3654         TAILQ_FOREACH(ifn, &ifnet, if_list) {
3655                 struct ifaddr_container *ifac;
3656
3657                 /* go through each interface addresses */
3658                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
3659                         struct ifaddr *ifa = ifac->ifa;
3660
3661                         /* correct family? */
3662                         if (ifa->ifa_addr->sa_family != sa->sa_family)
3663                                 continue;
3664
3665 #ifdef INET6
3666                         if (ifa->ifa_addr->sa_family == AF_INET6) {
3667                                 /* IPv6 address */
3668                                 struct sockaddr_in6 *sin1, *sin2, sin6_tmp;
3669                                 sin1 = (struct sockaddr_in6 *)ifa->ifa_addr;
3670                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin1->sin6_addr)) {
3671                                         /* create a copy and clear scope */
3672                                         memcpy(&sin6_tmp, sin1,
3673                                             sizeof(struct sockaddr_in6));
3674                                         sin1 = &sin6_tmp;
3675                                         in6_clearscope(&sin1->sin6_addr);
3676                                 }
3677                                 sin2 = (struct sockaddr_in6 *)sa;
3678                                 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr,
3679                                            sizeof(struct in6_addr)) == 0) {
3680                                         /* found it */
3681                                         return (ifa);
3682                                 }
3683                         } else
3684 #endif
3685                         if (ifa->ifa_addr->sa_family == AF_INET) {
3686                                 /* IPv4 address */
3687                                 struct sockaddr_in *sin1, *sin2;
3688                                 sin1 = (struct sockaddr_in *)ifa->ifa_addr;
3689                                 sin2 = (struct sockaddr_in *)sa;
3690                                 if (sin1->sin_addr.s_addr ==
3691                                     sin2->sin_addr.s_addr) {
3692                                         /* found it */
3693                                         return (ifa);
3694                                 }
3695                         }
3696                         /* else, not AF_INET or AF_INET6, so skip */
3697                 } /* end foreach ifa */
3698         } /* end foreach ifn */
3699         /* not found! */
3700         return (NULL);
3701 }
3702
3703
3704 #ifdef __APPLE__
3705 /*
3706  * here we hack in a fix for Apple's m_copym for the case where the first mbuf
3707  * in the chain is a M_PKTHDR and the length is zero
3708  */
3709 static void
3710 sctp_pkthdr_fix(struct mbuf *m)
3711 {
3712         struct mbuf *m_nxt;
3713
3714         if ((m->m_flags & M_PKTHDR) == 0) {
3715                 /* not a PKTHDR */
3716                 return;
3717         }
3718
3719         if (m->m_len != 0) {
3720                 /* not a zero length PKTHDR mbuf */
3721                 return;
3722         }
3723
3724         /* let's move in a word into the first mbuf... yes, ugly! */
3725         m_nxt = m->m_next;
3726         if (m_nxt == NULL) {
3727                 /* umm... not a very useful mbuf chain... */
3728                 return;
3729         }
3730         if ((size_t)m_nxt->m_len > sizeof(long)) {
3731                 /* move over a long */
3732                 bcopy(mtod(m_nxt, caddr_t), mtod(m, caddr_t), sizeof(long));
3733                 /* update mbuf data pointers and lengths */
3734                 m->m_len += sizeof(long);
3735                 m_nxt->m_data += sizeof(long);
3736                 m_nxt->m_len -= sizeof(long);
3737         }
3738 }
3739
3740 inline struct mbuf *
3741 sctp_m_copym(struct mbuf *m, int off, int len, int wait)
3742 {
3743         sctp_pkthdr_fix(m);
3744         return (m_copym(m, off, len, wait));
3745 }
3746 #endif /* __APPLE__ */