1f8829a4aSRandall Stewart /*- 2b1006367SRandall Stewart * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved. 3f8829a4aSRandall Stewart * 4f8829a4aSRandall Stewart * Redistribution and use in source and binary forms, with or without 5f8829a4aSRandall Stewart * modification, are permitted provided that the following conditions are met: 6f8829a4aSRandall Stewart * 7f8829a4aSRandall Stewart * a) Redistributions of source code must retain the above copyright notice, 8f8829a4aSRandall Stewart * this list of conditions and the following disclaimer. 9f8829a4aSRandall Stewart * 10f8829a4aSRandall Stewart * b) Redistributions in binary form must reproduce the above copyright 11f8829a4aSRandall Stewart * notice, this list of conditions and the following disclaimer in 12f8829a4aSRandall Stewart * the documentation and/or other materials provided with the distribution. 13f8829a4aSRandall Stewart * 14f8829a4aSRandall Stewart * c) Neither the name of Cisco Systems, Inc. nor the names of its 15f8829a4aSRandall Stewart * contributors may be used to endorse or promote products derived 16f8829a4aSRandall Stewart * from this software without specific prior written permission. 17f8829a4aSRandall Stewart * 18f8829a4aSRandall Stewart * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19f8829a4aSRandall Stewart * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 20f8829a4aSRandall Stewart * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21f8829a4aSRandall Stewart * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 22f8829a4aSRandall Stewart * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23f8829a4aSRandall Stewart * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24f8829a4aSRandall Stewart * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25f8829a4aSRandall Stewart * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26f8829a4aSRandall Stewart * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27f8829a4aSRandall Stewart * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 28f8829a4aSRandall Stewart * THE POSSIBILITY OF SUCH DAMAGE. 29f8829a4aSRandall Stewart */ 30f8829a4aSRandall Stewart 31f8829a4aSRandall Stewart /* $KAME: sctp_input.c,v 1.27 2005/03/06 16:04:17 itojun Exp $ */ 32f8829a4aSRandall Stewart 33f8829a4aSRandall Stewart #include <sys/cdefs.h> 34f8829a4aSRandall Stewart __FBSDID("$FreeBSD$"); 35f8829a4aSRandall Stewart 36f8829a4aSRandall Stewart #include <netinet/sctp_os.h> 37f8829a4aSRandall Stewart #include <netinet/sctp_var.h> 3842551e99SRandall Stewart #include <netinet/sctp_sysctl.h> 39f8829a4aSRandall Stewart #include <netinet/sctp_pcb.h> 40f8829a4aSRandall Stewart #include <netinet/sctp_header.h> 41f8829a4aSRandall Stewart #include <netinet/sctputil.h> 42f8829a4aSRandall Stewart #include <netinet/sctp_output.h> 43f8829a4aSRandall Stewart #include <netinet/sctp_input.h> 44f8829a4aSRandall Stewart #include <netinet/sctp_auth.h> 45f8829a4aSRandall Stewart #include <netinet/sctp_indata.h> 46f8829a4aSRandall Stewart #include <netinet/sctp_asconf.h> 47207304d4SRandall Stewart #include <netinet/sctp_bsd_addr.h> 48f8829a4aSRandall Stewart 49a5d547adSRandall Stewart 50a5d547adSRandall Stewart 51f8829a4aSRandall Stewart static void 52f8829a4aSRandall Stewart sctp_stop_all_cookie_timers(struct sctp_tcb *stcb) 53f8829a4aSRandall Stewart { 54f8829a4aSRandall Stewart struct sctp_nets *net; 55f8829a4aSRandall Stewart 56a5d547adSRandall Stewart /* 57a5d547adSRandall Stewart * This now not only stops all cookie timers it also stops any INIT 58a5d547adSRandall Stewart * timers as well. This will make sure that the timers are stopped 59a5d547adSRandall Stewart * in all collision cases. 60a5d547adSRandall Stewart */ 61f8829a4aSRandall Stewart SCTP_TCB_LOCK_ASSERT(stcb); 62f8829a4aSRandall Stewart TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 63a5d547adSRandall Stewart if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) { 64f8829a4aSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, 65f8829a4aSRandall Stewart stcb->sctp_ep, 66f8829a4aSRandall Stewart stcb, 67a5d547adSRandall Stewart net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1); 68a5d547adSRandall Stewart } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) { 69a5d547adSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_INIT, 70a5d547adSRandall Stewart stcb->sctp_ep, 71a5d547adSRandall Stewart stcb, 72a5d547adSRandall Stewart net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2); 73f8829a4aSRandall Stewart } 74f8829a4aSRandall Stewart } 75f8829a4aSRandall Stewart } 76f8829a4aSRandall Stewart 77f8829a4aSRandall Stewart /* INIT handler */ 78f8829a4aSRandall Stewart static void 79f8829a4aSRandall Stewart sctp_handle_init(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh, 80f8829a4aSRandall Stewart struct sctp_init_chunk *cp, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 8117205eccSRandall Stewart struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id, 8217205eccSRandall Stewart uint32_t table_id) 83f8829a4aSRandall Stewart { 84f8829a4aSRandall Stewart struct sctp_init *init; 85f8829a4aSRandall Stewart struct mbuf *op_err; 86f8829a4aSRandall Stewart uint32_t init_limit; 87f8829a4aSRandall Stewart 88ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n", 89ad81507eSRandall Stewart stcb); 90f8829a4aSRandall Stewart op_err = NULL; 91f8829a4aSRandall Stewart init = &cp->init; 92f8829a4aSRandall Stewart /* First are we accepting? */ 93f8829a4aSRandall Stewart if ((inp->sctp_socket->so_qlimit == 0) && (stcb == NULL)) { 94ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 95ad81507eSRandall Stewart "sctp_handle_init: Abort, so_qlimit:%d\n", 96ad81507eSRandall Stewart inp->sctp_socket->so_qlimit); 97f8829a4aSRandall Stewart /* 98f8829a4aSRandall Stewart * FIX ME ?? What about TCP model and we have a 99f8829a4aSRandall Stewart * match/restart case? 100f8829a4aSRandall Stewart */ 10117205eccSRandall Stewart sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 10217205eccSRandall Stewart vrf_id, table_id); 103bff64a4dSRandall Stewart if (stcb) 104bff64a4dSRandall Stewart *abort_no_unlock = 1; 105f8829a4aSRandall Stewart return; 106f8829a4aSRandall Stewart } 107f8829a4aSRandall Stewart if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) { 108f8829a4aSRandall Stewart /* Invalid length */ 109f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 11017205eccSRandall Stewart sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 11117205eccSRandall Stewart vrf_id, table_id); 112bff64a4dSRandall Stewart if (stcb) 113bff64a4dSRandall Stewart *abort_no_unlock = 1; 114f8829a4aSRandall Stewart return; 115f8829a4aSRandall Stewart } 116f8829a4aSRandall Stewart /* validate parameters */ 117f8829a4aSRandall Stewart if (init->initiate_tag == 0) { 118f8829a4aSRandall Stewart /* protocol error... send abort */ 119f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 12017205eccSRandall Stewart sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 12117205eccSRandall Stewart vrf_id, table_id); 122bff64a4dSRandall Stewart if (stcb) 123bff64a4dSRandall Stewart *abort_no_unlock = 1; 124f8829a4aSRandall Stewart return; 125f8829a4aSRandall Stewart } 126f8829a4aSRandall Stewart if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) { 127f8829a4aSRandall Stewart /* invalid parameter... send abort */ 128f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 12917205eccSRandall Stewart sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 13017205eccSRandall Stewart vrf_id, table_id); 131f8829a4aSRandall Stewart return; 132f8829a4aSRandall Stewart } 133f8829a4aSRandall Stewart if (init->num_inbound_streams == 0) { 134f8829a4aSRandall Stewart /* protocol error... send abort */ 135f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 13617205eccSRandall Stewart sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 13717205eccSRandall Stewart vrf_id, table_id); 138bff64a4dSRandall Stewart if (stcb) 139bff64a4dSRandall Stewart *abort_no_unlock = 1; 140f8829a4aSRandall Stewart return; 141f8829a4aSRandall Stewart } 142f8829a4aSRandall Stewart if (init->num_outbound_streams == 0) { 143f8829a4aSRandall Stewart /* protocol error... send abort */ 144f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 14517205eccSRandall Stewart sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 14617205eccSRandall Stewart vrf_id, table_id); 147bff64a4dSRandall Stewart if (stcb) 148bff64a4dSRandall Stewart *abort_no_unlock = 1; 149f8829a4aSRandall Stewart return; 150f8829a4aSRandall Stewart } 151f8829a4aSRandall Stewart init_limit = offset + ntohs(cp->ch.chunk_length); 152f8829a4aSRandall Stewart if (sctp_validate_init_auth_params(m, offset + sizeof(*cp), 153f8829a4aSRandall Stewart init_limit)) { 154f8829a4aSRandall Stewart /* auth parameter(s) error... send abort */ 15517205eccSRandall Stewart sctp_abort_association(inp, stcb, m, iphlen, sh, NULL, vrf_id, 15617205eccSRandall Stewart table_id); 157bff64a4dSRandall Stewart if (stcb) 158bff64a4dSRandall Stewart *abort_no_unlock = 1; 159f8829a4aSRandall Stewart return; 160f8829a4aSRandall Stewart } 161f8829a4aSRandall Stewart /* send an INIT-ACK w/cookie */ 162ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n"); 16317205eccSRandall Stewart sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp, vrf_id, 16417205eccSRandall Stewart table_id); 165f8829a4aSRandall Stewart } 166f8829a4aSRandall Stewart 167f8829a4aSRandall Stewart /* 168f8829a4aSRandall Stewart * process peer "INIT/INIT-ACK" chunk returns value < 0 on error 169f8829a4aSRandall Stewart */ 170f8829a4aSRandall Stewart static int 171f8829a4aSRandall Stewart sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb, 172f8829a4aSRandall Stewart struct sctp_nets *net) 173f8829a4aSRandall Stewart { 174f8829a4aSRandall Stewart struct sctp_init *init; 175f8829a4aSRandall Stewart struct sctp_association *asoc; 176f8829a4aSRandall Stewart struct sctp_nets *lnet; 177f8829a4aSRandall Stewart unsigned int i; 178f8829a4aSRandall Stewart 179f8829a4aSRandall Stewart init = &cp->init; 180f8829a4aSRandall Stewart asoc = &stcb->asoc; 181f8829a4aSRandall Stewart /* save off parameters */ 182f8829a4aSRandall Stewart asoc->peer_vtag = ntohl(init->initiate_tag); 183f8829a4aSRandall Stewart asoc->peers_rwnd = ntohl(init->a_rwnd); 184f8829a4aSRandall Stewart if (TAILQ_FIRST(&asoc->nets)) { 185f8829a4aSRandall Stewart /* update any ssthresh's that may have a default */ 186f8829a4aSRandall Stewart TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 187f8829a4aSRandall Stewart lnet->ssthresh = asoc->peers_rwnd; 188f8829a4aSRandall Stewart 189f8829a4aSRandall Stewart #if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING) 190f8829a4aSRandall Stewart sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION); 191f8829a4aSRandall Stewart #endif 192f8829a4aSRandall Stewart 193f8829a4aSRandall Stewart } 194f8829a4aSRandall Stewart } 1956a91f103SRandall Stewart SCTP_TCB_SEND_LOCK(stcb); 196f8829a4aSRandall Stewart if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) { 197f8829a4aSRandall Stewart unsigned int newcnt; 198f8829a4aSRandall Stewart struct sctp_stream_out *outs; 199f8829a4aSRandall Stewart struct sctp_stream_queue_pending *sp; 200f8829a4aSRandall Stewart 201f8829a4aSRandall Stewart /* cut back on number of streams */ 202f8829a4aSRandall Stewart newcnt = ntohs(init->num_inbound_streams); 203f8829a4aSRandall Stewart /* This if is probably not needed but I am cautious */ 204f8829a4aSRandall Stewart if (asoc->strmout) { 205f8829a4aSRandall Stewart /* First make sure no data chunks are trapped */ 206f8829a4aSRandall Stewart for (i = newcnt; i < asoc->pre_open_streams; i++) { 207f8829a4aSRandall Stewart outs = &asoc->strmout[i]; 208f8829a4aSRandall Stewart sp = TAILQ_FIRST(&outs->outqueue); 209f8829a4aSRandall Stewart while (sp) { 210f8829a4aSRandall Stewart TAILQ_REMOVE(&outs->outqueue, sp, 211f8829a4aSRandall Stewart next); 212f8829a4aSRandall Stewart asoc->stream_queue_cnt--; 213f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, 214f8829a4aSRandall Stewart stcb, SCTP_NOTIFY_DATAGRAM_UNSENT, 215f8829a4aSRandall Stewart sp); 216f8829a4aSRandall Stewart if (sp->data) { 217f8829a4aSRandall Stewart sctp_m_freem(sp->data); 218f8829a4aSRandall Stewart sp->data = NULL; 219f8829a4aSRandall Stewart } 220f8829a4aSRandall Stewart sctp_free_remote_addr(sp->net); 221f8829a4aSRandall Stewart sp->net = NULL; 222f8829a4aSRandall Stewart /* Free the chunk */ 223ad81507eSRandall Stewart SCTP_PRINTF("sp:%p tcb:%p weird free case\n", 224e349e6b8SRuslan Ermilov sp, stcb); 225f8829a4aSRandall Stewart 226f8829a4aSRandall Stewart sctp_free_a_strmoq(stcb, sp); 2273c503c28SRandall Stewart /* sa_ignore FREED_MEMORY */ 228f8829a4aSRandall Stewart sp = TAILQ_FIRST(&outs->outqueue); 229f8829a4aSRandall Stewart } 230f8829a4aSRandall Stewart } 231f8829a4aSRandall Stewart } 232f8829a4aSRandall Stewart /* cut back the count and abandon the upper streams */ 233f8829a4aSRandall Stewart asoc->pre_open_streams = newcnt; 234f8829a4aSRandall Stewart } 2356a91f103SRandall Stewart SCTP_TCB_SEND_UNLOCK(stcb); 236f8829a4aSRandall Stewart asoc->streamoutcnt = asoc->pre_open_streams; 237f8829a4aSRandall Stewart /* init tsn's */ 238f8829a4aSRandall Stewart asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1; 239f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING 240f8829a4aSRandall Stewart sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 241f8829a4aSRandall Stewart #endif 242f8829a4aSRandall Stewart /* This is the next one we expect */ 243f8829a4aSRandall Stewart asoc->str_reset_seq_in = asoc->asconf_seq_in + 1; 244f8829a4aSRandall Stewart 245f8829a4aSRandall Stewart asoc->mapping_array_base_tsn = ntohl(init->initial_tsn); 246f8829a4aSRandall Stewart asoc->cumulative_tsn = asoc->asconf_seq_in; 247f8829a4aSRandall Stewart asoc->last_echo_tsn = asoc->asconf_seq_in; 248f8829a4aSRandall Stewart asoc->advanced_peer_ack_point = asoc->last_acked_seq; 249f8829a4aSRandall Stewart /* open the requested streams */ 250207304d4SRandall Stewart 251f8829a4aSRandall Stewart if (asoc->strmin != NULL) { 252f8829a4aSRandall Stewart /* Free the old ones */ 2536a91f103SRandall Stewart struct sctp_queued_to_read *ctl; 2546a91f103SRandall Stewart 2556a91f103SRandall Stewart for (i = 0; i < asoc->streamincnt; i++) { 2566a91f103SRandall Stewart ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 2576a91f103SRandall Stewart while (ctl) { 2586a91f103SRandall Stewart TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next); 2596a91f103SRandall Stewart sctp_free_remote_addr(ctl->whoFrom); 2606a91f103SRandall Stewart sctp_m_freem(ctl->data); 2616a91f103SRandall Stewart ctl->data = NULL; 2626a91f103SRandall Stewart sctp_free_a_readq(stcb, ctl); 2636a91f103SRandall Stewart ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 2646a91f103SRandall Stewart } 2656a91f103SRandall Stewart } 266207304d4SRandall Stewart SCTP_FREE(asoc->strmin, SCTP_M_STRMI); 267f8829a4aSRandall Stewart } 2686a91f103SRandall Stewart asoc->streamincnt = ntohs(init->num_outbound_streams); 2696a91f103SRandall Stewart if (asoc->streamincnt > MAX_SCTP_STREAMS) { 2706a91f103SRandall Stewart asoc->streamincnt = MAX_SCTP_STREAMS; 2716a91f103SRandall Stewart } 272f8829a4aSRandall Stewart SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt * 273207304d4SRandall Stewart sizeof(struct sctp_stream_in), SCTP_M_STRMI); 274f8829a4aSRandall Stewart if (asoc->strmin == NULL) { 275f8829a4aSRandall Stewart /* we didn't get memory for the streams! */ 276ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n"); 277f8829a4aSRandall Stewart return (-1); 278f8829a4aSRandall Stewart } 279f8829a4aSRandall Stewart for (i = 0; i < asoc->streamincnt; i++) { 280f8829a4aSRandall Stewart asoc->strmin[i].stream_no = i; 281f8829a4aSRandall Stewart asoc->strmin[i].last_sequence_delivered = 0xffff; 282f8829a4aSRandall Stewart /* 283f8829a4aSRandall Stewart * U-stream ranges will be set when the cookie is unpacked. 284f8829a4aSRandall Stewart * Or for the INIT sender they are un set (if pr-sctp not 285f8829a4aSRandall Stewart * supported) when the INIT-ACK arrives. 286f8829a4aSRandall Stewart */ 287f8829a4aSRandall Stewart TAILQ_INIT(&asoc->strmin[i].inqueue); 2889a6142d8SRandall Stewart asoc->strmin[i].delivery_started = 0; 289f8829a4aSRandall Stewart } 290f8829a4aSRandall Stewart /* 291f8829a4aSRandall Stewart * load_address_from_init will put the addresses into the 292f8829a4aSRandall Stewart * association when the COOKIE is processed or the INIT-ACK is 293f8829a4aSRandall Stewart * processed. Both types of COOKIE's existing and new call this 294f8829a4aSRandall Stewart * routine. It will remove addresses that are no longer in the 295f8829a4aSRandall Stewart * association (for the restarting case where addresses are 296f8829a4aSRandall Stewart * removed). Up front when the INIT arrives we will discard it if it 297f8829a4aSRandall Stewart * is a restart and new addresses have been added. 298f8829a4aSRandall Stewart */ 2993c503c28SRandall Stewart /* sa_ignore MEMLEAK */ 300f8829a4aSRandall Stewart return (0); 301f8829a4aSRandall Stewart } 302f8829a4aSRandall Stewart 303f8829a4aSRandall Stewart /* 304f8829a4aSRandall Stewart * INIT-ACK message processing/consumption returns value < 0 on error 305f8829a4aSRandall Stewart */ 306f8829a4aSRandall Stewart static int 307f8829a4aSRandall Stewart sctp_process_init_ack(struct mbuf *m, int iphlen, int offset, 308f8829a4aSRandall Stewart struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 30917205eccSRandall Stewart struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id, 31017205eccSRandall Stewart uint32_t table_id) 311f8829a4aSRandall Stewart { 312f8829a4aSRandall Stewart struct sctp_association *asoc; 313f8829a4aSRandall Stewart struct mbuf *op_err; 314f8829a4aSRandall Stewart int retval, abort_flag; 315f8829a4aSRandall Stewart uint32_t initack_limit; 316f8829a4aSRandall Stewart 317f8829a4aSRandall Stewart /* First verify that we have no illegal param's */ 318f8829a4aSRandall Stewart abort_flag = 0; 319f8829a4aSRandall Stewart op_err = NULL; 320f8829a4aSRandall Stewart 321f8829a4aSRandall Stewart op_err = sctp_arethere_unrecognized_parameters(m, 322f8829a4aSRandall Stewart (offset + sizeof(struct sctp_init_chunk)), 323f8829a4aSRandall Stewart &abort_flag, (struct sctp_chunkhdr *)cp); 324f8829a4aSRandall Stewart if (abort_flag) { 325f8829a4aSRandall Stewart /* Send an abort and notify peer */ 326d61a0ae0SRandall Stewart sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_CAUSE_PROTOCOL_VIOLATION, op_err); 327bff64a4dSRandall Stewart *abort_no_unlock = 1; 328f8829a4aSRandall Stewart return (-1); 329f8829a4aSRandall Stewart } 330f8829a4aSRandall Stewart asoc = &stcb->asoc; 331f8829a4aSRandall Stewart /* process the peer's parameters in the INIT-ACK */ 332f8829a4aSRandall Stewart retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net); 333f8829a4aSRandall Stewart if (retval < 0) { 334f8829a4aSRandall Stewart return (retval); 335f8829a4aSRandall Stewart } 336f8829a4aSRandall Stewart initack_limit = offset + ntohs(cp->ch.chunk_length); 337f8829a4aSRandall Stewart /* load all addresses */ 338f8829a4aSRandall Stewart if ((retval = sctp_load_addresses_from_init(stcb, m, iphlen, 339f8829a4aSRandall Stewart (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh, 340f8829a4aSRandall Stewart NULL))) { 341f8829a4aSRandall Stewart /* Huh, we should abort */ 342ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, 343ad81507eSRandall Stewart "Load addresses from INIT causes an abort %d\n", 344ad81507eSRandall Stewart retval); 345f8829a4aSRandall Stewart sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 34617205eccSRandall Stewart NULL, 0, 0); 347bff64a4dSRandall Stewart *abort_no_unlock = 1; 348f8829a4aSRandall Stewart return (-1); 349f8829a4aSRandall Stewart } 350f8829a4aSRandall Stewart stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs, 351f8829a4aSRandall Stewart stcb->asoc.local_hmacs); 352f8829a4aSRandall Stewart if (op_err) { 353f8829a4aSRandall Stewart sctp_queue_op_err(stcb, op_err); 354f8829a4aSRandall Stewart /* queuing will steal away the mbuf chain to the out queue */ 355f8829a4aSRandall Stewart op_err = NULL; 356f8829a4aSRandall Stewart } 357f8829a4aSRandall Stewart /* extract the cookie and queue it to "echo" it back... */ 358f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 359f8829a4aSRandall Stewart net->error_count = 0; 360f8829a4aSRandall Stewart 361f8829a4aSRandall Stewart /* 362f8829a4aSRandall Stewart * Cancel the INIT timer, We do this first before queueing the 363f8829a4aSRandall Stewart * cookie. We always cancel at the primary to assue that we are 364f8829a4aSRandall Stewart * canceling the timer started by the INIT which always goes to the 365f8829a4aSRandall Stewart * primary. 366f8829a4aSRandall Stewart */ 367f8829a4aSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb, 368a5d547adSRandall Stewart asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4); 369a5d547adSRandall Stewart 370a5d547adSRandall Stewart /* calculate the RTO */ 371a5d547adSRandall Stewart net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered); 372f8829a4aSRandall Stewart 373f8829a4aSRandall Stewart retval = sctp_send_cookie_echo(m, offset, stcb, net); 374f8829a4aSRandall Stewart if (retval < 0) { 375f8829a4aSRandall Stewart /* 376f8829a4aSRandall Stewart * No cookie, we probably should send a op error. But in any 377f8829a4aSRandall Stewart * case if there is no cookie in the INIT-ACK, we can 378f8829a4aSRandall Stewart * abandon the peer, its broke. 379f8829a4aSRandall Stewart */ 380f8829a4aSRandall Stewart if (retval == -3) { 381f8829a4aSRandall Stewart /* We abort with an error of missing mandatory param */ 382f8829a4aSRandall Stewart op_err = 383f8829a4aSRandall Stewart sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM); 384f8829a4aSRandall Stewart if (op_err) { 385f8829a4aSRandall Stewart /* 386f8829a4aSRandall Stewart * Expand beyond to include the mandatory 387f8829a4aSRandall Stewart * param cookie 388f8829a4aSRandall Stewart */ 389f8829a4aSRandall Stewart struct sctp_inv_mandatory_param *mp; 390f8829a4aSRandall Stewart 391139bc87fSRandall Stewart SCTP_BUF_LEN(op_err) = 392f8829a4aSRandall Stewart sizeof(struct sctp_inv_mandatory_param); 393f8829a4aSRandall Stewart mp = mtod(op_err, 394f8829a4aSRandall Stewart struct sctp_inv_mandatory_param *); 395f8829a4aSRandall Stewart /* Subtract the reserved param */ 396f8829a4aSRandall Stewart mp->length = 397f8829a4aSRandall Stewart htons(sizeof(struct sctp_inv_mandatory_param) - 2); 398f8829a4aSRandall Stewart mp->num_param = htonl(1); 399f8829a4aSRandall Stewart mp->param = htons(SCTP_STATE_COOKIE); 400f8829a4aSRandall Stewart mp->resv = 0; 401f8829a4aSRandall Stewart } 402f8829a4aSRandall Stewart sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 40317205eccSRandall Stewart sh, op_err, 0, 0); 404bff64a4dSRandall Stewart *abort_no_unlock = 1; 405f8829a4aSRandall Stewart } 406f8829a4aSRandall Stewart return (retval); 407f8829a4aSRandall Stewart } 408f8829a4aSRandall Stewart return (0); 409f8829a4aSRandall Stewart } 410f8829a4aSRandall Stewart 411f8829a4aSRandall Stewart static void 412f8829a4aSRandall Stewart sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp, 413f8829a4aSRandall Stewart struct sctp_tcb *stcb, struct sctp_nets *net) 414f8829a4aSRandall Stewart { 415f8829a4aSRandall Stewart struct sockaddr_storage store; 416f8829a4aSRandall Stewart struct sockaddr_in *sin; 417f8829a4aSRandall Stewart struct sockaddr_in6 *sin6; 418f8829a4aSRandall Stewart struct sctp_nets *r_net; 419f8829a4aSRandall Stewart struct timeval tv; 420f8829a4aSRandall Stewart 421f8829a4aSRandall Stewart if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) { 422f8829a4aSRandall Stewart /* Invalid length */ 423f8829a4aSRandall Stewart return; 424f8829a4aSRandall Stewart } 425f8829a4aSRandall Stewart sin = (struct sockaddr_in *)&store; 426f8829a4aSRandall Stewart sin6 = (struct sockaddr_in6 *)&store; 427f8829a4aSRandall Stewart 428f8829a4aSRandall Stewart memset(&store, 0, sizeof(store)); 429f8829a4aSRandall Stewart if (cp->heartbeat.hb_info.addr_family == AF_INET && 430f8829a4aSRandall Stewart cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) { 431f8829a4aSRandall Stewart sin->sin_family = cp->heartbeat.hb_info.addr_family; 432f8829a4aSRandall Stewart sin->sin_len = cp->heartbeat.hb_info.addr_len; 433f8829a4aSRandall Stewart sin->sin_port = stcb->rport; 434f8829a4aSRandall Stewart memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address, 435f8829a4aSRandall Stewart sizeof(sin->sin_addr)); 436f8829a4aSRandall Stewart } else if (cp->heartbeat.hb_info.addr_family == AF_INET6 && 437f8829a4aSRandall Stewart cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) { 438f8829a4aSRandall Stewart sin6->sin6_family = cp->heartbeat.hb_info.addr_family; 439f8829a4aSRandall Stewart sin6->sin6_len = cp->heartbeat.hb_info.addr_len; 440f8829a4aSRandall Stewart sin6->sin6_port = stcb->rport; 441f8829a4aSRandall Stewart memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address, 442f8829a4aSRandall Stewart sizeof(sin6->sin6_addr)); 443f8829a4aSRandall Stewart } else { 444f8829a4aSRandall Stewart return; 445f8829a4aSRandall Stewart } 446f8829a4aSRandall Stewart r_net = sctp_findnet(stcb, (struct sockaddr *)sin); 447f8829a4aSRandall Stewart if (r_net == NULL) { 448ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n"); 449f8829a4aSRandall Stewart return; 450f8829a4aSRandall Stewart } 451f8829a4aSRandall Stewart if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) && 452f8829a4aSRandall Stewart (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) && 453f8829a4aSRandall Stewart (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) { 454f8829a4aSRandall Stewart /* 455f8829a4aSRandall Stewart * If the its a HB and it's random value is correct when can 456f8829a4aSRandall Stewart * confirm the destination. 457f8829a4aSRandall Stewart */ 458f8829a4aSRandall Stewart r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 45942551e99SRandall Stewart if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) { 46042551e99SRandall Stewart stcb->asoc.primary_destination = r_net; 46142551e99SRandall Stewart r_net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY; 46242551e99SRandall Stewart r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY; 46342551e99SRandall Stewart r_net = TAILQ_FIRST(&stcb->asoc.nets); 46442551e99SRandall Stewart if (r_net != stcb->asoc.primary_destination) { 46542551e99SRandall Stewart /* 46642551e99SRandall Stewart * first one on the list is NOT the primary 46742551e99SRandall Stewart * sctp_cmpaddr() is much more efficent if 46842551e99SRandall Stewart * the primary is the first on the list, 46942551e99SRandall Stewart * make it so. 47042551e99SRandall Stewart */ 47142551e99SRandall Stewart TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next); 47242551e99SRandall Stewart TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next); 47342551e99SRandall Stewart } 47442551e99SRandall Stewart } 475f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 476f8829a4aSRandall Stewart stcb, 0, (void *)r_net); 477f8829a4aSRandall Stewart } 478f8829a4aSRandall Stewart r_net->error_count = 0; 479f8829a4aSRandall Stewart r_net->hb_responded = 1; 480f8829a4aSRandall Stewart tv.tv_sec = cp->heartbeat.hb_info.time_value_1; 481f8829a4aSRandall Stewart tv.tv_usec = cp->heartbeat.hb_info.time_value_2; 482f8829a4aSRandall Stewart if (r_net->dest_state & SCTP_ADDR_NOT_REACHABLE) { 483f8829a4aSRandall Stewart r_net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE; 484f8829a4aSRandall Stewart r_net->dest_state |= SCTP_ADDR_REACHABLE; 485f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb, 486f8829a4aSRandall Stewart SCTP_HEARTBEAT_SUCCESS, (void *)r_net); 487f8829a4aSRandall Stewart /* now was it the primary? if so restore */ 488f8829a4aSRandall Stewart if (r_net->dest_state & SCTP_ADDR_WAS_PRIMARY) { 489ad81507eSRandall Stewart (void)sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, r_net); 490f8829a4aSRandall Stewart } 491f8829a4aSRandall Stewart } 492f8829a4aSRandall Stewart /* Now lets do a RTO with this */ 493f8829a4aSRandall Stewart r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv); 494f8829a4aSRandall Stewart } 495f8829a4aSRandall Stewart 496f8829a4aSRandall Stewart static void 497f8829a4aSRandall Stewart sctp_handle_abort(struct sctp_abort_chunk *cp, 498f8829a4aSRandall Stewart struct sctp_tcb *stcb, struct sctp_nets *net) 499f8829a4aSRandall Stewart { 500ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n"); 501f8829a4aSRandall Stewart if (stcb == NULL) 502f8829a4aSRandall Stewart return; 503f8829a4aSRandall Stewart 504f8829a4aSRandall Stewart /* stop any receive timers */ 505a5d547adSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5); 506f8829a4aSRandall Stewart /* notify user of the abort and clean up... */ 507f8829a4aSRandall Stewart sctp_abort_notification(stcb, 0); 508f8829a4aSRandall Stewart /* free the tcb */ 509f8829a4aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_aborted); 510f8829a4aSRandall Stewart if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) || 511f8829a4aSRandall Stewart (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 512f8829a4aSRandall Stewart SCTP_STAT_DECR_GAUGE32(sctps_currestab); 513f8829a4aSRandall Stewart } 514f1f73e57SRandall Stewart #ifdef SCTP_ASOCLOG_OF_TSNS 515f1f73e57SRandall Stewart sctp_print_out_track_log(stcb); 516f1f73e57SRandall Stewart #endif 517a5d547adSRandall Stewart sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6); 518ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n"); 519f8829a4aSRandall Stewart } 520f8829a4aSRandall Stewart 521f8829a4aSRandall Stewart static void 522f8829a4aSRandall Stewart sctp_handle_shutdown(struct sctp_shutdown_chunk *cp, 523f8829a4aSRandall Stewart struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag) 524f8829a4aSRandall Stewart { 525f8829a4aSRandall Stewart struct sctp_association *asoc; 526f8829a4aSRandall Stewart int some_on_streamwheel; 527f8829a4aSRandall Stewart 528ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 529ad81507eSRandall Stewart "sctp_handle_shutdown: handling SHUTDOWN\n"); 530f8829a4aSRandall Stewart if (stcb == NULL) 531f8829a4aSRandall Stewart return; 532a5d547adSRandall Stewart asoc = &stcb->asoc; 533a5d547adSRandall Stewart if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 534a5d547adSRandall Stewart (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 535f8829a4aSRandall Stewart return; 536f8829a4aSRandall Stewart } 537f8829a4aSRandall Stewart if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) { 538f8829a4aSRandall Stewart /* Shutdown NOT the expected size */ 539f8829a4aSRandall Stewart return; 540f8829a4aSRandall Stewart } else { 541f8829a4aSRandall Stewart sctp_update_acked(stcb, cp, net, abort_flag); 542f8829a4aSRandall Stewart } 543a5d547adSRandall Stewart if (asoc->control_pdapi) { 544f8829a4aSRandall Stewart /* 545f8829a4aSRandall Stewart * With a normal shutdown we assume the end of last record. 546f8829a4aSRandall Stewart */ 547f8829a4aSRandall Stewart SCTP_INP_READ_LOCK(stcb->sctp_ep); 548a5d547adSRandall Stewart asoc->control_pdapi->end_added = 1; 549a5d547adSRandall Stewart asoc->control_pdapi->pdapi_aborted = 1; 550a5d547adSRandall Stewart asoc->control_pdapi = NULL; 551f8829a4aSRandall Stewart SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 55250cec919SRandall Stewart sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 553f8829a4aSRandall Stewart } 554f8829a4aSRandall Stewart /* goto SHUTDOWN_RECEIVED state to block new requests */ 555f8829a4aSRandall Stewart if (stcb->sctp_socket) { 556f8829a4aSRandall Stewart if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 557d61a0ae0SRandall Stewart (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) && 558f8829a4aSRandall Stewart (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 559f8829a4aSRandall Stewart asoc->state = SCTP_STATE_SHUTDOWN_RECEIVED; 560f8829a4aSRandall Stewart /* 561f8829a4aSRandall Stewart * notify upper layer that peer has initiated a 562f8829a4aSRandall Stewart * shutdown 563f8829a4aSRandall Stewart */ 564f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL); 565f8829a4aSRandall Stewart 566f8829a4aSRandall Stewart /* reset time */ 5676e55db54SRandall Stewart (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 568f8829a4aSRandall Stewart } 569f8829a4aSRandall Stewart } 570f8829a4aSRandall Stewart if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) { 571f8829a4aSRandall Stewart /* 572f8829a4aSRandall Stewart * stop the shutdown timer, since we WILL move to 573f8829a4aSRandall Stewart * SHUTDOWN-ACK-SENT. 574f8829a4aSRandall Stewart */ 575a5d547adSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_7); 576f8829a4aSRandall Stewart } 577f8829a4aSRandall Stewart /* Now are we there yet? */ 578f8829a4aSRandall Stewart some_on_streamwheel = 0; 579f8829a4aSRandall Stewart if (!TAILQ_EMPTY(&asoc->out_wheel)) { 580f8829a4aSRandall Stewart /* Check to see if some data queued */ 581f8829a4aSRandall Stewart struct sctp_stream_out *outs; 582f8829a4aSRandall Stewart 583f8829a4aSRandall Stewart TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 584f8829a4aSRandall Stewart if (!TAILQ_EMPTY(&outs->outqueue)) { 585f8829a4aSRandall Stewart some_on_streamwheel = 1; 586f8829a4aSRandall Stewart break; 587f8829a4aSRandall Stewart } 588f8829a4aSRandall Stewart } 589f8829a4aSRandall Stewart } 590f8829a4aSRandall Stewart if (!TAILQ_EMPTY(&asoc->send_queue) || 591f8829a4aSRandall Stewart !TAILQ_EMPTY(&asoc->sent_queue) || 592f8829a4aSRandall Stewart some_on_streamwheel) { 593f8829a4aSRandall Stewart /* By returning we will push more data out */ 594f8829a4aSRandall Stewart return; 595f8829a4aSRandall Stewart } else { 596f8829a4aSRandall Stewart /* no outstanding data to send, so move on... */ 597f8829a4aSRandall Stewart /* send SHUTDOWN-ACK */ 598f8829a4aSRandall Stewart sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 599f8829a4aSRandall Stewart /* move to SHUTDOWN-ACK-SENT state */ 600f42a358aSRandall Stewart if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) || 601f42a358aSRandall Stewart (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 602f8829a4aSRandall Stewart SCTP_STAT_DECR_GAUGE32(sctps_currestab); 603f8829a4aSRandall Stewart } 604f8829a4aSRandall Stewart asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT; 605f8829a4aSRandall Stewart 606f8829a4aSRandall Stewart /* start SHUTDOWN timer */ 607f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, 608f8829a4aSRandall Stewart stcb, net); 609f8829a4aSRandall Stewart } 610f8829a4aSRandall Stewart } 611f8829a4aSRandall Stewart 612f8829a4aSRandall Stewart static void 613f8829a4aSRandall Stewart sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp, 614f8829a4aSRandall Stewart struct sctp_tcb *stcb, struct sctp_nets *net) 615f8829a4aSRandall Stewart { 616f8829a4aSRandall Stewart struct sctp_association *asoc; 617f8829a4aSRandall Stewart 618ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 619ad81507eSRandall Stewart "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n"); 620f8829a4aSRandall Stewart if (stcb == NULL) 621f8829a4aSRandall Stewart return; 622f8829a4aSRandall Stewart 623f8829a4aSRandall Stewart asoc = &stcb->asoc; 624f8829a4aSRandall Stewart /* process according to association state */ 625f8829a4aSRandall Stewart if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 626f8829a4aSRandall Stewart (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 627f8829a4aSRandall Stewart /* unexpected SHUTDOWN-ACK... so ignore... */ 628f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(stcb); 629f8829a4aSRandall Stewart return; 630f8829a4aSRandall Stewart } 631a5d547adSRandall Stewart if (asoc->control_pdapi) { 632f8829a4aSRandall Stewart /* 633f8829a4aSRandall Stewart * With a normal shutdown we assume the end of last record. 634f8829a4aSRandall Stewart */ 635f8829a4aSRandall Stewart SCTP_INP_READ_LOCK(stcb->sctp_ep); 636a5d547adSRandall Stewart asoc->control_pdapi->end_added = 1; 637a5d547adSRandall Stewart asoc->control_pdapi->pdapi_aborted = 1; 638a5d547adSRandall Stewart asoc->control_pdapi = NULL; 639f8829a4aSRandall Stewart SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 64050cec919SRandall Stewart sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 641f8829a4aSRandall Stewart } 642f8829a4aSRandall Stewart /* are the queues empty? */ 643f8829a4aSRandall Stewart if (!TAILQ_EMPTY(&asoc->send_queue) || 644f8829a4aSRandall Stewart !TAILQ_EMPTY(&asoc->sent_queue) || 645f8829a4aSRandall Stewart !TAILQ_EMPTY(&asoc->out_wheel)) { 6467f34832bSRandall Stewart sctp_report_all_outbound(stcb, 0); 647f8829a4aSRandall Stewart } 648f8829a4aSRandall Stewart /* stop the timer */ 649a5d547adSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8); 650f8829a4aSRandall Stewart /* send SHUTDOWN-COMPLETE */ 651f8829a4aSRandall Stewart sctp_send_shutdown_complete(stcb, net); 652f8829a4aSRandall Stewart /* notify upper layer protocol */ 653f8829a4aSRandall Stewart if (stcb->sctp_socket) { 654f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 655f8829a4aSRandall Stewart if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 656f8829a4aSRandall Stewart (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 657f8829a4aSRandall Stewart /* Set the connected flag to disconnected */ 658f8829a4aSRandall Stewart stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 659f8829a4aSRandall Stewart } 660f8829a4aSRandall Stewart } 661f8829a4aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 662f8829a4aSRandall Stewart /* free the TCB but first save off the ep */ 663a5d547adSRandall Stewart sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, 664a5d547adSRandall Stewart SCTP_FROM_SCTP_INPUT + SCTP_LOC_9); 665f8829a4aSRandall Stewart } 666f8829a4aSRandall Stewart 667f8829a4aSRandall Stewart /* 668f8829a4aSRandall Stewart * Skip past the param header and then we will find the chunk that caused the 669f8829a4aSRandall Stewart * problem. There are two possiblities ASCONF or FWD-TSN other than that and 670f8829a4aSRandall Stewart * our peer must be broken. 671f8829a4aSRandall Stewart */ 672f8829a4aSRandall Stewart static void 673f8829a4aSRandall Stewart sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr, 674f8829a4aSRandall Stewart struct sctp_nets *net) 675f8829a4aSRandall Stewart { 676f8829a4aSRandall Stewart struct sctp_chunkhdr *chk; 677f8829a4aSRandall Stewart 678f8829a4aSRandall Stewart chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr)); 679f8829a4aSRandall Stewart switch (chk->chunk_type) { 680f8829a4aSRandall Stewart case SCTP_ASCONF_ACK: 681f8829a4aSRandall Stewart case SCTP_ASCONF: 682f8829a4aSRandall Stewart sctp_asconf_cleanup(stcb, net); 683f8829a4aSRandall Stewart break; 684f8829a4aSRandall Stewart case SCTP_FORWARD_CUM_TSN: 685f8829a4aSRandall Stewart stcb->asoc.peer_supports_prsctp = 0; 686f8829a4aSRandall Stewart break; 687f8829a4aSRandall Stewart default: 688ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 689ad81507eSRandall Stewart "Peer does not support chunk type %d(%x)??\n", 690f8829a4aSRandall Stewart chk->chunk_type, (uint32_t) chk->chunk_type); 691f8829a4aSRandall Stewart break; 692f8829a4aSRandall Stewart } 693f8829a4aSRandall Stewart } 694f8829a4aSRandall Stewart 695f8829a4aSRandall Stewart /* 696f8829a4aSRandall Stewart * Skip past the param header and then we will find the param that caused the 697f8829a4aSRandall Stewart * problem. There are a number of param's in a ASCONF OR the prsctp param 698f8829a4aSRandall Stewart * these will turn of specific features. 699f8829a4aSRandall Stewart */ 700f8829a4aSRandall Stewart static void 701f8829a4aSRandall Stewart sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr) 702f8829a4aSRandall Stewart { 703f8829a4aSRandall Stewart struct sctp_paramhdr *pbad; 704f8829a4aSRandall Stewart 705f8829a4aSRandall Stewart pbad = phdr + 1; 706f8829a4aSRandall Stewart switch (ntohs(pbad->param_type)) { 707f8829a4aSRandall Stewart /* pr-sctp draft */ 708f8829a4aSRandall Stewart case SCTP_PRSCTP_SUPPORTED: 709f8829a4aSRandall Stewart stcb->asoc.peer_supports_prsctp = 0; 710f8829a4aSRandall Stewart break; 711f8829a4aSRandall Stewart case SCTP_SUPPORTED_CHUNK_EXT: 712f8829a4aSRandall Stewart break; 713f8829a4aSRandall Stewart /* draft-ietf-tsvwg-addip-sctp */ 714f8829a4aSRandall Stewart case SCTP_ECN_NONCE_SUPPORTED: 715f8829a4aSRandall Stewart stcb->asoc.peer_supports_ecn_nonce = 0; 716f8829a4aSRandall Stewart stcb->asoc.ecn_nonce_allowed = 0; 717f8829a4aSRandall Stewart stcb->asoc.ecn_allowed = 0; 718f8829a4aSRandall Stewart break; 719f8829a4aSRandall Stewart case SCTP_ADD_IP_ADDRESS: 720f8829a4aSRandall Stewart case SCTP_DEL_IP_ADDRESS: 721f8829a4aSRandall Stewart case SCTP_SET_PRIM_ADDR: 722f8829a4aSRandall Stewart stcb->asoc.peer_supports_asconf = 0; 723f8829a4aSRandall Stewart break; 724f8829a4aSRandall Stewart case SCTP_SUCCESS_REPORT: 725f8829a4aSRandall Stewart case SCTP_ERROR_CAUSE_IND: 726ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n"); 727ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 728ad81507eSRandall Stewart "Turning off ASCONF to this strange peer\n"); 729f8829a4aSRandall Stewart stcb->asoc.peer_supports_asconf = 0; 730f8829a4aSRandall Stewart break; 731f8829a4aSRandall Stewart default: 732ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 733ad81507eSRandall Stewart "Peer does not support param type %d(%x)??\n", 734f8829a4aSRandall Stewart pbad->param_type, (uint32_t) pbad->param_type); 735f8829a4aSRandall Stewart break; 736f8829a4aSRandall Stewart } 737f8829a4aSRandall Stewart } 738f8829a4aSRandall Stewart 739f8829a4aSRandall Stewart static int 740f8829a4aSRandall Stewart sctp_handle_error(struct sctp_chunkhdr *ch, 741f8829a4aSRandall Stewart struct sctp_tcb *stcb, struct sctp_nets *net) 742f8829a4aSRandall Stewart { 743f8829a4aSRandall Stewart int chklen; 744f8829a4aSRandall Stewart struct sctp_paramhdr *phdr; 745f8829a4aSRandall Stewart uint16_t error_type; 746f8829a4aSRandall Stewart uint16_t error_len; 747f8829a4aSRandall Stewart struct sctp_association *asoc; 748f8829a4aSRandall Stewart 749f8829a4aSRandall Stewart int adjust; 750f8829a4aSRandall Stewart 751f8829a4aSRandall Stewart /* parse through all of the errors and process */ 752f8829a4aSRandall Stewart asoc = &stcb->asoc; 753f8829a4aSRandall Stewart phdr = (struct sctp_paramhdr *)((caddr_t)ch + 754f8829a4aSRandall Stewart sizeof(struct sctp_chunkhdr)); 755f8829a4aSRandall Stewart chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr); 756f8829a4aSRandall Stewart while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) { 757f8829a4aSRandall Stewart /* Process an Error Cause */ 758f8829a4aSRandall Stewart error_type = ntohs(phdr->param_type); 759f8829a4aSRandall Stewart error_len = ntohs(phdr->param_length); 760f8829a4aSRandall Stewart if ((error_len > chklen) || (error_len == 0)) { 761f8829a4aSRandall Stewart /* invalid param length for this param */ 762ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n", 763f8829a4aSRandall Stewart chklen, error_len); 764f8829a4aSRandall Stewart return (0); 765f8829a4aSRandall Stewart } 766f8829a4aSRandall Stewart switch (error_type) { 767f8829a4aSRandall Stewart case SCTP_CAUSE_INVALID_STREAM: 768f8829a4aSRandall Stewart case SCTP_CAUSE_MISSING_PARAM: 769f8829a4aSRandall Stewart case SCTP_CAUSE_INVALID_PARAM: 770f8829a4aSRandall Stewart case SCTP_CAUSE_NO_USER_DATA: 771ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n", 772f8829a4aSRandall Stewart error_type); 773f8829a4aSRandall Stewart break; 774f8829a4aSRandall Stewart case SCTP_CAUSE_STALE_COOKIE: 775f8829a4aSRandall Stewart /* 776f8829a4aSRandall Stewart * We only act if we have echoed a cookie and are 777f8829a4aSRandall Stewart * waiting. 778f8829a4aSRandall Stewart */ 779f8829a4aSRandall Stewart if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 780f8829a4aSRandall Stewart int *p; 781f8829a4aSRandall Stewart 782f8829a4aSRandall Stewart p = (int *)((caddr_t)phdr + sizeof(*phdr)); 783f8829a4aSRandall Stewart /* Save the time doubled */ 784f8829a4aSRandall Stewart asoc->cookie_preserve_req = ntohl(*p) << 1; 785f8829a4aSRandall Stewart asoc->stale_cookie_count++; 786f8829a4aSRandall Stewart if (asoc->stale_cookie_count > 787f8829a4aSRandall Stewart asoc->max_init_times) { 788f8829a4aSRandall Stewart sctp_abort_notification(stcb, 0); 789f8829a4aSRandall Stewart /* now free the asoc */ 790a5d547adSRandall Stewart sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_10); 791f8829a4aSRandall Stewart return (-1); 792f8829a4aSRandall Stewart } 793f8829a4aSRandall Stewart /* blast back to INIT state */ 794f8829a4aSRandall Stewart asoc->state &= ~SCTP_STATE_COOKIE_ECHOED; 795f8829a4aSRandall Stewart asoc->state |= SCTP_STATE_COOKIE_WAIT; 796f8829a4aSRandall Stewart 797f8829a4aSRandall Stewart sctp_stop_all_cookie_timers(stcb); 798f8829a4aSRandall Stewart sctp_send_initiate(stcb->sctp_ep, stcb); 799f8829a4aSRandall Stewart } 800f8829a4aSRandall Stewart break; 801f8829a4aSRandall Stewart case SCTP_CAUSE_UNRESOLVABLE_ADDR: 802f8829a4aSRandall Stewart /* 803f8829a4aSRandall Stewart * Nothing we can do here, we don't do hostname 804f8829a4aSRandall Stewart * addresses so if the peer does not like my IPv6 805f8829a4aSRandall Stewart * (or IPv4 for that matter) it does not matter. If 806f8829a4aSRandall Stewart * they don't support that type of address, they can 807f8829a4aSRandall Stewart * NOT possibly get that packet type... i.e. with no 808f8829a4aSRandall Stewart * IPv6 you can't recieve a IPv6 packet. so we can 809f8829a4aSRandall Stewart * safely ignore this one. If we ever added support 810f8829a4aSRandall Stewart * for HOSTNAME Addresses, then we would need to do 811f8829a4aSRandall Stewart * something here. 812f8829a4aSRandall Stewart */ 813f8829a4aSRandall Stewart break; 814f8829a4aSRandall Stewart case SCTP_CAUSE_UNRECOG_CHUNK: 815f8829a4aSRandall Stewart sctp_process_unrecog_chunk(stcb, phdr, net); 816f8829a4aSRandall Stewart break; 817f8829a4aSRandall Stewart case SCTP_CAUSE_UNRECOG_PARAM: 818f8829a4aSRandall Stewart sctp_process_unrecog_param(stcb, phdr); 819f8829a4aSRandall Stewart break; 820f8829a4aSRandall Stewart case SCTP_CAUSE_COOKIE_IN_SHUTDOWN: 821f8829a4aSRandall Stewart /* 822f8829a4aSRandall Stewart * We ignore this since the timer will drive out a 823f8829a4aSRandall Stewart * new cookie anyway and there timer will drive us 824f8829a4aSRandall Stewart * to send a SHUTDOWN_COMPLETE. We can't send one 825f8829a4aSRandall Stewart * here since we don't have their tag. 826f8829a4aSRandall Stewart */ 827f8829a4aSRandall Stewart break; 828f8829a4aSRandall Stewart case SCTP_CAUSE_DELETING_LAST_ADDR: 829f8829a4aSRandall Stewart case SCTP_CAUSE_RESOURCE_SHORTAGE: 830f8829a4aSRandall Stewart case SCTP_CAUSE_DELETING_SRC_ADDR: 831f8829a4aSRandall Stewart /* 832f8829a4aSRandall Stewart * We should NOT get these here, but in a 83393164cf9SRandall Stewart * ASCONF-ACK. 834f8829a4aSRandall Stewart */ 835ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n", 836f8829a4aSRandall Stewart error_type); 837f8829a4aSRandall Stewart break; 838f8829a4aSRandall Stewart case SCTP_CAUSE_OUT_OF_RESC: 839f8829a4aSRandall Stewart /* 840f8829a4aSRandall Stewart * And what, pray tell do we do with the fact that 841f8829a4aSRandall Stewart * the peer is out of resources? Not really sure we 84293164cf9SRandall Stewart * could do anything but abort. I suspect this 843f8829a4aSRandall Stewart * should have came WITH an abort instead of in a 844f8829a4aSRandall Stewart * OP-ERROR. 845f8829a4aSRandall Stewart */ 846f8829a4aSRandall Stewart break; 847f8829a4aSRandall Stewart default: 848ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n", 849f8829a4aSRandall Stewart error_type); 850f8829a4aSRandall Stewart break; 851f8829a4aSRandall Stewart } 852f8829a4aSRandall Stewart adjust = SCTP_SIZE32(error_len); 853f8829a4aSRandall Stewart chklen -= adjust; 854f8829a4aSRandall Stewart phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust); 855f8829a4aSRandall Stewart } 856f8829a4aSRandall Stewart return (0); 857f8829a4aSRandall Stewart } 858f8829a4aSRandall Stewart 859f8829a4aSRandall Stewart static int 86017205eccSRandall Stewart sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset, 86117205eccSRandall Stewart struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 86217205eccSRandall Stewart struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id, 86317205eccSRandall Stewart uint32_t table_id) 864f8829a4aSRandall Stewart { 865f8829a4aSRandall Stewart struct sctp_init_ack *init_ack; 866f8829a4aSRandall Stewart int *state; 867f8829a4aSRandall Stewart struct mbuf *op_err; 868f8829a4aSRandall Stewart 869ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 870ad81507eSRandall Stewart "sctp_handle_init_ack: handling INIT-ACK\n"); 871ad81507eSRandall Stewart 872f8829a4aSRandall Stewart if (stcb == NULL) { 873ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 874ad81507eSRandall Stewart "sctp_handle_init_ack: TCB is null\n"); 875f8829a4aSRandall Stewart return (-1); 876f8829a4aSRandall Stewart } 877f8829a4aSRandall Stewart if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) { 878f8829a4aSRandall Stewart /* Invalid length */ 879f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 880f8829a4aSRandall Stewart sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 88117205eccSRandall Stewart op_err, 0, 0); 882bff64a4dSRandall Stewart *abort_no_unlock = 1; 883f8829a4aSRandall Stewart return (-1); 884f8829a4aSRandall Stewart } 885f8829a4aSRandall Stewart init_ack = &cp->init; 886f8829a4aSRandall Stewart /* validate parameters */ 887f8829a4aSRandall Stewart if (init_ack->initiate_tag == 0) { 888f8829a4aSRandall Stewart /* protocol error... send an abort */ 889f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 890f8829a4aSRandall Stewart sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 89117205eccSRandall Stewart op_err, 0, 0); 892bff64a4dSRandall Stewart *abort_no_unlock = 1; 893f8829a4aSRandall Stewart return (-1); 894f8829a4aSRandall Stewart } 895f8829a4aSRandall Stewart if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) { 896f8829a4aSRandall Stewart /* protocol error... send an abort */ 897f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 898f8829a4aSRandall Stewart sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 89917205eccSRandall Stewart op_err, 0, 0); 900bff64a4dSRandall Stewart *abort_no_unlock = 1; 901f8829a4aSRandall Stewart return (-1); 902f8829a4aSRandall Stewart } 903f8829a4aSRandall Stewart if (init_ack->num_inbound_streams == 0) { 904f8829a4aSRandall Stewart /* protocol error... send an abort */ 905f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 906f8829a4aSRandall Stewart sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 90717205eccSRandall Stewart op_err, 0, 0); 908bff64a4dSRandall Stewart *abort_no_unlock = 1; 909f8829a4aSRandall Stewart return (-1); 910f8829a4aSRandall Stewart } 911f8829a4aSRandall Stewart if (init_ack->num_outbound_streams == 0) { 912f8829a4aSRandall Stewart /* protocol error... send an abort */ 913f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 914f8829a4aSRandall Stewart sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 91517205eccSRandall Stewart op_err, 0, 0); 916bff64a4dSRandall Stewart *abort_no_unlock = 1; 917f8829a4aSRandall Stewart return (-1); 918f8829a4aSRandall Stewart } 919f8829a4aSRandall Stewart /* process according to association state... */ 920f8829a4aSRandall Stewart state = &stcb->asoc.state; 921f8829a4aSRandall Stewart switch (*state & SCTP_STATE_MASK) { 922f8829a4aSRandall Stewart case SCTP_STATE_COOKIE_WAIT: 923f8829a4aSRandall Stewart /* this is the expected state for this chunk */ 924f8829a4aSRandall Stewart /* process the INIT-ACK parameters */ 925f8829a4aSRandall Stewart if (stcb->asoc.primary_destination->dest_state & 926f8829a4aSRandall Stewart SCTP_ADDR_UNCONFIRMED) { 927f8829a4aSRandall Stewart /* 928f8829a4aSRandall Stewart * The primary is where we sent the INIT, we can 929f8829a4aSRandall Stewart * always consider it confirmed when the INIT-ACK is 930f8829a4aSRandall Stewart * returned. Do this before we load addresses 931f8829a4aSRandall Stewart * though. 932f8829a4aSRandall Stewart */ 933f8829a4aSRandall Stewart stcb->asoc.primary_destination->dest_state &= 934f8829a4aSRandall Stewart ~SCTP_ADDR_UNCONFIRMED; 935f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 936f8829a4aSRandall Stewart stcb, 0, (void *)stcb->asoc.primary_destination); 937f8829a4aSRandall Stewart } 93817205eccSRandall Stewart if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb, 93917205eccSRandall Stewart net, abort_no_unlock, vrf_id, 94017205eccSRandall Stewart table_id) < 0) { 941f8829a4aSRandall Stewart /* error in parsing parameters */ 942f8829a4aSRandall Stewart return (-1); 943f8829a4aSRandall Stewart } 944f8829a4aSRandall Stewart /* update our state */ 945ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n"); 946f8829a4aSRandall Stewart if (*state & SCTP_STATE_SHUTDOWN_PENDING) { 947f8829a4aSRandall Stewart *state = SCTP_STATE_COOKIE_ECHOED | 948f8829a4aSRandall Stewart SCTP_STATE_SHUTDOWN_PENDING; 949f8829a4aSRandall Stewart } else { 950f8829a4aSRandall Stewart *state = SCTP_STATE_COOKIE_ECHOED; 951f8829a4aSRandall Stewart } 952f8829a4aSRandall Stewart 953f8829a4aSRandall Stewart /* reset the RTO calc */ 954f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 9556e55db54SRandall Stewart (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered); 956f8829a4aSRandall Stewart /* 957f8829a4aSRandall Stewart * collapse the init timer back in case of a exponential 958a5d547adSRandall Stewart * backoff 959f8829a4aSRandall Stewart */ 960f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep, 961f8829a4aSRandall Stewart stcb, net); 962f8829a4aSRandall Stewart /* 963f8829a4aSRandall Stewart * the send at the end of the inbound data processing will 964f8829a4aSRandall Stewart * cause the cookie to be sent 965f8829a4aSRandall Stewart */ 966f8829a4aSRandall Stewart break; 967f8829a4aSRandall Stewart case SCTP_STATE_SHUTDOWN_SENT: 968f8829a4aSRandall Stewart /* incorrect state... discard */ 969f8829a4aSRandall Stewart break; 970f8829a4aSRandall Stewart case SCTP_STATE_COOKIE_ECHOED: 971f8829a4aSRandall Stewart /* incorrect state... discard */ 972f8829a4aSRandall Stewart break; 973f8829a4aSRandall Stewart case SCTP_STATE_OPEN: 974f8829a4aSRandall Stewart /* incorrect state... discard */ 975f8829a4aSRandall Stewart break; 976f8829a4aSRandall Stewart case SCTP_STATE_EMPTY: 977f8829a4aSRandall Stewart case SCTP_STATE_INUSE: 978f8829a4aSRandall Stewart default: 979f8829a4aSRandall Stewart /* incorrect state... discard */ 980f8829a4aSRandall Stewart return (-1); 981f8829a4aSRandall Stewart break; 982f8829a4aSRandall Stewart } 983ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n"); 984f8829a4aSRandall Stewart return (0); 985f8829a4aSRandall Stewart } 986f8829a4aSRandall Stewart 987f8829a4aSRandall Stewart 988f8829a4aSRandall Stewart /* 989f8829a4aSRandall Stewart * handle a state cookie for an existing association m: input packet mbuf 990f8829a4aSRandall Stewart * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a 991f8829a4aSRandall Stewart * "split" mbuf and the cookie signature does not exist offset: offset into 992f8829a4aSRandall Stewart * mbuf to the cookie-echo chunk 993f8829a4aSRandall Stewart */ 994f8829a4aSRandall Stewart static struct sctp_tcb * 995f8829a4aSRandall Stewart sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset, 996f8829a4aSRandall Stewart struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 997f8829a4aSRandall Stewart struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 99817205eccSRandall Stewart struct sockaddr *init_src, int *notification, sctp_assoc_t * sac_assoc_id, 99917205eccSRandall Stewart uint32_t vrf_id, uint32_t table_id) 1000f8829a4aSRandall Stewart { 1001f8829a4aSRandall Stewart struct sctp_association *asoc; 1002f8829a4aSRandall Stewart struct sctp_init_chunk *init_cp, init_buf; 1003f8829a4aSRandall Stewart struct sctp_init_ack_chunk *initack_cp, initack_buf; 1004f8829a4aSRandall Stewart int chk_length; 1005a5d547adSRandall Stewart int init_offset, initack_offset, i; 1006f8829a4aSRandall Stewart int retval; 10077f34832bSRandall Stewart int spec_flag = 0; 100844b7479bSRandall Stewart int how_indx; 1009f8829a4aSRandall Stewart 1010f8829a4aSRandall Stewart /* I know that the TCB is non-NULL from the caller */ 1011f8829a4aSRandall Stewart asoc = &stcb->asoc; 1012f42a358aSRandall Stewart for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) { 101344b7479bSRandall Stewart if (asoc->cookie_how[how_indx] == 0) 101444b7479bSRandall Stewart break; 101544b7479bSRandall Stewart } 101644b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) { 101744b7479bSRandall Stewart asoc->cookie_how[how_indx] = 1; 101844b7479bSRandall Stewart } 1019f8829a4aSRandall Stewart if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) { 1020f8829a4aSRandall Stewart /* SHUTDOWN came in after sending INIT-ACK */ 1021f8829a4aSRandall Stewart struct mbuf *op_err; 1022f8829a4aSRandall Stewart struct sctp_paramhdr *ph; 1023f8829a4aSRandall Stewart 1024f8829a4aSRandall Stewart sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 1025f8829a4aSRandall Stewart op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 1026139bc87fSRandall Stewart 0, M_DONTWAIT, 1, MT_DATA); 1027f8829a4aSRandall Stewart if (op_err == NULL) { 1028f8829a4aSRandall Stewart /* FOOBAR */ 1029f8829a4aSRandall Stewart return (NULL); 1030f8829a4aSRandall Stewart } 1031f8829a4aSRandall Stewart /* pre-reserve some space */ 1032139bc87fSRandall Stewart SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 1033139bc87fSRandall Stewart SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 1034139bc87fSRandall Stewart SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 1035f8829a4aSRandall Stewart /* Set the len */ 1036139bc87fSRandall Stewart SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr); 1037f8829a4aSRandall Stewart ph = mtod(op_err, struct sctp_paramhdr *); 1038f8829a4aSRandall Stewart ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN); 1039f8829a4aSRandall Stewart ph->param_length = htons(sizeof(struct sctp_paramhdr)); 104017205eccSRandall Stewart sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag, 104117205eccSRandall Stewart vrf_id, table_id); 104244b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 104344b7479bSRandall Stewart asoc->cookie_how[how_indx] = 2; 1044f8829a4aSRandall Stewart return (NULL); 1045f8829a4aSRandall Stewart } 1046f8829a4aSRandall Stewart /* 1047f8829a4aSRandall Stewart * find and validate the INIT chunk in the cookie (peer's info) the 1048f8829a4aSRandall Stewart * INIT should start after the cookie-echo header struct (chunk 1049f8829a4aSRandall Stewart * header, state cookie header struct) 1050f8829a4aSRandall Stewart */ 1051f8829a4aSRandall Stewart init_offset = offset += sizeof(struct sctp_cookie_echo_chunk); 1052f8829a4aSRandall Stewart 1053f8829a4aSRandall Stewart init_cp = (struct sctp_init_chunk *) 1054f8829a4aSRandall Stewart sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1055f8829a4aSRandall Stewart (uint8_t *) & init_buf); 1056f8829a4aSRandall Stewart if (init_cp == NULL) { 1057f8829a4aSRandall Stewart /* could not pull a INIT chunk in cookie */ 1058f8829a4aSRandall Stewart return (NULL); 1059f8829a4aSRandall Stewart } 1060f8829a4aSRandall Stewart chk_length = ntohs(init_cp->ch.chunk_length); 1061f8829a4aSRandall Stewart if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1062f8829a4aSRandall Stewart return (NULL); 1063f8829a4aSRandall Stewart } 1064f8829a4aSRandall Stewart /* 1065f8829a4aSRandall Stewart * find and validate the INIT-ACK chunk in the cookie (my info) the 1066f8829a4aSRandall Stewart * INIT-ACK follows the INIT chunk 1067f8829a4aSRandall Stewart */ 1068f8829a4aSRandall Stewart initack_offset = init_offset + SCTP_SIZE32(chk_length); 1069f8829a4aSRandall Stewart initack_cp = (struct sctp_init_ack_chunk *) 1070f8829a4aSRandall Stewart sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1071f8829a4aSRandall Stewart (uint8_t *) & initack_buf); 1072f8829a4aSRandall Stewart if (initack_cp == NULL) { 1073f8829a4aSRandall Stewart /* could not pull INIT-ACK chunk in cookie */ 1074f8829a4aSRandall Stewart return (NULL); 1075f8829a4aSRandall Stewart } 1076f8829a4aSRandall Stewart chk_length = ntohs(initack_cp->ch.chunk_length); 1077f8829a4aSRandall Stewart if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1078f8829a4aSRandall Stewart return (NULL); 1079f8829a4aSRandall Stewart } 1080f8829a4aSRandall Stewart if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) && 1081f8829a4aSRandall Stewart (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) { 1082f8829a4aSRandall Stewart /* 1083f8829a4aSRandall Stewart * case D in Section 5.2.4 Table 2: MMAA process accordingly 1084f8829a4aSRandall Stewart * to get into the OPEN state 1085f8829a4aSRandall Stewart */ 108644b7479bSRandall Stewart if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) { 108793164cf9SRandall Stewart #ifdef INVARIANTS 108844b7479bSRandall Stewart panic("Case D and non-match seq?"); 108993164cf9SRandall Stewart #else 1090ad81507eSRandall Stewart SCTP_PRINTF("Case D, seq non-match %x vs %x?\n", 1091ad81507eSRandall Stewart ntohl(initack_cp->init.initial_tsn), 1092ad81507eSRandall Stewart asoc->init_seq_number); 109393164cf9SRandall Stewart #endif 109444b7479bSRandall Stewart } 1095f8829a4aSRandall Stewart switch SCTP_GET_STATE 1096f8829a4aSRandall Stewart (asoc) { 1097f8829a4aSRandall Stewart case SCTP_STATE_COOKIE_WAIT: 109844b7479bSRandall Stewart case SCTP_STATE_COOKIE_ECHOED: 1099f8829a4aSRandall Stewart /* 110017205eccSRandall Stewart * INIT was sent but got a COOKIE_ECHO with the 110144b7479bSRandall Stewart * correct tags... just accept it...but we must 110244b7479bSRandall Stewart * process the init so that we can make sure we have 110344b7479bSRandall Stewart * the right seq no's. 1104f8829a4aSRandall Stewart */ 1105f8829a4aSRandall Stewart /* First we must process the INIT !! */ 1106f8829a4aSRandall Stewart retval = sctp_process_init(init_cp, stcb, net); 1107f8829a4aSRandall Stewart if (retval < 0) { 110844b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 110944b7479bSRandall Stewart asoc->cookie_how[how_indx] = 3; 1110f8829a4aSRandall Stewart return (NULL); 1111f8829a4aSRandall Stewart } 1112f8829a4aSRandall Stewart /* we have already processed the INIT so no problem */ 1113f8829a4aSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, 1114a5d547adSRandall Stewart net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_11); 1115a5d547adSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12); 1116f8829a4aSRandall Stewart /* update current state */ 1117f42a358aSRandall Stewart if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) 1118f42a358aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1119f42a358aSRandall Stewart else 1120f42a358aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1121f8829a4aSRandall Stewart if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1122f42a358aSRandall Stewart asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1123f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1124f8829a4aSRandall Stewart stcb->sctp_ep, stcb, asoc->primary_destination); 1125f8829a4aSRandall Stewart 1126f42a358aSRandall Stewart } else { 1127f8829a4aSRandall Stewart /* if ok, move to OPEN state */ 1128f8829a4aSRandall Stewart asoc->state = SCTP_STATE_OPEN; 1129f8829a4aSRandall Stewart } 1130f42a358aSRandall Stewart SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1131a5d547adSRandall Stewart sctp_stop_all_cookie_timers(stcb); 1132f8829a4aSRandall Stewart if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1133f8829a4aSRandall Stewart (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1134f8829a4aSRandall Stewart (inp->sctp_socket->so_qlimit == 0) 1135f8829a4aSRandall Stewart ) { 1136f8829a4aSRandall Stewart /* 1137f8829a4aSRandall Stewart * Here is where collision would go if we 1138f8829a4aSRandall Stewart * did a connect() and instead got a 1139f8829a4aSRandall Stewart * init/init-ack/cookie done before the 1140f8829a4aSRandall Stewart * init-ack came back.. 1141f8829a4aSRandall Stewart */ 1142f8829a4aSRandall Stewart stcb->sctp_ep->sctp_flags |= 1143f8829a4aSRandall Stewart SCTP_PCB_FLAGS_CONNECTED; 1144f8829a4aSRandall Stewart soisconnected(stcb->sctp_ep->sctp_socket); 1145f8829a4aSRandall Stewart } 1146f8829a4aSRandall Stewart /* notify upper layer */ 1147f8829a4aSRandall Stewart *notification = SCTP_NOTIFY_ASSOC_UP; 1148f8829a4aSRandall Stewart /* 1149f8829a4aSRandall Stewart * since we did not send a HB make sure we don't 1150f8829a4aSRandall Stewart * double things 1151f8829a4aSRandall Stewart */ 1152f8829a4aSRandall Stewart net->hb_responded = 1; 1153f8829a4aSRandall Stewart 1154f8829a4aSRandall Stewart if (stcb->asoc.sctp_autoclose_ticks && 1155f8829a4aSRandall Stewart (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) { 1156f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 1157f8829a4aSRandall Stewart inp, stcb, NULL); 1158f8829a4aSRandall Stewart } 1159f8829a4aSRandall Stewart break; 1160f8829a4aSRandall Stewart default: 1161f8829a4aSRandall Stewart /* 1162f8829a4aSRandall Stewart * we're in the OPEN state (or beyond), so peer must 1163f8829a4aSRandall Stewart * have simply lost the COOKIE-ACK 1164f8829a4aSRandall Stewart */ 1165f8829a4aSRandall Stewart break; 1166f8829a4aSRandall Stewart } /* end switch */ 1167a5d547adSRandall Stewart sctp_stop_all_cookie_timers(stcb); 1168f8829a4aSRandall Stewart /* 1169f8829a4aSRandall Stewart * We ignore the return code here.. not sure if we should 1170f8829a4aSRandall Stewart * somehow abort.. but we do have an existing asoc. This 1171f8829a4aSRandall Stewart * really should not fail. 1172f8829a4aSRandall Stewart */ 1173f8829a4aSRandall Stewart if (sctp_load_addresses_from_init(stcb, m, iphlen, 1174f8829a4aSRandall Stewart init_offset + sizeof(struct sctp_init_chunk), 1175f8829a4aSRandall Stewart initack_offset, sh, init_src)) { 117644b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 117744b7479bSRandall Stewart asoc->cookie_how[how_indx] = 4; 1178f8829a4aSRandall Stewart return (NULL); 1179f8829a4aSRandall Stewart } 1180f8829a4aSRandall Stewart /* respond with a COOKIE-ACK */ 1181a5d547adSRandall Stewart sctp_toss_old_cookies(stcb, asoc); 1182f8829a4aSRandall Stewart sctp_send_cookie_ack(stcb); 118344b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 118444b7479bSRandall Stewart asoc->cookie_how[how_indx] = 5; 1185f8829a4aSRandall Stewart return (stcb); 118617205eccSRandall Stewart } 1187f8829a4aSRandall Stewart if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1188f8829a4aSRandall Stewart ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag && 1189f8829a4aSRandall Stewart cookie->tie_tag_my_vtag == 0 && 1190f8829a4aSRandall Stewart cookie->tie_tag_peer_vtag == 0) { 1191f8829a4aSRandall Stewart /* 1192f8829a4aSRandall Stewart * case C in Section 5.2.4 Table 2: XMOO silently discard 1193f8829a4aSRandall Stewart */ 119444b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 119544b7479bSRandall Stewart asoc->cookie_how[how_indx] = 6; 1196f8829a4aSRandall Stewart return (NULL); 1197f8829a4aSRandall Stewart } 1198f8829a4aSRandall Stewart if (ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag && 1199f8829a4aSRandall Stewart (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag || 1200f8829a4aSRandall Stewart init_cp->init.initiate_tag == 0)) { 1201f8829a4aSRandall Stewart /* 1202f8829a4aSRandall Stewart * case B in Section 5.2.4 Table 2: MXAA or MOAA my info 1203f8829a4aSRandall Stewart * should be ok, re-accept peer info 1204f8829a4aSRandall Stewart */ 120544b7479bSRandall Stewart if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) { 120644b7479bSRandall Stewart /* 120744b7479bSRandall Stewart * Extension of case C. If we hit this, then the 120844b7479bSRandall Stewart * random number generator returned the same vtag 120944b7479bSRandall Stewart * when we first sent our INIT-ACK and when we later 121044b7479bSRandall Stewart * sent our INIT. The side with the seq numbers that 121144b7479bSRandall Stewart * are different will be the one that normnally 121244b7479bSRandall Stewart * would have hit case C. This in effect "extends" 121344b7479bSRandall Stewart * our vtags in this collision case to be 64 bits. 121444b7479bSRandall Stewart * The same collision could occur aka you get both 121544b7479bSRandall Stewart * vtag and seq number the same twice in a row.. but 121644b7479bSRandall Stewart * is much less likely. If it did happen then we 121744b7479bSRandall Stewart * would proceed through and bring up the assoc.. we 121844b7479bSRandall Stewart * may end up with the wrong stream setup however.. 121944b7479bSRandall Stewart * which would be bad.. but there is no way to 122044b7479bSRandall Stewart * tell.. until we send on a stream that does not 122144b7479bSRandall Stewart * exist :-) 122244b7479bSRandall Stewart */ 122344b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 122444b7479bSRandall Stewart asoc->cookie_how[how_indx] = 7; 122544b7479bSRandall Stewart 122644b7479bSRandall Stewart return (NULL); 122744b7479bSRandall Stewart } 122844b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 122944b7479bSRandall Stewart asoc->cookie_how[how_indx] = 8; 1230a5d547adSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13); 1231f8829a4aSRandall Stewart sctp_stop_all_cookie_timers(stcb); 1232f8829a4aSRandall Stewart /* 1233f8829a4aSRandall Stewart * since we did not send a HB make sure we don't double 1234f8829a4aSRandall Stewart * things 1235f8829a4aSRandall Stewart */ 1236f8829a4aSRandall Stewart net->hb_responded = 1; 1237f8829a4aSRandall Stewart if (stcb->asoc.sctp_autoclose_ticks && 1238f8829a4aSRandall Stewart sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1239f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, 1240f8829a4aSRandall Stewart NULL); 1241f8829a4aSRandall Stewart } 1242f8829a4aSRandall Stewart asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 12437f34832bSRandall Stewart asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1244f8829a4aSRandall Stewart 12457f34832bSRandall Stewart /* Note last_cwr_tsn? where is this used? */ 12467f34832bSRandall Stewart asoc->last_cwr_tsn = asoc->init_seq_number - 1; 12477f34832bSRandall Stewart if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) { 12487f34832bSRandall Stewart /* 12497f34832bSRandall Stewart * Ok the peer probably discarded our data (if we 12507f34832bSRandall Stewart * echoed a cookie+data). So anything on the 12517f34832bSRandall Stewart * sent_queue should be marked for retransmit, we 12527f34832bSRandall Stewart * may not get something to kick us so it COULD 12537f34832bSRandall Stewart * still take a timeout to move these.. but it can't 12547f34832bSRandall Stewart * hurt to mark them. 12557f34832bSRandall Stewart */ 12567f34832bSRandall Stewart struct sctp_tmit_chunk *chk; 12577f34832bSRandall Stewart 12587f34832bSRandall Stewart TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 12597f34832bSRandall Stewart if (chk->sent < SCTP_DATAGRAM_RESEND) { 12607f34832bSRandall Stewart chk->sent = SCTP_DATAGRAM_RESEND; 12615e54f665SRandall Stewart sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 12627f34832bSRandall Stewart spec_flag++; 12637f34832bSRandall Stewart } 12647f34832bSRandall Stewart } 12657f34832bSRandall Stewart 12667f34832bSRandall Stewart } 1267f8829a4aSRandall Stewart /* process the INIT info (peer's info) */ 1268f8829a4aSRandall Stewart retval = sctp_process_init(init_cp, stcb, net); 1269f8829a4aSRandall Stewart if (retval < 0) { 127044b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 127144b7479bSRandall Stewart asoc->cookie_how[how_indx] = 9; 1272f8829a4aSRandall Stewart return (NULL); 1273f8829a4aSRandall Stewart } 1274f8829a4aSRandall Stewart if (sctp_load_addresses_from_init(stcb, m, iphlen, 1275f8829a4aSRandall Stewart init_offset + sizeof(struct sctp_init_chunk), 1276f8829a4aSRandall Stewart initack_offset, sh, init_src)) { 127744b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 127844b7479bSRandall Stewart asoc->cookie_how[how_indx] = 10; 1279f8829a4aSRandall Stewart return (NULL); 1280f8829a4aSRandall Stewart } 1281f8829a4aSRandall Stewart if ((asoc->state & SCTP_STATE_COOKIE_WAIT) || 1282f8829a4aSRandall Stewart (asoc->state & SCTP_STATE_COOKIE_ECHOED)) { 1283f8829a4aSRandall Stewart *notification = SCTP_NOTIFY_ASSOC_UP; 1284f8829a4aSRandall Stewart 1285f8829a4aSRandall Stewart if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1286f8829a4aSRandall Stewart (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1287f8829a4aSRandall Stewart (inp->sctp_socket->so_qlimit == 0)) { 1288f8829a4aSRandall Stewart stcb->sctp_ep->sctp_flags |= 1289f8829a4aSRandall Stewart SCTP_PCB_FLAGS_CONNECTED; 1290f8829a4aSRandall Stewart soisconnected(stcb->sctp_ep->sctp_socket); 1291f8829a4aSRandall Stewart } 1292f42a358aSRandall Stewart if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) 1293f42a358aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1294f42a358aSRandall Stewart else 1295f42a358aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1296f42a358aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1297f42a358aSRandall Stewart SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1298f42a358aSRandall Stewart } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 1299f42a358aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_restartestab); 1300f42a358aSRandall Stewart } else { 1301f42a358aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1302f8829a4aSRandall Stewart } 1303f8829a4aSRandall Stewart if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1304f42a358aSRandall Stewart asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1305f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1306f8829a4aSRandall Stewart stcb->sctp_ep, stcb, asoc->primary_destination); 1307f8829a4aSRandall Stewart 1308f8829a4aSRandall Stewart } else { 1309f8829a4aSRandall Stewart asoc->state = SCTP_STATE_OPEN; 1310f8829a4aSRandall Stewart } 1311f8829a4aSRandall Stewart sctp_stop_all_cookie_timers(stcb); 1312a5d547adSRandall Stewart sctp_toss_old_cookies(stcb, asoc); 1313f8829a4aSRandall Stewart sctp_send_cookie_ack(stcb); 13147f34832bSRandall Stewart if (spec_flag) { 13157f34832bSRandall Stewart /* 13167f34832bSRandall Stewart * only if we have retrans set do we do this. What 13177f34832bSRandall Stewart * this call does is get only the COOKIE-ACK out and 13187f34832bSRandall Stewart * then when we return the normal call to 13197f34832bSRandall Stewart * sctp_chunk_output will get the retrans out behind 13207f34832bSRandall Stewart * this. 13217f34832bSRandall Stewart */ 13227f34832bSRandall Stewart sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK); 13237f34832bSRandall Stewart } 132444b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 132544b7479bSRandall Stewart asoc->cookie_how[how_indx] = 11; 132644b7479bSRandall Stewart 1327f8829a4aSRandall Stewart return (stcb); 1328f8829a4aSRandall Stewart } 1329f8829a4aSRandall Stewart if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1330f8829a4aSRandall Stewart ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) && 1331f8829a4aSRandall Stewart cookie->tie_tag_my_vtag == asoc->my_vtag_nonce && 1332f8829a4aSRandall Stewart cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce && 1333f8829a4aSRandall Stewart cookie->tie_tag_peer_vtag != 0) { 1334f8829a4aSRandall Stewart struct sctpasochead *head; 1335f8829a4aSRandall Stewart 1336f8829a4aSRandall Stewart /* 1337f8829a4aSRandall Stewart * case A in Section 5.2.4 Table 2: XXMM (peer restarted) 1338f8829a4aSRandall Stewart */ 1339a5d547adSRandall Stewart /* temp code */ 134044b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 134144b7479bSRandall Stewart asoc->cookie_how[how_indx] = 12; 1342a5d547adSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14); 1343a5d547adSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15); 1344139bc87fSRandall Stewart 1345f8829a4aSRandall Stewart *sac_assoc_id = sctp_get_associd(stcb); 1346f8829a4aSRandall Stewart /* notify upper layer */ 1347f8829a4aSRandall Stewart *notification = SCTP_NOTIFY_ASSOC_RESTART; 1348a5d547adSRandall Stewart atomic_add_int(&stcb->asoc.refcnt, 1); 1349f42a358aSRandall Stewart if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) && 1350f42a358aSRandall Stewart (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 1351f42a358aSRandall Stewart (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 1352f42a358aSRandall Stewart SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1353f42a358aSRandall Stewart } 1354f42a358aSRandall Stewart if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 1355f42a358aSRandall Stewart SCTP_STAT_INCR_GAUGE32(sctps_restartestab); 1356f42a358aSRandall Stewart } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) { 1357f42a358aSRandall Stewart SCTP_STAT_INCR_GAUGE32(sctps_collisionestab); 1358f42a358aSRandall Stewart } 1359139bc87fSRandall Stewart if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1360139bc87fSRandall Stewart asoc->state = SCTP_STATE_OPEN | 1361139bc87fSRandall Stewart SCTP_STATE_SHUTDOWN_PENDING; 1362139bc87fSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1363139bc87fSRandall Stewart stcb->sctp_ep, stcb, asoc->primary_destination); 1364139bc87fSRandall Stewart 1365139bc87fSRandall Stewart } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) { 1366139bc87fSRandall Stewart /* move to OPEN state, if not in SHUTDOWN_SENT */ 1367139bc87fSRandall Stewart asoc->state = SCTP_STATE_OPEN; 1368139bc87fSRandall Stewart } 1369139bc87fSRandall Stewart asoc->pre_open_streams = 1370139bc87fSRandall Stewart ntohs(initack_cp->init.num_outbound_streams); 1371139bc87fSRandall Stewart asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1372139bc87fSRandall Stewart asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1373139bc87fSRandall Stewart 1374139bc87fSRandall Stewart asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1375139bc87fSRandall Stewart asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1376139bc87fSRandall Stewart 1377139bc87fSRandall Stewart asoc->str_reset_seq_in = asoc->init_seq_number; 1378139bc87fSRandall Stewart 1379139bc87fSRandall Stewart asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1380139bc87fSRandall Stewart if (asoc->mapping_array) 1381139bc87fSRandall Stewart memset(asoc->mapping_array, 0, 1382139bc87fSRandall Stewart asoc->mapping_array_size); 1383a5d547adSRandall Stewart SCTP_TCB_UNLOCK(stcb); 1384a5d547adSRandall Stewart SCTP_INP_INFO_WLOCK(); 1385a5d547adSRandall Stewart SCTP_INP_WLOCK(stcb->sctp_ep); 1386a5d547adSRandall Stewart SCTP_TCB_LOCK(stcb); 1387a5d547adSRandall Stewart atomic_add_int(&stcb->asoc.refcnt, -1); 1388f8829a4aSRandall Stewart /* send up all the data */ 13897f34832bSRandall Stewart SCTP_TCB_SEND_LOCK(stcb); 1390f8829a4aSRandall Stewart 1391a5d547adSRandall Stewart sctp_report_all_outbound(stcb, 1); 1392a5d547adSRandall Stewart for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 1393a5d547adSRandall Stewart stcb->asoc.strmout[i].stream_no = i; 1394a5d547adSRandall Stewart stcb->asoc.strmout[i].next_sequence_sent = 0; 1395a5d547adSRandall Stewart stcb->asoc.strmout[i].last_msg_incomplete = 0; 1396a5d547adSRandall Stewart } 1397f8829a4aSRandall Stewart /* process the INIT-ACK info (my info) */ 1398f8829a4aSRandall Stewart asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1399f8829a4aSRandall Stewart asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1400f8829a4aSRandall Stewart 1401f8829a4aSRandall Stewart /* pull from vtag hash */ 1402f8829a4aSRandall Stewart LIST_REMOVE(stcb, sctp_asocs); 1403f8829a4aSRandall Stewart /* re-insert to new vtag position */ 1404f8829a4aSRandall Stewart head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, 1405f8829a4aSRandall Stewart sctppcbinfo.hashasocmark)]; 1406f8829a4aSRandall Stewart /* 1407f8829a4aSRandall Stewart * put it in the bucket in the vtag hash of assoc's for the 1408f8829a4aSRandall Stewart * system 1409f8829a4aSRandall Stewart */ 1410f8829a4aSRandall Stewart LIST_INSERT_HEAD(head, stcb, sctp_asocs); 1411f8829a4aSRandall Stewart 1412f8829a4aSRandall Stewart /* Is this the first restart? */ 1413f8829a4aSRandall Stewart if (stcb->asoc.in_restart_hash == 0) { 1414f8829a4aSRandall Stewart /* Ok add it to assoc_id vtag hash */ 1415f8829a4aSRandall Stewart head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id, 1416f8829a4aSRandall Stewart sctppcbinfo.hashrestartmark)]; 1417f8829a4aSRandall Stewart LIST_INSERT_HEAD(head, stcb, sctp_tcbrestarhash); 1418f8829a4aSRandall Stewart stcb->asoc.in_restart_hash = 1; 1419f8829a4aSRandall Stewart } 1420f8829a4aSRandall Stewart /* process the INIT info (peer's info) */ 14217f34832bSRandall Stewart SCTP_TCB_SEND_UNLOCK(stcb); 1422a5d547adSRandall Stewart SCTP_INP_WUNLOCK(stcb->sctp_ep); 1423a5d547adSRandall Stewart SCTP_INP_INFO_WUNLOCK(); 1424a5d547adSRandall Stewart 1425f8829a4aSRandall Stewart retval = sctp_process_init(init_cp, stcb, net); 1426f8829a4aSRandall Stewart if (retval < 0) { 142744b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 142844b7479bSRandall Stewart asoc->cookie_how[how_indx] = 13; 142944b7479bSRandall Stewart 1430f8829a4aSRandall Stewart return (NULL); 1431f8829a4aSRandall Stewart } 1432f8829a4aSRandall Stewart /* 1433f8829a4aSRandall Stewart * since we did not send a HB make sure we don't double 1434f8829a4aSRandall Stewart * things 1435f8829a4aSRandall Stewart */ 1436f8829a4aSRandall Stewart net->hb_responded = 1; 1437f8829a4aSRandall Stewart 1438f8829a4aSRandall Stewart if (sctp_load_addresses_from_init(stcb, m, iphlen, 1439f8829a4aSRandall Stewart init_offset + sizeof(struct sctp_init_chunk), 1440f8829a4aSRandall Stewart initack_offset, sh, init_src)) { 144144b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 144244b7479bSRandall Stewart asoc->cookie_how[how_indx] = 14; 144344b7479bSRandall Stewart 1444f8829a4aSRandall Stewart return (NULL); 1445f8829a4aSRandall Stewart } 1446f8829a4aSRandall Stewart /* respond with a COOKIE-ACK */ 1447f8829a4aSRandall Stewart sctp_stop_all_cookie_timers(stcb); 1448a5d547adSRandall Stewart sctp_toss_old_cookies(stcb, asoc); 1449f8829a4aSRandall Stewart sctp_send_cookie_ack(stcb); 145044b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 145144b7479bSRandall Stewart asoc->cookie_how[how_indx] = 15; 1452f8829a4aSRandall Stewart 1453f8829a4aSRandall Stewart return (stcb); 1454f8829a4aSRandall Stewart } 145544b7479bSRandall Stewart if (how_indx < sizeof(asoc->cookie_how)) 145644b7479bSRandall Stewart asoc->cookie_how[how_indx] = 16; 1457f8829a4aSRandall Stewart /* all other cases... */ 1458f8829a4aSRandall Stewart return (NULL); 1459f8829a4aSRandall Stewart } 1460f8829a4aSRandall Stewart 146193164cf9SRandall Stewart 1462f8829a4aSRandall Stewart /* 1463f8829a4aSRandall Stewart * handle a state cookie for a new association m: input packet mbuf chain-- 1464f8829a4aSRandall Stewart * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf 1465f8829a4aSRandall Stewart * and the cookie signature does not exist offset: offset into mbuf to the 1466f8829a4aSRandall Stewart * cookie-echo chunk length: length of the cookie chunk to: where the init 1467f8829a4aSRandall Stewart * was from returns a new TCB 1468f8829a4aSRandall Stewart */ 1469f8829a4aSRandall Stewart static struct sctp_tcb * 1470f8829a4aSRandall Stewart sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset, 1471f8829a4aSRandall Stewart struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1472f8829a4aSRandall Stewart struct sctp_inpcb *inp, struct sctp_nets **netp, 1473f8829a4aSRandall Stewart struct sockaddr *init_src, int *notification, 147417205eccSRandall Stewart int auth_skipped, uint32_t auth_offset, uint32_t auth_len, 147517205eccSRandall Stewart uint32_t vrf_id, uint32_t table_id) 1476f8829a4aSRandall Stewart { 1477f8829a4aSRandall Stewart struct sctp_tcb *stcb; 1478f8829a4aSRandall Stewart struct sctp_init_chunk *init_cp, init_buf; 1479f8829a4aSRandall Stewart struct sctp_init_ack_chunk *initack_cp, initack_buf; 1480f8829a4aSRandall Stewart struct sockaddr_storage sa_store; 1481f8829a4aSRandall Stewart struct sockaddr *initack_src = (struct sockaddr *)&sa_store; 1482f8829a4aSRandall Stewart struct sockaddr_in *sin; 1483f8829a4aSRandall Stewart struct sockaddr_in6 *sin6; 1484f8829a4aSRandall Stewart struct sctp_association *asoc; 1485f8829a4aSRandall Stewart int chk_length; 1486f8829a4aSRandall Stewart int init_offset, initack_offset, initack_limit; 1487f8829a4aSRandall Stewart int retval; 1488f8829a4aSRandall Stewart int error = 0; 1489f8829a4aSRandall Stewart uint32_t old_tag; 1490f42a358aSRandall Stewart uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE]; 1491f8829a4aSRandall Stewart 1492f8829a4aSRandall Stewart /* 1493f8829a4aSRandall Stewart * find and validate the INIT chunk in the cookie (peer's info) the 1494f8829a4aSRandall Stewart * INIT should start after the cookie-echo header struct (chunk 1495f8829a4aSRandall Stewart * header, state cookie header struct) 1496f8829a4aSRandall Stewart */ 1497f8829a4aSRandall Stewart init_offset = offset + sizeof(struct sctp_cookie_echo_chunk); 1498f8829a4aSRandall Stewart init_cp = (struct sctp_init_chunk *) 1499f8829a4aSRandall Stewart sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1500f8829a4aSRandall Stewart (uint8_t *) & init_buf); 1501f8829a4aSRandall Stewart if (init_cp == NULL) { 1502f8829a4aSRandall Stewart /* could not pull a INIT chunk in cookie */ 1503ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, 1504ad81507eSRandall Stewart "process_cookie_new: could not pull INIT chunk hdr\n"); 1505f8829a4aSRandall Stewart return (NULL); 1506f8829a4aSRandall Stewart } 1507f8829a4aSRandall Stewart chk_length = ntohs(init_cp->ch.chunk_length); 1508f8829a4aSRandall Stewart if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1509ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n"); 1510f8829a4aSRandall Stewart return (NULL); 1511f8829a4aSRandall Stewart } 1512f8829a4aSRandall Stewart initack_offset = init_offset + SCTP_SIZE32(chk_length); 1513f8829a4aSRandall Stewart /* 1514f8829a4aSRandall Stewart * find and validate the INIT-ACK chunk in the cookie (my info) the 1515f8829a4aSRandall Stewart * INIT-ACK follows the INIT chunk 1516f8829a4aSRandall Stewart */ 1517f8829a4aSRandall Stewart initack_cp = (struct sctp_init_ack_chunk *) 1518f8829a4aSRandall Stewart sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1519f8829a4aSRandall Stewart (uint8_t *) & initack_buf); 1520f8829a4aSRandall Stewart if (initack_cp == NULL) { 1521f8829a4aSRandall Stewart /* could not pull INIT-ACK chunk in cookie */ 1522ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n"); 1523f8829a4aSRandall Stewart return (NULL); 1524f8829a4aSRandall Stewart } 1525f8829a4aSRandall Stewart chk_length = ntohs(initack_cp->ch.chunk_length); 1526f8829a4aSRandall Stewart if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1527f8829a4aSRandall Stewart return (NULL); 1528f8829a4aSRandall Stewart } 1529f8829a4aSRandall Stewart /* 1530f8829a4aSRandall Stewart * NOTE: We can't use the INIT_ACK's chk_length to determine the 1531f8829a4aSRandall Stewart * "initack_limit" value. This is because the chk_length field 1532f8829a4aSRandall Stewart * includes the length of the cookie, but the cookie is omitted when 1533f8829a4aSRandall Stewart * the INIT and INIT_ACK are tacked onto the cookie... 1534f8829a4aSRandall Stewart */ 1535f8829a4aSRandall Stewart initack_limit = offset + cookie_len; 1536f8829a4aSRandall Stewart 1537f8829a4aSRandall Stewart /* 1538f8829a4aSRandall Stewart * now that we know the INIT/INIT-ACK are in place, create a new TCB 1539f8829a4aSRandall Stewart * and popluate 1540f8829a4aSRandall Stewart */ 1541f8829a4aSRandall Stewart stcb = sctp_aloc_assoc(inp, init_src, 0, &error, 1542bff64a4dSRandall Stewart ntohl(initack_cp->init.initiate_tag), vrf_id); 1543f8829a4aSRandall Stewart if (stcb == NULL) { 1544f8829a4aSRandall Stewart struct mbuf *op_err; 1545f8829a4aSRandall Stewart 1546f8829a4aSRandall Stewart /* memory problem? */ 1547ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, 1548ad81507eSRandall Stewart "process_cookie_new: no room for another TCB!\n"); 1549f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1550f8829a4aSRandall Stewart sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 155117205eccSRandall Stewart sh, op_err, vrf_id, table_id); 1552f8829a4aSRandall Stewart return (NULL); 1553f8829a4aSRandall Stewart } 1554f8829a4aSRandall Stewart /* get the correct sctp_nets */ 1555ad81507eSRandall Stewart if (netp) 1556f8829a4aSRandall Stewart *netp = sctp_findnet(stcb, init_src); 1557ad81507eSRandall Stewart 1558f8829a4aSRandall Stewart asoc = &stcb->asoc; 155917205eccSRandall Stewart /* save the table id (vrf_id is done in aloc_assoc) */ 156017205eccSRandall Stewart asoc->table_id = table_id; 1561f8829a4aSRandall Stewart /* get scope variables out of cookie */ 1562f8829a4aSRandall Stewart asoc->ipv4_local_scope = cookie->ipv4_scope; 1563f8829a4aSRandall Stewart asoc->site_scope = cookie->site_scope; 1564f8829a4aSRandall Stewart asoc->local_scope = cookie->local_scope; 1565f8829a4aSRandall Stewart asoc->loopback_scope = cookie->loopback_scope; 1566f8829a4aSRandall Stewart 1567f8829a4aSRandall Stewart if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) || 1568f8829a4aSRandall Stewart (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) { 1569f8829a4aSRandall Stewart struct mbuf *op_err; 1570f8829a4aSRandall Stewart 1571f8829a4aSRandall Stewart /* 1572f8829a4aSRandall Stewart * Houston we have a problem. The EP changed while the 1573f8829a4aSRandall Stewart * cookie was in flight. Only recourse is to abort the 1574f8829a4aSRandall Stewart * association. 1575f8829a4aSRandall Stewart */ 1576f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1577f8829a4aSRandall Stewart sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 157817205eccSRandall Stewart sh, op_err, vrf_id, table_id); 1579f8829a4aSRandall Stewart return (NULL); 1580f8829a4aSRandall Stewart } 1581f8829a4aSRandall Stewart /* process the INIT-ACK info (my info) */ 1582f8829a4aSRandall Stewart old_tag = asoc->my_vtag; 1583f8829a4aSRandall Stewart asoc->assoc_id = asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1584f8829a4aSRandall Stewart asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1585f8829a4aSRandall Stewart asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1586f8829a4aSRandall Stewart asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1587f8829a4aSRandall Stewart asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1588f8829a4aSRandall Stewart asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1589f8829a4aSRandall Stewart asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1590f8829a4aSRandall Stewart asoc->str_reset_seq_in = asoc->init_seq_number; 1591f8829a4aSRandall Stewart 1592f8829a4aSRandall Stewart asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1593f8829a4aSRandall Stewart 1594f8829a4aSRandall Stewart /* process the INIT info (peer's info) */ 1595ad81507eSRandall Stewart if (netp) 1596f8829a4aSRandall Stewart retval = sctp_process_init(init_cp, stcb, *netp); 1597ad81507eSRandall Stewart else 1598ad81507eSRandall Stewart retval = 0; 1599f8829a4aSRandall Stewart if (retval < 0) { 1600a5d547adSRandall Stewart sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16); 1601f8829a4aSRandall Stewart return (NULL); 1602f8829a4aSRandall Stewart } 1603f8829a4aSRandall Stewart /* load all addresses */ 1604f8829a4aSRandall Stewart if (sctp_load_addresses_from_init(stcb, m, iphlen, 1605f8829a4aSRandall Stewart init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh, 1606f8829a4aSRandall Stewart init_src)) { 1607a5d547adSRandall Stewart sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17); 1608f8829a4aSRandall Stewart return (NULL); 1609f8829a4aSRandall Stewart } 1610f8829a4aSRandall Stewart /* 1611f8829a4aSRandall Stewart * verify any preceding AUTH chunk that was skipped 1612f8829a4aSRandall Stewart */ 1613f8829a4aSRandall Stewart /* pull the local authentication parameters from the cookie/init-ack */ 1614f8829a4aSRandall Stewart sctp_auth_get_cookie_params(stcb, m, 1615f8829a4aSRandall Stewart initack_offset + sizeof(struct sctp_init_ack_chunk), 1616f8829a4aSRandall Stewart initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk))); 1617f8829a4aSRandall Stewart if (auth_skipped) { 1618f8829a4aSRandall Stewart struct sctp_auth_chunk *auth; 1619f8829a4aSRandall Stewart 1620f8829a4aSRandall Stewart auth = (struct sctp_auth_chunk *) 1621f42a358aSRandall Stewart sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf); 1622ad81507eSRandall Stewart if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) { 1623f8829a4aSRandall Stewart /* auth HMAC failed, dump the assoc and packet */ 1624ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_AUTH1, 1625ad81507eSRandall Stewart "COOKIE-ECHO: AUTH failed\n"); 1626a5d547adSRandall Stewart sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18); 1627f8829a4aSRandall Stewart return (NULL); 1628f8829a4aSRandall Stewart } else { 1629f8829a4aSRandall Stewart /* remaining chunks checked... good to go */ 1630f8829a4aSRandall Stewart stcb->asoc.authenticated = 1; 1631f8829a4aSRandall Stewart } 1632f8829a4aSRandall Stewart } 1633f8829a4aSRandall Stewart /* update current state */ 1634ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n"); 1635f8829a4aSRandall Stewart if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1636f8829a4aSRandall Stewart asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1637f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1638f8829a4aSRandall Stewart stcb->sctp_ep, stcb, asoc->primary_destination); 1639f8829a4aSRandall Stewart } else { 1640f8829a4aSRandall Stewart asoc->state = SCTP_STATE_OPEN; 1641f8829a4aSRandall Stewart } 1642a5d547adSRandall Stewart sctp_stop_all_cookie_timers(stcb); 1643f8829a4aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_passiveestab); 1644f8829a4aSRandall Stewart SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1645f8829a4aSRandall Stewart 1646f8829a4aSRandall Stewart /* 1647f8829a4aSRandall Stewart * if we're doing ASCONFs, check to see if we have any new local 1648f8829a4aSRandall Stewart * addresses that need to get added to the peer (eg. addresses 1649f8829a4aSRandall Stewart * changed while cookie echo in flight). This needs to be done 1650f8829a4aSRandall Stewart * after we go to the OPEN state to do the correct asconf 1651f8829a4aSRandall Stewart * processing. else, make sure we have the correct addresses in our 1652f8829a4aSRandall Stewart * lists 1653f8829a4aSRandall Stewart */ 1654f8829a4aSRandall Stewart 1655f8829a4aSRandall Stewart /* warning, we re-use sin, sin6, sa_store here! */ 1656f8829a4aSRandall Stewart /* pull in local_address (our "from" address) */ 1657f8829a4aSRandall Stewart if (cookie->laddr_type == SCTP_IPV4_ADDRESS) { 1658f8829a4aSRandall Stewart /* source addr is IPv4 */ 1659f8829a4aSRandall Stewart sin = (struct sockaddr_in *)initack_src; 1660f8829a4aSRandall Stewart memset(sin, 0, sizeof(*sin)); 1661f8829a4aSRandall Stewart sin->sin_family = AF_INET; 1662f8829a4aSRandall Stewart sin->sin_len = sizeof(struct sockaddr_in); 1663f8829a4aSRandall Stewart sin->sin_addr.s_addr = cookie->laddress[0]; 1664f8829a4aSRandall Stewart } else if (cookie->laddr_type == SCTP_IPV6_ADDRESS) { 1665f8829a4aSRandall Stewart /* source addr is IPv6 */ 1666f8829a4aSRandall Stewart sin6 = (struct sockaddr_in6 *)initack_src; 1667f8829a4aSRandall Stewart memset(sin6, 0, sizeof(*sin6)); 1668f8829a4aSRandall Stewart sin6->sin6_family = AF_INET6; 1669f8829a4aSRandall Stewart sin6->sin6_len = sizeof(struct sockaddr_in6); 1670f8829a4aSRandall Stewart sin6->sin6_scope_id = cookie->scope_id; 1671f8829a4aSRandall Stewart memcpy(&sin6->sin6_addr, cookie->laddress, 1672f8829a4aSRandall Stewart sizeof(sin6->sin6_addr)); 1673f8829a4aSRandall Stewart } else { 1674a5d547adSRandall Stewart sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19); 1675f8829a4aSRandall Stewart return (NULL); 1676f8829a4aSRandall Stewart } 1677f8829a4aSRandall Stewart 1678f8829a4aSRandall Stewart sctp_check_address_list(stcb, m, 1679f8829a4aSRandall Stewart initack_offset + sizeof(struct sctp_init_ack_chunk), 1680f8829a4aSRandall Stewart initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)), 1681f8829a4aSRandall Stewart initack_src, cookie->local_scope, cookie->site_scope, 1682f8829a4aSRandall Stewart cookie->ipv4_scope, cookie->loopback_scope); 1683f8829a4aSRandall Stewart 1684f8829a4aSRandall Stewart 1685f8829a4aSRandall Stewart /* set up to notify upper layer */ 1686f8829a4aSRandall Stewart *notification = SCTP_NOTIFY_ASSOC_UP; 1687f8829a4aSRandall Stewart if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1688f8829a4aSRandall Stewart (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1689f8829a4aSRandall Stewart (inp->sctp_socket->so_qlimit == 0)) { 1690f8829a4aSRandall Stewart /* 1691f8829a4aSRandall Stewart * This is an endpoint that called connect() how it got a 1692f8829a4aSRandall Stewart * cookie that is NEW is a bit of a mystery. It must be that 1693f8829a4aSRandall Stewart * the INIT was sent, but before it got there.. a complete 1694f8829a4aSRandall Stewart * INIT/INIT-ACK/COOKIE arrived. But of course then it 1695f8829a4aSRandall Stewart * should have went to the other code.. not here.. oh well.. 1696f8829a4aSRandall Stewart * a bit of protection is worth having.. 1697f8829a4aSRandall Stewart */ 1698f8829a4aSRandall Stewart stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 1699f8829a4aSRandall Stewart soisconnected(stcb->sctp_ep->sctp_socket); 1700f8829a4aSRandall Stewart } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 1701f8829a4aSRandall Stewart (inp->sctp_socket->so_qlimit)) { 1702f8829a4aSRandall Stewart /* 1703f8829a4aSRandall Stewart * We don't want to do anything with this one. Since it is 1704f8829a4aSRandall Stewart * the listening guy. The timer will get started for 1705f8829a4aSRandall Stewart * accepted connections in the caller. 1706f8829a4aSRandall Stewart */ 1707f8829a4aSRandall Stewart ; 1708f8829a4aSRandall Stewart } 1709f8829a4aSRandall Stewart /* since we did not send a HB make sure we don't double things */ 1710ad81507eSRandall Stewart if ((netp) && (*netp)) 1711f8829a4aSRandall Stewart (*netp)->hb_responded = 1; 1712f8829a4aSRandall Stewart 1713f8829a4aSRandall Stewart if (stcb->asoc.sctp_autoclose_ticks && 1714f8829a4aSRandall Stewart sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1715f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL); 1716f8829a4aSRandall Stewart } 1717f8829a4aSRandall Stewart /* respond with a COOKIE-ACK */ 1718a5d547adSRandall Stewart /* calculate the RTT */ 1719ad81507eSRandall Stewart if ((netp) && (*netp)) 1720a5d547adSRandall Stewart (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp, 1721a5d547adSRandall Stewart &cookie->time_entered); 1722f8829a4aSRandall Stewart sctp_send_cookie_ack(stcb); 1723f8829a4aSRandall Stewart return (stcb); 1724f8829a4aSRandall Stewart } 1725f8829a4aSRandall Stewart 1726f8829a4aSRandall Stewart 1727f8829a4aSRandall Stewart /* 1728f8829a4aSRandall Stewart * handles a COOKIE-ECHO message stcb: modified to either a new or left as 1729f8829a4aSRandall Stewart * existing (non-NULL) TCB 1730f8829a4aSRandall Stewart */ 1731f8829a4aSRandall Stewart static struct mbuf * 1732f8829a4aSRandall Stewart sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset, 1733f8829a4aSRandall Stewart struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp, 1734f8829a4aSRandall Stewart struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp, 173517205eccSRandall Stewart int auth_skipped, uint32_t auth_offset, uint32_t auth_len, 173617205eccSRandall Stewart struct sctp_tcb **locked_tcb, uint32_t vrf_id, uint32_t table_id) 1737f8829a4aSRandall Stewart { 1738f8829a4aSRandall Stewart struct sctp_state_cookie *cookie; 1739f8829a4aSRandall Stewart struct sockaddr_in6 sin6; 1740f8829a4aSRandall Stewart struct sockaddr_in sin; 1741f8829a4aSRandall Stewart struct sctp_tcb *l_stcb = *stcb; 1742f8829a4aSRandall Stewart struct sctp_inpcb *l_inp; 1743f8829a4aSRandall Stewart struct sockaddr *to; 1744f8829a4aSRandall Stewart sctp_assoc_t sac_restart_id; 1745f8829a4aSRandall Stewart struct sctp_pcb *ep; 1746f8829a4aSRandall Stewart struct mbuf *m_sig; 1747f8829a4aSRandall Stewart uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE]; 1748f8829a4aSRandall Stewart uint8_t *sig; 1749f8829a4aSRandall Stewart uint8_t cookie_ok = 0; 1750f8829a4aSRandall Stewart unsigned int size_of_pkt, sig_offset, cookie_offset; 1751f8829a4aSRandall Stewart unsigned int cookie_len; 1752f8829a4aSRandall Stewart struct timeval now; 1753f8829a4aSRandall Stewart struct timeval time_expires; 1754f8829a4aSRandall Stewart struct sockaddr_storage dest_store; 1755f8829a4aSRandall Stewart struct sockaddr *localep_sa = (struct sockaddr *)&dest_store; 1756f8829a4aSRandall Stewart struct ip *iph; 1757f8829a4aSRandall Stewart int notification = 0; 1758f8829a4aSRandall Stewart struct sctp_nets *netl; 1759f8829a4aSRandall Stewart int had_a_existing_tcb = 0; 1760f8829a4aSRandall Stewart 1761ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 1762ad81507eSRandall Stewart "sctp_handle_cookie: handling COOKIE-ECHO\n"); 1763f8829a4aSRandall Stewart 1764f8829a4aSRandall Stewart if (inp_p == NULL) { 1765f8829a4aSRandall Stewart return (NULL); 1766f8829a4aSRandall Stewart } 1767f8829a4aSRandall Stewart /* First get the destination address setup too. */ 1768f8829a4aSRandall Stewart iph = mtod(m, struct ip *); 1769f8829a4aSRandall Stewart if (iph->ip_v == IPVERSION) { 1770f8829a4aSRandall Stewart /* its IPv4 */ 1771f8829a4aSRandall Stewart struct sockaddr_in *sin; 1772f8829a4aSRandall Stewart 1773f8829a4aSRandall Stewart sin = (struct sockaddr_in *)(localep_sa); 1774f8829a4aSRandall Stewart memset(sin, 0, sizeof(*sin)); 1775f8829a4aSRandall Stewart sin->sin_family = AF_INET; 1776f8829a4aSRandall Stewart sin->sin_len = sizeof(*sin); 1777f8829a4aSRandall Stewart sin->sin_port = sh->dest_port; 1778f8829a4aSRandall Stewart sin->sin_addr.s_addr = iph->ip_dst.s_addr; 1779139bc87fSRandall Stewart size_of_pkt = SCTP_GET_IPV4_LENGTH(iph); 1780f8829a4aSRandall Stewart } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1781f8829a4aSRandall Stewart /* its IPv6 */ 1782f8829a4aSRandall Stewart struct ip6_hdr *ip6; 1783f8829a4aSRandall Stewart struct sockaddr_in6 *sin6; 1784f8829a4aSRandall Stewart 1785f8829a4aSRandall Stewart sin6 = (struct sockaddr_in6 *)(localep_sa); 1786f8829a4aSRandall Stewart memset(sin6, 0, sizeof(*sin6)); 1787f8829a4aSRandall Stewart sin6->sin6_family = AF_INET6; 1788f8829a4aSRandall Stewart sin6->sin6_len = sizeof(struct sockaddr_in6); 1789f8829a4aSRandall Stewart ip6 = mtod(m, struct ip6_hdr *); 1790f8829a4aSRandall Stewart sin6->sin6_port = sh->dest_port; 1791f8829a4aSRandall Stewart sin6->sin6_addr = ip6->ip6_dst; 1792f42a358aSRandall Stewart size_of_pkt = SCTP_GET_IPV6_LENGTH(ip6) + iphlen; 1793f8829a4aSRandall Stewart } else { 1794f8829a4aSRandall Stewart return (NULL); 1795f8829a4aSRandall Stewart } 1796f8829a4aSRandall Stewart 1797f8829a4aSRandall Stewart cookie = &cp->cookie; 1798f8829a4aSRandall Stewart cookie_offset = offset + sizeof(struct sctp_chunkhdr); 1799f8829a4aSRandall Stewart cookie_len = ntohs(cp->ch.chunk_length); 1800f8829a4aSRandall Stewart 1801f8829a4aSRandall Stewart if ((cookie->peerport != sh->src_port) && 1802f8829a4aSRandall Stewart (cookie->myport != sh->dest_port) && 1803f8829a4aSRandall Stewart (cookie->my_vtag != sh->v_tag)) { 1804f8829a4aSRandall Stewart /* 1805f8829a4aSRandall Stewart * invalid ports or bad tag. Note that we always leave the 1806f8829a4aSRandall Stewart * v_tag in the header in network order and when we stored 1807f8829a4aSRandall Stewart * it in the my_vtag slot we also left it in network order. 180817205eccSRandall Stewart * This maintains the match even though it may be in the 1809f8829a4aSRandall Stewart * opposite byte order of the machine :-> 1810f8829a4aSRandall Stewart */ 1811f8829a4aSRandall Stewart return (NULL); 1812f8829a4aSRandall Stewart } 1813f8829a4aSRandall Stewart if (cookie_len > size_of_pkt || 1814f8829a4aSRandall Stewart cookie_len < sizeof(struct sctp_cookie_echo_chunk) + 1815f8829a4aSRandall Stewart sizeof(struct sctp_init_chunk) + 1816f8829a4aSRandall Stewart sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) { 1817f8829a4aSRandall Stewart /* cookie too long! or too small */ 1818f8829a4aSRandall Stewart return (NULL); 1819f8829a4aSRandall Stewart } 1820f8829a4aSRandall Stewart /* 1821f8829a4aSRandall Stewart * split off the signature into its own mbuf (since it should not be 1822f8829a4aSRandall Stewart * calculated in the sctp_hmac_m() call). 1823f8829a4aSRandall Stewart */ 1824f8829a4aSRandall Stewart sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE; 1825f8829a4aSRandall Stewart if (sig_offset > size_of_pkt) { 1826f8829a4aSRandall Stewart /* packet not correct size! */ 1827f8829a4aSRandall Stewart /* XXX this may already be accounted for earlier... */ 1828f8829a4aSRandall Stewart return (NULL); 1829f8829a4aSRandall Stewart } 1830f8829a4aSRandall Stewart m_sig = m_split(m, sig_offset, M_DONTWAIT); 1831f8829a4aSRandall Stewart if (m_sig == NULL) { 1832f8829a4aSRandall Stewart /* out of memory or ?? */ 1833f8829a4aSRandall Stewart return (NULL); 1834f8829a4aSRandall Stewart } 1835f8829a4aSRandall Stewart /* 1836f8829a4aSRandall Stewart * compute the signature/digest for the cookie 1837f8829a4aSRandall Stewart */ 1838f8829a4aSRandall Stewart ep = &(*inp_p)->sctp_ep; 1839f8829a4aSRandall Stewart l_inp = *inp_p; 1840f8829a4aSRandall Stewart if (l_stcb) { 1841f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(l_stcb); 1842f8829a4aSRandall Stewart } 1843f8829a4aSRandall Stewart SCTP_INP_RLOCK(l_inp); 1844f8829a4aSRandall Stewart if (l_stcb) { 1845f8829a4aSRandall Stewart SCTP_TCB_LOCK(l_stcb); 1846f8829a4aSRandall Stewart } 1847f8829a4aSRandall Stewart /* which cookie is it? */ 1848f8829a4aSRandall Stewart if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) && 1849f8829a4aSRandall Stewart (ep->current_secret_number != ep->last_secret_number)) { 1850f8829a4aSRandall Stewart /* it's the old cookie */ 18516e55db54SRandall Stewart (void)sctp_hmac_m(SCTP_HMAC, 1852f8829a4aSRandall Stewart (uint8_t *) ep->secret_key[(int)ep->last_secret_number], 1853f8829a4aSRandall Stewart SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1854f8829a4aSRandall Stewart } else { 1855f8829a4aSRandall Stewart /* it's the current cookie */ 18566e55db54SRandall Stewart (void)sctp_hmac_m(SCTP_HMAC, 1857f8829a4aSRandall Stewart (uint8_t *) ep->secret_key[(int)ep->current_secret_number], 1858f8829a4aSRandall Stewart SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1859f8829a4aSRandall Stewart } 1860f8829a4aSRandall Stewart /* get the signature */ 1861f8829a4aSRandall Stewart SCTP_INP_RUNLOCK(l_inp); 1862f8829a4aSRandall Stewart sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig); 1863f8829a4aSRandall Stewart if (sig == NULL) { 1864f8829a4aSRandall Stewart /* couldn't find signature */ 186503b0b021SRandall Stewart sctp_m_freem(m_sig); 1866f8829a4aSRandall Stewart return (NULL); 1867f8829a4aSRandall Stewart } 1868f8829a4aSRandall Stewart /* compare the received digest with the computed digest */ 1869f8829a4aSRandall Stewart if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) { 1870f8829a4aSRandall Stewart /* try the old cookie? */ 1871f8829a4aSRandall Stewart if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) && 1872f8829a4aSRandall Stewart (ep->current_secret_number != ep->last_secret_number)) { 1873f8829a4aSRandall Stewart /* compute digest with old */ 18746e55db54SRandall Stewart (void)sctp_hmac_m(SCTP_HMAC, 1875f8829a4aSRandall Stewart (uint8_t *) ep->secret_key[(int)ep->last_secret_number], 1876f8829a4aSRandall Stewart SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1877f8829a4aSRandall Stewart /* compare */ 1878f8829a4aSRandall Stewart if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0) 1879f8829a4aSRandall Stewart cookie_ok = 1; 1880f8829a4aSRandall Stewart } 1881f8829a4aSRandall Stewart } else { 1882f8829a4aSRandall Stewart cookie_ok = 1; 1883f8829a4aSRandall Stewart } 1884f8829a4aSRandall Stewart 1885f8829a4aSRandall Stewart /* 1886f8829a4aSRandall Stewart * Now before we continue we must reconstruct our mbuf so that 1887f8829a4aSRandall Stewart * normal processing of any other chunks will work. 1888f8829a4aSRandall Stewart */ 1889f8829a4aSRandall Stewart { 1890f8829a4aSRandall Stewart struct mbuf *m_at; 1891f8829a4aSRandall Stewart 1892f8829a4aSRandall Stewart m_at = m; 1893139bc87fSRandall Stewart while (SCTP_BUF_NEXT(m_at) != NULL) { 1894139bc87fSRandall Stewart m_at = SCTP_BUF_NEXT(m_at); 1895f8829a4aSRandall Stewart } 1896139bc87fSRandall Stewart SCTP_BUF_NEXT(m_at) = m_sig; 1897f8829a4aSRandall Stewart } 1898f8829a4aSRandall Stewart 1899f8829a4aSRandall Stewart if (cookie_ok == 0) { 1900ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n"); 1901ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 1902ad81507eSRandall Stewart "offset = %u, cookie_offset = %u, sig_offset = %u\n", 1903f8829a4aSRandall Stewart (uint32_t) offset, cookie_offset, sig_offset); 1904f8829a4aSRandall Stewart return (NULL); 1905f8829a4aSRandall Stewart } 1906f8829a4aSRandall Stewart /* 1907f8829a4aSRandall Stewart * check the cookie timestamps to be sure it's not stale 1908f8829a4aSRandall Stewart */ 19096e55db54SRandall Stewart (void)SCTP_GETTIME_TIMEVAL(&now); 1910f8829a4aSRandall Stewart /* Expire time is in Ticks, so we convert to seconds */ 19113c503c28SRandall Stewart time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life); 1912f8829a4aSRandall Stewart time_expires.tv_usec = cookie->time_entered.tv_usec; 1913f8829a4aSRandall Stewart if (timevalcmp(&now, &time_expires, >)) { 1914f8829a4aSRandall Stewart /* cookie is stale! */ 1915f8829a4aSRandall Stewart struct mbuf *op_err; 1916f8829a4aSRandall Stewart struct sctp_stale_cookie_msg *scm; 1917f8829a4aSRandall Stewart uint32_t tim; 1918f8829a4aSRandall Stewart 1919f8829a4aSRandall Stewart op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg), 1920139bc87fSRandall Stewart 0, M_DONTWAIT, 1, MT_DATA); 1921f8829a4aSRandall Stewart if (op_err == NULL) { 1922f8829a4aSRandall Stewart /* FOOBAR */ 1923f8829a4aSRandall Stewart return (NULL); 1924f8829a4aSRandall Stewart } 1925f8829a4aSRandall Stewart /* pre-reserve some space */ 1926139bc87fSRandall Stewart SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 1927139bc87fSRandall Stewart SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 1928139bc87fSRandall Stewart SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 1929f8829a4aSRandall Stewart 1930f8829a4aSRandall Stewart /* Set the len */ 1931139bc87fSRandall Stewart SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg); 1932f8829a4aSRandall Stewart scm = mtod(op_err, struct sctp_stale_cookie_msg *); 1933f8829a4aSRandall Stewart scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE); 1934f8829a4aSRandall Stewart scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) + 1935f8829a4aSRandall Stewart (sizeof(uint32_t)))); 1936f8829a4aSRandall Stewart /* seconds to usec */ 1937f8829a4aSRandall Stewart tim = (now.tv_sec - time_expires.tv_sec) * 1000000; 1938f8829a4aSRandall Stewart /* add in usec */ 1939f8829a4aSRandall Stewart if (tim == 0) 1940f8829a4aSRandall Stewart tim = now.tv_usec - cookie->time_entered.tv_usec; 1941f8829a4aSRandall Stewart scm->time_usec = htonl(tim); 194217205eccSRandall Stewart sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag, 194317205eccSRandall Stewart vrf_id, table_id); 1944f8829a4aSRandall Stewart return (NULL); 1945f8829a4aSRandall Stewart } 1946f8829a4aSRandall Stewart /* 1947f8829a4aSRandall Stewart * Now we must see with the lookup address if we have an existing 1948f8829a4aSRandall Stewart * asoc. This will only happen if we were in the COOKIE-WAIT state 1949f8829a4aSRandall Stewart * and a INIT collided with us and somewhere the peer sent the 1950f8829a4aSRandall Stewart * cookie on another address besides the single address our assoc 1951f8829a4aSRandall Stewart * had for him. In this case we will have one of the tie-tags set at 1952f8829a4aSRandall Stewart * least AND the address field in the cookie can be used to look it 1953f8829a4aSRandall Stewart * up. 1954f8829a4aSRandall Stewart */ 1955f8829a4aSRandall Stewart to = NULL; 1956f8829a4aSRandall Stewart if (cookie->addr_type == SCTP_IPV6_ADDRESS) { 1957f8829a4aSRandall Stewart memset(&sin6, 0, sizeof(sin6)); 1958f8829a4aSRandall Stewart sin6.sin6_family = AF_INET6; 1959f8829a4aSRandall Stewart sin6.sin6_len = sizeof(sin6); 1960f8829a4aSRandall Stewart sin6.sin6_port = sh->src_port; 1961f8829a4aSRandall Stewart sin6.sin6_scope_id = cookie->scope_id; 1962f8829a4aSRandall Stewart memcpy(&sin6.sin6_addr.s6_addr, cookie->address, 1963f8829a4aSRandall Stewart sizeof(sin6.sin6_addr.s6_addr)); 1964f8829a4aSRandall Stewart to = (struct sockaddr *)&sin6; 1965f8829a4aSRandall Stewart } else if (cookie->addr_type == SCTP_IPV4_ADDRESS) { 1966f8829a4aSRandall Stewart memset(&sin, 0, sizeof(sin)); 1967f8829a4aSRandall Stewart sin.sin_family = AF_INET; 1968f8829a4aSRandall Stewart sin.sin_len = sizeof(sin); 1969f8829a4aSRandall Stewart sin.sin_port = sh->src_port; 1970f8829a4aSRandall Stewart sin.sin_addr.s_addr = cookie->address[0]; 1971f8829a4aSRandall Stewart to = (struct sockaddr *)&sin; 1972ad81507eSRandall Stewart } else { 1973ad81507eSRandall Stewart /* This should not happen */ 1974ad81507eSRandall Stewart return (NULL); 1975f8829a4aSRandall Stewart } 1976f8829a4aSRandall Stewart if ((*stcb == NULL) && to) { 1977f8829a4aSRandall Stewart /* Yep, lets check */ 1978f8829a4aSRandall Stewart *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL); 1979f8829a4aSRandall Stewart if (*stcb == NULL) { 1980f8829a4aSRandall Stewart /* 1981f8829a4aSRandall Stewart * We should have only got back the same inp. If we 1982f8829a4aSRandall Stewart * got back a different ep we have a problem. The 1983f8829a4aSRandall Stewart * original findep got back l_inp and now 1984f8829a4aSRandall Stewart */ 1985f8829a4aSRandall Stewart if (l_inp != *inp_p) { 1986ad81507eSRandall Stewart SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n"); 1987f8829a4aSRandall Stewart } 1988a5d547adSRandall Stewart } else { 1989a5d547adSRandall Stewart if (*locked_tcb == NULL) { 1990a5d547adSRandall Stewart /* 1991a5d547adSRandall Stewart * In this case we found the assoc only 1992a5d547adSRandall Stewart * after we locked the create lock. This 1993a5d547adSRandall Stewart * means we are in a colliding case and we 1994a5d547adSRandall Stewart * must make sure that we unlock the tcb if 1995a5d547adSRandall Stewart * its one of the cases where we throw away 1996a5d547adSRandall Stewart * the incoming packets. 1997a5d547adSRandall Stewart */ 1998a5d547adSRandall Stewart *locked_tcb = *stcb; 1999a5d547adSRandall Stewart 2000a5d547adSRandall Stewart /* 2001a5d547adSRandall Stewart * We must also increment the inp ref count 2002a5d547adSRandall Stewart * since the ref_count flags was set when we 2003a5d547adSRandall Stewart * did not find the TCB, now we found it 2004a5d547adSRandall Stewart * which reduces the refcount.. we must 2005a5d547adSRandall Stewart * raise it back out to balance it all :-) 2006a5d547adSRandall Stewart */ 2007a5d547adSRandall Stewart SCTP_INP_INCR_REF((*stcb)->sctp_ep); 2008a5d547adSRandall Stewart if ((*stcb)->sctp_ep != l_inp) { 2009ad81507eSRandall Stewart SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n", 2010a5d547adSRandall Stewart (*stcb)->sctp_ep, l_inp); 2011a5d547adSRandall Stewart } 2012a5d547adSRandall Stewart } 2013f8829a4aSRandall Stewart } 2014f8829a4aSRandall Stewart } 2015ad81507eSRandall Stewart if (to == NULL) 2016ad81507eSRandall Stewart return (NULL); 2017ad81507eSRandall Stewart 2018f8829a4aSRandall Stewart cookie_len -= SCTP_SIGNATURE_SIZE; 2019f8829a4aSRandall Stewart if (*stcb == NULL) { 2020f8829a4aSRandall Stewart /* this is the "normal" case... get a new TCB */ 2021f8829a4aSRandall Stewart *stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie, 2022f8829a4aSRandall Stewart cookie_len, *inp_p, netp, to, ¬ification, 202317205eccSRandall Stewart auth_skipped, auth_offset, auth_len, vrf_id, table_id); 2024f8829a4aSRandall Stewart } else { 2025f8829a4aSRandall Stewart /* this is abnormal... cookie-echo on existing TCB */ 2026f8829a4aSRandall Stewart had_a_existing_tcb = 1; 2027f8829a4aSRandall Stewart *stcb = sctp_process_cookie_existing(m, iphlen, offset, sh, 2028f8829a4aSRandall Stewart cookie, cookie_len, *inp_p, *stcb, *netp, to, ¬ification, 202917205eccSRandall Stewart &sac_restart_id, vrf_id, table_id); 2030f8829a4aSRandall Stewart } 2031f8829a4aSRandall Stewart 2032f8829a4aSRandall Stewart if (*stcb == NULL) { 2033f8829a4aSRandall Stewart /* still no TCB... must be bad cookie-echo */ 2034f8829a4aSRandall Stewart return (NULL); 2035f8829a4aSRandall Stewart } 2036f8829a4aSRandall Stewart /* 2037f8829a4aSRandall Stewart * Ok, we built an association so confirm the address we sent the 2038f8829a4aSRandall Stewart * INIT-ACK to. 2039f8829a4aSRandall Stewart */ 2040f8829a4aSRandall Stewart netl = sctp_findnet(*stcb, to); 2041f8829a4aSRandall Stewart /* 2042f8829a4aSRandall Stewart * This code should in theory NOT run but 2043f8829a4aSRandall Stewart */ 2044f8829a4aSRandall Stewart if (netl == NULL) { 2045f8829a4aSRandall Stewart /* TSNH! Huh, why do I need to add this address here? */ 2046f8829a4aSRandall Stewart int ret; 2047f8829a4aSRandall Stewart 2048a5d547adSRandall Stewart ret = sctp_add_remote_addr(*stcb, to, SCTP_DONOT_SETSCOPE, 2049a5d547adSRandall Stewart SCTP_IN_COOKIE_PROC); 2050f8829a4aSRandall Stewart netl = sctp_findnet(*stcb, to); 2051f8829a4aSRandall Stewart } 2052f8829a4aSRandall Stewart if (netl) { 2053f8829a4aSRandall Stewart if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) { 2054f8829a4aSRandall Stewart netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2055ad81507eSRandall Stewart (void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL, 2056f8829a4aSRandall Stewart netl); 2057f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 2058f8829a4aSRandall Stewart (*stcb), 0, (void *)netl); 2059f8829a4aSRandall Stewart } 2060f8829a4aSRandall Stewart } 2061f8829a4aSRandall Stewart if (*stcb) { 2062f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, *inp_p, 2063f8829a4aSRandall Stewart *stcb, NULL); 2064f8829a4aSRandall Stewart } 2065f8829a4aSRandall Stewart if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 2066f8829a4aSRandall Stewart if (!had_a_existing_tcb || 2067f8829a4aSRandall Stewart (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) { 2068f8829a4aSRandall Stewart /* 2069f8829a4aSRandall Stewart * If we have a NEW cookie or the connect never 2070f8829a4aSRandall Stewart * reached the connected state during collision we 2071f8829a4aSRandall Stewart * must do the TCP accept thing. 2072f8829a4aSRandall Stewart */ 2073f8829a4aSRandall Stewart struct socket *so, *oso; 2074f8829a4aSRandall Stewart struct sctp_inpcb *inp; 2075f8829a4aSRandall Stewart 2076f8829a4aSRandall Stewart if (notification == SCTP_NOTIFY_ASSOC_RESTART) { 2077f8829a4aSRandall Stewart /* 2078f8829a4aSRandall Stewart * For a restart we will keep the same 2079f8829a4aSRandall Stewart * socket, no need to do anything. I THINK!! 2080f8829a4aSRandall Stewart */ 2081f8829a4aSRandall Stewart sctp_ulp_notify(notification, *stcb, 0, (void *)&sac_restart_id); 2082f8829a4aSRandall Stewart return (m); 2083f8829a4aSRandall Stewart } 2084f8829a4aSRandall Stewart oso = (*inp_p)->sctp_socket; 2085f8829a4aSRandall Stewart /* 2086f8829a4aSRandall Stewart * We do this to keep the sockets side happy durin 2087f8829a4aSRandall Stewart * the sonewcon ONLY. 2088f8829a4aSRandall Stewart */ 2089f8829a4aSRandall Stewart NET_LOCK_GIANT(); 2090f8829a4aSRandall Stewart SCTP_TCB_UNLOCK((*stcb)); 209193164cf9SRandall Stewart so = sonewconn(oso, 0 2092f8829a4aSRandall Stewart ); 2093f8829a4aSRandall Stewart NET_UNLOCK_GIANT(); 2094f8829a4aSRandall Stewart SCTP_INP_WLOCK((*stcb)->sctp_ep); 2095f8829a4aSRandall Stewart SCTP_TCB_LOCK((*stcb)); 2096f8829a4aSRandall Stewart SCTP_INP_WUNLOCK((*stcb)->sctp_ep); 2097f8829a4aSRandall Stewart if (so == NULL) { 2098f8829a4aSRandall Stewart struct mbuf *op_err; 2099f8829a4aSRandall Stewart 2100f8829a4aSRandall Stewart /* Too many sockets */ 2101ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n"); 2102f8829a4aSRandall Stewart op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 2103f8829a4aSRandall Stewart sctp_abort_association(*inp_p, NULL, m, iphlen, 210417205eccSRandall Stewart sh, op_err, vrf_id, 210517205eccSRandall Stewart table_id); 2106a5d547adSRandall Stewart sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20); 2107f8829a4aSRandall Stewart return (NULL); 2108f8829a4aSRandall Stewart } 2109f8829a4aSRandall Stewart inp = (struct sctp_inpcb *)so->so_pcb; 211093164cf9SRandall Stewart SCTP_INP_INCR_REF(inp); 211193164cf9SRandall Stewart /* 211293164cf9SRandall Stewart * We add the unbound flag here so that if we get an 211393164cf9SRandall Stewart * soabort() before we get the move_pcb done, we 211493164cf9SRandall Stewart * will properly cleanup. 211593164cf9SRandall Stewart */ 2116f8829a4aSRandall Stewart inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 2117f8829a4aSRandall Stewart SCTP_PCB_FLAGS_CONNECTED | 2118f8829a4aSRandall Stewart SCTP_PCB_FLAGS_IN_TCPPOOL | 211993164cf9SRandall Stewart SCTP_PCB_FLAGS_UNBOUND | 2120f8829a4aSRandall Stewart (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) | 2121f8829a4aSRandall Stewart SCTP_PCB_FLAGS_DONT_WAKE); 2122f8829a4aSRandall Stewart inp->sctp_features = (*inp_p)->sctp_features; 2123f8829a4aSRandall Stewart inp->sctp_socket = so; 2124f8829a4aSRandall Stewart inp->sctp_frag_point = (*inp_p)->sctp_frag_point; 2125f8829a4aSRandall Stewart inp->partial_delivery_point = (*inp_p)->partial_delivery_point; 2126f8829a4aSRandall Stewart inp->sctp_context = (*inp_p)->sctp_context; 2127f8829a4aSRandall Stewart inp->inp_starting_point_for_iterator = NULL; 2128f8829a4aSRandall Stewart /* 2129f8829a4aSRandall Stewart * copy in the authentication parameters from the 2130f8829a4aSRandall Stewart * original endpoint 2131f8829a4aSRandall Stewart */ 2132f8829a4aSRandall Stewart if (inp->sctp_ep.local_hmacs) 2133f8829a4aSRandall Stewart sctp_free_hmaclist(inp->sctp_ep.local_hmacs); 2134f8829a4aSRandall Stewart inp->sctp_ep.local_hmacs = 2135f8829a4aSRandall Stewart sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs); 2136f8829a4aSRandall Stewart if (inp->sctp_ep.local_auth_chunks) 2137f8829a4aSRandall Stewart sctp_free_chunklist(inp->sctp_ep.local_auth_chunks); 2138f8829a4aSRandall Stewart inp->sctp_ep.local_auth_chunks = 2139f8829a4aSRandall Stewart sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks); 2140f8829a4aSRandall Stewart (void)sctp_copy_skeylist(&(*inp_p)->sctp_ep.shared_keys, 2141f8829a4aSRandall Stewart &inp->sctp_ep.shared_keys); 2142f8829a4aSRandall Stewart 2143f8829a4aSRandall Stewart /* 2144f8829a4aSRandall Stewart * Now we must move it from one hash table to 2145f8829a4aSRandall Stewart * another and get the tcb in the right place. 2146f8829a4aSRandall Stewart */ 2147f8829a4aSRandall Stewart sctp_move_pcb_and_assoc(*inp_p, inp, *stcb); 2148d61a0ae0SRandall Stewart 2149d61a0ae0SRandall Stewart atomic_add_int(&(*stcb)->asoc.refcnt, 1); 2150d61a0ae0SRandall Stewart SCTP_TCB_UNLOCK((*stcb)); 2151d61a0ae0SRandall Stewart 2152d06c82f1SRandall Stewart sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb, M_NOWAIT); 2153d61a0ae0SRandall Stewart SCTP_TCB_LOCK((*stcb)); 2154d61a0ae0SRandall Stewart atomic_subtract_int(&(*stcb)->asoc.refcnt, 1); 2155d61a0ae0SRandall Stewart 2156f8829a4aSRandall Stewart 215793164cf9SRandall Stewart /* 215893164cf9SRandall Stewart * now we must check to see if we were aborted while 215993164cf9SRandall Stewart * the move was going on and the lock/unlock 216093164cf9SRandall Stewart * happened. 216193164cf9SRandall Stewart */ 216293164cf9SRandall Stewart if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 216393164cf9SRandall Stewart /* 216493164cf9SRandall Stewart * yep it was, we leave the assoc attached 216593164cf9SRandall Stewart * to the socket since the sctp_inpcb_free() 216693164cf9SRandall Stewart * call will send an abort for us. 216793164cf9SRandall Stewart */ 216893164cf9SRandall Stewart SCTP_INP_DECR_REF(inp); 216993164cf9SRandall Stewart return (NULL); 217093164cf9SRandall Stewart } 217193164cf9SRandall Stewart SCTP_INP_DECR_REF(inp); 2172f8829a4aSRandall Stewart /* Switch over to the new guy */ 2173f8829a4aSRandall Stewart *inp_p = inp; 2174f8829a4aSRandall Stewart sctp_ulp_notify(notification, *stcb, 0, NULL); 217593164cf9SRandall Stewart 217693164cf9SRandall Stewart /* 217793164cf9SRandall Stewart * Pull it from the incomplete queue and wake the 217893164cf9SRandall Stewart * guy 217993164cf9SRandall Stewart */ 218093164cf9SRandall Stewart soisconnected(so); 2181f8829a4aSRandall Stewart return (m); 2182f8829a4aSRandall Stewart } 2183f8829a4aSRandall Stewart } 2184f8829a4aSRandall Stewart if ((notification) && ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) { 2185f8829a4aSRandall Stewart sctp_ulp_notify(notification, *stcb, 0, NULL); 2186f8829a4aSRandall Stewart } 2187f8829a4aSRandall Stewart return (m); 2188f8829a4aSRandall Stewart } 2189f8829a4aSRandall Stewart 2190f8829a4aSRandall Stewart static void 2191f8829a4aSRandall Stewart sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp, 2192f8829a4aSRandall Stewart struct sctp_tcb *stcb, struct sctp_nets *net) 2193f8829a4aSRandall Stewart { 2194f8829a4aSRandall Stewart /* cp must not be used, others call this without a c-ack :-) */ 2195f8829a4aSRandall Stewart struct sctp_association *asoc; 2196f8829a4aSRandall Stewart 2197ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 2198ad81507eSRandall Stewart "sctp_handle_cookie_ack: handling COOKIE-ACK\n"); 2199f8829a4aSRandall Stewart if (stcb == NULL) 2200f8829a4aSRandall Stewart return; 2201f8829a4aSRandall Stewart 2202f8829a4aSRandall Stewart asoc = &stcb->asoc; 2203f8829a4aSRandall Stewart 2204f8829a4aSRandall Stewart sctp_stop_all_cookie_timers(stcb); 2205f8829a4aSRandall Stewart /* process according to association state */ 2206f8829a4aSRandall Stewart if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 2207f8829a4aSRandall Stewart /* state change only needed when I am in right state */ 2208ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n"); 2209f8829a4aSRandall Stewart if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 2210f8829a4aSRandall Stewart asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 2211f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 2212f8829a4aSRandall Stewart stcb->sctp_ep, stcb, asoc->primary_destination); 2213f8829a4aSRandall Stewart 2214f8829a4aSRandall Stewart } else { 2215f8829a4aSRandall Stewart asoc->state = SCTP_STATE_OPEN; 2216f8829a4aSRandall Stewart } 2217f8829a4aSRandall Stewart /* update RTO */ 2218f8829a4aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 2219f8829a4aSRandall Stewart SCTP_STAT_INCR_GAUGE32(sctps_currestab); 2220f8829a4aSRandall Stewart if (asoc->overall_error_count == 0) { 2221f8829a4aSRandall Stewart net->RTO = sctp_calculate_rto(stcb, asoc, net, 2222f8829a4aSRandall Stewart &asoc->time_entered); 2223f8829a4aSRandall Stewart } 22246e55db54SRandall Stewart (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 2225f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL); 2226f8829a4aSRandall Stewart if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 2227f8829a4aSRandall Stewart (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 2228f8829a4aSRandall Stewart stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 2229f8829a4aSRandall Stewart soisconnected(stcb->sctp_ep->sctp_socket); 2230f8829a4aSRandall Stewart } 2231f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, 2232f8829a4aSRandall Stewart stcb, net); 2233f8829a4aSRandall Stewart /* 2234f8829a4aSRandall Stewart * since we did not send a HB make sure we don't double 2235f8829a4aSRandall Stewart * things 2236f8829a4aSRandall Stewart */ 2237f8829a4aSRandall Stewart net->hb_responded = 1; 2238f8829a4aSRandall Stewart 2239f8829a4aSRandall Stewart if (stcb->asoc.sctp_autoclose_ticks && 2240f8829a4aSRandall Stewart sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) { 2241f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 2242f8829a4aSRandall Stewart stcb->sctp_ep, stcb, NULL); 2243f8829a4aSRandall Stewart } 2244f8829a4aSRandall Stewart /* 2245f8829a4aSRandall Stewart * set ASCONF timer if ASCONFs are pending and allowed (eg. 2246f8829a4aSRandall Stewart * addresses changed when init/cookie echo in flight) 2247f8829a4aSRandall Stewart */ 2248f8829a4aSRandall Stewart if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) && 2249f8829a4aSRandall Stewart (stcb->asoc.peer_supports_asconf) && 2250f8829a4aSRandall Stewart (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) { 2251f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, 2252f8829a4aSRandall Stewart stcb->sctp_ep, stcb, 2253f8829a4aSRandall Stewart stcb->asoc.primary_destination); 2254f8829a4aSRandall Stewart } 2255f8829a4aSRandall Stewart } 2256f8829a4aSRandall Stewart /* Toss the cookie if I can */ 2257f8829a4aSRandall Stewart sctp_toss_old_cookies(stcb, asoc); 2258f8829a4aSRandall Stewart if (!TAILQ_EMPTY(&asoc->sent_queue)) { 2259f8829a4aSRandall Stewart /* Restart the timer if we have pending data */ 2260f8829a4aSRandall Stewart struct sctp_tmit_chunk *chk; 2261f8829a4aSRandall Stewart 2262f8829a4aSRandall Stewart chk = TAILQ_FIRST(&asoc->sent_queue); 2263f8829a4aSRandall Stewart if (chk) { 2264f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2265f8829a4aSRandall Stewart stcb, chk->whoTo); 2266f8829a4aSRandall Stewart } 2267f8829a4aSRandall Stewart } 2268f8829a4aSRandall Stewart } 2269f8829a4aSRandall Stewart 2270f8829a4aSRandall Stewart static void 2271f8829a4aSRandall Stewart sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp, 2272f8829a4aSRandall Stewart struct sctp_tcb *stcb) 2273f8829a4aSRandall Stewart { 2274f8829a4aSRandall Stewart struct sctp_nets *net; 2275f8829a4aSRandall Stewart struct sctp_tmit_chunk *lchk; 2276f8829a4aSRandall Stewart uint32_t tsn; 2277f8829a4aSRandall Stewart 2278f8829a4aSRandall Stewart if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_ecne_chunk)) { 2279f8829a4aSRandall Stewart return; 2280f8829a4aSRandall Stewart } 2281f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_recvecne); 2282f8829a4aSRandall Stewart tsn = ntohl(cp->tsn); 2283f8829a4aSRandall Stewart /* ECN Nonce stuff: need a resync and disable the nonce sum check */ 2284f8829a4aSRandall Stewart /* Also we make sure we disable the nonce_wait */ 2285f8829a4aSRandall Stewart lchk = TAILQ_FIRST(&stcb->asoc.send_queue); 2286f8829a4aSRandall Stewart if (lchk == NULL) { 2287f8829a4aSRandall Stewart stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq; 2288f8829a4aSRandall Stewart } else { 2289f8829a4aSRandall Stewart stcb->asoc.nonce_resync_tsn = lchk->rec.data.TSN_seq; 2290f8829a4aSRandall Stewart } 2291f8829a4aSRandall Stewart stcb->asoc.nonce_wait_for_ecne = 0; 2292f8829a4aSRandall Stewart stcb->asoc.nonce_sum_check = 0; 2293f8829a4aSRandall Stewart 2294f8829a4aSRandall Stewart /* Find where it was sent, if possible */ 2295f8829a4aSRandall Stewart net = NULL; 2296f8829a4aSRandall Stewart lchk = TAILQ_FIRST(&stcb->asoc.sent_queue); 2297f8829a4aSRandall Stewart while (lchk) { 2298f8829a4aSRandall Stewart if (lchk->rec.data.TSN_seq == tsn) { 2299f8829a4aSRandall Stewart net = lchk->whoTo; 2300f8829a4aSRandall Stewart break; 2301f8829a4aSRandall Stewart } 2302f8829a4aSRandall Stewart if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ)) 2303f8829a4aSRandall Stewart break; 2304f8829a4aSRandall Stewart lchk = TAILQ_NEXT(lchk, sctp_next); 2305f8829a4aSRandall Stewart } 2306f8829a4aSRandall Stewart if (net == NULL) 2307f8829a4aSRandall Stewart /* default is we use the primary */ 2308f8829a4aSRandall Stewart net = stcb->asoc.primary_destination; 2309f8829a4aSRandall Stewart 2310f8829a4aSRandall Stewart if (compare_with_wrap(tsn, stcb->asoc.last_cwr_tsn, MAX_TSN)) { 2311f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR 2312f8829a4aSRandall Stewart int old_cwnd; 2313f8829a4aSRandall Stewart 2314f8829a4aSRandall Stewart old_cwnd = net->cwnd; 2315f8829a4aSRandall Stewart #endif 2316f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_ecnereducedcwnd); 2317f8829a4aSRandall Stewart net->ssthresh = net->cwnd / 2; 2318f8829a4aSRandall Stewart if (net->ssthresh < net->mtu) { 2319f8829a4aSRandall Stewart net->ssthresh = net->mtu; 2320f8829a4aSRandall Stewart /* here back off the timer as well, to slow us down */ 2321f8829a4aSRandall Stewart net->RTO <<= 2; 2322f8829a4aSRandall Stewart } 2323f8829a4aSRandall Stewart net->cwnd = net->ssthresh; 2324f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR 2325f8829a4aSRandall Stewart sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_SAT); 2326f8829a4aSRandall Stewart #endif 2327f8829a4aSRandall Stewart /* 2328f8829a4aSRandall Stewart * we reduce once every RTT. So we will only lower cwnd at 2329f8829a4aSRandall Stewart * the next sending seq i.e. the resync_tsn. 2330f8829a4aSRandall Stewart */ 2331f8829a4aSRandall Stewart stcb->asoc.last_cwr_tsn = stcb->asoc.nonce_resync_tsn; 2332f8829a4aSRandall Stewart } 2333f8829a4aSRandall Stewart /* 2334f8829a4aSRandall Stewart * We always send a CWR this way if our previous one was lost our 2335f8829a4aSRandall Stewart * peer will get an update, or if it is not time again to reduce we 2336f8829a4aSRandall Stewart * still get the cwr to the peer. 2337f8829a4aSRandall Stewart */ 2338f8829a4aSRandall Stewart sctp_send_cwr(stcb, net, tsn); 2339f8829a4aSRandall Stewart } 2340f8829a4aSRandall Stewart 2341f8829a4aSRandall Stewart static void 2342f8829a4aSRandall Stewart sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb) 2343f8829a4aSRandall Stewart { 2344f8829a4aSRandall Stewart /* 2345f8829a4aSRandall Stewart * Here we get a CWR from the peer. We must look in the outqueue and 2346f8829a4aSRandall Stewart * make sure that we have a covered ECNE in teh control chunk part. 2347f8829a4aSRandall Stewart * If so remove it. 2348f8829a4aSRandall Stewart */ 2349f8829a4aSRandall Stewart struct sctp_tmit_chunk *chk; 2350f8829a4aSRandall Stewart struct sctp_ecne_chunk *ecne; 2351f8829a4aSRandall Stewart 2352f8829a4aSRandall Stewart TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 2353f8829a4aSRandall Stewart if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) { 2354f8829a4aSRandall Stewart continue; 2355f8829a4aSRandall Stewart } 2356f8829a4aSRandall Stewart /* 2357f8829a4aSRandall Stewart * Look for and remove if it is the right TSN. Since there 2358f8829a4aSRandall Stewart * is only ONE ECNE on the control queue at any one time we 2359f8829a4aSRandall Stewart * don't need to worry about more than one! 2360f8829a4aSRandall Stewart */ 2361f8829a4aSRandall Stewart ecne = mtod(chk->data, struct sctp_ecne_chunk *); 2362f8829a4aSRandall Stewart if (compare_with_wrap(ntohl(cp->tsn), ntohl(ecne->tsn), 2363f8829a4aSRandall Stewart MAX_TSN) || (cp->tsn == ecne->tsn)) { 2364f8829a4aSRandall Stewart /* this covers this ECNE, we can remove it */ 2365f8829a4aSRandall Stewart stcb->asoc.ecn_echo_cnt_onq--; 2366f8829a4aSRandall Stewart TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, 2367f8829a4aSRandall Stewart sctp_next); 2368f8829a4aSRandall Stewart if (chk->data) { 2369f8829a4aSRandall Stewart sctp_m_freem(chk->data); 2370f8829a4aSRandall Stewart chk->data = NULL; 2371f8829a4aSRandall Stewart } 2372f8829a4aSRandall Stewart stcb->asoc.ctrl_queue_cnt--; 2373f8829a4aSRandall Stewart sctp_free_remote_addr(chk->whoTo); 2374f8829a4aSRandall Stewart sctp_free_a_chunk(stcb, chk); 2375f8829a4aSRandall Stewart break; 2376f8829a4aSRandall Stewart } 2377f8829a4aSRandall Stewart } 2378f8829a4aSRandall Stewart } 2379f8829a4aSRandall Stewart 2380f8829a4aSRandall Stewart static void 2381f8829a4aSRandall Stewart sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp, 2382f8829a4aSRandall Stewart struct sctp_tcb *stcb, struct sctp_nets *net) 2383f8829a4aSRandall Stewart { 2384f8829a4aSRandall Stewart struct sctp_association *asoc; 2385f8829a4aSRandall Stewart 2386ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, 2387ad81507eSRandall Stewart "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n"); 2388f8829a4aSRandall Stewart if (stcb == NULL) 2389f8829a4aSRandall Stewart return; 2390f8829a4aSRandall Stewart 2391f8829a4aSRandall Stewart asoc = &stcb->asoc; 2392f8829a4aSRandall Stewart /* process according to association state */ 2393f8829a4aSRandall Stewart if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) { 2394f8829a4aSRandall Stewart /* unexpected SHUTDOWN-COMPLETE... so ignore... */ 2395f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(stcb); 2396f8829a4aSRandall Stewart return; 2397f8829a4aSRandall Stewart } 2398f8829a4aSRandall Stewart /* notify upper layer protocol */ 2399f8829a4aSRandall Stewart if (stcb->sctp_socket) { 2400f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 2401f8829a4aSRandall Stewart /* are the queues empty? they should be */ 2402f8829a4aSRandall Stewart if (!TAILQ_EMPTY(&asoc->send_queue) || 2403f8829a4aSRandall Stewart !TAILQ_EMPTY(&asoc->sent_queue) || 2404f8829a4aSRandall Stewart !TAILQ_EMPTY(&asoc->out_wheel)) { 24057f34832bSRandall Stewart sctp_report_all_outbound(stcb, 0); 2406f8829a4aSRandall Stewart } 2407f8829a4aSRandall Stewart } 2408f8829a4aSRandall Stewart /* stop the timer */ 2409a5d547adSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_21); 2410f8829a4aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 2411f8829a4aSRandall Stewart /* free the TCB */ 2412a5d547adSRandall Stewart sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22); 2413f8829a4aSRandall Stewart return; 2414f8829a4aSRandall Stewart } 2415f8829a4aSRandall Stewart 2416f8829a4aSRandall Stewart static int 2417f8829a4aSRandall Stewart process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc, 2418f8829a4aSRandall Stewart struct sctp_nets *net, uint8_t flg) 2419f8829a4aSRandall Stewart { 2420f8829a4aSRandall Stewart switch (desc->chunk_type) { 2421f8829a4aSRandall Stewart case SCTP_DATA: 2422f8829a4aSRandall Stewart /* find the tsn to resend (possibly */ 2423f8829a4aSRandall Stewart { 2424f8829a4aSRandall Stewart uint32_t tsn; 2425f8829a4aSRandall Stewart struct sctp_tmit_chunk *tp1; 2426f8829a4aSRandall Stewart 2427f8829a4aSRandall Stewart tsn = ntohl(desc->tsn_ifany); 2428f8829a4aSRandall Stewart tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2429f8829a4aSRandall Stewart while (tp1) { 2430f8829a4aSRandall Stewart if (tp1->rec.data.TSN_seq == tsn) { 2431f8829a4aSRandall Stewart /* found it */ 2432f8829a4aSRandall Stewart break; 2433f8829a4aSRandall Stewart } 2434f8829a4aSRandall Stewart if (compare_with_wrap(tp1->rec.data.TSN_seq, tsn, 2435f8829a4aSRandall Stewart MAX_TSN)) { 2436f8829a4aSRandall Stewart /* not found */ 2437f8829a4aSRandall Stewart tp1 = NULL; 2438f8829a4aSRandall Stewart break; 2439f8829a4aSRandall Stewart } 2440f8829a4aSRandall Stewart tp1 = TAILQ_NEXT(tp1, sctp_next); 2441f8829a4aSRandall Stewart } 2442f8829a4aSRandall Stewart if (tp1 == NULL) { 2443f8829a4aSRandall Stewart /* 2444f8829a4aSRandall Stewart * Do it the other way , aka without paying 2445f8829a4aSRandall Stewart * attention to queue seq order. 2446f8829a4aSRandall Stewart */ 2447f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpdnfnd); 2448f8829a4aSRandall Stewart tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2449f8829a4aSRandall Stewart while (tp1) { 2450f8829a4aSRandall Stewart if (tp1->rec.data.TSN_seq == tsn) { 2451f8829a4aSRandall Stewart /* found it */ 2452f8829a4aSRandall Stewart break; 2453f8829a4aSRandall Stewart } 2454f8829a4aSRandall Stewart tp1 = TAILQ_NEXT(tp1, sctp_next); 2455f8829a4aSRandall Stewart } 2456f8829a4aSRandall Stewart } 2457f8829a4aSRandall Stewart if (tp1 == NULL) { 2458f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrptsnnf); 2459f8829a4aSRandall Stewart } 2460f8829a4aSRandall Stewart if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) { 2461f8829a4aSRandall Stewart uint8_t *ddp; 2462f8829a4aSRandall Stewart 2463f8829a4aSRandall Stewart if ((stcb->asoc.peers_rwnd == 0) && 2464f8829a4aSRandall Stewart ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) { 2465f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpdiwnp); 2466f8829a4aSRandall Stewart return (0); 2467f8829a4aSRandall Stewart } 2468f8829a4aSRandall Stewart if (stcb->asoc.peers_rwnd == 0 && 2469f8829a4aSRandall Stewart (flg & SCTP_FROM_MIDDLE_BOX)) { 2470f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpdizrw); 2471f8829a4aSRandall Stewart return (0); 2472f8829a4aSRandall Stewart } 2473f8829a4aSRandall Stewart ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+ 2474f8829a4aSRandall Stewart sizeof(struct sctp_data_chunk)); 2475f8829a4aSRandall Stewart { 2476f8829a4aSRandall Stewart unsigned int iii; 2477f8829a4aSRandall Stewart 2478f8829a4aSRandall Stewart for (iii = 0; iii < sizeof(desc->data_bytes); 2479f8829a4aSRandall Stewart iii++) { 2480f8829a4aSRandall Stewart if (ddp[iii] != desc->data_bytes[iii]) { 2481f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpbadd); 2482f8829a4aSRandall Stewart return (-1); 2483f8829a4aSRandall Stewart } 2484f8829a4aSRandall Stewart } 2485f8829a4aSRandall Stewart } 2486f8829a4aSRandall Stewart /* 2487f8829a4aSRandall Stewart * We zero out the nonce so resync not 2488f8829a4aSRandall Stewart * needed 2489f8829a4aSRandall Stewart */ 2490f8829a4aSRandall Stewart tp1->rec.data.ect_nonce = 0; 2491f8829a4aSRandall Stewart 2492f8829a4aSRandall Stewart if (tp1->do_rtt) { 2493f8829a4aSRandall Stewart /* 2494f8829a4aSRandall Stewart * this guy had a RTO calculation 2495f8829a4aSRandall Stewart * pending on it, cancel it 2496f8829a4aSRandall Stewart */ 2497f8829a4aSRandall Stewart tp1->do_rtt = 0; 2498f8829a4aSRandall Stewart } 2499f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpmark); 2500f8829a4aSRandall Stewart if (tp1->sent != SCTP_DATAGRAM_RESEND) 2501f8829a4aSRandall Stewart sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2502f8829a4aSRandall Stewart tp1->sent = SCTP_DATAGRAM_RESEND; 2503f8829a4aSRandall Stewart /* 2504f8829a4aSRandall Stewart * mark it as if we were doing a FR, since 2505f8829a4aSRandall Stewart * we will be getting gap ack reports behind 2506f8829a4aSRandall Stewart * the info from the router. 2507f8829a4aSRandall Stewart */ 2508f8829a4aSRandall Stewart tp1->rec.data.doing_fast_retransmit = 1; 2509f8829a4aSRandall Stewart /* 2510f8829a4aSRandall Stewart * mark the tsn with what sequences can 2511f8829a4aSRandall Stewart * cause a new FR. 2512f8829a4aSRandall Stewart */ 2513f8829a4aSRandall Stewart if (TAILQ_EMPTY(&stcb->asoc.send_queue)) { 2514f8829a4aSRandall Stewart tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq; 2515f8829a4aSRandall Stewart } else { 2516f8829a4aSRandall Stewart tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq; 2517f8829a4aSRandall Stewart } 2518f8829a4aSRandall Stewart 2519f8829a4aSRandall Stewart /* restart the timer */ 2520f8829a4aSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2521a5d547adSRandall Stewart stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23); 2522f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2523f8829a4aSRandall Stewart stcb, tp1->whoTo); 2524f8829a4aSRandall Stewart 2525f8829a4aSRandall Stewart /* fix counts and things */ 2526a5d547adSRandall Stewart #ifdef SCTP_FLIGHT_LOGGING 2527c105859eSRandall Stewart sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP, 2528a5d547adSRandall Stewart tp1->whoTo->flight_size, 2529a5d547adSRandall Stewart tp1->book_size, 2530a5d547adSRandall Stewart (uintptr_t) stcb, 2531a5d547adSRandall Stewart tp1->rec.data.TSN_seq); 2532a5d547adSRandall Stewart #endif 2533c105859eSRandall Stewart sctp_flight_size_decrease(tp1); 2534c105859eSRandall Stewart sctp_total_flight_decrease(stcb, tp1); 2535f8829a4aSRandall Stewart } { 2536f8829a4aSRandall Stewart /* audit code */ 2537f8829a4aSRandall Stewart unsigned int audit; 2538f8829a4aSRandall Stewart 2539f8829a4aSRandall Stewart audit = 0; 2540f8829a4aSRandall Stewart TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) { 2541f8829a4aSRandall Stewart if (tp1->sent == SCTP_DATAGRAM_RESEND) 2542f8829a4aSRandall Stewart audit++; 2543f8829a4aSRandall Stewart } 2544f8829a4aSRandall Stewart TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue, 2545f8829a4aSRandall Stewart sctp_next) { 2546f8829a4aSRandall Stewart if (tp1->sent == SCTP_DATAGRAM_RESEND) 2547f8829a4aSRandall Stewart audit++; 2548f8829a4aSRandall Stewart } 2549f8829a4aSRandall Stewart if (audit != stcb->asoc.sent_queue_retran_cnt) { 2550ad81507eSRandall Stewart SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n", 2551f8829a4aSRandall Stewart audit, stcb->asoc.sent_queue_retran_cnt); 2552f8829a4aSRandall Stewart #ifndef SCTP_AUDITING_ENABLED 2553f8829a4aSRandall Stewart stcb->asoc.sent_queue_retran_cnt = audit; 2554f8829a4aSRandall Stewart #endif 2555f8829a4aSRandall Stewart } 2556f8829a4aSRandall Stewart } 2557f8829a4aSRandall Stewart } 2558f8829a4aSRandall Stewart break; 2559f8829a4aSRandall Stewart case SCTP_ASCONF: 2560f8829a4aSRandall Stewart { 2561f8829a4aSRandall Stewart struct sctp_tmit_chunk *asconf; 2562f8829a4aSRandall Stewart 2563f8829a4aSRandall Stewart TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue, 2564f8829a4aSRandall Stewart sctp_next) { 2565f8829a4aSRandall Stewart if (asconf->rec.chunk_id.id == SCTP_ASCONF) { 2566f8829a4aSRandall Stewart break; 2567f8829a4aSRandall Stewart } 2568f8829a4aSRandall Stewart } 2569f8829a4aSRandall Stewart if (asconf) { 2570f8829a4aSRandall Stewart if (asconf->sent != SCTP_DATAGRAM_RESEND) 2571f8829a4aSRandall Stewart sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2572f8829a4aSRandall Stewart asconf->sent = SCTP_DATAGRAM_RESEND; 2573f8829a4aSRandall Stewart asconf->snd_count--; 2574f8829a4aSRandall Stewart } 2575f8829a4aSRandall Stewart } 2576f8829a4aSRandall Stewart break; 2577f8829a4aSRandall Stewart case SCTP_INITIATION: 2578f8829a4aSRandall Stewart /* resend the INIT */ 2579f8829a4aSRandall Stewart stcb->asoc.dropped_special_cnt++; 2580f8829a4aSRandall Stewart if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) { 2581f8829a4aSRandall Stewart /* 2582f8829a4aSRandall Stewart * If we can get it in, in a few attempts we do 2583f8829a4aSRandall Stewart * this, otherwise we let the timer fire. 2584f8829a4aSRandall Stewart */ 2585f8829a4aSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, 2586a5d547adSRandall Stewart stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24); 2587f8829a4aSRandall Stewart sctp_send_initiate(stcb->sctp_ep, stcb); 2588f8829a4aSRandall Stewart } 2589f8829a4aSRandall Stewart break; 2590f8829a4aSRandall Stewart case SCTP_SELECTIVE_ACK: 2591f8829a4aSRandall Stewart /* resend the sack */ 2592f8829a4aSRandall Stewart sctp_send_sack(stcb); 2593f8829a4aSRandall Stewart break; 2594f8829a4aSRandall Stewart case SCTP_HEARTBEAT_REQUEST: 2595f8829a4aSRandall Stewart /* resend a demand HB */ 25966e55db54SRandall Stewart (void)sctp_send_hb(stcb, 1, net); 2597f8829a4aSRandall Stewart break; 2598f8829a4aSRandall Stewart case SCTP_SHUTDOWN: 2599f8829a4aSRandall Stewart sctp_send_shutdown(stcb, net); 2600f8829a4aSRandall Stewart break; 2601f8829a4aSRandall Stewart case SCTP_SHUTDOWN_ACK: 2602f8829a4aSRandall Stewart sctp_send_shutdown_ack(stcb, net); 2603f8829a4aSRandall Stewart break; 2604f8829a4aSRandall Stewart case SCTP_COOKIE_ECHO: 2605f8829a4aSRandall Stewart { 2606f8829a4aSRandall Stewart struct sctp_tmit_chunk *cookie; 2607f8829a4aSRandall Stewart 2608f8829a4aSRandall Stewart cookie = NULL; 2609f8829a4aSRandall Stewart TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue, 2610f8829a4aSRandall Stewart sctp_next) { 2611f8829a4aSRandall Stewart if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 2612f8829a4aSRandall Stewart break; 2613f8829a4aSRandall Stewart } 2614f8829a4aSRandall Stewart } 2615f8829a4aSRandall Stewart if (cookie) { 2616f8829a4aSRandall Stewart if (cookie->sent != SCTP_DATAGRAM_RESEND) 2617f8829a4aSRandall Stewart sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2618f8829a4aSRandall Stewart cookie->sent = SCTP_DATAGRAM_RESEND; 2619f8829a4aSRandall Stewart sctp_stop_all_cookie_timers(stcb); 2620f8829a4aSRandall Stewart } 2621f8829a4aSRandall Stewart } 2622f8829a4aSRandall Stewart break; 2623f8829a4aSRandall Stewart case SCTP_COOKIE_ACK: 2624f8829a4aSRandall Stewart sctp_send_cookie_ack(stcb); 2625f8829a4aSRandall Stewart break; 2626f8829a4aSRandall Stewart case SCTP_ASCONF_ACK: 2627f8829a4aSRandall Stewart /* resend last asconf ack */ 2628f8829a4aSRandall Stewart sctp_send_asconf_ack(stcb, 1); 2629f8829a4aSRandall Stewart break; 2630f8829a4aSRandall Stewart case SCTP_FORWARD_CUM_TSN: 2631f8829a4aSRandall Stewart send_forward_tsn(stcb, &stcb->asoc); 2632f8829a4aSRandall Stewart break; 2633f8829a4aSRandall Stewart /* can't do anything with these */ 2634f8829a4aSRandall Stewart case SCTP_PACKET_DROPPED: 2635f8829a4aSRandall Stewart case SCTP_INITIATION_ACK: /* this should not happen */ 2636f8829a4aSRandall Stewart case SCTP_HEARTBEAT_ACK: 2637f8829a4aSRandall Stewart case SCTP_ABORT_ASSOCIATION: 2638f8829a4aSRandall Stewart case SCTP_OPERATION_ERROR: 2639f8829a4aSRandall Stewart case SCTP_SHUTDOWN_COMPLETE: 2640f8829a4aSRandall Stewart case SCTP_ECN_ECHO: 2641f8829a4aSRandall Stewart case SCTP_ECN_CWR: 2642f8829a4aSRandall Stewart default: 2643f8829a4aSRandall Stewart break; 2644f8829a4aSRandall Stewart } 2645f8829a4aSRandall Stewart return (0); 2646f8829a4aSRandall Stewart } 2647f8829a4aSRandall Stewart 2648f8829a4aSRandall Stewart void 2649f8829a4aSRandall Stewart sctp_reset_in_stream(struct sctp_tcb *stcb, int number_entries, uint16_t * list) 2650f8829a4aSRandall Stewart { 2651f8829a4aSRandall Stewart int i; 2652f8829a4aSRandall Stewart uint16_t temp; 2653f8829a4aSRandall Stewart 2654f8829a4aSRandall Stewart /* 2655f8829a4aSRandall Stewart * We set things to 0xffff since this is the last delivered sequence 2656f8829a4aSRandall Stewart * and we will be sending in 0 after the reset. 2657f8829a4aSRandall Stewart */ 2658f8829a4aSRandall Stewart 2659f8829a4aSRandall Stewart if (number_entries) { 2660f8829a4aSRandall Stewart for (i = 0; i < number_entries; i++) { 2661f8829a4aSRandall Stewart temp = ntohs(list[i]); 2662f8829a4aSRandall Stewart if (temp >= stcb->asoc.streamincnt) { 2663f8829a4aSRandall Stewart continue; 2664f8829a4aSRandall Stewart } 2665f8829a4aSRandall Stewart stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff; 2666f8829a4aSRandall Stewart } 2667f8829a4aSRandall Stewart } else { 2668f8829a4aSRandall Stewart list = NULL; 2669f8829a4aSRandall Stewart for (i = 0; i < stcb->asoc.streamincnt; i++) { 2670f8829a4aSRandall Stewart stcb->asoc.strmin[i].last_sequence_delivered = 0xffff; 2671f8829a4aSRandall Stewart } 2672f8829a4aSRandall Stewart } 2673f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list); 2674f8829a4aSRandall Stewart } 2675f8829a4aSRandall Stewart 2676f8829a4aSRandall Stewart static void 2677f8829a4aSRandall Stewart sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list) 2678f8829a4aSRandall Stewart { 2679f8829a4aSRandall Stewart int i; 2680f8829a4aSRandall Stewart 2681f8829a4aSRandall Stewart if (number_entries == 0) { 2682f8829a4aSRandall Stewart for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 2683f8829a4aSRandall Stewart stcb->asoc.strmout[i].next_sequence_sent = 0; 2684f8829a4aSRandall Stewart } 2685f8829a4aSRandall Stewart } else if (number_entries) { 2686f8829a4aSRandall Stewart for (i = 0; i < number_entries; i++) { 2687f8829a4aSRandall Stewart uint16_t temp; 2688f8829a4aSRandall Stewart 2689f8829a4aSRandall Stewart temp = ntohs(list[i]); 2690f8829a4aSRandall Stewart if (temp >= stcb->asoc.streamoutcnt) { 2691f8829a4aSRandall Stewart /* no such stream */ 2692f8829a4aSRandall Stewart continue; 2693f8829a4aSRandall Stewart } 2694f8829a4aSRandall Stewart stcb->asoc.strmout[temp].next_sequence_sent = 0; 2695f8829a4aSRandall Stewart } 2696f8829a4aSRandall Stewart } 2697f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list); 2698f8829a4aSRandall Stewart } 2699f8829a4aSRandall Stewart 2700f8829a4aSRandall Stewart 2701f8829a4aSRandall Stewart struct sctp_stream_reset_out_request * 2702f8829a4aSRandall Stewart sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk) 2703f8829a4aSRandall Stewart { 2704f8829a4aSRandall Stewart struct sctp_association *asoc; 2705f8829a4aSRandall Stewart struct sctp_stream_reset_out_req *req; 2706f8829a4aSRandall Stewart struct sctp_stream_reset_out_request *r; 2707f8829a4aSRandall Stewart struct sctp_tmit_chunk *chk; 2708f8829a4aSRandall Stewart int len, clen; 2709f8829a4aSRandall Stewart 2710f8829a4aSRandall Stewart asoc = &stcb->asoc; 2711f8829a4aSRandall Stewart if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 2712d06c82f1SRandall Stewart asoc->stream_reset_outstanding = 0; 2713f8829a4aSRandall Stewart return (NULL); 2714f8829a4aSRandall Stewart } 2715f8829a4aSRandall Stewart if (stcb->asoc.str_reset == NULL) { 2716d06c82f1SRandall Stewart asoc->stream_reset_outstanding = 0; 2717f8829a4aSRandall Stewart return (NULL); 2718f8829a4aSRandall Stewart } 2719f8829a4aSRandall Stewart chk = stcb->asoc.str_reset; 2720f8829a4aSRandall Stewart if (chk->data == NULL) { 2721f8829a4aSRandall Stewart return (NULL); 2722f8829a4aSRandall Stewart } 2723f8829a4aSRandall Stewart if (bchk) { 2724f8829a4aSRandall Stewart /* he wants a copy of the chk pointer */ 2725f8829a4aSRandall Stewart *bchk = chk; 2726f8829a4aSRandall Stewart } 2727f8829a4aSRandall Stewart clen = chk->send_size; 2728f8829a4aSRandall Stewart req = mtod(chk->data, struct sctp_stream_reset_out_req *); 2729f8829a4aSRandall Stewart r = &req->sr_req; 2730f8829a4aSRandall Stewart if (ntohl(r->request_seq) == seq) { 2731f8829a4aSRandall Stewart /* found it */ 2732f8829a4aSRandall Stewart return (r); 2733f8829a4aSRandall Stewart } 2734f8829a4aSRandall Stewart len = SCTP_SIZE32(ntohs(r->ph.param_length)); 2735f8829a4aSRandall Stewart if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) { 2736f8829a4aSRandall Stewart /* move to the next one, there can only be a max of two */ 2737f8829a4aSRandall Stewart r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len); 2738f8829a4aSRandall Stewart if (ntohl(r->request_seq) == seq) { 2739f8829a4aSRandall Stewart return (r); 2740f8829a4aSRandall Stewart } 2741f8829a4aSRandall Stewart } 2742f8829a4aSRandall Stewart /* that seq is not here */ 2743f8829a4aSRandall Stewart return (NULL); 2744f8829a4aSRandall Stewart } 2745f8829a4aSRandall Stewart 2746f8829a4aSRandall Stewart static void 2747f8829a4aSRandall Stewart sctp_clean_up_stream_reset(struct sctp_tcb *stcb) 2748f8829a4aSRandall Stewart { 2749f8829a4aSRandall Stewart struct sctp_association *asoc; 2750f8829a4aSRandall Stewart struct sctp_tmit_chunk *chk = stcb->asoc.str_reset; 2751f8829a4aSRandall Stewart 2752f8829a4aSRandall Stewart if (stcb->asoc.str_reset == NULL) { 2753f8829a4aSRandall Stewart return; 2754f8829a4aSRandall Stewart } 2755f42a358aSRandall Stewart asoc = &stcb->asoc; 2756f42a358aSRandall Stewart 2757a5d547adSRandall Stewart sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25); 2758f8829a4aSRandall Stewart TAILQ_REMOVE(&asoc->control_send_queue, 2759f8829a4aSRandall Stewart chk, 2760f8829a4aSRandall Stewart sctp_next); 2761f8829a4aSRandall Stewart if (chk->data) { 2762f8829a4aSRandall Stewart sctp_m_freem(chk->data); 2763f8829a4aSRandall Stewart chk->data = NULL; 2764f8829a4aSRandall Stewart } 2765f8829a4aSRandall Stewart asoc->ctrl_queue_cnt--; 2766f8829a4aSRandall Stewart sctp_free_remote_addr(chk->whoTo); 2767f8829a4aSRandall Stewart 2768f8829a4aSRandall Stewart sctp_free_a_chunk(stcb, chk); 2769f8829a4aSRandall Stewart stcb->asoc.str_reset = NULL; 2770f8829a4aSRandall Stewart } 2771f8829a4aSRandall Stewart 2772f8829a4aSRandall Stewart 2773f8829a4aSRandall Stewart static int 2774f8829a4aSRandall Stewart sctp_handle_stream_reset_response(struct sctp_tcb *stcb, 2775f8829a4aSRandall Stewart uint32_t seq, uint32_t action, 277608598d70SRandall Stewart struct sctp_stream_reset_response *respin) 2777f8829a4aSRandall Stewart { 2778f8829a4aSRandall Stewart uint16_t type; 2779f8829a4aSRandall Stewart int lparm_len; 2780f8829a4aSRandall Stewart struct sctp_association *asoc = &stcb->asoc; 2781f8829a4aSRandall Stewart struct sctp_tmit_chunk *chk; 2782f8829a4aSRandall Stewart struct sctp_stream_reset_out_request *srparam; 2783f8829a4aSRandall Stewart int number_entries; 2784f8829a4aSRandall Stewart 2785f8829a4aSRandall Stewart if (asoc->stream_reset_outstanding == 0) { 2786f8829a4aSRandall Stewart /* duplicate */ 2787f8829a4aSRandall Stewart return (0); 2788f8829a4aSRandall Stewart } 2789f8829a4aSRandall Stewart if (seq == stcb->asoc.str_reset_seq_out) { 2790f8829a4aSRandall Stewart srparam = sctp_find_stream_reset(stcb, seq, &chk); 2791f8829a4aSRandall Stewart if (srparam) { 2792f8829a4aSRandall Stewart stcb->asoc.str_reset_seq_out++; 2793f8829a4aSRandall Stewart type = ntohs(srparam->ph.param_type); 2794f8829a4aSRandall Stewart lparm_len = ntohs(srparam->ph.param_length); 2795f8829a4aSRandall Stewart if (type == SCTP_STR_RESET_OUT_REQUEST) { 279608598d70SRandall Stewart number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t); 2797f8829a4aSRandall Stewart asoc->stream_reset_out_is_outstanding = 0; 2798f8829a4aSRandall Stewart if (asoc->stream_reset_outstanding) 2799f8829a4aSRandall Stewart asoc->stream_reset_outstanding--; 2800f8829a4aSRandall Stewart if (action == SCTP_STREAM_RESET_PERFORMED) { 2801f8829a4aSRandall Stewart /* do it */ 2802f8829a4aSRandall Stewart sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams); 2803f8829a4aSRandall Stewart } else { 2804f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams); 2805f8829a4aSRandall Stewart } 2806f8829a4aSRandall Stewart } else if (type == SCTP_STR_RESET_IN_REQUEST) { 2807f8829a4aSRandall Stewart /* Answered my request */ 280808598d70SRandall Stewart number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t); 2809f8829a4aSRandall Stewart if (asoc->stream_reset_outstanding) 2810f8829a4aSRandall Stewart asoc->stream_reset_outstanding--; 2811f8829a4aSRandall Stewart if (action != SCTP_STREAM_RESET_PERFORMED) { 2812f8829a4aSRandall Stewart sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, number_entries, srparam->list_of_streams); 2813f8829a4aSRandall Stewart } 2814f8829a4aSRandall Stewart } else if (type == SCTP_STR_RESET_TSN_REQUEST) { 2815f8829a4aSRandall Stewart /** 2816f8829a4aSRandall Stewart * a) Adopt the new in tsn. 2817f8829a4aSRandall Stewart * b) reset the map 2818f8829a4aSRandall Stewart * c) Adopt the new out-tsn 2819f8829a4aSRandall Stewart */ 2820f8829a4aSRandall Stewart struct sctp_stream_reset_response_tsn *resp; 2821f8829a4aSRandall Stewart struct sctp_forward_tsn_chunk fwdtsn; 2822f8829a4aSRandall Stewart int abort_flag = 0; 2823f8829a4aSRandall Stewart 2824f8829a4aSRandall Stewart if (respin == NULL) { 2825f8829a4aSRandall Stewart /* huh ? */ 2826f8829a4aSRandall Stewart return (0); 2827f8829a4aSRandall Stewart } 2828f8829a4aSRandall Stewart if (action == SCTP_STREAM_RESET_PERFORMED) { 2829f8829a4aSRandall Stewart resp = (struct sctp_stream_reset_response_tsn *)respin; 2830f8829a4aSRandall Stewart asoc->stream_reset_outstanding--; 2831f8829a4aSRandall Stewart fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 2832f8829a4aSRandall Stewart fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 2833f8829a4aSRandall Stewart fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1); 2834f8829a4aSRandall Stewart sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag); 2835f8829a4aSRandall Stewart if (abort_flag) { 2836f8829a4aSRandall Stewart return (1); 2837f8829a4aSRandall Stewart } 2838f8829a4aSRandall Stewart stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1); 2839f8829a4aSRandall Stewart stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 2840f8829a4aSRandall Stewart stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn); 2841f8829a4aSRandall Stewart memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 2842f8829a4aSRandall Stewart stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn); 2843f8829a4aSRandall Stewart stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn; 2844f8829a4aSRandall Stewart 2845f8829a4aSRandall Stewart sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL); 2846f8829a4aSRandall Stewart sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL); 2847f8829a4aSRandall Stewart 2848f8829a4aSRandall Stewart } 2849f8829a4aSRandall Stewart } 2850f8829a4aSRandall Stewart /* get rid of the request and get the request flags */ 2851f8829a4aSRandall Stewart if (asoc->stream_reset_outstanding == 0) { 2852f8829a4aSRandall Stewart sctp_clean_up_stream_reset(stcb); 2853f8829a4aSRandall Stewart } 2854f8829a4aSRandall Stewart } 2855f8829a4aSRandall Stewart } 2856f8829a4aSRandall Stewart return (0); 2857f8829a4aSRandall Stewart } 2858f8829a4aSRandall Stewart 2859f8829a4aSRandall Stewart static void 2860f8829a4aSRandall Stewart sctp_handle_str_reset_request_in(struct sctp_tcb *stcb, 2861f8829a4aSRandall Stewart struct sctp_tmit_chunk *chk, 2862f8829a4aSRandall Stewart struct sctp_stream_reset_in_request *req) 2863f8829a4aSRandall Stewart { 2864f8829a4aSRandall Stewart uint32_t seq; 2865f8829a4aSRandall Stewart int len, i; 2866f8829a4aSRandall Stewart int number_entries; 2867f8829a4aSRandall Stewart uint16_t temp; 2868f8829a4aSRandall Stewart 2869f8829a4aSRandall Stewart /* 2870f8829a4aSRandall Stewart * peer wants me to send a str-reset to him for my outgoing seq's if 2871f8829a4aSRandall Stewart * seq_in is right. 2872f8829a4aSRandall Stewart */ 2873f8829a4aSRandall Stewart struct sctp_association *asoc = &stcb->asoc; 2874f8829a4aSRandall Stewart 2875f8829a4aSRandall Stewart seq = ntohl(req->request_seq); 2876f8829a4aSRandall Stewart if (asoc->str_reset_seq_in == seq) { 2877f8829a4aSRandall Stewart if (stcb->asoc.stream_reset_out_is_outstanding == 0) { 2878f8829a4aSRandall Stewart len = ntohs(req->ph.param_length); 2879f8829a4aSRandall Stewart number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t)); 2880f8829a4aSRandall Stewart for (i = 0; i < number_entries; i++) { 2881f8829a4aSRandall Stewart temp = ntohs(req->list_of_streams[i]); 2882f8829a4aSRandall Stewart req->list_of_streams[i] = temp; 2883f8829a4aSRandall Stewart } 2884f8829a4aSRandall Stewart /* move the reset action back one */ 2885f8829a4aSRandall Stewart asoc->last_reset_action[1] = asoc->last_reset_action[0]; 2886f8829a4aSRandall Stewart asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 2887f8829a4aSRandall Stewart sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams, 2888f8829a4aSRandall Stewart asoc->str_reset_seq_out, 2889f8829a4aSRandall Stewart seq, (asoc->sending_seq - 1)); 2890f8829a4aSRandall Stewart asoc->stream_reset_out_is_outstanding = 1; 2891f8829a4aSRandall Stewart asoc->str_reset = chk; 2892f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 2893f8829a4aSRandall Stewart stcb->asoc.stream_reset_outstanding++; 2894f8829a4aSRandall Stewart } else { 2895f8829a4aSRandall Stewart /* Can't do it, since we have sent one out */ 2896f8829a4aSRandall Stewart asoc->last_reset_action[1] = asoc->last_reset_action[0]; 2897f8829a4aSRandall Stewart asoc->last_reset_action[0] = SCTP_STREAM_RESET_TRY_LATER; 2898f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 2899f8829a4aSRandall Stewart } 2900f8829a4aSRandall Stewart asoc->str_reset_seq_in++; 2901f8829a4aSRandall Stewart } else if (asoc->str_reset_seq_in - 1 == seq) { 2902f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 2903f8829a4aSRandall Stewart } else if (asoc->str_reset_seq_in - 2 == seq) { 2904f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 2905f8829a4aSRandall Stewart } else { 2906f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 2907f8829a4aSRandall Stewart } 2908f8829a4aSRandall Stewart } 2909f8829a4aSRandall Stewart 2910f8829a4aSRandall Stewart static int 2911f8829a4aSRandall Stewart sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb, 2912f8829a4aSRandall Stewart struct sctp_tmit_chunk *chk, 2913f8829a4aSRandall Stewart struct sctp_stream_reset_tsn_request *req) 2914f8829a4aSRandall Stewart { 2915f8829a4aSRandall Stewart /* reset all in and out and update the tsn */ 2916f8829a4aSRandall Stewart /* 2917f8829a4aSRandall Stewart * A) reset my str-seq's on in and out. B) Select a receive next, 2918f8829a4aSRandall Stewart * and set cum-ack to it. Also process this selected number as a 2919f8829a4aSRandall Stewart * fwd-tsn as well. C) set in the response my next sending seq. 2920f8829a4aSRandall Stewart */ 2921f8829a4aSRandall Stewart struct sctp_forward_tsn_chunk fwdtsn; 2922f8829a4aSRandall Stewart struct sctp_association *asoc = &stcb->asoc; 2923f8829a4aSRandall Stewart int abort_flag = 0; 2924f8829a4aSRandall Stewart uint32_t seq; 2925f8829a4aSRandall Stewart 2926f8829a4aSRandall Stewart seq = ntohl(req->request_seq); 2927f8829a4aSRandall Stewart if (asoc->str_reset_seq_in == seq) { 2928f8829a4aSRandall Stewart fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 2929f8829a4aSRandall Stewart fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 2930f8829a4aSRandall Stewart fwdtsn.ch.chunk_flags = 0; 2931f8829a4aSRandall Stewart fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1); 2932f8829a4aSRandall Stewart sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag); 2933f8829a4aSRandall Stewart if (abort_flag) { 2934f8829a4aSRandall Stewart return (1); 2935f8829a4aSRandall Stewart } 2936f8829a4aSRandall Stewart stcb->asoc.highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA; 2937f8829a4aSRandall Stewart stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 2938f8829a4aSRandall Stewart stcb->asoc.mapping_array_base_tsn = stcb->asoc.highest_tsn_inside_map + 1; 2939f8829a4aSRandall Stewart memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 2940f8829a4aSRandall Stewart atomic_add_int(&stcb->asoc.sending_seq, 1); 2941f8829a4aSRandall Stewart /* save off historical data for retrans */ 2942f8829a4aSRandall Stewart stcb->asoc.last_sending_seq[1] = stcb->asoc.last_sending_seq[0]; 2943f8829a4aSRandall Stewart stcb->asoc.last_sending_seq[0] = stcb->asoc.sending_seq; 2944f8829a4aSRandall Stewart stcb->asoc.last_base_tsnsent[1] = stcb->asoc.last_base_tsnsent[0]; 2945f8829a4aSRandall Stewart stcb->asoc.last_base_tsnsent[0] = stcb->asoc.mapping_array_base_tsn; 2946f8829a4aSRandall Stewart 2947f8829a4aSRandall Stewart sctp_add_stream_reset_result_tsn(chk, 2948f8829a4aSRandall Stewart ntohl(req->request_seq), 2949f8829a4aSRandall Stewart SCTP_STREAM_RESET_PERFORMED, 2950f8829a4aSRandall Stewart stcb->asoc.sending_seq, 2951f8829a4aSRandall Stewart stcb->asoc.mapping_array_base_tsn); 2952f8829a4aSRandall Stewart sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL); 2953f8829a4aSRandall Stewart sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL); 2954f8829a4aSRandall Stewart stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0]; 2955f8829a4aSRandall Stewart stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 2956f8829a4aSRandall Stewart 2957f8829a4aSRandall Stewart asoc->str_reset_seq_in++; 2958f8829a4aSRandall Stewart } else if (asoc->str_reset_seq_in - 1 == seq) { 2959f8829a4aSRandall Stewart sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0], 2960f8829a4aSRandall Stewart stcb->asoc.last_sending_seq[0], 2961f8829a4aSRandall Stewart stcb->asoc.last_base_tsnsent[0] 2962f8829a4aSRandall Stewart ); 2963f8829a4aSRandall Stewart } else if (asoc->str_reset_seq_in - 2 == seq) { 2964f8829a4aSRandall Stewart sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1], 2965f8829a4aSRandall Stewart stcb->asoc.last_sending_seq[1], 2966f8829a4aSRandall Stewart stcb->asoc.last_base_tsnsent[1] 2967f8829a4aSRandall Stewart ); 2968f8829a4aSRandall Stewart } else { 2969f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 2970f8829a4aSRandall Stewart } 2971f8829a4aSRandall Stewart return (0); 2972f8829a4aSRandall Stewart } 2973f8829a4aSRandall Stewart 2974f8829a4aSRandall Stewart static void 2975f8829a4aSRandall Stewart sctp_handle_str_reset_request_out(struct sctp_tcb *stcb, 2976f8829a4aSRandall Stewart struct sctp_tmit_chunk *chk, 2977f8829a4aSRandall Stewart struct sctp_stream_reset_out_request *req) 2978f8829a4aSRandall Stewart { 2979f8829a4aSRandall Stewart uint32_t seq, tsn; 2980f8829a4aSRandall Stewart int number_entries, len; 2981f8829a4aSRandall Stewart struct sctp_association *asoc = &stcb->asoc; 2982f8829a4aSRandall Stewart 2983f8829a4aSRandall Stewart seq = ntohl(req->request_seq); 2984f8829a4aSRandall Stewart 2985f8829a4aSRandall Stewart /* now if its not a duplicate we process it */ 2986f8829a4aSRandall Stewart if (asoc->str_reset_seq_in == seq) { 2987f8829a4aSRandall Stewart len = ntohs(req->ph.param_length); 2988f8829a4aSRandall Stewart number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t)); 2989f8829a4aSRandall Stewart /* 2990f8829a4aSRandall Stewart * the sender is resetting, handle the list issue.. we must 2991f8829a4aSRandall Stewart * a) verify if we can do the reset, if so no problem b) If 2992f8829a4aSRandall Stewart * we can't do the reset we must copy the request. c) queue 2993f8829a4aSRandall Stewart * it, and setup the data in processor to trigger it off 2994f8829a4aSRandall Stewart * when needed and dequeue all the queued data. 2995f8829a4aSRandall Stewart */ 2996f8829a4aSRandall Stewart tsn = ntohl(req->send_reset_at_tsn); 2997f8829a4aSRandall Stewart 2998f8829a4aSRandall Stewart /* move the reset action back one */ 2999f8829a4aSRandall Stewart asoc->last_reset_action[1] = asoc->last_reset_action[0]; 3000f8829a4aSRandall Stewart if ((tsn == asoc->cumulative_tsn) || 3001f8829a4aSRandall Stewart (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN))) { 3002f8829a4aSRandall Stewart /* we can do it now */ 3003f8829a4aSRandall Stewart sctp_reset_in_stream(stcb, number_entries, req->list_of_streams); 3004f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED); 3005f8829a4aSRandall Stewart asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3006f8829a4aSRandall Stewart } else { 3007f8829a4aSRandall Stewart /* 3008f8829a4aSRandall Stewart * we must queue it up and thus wait for the TSN's 3009f8829a4aSRandall Stewart * to arrive that are at or before tsn 3010f8829a4aSRandall Stewart */ 3011f8829a4aSRandall Stewart struct sctp_stream_reset_list *liste; 3012f8829a4aSRandall Stewart int siz; 3013f8829a4aSRandall Stewart 3014f8829a4aSRandall Stewart siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t)); 3015f8829a4aSRandall Stewart SCTP_MALLOC(liste, struct sctp_stream_reset_list *, 3016207304d4SRandall Stewart siz, SCTP_M_STRESET); 3017f8829a4aSRandall Stewart if (liste == NULL) { 3018f8829a4aSRandall Stewart /* gak out of memory */ 3019f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED); 3020f8829a4aSRandall Stewart asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED; 3021f8829a4aSRandall Stewart return; 3022f8829a4aSRandall Stewart } 3023f8829a4aSRandall Stewart liste->tsn = tsn; 3024f8829a4aSRandall Stewart liste->number_entries = number_entries; 3025f8829a4aSRandall Stewart memcpy(&liste->req, req, 3026f8829a4aSRandall Stewart (sizeof(struct sctp_stream_reset_out_request) + (number_entries * sizeof(uint16_t)))); 3027f8829a4aSRandall Stewart TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp); 3028f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED); 3029f8829a4aSRandall Stewart asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3030f8829a4aSRandall Stewart } 3031f8829a4aSRandall Stewart asoc->str_reset_seq_in++; 3032f8829a4aSRandall Stewart } else if ((asoc->str_reset_seq_in - 1) == seq) { 3033f8829a4aSRandall Stewart /* 3034f8829a4aSRandall Stewart * one seq back, just echo back last action since my 3035f8829a4aSRandall Stewart * response was lost. 3036f8829a4aSRandall Stewart */ 3037f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3038f8829a4aSRandall Stewart } else if ((asoc->str_reset_seq_in - 2) == seq) { 3039f8829a4aSRandall Stewart /* 3040f8829a4aSRandall Stewart * two seq back, just echo back last action since my 3041f8829a4aSRandall Stewart * response was lost. 3042f8829a4aSRandall Stewart */ 3043f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 3044f8829a4aSRandall Stewart } else { 3045f8829a4aSRandall Stewart sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 3046f8829a4aSRandall Stewart } 3047f8829a4aSRandall Stewart } 3048f8829a4aSRandall Stewart 3049f8829a4aSRandall Stewart static int 3050f8829a4aSRandall Stewart sctp_handle_stream_reset(struct sctp_tcb *stcb, struct sctp_stream_reset_out_req *sr_req) 3051f8829a4aSRandall Stewart { 3052f8829a4aSRandall Stewart int chk_length, param_len, ptype; 3053f8829a4aSRandall Stewart uint32_t seq; 3054f8829a4aSRandall Stewart int num_req = 0; 3055f8829a4aSRandall Stewart struct sctp_tmit_chunk *chk; 3056f8829a4aSRandall Stewart struct sctp_chunkhdr *ch; 3057f8829a4aSRandall Stewart struct sctp_paramhdr *ph; 3058f42a358aSRandall Stewart int ret_code = 0; 3059f42a358aSRandall Stewart int num_param = 0; 3060f8829a4aSRandall Stewart 3061f8829a4aSRandall Stewart /* now it may be a reset or a reset-response */ 3062f8829a4aSRandall Stewart chk_length = ntohs(sr_req->ch.chunk_length); 3063f8829a4aSRandall Stewart 3064f8829a4aSRandall Stewart /* setup for adding the response */ 3065f8829a4aSRandall Stewart sctp_alloc_a_chunk(stcb, chk); 3066f8829a4aSRandall Stewart if (chk == NULL) { 3067f8829a4aSRandall Stewart return (ret_code); 3068f8829a4aSRandall Stewart } 3069f8829a4aSRandall Stewart chk->rec.chunk_id.id = SCTP_STREAM_RESET; 3070d06c82f1SRandall Stewart chk->rec.chunk_id.can_take_data = 0; 3071f8829a4aSRandall Stewart chk->asoc = &stcb->asoc; 3072f8829a4aSRandall Stewart chk->no_fr_allowed = 0; 3073f8829a4aSRandall Stewart chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr); 307444b7479bSRandall Stewart chk->book_size_scale = 0; 3075139bc87fSRandall Stewart chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 3076f8829a4aSRandall Stewart if (chk->data == NULL) { 3077f8829a4aSRandall Stewart strres_nochunk: 3078f8829a4aSRandall Stewart if (chk->data) { 3079f8829a4aSRandall Stewart sctp_m_freem(chk->data); 3080f8829a4aSRandall Stewart chk->data = NULL; 3081f8829a4aSRandall Stewart } 3082f8829a4aSRandall Stewart sctp_free_a_chunk(stcb, chk); 3083f8829a4aSRandall Stewart return (ret_code); 3084f8829a4aSRandall Stewart } 3085139bc87fSRandall Stewart SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 3086f8829a4aSRandall Stewart 3087f8829a4aSRandall Stewart /* setup chunk parameters */ 3088f8829a4aSRandall Stewart chk->sent = SCTP_DATAGRAM_UNSENT; 3089f8829a4aSRandall Stewart chk->snd_count = 0; 3090f8829a4aSRandall Stewart chk->whoTo = stcb->asoc.primary_destination; 3091f8829a4aSRandall Stewart atomic_add_int(&chk->whoTo->ref_count, 1); 3092f8829a4aSRandall Stewart 3093f8829a4aSRandall Stewart ch = mtod(chk->data, struct sctp_chunkhdr *); 3094f8829a4aSRandall Stewart ch->chunk_type = SCTP_STREAM_RESET; 3095f8829a4aSRandall Stewart ch->chunk_flags = 0; 3096f8829a4aSRandall Stewart ch->chunk_length = htons(chk->send_size); 3097139bc87fSRandall Stewart SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 3098f8829a4aSRandall Stewart ph = (struct sctp_paramhdr *)&sr_req->sr_req; 3099f8829a4aSRandall Stewart while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) { 3100f8829a4aSRandall Stewart param_len = ntohs(ph->param_length); 3101f8829a4aSRandall Stewart if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) { 3102f8829a4aSRandall Stewart /* bad param */ 3103f8829a4aSRandall Stewart break; 3104f8829a4aSRandall Stewart } 3105f8829a4aSRandall Stewart ptype = ntohs(ph->param_type); 3106f8829a4aSRandall Stewart num_param++; 3107f8829a4aSRandall Stewart if (num_param > SCTP_MAX_RESET_PARAMS) { 3108f8829a4aSRandall Stewart /* hit the max of parameters already sorry.. */ 3109f8829a4aSRandall Stewart break; 3110f8829a4aSRandall Stewart } 3111f8829a4aSRandall Stewart if (ptype == SCTP_STR_RESET_OUT_REQUEST) { 3112f8829a4aSRandall Stewart struct sctp_stream_reset_out_request *req_out; 3113f8829a4aSRandall Stewart 3114f8829a4aSRandall Stewart req_out = (struct sctp_stream_reset_out_request *)ph; 3115f8829a4aSRandall Stewart num_req++; 3116f8829a4aSRandall Stewart if (stcb->asoc.stream_reset_outstanding) { 3117f8829a4aSRandall Stewart seq = ntohl(req_out->response_seq); 3118f8829a4aSRandall Stewart if (seq == stcb->asoc.str_reset_seq_out) { 3119f8829a4aSRandall Stewart /* implicit ack */ 3120ad81507eSRandall Stewart (void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_PERFORMED, NULL); 3121f8829a4aSRandall Stewart } 3122f8829a4aSRandall Stewart } 3123f8829a4aSRandall Stewart sctp_handle_str_reset_request_out(stcb, chk, req_out); 3124f8829a4aSRandall Stewart } else if (ptype == SCTP_STR_RESET_IN_REQUEST) { 3125f8829a4aSRandall Stewart struct sctp_stream_reset_in_request *req_in; 3126f8829a4aSRandall Stewart 3127f8829a4aSRandall Stewart num_req++; 3128f8829a4aSRandall Stewart req_in = (struct sctp_stream_reset_in_request *)ph; 3129f8829a4aSRandall Stewart sctp_handle_str_reset_request_in(stcb, chk, req_in); 3130f8829a4aSRandall Stewart } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) { 3131f8829a4aSRandall Stewart struct sctp_stream_reset_tsn_request *req_tsn; 3132f8829a4aSRandall Stewart 3133f8829a4aSRandall Stewart num_req++; 3134f8829a4aSRandall Stewart req_tsn = (struct sctp_stream_reset_tsn_request *)ph; 3135f8829a4aSRandall Stewart if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) { 3136f8829a4aSRandall Stewart ret_code = 1; 3137f8829a4aSRandall Stewart goto strres_nochunk; 3138f8829a4aSRandall Stewart } 3139f8829a4aSRandall Stewart /* no more */ 3140f8829a4aSRandall Stewart break; 3141f8829a4aSRandall Stewart } else if (ptype == SCTP_STR_RESET_RESPONSE) { 3142f8829a4aSRandall Stewart struct sctp_stream_reset_response *resp; 3143f8829a4aSRandall Stewart uint32_t result; 3144f8829a4aSRandall Stewart 3145f8829a4aSRandall Stewart resp = (struct sctp_stream_reset_response *)ph; 3146f8829a4aSRandall Stewart seq = ntohl(resp->response_seq); 3147f8829a4aSRandall Stewart result = ntohl(resp->result); 3148f8829a4aSRandall Stewart if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) { 3149f8829a4aSRandall Stewart ret_code = 1; 3150f8829a4aSRandall Stewart goto strres_nochunk; 3151f8829a4aSRandall Stewart } 3152f8829a4aSRandall Stewart } else { 3153f8829a4aSRandall Stewart break; 3154f8829a4aSRandall Stewart } 3155f8829a4aSRandall Stewart 3156f8829a4aSRandall Stewart ph = (struct sctp_paramhdr *)((caddr_t)ph + SCTP_SIZE32(param_len)); 3157f8829a4aSRandall Stewart chk_length -= SCTP_SIZE32(param_len); 3158f8829a4aSRandall Stewart } 3159f8829a4aSRandall Stewart if (num_req == 0) { 3160f8829a4aSRandall Stewart /* we have no response free the stuff */ 3161f8829a4aSRandall Stewart goto strres_nochunk; 3162f8829a4aSRandall Stewart } 3163f8829a4aSRandall Stewart /* ok we have a chunk to link in */ 3164f8829a4aSRandall Stewart TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, 3165f8829a4aSRandall Stewart chk, 3166f8829a4aSRandall Stewart sctp_next); 3167f8829a4aSRandall Stewart stcb->asoc.ctrl_queue_cnt++; 3168f8829a4aSRandall Stewart return (ret_code); 3169f8829a4aSRandall Stewart } 3170f8829a4aSRandall Stewart 3171f8829a4aSRandall Stewart /* 3172f8829a4aSRandall Stewart * Handle a router or endpoints report of a packet loss, there are two ways 3173f8829a4aSRandall Stewart * to handle this, either we get the whole packet and must disect it 3174f8829a4aSRandall Stewart * ourselves (possibly with truncation and or corruption) or it is a summary 3175f8829a4aSRandall Stewart * from a middle box that did the disectting for us. 3176f8829a4aSRandall Stewart */ 3177f8829a4aSRandall Stewart static void 3178f8829a4aSRandall Stewart sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp, 3179f8829a4aSRandall Stewart struct sctp_tcb *stcb, struct sctp_nets *net) 3180f8829a4aSRandall Stewart { 3181f8829a4aSRandall Stewart uint32_t bottle_bw, on_queue; 3182f8829a4aSRandall Stewart uint16_t trunc_len; 3183f8829a4aSRandall Stewart unsigned int chlen; 3184f8829a4aSRandall Stewart unsigned int at; 3185f8829a4aSRandall Stewart struct sctp_chunk_desc desc; 3186f8829a4aSRandall Stewart struct sctp_chunkhdr *ch; 3187f8829a4aSRandall Stewart 3188f8829a4aSRandall Stewart chlen = ntohs(cp->ch.chunk_length); 3189f8829a4aSRandall Stewart chlen -= sizeof(struct sctp_pktdrop_chunk); 3190f8829a4aSRandall Stewart /* XXX possible chlen underflow */ 3191f8829a4aSRandall Stewart if (chlen == 0) { 3192f8829a4aSRandall Stewart ch = NULL; 3193f8829a4aSRandall Stewart if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) 3194f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpbwrpt); 3195f8829a4aSRandall Stewart } else { 3196f8829a4aSRandall Stewart ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr)); 3197f8829a4aSRandall Stewart chlen -= sizeof(struct sctphdr); 3198f8829a4aSRandall Stewart /* XXX possible chlen underflow */ 3199f8829a4aSRandall Stewart memset(&desc, 0, sizeof(desc)); 3200f8829a4aSRandall Stewart } 3201f8829a4aSRandall Stewart trunc_len = (uint16_t) ntohs(cp->trunc_len); 3202f8829a4aSRandall Stewart /* now the chunks themselves */ 3203f8829a4aSRandall Stewart while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) { 3204f8829a4aSRandall Stewart desc.chunk_type = ch->chunk_type; 3205f8829a4aSRandall Stewart /* get amount we need to move */ 3206f8829a4aSRandall Stewart at = ntohs(ch->chunk_length); 3207f8829a4aSRandall Stewart if (at < sizeof(struct sctp_chunkhdr)) { 3208f8829a4aSRandall Stewart /* corrupt chunk, maybe at the end? */ 3209f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpcrupt); 3210f8829a4aSRandall Stewart break; 3211f8829a4aSRandall Stewart } 3212f8829a4aSRandall Stewart if (trunc_len == 0) { 3213f8829a4aSRandall Stewart /* we are supposed to have all of it */ 3214f8829a4aSRandall Stewart if (at > chlen) { 3215f8829a4aSRandall Stewart /* corrupt skip it */ 3216f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpcrupt); 3217f8829a4aSRandall Stewart break; 3218f8829a4aSRandall Stewart } 3219f8829a4aSRandall Stewart } else { 3220f8829a4aSRandall Stewart /* is there enough of it left ? */ 3221f8829a4aSRandall Stewart if (desc.chunk_type == SCTP_DATA) { 3222f8829a4aSRandall Stewart if (chlen < (sizeof(struct sctp_data_chunk) + 3223f8829a4aSRandall Stewart sizeof(desc.data_bytes))) { 3224f8829a4aSRandall Stewart break; 3225f8829a4aSRandall Stewart } 3226f8829a4aSRandall Stewart } else { 3227f8829a4aSRandall Stewart if (chlen < sizeof(struct sctp_chunkhdr)) { 3228f8829a4aSRandall Stewart break; 3229f8829a4aSRandall Stewart } 3230f8829a4aSRandall Stewart } 3231f8829a4aSRandall Stewart } 3232f8829a4aSRandall Stewart if (desc.chunk_type == SCTP_DATA) { 3233f8829a4aSRandall Stewart /* can we get out the tsn? */ 3234f8829a4aSRandall Stewart if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 3235f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpmbda); 3236f8829a4aSRandall Stewart 3237f8829a4aSRandall Stewart if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) { 3238f8829a4aSRandall Stewart /* yep */ 3239f8829a4aSRandall Stewart struct sctp_data_chunk *dcp; 3240f8829a4aSRandall Stewart uint8_t *ddp; 3241f8829a4aSRandall Stewart unsigned int iii; 3242f8829a4aSRandall Stewart 3243f8829a4aSRandall Stewart dcp = (struct sctp_data_chunk *)ch; 3244f8829a4aSRandall Stewart ddp = (uint8_t *) (dcp + 1); 3245f8829a4aSRandall Stewart for (iii = 0; iii < sizeof(desc.data_bytes); iii++) { 3246f8829a4aSRandall Stewart desc.data_bytes[iii] = ddp[iii]; 3247f8829a4aSRandall Stewart } 3248f8829a4aSRandall Stewart desc.tsn_ifany = dcp->dp.tsn; 3249f8829a4aSRandall Stewart } else { 3250f8829a4aSRandall Stewart /* nope we are done. */ 3251f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpnedat); 3252f8829a4aSRandall Stewart break; 3253f8829a4aSRandall Stewart } 3254f8829a4aSRandall Stewart } else { 3255f8829a4aSRandall Stewart if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 3256f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpmbct); 3257f8829a4aSRandall Stewart } 3258f8829a4aSRandall Stewart 3259f8829a4aSRandall Stewart if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) { 3260f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrppdbrk); 3261f8829a4aSRandall Stewart break; 3262f8829a4aSRandall Stewart } 3263f8829a4aSRandall Stewart if (SCTP_SIZE32(at) > chlen) { 3264f8829a4aSRandall Stewart break; 3265f8829a4aSRandall Stewart } 3266f8829a4aSRandall Stewart chlen -= SCTP_SIZE32(at); 3267f8829a4aSRandall Stewart if (chlen < sizeof(struct sctp_chunkhdr)) { 3268f8829a4aSRandall Stewart /* done, none left */ 3269f8829a4aSRandall Stewart break; 3270f8829a4aSRandall Stewart } 3271f8829a4aSRandall Stewart ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at)); 3272f8829a4aSRandall Stewart } 3273f8829a4aSRandall Stewart /* Now update any rwnd --- possibly */ 3274f8829a4aSRandall Stewart if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) { 3275f8829a4aSRandall Stewart /* From a peer, we get a rwnd report */ 3276f8829a4aSRandall Stewart uint32_t a_rwnd; 3277f8829a4aSRandall Stewart 3278f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpfehos); 3279f8829a4aSRandall Stewart 3280f8829a4aSRandall Stewart bottle_bw = ntohl(cp->bottle_bw); 3281f8829a4aSRandall Stewart on_queue = ntohl(cp->current_onq); 3282f8829a4aSRandall Stewart if (bottle_bw && on_queue) { 3283f8829a4aSRandall Stewart /* a rwnd report is in here */ 3284f8829a4aSRandall Stewart if (bottle_bw > on_queue) 3285f8829a4aSRandall Stewart a_rwnd = bottle_bw - on_queue; 3286f8829a4aSRandall Stewart else 3287f8829a4aSRandall Stewart a_rwnd = 0; 3288f8829a4aSRandall Stewart 3289f8829a4aSRandall Stewart if (a_rwnd == 0) 3290f8829a4aSRandall Stewart stcb->asoc.peers_rwnd = 0; 3291f8829a4aSRandall Stewart else { 3292f8829a4aSRandall Stewart if (a_rwnd > stcb->asoc.total_flight) { 3293f8829a4aSRandall Stewart stcb->asoc.peers_rwnd = 3294f8829a4aSRandall Stewart a_rwnd - stcb->asoc.total_flight; 3295f8829a4aSRandall Stewart } else { 3296f8829a4aSRandall Stewart stcb->asoc.peers_rwnd = 0; 3297f8829a4aSRandall Stewart } 3298f8829a4aSRandall Stewart if (stcb->asoc.peers_rwnd < 3299f8829a4aSRandall Stewart stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 3300f8829a4aSRandall Stewart /* SWS sender side engages */ 3301f8829a4aSRandall Stewart stcb->asoc.peers_rwnd = 0; 3302f8829a4aSRandall Stewart } 3303f8829a4aSRandall Stewart } 3304f8829a4aSRandall Stewart } 3305f8829a4aSRandall Stewart } else { 3306f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_pdrpfmbox); 3307f8829a4aSRandall Stewart } 3308f8829a4aSRandall Stewart 3309f8829a4aSRandall Stewart /* now middle boxes in sat networks get a cwnd bump */ 3310f8829a4aSRandall Stewart if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) && 3311f8829a4aSRandall Stewart (stcb->asoc.sat_t3_loss_recovery == 0) && 3312f8829a4aSRandall Stewart (stcb->asoc.sat_network)) { 3313f8829a4aSRandall Stewart /* 3314f8829a4aSRandall Stewart * This is debateable but for sat networks it makes sense 3315f8829a4aSRandall Stewart * Note if a T3 timer has went off, we will prohibit any 3316f8829a4aSRandall Stewart * changes to cwnd until we exit the t3 loss recovery. 3317f8829a4aSRandall Stewart */ 3318f8829a4aSRandall Stewart uint32_t bw_avail; 3319f8829a4aSRandall Stewart int rtt, incr; 3320f8829a4aSRandall Stewart 3321f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR 3322f8829a4aSRandall Stewart int old_cwnd = net->cwnd; 3323f8829a4aSRandall Stewart 3324f8829a4aSRandall Stewart #endif 3325f8829a4aSRandall Stewart /* need real RTT for this calc */ 3326f8829a4aSRandall Stewart rtt = ((net->lastsa >> 2) + net->lastsv) >> 1; 3327f8829a4aSRandall Stewart /* get bottle neck bw */ 3328f8829a4aSRandall Stewart bottle_bw = ntohl(cp->bottle_bw); 3329f8829a4aSRandall Stewart /* and whats on queue */ 3330f8829a4aSRandall Stewart on_queue = ntohl(cp->current_onq); 3331f8829a4aSRandall Stewart /* 3332f8829a4aSRandall Stewart * adjust the on-queue if our flight is more it could be 3333f8829a4aSRandall Stewart * that the router has not yet gotten data "in-flight" to it 3334f8829a4aSRandall Stewart */ 3335f8829a4aSRandall Stewart if (on_queue < net->flight_size) 3336f8829a4aSRandall Stewart on_queue = net->flight_size; 3337f8829a4aSRandall Stewart 3338f8829a4aSRandall Stewart /* calculate the available space */ 3339f8829a4aSRandall Stewart bw_avail = (bottle_bw * rtt) / 1000; 3340f8829a4aSRandall Stewart if (bw_avail > bottle_bw) { 3341f8829a4aSRandall Stewart /* 3342f8829a4aSRandall Stewart * Cap the growth to no more than the bottle neck. 3343f8829a4aSRandall Stewart * This can happen as RTT slides up due to queues. 3344f8829a4aSRandall Stewart * It also means if you have more than a 1 second 3345f8829a4aSRandall Stewart * RTT with a empty queue you will be limited to the 3346f8829a4aSRandall Stewart * bottle_bw per second no matter if other points 3347f8829a4aSRandall Stewart * have 1/2 the RTT and you could get more out... 3348f8829a4aSRandall Stewart */ 3349f8829a4aSRandall Stewart bw_avail = bottle_bw; 3350f8829a4aSRandall Stewart } 3351f8829a4aSRandall Stewart if (on_queue > bw_avail) { 3352f8829a4aSRandall Stewart /* 3353f8829a4aSRandall Stewart * No room for anything else don't allow anything 3354f8829a4aSRandall Stewart * else to be "added to the fire". 3355f8829a4aSRandall Stewart */ 3356f8829a4aSRandall Stewart int seg_inflight, seg_onqueue, my_portion; 3357f8829a4aSRandall Stewart 3358f8829a4aSRandall Stewart net->partial_bytes_acked = 0; 3359f8829a4aSRandall Stewart 3360f8829a4aSRandall Stewart /* how much are we over queue size? */ 3361f8829a4aSRandall Stewart incr = on_queue - bw_avail; 3362f8829a4aSRandall Stewart if (stcb->asoc.seen_a_sack_this_pkt) { 3363f8829a4aSRandall Stewart /* 3364f8829a4aSRandall Stewart * undo any cwnd adjustment that the sack 3365f8829a4aSRandall Stewart * might have made 3366f8829a4aSRandall Stewart */ 3367f8829a4aSRandall Stewart net->cwnd = net->prev_cwnd; 3368f8829a4aSRandall Stewart } 3369f8829a4aSRandall Stewart /* Now how much of that is mine? */ 3370f8829a4aSRandall Stewart seg_inflight = net->flight_size / net->mtu; 3371f8829a4aSRandall Stewart seg_onqueue = on_queue / net->mtu; 3372f8829a4aSRandall Stewart my_portion = (incr * seg_inflight) / seg_onqueue; 3373f8829a4aSRandall Stewart 3374f8829a4aSRandall Stewart /* Have I made an adjustment already */ 3375f8829a4aSRandall Stewart if (net->cwnd > net->flight_size) { 3376f8829a4aSRandall Stewart /* 3377f8829a4aSRandall Stewart * for this flight I made an adjustment we 3378f8829a4aSRandall Stewart * need to decrease the portion by a share 3379f8829a4aSRandall Stewart * our previous adjustment. 3380f8829a4aSRandall Stewart */ 3381f8829a4aSRandall Stewart int diff_adj; 3382f8829a4aSRandall Stewart 3383f8829a4aSRandall Stewart diff_adj = net->cwnd - net->flight_size; 3384f8829a4aSRandall Stewart if (diff_adj > my_portion) 3385f8829a4aSRandall Stewart my_portion = 0; 3386f8829a4aSRandall Stewart else 3387f8829a4aSRandall Stewart my_portion -= diff_adj; 3388f8829a4aSRandall Stewart } 3389f8829a4aSRandall Stewart /* 3390f8829a4aSRandall Stewart * back down to the previous cwnd (assume we have 3391f8829a4aSRandall Stewart * had a sack before this packet). minus what ever 3392f8829a4aSRandall Stewart * portion of the overage is my fault. 3393f8829a4aSRandall Stewart */ 3394f8829a4aSRandall Stewart net->cwnd -= my_portion; 3395f8829a4aSRandall Stewart 3396f8829a4aSRandall Stewart /* we will NOT back down more than 1 MTU */ 3397f8829a4aSRandall Stewart if (net->cwnd <= net->mtu) { 3398f8829a4aSRandall Stewart net->cwnd = net->mtu; 3399f8829a4aSRandall Stewart } 3400f8829a4aSRandall Stewart /* force into CA */ 3401f8829a4aSRandall Stewart net->ssthresh = net->cwnd - 1; 3402f8829a4aSRandall Stewart } else { 3403f8829a4aSRandall Stewart /* 3404f8829a4aSRandall Stewart * Take 1/4 of the space left or max burst up .. 3405f8829a4aSRandall Stewart * whichever is less. 3406f8829a4aSRandall Stewart */ 3407f8829a4aSRandall Stewart incr = min((bw_avail - on_queue) >> 2, 3408f8829a4aSRandall Stewart (int)stcb->asoc.max_burst * (int)net->mtu); 3409f8829a4aSRandall Stewart net->cwnd += incr; 3410f8829a4aSRandall Stewart } 3411f8829a4aSRandall Stewart if (net->cwnd > bw_avail) { 3412f8829a4aSRandall Stewart /* We can't exceed the pipe size */ 3413f8829a4aSRandall Stewart net->cwnd = bw_avail; 3414f8829a4aSRandall Stewart } 3415f8829a4aSRandall Stewart if (net->cwnd < net->mtu) { 3416f8829a4aSRandall Stewart /* We always have 1 MTU */ 3417f8829a4aSRandall Stewart net->cwnd = net->mtu; 3418f8829a4aSRandall Stewart } 3419f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR 3420f8829a4aSRandall Stewart if (net->cwnd - old_cwnd != 0) { 3421f8829a4aSRandall Stewart /* log only changes */ 3422f8829a4aSRandall Stewart sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), 3423f8829a4aSRandall Stewart SCTP_CWND_LOG_FROM_SAT); 3424f8829a4aSRandall Stewart } 3425f8829a4aSRandall Stewart #endif 3426f8829a4aSRandall Stewart } 3427f8829a4aSRandall Stewart } 3428f8829a4aSRandall Stewart 3429f8829a4aSRandall Stewart /* 3430f8829a4aSRandall Stewart * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to 3431f8829a4aSRandall Stewart * still contain IP/SCTP header - stcb: is the tcb found for this packet - 3432f8829a4aSRandall Stewart * offset: offset into the mbuf chain to first chunkhdr - length: is the 3433f8829a4aSRandall Stewart * length of the complete packet outputs: - length: modified to remaining 3434f8829a4aSRandall Stewart * length after control processing - netp: modified to new sctp_nets after 3435f8829a4aSRandall Stewart * cookie-echo processing - return NULL to discard the packet (ie. no asoc, 3436f8829a4aSRandall Stewart * bad packet,...) otherwise return the tcb for this packet 3437f8829a4aSRandall Stewart */ 34383c6f3536SRandall Stewart #ifdef __GNUC__ 34393c6f3536SRandall Stewart __attribute__((noinline)) 34403c6f3536SRandall Stewart #endif 3441f8829a4aSRandall Stewart static struct sctp_tcb * 3442f8829a4aSRandall Stewart sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length, 3443f8829a4aSRandall Stewart struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp, 344417205eccSRandall Stewart struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen, 344517205eccSRandall Stewart uint32_t vrf_id, uint32_t table_id) 3446f8829a4aSRandall Stewart { 3447f8829a4aSRandall Stewart struct sctp_association *asoc; 3448f8829a4aSRandall Stewart uint32_t vtag_in; 3449f8829a4aSRandall Stewart int num_chunks = 0; /* number of control chunks processed */ 3450f8829a4aSRandall Stewart int chk_length; 3451f8829a4aSRandall Stewart int ret; 3452bff64a4dSRandall Stewart int abort_no_unlock = 0; 3453f8829a4aSRandall Stewart 3454f8829a4aSRandall Stewart /* 3455f8829a4aSRandall Stewart * How big should this be, and should it be alloc'd? Lets try the 3456f8829a4aSRandall Stewart * d-mtu-ceiling for now (2k) and that should hopefully work ... 3457f8829a4aSRandall Stewart * until we get into jumbo grams and such.. 3458f8829a4aSRandall Stewart */ 3459f42a358aSRandall Stewart uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE]; 3460f8829a4aSRandall Stewart struct sctp_tcb *locked_tcb = stcb; 3461f8829a4aSRandall Stewart int got_auth = 0; 3462f8829a4aSRandall Stewart uint32_t auth_offset = 0, auth_len = 0; 3463f8829a4aSRandall Stewart int auth_skipped = 0; 3464f8829a4aSRandall Stewart 3465ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n", 3466f8829a4aSRandall Stewart iphlen, *offset, length, stcb); 3467f8829a4aSRandall Stewart 3468f8829a4aSRandall Stewart /* validate chunk header length... */ 3469f8829a4aSRandall Stewart if (ntohs(ch->chunk_length) < sizeof(*ch)) { 3470d61a0ae0SRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n", 3471d61a0ae0SRandall Stewart ntohs(ch->chunk_length)); 3472207304d4SRandall Stewart if (locked_tcb) { 3473207304d4SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 3474207304d4SRandall Stewart } 3475f8829a4aSRandall Stewart return (NULL); 3476f8829a4aSRandall Stewart } 3477f8829a4aSRandall Stewart /* 3478f8829a4aSRandall Stewart * validate the verification tag 3479f8829a4aSRandall Stewart */ 3480f8829a4aSRandall Stewart vtag_in = ntohl(sh->v_tag); 3481f8829a4aSRandall Stewart 3482a5d547adSRandall Stewart if (locked_tcb) { 3483a5d547adSRandall Stewart SCTP_TCB_LOCK_ASSERT(locked_tcb); 3484a5d547adSRandall Stewart } 3485f8829a4aSRandall Stewart if (ch->chunk_type == SCTP_INITIATION) { 3486d61a0ae0SRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n", 3487d61a0ae0SRandall Stewart ntohs(ch->chunk_length), vtag_in); 3488f8829a4aSRandall Stewart if (vtag_in != 0) { 3489f8829a4aSRandall Stewart /* protocol error- silently discard... */ 3490f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_badvtag); 34916e55db54SRandall Stewart if (locked_tcb) { 3492f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 34936e55db54SRandall Stewart } 3494f8829a4aSRandall Stewart return (NULL); 3495f8829a4aSRandall Stewart } 3496f8829a4aSRandall Stewart } else if (ch->chunk_type != SCTP_COOKIE_ECHO) { 3497f8829a4aSRandall Stewart /* 3498f8829a4aSRandall Stewart * If there is no stcb, skip the AUTH chunk and process 3499f8829a4aSRandall Stewart * later after a stcb is found (to validate the lookup was 3500f8829a4aSRandall Stewart * valid. 3501f8829a4aSRandall Stewart */ 3502f8829a4aSRandall Stewart if ((ch->chunk_type == SCTP_AUTHENTICATION) && 3503f8829a4aSRandall Stewart (stcb == NULL) && !sctp_auth_disable) { 3504f8829a4aSRandall Stewart /* save this chunk for later processing */ 3505f8829a4aSRandall Stewart auth_skipped = 1; 3506f8829a4aSRandall Stewart auth_offset = *offset; 3507f8829a4aSRandall Stewart auth_len = ntohs(ch->chunk_length); 3508f8829a4aSRandall Stewart 3509f8829a4aSRandall Stewart /* (temporarily) move past this chunk */ 3510f8829a4aSRandall Stewart *offset += SCTP_SIZE32(auth_len); 3511f8829a4aSRandall Stewart if (*offset >= length) { 3512f8829a4aSRandall Stewart /* no more data left in the mbuf chain */ 3513f8829a4aSRandall Stewart *offset = length; 3514207304d4SRandall Stewart if (locked_tcb) { 3515207304d4SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 3516207304d4SRandall Stewart } 3517f8829a4aSRandall Stewart return (NULL); 3518f8829a4aSRandall Stewart } 3519f8829a4aSRandall Stewart ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3520f8829a4aSRandall Stewart sizeof(struct sctp_chunkhdr), chunk_buf); 3521f8829a4aSRandall Stewart } 3522ad81507eSRandall Stewart if (ch == NULL) { 3523ad81507eSRandall Stewart /* Help */ 3524ad81507eSRandall Stewart *offset = length; 3525207304d4SRandall Stewart if (locked_tcb) { 3526207304d4SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 3527207304d4SRandall Stewart } 3528ad81507eSRandall Stewart return (NULL); 3529ad81507eSRandall Stewart } 3530f8829a4aSRandall Stewart if (ch->chunk_type == SCTP_COOKIE_ECHO) { 3531f8829a4aSRandall Stewart goto process_control_chunks; 3532f8829a4aSRandall Stewart } 3533f8829a4aSRandall Stewart /* 3534f8829a4aSRandall Stewart * first check if it's an ASCONF with an unknown src addr we 3535f8829a4aSRandall Stewart * need to look inside to find the association 3536f8829a4aSRandall Stewart */ 3537f8829a4aSRandall Stewart if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) { 3538f8829a4aSRandall Stewart /* inp's refcount may be reduced */ 3539f8829a4aSRandall Stewart SCTP_INP_INCR_REF(inp); 3540f8829a4aSRandall Stewart 3541f8829a4aSRandall Stewart stcb = sctp_findassociation_ep_asconf(m, iphlen, 3542f8829a4aSRandall Stewart *offset, sh, &inp, netp); 3543f8829a4aSRandall Stewart if (stcb == NULL) { 3544f8829a4aSRandall Stewart /* 3545f8829a4aSRandall Stewart * reduce inp's refcount if not reduced in 3546f8829a4aSRandall Stewart * sctp_findassociation_ep_asconf(). 3547f8829a4aSRandall Stewart */ 3548f8829a4aSRandall Stewart SCTP_INP_DECR_REF(inp); 3549f8829a4aSRandall Stewart } 3550f8829a4aSRandall Stewart /* now go back and verify any auth chunk to be sure */ 3551f8829a4aSRandall Stewart if (auth_skipped && (stcb != NULL)) { 3552f8829a4aSRandall Stewart struct sctp_auth_chunk *auth; 3553f8829a4aSRandall Stewart 3554f8829a4aSRandall Stewart auth = (struct sctp_auth_chunk *) 3555f8829a4aSRandall Stewart sctp_m_getptr(m, auth_offset, 3556f8829a4aSRandall Stewart auth_len, chunk_buf); 3557f8829a4aSRandall Stewart got_auth = 1; 3558f8829a4aSRandall Stewart auth_skipped = 0; 3559ad81507eSRandall Stewart if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, 3560f8829a4aSRandall Stewart auth_offset)) { 3561f8829a4aSRandall Stewart /* auth HMAC failed so dump it */ 3562f8829a4aSRandall Stewart *offset = length; 3563207304d4SRandall Stewart if (locked_tcb) { 3564207304d4SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 3565207304d4SRandall Stewart } 3566f8829a4aSRandall Stewart return (NULL); 3567f8829a4aSRandall Stewart } else { 3568f8829a4aSRandall Stewart /* remaining chunks are HMAC checked */ 3569f8829a4aSRandall Stewart stcb->asoc.authenticated = 1; 3570f8829a4aSRandall Stewart } 3571f8829a4aSRandall Stewart } 3572f8829a4aSRandall Stewart } 3573f8829a4aSRandall Stewart if (stcb == NULL) { 3574f8829a4aSRandall Stewart /* no association, so it's out of the blue... */ 357517205eccSRandall Stewart sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL, 357617205eccSRandall Stewart vrf_id, table_id); 3577f8829a4aSRandall Stewart *offset = length; 35786e55db54SRandall Stewart if (locked_tcb) { 3579f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 35806e55db54SRandall Stewart } 3581f8829a4aSRandall Stewart return (NULL); 3582f8829a4aSRandall Stewart } 3583f8829a4aSRandall Stewart asoc = &stcb->asoc; 3584f8829a4aSRandall Stewart /* ABORT and SHUTDOWN can use either v_tag... */ 3585f8829a4aSRandall Stewart if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) || 3586f8829a4aSRandall Stewart (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) || 3587f8829a4aSRandall Stewart (ch->chunk_type == SCTP_PACKET_DROPPED)) { 3588f8829a4aSRandall Stewart if ((vtag_in == asoc->my_vtag) || 3589f8829a4aSRandall Stewart ((ch->chunk_flags & SCTP_HAD_NO_TCB) && 3590f8829a4aSRandall Stewart (vtag_in == asoc->peer_vtag))) { 3591f8829a4aSRandall Stewart /* this is valid */ 3592f8829a4aSRandall Stewart } else { 3593f8829a4aSRandall Stewart /* drop this packet... */ 3594f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_badvtag); 35956e55db54SRandall Stewart if (locked_tcb) { 3596f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 35976e55db54SRandall Stewart } 3598f8829a4aSRandall Stewart return (NULL); 3599f8829a4aSRandall Stewart } 3600f8829a4aSRandall Stewart } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 3601f8829a4aSRandall Stewart if (vtag_in != asoc->my_vtag) { 3602f8829a4aSRandall Stewart /* 3603f8829a4aSRandall Stewart * this could be a stale SHUTDOWN-ACK or the 3604f8829a4aSRandall Stewart * peer never got the SHUTDOWN-COMPLETE and 3605f8829a4aSRandall Stewart * is still hung; we have started a new asoc 3606f8829a4aSRandall Stewart * but it won't complete until the shutdown 3607f8829a4aSRandall Stewart * is completed 3608f8829a4aSRandall Stewart */ 36096e55db54SRandall Stewart if (locked_tcb) { 3610f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 36116e55db54SRandall Stewart } 3612f8829a4aSRandall Stewart sctp_handle_ootb(m, iphlen, *offset, sh, inp, 361317205eccSRandall Stewart NULL, vrf_id, table_id); 3614f8829a4aSRandall Stewart return (NULL); 3615f8829a4aSRandall Stewart } 3616f8829a4aSRandall Stewart } else { 3617f8829a4aSRandall Stewart /* for all other chunks, vtag must match */ 3618f8829a4aSRandall Stewart if (vtag_in != asoc->my_vtag) { 3619f8829a4aSRandall Stewart /* invalid vtag... */ 3620ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, 3621ad81507eSRandall Stewart "invalid vtag: %xh, expect %xh\n", 3622ad81507eSRandall Stewart vtag_in, asoc->my_vtag); 3623f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_badvtag); 36246e55db54SRandall Stewart if (locked_tcb) { 3625f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 36266e55db54SRandall Stewart } 3627f8829a4aSRandall Stewart *offset = length; 3628f8829a4aSRandall Stewart return (NULL); 3629f8829a4aSRandall Stewart } 3630f8829a4aSRandall Stewart } 3631f8829a4aSRandall Stewart } /* end if !SCTP_COOKIE_ECHO */ 3632f8829a4aSRandall Stewart /* 3633f8829a4aSRandall Stewart * process all control chunks... 3634f8829a4aSRandall Stewart */ 3635f8829a4aSRandall Stewart if (((ch->chunk_type == SCTP_SELECTIVE_ACK) || 3636f8829a4aSRandall Stewart (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) && 3637f8829a4aSRandall Stewart (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 3638f8829a4aSRandall Stewart /* implied cookie-ack.. we must have lost the ack */ 3639f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 3640f8829a4aSRandall Stewart sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, 3641f8829a4aSRandall Stewart *netp); 3642f8829a4aSRandall Stewart } 3643f8829a4aSRandall Stewart process_control_chunks: 3644f8829a4aSRandall Stewart while (IS_SCTP_CONTROL(ch)) { 3645f8829a4aSRandall Stewart /* validate chunk length */ 3646f8829a4aSRandall Stewart chk_length = ntohs(ch->chunk_length); 3647ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n", 3648f8829a4aSRandall Stewart ch->chunk_type, chk_length); 3649f8829a4aSRandall Stewart if ((size_t)chk_length < sizeof(*ch) || 3650f8829a4aSRandall Stewart (*offset + chk_length) > length) { 3651f8829a4aSRandall Stewart *offset = length; 36526e55db54SRandall Stewart if (locked_tcb) { 3653f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 36546e55db54SRandall Stewart } 3655f8829a4aSRandall Stewart return (NULL); 3656f8829a4aSRandall Stewart } 3657f8829a4aSRandall Stewart SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks); 3658f8829a4aSRandall Stewart /* 3659f8829a4aSRandall Stewart * INIT-ACK only gets the init ack "header" portion only 3660f8829a4aSRandall Stewart * because we don't have to process the peer's COOKIE. All 3661f8829a4aSRandall Stewart * others get a complete chunk. 3662f8829a4aSRandall Stewart */ 3663d06c82f1SRandall Stewart if ((ch->chunk_type == SCTP_INITIATION_ACK) || 3664d06c82f1SRandall Stewart (ch->chunk_type == SCTP_INITIATION)) { 3665f8829a4aSRandall Stewart /* get an init-ack chunk */ 3666f8829a4aSRandall Stewart ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3667f8829a4aSRandall Stewart sizeof(struct sctp_init_ack_chunk), chunk_buf); 3668f8829a4aSRandall Stewart if (ch == NULL) { 3669f8829a4aSRandall Stewart *offset = length; 36706e55db54SRandall Stewart if (locked_tcb) { 3671f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 36726e55db54SRandall Stewart } 3673f8829a4aSRandall Stewart return (NULL); 3674f8829a4aSRandall Stewart } 3675d06c82f1SRandall Stewart } else if (ch->chunk_type == SCTP_COOKIE_ECHO) { 3676d06c82f1SRandall Stewart if (chk_length > sizeof(chunk_buf)) { 3677d06c82f1SRandall Stewart /* 3678d06c82f1SRandall Stewart * use just the size of the chunk buffer so 3679d06c82f1SRandall Stewart * the front part of our cookie is intact. 3680d06c82f1SRandall Stewart * The rest of cookie processing should use 3681d06c82f1SRandall Stewart * the sctp_m_getptr() function to access 3682d06c82f1SRandall Stewart * the other parts. 3683d06c82f1SRandall Stewart */ 3684d06c82f1SRandall Stewart ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3685d06c82f1SRandall Stewart (sizeof(chunk_buf) - 4), 3686d06c82f1SRandall Stewart chunk_buf); 3687d06c82f1SRandall Stewart if (ch == NULL) { 3688d06c82f1SRandall Stewart *offset = length; 36896e55db54SRandall Stewart if (locked_tcb) { 3690d06c82f1SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 36916e55db54SRandall Stewart } 3692d06c82f1SRandall Stewart return (NULL); 3693d06c82f1SRandall Stewart } 3694d06c82f1SRandall Stewart } else { 3695d06c82f1SRandall Stewart /* We can fit it all */ 3696d06c82f1SRandall Stewart goto all_fits; 3697d06c82f1SRandall Stewart } 3698f8829a4aSRandall Stewart } else { 3699f8829a4aSRandall Stewart /* get a complete chunk... */ 3700f8829a4aSRandall Stewart if ((size_t)chk_length > sizeof(chunk_buf)) { 3701f8829a4aSRandall Stewart struct mbuf *oper; 3702f8829a4aSRandall Stewart struct sctp_paramhdr *phdr; 3703f8829a4aSRandall Stewart 3704f8829a4aSRandall Stewart oper = NULL; 3705d06c82f1SRandall Stewart if (stcb) { 3706f8829a4aSRandall Stewart oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 3707139bc87fSRandall Stewart 0, M_DONTWAIT, 1, MT_DATA); 3708d06c82f1SRandall Stewart 3709f8829a4aSRandall Stewart if (oper) { 3710f8829a4aSRandall Stewart /* pre-reserve some space */ 3711139bc87fSRandall Stewart SCTP_BUF_RESV_UF(oper, sizeof(struct sctp_chunkhdr)); 3712139bc87fSRandall Stewart SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr); 3713f8829a4aSRandall Stewart phdr = mtod(oper, struct sctp_paramhdr *); 3714f8829a4aSRandall Stewart phdr->param_type = htons(SCTP_CAUSE_OUT_OF_RESC); 3715f8829a4aSRandall Stewart phdr->param_length = htons(sizeof(struct sctp_paramhdr)); 3716f8829a4aSRandall Stewart sctp_queue_op_err(stcb, oper); 3717f8829a4aSRandall Stewart } 3718d06c82f1SRandall Stewart } 37196e55db54SRandall Stewart if (locked_tcb) { 3720f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 37216e55db54SRandall Stewart } 3722f8829a4aSRandall Stewart return (NULL); 3723f8829a4aSRandall Stewart } 3724d06c82f1SRandall Stewart all_fits: 3725f8829a4aSRandall Stewart ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3726f8829a4aSRandall Stewart chk_length, chunk_buf); 3727f8829a4aSRandall Stewart if (ch == NULL) { 3728ad81507eSRandall Stewart SCTP_PRINTF("sctp_process_control: Can't get the all data....\n"); 3729f8829a4aSRandall Stewart *offset = length; 37306e55db54SRandall Stewart if (locked_tcb) { 3731f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 37326e55db54SRandall Stewart } 3733f8829a4aSRandall Stewart return (NULL); 3734f8829a4aSRandall Stewart } 3735f8829a4aSRandall Stewart } 3736f8829a4aSRandall Stewart num_chunks++; 3737f8829a4aSRandall Stewart /* Save off the last place we got a control from */ 3738f8829a4aSRandall Stewart if (stcb != NULL) { 3739ad81507eSRandall Stewart if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) { 3740f8829a4aSRandall Stewart /* 3741f8829a4aSRandall Stewart * allow last_control to be NULL if 3742f8829a4aSRandall Stewart * ASCONF... ASCONF processing will find the 3743f8829a4aSRandall Stewart * right net later 3744f8829a4aSRandall Stewart */ 3745ad81507eSRandall Stewart if ((netp != NULL) && (*netp != NULL)) 3746f8829a4aSRandall Stewart stcb->asoc.last_control_chunk_from = *netp; 3747f8829a4aSRandall Stewart } 3748f8829a4aSRandall Stewart } 3749f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED 3750f8829a4aSRandall Stewart sctp_audit_log(0xB0, ch->chunk_type); 3751f8829a4aSRandall Stewart #endif 3752f8829a4aSRandall Stewart 3753f8829a4aSRandall Stewart /* check to see if this chunk required auth, but isn't */ 3754f8829a4aSRandall Stewart if ((stcb != NULL) && !sctp_auth_disable && 3755f8829a4aSRandall Stewart sctp_auth_is_required_chunk(ch->chunk_type, 3756f8829a4aSRandall Stewart stcb->asoc.local_auth_chunks) && 3757f8829a4aSRandall Stewart !stcb->asoc.authenticated) { 3758f8829a4aSRandall Stewart /* "silently" ignore */ 3759f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_recvauthmissing); 3760f8829a4aSRandall Stewart goto next_chunk; 3761f8829a4aSRandall Stewart } 3762f8829a4aSRandall Stewart switch (ch->chunk_type) { 3763f8829a4aSRandall Stewart case SCTP_INITIATION: 3764f8829a4aSRandall Stewart /* must be first and only chunk */ 3765ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n"); 3766f8829a4aSRandall Stewart if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3767f8829a4aSRandall Stewart /* We are not interested anymore? */ 3768f8829a4aSRandall Stewart if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3769f8829a4aSRandall Stewart /* 3770f8829a4aSRandall Stewart * collision case where we are 3771f8829a4aSRandall Stewart * sending to them too 3772f8829a4aSRandall Stewart */ 3773f8829a4aSRandall Stewart ; 3774f8829a4aSRandall Stewart } else { 37756e55db54SRandall Stewart if (locked_tcb) { 3776f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 37776e55db54SRandall Stewart } 3778f8829a4aSRandall Stewart *offset = length; 3779f8829a4aSRandall Stewart return (NULL); 3780f8829a4aSRandall Stewart } 3781f8829a4aSRandall Stewart } 3782f8829a4aSRandall Stewart if ((num_chunks > 1) || 3783f8829a4aSRandall Stewart (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3784f8829a4aSRandall Stewart *offset = length; 37856e55db54SRandall Stewart if (locked_tcb) { 3786f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 37876e55db54SRandall Stewart } 3788f8829a4aSRandall Stewart return (NULL); 3789f8829a4aSRandall Stewart } 3790f8829a4aSRandall Stewart if ((stcb != NULL) && 3791f8829a4aSRandall Stewart (SCTP_GET_STATE(&stcb->asoc) == 3792f8829a4aSRandall Stewart SCTP_STATE_SHUTDOWN_ACK_SENT)) { 3793f8829a4aSRandall Stewart sctp_send_shutdown_ack(stcb, 3794f8829a4aSRandall Stewart stcb->asoc.primary_destination); 3795f8829a4aSRandall Stewart *offset = length; 3796f8829a4aSRandall Stewart sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 37976e55db54SRandall Stewart if (locked_tcb) { 3798f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 37996e55db54SRandall Stewart } 3800f8829a4aSRandall Stewart return (NULL); 3801f8829a4aSRandall Stewart } 3802ad81507eSRandall Stewart if (netp) { 3803f8829a4aSRandall Stewart sctp_handle_init(m, iphlen, *offset, sh, 3804ad81507eSRandall Stewart (struct sctp_init_chunk *)ch, inp, 3805ad81507eSRandall Stewart stcb, *netp, &abort_no_unlock, vrf_id, table_id); 3806ad81507eSRandall Stewart } 3807bff64a4dSRandall Stewart if (abort_no_unlock) 3808bff64a4dSRandall Stewart return (NULL); 3809bff64a4dSRandall Stewart 3810f8829a4aSRandall Stewart *offset = length; 38116e55db54SRandall Stewart if (locked_tcb) { 3812f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 38136e55db54SRandall Stewart } 3814f8829a4aSRandall Stewart return (NULL); 3815f8829a4aSRandall Stewart break; 3816f8829a4aSRandall Stewart case SCTP_INITIATION_ACK: 3817f8829a4aSRandall Stewart /* must be first and only chunk */ 3818ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n"); 3819f8829a4aSRandall Stewart if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3820f8829a4aSRandall Stewart /* We are not interested anymore */ 3821f8829a4aSRandall Stewart if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3822f8829a4aSRandall Stewart ; 3823f8829a4aSRandall Stewart } else { 38246e55db54SRandall Stewart if (locked_tcb) { 3825f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 38266e55db54SRandall Stewart } 3827f8829a4aSRandall Stewart *offset = length; 3828f8829a4aSRandall Stewart if (stcb) { 3829a5d547adSRandall Stewart sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26); 3830f8829a4aSRandall Stewart } 3831f8829a4aSRandall Stewart return (NULL); 3832f8829a4aSRandall Stewart } 3833f8829a4aSRandall Stewart } 3834f8829a4aSRandall Stewart if ((num_chunks > 1) || 3835f8829a4aSRandall Stewart (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3836f8829a4aSRandall Stewart *offset = length; 38376e55db54SRandall Stewart if (locked_tcb) { 3838f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 38396e55db54SRandall Stewart } 3840f8829a4aSRandall Stewart return (NULL); 3841f8829a4aSRandall Stewart } 3842ad81507eSRandall Stewart if ((netp) && (*netp)) { 3843f8829a4aSRandall Stewart ret = sctp_handle_init_ack(m, iphlen, *offset, sh, 384417205eccSRandall Stewart (struct sctp_init_ack_chunk *)ch, stcb, *netp, &abort_no_unlock, vrf_id, table_id); 3845ad81507eSRandall Stewart } else { 3846ad81507eSRandall Stewart ret = -1; 3847ad81507eSRandall Stewart } 3848f8829a4aSRandall Stewart /* 3849f8829a4aSRandall Stewart * Special case, I must call the output routine to 3850f8829a4aSRandall Stewart * get the cookie echoed 3851f8829a4aSRandall Stewart */ 3852bff64a4dSRandall Stewart if (abort_no_unlock) 3853bff64a4dSRandall Stewart return (NULL); 3854bff64a4dSRandall Stewart 3855f8829a4aSRandall Stewart if ((stcb) && ret == 0) 3856f8829a4aSRandall Stewart sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 3857f8829a4aSRandall Stewart *offset = length; 38586e55db54SRandall Stewart if (locked_tcb) { 3859f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 38606e55db54SRandall Stewart } 3861f8829a4aSRandall Stewart return (NULL); 3862f8829a4aSRandall Stewart break; 3863f8829a4aSRandall Stewart case SCTP_SELECTIVE_ACK: 3864ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n"); 3865f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_recvsacks); 3866f8829a4aSRandall Stewart { 3867f8829a4aSRandall Stewart struct sctp_sack_chunk *sack; 3868f8829a4aSRandall Stewart int abort_now = 0; 3869f8829a4aSRandall Stewart uint32_t a_rwnd, cum_ack; 3870f8829a4aSRandall Stewart uint16_t num_seg; 3871f8829a4aSRandall Stewart int nonce_sum_flag; 3872f8829a4aSRandall Stewart 3873ad81507eSRandall Stewart if ((stcb == NULL) || (chk_length < sizeof(struct sctp_sack_chunk))) { 3874ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on sack chunk, too small\n"); 387517205eccSRandall Stewart *offset = length; 38766e55db54SRandall Stewart if (locked_tcb) { 38776114cd96SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 38786e55db54SRandall Stewart } 3879d06c82f1SRandall Stewart return (NULL); 3880d06c82f1SRandall Stewart } 3881f8829a4aSRandall Stewart sack = (struct sctp_sack_chunk *)ch; 3882f8829a4aSRandall Stewart nonce_sum_flag = ch->chunk_flags & SCTP_SACK_NONCE_SUM; 3883f8829a4aSRandall Stewart cum_ack = ntohl(sack->sack.cum_tsn_ack); 3884f8829a4aSRandall Stewart num_seg = ntohs(sack->sack.num_gap_ack_blks); 3885f8829a4aSRandall Stewart a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd); 3886f8829a4aSRandall Stewart stcb->asoc.seen_a_sack_this_pkt = 1; 3887f8829a4aSRandall Stewart if ((stcb->asoc.pr_sctp_cnt == 0) && 3888f8829a4aSRandall Stewart (num_seg == 0) && 3889f8829a4aSRandall Stewart ((compare_with_wrap(cum_ack, stcb->asoc.last_acked_seq, MAX_TSN)) || 3890f8829a4aSRandall Stewart (cum_ack == stcb->asoc.last_acked_seq)) && 3891f8829a4aSRandall Stewart (stcb->asoc.saw_sack_with_frags == 0) && 3892f8829a4aSRandall Stewart (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) 3893f8829a4aSRandall Stewart ) { 3894f8829a4aSRandall Stewart /* 3895f8829a4aSRandall Stewart * We have a SIMPLE sack having no 3896f8829a4aSRandall Stewart * prior segments and data on sent 3897f8829a4aSRandall Stewart * queue to be acked.. Use the 3898f8829a4aSRandall Stewart * faster path sack processing. We 3899f8829a4aSRandall Stewart * also allow window update sacks 3900f8829a4aSRandall Stewart * with no missing segments to go 3901f8829a4aSRandall Stewart * this way too. 3902f8829a4aSRandall Stewart */ 3903d06c82f1SRandall Stewart sctp_express_handle_sack(stcb, cum_ack, a_rwnd, nonce_sum_flag, 3904d06c82f1SRandall Stewart &abort_now); 3905f8829a4aSRandall Stewart } else { 3906ad81507eSRandall Stewart if (netp && *netp) 3907d06c82f1SRandall Stewart sctp_handle_sack(sack, stcb, *netp, &abort_now, chk_length, a_rwnd); 3908f8829a4aSRandall Stewart } 3909f8829a4aSRandall Stewart if (abort_now) { 3910f8829a4aSRandall Stewart /* ABORT signal from sack processing */ 3911f8829a4aSRandall Stewart *offset = length; 3912f8829a4aSRandall Stewart return (NULL); 3913f8829a4aSRandall Stewart } 3914f8829a4aSRandall Stewart } 3915f8829a4aSRandall Stewart break; 3916f8829a4aSRandall Stewart case SCTP_HEARTBEAT_REQUEST: 3917ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n"); 3918ad81507eSRandall Stewart if ((stcb) && netp && *netp) { 3919f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_recvheartbeat); 3920ad81507eSRandall Stewart sctp_send_heartbeat_ack(stcb, m, *offset, 3921ad81507eSRandall Stewart chk_length, *netp); 3922f8829a4aSRandall Stewart 3923f8829a4aSRandall Stewart /* He's alive so give him credit */ 3924f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 3925ad81507eSRandall Stewart } 3926f8829a4aSRandall Stewart break; 3927f8829a4aSRandall Stewart case SCTP_HEARTBEAT_ACK: 3928ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n"); 3929ad81507eSRandall Stewart if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) { 3930d06c82f1SRandall Stewart /* Its not ours */ 393117205eccSRandall Stewart *offset = length; 39326e55db54SRandall Stewart if (locked_tcb) { 39336114cd96SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 39346e55db54SRandall Stewart } 3935d06c82f1SRandall Stewart return (NULL); 3936d06c82f1SRandall Stewart } 3937f8829a4aSRandall Stewart /* He's alive so give him credit */ 3938f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 3939f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_recvheartbeatack); 3940ad81507eSRandall Stewart if (netp && *netp) 3941f8829a4aSRandall Stewart sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch, 3942f8829a4aSRandall Stewart stcb, *netp); 3943f8829a4aSRandall Stewart break; 3944f8829a4aSRandall Stewart case SCTP_ABORT_ASSOCIATION: 3945207304d4SRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n", 3946207304d4SRandall Stewart stcb); 3947ad81507eSRandall Stewart if ((stcb) && netp && *netp) 3948f8829a4aSRandall Stewart sctp_handle_abort((struct sctp_abort_chunk *)ch, 3949f8829a4aSRandall Stewart stcb, *netp); 3950f8829a4aSRandall Stewart *offset = length; 3951f8829a4aSRandall Stewart return (NULL); 3952f8829a4aSRandall Stewart break; 3953f8829a4aSRandall Stewart case SCTP_SHUTDOWN: 3954207304d4SRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n", 3955207304d4SRandall Stewart stcb); 3956ad81507eSRandall Stewart if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) { 3957d06c82f1SRandall Stewart *offset = length; 39586e55db54SRandall Stewart if (locked_tcb) { 39596114cd96SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 39606e55db54SRandall Stewart } 3961d06c82f1SRandall Stewart return (NULL); 3962d06c82f1SRandall Stewart 3963ad81507eSRandall Stewart } 3964ad81507eSRandall Stewart if (netp && *netp) { 3965f8829a4aSRandall Stewart int abort_flag = 0; 3966f8829a4aSRandall Stewart 3967f8829a4aSRandall Stewart sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch, 3968f8829a4aSRandall Stewart stcb, *netp, &abort_flag); 3969f8829a4aSRandall Stewart if (abort_flag) { 3970f8829a4aSRandall Stewart *offset = length; 3971f8829a4aSRandall Stewart return (NULL); 3972f8829a4aSRandall Stewart } 3973f8829a4aSRandall Stewart } 3974f8829a4aSRandall Stewart break; 3975f8829a4aSRandall Stewart case SCTP_SHUTDOWN_ACK: 3976207304d4SRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", stcb); 3977ad81507eSRandall Stewart if ((stcb) && (netp) && (*netp)) 3978f8829a4aSRandall Stewart sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp); 3979f8829a4aSRandall Stewart *offset = length; 3980f8829a4aSRandall Stewart return (NULL); 3981f8829a4aSRandall Stewart break; 3982ad81507eSRandall Stewart 3983f8829a4aSRandall Stewart case SCTP_OPERATION_ERROR: 3984ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n"); 3985ad81507eSRandall Stewart if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) { 3986ad81507eSRandall Stewart 3987f8829a4aSRandall Stewart *offset = length; 3988f8829a4aSRandall Stewart return (NULL); 3989f8829a4aSRandall Stewart } 3990f8829a4aSRandall Stewart break; 3991f8829a4aSRandall Stewart case SCTP_COOKIE_ECHO: 3992ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, 3993207304d4SRandall Stewart "SCTP_COOKIE-ECHO, stcb %p\n", stcb); 3994f8829a4aSRandall Stewart if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3995f8829a4aSRandall Stewart ; 3996f8829a4aSRandall Stewart } else { 3997ad81507eSRandall Stewart if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3998f8829a4aSRandall Stewart /* We are not interested anymore */ 3999f8829a4aSRandall Stewart *offset = length; 4000f8829a4aSRandall Stewart return (NULL); 4001f8829a4aSRandall Stewart } 4002f8829a4aSRandall Stewart } 4003f8829a4aSRandall Stewart /* 4004f8829a4aSRandall Stewart * First are we accepting? We do this again here 4005ad81507eSRandall Stewart * sincen it is possible that a previous endpoint 4006ad81507eSRandall Stewart * WAS listening responded to a INIT-ACK and then 4007f8829a4aSRandall Stewart * closed. We opened and bound.. and are now no 4008f8829a4aSRandall Stewart * longer listening. 4009f8829a4aSRandall Stewart */ 4010f8829a4aSRandall Stewart if (inp->sctp_socket->so_qlimit == 0) { 4011f8829a4aSRandall Stewart if ((stcb) && (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 4012f8829a4aSRandall Stewart /* 4013f8829a4aSRandall Stewart * special case, is this a retran'd 4014f8829a4aSRandall Stewart * COOKIE-ECHO or a restarting assoc 4015f8829a4aSRandall Stewart * that is a peeled off or 4016f8829a4aSRandall Stewart * one-to-one style socket. 4017f8829a4aSRandall Stewart */ 4018f8829a4aSRandall Stewart goto process_cookie_anyway; 4019f8829a4aSRandall Stewart } 402017205eccSRandall Stewart sctp_abort_association(inp, stcb, m, iphlen, 402117205eccSRandall Stewart sh, NULL, vrf_id, 402217205eccSRandall Stewart table_id); 4023f8829a4aSRandall Stewart *offset = length; 4024f8829a4aSRandall Stewart return (NULL); 4025f8829a4aSRandall Stewart } else if (inp->sctp_socket->so_qlimit) { 4026f8829a4aSRandall Stewart /* we are accepting so check limits like TCP */ 4027f8829a4aSRandall Stewart if (inp->sctp_socket->so_qlen > 4028f8829a4aSRandall Stewart inp->sctp_socket->so_qlimit) { 4029f8829a4aSRandall Stewart /* no space */ 4030f8829a4aSRandall Stewart struct mbuf *oper; 4031f8829a4aSRandall Stewart struct sctp_paramhdr *phdr; 4032f8829a4aSRandall Stewart 4033f8829a4aSRandall Stewart if (sctp_abort_if_one_2_one_hits_limit) { 4034f8829a4aSRandall Stewart oper = NULL; 4035f8829a4aSRandall Stewart oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 4036139bc87fSRandall Stewart 0, M_DONTWAIT, 1, MT_DATA); 4037f8829a4aSRandall Stewart if (oper) { 4038139bc87fSRandall Stewart SCTP_BUF_LEN(oper) = 4039f8829a4aSRandall Stewart sizeof(struct sctp_paramhdr); 4040f8829a4aSRandall Stewart phdr = mtod(oper, 4041f8829a4aSRandall Stewart struct sctp_paramhdr *); 4042f8829a4aSRandall Stewart phdr->param_type = 4043f8829a4aSRandall Stewart htons(SCTP_CAUSE_OUT_OF_RESC); 4044f8829a4aSRandall Stewart phdr->param_length = 4045f8829a4aSRandall Stewart htons(sizeof(struct sctp_paramhdr)); 4046f8829a4aSRandall Stewart } 4047f8829a4aSRandall Stewart sctp_abort_association(inp, stcb, m, 404817205eccSRandall Stewart iphlen, sh, oper, vrf_id, table_id); 4049f8829a4aSRandall Stewart } 4050f8829a4aSRandall Stewart *offset = length; 4051f8829a4aSRandall Stewart return (NULL); 4052f8829a4aSRandall Stewart } 4053f8829a4aSRandall Stewart } 4054f8829a4aSRandall Stewart process_cookie_anyway: 4055f8829a4aSRandall Stewart { 4056f8829a4aSRandall Stewart struct mbuf *ret_buf; 4057a5d547adSRandall Stewart struct sctp_inpcb *linp; 4058f8829a4aSRandall Stewart 4059ad81507eSRandall Stewart if (stcb) { 4060a5d547adSRandall Stewart linp = NULL; 4061ad81507eSRandall Stewart } else { 4062a5d547adSRandall Stewart linp = inp; 4063ad81507eSRandall Stewart } 4064a5d547adSRandall Stewart 4065ad81507eSRandall Stewart if (linp) { 4066a5d547adSRandall Stewart SCTP_ASOC_CREATE_LOCK(linp); 4067ad81507eSRandall Stewart } 4068ad81507eSRandall Stewart if (netp) { 4069f8829a4aSRandall Stewart ret_buf = 4070f8829a4aSRandall Stewart sctp_handle_cookie_echo(m, iphlen, 4071f8829a4aSRandall Stewart *offset, sh, 4072f8829a4aSRandall Stewart (struct sctp_cookie_echo_chunk *)ch, 4073f8829a4aSRandall Stewart &inp, &stcb, netp, 4074f8829a4aSRandall Stewart auth_skipped, 4075f8829a4aSRandall Stewart auth_offset, 4076a5d547adSRandall Stewart auth_len, 407717205eccSRandall Stewart &locked_tcb, 407817205eccSRandall Stewart vrf_id, 407917205eccSRandall Stewart table_id); 4080ad81507eSRandall Stewart } else { 4081ad81507eSRandall Stewart ret_buf = NULL; 4082ad81507eSRandall Stewart } 4083ad81507eSRandall Stewart if (linp) { 4084a5d547adSRandall Stewart SCTP_ASOC_CREATE_UNLOCK(linp); 4085ad81507eSRandall Stewart } 4086f8829a4aSRandall Stewart if (ret_buf == NULL) { 4087f8829a4aSRandall Stewart if (locked_tcb) { 4088f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 4089f8829a4aSRandall Stewart } 4090ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, 4091ad81507eSRandall Stewart "GAK, null buffer\n"); 4092f8829a4aSRandall Stewart auth_skipped = 0; 4093f8829a4aSRandall Stewart *offset = length; 4094f8829a4aSRandall Stewart return (NULL); 4095f8829a4aSRandall Stewart } 4096f8829a4aSRandall Stewart /* if AUTH skipped, see if it verified... */ 4097f8829a4aSRandall Stewart if (auth_skipped) { 4098f8829a4aSRandall Stewart got_auth = 1; 4099f8829a4aSRandall Stewart auth_skipped = 0; 4100f8829a4aSRandall Stewart } 4101f8829a4aSRandall Stewart if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) { 4102f8829a4aSRandall Stewart /* 4103f8829a4aSRandall Stewart * Restart the timer if we have 4104f8829a4aSRandall Stewart * pending data 4105f8829a4aSRandall Stewart */ 4106f8829a4aSRandall Stewart struct sctp_tmit_chunk *chk; 4107f8829a4aSRandall Stewart 4108f8829a4aSRandall Stewart chk = TAILQ_FIRST(&stcb->asoc.sent_queue); 4109f8829a4aSRandall Stewart if (chk) { 4110f8829a4aSRandall Stewart sctp_timer_start(SCTP_TIMER_TYPE_SEND, 4111f8829a4aSRandall Stewart stcb->sctp_ep, stcb, 4112f8829a4aSRandall Stewart chk->whoTo); 4113f8829a4aSRandall Stewart } 4114f8829a4aSRandall Stewart } 4115f8829a4aSRandall Stewart } 4116f8829a4aSRandall Stewart break; 4117f8829a4aSRandall Stewart case SCTP_COOKIE_ACK: 4118207304d4SRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", stcb); 4119ad81507eSRandall Stewart if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) { 41206e55db54SRandall Stewart if (locked_tcb) { 412117205eccSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 41226e55db54SRandall Stewart } 412317205eccSRandall Stewart return (NULL); 412417205eccSRandall Stewart } 4125f8829a4aSRandall Stewart if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4126f8829a4aSRandall Stewart /* We are not interested anymore */ 4127f8829a4aSRandall Stewart if ((stcb) && (stcb->asoc.total_output_queue_size)) { 4128f8829a4aSRandall Stewart ; 4129ad81507eSRandall Stewart } else if (stcb) { 4130a5d547adSRandall Stewart sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27); 4131f8829a4aSRandall Stewart *offset = length; 4132f8829a4aSRandall Stewart return (NULL); 4133f8829a4aSRandall Stewart } 4134f8829a4aSRandall Stewart } 4135f8829a4aSRandall Stewart /* He's alive so give him credit */ 4136ad81507eSRandall Stewart if ((stcb) && netp && *netp) { 4137f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 4138f8829a4aSRandall Stewart sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp); 41396e55db54SRandall Stewart } 4140f8829a4aSRandall Stewart break; 4141f8829a4aSRandall Stewart case SCTP_ECN_ECHO: 4142ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n"); 4143f8829a4aSRandall Stewart /* He's alive so give him credit */ 4144ad81507eSRandall Stewart if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) { 4145d06c82f1SRandall Stewart /* Its not ours */ 41466e55db54SRandall Stewart if (locked_tcb) { 41476114cd96SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 41486e55db54SRandall Stewart } 4149d06c82f1SRandall Stewart *offset = length; 4150d06c82f1SRandall Stewart return (NULL); 4151d06c82f1SRandall Stewart } 41526e55db54SRandall Stewart if (stcb) { 4153f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 4154f8829a4aSRandall Stewart sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, 4155f8829a4aSRandall Stewart stcb); 41566e55db54SRandall Stewart } 4157f8829a4aSRandall Stewart break; 4158f8829a4aSRandall Stewart case SCTP_ECN_CWR: 4159ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n"); 4160f8829a4aSRandall Stewart /* He's alive so give him credit */ 4161ad81507eSRandall Stewart if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) { 4162d06c82f1SRandall Stewart /* Its not ours */ 41636e55db54SRandall Stewart if (locked_tcb) { 41646114cd96SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 41656e55db54SRandall Stewart } 4166d06c82f1SRandall Stewart *offset = length; 4167d06c82f1SRandall Stewart return (NULL); 4168d06c82f1SRandall Stewart } 41696e55db54SRandall Stewart if (stcb) { 4170f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 4171f8829a4aSRandall Stewart sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb); 41726e55db54SRandall Stewart } 4173f8829a4aSRandall Stewart break; 4174f8829a4aSRandall Stewart case SCTP_SHUTDOWN_COMPLETE: 4175207304d4SRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", stcb); 4176f8829a4aSRandall Stewart /* must be first and only chunk */ 4177f8829a4aSRandall Stewart if ((num_chunks > 1) || 4178f8829a4aSRandall Stewart (length - *offset > SCTP_SIZE32(chk_length))) { 4179f8829a4aSRandall Stewart *offset = length; 41806e55db54SRandall Stewart if (locked_tcb) { 4181f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 41826e55db54SRandall Stewart } 4183f8829a4aSRandall Stewart return (NULL); 4184f8829a4aSRandall Stewart } 4185ad81507eSRandall Stewart if ((stcb) && netp && *netp) { 4186f8829a4aSRandall Stewart sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch, 4187f8829a4aSRandall Stewart stcb, *netp); 41886e55db54SRandall Stewart } 4189f8829a4aSRandall Stewart *offset = length; 4190f8829a4aSRandall Stewart return (NULL); 4191f8829a4aSRandall Stewart break; 4192f8829a4aSRandall Stewart case SCTP_ASCONF: 4193ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n"); 4194f8829a4aSRandall Stewart /* He's alive so give him credit */ 41956e55db54SRandall Stewart if (stcb) { 4196f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 4197f8829a4aSRandall Stewart sctp_handle_asconf(m, *offset, 4198f8829a4aSRandall Stewart (struct sctp_asconf_chunk *)ch, stcb); 41996e55db54SRandall Stewart } 4200f8829a4aSRandall Stewart break; 4201f8829a4aSRandall Stewart case SCTP_ASCONF_ACK: 4202ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n"); 4203d06c82f1SRandall Stewart if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) { 4204d06c82f1SRandall Stewart /* Its not ours */ 42056e55db54SRandall Stewart if (locked_tcb) { 42066114cd96SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 42076e55db54SRandall Stewart } 4208d06c82f1SRandall Stewart *offset = length; 4209d06c82f1SRandall Stewart return (NULL); 4210d06c82f1SRandall Stewart } 4211ad81507eSRandall Stewart if ((stcb) && netp && *netp) { 4212f8829a4aSRandall Stewart /* He's alive so give him credit */ 4213f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 4214f8829a4aSRandall Stewart sctp_handle_asconf_ack(m, *offset, 4215f8829a4aSRandall Stewart (struct sctp_asconf_ack_chunk *)ch, stcb, *netp); 42166e55db54SRandall Stewart } 4217f8829a4aSRandall Stewart break; 4218f8829a4aSRandall Stewart case SCTP_FORWARD_CUM_TSN: 4219ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n"); 4220d06c82f1SRandall Stewart if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) { 4221d06c82f1SRandall Stewart /* Its not ours */ 42226e55db54SRandall Stewart if (locked_tcb) { 42236114cd96SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 42246e55db54SRandall Stewart } 4225d06c82f1SRandall Stewart *offset = length; 4226d06c82f1SRandall Stewart return (NULL); 4227d06c82f1SRandall Stewart } 4228f8829a4aSRandall Stewart /* He's alive so give him credit */ 42296e55db54SRandall Stewart if (stcb) { 4230f8829a4aSRandall Stewart int abort_flag = 0; 4231f8829a4aSRandall Stewart 4232f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 4233f8829a4aSRandall Stewart *fwd_tsn_seen = 1; 4234f8829a4aSRandall Stewart if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4235f8829a4aSRandall Stewart /* We are not interested anymore */ 4236a5d547adSRandall Stewart sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28); 4237f8829a4aSRandall Stewart *offset = length; 4238f8829a4aSRandall Stewart return (NULL); 4239f8829a4aSRandall Stewart } 4240f8829a4aSRandall Stewart sctp_handle_forward_tsn(stcb, 4241f8829a4aSRandall Stewart (struct sctp_forward_tsn_chunk *)ch, &abort_flag); 4242f8829a4aSRandall Stewart if (abort_flag) { 4243f8829a4aSRandall Stewart *offset = length; 4244f8829a4aSRandall Stewart return (NULL); 4245f8829a4aSRandall Stewart } else { 4246f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 4247f8829a4aSRandall Stewart } 4248f8829a4aSRandall Stewart 4249f8829a4aSRandall Stewart } 4250f8829a4aSRandall Stewart break; 4251f8829a4aSRandall Stewart case SCTP_STREAM_RESET: 4252ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n"); 4253f8829a4aSRandall Stewart ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4254f8829a4aSRandall Stewart chk_length, chunk_buf); 4255ad81507eSRandall Stewart if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) { 4256d06c82f1SRandall Stewart /* Its not ours */ 42576e55db54SRandall Stewart if (locked_tcb) { 42586114cd96SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 42596e55db54SRandall Stewart } 4260d06c82f1SRandall Stewart *offset = length; 4261d06c82f1SRandall Stewart return (NULL); 4262d06c82f1SRandall Stewart } 4263f8829a4aSRandall Stewart if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4264f8829a4aSRandall Stewart /* We are not interested anymore */ 4265a5d547adSRandall Stewart sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29); 4266f8829a4aSRandall Stewart *offset = length; 4267f8829a4aSRandall Stewart return (NULL); 4268f8829a4aSRandall Stewart } 4269f8829a4aSRandall Stewart if (stcb->asoc.peer_supports_strreset == 0) { 4270f8829a4aSRandall Stewart /* 4271ad81507eSRandall Stewart * hmm, peer should have announced this, but 4272ad81507eSRandall Stewart * we will turn it on since he is sending us 4273ad81507eSRandall Stewart * a stream reset. 4274f8829a4aSRandall Stewart */ 4275f8829a4aSRandall Stewart stcb->asoc.peer_supports_strreset = 1; 4276f8829a4aSRandall Stewart } 4277f8829a4aSRandall Stewart if (sctp_handle_stream_reset(stcb, (struct sctp_stream_reset_out_req *)ch)) { 4278f8829a4aSRandall Stewart /* stop processing */ 4279f8829a4aSRandall Stewart *offset = length; 4280f8829a4aSRandall Stewart return (NULL); 4281f8829a4aSRandall Stewart } 4282f8829a4aSRandall Stewart break; 4283f8829a4aSRandall Stewart case SCTP_PACKET_DROPPED: 4284ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n"); 4285f8829a4aSRandall Stewart /* re-get it all please */ 4286d06c82f1SRandall Stewart if (chk_length < sizeof(struct sctp_pktdrop_chunk)) { 4287d06c82f1SRandall Stewart /* Its not ours */ 42886e55db54SRandall Stewart if (locked_tcb) { 42896114cd96SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 42906e55db54SRandall Stewart } 4291d06c82f1SRandall Stewart *offset = length; 4292d06c82f1SRandall Stewart return (NULL); 4293d06c82f1SRandall Stewart } 4294f8829a4aSRandall Stewart ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4295f8829a4aSRandall Stewart chk_length, chunk_buf); 4296f8829a4aSRandall Stewart 4297ad81507eSRandall Stewart if (ch && (stcb) && netp && (*netp)) { 4298f8829a4aSRandall Stewart sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch, 4299f8829a4aSRandall Stewart stcb, *netp); 43006e55db54SRandall Stewart } 4301f8829a4aSRandall Stewart break; 4302f8829a4aSRandall Stewart 4303f8829a4aSRandall Stewart case SCTP_AUTHENTICATION: 4304ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n"); 4305f8829a4aSRandall Stewart if (sctp_auth_disable) 4306f8829a4aSRandall Stewart goto unknown_chunk; 4307f8829a4aSRandall Stewart 4308f8829a4aSRandall Stewart if (stcb == NULL) { 4309f8829a4aSRandall Stewart /* save the first AUTH for later processing */ 4310f8829a4aSRandall Stewart if (auth_skipped == 0) { 4311f8829a4aSRandall Stewart auth_offset = *offset; 4312f8829a4aSRandall Stewart auth_len = chk_length; 4313f8829a4aSRandall Stewart auth_skipped = 1; 4314f8829a4aSRandall Stewart } 4315f8829a4aSRandall Stewart /* skip this chunk (temporarily) */ 4316f8829a4aSRandall Stewart goto next_chunk; 4317f8829a4aSRandall Stewart } 4318d06c82f1SRandall Stewart if ((chk_length < (sizeof(struct sctp_auth_chunk))) || 4319ad81507eSRandall Stewart (chk_length > (sizeof(struct sctp_auth_chunk) + 4320ad81507eSRandall Stewart SCTP_AUTH_DIGEST_LEN_MAX))) { 4321d06c82f1SRandall Stewart /* Its not ours */ 43226e55db54SRandall Stewart if (locked_tcb) { 43236114cd96SRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 43246e55db54SRandall Stewart } 4325d06c82f1SRandall Stewart *offset = length; 4326d06c82f1SRandall Stewart return (NULL); 4327d06c82f1SRandall Stewart } 4328f8829a4aSRandall Stewart if (got_auth == 1) { 4329f8829a4aSRandall Stewart /* skip this chunk... it's already auth'd */ 4330f8829a4aSRandall Stewart goto next_chunk; 4331f8829a4aSRandall Stewart } 4332f8829a4aSRandall Stewart ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4333f8829a4aSRandall Stewart chk_length, chunk_buf); 4334f8829a4aSRandall Stewart got_auth = 1; 4335ad81507eSRandall Stewart if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch, 4336f8829a4aSRandall Stewart m, *offset)) { 4337f8829a4aSRandall Stewart /* auth HMAC failed so dump the packet */ 4338f8829a4aSRandall Stewart *offset = length; 4339f8829a4aSRandall Stewart return (stcb); 4340f8829a4aSRandall Stewart } else { 4341f8829a4aSRandall Stewart /* remaining chunks are HMAC checked */ 4342f8829a4aSRandall Stewart stcb->asoc.authenticated = 1; 4343f8829a4aSRandall Stewart } 4344f8829a4aSRandall Stewart break; 4345f8829a4aSRandall Stewart 4346f8829a4aSRandall Stewart default: 4347f8829a4aSRandall Stewart unknown_chunk: 4348f8829a4aSRandall Stewart /* it's an unknown chunk! */ 4349f8829a4aSRandall Stewart if ((ch->chunk_type & 0x40) && (stcb != NULL)) { 4350f8829a4aSRandall Stewart struct mbuf *mm; 4351f8829a4aSRandall Stewart struct sctp_paramhdr *phd; 4352f8829a4aSRandall Stewart 4353f8829a4aSRandall Stewart mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 4354139bc87fSRandall Stewart 0, M_DONTWAIT, 1, MT_DATA); 4355f8829a4aSRandall Stewart if (mm) { 4356f8829a4aSRandall Stewart phd = mtod(mm, struct sctp_paramhdr *); 4357f8829a4aSRandall Stewart /* 4358f8829a4aSRandall Stewart * We cheat and use param type since 4359f8829a4aSRandall Stewart * we did not bother to define a 4360f8829a4aSRandall Stewart * error cause struct. They are the 4361f8829a4aSRandall Stewart * same basic format with different 4362f8829a4aSRandall Stewart * names. 4363f8829a4aSRandall Stewart */ 4364f8829a4aSRandall Stewart phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK); 4365f8829a4aSRandall Stewart phd->param_length = htons(chk_length + sizeof(*phd)); 4366139bc87fSRandall Stewart SCTP_BUF_LEN(mm) = sizeof(*phd); 436744b7479bSRandall Stewart SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, SCTP_SIZE32(chk_length), 4368f8829a4aSRandall Stewart M_DONTWAIT); 4369139bc87fSRandall Stewart if (SCTP_BUF_NEXT(mm)) { 4370f8829a4aSRandall Stewart sctp_queue_op_err(stcb, mm); 4371f8829a4aSRandall Stewart } else { 4372f8829a4aSRandall Stewart sctp_m_freem(mm); 4373f8829a4aSRandall Stewart } 4374f8829a4aSRandall Stewart } 4375f8829a4aSRandall Stewart } 4376f8829a4aSRandall Stewart if ((ch->chunk_type & 0x80) == 0) { 4377f8829a4aSRandall Stewart /* discard this packet */ 4378f8829a4aSRandall Stewart *offset = length; 4379f8829a4aSRandall Stewart return (stcb); 4380f8829a4aSRandall Stewart } /* else skip this bad chunk and continue... */ 4381f8829a4aSRandall Stewart break; 4382f8829a4aSRandall Stewart } /* switch (ch->chunk_type) */ 4383f8829a4aSRandall Stewart 4384f8829a4aSRandall Stewart 4385f8829a4aSRandall Stewart next_chunk: 4386f8829a4aSRandall Stewart /* get the next chunk */ 4387f8829a4aSRandall Stewart *offset += SCTP_SIZE32(chk_length); 4388f8829a4aSRandall Stewart if (*offset >= length) { 4389f8829a4aSRandall Stewart /* no more data left in the mbuf chain */ 4390f8829a4aSRandall Stewart break; 4391f8829a4aSRandall Stewart } 4392f8829a4aSRandall Stewart ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4393f8829a4aSRandall Stewart sizeof(struct sctp_chunkhdr), chunk_buf); 4394f8829a4aSRandall Stewart if (ch == NULL) { 43956e55db54SRandall Stewart if (locked_tcb) { 4396f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(locked_tcb); 43976e55db54SRandall Stewart } 4398f8829a4aSRandall Stewart *offset = length; 4399f8829a4aSRandall Stewart return (NULL); 4400f8829a4aSRandall Stewart } 4401f8829a4aSRandall Stewart } /* while */ 4402f8829a4aSRandall Stewart return (stcb); 4403f8829a4aSRandall Stewart } 4404f8829a4aSRandall Stewart 4405f8829a4aSRandall Stewart 4406f8829a4aSRandall Stewart /* 4407f8829a4aSRandall Stewart * Process the ECN bits we have something set so we must look to see if it is 4408f8829a4aSRandall Stewart * ECN(0) or ECN(1) or CE 4409f8829a4aSRandall Stewart */ 4410f8829a4aSRandall Stewart static __inline void 4411f8829a4aSRandall Stewart sctp_process_ecn_marked_a(struct sctp_tcb *stcb, struct sctp_nets *net, 4412f8829a4aSRandall Stewart uint8_t ecn_bits) 4413f8829a4aSRandall Stewart { 4414f8829a4aSRandall Stewart if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 4415f8829a4aSRandall Stewart ; 4416f8829a4aSRandall Stewart } else if ((ecn_bits & SCTP_ECT1_BIT) == SCTP_ECT1_BIT) { 4417f8829a4aSRandall Stewart /* 4418f8829a4aSRandall Stewart * we only add to the nonce sum for ECT1, ECT0 does not 4419f8829a4aSRandall Stewart * change the NS bit (that we have yet to find a way to send 4420f8829a4aSRandall Stewart * it yet). 4421f8829a4aSRandall Stewart */ 4422f8829a4aSRandall Stewart 4423f8829a4aSRandall Stewart /* ECN Nonce stuff */ 4424f8829a4aSRandall Stewart stcb->asoc.receiver_nonce_sum++; 4425f8829a4aSRandall Stewart stcb->asoc.receiver_nonce_sum &= SCTP_SACK_NONCE_SUM; 4426f8829a4aSRandall Stewart 4427f8829a4aSRandall Stewart /* 4428f8829a4aSRandall Stewart * Drag up the last_echo point if cumack is larger since we 4429f8829a4aSRandall Stewart * don't want the point falling way behind by more than 4430f8829a4aSRandall Stewart * 2^^31 and then having it be incorrect. 4431f8829a4aSRandall Stewart */ 4432f8829a4aSRandall Stewart if (compare_with_wrap(stcb->asoc.cumulative_tsn, 4433f8829a4aSRandall Stewart stcb->asoc.last_echo_tsn, MAX_TSN)) { 4434f8829a4aSRandall Stewart stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 4435f8829a4aSRandall Stewart } 4436f8829a4aSRandall Stewart } else if ((ecn_bits & SCTP_ECT0_BIT) == SCTP_ECT0_BIT) { 4437f8829a4aSRandall Stewart /* 4438f8829a4aSRandall Stewart * Drag up the last_echo point if cumack is larger since we 4439f8829a4aSRandall Stewart * don't want the point falling way behind by more than 4440f8829a4aSRandall Stewart * 2^^31 and then having it be incorrect. 4441f8829a4aSRandall Stewart */ 4442f8829a4aSRandall Stewart if (compare_with_wrap(stcb->asoc.cumulative_tsn, 4443f8829a4aSRandall Stewart stcb->asoc.last_echo_tsn, MAX_TSN)) { 4444f8829a4aSRandall Stewart stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 4445f8829a4aSRandall Stewart } 4446f8829a4aSRandall Stewart } 4447f8829a4aSRandall Stewart } 4448f8829a4aSRandall Stewart 4449f8829a4aSRandall Stewart static __inline void 4450f8829a4aSRandall Stewart sctp_process_ecn_marked_b(struct sctp_tcb *stcb, struct sctp_nets *net, 4451f8829a4aSRandall Stewart uint32_t high_tsn, uint8_t ecn_bits) 4452f8829a4aSRandall Stewart { 4453f8829a4aSRandall Stewart if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 4454f8829a4aSRandall Stewart /* 4455f8829a4aSRandall Stewart * we possibly must notify the sender that a congestion 4456f8829a4aSRandall Stewart * window reduction is in order. We do this by adding a ECNE 4457f8829a4aSRandall Stewart * chunk to the output chunk queue. The incoming CWR will 4458f8829a4aSRandall Stewart * remove this chunk. 4459f8829a4aSRandall Stewart */ 4460f8829a4aSRandall Stewart if (compare_with_wrap(high_tsn, stcb->asoc.last_echo_tsn, 4461f8829a4aSRandall Stewart MAX_TSN)) { 4462f8829a4aSRandall Stewart /* Yep, we need to add a ECNE */ 4463f8829a4aSRandall Stewart sctp_send_ecn_echo(stcb, net, high_tsn); 4464f8829a4aSRandall Stewart stcb->asoc.last_echo_tsn = high_tsn; 4465f8829a4aSRandall Stewart } 4466f8829a4aSRandall Stewart } 4467f8829a4aSRandall Stewart } 4468f8829a4aSRandall Stewart 4469f8829a4aSRandall Stewart /* 4470f8829a4aSRandall Stewart * common input chunk processing (v4 and v6) 4471f8829a4aSRandall Stewart */ 44726e55db54SRandall Stewart void 4473f8829a4aSRandall Stewart sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, 4474f8829a4aSRandall Stewart int length, struct sctphdr *sh, struct sctp_chunkhdr *ch, 4475f8829a4aSRandall Stewart struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 447617205eccSRandall Stewart uint8_t ecn_bits, uint32_t vrf_id, uint32_t table_id) 4477f8829a4aSRandall Stewart { 4478f8829a4aSRandall Stewart /* 4479f8829a4aSRandall Stewart * Control chunk processing 4480f8829a4aSRandall Stewart */ 4481f8829a4aSRandall Stewart uint32_t high_tsn; 4482f8829a4aSRandall Stewart int fwd_tsn_seen = 0, data_processed = 0; 4483f8829a4aSRandall Stewart struct mbuf *m = *mm; 4484f8829a4aSRandall Stewart int abort_flag = 0; 4485f8829a4aSRandall Stewart int un_sent; 4486f8829a4aSRandall Stewart 4487f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_recvdatagrams); 4488f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED 4489f8829a4aSRandall Stewart sctp_audit_log(0xE0, 1); 4490f8829a4aSRandall Stewart sctp_auditing(0, inp, stcb, net); 4491f8829a4aSRandall Stewart #endif 4492f8829a4aSRandall Stewart 4493ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d\n", 449450cec919SRandall Stewart m, iphlen, offset); 4495f8829a4aSRandall Stewart 4496f8829a4aSRandall Stewart if (stcb) { 4497f8829a4aSRandall Stewart /* always clear this before beginning a packet */ 4498f8829a4aSRandall Stewart stcb->asoc.authenticated = 0; 4499f8829a4aSRandall Stewart stcb->asoc.seen_a_sack_this_pkt = 0; 4500f8829a4aSRandall Stewart } 4501f8829a4aSRandall Stewart if (IS_SCTP_CONTROL(ch)) { 4502f8829a4aSRandall Stewart /* process the control portion of the SCTP packet */ 45033c503c28SRandall Stewart /* sa_ignore NO_NULL_CHK */ 4504f8829a4aSRandall Stewart stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch, 450517205eccSRandall Stewart inp, stcb, &net, &fwd_tsn_seen, vrf_id, table_id); 4506f8829a4aSRandall Stewart if (stcb) { 4507f8829a4aSRandall Stewart /* 4508f8829a4aSRandall Stewart * This covers us if the cookie-echo was there and 4509f8829a4aSRandall Stewart * it changes our INP. 4510f8829a4aSRandall Stewart */ 4511f8829a4aSRandall Stewart inp = stcb->sctp_ep; 4512f8829a4aSRandall Stewart } 4513f8829a4aSRandall Stewart } else { 4514f8829a4aSRandall Stewart /* 4515f8829a4aSRandall Stewart * no control chunks, so pre-process DATA chunks (these 4516f8829a4aSRandall Stewart * checks are taken care of by control processing) 4517f8829a4aSRandall Stewart */ 4518f8829a4aSRandall Stewart 4519f8829a4aSRandall Stewart /* 4520f8829a4aSRandall Stewart * if DATA only packet, and auth is required, then punt... 4521f8829a4aSRandall Stewart * can't have authenticated without any AUTH (control) 4522f8829a4aSRandall Stewart * chunks 4523f8829a4aSRandall Stewart */ 4524f8829a4aSRandall Stewart if ((stcb != NULL) && !sctp_auth_disable && 4525f8829a4aSRandall Stewart sctp_auth_is_required_chunk(SCTP_DATA, 4526f8829a4aSRandall Stewart stcb->asoc.local_auth_chunks)) { 4527f8829a4aSRandall Stewart /* "silently" ignore */ 4528f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_recvauthmissing); 4529f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(stcb); 45306e55db54SRandall Stewart return; 4531f8829a4aSRandall Stewart } 4532f8829a4aSRandall Stewart if (stcb == NULL) { 4533f8829a4aSRandall Stewart /* out of the blue DATA chunk */ 453417205eccSRandall Stewart sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL, 453517205eccSRandall Stewart vrf_id, table_id); 45366e55db54SRandall Stewart return; 4537f8829a4aSRandall Stewart } 4538f8829a4aSRandall Stewart if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) { 4539f8829a4aSRandall Stewart /* v_tag mismatch! */ 4540f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_badvtag); 4541f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(stcb); 45426e55db54SRandall Stewart return; 4543f8829a4aSRandall Stewart } 4544f8829a4aSRandall Stewart } 4545f8829a4aSRandall Stewart 4546f8829a4aSRandall Stewart if (stcb == NULL) { 4547f8829a4aSRandall Stewart /* 4548f8829a4aSRandall Stewart * no valid TCB for this packet, or we found it's a bad 4549f8829a4aSRandall Stewart * packet while processing control, or we're done with this 4550f8829a4aSRandall Stewart * packet (done or skip rest of data), so we drop it... 4551f8829a4aSRandall Stewart */ 45526e55db54SRandall Stewart return; 4553f8829a4aSRandall Stewart } 4554f8829a4aSRandall Stewart /* 4555f8829a4aSRandall Stewart * DATA chunk processing 4556f8829a4aSRandall Stewart */ 4557f8829a4aSRandall Stewart /* plow through the data chunks while length > offset */ 4558f8829a4aSRandall Stewart 4559f8829a4aSRandall Stewart /* 4560f8829a4aSRandall Stewart * Rest should be DATA only. Check authentication state if AUTH for 4561f8829a4aSRandall Stewart * DATA is required. 4562f8829a4aSRandall Stewart */ 4563a5d547adSRandall Stewart if ((length > offset) && (stcb != NULL) && !sctp_auth_disable && 4564f8829a4aSRandall Stewart sctp_auth_is_required_chunk(SCTP_DATA, 4565f8829a4aSRandall Stewart stcb->asoc.local_auth_chunks) && 4566f8829a4aSRandall Stewart !stcb->asoc.authenticated) { 4567f8829a4aSRandall Stewart /* "silently" ignore */ 4568f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_recvauthmissing); 4569ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_AUTH1, 4570ad81507eSRandall Stewart "Data chunk requires AUTH, skipped\n"); 4571a5d547adSRandall Stewart goto trigger_send; 4572f8829a4aSRandall Stewart } 4573f8829a4aSRandall Stewart if (length > offset) { 4574f8829a4aSRandall Stewart int retval; 4575f8829a4aSRandall Stewart 4576f8829a4aSRandall Stewart /* 4577f8829a4aSRandall Stewart * First check to make sure our state is correct. We would 4578f8829a4aSRandall Stewart * not get here unless we really did have a tag, so we don't 4579f8829a4aSRandall Stewart * abort if this happens, just dump the chunk silently. 4580f8829a4aSRandall Stewart */ 4581f8829a4aSRandall Stewart switch (SCTP_GET_STATE(&stcb->asoc)) { 4582f8829a4aSRandall Stewart case SCTP_STATE_COOKIE_ECHOED: 4583f8829a4aSRandall Stewart /* 4584f8829a4aSRandall Stewart * we consider data with valid tags in this state 4585f8829a4aSRandall Stewart * shows us the cookie-ack was lost. Imply it was 4586f8829a4aSRandall Stewart * there. 4587f8829a4aSRandall Stewart */ 4588f8829a4aSRandall Stewart stcb->asoc.overall_error_count = 0; 4589f8829a4aSRandall Stewart sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net); 4590f8829a4aSRandall Stewart break; 4591f8829a4aSRandall Stewart case SCTP_STATE_COOKIE_WAIT: 4592f8829a4aSRandall Stewart /* 4593f8829a4aSRandall Stewart * We consider OOTB any data sent during asoc setup. 4594f8829a4aSRandall Stewart */ 459517205eccSRandall Stewart sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL, 459617205eccSRandall Stewart vrf_id, table_id); 4597f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(stcb); 45986e55db54SRandall Stewart return; 4599f8829a4aSRandall Stewart break; 4600f8829a4aSRandall Stewart case SCTP_STATE_EMPTY: /* should not happen */ 4601f8829a4aSRandall Stewart case SCTP_STATE_INUSE: /* should not happen */ 4602f8829a4aSRandall Stewart case SCTP_STATE_SHUTDOWN_RECEIVED: /* This is a peer error */ 4603f8829a4aSRandall Stewart case SCTP_STATE_SHUTDOWN_ACK_SENT: 4604f8829a4aSRandall Stewart default: 4605f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(stcb); 46066e55db54SRandall Stewart return; 4607f8829a4aSRandall Stewart break; 4608f8829a4aSRandall Stewart case SCTP_STATE_OPEN: 4609f8829a4aSRandall Stewart case SCTP_STATE_SHUTDOWN_SENT: 4610f8829a4aSRandall Stewart break; 4611f8829a4aSRandall Stewart } 4612f8829a4aSRandall Stewart /* take care of ECN, part 1. */ 4613f8829a4aSRandall Stewart if (stcb->asoc.ecn_allowed && 4614f8829a4aSRandall Stewart (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) { 4615f8829a4aSRandall Stewart sctp_process_ecn_marked_a(stcb, net, ecn_bits); 4616f8829a4aSRandall Stewart } 4617f8829a4aSRandall Stewart /* plow through the data chunks while length > offset */ 4618f8829a4aSRandall Stewart retval = sctp_process_data(mm, iphlen, &offset, length, sh, 4619f8829a4aSRandall Stewart inp, stcb, net, &high_tsn); 4620f8829a4aSRandall Stewart if (retval == 2) { 4621f8829a4aSRandall Stewart /* 4622f8829a4aSRandall Stewart * The association aborted, NO UNLOCK needed since 4623f8829a4aSRandall Stewart * the association is destroyed. 4624f8829a4aSRandall Stewart */ 46256e55db54SRandall Stewart return; 4626f8829a4aSRandall Stewart } 4627f8829a4aSRandall Stewart data_processed = 1; 4628f8829a4aSRandall Stewart if (retval == 0) { 4629f8829a4aSRandall Stewart /* take care of ecn part 2. */ 4630f8829a4aSRandall Stewart if (stcb->asoc.ecn_allowed && 4631f8829a4aSRandall Stewart (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) { 4632f8829a4aSRandall Stewart sctp_process_ecn_marked_b(stcb, net, high_tsn, 4633f8829a4aSRandall Stewart ecn_bits); 4634f8829a4aSRandall Stewart } 4635f8829a4aSRandall Stewart } 4636f8829a4aSRandall Stewart /* 4637f8829a4aSRandall Stewart * Anything important needs to have been m_copy'ed in 4638f8829a4aSRandall Stewart * process_data 4639f8829a4aSRandall Stewart */ 4640f8829a4aSRandall Stewart } 4641f8829a4aSRandall Stewart if ((data_processed == 0) && (fwd_tsn_seen)) { 4642f8829a4aSRandall Stewart int was_a_gap = 0; 4643f8829a4aSRandall Stewart 4644f8829a4aSRandall Stewart if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map, 4645f8829a4aSRandall Stewart stcb->asoc.cumulative_tsn, MAX_TSN)) { 4646f8829a4aSRandall Stewart /* there was a gap before this data was processed */ 4647f8829a4aSRandall Stewart was_a_gap = 1; 4648f8829a4aSRandall Stewart } 4649f8829a4aSRandall Stewart sctp_sack_check(stcb, 1, was_a_gap, &abort_flag); 4650f8829a4aSRandall Stewart if (abort_flag) { 4651f8829a4aSRandall Stewart /* Again, we aborted so NO UNLOCK needed */ 46526e55db54SRandall Stewart return; 4653f8829a4aSRandall Stewart } 4654f8829a4aSRandall Stewart } 4655f8829a4aSRandall Stewart /* trigger send of any chunks in queue... */ 4656a5d547adSRandall Stewart trigger_send: 4657f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED 4658f8829a4aSRandall Stewart sctp_audit_log(0xE0, 2); 4659f8829a4aSRandall Stewart sctp_auditing(1, inp, stcb, net); 4660f8829a4aSRandall Stewart #endif 4661ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, 4662ad81507eSRandall Stewart "Check for chunk output prw:%d tqe:%d tf=%d\n", 4663f8829a4aSRandall Stewart stcb->asoc.peers_rwnd, 4664f8829a4aSRandall Stewart TAILQ_EMPTY(&stcb->asoc.control_send_queue), 4665f8829a4aSRandall Stewart stcb->asoc.total_flight); 4666f8829a4aSRandall Stewart un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 4667f8829a4aSRandall Stewart 4668f8829a4aSRandall Stewart if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue) || 4669f8829a4aSRandall Stewart ((un_sent) && 4670f8829a4aSRandall Stewart (stcb->asoc.peers_rwnd > 0 || 4671f8829a4aSRandall Stewart (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) { 4672ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n"); 4673f8829a4aSRandall Stewart sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 4674ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n"); 4675f8829a4aSRandall Stewart } 4676f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED 4677f8829a4aSRandall Stewart sctp_audit_log(0xE0, 3); 4678f8829a4aSRandall Stewart sctp_auditing(2, inp, stcb, net); 4679f8829a4aSRandall Stewart #endif 4680f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(stcb); 46816e55db54SRandall Stewart return; 4682f8829a4aSRandall Stewart } 4683f8829a4aSRandall Stewart 4684a5d547adSRandall Stewart 4685a5d547adSRandall Stewart 4686f8829a4aSRandall Stewart void 4687139bc87fSRandall Stewart sctp_input(i_pak, off) 4688139bc87fSRandall Stewart struct mbuf *i_pak; 4689f8829a4aSRandall Stewart int off; 4690f8829a4aSRandall Stewart 4691f8829a4aSRandall Stewart { 4692f8829a4aSRandall Stewart #ifdef SCTP_MBUF_LOGGING 4693f8829a4aSRandall Stewart struct mbuf *mat; 4694f8829a4aSRandall Stewart 4695f8829a4aSRandall Stewart #endif 4696139bc87fSRandall Stewart struct mbuf *m; 4697f8829a4aSRandall Stewart int iphlen; 469817205eccSRandall Stewart uint32_t vrf_id = 0, table_id = 0; 4699f8829a4aSRandall Stewart uint8_t ecn_bits; 4700f8829a4aSRandall Stewart struct ip *ip; 4701f8829a4aSRandall Stewart struct sctphdr *sh; 4702f8829a4aSRandall Stewart struct sctp_inpcb *inp = NULL; 4703f8829a4aSRandall Stewart 4704f8829a4aSRandall Stewart uint32_t check, calc_check; 4705f8829a4aSRandall Stewart struct sctp_nets *net; 4706f8829a4aSRandall Stewart struct sctp_tcb *stcb = NULL; 4707f8829a4aSRandall Stewart struct sctp_chunkhdr *ch; 4708f8829a4aSRandall Stewart int refcount_up = 0; 4709f8829a4aSRandall Stewart int length, mlen, offset; 4710f8829a4aSRandall Stewart 471117205eccSRandall Stewart 471217205eccSRandall Stewart if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) { 471317205eccSRandall Stewart SCTP_RELEASE_PKT(i_pak); 471417205eccSRandall Stewart return; 471517205eccSRandall Stewart } 471617205eccSRandall Stewart if (SCTP_GET_PKT_TABLEID(i_pak, table_id)) { 471717205eccSRandall Stewart SCTP_RELEASE_PKT(i_pak); 471817205eccSRandall Stewart return; 471917205eccSRandall Stewart } 4720bff64a4dSRandall Stewart mlen = SCTP_HEADER_LEN(i_pak); 4721f8829a4aSRandall Stewart iphlen = off; 4722139bc87fSRandall Stewart m = SCTP_HEADER_TO_CHAIN(i_pak); 4723d61a0ae0SRandall Stewart 4724f8829a4aSRandall Stewart net = NULL; 4725f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_recvpackets); 4726f8829a4aSRandall Stewart SCTP_STAT_INCR_COUNTER64(sctps_inpackets); 4727f8829a4aSRandall Stewart 4728207304d4SRandall Stewart 4729f8829a4aSRandall Stewart #ifdef SCTP_MBUF_LOGGING 4730f8829a4aSRandall Stewart /* Log in any input mbufs */ 4731f8829a4aSRandall Stewart mat = m; 4732f8829a4aSRandall Stewart while (mat) { 4733139bc87fSRandall Stewart if (SCTP_BUF_IS_EXTENDED(mat)) { 4734f8829a4aSRandall Stewart sctp_log_mb(mat, SCTP_MBUF_INPUT); 4735f8829a4aSRandall Stewart } 4736139bc87fSRandall Stewart mat = SCTP_BUF_NEXT(mat); 4737f8829a4aSRandall Stewart } 4738f8829a4aSRandall Stewart #endif 4739207304d4SRandall Stewart #ifdef SCTP_PACKET_LOGGING 4740207304d4SRandall Stewart sctp_packet_log(m, mlen); 4741207304d4SRandall Stewart #endif 4742207304d4SRandall Stewart /* 4743207304d4SRandall Stewart * Must take out the iphlen, since mlen expects this (only effect lb 4744207304d4SRandall Stewart * case) 4745207304d4SRandall Stewart */ 4746207304d4SRandall Stewart mlen -= iphlen; 47475e54f665SRandall Stewart 4748f8829a4aSRandall Stewart /* 4749f8829a4aSRandall Stewart * Get IP, SCTP, and first chunk header together in first mbuf. 4750f8829a4aSRandall Stewart */ 4751f8829a4aSRandall Stewart ip = mtod(m, struct ip *); 4752f8829a4aSRandall Stewart offset = iphlen + sizeof(*sh) + sizeof(*ch); 4753139bc87fSRandall Stewart if (SCTP_BUF_LEN(m) < offset) { 4754f8829a4aSRandall Stewart if ((m = m_pullup(m, offset)) == 0) { 4755f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_hdrops); 4756f8829a4aSRandall Stewart return; 4757f8829a4aSRandall Stewart } 4758f8829a4aSRandall Stewart ip = mtod(m, struct ip *); 4759f8829a4aSRandall Stewart } 4760f8829a4aSRandall Stewart sh = (struct sctphdr *)((caddr_t)ip + iphlen); 4761f8829a4aSRandall Stewart ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh)); 4762f8829a4aSRandall Stewart 4763f8829a4aSRandall Stewart /* SCTP does not allow broadcasts or multicasts */ 4764f8829a4aSRandall Stewart if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { 4765f8829a4aSRandall Stewart goto bad; 4766f8829a4aSRandall Stewart } 47675e54f665SRandall Stewart if (SCTP_IS_IT_BROADCAST(ip->ip_dst, m)) { 4768f8829a4aSRandall Stewart /* 4769f8829a4aSRandall Stewart * We only look at broadcast if its a front state, All 4770f8829a4aSRandall Stewart * others we will not have a tcb for anyway. 4771f8829a4aSRandall Stewart */ 4772f8829a4aSRandall Stewart goto bad; 4773f8829a4aSRandall Stewart } 4774f8829a4aSRandall Stewart /* validate SCTP checksum */ 47755e54f665SRandall Stewart if ((sctp_no_csum_on_loopback == 0) || !SCTP_IS_IT_LOOPBACK(m)) { 4776f8829a4aSRandall Stewart /* 4777f8829a4aSRandall Stewart * we do NOT validate things from the loopback if the sysctl 4778f8829a4aSRandall Stewart * is set to 1. 4779f8829a4aSRandall Stewart */ 4780f8829a4aSRandall Stewart check = sh->checksum; /* save incoming checksum */ 4781f8829a4aSRandall Stewart if ((check == 0) && (sctp_no_csum_on_loopback)) { 4782f8829a4aSRandall Stewart /* 4783f8829a4aSRandall Stewart * special hook for where we got a local address 4784f8829a4aSRandall Stewart * somehow routed across a non IFT_LOOP type 4785f8829a4aSRandall Stewart * interface 4786f8829a4aSRandall Stewart */ 4787f8829a4aSRandall Stewart if (ip->ip_src.s_addr == ip->ip_dst.s_addr) 4788f8829a4aSRandall Stewart goto sctp_skip_csum_4; 4789f8829a4aSRandall Stewart } 4790f8829a4aSRandall Stewart sh->checksum = 0; /* prepare for calc */ 4791f8829a4aSRandall Stewart calc_check = sctp_calculate_sum(m, &mlen, iphlen); 4792f8829a4aSRandall Stewart if (calc_check != check) { 4793ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x m:%p mlen:%d iphlen:%d\n", 479450cec919SRandall Stewart calc_check, check, m, mlen, iphlen); 4795f8829a4aSRandall Stewart 4796f8829a4aSRandall Stewart stcb = sctp_findassociation_addr(m, iphlen, 4797f8829a4aSRandall Stewart offset - sizeof(*ch), 4798ad81507eSRandall Stewart sh, ch, &inp, &net, 4799ad81507eSRandall Stewart vrf_id); 4800f8829a4aSRandall Stewart if ((inp) && (stcb)) { 4801f8829a4aSRandall Stewart sctp_send_packet_dropped(stcb, net, m, iphlen, 1); 4802f8829a4aSRandall Stewart sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR); 4803f8829a4aSRandall Stewart } else if ((inp != NULL) && (stcb == NULL)) { 4804f8829a4aSRandall Stewart refcount_up = 1; 4805f8829a4aSRandall Stewart } 4806f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_badsum); 4807f8829a4aSRandall Stewart SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors); 4808f8829a4aSRandall Stewart goto bad; 4809f8829a4aSRandall Stewart } 4810f8829a4aSRandall Stewart sh->checksum = calc_check; 48115e54f665SRandall Stewart } 4812bff64a4dSRandall Stewart sctp_skip_csum_4: 48135e54f665SRandall Stewart /* destination port of 0 is illegal, based on RFC2960. */ 48145e54f665SRandall Stewart if (sh->dest_port == 0) { 48155e54f665SRandall Stewart SCTP_STAT_INCR(sctps_hdrops); 48165e54f665SRandall Stewart goto bad; 4817f8829a4aSRandall Stewart } 4818f8829a4aSRandall Stewart /* validate mbuf chain length with IP payload length */ 4819f8829a4aSRandall Stewart if (mlen < (ip->ip_len - iphlen)) { 4820f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_hdrops); 4821f8829a4aSRandall Stewart goto bad; 4822f8829a4aSRandall Stewart } 4823f8829a4aSRandall Stewart /* 4824f8829a4aSRandall Stewart * Locate pcb and tcb for datagram sctp_findassociation_addr() wants 4825f8829a4aSRandall Stewart * IP/SCTP/first chunk header... 4826f8829a4aSRandall Stewart */ 4827f8829a4aSRandall Stewart stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch), 4828bff64a4dSRandall Stewart sh, ch, &inp, &net, vrf_id); 4829f8829a4aSRandall Stewart /* inp's ref-count increased && stcb locked */ 4830f8829a4aSRandall Stewart if (inp == NULL) { 4831f8829a4aSRandall Stewart struct sctp_init_chunk *init_chk, chunk_buf; 4832f8829a4aSRandall Stewart 4833f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_noport); 4834f8829a4aSRandall Stewart #ifdef ICMP_BANDLIM 4835f8829a4aSRandall Stewart /* 4836f8829a4aSRandall Stewart * we use the bandwidth limiting to protect against sending 4837f8829a4aSRandall Stewart * too many ABORTS all at once. In this case these count the 4838f8829a4aSRandall Stewart * same as an ICMP message. 4839f8829a4aSRandall Stewart */ 4840f8829a4aSRandall Stewart if (badport_bandlim(0) < 0) 4841f8829a4aSRandall Stewart goto bad; 4842f8829a4aSRandall Stewart #endif /* ICMP_BANDLIM */ 4843ad81507eSRandall Stewart SCTPDBG(SCTP_DEBUG_INPUT1, 4844ad81507eSRandall Stewart "Sending a ABORT from packet entry!\n"); 4845f8829a4aSRandall Stewart if (ch->chunk_type == SCTP_INITIATION) { 4846f8829a4aSRandall Stewart /* 4847f8829a4aSRandall Stewart * we do a trick here to get the INIT tag, dig in 4848f8829a4aSRandall Stewart * and get the tag from the INIT and put it in the 4849f8829a4aSRandall Stewart * common header. 4850f8829a4aSRandall Stewart */ 4851f8829a4aSRandall Stewart init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m, 4852f8829a4aSRandall Stewart iphlen + sizeof(*sh), sizeof(*init_chk), 4853f8829a4aSRandall Stewart (uint8_t *) & chunk_buf); 4854f8829a4aSRandall Stewart if (init_chk != NULL) 4855f8829a4aSRandall Stewart sh->v_tag = init_chk->init.initiate_tag; 4856f8829a4aSRandall Stewart } 4857a5d547adSRandall Stewart if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 485817205eccSRandall Stewart sctp_send_shutdown_complete2(m, iphlen, sh, vrf_id, 485917205eccSRandall Stewart table_id); 4860a5d547adSRandall Stewart goto bad; 4861a5d547adSRandall Stewart } 4862a5d547adSRandall Stewart if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) { 4863a5d547adSRandall Stewart goto bad; 4864a5d547adSRandall Stewart } 4865a5d547adSRandall Stewart if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) 486617205eccSRandall Stewart sctp_send_abort(m, iphlen, sh, 0, NULL, vrf_id, 486717205eccSRandall Stewart table_id); 4868f8829a4aSRandall Stewart goto bad; 4869f8829a4aSRandall Stewart } else if (stcb == NULL) { 4870f8829a4aSRandall Stewart refcount_up = 1; 4871f8829a4aSRandall Stewart } 4872f8829a4aSRandall Stewart #ifdef IPSEC 4873f8829a4aSRandall Stewart /* 4874f8829a4aSRandall Stewart * I very much doubt any of the IPSEC stuff will work but I have no 4875f8829a4aSRandall Stewart * idea, so I will leave it in place. 4876f8829a4aSRandall Stewart */ 4877f8829a4aSRandall Stewart 487850cec919SRandall Stewart if (inp && ipsec4_in_reject(m, &inp->ip_inp.inp)) { 4879f8829a4aSRandall Stewart ipsecstat.in_polvio++; 4880f8829a4aSRandall Stewart SCTP_STAT_INCR(sctps_hdrops); 4881f8829a4aSRandall Stewart goto bad; 4882f8829a4aSRandall Stewart } 4883f8829a4aSRandall Stewart #endif /* IPSEC */ 4884f8829a4aSRandall Stewart 4885f8829a4aSRandall Stewart /* 4886f8829a4aSRandall Stewart * common chunk processing 4887f8829a4aSRandall Stewart */ 4888f8829a4aSRandall Stewart length = ip->ip_len + iphlen; 4889f8829a4aSRandall Stewart offset -= sizeof(struct sctp_chunkhdr); 4890f8829a4aSRandall Stewart 4891f8829a4aSRandall Stewart ecn_bits = ip->ip_tos; 4892f8829a4aSRandall Stewart 48933c503c28SRandall Stewart /* sa_ignore NO_NULL_CHK */ 4894f8829a4aSRandall Stewart sctp_common_input_processing(&m, iphlen, offset, length, sh, ch, 489517205eccSRandall Stewart inp, stcb, net, ecn_bits, vrf_id, 489617205eccSRandall Stewart table_id); 4897f8829a4aSRandall Stewart /* inp's ref-count reduced && stcb unlocked */ 4898f8829a4aSRandall Stewart if (m) { 4899f8829a4aSRandall Stewart sctp_m_freem(m); 4900f8829a4aSRandall Stewart } 4901f8829a4aSRandall Stewart if ((inp) && (refcount_up)) { 4902f8829a4aSRandall Stewart /* reduce ref-count */ 4903f8829a4aSRandall Stewart SCTP_INP_WLOCK(inp); 4904f8829a4aSRandall Stewart SCTP_INP_DECR_REF(inp); 4905f8829a4aSRandall Stewart SCTP_INP_WUNLOCK(inp); 4906f8829a4aSRandall Stewart } 4907f8829a4aSRandall Stewart return; 4908f8829a4aSRandall Stewart bad: 4909ad81507eSRandall Stewart if (stcb) { 4910f8829a4aSRandall Stewart SCTP_TCB_UNLOCK(stcb); 4911ad81507eSRandall Stewart } 4912f8829a4aSRandall Stewart if ((inp) && (refcount_up)) { 4913f8829a4aSRandall Stewart /* reduce ref-count */ 4914f8829a4aSRandall Stewart SCTP_INP_WLOCK(inp); 4915f8829a4aSRandall Stewart SCTP_INP_DECR_REF(inp); 4916f8829a4aSRandall Stewart SCTP_INP_WUNLOCK(inp); 4917f8829a4aSRandall Stewart } 4918f8829a4aSRandall Stewart if (m) { 4919f8829a4aSRandall Stewart sctp_m_freem(m); 4920f8829a4aSRandall Stewart } 4921f8829a4aSRandall Stewart return; 4922f8829a4aSRandall Stewart } 4923