1 /*- 2 * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * a) Redistributions of source code must retain the above copyright notice, 8 * this list of conditions and the following disclaimer. 9 * 10 * b) Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the distribution. 13 * 14 * c) Neither the name of Cisco Systems, Inc. nor the names of its 15 * contributors may be used to endorse or promote products derived 16 * from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 20 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 28 * THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 /* $KAME: sctp_input.c,v 1.27 2005/03/06 16:04:17 itojun Exp $ */ 32 33 #include <sys/cdefs.h> 34 __FBSDID("$FreeBSD$"); 35 36 #include <netinet/sctp_os.h> 37 #include <netinet/sctp_var.h> 38 #include <netinet/sctp_pcb.h> 39 #include <netinet/sctp_header.h> 40 #include <netinet/sctputil.h> 41 #include <netinet/sctp_output.h> 42 #include <netinet/sctp_input.h> 43 #include <netinet/sctp_auth.h> 44 #include <netinet/sctp_indata.h> 45 #include <netinet/sctp_asconf.h> 46 47 48 #ifdef SCTP_DEBUG 49 extern uint32_t sctp_debug_on; 50 51 #endif 52 53 54 55 struct sctp_foo_stuff sctp_logoff[30000]; 56 int sctp_logoff_stuff = 0; 57 58 59 static void 60 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb) 61 { 62 struct sctp_nets *net; 63 64 /* 65 * This now not only stops all cookie timers it also stops any INIT 66 * timers as well. This will make sure that the timers are stopped 67 * in all collision cases. 68 */ 69 SCTP_TCB_LOCK_ASSERT(stcb); 70 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 71 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) { 72 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, 73 stcb->sctp_ep, 74 stcb, 75 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1); 76 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) { 77 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, 78 stcb->sctp_ep, 79 stcb, 80 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2); 81 } 82 } 83 } 84 85 /* INIT handler */ 86 static void 87 sctp_handle_init(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh, 88 struct sctp_init_chunk *cp, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 89 struct sctp_nets *net) 90 { 91 struct sctp_init *init; 92 struct mbuf *op_err; 93 uint32_t init_limit; 94 95 #ifdef SCTP_DEBUG 96 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 97 printf("sctp_handle_init: handling INIT tcb:%p\n", stcb); 98 } 99 #endif 100 op_err = NULL; 101 init = &cp->init; 102 /* First are we accepting? */ 103 if ((inp->sctp_socket->so_qlimit == 0) && (stcb == NULL)) { 104 #ifdef SCTP_DEBUG 105 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 106 printf("sctp_handle_init: Abort, so_qlimit:%d\n", inp->sctp_socket->so_qlimit); 107 } 108 #endif 109 /* 110 * FIX ME ?? What about TCP model and we have a 111 * match/restart case? 112 */ 113 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 114 return; 115 } 116 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) { 117 /* Invalid length */ 118 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 119 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 120 return; 121 } 122 /* validate parameters */ 123 if (init->initiate_tag == 0) { 124 /* protocol error... send abort */ 125 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 126 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 127 return; 128 } 129 if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) { 130 /* invalid parameter... send abort */ 131 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 132 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 133 return; 134 } 135 if (init->num_inbound_streams == 0) { 136 /* protocol error... send abort */ 137 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 138 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 139 return; 140 } 141 if (init->num_outbound_streams == 0) { 142 /* protocol error... send abort */ 143 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 144 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 145 return; 146 } 147 init_limit = offset + ntohs(cp->ch.chunk_length); 148 if (sctp_validate_init_auth_params(m, offset + sizeof(*cp), 149 init_limit)) { 150 /* auth parameter(s) error... send abort */ 151 sctp_abort_association(inp, stcb, m, iphlen, sh, NULL); 152 return; 153 } 154 /* send an INIT-ACK w/cookie */ 155 #ifdef SCTP_DEBUG 156 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 157 printf("sctp_handle_init: sending INIT-ACK\n"); 158 } 159 #endif 160 sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp); 161 } 162 163 /* 164 * process peer "INIT/INIT-ACK" chunk returns value < 0 on error 165 */ 166 static int 167 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb, 168 struct sctp_nets *net) 169 { 170 struct sctp_init *init; 171 struct sctp_association *asoc; 172 struct sctp_nets *lnet; 173 unsigned int i; 174 175 init = &cp->init; 176 asoc = &stcb->asoc; 177 /* save off parameters */ 178 asoc->peer_vtag = ntohl(init->initiate_tag); 179 asoc->peers_rwnd = ntohl(init->a_rwnd); 180 if (TAILQ_FIRST(&asoc->nets)) { 181 /* update any ssthresh's that may have a default */ 182 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 183 lnet->ssthresh = asoc->peers_rwnd; 184 185 #if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING) 186 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION); 187 #endif 188 189 } 190 } 191 SCTP_TCB_SEND_LOCK(stcb); 192 if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) { 193 unsigned int newcnt; 194 struct sctp_stream_out *outs; 195 struct sctp_stream_queue_pending *sp; 196 197 /* cut back on number of streams */ 198 newcnt = ntohs(init->num_inbound_streams); 199 /* This if is probably not needed but I am cautious */ 200 if (asoc->strmout) { 201 /* First make sure no data chunks are trapped */ 202 for (i = newcnt; i < asoc->pre_open_streams; i++) { 203 outs = &asoc->strmout[i]; 204 sp = TAILQ_FIRST(&outs->outqueue); 205 while (sp) { 206 TAILQ_REMOVE(&outs->outqueue, sp, 207 next); 208 asoc->stream_queue_cnt--; 209 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, 210 stcb, SCTP_NOTIFY_DATAGRAM_UNSENT, 211 sp); 212 if (sp->data) { 213 sctp_m_freem(sp->data); 214 sp->data = NULL; 215 } 216 sctp_free_remote_addr(sp->net); 217 sp->net = NULL; 218 /* Free the chunk */ 219 printf("sp:%p tcb:%p weird free case\n", 220 sp, stcb); 221 222 sctp_free_a_strmoq(stcb, sp); 223 sp = TAILQ_FIRST(&outs->outqueue); 224 } 225 } 226 } 227 /* cut back the count and abandon the upper streams */ 228 asoc->pre_open_streams = newcnt; 229 } 230 SCTP_TCB_SEND_UNLOCK(stcb); 231 asoc->streamoutcnt = asoc->pre_open_streams; 232 /* init tsn's */ 233 asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1; 234 #ifdef SCTP_MAP_LOGGING 235 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 236 #endif 237 /* This is the next one we expect */ 238 asoc->str_reset_seq_in = asoc->asconf_seq_in + 1; 239 240 asoc->mapping_array_base_tsn = ntohl(init->initial_tsn); 241 asoc->cumulative_tsn = asoc->asconf_seq_in; 242 asoc->last_echo_tsn = asoc->asconf_seq_in; 243 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 244 /* open the requested streams */ 245 if (asoc->strmin != NULL) { 246 /* Free the old ones */ 247 struct sctp_queued_to_read *ctl; 248 249 for (i = 0; i < asoc->streamincnt; i++) { 250 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 251 while (ctl) { 252 TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next); 253 sctp_free_remote_addr(ctl->whoFrom); 254 sctp_m_freem(ctl->data); 255 ctl->data = NULL; 256 sctp_free_a_readq(stcb, ctl); 257 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 258 } 259 } 260 SCTP_FREE(asoc->strmin); 261 } 262 asoc->streamincnt = ntohs(init->num_outbound_streams); 263 if (asoc->streamincnt > MAX_SCTP_STREAMS) { 264 asoc->streamincnt = MAX_SCTP_STREAMS; 265 } 266 SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt * 267 sizeof(struct sctp_stream_in), "StreamsIn"); 268 if (asoc->strmin == NULL) { 269 /* we didn't get memory for the streams! */ 270 #ifdef SCTP_DEBUG 271 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 272 printf("process_init: couldn't get memory for the streams!\n"); 273 } 274 #endif 275 return (-1); 276 } 277 for (i = 0; i < asoc->streamincnt; i++) { 278 asoc->strmin[i].stream_no = i; 279 asoc->strmin[i].last_sequence_delivered = 0xffff; 280 /* 281 * U-stream ranges will be set when the cookie is unpacked. 282 * Or for the INIT sender they are un set (if pr-sctp not 283 * supported) when the INIT-ACK arrives. 284 */ 285 TAILQ_INIT(&asoc->strmin[i].inqueue); 286 /* 287 * we are not on any wheel, pr-sctp streams will go on the 288 * wheel when they have data waiting for reorder. 289 */ 290 asoc->strmin[i].next_spoke.tqe_next = 0; 291 asoc->strmin[i].next_spoke.tqe_prev = 0; 292 } 293 294 /* 295 * load_address_from_init will put the addresses into the 296 * association when the COOKIE is processed or the INIT-ACK is 297 * processed. Both types of COOKIE's existing and new call this 298 * routine. It will remove addresses that are no longer in the 299 * association (for the restarting case where addresses are 300 * removed). Up front when the INIT arrives we will discard it if it 301 * is a restart and new addresses have been added. 302 */ 303 return (0); 304 } 305 306 /* 307 * INIT-ACK message processing/consumption returns value < 0 on error 308 */ 309 static int 310 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset, 311 struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 312 struct sctp_nets *net) 313 { 314 struct sctp_association *asoc; 315 struct mbuf *op_err; 316 int retval, abort_flag; 317 uint32_t initack_limit; 318 319 /* First verify that we have no illegal param's */ 320 abort_flag = 0; 321 op_err = NULL; 322 323 op_err = sctp_arethere_unrecognized_parameters(m, 324 (offset + sizeof(struct sctp_init_chunk)), 325 &abort_flag, (struct sctp_chunkhdr *)cp); 326 if (abort_flag) { 327 /* Send an abort and notify peer */ 328 if (op_err != NULL) { 329 sctp_send_operr_to(m, iphlen, op_err, cp->init.initiate_tag); 330 } else { 331 /* 332 * Just notify (abort_assoc does this if we send an 333 * abort). 334 */ 335 sctp_abort_notification(stcb, 0); 336 /* 337 * No sense in further INIT's since we will get the 338 * same param back 339 */ 340 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3); 341 } 342 return (-1); 343 } 344 asoc = &stcb->asoc; 345 /* process the peer's parameters in the INIT-ACK */ 346 retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net); 347 if (retval < 0) { 348 return (retval); 349 } 350 initack_limit = offset + ntohs(cp->ch.chunk_length); 351 /* load all addresses */ 352 if ((retval = sctp_load_addresses_from_init(stcb, m, iphlen, 353 (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh, 354 NULL))) { 355 /* Huh, we should abort */ 356 #ifdef SCTP_DEBUG 357 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 358 printf("Load addresses from INIT causes an abort %d\n", retval); 359 } 360 #endif 361 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 362 NULL); 363 return (-1); 364 } 365 stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs, 366 stcb->asoc.local_hmacs); 367 if (op_err) { 368 sctp_queue_op_err(stcb, op_err); 369 /* queuing will steal away the mbuf chain to the out queue */ 370 op_err = NULL; 371 } 372 /* extract the cookie and queue it to "echo" it back... */ 373 stcb->asoc.overall_error_count = 0; 374 net->error_count = 0; 375 376 /* 377 * Cancel the INIT timer, We do this first before queueing the 378 * cookie. We always cancel at the primary to assue that we are 379 * canceling the timer started by the INIT which always goes to the 380 * primary. 381 */ 382 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb, 383 asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4); 384 385 /* calculate the RTO */ 386 net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered); 387 388 retval = sctp_send_cookie_echo(m, offset, stcb, net); 389 if (retval < 0) { 390 /* 391 * No cookie, we probably should send a op error. But in any 392 * case if there is no cookie in the INIT-ACK, we can 393 * abandon the peer, its broke. 394 */ 395 if (retval == -3) { 396 /* We abort with an error of missing mandatory param */ 397 struct mbuf *op_err; 398 399 op_err = 400 sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM); 401 if (op_err) { 402 /* 403 * Expand beyond to include the mandatory 404 * param cookie 405 */ 406 struct sctp_inv_mandatory_param *mp; 407 408 SCTP_BUF_LEN(op_err) = 409 sizeof(struct sctp_inv_mandatory_param); 410 mp = mtod(op_err, 411 struct sctp_inv_mandatory_param *); 412 /* Subtract the reserved param */ 413 mp->length = 414 htons(sizeof(struct sctp_inv_mandatory_param) - 2); 415 mp->num_param = htonl(1); 416 mp->param = htons(SCTP_STATE_COOKIE); 417 mp->resv = 0; 418 } 419 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 420 sh, op_err); 421 } 422 return (retval); 423 } 424 return (0); 425 } 426 427 static void 428 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp, 429 struct sctp_tcb *stcb, struct sctp_nets *net) 430 { 431 struct sockaddr_storage store; 432 struct sockaddr_in *sin; 433 struct sockaddr_in6 *sin6; 434 struct sctp_nets *r_net; 435 struct timeval tv; 436 437 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) { 438 /* Invalid length */ 439 return; 440 } 441 sin = (struct sockaddr_in *)&store; 442 sin6 = (struct sockaddr_in6 *)&store; 443 444 memset(&store, 0, sizeof(store)); 445 if (cp->heartbeat.hb_info.addr_family == AF_INET && 446 cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) { 447 sin->sin_family = cp->heartbeat.hb_info.addr_family; 448 sin->sin_len = cp->heartbeat.hb_info.addr_len; 449 sin->sin_port = stcb->rport; 450 memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address, 451 sizeof(sin->sin_addr)); 452 } else if (cp->heartbeat.hb_info.addr_family == AF_INET6 && 453 cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) { 454 sin6->sin6_family = cp->heartbeat.hb_info.addr_family; 455 sin6->sin6_len = cp->heartbeat.hb_info.addr_len; 456 sin6->sin6_port = stcb->rport; 457 memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address, 458 sizeof(sin6->sin6_addr)); 459 } else { 460 return; 461 } 462 r_net = sctp_findnet(stcb, (struct sockaddr *)sin); 463 if (r_net == NULL) { 464 #ifdef SCTP_DEBUG 465 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 466 printf("Huh? I can't find the address I sent it to, discard\n"); 467 } 468 #endif 469 return; 470 } 471 if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) && 472 (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) && 473 (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) { 474 /* 475 * If the its a HB and it's random value is correct when can 476 * confirm the destination. 477 */ 478 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 479 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 480 stcb, 0, (void *)r_net); 481 } 482 r_net->error_count = 0; 483 r_net->hb_responded = 1; 484 tv.tv_sec = cp->heartbeat.hb_info.time_value_1; 485 tv.tv_usec = cp->heartbeat.hb_info.time_value_2; 486 if (r_net->dest_state & SCTP_ADDR_NOT_REACHABLE) { 487 r_net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE; 488 r_net->dest_state |= SCTP_ADDR_REACHABLE; 489 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb, 490 SCTP_HEARTBEAT_SUCCESS, (void *)r_net); 491 /* now was it the primary? if so restore */ 492 if (r_net->dest_state & SCTP_ADDR_WAS_PRIMARY) { 493 sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, r_net); 494 } 495 } 496 /* Now lets do a RTO with this */ 497 r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv); 498 } 499 500 static void 501 sctp_handle_abort(struct sctp_abort_chunk *cp, 502 struct sctp_tcb *stcb, struct sctp_nets *net) 503 { 504 505 #ifdef SCTP_DEBUG 506 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 507 printf("sctp_handle_abort: handling ABORT\n"); 508 } 509 #endif 510 if (stcb == NULL) 511 return; 512 /* verify that the destination addr is in the association */ 513 /* ignore abort for addresses being deleted */ 514 515 /* stop any receive timers */ 516 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5); 517 /* notify user of the abort and clean up... */ 518 sctp_abort_notification(stcb, 0); 519 /* free the tcb */ 520 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 521 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) || 522 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 523 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 524 } 525 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6); 526 #ifdef SCTP_DEBUG 527 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 528 printf("sctp_handle_abort: finished\n"); 529 } 530 #endif 531 } 532 533 static void 534 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp, 535 struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag) 536 { 537 struct sctp_association *asoc; 538 int some_on_streamwheel; 539 540 #ifdef SCTP_DEBUG 541 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 542 printf("sctp_handle_shutdown: handling SHUTDOWN\n"); 543 } 544 #endif 545 if (stcb == NULL) 546 return; 547 asoc = &stcb->asoc; 548 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 549 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 550 return; 551 } 552 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) { 553 /* Shutdown NOT the expected size */ 554 return; 555 } else { 556 sctp_update_acked(stcb, cp, net, abort_flag); 557 } 558 if (asoc->control_pdapi) { 559 /* 560 * With a normal shutdown we assume the end of last record. 561 */ 562 SCTP_INP_READ_LOCK(stcb->sctp_ep); 563 asoc->control_pdapi->end_added = 1; 564 asoc->control_pdapi->pdapi_aborted = 1; 565 asoc->control_pdapi = NULL; 566 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 567 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 568 } 569 /* goto SHUTDOWN_RECEIVED state to block new requests */ 570 if (stcb->sctp_socket) { 571 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 572 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 573 asoc->state = SCTP_STATE_SHUTDOWN_RECEIVED; 574 /* 575 * notify upper layer that peer has initiated a 576 * shutdown 577 */ 578 sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL); 579 580 /* reset time */ 581 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 582 } 583 } 584 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) { 585 /* 586 * stop the shutdown timer, since we WILL move to 587 * SHUTDOWN-ACK-SENT. 588 */ 589 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_7); 590 } 591 /* Now are we there yet? */ 592 some_on_streamwheel = 0; 593 if (!TAILQ_EMPTY(&asoc->out_wheel)) { 594 /* Check to see if some data queued */ 595 struct sctp_stream_out *outs; 596 597 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 598 if (!TAILQ_EMPTY(&outs->outqueue)) { 599 some_on_streamwheel = 1; 600 break; 601 } 602 } 603 } 604 if (!TAILQ_EMPTY(&asoc->send_queue) || 605 !TAILQ_EMPTY(&asoc->sent_queue) || 606 some_on_streamwheel) { 607 /* By returning we will push more data out */ 608 return; 609 } else { 610 /* no outstanding data to send, so move on... */ 611 /* send SHUTDOWN-ACK */ 612 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 613 /* move to SHUTDOWN-ACK-SENT state */ 614 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) || 615 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 616 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 617 } 618 asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT; 619 620 /* start SHUTDOWN timer */ 621 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, 622 stcb, net); 623 } 624 } 625 626 static void 627 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp, 628 struct sctp_tcb *stcb, struct sctp_nets *net) 629 { 630 struct sctp_association *asoc; 631 632 #ifdef SCTP_DEBUG 633 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 634 printf("sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n"); 635 } 636 #endif 637 if (stcb == NULL) 638 return; 639 640 asoc = &stcb->asoc; 641 /* process according to association state */ 642 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 643 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 644 /* unexpected SHUTDOWN-ACK... so ignore... */ 645 SCTP_TCB_UNLOCK(stcb); 646 return; 647 } 648 if (asoc->control_pdapi) { 649 /* 650 * With a normal shutdown we assume the end of last record. 651 */ 652 SCTP_INP_READ_LOCK(stcb->sctp_ep); 653 asoc->control_pdapi->end_added = 1; 654 asoc->control_pdapi->pdapi_aborted = 1; 655 asoc->control_pdapi = NULL; 656 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 657 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 658 } 659 /* are the queues empty? */ 660 if (!TAILQ_EMPTY(&asoc->send_queue) || 661 !TAILQ_EMPTY(&asoc->sent_queue) || 662 !TAILQ_EMPTY(&asoc->out_wheel)) { 663 sctp_report_all_outbound(stcb, 0); 664 } 665 /* stop the timer */ 666 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8); 667 /* send SHUTDOWN-COMPLETE */ 668 sctp_send_shutdown_complete(stcb, net); 669 /* notify upper layer protocol */ 670 if (stcb->sctp_socket) { 671 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 672 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 673 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 674 /* Set the connected flag to disconnected */ 675 stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 676 } 677 } 678 SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 679 /* free the TCB but first save off the ep */ 680 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, 681 SCTP_FROM_SCTP_INPUT + SCTP_LOC_9); 682 } 683 684 /* 685 * Skip past the param header and then we will find the chunk that caused the 686 * problem. There are two possiblities ASCONF or FWD-TSN other than that and 687 * our peer must be broken. 688 */ 689 static void 690 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr, 691 struct sctp_nets *net) 692 { 693 struct sctp_chunkhdr *chk; 694 695 chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr)); 696 switch (chk->chunk_type) { 697 case SCTP_ASCONF_ACK: 698 case SCTP_ASCONF: 699 sctp_asconf_cleanup(stcb, net); 700 break; 701 case SCTP_FORWARD_CUM_TSN: 702 stcb->asoc.peer_supports_prsctp = 0; 703 break; 704 default: 705 #ifdef SCTP_DEBUG 706 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 707 printf("Peer does not support chunk type %d(%x)??\n", 708 chk->chunk_type, (uint32_t) chk->chunk_type); 709 } 710 #endif 711 break; 712 } 713 } 714 715 /* 716 * Skip past the param header and then we will find the param that caused the 717 * problem. There are a number of param's in a ASCONF OR the prsctp param 718 * these will turn of specific features. 719 */ 720 static void 721 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr) 722 { 723 struct sctp_paramhdr *pbad; 724 725 pbad = phdr + 1; 726 switch (ntohs(pbad->param_type)) { 727 /* pr-sctp draft */ 728 case SCTP_PRSCTP_SUPPORTED: 729 stcb->asoc.peer_supports_prsctp = 0; 730 break; 731 case SCTP_SUPPORTED_CHUNK_EXT: 732 break; 733 /* draft-ietf-tsvwg-addip-sctp */ 734 case SCTP_ECN_NONCE_SUPPORTED: 735 stcb->asoc.peer_supports_ecn_nonce = 0; 736 stcb->asoc.ecn_nonce_allowed = 0; 737 stcb->asoc.ecn_allowed = 0; 738 break; 739 case SCTP_ADD_IP_ADDRESS: 740 case SCTP_DEL_IP_ADDRESS: 741 case SCTP_SET_PRIM_ADDR: 742 stcb->asoc.peer_supports_asconf = 0; 743 break; 744 case SCTP_SUCCESS_REPORT: 745 case SCTP_ERROR_CAUSE_IND: 746 #ifdef SCTP_DEBUG 747 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 748 printf("Huh, the peer does not support success? or error cause?\n"); 749 printf("Turning off ASCONF to this strange peer\n"); 750 } 751 #endif 752 stcb->asoc.peer_supports_asconf = 0; 753 break; 754 default: 755 #ifdef SCTP_DEBUG 756 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 757 printf("Peer does not support param type %d(%x)??\n", 758 pbad->param_type, (uint32_t) pbad->param_type); 759 } 760 #endif 761 break; 762 } 763 } 764 765 static int 766 sctp_handle_error(struct sctp_chunkhdr *ch, 767 struct sctp_tcb *stcb, struct sctp_nets *net) 768 { 769 int chklen; 770 struct sctp_paramhdr *phdr; 771 uint16_t error_type; 772 uint16_t error_len; 773 struct sctp_association *asoc; 774 775 int adjust; 776 777 /* parse through all of the errors and process */ 778 asoc = &stcb->asoc; 779 phdr = (struct sctp_paramhdr *)((caddr_t)ch + 780 sizeof(struct sctp_chunkhdr)); 781 chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr); 782 while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) { 783 /* Process an Error Cause */ 784 error_type = ntohs(phdr->param_type); 785 error_len = ntohs(phdr->param_length); 786 if ((error_len > chklen) || (error_len == 0)) { 787 /* invalid param length for this param */ 788 #ifdef SCTP_DEBUG 789 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 790 printf("Bogus length in error param- chunk left:%d errorlen:%d\n", 791 chklen, error_len); 792 } 793 #endif /* SCTP_DEBUG */ 794 return (0); 795 } 796 switch (error_type) { 797 case SCTP_CAUSE_INVALID_STREAM: 798 case SCTP_CAUSE_MISSING_PARAM: 799 case SCTP_CAUSE_INVALID_PARAM: 800 case SCTP_CAUSE_NO_USER_DATA: 801 #ifdef SCTP_DEBUG 802 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 803 printf("Software error we got a %d back? We have a bug :/ (or do they?)\n", 804 error_type); 805 } 806 #endif 807 break; 808 case SCTP_CAUSE_STALE_COOKIE: 809 /* 810 * We only act if we have echoed a cookie and are 811 * waiting. 812 */ 813 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 814 int *p; 815 816 p = (int *)((caddr_t)phdr + sizeof(*phdr)); 817 /* Save the time doubled */ 818 asoc->cookie_preserve_req = ntohl(*p) << 1; 819 asoc->stale_cookie_count++; 820 if (asoc->stale_cookie_count > 821 asoc->max_init_times) { 822 sctp_abort_notification(stcb, 0); 823 /* now free the asoc */ 824 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_10); 825 return (-1); 826 } 827 /* blast back to INIT state */ 828 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED; 829 asoc->state |= SCTP_STATE_COOKIE_WAIT; 830 831 sctp_stop_all_cookie_timers(stcb); 832 sctp_send_initiate(stcb->sctp_ep, stcb); 833 } 834 break; 835 case SCTP_CAUSE_UNRESOLVABLE_ADDR: 836 /* 837 * Nothing we can do here, we don't do hostname 838 * addresses so if the peer does not like my IPv6 839 * (or IPv4 for that matter) it does not matter. If 840 * they don't support that type of address, they can 841 * NOT possibly get that packet type... i.e. with no 842 * IPv6 you can't recieve a IPv6 packet. so we can 843 * safely ignore this one. If we ever added support 844 * for HOSTNAME Addresses, then we would need to do 845 * something here. 846 */ 847 break; 848 case SCTP_CAUSE_UNRECOG_CHUNK: 849 sctp_process_unrecog_chunk(stcb, phdr, net); 850 break; 851 case SCTP_CAUSE_UNRECOG_PARAM: 852 sctp_process_unrecog_param(stcb, phdr); 853 break; 854 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN: 855 /* 856 * We ignore this since the timer will drive out a 857 * new cookie anyway and there timer will drive us 858 * to send a SHUTDOWN_COMPLETE. We can't send one 859 * here since we don't have their tag. 860 */ 861 break; 862 case SCTP_CAUSE_DELETING_LAST_ADDR: 863 case SCTP_CAUSE_RESOURCE_SHORTAGE: 864 case SCTP_CAUSE_DELETING_SRC_ADDR: 865 /* 866 * We should NOT get these here, but in a 867 * ASCONF-ACK. 868 */ 869 #ifdef SCTP_DEBUG 870 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 871 printf("Peer sends ASCONF errors in a Operational Error?<%d>?\n", 872 error_type); 873 } 874 #endif 875 break; 876 case SCTP_CAUSE_OUT_OF_RESC: 877 /* 878 * And what, pray tell do we do with the fact that 879 * the peer is out of resources? Not really sure we 880 * could do anything but abort. I suspect this 881 * should have came WITH an abort instead of in a 882 * OP-ERROR. 883 */ 884 break; 885 default: 886 #ifdef SCTP_DEBUG 887 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 888 /* don't know what this error cause is... */ 889 printf("sctp_handle_error: unknown error type = 0x%xh\n", 890 error_type); 891 } 892 #endif /* SCTP_DEBUG */ 893 break; 894 } 895 adjust = SCTP_SIZE32(error_len); 896 chklen -= adjust; 897 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust); 898 } 899 return (0); 900 } 901 902 static int 903 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh, 904 struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 905 struct sctp_nets *net) 906 { 907 struct sctp_init_ack *init_ack; 908 int *state; 909 struct mbuf *op_err; 910 911 #ifdef SCTP_DEBUG 912 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 913 printf("sctp_handle_init_ack: handling INIT-ACK\n"); 914 } 915 #endif 916 if (stcb == NULL) { 917 #ifdef SCTP_DEBUG 918 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 919 printf("sctp_handle_init_ack: TCB is null\n"); 920 } 921 #endif 922 return (-1); 923 } 924 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) { 925 /* Invalid length */ 926 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 927 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 928 op_err); 929 return (-1); 930 } 931 init_ack = &cp->init; 932 /* validate parameters */ 933 if (init_ack->initiate_tag == 0) { 934 /* protocol error... send an abort */ 935 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 936 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 937 op_err); 938 return (-1); 939 } 940 if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) { 941 /* protocol error... send an abort */ 942 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 943 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 944 op_err); 945 return (-1); 946 } 947 if (init_ack->num_inbound_streams == 0) { 948 /* protocol error... send an abort */ 949 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 950 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 951 op_err); 952 return (-1); 953 } 954 if (init_ack->num_outbound_streams == 0) { 955 /* protocol error... send an abort */ 956 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 957 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 958 op_err); 959 return (-1); 960 } 961 /* process according to association state... */ 962 state = &stcb->asoc.state; 963 switch (*state & SCTP_STATE_MASK) { 964 case SCTP_STATE_COOKIE_WAIT: 965 /* this is the expected state for this chunk */ 966 /* process the INIT-ACK parameters */ 967 if (stcb->asoc.primary_destination->dest_state & 968 SCTP_ADDR_UNCONFIRMED) { 969 /* 970 * The primary is where we sent the INIT, we can 971 * always consider it confirmed when the INIT-ACK is 972 * returned. Do this before we load addresses 973 * though. 974 */ 975 stcb->asoc.primary_destination->dest_state &= 976 ~SCTP_ADDR_UNCONFIRMED; 977 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 978 stcb, 0, (void *)stcb->asoc.primary_destination); 979 } 980 if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb, net 981 ) < 0) { 982 /* error in parsing parameters */ 983 return (-1); 984 } 985 /* update our state */ 986 #ifdef SCTP_DEBUG 987 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 988 printf("moving to COOKIE-ECHOED state\n"); 989 } 990 #endif 991 if (*state & SCTP_STATE_SHUTDOWN_PENDING) { 992 *state = SCTP_STATE_COOKIE_ECHOED | 993 SCTP_STATE_SHUTDOWN_PENDING; 994 } else { 995 *state = SCTP_STATE_COOKIE_ECHOED; 996 } 997 998 /* reset the RTO calc */ 999 stcb->asoc.overall_error_count = 0; 1000 SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered); 1001 /* 1002 * collapse the init timer back in case of a exponential 1003 * backoff 1004 */ 1005 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep, 1006 stcb, net); 1007 /* 1008 * the send at the end of the inbound data processing will 1009 * cause the cookie to be sent 1010 */ 1011 break; 1012 case SCTP_STATE_SHUTDOWN_SENT: 1013 /* incorrect state... discard */ 1014 break; 1015 case SCTP_STATE_COOKIE_ECHOED: 1016 /* incorrect state... discard */ 1017 break; 1018 case SCTP_STATE_OPEN: 1019 /* incorrect state... discard */ 1020 break; 1021 case SCTP_STATE_EMPTY: 1022 case SCTP_STATE_INUSE: 1023 default: 1024 /* incorrect state... discard */ 1025 return (-1); 1026 break; 1027 } /* end switch asoc state */ 1028 #ifdef SCTP_DEBUG 1029 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1030 printf("Leaving handle-init-ack end\n"); 1031 } 1032 #endif 1033 return (0); 1034 } 1035 1036 1037 /* 1038 * handle a state cookie for an existing association m: input packet mbuf 1039 * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a 1040 * "split" mbuf and the cookie signature does not exist offset: offset into 1041 * mbuf to the cookie-echo chunk 1042 */ 1043 static struct sctp_tcb * 1044 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset, 1045 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1046 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 1047 struct sockaddr *init_src, int *notification, sctp_assoc_t * sac_assoc_id) 1048 { 1049 struct sctp_association *asoc; 1050 struct sctp_init_chunk *init_cp, init_buf; 1051 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1052 int chk_length; 1053 int init_offset, initack_offset, i; 1054 int retval; 1055 int spec_flag = 0; 1056 int how_indx; 1057 1058 /* I know that the TCB is non-NULL from the caller */ 1059 asoc = &stcb->asoc; 1060 for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) { 1061 if (asoc->cookie_how[how_indx] == 0) 1062 break; 1063 } 1064 if (how_indx < sizeof(asoc->cookie_how)) { 1065 asoc->cookie_how[how_indx] = 1; 1066 } 1067 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) { 1068 /* SHUTDOWN came in after sending INIT-ACK */ 1069 struct mbuf *op_err; 1070 struct sctp_paramhdr *ph; 1071 1072 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 1073 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 1074 0, M_DONTWAIT, 1, MT_DATA); 1075 if (op_err == NULL) { 1076 /* FOOBAR */ 1077 return (NULL); 1078 } 1079 /* pre-reserve some space */ 1080 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 1081 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 1082 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 1083 /* Set the len */ 1084 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr); 1085 ph = mtod(op_err, struct sctp_paramhdr *); 1086 ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN); 1087 ph->param_length = htons(sizeof(struct sctp_paramhdr)); 1088 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag); 1089 if (how_indx < sizeof(asoc->cookie_how)) 1090 asoc->cookie_how[how_indx] = 2; 1091 return (NULL); 1092 } 1093 /* 1094 * find and validate the INIT chunk in the cookie (peer's info) the 1095 * INIT should start after the cookie-echo header struct (chunk 1096 * header, state cookie header struct) 1097 */ 1098 init_offset = offset += sizeof(struct sctp_cookie_echo_chunk); 1099 1100 init_cp = (struct sctp_init_chunk *) 1101 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1102 (uint8_t *) & init_buf); 1103 if (init_cp == NULL) { 1104 /* could not pull a INIT chunk in cookie */ 1105 return (NULL); 1106 } 1107 chk_length = ntohs(init_cp->ch.chunk_length); 1108 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1109 return (NULL); 1110 } 1111 /* 1112 * find and validate the INIT-ACK chunk in the cookie (my info) the 1113 * INIT-ACK follows the INIT chunk 1114 */ 1115 initack_offset = init_offset + SCTP_SIZE32(chk_length); 1116 initack_cp = (struct sctp_init_ack_chunk *) 1117 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1118 (uint8_t *) & initack_buf); 1119 if (initack_cp == NULL) { 1120 /* could not pull INIT-ACK chunk in cookie */ 1121 return (NULL); 1122 } 1123 chk_length = ntohs(initack_cp->ch.chunk_length); 1124 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1125 return (NULL); 1126 } 1127 if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) && 1128 (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) { 1129 /* 1130 * case D in Section 5.2.4 Table 2: MMAA process accordingly 1131 * to get into the OPEN state 1132 */ 1133 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) { 1134 #ifdef INVARIANTS 1135 panic("Case D and non-match seq?"); 1136 #else 1137 printf("Case D, seq non-match %x vs %x?\n", 1138 ntohl(initack_cp->init.initial_tsn), asoc->init_seq_number); 1139 #endif 1140 } 1141 switch SCTP_GET_STATE 1142 (asoc) { 1143 case SCTP_STATE_COOKIE_WAIT: 1144 case SCTP_STATE_COOKIE_ECHOED: 1145 /* 1146 * INIT was sent, but got got a COOKIE_ECHO with the 1147 * correct tags... just accept it...but we must 1148 * process the init so that we can make sure we have 1149 * the right seq no's. 1150 */ 1151 /* First we must process the INIT !! */ 1152 retval = sctp_process_init(init_cp, stcb, net); 1153 if (retval < 0) { 1154 if (how_indx < sizeof(asoc->cookie_how)) 1155 asoc->cookie_how[how_indx] = 3; 1156 return (NULL); 1157 } 1158 /* we have already processed the INIT so no problem */ 1159 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, 1160 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_11); 1161 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12); 1162 /* update current state */ 1163 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) 1164 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1165 else 1166 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1167 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1168 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1169 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1170 stcb->sctp_ep, stcb, asoc->primary_destination); 1171 1172 } else { 1173 /* if ok, move to OPEN state */ 1174 asoc->state = SCTP_STATE_OPEN; 1175 } 1176 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1177 sctp_stop_all_cookie_timers(stcb); 1178 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1179 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1180 (inp->sctp_socket->so_qlimit == 0) 1181 ) { 1182 /* 1183 * Here is where collision would go if we 1184 * did a connect() and instead got a 1185 * init/init-ack/cookie done before the 1186 * init-ack came back.. 1187 */ 1188 stcb->sctp_ep->sctp_flags |= 1189 SCTP_PCB_FLAGS_CONNECTED; 1190 soisconnected(stcb->sctp_ep->sctp_socket); 1191 } 1192 /* notify upper layer */ 1193 *notification = SCTP_NOTIFY_ASSOC_UP; 1194 /* 1195 * since we did not send a HB make sure we don't 1196 * double things 1197 */ 1198 net->hb_responded = 1; 1199 1200 if (stcb->asoc.sctp_autoclose_ticks && 1201 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) { 1202 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 1203 inp, stcb, NULL); 1204 } 1205 break; 1206 default: 1207 /* 1208 * we're in the OPEN state (or beyond), so peer must 1209 * have simply lost the COOKIE-ACK 1210 */ 1211 1212 break; 1213 } /* end switch */ 1214 sctp_stop_all_cookie_timers(stcb); 1215 /* 1216 * We ignore the return code here.. not sure if we should 1217 * somehow abort.. but we do have an existing asoc. This 1218 * really should not fail. 1219 */ 1220 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1221 init_offset + sizeof(struct sctp_init_chunk), 1222 initack_offset, sh, init_src)) { 1223 if (how_indx < sizeof(asoc->cookie_how)) 1224 asoc->cookie_how[how_indx] = 4; 1225 return (NULL); 1226 } 1227 /* respond with a COOKIE-ACK */ 1228 sctp_toss_old_cookies(stcb, asoc); 1229 sctp_send_cookie_ack(stcb); 1230 if (how_indx < sizeof(asoc->cookie_how)) 1231 asoc->cookie_how[how_indx] = 5; 1232 return (stcb); 1233 } /* end if */ 1234 if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1235 ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag && 1236 cookie->tie_tag_my_vtag == 0 && 1237 cookie->tie_tag_peer_vtag == 0) { 1238 /* 1239 * case C in Section 5.2.4 Table 2: XMOO silently discard 1240 */ 1241 if (how_indx < sizeof(asoc->cookie_how)) 1242 asoc->cookie_how[how_indx] = 6; 1243 return (NULL); 1244 } 1245 if (ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag && 1246 (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag || 1247 init_cp->init.initiate_tag == 0)) { 1248 /* 1249 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info 1250 * should be ok, re-accept peer info 1251 */ 1252 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) { 1253 /* 1254 * Extension of case C. If we hit this, then the 1255 * random number generator returned the same vtag 1256 * when we first sent our INIT-ACK and when we later 1257 * sent our INIT. The side with the seq numbers that 1258 * are different will be the one that normnally 1259 * would have hit case C. This in effect "extends" 1260 * our vtags in this collision case to be 64 bits. 1261 * The same collision could occur aka you get both 1262 * vtag and seq number the same twice in a row.. but 1263 * is much less likely. If it did happen then we 1264 * would proceed through and bring up the assoc.. we 1265 * may end up with the wrong stream setup however.. 1266 * which would be bad.. but there is no way to 1267 * tell.. until we send on a stream that does not 1268 * exist :-) 1269 */ 1270 if (how_indx < sizeof(asoc->cookie_how)) 1271 asoc->cookie_how[how_indx] = 7; 1272 1273 return (NULL); 1274 } 1275 if (how_indx < sizeof(asoc->cookie_how)) 1276 asoc->cookie_how[how_indx] = 8; 1277 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13); 1278 sctp_stop_all_cookie_timers(stcb); 1279 /* 1280 * since we did not send a HB make sure we don't double 1281 * things 1282 */ 1283 net->hb_responded = 1; 1284 if (stcb->asoc.sctp_autoclose_ticks && 1285 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1286 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, 1287 NULL); 1288 } 1289 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1290 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1291 1292 /* Note last_cwr_tsn? where is this used? */ 1293 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1294 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) { 1295 /* 1296 * Ok the peer probably discarded our data (if we 1297 * echoed a cookie+data). So anything on the 1298 * sent_queue should be marked for retransmit, we 1299 * may not get something to kick us so it COULD 1300 * still take a timeout to move these.. but it can't 1301 * hurt to mark them. 1302 */ 1303 struct sctp_tmit_chunk *chk; 1304 1305 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 1306 if (chk->sent < SCTP_DATAGRAM_RESEND) { 1307 chk->sent = SCTP_DATAGRAM_RESEND; 1308 stcb->asoc.sent_queue_retran_cnt++; 1309 spec_flag++; 1310 } 1311 } 1312 1313 } 1314 /* process the INIT info (peer's info) */ 1315 retval = sctp_process_init(init_cp, stcb, net); 1316 if (retval < 0) { 1317 if (how_indx < sizeof(asoc->cookie_how)) 1318 asoc->cookie_how[how_indx] = 9; 1319 return (NULL); 1320 } 1321 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1322 init_offset + sizeof(struct sctp_init_chunk), 1323 initack_offset, sh, init_src)) { 1324 if (how_indx < sizeof(asoc->cookie_how)) 1325 asoc->cookie_how[how_indx] = 10; 1326 return (NULL); 1327 } 1328 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) || 1329 (asoc->state & SCTP_STATE_COOKIE_ECHOED)) { 1330 *notification = SCTP_NOTIFY_ASSOC_UP; 1331 1332 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1333 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1334 (inp->sctp_socket->so_qlimit == 0)) { 1335 stcb->sctp_ep->sctp_flags |= 1336 SCTP_PCB_FLAGS_CONNECTED; 1337 soisconnected(stcb->sctp_ep->sctp_socket); 1338 } 1339 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) 1340 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1341 else 1342 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1343 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1344 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1345 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 1346 SCTP_STAT_INCR_COUNTER32(sctps_restartestab); 1347 } else { 1348 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1349 } 1350 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1351 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1352 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1353 stcb->sctp_ep, stcb, asoc->primary_destination); 1354 1355 } else { 1356 asoc->state = SCTP_STATE_OPEN; 1357 } 1358 sctp_stop_all_cookie_timers(stcb); 1359 sctp_toss_old_cookies(stcb, asoc); 1360 sctp_send_cookie_ack(stcb); 1361 if (spec_flag) { 1362 /* 1363 * only if we have retrans set do we do this. What 1364 * this call does is get only the COOKIE-ACK out and 1365 * then when we return the normal call to 1366 * sctp_chunk_output will get the retrans out behind 1367 * this. 1368 */ 1369 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK); 1370 } 1371 if (how_indx < sizeof(asoc->cookie_how)) 1372 asoc->cookie_how[how_indx] = 11; 1373 1374 return (stcb); 1375 } 1376 if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1377 ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) && 1378 cookie->tie_tag_my_vtag == asoc->my_vtag_nonce && 1379 cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce && 1380 cookie->tie_tag_peer_vtag != 0) { 1381 struct sctpasochead *head; 1382 1383 /* 1384 * case A in Section 5.2.4 Table 2: XXMM (peer restarted) 1385 */ 1386 /* temp code */ 1387 if (how_indx < sizeof(asoc->cookie_how)) 1388 asoc->cookie_how[how_indx] = 12; 1389 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14); 1390 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15); 1391 1392 *sac_assoc_id = sctp_get_associd(stcb); 1393 /* notify upper layer */ 1394 *notification = SCTP_NOTIFY_ASSOC_RESTART; 1395 atomic_add_int(&stcb->asoc.refcnt, 1); 1396 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) && 1397 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 1398 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 1399 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1400 } 1401 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 1402 SCTP_STAT_INCR_GAUGE32(sctps_restartestab); 1403 } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) { 1404 SCTP_STAT_INCR_GAUGE32(sctps_collisionestab); 1405 } 1406 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1407 asoc->state = SCTP_STATE_OPEN | 1408 SCTP_STATE_SHUTDOWN_PENDING; 1409 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1410 stcb->sctp_ep, stcb, asoc->primary_destination); 1411 1412 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) { 1413 /* move to OPEN state, if not in SHUTDOWN_SENT */ 1414 asoc->state = SCTP_STATE_OPEN; 1415 } 1416 asoc->pre_open_streams = 1417 ntohs(initack_cp->init.num_outbound_streams); 1418 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1419 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1420 1421 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1422 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1423 1424 asoc->str_reset_seq_in = asoc->init_seq_number; 1425 1426 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1427 if (asoc->mapping_array) 1428 memset(asoc->mapping_array, 0, 1429 asoc->mapping_array_size); 1430 SCTP_TCB_UNLOCK(stcb); 1431 SCTP_INP_INFO_WLOCK(); 1432 SCTP_INP_WLOCK(stcb->sctp_ep); 1433 SCTP_TCB_LOCK(stcb); 1434 atomic_add_int(&stcb->asoc.refcnt, -1); 1435 /* send up all the data */ 1436 SCTP_TCB_SEND_LOCK(stcb); 1437 1438 sctp_report_all_outbound(stcb, 1); 1439 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 1440 stcb->asoc.strmout[i].stream_no = i; 1441 stcb->asoc.strmout[i].next_sequence_sent = 0; 1442 stcb->asoc.strmout[i].last_msg_incomplete = 0; 1443 } 1444 /* process the INIT-ACK info (my info) */ 1445 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1446 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1447 1448 /* pull from vtag hash */ 1449 LIST_REMOVE(stcb, sctp_asocs); 1450 /* re-insert to new vtag position */ 1451 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, 1452 sctppcbinfo.hashasocmark)]; 1453 /* 1454 * put it in the bucket in the vtag hash of assoc's for the 1455 * system 1456 */ 1457 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 1458 1459 /* Is this the first restart? */ 1460 if (stcb->asoc.in_restart_hash == 0) { 1461 /* Ok add it to assoc_id vtag hash */ 1462 head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id, 1463 sctppcbinfo.hashrestartmark)]; 1464 LIST_INSERT_HEAD(head, stcb, sctp_tcbrestarhash); 1465 stcb->asoc.in_restart_hash = 1; 1466 } 1467 /* process the INIT info (peer's info) */ 1468 SCTP_TCB_SEND_UNLOCK(stcb); 1469 SCTP_INP_WUNLOCK(stcb->sctp_ep); 1470 SCTP_INP_INFO_WUNLOCK(); 1471 1472 retval = sctp_process_init(init_cp, stcb, net); 1473 if (retval < 0) { 1474 if (how_indx < sizeof(asoc->cookie_how)) 1475 asoc->cookie_how[how_indx] = 13; 1476 1477 return (NULL); 1478 } 1479 /* 1480 * since we did not send a HB make sure we don't double 1481 * things 1482 */ 1483 net->hb_responded = 1; 1484 1485 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1486 init_offset + sizeof(struct sctp_init_chunk), 1487 initack_offset, sh, init_src)) { 1488 if (how_indx < sizeof(asoc->cookie_how)) 1489 asoc->cookie_how[how_indx] = 14; 1490 1491 return (NULL); 1492 } 1493 /* respond with a COOKIE-ACK */ 1494 sctp_stop_all_cookie_timers(stcb); 1495 sctp_toss_old_cookies(stcb, asoc); 1496 sctp_send_cookie_ack(stcb); 1497 if (how_indx < sizeof(asoc->cookie_how)) 1498 asoc->cookie_how[how_indx] = 15; 1499 1500 return (stcb); 1501 } 1502 if (how_indx < sizeof(asoc->cookie_how)) 1503 asoc->cookie_how[how_indx] = 16; 1504 /* all other cases... */ 1505 return (NULL); 1506 } 1507 1508 1509 /* 1510 * handle a state cookie for a new association m: input packet mbuf chain-- 1511 * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf 1512 * and the cookie signature does not exist offset: offset into mbuf to the 1513 * cookie-echo chunk length: length of the cookie chunk to: where the init 1514 * was from returns a new TCB 1515 */ 1516 static struct sctp_tcb * 1517 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset, 1518 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1519 struct sctp_inpcb *inp, struct sctp_nets **netp, 1520 struct sockaddr *init_src, int *notification, 1521 int auth_skipped, uint32_t auth_offset, uint32_t auth_len) 1522 { 1523 struct sctp_tcb *stcb; 1524 struct sctp_init_chunk *init_cp, init_buf; 1525 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1526 struct sockaddr_storage sa_store; 1527 struct sockaddr *initack_src = (struct sockaddr *)&sa_store; 1528 struct sockaddr_in *sin; 1529 struct sockaddr_in6 *sin6; 1530 struct sctp_association *asoc; 1531 int chk_length; 1532 int init_offset, initack_offset, initack_limit; 1533 int retval; 1534 int error = 0; 1535 uint32_t old_tag; 1536 uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE]; 1537 1538 /* 1539 * find and validate the INIT chunk in the cookie (peer's info) the 1540 * INIT should start after the cookie-echo header struct (chunk 1541 * header, state cookie header struct) 1542 */ 1543 init_offset = offset + sizeof(struct sctp_cookie_echo_chunk); 1544 init_cp = (struct sctp_init_chunk *) 1545 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1546 (uint8_t *) & init_buf); 1547 if (init_cp == NULL) { 1548 /* could not pull a INIT chunk in cookie */ 1549 #ifdef SCTP_DEBUG 1550 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1551 printf("process_cookie_new: could not pull INIT chunk hdr\n"); 1552 } 1553 #endif /* SCTP_DEBUG */ 1554 return (NULL); 1555 } 1556 chk_length = ntohs(init_cp->ch.chunk_length); 1557 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1558 #ifdef SCTP_DEBUG 1559 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1560 printf("HUH? process_cookie_new: could not find INIT chunk!\n"); 1561 } 1562 #endif /* SCTP_DEBUG */ 1563 return (NULL); 1564 } 1565 initack_offset = init_offset + SCTP_SIZE32(chk_length); 1566 /* 1567 * find and validate the INIT-ACK chunk in the cookie (my info) the 1568 * INIT-ACK follows the INIT chunk 1569 */ 1570 initack_cp = (struct sctp_init_ack_chunk *) 1571 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1572 (uint8_t *) & initack_buf); 1573 if (initack_cp == NULL) { 1574 /* could not pull INIT-ACK chunk in cookie */ 1575 #ifdef SCTP_DEBUG 1576 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1577 printf("process_cookie_new: could not pull INIT-ACK chunk hdr\n"); 1578 } 1579 #endif /* SCTP_DEBUG */ 1580 return (NULL); 1581 } 1582 chk_length = ntohs(initack_cp->ch.chunk_length); 1583 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1584 return (NULL); 1585 } 1586 /* 1587 * NOTE: We can't use the INIT_ACK's chk_length to determine the 1588 * "initack_limit" value. This is because the chk_length field 1589 * includes the length of the cookie, but the cookie is omitted when 1590 * the INIT and INIT_ACK are tacked onto the cookie... 1591 */ 1592 initack_limit = offset + cookie_len; 1593 1594 /* 1595 * now that we know the INIT/INIT-ACK are in place, create a new TCB 1596 * and popluate 1597 */ 1598 stcb = sctp_aloc_assoc(inp, init_src, 0, &error, 1599 ntohl(initack_cp->init.initiate_tag)); 1600 if (stcb == NULL) { 1601 struct mbuf *op_err; 1602 1603 /* memory problem? */ 1604 #ifdef SCTP_DEBUG 1605 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1606 printf("process_cookie_new: no room for another TCB!\n"); 1607 } 1608 #endif /* SCTP_DEBUG */ 1609 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1610 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 1611 sh, op_err); 1612 return (NULL); 1613 } 1614 /* get the correct sctp_nets */ 1615 *netp = sctp_findnet(stcb, init_src); 1616 asoc = &stcb->asoc; 1617 /* get scope variables out of cookie */ 1618 asoc->ipv4_local_scope = cookie->ipv4_scope; 1619 asoc->site_scope = cookie->site_scope; 1620 asoc->local_scope = cookie->local_scope; 1621 asoc->loopback_scope = cookie->loopback_scope; 1622 1623 if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) || 1624 (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) { 1625 struct mbuf *op_err; 1626 1627 /* 1628 * Houston we have a problem. The EP changed while the 1629 * cookie was in flight. Only recourse is to abort the 1630 * association. 1631 */ 1632 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1633 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 1634 sh, op_err); 1635 return (NULL); 1636 } 1637 /* process the INIT-ACK info (my info) */ 1638 old_tag = asoc->my_vtag; 1639 asoc->assoc_id = asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1640 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1641 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1642 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1643 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1644 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1645 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1646 asoc->str_reset_seq_in = asoc->init_seq_number; 1647 1648 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1649 1650 /* process the INIT info (peer's info) */ 1651 retval = sctp_process_init(init_cp, stcb, *netp); 1652 if (retval < 0) { 1653 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16); 1654 return (NULL); 1655 } 1656 /* load all addresses */ 1657 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1658 init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh, 1659 init_src)) { 1660 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17); 1661 return (NULL); 1662 } 1663 /* 1664 * verify any preceding AUTH chunk that was skipped 1665 */ 1666 /* pull the local authentication parameters from the cookie/init-ack */ 1667 sctp_auth_get_cookie_params(stcb, m, 1668 initack_offset + sizeof(struct sctp_init_ack_chunk), 1669 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk))); 1670 if (auth_skipped) { 1671 struct sctp_auth_chunk *auth; 1672 1673 auth = (struct sctp_auth_chunk *) 1674 sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf); 1675 if (sctp_handle_auth(stcb, auth, m, auth_offset)) { 1676 /* auth HMAC failed, dump the assoc and packet */ 1677 #ifdef SCTP_DEBUG 1678 if (sctp_debug_on & SCTP_DEBUG_AUTH1) 1679 printf("COOKIE-ECHO: AUTH failed\n"); 1680 #endif /* SCTP_DEBUG */ 1681 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18); 1682 return (NULL); 1683 } else { 1684 /* remaining chunks checked... good to go */ 1685 stcb->asoc.authenticated = 1; 1686 } 1687 } 1688 /* update current state */ 1689 #ifdef SCTP_DEBUG 1690 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1691 printf("moving to OPEN state\n"); 1692 } 1693 #endif 1694 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1695 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1696 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1697 stcb->sctp_ep, stcb, asoc->primary_destination); 1698 } else { 1699 asoc->state = SCTP_STATE_OPEN; 1700 } 1701 sctp_stop_all_cookie_timers(stcb); 1702 SCTP_STAT_INCR_COUNTER32(sctps_passiveestab); 1703 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1704 1705 /* 1706 * if we're doing ASCONFs, check to see if we have any new local 1707 * addresses that need to get added to the peer (eg. addresses 1708 * changed while cookie echo in flight). This needs to be done 1709 * after we go to the OPEN state to do the correct asconf 1710 * processing. else, make sure we have the correct addresses in our 1711 * lists 1712 */ 1713 1714 /* warning, we re-use sin, sin6, sa_store here! */ 1715 /* pull in local_address (our "from" address) */ 1716 if (cookie->laddr_type == SCTP_IPV4_ADDRESS) { 1717 /* source addr is IPv4 */ 1718 sin = (struct sockaddr_in *)initack_src; 1719 memset(sin, 0, sizeof(*sin)); 1720 sin->sin_family = AF_INET; 1721 sin->sin_len = sizeof(struct sockaddr_in); 1722 sin->sin_addr.s_addr = cookie->laddress[0]; 1723 } else if (cookie->laddr_type == SCTP_IPV6_ADDRESS) { 1724 /* source addr is IPv6 */ 1725 sin6 = (struct sockaddr_in6 *)initack_src; 1726 memset(sin6, 0, sizeof(*sin6)); 1727 sin6->sin6_family = AF_INET6; 1728 sin6->sin6_len = sizeof(struct sockaddr_in6); 1729 sin6->sin6_scope_id = cookie->scope_id; 1730 memcpy(&sin6->sin6_addr, cookie->laddress, 1731 sizeof(sin6->sin6_addr)); 1732 } else { 1733 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19); 1734 return (NULL); 1735 } 1736 1737 sctp_check_address_list(stcb, m, 1738 initack_offset + sizeof(struct sctp_init_ack_chunk), 1739 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)), 1740 initack_src, cookie->local_scope, cookie->site_scope, 1741 cookie->ipv4_scope, cookie->loopback_scope); 1742 1743 1744 /* set up to notify upper layer */ 1745 *notification = SCTP_NOTIFY_ASSOC_UP; 1746 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1747 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1748 (inp->sctp_socket->so_qlimit == 0)) { 1749 /* 1750 * This is an endpoint that called connect() how it got a 1751 * cookie that is NEW is a bit of a mystery. It must be that 1752 * the INIT was sent, but before it got there.. a complete 1753 * INIT/INIT-ACK/COOKIE arrived. But of course then it 1754 * should have went to the other code.. not here.. oh well.. 1755 * a bit of protection is worth having.. 1756 */ 1757 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 1758 soisconnected(stcb->sctp_ep->sctp_socket); 1759 } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 1760 (inp->sctp_socket->so_qlimit)) { 1761 /* 1762 * We don't want to do anything with this one. Since it is 1763 * the listening guy. The timer will get started for 1764 * accepted connections in the caller. 1765 */ 1766 ; 1767 } 1768 /* since we did not send a HB make sure we don't double things */ 1769 (*netp)->hb_responded = 1; 1770 1771 if (stcb->asoc.sctp_autoclose_ticks && 1772 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1773 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL); 1774 } 1775 /* respond with a COOKIE-ACK */ 1776 /* calculate the RTT */ 1777 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp, 1778 &cookie->time_entered); 1779 sctp_send_cookie_ack(stcb); 1780 return (stcb); 1781 } 1782 1783 1784 /* 1785 * handles a COOKIE-ECHO message stcb: modified to either a new or left as 1786 * existing (non-NULL) TCB 1787 */ 1788 static struct mbuf * 1789 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset, 1790 struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp, 1791 struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp, 1792 int auth_skipped, uint32_t auth_offset, uint32_t auth_len, struct sctp_tcb **locked_tcb) 1793 { 1794 struct sctp_state_cookie *cookie; 1795 struct sockaddr_in6 sin6; 1796 struct sockaddr_in sin; 1797 struct sctp_tcb *l_stcb = *stcb; 1798 struct sctp_inpcb *l_inp; 1799 struct sockaddr *to; 1800 sctp_assoc_t sac_restart_id; 1801 struct sctp_pcb *ep; 1802 struct mbuf *m_sig; 1803 uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE]; 1804 uint8_t *sig; 1805 uint8_t cookie_ok = 0; 1806 unsigned int size_of_pkt, sig_offset, cookie_offset; 1807 unsigned int cookie_len; 1808 struct timeval now; 1809 struct timeval time_expires; 1810 struct sockaddr_storage dest_store; 1811 struct sockaddr *localep_sa = (struct sockaddr *)&dest_store; 1812 struct ip *iph; 1813 int notification = 0; 1814 struct sctp_nets *netl; 1815 int had_a_existing_tcb = 0; 1816 1817 #ifdef SCTP_DEBUG 1818 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1819 printf("sctp_handle_cookie: handling COOKIE-ECHO\n"); 1820 } 1821 #endif 1822 1823 if (inp_p == NULL) { 1824 return (NULL); 1825 } 1826 /* First get the destination address setup too. */ 1827 iph = mtod(m, struct ip *); 1828 if (iph->ip_v == IPVERSION) { 1829 /* its IPv4 */ 1830 struct sockaddr_in *sin; 1831 1832 sin = (struct sockaddr_in *)(localep_sa); 1833 memset(sin, 0, sizeof(*sin)); 1834 sin->sin_family = AF_INET; 1835 sin->sin_len = sizeof(*sin); 1836 sin->sin_port = sh->dest_port; 1837 sin->sin_addr.s_addr = iph->ip_dst.s_addr; 1838 size_of_pkt = SCTP_GET_IPV4_LENGTH(iph); 1839 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1840 /* its IPv6 */ 1841 struct ip6_hdr *ip6; 1842 struct sockaddr_in6 *sin6; 1843 1844 sin6 = (struct sockaddr_in6 *)(localep_sa); 1845 memset(sin6, 0, sizeof(*sin6)); 1846 sin6->sin6_family = AF_INET6; 1847 sin6->sin6_len = sizeof(struct sockaddr_in6); 1848 ip6 = mtod(m, struct ip6_hdr *); 1849 sin6->sin6_port = sh->dest_port; 1850 sin6->sin6_addr = ip6->ip6_dst; 1851 size_of_pkt = SCTP_GET_IPV6_LENGTH(ip6) + iphlen; 1852 } else { 1853 return (NULL); 1854 } 1855 1856 cookie = &cp->cookie; 1857 cookie_offset = offset + sizeof(struct sctp_chunkhdr); 1858 cookie_len = ntohs(cp->ch.chunk_length); 1859 1860 if ((cookie->peerport != sh->src_port) && 1861 (cookie->myport != sh->dest_port) && 1862 (cookie->my_vtag != sh->v_tag)) { 1863 /* 1864 * invalid ports or bad tag. Note that we always leave the 1865 * v_tag in the header in network order and when we stored 1866 * it in the my_vtag slot we also left it in network order. 1867 * This maintians the match even though it may be in the 1868 * opposite byte order of the machine :-> 1869 */ 1870 return (NULL); 1871 } 1872 if (cookie_len > size_of_pkt || 1873 cookie_len < sizeof(struct sctp_cookie_echo_chunk) + 1874 sizeof(struct sctp_init_chunk) + 1875 sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) { 1876 /* cookie too long! or too small */ 1877 return (NULL); 1878 } 1879 /* 1880 * split off the signature into its own mbuf (since it should not be 1881 * calculated in the sctp_hmac_m() call). 1882 */ 1883 sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE; 1884 if (sig_offset > size_of_pkt) { 1885 /* packet not correct size! */ 1886 /* XXX this may already be accounted for earlier... */ 1887 return (NULL); 1888 } 1889 m_sig = m_split(m, sig_offset, M_DONTWAIT); 1890 if (m_sig == NULL) { 1891 /* out of memory or ?? */ 1892 return (NULL); 1893 } 1894 /* 1895 * compute the signature/digest for the cookie 1896 */ 1897 ep = &(*inp_p)->sctp_ep; 1898 l_inp = *inp_p; 1899 if (l_stcb) { 1900 SCTP_TCB_UNLOCK(l_stcb); 1901 } 1902 SCTP_INP_RLOCK(l_inp); 1903 if (l_stcb) { 1904 SCTP_TCB_LOCK(l_stcb); 1905 } 1906 /* which cookie is it? */ 1907 if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) && 1908 (ep->current_secret_number != ep->last_secret_number)) { 1909 /* it's the old cookie */ 1910 sctp_hmac_m(SCTP_HMAC, 1911 (uint8_t *) ep->secret_key[(int)ep->last_secret_number], 1912 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1913 } else { 1914 /* it's the current cookie */ 1915 sctp_hmac_m(SCTP_HMAC, 1916 (uint8_t *) ep->secret_key[(int)ep->current_secret_number], 1917 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1918 } 1919 /* get the signature */ 1920 SCTP_INP_RUNLOCK(l_inp); 1921 sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig); 1922 if (sig == NULL) { 1923 /* couldn't find signature */ 1924 sctp_m_freem(m_sig); 1925 return (NULL); 1926 } 1927 /* compare the received digest with the computed digest */ 1928 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) { 1929 /* try the old cookie? */ 1930 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) && 1931 (ep->current_secret_number != ep->last_secret_number)) { 1932 /* compute digest with old */ 1933 sctp_hmac_m(SCTP_HMAC, 1934 (uint8_t *) ep->secret_key[(int)ep->last_secret_number], 1935 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1936 /* compare */ 1937 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0) 1938 cookie_ok = 1; 1939 } 1940 } else { 1941 cookie_ok = 1; 1942 } 1943 1944 /* 1945 * Now before we continue we must reconstruct our mbuf so that 1946 * normal processing of any other chunks will work. 1947 */ 1948 { 1949 struct mbuf *m_at; 1950 1951 m_at = m; 1952 while (SCTP_BUF_NEXT(m_at) != NULL) { 1953 m_at = SCTP_BUF_NEXT(m_at); 1954 } 1955 SCTP_BUF_NEXT(m_at) = m_sig; 1956 } 1957 1958 if (cookie_ok == 0) { 1959 #ifdef SCTP_DEBUG 1960 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1961 printf("handle_cookie_echo: cookie signature validation failed!\n"); 1962 printf("offset = %u, cookie_offset = %u, sig_offset = %u\n", 1963 (uint32_t) offset, cookie_offset, sig_offset); 1964 } 1965 #endif 1966 return (NULL); 1967 } 1968 /* 1969 * check the cookie timestamps to be sure it's not stale 1970 */ 1971 SCTP_GETTIME_TIMEVAL(&now); 1972 /* Expire time is in Ticks, so we convert to seconds */ 1973 time_expires.tv_sec = cookie->time_entered.tv_sec + cookie->cookie_life; 1974 time_expires.tv_usec = cookie->time_entered.tv_usec; 1975 if (timevalcmp(&now, &time_expires, >)) { 1976 /* cookie is stale! */ 1977 struct mbuf *op_err; 1978 struct sctp_stale_cookie_msg *scm; 1979 uint32_t tim; 1980 1981 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg), 1982 0, M_DONTWAIT, 1, MT_DATA); 1983 if (op_err == NULL) { 1984 /* FOOBAR */ 1985 return (NULL); 1986 } 1987 /* pre-reserve some space */ 1988 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 1989 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 1990 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 1991 1992 /* Set the len */ 1993 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg); 1994 scm = mtod(op_err, struct sctp_stale_cookie_msg *); 1995 scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE); 1996 scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) + 1997 (sizeof(uint32_t)))); 1998 /* seconds to usec */ 1999 tim = (now.tv_sec - time_expires.tv_sec) * 1000000; 2000 /* add in usec */ 2001 if (tim == 0) 2002 tim = now.tv_usec - cookie->time_entered.tv_usec; 2003 scm->time_usec = htonl(tim); 2004 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag); 2005 return (NULL); 2006 } 2007 /* 2008 * Now we must see with the lookup address if we have an existing 2009 * asoc. This will only happen if we were in the COOKIE-WAIT state 2010 * and a INIT collided with us and somewhere the peer sent the 2011 * cookie on another address besides the single address our assoc 2012 * had for him. In this case we will have one of the tie-tags set at 2013 * least AND the address field in the cookie can be used to look it 2014 * up. 2015 */ 2016 to = NULL; 2017 if (cookie->addr_type == SCTP_IPV6_ADDRESS) { 2018 memset(&sin6, 0, sizeof(sin6)); 2019 sin6.sin6_family = AF_INET6; 2020 sin6.sin6_len = sizeof(sin6); 2021 sin6.sin6_port = sh->src_port; 2022 sin6.sin6_scope_id = cookie->scope_id; 2023 memcpy(&sin6.sin6_addr.s6_addr, cookie->address, 2024 sizeof(sin6.sin6_addr.s6_addr)); 2025 to = (struct sockaddr *)&sin6; 2026 } else if (cookie->addr_type == SCTP_IPV4_ADDRESS) { 2027 memset(&sin, 0, sizeof(sin)); 2028 sin.sin_family = AF_INET; 2029 sin.sin_len = sizeof(sin); 2030 sin.sin_port = sh->src_port; 2031 sin.sin_addr.s_addr = cookie->address[0]; 2032 to = (struct sockaddr *)&sin; 2033 } 2034 if ((*stcb == NULL) && to) { 2035 /* Yep, lets check */ 2036 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL); 2037 if (*stcb == NULL) { 2038 /* 2039 * We should have only got back the same inp. If we 2040 * got back a different ep we have a problem. The 2041 * original findep got back l_inp and now 2042 */ 2043 if (l_inp != *inp_p) { 2044 printf("Bad problem find_ep got a diff inp then special_locate?\n"); 2045 } 2046 } else { 2047 if (*locked_tcb == NULL) { 2048 /* 2049 * In this case we found the assoc only 2050 * after we locked the create lock. This 2051 * means we are in a colliding case and we 2052 * must make sure that we unlock the tcb if 2053 * its one of the cases where we throw away 2054 * the incoming packets. 2055 */ 2056 *locked_tcb = *stcb; 2057 2058 /* 2059 * We must also increment the inp ref count 2060 * since the ref_count flags was set when we 2061 * did not find the TCB, now we found it 2062 * which reduces the refcount.. we must 2063 * raise it back out to balance it all :-) 2064 */ 2065 SCTP_INP_INCR_REF((*stcb)->sctp_ep); 2066 if ((*stcb)->sctp_ep != l_inp) { 2067 printf("Huh? ep:%p diff then l_inp:%p?\n", 2068 (*stcb)->sctp_ep, l_inp); 2069 } 2070 } 2071 } 2072 } 2073 cookie_len -= SCTP_SIGNATURE_SIZE; 2074 if (*stcb == NULL) { 2075 /* this is the "normal" case... get a new TCB */ 2076 *stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie, 2077 cookie_len, *inp_p, netp, to, ¬ification, 2078 auth_skipped, auth_offset, auth_len); 2079 } else { 2080 /* this is abnormal... cookie-echo on existing TCB */ 2081 had_a_existing_tcb = 1; 2082 *stcb = sctp_process_cookie_existing(m, iphlen, offset, sh, 2083 cookie, cookie_len, *inp_p, *stcb, *netp, to, ¬ification, 2084 &sac_restart_id); 2085 } 2086 2087 if (*stcb == NULL) { 2088 /* still no TCB... must be bad cookie-echo */ 2089 return (NULL); 2090 } 2091 /* 2092 * Ok, we built an association so confirm the address we sent the 2093 * INIT-ACK to. 2094 */ 2095 netl = sctp_findnet(*stcb, to); 2096 /* 2097 * This code should in theory NOT run but 2098 */ 2099 if (netl == NULL) { 2100 /* TSNH! Huh, why do I need to add this address here? */ 2101 int ret; 2102 2103 ret = sctp_add_remote_addr(*stcb, to, SCTP_DONOT_SETSCOPE, 2104 SCTP_IN_COOKIE_PROC); 2105 netl = sctp_findnet(*stcb, to); 2106 } 2107 if (netl) { 2108 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) { 2109 netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2110 sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL, 2111 netl); 2112 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 2113 (*stcb), 0, (void *)netl); 2114 } 2115 } 2116 if (*stcb) { 2117 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, *inp_p, 2118 *stcb, NULL); 2119 } 2120 if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 2121 if (!had_a_existing_tcb || 2122 (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) { 2123 /* 2124 * If we have a NEW cookie or the connect never 2125 * reached the connected state during collision we 2126 * must do the TCP accept thing. 2127 */ 2128 struct socket *so, *oso; 2129 struct sctp_inpcb *inp; 2130 2131 if (notification == SCTP_NOTIFY_ASSOC_RESTART) { 2132 /* 2133 * For a restart we will keep the same 2134 * socket, no need to do anything. I THINK!! 2135 */ 2136 sctp_ulp_notify(notification, *stcb, 0, (void *)&sac_restart_id); 2137 return (m); 2138 } 2139 oso = (*inp_p)->sctp_socket; 2140 /* 2141 * We do this to keep the sockets side happy durin 2142 * the sonewcon ONLY. 2143 */ 2144 NET_LOCK_GIANT(); 2145 SCTP_TCB_UNLOCK((*stcb)); 2146 so = sonewconn(oso, 0 2147 ); 2148 NET_UNLOCK_GIANT(); 2149 SCTP_INP_WLOCK((*stcb)->sctp_ep); 2150 SCTP_TCB_LOCK((*stcb)); 2151 SCTP_INP_WUNLOCK((*stcb)->sctp_ep); 2152 if (so == NULL) { 2153 struct mbuf *op_err; 2154 2155 /* Too many sockets */ 2156 #ifdef SCTP_DEBUG 2157 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 2158 printf("process_cookie_new: no room for another socket!\n"); 2159 } 2160 #endif /* SCTP_DEBUG */ 2161 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 2162 sctp_abort_association(*inp_p, NULL, m, iphlen, 2163 sh, op_err); 2164 sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20); 2165 return (NULL); 2166 } 2167 inp = (struct sctp_inpcb *)so->so_pcb; 2168 SCTP_INP_INCR_REF(inp); 2169 /* 2170 * We add the unbound flag here so that if we get an 2171 * soabort() before we get the move_pcb done, we 2172 * will properly cleanup. 2173 */ 2174 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 2175 SCTP_PCB_FLAGS_CONNECTED | 2176 SCTP_PCB_FLAGS_IN_TCPPOOL | 2177 SCTP_PCB_FLAGS_UNBOUND | 2178 (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) | 2179 SCTP_PCB_FLAGS_DONT_WAKE); 2180 inp->sctp_features = (*inp_p)->sctp_features; 2181 inp->sctp_socket = so; 2182 inp->sctp_frag_point = (*inp_p)->sctp_frag_point; 2183 inp->partial_delivery_point = (*inp_p)->partial_delivery_point; 2184 inp->sctp_context = (*inp_p)->sctp_context; 2185 inp->inp_starting_point_for_iterator = NULL; 2186 /* 2187 * copy in the authentication parameters from the 2188 * original endpoint 2189 */ 2190 if (inp->sctp_ep.local_hmacs) 2191 sctp_free_hmaclist(inp->sctp_ep.local_hmacs); 2192 inp->sctp_ep.local_hmacs = 2193 sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs); 2194 if (inp->sctp_ep.local_auth_chunks) 2195 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks); 2196 inp->sctp_ep.local_auth_chunks = 2197 sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks); 2198 (void)sctp_copy_skeylist(&(*inp_p)->sctp_ep.shared_keys, 2199 &inp->sctp_ep.shared_keys); 2200 2201 /* 2202 * Now we must move it from one hash table to 2203 * another and get the tcb in the right place. 2204 */ 2205 sctp_move_pcb_and_assoc(*inp_p, inp, *stcb); 2206 sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb); 2207 2208 /* 2209 * now we must check to see if we were aborted while 2210 * the move was going on and the lock/unlock 2211 * happened. 2212 */ 2213 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 2214 /* 2215 * yep it was, we leave the assoc attached 2216 * to the socket since the sctp_inpcb_free() 2217 * call will send an abort for us. 2218 */ 2219 SCTP_INP_DECR_REF(inp); 2220 return (NULL); 2221 } 2222 SCTP_INP_DECR_REF(inp); 2223 /* Switch over to the new guy */ 2224 *inp_p = inp; 2225 sctp_ulp_notify(notification, *stcb, 0, NULL); 2226 2227 /* 2228 * Pull it from the incomplete queue and wake the 2229 * guy 2230 */ 2231 soisconnected(so); 2232 return (m); 2233 } 2234 } 2235 if ((notification) && ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) { 2236 sctp_ulp_notify(notification, *stcb, 0, NULL); 2237 } 2238 return (m); 2239 } 2240 2241 static void 2242 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp, 2243 struct sctp_tcb *stcb, struct sctp_nets *net) 2244 { 2245 /* cp must not be used, others call this without a c-ack :-) */ 2246 struct sctp_association *asoc; 2247 2248 #ifdef SCTP_DEBUG 2249 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2250 printf("sctp_handle_cookie_ack: handling COOKIE-ACK\n"); 2251 } 2252 #endif 2253 if (stcb == NULL) 2254 return; 2255 2256 asoc = &stcb->asoc; 2257 2258 sctp_stop_all_cookie_timers(stcb); 2259 /* process according to association state */ 2260 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 2261 /* state change only needed when I am in right state */ 2262 #ifdef SCTP_DEBUG 2263 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2264 printf("moving to OPEN state\n"); 2265 } 2266 #endif 2267 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 2268 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 2269 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 2270 stcb->sctp_ep, stcb, asoc->primary_destination); 2271 2272 } else { 2273 asoc->state = SCTP_STATE_OPEN; 2274 } 2275 /* update RTO */ 2276 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 2277 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 2278 if (asoc->overall_error_count == 0) { 2279 net->RTO = sctp_calculate_rto(stcb, asoc, net, 2280 &asoc->time_entered); 2281 } 2282 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 2283 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL); 2284 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 2285 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 2286 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 2287 soisconnected(stcb->sctp_ep->sctp_socket); 2288 } 2289 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, 2290 stcb, net); 2291 /* 2292 * since we did not send a HB make sure we don't double 2293 * things 2294 */ 2295 net->hb_responded = 1; 2296 2297 if (stcb->asoc.sctp_autoclose_ticks && 2298 sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) { 2299 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 2300 stcb->sctp_ep, stcb, NULL); 2301 } 2302 /* 2303 * set ASCONF timer if ASCONFs are pending and allowed (eg. 2304 * addresses changed when init/cookie echo in flight) 2305 */ 2306 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) && 2307 (stcb->asoc.peer_supports_asconf) && 2308 (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) { 2309 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, 2310 stcb->sctp_ep, stcb, 2311 stcb->asoc.primary_destination); 2312 } 2313 } 2314 /* Toss the cookie if I can */ 2315 sctp_toss_old_cookies(stcb, asoc); 2316 if (!TAILQ_EMPTY(&asoc->sent_queue)) { 2317 /* Restart the timer if we have pending data */ 2318 struct sctp_tmit_chunk *chk; 2319 2320 chk = TAILQ_FIRST(&asoc->sent_queue); 2321 if (chk) { 2322 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2323 stcb, chk->whoTo); 2324 } 2325 } 2326 } 2327 2328 static void 2329 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp, 2330 struct sctp_tcb *stcb) 2331 { 2332 struct sctp_nets *net; 2333 struct sctp_tmit_chunk *lchk; 2334 uint32_t tsn; 2335 2336 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_ecne_chunk)) { 2337 return; 2338 } 2339 SCTP_STAT_INCR(sctps_recvecne); 2340 tsn = ntohl(cp->tsn); 2341 /* ECN Nonce stuff: need a resync and disable the nonce sum check */ 2342 /* Also we make sure we disable the nonce_wait */ 2343 lchk = TAILQ_FIRST(&stcb->asoc.send_queue); 2344 if (lchk == NULL) { 2345 stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq; 2346 } else { 2347 stcb->asoc.nonce_resync_tsn = lchk->rec.data.TSN_seq; 2348 } 2349 stcb->asoc.nonce_wait_for_ecne = 0; 2350 stcb->asoc.nonce_sum_check = 0; 2351 2352 /* Find where it was sent, if possible */ 2353 net = NULL; 2354 lchk = TAILQ_FIRST(&stcb->asoc.sent_queue); 2355 while (lchk) { 2356 if (lchk->rec.data.TSN_seq == tsn) { 2357 net = lchk->whoTo; 2358 break; 2359 } 2360 if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ)) 2361 break; 2362 lchk = TAILQ_NEXT(lchk, sctp_next); 2363 } 2364 if (net == NULL) 2365 /* default is we use the primary */ 2366 net = stcb->asoc.primary_destination; 2367 2368 if (compare_with_wrap(tsn, stcb->asoc.last_cwr_tsn, MAX_TSN)) { 2369 #ifdef SCTP_CWND_MONITOR 2370 int old_cwnd; 2371 2372 old_cwnd = net->cwnd; 2373 #endif 2374 SCTP_STAT_INCR(sctps_ecnereducedcwnd); 2375 net->ssthresh = net->cwnd / 2; 2376 if (net->ssthresh < net->mtu) { 2377 net->ssthresh = net->mtu; 2378 /* here back off the timer as well, to slow us down */ 2379 net->RTO <<= 2; 2380 } 2381 net->cwnd = net->ssthresh; 2382 #ifdef SCTP_CWND_MONITOR 2383 sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_SAT); 2384 #endif 2385 /* 2386 * we reduce once every RTT. So we will only lower cwnd at 2387 * the next sending seq i.e. the resync_tsn. 2388 */ 2389 stcb->asoc.last_cwr_tsn = stcb->asoc.nonce_resync_tsn; 2390 } 2391 /* 2392 * We always send a CWR this way if our previous one was lost our 2393 * peer will get an update, or if it is not time again to reduce we 2394 * still get the cwr to the peer. 2395 */ 2396 sctp_send_cwr(stcb, net, tsn); 2397 } 2398 2399 static void 2400 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb) 2401 { 2402 /* 2403 * Here we get a CWR from the peer. We must look in the outqueue and 2404 * make sure that we have a covered ECNE in teh control chunk part. 2405 * If so remove it. 2406 */ 2407 struct sctp_tmit_chunk *chk; 2408 struct sctp_ecne_chunk *ecne; 2409 2410 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 2411 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) { 2412 continue; 2413 } 2414 /* 2415 * Look for and remove if it is the right TSN. Since there 2416 * is only ONE ECNE on the control queue at any one time we 2417 * don't need to worry about more than one! 2418 */ 2419 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 2420 if (compare_with_wrap(ntohl(cp->tsn), ntohl(ecne->tsn), 2421 MAX_TSN) || (cp->tsn == ecne->tsn)) { 2422 /* this covers this ECNE, we can remove it */ 2423 stcb->asoc.ecn_echo_cnt_onq--; 2424 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, 2425 sctp_next); 2426 if (chk->data) { 2427 sctp_m_freem(chk->data); 2428 chk->data = NULL; 2429 } 2430 stcb->asoc.ctrl_queue_cnt--; 2431 sctp_free_remote_addr(chk->whoTo); 2432 sctp_free_a_chunk(stcb, chk); 2433 break; 2434 } 2435 } 2436 } 2437 2438 static void 2439 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp, 2440 struct sctp_tcb *stcb, struct sctp_nets *net) 2441 { 2442 struct sctp_association *asoc; 2443 2444 #ifdef SCTP_DEBUG 2445 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2446 printf("sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n"); 2447 } 2448 #endif 2449 if (stcb == NULL) 2450 return; 2451 2452 asoc = &stcb->asoc; 2453 /* process according to association state */ 2454 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) { 2455 /* unexpected SHUTDOWN-COMPLETE... so ignore... */ 2456 SCTP_TCB_UNLOCK(stcb); 2457 return; 2458 } 2459 /* notify upper layer protocol */ 2460 if (stcb->sctp_socket) { 2461 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 2462 /* are the queues empty? they should be */ 2463 if (!TAILQ_EMPTY(&asoc->send_queue) || 2464 !TAILQ_EMPTY(&asoc->sent_queue) || 2465 !TAILQ_EMPTY(&asoc->out_wheel)) { 2466 sctp_report_all_outbound(stcb, 0); 2467 } 2468 } 2469 /* stop the timer */ 2470 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_21); 2471 SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 2472 /* free the TCB */ 2473 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22); 2474 return; 2475 } 2476 2477 static int 2478 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc, 2479 struct sctp_nets *net, uint8_t flg) 2480 { 2481 switch (desc->chunk_type) { 2482 case SCTP_DATA: 2483 /* find the tsn to resend (possibly */ 2484 { 2485 uint32_t tsn; 2486 struct sctp_tmit_chunk *tp1; 2487 2488 tsn = ntohl(desc->tsn_ifany); 2489 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2490 while (tp1) { 2491 if (tp1->rec.data.TSN_seq == tsn) { 2492 /* found it */ 2493 break; 2494 } 2495 if (compare_with_wrap(tp1->rec.data.TSN_seq, tsn, 2496 MAX_TSN)) { 2497 /* not found */ 2498 tp1 = NULL; 2499 break; 2500 } 2501 tp1 = TAILQ_NEXT(tp1, sctp_next); 2502 } 2503 if (tp1 == NULL) { 2504 /* 2505 * Do it the other way , aka without paying 2506 * attention to queue seq order. 2507 */ 2508 SCTP_STAT_INCR(sctps_pdrpdnfnd); 2509 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2510 while (tp1) { 2511 if (tp1->rec.data.TSN_seq == tsn) { 2512 /* found it */ 2513 break; 2514 } 2515 tp1 = TAILQ_NEXT(tp1, sctp_next); 2516 } 2517 } 2518 if (tp1 == NULL) { 2519 SCTP_STAT_INCR(sctps_pdrptsnnf); 2520 } 2521 if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) { 2522 uint8_t *ddp; 2523 2524 if ((stcb->asoc.peers_rwnd == 0) && 2525 ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) { 2526 SCTP_STAT_INCR(sctps_pdrpdiwnp); 2527 return (0); 2528 } 2529 if (stcb->asoc.peers_rwnd == 0 && 2530 (flg & SCTP_FROM_MIDDLE_BOX)) { 2531 SCTP_STAT_INCR(sctps_pdrpdizrw); 2532 return (0); 2533 } 2534 ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+ 2535 sizeof(struct sctp_data_chunk)); 2536 { 2537 unsigned int iii; 2538 2539 for (iii = 0; iii < sizeof(desc->data_bytes); 2540 iii++) { 2541 if (ddp[iii] != desc->data_bytes[iii]) { 2542 SCTP_STAT_INCR(sctps_pdrpbadd); 2543 return (-1); 2544 } 2545 } 2546 } 2547 /* 2548 * We zero out the nonce so resync not 2549 * needed 2550 */ 2551 tp1->rec.data.ect_nonce = 0; 2552 2553 if (tp1->do_rtt) { 2554 /* 2555 * this guy had a RTO calculation 2556 * pending on it, cancel it 2557 */ 2558 tp1->whoTo->rto_pending = 0; 2559 tp1->do_rtt = 0; 2560 } 2561 SCTP_STAT_INCR(sctps_pdrpmark); 2562 if (tp1->sent != SCTP_DATAGRAM_RESEND) 2563 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2564 tp1->sent = SCTP_DATAGRAM_RESEND; 2565 /* 2566 * mark it as if we were doing a FR, since 2567 * we will be getting gap ack reports behind 2568 * the info from the router. 2569 */ 2570 tp1->rec.data.doing_fast_retransmit = 1; 2571 /* 2572 * mark the tsn with what sequences can 2573 * cause a new FR. 2574 */ 2575 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) { 2576 tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq; 2577 } else { 2578 tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq; 2579 } 2580 2581 /* restart the timer */ 2582 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2583 stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23); 2584 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2585 stcb, tp1->whoTo); 2586 2587 /* fix counts and things */ 2588 #ifdef SCTP_FLIGHT_LOGGING 2589 sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN, 2590 tp1->whoTo->flight_size, 2591 tp1->book_size, 2592 (uintptr_t) stcb, 2593 tp1->rec.data.TSN_seq); 2594 #endif 2595 if (tp1->whoTo->flight_size >= tp1->book_size) 2596 tp1->whoTo->flight_size -= tp1->book_size; 2597 else 2598 tp1->whoTo->flight_size = 0; 2599 2600 if (stcb->asoc.total_flight >= tp1->book_size) { 2601 stcb->asoc.total_flight -= tp1->book_size; 2602 if (stcb->asoc.total_flight_count > 0) 2603 stcb->asoc.total_flight_count--; 2604 } else { 2605 stcb->asoc.total_flight = 0; 2606 stcb->asoc.total_flight_count = 0; 2607 } 2608 tp1->snd_count--; 2609 } { 2610 /* audit code */ 2611 unsigned int audit; 2612 2613 audit = 0; 2614 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) { 2615 if (tp1->sent == SCTP_DATAGRAM_RESEND) 2616 audit++; 2617 } 2618 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue, 2619 sctp_next) { 2620 if (tp1->sent == SCTP_DATAGRAM_RESEND) 2621 audit++; 2622 } 2623 if (audit != stcb->asoc.sent_queue_retran_cnt) { 2624 printf("**Local Audit finds cnt:%d asoc cnt:%d\n", 2625 audit, stcb->asoc.sent_queue_retran_cnt); 2626 #ifndef SCTP_AUDITING_ENABLED 2627 stcb->asoc.sent_queue_retran_cnt = audit; 2628 #endif 2629 } 2630 } 2631 } 2632 break; 2633 case SCTP_ASCONF: 2634 { 2635 struct sctp_tmit_chunk *asconf; 2636 2637 TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue, 2638 sctp_next) { 2639 if (asconf->rec.chunk_id.id == SCTP_ASCONF) { 2640 break; 2641 } 2642 } 2643 if (asconf) { 2644 if (asconf->sent != SCTP_DATAGRAM_RESEND) 2645 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2646 asconf->sent = SCTP_DATAGRAM_RESEND; 2647 asconf->snd_count--; 2648 } 2649 } 2650 break; 2651 case SCTP_INITIATION: 2652 /* resend the INIT */ 2653 stcb->asoc.dropped_special_cnt++; 2654 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) { 2655 /* 2656 * If we can get it in, in a few attempts we do 2657 * this, otherwise we let the timer fire. 2658 */ 2659 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, 2660 stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24); 2661 sctp_send_initiate(stcb->sctp_ep, stcb); 2662 } 2663 break; 2664 case SCTP_SELECTIVE_ACK: 2665 /* resend the sack */ 2666 sctp_send_sack(stcb); 2667 break; 2668 case SCTP_HEARTBEAT_REQUEST: 2669 /* resend a demand HB */ 2670 sctp_send_hb(stcb, 1, net); 2671 break; 2672 case SCTP_SHUTDOWN: 2673 sctp_send_shutdown(stcb, net); 2674 break; 2675 case SCTP_SHUTDOWN_ACK: 2676 sctp_send_shutdown_ack(stcb, net); 2677 break; 2678 case SCTP_COOKIE_ECHO: 2679 { 2680 struct sctp_tmit_chunk *cookie; 2681 2682 cookie = NULL; 2683 TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue, 2684 sctp_next) { 2685 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 2686 break; 2687 } 2688 } 2689 if (cookie) { 2690 if (cookie->sent != SCTP_DATAGRAM_RESEND) 2691 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2692 cookie->sent = SCTP_DATAGRAM_RESEND; 2693 sctp_stop_all_cookie_timers(stcb); 2694 } 2695 } 2696 break; 2697 case SCTP_COOKIE_ACK: 2698 sctp_send_cookie_ack(stcb); 2699 break; 2700 case SCTP_ASCONF_ACK: 2701 /* resend last asconf ack */ 2702 sctp_send_asconf_ack(stcb, 1); 2703 break; 2704 case SCTP_FORWARD_CUM_TSN: 2705 send_forward_tsn(stcb, &stcb->asoc); 2706 break; 2707 /* can't do anything with these */ 2708 case SCTP_PACKET_DROPPED: 2709 case SCTP_INITIATION_ACK: /* this should not happen */ 2710 case SCTP_HEARTBEAT_ACK: 2711 case SCTP_ABORT_ASSOCIATION: 2712 case SCTP_OPERATION_ERROR: 2713 case SCTP_SHUTDOWN_COMPLETE: 2714 case SCTP_ECN_ECHO: 2715 case SCTP_ECN_CWR: 2716 default: 2717 break; 2718 } 2719 return (0); 2720 } 2721 2722 void 2723 sctp_reset_in_stream(struct sctp_tcb *stcb, int number_entries, uint16_t * list) 2724 { 2725 int i; 2726 uint16_t temp; 2727 2728 /* 2729 * We set things to 0xffff since this is the last delivered sequence 2730 * and we will be sending in 0 after the reset. 2731 */ 2732 2733 if (number_entries) { 2734 for (i = 0; i < number_entries; i++) { 2735 temp = ntohs(list[i]); 2736 if (temp >= stcb->asoc.streamincnt) { 2737 continue; 2738 } 2739 stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff; 2740 } 2741 } else { 2742 list = NULL; 2743 for (i = 0; i < stcb->asoc.streamincnt; i++) { 2744 stcb->asoc.strmin[i].last_sequence_delivered = 0xffff; 2745 } 2746 } 2747 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list); 2748 } 2749 2750 static void 2751 sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list) 2752 { 2753 int i; 2754 2755 if (number_entries == 0) { 2756 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 2757 stcb->asoc.strmout[i].next_sequence_sent = 0; 2758 } 2759 } else if (number_entries) { 2760 for (i = 0; i < number_entries; i++) { 2761 uint16_t temp; 2762 2763 temp = ntohs(list[i]); 2764 if (temp >= stcb->asoc.streamoutcnt) { 2765 /* no such stream */ 2766 continue; 2767 } 2768 stcb->asoc.strmout[temp].next_sequence_sent = 0; 2769 } 2770 } 2771 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list); 2772 } 2773 2774 2775 struct sctp_stream_reset_out_request * 2776 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk) 2777 { 2778 struct sctp_association *asoc; 2779 struct sctp_stream_reset_out_req *req; 2780 struct sctp_stream_reset_out_request *r; 2781 struct sctp_tmit_chunk *chk; 2782 int len, clen; 2783 2784 asoc = &stcb->asoc; 2785 if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 2786 return (NULL); 2787 } 2788 if (stcb->asoc.str_reset == NULL) { 2789 return (NULL); 2790 } 2791 chk = stcb->asoc.str_reset; 2792 if (chk->data == NULL) { 2793 return (NULL); 2794 } 2795 if (bchk) { 2796 /* he wants a copy of the chk pointer */ 2797 *bchk = chk; 2798 } 2799 clen = chk->send_size; 2800 req = mtod(chk->data, struct sctp_stream_reset_out_req *); 2801 r = &req->sr_req; 2802 if (ntohl(r->request_seq) == seq) { 2803 /* found it */ 2804 return (r); 2805 } 2806 len = SCTP_SIZE32(ntohs(r->ph.param_length)); 2807 if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) { 2808 /* move to the next one, there can only be a max of two */ 2809 r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len); 2810 if (ntohl(r->request_seq) == seq) { 2811 return (r); 2812 } 2813 } 2814 /* that seq is not here */ 2815 return (NULL); 2816 } 2817 2818 static void 2819 sctp_clean_up_stream_reset(struct sctp_tcb *stcb) 2820 { 2821 struct sctp_association *asoc; 2822 struct sctp_tmit_chunk *chk = stcb->asoc.str_reset; 2823 2824 if (stcb->asoc.str_reset == NULL) { 2825 return; 2826 } 2827 asoc = &stcb->asoc; 2828 2829 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25); 2830 TAILQ_REMOVE(&asoc->control_send_queue, 2831 chk, 2832 sctp_next); 2833 if (chk->data) { 2834 sctp_m_freem(chk->data); 2835 chk->data = NULL; 2836 } 2837 asoc->ctrl_queue_cnt--; 2838 sctp_free_remote_addr(chk->whoTo); 2839 2840 sctp_free_a_chunk(stcb, chk); 2841 stcb->asoc.str_reset = NULL; 2842 } 2843 2844 2845 static int 2846 sctp_handle_stream_reset_response(struct sctp_tcb *stcb, 2847 uint32_t seq, uint32_t action, 2848 struct sctp_stream_reset_response *respin) 2849 { 2850 uint16_t type; 2851 int lparm_len; 2852 struct sctp_association *asoc = &stcb->asoc; 2853 struct sctp_tmit_chunk *chk; 2854 struct sctp_stream_reset_out_request *srparam; 2855 int number_entries; 2856 2857 if (asoc->stream_reset_outstanding == 0) { 2858 /* duplicate */ 2859 return (0); 2860 } 2861 if (seq == stcb->asoc.str_reset_seq_out) { 2862 srparam = sctp_find_stream_reset(stcb, seq, &chk); 2863 if (srparam) { 2864 stcb->asoc.str_reset_seq_out++; 2865 type = ntohs(srparam->ph.param_type); 2866 lparm_len = ntohs(srparam->ph.param_length); 2867 if (type == SCTP_STR_RESET_OUT_REQUEST) { 2868 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t); 2869 asoc->stream_reset_out_is_outstanding = 0; 2870 if (asoc->stream_reset_outstanding) 2871 asoc->stream_reset_outstanding--; 2872 if (action == SCTP_STREAM_RESET_PERFORMED) { 2873 /* do it */ 2874 sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams); 2875 } else { 2876 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams); 2877 } 2878 } else if (type == SCTP_STR_RESET_IN_REQUEST) { 2879 /* Answered my request */ 2880 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t); 2881 if (asoc->stream_reset_outstanding) 2882 asoc->stream_reset_outstanding--; 2883 if (action != SCTP_STREAM_RESET_PERFORMED) { 2884 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, number_entries, srparam->list_of_streams); 2885 } 2886 } else if (type == SCTP_STR_RESET_TSN_REQUEST) { 2887 /** 2888 * a) Adopt the new in tsn. 2889 * b) reset the map 2890 * c) Adopt the new out-tsn 2891 */ 2892 struct sctp_stream_reset_response_tsn *resp; 2893 struct sctp_forward_tsn_chunk fwdtsn; 2894 int abort_flag = 0; 2895 2896 if (respin == NULL) { 2897 /* huh ? */ 2898 return (0); 2899 } 2900 if (action == SCTP_STREAM_RESET_PERFORMED) { 2901 resp = (struct sctp_stream_reset_response_tsn *)respin; 2902 asoc->stream_reset_outstanding--; 2903 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 2904 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 2905 fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1); 2906 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag); 2907 if (abort_flag) { 2908 return (1); 2909 } 2910 stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1); 2911 stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 2912 stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn); 2913 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 2914 stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn); 2915 stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn; 2916 2917 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL); 2918 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL); 2919 2920 } 2921 } 2922 /* get rid of the request and get the request flags */ 2923 if (asoc->stream_reset_outstanding == 0) { 2924 sctp_clean_up_stream_reset(stcb); 2925 } 2926 } 2927 } 2928 return (0); 2929 } 2930 2931 static void 2932 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb, 2933 struct sctp_tmit_chunk *chk, 2934 struct sctp_stream_reset_in_request *req) 2935 { 2936 uint32_t seq; 2937 int len, i; 2938 int number_entries; 2939 uint16_t temp; 2940 2941 /* 2942 * peer wants me to send a str-reset to him for my outgoing seq's if 2943 * seq_in is right. 2944 */ 2945 struct sctp_association *asoc = &stcb->asoc; 2946 2947 seq = ntohl(req->request_seq); 2948 if (asoc->str_reset_seq_in == seq) { 2949 if (stcb->asoc.stream_reset_out_is_outstanding == 0) { 2950 len = ntohs(req->ph.param_length); 2951 number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t)); 2952 for (i = 0; i < number_entries; i++) { 2953 temp = ntohs(req->list_of_streams[i]); 2954 req->list_of_streams[i] = temp; 2955 } 2956 /* move the reset action back one */ 2957 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 2958 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 2959 sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams, 2960 asoc->str_reset_seq_out, 2961 seq, (asoc->sending_seq - 1)); 2962 asoc->stream_reset_out_is_outstanding = 1; 2963 asoc->str_reset = chk; 2964 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 2965 stcb->asoc.stream_reset_outstanding++; 2966 } else { 2967 /* Can't do it, since we have sent one out */ 2968 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 2969 asoc->last_reset_action[0] = SCTP_STREAM_RESET_TRY_LATER; 2970 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 2971 } 2972 asoc->str_reset_seq_in++; 2973 } else if (asoc->str_reset_seq_in - 1 == seq) { 2974 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 2975 } else if (asoc->str_reset_seq_in - 2 == seq) { 2976 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 2977 } else { 2978 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 2979 } 2980 } 2981 2982 static int 2983 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb, 2984 struct sctp_tmit_chunk *chk, 2985 struct sctp_stream_reset_tsn_request *req) 2986 { 2987 /* reset all in and out and update the tsn */ 2988 /* 2989 * A) reset my str-seq's on in and out. B) Select a receive next, 2990 * and set cum-ack to it. Also process this selected number as a 2991 * fwd-tsn as well. C) set in the response my next sending seq. 2992 */ 2993 struct sctp_forward_tsn_chunk fwdtsn; 2994 struct sctp_association *asoc = &stcb->asoc; 2995 int abort_flag = 0; 2996 uint32_t seq; 2997 2998 seq = ntohl(req->request_seq); 2999 if (asoc->str_reset_seq_in == seq) { 3000 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 3001 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 3002 fwdtsn.ch.chunk_flags = 0; 3003 fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1); 3004 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag); 3005 if (abort_flag) { 3006 return (1); 3007 } 3008 stcb->asoc.highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA; 3009 stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 3010 stcb->asoc.mapping_array_base_tsn = stcb->asoc.highest_tsn_inside_map + 1; 3011 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 3012 atomic_add_int(&stcb->asoc.sending_seq, 1); 3013 /* save off historical data for retrans */ 3014 stcb->asoc.last_sending_seq[1] = stcb->asoc.last_sending_seq[0]; 3015 stcb->asoc.last_sending_seq[0] = stcb->asoc.sending_seq; 3016 stcb->asoc.last_base_tsnsent[1] = stcb->asoc.last_base_tsnsent[0]; 3017 stcb->asoc.last_base_tsnsent[0] = stcb->asoc.mapping_array_base_tsn; 3018 3019 sctp_add_stream_reset_result_tsn(chk, 3020 ntohl(req->request_seq), 3021 SCTP_STREAM_RESET_PERFORMED, 3022 stcb->asoc.sending_seq, 3023 stcb->asoc.mapping_array_base_tsn); 3024 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL); 3025 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL); 3026 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0]; 3027 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3028 3029 asoc->str_reset_seq_in++; 3030 } else if (asoc->str_reset_seq_in - 1 == seq) { 3031 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0], 3032 stcb->asoc.last_sending_seq[0], 3033 stcb->asoc.last_base_tsnsent[0] 3034 ); 3035 } else if (asoc->str_reset_seq_in - 2 == seq) { 3036 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1], 3037 stcb->asoc.last_sending_seq[1], 3038 stcb->asoc.last_base_tsnsent[1] 3039 ); 3040 } else { 3041 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 3042 } 3043 return (0); 3044 } 3045 3046 static void 3047 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb, 3048 struct sctp_tmit_chunk *chk, 3049 struct sctp_stream_reset_out_request *req) 3050 { 3051 uint32_t seq, tsn; 3052 int number_entries, len; 3053 struct sctp_association *asoc = &stcb->asoc; 3054 3055 seq = ntohl(req->request_seq); 3056 3057 /* now if its not a duplicate we process it */ 3058 if (asoc->str_reset_seq_in == seq) { 3059 len = ntohs(req->ph.param_length); 3060 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t)); 3061 /* 3062 * the sender is resetting, handle the list issue.. we must 3063 * a) verify if we can do the reset, if so no problem b) If 3064 * we can't do the reset we must copy the request. c) queue 3065 * it, and setup the data in processor to trigger it off 3066 * when needed and dequeue all the queued data. 3067 */ 3068 tsn = ntohl(req->send_reset_at_tsn); 3069 3070 /* move the reset action back one */ 3071 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 3072 if ((tsn == asoc->cumulative_tsn) || 3073 (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN))) { 3074 /* we can do it now */ 3075 sctp_reset_in_stream(stcb, number_entries, req->list_of_streams); 3076 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED); 3077 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3078 } else { 3079 /* 3080 * we must queue it up and thus wait for the TSN's 3081 * to arrive that are at or before tsn 3082 */ 3083 struct sctp_stream_reset_list *liste; 3084 int siz; 3085 3086 siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t)); 3087 SCTP_MALLOC(liste, struct sctp_stream_reset_list *, 3088 siz, "StrRstList"); 3089 if (liste == NULL) { 3090 /* gak out of memory */ 3091 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED); 3092 asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED; 3093 return; 3094 } 3095 liste->tsn = tsn; 3096 liste->number_entries = number_entries; 3097 memcpy(&liste->req, req, 3098 (sizeof(struct sctp_stream_reset_out_request) + (number_entries * sizeof(uint16_t)))); 3099 TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp); 3100 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED); 3101 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3102 } 3103 asoc->str_reset_seq_in++; 3104 } else if ((asoc->str_reset_seq_in - 1) == seq) { 3105 /* 3106 * one seq back, just echo back last action since my 3107 * response was lost. 3108 */ 3109 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3110 } else if ((asoc->str_reset_seq_in - 2) == seq) { 3111 /* 3112 * two seq back, just echo back last action since my 3113 * response was lost. 3114 */ 3115 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 3116 } else { 3117 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 3118 } 3119 } 3120 3121 static int 3122 sctp_handle_stream_reset(struct sctp_tcb *stcb, struct sctp_stream_reset_out_req *sr_req) 3123 { 3124 int chk_length, param_len, ptype; 3125 uint32_t seq; 3126 int num_req = 0; 3127 struct sctp_tmit_chunk *chk; 3128 struct sctp_chunkhdr *ch; 3129 struct sctp_paramhdr *ph; 3130 int ret_code = 0; 3131 int num_param = 0; 3132 3133 /* now it may be a reset or a reset-response */ 3134 chk_length = ntohs(sr_req->ch.chunk_length); 3135 3136 /* setup for adding the response */ 3137 sctp_alloc_a_chunk(stcb, chk); 3138 if (chk == NULL) { 3139 return (ret_code); 3140 } 3141 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 3142 chk->asoc = &stcb->asoc; 3143 chk->no_fr_allowed = 0; 3144 chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr); 3145 chk->book_size_scale = 0; 3146 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 3147 if (chk->data == NULL) { 3148 strres_nochunk: 3149 if (chk->data) { 3150 sctp_m_freem(chk->data); 3151 chk->data = NULL; 3152 } 3153 sctp_free_a_chunk(stcb, chk); 3154 return (ret_code); 3155 } 3156 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 3157 3158 /* setup chunk parameters */ 3159 chk->sent = SCTP_DATAGRAM_UNSENT; 3160 chk->snd_count = 0; 3161 chk->whoTo = stcb->asoc.primary_destination; 3162 atomic_add_int(&chk->whoTo->ref_count, 1); 3163 3164 ch = mtod(chk->data, struct sctp_chunkhdr *); 3165 ch->chunk_type = SCTP_STREAM_RESET; 3166 ch->chunk_flags = 0; 3167 ch->chunk_length = htons(chk->send_size); 3168 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 3169 3170 ph = (struct sctp_paramhdr *)&sr_req->sr_req; 3171 while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) { 3172 param_len = ntohs(ph->param_length); 3173 if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) { 3174 /* bad param */ 3175 break; 3176 } 3177 ptype = ntohs(ph->param_type); 3178 num_param++; 3179 if (num_param > SCTP_MAX_RESET_PARAMS) { 3180 /* hit the max of parameters already sorry.. */ 3181 break; 3182 } 3183 if (ptype == SCTP_STR_RESET_OUT_REQUEST) { 3184 struct sctp_stream_reset_out_request *req_out; 3185 3186 req_out = (struct sctp_stream_reset_out_request *)ph; 3187 num_req++; 3188 if (stcb->asoc.stream_reset_outstanding) { 3189 seq = ntohl(req_out->response_seq); 3190 if (seq == stcb->asoc.str_reset_seq_out) { 3191 /* implicit ack */ 3192 sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_PERFORMED, NULL); 3193 } 3194 } 3195 sctp_handle_str_reset_request_out(stcb, chk, req_out); 3196 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) { 3197 struct sctp_stream_reset_in_request *req_in; 3198 3199 num_req++; 3200 req_in = (struct sctp_stream_reset_in_request *)ph; 3201 sctp_handle_str_reset_request_in(stcb, chk, req_in); 3202 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) { 3203 struct sctp_stream_reset_tsn_request *req_tsn; 3204 3205 num_req++; 3206 req_tsn = (struct sctp_stream_reset_tsn_request *)ph; 3207 if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) { 3208 ret_code = 1; 3209 goto strres_nochunk; 3210 } 3211 /* no more */ 3212 break; 3213 } else if (ptype == SCTP_STR_RESET_RESPONSE) { 3214 struct sctp_stream_reset_response *resp; 3215 uint32_t result; 3216 3217 resp = (struct sctp_stream_reset_response *)ph; 3218 seq = ntohl(resp->response_seq); 3219 result = ntohl(resp->result); 3220 if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) { 3221 ret_code = 1; 3222 goto strres_nochunk; 3223 } 3224 } else { 3225 break; 3226 } 3227 3228 ph = (struct sctp_paramhdr *)((caddr_t)ph + SCTP_SIZE32(param_len)); 3229 chk_length -= SCTP_SIZE32(param_len); 3230 } 3231 if (num_req == 0) { 3232 /* we have no response free the stuff */ 3233 goto strres_nochunk; 3234 } 3235 /* ok we have a chunk to link in */ 3236 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, 3237 chk, 3238 sctp_next); 3239 stcb->asoc.ctrl_queue_cnt++; 3240 return (ret_code); 3241 } 3242 3243 /* 3244 * Handle a router or endpoints report of a packet loss, there are two ways 3245 * to handle this, either we get the whole packet and must disect it 3246 * ourselves (possibly with truncation and or corruption) or it is a summary 3247 * from a middle box that did the disectting for us. 3248 */ 3249 static void 3250 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp, 3251 struct sctp_tcb *stcb, struct sctp_nets *net) 3252 { 3253 uint32_t bottle_bw, on_queue; 3254 uint16_t trunc_len; 3255 unsigned int chlen; 3256 unsigned int at; 3257 struct sctp_chunk_desc desc; 3258 struct sctp_chunkhdr *ch; 3259 3260 chlen = ntohs(cp->ch.chunk_length); 3261 chlen -= sizeof(struct sctp_pktdrop_chunk); 3262 /* XXX possible chlen underflow */ 3263 if (chlen == 0) { 3264 ch = NULL; 3265 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) 3266 SCTP_STAT_INCR(sctps_pdrpbwrpt); 3267 } else { 3268 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr)); 3269 chlen -= sizeof(struct sctphdr); 3270 /* XXX possible chlen underflow */ 3271 memset(&desc, 0, sizeof(desc)); 3272 } 3273 trunc_len = (uint16_t) ntohs(cp->trunc_len); 3274 /* now the chunks themselves */ 3275 while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) { 3276 desc.chunk_type = ch->chunk_type; 3277 /* get amount we need to move */ 3278 at = ntohs(ch->chunk_length); 3279 if (at < sizeof(struct sctp_chunkhdr)) { 3280 /* corrupt chunk, maybe at the end? */ 3281 SCTP_STAT_INCR(sctps_pdrpcrupt); 3282 break; 3283 } 3284 if (trunc_len == 0) { 3285 /* we are supposed to have all of it */ 3286 if (at > chlen) { 3287 /* corrupt skip it */ 3288 SCTP_STAT_INCR(sctps_pdrpcrupt); 3289 break; 3290 } 3291 } else { 3292 /* is there enough of it left ? */ 3293 if (desc.chunk_type == SCTP_DATA) { 3294 if (chlen < (sizeof(struct sctp_data_chunk) + 3295 sizeof(desc.data_bytes))) { 3296 break; 3297 } 3298 } else { 3299 if (chlen < sizeof(struct sctp_chunkhdr)) { 3300 break; 3301 } 3302 } 3303 } 3304 if (desc.chunk_type == SCTP_DATA) { 3305 /* can we get out the tsn? */ 3306 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 3307 SCTP_STAT_INCR(sctps_pdrpmbda); 3308 3309 if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) { 3310 /* yep */ 3311 struct sctp_data_chunk *dcp; 3312 uint8_t *ddp; 3313 unsigned int iii; 3314 3315 dcp = (struct sctp_data_chunk *)ch; 3316 ddp = (uint8_t *) (dcp + 1); 3317 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) { 3318 desc.data_bytes[iii] = ddp[iii]; 3319 } 3320 desc.tsn_ifany = dcp->dp.tsn; 3321 } else { 3322 /* nope we are done. */ 3323 SCTP_STAT_INCR(sctps_pdrpnedat); 3324 break; 3325 } 3326 } else { 3327 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 3328 SCTP_STAT_INCR(sctps_pdrpmbct); 3329 } 3330 3331 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) { 3332 SCTP_STAT_INCR(sctps_pdrppdbrk); 3333 break; 3334 } 3335 if (SCTP_SIZE32(at) > chlen) { 3336 break; 3337 } 3338 chlen -= SCTP_SIZE32(at); 3339 if (chlen < sizeof(struct sctp_chunkhdr)) { 3340 /* done, none left */ 3341 break; 3342 } 3343 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at)); 3344 } 3345 /* Now update any rwnd --- possibly */ 3346 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) { 3347 /* From a peer, we get a rwnd report */ 3348 uint32_t a_rwnd; 3349 3350 SCTP_STAT_INCR(sctps_pdrpfehos); 3351 3352 bottle_bw = ntohl(cp->bottle_bw); 3353 on_queue = ntohl(cp->current_onq); 3354 if (bottle_bw && on_queue) { 3355 /* a rwnd report is in here */ 3356 if (bottle_bw > on_queue) 3357 a_rwnd = bottle_bw - on_queue; 3358 else 3359 a_rwnd = 0; 3360 3361 if (a_rwnd == 0) 3362 stcb->asoc.peers_rwnd = 0; 3363 else { 3364 if (a_rwnd > stcb->asoc.total_flight) { 3365 stcb->asoc.peers_rwnd = 3366 a_rwnd - stcb->asoc.total_flight; 3367 } else { 3368 stcb->asoc.peers_rwnd = 0; 3369 } 3370 if (stcb->asoc.peers_rwnd < 3371 stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 3372 /* SWS sender side engages */ 3373 stcb->asoc.peers_rwnd = 0; 3374 } 3375 } 3376 } 3377 } else { 3378 SCTP_STAT_INCR(sctps_pdrpfmbox); 3379 } 3380 3381 /* now middle boxes in sat networks get a cwnd bump */ 3382 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) && 3383 (stcb->asoc.sat_t3_loss_recovery == 0) && 3384 (stcb->asoc.sat_network)) { 3385 /* 3386 * This is debateable but for sat networks it makes sense 3387 * Note if a T3 timer has went off, we will prohibit any 3388 * changes to cwnd until we exit the t3 loss recovery. 3389 */ 3390 uint32_t bw_avail; 3391 int rtt, incr; 3392 3393 #ifdef SCTP_CWND_MONITOR 3394 int old_cwnd = net->cwnd; 3395 3396 #endif 3397 /* need real RTT for this calc */ 3398 rtt = ((net->lastsa >> 2) + net->lastsv) >> 1; 3399 /* get bottle neck bw */ 3400 bottle_bw = ntohl(cp->bottle_bw); 3401 /* and whats on queue */ 3402 on_queue = ntohl(cp->current_onq); 3403 /* 3404 * adjust the on-queue if our flight is more it could be 3405 * that the router has not yet gotten data "in-flight" to it 3406 */ 3407 if (on_queue < net->flight_size) 3408 on_queue = net->flight_size; 3409 3410 /* calculate the available space */ 3411 bw_avail = (bottle_bw * rtt) / 1000; 3412 if (bw_avail > bottle_bw) { 3413 /* 3414 * Cap the growth to no more than the bottle neck. 3415 * This can happen as RTT slides up due to queues. 3416 * It also means if you have more than a 1 second 3417 * RTT with a empty queue you will be limited to the 3418 * bottle_bw per second no matter if other points 3419 * have 1/2 the RTT and you could get more out... 3420 */ 3421 bw_avail = bottle_bw; 3422 } 3423 if (on_queue > bw_avail) { 3424 /* 3425 * No room for anything else don't allow anything 3426 * else to be "added to the fire". 3427 */ 3428 int seg_inflight, seg_onqueue, my_portion; 3429 3430 net->partial_bytes_acked = 0; 3431 3432 /* how much are we over queue size? */ 3433 incr = on_queue - bw_avail; 3434 if (stcb->asoc.seen_a_sack_this_pkt) { 3435 /* 3436 * undo any cwnd adjustment that the sack 3437 * might have made 3438 */ 3439 net->cwnd = net->prev_cwnd; 3440 } 3441 /* Now how much of that is mine? */ 3442 seg_inflight = net->flight_size / net->mtu; 3443 seg_onqueue = on_queue / net->mtu; 3444 my_portion = (incr * seg_inflight) / seg_onqueue; 3445 3446 /* Have I made an adjustment already */ 3447 if (net->cwnd > net->flight_size) { 3448 /* 3449 * for this flight I made an adjustment we 3450 * need to decrease the portion by a share 3451 * our previous adjustment. 3452 */ 3453 int diff_adj; 3454 3455 diff_adj = net->cwnd - net->flight_size; 3456 if (diff_adj > my_portion) 3457 my_portion = 0; 3458 else 3459 my_portion -= diff_adj; 3460 } 3461 /* 3462 * back down to the previous cwnd (assume we have 3463 * had a sack before this packet). minus what ever 3464 * portion of the overage is my fault. 3465 */ 3466 net->cwnd -= my_portion; 3467 3468 /* we will NOT back down more than 1 MTU */ 3469 if (net->cwnd <= net->mtu) { 3470 net->cwnd = net->mtu; 3471 } 3472 /* force into CA */ 3473 net->ssthresh = net->cwnd - 1; 3474 } else { 3475 /* 3476 * Take 1/4 of the space left or max burst up .. 3477 * whichever is less. 3478 */ 3479 incr = min((bw_avail - on_queue) >> 2, 3480 (int)stcb->asoc.max_burst * (int)net->mtu); 3481 net->cwnd += incr; 3482 } 3483 if (net->cwnd > bw_avail) { 3484 /* We can't exceed the pipe size */ 3485 net->cwnd = bw_avail; 3486 } 3487 if (net->cwnd < net->mtu) { 3488 /* We always have 1 MTU */ 3489 net->cwnd = net->mtu; 3490 } 3491 #ifdef SCTP_CWND_MONITOR 3492 if (net->cwnd - old_cwnd != 0) { 3493 /* log only changes */ 3494 sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), 3495 SCTP_CWND_LOG_FROM_SAT); 3496 } 3497 #endif 3498 } 3499 } 3500 3501 extern int sctp_strict_init; 3502 extern int sctp_abort_if_one_2_one_hits_limit; 3503 3504 /* 3505 * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to 3506 * still contain IP/SCTP header - stcb: is the tcb found for this packet - 3507 * offset: offset into the mbuf chain to first chunkhdr - length: is the 3508 * length of the complete packet outputs: - length: modified to remaining 3509 * length after control processing - netp: modified to new sctp_nets after 3510 * cookie-echo processing - return NULL to discard the packet (ie. no asoc, 3511 * bad packet,...) otherwise return the tcb for this packet 3512 */ 3513 static struct sctp_tcb * 3514 sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length, 3515 struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp, 3516 struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen) 3517 { 3518 struct sctp_association *asoc; 3519 uint32_t vtag_in; 3520 int num_chunks = 0; /* number of control chunks processed */ 3521 int chk_length; 3522 int ret; 3523 3524 /* 3525 * How big should this be, and should it be alloc'd? Lets try the 3526 * d-mtu-ceiling for now (2k) and that should hopefully work ... 3527 * until we get into jumbo grams and such.. 3528 */ 3529 uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE]; 3530 struct sctp_tcb *locked_tcb = stcb; 3531 int got_auth = 0; 3532 uint32_t auth_offset = 0, auth_len = 0; 3533 int auth_skipped = 0; 3534 3535 #ifdef SCTP_DEBUG 3536 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 3537 printf("sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n", 3538 iphlen, *offset, length, stcb); 3539 } 3540 #endif /* SCTP_DEBUG */ 3541 3542 /* validate chunk header length... */ 3543 if (ntohs(ch->chunk_length) < sizeof(*ch)) { 3544 return (NULL); 3545 } 3546 /* 3547 * validate the verification tag 3548 */ 3549 vtag_in = ntohl(sh->v_tag); 3550 3551 if (locked_tcb) { 3552 SCTP_TCB_LOCK_ASSERT(locked_tcb); 3553 } 3554 if (ch->chunk_type == SCTP_INITIATION) { 3555 if (vtag_in != 0) { 3556 /* protocol error- silently discard... */ 3557 SCTP_STAT_INCR(sctps_badvtag); 3558 if (locked_tcb) 3559 SCTP_TCB_UNLOCK(locked_tcb); 3560 return (NULL); 3561 } 3562 } else if (ch->chunk_type != SCTP_COOKIE_ECHO) { 3563 /* 3564 * If there is no stcb, skip the AUTH chunk and process 3565 * later after a stcb is found (to validate the lookup was 3566 * valid. 3567 */ 3568 if ((ch->chunk_type == SCTP_AUTHENTICATION) && 3569 (stcb == NULL) && !sctp_auth_disable) { 3570 /* save this chunk for later processing */ 3571 auth_skipped = 1; 3572 auth_offset = *offset; 3573 auth_len = ntohs(ch->chunk_length); 3574 3575 /* (temporarily) move past this chunk */ 3576 *offset += SCTP_SIZE32(auth_len); 3577 if (*offset >= length) { 3578 /* no more data left in the mbuf chain */ 3579 *offset = length; 3580 return (NULL); 3581 } 3582 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3583 sizeof(struct sctp_chunkhdr), chunk_buf); 3584 } 3585 if (ch->chunk_type == SCTP_COOKIE_ECHO) { 3586 goto process_control_chunks; 3587 } 3588 /* 3589 * first check if it's an ASCONF with an unknown src addr we 3590 * need to look inside to find the association 3591 */ 3592 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) { 3593 /* inp's refcount may be reduced */ 3594 SCTP_INP_INCR_REF(inp); 3595 3596 stcb = sctp_findassociation_ep_asconf(m, iphlen, 3597 *offset, sh, &inp, netp); 3598 if (stcb == NULL) { 3599 /* 3600 * reduce inp's refcount if not reduced in 3601 * sctp_findassociation_ep_asconf(). 3602 */ 3603 SCTP_INP_DECR_REF(inp); 3604 } 3605 /* now go back and verify any auth chunk to be sure */ 3606 if (auth_skipped && (stcb != NULL)) { 3607 struct sctp_auth_chunk *auth; 3608 3609 auth = (struct sctp_auth_chunk *) 3610 sctp_m_getptr(m, auth_offset, 3611 auth_len, chunk_buf); 3612 got_auth = 1; 3613 auth_skipped = 0; 3614 if (sctp_handle_auth(stcb, auth, m, 3615 auth_offset)) { 3616 /* auth HMAC failed so dump it */ 3617 *offset = length; 3618 return (NULL); 3619 } else { 3620 /* remaining chunks are HMAC checked */ 3621 stcb->asoc.authenticated = 1; 3622 } 3623 } 3624 } 3625 if (stcb == NULL) { 3626 /* no association, so it's out of the blue... */ 3627 sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL); 3628 *offset = length; 3629 if (locked_tcb) 3630 SCTP_TCB_UNLOCK(locked_tcb); 3631 return (NULL); 3632 } 3633 asoc = &stcb->asoc; 3634 /* ABORT and SHUTDOWN can use either v_tag... */ 3635 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) || 3636 (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) || 3637 (ch->chunk_type == SCTP_PACKET_DROPPED)) { 3638 if ((vtag_in == asoc->my_vtag) || 3639 ((ch->chunk_flags & SCTP_HAD_NO_TCB) && 3640 (vtag_in == asoc->peer_vtag))) { 3641 /* this is valid */ 3642 } else { 3643 /* drop this packet... */ 3644 SCTP_STAT_INCR(sctps_badvtag); 3645 if (locked_tcb) 3646 SCTP_TCB_UNLOCK(locked_tcb); 3647 return (NULL); 3648 } 3649 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 3650 if (vtag_in != asoc->my_vtag) { 3651 /* 3652 * this could be a stale SHUTDOWN-ACK or the 3653 * peer never got the SHUTDOWN-COMPLETE and 3654 * is still hung; we have started a new asoc 3655 * but it won't complete until the shutdown 3656 * is completed 3657 */ 3658 if (locked_tcb) 3659 SCTP_TCB_UNLOCK(locked_tcb); 3660 sctp_handle_ootb(m, iphlen, *offset, sh, inp, 3661 NULL); 3662 return (NULL); 3663 } 3664 } else { 3665 /* for all other chunks, vtag must match */ 3666 if (vtag_in != asoc->my_vtag) { 3667 /* invalid vtag... */ 3668 #ifdef SCTP_DEBUG 3669 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3670 printf("invalid vtag: %xh, expect %xh\n", vtag_in, asoc->my_vtag); 3671 } 3672 #endif /* SCTP_DEBUG */ 3673 SCTP_STAT_INCR(sctps_badvtag); 3674 if (locked_tcb) 3675 SCTP_TCB_UNLOCK(locked_tcb); 3676 *offset = length; 3677 return (NULL); 3678 } 3679 } 3680 } /* end if !SCTP_COOKIE_ECHO */ 3681 /* 3682 * process all control chunks... 3683 */ 3684 if (((ch->chunk_type == SCTP_SELECTIVE_ACK) || 3685 (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) && 3686 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 3687 /* implied cookie-ack.. we must have lost the ack */ 3688 stcb->asoc.overall_error_count = 0; 3689 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, 3690 *netp); 3691 } 3692 process_control_chunks: 3693 3694 while (IS_SCTP_CONTROL(ch)) { 3695 /* validate chunk length */ 3696 chk_length = ntohs(ch->chunk_length); 3697 #ifdef SCTP_DEBUG 3698 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 3699 printf("sctp_process_control: processing a chunk type=%u, len=%u\n", 3700 ch->chunk_type, chk_length); 3701 } 3702 #endif /* SCTP_DEBUG */ 3703 if ((size_t)chk_length < sizeof(*ch) || 3704 (*offset + chk_length) > length) { 3705 *offset = length; 3706 if (locked_tcb) 3707 SCTP_TCB_UNLOCK(locked_tcb); 3708 return (NULL); 3709 } 3710 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks); 3711 /* 3712 * INIT-ACK only gets the init ack "header" portion only 3713 * because we don't have to process the peer's COOKIE. All 3714 * others get a complete chunk. 3715 */ 3716 if (ch->chunk_type == SCTP_INITIATION_ACK) { 3717 /* get an init-ack chunk */ 3718 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3719 sizeof(struct sctp_init_ack_chunk), chunk_buf); 3720 if (ch == NULL) { 3721 *offset = length; 3722 if (locked_tcb) 3723 SCTP_TCB_UNLOCK(locked_tcb); 3724 return (NULL); 3725 } 3726 } else { 3727 /* get a complete chunk... */ 3728 if ((size_t)chk_length > sizeof(chunk_buf)) { 3729 struct mbuf *oper; 3730 struct sctp_paramhdr *phdr; 3731 3732 oper = NULL; 3733 oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 3734 0, M_DONTWAIT, 1, MT_DATA); 3735 if (oper) { 3736 /* pre-reserve some space */ 3737 SCTP_BUF_RESV_UF(oper, sizeof(struct sctp_chunkhdr)); 3738 SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr); 3739 phdr = mtod(oper, struct sctp_paramhdr *); 3740 phdr->param_type = htons(SCTP_CAUSE_OUT_OF_RESC); 3741 phdr->param_length = htons(sizeof(struct sctp_paramhdr)); 3742 sctp_queue_op_err(stcb, oper); 3743 } 3744 if (locked_tcb) 3745 SCTP_TCB_UNLOCK(locked_tcb); 3746 return (NULL); 3747 } 3748 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3749 chk_length, chunk_buf); 3750 if (ch == NULL) { 3751 printf("sctp_process_control: Can't get the all data....\n"); 3752 *offset = length; 3753 if (locked_tcb) 3754 SCTP_TCB_UNLOCK(locked_tcb); 3755 return (NULL); 3756 } 3757 } 3758 num_chunks++; 3759 /* Save off the last place we got a control from */ 3760 if (stcb != NULL) { 3761 if ((*netp != NULL) || (ch->chunk_type == SCTP_ASCONF)) { 3762 /* 3763 * allow last_control to be NULL if 3764 * ASCONF... ASCONF processing will find the 3765 * right net later 3766 */ 3767 stcb->asoc.last_control_chunk_from = *netp; 3768 } 3769 } 3770 #ifdef SCTP_AUDITING_ENABLED 3771 sctp_audit_log(0xB0, ch->chunk_type); 3772 #endif 3773 3774 /* check to see if this chunk required auth, but isn't */ 3775 if ((stcb != NULL) && !sctp_auth_disable && 3776 sctp_auth_is_required_chunk(ch->chunk_type, 3777 stcb->asoc.local_auth_chunks) && 3778 !stcb->asoc.authenticated) { 3779 /* "silently" ignore */ 3780 SCTP_STAT_INCR(sctps_recvauthmissing); 3781 goto next_chunk; 3782 } 3783 switch (ch->chunk_type) { 3784 case SCTP_INITIATION: 3785 /* must be first and only chunk */ 3786 #ifdef SCTP_DEBUG 3787 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3788 printf("SCTP_INIT\n"); 3789 } 3790 #endif /* SCTP_DEBUG */ 3791 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3792 /* We are not interested anymore? */ 3793 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3794 /* 3795 * collision case where we are 3796 * sending to them too 3797 */ 3798 ; 3799 } else { 3800 if (locked_tcb) 3801 SCTP_TCB_UNLOCK(locked_tcb); 3802 *offset = length; 3803 return (NULL); 3804 } 3805 } 3806 if ((num_chunks > 1) || 3807 (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3808 *offset = length; 3809 if (locked_tcb) 3810 SCTP_TCB_UNLOCK(locked_tcb); 3811 return (NULL); 3812 } 3813 if ((stcb != NULL) && 3814 (SCTP_GET_STATE(&stcb->asoc) == 3815 SCTP_STATE_SHUTDOWN_ACK_SENT)) { 3816 sctp_send_shutdown_ack(stcb, 3817 stcb->asoc.primary_destination); 3818 *offset = length; 3819 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 3820 if (locked_tcb) 3821 SCTP_TCB_UNLOCK(locked_tcb); 3822 return (NULL); 3823 } 3824 sctp_handle_init(m, iphlen, *offset, sh, 3825 (struct sctp_init_chunk *)ch, inp, stcb, *netp); 3826 *offset = length; 3827 if (locked_tcb) 3828 SCTP_TCB_UNLOCK(locked_tcb); 3829 return (NULL); 3830 break; 3831 case SCTP_INITIATION_ACK: 3832 /* must be first and only chunk */ 3833 #ifdef SCTP_DEBUG 3834 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3835 printf("SCTP_INIT-ACK\n"); 3836 } 3837 #endif /* SCTP_DEBUG */ 3838 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3839 /* We are not interested anymore */ 3840 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3841 ; 3842 } else { 3843 if (locked_tcb) 3844 SCTP_TCB_UNLOCK(locked_tcb); 3845 *offset = length; 3846 if (stcb) { 3847 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26); 3848 } 3849 return (NULL); 3850 } 3851 } 3852 if ((num_chunks > 1) || 3853 (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3854 *offset = length; 3855 if (locked_tcb) 3856 SCTP_TCB_UNLOCK(locked_tcb); 3857 return (NULL); 3858 } 3859 ret = sctp_handle_init_ack(m, iphlen, *offset, sh, 3860 (struct sctp_init_ack_chunk *)ch, stcb, *netp); 3861 /* 3862 * Special case, I must call the output routine to 3863 * get the cookie echoed 3864 */ 3865 if ((stcb) && ret == 0) 3866 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 3867 *offset = length; 3868 if (locked_tcb) 3869 SCTP_TCB_UNLOCK(locked_tcb); 3870 return (NULL); 3871 break; 3872 case SCTP_SELECTIVE_ACK: 3873 #ifdef SCTP_DEBUG 3874 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3875 printf("SCTP_SACK\n"); 3876 } 3877 #endif /* SCTP_DEBUG */ 3878 SCTP_STAT_INCR(sctps_recvsacks); 3879 { 3880 struct sctp_sack_chunk *sack; 3881 int abort_now = 0; 3882 uint32_t a_rwnd, cum_ack; 3883 uint16_t num_seg; 3884 int nonce_sum_flag; 3885 3886 sack = (struct sctp_sack_chunk *)ch; 3887 3888 nonce_sum_flag = ch->chunk_flags & SCTP_SACK_NONCE_SUM; 3889 cum_ack = ntohl(sack->sack.cum_tsn_ack); 3890 num_seg = ntohs(sack->sack.num_gap_ack_blks); 3891 a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd); 3892 stcb->asoc.seen_a_sack_this_pkt = 1; 3893 if ((stcb->asoc.pr_sctp_cnt == 0) && 3894 (num_seg == 0) && 3895 ((compare_with_wrap(cum_ack, stcb->asoc.last_acked_seq, MAX_TSN)) || 3896 (cum_ack == stcb->asoc.last_acked_seq)) && 3897 (stcb->asoc.saw_sack_with_frags == 0) && 3898 (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) 3899 ) { 3900 /* 3901 * We have a SIMPLE sack having no 3902 * prior segments and data on sent 3903 * queue to be acked.. Use the 3904 * faster path sack processing. We 3905 * also allow window update sacks 3906 * with no missing segments to go 3907 * this way too. 3908 */ 3909 sctp_express_handle_sack(stcb, cum_ack, a_rwnd, nonce_sum_flag, &abort_now); 3910 } else { 3911 sctp_handle_sack(sack, stcb, *netp, &abort_now); 3912 } 3913 if (abort_now) { 3914 /* ABORT signal from sack processing */ 3915 *offset = length; 3916 return (NULL); 3917 } 3918 } 3919 break; 3920 case SCTP_HEARTBEAT_REQUEST: 3921 #ifdef SCTP_DEBUG 3922 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3923 printf("SCTP_HEARTBEAT\n"); 3924 } 3925 #endif /* SCTP_DEBUG */ 3926 SCTP_STAT_INCR(sctps_recvheartbeat); 3927 sctp_send_heartbeat_ack(stcb, m, *offset, chk_length, 3928 *netp); 3929 3930 /* He's alive so give him credit */ 3931 stcb->asoc.overall_error_count = 0; 3932 break; 3933 case SCTP_HEARTBEAT_ACK: 3934 #ifdef SCTP_DEBUG 3935 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3936 printf("SCTP_HEARTBEAT-ACK\n"); 3937 } 3938 #endif /* SCTP_DEBUG */ 3939 3940 /* He's alive so give him credit */ 3941 stcb->asoc.overall_error_count = 0; 3942 SCTP_STAT_INCR(sctps_recvheartbeatack); 3943 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch, 3944 stcb, *netp); 3945 break; 3946 case SCTP_ABORT_ASSOCIATION: 3947 #ifdef SCTP_DEBUG 3948 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3949 printf("SCTP_ABORT\n"); 3950 } 3951 #endif /* SCTP_DEBUG */ 3952 sctp_handle_abort((struct sctp_abort_chunk *)ch, 3953 stcb, *netp); 3954 *offset = length; 3955 return (NULL); 3956 break; 3957 case SCTP_SHUTDOWN: 3958 #ifdef SCTP_DEBUG 3959 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3960 printf("SCTP_SHUTDOWN\n"); 3961 } 3962 #endif /* SCTP_DEBUG */ 3963 { 3964 int abort_flag = 0; 3965 3966 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch, 3967 stcb, *netp, &abort_flag); 3968 if (abort_flag) { 3969 *offset = length; 3970 return (NULL); 3971 } 3972 } 3973 break; 3974 case SCTP_SHUTDOWN_ACK: 3975 #ifdef SCTP_DEBUG 3976 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3977 printf("SCTP_SHUTDOWN-ACK\n"); 3978 } 3979 #endif /* SCTP_DEBUG */ 3980 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp); 3981 *offset = length; 3982 return (NULL); 3983 break; 3984 case SCTP_OPERATION_ERROR: 3985 #ifdef SCTP_DEBUG 3986 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3987 printf("SCTP_OP-ERR\n"); 3988 } 3989 #endif /* SCTP_DEBUG */ 3990 if (sctp_handle_error(ch, stcb, *netp) < 0) { 3991 *offset = length; 3992 return (NULL); 3993 } 3994 break; 3995 case SCTP_COOKIE_ECHO: 3996 #ifdef SCTP_DEBUG 3997 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3998 printf("SCTP_COOKIE-ECHO stcb is %p\n", stcb); 3999 } 4000 #endif /* SCTP_DEBUG */ 4001 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 4002 ; 4003 } else { 4004 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) && 4005 (stcb == NULL)) { 4006 /* We are not interested anymore */ 4007 *offset = length; 4008 return (NULL); 4009 } 4010 } 4011 /* 4012 * First are we accepting? We do this again here 4013 * since it is possible that a previous endpoint WAS 4014 * listening responded to a INIT-ACK and then 4015 * closed. We opened and bound.. and are now no 4016 * longer listening. 4017 */ 4018 if (inp->sctp_socket->so_qlimit == 0) { 4019 if ((stcb) && (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 4020 /* 4021 * special case, is this a retran'd 4022 * COOKIE-ECHO or a restarting assoc 4023 * that is a peeled off or 4024 * one-to-one style socket. 4025 */ 4026 goto process_cookie_anyway; 4027 } 4028 sctp_abort_association(inp, stcb, m, iphlen, sh, 4029 NULL); 4030 *offset = length; 4031 return (NULL); 4032 } else if (inp->sctp_socket->so_qlimit) { 4033 /* we are accepting so check limits like TCP */ 4034 if (inp->sctp_socket->so_qlen > 4035 inp->sctp_socket->so_qlimit) { 4036 /* no space */ 4037 struct mbuf *oper; 4038 struct sctp_paramhdr *phdr; 4039 4040 if (sctp_abort_if_one_2_one_hits_limit) { 4041 oper = NULL; 4042 oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 4043 0, M_DONTWAIT, 1, MT_DATA); 4044 if (oper) { 4045 SCTP_BUF_LEN(oper) = 4046 sizeof(struct sctp_paramhdr); 4047 phdr = mtod(oper, 4048 struct sctp_paramhdr *); 4049 phdr->param_type = 4050 htons(SCTP_CAUSE_OUT_OF_RESC); 4051 phdr->param_length = 4052 htons(sizeof(struct sctp_paramhdr)); 4053 } 4054 sctp_abort_association(inp, stcb, m, 4055 iphlen, sh, oper); 4056 } 4057 *offset = length; 4058 return (NULL); 4059 } 4060 } 4061 process_cookie_anyway: 4062 { 4063 struct mbuf *ret_buf; 4064 struct sctp_inpcb *linp; 4065 4066 if (stcb) 4067 linp = NULL; 4068 else 4069 linp = inp; 4070 4071 if (linp) 4072 SCTP_ASOC_CREATE_LOCK(linp); 4073 ret_buf = 4074 sctp_handle_cookie_echo(m, iphlen, 4075 *offset, sh, 4076 (struct sctp_cookie_echo_chunk *)ch, 4077 &inp, &stcb, netp, 4078 auth_skipped, 4079 auth_offset, 4080 auth_len, 4081 &locked_tcb); 4082 if (linp) 4083 SCTP_ASOC_CREATE_UNLOCK(linp); 4084 if (ret_buf == NULL) { 4085 if (locked_tcb) { 4086 SCTP_TCB_UNLOCK(locked_tcb); 4087 } 4088 #ifdef SCTP_DEBUG 4089 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4090 printf("GAK, null buffer\n"); 4091 } 4092 #endif /* SCTP_DEBUG */ 4093 auth_skipped = 0; 4094 *offset = length; 4095 return (NULL); 4096 } 4097 /* if AUTH skipped, see if it verified... */ 4098 if (auth_skipped) { 4099 got_auth = 1; 4100 auth_skipped = 0; 4101 } 4102 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) { 4103 /* 4104 * Restart the timer if we have 4105 * pending data 4106 */ 4107 struct sctp_tmit_chunk *chk; 4108 4109 chk = TAILQ_FIRST(&stcb->asoc.sent_queue); 4110 if (chk) { 4111 sctp_timer_start(SCTP_TIMER_TYPE_SEND, 4112 stcb->sctp_ep, stcb, 4113 chk->whoTo); 4114 } 4115 } 4116 } 4117 break; 4118 case SCTP_COOKIE_ACK: 4119 #ifdef SCTP_DEBUG 4120 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4121 printf("SCTP_COOKIE-ACK\n"); 4122 } 4123 #endif /* SCTP_DEBUG */ 4124 4125 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4126 /* We are not interested anymore */ 4127 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 4128 ; 4129 } else { 4130 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27); 4131 *offset = length; 4132 return (NULL); 4133 } 4134 } 4135 /* He's alive so give him credit */ 4136 stcb->asoc.overall_error_count = 0; 4137 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp); 4138 break; 4139 case SCTP_ECN_ECHO: 4140 #ifdef SCTP_DEBUG 4141 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4142 printf("SCTP_ECN-ECHO\n"); 4143 } 4144 #endif /* SCTP_DEBUG */ 4145 /* He's alive so give him credit */ 4146 stcb->asoc.overall_error_count = 0; 4147 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, 4148 stcb); 4149 break; 4150 case SCTP_ECN_CWR: 4151 #ifdef SCTP_DEBUG 4152 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4153 printf("SCTP_ECN-CWR\n"); 4154 } 4155 #endif /* SCTP_DEBUG */ 4156 /* He's alive so give him credit */ 4157 stcb->asoc.overall_error_count = 0; 4158 4159 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb); 4160 break; 4161 case SCTP_SHUTDOWN_COMPLETE: 4162 #ifdef SCTP_DEBUG 4163 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4164 printf("SCTP_SHUTDOWN-COMPLETE\n"); 4165 } 4166 #endif /* SCTP_DEBUG */ 4167 /* must be first and only chunk */ 4168 if ((num_chunks > 1) || 4169 (length - *offset > SCTP_SIZE32(chk_length))) { 4170 *offset = length; 4171 if (locked_tcb) 4172 SCTP_TCB_UNLOCK(locked_tcb); 4173 4174 return (NULL); 4175 } 4176 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch, 4177 stcb, *netp); 4178 *offset = length; 4179 return (NULL); 4180 break; 4181 case SCTP_ASCONF: 4182 #ifdef SCTP_DEBUG 4183 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4184 printf("SCTP_ASCONF\n"); 4185 } 4186 #endif /* SCTP_DEBUG */ 4187 /* He's alive so give him credit */ 4188 stcb->asoc.overall_error_count = 0; 4189 4190 sctp_handle_asconf(m, *offset, 4191 (struct sctp_asconf_chunk *)ch, stcb); 4192 break; 4193 case SCTP_ASCONF_ACK: 4194 #ifdef SCTP_DEBUG 4195 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4196 printf("SCTP_ASCONF-ACK\n"); 4197 } 4198 #endif /* SCTP_DEBUG */ 4199 /* He's alive so give him credit */ 4200 stcb->asoc.overall_error_count = 0; 4201 4202 sctp_handle_asconf_ack(m, *offset, 4203 (struct sctp_asconf_ack_chunk *)ch, stcb, *netp); 4204 break; 4205 case SCTP_FORWARD_CUM_TSN: 4206 #ifdef SCTP_DEBUG 4207 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4208 printf("SCTP_FWD-TSN\n"); 4209 } 4210 #endif /* SCTP_DEBUG */ 4211 /* He's alive so give him credit */ 4212 { 4213 int abort_flag = 0; 4214 4215 stcb->asoc.overall_error_count = 0; 4216 *fwd_tsn_seen = 1; 4217 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4218 /* We are not interested anymore */ 4219 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28); 4220 *offset = length; 4221 return (NULL); 4222 } 4223 sctp_handle_forward_tsn(stcb, 4224 (struct sctp_forward_tsn_chunk *)ch, &abort_flag); 4225 if (abort_flag) { 4226 *offset = length; 4227 return (NULL); 4228 } else { 4229 stcb->asoc.overall_error_count = 0; 4230 } 4231 4232 } 4233 break; 4234 case SCTP_STREAM_RESET: 4235 #ifdef SCTP_DEBUG 4236 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4237 printf("SCTP_STREAM_RESET\n"); 4238 } 4239 #endif /* SCTP_DEBUG */ 4240 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4241 chk_length, chunk_buf); 4242 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4243 /* We are not interested anymore */ 4244 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29); 4245 *offset = length; 4246 return (NULL); 4247 } 4248 if (stcb->asoc.peer_supports_strreset == 0) { 4249 /* 4250 * hmm, peer should have announced this, but 4251 * we will turn it on since he is sending us 4252 * a stream reset. 4253 */ 4254 stcb->asoc.peer_supports_strreset = 1; 4255 } 4256 if (sctp_handle_stream_reset(stcb, (struct sctp_stream_reset_out_req *)ch)) { 4257 /* stop processing */ 4258 *offset = length; 4259 return (NULL); 4260 } 4261 break; 4262 case SCTP_PACKET_DROPPED: 4263 #ifdef SCTP_DEBUG 4264 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4265 printf("SCTP_PACKET_DROPPED\n"); 4266 } 4267 #endif /* SCTP_DEBUG */ 4268 /* re-get it all please */ 4269 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4270 chk_length, chunk_buf); 4271 4272 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch, 4273 stcb, *netp); 4274 4275 break; 4276 4277 case SCTP_AUTHENTICATION: 4278 #ifdef SCTP_DEBUG 4279 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4280 printf("SCTP_AUTHENTICATION\n"); 4281 } 4282 #endif /* SCTP_DEBUG */ 4283 if (sctp_auth_disable) 4284 goto unknown_chunk; 4285 4286 if (stcb == NULL) { 4287 /* save the first AUTH for later processing */ 4288 if (auth_skipped == 0) { 4289 auth_offset = *offset; 4290 auth_len = chk_length; 4291 auth_skipped = 1; 4292 } 4293 /* skip this chunk (temporarily) */ 4294 goto next_chunk; 4295 } 4296 if (got_auth == 1) { 4297 /* skip this chunk... it's already auth'd */ 4298 goto next_chunk; 4299 } 4300 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4301 chk_length, chunk_buf); 4302 got_auth = 1; 4303 if (sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch, 4304 m, *offset)) { 4305 /* auth HMAC failed so dump the packet */ 4306 *offset = length; 4307 return (stcb); 4308 } else { 4309 /* remaining chunks are HMAC checked */ 4310 stcb->asoc.authenticated = 1; 4311 } 4312 break; 4313 4314 default: 4315 unknown_chunk: 4316 /* it's an unknown chunk! */ 4317 if ((ch->chunk_type & 0x40) && (stcb != NULL)) { 4318 struct mbuf *mm; 4319 struct sctp_paramhdr *phd; 4320 4321 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 4322 0, M_DONTWAIT, 1, MT_DATA); 4323 if (mm) { 4324 phd = mtod(mm, struct sctp_paramhdr *); 4325 /* 4326 * We cheat and use param type since 4327 * we did not bother to define a 4328 * error cause struct. They are the 4329 * same basic format with different 4330 * names. 4331 */ 4332 phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK); 4333 phd->param_length = htons(chk_length + sizeof(*phd)); 4334 SCTP_BUF_LEN(mm) = sizeof(*phd); 4335 SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, SCTP_SIZE32(chk_length), 4336 M_DONTWAIT); 4337 if (SCTP_BUF_NEXT(mm)) { 4338 sctp_queue_op_err(stcb, mm); 4339 } else { 4340 sctp_m_freem(mm); 4341 } 4342 } 4343 } 4344 if ((ch->chunk_type & 0x80) == 0) { 4345 /* discard this packet */ 4346 *offset = length; 4347 return (stcb); 4348 } /* else skip this bad chunk and continue... */ 4349 break; 4350 } /* switch (ch->chunk_type) */ 4351 4352 4353 next_chunk: 4354 /* get the next chunk */ 4355 *offset += SCTP_SIZE32(chk_length); 4356 if (*offset >= length) { 4357 /* no more data left in the mbuf chain */ 4358 break; 4359 } 4360 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4361 sizeof(struct sctp_chunkhdr), chunk_buf); 4362 if (ch == NULL) { 4363 if (locked_tcb) 4364 SCTP_TCB_UNLOCK(locked_tcb); 4365 *offset = length; 4366 return (NULL); 4367 } 4368 } /* while */ 4369 return (stcb); 4370 } 4371 4372 4373 /* 4374 * Process the ECN bits we have something set so we must look to see if it is 4375 * ECN(0) or ECN(1) or CE 4376 */ 4377 static __inline void 4378 sctp_process_ecn_marked_a(struct sctp_tcb *stcb, struct sctp_nets *net, 4379 uint8_t ecn_bits) 4380 { 4381 if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 4382 ; 4383 } else if ((ecn_bits & SCTP_ECT1_BIT) == SCTP_ECT1_BIT) { 4384 /* 4385 * we only add to the nonce sum for ECT1, ECT0 does not 4386 * change the NS bit (that we have yet to find a way to send 4387 * it yet). 4388 */ 4389 4390 /* ECN Nonce stuff */ 4391 stcb->asoc.receiver_nonce_sum++; 4392 stcb->asoc.receiver_nonce_sum &= SCTP_SACK_NONCE_SUM; 4393 4394 /* 4395 * Drag up the last_echo point if cumack is larger since we 4396 * don't want the point falling way behind by more than 4397 * 2^^31 and then having it be incorrect. 4398 */ 4399 if (compare_with_wrap(stcb->asoc.cumulative_tsn, 4400 stcb->asoc.last_echo_tsn, MAX_TSN)) { 4401 stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 4402 } 4403 } else if ((ecn_bits & SCTP_ECT0_BIT) == SCTP_ECT0_BIT) { 4404 /* 4405 * Drag up the last_echo point if cumack is larger since we 4406 * don't want the point falling way behind by more than 4407 * 2^^31 and then having it be incorrect. 4408 */ 4409 if (compare_with_wrap(stcb->asoc.cumulative_tsn, 4410 stcb->asoc.last_echo_tsn, MAX_TSN)) { 4411 stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 4412 } 4413 } 4414 } 4415 4416 static __inline void 4417 sctp_process_ecn_marked_b(struct sctp_tcb *stcb, struct sctp_nets *net, 4418 uint32_t high_tsn, uint8_t ecn_bits) 4419 { 4420 if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 4421 /* 4422 * we possibly must notify the sender that a congestion 4423 * window reduction is in order. We do this by adding a ECNE 4424 * chunk to the output chunk queue. The incoming CWR will 4425 * remove this chunk. 4426 */ 4427 if (compare_with_wrap(high_tsn, stcb->asoc.last_echo_tsn, 4428 MAX_TSN)) { 4429 /* Yep, we need to add a ECNE */ 4430 sctp_send_ecn_echo(stcb, net, high_tsn); 4431 stcb->asoc.last_echo_tsn = high_tsn; 4432 } 4433 } 4434 } 4435 4436 /* 4437 * common input chunk processing (v4 and v6) 4438 */ 4439 int 4440 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, 4441 int length, struct sctphdr *sh, struct sctp_chunkhdr *ch, 4442 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 4443 uint8_t ecn_bits) 4444 { 4445 /* 4446 * Control chunk processing 4447 */ 4448 uint32_t high_tsn; 4449 int fwd_tsn_seen = 0, data_processed = 0; 4450 struct mbuf *m = *mm; 4451 int abort_flag = 0; 4452 int un_sent; 4453 4454 SCTP_STAT_INCR(sctps_recvdatagrams); 4455 #ifdef SCTP_AUDITING_ENABLED 4456 sctp_audit_log(0xE0, 1); 4457 sctp_auditing(0, inp, stcb, net); 4458 #endif 4459 4460 #ifdef SCTP_DEBUG 4461 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4462 printf("Ok, Common input processing called, m:%p iphlen:%d offset:%d\n", 4463 m, iphlen, offset); 4464 } 4465 #endif /* SCTP_DEBUG */ 4466 4467 if (stcb) { 4468 /* always clear this before beginning a packet */ 4469 stcb->asoc.authenticated = 0; 4470 stcb->asoc.seen_a_sack_this_pkt = 0; 4471 } 4472 if (IS_SCTP_CONTROL(ch)) { 4473 /* process the control portion of the SCTP packet */ 4474 stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch, 4475 inp, stcb, &net, &fwd_tsn_seen); 4476 if (stcb) { 4477 /* 4478 * This covers us if the cookie-echo was there and 4479 * it changes our INP. 4480 */ 4481 inp = stcb->sctp_ep; 4482 } 4483 } else { 4484 /* 4485 * no control chunks, so pre-process DATA chunks (these 4486 * checks are taken care of by control processing) 4487 */ 4488 4489 /* 4490 * if DATA only packet, and auth is required, then punt... 4491 * can't have authenticated without any AUTH (control) 4492 * chunks 4493 */ 4494 if ((stcb != NULL) && !sctp_auth_disable && 4495 sctp_auth_is_required_chunk(SCTP_DATA, 4496 stcb->asoc.local_auth_chunks)) { 4497 /* "silently" ignore */ 4498 SCTP_STAT_INCR(sctps_recvauthmissing); 4499 SCTP_TCB_UNLOCK(stcb); 4500 return (1); 4501 } 4502 if (stcb == NULL) { 4503 /* out of the blue DATA chunk */ 4504 sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL); 4505 return (1); 4506 } 4507 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) { 4508 /* v_tag mismatch! */ 4509 SCTP_STAT_INCR(sctps_badvtag); 4510 SCTP_TCB_UNLOCK(stcb); 4511 return (1); 4512 } 4513 } 4514 4515 if (stcb == NULL) { 4516 /* 4517 * no valid TCB for this packet, or we found it's a bad 4518 * packet while processing control, or we're done with this 4519 * packet (done or skip rest of data), so we drop it... 4520 */ 4521 return (1); 4522 } 4523 /* 4524 * DATA chunk processing 4525 */ 4526 /* plow through the data chunks while length > offset */ 4527 4528 /* 4529 * Rest should be DATA only. Check authentication state if AUTH for 4530 * DATA is required. 4531 */ 4532 if ((length > offset) && (stcb != NULL) && !sctp_auth_disable && 4533 sctp_auth_is_required_chunk(SCTP_DATA, 4534 stcb->asoc.local_auth_chunks) && 4535 !stcb->asoc.authenticated) { 4536 /* "silently" ignore */ 4537 SCTP_STAT_INCR(sctps_recvauthmissing); 4538 #ifdef SCTP_DEBUG 4539 if (sctp_debug_on & SCTP_DEBUG_AUTH1) 4540 printf("Data chunk requires AUTH, skipped\n"); 4541 #endif 4542 goto trigger_send; 4543 } 4544 if (length > offset) { 4545 int retval; 4546 4547 /* 4548 * First check to make sure our state is correct. We would 4549 * not get here unless we really did have a tag, so we don't 4550 * abort if this happens, just dump the chunk silently. 4551 */ 4552 switch (SCTP_GET_STATE(&stcb->asoc)) { 4553 case SCTP_STATE_COOKIE_ECHOED: 4554 /* 4555 * we consider data with valid tags in this state 4556 * shows us the cookie-ack was lost. Imply it was 4557 * there. 4558 */ 4559 stcb->asoc.overall_error_count = 0; 4560 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net); 4561 break; 4562 case SCTP_STATE_COOKIE_WAIT: 4563 /* 4564 * We consider OOTB any data sent during asoc setup. 4565 */ 4566 sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL); 4567 SCTP_TCB_UNLOCK(stcb); 4568 return (1); 4569 break; 4570 case SCTP_STATE_EMPTY: /* should not happen */ 4571 case SCTP_STATE_INUSE: /* should not happen */ 4572 case SCTP_STATE_SHUTDOWN_RECEIVED: /* This is a peer error */ 4573 case SCTP_STATE_SHUTDOWN_ACK_SENT: 4574 default: 4575 SCTP_TCB_UNLOCK(stcb); 4576 return (1); 4577 break; 4578 case SCTP_STATE_OPEN: 4579 case SCTP_STATE_SHUTDOWN_SENT: 4580 break; 4581 } 4582 /* take care of ECN, part 1. */ 4583 if (stcb->asoc.ecn_allowed && 4584 (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) { 4585 sctp_process_ecn_marked_a(stcb, net, ecn_bits); 4586 } 4587 /* plow through the data chunks while length > offset */ 4588 retval = sctp_process_data(mm, iphlen, &offset, length, sh, 4589 inp, stcb, net, &high_tsn); 4590 if (retval == 2) { 4591 /* 4592 * The association aborted, NO UNLOCK needed since 4593 * the association is destroyed. 4594 */ 4595 return (0); 4596 } 4597 data_processed = 1; 4598 if (retval == 0) { 4599 /* take care of ecn part 2. */ 4600 if (stcb->asoc.ecn_allowed && 4601 (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) { 4602 sctp_process_ecn_marked_b(stcb, net, high_tsn, 4603 ecn_bits); 4604 } 4605 } 4606 /* 4607 * Anything important needs to have been m_copy'ed in 4608 * process_data 4609 */ 4610 } 4611 if ((data_processed == 0) && (fwd_tsn_seen)) { 4612 int was_a_gap = 0; 4613 4614 if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map, 4615 stcb->asoc.cumulative_tsn, MAX_TSN)) { 4616 /* there was a gap before this data was processed */ 4617 was_a_gap = 1; 4618 } 4619 sctp_sack_check(stcb, 1, was_a_gap, &abort_flag); 4620 if (abort_flag) { 4621 /* Again, we aborted so NO UNLOCK needed */ 4622 return (0); 4623 } 4624 } 4625 /* trigger send of any chunks in queue... */ 4626 trigger_send: 4627 #ifdef SCTP_AUDITING_ENABLED 4628 sctp_audit_log(0xE0, 2); 4629 sctp_auditing(1, inp, stcb, net); 4630 #endif 4631 #ifdef SCTP_DEBUG 4632 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4633 printf("Check for chunk output prw:%d tqe:%d tf=%d\n", 4634 stcb->asoc.peers_rwnd, 4635 TAILQ_EMPTY(&stcb->asoc.control_send_queue), 4636 stcb->asoc.total_flight); 4637 } 4638 #endif 4639 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 4640 4641 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue) || 4642 ((un_sent) && 4643 (stcb->asoc.peers_rwnd > 0 || 4644 (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) { 4645 #ifdef SCTP_DEBUG 4646 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4647 printf("Calling chunk OUTPUT\n"); 4648 } 4649 #endif 4650 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 4651 #ifdef SCTP_DEBUG 4652 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4653 printf("chunk OUTPUT returns\n"); 4654 } 4655 #endif 4656 } 4657 #ifdef SCTP_AUDITING_ENABLED 4658 sctp_audit_log(0xE0, 3); 4659 sctp_auditing(2, inp, stcb, net); 4660 #endif 4661 SCTP_TCB_UNLOCK(stcb); 4662 return (0); 4663 } 4664 4665 extern int sctp_no_csum_on_loopback; 4666 4667 4668 int sctp_buf_index = 0; 4669 uint8_t sctp_list_of_chunks[30000]; 4670 4671 4672 void 4673 sctp_input(i_pak, off) 4674 struct mbuf *i_pak; 4675 int off; 4676 4677 { 4678 #ifdef SCTP_MBUF_LOGGING 4679 struct mbuf *mat; 4680 4681 #endif 4682 struct mbuf *m; 4683 int iphlen; 4684 uint8_t ecn_bits; 4685 struct ip *ip; 4686 struct sctphdr *sh; 4687 struct sctp_inpcb *inp = NULL; 4688 4689 uint32_t check, calc_check; 4690 struct sctp_nets *net; 4691 struct sctp_tcb *stcb = NULL; 4692 struct sctp_chunkhdr *ch; 4693 int refcount_up = 0; 4694 int length, mlen, offset; 4695 4696 4697 iphlen = off; 4698 m = SCTP_HEADER_TO_CHAIN(i_pak); 4699 net = NULL; 4700 SCTP_STAT_INCR(sctps_recvpackets); 4701 SCTP_STAT_INCR_COUNTER64(sctps_inpackets); 4702 4703 /* 4704 * Strip IP options, we don't allow any in or out. 4705 */ 4706 #ifdef SCTP_MBUF_LOGGING 4707 /* Log in any input mbufs */ 4708 mat = m; 4709 while (mat) { 4710 if (SCTP_BUF_IS_EXTENDED(mat)) { 4711 sctp_log_mb(mat, SCTP_MBUF_INPUT); 4712 } 4713 mat = SCTP_BUF_NEXT(mat); 4714 } 4715 #endif 4716 if ((size_t)iphlen > sizeof(struct ip)) { 4717 ip_stripoptions(m, (struct mbuf *)0); 4718 iphlen = sizeof(struct ip); 4719 } 4720 /* 4721 * Get IP, SCTP, and first chunk header together in first mbuf. 4722 */ 4723 ip = mtod(m, struct ip *); 4724 offset = iphlen + sizeof(*sh) + sizeof(*ch); 4725 if (SCTP_BUF_LEN(m) < offset) { 4726 if ((m = m_pullup(m, offset)) == 0) { 4727 SCTP_STAT_INCR(sctps_hdrops); 4728 return; 4729 } 4730 ip = mtod(m, struct ip *); 4731 } 4732 sh = (struct sctphdr *)((caddr_t)ip + iphlen); 4733 ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh)); 4734 4735 /* SCTP does not allow broadcasts or multicasts */ 4736 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { 4737 goto bad; 4738 } 4739 if (((ch->chunk_type == SCTP_INITIATION) || 4740 (ch->chunk_type == SCTP_INITIATION_ACK) || 4741 (ch->chunk_type == SCTP_COOKIE_ECHO)) && 4742 (SCTP_IS_IT_BROADCAST(ip->ip_dst, i_pak))) { 4743 /* 4744 * We only look at broadcast if its a front state, All 4745 * others we will not have a tcb for anyway. 4746 */ 4747 goto bad; 4748 } 4749 /* destination port of 0 is illegal, based on RFC2960. */ 4750 if (sh->dest_port == 0) { 4751 SCTP_STAT_INCR(sctps_hdrops); 4752 goto bad; 4753 } 4754 /* validate SCTP checksum */ 4755 if ((sctp_no_csum_on_loopback == 0) || !SCTP_IS_IT_LOOPBACK(i_pak)) { 4756 /* 4757 * we do NOT validate things from the loopback if the sysctl 4758 * is set to 1. 4759 */ 4760 check = sh->checksum; /* save incoming checksum */ 4761 if ((check == 0) && (sctp_no_csum_on_loopback)) { 4762 /* 4763 * special hook for where we got a local address 4764 * somehow routed across a non IFT_LOOP type 4765 * interface 4766 */ 4767 if (ip->ip_src.s_addr == ip->ip_dst.s_addr) 4768 goto sctp_skip_csum_4; 4769 } 4770 sh->checksum = 0; /* prepare for calc */ 4771 calc_check = sctp_calculate_sum(m, &mlen, iphlen); 4772 if (calc_check != check) { 4773 #ifdef SCTP_DEBUG 4774 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4775 printf("Bad CSUM on SCTP packet calc_check:%x check:%x m:%p mlen:%d iphlen:%d\n", 4776 calc_check, check, m, mlen, iphlen); 4777 } 4778 #endif 4779 4780 stcb = sctp_findassociation_addr(m, iphlen, 4781 offset - sizeof(*ch), 4782 sh, ch, &inp, &net); 4783 if ((inp) && (stcb)) { 4784 sctp_send_packet_dropped(stcb, net, m, iphlen, 1); 4785 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR); 4786 } else if ((inp != NULL) && (stcb == NULL)) { 4787 refcount_up = 1; 4788 } 4789 SCTP_STAT_INCR(sctps_badsum); 4790 SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors); 4791 goto bad; 4792 } 4793 sh->checksum = calc_check; 4794 } else { 4795 sctp_skip_csum_4: 4796 mlen = SCTP_HEADER_LEN(i_pak); 4797 } 4798 /* validate mbuf chain length with IP payload length */ 4799 if (mlen < (ip->ip_len - iphlen)) { 4800 SCTP_STAT_INCR(sctps_hdrops); 4801 goto bad; 4802 } { 4803 /* TEMP log the first chunk */ 4804 int x; 4805 4806 x = atomic_fetchadd_int(&sctp_buf_index, 1); 4807 if (x >= 30000) { 4808 sctp_buf_index = 1; 4809 x = 0;; 4810 } 4811 sctp_list_of_chunks[x] = ch->chunk_type; 4812 } 4813 /* 4814 * Locate pcb and tcb for datagram sctp_findassociation_addr() wants 4815 * IP/SCTP/first chunk header... 4816 */ 4817 stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch), 4818 sh, ch, &inp, &net); 4819 /* inp's ref-count increased && stcb locked */ 4820 if (inp == NULL) { 4821 struct sctp_init_chunk *init_chk, chunk_buf; 4822 4823 SCTP_STAT_INCR(sctps_noport); 4824 #ifdef ICMP_BANDLIM 4825 /* 4826 * we use the bandwidth limiting to protect against sending 4827 * too many ABORTS all at once. In this case these count the 4828 * same as an ICMP message. 4829 */ 4830 if (badport_bandlim(0) < 0) 4831 goto bad; 4832 #endif /* ICMP_BANDLIM */ 4833 #ifdef SCTP_DEBUG 4834 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4835 printf("Sending a ABORT from packet entry!\n"); 4836 } 4837 #endif 4838 if (ch->chunk_type == SCTP_INITIATION) { 4839 /* 4840 * we do a trick here to get the INIT tag, dig in 4841 * and get the tag from the INIT and put it in the 4842 * common header. 4843 */ 4844 init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m, 4845 iphlen + sizeof(*sh), sizeof(*init_chk), 4846 (uint8_t *) & chunk_buf); 4847 if (init_chk != NULL) 4848 sh->v_tag = init_chk->init.initiate_tag; 4849 } 4850 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 4851 sctp_send_shutdown_complete2(m, iphlen, sh); 4852 goto bad; 4853 } 4854 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) { 4855 goto bad; 4856 } 4857 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) 4858 sctp_send_abort(m, iphlen, sh, 0, NULL); 4859 goto bad; 4860 } else if (stcb == NULL) { 4861 refcount_up = 1; 4862 } 4863 #ifdef IPSEC 4864 /* 4865 * I very much doubt any of the IPSEC stuff will work but I have no 4866 * idea, so I will leave it in place. 4867 */ 4868 4869 if (inp && ipsec4_in_reject(m, &inp->ip_inp.inp)) { 4870 ipsecstat.in_polvio++; 4871 SCTP_STAT_INCR(sctps_hdrops); 4872 goto bad; 4873 } 4874 #endif /* IPSEC */ 4875 4876 4877 4878 /* 4879 * common chunk processing 4880 */ 4881 length = ip->ip_len + iphlen; 4882 offset -= sizeof(struct sctp_chunkhdr); 4883 4884 ecn_bits = ip->ip_tos; 4885 4886 sctp_common_input_processing(&m, iphlen, offset, length, sh, ch, 4887 inp, stcb, net, ecn_bits); 4888 /* inp's ref-count reduced && stcb unlocked */ 4889 if (m) { 4890 sctp_m_freem(m); 4891 } 4892 if ((inp) && (refcount_up)) { 4893 /* reduce ref-count */ 4894 SCTP_INP_WLOCK(inp); 4895 SCTP_INP_DECR_REF(inp); 4896 SCTP_INP_WUNLOCK(inp); 4897 } 4898 return; 4899 bad: 4900 if (stcb) 4901 SCTP_TCB_UNLOCK(stcb); 4902 4903 if ((inp) && (refcount_up)) { 4904 /* reduce ref-count */ 4905 SCTP_INP_WLOCK(inp); 4906 SCTP_INP_DECR_REF(inp); 4907 SCTP_INP_WUNLOCK(inp); 4908 } 4909 if (m) { 4910 sctp_m_freem(m); 4911 } 4912 return; 4913 } 4914