1 /*- 2 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 3 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 4 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions are met: 8 * 9 * a) Redistributions of source code must retain the above copyright notice, 10 * this list of conditions and the following disclaimer. 11 * 12 * b) Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the distribution. 15 * 16 * c) Neither the name of Cisco Systems, Inc. nor the names of its 17 * contributors may be used to endorse or promote products derived 18 * from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 24 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 30 * THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __FBSDID("$FreeBSD$"); 35 36 #include <netinet/sctp_os.h> 37 #include <netinet/sctp_var.h> 38 #include <netinet/sctp_sysctl.h> 39 #include <netinet/sctp_pcb.h> 40 #include <netinet/sctp_header.h> 41 #include <netinet/sctputil.h> 42 #include <netinet/sctp_output.h> 43 #include <netinet/sctp_input.h> 44 #include <netinet/sctp_auth.h> 45 #include <netinet/sctp_indata.h> 46 #include <netinet/sctp_asconf.h> 47 #include <netinet/sctp_bsd_addr.h> 48 #include <netinet/sctp_timer.h> 49 #include <netinet/sctp_crc32.h> 50 #if defined(INET) || defined(INET6) 51 #include <netinet/udp.h> 52 #endif 53 #include <sys/smp.h> 54 55 56 57 static void 58 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb) 59 { 60 struct sctp_nets *net; 61 62 /* 63 * This now not only stops all cookie timers it also stops any INIT 64 * timers as well. This will make sure that the timers are stopped 65 * in all collision cases. 66 */ 67 SCTP_TCB_LOCK_ASSERT(stcb); 68 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 69 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) { 70 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, 71 stcb->sctp_ep, 72 stcb, 73 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1); 74 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) { 75 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, 76 stcb->sctp_ep, 77 stcb, 78 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2); 79 } 80 } 81 } 82 83 /* INIT handler */ 84 static void 85 sctp_handle_init(struct mbuf *m, int iphlen, int offset, 86 struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh, 87 struct sctp_init_chunk *cp, struct sctp_inpcb *inp, 88 struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_no_unlock, 89 uint8_t mflowtype, uint32_t mflowid, 90 uint32_t vrf_id, uint16_t port) 91 { 92 struct sctp_init *init; 93 struct mbuf *op_err; 94 95 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n", 96 (void *)stcb); 97 if (stcb == NULL) { 98 SCTP_INP_RLOCK(inp); 99 } 100 /* validate length */ 101 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) { 102 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, ""); 103 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err, 104 mflowtype, mflowid, 105 vrf_id, port); 106 if (stcb) 107 *abort_no_unlock = 1; 108 goto outnow; 109 } 110 /* validate parameters */ 111 init = &cp->init; 112 if (init->initiate_tag == 0) { 113 /* protocol error... send abort */ 114 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, ""); 115 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err, 116 mflowtype, mflowid, 117 vrf_id, port); 118 if (stcb) 119 *abort_no_unlock = 1; 120 goto outnow; 121 } 122 if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) { 123 /* invalid parameter... send abort */ 124 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, ""); 125 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err, 126 mflowtype, mflowid, 127 vrf_id, port); 128 if (stcb) 129 *abort_no_unlock = 1; 130 goto outnow; 131 } 132 if (init->num_inbound_streams == 0) { 133 /* protocol error... send abort */ 134 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, ""); 135 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err, 136 mflowtype, mflowid, 137 vrf_id, port); 138 if (stcb) 139 *abort_no_unlock = 1; 140 goto outnow; 141 } 142 if (init->num_outbound_streams == 0) { 143 /* protocol error... send abort */ 144 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, ""); 145 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err, 146 mflowtype, mflowid, 147 vrf_id, port); 148 if (stcb) 149 *abort_no_unlock = 1; 150 goto outnow; 151 } 152 if (sctp_validate_init_auth_params(m, offset + sizeof(*cp), 153 offset + ntohs(cp->ch.chunk_length))) { 154 /* auth parameter(s) error... send abort */ 155 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 156 "Problem with AUTH parameters"); 157 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err, 158 mflowtype, mflowid, 159 vrf_id, port); 160 if (stcb) 161 *abort_no_unlock = 1; 162 goto outnow; 163 } 164 /* We are only accepting if we have a socket with positive 165 * so_qlimit. */ 166 if ((stcb == NULL) && 167 ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 168 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 169 (inp->sctp_socket == NULL) || 170 (inp->sctp_socket->so_qlimit == 0))) { 171 /* 172 * FIX ME ?? What about TCP model and we have a 173 * match/restart case? Actually no fix is needed. the lookup 174 * will always find the existing assoc so stcb would not be 175 * NULL. It may be questionable to do this since we COULD 176 * just send back the INIT-ACK and hope that the app did 177 * accept()'s by the time the COOKIE was sent. But there is 178 * a price to pay for COOKIE generation and I don't want to 179 * pay it on the chance that the app will actually do some 180 * accepts(). The App just looses and should NOT be in this 181 * state :-) 182 */ 183 if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0) { 184 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 185 "No listener"); 186 sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err, 187 mflowtype, mflowid, inp->fibnum, 188 vrf_id, port); 189 } 190 goto outnow; 191 } 192 if ((stcb != NULL) && 193 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT)) { 194 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending SHUTDOWN-ACK\n"); 195 sctp_send_shutdown_ack(stcb, NULL); 196 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED); 197 } else { 198 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n"); 199 sctp_send_initiate_ack(inp, stcb, net, m, iphlen, offset, 200 src, dst, sh, cp, 201 mflowtype, mflowid, 202 vrf_id, port, 203 ((stcb == NULL) ? SCTP_HOLDS_LOCK : SCTP_NOT_LOCKED)); 204 } 205 outnow: 206 if (stcb == NULL) { 207 SCTP_INP_RUNLOCK(inp); 208 } 209 } 210 211 /* 212 * process peer "INIT/INIT-ACK" chunk returns value < 0 on error 213 */ 214 215 int 216 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked 217 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 218 SCTP_UNUSED 219 #endif 220 ) 221 { 222 int unsent_data; 223 unsigned int i; 224 struct sctp_stream_queue_pending *sp; 225 struct sctp_association *asoc; 226 227 /* 228 * This function returns if any stream has true unsent data on it. 229 * Note that as it looks through it will clean up any places that 230 * have old data that has been sent but left at top of stream queue. 231 */ 232 asoc = &stcb->asoc; 233 unsent_data = 0; 234 SCTP_TCB_SEND_LOCK(stcb); 235 if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) { 236 /* Check to see if some data queued */ 237 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 238 /* sa_ignore FREED_MEMORY */ 239 sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue); 240 if (sp == NULL) { 241 continue; 242 } 243 if ((sp->msg_is_complete) && 244 (sp->length == 0) && 245 (sp->sender_all_done)) { 246 /* 247 * We are doing differed cleanup. Last time 248 * through when we took all the data the 249 * sender_all_done was not set. 250 */ 251 if (sp->put_last_out == 0) { 252 SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n"); 253 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n", 254 sp->sender_all_done, 255 sp->length, 256 sp->msg_is_complete, 257 sp->put_last_out); 258 } 259 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1); 260 TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next); 261 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, &asoc->strmout[i], sp, 1); 262 if (sp->net) { 263 sctp_free_remote_addr(sp->net); 264 sp->net = NULL; 265 } 266 if (sp->data) { 267 sctp_m_freem(sp->data); 268 sp->data = NULL; 269 } 270 sctp_free_a_strmoq(stcb, sp, so_locked); 271 if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 272 unsent_data++; 273 } 274 } else { 275 unsent_data++; 276 } 277 if (unsent_data > 0) { 278 break; 279 } 280 } 281 } 282 SCTP_TCB_SEND_UNLOCK(stcb); 283 return (unsent_data); 284 } 285 286 static int 287 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb) 288 { 289 struct sctp_init *init; 290 struct sctp_association *asoc; 291 struct sctp_nets *lnet; 292 unsigned int i; 293 294 init = &cp->init; 295 asoc = &stcb->asoc; 296 /* save off parameters */ 297 asoc->peer_vtag = ntohl(init->initiate_tag); 298 asoc->peers_rwnd = ntohl(init->a_rwnd); 299 /* init tsn's */ 300 asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1; 301 302 if (!TAILQ_EMPTY(&asoc->nets)) { 303 /* update any ssthresh's that may have a default */ 304 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 305 lnet->ssthresh = asoc->peers_rwnd; 306 if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE | SCTP_CWND_LOGGING_ENABLE)) { 307 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION); 308 } 309 } 310 } 311 SCTP_TCB_SEND_LOCK(stcb); 312 if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) { 313 unsigned int newcnt; 314 struct sctp_stream_out *outs; 315 struct sctp_stream_queue_pending *sp, *nsp; 316 struct sctp_tmit_chunk *chk, *nchk; 317 318 /* abandon the upper streams */ 319 newcnt = ntohs(init->num_inbound_streams); 320 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 321 if (chk->rec.data.sid >= newcnt) { 322 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next); 323 asoc->send_queue_cnt--; 324 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) { 325 asoc->strmout[chk->rec.data.sid].chunks_on_queues--; 326 #ifdef INVARIANTS 327 } else { 328 panic("No chunks on the queues for sid %u.", chk->rec.data.sid); 329 #endif 330 } 331 if (chk->data != NULL) { 332 sctp_free_bufspace(stcb, asoc, chk, 1); 333 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 334 0, chk, SCTP_SO_NOT_LOCKED); 335 if (chk->data) { 336 sctp_m_freem(chk->data); 337 chk->data = NULL; 338 } 339 } 340 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 341 /* sa_ignore FREED_MEMORY */ 342 } 343 } 344 if (asoc->strmout) { 345 for (i = newcnt; i < asoc->pre_open_streams; i++) { 346 outs = &asoc->strmout[i]; 347 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) { 348 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1); 349 TAILQ_REMOVE(&outs->outqueue, sp, next); 350 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1); 351 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, 352 stcb, 0, sp, SCTP_SO_NOT_LOCKED); 353 if (sp->data) { 354 sctp_m_freem(sp->data); 355 sp->data = NULL; 356 } 357 if (sp->net) { 358 sctp_free_remote_addr(sp->net); 359 sp->net = NULL; 360 } 361 /* Free the chunk */ 362 sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED); 363 /* sa_ignore FREED_MEMORY */ 364 } 365 outs->state = SCTP_STREAM_CLOSED; 366 } 367 } 368 /* cut back the count */ 369 asoc->pre_open_streams = newcnt; 370 } 371 SCTP_TCB_SEND_UNLOCK(stcb); 372 asoc->streamoutcnt = asoc->pre_open_streams; 373 if (asoc->strmout) { 374 for (i = 0; i < asoc->streamoutcnt; i++) { 375 asoc->strmout[i].state = SCTP_STREAM_OPEN; 376 } 377 } 378 /* EY - nr_sack: initialize highest tsn in nr_mapping_array */ 379 asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map; 380 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) { 381 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 382 } 383 /* This is the next one we expect */ 384 asoc->str_reset_seq_in = asoc->asconf_seq_in + 1; 385 386 asoc->mapping_array_base_tsn = ntohl(init->initial_tsn); 387 asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in; 388 389 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 390 /* open the requested streams */ 391 392 if (asoc->strmin != NULL) { 393 /* Free the old ones */ 394 for (i = 0; i < asoc->streamincnt; i++) { 395 sctp_clean_up_stream(stcb, &asoc->strmin[i].inqueue); 396 sctp_clean_up_stream(stcb, &asoc->strmin[i].uno_inqueue); 397 } 398 SCTP_FREE(asoc->strmin, SCTP_M_STRMI); 399 } 400 if (asoc->max_inbound_streams > ntohs(init->num_outbound_streams)) { 401 asoc->streamincnt = ntohs(init->num_outbound_streams); 402 } else { 403 asoc->streamincnt = asoc->max_inbound_streams; 404 } 405 SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt * 406 sizeof(struct sctp_stream_in), SCTP_M_STRMI); 407 if (asoc->strmin == NULL) { 408 /* we didn't get memory for the streams! */ 409 SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n"); 410 return (-1); 411 } 412 for (i = 0; i < asoc->streamincnt; i++) { 413 asoc->strmin[i].sid = i; 414 asoc->strmin[i].last_mid_delivered = 0xffffffff; 415 TAILQ_INIT(&asoc->strmin[i].inqueue); 416 TAILQ_INIT(&asoc->strmin[i].uno_inqueue); 417 asoc->strmin[i].pd_api_started = 0; 418 asoc->strmin[i].delivery_started = 0; 419 } 420 /* 421 * load_address_from_init will put the addresses into the 422 * association when the COOKIE is processed or the INIT-ACK is 423 * processed. Both types of COOKIE's existing and new call this 424 * routine. It will remove addresses that are no longer in the 425 * association (for the restarting case where addresses are 426 * removed). Up front when the INIT arrives we will discard it if it 427 * is a restart and new addresses have been added. 428 */ 429 /* sa_ignore MEMLEAK */ 430 return (0); 431 } 432 433 /* 434 * INIT-ACK message processing/consumption returns value < 0 on error 435 */ 436 static int 437 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset, 438 struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh, 439 struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 440 struct sctp_nets *net, int *abort_no_unlock, 441 uint8_t mflowtype, uint32_t mflowid, 442 uint32_t vrf_id) 443 { 444 struct sctp_association *asoc; 445 struct mbuf *op_err; 446 int retval, abort_flag; 447 uint32_t initack_limit; 448 int nat_friendly = 0; 449 450 /* First verify that we have no illegal param's */ 451 abort_flag = 0; 452 453 op_err = sctp_arethere_unrecognized_parameters(m, 454 (offset + sizeof(struct sctp_init_chunk)), 455 &abort_flag, (struct sctp_chunkhdr *)cp, &nat_friendly); 456 if (abort_flag) { 457 /* Send an abort and notify peer */ 458 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED); 459 *abort_no_unlock = 1; 460 return (-1); 461 } 462 asoc = &stcb->asoc; 463 asoc->peer_supports_nat = (uint8_t)nat_friendly; 464 /* process the peer's parameters in the INIT-ACK */ 465 retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb); 466 if (retval < 0) { 467 return (retval); 468 } 469 initack_limit = offset + ntohs(cp->ch.chunk_length); 470 /* load all addresses */ 471 if ((retval = sctp_load_addresses_from_init(stcb, m, 472 (offset + sizeof(struct sctp_init_chunk)), initack_limit, 473 src, dst, NULL, stcb->asoc.port))) { 474 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 475 "Problem with address parameters"); 476 SCTPDBG(SCTP_DEBUG_INPUT1, 477 "Load addresses from INIT causes an abort %d\n", 478 retval); 479 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 480 src, dst, sh, op_err, 481 mflowtype, mflowid, 482 vrf_id, net->port); 483 *abort_no_unlock = 1; 484 return (-1); 485 } 486 /* if the peer doesn't support asconf, flush the asconf queue */ 487 if (asoc->asconf_supported == 0) { 488 struct sctp_asconf_addr *param, *nparam; 489 490 TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) { 491 TAILQ_REMOVE(&asoc->asconf_queue, param, next); 492 SCTP_FREE(param, SCTP_M_ASC_ADDR); 493 } 494 } 495 stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs, 496 stcb->asoc.local_hmacs); 497 if (op_err) { 498 sctp_queue_op_err(stcb, op_err); 499 /* queuing will steal away the mbuf chain to the out queue */ 500 op_err = NULL; 501 } 502 /* extract the cookie and queue it to "echo" it back... */ 503 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 504 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 505 stcb->asoc.overall_error_count, 506 0, 507 SCTP_FROM_SCTP_INPUT, 508 __LINE__); 509 } 510 stcb->asoc.overall_error_count = 0; 511 net->error_count = 0; 512 513 /* 514 * Cancel the INIT timer, We do this first before queueing the 515 * cookie. We always cancel at the primary to assue that we are 516 * canceling the timer started by the INIT which always goes to the 517 * primary. 518 */ 519 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb, 520 asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3); 521 522 /* calculate the RTO */ 523 net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered, sctp_align_safe_nocopy, 524 SCTP_RTT_FROM_NON_DATA); 525 retval = sctp_send_cookie_echo(m, offset, stcb, net); 526 if (retval < 0) { 527 /* 528 * No cookie, we probably should send a op error. But in any 529 * case if there is no cookie in the INIT-ACK, we can 530 * abandon the peer, its broke. 531 */ 532 if (retval == -3) { 533 uint16_t len; 534 535 len = (uint16_t)(sizeof(struct sctp_error_missing_param) + sizeof(uint16_t)); 536 /* We abort with an error of missing mandatory param */ 537 op_err = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA); 538 if (op_err != NULL) { 539 struct sctp_error_missing_param *cause; 540 541 SCTP_BUF_LEN(op_err) = len; 542 cause = mtod(op_err, struct sctp_error_missing_param *); 543 /* Subtract the reserved param */ 544 cause->cause.code = htons(SCTP_CAUSE_MISSING_PARAM); 545 cause->cause.length = htons(len); 546 cause->num_missing_params = htonl(1); 547 cause->type[0] = htons(SCTP_STATE_COOKIE); 548 } 549 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 550 src, dst, sh, op_err, 551 mflowtype, mflowid, 552 vrf_id, net->port); 553 *abort_no_unlock = 1; 554 } 555 return (retval); 556 } 557 return (0); 558 } 559 560 static void 561 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp, 562 struct sctp_tcb *stcb, struct sctp_nets *net) 563 { 564 union sctp_sockstore store; 565 struct sctp_nets *r_net, *f_net; 566 struct timeval tv; 567 int req_prim = 0; 568 uint16_t old_error_counter; 569 570 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) { 571 /* Invalid length */ 572 return; 573 } 574 memset(&store, 0, sizeof(store)); 575 switch (cp->heartbeat.hb_info.addr_family) { 576 #ifdef INET 577 case AF_INET: 578 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) { 579 store.sin.sin_family = cp->heartbeat.hb_info.addr_family; 580 store.sin.sin_len = cp->heartbeat.hb_info.addr_len; 581 store.sin.sin_port = stcb->rport; 582 memcpy(&store.sin.sin_addr, cp->heartbeat.hb_info.address, 583 sizeof(store.sin.sin_addr)); 584 } else { 585 return; 586 } 587 break; 588 #endif 589 #ifdef INET6 590 case AF_INET6: 591 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) { 592 store.sin6.sin6_family = cp->heartbeat.hb_info.addr_family; 593 store.sin6.sin6_len = cp->heartbeat.hb_info.addr_len; 594 store.sin6.sin6_port = stcb->rport; 595 memcpy(&store.sin6.sin6_addr, cp->heartbeat.hb_info.address, sizeof(struct in6_addr)); 596 } else { 597 return; 598 } 599 break; 600 #endif 601 default: 602 return; 603 } 604 r_net = sctp_findnet(stcb, &store.sa); 605 if (r_net == NULL) { 606 SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n"); 607 return; 608 } 609 if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) && 610 (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) && 611 (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) { 612 /* 613 * If the its a HB and it's random value is correct when can 614 * confirm the destination. 615 */ 616 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 617 if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) { 618 stcb->asoc.primary_destination = r_net; 619 r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY; 620 f_net = TAILQ_FIRST(&stcb->asoc.nets); 621 if (f_net != r_net) { 622 /* 623 * first one on the list is NOT the primary 624 * sctp_cmpaddr() is much more efficient if 625 * the primary is the first on the list, 626 * make it so. 627 */ 628 TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next); 629 TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next); 630 } 631 req_prim = 1; 632 } 633 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 634 stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED); 635 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, 636 r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4); 637 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net); 638 } 639 old_error_counter = r_net->error_count; 640 r_net->error_count = 0; 641 r_net->hb_responded = 1; 642 tv.tv_sec = cp->heartbeat.hb_info.time_value_1; 643 tv.tv_usec = cp->heartbeat.hb_info.time_value_2; 644 /* Now lets do a RTO with this */ 645 r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv, sctp_align_safe_nocopy, 646 SCTP_RTT_FROM_NON_DATA); 647 if (!(r_net->dest_state & SCTP_ADDR_REACHABLE)) { 648 r_net->dest_state |= SCTP_ADDR_REACHABLE; 649 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb, 650 0, (void *)r_net, SCTP_SO_NOT_LOCKED); 651 } 652 if (r_net->dest_state & SCTP_ADDR_PF) { 653 r_net->dest_state &= ~SCTP_ADDR_PF; 654 stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net); 655 } 656 if (old_error_counter > 0) { 657 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, 658 stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5); 659 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net); 660 } 661 if (r_net == stcb->asoc.primary_destination) { 662 if (stcb->asoc.alternate) { 663 /* release the alternate, primary is good */ 664 sctp_free_remote_addr(stcb->asoc.alternate); 665 stcb->asoc.alternate = NULL; 666 } 667 } 668 /* Mobility adaptation */ 669 if (req_prim) { 670 if ((sctp_is_mobility_feature_on(stcb->sctp_ep, 671 SCTP_MOBILITY_BASE) || 672 sctp_is_mobility_feature_on(stcb->sctp_ep, 673 SCTP_MOBILITY_FASTHANDOFF)) && 674 sctp_is_mobility_feature_on(stcb->sctp_ep, 675 SCTP_MOBILITY_PRIM_DELETED)) { 676 677 sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, 678 stcb->sctp_ep, stcb, NULL, 679 SCTP_FROM_SCTP_INPUT + SCTP_LOC_6); 680 if (sctp_is_mobility_feature_on(stcb->sctp_ep, 681 SCTP_MOBILITY_FASTHANDOFF)) { 682 sctp_assoc_immediate_retrans(stcb, 683 stcb->asoc.primary_destination); 684 } 685 if (sctp_is_mobility_feature_on(stcb->sctp_ep, 686 SCTP_MOBILITY_BASE)) { 687 sctp_move_chunks_from_net(stcb, 688 stcb->asoc.deleted_primary); 689 } 690 sctp_delete_prim_timer(stcb->sctp_ep, stcb, 691 stcb->asoc.deleted_primary); 692 } 693 } 694 } 695 696 static int 697 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb) 698 { 699 /* 700 * return 0 means we want you to proceed with the abort non-zero 701 * means no abort processing 702 */ 703 struct sctpasochead *head; 704 705 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) { 706 /* generate a new vtag and send init */ 707 LIST_REMOVE(stcb, sctp_asocs); 708 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1); 709 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))]; 710 /* 711 * put it in the bucket in the vtag hash of assoc's for the 712 * system 713 */ 714 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 715 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED); 716 return (1); 717 } 718 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) { 719 /* 720 * treat like a case where the cookie expired i.e.: - dump 721 * current cookie. - generate a new vtag. - resend init. 722 */ 723 /* generate a new vtag and send init */ 724 LIST_REMOVE(stcb, sctp_asocs); 725 stcb->asoc.state &= ~SCTP_STATE_COOKIE_ECHOED; 726 stcb->asoc.state |= SCTP_STATE_COOKIE_WAIT; 727 sctp_stop_all_cookie_timers(stcb); 728 sctp_toss_old_cookies(stcb, &stcb->asoc); 729 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1); 730 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))]; 731 /* 732 * put it in the bucket in the vtag hash of assoc's for the 733 * system 734 */ 735 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 736 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED); 737 return (1); 738 } 739 return (0); 740 } 741 742 static int 743 sctp_handle_nat_missing_state(struct sctp_tcb *stcb, 744 struct sctp_nets *net) 745 { 746 /* 747 * return 0 means we want you to proceed with the abort non-zero 748 * means no abort processing 749 */ 750 if (stcb->asoc.auth_supported == 0) { 751 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n"); 752 return (0); 753 } 754 sctp_asconf_send_nat_state_update(stcb, net); 755 return (1); 756 } 757 758 759 static void 760 sctp_handle_abort(struct sctp_abort_chunk *abort, 761 struct sctp_tcb *stcb, struct sctp_nets *net) 762 { 763 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 764 struct socket *so; 765 #endif 766 uint16_t len; 767 uint16_t error; 768 769 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n"); 770 if (stcb == NULL) 771 return; 772 773 len = ntohs(abort->ch.chunk_length); 774 if (len > sizeof(struct sctp_chunkhdr)) { 775 /* 776 * Need to check the cause codes for our two magic nat 777 * aborts which don't kill the assoc necessarily. 778 */ 779 struct sctp_gen_error_cause *cause; 780 781 cause = (struct sctp_gen_error_cause *)(abort + 1); 782 error = ntohs(cause->code); 783 if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) { 784 SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n", 785 abort->ch.chunk_flags); 786 if (sctp_handle_nat_colliding_state(stcb)) { 787 return; 788 } 789 } else if (error == SCTP_CAUSE_NAT_MISSING_STATE) { 790 SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n", 791 abort->ch.chunk_flags); 792 if (sctp_handle_nat_missing_state(stcb, net)) { 793 return; 794 } 795 } 796 } else { 797 error = 0; 798 } 799 /* stop any receive timers */ 800 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, 801 SCTP_FROM_SCTP_INPUT + SCTP_LOC_7); 802 /* notify user of the abort and clean up... */ 803 sctp_abort_notification(stcb, 1, error, abort, SCTP_SO_NOT_LOCKED); 804 /* free the tcb */ 805 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 806 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) || 807 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 808 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 809 } 810 #ifdef SCTP_ASOCLOG_OF_TSNS 811 sctp_print_out_track_log(stcb); 812 #endif 813 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 814 so = SCTP_INP_SO(stcb->sctp_ep); 815 atomic_add_int(&stcb->asoc.refcnt, 1); 816 SCTP_TCB_UNLOCK(stcb); 817 SCTP_SOCKET_LOCK(so, 1); 818 SCTP_TCB_LOCK(stcb); 819 atomic_subtract_int(&stcb->asoc.refcnt, 1); 820 #endif 821 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED; 822 (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, 823 SCTP_FROM_SCTP_INPUT + SCTP_LOC_8); 824 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 825 SCTP_SOCKET_UNLOCK(so, 1); 826 #endif 827 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n"); 828 } 829 830 static void 831 sctp_start_net_timers(struct sctp_tcb *stcb) 832 { 833 uint32_t cnt_hb_sent; 834 struct sctp_nets *net; 835 836 cnt_hb_sent = 0; 837 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 838 /* 839 * For each network start: 1) A pmtu timer. 2) A HB timer 3) 840 * If the dest in unconfirmed send a hb as well if under 841 * max_hb_burst have been sent. 842 */ 843 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net); 844 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net); 845 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) && 846 (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) { 847 sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED); 848 cnt_hb_sent++; 849 } 850 } 851 if (cnt_hb_sent) { 852 sctp_chunk_output(stcb->sctp_ep, stcb, 853 SCTP_OUTPUT_FROM_COOKIE_ACK, 854 SCTP_SO_NOT_LOCKED); 855 } 856 } 857 858 859 static void 860 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp, 861 struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag) 862 { 863 struct sctp_association *asoc; 864 int some_on_streamwheel; 865 int old_state; 866 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 867 struct socket *so; 868 #endif 869 870 SCTPDBG(SCTP_DEBUG_INPUT2, 871 "sctp_handle_shutdown: handling SHUTDOWN\n"); 872 if (stcb == NULL) 873 return; 874 asoc = &stcb->asoc; 875 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 876 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 877 return; 878 } 879 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) { 880 /* Shutdown NOT the expected size */ 881 return; 882 } 883 old_state = SCTP_GET_STATE(asoc); 884 sctp_update_acked(stcb, cp, abort_flag); 885 if (*abort_flag) { 886 return; 887 } 888 if (asoc->control_pdapi) { 889 /* 890 * With a normal shutdown we assume the end of last record. 891 */ 892 SCTP_INP_READ_LOCK(stcb->sctp_ep); 893 if (asoc->control_pdapi->on_strm_q) { 894 struct sctp_stream_in *strm; 895 896 strm = &asoc->strmin[asoc->control_pdapi->sinfo_stream]; 897 if (asoc->control_pdapi->on_strm_q == SCTP_ON_UNORDERED) { 898 /* Unordered */ 899 TAILQ_REMOVE(&strm->uno_inqueue, asoc->control_pdapi, next_instrm); 900 asoc->control_pdapi->on_strm_q = 0; 901 } else if (asoc->control_pdapi->on_strm_q == SCTP_ON_ORDERED) { 902 /* Ordered */ 903 TAILQ_REMOVE(&strm->inqueue, asoc->control_pdapi, next_instrm); 904 asoc->control_pdapi->on_strm_q = 0; 905 #ifdef INVARIANTS 906 } else { 907 panic("Unknown state on ctrl:%p on_strm_q:%d", 908 asoc->control_pdapi, 909 asoc->control_pdapi->on_strm_q); 910 #endif 911 } 912 } 913 asoc->control_pdapi->end_added = 1; 914 asoc->control_pdapi->pdapi_aborted = 1; 915 asoc->control_pdapi = NULL; 916 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 917 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 918 so = SCTP_INP_SO(stcb->sctp_ep); 919 atomic_add_int(&stcb->asoc.refcnt, 1); 920 SCTP_TCB_UNLOCK(stcb); 921 SCTP_SOCKET_LOCK(so, 1); 922 SCTP_TCB_LOCK(stcb); 923 atomic_subtract_int(&stcb->asoc.refcnt, 1); 924 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 925 /* assoc was freed while we were unlocked */ 926 SCTP_SOCKET_UNLOCK(so, 1); 927 return; 928 } 929 #endif 930 if (stcb->sctp_socket) { 931 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 932 } 933 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 934 SCTP_SOCKET_UNLOCK(so, 1); 935 #endif 936 } 937 /* goto SHUTDOWN_RECEIVED state to block new requests */ 938 if (stcb->sctp_socket) { 939 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 940 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) && 941 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 942 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_RECEIVED); 943 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING); 944 /* 945 * notify upper layer that peer has initiated a 946 * shutdown 947 */ 948 sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED); 949 950 /* reset time */ 951 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 952 } 953 } 954 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) { 955 /* 956 * stop the shutdown timer, since we WILL move to 957 * SHUTDOWN-ACK-SENT. 958 */ 959 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 960 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9); 961 } 962 /* Now is there unsent data on a stream somewhere? */ 963 some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED); 964 965 if (!TAILQ_EMPTY(&asoc->send_queue) || 966 !TAILQ_EMPTY(&asoc->sent_queue) || 967 some_on_streamwheel) { 968 /* By returning we will push more data out */ 969 return; 970 } else { 971 /* no outstanding data to send, so move on... */ 972 /* send SHUTDOWN-ACK */ 973 /* move to SHUTDOWN-ACK-SENT state */ 974 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) || 975 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 976 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 977 } 978 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING); 979 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) { 980 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT); 981 sctp_stop_timers_for_shutdown(stcb); 982 sctp_send_shutdown_ack(stcb, net); 983 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, 984 stcb->sctp_ep, stcb, net); 985 } else if (old_state == SCTP_STATE_SHUTDOWN_ACK_SENT) { 986 sctp_send_shutdown_ack(stcb, net); 987 } 988 } 989 } 990 991 static void 992 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED, 993 struct sctp_tcb *stcb, 994 struct sctp_nets *net) 995 { 996 struct sctp_association *asoc; 997 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 998 struct socket *so; 999 1000 so = SCTP_INP_SO(stcb->sctp_ep); 1001 #endif 1002 SCTPDBG(SCTP_DEBUG_INPUT2, 1003 "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n"); 1004 if (stcb == NULL) 1005 return; 1006 1007 asoc = &stcb->asoc; 1008 /* process according to association state */ 1009 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 1010 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 1011 /* unexpected SHUTDOWN-ACK... do OOTB handling... */ 1012 sctp_send_shutdown_complete(stcb, net, 1); 1013 SCTP_TCB_UNLOCK(stcb); 1014 return; 1015 } 1016 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 1017 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 1018 /* unexpected SHUTDOWN-ACK... so ignore... */ 1019 SCTP_TCB_UNLOCK(stcb); 1020 return; 1021 } 1022 if (asoc->control_pdapi) { 1023 /* 1024 * With a normal shutdown we assume the end of last record. 1025 */ 1026 SCTP_INP_READ_LOCK(stcb->sctp_ep); 1027 asoc->control_pdapi->end_added = 1; 1028 asoc->control_pdapi->pdapi_aborted = 1; 1029 asoc->control_pdapi = NULL; 1030 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 1031 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1032 atomic_add_int(&stcb->asoc.refcnt, 1); 1033 SCTP_TCB_UNLOCK(stcb); 1034 SCTP_SOCKET_LOCK(so, 1); 1035 SCTP_TCB_LOCK(stcb); 1036 atomic_subtract_int(&stcb->asoc.refcnt, 1); 1037 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 1038 /* assoc was freed while we were unlocked */ 1039 SCTP_SOCKET_UNLOCK(so, 1); 1040 return; 1041 } 1042 #endif 1043 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 1044 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1045 SCTP_SOCKET_UNLOCK(so, 1); 1046 #endif 1047 } 1048 #ifdef INVARIANTS 1049 if (!TAILQ_EMPTY(&asoc->send_queue) || 1050 !TAILQ_EMPTY(&asoc->sent_queue) || 1051 sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) { 1052 panic("Queues are not empty when handling SHUTDOWN-ACK"); 1053 } 1054 #endif 1055 /* stop the timer */ 1056 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, 1057 SCTP_FROM_SCTP_INPUT + SCTP_LOC_10); 1058 /* send SHUTDOWN-COMPLETE */ 1059 sctp_send_shutdown_complete(stcb, net, 0); 1060 /* notify upper layer protocol */ 1061 if (stcb->sctp_socket) { 1062 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1063 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 1064 stcb->sctp_socket->so_snd.sb_cc = 0; 1065 } 1066 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED); 1067 } 1068 SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 1069 /* free the TCB but first save off the ep */ 1070 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1071 atomic_add_int(&stcb->asoc.refcnt, 1); 1072 SCTP_TCB_UNLOCK(stcb); 1073 SCTP_SOCKET_LOCK(so, 1); 1074 SCTP_TCB_LOCK(stcb); 1075 atomic_subtract_int(&stcb->asoc.refcnt, 1); 1076 #endif 1077 (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, 1078 SCTP_FROM_SCTP_INPUT + SCTP_LOC_11); 1079 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1080 SCTP_SOCKET_UNLOCK(so, 1); 1081 #endif 1082 } 1083 1084 /* 1085 * Skip past the param header and then we will find the chunk that caused the 1086 * problem. There are two possibilities ASCONF or FWD-TSN other than that and 1087 * our peer must be broken. 1088 */ 1089 static void 1090 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr, 1091 struct sctp_nets *net) 1092 { 1093 struct sctp_chunkhdr *chk; 1094 1095 chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr)); 1096 switch (chk->chunk_type) { 1097 case SCTP_ASCONF_ACK: 1098 case SCTP_ASCONF: 1099 sctp_asconf_cleanup(stcb, net); 1100 break; 1101 case SCTP_IFORWARD_CUM_TSN: 1102 case SCTP_FORWARD_CUM_TSN: 1103 stcb->asoc.prsctp_supported = 0; 1104 break; 1105 default: 1106 SCTPDBG(SCTP_DEBUG_INPUT2, 1107 "Peer does not support chunk type %d(%x)??\n", 1108 chk->chunk_type, (uint32_t)chk->chunk_type); 1109 break; 1110 } 1111 } 1112 1113 /* 1114 * Skip past the param header and then we will find the param that caused the 1115 * problem. There are a number of param's in a ASCONF OR the prsctp param 1116 * these will turn of specific features. 1117 * XXX: Is this the right thing to do? 1118 */ 1119 static void 1120 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr) 1121 { 1122 struct sctp_paramhdr *pbad; 1123 1124 pbad = phdr + 1; 1125 switch (ntohs(pbad->param_type)) { 1126 /* pr-sctp draft */ 1127 case SCTP_PRSCTP_SUPPORTED: 1128 stcb->asoc.prsctp_supported = 0; 1129 break; 1130 case SCTP_SUPPORTED_CHUNK_EXT: 1131 break; 1132 /* draft-ietf-tsvwg-addip-sctp */ 1133 case SCTP_HAS_NAT_SUPPORT: 1134 stcb->asoc.peer_supports_nat = 0; 1135 break; 1136 case SCTP_ADD_IP_ADDRESS: 1137 case SCTP_DEL_IP_ADDRESS: 1138 case SCTP_SET_PRIM_ADDR: 1139 stcb->asoc.asconf_supported = 0; 1140 break; 1141 case SCTP_SUCCESS_REPORT: 1142 case SCTP_ERROR_CAUSE_IND: 1143 SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n"); 1144 SCTPDBG(SCTP_DEBUG_INPUT2, 1145 "Turning off ASCONF to this strange peer\n"); 1146 stcb->asoc.asconf_supported = 0; 1147 break; 1148 default: 1149 SCTPDBG(SCTP_DEBUG_INPUT2, 1150 "Peer does not support param type %d(%x)??\n", 1151 pbad->param_type, (uint32_t)pbad->param_type); 1152 break; 1153 } 1154 } 1155 1156 static int 1157 sctp_handle_error(struct sctp_chunkhdr *ch, 1158 struct sctp_tcb *stcb, struct sctp_nets *net) 1159 { 1160 int chklen; 1161 struct sctp_paramhdr *phdr; 1162 uint16_t error, error_type; 1163 uint16_t error_len; 1164 struct sctp_association *asoc; 1165 int adjust; 1166 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1167 struct socket *so; 1168 #endif 1169 1170 /* parse through all of the errors and process */ 1171 asoc = &stcb->asoc; 1172 phdr = (struct sctp_paramhdr *)((caddr_t)ch + 1173 sizeof(struct sctp_chunkhdr)); 1174 chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr); 1175 error = 0; 1176 while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) { 1177 /* Process an Error Cause */ 1178 error_type = ntohs(phdr->param_type); 1179 error_len = ntohs(phdr->param_length); 1180 if ((error_len > chklen) || (error_len == 0)) { 1181 /* invalid param length for this param */ 1182 SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n", 1183 chklen, error_len); 1184 return (0); 1185 } 1186 if (error == 0) { 1187 /* report the first error cause */ 1188 error = error_type; 1189 } 1190 switch (error_type) { 1191 case SCTP_CAUSE_INVALID_STREAM: 1192 case SCTP_CAUSE_MISSING_PARAM: 1193 case SCTP_CAUSE_INVALID_PARAM: 1194 case SCTP_CAUSE_NO_USER_DATA: 1195 SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n", 1196 error_type); 1197 break; 1198 case SCTP_CAUSE_NAT_COLLIDING_STATE: 1199 SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n", 1200 ch->chunk_flags); 1201 if (sctp_handle_nat_colliding_state(stcb)) { 1202 return (0); 1203 } 1204 break; 1205 case SCTP_CAUSE_NAT_MISSING_STATE: 1206 SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n", 1207 ch->chunk_flags); 1208 if (sctp_handle_nat_missing_state(stcb, net)) { 1209 return (0); 1210 } 1211 break; 1212 case SCTP_CAUSE_STALE_COOKIE: 1213 /* 1214 * We only act if we have echoed a cookie and are 1215 * waiting. 1216 */ 1217 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 1218 int *p; 1219 1220 p = (int *)((caddr_t)phdr + sizeof(*phdr)); 1221 /* Save the time doubled */ 1222 asoc->cookie_preserve_req = ntohl(*p) << 1; 1223 asoc->stale_cookie_count++; 1224 if (asoc->stale_cookie_count > 1225 asoc->max_init_times) { 1226 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED); 1227 /* now free the asoc */ 1228 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1229 so = SCTP_INP_SO(stcb->sctp_ep); 1230 atomic_add_int(&stcb->asoc.refcnt, 1); 1231 SCTP_TCB_UNLOCK(stcb); 1232 SCTP_SOCKET_LOCK(so, 1); 1233 SCTP_TCB_LOCK(stcb); 1234 atomic_subtract_int(&stcb->asoc.refcnt, 1); 1235 #endif 1236 (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, 1237 SCTP_FROM_SCTP_INPUT + SCTP_LOC_12); 1238 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1239 SCTP_SOCKET_UNLOCK(so, 1); 1240 #endif 1241 return (-1); 1242 } 1243 /* blast back to INIT state */ 1244 sctp_toss_old_cookies(stcb, &stcb->asoc); 1245 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED; 1246 asoc->state |= SCTP_STATE_COOKIE_WAIT; 1247 sctp_stop_all_cookie_timers(stcb); 1248 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED); 1249 } 1250 break; 1251 case SCTP_CAUSE_UNRESOLVABLE_ADDR: 1252 /* 1253 * Nothing we can do here, we don't do hostname 1254 * addresses so if the peer does not like my IPv6 1255 * (or IPv4 for that matter) it does not matter. If 1256 * they don't support that type of address, they can 1257 * NOT possibly get that packet type... i.e. with no 1258 * IPv6 you can't receive a IPv6 packet. so we can 1259 * safely ignore this one. If we ever added support 1260 * for HOSTNAME Addresses, then we would need to do 1261 * something here. 1262 */ 1263 break; 1264 case SCTP_CAUSE_UNRECOG_CHUNK: 1265 sctp_process_unrecog_chunk(stcb, phdr, net); 1266 break; 1267 case SCTP_CAUSE_UNRECOG_PARAM: 1268 sctp_process_unrecog_param(stcb, phdr); 1269 break; 1270 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN: 1271 /* 1272 * We ignore this since the timer will drive out a 1273 * new cookie anyway and there timer will drive us 1274 * to send a SHUTDOWN_COMPLETE. We can't send one 1275 * here since we don't have their tag. 1276 */ 1277 break; 1278 case SCTP_CAUSE_DELETING_LAST_ADDR: 1279 case SCTP_CAUSE_RESOURCE_SHORTAGE: 1280 case SCTP_CAUSE_DELETING_SRC_ADDR: 1281 /* 1282 * We should NOT get these here, but in a 1283 * ASCONF-ACK. 1284 */ 1285 SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n", 1286 error_type); 1287 break; 1288 case SCTP_CAUSE_OUT_OF_RESC: 1289 /* 1290 * And what, pray tell do we do with the fact that 1291 * the peer is out of resources? Not really sure we 1292 * could do anything but abort. I suspect this 1293 * should have came WITH an abort instead of in a 1294 * OP-ERROR. 1295 */ 1296 break; 1297 default: 1298 SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n", 1299 error_type); 1300 break; 1301 } 1302 adjust = SCTP_SIZE32(error_len); 1303 chklen -= adjust; 1304 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust); 1305 } 1306 sctp_ulp_notify(SCTP_NOTIFY_REMOTE_ERROR, stcb, error, ch, SCTP_SO_NOT_LOCKED); 1307 return (0); 1308 } 1309 1310 static int 1311 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset, 1312 struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh, 1313 struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 1314 struct sctp_nets *net, int *abort_no_unlock, 1315 uint8_t mflowtype, uint32_t mflowid, 1316 uint32_t vrf_id) 1317 { 1318 struct sctp_init_ack *init_ack; 1319 struct mbuf *op_err; 1320 1321 SCTPDBG(SCTP_DEBUG_INPUT2, 1322 "sctp_handle_init_ack: handling INIT-ACK\n"); 1323 1324 if (stcb == NULL) { 1325 SCTPDBG(SCTP_DEBUG_INPUT2, 1326 "sctp_handle_init_ack: TCB is null\n"); 1327 return (-1); 1328 } 1329 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) { 1330 /* Invalid length */ 1331 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, ""); 1332 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 1333 src, dst, sh, op_err, 1334 mflowtype, mflowid, 1335 vrf_id, net->port); 1336 *abort_no_unlock = 1; 1337 return (-1); 1338 } 1339 init_ack = &cp->init; 1340 /* validate parameters */ 1341 if (init_ack->initiate_tag == 0) { 1342 /* protocol error... send an abort */ 1343 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, ""); 1344 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 1345 src, dst, sh, op_err, 1346 mflowtype, mflowid, 1347 vrf_id, net->port); 1348 *abort_no_unlock = 1; 1349 return (-1); 1350 } 1351 if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) { 1352 /* protocol error... send an abort */ 1353 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, ""); 1354 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 1355 src, dst, sh, op_err, 1356 mflowtype, mflowid, 1357 vrf_id, net->port); 1358 *abort_no_unlock = 1; 1359 return (-1); 1360 } 1361 if (init_ack->num_inbound_streams == 0) { 1362 /* protocol error... send an abort */ 1363 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, ""); 1364 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 1365 src, dst, sh, op_err, 1366 mflowtype, mflowid, 1367 vrf_id, net->port); 1368 *abort_no_unlock = 1; 1369 return (-1); 1370 } 1371 if (init_ack->num_outbound_streams == 0) { 1372 /* protocol error... send an abort */ 1373 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, ""); 1374 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 1375 src, dst, sh, op_err, 1376 mflowtype, mflowid, 1377 vrf_id, net->port); 1378 *abort_no_unlock = 1; 1379 return (-1); 1380 } 1381 /* process according to association state... */ 1382 switch (stcb->asoc.state & SCTP_STATE_MASK) { 1383 case SCTP_STATE_COOKIE_WAIT: 1384 /* this is the expected state for this chunk */ 1385 /* process the INIT-ACK parameters */ 1386 if (stcb->asoc.primary_destination->dest_state & 1387 SCTP_ADDR_UNCONFIRMED) { 1388 /* 1389 * The primary is where we sent the INIT, we can 1390 * always consider it confirmed when the INIT-ACK is 1391 * returned. Do this before we load addresses 1392 * though. 1393 */ 1394 stcb->asoc.primary_destination->dest_state &= 1395 ~SCTP_ADDR_UNCONFIRMED; 1396 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 1397 stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED); 1398 } 1399 if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb, 1400 net, abort_no_unlock, 1401 mflowtype, mflowid, 1402 vrf_id) < 0) { 1403 /* error in parsing parameters */ 1404 return (-1); 1405 } 1406 /* update our state */ 1407 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n"); 1408 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_ECHOED); 1409 1410 /* reset the RTO calc */ 1411 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 1412 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 1413 stcb->asoc.overall_error_count, 1414 0, 1415 SCTP_FROM_SCTP_INPUT, 1416 __LINE__); 1417 } 1418 stcb->asoc.overall_error_count = 0; 1419 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered); 1420 /* 1421 * collapse the init timer back in case of a exponential 1422 * backoff 1423 */ 1424 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep, 1425 stcb, net); 1426 /* 1427 * the send at the end of the inbound data processing will 1428 * cause the cookie to be sent 1429 */ 1430 break; 1431 case SCTP_STATE_SHUTDOWN_SENT: 1432 /* incorrect state... discard */ 1433 break; 1434 case SCTP_STATE_COOKIE_ECHOED: 1435 /* incorrect state... discard */ 1436 break; 1437 case SCTP_STATE_OPEN: 1438 /* incorrect state... discard */ 1439 break; 1440 case SCTP_STATE_EMPTY: 1441 case SCTP_STATE_INUSE: 1442 default: 1443 /* incorrect state... discard */ 1444 return (-1); 1445 break; 1446 } 1447 SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n"); 1448 return (0); 1449 } 1450 1451 static struct sctp_tcb * 1452 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset, 1453 struct sockaddr *src, struct sockaddr *dst, 1454 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1455 struct sctp_inpcb *inp, struct sctp_nets **netp, 1456 struct sockaddr *init_src, int *notification, 1457 int auth_skipped, uint32_t auth_offset, uint32_t auth_len, 1458 uint8_t mflowtype, uint32_t mflowid, 1459 uint32_t vrf_id, uint16_t port); 1460 1461 1462 /* 1463 * handle a state cookie for an existing association m: input packet mbuf 1464 * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a 1465 * "split" mbuf and the cookie signature does not exist offset: offset into 1466 * mbuf to the cookie-echo chunk 1467 */ 1468 static struct sctp_tcb * 1469 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset, 1470 struct sockaddr *src, struct sockaddr *dst, 1471 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1472 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp, 1473 struct sockaddr *init_src, int *notification, 1474 int auth_skipped, uint32_t auth_offset, uint32_t auth_len, 1475 uint8_t mflowtype, uint32_t mflowid, 1476 uint32_t vrf_id, uint16_t port) 1477 { 1478 struct sctp_association *asoc; 1479 struct sctp_init_chunk *init_cp, init_buf; 1480 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1481 struct sctp_nets *net; 1482 struct mbuf *op_err; 1483 int init_offset, initack_offset, i; 1484 int retval; 1485 int spec_flag = 0; 1486 uint32_t how_indx; 1487 #if defined(SCTP_DETAILED_STR_STATS) 1488 int j; 1489 #endif 1490 1491 net = *netp; 1492 /* I know that the TCB is non-NULL from the caller */ 1493 asoc = &stcb->asoc; 1494 for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) { 1495 if (asoc->cookie_how[how_indx] == 0) 1496 break; 1497 } 1498 if (how_indx < sizeof(asoc->cookie_how)) { 1499 asoc->cookie_how[how_indx] = 1; 1500 } 1501 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) { 1502 /* SHUTDOWN came in after sending INIT-ACK */ 1503 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 1504 op_err = sctp_generate_cause(SCTP_CAUSE_COOKIE_IN_SHUTDOWN, ""); 1505 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err, 1506 mflowtype, mflowid, inp->fibnum, 1507 vrf_id, net->port); 1508 if (how_indx < sizeof(asoc->cookie_how)) 1509 asoc->cookie_how[how_indx] = 2; 1510 return (NULL); 1511 } 1512 /* 1513 * find and validate the INIT chunk in the cookie (peer's info) the 1514 * INIT should start after the cookie-echo header struct (chunk 1515 * header, state cookie header struct) 1516 */ 1517 init_offset = offset += sizeof(struct sctp_cookie_echo_chunk); 1518 1519 init_cp = (struct sctp_init_chunk *) 1520 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1521 (uint8_t *)&init_buf); 1522 if (init_cp == NULL) { 1523 /* could not pull a INIT chunk in cookie */ 1524 return (NULL); 1525 } 1526 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1527 return (NULL); 1528 } 1529 /* 1530 * find and validate the INIT-ACK chunk in the cookie (my info) the 1531 * INIT-ACK follows the INIT chunk 1532 */ 1533 initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length)); 1534 initack_cp = (struct sctp_init_ack_chunk *) 1535 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1536 (uint8_t *)&initack_buf); 1537 if (initack_cp == NULL) { 1538 /* could not pull INIT-ACK chunk in cookie */ 1539 return (NULL); 1540 } 1541 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1542 return (NULL); 1543 } 1544 if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) && 1545 (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) { 1546 /* 1547 * case D in Section 5.2.4 Table 2: MMAA process accordingly 1548 * to get into the OPEN state 1549 */ 1550 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) { 1551 /*- 1552 * Opps, this means that we somehow generated two vtag's 1553 * the same. I.e. we did: 1554 * Us Peer 1555 * <---INIT(tag=a)------ 1556 * ----INIT-ACK(tag=t)--> 1557 * ----INIT(tag=t)------> *1 1558 * <---INIT-ACK(tag=a)--- 1559 * <----CE(tag=t)------------- *2 1560 * 1561 * At point *1 we should be generating a different 1562 * tag t'. Which means we would throw away the CE and send 1563 * ours instead. Basically this is case C (throw away side). 1564 */ 1565 if (how_indx < sizeof(asoc->cookie_how)) 1566 asoc->cookie_how[how_indx] = 17; 1567 return (NULL); 1568 1569 } 1570 switch (SCTP_GET_STATE(asoc)) { 1571 case SCTP_STATE_COOKIE_WAIT: 1572 case SCTP_STATE_COOKIE_ECHOED: 1573 /* 1574 * INIT was sent but got a COOKIE_ECHO with the 1575 * correct tags... just accept it...but we must 1576 * process the init so that we can make sure we have 1577 * the right seq no's. 1578 */ 1579 /* First we must process the INIT !! */ 1580 retval = sctp_process_init(init_cp, stcb); 1581 if (retval < 0) { 1582 if (how_indx < sizeof(asoc->cookie_how)) 1583 asoc->cookie_how[how_indx] = 3; 1584 return (NULL); 1585 } 1586 /* we have already processed the INIT so no problem */ 1587 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, 1588 stcb, net, 1589 SCTP_FROM_SCTP_INPUT + SCTP_LOC_13); 1590 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, 1591 stcb, net, 1592 SCTP_FROM_SCTP_INPUT + SCTP_LOC_14); 1593 /* update current state */ 1594 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) 1595 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1596 else 1597 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1598 1599 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN); 1600 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1601 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1602 stcb->sctp_ep, stcb, asoc->primary_destination); 1603 } 1604 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1605 sctp_stop_all_cookie_timers(stcb); 1606 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1607 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1608 (inp->sctp_socket->so_qlimit == 0) 1609 ) { 1610 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1611 struct socket *so; 1612 #endif 1613 /* 1614 * Here is where collision would go if we 1615 * did a connect() and instead got a 1616 * init/init-ack/cookie done before the 1617 * init-ack came back.. 1618 */ 1619 stcb->sctp_ep->sctp_flags |= 1620 SCTP_PCB_FLAGS_CONNECTED; 1621 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1622 so = SCTP_INP_SO(stcb->sctp_ep); 1623 atomic_add_int(&stcb->asoc.refcnt, 1); 1624 SCTP_TCB_UNLOCK(stcb); 1625 SCTP_SOCKET_LOCK(so, 1); 1626 SCTP_TCB_LOCK(stcb); 1627 atomic_add_int(&stcb->asoc.refcnt, -1); 1628 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 1629 SCTP_SOCKET_UNLOCK(so, 1); 1630 return (NULL); 1631 } 1632 #endif 1633 soisconnected(stcb->sctp_socket); 1634 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1635 SCTP_SOCKET_UNLOCK(so, 1); 1636 #endif 1637 } 1638 /* notify upper layer */ 1639 *notification = SCTP_NOTIFY_ASSOC_UP; 1640 /* 1641 * since we did not send a HB make sure we don't 1642 * double things 1643 */ 1644 net->hb_responded = 1; 1645 net->RTO = sctp_calculate_rto(stcb, asoc, net, 1646 &cookie->time_entered, 1647 sctp_align_unsafe_makecopy, 1648 SCTP_RTT_FROM_NON_DATA); 1649 1650 if (stcb->asoc.sctp_autoclose_ticks && 1651 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) { 1652 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 1653 inp, stcb, NULL); 1654 } 1655 break; 1656 default: 1657 /* 1658 * we're in the OPEN state (or beyond), so peer must 1659 * have simply lost the COOKIE-ACK 1660 */ 1661 break; 1662 } /* end switch */ 1663 sctp_stop_all_cookie_timers(stcb); 1664 /* 1665 * We ignore the return code here.. not sure if we should 1666 * somehow abort.. but we do have an existing asoc. This 1667 * really should not fail. 1668 */ 1669 if (sctp_load_addresses_from_init(stcb, m, 1670 init_offset + sizeof(struct sctp_init_chunk), 1671 initack_offset, src, dst, init_src, stcb->asoc.port)) { 1672 if (how_indx < sizeof(asoc->cookie_how)) 1673 asoc->cookie_how[how_indx] = 4; 1674 return (NULL); 1675 } 1676 /* respond with a COOKIE-ACK */ 1677 sctp_toss_old_cookies(stcb, asoc); 1678 sctp_send_cookie_ack(stcb); 1679 if (how_indx < sizeof(asoc->cookie_how)) 1680 asoc->cookie_how[how_indx] = 5; 1681 return (stcb); 1682 } 1683 if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1684 ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag && 1685 cookie->tie_tag_my_vtag == 0 && 1686 cookie->tie_tag_peer_vtag == 0) { 1687 /* 1688 * case C in Section 5.2.4 Table 2: XMOO silently discard 1689 */ 1690 if (how_indx < sizeof(asoc->cookie_how)) 1691 asoc->cookie_how[how_indx] = 6; 1692 return (NULL); 1693 } 1694 /* 1695 * If nat support, and the below and stcb is established, send back 1696 * a ABORT(colliding state) if we are established. 1697 */ 1698 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) && 1699 (asoc->peer_supports_nat) && 1700 ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) && 1701 ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) || 1702 (asoc->peer_vtag == 0)))) { 1703 /* 1704 * Special case - Peer's support nat. We may have two init's 1705 * that we gave out the same tag on since one was not 1706 * established.. i.e. we get INIT from host-1 behind the nat 1707 * and we respond tag-a, we get a INIT from host-2 behind 1708 * the nat and we get tag-a again. Then we bring up host-1 1709 * (or 2's) assoc, Then comes the cookie from hsot-2 (or 1). 1710 * Now we have colliding state. We must send an abort here 1711 * with colliding state indication. 1712 */ 1713 op_err = sctp_generate_cause(SCTP_CAUSE_NAT_COLLIDING_STATE, ""); 1714 sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err, 1715 mflowtype, mflowid, inp->fibnum, 1716 vrf_id, port); 1717 return (NULL); 1718 } 1719 if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) && 1720 ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) || 1721 (asoc->peer_vtag == 0))) { 1722 /* 1723 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info 1724 * should be ok, re-accept peer info 1725 */ 1726 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) { 1727 /* 1728 * Extension of case C. If we hit this, then the 1729 * random number generator returned the same vtag 1730 * when we first sent our INIT-ACK and when we later 1731 * sent our INIT. The side with the seq numbers that 1732 * are different will be the one that normnally 1733 * would have hit case C. This in effect "extends" 1734 * our vtags in this collision case to be 64 bits. 1735 * The same collision could occur aka you get both 1736 * vtag and seq number the same twice in a row.. but 1737 * is much less likely. If it did happen then we 1738 * would proceed through and bring up the assoc.. we 1739 * may end up with the wrong stream setup however.. 1740 * which would be bad.. but there is no way to 1741 * tell.. until we send on a stream that does not 1742 * exist :-) 1743 */ 1744 if (how_indx < sizeof(asoc->cookie_how)) 1745 asoc->cookie_how[how_indx] = 7; 1746 1747 return (NULL); 1748 } 1749 if (how_indx < sizeof(asoc->cookie_how)) 1750 asoc->cookie_how[how_indx] = 8; 1751 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, 1752 SCTP_FROM_SCTP_INPUT + SCTP_LOC_15); 1753 sctp_stop_all_cookie_timers(stcb); 1754 /* 1755 * since we did not send a HB make sure we don't double 1756 * things 1757 */ 1758 net->hb_responded = 1; 1759 if (stcb->asoc.sctp_autoclose_ticks && 1760 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1761 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, 1762 NULL); 1763 } 1764 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1765 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1766 1767 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) { 1768 /* 1769 * Ok the peer probably discarded our data (if we 1770 * echoed a cookie+data). So anything on the 1771 * sent_queue should be marked for retransmit, we 1772 * may not get something to kick us so it COULD 1773 * still take a timeout to move these.. but it can't 1774 * hurt to mark them. 1775 */ 1776 struct sctp_tmit_chunk *chk; 1777 1778 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 1779 if (chk->sent < SCTP_DATAGRAM_RESEND) { 1780 chk->sent = SCTP_DATAGRAM_RESEND; 1781 sctp_flight_size_decrease(chk); 1782 sctp_total_flight_decrease(stcb, chk); 1783 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 1784 spec_flag++; 1785 } 1786 } 1787 1788 } 1789 /* process the INIT info (peer's info) */ 1790 retval = sctp_process_init(init_cp, stcb); 1791 if (retval < 0) { 1792 if (how_indx < sizeof(asoc->cookie_how)) 1793 asoc->cookie_how[how_indx] = 9; 1794 return (NULL); 1795 } 1796 if (sctp_load_addresses_from_init(stcb, m, 1797 init_offset + sizeof(struct sctp_init_chunk), 1798 initack_offset, src, dst, init_src, stcb->asoc.port)) { 1799 if (how_indx < sizeof(asoc->cookie_how)) 1800 asoc->cookie_how[how_indx] = 10; 1801 return (NULL); 1802 } 1803 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) || 1804 (asoc->state & SCTP_STATE_COOKIE_ECHOED)) { 1805 *notification = SCTP_NOTIFY_ASSOC_UP; 1806 1807 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1808 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1809 (inp->sctp_socket->so_qlimit == 0)) { 1810 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1811 struct socket *so; 1812 #endif 1813 stcb->sctp_ep->sctp_flags |= 1814 SCTP_PCB_FLAGS_CONNECTED; 1815 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1816 so = SCTP_INP_SO(stcb->sctp_ep); 1817 atomic_add_int(&stcb->asoc.refcnt, 1); 1818 SCTP_TCB_UNLOCK(stcb); 1819 SCTP_SOCKET_LOCK(so, 1); 1820 SCTP_TCB_LOCK(stcb); 1821 atomic_add_int(&stcb->asoc.refcnt, -1); 1822 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 1823 SCTP_SOCKET_UNLOCK(so, 1); 1824 return (NULL); 1825 } 1826 #endif 1827 soisconnected(stcb->sctp_socket); 1828 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1829 SCTP_SOCKET_UNLOCK(so, 1); 1830 #endif 1831 } 1832 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) 1833 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1834 else 1835 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1836 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1837 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 1838 SCTP_STAT_INCR_COUNTER32(sctps_restartestab); 1839 } else { 1840 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1841 } 1842 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN); 1843 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1844 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1845 stcb->sctp_ep, stcb, asoc->primary_destination); 1846 } 1847 sctp_stop_all_cookie_timers(stcb); 1848 sctp_toss_old_cookies(stcb, asoc); 1849 sctp_send_cookie_ack(stcb); 1850 if (spec_flag) { 1851 /* 1852 * only if we have retrans set do we do this. What 1853 * this call does is get only the COOKIE-ACK out and 1854 * then when we return the normal call to 1855 * sctp_chunk_output will get the retrans out behind 1856 * this. 1857 */ 1858 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED); 1859 } 1860 if (how_indx < sizeof(asoc->cookie_how)) 1861 asoc->cookie_how[how_indx] = 11; 1862 1863 return (stcb); 1864 } 1865 if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1866 ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) && 1867 cookie->tie_tag_my_vtag == asoc->my_vtag_nonce && 1868 cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce && 1869 cookie->tie_tag_peer_vtag != 0) { 1870 struct sctpasochead *head; 1871 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1872 struct socket *so; 1873 #endif 1874 1875 if (asoc->peer_supports_nat) { 1876 /* 1877 * This is a gross gross hack. Just call the 1878 * cookie_new code since we are allowing a duplicate 1879 * association. I hope this works... 1880 */ 1881 return (sctp_process_cookie_new(m, iphlen, offset, src, dst, 1882 sh, cookie, cookie_len, 1883 inp, netp, init_src, notification, 1884 auth_skipped, auth_offset, auth_len, 1885 mflowtype, mflowid, 1886 vrf_id, port)); 1887 } 1888 /* 1889 * case A in Section 5.2.4 Table 2: XXMM (peer restarted) 1890 */ 1891 /* temp code */ 1892 if (how_indx < sizeof(asoc->cookie_how)) 1893 asoc->cookie_how[how_indx] = 12; 1894 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, 1895 SCTP_FROM_SCTP_INPUT + SCTP_LOC_16); 1896 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, 1897 SCTP_FROM_SCTP_INPUT + SCTP_LOC_17); 1898 1899 /* notify upper layer */ 1900 *notification = SCTP_NOTIFY_ASSOC_RESTART; 1901 atomic_add_int(&stcb->asoc.refcnt, 1); 1902 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) && 1903 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 1904 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 1905 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1906 } 1907 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 1908 SCTP_STAT_INCR_GAUGE32(sctps_restartestab); 1909 } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) { 1910 SCTP_STAT_INCR_GAUGE32(sctps_collisionestab); 1911 } 1912 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1913 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN); 1914 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1915 stcb->sctp_ep, stcb, asoc->primary_destination); 1916 1917 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) { 1918 /* move to OPEN state, if not in SHUTDOWN_SENT */ 1919 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN); 1920 } 1921 asoc->pre_open_streams = 1922 ntohs(initack_cp->init.num_outbound_streams); 1923 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1924 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1925 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1; 1926 1927 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1928 1929 asoc->str_reset_seq_in = asoc->init_seq_number; 1930 1931 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1932 if (asoc->mapping_array) { 1933 memset(asoc->mapping_array, 0, 1934 asoc->mapping_array_size); 1935 } 1936 if (asoc->nr_mapping_array) { 1937 memset(asoc->nr_mapping_array, 0, 1938 asoc->mapping_array_size); 1939 } 1940 SCTP_TCB_UNLOCK(stcb); 1941 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1942 so = SCTP_INP_SO(stcb->sctp_ep); 1943 SCTP_SOCKET_LOCK(so, 1); 1944 #endif 1945 SCTP_INP_INFO_WLOCK(); 1946 SCTP_INP_WLOCK(stcb->sctp_ep); 1947 SCTP_TCB_LOCK(stcb); 1948 atomic_add_int(&stcb->asoc.refcnt, -1); 1949 /* send up all the data */ 1950 SCTP_TCB_SEND_LOCK(stcb); 1951 1952 sctp_report_all_outbound(stcb, 0, 1, SCTP_SO_LOCKED); 1953 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 1954 stcb->asoc.strmout[i].chunks_on_queues = 0; 1955 #if defined(SCTP_DETAILED_STR_STATS) 1956 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 1957 asoc->strmout[i].abandoned_sent[j] = 0; 1958 asoc->strmout[i].abandoned_unsent[j] = 0; 1959 } 1960 #else 1961 asoc->strmout[i].abandoned_sent[0] = 0; 1962 asoc->strmout[i].abandoned_unsent[0] = 0; 1963 #endif 1964 stcb->asoc.strmout[i].sid = i; 1965 stcb->asoc.strmout[i].next_mid_ordered = 0; 1966 stcb->asoc.strmout[i].next_mid_unordered = 0; 1967 stcb->asoc.strmout[i].last_msg_incomplete = 0; 1968 } 1969 /* process the INIT-ACK info (my info) */ 1970 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1971 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1972 1973 /* pull from vtag hash */ 1974 LIST_REMOVE(stcb, sctp_asocs); 1975 /* re-insert to new vtag position */ 1976 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, 1977 SCTP_BASE_INFO(hashasocmark))]; 1978 /* 1979 * put it in the bucket in the vtag hash of assoc's for the 1980 * system 1981 */ 1982 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 1983 1984 SCTP_TCB_SEND_UNLOCK(stcb); 1985 SCTP_INP_WUNLOCK(stcb->sctp_ep); 1986 SCTP_INP_INFO_WUNLOCK(); 1987 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1988 SCTP_SOCKET_UNLOCK(so, 1); 1989 #endif 1990 asoc->total_flight = 0; 1991 asoc->total_flight_count = 0; 1992 /* process the INIT info (peer's info) */ 1993 retval = sctp_process_init(init_cp, stcb); 1994 if (retval < 0) { 1995 if (how_indx < sizeof(asoc->cookie_how)) 1996 asoc->cookie_how[how_indx] = 13; 1997 1998 return (NULL); 1999 } 2000 /* 2001 * since we did not send a HB make sure we don't double 2002 * things 2003 */ 2004 net->hb_responded = 1; 2005 2006 if (sctp_load_addresses_from_init(stcb, m, 2007 init_offset + sizeof(struct sctp_init_chunk), 2008 initack_offset, src, dst, init_src, stcb->asoc.port)) { 2009 if (how_indx < sizeof(asoc->cookie_how)) 2010 asoc->cookie_how[how_indx] = 14; 2011 2012 return (NULL); 2013 } 2014 /* respond with a COOKIE-ACK */ 2015 sctp_stop_all_cookie_timers(stcb); 2016 sctp_toss_old_cookies(stcb, asoc); 2017 sctp_send_cookie_ack(stcb); 2018 if (how_indx < sizeof(asoc->cookie_how)) 2019 asoc->cookie_how[how_indx] = 15; 2020 2021 return (stcb); 2022 } 2023 if (how_indx < sizeof(asoc->cookie_how)) 2024 asoc->cookie_how[how_indx] = 16; 2025 /* all other cases... */ 2026 return (NULL); 2027 } 2028 2029 2030 /* 2031 * handle a state cookie for a new association m: input packet mbuf chain-- 2032 * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf 2033 * and the cookie signature does not exist offset: offset into mbuf to the 2034 * cookie-echo chunk length: length of the cookie chunk to: where the init 2035 * was from returns a new TCB 2036 */ 2037 static struct sctp_tcb * 2038 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset, 2039 struct sockaddr *src, struct sockaddr *dst, 2040 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 2041 struct sctp_inpcb *inp, struct sctp_nets **netp, 2042 struct sockaddr *init_src, int *notification, 2043 int auth_skipped, uint32_t auth_offset, uint32_t auth_len, 2044 uint8_t mflowtype, uint32_t mflowid, 2045 uint32_t vrf_id, uint16_t port) 2046 { 2047 struct sctp_tcb *stcb; 2048 struct sctp_init_chunk *init_cp, init_buf; 2049 struct sctp_init_ack_chunk *initack_cp, initack_buf; 2050 union sctp_sockstore store; 2051 struct sctp_association *asoc; 2052 int init_offset, initack_offset, initack_limit; 2053 int retval; 2054 int error = 0; 2055 uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE]; 2056 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2057 struct socket *so; 2058 2059 so = SCTP_INP_SO(inp); 2060 #endif 2061 2062 /* 2063 * find and validate the INIT chunk in the cookie (peer's info) the 2064 * INIT should start after the cookie-echo header struct (chunk 2065 * header, state cookie header struct) 2066 */ 2067 init_offset = offset + sizeof(struct sctp_cookie_echo_chunk); 2068 init_cp = (struct sctp_init_chunk *) 2069 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 2070 (uint8_t *)&init_buf); 2071 if (init_cp == NULL) { 2072 /* could not pull a INIT chunk in cookie */ 2073 SCTPDBG(SCTP_DEBUG_INPUT1, 2074 "process_cookie_new: could not pull INIT chunk hdr\n"); 2075 return (NULL); 2076 } 2077 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 2078 SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n"); 2079 return (NULL); 2080 } 2081 initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length)); 2082 /* 2083 * find and validate the INIT-ACK chunk in the cookie (my info) the 2084 * INIT-ACK follows the INIT chunk 2085 */ 2086 initack_cp = (struct sctp_init_ack_chunk *) 2087 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 2088 (uint8_t *)&initack_buf); 2089 if (initack_cp == NULL) { 2090 /* could not pull INIT-ACK chunk in cookie */ 2091 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n"); 2092 return (NULL); 2093 } 2094 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 2095 return (NULL); 2096 } 2097 /* 2098 * NOTE: We can't use the INIT_ACK's chk_length to determine the 2099 * "initack_limit" value. This is because the chk_length field 2100 * includes the length of the cookie, but the cookie is omitted when 2101 * the INIT and INIT_ACK are tacked onto the cookie... 2102 */ 2103 initack_limit = offset + cookie_len; 2104 2105 /* 2106 * now that we know the INIT/INIT-ACK are in place, create a new TCB 2107 * and popluate 2108 */ 2109 2110 /* 2111 * Here we do a trick, we set in NULL for the proc/thread argument. 2112 * We do this since in effect we only use the p argument when the 2113 * socket is unbound and we must do an implicit bind. Since we are 2114 * getting a cookie, we cannot be unbound. 2115 */ 2116 stcb = sctp_aloc_assoc(inp, init_src, &error, 2117 ntohl(initack_cp->init.initiate_tag), vrf_id, 2118 ntohs(initack_cp->init.num_outbound_streams), 2119 port, 2120 (struct thread *)NULL 2121 ); 2122 if (stcb == NULL) { 2123 struct mbuf *op_err; 2124 2125 /* memory problem? */ 2126 SCTPDBG(SCTP_DEBUG_INPUT1, 2127 "process_cookie_new: no room for another TCB!\n"); 2128 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, ""); 2129 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 2130 src, dst, sh, op_err, 2131 mflowtype, mflowid, 2132 vrf_id, port); 2133 return (NULL); 2134 } 2135 /* get the correct sctp_nets */ 2136 if (netp) 2137 *netp = sctp_findnet(stcb, init_src); 2138 2139 asoc = &stcb->asoc; 2140 /* get scope variables out of cookie */ 2141 asoc->scope.ipv4_local_scope = cookie->ipv4_scope; 2142 asoc->scope.site_scope = cookie->site_scope; 2143 asoc->scope.local_scope = cookie->local_scope; 2144 asoc->scope.loopback_scope = cookie->loopback_scope; 2145 2146 if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) || 2147 (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal)) { 2148 struct mbuf *op_err; 2149 2150 /* 2151 * Houston we have a problem. The EP changed while the 2152 * cookie was in flight. Only recourse is to abort the 2153 * association. 2154 */ 2155 atomic_add_int(&stcb->asoc.refcnt, 1); 2156 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, ""); 2157 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 2158 src, dst, sh, op_err, 2159 mflowtype, mflowid, 2160 vrf_id, port); 2161 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2162 SCTP_TCB_UNLOCK(stcb); 2163 SCTP_SOCKET_LOCK(so, 1); 2164 SCTP_TCB_LOCK(stcb); 2165 #endif 2166 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 2167 SCTP_FROM_SCTP_INPUT + SCTP_LOC_18); 2168 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2169 SCTP_SOCKET_UNLOCK(so, 1); 2170 #endif 2171 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2172 return (NULL); 2173 } 2174 /* process the INIT-ACK info (my info) */ 2175 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 2176 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 2177 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 2178 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 2179 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 2180 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1; 2181 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 2182 asoc->str_reset_seq_in = asoc->init_seq_number; 2183 2184 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 2185 2186 /* process the INIT info (peer's info) */ 2187 if (netp) 2188 retval = sctp_process_init(init_cp, stcb); 2189 else 2190 retval = 0; 2191 if (retval < 0) { 2192 atomic_add_int(&stcb->asoc.refcnt, 1); 2193 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2194 SCTP_TCB_UNLOCK(stcb); 2195 SCTP_SOCKET_LOCK(so, 1); 2196 SCTP_TCB_LOCK(stcb); 2197 #endif 2198 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 2199 SCTP_FROM_SCTP_INPUT + SCTP_LOC_19); 2200 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2201 SCTP_SOCKET_UNLOCK(so, 1); 2202 #endif 2203 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2204 return (NULL); 2205 } 2206 /* load all addresses */ 2207 if (sctp_load_addresses_from_init(stcb, m, 2208 init_offset + sizeof(struct sctp_init_chunk), initack_offset, 2209 src, dst, init_src, port)) { 2210 atomic_add_int(&stcb->asoc.refcnt, 1); 2211 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2212 SCTP_TCB_UNLOCK(stcb); 2213 SCTP_SOCKET_LOCK(so, 1); 2214 SCTP_TCB_LOCK(stcb); 2215 #endif 2216 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 2217 SCTP_FROM_SCTP_INPUT + SCTP_LOC_20); 2218 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2219 SCTP_SOCKET_UNLOCK(so, 1); 2220 #endif 2221 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2222 return (NULL); 2223 } 2224 /* 2225 * verify any preceding AUTH chunk that was skipped 2226 */ 2227 /* pull the local authentication parameters from the cookie/init-ack */ 2228 sctp_auth_get_cookie_params(stcb, m, 2229 initack_offset + sizeof(struct sctp_init_ack_chunk), 2230 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk))); 2231 if (auth_skipped) { 2232 struct sctp_auth_chunk *auth; 2233 2234 auth = (struct sctp_auth_chunk *) 2235 sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf); 2236 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) { 2237 /* auth HMAC failed, dump the assoc and packet */ 2238 SCTPDBG(SCTP_DEBUG_AUTH1, 2239 "COOKIE-ECHO: AUTH failed\n"); 2240 atomic_add_int(&stcb->asoc.refcnt, 1); 2241 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2242 SCTP_TCB_UNLOCK(stcb); 2243 SCTP_SOCKET_LOCK(so, 1); 2244 SCTP_TCB_LOCK(stcb); 2245 #endif 2246 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 2247 SCTP_FROM_SCTP_INPUT + SCTP_LOC_21); 2248 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2249 SCTP_SOCKET_UNLOCK(so, 1); 2250 #endif 2251 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2252 return (NULL); 2253 } else { 2254 /* remaining chunks checked... good to go */ 2255 stcb->asoc.authenticated = 1; 2256 } 2257 } 2258 /* update current state */ 2259 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n"); 2260 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN); 2261 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 2262 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 2263 stcb->sctp_ep, stcb, asoc->primary_destination); 2264 } 2265 sctp_stop_all_cookie_timers(stcb); 2266 SCTP_STAT_INCR_COUNTER32(sctps_passiveestab); 2267 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 2268 2269 /* 2270 * if we're doing ASCONFs, check to see if we have any new local 2271 * addresses that need to get added to the peer (eg. addresses 2272 * changed while cookie echo in flight). This needs to be done 2273 * after we go to the OPEN state to do the correct asconf 2274 * processing. else, make sure we have the correct addresses in our 2275 * lists 2276 */ 2277 2278 /* warning, we re-use sin, sin6, sa_store here! */ 2279 /* pull in local_address (our "from" address) */ 2280 switch (cookie->laddr_type) { 2281 #ifdef INET 2282 case SCTP_IPV4_ADDRESS: 2283 /* source addr is IPv4 */ 2284 memset(&store.sin, 0, sizeof(struct sockaddr_in)); 2285 store.sin.sin_family = AF_INET; 2286 store.sin.sin_len = sizeof(struct sockaddr_in); 2287 store.sin.sin_addr.s_addr = cookie->laddress[0]; 2288 break; 2289 #endif 2290 #ifdef INET6 2291 case SCTP_IPV6_ADDRESS: 2292 /* source addr is IPv6 */ 2293 memset(&store.sin6, 0, sizeof(struct sockaddr_in6)); 2294 store.sin6.sin6_family = AF_INET6; 2295 store.sin6.sin6_len = sizeof(struct sockaddr_in6); 2296 store.sin6.sin6_scope_id = cookie->scope_id; 2297 memcpy(&store.sin6.sin6_addr, cookie->laddress, sizeof(struct in6_addr)); 2298 break; 2299 #endif 2300 default: 2301 atomic_add_int(&stcb->asoc.refcnt, 1); 2302 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2303 SCTP_TCB_UNLOCK(stcb); 2304 SCTP_SOCKET_LOCK(so, 1); 2305 SCTP_TCB_LOCK(stcb); 2306 #endif 2307 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 2308 SCTP_FROM_SCTP_INPUT + SCTP_LOC_22); 2309 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2310 SCTP_SOCKET_UNLOCK(so, 1); 2311 #endif 2312 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2313 return (NULL); 2314 } 2315 2316 /* set up to notify upper layer */ 2317 *notification = SCTP_NOTIFY_ASSOC_UP; 2318 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 2319 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 2320 (inp->sctp_socket->so_qlimit == 0)) { 2321 /* 2322 * This is an endpoint that called connect() how it got a 2323 * cookie that is NEW is a bit of a mystery. It must be that 2324 * the INIT was sent, but before it got there.. a complete 2325 * INIT/INIT-ACK/COOKIE arrived. But of course then it 2326 * should have went to the other code.. not here.. oh well.. 2327 * a bit of protection is worth having.. 2328 */ 2329 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 2330 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2331 atomic_add_int(&stcb->asoc.refcnt, 1); 2332 SCTP_TCB_UNLOCK(stcb); 2333 SCTP_SOCKET_LOCK(so, 1); 2334 SCTP_TCB_LOCK(stcb); 2335 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2336 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 2337 SCTP_SOCKET_UNLOCK(so, 1); 2338 return (NULL); 2339 } 2340 #endif 2341 soisconnected(stcb->sctp_socket); 2342 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2343 SCTP_SOCKET_UNLOCK(so, 1); 2344 #endif 2345 } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 2346 (inp->sctp_socket->so_qlimit)) { 2347 /* 2348 * We don't want to do anything with this one. Since it is 2349 * the listening guy. The timer will get started for 2350 * accepted connections in the caller. 2351 */ 2352 ; 2353 } 2354 /* since we did not send a HB make sure we don't double things */ 2355 if ((netp) && (*netp)) 2356 (*netp)->hb_responded = 1; 2357 2358 if (stcb->asoc.sctp_autoclose_ticks && 2359 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 2360 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL); 2361 } 2362 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered); 2363 if ((netp != NULL) && (*netp != NULL)) { 2364 /* calculate the RTT and set the encaps port */ 2365 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp, 2366 &cookie->time_entered, sctp_align_unsafe_makecopy, 2367 SCTP_RTT_FROM_NON_DATA); 2368 } 2369 /* respond with a COOKIE-ACK */ 2370 sctp_send_cookie_ack(stcb); 2371 2372 /* 2373 * check the address lists for any ASCONFs that need to be sent 2374 * AFTER the cookie-ack is sent 2375 */ 2376 sctp_check_address_list(stcb, m, 2377 initack_offset + sizeof(struct sctp_init_ack_chunk), 2378 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)), 2379 &store.sa, cookie->local_scope, cookie->site_scope, 2380 cookie->ipv4_scope, cookie->loopback_scope); 2381 2382 2383 return (stcb); 2384 } 2385 2386 /* 2387 * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e 2388 * we NEED to make sure we are not already using the vtag. If so we 2389 * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit! 2390 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag, 2391 SCTP_BASE_INFO(hashasocmark))]; 2392 LIST_FOREACH(stcb, head, sctp_asocs) { 2393 if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep)) { 2394 -- SEND ABORT - TRY AGAIN -- 2395 } 2396 } 2397 */ 2398 2399 /* 2400 * handles a COOKIE-ECHO message stcb: modified to either a new or left as 2401 * existing (non-NULL) TCB 2402 */ 2403 static struct mbuf * 2404 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset, 2405 struct sockaddr *src, struct sockaddr *dst, 2406 struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp, 2407 struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp, 2408 int auth_skipped, uint32_t auth_offset, uint32_t auth_len, 2409 struct sctp_tcb **locked_tcb, 2410 uint8_t mflowtype, uint32_t mflowid, 2411 uint32_t vrf_id, uint16_t port) 2412 { 2413 struct sctp_state_cookie *cookie; 2414 struct sctp_tcb *l_stcb = *stcb; 2415 struct sctp_inpcb *l_inp; 2416 struct sockaddr *to; 2417 struct sctp_pcb *ep; 2418 struct mbuf *m_sig; 2419 uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE]; 2420 uint8_t *sig; 2421 uint8_t cookie_ok = 0; 2422 unsigned int sig_offset, cookie_offset; 2423 unsigned int cookie_len; 2424 struct timeval now; 2425 struct timeval time_expires; 2426 int notification = 0; 2427 struct sctp_nets *netl; 2428 int had_a_existing_tcb = 0; 2429 int send_int_conf = 0; 2430 #ifdef INET 2431 struct sockaddr_in sin; 2432 #endif 2433 #ifdef INET6 2434 struct sockaddr_in6 sin6; 2435 #endif 2436 2437 SCTPDBG(SCTP_DEBUG_INPUT2, 2438 "sctp_handle_cookie: handling COOKIE-ECHO\n"); 2439 2440 if (inp_p == NULL) { 2441 return (NULL); 2442 } 2443 cookie = &cp->cookie; 2444 cookie_offset = offset + sizeof(struct sctp_chunkhdr); 2445 cookie_len = ntohs(cp->ch.chunk_length); 2446 2447 if ((cookie->peerport != sh->src_port) || 2448 (cookie->myport != sh->dest_port) || 2449 (cookie->my_vtag != sh->v_tag)) { 2450 /* 2451 * invalid ports or bad tag. Note that we always leave the 2452 * v_tag in the header in network order and when we stored 2453 * it in the my_vtag slot we also left it in network order. 2454 * This maintains the match even though it may be in the 2455 * opposite byte order of the machine :-> 2456 */ 2457 return (NULL); 2458 } 2459 if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) + 2460 sizeof(struct sctp_init_chunk) + 2461 sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) { 2462 /* cookie too small */ 2463 return (NULL); 2464 } 2465 /* 2466 * split off the signature into its own mbuf (since it should not be 2467 * calculated in the sctp_hmac_m() call). 2468 */ 2469 sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE; 2470 m_sig = m_split(m, sig_offset, M_NOWAIT); 2471 if (m_sig == NULL) { 2472 /* out of memory or ?? */ 2473 return (NULL); 2474 } 2475 #ifdef SCTP_MBUF_LOGGING 2476 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 2477 sctp_log_mbc(m_sig, SCTP_MBUF_SPLIT); 2478 } 2479 #endif 2480 2481 /* 2482 * compute the signature/digest for the cookie 2483 */ 2484 ep = &(*inp_p)->sctp_ep; 2485 l_inp = *inp_p; 2486 if (l_stcb) { 2487 SCTP_TCB_UNLOCK(l_stcb); 2488 } 2489 SCTP_INP_RLOCK(l_inp); 2490 if (l_stcb) { 2491 SCTP_TCB_LOCK(l_stcb); 2492 } 2493 /* which cookie is it? */ 2494 if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) && 2495 (ep->current_secret_number != ep->last_secret_number)) { 2496 /* it's the old cookie */ 2497 (void)sctp_hmac_m(SCTP_HMAC, 2498 (uint8_t *)ep->secret_key[(int)ep->last_secret_number], 2499 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0); 2500 } else { 2501 /* it's the current cookie */ 2502 (void)sctp_hmac_m(SCTP_HMAC, 2503 (uint8_t *)ep->secret_key[(int)ep->current_secret_number], 2504 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0); 2505 } 2506 /* get the signature */ 2507 SCTP_INP_RUNLOCK(l_inp); 2508 sig = (uint8_t *)sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *)&tmp_sig); 2509 if (sig == NULL) { 2510 /* couldn't find signature */ 2511 sctp_m_freem(m_sig); 2512 return (NULL); 2513 } 2514 /* compare the received digest with the computed digest */ 2515 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) { 2516 /* try the old cookie? */ 2517 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) && 2518 (ep->current_secret_number != ep->last_secret_number)) { 2519 /* compute digest with old */ 2520 (void)sctp_hmac_m(SCTP_HMAC, 2521 (uint8_t *)ep->secret_key[(int)ep->last_secret_number], 2522 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0); 2523 /* compare */ 2524 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0) 2525 cookie_ok = 1; 2526 } 2527 } else { 2528 cookie_ok = 1; 2529 } 2530 2531 /* 2532 * Now before we continue we must reconstruct our mbuf so that 2533 * normal processing of any other chunks will work. 2534 */ 2535 { 2536 struct mbuf *m_at; 2537 2538 m_at = m; 2539 while (SCTP_BUF_NEXT(m_at) != NULL) { 2540 m_at = SCTP_BUF_NEXT(m_at); 2541 } 2542 SCTP_BUF_NEXT(m_at) = m_sig; 2543 } 2544 2545 if (cookie_ok == 0) { 2546 SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n"); 2547 SCTPDBG(SCTP_DEBUG_INPUT2, 2548 "offset = %u, cookie_offset = %u, sig_offset = %u\n", 2549 (uint32_t)offset, cookie_offset, sig_offset); 2550 return (NULL); 2551 } 2552 /* 2553 * check the cookie timestamps to be sure it's not stale 2554 */ 2555 (void)SCTP_GETTIME_TIMEVAL(&now); 2556 /* Expire time is in Ticks, so we convert to seconds */ 2557 time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life); 2558 time_expires.tv_usec = cookie->time_entered.tv_usec; 2559 /* 2560 * TODO sctp_constants.h needs alternative time macros when _KERNEL 2561 * is undefined. 2562 */ 2563 if (timevalcmp(&now, &time_expires, >)) { 2564 /* cookie is stale! */ 2565 struct mbuf *op_err; 2566 struct sctp_error_stale_cookie *cause; 2567 uint32_t tim; 2568 2569 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_error_stale_cookie), 2570 0, M_NOWAIT, 1, MT_DATA); 2571 if (op_err == NULL) { 2572 /* FOOBAR */ 2573 return (NULL); 2574 } 2575 /* Set the len */ 2576 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_error_stale_cookie); 2577 cause = mtod(op_err, struct sctp_error_stale_cookie *); 2578 cause->cause.code = htons(SCTP_CAUSE_STALE_COOKIE); 2579 cause->cause.length = htons((sizeof(struct sctp_paramhdr) + 2580 (sizeof(uint32_t)))); 2581 /* seconds to usec */ 2582 tim = (now.tv_sec - time_expires.tv_sec) * 1000000; 2583 /* add in usec */ 2584 if (tim == 0) 2585 tim = now.tv_usec - cookie->time_entered.tv_usec; 2586 cause->stale_time = htonl(tim); 2587 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err, 2588 mflowtype, mflowid, l_inp->fibnum, 2589 vrf_id, port); 2590 return (NULL); 2591 } 2592 /* 2593 * Now we must see with the lookup address if we have an existing 2594 * asoc. This will only happen if we were in the COOKIE-WAIT state 2595 * and a INIT collided with us and somewhere the peer sent the 2596 * cookie on another address besides the single address our assoc 2597 * had for him. In this case we will have one of the tie-tags set at 2598 * least AND the address field in the cookie can be used to look it 2599 * up. 2600 */ 2601 to = NULL; 2602 switch (cookie->addr_type) { 2603 #ifdef INET6 2604 case SCTP_IPV6_ADDRESS: 2605 memset(&sin6, 0, sizeof(sin6)); 2606 sin6.sin6_family = AF_INET6; 2607 sin6.sin6_len = sizeof(sin6); 2608 sin6.sin6_port = sh->src_port; 2609 sin6.sin6_scope_id = cookie->scope_id; 2610 memcpy(&sin6.sin6_addr.s6_addr, cookie->address, 2611 sizeof(sin6.sin6_addr.s6_addr)); 2612 to = (struct sockaddr *)&sin6; 2613 break; 2614 #endif 2615 #ifdef INET 2616 case SCTP_IPV4_ADDRESS: 2617 memset(&sin, 0, sizeof(sin)); 2618 sin.sin_family = AF_INET; 2619 sin.sin_len = sizeof(sin); 2620 sin.sin_port = sh->src_port; 2621 sin.sin_addr.s_addr = cookie->address[0]; 2622 to = (struct sockaddr *)&sin; 2623 break; 2624 #endif 2625 default: 2626 /* This should not happen */ 2627 return (NULL); 2628 } 2629 if (*stcb == NULL) { 2630 /* Yep, lets check */ 2631 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, dst, NULL); 2632 if (*stcb == NULL) { 2633 /* 2634 * We should have only got back the same inp. If we 2635 * got back a different ep we have a problem. The 2636 * original findep got back l_inp and now 2637 */ 2638 if (l_inp != *inp_p) { 2639 SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n"); 2640 } 2641 } else { 2642 if (*locked_tcb == NULL) { 2643 /* 2644 * In this case we found the assoc only 2645 * after we locked the create lock. This 2646 * means we are in a colliding case and we 2647 * must make sure that we unlock the tcb if 2648 * its one of the cases where we throw away 2649 * the incoming packets. 2650 */ 2651 *locked_tcb = *stcb; 2652 2653 /* 2654 * We must also increment the inp ref count 2655 * since the ref_count flags was set when we 2656 * did not find the TCB, now we found it 2657 * which reduces the refcount.. we must 2658 * raise it back out to balance it all :-) 2659 */ 2660 SCTP_INP_INCR_REF((*stcb)->sctp_ep); 2661 if ((*stcb)->sctp_ep != l_inp) { 2662 SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n", 2663 (void *)(*stcb)->sctp_ep, (void *)l_inp); 2664 } 2665 } 2666 } 2667 } 2668 cookie_len -= SCTP_SIGNATURE_SIZE; 2669 if (*stcb == NULL) { 2670 /* this is the "normal" case... get a new TCB */ 2671 *stcb = sctp_process_cookie_new(m, iphlen, offset, src, dst, sh, 2672 cookie, cookie_len, *inp_p, 2673 netp, to, ¬ification, 2674 auth_skipped, auth_offset, auth_len, 2675 mflowtype, mflowid, 2676 vrf_id, port); 2677 } else { 2678 /* this is abnormal... cookie-echo on existing TCB */ 2679 had_a_existing_tcb = 1; 2680 *stcb = sctp_process_cookie_existing(m, iphlen, offset, 2681 src, dst, sh, 2682 cookie, cookie_len, *inp_p, *stcb, netp, to, 2683 ¬ification, auth_skipped, auth_offset, auth_len, 2684 mflowtype, mflowid, 2685 vrf_id, port); 2686 } 2687 2688 if (*stcb == NULL) { 2689 /* still no TCB... must be bad cookie-echo */ 2690 return (NULL); 2691 } 2692 if (*netp != NULL) { 2693 (*netp)->flowtype = mflowtype; 2694 (*netp)->flowid = mflowid; 2695 } 2696 /* 2697 * Ok, we built an association so confirm the address we sent the 2698 * INIT-ACK to. 2699 */ 2700 netl = sctp_findnet(*stcb, to); 2701 /* 2702 * This code should in theory NOT run but 2703 */ 2704 if (netl == NULL) { 2705 /* TSNH! Huh, why do I need to add this address here? */ 2706 if (sctp_add_remote_addr(*stcb, to, NULL, port, 2707 SCTP_DONOT_SETSCOPE, SCTP_IN_COOKIE_PROC)) { 2708 return (NULL); 2709 } 2710 netl = sctp_findnet(*stcb, to); 2711 } 2712 if (netl) { 2713 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) { 2714 netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2715 (void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL, 2716 netl); 2717 send_int_conf = 1; 2718 } 2719 } 2720 sctp_start_net_timers(*stcb); 2721 if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 2722 if (!had_a_existing_tcb || 2723 (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) { 2724 /* 2725 * If we have a NEW cookie or the connect never 2726 * reached the connected state during collision we 2727 * must do the TCP accept thing. 2728 */ 2729 struct socket *so, *oso; 2730 struct sctp_inpcb *inp; 2731 2732 if (notification == SCTP_NOTIFY_ASSOC_RESTART) { 2733 /* 2734 * For a restart we will keep the same 2735 * socket, no need to do anything. I THINK!! 2736 */ 2737 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED); 2738 if (send_int_conf) { 2739 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 2740 (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED); 2741 } 2742 return (m); 2743 } 2744 oso = (*inp_p)->sctp_socket; 2745 atomic_add_int(&(*stcb)->asoc.refcnt, 1); 2746 SCTP_TCB_UNLOCK((*stcb)); 2747 CURVNET_SET(oso->so_vnet); 2748 so = sonewconn(oso, 0 2749 ); 2750 CURVNET_RESTORE(); 2751 SCTP_TCB_LOCK((*stcb)); 2752 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1); 2753 2754 if (so == NULL) { 2755 struct mbuf *op_err; 2756 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2757 struct socket *pcb_so; 2758 #endif 2759 /* Too many sockets */ 2760 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n"); 2761 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, ""); 2762 sctp_abort_association(*inp_p, NULL, m, iphlen, 2763 src, dst, sh, op_err, 2764 mflowtype, mflowid, 2765 vrf_id, port); 2766 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2767 pcb_so = SCTP_INP_SO(*inp_p); 2768 atomic_add_int(&(*stcb)->asoc.refcnt, 1); 2769 SCTP_TCB_UNLOCK((*stcb)); 2770 SCTP_SOCKET_LOCK(pcb_so, 1); 2771 SCTP_TCB_LOCK((*stcb)); 2772 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1); 2773 #endif 2774 (void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, 2775 SCTP_FROM_SCTP_INPUT + SCTP_LOC_23); 2776 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2777 SCTP_SOCKET_UNLOCK(pcb_so, 1); 2778 #endif 2779 return (NULL); 2780 } 2781 inp = (struct sctp_inpcb *)so->so_pcb; 2782 SCTP_INP_INCR_REF(inp); 2783 /* 2784 * We add the unbound flag here so that if we get an 2785 * soabort() before we get the move_pcb done, we 2786 * will properly cleanup. 2787 */ 2788 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 2789 SCTP_PCB_FLAGS_CONNECTED | 2790 SCTP_PCB_FLAGS_IN_TCPPOOL | 2791 SCTP_PCB_FLAGS_UNBOUND | 2792 (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) | 2793 SCTP_PCB_FLAGS_DONT_WAKE); 2794 inp->sctp_features = (*inp_p)->sctp_features; 2795 inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features; 2796 inp->sctp_socket = so; 2797 inp->sctp_frag_point = (*inp_p)->sctp_frag_point; 2798 inp->max_cwnd = (*inp_p)->max_cwnd; 2799 inp->sctp_cmt_on_off = (*inp_p)->sctp_cmt_on_off; 2800 inp->ecn_supported = (*inp_p)->ecn_supported; 2801 inp->prsctp_supported = (*inp_p)->prsctp_supported; 2802 inp->auth_supported = (*inp_p)->auth_supported; 2803 inp->asconf_supported = (*inp_p)->asconf_supported; 2804 inp->reconfig_supported = (*inp_p)->reconfig_supported; 2805 inp->nrsack_supported = (*inp_p)->nrsack_supported; 2806 inp->pktdrop_supported = (*inp_p)->pktdrop_supported; 2807 inp->partial_delivery_point = (*inp_p)->partial_delivery_point; 2808 inp->sctp_context = (*inp_p)->sctp_context; 2809 inp->local_strreset_support = (*inp_p)->local_strreset_support; 2810 inp->fibnum = (*inp_p)->fibnum; 2811 inp->inp_starting_point_for_iterator = NULL; 2812 /* 2813 * copy in the authentication parameters from the 2814 * original endpoint 2815 */ 2816 if (inp->sctp_ep.local_hmacs) 2817 sctp_free_hmaclist(inp->sctp_ep.local_hmacs); 2818 inp->sctp_ep.local_hmacs = 2819 sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs); 2820 if (inp->sctp_ep.local_auth_chunks) 2821 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks); 2822 inp->sctp_ep.local_auth_chunks = 2823 sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks); 2824 2825 /* 2826 * Now we must move it from one hash table to 2827 * another and get the tcb in the right place. 2828 */ 2829 2830 /* 2831 * This is where the one-2-one socket is put into 2832 * the accept state waiting for the accept! 2833 */ 2834 if (*stcb) { 2835 (*stcb)->asoc.state |= SCTP_STATE_IN_ACCEPT_QUEUE; 2836 } 2837 sctp_move_pcb_and_assoc(*inp_p, inp, *stcb); 2838 2839 atomic_add_int(&(*stcb)->asoc.refcnt, 1); 2840 SCTP_TCB_UNLOCK((*stcb)); 2841 2842 sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb, 2843 0); 2844 SCTP_TCB_LOCK((*stcb)); 2845 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1); 2846 2847 2848 /* 2849 * now we must check to see if we were aborted while 2850 * the move was going on and the lock/unlock 2851 * happened. 2852 */ 2853 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 2854 /* 2855 * yep it was, we leave the assoc attached 2856 * to the socket since the sctp_inpcb_free() 2857 * call will send an abort for us. 2858 */ 2859 SCTP_INP_DECR_REF(inp); 2860 return (NULL); 2861 } 2862 SCTP_INP_DECR_REF(inp); 2863 /* Switch over to the new guy */ 2864 *inp_p = inp; 2865 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED); 2866 if (send_int_conf) { 2867 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 2868 (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED); 2869 } 2870 /* 2871 * Pull it from the incomplete queue and wake the 2872 * guy 2873 */ 2874 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2875 atomic_add_int(&(*stcb)->asoc.refcnt, 1); 2876 SCTP_TCB_UNLOCK((*stcb)); 2877 SCTP_SOCKET_LOCK(so, 1); 2878 #endif 2879 soisconnected(so); 2880 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2881 SCTP_TCB_LOCK((*stcb)); 2882 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1); 2883 SCTP_SOCKET_UNLOCK(so, 1); 2884 #endif 2885 return (m); 2886 } 2887 } 2888 if (notification) { 2889 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED); 2890 } 2891 if (send_int_conf) { 2892 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 2893 (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED); 2894 } 2895 return (m); 2896 } 2897 2898 static void 2899 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp SCTP_UNUSED, 2900 struct sctp_tcb *stcb, struct sctp_nets *net) 2901 { 2902 /* cp must not be used, others call this without a c-ack :-) */ 2903 struct sctp_association *asoc; 2904 2905 SCTPDBG(SCTP_DEBUG_INPUT2, 2906 "sctp_handle_cookie_ack: handling COOKIE-ACK\n"); 2907 if ((stcb == NULL) || (net == NULL)) { 2908 return; 2909 } 2910 asoc = &stcb->asoc; 2911 2912 sctp_stop_all_cookie_timers(stcb); 2913 /* process according to association state */ 2914 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 2915 /* state change only needed when I am in right state */ 2916 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n"); 2917 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN); 2918 sctp_start_net_timers(stcb); 2919 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 2920 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 2921 stcb->sctp_ep, stcb, asoc->primary_destination); 2922 2923 } 2924 /* update RTO */ 2925 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 2926 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 2927 if (asoc->overall_error_count == 0) { 2928 net->RTO = sctp_calculate_rto(stcb, asoc, net, 2929 &asoc->time_entered, sctp_align_safe_nocopy, 2930 SCTP_RTT_FROM_NON_DATA); 2931 } 2932 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 2933 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED); 2934 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 2935 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 2936 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2937 struct socket *so; 2938 2939 #endif 2940 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 2941 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2942 so = SCTP_INP_SO(stcb->sctp_ep); 2943 atomic_add_int(&stcb->asoc.refcnt, 1); 2944 SCTP_TCB_UNLOCK(stcb); 2945 SCTP_SOCKET_LOCK(so, 1); 2946 SCTP_TCB_LOCK(stcb); 2947 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2948 #endif 2949 if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0) { 2950 soisconnected(stcb->sctp_socket); 2951 } 2952 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2953 SCTP_SOCKET_UNLOCK(so, 1); 2954 #endif 2955 } 2956 /* 2957 * since we did not send a HB make sure we don't double 2958 * things 2959 */ 2960 net->hb_responded = 1; 2961 2962 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 2963 /* 2964 * We don't need to do the asconf thing, nor hb or 2965 * autoclose if the socket is closed. 2966 */ 2967 goto closed_socket; 2968 } 2969 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, 2970 stcb, net); 2971 2972 2973 if (stcb->asoc.sctp_autoclose_ticks && 2974 sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) { 2975 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 2976 stcb->sctp_ep, stcb, NULL); 2977 } 2978 /* 2979 * send ASCONF if parameters are pending and ASCONFs are 2980 * allowed (eg. addresses changed when init/cookie echo were 2981 * in flight) 2982 */ 2983 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) && 2984 (stcb->asoc.asconf_supported == 1) && 2985 (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) { 2986 #ifdef SCTP_TIMER_BASED_ASCONF 2987 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, 2988 stcb->sctp_ep, stcb, 2989 stcb->asoc.primary_destination); 2990 #else 2991 sctp_send_asconf(stcb, stcb->asoc.primary_destination, 2992 SCTP_ADDR_NOT_LOCKED); 2993 #endif 2994 } 2995 } 2996 closed_socket: 2997 /* Toss the cookie if I can */ 2998 sctp_toss_old_cookies(stcb, asoc); 2999 if (!TAILQ_EMPTY(&asoc->sent_queue)) { 3000 /* Restart the timer if we have pending data */ 3001 struct sctp_tmit_chunk *chk; 3002 3003 chk = TAILQ_FIRST(&asoc->sent_queue); 3004 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo); 3005 } 3006 } 3007 3008 static void 3009 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp, 3010 struct sctp_tcb *stcb) 3011 { 3012 struct sctp_nets *net; 3013 struct sctp_tmit_chunk *lchk; 3014 struct sctp_ecne_chunk bkup; 3015 uint8_t override_bit; 3016 uint32_t tsn, window_data_tsn; 3017 int len; 3018 unsigned int pkt_cnt; 3019 3020 len = ntohs(cp->ch.chunk_length); 3021 if ((len != sizeof(struct sctp_ecne_chunk)) && 3022 (len != sizeof(struct old_sctp_ecne_chunk))) { 3023 return; 3024 } 3025 if (len == sizeof(struct old_sctp_ecne_chunk)) { 3026 /* Its the old format */ 3027 memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk)); 3028 bkup.num_pkts_since_cwr = htonl(1); 3029 cp = &bkup; 3030 } 3031 SCTP_STAT_INCR(sctps_recvecne); 3032 tsn = ntohl(cp->tsn); 3033 pkt_cnt = ntohl(cp->num_pkts_since_cwr); 3034 lchk = TAILQ_LAST(&stcb->asoc.send_queue, sctpchunk_listhead); 3035 if (lchk == NULL) { 3036 window_data_tsn = stcb->asoc.sending_seq - 1; 3037 } else { 3038 window_data_tsn = lchk->rec.data.tsn; 3039 } 3040 3041 /* Find where it was sent to if possible. */ 3042 net = NULL; 3043 TAILQ_FOREACH(lchk, &stcb->asoc.sent_queue, sctp_next) { 3044 if (lchk->rec.data.tsn == tsn) { 3045 net = lchk->whoTo; 3046 net->ecn_prev_cwnd = lchk->rec.data.cwnd_at_send; 3047 break; 3048 } 3049 if (SCTP_TSN_GT(lchk->rec.data.tsn, tsn)) { 3050 break; 3051 } 3052 } 3053 if (net == NULL) { 3054 /* 3055 * What to do. A previous send of a CWR was possibly lost. 3056 * See how old it is, we may have it marked on the actual 3057 * net. 3058 */ 3059 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 3060 if (tsn == net->last_cwr_tsn) { 3061 /* Found him, send it off */ 3062 break; 3063 } 3064 } 3065 if (net == NULL) { 3066 /* 3067 * If we reach here, we need to send a special CWR 3068 * that says hey, we did this a long time ago and 3069 * you lost the response. 3070 */ 3071 net = TAILQ_FIRST(&stcb->asoc.nets); 3072 if (net == NULL) { 3073 /* TSNH */ 3074 return; 3075 } 3076 override_bit = SCTP_CWR_REDUCE_OVERRIDE; 3077 } else { 3078 override_bit = 0; 3079 } 3080 } else { 3081 override_bit = 0; 3082 } 3083 if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) && 3084 ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) { 3085 /* 3086 * JRS - Use the congestion control given in the pluggable 3087 * CC module 3088 */ 3089 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 0, pkt_cnt); 3090 /* 3091 * We reduce once every RTT. So we will only lower cwnd at 3092 * the next sending seq i.e. the window_data_tsn 3093 */ 3094 net->cwr_window_tsn = window_data_tsn; 3095 net->ecn_ce_pkt_cnt += pkt_cnt; 3096 net->lost_cnt = pkt_cnt; 3097 net->last_cwr_tsn = tsn; 3098 } else { 3099 override_bit |= SCTP_CWR_IN_SAME_WINDOW; 3100 if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) && 3101 ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) { 3102 /* 3103 * Another loss in the same window update how many 3104 * marks/packets lost we have had. 3105 */ 3106 int cnt = 1; 3107 3108 if (pkt_cnt > net->lost_cnt) { 3109 /* Should be the case */ 3110 cnt = (pkt_cnt - net->lost_cnt); 3111 net->ecn_ce_pkt_cnt += cnt; 3112 } 3113 net->lost_cnt = pkt_cnt; 3114 net->last_cwr_tsn = tsn; 3115 /* 3116 * Most CC functions will ignore this call, since we 3117 * are in-window yet of the initial CE the peer saw. 3118 */ 3119 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 1, cnt); 3120 } 3121 } 3122 /* 3123 * We always send a CWR this way if our previous one was lost our 3124 * peer will get an update, or if it is not time again to reduce we 3125 * still get the cwr to the peer. Note we set the override when we 3126 * could not find the TSN on the chunk or the destination network. 3127 */ 3128 sctp_send_cwr(stcb, net, net->last_cwr_tsn, override_bit); 3129 } 3130 3131 static void 3132 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net) 3133 { 3134 /* 3135 * Here we get a CWR from the peer. We must look in the outqueue and 3136 * make sure that we have a covered ECNE in the control chunk part. 3137 * If so remove it. 3138 */ 3139 struct sctp_tmit_chunk *chk; 3140 struct sctp_ecne_chunk *ecne; 3141 int override; 3142 uint32_t cwr_tsn; 3143 3144 cwr_tsn = ntohl(cp->tsn); 3145 override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE; 3146 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 3147 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) { 3148 continue; 3149 } 3150 if ((override == 0) && (chk->whoTo != net)) { 3151 /* Must be from the right src unless override is set */ 3152 continue; 3153 } 3154 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 3155 if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) { 3156 /* this covers this ECNE, we can remove it */ 3157 stcb->asoc.ecn_echo_cnt_onq--; 3158 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, 3159 sctp_next); 3160 sctp_m_freem(chk->data); 3161 chk->data = NULL; 3162 stcb->asoc.ctrl_queue_cnt--; 3163 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 3164 if (override == 0) { 3165 break; 3166 } 3167 } 3168 } 3169 } 3170 3171 static void 3172 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp SCTP_UNUSED, 3173 struct sctp_tcb *stcb, struct sctp_nets *net) 3174 { 3175 struct sctp_association *asoc; 3176 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3177 struct socket *so; 3178 #endif 3179 3180 SCTPDBG(SCTP_DEBUG_INPUT2, 3181 "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n"); 3182 if (stcb == NULL) 3183 return; 3184 3185 asoc = &stcb->asoc; 3186 /* process according to association state */ 3187 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) { 3188 /* unexpected SHUTDOWN-COMPLETE... so ignore... */ 3189 SCTPDBG(SCTP_DEBUG_INPUT2, 3190 "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n"); 3191 SCTP_TCB_UNLOCK(stcb); 3192 return; 3193 } 3194 /* notify upper layer protocol */ 3195 if (stcb->sctp_socket) { 3196 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED); 3197 } 3198 #ifdef INVARIANTS 3199 if (!TAILQ_EMPTY(&asoc->send_queue) || 3200 !TAILQ_EMPTY(&asoc->sent_queue) || 3201 sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) { 3202 panic("Queues are not empty when handling SHUTDOWN-COMPLETE"); 3203 } 3204 #endif 3205 /* stop the timer */ 3206 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net, 3207 SCTP_FROM_SCTP_INPUT + SCTP_LOC_24); 3208 SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 3209 /* free the TCB */ 3210 SCTPDBG(SCTP_DEBUG_INPUT2, 3211 "sctp_handle_shutdown_complete: calls free-asoc\n"); 3212 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3213 so = SCTP_INP_SO(stcb->sctp_ep); 3214 atomic_add_int(&stcb->asoc.refcnt, 1); 3215 SCTP_TCB_UNLOCK(stcb); 3216 SCTP_SOCKET_LOCK(so, 1); 3217 SCTP_TCB_LOCK(stcb); 3218 atomic_subtract_int(&stcb->asoc.refcnt, 1); 3219 #endif 3220 (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, 3221 SCTP_FROM_SCTP_INPUT + SCTP_LOC_25); 3222 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3223 SCTP_SOCKET_UNLOCK(so, 1); 3224 #endif 3225 return; 3226 } 3227 3228 static int 3229 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc, 3230 struct sctp_nets *net, uint8_t flg) 3231 { 3232 switch (desc->chunk_type) { 3233 case SCTP_DATA: 3234 /* find the tsn to resend (possibly */ 3235 { 3236 uint32_t tsn; 3237 struct sctp_tmit_chunk *tp1; 3238 3239 tsn = ntohl(desc->tsn_ifany); 3240 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) { 3241 if (tp1->rec.data.tsn == tsn) { 3242 /* found it */ 3243 break; 3244 } 3245 if (SCTP_TSN_GT(tp1->rec.data.tsn, tsn)) { 3246 /* not found */ 3247 tp1 = NULL; 3248 break; 3249 } 3250 } 3251 if (tp1 == NULL) { 3252 /* 3253 * Do it the other way , aka without paying 3254 * attention to queue seq order. 3255 */ 3256 SCTP_STAT_INCR(sctps_pdrpdnfnd); 3257 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) { 3258 if (tp1->rec.data.tsn == tsn) { 3259 /* found it */ 3260 break; 3261 } 3262 } 3263 } 3264 if (tp1 == NULL) { 3265 SCTP_STAT_INCR(sctps_pdrptsnnf); 3266 } 3267 if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) { 3268 uint8_t *ddp; 3269 3270 if (((flg & SCTP_BADCRC) == 0) && 3271 ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) { 3272 return (0); 3273 } 3274 if ((stcb->asoc.peers_rwnd == 0) && 3275 ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) { 3276 SCTP_STAT_INCR(sctps_pdrpdiwnp); 3277 return (0); 3278 } 3279 if (stcb->asoc.peers_rwnd == 0 && 3280 (flg & SCTP_FROM_MIDDLE_BOX)) { 3281 SCTP_STAT_INCR(sctps_pdrpdizrw); 3282 return (0); 3283 } 3284 ddp = (uint8_t *)(mtod(tp1->data, caddr_t)+ 3285 sizeof(struct sctp_data_chunk)); 3286 { 3287 unsigned int iii; 3288 3289 for (iii = 0; iii < sizeof(desc->data_bytes); 3290 iii++) { 3291 if (ddp[iii] != desc->data_bytes[iii]) { 3292 SCTP_STAT_INCR(sctps_pdrpbadd); 3293 return (-1); 3294 } 3295 } 3296 } 3297 3298 if (tp1->do_rtt) { 3299 /* 3300 * this guy had a RTO calculation 3301 * pending on it, cancel it 3302 */ 3303 if (tp1->whoTo->rto_needed == 0) { 3304 tp1->whoTo->rto_needed = 1; 3305 } 3306 tp1->do_rtt = 0; 3307 } 3308 SCTP_STAT_INCR(sctps_pdrpmark); 3309 if (tp1->sent != SCTP_DATAGRAM_RESEND) 3310 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 3311 /* 3312 * mark it as if we were doing a FR, since 3313 * we will be getting gap ack reports behind 3314 * the info from the router. 3315 */ 3316 tp1->rec.data.doing_fast_retransmit = 1; 3317 /* 3318 * mark the tsn with what sequences can 3319 * cause a new FR. 3320 */ 3321 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) { 3322 tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq; 3323 } else { 3324 tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.tsn; 3325 } 3326 3327 /* restart the timer */ 3328 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 3329 stcb, tp1->whoTo, 3330 SCTP_FROM_SCTP_INPUT + SCTP_LOC_26); 3331 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 3332 stcb, tp1->whoTo); 3333 3334 /* fix counts and things */ 3335 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 3336 sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP, 3337 tp1->whoTo->flight_size, 3338 tp1->book_size, 3339 (uint32_t)(uintptr_t)stcb, 3340 tp1->rec.data.tsn); 3341 } 3342 if (tp1->sent < SCTP_DATAGRAM_RESEND) { 3343 sctp_flight_size_decrease(tp1); 3344 sctp_total_flight_decrease(stcb, tp1); 3345 } 3346 tp1->sent = SCTP_DATAGRAM_RESEND; 3347 } { 3348 /* audit code */ 3349 unsigned int audit; 3350 3351 audit = 0; 3352 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) { 3353 if (tp1->sent == SCTP_DATAGRAM_RESEND) 3354 audit++; 3355 } 3356 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue, 3357 sctp_next) { 3358 if (tp1->sent == SCTP_DATAGRAM_RESEND) 3359 audit++; 3360 } 3361 if (audit != stcb->asoc.sent_queue_retran_cnt) { 3362 SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n", 3363 audit, stcb->asoc.sent_queue_retran_cnt); 3364 #ifndef SCTP_AUDITING_ENABLED 3365 stcb->asoc.sent_queue_retran_cnt = audit; 3366 #endif 3367 } 3368 } 3369 } 3370 break; 3371 case SCTP_ASCONF: 3372 { 3373 struct sctp_tmit_chunk *asconf; 3374 3375 TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue, 3376 sctp_next) { 3377 if (asconf->rec.chunk_id.id == SCTP_ASCONF) { 3378 break; 3379 } 3380 } 3381 if (asconf) { 3382 if (asconf->sent != SCTP_DATAGRAM_RESEND) 3383 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 3384 asconf->sent = SCTP_DATAGRAM_RESEND; 3385 asconf->snd_count--; 3386 } 3387 } 3388 break; 3389 case SCTP_INITIATION: 3390 /* resend the INIT */ 3391 stcb->asoc.dropped_special_cnt++; 3392 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) { 3393 /* 3394 * If we can get it in, in a few attempts we do 3395 * this, otherwise we let the timer fire. 3396 */ 3397 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, 3398 stcb, net, 3399 SCTP_FROM_SCTP_INPUT + SCTP_LOC_27); 3400 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED); 3401 } 3402 break; 3403 case SCTP_SELECTIVE_ACK: 3404 case SCTP_NR_SELECTIVE_ACK: 3405 /* resend the sack */ 3406 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED); 3407 break; 3408 case SCTP_HEARTBEAT_REQUEST: 3409 /* resend a demand HB */ 3410 if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) { 3411 /* 3412 * Only retransmit if we KNOW we wont destroy the 3413 * tcb 3414 */ 3415 sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED); 3416 } 3417 break; 3418 case SCTP_SHUTDOWN: 3419 sctp_send_shutdown(stcb, net); 3420 break; 3421 case SCTP_SHUTDOWN_ACK: 3422 sctp_send_shutdown_ack(stcb, net); 3423 break; 3424 case SCTP_COOKIE_ECHO: 3425 { 3426 struct sctp_tmit_chunk *cookie; 3427 3428 cookie = NULL; 3429 TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue, 3430 sctp_next) { 3431 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 3432 break; 3433 } 3434 } 3435 if (cookie) { 3436 if (cookie->sent != SCTP_DATAGRAM_RESEND) 3437 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 3438 cookie->sent = SCTP_DATAGRAM_RESEND; 3439 sctp_stop_all_cookie_timers(stcb); 3440 } 3441 } 3442 break; 3443 case SCTP_COOKIE_ACK: 3444 sctp_send_cookie_ack(stcb); 3445 break; 3446 case SCTP_ASCONF_ACK: 3447 /* resend last asconf ack */ 3448 sctp_send_asconf_ack(stcb); 3449 break; 3450 case SCTP_IFORWARD_CUM_TSN: 3451 case SCTP_FORWARD_CUM_TSN: 3452 send_forward_tsn(stcb, &stcb->asoc); 3453 break; 3454 /* can't do anything with these */ 3455 case SCTP_PACKET_DROPPED: 3456 case SCTP_INITIATION_ACK: /* this should not happen */ 3457 case SCTP_HEARTBEAT_ACK: 3458 case SCTP_ABORT_ASSOCIATION: 3459 case SCTP_OPERATION_ERROR: 3460 case SCTP_SHUTDOWN_COMPLETE: 3461 case SCTP_ECN_ECHO: 3462 case SCTP_ECN_CWR: 3463 default: 3464 break; 3465 } 3466 return (0); 3467 } 3468 3469 void 3470 sctp_reset_in_stream(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list) 3471 { 3472 uint32_t i; 3473 uint16_t temp; 3474 3475 /* 3476 * We set things to 0xffffffff since this is the last delivered 3477 * sequence and we will be sending in 0 after the reset. 3478 */ 3479 3480 if (number_entries) { 3481 for (i = 0; i < number_entries; i++) { 3482 temp = ntohs(list[i]); 3483 if (temp >= stcb->asoc.streamincnt) { 3484 continue; 3485 } 3486 stcb->asoc.strmin[temp].last_mid_delivered = 0xffffffff; 3487 } 3488 } else { 3489 list = NULL; 3490 for (i = 0; i < stcb->asoc.streamincnt; i++) { 3491 stcb->asoc.strmin[i].last_mid_delivered = 0xffffffff; 3492 } 3493 } 3494 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED); 3495 } 3496 3497 static void 3498 sctp_reset_out_streams(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list) 3499 { 3500 uint32_t i; 3501 uint16_t temp; 3502 3503 if (number_entries > 0) { 3504 for (i = 0; i < number_entries; i++) { 3505 temp = ntohs(list[i]); 3506 if (temp >= stcb->asoc.streamoutcnt) { 3507 /* no such stream */ 3508 continue; 3509 } 3510 stcb->asoc.strmout[temp].next_mid_ordered = 0; 3511 stcb->asoc.strmout[temp].next_mid_unordered = 0; 3512 } 3513 } else { 3514 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3515 stcb->asoc.strmout[i].next_mid_ordered = 0; 3516 stcb->asoc.strmout[i].next_mid_unordered = 0; 3517 } 3518 } 3519 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED); 3520 } 3521 3522 static void 3523 sctp_reset_clear_pending(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list) 3524 { 3525 uint32_t i; 3526 uint16_t temp; 3527 3528 if (number_entries > 0) { 3529 for (i = 0; i < number_entries; i++) { 3530 temp = ntohs(list[i]); 3531 if (temp >= stcb->asoc.streamoutcnt) { 3532 /* no such stream */ 3533 continue; 3534 } 3535 stcb->asoc.strmout[temp].state = SCTP_STREAM_OPEN; 3536 } 3537 } else { 3538 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3539 stcb->asoc.strmout[i].state = SCTP_STREAM_OPEN; 3540 } 3541 } 3542 } 3543 3544 3545 struct sctp_stream_reset_request * 3546 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk) 3547 { 3548 struct sctp_association *asoc; 3549 struct sctp_chunkhdr *ch; 3550 struct sctp_stream_reset_request *r; 3551 struct sctp_tmit_chunk *chk; 3552 int len, clen; 3553 3554 asoc = &stcb->asoc; 3555 if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 3556 asoc->stream_reset_outstanding = 0; 3557 return (NULL); 3558 } 3559 if (stcb->asoc.str_reset == NULL) { 3560 asoc->stream_reset_outstanding = 0; 3561 return (NULL); 3562 } 3563 chk = stcb->asoc.str_reset; 3564 if (chk->data == NULL) { 3565 return (NULL); 3566 } 3567 if (bchk) { 3568 /* he wants a copy of the chk pointer */ 3569 *bchk = chk; 3570 } 3571 clen = chk->send_size; 3572 ch = mtod(chk->data, struct sctp_chunkhdr *); 3573 r = (struct sctp_stream_reset_request *)(ch + 1); 3574 if (ntohl(r->request_seq) == seq) { 3575 /* found it */ 3576 return (r); 3577 } 3578 len = SCTP_SIZE32(ntohs(r->ph.param_length)); 3579 if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) { 3580 /* move to the next one, there can only be a max of two */ 3581 r = (struct sctp_stream_reset_request *)((caddr_t)r + len); 3582 if (ntohl(r->request_seq) == seq) { 3583 return (r); 3584 } 3585 } 3586 /* that seq is not here */ 3587 return (NULL); 3588 } 3589 3590 static void 3591 sctp_clean_up_stream_reset(struct sctp_tcb *stcb) 3592 { 3593 struct sctp_association *asoc; 3594 struct sctp_tmit_chunk *chk = stcb->asoc.str_reset; 3595 3596 if (stcb->asoc.str_reset == NULL) { 3597 return; 3598 } 3599 asoc = &stcb->asoc; 3600 3601 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, 3602 chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28); 3603 TAILQ_REMOVE(&asoc->control_send_queue, 3604 chk, 3605 sctp_next); 3606 if (chk->data) { 3607 sctp_m_freem(chk->data); 3608 chk->data = NULL; 3609 } 3610 asoc->ctrl_queue_cnt--; 3611 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 3612 /* sa_ignore NO_NULL_CHK */ 3613 stcb->asoc.str_reset = NULL; 3614 } 3615 3616 3617 static int 3618 sctp_handle_stream_reset_response(struct sctp_tcb *stcb, 3619 uint32_t seq, uint32_t action, 3620 struct sctp_stream_reset_response *respin) 3621 { 3622 uint16_t type; 3623 int lparm_len; 3624 struct sctp_association *asoc = &stcb->asoc; 3625 struct sctp_tmit_chunk *chk; 3626 struct sctp_stream_reset_request *req_param; 3627 struct sctp_stream_reset_out_request *req_out_param; 3628 struct sctp_stream_reset_in_request *req_in_param; 3629 uint32_t number_entries; 3630 3631 if (asoc->stream_reset_outstanding == 0) { 3632 /* duplicate */ 3633 return (0); 3634 } 3635 if (seq == stcb->asoc.str_reset_seq_out) { 3636 req_param = sctp_find_stream_reset(stcb, seq, &chk); 3637 if (req_param != NULL) { 3638 stcb->asoc.str_reset_seq_out++; 3639 type = ntohs(req_param->ph.param_type); 3640 lparm_len = ntohs(req_param->ph.param_length); 3641 if (type == SCTP_STR_RESET_OUT_REQUEST) { 3642 int no_clear = 0; 3643 3644 req_out_param = (struct sctp_stream_reset_out_request *)req_param; 3645 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t); 3646 asoc->stream_reset_out_is_outstanding = 0; 3647 if (asoc->stream_reset_outstanding) 3648 asoc->stream_reset_outstanding--; 3649 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) { 3650 /* do it */ 3651 sctp_reset_out_streams(stcb, number_entries, req_out_param->list_of_streams); 3652 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) { 3653 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED); 3654 } else if (action == SCTP_STREAM_RESET_RESULT_IN_PROGRESS) { 3655 /* 3656 * Set it up so we don't stop 3657 * retransmitting 3658 */ 3659 asoc->stream_reset_outstanding++; 3660 stcb->asoc.str_reset_seq_out--; 3661 asoc->stream_reset_out_is_outstanding = 1; 3662 no_clear = 1; 3663 } else { 3664 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED); 3665 } 3666 if (no_clear == 0) { 3667 sctp_reset_clear_pending(stcb, number_entries, req_out_param->list_of_streams); 3668 } 3669 } else if (type == SCTP_STR_RESET_IN_REQUEST) { 3670 req_in_param = (struct sctp_stream_reset_in_request *)req_param; 3671 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t); 3672 if (asoc->stream_reset_outstanding) 3673 asoc->stream_reset_outstanding--; 3674 if (action == SCTP_STREAM_RESET_RESULT_DENIED) { 3675 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_IN, stcb, 3676 number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED); 3677 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) { 3678 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, 3679 number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED); 3680 } 3681 } else if (type == SCTP_STR_RESET_ADD_OUT_STREAMS) { 3682 /* Ok we now may have more streams */ 3683 int num_stream; 3684 3685 num_stream = stcb->asoc.strm_pending_add_size; 3686 if (num_stream > (stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt)) { 3687 /* TSNH */ 3688 num_stream = stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt; 3689 } 3690 stcb->asoc.strm_pending_add_size = 0; 3691 if (asoc->stream_reset_outstanding) 3692 asoc->stream_reset_outstanding--; 3693 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) { 3694 /* Put the new streams into effect */ 3695 int i; 3696 3697 for (i = asoc->streamoutcnt; i < (asoc->streamoutcnt + num_stream); i++) { 3698 asoc->strmout[i].state = SCTP_STREAM_OPEN; 3699 } 3700 asoc->streamoutcnt += num_stream; 3701 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0); 3702 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) { 3703 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 3704 SCTP_STREAM_CHANGE_DENIED); 3705 } else { 3706 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 3707 SCTP_STREAM_CHANGE_FAILED); 3708 } 3709 } else if (type == SCTP_STR_RESET_ADD_IN_STREAMS) { 3710 if (asoc->stream_reset_outstanding) 3711 asoc->stream_reset_outstanding--; 3712 if (action == SCTP_STREAM_RESET_RESULT_DENIED) { 3713 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 3714 SCTP_STREAM_CHANGE_DENIED); 3715 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) { 3716 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 3717 SCTP_STREAM_CHANGE_FAILED); 3718 } 3719 } else if (type == SCTP_STR_RESET_TSN_REQUEST) { 3720 /** 3721 * a) Adopt the new in tsn. 3722 * b) reset the map 3723 * c) Adopt the new out-tsn 3724 */ 3725 struct sctp_stream_reset_response_tsn *resp; 3726 struct sctp_forward_tsn_chunk fwdtsn; 3727 int abort_flag = 0; 3728 3729 if (respin == NULL) { 3730 /* huh ? */ 3731 return (0); 3732 } 3733 if (ntohs(respin->ph.param_length) < sizeof(struct sctp_stream_reset_response_tsn)) { 3734 return (0); 3735 } 3736 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) { 3737 resp = (struct sctp_stream_reset_response_tsn *)respin; 3738 asoc->stream_reset_outstanding--; 3739 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 3740 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 3741 fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1); 3742 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0); 3743 if (abort_flag) { 3744 return (1); 3745 } 3746 stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1); 3747 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) { 3748 sctp_log_map(0, 7, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 3749 } 3750 stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 3751 stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn); 3752 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 3753 3754 stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map; 3755 memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size); 3756 3757 stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn); 3758 stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn; 3759 3760 sctp_reset_out_streams(stcb, 0, (uint16_t *)NULL); 3761 sctp_reset_in_stream(stcb, 0, (uint16_t *)NULL); 3762 sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 0); 3763 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) { 3764 sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 3765 SCTP_ASSOC_RESET_DENIED); 3766 } else { 3767 sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 3768 SCTP_ASSOC_RESET_FAILED); 3769 } 3770 } 3771 /* get rid of the request and get the request flags */ 3772 if (asoc->stream_reset_outstanding == 0) { 3773 sctp_clean_up_stream_reset(stcb); 3774 } 3775 } 3776 } 3777 if (asoc->stream_reset_outstanding == 0) { 3778 sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED); 3779 } 3780 return (0); 3781 } 3782 3783 static void 3784 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb, 3785 struct sctp_tmit_chunk *chk, 3786 struct sctp_stream_reset_in_request *req, int trunc) 3787 { 3788 uint32_t seq; 3789 int len, i; 3790 int number_entries; 3791 uint16_t temp; 3792 3793 /* 3794 * peer wants me to send a str-reset to him for my outgoing seq's if 3795 * seq_in is right. 3796 */ 3797 struct sctp_association *asoc = &stcb->asoc; 3798 3799 seq = ntohl(req->request_seq); 3800 if (asoc->str_reset_seq_in == seq) { 3801 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 3802 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) { 3803 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 3804 } else if (trunc) { 3805 /* Can't do it, since they exceeded our buffer size */ 3806 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 3807 } else if (stcb->asoc.stream_reset_out_is_outstanding == 0) { 3808 len = ntohs(req->ph.param_length); 3809 number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t)); 3810 if (number_entries) { 3811 for (i = 0; i < number_entries; i++) { 3812 temp = ntohs(req->list_of_streams[i]); 3813 if (temp >= stcb->asoc.streamoutcnt) { 3814 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 3815 goto bad_boy; 3816 } 3817 req->list_of_streams[i] = temp; 3818 } 3819 for (i = 0; i < number_entries; i++) { 3820 if (stcb->asoc.strmout[req->list_of_streams[i]].state == SCTP_STREAM_OPEN) { 3821 stcb->asoc.strmout[req->list_of_streams[i]].state = SCTP_STREAM_RESET_PENDING; 3822 } 3823 } 3824 } else { 3825 /* Its all */ 3826 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3827 if (stcb->asoc.strmout[i].state == SCTP_STREAM_OPEN) 3828 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_PENDING; 3829 } 3830 } 3831 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED; 3832 } else { 3833 /* Can't do it, since we have sent one out */ 3834 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS; 3835 } 3836 bad_boy: 3837 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3838 asoc->str_reset_seq_in++; 3839 } else if (asoc->str_reset_seq_in - 1 == seq) { 3840 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3841 } else if (asoc->str_reset_seq_in - 2 == seq) { 3842 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 3843 } else { 3844 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO); 3845 } 3846 sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED); 3847 } 3848 3849 static int 3850 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb, 3851 struct sctp_tmit_chunk *chk, 3852 struct sctp_stream_reset_tsn_request *req) 3853 { 3854 /* reset all in and out and update the tsn */ 3855 /* 3856 * A) reset my str-seq's on in and out. B) Select a receive next, 3857 * and set cum-ack to it. Also process this selected number as a 3858 * fwd-tsn as well. C) set in the response my next sending seq. 3859 */ 3860 struct sctp_forward_tsn_chunk fwdtsn; 3861 struct sctp_association *asoc = &stcb->asoc; 3862 int abort_flag = 0; 3863 uint32_t seq; 3864 3865 seq = ntohl(req->request_seq); 3866 if (asoc->str_reset_seq_in == seq) { 3867 asoc->last_reset_action[1] = stcb->asoc.last_reset_action[0]; 3868 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) { 3869 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 3870 } else { 3871 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 3872 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 3873 fwdtsn.ch.chunk_flags = 0; 3874 fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1); 3875 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0); 3876 if (abort_flag) { 3877 return (1); 3878 } 3879 asoc->highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA; 3880 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) { 3881 sctp_log_map(0, 10, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 3882 } 3883 asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->highest_tsn_inside_map; 3884 asoc->mapping_array_base_tsn = asoc->highest_tsn_inside_map + 1; 3885 memset(asoc->mapping_array, 0, asoc->mapping_array_size); 3886 asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map; 3887 memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size); 3888 atomic_add_int(&asoc->sending_seq, 1); 3889 /* save off historical data for retrans */ 3890 asoc->last_sending_seq[1] = asoc->last_sending_seq[0]; 3891 asoc->last_sending_seq[0] = asoc->sending_seq; 3892 asoc->last_base_tsnsent[1] = asoc->last_base_tsnsent[0]; 3893 asoc->last_base_tsnsent[0] = asoc->mapping_array_base_tsn; 3894 sctp_reset_out_streams(stcb, 0, (uint16_t *)NULL); 3895 sctp_reset_in_stream(stcb, 0, (uint16_t *)NULL); 3896 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED; 3897 sctp_notify_stream_reset_tsn(stcb, asoc->sending_seq, (asoc->mapping_array_base_tsn + 1), 0); 3898 } 3899 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0], 3900 asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]); 3901 asoc->str_reset_seq_in++; 3902 } else if (asoc->str_reset_seq_in - 1 == seq) { 3903 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0], 3904 asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]); 3905 } else if (asoc->str_reset_seq_in - 2 == seq) { 3906 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1], 3907 asoc->last_sending_seq[1], asoc->last_base_tsnsent[1]); 3908 } else { 3909 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO); 3910 } 3911 return (0); 3912 } 3913 3914 static void 3915 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb, 3916 struct sctp_tmit_chunk *chk, 3917 struct sctp_stream_reset_out_request *req, int trunc) 3918 { 3919 uint32_t seq, tsn; 3920 int number_entries, len; 3921 struct sctp_association *asoc = &stcb->asoc; 3922 3923 seq = ntohl(req->request_seq); 3924 3925 /* now if its not a duplicate we process it */ 3926 if (asoc->str_reset_seq_in == seq) { 3927 len = ntohs(req->ph.param_length); 3928 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t)); 3929 /* 3930 * the sender is resetting, handle the list issue.. we must 3931 * a) verify if we can do the reset, if so no problem b) If 3932 * we can't do the reset we must copy the request. c) queue 3933 * it, and setup the data in processor to trigger it off 3934 * when needed and dequeue all the queued data. 3935 */ 3936 tsn = ntohl(req->send_reset_at_tsn); 3937 3938 /* move the reset action back one */ 3939 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 3940 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) { 3941 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 3942 } else if (trunc) { 3943 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 3944 } else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) { 3945 /* we can do it now */ 3946 sctp_reset_in_stream(stcb, number_entries, req->list_of_streams); 3947 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED; 3948 } else { 3949 /* 3950 * we must queue it up and thus wait for the TSN's 3951 * to arrive that are at or before tsn 3952 */ 3953 struct sctp_stream_reset_list *liste; 3954 int siz; 3955 3956 siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t)); 3957 SCTP_MALLOC(liste, struct sctp_stream_reset_list *, 3958 siz, SCTP_M_STRESET); 3959 if (liste == NULL) { 3960 /* gak out of memory */ 3961 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 3962 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3963 return; 3964 } 3965 liste->seq = seq; 3966 liste->tsn = tsn; 3967 liste->number_entries = number_entries; 3968 memcpy(&liste->list_of_streams, req->list_of_streams, number_entries * sizeof(uint16_t)); 3969 TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp); 3970 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_IN_PROGRESS; 3971 } 3972 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3973 asoc->str_reset_seq_in++; 3974 } else if ((asoc->str_reset_seq_in - 1) == seq) { 3975 /* 3976 * one seq back, just echo back last action since my 3977 * response was lost. 3978 */ 3979 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3980 } else if ((asoc->str_reset_seq_in - 2) == seq) { 3981 /* 3982 * two seq back, just echo back last action since my 3983 * response was lost. 3984 */ 3985 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 3986 } else { 3987 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO); 3988 } 3989 } 3990 3991 static void 3992 sctp_handle_str_reset_add_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk, 3993 struct sctp_stream_reset_add_strm *str_add) 3994 { 3995 /* 3996 * Peer is requesting to add more streams. If its within our 3997 * max-streams we will allow it. 3998 */ 3999 uint32_t num_stream, i; 4000 uint32_t seq; 4001 struct sctp_association *asoc = &stcb->asoc; 4002 struct sctp_queued_to_read *ctl, *nctl; 4003 4004 /* Get the number. */ 4005 seq = ntohl(str_add->request_seq); 4006 num_stream = ntohs(str_add->number_of_streams); 4007 /* Now what would be the new total? */ 4008 if (asoc->str_reset_seq_in == seq) { 4009 num_stream += stcb->asoc.streamincnt; 4010 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0]; 4011 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) { 4012 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 4013 } else if ((num_stream > stcb->asoc.max_inbound_streams) || 4014 (num_stream > 0xffff)) { 4015 /* We must reject it they ask for to many */ 4016 denied: 4017 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 4018 } else { 4019 /* Ok, we can do that :-) */ 4020 struct sctp_stream_in *oldstrm; 4021 4022 /* save off the old */ 4023 oldstrm = stcb->asoc.strmin; 4024 SCTP_MALLOC(stcb->asoc.strmin, struct sctp_stream_in *, 4025 (num_stream * sizeof(struct sctp_stream_in)), 4026 SCTP_M_STRMI); 4027 if (stcb->asoc.strmin == NULL) { 4028 stcb->asoc.strmin = oldstrm; 4029 goto denied; 4030 } 4031 /* copy off the old data */ 4032 for (i = 0; i < stcb->asoc.streamincnt; i++) { 4033 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue); 4034 TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue); 4035 stcb->asoc.strmin[i].sid = i; 4036 stcb->asoc.strmin[i].last_mid_delivered = oldstrm[i].last_mid_delivered; 4037 stcb->asoc.strmin[i].delivery_started = oldstrm[i].delivery_started; 4038 stcb->asoc.strmin[i].pd_api_started = oldstrm[i].pd_api_started; 4039 /* now anything on those queues? */ 4040 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].inqueue, next_instrm, nctl) { 4041 TAILQ_REMOVE(&oldstrm[i].inqueue, ctl, next_instrm); 4042 TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].inqueue, ctl, next_instrm); 4043 } 4044 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].uno_inqueue, next_instrm, nctl) { 4045 TAILQ_REMOVE(&oldstrm[i].uno_inqueue, ctl, next_instrm); 4046 TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].uno_inqueue, ctl, next_instrm); 4047 } 4048 } 4049 /* Init the new streams */ 4050 for (i = stcb->asoc.streamincnt; i < num_stream; i++) { 4051 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue); 4052 TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue); 4053 stcb->asoc.strmin[i].sid = i; 4054 stcb->asoc.strmin[i].last_mid_delivered = 0xffffffff; 4055 stcb->asoc.strmin[i].pd_api_started = 0; 4056 stcb->asoc.strmin[i].delivery_started = 0; 4057 } 4058 SCTP_FREE(oldstrm, SCTP_M_STRMI); 4059 /* update the size */ 4060 stcb->asoc.streamincnt = num_stream; 4061 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED; 4062 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0); 4063 } 4064 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 4065 asoc->str_reset_seq_in++; 4066 } else if ((asoc->str_reset_seq_in - 1) == seq) { 4067 /* 4068 * one seq back, just echo back last action since my 4069 * response was lost. 4070 */ 4071 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 4072 } else if ((asoc->str_reset_seq_in - 2) == seq) { 4073 /* 4074 * two seq back, just echo back last action since my 4075 * response was lost. 4076 */ 4077 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 4078 } else { 4079 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO); 4080 4081 } 4082 } 4083 4084 static void 4085 sctp_handle_str_reset_add_out_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk, 4086 struct sctp_stream_reset_add_strm *str_add) 4087 { 4088 /* 4089 * Peer is requesting to add more streams. If its within our 4090 * max-streams we will allow it. 4091 */ 4092 uint16_t num_stream; 4093 uint32_t seq; 4094 struct sctp_association *asoc = &stcb->asoc; 4095 4096 /* Get the number. */ 4097 seq = ntohl(str_add->request_seq); 4098 num_stream = ntohs(str_add->number_of_streams); 4099 /* Now what would be the new total? */ 4100 if (asoc->str_reset_seq_in == seq) { 4101 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0]; 4102 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) { 4103 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 4104 } else if (stcb->asoc.stream_reset_outstanding) { 4105 /* We must reject it we have something pending */ 4106 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS; 4107 } else { 4108 /* Ok, we can do that :-) */ 4109 int mychk; 4110 4111 mychk = stcb->asoc.streamoutcnt; 4112 mychk += num_stream; 4113 if (mychk < 0x10000) { 4114 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED; 4115 if (sctp_send_str_reset_req(stcb, 0, NULL, 0, 0, 1, num_stream, 0, 1)) { 4116 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 4117 } 4118 } else { 4119 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED; 4120 } 4121 } 4122 sctp_add_stream_reset_result(chk, seq, stcb->asoc.last_reset_action[0]); 4123 asoc->str_reset_seq_in++; 4124 } else if ((asoc->str_reset_seq_in - 1) == seq) { 4125 /* 4126 * one seq back, just echo back last action since my 4127 * response was lost. 4128 */ 4129 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 4130 } else if ((asoc->str_reset_seq_in - 2) == seq) { 4131 /* 4132 * two seq back, just echo back last action since my 4133 * response was lost. 4134 */ 4135 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 4136 } else { 4137 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO); 4138 } 4139 } 4140 4141 #ifdef __GNUC__ 4142 __attribute__((noinline)) 4143 #endif 4144 static int 4145 sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset, 4146 struct sctp_chunkhdr *ch_req) 4147 { 4148 uint16_t remaining_length, param_len, ptype; 4149 struct sctp_paramhdr pstore; 4150 uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE]; 4151 uint32_t seq = 0; 4152 int num_req = 0; 4153 int trunc = 0; 4154 struct sctp_tmit_chunk *chk; 4155 struct sctp_chunkhdr *ch; 4156 struct sctp_paramhdr *ph; 4157 int ret_code = 0; 4158 int num_param = 0; 4159 4160 /* now it may be a reset or a reset-response */ 4161 remaining_length = ntohs(ch_req->chunk_length) - sizeof(struct sctp_chunkhdr); 4162 4163 /* setup for adding the response */ 4164 sctp_alloc_a_chunk(stcb, chk); 4165 if (chk == NULL) { 4166 return (ret_code); 4167 } 4168 chk->copy_by_ref = 0; 4169 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 4170 chk->rec.chunk_id.can_take_data = 0; 4171 chk->flags = 0; 4172 chk->asoc = &stcb->asoc; 4173 chk->no_fr_allowed = 0; 4174 chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr); 4175 chk->book_size_scale = 0; 4176 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 4177 if (chk->data == NULL) { 4178 strres_nochunk: 4179 if (chk->data) { 4180 sctp_m_freem(chk->data); 4181 chk->data = NULL; 4182 } 4183 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 4184 return (ret_code); 4185 } 4186 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 4187 4188 /* setup chunk parameters */ 4189 chk->sent = SCTP_DATAGRAM_UNSENT; 4190 chk->snd_count = 0; 4191 chk->whoTo = NULL; 4192 4193 ch = mtod(chk->data, struct sctp_chunkhdr *); 4194 ch->chunk_type = SCTP_STREAM_RESET; 4195 ch->chunk_flags = 0; 4196 ch->chunk_length = htons(chk->send_size); 4197 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 4198 offset += sizeof(struct sctp_chunkhdr); 4199 while (remaining_length >= sizeof(struct sctp_paramhdr)) { 4200 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *)&pstore); 4201 if (ph == NULL) { 4202 /* TSNH */ 4203 break; 4204 } 4205 param_len = ntohs(ph->param_length); 4206 if ((param_len > remaining_length) || 4207 (param_len < (sizeof(struct sctp_paramhdr) + sizeof(uint32_t)))) { 4208 /* bad parameter length */ 4209 break; 4210 } 4211 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, sizeof(cstore)), 4212 (uint8_t *)&cstore); 4213 if (ph == NULL) { 4214 /* TSNH */ 4215 break; 4216 } 4217 ptype = ntohs(ph->param_type); 4218 num_param++; 4219 if (param_len > sizeof(cstore)) { 4220 trunc = 1; 4221 } else { 4222 trunc = 0; 4223 } 4224 if (num_param > SCTP_MAX_RESET_PARAMS) { 4225 /* hit the max of parameters already sorry.. */ 4226 break; 4227 } 4228 if (ptype == SCTP_STR_RESET_OUT_REQUEST) { 4229 struct sctp_stream_reset_out_request *req_out; 4230 4231 if (param_len < sizeof(struct sctp_stream_reset_out_request)) { 4232 break; 4233 } 4234 req_out = (struct sctp_stream_reset_out_request *)ph; 4235 num_req++; 4236 if (stcb->asoc.stream_reset_outstanding) { 4237 seq = ntohl(req_out->response_seq); 4238 if (seq == stcb->asoc.str_reset_seq_out) { 4239 /* implicit ack */ 4240 (void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_RESULT_PERFORMED, NULL); 4241 } 4242 } 4243 sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc); 4244 } else if (ptype == SCTP_STR_RESET_ADD_OUT_STREAMS) { 4245 struct sctp_stream_reset_add_strm *str_add; 4246 4247 if (param_len < sizeof(struct sctp_stream_reset_add_strm)) { 4248 break; 4249 } 4250 str_add = (struct sctp_stream_reset_add_strm *)ph; 4251 num_req++; 4252 sctp_handle_str_reset_add_strm(stcb, chk, str_add); 4253 } else if (ptype == SCTP_STR_RESET_ADD_IN_STREAMS) { 4254 struct sctp_stream_reset_add_strm *str_add; 4255 4256 if (param_len < sizeof(struct sctp_stream_reset_add_strm)) { 4257 break; 4258 } 4259 str_add = (struct sctp_stream_reset_add_strm *)ph; 4260 num_req++; 4261 sctp_handle_str_reset_add_out_strm(stcb, chk, str_add); 4262 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) { 4263 struct sctp_stream_reset_in_request *req_in; 4264 4265 num_req++; 4266 req_in = (struct sctp_stream_reset_in_request *)ph; 4267 sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc); 4268 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) { 4269 struct sctp_stream_reset_tsn_request *req_tsn; 4270 4271 num_req++; 4272 req_tsn = (struct sctp_stream_reset_tsn_request *)ph; 4273 if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) { 4274 ret_code = 1; 4275 goto strres_nochunk; 4276 } 4277 /* no more */ 4278 break; 4279 } else if (ptype == SCTP_STR_RESET_RESPONSE) { 4280 struct sctp_stream_reset_response *resp; 4281 uint32_t result; 4282 4283 if (param_len < sizeof(struct sctp_stream_reset_response)) { 4284 break; 4285 } 4286 resp = (struct sctp_stream_reset_response *)ph; 4287 seq = ntohl(resp->response_seq); 4288 result = ntohl(resp->result); 4289 if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) { 4290 ret_code = 1; 4291 goto strres_nochunk; 4292 } 4293 } else { 4294 break; 4295 } 4296 offset += SCTP_SIZE32(param_len); 4297 if (remaining_length >= SCTP_SIZE32(param_len)) { 4298 remaining_length -= SCTP_SIZE32(param_len); 4299 } else { 4300 remaining_length = 0; 4301 } 4302 } 4303 if (num_req == 0) { 4304 /* we have no response free the stuff */ 4305 goto strres_nochunk; 4306 } 4307 /* ok we have a chunk to link in */ 4308 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, 4309 chk, 4310 sctp_next); 4311 stcb->asoc.ctrl_queue_cnt++; 4312 return (ret_code); 4313 } 4314 4315 /* 4316 * Handle a router or endpoints report of a packet loss, there are two ways 4317 * to handle this, either we get the whole packet and must disect it 4318 * ourselves (possibly with truncation and or corruption) or it is a summary 4319 * from a middle box that did the disectting for us. 4320 */ 4321 static void 4322 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp, 4323 struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit) 4324 { 4325 uint32_t bottle_bw, on_queue; 4326 uint16_t trunc_len; 4327 unsigned int chlen; 4328 unsigned int at; 4329 struct sctp_chunk_desc desc; 4330 struct sctp_chunkhdr *ch; 4331 4332 chlen = ntohs(cp->ch.chunk_length); 4333 chlen -= sizeof(struct sctp_pktdrop_chunk); 4334 /* XXX possible chlen underflow */ 4335 if (chlen == 0) { 4336 ch = NULL; 4337 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) 4338 SCTP_STAT_INCR(sctps_pdrpbwrpt); 4339 } else { 4340 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr)); 4341 chlen -= sizeof(struct sctphdr); 4342 /* XXX possible chlen underflow */ 4343 memset(&desc, 0, sizeof(desc)); 4344 } 4345 trunc_len = (uint16_t)ntohs(cp->trunc_len); 4346 if (trunc_len > limit) { 4347 trunc_len = limit; 4348 } 4349 /* now the chunks themselves */ 4350 while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) { 4351 desc.chunk_type = ch->chunk_type; 4352 /* get amount we need to move */ 4353 at = ntohs(ch->chunk_length); 4354 if (at < sizeof(struct sctp_chunkhdr)) { 4355 /* corrupt chunk, maybe at the end? */ 4356 SCTP_STAT_INCR(sctps_pdrpcrupt); 4357 break; 4358 } 4359 if (trunc_len == 0) { 4360 /* we are supposed to have all of it */ 4361 if (at > chlen) { 4362 /* corrupt skip it */ 4363 SCTP_STAT_INCR(sctps_pdrpcrupt); 4364 break; 4365 } 4366 } else { 4367 /* is there enough of it left ? */ 4368 if (desc.chunk_type == SCTP_DATA) { 4369 if (chlen < (sizeof(struct sctp_data_chunk) + 4370 sizeof(desc.data_bytes))) { 4371 break; 4372 } 4373 } else { 4374 if (chlen < sizeof(struct sctp_chunkhdr)) { 4375 break; 4376 } 4377 } 4378 } 4379 if (desc.chunk_type == SCTP_DATA) { 4380 /* can we get out the tsn? */ 4381 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 4382 SCTP_STAT_INCR(sctps_pdrpmbda); 4383 4384 if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) { 4385 /* yep */ 4386 struct sctp_data_chunk *dcp; 4387 uint8_t *ddp; 4388 unsigned int iii; 4389 4390 dcp = (struct sctp_data_chunk *)ch; 4391 ddp = (uint8_t *)(dcp + 1); 4392 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) { 4393 desc.data_bytes[iii] = ddp[iii]; 4394 } 4395 desc.tsn_ifany = dcp->dp.tsn; 4396 } else { 4397 /* nope we are done. */ 4398 SCTP_STAT_INCR(sctps_pdrpnedat); 4399 break; 4400 } 4401 } else { 4402 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 4403 SCTP_STAT_INCR(sctps_pdrpmbct); 4404 } 4405 4406 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) { 4407 SCTP_STAT_INCR(sctps_pdrppdbrk); 4408 break; 4409 } 4410 if (SCTP_SIZE32(at) > chlen) { 4411 break; 4412 } 4413 chlen -= SCTP_SIZE32(at); 4414 if (chlen < sizeof(struct sctp_chunkhdr)) { 4415 /* done, none left */ 4416 break; 4417 } 4418 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at)); 4419 } 4420 /* Now update any rwnd --- possibly */ 4421 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) { 4422 /* From a peer, we get a rwnd report */ 4423 uint32_t a_rwnd; 4424 4425 SCTP_STAT_INCR(sctps_pdrpfehos); 4426 4427 bottle_bw = ntohl(cp->bottle_bw); 4428 on_queue = ntohl(cp->current_onq); 4429 if (bottle_bw && on_queue) { 4430 /* a rwnd report is in here */ 4431 if (bottle_bw > on_queue) 4432 a_rwnd = bottle_bw - on_queue; 4433 else 4434 a_rwnd = 0; 4435 4436 if (a_rwnd == 0) 4437 stcb->asoc.peers_rwnd = 0; 4438 else { 4439 if (a_rwnd > stcb->asoc.total_flight) { 4440 stcb->asoc.peers_rwnd = 4441 a_rwnd - stcb->asoc.total_flight; 4442 } else { 4443 stcb->asoc.peers_rwnd = 0; 4444 } 4445 if (stcb->asoc.peers_rwnd < 4446 stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 4447 /* SWS sender side engages */ 4448 stcb->asoc.peers_rwnd = 0; 4449 } 4450 } 4451 } 4452 } else { 4453 SCTP_STAT_INCR(sctps_pdrpfmbox); 4454 } 4455 4456 /* now middle boxes in sat networks get a cwnd bump */ 4457 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) && 4458 (stcb->asoc.sat_t3_loss_recovery == 0) && 4459 (stcb->asoc.sat_network)) { 4460 /* 4461 * This is debatable but for sat networks it makes sense 4462 * Note if a T3 timer has went off, we will prohibit any 4463 * changes to cwnd until we exit the t3 loss recovery. 4464 */ 4465 stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb, 4466 net, cp, &bottle_bw, &on_queue); 4467 } 4468 } 4469 4470 /* 4471 * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to 4472 * still contain IP/SCTP header - stcb: is the tcb found for this packet - 4473 * offset: offset into the mbuf chain to first chunkhdr - length: is the 4474 * length of the complete packet outputs: - length: modified to remaining 4475 * length after control processing - netp: modified to new sctp_nets after 4476 * cookie-echo processing - return NULL to discard the packet (ie. no asoc, 4477 * bad packet,...) otherwise return the tcb for this packet 4478 */ 4479 #ifdef __GNUC__ 4480 __attribute__((noinline)) 4481 #endif 4482 static struct sctp_tcb * 4483 sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length, 4484 struct sockaddr *src, struct sockaddr *dst, 4485 struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp, 4486 struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen, 4487 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 4488 uint32_t vrf_id, uint16_t port) 4489 { 4490 struct sctp_association *asoc; 4491 struct mbuf *op_err; 4492 char msg[SCTP_DIAG_INFO_LEN]; 4493 uint32_t vtag_in; 4494 int num_chunks = 0; /* number of control chunks processed */ 4495 uint32_t chk_length; 4496 int ret; 4497 int abort_no_unlock = 0; 4498 int ecne_seen = 0; 4499 4500 /* 4501 * How big should this be, and should it be alloc'd? Lets try the 4502 * d-mtu-ceiling for now (2k) and that should hopefully work ... 4503 * until we get into jumbo grams and such.. 4504 */ 4505 uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE]; 4506 struct sctp_tcb *locked_tcb = stcb; 4507 int got_auth = 0; 4508 uint32_t auth_offset = 0, auth_len = 0; 4509 int auth_skipped = 0; 4510 int asconf_cnt = 0; 4511 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4512 struct socket *so; 4513 #endif 4514 4515 SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n", 4516 iphlen, *offset, length, (void *)stcb); 4517 4518 /* validate chunk header length... */ 4519 if (ntohs(ch->chunk_length) < sizeof(*ch)) { 4520 SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n", 4521 ntohs(ch->chunk_length)); 4522 if (locked_tcb) { 4523 SCTP_TCB_UNLOCK(locked_tcb); 4524 } 4525 return (NULL); 4526 } 4527 /* 4528 * validate the verification tag 4529 */ 4530 vtag_in = ntohl(sh->v_tag); 4531 4532 if (locked_tcb) { 4533 SCTP_TCB_LOCK_ASSERT(locked_tcb); 4534 } 4535 if (ch->chunk_type == SCTP_INITIATION) { 4536 SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n", 4537 ntohs(ch->chunk_length), vtag_in); 4538 if (vtag_in != 0) { 4539 /* protocol error- silently discard... */ 4540 SCTP_STAT_INCR(sctps_badvtag); 4541 if (locked_tcb) { 4542 SCTP_TCB_UNLOCK(locked_tcb); 4543 } 4544 return (NULL); 4545 } 4546 } else if (ch->chunk_type != SCTP_COOKIE_ECHO) { 4547 /* 4548 * If there is no stcb, skip the AUTH chunk and process 4549 * later after a stcb is found (to validate the lookup was 4550 * valid. 4551 */ 4552 if ((ch->chunk_type == SCTP_AUTHENTICATION) && 4553 (stcb == NULL) && 4554 (inp->auth_supported == 1)) { 4555 /* save this chunk for later processing */ 4556 auth_skipped = 1; 4557 auth_offset = *offset; 4558 auth_len = ntohs(ch->chunk_length); 4559 4560 /* (temporarily) move past this chunk */ 4561 *offset += SCTP_SIZE32(auth_len); 4562 if (*offset >= length) { 4563 /* no more data left in the mbuf chain */ 4564 *offset = length; 4565 if (locked_tcb) { 4566 SCTP_TCB_UNLOCK(locked_tcb); 4567 } 4568 return (NULL); 4569 } 4570 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4571 sizeof(struct sctp_chunkhdr), chunk_buf); 4572 } 4573 if (ch == NULL) { 4574 /* Help */ 4575 *offset = length; 4576 if (locked_tcb) { 4577 SCTP_TCB_UNLOCK(locked_tcb); 4578 } 4579 return (NULL); 4580 } 4581 if (ch->chunk_type == SCTP_COOKIE_ECHO) { 4582 goto process_control_chunks; 4583 } 4584 /* 4585 * first check if it's an ASCONF with an unknown src addr we 4586 * need to look inside to find the association 4587 */ 4588 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) { 4589 struct sctp_chunkhdr *asconf_ch = ch; 4590 uint32_t asconf_offset = 0, asconf_len = 0; 4591 4592 /* inp's refcount may be reduced */ 4593 SCTP_INP_INCR_REF(inp); 4594 4595 asconf_offset = *offset; 4596 do { 4597 asconf_len = ntohs(asconf_ch->chunk_length); 4598 if (asconf_len < sizeof(struct sctp_asconf_paramhdr)) 4599 break; 4600 stcb = sctp_findassociation_ep_asconf(m, 4601 *offset, 4602 dst, 4603 sh, &inp, netp, vrf_id); 4604 if (stcb != NULL) 4605 break; 4606 asconf_offset += SCTP_SIZE32(asconf_len); 4607 asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset, 4608 sizeof(struct sctp_chunkhdr), chunk_buf); 4609 } while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF); 4610 if (stcb == NULL) { 4611 /* 4612 * reduce inp's refcount if not reduced in 4613 * sctp_findassociation_ep_asconf(). 4614 */ 4615 SCTP_INP_DECR_REF(inp); 4616 } else { 4617 locked_tcb = stcb; 4618 } 4619 4620 /* now go back and verify any auth chunk to be sure */ 4621 if (auth_skipped && (stcb != NULL)) { 4622 struct sctp_auth_chunk *auth; 4623 4624 auth = (struct sctp_auth_chunk *) 4625 sctp_m_getptr(m, auth_offset, 4626 auth_len, chunk_buf); 4627 got_auth = 1; 4628 auth_skipped = 0; 4629 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, 4630 auth_offset)) { 4631 /* auth HMAC failed so dump it */ 4632 *offset = length; 4633 if (locked_tcb) { 4634 SCTP_TCB_UNLOCK(locked_tcb); 4635 } 4636 return (NULL); 4637 } else { 4638 /* remaining chunks are HMAC checked */ 4639 stcb->asoc.authenticated = 1; 4640 } 4641 } 4642 } 4643 if (stcb == NULL) { 4644 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__); 4645 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 4646 msg); 4647 /* no association, so it's out of the blue... */ 4648 sctp_handle_ootb(m, iphlen, *offset, src, dst, sh, inp, op_err, 4649 mflowtype, mflowid, inp->fibnum, 4650 vrf_id, port); 4651 *offset = length; 4652 if (locked_tcb) { 4653 SCTP_TCB_UNLOCK(locked_tcb); 4654 } 4655 return (NULL); 4656 } 4657 asoc = &stcb->asoc; 4658 /* ABORT and SHUTDOWN can use either v_tag... */ 4659 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) || 4660 (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) || 4661 (ch->chunk_type == SCTP_PACKET_DROPPED)) { 4662 /* Take the T-bit always into account. */ 4663 if ((((ch->chunk_flags & SCTP_HAD_NO_TCB) == 0) && 4664 (vtag_in == asoc->my_vtag)) || 4665 (((ch->chunk_flags & SCTP_HAD_NO_TCB) == SCTP_HAD_NO_TCB) && 4666 (vtag_in == asoc->peer_vtag))) { 4667 /* this is valid */ 4668 } else { 4669 /* drop this packet... */ 4670 SCTP_STAT_INCR(sctps_badvtag); 4671 if (locked_tcb) { 4672 SCTP_TCB_UNLOCK(locked_tcb); 4673 } 4674 return (NULL); 4675 } 4676 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 4677 if (vtag_in != asoc->my_vtag) { 4678 /* 4679 * this could be a stale SHUTDOWN-ACK or the 4680 * peer never got the SHUTDOWN-COMPLETE and 4681 * is still hung; we have started a new asoc 4682 * but it won't complete until the shutdown 4683 * is completed 4684 */ 4685 if (locked_tcb) { 4686 SCTP_TCB_UNLOCK(locked_tcb); 4687 } 4688 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__); 4689 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 4690 msg); 4691 sctp_handle_ootb(m, iphlen, *offset, src, dst, 4692 sh, inp, op_err, 4693 mflowtype, mflowid, fibnum, 4694 vrf_id, port); 4695 return (NULL); 4696 } 4697 } else { 4698 /* for all other chunks, vtag must match */ 4699 if (vtag_in != asoc->my_vtag) { 4700 /* invalid vtag... */ 4701 SCTPDBG(SCTP_DEBUG_INPUT3, 4702 "invalid vtag: %xh, expect %xh\n", 4703 vtag_in, asoc->my_vtag); 4704 SCTP_STAT_INCR(sctps_badvtag); 4705 if (locked_tcb) { 4706 SCTP_TCB_UNLOCK(locked_tcb); 4707 } 4708 *offset = length; 4709 return (NULL); 4710 } 4711 } 4712 } /* end if !SCTP_COOKIE_ECHO */ 4713 /* 4714 * process all control chunks... 4715 */ 4716 if (((ch->chunk_type == SCTP_SELECTIVE_ACK) || 4717 (ch->chunk_type == SCTP_NR_SELECTIVE_ACK) || 4718 (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) && 4719 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 4720 /* implied cookie-ack.. we must have lost the ack */ 4721 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 4722 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 4723 stcb->asoc.overall_error_count, 4724 0, 4725 SCTP_FROM_SCTP_INPUT, 4726 __LINE__); 4727 } 4728 stcb->asoc.overall_error_count = 0; 4729 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, 4730 *netp); 4731 } 4732 process_control_chunks: 4733 while (IS_SCTP_CONTROL(ch)) { 4734 /* validate chunk length */ 4735 chk_length = ntohs(ch->chunk_length); 4736 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n", 4737 ch->chunk_type, chk_length); 4738 SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length); 4739 if (chk_length < sizeof(*ch) || 4740 (*offset + (int)chk_length) > length) { 4741 *offset = length; 4742 if (locked_tcb) { 4743 SCTP_TCB_UNLOCK(locked_tcb); 4744 } 4745 return (NULL); 4746 } 4747 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks); 4748 /* 4749 * INIT-ACK only gets the init ack "header" portion only 4750 * because we don't have to process the peer's COOKIE. All 4751 * others get a complete chunk. 4752 */ 4753 if ((ch->chunk_type == SCTP_INITIATION_ACK) || 4754 (ch->chunk_type == SCTP_INITIATION)) { 4755 /* get an init-ack chunk */ 4756 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4757 sizeof(struct sctp_init_ack_chunk), chunk_buf); 4758 if (ch == NULL) { 4759 *offset = length; 4760 if (locked_tcb) { 4761 SCTP_TCB_UNLOCK(locked_tcb); 4762 } 4763 return (NULL); 4764 } 4765 } else { 4766 /* For cookies and all other chunks. */ 4767 if (chk_length > sizeof(chunk_buf)) { 4768 /* 4769 * use just the size of the chunk buffer so 4770 * the front part of our chunks fit in 4771 * contiguous space up to the chunk buffer 4772 * size (508 bytes). For chunks that need to 4773 * get more than that they must use the 4774 * sctp_m_getptr() function or other means 4775 * (e.g. know how to parse mbuf chains). 4776 * Cookies do this already. 4777 */ 4778 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4779 (sizeof(chunk_buf) - 4), 4780 chunk_buf); 4781 if (ch == NULL) { 4782 *offset = length; 4783 if (locked_tcb) { 4784 SCTP_TCB_UNLOCK(locked_tcb); 4785 } 4786 return (NULL); 4787 } 4788 } else { 4789 /* We can fit it all */ 4790 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4791 chk_length, chunk_buf); 4792 if (ch == NULL) { 4793 SCTP_PRINTF("sctp_process_control: Can't get the all data....\n"); 4794 *offset = length; 4795 if (locked_tcb) { 4796 SCTP_TCB_UNLOCK(locked_tcb); 4797 } 4798 return (NULL); 4799 } 4800 } 4801 } 4802 num_chunks++; 4803 /* Save off the last place we got a control from */ 4804 if (stcb != NULL) { 4805 if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) { 4806 /* 4807 * allow last_control to be NULL if 4808 * ASCONF... ASCONF processing will find the 4809 * right net later 4810 */ 4811 if ((netp != NULL) && (*netp != NULL)) 4812 stcb->asoc.last_control_chunk_from = *netp; 4813 } 4814 } 4815 #ifdef SCTP_AUDITING_ENABLED 4816 sctp_audit_log(0xB0, ch->chunk_type); 4817 #endif 4818 4819 /* check to see if this chunk required auth, but isn't */ 4820 if ((stcb != NULL) && 4821 (stcb->asoc.auth_supported == 1) && 4822 sctp_auth_is_required_chunk(ch->chunk_type, stcb->asoc.local_auth_chunks) && 4823 !stcb->asoc.authenticated) { 4824 /* "silently" ignore */ 4825 SCTP_STAT_INCR(sctps_recvauthmissing); 4826 goto next_chunk; 4827 } 4828 switch (ch->chunk_type) { 4829 case SCTP_INITIATION: 4830 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n"); 4831 /* The INIT chunk must be the only chunk. */ 4832 if ((num_chunks > 1) || 4833 (length - *offset > (int)SCTP_SIZE32(chk_length))) { 4834 /* RFC 4960 requires that no ABORT is sent */ 4835 *offset = length; 4836 if (locked_tcb) { 4837 SCTP_TCB_UNLOCK(locked_tcb); 4838 } 4839 return (NULL); 4840 } 4841 /* Honor our resource limit. */ 4842 if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) { 4843 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, ""); 4844 sctp_abort_association(inp, stcb, m, iphlen, 4845 src, dst, sh, op_err, 4846 mflowtype, mflowid, 4847 vrf_id, port); 4848 *offset = length; 4849 return (NULL); 4850 } 4851 sctp_handle_init(m, iphlen, *offset, src, dst, sh, 4852 (struct sctp_init_chunk *)ch, inp, 4853 stcb, *netp, &abort_no_unlock, 4854 mflowtype, mflowid, 4855 vrf_id, port); 4856 *offset = length; 4857 if ((!abort_no_unlock) && (locked_tcb)) { 4858 SCTP_TCB_UNLOCK(locked_tcb); 4859 } 4860 return (NULL); 4861 break; 4862 case SCTP_PAD_CHUNK: 4863 break; 4864 case SCTP_INITIATION_ACK: 4865 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n"); 4866 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4867 /* We are not interested anymore */ 4868 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 4869 ; 4870 } else { 4871 if ((locked_tcb != NULL) && (locked_tcb != stcb)) { 4872 /* Very unlikely */ 4873 SCTP_TCB_UNLOCK(locked_tcb); 4874 } 4875 *offset = length; 4876 if (stcb) { 4877 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4878 so = SCTP_INP_SO(inp); 4879 atomic_add_int(&stcb->asoc.refcnt, 1); 4880 SCTP_TCB_UNLOCK(stcb); 4881 SCTP_SOCKET_LOCK(so, 1); 4882 SCTP_TCB_LOCK(stcb); 4883 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4884 #endif 4885 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 4886 SCTP_FROM_SCTP_INPUT + SCTP_LOC_29); 4887 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4888 SCTP_SOCKET_UNLOCK(so, 1); 4889 #endif 4890 } 4891 return (NULL); 4892 } 4893 } 4894 /* The INIT-ACK chunk must be the only chunk. */ 4895 if ((num_chunks > 1) || 4896 (length - *offset > (int)SCTP_SIZE32(chk_length))) { 4897 *offset = length; 4898 if (locked_tcb) { 4899 SCTP_TCB_UNLOCK(locked_tcb); 4900 } 4901 return (NULL); 4902 } 4903 if ((netp) && (*netp)) { 4904 ret = sctp_handle_init_ack(m, iphlen, *offset, 4905 src, dst, sh, 4906 (struct sctp_init_ack_chunk *)ch, 4907 stcb, *netp, 4908 &abort_no_unlock, 4909 mflowtype, mflowid, 4910 vrf_id); 4911 } else { 4912 ret = -1; 4913 } 4914 *offset = length; 4915 if (abort_no_unlock) { 4916 return (NULL); 4917 } 4918 /* 4919 * Special case, I must call the output routine to 4920 * get the cookie echoed 4921 */ 4922 if ((stcb != NULL) && (ret == 0)) { 4923 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED); 4924 } 4925 if (locked_tcb) { 4926 SCTP_TCB_UNLOCK(locked_tcb); 4927 } 4928 return (NULL); 4929 break; 4930 case SCTP_SELECTIVE_ACK: 4931 { 4932 struct sctp_sack_chunk *sack; 4933 int abort_now = 0; 4934 uint32_t a_rwnd, cum_ack; 4935 uint16_t num_seg, num_dup; 4936 uint8_t flags; 4937 int offset_seg, offset_dup; 4938 4939 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n"); 4940 SCTP_STAT_INCR(sctps_recvsacks); 4941 if (stcb == NULL) { 4942 SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing SACK chunk\n"); 4943 break; 4944 } 4945 if (chk_length < sizeof(struct sctp_sack_chunk)) { 4946 SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on SACK chunk, too small\n"); 4947 break; 4948 } 4949 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) { 4950 /*- 4951 * If we have sent a shutdown-ack, we will pay no 4952 * attention to a sack sent in to us since 4953 * we don't care anymore. 4954 */ 4955 break; 4956 } 4957 sack = (struct sctp_sack_chunk *)ch; 4958 flags = ch->chunk_flags; 4959 cum_ack = ntohl(sack->sack.cum_tsn_ack); 4960 num_seg = ntohs(sack->sack.num_gap_ack_blks); 4961 num_dup = ntohs(sack->sack.num_dup_tsns); 4962 a_rwnd = (uint32_t)ntohl(sack->sack.a_rwnd); 4963 if (sizeof(struct sctp_sack_chunk) + 4964 num_seg * sizeof(struct sctp_gap_ack_block) + 4965 num_dup * sizeof(uint32_t) != chk_length) { 4966 SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of SACK chunk\n"); 4967 break; 4968 } 4969 offset_seg = *offset + sizeof(struct sctp_sack_chunk); 4970 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block); 4971 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n", 4972 cum_ack, num_seg, a_rwnd); 4973 stcb->asoc.seen_a_sack_this_pkt = 1; 4974 if ((stcb->asoc.pr_sctp_cnt == 0) && 4975 (num_seg == 0) && 4976 SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) && 4977 (stcb->asoc.saw_sack_with_frags == 0) && 4978 (stcb->asoc.saw_sack_with_nr_frags == 0) && 4979 (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) 4980 ) { 4981 /* 4982 * We have a SIMPLE sack having no 4983 * prior segments and data on sent 4984 * queue to be acked.. Use the 4985 * faster path sack processing. We 4986 * also allow window update sacks 4987 * with no missing segments to go 4988 * this way too. 4989 */ 4990 sctp_express_handle_sack(stcb, cum_ack, a_rwnd, &abort_now, ecne_seen); 4991 } else { 4992 if (netp && *netp) 4993 sctp_handle_sack(m, offset_seg, offset_dup, stcb, 4994 num_seg, 0, num_dup, &abort_now, flags, 4995 cum_ack, a_rwnd, ecne_seen); 4996 } 4997 if (abort_now) { 4998 /* ABORT signal from sack processing */ 4999 *offset = length; 5000 return (NULL); 5001 } 5002 if (TAILQ_EMPTY(&stcb->asoc.send_queue) && 5003 TAILQ_EMPTY(&stcb->asoc.sent_queue) && 5004 (stcb->asoc.stream_queue_cnt == 0)) { 5005 sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED); 5006 } 5007 } 5008 break; 5009 /* 5010 * EY - nr_sack: If the received chunk is an 5011 * nr_sack chunk 5012 */ 5013 case SCTP_NR_SELECTIVE_ACK: 5014 { 5015 struct sctp_nr_sack_chunk *nr_sack; 5016 int abort_now = 0; 5017 uint32_t a_rwnd, cum_ack; 5018 uint16_t num_seg, num_nr_seg, num_dup; 5019 uint8_t flags; 5020 int offset_seg, offset_dup; 5021 5022 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK\n"); 5023 SCTP_STAT_INCR(sctps_recvsacks); 5024 if (stcb == NULL) { 5025 SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing NR-SACK chunk\n"); 5026 break; 5027 } 5028 if (stcb->asoc.nrsack_supported == 0) { 5029 goto unknown_chunk; 5030 } 5031 if (chk_length < sizeof(struct sctp_nr_sack_chunk)) { 5032 SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on NR-SACK chunk, too small\n"); 5033 break; 5034 } 5035 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) { 5036 /*- 5037 * If we have sent a shutdown-ack, we will pay no 5038 * attention to a sack sent in to us since 5039 * we don't care anymore. 5040 */ 5041 break; 5042 } 5043 nr_sack = (struct sctp_nr_sack_chunk *)ch; 5044 flags = ch->chunk_flags; 5045 cum_ack = ntohl(nr_sack->nr_sack.cum_tsn_ack); 5046 num_seg = ntohs(nr_sack->nr_sack.num_gap_ack_blks); 5047 num_nr_seg = ntohs(nr_sack->nr_sack.num_nr_gap_ack_blks); 5048 num_dup = ntohs(nr_sack->nr_sack.num_dup_tsns); 5049 a_rwnd = (uint32_t)ntohl(nr_sack->nr_sack.a_rwnd); 5050 if (sizeof(struct sctp_nr_sack_chunk) + 5051 (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block) + 5052 num_dup * sizeof(uint32_t) != chk_length) { 5053 SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of NR_SACK chunk\n"); 5054 break; 5055 } 5056 offset_seg = *offset + sizeof(struct sctp_nr_sack_chunk); 5057 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block); 5058 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n", 5059 cum_ack, num_seg, a_rwnd); 5060 stcb->asoc.seen_a_sack_this_pkt = 1; 5061 if ((stcb->asoc.pr_sctp_cnt == 0) && 5062 (num_seg == 0) && (num_nr_seg == 0) && 5063 SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) && 5064 (stcb->asoc.saw_sack_with_frags == 0) && 5065 (stcb->asoc.saw_sack_with_nr_frags == 0) && 5066 (!TAILQ_EMPTY(&stcb->asoc.sent_queue))) { 5067 /* 5068 * We have a SIMPLE sack having no 5069 * prior segments and data on sent 5070 * queue to be acked. Use the faster 5071 * path sack processing. We also 5072 * allow window update sacks with no 5073 * missing segments to go this way 5074 * too. 5075 */ 5076 sctp_express_handle_sack(stcb, cum_ack, a_rwnd, 5077 &abort_now, ecne_seen); 5078 } else { 5079 if (netp && *netp) 5080 sctp_handle_sack(m, offset_seg, offset_dup, stcb, 5081 num_seg, num_nr_seg, num_dup, &abort_now, flags, 5082 cum_ack, a_rwnd, ecne_seen); 5083 } 5084 if (abort_now) { 5085 /* ABORT signal from sack processing */ 5086 *offset = length; 5087 return (NULL); 5088 } 5089 if (TAILQ_EMPTY(&stcb->asoc.send_queue) && 5090 TAILQ_EMPTY(&stcb->asoc.sent_queue) && 5091 (stcb->asoc.stream_queue_cnt == 0)) { 5092 sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED); 5093 } 5094 } 5095 break; 5096 5097 case SCTP_HEARTBEAT_REQUEST: 5098 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n"); 5099 if ((stcb) && netp && *netp) { 5100 SCTP_STAT_INCR(sctps_recvheartbeat); 5101 sctp_send_heartbeat_ack(stcb, m, *offset, 5102 chk_length, *netp); 5103 5104 /* He's alive so give him credit */ 5105 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 5106 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 5107 stcb->asoc.overall_error_count, 5108 0, 5109 SCTP_FROM_SCTP_INPUT, 5110 __LINE__); 5111 } 5112 stcb->asoc.overall_error_count = 0; 5113 } 5114 break; 5115 case SCTP_HEARTBEAT_ACK: 5116 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n"); 5117 if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) { 5118 /* Its not ours */ 5119 *offset = length; 5120 if (locked_tcb) { 5121 SCTP_TCB_UNLOCK(locked_tcb); 5122 } 5123 return (NULL); 5124 } 5125 /* He's alive so give him credit */ 5126 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 5127 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 5128 stcb->asoc.overall_error_count, 5129 0, 5130 SCTP_FROM_SCTP_INPUT, 5131 __LINE__); 5132 } 5133 stcb->asoc.overall_error_count = 0; 5134 SCTP_STAT_INCR(sctps_recvheartbeatack); 5135 if (netp && *netp) 5136 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch, 5137 stcb, *netp); 5138 break; 5139 case SCTP_ABORT_ASSOCIATION: 5140 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n", 5141 (void *)stcb); 5142 if ((stcb) && netp && *netp) 5143 sctp_handle_abort((struct sctp_abort_chunk *)ch, 5144 stcb, *netp); 5145 *offset = length; 5146 return (NULL); 5147 break; 5148 case SCTP_SHUTDOWN: 5149 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n", 5150 (void *)stcb); 5151 if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) { 5152 *offset = length; 5153 if (locked_tcb) { 5154 SCTP_TCB_UNLOCK(locked_tcb); 5155 } 5156 return (NULL); 5157 } 5158 if (netp && *netp) { 5159 int abort_flag = 0; 5160 5161 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch, 5162 stcb, *netp, &abort_flag); 5163 if (abort_flag) { 5164 *offset = length; 5165 return (NULL); 5166 } 5167 } 5168 break; 5169 case SCTP_SHUTDOWN_ACK: 5170 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", (void *)stcb); 5171 if ((stcb) && (netp) && (*netp)) 5172 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp); 5173 *offset = length; 5174 return (NULL); 5175 break; 5176 5177 case SCTP_OPERATION_ERROR: 5178 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n"); 5179 if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) { 5180 *offset = length; 5181 return (NULL); 5182 } 5183 break; 5184 case SCTP_COOKIE_ECHO: 5185 SCTPDBG(SCTP_DEBUG_INPUT3, 5186 "SCTP_COOKIE-ECHO, stcb %p\n", (void *)stcb); 5187 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 5188 ; 5189 } else { 5190 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 5191 /* We are not interested anymore */ 5192 abend: 5193 if (stcb) { 5194 SCTP_TCB_UNLOCK(stcb); 5195 } 5196 *offset = length; 5197 return (NULL); 5198 } 5199 } 5200 /* 5201 * First are we accepting? We do this again here 5202 * since it is possible that a previous endpoint WAS 5203 * listening responded to a INIT-ACK and then 5204 * closed. We opened and bound.. and are now no 5205 * longer listening. 5206 */ 5207 5208 if ((stcb == NULL) && (inp->sctp_socket->so_qlen >= inp->sctp_socket->so_qlimit)) { 5209 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 5210 (SCTP_BASE_SYSCTL(sctp_abort_if_one_2_one_hits_limit))) { 5211 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, ""); 5212 sctp_abort_association(inp, stcb, m, iphlen, 5213 src, dst, sh, op_err, 5214 mflowtype, mflowid, 5215 vrf_id, port); 5216 } 5217 *offset = length; 5218 return (NULL); 5219 } else { 5220 struct mbuf *ret_buf; 5221 struct sctp_inpcb *linp; 5222 5223 if (stcb) { 5224 linp = NULL; 5225 } else { 5226 linp = inp; 5227 } 5228 5229 if (linp) { 5230 SCTP_ASOC_CREATE_LOCK(linp); 5231 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 5232 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 5233 SCTP_ASOC_CREATE_UNLOCK(linp); 5234 goto abend; 5235 } 5236 } 5237 if (netp) { 5238 ret_buf = 5239 sctp_handle_cookie_echo(m, iphlen, 5240 *offset, 5241 src, dst, 5242 sh, 5243 (struct sctp_cookie_echo_chunk *)ch, 5244 &inp, &stcb, netp, 5245 auth_skipped, 5246 auth_offset, 5247 auth_len, 5248 &locked_tcb, 5249 mflowtype, 5250 mflowid, 5251 vrf_id, 5252 port); 5253 } else { 5254 ret_buf = NULL; 5255 } 5256 if (linp) { 5257 SCTP_ASOC_CREATE_UNLOCK(linp); 5258 } 5259 if (ret_buf == NULL) { 5260 if (locked_tcb) { 5261 SCTP_TCB_UNLOCK(locked_tcb); 5262 } 5263 SCTPDBG(SCTP_DEBUG_INPUT3, 5264 "GAK, null buffer\n"); 5265 *offset = length; 5266 return (NULL); 5267 } 5268 /* if AUTH skipped, see if it verified... */ 5269 if (auth_skipped) { 5270 got_auth = 1; 5271 auth_skipped = 0; 5272 } 5273 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) { 5274 /* 5275 * Restart the timer if we have 5276 * pending data 5277 */ 5278 struct sctp_tmit_chunk *chk; 5279 5280 chk = TAILQ_FIRST(&stcb->asoc.sent_queue); 5281 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo); 5282 } 5283 } 5284 break; 5285 case SCTP_COOKIE_ACK: 5286 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", (void *)stcb); 5287 if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) { 5288 if (locked_tcb) { 5289 SCTP_TCB_UNLOCK(locked_tcb); 5290 } 5291 return (NULL); 5292 } 5293 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 5294 /* We are not interested anymore */ 5295 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 5296 ; 5297 } else if (stcb) { 5298 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 5299 so = SCTP_INP_SO(inp); 5300 atomic_add_int(&stcb->asoc.refcnt, 1); 5301 SCTP_TCB_UNLOCK(stcb); 5302 SCTP_SOCKET_LOCK(so, 1); 5303 SCTP_TCB_LOCK(stcb); 5304 atomic_subtract_int(&stcb->asoc.refcnt, 1); 5305 #endif 5306 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 5307 SCTP_FROM_SCTP_INPUT + SCTP_LOC_30); 5308 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 5309 SCTP_SOCKET_UNLOCK(so, 1); 5310 #endif 5311 *offset = length; 5312 return (NULL); 5313 } 5314 } 5315 /* He's alive so give him credit */ 5316 if ((stcb) && netp && *netp) { 5317 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 5318 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 5319 stcb->asoc.overall_error_count, 5320 0, 5321 SCTP_FROM_SCTP_INPUT, 5322 __LINE__); 5323 } 5324 stcb->asoc.overall_error_count = 0; 5325 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp); 5326 } 5327 break; 5328 case SCTP_ECN_ECHO: 5329 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n"); 5330 /* He's alive so give him credit */ 5331 if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) { 5332 /* Its not ours */ 5333 if (locked_tcb) { 5334 SCTP_TCB_UNLOCK(locked_tcb); 5335 } 5336 *offset = length; 5337 return (NULL); 5338 } 5339 if (stcb) { 5340 if (stcb->asoc.ecn_supported == 0) { 5341 goto unknown_chunk; 5342 } 5343 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 5344 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 5345 stcb->asoc.overall_error_count, 5346 0, 5347 SCTP_FROM_SCTP_INPUT, 5348 __LINE__); 5349 } 5350 stcb->asoc.overall_error_count = 0; 5351 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, 5352 stcb); 5353 ecne_seen = 1; 5354 } 5355 break; 5356 case SCTP_ECN_CWR: 5357 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n"); 5358 /* He's alive so give him credit */ 5359 if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) { 5360 /* Its not ours */ 5361 if (locked_tcb) { 5362 SCTP_TCB_UNLOCK(locked_tcb); 5363 } 5364 *offset = length; 5365 return (NULL); 5366 } 5367 if (stcb) { 5368 if (stcb->asoc.ecn_supported == 0) { 5369 goto unknown_chunk; 5370 } 5371 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 5372 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 5373 stcb->asoc.overall_error_count, 5374 0, 5375 SCTP_FROM_SCTP_INPUT, 5376 __LINE__); 5377 } 5378 stcb->asoc.overall_error_count = 0; 5379 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb, *netp); 5380 } 5381 break; 5382 case SCTP_SHUTDOWN_COMPLETE: 5383 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", (void *)stcb); 5384 /* must be first and only chunk */ 5385 if ((num_chunks > 1) || 5386 (length - *offset > (int)SCTP_SIZE32(chk_length))) { 5387 *offset = length; 5388 if (locked_tcb) { 5389 SCTP_TCB_UNLOCK(locked_tcb); 5390 } 5391 return (NULL); 5392 } 5393 if ((stcb) && netp && *netp) { 5394 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch, 5395 stcb, *netp); 5396 } 5397 *offset = length; 5398 return (NULL); 5399 break; 5400 case SCTP_ASCONF: 5401 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n"); 5402 /* He's alive so give him credit */ 5403 if (stcb) { 5404 if (stcb->asoc.asconf_supported == 0) { 5405 goto unknown_chunk; 5406 } 5407 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 5408 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 5409 stcb->asoc.overall_error_count, 5410 0, 5411 SCTP_FROM_SCTP_INPUT, 5412 __LINE__); 5413 } 5414 stcb->asoc.overall_error_count = 0; 5415 sctp_handle_asconf(m, *offset, src, 5416 (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0); 5417 asconf_cnt++; 5418 } 5419 break; 5420 case SCTP_ASCONF_ACK: 5421 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n"); 5422 if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) { 5423 /* Its not ours */ 5424 if (locked_tcb) { 5425 SCTP_TCB_UNLOCK(locked_tcb); 5426 } 5427 *offset = length; 5428 return (NULL); 5429 } 5430 if ((stcb) && netp && *netp) { 5431 if (stcb->asoc.asconf_supported == 0) { 5432 goto unknown_chunk; 5433 } 5434 /* He's alive so give him credit */ 5435 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 5436 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 5437 stcb->asoc.overall_error_count, 5438 0, 5439 SCTP_FROM_SCTP_INPUT, 5440 __LINE__); 5441 } 5442 stcb->asoc.overall_error_count = 0; 5443 sctp_handle_asconf_ack(m, *offset, 5444 (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock); 5445 if (abort_no_unlock) 5446 return (NULL); 5447 } 5448 break; 5449 case SCTP_FORWARD_CUM_TSN: 5450 case SCTP_IFORWARD_CUM_TSN: 5451 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n"); 5452 if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) { 5453 /* Its not ours */ 5454 if (locked_tcb) { 5455 SCTP_TCB_UNLOCK(locked_tcb); 5456 } 5457 *offset = length; 5458 return (NULL); 5459 } 5460 /* He's alive so give him credit */ 5461 if (stcb) { 5462 int abort_flag = 0; 5463 5464 if (stcb->asoc.prsctp_supported == 0) { 5465 goto unknown_chunk; 5466 } 5467 stcb->asoc.overall_error_count = 0; 5468 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 5469 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 5470 stcb->asoc.overall_error_count, 5471 0, 5472 SCTP_FROM_SCTP_INPUT, 5473 __LINE__); 5474 } 5475 *fwd_tsn_seen = 1; 5476 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 5477 /* We are not interested anymore */ 5478 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 5479 so = SCTP_INP_SO(inp); 5480 atomic_add_int(&stcb->asoc.refcnt, 1); 5481 SCTP_TCB_UNLOCK(stcb); 5482 SCTP_SOCKET_LOCK(so, 1); 5483 SCTP_TCB_LOCK(stcb); 5484 atomic_subtract_int(&stcb->asoc.refcnt, 1); 5485 #endif 5486 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 5487 SCTP_FROM_SCTP_INPUT + SCTP_LOC_31); 5488 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 5489 SCTP_SOCKET_UNLOCK(so, 1); 5490 #endif 5491 *offset = length; 5492 return (NULL); 5493 } 5494 /* 5495 * For sending a SACK this looks like DATA 5496 * chunks. 5497 */ 5498 stcb->asoc.last_data_chunk_from = stcb->asoc.last_control_chunk_from; 5499 sctp_handle_forward_tsn(stcb, 5500 (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset); 5501 if (abort_flag) { 5502 *offset = length; 5503 return (NULL); 5504 } else { 5505 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 5506 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 5507 stcb->asoc.overall_error_count, 5508 0, 5509 SCTP_FROM_SCTP_INPUT, 5510 __LINE__); 5511 } 5512 stcb->asoc.overall_error_count = 0; 5513 } 5514 5515 } 5516 break; 5517 case SCTP_STREAM_RESET: 5518 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n"); 5519 if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) { 5520 /* Its not ours */ 5521 if (locked_tcb) { 5522 SCTP_TCB_UNLOCK(locked_tcb); 5523 } 5524 *offset = length; 5525 return (NULL); 5526 } 5527 if (stcb->asoc.reconfig_supported == 0) { 5528 goto unknown_chunk; 5529 } 5530 if (sctp_handle_stream_reset(stcb, m, *offset, ch)) { 5531 /* stop processing */ 5532 *offset = length; 5533 return (NULL); 5534 } 5535 break; 5536 case SCTP_PACKET_DROPPED: 5537 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n"); 5538 /* re-get it all please */ 5539 if (chk_length < sizeof(struct sctp_pktdrop_chunk)) { 5540 /* Its not ours */ 5541 if (locked_tcb) { 5542 SCTP_TCB_UNLOCK(locked_tcb); 5543 } 5544 *offset = length; 5545 return (NULL); 5546 } 5547 if (ch && (stcb) && netp && (*netp)) { 5548 if (stcb->asoc.pktdrop_supported == 0) { 5549 goto unknown_chunk; 5550 } 5551 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch, 5552 stcb, *netp, 5553 min(chk_length, (sizeof(chunk_buf) - 4))); 5554 5555 } 5556 break; 5557 case SCTP_AUTHENTICATION: 5558 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n"); 5559 if (stcb == NULL) { 5560 /* save the first AUTH for later processing */ 5561 if (auth_skipped == 0) { 5562 auth_offset = *offset; 5563 auth_len = chk_length; 5564 auth_skipped = 1; 5565 } 5566 /* skip this chunk (temporarily) */ 5567 goto next_chunk; 5568 } 5569 if (stcb->asoc.auth_supported == 0) { 5570 goto unknown_chunk; 5571 } 5572 if ((chk_length < (sizeof(struct sctp_auth_chunk))) || 5573 (chk_length > (sizeof(struct sctp_auth_chunk) + 5574 SCTP_AUTH_DIGEST_LEN_MAX))) { 5575 /* Its not ours */ 5576 if (locked_tcb) { 5577 SCTP_TCB_UNLOCK(locked_tcb); 5578 } 5579 *offset = length; 5580 return (NULL); 5581 } 5582 if (got_auth == 1) { 5583 /* skip this chunk... it's already auth'd */ 5584 goto next_chunk; 5585 } 5586 got_auth = 1; 5587 if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch, 5588 m, *offset)) { 5589 /* auth HMAC failed so dump the packet */ 5590 *offset = length; 5591 return (stcb); 5592 } else { 5593 /* remaining chunks are HMAC checked */ 5594 stcb->asoc.authenticated = 1; 5595 } 5596 break; 5597 5598 default: 5599 unknown_chunk: 5600 /* it's an unknown chunk! */ 5601 if ((ch->chunk_type & 0x40) && (stcb != NULL)) { 5602 struct sctp_gen_error_cause *cause; 5603 int len; 5604 5605 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_gen_error_cause), 5606 0, M_NOWAIT, 1, MT_DATA); 5607 if (op_err != NULL) { 5608 len = min(SCTP_SIZE32(chk_length), (uint32_t)(length - *offset)); 5609 cause = mtod(op_err, struct sctp_gen_error_cause *); 5610 cause->code = htons(SCTP_CAUSE_UNRECOG_CHUNK); 5611 cause->length = htons((uint16_t)(len + sizeof(struct sctp_gen_error_cause))); 5612 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause); 5613 SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(m, *offset, len, M_NOWAIT); 5614 if (SCTP_BUF_NEXT(op_err) != NULL) { 5615 #ifdef SCTP_MBUF_LOGGING 5616 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 5617 sctp_log_mbc(SCTP_BUF_NEXT(op_err), SCTP_MBUF_ICOPY); 5618 } 5619 #endif 5620 sctp_queue_op_err(stcb, op_err); 5621 } else { 5622 sctp_m_freem(op_err); 5623 } 5624 } 5625 } 5626 if ((ch->chunk_type & 0x80) == 0) { 5627 /* discard this packet */ 5628 *offset = length; 5629 return (stcb); 5630 } /* else skip this bad chunk and continue... */ 5631 break; 5632 } /* switch (ch->chunk_type) */ 5633 5634 5635 next_chunk: 5636 /* get the next chunk */ 5637 *offset += SCTP_SIZE32(chk_length); 5638 if (*offset >= length) { 5639 /* no more data left in the mbuf chain */ 5640 break; 5641 } 5642 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 5643 sizeof(struct sctp_chunkhdr), chunk_buf); 5644 if (ch == NULL) { 5645 if (locked_tcb) { 5646 SCTP_TCB_UNLOCK(locked_tcb); 5647 } 5648 *offset = length; 5649 return (NULL); 5650 } 5651 } /* while */ 5652 5653 if (asconf_cnt > 0 && stcb != NULL) { 5654 sctp_send_asconf_ack(stcb); 5655 } 5656 return (stcb); 5657 } 5658 5659 5660 /* 5661 * common input chunk processing (v4 and v6) 5662 */ 5663 void 5664 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int length, 5665 struct sockaddr *src, struct sockaddr *dst, 5666 struct sctphdr *sh, struct sctp_chunkhdr *ch, 5667 #if !defined(SCTP_WITH_NO_CSUM) 5668 uint8_t compute_crc, 5669 #endif 5670 uint8_t ecn_bits, 5671 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 5672 uint32_t vrf_id, uint16_t port) 5673 { 5674 uint32_t high_tsn; 5675 int fwd_tsn_seen = 0, data_processed = 0; 5676 struct mbuf *m = *mm, *op_err; 5677 char msg[SCTP_DIAG_INFO_LEN]; 5678 int un_sent; 5679 int cnt_ctrl_ready = 0; 5680 struct sctp_inpcb *inp = NULL, *inp_decr = NULL; 5681 struct sctp_tcb *stcb = NULL; 5682 struct sctp_nets *net = NULL; 5683 5684 SCTP_STAT_INCR(sctps_recvdatagrams); 5685 #ifdef SCTP_AUDITING_ENABLED 5686 sctp_audit_log(0xE0, 1); 5687 sctp_auditing(0, inp, stcb, net); 5688 #endif 5689 #if !defined(SCTP_WITH_NO_CSUM) 5690 if (compute_crc != 0) { 5691 uint32_t check, calc_check; 5692 5693 check = sh->checksum; 5694 sh->checksum = 0; 5695 calc_check = sctp_calculate_cksum(m, iphlen); 5696 sh->checksum = check; 5697 if (calc_check != check) { 5698 SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x m:%p mlen:%d iphlen:%d\n", 5699 calc_check, check, (void *)m, length, iphlen); 5700 stcb = sctp_findassociation_addr(m, offset, src, dst, 5701 sh, ch, &inp, &net, vrf_id); 5702 #if defined(INET) || defined(INET6) 5703 if ((ch->chunk_type != SCTP_INITIATION) && 5704 (net != NULL) && (net->port != port)) { 5705 if (net->port == 0) { 5706 /* UDP encapsulation turned on. */ 5707 net->mtu -= sizeof(struct udphdr); 5708 if (stcb->asoc.smallest_mtu > net->mtu) { 5709 sctp_pathmtu_adjustment(stcb, net->mtu); 5710 } 5711 } else if (port == 0) { 5712 /* UDP encapsulation turned off. */ 5713 net->mtu += sizeof(struct udphdr); 5714 /* XXX Update smallest_mtu */ 5715 } 5716 net->port = port; 5717 } 5718 #endif 5719 if (net != NULL) { 5720 net->flowtype = mflowtype; 5721 net->flowid = mflowid; 5722 } 5723 if ((inp != NULL) && (stcb != NULL)) { 5724 sctp_send_packet_dropped(stcb, net, m, length, iphlen, 1); 5725 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED); 5726 } else if ((inp != NULL) && (stcb == NULL)) { 5727 inp_decr = inp; 5728 } 5729 SCTP_STAT_INCR(sctps_badsum); 5730 SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors); 5731 goto out; 5732 } 5733 } 5734 #endif 5735 /* Destination port of 0 is illegal, based on RFC4960. */ 5736 if (sh->dest_port == 0) { 5737 SCTP_STAT_INCR(sctps_hdrops); 5738 goto out; 5739 } 5740 stcb = sctp_findassociation_addr(m, offset, src, dst, 5741 sh, ch, &inp, &net, vrf_id); 5742 #if defined(INET) || defined(INET6) 5743 if ((ch->chunk_type != SCTP_INITIATION) && 5744 (net != NULL) && (net->port != port)) { 5745 if (net->port == 0) { 5746 /* UDP encapsulation turned on. */ 5747 net->mtu -= sizeof(struct udphdr); 5748 if (stcb->asoc.smallest_mtu > net->mtu) { 5749 sctp_pathmtu_adjustment(stcb, net->mtu); 5750 } 5751 } else if (port == 0) { 5752 /* UDP encapsulation turned off. */ 5753 net->mtu += sizeof(struct udphdr); 5754 /* XXX Update smallest_mtu */ 5755 } 5756 net->port = port; 5757 } 5758 #endif 5759 if (net != NULL) { 5760 net->flowtype = mflowtype; 5761 net->flowid = mflowid; 5762 } 5763 if (inp == NULL) { 5764 SCTP_STAT_INCR(sctps_noport); 5765 if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0) { 5766 goto out; 5767 } 5768 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 5769 sctp_send_shutdown_complete2(src, dst, sh, 5770 mflowtype, mflowid, fibnum, 5771 vrf_id, port); 5772 goto out; 5773 } 5774 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) { 5775 goto out; 5776 } 5777 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) { 5778 if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) || 5779 ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) && 5780 (ch->chunk_type != SCTP_INIT))) { 5781 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5782 "Out of the blue"); 5783 sctp_send_abort(m, iphlen, src, dst, 5784 sh, 0, op_err, 5785 mflowtype, mflowid, fibnum, 5786 vrf_id, port); 5787 } 5788 } 5789 goto out; 5790 } else if (stcb == NULL) { 5791 inp_decr = inp; 5792 } 5793 SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n", 5794 (void *)m, iphlen, offset, length, (void *)stcb); 5795 if (stcb) { 5796 /* always clear this before beginning a packet */ 5797 stcb->asoc.authenticated = 0; 5798 stcb->asoc.seen_a_sack_this_pkt = 0; 5799 SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n", 5800 (void *)stcb, stcb->asoc.state); 5801 5802 if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) || 5803 (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) { 5804 /*- 5805 * If we hit here, we had a ref count 5806 * up when the assoc was aborted and the 5807 * timer is clearing out the assoc, we should 5808 * NOT respond to any packet.. its OOTB. 5809 */ 5810 SCTP_TCB_UNLOCK(stcb); 5811 stcb = NULL; 5812 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__); 5813 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5814 msg); 5815 sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err, 5816 mflowtype, mflowid, inp->fibnum, 5817 vrf_id, port); 5818 goto out; 5819 } 5820 } 5821 if (IS_SCTP_CONTROL(ch)) { 5822 /* process the control portion of the SCTP packet */ 5823 /* sa_ignore NO_NULL_CHK */ 5824 stcb = sctp_process_control(m, iphlen, &offset, length, 5825 src, dst, sh, ch, 5826 inp, stcb, &net, &fwd_tsn_seen, 5827 mflowtype, mflowid, fibnum, 5828 vrf_id, port); 5829 if (stcb) { 5830 /* 5831 * This covers us if the cookie-echo was there and 5832 * it changes our INP. 5833 */ 5834 inp = stcb->sctp_ep; 5835 #if defined(INET) || defined(INET6) 5836 if ((ch->chunk_type != SCTP_INITIATION) && 5837 (net != NULL) && (net->port != port)) { 5838 if (net->port == 0) { 5839 /* UDP encapsulation turned on. */ 5840 net->mtu -= sizeof(struct udphdr); 5841 if (stcb->asoc.smallest_mtu > net->mtu) { 5842 sctp_pathmtu_adjustment(stcb, net->mtu); 5843 } 5844 } else if (port == 0) { 5845 /* UDP encapsulation turned off. */ 5846 net->mtu += sizeof(struct udphdr); 5847 /* XXX Update smallest_mtu */ 5848 } 5849 net->port = port; 5850 } 5851 #endif 5852 } 5853 } else { 5854 /* 5855 * no control chunks, so pre-process DATA chunks (these 5856 * checks are taken care of by control processing) 5857 */ 5858 5859 /* 5860 * if DATA only packet, and auth is required, then punt... 5861 * can't have authenticated without any AUTH (control) 5862 * chunks 5863 */ 5864 if ((stcb != NULL) && 5865 (stcb->asoc.auth_supported == 1) && 5866 sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks)) { 5867 /* "silently" ignore */ 5868 SCTP_STAT_INCR(sctps_recvauthmissing); 5869 goto out; 5870 } 5871 if (stcb == NULL) { 5872 /* out of the blue DATA chunk */ 5873 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__); 5874 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5875 msg); 5876 sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err, 5877 mflowtype, mflowid, fibnum, 5878 vrf_id, port); 5879 goto out; 5880 } 5881 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) { 5882 /* v_tag mismatch! */ 5883 SCTP_STAT_INCR(sctps_badvtag); 5884 goto out; 5885 } 5886 } 5887 5888 if (stcb == NULL) { 5889 /* 5890 * no valid TCB for this packet, or we found it's a bad 5891 * packet while processing control, or we're done with this 5892 * packet (done or skip rest of data), so we drop it... 5893 */ 5894 goto out; 5895 } 5896 /* 5897 * DATA chunk processing 5898 */ 5899 /* plow through the data chunks while length > offset */ 5900 5901 /* 5902 * Rest should be DATA only. Check authentication state if AUTH for 5903 * DATA is required. 5904 */ 5905 if ((length > offset) && 5906 (stcb != NULL) && 5907 (stcb->asoc.auth_supported == 1) && 5908 sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks) && 5909 !stcb->asoc.authenticated) { 5910 /* "silently" ignore */ 5911 SCTP_STAT_INCR(sctps_recvauthmissing); 5912 SCTPDBG(SCTP_DEBUG_AUTH1, 5913 "Data chunk requires AUTH, skipped\n"); 5914 goto trigger_send; 5915 } 5916 if (length > offset) { 5917 int retval; 5918 5919 /* 5920 * First check to make sure our state is correct. We would 5921 * not get here unless we really did have a tag, so we don't 5922 * abort if this happens, just dump the chunk silently. 5923 */ 5924 switch (SCTP_GET_STATE(&stcb->asoc)) { 5925 case SCTP_STATE_COOKIE_ECHOED: 5926 /* 5927 * we consider data with valid tags in this state 5928 * shows us the cookie-ack was lost. Imply it was 5929 * there. 5930 */ 5931 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) { 5932 sctp_misc_ints(SCTP_THRESHOLD_CLEAR, 5933 stcb->asoc.overall_error_count, 5934 0, 5935 SCTP_FROM_SCTP_INPUT, 5936 __LINE__); 5937 } 5938 stcb->asoc.overall_error_count = 0; 5939 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net); 5940 break; 5941 case SCTP_STATE_COOKIE_WAIT: 5942 /* 5943 * We consider OOTB any data sent during asoc setup. 5944 */ 5945 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__); 5946 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5947 msg); 5948 sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err, 5949 mflowtype, mflowid, inp->fibnum, 5950 vrf_id, port); 5951 goto out; 5952 /* sa_ignore NOTREACHED */ 5953 break; 5954 case SCTP_STATE_EMPTY: /* should not happen */ 5955 case SCTP_STATE_INUSE: /* should not happen */ 5956 case SCTP_STATE_SHUTDOWN_RECEIVED: /* This is a peer error */ 5957 case SCTP_STATE_SHUTDOWN_ACK_SENT: 5958 default: 5959 goto out; 5960 /* sa_ignore NOTREACHED */ 5961 break; 5962 case SCTP_STATE_OPEN: 5963 case SCTP_STATE_SHUTDOWN_SENT: 5964 break; 5965 } 5966 /* plow through the data chunks while length > offset */ 5967 retval = sctp_process_data(mm, iphlen, &offset, length, 5968 inp, stcb, net, &high_tsn); 5969 if (retval == 2) { 5970 /* 5971 * The association aborted, NO UNLOCK needed since 5972 * the association is destroyed. 5973 */ 5974 stcb = NULL; 5975 goto out; 5976 } 5977 data_processed = 1; 5978 /* 5979 * Anything important needs to have been m_copy'ed in 5980 * process_data 5981 */ 5982 } 5983 /* take care of ecn */ 5984 if ((data_processed == 1) && 5985 (stcb->asoc.ecn_supported == 1) && 5986 ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS)) { 5987 /* Yep, we need to add a ECNE */ 5988 sctp_send_ecn_echo(stcb, net, high_tsn); 5989 } 5990 if ((data_processed == 0) && (fwd_tsn_seen)) { 5991 int was_a_gap; 5992 uint32_t highest_tsn; 5993 5994 if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) { 5995 highest_tsn = stcb->asoc.highest_tsn_inside_nr_map; 5996 } else { 5997 highest_tsn = stcb->asoc.highest_tsn_inside_map; 5998 } 5999 was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn); 6000 stcb->asoc.send_sack = 1; 6001 sctp_sack_check(stcb, was_a_gap); 6002 } else if (fwd_tsn_seen) { 6003 stcb->asoc.send_sack = 1; 6004 } 6005 /* trigger send of any chunks in queue... */ 6006 trigger_send: 6007 #ifdef SCTP_AUDITING_ENABLED 6008 sctp_audit_log(0xE0, 2); 6009 sctp_auditing(1, inp, stcb, net); 6010 #endif 6011 SCTPDBG(SCTP_DEBUG_INPUT1, 6012 "Check for chunk output prw:%d tqe:%d tf=%d\n", 6013 stcb->asoc.peers_rwnd, 6014 TAILQ_EMPTY(&stcb->asoc.control_send_queue), 6015 stcb->asoc.total_flight); 6016 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 6017 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 6018 cnt_ctrl_ready = stcb->asoc.ctrl_queue_cnt - stcb->asoc.ecn_echo_cnt_onq; 6019 } 6020 if (!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue) || 6021 cnt_ctrl_ready || 6022 stcb->asoc.trigger_reset || 6023 ((un_sent) && 6024 (stcb->asoc.peers_rwnd > 0 || 6025 (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) { 6026 SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n"); 6027 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED); 6028 SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n"); 6029 } 6030 #ifdef SCTP_AUDITING_ENABLED 6031 sctp_audit_log(0xE0, 3); 6032 sctp_auditing(2, inp, stcb, net); 6033 #endif 6034 out: 6035 if (stcb != NULL) { 6036 SCTP_TCB_UNLOCK(stcb); 6037 } 6038 if (inp_decr != NULL) { 6039 /* reduce ref-count */ 6040 SCTP_INP_WLOCK(inp_decr); 6041 SCTP_INP_DECR_REF(inp_decr); 6042 SCTP_INP_WUNLOCK(inp_decr); 6043 } 6044 return; 6045 } 6046 6047 #ifdef INET 6048 void 6049 sctp_input_with_port(struct mbuf *i_pak, int off, uint16_t port) 6050 { 6051 struct mbuf *m; 6052 int iphlen; 6053 uint32_t vrf_id = 0; 6054 uint8_t ecn_bits; 6055 struct sockaddr_in src, dst; 6056 struct ip *ip; 6057 struct sctphdr *sh; 6058 struct sctp_chunkhdr *ch; 6059 int length, offset; 6060 #if !defined(SCTP_WITH_NO_CSUM) 6061 uint8_t compute_crc; 6062 #endif 6063 uint32_t mflowid; 6064 uint8_t mflowtype; 6065 uint16_t fibnum; 6066 6067 iphlen = off; 6068 if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) { 6069 SCTP_RELEASE_PKT(i_pak); 6070 return; 6071 } 6072 m = SCTP_HEADER_TO_CHAIN(i_pak); 6073 #ifdef SCTP_MBUF_LOGGING 6074 /* Log in any input mbufs */ 6075 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6076 sctp_log_mbc(m, SCTP_MBUF_INPUT); 6077 } 6078 #endif 6079 #ifdef SCTP_PACKET_LOGGING 6080 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 6081 sctp_packet_log(m); 6082 } 6083 #endif 6084 SCTPDBG(SCTP_DEBUG_CRCOFFLOAD, 6085 "sctp_input(): Packet of length %d received on %s with csum_flags 0x%b.\n", 6086 m->m_pkthdr.len, 6087 if_name(m->m_pkthdr.rcvif), 6088 (int)m->m_pkthdr.csum_flags, CSUM_BITS); 6089 mflowid = m->m_pkthdr.flowid; 6090 mflowtype = M_HASHTYPE_GET(m); 6091 fibnum = M_GETFIB(m); 6092 SCTP_STAT_INCR(sctps_recvpackets); 6093 SCTP_STAT_INCR_COUNTER64(sctps_inpackets); 6094 /* Get IP, SCTP, and first chunk header together in the first mbuf. */ 6095 offset = iphlen + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 6096 if (SCTP_BUF_LEN(m) < offset) { 6097 if ((m = m_pullup(m, offset)) == NULL) { 6098 SCTP_STAT_INCR(sctps_hdrops); 6099 return; 6100 } 6101 } 6102 ip = mtod(m, struct ip *); 6103 sh = (struct sctphdr *)((caddr_t)ip + iphlen); 6104 ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(struct sctphdr)); 6105 offset -= sizeof(struct sctp_chunkhdr); 6106 memset(&src, 0, sizeof(struct sockaddr_in)); 6107 src.sin_family = AF_INET; 6108 src.sin_len = sizeof(struct sockaddr_in); 6109 src.sin_port = sh->src_port; 6110 src.sin_addr = ip->ip_src; 6111 memset(&dst, 0, sizeof(struct sockaddr_in)); 6112 dst.sin_family = AF_INET; 6113 dst.sin_len = sizeof(struct sockaddr_in); 6114 dst.sin_port = sh->dest_port; 6115 dst.sin_addr = ip->ip_dst; 6116 length = ntohs(ip->ip_len); 6117 /* Validate mbuf chain length with IP payload length. */ 6118 if (SCTP_HEADER_LEN(m) != length) { 6119 SCTPDBG(SCTP_DEBUG_INPUT1, 6120 "sctp_input() length:%d reported length:%d\n", length, SCTP_HEADER_LEN(m)); 6121 SCTP_STAT_INCR(sctps_hdrops); 6122 goto out; 6123 } 6124 /* SCTP does not allow broadcasts or multicasts */ 6125 if (IN_MULTICAST(ntohl(dst.sin_addr.s_addr))) { 6126 goto out; 6127 } 6128 if (SCTP_IS_IT_BROADCAST(dst.sin_addr, m)) { 6129 goto out; 6130 } 6131 ecn_bits = ip->ip_tos; 6132 #if defined(SCTP_WITH_NO_CSUM) 6133 SCTP_STAT_INCR(sctps_recvnocrc); 6134 #else 6135 if (m->m_pkthdr.csum_flags & CSUM_SCTP_VALID) { 6136 SCTP_STAT_INCR(sctps_recvhwcrc); 6137 compute_crc = 0; 6138 } else { 6139 SCTP_STAT_INCR(sctps_recvswcrc); 6140 compute_crc = 1; 6141 } 6142 #endif 6143 sctp_common_input_processing(&m, iphlen, offset, length, 6144 (struct sockaddr *)&src, 6145 (struct sockaddr *)&dst, 6146 sh, ch, 6147 #if !defined(SCTP_WITH_NO_CSUM) 6148 compute_crc, 6149 #endif 6150 ecn_bits, 6151 mflowtype, mflowid, fibnum, 6152 vrf_id, port); 6153 out: 6154 if (m) { 6155 sctp_m_freem(m); 6156 } 6157 return; 6158 } 6159 6160 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP) 6161 extern int *sctp_cpuarry; 6162 #endif 6163 6164 int 6165 sctp_input(struct mbuf **mp, int *offp, int proto SCTP_UNUSED) 6166 { 6167 struct mbuf *m; 6168 int off; 6169 6170 m = *mp; 6171 off = *offp; 6172 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP) 6173 if (mp_ncpus > 1) { 6174 struct ip *ip; 6175 struct sctphdr *sh; 6176 int offset; 6177 int cpu_to_use; 6178 uint32_t flowid, tag; 6179 6180 if (M_HASHTYPE_GET(m) != M_HASHTYPE_NONE) { 6181 flowid = m->m_pkthdr.flowid; 6182 } else { 6183 /* 6184 * No flow id built by lower layers fix it so we 6185 * create one. 6186 */ 6187 offset = off + sizeof(struct sctphdr); 6188 if (SCTP_BUF_LEN(m) < offset) { 6189 if ((m = m_pullup(m, offset)) == NULL) { 6190 SCTP_STAT_INCR(sctps_hdrops); 6191 return (IPPROTO_DONE); 6192 } 6193 } 6194 ip = mtod(m, struct ip *); 6195 sh = (struct sctphdr *)((caddr_t)ip + off); 6196 tag = htonl(sh->v_tag); 6197 flowid = tag ^ ntohs(sh->dest_port) ^ ntohs(sh->src_port); 6198 m->m_pkthdr.flowid = flowid; 6199 M_HASHTYPE_SET(m, M_HASHTYPE_OPAQUE_HASH); 6200 } 6201 cpu_to_use = sctp_cpuarry[flowid % mp_ncpus]; 6202 sctp_queue_to_mcore(m, off, cpu_to_use); 6203 return (IPPROTO_DONE); 6204 } 6205 #endif 6206 sctp_input_with_port(m, off, 0); 6207 return (IPPROTO_DONE); 6208 } 6209 #endif 6210