1 /*- 2 * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * a) Redistributions of source code must retain the above copyright notice, 8 * this list of conditions and the following disclaimer. 9 * 10 * b) Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the distribution. 13 * 14 * c) Neither the name of Cisco Systems, Inc. nor the names of its 15 * contributors may be used to endorse or promote products derived 16 * from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 20 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 28 * THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 /* $KAME: sctp_input.c,v 1.27 2005/03/06 16:04:17 itojun Exp $ */ 32 33 #include <sys/cdefs.h> 34 __FBSDID("$FreeBSD$"); 35 36 #include <netinet/sctp_os.h> 37 #include <netinet/sctp_var.h> 38 #include <netinet/sctp_pcb.h> 39 #include <netinet/sctp_header.h> 40 #include <netinet/sctputil.h> 41 #include <netinet/sctp_output.h> 42 #include <netinet/sctp_input.h> 43 #include <netinet/sctp_auth.h> 44 #include <netinet/sctp_indata.h> 45 #include <netinet/sctp_asconf.h> 46 47 48 #ifdef SCTP_DEBUG 49 extern uint32_t sctp_debug_on; 50 51 #endif 52 53 54 55 56 struct sctp_foo_stuff sctp_logoff[30000]; 57 int sctp_logoff_stuff = 0; 58 59 60 static void 61 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb) 62 { 63 struct sctp_nets *net; 64 65 /* 66 * This now not only stops all cookie timers it also stops any INIT 67 * timers as well. This will make sure that the timers are stopped 68 * in all collision cases. 69 */ 70 SCTP_TCB_LOCK_ASSERT(stcb); 71 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 72 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) { 73 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, 74 stcb->sctp_ep, 75 stcb, 76 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1); 77 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) { 78 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, 79 stcb->sctp_ep, 80 stcb, 81 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2); 82 } 83 } 84 } 85 86 /* INIT handler */ 87 static void 88 sctp_handle_init(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh, 89 struct sctp_init_chunk *cp, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 90 struct sctp_nets *net) 91 { 92 struct sctp_init *init; 93 struct mbuf *op_err; 94 uint32_t init_limit; 95 96 #ifdef SCTP_DEBUG 97 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 98 printf("sctp_handle_init: handling INIT tcb:%p\n", stcb); 99 } 100 #endif 101 op_err = NULL; 102 init = &cp->init; 103 /* First are we accepting? */ 104 if ((inp->sctp_socket->so_qlimit == 0) && (stcb == NULL)) { 105 #ifdef SCTP_DEBUG 106 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 107 printf("sctp_handle_init: Abort, so_qlimit:%d\n", inp->sctp_socket->so_qlimit); 108 } 109 #endif 110 /* 111 * FIX ME ?? What about TCP model and we have a 112 * match/restart case? 113 */ 114 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 115 return; 116 } 117 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) { 118 /* Invalid length */ 119 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 120 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 121 return; 122 } 123 /* validate parameters */ 124 if (init->initiate_tag == 0) { 125 /* protocol error... send abort */ 126 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 127 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 128 return; 129 } 130 if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) { 131 /* invalid parameter... send abort */ 132 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 133 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 134 return; 135 } 136 if (init->num_inbound_streams == 0) { 137 /* protocol error... send abort */ 138 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 139 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 140 return; 141 } 142 if (init->num_outbound_streams == 0) { 143 /* protocol error... send abort */ 144 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 145 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 146 return; 147 } 148 init_limit = offset + ntohs(cp->ch.chunk_length); 149 if (sctp_validate_init_auth_params(m, offset + sizeof(*cp), 150 init_limit)) { 151 /* auth parameter(s) error... send abort */ 152 sctp_abort_association(inp, stcb, m, iphlen, sh, NULL); 153 return; 154 } 155 /* send an INIT-ACK w/cookie */ 156 #ifdef SCTP_DEBUG 157 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 158 printf("sctp_handle_init: sending INIT-ACK\n"); 159 } 160 #endif 161 sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp); 162 } 163 164 /* 165 * process peer "INIT/INIT-ACK" chunk returns value < 0 on error 166 */ 167 static int 168 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb, 169 struct sctp_nets *net) 170 { 171 struct sctp_init *init; 172 struct sctp_association *asoc; 173 struct sctp_nets *lnet; 174 unsigned int i; 175 176 init = &cp->init; 177 asoc = &stcb->asoc; 178 /* save off parameters */ 179 asoc->peer_vtag = ntohl(init->initiate_tag); 180 asoc->peers_rwnd = ntohl(init->a_rwnd); 181 if (TAILQ_FIRST(&asoc->nets)) { 182 /* update any ssthresh's that may have a default */ 183 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 184 lnet->ssthresh = asoc->peers_rwnd; 185 186 #if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING) 187 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION); 188 #endif 189 190 } 191 } 192 SCTP_TCB_SEND_LOCK(stcb); 193 if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) { 194 unsigned int newcnt; 195 struct sctp_stream_out *outs; 196 struct sctp_stream_queue_pending *sp; 197 198 /* cut back on number of streams */ 199 newcnt = ntohs(init->num_inbound_streams); 200 /* This if is probably not needed but I am cautious */ 201 if (asoc->strmout) { 202 /* First make sure no data chunks are trapped */ 203 for (i = newcnt; i < asoc->pre_open_streams; i++) { 204 outs = &asoc->strmout[i]; 205 sp = TAILQ_FIRST(&outs->outqueue); 206 while (sp) { 207 TAILQ_REMOVE(&outs->outqueue, sp, 208 next); 209 asoc->stream_queue_cnt--; 210 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, 211 stcb, SCTP_NOTIFY_DATAGRAM_UNSENT, 212 sp); 213 if (sp->data) { 214 sctp_m_freem(sp->data); 215 sp->data = NULL; 216 } 217 sctp_free_remote_addr(sp->net); 218 sp->net = NULL; 219 /* Free the chunk */ 220 printf("sp:%p tcb:%p weird free case\n", 221 sp, stcb); 222 223 sctp_free_a_strmoq(stcb, sp); 224 sp = TAILQ_FIRST(&outs->outqueue); 225 } 226 } 227 } 228 /* cut back the count and abandon the upper streams */ 229 asoc->pre_open_streams = newcnt; 230 } 231 SCTP_TCB_SEND_UNLOCK(stcb); 232 asoc->streamoutcnt = asoc->pre_open_streams; 233 /* init tsn's */ 234 asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1; 235 #ifdef SCTP_MAP_LOGGING 236 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 237 #endif 238 /* This is the next one we expect */ 239 asoc->str_reset_seq_in = asoc->asconf_seq_in + 1; 240 241 asoc->mapping_array_base_tsn = ntohl(init->initial_tsn); 242 asoc->cumulative_tsn = asoc->asconf_seq_in; 243 asoc->last_echo_tsn = asoc->asconf_seq_in; 244 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 245 /* open the requested streams */ 246 if (asoc->strmin != NULL) { 247 /* Free the old ones */ 248 struct sctp_queued_to_read *ctl; 249 250 for (i = 0; i < asoc->streamincnt; i++) { 251 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 252 while (ctl) { 253 TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next); 254 sctp_free_remote_addr(ctl->whoFrom); 255 sctp_m_freem(ctl->data); 256 ctl->data = NULL; 257 sctp_free_a_readq(stcb, ctl); 258 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 259 } 260 } 261 SCTP_FREE(asoc->strmin); 262 } 263 asoc->streamincnt = ntohs(init->num_outbound_streams); 264 if (asoc->streamincnt > MAX_SCTP_STREAMS) { 265 asoc->streamincnt = MAX_SCTP_STREAMS; 266 } 267 SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt * 268 sizeof(struct sctp_stream_in), "StreamsIn"); 269 if (asoc->strmin == NULL) { 270 /* we didn't get memory for the streams! */ 271 #ifdef SCTP_DEBUG 272 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 273 printf("process_init: couldn't get memory for the streams!\n"); 274 } 275 #endif 276 return (-1); 277 } 278 for (i = 0; i < asoc->streamincnt; i++) { 279 asoc->strmin[i].stream_no = i; 280 asoc->strmin[i].last_sequence_delivered = 0xffff; 281 /* 282 * U-stream ranges will be set when the cookie is unpacked. 283 * Or for the INIT sender they are un set (if pr-sctp not 284 * supported) when the INIT-ACK arrives. 285 */ 286 TAILQ_INIT(&asoc->strmin[i].inqueue); 287 /* 288 * we are not on any wheel, pr-sctp streams will go on the 289 * wheel when they have data waiting for reorder. 290 */ 291 asoc->strmin[i].next_spoke.tqe_next = 0; 292 asoc->strmin[i].next_spoke.tqe_prev = 0; 293 } 294 295 /* 296 * load_address_from_init will put the addresses into the 297 * association when the COOKIE is processed or the INIT-ACK is 298 * processed. Both types of COOKIE's existing and new call this 299 * routine. It will remove addresses that are no longer in the 300 * association (for the restarting case where addresses are 301 * removed). Up front when the INIT arrives we will discard it if it 302 * is a restart and new addresses have been added. 303 */ 304 return (0); 305 } 306 307 /* 308 * INIT-ACK message processing/consumption returns value < 0 on error 309 */ 310 static int 311 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset, 312 struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 313 struct sctp_nets *net) 314 { 315 struct sctp_association *asoc; 316 struct mbuf *op_err; 317 int retval, abort_flag; 318 uint32_t initack_limit; 319 320 /* First verify that we have no illegal param's */ 321 abort_flag = 0; 322 op_err = NULL; 323 324 op_err = sctp_arethere_unrecognized_parameters(m, 325 (offset + sizeof(struct sctp_init_chunk)), 326 &abort_flag, (struct sctp_chunkhdr *)cp); 327 if (abort_flag) { 328 /* Send an abort and notify peer */ 329 if (op_err != NULL) { 330 sctp_send_operr_to(m, iphlen, op_err, cp->init.initiate_tag); 331 } else { 332 /* 333 * Just notify (abort_assoc does this if we send an 334 * abort). 335 */ 336 sctp_abort_notification(stcb, 0); 337 /* 338 * No sense in further INIT's since we will get the 339 * same param back 340 */ 341 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3); 342 } 343 return (-1); 344 } 345 asoc = &stcb->asoc; 346 /* process the peer's parameters in the INIT-ACK */ 347 retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net); 348 if (retval < 0) { 349 return (retval); 350 } 351 initack_limit = offset + ntohs(cp->ch.chunk_length); 352 /* load all addresses */ 353 if ((retval = sctp_load_addresses_from_init(stcb, m, iphlen, 354 (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh, 355 NULL))) { 356 /* Huh, we should abort */ 357 #ifdef SCTP_DEBUG 358 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 359 printf("Load addresses from INIT causes an abort %d\n", retval); 360 } 361 #endif 362 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 363 NULL); 364 return (-1); 365 } 366 stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs, 367 stcb->asoc.local_hmacs); 368 if (op_err) { 369 sctp_queue_op_err(stcb, op_err); 370 /* queuing will steal away the mbuf chain to the out queue */ 371 op_err = NULL; 372 } 373 /* extract the cookie and queue it to "echo" it back... */ 374 stcb->asoc.overall_error_count = 0; 375 net->error_count = 0; 376 377 /* 378 * Cancel the INIT timer, We do this first before queueing the 379 * cookie. We always cancel at the primary to assue that we are 380 * canceling the timer started by the INIT which always goes to the 381 * primary. 382 */ 383 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb, 384 asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4); 385 386 /* calculate the RTO */ 387 net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered); 388 389 retval = sctp_send_cookie_echo(m, offset, stcb, net); 390 if (retval < 0) { 391 /* 392 * No cookie, we probably should send a op error. But in any 393 * case if there is no cookie in the INIT-ACK, we can 394 * abandon the peer, its broke. 395 */ 396 if (retval == -3) { 397 /* We abort with an error of missing mandatory param */ 398 struct mbuf *op_err; 399 400 op_err = 401 sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM); 402 if (op_err) { 403 /* 404 * Expand beyond to include the mandatory 405 * param cookie 406 */ 407 struct sctp_inv_mandatory_param *mp; 408 409 SCTP_BUF_LEN(op_err) = 410 sizeof(struct sctp_inv_mandatory_param); 411 mp = mtod(op_err, 412 struct sctp_inv_mandatory_param *); 413 /* Subtract the reserved param */ 414 mp->length = 415 htons(sizeof(struct sctp_inv_mandatory_param) - 2); 416 mp->num_param = htonl(1); 417 mp->param = htons(SCTP_STATE_COOKIE); 418 mp->resv = 0; 419 } 420 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 421 sh, op_err); 422 } 423 return (retval); 424 } 425 return (0); 426 } 427 428 static void 429 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp, 430 struct sctp_tcb *stcb, struct sctp_nets *net) 431 { 432 struct sockaddr_storage store; 433 struct sockaddr_in *sin; 434 struct sockaddr_in6 *sin6; 435 struct sctp_nets *r_net; 436 struct timeval tv; 437 438 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) { 439 /* Invalid length */ 440 return; 441 } 442 sin = (struct sockaddr_in *)&store; 443 sin6 = (struct sockaddr_in6 *)&store; 444 445 memset(&store, 0, sizeof(store)); 446 if (cp->heartbeat.hb_info.addr_family == AF_INET && 447 cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) { 448 sin->sin_family = cp->heartbeat.hb_info.addr_family; 449 sin->sin_len = cp->heartbeat.hb_info.addr_len; 450 sin->sin_port = stcb->rport; 451 memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address, 452 sizeof(sin->sin_addr)); 453 } else if (cp->heartbeat.hb_info.addr_family == AF_INET6 && 454 cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) { 455 sin6->sin6_family = cp->heartbeat.hb_info.addr_family; 456 sin6->sin6_len = cp->heartbeat.hb_info.addr_len; 457 sin6->sin6_port = stcb->rport; 458 memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address, 459 sizeof(sin6->sin6_addr)); 460 } else { 461 return; 462 } 463 r_net = sctp_findnet(stcb, (struct sockaddr *)sin); 464 if (r_net == NULL) { 465 #ifdef SCTP_DEBUG 466 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 467 printf("Huh? I can't find the address I sent it to, discard\n"); 468 } 469 #endif 470 return; 471 } 472 if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) && 473 (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) && 474 (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) { 475 /* 476 * If the its a HB and it's random value is correct when can 477 * confirm the destination. 478 */ 479 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 480 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 481 stcb, 0, (void *)r_net); 482 } 483 r_net->error_count = 0; 484 r_net->hb_responded = 1; 485 tv.tv_sec = cp->heartbeat.hb_info.time_value_1; 486 tv.tv_usec = cp->heartbeat.hb_info.time_value_2; 487 if (r_net->dest_state & SCTP_ADDR_NOT_REACHABLE) { 488 r_net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE; 489 r_net->dest_state |= SCTP_ADDR_REACHABLE; 490 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb, 491 SCTP_HEARTBEAT_SUCCESS, (void *)r_net); 492 /* now was it the primary? if so restore */ 493 if (r_net->dest_state & SCTP_ADDR_WAS_PRIMARY) { 494 sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, r_net); 495 } 496 } 497 /* Now lets do a RTO with this */ 498 r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv); 499 } 500 501 static void 502 sctp_handle_abort(struct sctp_abort_chunk *cp, 503 struct sctp_tcb *stcb, struct sctp_nets *net) 504 { 505 506 #ifdef SCTP_DEBUG 507 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 508 printf("sctp_handle_abort: handling ABORT\n"); 509 } 510 #endif 511 if (stcb == NULL) 512 return; 513 /* verify that the destination addr is in the association */ 514 /* ignore abort for addresses being deleted */ 515 516 /* stop any receive timers */ 517 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5); 518 /* notify user of the abort and clean up... */ 519 sctp_abort_notification(stcb, 0); 520 /* free the tcb */ 521 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 522 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) || 523 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 524 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 525 } 526 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6); 527 #ifdef SCTP_DEBUG 528 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 529 printf("sctp_handle_abort: finished\n"); 530 } 531 #endif 532 } 533 534 static void 535 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp, 536 struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag) 537 { 538 struct sctp_association *asoc; 539 int some_on_streamwheel; 540 541 #ifdef SCTP_DEBUG 542 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 543 printf("sctp_handle_shutdown: handling SHUTDOWN\n"); 544 } 545 #endif 546 if (stcb == NULL) 547 return; 548 asoc = &stcb->asoc; 549 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 550 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 551 return; 552 } 553 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) { 554 /* Shutdown NOT the expected size */ 555 return; 556 } else { 557 sctp_update_acked(stcb, cp, net, abort_flag); 558 } 559 if (asoc->control_pdapi) { 560 /* 561 * With a normal shutdown we assume the end of last record. 562 */ 563 SCTP_INP_READ_LOCK(stcb->sctp_ep); 564 asoc->control_pdapi->end_added = 1; 565 asoc->control_pdapi->pdapi_aborted = 1; 566 asoc->control_pdapi = NULL; 567 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 568 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 569 } 570 /* goto SHUTDOWN_RECEIVED state to block new requests */ 571 if (stcb->sctp_socket) { 572 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 573 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 574 asoc->state = SCTP_STATE_SHUTDOWN_RECEIVED; 575 /* 576 * notify upper layer that peer has initiated a 577 * shutdown 578 */ 579 sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL); 580 581 /* reset time */ 582 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 583 } 584 } 585 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) { 586 /* 587 * stop the shutdown timer, since we WILL move to 588 * SHUTDOWN-ACK-SENT. 589 */ 590 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_7); 591 } 592 /* Now are we there yet? */ 593 some_on_streamwheel = 0; 594 if (!TAILQ_EMPTY(&asoc->out_wheel)) { 595 /* Check to see if some data queued */ 596 struct sctp_stream_out *outs; 597 598 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 599 if (!TAILQ_EMPTY(&outs->outqueue)) { 600 some_on_streamwheel = 1; 601 break; 602 } 603 } 604 } 605 if (!TAILQ_EMPTY(&asoc->send_queue) || 606 !TAILQ_EMPTY(&asoc->sent_queue) || 607 some_on_streamwheel) { 608 /* By returning we will push more data out */ 609 return; 610 } else { 611 /* no outstanding data to send, so move on... */ 612 /* send SHUTDOWN-ACK */ 613 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 614 /* move to SHUTDOWN-ACK-SENT state */ 615 if (asoc->state == SCTP_STATE_SHUTDOWN_RECEIVED) { 616 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 617 } 618 asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT; 619 620 /* start SHUTDOWN timer */ 621 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, 622 stcb, net); 623 } 624 } 625 626 static void 627 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp, 628 struct sctp_tcb *stcb, struct sctp_nets *net) 629 { 630 struct sctp_association *asoc; 631 632 #ifdef SCTP_DEBUG 633 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 634 printf("sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n"); 635 } 636 #endif 637 if (stcb == NULL) 638 return; 639 640 asoc = &stcb->asoc; 641 /* process according to association state */ 642 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 643 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 644 /* unexpected SHUTDOWN-ACK... so ignore... */ 645 SCTP_TCB_UNLOCK(stcb); 646 return; 647 } 648 if (asoc->control_pdapi) { 649 /* 650 * With a normal shutdown we assume the end of last record. 651 */ 652 SCTP_INP_READ_LOCK(stcb->sctp_ep); 653 asoc->control_pdapi->end_added = 1; 654 asoc->control_pdapi->pdapi_aborted = 1; 655 asoc->control_pdapi = NULL; 656 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 657 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 658 } 659 /* are the queues empty? */ 660 if (!TAILQ_EMPTY(&asoc->send_queue) || 661 !TAILQ_EMPTY(&asoc->sent_queue) || 662 !TAILQ_EMPTY(&asoc->out_wheel)) { 663 sctp_report_all_outbound(stcb, 0); 664 } 665 /* stop the timer */ 666 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8); 667 /* send SHUTDOWN-COMPLETE */ 668 sctp_send_shutdown_complete(stcb, net); 669 /* notify upper layer protocol */ 670 if (stcb->sctp_socket) { 671 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 672 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 673 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 674 /* Set the connected flag to disconnected */ 675 stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 676 } 677 } 678 SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 679 /* free the TCB but first save off the ep */ 680 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, 681 SCTP_FROM_SCTP_INPUT + SCTP_LOC_9); 682 } 683 684 /* 685 * Skip past the param header and then we will find the chunk that caused the 686 * problem. There are two possiblities ASCONF or FWD-TSN other than that and 687 * our peer must be broken. 688 */ 689 static void 690 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr, 691 struct sctp_nets *net) 692 { 693 struct sctp_chunkhdr *chk; 694 695 chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr)); 696 switch (chk->chunk_type) { 697 case SCTP_ASCONF_ACK: 698 case SCTP_ASCONF: 699 sctp_asconf_cleanup(stcb, net); 700 break; 701 case SCTP_FORWARD_CUM_TSN: 702 stcb->asoc.peer_supports_prsctp = 0; 703 break; 704 default: 705 #ifdef SCTP_DEBUG 706 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 707 printf("Peer does not support chunk type %d(%x)??\n", 708 chk->chunk_type, (uint32_t) chk->chunk_type); 709 } 710 #endif 711 break; 712 } 713 } 714 715 /* 716 * Skip past the param header and then we will find the param that caused the 717 * problem. There are a number of param's in a ASCONF OR the prsctp param 718 * these will turn of specific features. 719 */ 720 static void 721 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr) 722 { 723 struct sctp_paramhdr *pbad; 724 725 pbad = phdr + 1; 726 switch (ntohs(pbad->param_type)) { 727 /* pr-sctp draft */ 728 case SCTP_PRSCTP_SUPPORTED: 729 stcb->asoc.peer_supports_prsctp = 0; 730 break; 731 case SCTP_SUPPORTED_CHUNK_EXT: 732 break; 733 /* draft-ietf-tsvwg-addip-sctp */ 734 case SCTP_ECN_NONCE_SUPPORTED: 735 stcb->asoc.peer_supports_ecn_nonce = 0; 736 stcb->asoc.ecn_nonce_allowed = 0; 737 stcb->asoc.ecn_allowed = 0; 738 break; 739 case SCTP_ADD_IP_ADDRESS: 740 case SCTP_DEL_IP_ADDRESS: 741 case SCTP_SET_PRIM_ADDR: 742 stcb->asoc.peer_supports_asconf = 0; 743 break; 744 case SCTP_SUCCESS_REPORT: 745 case SCTP_ERROR_CAUSE_IND: 746 #ifdef SCTP_DEBUG 747 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 748 printf("Huh, the peer does not support success? or error cause?\n"); 749 printf("Turning off ASCONF to this strange peer\n"); 750 } 751 #endif 752 stcb->asoc.peer_supports_asconf = 0; 753 break; 754 default: 755 #ifdef SCTP_DEBUG 756 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 757 printf("Peer does not support param type %d(%x)??\n", 758 pbad->param_type, (uint32_t) pbad->param_type); 759 } 760 #endif 761 break; 762 } 763 } 764 765 static int 766 sctp_handle_error(struct sctp_chunkhdr *ch, 767 struct sctp_tcb *stcb, struct sctp_nets *net) 768 { 769 int chklen; 770 struct sctp_paramhdr *phdr; 771 uint16_t error_type; 772 uint16_t error_len; 773 struct sctp_association *asoc; 774 775 int adjust; 776 777 /* parse through all of the errors and process */ 778 asoc = &stcb->asoc; 779 phdr = (struct sctp_paramhdr *)((caddr_t)ch + 780 sizeof(struct sctp_chunkhdr)); 781 chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr); 782 while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) { 783 /* Process an Error Cause */ 784 error_type = ntohs(phdr->param_type); 785 error_len = ntohs(phdr->param_length); 786 if ((error_len > chklen) || (error_len == 0)) { 787 /* invalid param length for this param */ 788 #ifdef SCTP_DEBUG 789 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 790 printf("Bogus length in error param- chunk left:%d errorlen:%d\n", 791 chklen, error_len); 792 } 793 #endif /* SCTP_DEBUG */ 794 return (0); 795 } 796 switch (error_type) { 797 case SCTP_CAUSE_INVALID_STREAM: 798 case SCTP_CAUSE_MISSING_PARAM: 799 case SCTP_CAUSE_INVALID_PARAM: 800 case SCTP_CAUSE_NO_USER_DATA: 801 #ifdef SCTP_DEBUG 802 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 803 printf("Software error we got a %d back? We have a bug :/ (or do they?)\n", 804 error_type); 805 } 806 #endif 807 break; 808 case SCTP_CAUSE_STALE_COOKIE: 809 /* 810 * We only act if we have echoed a cookie and are 811 * waiting. 812 */ 813 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 814 int *p; 815 816 p = (int *)((caddr_t)phdr + sizeof(*phdr)); 817 /* Save the time doubled */ 818 asoc->cookie_preserve_req = ntohl(*p) << 1; 819 asoc->stale_cookie_count++; 820 if (asoc->stale_cookie_count > 821 asoc->max_init_times) { 822 sctp_abort_notification(stcb, 0); 823 /* now free the asoc */ 824 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_10); 825 return (-1); 826 } 827 /* blast back to INIT state */ 828 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED; 829 asoc->state |= SCTP_STATE_COOKIE_WAIT; 830 831 sctp_stop_all_cookie_timers(stcb); 832 sctp_send_initiate(stcb->sctp_ep, stcb); 833 } 834 break; 835 case SCTP_CAUSE_UNRESOLVABLE_ADDR: 836 /* 837 * Nothing we can do here, we don't do hostname 838 * addresses so if the peer does not like my IPv6 839 * (or IPv4 for that matter) it does not matter. If 840 * they don't support that type of address, they can 841 * NOT possibly get that packet type... i.e. with no 842 * IPv6 you can't recieve a IPv6 packet. so we can 843 * safely ignore this one. If we ever added support 844 * for HOSTNAME Addresses, then we would need to do 845 * something here. 846 */ 847 break; 848 case SCTP_CAUSE_UNRECOG_CHUNK: 849 sctp_process_unrecog_chunk(stcb, phdr, net); 850 break; 851 case SCTP_CAUSE_UNRECOG_PARAM: 852 sctp_process_unrecog_param(stcb, phdr); 853 break; 854 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN: 855 /* 856 * We ignore this since the timer will drive out a 857 * new cookie anyway and there timer will drive us 858 * to send a SHUTDOWN_COMPLETE. We can't send one 859 * here since we don't have their tag. 860 */ 861 break; 862 case SCTP_CAUSE_DELETING_LAST_ADDR: 863 case SCTP_CAUSE_RESOURCE_SHORTAGE: 864 case SCTP_CAUSE_DELETING_SRC_ADDR: 865 /* 866 * We should NOT get these here, but in a 867 * ASCONF-ACK. 868 */ 869 #ifdef SCTP_DEBUG 870 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 871 printf("Peer sends ASCONF errors in a Operational Error?<%d>?\n", 872 error_type); 873 } 874 #endif 875 break; 876 case SCTP_CAUSE_OUT_OF_RESC: 877 /* 878 * And what, pray tell do we do with the fact that 879 * the peer is out of resources? Not really sure we 880 * could do anything but abort. I suspect this 881 * should have came WITH an abort instead of in a 882 * OP-ERROR. 883 */ 884 break; 885 default: 886 #ifdef SCTP_DEBUG 887 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 888 /* don't know what this error cause is... */ 889 printf("sctp_handle_error: unknown error type = 0x%xh\n", 890 error_type); 891 } 892 #endif /* SCTP_DEBUG */ 893 break; 894 } 895 adjust = SCTP_SIZE32(error_len); 896 chklen -= adjust; 897 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust); 898 } 899 return (0); 900 } 901 902 static int 903 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh, 904 struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 905 struct sctp_nets *net) 906 { 907 struct sctp_init_ack *init_ack; 908 int *state; 909 struct mbuf *op_err; 910 911 #ifdef SCTP_DEBUG 912 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 913 printf("sctp_handle_init_ack: handling INIT-ACK\n"); 914 } 915 #endif 916 if (stcb == NULL) { 917 #ifdef SCTP_DEBUG 918 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 919 printf("sctp_handle_init_ack: TCB is null\n"); 920 } 921 #endif 922 return (-1); 923 } 924 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) { 925 /* Invalid length */ 926 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 927 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 928 op_err); 929 return (-1); 930 } 931 init_ack = &cp->init; 932 /* validate parameters */ 933 if (init_ack->initiate_tag == 0) { 934 /* protocol error... send an abort */ 935 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 936 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 937 op_err); 938 return (-1); 939 } 940 if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) { 941 /* protocol error... send an abort */ 942 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 943 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 944 op_err); 945 return (-1); 946 } 947 if (init_ack->num_inbound_streams == 0) { 948 /* protocol error... send an abort */ 949 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 950 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 951 op_err); 952 return (-1); 953 } 954 if (init_ack->num_outbound_streams == 0) { 955 /* protocol error... send an abort */ 956 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 957 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 958 op_err); 959 return (-1); 960 } 961 /* process according to association state... */ 962 state = &stcb->asoc.state; 963 switch (*state & SCTP_STATE_MASK) { 964 case SCTP_STATE_COOKIE_WAIT: 965 /* this is the expected state for this chunk */ 966 /* process the INIT-ACK parameters */ 967 if (stcb->asoc.primary_destination->dest_state & 968 SCTP_ADDR_UNCONFIRMED) { 969 /* 970 * The primary is where we sent the INIT, we can 971 * always consider it confirmed when the INIT-ACK is 972 * returned. Do this before we load addresses 973 * though. 974 */ 975 stcb->asoc.primary_destination->dest_state &= 976 ~SCTP_ADDR_UNCONFIRMED; 977 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 978 stcb, 0, (void *)stcb->asoc.primary_destination); 979 } 980 if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb, net 981 ) < 0) { 982 /* error in parsing parameters */ 983 return (-1); 984 } 985 /* update our state */ 986 #ifdef SCTP_DEBUG 987 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 988 printf("moving to COOKIE-ECHOED state\n"); 989 } 990 #endif 991 if (*state & SCTP_STATE_SHUTDOWN_PENDING) { 992 *state = SCTP_STATE_COOKIE_ECHOED | 993 SCTP_STATE_SHUTDOWN_PENDING; 994 } else { 995 *state = SCTP_STATE_COOKIE_ECHOED; 996 } 997 998 /* reset the RTO calc */ 999 stcb->asoc.overall_error_count = 0; 1000 SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered); 1001 /* 1002 * collapse the init timer back in case of a exponential 1003 * backoff 1004 */ 1005 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep, 1006 stcb, net); 1007 /* 1008 * the send at the end of the inbound data processing will 1009 * cause the cookie to be sent 1010 */ 1011 break; 1012 case SCTP_STATE_SHUTDOWN_SENT: 1013 /* incorrect state... discard */ 1014 break; 1015 case SCTP_STATE_COOKIE_ECHOED: 1016 /* incorrect state... discard */ 1017 break; 1018 case SCTP_STATE_OPEN: 1019 /* incorrect state... discard */ 1020 break; 1021 case SCTP_STATE_EMPTY: 1022 case SCTP_STATE_INUSE: 1023 default: 1024 /* incorrect state... discard */ 1025 return (-1); 1026 break; 1027 } /* end switch asoc state */ 1028 #ifdef SCTP_DEBUG 1029 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1030 printf("Leaving handle-init-ack end\n"); 1031 } 1032 #endif 1033 return (0); 1034 } 1035 1036 1037 /* 1038 * handle a state cookie for an existing association m: input packet mbuf 1039 * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a 1040 * "split" mbuf and the cookie signature does not exist offset: offset into 1041 * mbuf to the cookie-echo chunk 1042 */ 1043 static struct sctp_tcb * 1044 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset, 1045 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1046 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 1047 struct sockaddr *init_src, int *notification, sctp_assoc_t * sac_assoc_id) 1048 { 1049 struct sctp_association *asoc; 1050 struct sctp_init_chunk *init_cp, init_buf; 1051 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1052 int chk_length; 1053 int init_offset, initack_offset, i; 1054 int retval; 1055 int spec_flag = 0; 1056 int how_indx; 1057 1058 /* I know that the TCB is non-NULL from the caller */ 1059 asoc = &stcb->asoc; 1060 for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); i++) { 1061 if (asoc->cookie_how[how_indx] == 0) 1062 break; 1063 } 1064 if (how_indx < sizeof(asoc->cookie_how)) { 1065 asoc->cookie_how[how_indx] = 1; 1066 } 1067 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) { 1068 /* SHUTDOWN came in after sending INIT-ACK */ 1069 struct mbuf *op_err; 1070 struct sctp_paramhdr *ph; 1071 1072 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 1073 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 1074 0, M_DONTWAIT, 1, MT_DATA); 1075 if (op_err == NULL) { 1076 /* FOOBAR */ 1077 return (NULL); 1078 } 1079 /* pre-reserve some space */ 1080 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 1081 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 1082 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 1083 /* Set the len */ 1084 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr); 1085 ph = mtod(op_err, struct sctp_paramhdr *); 1086 ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN); 1087 ph->param_length = htons(sizeof(struct sctp_paramhdr)); 1088 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag); 1089 if (how_indx < sizeof(asoc->cookie_how)) 1090 asoc->cookie_how[how_indx] = 2; 1091 return (NULL); 1092 } 1093 /* 1094 * find and validate the INIT chunk in the cookie (peer's info) the 1095 * INIT should start after the cookie-echo header struct (chunk 1096 * header, state cookie header struct) 1097 */ 1098 init_offset = offset += sizeof(struct sctp_cookie_echo_chunk); 1099 1100 init_cp = (struct sctp_init_chunk *) 1101 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1102 (uint8_t *) & init_buf); 1103 if (init_cp == NULL) { 1104 /* could not pull a INIT chunk in cookie */ 1105 return (NULL); 1106 } 1107 chk_length = ntohs(init_cp->ch.chunk_length); 1108 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1109 return (NULL); 1110 } 1111 /* 1112 * find and validate the INIT-ACK chunk in the cookie (my info) the 1113 * INIT-ACK follows the INIT chunk 1114 */ 1115 initack_offset = init_offset + SCTP_SIZE32(chk_length); 1116 initack_cp = (struct sctp_init_ack_chunk *) 1117 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1118 (uint8_t *) & initack_buf); 1119 if (initack_cp == NULL) { 1120 /* could not pull INIT-ACK chunk in cookie */ 1121 return (NULL); 1122 } 1123 chk_length = ntohs(initack_cp->ch.chunk_length); 1124 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1125 return (NULL); 1126 } 1127 if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) && 1128 (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) { 1129 /* 1130 * case D in Section 5.2.4 Table 2: MMAA process accordingly 1131 * to get into the OPEN state 1132 */ 1133 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) { 1134 #ifdef INVARIANTS 1135 panic("Case D and non-match seq?"); 1136 #else 1137 printf("Case D, seq non-match %x vs %x?\n", 1138 ntohl(initack_cp->init.initial_tsn), asoc->init_seq_number); 1139 #endif 1140 } 1141 switch SCTP_GET_STATE 1142 (asoc) { 1143 case SCTP_STATE_COOKIE_WAIT: 1144 case SCTP_STATE_COOKIE_ECHOED: 1145 /* 1146 * INIT was sent, but got got a COOKIE_ECHO with the 1147 * correct tags... just accept it...but we must 1148 * process the init so that we can make sure we have 1149 * the right seq no's. 1150 */ 1151 /* First we must process the INIT !! */ 1152 retval = sctp_process_init(init_cp, stcb, net); 1153 if (retval < 0) { 1154 if (how_indx < sizeof(asoc->cookie_how)) 1155 asoc->cookie_how[how_indx] = 3; 1156 return (NULL); 1157 } 1158 /* we have already processed the INIT so no problem */ 1159 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, 1160 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_11); 1161 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12); 1162 /* update current state */ 1163 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1164 asoc->state = SCTP_STATE_OPEN | 1165 SCTP_STATE_SHUTDOWN_PENDING; 1166 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1167 stcb->sctp_ep, stcb, asoc->primary_destination); 1168 1169 } else if ((asoc->state & SCTP_STATE_SHUTDOWN_SENT) == 0) { 1170 /* if ok, move to OPEN state */ 1171 asoc->state = SCTP_STATE_OPEN; 1172 } 1173 sctp_stop_all_cookie_timers(stcb); 1174 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1175 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1176 (inp->sctp_socket->so_qlimit == 0) 1177 ) { 1178 /* 1179 * Here is where collision would go if we 1180 * did a connect() and instead got a 1181 * init/init-ack/cookie done before the 1182 * init-ack came back.. 1183 */ 1184 stcb->sctp_ep->sctp_flags |= 1185 SCTP_PCB_FLAGS_CONNECTED; 1186 soisconnected(stcb->sctp_ep->sctp_socket); 1187 } 1188 /* notify upper layer */ 1189 *notification = SCTP_NOTIFY_ASSOC_UP; 1190 /* 1191 * since we did not send a HB make sure we don't 1192 * double things 1193 */ 1194 net->hb_responded = 1; 1195 1196 if (stcb->asoc.sctp_autoclose_ticks && 1197 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) { 1198 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 1199 inp, stcb, NULL); 1200 } 1201 break; 1202 default: 1203 /* 1204 * we're in the OPEN state (or beyond), so peer must 1205 * have simply lost the COOKIE-ACK 1206 */ 1207 break; 1208 } /* end switch */ 1209 sctp_stop_all_cookie_timers(stcb); 1210 /* 1211 * We ignore the return code here.. not sure if we should 1212 * somehow abort.. but we do have an existing asoc. This 1213 * really should not fail. 1214 */ 1215 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1216 init_offset + sizeof(struct sctp_init_chunk), 1217 initack_offset, sh, init_src)) { 1218 if (how_indx < sizeof(asoc->cookie_how)) 1219 asoc->cookie_how[how_indx] = 4; 1220 return (NULL); 1221 } 1222 /* respond with a COOKIE-ACK */ 1223 sctp_toss_old_cookies(stcb, asoc); 1224 sctp_send_cookie_ack(stcb); 1225 if (how_indx < sizeof(asoc->cookie_how)) 1226 asoc->cookie_how[how_indx] = 5; 1227 return (stcb); 1228 } /* end if */ 1229 if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1230 ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag && 1231 cookie->tie_tag_my_vtag == 0 && 1232 cookie->tie_tag_peer_vtag == 0) { 1233 /* 1234 * case C in Section 5.2.4 Table 2: XMOO silently discard 1235 */ 1236 if (how_indx < sizeof(asoc->cookie_how)) 1237 asoc->cookie_how[how_indx] = 6; 1238 return (NULL); 1239 } 1240 if (ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag && 1241 (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag || 1242 init_cp->init.initiate_tag == 0)) { 1243 /* 1244 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info 1245 * should be ok, re-accept peer info 1246 */ 1247 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) { 1248 /* 1249 * Extension of case C. If we hit this, then the 1250 * random number generator returned the same vtag 1251 * when we first sent our INIT-ACK and when we later 1252 * sent our INIT. The side with the seq numbers that 1253 * are different will be the one that normnally 1254 * would have hit case C. This in effect "extends" 1255 * our vtags in this collision case to be 64 bits. 1256 * The same collision could occur aka you get both 1257 * vtag and seq number the same twice in a row.. but 1258 * is much less likely. If it did happen then we 1259 * would proceed through and bring up the assoc.. we 1260 * may end up with the wrong stream setup however.. 1261 * which would be bad.. but there is no way to 1262 * tell.. until we send on a stream that does not 1263 * exist :-) 1264 */ 1265 if (how_indx < sizeof(asoc->cookie_how)) 1266 asoc->cookie_how[how_indx] = 7; 1267 1268 return (NULL); 1269 } 1270 if (how_indx < sizeof(asoc->cookie_how)) 1271 asoc->cookie_how[how_indx] = 8; 1272 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13); 1273 sctp_stop_all_cookie_timers(stcb); 1274 /* 1275 * since we did not send a HB make sure we don't double 1276 * things 1277 */ 1278 net->hb_responded = 1; 1279 if (stcb->asoc.sctp_autoclose_ticks && 1280 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1281 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, 1282 NULL); 1283 } 1284 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1285 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1286 1287 /* Note last_cwr_tsn? where is this used? */ 1288 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1289 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) { 1290 /* 1291 * Ok the peer probably discarded our data (if we 1292 * echoed a cookie+data). So anything on the 1293 * sent_queue should be marked for retransmit, we 1294 * may not get something to kick us so it COULD 1295 * still take a timeout to move these.. but it can't 1296 * hurt to mark them. 1297 */ 1298 struct sctp_tmit_chunk *chk; 1299 1300 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 1301 if (chk->sent < SCTP_DATAGRAM_RESEND) { 1302 chk->sent = SCTP_DATAGRAM_RESEND; 1303 stcb->asoc.sent_queue_retran_cnt++; 1304 spec_flag++; 1305 } 1306 } 1307 1308 } 1309 /* process the INIT info (peer's info) */ 1310 retval = sctp_process_init(init_cp, stcb, net); 1311 if (retval < 0) { 1312 if (how_indx < sizeof(asoc->cookie_how)) 1313 asoc->cookie_how[how_indx] = 9; 1314 return (NULL); 1315 } 1316 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1317 init_offset + sizeof(struct sctp_init_chunk), 1318 initack_offset, sh, init_src)) { 1319 if (how_indx < sizeof(asoc->cookie_how)) 1320 asoc->cookie_how[how_indx] = 10; 1321 return (NULL); 1322 } 1323 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) || 1324 (asoc->state & SCTP_STATE_COOKIE_ECHOED)) { 1325 *notification = SCTP_NOTIFY_ASSOC_UP; 1326 1327 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1328 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1329 (inp->sctp_socket->so_qlimit == 0)) { 1330 stcb->sctp_ep->sctp_flags |= 1331 SCTP_PCB_FLAGS_CONNECTED; 1332 soisconnected(stcb->sctp_ep->sctp_socket); 1333 } 1334 } 1335 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1336 asoc->state = SCTP_STATE_OPEN | 1337 SCTP_STATE_SHUTDOWN_PENDING; 1338 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1339 stcb->sctp_ep, stcb, asoc->primary_destination); 1340 1341 } else { 1342 asoc->state = SCTP_STATE_OPEN; 1343 } 1344 sctp_stop_all_cookie_timers(stcb); 1345 sctp_toss_old_cookies(stcb, asoc); 1346 sctp_send_cookie_ack(stcb); 1347 if (spec_flag) { 1348 /* 1349 * only if we have retrans set do we do this. What 1350 * this call does is get only the COOKIE-ACK out and 1351 * then when we return the normal call to 1352 * sctp_chunk_output will get the retrans out behind 1353 * this. 1354 */ 1355 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK); 1356 } 1357 if (how_indx < sizeof(asoc->cookie_how)) 1358 asoc->cookie_how[how_indx] = 11; 1359 1360 return (stcb); 1361 } 1362 if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1363 ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) && 1364 cookie->tie_tag_my_vtag == asoc->my_vtag_nonce && 1365 cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce && 1366 cookie->tie_tag_peer_vtag != 0) { 1367 struct sctpasochead *head; 1368 1369 /* 1370 * case A in Section 5.2.4 Table 2: XXMM (peer restarted) 1371 */ 1372 /* temp code */ 1373 if (how_indx < sizeof(asoc->cookie_how)) 1374 asoc->cookie_how[how_indx] = 12; 1375 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14); 1376 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15); 1377 1378 *sac_assoc_id = sctp_get_associd(stcb); 1379 /* notify upper layer */ 1380 *notification = SCTP_NOTIFY_ASSOC_RESTART; 1381 atomic_add_int(&stcb->asoc.refcnt, 1); 1382 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1383 asoc->state = SCTP_STATE_OPEN | 1384 SCTP_STATE_SHUTDOWN_PENDING; 1385 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1386 stcb->sctp_ep, stcb, asoc->primary_destination); 1387 1388 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) { 1389 /* move to OPEN state, if not in SHUTDOWN_SENT */ 1390 asoc->state = SCTP_STATE_OPEN; 1391 } 1392 asoc->pre_open_streams = 1393 ntohs(initack_cp->init.num_outbound_streams); 1394 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1395 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1396 1397 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1398 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1399 1400 asoc->str_reset_seq_in = asoc->init_seq_number; 1401 1402 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1403 if (asoc->mapping_array) 1404 memset(asoc->mapping_array, 0, 1405 asoc->mapping_array_size); 1406 SCTP_TCB_UNLOCK(stcb); 1407 SCTP_INP_INFO_WLOCK(); 1408 SCTP_INP_WLOCK(stcb->sctp_ep); 1409 SCTP_TCB_LOCK(stcb); 1410 atomic_add_int(&stcb->asoc.refcnt, -1); 1411 /* send up all the data */ 1412 SCTP_TCB_SEND_LOCK(stcb); 1413 1414 sctp_report_all_outbound(stcb, 1); 1415 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 1416 stcb->asoc.strmout[i].stream_no = i; 1417 stcb->asoc.strmout[i].next_sequence_sent = 0; 1418 stcb->asoc.strmout[i].last_msg_incomplete = 0; 1419 } 1420 /* process the INIT-ACK info (my info) */ 1421 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1422 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1423 1424 /* pull from vtag hash */ 1425 LIST_REMOVE(stcb, sctp_asocs); 1426 /* re-insert to new vtag position */ 1427 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, 1428 sctppcbinfo.hashasocmark)]; 1429 /* 1430 * put it in the bucket in the vtag hash of assoc's for the 1431 * system 1432 */ 1433 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 1434 1435 /* Is this the first restart? */ 1436 if (stcb->asoc.in_restart_hash == 0) { 1437 /* Ok add it to assoc_id vtag hash */ 1438 head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id, 1439 sctppcbinfo.hashrestartmark)]; 1440 LIST_INSERT_HEAD(head, stcb, sctp_tcbrestarhash); 1441 stcb->asoc.in_restart_hash = 1; 1442 } 1443 /* process the INIT info (peer's info) */ 1444 SCTP_TCB_SEND_UNLOCK(stcb); 1445 SCTP_INP_WUNLOCK(stcb->sctp_ep); 1446 SCTP_INP_INFO_WUNLOCK(); 1447 1448 retval = sctp_process_init(init_cp, stcb, net); 1449 if (retval < 0) { 1450 if (how_indx < sizeof(asoc->cookie_how)) 1451 asoc->cookie_how[how_indx] = 13; 1452 1453 return (NULL); 1454 } 1455 /* 1456 * since we did not send a HB make sure we don't double 1457 * things 1458 */ 1459 net->hb_responded = 1; 1460 1461 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1462 init_offset + sizeof(struct sctp_init_chunk), 1463 initack_offset, sh, init_src)) { 1464 if (how_indx < sizeof(asoc->cookie_how)) 1465 asoc->cookie_how[how_indx] = 14; 1466 1467 return (NULL); 1468 } 1469 /* respond with a COOKIE-ACK */ 1470 sctp_stop_all_cookie_timers(stcb); 1471 sctp_toss_old_cookies(stcb, asoc); 1472 sctp_send_cookie_ack(stcb); 1473 if (how_indx < sizeof(asoc->cookie_how)) 1474 asoc->cookie_how[how_indx] = 15; 1475 1476 return (stcb); 1477 } 1478 if (how_indx < sizeof(asoc->cookie_how)) 1479 asoc->cookie_how[how_indx] = 16; 1480 /* all other cases... */ 1481 return (NULL); 1482 } 1483 1484 1485 /* 1486 * handle a state cookie for a new association m: input packet mbuf chain-- 1487 * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf 1488 * and the cookie signature does not exist offset: offset into mbuf to the 1489 * cookie-echo chunk length: length of the cookie chunk to: where the init 1490 * was from returns a new TCB 1491 */ 1492 static struct sctp_tcb * 1493 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset, 1494 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1495 struct sctp_inpcb *inp, struct sctp_nets **netp, 1496 struct sockaddr *init_src, int *notification, 1497 int auth_skipped, uint32_t auth_offset, uint32_t auth_len) 1498 { 1499 struct sctp_tcb *stcb; 1500 struct sctp_init_chunk *init_cp, init_buf; 1501 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1502 struct sockaddr_storage sa_store; 1503 struct sockaddr *initack_src = (struct sockaddr *)&sa_store; 1504 struct sockaddr_in *sin; 1505 struct sockaddr_in6 *sin6; 1506 struct sctp_association *asoc; 1507 int chk_length; 1508 int init_offset, initack_offset, initack_limit; 1509 int retval; 1510 int error = 0; 1511 uint32_t old_tag; 1512 uint8_t chunk_buf[DEFAULT_CHUNK_BUFFER]; 1513 1514 /* 1515 * find and validate the INIT chunk in the cookie (peer's info) the 1516 * INIT should start after the cookie-echo header struct (chunk 1517 * header, state cookie header struct) 1518 */ 1519 init_offset = offset + sizeof(struct sctp_cookie_echo_chunk); 1520 init_cp = (struct sctp_init_chunk *) 1521 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1522 (uint8_t *) & init_buf); 1523 if (init_cp == NULL) { 1524 /* could not pull a INIT chunk in cookie */ 1525 #ifdef SCTP_DEBUG 1526 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1527 printf("process_cookie_new: could not pull INIT chunk hdr\n"); 1528 } 1529 #endif /* SCTP_DEBUG */ 1530 return (NULL); 1531 } 1532 chk_length = ntohs(init_cp->ch.chunk_length); 1533 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1534 #ifdef SCTP_DEBUG 1535 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1536 printf("HUH? process_cookie_new: could not find INIT chunk!\n"); 1537 } 1538 #endif /* SCTP_DEBUG */ 1539 return (NULL); 1540 } 1541 initack_offset = init_offset + SCTP_SIZE32(chk_length); 1542 /* 1543 * find and validate the INIT-ACK chunk in the cookie (my info) the 1544 * INIT-ACK follows the INIT chunk 1545 */ 1546 initack_cp = (struct sctp_init_ack_chunk *) 1547 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1548 (uint8_t *) & initack_buf); 1549 if (initack_cp == NULL) { 1550 /* could not pull INIT-ACK chunk in cookie */ 1551 #ifdef SCTP_DEBUG 1552 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1553 printf("process_cookie_new: could not pull INIT-ACK chunk hdr\n"); 1554 } 1555 #endif /* SCTP_DEBUG */ 1556 return (NULL); 1557 } 1558 chk_length = ntohs(initack_cp->ch.chunk_length); 1559 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1560 return (NULL); 1561 } 1562 /* 1563 * NOTE: We can't use the INIT_ACK's chk_length to determine the 1564 * "initack_limit" value. This is because the chk_length field 1565 * includes the length of the cookie, but the cookie is omitted when 1566 * the INIT and INIT_ACK are tacked onto the cookie... 1567 */ 1568 initack_limit = offset + cookie_len; 1569 1570 /* 1571 * now that we know the INIT/INIT-ACK are in place, create a new TCB 1572 * and popluate 1573 */ 1574 stcb = sctp_aloc_assoc(inp, init_src, 0, &error, 1575 ntohl(initack_cp->init.initiate_tag)); 1576 if (stcb == NULL) { 1577 struct mbuf *op_err; 1578 1579 /* memory problem? */ 1580 #ifdef SCTP_DEBUG 1581 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1582 printf("process_cookie_new: no room for another TCB!\n"); 1583 } 1584 #endif /* SCTP_DEBUG */ 1585 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1586 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 1587 sh, op_err); 1588 return (NULL); 1589 } 1590 /* get the correct sctp_nets */ 1591 *netp = sctp_findnet(stcb, init_src); 1592 asoc = &stcb->asoc; 1593 /* get scope variables out of cookie */ 1594 asoc->ipv4_local_scope = cookie->ipv4_scope; 1595 asoc->site_scope = cookie->site_scope; 1596 asoc->local_scope = cookie->local_scope; 1597 asoc->loopback_scope = cookie->loopback_scope; 1598 1599 if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) || 1600 (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) { 1601 struct mbuf *op_err; 1602 1603 /* 1604 * Houston we have a problem. The EP changed while the 1605 * cookie was in flight. Only recourse is to abort the 1606 * association. 1607 */ 1608 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1609 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 1610 sh, op_err); 1611 return (NULL); 1612 } 1613 /* process the INIT-ACK info (my info) */ 1614 old_tag = asoc->my_vtag; 1615 asoc->assoc_id = asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1616 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1617 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1618 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1619 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1620 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1621 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1622 asoc->str_reset_seq_in = asoc->init_seq_number; 1623 1624 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1625 1626 /* process the INIT info (peer's info) */ 1627 retval = sctp_process_init(init_cp, stcb, *netp); 1628 if (retval < 0) { 1629 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16); 1630 return (NULL); 1631 } 1632 /* load all addresses */ 1633 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1634 init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh, 1635 init_src)) { 1636 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17); 1637 return (NULL); 1638 } 1639 /* 1640 * verify any preceding AUTH chunk that was skipped 1641 */ 1642 /* pull the local authentication parameters from the cookie/init-ack */ 1643 sctp_auth_get_cookie_params(stcb, m, 1644 initack_offset + sizeof(struct sctp_init_ack_chunk), 1645 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk))); 1646 if (auth_skipped) { 1647 struct sctp_auth_chunk *auth; 1648 1649 auth = (struct sctp_auth_chunk *) 1650 sctp_m_getptr(m, auth_offset, auth_len, chunk_buf); 1651 if (sctp_handle_auth(stcb, auth, m, auth_offset)) { 1652 /* auth HMAC failed, dump the assoc and packet */ 1653 #ifdef SCTP_DEBUG 1654 if (sctp_debug_on & SCTP_DEBUG_AUTH1) 1655 printf("COOKIE-ECHO: AUTH failed\n"); 1656 #endif /* SCTP_DEBUG */ 1657 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18); 1658 return (NULL); 1659 } else { 1660 /* remaining chunks checked... good to go */ 1661 stcb->asoc.authenticated = 1; 1662 } 1663 } 1664 /* update current state */ 1665 #ifdef SCTP_DEBUG 1666 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1667 printf("moving to OPEN state\n"); 1668 } 1669 #endif 1670 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1671 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1672 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1673 stcb->sctp_ep, stcb, asoc->primary_destination); 1674 } else { 1675 asoc->state = SCTP_STATE_OPEN; 1676 } 1677 sctp_stop_all_cookie_timers(stcb); 1678 SCTP_STAT_INCR_COUNTER32(sctps_passiveestab); 1679 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1680 1681 /* 1682 * if we're doing ASCONFs, check to see if we have any new local 1683 * addresses that need to get added to the peer (eg. addresses 1684 * changed while cookie echo in flight). This needs to be done 1685 * after we go to the OPEN state to do the correct asconf 1686 * processing. else, make sure we have the correct addresses in our 1687 * lists 1688 */ 1689 1690 /* warning, we re-use sin, sin6, sa_store here! */ 1691 /* pull in local_address (our "from" address) */ 1692 if (cookie->laddr_type == SCTP_IPV4_ADDRESS) { 1693 /* source addr is IPv4 */ 1694 sin = (struct sockaddr_in *)initack_src; 1695 memset(sin, 0, sizeof(*sin)); 1696 sin->sin_family = AF_INET; 1697 sin->sin_len = sizeof(struct sockaddr_in); 1698 sin->sin_addr.s_addr = cookie->laddress[0]; 1699 } else if (cookie->laddr_type == SCTP_IPV6_ADDRESS) { 1700 /* source addr is IPv6 */ 1701 sin6 = (struct sockaddr_in6 *)initack_src; 1702 memset(sin6, 0, sizeof(*sin6)); 1703 sin6->sin6_family = AF_INET6; 1704 sin6->sin6_len = sizeof(struct sockaddr_in6); 1705 sin6->sin6_scope_id = cookie->scope_id; 1706 memcpy(&sin6->sin6_addr, cookie->laddress, 1707 sizeof(sin6->sin6_addr)); 1708 } else { 1709 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19); 1710 return (NULL); 1711 } 1712 1713 sctp_check_address_list(stcb, m, 1714 initack_offset + sizeof(struct sctp_init_ack_chunk), 1715 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)), 1716 initack_src, cookie->local_scope, cookie->site_scope, 1717 cookie->ipv4_scope, cookie->loopback_scope); 1718 1719 1720 /* set up to notify upper layer */ 1721 *notification = SCTP_NOTIFY_ASSOC_UP; 1722 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1723 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1724 (inp->sctp_socket->so_qlimit == 0)) { 1725 /* 1726 * This is an endpoint that called connect() how it got a 1727 * cookie that is NEW is a bit of a mystery. It must be that 1728 * the INIT was sent, but before it got there.. a complete 1729 * INIT/INIT-ACK/COOKIE arrived. But of course then it 1730 * should have went to the other code.. not here.. oh well.. 1731 * a bit of protection is worth having.. 1732 */ 1733 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 1734 soisconnected(stcb->sctp_ep->sctp_socket); 1735 } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 1736 (inp->sctp_socket->so_qlimit)) { 1737 /* 1738 * We don't want to do anything with this one. Since it is 1739 * the listening guy. The timer will get started for 1740 * accepted connections in the caller. 1741 */ 1742 ; 1743 } 1744 /* since we did not send a HB make sure we don't double things */ 1745 (*netp)->hb_responded = 1; 1746 1747 if (stcb->asoc.sctp_autoclose_ticks && 1748 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1749 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL); 1750 } 1751 /* respond with a COOKIE-ACK */ 1752 /* calculate the RTT */ 1753 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp, 1754 &cookie->time_entered); 1755 sctp_send_cookie_ack(stcb); 1756 return (stcb); 1757 } 1758 1759 1760 /* 1761 * handles a COOKIE-ECHO message stcb: modified to either a new or left as 1762 * existing (non-NULL) TCB 1763 */ 1764 static struct mbuf * 1765 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset, 1766 struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp, 1767 struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp, 1768 int auth_skipped, uint32_t auth_offset, uint32_t auth_len, struct sctp_tcb **locked_tcb) 1769 { 1770 struct sctp_state_cookie *cookie; 1771 struct sockaddr_in6 sin6; 1772 struct sockaddr_in sin; 1773 struct sctp_tcb *l_stcb = *stcb; 1774 struct sctp_inpcb *l_inp; 1775 struct sockaddr *to; 1776 sctp_assoc_t sac_restart_id; 1777 struct sctp_pcb *ep; 1778 struct mbuf *m_sig; 1779 uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE]; 1780 uint8_t *sig; 1781 uint8_t cookie_ok = 0; 1782 unsigned int size_of_pkt, sig_offset, cookie_offset; 1783 unsigned int cookie_len; 1784 struct timeval now; 1785 struct timeval time_expires; 1786 struct sockaddr_storage dest_store; 1787 struct sockaddr *localep_sa = (struct sockaddr *)&dest_store; 1788 struct ip *iph; 1789 int notification = 0; 1790 struct sctp_nets *netl; 1791 int had_a_existing_tcb = 0; 1792 1793 #ifdef SCTP_DEBUG 1794 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1795 printf("sctp_handle_cookie: handling COOKIE-ECHO\n"); 1796 } 1797 #endif 1798 1799 if (inp_p == NULL) { 1800 return (NULL); 1801 } 1802 /* First get the destination address setup too. */ 1803 iph = mtod(m, struct ip *); 1804 if (iph->ip_v == IPVERSION) { 1805 /* its IPv4 */ 1806 struct sockaddr_in *sin; 1807 1808 sin = (struct sockaddr_in *)(localep_sa); 1809 memset(sin, 0, sizeof(*sin)); 1810 sin->sin_family = AF_INET; 1811 sin->sin_len = sizeof(*sin); 1812 sin->sin_port = sh->dest_port; 1813 sin->sin_addr.s_addr = iph->ip_dst.s_addr; 1814 size_of_pkt = SCTP_GET_IPV4_LENGTH(iph); 1815 1816 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1817 /* its IPv6 */ 1818 struct ip6_hdr *ip6; 1819 struct sockaddr_in6 *sin6; 1820 1821 sin6 = (struct sockaddr_in6 *)(localep_sa); 1822 memset(sin6, 0, sizeof(*sin6)); 1823 sin6->sin6_family = AF_INET6; 1824 sin6->sin6_len = sizeof(struct sockaddr_in6); 1825 ip6 = mtod(m, struct ip6_hdr *); 1826 sin6->sin6_port = sh->dest_port; 1827 sin6->sin6_addr = ip6->ip6_dst; 1828 size_of_pkt = SCTP_GET_IPV6_LENGTH(ip6); 1829 } else { 1830 return (NULL); 1831 } 1832 1833 cookie = &cp->cookie; 1834 cookie_offset = offset + sizeof(struct sctp_chunkhdr); 1835 cookie_len = ntohs(cp->ch.chunk_length); 1836 1837 if ((cookie->peerport != sh->src_port) && 1838 (cookie->myport != sh->dest_port) && 1839 (cookie->my_vtag != sh->v_tag)) { 1840 /* 1841 * invalid ports or bad tag. Note that we always leave the 1842 * v_tag in the header in network order and when we stored 1843 * it in the my_vtag slot we also left it in network order. 1844 * This maintians the match even though it may be in the 1845 * opposite byte order of the machine :-> 1846 */ 1847 return (NULL); 1848 } 1849 if (cookie_len > size_of_pkt || 1850 cookie_len < sizeof(struct sctp_cookie_echo_chunk) + 1851 sizeof(struct sctp_init_chunk) + 1852 sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) { 1853 /* cookie too long! or too small */ 1854 return (NULL); 1855 } 1856 /* 1857 * split off the signature into its own mbuf (since it should not be 1858 * calculated in the sctp_hmac_m() call). 1859 */ 1860 sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE; 1861 if (sig_offset > size_of_pkt) { 1862 /* packet not correct size! */ 1863 /* XXX this may already be accounted for earlier... */ 1864 return (NULL); 1865 } 1866 m_sig = m_split(m, sig_offset, M_DONTWAIT); 1867 if (m_sig == NULL) { 1868 /* out of memory or ?? */ 1869 return (NULL); 1870 } 1871 /* 1872 * compute the signature/digest for the cookie 1873 */ 1874 ep = &(*inp_p)->sctp_ep; 1875 l_inp = *inp_p; 1876 if (l_stcb) { 1877 SCTP_TCB_UNLOCK(l_stcb); 1878 } 1879 SCTP_INP_RLOCK(l_inp); 1880 if (l_stcb) { 1881 SCTP_TCB_LOCK(l_stcb); 1882 } 1883 /* which cookie is it? */ 1884 if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) && 1885 (ep->current_secret_number != ep->last_secret_number)) { 1886 /* it's the old cookie */ 1887 sctp_hmac_m(SCTP_HMAC, 1888 (uint8_t *) ep->secret_key[(int)ep->last_secret_number], 1889 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1890 } else { 1891 /* it's the current cookie */ 1892 sctp_hmac_m(SCTP_HMAC, 1893 (uint8_t *) ep->secret_key[(int)ep->current_secret_number], 1894 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1895 } 1896 /* get the signature */ 1897 SCTP_INP_RUNLOCK(l_inp); 1898 sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig); 1899 if (sig == NULL) { 1900 /* couldn't find signature */ 1901 sctp_m_freem(m_sig); 1902 return (NULL); 1903 } 1904 /* compare the received digest with the computed digest */ 1905 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) { 1906 /* try the old cookie? */ 1907 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) && 1908 (ep->current_secret_number != ep->last_secret_number)) { 1909 /* compute digest with old */ 1910 sctp_hmac_m(SCTP_HMAC, 1911 (uint8_t *) ep->secret_key[(int)ep->last_secret_number], 1912 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1913 /* compare */ 1914 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0) 1915 cookie_ok = 1; 1916 } 1917 } else { 1918 cookie_ok = 1; 1919 } 1920 1921 /* 1922 * Now before we continue we must reconstruct our mbuf so that 1923 * normal processing of any other chunks will work. 1924 */ 1925 { 1926 struct mbuf *m_at; 1927 1928 m_at = m; 1929 while (SCTP_BUF_NEXT(m_at) != NULL) { 1930 m_at = SCTP_BUF_NEXT(m_at); 1931 } 1932 SCTP_BUF_NEXT(m_at) = m_sig; 1933 } 1934 1935 if (cookie_ok == 0) { 1936 #ifdef SCTP_DEBUG 1937 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1938 printf("handle_cookie_echo: cookie signature validation failed!\n"); 1939 printf("offset = %u, cookie_offset = %u, sig_offset = %u\n", 1940 (uint32_t) offset, cookie_offset, sig_offset); 1941 } 1942 #endif 1943 return (NULL); 1944 } 1945 /* 1946 * check the cookie timestamps to be sure it's not stale 1947 */ 1948 SCTP_GETTIME_TIMEVAL(&now); 1949 /* Expire time is in Ticks, so we convert to seconds */ 1950 time_expires.tv_sec = cookie->time_entered.tv_sec + cookie->cookie_life; 1951 time_expires.tv_usec = cookie->time_entered.tv_usec; 1952 if (timevalcmp(&now, &time_expires, >)) { 1953 /* cookie is stale! */ 1954 struct mbuf *op_err; 1955 struct sctp_stale_cookie_msg *scm; 1956 uint32_t tim; 1957 1958 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg), 1959 0, M_DONTWAIT, 1, MT_DATA); 1960 if (op_err == NULL) { 1961 /* FOOBAR */ 1962 return (NULL); 1963 } 1964 /* pre-reserve some space */ 1965 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 1966 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 1967 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 1968 1969 /* Set the len */ 1970 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg); 1971 scm = mtod(op_err, struct sctp_stale_cookie_msg *); 1972 scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE); 1973 scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) + 1974 (sizeof(uint32_t)))); 1975 /* seconds to usec */ 1976 tim = (now.tv_sec - time_expires.tv_sec) * 1000000; 1977 /* add in usec */ 1978 if (tim == 0) 1979 tim = now.tv_usec - cookie->time_entered.tv_usec; 1980 scm->time_usec = htonl(tim); 1981 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag); 1982 return (NULL); 1983 } 1984 /* 1985 * Now we must see with the lookup address if we have an existing 1986 * asoc. This will only happen if we were in the COOKIE-WAIT state 1987 * and a INIT collided with us and somewhere the peer sent the 1988 * cookie on another address besides the single address our assoc 1989 * had for him. In this case we will have one of the tie-tags set at 1990 * least AND the address field in the cookie can be used to look it 1991 * up. 1992 */ 1993 to = NULL; 1994 if (cookie->addr_type == SCTP_IPV6_ADDRESS) { 1995 memset(&sin6, 0, sizeof(sin6)); 1996 sin6.sin6_family = AF_INET6; 1997 sin6.sin6_len = sizeof(sin6); 1998 sin6.sin6_port = sh->src_port; 1999 sin6.sin6_scope_id = cookie->scope_id; 2000 memcpy(&sin6.sin6_addr.s6_addr, cookie->address, 2001 sizeof(sin6.sin6_addr.s6_addr)); 2002 to = (struct sockaddr *)&sin6; 2003 } else if (cookie->addr_type == SCTP_IPV4_ADDRESS) { 2004 memset(&sin, 0, sizeof(sin)); 2005 sin.sin_family = AF_INET; 2006 sin.sin_len = sizeof(sin); 2007 sin.sin_port = sh->src_port; 2008 sin.sin_addr.s_addr = cookie->address[0]; 2009 to = (struct sockaddr *)&sin; 2010 } 2011 if ((*stcb == NULL) && to) { 2012 /* Yep, lets check */ 2013 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL); 2014 if (*stcb == NULL) { 2015 /* 2016 * We should have only got back the same inp. If we 2017 * got back a different ep we have a problem. The 2018 * original findep got back l_inp and now 2019 */ 2020 if (l_inp != *inp_p) { 2021 printf("Bad problem find_ep got a diff inp then special_locate?\n"); 2022 } 2023 } else { 2024 if (*locked_tcb == NULL) { 2025 /* 2026 * In this case we found the assoc only 2027 * after we locked the create lock. This 2028 * means we are in a colliding case and we 2029 * must make sure that we unlock the tcb if 2030 * its one of the cases where we throw away 2031 * the incoming packets. 2032 */ 2033 *locked_tcb = *stcb; 2034 2035 /* 2036 * We must also increment the inp ref count 2037 * since the ref_count flags was set when we 2038 * did not find the TCB, now we found it 2039 * which reduces the refcount.. we must 2040 * raise it back out to balance it all :-) 2041 */ 2042 SCTP_INP_INCR_REF((*stcb)->sctp_ep); 2043 if ((*stcb)->sctp_ep != l_inp) { 2044 printf("Huh? ep:%p diff then l_inp:%p?\n", 2045 (*stcb)->sctp_ep, l_inp); 2046 } 2047 } 2048 } 2049 } 2050 cookie_len -= SCTP_SIGNATURE_SIZE; 2051 if (*stcb == NULL) { 2052 /* this is the "normal" case... get a new TCB */ 2053 *stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie, 2054 cookie_len, *inp_p, netp, to, ¬ification, 2055 auth_skipped, auth_offset, auth_len); 2056 } else { 2057 /* this is abnormal... cookie-echo on existing TCB */ 2058 had_a_existing_tcb = 1; 2059 *stcb = sctp_process_cookie_existing(m, iphlen, offset, sh, 2060 cookie, cookie_len, *inp_p, *stcb, *netp, to, ¬ification, 2061 &sac_restart_id); 2062 } 2063 2064 if (*stcb == NULL) { 2065 /* still no TCB... must be bad cookie-echo */ 2066 return (NULL); 2067 } 2068 /* 2069 * Ok, we built an association so confirm the address we sent the 2070 * INIT-ACK to. 2071 */ 2072 netl = sctp_findnet(*stcb, to); 2073 /* 2074 * This code should in theory NOT run but 2075 */ 2076 if (netl == NULL) { 2077 /* TSNH! Huh, why do I need to add this address here? */ 2078 int ret; 2079 2080 ret = sctp_add_remote_addr(*stcb, to, SCTP_DONOT_SETSCOPE, 2081 SCTP_IN_COOKIE_PROC); 2082 netl = sctp_findnet(*stcb, to); 2083 } 2084 if (netl) { 2085 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) { 2086 netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2087 sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL, 2088 netl); 2089 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 2090 (*stcb), 0, (void *)netl); 2091 } 2092 } 2093 if (*stcb) { 2094 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, *inp_p, 2095 *stcb, NULL); 2096 } 2097 if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 2098 if (!had_a_existing_tcb || 2099 (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) { 2100 /* 2101 * If we have a NEW cookie or the connect never 2102 * reached the connected state during collision we 2103 * must do the TCP accept thing. 2104 */ 2105 struct socket *so, *oso; 2106 struct sctp_inpcb *inp; 2107 2108 if (notification == SCTP_NOTIFY_ASSOC_RESTART) { 2109 /* 2110 * For a restart we will keep the same 2111 * socket, no need to do anything. I THINK!! 2112 */ 2113 sctp_ulp_notify(notification, *stcb, 0, (void *)&sac_restart_id); 2114 return (m); 2115 } 2116 oso = (*inp_p)->sctp_socket; 2117 /* 2118 * We do this to keep the sockets side happy durin 2119 * the sonewcon ONLY. 2120 */ 2121 NET_LOCK_GIANT(); 2122 SCTP_TCB_UNLOCK((*stcb)); 2123 so = sonewconn(oso, 0 2124 ); 2125 NET_UNLOCK_GIANT(); 2126 SCTP_INP_WLOCK((*stcb)->sctp_ep); 2127 SCTP_TCB_LOCK((*stcb)); 2128 SCTP_INP_WUNLOCK((*stcb)->sctp_ep); 2129 if (so == NULL) { 2130 struct mbuf *op_err; 2131 2132 /* Too many sockets */ 2133 #ifdef SCTP_DEBUG 2134 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 2135 printf("process_cookie_new: no room for another socket!\n"); 2136 } 2137 #endif /* SCTP_DEBUG */ 2138 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 2139 sctp_abort_association(*inp_p, NULL, m, iphlen, 2140 sh, op_err); 2141 sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20); 2142 return (NULL); 2143 } 2144 inp = (struct sctp_inpcb *)so->so_pcb; 2145 SCTP_INP_INCR_REF(inp); 2146 /* 2147 * We add the unbound flag here so that if we get an 2148 * soabort() before we get the move_pcb done, we 2149 * will properly cleanup. 2150 */ 2151 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 2152 SCTP_PCB_FLAGS_CONNECTED | 2153 SCTP_PCB_FLAGS_IN_TCPPOOL | 2154 SCTP_PCB_FLAGS_UNBOUND | 2155 (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) | 2156 SCTP_PCB_FLAGS_DONT_WAKE); 2157 inp->sctp_features = (*inp_p)->sctp_features; 2158 inp->sctp_socket = so; 2159 inp->sctp_frag_point = (*inp_p)->sctp_frag_point; 2160 inp->partial_delivery_point = (*inp_p)->partial_delivery_point; 2161 inp->sctp_context = (*inp_p)->sctp_context; 2162 inp->inp_starting_point_for_iterator = NULL; 2163 /* 2164 * copy in the authentication parameters from the 2165 * original endpoint 2166 */ 2167 if (inp->sctp_ep.local_hmacs) 2168 sctp_free_hmaclist(inp->sctp_ep.local_hmacs); 2169 inp->sctp_ep.local_hmacs = 2170 sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs); 2171 if (inp->sctp_ep.local_auth_chunks) 2172 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks); 2173 inp->sctp_ep.local_auth_chunks = 2174 sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks); 2175 (void)sctp_copy_skeylist(&(*inp_p)->sctp_ep.shared_keys, 2176 &inp->sctp_ep.shared_keys); 2177 2178 /* 2179 * Now we must move it from one hash table to 2180 * another and get the tcb in the right place. 2181 */ 2182 sctp_move_pcb_and_assoc(*inp_p, inp, *stcb); 2183 sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb); 2184 2185 /* 2186 * now we must check to see if we were aborted while 2187 * the move was going on and the lock/unlock 2188 * happened. 2189 */ 2190 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 2191 /* 2192 * yep it was, we leave the assoc attached 2193 * to the socket since the sctp_inpcb_free() 2194 * call will send an abort for us. 2195 */ 2196 SCTP_INP_DECR_REF(inp); 2197 return (NULL); 2198 } 2199 SCTP_INP_DECR_REF(inp); 2200 /* Switch over to the new guy */ 2201 *inp_p = inp; 2202 sctp_ulp_notify(notification, *stcb, 0, NULL); 2203 2204 /* 2205 * Pull it from the incomplete queue and wake the 2206 * guy 2207 */ 2208 soisconnected(so); 2209 return (m); 2210 } 2211 } 2212 if ((notification) && ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) { 2213 sctp_ulp_notify(notification, *stcb, 0, NULL); 2214 } 2215 return (m); 2216 } 2217 2218 static void 2219 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp, 2220 struct sctp_tcb *stcb, struct sctp_nets *net) 2221 { 2222 /* cp must not be used, others call this without a c-ack :-) */ 2223 struct sctp_association *asoc; 2224 2225 #ifdef SCTP_DEBUG 2226 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2227 printf("sctp_handle_cookie_ack: handling COOKIE-ACK\n"); 2228 } 2229 #endif 2230 if (stcb == NULL) 2231 return; 2232 2233 asoc = &stcb->asoc; 2234 2235 sctp_stop_all_cookie_timers(stcb); 2236 /* process according to association state */ 2237 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 2238 /* state change only needed when I am in right state */ 2239 #ifdef SCTP_DEBUG 2240 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2241 printf("moving to OPEN state\n"); 2242 } 2243 #endif 2244 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 2245 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 2246 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 2247 stcb->sctp_ep, stcb, asoc->primary_destination); 2248 2249 } else { 2250 asoc->state = SCTP_STATE_OPEN; 2251 } 2252 /* update RTO */ 2253 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 2254 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 2255 if (asoc->overall_error_count == 0) { 2256 net->RTO = sctp_calculate_rto(stcb, asoc, net, 2257 &asoc->time_entered); 2258 } 2259 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 2260 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL); 2261 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 2262 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 2263 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 2264 soisconnected(stcb->sctp_ep->sctp_socket); 2265 } 2266 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, 2267 stcb, net); 2268 /* 2269 * since we did not send a HB make sure we don't double 2270 * things 2271 */ 2272 net->hb_responded = 1; 2273 2274 if (stcb->asoc.sctp_autoclose_ticks && 2275 sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) { 2276 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 2277 stcb->sctp_ep, stcb, NULL); 2278 } 2279 /* 2280 * set ASCONF timer if ASCONFs are pending and allowed (eg. 2281 * addresses changed when init/cookie echo in flight) 2282 */ 2283 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) && 2284 (stcb->asoc.peer_supports_asconf) && 2285 (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) { 2286 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, 2287 stcb->sctp_ep, stcb, 2288 stcb->asoc.primary_destination); 2289 } 2290 } 2291 /* Toss the cookie if I can */ 2292 sctp_toss_old_cookies(stcb, asoc); 2293 if (!TAILQ_EMPTY(&asoc->sent_queue)) { 2294 /* Restart the timer if we have pending data */ 2295 struct sctp_tmit_chunk *chk; 2296 2297 chk = TAILQ_FIRST(&asoc->sent_queue); 2298 if (chk) { 2299 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2300 stcb, chk->whoTo); 2301 } 2302 } 2303 } 2304 2305 static void 2306 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp, 2307 struct sctp_tcb *stcb) 2308 { 2309 struct sctp_nets *net; 2310 struct sctp_tmit_chunk *lchk; 2311 uint32_t tsn; 2312 2313 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_ecne_chunk)) { 2314 return; 2315 } 2316 SCTP_STAT_INCR(sctps_recvecne); 2317 tsn = ntohl(cp->tsn); 2318 /* ECN Nonce stuff: need a resync and disable the nonce sum check */ 2319 /* Also we make sure we disable the nonce_wait */ 2320 lchk = TAILQ_FIRST(&stcb->asoc.send_queue); 2321 if (lchk == NULL) { 2322 stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq; 2323 } else { 2324 stcb->asoc.nonce_resync_tsn = lchk->rec.data.TSN_seq; 2325 } 2326 stcb->asoc.nonce_wait_for_ecne = 0; 2327 stcb->asoc.nonce_sum_check = 0; 2328 2329 /* Find where it was sent, if possible */ 2330 net = NULL; 2331 lchk = TAILQ_FIRST(&stcb->asoc.sent_queue); 2332 while (lchk) { 2333 if (lchk->rec.data.TSN_seq == tsn) { 2334 net = lchk->whoTo; 2335 break; 2336 } 2337 if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ)) 2338 break; 2339 lchk = TAILQ_NEXT(lchk, sctp_next); 2340 } 2341 if (net == NULL) 2342 /* default is we use the primary */ 2343 net = stcb->asoc.primary_destination; 2344 2345 if (compare_with_wrap(tsn, stcb->asoc.last_cwr_tsn, MAX_TSN)) { 2346 #ifdef SCTP_CWND_MONITOR 2347 int old_cwnd; 2348 2349 old_cwnd = net->cwnd; 2350 #endif 2351 SCTP_STAT_INCR(sctps_ecnereducedcwnd); 2352 net->ssthresh = net->cwnd / 2; 2353 if (net->ssthresh < net->mtu) { 2354 net->ssthresh = net->mtu; 2355 /* here back off the timer as well, to slow us down */ 2356 net->RTO <<= 2; 2357 } 2358 net->cwnd = net->ssthresh; 2359 #ifdef SCTP_CWND_MONITOR 2360 sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_SAT); 2361 #endif 2362 /* 2363 * we reduce once every RTT. So we will only lower cwnd at 2364 * the next sending seq i.e. the resync_tsn. 2365 */ 2366 stcb->asoc.last_cwr_tsn = stcb->asoc.nonce_resync_tsn; 2367 } 2368 /* 2369 * We always send a CWR this way if our previous one was lost our 2370 * peer will get an update, or if it is not time again to reduce we 2371 * still get the cwr to the peer. 2372 */ 2373 sctp_send_cwr(stcb, net, tsn); 2374 } 2375 2376 static void 2377 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb) 2378 { 2379 /* 2380 * Here we get a CWR from the peer. We must look in the outqueue and 2381 * make sure that we have a covered ECNE in teh control chunk part. 2382 * If so remove it. 2383 */ 2384 struct sctp_tmit_chunk *chk; 2385 struct sctp_ecne_chunk *ecne; 2386 2387 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 2388 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) { 2389 continue; 2390 } 2391 /* 2392 * Look for and remove if it is the right TSN. Since there 2393 * is only ONE ECNE on the control queue at any one time we 2394 * don't need to worry about more than one! 2395 */ 2396 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 2397 if (compare_with_wrap(ntohl(cp->tsn), ntohl(ecne->tsn), 2398 MAX_TSN) || (cp->tsn == ecne->tsn)) { 2399 /* this covers this ECNE, we can remove it */ 2400 stcb->asoc.ecn_echo_cnt_onq--; 2401 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, 2402 sctp_next); 2403 if (chk->data) { 2404 sctp_m_freem(chk->data); 2405 chk->data = NULL; 2406 } 2407 stcb->asoc.ctrl_queue_cnt--; 2408 sctp_free_remote_addr(chk->whoTo); 2409 sctp_free_a_chunk(stcb, chk); 2410 break; 2411 } 2412 } 2413 } 2414 2415 static void 2416 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp, 2417 struct sctp_tcb *stcb, struct sctp_nets *net) 2418 { 2419 struct sctp_association *asoc; 2420 2421 #ifdef SCTP_DEBUG 2422 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2423 printf("sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n"); 2424 } 2425 #endif 2426 if (stcb == NULL) 2427 return; 2428 2429 asoc = &stcb->asoc; 2430 /* process according to association state */ 2431 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) { 2432 /* unexpected SHUTDOWN-COMPLETE... so ignore... */ 2433 SCTP_TCB_UNLOCK(stcb); 2434 return; 2435 } 2436 /* notify upper layer protocol */ 2437 if (stcb->sctp_socket) { 2438 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 2439 /* are the queues empty? they should be */ 2440 if (!TAILQ_EMPTY(&asoc->send_queue) || 2441 !TAILQ_EMPTY(&asoc->sent_queue) || 2442 !TAILQ_EMPTY(&asoc->out_wheel)) { 2443 sctp_report_all_outbound(stcb, 0); 2444 } 2445 } 2446 /* stop the timer */ 2447 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_21); 2448 SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 2449 /* free the TCB */ 2450 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22); 2451 return; 2452 } 2453 2454 static int 2455 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc, 2456 struct sctp_nets *net, uint8_t flg) 2457 { 2458 switch (desc->chunk_type) { 2459 case SCTP_DATA: 2460 /* find the tsn to resend (possibly */ 2461 { 2462 uint32_t tsn; 2463 struct sctp_tmit_chunk *tp1; 2464 2465 tsn = ntohl(desc->tsn_ifany); 2466 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2467 while (tp1) { 2468 if (tp1->rec.data.TSN_seq == tsn) { 2469 /* found it */ 2470 break; 2471 } 2472 if (compare_with_wrap(tp1->rec.data.TSN_seq, tsn, 2473 MAX_TSN)) { 2474 /* not found */ 2475 tp1 = NULL; 2476 break; 2477 } 2478 tp1 = TAILQ_NEXT(tp1, sctp_next); 2479 } 2480 if (tp1 == NULL) { 2481 /* 2482 * Do it the other way , aka without paying 2483 * attention to queue seq order. 2484 */ 2485 SCTP_STAT_INCR(sctps_pdrpdnfnd); 2486 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2487 while (tp1) { 2488 if (tp1->rec.data.TSN_seq == tsn) { 2489 /* found it */ 2490 break; 2491 } 2492 tp1 = TAILQ_NEXT(tp1, sctp_next); 2493 } 2494 } 2495 if (tp1 == NULL) { 2496 SCTP_STAT_INCR(sctps_pdrptsnnf); 2497 } 2498 if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) { 2499 uint8_t *ddp; 2500 2501 if ((stcb->asoc.peers_rwnd == 0) && 2502 ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) { 2503 SCTP_STAT_INCR(sctps_pdrpdiwnp); 2504 return (0); 2505 } 2506 if (stcb->asoc.peers_rwnd == 0 && 2507 (flg & SCTP_FROM_MIDDLE_BOX)) { 2508 SCTP_STAT_INCR(sctps_pdrpdizrw); 2509 return (0); 2510 } 2511 ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+ 2512 sizeof(struct sctp_data_chunk)); 2513 { 2514 unsigned int iii; 2515 2516 for (iii = 0; iii < sizeof(desc->data_bytes); 2517 iii++) { 2518 if (ddp[iii] != desc->data_bytes[iii]) { 2519 SCTP_STAT_INCR(sctps_pdrpbadd); 2520 return (-1); 2521 } 2522 } 2523 } 2524 /* 2525 * We zero out the nonce so resync not 2526 * needed 2527 */ 2528 tp1->rec.data.ect_nonce = 0; 2529 2530 if (tp1->do_rtt) { 2531 /* 2532 * this guy had a RTO calculation 2533 * pending on it, cancel it 2534 */ 2535 tp1->whoTo->rto_pending = 0; 2536 tp1->do_rtt = 0; 2537 } 2538 SCTP_STAT_INCR(sctps_pdrpmark); 2539 if (tp1->sent != SCTP_DATAGRAM_RESEND) 2540 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2541 tp1->sent = SCTP_DATAGRAM_RESEND; 2542 /* 2543 * mark it as if we were doing a FR, since 2544 * we will be getting gap ack reports behind 2545 * the info from the router. 2546 */ 2547 tp1->rec.data.doing_fast_retransmit = 1; 2548 /* 2549 * mark the tsn with what sequences can 2550 * cause a new FR. 2551 */ 2552 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) { 2553 tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq; 2554 } else { 2555 tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq; 2556 } 2557 2558 /* restart the timer */ 2559 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2560 stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23); 2561 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2562 stcb, tp1->whoTo); 2563 2564 /* fix counts and things */ 2565 #ifdef SCTP_FLIGHT_LOGGING 2566 sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN, 2567 tp1->whoTo->flight_size, 2568 tp1->book_size, 2569 (uintptr_t) stcb, 2570 tp1->rec.data.TSN_seq); 2571 #endif 2572 if (tp1->whoTo->flight_size >= tp1->book_size) 2573 tp1->whoTo->flight_size -= tp1->book_size; 2574 else 2575 tp1->whoTo->flight_size = 0; 2576 2577 if (stcb->asoc.total_flight >= tp1->book_size) { 2578 stcb->asoc.total_flight -= tp1->book_size; 2579 if (stcb->asoc.total_flight_count > 0) 2580 stcb->asoc.total_flight_count--; 2581 } else { 2582 stcb->asoc.total_flight = 0; 2583 stcb->asoc.total_flight_count = 0; 2584 } 2585 tp1->snd_count--; 2586 } { 2587 /* audit code */ 2588 unsigned int audit; 2589 2590 audit = 0; 2591 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) { 2592 if (tp1->sent == SCTP_DATAGRAM_RESEND) 2593 audit++; 2594 } 2595 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue, 2596 sctp_next) { 2597 if (tp1->sent == SCTP_DATAGRAM_RESEND) 2598 audit++; 2599 } 2600 if (audit != stcb->asoc.sent_queue_retran_cnt) { 2601 printf("**Local Audit finds cnt:%d asoc cnt:%d\n", 2602 audit, stcb->asoc.sent_queue_retran_cnt); 2603 #ifndef SCTP_AUDITING_ENABLED 2604 stcb->asoc.sent_queue_retran_cnt = audit; 2605 #endif 2606 } 2607 } 2608 } 2609 break; 2610 case SCTP_ASCONF: 2611 { 2612 struct sctp_tmit_chunk *asconf; 2613 2614 TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue, 2615 sctp_next) { 2616 if (asconf->rec.chunk_id.id == SCTP_ASCONF) { 2617 break; 2618 } 2619 } 2620 if (asconf) { 2621 if (asconf->sent != SCTP_DATAGRAM_RESEND) 2622 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2623 asconf->sent = SCTP_DATAGRAM_RESEND; 2624 asconf->snd_count--; 2625 } 2626 } 2627 break; 2628 case SCTP_INITIATION: 2629 /* resend the INIT */ 2630 stcb->asoc.dropped_special_cnt++; 2631 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) { 2632 /* 2633 * If we can get it in, in a few attempts we do 2634 * this, otherwise we let the timer fire. 2635 */ 2636 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, 2637 stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24); 2638 sctp_send_initiate(stcb->sctp_ep, stcb); 2639 } 2640 break; 2641 case SCTP_SELECTIVE_ACK: 2642 /* resend the sack */ 2643 sctp_send_sack(stcb); 2644 break; 2645 case SCTP_HEARTBEAT_REQUEST: 2646 /* resend a demand HB */ 2647 sctp_send_hb(stcb, 1, net); 2648 break; 2649 case SCTP_SHUTDOWN: 2650 sctp_send_shutdown(stcb, net); 2651 break; 2652 case SCTP_SHUTDOWN_ACK: 2653 sctp_send_shutdown_ack(stcb, net); 2654 break; 2655 case SCTP_COOKIE_ECHO: 2656 { 2657 struct sctp_tmit_chunk *cookie; 2658 2659 cookie = NULL; 2660 TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue, 2661 sctp_next) { 2662 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 2663 break; 2664 } 2665 } 2666 if (cookie) { 2667 if (cookie->sent != SCTP_DATAGRAM_RESEND) 2668 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2669 cookie->sent = SCTP_DATAGRAM_RESEND; 2670 sctp_stop_all_cookie_timers(stcb); 2671 } 2672 } 2673 break; 2674 case SCTP_COOKIE_ACK: 2675 sctp_send_cookie_ack(stcb); 2676 break; 2677 case SCTP_ASCONF_ACK: 2678 /* resend last asconf ack */ 2679 sctp_send_asconf_ack(stcb, 1); 2680 break; 2681 case SCTP_FORWARD_CUM_TSN: 2682 send_forward_tsn(stcb, &stcb->asoc); 2683 break; 2684 /* can't do anything with these */ 2685 case SCTP_PACKET_DROPPED: 2686 case SCTP_INITIATION_ACK: /* this should not happen */ 2687 case SCTP_HEARTBEAT_ACK: 2688 case SCTP_ABORT_ASSOCIATION: 2689 case SCTP_OPERATION_ERROR: 2690 case SCTP_SHUTDOWN_COMPLETE: 2691 case SCTP_ECN_ECHO: 2692 case SCTP_ECN_CWR: 2693 default: 2694 break; 2695 } 2696 return (0); 2697 } 2698 2699 void 2700 sctp_reset_in_stream(struct sctp_tcb *stcb, int number_entries, uint16_t * list) 2701 { 2702 int i; 2703 uint16_t temp; 2704 2705 /* 2706 * We set things to 0xffff since this is the last delivered sequence 2707 * and we will be sending in 0 after the reset. 2708 */ 2709 2710 if (number_entries) { 2711 for (i = 0; i < number_entries; i++) { 2712 temp = ntohs(list[i]); 2713 if (temp >= stcb->asoc.streamincnt) { 2714 continue; 2715 } 2716 stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff; 2717 } 2718 } else { 2719 list = NULL; 2720 for (i = 0; i < stcb->asoc.streamincnt; i++) { 2721 stcb->asoc.strmin[i].last_sequence_delivered = 0xffff; 2722 } 2723 } 2724 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list); 2725 } 2726 2727 static void 2728 sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list) 2729 { 2730 int i; 2731 2732 if (number_entries == 0) { 2733 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 2734 stcb->asoc.strmout[i].next_sequence_sent = 0; 2735 } 2736 } else if (number_entries) { 2737 for (i = 0; i < number_entries; i++) { 2738 uint16_t temp; 2739 2740 temp = ntohs(list[i]); 2741 if (temp >= stcb->asoc.streamoutcnt) { 2742 /* no such stream */ 2743 continue; 2744 } 2745 stcb->asoc.strmout[temp].next_sequence_sent = 0; 2746 } 2747 } 2748 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list); 2749 } 2750 2751 2752 struct sctp_stream_reset_out_request * 2753 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk) 2754 { 2755 struct sctp_association *asoc; 2756 struct sctp_stream_reset_out_req *req; 2757 struct sctp_stream_reset_out_request *r; 2758 struct sctp_tmit_chunk *chk; 2759 int len, clen; 2760 2761 asoc = &stcb->asoc; 2762 if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 2763 return (NULL); 2764 } 2765 if (stcb->asoc.str_reset == NULL) { 2766 return (NULL); 2767 } 2768 chk = stcb->asoc.str_reset; 2769 if (chk->data == NULL) { 2770 return (NULL); 2771 } 2772 if (bchk) { 2773 /* he wants a copy of the chk pointer */ 2774 *bchk = chk; 2775 } 2776 clen = chk->send_size; 2777 req = mtod(chk->data, struct sctp_stream_reset_out_req *); 2778 r = &req->sr_req; 2779 if (ntohl(r->request_seq) == seq) { 2780 /* found it */ 2781 return (r); 2782 } 2783 len = SCTP_SIZE32(ntohs(r->ph.param_length)); 2784 if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) { 2785 /* move to the next one, there can only be a max of two */ 2786 r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len); 2787 if (ntohl(r->request_seq) == seq) { 2788 return (r); 2789 } 2790 } 2791 /* that seq is not here */ 2792 return (NULL); 2793 } 2794 2795 static void 2796 sctp_clean_up_stream_reset(struct sctp_tcb *stcb) 2797 { 2798 struct sctp_association *asoc; 2799 2800 asoc = &stcb->asoc; 2801 struct sctp_tmit_chunk *chk = stcb->asoc.str_reset; 2802 2803 if (stcb->asoc.str_reset == NULL) { 2804 return; 2805 } 2806 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25); 2807 TAILQ_REMOVE(&asoc->control_send_queue, 2808 chk, 2809 sctp_next); 2810 if (chk->data) { 2811 sctp_m_freem(chk->data); 2812 chk->data = NULL; 2813 } 2814 asoc->ctrl_queue_cnt--; 2815 sctp_free_remote_addr(chk->whoTo); 2816 2817 sctp_free_a_chunk(stcb, chk); 2818 stcb->asoc.str_reset = NULL; 2819 } 2820 2821 2822 static int 2823 sctp_handle_stream_reset_response(struct sctp_tcb *stcb, 2824 uint32_t seq, uint32_t action, 2825 struct sctp_stream_reset_response *respin) 2826 { 2827 uint16_t type; 2828 int lparm_len; 2829 struct sctp_association *asoc = &stcb->asoc; 2830 struct sctp_tmit_chunk *chk; 2831 struct sctp_stream_reset_out_request *srparam; 2832 int number_entries; 2833 2834 if (asoc->stream_reset_outstanding == 0) { 2835 /* duplicate */ 2836 return (0); 2837 } 2838 if (seq == stcb->asoc.str_reset_seq_out) { 2839 srparam = sctp_find_stream_reset(stcb, seq, &chk); 2840 if (srparam) { 2841 stcb->asoc.str_reset_seq_out++; 2842 type = ntohs(srparam->ph.param_type); 2843 lparm_len = ntohs(srparam->ph.param_length); 2844 if (type == SCTP_STR_RESET_OUT_REQUEST) { 2845 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t); 2846 asoc->stream_reset_out_is_outstanding = 0; 2847 if (asoc->stream_reset_outstanding) 2848 asoc->stream_reset_outstanding--; 2849 if (action == SCTP_STREAM_RESET_PERFORMED) { 2850 /* do it */ 2851 sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams); 2852 } else { 2853 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams); 2854 } 2855 } else if (type == SCTP_STR_RESET_IN_REQUEST) { 2856 /* Answered my request */ 2857 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t); 2858 if (asoc->stream_reset_outstanding) 2859 asoc->stream_reset_outstanding--; 2860 if (action != SCTP_STREAM_RESET_PERFORMED) { 2861 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, number_entries, srparam->list_of_streams); 2862 } 2863 } else if (type == SCTP_STR_RESET_TSN_REQUEST) { 2864 /** 2865 * a) Adopt the new in tsn. 2866 * b) reset the map 2867 * c) Adopt the new out-tsn 2868 */ 2869 struct sctp_stream_reset_response_tsn *resp; 2870 struct sctp_forward_tsn_chunk fwdtsn; 2871 int abort_flag = 0; 2872 2873 if (respin == NULL) { 2874 /* huh ? */ 2875 return (0); 2876 } 2877 if (action == SCTP_STREAM_RESET_PERFORMED) { 2878 resp = (struct sctp_stream_reset_response_tsn *)respin; 2879 asoc->stream_reset_outstanding--; 2880 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 2881 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 2882 fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1); 2883 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag); 2884 if (abort_flag) { 2885 return (1); 2886 } 2887 stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1); 2888 stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 2889 stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn); 2890 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 2891 stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn); 2892 stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn; 2893 2894 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL); 2895 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL); 2896 2897 } 2898 } 2899 /* get rid of the request and get the request flags */ 2900 if (asoc->stream_reset_outstanding == 0) { 2901 sctp_clean_up_stream_reset(stcb); 2902 } 2903 } 2904 } 2905 return (0); 2906 } 2907 2908 static void 2909 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb, 2910 struct sctp_tmit_chunk *chk, 2911 struct sctp_stream_reset_in_request *req) 2912 { 2913 uint32_t seq; 2914 int len, i; 2915 int number_entries; 2916 uint16_t temp; 2917 2918 /* 2919 * peer wants me to send a str-reset to him for my outgoing seq's if 2920 * seq_in is right. 2921 */ 2922 struct sctp_association *asoc = &stcb->asoc; 2923 2924 seq = ntohl(req->request_seq); 2925 if (asoc->str_reset_seq_in == seq) { 2926 if (stcb->asoc.stream_reset_out_is_outstanding == 0) { 2927 len = ntohs(req->ph.param_length); 2928 number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t)); 2929 for (i = 0; i < number_entries; i++) { 2930 temp = ntohs(req->list_of_streams[i]); 2931 req->list_of_streams[i] = temp; 2932 } 2933 /* move the reset action back one */ 2934 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 2935 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 2936 sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams, 2937 asoc->str_reset_seq_out, 2938 seq, (asoc->sending_seq - 1)); 2939 asoc->stream_reset_out_is_outstanding = 1; 2940 asoc->str_reset = chk; 2941 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 2942 stcb->asoc.stream_reset_outstanding++; 2943 } else { 2944 /* Can't do it, since we have sent one out */ 2945 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 2946 asoc->last_reset_action[0] = SCTP_STREAM_RESET_TRY_LATER; 2947 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 2948 } 2949 asoc->str_reset_seq_in++; 2950 } else if (asoc->str_reset_seq_in - 1 == seq) { 2951 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 2952 } else if (asoc->str_reset_seq_in - 2 == seq) { 2953 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 2954 } else { 2955 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 2956 } 2957 } 2958 2959 static int 2960 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb, 2961 struct sctp_tmit_chunk *chk, 2962 struct sctp_stream_reset_tsn_request *req) 2963 { 2964 /* reset all in and out and update the tsn */ 2965 /* 2966 * A) reset my str-seq's on in and out. B) Select a receive next, 2967 * and set cum-ack to it. Also process this selected number as a 2968 * fwd-tsn as well. C) set in the response my next sending seq. 2969 */ 2970 struct sctp_forward_tsn_chunk fwdtsn; 2971 struct sctp_association *asoc = &stcb->asoc; 2972 int abort_flag = 0; 2973 uint32_t seq; 2974 2975 seq = ntohl(req->request_seq); 2976 if (asoc->str_reset_seq_in == seq) { 2977 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 2978 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 2979 fwdtsn.ch.chunk_flags = 0; 2980 fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1); 2981 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag); 2982 if (abort_flag) { 2983 return (1); 2984 } 2985 stcb->asoc.highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA; 2986 stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 2987 stcb->asoc.mapping_array_base_tsn = stcb->asoc.highest_tsn_inside_map + 1; 2988 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 2989 atomic_add_int(&stcb->asoc.sending_seq, 1); 2990 /* save off historical data for retrans */ 2991 stcb->asoc.last_sending_seq[1] = stcb->asoc.last_sending_seq[0]; 2992 stcb->asoc.last_sending_seq[0] = stcb->asoc.sending_seq; 2993 stcb->asoc.last_base_tsnsent[1] = stcb->asoc.last_base_tsnsent[0]; 2994 stcb->asoc.last_base_tsnsent[0] = stcb->asoc.mapping_array_base_tsn; 2995 2996 sctp_add_stream_reset_result_tsn(chk, 2997 ntohl(req->request_seq), 2998 SCTP_STREAM_RESET_PERFORMED, 2999 stcb->asoc.sending_seq, 3000 stcb->asoc.mapping_array_base_tsn); 3001 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL); 3002 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL); 3003 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0]; 3004 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3005 3006 asoc->str_reset_seq_in++; 3007 } else if (asoc->str_reset_seq_in - 1 == seq) { 3008 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0], 3009 stcb->asoc.last_sending_seq[0], 3010 stcb->asoc.last_base_tsnsent[0] 3011 ); 3012 } else if (asoc->str_reset_seq_in - 2 == seq) { 3013 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1], 3014 stcb->asoc.last_sending_seq[1], 3015 stcb->asoc.last_base_tsnsent[1] 3016 ); 3017 } else { 3018 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 3019 } 3020 return (0); 3021 } 3022 3023 static void 3024 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb, 3025 struct sctp_tmit_chunk *chk, 3026 struct sctp_stream_reset_out_request *req) 3027 { 3028 uint32_t seq, tsn; 3029 int number_entries, len; 3030 struct sctp_association *asoc = &stcb->asoc; 3031 3032 seq = ntohl(req->request_seq); 3033 3034 /* now if its not a duplicate we process it */ 3035 if (asoc->str_reset_seq_in == seq) { 3036 len = ntohs(req->ph.param_length); 3037 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t)); 3038 /* 3039 * the sender is resetting, handle the list issue.. we must 3040 * a) verify if we can do the reset, if so no problem b) If 3041 * we can't do the reset we must copy the request. c) queue 3042 * it, and setup the data in processor to trigger it off 3043 * when needed and dequeue all the queued data. 3044 */ 3045 tsn = ntohl(req->send_reset_at_tsn); 3046 3047 /* move the reset action back one */ 3048 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 3049 if ((tsn == asoc->cumulative_tsn) || 3050 (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN))) { 3051 /* we can do it now */ 3052 sctp_reset_in_stream(stcb, number_entries, req->list_of_streams); 3053 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED); 3054 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3055 } else { 3056 /* 3057 * we must queue it up and thus wait for the TSN's 3058 * to arrive that are at or before tsn 3059 */ 3060 struct sctp_stream_reset_list *liste; 3061 int siz; 3062 3063 siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t)); 3064 SCTP_MALLOC(liste, struct sctp_stream_reset_list *, 3065 siz, "StrRstList"); 3066 if (liste == NULL) { 3067 /* gak out of memory */ 3068 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED); 3069 asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED; 3070 return; 3071 } 3072 liste->tsn = tsn; 3073 liste->number_entries = number_entries; 3074 memcpy(&liste->req, req, 3075 (sizeof(struct sctp_stream_reset_out_request) + (number_entries * sizeof(uint16_t)))); 3076 TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp); 3077 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED); 3078 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3079 } 3080 asoc->str_reset_seq_in++; 3081 } else if ((asoc->str_reset_seq_in - 1) == seq) { 3082 /* 3083 * one seq back, just echo back last action since my 3084 * response was lost. 3085 */ 3086 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3087 } else if ((asoc->str_reset_seq_in - 2) == seq) { 3088 /* 3089 * two seq back, just echo back last action since my 3090 * response was lost. 3091 */ 3092 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 3093 } else { 3094 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 3095 } 3096 } 3097 3098 static int 3099 sctp_handle_stream_reset(struct sctp_tcb *stcb, struct sctp_stream_reset_out_req *sr_req) 3100 { 3101 int chk_length, param_len, ptype; 3102 uint32_t seq; 3103 int num_req = 0; 3104 struct sctp_tmit_chunk *chk; 3105 struct sctp_chunkhdr *ch; 3106 struct sctp_paramhdr *ph; 3107 3108 /* now it may be a reset or a reset-response */ 3109 chk_length = ntohs(sr_req->ch.chunk_length); 3110 int ret_code = 0; 3111 int num_param = 0; 3112 3113 /* setup for adding the response */ 3114 sctp_alloc_a_chunk(stcb, chk); 3115 if (chk == NULL) { 3116 return (ret_code); 3117 } 3118 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 3119 chk->asoc = &stcb->asoc; 3120 chk->no_fr_allowed = 0; 3121 chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr); 3122 chk->book_size_scale = 0; 3123 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 3124 if (chk->data == NULL) { 3125 strres_nochunk: 3126 if (chk->data) { 3127 sctp_m_freem(chk->data); 3128 chk->data = NULL; 3129 } 3130 sctp_free_a_chunk(stcb, chk); 3131 return (ret_code); 3132 } 3133 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 3134 3135 /* setup chunk parameters */ 3136 chk->sent = SCTP_DATAGRAM_UNSENT; 3137 chk->snd_count = 0; 3138 chk->whoTo = stcb->asoc.primary_destination; 3139 atomic_add_int(&chk->whoTo->ref_count, 1); 3140 3141 ch = mtod(chk->data, struct sctp_chunkhdr *); 3142 ch->chunk_type = SCTP_STREAM_RESET; 3143 ch->chunk_flags = 0; 3144 ch->chunk_length = htons(chk->send_size); 3145 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 3146 3147 3148 ph = (struct sctp_paramhdr *)&sr_req->sr_req; 3149 while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) { 3150 param_len = ntohs(ph->param_length); 3151 if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) { 3152 /* bad param */ 3153 break; 3154 } 3155 ptype = ntohs(ph->param_type); 3156 num_param++; 3157 if (num_param > SCTP_MAX_RESET_PARAMS) { 3158 /* hit the max of parameters already sorry.. */ 3159 break; 3160 } 3161 if (ptype == SCTP_STR_RESET_OUT_REQUEST) { 3162 struct sctp_stream_reset_out_request *req_out; 3163 3164 req_out = (struct sctp_stream_reset_out_request *)ph; 3165 num_req++; 3166 if (stcb->asoc.stream_reset_outstanding) { 3167 seq = ntohl(req_out->response_seq); 3168 if (seq == stcb->asoc.str_reset_seq_out) { 3169 /* implicit ack */ 3170 sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_PERFORMED, NULL); 3171 } 3172 } 3173 sctp_handle_str_reset_request_out(stcb, chk, req_out); 3174 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) { 3175 struct sctp_stream_reset_in_request *req_in; 3176 3177 num_req++; 3178 req_in = (struct sctp_stream_reset_in_request *)ph; 3179 sctp_handle_str_reset_request_in(stcb, chk, req_in); 3180 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) { 3181 struct sctp_stream_reset_tsn_request *req_tsn; 3182 3183 num_req++; 3184 req_tsn = (struct sctp_stream_reset_tsn_request *)ph; 3185 if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) { 3186 ret_code = 1; 3187 goto strres_nochunk; 3188 } 3189 /* no more */ 3190 break; 3191 } else if (ptype == SCTP_STR_RESET_RESPONSE) { 3192 struct sctp_stream_reset_response *resp; 3193 uint32_t result; 3194 3195 resp = (struct sctp_stream_reset_response *)ph; 3196 seq = ntohl(resp->response_seq); 3197 result = ntohl(resp->result); 3198 if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) { 3199 ret_code = 1; 3200 goto strres_nochunk; 3201 } 3202 } else { 3203 break; 3204 } 3205 3206 ph = (struct sctp_paramhdr *)((caddr_t)ph + SCTP_SIZE32(param_len)); 3207 chk_length -= SCTP_SIZE32(param_len); 3208 } 3209 if (num_req == 0) { 3210 /* we have no response free the stuff */ 3211 goto strres_nochunk; 3212 } 3213 /* ok we have a chunk to link in */ 3214 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, 3215 chk, 3216 sctp_next); 3217 stcb->asoc.ctrl_queue_cnt++; 3218 return (ret_code); 3219 } 3220 3221 /* 3222 * Handle a router or endpoints report of a packet loss, there are two ways 3223 * to handle this, either we get the whole packet and must disect it 3224 * ourselves (possibly with truncation and or corruption) or it is a summary 3225 * from a middle box that did the disectting for us. 3226 */ 3227 static void 3228 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp, 3229 struct sctp_tcb *stcb, struct sctp_nets *net) 3230 { 3231 uint32_t bottle_bw, on_queue; 3232 uint16_t trunc_len; 3233 unsigned int chlen; 3234 unsigned int at; 3235 struct sctp_chunk_desc desc; 3236 struct sctp_chunkhdr *ch; 3237 3238 chlen = ntohs(cp->ch.chunk_length); 3239 chlen -= sizeof(struct sctp_pktdrop_chunk); 3240 /* XXX possible chlen underflow */ 3241 if (chlen == 0) { 3242 ch = NULL; 3243 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) 3244 SCTP_STAT_INCR(sctps_pdrpbwrpt); 3245 } else { 3246 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr)); 3247 chlen -= sizeof(struct sctphdr); 3248 /* XXX possible chlen underflow */ 3249 memset(&desc, 0, sizeof(desc)); 3250 } 3251 trunc_len = (uint16_t) ntohs(cp->trunc_len); 3252 /* now the chunks themselves */ 3253 while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) { 3254 desc.chunk_type = ch->chunk_type; 3255 /* get amount we need to move */ 3256 at = ntohs(ch->chunk_length); 3257 if (at < sizeof(struct sctp_chunkhdr)) { 3258 /* corrupt chunk, maybe at the end? */ 3259 SCTP_STAT_INCR(sctps_pdrpcrupt); 3260 break; 3261 } 3262 if (trunc_len == 0) { 3263 /* we are supposed to have all of it */ 3264 if (at > chlen) { 3265 /* corrupt skip it */ 3266 SCTP_STAT_INCR(sctps_pdrpcrupt); 3267 break; 3268 } 3269 } else { 3270 /* is there enough of it left ? */ 3271 if (desc.chunk_type == SCTP_DATA) { 3272 if (chlen < (sizeof(struct sctp_data_chunk) + 3273 sizeof(desc.data_bytes))) { 3274 break; 3275 } 3276 } else { 3277 if (chlen < sizeof(struct sctp_chunkhdr)) { 3278 break; 3279 } 3280 } 3281 } 3282 if (desc.chunk_type == SCTP_DATA) { 3283 /* can we get out the tsn? */ 3284 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 3285 SCTP_STAT_INCR(sctps_pdrpmbda); 3286 3287 if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) { 3288 /* yep */ 3289 struct sctp_data_chunk *dcp; 3290 uint8_t *ddp; 3291 unsigned int iii; 3292 3293 dcp = (struct sctp_data_chunk *)ch; 3294 ddp = (uint8_t *) (dcp + 1); 3295 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) { 3296 desc.data_bytes[iii] = ddp[iii]; 3297 } 3298 desc.tsn_ifany = dcp->dp.tsn; 3299 } else { 3300 /* nope we are done. */ 3301 SCTP_STAT_INCR(sctps_pdrpnedat); 3302 break; 3303 } 3304 } else { 3305 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 3306 SCTP_STAT_INCR(sctps_pdrpmbct); 3307 } 3308 3309 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) { 3310 SCTP_STAT_INCR(sctps_pdrppdbrk); 3311 break; 3312 } 3313 if (SCTP_SIZE32(at) > chlen) { 3314 break; 3315 } 3316 chlen -= SCTP_SIZE32(at); 3317 if (chlen < sizeof(struct sctp_chunkhdr)) { 3318 /* done, none left */ 3319 break; 3320 } 3321 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at)); 3322 } 3323 /* Now update any rwnd --- possibly */ 3324 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) { 3325 /* From a peer, we get a rwnd report */ 3326 uint32_t a_rwnd; 3327 3328 SCTP_STAT_INCR(sctps_pdrpfehos); 3329 3330 bottle_bw = ntohl(cp->bottle_bw); 3331 on_queue = ntohl(cp->current_onq); 3332 if (bottle_bw && on_queue) { 3333 /* a rwnd report is in here */ 3334 if (bottle_bw > on_queue) 3335 a_rwnd = bottle_bw - on_queue; 3336 else 3337 a_rwnd = 0; 3338 3339 if (a_rwnd == 0) 3340 stcb->asoc.peers_rwnd = 0; 3341 else { 3342 if (a_rwnd > stcb->asoc.total_flight) { 3343 stcb->asoc.peers_rwnd = 3344 a_rwnd - stcb->asoc.total_flight; 3345 } else { 3346 stcb->asoc.peers_rwnd = 0; 3347 } 3348 if (stcb->asoc.peers_rwnd < 3349 stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 3350 /* SWS sender side engages */ 3351 stcb->asoc.peers_rwnd = 0; 3352 } 3353 } 3354 } 3355 } else { 3356 SCTP_STAT_INCR(sctps_pdrpfmbox); 3357 } 3358 3359 /* now middle boxes in sat networks get a cwnd bump */ 3360 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) && 3361 (stcb->asoc.sat_t3_loss_recovery == 0) && 3362 (stcb->asoc.sat_network)) { 3363 /* 3364 * This is debateable but for sat networks it makes sense 3365 * Note if a T3 timer has went off, we will prohibit any 3366 * changes to cwnd until we exit the t3 loss recovery. 3367 */ 3368 uint32_t bw_avail; 3369 int rtt, incr; 3370 3371 #ifdef SCTP_CWND_MONITOR 3372 int old_cwnd = net->cwnd; 3373 3374 #endif 3375 /* need real RTT for this calc */ 3376 rtt = ((net->lastsa >> 2) + net->lastsv) >> 1; 3377 /* get bottle neck bw */ 3378 bottle_bw = ntohl(cp->bottle_bw); 3379 /* and whats on queue */ 3380 on_queue = ntohl(cp->current_onq); 3381 /* 3382 * adjust the on-queue if our flight is more it could be 3383 * that the router has not yet gotten data "in-flight" to it 3384 */ 3385 if (on_queue < net->flight_size) 3386 on_queue = net->flight_size; 3387 3388 /* calculate the available space */ 3389 bw_avail = (bottle_bw * rtt) / 1000; 3390 if (bw_avail > bottle_bw) { 3391 /* 3392 * Cap the growth to no more than the bottle neck. 3393 * This can happen as RTT slides up due to queues. 3394 * It also means if you have more than a 1 second 3395 * RTT with a empty queue you will be limited to the 3396 * bottle_bw per second no matter if other points 3397 * have 1/2 the RTT and you could get more out... 3398 */ 3399 bw_avail = bottle_bw; 3400 } 3401 if (on_queue > bw_avail) { 3402 /* 3403 * No room for anything else don't allow anything 3404 * else to be "added to the fire". 3405 */ 3406 int seg_inflight, seg_onqueue, my_portion; 3407 3408 net->partial_bytes_acked = 0; 3409 3410 /* how much are we over queue size? */ 3411 incr = on_queue - bw_avail; 3412 if (stcb->asoc.seen_a_sack_this_pkt) { 3413 /* 3414 * undo any cwnd adjustment that the sack 3415 * might have made 3416 */ 3417 net->cwnd = net->prev_cwnd; 3418 } 3419 /* Now how much of that is mine? */ 3420 seg_inflight = net->flight_size / net->mtu; 3421 seg_onqueue = on_queue / net->mtu; 3422 my_portion = (incr * seg_inflight) / seg_onqueue; 3423 3424 /* Have I made an adjustment already */ 3425 if (net->cwnd > net->flight_size) { 3426 /* 3427 * for this flight I made an adjustment we 3428 * need to decrease the portion by a share 3429 * our previous adjustment. 3430 */ 3431 int diff_adj; 3432 3433 diff_adj = net->cwnd - net->flight_size; 3434 if (diff_adj > my_portion) 3435 my_portion = 0; 3436 else 3437 my_portion -= diff_adj; 3438 } 3439 /* 3440 * back down to the previous cwnd (assume we have 3441 * had a sack before this packet). minus what ever 3442 * portion of the overage is my fault. 3443 */ 3444 net->cwnd -= my_portion; 3445 3446 /* we will NOT back down more than 1 MTU */ 3447 if (net->cwnd <= net->mtu) { 3448 net->cwnd = net->mtu; 3449 } 3450 /* force into CA */ 3451 net->ssthresh = net->cwnd - 1; 3452 } else { 3453 /* 3454 * Take 1/4 of the space left or max burst up .. 3455 * whichever is less. 3456 */ 3457 incr = min((bw_avail - on_queue) >> 2, 3458 (int)stcb->asoc.max_burst * (int)net->mtu); 3459 net->cwnd += incr; 3460 } 3461 if (net->cwnd > bw_avail) { 3462 /* We can't exceed the pipe size */ 3463 net->cwnd = bw_avail; 3464 } 3465 if (net->cwnd < net->mtu) { 3466 /* We always have 1 MTU */ 3467 net->cwnd = net->mtu; 3468 } 3469 #ifdef SCTP_CWND_MONITOR 3470 if (net->cwnd - old_cwnd != 0) { 3471 /* log only changes */ 3472 sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), 3473 SCTP_CWND_LOG_FROM_SAT); 3474 } 3475 #endif 3476 } 3477 } 3478 3479 extern int sctp_strict_init; 3480 extern int sctp_abort_if_one_2_one_hits_limit; 3481 3482 /* 3483 * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to 3484 * still contain IP/SCTP header - stcb: is the tcb found for this packet - 3485 * offset: offset into the mbuf chain to first chunkhdr - length: is the 3486 * length of the complete packet outputs: - length: modified to remaining 3487 * length after control processing - netp: modified to new sctp_nets after 3488 * cookie-echo processing - return NULL to discard the packet (ie. no asoc, 3489 * bad packet,...) otherwise return the tcb for this packet 3490 */ 3491 static struct sctp_tcb * 3492 sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length, 3493 struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp, 3494 struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen) 3495 { 3496 struct sctp_association *asoc; 3497 uint32_t vtag_in; 3498 int num_chunks = 0; /* number of control chunks processed */ 3499 int chk_length; 3500 int ret; 3501 3502 /* 3503 * How big should this be, and should it be alloc'd? Lets try the 3504 * d-mtu-ceiling for now (2k) and that should hopefully work ... 3505 * until we get into jumbo grams and such.. 3506 */ 3507 uint8_t chunk_buf[DEFAULT_CHUNK_BUFFER]; 3508 struct sctp_tcb *locked_tcb = stcb; 3509 int got_auth = 0; 3510 uint32_t auth_offset = 0, auth_len = 0; 3511 int auth_skipped = 0; 3512 3513 #ifdef SCTP_DEBUG 3514 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 3515 printf("sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n", 3516 iphlen, *offset, length, stcb); 3517 } 3518 #endif /* SCTP_DEBUG */ 3519 3520 /* validate chunk header length... */ 3521 if (ntohs(ch->chunk_length) < sizeof(*ch)) { 3522 return (NULL); 3523 } 3524 /* 3525 * validate the verification tag 3526 */ 3527 vtag_in = ntohl(sh->v_tag); 3528 3529 if (locked_tcb) { 3530 SCTP_TCB_LOCK_ASSERT(locked_tcb); 3531 } 3532 if (ch->chunk_type == SCTP_INITIATION) { 3533 if (vtag_in != 0) { 3534 /* protocol error- silently discard... */ 3535 SCTP_STAT_INCR(sctps_badvtag); 3536 if (locked_tcb) 3537 SCTP_TCB_UNLOCK(locked_tcb); 3538 return (NULL); 3539 } 3540 } else if (ch->chunk_type != SCTP_COOKIE_ECHO) { 3541 /* 3542 * If there is no stcb, skip the AUTH chunk and process 3543 * later after a stcb is found (to validate the lookup was 3544 * valid. 3545 */ 3546 if ((ch->chunk_type == SCTP_AUTHENTICATION) && 3547 (stcb == NULL) && !sctp_auth_disable) { 3548 /* save this chunk for later processing */ 3549 auth_skipped = 1; 3550 auth_offset = *offset; 3551 auth_len = ntohs(ch->chunk_length); 3552 3553 /* (temporarily) move past this chunk */ 3554 *offset += SCTP_SIZE32(auth_len); 3555 if (*offset >= length) { 3556 /* no more data left in the mbuf chain */ 3557 *offset = length; 3558 return (NULL); 3559 } 3560 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3561 sizeof(struct sctp_chunkhdr), chunk_buf); 3562 } 3563 if (ch->chunk_type == SCTP_COOKIE_ECHO) { 3564 goto process_control_chunks; 3565 } 3566 /* 3567 * first check if it's an ASCONF with an unknown src addr we 3568 * need to look inside to find the association 3569 */ 3570 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) { 3571 /* inp's refcount may be reduced */ 3572 SCTP_INP_INCR_REF(inp); 3573 3574 stcb = sctp_findassociation_ep_asconf(m, iphlen, 3575 *offset, sh, &inp, netp); 3576 if (stcb == NULL) { 3577 /* 3578 * reduce inp's refcount if not reduced in 3579 * sctp_findassociation_ep_asconf(). 3580 */ 3581 SCTP_INP_DECR_REF(inp); 3582 } 3583 /* now go back and verify any auth chunk to be sure */ 3584 if (auth_skipped && (stcb != NULL)) { 3585 struct sctp_auth_chunk *auth; 3586 3587 auth = (struct sctp_auth_chunk *) 3588 sctp_m_getptr(m, auth_offset, 3589 auth_len, chunk_buf); 3590 got_auth = 1; 3591 auth_skipped = 0; 3592 if (sctp_handle_auth(stcb, auth, m, 3593 auth_offset)) { 3594 /* auth HMAC failed so dump it */ 3595 *offset = length; 3596 return (NULL); 3597 } else { 3598 /* remaining chunks are HMAC checked */ 3599 stcb->asoc.authenticated = 1; 3600 } 3601 } 3602 } 3603 if (stcb == NULL) { 3604 /* no association, so it's out of the blue... */ 3605 sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL); 3606 *offset = length; 3607 if (locked_tcb) 3608 SCTP_TCB_UNLOCK(locked_tcb); 3609 return (NULL); 3610 } 3611 asoc = &stcb->asoc; 3612 /* ABORT and SHUTDOWN can use either v_tag... */ 3613 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) || 3614 (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) || 3615 (ch->chunk_type == SCTP_PACKET_DROPPED)) { 3616 if ((vtag_in == asoc->my_vtag) || 3617 ((ch->chunk_flags & SCTP_HAD_NO_TCB) && 3618 (vtag_in == asoc->peer_vtag))) { 3619 /* this is valid */ 3620 } else { 3621 /* drop this packet... */ 3622 SCTP_STAT_INCR(sctps_badvtag); 3623 if (locked_tcb) 3624 SCTP_TCB_UNLOCK(locked_tcb); 3625 return (NULL); 3626 } 3627 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 3628 if (vtag_in != asoc->my_vtag) { 3629 /* 3630 * this could be a stale SHUTDOWN-ACK or the 3631 * peer never got the SHUTDOWN-COMPLETE and 3632 * is still hung; we have started a new asoc 3633 * but it won't complete until the shutdown 3634 * is completed 3635 */ 3636 if (locked_tcb) 3637 SCTP_TCB_UNLOCK(locked_tcb); 3638 sctp_handle_ootb(m, iphlen, *offset, sh, inp, 3639 NULL); 3640 return (NULL); 3641 } 3642 } else { 3643 /* for all other chunks, vtag must match */ 3644 if (vtag_in != asoc->my_vtag) { 3645 /* invalid vtag... */ 3646 #ifdef SCTP_DEBUG 3647 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3648 printf("invalid vtag: %xh, expect %xh\n", vtag_in, asoc->my_vtag); 3649 } 3650 #endif /* SCTP_DEBUG */ 3651 SCTP_STAT_INCR(sctps_badvtag); 3652 if (locked_tcb) 3653 SCTP_TCB_UNLOCK(locked_tcb); 3654 *offset = length; 3655 return (NULL); 3656 } 3657 } 3658 } /* end if !SCTP_COOKIE_ECHO */ 3659 /* 3660 * process all control chunks... 3661 */ 3662 if (((ch->chunk_type == SCTP_SELECTIVE_ACK) || 3663 (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) && 3664 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 3665 /* implied cookie-ack.. we must have lost the ack */ 3666 stcb->asoc.overall_error_count = 0; 3667 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, 3668 *netp); 3669 } 3670 process_control_chunks: 3671 3672 while (IS_SCTP_CONTROL(ch)) { 3673 /* validate chunk length */ 3674 chk_length = ntohs(ch->chunk_length); 3675 #ifdef SCTP_DEBUG 3676 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 3677 printf("sctp_process_control: processing a chunk type=%u, len=%u\n", 3678 ch->chunk_type, chk_length); 3679 } 3680 #endif /* SCTP_DEBUG */ 3681 if ((size_t)chk_length < sizeof(*ch) || 3682 (*offset + chk_length) > length) { 3683 *offset = length; 3684 if (locked_tcb) 3685 SCTP_TCB_UNLOCK(locked_tcb); 3686 return (NULL); 3687 } 3688 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks); 3689 /* 3690 * INIT-ACK only gets the init ack "header" portion only 3691 * because we don't have to process the peer's COOKIE. All 3692 * others get a complete chunk. 3693 */ 3694 if (ch->chunk_type == SCTP_INITIATION_ACK) { 3695 /* get an init-ack chunk */ 3696 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3697 sizeof(struct sctp_init_ack_chunk), chunk_buf); 3698 if (ch == NULL) { 3699 *offset = length; 3700 if (locked_tcb) 3701 SCTP_TCB_UNLOCK(locked_tcb); 3702 return (NULL); 3703 } 3704 } else { 3705 /* get a complete chunk... */ 3706 if ((size_t)chk_length > sizeof(chunk_buf)) { 3707 struct mbuf *oper; 3708 struct sctp_paramhdr *phdr; 3709 3710 oper = NULL; 3711 oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 3712 0, M_DONTWAIT, 1, MT_DATA); 3713 if (oper) { 3714 /* pre-reserve some space */ 3715 SCTP_BUF_RESV_UF(oper, sizeof(struct sctp_chunkhdr)); 3716 SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr); 3717 phdr = mtod(oper, struct sctp_paramhdr *); 3718 phdr->param_type = htons(SCTP_CAUSE_OUT_OF_RESC); 3719 phdr->param_length = htons(sizeof(struct sctp_paramhdr)); 3720 sctp_queue_op_err(stcb, oper); 3721 } 3722 if (locked_tcb) 3723 SCTP_TCB_UNLOCK(locked_tcb); 3724 return (NULL); 3725 } 3726 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3727 chk_length, chunk_buf); 3728 if (ch == NULL) { 3729 printf("sctp_process_control: Can't get the all data....\n"); 3730 *offset = length; 3731 if (locked_tcb) 3732 SCTP_TCB_UNLOCK(locked_tcb); 3733 return (NULL); 3734 } 3735 } 3736 num_chunks++; 3737 /* Save off the last place we got a control from */ 3738 if (stcb != NULL) { 3739 if ((*netp != NULL) || (ch->chunk_type == SCTP_ASCONF)) { 3740 /* 3741 * allow last_control to be NULL if 3742 * ASCONF... ASCONF processing will find the 3743 * right net later 3744 */ 3745 stcb->asoc.last_control_chunk_from = *netp; 3746 } 3747 } 3748 #ifdef SCTP_AUDITING_ENABLED 3749 sctp_audit_log(0xB0, ch->chunk_type); 3750 #endif 3751 3752 /* check to see if this chunk required auth, but isn't */ 3753 if ((stcb != NULL) && !sctp_auth_disable && 3754 sctp_auth_is_required_chunk(ch->chunk_type, 3755 stcb->asoc.local_auth_chunks) && 3756 !stcb->asoc.authenticated) { 3757 /* "silently" ignore */ 3758 SCTP_STAT_INCR(sctps_recvauthmissing); 3759 goto next_chunk; 3760 } 3761 switch (ch->chunk_type) { 3762 case SCTP_INITIATION: 3763 /* must be first and only chunk */ 3764 #ifdef SCTP_DEBUG 3765 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3766 printf("SCTP_INIT\n"); 3767 } 3768 #endif /* SCTP_DEBUG */ 3769 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3770 /* We are not interested anymore? */ 3771 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3772 /* 3773 * collision case where we are 3774 * sending to them too 3775 */ 3776 ; 3777 } else { 3778 if (locked_tcb) 3779 SCTP_TCB_UNLOCK(locked_tcb); 3780 *offset = length; 3781 return (NULL); 3782 } 3783 } 3784 if ((num_chunks > 1) || 3785 (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3786 *offset = length; 3787 if (locked_tcb) 3788 SCTP_TCB_UNLOCK(locked_tcb); 3789 return (NULL); 3790 } 3791 if ((stcb != NULL) && 3792 (SCTP_GET_STATE(&stcb->asoc) == 3793 SCTP_STATE_SHUTDOWN_ACK_SENT)) { 3794 sctp_send_shutdown_ack(stcb, 3795 stcb->asoc.primary_destination); 3796 *offset = length; 3797 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 3798 if (locked_tcb) 3799 SCTP_TCB_UNLOCK(locked_tcb); 3800 return (NULL); 3801 } 3802 sctp_handle_init(m, iphlen, *offset, sh, 3803 (struct sctp_init_chunk *)ch, inp, stcb, *netp); 3804 *offset = length; 3805 if (locked_tcb) 3806 SCTP_TCB_UNLOCK(locked_tcb); 3807 return (NULL); 3808 break; 3809 case SCTP_INITIATION_ACK: 3810 /* must be first and only chunk */ 3811 #ifdef SCTP_DEBUG 3812 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3813 printf("SCTP_INIT-ACK\n"); 3814 } 3815 #endif /* SCTP_DEBUG */ 3816 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3817 /* We are not interested anymore */ 3818 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3819 ; 3820 } else { 3821 if (locked_tcb) 3822 SCTP_TCB_UNLOCK(locked_tcb); 3823 *offset = length; 3824 if (stcb) { 3825 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26); 3826 } 3827 return (NULL); 3828 } 3829 } 3830 if ((num_chunks > 1) || 3831 (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3832 *offset = length; 3833 if (locked_tcb) 3834 SCTP_TCB_UNLOCK(locked_tcb); 3835 return (NULL); 3836 } 3837 ret = sctp_handle_init_ack(m, iphlen, *offset, sh, 3838 (struct sctp_init_ack_chunk *)ch, stcb, *netp); 3839 /* 3840 * Special case, I must call the output routine to 3841 * get the cookie echoed 3842 */ 3843 if ((stcb) && ret == 0) 3844 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 3845 *offset = length; 3846 if (locked_tcb) 3847 SCTP_TCB_UNLOCK(locked_tcb); 3848 return (NULL); 3849 break; 3850 case SCTP_SELECTIVE_ACK: 3851 #ifdef SCTP_DEBUG 3852 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3853 printf("SCTP_SACK\n"); 3854 } 3855 #endif /* SCTP_DEBUG */ 3856 SCTP_STAT_INCR(sctps_recvsacks); 3857 { 3858 struct sctp_sack_chunk *sack; 3859 int abort_now = 0; 3860 uint32_t a_rwnd, cum_ack; 3861 uint16_t num_seg; 3862 int nonce_sum_flag; 3863 3864 sack = (struct sctp_sack_chunk *)ch; 3865 3866 nonce_sum_flag = ch->chunk_flags & SCTP_SACK_NONCE_SUM; 3867 cum_ack = ntohl(sack->sack.cum_tsn_ack); 3868 num_seg = ntohs(sack->sack.num_gap_ack_blks); 3869 a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd); 3870 stcb->asoc.seen_a_sack_this_pkt = 1; 3871 if ((stcb->asoc.pr_sctp_cnt == 0) && 3872 (num_seg == 0) && 3873 ((compare_with_wrap(cum_ack, stcb->asoc.last_acked_seq, MAX_TSN)) || 3874 (cum_ack == stcb->asoc.last_acked_seq)) && 3875 (stcb->asoc.saw_sack_with_frags == 0) && 3876 (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) 3877 ) { 3878 /* 3879 * We have a SIMPLE sack having no 3880 * prior segments and data on sent 3881 * queue to be acked.. Use the 3882 * faster path sack processing. We 3883 * also allow window update sacks 3884 * with no missing segments to go 3885 * this way too. 3886 */ 3887 sctp_express_handle_sack(stcb, cum_ack, a_rwnd, nonce_sum_flag, &abort_now); 3888 } else { 3889 sctp_handle_sack(sack, stcb, *netp, &abort_now); 3890 } 3891 if (abort_now) { 3892 /* ABORT signal from sack processing */ 3893 *offset = length; 3894 return (NULL); 3895 } 3896 } 3897 break; 3898 case SCTP_HEARTBEAT_REQUEST: 3899 #ifdef SCTP_DEBUG 3900 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3901 printf("SCTP_HEARTBEAT\n"); 3902 } 3903 #endif /* SCTP_DEBUG */ 3904 SCTP_STAT_INCR(sctps_recvheartbeat); 3905 sctp_send_heartbeat_ack(stcb, m, *offset, chk_length, 3906 *netp); 3907 3908 /* He's alive so give him credit */ 3909 stcb->asoc.overall_error_count = 0; 3910 break; 3911 case SCTP_HEARTBEAT_ACK: 3912 #ifdef SCTP_DEBUG 3913 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3914 printf("SCTP_HEARTBEAT-ACK\n"); 3915 } 3916 #endif /* SCTP_DEBUG */ 3917 3918 /* He's alive so give him credit */ 3919 stcb->asoc.overall_error_count = 0; 3920 SCTP_STAT_INCR(sctps_recvheartbeatack); 3921 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch, 3922 stcb, *netp); 3923 break; 3924 case SCTP_ABORT_ASSOCIATION: 3925 #ifdef SCTP_DEBUG 3926 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3927 printf("SCTP_ABORT\n"); 3928 } 3929 #endif /* SCTP_DEBUG */ 3930 sctp_handle_abort((struct sctp_abort_chunk *)ch, 3931 stcb, *netp); 3932 *offset = length; 3933 return (NULL); 3934 break; 3935 case SCTP_SHUTDOWN: 3936 #ifdef SCTP_DEBUG 3937 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3938 printf("SCTP_SHUTDOWN\n"); 3939 } 3940 #endif /* SCTP_DEBUG */ 3941 { 3942 int abort_flag = 0; 3943 3944 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch, 3945 stcb, *netp, &abort_flag); 3946 if (abort_flag) { 3947 *offset = length; 3948 return (NULL); 3949 } 3950 } 3951 break; 3952 case SCTP_SHUTDOWN_ACK: 3953 #ifdef SCTP_DEBUG 3954 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3955 printf("SCTP_SHUTDOWN-ACK\n"); 3956 } 3957 #endif /* SCTP_DEBUG */ 3958 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp); 3959 *offset = length; 3960 return (NULL); 3961 break; 3962 case SCTP_OPERATION_ERROR: 3963 #ifdef SCTP_DEBUG 3964 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3965 printf("SCTP_OP-ERR\n"); 3966 } 3967 #endif /* SCTP_DEBUG */ 3968 if (sctp_handle_error(ch, stcb, *netp) < 0) { 3969 *offset = length; 3970 return (NULL); 3971 } 3972 break; 3973 case SCTP_COOKIE_ECHO: 3974 #ifdef SCTP_DEBUG 3975 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3976 printf("SCTP_COOKIE-ECHO stcb is %p\n", stcb); 3977 } 3978 #endif /* SCTP_DEBUG */ 3979 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3980 ; 3981 } else { 3982 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) && 3983 (stcb == NULL)) { 3984 /* We are not interested anymore */ 3985 *offset = length; 3986 return (NULL); 3987 } 3988 } 3989 /* 3990 * First are we accepting? We do this again here 3991 * since it is possible that a previous endpoint WAS 3992 * listening responded to a INIT-ACK and then 3993 * closed. We opened and bound.. and are now no 3994 * longer listening. 3995 */ 3996 if (inp->sctp_socket->so_qlimit == 0) { 3997 if ((stcb) && (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 3998 /* 3999 * special case, is this a retran'd 4000 * COOKIE-ECHO or a restarting assoc 4001 * that is a peeled off or 4002 * one-to-one style socket. 4003 */ 4004 goto process_cookie_anyway; 4005 } 4006 sctp_abort_association(inp, stcb, m, iphlen, sh, 4007 NULL); 4008 *offset = length; 4009 return (NULL); 4010 } else if (inp->sctp_socket->so_qlimit) { 4011 /* we are accepting so check limits like TCP */ 4012 if (inp->sctp_socket->so_qlen > 4013 inp->sctp_socket->so_qlimit) { 4014 /* no space */ 4015 struct mbuf *oper; 4016 struct sctp_paramhdr *phdr; 4017 4018 if (sctp_abort_if_one_2_one_hits_limit) { 4019 oper = NULL; 4020 oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 4021 0, M_DONTWAIT, 1, MT_DATA); 4022 if (oper) { 4023 SCTP_BUF_LEN(oper) = 4024 sizeof(struct sctp_paramhdr); 4025 phdr = mtod(oper, 4026 struct sctp_paramhdr *); 4027 phdr->param_type = 4028 htons(SCTP_CAUSE_OUT_OF_RESC); 4029 phdr->param_length = 4030 htons(sizeof(struct sctp_paramhdr)); 4031 } 4032 sctp_abort_association(inp, stcb, m, 4033 iphlen, sh, oper); 4034 } 4035 *offset = length; 4036 return (NULL); 4037 } 4038 } 4039 process_cookie_anyway: 4040 { 4041 struct mbuf *ret_buf; 4042 struct sctp_inpcb *linp; 4043 4044 if (stcb) 4045 linp = NULL; 4046 else 4047 linp = inp; 4048 4049 if (linp) 4050 SCTP_ASOC_CREATE_LOCK(linp); 4051 ret_buf = 4052 sctp_handle_cookie_echo(m, iphlen, 4053 *offset, sh, 4054 (struct sctp_cookie_echo_chunk *)ch, 4055 &inp, &stcb, netp, 4056 auth_skipped, 4057 auth_offset, 4058 auth_len, 4059 &locked_tcb); 4060 if (linp) 4061 SCTP_ASOC_CREATE_UNLOCK(linp); 4062 if (ret_buf == NULL) { 4063 if (locked_tcb) { 4064 SCTP_TCB_UNLOCK(locked_tcb); 4065 } 4066 #ifdef SCTP_DEBUG 4067 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4068 printf("GAK, null buffer\n"); 4069 } 4070 #endif /* SCTP_DEBUG */ 4071 auth_skipped = 0; 4072 *offset = length; 4073 return (NULL); 4074 } 4075 /* if AUTH skipped, see if it verified... */ 4076 if (auth_skipped) { 4077 got_auth = 1; 4078 auth_skipped = 0; 4079 } 4080 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) { 4081 /* 4082 * Restart the timer if we have 4083 * pending data 4084 */ 4085 struct sctp_tmit_chunk *chk; 4086 4087 chk = TAILQ_FIRST(&stcb->asoc.sent_queue); 4088 if (chk) { 4089 sctp_timer_start(SCTP_TIMER_TYPE_SEND, 4090 stcb->sctp_ep, stcb, 4091 chk->whoTo); 4092 } 4093 } 4094 } 4095 break; 4096 case SCTP_COOKIE_ACK: 4097 #ifdef SCTP_DEBUG 4098 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4099 printf("SCTP_COOKIE-ACK\n"); 4100 } 4101 #endif /* SCTP_DEBUG */ 4102 4103 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4104 /* We are not interested anymore */ 4105 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 4106 ; 4107 } else { 4108 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27); 4109 *offset = length; 4110 return (NULL); 4111 } 4112 } 4113 /* He's alive so give him credit */ 4114 stcb->asoc.overall_error_count = 0; 4115 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp); 4116 break; 4117 case SCTP_ECN_ECHO: 4118 #ifdef SCTP_DEBUG 4119 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4120 printf("SCTP_ECN-ECHO\n"); 4121 } 4122 #endif /* SCTP_DEBUG */ 4123 /* He's alive so give him credit */ 4124 stcb->asoc.overall_error_count = 0; 4125 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, 4126 stcb); 4127 break; 4128 case SCTP_ECN_CWR: 4129 #ifdef SCTP_DEBUG 4130 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4131 printf("SCTP_ECN-CWR\n"); 4132 } 4133 #endif /* SCTP_DEBUG */ 4134 /* He's alive so give him credit */ 4135 stcb->asoc.overall_error_count = 0; 4136 4137 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb); 4138 break; 4139 case SCTP_SHUTDOWN_COMPLETE: 4140 #ifdef SCTP_DEBUG 4141 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4142 printf("SCTP_SHUTDOWN-COMPLETE\n"); 4143 } 4144 #endif /* SCTP_DEBUG */ 4145 /* must be first and only chunk */ 4146 if ((num_chunks > 1) || 4147 (length - *offset > SCTP_SIZE32(chk_length))) { 4148 *offset = length; 4149 if (locked_tcb) 4150 SCTP_TCB_UNLOCK(locked_tcb); 4151 4152 return (NULL); 4153 } 4154 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch, 4155 stcb, *netp); 4156 *offset = length; 4157 return (NULL); 4158 break; 4159 case SCTP_ASCONF: 4160 #ifdef SCTP_DEBUG 4161 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4162 printf("SCTP_ASCONF\n"); 4163 } 4164 #endif /* SCTP_DEBUG */ 4165 /* He's alive so give him credit */ 4166 stcb->asoc.overall_error_count = 0; 4167 4168 sctp_handle_asconf(m, *offset, 4169 (struct sctp_asconf_chunk *)ch, stcb); 4170 break; 4171 case SCTP_ASCONF_ACK: 4172 #ifdef SCTP_DEBUG 4173 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4174 printf("SCTP_ASCONF-ACK\n"); 4175 } 4176 #endif /* SCTP_DEBUG */ 4177 /* He's alive so give him credit */ 4178 stcb->asoc.overall_error_count = 0; 4179 4180 sctp_handle_asconf_ack(m, *offset, 4181 (struct sctp_asconf_ack_chunk *)ch, stcb, *netp); 4182 break; 4183 case SCTP_FORWARD_CUM_TSN: 4184 #ifdef SCTP_DEBUG 4185 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4186 printf("SCTP_FWD-TSN\n"); 4187 } 4188 #endif /* SCTP_DEBUG */ 4189 /* He's alive so give him credit */ 4190 { 4191 int abort_flag = 0; 4192 4193 stcb->asoc.overall_error_count = 0; 4194 *fwd_tsn_seen = 1; 4195 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4196 /* We are not interested anymore */ 4197 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28); 4198 *offset = length; 4199 return (NULL); 4200 } 4201 sctp_handle_forward_tsn(stcb, 4202 (struct sctp_forward_tsn_chunk *)ch, &abort_flag); 4203 if (abort_flag) { 4204 *offset = length; 4205 return (NULL); 4206 } else { 4207 stcb->asoc.overall_error_count = 0; 4208 } 4209 4210 } 4211 break; 4212 case SCTP_STREAM_RESET: 4213 #ifdef SCTP_DEBUG 4214 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4215 printf("SCTP_STREAM_RESET\n"); 4216 } 4217 #endif /* SCTP_DEBUG */ 4218 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4219 chk_length, chunk_buf); 4220 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4221 /* We are not interested anymore */ 4222 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29); 4223 *offset = length; 4224 return (NULL); 4225 } 4226 if (stcb->asoc.peer_supports_strreset == 0) { 4227 /* 4228 * hmm, peer should have announced this, but 4229 * we will turn it on since he is sending us 4230 * a stream reset. 4231 */ 4232 stcb->asoc.peer_supports_strreset = 1; 4233 } 4234 if (sctp_handle_stream_reset(stcb, (struct sctp_stream_reset_out_req *)ch)) { 4235 /* stop processing */ 4236 *offset = length; 4237 return (NULL); 4238 } 4239 break; 4240 case SCTP_PACKET_DROPPED: 4241 #ifdef SCTP_DEBUG 4242 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4243 printf("SCTP_PACKET_DROPPED\n"); 4244 } 4245 #endif /* SCTP_DEBUG */ 4246 /* re-get it all please */ 4247 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4248 chk_length, chunk_buf); 4249 4250 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch, 4251 stcb, *netp); 4252 4253 break; 4254 4255 case SCTP_AUTHENTICATION: 4256 #ifdef SCTP_DEBUG 4257 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4258 printf("SCTP_AUTHENTICATION\n"); 4259 } 4260 #endif /* SCTP_DEBUG */ 4261 if (sctp_auth_disable) 4262 goto unknown_chunk; 4263 4264 if (stcb == NULL) { 4265 /* save the first AUTH for later processing */ 4266 if (auth_skipped == 0) { 4267 auth_offset = *offset; 4268 auth_len = chk_length; 4269 auth_skipped = 1; 4270 } 4271 /* skip this chunk (temporarily) */ 4272 goto next_chunk; 4273 } 4274 if (got_auth == 1) { 4275 /* skip this chunk... it's already auth'd */ 4276 goto next_chunk; 4277 } 4278 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4279 chk_length, chunk_buf); 4280 got_auth = 1; 4281 if (sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch, 4282 m, *offset)) { 4283 /* auth HMAC failed so dump the packet */ 4284 *offset = length; 4285 return (stcb); 4286 } else { 4287 /* remaining chunks are HMAC checked */ 4288 stcb->asoc.authenticated = 1; 4289 } 4290 break; 4291 4292 default: 4293 unknown_chunk: 4294 /* it's an unknown chunk! */ 4295 if ((ch->chunk_type & 0x40) && (stcb != NULL)) { 4296 struct mbuf *mm; 4297 struct sctp_paramhdr *phd; 4298 4299 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 4300 0, M_DONTWAIT, 1, MT_DATA); 4301 if (mm) { 4302 phd = mtod(mm, struct sctp_paramhdr *); 4303 /* 4304 * We cheat and use param type since 4305 * we did not bother to define a 4306 * error cause struct. They are the 4307 * same basic format with different 4308 * names. 4309 */ 4310 phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK); 4311 phd->param_length = htons(chk_length + sizeof(*phd)); 4312 SCTP_BUF_LEN(mm) = sizeof(*phd); 4313 SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, SCTP_SIZE32(chk_length), 4314 M_DONTWAIT); 4315 if (SCTP_BUF_NEXT(mm)) { 4316 sctp_queue_op_err(stcb, mm); 4317 } else { 4318 sctp_m_freem(mm); 4319 } 4320 } 4321 } 4322 if ((ch->chunk_type & 0x80) == 0) { 4323 /* discard this packet */ 4324 *offset = length; 4325 return (stcb); 4326 } /* else skip this bad chunk and continue... */ 4327 break; 4328 } /* switch (ch->chunk_type) */ 4329 4330 4331 next_chunk: 4332 /* get the next chunk */ 4333 *offset += SCTP_SIZE32(chk_length); 4334 if (*offset >= length) { 4335 /* no more data left in the mbuf chain */ 4336 break; 4337 } 4338 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4339 sizeof(struct sctp_chunkhdr), chunk_buf); 4340 if (ch == NULL) { 4341 if (locked_tcb) 4342 SCTP_TCB_UNLOCK(locked_tcb); 4343 *offset = length; 4344 return (NULL); 4345 } 4346 } /* while */ 4347 return (stcb); 4348 } 4349 4350 4351 /* 4352 * Process the ECN bits we have something set so we must look to see if it is 4353 * ECN(0) or ECN(1) or CE 4354 */ 4355 static __inline void 4356 sctp_process_ecn_marked_a(struct sctp_tcb *stcb, struct sctp_nets *net, 4357 uint8_t ecn_bits) 4358 { 4359 if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 4360 ; 4361 } else if ((ecn_bits & SCTP_ECT1_BIT) == SCTP_ECT1_BIT) { 4362 /* 4363 * we only add to the nonce sum for ECT1, ECT0 does not 4364 * change the NS bit (that we have yet to find a way to send 4365 * it yet). 4366 */ 4367 4368 /* ECN Nonce stuff */ 4369 stcb->asoc.receiver_nonce_sum++; 4370 stcb->asoc.receiver_nonce_sum &= SCTP_SACK_NONCE_SUM; 4371 4372 /* 4373 * Drag up the last_echo point if cumack is larger since we 4374 * don't want the point falling way behind by more than 4375 * 2^^31 and then having it be incorrect. 4376 */ 4377 if (compare_with_wrap(stcb->asoc.cumulative_tsn, 4378 stcb->asoc.last_echo_tsn, MAX_TSN)) { 4379 stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 4380 } 4381 } else if ((ecn_bits & SCTP_ECT0_BIT) == SCTP_ECT0_BIT) { 4382 /* 4383 * Drag up the last_echo point if cumack is larger since we 4384 * don't want the point falling way behind by more than 4385 * 2^^31 and then having it be incorrect. 4386 */ 4387 if (compare_with_wrap(stcb->asoc.cumulative_tsn, 4388 stcb->asoc.last_echo_tsn, MAX_TSN)) { 4389 stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 4390 } 4391 } 4392 } 4393 4394 static __inline void 4395 sctp_process_ecn_marked_b(struct sctp_tcb *stcb, struct sctp_nets *net, 4396 uint32_t high_tsn, uint8_t ecn_bits) 4397 { 4398 if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 4399 /* 4400 * we possibly must notify the sender that a congestion 4401 * window reduction is in order. We do this by adding a ECNE 4402 * chunk to the output chunk queue. The incoming CWR will 4403 * remove this chunk. 4404 */ 4405 if (compare_with_wrap(high_tsn, stcb->asoc.last_echo_tsn, 4406 MAX_TSN)) { 4407 /* Yep, we need to add a ECNE */ 4408 sctp_send_ecn_echo(stcb, net, high_tsn); 4409 stcb->asoc.last_echo_tsn = high_tsn; 4410 } 4411 } 4412 } 4413 4414 /* 4415 * common input chunk processing (v4 and v6) 4416 */ 4417 int 4418 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, 4419 int length, struct sctphdr *sh, struct sctp_chunkhdr *ch, 4420 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 4421 uint8_t ecn_bits) 4422 { 4423 /* 4424 * Control chunk processing 4425 */ 4426 uint32_t high_tsn; 4427 int fwd_tsn_seen = 0, data_processed = 0; 4428 struct mbuf *m = *mm; 4429 int abort_flag = 0; 4430 int un_sent; 4431 4432 SCTP_STAT_INCR(sctps_recvdatagrams); 4433 #ifdef SCTP_AUDITING_ENABLED 4434 sctp_audit_log(0xE0, 1); 4435 sctp_auditing(0, inp, stcb, net); 4436 #endif 4437 4438 #ifdef SCTP_DEBUG 4439 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4440 printf("Ok, Common input processing called, m:%p iphlen:%d offset:%d\n", 4441 m, iphlen, offset); 4442 } 4443 #endif /* SCTP_DEBUG */ 4444 4445 if (stcb) { 4446 /* always clear this before beginning a packet */ 4447 stcb->asoc.authenticated = 0; 4448 stcb->asoc.seen_a_sack_this_pkt = 0; 4449 } 4450 if (IS_SCTP_CONTROL(ch)) { 4451 /* process the control portion of the SCTP packet */ 4452 stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch, 4453 inp, stcb, &net, &fwd_tsn_seen); 4454 if (stcb) { 4455 /* 4456 * This covers us if the cookie-echo was there and 4457 * it changes our INP. 4458 */ 4459 inp = stcb->sctp_ep; 4460 } 4461 } else { 4462 /* 4463 * no control chunks, so pre-process DATA chunks (these 4464 * checks are taken care of by control processing) 4465 */ 4466 4467 /* 4468 * if DATA only packet, and auth is required, then punt... 4469 * can't have authenticated without any AUTH (control) 4470 * chunks 4471 */ 4472 if ((stcb != NULL) && !sctp_auth_disable && 4473 sctp_auth_is_required_chunk(SCTP_DATA, 4474 stcb->asoc.local_auth_chunks)) { 4475 /* "silently" ignore */ 4476 SCTP_STAT_INCR(sctps_recvauthmissing); 4477 SCTP_TCB_UNLOCK(stcb); 4478 return (1); 4479 } 4480 if (stcb == NULL) { 4481 /* out of the blue DATA chunk */ 4482 sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL); 4483 return (1); 4484 } 4485 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) { 4486 /* v_tag mismatch! */ 4487 SCTP_STAT_INCR(sctps_badvtag); 4488 SCTP_TCB_UNLOCK(stcb); 4489 return (1); 4490 } 4491 } 4492 4493 if (stcb == NULL) { 4494 /* 4495 * no valid TCB for this packet, or we found it's a bad 4496 * packet while processing control, or we're done with this 4497 * packet (done or skip rest of data), so we drop it... 4498 */ 4499 return (1); 4500 } 4501 /* 4502 * DATA chunk processing 4503 */ 4504 /* plow through the data chunks while length > offset */ 4505 4506 /* 4507 * Rest should be DATA only. Check authentication state if AUTH for 4508 * DATA is required. 4509 */ 4510 if ((length > offset) && (stcb != NULL) && !sctp_auth_disable && 4511 sctp_auth_is_required_chunk(SCTP_DATA, 4512 stcb->asoc.local_auth_chunks) && 4513 !stcb->asoc.authenticated) { 4514 /* "silently" ignore */ 4515 SCTP_STAT_INCR(sctps_recvauthmissing); 4516 #ifdef SCTP_DEBUG 4517 if (sctp_debug_on & SCTP_DEBUG_AUTH1) 4518 printf("Data chunk requires AUTH, skipped\n"); 4519 #endif 4520 goto trigger_send; 4521 } 4522 if (length > offset) { 4523 int retval; 4524 4525 /* 4526 * First check to make sure our state is correct. We would 4527 * not get here unless we really did have a tag, so we don't 4528 * abort if this happens, just dump the chunk silently. 4529 */ 4530 switch (SCTP_GET_STATE(&stcb->asoc)) { 4531 case SCTP_STATE_COOKIE_ECHOED: 4532 /* 4533 * we consider data with valid tags in this state 4534 * shows us the cookie-ack was lost. Imply it was 4535 * there. 4536 */ 4537 stcb->asoc.overall_error_count = 0; 4538 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net); 4539 break; 4540 case SCTP_STATE_COOKIE_WAIT: 4541 /* 4542 * We consider OOTB any data sent during asoc setup. 4543 */ 4544 sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL); 4545 SCTP_TCB_UNLOCK(stcb); 4546 return (1); 4547 break; 4548 case SCTP_STATE_EMPTY: /* should not happen */ 4549 case SCTP_STATE_INUSE: /* should not happen */ 4550 case SCTP_STATE_SHUTDOWN_RECEIVED: /* This is a peer error */ 4551 case SCTP_STATE_SHUTDOWN_ACK_SENT: 4552 default: 4553 SCTP_TCB_UNLOCK(stcb); 4554 return (1); 4555 break; 4556 case SCTP_STATE_OPEN: 4557 case SCTP_STATE_SHUTDOWN_SENT: 4558 break; 4559 } 4560 /* take care of ECN, part 1. */ 4561 if (stcb->asoc.ecn_allowed && 4562 (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) { 4563 sctp_process_ecn_marked_a(stcb, net, ecn_bits); 4564 } 4565 /* plow through the data chunks while length > offset */ 4566 retval = sctp_process_data(mm, iphlen, &offset, length, sh, 4567 inp, stcb, net, &high_tsn); 4568 if (retval == 2) { 4569 /* 4570 * The association aborted, NO UNLOCK needed since 4571 * the association is destroyed. 4572 */ 4573 return (0); 4574 } 4575 data_processed = 1; 4576 if (retval == 0) { 4577 /* take care of ecn part 2. */ 4578 if (stcb->asoc.ecn_allowed && 4579 (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) { 4580 sctp_process_ecn_marked_b(stcb, net, high_tsn, 4581 ecn_bits); 4582 } 4583 } 4584 /* 4585 * Anything important needs to have been m_copy'ed in 4586 * process_data 4587 */ 4588 } 4589 if ((data_processed == 0) && (fwd_tsn_seen)) { 4590 int was_a_gap = 0; 4591 4592 if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map, 4593 stcb->asoc.cumulative_tsn, MAX_TSN)) { 4594 /* there was a gap before this data was processed */ 4595 was_a_gap = 1; 4596 } 4597 sctp_sack_check(stcb, 1, was_a_gap, &abort_flag); 4598 if (abort_flag) { 4599 /* Again, we aborted so NO UNLOCK needed */ 4600 return (0); 4601 } 4602 } 4603 /* trigger send of any chunks in queue... */ 4604 trigger_send: 4605 #ifdef SCTP_AUDITING_ENABLED 4606 sctp_audit_log(0xE0, 2); 4607 sctp_auditing(1, inp, stcb, net); 4608 #endif 4609 #ifdef SCTP_DEBUG 4610 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4611 printf("Check for chunk output prw:%d tqe:%d tf=%d\n", 4612 stcb->asoc.peers_rwnd, 4613 TAILQ_EMPTY(&stcb->asoc.control_send_queue), 4614 stcb->asoc.total_flight); 4615 } 4616 #endif 4617 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 4618 4619 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue) || 4620 ((un_sent) && 4621 (stcb->asoc.peers_rwnd > 0 || 4622 (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) { 4623 #ifdef SCTP_DEBUG 4624 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4625 printf("Calling chunk OUTPUT\n"); 4626 } 4627 #endif 4628 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 4629 #ifdef SCTP_DEBUG 4630 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4631 printf("chunk OUTPUT returns\n"); 4632 } 4633 #endif 4634 } 4635 #ifdef SCTP_AUDITING_ENABLED 4636 sctp_audit_log(0xE0, 3); 4637 sctp_auditing(2, inp, stcb, net); 4638 #endif 4639 SCTP_TCB_UNLOCK(stcb); 4640 return (0); 4641 } 4642 4643 extern int sctp_no_csum_on_loopback; 4644 4645 4646 int sctp_buf_index = 0; 4647 uint8_t sctp_list_of_chunks[30000]; 4648 4649 4650 void 4651 sctp_input(i_pak, off) 4652 struct mbuf *i_pak; 4653 int off; 4654 4655 { 4656 #ifdef SCTP_MBUF_LOGGING 4657 struct mbuf *mat; 4658 4659 #endif 4660 struct mbuf *m; 4661 int iphlen; 4662 uint8_t ecn_bits; 4663 struct ip *ip; 4664 struct sctphdr *sh; 4665 struct sctp_inpcb *inp = NULL; 4666 4667 uint32_t check, calc_check; 4668 struct sctp_nets *net; 4669 struct sctp_tcb *stcb = NULL; 4670 struct sctp_chunkhdr *ch; 4671 int refcount_up = 0; 4672 int length, mlen, offset; 4673 4674 4675 iphlen = off; 4676 m = SCTP_HEADER_TO_CHAIN(i_pak); 4677 net = NULL; 4678 SCTP_STAT_INCR(sctps_recvpackets); 4679 SCTP_STAT_INCR_COUNTER64(sctps_inpackets); 4680 4681 /* 4682 * Strip IP options, we don't allow any in or out. 4683 */ 4684 #ifdef SCTP_MBUF_LOGGING 4685 /* Log in any input mbufs */ 4686 mat = m; 4687 while (mat) { 4688 if (SCTP_BUF_IS_EXTENDED(mat)) { 4689 sctp_log_mb(mat, SCTP_MBUF_INPUT); 4690 } 4691 mat = SCTP_BUF_NEXT(mat); 4692 } 4693 #endif 4694 if ((size_t)iphlen > sizeof(struct ip)) { 4695 ip_stripoptions(m, (struct mbuf *)0); 4696 iphlen = sizeof(struct ip); 4697 } 4698 /* 4699 * Get IP, SCTP, and first chunk header together in first mbuf. 4700 */ 4701 ip = mtod(m, struct ip *); 4702 offset = iphlen + sizeof(*sh) + sizeof(*ch); 4703 if (SCTP_BUF_LEN(m) < offset) { 4704 if ((m = m_pullup(m, offset)) == 0) { 4705 SCTP_STAT_INCR(sctps_hdrops); 4706 return; 4707 } 4708 ip = mtod(m, struct ip *); 4709 } 4710 sh = (struct sctphdr *)((caddr_t)ip + iphlen); 4711 ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh)); 4712 4713 /* SCTP does not allow broadcasts or multicasts */ 4714 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { 4715 goto bad; 4716 } 4717 if (((ch->chunk_type == SCTP_INITIATION) || 4718 (ch->chunk_type == SCTP_INITIATION_ACK) || 4719 (ch->chunk_type == SCTP_COOKIE_ECHO)) && 4720 (SCTP_IS_IT_BROADCAST(ip->ip_dst, i_pak))) { 4721 /* 4722 * We only look at broadcast if its a front state, All 4723 * others we will not have a tcb for anyway. 4724 */ 4725 goto bad; 4726 } 4727 /* destination port of 0 is illegal, based on RFC2960. */ 4728 if (sh->dest_port == 0) { 4729 SCTP_STAT_INCR(sctps_hdrops); 4730 goto bad; 4731 } 4732 /* validate SCTP checksum */ 4733 if ((sctp_no_csum_on_loopback == 0) || !SCTP_IS_IT_LOOPBACK(i_pak)) { 4734 /* 4735 * we do NOT validate things from the loopback if the sysctl 4736 * is set to 1. 4737 */ 4738 check = sh->checksum; /* save incoming checksum */ 4739 if ((check == 0) && (sctp_no_csum_on_loopback)) { 4740 /* 4741 * special hook for where we got a local address 4742 * somehow routed across a non IFT_LOOP type 4743 * interface 4744 */ 4745 if (ip->ip_src.s_addr == ip->ip_dst.s_addr) 4746 goto sctp_skip_csum_4; 4747 } 4748 sh->checksum = 0; /* prepare for calc */ 4749 calc_check = sctp_calculate_sum(m, &mlen, iphlen); 4750 if (calc_check != check) { 4751 #ifdef SCTP_DEBUG 4752 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4753 printf("Bad CSUM on SCTP packet calc_check:%x check:%x m:%p mlen:%d iphlen:%d\n", 4754 calc_check, check, m, mlen, iphlen); 4755 } 4756 #endif 4757 4758 stcb = sctp_findassociation_addr(m, iphlen, 4759 offset - sizeof(*ch), 4760 sh, ch, &inp, &net); 4761 if ((inp) && (stcb)) { 4762 sctp_send_packet_dropped(stcb, net, m, iphlen, 1); 4763 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR); 4764 } else if ((inp != NULL) && (stcb == NULL)) { 4765 refcount_up = 1; 4766 } 4767 SCTP_STAT_INCR(sctps_badsum); 4768 SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors); 4769 goto bad; 4770 } 4771 sh->checksum = calc_check; 4772 } else { 4773 sctp_skip_csum_4: 4774 mlen = SCTP_HEADER_LEN(i_pak); 4775 } 4776 /* validate mbuf chain length with IP payload length */ 4777 if (mlen < (ip->ip_len - iphlen)) { 4778 SCTP_STAT_INCR(sctps_hdrops); 4779 goto bad; 4780 } { 4781 /* TEMP log the first chunk */ 4782 int x; 4783 4784 x = atomic_fetchadd_int(&sctp_buf_index, 1); 4785 if (x >= 30000) { 4786 sctp_buf_index = 1; 4787 x = 0;; 4788 } 4789 sctp_list_of_chunks[x] = ch->chunk_type; 4790 } 4791 /* 4792 * Locate pcb and tcb for datagram sctp_findassociation_addr() wants 4793 * IP/SCTP/first chunk header... 4794 */ 4795 stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch), 4796 sh, ch, &inp, &net); 4797 /* inp's ref-count increased && stcb locked */ 4798 if (inp == NULL) { 4799 struct sctp_init_chunk *init_chk, chunk_buf; 4800 4801 SCTP_STAT_INCR(sctps_noport); 4802 #ifdef ICMP_BANDLIM 4803 /* 4804 * we use the bandwidth limiting to protect against sending 4805 * too many ABORTS all at once. In this case these count the 4806 * same as an ICMP message. 4807 */ 4808 if (badport_bandlim(0) < 0) 4809 goto bad; 4810 #endif /* ICMP_BANDLIM */ 4811 #ifdef SCTP_DEBUG 4812 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4813 printf("Sending a ABORT from packet entry!\n"); 4814 } 4815 #endif 4816 if (ch->chunk_type == SCTP_INITIATION) { 4817 /* 4818 * we do a trick here to get the INIT tag, dig in 4819 * and get the tag from the INIT and put it in the 4820 * common header. 4821 */ 4822 init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m, 4823 iphlen + sizeof(*sh), sizeof(*init_chk), 4824 (uint8_t *) & chunk_buf); 4825 if (init_chk != NULL) 4826 sh->v_tag = init_chk->init.initiate_tag; 4827 } 4828 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 4829 sctp_send_shutdown_complete2(m, iphlen, sh); 4830 goto bad; 4831 } 4832 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) { 4833 goto bad; 4834 } 4835 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) 4836 sctp_send_abort(m, iphlen, sh, 0, NULL); 4837 goto bad; 4838 } else if (stcb == NULL) { 4839 refcount_up = 1; 4840 } 4841 #ifdef IPSEC 4842 /* 4843 * I very much doubt any of the IPSEC stuff will work but I have no 4844 * idea, so I will leave it in place. 4845 */ 4846 4847 if (inp && ipsec4_in_reject(m, &inp->ip_inp.inp)) { 4848 ipsecstat.in_polvio++; 4849 SCTP_STAT_INCR(sctps_hdrops); 4850 goto bad; 4851 } 4852 #endif /* IPSEC */ 4853 4854 4855 4856 /* 4857 * common chunk processing 4858 */ 4859 length = ip->ip_len + iphlen; 4860 offset -= sizeof(struct sctp_chunkhdr); 4861 4862 ecn_bits = ip->ip_tos; 4863 4864 sctp_common_input_processing(&m, iphlen, offset, length, sh, ch, 4865 inp, stcb, net, ecn_bits); 4866 /* inp's ref-count reduced && stcb unlocked */ 4867 if (m) { 4868 sctp_m_freem(m); 4869 } 4870 if ((inp) && (refcount_up)) { 4871 /* reduce ref-count */ 4872 SCTP_INP_WLOCK(inp); 4873 SCTP_INP_DECR_REF(inp); 4874 SCTP_INP_WUNLOCK(inp); 4875 } 4876 return; 4877 bad: 4878 if (stcb) 4879 SCTP_TCB_UNLOCK(stcb); 4880 4881 if ((inp) && (refcount_up)) { 4882 /* reduce ref-count */ 4883 SCTP_INP_WLOCK(inp); 4884 SCTP_INP_DECR_REF(inp); 4885 SCTP_INP_WUNLOCK(inp); 4886 } 4887 if (m) { 4888 sctp_m_freem(m); 4889 } 4890 return; 4891 } 4892