1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 5 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 6 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions are met: 10 * 11 * a) Redistributions of source code must retain the above copyright notice, 12 * this list of conditions and the following disclaimer. 13 * 14 * b) Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the distribution. 17 * 18 * c) Neither the name of Cisco Systems, Inc. nor the names of its 19 * contributors may be used to endorse or promote products derived 20 * from this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 26 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 32 * THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include <sys/cdefs.h> 36 __FBSDID("$FreeBSD$"); 37 38 #include <netinet/sctp_os.h> 39 #include <sys/proc.h> 40 #include <netinet/sctp_var.h> 41 #include <netinet/sctp_sysctl.h> 42 #include <netinet/sctp_header.h> 43 #include <netinet/sctp_pcb.h> 44 #include <netinet/sctputil.h> 45 #include <netinet/sctp_output.h> 46 #include <netinet/sctp_uio.h> 47 #include <netinet/sctputil.h> 48 #include <netinet/sctp_auth.h> 49 #include <netinet/sctp_timer.h> 50 #include <netinet/sctp_asconf.h> 51 #include <netinet/sctp_indata.h> 52 #include <netinet/sctp_bsd_addr.h> 53 #include <netinet/sctp_input.h> 54 #include <netinet/sctp_crc32.h> 55 #include <netinet/sctp_kdtrace.h> 56 #if defined(INET) || defined(INET6) 57 #include <netinet/udp.h> 58 #endif 59 #include <netinet/udp_var.h> 60 #include <machine/in_cksum.h> 61 62 63 #define SCTP_MAX_GAPS_INARRAY 4 64 struct sack_track { 65 uint8_t right_edge; /* mergable on the right edge */ 66 uint8_t left_edge; /* mergable on the left edge */ 67 uint8_t num_entries; 68 uint8_t spare; 69 struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY]; 70 }; 71 72 const struct sack_track sack_array[256] = { 73 {0, 0, 0, 0, /* 0x00 */ 74 {{0, 0}, 75 {0, 0}, 76 {0, 0}, 77 {0, 0} 78 } 79 }, 80 {1, 0, 1, 0, /* 0x01 */ 81 {{0, 0}, 82 {0, 0}, 83 {0, 0}, 84 {0, 0} 85 } 86 }, 87 {0, 0, 1, 0, /* 0x02 */ 88 {{1, 1}, 89 {0, 0}, 90 {0, 0}, 91 {0, 0} 92 } 93 }, 94 {1, 0, 1, 0, /* 0x03 */ 95 {{0, 1}, 96 {0, 0}, 97 {0, 0}, 98 {0, 0} 99 } 100 }, 101 {0, 0, 1, 0, /* 0x04 */ 102 {{2, 2}, 103 {0, 0}, 104 {0, 0}, 105 {0, 0} 106 } 107 }, 108 {1, 0, 2, 0, /* 0x05 */ 109 {{0, 0}, 110 {2, 2}, 111 {0, 0}, 112 {0, 0} 113 } 114 }, 115 {0, 0, 1, 0, /* 0x06 */ 116 {{1, 2}, 117 {0, 0}, 118 {0, 0}, 119 {0, 0} 120 } 121 }, 122 {1, 0, 1, 0, /* 0x07 */ 123 {{0, 2}, 124 {0, 0}, 125 {0, 0}, 126 {0, 0} 127 } 128 }, 129 {0, 0, 1, 0, /* 0x08 */ 130 {{3, 3}, 131 {0, 0}, 132 {0, 0}, 133 {0, 0} 134 } 135 }, 136 {1, 0, 2, 0, /* 0x09 */ 137 {{0, 0}, 138 {3, 3}, 139 {0, 0}, 140 {0, 0} 141 } 142 }, 143 {0, 0, 2, 0, /* 0x0a */ 144 {{1, 1}, 145 {3, 3}, 146 {0, 0}, 147 {0, 0} 148 } 149 }, 150 {1, 0, 2, 0, /* 0x0b */ 151 {{0, 1}, 152 {3, 3}, 153 {0, 0}, 154 {0, 0} 155 } 156 }, 157 {0, 0, 1, 0, /* 0x0c */ 158 {{2, 3}, 159 {0, 0}, 160 {0, 0}, 161 {0, 0} 162 } 163 }, 164 {1, 0, 2, 0, /* 0x0d */ 165 {{0, 0}, 166 {2, 3}, 167 {0, 0}, 168 {0, 0} 169 } 170 }, 171 {0, 0, 1, 0, /* 0x0e */ 172 {{1, 3}, 173 {0, 0}, 174 {0, 0}, 175 {0, 0} 176 } 177 }, 178 {1, 0, 1, 0, /* 0x0f */ 179 {{0, 3}, 180 {0, 0}, 181 {0, 0}, 182 {0, 0} 183 } 184 }, 185 {0, 0, 1, 0, /* 0x10 */ 186 {{4, 4}, 187 {0, 0}, 188 {0, 0}, 189 {0, 0} 190 } 191 }, 192 {1, 0, 2, 0, /* 0x11 */ 193 {{0, 0}, 194 {4, 4}, 195 {0, 0}, 196 {0, 0} 197 } 198 }, 199 {0, 0, 2, 0, /* 0x12 */ 200 {{1, 1}, 201 {4, 4}, 202 {0, 0}, 203 {0, 0} 204 } 205 }, 206 {1, 0, 2, 0, /* 0x13 */ 207 {{0, 1}, 208 {4, 4}, 209 {0, 0}, 210 {0, 0} 211 } 212 }, 213 {0, 0, 2, 0, /* 0x14 */ 214 {{2, 2}, 215 {4, 4}, 216 {0, 0}, 217 {0, 0} 218 } 219 }, 220 {1, 0, 3, 0, /* 0x15 */ 221 {{0, 0}, 222 {2, 2}, 223 {4, 4}, 224 {0, 0} 225 } 226 }, 227 {0, 0, 2, 0, /* 0x16 */ 228 {{1, 2}, 229 {4, 4}, 230 {0, 0}, 231 {0, 0} 232 } 233 }, 234 {1, 0, 2, 0, /* 0x17 */ 235 {{0, 2}, 236 {4, 4}, 237 {0, 0}, 238 {0, 0} 239 } 240 }, 241 {0, 0, 1, 0, /* 0x18 */ 242 {{3, 4}, 243 {0, 0}, 244 {0, 0}, 245 {0, 0} 246 } 247 }, 248 {1, 0, 2, 0, /* 0x19 */ 249 {{0, 0}, 250 {3, 4}, 251 {0, 0}, 252 {0, 0} 253 } 254 }, 255 {0, 0, 2, 0, /* 0x1a */ 256 {{1, 1}, 257 {3, 4}, 258 {0, 0}, 259 {0, 0} 260 } 261 }, 262 {1, 0, 2, 0, /* 0x1b */ 263 {{0, 1}, 264 {3, 4}, 265 {0, 0}, 266 {0, 0} 267 } 268 }, 269 {0, 0, 1, 0, /* 0x1c */ 270 {{2, 4}, 271 {0, 0}, 272 {0, 0}, 273 {0, 0} 274 } 275 }, 276 {1, 0, 2, 0, /* 0x1d */ 277 {{0, 0}, 278 {2, 4}, 279 {0, 0}, 280 {0, 0} 281 } 282 }, 283 {0, 0, 1, 0, /* 0x1e */ 284 {{1, 4}, 285 {0, 0}, 286 {0, 0}, 287 {0, 0} 288 } 289 }, 290 {1, 0, 1, 0, /* 0x1f */ 291 {{0, 4}, 292 {0, 0}, 293 {0, 0}, 294 {0, 0} 295 } 296 }, 297 {0, 0, 1, 0, /* 0x20 */ 298 {{5, 5}, 299 {0, 0}, 300 {0, 0}, 301 {0, 0} 302 } 303 }, 304 {1, 0, 2, 0, /* 0x21 */ 305 {{0, 0}, 306 {5, 5}, 307 {0, 0}, 308 {0, 0} 309 } 310 }, 311 {0, 0, 2, 0, /* 0x22 */ 312 {{1, 1}, 313 {5, 5}, 314 {0, 0}, 315 {0, 0} 316 } 317 }, 318 {1, 0, 2, 0, /* 0x23 */ 319 {{0, 1}, 320 {5, 5}, 321 {0, 0}, 322 {0, 0} 323 } 324 }, 325 {0, 0, 2, 0, /* 0x24 */ 326 {{2, 2}, 327 {5, 5}, 328 {0, 0}, 329 {0, 0} 330 } 331 }, 332 {1, 0, 3, 0, /* 0x25 */ 333 {{0, 0}, 334 {2, 2}, 335 {5, 5}, 336 {0, 0} 337 } 338 }, 339 {0, 0, 2, 0, /* 0x26 */ 340 {{1, 2}, 341 {5, 5}, 342 {0, 0}, 343 {0, 0} 344 } 345 }, 346 {1, 0, 2, 0, /* 0x27 */ 347 {{0, 2}, 348 {5, 5}, 349 {0, 0}, 350 {0, 0} 351 } 352 }, 353 {0, 0, 2, 0, /* 0x28 */ 354 {{3, 3}, 355 {5, 5}, 356 {0, 0}, 357 {0, 0} 358 } 359 }, 360 {1, 0, 3, 0, /* 0x29 */ 361 {{0, 0}, 362 {3, 3}, 363 {5, 5}, 364 {0, 0} 365 } 366 }, 367 {0, 0, 3, 0, /* 0x2a */ 368 {{1, 1}, 369 {3, 3}, 370 {5, 5}, 371 {0, 0} 372 } 373 }, 374 {1, 0, 3, 0, /* 0x2b */ 375 {{0, 1}, 376 {3, 3}, 377 {5, 5}, 378 {0, 0} 379 } 380 }, 381 {0, 0, 2, 0, /* 0x2c */ 382 {{2, 3}, 383 {5, 5}, 384 {0, 0}, 385 {0, 0} 386 } 387 }, 388 {1, 0, 3, 0, /* 0x2d */ 389 {{0, 0}, 390 {2, 3}, 391 {5, 5}, 392 {0, 0} 393 } 394 }, 395 {0, 0, 2, 0, /* 0x2e */ 396 {{1, 3}, 397 {5, 5}, 398 {0, 0}, 399 {0, 0} 400 } 401 }, 402 {1, 0, 2, 0, /* 0x2f */ 403 {{0, 3}, 404 {5, 5}, 405 {0, 0}, 406 {0, 0} 407 } 408 }, 409 {0, 0, 1, 0, /* 0x30 */ 410 {{4, 5}, 411 {0, 0}, 412 {0, 0}, 413 {0, 0} 414 } 415 }, 416 {1, 0, 2, 0, /* 0x31 */ 417 {{0, 0}, 418 {4, 5}, 419 {0, 0}, 420 {0, 0} 421 } 422 }, 423 {0, 0, 2, 0, /* 0x32 */ 424 {{1, 1}, 425 {4, 5}, 426 {0, 0}, 427 {0, 0} 428 } 429 }, 430 {1, 0, 2, 0, /* 0x33 */ 431 {{0, 1}, 432 {4, 5}, 433 {0, 0}, 434 {0, 0} 435 } 436 }, 437 {0, 0, 2, 0, /* 0x34 */ 438 {{2, 2}, 439 {4, 5}, 440 {0, 0}, 441 {0, 0} 442 } 443 }, 444 {1, 0, 3, 0, /* 0x35 */ 445 {{0, 0}, 446 {2, 2}, 447 {4, 5}, 448 {0, 0} 449 } 450 }, 451 {0, 0, 2, 0, /* 0x36 */ 452 {{1, 2}, 453 {4, 5}, 454 {0, 0}, 455 {0, 0} 456 } 457 }, 458 {1, 0, 2, 0, /* 0x37 */ 459 {{0, 2}, 460 {4, 5}, 461 {0, 0}, 462 {0, 0} 463 } 464 }, 465 {0, 0, 1, 0, /* 0x38 */ 466 {{3, 5}, 467 {0, 0}, 468 {0, 0}, 469 {0, 0} 470 } 471 }, 472 {1, 0, 2, 0, /* 0x39 */ 473 {{0, 0}, 474 {3, 5}, 475 {0, 0}, 476 {0, 0} 477 } 478 }, 479 {0, 0, 2, 0, /* 0x3a */ 480 {{1, 1}, 481 {3, 5}, 482 {0, 0}, 483 {0, 0} 484 } 485 }, 486 {1, 0, 2, 0, /* 0x3b */ 487 {{0, 1}, 488 {3, 5}, 489 {0, 0}, 490 {0, 0} 491 } 492 }, 493 {0, 0, 1, 0, /* 0x3c */ 494 {{2, 5}, 495 {0, 0}, 496 {0, 0}, 497 {0, 0} 498 } 499 }, 500 {1, 0, 2, 0, /* 0x3d */ 501 {{0, 0}, 502 {2, 5}, 503 {0, 0}, 504 {0, 0} 505 } 506 }, 507 {0, 0, 1, 0, /* 0x3e */ 508 {{1, 5}, 509 {0, 0}, 510 {0, 0}, 511 {0, 0} 512 } 513 }, 514 {1, 0, 1, 0, /* 0x3f */ 515 {{0, 5}, 516 {0, 0}, 517 {0, 0}, 518 {0, 0} 519 } 520 }, 521 {0, 0, 1, 0, /* 0x40 */ 522 {{6, 6}, 523 {0, 0}, 524 {0, 0}, 525 {0, 0} 526 } 527 }, 528 {1, 0, 2, 0, /* 0x41 */ 529 {{0, 0}, 530 {6, 6}, 531 {0, 0}, 532 {0, 0} 533 } 534 }, 535 {0, 0, 2, 0, /* 0x42 */ 536 {{1, 1}, 537 {6, 6}, 538 {0, 0}, 539 {0, 0} 540 } 541 }, 542 {1, 0, 2, 0, /* 0x43 */ 543 {{0, 1}, 544 {6, 6}, 545 {0, 0}, 546 {0, 0} 547 } 548 }, 549 {0, 0, 2, 0, /* 0x44 */ 550 {{2, 2}, 551 {6, 6}, 552 {0, 0}, 553 {0, 0} 554 } 555 }, 556 {1, 0, 3, 0, /* 0x45 */ 557 {{0, 0}, 558 {2, 2}, 559 {6, 6}, 560 {0, 0} 561 } 562 }, 563 {0, 0, 2, 0, /* 0x46 */ 564 {{1, 2}, 565 {6, 6}, 566 {0, 0}, 567 {0, 0} 568 } 569 }, 570 {1, 0, 2, 0, /* 0x47 */ 571 {{0, 2}, 572 {6, 6}, 573 {0, 0}, 574 {0, 0} 575 } 576 }, 577 {0, 0, 2, 0, /* 0x48 */ 578 {{3, 3}, 579 {6, 6}, 580 {0, 0}, 581 {0, 0} 582 } 583 }, 584 {1, 0, 3, 0, /* 0x49 */ 585 {{0, 0}, 586 {3, 3}, 587 {6, 6}, 588 {0, 0} 589 } 590 }, 591 {0, 0, 3, 0, /* 0x4a */ 592 {{1, 1}, 593 {3, 3}, 594 {6, 6}, 595 {0, 0} 596 } 597 }, 598 {1, 0, 3, 0, /* 0x4b */ 599 {{0, 1}, 600 {3, 3}, 601 {6, 6}, 602 {0, 0} 603 } 604 }, 605 {0, 0, 2, 0, /* 0x4c */ 606 {{2, 3}, 607 {6, 6}, 608 {0, 0}, 609 {0, 0} 610 } 611 }, 612 {1, 0, 3, 0, /* 0x4d */ 613 {{0, 0}, 614 {2, 3}, 615 {6, 6}, 616 {0, 0} 617 } 618 }, 619 {0, 0, 2, 0, /* 0x4e */ 620 {{1, 3}, 621 {6, 6}, 622 {0, 0}, 623 {0, 0} 624 } 625 }, 626 {1, 0, 2, 0, /* 0x4f */ 627 {{0, 3}, 628 {6, 6}, 629 {0, 0}, 630 {0, 0} 631 } 632 }, 633 {0, 0, 2, 0, /* 0x50 */ 634 {{4, 4}, 635 {6, 6}, 636 {0, 0}, 637 {0, 0} 638 } 639 }, 640 {1, 0, 3, 0, /* 0x51 */ 641 {{0, 0}, 642 {4, 4}, 643 {6, 6}, 644 {0, 0} 645 } 646 }, 647 {0, 0, 3, 0, /* 0x52 */ 648 {{1, 1}, 649 {4, 4}, 650 {6, 6}, 651 {0, 0} 652 } 653 }, 654 {1, 0, 3, 0, /* 0x53 */ 655 {{0, 1}, 656 {4, 4}, 657 {6, 6}, 658 {0, 0} 659 } 660 }, 661 {0, 0, 3, 0, /* 0x54 */ 662 {{2, 2}, 663 {4, 4}, 664 {6, 6}, 665 {0, 0} 666 } 667 }, 668 {1, 0, 4, 0, /* 0x55 */ 669 {{0, 0}, 670 {2, 2}, 671 {4, 4}, 672 {6, 6} 673 } 674 }, 675 {0, 0, 3, 0, /* 0x56 */ 676 {{1, 2}, 677 {4, 4}, 678 {6, 6}, 679 {0, 0} 680 } 681 }, 682 {1, 0, 3, 0, /* 0x57 */ 683 {{0, 2}, 684 {4, 4}, 685 {6, 6}, 686 {0, 0} 687 } 688 }, 689 {0, 0, 2, 0, /* 0x58 */ 690 {{3, 4}, 691 {6, 6}, 692 {0, 0}, 693 {0, 0} 694 } 695 }, 696 {1, 0, 3, 0, /* 0x59 */ 697 {{0, 0}, 698 {3, 4}, 699 {6, 6}, 700 {0, 0} 701 } 702 }, 703 {0, 0, 3, 0, /* 0x5a */ 704 {{1, 1}, 705 {3, 4}, 706 {6, 6}, 707 {0, 0} 708 } 709 }, 710 {1, 0, 3, 0, /* 0x5b */ 711 {{0, 1}, 712 {3, 4}, 713 {6, 6}, 714 {0, 0} 715 } 716 }, 717 {0, 0, 2, 0, /* 0x5c */ 718 {{2, 4}, 719 {6, 6}, 720 {0, 0}, 721 {0, 0} 722 } 723 }, 724 {1, 0, 3, 0, /* 0x5d */ 725 {{0, 0}, 726 {2, 4}, 727 {6, 6}, 728 {0, 0} 729 } 730 }, 731 {0, 0, 2, 0, /* 0x5e */ 732 {{1, 4}, 733 {6, 6}, 734 {0, 0}, 735 {0, 0} 736 } 737 }, 738 {1, 0, 2, 0, /* 0x5f */ 739 {{0, 4}, 740 {6, 6}, 741 {0, 0}, 742 {0, 0} 743 } 744 }, 745 {0, 0, 1, 0, /* 0x60 */ 746 {{5, 6}, 747 {0, 0}, 748 {0, 0}, 749 {0, 0} 750 } 751 }, 752 {1, 0, 2, 0, /* 0x61 */ 753 {{0, 0}, 754 {5, 6}, 755 {0, 0}, 756 {0, 0} 757 } 758 }, 759 {0, 0, 2, 0, /* 0x62 */ 760 {{1, 1}, 761 {5, 6}, 762 {0, 0}, 763 {0, 0} 764 } 765 }, 766 {1, 0, 2, 0, /* 0x63 */ 767 {{0, 1}, 768 {5, 6}, 769 {0, 0}, 770 {0, 0} 771 } 772 }, 773 {0, 0, 2, 0, /* 0x64 */ 774 {{2, 2}, 775 {5, 6}, 776 {0, 0}, 777 {0, 0} 778 } 779 }, 780 {1, 0, 3, 0, /* 0x65 */ 781 {{0, 0}, 782 {2, 2}, 783 {5, 6}, 784 {0, 0} 785 } 786 }, 787 {0, 0, 2, 0, /* 0x66 */ 788 {{1, 2}, 789 {5, 6}, 790 {0, 0}, 791 {0, 0} 792 } 793 }, 794 {1, 0, 2, 0, /* 0x67 */ 795 {{0, 2}, 796 {5, 6}, 797 {0, 0}, 798 {0, 0} 799 } 800 }, 801 {0, 0, 2, 0, /* 0x68 */ 802 {{3, 3}, 803 {5, 6}, 804 {0, 0}, 805 {0, 0} 806 } 807 }, 808 {1, 0, 3, 0, /* 0x69 */ 809 {{0, 0}, 810 {3, 3}, 811 {5, 6}, 812 {0, 0} 813 } 814 }, 815 {0, 0, 3, 0, /* 0x6a */ 816 {{1, 1}, 817 {3, 3}, 818 {5, 6}, 819 {0, 0} 820 } 821 }, 822 {1, 0, 3, 0, /* 0x6b */ 823 {{0, 1}, 824 {3, 3}, 825 {5, 6}, 826 {0, 0} 827 } 828 }, 829 {0, 0, 2, 0, /* 0x6c */ 830 {{2, 3}, 831 {5, 6}, 832 {0, 0}, 833 {0, 0} 834 } 835 }, 836 {1, 0, 3, 0, /* 0x6d */ 837 {{0, 0}, 838 {2, 3}, 839 {5, 6}, 840 {0, 0} 841 } 842 }, 843 {0, 0, 2, 0, /* 0x6e */ 844 {{1, 3}, 845 {5, 6}, 846 {0, 0}, 847 {0, 0} 848 } 849 }, 850 {1, 0, 2, 0, /* 0x6f */ 851 {{0, 3}, 852 {5, 6}, 853 {0, 0}, 854 {0, 0} 855 } 856 }, 857 {0, 0, 1, 0, /* 0x70 */ 858 {{4, 6}, 859 {0, 0}, 860 {0, 0}, 861 {0, 0} 862 } 863 }, 864 {1, 0, 2, 0, /* 0x71 */ 865 {{0, 0}, 866 {4, 6}, 867 {0, 0}, 868 {0, 0} 869 } 870 }, 871 {0, 0, 2, 0, /* 0x72 */ 872 {{1, 1}, 873 {4, 6}, 874 {0, 0}, 875 {0, 0} 876 } 877 }, 878 {1, 0, 2, 0, /* 0x73 */ 879 {{0, 1}, 880 {4, 6}, 881 {0, 0}, 882 {0, 0} 883 } 884 }, 885 {0, 0, 2, 0, /* 0x74 */ 886 {{2, 2}, 887 {4, 6}, 888 {0, 0}, 889 {0, 0} 890 } 891 }, 892 {1, 0, 3, 0, /* 0x75 */ 893 {{0, 0}, 894 {2, 2}, 895 {4, 6}, 896 {0, 0} 897 } 898 }, 899 {0, 0, 2, 0, /* 0x76 */ 900 {{1, 2}, 901 {4, 6}, 902 {0, 0}, 903 {0, 0} 904 } 905 }, 906 {1, 0, 2, 0, /* 0x77 */ 907 {{0, 2}, 908 {4, 6}, 909 {0, 0}, 910 {0, 0} 911 } 912 }, 913 {0, 0, 1, 0, /* 0x78 */ 914 {{3, 6}, 915 {0, 0}, 916 {0, 0}, 917 {0, 0} 918 } 919 }, 920 {1, 0, 2, 0, /* 0x79 */ 921 {{0, 0}, 922 {3, 6}, 923 {0, 0}, 924 {0, 0} 925 } 926 }, 927 {0, 0, 2, 0, /* 0x7a */ 928 {{1, 1}, 929 {3, 6}, 930 {0, 0}, 931 {0, 0} 932 } 933 }, 934 {1, 0, 2, 0, /* 0x7b */ 935 {{0, 1}, 936 {3, 6}, 937 {0, 0}, 938 {0, 0} 939 } 940 }, 941 {0, 0, 1, 0, /* 0x7c */ 942 {{2, 6}, 943 {0, 0}, 944 {0, 0}, 945 {0, 0} 946 } 947 }, 948 {1, 0, 2, 0, /* 0x7d */ 949 {{0, 0}, 950 {2, 6}, 951 {0, 0}, 952 {0, 0} 953 } 954 }, 955 {0, 0, 1, 0, /* 0x7e */ 956 {{1, 6}, 957 {0, 0}, 958 {0, 0}, 959 {0, 0} 960 } 961 }, 962 {1, 0, 1, 0, /* 0x7f */ 963 {{0, 6}, 964 {0, 0}, 965 {0, 0}, 966 {0, 0} 967 } 968 }, 969 {0, 1, 1, 0, /* 0x80 */ 970 {{7, 7}, 971 {0, 0}, 972 {0, 0}, 973 {0, 0} 974 } 975 }, 976 {1, 1, 2, 0, /* 0x81 */ 977 {{0, 0}, 978 {7, 7}, 979 {0, 0}, 980 {0, 0} 981 } 982 }, 983 {0, 1, 2, 0, /* 0x82 */ 984 {{1, 1}, 985 {7, 7}, 986 {0, 0}, 987 {0, 0} 988 } 989 }, 990 {1, 1, 2, 0, /* 0x83 */ 991 {{0, 1}, 992 {7, 7}, 993 {0, 0}, 994 {0, 0} 995 } 996 }, 997 {0, 1, 2, 0, /* 0x84 */ 998 {{2, 2}, 999 {7, 7}, 1000 {0, 0}, 1001 {0, 0} 1002 } 1003 }, 1004 {1, 1, 3, 0, /* 0x85 */ 1005 {{0, 0}, 1006 {2, 2}, 1007 {7, 7}, 1008 {0, 0} 1009 } 1010 }, 1011 {0, 1, 2, 0, /* 0x86 */ 1012 {{1, 2}, 1013 {7, 7}, 1014 {0, 0}, 1015 {0, 0} 1016 } 1017 }, 1018 {1, 1, 2, 0, /* 0x87 */ 1019 {{0, 2}, 1020 {7, 7}, 1021 {0, 0}, 1022 {0, 0} 1023 } 1024 }, 1025 {0, 1, 2, 0, /* 0x88 */ 1026 {{3, 3}, 1027 {7, 7}, 1028 {0, 0}, 1029 {0, 0} 1030 } 1031 }, 1032 {1, 1, 3, 0, /* 0x89 */ 1033 {{0, 0}, 1034 {3, 3}, 1035 {7, 7}, 1036 {0, 0} 1037 } 1038 }, 1039 {0, 1, 3, 0, /* 0x8a */ 1040 {{1, 1}, 1041 {3, 3}, 1042 {7, 7}, 1043 {0, 0} 1044 } 1045 }, 1046 {1, 1, 3, 0, /* 0x8b */ 1047 {{0, 1}, 1048 {3, 3}, 1049 {7, 7}, 1050 {0, 0} 1051 } 1052 }, 1053 {0, 1, 2, 0, /* 0x8c */ 1054 {{2, 3}, 1055 {7, 7}, 1056 {0, 0}, 1057 {0, 0} 1058 } 1059 }, 1060 {1, 1, 3, 0, /* 0x8d */ 1061 {{0, 0}, 1062 {2, 3}, 1063 {7, 7}, 1064 {0, 0} 1065 } 1066 }, 1067 {0, 1, 2, 0, /* 0x8e */ 1068 {{1, 3}, 1069 {7, 7}, 1070 {0, 0}, 1071 {0, 0} 1072 } 1073 }, 1074 {1, 1, 2, 0, /* 0x8f */ 1075 {{0, 3}, 1076 {7, 7}, 1077 {0, 0}, 1078 {0, 0} 1079 } 1080 }, 1081 {0, 1, 2, 0, /* 0x90 */ 1082 {{4, 4}, 1083 {7, 7}, 1084 {0, 0}, 1085 {0, 0} 1086 } 1087 }, 1088 {1, 1, 3, 0, /* 0x91 */ 1089 {{0, 0}, 1090 {4, 4}, 1091 {7, 7}, 1092 {0, 0} 1093 } 1094 }, 1095 {0, 1, 3, 0, /* 0x92 */ 1096 {{1, 1}, 1097 {4, 4}, 1098 {7, 7}, 1099 {0, 0} 1100 } 1101 }, 1102 {1, 1, 3, 0, /* 0x93 */ 1103 {{0, 1}, 1104 {4, 4}, 1105 {7, 7}, 1106 {0, 0} 1107 } 1108 }, 1109 {0, 1, 3, 0, /* 0x94 */ 1110 {{2, 2}, 1111 {4, 4}, 1112 {7, 7}, 1113 {0, 0} 1114 } 1115 }, 1116 {1, 1, 4, 0, /* 0x95 */ 1117 {{0, 0}, 1118 {2, 2}, 1119 {4, 4}, 1120 {7, 7} 1121 } 1122 }, 1123 {0, 1, 3, 0, /* 0x96 */ 1124 {{1, 2}, 1125 {4, 4}, 1126 {7, 7}, 1127 {0, 0} 1128 } 1129 }, 1130 {1, 1, 3, 0, /* 0x97 */ 1131 {{0, 2}, 1132 {4, 4}, 1133 {7, 7}, 1134 {0, 0} 1135 } 1136 }, 1137 {0, 1, 2, 0, /* 0x98 */ 1138 {{3, 4}, 1139 {7, 7}, 1140 {0, 0}, 1141 {0, 0} 1142 } 1143 }, 1144 {1, 1, 3, 0, /* 0x99 */ 1145 {{0, 0}, 1146 {3, 4}, 1147 {7, 7}, 1148 {0, 0} 1149 } 1150 }, 1151 {0, 1, 3, 0, /* 0x9a */ 1152 {{1, 1}, 1153 {3, 4}, 1154 {7, 7}, 1155 {0, 0} 1156 } 1157 }, 1158 {1, 1, 3, 0, /* 0x9b */ 1159 {{0, 1}, 1160 {3, 4}, 1161 {7, 7}, 1162 {0, 0} 1163 } 1164 }, 1165 {0, 1, 2, 0, /* 0x9c */ 1166 {{2, 4}, 1167 {7, 7}, 1168 {0, 0}, 1169 {0, 0} 1170 } 1171 }, 1172 {1, 1, 3, 0, /* 0x9d */ 1173 {{0, 0}, 1174 {2, 4}, 1175 {7, 7}, 1176 {0, 0} 1177 } 1178 }, 1179 {0, 1, 2, 0, /* 0x9e */ 1180 {{1, 4}, 1181 {7, 7}, 1182 {0, 0}, 1183 {0, 0} 1184 } 1185 }, 1186 {1, 1, 2, 0, /* 0x9f */ 1187 {{0, 4}, 1188 {7, 7}, 1189 {0, 0}, 1190 {0, 0} 1191 } 1192 }, 1193 {0, 1, 2, 0, /* 0xa0 */ 1194 {{5, 5}, 1195 {7, 7}, 1196 {0, 0}, 1197 {0, 0} 1198 } 1199 }, 1200 {1, 1, 3, 0, /* 0xa1 */ 1201 {{0, 0}, 1202 {5, 5}, 1203 {7, 7}, 1204 {0, 0} 1205 } 1206 }, 1207 {0, 1, 3, 0, /* 0xa2 */ 1208 {{1, 1}, 1209 {5, 5}, 1210 {7, 7}, 1211 {0, 0} 1212 } 1213 }, 1214 {1, 1, 3, 0, /* 0xa3 */ 1215 {{0, 1}, 1216 {5, 5}, 1217 {7, 7}, 1218 {0, 0} 1219 } 1220 }, 1221 {0, 1, 3, 0, /* 0xa4 */ 1222 {{2, 2}, 1223 {5, 5}, 1224 {7, 7}, 1225 {0, 0} 1226 } 1227 }, 1228 {1, 1, 4, 0, /* 0xa5 */ 1229 {{0, 0}, 1230 {2, 2}, 1231 {5, 5}, 1232 {7, 7} 1233 } 1234 }, 1235 {0, 1, 3, 0, /* 0xa6 */ 1236 {{1, 2}, 1237 {5, 5}, 1238 {7, 7}, 1239 {0, 0} 1240 } 1241 }, 1242 {1, 1, 3, 0, /* 0xa7 */ 1243 {{0, 2}, 1244 {5, 5}, 1245 {7, 7}, 1246 {0, 0} 1247 } 1248 }, 1249 {0, 1, 3, 0, /* 0xa8 */ 1250 {{3, 3}, 1251 {5, 5}, 1252 {7, 7}, 1253 {0, 0} 1254 } 1255 }, 1256 {1, 1, 4, 0, /* 0xa9 */ 1257 {{0, 0}, 1258 {3, 3}, 1259 {5, 5}, 1260 {7, 7} 1261 } 1262 }, 1263 {0, 1, 4, 0, /* 0xaa */ 1264 {{1, 1}, 1265 {3, 3}, 1266 {5, 5}, 1267 {7, 7} 1268 } 1269 }, 1270 {1, 1, 4, 0, /* 0xab */ 1271 {{0, 1}, 1272 {3, 3}, 1273 {5, 5}, 1274 {7, 7} 1275 } 1276 }, 1277 {0, 1, 3, 0, /* 0xac */ 1278 {{2, 3}, 1279 {5, 5}, 1280 {7, 7}, 1281 {0, 0} 1282 } 1283 }, 1284 {1, 1, 4, 0, /* 0xad */ 1285 {{0, 0}, 1286 {2, 3}, 1287 {5, 5}, 1288 {7, 7} 1289 } 1290 }, 1291 {0, 1, 3, 0, /* 0xae */ 1292 {{1, 3}, 1293 {5, 5}, 1294 {7, 7}, 1295 {0, 0} 1296 } 1297 }, 1298 {1, 1, 3, 0, /* 0xaf */ 1299 {{0, 3}, 1300 {5, 5}, 1301 {7, 7}, 1302 {0, 0} 1303 } 1304 }, 1305 {0, 1, 2, 0, /* 0xb0 */ 1306 {{4, 5}, 1307 {7, 7}, 1308 {0, 0}, 1309 {0, 0} 1310 } 1311 }, 1312 {1, 1, 3, 0, /* 0xb1 */ 1313 {{0, 0}, 1314 {4, 5}, 1315 {7, 7}, 1316 {0, 0} 1317 } 1318 }, 1319 {0, 1, 3, 0, /* 0xb2 */ 1320 {{1, 1}, 1321 {4, 5}, 1322 {7, 7}, 1323 {0, 0} 1324 } 1325 }, 1326 {1, 1, 3, 0, /* 0xb3 */ 1327 {{0, 1}, 1328 {4, 5}, 1329 {7, 7}, 1330 {0, 0} 1331 } 1332 }, 1333 {0, 1, 3, 0, /* 0xb4 */ 1334 {{2, 2}, 1335 {4, 5}, 1336 {7, 7}, 1337 {0, 0} 1338 } 1339 }, 1340 {1, 1, 4, 0, /* 0xb5 */ 1341 {{0, 0}, 1342 {2, 2}, 1343 {4, 5}, 1344 {7, 7} 1345 } 1346 }, 1347 {0, 1, 3, 0, /* 0xb6 */ 1348 {{1, 2}, 1349 {4, 5}, 1350 {7, 7}, 1351 {0, 0} 1352 } 1353 }, 1354 {1, 1, 3, 0, /* 0xb7 */ 1355 {{0, 2}, 1356 {4, 5}, 1357 {7, 7}, 1358 {0, 0} 1359 } 1360 }, 1361 {0, 1, 2, 0, /* 0xb8 */ 1362 {{3, 5}, 1363 {7, 7}, 1364 {0, 0}, 1365 {0, 0} 1366 } 1367 }, 1368 {1, 1, 3, 0, /* 0xb9 */ 1369 {{0, 0}, 1370 {3, 5}, 1371 {7, 7}, 1372 {0, 0} 1373 } 1374 }, 1375 {0, 1, 3, 0, /* 0xba */ 1376 {{1, 1}, 1377 {3, 5}, 1378 {7, 7}, 1379 {0, 0} 1380 } 1381 }, 1382 {1, 1, 3, 0, /* 0xbb */ 1383 {{0, 1}, 1384 {3, 5}, 1385 {7, 7}, 1386 {0, 0} 1387 } 1388 }, 1389 {0, 1, 2, 0, /* 0xbc */ 1390 {{2, 5}, 1391 {7, 7}, 1392 {0, 0}, 1393 {0, 0} 1394 } 1395 }, 1396 {1, 1, 3, 0, /* 0xbd */ 1397 {{0, 0}, 1398 {2, 5}, 1399 {7, 7}, 1400 {0, 0} 1401 } 1402 }, 1403 {0, 1, 2, 0, /* 0xbe */ 1404 {{1, 5}, 1405 {7, 7}, 1406 {0, 0}, 1407 {0, 0} 1408 } 1409 }, 1410 {1, 1, 2, 0, /* 0xbf */ 1411 {{0, 5}, 1412 {7, 7}, 1413 {0, 0}, 1414 {0, 0} 1415 } 1416 }, 1417 {0, 1, 1, 0, /* 0xc0 */ 1418 {{6, 7}, 1419 {0, 0}, 1420 {0, 0}, 1421 {0, 0} 1422 } 1423 }, 1424 {1, 1, 2, 0, /* 0xc1 */ 1425 {{0, 0}, 1426 {6, 7}, 1427 {0, 0}, 1428 {0, 0} 1429 } 1430 }, 1431 {0, 1, 2, 0, /* 0xc2 */ 1432 {{1, 1}, 1433 {6, 7}, 1434 {0, 0}, 1435 {0, 0} 1436 } 1437 }, 1438 {1, 1, 2, 0, /* 0xc3 */ 1439 {{0, 1}, 1440 {6, 7}, 1441 {0, 0}, 1442 {0, 0} 1443 } 1444 }, 1445 {0, 1, 2, 0, /* 0xc4 */ 1446 {{2, 2}, 1447 {6, 7}, 1448 {0, 0}, 1449 {0, 0} 1450 } 1451 }, 1452 {1, 1, 3, 0, /* 0xc5 */ 1453 {{0, 0}, 1454 {2, 2}, 1455 {6, 7}, 1456 {0, 0} 1457 } 1458 }, 1459 {0, 1, 2, 0, /* 0xc6 */ 1460 {{1, 2}, 1461 {6, 7}, 1462 {0, 0}, 1463 {0, 0} 1464 } 1465 }, 1466 {1, 1, 2, 0, /* 0xc7 */ 1467 {{0, 2}, 1468 {6, 7}, 1469 {0, 0}, 1470 {0, 0} 1471 } 1472 }, 1473 {0, 1, 2, 0, /* 0xc8 */ 1474 {{3, 3}, 1475 {6, 7}, 1476 {0, 0}, 1477 {0, 0} 1478 } 1479 }, 1480 {1, 1, 3, 0, /* 0xc9 */ 1481 {{0, 0}, 1482 {3, 3}, 1483 {6, 7}, 1484 {0, 0} 1485 } 1486 }, 1487 {0, 1, 3, 0, /* 0xca */ 1488 {{1, 1}, 1489 {3, 3}, 1490 {6, 7}, 1491 {0, 0} 1492 } 1493 }, 1494 {1, 1, 3, 0, /* 0xcb */ 1495 {{0, 1}, 1496 {3, 3}, 1497 {6, 7}, 1498 {0, 0} 1499 } 1500 }, 1501 {0, 1, 2, 0, /* 0xcc */ 1502 {{2, 3}, 1503 {6, 7}, 1504 {0, 0}, 1505 {0, 0} 1506 } 1507 }, 1508 {1, 1, 3, 0, /* 0xcd */ 1509 {{0, 0}, 1510 {2, 3}, 1511 {6, 7}, 1512 {0, 0} 1513 } 1514 }, 1515 {0, 1, 2, 0, /* 0xce */ 1516 {{1, 3}, 1517 {6, 7}, 1518 {0, 0}, 1519 {0, 0} 1520 } 1521 }, 1522 {1, 1, 2, 0, /* 0xcf */ 1523 {{0, 3}, 1524 {6, 7}, 1525 {0, 0}, 1526 {0, 0} 1527 } 1528 }, 1529 {0, 1, 2, 0, /* 0xd0 */ 1530 {{4, 4}, 1531 {6, 7}, 1532 {0, 0}, 1533 {0, 0} 1534 } 1535 }, 1536 {1, 1, 3, 0, /* 0xd1 */ 1537 {{0, 0}, 1538 {4, 4}, 1539 {6, 7}, 1540 {0, 0} 1541 } 1542 }, 1543 {0, 1, 3, 0, /* 0xd2 */ 1544 {{1, 1}, 1545 {4, 4}, 1546 {6, 7}, 1547 {0, 0} 1548 } 1549 }, 1550 {1, 1, 3, 0, /* 0xd3 */ 1551 {{0, 1}, 1552 {4, 4}, 1553 {6, 7}, 1554 {0, 0} 1555 } 1556 }, 1557 {0, 1, 3, 0, /* 0xd4 */ 1558 {{2, 2}, 1559 {4, 4}, 1560 {6, 7}, 1561 {0, 0} 1562 } 1563 }, 1564 {1, 1, 4, 0, /* 0xd5 */ 1565 {{0, 0}, 1566 {2, 2}, 1567 {4, 4}, 1568 {6, 7} 1569 } 1570 }, 1571 {0, 1, 3, 0, /* 0xd6 */ 1572 {{1, 2}, 1573 {4, 4}, 1574 {6, 7}, 1575 {0, 0} 1576 } 1577 }, 1578 {1, 1, 3, 0, /* 0xd7 */ 1579 {{0, 2}, 1580 {4, 4}, 1581 {6, 7}, 1582 {0, 0} 1583 } 1584 }, 1585 {0, 1, 2, 0, /* 0xd8 */ 1586 {{3, 4}, 1587 {6, 7}, 1588 {0, 0}, 1589 {0, 0} 1590 } 1591 }, 1592 {1, 1, 3, 0, /* 0xd9 */ 1593 {{0, 0}, 1594 {3, 4}, 1595 {6, 7}, 1596 {0, 0} 1597 } 1598 }, 1599 {0, 1, 3, 0, /* 0xda */ 1600 {{1, 1}, 1601 {3, 4}, 1602 {6, 7}, 1603 {0, 0} 1604 } 1605 }, 1606 {1, 1, 3, 0, /* 0xdb */ 1607 {{0, 1}, 1608 {3, 4}, 1609 {6, 7}, 1610 {0, 0} 1611 } 1612 }, 1613 {0, 1, 2, 0, /* 0xdc */ 1614 {{2, 4}, 1615 {6, 7}, 1616 {0, 0}, 1617 {0, 0} 1618 } 1619 }, 1620 {1, 1, 3, 0, /* 0xdd */ 1621 {{0, 0}, 1622 {2, 4}, 1623 {6, 7}, 1624 {0, 0} 1625 } 1626 }, 1627 {0, 1, 2, 0, /* 0xde */ 1628 {{1, 4}, 1629 {6, 7}, 1630 {0, 0}, 1631 {0, 0} 1632 } 1633 }, 1634 {1, 1, 2, 0, /* 0xdf */ 1635 {{0, 4}, 1636 {6, 7}, 1637 {0, 0}, 1638 {0, 0} 1639 } 1640 }, 1641 {0, 1, 1, 0, /* 0xe0 */ 1642 {{5, 7}, 1643 {0, 0}, 1644 {0, 0}, 1645 {0, 0} 1646 } 1647 }, 1648 {1, 1, 2, 0, /* 0xe1 */ 1649 {{0, 0}, 1650 {5, 7}, 1651 {0, 0}, 1652 {0, 0} 1653 } 1654 }, 1655 {0, 1, 2, 0, /* 0xe2 */ 1656 {{1, 1}, 1657 {5, 7}, 1658 {0, 0}, 1659 {0, 0} 1660 } 1661 }, 1662 {1, 1, 2, 0, /* 0xe3 */ 1663 {{0, 1}, 1664 {5, 7}, 1665 {0, 0}, 1666 {0, 0} 1667 } 1668 }, 1669 {0, 1, 2, 0, /* 0xe4 */ 1670 {{2, 2}, 1671 {5, 7}, 1672 {0, 0}, 1673 {0, 0} 1674 } 1675 }, 1676 {1, 1, 3, 0, /* 0xe5 */ 1677 {{0, 0}, 1678 {2, 2}, 1679 {5, 7}, 1680 {0, 0} 1681 } 1682 }, 1683 {0, 1, 2, 0, /* 0xe6 */ 1684 {{1, 2}, 1685 {5, 7}, 1686 {0, 0}, 1687 {0, 0} 1688 } 1689 }, 1690 {1, 1, 2, 0, /* 0xe7 */ 1691 {{0, 2}, 1692 {5, 7}, 1693 {0, 0}, 1694 {0, 0} 1695 } 1696 }, 1697 {0, 1, 2, 0, /* 0xe8 */ 1698 {{3, 3}, 1699 {5, 7}, 1700 {0, 0}, 1701 {0, 0} 1702 } 1703 }, 1704 {1, 1, 3, 0, /* 0xe9 */ 1705 {{0, 0}, 1706 {3, 3}, 1707 {5, 7}, 1708 {0, 0} 1709 } 1710 }, 1711 {0, 1, 3, 0, /* 0xea */ 1712 {{1, 1}, 1713 {3, 3}, 1714 {5, 7}, 1715 {0, 0} 1716 } 1717 }, 1718 {1, 1, 3, 0, /* 0xeb */ 1719 {{0, 1}, 1720 {3, 3}, 1721 {5, 7}, 1722 {0, 0} 1723 } 1724 }, 1725 {0, 1, 2, 0, /* 0xec */ 1726 {{2, 3}, 1727 {5, 7}, 1728 {0, 0}, 1729 {0, 0} 1730 } 1731 }, 1732 {1, 1, 3, 0, /* 0xed */ 1733 {{0, 0}, 1734 {2, 3}, 1735 {5, 7}, 1736 {0, 0} 1737 } 1738 }, 1739 {0, 1, 2, 0, /* 0xee */ 1740 {{1, 3}, 1741 {5, 7}, 1742 {0, 0}, 1743 {0, 0} 1744 } 1745 }, 1746 {1, 1, 2, 0, /* 0xef */ 1747 {{0, 3}, 1748 {5, 7}, 1749 {0, 0}, 1750 {0, 0} 1751 } 1752 }, 1753 {0, 1, 1, 0, /* 0xf0 */ 1754 {{4, 7}, 1755 {0, 0}, 1756 {0, 0}, 1757 {0, 0} 1758 } 1759 }, 1760 {1, 1, 2, 0, /* 0xf1 */ 1761 {{0, 0}, 1762 {4, 7}, 1763 {0, 0}, 1764 {0, 0} 1765 } 1766 }, 1767 {0, 1, 2, 0, /* 0xf2 */ 1768 {{1, 1}, 1769 {4, 7}, 1770 {0, 0}, 1771 {0, 0} 1772 } 1773 }, 1774 {1, 1, 2, 0, /* 0xf3 */ 1775 {{0, 1}, 1776 {4, 7}, 1777 {0, 0}, 1778 {0, 0} 1779 } 1780 }, 1781 {0, 1, 2, 0, /* 0xf4 */ 1782 {{2, 2}, 1783 {4, 7}, 1784 {0, 0}, 1785 {0, 0} 1786 } 1787 }, 1788 {1, 1, 3, 0, /* 0xf5 */ 1789 {{0, 0}, 1790 {2, 2}, 1791 {4, 7}, 1792 {0, 0} 1793 } 1794 }, 1795 {0, 1, 2, 0, /* 0xf6 */ 1796 {{1, 2}, 1797 {4, 7}, 1798 {0, 0}, 1799 {0, 0} 1800 } 1801 }, 1802 {1, 1, 2, 0, /* 0xf7 */ 1803 {{0, 2}, 1804 {4, 7}, 1805 {0, 0}, 1806 {0, 0} 1807 } 1808 }, 1809 {0, 1, 1, 0, /* 0xf8 */ 1810 {{3, 7}, 1811 {0, 0}, 1812 {0, 0}, 1813 {0, 0} 1814 } 1815 }, 1816 {1, 1, 2, 0, /* 0xf9 */ 1817 {{0, 0}, 1818 {3, 7}, 1819 {0, 0}, 1820 {0, 0} 1821 } 1822 }, 1823 {0, 1, 2, 0, /* 0xfa */ 1824 {{1, 1}, 1825 {3, 7}, 1826 {0, 0}, 1827 {0, 0} 1828 } 1829 }, 1830 {1, 1, 2, 0, /* 0xfb */ 1831 {{0, 1}, 1832 {3, 7}, 1833 {0, 0}, 1834 {0, 0} 1835 } 1836 }, 1837 {0, 1, 1, 0, /* 0xfc */ 1838 {{2, 7}, 1839 {0, 0}, 1840 {0, 0}, 1841 {0, 0} 1842 } 1843 }, 1844 {1, 1, 2, 0, /* 0xfd */ 1845 {{0, 0}, 1846 {2, 7}, 1847 {0, 0}, 1848 {0, 0} 1849 } 1850 }, 1851 {0, 1, 1, 0, /* 0xfe */ 1852 {{1, 7}, 1853 {0, 0}, 1854 {0, 0}, 1855 {0, 0} 1856 } 1857 }, 1858 {1, 1, 1, 0, /* 0xff */ 1859 {{0, 7}, 1860 {0, 0}, 1861 {0, 0}, 1862 {0, 0} 1863 } 1864 } 1865 }; 1866 1867 1868 int 1869 sctp_is_address_in_scope(struct sctp_ifa *ifa, 1870 struct sctp_scoping *scope, 1871 int do_update) 1872 { 1873 if ((scope->loopback_scope == 0) && 1874 (ifa->ifn_p) && SCTP_IFN_IS_IFT_LOOP(ifa->ifn_p)) { 1875 /* 1876 * skip loopback if not in scope * 1877 */ 1878 return (0); 1879 } 1880 switch (ifa->address.sa.sa_family) { 1881 #ifdef INET 1882 case AF_INET: 1883 if (scope->ipv4_addr_legal) { 1884 struct sockaddr_in *sin; 1885 1886 sin = &ifa->address.sin; 1887 if (sin->sin_addr.s_addr == 0) { 1888 /* not in scope , unspecified */ 1889 return (0); 1890 } 1891 if ((scope->ipv4_local_scope == 0) && 1892 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 1893 /* private address not in scope */ 1894 return (0); 1895 } 1896 } else { 1897 return (0); 1898 } 1899 break; 1900 #endif 1901 #ifdef INET6 1902 case AF_INET6: 1903 if (scope->ipv6_addr_legal) { 1904 struct sockaddr_in6 *sin6; 1905 1906 /* 1907 * Must update the flags, bummer, which means any 1908 * IFA locks must now be applied HERE <-> 1909 */ 1910 if (do_update) { 1911 sctp_gather_internal_ifa_flags(ifa); 1912 } 1913 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 1914 return (0); 1915 } 1916 /* ok to use deprecated addresses? */ 1917 sin6 = &ifa->address.sin6; 1918 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1919 /* skip unspecifed addresses */ 1920 return (0); 1921 } 1922 if ( /* (local_scope == 0) && */ 1923 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) { 1924 return (0); 1925 } 1926 if ((scope->site_scope == 0) && 1927 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 1928 return (0); 1929 } 1930 } else { 1931 return (0); 1932 } 1933 break; 1934 #endif 1935 default: 1936 return (0); 1937 } 1938 return (1); 1939 } 1940 1941 static struct mbuf * 1942 sctp_add_addr_to_mbuf(struct mbuf *m, struct sctp_ifa *ifa, uint16_t *len) 1943 { 1944 #if defined(INET) || defined(INET6) 1945 struct sctp_paramhdr *paramh; 1946 struct mbuf *mret; 1947 uint16_t plen; 1948 #endif 1949 1950 switch (ifa->address.sa.sa_family) { 1951 #ifdef INET 1952 case AF_INET: 1953 plen = (uint16_t)sizeof(struct sctp_ipv4addr_param); 1954 break; 1955 #endif 1956 #ifdef INET6 1957 case AF_INET6: 1958 plen = (uint16_t)sizeof(struct sctp_ipv6addr_param); 1959 break; 1960 #endif 1961 default: 1962 return (m); 1963 } 1964 #if defined(INET) || defined(INET6) 1965 if (M_TRAILINGSPACE(m) >= plen) { 1966 /* easy side we just drop it on the end */ 1967 paramh = (struct sctp_paramhdr *)(SCTP_BUF_AT(m, SCTP_BUF_LEN(m))); 1968 mret = m; 1969 } else { 1970 /* Need more space */ 1971 mret = m; 1972 while (SCTP_BUF_NEXT(mret) != NULL) { 1973 mret = SCTP_BUF_NEXT(mret); 1974 } 1975 SCTP_BUF_NEXT(mret) = sctp_get_mbuf_for_msg(plen, 0, M_NOWAIT, 1, MT_DATA); 1976 if (SCTP_BUF_NEXT(mret) == NULL) { 1977 /* We are hosed, can't add more addresses */ 1978 return (m); 1979 } 1980 mret = SCTP_BUF_NEXT(mret); 1981 paramh = mtod(mret, struct sctp_paramhdr *); 1982 } 1983 /* now add the parameter */ 1984 switch (ifa->address.sa.sa_family) { 1985 #ifdef INET 1986 case AF_INET: 1987 { 1988 struct sctp_ipv4addr_param *ipv4p; 1989 struct sockaddr_in *sin; 1990 1991 sin = &ifa->address.sin; 1992 ipv4p = (struct sctp_ipv4addr_param *)paramh; 1993 paramh->param_type = htons(SCTP_IPV4_ADDRESS); 1994 paramh->param_length = htons(plen); 1995 ipv4p->addr = sin->sin_addr.s_addr; 1996 SCTP_BUF_LEN(mret) += plen; 1997 break; 1998 } 1999 #endif 2000 #ifdef INET6 2001 case AF_INET6: 2002 { 2003 struct sctp_ipv6addr_param *ipv6p; 2004 struct sockaddr_in6 *sin6; 2005 2006 sin6 = &ifa->address.sin6; 2007 ipv6p = (struct sctp_ipv6addr_param *)paramh; 2008 paramh->param_type = htons(SCTP_IPV6_ADDRESS); 2009 paramh->param_length = htons(plen); 2010 memcpy(ipv6p->addr, &sin6->sin6_addr, 2011 sizeof(ipv6p->addr)); 2012 /* clear embedded scope in the address */ 2013 in6_clearscope((struct in6_addr *)ipv6p->addr); 2014 SCTP_BUF_LEN(mret) += plen; 2015 break; 2016 } 2017 #endif 2018 default: 2019 return (m); 2020 } 2021 if (len != NULL) { 2022 *len += plen; 2023 } 2024 return (mret); 2025 #endif 2026 } 2027 2028 2029 struct mbuf * 2030 sctp_add_addresses_to_i_ia(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2031 struct sctp_scoping *scope, 2032 struct mbuf *m_at, int cnt_inits_to, 2033 uint16_t *padding_len, uint16_t *chunk_len) 2034 { 2035 struct sctp_vrf *vrf = NULL; 2036 int cnt, limit_out = 0, total_count; 2037 uint32_t vrf_id; 2038 2039 vrf_id = inp->def_vrf_id; 2040 SCTP_IPI_ADDR_RLOCK(); 2041 vrf = sctp_find_vrf(vrf_id); 2042 if (vrf == NULL) { 2043 SCTP_IPI_ADDR_RUNLOCK(); 2044 return (m_at); 2045 } 2046 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 2047 struct sctp_ifa *sctp_ifap; 2048 struct sctp_ifn *sctp_ifnp; 2049 2050 cnt = cnt_inits_to; 2051 if (vrf->total_ifa_count > SCTP_COUNT_LIMIT) { 2052 limit_out = 1; 2053 cnt = SCTP_ADDRESS_LIMIT; 2054 goto skip_count; 2055 } 2056 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2057 if ((scope->loopback_scope == 0) && 2058 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2059 /* 2060 * Skip loopback devices if loopback_scope 2061 * not set 2062 */ 2063 continue; 2064 } 2065 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2066 #ifdef INET 2067 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2068 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2069 &sctp_ifap->address.sin.sin_addr) != 0)) { 2070 continue; 2071 } 2072 #endif 2073 #ifdef INET6 2074 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2075 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2076 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2077 continue; 2078 } 2079 #endif 2080 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2081 continue; 2082 } 2083 if (sctp_is_address_in_scope(sctp_ifap, scope, 1) == 0) { 2084 continue; 2085 } 2086 cnt++; 2087 if (cnt > SCTP_ADDRESS_LIMIT) { 2088 break; 2089 } 2090 } 2091 if (cnt > SCTP_ADDRESS_LIMIT) { 2092 break; 2093 } 2094 } 2095 skip_count: 2096 if (cnt > 1) { 2097 total_count = 0; 2098 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2099 cnt = 0; 2100 if ((scope->loopback_scope == 0) && 2101 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2102 /* 2103 * Skip loopback devices if 2104 * loopback_scope not set 2105 */ 2106 continue; 2107 } 2108 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2109 #ifdef INET 2110 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2111 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2112 &sctp_ifap->address.sin.sin_addr) != 0)) { 2113 continue; 2114 } 2115 #endif 2116 #ifdef INET6 2117 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2118 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2119 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2120 continue; 2121 } 2122 #endif 2123 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2124 continue; 2125 } 2126 if (sctp_is_address_in_scope(sctp_ifap, 2127 scope, 0) == 0) { 2128 continue; 2129 } 2130 if ((chunk_len != NULL) && 2131 (padding_len != NULL) && 2132 (*padding_len > 0)) { 2133 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2134 SCTP_BUF_LEN(m_at) += *padding_len; 2135 *chunk_len += *padding_len; 2136 *padding_len = 0; 2137 } 2138 m_at = sctp_add_addr_to_mbuf(m_at, sctp_ifap, chunk_len); 2139 if (limit_out) { 2140 cnt++; 2141 total_count++; 2142 if (cnt >= 2) { 2143 /* 2144 * two from each 2145 * address 2146 */ 2147 break; 2148 } 2149 if (total_count > SCTP_ADDRESS_LIMIT) { 2150 /* No more addresses */ 2151 break; 2152 } 2153 } 2154 } 2155 } 2156 } 2157 } else { 2158 struct sctp_laddr *laddr; 2159 2160 cnt = cnt_inits_to; 2161 /* First, how many ? */ 2162 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2163 if (laddr->ifa == NULL) { 2164 continue; 2165 } 2166 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) 2167 /* 2168 * Address being deleted by the system, dont 2169 * list. 2170 */ 2171 continue; 2172 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2173 /* 2174 * Address being deleted on this ep don't 2175 * list. 2176 */ 2177 continue; 2178 } 2179 if (sctp_is_address_in_scope(laddr->ifa, 2180 scope, 1) == 0) { 2181 continue; 2182 } 2183 cnt++; 2184 } 2185 /* 2186 * To get through a NAT we only list addresses if we have 2187 * more than one. That way if you just bind a single address 2188 * we let the source of the init dictate our address. 2189 */ 2190 if (cnt > 1) { 2191 cnt = cnt_inits_to; 2192 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2193 if (laddr->ifa == NULL) { 2194 continue; 2195 } 2196 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) { 2197 continue; 2198 } 2199 if (sctp_is_address_in_scope(laddr->ifa, 2200 scope, 0) == 0) { 2201 continue; 2202 } 2203 if ((chunk_len != NULL) && 2204 (padding_len != NULL) && 2205 (*padding_len > 0)) { 2206 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2207 SCTP_BUF_LEN(m_at) += *padding_len; 2208 *chunk_len += *padding_len; 2209 *padding_len = 0; 2210 } 2211 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa, chunk_len); 2212 cnt++; 2213 if (cnt >= SCTP_ADDRESS_LIMIT) { 2214 break; 2215 } 2216 } 2217 } 2218 } 2219 SCTP_IPI_ADDR_RUNLOCK(); 2220 return (m_at); 2221 } 2222 2223 static struct sctp_ifa * 2224 sctp_is_ifa_addr_preferred(struct sctp_ifa *ifa, 2225 uint8_t dest_is_loop, 2226 uint8_t dest_is_priv, 2227 sa_family_t fam) 2228 { 2229 uint8_t dest_is_global = 0; 2230 2231 /* dest_is_priv is true if destination is a private address */ 2232 /* dest_is_loop is true if destination is a loopback addresses */ 2233 2234 /** 2235 * Here we determine if its a preferred address. A preferred address 2236 * means it is the same scope or higher scope then the destination. 2237 * L = loopback, P = private, G = global 2238 * ----------------------------------------- 2239 * src | dest | result 2240 * ---------------------------------------- 2241 * L | L | yes 2242 * ----------------------------------------- 2243 * P | L | yes-v4 no-v6 2244 * ----------------------------------------- 2245 * G | L | yes-v4 no-v6 2246 * ----------------------------------------- 2247 * L | P | no 2248 * ----------------------------------------- 2249 * P | P | yes 2250 * ----------------------------------------- 2251 * G | P | no 2252 * ----------------------------------------- 2253 * L | G | no 2254 * ----------------------------------------- 2255 * P | G | no 2256 * ----------------------------------------- 2257 * G | G | yes 2258 * ----------------------------------------- 2259 */ 2260 2261 if (ifa->address.sa.sa_family != fam) { 2262 /* forget mis-matched family */ 2263 return (NULL); 2264 } 2265 if ((dest_is_priv == 0) && (dest_is_loop == 0)) { 2266 dest_is_global = 1; 2267 } 2268 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Is destination preferred:"); 2269 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ifa->address.sa); 2270 /* Ok the address may be ok */ 2271 #ifdef INET6 2272 if (fam == AF_INET6) { 2273 /* ok to use deprecated addresses? no lets not! */ 2274 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2275 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:1\n"); 2276 return (NULL); 2277 } 2278 if (ifa->src_is_priv && !ifa->src_is_loop) { 2279 if (dest_is_loop) { 2280 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:2\n"); 2281 return (NULL); 2282 } 2283 } 2284 if (ifa->src_is_glob) { 2285 if (dest_is_loop) { 2286 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:3\n"); 2287 return (NULL); 2288 } 2289 } 2290 } 2291 #endif 2292 /* 2293 * Now that we know what is what, implement or table this could in 2294 * theory be done slicker (it used to be), but this is 2295 * straightforward and easier to validate :-) 2296 */ 2297 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src_loop:%d src_priv:%d src_glob:%d\n", 2298 ifa->src_is_loop, ifa->src_is_priv, ifa->src_is_glob); 2299 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dest_loop:%d dest_priv:%d dest_glob:%d\n", 2300 dest_is_loop, dest_is_priv, dest_is_global); 2301 2302 if ((ifa->src_is_loop) && (dest_is_priv)) { 2303 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:4\n"); 2304 return (NULL); 2305 } 2306 if ((ifa->src_is_glob) && (dest_is_priv)) { 2307 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:5\n"); 2308 return (NULL); 2309 } 2310 if ((ifa->src_is_loop) && (dest_is_global)) { 2311 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:6\n"); 2312 return (NULL); 2313 } 2314 if ((ifa->src_is_priv) && (dest_is_global)) { 2315 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:7\n"); 2316 return (NULL); 2317 } 2318 SCTPDBG(SCTP_DEBUG_OUTPUT3, "YES\n"); 2319 /* its a preferred address */ 2320 return (ifa); 2321 } 2322 2323 static struct sctp_ifa * 2324 sctp_is_ifa_addr_acceptable(struct sctp_ifa *ifa, 2325 uint8_t dest_is_loop, 2326 uint8_t dest_is_priv, 2327 sa_family_t fam) 2328 { 2329 uint8_t dest_is_global = 0; 2330 2331 /** 2332 * Here we determine if its a acceptable address. A acceptable 2333 * address means it is the same scope or higher scope but we can 2334 * allow for NAT which means its ok to have a global dest and a 2335 * private src. 2336 * 2337 * L = loopback, P = private, G = global 2338 * ----------------------------------------- 2339 * src | dest | result 2340 * ----------------------------------------- 2341 * L | L | yes 2342 * ----------------------------------------- 2343 * P | L | yes-v4 no-v6 2344 * ----------------------------------------- 2345 * G | L | yes 2346 * ----------------------------------------- 2347 * L | P | no 2348 * ----------------------------------------- 2349 * P | P | yes 2350 * ----------------------------------------- 2351 * G | P | yes - May not work 2352 * ----------------------------------------- 2353 * L | G | no 2354 * ----------------------------------------- 2355 * P | G | yes - May not work 2356 * ----------------------------------------- 2357 * G | G | yes 2358 * ----------------------------------------- 2359 */ 2360 2361 if (ifa->address.sa.sa_family != fam) { 2362 /* forget non matching family */ 2363 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa_fam:%d fam:%d\n", 2364 ifa->address.sa.sa_family, fam); 2365 return (NULL); 2366 } 2367 /* Ok the address may be ok */ 2368 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, &ifa->address.sa); 2369 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst_is_loop:%d dest_is_priv:%d\n", 2370 dest_is_loop, dest_is_priv); 2371 if ((dest_is_loop == 0) && (dest_is_priv == 0)) { 2372 dest_is_global = 1; 2373 } 2374 #ifdef INET6 2375 if (fam == AF_INET6) { 2376 /* ok to use deprecated addresses? */ 2377 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2378 return (NULL); 2379 } 2380 if (ifa->src_is_priv) { 2381 /* Special case, linklocal to loop */ 2382 if (dest_is_loop) 2383 return (NULL); 2384 } 2385 } 2386 #endif 2387 /* 2388 * Now that we know what is what, implement our table. This could in 2389 * theory be done slicker (it used to be), but this is 2390 * straightforward and easier to validate :-) 2391 */ 2392 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_priv:%d\n", 2393 ifa->src_is_loop, 2394 dest_is_priv); 2395 if ((ifa->src_is_loop == 1) && (dest_is_priv)) { 2396 return (NULL); 2397 } 2398 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_glob:%d\n", 2399 ifa->src_is_loop, 2400 dest_is_global); 2401 if ((ifa->src_is_loop == 1) && (dest_is_global)) { 2402 return (NULL); 2403 } 2404 SCTPDBG(SCTP_DEBUG_OUTPUT3, "address is acceptable\n"); 2405 /* its an acceptable address */ 2406 return (ifa); 2407 } 2408 2409 int 2410 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa) 2411 { 2412 struct sctp_laddr *laddr; 2413 2414 if (stcb == NULL) { 2415 /* There are no restrictions, no TCB :-) */ 2416 return (0); 2417 } 2418 LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) { 2419 if (laddr->ifa == NULL) { 2420 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2421 __func__); 2422 continue; 2423 } 2424 if (laddr->ifa == ifa) { 2425 /* Yes it is on the list */ 2426 return (1); 2427 } 2428 } 2429 return (0); 2430 } 2431 2432 2433 int 2434 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa) 2435 { 2436 struct sctp_laddr *laddr; 2437 2438 if (ifa == NULL) 2439 return (0); 2440 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2441 if (laddr->ifa == NULL) { 2442 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2443 __func__); 2444 continue; 2445 } 2446 if ((laddr->ifa == ifa) && laddr->action == 0) 2447 /* same pointer */ 2448 return (1); 2449 } 2450 return (0); 2451 } 2452 2453 2454 2455 static struct sctp_ifa * 2456 sctp_choose_boundspecific_inp(struct sctp_inpcb *inp, 2457 sctp_route_t *ro, 2458 uint32_t vrf_id, 2459 int non_asoc_addr_ok, 2460 uint8_t dest_is_priv, 2461 uint8_t dest_is_loop, 2462 sa_family_t fam) 2463 { 2464 struct sctp_laddr *laddr, *starting_point; 2465 void *ifn; 2466 int resettotop = 0; 2467 struct sctp_ifn *sctp_ifn; 2468 struct sctp_ifa *sctp_ifa, *sifa; 2469 struct sctp_vrf *vrf; 2470 uint32_t ifn_index; 2471 2472 vrf = sctp_find_vrf(vrf_id); 2473 if (vrf == NULL) 2474 return (NULL); 2475 2476 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2477 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2478 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2479 /* 2480 * first question, is the ifn we will emit on in our list, if so, we 2481 * want such an address. Note that we first looked for a preferred 2482 * address. 2483 */ 2484 if (sctp_ifn) { 2485 /* is a preferred one on the interface we route out? */ 2486 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2487 #ifdef INET 2488 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2489 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2490 &sctp_ifa->address.sin.sin_addr) != 0)) { 2491 continue; 2492 } 2493 #endif 2494 #ifdef INET6 2495 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2496 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2497 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2498 continue; 2499 } 2500 #endif 2501 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2502 (non_asoc_addr_ok == 0)) 2503 continue; 2504 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, 2505 dest_is_loop, 2506 dest_is_priv, fam); 2507 if (sifa == NULL) 2508 continue; 2509 if (sctp_is_addr_in_ep(inp, sifa)) { 2510 atomic_add_int(&sifa->refcount, 1); 2511 return (sifa); 2512 } 2513 } 2514 } 2515 /* 2516 * ok, now we now need to find one on the list of the addresses. We 2517 * can't get one on the emitting interface so let's find first a 2518 * preferred one. If not that an acceptable one otherwise... we 2519 * return NULL. 2520 */ 2521 starting_point = inp->next_addr_touse; 2522 once_again: 2523 if (inp->next_addr_touse == NULL) { 2524 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2525 resettotop = 1; 2526 } 2527 for (laddr = inp->next_addr_touse; laddr; 2528 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2529 if (laddr->ifa == NULL) { 2530 /* address has been removed */ 2531 continue; 2532 } 2533 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2534 /* address is being deleted */ 2535 continue; 2536 } 2537 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, 2538 dest_is_priv, fam); 2539 if (sifa == NULL) 2540 continue; 2541 atomic_add_int(&sifa->refcount, 1); 2542 return (sifa); 2543 } 2544 if (resettotop == 0) { 2545 inp->next_addr_touse = NULL; 2546 goto once_again; 2547 } 2548 2549 inp->next_addr_touse = starting_point; 2550 resettotop = 0; 2551 once_again_too: 2552 if (inp->next_addr_touse == NULL) { 2553 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2554 resettotop = 1; 2555 } 2556 2557 /* ok, what about an acceptable address in the inp */ 2558 for (laddr = inp->next_addr_touse; laddr; 2559 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2560 if (laddr->ifa == NULL) { 2561 /* address has been removed */ 2562 continue; 2563 } 2564 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2565 /* address is being deleted */ 2566 continue; 2567 } 2568 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2569 dest_is_priv, fam); 2570 if (sifa == NULL) 2571 continue; 2572 atomic_add_int(&sifa->refcount, 1); 2573 return (sifa); 2574 } 2575 if (resettotop == 0) { 2576 inp->next_addr_touse = NULL; 2577 goto once_again_too; 2578 } 2579 2580 /* 2581 * no address bound can be a source for the destination we are in 2582 * trouble 2583 */ 2584 return (NULL); 2585 } 2586 2587 2588 2589 static struct sctp_ifa * 2590 sctp_choose_boundspecific_stcb(struct sctp_inpcb *inp, 2591 struct sctp_tcb *stcb, 2592 sctp_route_t *ro, 2593 uint32_t vrf_id, 2594 uint8_t dest_is_priv, 2595 uint8_t dest_is_loop, 2596 int non_asoc_addr_ok, 2597 sa_family_t fam) 2598 { 2599 struct sctp_laddr *laddr, *starting_point; 2600 void *ifn; 2601 struct sctp_ifn *sctp_ifn; 2602 struct sctp_ifa *sctp_ifa, *sifa; 2603 uint8_t start_at_beginning = 0; 2604 struct sctp_vrf *vrf; 2605 uint32_t ifn_index; 2606 2607 /* 2608 * first question, is the ifn we will emit on in our list, if so, we 2609 * want that one. 2610 */ 2611 vrf = sctp_find_vrf(vrf_id); 2612 if (vrf == NULL) 2613 return (NULL); 2614 2615 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2616 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2617 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2618 2619 /* 2620 * first question, is the ifn we will emit on in our list? If so, 2621 * we want that one. First we look for a preferred. Second, we go 2622 * for an acceptable. 2623 */ 2624 if (sctp_ifn) { 2625 /* first try for a preferred address on the ep */ 2626 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2627 #ifdef INET 2628 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2629 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2630 &sctp_ifa->address.sin.sin_addr) != 0)) { 2631 continue; 2632 } 2633 #endif 2634 #ifdef INET6 2635 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2636 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2637 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2638 continue; 2639 } 2640 #endif 2641 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2642 continue; 2643 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2644 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2645 if (sifa == NULL) 2646 continue; 2647 if (((non_asoc_addr_ok == 0) && 2648 (sctp_is_addr_restricted(stcb, sifa))) || 2649 (non_asoc_addr_ok && 2650 (sctp_is_addr_restricted(stcb, sifa)) && 2651 (!sctp_is_addr_pending(stcb, sifa)))) { 2652 /* on the no-no list */ 2653 continue; 2654 } 2655 atomic_add_int(&sifa->refcount, 1); 2656 return (sifa); 2657 } 2658 } 2659 /* next try for an acceptable address on the ep */ 2660 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2661 #ifdef INET 2662 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2663 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2664 &sctp_ifa->address.sin.sin_addr) != 0)) { 2665 continue; 2666 } 2667 #endif 2668 #ifdef INET6 2669 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2670 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2671 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2672 continue; 2673 } 2674 #endif 2675 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2676 continue; 2677 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2678 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2679 if (sifa == NULL) 2680 continue; 2681 if (((non_asoc_addr_ok == 0) && 2682 (sctp_is_addr_restricted(stcb, sifa))) || 2683 (non_asoc_addr_ok && 2684 (sctp_is_addr_restricted(stcb, sifa)) && 2685 (!sctp_is_addr_pending(stcb, sifa)))) { 2686 /* on the no-no list */ 2687 continue; 2688 } 2689 atomic_add_int(&sifa->refcount, 1); 2690 return (sifa); 2691 } 2692 } 2693 2694 } 2695 /* 2696 * if we can't find one like that then we must look at all addresses 2697 * bound to pick one at first preferable then secondly acceptable. 2698 */ 2699 starting_point = stcb->asoc.last_used_address; 2700 sctp_from_the_top: 2701 if (stcb->asoc.last_used_address == NULL) { 2702 start_at_beginning = 1; 2703 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2704 } 2705 /* search beginning with the last used address */ 2706 for (laddr = stcb->asoc.last_used_address; laddr; 2707 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2708 if (laddr->ifa == NULL) { 2709 /* address has been removed */ 2710 continue; 2711 } 2712 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2713 /* address is being deleted */ 2714 continue; 2715 } 2716 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, dest_is_priv, fam); 2717 if (sifa == NULL) 2718 continue; 2719 if (((non_asoc_addr_ok == 0) && 2720 (sctp_is_addr_restricted(stcb, sifa))) || 2721 (non_asoc_addr_ok && 2722 (sctp_is_addr_restricted(stcb, sifa)) && 2723 (!sctp_is_addr_pending(stcb, sifa)))) { 2724 /* on the no-no list */ 2725 continue; 2726 } 2727 stcb->asoc.last_used_address = laddr; 2728 atomic_add_int(&sifa->refcount, 1); 2729 return (sifa); 2730 } 2731 if (start_at_beginning == 0) { 2732 stcb->asoc.last_used_address = NULL; 2733 goto sctp_from_the_top; 2734 } 2735 /* now try for any higher scope than the destination */ 2736 stcb->asoc.last_used_address = starting_point; 2737 start_at_beginning = 0; 2738 sctp_from_the_top2: 2739 if (stcb->asoc.last_used_address == NULL) { 2740 start_at_beginning = 1; 2741 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2742 } 2743 /* search beginning with the last used address */ 2744 for (laddr = stcb->asoc.last_used_address; laddr; 2745 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2746 if (laddr->ifa == NULL) { 2747 /* address has been removed */ 2748 continue; 2749 } 2750 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2751 /* address is being deleted */ 2752 continue; 2753 } 2754 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2755 dest_is_priv, fam); 2756 if (sifa == NULL) 2757 continue; 2758 if (((non_asoc_addr_ok == 0) && 2759 (sctp_is_addr_restricted(stcb, sifa))) || 2760 (non_asoc_addr_ok && 2761 (sctp_is_addr_restricted(stcb, sifa)) && 2762 (!sctp_is_addr_pending(stcb, sifa)))) { 2763 /* on the no-no list */ 2764 continue; 2765 } 2766 stcb->asoc.last_used_address = laddr; 2767 atomic_add_int(&sifa->refcount, 1); 2768 return (sifa); 2769 } 2770 if (start_at_beginning == 0) { 2771 stcb->asoc.last_used_address = NULL; 2772 goto sctp_from_the_top2; 2773 } 2774 return (NULL); 2775 } 2776 2777 static struct sctp_ifa * 2778 sctp_select_nth_preferred_addr_from_ifn_boundall(struct sctp_ifn *ifn, 2779 struct sctp_inpcb *inp, 2780 struct sctp_tcb *stcb, 2781 int non_asoc_addr_ok, 2782 uint8_t dest_is_loop, 2783 uint8_t dest_is_priv, 2784 int addr_wanted, 2785 sa_family_t fam, 2786 sctp_route_t *ro 2787 ) 2788 { 2789 struct sctp_ifa *ifa, *sifa; 2790 int num_eligible_addr = 0; 2791 #ifdef INET6 2792 struct sockaddr_in6 sin6, lsa6; 2793 2794 if (fam == AF_INET6) { 2795 memcpy(&sin6, &ro->ro_dst, sizeof(struct sockaddr_in6)); 2796 (void)sa6_recoverscope(&sin6); 2797 } 2798 #endif /* INET6 */ 2799 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2800 #ifdef INET 2801 if ((ifa->address.sa.sa_family == AF_INET) && 2802 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2803 &ifa->address.sin.sin_addr) != 0)) { 2804 continue; 2805 } 2806 #endif 2807 #ifdef INET6 2808 if ((ifa->address.sa.sa_family == AF_INET6) && 2809 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2810 &ifa->address.sin6.sin6_addr) != 0)) { 2811 continue; 2812 } 2813 #endif 2814 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2815 (non_asoc_addr_ok == 0)) 2816 continue; 2817 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2818 dest_is_priv, fam); 2819 if (sifa == NULL) 2820 continue; 2821 #ifdef INET6 2822 if (fam == AF_INET6 && 2823 dest_is_loop && 2824 sifa->src_is_loop && sifa->src_is_priv) { 2825 /* 2826 * don't allow fe80::1 to be a src on loop ::1, we 2827 * don't list it to the peer so we will get an 2828 * abort. 2829 */ 2830 continue; 2831 } 2832 if (fam == AF_INET6 && 2833 IN6_IS_ADDR_LINKLOCAL(&sifa->address.sin6.sin6_addr) && 2834 IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) { 2835 /* 2836 * link-local <-> link-local must belong to the same 2837 * scope. 2838 */ 2839 memcpy(&lsa6, &sifa->address.sin6, sizeof(struct sockaddr_in6)); 2840 (void)sa6_recoverscope(&lsa6); 2841 if (sin6.sin6_scope_id != lsa6.sin6_scope_id) { 2842 continue; 2843 } 2844 } 2845 #endif /* INET6 */ 2846 2847 /* 2848 * Check if the IPv6 address matches to next-hop. In the 2849 * mobile case, old IPv6 address may be not deleted from the 2850 * interface. Then, the interface has previous and new 2851 * addresses. We should use one corresponding to the 2852 * next-hop. (by micchie) 2853 */ 2854 #ifdef INET6 2855 if (stcb && fam == AF_INET6 && 2856 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2857 if (sctp_v6src_match_nexthop(&sifa->address.sin6, ro) 2858 == 0) { 2859 continue; 2860 } 2861 } 2862 #endif 2863 #ifdef INET 2864 /* Avoid topologically incorrect IPv4 address */ 2865 if (stcb && fam == AF_INET && 2866 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2867 if (sctp_v4src_match_nexthop(sifa, ro) == 0) { 2868 continue; 2869 } 2870 } 2871 #endif 2872 if (stcb) { 2873 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2874 continue; 2875 } 2876 if (((non_asoc_addr_ok == 0) && 2877 (sctp_is_addr_restricted(stcb, sifa))) || 2878 (non_asoc_addr_ok && 2879 (sctp_is_addr_restricted(stcb, sifa)) && 2880 (!sctp_is_addr_pending(stcb, sifa)))) { 2881 /* 2882 * It is restricted for some reason.. 2883 * probably not yet added. 2884 */ 2885 continue; 2886 } 2887 } 2888 if (num_eligible_addr >= addr_wanted) { 2889 return (sifa); 2890 } 2891 num_eligible_addr++; 2892 } 2893 return (NULL); 2894 } 2895 2896 2897 static int 2898 sctp_count_num_preferred_boundall(struct sctp_ifn *ifn, 2899 struct sctp_inpcb *inp, 2900 struct sctp_tcb *stcb, 2901 int non_asoc_addr_ok, 2902 uint8_t dest_is_loop, 2903 uint8_t dest_is_priv, 2904 sa_family_t fam) 2905 { 2906 struct sctp_ifa *ifa, *sifa; 2907 int num_eligible_addr = 0; 2908 2909 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2910 #ifdef INET 2911 if ((ifa->address.sa.sa_family == AF_INET) && 2912 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2913 &ifa->address.sin.sin_addr) != 0)) { 2914 continue; 2915 } 2916 #endif 2917 #ifdef INET6 2918 if ((ifa->address.sa.sa_family == AF_INET6) && 2919 (stcb != NULL) && 2920 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2921 &ifa->address.sin6.sin6_addr) != 0)) { 2922 continue; 2923 } 2924 #endif 2925 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2926 (non_asoc_addr_ok == 0)) { 2927 continue; 2928 } 2929 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2930 dest_is_priv, fam); 2931 if (sifa == NULL) { 2932 continue; 2933 } 2934 if (stcb) { 2935 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2936 continue; 2937 } 2938 if (((non_asoc_addr_ok == 0) && 2939 (sctp_is_addr_restricted(stcb, sifa))) || 2940 (non_asoc_addr_ok && 2941 (sctp_is_addr_restricted(stcb, sifa)) && 2942 (!sctp_is_addr_pending(stcb, sifa)))) { 2943 /* 2944 * It is restricted for some reason.. 2945 * probably not yet added. 2946 */ 2947 continue; 2948 } 2949 } 2950 num_eligible_addr++; 2951 } 2952 return (num_eligible_addr); 2953 } 2954 2955 static struct sctp_ifa * 2956 sctp_choose_boundall(struct sctp_inpcb *inp, 2957 struct sctp_tcb *stcb, 2958 struct sctp_nets *net, 2959 sctp_route_t *ro, 2960 uint32_t vrf_id, 2961 uint8_t dest_is_priv, 2962 uint8_t dest_is_loop, 2963 int non_asoc_addr_ok, 2964 sa_family_t fam) 2965 { 2966 int cur_addr_num = 0, num_preferred = 0; 2967 void *ifn; 2968 struct sctp_ifn *sctp_ifn, *looked_at = NULL, *emit_ifn; 2969 struct sctp_ifa *sctp_ifa, *sifa; 2970 uint32_t ifn_index; 2971 struct sctp_vrf *vrf; 2972 #ifdef INET 2973 int retried = 0; 2974 #endif 2975 2976 /*- 2977 * For boundall we can use any address in the association. 2978 * If non_asoc_addr_ok is set we can use any address (at least in 2979 * theory). So we look for preferred addresses first. If we find one, 2980 * we use it. Otherwise we next try to get an address on the 2981 * interface, which we should be able to do (unless non_asoc_addr_ok 2982 * is false and we are routed out that way). In these cases where we 2983 * can't use the address of the interface we go through all the 2984 * ifn's looking for an address we can use and fill that in. Punting 2985 * means we send back address 0, which will probably cause problems 2986 * actually since then IP will fill in the address of the route ifn, 2987 * which means we probably already rejected it.. i.e. here comes an 2988 * abort :-<. 2989 */ 2990 vrf = sctp_find_vrf(vrf_id); 2991 if (vrf == NULL) 2992 return (NULL); 2993 2994 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2995 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2996 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn from route:%p ifn_index:%d\n", ifn, ifn_index); 2997 emit_ifn = looked_at = sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2998 if (sctp_ifn == NULL) { 2999 /* ?? We don't have this guy ?? */ 3000 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No ifn emit interface?\n"); 3001 goto bound_all_plan_b; 3002 } 3003 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn_index:%d name:%s is emit interface\n", 3004 ifn_index, sctp_ifn->ifn_name); 3005 3006 if (net) { 3007 cur_addr_num = net->indx_of_eligible_next_to_use; 3008 } 3009 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, 3010 inp, stcb, 3011 non_asoc_addr_ok, 3012 dest_is_loop, 3013 dest_is_priv, fam); 3014 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Found %d preferred source addresses for intf:%s\n", 3015 num_preferred, sctp_ifn->ifn_name); 3016 if (num_preferred == 0) { 3017 /* 3018 * no eligible addresses, we must use some other interface 3019 * address if we can find one. 3020 */ 3021 goto bound_all_plan_b; 3022 } 3023 /* 3024 * Ok we have num_eligible_addr set with how many we can use, this 3025 * may vary from call to call due to addresses being deprecated 3026 * etc.. 3027 */ 3028 if (cur_addr_num >= num_preferred) { 3029 cur_addr_num = 0; 3030 } 3031 /* 3032 * select the nth address from the list (where cur_addr_num is the 3033 * nth) and 0 is the first one, 1 is the second one etc... 3034 */ 3035 SCTPDBG(SCTP_DEBUG_OUTPUT2, "cur_addr_num:%d\n", cur_addr_num); 3036 3037 sctp_ifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3038 dest_is_priv, cur_addr_num, fam, ro); 3039 3040 /* if sctp_ifa is NULL something changed??, fall to plan b. */ 3041 if (sctp_ifa) { 3042 atomic_add_int(&sctp_ifa->refcount, 1); 3043 if (net) { 3044 /* save off where the next one we will want */ 3045 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3046 } 3047 return (sctp_ifa); 3048 } 3049 /* 3050 * plan_b: Look at all interfaces and find a preferred address. If 3051 * no preferred fall through to plan_c. 3052 */ 3053 bound_all_plan_b: 3054 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan B\n"); 3055 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3056 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Examine interface %s\n", 3057 sctp_ifn->ifn_name); 3058 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3059 /* wrong base scope */ 3060 SCTPDBG(SCTP_DEBUG_OUTPUT2, "skip\n"); 3061 continue; 3062 } 3063 if ((sctp_ifn == looked_at) && looked_at) { 3064 /* already looked at this guy */ 3065 SCTPDBG(SCTP_DEBUG_OUTPUT2, "already seen\n"); 3066 continue; 3067 } 3068 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, 3069 dest_is_loop, dest_is_priv, fam); 3070 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3071 "Found ifn:%p %d preferred source addresses\n", 3072 ifn, num_preferred); 3073 if (num_preferred == 0) { 3074 /* None on this interface. */ 3075 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No preferred -- skipping to next\n"); 3076 continue; 3077 } 3078 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3079 "num preferred:%d on interface:%p cur_addr_num:%d\n", 3080 num_preferred, (void *)sctp_ifn, cur_addr_num); 3081 3082 /* 3083 * Ok we have num_eligible_addr set with how many we can 3084 * use, this may vary from call to call due to addresses 3085 * being deprecated etc.. 3086 */ 3087 if (cur_addr_num >= num_preferred) { 3088 cur_addr_num = 0; 3089 } 3090 sifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3091 dest_is_priv, cur_addr_num, fam, ro); 3092 if (sifa == NULL) 3093 continue; 3094 if (net) { 3095 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3096 SCTPDBG(SCTP_DEBUG_OUTPUT2, "we selected %d\n", 3097 cur_addr_num); 3098 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Source:"); 3099 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 3100 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Dest:"); 3101 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &net->ro._l_addr.sa); 3102 } 3103 atomic_add_int(&sifa->refcount, 1); 3104 return (sifa); 3105 } 3106 #ifdef INET 3107 again_with_private_addresses_allowed: 3108 #endif 3109 /* plan_c: do we have an acceptable address on the emit interface */ 3110 sifa = NULL; 3111 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan C: find acceptable on interface\n"); 3112 if (emit_ifn == NULL) { 3113 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jump to Plan D - no emit_ifn\n"); 3114 goto plan_d; 3115 } 3116 LIST_FOREACH(sctp_ifa, &emit_ifn->ifalist, next_ifa) { 3117 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifa:%p\n", (void *)sctp_ifa); 3118 #ifdef INET 3119 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3120 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3121 &sctp_ifa->address.sin.sin_addr) != 0)) { 3122 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3123 continue; 3124 } 3125 #endif 3126 #ifdef INET6 3127 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3128 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3129 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3130 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3131 continue; 3132 } 3133 #endif 3134 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3135 (non_asoc_addr_ok == 0)) { 3136 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Defer\n"); 3137 continue; 3138 } 3139 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, 3140 dest_is_priv, fam); 3141 if (sifa == NULL) { 3142 SCTPDBG(SCTP_DEBUG_OUTPUT2, "IFA not acceptable\n"); 3143 continue; 3144 } 3145 if (stcb) { 3146 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3147 SCTPDBG(SCTP_DEBUG_OUTPUT2, "NOT in scope\n"); 3148 sifa = NULL; 3149 continue; 3150 } 3151 if (((non_asoc_addr_ok == 0) && 3152 (sctp_is_addr_restricted(stcb, sifa))) || 3153 (non_asoc_addr_ok && 3154 (sctp_is_addr_restricted(stcb, sifa)) && 3155 (!sctp_is_addr_pending(stcb, sifa)))) { 3156 /* 3157 * It is restricted for some reason.. 3158 * probably not yet added. 3159 */ 3160 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Its restricted\n"); 3161 sifa = NULL; 3162 continue; 3163 } 3164 } 3165 atomic_add_int(&sifa->refcount, 1); 3166 goto out; 3167 } 3168 plan_d: 3169 /* 3170 * plan_d: We are in trouble. No preferred address on the emit 3171 * interface. And not even a preferred address on all interfaces. Go 3172 * out and see if we can find an acceptable address somewhere 3173 * amongst all interfaces. 3174 */ 3175 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan D looked_at is %p\n", (void *)looked_at); 3176 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3177 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3178 /* wrong base scope */ 3179 continue; 3180 } 3181 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3182 #ifdef INET 3183 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3184 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3185 &sctp_ifa->address.sin.sin_addr) != 0)) { 3186 continue; 3187 } 3188 #endif 3189 #ifdef INET6 3190 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3191 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3192 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3193 continue; 3194 } 3195 #endif 3196 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3197 (non_asoc_addr_ok == 0)) 3198 continue; 3199 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3200 dest_is_loop, 3201 dest_is_priv, fam); 3202 if (sifa == NULL) 3203 continue; 3204 if (stcb) { 3205 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3206 sifa = NULL; 3207 continue; 3208 } 3209 if (((non_asoc_addr_ok == 0) && 3210 (sctp_is_addr_restricted(stcb, sifa))) || 3211 (non_asoc_addr_ok && 3212 (sctp_is_addr_restricted(stcb, sifa)) && 3213 (!sctp_is_addr_pending(stcb, sifa)))) { 3214 /* 3215 * It is restricted for some 3216 * reason.. probably not yet added. 3217 */ 3218 sifa = NULL; 3219 continue; 3220 } 3221 } 3222 goto out; 3223 } 3224 } 3225 #ifdef INET 3226 if (stcb) { 3227 if ((retried == 0) && (stcb->asoc.scope.ipv4_local_scope == 0)) { 3228 stcb->asoc.scope.ipv4_local_scope = 1; 3229 retried = 1; 3230 goto again_with_private_addresses_allowed; 3231 } else if (retried == 1) { 3232 stcb->asoc.scope.ipv4_local_scope = 0; 3233 } 3234 } 3235 #endif 3236 out: 3237 #ifdef INET 3238 if (sifa) { 3239 if (retried == 1) { 3240 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3241 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3242 /* wrong base scope */ 3243 continue; 3244 } 3245 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3246 struct sctp_ifa *tmp_sifa; 3247 3248 #ifdef INET 3249 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3250 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3251 &sctp_ifa->address.sin.sin_addr) != 0)) { 3252 continue; 3253 } 3254 #endif 3255 #ifdef INET6 3256 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3257 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3258 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3259 continue; 3260 } 3261 #endif 3262 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3263 (non_asoc_addr_ok == 0)) 3264 continue; 3265 tmp_sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3266 dest_is_loop, 3267 dest_is_priv, fam); 3268 if (tmp_sifa == NULL) { 3269 continue; 3270 } 3271 if (tmp_sifa == sifa) { 3272 continue; 3273 } 3274 if (stcb) { 3275 if (sctp_is_address_in_scope(tmp_sifa, 3276 &stcb->asoc.scope, 0) == 0) { 3277 continue; 3278 } 3279 if (((non_asoc_addr_ok == 0) && 3280 (sctp_is_addr_restricted(stcb, tmp_sifa))) || 3281 (non_asoc_addr_ok && 3282 (sctp_is_addr_restricted(stcb, tmp_sifa)) && 3283 (!sctp_is_addr_pending(stcb, tmp_sifa)))) { 3284 /* 3285 * It is restricted 3286 * for some reason.. 3287 * probably not yet 3288 * added. 3289 */ 3290 continue; 3291 } 3292 } 3293 if ((tmp_sifa->address.sin.sin_family == AF_INET) && 3294 (IN4_ISPRIVATE_ADDRESS(&(tmp_sifa->address.sin.sin_addr)))) { 3295 sctp_add_local_addr_restricted(stcb, tmp_sifa); 3296 } 3297 } 3298 } 3299 } 3300 atomic_add_int(&sifa->refcount, 1); 3301 } 3302 #endif 3303 return (sifa); 3304 } 3305 3306 3307 3308 /* tcb may be NULL */ 3309 struct sctp_ifa * 3310 sctp_source_address_selection(struct sctp_inpcb *inp, 3311 struct sctp_tcb *stcb, 3312 sctp_route_t *ro, 3313 struct sctp_nets *net, 3314 int non_asoc_addr_ok, uint32_t vrf_id) 3315 { 3316 struct sctp_ifa *answer; 3317 uint8_t dest_is_priv, dest_is_loop; 3318 sa_family_t fam; 3319 #ifdef INET 3320 struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst; 3321 #endif 3322 #ifdef INET6 3323 struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&ro->ro_dst; 3324 #endif 3325 3326 /** 3327 * Rules: 3328 * - Find the route if needed, cache if I can. 3329 * - Look at interface address in route, Is it in the bound list. If so we 3330 * have the best source. 3331 * - If not we must rotate amongst the addresses. 3332 * 3333 * Cavets and issues 3334 * 3335 * Do we need to pay attention to scope. We can have a private address 3336 * or a global address we are sourcing or sending to. So if we draw 3337 * it out 3338 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3339 * For V4 3340 * ------------------------------------------ 3341 * source * dest * result 3342 * ----------------------------------------- 3343 * <a> Private * Global * NAT 3344 * ----------------------------------------- 3345 * <b> Private * Private * No problem 3346 * ----------------------------------------- 3347 * <c> Global * Private * Huh, How will this work? 3348 * ----------------------------------------- 3349 * <d> Global * Global * No Problem 3350 *------------------------------------------ 3351 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3352 * For V6 3353 *------------------------------------------ 3354 * source * dest * result 3355 * ----------------------------------------- 3356 * <a> Linklocal * Global * 3357 * ----------------------------------------- 3358 * <b> Linklocal * Linklocal * No problem 3359 * ----------------------------------------- 3360 * <c> Global * Linklocal * Huh, How will this work? 3361 * ----------------------------------------- 3362 * <d> Global * Global * No Problem 3363 *------------------------------------------ 3364 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3365 * 3366 * And then we add to that what happens if there are multiple addresses 3367 * assigned to an interface. Remember the ifa on a ifn is a linked 3368 * list of addresses. So one interface can have more than one IP 3369 * address. What happens if we have both a private and a global 3370 * address? Do we then use context of destination to sort out which 3371 * one is best? And what about NAT's sending P->G may get you a NAT 3372 * translation, or should you select the G thats on the interface in 3373 * preference. 3374 * 3375 * Decisions: 3376 * 3377 * - count the number of addresses on the interface. 3378 * - if it is one, no problem except case <c>. 3379 * For <a> we will assume a NAT out there. 3380 * - if there are more than one, then we need to worry about scope P 3381 * or G. We should prefer G -> G and P -> P if possible. 3382 * Then as a secondary fall back to mixed types G->P being a last 3383 * ditch one. 3384 * - The above all works for bound all, but bound specific we need to 3385 * use the same concept but instead only consider the bound 3386 * addresses. If the bound set is NOT assigned to the interface then 3387 * we must use rotation amongst the bound addresses.. 3388 */ 3389 if (ro->ro_nh == NULL) { 3390 /* 3391 * Need a route to cache. 3392 */ 3393 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 3394 } 3395 if (ro->ro_nh == NULL) { 3396 return (NULL); 3397 } 3398 fam = ro->ro_dst.sa_family; 3399 dest_is_priv = dest_is_loop = 0; 3400 /* Setup our scopes for the destination */ 3401 switch (fam) { 3402 #ifdef INET 3403 case AF_INET: 3404 /* Scope based on outbound address */ 3405 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) { 3406 dest_is_loop = 1; 3407 if (net != NULL) { 3408 /* mark it as local */ 3409 net->addr_is_local = 1; 3410 } 3411 } else if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) { 3412 dest_is_priv = 1; 3413 } 3414 break; 3415 #endif 3416 #ifdef INET6 3417 case AF_INET6: 3418 /* Scope based on outbound address */ 3419 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr) || 3420 SCTP_ROUTE_IS_REAL_LOOP(ro)) { 3421 /* 3422 * If the address is a loopback address, which 3423 * consists of "::1" OR "fe80::1%lo0", we are 3424 * loopback scope. But we don't use dest_is_priv 3425 * (link local addresses). 3426 */ 3427 dest_is_loop = 1; 3428 if (net != NULL) { 3429 /* mark it as local */ 3430 net->addr_is_local = 1; 3431 } 3432 } else if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) { 3433 dest_is_priv = 1; 3434 } 3435 break; 3436 #endif 3437 } 3438 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Select source addr for:"); 3439 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&ro->ro_dst); 3440 SCTP_IPI_ADDR_RLOCK(); 3441 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3442 /* 3443 * Bound all case 3444 */ 3445 answer = sctp_choose_boundall(inp, stcb, net, ro, vrf_id, 3446 dest_is_priv, dest_is_loop, 3447 non_asoc_addr_ok, fam); 3448 SCTP_IPI_ADDR_RUNLOCK(); 3449 return (answer); 3450 } 3451 /* 3452 * Subset bound case 3453 */ 3454 if (stcb) { 3455 answer = sctp_choose_boundspecific_stcb(inp, stcb, ro, 3456 vrf_id, dest_is_priv, 3457 dest_is_loop, 3458 non_asoc_addr_ok, fam); 3459 } else { 3460 answer = sctp_choose_boundspecific_inp(inp, ro, vrf_id, 3461 non_asoc_addr_ok, 3462 dest_is_priv, 3463 dest_is_loop, fam); 3464 } 3465 SCTP_IPI_ADDR_RUNLOCK(); 3466 return (answer); 3467 } 3468 3469 static int 3470 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, size_t cpsize) 3471 { 3472 struct cmsghdr cmh; 3473 struct sctp_sndinfo sndinfo; 3474 struct sctp_prinfo prinfo; 3475 struct sctp_authinfo authinfo; 3476 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3477 int found; 3478 3479 /* 3480 * Independent of how many mbufs, find the c_type inside the control 3481 * structure and copy out the data. 3482 */ 3483 found = 0; 3484 tot_len = SCTP_BUF_LEN(control); 3485 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3486 rem_len = tot_len - off; 3487 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3488 /* There is not enough room for one more. */ 3489 return (found); 3490 } 3491 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3492 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3493 /* We dont't have a complete CMSG header. */ 3494 return (found); 3495 } 3496 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3497 /* We don't have the complete CMSG. */ 3498 return (found); 3499 } 3500 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3501 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3502 if ((cmh.cmsg_level == IPPROTO_SCTP) && 3503 ((c_type == cmh.cmsg_type) || 3504 ((c_type == SCTP_SNDRCV) && 3505 ((cmh.cmsg_type == SCTP_SNDINFO) || 3506 (cmh.cmsg_type == SCTP_PRINFO) || 3507 (cmh.cmsg_type == SCTP_AUTHINFO))))) { 3508 if (c_type == cmh.cmsg_type) { 3509 if (cpsize > INT_MAX) { 3510 return (found); 3511 } 3512 if (cmsg_data_len < (int)cpsize) { 3513 return (found); 3514 } 3515 /* It is exactly what we want. Copy it out. */ 3516 m_copydata(control, cmsg_data_off, (int)cpsize, (caddr_t)data); 3517 return (1); 3518 } else { 3519 struct sctp_sndrcvinfo *sndrcvinfo; 3520 3521 sndrcvinfo = (struct sctp_sndrcvinfo *)data; 3522 if (found == 0) { 3523 if (cpsize < sizeof(struct sctp_sndrcvinfo)) { 3524 return (found); 3525 } 3526 memset(sndrcvinfo, 0, sizeof(struct sctp_sndrcvinfo)); 3527 } 3528 switch (cmh.cmsg_type) { 3529 case SCTP_SNDINFO: 3530 if (cmsg_data_len < (int)sizeof(struct sctp_sndinfo)) { 3531 return (found); 3532 } 3533 m_copydata(control, cmsg_data_off, sizeof(struct sctp_sndinfo), (caddr_t)&sndinfo); 3534 sndrcvinfo->sinfo_stream = sndinfo.snd_sid; 3535 sndrcvinfo->sinfo_flags = sndinfo.snd_flags; 3536 sndrcvinfo->sinfo_ppid = sndinfo.snd_ppid; 3537 sndrcvinfo->sinfo_context = sndinfo.snd_context; 3538 sndrcvinfo->sinfo_assoc_id = sndinfo.snd_assoc_id; 3539 break; 3540 case SCTP_PRINFO: 3541 if (cmsg_data_len < (int)sizeof(struct sctp_prinfo)) { 3542 return (found); 3543 } 3544 m_copydata(control, cmsg_data_off, sizeof(struct sctp_prinfo), (caddr_t)&prinfo); 3545 if (prinfo.pr_policy != SCTP_PR_SCTP_NONE) { 3546 sndrcvinfo->sinfo_timetolive = prinfo.pr_value; 3547 } else { 3548 sndrcvinfo->sinfo_timetolive = 0; 3549 } 3550 sndrcvinfo->sinfo_flags |= prinfo.pr_policy; 3551 break; 3552 case SCTP_AUTHINFO: 3553 if (cmsg_data_len < (int)sizeof(struct sctp_authinfo)) { 3554 return (found); 3555 } 3556 m_copydata(control, cmsg_data_off, sizeof(struct sctp_authinfo), (caddr_t)&authinfo); 3557 sndrcvinfo->sinfo_keynumber_valid = 1; 3558 sndrcvinfo->sinfo_keynumber = authinfo.auth_keynumber; 3559 break; 3560 default: 3561 return (found); 3562 } 3563 found = 1; 3564 } 3565 } 3566 } 3567 return (found); 3568 } 3569 3570 static int 3571 sctp_process_cmsgs_for_init(struct sctp_tcb *stcb, struct mbuf *control, int *error) 3572 { 3573 struct cmsghdr cmh; 3574 struct sctp_initmsg initmsg; 3575 #ifdef INET 3576 struct sockaddr_in sin; 3577 #endif 3578 #ifdef INET6 3579 struct sockaddr_in6 sin6; 3580 #endif 3581 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3582 3583 tot_len = SCTP_BUF_LEN(control); 3584 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3585 rem_len = tot_len - off; 3586 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3587 /* There is not enough room for one more. */ 3588 *error = EINVAL; 3589 return (1); 3590 } 3591 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3592 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3593 /* We dont't have a complete CMSG header. */ 3594 *error = EINVAL; 3595 return (1); 3596 } 3597 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3598 /* We don't have the complete CMSG. */ 3599 *error = EINVAL; 3600 return (1); 3601 } 3602 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3603 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3604 if (cmh.cmsg_level == IPPROTO_SCTP) { 3605 switch (cmh.cmsg_type) { 3606 case SCTP_INIT: 3607 if (cmsg_data_len < (int)sizeof(struct sctp_initmsg)) { 3608 *error = EINVAL; 3609 return (1); 3610 } 3611 m_copydata(control, cmsg_data_off, sizeof(struct sctp_initmsg), (caddr_t)&initmsg); 3612 if (initmsg.sinit_max_attempts) 3613 stcb->asoc.max_init_times = initmsg.sinit_max_attempts; 3614 if (initmsg.sinit_num_ostreams) 3615 stcb->asoc.pre_open_streams = initmsg.sinit_num_ostreams; 3616 if (initmsg.sinit_max_instreams) 3617 stcb->asoc.max_inbound_streams = initmsg.sinit_max_instreams; 3618 if (initmsg.sinit_max_init_timeo) 3619 stcb->asoc.initial_init_rto_max = initmsg.sinit_max_init_timeo; 3620 if (stcb->asoc.streamoutcnt < stcb->asoc.pre_open_streams) { 3621 struct sctp_stream_out *tmp_str; 3622 unsigned int i; 3623 #if defined(SCTP_DETAILED_STR_STATS) 3624 int j; 3625 #endif 3626 3627 /* Default is NOT correct */ 3628 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, default:%d pre_open:%d\n", 3629 stcb->asoc.streamoutcnt, stcb->asoc.pre_open_streams); 3630 SCTP_TCB_UNLOCK(stcb); 3631 SCTP_MALLOC(tmp_str, 3632 struct sctp_stream_out *, 3633 (stcb->asoc.pre_open_streams * sizeof(struct sctp_stream_out)), 3634 SCTP_M_STRMO); 3635 SCTP_TCB_LOCK(stcb); 3636 if (tmp_str != NULL) { 3637 SCTP_FREE(stcb->asoc.strmout, SCTP_M_STRMO); 3638 stcb->asoc.strmout = tmp_str; 3639 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt = stcb->asoc.pre_open_streams; 3640 } else { 3641 stcb->asoc.pre_open_streams = stcb->asoc.streamoutcnt; 3642 } 3643 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3644 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 3645 stcb->asoc.strmout[i].chunks_on_queues = 0; 3646 stcb->asoc.strmout[i].next_mid_ordered = 0; 3647 stcb->asoc.strmout[i].next_mid_unordered = 0; 3648 #if defined(SCTP_DETAILED_STR_STATS) 3649 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 3650 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 3651 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 3652 } 3653 #else 3654 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 3655 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 3656 #endif 3657 stcb->asoc.strmout[i].sid = i; 3658 stcb->asoc.strmout[i].last_msg_incomplete = 0; 3659 stcb->asoc.strmout[i].state = SCTP_STREAM_OPENING; 3660 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 3661 } 3662 } 3663 break; 3664 #ifdef INET 3665 case SCTP_DSTADDRV4: 3666 if (cmsg_data_len < (int)sizeof(struct in_addr)) { 3667 *error = EINVAL; 3668 return (1); 3669 } 3670 memset(&sin, 0, sizeof(struct sockaddr_in)); 3671 sin.sin_family = AF_INET; 3672 sin.sin_len = sizeof(struct sockaddr_in); 3673 sin.sin_port = stcb->rport; 3674 m_copydata(control, cmsg_data_off, sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3675 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3676 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3677 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3678 *error = EINVAL; 3679 return (1); 3680 } 3681 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3682 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3683 *error = ENOBUFS; 3684 return (1); 3685 } 3686 break; 3687 #endif 3688 #ifdef INET6 3689 case SCTP_DSTADDRV6: 3690 if (cmsg_data_len < (int)sizeof(struct in6_addr)) { 3691 *error = EINVAL; 3692 return (1); 3693 } 3694 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3695 sin6.sin6_family = AF_INET6; 3696 sin6.sin6_len = sizeof(struct sockaddr_in6); 3697 sin6.sin6_port = stcb->rport; 3698 m_copydata(control, cmsg_data_off, sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3699 if (IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr) || 3700 IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) { 3701 *error = EINVAL; 3702 return (1); 3703 } 3704 #ifdef INET 3705 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3706 in6_sin6_2_sin(&sin, &sin6); 3707 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3708 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3709 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3710 *error = EINVAL; 3711 return (1); 3712 } 3713 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3714 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3715 *error = ENOBUFS; 3716 return (1); 3717 } 3718 } else 3719 #endif 3720 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin6, NULL, stcb->asoc.port, 3721 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3722 *error = ENOBUFS; 3723 return (1); 3724 } 3725 break; 3726 #endif 3727 default: 3728 break; 3729 } 3730 } 3731 } 3732 return (0); 3733 } 3734 3735 #if defined(INET) || defined(INET6) 3736 static struct sctp_tcb * 3737 sctp_findassociation_cmsgs(struct sctp_inpcb **inp_p, 3738 uint16_t port, 3739 struct mbuf *control, 3740 struct sctp_nets **net_p, 3741 int *error) 3742 { 3743 struct cmsghdr cmh; 3744 struct sctp_tcb *stcb; 3745 struct sockaddr *addr; 3746 #ifdef INET 3747 struct sockaddr_in sin; 3748 #endif 3749 #ifdef INET6 3750 struct sockaddr_in6 sin6; 3751 #endif 3752 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3753 3754 tot_len = SCTP_BUF_LEN(control); 3755 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3756 rem_len = tot_len - off; 3757 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3758 /* There is not enough room for one more. */ 3759 *error = EINVAL; 3760 return (NULL); 3761 } 3762 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3763 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3764 /* We dont't have a complete CMSG header. */ 3765 *error = EINVAL; 3766 return (NULL); 3767 } 3768 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3769 /* We don't have the complete CMSG. */ 3770 *error = EINVAL; 3771 return (NULL); 3772 } 3773 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3774 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3775 if (cmh.cmsg_level == IPPROTO_SCTP) { 3776 switch (cmh.cmsg_type) { 3777 #ifdef INET 3778 case SCTP_DSTADDRV4: 3779 if (cmsg_data_len < (int)sizeof(struct in_addr)) { 3780 *error = EINVAL; 3781 return (NULL); 3782 } 3783 memset(&sin, 0, sizeof(struct sockaddr_in)); 3784 sin.sin_family = AF_INET; 3785 sin.sin_len = sizeof(struct sockaddr_in); 3786 sin.sin_port = port; 3787 m_copydata(control, cmsg_data_off, sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3788 addr = (struct sockaddr *)&sin; 3789 break; 3790 #endif 3791 #ifdef INET6 3792 case SCTP_DSTADDRV6: 3793 if (cmsg_data_len < (int)sizeof(struct in6_addr)) { 3794 *error = EINVAL; 3795 return (NULL); 3796 } 3797 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3798 sin6.sin6_family = AF_INET6; 3799 sin6.sin6_len = sizeof(struct sockaddr_in6); 3800 sin6.sin6_port = port; 3801 m_copydata(control, cmsg_data_off, sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3802 #ifdef INET 3803 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3804 in6_sin6_2_sin(&sin, &sin6); 3805 addr = (struct sockaddr *)&sin; 3806 } else 3807 #endif 3808 addr = (struct sockaddr *)&sin6; 3809 break; 3810 #endif 3811 default: 3812 addr = NULL; 3813 break; 3814 } 3815 if (addr) { 3816 stcb = sctp_findassociation_ep_addr(inp_p, addr, net_p, NULL, NULL); 3817 if (stcb != NULL) { 3818 return (stcb); 3819 } 3820 } 3821 } 3822 } 3823 return (NULL); 3824 } 3825 #endif 3826 3827 static struct mbuf * 3828 sctp_add_cookie(struct mbuf *init, int init_offset, 3829 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in, uint8_t **signature) 3830 { 3831 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 3832 struct sctp_state_cookie *stc; 3833 struct sctp_paramhdr *ph; 3834 uint16_t cookie_sz; 3835 3836 mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) + 3837 sizeof(struct sctp_paramhdr)), 0, 3838 M_NOWAIT, 1, MT_DATA); 3839 if (mret == NULL) { 3840 return (NULL); 3841 } 3842 copy_init = SCTP_M_COPYM(init, init_offset, M_COPYALL, M_NOWAIT); 3843 if (copy_init == NULL) { 3844 sctp_m_freem(mret); 3845 return (NULL); 3846 } 3847 #ifdef SCTP_MBUF_LOGGING 3848 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3849 sctp_log_mbc(copy_init, SCTP_MBUF_ICOPY); 3850 } 3851 #endif 3852 copy_initack = SCTP_M_COPYM(initack, initack_offset, M_COPYALL, 3853 M_NOWAIT); 3854 if (copy_initack == NULL) { 3855 sctp_m_freem(mret); 3856 sctp_m_freem(copy_init); 3857 return (NULL); 3858 } 3859 #ifdef SCTP_MBUF_LOGGING 3860 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3861 sctp_log_mbc(copy_initack, SCTP_MBUF_ICOPY); 3862 } 3863 #endif 3864 /* easy side we just drop it on the end */ 3865 ph = mtod(mret, struct sctp_paramhdr *); 3866 SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) + 3867 sizeof(struct sctp_paramhdr); 3868 stc = (struct sctp_state_cookie *)((caddr_t)ph + 3869 sizeof(struct sctp_paramhdr)); 3870 ph->param_type = htons(SCTP_STATE_COOKIE); 3871 ph->param_length = 0; /* fill in at the end */ 3872 /* Fill in the stc cookie data */ 3873 memcpy(stc, stc_in, sizeof(struct sctp_state_cookie)); 3874 3875 /* tack the INIT and then the INIT-ACK onto the chain */ 3876 cookie_sz = 0; 3877 for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3878 cookie_sz += SCTP_BUF_LEN(m_at); 3879 if (SCTP_BUF_NEXT(m_at) == NULL) { 3880 SCTP_BUF_NEXT(m_at) = copy_init; 3881 break; 3882 } 3883 } 3884 for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3885 cookie_sz += SCTP_BUF_LEN(m_at); 3886 if (SCTP_BUF_NEXT(m_at) == NULL) { 3887 SCTP_BUF_NEXT(m_at) = copy_initack; 3888 break; 3889 } 3890 } 3891 for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3892 cookie_sz += SCTP_BUF_LEN(m_at); 3893 if (SCTP_BUF_NEXT(m_at) == NULL) { 3894 break; 3895 } 3896 } 3897 sig = sctp_get_mbuf_for_msg(SCTP_SIGNATURE_SIZE, 0, M_NOWAIT, 1, MT_DATA); 3898 if (sig == NULL) { 3899 /* no space, so free the entire chain */ 3900 sctp_m_freem(mret); 3901 return (NULL); 3902 } 3903 SCTP_BUF_NEXT(m_at) = sig; 3904 SCTP_BUF_LEN(sig) = SCTP_SIGNATURE_SIZE; 3905 cookie_sz += SCTP_SIGNATURE_SIZE; 3906 ph->param_length = htons(cookie_sz); 3907 *signature = (uint8_t *)mtod(sig, caddr_t); 3908 memset(*signature, 0, SCTP_SIGNATURE_SIZE); 3909 return (mret); 3910 } 3911 3912 static uint8_t 3913 sctp_get_ect(struct sctp_tcb *stcb) 3914 { 3915 if ((stcb != NULL) && (stcb->asoc.ecn_supported == 1)) { 3916 return (SCTP_ECT0_BIT); 3917 } else { 3918 return (0); 3919 } 3920 } 3921 3922 #if defined(INET) || defined(INET6) 3923 static void 3924 sctp_handle_no_route(struct sctp_tcb *stcb, 3925 struct sctp_nets *net, 3926 int so_locked) 3927 { 3928 SCTPDBG(SCTP_DEBUG_OUTPUT1, "dropped packet - no valid source addr\n"); 3929 3930 if (net) { 3931 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Destination was "); 3932 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT1, &net->ro._l_addr.sa); 3933 if (net->dest_state & SCTP_ADDR_CONFIRMED) { 3934 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) { 3935 SCTPDBG(SCTP_DEBUG_OUTPUT1, "no route takes interface %p down\n", (void *)net); 3936 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 3937 stcb, 0, 3938 (void *)net, 3939 so_locked); 3940 net->dest_state &= ~SCTP_ADDR_REACHABLE; 3941 net->dest_state &= ~SCTP_ADDR_PF; 3942 } 3943 } 3944 if (stcb) { 3945 if (net == stcb->asoc.primary_destination) { 3946 /* need a new primary */ 3947 struct sctp_nets *alt; 3948 3949 alt = sctp_find_alternate_net(stcb, net, 0); 3950 if (alt != net) { 3951 if (stcb->asoc.alternate) { 3952 sctp_free_remote_addr(stcb->asoc.alternate); 3953 } 3954 stcb->asoc.alternate = alt; 3955 atomic_add_int(&stcb->asoc.alternate->ref_count, 1); 3956 if (net->ro._s_addr) { 3957 sctp_free_ifa(net->ro._s_addr); 3958 net->ro._s_addr = NULL; 3959 } 3960 net->src_addr_selected = 0; 3961 } 3962 } 3963 } 3964 } 3965 } 3966 #endif 3967 3968 static int 3969 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 3970 struct sctp_tcb *stcb, /* may be NULL */ 3971 struct sctp_nets *net, 3972 struct sockaddr *to, 3973 struct mbuf *m, 3974 uint32_t auth_offset, 3975 struct sctp_auth_chunk *auth, 3976 uint16_t auth_keyid, 3977 int nofragment_flag, 3978 int ecn_ok, 3979 int out_of_asoc_ok, 3980 uint16_t src_port, 3981 uint16_t dest_port, 3982 uint32_t v_tag, 3983 uint16_t port, 3984 union sctp_sockstore *over_addr, 3985 uint8_t mflowtype, uint32_t mflowid, 3986 int so_locked) 3987 { 3988 /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 3989 /** 3990 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet header 3991 * WITH an SCTPHDR but no IP header, endpoint inp and sa structure: 3992 * - fill in the HMAC digest of any AUTH chunk in the packet. 3993 * - calculate and fill in the SCTP checksum. 3994 * - prepend an IP address header. 3995 * - if boundall use INADDR_ANY. 3996 * - if boundspecific do source address selection. 3997 * - set fragmentation option for ipV4. 3998 * - On return from IP output, check/adjust mtu size of output 3999 * interface and smallest_mtu size as well. 4000 */ 4001 /* Will need ifdefs around this */ 4002 struct mbuf *newm; 4003 struct sctphdr *sctphdr; 4004 int packet_length; 4005 int ret; 4006 #if defined(INET) || defined(INET6) 4007 uint32_t vrf_id; 4008 #endif 4009 #if defined(INET) || defined(INET6) 4010 struct mbuf *o_pak; 4011 sctp_route_t *ro = NULL; 4012 struct udphdr *udp = NULL; 4013 #endif 4014 uint8_t tos_value; 4015 4016 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 4017 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4018 sctp_m_freem(m); 4019 return (EFAULT); 4020 } 4021 #if defined(INET) || defined(INET6) 4022 if (stcb) { 4023 vrf_id = stcb->asoc.vrf_id; 4024 } else { 4025 vrf_id = inp->def_vrf_id; 4026 } 4027 #endif 4028 /* fill in the HMAC digest for any AUTH chunk in the packet */ 4029 if ((auth != NULL) && (stcb != NULL)) { 4030 sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb, auth_keyid); 4031 } 4032 4033 if (net) { 4034 tos_value = net->dscp; 4035 } else if (stcb) { 4036 tos_value = stcb->asoc.default_dscp; 4037 } else { 4038 tos_value = inp->sctp_ep.default_dscp; 4039 } 4040 4041 switch (to->sa_family) { 4042 #ifdef INET 4043 case AF_INET: 4044 { 4045 struct ip *ip = NULL; 4046 sctp_route_t iproute; 4047 int len; 4048 4049 len = SCTP_MIN_V4_OVERHEAD; 4050 if (port) { 4051 len += sizeof(struct udphdr); 4052 } 4053 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4054 if (newm == NULL) { 4055 sctp_m_freem(m); 4056 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4057 return (ENOMEM); 4058 } 4059 SCTP_ALIGN_TO_END(newm, len); 4060 SCTP_BUF_LEN(newm) = len; 4061 SCTP_BUF_NEXT(newm) = m; 4062 m = newm; 4063 if (net != NULL) { 4064 m->m_pkthdr.flowid = net->flowid; 4065 M_HASHTYPE_SET(m, net->flowtype); 4066 } else { 4067 m->m_pkthdr.flowid = mflowid; 4068 M_HASHTYPE_SET(m, mflowtype); 4069 } 4070 packet_length = sctp_calculate_len(m); 4071 ip = mtod(m, struct ip *); 4072 ip->ip_v = IPVERSION; 4073 ip->ip_hl = (sizeof(struct ip) >> 2); 4074 if (tos_value == 0) { 4075 /* 4076 * This means especially, that it is not set 4077 * at the SCTP layer. So use the value from 4078 * the IP layer. 4079 */ 4080 tos_value = inp->ip_inp.inp.inp_ip_tos; 4081 } 4082 tos_value &= 0xfc; 4083 if (ecn_ok) { 4084 tos_value |= sctp_get_ect(stcb); 4085 } 4086 if ((nofragment_flag) && (port == 0)) { 4087 ip->ip_off = htons(IP_DF); 4088 } else { 4089 ip->ip_off = htons(0); 4090 } 4091 /* FreeBSD has a function for ip_id's */ 4092 ip_fillid(ip); 4093 4094 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl; 4095 ip->ip_len = htons(packet_length); 4096 ip->ip_tos = tos_value; 4097 if (port) { 4098 ip->ip_p = IPPROTO_UDP; 4099 } else { 4100 ip->ip_p = IPPROTO_SCTP; 4101 } 4102 ip->ip_sum = 0; 4103 if (net == NULL) { 4104 ro = &iproute; 4105 memset(&iproute, 0, sizeof(iproute)); 4106 memcpy(&ro->ro_dst, to, to->sa_len); 4107 } else { 4108 ro = (sctp_route_t *)&net->ro; 4109 } 4110 /* Now the address selection part */ 4111 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr; 4112 4113 /* call the routine to select the src address */ 4114 if (net && out_of_asoc_ok == 0) { 4115 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4116 sctp_free_ifa(net->ro._s_addr); 4117 net->ro._s_addr = NULL; 4118 net->src_addr_selected = 0; 4119 RO_NHFREE(ro); 4120 } 4121 if (net->src_addr_selected == 0) { 4122 /* Cache the source address */ 4123 net->ro._s_addr = sctp_source_address_selection(inp, stcb, 4124 ro, net, 0, 4125 vrf_id); 4126 net->src_addr_selected = 1; 4127 } 4128 if (net->ro._s_addr == NULL) { 4129 /* No route to host */ 4130 net->src_addr_selected = 0; 4131 sctp_handle_no_route(stcb, net, so_locked); 4132 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4133 sctp_m_freem(m); 4134 return (EHOSTUNREACH); 4135 } 4136 ip->ip_src = net->ro._s_addr->address.sin.sin_addr; 4137 } else { 4138 if (over_addr == NULL) { 4139 struct sctp_ifa *_lsrc; 4140 4141 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4142 net, 4143 out_of_asoc_ok, 4144 vrf_id); 4145 if (_lsrc == NULL) { 4146 sctp_handle_no_route(stcb, net, so_locked); 4147 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4148 sctp_m_freem(m); 4149 return (EHOSTUNREACH); 4150 } 4151 ip->ip_src = _lsrc->address.sin.sin_addr; 4152 sctp_free_ifa(_lsrc); 4153 } else { 4154 ip->ip_src = over_addr->sin.sin_addr; 4155 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4156 } 4157 } 4158 if (port) { 4159 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4160 sctp_handle_no_route(stcb, net, so_locked); 4161 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4162 sctp_m_freem(m); 4163 return (EHOSTUNREACH); 4164 } 4165 udp = (struct udphdr *)((caddr_t)ip + sizeof(struct ip)); 4166 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4167 udp->uh_dport = port; 4168 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip))); 4169 if (V_udp_cksum) { 4170 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 4171 } else { 4172 udp->uh_sum = 0; 4173 } 4174 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4175 } else { 4176 sctphdr = (struct sctphdr *)((caddr_t)ip + sizeof(struct ip)); 4177 } 4178 4179 sctphdr->src_port = src_port; 4180 sctphdr->dest_port = dest_port; 4181 sctphdr->v_tag = v_tag; 4182 sctphdr->checksum = 0; 4183 4184 /* 4185 * If source address selection fails and we find no 4186 * route then the ip_output should fail as well with 4187 * a NO_ROUTE_TO_HOST type error. We probably should 4188 * catch that somewhere and abort the association 4189 * right away (assuming this is an INIT being sent). 4190 */ 4191 if (ro->ro_nh == NULL) { 4192 /* 4193 * src addr selection failed to find a route 4194 * (or valid source addr), so we can't get 4195 * there from here (yet)! 4196 */ 4197 sctp_handle_no_route(stcb, net, so_locked); 4198 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4199 sctp_m_freem(m); 4200 return (EHOSTUNREACH); 4201 } 4202 if (ro != &iproute) { 4203 memcpy(&iproute, ro, sizeof(*ro)); 4204 } 4205 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv4 output routine from low level src addr:%x\n", 4206 (uint32_t)(ntohl(ip->ip_src.s_addr))); 4207 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Destination is %x\n", 4208 (uint32_t)(ntohl(ip->ip_dst.s_addr))); 4209 SCTPDBG(SCTP_DEBUG_OUTPUT3, "RTP route is %p through\n", 4210 (void *)ro->ro_nh); 4211 4212 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4213 /* failed to prepend data, give up */ 4214 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4215 sctp_m_freem(m); 4216 return (ENOMEM); 4217 } 4218 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4219 if (port) { 4220 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip) + sizeof(struct udphdr)); 4221 SCTP_STAT_INCR(sctps_sendswcrc); 4222 if (V_udp_cksum) { 4223 SCTP_ENABLE_UDP_CSUM(o_pak); 4224 } 4225 } else { 4226 m->m_pkthdr.csum_flags = CSUM_SCTP; 4227 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4228 SCTP_STAT_INCR(sctps_sendhwcrc); 4229 } 4230 #ifdef SCTP_PACKET_LOGGING 4231 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4232 sctp_packet_log(o_pak); 4233 #endif 4234 /* send it out. table id is taken from stcb */ 4235 SCTP_PROBE5(send, NULL, stcb, ip, stcb, sctphdr); 4236 SCTP_IP_OUTPUT(ret, o_pak, ro, stcb, vrf_id); 4237 if (port) { 4238 UDPSTAT_INC(udps_opackets); 4239 } 4240 SCTP_STAT_INCR(sctps_sendpackets); 4241 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4242 if (ret) 4243 SCTP_STAT_INCR(sctps_senderrors); 4244 4245 SCTPDBG(SCTP_DEBUG_OUTPUT3, "IP output returns %d\n", ret); 4246 if (net == NULL) { 4247 /* free tempy routes */ 4248 RO_NHFREE(ro); 4249 } else { 4250 if ((ro->ro_nh != NULL) && (net->ro._s_addr) && 4251 ((net->dest_state & SCTP_ADDR_NO_PMTUD) == 0)) { 4252 uint32_t mtu; 4253 4254 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_nh); 4255 if (mtu > 0) { 4256 if (net->port) { 4257 mtu -= sizeof(struct udphdr); 4258 } 4259 if (mtu < net->mtu) { 4260 if ((stcb != NULL) && (stcb->asoc.smallest_mtu > mtu)) { 4261 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4262 } 4263 net->mtu = mtu; 4264 } 4265 } 4266 } else if (ro->ro_nh == NULL) { 4267 /* route was freed */ 4268 if (net->ro._s_addr && 4269 net->src_addr_selected) { 4270 sctp_free_ifa(net->ro._s_addr); 4271 net->ro._s_addr = NULL; 4272 } 4273 net->src_addr_selected = 0; 4274 } 4275 } 4276 return (ret); 4277 } 4278 #endif 4279 #ifdef INET6 4280 case AF_INET6: 4281 { 4282 uint32_t flowlabel, flowinfo; 4283 struct ip6_hdr *ip6h; 4284 struct route_in6 ip6route; 4285 struct ifnet *ifp; 4286 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 4287 int prev_scope = 0; 4288 struct sockaddr_in6 lsa6_storage; 4289 int error; 4290 u_short prev_port = 0; 4291 int len; 4292 4293 if (net) { 4294 flowlabel = net->flowlabel; 4295 } else if (stcb) { 4296 flowlabel = stcb->asoc.default_flowlabel; 4297 } else { 4298 flowlabel = inp->sctp_ep.default_flowlabel; 4299 } 4300 if (flowlabel == 0) { 4301 /* 4302 * This means especially, that it is not set 4303 * at the SCTP layer. So use the value from 4304 * the IP layer. 4305 */ 4306 flowlabel = ntohl(((struct inpcb *)inp)->inp_flow); 4307 } 4308 flowlabel &= 0x000fffff; 4309 len = SCTP_MIN_OVERHEAD; 4310 if (port) { 4311 len += sizeof(struct udphdr); 4312 } 4313 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4314 if (newm == NULL) { 4315 sctp_m_freem(m); 4316 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4317 return (ENOMEM); 4318 } 4319 SCTP_ALIGN_TO_END(newm, len); 4320 SCTP_BUF_LEN(newm) = len; 4321 SCTP_BUF_NEXT(newm) = m; 4322 m = newm; 4323 if (net != NULL) { 4324 m->m_pkthdr.flowid = net->flowid; 4325 M_HASHTYPE_SET(m, net->flowtype); 4326 } else { 4327 m->m_pkthdr.flowid = mflowid; 4328 M_HASHTYPE_SET(m, mflowtype); 4329 } 4330 packet_length = sctp_calculate_len(m); 4331 4332 ip6h = mtod(m, struct ip6_hdr *); 4333 /* protect *sin6 from overwrite */ 4334 sin6 = (struct sockaddr_in6 *)to; 4335 tmp = *sin6; 4336 sin6 = &tmp; 4337 4338 /* KAME hack: embed scopeid */ 4339 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4340 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4341 sctp_m_freem(m); 4342 return (EINVAL); 4343 } 4344 if (net == NULL) { 4345 memset(&ip6route, 0, sizeof(ip6route)); 4346 ro = (sctp_route_t *)&ip6route; 4347 memcpy(&ro->ro_dst, sin6, sin6->sin6_len); 4348 } else { 4349 ro = (sctp_route_t *)&net->ro; 4350 } 4351 /* 4352 * We assume here that inp_flow is in host byte 4353 * order within the TCB! 4354 */ 4355 if (tos_value == 0) { 4356 /* 4357 * This means especially, that it is not set 4358 * at the SCTP layer. So use the value from 4359 * the IP layer. 4360 */ 4361 tos_value = (ntohl(((struct inpcb *)inp)->inp_flow) >> 20) & 0xff; 4362 } 4363 tos_value &= 0xfc; 4364 if (ecn_ok) { 4365 tos_value |= sctp_get_ect(stcb); 4366 } 4367 flowinfo = 0x06; 4368 flowinfo <<= 8; 4369 flowinfo |= tos_value; 4370 flowinfo <<= 20; 4371 flowinfo |= flowlabel; 4372 ip6h->ip6_flow = htonl(flowinfo); 4373 if (port) { 4374 ip6h->ip6_nxt = IPPROTO_UDP; 4375 } else { 4376 ip6h->ip6_nxt = IPPROTO_SCTP; 4377 } 4378 ip6h->ip6_plen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4379 ip6h->ip6_dst = sin6->sin6_addr; 4380 4381 /* 4382 * Add SRC address selection here: we can only reuse 4383 * to a limited degree the kame src-addr-sel, since 4384 * we can try their selection but it may not be 4385 * bound. 4386 */ 4387 memset(&lsa6_tmp, 0, sizeof(lsa6_tmp)); 4388 lsa6_tmp.sin6_family = AF_INET6; 4389 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 4390 lsa6 = &lsa6_tmp; 4391 if (net && out_of_asoc_ok == 0) { 4392 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4393 sctp_free_ifa(net->ro._s_addr); 4394 net->ro._s_addr = NULL; 4395 net->src_addr_selected = 0; 4396 RO_NHFREE(ro); 4397 } 4398 if (net->src_addr_selected == 0) { 4399 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4400 /* KAME hack: embed scopeid */ 4401 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4402 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4403 sctp_m_freem(m); 4404 return (EINVAL); 4405 } 4406 /* Cache the source address */ 4407 net->ro._s_addr = sctp_source_address_selection(inp, 4408 stcb, 4409 ro, 4410 net, 4411 0, 4412 vrf_id); 4413 (void)sa6_recoverscope(sin6); 4414 net->src_addr_selected = 1; 4415 } 4416 if (net->ro._s_addr == NULL) { 4417 SCTPDBG(SCTP_DEBUG_OUTPUT3, "V6:No route to host\n"); 4418 net->src_addr_selected = 0; 4419 sctp_handle_no_route(stcb, net, so_locked); 4420 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4421 sctp_m_freem(m); 4422 return (EHOSTUNREACH); 4423 } 4424 lsa6->sin6_addr = net->ro._s_addr->address.sin6.sin6_addr; 4425 } else { 4426 sin6 = (struct sockaddr_in6 *)&ro->ro_dst; 4427 /* KAME hack: embed scopeid */ 4428 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4429 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4430 sctp_m_freem(m); 4431 return (EINVAL); 4432 } 4433 if (over_addr == NULL) { 4434 struct sctp_ifa *_lsrc; 4435 4436 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4437 net, 4438 out_of_asoc_ok, 4439 vrf_id); 4440 if (_lsrc == NULL) { 4441 sctp_handle_no_route(stcb, net, so_locked); 4442 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4443 sctp_m_freem(m); 4444 return (EHOSTUNREACH); 4445 } 4446 lsa6->sin6_addr = _lsrc->address.sin6.sin6_addr; 4447 sctp_free_ifa(_lsrc); 4448 } else { 4449 lsa6->sin6_addr = over_addr->sin6.sin6_addr; 4450 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4451 } 4452 (void)sa6_recoverscope(sin6); 4453 } 4454 lsa6->sin6_port = inp->sctp_lport; 4455 4456 if (ro->ro_nh == NULL) { 4457 /* 4458 * src addr selection failed to find a route 4459 * (or valid source addr), so we can't get 4460 * there from here! 4461 */ 4462 sctp_handle_no_route(stcb, net, so_locked); 4463 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4464 sctp_m_freem(m); 4465 return (EHOSTUNREACH); 4466 } 4467 /* 4468 * XXX: sa6 may not have a valid sin6_scope_id in 4469 * the non-SCOPEDROUTING case. 4470 */ 4471 memset(&lsa6_storage, 0, sizeof(lsa6_storage)); 4472 lsa6_storage.sin6_family = AF_INET6; 4473 lsa6_storage.sin6_len = sizeof(lsa6_storage); 4474 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4475 if ((error = sa6_recoverscope(&lsa6_storage)) != 0) { 4476 SCTPDBG(SCTP_DEBUG_OUTPUT3, "recover scope fails error %d\n", error); 4477 sctp_m_freem(m); 4478 return (error); 4479 } 4480 /* XXX */ 4481 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4482 lsa6_storage.sin6_port = inp->sctp_lport; 4483 lsa6 = &lsa6_storage; 4484 ip6h->ip6_src = lsa6->sin6_addr; 4485 4486 if (port) { 4487 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4488 sctp_handle_no_route(stcb, net, so_locked); 4489 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4490 sctp_m_freem(m); 4491 return (EHOSTUNREACH); 4492 } 4493 udp = (struct udphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4494 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4495 udp->uh_dport = port; 4496 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4497 udp->uh_sum = 0; 4498 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4499 } else { 4500 sctphdr = (struct sctphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4501 } 4502 4503 sctphdr->src_port = src_port; 4504 sctphdr->dest_port = dest_port; 4505 sctphdr->v_tag = v_tag; 4506 sctphdr->checksum = 0; 4507 4508 /* 4509 * We set the hop limit now since there is a good 4510 * chance that our ro pointer is now filled 4511 */ 4512 ip6h->ip6_hlim = SCTP_GET_HLIM(inp, ro); 4513 ifp = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 4514 4515 #ifdef SCTP_DEBUG 4516 /* Copy to be sure something bad is not happening */ 4517 sin6->sin6_addr = ip6h->ip6_dst; 4518 lsa6->sin6_addr = ip6h->ip6_src; 4519 #endif 4520 4521 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv6 output routine from low level\n"); 4522 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src: "); 4523 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)lsa6); 4524 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst: "); 4525 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)sin6); 4526 if (net) { 4527 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4528 /* 4529 * preserve the port and scope for link 4530 * local send 4531 */ 4532 prev_scope = sin6->sin6_scope_id; 4533 prev_port = sin6->sin6_port; 4534 } 4535 4536 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4537 /* failed to prepend data, give up */ 4538 sctp_m_freem(m); 4539 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4540 return (ENOMEM); 4541 } 4542 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4543 if (port) { 4544 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 4545 SCTP_STAT_INCR(sctps_sendswcrc); 4546 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), packet_length - sizeof(struct ip6_hdr))) == 0) { 4547 udp->uh_sum = 0xffff; 4548 } 4549 } else { 4550 m->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 4551 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4552 SCTP_STAT_INCR(sctps_sendhwcrc); 4553 } 4554 /* send it out. table id is taken from stcb */ 4555 #ifdef SCTP_PACKET_LOGGING 4556 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4557 sctp_packet_log(o_pak); 4558 #endif 4559 SCTP_PROBE5(send, NULL, stcb, ip6h, stcb, sctphdr); 4560 SCTP_IP6_OUTPUT(ret, o_pak, (struct route_in6 *)ro, &ifp, stcb, vrf_id); 4561 if (net) { 4562 /* for link local this must be done */ 4563 sin6->sin6_scope_id = prev_scope; 4564 sin6->sin6_port = prev_port; 4565 } 4566 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 4567 if (port) { 4568 UDPSTAT_INC(udps_opackets); 4569 } 4570 SCTP_STAT_INCR(sctps_sendpackets); 4571 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4572 if (ret) { 4573 SCTP_STAT_INCR(sctps_senderrors); 4574 } 4575 if (net == NULL) { 4576 /* Now if we had a temp route free it */ 4577 RO_NHFREE(ro); 4578 } else { 4579 /* 4580 * PMTU check versus smallest asoc MTU goes 4581 * here 4582 */ 4583 if (ro->ro_nh == NULL) { 4584 /* Route was freed */ 4585 if (net->ro._s_addr && 4586 net->src_addr_selected) { 4587 sctp_free_ifa(net->ro._s_addr); 4588 net->ro._s_addr = NULL; 4589 } 4590 net->src_addr_selected = 0; 4591 } 4592 if ((ro->ro_nh != NULL) && (net->ro._s_addr) && 4593 ((net->dest_state & SCTP_ADDR_NO_PMTUD) == 0)) { 4594 uint32_t mtu; 4595 4596 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_nh); 4597 if (mtu > 0) { 4598 if (net->port) { 4599 mtu -= sizeof(struct udphdr); 4600 } 4601 if (mtu < net->mtu) { 4602 if ((stcb != NULL) && (stcb->asoc.smallest_mtu > mtu)) { 4603 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4604 } 4605 net->mtu = mtu; 4606 } 4607 } 4608 } else if (ifp) { 4609 if (ND_IFINFO(ifp)->linkmtu && 4610 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) { 4611 sctp_mtu_size_reset(inp, 4612 &stcb->asoc, 4613 ND_IFINFO(ifp)->linkmtu); 4614 } 4615 } 4616 } 4617 return (ret); 4618 } 4619 #endif 4620 default: 4621 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 4622 ((struct sockaddr *)to)->sa_family); 4623 sctp_m_freem(m); 4624 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4625 return (EFAULT); 4626 } 4627 } 4628 4629 4630 void 4631 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int so_locked) 4632 { 4633 struct mbuf *m, *m_last; 4634 struct sctp_nets *net; 4635 struct sctp_init_chunk *init; 4636 struct sctp_supported_addr_param *sup_addr; 4637 struct sctp_adaptation_layer_indication *ali; 4638 struct sctp_supported_chunk_types_param *pr_supported; 4639 struct sctp_paramhdr *ph; 4640 int cnt_inits_to = 0; 4641 int error; 4642 uint16_t num_ext, chunk_len, padding_len, parameter_len; 4643 4644 /* INIT's always go to the primary (and usually ONLY address) */ 4645 net = stcb->asoc.primary_destination; 4646 if (net == NULL) { 4647 net = TAILQ_FIRST(&stcb->asoc.nets); 4648 if (net == NULL) { 4649 /* TSNH */ 4650 return; 4651 } 4652 /* we confirm any address we send an INIT to */ 4653 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4654 (void)sctp_set_primary_addr(stcb, NULL, net); 4655 } else { 4656 /* we confirm any address we send an INIT to */ 4657 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4658 } 4659 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT\n"); 4660 #ifdef INET6 4661 if (net->ro._l_addr.sa.sa_family == AF_INET6) { 4662 /* 4663 * special hook, if we are sending to link local it will not 4664 * show up in our private address count. 4665 */ 4666 if (IN6_IS_ADDR_LINKLOCAL(&net->ro._l_addr.sin6.sin6_addr)) 4667 cnt_inits_to = 1; 4668 } 4669 #endif 4670 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 4671 /* This case should not happen */ 4672 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - failed timer?\n"); 4673 return; 4674 } 4675 /* start the INIT timer */ 4676 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 4677 4678 m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_NOWAIT, 1, MT_DATA); 4679 if (m == NULL) { 4680 /* No memory, INIT timer will re-attempt. */ 4681 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - mbuf?\n"); 4682 return; 4683 } 4684 chunk_len = (uint16_t)sizeof(struct sctp_init_chunk); 4685 padding_len = 0; 4686 /* Now lets put the chunk header in place */ 4687 init = mtod(m, struct sctp_init_chunk *); 4688 /* now the chunk header */ 4689 init->ch.chunk_type = SCTP_INITIATION; 4690 init->ch.chunk_flags = 0; 4691 /* fill in later from mbuf we build */ 4692 init->ch.chunk_length = 0; 4693 /* place in my tag */ 4694 init->init.initiate_tag = htonl(stcb->asoc.my_vtag); 4695 /* set up some of the credits. */ 4696 init->init.a_rwnd = htonl(max(inp->sctp_socket ? SCTP_SB_LIMIT_RCV(inp->sctp_socket) : 0, 4697 SCTP_MINIMAL_RWND)); 4698 init->init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 4699 init->init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 4700 init->init.initial_tsn = htonl(stcb->asoc.init_seq_number); 4701 4702 /* Adaptation layer indication parameter */ 4703 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 4704 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 4705 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 4706 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 4707 ali->ph.param_length = htons(parameter_len); 4708 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 4709 chunk_len += parameter_len; 4710 } 4711 4712 /* ECN parameter */ 4713 if (stcb->asoc.ecn_supported == 1) { 4714 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4715 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4716 ph->param_type = htons(SCTP_ECN_CAPABLE); 4717 ph->param_length = htons(parameter_len); 4718 chunk_len += parameter_len; 4719 } 4720 4721 /* PR-SCTP supported parameter */ 4722 if (stcb->asoc.prsctp_supported == 1) { 4723 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4724 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4725 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 4726 ph->param_length = htons(parameter_len); 4727 chunk_len += parameter_len; 4728 } 4729 4730 /* Add NAT friendly parameter. */ 4731 if (SCTP_BASE_SYSCTL(sctp_inits_include_nat_friendly)) { 4732 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4733 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4734 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 4735 ph->param_length = htons(parameter_len); 4736 chunk_len += parameter_len; 4737 } 4738 4739 /* And now tell the peer which extensions we support */ 4740 num_ext = 0; 4741 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 4742 if (stcb->asoc.prsctp_supported == 1) { 4743 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 4744 if (stcb->asoc.idata_supported) { 4745 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 4746 } 4747 } 4748 if (stcb->asoc.auth_supported == 1) { 4749 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 4750 } 4751 if (stcb->asoc.asconf_supported == 1) { 4752 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 4753 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 4754 } 4755 if (stcb->asoc.reconfig_supported == 1) { 4756 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 4757 } 4758 if (stcb->asoc.idata_supported) { 4759 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 4760 } 4761 if (stcb->asoc.nrsack_supported == 1) { 4762 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 4763 } 4764 if (stcb->asoc.pktdrop_supported == 1) { 4765 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 4766 } 4767 if (num_ext > 0) { 4768 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 4769 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 4770 pr_supported->ph.param_length = htons(parameter_len); 4771 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4772 chunk_len += parameter_len; 4773 } 4774 /* add authentication parameters */ 4775 if (stcb->asoc.auth_supported) { 4776 /* attach RANDOM parameter, if available */ 4777 if (stcb->asoc.authinfo.random != NULL) { 4778 struct sctp_auth_random *randp; 4779 4780 if (padding_len > 0) { 4781 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4782 chunk_len += padding_len; 4783 padding_len = 0; 4784 } 4785 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 4786 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + stcb->asoc.authinfo.random_len; 4787 /* random key already contains the header */ 4788 memcpy(randp, stcb->asoc.authinfo.random->key, parameter_len); 4789 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4790 chunk_len += parameter_len; 4791 } 4792 /* add HMAC_ALGO parameter */ 4793 if (stcb->asoc.local_hmacs != NULL) { 4794 struct sctp_auth_hmac_algo *hmacs; 4795 4796 if (padding_len > 0) { 4797 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4798 chunk_len += padding_len; 4799 padding_len = 0; 4800 } 4801 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 4802 parameter_len = (uint16_t)(sizeof(struct sctp_auth_hmac_algo) + 4803 stcb->asoc.local_hmacs->num_algo * sizeof(uint16_t)); 4804 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 4805 hmacs->ph.param_length = htons(parameter_len); 4806 sctp_serialize_hmaclist(stcb->asoc.local_hmacs, (uint8_t *)hmacs->hmac_ids); 4807 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4808 chunk_len += parameter_len; 4809 } 4810 /* add CHUNKS parameter */ 4811 if (stcb->asoc.local_auth_chunks != NULL) { 4812 struct sctp_auth_chunk_list *chunks; 4813 4814 if (padding_len > 0) { 4815 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4816 chunk_len += padding_len; 4817 padding_len = 0; 4818 } 4819 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 4820 parameter_len = (uint16_t)(sizeof(struct sctp_auth_chunk_list) + 4821 sctp_auth_get_chklist_size(stcb->asoc.local_auth_chunks)); 4822 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 4823 chunks->ph.param_length = htons(parameter_len); 4824 sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks, chunks->chunk_types); 4825 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4826 chunk_len += parameter_len; 4827 } 4828 } 4829 4830 /* now any cookie time extensions */ 4831 if (stcb->asoc.cookie_preserve_req) { 4832 struct sctp_cookie_perserve_param *cookie_preserve; 4833 4834 if (padding_len > 0) { 4835 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4836 chunk_len += padding_len; 4837 padding_len = 0; 4838 } 4839 parameter_len = (uint16_t)sizeof(struct sctp_cookie_perserve_param); 4840 cookie_preserve = (struct sctp_cookie_perserve_param *)(mtod(m, caddr_t)+chunk_len); 4841 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 4842 cookie_preserve->ph.param_length = htons(parameter_len); 4843 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 4844 stcb->asoc.cookie_preserve_req = 0; 4845 chunk_len += parameter_len; 4846 } 4847 4848 if (stcb->asoc.scope.ipv4_addr_legal || stcb->asoc.scope.ipv6_addr_legal) { 4849 uint8_t i; 4850 4851 if (padding_len > 0) { 4852 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4853 chunk_len += padding_len; 4854 padding_len = 0; 4855 } 4856 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4857 if (stcb->asoc.scope.ipv4_addr_legal) { 4858 parameter_len += (uint16_t)sizeof(uint16_t); 4859 } 4860 if (stcb->asoc.scope.ipv6_addr_legal) { 4861 parameter_len += (uint16_t)sizeof(uint16_t); 4862 } 4863 sup_addr = (struct sctp_supported_addr_param *)(mtod(m, caddr_t)+chunk_len); 4864 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 4865 sup_addr->ph.param_length = htons(parameter_len); 4866 i = 0; 4867 if (stcb->asoc.scope.ipv4_addr_legal) { 4868 sup_addr->addr_type[i++] = htons(SCTP_IPV4_ADDRESS); 4869 } 4870 if (stcb->asoc.scope.ipv6_addr_legal) { 4871 sup_addr->addr_type[i++] = htons(SCTP_IPV6_ADDRESS); 4872 } 4873 padding_len = 4 - 2 * i; 4874 chunk_len += parameter_len; 4875 } 4876 4877 SCTP_BUF_LEN(m) = chunk_len; 4878 /* now the addresses */ 4879 /* 4880 * To optimize this we could put the scoping stuff into a structure 4881 * and remove the individual uint8's from the assoc structure. Then 4882 * we could just sifa in the address within the stcb. But for now 4883 * this is a quick hack to get the address stuff teased apart. 4884 */ 4885 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &stcb->asoc.scope, 4886 m, cnt_inits_to, 4887 &padding_len, &chunk_len); 4888 4889 init->ch.chunk_length = htons(chunk_len); 4890 if (padding_len > 0) { 4891 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 4892 sctp_m_freem(m); 4893 return; 4894 } 4895 } 4896 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - calls lowlevel_output\n"); 4897 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 4898 (struct sockaddr *)&net->ro._l_addr, 4899 m, 0, NULL, 0, 0, 0, 0, 4900 inp->sctp_lport, stcb->rport, htonl(0), 4901 net->port, NULL, 4902 0, 0, 4903 so_locked))) { 4904 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 4905 if (error == ENOBUFS) { 4906 stcb->asoc.ifp_had_enobuf = 1; 4907 SCTP_STAT_INCR(sctps_lowlevelerr); 4908 } 4909 } else { 4910 stcb->asoc.ifp_had_enobuf = 0; 4911 } 4912 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 4913 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 4914 } 4915 4916 struct mbuf * 4917 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 4918 int param_offset, int *abort_processing, 4919 struct sctp_chunkhdr *cp, 4920 int *nat_friendly, 4921 int *cookie_found) 4922 { 4923 /* 4924 * Given a mbuf containing an INIT or INIT-ACK with the param_offset 4925 * being equal to the beginning of the params i.e. (iphlen + 4926 * sizeof(struct sctp_init_msg) parse through the parameters to the 4927 * end of the mbuf verifying that all parameters are known. 4928 * 4929 * For unknown parameters build and return a mbuf with 4930 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop 4931 * processing this chunk stop, and set *abort_processing to 1. 4932 * 4933 * By having param_offset be pre-set to where parameters begin it is 4934 * hoped that this routine may be reused in the future by new 4935 * features. 4936 */ 4937 struct sctp_paramhdr *phdr, params; 4938 4939 struct mbuf *mat, *m_tmp, *op_err, *op_err_last; 4940 int at, limit, pad_needed; 4941 uint16_t ptype, plen, padded_size; 4942 4943 *abort_processing = 0; 4944 if (cookie_found != NULL) { 4945 *cookie_found = 0; 4946 } 4947 mat = in_initpkt; 4948 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 4949 at = param_offset; 4950 op_err = NULL; 4951 op_err_last = NULL; 4952 pad_needed = 0; 4953 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Check for unrecognized param's\n"); 4954 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 4955 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 4956 ptype = ntohs(phdr->param_type); 4957 plen = ntohs(phdr->param_length); 4958 if ((plen > limit) || (plen < sizeof(struct sctp_paramhdr))) { 4959 /* wacked parameter */ 4960 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error %d\n", plen); 4961 goto invalid_size; 4962 } 4963 limit -= SCTP_SIZE32(plen); 4964 /*- 4965 * All parameters for all chunks that we know/understand are 4966 * listed here. We process them other places and make 4967 * appropriate stop actions per the upper bits. However this 4968 * is the generic routine processor's can call to get back 4969 * an operr.. to either incorporate (init-ack) or send. 4970 */ 4971 padded_size = SCTP_SIZE32(plen); 4972 switch (ptype) { 4973 /* Param's with variable size */ 4974 case SCTP_HEARTBEAT_INFO: 4975 case SCTP_UNRECOG_PARAM: 4976 case SCTP_ERROR_CAUSE_IND: 4977 /* ok skip fwd */ 4978 at += padded_size; 4979 break; 4980 case SCTP_STATE_COOKIE: 4981 if (cookie_found != NULL) { 4982 *cookie_found = 1; 4983 } 4984 at += padded_size; 4985 break; 4986 /* Param's with variable size within a range */ 4987 case SCTP_CHUNK_LIST: 4988 case SCTP_SUPPORTED_CHUNK_EXT: 4989 if (padded_size > (sizeof(struct sctp_supported_chunk_types_param) + (sizeof(uint8_t) * SCTP_MAX_SUPPORTED_EXT))) { 4990 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error chklist %d\n", plen); 4991 goto invalid_size; 4992 } 4993 at += padded_size; 4994 break; 4995 case SCTP_SUPPORTED_ADDRTYPE: 4996 if (padded_size > SCTP_MAX_ADDR_PARAMS_SIZE) { 4997 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error supaddrtype %d\n", plen); 4998 goto invalid_size; 4999 } 5000 at += padded_size; 5001 break; 5002 case SCTP_RANDOM: 5003 if (padded_size > (sizeof(struct sctp_auth_random) + SCTP_RANDOM_MAX_SIZE)) { 5004 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error random %d\n", plen); 5005 goto invalid_size; 5006 } 5007 at += padded_size; 5008 break; 5009 case SCTP_SET_PRIM_ADDR: 5010 case SCTP_DEL_IP_ADDRESS: 5011 case SCTP_ADD_IP_ADDRESS: 5012 if ((padded_size != sizeof(struct sctp_asconf_addrv4_param)) && 5013 (padded_size != sizeof(struct sctp_asconf_addr_param))) { 5014 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error setprim %d\n", plen); 5015 goto invalid_size; 5016 } 5017 at += padded_size; 5018 break; 5019 /* Param's with a fixed size */ 5020 case SCTP_IPV4_ADDRESS: 5021 if (padded_size != sizeof(struct sctp_ipv4addr_param)) { 5022 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv4 addr %d\n", plen); 5023 goto invalid_size; 5024 } 5025 at += padded_size; 5026 break; 5027 case SCTP_IPV6_ADDRESS: 5028 if (padded_size != sizeof(struct sctp_ipv6addr_param)) { 5029 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv6 addr %d\n", plen); 5030 goto invalid_size; 5031 } 5032 at += padded_size; 5033 break; 5034 case SCTP_COOKIE_PRESERVE: 5035 if (padded_size != sizeof(struct sctp_cookie_perserve_param)) { 5036 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error cookie-preserve %d\n", plen); 5037 goto invalid_size; 5038 } 5039 at += padded_size; 5040 break; 5041 case SCTP_HAS_NAT_SUPPORT: 5042 *nat_friendly = 1; 5043 /* fall through */ 5044 case SCTP_PRSCTP_SUPPORTED: 5045 if (padded_size != sizeof(struct sctp_paramhdr)) { 5046 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error prsctp/nat support %d\n", plen); 5047 goto invalid_size; 5048 } 5049 at += padded_size; 5050 break; 5051 case SCTP_ECN_CAPABLE: 5052 if (padded_size != sizeof(struct sctp_paramhdr)) { 5053 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecn %d\n", plen); 5054 goto invalid_size; 5055 } 5056 at += padded_size; 5057 break; 5058 case SCTP_ULP_ADAPTATION: 5059 if (padded_size != sizeof(struct sctp_adaptation_layer_indication)) { 5060 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error adapatation %d\n", plen); 5061 goto invalid_size; 5062 } 5063 at += padded_size; 5064 break; 5065 case SCTP_SUCCESS_REPORT: 5066 if (padded_size != sizeof(struct sctp_asconf_paramhdr)) { 5067 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error success %d\n", plen); 5068 goto invalid_size; 5069 } 5070 at += padded_size; 5071 break; 5072 case SCTP_HOSTNAME_ADDRESS: 5073 { 5074 /* Hostname parameters are deprecated. */ 5075 struct sctp_gen_error_cause *cause; 5076 int l_len; 5077 5078 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Can't handle hostname addresses.. abort processing\n"); 5079 *abort_processing = 1; 5080 sctp_m_freem(op_err); 5081 op_err = NULL; 5082 op_err_last = NULL; 5083 #ifdef INET6 5084 l_len = SCTP_MIN_OVERHEAD; 5085 #else 5086 l_len = SCTP_MIN_V4_OVERHEAD; 5087 #endif 5088 l_len += sizeof(struct sctp_chunkhdr); 5089 l_len += sizeof(struct sctp_gen_error_cause); 5090 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5091 if (op_err != NULL) { 5092 /* 5093 * Pre-reserve space for IP, SCTP, 5094 * and chunk header. 5095 */ 5096 #ifdef INET6 5097 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5098 #else 5099 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5100 #endif 5101 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5102 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5103 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause); 5104 cause = mtod(op_err, struct sctp_gen_error_cause *); 5105 cause->code = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR); 5106 cause->length = htons((uint16_t)(sizeof(struct sctp_gen_error_cause) + plen)); 5107 SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(mat, at, plen, M_NOWAIT); 5108 if (SCTP_BUF_NEXT(op_err) == NULL) { 5109 sctp_m_freem(op_err); 5110 op_err = NULL; 5111 op_err_last = NULL; 5112 } 5113 } 5114 return (op_err); 5115 } 5116 default: 5117 /* 5118 * we do not recognize the parameter figure out what 5119 * we do. 5120 */ 5121 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Hit default param %x\n", ptype); 5122 if ((ptype & 0x4000) == 0x4000) { 5123 /* Report bit is set?? */ 5124 SCTPDBG(SCTP_DEBUG_OUTPUT1, "report op err\n"); 5125 if (op_err == NULL) { 5126 int l_len; 5127 5128 /* Ok need to try to get an mbuf */ 5129 #ifdef INET6 5130 l_len = SCTP_MIN_OVERHEAD; 5131 #else 5132 l_len = SCTP_MIN_V4_OVERHEAD; 5133 #endif 5134 l_len += sizeof(struct sctp_chunkhdr); 5135 l_len += sizeof(struct sctp_paramhdr); 5136 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5137 if (op_err) { 5138 SCTP_BUF_LEN(op_err) = 0; 5139 #ifdef INET6 5140 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5141 #else 5142 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5143 #endif 5144 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5145 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5146 op_err_last = op_err; 5147 } 5148 } 5149 if (op_err != NULL) { 5150 /* If we have space */ 5151 struct sctp_paramhdr *param; 5152 5153 if (pad_needed > 0) { 5154 op_err_last = sctp_add_pad_tombuf(op_err_last, pad_needed); 5155 } 5156 if (op_err_last == NULL) { 5157 sctp_m_freem(op_err); 5158 op_err = NULL; 5159 op_err_last = NULL; 5160 goto more_processing; 5161 } 5162 if (M_TRAILINGSPACE(op_err_last) < (int)sizeof(struct sctp_paramhdr)) { 5163 m_tmp = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_NOWAIT, 1, MT_DATA); 5164 if (m_tmp == NULL) { 5165 sctp_m_freem(op_err); 5166 op_err = NULL; 5167 op_err_last = NULL; 5168 goto more_processing; 5169 } 5170 SCTP_BUF_LEN(m_tmp) = 0; 5171 SCTP_BUF_NEXT(m_tmp) = NULL; 5172 SCTP_BUF_NEXT(op_err_last) = m_tmp; 5173 op_err_last = m_tmp; 5174 } 5175 param = (struct sctp_paramhdr *)(mtod(op_err_last, caddr_t)+SCTP_BUF_LEN(op_err_last)); 5176 param->param_type = htons(SCTP_UNRECOG_PARAM); 5177 param->param_length = htons((uint16_t)sizeof(struct sctp_paramhdr) + plen); 5178 SCTP_BUF_LEN(op_err_last) += sizeof(struct sctp_paramhdr); 5179 SCTP_BUF_NEXT(op_err_last) = SCTP_M_COPYM(mat, at, plen, M_NOWAIT); 5180 if (SCTP_BUF_NEXT(op_err_last) == NULL) { 5181 sctp_m_freem(op_err); 5182 op_err = NULL; 5183 op_err_last = NULL; 5184 goto more_processing; 5185 } else { 5186 while (SCTP_BUF_NEXT(op_err_last) != NULL) { 5187 op_err_last = SCTP_BUF_NEXT(op_err_last); 5188 } 5189 } 5190 if (plen % 4 != 0) { 5191 pad_needed = 4 - (plen % 4); 5192 } else { 5193 pad_needed = 0; 5194 } 5195 } 5196 } 5197 more_processing: 5198 if ((ptype & 0x8000) == 0x0000) { 5199 SCTPDBG(SCTP_DEBUG_OUTPUT1, "stop proc\n"); 5200 return (op_err); 5201 } else { 5202 /* skip this chunk and continue processing */ 5203 SCTPDBG(SCTP_DEBUG_OUTPUT1, "move on\n"); 5204 at += SCTP_SIZE32(plen); 5205 } 5206 break; 5207 5208 } 5209 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5210 } 5211 return (op_err); 5212 invalid_size: 5213 SCTPDBG(SCTP_DEBUG_OUTPUT1, "abort flag set\n"); 5214 *abort_processing = 1; 5215 sctp_m_freem(op_err); 5216 op_err = NULL; 5217 op_err_last = NULL; 5218 if (phdr != NULL) { 5219 struct sctp_paramhdr *param; 5220 int l_len; 5221 #ifdef INET6 5222 l_len = SCTP_MIN_OVERHEAD; 5223 #else 5224 l_len = SCTP_MIN_V4_OVERHEAD; 5225 #endif 5226 l_len += sizeof(struct sctp_chunkhdr); 5227 l_len += (2 * sizeof(struct sctp_paramhdr)); 5228 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5229 if (op_err) { 5230 SCTP_BUF_LEN(op_err) = 0; 5231 #ifdef INET6 5232 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5233 #else 5234 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5235 #endif 5236 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5237 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5238 SCTP_BUF_LEN(op_err) = 2 * sizeof(struct sctp_paramhdr); 5239 param = mtod(op_err, struct sctp_paramhdr *); 5240 param->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 5241 param->param_length = htons(2 * sizeof(struct sctp_paramhdr)); 5242 param++; 5243 param->param_type = htons(ptype); 5244 param->param_length = htons(plen); 5245 } 5246 } 5247 return (op_err); 5248 } 5249 5250 static int 5251 sctp_are_there_new_addresses(struct sctp_association *asoc, 5252 struct mbuf *in_initpkt, int offset, struct sockaddr *src) 5253 { 5254 /* 5255 * Given a INIT packet, look through the packet to verify that there 5256 * are NO new addresses. As we go through the parameters add reports 5257 * of any un-understood parameters that require an error. Also we 5258 * must return (1) to drop the packet if we see a un-understood 5259 * parameter that tells us to drop the chunk. 5260 */ 5261 struct sockaddr *sa_touse; 5262 struct sockaddr *sa; 5263 struct sctp_paramhdr *phdr, params; 5264 uint16_t ptype, plen; 5265 uint8_t fnd; 5266 struct sctp_nets *net; 5267 int check_src; 5268 #ifdef INET 5269 struct sockaddr_in sin4, *sa4; 5270 #endif 5271 #ifdef INET6 5272 struct sockaddr_in6 sin6, *sa6; 5273 #endif 5274 5275 #ifdef INET 5276 memset(&sin4, 0, sizeof(sin4)); 5277 sin4.sin_family = AF_INET; 5278 sin4.sin_len = sizeof(sin4); 5279 #endif 5280 #ifdef INET6 5281 memset(&sin6, 0, sizeof(sin6)); 5282 sin6.sin6_family = AF_INET6; 5283 sin6.sin6_len = sizeof(sin6); 5284 #endif 5285 /* First what about the src address of the pkt ? */ 5286 check_src = 0; 5287 switch (src->sa_family) { 5288 #ifdef INET 5289 case AF_INET: 5290 if (asoc->scope.ipv4_addr_legal) { 5291 check_src = 1; 5292 } 5293 break; 5294 #endif 5295 #ifdef INET6 5296 case AF_INET6: 5297 if (asoc->scope.ipv6_addr_legal) { 5298 check_src = 1; 5299 } 5300 break; 5301 #endif 5302 default: 5303 /* TSNH */ 5304 break; 5305 } 5306 if (check_src) { 5307 fnd = 0; 5308 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5309 sa = (struct sockaddr *)&net->ro._l_addr; 5310 if (sa->sa_family == src->sa_family) { 5311 #ifdef INET 5312 if (sa->sa_family == AF_INET) { 5313 struct sockaddr_in *src4; 5314 5315 sa4 = (struct sockaddr_in *)sa; 5316 src4 = (struct sockaddr_in *)src; 5317 if (sa4->sin_addr.s_addr == src4->sin_addr.s_addr) { 5318 fnd = 1; 5319 break; 5320 } 5321 } 5322 #endif 5323 #ifdef INET6 5324 if (sa->sa_family == AF_INET6) { 5325 struct sockaddr_in6 *src6; 5326 5327 sa6 = (struct sockaddr_in6 *)sa; 5328 src6 = (struct sockaddr_in6 *)src; 5329 if (SCTP6_ARE_ADDR_EQUAL(sa6, src6)) { 5330 fnd = 1; 5331 break; 5332 } 5333 } 5334 #endif 5335 } 5336 } 5337 if (fnd == 0) { 5338 /* New address added! no need to look further. */ 5339 return (1); 5340 } 5341 } 5342 /* Ok so far lets munge through the rest of the packet */ 5343 offset += sizeof(struct sctp_init_chunk); 5344 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5345 while (phdr) { 5346 sa_touse = NULL; 5347 ptype = ntohs(phdr->param_type); 5348 plen = ntohs(phdr->param_length); 5349 switch (ptype) { 5350 #ifdef INET 5351 case SCTP_IPV4_ADDRESS: 5352 { 5353 struct sctp_ipv4addr_param *p4, p4_buf; 5354 5355 if (plen != sizeof(struct sctp_ipv4addr_param)) { 5356 return (1); 5357 } 5358 phdr = sctp_get_next_param(in_initpkt, offset, 5359 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 5360 if (phdr == NULL) { 5361 return (1); 5362 } 5363 if (asoc->scope.ipv4_addr_legal) { 5364 p4 = (struct sctp_ipv4addr_param *)phdr; 5365 sin4.sin_addr.s_addr = p4->addr; 5366 sa_touse = (struct sockaddr *)&sin4; 5367 } 5368 break; 5369 } 5370 #endif 5371 #ifdef INET6 5372 case SCTP_IPV6_ADDRESS: 5373 { 5374 struct sctp_ipv6addr_param *p6, p6_buf; 5375 5376 if (plen != sizeof(struct sctp_ipv6addr_param)) { 5377 return (1); 5378 } 5379 phdr = sctp_get_next_param(in_initpkt, offset, 5380 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 5381 if (phdr == NULL) { 5382 return (1); 5383 } 5384 if (asoc->scope.ipv6_addr_legal) { 5385 p6 = (struct sctp_ipv6addr_param *)phdr; 5386 memcpy((caddr_t)&sin6.sin6_addr, p6->addr, 5387 sizeof(p6->addr)); 5388 sa_touse = (struct sockaddr *)&sin6; 5389 } 5390 break; 5391 } 5392 #endif 5393 default: 5394 sa_touse = NULL; 5395 break; 5396 } 5397 if (sa_touse) { 5398 /* ok, sa_touse points to one to check */ 5399 fnd = 0; 5400 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5401 sa = (struct sockaddr *)&net->ro._l_addr; 5402 if (sa->sa_family != sa_touse->sa_family) { 5403 continue; 5404 } 5405 #ifdef INET 5406 if (sa->sa_family == AF_INET) { 5407 sa4 = (struct sockaddr_in *)sa; 5408 if (sa4->sin_addr.s_addr == 5409 sin4.sin_addr.s_addr) { 5410 fnd = 1; 5411 break; 5412 } 5413 } 5414 #endif 5415 #ifdef INET6 5416 if (sa->sa_family == AF_INET6) { 5417 sa6 = (struct sockaddr_in6 *)sa; 5418 if (SCTP6_ARE_ADDR_EQUAL( 5419 sa6, &sin6)) { 5420 fnd = 1; 5421 break; 5422 } 5423 } 5424 #endif 5425 } 5426 if (!fnd) { 5427 /* New addr added! no need to look further */ 5428 return (1); 5429 } 5430 } 5431 offset += SCTP_SIZE32(plen); 5432 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5433 } 5434 return (0); 5435 } 5436 5437 /* 5438 * Given a MBUF chain that was sent into us containing an INIT. Build a 5439 * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done 5440 * a pullup to include IPv6/4header, SCTP header and initial part of INIT 5441 * message (i.e. the struct sctp_init_msg). 5442 */ 5443 void 5444 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 5445 struct sctp_nets *src_net, struct mbuf *init_pkt, 5446 int iphlen, int offset, 5447 struct sockaddr *src, struct sockaddr *dst, 5448 struct sctphdr *sh, struct sctp_init_chunk *init_chk, 5449 uint8_t mflowtype, uint32_t mflowid, 5450 uint32_t vrf_id, uint16_t port) 5451 { 5452 struct sctp_association *asoc; 5453 struct mbuf *m, *m_tmp, *m_last, *m_cookie, *op_err; 5454 struct sctp_init_ack_chunk *initack; 5455 struct sctp_adaptation_layer_indication *ali; 5456 struct sctp_supported_chunk_types_param *pr_supported; 5457 struct sctp_paramhdr *ph; 5458 union sctp_sockstore *over_addr; 5459 struct sctp_scoping scp; 5460 struct timeval now; 5461 #ifdef INET 5462 struct sockaddr_in *dst4 = (struct sockaddr_in *)dst; 5463 struct sockaddr_in *src4 = (struct sockaddr_in *)src; 5464 struct sockaddr_in *sin; 5465 #endif 5466 #ifdef INET6 5467 struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst; 5468 struct sockaddr_in6 *src6 = (struct sockaddr_in6 *)src; 5469 struct sockaddr_in6 *sin6; 5470 #endif 5471 struct sockaddr *to; 5472 struct sctp_state_cookie stc; 5473 struct sctp_nets *net = NULL; 5474 uint8_t *signature = NULL; 5475 int cnt_inits_to = 0; 5476 uint16_t his_limit, i_want; 5477 int abort_flag; 5478 int nat_friendly = 0; 5479 int error; 5480 struct socket *so; 5481 uint16_t num_ext, chunk_len, padding_len, parameter_len; 5482 5483 if (stcb) { 5484 asoc = &stcb->asoc; 5485 } else { 5486 asoc = NULL; 5487 } 5488 if ((asoc != NULL) && 5489 (SCTP_GET_STATE(stcb) != SCTP_STATE_COOKIE_WAIT)) { 5490 if (sctp_are_there_new_addresses(asoc, init_pkt, offset, src)) { 5491 /* 5492 * new addresses, out of here in non-cookie-wait 5493 * states 5494 * 5495 * Send an ABORT, without the new address error 5496 * cause. This looks no different than if no 5497 * listener was present. 5498 */ 5499 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5500 "Address added"); 5501 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5502 mflowtype, mflowid, inp->fibnum, 5503 vrf_id, port); 5504 return; 5505 } 5506 if (src_net != NULL && (src_net->port != port)) { 5507 /* 5508 * change of remote encapsulation port, out of here 5509 * in non-cookie-wait states 5510 * 5511 * Send an ABORT, without an specific error cause. 5512 * This looks no different than if no listener was 5513 * present. 5514 */ 5515 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5516 "Remote encapsulation port changed"); 5517 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5518 mflowtype, mflowid, inp->fibnum, 5519 vrf_id, port); 5520 return; 5521 } 5522 } 5523 abort_flag = 0; 5524 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 5525 (offset + sizeof(struct sctp_init_chunk)), 5526 &abort_flag, 5527 (struct sctp_chunkhdr *)init_chk, 5528 &nat_friendly, NULL); 5529 if (abort_flag) { 5530 do_a_abort: 5531 if (op_err == NULL) { 5532 char msg[SCTP_DIAG_INFO_LEN]; 5533 5534 SCTP_SNPRINTF(msg, sizeof(msg), "%s:%d at %s", __FILE__, __LINE__, __func__); 5535 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5536 msg); 5537 } 5538 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 5539 init_chk->init.initiate_tag, op_err, 5540 mflowtype, mflowid, inp->fibnum, 5541 vrf_id, port); 5542 return; 5543 } 5544 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 5545 if (m == NULL) { 5546 /* No memory, INIT timer will re-attempt. */ 5547 sctp_m_freem(op_err); 5548 return; 5549 } 5550 chunk_len = (uint16_t)sizeof(struct sctp_init_ack_chunk); 5551 padding_len = 0; 5552 5553 /* 5554 * We might not overwrite the identification[] completely and on 5555 * some platforms time_entered will contain some padding. Therefore 5556 * zero out the cookie to avoid putting uninitialized memory on the 5557 * wire. 5558 */ 5559 memset(&stc, 0, sizeof(struct sctp_state_cookie)); 5560 5561 /* the time I built cookie */ 5562 (void)SCTP_GETTIME_TIMEVAL(&now); 5563 stc.time_entered.tv_sec = now.tv_sec; 5564 stc.time_entered.tv_usec = now.tv_usec; 5565 5566 /* populate any tie tags */ 5567 if (asoc != NULL) { 5568 /* unlock before tag selections */ 5569 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 5570 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 5571 stc.cookie_life = asoc->cookie_life; 5572 net = asoc->primary_destination; 5573 } else { 5574 stc.tie_tag_my_vtag = 0; 5575 stc.tie_tag_peer_vtag = 0; 5576 /* life I will award this cookie */ 5577 stc.cookie_life = inp->sctp_ep.def_cookie_life; 5578 } 5579 5580 /* copy in the ports for later check */ 5581 stc.myport = sh->dest_port; 5582 stc.peerport = sh->src_port; 5583 5584 /* 5585 * If we wanted to honor cookie life extensions, we would add to 5586 * stc.cookie_life. For now we should NOT honor any extension 5587 */ 5588 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 5589 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5590 stc.ipv6_addr_legal = 1; 5591 if (SCTP_IPV6_V6ONLY(inp)) { 5592 stc.ipv4_addr_legal = 0; 5593 } else { 5594 stc.ipv4_addr_legal = 1; 5595 } 5596 } else { 5597 stc.ipv6_addr_legal = 0; 5598 stc.ipv4_addr_legal = 1; 5599 } 5600 stc.ipv4_scope = 0; 5601 if (net == NULL) { 5602 to = src; 5603 switch (dst->sa_family) { 5604 #ifdef INET 5605 case AF_INET: 5606 { 5607 /* lookup address */ 5608 stc.address[0] = src4->sin_addr.s_addr; 5609 stc.address[1] = 0; 5610 stc.address[2] = 0; 5611 stc.address[3] = 0; 5612 stc.addr_type = SCTP_IPV4_ADDRESS; 5613 /* local from address */ 5614 stc.laddress[0] = dst4->sin_addr.s_addr; 5615 stc.laddress[1] = 0; 5616 stc.laddress[2] = 0; 5617 stc.laddress[3] = 0; 5618 stc.laddr_type = SCTP_IPV4_ADDRESS; 5619 /* scope_id is only for v6 */ 5620 stc.scope_id = 0; 5621 if ((IN4_ISPRIVATE_ADDRESS(&src4->sin_addr)) || 5622 (IN4_ISPRIVATE_ADDRESS(&dst4->sin_addr))) { 5623 stc.ipv4_scope = 1; 5624 } 5625 /* Must use the address in this case */ 5626 if (sctp_is_address_on_local_host(src, vrf_id)) { 5627 stc.loopback_scope = 1; 5628 stc.ipv4_scope = 1; 5629 stc.site_scope = 1; 5630 stc.local_scope = 0; 5631 } 5632 break; 5633 } 5634 #endif 5635 #ifdef INET6 5636 case AF_INET6: 5637 { 5638 stc.addr_type = SCTP_IPV6_ADDRESS; 5639 memcpy(&stc.address, &src6->sin6_addr, sizeof(struct in6_addr)); 5640 stc.scope_id = ntohs(in6_getscope(&src6->sin6_addr)); 5641 if (sctp_is_address_on_local_host(src, vrf_id)) { 5642 stc.loopback_scope = 1; 5643 stc.local_scope = 0; 5644 stc.site_scope = 1; 5645 stc.ipv4_scope = 1; 5646 } else if (IN6_IS_ADDR_LINKLOCAL(&src6->sin6_addr) || 5647 IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr)) { 5648 /* 5649 * If the new destination or source 5650 * is a LINK_LOCAL we must have 5651 * common both site and local scope. 5652 * Don't set local scope though 5653 * since we must depend on the 5654 * source to be added implicitly. We 5655 * cannot assure just because we 5656 * share one link that all links are 5657 * common. 5658 */ 5659 stc.local_scope = 0; 5660 stc.site_scope = 1; 5661 stc.ipv4_scope = 1; 5662 /* 5663 * we start counting for the private 5664 * address stuff at 1. since the 5665 * link local we source from won't 5666 * show up in our scoped count. 5667 */ 5668 cnt_inits_to = 1; 5669 /* 5670 * pull out the scope_id from 5671 * incoming pkt 5672 */ 5673 } else if (IN6_IS_ADDR_SITELOCAL(&src6->sin6_addr) || 5674 IN6_IS_ADDR_SITELOCAL(&dst6->sin6_addr)) { 5675 /* 5676 * If the new destination or source 5677 * is SITE_LOCAL then we must have 5678 * site scope in common. 5679 */ 5680 stc.site_scope = 1; 5681 } 5682 memcpy(&stc.laddress, &dst6->sin6_addr, sizeof(struct in6_addr)); 5683 stc.laddr_type = SCTP_IPV6_ADDRESS; 5684 break; 5685 } 5686 #endif 5687 default: 5688 /* TSNH */ 5689 goto do_a_abort; 5690 break; 5691 } 5692 } else { 5693 /* set the scope per the existing tcb */ 5694 5695 #ifdef INET6 5696 struct sctp_nets *lnet; 5697 #endif 5698 5699 stc.loopback_scope = asoc->scope.loopback_scope; 5700 stc.ipv4_scope = asoc->scope.ipv4_local_scope; 5701 stc.site_scope = asoc->scope.site_scope; 5702 stc.local_scope = asoc->scope.local_scope; 5703 #ifdef INET6 5704 /* Why do we not consider IPv4 LL addresses? */ 5705 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 5706 if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) { 5707 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) { 5708 /* 5709 * if we have a LL address, start 5710 * counting at 1. 5711 */ 5712 cnt_inits_to = 1; 5713 } 5714 } 5715 } 5716 #endif 5717 /* use the net pointer */ 5718 to = (struct sockaddr *)&net->ro._l_addr; 5719 switch (to->sa_family) { 5720 #ifdef INET 5721 case AF_INET: 5722 sin = (struct sockaddr_in *)to; 5723 stc.address[0] = sin->sin_addr.s_addr; 5724 stc.address[1] = 0; 5725 stc.address[2] = 0; 5726 stc.address[3] = 0; 5727 stc.addr_type = SCTP_IPV4_ADDRESS; 5728 if (net->src_addr_selected == 0) { 5729 /* 5730 * strange case here, the INIT should have 5731 * did the selection. 5732 */ 5733 net->ro._s_addr = sctp_source_address_selection(inp, 5734 stcb, (sctp_route_t *)&net->ro, 5735 net, 0, vrf_id); 5736 if (net->ro._s_addr == NULL) { 5737 sctp_m_freem(op_err); 5738 sctp_m_freem(m); 5739 return; 5740 } 5741 5742 net->src_addr_selected = 1; 5743 5744 } 5745 stc.laddress[0] = net->ro._s_addr->address.sin.sin_addr.s_addr; 5746 stc.laddress[1] = 0; 5747 stc.laddress[2] = 0; 5748 stc.laddress[3] = 0; 5749 stc.laddr_type = SCTP_IPV4_ADDRESS; 5750 /* scope_id is only for v6 */ 5751 stc.scope_id = 0; 5752 break; 5753 #endif 5754 #ifdef INET6 5755 case AF_INET6: 5756 sin6 = (struct sockaddr_in6 *)to; 5757 memcpy(&stc.address, &sin6->sin6_addr, 5758 sizeof(struct in6_addr)); 5759 stc.addr_type = SCTP_IPV6_ADDRESS; 5760 stc.scope_id = sin6->sin6_scope_id; 5761 if (net->src_addr_selected == 0) { 5762 /* 5763 * strange case here, the INIT should have 5764 * done the selection. 5765 */ 5766 net->ro._s_addr = sctp_source_address_selection(inp, 5767 stcb, (sctp_route_t *)&net->ro, 5768 net, 0, vrf_id); 5769 if (net->ro._s_addr == NULL) { 5770 sctp_m_freem(op_err); 5771 sctp_m_freem(m); 5772 return; 5773 } 5774 5775 net->src_addr_selected = 1; 5776 } 5777 memcpy(&stc.laddress, &net->ro._s_addr->address.sin6.sin6_addr, 5778 sizeof(struct in6_addr)); 5779 stc.laddr_type = SCTP_IPV6_ADDRESS; 5780 break; 5781 #endif 5782 } 5783 } 5784 /* Now lets put the SCTP header in place */ 5785 initack = mtod(m, struct sctp_init_ack_chunk *); 5786 /* Save it off for quick ref */ 5787 stc.peers_vtag = ntohl(init_chk->init.initiate_tag); 5788 /* who are we */ 5789 memcpy(stc.identification, SCTP_VERSION_STRING, 5790 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 5791 memset(stc.reserved, 0, SCTP_RESERVE_SPACE); 5792 /* now the chunk header */ 5793 initack->ch.chunk_type = SCTP_INITIATION_ACK; 5794 initack->ch.chunk_flags = 0; 5795 /* fill in later from mbuf we build */ 5796 initack->ch.chunk_length = 0; 5797 /* place in my tag */ 5798 if ((asoc != NULL) && 5799 ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 5800 (SCTP_GET_STATE(stcb) == SCTP_STATE_INUSE) || 5801 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED))) { 5802 /* re-use the v-tags and init-seq here */ 5803 initack->init.initiate_tag = htonl(asoc->my_vtag); 5804 initack->init.initial_tsn = htonl(asoc->init_seq_number); 5805 } else { 5806 uint32_t vtag, itsn; 5807 5808 if (asoc) { 5809 atomic_add_int(&asoc->refcnt, 1); 5810 SCTP_TCB_UNLOCK(stcb); 5811 new_tag: 5812 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5813 if ((asoc->peer_supports_nat) && (vtag == asoc->my_vtag)) { 5814 /* 5815 * Got a duplicate vtag on some guy behind a 5816 * nat make sure we don't use it. 5817 */ 5818 goto new_tag; 5819 } 5820 initack->init.initiate_tag = htonl(vtag); 5821 /* get a TSN to use too */ 5822 itsn = sctp_select_initial_TSN(&inp->sctp_ep); 5823 initack->init.initial_tsn = htonl(itsn); 5824 SCTP_TCB_LOCK(stcb); 5825 atomic_add_int(&asoc->refcnt, -1); 5826 } else { 5827 SCTP_INP_INCR_REF(inp); 5828 SCTP_INP_RUNLOCK(inp); 5829 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5830 initack->init.initiate_tag = htonl(vtag); 5831 /* get a TSN to use too */ 5832 initack->init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 5833 SCTP_INP_RLOCK(inp); 5834 SCTP_INP_DECR_REF(inp); 5835 } 5836 } 5837 /* save away my tag to */ 5838 stc.my_vtag = initack->init.initiate_tag; 5839 5840 /* set up some of the credits. */ 5841 so = inp->sctp_socket; 5842 if (so == NULL) { 5843 /* memory problem */ 5844 sctp_m_freem(op_err); 5845 sctp_m_freem(m); 5846 return; 5847 } else { 5848 initack->init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(so), SCTP_MINIMAL_RWND)); 5849 } 5850 /* set what I want */ 5851 his_limit = ntohs(init_chk->init.num_inbound_streams); 5852 /* choose what I want */ 5853 if (asoc != NULL) { 5854 if (asoc->streamoutcnt > asoc->pre_open_streams) { 5855 i_want = asoc->streamoutcnt; 5856 } else { 5857 i_want = asoc->pre_open_streams; 5858 } 5859 } else { 5860 i_want = inp->sctp_ep.pre_open_stream_count; 5861 } 5862 if (his_limit < i_want) { 5863 /* I Want more :< */ 5864 initack->init.num_outbound_streams = init_chk->init.num_inbound_streams; 5865 } else { 5866 /* I can have what I want :> */ 5867 initack->init.num_outbound_streams = htons(i_want); 5868 } 5869 /* tell him his limit. */ 5870 initack->init.num_inbound_streams = 5871 htons(inp->sctp_ep.max_open_streams_intome); 5872 5873 /* adaptation layer indication parameter */ 5874 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 5875 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 5876 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 5877 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 5878 ali->ph.param_length = htons(parameter_len); 5879 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 5880 chunk_len += parameter_len; 5881 } 5882 5883 /* ECN parameter */ 5884 if (((asoc != NULL) && (asoc->ecn_supported == 1)) || 5885 ((asoc == NULL) && (inp->ecn_supported == 1))) { 5886 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5887 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5888 ph->param_type = htons(SCTP_ECN_CAPABLE); 5889 ph->param_length = htons(parameter_len); 5890 chunk_len += parameter_len; 5891 } 5892 5893 /* PR-SCTP supported parameter */ 5894 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5895 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5896 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5897 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5898 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 5899 ph->param_length = htons(parameter_len); 5900 chunk_len += parameter_len; 5901 } 5902 5903 /* Add NAT friendly parameter */ 5904 if (nat_friendly) { 5905 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5906 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5907 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 5908 ph->param_length = htons(parameter_len); 5909 chunk_len += parameter_len; 5910 } 5911 5912 /* And now tell the peer which extensions we support */ 5913 num_ext = 0; 5914 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 5915 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5916 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5917 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 5918 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5919 ((asoc == NULL) && (inp->idata_supported == 1))) { 5920 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 5921 } 5922 } 5923 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5924 ((asoc == NULL) && (inp->auth_supported == 1))) { 5925 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 5926 } 5927 if (((asoc != NULL) && (asoc->asconf_supported == 1)) || 5928 ((asoc == NULL) && (inp->asconf_supported == 1))) { 5929 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 5930 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 5931 } 5932 if (((asoc != NULL) && (asoc->reconfig_supported == 1)) || 5933 ((asoc == NULL) && (inp->reconfig_supported == 1))) { 5934 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 5935 } 5936 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5937 ((asoc == NULL) && (inp->idata_supported == 1))) { 5938 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 5939 } 5940 if (((asoc != NULL) && (asoc->nrsack_supported == 1)) || 5941 ((asoc == NULL) && (inp->nrsack_supported == 1))) { 5942 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 5943 } 5944 if (((asoc != NULL) && (asoc->pktdrop_supported == 1)) || 5945 ((asoc == NULL) && (inp->pktdrop_supported == 1))) { 5946 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 5947 } 5948 if (num_ext > 0) { 5949 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 5950 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 5951 pr_supported->ph.param_length = htons(parameter_len); 5952 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5953 chunk_len += parameter_len; 5954 } 5955 5956 /* add authentication parameters */ 5957 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5958 ((asoc == NULL) && (inp->auth_supported == 1))) { 5959 struct sctp_auth_random *randp; 5960 struct sctp_auth_hmac_algo *hmacs; 5961 struct sctp_auth_chunk_list *chunks; 5962 5963 if (padding_len > 0) { 5964 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 5965 chunk_len += padding_len; 5966 padding_len = 0; 5967 } 5968 /* generate and add RANDOM parameter */ 5969 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 5970 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + 5971 SCTP_AUTH_RANDOM_SIZE_DEFAULT; 5972 randp->ph.param_type = htons(SCTP_RANDOM); 5973 randp->ph.param_length = htons(parameter_len); 5974 SCTP_READ_RANDOM(randp->random_data, SCTP_AUTH_RANDOM_SIZE_DEFAULT); 5975 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5976 chunk_len += parameter_len; 5977 5978 if (padding_len > 0) { 5979 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 5980 chunk_len += padding_len; 5981 padding_len = 0; 5982 } 5983 /* add HMAC_ALGO parameter */ 5984 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 5985 parameter_len = (uint16_t)sizeof(struct sctp_auth_hmac_algo) + 5986 sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs, 5987 (uint8_t *)hmacs->hmac_ids); 5988 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 5989 hmacs->ph.param_length = htons(parameter_len); 5990 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5991 chunk_len += parameter_len; 5992 5993 if (padding_len > 0) { 5994 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 5995 chunk_len += padding_len; 5996 padding_len = 0; 5997 } 5998 /* add CHUNKS parameter */ 5999 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 6000 parameter_len = (uint16_t)sizeof(struct sctp_auth_chunk_list) + 6001 sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks, 6002 chunks->chunk_types); 6003 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 6004 chunks->ph.param_length = htons(parameter_len); 6005 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6006 chunk_len += parameter_len; 6007 } 6008 SCTP_BUF_LEN(m) = chunk_len; 6009 m_last = m; 6010 /* now the addresses */ 6011 /* 6012 * To optimize this we could put the scoping stuff into a structure 6013 * and remove the individual uint8's from the stc structure. Then we 6014 * could just sifa in the address within the stc.. but for now this 6015 * is a quick hack to get the address stuff teased apart. 6016 */ 6017 scp.ipv4_addr_legal = stc.ipv4_addr_legal; 6018 scp.ipv6_addr_legal = stc.ipv6_addr_legal; 6019 scp.loopback_scope = stc.loopback_scope; 6020 scp.ipv4_local_scope = stc.ipv4_scope; 6021 scp.local_scope = stc.local_scope; 6022 scp.site_scope = stc.site_scope; 6023 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &scp, m_last, 6024 cnt_inits_to, 6025 &padding_len, &chunk_len); 6026 /* padding_len can only be positive, if no addresses have been added */ 6027 if (padding_len > 0) { 6028 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6029 chunk_len += padding_len; 6030 SCTP_BUF_LEN(m) += padding_len; 6031 padding_len = 0; 6032 } 6033 6034 /* tack on the operational error if present */ 6035 if (op_err) { 6036 parameter_len = 0; 6037 for (m_tmp = op_err; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6038 parameter_len += SCTP_BUF_LEN(m_tmp); 6039 } 6040 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6041 SCTP_BUF_NEXT(m_last) = op_err; 6042 while (SCTP_BUF_NEXT(m_last) != NULL) { 6043 m_last = SCTP_BUF_NEXT(m_last); 6044 } 6045 chunk_len += parameter_len; 6046 } 6047 if (padding_len > 0) { 6048 m_last = sctp_add_pad_tombuf(m_last, padding_len); 6049 if (m_last == NULL) { 6050 /* Houston we have a problem, no space */ 6051 sctp_m_freem(m); 6052 return; 6053 } 6054 chunk_len += padding_len; 6055 padding_len = 0; 6056 } 6057 /* Now we must build a cookie */ 6058 m_cookie = sctp_add_cookie(init_pkt, offset, m, 0, &stc, &signature); 6059 if (m_cookie == NULL) { 6060 /* memory problem */ 6061 sctp_m_freem(m); 6062 return; 6063 } 6064 /* Now append the cookie to the end and update the space/size */ 6065 SCTP_BUF_NEXT(m_last) = m_cookie; 6066 parameter_len = 0; 6067 for (m_tmp = m_cookie; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6068 parameter_len += SCTP_BUF_LEN(m_tmp); 6069 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 6070 m_last = m_tmp; 6071 } 6072 } 6073 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6074 chunk_len += parameter_len; 6075 6076 /* 6077 * Place in the size, but we don't include the last pad (if any) in 6078 * the INIT-ACK. 6079 */ 6080 initack->ch.chunk_length = htons(chunk_len); 6081 6082 /* 6083 * Time to sign the cookie, we don't sign over the cookie signature 6084 * though thus we set trailer. 6085 */ 6086 (void)sctp_hmac_m(SCTP_HMAC, 6087 (uint8_t *)inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)], 6088 SCTP_SECRET_SIZE, m_cookie, sizeof(struct sctp_paramhdr), 6089 (uint8_t *)signature, SCTP_SIGNATURE_SIZE); 6090 /* 6091 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return 6092 * here since the timer will drive a retranmission. 6093 */ 6094 if (padding_len > 0) { 6095 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 6096 sctp_m_freem(m); 6097 return; 6098 } 6099 } 6100 if (stc.loopback_scope) { 6101 over_addr = (union sctp_sockstore *)dst; 6102 } else { 6103 over_addr = NULL; 6104 } 6105 6106 if ((error = sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0, 6107 0, 0, 6108 inp->sctp_lport, sh->src_port, init_chk->init.initiate_tag, 6109 port, over_addr, 6110 mflowtype, mflowid, 6111 SCTP_SO_NOT_LOCKED))) { 6112 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 6113 if (error == ENOBUFS) { 6114 if (asoc != NULL) { 6115 asoc->ifp_had_enobuf = 1; 6116 } 6117 SCTP_STAT_INCR(sctps_lowlevelerr); 6118 } 6119 } else { 6120 if (asoc != NULL) { 6121 asoc->ifp_had_enobuf = 0; 6122 } 6123 } 6124 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 6125 } 6126 6127 6128 static void 6129 sctp_prune_prsctp(struct sctp_tcb *stcb, 6130 struct sctp_association *asoc, 6131 struct sctp_sndrcvinfo *srcv, 6132 int dataout) 6133 { 6134 int freed_spc = 0; 6135 struct sctp_tmit_chunk *chk, *nchk; 6136 6137 SCTP_TCB_LOCK_ASSERT(stcb); 6138 if ((asoc->prsctp_supported) && 6139 (asoc->sent_queue_cnt_removeable > 0)) { 6140 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6141 /* 6142 * Look for chunks marked with the PR_SCTP flag AND 6143 * the buffer space flag. If the one being sent is 6144 * equal or greater priority then purge the old one 6145 * and free some space. 6146 */ 6147 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6148 /* 6149 * This one is PR-SCTP AND buffer space 6150 * limited type 6151 */ 6152 if (chk->rec.data.timetodrop.tv_sec > (long)srcv->sinfo_timetolive) { 6153 /* 6154 * Lower numbers equates to higher 6155 * priority. So if the one we are 6156 * looking at has a larger priority, 6157 * we want to drop the data and NOT 6158 * retransmit it. 6159 */ 6160 if (chk->data) { 6161 /* 6162 * We release the book_size 6163 * if the mbuf is here 6164 */ 6165 int ret_spc; 6166 uint8_t sent; 6167 6168 if (chk->sent > SCTP_DATAGRAM_UNSENT) 6169 sent = 1; 6170 else 6171 sent = 0; 6172 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6173 sent, 6174 SCTP_SO_LOCKED); 6175 freed_spc += ret_spc; 6176 if (freed_spc >= dataout) { 6177 return; 6178 } 6179 } /* if chunk was present */ 6180 } /* if of sufficient priority */ 6181 } /* if chunk has enabled */ 6182 } /* tailqforeach */ 6183 6184 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 6185 /* Here we must move to the sent queue and mark */ 6186 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6187 if (chk->rec.data.timetodrop.tv_sec > (long)srcv->sinfo_timetolive) { 6188 if (chk->data) { 6189 /* 6190 * We release the book_size 6191 * if the mbuf is here 6192 */ 6193 int ret_spc; 6194 6195 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6196 0, SCTP_SO_LOCKED); 6197 6198 freed_spc += ret_spc; 6199 if (freed_spc >= dataout) { 6200 return; 6201 } 6202 } /* end if chk->data */ 6203 } /* end if right class */ 6204 } /* end if chk pr-sctp */ 6205 } /* tailqforeachsafe (chk) */ 6206 } /* if enabled in asoc */ 6207 } 6208 6209 int 6210 sctp_get_frag_point(struct sctp_tcb *stcb, 6211 struct sctp_association *asoc) 6212 { 6213 int siz, ovh; 6214 6215 /* 6216 * For endpoints that have both v6 and v4 addresses we must reserve 6217 * room for the ipv6 header, for those that are only dealing with V4 6218 * we use a larger frag point. 6219 */ 6220 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6221 ovh = SCTP_MIN_OVERHEAD; 6222 } else { 6223 ovh = SCTP_MIN_V4_OVERHEAD; 6224 } 6225 ovh += SCTP_DATA_CHUNK_OVERHEAD(stcb); 6226 if (stcb->asoc.sctp_frag_point > asoc->smallest_mtu) 6227 siz = asoc->smallest_mtu - ovh; 6228 else 6229 siz = (stcb->asoc.sctp_frag_point - ovh); 6230 /* 6231 * if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { 6232 */ 6233 /* A data chunk MUST fit in a cluster */ 6234 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk)); */ 6235 /* } */ 6236 6237 /* adjust for an AUTH chunk if DATA requires auth */ 6238 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) 6239 siz -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 6240 6241 if (siz % 4) { 6242 /* make it an even word boundary please */ 6243 siz -= (siz % 4); 6244 } 6245 return (siz); 6246 } 6247 6248 static void 6249 sctp_set_prsctp_policy(struct sctp_stream_queue_pending *sp) 6250 { 6251 /* 6252 * We assume that the user wants PR_SCTP_TTL if the user provides a 6253 * positive lifetime but does not specify any PR_SCTP policy. 6254 */ 6255 if (PR_SCTP_ENABLED(sp->sinfo_flags)) { 6256 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6257 } else if (sp->timetolive > 0) { 6258 sp->sinfo_flags |= SCTP_PR_SCTP_TTL; 6259 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6260 } else { 6261 return; 6262 } 6263 switch (PR_SCTP_POLICY(sp->sinfo_flags)) { 6264 case CHUNK_FLAGS_PR_SCTP_BUF: 6265 /* 6266 * Time to live is a priority stored in tv_sec when doing 6267 * the buffer drop thing. 6268 */ 6269 sp->ts.tv_sec = sp->timetolive; 6270 sp->ts.tv_usec = 0; 6271 break; 6272 case CHUNK_FLAGS_PR_SCTP_TTL: 6273 { 6274 struct timeval tv; 6275 6276 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6277 tv.tv_sec = sp->timetolive / 1000; 6278 tv.tv_usec = (sp->timetolive * 1000) % 1000000; 6279 /* 6280 * TODO sctp_constants.h needs alternative time 6281 * macros when _KERNEL is undefined. 6282 */ 6283 timevaladd(&sp->ts, &tv); 6284 } 6285 break; 6286 case CHUNK_FLAGS_PR_SCTP_RTX: 6287 /* 6288 * Time to live is a the number or retransmissions stored in 6289 * tv_sec. 6290 */ 6291 sp->ts.tv_sec = sp->timetolive; 6292 sp->ts.tv_usec = 0; 6293 break; 6294 default: 6295 SCTPDBG(SCTP_DEBUG_USRREQ1, 6296 "Unknown PR_SCTP policy %u.\n", 6297 PR_SCTP_POLICY(sp->sinfo_flags)); 6298 break; 6299 } 6300 } 6301 6302 static int 6303 sctp_msg_append(struct sctp_tcb *stcb, 6304 struct sctp_nets *net, 6305 struct mbuf *m, 6306 struct sctp_sndrcvinfo *srcv, int hold_stcb_lock) 6307 { 6308 int error = 0; 6309 struct mbuf *at; 6310 struct sctp_stream_queue_pending *sp = NULL; 6311 struct sctp_stream_out *strm; 6312 6313 /* 6314 * Given an mbuf chain, put it into the association send queue and 6315 * place it on the wheel 6316 */ 6317 if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) { 6318 /* Invalid stream number */ 6319 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6320 error = EINVAL; 6321 goto out_now; 6322 } 6323 if ((stcb->asoc.stream_locked) && 6324 (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) { 6325 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6326 error = EINVAL; 6327 goto out_now; 6328 } 6329 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 6330 /* Now can we send this? */ 6331 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 6332 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 6333 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 6334 (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) { 6335 /* got data while shutting down */ 6336 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 6337 error = ECONNRESET; 6338 goto out_now; 6339 } 6340 sctp_alloc_a_strmoq(stcb, sp); 6341 if (sp == NULL) { 6342 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6343 error = ENOMEM; 6344 goto out_now; 6345 } 6346 sp->sinfo_flags = srcv->sinfo_flags; 6347 sp->timetolive = srcv->sinfo_timetolive; 6348 sp->ppid = srcv->sinfo_ppid; 6349 sp->context = srcv->sinfo_context; 6350 sp->fsn = 0; 6351 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 6352 sp->net = net; 6353 atomic_add_int(&sp->net->ref_count, 1); 6354 } else { 6355 sp->net = NULL; 6356 } 6357 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6358 sp->sid = srcv->sinfo_stream; 6359 sp->msg_is_complete = 1; 6360 sp->sender_all_done = 1; 6361 sp->some_taken = 0; 6362 sp->data = m; 6363 sp->tail_mbuf = NULL; 6364 sctp_set_prsctp_policy(sp); 6365 /* 6366 * We could in theory (for sendall) sifa the length in, but we would 6367 * still have to hunt through the chain since we need to setup the 6368 * tail_mbuf 6369 */ 6370 sp->length = 0; 6371 for (at = m; at; at = SCTP_BUF_NEXT(at)) { 6372 if (SCTP_BUF_NEXT(at) == NULL) 6373 sp->tail_mbuf = at; 6374 sp->length += SCTP_BUF_LEN(at); 6375 } 6376 if (srcv->sinfo_keynumber_valid) { 6377 sp->auth_keyid = srcv->sinfo_keynumber; 6378 } else { 6379 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 6380 } 6381 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 6382 sctp_auth_key_acquire(stcb, sp->auth_keyid); 6383 sp->holds_key_ref = 1; 6384 } 6385 if (hold_stcb_lock == 0) { 6386 SCTP_TCB_SEND_LOCK(stcb); 6387 } 6388 sctp_snd_sb_alloc(stcb, sp->length); 6389 atomic_add_int(&stcb->asoc.stream_queue_cnt, 1); 6390 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 6391 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, &stcb->asoc, strm, sp, 1); 6392 m = NULL; 6393 if (hold_stcb_lock == 0) { 6394 SCTP_TCB_SEND_UNLOCK(stcb); 6395 } 6396 out_now: 6397 if (m) { 6398 sctp_m_freem(m); 6399 } 6400 return (error); 6401 } 6402 6403 6404 static struct mbuf * 6405 sctp_copy_mbufchain(struct mbuf *clonechain, 6406 struct mbuf *outchain, 6407 struct mbuf **endofchain, 6408 int can_take_mbuf, 6409 int sizeofcpy, 6410 uint8_t copy_by_ref) 6411 { 6412 struct mbuf *m; 6413 struct mbuf *appendchain; 6414 caddr_t cp; 6415 int len; 6416 6417 if (endofchain == NULL) { 6418 /* error */ 6419 error_out: 6420 if (outchain) 6421 sctp_m_freem(outchain); 6422 return (NULL); 6423 } 6424 if (can_take_mbuf) { 6425 appendchain = clonechain; 6426 } else { 6427 if (!copy_by_ref && 6428 (sizeofcpy <= (int)((((SCTP_BASE_SYSCTL(sctp_mbuf_threshold_count) - 1) * MLEN) + MHLEN)))) { 6429 /* Its not in a cluster */ 6430 if (*endofchain == NULL) { 6431 /* lets get a mbuf cluster */ 6432 if (outchain == NULL) { 6433 /* This is the general case */ 6434 new_mbuf: 6435 outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6436 if (outchain == NULL) { 6437 goto error_out; 6438 } 6439 SCTP_BUF_LEN(outchain) = 0; 6440 *endofchain = outchain; 6441 /* get the prepend space */ 6442 SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4)); 6443 } else { 6444 /* 6445 * We really should not get a NULL 6446 * in endofchain 6447 */ 6448 /* find end */ 6449 m = outchain; 6450 while (m) { 6451 if (SCTP_BUF_NEXT(m) == NULL) { 6452 *endofchain = m; 6453 break; 6454 } 6455 m = SCTP_BUF_NEXT(m); 6456 } 6457 /* sanity */ 6458 if (*endofchain == NULL) { 6459 /* 6460 * huh, TSNH XXX maybe we 6461 * should panic 6462 */ 6463 sctp_m_freem(outchain); 6464 goto new_mbuf; 6465 } 6466 } 6467 /* get the new end of length */ 6468 len = (int)M_TRAILINGSPACE(*endofchain); 6469 } else { 6470 /* how much is left at the end? */ 6471 len = (int)M_TRAILINGSPACE(*endofchain); 6472 } 6473 /* Find the end of the data, for appending */ 6474 cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain))); 6475 6476 /* Now lets copy it out */ 6477 if (len >= sizeofcpy) { 6478 /* It all fits, copy it in */ 6479 m_copydata(clonechain, 0, sizeofcpy, cp); 6480 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6481 } else { 6482 /* fill up the end of the chain */ 6483 if (len > 0) { 6484 m_copydata(clonechain, 0, len, cp); 6485 SCTP_BUF_LEN((*endofchain)) += len; 6486 /* now we need another one */ 6487 sizeofcpy -= len; 6488 } 6489 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6490 if (m == NULL) { 6491 /* We failed */ 6492 goto error_out; 6493 } 6494 SCTP_BUF_NEXT((*endofchain)) = m; 6495 *endofchain = m; 6496 cp = mtod((*endofchain), caddr_t); 6497 m_copydata(clonechain, len, sizeofcpy, cp); 6498 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6499 } 6500 return (outchain); 6501 } else { 6502 /* copy the old fashion way */ 6503 appendchain = SCTP_M_COPYM(clonechain, 0, M_COPYALL, M_NOWAIT); 6504 #ifdef SCTP_MBUF_LOGGING 6505 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6506 sctp_log_mbc(appendchain, SCTP_MBUF_ICOPY); 6507 } 6508 #endif 6509 } 6510 } 6511 if (appendchain == NULL) { 6512 /* error */ 6513 if (outchain) 6514 sctp_m_freem(outchain); 6515 return (NULL); 6516 } 6517 if (outchain) { 6518 /* tack on to the end */ 6519 if (*endofchain != NULL) { 6520 SCTP_BUF_NEXT(((*endofchain))) = appendchain; 6521 } else { 6522 m = outchain; 6523 while (m) { 6524 if (SCTP_BUF_NEXT(m) == NULL) { 6525 SCTP_BUF_NEXT(m) = appendchain; 6526 break; 6527 } 6528 m = SCTP_BUF_NEXT(m); 6529 } 6530 } 6531 /* 6532 * save off the end and update the end-chain position 6533 */ 6534 m = appendchain; 6535 while (m) { 6536 if (SCTP_BUF_NEXT(m) == NULL) { 6537 *endofchain = m; 6538 break; 6539 } 6540 m = SCTP_BUF_NEXT(m); 6541 } 6542 return (outchain); 6543 } else { 6544 /* save off the end and update the end-chain position */ 6545 m = appendchain; 6546 while (m) { 6547 if (SCTP_BUF_NEXT(m) == NULL) { 6548 *endofchain = m; 6549 break; 6550 } 6551 m = SCTP_BUF_NEXT(m); 6552 } 6553 return (appendchain); 6554 } 6555 } 6556 6557 static int 6558 sctp_med_chunk_output(struct sctp_inpcb *inp, 6559 struct sctp_tcb *stcb, 6560 struct sctp_association *asoc, 6561 int *num_out, 6562 int *reason_code, 6563 int control_only, int from_where, 6564 struct timeval *now, int *now_filled, int frag_point, int so_locked); 6565 6566 static void 6567 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, 6568 uint32_t val SCTP_UNUSED) 6569 { 6570 struct sctp_copy_all *ca; 6571 struct mbuf *m; 6572 int ret = 0; 6573 int added_control = 0; 6574 int un_sent, do_chunk_output = 1; 6575 struct sctp_association *asoc; 6576 struct sctp_nets *net; 6577 6578 ca = (struct sctp_copy_all *)ptr; 6579 if (ca->m == NULL) { 6580 return; 6581 } 6582 if (ca->inp != inp) { 6583 /* TSNH */ 6584 return; 6585 } 6586 if (ca->sndlen > 0) { 6587 m = SCTP_M_COPYM(ca->m, 0, M_COPYALL, M_NOWAIT); 6588 if (m == NULL) { 6589 /* can't copy so we are done */ 6590 ca->cnt_failed++; 6591 return; 6592 } 6593 #ifdef SCTP_MBUF_LOGGING 6594 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6595 sctp_log_mbc(m, SCTP_MBUF_ICOPY); 6596 } 6597 #endif 6598 } else { 6599 m = NULL; 6600 } 6601 SCTP_TCB_LOCK_ASSERT(stcb); 6602 if (stcb->asoc.alternate) { 6603 net = stcb->asoc.alternate; 6604 } else { 6605 net = stcb->asoc.primary_destination; 6606 } 6607 if (ca->sndrcv.sinfo_flags & SCTP_ABORT) { 6608 /* Abort this assoc with m as the user defined reason */ 6609 if (m != NULL) { 6610 SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_NOWAIT); 6611 } else { 6612 m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 6613 0, M_NOWAIT, 1, MT_DATA); 6614 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr); 6615 } 6616 if (m != NULL) { 6617 struct sctp_paramhdr *ph; 6618 6619 ph = mtod(m, struct sctp_paramhdr *); 6620 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 6621 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + ca->sndlen)); 6622 } 6623 /* 6624 * We add one here to keep the assoc from dis-appearing on 6625 * us. 6626 */ 6627 atomic_add_int(&stcb->asoc.refcnt, 1); 6628 sctp_abort_an_association(inp, stcb, m, SCTP_SO_NOT_LOCKED); 6629 /* 6630 * sctp_abort_an_association calls sctp_free_asoc() free 6631 * association will NOT free it since we incremented the 6632 * refcnt .. we do this to prevent it being freed and things 6633 * getting tricky since we could end up (from free_asoc) 6634 * calling inpcb_free which would get a recursive lock call 6635 * to the iterator lock.. But as a consequence of that the 6636 * stcb will return to us un-locked.. since free_asoc 6637 * returns with either no TCB or the TCB unlocked, we must 6638 * relock.. to unlock in the iterator timer :-0 6639 */ 6640 SCTP_TCB_LOCK(stcb); 6641 atomic_add_int(&stcb->asoc.refcnt, -1); 6642 goto no_chunk_output; 6643 } else { 6644 if (m) { 6645 ret = sctp_msg_append(stcb, net, m, 6646 &ca->sndrcv, 1); 6647 } 6648 asoc = &stcb->asoc; 6649 if (ca->sndrcv.sinfo_flags & SCTP_EOF) { 6650 /* shutdown this assoc */ 6651 if (TAILQ_EMPTY(&asoc->send_queue) && 6652 TAILQ_EMPTY(&asoc->sent_queue) && 6653 sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED) == 0) { 6654 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6655 goto abort_anyway; 6656 } 6657 /* 6658 * there is nothing queued to send, so I'm 6659 * done... 6660 */ 6661 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 6662 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6663 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6664 /* 6665 * only send SHUTDOWN the first time 6666 * through 6667 */ 6668 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 6669 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 6670 } 6671 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT); 6672 sctp_stop_timers_for_shutdown(stcb); 6673 sctp_send_shutdown(stcb, net); 6674 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 6675 net); 6676 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6677 NULL); 6678 added_control = 1; 6679 do_chunk_output = 0; 6680 } 6681 } else { 6682 /* 6683 * we still got (or just got) data to send, 6684 * so set SHUTDOWN_PENDING 6685 */ 6686 /* 6687 * XXX sockets draft says that SCTP_EOF 6688 * should be sent with no data. currently, 6689 * we will allow user data to be sent first 6690 * and move to SHUTDOWN-PENDING 6691 */ 6692 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 6693 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6694 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6695 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6696 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT); 6697 } 6698 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 6699 if (TAILQ_EMPTY(&asoc->send_queue) && 6700 TAILQ_EMPTY(&asoc->sent_queue) && 6701 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 6702 struct mbuf *op_err; 6703 char msg[SCTP_DIAG_INFO_LEN]; 6704 6705 abort_anyway: 6706 SCTP_SNPRINTF(msg, sizeof(msg), 6707 "%s:%d at %s", __FILE__, __LINE__, __func__); 6708 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 6709 msg); 6710 atomic_add_int(&stcb->asoc.refcnt, 1); 6711 sctp_abort_an_association(stcb->sctp_ep, stcb, 6712 op_err, SCTP_SO_NOT_LOCKED); 6713 atomic_add_int(&stcb->asoc.refcnt, -1); 6714 goto no_chunk_output; 6715 } 6716 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6717 NULL); 6718 } 6719 } 6720 6721 } 6722 } 6723 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 6724 (stcb->asoc.stream_queue_cnt * SCTP_DATA_CHUNK_OVERHEAD(stcb))); 6725 6726 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 6727 (stcb->asoc.total_flight > 0) && 6728 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 6729 do_chunk_output = 0; 6730 } 6731 if (do_chunk_output) 6732 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_NOT_LOCKED); 6733 else if (added_control) { 6734 int num_out, reason, now_filled = 0; 6735 struct timeval now; 6736 int frag_point; 6737 6738 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 6739 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 6740 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_NOT_LOCKED); 6741 } 6742 no_chunk_output: 6743 if (ret) { 6744 ca->cnt_failed++; 6745 } else { 6746 ca->cnt_sent++; 6747 } 6748 } 6749 6750 static void 6751 sctp_sendall_completes(void *ptr, uint32_t val SCTP_UNUSED) 6752 { 6753 struct sctp_copy_all *ca; 6754 6755 ca = (struct sctp_copy_all *)ptr; 6756 /* 6757 * Do a notify here? Kacheong suggests that the notify be done at 6758 * the send time.. so you would push up a notification if any send 6759 * failed. Don't know if this is feasible since the only failures we 6760 * have is "memory" related and if you cannot get an mbuf to send 6761 * the data you surely can't get an mbuf to send up to notify the 6762 * user you can't send the data :-> 6763 */ 6764 6765 /* now free everything */ 6766 if (ca->inp) { 6767 /* Lets clear the flag to allow others to run. */ 6768 ca->inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6769 } 6770 sctp_m_freem(ca->m); 6771 SCTP_FREE(ca, SCTP_M_COPYAL); 6772 } 6773 6774 static struct mbuf * 6775 sctp_copy_out_all(struct uio *uio, ssize_t len) 6776 { 6777 struct mbuf *ret, *at; 6778 ssize_t left, willcpy, cancpy, error; 6779 6780 ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAITOK, 1, MT_DATA); 6781 if (ret == NULL) { 6782 /* TSNH */ 6783 return (NULL); 6784 } 6785 left = len; 6786 SCTP_BUF_LEN(ret) = 0; 6787 /* save space for the data chunk header */ 6788 cancpy = (int)M_TRAILINGSPACE(ret); 6789 willcpy = min(cancpy, left); 6790 at = ret; 6791 while (left > 0) { 6792 /* Align data to the end */ 6793 error = uiomove(mtod(at, caddr_t), (int)willcpy, uio); 6794 if (error) { 6795 err_out_now: 6796 sctp_m_freem(at); 6797 return (NULL); 6798 } 6799 SCTP_BUF_LEN(at) = (int)willcpy; 6800 SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0; 6801 left -= willcpy; 6802 if (left > 0) { 6803 SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg((unsigned int)left, 0, M_WAITOK, 1, MT_DATA); 6804 if (SCTP_BUF_NEXT(at) == NULL) { 6805 goto err_out_now; 6806 } 6807 at = SCTP_BUF_NEXT(at); 6808 SCTP_BUF_LEN(at) = 0; 6809 cancpy = (int)M_TRAILINGSPACE(at); 6810 willcpy = min(cancpy, left); 6811 } 6812 } 6813 return (ret); 6814 } 6815 6816 static int 6817 sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, 6818 struct sctp_sndrcvinfo *srcv) 6819 { 6820 int ret; 6821 struct sctp_copy_all *ca; 6822 6823 if (inp->sctp_flags & SCTP_PCB_FLAGS_SND_ITERATOR_UP) { 6824 /* There is another. */ 6825 return (EBUSY); 6826 } 6827 if (uio->uio_resid > (ssize_t)SCTP_BASE_SYSCTL(sctp_sendall_limit)) { 6828 /* You must not be larger than the limit! */ 6829 return (EMSGSIZE); 6830 } 6831 SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all), 6832 SCTP_M_COPYAL); 6833 if (ca == NULL) { 6834 sctp_m_freem(m); 6835 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6836 return (ENOMEM); 6837 } 6838 memset(ca, 0, sizeof(struct sctp_copy_all)); 6839 6840 ca->inp = inp; 6841 if (srcv) { 6842 memcpy(&ca->sndrcv, srcv, sizeof(struct sctp_nonpad_sndrcvinfo)); 6843 } 6844 /* 6845 * take off the sendall flag, it would be bad if we failed to do 6846 * this :-0 6847 */ 6848 ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL; 6849 /* get length and mbuf chain */ 6850 if (uio) { 6851 ca->sndlen = uio->uio_resid; 6852 ca->m = sctp_copy_out_all(uio, ca->sndlen); 6853 if (ca->m == NULL) { 6854 SCTP_FREE(ca, SCTP_M_COPYAL); 6855 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6856 return (ENOMEM); 6857 } 6858 } else { 6859 /* Gather the length of the send */ 6860 struct mbuf *mat; 6861 6862 ca->sndlen = 0; 6863 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 6864 ca->sndlen += SCTP_BUF_LEN(mat); 6865 } 6866 } 6867 inp->sctp_flags |= SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6868 ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, NULL, 6869 SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES, 6870 SCTP_ASOC_ANY_STATE, 6871 (void *)ca, 0, 6872 sctp_sendall_completes, inp, 1); 6873 if (ret) { 6874 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6875 SCTP_FREE(ca, SCTP_M_COPYAL); 6876 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 6877 return (EFAULT); 6878 } 6879 return (0); 6880 } 6881 6882 6883 void 6884 sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc) 6885 { 6886 struct sctp_tmit_chunk *chk, *nchk; 6887 6888 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 6889 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 6890 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 6891 asoc->ctrl_queue_cnt--; 6892 if (chk->data) { 6893 sctp_m_freem(chk->data); 6894 chk->data = NULL; 6895 } 6896 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6897 } 6898 } 6899 } 6900 6901 void 6902 sctp_toss_old_asconf(struct sctp_tcb *stcb) 6903 { 6904 struct sctp_association *asoc; 6905 struct sctp_tmit_chunk *chk, *nchk; 6906 struct sctp_asconf_chunk *acp; 6907 6908 asoc = &stcb->asoc; 6909 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 6910 /* find SCTP_ASCONF chunk in queue */ 6911 if (chk->rec.chunk_id.id == SCTP_ASCONF) { 6912 if (chk->data) { 6913 acp = mtod(chk->data, struct sctp_asconf_chunk *); 6914 if (SCTP_TSN_GT(ntohl(acp->serial_number), asoc->asconf_seq_out_acked)) { 6915 /* Not Acked yet */ 6916 break; 6917 } 6918 } 6919 TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next); 6920 asoc->ctrl_queue_cnt--; 6921 if (chk->data) { 6922 sctp_m_freem(chk->data); 6923 chk->data = NULL; 6924 } 6925 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6926 } 6927 } 6928 } 6929 6930 6931 static void 6932 sctp_clean_up_datalist(struct sctp_tcb *stcb, 6933 struct sctp_association *asoc, 6934 struct sctp_tmit_chunk **data_list, 6935 int bundle_at, 6936 struct sctp_nets *net) 6937 { 6938 int i; 6939 struct sctp_tmit_chunk *tp1; 6940 6941 for (i = 0; i < bundle_at; i++) { 6942 /* off of the send queue */ 6943 TAILQ_REMOVE(&asoc->send_queue, data_list[i], sctp_next); 6944 asoc->send_queue_cnt--; 6945 if (i > 0) { 6946 /* 6947 * Any chunk NOT 0 you zap the time chunk 0 gets 6948 * zapped or set based on if a RTO measurment is 6949 * needed. 6950 */ 6951 data_list[i]->do_rtt = 0; 6952 } 6953 /* record time */ 6954 data_list[i]->sent_rcv_time = net->last_sent_time; 6955 data_list[i]->rec.data.cwnd_at_send = net->cwnd; 6956 data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.tsn; 6957 if (data_list[i]->whoTo == NULL) { 6958 data_list[i]->whoTo = net; 6959 atomic_add_int(&net->ref_count, 1); 6960 } 6961 /* on to the sent queue */ 6962 tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead); 6963 if ((tp1) && SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 6964 struct sctp_tmit_chunk *tpp; 6965 6966 /* need to move back */ 6967 back_up_more: 6968 tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next); 6969 if (tpp == NULL) { 6970 TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next); 6971 goto all_done; 6972 } 6973 tp1 = tpp; 6974 if (SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 6975 goto back_up_more; 6976 } 6977 TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next); 6978 } else { 6979 TAILQ_INSERT_TAIL(&asoc->sent_queue, 6980 data_list[i], 6981 sctp_next); 6982 } 6983 all_done: 6984 /* This does not lower until the cum-ack passes it */ 6985 asoc->sent_queue_cnt++; 6986 if ((asoc->peers_rwnd <= 0) && 6987 (asoc->total_flight == 0) && 6988 (bundle_at == 1)) { 6989 /* Mark the chunk as being a window probe */ 6990 SCTP_STAT_INCR(sctps_windowprobed); 6991 } 6992 #ifdef SCTP_AUDITING_ENABLED 6993 sctp_audit_log(0xC2, 3); 6994 #endif 6995 data_list[i]->sent = SCTP_DATAGRAM_SENT; 6996 data_list[i]->snd_count = 1; 6997 data_list[i]->rec.data.chunk_was_revoked = 0; 6998 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 6999 sctp_misc_ints(SCTP_FLIGHT_LOG_UP, 7000 data_list[i]->whoTo->flight_size, 7001 data_list[i]->book_size, 7002 (uint32_t)(uintptr_t)data_list[i]->whoTo, 7003 data_list[i]->rec.data.tsn); 7004 } 7005 sctp_flight_size_increase(data_list[i]); 7006 sctp_total_flight_increase(stcb, data_list[i]); 7007 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 7008 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 7009 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 7010 } 7011 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 7012 (uint32_t)(data_list[i]->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 7013 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 7014 /* SWS sender side engages */ 7015 asoc->peers_rwnd = 0; 7016 } 7017 } 7018 if (asoc->cc_functions.sctp_cwnd_update_packet_transmitted) { 7019 (*asoc->cc_functions.sctp_cwnd_update_packet_transmitted) (stcb, net); 7020 } 7021 } 7022 7023 static void 7024 sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc, int so_locked) 7025 { 7026 struct sctp_tmit_chunk *chk, *nchk; 7027 7028 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 7029 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7030 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 7031 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 7032 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 7033 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) || 7034 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 7035 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 7036 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 7037 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 7038 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 7039 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 7040 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 7041 /* Stray chunks must be cleaned up */ 7042 clean_up_anyway: 7043 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7044 asoc->ctrl_queue_cnt--; 7045 if (chk->data) { 7046 sctp_m_freem(chk->data); 7047 chk->data = NULL; 7048 } 7049 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 7050 asoc->fwd_tsn_cnt--; 7051 } 7052 sctp_free_a_chunk(stcb, chk, so_locked); 7053 } else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 7054 /* special handling, we must look into the param */ 7055 if (chk != asoc->str_reset) { 7056 goto clean_up_anyway; 7057 } 7058 } 7059 } 7060 } 7061 7062 static uint32_t 7063 sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length, 7064 uint32_t space_left, uint32_t frag_point, int eeor_on) 7065 { 7066 /* 7067 * Make a decision on if I should split a msg into multiple parts. 7068 * This is only asked of incomplete messages. 7069 */ 7070 if (eeor_on) { 7071 /* 7072 * If we are doing EEOR we need to always send it if its the 7073 * entire thing, since it might be all the guy is putting in 7074 * the hopper. 7075 */ 7076 if (space_left >= length) { 7077 /*- 7078 * If we have data outstanding, 7079 * we get another chance when the sack 7080 * arrives to transmit - wait for more data 7081 */ 7082 if (stcb->asoc.total_flight == 0) { 7083 /* 7084 * If nothing is in flight, we zero the 7085 * packet counter. 7086 */ 7087 return (length); 7088 } 7089 return (0); 7090 7091 } else { 7092 /* You can fill the rest */ 7093 return (space_left); 7094 } 7095 } 7096 /*- 7097 * For those strange folk that make the send buffer 7098 * smaller than our fragmentation point, we can't 7099 * get a full msg in so we have to allow splitting. 7100 */ 7101 if (SCTP_SB_LIMIT_SND(stcb->sctp_socket) < frag_point) { 7102 return (length); 7103 } 7104 if ((length <= space_left) || 7105 ((length - space_left) < SCTP_BASE_SYSCTL(sctp_min_residual))) { 7106 /* Sub-optimial residual don't split in non-eeor mode. */ 7107 return (0); 7108 } 7109 /* 7110 * If we reach here length is larger than the space_left. Do we wish 7111 * to split it for the sake of packet putting together? 7112 */ 7113 if (space_left >= min(SCTP_BASE_SYSCTL(sctp_min_split_point), frag_point)) { 7114 /* Its ok to split it */ 7115 return (min(space_left, frag_point)); 7116 } 7117 /* Nope, can't split */ 7118 return (0); 7119 } 7120 7121 static uint32_t 7122 sctp_move_to_outqueue(struct sctp_tcb *stcb, 7123 struct sctp_stream_out *strq, 7124 uint32_t space_left, 7125 uint32_t frag_point, 7126 int *giveup, 7127 int eeor_mode, 7128 int *bail, 7129 int so_locked) 7130 { 7131 /* Move from the stream to the send_queue keeping track of the total */ 7132 struct sctp_association *asoc; 7133 struct sctp_stream_queue_pending *sp; 7134 struct sctp_tmit_chunk *chk; 7135 struct sctp_data_chunk *dchkh = NULL; 7136 struct sctp_idata_chunk *ndchkh = NULL; 7137 uint32_t to_move, length; 7138 int leading; 7139 uint8_t rcv_flags = 0; 7140 uint8_t some_taken; 7141 uint8_t send_lock_up = 0; 7142 7143 SCTP_TCB_LOCK_ASSERT(stcb); 7144 asoc = &stcb->asoc; 7145 one_more_time: 7146 /* sa_ignore FREED_MEMORY */ 7147 sp = TAILQ_FIRST(&strq->outqueue); 7148 if (sp == NULL) { 7149 if (send_lock_up == 0) { 7150 SCTP_TCB_SEND_LOCK(stcb); 7151 send_lock_up = 1; 7152 } 7153 sp = TAILQ_FIRST(&strq->outqueue); 7154 if (sp) { 7155 goto one_more_time; 7156 } 7157 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_EXPLICIT_EOR) == 0) && 7158 (stcb->asoc.idata_supported == 0) && 7159 (strq->last_msg_incomplete)) { 7160 SCTP_PRINTF("Huh? Stream:%d lm_in_c=%d but queue is NULL\n", 7161 strq->sid, 7162 strq->last_msg_incomplete); 7163 strq->last_msg_incomplete = 0; 7164 } 7165 to_move = 0; 7166 if (send_lock_up) { 7167 SCTP_TCB_SEND_UNLOCK(stcb); 7168 send_lock_up = 0; 7169 } 7170 goto out_of; 7171 } 7172 if ((sp->msg_is_complete) && (sp->length == 0)) { 7173 if (sp->sender_all_done) { 7174 /* 7175 * We are doing deferred cleanup. Last time through 7176 * when we took all the data the sender_all_done was 7177 * not set. 7178 */ 7179 if ((sp->put_last_out == 0) && (sp->discard_rest == 0)) { 7180 SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n"); 7181 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7182 sp->sender_all_done, 7183 sp->length, 7184 sp->msg_is_complete, 7185 sp->put_last_out, 7186 send_lock_up); 7187 } 7188 if ((TAILQ_NEXT(sp, next) == NULL) && (send_lock_up == 0)) { 7189 SCTP_TCB_SEND_LOCK(stcb); 7190 send_lock_up = 1; 7191 } 7192 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7193 TAILQ_REMOVE(&strq->outqueue, sp, next); 7194 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7195 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7196 (strq->chunks_on_queues == 0) && 7197 TAILQ_EMPTY(&strq->outqueue)) { 7198 stcb->asoc.trigger_reset = 1; 7199 } 7200 if (sp->net) { 7201 sctp_free_remote_addr(sp->net); 7202 sp->net = NULL; 7203 } 7204 if (sp->data) { 7205 sctp_m_freem(sp->data); 7206 sp->data = NULL; 7207 } 7208 sctp_free_a_strmoq(stcb, sp, so_locked); 7209 /* we can't be locked to it */ 7210 if (send_lock_up) { 7211 SCTP_TCB_SEND_UNLOCK(stcb); 7212 send_lock_up = 0; 7213 } 7214 /* back to get the next msg */ 7215 goto one_more_time; 7216 } else { 7217 /* 7218 * sender just finished this but still holds a 7219 * reference 7220 */ 7221 *giveup = 1; 7222 to_move = 0; 7223 goto out_of; 7224 } 7225 } else { 7226 /* is there some to get */ 7227 if (sp->length == 0) { 7228 /* no */ 7229 *giveup = 1; 7230 to_move = 0; 7231 goto out_of; 7232 } else if (sp->discard_rest) { 7233 if (send_lock_up == 0) { 7234 SCTP_TCB_SEND_LOCK(stcb); 7235 send_lock_up = 1; 7236 } 7237 /* Whack down the size */ 7238 atomic_subtract_int(&stcb->asoc.total_output_queue_size, sp->length); 7239 if ((stcb->sctp_socket != NULL) && 7240 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 7241 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 7242 atomic_subtract_int(&stcb->sctp_socket->so_snd.sb_cc, sp->length); 7243 } 7244 if (sp->data) { 7245 sctp_m_freem(sp->data); 7246 sp->data = NULL; 7247 sp->tail_mbuf = NULL; 7248 } 7249 sp->length = 0; 7250 sp->some_taken = 1; 7251 *giveup = 1; 7252 to_move = 0; 7253 goto out_of; 7254 } 7255 } 7256 some_taken = sp->some_taken; 7257 re_look: 7258 length = sp->length; 7259 if (sp->msg_is_complete) { 7260 /* The message is complete */ 7261 to_move = min(length, frag_point); 7262 if (to_move == length) { 7263 /* All of it fits in the MTU */ 7264 if (sp->some_taken) { 7265 rcv_flags |= SCTP_DATA_LAST_FRAG; 7266 } else { 7267 rcv_flags |= SCTP_DATA_NOT_FRAG; 7268 } 7269 sp->put_last_out = 1; 7270 if (sp->sinfo_flags & SCTP_SACK_IMMEDIATELY) { 7271 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7272 } 7273 } else { 7274 /* Not all of it fits, we fragment */ 7275 if (sp->some_taken == 0) { 7276 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7277 } 7278 sp->some_taken = 1; 7279 } 7280 } else { 7281 to_move = sctp_can_we_split_this(stcb, length, space_left, frag_point, eeor_mode); 7282 if (to_move) { 7283 /*- 7284 * We use a snapshot of length in case it 7285 * is expanding during the compare. 7286 */ 7287 uint32_t llen; 7288 7289 llen = length; 7290 if (to_move >= llen) { 7291 to_move = llen; 7292 if (send_lock_up == 0) { 7293 /*- 7294 * We are taking all of an incomplete msg 7295 * thus we need a send lock. 7296 */ 7297 SCTP_TCB_SEND_LOCK(stcb); 7298 send_lock_up = 1; 7299 if (sp->msg_is_complete) { 7300 /* 7301 * the sender finished the 7302 * msg 7303 */ 7304 goto re_look; 7305 } 7306 } 7307 } 7308 if (sp->some_taken == 0) { 7309 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7310 sp->some_taken = 1; 7311 } 7312 } else { 7313 /* Nothing to take. */ 7314 *giveup = 1; 7315 to_move = 0; 7316 goto out_of; 7317 } 7318 } 7319 7320 /* If we reach here, we can copy out a chunk */ 7321 sctp_alloc_a_chunk(stcb, chk); 7322 if (chk == NULL) { 7323 /* No chunk memory */ 7324 *giveup = 1; 7325 to_move = 0; 7326 goto out_of; 7327 } 7328 /* 7329 * Setup for unordered if needed by looking at the user sent info 7330 * flags. 7331 */ 7332 if (sp->sinfo_flags & SCTP_UNORDERED) { 7333 rcv_flags |= SCTP_DATA_UNORDERED; 7334 } 7335 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 7336 (sp->sinfo_flags & SCTP_EOF) == SCTP_EOF) { 7337 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7338 } 7339 /* clear out the chunk before setting up */ 7340 memset(chk, 0, sizeof(*chk)); 7341 chk->rec.data.rcv_flags = rcv_flags; 7342 7343 if (to_move >= length) { 7344 /* we think we can steal the whole thing */ 7345 if ((sp->sender_all_done == 0) && (send_lock_up == 0)) { 7346 SCTP_TCB_SEND_LOCK(stcb); 7347 send_lock_up = 1; 7348 } 7349 if (to_move < sp->length) { 7350 /* bail, it changed */ 7351 goto dont_do_it; 7352 } 7353 chk->data = sp->data; 7354 chk->last_mbuf = sp->tail_mbuf; 7355 /* register the stealing */ 7356 sp->data = sp->tail_mbuf = NULL; 7357 } else { 7358 struct mbuf *m; 7359 7360 dont_do_it: 7361 chk->data = SCTP_M_COPYM(sp->data, 0, to_move, M_NOWAIT); 7362 chk->last_mbuf = NULL; 7363 if (chk->data == NULL) { 7364 sp->some_taken = some_taken; 7365 sctp_free_a_chunk(stcb, chk, so_locked); 7366 *bail = 1; 7367 to_move = 0; 7368 goto out_of; 7369 } 7370 #ifdef SCTP_MBUF_LOGGING 7371 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 7372 sctp_log_mbc(chk->data, SCTP_MBUF_ICOPY); 7373 } 7374 #endif 7375 /* Pull off the data */ 7376 m_adj(sp->data, to_move); 7377 /* Now lets work our way down and compact it */ 7378 m = sp->data; 7379 while (m && (SCTP_BUF_LEN(m) == 0)) { 7380 sp->data = SCTP_BUF_NEXT(m); 7381 SCTP_BUF_NEXT(m) = NULL; 7382 if (sp->tail_mbuf == m) { 7383 /*- 7384 * Freeing tail? TSNH since 7385 * we supposedly were taking less 7386 * than the sp->length. 7387 */ 7388 #ifdef INVARIANTS 7389 panic("Huh, freing tail? - TSNH"); 7390 #else 7391 SCTP_PRINTF("Huh, freeing tail? - TSNH\n"); 7392 sp->tail_mbuf = sp->data = NULL; 7393 sp->length = 0; 7394 #endif 7395 7396 } 7397 sctp_m_free(m); 7398 m = sp->data; 7399 } 7400 } 7401 if (SCTP_BUF_IS_EXTENDED(chk->data)) { 7402 chk->copy_by_ref = 1; 7403 } else { 7404 chk->copy_by_ref = 0; 7405 } 7406 /* 7407 * get last_mbuf and counts of mb usage This is ugly but hopefully 7408 * its only one mbuf. 7409 */ 7410 if (chk->last_mbuf == NULL) { 7411 chk->last_mbuf = chk->data; 7412 while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) { 7413 chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf); 7414 } 7415 } 7416 7417 if (to_move > length) { 7418 /*- This should not happen either 7419 * since we always lower to_move to the size 7420 * of sp->length if its larger. 7421 */ 7422 #ifdef INVARIANTS 7423 panic("Huh, how can to_move be larger?"); 7424 #else 7425 SCTP_PRINTF("Huh, how can to_move be larger?\n"); 7426 sp->length = 0; 7427 #endif 7428 } else { 7429 atomic_subtract_int(&sp->length, to_move); 7430 } 7431 leading = SCTP_DATA_CHUNK_OVERHEAD(stcb); 7432 if (M_LEADINGSPACE(chk->data) < leading) { 7433 /* Not enough room for a chunk header, get some */ 7434 struct mbuf *m; 7435 7436 m = sctp_get_mbuf_for_msg(1, 0, M_NOWAIT, 1, MT_DATA); 7437 if (m == NULL) { 7438 /* 7439 * we're in trouble here. _PREPEND below will free 7440 * all the data if there is no leading space, so we 7441 * must put the data back and restore. 7442 */ 7443 if (send_lock_up == 0) { 7444 SCTP_TCB_SEND_LOCK(stcb); 7445 send_lock_up = 1; 7446 } 7447 if (sp->data == NULL) { 7448 /* unsteal the data */ 7449 sp->data = chk->data; 7450 sp->tail_mbuf = chk->last_mbuf; 7451 } else { 7452 struct mbuf *m_tmp; 7453 7454 /* reassemble the data */ 7455 m_tmp = sp->data; 7456 sp->data = chk->data; 7457 SCTP_BUF_NEXT(chk->last_mbuf) = m_tmp; 7458 } 7459 sp->some_taken = some_taken; 7460 atomic_add_int(&sp->length, to_move); 7461 chk->data = NULL; 7462 *bail = 1; 7463 sctp_free_a_chunk(stcb, chk, so_locked); 7464 to_move = 0; 7465 goto out_of; 7466 } else { 7467 SCTP_BUF_LEN(m) = 0; 7468 SCTP_BUF_NEXT(m) = chk->data; 7469 chk->data = m; 7470 M_ALIGN(chk->data, 4); 7471 } 7472 } 7473 SCTP_BUF_PREPEND(chk->data, SCTP_DATA_CHUNK_OVERHEAD(stcb), M_NOWAIT); 7474 if (chk->data == NULL) { 7475 /* HELP, TSNH since we assured it would not above? */ 7476 #ifdef INVARIANTS 7477 panic("prepend failes HELP?"); 7478 #else 7479 SCTP_PRINTF("prepend fails HELP?\n"); 7480 sctp_free_a_chunk(stcb, chk, so_locked); 7481 #endif 7482 *bail = 1; 7483 to_move = 0; 7484 goto out_of; 7485 } 7486 sctp_snd_sb_alloc(stcb, SCTP_DATA_CHUNK_OVERHEAD(stcb)); 7487 chk->book_size = chk->send_size = (uint16_t)(to_move + SCTP_DATA_CHUNK_OVERHEAD(stcb)); 7488 chk->book_size_scale = 0; 7489 chk->sent = SCTP_DATAGRAM_UNSENT; 7490 7491 chk->flags = 0; 7492 chk->asoc = &stcb->asoc; 7493 chk->pad_inplace = 0; 7494 chk->no_fr_allowed = 0; 7495 if (stcb->asoc.idata_supported == 0) { 7496 if (rcv_flags & SCTP_DATA_UNORDERED) { 7497 /* Just use 0. The receiver ignores the values. */ 7498 chk->rec.data.mid = 0; 7499 } else { 7500 chk->rec.data.mid = strq->next_mid_ordered; 7501 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7502 strq->next_mid_ordered++; 7503 } 7504 } 7505 } else { 7506 if (rcv_flags & SCTP_DATA_UNORDERED) { 7507 chk->rec.data.mid = strq->next_mid_unordered; 7508 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7509 strq->next_mid_unordered++; 7510 } 7511 } else { 7512 chk->rec.data.mid = strq->next_mid_ordered; 7513 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7514 strq->next_mid_ordered++; 7515 } 7516 } 7517 } 7518 chk->rec.data.sid = sp->sid; 7519 chk->rec.data.ppid = sp->ppid; 7520 chk->rec.data.context = sp->context; 7521 chk->rec.data.doing_fast_retransmit = 0; 7522 7523 chk->rec.data.timetodrop = sp->ts; 7524 chk->flags = sp->act_flags; 7525 7526 if (sp->net) { 7527 chk->whoTo = sp->net; 7528 atomic_add_int(&chk->whoTo->ref_count, 1); 7529 } else 7530 chk->whoTo = NULL; 7531 7532 if (sp->holds_key_ref) { 7533 chk->auth_keyid = sp->auth_keyid; 7534 sctp_auth_key_acquire(stcb, chk->auth_keyid); 7535 chk->holds_key_ref = 1; 7536 } 7537 chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1); 7538 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) { 7539 sctp_misc_ints(SCTP_STRMOUT_LOG_SEND, 7540 (uint32_t)(uintptr_t)stcb, sp->length, 7541 (uint32_t)((chk->rec.data.sid << 16) | (0x0000ffff & chk->rec.data.mid)), 7542 chk->rec.data.tsn); 7543 } 7544 if (stcb->asoc.idata_supported == 0) { 7545 dchkh = mtod(chk->data, struct sctp_data_chunk *); 7546 } else { 7547 ndchkh = mtod(chk->data, struct sctp_idata_chunk *); 7548 } 7549 /* 7550 * Put the rest of the things in place now. Size was done earlier in 7551 * previous loop prior to padding. 7552 */ 7553 7554 #ifdef SCTP_ASOCLOG_OF_TSNS 7555 SCTP_TCB_LOCK_ASSERT(stcb); 7556 if (asoc->tsn_out_at >= SCTP_TSN_LOG_SIZE) { 7557 asoc->tsn_out_at = 0; 7558 asoc->tsn_out_wrapped = 1; 7559 } 7560 asoc->out_tsnlog[asoc->tsn_out_at].tsn = chk->rec.data.tsn; 7561 asoc->out_tsnlog[asoc->tsn_out_at].strm = chk->rec.data.sid; 7562 asoc->out_tsnlog[asoc->tsn_out_at].seq = chk->rec.data.mid; 7563 asoc->out_tsnlog[asoc->tsn_out_at].sz = chk->send_size; 7564 asoc->out_tsnlog[asoc->tsn_out_at].flgs = chk->rec.data.rcv_flags; 7565 asoc->out_tsnlog[asoc->tsn_out_at].stcb = (void *)stcb; 7566 asoc->out_tsnlog[asoc->tsn_out_at].in_pos = asoc->tsn_out_at; 7567 asoc->out_tsnlog[asoc->tsn_out_at].in_out = 2; 7568 asoc->tsn_out_at++; 7569 #endif 7570 if (stcb->asoc.idata_supported == 0) { 7571 dchkh->ch.chunk_type = SCTP_DATA; 7572 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7573 dchkh->dp.tsn = htonl(chk->rec.data.tsn); 7574 dchkh->dp.sid = htons(strq->sid); 7575 dchkh->dp.ssn = htons((uint16_t)chk->rec.data.mid); 7576 dchkh->dp.ppid = chk->rec.data.ppid; 7577 dchkh->ch.chunk_length = htons(chk->send_size); 7578 } else { 7579 ndchkh->ch.chunk_type = SCTP_IDATA; 7580 ndchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7581 ndchkh->dp.tsn = htonl(chk->rec.data.tsn); 7582 ndchkh->dp.sid = htons(strq->sid); 7583 ndchkh->dp.reserved = htons(0); 7584 ndchkh->dp.mid = htonl(chk->rec.data.mid); 7585 if (sp->fsn == 0) 7586 ndchkh->dp.ppid_fsn.ppid = chk->rec.data.ppid; 7587 else 7588 ndchkh->dp.ppid_fsn.fsn = htonl(sp->fsn); 7589 sp->fsn++; 7590 ndchkh->ch.chunk_length = htons(chk->send_size); 7591 } 7592 /* Now advance the chk->send_size by the actual pad needed. */ 7593 if (chk->send_size < SCTP_SIZE32(chk->book_size)) { 7594 /* need a pad */ 7595 struct mbuf *lm; 7596 int pads; 7597 7598 pads = SCTP_SIZE32(chk->book_size) - chk->send_size; 7599 lm = sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf); 7600 if (lm != NULL) { 7601 chk->last_mbuf = lm; 7602 chk->pad_inplace = 1; 7603 } 7604 chk->send_size += pads; 7605 } 7606 if (PR_SCTP_ENABLED(chk->flags)) { 7607 asoc->pr_sctp_cnt++; 7608 } 7609 if (sp->msg_is_complete && (sp->length == 0) && (sp->sender_all_done)) { 7610 /* All done pull and kill the message */ 7611 if (sp->put_last_out == 0) { 7612 SCTP_PRINTF("Gak, put out entire msg with NO end!-2\n"); 7613 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7614 sp->sender_all_done, 7615 sp->length, 7616 sp->msg_is_complete, 7617 sp->put_last_out, 7618 send_lock_up); 7619 } 7620 if ((send_lock_up == 0) && (TAILQ_NEXT(sp, next) == NULL)) { 7621 SCTP_TCB_SEND_LOCK(stcb); 7622 send_lock_up = 1; 7623 } 7624 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7625 TAILQ_REMOVE(&strq->outqueue, sp, next); 7626 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7627 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7628 (strq->chunks_on_queues == 0) && 7629 TAILQ_EMPTY(&strq->outqueue)) { 7630 stcb->asoc.trigger_reset = 1; 7631 } 7632 if (sp->net) { 7633 sctp_free_remote_addr(sp->net); 7634 sp->net = NULL; 7635 } 7636 if (sp->data) { 7637 sctp_m_freem(sp->data); 7638 sp->data = NULL; 7639 } 7640 sctp_free_a_strmoq(stcb, sp, so_locked); 7641 } 7642 asoc->chunks_on_out_queue++; 7643 strq->chunks_on_queues++; 7644 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 7645 asoc->send_queue_cnt++; 7646 out_of: 7647 if (send_lock_up) { 7648 SCTP_TCB_SEND_UNLOCK(stcb); 7649 } 7650 return (to_move); 7651 } 7652 7653 7654 static void 7655 sctp_fill_outqueue(struct sctp_tcb *stcb, 7656 struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked) 7657 { 7658 struct sctp_association *asoc; 7659 struct sctp_stream_out *strq; 7660 uint32_t space_left, moved, total_moved; 7661 int bail, giveup; 7662 7663 SCTP_TCB_LOCK_ASSERT(stcb); 7664 asoc = &stcb->asoc; 7665 total_moved = 0; 7666 switch (net->ro._l_addr.sa.sa_family) { 7667 #ifdef INET 7668 case AF_INET: 7669 space_left = net->mtu - SCTP_MIN_V4_OVERHEAD; 7670 break; 7671 #endif 7672 #ifdef INET6 7673 case AF_INET6: 7674 space_left = net->mtu - SCTP_MIN_OVERHEAD; 7675 break; 7676 #endif 7677 default: 7678 /* TSNH */ 7679 space_left = net->mtu; 7680 break; 7681 } 7682 /* Need an allowance for the data chunk header too */ 7683 space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb); 7684 7685 /* must make even word boundary */ 7686 space_left &= 0xfffffffc; 7687 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7688 giveup = 0; 7689 bail = 0; 7690 while ((space_left > 0) && (strq != NULL)) { 7691 moved = sctp_move_to_outqueue(stcb, strq, space_left, frag_point, 7692 &giveup, eeor_mode, &bail, so_locked); 7693 stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved); 7694 if ((giveup != 0) || (bail != 0)) { 7695 break; 7696 } 7697 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7698 total_moved += moved; 7699 if (space_left >= moved) { 7700 space_left -= moved; 7701 } else { 7702 space_left = 0; 7703 } 7704 if (space_left >= SCTP_DATA_CHUNK_OVERHEAD(stcb)) { 7705 space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb); 7706 } else { 7707 space_left = 0; 7708 } 7709 space_left &= 0xfffffffc; 7710 } 7711 if (bail != 0) 7712 *quit_now = 1; 7713 7714 stcb->asoc.ss_functions.sctp_ss_packet_done(stcb, net, asoc); 7715 7716 if (total_moved == 0) { 7717 if ((stcb->asoc.sctp_cmt_on_off == 0) && 7718 (net == stcb->asoc.primary_destination)) { 7719 /* ran dry for primary network net */ 7720 SCTP_STAT_INCR(sctps_primary_randry); 7721 } else if (stcb->asoc.sctp_cmt_on_off > 0) { 7722 /* ran dry with CMT on */ 7723 SCTP_STAT_INCR(sctps_cmt_randry); 7724 } 7725 } 7726 } 7727 7728 void 7729 sctp_fix_ecn_echo(struct sctp_association *asoc) 7730 { 7731 struct sctp_tmit_chunk *chk; 7732 7733 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7734 if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 7735 chk->sent = SCTP_DATAGRAM_UNSENT; 7736 } 7737 } 7738 } 7739 7740 void 7741 sctp_move_chunks_from_net(struct sctp_tcb *stcb, struct sctp_nets *net) 7742 { 7743 struct sctp_association *asoc; 7744 struct sctp_tmit_chunk *chk; 7745 struct sctp_stream_queue_pending *sp; 7746 unsigned int i; 7747 7748 if (net == NULL) { 7749 return; 7750 } 7751 asoc = &stcb->asoc; 7752 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 7753 TAILQ_FOREACH(sp, &stcb->asoc.strmout[i].outqueue, next) { 7754 if (sp->net == net) { 7755 sctp_free_remote_addr(sp->net); 7756 sp->net = NULL; 7757 } 7758 } 7759 } 7760 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7761 if (chk->whoTo == net) { 7762 sctp_free_remote_addr(chk->whoTo); 7763 chk->whoTo = NULL; 7764 } 7765 } 7766 } 7767 7768 int 7769 sctp_med_chunk_output(struct sctp_inpcb *inp, 7770 struct sctp_tcb *stcb, 7771 struct sctp_association *asoc, 7772 int *num_out, 7773 int *reason_code, 7774 int control_only, int from_where, 7775 struct timeval *now, int *now_filled, int frag_point, int so_locked) 7776 { 7777 /** 7778 * Ok this is the generic chunk service queue. we must do the 7779 * following: 7780 * - Service the stream queue that is next, moving any 7781 * message (note I must get a complete message i.e. FIRST/MIDDLE and 7782 * LAST to the out queue in one pass) and assigning TSN's. This 7783 * only applys though if the peer does not support NDATA. For NDATA 7784 * chunks its ok to not send the entire message ;-) 7785 * - Check to see if the cwnd/rwnd allows any output, if so we go ahead and 7786 * fomulate and send the low level chunks. Making sure to combine 7787 * any control in the control chunk queue also. 7788 */ 7789 struct sctp_nets *net, *start_at, *sack_goes_to = NULL, *old_start_at = NULL; 7790 struct mbuf *outchain, *endoutchain; 7791 struct sctp_tmit_chunk *chk, *nchk; 7792 7793 /* temp arrays for unlinking */ 7794 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 7795 int no_fragmentflg, error; 7796 unsigned int max_rwnd_per_dest, max_send_per_dest; 7797 int one_chunk, hbflag, skip_data_for_this_net; 7798 int asconf, cookie, no_out_cnt; 7799 int bundle_at, ctl_cnt, no_data_chunks, eeor_mode; 7800 unsigned int mtu, r_mtu, omtu, mx_mtu, to_out; 7801 int tsns_sent = 0; 7802 uint32_t auth_offset; 7803 struct sctp_auth_chunk *auth; 7804 uint16_t auth_keyid; 7805 int override_ok = 1; 7806 int skip_fill_up = 0; 7807 int data_auth_reqd = 0; 7808 7809 /* 7810 * JRS 5/14/07 - Add flag for whether a heartbeat is sent to the 7811 * destination. 7812 */ 7813 int quit_now = 0; 7814 7815 *num_out = 0; 7816 *reason_code = 0; 7817 auth_keyid = stcb->asoc.authinfo.active_keyid; 7818 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) || 7819 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 7820 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 7821 eeor_mode = 1; 7822 } else { 7823 eeor_mode = 0; 7824 } 7825 ctl_cnt = no_out_cnt = asconf = cookie = 0; 7826 /* 7827 * First lets prime the pump. For each destination, if there is room 7828 * in the flight size, attempt to pull an MTU's worth out of the 7829 * stream queues into the general send_queue 7830 */ 7831 #ifdef SCTP_AUDITING_ENABLED 7832 sctp_audit_log(0xC2, 2); 7833 #endif 7834 SCTP_TCB_LOCK_ASSERT(stcb); 7835 hbflag = 0; 7836 if (control_only) 7837 no_data_chunks = 1; 7838 else 7839 no_data_chunks = 0; 7840 7841 /* Nothing to possible to send? */ 7842 if ((TAILQ_EMPTY(&asoc->control_send_queue) || 7843 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) && 7844 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7845 TAILQ_EMPTY(&asoc->send_queue) && 7846 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 7847 nothing_to_send: 7848 *reason_code = 9; 7849 return (0); 7850 } 7851 if (asoc->peers_rwnd == 0) { 7852 /* No room in peers rwnd */ 7853 *reason_code = 1; 7854 if (asoc->total_flight > 0) { 7855 /* we are allowed one chunk in flight */ 7856 no_data_chunks = 1; 7857 } 7858 } 7859 if (stcb->asoc.ecn_echo_cnt_onq) { 7860 /* Record where a sack goes, if any */ 7861 if (no_data_chunks && 7862 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) { 7863 /* Nothing but ECNe to send - we don't do that */ 7864 goto nothing_to_send; 7865 } 7866 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7867 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7868 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 7869 sack_goes_to = chk->whoTo; 7870 break; 7871 } 7872 } 7873 } 7874 max_rwnd_per_dest = ((asoc->peers_rwnd + asoc->total_flight) / asoc->numnets); 7875 if (stcb->sctp_socket) 7876 max_send_per_dest = SCTP_SB_LIMIT_SND(stcb->sctp_socket) / asoc->numnets; 7877 else 7878 max_send_per_dest = 0; 7879 if (no_data_chunks == 0) { 7880 /* How many non-directed chunks are there? */ 7881 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7882 if (chk->whoTo == NULL) { 7883 /* 7884 * We already have non-directed chunks on 7885 * the queue, no need to do a fill-up. 7886 */ 7887 skip_fill_up = 1; 7888 break; 7889 } 7890 } 7891 7892 } 7893 if ((no_data_chunks == 0) && 7894 (skip_fill_up == 0) && 7895 (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc))) { 7896 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 7897 /* 7898 * This for loop we are in takes in each net, if 7899 * its's got space in cwnd and has data sent to it 7900 * (when CMT is off) then it calls 7901 * sctp_fill_outqueue for the net. This gets data on 7902 * the send queue for that network. 7903 * 7904 * In sctp_fill_outqueue TSN's are assigned and data 7905 * is copied out of the stream buffers. Note mostly 7906 * copy by reference (we hope). 7907 */ 7908 net->window_probe = 0; 7909 if ((net != stcb->asoc.alternate) && 7910 ((net->dest_state & SCTP_ADDR_PF) || 7911 (!(net->dest_state & SCTP_ADDR_REACHABLE)) || 7912 (net->dest_state & SCTP_ADDR_UNCONFIRMED))) { 7913 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7914 sctp_log_cwnd(stcb, net, 1, 7915 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7916 } 7917 continue; 7918 } 7919 if ((stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) && 7920 (net->flight_size == 0)) { 7921 (*stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) (stcb, net); 7922 } 7923 if (net->flight_size >= net->cwnd) { 7924 /* skip this network, no room - can't fill */ 7925 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7926 sctp_log_cwnd(stcb, net, 3, 7927 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7928 } 7929 continue; 7930 } 7931 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7932 sctp_log_cwnd(stcb, net, 4, SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7933 } 7934 sctp_fill_outqueue(stcb, net, frag_point, eeor_mode, &quit_now, so_locked); 7935 if (quit_now) { 7936 /* memory alloc failure */ 7937 no_data_chunks = 1; 7938 break; 7939 } 7940 } 7941 } 7942 /* now service each destination and send out what we can for it */ 7943 /* Nothing to send? */ 7944 if (TAILQ_EMPTY(&asoc->control_send_queue) && 7945 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7946 TAILQ_EMPTY(&asoc->send_queue)) { 7947 *reason_code = 8; 7948 return (0); 7949 } 7950 7951 if (asoc->sctp_cmt_on_off > 0) { 7952 /* get the last start point */ 7953 start_at = asoc->last_net_cmt_send_started; 7954 if (start_at == NULL) { 7955 /* null so to beginning */ 7956 start_at = TAILQ_FIRST(&asoc->nets); 7957 } else { 7958 start_at = TAILQ_NEXT(asoc->last_net_cmt_send_started, sctp_next); 7959 if (start_at == NULL) { 7960 start_at = TAILQ_FIRST(&asoc->nets); 7961 } 7962 } 7963 asoc->last_net_cmt_send_started = start_at; 7964 } else { 7965 start_at = TAILQ_FIRST(&asoc->nets); 7966 } 7967 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7968 if (chk->whoTo == NULL) { 7969 if (asoc->alternate) { 7970 chk->whoTo = asoc->alternate; 7971 } else { 7972 chk->whoTo = asoc->primary_destination; 7973 } 7974 atomic_add_int(&chk->whoTo->ref_count, 1); 7975 } 7976 } 7977 old_start_at = NULL; 7978 again_one_more_time: 7979 for (net = start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) { 7980 /* how much can we send? */ 7981 /* SCTPDBG("Examine for sending net:%x\n", (uint32_t)net); */ 7982 if (old_start_at && (old_start_at == net)) { 7983 /* through list ocmpletely. */ 7984 break; 7985 } 7986 tsns_sent = 0xa; 7987 if (TAILQ_EMPTY(&asoc->control_send_queue) && 7988 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7989 (net->flight_size >= net->cwnd)) { 7990 /* 7991 * Nothing on control or asconf and flight is full, 7992 * we can skip even in the CMT case. 7993 */ 7994 continue; 7995 } 7996 bundle_at = 0; 7997 endoutchain = outchain = NULL; 7998 auth = NULL; 7999 auth_offset = 0; 8000 no_fragmentflg = 1; 8001 one_chunk = 0; 8002 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 8003 skip_data_for_this_net = 1; 8004 } else { 8005 skip_data_for_this_net = 0; 8006 } 8007 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8008 #ifdef INET 8009 case AF_INET: 8010 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8011 break; 8012 #endif 8013 #ifdef INET6 8014 case AF_INET6: 8015 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8016 break; 8017 #endif 8018 default: 8019 /* TSNH */ 8020 mtu = net->mtu; 8021 break; 8022 } 8023 mx_mtu = mtu; 8024 to_out = 0; 8025 if (mtu > asoc->peers_rwnd) { 8026 if (asoc->total_flight > 0) { 8027 /* We have a packet in flight somewhere */ 8028 r_mtu = asoc->peers_rwnd; 8029 } else { 8030 /* We are always allowed to send one MTU out */ 8031 one_chunk = 1; 8032 r_mtu = mtu; 8033 } 8034 } else { 8035 r_mtu = mtu; 8036 } 8037 error = 0; 8038 /************************/ 8039 /* ASCONF transmission */ 8040 /************************/ 8041 /* Now first lets go through the asconf queue */ 8042 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 8043 if (chk->rec.chunk_id.id != SCTP_ASCONF) { 8044 continue; 8045 } 8046 if (chk->whoTo == NULL) { 8047 if (asoc->alternate == NULL) { 8048 if (asoc->primary_destination != net) { 8049 break; 8050 } 8051 } else { 8052 if (asoc->alternate != net) { 8053 break; 8054 } 8055 } 8056 } else { 8057 if (chk->whoTo != net) { 8058 break; 8059 } 8060 } 8061 if (chk->data == NULL) { 8062 break; 8063 } 8064 if (chk->sent != SCTP_DATAGRAM_UNSENT && 8065 chk->sent != SCTP_DATAGRAM_RESEND) { 8066 break; 8067 } 8068 /* 8069 * if no AUTH is yet included and this chunk 8070 * requires it, make sure to account for it. We 8071 * don't apply the size until the AUTH chunk is 8072 * actually added below in case there is no room for 8073 * this chunk. NOTE: we overload the use of "omtu" 8074 * here 8075 */ 8076 if ((auth == NULL) && 8077 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8078 stcb->asoc.peer_auth_chunks)) { 8079 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8080 } else 8081 omtu = 0; 8082 /* Here we do NOT factor the r_mtu */ 8083 if ((chk->send_size < (int)(mtu - omtu)) || 8084 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8085 /* 8086 * We probably should glom the mbuf chain 8087 * from the chk->data for control but the 8088 * problem is it becomes yet one more level 8089 * of tracking to do if for some reason 8090 * output fails. Then I have got to 8091 * reconstruct the merged control chain.. el 8092 * yucko.. for now we take the easy way and 8093 * do the copy 8094 */ 8095 /* 8096 * Add an AUTH chunk, if chunk requires it 8097 * save the offset into the chain for AUTH 8098 */ 8099 if ((auth == NULL) && 8100 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8101 stcb->asoc.peer_auth_chunks))) { 8102 outchain = sctp_add_auth_chunk(outchain, 8103 &endoutchain, 8104 &auth, 8105 &auth_offset, 8106 stcb, 8107 chk->rec.chunk_id.id); 8108 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8109 } 8110 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8111 (int)chk->rec.chunk_id.can_take_data, 8112 chk->send_size, chk->copy_by_ref); 8113 if (outchain == NULL) { 8114 *reason_code = 8; 8115 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8116 return (ENOMEM); 8117 } 8118 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8119 /* update our MTU size */ 8120 if (mtu > (chk->send_size + omtu)) 8121 mtu -= (chk->send_size + omtu); 8122 else 8123 mtu = 0; 8124 to_out += (chk->send_size + omtu); 8125 /* Do clear IP_DF ? */ 8126 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8127 no_fragmentflg = 0; 8128 } 8129 if (chk->rec.chunk_id.can_take_data) 8130 chk->data = NULL; 8131 /* 8132 * set hb flag since we can use these for 8133 * RTO 8134 */ 8135 hbflag = 1; 8136 asconf = 1; 8137 /* 8138 * should sysctl this: don't bundle data 8139 * with ASCONF since it requires AUTH 8140 */ 8141 no_data_chunks = 1; 8142 chk->sent = SCTP_DATAGRAM_SENT; 8143 if (chk->whoTo == NULL) { 8144 chk->whoTo = net; 8145 atomic_add_int(&net->ref_count, 1); 8146 } 8147 chk->snd_count++; 8148 if (mtu == 0) { 8149 /* 8150 * Ok we are out of room but we can 8151 * output without effecting the 8152 * flight size since this little guy 8153 * is a control only packet. 8154 */ 8155 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8156 /* 8157 * do NOT clear the asconf flag as 8158 * it is used to do appropriate 8159 * source address selection. 8160 */ 8161 if (*now_filled == 0) { 8162 (void)SCTP_GETTIME_TIMEVAL(now); 8163 *now_filled = 1; 8164 } 8165 net->last_sent_time = *now; 8166 hbflag = 0; 8167 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8168 (struct sockaddr *)&net->ro._l_addr, 8169 outchain, auth_offset, auth, 8170 stcb->asoc.authinfo.active_keyid, 8171 no_fragmentflg, 0, asconf, 8172 inp->sctp_lport, stcb->rport, 8173 htonl(stcb->asoc.peer_vtag), 8174 net->port, NULL, 8175 0, 0, 8176 so_locked))) { 8177 /* 8178 * error, we could not 8179 * output 8180 */ 8181 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8182 if (from_where == 0) { 8183 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8184 } 8185 if (error == ENOBUFS) { 8186 asoc->ifp_had_enobuf = 1; 8187 SCTP_STAT_INCR(sctps_lowlevelerr); 8188 } 8189 /* error, could not output */ 8190 if (error == EHOSTUNREACH) { 8191 /* 8192 * Destination went 8193 * unreachable 8194 * during this send 8195 */ 8196 sctp_move_chunks_from_net(stcb, net); 8197 } 8198 *reason_code = 7; 8199 break; 8200 } else { 8201 asoc->ifp_had_enobuf = 0; 8202 } 8203 /* 8204 * increase the number we sent, if a 8205 * cookie is sent we don't tell them 8206 * any was sent out. 8207 */ 8208 outchain = endoutchain = NULL; 8209 auth = NULL; 8210 auth_offset = 0; 8211 if (!no_out_cnt) 8212 *num_out += ctl_cnt; 8213 /* recalc a clean slate and setup */ 8214 switch (net->ro._l_addr.sa.sa_family) { 8215 #ifdef INET 8216 case AF_INET: 8217 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8218 break; 8219 #endif 8220 #ifdef INET6 8221 case AF_INET6: 8222 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8223 break; 8224 #endif 8225 default: 8226 /* TSNH */ 8227 mtu = net->mtu; 8228 break; 8229 } 8230 to_out = 0; 8231 no_fragmentflg = 1; 8232 } 8233 } 8234 } 8235 if (error != 0) { 8236 /* try next net */ 8237 continue; 8238 } 8239 /************************/ 8240 /* Control transmission */ 8241 /************************/ 8242 /* Now first lets go through the control queue */ 8243 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 8244 if ((sack_goes_to) && 8245 (chk->rec.chunk_id.id == SCTP_ECN_ECHO) && 8246 (chk->whoTo != sack_goes_to)) { 8247 /* 8248 * if we have a sack in queue, and we are 8249 * looking at an ecn echo that is NOT queued 8250 * to where the sack is going.. 8251 */ 8252 if (chk->whoTo == net) { 8253 /* 8254 * Don't transmit it to where its 8255 * going (current net) 8256 */ 8257 continue; 8258 } else if (sack_goes_to == net) { 8259 /* 8260 * But do transmit it to this 8261 * address 8262 */ 8263 goto skip_net_check; 8264 } 8265 } 8266 if (chk->whoTo == NULL) { 8267 if (asoc->alternate == NULL) { 8268 if (asoc->primary_destination != net) { 8269 continue; 8270 } 8271 } else { 8272 if (asoc->alternate != net) { 8273 continue; 8274 } 8275 } 8276 } else { 8277 if (chk->whoTo != net) { 8278 continue; 8279 } 8280 } 8281 skip_net_check: 8282 if (chk->data == NULL) { 8283 continue; 8284 } 8285 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 8286 /* 8287 * It must be unsent. Cookies and ASCONF's 8288 * hang around but there timers will force 8289 * when marked for resend. 8290 */ 8291 continue; 8292 } 8293 /* 8294 * if no AUTH is yet included and this chunk 8295 * requires it, make sure to account for it. We 8296 * don't apply the size until the AUTH chunk is 8297 * actually added below in case there is no room for 8298 * this chunk. NOTE: we overload the use of "omtu" 8299 * here 8300 */ 8301 if ((auth == NULL) && 8302 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8303 stcb->asoc.peer_auth_chunks)) { 8304 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8305 } else 8306 omtu = 0; 8307 /* Here we do NOT factor the r_mtu */ 8308 if ((chk->send_size <= (int)(mtu - omtu)) || 8309 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8310 /* 8311 * We probably should glom the mbuf chain 8312 * from the chk->data for control but the 8313 * problem is it becomes yet one more level 8314 * of tracking to do if for some reason 8315 * output fails. Then I have got to 8316 * reconstruct the merged control chain.. el 8317 * yucko.. for now we take the easy way and 8318 * do the copy 8319 */ 8320 /* 8321 * Add an AUTH chunk, if chunk requires it 8322 * save the offset into the chain for AUTH 8323 */ 8324 if ((auth == NULL) && 8325 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8326 stcb->asoc.peer_auth_chunks))) { 8327 outchain = sctp_add_auth_chunk(outchain, 8328 &endoutchain, 8329 &auth, 8330 &auth_offset, 8331 stcb, 8332 chk->rec.chunk_id.id); 8333 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8334 } 8335 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8336 (int)chk->rec.chunk_id.can_take_data, 8337 chk->send_size, chk->copy_by_ref); 8338 if (outchain == NULL) { 8339 *reason_code = 8; 8340 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8341 return (ENOMEM); 8342 } 8343 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8344 /* update our MTU size */ 8345 if (mtu > (chk->send_size + omtu)) 8346 mtu -= (chk->send_size + omtu); 8347 else 8348 mtu = 0; 8349 to_out += (chk->send_size + omtu); 8350 /* Do clear IP_DF ? */ 8351 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8352 no_fragmentflg = 0; 8353 } 8354 if (chk->rec.chunk_id.can_take_data) 8355 chk->data = NULL; 8356 /* Mark things to be removed, if needed */ 8357 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8358 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 8359 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 8360 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 8361 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 8362 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 8363 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 8364 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 8365 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 8366 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 8367 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 8368 if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) { 8369 hbflag = 1; 8370 } 8371 /* remove these chunks at the end */ 8372 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8373 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 8374 /* turn off the timer */ 8375 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 8376 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 8377 inp, stcb, NULL, 8378 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1); 8379 } 8380 } 8381 ctl_cnt++; 8382 } else { 8383 /* 8384 * Other chunks, since they have 8385 * timers running (i.e. COOKIE) we 8386 * just "trust" that it gets sent or 8387 * retransmitted. 8388 */ 8389 ctl_cnt++; 8390 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 8391 cookie = 1; 8392 no_out_cnt = 1; 8393 } else if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 8394 /* 8395 * Increment ecne send count 8396 * here this means we may be 8397 * over-zealous in our 8398 * counting if the send 8399 * fails, but its the best 8400 * place to do it (we used 8401 * to do it in the queue of 8402 * the chunk, but that did 8403 * not tell how many times 8404 * it was sent. 8405 */ 8406 SCTP_STAT_INCR(sctps_sendecne); 8407 } 8408 chk->sent = SCTP_DATAGRAM_SENT; 8409 if (chk->whoTo == NULL) { 8410 chk->whoTo = net; 8411 atomic_add_int(&net->ref_count, 1); 8412 } 8413 chk->snd_count++; 8414 } 8415 if (mtu == 0) { 8416 /* 8417 * Ok we are out of room but we can 8418 * output without effecting the 8419 * flight size since this little guy 8420 * is a control only packet. 8421 */ 8422 if (asconf) { 8423 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8424 /* 8425 * do NOT clear the asconf 8426 * flag as it is used to do 8427 * appropriate source 8428 * address selection. 8429 */ 8430 } 8431 if (cookie) { 8432 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8433 cookie = 0; 8434 } 8435 /* Only HB or ASCONF advances time */ 8436 if (hbflag) { 8437 if (*now_filled == 0) { 8438 (void)SCTP_GETTIME_TIMEVAL(now); 8439 *now_filled = 1; 8440 } 8441 net->last_sent_time = *now; 8442 hbflag = 0; 8443 } 8444 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8445 (struct sockaddr *)&net->ro._l_addr, 8446 outchain, 8447 auth_offset, auth, 8448 stcb->asoc.authinfo.active_keyid, 8449 no_fragmentflg, 0, asconf, 8450 inp->sctp_lport, stcb->rport, 8451 htonl(stcb->asoc.peer_vtag), 8452 net->port, NULL, 8453 0, 0, 8454 so_locked))) { 8455 /* 8456 * error, we could not 8457 * output 8458 */ 8459 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8460 if (from_where == 0) { 8461 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8462 } 8463 if (error == ENOBUFS) { 8464 asoc->ifp_had_enobuf = 1; 8465 SCTP_STAT_INCR(sctps_lowlevelerr); 8466 } 8467 if (error == EHOSTUNREACH) { 8468 /* 8469 * Destination went 8470 * unreachable 8471 * during this send 8472 */ 8473 sctp_move_chunks_from_net(stcb, net); 8474 } 8475 *reason_code = 7; 8476 break; 8477 } else { 8478 asoc->ifp_had_enobuf = 0; 8479 } 8480 /* 8481 * increase the number we sent, if a 8482 * cookie is sent we don't tell them 8483 * any was sent out. 8484 */ 8485 outchain = endoutchain = NULL; 8486 auth = NULL; 8487 auth_offset = 0; 8488 if (!no_out_cnt) 8489 *num_out += ctl_cnt; 8490 /* recalc a clean slate and setup */ 8491 switch (net->ro._l_addr.sa.sa_family) { 8492 #ifdef INET 8493 case AF_INET: 8494 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8495 break; 8496 #endif 8497 #ifdef INET6 8498 case AF_INET6: 8499 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8500 break; 8501 #endif 8502 default: 8503 /* TSNH */ 8504 mtu = net->mtu; 8505 break; 8506 } 8507 to_out = 0; 8508 no_fragmentflg = 1; 8509 } 8510 } 8511 } 8512 if (error != 0) { 8513 /* try next net */ 8514 continue; 8515 } 8516 /* JRI: if dest is in PF state, do not send data to it */ 8517 if ((asoc->sctp_cmt_on_off > 0) && 8518 (net != stcb->asoc.alternate) && 8519 (net->dest_state & SCTP_ADDR_PF)) { 8520 goto no_data_fill; 8521 } 8522 if (net->flight_size >= net->cwnd) { 8523 goto no_data_fill; 8524 } 8525 if ((asoc->sctp_cmt_on_off > 0) && 8526 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_RECV_BUFFER_SPLITTING) && 8527 (net->flight_size > max_rwnd_per_dest)) { 8528 goto no_data_fill; 8529 } 8530 /* 8531 * We need a specific accounting for the usage of the send 8532 * buffer. We also need to check the number of messages per 8533 * net. For now, this is better than nothing and it disabled 8534 * by default... 8535 */ 8536 if ((asoc->sctp_cmt_on_off > 0) && 8537 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_SEND_BUFFER_SPLITTING) && 8538 (max_send_per_dest > 0) && 8539 (net->flight_size > max_send_per_dest)) { 8540 goto no_data_fill; 8541 } 8542 /*********************/ 8543 /* Data transmission */ 8544 /*********************/ 8545 /* 8546 * if AUTH for DATA is required and no AUTH has been added 8547 * yet, account for this in the mtu now... if no data can be 8548 * bundled, this adjustment won't matter anyways since the 8549 * packet will be going out... 8550 */ 8551 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, 8552 stcb->asoc.peer_auth_chunks); 8553 if (data_auth_reqd && (auth == NULL)) { 8554 mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8555 } 8556 /* now lets add any data within the MTU constraints */ 8557 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8558 #ifdef INET 8559 case AF_INET: 8560 if (net->mtu > SCTP_MIN_V4_OVERHEAD) 8561 omtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8562 else 8563 omtu = 0; 8564 break; 8565 #endif 8566 #ifdef INET6 8567 case AF_INET6: 8568 if (net->mtu > SCTP_MIN_OVERHEAD) 8569 omtu = net->mtu - SCTP_MIN_OVERHEAD; 8570 else 8571 omtu = 0; 8572 break; 8573 #endif 8574 default: 8575 /* TSNH */ 8576 omtu = 0; 8577 break; 8578 } 8579 if ((((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) || 8580 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) && 8581 (skip_data_for_this_net == 0)) || 8582 (cookie)) { 8583 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 8584 if (no_data_chunks) { 8585 /* let only control go out */ 8586 *reason_code = 1; 8587 break; 8588 } 8589 if (net->flight_size >= net->cwnd) { 8590 /* skip this net, no room for data */ 8591 *reason_code = 2; 8592 break; 8593 } 8594 if ((chk->whoTo != NULL) && 8595 (chk->whoTo != net)) { 8596 /* Don't send the chunk on this net */ 8597 continue; 8598 } 8599 8600 if (asoc->sctp_cmt_on_off == 0) { 8601 if ((asoc->alternate) && 8602 (asoc->alternate != net) && 8603 (chk->whoTo == NULL)) { 8604 continue; 8605 } else if ((net != asoc->primary_destination) && 8606 (asoc->alternate == NULL) && 8607 (chk->whoTo == NULL)) { 8608 continue; 8609 } 8610 } 8611 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 8612 /*- 8613 * strange, we have a chunk that is 8614 * to big for its destination and 8615 * yet no fragment ok flag. 8616 * Something went wrong when the 8617 * PMTU changed...we did not mark 8618 * this chunk for some reason?? I 8619 * will fix it here by letting IP 8620 * fragment it for now and printing 8621 * a warning. This really should not 8622 * happen ... 8623 */ 8624 SCTP_PRINTF("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 8625 chk->send_size, mtu); 8626 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 8627 } 8628 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 8629 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 8630 struct sctp_data_chunk *dchkh; 8631 8632 dchkh = mtod(chk->data, struct sctp_data_chunk *); 8633 dchkh->ch.chunk_flags |= SCTP_DATA_SACK_IMMEDIATELY; 8634 } 8635 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 8636 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 8637 /* ok we will add this one */ 8638 8639 /* 8640 * Add an AUTH chunk, if chunk 8641 * requires it, save the offset into 8642 * the chain for AUTH 8643 */ 8644 if (data_auth_reqd) { 8645 if (auth == NULL) { 8646 outchain = sctp_add_auth_chunk(outchain, 8647 &endoutchain, 8648 &auth, 8649 &auth_offset, 8650 stcb, 8651 SCTP_DATA); 8652 auth_keyid = chk->auth_keyid; 8653 override_ok = 0; 8654 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8655 } else if (override_ok) { 8656 /* 8657 * use this data's 8658 * keyid 8659 */ 8660 auth_keyid = chk->auth_keyid; 8661 override_ok = 0; 8662 } else if (auth_keyid != chk->auth_keyid) { 8663 /* 8664 * different keyid, 8665 * so done bundling 8666 */ 8667 break; 8668 } 8669 } 8670 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0, 8671 chk->send_size, chk->copy_by_ref); 8672 if (outchain == NULL) { 8673 SCTPDBG(SCTP_DEBUG_OUTPUT3, "No memory?\n"); 8674 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 8675 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8676 } 8677 *reason_code = 3; 8678 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8679 return (ENOMEM); 8680 } 8681 /* upate our MTU size */ 8682 /* Do clear IP_DF ? */ 8683 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8684 no_fragmentflg = 0; 8685 } 8686 /* unsigned subtraction of mtu */ 8687 if (mtu > chk->send_size) 8688 mtu -= chk->send_size; 8689 else 8690 mtu = 0; 8691 /* unsigned subtraction of r_mtu */ 8692 if (r_mtu > chk->send_size) 8693 r_mtu -= chk->send_size; 8694 else 8695 r_mtu = 0; 8696 8697 to_out += chk->send_size; 8698 if ((to_out > mx_mtu) && no_fragmentflg) { 8699 #ifdef INVARIANTS 8700 panic("Exceeding mtu of %d out size is %d", mx_mtu, to_out); 8701 #else 8702 SCTP_PRINTF("Exceeding mtu of %d out size is %d\n", 8703 mx_mtu, to_out); 8704 #endif 8705 } 8706 chk->window_probe = 0; 8707 data_list[bundle_at++] = chk; 8708 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 8709 break; 8710 } 8711 if (chk->sent == SCTP_DATAGRAM_UNSENT) { 8712 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 8713 SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks); 8714 } else { 8715 SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks); 8716 } 8717 if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) && 8718 ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0)) 8719 /* 8720 * Count number of 8721 * user msg's that 8722 * were fragmented 8723 * we do this by 8724 * counting when we 8725 * see a LAST 8726 * fragment only. 8727 */ 8728 SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs); 8729 } 8730 if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) { 8731 if ((one_chunk) && (stcb->asoc.total_flight == 0)) { 8732 data_list[0]->window_probe = 1; 8733 net->window_probe = 1; 8734 } 8735 break; 8736 } 8737 } else { 8738 /* 8739 * Must be sent in order of the 8740 * TSN's (on a network) 8741 */ 8742 break; 8743 } 8744 } /* for (chunk gather loop for this net) */ 8745 } /* if asoc.state OPEN */ 8746 no_data_fill: 8747 /* Is there something to send for this destination? */ 8748 if (outchain) { 8749 /* We may need to start a control timer or two */ 8750 if (asconf) { 8751 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, 8752 stcb, net); 8753 /* 8754 * do NOT clear the asconf flag as it is 8755 * used to do appropriate source address 8756 * selection. 8757 */ 8758 } 8759 if (cookie) { 8760 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8761 cookie = 0; 8762 } 8763 /* must start a send timer if data is being sent */ 8764 if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) { 8765 /* 8766 * no timer running on this destination 8767 * restart it. 8768 */ 8769 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8770 } 8771 if (bundle_at || hbflag) { 8772 /* For data/asconf and hb set time */ 8773 if (*now_filled == 0) { 8774 (void)SCTP_GETTIME_TIMEVAL(now); 8775 *now_filled = 1; 8776 } 8777 net->last_sent_time = *now; 8778 } 8779 /* Now send it, if there is anything to send :> */ 8780 if ((error = sctp_lowlevel_chunk_output(inp, 8781 stcb, 8782 net, 8783 (struct sockaddr *)&net->ro._l_addr, 8784 outchain, 8785 auth_offset, 8786 auth, 8787 auth_keyid, 8788 no_fragmentflg, 8789 bundle_at, 8790 asconf, 8791 inp->sctp_lport, stcb->rport, 8792 htonl(stcb->asoc.peer_vtag), 8793 net->port, NULL, 8794 0, 0, 8795 so_locked))) { 8796 /* error, we could not output */ 8797 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8798 if (from_where == 0) { 8799 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8800 } 8801 if (error == ENOBUFS) { 8802 asoc->ifp_had_enobuf = 1; 8803 SCTP_STAT_INCR(sctps_lowlevelerr); 8804 } 8805 if (error == EHOSTUNREACH) { 8806 /* 8807 * Destination went unreachable 8808 * during this send 8809 */ 8810 sctp_move_chunks_from_net(stcb, net); 8811 } 8812 *reason_code = 6; 8813 /*- 8814 * I add this line to be paranoid. As far as 8815 * I can tell the continue, takes us back to 8816 * the top of the for, but just to make sure 8817 * I will reset these again here. 8818 */ 8819 ctl_cnt = bundle_at = 0; 8820 continue; /* This takes us back to the 8821 * for() for the nets. */ 8822 } else { 8823 asoc->ifp_had_enobuf = 0; 8824 } 8825 endoutchain = NULL; 8826 auth = NULL; 8827 auth_offset = 0; 8828 if (!no_out_cnt) { 8829 *num_out += (ctl_cnt + bundle_at); 8830 } 8831 if (bundle_at) { 8832 /* setup for a RTO measurement */ 8833 tsns_sent = data_list[0]->rec.data.tsn; 8834 /* fill time if not already filled */ 8835 if (*now_filled == 0) { 8836 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 8837 *now_filled = 1; 8838 *now = asoc->time_last_sent; 8839 } else { 8840 asoc->time_last_sent = *now; 8841 } 8842 if (net->rto_needed) { 8843 data_list[0]->do_rtt = 1; 8844 net->rto_needed = 0; 8845 } 8846 SCTP_STAT_INCR_BY(sctps_senddata, bundle_at); 8847 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 8848 } 8849 if (one_chunk) { 8850 break; 8851 } 8852 } 8853 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8854 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND); 8855 } 8856 } 8857 if (old_start_at == NULL) { 8858 old_start_at = start_at; 8859 start_at = TAILQ_FIRST(&asoc->nets); 8860 if (old_start_at) 8861 goto again_one_more_time; 8862 } 8863 8864 /* 8865 * At the end there should be no NON timed chunks hanging on this 8866 * queue. 8867 */ 8868 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8869 sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND); 8870 } 8871 if ((*num_out == 0) && (*reason_code == 0)) { 8872 *reason_code = 4; 8873 } else { 8874 *reason_code = 5; 8875 } 8876 sctp_clean_up_ctl(stcb, asoc, so_locked); 8877 return (0); 8878 } 8879 8880 void 8881 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 8882 { 8883 /*- 8884 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of 8885 * the control chunk queue. 8886 */ 8887 struct sctp_chunkhdr *hdr; 8888 struct sctp_tmit_chunk *chk; 8889 struct mbuf *mat, *last_mbuf; 8890 uint32_t chunk_length; 8891 uint16_t padding_length; 8892 8893 SCTP_TCB_LOCK_ASSERT(stcb); 8894 SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_NOWAIT); 8895 if (op_err == NULL) { 8896 return; 8897 } 8898 last_mbuf = NULL; 8899 chunk_length = 0; 8900 for (mat = op_err; mat != NULL; mat = SCTP_BUF_NEXT(mat)) { 8901 chunk_length += SCTP_BUF_LEN(mat); 8902 if (SCTP_BUF_NEXT(mat) == NULL) { 8903 last_mbuf = mat; 8904 } 8905 } 8906 if (chunk_length > SCTP_MAX_CHUNK_LENGTH) { 8907 sctp_m_freem(op_err); 8908 return; 8909 } 8910 padding_length = chunk_length % 4; 8911 if (padding_length != 0) { 8912 padding_length = 4 - padding_length; 8913 } 8914 if (padding_length != 0) { 8915 if (sctp_add_pad_tombuf(last_mbuf, padding_length) == NULL) { 8916 sctp_m_freem(op_err); 8917 return; 8918 } 8919 } 8920 sctp_alloc_a_chunk(stcb, chk); 8921 if (chk == NULL) { 8922 /* no memory */ 8923 sctp_m_freem(op_err); 8924 return; 8925 } 8926 chk->copy_by_ref = 0; 8927 chk->rec.chunk_id.id = SCTP_OPERATION_ERROR; 8928 chk->rec.chunk_id.can_take_data = 0; 8929 chk->flags = 0; 8930 chk->send_size = (uint16_t)chunk_length; 8931 chk->sent = SCTP_DATAGRAM_UNSENT; 8932 chk->snd_count = 0; 8933 chk->asoc = &stcb->asoc; 8934 chk->data = op_err; 8935 chk->whoTo = NULL; 8936 hdr = mtod(op_err, struct sctp_chunkhdr *); 8937 hdr->chunk_type = SCTP_OPERATION_ERROR; 8938 hdr->chunk_flags = 0; 8939 hdr->chunk_length = htons(chk->send_size); 8940 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 8941 chk->asoc->ctrl_queue_cnt++; 8942 } 8943 8944 int 8945 sctp_send_cookie_echo(struct mbuf *m, 8946 int offset, int limit, 8947 struct sctp_tcb *stcb, 8948 struct sctp_nets *net) 8949 { 8950 /*- 8951 * pull out the cookie and put it at the front of the control chunk 8952 * queue. 8953 */ 8954 int at; 8955 struct mbuf *cookie; 8956 struct sctp_paramhdr param, *phdr; 8957 struct sctp_chunkhdr *hdr; 8958 struct sctp_tmit_chunk *chk; 8959 uint16_t ptype, plen; 8960 8961 SCTP_TCB_LOCK_ASSERT(stcb); 8962 /* First find the cookie in the param area */ 8963 cookie = NULL; 8964 at = offset + sizeof(struct sctp_init_chunk); 8965 for (;;) { 8966 phdr = sctp_get_next_param(m, at, ¶m, sizeof(param)); 8967 if (phdr == NULL) { 8968 return (-3); 8969 } 8970 ptype = ntohs(phdr->param_type); 8971 plen = ntohs(phdr->param_length); 8972 if (plen < sizeof(struct sctp_paramhdr)) { 8973 return (-6); 8974 } 8975 if (ptype == SCTP_STATE_COOKIE) { 8976 int pad; 8977 8978 /* found the cookie */ 8979 if (at + plen > limit) { 8980 return (-7); 8981 } 8982 cookie = SCTP_M_COPYM(m, at, plen, M_NOWAIT); 8983 if (cookie == NULL) { 8984 /* No memory */ 8985 return (-2); 8986 } 8987 if ((pad = (plen % 4)) > 0) { 8988 pad = 4 - pad; 8989 } 8990 if (pad > 0) { 8991 if (sctp_pad_lastmbuf(cookie, pad, NULL) == NULL) { 8992 return (-8); 8993 } 8994 } 8995 #ifdef SCTP_MBUF_LOGGING 8996 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 8997 sctp_log_mbc(cookie, SCTP_MBUF_ICOPY); 8998 } 8999 #endif 9000 break; 9001 } 9002 at += SCTP_SIZE32(plen); 9003 } 9004 /* ok, we got the cookie lets change it into a cookie echo chunk */ 9005 /* first the change from param to cookie */ 9006 hdr = mtod(cookie, struct sctp_chunkhdr *); 9007 hdr->chunk_type = SCTP_COOKIE_ECHO; 9008 hdr->chunk_flags = 0; 9009 /* get the chunk stuff now and place it in the FRONT of the queue */ 9010 sctp_alloc_a_chunk(stcb, chk); 9011 if (chk == NULL) { 9012 /* no memory */ 9013 sctp_m_freem(cookie); 9014 return (-5); 9015 } 9016 chk->copy_by_ref = 0; 9017 chk->rec.chunk_id.id = SCTP_COOKIE_ECHO; 9018 chk->rec.chunk_id.can_take_data = 0; 9019 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9020 chk->send_size = SCTP_SIZE32(plen); 9021 chk->sent = SCTP_DATAGRAM_UNSENT; 9022 chk->snd_count = 0; 9023 chk->asoc = &stcb->asoc; 9024 chk->data = cookie; 9025 chk->whoTo = net; 9026 atomic_add_int(&chk->whoTo->ref_count, 1); 9027 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 9028 chk->asoc->ctrl_queue_cnt++; 9029 return (0); 9030 } 9031 9032 void 9033 sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 9034 struct mbuf *m, 9035 int offset, 9036 int chk_length, 9037 struct sctp_nets *net) 9038 { 9039 /* 9040 * take a HB request and make it into a HB ack and send it. 9041 */ 9042 struct mbuf *outchain; 9043 struct sctp_chunkhdr *chdr; 9044 struct sctp_tmit_chunk *chk; 9045 9046 if (net == NULL) 9047 /* must have a net pointer */ 9048 return; 9049 9050 outchain = SCTP_M_COPYM(m, offset, chk_length, M_NOWAIT); 9051 if (outchain == NULL) { 9052 /* gak out of memory */ 9053 return; 9054 } 9055 #ifdef SCTP_MBUF_LOGGING 9056 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9057 sctp_log_mbc(outchain, SCTP_MBUF_ICOPY); 9058 } 9059 #endif 9060 chdr = mtod(outchain, struct sctp_chunkhdr *); 9061 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 9062 chdr->chunk_flags = 0; 9063 if (chk_length % 4 != 0) { 9064 sctp_pad_lastmbuf(outchain, 4 - (chk_length % 4), NULL); 9065 } 9066 sctp_alloc_a_chunk(stcb, chk); 9067 if (chk == NULL) { 9068 /* no memory */ 9069 sctp_m_freem(outchain); 9070 return; 9071 } 9072 chk->copy_by_ref = 0; 9073 chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK; 9074 chk->rec.chunk_id.can_take_data = 1; 9075 chk->flags = 0; 9076 chk->send_size = chk_length; 9077 chk->sent = SCTP_DATAGRAM_UNSENT; 9078 chk->snd_count = 0; 9079 chk->asoc = &stcb->asoc; 9080 chk->data = outchain; 9081 chk->whoTo = net; 9082 atomic_add_int(&chk->whoTo->ref_count, 1); 9083 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9084 chk->asoc->ctrl_queue_cnt++; 9085 } 9086 9087 void 9088 sctp_send_cookie_ack(struct sctp_tcb *stcb) 9089 { 9090 /* formulate and queue a cookie-ack back to sender */ 9091 struct mbuf *cookie_ack; 9092 struct sctp_chunkhdr *hdr; 9093 struct sctp_tmit_chunk *chk; 9094 9095 SCTP_TCB_LOCK_ASSERT(stcb); 9096 9097 cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 9098 if (cookie_ack == NULL) { 9099 /* no mbuf's */ 9100 return; 9101 } 9102 SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD); 9103 sctp_alloc_a_chunk(stcb, chk); 9104 if (chk == NULL) { 9105 /* no memory */ 9106 sctp_m_freem(cookie_ack); 9107 return; 9108 } 9109 chk->copy_by_ref = 0; 9110 chk->rec.chunk_id.id = SCTP_COOKIE_ACK; 9111 chk->rec.chunk_id.can_take_data = 1; 9112 chk->flags = 0; 9113 chk->send_size = sizeof(struct sctp_chunkhdr); 9114 chk->sent = SCTP_DATAGRAM_UNSENT; 9115 chk->snd_count = 0; 9116 chk->asoc = &stcb->asoc; 9117 chk->data = cookie_ack; 9118 if (chk->asoc->last_control_chunk_from != NULL) { 9119 chk->whoTo = chk->asoc->last_control_chunk_from; 9120 atomic_add_int(&chk->whoTo->ref_count, 1); 9121 } else { 9122 chk->whoTo = NULL; 9123 } 9124 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 9125 hdr->chunk_type = SCTP_COOKIE_ACK; 9126 hdr->chunk_flags = 0; 9127 hdr->chunk_length = htons(chk->send_size); 9128 SCTP_BUF_LEN(cookie_ack) = chk->send_size; 9129 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9130 chk->asoc->ctrl_queue_cnt++; 9131 return; 9132 } 9133 9134 9135 void 9136 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 9137 { 9138 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 9139 struct mbuf *m_shutdown_ack; 9140 struct sctp_shutdown_ack_chunk *ack_cp; 9141 struct sctp_tmit_chunk *chk; 9142 9143 m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9144 if (m_shutdown_ack == NULL) { 9145 /* no mbuf's */ 9146 return; 9147 } 9148 SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD); 9149 sctp_alloc_a_chunk(stcb, chk); 9150 if (chk == NULL) { 9151 /* no memory */ 9152 sctp_m_freem(m_shutdown_ack); 9153 return; 9154 } 9155 chk->copy_by_ref = 0; 9156 chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK; 9157 chk->rec.chunk_id.can_take_data = 1; 9158 chk->flags = 0; 9159 chk->send_size = sizeof(struct sctp_chunkhdr); 9160 chk->sent = SCTP_DATAGRAM_UNSENT; 9161 chk->snd_count = 0; 9162 chk->asoc = &stcb->asoc; 9163 chk->data = m_shutdown_ack; 9164 chk->whoTo = net; 9165 if (chk->whoTo) { 9166 atomic_add_int(&chk->whoTo->ref_count, 1); 9167 } 9168 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 9169 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 9170 ack_cp->ch.chunk_flags = 0; 9171 ack_cp->ch.chunk_length = htons(chk->send_size); 9172 SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size; 9173 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9174 chk->asoc->ctrl_queue_cnt++; 9175 return; 9176 } 9177 9178 void 9179 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 9180 { 9181 /* formulate and queue a SHUTDOWN to the sender */ 9182 struct mbuf *m_shutdown; 9183 struct sctp_shutdown_chunk *shutdown_cp; 9184 struct sctp_tmit_chunk *chk; 9185 9186 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 9187 if (chk->rec.chunk_id.id == SCTP_SHUTDOWN) { 9188 /* We already have a SHUTDOWN queued. Reuse it. */ 9189 if (chk->whoTo) { 9190 sctp_free_remote_addr(chk->whoTo); 9191 chk->whoTo = NULL; 9192 } 9193 break; 9194 } 9195 } 9196 if (chk == NULL) { 9197 m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9198 if (m_shutdown == NULL) { 9199 /* no mbuf's */ 9200 return; 9201 } 9202 SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD); 9203 sctp_alloc_a_chunk(stcb, chk); 9204 if (chk == NULL) { 9205 /* no memory */ 9206 sctp_m_freem(m_shutdown); 9207 return; 9208 } 9209 chk->copy_by_ref = 0; 9210 chk->rec.chunk_id.id = SCTP_SHUTDOWN; 9211 chk->rec.chunk_id.can_take_data = 1; 9212 chk->flags = 0; 9213 chk->send_size = sizeof(struct sctp_shutdown_chunk); 9214 chk->sent = SCTP_DATAGRAM_UNSENT; 9215 chk->snd_count = 0; 9216 chk->asoc = &stcb->asoc; 9217 chk->data = m_shutdown; 9218 chk->whoTo = net; 9219 if (chk->whoTo) { 9220 atomic_add_int(&chk->whoTo->ref_count, 1); 9221 } 9222 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 9223 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 9224 shutdown_cp->ch.chunk_flags = 0; 9225 shutdown_cp->ch.chunk_length = htons(chk->send_size); 9226 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9227 SCTP_BUF_LEN(m_shutdown) = chk->send_size; 9228 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9229 chk->asoc->ctrl_queue_cnt++; 9230 } else { 9231 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, sctp_next); 9232 chk->whoTo = net; 9233 if (chk->whoTo) { 9234 atomic_add_int(&chk->whoTo->ref_count, 1); 9235 } 9236 shutdown_cp = mtod(chk->data, struct sctp_shutdown_chunk *); 9237 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9238 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 9239 } 9240 return; 9241 } 9242 9243 void 9244 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked) 9245 { 9246 /* 9247 * formulate and queue an ASCONF to the peer. ASCONF parameters 9248 * should be queued on the assoc queue. 9249 */ 9250 struct sctp_tmit_chunk *chk; 9251 struct mbuf *m_asconf; 9252 int len; 9253 9254 SCTP_TCB_LOCK_ASSERT(stcb); 9255 9256 if ((!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) && 9257 (!sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS))) { 9258 /* can't send a new one if there is one in flight already */ 9259 return; 9260 } 9261 9262 /* compose an ASCONF chunk, maximum length is PMTU */ 9263 m_asconf = sctp_compose_asconf(stcb, &len, addr_locked); 9264 if (m_asconf == NULL) { 9265 return; 9266 } 9267 9268 sctp_alloc_a_chunk(stcb, chk); 9269 if (chk == NULL) { 9270 /* no memory */ 9271 sctp_m_freem(m_asconf); 9272 return; 9273 } 9274 9275 chk->copy_by_ref = 0; 9276 chk->rec.chunk_id.id = SCTP_ASCONF; 9277 chk->rec.chunk_id.can_take_data = 0; 9278 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9279 chk->data = m_asconf; 9280 chk->send_size = len; 9281 chk->sent = SCTP_DATAGRAM_UNSENT; 9282 chk->snd_count = 0; 9283 chk->asoc = &stcb->asoc; 9284 chk->whoTo = net; 9285 if (chk->whoTo) { 9286 atomic_add_int(&chk->whoTo->ref_count, 1); 9287 } 9288 TAILQ_INSERT_TAIL(&chk->asoc->asconf_send_queue, chk, sctp_next); 9289 chk->asoc->ctrl_queue_cnt++; 9290 return; 9291 } 9292 9293 void 9294 sctp_send_asconf_ack(struct sctp_tcb *stcb) 9295 { 9296 /* 9297 * formulate and queue a asconf-ack back to sender. the asconf-ack 9298 * must be stored in the tcb. 9299 */ 9300 struct sctp_tmit_chunk *chk; 9301 struct sctp_asconf_ack *ack, *latest_ack; 9302 struct mbuf *m_ack; 9303 struct sctp_nets *net = NULL; 9304 9305 SCTP_TCB_LOCK_ASSERT(stcb); 9306 /* Get the latest ASCONF-ACK */ 9307 latest_ack = TAILQ_LAST(&stcb->asoc.asconf_ack_sent, sctp_asconf_ackhead); 9308 if (latest_ack == NULL) { 9309 return; 9310 } 9311 if (latest_ack->last_sent_to != NULL && 9312 latest_ack->last_sent_to == stcb->asoc.last_control_chunk_from) { 9313 /* we're doing a retransmission */ 9314 net = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0); 9315 if (net == NULL) { 9316 /* no alternate */ 9317 if (stcb->asoc.last_control_chunk_from == NULL) { 9318 if (stcb->asoc.alternate) { 9319 net = stcb->asoc.alternate; 9320 } else { 9321 net = stcb->asoc.primary_destination; 9322 } 9323 } else { 9324 net = stcb->asoc.last_control_chunk_from; 9325 } 9326 } 9327 } else { 9328 /* normal case */ 9329 if (stcb->asoc.last_control_chunk_from == NULL) { 9330 if (stcb->asoc.alternate) { 9331 net = stcb->asoc.alternate; 9332 } else { 9333 net = stcb->asoc.primary_destination; 9334 } 9335 } else { 9336 net = stcb->asoc.last_control_chunk_from; 9337 } 9338 } 9339 latest_ack->last_sent_to = net; 9340 9341 TAILQ_FOREACH(ack, &stcb->asoc.asconf_ack_sent, next) { 9342 if (ack->data == NULL) { 9343 continue; 9344 } 9345 9346 /* copy the asconf_ack */ 9347 m_ack = SCTP_M_COPYM(ack->data, 0, M_COPYALL, M_NOWAIT); 9348 if (m_ack == NULL) { 9349 /* couldn't copy it */ 9350 return; 9351 } 9352 #ifdef SCTP_MBUF_LOGGING 9353 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9354 sctp_log_mbc(m_ack, SCTP_MBUF_ICOPY); 9355 } 9356 #endif 9357 9358 sctp_alloc_a_chunk(stcb, chk); 9359 if (chk == NULL) { 9360 /* no memory */ 9361 if (m_ack) 9362 sctp_m_freem(m_ack); 9363 return; 9364 } 9365 chk->copy_by_ref = 0; 9366 chk->rec.chunk_id.id = SCTP_ASCONF_ACK; 9367 chk->rec.chunk_id.can_take_data = 1; 9368 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9369 chk->whoTo = net; 9370 if (chk->whoTo) { 9371 atomic_add_int(&chk->whoTo->ref_count, 1); 9372 } 9373 chk->data = m_ack; 9374 chk->send_size = ack->len; 9375 chk->sent = SCTP_DATAGRAM_UNSENT; 9376 chk->snd_count = 0; 9377 chk->asoc = &stcb->asoc; 9378 9379 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9380 chk->asoc->ctrl_queue_cnt++; 9381 } 9382 return; 9383 } 9384 9385 9386 static int 9387 sctp_chunk_retransmission(struct sctp_inpcb *inp, 9388 struct sctp_tcb *stcb, 9389 struct sctp_association *asoc, 9390 int *cnt_out, struct timeval *now, int *now_filled, int *fr_done, int so_locked) 9391 { 9392 /*- 9393 * send out one MTU of retransmission. If fast_retransmit is 9394 * happening we ignore the cwnd. Otherwise we obey the cwnd and 9395 * rwnd. For a Cookie or Asconf in the control chunk queue we 9396 * retransmit them by themselves. 9397 * 9398 * For data chunks we will pick out the lowest TSN's in the sent_queue 9399 * marked for resend and bundle them all together (up to a MTU of 9400 * destination). The address to send to should have been 9401 * selected/changed where the retransmission was marked (i.e. in FR 9402 * or t3-timeout routines). 9403 */ 9404 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 9405 struct sctp_tmit_chunk *chk, *fwd; 9406 struct mbuf *m, *endofchain; 9407 struct sctp_nets *net = NULL; 9408 uint32_t tsns_sent = 0; 9409 int no_fragmentflg, bundle_at, cnt_thru; 9410 unsigned int mtu; 9411 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 9412 struct sctp_auth_chunk *auth = NULL; 9413 uint32_t auth_offset = 0; 9414 uint16_t auth_keyid; 9415 int override_ok = 1; 9416 int data_auth_reqd = 0; 9417 uint32_t dmtu = 0; 9418 9419 SCTP_TCB_LOCK_ASSERT(stcb); 9420 tmr_started = ctl_cnt = bundle_at = error = 0; 9421 no_fragmentflg = 1; 9422 fwd_tsn = 0; 9423 *cnt_out = 0; 9424 fwd = NULL; 9425 endofchain = m = NULL; 9426 auth_keyid = stcb->asoc.authinfo.active_keyid; 9427 #ifdef SCTP_AUDITING_ENABLED 9428 sctp_audit_log(0xC3, 1); 9429 #endif 9430 if ((TAILQ_EMPTY(&asoc->sent_queue)) && 9431 (TAILQ_EMPTY(&asoc->control_send_queue))) { 9432 SCTPDBG(SCTP_DEBUG_OUTPUT1, "SCTP hits empty queue with cnt set to %d?\n", 9433 asoc->sent_queue_retran_cnt); 9434 asoc->sent_queue_cnt = 0; 9435 asoc->sent_queue_cnt_removeable = 0; 9436 /* send back 0/0 so we enter normal transmission */ 9437 *cnt_out = 0; 9438 return (0); 9439 } 9440 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 9441 if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) || 9442 (chk->rec.chunk_id.id == SCTP_STREAM_RESET) || 9443 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) { 9444 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9445 continue; 9446 } 9447 if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 9448 if (chk != asoc->str_reset) { 9449 /* 9450 * not eligible for retran if its 9451 * not ours 9452 */ 9453 continue; 9454 } 9455 } 9456 ctl_cnt++; 9457 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 9458 fwd_tsn = 1; 9459 } 9460 /* 9461 * Add an AUTH chunk, if chunk requires it save the 9462 * offset into the chain for AUTH 9463 */ 9464 if ((auth == NULL) && 9465 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 9466 stcb->asoc.peer_auth_chunks))) { 9467 m = sctp_add_auth_chunk(m, &endofchain, 9468 &auth, &auth_offset, 9469 stcb, 9470 chk->rec.chunk_id.id); 9471 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9472 } 9473 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9474 break; 9475 } 9476 } 9477 one_chunk = 0; 9478 cnt_thru = 0; 9479 /* do we have control chunks to retransmit? */ 9480 if (m != NULL) { 9481 /* Start a timer no matter if we succeed or fail */ 9482 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 9483 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 9484 } else if (chk->rec.chunk_id.id == SCTP_ASCONF) 9485 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 9486 chk->snd_count++; /* update our count */ 9487 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 9488 (struct sockaddr *)&chk->whoTo->ro._l_addr, m, 9489 auth_offset, auth, stcb->asoc.authinfo.active_keyid, 9490 no_fragmentflg, 0, 0, 9491 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9492 chk->whoTo->port, NULL, 9493 0, 0, 9494 so_locked))) { 9495 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9496 if (error == ENOBUFS) { 9497 asoc->ifp_had_enobuf = 1; 9498 SCTP_STAT_INCR(sctps_lowlevelerr); 9499 } 9500 return (error); 9501 } else { 9502 asoc->ifp_had_enobuf = 0; 9503 } 9504 endofchain = NULL; 9505 auth = NULL; 9506 auth_offset = 0; 9507 /* 9508 * We don't want to mark the net->sent time here since this 9509 * we use this for HB and retrans cannot measure RTT 9510 */ 9511 /* (void)SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */ 9512 *cnt_out += 1; 9513 chk->sent = SCTP_DATAGRAM_SENT; 9514 sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt); 9515 if (fwd_tsn == 0) { 9516 return (0); 9517 } else { 9518 /* Clean up the fwd-tsn list */ 9519 sctp_clean_up_ctl(stcb, asoc, so_locked); 9520 return (0); 9521 } 9522 } 9523 /* 9524 * Ok, it is just data retransmission we need to do or that and a 9525 * fwd-tsn with it all. 9526 */ 9527 if (TAILQ_EMPTY(&asoc->sent_queue)) { 9528 return (SCTP_RETRAN_DONE); 9529 } 9530 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED) || 9531 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT)) { 9532 /* not yet open, resend the cookie and that is it */ 9533 return (1); 9534 } 9535 #ifdef SCTP_AUDITING_ENABLED 9536 sctp_auditing(20, inp, stcb, NULL); 9537 #endif 9538 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks); 9539 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 9540 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9541 /* No, not sent to this net or not ready for rtx */ 9542 continue; 9543 } 9544 if (chk->data == NULL) { 9545 SCTP_PRINTF("TSN:%x chk->snd_count:%d chk->sent:%d can't retran - no data\n", 9546 chk->rec.data.tsn, chk->snd_count, chk->sent); 9547 continue; 9548 } 9549 if ((SCTP_BASE_SYSCTL(sctp_max_retran_chunk)) && 9550 (chk->snd_count >= SCTP_BASE_SYSCTL(sctp_max_retran_chunk))) { 9551 struct mbuf *op_err; 9552 char msg[SCTP_DIAG_INFO_LEN]; 9553 9554 SCTP_SNPRINTF(msg, sizeof(msg), "TSN %8.8x retransmitted %d times, giving up", 9555 chk->rec.data.tsn, chk->snd_count); 9556 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 9557 msg); 9558 atomic_add_int(&stcb->asoc.refcnt, 1); 9559 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, 9560 so_locked); 9561 SCTP_TCB_LOCK(stcb); 9562 atomic_subtract_int(&stcb->asoc.refcnt, 1); 9563 return (SCTP_RETRAN_EXIT); 9564 } 9565 /* pick up the net */ 9566 net = chk->whoTo; 9567 switch (net->ro._l_addr.sa.sa_family) { 9568 #ifdef INET 9569 case AF_INET: 9570 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 9571 break; 9572 #endif 9573 #ifdef INET6 9574 case AF_INET6: 9575 mtu = net->mtu - SCTP_MIN_OVERHEAD; 9576 break; 9577 #endif 9578 default: 9579 /* TSNH */ 9580 mtu = net->mtu; 9581 break; 9582 } 9583 9584 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 9585 /* No room in peers rwnd */ 9586 uint32_t tsn; 9587 9588 tsn = asoc->last_acked_seq + 1; 9589 if (tsn == chk->rec.data.tsn) { 9590 /* 9591 * we make a special exception for this 9592 * case. The peer has no rwnd but is missing 9593 * the lowest chunk.. which is probably what 9594 * is holding up the rwnd. 9595 */ 9596 goto one_chunk_around; 9597 } 9598 return (1); 9599 } 9600 one_chunk_around: 9601 if (asoc->peers_rwnd < mtu) { 9602 one_chunk = 1; 9603 if ((asoc->peers_rwnd == 0) && 9604 (asoc->total_flight == 0)) { 9605 chk->window_probe = 1; 9606 chk->whoTo->window_probe = 1; 9607 } 9608 } 9609 #ifdef SCTP_AUDITING_ENABLED 9610 sctp_audit_log(0xC3, 2); 9611 #endif 9612 bundle_at = 0; 9613 m = NULL; 9614 net->fast_retran_ip = 0; 9615 if (chk->rec.data.doing_fast_retransmit == 0) { 9616 /* 9617 * if no FR in progress skip destination that have 9618 * flight_size > cwnd. 9619 */ 9620 if (net->flight_size >= net->cwnd) { 9621 continue; 9622 } 9623 } else { 9624 /* 9625 * Mark the destination net to have FR recovery 9626 * limits put on it. 9627 */ 9628 *fr_done = 1; 9629 net->fast_retran_ip = 1; 9630 } 9631 9632 /* 9633 * if no AUTH is yet included and this chunk requires it, 9634 * make sure to account for it. We don't apply the size 9635 * until the AUTH chunk is actually added below in case 9636 * there is no room for this chunk. 9637 */ 9638 if (data_auth_reqd && (auth == NULL)) { 9639 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9640 } else 9641 dmtu = 0; 9642 9643 if ((chk->send_size <= (mtu - dmtu)) || 9644 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 9645 /* ok we will add this one */ 9646 if (data_auth_reqd) { 9647 if (auth == NULL) { 9648 m = sctp_add_auth_chunk(m, 9649 &endofchain, 9650 &auth, 9651 &auth_offset, 9652 stcb, 9653 SCTP_DATA); 9654 auth_keyid = chk->auth_keyid; 9655 override_ok = 0; 9656 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9657 } else if (override_ok) { 9658 auth_keyid = chk->auth_keyid; 9659 override_ok = 0; 9660 } else if (chk->auth_keyid != auth_keyid) { 9661 /* different keyid, so done bundling */ 9662 break; 9663 } 9664 } 9665 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9666 if (m == NULL) { 9667 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9668 return (ENOMEM); 9669 } 9670 /* Do clear IP_DF ? */ 9671 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9672 no_fragmentflg = 0; 9673 } 9674 /* upate our MTU size */ 9675 if (mtu > (chk->send_size + dmtu)) 9676 mtu -= (chk->send_size + dmtu); 9677 else 9678 mtu = 0; 9679 data_list[bundle_at++] = chk; 9680 if (one_chunk && (asoc->total_flight <= 0)) { 9681 SCTP_STAT_INCR(sctps_windowprobed); 9682 } 9683 } 9684 if (one_chunk == 0) { 9685 /* 9686 * now are there anymore forward from chk to pick 9687 * up? 9688 */ 9689 for (fwd = TAILQ_NEXT(chk, sctp_next); fwd != NULL; fwd = TAILQ_NEXT(fwd, sctp_next)) { 9690 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 9691 /* Nope, not for retran */ 9692 continue; 9693 } 9694 if (fwd->whoTo != net) { 9695 /* Nope, not the net in question */ 9696 continue; 9697 } 9698 if (data_auth_reqd && (auth == NULL)) { 9699 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9700 } else 9701 dmtu = 0; 9702 if (fwd->send_size <= (mtu - dmtu)) { 9703 if (data_auth_reqd) { 9704 if (auth == NULL) { 9705 m = sctp_add_auth_chunk(m, 9706 &endofchain, 9707 &auth, 9708 &auth_offset, 9709 stcb, 9710 SCTP_DATA); 9711 auth_keyid = fwd->auth_keyid; 9712 override_ok = 0; 9713 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9714 } else if (override_ok) { 9715 auth_keyid = fwd->auth_keyid; 9716 override_ok = 0; 9717 } else if (fwd->auth_keyid != auth_keyid) { 9718 /* 9719 * different keyid, 9720 * so done bundling 9721 */ 9722 break; 9723 } 9724 } 9725 m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref); 9726 if (m == NULL) { 9727 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9728 return (ENOMEM); 9729 } 9730 /* Do clear IP_DF ? */ 9731 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9732 no_fragmentflg = 0; 9733 } 9734 /* upate our MTU size */ 9735 if (mtu > (fwd->send_size + dmtu)) 9736 mtu -= (fwd->send_size + dmtu); 9737 else 9738 mtu = 0; 9739 data_list[bundle_at++] = fwd; 9740 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 9741 break; 9742 } 9743 } else { 9744 /* can't fit so we are done */ 9745 break; 9746 } 9747 } 9748 } 9749 /* Is there something to send for this destination? */ 9750 if (m) { 9751 /* 9752 * No matter if we fail/or succeed we should start a 9753 * timer. A failure is like a lost IP packet :-) 9754 */ 9755 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9756 /* 9757 * no timer running on this destination 9758 * restart it. 9759 */ 9760 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9761 tmr_started = 1; 9762 } 9763 /* Now lets send it, if there is anything to send :> */ 9764 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 9765 (struct sockaddr *)&net->ro._l_addr, m, 9766 auth_offset, auth, auth_keyid, 9767 no_fragmentflg, 0, 0, 9768 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9769 net->port, NULL, 9770 0, 0, 9771 so_locked))) { 9772 /* error, we could not output */ 9773 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9774 if (error == ENOBUFS) { 9775 asoc->ifp_had_enobuf = 1; 9776 SCTP_STAT_INCR(sctps_lowlevelerr); 9777 } 9778 return (error); 9779 } else { 9780 asoc->ifp_had_enobuf = 0; 9781 } 9782 endofchain = NULL; 9783 auth = NULL; 9784 auth_offset = 0; 9785 /* For HB's */ 9786 /* 9787 * We don't want to mark the net->sent time here 9788 * since this we use this for HB and retrans cannot 9789 * measure RTT 9790 */ 9791 /* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */ 9792 9793 /* For auto-close */ 9794 cnt_thru++; 9795 if (*now_filled == 0) { 9796 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 9797 *now = asoc->time_last_sent; 9798 *now_filled = 1; 9799 } else { 9800 asoc->time_last_sent = *now; 9801 } 9802 *cnt_out += bundle_at; 9803 #ifdef SCTP_AUDITING_ENABLED 9804 sctp_audit_log(0xC4, bundle_at); 9805 #endif 9806 if (bundle_at) { 9807 tsns_sent = data_list[0]->rec.data.tsn; 9808 } 9809 for (i = 0; i < bundle_at; i++) { 9810 SCTP_STAT_INCR(sctps_sendretransdata); 9811 data_list[i]->sent = SCTP_DATAGRAM_SENT; 9812 /* 9813 * When we have a revoked data, and we 9814 * retransmit it, then we clear the revoked 9815 * flag since this flag dictates if we 9816 * subtracted from the fs 9817 */ 9818 if (data_list[i]->rec.data.chunk_was_revoked) { 9819 /* Deflate the cwnd */ 9820 data_list[i]->whoTo->cwnd -= data_list[i]->book_size; 9821 data_list[i]->rec.data.chunk_was_revoked = 0; 9822 } 9823 data_list[i]->snd_count++; 9824 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 9825 /* record the time */ 9826 data_list[i]->sent_rcv_time = asoc->time_last_sent; 9827 if (data_list[i]->book_size_scale) { 9828 /* 9829 * need to double the book size on 9830 * this one 9831 */ 9832 data_list[i]->book_size_scale = 0; 9833 /* 9834 * Since we double the booksize, we 9835 * must also double the output queue 9836 * size, since this get shrunk when 9837 * we free by this amount. 9838 */ 9839 atomic_add_int(&((asoc)->total_output_queue_size), data_list[i]->book_size); 9840 data_list[i]->book_size *= 2; 9841 9842 9843 } else { 9844 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 9845 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 9846 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 9847 } 9848 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 9849 (uint32_t)(data_list[i]->send_size + 9850 SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 9851 } 9852 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 9853 sctp_misc_ints(SCTP_FLIGHT_LOG_UP_RSND, 9854 data_list[i]->whoTo->flight_size, 9855 data_list[i]->book_size, 9856 (uint32_t)(uintptr_t)data_list[i]->whoTo, 9857 data_list[i]->rec.data.tsn); 9858 } 9859 sctp_flight_size_increase(data_list[i]); 9860 sctp_total_flight_increase(stcb, data_list[i]); 9861 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 9862 /* SWS sender side engages */ 9863 asoc->peers_rwnd = 0; 9864 } 9865 if ((i == 0) && 9866 (data_list[i]->rec.data.doing_fast_retransmit)) { 9867 SCTP_STAT_INCR(sctps_sendfastretrans); 9868 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 9869 (tmr_started == 0)) { 9870 /*- 9871 * ok we just fast-retrans'd 9872 * the lowest TSN, i.e the 9873 * first on the list. In 9874 * this case we want to give 9875 * some more time to get a 9876 * SACK back without a 9877 * t3-expiring. 9878 */ 9879 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 9880 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_2); 9881 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9882 } 9883 } 9884 } 9885 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 9886 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND); 9887 } 9888 #ifdef SCTP_AUDITING_ENABLED 9889 sctp_auditing(21, inp, stcb, NULL); 9890 #endif 9891 } else { 9892 /* None will fit */ 9893 return (1); 9894 } 9895 if (asoc->sent_queue_retran_cnt <= 0) { 9896 /* all done we have no more to retran */ 9897 asoc->sent_queue_retran_cnt = 0; 9898 break; 9899 } 9900 if (one_chunk) { 9901 /* No more room in rwnd */ 9902 return (1); 9903 } 9904 /* stop the for loop here. we sent out a packet */ 9905 break; 9906 } 9907 return (0); 9908 } 9909 9910 static void 9911 sctp_timer_validation(struct sctp_inpcb *inp, 9912 struct sctp_tcb *stcb, 9913 struct sctp_association *asoc) 9914 { 9915 struct sctp_nets *net; 9916 9917 /* Validate that a timer is running somewhere */ 9918 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 9919 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9920 /* Here is a timer */ 9921 return; 9922 } 9923 } 9924 SCTP_TCB_LOCK_ASSERT(stcb); 9925 /* Gak, we did not have a timer somewhere */ 9926 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Deadlock avoided starting timer on a dest at retran\n"); 9927 if (asoc->alternate) { 9928 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->alternate); 9929 } else { 9930 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 9931 } 9932 return; 9933 } 9934 9935 void 9936 sctp_chunk_output(struct sctp_inpcb *inp, 9937 struct sctp_tcb *stcb, 9938 int from_where, 9939 int so_locked) 9940 { 9941 /*- 9942 * Ok this is the generic chunk service queue. we must do the 9943 * following: 9944 * - See if there are retransmits pending, if so we must 9945 * do these first. 9946 * - Service the stream queue that is next, moving any 9947 * message (note I must get a complete message i.e. 9948 * FIRST/MIDDLE and LAST to the out queue in one pass) and assigning 9949 * TSN's 9950 * - Check to see if the cwnd/rwnd allows any output, if so we 9951 * go ahead and fomulate and send the low level chunks. Making sure 9952 * to combine any control in the control chunk queue also. 9953 */ 9954 struct sctp_association *asoc; 9955 struct sctp_nets *net; 9956 int error = 0, num_out, tot_out = 0, ret = 0, reason_code; 9957 unsigned int burst_cnt = 0; 9958 struct timeval now; 9959 int now_filled = 0; 9960 int nagle_on; 9961 int frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 9962 int un_sent = 0; 9963 int fr_done; 9964 unsigned int tot_frs = 0; 9965 9966 asoc = &stcb->asoc; 9967 do_it_again: 9968 /* The Nagle algorithm is only applied when handling a send call. */ 9969 if (from_where == SCTP_OUTPUT_FROM_USR_SEND) { 9970 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) { 9971 nagle_on = 0; 9972 } else { 9973 nagle_on = 1; 9974 } 9975 } else { 9976 nagle_on = 0; 9977 } 9978 SCTP_TCB_LOCK_ASSERT(stcb); 9979 9980 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 9981 9982 if ((un_sent <= 0) && 9983 (TAILQ_EMPTY(&asoc->control_send_queue)) && 9984 (TAILQ_EMPTY(&asoc->asconf_send_queue)) && 9985 (asoc->sent_queue_retran_cnt == 0) && 9986 (asoc->trigger_reset == 0)) { 9987 /* Nothing to do unless there is something to be sent left */ 9988 return; 9989 } 9990 /* 9991 * Do we have something to send, data or control AND a sack timer 9992 * running, if so piggy-back the sack. 9993 */ 9994 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 9995 sctp_send_sack(stcb, so_locked); 9996 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, 9997 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_3); 9998 } 9999 while (asoc->sent_queue_retran_cnt) { 10000 /*- 10001 * Ok, it is retransmission time only, we send out only ONE 10002 * packet with a single call off to the retran code. 10003 */ 10004 if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) { 10005 /*- 10006 * Special hook for handling cookiess discarded 10007 * by peer that carried data. Send cookie-ack only 10008 * and then the next call with get the retran's. 10009 */ 10010 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10011 from_where, 10012 &now, &now_filled, frag_point, so_locked); 10013 return; 10014 } else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) { 10015 /* if its not from a HB then do it */ 10016 fr_done = 0; 10017 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled, &fr_done, so_locked); 10018 if (fr_done) { 10019 tot_frs++; 10020 } 10021 } else { 10022 /* 10023 * its from any other place, we don't allow retran 10024 * output (only control) 10025 */ 10026 ret = 1; 10027 } 10028 if (ret > 0) { 10029 /* Can't send anymore */ 10030 /*- 10031 * now lets push out control by calling med-level 10032 * output once. this assures that we WILL send HB's 10033 * if queued too. 10034 */ 10035 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10036 from_where, 10037 &now, &now_filled, frag_point, so_locked); 10038 #ifdef SCTP_AUDITING_ENABLED 10039 sctp_auditing(8, inp, stcb, NULL); 10040 #endif 10041 sctp_timer_validation(inp, stcb, asoc); 10042 return; 10043 } 10044 if (ret < 0) { 10045 /*- 10046 * The count was off.. retran is not happening so do 10047 * the normal retransmission. 10048 */ 10049 #ifdef SCTP_AUDITING_ENABLED 10050 sctp_auditing(9, inp, stcb, NULL); 10051 #endif 10052 if (ret == SCTP_RETRAN_EXIT) { 10053 return; 10054 } 10055 break; 10056 } 10057 if (from_where == SCTP_OUTPUT_FROM_T3) { 10058 /* Only one transmission allowed out of a timeout */ 10059 #ifdef SCTP_AUDITING_ENABLED 10060 sctp_auditing(10, inp, stcb, NULL); 10061 #endif 10062 /* Push out any control */ 10063 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, from_where, 10064 &now, &now_filled, frag_point, so_locked); 10065 return; 10066 } 10067 if ((asoc->fr_max_burst > 0) && (tot_frs >= asoc->fr_max_burst)) { 10068 /* Hit FR burst limit */ 10069 return; 10070 } 10071 if ((num_out == 0) && (ret == 0)) { 10072 /* No more retrans to send */ 10073 break; 10074 } 10075 } 10076 #ifdef SCTP_AUDITING_ENABLED 10077 sctp_auditing(12, inp, stcb, NULL); 10078 #endif 10079 /* Check for bad destinations, if they exist move chunks around. */ 10080 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 10081 if (!(net->dest_state & SCTP_ADDR_REACHABLE)) { 10082 /*- 10083 * if possible move things off of this address we 10084 * still may send below due to the dormant state but 10085 * we try to find an alternate address to send to 10086 * and if we have one we move all queued data on the 10087 * out wheel to this alternate address. 10088 */ 10089 if (net->ref_count > 1) 10090 sctp_move_chunks_from_net(stcb, net); 10091 } else { 10092 /*- 10093 * if ((asoc->sat_network) || (net->addr_is_local)) 10094 * { burst_limit = asoc->max_burst * 10095 * SCTP_SAT_NETWORK_BURST_INCR; } 10096 */ 10097 if (asoc->max_burst > 0) { 10098 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst)) { 10099 if ((net->flight_size + (asoc->max_burst * net->mtu)) < net->cwnd) { 10100 /* 10101 * JRS - Use the congestion 10102 * control given in the 10103 * congestion control module 10104 */ 10105 asoc->cc_functions.sctp_cwnd_update_after_output(stcb, net, asoc->max_burst); 10106 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10107 sctp_log_maxburst(stcb, net, 0, asoc->max_burst, SCTP_MAX_BURST_APPLIED); 10108 } 10109 SCTP_STAT_INCR(sctps_maxburstqueued); 10110 } 10111 net->fast_retran_ip = 0; 10112 } else { 10113 if (net->flight_size == 0) { 10114 /* 10115 * Should be decaying the 10116 * cwnd here 10117 */ 10118 ; 10119 } 10120 } 10121 } 10122 } 10123 10124 } 10125 burst_cnt = 0; 10126 do { 10127 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 10128 &reason_code, 0, from_where, 10129 &now, &now_filled, frag_point, so_locked); 10130 if (error) { 10131 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Error %d was returned from med-c-op\n", error); 10132 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10133 sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 10134 } 10135 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10136 sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES); 10137 sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES); 10138 } 10139 break; 10140 } 10141 SCTPDBG(SCTP_DEBUG_OUTPUT3, "m-c-o put out %d\n", num_out); 10142 10143 tot_out += num_out; 10144 burst_cnt++; 10145 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10146 sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES); 10147 if (num_out == 0) { 10148 sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES); 10149 } 10150 } 10151 if (nagle_on) { 10152 /* 10153 * When the Nagle algorithm is used, look at how 10154 * much is unsent, then if its smaller than an MTU 10155 * and we have data in flight we stop, except if we 10156 * are handling a fragmented user message. 10157 */ 10158 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 10159 if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) && 10160 (stcb->asoc.total_flight > 0)) { 10161 /* && sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) {*/ 10162 break; 10163 } 10164 } 10165 if (TAILQ_EMPTY(&asoc->control_send_queue) && 10166 TAILQ_EMPTY(&asoc->send_queue) && 10167 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 10168 /* Nothing left to send */ 10169 break; 10170 } 10171 if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) { 10172 /* Nothing left to send */ 10173 break; 10174 } 10175 } while (num_out && 10176 ((asoc->max_burst == 0) || 10177 SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) || 10178 (burst_cnt < asoc->max_burst))); 10179 10180 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) == 0) { 10181 if ((asoc->max_burst > 0) && (burst_cnt >= asoc->max_burst)) { 10182 SCTP_STAT_INCR(sctps_maxburstqueued); 10183 asoc->burst_limit_applied = 1; 10184 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10185 sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED); 10186 } 10187 } else { 10188 asoc->burst_limit_applied = 0; 10189 } 10190 } 10191 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10192 sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES); 10193 } 10194 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, we have put out %d chunks\n", 10195 tot_out); 10196 10197 /*- 10198 * Now we need to clean up the control chunk chain if a ECNE is on 10199 * it. It must be marked as UNSENT again so next call will continue 10200 * to send it until such time that we get a CWR, to remove it. 10201 */ 10202 if (stcb->asoc.ecn_echo_cnt_onq) 10203 sctp_fix_ecn_echo(asoc); 10204 10205 if (stcb->asoc.trigger_reset) { 10206 if (sctp_send_stream_reset_out_if_possible(stcb, so_locked) == 0) { 10207 goto do_it_again; 10208 } 10209 } 10210 return; 10211 } 10212 10213 10214 int 10215 sctp_output( 10216 struct sctp_inpcb *inp, 10217 struct mbuf *m, 10218 struct sockaddr *addr, 10219 struct mbuf *control, 10220 struct thread *p, 10221 int flags) 10222 { 10223 if (inp == NULL) { 10224 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10225 return (EINVAL); 10226 } 10227 10228 if (inp->sctp_socket == NULL) { 10229 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10230 return (EINVAL); 10231 } 10232 return (sctp_sosend(inp->sctp_socket, 10233 addr, 10234 (struct uio *)NULL, 10235 m, 10236 control, 10237 flags, p 10238 )); 10239 } 10240 10241 void 10242 send_forward_tsn(struct sctp_tcb *stcb, 10243 struct sctp_association *asoc) 10244 { 10245 struct sctp_tmit_chunk *chk, *at, *tp1, *last; 10246 struct sctp_forward_tsn_chunk *fwdtsn; 10247 struct sctp_strseq *strseq; 10248 struct sctp_strseq_mid *strseq_m; 10249 uint32_t advance_peer_ack_point; 10250 unsigned int cnt_of_space, i, ovh; 10251 unsigned int space_needed; 10252 unsigned int cnt_of_skipped = 0; 10253 10254 SCTP_TCB_LOCK_ASSERT(stcb); 10255 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10256 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 10257 /* mark it to unsent */ 10258 chk->sent = SCTP_DATAGRAM_UNSENT; 10259 chk->snd_count = 0; 10260 /* Do we correct its output location? */ 10261 if (chk->whoTo) { 10262 sctp_free_remote_addr(chk->whoTo); 10263 chk->whoTo = NULL; 10264 } 10265 goto sctp_fill_in_rest; 10266 } 10267 } 10268 /* Ok if we reach here we must build one */ 10269 sctp_alloc_a_chunk(stcb, chk); 10270 if (chk == NULL) { 10271 return; 10272 } 10273 asoc->fwd_tsn_cnt++; 10274 chk->copy_by_ref = 0; 10275 /* 10276 * We don't do the old thing here since this is used not for on-wire 10277 * but to tell if we are sending a fwd-tsn by the stack during 10278 * output. And if its a IFORWARD or a FORWARD it is a fwd-tsn. 10279 */ 10280 chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN; 10281 chk->rec.chunk_id.can_take_data = 0; 10282 chk->flags = 0; 10283 chk->asoc = asoc; 10284 chk->whoTo = NULL; 10285 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 10286 if (chk->data == NULL) { 10287 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 10288 return; 10289 } 10290 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 10291 chk->sent = SCTP_DATAGRAM_UNSENT; 10292 chk->snd_count = 0; 10293 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 10294 asoc->ctrl_queue_cnt++; 10295 sctp_fill_in_rest: 10296 /*- 10297 * Here we go through and fill out the part that deals with 10298 * stream/seq of the ones we skip. 10299 */ 10300 SCTP_BUF_LEN(chk->data) = 0; 10301 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10302 if ((at->sent != SCTP_FORWARD_TSN_SKIP) && 10303 (at->sent != SCTP_DATAGRAM_NR_ACKED)) { 10304 /* no more to look at */ 10305 break; 10306 } 10307 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10308 /* We don't report these */ 10309 continue; 10310 } 10311 cnt_of_skipped++; 10312 } 10313 if (asoc->idata_supported) { 10314 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10315 (cnt_of_skipped * sizeof(struct sctp_strseq_mid))); 10316 } else { 10317 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10318 (cnt_of_skipped * sizeof(struct sctp_strseq))); 10319 } 10320 cnt_of_space = (unsigned int)M_TRAILINGSPACE(chk->data); 10321 10322 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 10323 ovh = SCTP_MIN_OVERHEAD; 10324 } else { 10325 ovh = SCTP_MIN_V4_OVERHEAD; 10326 } 10327 if (cnt_of_space > (asoc->smallest_mtu - ovh)) { 10328 /* trim to a mtu size */ 10329 cnt_of_space = asoc->smallest_mtu - ovh; 10330 } 10331 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10332 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10333 0xff, 0, cnt_of_skipped, 10334 asoc->advanced_peer_ack_point); 10335 } 10336 advance_peer_ack_point = asoc->advanced_peer_ack_point; 10337 if (cnt_of_space < space_needed) { 10338 /*- 10339 * ok we must trim down the chunk by lowering the 10340 * advance peer ack point. 10341 */ 10342 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10343 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10344 0xff, 0xff, cnt_of_space, 10345 space_needed); 10346 } 10347 cnt_of_skipped = cnt_of_space - sizeof(struct sctp_forward_tsn_chunk); 10348 if (asoc->idata_supported) { 10349 cnt_of_skipped /= sizeof(struct sctp_strseq_mid); 10350 } else { 10351 cnt_of_skipped /= sizeof(struct sctp_strseq); 10352 } 10353 /*- 10354 * Go through and find the TSN that will be the one 10355 * we report. 10356 */ 10357 at = TAILQ_FIRST(&asoc->sent_queue); 10358 if (at != NULL) { 10359 for (i = 0; i < cnt_of_skipped; i++) { 10360 tp1 = TAILQ_NEXT(at, sctp_next); 10361 if (tp1 == NULL) { 10362 break; 10363 } 10364 at = tp1; 10365 } 10366 } 10367 if (at && SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10368 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10369 0xff, cnt_of_skipped, at->rec.data.tsn, 10370 asoc->advanced_peer_ack_point); 10371 } 10372 last = at; 10373 /*- 10374 * last now points to last one I can report, update 10375 * peer ack point 10376 */ 10377 if (last) { 10378 advance_peer_ack_point = last->rec.data.tsn; 10379 } 10380 if (asoc->idata_supported) { 10381 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10382 cnt_of_skipped * sizeof(struct sctp_strseq_mid); 10383 } else { 10384 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10385 cnt_of_skipped * sizeof(struct sctp_strseq); 10386 } 10387 } 10388 chk->send_size = space_needed; 10389 /* Setup the chunk */ 10390 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 10391 fwdtsn->ch.chunk_length = htons(chk->send_size); 10392 fwdtsn->ch.chunk_flags = 0; 10393 if (asoc->idata_supported) { 10394 fwdtsn->ch.chunk_type = SCTP_IFORWARD_CUM_TSN; 10395 } else { 10396 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 10397 } 10398 fwdtsn->new_cumulative_tsn = htonl(advance_peer_ack_point); 10399 SCTP_BUF_LEN(chk->data) = chk->send_size; 10400 fwdtsn++; 10401 /*- 10402 * Move pointer to after the fwdtsn and transfer to the 10403 * strseq pointer. 10404 */ 10405 if (asoc->idata_supported) { 10406 strseq_m = (struct sctp_strseq_mid *)fwdtsn; 10407 strseq = NULL; 10408 } else { 10409 strseq = (struct sctp_strseq *)fwdtsn; 10410 strseq_m = NULL; 10411 } 10412 /*- 10413 * Now populate the strseq list. This is done blindly 10414 * without pulling out duplicate stream info. This is 10415 * inefficent but won't harm the process since the peer will 10416 * look at these in sequence and will thus release anything. 10417 * It could mean we exceed the PMTU and chop off some that 10418 * we could have included.. but this is unlikely (aka 1432/4 10419 * would mean 300+ stream seq's would have to be reported in 10420 * one FWD-TSN. With a bit of work we can later FIX this to 10421 * optimize and pull out duplicates.. but it does add more 10422 * overhead. So for now... not! 10423 */ 10424 i = 0; 10425 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10426 if (i >= cnt_of_skipped) { 10427 break; 10428 } 10429 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10430 /* We don't report these */ 10431 continue; 10432 } 10433 if (at->rec.data.tsn == advance_peer_ack_point) { 10434 at->rec.data.fwd_tsn_cnt = 0; 10435 } 10436 if (asoc->idata_supported) { 10437 strseq_m->sid = htons(at->rec.data.sid); 10438 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 10439 strseq_m->flags = htons(PR_SCTP_UNORDERED_FLAG); 10440 } else { 10441 strseq_m->flags = 0; 10442 } 10443 strseq_m->mid = htonl(at->rec.data.mid); 10444 strseq_m++; 10445 } else { 10446 strseq->sid = htons(at->rec.data.sid); 10447 strseq->ssn = htons((uint16_t)at->rec.data.mid); 10448 strseq++; 10449 } 10450 i++; 10451 } 10452 return; 10453 } 10454 10455 void 10456 sctp_send_sack(struct sctp_tcb *stcb, int so_locked) 10457 { 10458 /*- 10459 * Queue up a SACK or NR-SACK in the control queue. 10460 * We must first check to see if a SACK or NR-SACK is 10461 * somehow on the control queue. 10462 * If so, we will take and and remove the old one. 10463 */ 10464 struct sctp_association *asoc; 10465 struct sctp_tmit_chunk *chk, *a_chk; 10466 struct sctp_sack_chunk *sack; 10467 struct sctp_nr_sack_chunk *nr_sack; 10468 struct sctp_gap_ack_block *gap_descriptor; 10469 const struct sack_track *selector; 10470 int mergeable = 0; 10471 int offset; 10472 caddr_t limit; 10473 uint32_t *dup; 10474 int limit_reached = 0; 10475 unsigned int i, siz, j; 10476 unsigned int num_gap_blocks = 0, num_nr_gap_blocks = 0, space; 10477 int num_dups = 0; 10478 int space_req; 10479 uint32_t highest_tsn; 10480 uint8_t flags; 10481 uint8_t type; 10482 uint8_t tsn_map; 10483 10484 if (stcb->asoc.nrsack_supported == 1) { 10485 type = SCTP_NR_SELECTIVE_ACK; 10486 } else { 10487 type = SCTP_SELECTIVE_ACK; 10488 } 10489 a_chk = NULL; 10490 asoc = &stcb->asoc; 10491 SCTP_TCB_LOCK_ASSERT(stcb); 10492 if (asoc->last_data_chunk_from == NULL) { 10493 /* Hmm we never received anything */ 10494 return; 10495 } 10496 sctp_slide_mapping_arrays(stcb); 10497 sctp_set_rwnd(stcb, asoc); 10498 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10499 if (chk->rec.chunk_id.id == type) { 10500 /* Hmm, found a sack already on queue, remove it */ 10501 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 10502 asoc->ctrl_queue_cnt--; 10503 a_chk = chk; 10504 if (a_chk->data) { 10505 sctp_m_freem(a_chk->data); 10506 a_chk->data = NULL; 10507 } 10508 if (a_chk->whoTo) { 10509 sctp_free_remote_addr(a_chk->whoTo); 10510 a_chk->whoTo = NULL; 10511 } 10512 break; 10513 } 10514 } 10515 if (a_chk == NULL) { 10516 sctp_alloc_a_chunk(stcb, a_chk); 10517 if (a_chk == NULL) { 10518 /* No memory so we drop the idea, and set a timer */ 10519 if (stcb->asoc.delayed_ack) { 10520 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10521 stcb->sctp_ep, stcb, NULL, 10522 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4); 10523 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10524 stcb->sctp_ep, stcb, NULL); 10525 } else { 10526 stcb->asoc.send_sack = 1; 10527 } 10528 return; 10529 } 10530 a_chk->copy_by_ref = 0; 10531 a_chk->rec.chunk_id.id = type; 10532 a_chk->rec.chunk_id.can_take_data = 1; 10533 } 10534 /* Clear our pkt counts */ 10535 asoc->data_pkts_seen = 0; 10536 10537 a_chk->flags = 0; 10538 a_chk->asoc = asoc; 10539 a_chk->snd_count = 0; 10540 a_chk->send_size = 0; /* fill in later */ 10541 a_chk->sent = SCTP_DATAGRAM_UNSENT; 10542 a_chk->whoTo = NULL; 10543 10544 if (!(asoc->last_data_chunk_from->dest_state & SCTP_ADDR_REACHABLE)) { 10545 /*- 10546 * Ok, the destination for the SACK is unreachable, lets see if 10547 * we can select an alternate to asoc->last_data_chunk_from 10548 */ 10549 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0); 10550 if (a_chk->whoTo == NULL) { 10551 /* Nope, no alternate */ 10552 a_chk->whoTo = asoc->last_data_chunk_from; 10553 } 10554 } else { 10555 a_chk->whoTo = asoc->last_data_chunk_from; 10556 } 10557 if (a_chk->whoTo) { 10558 atomic_add_int(&a_chk->whoTo->ref_count, 1); 10559 } 10560 if (SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->highest_tsn_inside_nr_map)) { 10561 highest_tsn = asoc->highest_tsn_inside_map; 10562 } else { 10563 highest_tsn = asoc->highest_tsn_inside_nr_map; 10564 } 10565 if (highest_tsn == asoc->cumulative_tsn) { 10566 /* no gaps */ 10567 if (type == SCTP_SELECTIVE_ACK) { 10568 space_req = sizeof(struct sctp_sack_chunk); 10569 } else { 10570 space_req = sizeof(struct sctp_nr_sack_chunk); 10571 } 10572 } else { 10573 /* gaps get a cluster */ 10574 space_req = MCLBYTES; 10575 } 10576 /* Ok now lets formulate a MBUF with our sack */ 10577 a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_NOWAIT, 1, MT_DATA); 10578 if ((a_chk->data == NULL) || 10579 (a_chk->whoTo == NULL)) { 10580 /* rats, no mbuf memory */ 10581 if (a_chk->data) { 10582 /* was a problem with the destination */ 10583 sctp_m_freem(a_chk->data); 10584 a_chk->data = NULL; 10585 } 10586 sctp_free_a_chunk(stcb, a_chk, so_locked); 10587 /* sa_ignore NO_NULL_CHK */ 10588 if (stcb->asoc.delayed_ack) { 10589 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10590 stcb->sctp_ep, stcb, NULL, 10591 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5); 10592 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10593 stcb->sctp_ep, stcb, NULL); 10594 } else { 10595 stcb->asoc.send_sack = 1; 10596 } 10597 return; 10598 } 10599 /* ok, lets go through and fill it in */ 10600 SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD); 10601 space = (unsigned int)M_TRAILINGSPACE(a_chk->data); 10602 if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) { 10603 space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD); 10604 } 10605 limit = mtod(a_chk->data, caddr_t); 10606 limit += space; 10607 10608 flags = 0; 10609 10610 if ((asoc->sctp_cmt_on_off > 0) && 10611 SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) { 10612 /*- 10613 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been 10614 * received, then set high bit to 1, else 0. Reset 10615 * pkts_rcvd. 10616 */ 10617 flags |= (asoc->cmt_dac_pkts_rcvd << 6); 10618 asoc->cmt_dac_pkts_rcvd = 0; 10619 } 10620 #ifdef SCTP_ASOCLOG_OF_TSNS 10621 stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn; 10622 stcb->asoc.cumack_log_atsnt++; 10623 if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) { 10624 stcb->asoc.cumack_log_atsnt = 0; 10625 } 10626 #endif 10627 /* reset the readers interpretation */ 10628 stcb->freed_by_sorcv_sincelast = 0; 10629 10630 if (type == SCTP_SELECTIVE_ACK) { 10631 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 10632 nr_sack = NULL; 10633 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk)); 10634 if (highest_tsn > asoc->mapping_array_base_tsn) { 10635 siz = (((highest_tsn - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10636 } else { 10637 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + highest_tsn + 7) / 8; 10638 } 10639 } else { 10640 sack = NULL; 10641 nr_sack = mtod(a_chk->data, struct sctp_nr_sack_chunk *); 10642 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)nr_sack + sizeof(struct sctp_nr_sack_chunk)); 10643 if (asoc->highest_tsn_inside_map > asoc->mapping_array_base_tsn) { 10644 siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10645 } else { 10646 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_map + 7) / 8; 10647 } 10648 } 10649 10650 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10651 offset = 1; 10652 } else { 10653 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10654 } 10655 if (((type == SCTP_SELECTIVE_ACK) && 10656 SCTP_TSN_GT(highest_tsn, asoc->cumulative_tsn)) || 10657 ((type == SCTP_NR_SELECTIVE_ACK) && 10658 SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->cumulative_tsn))) { 10659 /* we have a gap .. maybe */ 10660 for (i = 0; i < siz; i++) { 10661 tsn_map = asoc->mapping_array[i]; 10662 if (type == SCTP_SELECTIVE_ACK) { 10663 tsn_map |= asoc->nr_mapping_array[i]; 10664 } 10665 if (i == 0) { 10666 /* 10667 * Clear all bits corresponding to TSNs 10668 * smaller or equal to the cumulative TSN. 10669 */ 10670 tsn_map &= (~0U << (1 - offset)); 10671 } 10672 selector = &sack_array[tsn_map]; 10673 if (mergeable && selector->right_edge) { 10674 /* 10675 * Backup, left and right edges were ok to 10676 * merge. 10677 */ 10678 num_gap_blocks--; 10679 gap_descriptor--; 10680 } 10681 if (selector->num_entries == 0) 10682 mergeable = 0; 10683 else { 10684 for (j = 0; j < selector->num_entries; j++) { 10685 if (mergeable && selector->right_edge) { 10686 /* 10687 * do a merge by NOT setting 10688 * the left side 10689 */ 10690 mergeable = 0; 10691 } else { 10692 /* 10693 * no merge, set the left 10694 * side 10695 */ 10696 mergeable = 0; 10697 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10698 } 10699 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10700 num_gap_blocks++; 10701 gap_descriptor++; 10702 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10703 /* no more room */ 10704 limit_reached = 1; 10705 break; 10706 } 10707 } 10708 if (selector->left_edge) { 10709 mergeable = 1; 10710 } 10711 } 10712 if (limit_reached) { 10713 /* Reached the limit stop */ 10714 break; 10715 } 10716 offset += 8; 10717 } 10718 } 10719 if ((type == SCTP_NR_SELECTIVE_ACK) && 10720 (limit_reached == 0)) { 10721 10722 mergeable = 0; 10723 10724 if (asoc->highest_tsn_inside_nr_map > asoc->mapping_array_base_tsn) { 10725 siz = (((asoc->highest_tsn_inside_nr_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10726 } else { 10727 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_nr_map + 7) / 8; 10728 } 10729 10730 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10731 offset = 1; 10732 } else { 10733 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10734 } 10735 if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->cumulative_tsn)) { 10736 /* we have a gap .. maybe */ 10737 for (i = 0; i < siz; i++) { 10738 tsn_map = asoc->nr_mapping_array[i]; 10739 if (i == 0) { 10740 /* 10741 * Clear all bits corresponding to 10742 * TSNs smaller or equal to the 10743 * cumulative TSN. 10744 */ 10745 tsn_map &= (~0U << (1 - offset)); 10746 } 10747 selector = &sack_array[tsn_map]; 10748 if (mergeable && selector->right_edge) { 10749 /* 10750 * Backup, left and right edges were 10751 * ok to merge. 10752 */ 10753 num_nr_gap_blocks--; 10754 gap_descriptor--; 10755 } 10756 if (selector->num_entries == 0) 10757 mergeable = 0; 10758 else { 10759 for (j = 0; j < selector->num_entries; j++) { 10760 if (mergeable && selector->right_edge) { 10761 /* 10762 * do a merge by NOT 10763 * setting the left 10764 * side 10765 */ 10766 mergeable = 0; 10767 } else { 10768 /* 10769 * no merge, set the 10770 * left side 10771 */ 10772 mergeable = 0; 10773 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10774 } 10775 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10776 num_nr_gap_blocks++; 10777 gap_descriptor++; 10778 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10779 /* no more room */ 10780 limit_reached = 1; 10781 break; 10782 } 10783 } 10784 if (selector->left_edge) { 10785 mergeable = 1; 10786 } 10787 } 10788 if (limit_reached) { 10789 /* Reached the limit stop */ 10790 break; 10791 } 10792 offset += 8; 10793 } 10794 } 10795 } 10796 /* now we must add any dups we are going to report. */ 10797 if ((limit_reached == 0) && (asoc->numduptsns)) { 10798 dup = (uint32_t *)gap_descriptor; 10799 for (i = 0; i < asoc->numduptsns; i++) { 10800 *dup = htonl(asoc->dup_tsns[i]); 10801 dup++; 10802 num_dups++; 10803 if (((caddr_t)dup + sizeof(uint32_t)) > limit) { 10804 /* no more room */ 10805 break; 10806 } 10807 } 10808 asoc->numduptsns = 0; 10809 } 10810 /* 10811 * now that the chunk is prepared queue it to the control chunk 10812 * queue. 10813 */ 10814 if (type == SCTP_SELECTIVE_ACK) { 10815 a_chk->send_size = (uint16_t)(sizeof(struct sctp_sack_chunk) + 10816 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10817 num_dups * sizeof(int32_t)); 10818 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10819 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10820 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 10821 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 10822 sack->sack.num_dup_tsns = htons(num_dups); 10823 sack->ch.chunk_type = type; 10824 sack->ch.chunk_flags = flags; 10825 sack->ch.chunk_length = htons(a_chk->send_size); 10826 } else { 10827 a_chk->send_size = (uint16_t)(sizeof(struct sctp_nr_sack_chunk) + 10828 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10829 num_dups * sizeof(int32_t)); 10830 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10831 nr_sack->nr_sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10832 nr_sack->nr_sack.a_rwnd = htonl(asoc->my_rwnd); 10833 nr_sack->nr_sack.num_gap_ack_blks = htons(num_gap_blocks); 10834 nr_sack->nr_sack.num_nr_gap_ack_blks = htons(num_nr_gap_blocks); 10835 nr_sack->nr_sack.num_dup_tsns = htons(num_dups); 10836 nr_sack->nr_sack.reserved = 0; 10837 nr_sack->ch.chunk_type = type; 10838 nr_sack->ch.chunk_flags = flags; 10839 nr_sack->ch.chunk_length = htons(a_chk->send_size); 10840 } 10841 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 10842 asoc->my_last_reported_rwnd = asoc->my_rwnd; 10843 asoc->ctrl_queue_cnt++; 10844 asoc->send_sack = 0; 10845 SCTP_STAT_INCR(sctps_sendsacks); 10846 return; 10847 } 10848 10849 void 10850 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr, int so_locked) 10851 { 10852 struct mbuf *m_abort, *m, *m_last; 10853 struct mbuf *m_out, *m_end = NULL; 10854 struct sctp_abort_chunk *abort; 10855 struct sctp_auth_chunk *auth = NULL; 10856 struct sctp_nets *net; 10857 uint32_t vtag; 10858 uint32_t auth_offset = 0; 10859 int error; 10860 uint16_t cause_len, chunk_len, padding_len; 10861 10862 SCTP_TCB_LOCK_ASSERT(stcb); 10863 /*- 10864 * Add an AUTH chunk, if chunk requires it and save the offset into 10865 * the chain for AUTH 10866 */ 10867 if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION, 10868 stcb->asoc.peer_auth_chunks)) { 10869 m_out = sctp_add_auth_chunk(NULL, &m_end, &auth, &auth_offset, 10870 stcb, SCTP_ABORT_ASSOCIATION); 10871 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10872 } else { 10873 m_out = NULL; 10874 } 10875 m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_NOWAIT, 1, MT_HEADER); 10876 if (m_abort == NULL) { 10877 if (m_out) { 10878 sctp_m_freem(m_out); 10879 } 10880 if (operr) { 10881 sctp_m_freem(operr); 10882 } 10883 return; 10884 } 10885 /* link in any error */ 10886 SCTP_BUF_NEXT(m_abort) = operr; 10887 cause_len = 0; 10888 m_last = NULL; 10889 for (m = operr; m; m = SCTP_BUF_NEXT(m)) { 10890 cause_len += (uint16_t)SCTP_BUF_LEN(m); 10891 if (SCTP_BUF_NEXT(m) == NULL) { 10892 m_last = m; 10893 } 10894 } 10895 SCTP_BUF_LEN(m_abort) = sizeof(struct sctp_abort_chunk); 10896 chunk_len = (uint16_t)sizeof(struct sctp_abort_chunk) + cause_len; 10897 padding_len = SCTP_SIZE32(chunk_len) - chunk_len; 10898 if (m_out == NULL) { 10899 /* NO Auth chunk prepended, so reserve space in front */ 10900 SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD); 10901 m_out = m_abort; 10902 } else { 10903 /* Put AUTH chunk at the front of the chain */ 10904 SCTP_BUF_NEXT(m_end) = m_abort; 10905 } 10906 if (stcb->asoc.alternate) { 10907 net = stcb->asoc.alternate; 10908 } else { 10909 net = stcb->asoc.primary_destination; 10910 } 10911 /* Fill in the ABORT chunk header. */ 10912 abort = mtod(m_abort, struct sctp_abort_chunk *); 10913 abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION; 10914 if (stcb->asoc.peer_vtag == 0) { 10915 /* This happens iff the assoc is in COOKIE-WAIT state. */ 10916 vtag = stcb->asoc.my_vtag; 10917 abort->ch.chunk_flags = SCTP_HAD_NO_TCB; 10918 } else { 10919 vtag = stcb->asoc.peer_vtag; 10920 abort->ch.chunk_flags = 0; 10921 } 10922 abort->ch.chunk_length = htons(chunk_len); 10923 /* Add padding, if necessary. */ 10924 if (padding_len > 0) { 10925 if ((m_last == NULL) || 10926 (sctp_add_pad_tombuf(m_last, padding_len) == NULL)) { 10927 sctp_m_freem(m_out); 10928 return; 10929 } 10930 } 10931 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10932 (struct sockaddr *)&net->ro._l_addr, 10933 m_out, auth_offset, auth, stcb->asoc.authinfo.active_keyid, 1, 0, 0, 10934 stcb->sctp_ep->sctp_lport, stcb->rport, htonl(vtag), 10935 stcb->asoc.primary_destination->port, NULL, 10936 0, 0, 10937 so_locked))) { 10938 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 10939 if (error == ENOBUFS) { 10940 stcb->asoc.ifp_had_enobuf = 1; 10941 SCTP_STAT_INCR(sctps_lowlevelerr); 10942 } 10943 } else { 10944 stcb->asoc.ifp_had_enobuf = 0; 10945 } 10946 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10947 } 10948 10949 void 10950 sctp_send_shutdown_complete(struct sctp_tcb *stcb, 10951 struct sctp_nets *net, 10952 int reflect_vtag) 10953 { 10954 /* formulate and SEND a SHUTDOWN-COMPLETE */ 10955 struct mbuf *m_shutdown_comp; 10956 struct sctp_shutdown_complete_chunk *shutdown_complete; 10957 uint32_t vtag; 10958 int error; 10959 uint8_t flags; 10960 10961 m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 10962 if (m_shutdown_comp == NULL) { 10963 /* no mbuf's */ 10964 return; 10965 } 10966 if (reflect_vtag) { 10967 flags = SCTP_HAD_NO_TCB; 10968 vtag = stcb->asoc.my_vtag; 10969 } else { 10970 flags = 0; 10971 vtag = stcb->asoc.peer_vtag; 10972 } 10973 shutdown_complete = mtod(m_shutdown_comp, struct sctp_shutdown_complete_chunk *); 10974 shutdown_complete->ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 10975 shutdown_complete->ch.chunk_flags = flags; 10976 shutdown_complete->ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 10977 SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_chunk); 10978 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10979 (struct sockaddr *)&net->ro._l_addr, 10980 m_shutdown_comp, 0, NULL, 0, 1, 0, 0, 10981 stcb->sctp_ep->sctp_lport, stcb->rport, 10982 htonl(vtag), 10983 net->port, NULL, 10984 0, 0, 10985 SCTP_SO_NOT_LOCKED))) { 10986 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 10987 if (error == ENOBUFS) { 10988 stcb->asoc.ifp_had_enobuf = 1; 10989 SCTP_STAT_INCR(sctps_lowlevelerr); 10990 } 10991 } else { 10992 stcb->asoc.ifp_had_enobuf = 0; 10993 } 10994 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10995 return; 10996 } 10997 10998 static void 10999 sctp_send_resp_msg(struct sockaddr *src, struct sockaddr *dst, 11000 struct sctphdr *sh, uint32_t vtag, 11001 uint8_t type, struct mbuf *cause, 11002 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11003 uint32_t vrf_id, uint16_t port) 11004 { 11005 struct mbuf *o_pak; 11006 struct mbuf *mout; 11007 struct sctphdr *shout; 11008 struct sctp_chunkhdr *ch; 11009 #if defined(INET) || defined(INET6) 11010 struct udphdr *udp; 11011 #endif 11012 int ret, len, cause_len, padding_len; 11013 #ifdef INET 11014 struct sockaddr_in *src_sin, *dst_sin; 11015 struct ip *ip; 11016 #endif 11017 #ifdef INET6 11018 struct sockaddr_in6 *src_sin6, *dst_sin6; 11019 struct ip6_hdr *ip6; 11020 #endif 11021 11022 /* Compute the length of the cause and add final padding. */ 11023 cause_len = 0; 11024 if (cause != NULL) { 11025 struct mbuf *m_at, *m_last = NULL; 11026 11027 for (m_at = cause; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 11028 if (SCTP_BUF_NEXT(m_at) == NULL) 11029 m_last = m_at; 11030 cause_len += SCTP_BUF_LEN(m_at); 11031 } 11032 padding_len = cause_len % 4; 11033 if (padding_len != 0) { 11034 padding_len = 4 - padding_len; 11035 } 11036 if (padding_len != 0) { 11037 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 11038 sctp_m_freem(cause); 11039 return; 11040 } 11041 } 11042 } else { 11043 padding_len = 0; 11044 } 11045 /* Get an mbuf for the header. */ 11046 len = sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 11047 switch (dst->sa_family) { 11048 #ifdef INET 11049 case AF_INET: 11050 len += sizeof(struct ip); 11051 break; 11052 #endif 11053 #ifdef INET6 11054 case AF_INET6: 11055 len += sizeof(struct ip6_hdr); 11056 break; 11057 #endif 11058 default: 11059 break; 11060 } 11061 #if defined(INET) || defined(INET6) 11062 if (port) { 11063 len += sizeof(struct udphdr); 11064 } 11065 #endif 11066 mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_NOWAIT, 1, MT_DATA); 11067 if (mout == NULL) { 11068 if (cause) { 11069 sctp_m_freem(cause); 11070 } 11071 return; 11072 } 11073 SCTP_BUF_RESV_UF(mout, max_linkhdr); 11074 SCTP_BUF_LEN(mout) = len; 11075 SCTP_BUF_NEXT(mout) = cause; 11076 M_SETFIB(mout, fibnum); 11077 mout->m_pkthdr.flowid = mflowid; 11078 M_HASHTYPE_SET(mout, mflowtype); 11079 #ifdef INET 11080 ip = NULL; 11081 #endif 11082 #ifdef INET6 11083 ip6 = NULL; 11084 #endif 11085 switch (dst->sa_family) { 11086 #ifdef INET 11087 case AF_INET: 11088 src_sin = (struct sockaddr_in *)src; 11089 dst_sin = (struct sockaddr_in *)dst; 11090 ip = mtod(mout, struct ip *); 11091 ip->ip_v = IPVERSION; 11092 ip->ip_hl = (sizeof(struct ip) >> 2); 11093 ip->ip_tos = 0; 11094 ip->ip_off = htons(IP_DF); 11095 ip_fillid(ip); 11096 ip->ip_ttl = MODULE_GLOBAL(ip_defttl); 11097 if (port) { 11098 ip->ip_p = IPPROTO_UDP; 11099 } else { 11100 ip->ip_p = IPPROTO_SCTP; 11101 } 11102 ip->ip_src.s_addr = dst_sin->sin_addr.s_addr; 11103 ip->ip_dst.s_addr = src_sin->sin_addr.s_addr; 11104 ip->ip_sum = 0; 11105 len = sizeof(struct ip); 11106 shout = (struct sctphdr *)((caddr_t)ip + len); 11107 break; 11108 #endif 11109 #ifdef INET6 11110 case AF_INET6: 11111 src_sin6 = (struct sockaddr_in6 *)src; 11112 dst_sin6 = (struct sockaddr_in6 *)dst; 11113 ip6 = mtod(mout, struct ip6_hdr *); 11114 ip6->ip6_flow = htonl(0x60000000); 11115 if (V_ip6_auto_flowlabel) { 11116 ip6->ip6_flow |= (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK); 11117 } 11118 ip6->ip6_hlim = MODULE_GLOBAL(ip6_defhlim); 11119 if (port) { 11120 ip6->ip6_nxt = IPPROTO_UDP; 11121 } else { 11122 ip6->ip6_nxt = IPPROTO_SCTP; 11123 } 11124 ip6->ip6_src = dst_sin6->sin6_addr; 11125 ip6->ip6_dst = src_sin6->sin6_addr; 11126 len = sizeof(struct ip6_hdr); 11127 shout = (struct sctphdr *)((caddr_t)ip6 + len); 11128 break; 11129 #endif 11130 default: 11131 len = 0; 11132 shout = mtod(mout, struct sctphdr *); 11133 break; 11134 } 11135 #if defined(INET) || defined(INET6) 11136 if (port) { 11137 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 11138 sctp_m_freem(mout); 11139 return; 11140 } 11141 udp = (struct udphdr *)shout; 11142 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 11143 udp->uh_dport = port; 11144 udp->uh_sum = 0; 11145 udp->uh_ulen = htons((uint16_t)(sizeof(struct udphdr) + 11146 sizeof(struct sctphdr) + 11147 sizeof(struct sctp_chunkhdr) + 11148 cause_len + padding_len)); 11149 len += sizeof(struct udphdr); 11150 shout = (struct sctphdr *)((caddr_t)shout + sizeof(struct udphdr)); 11151 } else { 11152 udp = NULL; 11153 } 11154 #endif 11155 shout->src_port = sh->dest_port; 11156 shout->dest_port = sh->src_port; 11157 shout->checksum = 0; 11158 if (vtag) { 11159 shout->v_tag = htonl(vtag); 11160 } else { 11161 shout->v_tag = sh->v_tag; 11162 } 11163 len += sizeof(struct sctphdr); 11164 ch = (struct sctp_chunkhdr *)((caddr_t)shout + sizeof(struct sctphdr)); 11165 ch->chunk_type = type; 11166 if (vtag) { 11167 ch->chunk_flags = 0; 11168 } else { 11169 ch->chunk_flags = SCTP_HAD_NO_TCB; 11170 } 11171 ch->chunk_length = htons((uint16_t)(sizeof(struct sctp_chunkhdr) + cause_len)); 11172 len += sizeof(struct sctp_chunkhdr); 11173 len += cause_len + padding_len; 11174 11175 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 11176 sctp_m_freem(mout); 11177 return; 11178 } 11179 SCTP_ATTACH_CHAIN(o_pak, mout, len); 11180 switch (dst->sa_family) { 11181 #ifdef INET 11182 case AF_INET: 11183 if (port) { 11184 if (V_udp_cksum) { 11185 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 11186 } else { 11187 udp->uh_sum = 0; 11188 } 11189 } 11190 ip->ip_len = htons(len); 11191 if (port) { 11192 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip) + sizeof(struct udphdr)); 11193 SCTP_STAT_INCR(sctps_sendswcrc); 11194 if (V_udp_cksum) { 11195 SCTP_ENABLE_UDP_CSUM(o_pak); 11196 } 11197 } else { 11198 mout->m_pkthdr.csum_flags = CSUM_SCTP; 11199 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11200 SCTP_STAT_INCR(sctps_sendhwcrc); 11201 } 11202 #ifdef SCTP_PACKET_LOGGING 11203 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11204 sctp_packet_log(o_pak); 11205 } 11206 #endif 11207 SCTP_PROBE5(send, NULL, NULL, ip, NULL, shout); 11208 SCTP_IP_OUTPUT(ret, o_pak, NULL, NULL, vrf_id); 11209 break; 11210 #endif 11211 #ifdef INET6 11212 case AF_INET6: 11213 ip6->ip6_plen = htons((uint16_t)(len - sizeof(struct ip6_hdr))); 11214 if (port) { 11215 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 11216 SCTP_STAT_INCR(sctps_sendswcrc); 11217 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), len - sizeof(struct ip6_hdr))) == 0) { 11218 udp->uh_sum = 0xffff; 11219 } 11220 } else { 11221 mout->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 11222 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11223 SCTP_STAT_INCR(sctps_sendhwcrc); 11224 } 11225 #ifdef SCTP_PACKET_LOGGING 11226 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11227 sctp_packet_log(o_pak); 11228 } 11229 #endif 11230 SCTP_PROBE5(send, NULL, NULL, ip6, NULL, shout); 11231 SCTP_IP6_OUTPUT(ret, o_pak, NULL, NULL, NULL, vrf_id); 11232 break; 11233 #endif 11234 default: 11235 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 11236 dst->sa_family); 11237 sctp_m_freem(mout); 11238 SCTP_LTRACE_ERR_RET_PKT(mout, NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 11239 return; 11240 } 11241 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 11242 if (port) { 11243 UDPSTAT_INC(udps_opackets); 11244 } 11245 SCTP_STAT_INCR(sctps_sendpackets); 11246 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 11247 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11248 if (ret) { 11249 SCTP_STAT_INCR(sctps_senderrors); 11250 } 11251 return; 11252 } 11253 11254 void 11255 sctp_send_shutdown_complete2(struct sockaddr *src, struct sockaddr *dst, 11256 struct sctphdr *sh, 11257 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11258 uint32_t vrf_id, uint16_t port) 11259 { 11260 sctp_send_resp_msg(src, dst, sh, 0, SCTP_SHUTDOWN_COMPLETE, NULL, 11261 mflowtype, mflowid, fibnum, 11262 vrf_id, port); 11263 } 11264 11265 void 11266 sctp_send_hb(struct sctp_tcb *stcb, struct sctp_nets *net, int so_locked) 11267 { 11268 struct sctp_tmit_chunk *chk; 11269 struct sctp_heartbeat_chunk *hb; 11270 struct timeval now; 11271 11272 SCTP_TCB_LOCK_ASSERT(stcb); 11273 if (net == NULL) { 11274 return; 11275 } 11276 (void)SCTP_GETTIME_TIMEVAL(&now); 11277 switch (net->ro._l_addr.sa.sa_family) { 11278 #ifdef INET 11279 case AF_INET: 11280 break; 11281 #endif 11282 #ifdef INET6 11283 case AF_INET6: 11284 break; 11285 #endif 11286 default: 11287 return; 11288 } 11289 sctp_alloc_a_chunk(stcb, chk); 11290 if (chk == NULL) { 11291 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak, can't get a chunk for hb\n"); 11292 return; 11293 } 11294 11295 chk->copy_by_ref = 0; 11296 chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST; 11297 chk->rec.chunk_id.can_take_data = 1; 11298 chk->flags = 0; 11299 chk->asoc = &stcb->asoc; 11300 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 11301 11302 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11303 if (chk->data == NULL) { 11304 sctp_free_a_chunk(stcb, chk, so_locked); 11305 return; 11306 } 11307 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11308 SCTP_BUF_LEN(chk->data) = chk->send_size; 11309 chk->sent = SCTP_DATAGRAM_UNSENT; 11310 chk->snd_count = 0; 11311 chk->whoTo = net; 11312 atomic_add_int(&chk->whoTo->ref_count, 1); 11313 /* Now we have a mbuf that we can fill in with the details */ 11314 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 11315 memset(hb, 0, sizeof(struct sctp_heartbeat_chunk)); 11316 /* fill out chunk header */ 11317 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 11318 hb->ch.chunk_flags = 0; 11319 hb->ch.chunk_length = htons(chk->send_size); 11320 /* Fill out hb parameter */ 11321 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 11322 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 11323 hb->heartbeat.hb_info.time_value_1 = now.tv_sec; 11324 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 11325 /* Did our user request this one, put it in */ 11326 hb->heartbeat.hb_info.addr_family = (uint8_t)net->ro._l_addr.sa.sa_family; 11327 hb->heartbeat.hb_info.addr_len = net->ro._l_addr.sa.sa_len; 11328 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 11329 /* 11330 * we only take from the entropy pool if the address is not 11331 * confirmed. 11332 */ 11333 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11334 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11335 } else { 11336 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 11337 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 11338 } 11339 switch (net->ro._l_addr.sa.sa_family) { 11340 #ifdef INET 11341 case AF_INET: 11342 memcpy(hb->heartbeat.hb_info.address, 11343 &net->ro._l_addr.sin.sin_addr, 11344 sizeof(net->ro._l_addr.sin.sin_addr)); 11345 break; 11346 #endif 11347 #ifdef INET6 11348 case AF_INET6: 11349 memcpy(hb->heartbeat.hb_info.address, 11350 &net->ro._l_addr.sin6.sin6_addr, 11351 sizeof(net->ro._l_addr.sin6.sin6_addr)); 11352 break; 11353 #endif 11354 default: 11355 if (chk->data) { 11356 sctp_m_freem(chk->data); 11357 chk->data = NULL; 11358 } 11359 sctp_free_a_chunk(stcb, chk, so_locked); 11360 return; 11361 break; 11362 } 11363 net->hb_responded = 0; 11364 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11365 stcb->asoc.ctrl_queue_cnt++; 11366 SCTP_STAT_INCR(sctps_sendheartbeat); 11367 return; 11368 } 11369 11370 void 11371 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 11372 uint32_t high_tsn) 11373 { 11374 struct sctp_association *asoc; 11375 struct sctp_ecne_chunk *ecne; 11376 struct sctp_tmit_chunk *chk; 11377 11378 if (net == NULL) { 11379 return; 11380 } 11381 asoc = &stcb->asoc; 11382 SCTP_TCB_LOCK_ASSERT(stcb); 11383 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11384 if ((chk->rec.chunk_id.id == SCTP_ECN_ECHO) && (net == chk->whoTo)) { 11385 /* found a previous ECN_ECHO update it if needed */ 11386 uint32_t cnt, ctsn; 11387 11388 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11389 ctsn = ntohl(ecne->tsn); 11390 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11391 ecne->tsn = htonl(high_tsn); 11392 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11393 } 11394 cnt = ntohl(ecne->num_pkts_since_cwr); 11395 cnt++; 11396 ecne->num_pkts_since_cwr = htonl(cnt); 11397 return; 11398 } 11399 } 11400 /* nope could not find one to update so we must build one */ 11401 sctp_alloc_a_chunk(stcb, chk); 11402 if (chk == NULL) { 11403 return; 11404 } 11405 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11406 chk->copy_by_ref = 0; 11407 chk->rec.chunk_id.id = SCTP_ECN_ECHO; 11408 chk->rec.chunk_id.can_take_data = 0; 11409 chk->flags = 0; 11410 chk->asoc = &stcb->asoc; 11411 chk->send_size = sizeof(struct sctp_ecne_chunk); 11412 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11413 if (chk->data == NULL) { 11414 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11415 return; 11416 } 11417 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11418 SCTP_BUF_LEN(chk->data) = chk->send_size; 11419 chk->sent = SCTP_DATAGRAM_UNSENT; 11420 chk->snd_count = 0; 11421 chk->whoTo = net; 11422 atomic_add_int(&chk->whoTo->ref_count, 1); 11423 11424 stcb->asoc.ecn_echo_cnt_onq++; 11425 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11426 ecne->ch.chunk_type = SCTP_ECN_ECHO; 11427 ecne->ch.chunk_flags = 0; 11428 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 11429 ecne->tsn = htonl(high_tsn); 11430 ecne->num_pkts_since_cwr = htonl(1); 11431 TAILQ_INSERT_HEAD(&stcb->asoc.control_send_queue, chk, sctp_next); 11432 asoc->ctrl_queue_cnt++; 11433 } 11434 11435 void 11436 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 11437 struct mbuf *m, int len, int iphlen, int bad_crc) 11438 { 11439 struct sctp_association *asoc; 11440 struct sctp_pktdrop_chunk *drp; 11441 struct sctp_tmit_chunk *chk; 11442 uint8_t *datap; 11443 int was_trunc = 0; 11444 int fullsz = 0; 11445 long spc; 11446 int offset; 11447 struct sctp_chunkhdr *ch, chunk_buf; 11448 unsigned int chk_length; 11449 11450 if (!stcb) { 11451 return; 11452 } 11453 asoc = &stcb->asoc; 11454 SCTP_TCB_LOCK_ASSERT(stcb); 11455 if (asoc->pktdrop_supported == 0) { 11456 /*- 11457 * peer must declare support before I send one. 11458 */ 11459 return; 11460 } 11461 if (stcb->sctp_socket == NULL) { 11462 return; 11463 } 11464 sctp_alloc_a_chunk(stcb, chk); 11465 if (chk == NULL) { 11466 return; 11467 } 11468 chk->copy_by_ref = 0; 11469 chk->rec.chunk_id.id = SCTP_PACKET_DROPPED; 11470 chk->rec.chunk_id.can_take_data = 1; 11471 chk->flags = 0; 11472 len -= iphlen; 11473 chk->send_size = len; 11474 /* Validate that we do not have an ABORT in here. */ 11475 offset = iphlen + sizeof(struct sctphdr); 11476 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11477 sizeof(*ch), (uint8_t *)&chunk_buf); 11478 while (ch != NULL) { 11479 chk_length = ntohs(ch->chunk_length); 11480 if (chk_length < sizeof(*ch)) { 11481 /* break to abort land */ 11482 break; 11483 } 11484 switch (ch->chunk_type) { 11485 case SCTP_PACKET_DROPPED: 11486 case SCTP_ABORT_ASSOCIATION: 11487 case SCTP_INITIATION_ACK: 11488 /** 11489 * We don't respond with an PKT-DROP to an ABORT 11490 * or PKT-DROP. We also do not respond to an 11491 * INIT-ACK, because we can't know if the initiation 11492 * tag is correct or not. 11493 */ 11494 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11495 return; 11496 default: 11497 break; 11498 } 11499 offset += SCTP_SIZE32(chk_length); 11500 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11501 sizeof(*ch), (uint8_t *)&chunk_buf); 11502 } 11503 11504 if ((len + SCTP_MAX_OVERHEAD + sizeof(struct sctp_pktdrop_chunk)) > 11505 min(stcb->asoc.smallest_mtu, MCLBYTES)) { 11506 /* 11507 * only send 1 mtu worth, trim off the excess on the end. 11508 */ 11509 fullsz = len; 11510 len = min(stcb->asoc.smallest_mtu, MCLBYTES) - SCTP_MAX_OVERHEAD; 11511 was_trunc = 1; 11512 } 11513 chk->asoc = &stcb->asoc; 11514 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11515 if (chk->data == NULL) { 11516 jump_out: 11517 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11518 return; 11519 } 11520 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11521 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 11522 if (drp == NULL) { 11523 sctp_m_freem(chk->data); 11524 chk->data = NULL; 11525 goto jump_out; 11526 } 11527 chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 11528 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD)); 11529 chk->book_size_scale = 0; 11530 if (was_trunc) { 11531 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 11532 drp->trunc_len = htons(fullsz); 11533 /* 11534 * Len is already adjusted to size minus overhead above take 11535 * out the pkt_drop chunk itself from it. 11536 */ 11537 chk->send_size = (uint16_t)(len - sizeof(struct sctp_pktdrop_chunk)); 11538 len = chk->send_size; 11539 } else { 11540 /* no truncation needed */ 11541 drp->ch.chunk_flags = 0; 11542 drp->trunc_len = htons(0); 11543 } 11544 if (bad_crc) { 11545 drp->ch.chunk_flags |= SCTP_BADCRC; 11546 } 11547 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 11548 SCTP_BUF_LEN(chk->data) = chk->send_size; 11549 chk->sent = SCTP_DATAGRAM_UNSENT; 11550 chk->snd_count = 0; 11551 if (net) { 11552 /* we should hit here */ 11553 chk->whoTo = net; 11554 atomic_add_int(&chk->whoTo->ref_count, 1); 11555 } else { 11556 chk->whoTo = NULL; 11557 } 11558 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 11559 drp->ch.chunk_length = htons(chk->send_size); 11560 spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket); 11561 if (spc < 0) { 11562 spc = 0; 11563 } 11564 drp->bottle_bw = htonl(spc); 11565 if (asoc->my_rwnd) { 11566 drp->current_onq = htonl(asoc->size_on_reasm_queue + 11567 asoc->size_on_all_streams + 11568 asoc->my_rwnd_control_len + 11569 stcb->sctp_socket->so_rcv.sb_cc); 11570 } else { 11571 /*- 11572 * If my rwnd is 0, possibly from mbuf depletion as well as 11573 * space used, tell the peer there is NO space aka onq == bw 11574 */ 11575 drp->current_onq = htonl(spc); 11576 } 11577 drp->reserved = 0; 11578 datap = drp->data; 11579 m_copydata(m, iphlen, len, (caddr_t)datap); 11580 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11581 asoc->ctrl_queue_cnt++; 11582 } 11583 11584 void 11585 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn, uint8_t override) 11586 { 11587 struct sctp_association *asoc; 11588 struct sctp_cwr_chunk *cwr; 11589 struct sctp_tmit_chunk *chk; 11590 11591 SCTP_TCB_LOCK_ASSERT(stcb); 11592 if (net == NULL) { 11593 return; 11594 } 11595 asoc = &stcb->asoc; 11596 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11597 if ((chk->rec.chunk_id.id == SCTP_ECN_CWR) && (net == chk->whoTo)) { 11598 /* 11599 * found a previous CWR queued to same destination 11600 * update it if needed 11601 */ 11602 uint32_t ctsn; 11603 11604 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11605 ctsn = ntohl(cwr->tsn); 11606 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11607 cwr->tsn = htonl(high_tsn); 11608 } 11609 if (override & SCTP_CWR_REDUCE_OVERRIDE) { 11610 /* Make sure override is carried */ 11611 cwr->ch.chunk_flags |= SCTP_CWR_REDUCE_OVERRIDE; 11612 } 11613 return; 11614 } 11615 } 11616 sctp_alloc_a_chunk(stcb, chk); 11617 if (chk == NULL) { 11618 return; 11619 } 11620 chk->copy_by_ref = 0; 11621 chk->rec.chunk_id.id = SCTP_ECN_CWR; 11622 chk->rec.chunk_id.can_take_data = 1; 11623 chk->flags = 0; 11624 chk->asoc = &stcb->asoc; 11625 chk->send_size = sizeof(struct sctp_cwr_chunk); 11626 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11627 if (chk->data == NULL) { 11628 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11629 return; 11630 } 11631 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11632 SCTP_BUF_LEN(chk->data) = chk->send_size; 11633 chk->sent = SCTP_DATAGRAM_UNSENT; 11634 chk->snd_count = 0; 11635 chk->whoTo = net; 11636 atomic_add_int(&chk->whoTo->ref_count, 1); 11637 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11638 cwr->ch.chunk_type = SCTP_ECN_CWR; 11639 cwr->ch.chunk_flags = override; 11640 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 11641 cwr->tsn = htonl(high_tsn); 11642 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11643 asoc->ctrl_queue_cnt++; 11644 } 11645 11646 static int 11647 sctp_add_stream_reset_out(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk, 11648 uint32_t seq, uint32_t resp_seq, uint32_t last_sent) 11649 { 11650 uint16_t len, old_len, i; 11651 struct sctp_stream_reset_out_request *req_out; 11652 struct sctp_chunkhdr *ch; 11653 int at; 11654 int number_entries = 0; 11655 11656 ch = mtod(chk->data, struct sctp_chunkhdr *); 11657 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11658 /* get to new offset for the param. */ 11659 req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len); 11660 /* now how long will this param be? */ 11661 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11662 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11663 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11664 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11665 number_entries++; 11666 } 11667 } 11668 if (number_entries == 0) { 11669 return (0); 11670 } 11671 if (number_entries == stcb->asoc.streamoutcnt) { 11672 number_entries = 0; 11673 } 11674 if (number_entries > SCTP_MAX_STREAMS_AT_ONCE_RESET) { 11675 number_entries = SCTP_MAX_STREAMS_AT_ONCE_RESET; 11676 } 11677 len = (uint16_t)(sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries)); 11678 req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST); 11679 req_out->ph.param_length = htons(len); 11680 req_out->request_seq = htonl(seq); 11681 req_out->response_seq = htonl(resp_seq); 11682 req_out->send_reset_at_tsn = htonl(last_sent); 11683 at = 0; 11684 if (number_entries) { 11685 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11686 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11687 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11688 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11689 req_out->list_of_streams[at] = htons(i); 11690 at++; 11691 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11692 if (at >= number_entries) { 11693 break; 11694 } 11695 } 11696 } 11697 } else { 11698 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11699 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11700 } 11701 } 11702 if (SCTP_SIZE32(len) > len) { 11703 /*- 11704 * Need to worry about the pad we may end up adding to the 11705 * end. This is easy since the struct is either aligned to 4 11706 * bytes or 2 bytes off. 11707 */ 11708 req_out->list_of_streams[number_entries] = 0; 11709 } 11710 /* now fix the chunk length */ 11711 ch->chunk_length = htons(len + old_len); 11712 chk->book_size = len + old_len; 11713 chk->book_size_scale = 0; 11714 chk->send_size = SCTP_SIZE32(chk->book_size); 11715 SCTP_BUF_LEN(chk->data) = chk->send_size; 11716 return (1); 11717 } 11718 11719 static void 11720 sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk, 11721 int number_entries, uint16_t *list, 11722 uint32_t seq) 11723 { 11724 uint16_t len, old_len, i; 11725 struct sctp_stream_reset_in_request *req_in; 11726 struct sctp_chunkhdr *ch; 11727 11728 ch = mtod(chk->data, struct sctp_chunkhdr *); 11729 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11730 11731 /* get to new offset for the param. */ 11732 req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len); 11733 /* now how long will this param be? */ 11734 len = (uint16_t)(sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries)); 11735 req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST); 11736 req_in->ph.param_length = htons(len); 11737 req_in->request_seq = htonl(seq); 11738 if (number_entries) { 11739 for (i = 0; i < number_entries; i++) { 11740 req_in->list_of_streams[i] = htons(list[i]); 11741 } 11742 } 11743 if (SCTP_SIZE32(len) > len) { 11744 /*- 11745 * Need to worry about the pad we may end up adding to the 11746 * end. This is easy since the struct is either aligned to 4 11747 * bytes or 2 bytes off. 11748 */ 11749 req_in->list_of_streams[number_entries] = 0; 11750 } 11751 /* now fix the chunk length */ 11752 ch->chunk_length = htons(len + old_len); 11753 chk->book_size = len + old_len; 11754 chk->book_size_scale = 0; 11755 chk->send_size = SCTP_SIZE32(chk->book_size); 11756 SCTP_BUF_LEN(chk->data) = chk->send_size; 11757 return; 11758 } 11759 11760 static void 11761 sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk, 11762 uint32_t seq) 11763 { 11764 uint16_t len, old_len; 11765 struct sctp_stream_reset_tsn_request *req_tsn; 11766 struct sctp_chunkhdr *ch; 11767 11768 ch = mtod(chk->data, struct sctp_chunkhdr *); 11769 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11770 11771 /* get to new offset for the param. */ 11772 req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len); 11773 /* now how long will this param be? */ 11774 len = sizeof(struct sctp_stream_reset_tsn_request); 11775 req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST); 11776 req_tsn->ph.param_length = htons(len); 11777 req_tsn->request_seq = htonl(seq); 11778 11779 /* now fix the chunk length */ 11780 ch->chunk_length = htons(len + old_len); 11781 chk->send_size = len + old_len; 11782 chk->book_size = SCTP_SIZE32(chk->send_size); 11783 chk->book_size_scale = 0; 11784 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11785 return; 11786 } 11787 11788 void 11789 sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk, 11790 uint32_t resp_seq, uint32_t result) 11791 { 11792 uint16_t len, old_len; 11793 struct sctp_stream_reset_response *resp; 11794 struct sctp_chunkhdr *ch; 11795 11796 ch = mtod(chk->data, struct sctp_chunkhdr *); 11797 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11798 11799 /* get to new offset for the param. */ 11800 resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len); 11801 /* now how long will this param be? */ 11802 len = sizeof(struct sctp_stream_reset_response); 11803 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11804 resp->ph.param_length = htons(len); 11805 resp->response_seq = htonl(resp_seq); 11806 resp->result = ntohl(result); 11807 11808 /* now fix the chunk length */ 11809 ch->chunk_length = htons(len + old_len); 11810 chk->book_size = len + old_len; 11811 chk->book_size_scale = 0; 11812 chk->send_size = SCTP_SIZE32(chk->book_size); 11813 SCTP_BUF_LEN(chk->data) = chk->send_size; 11814 return; 11815 } 11816 11817 void 11818 sctp_send_deferred_reset_response(struct sctp_tcb *stcb, 11819 struct sctp_stream_reset_list *ent, 11820 int response) 11821 { 11822 struct sctp_association *asoc; 11823 struct sctp_tmit_chunk *chk; 11824 struct sctp_chunkhdr *ch; 11825 11826 asoc = &stcb->asoc; 11827 11828 /* 11829 * Reset our last reset action to the new one IP -> response 11830 * (PERFORMED probably). This assures that if we fail to send, a 11831 * retran from the peer will get the new response. 11832 */ 11833 asoc->last_reset_action[0] = response; 11834 if (asoc->stream_reset_outstanding) { 11835 return; 11836 } 11837 sctp_alloc_a_chunk(stcb, chk); 11838 if (chk == NULL) { 11839 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11840 return; 11841 } 11842 chk->copy_by_ref = 0; 11843 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 11844 chk->rec.chunk_id.can_take_data = 0; 11845 chk->flags = 0; 11846 chk->asoc = &stcb->asoc; 11847 chk->book_size = sizeof(struct sctp_chunkhdr); 11848 chk->send_size = SCTP_SIZE32(chk->book_size); 11849 chk->book_size_scale = 0; 11850 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11851 if (chk->data == NULL) { 11852 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 11853 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11854 return; 11855 } 11856 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11857 /* setup chunk parameters */ 11858 chk->sent = SCTP_DATAGRAM_UNSENT; 11859 chk->snd_count = 0; 11860 if (stcb->asoc.alternate) { 11861 chk->whoTo = stcb->asoc.alternate; 11862 } else { 11863 chk->whoTo = stcb->asoc.primary_destination; 11864 } 11865 ch = mtod(chk->data, struct sctp_chunkhdr *); 11866 ch->chunk_type = SCTP_STREAM_RESET; 11867 ch->chunk_flags = 0; 11868 ch->chunk_length = htons(chk->book_size); 11869 atomic_add_int(&chk->whoTo->ref_count, 1); 11870 SCTP_BUF_LEN(chk->data) = chk->send_size; 11871 sctp_add_stream_reset_result(chk, ent->seq, response); 11872 /* insert the chunk for sending */ 11873 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 11874 chk, 11875 sctp_next); 11876 asoc->ctrl_queue_cnt++; 11877 } 11878 11879 void 11880 sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk, 11881 uint32_t resp_seq, uint32_t result, 11882 uint32_t send_una, uint32_t recv_next) 11883 { 11884 uint16_t len, old_len; 11885 struct sctp_stream_reset_response_tsn *resp; 11886 struct sctp_chunkhdr *ch; 11887 11888 ch = mtod(chk->data, struct sctp_chunkhdr *); 11889 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11890 11891 /* get to new offset for the param. */ 11892 resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len); 11893 /* now how long will this param be? */ 11894 len = sizeof(struct sctp_stream_reset_response_tsn); 11895 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11896 resp->ph.param_length = htons(len); 11897 resp->response_seq = htonl(resp_seq); 11898 resp->result = htonl(result); 11899 resp->senders_next_tsn = htonl(send_una); 11900 resp->receivers_next_tsn = htonl(recv_next); 11901 11902 /* now fix the chunk length */ 11903 ch->chunk_length = htons(len + old_len); 11904 chk->book_size = len + old_len; 11905 chk->send_size = SCTP_SIZE32(chk->book_size); 11906 chk->book_size_scale = 0; 11907 SCTP_BUF_LEN(chk->data) = chk->send_size; 11908 return; 11909 } 11910 11911 static void 11912 sctp_add_an_out_stream(struct sctp_tmit_chunk *chk, 11913 uint32_t seq, 11914 uint16_t adding) 11915 { 11916 uint16_t len, old_len; 11917 struct sctp_chunkhdr *ch; 11918 struct sctp_stream_reset_add_strm *addstr; 11919 11920 ch = mtod(chk->data, struct sctp_chunkhdr *); 11921 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11922 11923 /* get to new offset for the param. */ 11924 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11925 /* now how long will this param be? */ 11926 len = sizeof(struct sctp_stream_reset_add_strm); 11927 11928 /* Fill it out. */ 11929 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_OUT_STREAMS); 11930 addstr->ph.param_length = htons(len); 11931 addstr->request_seq = htonl(seq); 11932 addstr->number_of_streams = htons(adding); 11933 addstr->reserved = 0; 11934 11935 /* now fix the chunk length */ 11936 ch->chunk_length = htons(len + old_len); 11937 chk->send_size = len + old_len; 11938 chk->book_size = SCTP_SIZE32(chk->send_size); 11939 chk->book_size_scale = 0; 11940 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11941 return; 11942 } 11943 11944 static void 11945 sctp_add_an_in_stream(struct sctp_tmit_chunk *chk, 11946 uint32_t seq, 11947 uint16_t adding) 11948 { 11949 uint16_t len, old_len; 11950 struct sctp_chunkhdr *ch; 11951 struct sctp_stream_reset_add_strm *addstr; 11952 11953 ch = mtod(chk->data, struct sctp_chunkhdr *); 11954 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11955 11956 /* get to new offset for the param. */ 11957 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11958 /* now how long will this param be? */ 11959 len = sizeof(struct sctp_stream_reset_add_strm); 11960 /* Fill it out. */ 11961 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_IN_STREAMS); 11962 addstr->ph.param_length = htons(len); 11963 addstr->request_seq = htonl(seq); 11964 addstr->number_of_streams = htons(adding); 11965 addstr->reserved = 0; 11966 11967 /* now fix the chunk length */ 11968 ch->chunk_length = htons(len + old_len); 11969 chk->send_size = len + old_len; 11970 chk->book_size = SCTP_SIZE32(chk->send_size); 11971 chk->book_size_scale = 0; 11972 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11973 return; 11974 } 11975 11976 int 11977 sctp_send_stream_reset_out_if_possible(struct sctp_tcb *stcb, int so_locked) 11978 { 11979 struct sctp_association *asoc; 11980 struct sctp_tmit_chunk *chk; 11981 struct sctp_chunkhdr *ch; 11982 uint32_t seq; 11983 11984 asoc = &stcb->asoc; 11985 asoc->trigger_reset = 0; 11986 if (asoc->stream_reset_outstanding) { 11987 return (EALREADY); 11988 } 11989 sctp_alloc_a_chunk(stcb, chk); 11990 if (chk == NULL) { 11991 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11992 return (ENOMEM); 11993 } 11994 chk->copy_by_ref = 0; 11995 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 11996 chk->rec.chunk_id.can_take_data = 0; 11997 chk->flags = 0; 11998 chk->asoc = &stcb->asoc; 11999 chk->book_size = sizeof(struct sctp_chunkhdr); 12000 chk->send_size = SCTP_SIZE32(chk->book_size); 12001 chk->book_size_scale = 0; 12002 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12003 if (chk->data == NULL) { 12004 sctp_free_a_chunk(stcb, chk, so_locked); 12005 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12006 return (ENOMEM); 12007 } 12008 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12009 12010 /* setup chunk parameters */ 12011 chk->sent = SCTP_DATAGRAM_UNSENT; 12012 chk->snd_count = 0; 12013 if (stcb->asoc.alternate) { 12014 chk->whoTo = stcb->asoc.alternate; 12015 } else { 12016 chk->whoTo = stcb->asoc.primary_destination; 12017 } 12018 ch = mtod(chk->data, struct sctp_chunkhdr *); 12019 ch->chunk_type = SCTP_STREAM_RESET; 12020 ch->chunk_flags = 0; 12021 ch->chunk_length = htons(chk->book_size); 12022 atomic_add_int(&chk->whoTo->ref_count, 1); 12023 SCTP_BUF_LEN(chk->data) = chk->send_size; 12024 seq = stcb->asoc.str_reset_seq_out; 12025 if (sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1))) { 12026 seq++; 12027 asoc->stream_reset_outstanding++; 12028 } else { 12029 m_freem(chk->data); 12030 chk->data = NULL; 12031 sctp_free_a_chunk(stcb, chk, so_locked); 12032 return (ENOENT); 12033 } 12034 asoc->str_reset = chk; 12035 /* insert the chunk for sending */ 12036 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12037 chk, 12038 sctp_next); 12039 asoc->ctrl_queue_cnt++; 12040 12041 if (stcb->asoc.send_sack) { 12042 sctp_send_sack(stcb, so_locked); 12043 } 12044 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12045 return (0); 12046 } 12047 12048 int 12049 sctp_send_str_reset_req(struct sctp_tcb *stcb, 12050 uint16_t number_entries, uint16_t *list, 12051 uint8_t send_in_req, 12052 uint8_t send_tsn_req, 12053 uint8_t add_stream, 12054 uint16_t adding_o, 12055 uint16_t adding_i, uint8_t peer_asked) 12056 { 12057 struct sctp_association *asoc; 12058 struct sctp_tmit_chunk *chk; 12059 struct sctp_chunkhdr *ch; 12060 int can_send_out_req = 0; 12061 uint32_t seq; 12062 12063 asoc = &stcb->asoc; 12064 if (asoc->stream_reset_outstanding) { 12065 /*- 12066 * Already one pending, must get ACK back to clear the flag. 12067 */ 12068 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EBUSY); 12069 return (EBUSY); 12070 } 12071 if ((send_in_req == 0) && (send_tsn_req == 0) && 12072 (add_stream == 0)) { 12073 /* nothing to do */ 12074 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12075 return (EINVAL); 12076 } 12077 if (send_tsn_req && send_in_req) { 12078 /* error, can't do that */ 12079 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12080 return (EINVAL); 12081 } else if (send_in_req) { 12082 can_send_out_req = 1; 12083 } 12084 if (number_entries > (MCLBYTES - 12085 SCTP_MIN_OVERHEAD - 12086 sizeof(struct sctp_chunkhdr) - 12087 sizeof(struct sctp_stream_reset_out_request)) / 12088 sizeof(uint16_t)) { 12089 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12090 return (ENOMEM); 12091 } 12092 sctp_alloc_a_chunk(stcb, chk); 12093 if (chk == NULL) { 12094 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12095 return (ENOMEM); 12096 } 12097 chk->copy_by_ref = 0; 12098 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12099 chk->rec.chunk_id.can_take_data = 0; 12100 chk->flags = 0; 12101 chk->asoc = &stcb->asoc; 12102 chk->book_size = sizeof(struct sctp_chunkhdr); 12103 chk->send_size = SCTP_SIZE32(chk->book_size); 12104 chk->book_size_scale = 0; 12105 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12106 if (chk->data == NULL) { 12107 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 12108 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12109 return (ENOMEM); 12110 } 12111 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12112 12113 /* setup chunk parameters */ 12114 chk->sent = SCTP_DATAGRAM_UNSENT; 12115 chk->snd_count = 0; 12116 if (stcb->asoc.alternate) { 12117 chk->whoTo = stcb->asoc.alternate; 12118 } else { 12119 chk->whoTo = stcb->asoc.primary_destination; 12120 } 12121 atomic_add_int(&chk->whoTo->ref_count, 1); 12122 ch = mtod(chk->data, struct sctp_chunkhdr *); 12123 ch->chunk_type = SCTP_STREAM_RESET; 12124 ch->chunk_flags = 0; 12125 ch->chunk_length = htons(chk->book_size); 12126 SCTP_BUF_LEN(chk->data) = chk->send_size; 12127 12128 seq = stcb->asoc.str_reset_seq_out; 12129 if (can_send_out_req) { 12130 int ret; 12131 12132 ret = sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1)); 12133 if (ret) { 12134 seq++; 12135 asoc->stream_reset_outstanding++; 12136 } 12137 } 12138 if ((add_stream & 1) && 12139 ((stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt) < adding_o)) { 12140 /* Need to allocate more */ 12141 struct sctp_stream_out *oldstream; 12142 struct sctp_stream_queue_pending *sp, *nsp; 12143 int i; 12144 #if defined(SCTP_DETAILED_STR_STATS) 12145 int j; 12146 #endif 12147 12148 oldstream = stcb->asoc.strmout; 12149 /* get some more */ 12150 SCTP_MALLOC(stcb->asoc.strmout, struct sctp_stream_out *, 12151 (stcb->asoc.streamoutcnt + adding_o) * sizeof(struct sctp_stream_out), 12152 SCTP_M_STRMO); 12153 if (stcb->asoc.strmout == NULL) { 12154 uint8_t x; 12155 12156 stcb->asoc.strmout = oldstream; 12157 /* Turn off the bit */ 12158 x = add_stream & 0xfe; 12159 add_stream = x; 12160 goto skip_stuff; 12161 } 12162 /* 12163 * Ok now we proceed with copying the old out stuff and 12164 * initializing the new stuff. 12165 */ 12166 SCTP_TCB_SEND_LOCK(stcb); 12167 stcb->asoc.ss_functions.sctp_ss_clear(stcb, &stcb->asoc, 0, 1); 12168 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 12169 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12170 stcb->asoc.strmout[i].chunks_on_queues = oldstream[i].chunks_on_queues; 12171 stcb->asoc.strmout[i].next_mid_ordered = oldstream[i].next_mid_ordered; 12172 stcb->asoc.strmout[i].next_mid_unordered = oldstream[i].next_mid_unordered; 12173 stcb->asoc.strmout[i].last_msg_incomplete = oldstream[i].last_msg_incomplete; 12174 stcb->asoc.strmout[i].sid = i; 12175 stcb->asoc.strmout[i].state = oldstream[i].state; 12176 /* FIX ME FIX ME */ 12177 /* 12178 * This should be a SS_COPY operation FIX ME STREAM 12179 * SCHEDULER EXPERT 12180 */ 12181 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], &oldstream[i]); 12182 /* now anything on those queues? */ 12183 TAILQ_FOREACH_SAFE(sp, &oldstream[i].outqueue, next, nsp) { 12184 TAILQ_REMOVE(&oldstream[i].outqueue, sp, next); 12185 TAILQ_INSERT_TAIL(&stcb->asoc.strmout[i].outqueue, sp, next); 12186 } 12187 12188 } 12189 /* now the new streams */ 12190 stcb->asoc.ss_functions.sctp_ss_init(stcb, &stcb->asoc, 1); 12191 for (i = stcb->asoc.streamoutcnt; i < (stcb->asoc.streamoutcnt + adding_o); i++) { 12192 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12193 stcb->asoc.strmout[i].chunks_on_queues = 0; 12194 #if defined(SCTP_DETAILED_STR_STATS) 12195 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 12196 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 12197 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 12198 } 12199 #else 12200 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 12201 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 12202 #endif 12203 stcb->asoc.strmout[i].next_mid_ordered = 0; 12204 stcb->asoc.strmout[i].next_mid_unordered = 0; 12205 stcb->asoc.strmout[i].sid = i; 12206 stcb->asoc.strmout[i].last_msg_incomplete = 0; 12207 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 12208 stcb->asoc.strmout[i].state = SCTP_STREAM_CLOSED; 12209 } 12210 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt + adding_o; 12211 SCTP_FREE(oldstream, SCTP_M_STRMO); 12212 SCTP_TCB_SEND_UNLOCK(stcb); 12213 } 12214 skip_stuff: 12215 if ((add_stream & 1) && (adding_o > 0)) { 12216 asoc->strm_pending_add_size = adding_o; 12217 asoc->peer_req_out = peer_asked; 12218 sctp_add_an_out_stream(chk, seq, adding_o); 12219 seq++; 12220 asoc->stream_reset_outstanding++; 12221 } 12222 if ((add_stream & 2) && (adding_i > 0)) { 12223 sctp_add_an_in_stream(chk, seq, adding_i); 12224 seq++; 12225 asoc->stream_reset_outstanding++; 12226 } 12227 if (send_in_req) { 12228 sctp_add_stream_reset_in(chk, number_entries, list, seq); 12229 seq++; 12230 asoc->stream_reset_outstanding++; 12231 } 12232 if (send_tsn_req) { 12233 sctp_add_stream_reset_tsn(chk, seq); 12234 asoc->stream_reset_outstanding++; 12235 } 12236 asoc->str_reset = chk; 12237 /* insert the chunk for sending */ 12238 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12239 chk, 12240 sctp_next); 12241 asoc->ctrl_queue_cnt++; 12242 if (stcb->asoc.send_sack) { 12243 sctp_send_sack(stcb, SCTP_SO_LOCKED); 12244 } 12245 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12246 return (0); 12247 } 12248 12249 void 12250 sctp_send_abort(struct mbuf *m, int iphlen, struct sockaddr *src, struct sockaddr *dst, 12251 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12252 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12253 uint32_t vrf_id, uint16_t port) 12254 { 12255 /* Don't respond to an ABORT with an ABORT. */ 12256 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 12257 if (cause) 12258 sctp_m_freem(cause); 12259 return; 12260 } 12261 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_ABORT_ASSOCIATION, cause, 12262 mflowtype, mflowid, fibnum, 12263 vrf_id, port); 12264 return; 12265 } 12266 12267 void 12268 sctp_send_operr_to(struct sockaddr *src, struct sockaddr *dst, 12269 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12270 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12271 uint32_t vrf_id, uint16_t port) 12272 { 12273 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_OPERATION_ERROR, cause, 12274 mflowtype, mflowid, fibnum, 12275 vrf_id, port); 12276 return; 12277 } 12278 12279 static struct mbuf * 12280 sctp_copy_resume(struct uio *uio, 12281 int max_send_len, 12282 int user_marks_eor, 12283 int *error, 12284 uint32_t *sndout, 12285 struct mbuf **new_tail) 12286 { 12287 struct mbuf *m; 12288 12289 m = m_uiotombuf(uio, M_WAITOK, max_send_len, 0, 12290 (M_PKTHDR | (user_marks_eor ? M_EOR : 0))); 12291 if (m == NULL) { 12292 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12293 *error = ENOBUFS; 12294 } else { 12295 *sndout = m_length(m, NULL); 12296 *new_tail = m_last(m); 12297 } 12298 return (m); 12299 } 12300 12301 static int 12302 sctp_copy_one(struct sctp_stream_queue_pending *sp, 12303 struct uio *uio, 12304 int resv_upfront) 12305 { 12306 sp->data = m_uiotombuf(uio, M_WAITOK, sp->length, 12307 resv_upfront, 0); 12308 if (sp->data == NULL) { 12309 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12310 return (ENOBUFS); 12311 } 12312 12313 sp->tail_mbuf = m_last(sp->data); 12314 return (0); 12315 } 12316 12317 12318 12319 static struct sctp_stream_queue_pending * 12320 sctp_copy_it_in(struct sctp_tcb *stcb, 12321 struct sctp_association *asoc, 12322 struct sctp_sndrcvinfo *srcv, 12323 struct uio *uio, 12324 struct sctp_nets *net, 12325 ssize_t max_send_len, 12326 int user_marks_eor, 12327 int *error) 12328 { 12329 12330 /*- 12331 * This routine must be very careful in its work. Protocol 12332 * processing is up and running so care must be taken to spl...() 12333 * when you need to do something that may effect the stcb/asoc. The 12334 * sb is locked however. When data is copied the protocol processing 12335 * should be enabled since this is a slower operation... 12336 */ 12337 struct sctp_stream_queue_pending *sp = NULL; 12338 int resv_in_first; 12339 12340 *error = 0; 12341 /* Now can we send this? */ 12342 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 12343 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12344 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12345 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12346 /* got data while shutting down */ 12347 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12348 *error = ECONNRESET; 12349 goto out_now; 12350 } 12351 sctp_alloc_a_strmoq(stcb, sp); 12352 if (sp == NULL) { 12353 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12354 *error = ENOMEM; 12355 goto out_now; 12356 } 12357 sp->act_flags = 0; 12358 sp->sender_all_done = 0; 12359 sp->sinfo_flags = srcv->sinfo_flags; 12360 sp->timetolive = srcv->sinfo_timetolive; 12361 sp->ppid = srcv->sinfo_ppid; 12362 sp->context = srcv->sinfo_context; 12363 sp->fsn = 0; 12364 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 12365 12366 sp->sid = srcv->sinfo_stream; 12367 sp->length = (uint32_t)min(uio->uio_resid, max_send_len); 12368 if ((sp->length == (uint32_t)uio->uio_resid) && 12369 ((user_marks_eor == 0) || 12370 (srcv->sinfo_flags & SCTP_EOF) || 12371 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 12372 sp->msg_is_complete = 1; 12373 } else { 12374 sp->msg_is_complete = 0; 12375 } 12376 sp->sender_all_done = 0; 12377 sp->some_taken = 0; 12378 sp->put_last_out = 0; 12379 resv_in_first = SCTP_DATA_CHUNK_OVERHEAD(stcb); 12380 sp->data = sp->tail_mbuf = NULL; 12381 if (sp->length == 0) { 12382 goto skip_copy; 12383 } 12384 if (srcv->sinfo_keynumber_valid) { 12385 sp->auth_keyid = srcv->sinfo_keynumber; 12386 } else { 12387 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 12388 } 12389 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 12390 sctp_auth_key_acquire(stcb, sp->auth_keyid); 12391 sp->holds_key_ref = 1; 12392 } 12393 *error = sctp_copy_one(sp, uio, resv_in_first); 12394 skip_copy: 12395 if (*error) { 12396 sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); 12397 sp = NULL; 12398 } else { 12399 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 12400 sp->net = net; 12401 atomic_add_int(&sp->net->ref_count, 1); 12402 } else { 12403 sp->net = NULL; 12404 } 12405 sctp_set_prsctp_policy(sp); 12406 } 12407 out_now: 12408 return (sp); 12409 } 12410 12411 12412 int 12413 sctp_sosend(struct socket *so, 12414 struct sockaddr *addr, 12415 struct uio *uio, 12416 struct mbuf *top, 12417 struct mbuf *control, 12418 int flags, 12419 struct thread *p 12420 ) 12421 { 12422 int error, use_sndinfo = 0; 12423 struct sctp_sndrcvinfo sndrcvninfo; 12424 struct sockaddr *addr_to_use; 12425 #if defined(INET) && defined(INET6) 12426 struct sockaddr_in sin; 12427 #endif 12428 12429 if (control) { 12430 /* process cmsg snd/rcv info (maybe a assoc-id) */ 12431 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&sndrcvninfo, control, 12432 sizeof(sndrcvninfo))) { 12433 /* got one */ 12434 use_sndinfo = 1; 12435 } 12436 } 12437 addr_to_use = addr; 12438 #if defined(INET) && defined(INET6) 12439 if ((addr) && (addr->sa_family == AF_INET6)) { 12440 struct sockaddr_in6 *sin6; 12441 12442 sin6 = (struct sockaddr_in6 *)addr; 12443 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 12444 in6_sin6_2_sin(&sin, sin6); 12445 addr_to_use = (struct sockaddr *)&sin; 12446 } 12447 } 12448 #endif 12449 error = sctp_lower_sosend(so, addr_to_use, uio, top, 12450 control, 12451 flags, 12452 use_sndinfo ? &sndrcvninfo : NULL 12453 ,p 12454 ); 12455 return (error); 12456 } 12457 12458 12459 int 12460 sctp_lower_sosend(struct socket *so, 12461 struct sockaddr *addr, 12462 struct uio *uio, 12463 struct mbuf *i_pak, 12464 struct mbuf *control, 12465 int flags, 12466 struct sctp_sndrcvinfo *srcv 12467 , 12468 struct thread *p 12469 ) 12470 { 12471 struct epoch_tracker et; 12472 ssize_t sndlen = 0, max_len, local_add_more; 12473 int error, len; 12474 struct mbuf *top = NULL; 12475 int queue_only = 0, queue_only_for_init = 0; 12476 int free_cnt_applied = 0; 12477 int un_sent; 12478 int now_filled = 0; 12479 unsigned int inqueue_bytes = 0; 12480 struct sctp_block_entry be; 12481 struct sctp_inpcb *inp; 12482 struct sctp_tcb *stcb = NULL; 12483 struct timeval now; 12484 struct sctp_nets *net; 12485 struct sctp_association *asoc; 12486 struct sctp_inpcb *t_inp; 12487 int user_marks_eor; 12488 int create_lock_applied = 0; 12489 int nagle_applies = 0; 12490 int some_on_control = 0; 12491 int got_all_of_the_send = 0; 12492 int hold_tcblock = 0; 12493 int non_blocking = 0; 12494 ssize_t local_soresv = 0; 12495 uint16_t port; 12496 uint16_t sinfo_flags; 12497 sctp_assoc_t sinfo_assoc_id; 12498 12499 error = 0; 12500 net = NULL; 12501 stcb = NULL; 12502 asoc = NULL; 12503 12504 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 12505 if (inp == NULL) { 12506 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12507 error = EINVAL; 12508 if (i_pak) { 12509 SCTP_RELEASE_PKT(i_pak); 12510 } 12511 return (error); 12512 } 12513 if ((uio == NULL) && (i_pak == NULL)) { 12514 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12515 return (EINVAL); 12516 } 12517 user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 12518 atomic_add_int(&inp->total_sends, 1); 12519 if (uio) { 12520 if (uio->uio_resid < 0) { 12521 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12522 return (EINVAL); 12523 } 12524 sndlen = uio->uio_resid; 12525 } else { 12526 top = SCTP_HEADER_TO_CHAIN(i_pak); 12527 sndlen = SCTP_HEADER_LEN(i_pak); 12528 } 12529 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %zd\n", 12530 (void *)addr, 12531 sndlen); 12532 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 12533 SCTP_IS_LISTENING(inp)) { 12534 /* The listener can NOT send */ 12535 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12536 error = ENOTCONN; 12537 goto out_unlocked; 12538 } 12539 /** 12540 * Pre-screen address, if one is given the sin-len 12541 * must be set correctly! 12542 */ 12543 if (addr) { 12544 union sctp_sockstore *raddr = (union sctp_sockstore *)addr; 12545 12546 switch (raddr->sa.sa_family) { 12547 #ifdef INET 12548 case AF_INET: 12549 if (raddr->sin.sin_len != sizeof(struct sockaddr_in)) { 12550 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12551 error = EINVAL; 12552 goto out_unlocked; 12553 } 12554 port = raddr->sin.sin_port; 12555 break; 12556 #endif 12557 #ifdef INET6 12558 case AF_INET6: 12559 if (raddr->sin6.sin6_len != sizeof(struct sockaddr_in6)) { 12560 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12561 error = EINVAL; 12562 goto out_unlocked; 12563 } 12564 port = raddr->sin6.sin6_port; 12565 break; 12566 #endif 12567 default: 12568 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAFNOSUPPORT); 12569 error = EAFNOSUPPORT; 12570 goto out_unlocked; 12571 } 12572 } else 12573 port = 0; 12574 12575 if (srcv) { 12576 sinfo_flags = srcv->sinfo_flags; 12577 sinfo_assoc_id = srcv->sinfo_assoc_id; 12578 if (INVALID_SINFO_FLAG(sinfo_flags) || 12579 PR_SCTP_INVALID_POLICY(sinfo_flags)) { 12580 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12581 error = EINVAL; 12582 goto out_unlocked; 12583 } 12584 if (srcv->sinfo_flags) 12585 SCTP_STAT_INCR(sctps_sends_with_flags); 12586 } else { 12587 sinfo_flags = inp->def_send.sinfo_flags; 12588 sinfo_assoc_id = inp->def_send.sinfo_assoc_id; 12589 } 12590 if (flags & MSG_EOR) { 12591 sinfo_flags |= SCTP_EOR; 12592 } 12593 if (flags & MSG_EOF) { 12594 sinfo_flags |= SCTP_EOF; 12595 } 12596 if (sinfo_flags & SCTP_SENDALL) { 12597 /* its a sendall */ 12598 error = sctp_sendall(inp, uio, top, srcv); 12599 top = NULL; 12600 goto out_unlocked; 12601 } 12602 if ((sinfo_flags & SCTP_ADDR_OVER) && (addr == NULL)) { 12603 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12604 error = EINVAL; 12605 goto out_unlocked; 12606 } 12607 /* now we must find the assoc */ 12608 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) || 12609 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 12610 SCTP_INP_RLOCK(inp); 12611 stcb = LIST_FIRST(&inp->sctp_asoc_list); 12612 if (stcb) { 12613 SCTP_TCB_LOCK(stcb); 12614 hold_tcblock = 1; 12615 } 12616 SCTP_INP_RUNLOCK(inp); 12617 } else if (sinfo_assoc_id) { 12618 stcb = sctp_findassociation_ep_asocid(inp, sinfo_assoc_id, 1); 12619 if (stcb != NULL) { 12620 hold_tcblock = 1; 12621 } 12622 } else if (addr) { 12623 /*- 12624 * Since we did not use findep we must 12625 * increment it, and if we don't find a tcb 12626 * decrement it. 12627 */ 12628 SCTP_INP_WLOCK(inp); 12629 SCTP_INP_INCR_REF(inp); 12630 SCTP_INP_WUNLOCK(inp); 12631 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12632 if (stcb == NULL) { 12633 SCTP_INP_WLOCK(inp); 12634 SCTP_INP_DECR_REF(inp); 12635 SCTP_INP_WUNLOCK(inp); 12636 } else { 12637 hold_tcblock = 1; 12638 } 12639 } 12640 if ((stcb == NULL) && (addr)) { 12641 /* Possible implicit send? */ 12642 SCTP_ASOC_CREATE_LOCK(inp); 12643 create_lock_applied = 1; 12644 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 12645 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 12646 /* Should I really unlock ? */ 12647 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12648 error = EINVAL; 12649 goto out_unlocked; 12650 12651 } 12652 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 12653 (addr->sa_family == AF_INET6)) { 12654 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12655 error = EINVAL; 12656 goto out_unlocked; 12657 } 12658 SCTP_INP_WLOCK(inp); 12659 SCTP_INP_INCR_REF(inp); 12660 SCTP_INP_WUNLOCK(inp); 12661 /* With the lock applied look again */ 12662 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12663 #if defined(INET) || defined(INET6) 12664 if ((stcb == NULL) && (control != NULL) && (port > 0)) { 12665 stcb = sctp_findassociation_cmsgs(&t_inp, port, control, &net, &error); 12666 } 12667 #endif 12668 if (stcb == NULL) { 12669 SCTP_INP_WLOCK(inp); 12670 SCTP_INP_DECR_REF(inp); 12671 SCTP_INP_WUNLOCK(inp); 12672 } else { 12673 hold_tcblock = 1; 12674 } 12675 if (error) { 12676 goto out_unlocked; 12677 } 12678 if (t_inp != inp) { 12679 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12680 error = ENOTCONN; 12681 goto out_unlocked; 12682 } 12683 } 12684 if (stcb == NULL) { 12685 if (addr == NULL) { 12686 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12687 error = ENOENT; 12688 goto out_unlocked; 12689 } else { 12690 /* We must go ahead and start the INIT process */ 12691 uint32_t vrf_id; 12692 12693 if ((sinfo_flags & SCTP_ABORT) || 12694 ((sinfo_flags & SCTP_EOF) && (sndlen == 0))) { 12695 /*- 12696 * User asks to abort a non-existant assoc, 12697 * or EOF a non-existant assoc with no data 12698 */ 12699 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12700 error = ENOENT; 12701 goto out_unlocked; 12702 } 12703 /* get an asoc/stcb struct */ 12704 vrf_id = inp->def_vrf_id; 12705 #ifdef INVARIANTS 12706 if (create_lock_applied == 0) { 12707 panic("Error, should hold create lock and I don't?"); 12708 } 12709 #endif 12710 stcb = sctp_aloc_assoc(inp, addr, &error, 0, vrf_id, 12711 inp->sctp_ep.pre_open_stream_count, 12712 inp->sctp_ep.port, 12713 p, 12714 SCTP_INITIALIZE_AUTH_PARAMS); 12715 if (stcb == NULL) { 12716 /* Error is setup for us in the call */ 12717 goto out_unlocked; 12718 } 12719 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 12720 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 12721 /* 12722 * Set the connected flag so we can queue 12723 * data 12724 */ 12725 soisconnecting(so); 12726 } 12727 hold_tcblock = 1; 12728 if (create_lock_applied) { 12729 SCTP_ASOC_CREATE_UNLOCK(inp); 12730 create_lock_applied = 0; 12731 } else { 12732 SCTP_PRINTF("Huh-3? create lock should have been on??\n"); 12733 } 12734 /* 12735 * Turn on queue only flag to prevent data from 12736 * being sent 12737 */ 12738 queue_only = 1; 12739 asoc = &stcb->asoc; 12740 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 12741 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 12742 12743 if (control) { 12744 if (sctp_process_cmsgs_for_init(stcb, control, &error)) { 12745 sctp_free_assoc(inp, stcb, SCTP_PCBFREE_FORCE, 12746 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_6); 12747 hold_tcblock = 0; 12748 stcb = NULL; 12749 goto out_unlocked; 12750 } 12751 } 12752 /* out with the INIT */ 12753 queue_only_for_init = 1; 12754 /*- 12755 * we may want to dig in after this call and adjust the MTU 12756 * value. It defaulted to 1500 (constant) but the ro 12757 * structure may now have an update and thus we may need to 12758 * change it BEFORE we append the message. 12759 */ 12760 } 12761 } else 12762 asoc = &stcb->asoc; 12763 if (srcv == NULL) { 12764 srcv = (struct sctp_sndrcvinfo *)&asoc->def_send; 12765 sinfo_flags = srcv->sinfo_flags; 12766 if (flags & MSG_EOR) { 12767 sinfo_flags |= SCTP_EOR; 12768 } 12769 if (flags & MSG_EOF) { 12770 sinfo_flags |= SCTP_EOF; 12771 } 12772 } 12773 if (sinfo_flags & SCTP_ADDR_OVER) { 12774 if (addr) 12775 net = sctp_findnet(stcb, addr); 12776 else 12777 net = NULL; 12778 if ((net == NULL) || 12779 ((port != 0) && (port != stcb->rport))) { 12780 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12781 error = EINVAL; 12782 goto out_unlocked; 12783 } 12784 } else { 12785 if (stcb->asoc.alternate) { 12786 net = stcb->asoc.alternate; 12787 } else { 12788 net = stcb->asoc.primary_destination; 12789 } 12790 } 12791 atomic_add_int(&stcb->total_sends, 1); 12792 /* Keep the stcb from being freed under our feet */ 12793 atomic_add_int(&asoc->refcnt, 1); 12794 free_cnt_applied = 1; 12795 12796 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NO_FRAGMENT)) { 12797 if (sndlen > (ssize_t)asoc->smallest_mtu) { 12798 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12799 error = EMSGSIZE; 12800 goto out_unlocked; 12801 } 12802 } 12803 if (SCTP_SO_IS_NBIO(so) 12804 || (flags & (MSG_NBIO | MSG_DONTWAIT)) != 0 12805 ) { 12806 non_blocking = 1; 12807 } 12808 /* would we block? */ 12809 if (non_blocking) { 12810 ssize_t amount; 12811 12812 if (hold_tcblock == 0) { 12813 SCTP_TCB_LOCK(stcb); 12814 hold_tcblock = 1; 12815 } 12816 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 12817 if (user_marks_eor == 0) { 12818 amount = sndlen; 12819 } else { 12820 amount = 1; 12821 } 12822 if ((SCTP_SB_LIMIT_SND(so) < (amount + inqueue_bytes + stcb->asoc.sb_send_resv)) || 12823 (stcb->asoc.chunks_on_out_queue >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12824 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EWOULDBLOCK); 12825 if (sndlen > (ssize_t)SCTP_SB_LIMIT_SND(so)) 12826 error = EMSGSIZE; 12827 else 12828 error = EWOULDBLOCK; 12829 goto out_unlocked; 12830 } 12831 stcb->asoc.sb_send_resv += (uint32_t)sndlen; 12832 SCTP_TCB_UNLOCK(stcb); 12833 hold_tcblock = 0; 12834 } else { 12835 atomic_add_int(&stcb->asoc.sb_send_resv, sndlen); 12836 } 12837 local_soresv = sndlen; 12838 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12839 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12840 error = ECONNRESET; 12841 goto out_unlocked; 12842 } 12843 if (create_lock_applied) { 12844 SCTP_ASOC_CREATE_UNLOCK(inp); 12845 create_lock_applied = 0; 12846 } 12847 /* Is the stream no. valid? */ 12848 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 12849 /* Invalid stream number */ 12850 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12851 error = EINVAL; 12852 goto out_unlocked; 12853 } 12854 if ((asoc->strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPEN) && 12855 (asoc->strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPENING)) { 12856 /* 12857 * Can't queue any data while stream reset is underway. 12858 */ 12859 if (asoc->strmout[srcv->sinfo_stream].state > SCTP_STREAM_OPEN) { 12860 error = EAGAIN; 12861 } else { 12862 error = EINVAL; 12863 } 12864 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, error); 12865 goto out_unlocked; 12866 } 12867 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 12868 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 12869 queue_only = 1; 12870 } 12871 /* we are now done with all control */ 12872 if (control) { 12873 sctp_m_freem(control); 12874 control = NULL; 12875 } 12876 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 12877 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12878 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12879 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12880 if (sinfo_flags & SCTP_ABORT) { 12881 ; 12882 } else { 12883 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12884 error = ECONNRESET; 12885 goto out_unlocked; 12886 } 12887 } 12888 /* Ok, we will attempt a msgsnd :> */ 12889 if (p) { 12890 p->td_ru.ru_msgsnd++; 12891 } 12892 /* Are we aborting? */ 12893 if (sinfo_flags & SCTP_ABORT) { 12894 struct mbuf *mm; 12895 ssize_t tot_demand, tot_out = 0, max_out; 12896 12897 SCTP_STAT_INCR(sctps_sends_with_abort); 12898 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 12899 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 12900 /* It has to be up before we abort */ 12901 /* how big is the user initiated abort? */ 12902 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12903 error = EINVAL; 12904 goto out; 12905 } 12906 if (hold_tcblock) { 12907 SCTP_TCB_UNLOCK(stcb); 12908 hold_tcblock = 0; 12909 } 12910 if (top) { 12911 struct mbuf *cntm = NULL; 12912 12913 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_WAITOK, 1, MT_DATA); 12914 if (sndlen != 0) { 12915 for (cntm = top; cntm; cntm = SCTP_BUF_NEXT(cntm)) { 12916 tot_out += SCTP_BUF_LEN(cntm); 12917 } 12918 } 12919 } else { 12920 /* Must fit in a MTU */ 12921 tot_out = sndlen; 12922 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 12923 if (tot_demand > SCTP_DEFAULT_ADD_MORE) { 12924 /* To big */ 12925 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12926 error = EMSGSIZE; 12927 goto out; 12928 } 12929 mm = sctp_get_mbuf_for_msg((unsigned int)tot_demand, 0, M_WAITOK, 1, MT_DATA); 12930 } 12931 if (mm == NULL) { 12932 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12933 error = ENOMEM; 12934 goto out; 12935 } 12936 max_out = asoc->smallest_mtu - sizeof(struct sctp_paramhdr); 12937 max_out -= sizeof(struct sctp_abort_msg); 12938 if (tot_out > max_out) { 12939 tot_out = max_out; 12940 } 12941 if (mm) { 12942 struct sctp_paramhdr *ph; 12943 12944 /* now move forward the data pointer */ 12945 ph = mtod(mm, struct sctp_paramhdr *); 12946 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 12947 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + tot_out)); 12948 ph++; 12949 SCTP_BUF_LEN(mm) = (int)(tot_out + sizeof(struct sctp_paramhdr)); 12950 if (top == NULL) { 12951 error = uiomove((caddr_t)ph, (int)tot_out, uio); 12952 if (error) { 12953 /*- 12954 * Here if we can't get his data we 12955 * still abort we just don't get to 12956 * send the users note :-0 12957 */ 12958 sctp_m_freem(mm); 12959 mm = NULL; 12960 } 12961 } else { 12962 if (sndlen != 0) { 12963 SCTP_BUF_NEXT(mm) = top; 12964 } 12965 } 12966 } 12967 if (hold_tcblock == 0) { 12968 SCTP_TCB_LOCK(stcb); 12969 } 12970 atomic_add_int(&stcb->asoc.refcnt, -1); 12971 free_cnt_applied = 0; 12972 /* release this lock, otherwise we hang on ourselves */ 12973 NET_EPOCH_ENTER(et); 12974 sctp_abort_an_association(stcb->sctp_ep, stcb, mm, SCTP_SO_LOCKED); 12975 NET_EPOCH_EXIT(et); 12976 /* now relock the stcb so everything is sane */ 12977 hold_tcblock = 0; 12978 stcb = NULL; 12979 /* 12980 * In this case top is already chained to mm avoid double 12981 * free, since we free it below if top != NULL and driver 12982 * would free it after sending the packet out 12983 */ 12984 if (sndlen != 0) { 12985 top = NULL; 12986 } 12987 goto out_unlocked; 12988 } 12989 /* Calculate the maximum we can send */ 12990 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 12991 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 12992 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 12993 } else { 12994 max_len = 0; 12995 } 12996 if (hold_tcblock) { 12997 SCTP_TCB_UNLOCK(stcb); 12998 hold_tcblock = 0; 12999 } 13000 if (asoc->strmout == NULL) { 13001 /* huh? software error */ 13002 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 13003 error = EFAULT; 13004 goto out_unlocked; 13005 } 13006 13007 /* Unless E_EOR mode is on, we must make a send FIT in one call. */ 13008 if ((user_marks_eor == 0) && 13009 (sndlen > (ssize_t)SCTP_SB_LIMIT_SND(stcb->sctp_socket))) { 13010 /* It will NEVER fit */ 13011 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 13012 error = EMSGSIZE; 13013 goto out_unlocked; 13014 } 13015 if ((uio == NULL) && user_marks_eor) { 13016 /*- 13017 * We do not support eeor mode for 13018 * sending with mbuf chains (like sendfile). 13019 */ 13020 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13021 error = EINVAL; 13022 goto out_unlocked; 13023 } 13024 13025 if (user_marks_eor) { 13026 local_add_more = (ssize_t)min(SCTP_SB_LIMIT_SND(so), SCTP_BASE_SYSCTL(sctp_add_more_threshold)); 13027 } else { 13028 /*- 13029 * For non-eeor the whole message must fit in 13030 * the socket send buffer. 13031 */ 13032 local_add_more = sndlen; 13033 } 13034 len = 0; 13035 if (non_blocking) { 13036 goto skip_preblock; 13037 } 13038 if (((max_len <= local_add_more) && 13039 ((ssize_t)SCTP_SB_LIMIT_SND(so) >= local_add_more)) || 13040 (max_len == 0) || 13041 ((stcb->asoc.chunks_on_out_queue + stcb->asoc.stream_queue_cnt) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13042 /* No room right now ! */ 13043 SOCKBUF_LOCK(&so->so_snd); 13044 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13045 while ((SCTP_SB_LIMIT_SND(so) < (inqueue_bytes + local_add_more)) || 13046 ((stcb->asoc.stream_queue_cnt + stcb->asoc.chunks_on_out_queue) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13047 SCTPDBG(SCTP_DEBUG_OUTPUT1, "pre_block limit:%u <(inq:%d + %zd) || (%d+%d > %d)\n", 13048 (unsigned int)SCTP_SB_LIMIT_SND(so), 13049 inqueue_bytes, 13050 local_add_more, 13051 stcb->asoc.stream_queue_cnt, 13052 stcb->asoc.chunks_on_out_queue, 13053 SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)); 13054 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13055 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA, asoc, sndlen); 13056 } 13057 be.error = 0; 13058 stcb->block_entry = &be; 13059 error = sbwait(&so->so_snd); 13060 stcb->block_entry = NULL; 13061 if (error || so->so_error || be.error) { 13062 if (error == 0) { 13063 if (so->so_error) 13064 error = so->so_error; 13065 if (be.error) { 13066 error = be.error; 13067 } 13068 } 13069 SOCKBUF_UNLOCK(&so->so_snd); 13070 goto out_unlocked; 13071 } 13072 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13073 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13074 asoc, stcb->asoc.total_output_queue_size); 13075 } 13076 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13077 SOCKBUF_UNLOCK(&so->so_snd); 13078 goto out_unlocked; 13079 } 13080 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13081 } 13082 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13083 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13084 } else { 13085 max_len = 0; 13086 } 13087 SOCKBUF_UNLOCK(&so->so_snd); 13088 } 13089 13090 skip_preblock: 13091 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13092 goto out_unlocked; 13093 } 13094 /* 13095 * sndlen covers for mbuf case uio_resid covers for the non-mbuf 13096 * case NOTE: uio will be null when top/mbuf is passed 13097 */ 13098 if (sndlen == 0) { 13099 if (sinfo_flags & SCTP_EOF) { 13100 got_all_of_the_send = 1; 13101 goto dataless_eof; 13102 } else { 13103 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13104 error = EINVAL; 13105 goto out; 13106 } 13107 } 13108 if (top == NULL) { 13109 struct sctp_stream_queue_pending *sp; 13110 struct sctp_stream_out *strm; 13111 uint32_t sndout; 13112 13113 SCTP_TCB_SEND_LOCK(stcb); 13114 if ((asoc->stream_locked) && 13115 (asoc->stream_locked_on != srcv->sinfo_stream)) { 13116 SCTP_TCB_SEND_UNLOCK(stcb); 13117 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13118 error = EINVAL; 13119 goto out; 13120 } 13121 SCTP_TCB_SEND_UNLOCK(stcb); 13122 13123 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 13124 if (strm->last_msg_incomplete == 0) { 13125 do_a_copy_in: 13126 sp = sctp_copy_it_in(stcb, asoc, srcv, uio, net, max_len, user_marks_eor, &error); 13127 if (error) { 13128 goto out; 13129 } 13130 SCTP_TCB_SEND_LOCK(stcb); 13131 if (sp->msg_is_complete) { 13132 strm->last_msg_incomplete = 0; 13133 asoc->stream_locked = 0; 13134 } else { 13135 /* 13136 * Just got locked to this guy in case of an 13137 * interrupt. 13138 */ 13139 strm->last_msg_incomplete = 1; 13140 if (stcb->asoc.idata_supported == 0) { 13141 asoc->stream_locked = 1; 13142 asoc->stream_locked_on = srcv->sinfo_stream; 13143 } 13144 sp->sender_all_done = 0; 13145 } 13146 sctp_snd_sb_alloc(stcb, sp->length); 13147 atomic_add_int(&asoc->stream_queue_cnt, 1); 13148 if (sinfo_flags & SCTP_UNORDERED) { 13149 SCTP_STAT_INCR(sctps_sends_with_unord); 13150 } 13151 sp->processing = 1; 13152 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 13153 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, asoc, strm, sp, 1); 13154 SCTP_TCB_SEND_UNLOCK(stcb); 13155 } else { 13156 SCTP_TCB_SEND_LOCK(stcb); 13157 sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead); 13158 if (sp->processing) { 13159 SCTP_TCB_SEND_UNLOCK(stcb); 13160 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13161 error = EINVAL; 13162 goto out; 13163 } else { 13164 sp->processing = 1; 13165 } 13166 SCTP_TCB_SEND_UNLOCK(stcb); 13167 if (sp == NULL) { 13168 /* ???? Huh ??? last msg is gone */ 13169 #ifdef INVARIANTS 13170 panic("Warning: Last msg marked incomplete, yet nothing left?"); 13171 #else 13172 SCTP_PRINTF("Warning: Last msg marked incomplete, yet nothing left?\n"); 13173 strm->last_msg_incomplete = 0; 13174 #endif 13175 goto do_a_copy_in; 13176 13177 } 13178 } 13179 while (uio->uio_resid > 0) { 13180 /* How much room do we have? */ 13181 struct mbuf *new_tail, *mm; 13182 13183 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13184 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) 13185 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13186 else 13187 max_len = 0; 13188 13189 if ((max_len > (ssize_t)SCTP_BASE_SYSCTL(sctp_add_more_threshold)) || 13190 (max_len && (SCTP_SB_LIMIT_SND(so) < SCTP_BASE_SYSCTL(sctp_add_more_threshold))) || 13191 (uio->uio_resid && (uio->uio_resid <= max_len))) { 13192 sndout = 0; 13193 new_tail = NULL; 13194 if (hold_tcblock) { 13195 SCTP_TCB_UNLOCK(stcb); 13196 hold_tcblock = 0; 13197 } 13198 mm = sctp_copy_resume(uio, (int)max_len, user_marks_eor, &error, &sndout, &new_tail); 13199 if ((mm == NULL) || error) { 13200 if (mm) { 13201 sctp_m_freem(mm); 13202 } 13203 goto out; 13204 } 13205 /* Update the mbuf and count */ 13206 SCTP_TCB_SEND_LOCK(stcb); 13207 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13208 (stcb->asoc.state & SCTP_STATE_WAS_ABORTED)) { 13209 /* 13210 * we need to get out. Peer probably 13211 * aborted. 13212 */ 13213 sctp_m_freem(mm); 13214 if (stcb->asoc.state & SCTP_STATE_WAS_ABORTED) { 13215 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 13216 error = ECONNRESET; 13217 } 13218 SCTP_TCB_SEND_UNLOCK(stcb); 13219 goto out; 13220 } 13221 if (sp->tail_mbuf) { 13222 /* tack it to the end */ 13223 SCTP_BUF_NEXT(sp->tail_mbuf) = mm; 13224 sp->tail_mbuf = new_tail; 13225 } else { 13226 /* A stolen mbuf */ 13227 sp->data = mm; 13228 sp->tail_mbuf = new_tail; 13229 } 13230 sctp_snd_sb_alloc(stcb, sndout); 13231 atomic_add_int(&sp->length, sndout); 13232 len += sndout; 13233 if (sinfo_flags & SCTP_SACK_IMMEDIATELY) { 13234 sp->sinfo_flags |= SCTP_SACK_IMMEDIATELY; 13235 } 13236 13237 /* Did we reach EOR? */ 13238 if ((uio->uio_resid == 0) && 13239 ((user_marks_eor == 0) || 13240 (sinfo_flags & SCTP_EOF) || 13241 (user_marks_eor && (sinfo_flags & SCTP_EOR)))) { 13242 sp->msg_is_complete = 1; 13243 } else { 13244 sp->msg_is_complete = 0; 13245 } 13246 SCTP_TCB_SEND_UNLOCK(stcb); 13247 } 13248 if (uio->uio_resid == 0) { 13249 /* got it all? */ 13250 continue; 13251 } 13252 /* PR-SCTP? */ 13253 if ((asoc->prsctp_supported) && (asoc->sent_queue_cnt_removeable > 0)) { 13254 /* 13255 * This is ugly but we must assure locking 13256 * order 13257 */ 13258 if (hold_tcblock == 0) { 13259 SCTP_TCB_LOCK(stcb); 13260 hold_tcblock = 1; 13261 } 13262 sctp_prune_prsctp(stcb, asoc, srcv, (int)sndlen); 13263 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13264 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) 13265 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13266 else 13267 max_len = 0; 13268 if (max_len > 0) { 13269 continue; 13270 } 13271 SCTP_TCB_UNLOCK(stcb); 13272 hold_tcblock = 0; 13273 } 13274 /* wait for space now */ 13275 if (non_blocking) { 13276 /* Non-blocking io in place out */ 13277 goto skip_out_eof; 13278 } 13279 /* What about the INIT, send it maybe */ 13280 if (queue_only_for_init) { 13281 if (hold_tcblock == 0) { 13282 SCTP_TCB_LOCK(stcb); 13283 hold_tcblock = 1; 13284 } 13285 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13286 /* a collision took us forward? */ 13287 queue_only = 0; 13288 } else { 13289 NET_EPOCH_ENTER(et); 13290 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13291 NET_EPOCH_EXIT(et); 13292 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 13293 queue_only = 1; 13294 } 13295 } 13296 if ((net->flight_size > net->cwnd) && 13297 (asoc->sctp_cmt_on_off == 0)) { 13298 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13299 queue_only = 1; 13300 } else if (asoc->ifp_had_enobuf) { 13301 SCTP_STAT_INCR(sctps_ifnomemqueued); 13302 if (net->flight_size > (2 * net->mtu)) { 13303 queue_only = 1; 13304 } 13305 asoc->ifp_had_enobuf = 0; 13306 } 13307 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 13308 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13309 (stcb->asoc.total_flight > 0) && 13310 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13311 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13312 13313 /*- 13314 * Ok, Nagle is set on and we have data outstanding. 13315 * Don't send anything and let SACKs drive out the 13316 * data unless we have a "full" segment to send. 13317 */ 13318 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13319 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13320 } 13321 SCTP_STAT_INCR(sctps_naglequeued); 13322 nagle_applies = 1; 13323 } else { 13324 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13325 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13326 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13327 } 13328 SCTP_STAT_INCR(sctps_naglesent); 13329 nagle_applies = 0; 13330 } 13331 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13332 13333 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13334 nagle_applies, un_sent); 13335 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13336 stcb->asoc.total_flight, 13337 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13338 } 13339 if (queue_only_for_init) 13340 queue_only_for_init = 0; 13341 if ((queue_only == 0) && (nagle_applies == 0)) { 13342 /*- 13343 * need to start chunk output 13344 * before blocking.. note that if 13345 * a lock is already applied, then 13346 * the input via the net is happening 13347 * and I don't need to start output :-D 13348 */ 13349 NET_EPOCH_ENTER(et); 13350 if (hold_tcblock == 0) { 13351 if (SCTP_TCB_TRYLOCK(stcb)) { 13352 hold_tcblock = 1; 13353 sctp_chunk_output(inp, 13354 stcb, 13355 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13356 } 13357 } else { 13358 sctp_chunk_output(inp, 13359 stcb, 13360 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13361 } 13362 NET_EPOCH_EXIT(et); 13363 } 13364 if (hold_tcblock == 1) { 13365 SCTP_TCB_UNLOCK(stcb); 13366 hold_tcblock = 0; 13367 } 13368 SOCKBUF_LOCK(&so->so_snd); 13369 /*- 13370 * This is a bit strange, but I think it will 13371 * work. The total_output_queue_size is locked and 13372 * protected by the TCB_LOCK, which we just released. 13373 * There is a race that can occur between releasing it 13374 * above, and me getting the socket lock, where sacks 13375 * come in but we have not put the SB_WAIT on the 13376 * so_snd buffer to get the wakeup. After the LOCK 13377 * is applied the sack_processing will also need to 13378 * LOCK the so->so_snd to do the actual sowwakeup(). So 13379 * once we have the socket buffer lock if we recheck the 13380 * size we KNOW we will get to sleep safely with the 13381 * wakeup flag in place. 13382 */ 13383 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13384 if (SCTP_SB_LIMIT_SND(so) <= (inqueue_bytes + 13385 min(SCTP_BASE_SYSCTL(sctp_add_more_threshold), SCTP_SB_LIMIT_SND(so)))) { 13386 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13387 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 13388 asoc, uio->uio_resid); 13389 } 13390 be.error = 0; 13391 stcb->block_entry = &be; 13392 error = sbwait(&so->so_snd); 13393 stcb->block_entry = NULL; 13394 13395 if (error || so->so_error || be.error) { 13396 if (error == 0) { 13397 if (so->so_error) 13398 error = so->so_error; 13399 if (be.error) { 13400 error = be.error; 13401 } 13402 } 13403 SOCKBUF_UNLOCK(&so->so_snd); 13404 goto out_unlocked; 13405 } 13406 13407 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13408 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13409 asoc, stcb->asoc.total_output_queue_size); 13410 } 13411 } 13412 SOCKBUF_UNLOCK(&so->so_snd); 13413 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13414 goto out_unlocked; 13415 } 13416 } 13417 SCTP_TCB_SEND_LOCK(stcb); 13418 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13419 (stcb->asoc.state & SCTP_STATE_WAS_ABORTED)) { 13420 SCTP_TCB_SEND_UNLOCK(stcb); 13421 goto out_unlocked; 13422 } 13423 if (sp) { 13424 if (sp->msg_is_complete == 0) { 13425 strm->last_msg_incomplete = 1; 13426 if (stcb->asoc.idata_supported == 0) { 13427 asoc->stream_locked = 1; 13428 asoc->stream_locked_on = srcv->sinfo_stream; 13429 } 13430 } else { 13431 sp->sender_all_done = 1; 13432 strm->last_msg_incomplete = 0; 13433 asoc->stream_locked = 0; 13434 } 13435 sp->processing = 0; 13436 } else { 13437 SCTP_PRINTF("Huh no sp TSNH?\n"); 13438 strm->last_msg_incomplete = 0; 13439 asoc->stream_locked = 0; 13440 } 13441 SCTP_TCB_SEND_UNLOCK(stcb); 13442 if (uio->uio_resid == 0) { 13443 got_all_of_the_send = 1; 13444 } 13445 } else { 13446 /* We send in a 0, since we do NOT have any locks */ 13447 error = sctp_msg_append(stcb, net, top, srcv, 0); 13448 top = NULL; 13449 if (sinfo_flags & SCTP_EOF) { 13450 got_all_of_the_send = 1; 13451 } 13452 } 13453 if (error) { 13454 goto out; 13455 } 13456 dataless_eof: 13457 /* EOF thing ? */ 13458 if ((sinfo_flags & SCTP_EOF) && 13459 (got_all_of_the_send == 1)) { 13460 SCTP_STAT_INCR(sctps_sends_with_eof); 13461 error = 0; 13462 if (hold_tcblock == 0) { 13463 SCTP_TCB_LOCK(stcb); 13464 hold_tcblock = 1; 13465 } 13466 if (TAILQ_EMPTY(&asoc->send_queue) && 13467 TAILQ_EMPTY(&asoc->sent_queue) && 13468 sctp_is_there_unsent_data(stcb, SCTP_SO_LOCKED) == 0) { 13469 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13470 goto abort_anyway; 13471 } 13472 /* there is nothing queued to send, so I'm done... */ 13473 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 13474 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13475 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13476 struct sctp_nets *netp; 13477 13478 /* only send SHUTDOWN the first time through */ 13479 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13480 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 13481 } 13482 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT); 13483 sctp_stop_timers_for_shutdown(stcb); 13484 if (stcb->asoc.alternate) { 13485 netp = stcb->asoc.alternate; 13486 } else { 13487 netp = stcb->asoc.primary_destination; 13488 } 13489 sctp_send_shutdown(stcb, netp); 13490 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 13491 netp); 13492 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13493 NULL); 13494 } 13495 } else { 13496 /*- 13497 * we still got (or just got) data to send, so set 13498 * SHUTDOWN_PENDING 13499 */ 13500 /*- 13501 * XXX sockets draft says that SCTP_EOF should be 13502 * sent with no data. currently, we will allow user 13503 * data to be sent first and move to 13504 * SHUTDOWN-PENDING 13505 */ 13506 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 13507 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13508 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13509 if (hold_tcblock == 0) { 13510 SCTP_TCB_LOCK(stcb); 13511 hold_tcblock = 1; 13512 } 13513 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13514 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT); 13515 } 13516 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 13517 if (TAILQ_EMPTY(&asoc->send_queue) && 13518 TAILQ_EMPTY(&asoc->sent_queue) && 13519 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 13520 struct mbuf *op_err; 13521 char msg[SCTP_DIAG_INFO_LEN]; 13522 13523 abort_anyway: 13524 if (free_cnt_applied) { 13525 atomic_add_int(&stcb->asoc.refcnt, -1); 13526 free_cnt_applied = 0; 13527 } 13528 SCTP_SNPRINTF(msg, sizeof(msg), 13529 "%s:%d at %s", __FILE__, __LINE__, __func__); 13530 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 13531 msg); 13532 NET_EPOCH_ENTER(et); 13533 sctp_abort_an_association(stcb->sctp_ep, stcb, 13534 op_err, SCTP_SO_LOCKED); 13535 NET_EPOCH_EXIT(et); 13536 /* 13537 * now relock the stcb so everything 13538 * is sane 13539 */ 13540 hold_tcblock = 0; 13541 stcb = NULL; 13542 goto out; 13543 } 13544 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13545 NULL); 13546 sctp_feature_off(inp, SCTP_PCB_FLAGS_NODELAY); 13547 } 13548 } 13549 } 13550 skip_out_eof: 13551 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 13552 some_on_control = 1; 13553 } 13554 if (queue_only_for_init) { 13555 if (hold_tcblock == 0) { 13556 SCTP_TCB_LOCK(stcb); 13557 hold_tcblock = 1; 13558 } 13559 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13560 /* a collision took us forward? */ 13561 queue_only = 0; 13562 } else { 13563 NET_EPOCH_ENTER(et); 13564 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13565 NET_EPOCH_EXIT(et); 13566 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 13567 queue_only = 1; 13568 } 13569 } 13570 if ((net->flight_size > net->cwnd) && 13571 (stcb->asoc.sctp_cmt_on_off == 0)) { 13572 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13573 queue_only = 1; 13574 } else if (asoc->ifp_had_enobuf) { 13575 SCTP_STAT_INCR(sctps_ifnomemqueued); 13576 if (net->flight_size > (2 * net->mtu)) { 13577 queue_only = 1; 13578 } 13579 asoc->ifp_had_enobuf = 0; 13580 } 13581 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 13582 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13583 (stcb->asoc.total_flight > 0) && 13584 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13585 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13586 /*- 13587 * Ok, Nagle is set on and we have data outstanding. 13588 * Don't send anything and let SACKs drive out the 13589 * data unless wen have a "full" segment to send. 13590 */ 13591 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13592 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13593 } 13594 SCTP_STAT_INCR(sctps_naglequeued); 13595 nagle_applies = 1; 13596 } else { 13597 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13598 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13599 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13600 } 13601 SCTP_STAT_INCR(sctps_naglesent); 13602 nagle_applies = 0; 13603 } 13604 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13605 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13606 nagle_applies, un_sent); 13607 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13608 stcb->asoc.total_flight, 13609 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13610 } 13611 NET_EPOCH_ENTER(et); 13612 if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) { 13613 /* we can attempt to send too. */ 13614 if (hold_tcblock == 0) { 13615 /* 13616 * If there is activity recv'ing sacks no need to 13617 * send 13618 */ 13619 if (SCTP_TCB_TRYLOCK(stcb)) { 13620 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13621 hold_tcblock = 1; 13622 } 13623 } else { 13624 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13625 } 13626 } else if ((queue_only == 0) && 13627 (stcb->asoc.peers_rwnd == 0) && 13628 (stcb->asoc.total_flight == 0)) { 13629 /* We get to have a probe outstanding */ 13630 if (hold_tcblock == 0) { 13631 hold_tcblock = 1; 13632 SCTP_TCB_LOCK(stcb); 13633 } 13634 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13635 } else if (some_on_control) { 13636 int num_out, reason, frag_point; 13637 13638 /* Here we do control only */ 13639 if (hold_tcblock == 0) { 13640 hold_tcblock = 1; 13641 SCTP_TCB_LOCK(stcb); 13642 } 13643 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 13644 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 13645 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_LOCKED); 13646 } 13647 NET_EPOCH_EXIT(et); 13648 SCTPDBG(SCTP_DEBUG_OUTPUT1, "USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d err:%d\n", 13649 queue_only, stcb->asoc.peers_rwnd, un_sent, 13650 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue, 13651 stcb->asoc.total_output_queue_size, error); 13652 13653 out: 13654 out_unlocked: 13655 13656 if (local_soresv && stcb) { 13657 atomic_subtract_int(&stcb->asoc.sb_send_resv, sndlen); 13658 } 13659 if (create_lock_applied) { 13660 SCTP_ASOC_CREATE_UNLOCK(inp); 13661 } 13662 if ((stcb) && hold_tcblock) { 13663 SCTP_TCB_UNLOCK(stcb); 13664 } 13665 if (stcb && free_cnt_applied) { 13666 atomic_add_int(&stcb->asoc.refcnt, -1); 13667 } 13668 #ifdef INVARIANTS 13669 if (stcb) { 13670 if (mtx_owned(&stcb->tcb_mtx)) { 13671 panic("Leaving with tcb mtx owned?"); 13672 } 13673 if (mtx_owned(&stcb->tcb_send_mtx)) { 13674 panic("Leaving with tcb send mtx owned?"); 13675 } 13676 } 13677 #endif 13678 if (top) { 13679 sctp_m_freem(top); 13680 } 13681 if (control) { 13682 sctp_m_freem(control); 13683 } 13684 return (error); 13685 } 13686 13687 13688 /* 13689 * generate an AUTHentication chunk, if required 13690 */ 13691 struct mbuf * 13692 sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end, 13693 struct sctp_auth_chunk **auth_ret, uint32_t *offset, 13694 struct sctp_tcb *stcb, uint8_t chunk) 13695 { 13696 struct mbuf *m_auth; 13697 struct sctp_auth_chunk *auth; 13698 int chunk_len; 13699 struct mbuf *cn; 13700 13701 if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) || 13702 (stcb == NULL)) 13703 return (m); 13704 13705 if (stcb->asoc.auth_supported == 0) { 13706 return (m); 13707 } 13708 /* does the requested chunk require auth? */ 13709 if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) { 13710 return (m); 13711 } 13712 m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_NOWAIT, 1, MT_HEADER); 13713 if (m_auth == NULL) { 13714 /* no mbuf's */ 13715 return (m); 13716 } 13717 /* reserve some space if this will be the first mbuf */ 13718 if (m == NULL) 13719 SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD); 13720 /* fill in the AUTH chunk details */ 13721 auth = mtod(m_auth, struct sctp_auth_chunk *); 13722 memset(auth, 0, sizeof(*auth)); 13723 auth->ch.chunk_type = SCTP_AUTHENTICATION; 13724 auth->ch.chunk_flags = 0; 13725 chunk_len = sizeof(*auth) + 13726 sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id); 13727 auth->ch.chunk_length = htons(chunk_len); 13728 auth->hmac_id = htons(stcb->asoc.peer_hmac_id); 13729 /* key id and hmac digest will be computed and filled in upon send */ 13730 13731 /* save the offset where the auth was inserted into the chain */ 13732 *offset = 0; 13733 for (cn = m; cn; cn = SCTP_BUF_NEXT(cn)) { 13734 *offset += SCTP_BUF_LEN(cn); 13735 } 13736 13737 /* update length and return pointer to the auth chunk */ 13738 SCTP_BUF_LEN(m_auth) = chunk_len; 13739 m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0); 13740 if (auth_ret != NULL) 13741 *auth_ret = auth; 13742 13743 return (m); 13744 } 13745 13746 #ifdef INET6 13747 int 13748 sctp_v6src_match_nexthop(struct sockaddr_in6 *src6, sctp_route_t *ro) 13749 { 13750 struct nd_prefix *pfx = NULL; 13751 struct nd_pfxrouter *pfxrtr = NULL; 13752 struct sockaddr_in6 gw6; 13753 13754 if (ro == NULL || ro->ro_nh == NULL || src6->sin6_family != AF_INET6) 13755 return (0); 13756 13757 /* get prefix entry of address */ 13758 ND6_RLOCK(); 13759 LIST_FOREACH(pfx, &MODULE_GLOBAL(nd_prefix), ndpr_entry) { 13760 if (pfx->ndpr_stateflags & NDPRF_DETACHED) 13761 continue; 13762 if (IN6_ARE_MASKED_ADDR_EQUAL(&pfx->ndpr_prefix.sin6_addr, 13763 &src6->sin6_addr, &pfx->ndpr_mask)) 13764 break; 13765 } 13766 /* no prefix entry in the prefix list */ 13767 if (pfx == NULL) { 13768 ND6_RUNLOCK(); 13769 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefix entry for "); 13770 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13771 return (0); 13772 } 13773 13774 SCTPDBG(SCTP_DEBUG_OUTPUT2, "v6src_match_nexthop(), Prefix entry is "); 13775 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13776 13777 /* search installed gateway from prefix entry */ 13778 LIST_FOREACH(pfxrtr, &pfx->ndpr_advrtrs, pfr_entry) { 13779 memset(&gw6, 0, sizeof(struct sockaddr_in6)); 13780 gw6.sin6_family = AF_INET6; 13781 gw6.sin6_len = sizeof(struct sockaddr_in6); 13782 memcpy(&gw6.sin6_addr, &pfxrtr->router->rtaddr, 13783 sizeof(struct in6_addr)); 13784 SCTPDBG(SCTP_DEBUG_OUTPUT2, "prefix router is "); 13785 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&gw6); 13786 SCTPDBG(SCTP_DEBUG_OUTPUT2, "installed router is "); 13787 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ro->ro_nh->gw_sa); 13788 if (sctp_cmpaddr((struct sockaddr *)&gw6, &ro->ro_nh->gw_sa)) { 13789 ND6_RUNLOCK(); 13790 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is installed\n"); 13791 return (1); 13792 } 13793 } 13794 ND6_RUNLOCK(); 13795 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is not installed\n"); 13796 return (0); 13797 } 13798 #endif 13799 13800 int 13801 sctp_v4src_match_nexthop(struct sctp_ifa *sifa, sctp_route_t *ro) 13802 { 13803 #ifdef INET 13804 struct sockaddr_in *sin, *mask; 13805 struct ifaddr *ifa; 13806 struct in_addr srcnetaddr, gwnetaddr; 13807 13808 if (ro == NULL || ro->ro_nh == NULL || 13809 sifa->address.sa.sa_family != AF_INET) { 13810 return (0); 13811 } 13812 ifa = (struct ifaddr *)sifa->ifa; 13813 mask = (struct sockaddr_in *)(ifa->ifa_netmask); 13814 sin = &sifa->address.sin; 13815 srcnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13816 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: src address is "); 13817 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 13818 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", srcnetaddr.s_addr); 13819 13820 sin = &ro->ro_nh->gw4_sa; 13821 gwnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13822 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: nexthop is "); 13823 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ro->ro_nh->gw_sa); 13824 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", gwnetaddr.s_addr); 13825 if (srcnetaddr.s_addr == gwnetaddr.s_addr) { 13826 return (1); 13827 } 13828 #endif 13829 return (0); 13830 } 13831