1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 5 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 6 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions are met: 10 * 11 * a) Redistributions of source code must retain the above copyright notice, 12 * this list of conditions and the following disclaimer. 13 * 14 * b) Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the distribution. 17 * 18 * c) Neither the name of Cisco Systems, Inc. nor the names of its 19 * contributors may be used to endorse or promote products derived 20 * from this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 26 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 32 * THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include <sys/cdefs.h> 36 __FBSDID("$FreeBSD$"); 37 38 #include <netinet/sctp_os.h> 39 #include <sys/proc.h> 40 #include <netinet/sctp_var.h> 41 #include <netinet/sctp_sysctl.h> 42 #include <netinet/sctp_header.h> 43 #include <netinet/sctp_pcb.h> 44 #include <netinet/sctputil.h> 45 #include <netinet/sctp_output.h> 46 #include <netinet/sctp_uio.h> 47 #include <netinet/sctputil.h> 48 #include <netinet/sctp_auth.h> 49 #include <netinet/sctp_timer.h> 50 #include <netinet/sctp_asconf.h> 51 #include <netinet/sctp_indata.h> 52 #include <netinet/sctp_bsd_addr.h> 53 #include <netinet/sctp_input.h> 54 #include <netinet/sctp_crc32.h> 55 #include <netinet/sctp_kdtrace.h> 56 #if defined(INET) || defined(INET6) 57 #include <netinet/udp.h> 58 #endif 59 #include <netinet/udp_var.h> 60 #include <machine/in_cksum.h> 61 62 #define SCTP_MAX_GAPS_INARRAY 4 63 struct sack_track { 64 uint8_t right_edge; /* mergable on the right edge */ 65 uint8_t left_edge; /* mergable on the left edge */ 66 uint8_t num_entries; 67 uint8_t spare; 68 struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY]; 69 }; 70 71 const struct sack_track sack_array[256] = { 72 {0, 0, 0, 0, /* 0x00 */ 73 {{0, 0}, 74 {0, 0}, 75 {0, 0}, 76 {0, 0} 77 } 78 }, 79 {1, 0, 1, 0, /* 0x01 */ 80 {{0, 0}, 81 {0, 0}, 82 {0, 0}, 83 {0, 0} 84 } 85 }, 86 {0, 0, 1, 0, /* 0x02 */ 87 {{1, 1}, 88 {0, 0}, 89 {0, 0}, 90 {0, 0} 91 } 92 }, 93 {1, 0, 1, 0, /* 0x03 */ 94 {{0, 1}, 95 {0, 0}, 96 {0, 0}, 97 {0, 0} 98 } 99 }, 100 {0, 0, 1, 0, /* 0x04 */ 101 {{2, 2}, 102 {0, 0}, 103 {0, 0}, 104 {0, 0} 105 } 106 }, 107 {1, 0, 2, 0, /* 0x05 */ 108 {{0, 0}, 109 {2, 2}, 110 {0, 0}, 111 {0, 0} 112 } 113 }, 114 {0, 0, 1, 0, /* 0x06 */ 115 {{1, 2}, 116 {0, 0}, 117 {0, 0}, 118 {0, 0} 119 } 120 }, 121 {1, 0, 1, 0, /* 0x07 */ 122 {{0, 2}, 123 {0, 0}, 124 {0, 0}, 125 {0, 0} 126 } 127 }, 128 {0, 0, 1, 0, /* 0x08 */ 129 {{3, 3}, 130 {0, 0}, 131 {0, 0}, 132 {0, 0} 133 } 134 }, 135 {1, 0, 2, 0, /* 0x09 */ 136 {{0, 0}, 137 {3, 3}, 138 {0, 0}, 139 {0, 0} 140 } 141 }, 142 {0, 0, 2, 0, /* 0x0a */ 143 {{1, 1}, 144 {3, 3}, 145 {0, 0}, 146 {0, 0} 147 } 148 }, 149 {1, 0, 2, 0, /* 0x0b */ 150 {{0, 1}, 151 {3, 3}, 152 {0, 0}, 153 {0, 0} 154 } 155 }, 156 {0, 0, 1, 0, /* 0x0c */ 157 {{2, 3}, 158 {0, 0}, 159 {0, 0}, 160 {0, 0} 161 } 162 }, 163 {1, 0, 2, 0, /* 0x0d */ 164 {{0, 0}, 165 {2, 3}, 166 {0, 0}, 167 {0, 0} 168 } 169 }, 170 {0, 0, 1, 0, /* 0x0e */ 171 {{1, 3}, 172 {0, 0}, 173 {0, 0}, 174 {0, 0} 175 } 176 }, 177 {1, 0, 1, 0, /* 0x0f */ 178 {{0, 3}, 179 {0, 0}, 180 {0, 0}, 181 {0, 0} 182 } 183 }, 184 {0, 0, 1, 0, /* 0x10 */ 185 {{4, 4}, 186 {0, 0}, 187 {0, 0}, 188 {0, 0} 189 } 190 }, 191 {1, 0, 2, 0, /* 0x11 */ 192 {{0, 0}, 193 {4, 4}, 194 {0, 0}, 195 {0, 0} 196 } 197 }, 198 {0, 0, 2, 0, /* 0x12 */ 199 {{1, 1}, 200 {4, 4}, 201 {0, 0}, 202 {0, 0} 203 } 204 }, 205 {1, 0, 2, 0, /* 0x13 */ 206 {{0, 1}, 207 {4, 4}, 208 {0, 0}, 209 {0, 0} 210 } 211 }, 212 {0, 0, 2, 0, /* 0x14 */ 213 {{2, 2}, 214 {4, 4}, 215 {0, 0}, 216 {0, 0} 217 } 218 }, 219 {1, 0, 3, 0, /* 0x15 */ 220 {{0, 0}, 221 {2, 2}, 222 {4, 4}, 223 {0, 0} 224 } 225 }, 226 {0, 0, 2, 0, /* 0x16 */ 227 {{1, 2}, 228 {4, 4}, 229 {0, 0}, 230 {0, 0} 231 } 232 }, 233 {1, 0, 2, 0, /* 0x17 */ 234 {{0, 2}, 235 {4, 4}, 236 {0, 0}, 237 {0, 0} 238 } 239 }, 240 {0, 0, 1, 0, /* 0x18 */ 241 {{3, 4}, 242 {0, 0}, 243 {0, 0}, 244 {0, 0} 245 } 246 }, 247 {1, 0, 2, 0, /* 0x19 */ 248 {{0, 0}, 249 {3, 4}, 250 {0, 0}, 251 {0, 0} 252 } 253 }, 254 {0, 0, 2, 0, /* 0x1a */ 255 {{1, 1}, 256 {3, 4}, 257 {0, 0}, 258 {0, 0} 259 } 260 }, 261 {1, 0, 2, 0, /* 0x1b */ 262 {{0, 1}, 263 {3, 4}, 264 {0, 0}, 265 {0, 0} 266 } 267 }, 268 {0, 0, 1, 0, /* 0x1c */ 269 {{2, 4}, 270 {0, 0}, 271 {0, 0}, 272 {0, 0} 273 } 274 }, 275 {1, 0, 2, 0, /* 0x1d */ 276 {{0, 0}, 277 {2, 4}, 278 {0, 0}, 279 {0, 0} 280 } 281 }, 282 {0, 0, 1, 0, /* 0x1e */ 283 {{1, 4}, 284 {0, 0}, 285 {0, 0}, 286 {0, 0} 287 } 288 }, 289 {1, 0, 1, 0, /* 0x1f */ 290 {{0, 4}, 291 {0, 0}, 292 {0, 0}, 293 {0, 0} 294 } 295 }, 296 {0, 0, 1, 0, /* 0x20 */ 297 {{5, 5}, 298 {0, 0}, 299 {0, 0}, 300 {0, 0} 301 } 302 }, 303 {1, 0, 2, 0, /* 0x21 */ 304 {{0, 0}, 305 {5, 5}, 306 {0, 0}, 307 {0, 0} 308 } 309 }, 310 {0, 0, 2, 0, /* 0x22 */ 311 {{1, 1}, 312 {5, 5}, 313 {0, 0}, 314 {0, 0} 315 } 316 }, 317 {1, 0, 2, 0, /* 0x23 */ 318 {{0, 1}, 319 {5, 5}, 320 {0, 0}, 321 {0, 0} 322 } 323 }, 324 {0, 0, 2, 0, /* 0x24 */ 325 {{2, 2}, 326 {5, 5}, 327 {0, 0}, 328 {0, 0} 329 } 330 }, 331 {1, 0, 3, 0, /* 0x25 */ 332 {{0, 0}, 333 {2, 2}, 334 {5, 5}, 335 {0, 0} 336 } 337 }, 338 {0, 0, 2, 0, /* 0x26 */ 339 {{1, 2}, 340 {5, 5}, 341 {0, 0}, 342 {0, 0} 343 } 344 }, 345 {1, 0, 2, 0, /* 0x27 */ 346 {{0, 2}, 347 {5, 5}, 348 {0, 0}, 349 {0, 0} 350 } 351 }, 352 {0, 0, 2, 0, /* 0x28 */ 353 {{3, 3}, 354 {5, 5}, 355 {0, 0}, 356 {0, 0} 357 } 358 }, 359 {1, 0, 3, 0, /* 0x29 */ 360 {{0, 0}, 361 {3, 3}, 362 {5, 5}, 363 {0, 0} 364 } 365 }, 366 {0, 0, 3, 0, /* 0x2a */ 367 {{1, 1}, 368 {3, 3}, 369 {5, 5}, 370 {0, 0} 371 } 372 }, 373 {1, 0, 3, 0, /* 0x2b */ 374 {{0, 1}, 375 {3, 3}, 376 {5, 5}, 377 {0, 0} 378 } 379 }, 380 {0, 0, 2, 0, /* 0x2c */ 381 {{2, 3}, 382 {5, 5}, 383 {0, 0}, 384 {0, 0} 385 } 386 }, 387 {1, 0, 3, 0, /* 0x2d */ 388 {{0, 0}, 389 {2, 3}, 390 {5, 5}, 391 {0, 0} 392 } 393 }, 394 {0, 0, 2, 0, /* 0x2e */ 395 {{1, 3}, 396 {5, 5}, 397 {0, 0}, 398 {0, 0} 399 } 400 }, 401 {1, 0, 2, 0, /* 0x2f */ 402 {{0, 3}, 403 {5, 5}, 404 {0, 0}, 405 {0, 0} 406 } 407 }, 408 {0, 0, 1, 0, /* 0x30 */ 409 {{4, 5}, 410 {0, 0}, 411 {0, 0}, 412 {0, 0} 413 } 414 }, 415 {1, 0, 2, 0, /* 0x31 */ 416 {{0, 0}, 417 {4, 5}, 418 {0, 0}, 419 {0, 0} 420 } 421 }, 422 {0, 0, 2, 0, /* 0x32 */ 423 {{1, 1}, 424 {4, 5}, 425 {0, 0}, 426 {0, 0} 427 } 428 }, 429 {1, 0, 2, 0, /* 0x33 */ 430 {{0, 1}, 431 {4, 5}, 432 {0, 0}, 433 {0, 0} 434 } 435 }, 436 {0, 0, 2, 0, /* 0x34 */ 437 {{2, 2}, 438 {4, 5}, 439 {0, 0}, 440 {0, 0} 441 } 442 }, 443 {1, 0, 3, 0, /* 0x35 */ 444 {{0, 0}, 445 {2, 2}, 446 {4, 5}, 447 {0, 0} 448 } 449 }, 450 {0, 0, 2, 0, /* 0x36 */ 451 {{1, 2}, 452 {4, 5}, 453 {0, 0}, 454 {0, 0} 455 } 456 }, 457 {1, 0, 2, 0, /* 0x37 */ 458 {{0, 2}, 459 {4, 5}, 460 {0, 0}, 461 {0, 0} 462 } 463 }, 464 {0, 0, 1, 0, /* 0x38 */ 465 {{3, 5}, 466 {0, 0}, 467 {0, 0}, 468 {0, 0} 469 } 470 }, 471 {1, 0, 2, 0, /* 0x39 */ 472 {{0, 0}, 473 {3, 5}, 474 {0, 0}, 475 {0, 0} 476 } 477 }, 478 {0, 0, 2, 0, /* 0x3a */ 479 {{1, 1}, 480 {3, 5}, 481 {0, 0}, 482 {0, 0} 483 } 484 }, 485 {1, 0, 2, 0, /* 0x3b */ 486 {{0, 1}, 487 {3, 5}, 488 {0, 0}, 489 {0, 0} 490 } 491 }, 492 {0, 0, 1, 0, /* 0x3c */ 493 {{2, 5}, 494 {0, 0}, 495 {0, 0}, 496 {0, 0} 497 } 498 }, 499 {1, 0, 2, 0, /* 0x3d */ 500 {{0, 0}, 501 {2, 5}, 502 {0, 0}, 503 {0, 0} 504 } 505 }, 506 {0, 0, 1, 0, /* 0x3e */ 507 {{1, 5}, 508 {0, 0}, 509 {0, 0}, 510 {0, 0} 511 } 512 }, 513 {1, 0, 1, 0, /* 0x3f */ 514 {{0, 5}, 515 {0, 0}, 516 {0, 0}, 517 {0, 0} 518 } 519 }, 520 {0, 0, 1, 0, /* 0x40 */ 521 {{6, 6}, 522 {0, 0}, 523 {0, 0}, 524 {0, 0} 525 } 526 }, 527 {1, 0, 2, 0, /* 0x41 */ 528 {{0, 0}, 529 {6, 6}, 530 {0, 0}, 531 {0, 0} 532 } 533 }, 534 {0, 0, 2, 0, /* 0x42 */ 535 {{1, 1}, 536 {6, 6}, 537 {0, 0}, 538 {0, 0} 539 } 540 }, 541 {1, 0, 2, 0, /* 0x43 */ 542 {{0, 1}, 543 {6, 6}, 544 {0, 0}, 545 {0, 0} 546 } 547 }, 548 {0, 0, 2, 0, /* 0x44 */ 549 {{2, 2}, 550 {6, 6}, 551 {0, 0}, 552 {0, 0} 553 } 554 }, 555 {1, 0, 3, 0, /* 0x45 */ 556 {{0, 0}, 557 {2, 2}, 558 {6, 6}, 559 {0, 0} 560 } 561 }, 562 {0, 0, 2, 0, /* 0x46 */ 563 {{1, 2}, 564 {6, 6}, 565 {0, 0}, 566 {0, 0} 567 } 568 }, 569 {1, 0, 2, 0, /* 0x47 */ 570 {{0, 2}, 571 {6, 6}, 572 {0, 0}, 573 {0, 0} 574 } 575 }, 576 {0, 0, 2, 0, /* 0x48 */ 577 {{3, 3}, 578 {6, 6}, 579 {0, 0}, 580 {0, 0} 581 } 582 }, 583 {1, 0, 3, 0, /* 0x49 */ 584 {{0, 0}, 585 {3, 3}, 586 {6, 6}, 587 {0, 0} 588 } 589 }, 590 {0, 0, 3, 0, /* 0x4a */ 591 {{1, 1}, 592 {3, 3}, 593 {6, 6}, 594 {0, 0} 595 } 596 }, 597 {1, 0, 3, 0, /* 0x4b */ 598 {{0, 1}, 599 {3, 3}, 600 {6, 6}, 601 {0, 0} 602 } 603 }, 604 {0, 0, 2, 0, /* 0x4c */ 605 {{2, 3}, 606 {6, 6}, 607 {0, 0}, 608 {0, 0} 609 } 610 }, 611 {1, 0, 3, 0, /* 0x4d */ 612 {{0, 0}, 613 {2, 3}, 614 {6, 6}, 615 {0, 0} 616 } 617 }, 618 {0, 0, 2, 0, /* 0x4e */ 619 {{1, 3}, 620 {6, 6}, 621 {0, 0}, 622 {0, 0} 623 } 624 }, 625 {1, 0, 2, 0, /* 0x4f */ 626 {{0, 3}, 627 {6, 6}, 628 {0, 0}, 629 {0, 0} 630 } 631 }, 632 {0, 0, 2, 0, /* 0x50 */ 633 {{4, 4}, 634 {6, 6}, 635 {0, 0}, 636 {0, 0} 637 } 638 }, 639 {1, 0, 3, 0, /* 0x51 */ 640 {{0, 0}, 641 {4, 4}, 642 {6, 6}, 643 {0, 0} 644 } 645 }, 646 {0, 0, 3, 0, /* 0x52 */ 647 {{1, 1}, 648 {4, 4}, 649 {6, 6}, 650 {0, 0} 651 } 652 }, 653 {1, 0, 3, 0, /* 0x53 */ 654 {{0, 1}, 655 {4, 4}, 656 {6, 6}, 657 {0, 0} 658 } 659 }, 660 {0, 0, 3, 0, /* 0x54 */ 661 {{2, 2}, 662 {4, 4}, 663 {6, 6}, 664 {0, 0} 665 } 666 }, 667 {1, 0, 4, 0, /* 0x55 */ 668 {{0, 0}, 669 {2, 2}, 670 {4, 4}, 671 {6, 6} 672 } 673 }, 674 {0, 0, 3, 0, /* 0x56 */ 675 {{1, 2}, 676 {4, 4}, 677 {6, 6}, 678 {0, 0} 679 } 680 }, 681 {1, 0, 3, 0, /* 0x57 */ 682 {{0, 2}, 683 {4, 4}, 684 {6, 6}, 685 {0, 0} 686 } 687 }, 688 {0, 0, 2, 0, /* 0x58 */ 689 {{3, 4}, 690 {6, 6}, 691 {0, 0}, 692 {0, 0} 693 } 694 }, 695 {1, 0, 3, 0, /* 0x59 */ 696 {{0, 0}, 697 {3, 4}, 698 {6, 6}, 699 {0, 0} 700 } 701 }, 702 {0, 0, 3, 0, /* 0x5a */ 703 {{1, 1}, 704 {3, 4}, 705 {6, 6}, 706 {0, 0} 707 } 708 }, 709 {1, 0, 3, 0, /* 0x5b */ 710 {{0, 1}, 711 {3, 4}, 712 {6, 6}, 713 {0, 0} 714 } 715 }, 716 {0, 0, 2, 0, /* 0x5c */ 717 {{2, 4}, 718 {6, 6}, 719 {0, 0}, 720 {0, 0} 721 } 722 }, 723 {1, 0, 3, 0, /* 0x5d */ 724 {{0, 0}, 725 {2, 4}, 726 {6, 6}, 727 {0, 0} 728 } 729 }, 730 {0, 0, 2, 0, /* 0x5e */ 731 {{1, 4}, 732 {6, 6}, 733 {0, 0}, 734 {0, 0} 735 } 736 }, 737 {1, 0, 2, 0, /* 0x5f */ 738 {{0, 4}, 739 {6, 6}, 740 {0, 0}, 741 {0, 0} 742 } 743 }, 744 {0, 0, 1, 0, /* 0x60 */ 745 {{5, 6}, 746 {0, 0}, 747 {0, 0}, 748 {0, 0} 749 } 750 }, 751 {1, 0, 2, 0, /* 0x61 */ 752 {{0, 0}, 753 {5, 6}, 754 {0, 0}, 755 {0, 0} 756 } 757 }, 758 {0, 0, 2, 0, /* 0x62 */ 759 {{1, 1}, 760 {5, 6}, 761 {0, 0}, 762 {0, 0} 763 } 764 }, 765 {1, 0, 2, 0, /* 0x63 */ 766 {{0, 1}, 767 {5, 6}, 768 {0, 0}, 769 {0, 0} 770 } 771 }, 772 {0, 0, 2, 0, /* 0x64 */ 773 {{2, 2}, 774 {5, 6}, 775 {0, 0}, 776 {0, 0} 777 } 778 }, 779 {1, 0, 3, 0, /* 0x65 */ 780 {{0, 0}, 781 {2, 2}, 782 {5, 6}, 783 {0, 0} 784 } 785 }, 786 {0, 0, 2, 0, /* 0x66 */ 787 {{1, 2}, 788 {5, 6}, 789 {0, 0}, 790 {0, 0} 791 } 792 }, 793 {1, 0, 2, 0, /* 0x67 */ 794 {{0, 2}, 795 {5, 6}, 796 {0, 0}, 797 {0, 0} 798 } 799 }, 800 {0, 0, 2, 0, /* 0x68 */ 801 {{3, 3}, 802 {5, 6}, 803 {0, 0}, 804 {0, 0} 805 } 806 }, 807 {1, 0, 3, 0, /* 0x69 */ 808 {{0, 0}, 809 {3, 3}, 810 {5, 6}, 811 {0, 0} 812 } 813 }, 814 {0, 0, 3, 0, /* 0x6a */ 815 {{1, 1}, 816 {3, 3}, 817 {5, 6}, 818 {0, 0} 819 } 820 }, 821 {1, 0, 3, 0, /* 0x6b */ 822 {{0, 1}, 823 {3, 3}, 824 {5, 6}, 825 {0, 0} 826 } 827 }, 828 {0, 0, 2, 0, /* 0x6c */ 829 {{2, 3}, 830 {5, 6}, 831 {0, 0}, 832 {0, 0} 833 } 834 }, 835 {1, 0, 3, 0, /* 0x6d */ 836 {{0, 0}, 837 {2, 3}, 838 {5, 6}, 839 {0, 0} 840 } 841 }, 842 {0, 0, 2, 0, /* 0x6e */ 843 {{1, 3}, 844 {5, 6}, 845 {0, 0}, 846 {0, 0} 847 } 848 }, 849 {1, 0, 2, 0, /* 0x6f */ 850 {{0, 3}, 851 {5, 6}, 852 {0, 0}, 853 {0, 0} 854 } 855 }, 856 {0, 0, 1, 0, /* 0x70 */ 857 {{4, 6}, 858 {0, 0}, 859 {0, 0}, 860 {0, 0} 861 } 862 }, 863 {1, 0, 2, 0, /* 0x71 */ 864 {{0, 0}, 865 {4, 6}, 866 {0, 0}, 867 {0, 0} 868 } 869 }, 870 {0, 0, 2, 0, /* 0x72 */ 871 {{1, 1}, 872 {4, 6}, 873 {0, 0}, 874 {0, 0} 875 } 876 }, 877 {1, 0, 2, 0, /* 0x73 */ 878 {{0, 1}, 879 {4, 6}, 880 {0, 0}, 881 {0, 0} 882 } 883 }, 884 {0, 0, 2, 0, /* 0x74 */ 885 {{2, 2}, 886 {4, 6}, 887 {0, 0}, 888 {0, 0} 889 } 890 }, 891 {1, 0, 3, 0, /* 0x75 */ 892 {{0, 0}, 893 {2, 2}, 894 {4, 6}, 895 {0, 0} 896 } 897 }, 898 {0, 0, 2, 0, /* 0x76 */ 899 {{1, 2}, 900 {4, 6}, 901 {0, 0}, 902 {0, 0} 903 } 904 }, 905 {1, 0, 2, 0, /* 0x77 */ 906 {{0, 2}, 907 {4, 6}, 908 {0, 0}, 909 {0, 0} 910 } 911 }, 912 {0, 0, 1, 0, /* 0x78 */ 913 {{3, 6}, 914 {0, 0}, 915 {0, 0}, 916 {0, 0} 917 } 918 }, 919 {1, 0, 2, 0, /* 0x79 */ 920 {{0, 0}, 921 {3, 6}, 922 {0, 0}, 923 {0, 0} 924 } 925 }, 926 {0, 0, 2, 0, /* 0x7a */ 927 {{1, 1}, 928 {3, 6}, 929 {0, 0}, 930 {0, 0} 931 } 932 }, 933 {1, 0, 2, 0, /* 0x7b */ 934 {{0, 1}, 935 {3, 6}, 936 {0, 0}, 937 {0, 0} 938 } 939 }, 940 {0, 0, 1, 0, /* 0x7c */ 941 {{2, 6}, 942 {0, 0}, 943 {0, 0}, 944 {0, 0} 945 } 946 }, 947 {1, 0, 2, 0, /* 0x7d */ 948 {{0, 0}, 949 {2, 6}, 950 {0, 0}, 951 {0, 0} 952 } 953 }, 954 {0, 0, 1, 0, /* 0x7e */ 955 {{1, 6}, 956 {0, 0}, 957 {0, 0}, 958 {0, 0} 959 } 960 }, 961 {1, 0, 1, 0, /* 0x7f */ 962 {{0, 6}, 963 {0, 0}, 964 {0, 0}, 965 {0, 0} 966 } 967 }, 968 {0, 1, 1, 0, /* 0x80 */ 969 {{7, 7}, 970 {0, 0}, 971 {0, 0}, 972 {0, 0} 973 } 974 }, 975 {1, 1, 2, 0, /* 0x81 */ 976 {{0, 0}, 977 {7, 7}, 978 {0, 0}, 979 {0, 0} 980 } 981 }, 982 {0, 1, 2, 0, /* 0x82 */ 983 {{1, 1}, 984 {7, 7}, 985 {0, 0}, 986 {0, 0} 987 } 988 }, 989 {1, 1, 2, 0, /* 0x83 */ 990 {{0, 1}, 991 {7, 7}, 992 {0, 0}, 993 {0, 0} 994 } 995 }, 996 {0, 1, 2, 0, /* 0x84 */ 997 {{2, 2}, 998 {7, 7}, 999 {0, 0}, 1000 {0, 0} 1001 } 1002 }, 1003 {1, 1, 3, 0, /* 0x85 */ 1004 {{0, 0}, 1005 {2, 2}, 1006 {7, 7}, 1007 {0, 0} 1008 } 1009 }, 1010 {0, 1, 2, 0, /* 0x86 */ 1011 {{1, 2}, 1012 {7, 7}, 1013 {0, 0}, 1014 {0, 0} 1015 } 1016 }, 1017 {1, 1, 2, 0, /* 0x87 */ 1018 {{0, 2}, 1019 {7, 7}, 1020 {0, 0}, 1021 {0, 0} 1022 } 1023 }, 1024 {0, 1, 2, 0, /* 0x88 */ 1025 {{3, 3}, 1026 {7, 7}, 1027 {0, 0}, 1028 {0, 0} 1029 } 1030 }, 1031 {1, 1, 3, 0, /* 0x89 */ 1032 {{0, 0}, 1033 {3, 3}, 1034 {7, 7}, 1035 {0, 0} 1036 } 1037 }, 1038 {0, 1, 3, 0, /* 0x8a */ 1039 {{1, 1}, 1040 {3, 3}, 1041 {7, 7}, 1042 {0, 0} 1043 } 1044 }, 1045 {1, 1, 3, 0, /* 0x8b */ 1046 {{0, 1}, 1047 {3, 3}, 1048 {7, 7}, 1049 {0, 0} 1050 } 1051 }, 1052 {0, 1, 2, 0, /* 0x8c */ 1053 {{2, 3}, 1054 {7, 7}, 1055 {0, 0}, 1056 {0, 0} 1057 } 1058 }, 1059 {1, 1, 3, 0, /* 0x8d */ 1060 {{0, 0}, 1061 {2, 3}, 1062 {7, 7}, 1063 {0, 0} 1064 } 1065 }, 1066 {0, 1, 2, 0, /* 0x8e */ 1067 {{1, 3}, 1068 {7, 7}, 1069 {0, 0}, 1070 {0, 0} 1071 } 1072 }, 1073 {1, 1, 2, 0, /* 0x8f */ 1074 {{0, 3}, 1075 {7, 7}, 1076 {0, 0}, 1077 {0, 0} 1078 } 1079 }, 1080 {0, 1, 2, 0, /* 0x90 */ 1081 {{4, 4}, 1082 {7, 7}, 1083 {0, 0}, 1084 {0, 0} 1085 } 1086 }, 1087 {1, 1, 3, 0, /* 0x91 */ 1088 {{0, 0}, 1089 {4, 4}, 1090 {7, 7}, 1091 {0, 0} 1092 } 1093 }, 1094 {0, 1, 3, 0, /* 0x92 */ 1095 {{1, 1}, 1096 {4, 4}, 1097 {7, 7}, 1098 {0, 0} 1099 } 1100 }, 1101 {1, 1, 3, 0, /* 0x93 */ 1102 {{0, 1}, 1103 {4, 4}, 1104 {7, 7}, 1105 {0, 0} 1106 } 1107 }, 1108 {0, 1, 3, 0, /* 0x94 */ 1109 {{2, 2}, 1110 {4, 4}, 1111 {7, 7}, 1112 {0, 0} 1113 } 1114 }, 1115 {1, 1, 4, 0, /* 0x95 */ 1116 {{0, 0}, 1117 {2, 2}, 1118 {4, 4}, 1119 {7, 7} 1120 } 1121 }, 1122 {0, 1, 3, 0, /* 0x96 */ 1123 {{1, 2}, 1124 {4, 4}, 1125 {7, 7}, 1126 {0, 0} 1127 } 1128 }, 1129 {1, 1, 3, 0, /* 0x97 */ 1130 {{0, 2}, 1131 {4, 4}, 1132 {7, 7}, 1133 {0, 0} 1134 } 1135 }, 1136 {0, 1, 2, 0, /* 0x98 */ 1137 {{3, 4}, 1138 {7, 7}, 1139 {0, 0}, 1140 {0, 0} 1141 } 1142 }, 1143 {1, 1, 3, 0, /* 0x99 */ 1144 {{0, 0}, 1145 {3, 4}, 1146 {7, 7}, 1147 {0, 0} 1148 } 1149 }, 1150 {0, 1, 3, 0, /* 0x9a */ 1151 {{1, 1}, 1152 {3, 4}, 1153 {7, 7}, 1154 {0, 0} 1155 } 1156 }, 1157 {1, 1, 3, 0, /* 0x9b */ 1158 {{0, 1}, 1159 {3, 4}, 1160 {7, 7}, 1161 {0, 0} 1162 } 1163 }, 1164 {0, 1, 2, 0, /* 0x9c */ 1165 {{2, 4}, 1166 {7, 7}, 1167 {0, 0}, 1168 {0, 0} 1169 } 1170 }, 1171 {1, 1, 3, 0, /* 0x9d */ 1172 {{0, 0}, 1173 {2, 4}, 1174 {7, 7}, 1175 {0, 0} 1176 } 1177 }, 1178 {0, 1, 2, 0, /* 0x9e */ 1179 {{1, 4}, 1180 {7, 7}, 1181 {0, 0}, 1182 {0, 0} 1183 } 1184 }, 1185 {1, 1, 2, 0, /* 0x9f */ 1186 {{0, 4}, 1187 {7, 7}, 1188 {0, 0}, 1189 {0, 0} 1190 } 1191 }, 1192 {0, 1, 2, 0, /* 0xa0 */ 1193 {{5, 5}, 1194 {7, 7}, 1195 {0, 0}, 1196 {0, 0} 1197 } 1198 }, 1199 {1, 1, 3, 0, /* 0xa1 */ 1200 {{0, 0}, 1201 {5, 5}, 1202 {7, 7}, 1203 {0, 0} 1204 } 1205 }, 1206 {0, 1, 3, 0, /* 0xa2 */ 1207 {{1, 1}, 1208 {5, 5}, 1209 {7, 7}, 1210 {0, 0} 1211 } 1212 }, 1213 {1, 1, 3, 0, /* 0xa3 */ 1214 {{0, 1}, 1215 {5, 5}, 1216 {7, 7}, 1217 {0, 0} 1218 } 1219 }, 1220 {0, 1, 3, 0, /* 0xa4 */ 1221 {{2, 2}, 1222 {5, 5}, 1223 {7, 7}, 1224 {0, 0} 1225 } 1226 }, 1227 {1, 1, 4, 0, /* 0xa5 */ 1228 {{0, 0}, 1229 {2, 2}, 1230 {5, 5}, 1231 {7, 7} 1232 } 1233 }, 1234 {0, 1, 3, 0, /* 0xa6 */ 1235 {{1, 2}, 1236 {5, 5}, 1237 {7, 7}, 1238 {0, 0} 1239 } 1240 }, 1241 {1, 1, 3, 0, /* 0xa7 */ 1242 {{0, 2}, 1243 {5, 5}, 1244 {7, 7}, 1245 {0, 0} 1246 } 1247 }, 1248 {0, 1, 3, 0, /* 0xa8 */ 1249 {{3, 3}, 1250 {5, 5}, 1251 {7, 7}, 1252 {0, 0} 1253 } 1254 }, 1255 {1, 1, 4, 0, /* 0xa9 */ 1256 {{0, 0}, 1257 {3, 3}, 1258 {5, 5}, 1259 {7, 7} 1260 } 1261 }, 1262 {0, 1, 4, 0, /* 0xaa */ 1263 {{1, 1}, 1264 {3, 3}, 1265 {5, 5}, 1266 {7, 7} 1267 } 1268 }, 1269 {1, 1, 4, 0, /* 0xab */ 1270 {{0, 1}, 1271 {3, 3}, 1272 {5, 5}, 1273 {7, 7} 1274 } 1275 }, 1276 {0, 1, 3, 0, /* 0xac */ 1277 {{2, 3}, 1278 {5, 5}, 1279 {7, 7}, 1280 {0, 0} 1281 } 1282 }, 1283 {1, 1, 4, 0, /* 0xad */ 1284 {{0, 0}, 1285 {2, 3}, 1286 {5, 5}, 1287 {7, 7} 1288 } 1289 }, 1290 {0, 1, 3, 0, /* 0xae */ 1291 {{1, 3}, 1292 {5, 5}, 1293 {7, 7}, 1294 {0, 0} 1295 } 1296 }, 1297 {1, 1, 3, 0, /* 0xaf */ 1298 {{0, 3}, 1299 {5, 5}, 1300 {7, 7}, 1301 {0, 0} 1302 } 1303 }, 1304 {0, 1, 2, 0, /* 0xb0 */ 1305 {{4, 5}, 1306 {7, 7}, 1307 {0, 0}, 1308 {0, 0} 1309 } 1310 }, 1311 {1, 1, 3, 0, /* 0xb1 */ 1312 {{0, 0}, 1313 {4, 5}, 1314 {7, 7}, 1315 {0, 0} 1316 } 1317 }, 1318 {0, 1, 3, 0, /* 0xb2 */ 1319 {{1, 1}, 1320 {4, 5}, 1321 {7, 7}, 1322 {0, 0} 1323 } 1324 }, 1325 {1, 1, 3, 0, /* 0xb3 */ 1326 {{0, 1}, 1327 {4, 5}, 1328 {7, 7}, 1329 {0, 0} 1330 } 1331 }, 1332 {0, 1, 3, 0, /* 0xb4 */ 1333 {{2, 2}, 1334 {4, 5}, 1335 {7, 7}, 1336 {0, 0} 1337 } 1338 }, 1339 {1, 1, 4, 0, /* 0xb5 */ 1340 {{0, 0}, 1341 {2, 2}, 1342 {4, 5}, 1343 {7, 7} 1344 } 1345 }, 1346 {0, 1, 3, 0, /* 0xb6 */ 1347 {{1, 2}, 1348 {4, 5}, 1349 {7, 7}, 1350 {0, 0} 1351 } 1352 }, 1353 {1, 1, 3, 0, /* 0xb7 */ 1354 {{0, 2}, 1355 {4, 5}, 1356 {7, 7}, 1357 {0, 0} 1358 } 1359 }, 1360 {0, 1, 2, 0, /* 0xb8 */ 1361 {{3, 5}, 1362 {7, 7}, 1363 {0, 0}, 1364 {0, 0} 1365 } 1366 }, 1367 {1, 1, 3, 0, /* 0xb9 */ 1368 {{0, 0}, 1369 {3, 5}, 1370 {7, 7}, 1371 {0, 0} 1372 } 1373 }, 1374 {0, 1, 3, 0, /* 0xba */ 1375 {{1, 1}, 1376 {3, 5}, 1377 {7, 7}, 1378 {0, 0} 1379 } 1380 }, 1381 {1, 1, 3, 0, /* 0xbb */ 1382 {{0, 1}, 1383 {3, 5}, 1384 {7, 7}, 1385 {0, 0} 1386 } 1387 }, 1388 {0, 1, 2, 0, /* 0xbc */ 1389 {{2, 5}, 1390 {7, 7}, 1391 {0, 0}, 1392 {0, 0} 1393 } 1394 }, 1395 {1, 1, 3, 0, /* 0xbd */ 1396 {{0, 0}, 1397 {2, 5}, 1398 {7, 7}, 1399 {0, 0} 1400 } 1401 }, 1402 {0, 1, 2, 0, /* 0xbe */ 1403 {{1, 5}, 1404 {7, 7}, 1405 {0, 0}, 1406 {0, 0} 1407 } 1408 }, 1409 {1, 1, 2, 0, /* 0xbf */ 1410 {{0, 5}, 1411 {7, 7}, 1412 {0, 0}, 1413 {0, 0} 1414 } 1415 }, 1416 {0, 1, 1, 0, /* 0xc0 */ 1417 {{6, 7}, 1418 {0, 0}, 1419 {0, 0}, 1420 {0, 0} 1421 } 1422 }, 1423 {1, 1, 2, 0, /* 0xc1 */ 1424 {{0, 0}, 1425 {6, 7}, 1426 {0, 0}, 1427 {0, 0} 1428 } 1429 }, 1430 {0, 1, 2, 0, /* 0xc2 */ 1431 {{1, 1}, 1432 {6, 7}, 1433 {0, 0}, 1434 {0, 0} 1435 } 1436 }, 1437 {1, 1, 2, 0, /* 0xc3 */ 1438 {{0, 1}, 1439 {6, 7}, 1440 {0, 0}, 1441 {0, 0} 1442 } 1443 }, 1444 {0, 1, 2, 0, /* 0xc4 */ 1445 {{2, 2}, 1446 {6, 7}, 1447 {0, 0}, 1448 {0, 0} 1449 } 1450 }, 1451 {1, 1, 3, 0, /* 0xc5 */ 1452 {{0, 0}, 1453 {2, 2}, 1454 {6, 7}, 1455 {0, 0} 1456 } 1457 }, 1458 {0, 1, 2, 0, /* 0xc6 */ 1459 {{1, 2}, 1460 {6, 7}, 1461 {0, 0}, 1462 {0, 0} 1463 } 1464 }, 1465 {1, 1, 2, 0, /* 0xc7 */ 1466 {{0, 2}, 1467 {6, 7}, 1468 {0, 0}, 1469 {0, 0} 1470 } 1471 }, 1472 {0, 1, 2, 0, /* 0xc8 */ 1473 {{3, 3}, 1474 {6, 7}, 1475 {0, 0}, 1476 {0, 0} 1477 } 1478 }, 1479 {1, 1, 3, 0, /* 0xc9 */ 1480 {{0, 0}, 1481 {3, 3}, 1482 {6, 7}, 1483 {0, 0} 1484 } 1485 }, 1486 {0, 1, 3, 0, /* 0xca */ 1487 {{1, 1}, 1488 {3, 3}, 1489 {6, 7}, 1490 {0, 0} 1491 } 1492 }, 1493 {1, 1, 3, 0, /* 0xcb */ 1494 {{0, 1}, 1495 {3, 3}, 1496 {6, 7}, 1497 {0, 0} 1498 } 1499 }, 1500 {0, 1, 2, 0, /* 0xcc */ 1501 {{2, 3}, 1502 {6, 7}, 1503 {0, 0}, 1504 {0, 0} 1505 } 1506 }, 1507 {1, 1, 3, 0, /* 0xcd */ 1508 {{0, 0}, 1509 {2, 3}, 1510 {6, 7}, 1511 {0, 0} 1512 } 1513 }, 1514 {0, 1, 2, 0, /* 0xce */ 1515 {{1, 3}, 1516 {6, 7}, 1517 {0, 0}, 1518 {0, 0} 1519 } 1520 }, 1521 {1, 1, 2, 0, /* 0xcf */ 1522 {{0, 3}, 1523 {6, 7}, 1524 {0, 0}, 1525 {0, 0} 1526 } 1527 }, 1528 {0, 1, 2, 0, /* 0xd0 */ 1529 {{4, 4}, 1530 {6, 7}, 1531 {0, 0}, 1532 {0, 0} 1533 } 1534 }, 1535 {1, 1, 3, 0, /* 0xd1 */ 1536 {{0, 0}, 1537 {4, 4}, 1538 {6, 7}, 1539 {0, 0} 1540 } 1541 }, 1542 {0, 1, 3, 0, /* 0xd2 */ 1543 {{1, 1}, 1544 {4, 4}, 1545 {6, 7}, 1546 {0, 0} 1547 } 1548 }, 1549 {1, 1, 3, 0, /* 0xd3 */ 1550 {{0, 1}, 1551 {4, 4}, 1552 {6, 7}, 1553 {0, 0} 1554 } 1555 }, 1556 {0, 1, 3, 0, /* 0xd4 */ 1557 {{2, 2}, 1558 {4, 4}, 1559 {6, 7}, 1560 {0, 0} 1561 } 1562 }, 1563 {1, 1, 4, 0, /* 0xd5 */ 1564 {{0, 0}, 1565 {2, 2}, 1566 {4, 4}, 1567 {6, 7} 1568 } 1569 }, 1570 {0, 1, 3, 0, /* 0xd6 */ 1571 {{1, 2}, 1572 {4, 4}, 1573 {6, 7}, 1574 {0, 0} 1575 } 1576 }, 1577 {1, 1, 3, 0, /* 0xd7 */ 1578 {{0, 2}, 1579 {4, 4}, 1580 {6, 7}, 1581 {0, 0} 1582 } 1583 }, 1584 {0, 1, 2, 0, /* 0xd8 */ 1585 {{3, 4}, 1586 {6, 7}, 1587 {0, 0}, 1588 {0, 0} 1589 } 1590 }, 1591 {1, 1, 3, 0, /* 0xd9 */ 1592 {{0, 0}, 1593 {3, 4}, 1594 {6, 7}, 1595 {0, 0} 1596 } 1597 }, 1598 {0, 1, 3, 0, /* 0xda */ 1599 {{1, 1}, 1600 {3, 4}, 1601 {6, 7}, 1602 {0, 0} 1603 } 1604 }, 1605 {1, 1, 3, 0, /* 0xdb */ 1606 {{0, 1}, 1607 {3, 4}, 1608 {6, 7}, 1609 {0, 0} 1610 } 1611 }, 1612 {0, 1, 2, 0, /* 0xdc */ 1613 {{2, 4}, 1614 {6, 7}, 1615 {0, 0}, 1616 {0, 0} 1617 } 1618 }, 1619 {1, 1, 3, 0, /* 0xdd */ 1620 {{0, 0}, 1621 {2, 4}, 1622 {6, 7}, 1623 {0, 0} 1624 } 1625 }, 1626 {0, 1, 2, 0, /* 0xde */ 1627 {{1, 4}, 1628 {6, 7}, 1629 {0, 0}, 1630 {0, 0} 1631 } 1632 }, 1633 {1, 1, 2, 0, /* 0xdf */ 1634 {{0, 4}, 1635 {6, 7}, 1636 {0, 0}, 1637 {0, 0} 1638 } 1639 }, 1640 {0, 1, 1, 0, /* 0xe0 */ 1641 {{5, 7}, 1642 {0, 0}, 1643 {0, 0}, 1644 {0, 0} 1645 } 1646 }, 1647 {1, 1, 2, 0, /* 0xe1 */ 1648 {{0, 0}, 1649 {5, 7}, 1650 {0, 0}, 1651 {0, 0} 1652 } 1653 }, 1654 {0, 1, 2, 0, /* 0xe2 */ 1655 {{1, 1}, 1656 {5, 7}, 1657 {0, 0}, 1658 {0, 0} 1659 } 1660 }, 1661 {1, 1, 2, 0, /* 0xe3 */ 1662 {{0, 1}, 1663 {5, 7}, 1664 {0, 0}, 1665 {0, 0} 1666 } 1667 }, 1668 {0, 1, 2, 0, /* 0xe4 */ 1669 {{2, 2}, 1670 {5, 7}, 1671 {0, 0}, 1672 {0, 0} 1673 } 1674 }, 1675 {1, 1, 3, 0, /* 0xe5 */ 1676 {{0, 0}, 1677 {2, 2}, 1678 {5, 7}, 1679 {0, 0} 1680 } 1681 }, 1682 {0, 1, 2, 0, /* 0xe6 */ 1683 {{1, 2}, 1684 {5, 7}, 1685 {0, 0}, 1686 {0, 0} 1687 } 1688 }, 1689 {1, 1, 2, 0, /* 0xe7 */ 1690 {{0, 2}, 1691 {5, 7}, 1692 {0, 0}, 1693 {0, 0} 1694 } 1695 }, 1696 {0, 1, 2, 0, /* 0xe8 */ 1697 {{3, 3}, 1698 {5, 7}, 1699 {0, 0}, 1700 {0, 0} 1701 } 1702 }, 1703 {1, 1, 3, 0, /* 0xe9 */ 1704 {{0, 0}, 1705 {3, 3}, 1706 {5, 7}, 1707 {0, 0} 1708 } 1709 }, 1710 {0, 1, 3, 0, /* 0xea */ 1711 {{1, 1}, 1712 {3, 3}, 1713 {5, 7}, 1714 {0, 0} 1715 } 1716 }, 1717 {1, 1, 3, 0, /* 0xeb */ 1718 {{0, 1}, 1719 {3, 3}, 1720 {5, 7}, 1721 {0, 0} 1722 } 1723 }, 1724 {0, 1, 2, 0, /* 0xec */ 1725 {{2, 3}, 1726 {5, 7}, 1727 {0, 0}, 1728 {0, 0} 1729 } 1730 }, 1731 {1, 1, 3, 0, /* 0xed */ 1732 {{0, 0}, 1733 {2, 3}, 1734 {5, 7}, 1735 {0, 0} 1736 } 1737 }, 1738 {0, 1, 2, 0, /* 0xee */ 1739 {{1, 3}, 1740 {5, 7}, 1741 {0, 0}, 1742 {0, 0} 1743 } 1744 }, 1745 {1, 1, 2, 0, /* 0xef */ 1746 {{0, 3}, 1747 {5, 7}, 1748 {0, 0}, 1749 {0, 0} 1750 } 1751 }, 1752 {0, 1, 1, 0, /* 0xf0 */ 1753 {{4, 7}, 1754 {0, 0}, 1755 {0, 0}, 1756 {0, 0} 1757 } 1758 }, 1759 {1, 1, 2, 0, /* 0xf1 */ 1760 {{0, 0}, 1761 {4, 7}, 1762 {0, 0}, 1763 {0, 0} 1764 } 1765 }, 1766 {0, 1, 2, 0, /* 0xf2 */ 1767 {{1, 1}, 1768 {4, 7}, 1769 {0, 0}, 1770 {0, 0} 1771 } 1772 }, 1773 {1, 1, 2, 0, /* 0xf3 */ 1774 {{0, 1}, 1775 {4, 7}, 1776 {0, 0}, 1777 {0, 0} 1778 } 1779 }, 1780 {0, 1, 2, 0, /* 0xf4 */ 1781 {{2, 2}, 1782 {4, 7}, 1783 {0, 0}, 1784 {0, 0} 1785 } 1786 }, 1787 {1, 1, 3, 0, /* 0xf5 */ 1788 {{0, 0}, 1789 {2, 2}, 1790 {4, 7}, 1791 {0, 0} 1792 } 1793 }, 1794 {0, 1, 2, 0, /* 0xf6 */ 1795 {{1, 2}, 1796 {4, 7}, 1797 {0, 0}, 1798 {0, 0} 1799 } 1800 }, 1801 {1, 1, 2, 0, /* 0xf7 */ 1802 {{0, 2}, 1803 {4, 7}, 1804 {0, 0}, 1805 {0, 0} 1806 } 1807 }, 1808 {0, 1, 1, 0, /* 0xf8 */ 1809 {{3, 7}, 1810 {0, 0}, 1811 {0, 0}, 1812 {0, 0} 1813 } 1814 }, 1815 {1, 1, 2, 0, /* 0xf9 */ 1816 {{0, 0}, 1817 {3, 7}, 1818 {0, 0}, 1819 {0, 0} 1820 } 1821 }, 1822 {0, 1, 2, 0, /* 0xfa */ 1823 {{1, 1}, 1824 {3, 7}, 1825 {0, 0}, 1826 {0, 0} 1827 } 1828 }, 1829 {1, 1, 2, 0, /* 0xfb */ 1830 {{0, 1}, 1831 {3, 7}, 1832 {0, 0}, 1833 {0, 0} 1834 } 1835 }, 1836 {0, 1, 1, 0, /* 0xfc */ 1837 {{2, 7}, 1838 {0, 0}, 1839 {0, 0}, 1840 {0, 0} 1841 } 1842 }, 1843 {1, 1, 2, 0, /* 0xfd */ 1844 {{0, 0}, 1845 {2, 7}, 1846 {0, 0}, 1847 {0, 0} 1848 } 1849 }, 1850 {0, 1, 1, 0, /* 0xfe */ 1851 {{1, 7}, 1852 {0, 0}, 1853 {0, 0}, 1854 {0, 0} 1855 } 1856 }, 1857 {1, 1, 1, 0, /* 0xff */ 1858 {{0, 7}, 1859 {0, 0}, 1860 {0, 0}, 1861 {0, 0} 1862 } 1863 } 1864 }; 1865 1866 int 1867 sctp_is_address_in_scope(struct sctp_ifa *ifa, 1868 struct sctp_scoping *scope, 1869 int do_update) 1870 { 1871 if ((scope->loopback_scope == 0) && 1872 (ifa->ifn_p) && SCTP_IFN_IS_IFT_LOOP(ifa->ifn_p)) { 1873 /* 1874 * skip loopback if not in scope * 1875 */ 1876 return (0); 1877 } 1878 switch (ifa->address.sa.sa_family) { 1879 #ifdef INET 1880 case AF_INET: 1881 if (scope->ipv4_addr_legal) { 1882 struct sockaddr_in *sin; 1883 1884 sin = &ifa->address.sin; 1885 if (sin->sin_addr.s_addr == 0) { 1886 /* not in scope , unspecified */ 1887 return (0); 1888 } 1889 if ((scope->ipv4_local_scope == 0) && 1890 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 1891 /* private address not in scope */ 1892 return (0); 1893 } 1894 } else { 1895 return (0); 1896 } 1897 break; 1898 #endif 1899 #ifdef INET6 1900 case AF_INET6: 1901 if (scope->ipv6_addr_legal) { 1902 struct sockaddr_in6 *sin6; 1903 1904 /* 1905 * Must update the flags, bummer, which means any 1906 * IFA locks must now be applied HERE <-> 1907 */ 1908 if (do_update) { 1909 sctp_gather_internal_ifa_flags(ifa); 1910 } 1911 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 1912 return (0); 1913 } 1914 /* ok to use deprecated addresses? */ 1915 sin6 = &ifa->address.sin6; 1916 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1917 /* skip unspecified addresses */ 1918 return (0); 1919 } 1920 if ( /* (local_scope == 0) && */ 1921 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) { 1922 return (0); 1923 } 1924 if ((scope->site_scope == 0) && 1925 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 1926 return (0); 1927 } 1928 } else { 1929 return (0); 1930 } 1931 break; 1932 #endif 1933 default: 1934 return (0); 1935 } 1936 return (1); 1937 } 1938 1939 static struct mbuf * 1940 sctp_add_addr_to_mbuf(struct mbuf *m, struct sctp_ifa *ifa, uint16_t *len) 1941 { 1942 #if defined(INET) || defined(INET6) 1943 struct sctp_paramhdr *paramh; 1944 struct mbuf *mret; 1945 uint16_t plen; 1946 #endif 1947 1948 switch (ifa->address.sa.sa_family) { 1949 #ifdef INET 1950 case AF_INET: 1951 plen = (uint16_t)sizeof(struct sctp_ipv4addr_param); 1952 break; 1953 #endif 1954 #ifdef INET6 1955 case AF_INET6: 1956 plen = (uint16_t)sizeof(struct sctp_ipv6addr_param); 1957 break; 1958 #endif 1959 default: 1960 return (m); 1961 } 1962 #if defined(INET) || defined(INET6) 1963 if (M_TRAILINGSPACE(m) >= plen) { 1964 /* easy side we just drop it on the end */ 1965 paramh = (struct sctp_paramhdr *)(SCTP_BUF_AT(m, SCTP_BUF_LEN(m))); 1966 mret = m; 1967 } else { 1968 /* Need more space */ 1969 mret = m; 1970 while (SCTP_BUF_NEXT(mret) != NULL) { 1971 mret = SCTP_BUF_NEXT(mret); 1972 } 1973 SCTP_BUF_NEXT(mret) = sctp_get_mbuf_for_msg(plen, 0, M_NOWAIT, 1, MT_DATA); 1974 if (SCTP_BUF_NEXT(mret) == NULL) { 1975 /* We are hosed, can't add more addresses */ 1976 return (m); 1977 } 1978 mret = SCTP_BUF_NEXT(mret); 1979 paramh = mtod(mret, struct sctp_paramhdr *); 1980 } 1981 /* now add the parameter */ 1982 switch (ifa->address.sa.sa_family) { 1983 #ifdef INET 1984 case AF_INET: 1985 { 1986 struct sctp_ipv4addr_param *ipv4p; 1987 struct sockaddr_in *sin; 1988 1989 sin = &ifa->address.sin; 1990 ipv4p = (struct sctp_ipv4addr_param *)paramh; 1991 paramh->param_type = htons(SCTP_IPV4_ADDRESS); 1992 paramh->param_length = htons(plen); 1993 ipv4p->addr = sin->sin_addr.s_addr; 1994 SCTP_BUF_LEN(mret) += plen; 1995 break; 1996 } 1997 #endif 1998 #ifdef INET6 1999 case AF_INET6: 2000 { 2001 struct sctp_ipv6addr_param *ipv6p; 2002 struct sockaddr_in6 *sin6; 2003 2004 sin6 = &ifa->address.sin6; 2005 ipv6p = (struct sctp_ipv6addr_param *)paramh; 2006 paramh->param_type = htons(SCTP_IPV6_ADDRESS); 2007 paramh->param_length = htons(plen); 2008 memcpy(ipv6p->addr, &sin6->sin6_addr, 2009 sizeof(ipv6p->addr)); 2010 /* clear embedded scope in the address */ 2011 in6_clearscope((struct in6_addr *)ipv6p->addr); 2012 SCTP_BUF_LEN(mret) += plen; 2013 break; 2014 } 2015 #endif 2016 default: 2017 return (m); 2018 } 2019 if (len != NULL) { 2020 *len += plen; 2021 } 2022 return (mret); 2023 #endif 2024 } 2025 2026 struct mbuf * 2027 sctp_add_addresses_to_i_ia(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2028 struct sctp_scoping *scope, 2029 struct mbuf *m_at, int cnt_inits_to, 2030 uint16_t *padding_len, uint16_t *chunk_len) 2031 { 2032 struct sctp_vrf *vrf = NULL; 2033 int cnt, limit_out = 0, total_count; 2034 uint32_t vrf_id; 2035 2036 vrf_id = inp->def_vrf_id; 2037 SCTP_IPI_ADDR_RLOCK(); 2038 vrf = sctp_find_vrf(vrf_id); 2039 if (vrf == NULL) { 2040 SCTP_IPI_ADDR_RUNLOCK(); 2041 return (m_at); 2042 } 2043 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 2044 struct sctp_ifa *sctp_ifap; 2045 struct sctp_ifn *sctp_ifnp; 2046 2047 cnt = cnt_inits_to; 2048 if (vrf->total_ifa_count > SCTP_COUNT_LIMIT) { 2049 limit_out = 1; 2050 cnt = SCTP_ADDRESS_LIMIT; 2051 goto skip_count; 2052 } 2053 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2054 if ((scope->loopback_scope == 0) && 2055 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2056 /* 2057 * Skip loopback devices if loopback_scope 2058 * not set 2059 */ 2060 continue; 2061 } 2062 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2063 #ifdef INET 2064 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2065 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2066 &sctp_ifap->address.sin.sin_addr) != 0)) { 2067 continue; 2068 } 2069 #endif 2070 #ifdef INET6 2071 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2072 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2073 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2074 continue; 2075 } 2076 #endif 2077 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2078 continue; 2079 } 2080 if (sctp_is_address_in_scope(sctp_ifap, scope, 1) == 0) { 2081 continue; 2082 } 2083 cnt++; 2084 if (cnt > SCTP_ADDRESS_LIMIT) { 2085 break; 2086 } 2087 } 2088 if (cnt > SCTP_ADDRESS_LIMIT) { 2089 break; 2090 } 2091 } 2092 skip_count: 2093 if (cnt > 1) { 2094 total_count = 0; 2095 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2096 cnt = 0; 2097 if ((scope->loopback_scope == 0) && 2098 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2099 /* 2100 * Skip loopback devices if 2101 * loopback_scope not set 2102 */ 2103 continue; 2104 } 2105 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2106 #ifdef INET 2107 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2108 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2109 &sctp_ifap->address.sin.sin_addr) != 0)) { 2110 continue; 2111 } 2112 #endif 2113 #ifdef INET6 2114 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2115 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2116 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2117 continue; 2118 } 2119 #endif 2120 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2121 continue; 2122 } 2123 if (sctp_is_address_in_scope(sctp_ifap, 2124 scope, 0) == 0) { 2125 continue; 2126 } 2127 if ((chunk_len != NULL) && 2128 (padding_len != NULL) && 2129 (*padding_len > 0)) { 2130 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2131 SCTP_BUF_LEN(m_at) += *padding_len; 2132 *chunk_len += *padding_len; 2133 *padding_len = 0; 2134 } 2135 m_at = sctp_add_addr_to_mbuf(m_at, sctp_ifap, chunk_len); 2136 if (limit_out) { 2137 cnt++; 2138 total_count++; 2139 if (cnt >= 2) { 2140 /* 2141 * two from each 2142 * address 2143 */ 2144 break; 2145 } 2146 if (total_count > SCTP_ADDRESS_LIMIT) { 2147 /* No more addresses */ 2148 break; 2149 } 2150 } 2151 } 2152 } 2153 } 2154 } else { 2155 struct sctp_laddr *laddr; 2156 2157 cnt = cnt_inits_to; 2158 /* First, how many ? */ 2159 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2160 if (laddr->ifa == NULL) { 2161 continue; 2162 } 2163 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) 2164 /* 2165 * Address being deleted by the system, dont 2166 * list. 2167 */ 2168 continue; 2169 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2170 /* 2171 * Address being deleted on this ep don't 2172 * list. 2173 */ 2174 continue; 2175 } 2176 if (sctp_is_address_in_scope(laddr->ifa, 2177 scope, 1) == 0) { 2178 continue; 2179 } 2180 cnt++; 2181 } 2182 /* 2183 * To get through a NAT we only list addresses if we have 2184 * more than one. That way if you just bind a single address 2185 * we let the source of the init dictate our address. 2186 */ 2187 if (cnt > 1) { 2188 cnt = cnt_inits_to; 2189 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2190 if (laddr->ifa == NULL) { 2191 continue; 2192 } 2193 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) { 2194 continue; 2195 } 2196 if (sctp_is_address_in_scope(laddr->ifa, 2197 scope, 0) == 0) { 2198 continue; 2199 } 2200 if ((chunk_len != NULL) && 2201 (padding_len != NULL) && 2202 (*padding_len > 0)) { 2203 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2204 SCTP_BUF_LEN(m_at) += *padding_len; 2205 *chunk_len += *padding_len; 2206 *padding_len = 0; 2207 } 2208 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa, chunk_len); 2209 cnt++; 2210 if (cnt >= SCTP_ADDRESS_LIMIT) { 2211 break; 2212 } 2213 } 2214 } 2215 } 2216 SCTP_IPI_ADDR_RUNLOCK(); 2217 return (m_at); 2218 } 2219 2220 static struct sctp_ifa * 2221 sctp_is_ifa_addr_preferred(struct sctp_ifa *ifa, 2222 uint8_t dest_is_loop, 2223 uint8_t dest_is_priv, 2224 sa_family_t fam) 2225 { 2226 uint8_t dest_is_global = 0; 2227 2228 /* dest_is_priv is true if destination is a private address */ 2229 /* dest_is_loop is true if destination is a loopback addresses */ 2230 2231 /** 2232 * Here we determine if its a preferred address. A preferred address 2233 * means it is the same scope or higher scope then the destination. 2234 * L = loopback, P = private, G = global 2235 * ----------------------------------------- 2236 * src | dest | result 2237 * ---------------------------------------- 2238 * L | L | yes 2239 * ----------------------------------------- 2240 * P | L | yes-v4 no-v6 2241 * ----------------------------------------- 2242 * G | L | yes-v4 no-v6 2243 * ----------------------------------------- 2244 * L | P | no 2245 * ----------------------------------------- 2246 * P | P | yes 2247 * ----------------------------------------- 2248 * G | P | no 2249 * ----------------------------------------- 2250 * L | G | no 2251 * ----------------------------------------- 2252 * P | G | no 2253 * ----------------------------------------- 2254 * G | G | yes 2255 * ----------------------------------------- 2256 */ 2257 2258 if (ifa->address.sa.sa_family != fam) { 2259 /* forget mis-matched family */ 2260 return (NULL); 2261 } 2262 if ((dest_is_priv == 0) && (dest_is_loop == 0)) { 2263 dest_is_global = 1; 2264 } 2265 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Is destination preferred:"); 2266 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ifa->address.sa); 2267 /* Ok the address may be ok */ 2268 #ifdef INET6 2269 if (fam == AF_INET6) { 2270 /* ok to use deprecated addresses? no lets not! */ 2271 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2272 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:1\n"); 2273 return (NULL); 2274 } 2275 if (ifa->src_is_priv && !ifa->src_is_loop) { 2276 if (dest_is_loop) { 2277 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:2\n"); 2278 return (NULL); 2279 } 2280 } 2281 if (ifa->src_is_glob) { 2282 if (dest_is_loop) { 2283 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:3\n"); 2284 return (NULL); 2285 } 2286 } 2287 } 2288 #endif 2289 /* 2290 * Now that we know what is what, implement or table this could in 2291 * theory be done slicker (it used to be), but this is 2292 * straightforward and easier to validate :-) 2293 */ 2294 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src_loop:%d src_priv:%d src_glob:%d\n", 2295 ifa->src_is_loop, ifa->src_is_priv, ifa->src_is_glob); 2296 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dest_loop:%d dest_priv:%d dest_glob:%d\n", 2297 dest_is_loop, dest_is_priv, dest_is_global); 2298 2299 if ((ifa->src_is_loop) && (dest_is_priv)) { 2300 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:4\n"); 2301 return (NULL); 2302 } 2303 if ((ifa->src_is_glob) && (dest_is_priv)) { 2304 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:5\n"); 2305 return (NULL); 2306 } 2307 if ((ifa->src_is_loop) && (dest_is_global)) { 2308 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:6\n"); 2309 return (NULL); 2310 } 2311 if ((ifa->src_is_priv) && (dest_is_global)) { 2312 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:7\n"); 2313 return (NULL); 2314 } 2315 SCTPDBG(SCTP_DEBUG_OUTPUT3, "YES\n"); 2316 /* its a preferred address */ 2317 return (ifa); 2318 } 2319 2320 static struct sctp_ifa * 2321 sctp_is_ifa_addr_acceptable(struct sctp_ifa *ifa, 2322 uint8_t dest_is_loop, 2323 uint8_t dest_is_priv, 2324 sa_family_t fam) 2325 { 2326 uint8_t dest_is_global = 0; 2327 2328 /** 2329 * Here we determine if its a acceptable address. A acceptable 2330 * address means it is the same scope or higher scope but we can 2331 * allow for NAT which means its ok to have a global dest and a 2332 * private src. 2333 * 2334 * L = loopback, P = private, G = global 2335 * ----------------------------------------- 2336 * src | dest | result 2337 * ----------------------------------------- 2338 * L | L | yes 2339 * ----------------------------------------- 2340 * P | L | yes-v4 no-v6 2341 * ----------------------------------------- 2342 * G | L | yes 2343 * ----------------------------------------- 2344 * L | P | no 2345 * ----------------------------------------- 2346 * P | P | yes 2347 * ----------------------------------------- 2348 * G | P | yes - May not work 2349 * ----------------------------------------- 2350 * L | G | no 2351 * ----------------------------------------- 2352 * P | G | yes - May not work 2353 * ----------------------------------------- 2354 * G | G | yes 2355 * ----------------------------------------- 2356 */ 2357 2358 if (ifa->address.sa.sa_family != fam) { 2359 /* forget non matching family */ 2360 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa_fam:%d fam:%d\n", 2361 ifa->address.sa.sa_family, fam); 2362 return (NULL); 2363 } 2364 /* Ok the address may be ok */ 2365 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, &ifa->address.sa); 2366 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst_is_loop:%d dest_is_priv:%d\n", 2367 dest_is_loop, dest_is_priv); 2368 if ((dest_is_loop == 0) && (dest_is_priv == 0)) { 2369 dest_is_global = 1; 2370 } 2371 #ifdef INET6 2372 if (fam == AF_INET6) { 2373 /* ok to use deprecated addresses? */ 2374 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2375 return (NULL); 2376 } 2377 if (ifa->src_is_priv) { 2378 /* Special case, linklocal to loop */ 2379 if (dest_is_loop) 2380 return (NULL); 2381 } 2382 } 2383 #endif 2384 /* 2385 * Now that we know what is what, implement our table. This could in 2386 * theory be done slicker (it used to be), but this is 2387 * straightforward and easier to validate :-) 2388 */ 2389 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_priv:%d\n", 2390 ifa->src_is_loop, 2391 dest_is_priv); 2392 if ((ifa->src_is_loop == 1) && (dest_is_priv)) { 2393 return (NULL); 2394 } 2395 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_glob:%d\n", 2396 ifa->src_is_loop, 2397 dest_is_global); 2398 if ((ifa->src_is_loop == 1) && (dest_is_global)) { 2399 return (NULL); 2400 } 2401 SCTPDBG(SCTP_DEBUG_OUTPUT3, "address is acceptable\n"); 2402 /* its an acceptable address */ 2403 return (ifa); 2404 } 2405 2406 int 2407 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa) 2408 { 2409 struct sctp_laddr *laddr; 2410 2411 if (stcb == NULL) { 2412 /* There are no restrictions, no TCB :-) */ 2413 return (0); 2414 } 2415 LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) { 2416 if (laddr->ifa == NULL) { 2417 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2418 __func__); 2419 continue; 2420 } 2421 if (laddr->ifa == ifa) { 2422 /* Yes it is on the list */ 2423 return (1); 2424 } 2425 } 2426 return (0); 2427 } 2428 2429 int 2430 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa) 2431 { 2432 struct sctp_laddr *laddr; 2433 2434 if (ifa == NULL) 2435 return (0); 2436 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2437 if (laddr->ifa == NULL) { 2438 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2439 __func__); 2440 continue; 2441 } 2442 if ((laddr->ifa == ifa) && laddr->action == 0) 2443 /* same pointer */ 2444 return (1); 2445 } 2446 return (0); 2447 } 2448 2449 static struct sctp_ifa * 2450 sctp_choose_boundspecific_inp(struct sctp_inpcb *inp, 2451 sctp_route_t *ro, 2452 uint32_t vrf_id, 2453 int non_asoc_addr_ok, 2454 uint8_t dest_is_priv, 2455 uint8_t dest_is_loop, 2456 sa_family_t fam) 2457 { 2458 struct sctp_laddr *laddr, *starting_point; 2459 void *ifn; 2460 int resettotop = 0; 2461 struct sctp_ifn *sctp_ifn; 2462 struct sctp_ifa *sctp_ifa, *sifa; 2463 struct sctp_vrf *vrf; 2464 uint32_t ifn_index; 2465 2466 vrf = sctp_find_vrf(vrf_id); 2467 if (vrf == NULL) 2468 return (NULL); 2469 2470 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2471 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2472 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2473 /* 2474 * first question, is the ifn we will emit on in our list, if so, we 2475 * want such an address. Note that we first looked for a preferred 2476 * address. 2477 */ 2478 if (sctp_ifn) { 2479 /* is a preferred one on the interface we route out? */ 2480 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2481 #ifdef INET 2482 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2483 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2484 &sctp_ifa->address.sin.sin_addr) != 0)) { 2485 continue; 2486 } 2487 #endif 2488 #ifdef INET6 2489 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2490 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2491 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2492 continue; 2493 } 2494 #endif 2495 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2496 (non_asoc_addr_ok == 0)) 2497 continue; 2498 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, 2499 dest_is_loop, 2500 dest_is_priv, fam); 2501 if (sifa == NULL) 2502 continue; 2503 if (sctp_is_addr_in_ep(inp, sifa)) { 2504 atomic_add_int(&sifa->refcount, 1); 2505 return (sifa); 2506 } 2507 } 2508 } 2509 /* 2510 * ok, now we now need to find one on the list of the addresses. We 2511 * can't get one on the emitting interface so let's find first a 2512 * preferred one. If not that an acceptable one otherwise... we 2513 * return NULL. 2514 */ 2515 starting_point = inp->next_addr_touse; 2516 once_again: 2517 if (inp->next_addr_touse == NULL) { 2518 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2519 resettotop = 1; 2520 } 2521 for (laddr = inp->next_addr_touse; laddr; 2522 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2523 if (laddr->ifa == NULL) { 2524 /* address has been removed */ 2525 continue; 2526 } 2527 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2528 /* address is being deleted */ 2529 continue; 2530 } 2531 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, 2532 dest_is_priv, fam); 2533 if (sifa == NULL) 2534 continue; 2535 atomic_add_int(&sifa->refcount, 1); 2536 return (sifa); 2537 } 2538 if (resettotop == 0) { 2539 inp->next_addr_touse = NULL; 2540 goto once_again; 2541 } 2542 2543 inp->next_addr_touse = starting_point; 2544 resettotop = 0; 2545 once_again_too: 2546 if (inp->next_addr_touse == NULL) { 2547 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2548 resettotop = 1; 2549 } 2550 2551 /* ok, what about an acceptable address in the inp */ 2552 for (laddr = inp->next_addr_touse; laddr; 2553 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2554 if (laddr->ifa == NULL) { 2555 /* address has been removed */ 2556 continue; 2557 } 2558 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2559 /* address is being deleted */ 2560 continue; 2561 } 2562 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2563 dest_is_priv, fam); 2564 if (sifa == NULL) 2565 continue; 2566 atomic_add_int(&sifa->refcount, 1); 2567 return (sifa); 2568 } 2569 if (resettotop == 0) { 2570 inp->next_addr_touse = NULL; 2571 goto once_again_too; 2572 } 2573 2574 /* 2575 * no address bound can be a source for the destination we are in 2576 * trouble 2577 */ 2578 return (NULL); 2579 } 2580 2581 static struct sctp_ifa * 2582 sctp_choose_boundspecific_stcb(struct sctp_inpcb *inp, 2583 struct sctp_tcb *stcb, 2584 sctp_route_t *ro, 2585 uint32_t vrf_id, 2586 uint8_t dest_is_priv, 2587 uint8_t dest_is_loop, 2588 int non_asoc_addr_ok, 2589 sa_family_t fam) 2590 { 2591 struct sctp_laddr *laddr, *starting_point; 2592 void *ifn; 2593 struct sctp_ifn *sctp_ifn; 2594 struct sctp_ifa *sctp_ifa, *sifa; 2595 uint8_t start_at_beginning = 0; 2596 struct sctp_vrf *vrf; 2597 uint32_t ifn_index; 2598 2599 /* 2600 * first question, is the ifn we will emit on in our list, if so, we 2601 * want that one. 2602 */ 2603 vrf = sctp_find_vrf(vrf_id); 2604 if (vrf == NULL) 2605 return (NULL); 2606 2607 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2608 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2609 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2610 2611 /* 2612 * first question, is the ifn we will emit on in our list? If so, 2613 * we want that one. First we look for a preferred. Second, we go 2614 * for an acceptable. 2615 */ 2616 if (sctp_ifn) { 2617 /* first try for a preferred address on the ep */ 2618 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2619 #ifdef INET 2620 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2621 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2622 &sctp_ifa->address.sin.sin_addr) != 0)) { 2623 continue; 2624 } 2625 #endif 2626 #ifdef INET6 2627 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2628 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2629 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2630 continue; 2631 } 2632 #endif 2633 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2634 continue; 2635 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2636 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2637 if (sifa == NULL) 2638 continue; 2639 if (((non_asoc_addr_ok == 0) && 2640 (sctp_is_addr_restricted(stcb, sifa))) || 2641 (non_asoc_addr_ok && 2642 (sctp_is_addr_restricted(stcb, sifa)) && 2643 (!sctp_is_addr_pending(stcb, sifa)))) { 2644 /* on the no-no list */ 2645 continue; 2646 } 2647 atomic_add_int(&sifa->refcount, 1); 2648 return (sifa); 2649 } 2650 } 2651 /* next try for an acceptable address on the ep */ 2652 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2653 #ifdef INET 2654 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2655 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2656 &sctp_ifa->address.sin.sin_addr) != 0)) { 2657 continue; 2658 } 2659 #endif 2660 #ifdef INET6 2661 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2662 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2663 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2664 continue; 2665 } 2666 #endif 2667 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2668 continue; 2669 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2670 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2671 if (sifa == NULL) 2672 continue; 2673 if (((non_asoc_addr_ok == 0) && 2674 (sctp_is_addr_restricted(stcb, sifa))) || 2675 (non_asoc_addr_ok && 2676 (sctp_is_addr_restricted(stcb, sifa)) && 2677 (!sctp_is_addr_pending(stcb, sifa)))) { 2678 /* on the no-no list */ 2679 continue; 2680 } 2681 atomic_add_int(&sifa->refcount, 1); 2682 return (sifa); 2683 } 2684 } 2685 } 2686 /* 2687 * if we can't find one like that then we must look at all addresses 2688 * bound to pick one at first preferable then secondly acceptable. 2689 */ 2690 starting_point = stcb->asoc.last_used_address; 2691 sctp_from_the_top: 2692 if (stcb->asoc.last_used_address == NULL) { 2693 start_at_beginning = 1; 2694 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2695 } 2696 /* search beginning with the last used address */ 2697 for (laddr = stcb->asoc.last_used_address; laddr; 2698 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2699 if (laddr->ifa == NULL) { 2700 /* address has been removed */ 2701 continue; 2702 } 2703 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2704 /* address is being deleted */ 2705 continue; 2706 } 2707 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, dest_is_priv, fam); 2708 if (sifa == NULL) 2709 continue; 2710 if (((non_asoc_addr_ok == 0) && 2711 (sctp_is_addr_restricted(stcb, sifa))) || 2712 (non_asoc_addr_ok && 2713 (sctp_is_addr_restricted(stcb, sifa)) && 2714 (!sctp_is_addr_pending(stcb, sifa)))) { 2715 /* on the no-no list */ 2716 continue; 2717 } 2718 stcb->asoc.last_used_address = laddr; 2719 atomic_add_int(&sifa->refcount, 1); 2720 return (sifa); 2721 } 2722 if (start_at_beginning == 0) { 2723 stcb->asoc.last_used_address = NULL; 2724 goto sctp_from_the_top; 2725 } 2726 /* now try for any higher scope than the destination */ 2727 stcb->asoc.last_used_address = starting_point; 2728 start_at_beginning = 0; 2729 sctp_from_the_top2: 2730 if (stcb->asoc.last_used_address == NULL) { 2731 start_at_beginning = 1; 2732 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2733 } 2734 /* search beginning with the last used address */ 2735 for (laddr = stcb->asoc.last_used_address; laddr; 2736 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2737 if (laddr->ifa == NULL) { 2738 /* address has been removed */ 2739 continue; 2740 } 2741 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2742 /* address is being deleted */ 2743 continue; 2744 } 2745 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2746 dest_is_priv, fam); 2747 if (sifa == NULL) 2748 continue; 2749 if (((non_asoc_addr_ok == 0) && 2750 (sctp_is_addr_restricted(stcb, sifa))) || 2751 (non_asoc_addr_ok && 2752 (sctp_is_addr_restricted(stcb, sifa)) && 2753 (!sctp_is_addr_pending(stcb, sifa)))) { 2754 /* on the no-no list */ 2755 continue; 2756 } 2757 stcb->asoc.last_used_address = laddr; 2758 atomic_add_int(&sifa->refcount, 1); 2759 return (sifa); 2760 } 2761 if (start_at_beginning == 0) { 2762 stcb->asoc.last_used_address = NULL; 2763 goto sctp_from_the_top2; 2764 } 2765 return (NULL); 2766 } 2767 2768 static struct sctp_ifa * 2769 sctp_select_nth_preferred_addr_from_ifn_boundall(struct sctp_ifn *ifn, 2770 struct sctp_inpcb *inp, 2771 struct sctp_tcb *stcb, 2772 int non_asoc_addr_ok, 2773 uint8_t dest_is_loop, 2774 uint8_t dest_is_priv, 2775 int addr_wanted, 2776 sa_family_t fam, 2777 sctp_route_t *ro) 2778 { 2779 struct sctp_ifa *ifa, *sifa; 2780 int num_eligible_addr = 0; 2781 #ifdef INET6 2782 struct sockaddr_in6 sin6, lsa6; 2783 2784 if (fam == AF_INET6) { 2785 memcpy(&sin6, &ro->ro_dst, sizeof(struct sockaddr_in6)); 2786 (void)sa6_recoverscope(&sin6); 2787 } 2788 #endif /* INET6 */ 2789 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2790 #ifdef INET 2791 if ((ifa->address.sa.sa_family == AF_INET) && 2792 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2793 &ifa->address.sin.sin_addr) != 0)) { 2794 continue; 2795 } 2796 #endif 2797 #ifdef INET6 2798 if ((ifa->address.sa.sa_family == AF_INET6) && 2799 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2800 &ifa->address.sin6.sin6_addr) != 0)) { 2801 continue; 2802 } 2803 #endif 2804 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2805 (non_asoc_addr_ok == 0)) 2806 continue; 2807 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2808 dest_is_priv, fam); 2809 if (sifa == NULL) 2810 continue; 2811 #ifdef INET6 2812 if (fam == AF_INET6 && 2813 dest_is_loop && 2814 sifa->src_is_loop && sifa->src_is_priv) { 2815 /* 2816 * don't allow fe80::1 to be a src on loop ::1, we 2817 * don't list it to the peer so we will get an 2818 * abort. 2819 */ 2820 continue; 2821 } 2822 if (fam == AF_INET6 && 2823 IN6_IS_ADDR_LINKLOCAL(&sifa->address.sin6.sin6_addr) && 2824 IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) { 2825 /* 2826 * link-local <-> link-local must belong to the same 2827 * scope. 2828 */ 2829 memcpy(&lsa6, &sifa->address.sin6, sizeof(struct sockaddr_in6)); 2830 (void)sa6_recoverscope(&lsa6); 2831 if (sin6.sin6_scope_id != lsa6.sin6_scope_id) { 2832 continue; 2833 } 2834 } 2835 #endif /* INET6 */ 2836 2837 /* 2838 * Check if the IPv6 address matches to next-hop. In the 2839 * mobile case, old IPv6 address may be not deleted from the 2840 * interface. Then, the interface has previous and new 2841 * addresses. We should use one corresponding to the 2842 * next-hop. (by micchie) 2843 */ 2844 #ifdef INET6 2845 if (stcb && fam == AF_INET6 && 2846 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2847 if (sctp_v6src_match_nexthop(&sifa->address.sin6, ro) == 0) { 2848 continue; 2849 } 2850 } 2851 #endif 2852 #ifdef INET 2853 /* Avoid topologically incorrect IPv4 address */ 2854 if (stcb && fam == AF_INET && 2855 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2856 if (sctp_v4src_match_nexthop(sifa, ro) == 0) { 2857 continue; 2858 } 2859 } 2860 #endif 2861 if (stcb) { 2862 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2863 continue; 2864 } 2865 if (((non_asoc_addr_ok == 0) && 2866 (sctp_is_addr_restricted(stcb, sifa))) || 2867 (non_asoc_addr_ok && 2868 (sctp_is_addr_restricted(stcb, sifa)) && 2869 (!sctp_is_addr_pending(stcb, sifa)))) { 2870 /* 2871 * It is restricted for some reason.. 2872 * probably not yet added. 2873 */ 2874 continue; 2875 } 2876 } 2877 if (num_eligible_addr >= addr_wanted) { 2878 return (sifa); 2879 } 2880 num_eligible_addr++; 2881 } 2882 return (NULL); 2883 } 2884 2885 static int 2886 sctp_count_num_preferred_boundall(struct sctp_ifn *ifn, 2887 struct sctp_inpcb *inp, 2888 struct sctp_tcb *stcb, 2889 int non_asoc_addr_ok, 2890 uint8_t dest_is_loop, 2891 uint8_t dest_is_priv, 2892 sa_family_t fam) 2893 { 2894 struct sctp_ifa *ifa, *sifa; 2895 int num_eligible_addr = 0; 2896 2897 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2898 #ifdef INET 2899 if ((ifa->address.sa.sa_family == AF_INET) && 2900 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2901 &ifa->address.sin.sin_addr) != 0)) { 2902 continue; 2903 } 2904 #endif 2905 #ifdef INET6 2906 if ((ifa->address.sa.sa_family == AF_INET6) && 2907 (stcb != NULL) && 2908 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2909 &ifa->address.sin6.sin6_addr) != 0)) { 2910 continue; 2911 } 2912 #endif 2913 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2914 (non_asoc_addr_ok == 0)) { 2915 continue; 2916 } 2917 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2918 dest_is_priv, fam); 2919 if (sifa == NULL) { 2920 continue; 2921 } 2922 if (stcb) { 2923 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2924 continue; 2925 } 2926 if (((non_asoc_addr_ok == 0) && 2927 (sctp_is_addr_restricted(stcb, sifa))) || 2928 (non_asoc_addr_ok && 2929 (sctp_is_addr_restricted(stcb, sifa)) && 2930 (!sctp_is_addr_pending(stcb, sifa)))) { 2931 /* 2932 * It is restricted for some reason.. 2933 * probably not yet added. 2934 */ 2935 continue; 2936 } 2937 } 2938 num_eligible_addr++; 2939 } 2940 return (num_eligible_addr); 2941 } 2942 2943 static struct sctp_ifa * 2944 sctp_choose_boundall(struct sctp_inpcb *inp, 2945 struct sctp_tcb *stcb, 2946 struct sctp_nets *net, 2947 sctp_route_t *ro, 2948 uint32_t vrf_id, 2949 uint8_t dest_is_priv, 2950 uint8_t dest_is_loop, 2951 int non_asoc_addr_ok, 2952 sa_family_t fam) 2953 { 2954 int cur_addr_num = 0, num_preferred = 0; 2955 void *ifn; 2956 struct sctp_ifn *sctp_ifn, *looked_at = NULL, *emit_ifn; 2957 struct sctp_ifa *sctp_ifa, *sifa; 2958 uint32_t ifn_index; 2959 struct sctp_vrf *vrf; 2960 #ifdef INET 2961 int retried = 0; 2962 #endif 2963 2964 /*- 2965 * For boundall we can use any address in the association. 2966 * If non_asoc_addr_ok is set we can use any address (at least in 2967 * theory). So we look for preferred addresses first. If we find one, 2968 * we use it. Otherwise we next try to get an address on the 2969 * interface, which we should be able to do (unless non_asoc_addr_ok 2970 * is false and we are routed out that way). In these cases where we 2971 * can't use the address of the interface we go through all the 2972 * ifn's looking for an address we can use and fill that in. Punting 2973 * means we send back address 0, which will probably cause problems 2974 * actually since then IP will fill in the address of the route ifn, 2975 * which means we probably already rejected it.. i.e. here comes an 2976 * abort :-<. 2977 */ 2978 vrf = sctp_find_vrf(vrf_id); 2979 if (vrf == NULL) 2980 return (NULL); 2981 2982 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2983 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2984 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn from route:%p ifn_index:%d\n", ifn, ifn_index); 2985 emit_ifn = looked_at = sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2986 if (sctp_ifn == NULL) { 2987 /* ?? We don't have this guy ?? */ 2988 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No ifn emit interface?\n"); 2989 goto bound_all_plan_b; 2990 } 2991 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn_index:%d name:%s is emit interface\n", 2992 ifn_index, sctp_ifn->ifn_name); 2993 2994 if (net) { 2995 cur_addr_num = net->indx_of_eligible_next_to_use; 2996 } 2997 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, 2998 inp, stcb, 2999 non_asoc_addr_ok, 3000 dest_is_loop, 3001 dest_is_priv, fam); 3002 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Found %d preferred source addresses for intf:%s\n", 3003 num_preferred, sctp_ifn->ifn_name); 3004 if (num_preferred == 0) { 3005 /* 3006 * no eligible addresses, we must use some other interface 3007 * address if we can find one. 3008 */ 3009 goto bound_all_plan_b; 3010 } 3011 /* 3012 * Ok we have num_eligible_addr set with how many we can use, this 3013 * may vary from call to call due to addresses being deprecated 3014 * etc.. 3015 */ 3016 if (cur_addr_num >= num_preferred) { 3017 cur_addr_num = 0; 3018 } 3019 /* 3020 * select the nth address from the list (where cur_addr_num is the 3021 * nth) and 0 is the first one, 1 is the second one etc... 3022 */ 3023 SCTPDBG(SCTP_DEBUG_OUTPUT2, "cur_addr_num:%d\n", cur_addr_num); 3024 3025 sctp_ifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3026 dest_is_priv, cur_addr_num, fam, ro); 3027 3028 /* if sctp_ifa is NULL something changed??, fall to plan b. */ 3029 if (sctp_ifa) { 3030 atomic_add_int(&sctp_ifa->refcount, 1); 3031 if (net) { 3032 /* save off where the next one we will want */ 3033 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3034 } 3035 return (sctp_ifa); 3036 } 3037 /* 3038 * plan_b: Look at all interfaces and find a preferred address. If 3039 * no preferred fall through to plan_c. 3040 */ 3041 bound_all_plan_b: 3042 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan B\n"); 3043 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3044 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Examine interface %s\n", 3045 sctp_ifn->ifn_name); 3046 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3047 /* wrong base scope */ 3048 SCTPDBG(SCTP_DEBUG_OUTPUT2, "skip\n"); 3049 continue; 3050 } 3051 if ((sctp_ifn == looked_at) && looked_at) { 3052 /* already looked at this guy */ 3053 SCTPDBG(SCTP_DEBUG_OUTPUT2, "already seen\n"); 3054 continue; 3055 } 3056 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, 3057 dest_is_loop, dest_is_priv, fam); 3058 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3059 "Found ifn:%p %d preferred source addresses\n", 3060 ifn, num_preferred); 3061 if (num_preferred == 0) { 3062 /* None on this interface. */ 3063 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No preferred -- skipping to next\n"); 3064 continue; 3065 } 3066 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3067 "num preferred:%d on interface:%p cur_addr_num:%d\n", 3068 num_preferred, (void *)sctp_ifn, cur_addr_num); 3069 3070 /* 3071 * Ok we have num_eligible_addr set with how many we can 3072 * use, this may vary from call to call due to addresses 3073 * being deprecated etc.. 3074 */ 3075 if (cur_addr_num >= num_preferred) { 3076 cur_addr_num = 0; 3077 } 3078 sifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3079 dest_is_priv, cur_addr_num, fam, ro); 3080 if (sifa == NULL) 3081 continue; 3082 if (net) { 3083 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3084 SCTPDBG(SCTP_DEBUG_OUTPUT2, "we selected %d\n", 3085 cur_addr_num); 3086 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Source:"); 3087 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 3088 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Dest:"); 3089 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &net->ro._l_addr.sa); 3090 } 3091 atomic_add_int(&sifa->refcount, 1); 3092 return (sifa); 3093 } 3094 #ifdef INET 3095 again_with_private_addresses_allowed: 3096 #endif 3097 /* plan_c: do we have an acceptable address on the emit interface */ 3098 sifa = NULL; 3099 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan C: find acceptable on interface\n"); 3100 if (emit_ifn == NULL) { 3101 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jump to Plan D - no emit_ifn\n"); 3102 goto plan_d; 3103 } 3104 LIST_FOREACH(sctp_ifa, &emit_ifn->ifalist, next_ifa) { 3105 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifa:%p\n", (void *)sctp_ifa); 3106 #ifdef INET 3107 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3108 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3109 &sctp_ifa->address.sin.sin_addr) != 0)) { 3110 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3111 continue; 3112 } 3113 #endif 3114 #ifdef INET6 3115 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3116 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3117 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3118 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3119 continue; 3120 } 3121 #endif 3122 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3123 (non_asoc_addr_ok == 0)) { 3124 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Defer\n"); 3125 continue; 3126 } 3127 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, 3128 dest_is_priv, fam); 3129 if (sifa == NULL) { 3130 SCTPDBG(SCTP_DEBUG_OUTPUT2, "IFA not acceptable\n"); 3131 continue; 3132 } 3133 if (stcb) { 3134 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3135 SCTPDBG(SCTP_DEBUG_OUTPUT2, "NOT in scope\n"); 3136 sifa = NULL; 3137 continue; 3138 } 3139 if (((non_asoc_addr_ok == 0) && 3140 (sctp_is_addr_restricted(stcb, sifa))) || 3141 (non_asoc_addr_ok && 3142 (sctp_is_addr_restricted(stcb, sifa)) && 3143 (!sctp_is_addr_pending(stcb, sifa)))) { 3144 /* 3145 * It is restricted for some reason.. 3146 * probably not yet added. 3147 */ 3148 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Its restricted\n"); 3149 sifa = NULL; 3150 continue; 3151 } 3152 } 3153 atomic_add_int(&sifa->refcount, 1); 3154 goto out; 3155 } 3156 plan_d: 3157 /* 3158 * plan_d: We are in trouble. No preferred address on the emit 3159 * interface. And not even a preferred address on all interfaces. Go 3160 * out and see if we can find an acceptable address somewhere 3161 * amongst all interfaces. 3162 */ 3163 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan D looked_at is %p\n", (void *)looked_at); 3164 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3165 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3166 /* wrong base scope */ 3167 continue; 3168 } 3169 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3170 #ifdef INET 3171 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3172 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3173 &sctp_ifa->address.sin.sin_addr) != 0)) { 3174 continue; 3175 } 3176 #endif 3177 #ifdef INET6 3178 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3179 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3180 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3181 continue; 3182 } 3183 #endif 3184 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3185 (non_asoc_addr_ok == 0)) 3186 continue; 3187 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3188 dest_is_loop, 3189 dest_is_priv, fam); 3190 if (sifa == NULL) 3191 continue; 3192 if (stcb) { 3193 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3194 sifa = NULL; 3195 continue; 3196 } 3197 if (((non_asoc_addr_ok == 0) && 3198 (sctp_is_addr_restricted(stcb, sifa))) || 3199 (non_asoc_addr_ok && 3200 (sctp_is_addr_restricted(stcb, sifa)) && 3201 (!sctp_is_addr_pending(stcb, sifa)))) { 3202 /* 3203 * It is restricted for some 3204 * reason.. probably not yet added. 3205 */ 3206 sifa = NULL; 3207 continue; 3208 } 3209 } 3210 goto out; 3211 } 3212 } 3213 #ifdef INET 3214 if (stcb) { 3215 if ((retried == 0) && (stcb->asoc.scope.ipv4_local_scope == 0)) { 3216 stcb->asoc.scope.ipv4_local_scope = 1; 3217 retried = 1; 3218 goto again_with_private_addresses_allowed; 3219 } else if (retried == 1) { 3220 stcb->asoc.scope.ipv4_local_scope = 0; 3221 } 3222 } 3223 #endif 3224 out: 3225 #ifdef INET 3226 if (sifa) { 3227 if (retried == 1) { 3228 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3229 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3230 /* wrong base scope */ 3231 continue; 3232 } 3233 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3234 struct sctp_ifa *tmp_sifa; 3235 3236 #ifdef INET 3237 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3238 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3239 &sctp_ifa->address.sin.sin_addr) != 0)) { 3240 continue; 3241 } 3242 #endif 3243 #ifdef INET6 3244 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3245 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3246 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3247 continue; 3248 } 3249 #endif 3250 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3251 (non_asoc_addr_ok == 0)) 3252 continue; 3253 tmp_sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3254 dest_is_loop, 3255 dest_is_priv, fam); 3256 if (tmp_sifa == NULL) { 3257 continue; 3258 } 3259 if (tmp_sifa == sifa) { 3260 continue; 3261 } 3262 if (stcb) { 3263 if (sctp_is_address_in_scope(tmp_sifa, 3264 &stcb->asoc.scope, 0) == 0) { 3265 continue; 3266 } 3267 if (((non_asoc_addr_ok == 0) && 3268 (sctp_is_addr_restricted(stcb, tmp_sifa))) || 3269 (non_asoc_addr_ok && 3270 (sctp_is_addr_restricted(stcb, tmp_sifa)) && 3271 (!sctp_is_addr_pending(stcb, tmp_sifa)))) { 3272 /* 3273 * It is restricted 3274 * for some reason.. 3275 * probably not yet 3276 * added. 3277 */ 3278 continue; 3279 } 3280 } 3281 if ((tmp_sifa->address.sin.sin_family == AF_INET) && 3282 (IN4_ISPRIVATE_ADDRESS(&(tmp_sifa->address.sin.sin_addr)))) { 3283 sctp_add_local_addr_restricted(stcb, tmp_sifa); 3284 } 3285 } 3286 } 3287 } 3288 atomic_add_int(&sifa->refcount, 1); 3289 } 3290 #endif 3291 return (sifa); 3292 } 3293 3294 /* tcb may be NULL */ 3295 struct sctp_ifa * 3296 sctp_source_address_selection(struct sctp_inpcb *inp, 3297 struct sctp_tcb *stcb, 3298 sctp_route_t *ro, 3299 struct sctp_nets *net, 3300 int non_asoc_addr_ok, uint32_t vrf_id) 3301 { 3302 struct sctp_ifa *answer; 3303 uint8_t dest_is_priv, dest_is_loop; 3304 sa_family_t fam; 3305 #ifdef INET 3306 struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst; 3307 #endif 3308 #ifdef INET6 3309 struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&ro->ro_dst; 3310 #endif 3311 3312 /** 3313 * Rules: 3314 * - Find the route if needed, cache if I can. 3315 * - Look at interface address in route, Is it in the bound list. If so we 3316 * have the best source. 3317 * - If not we must rotate amongst the addresses. 3318 * 3319 * Caveats and issues 3320 * 3321 * Do we need to pay attention to scope. We can have a private address 3322 * or a global address we are sourcing or sending to. So if we draw 3323 * it out 3324 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3325 * For V4 3326 * ------------------------------------------ 3327 * source * dest * result 3328 * ----------------------------------------- 3329 * <a> Private * Global * NAT 3330 * ----------------------------------------- 3331 * <b> Private * Private * No problem 3332 * ----------------------------------------- 3333 * <c> Global * Private * Huh, How will this work? 3334 * ----------------------------------------- 3335 * <d> Global * Global * No Problem 3336 *------------------------------------------ 3337 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3338 * For V6 3339 *------------------------------------------ 3340 * source * dest * result 3341 * ----------------------------------------- 3342 * <a> Linklocal * Global * 3343 * ----------------------------------------- 3344 * <b> Linklocal * Linklocal * No problem 3345 * ----------------------------------------- 3346 * <c> Global * Linklocal * Huh, How will this work? 3347 * ----------------------------------------- 3348 * <d> Global * Global * No Problem 3349 *------------------------------------------ 3350 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3351 * 3352 * And then we add to that what happens if there are multiple addresses 3353 * assigned to an interface. Remember the ifa on a ifn is a linked 3354 * list of addresses. So one interface can have more than one IP 3355 * address. What happens if we have both a private and a global 3356 * address? Do we then use context of destination to sort out which 3357 * one is best? And what about NAT's sending P->G may get you a NAT 3358 * translation, or should you select the G thats on the interface in 3359 * preference. 3360 * 3361 * Decisions: 3362 * 3363 * - count the number of addresses on the interface. 3364 * - if it is one, no problem except case <c>. 3365 * For <a> we will assume a NAT out there. 3366 * - if there are more than one, then we need to worry about scope P 3367 * or G. We should prefer G -> G and P -> P if possible. 3368 * Then as a secondary fall back to mixed types G->P being a last 3369 * ditch one. 3370 * - The above all works for bound all, but bound specific we need to 3371 * use the same concept but instead only consider the bound 3372 * addresses. If the bound set is NOT assigned to the interface then 3373 * we must use rotation amongst the bound addresses.. 3374 */ 3375 if (ro->ro_nh == NULL) { 3376 /* 3377 * Need a route to cache. 3378 */ 3379 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 3380 } 3381 if (ro->ro_nh == NULL) { 3382 return (NULL); 3383 } 3384 fam = ro->ro_dst.sa_family; 3385 dest_is_priv = dest_is_loop = 0; 3386 /* Setup our scopes for the destination */ 3387 switch (fam) { 3388 #ifdef INET 3389 case AF_INET: 3390 /* Scope based on outbound address */ 3391 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) { 3392 dest_is_loop = 1; 3393 if (net != NULL) { 3394 /* mark it as local */ 3395 net->addr_is_local = 1; 3396 } 3397 } else if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) { 3398 dest_is_priv = 1; 3399 } 3400 break; 3401 #endif 3402 #ifdef INET6 3403 case AF_INET6: 3404 /* Scope based on outbound address */ 3405 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr) || 3406 SCTP_ROUTE_IS_REAL_LOOP(ro)) { 3407 /* 3408 * If the address is a loopback address, which 3409 * consists of "::1" OR "fe80::1%lo0", we are 3410 * loopback scope. But we don't use dest_is_priv 3411 * (link local addresses). 3412 */ 3413 dest_is_loop = 1; 3414 if (net != NULL) { 3415 /* mark it as local */ 3416 net->addr_is_local = 1; 3417 } 3418 } else if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) { 3419 dest_is_priv = 1; 3420 } 3421 break; 3422 #endif 3423 } 3424 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Select source addr for:"); 3425 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&ro->ro_dst); 3426 SCTP_IPI_ADDR_RLOCK(); 3427 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3428 /* 3429 * Bound all case 3430 */ 3431 answer = sctp_choose_boundall(inp, stcb, net, ro, vrf_id, 3432 dest_is_priv, dest_is_loop, 3433 non_asoc_addr_ok, fam); 3434 SCTP_IPI_ADDR_RUNLOCK(); 3435 return (answer); 3436 } 3437 /* 3438 * Subset bound case 3439 */ 3440 if (stcb) { 3441 answer = sctp_choose_boundspecific_stcb(inp, stcb, ro, 3442 vrf_id, dest_is_priv, 3443 dest_is_loop, 3444 non_asoc_addr_ok, fam); 3445 } else { 3446 answer = sctp_choose_boundspecific_inp(inp, ro, vrf_id, 3447 non_asoc_addr_ok, 3448 dest_is_priv, 3449 dest_is_loop, fam); 3450 } 3451 SCTP_IPI_ADDR_RUNLOCK(); 3452 return (answer); 3453 } 3454 3455 static bool 3456 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, size_t cpsize) 3457 { 3458 struct cmsghdr cmh; 3459 struct sctp_sndinfo sndinfo; 3460 struct sctp_prinfo prinfo; 3461 struct sctp_authinfo authinfo; 3462 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3463 bool found; 3464 3465 /* 3466 * Independent of how many mbufs, find the c_type inside the control 3467 * structure and copy out the data. 3468 */ 3469 found = false; 3470 tot_len = SCTP_BUF_LEN(control); 3471 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3472 rem_len = tot_len - off; 3473 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3474 /* There is not enough room for one more. */ 3475 return (found); 3476 } 3477 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3478 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3479 /* We dont't have a complete CMSG header. */ 3480 return (found); 3481 } 3482 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3483 /* We don't have the complete CMSG. */ 3484 return (found); 3485 } 3486 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3487 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3488 if ((cmh.cmsg_level == IPPROTO_SCTP) && 3489 ((c_type == cmh.cmsg_type) || 3490 ((c_type == SCTP_SNDRCV) && 3491 ((cmh.cmsg_type == SCTP_SNDINFO) || 3492 (cmh.cmsg_type == SCTP_PRINFO) || 3493 (cmh.cmsg_type == SCTP_AUTHINFO))))) { 3494 if (c_type == cmh.cmsg_type) { 3495 if (cpsize > INT_MAX) { 3496 return (found); 3497 } 3498 if (cmsg_data_len < (int)cpsize) { 3499 return (found); 3500 } 3501 /* It is exactly what we want. Copy it out. */ 3502 m_copydata(control, cmsg_data_off, (int)cpsize, (caddr_t)data); 3503 return (1); 3504 } else { 3505 struct sctp_sndrcvinfo *sndrcvinfo; 3506 3507 sndrcvinfo = (struct sctp_sndrcvinfo *)data; 3508 if (!found) { 3509 if (cpsize < sizeof(struct sctp_sndrcvinfo)) { 3510 return (found); 3511 } 3512 memset(sndrcvinfo, 0, sizeof(struct sctp_sndrcvinfo)); 3513 } 3514 switch (cmh.cmsg_type) { 3515 case SCTP_SNDINFO: 3516 if (cmsg_data_len < (int)sizeof(struct sctp_sndinfo)) { 3517 return (found); 3518 } 3519 m_copydata(control, cmsg_data_off, sizeof(struct sctp_sndinfo), (caddr_t)&sndinfo); 3520 sndrcvinfo->sinfo_stream = sndinfo.snd_sid; 3521 sndrcvinfo->sinfo_flags = sndinfo.snd_flags; 3522 sndrcvinfo->sinfo_ppid = sndinfo.snd_ppid; 3523 sndrcvinfo->sinfo_context = sndinfo.snd_context; 3524 sndrcvinfo->sinfo_assoc_id = sndinfo.snd_assoc_id; 3525 break; 3526 case SCTP_PRINFO: 3527 if (cmsg_data_len < (int)sizeof(struct sctp_prinfo)) { 3528 return (found); 3529 } 3530 m_copydata(control, cmsg_data_off, sizeof(struct sctp_prinfo), (caddr_t)&prinfo); 3531 if (prinfo.pr_policy != SCTP_PR_SCTP_NONE) { 3532 sndrcvinfo->sinfo_timetolive = prinfo.pr_value; 3533 } else { 3534 sndrcvinfo->sinfo_timetolive = 0; 3535 } 3536 sndrcvinfo->sinfo_flags |= prinfo.pr_policy; 3537 break; 3538 case SCTP_AUTHINFO: 3539 if (cmsg_data_len < (int)sizeof(struct sctp_authinfo)) { 3540 return (found); 3541 } 3542 m_copydata(control, cmsg_data_off, sizeof(struct sctp_authinfo), (caddr_t)&authinfo); 3543 sndrcvinfo->sinfo_keynumber_valid = 1; 3544 sndrcvinfo->sinfo_keynumber = authinfo.auth_keynumber; 3545 break; 3546 default: 3547 return (found); 3548 } 3549 found = true; 3550 } 3551 } 3552 } 3553 return (found); 3554 } 3555 3556 static int 3557 sctp_process_cmsgs_for_init(struct sctp_tcb *stcb, struct mbuf *control, int *error) 3558 { 3559 struct cmsghdr cmh; 3560 struct sctp_initmsg initmsg; 3561 #ifdef INET 3562 struct sockaddr_in sin; 3563 #endif 3564 #ifdef INET6 3565 struct sockaddr_in6 sin6; 3566 #endif 3567 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3568 3569 tot_len = SCTP_BUF_LEN(control); 3570 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3571 rem_len = tot_len - off; 3572 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3573 /* There is not enough room for one more. */ 3574 *error = EINVAL; 3575 return (1); 3576 } 3577 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3578 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3579 /* We dont't have a complete CMSG header. */ 3580 *error = EINVAL; 3581 return (1); 3582 } 3583 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3584 /* We don't have the complete CMSG. */ 3585 *error = EINVAL; 3586 return (1); 3587 } 3588 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3589 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3590 if (cmh.cmsg_level == IPPROTO_SCTP) { 3591 switch (cmh.cmsg_type) { 3592 case SCTP_INIT: 3593 if (cmsg_data_len < (int)sizeof(struct sctp_initmsg)) { 3594 *error = EINVAL; 3595 return (1); 3596 } 3597 m_copydata(control, cmsg_data_off, sizeof(struct sctp_initmsg), (caddr_t)&initmsg); 3598 if (initmsg.sinit_max_attempts) 3599 stcb->asoc.max_init_times = initmsg.sinit_max_attempts; 3600 if (initmsg.sinit_num_ostreams) 3601 stcb->asoc.pre_open_streams = initmsg.sinit_num_ostreams; 3602 if (initmsg.sinit_max_instreams) 3603 stcb->asoc.max_inbound_streams = initmsg.sinit_max_instreams; 3604 if (initmsg.sinit_max_init_timeo) 3605 stcb->asoc.initial_init_rto_max = initmsg.sinit_max_init_timeo; 3606 if (stcb->asoc.streamoutcnt < stcb->asoc.pre_open_streams) { 3607 struct sctp_stream_out *tmp_str; 3608 unsigned int i; 3609 #if defined(SCTP_DETAILED_STR_STATS) 3610 int j; 3611 #endif 3612 3613 /* Default is NOT correct */ 3614 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, default:%d pre_open:%d\n", 3615 stcb->asoc.streamoutcnt, stcb->asoc.pre_open_streams); 3616 SCTP_TCB_UNLOCK(stcb); 3617 SCTP_MALLOC(tmp_str, 3618 struct sctp_stream_out *, 3619 (stcb->asoc.pre_open_streams * sizeof(struct sctp_stream_out)), 3620 SCTP_M_STRMO); 3621 SCTP_TCB_LOCK(stcb); 3622 if (tmp_str != NULL) { 3623 SCTP_FREE(stcb->asoc.strmout, SCTP_M_STRMO); 3624 stcb->asoc.strmout = tmp_str; 3625 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt = stcb->asoc.pre_open_streams; 3626 } else { 3627 stcb->asoc.pre_open_streams = stcb->asoc.streamoutcnt; 3628 } 3629 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3630 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 3631 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 3632 stcb->asoc.strmout[i].chunks_on_queues = 0; 3633 #if defined(SCTP_DETAILED_STR_STATS) 3634 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 3635 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 3636 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 3637 } 3638 #else 3639 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 3640 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 3641 #endif 3642 stcb->asoc.strmout[i].next_mid_ordered = 0; 3643 stcb->asoc.strmout[i].next_mid_unordered = 0; 3644 stcb->asoc.strmout[i].sid = i; 3645 stcb->asoc.strmout[i].last_msg_incomplete = 0; 3646 stcb->asoc.strmout[i].state = SCTP_STREAM_OPENING; 3647 } 3648 } 3649 break; 3650 #ifdef INET 3651 case SCTP_DSTADDRV4: 3652 if (cmsg_data_len < (int)sizeof(struct in_addr)) { 3653 *error = EINVAL; 3654 return (1); 3655 } 3656 memset(&sin, 0, sizeof(struct sockaddr_in)); 3657 sin.sin_family = AF_INET; 3658 sin.sin_len = sizeof(struct sockaddr_in); 3659 sin.sin_port = stcb->rport; 3660 m_copydata(control, cmsg_data_off, sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3661 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3662 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3663 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3664 *error = EINVAL; 3665 return (1); 3666 } 3667 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3668 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3669 *error = ENOBUFS; 3670 return (1); 3671 } 3672 break; 3673 #endif 3674 #ifdef INET6 3675 case SCTP_DSTADDRV6: 3676 if (cmsg_data_len < (int)sizeof(struct in6_addr)) { 3677 *error = EINVAL; 3678 return (1); 3679 } 3680 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3681 sin6.sin6_family = AF_INET6; 3682 sin6.sin6_len = sizeof(struct sockaddr_in6); 3683 sin6.sin6_port = stcb->rport; 3684 m_copydata(control, cmsg_data_off, sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3685 if (IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr) || 3686 IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) { 3687 *error = EINVAL; 3688 return (1); 3689 } 3690 #ifdef INET 3691 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3692 in6_sin6_2_sin(&sin, &sin6); 3693 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3694 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3695 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3696 *error = EINVAL; 3697 return (1); 3698 } 3699 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3700 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3701 *error = ENOBUFS; 3702 return (1); 3703 } 3704 } else 3705 #endif 3706 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin6, NULL, stcb->asoc.port, 3707 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3708 *error = ENOBUFS; 3709 return (1); 3710 } 3711 break; 3712 #endif 3713 default: 3714 break; 3715 } 3716 } 3717 } 3718 return (0); 3719 } 3720 3721 #if defined(INET) || defined(INET6) 3722 static struct sctp_tcb * 3723 sctp_findassociation_cmsgs(struct sctp_inpcb **inp_p, 3724 uint16_t port, 3725 struct mbuf *control, 3726 struct sctp_nets **net_p, 3727 int *error) 3728 { 3729 struct cmsghdr cmh; 3730 struct sctp_tcb *stcb; 3731 struct sockaddr *addr; 3732 #ifdef INET 3733 struct sockaddr_in sin; 3734 #endif 3735 #ifdef INET6 3736 struct sockaddr_in6 sin6; 3737 #endif 3738 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3739 3740 tot_len = SCTP_BUF_LEN(control); 3741 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3742 rem_len = tot_len - off; 3743 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3744 /* There is not enough room for one more. */ 3745 *error = EINVAL; 3746 return (NULL); 3747 } 3748 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3749 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3750 /* We dont't have a complete CMSG header. */ 3751 *error = EINVAL; 3752 return (NULL); 3753 } 3754 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3755 /* We don't have the complete CMSG. */ 3756 *error = EINVAL; 3757 return (NULL); 3758 } 3759 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3760 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3761 if (cmh.cmsg_level == IPPROTO_SCTP) { 3762 switch (cmh.cmsg_type) { 3763 #ifdef INET 3764 case SCTP_DSTADDRV4: 3765 if (cmsg_data_len < (int)sizeof(struct in_addr)) { 3766 *error = EINVAL; 3767 return (NULL); 3768 } 3769 memset(&sin, 0, sizeof(struct sockaddr_in)); 3770 sin.sin_family = AF_INET; 3771 sin.sin_len = sizeof(struct sockaddr_in); 3772 sin.sin_port = port; 3773 m_copydata(control, cmsg_data_off, sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3774 addr = (struct sockaddr *)&sin; 3775 break; 3776 #endif 3777 #ifdef INET6 3778 case SCTP_DSTADDRV6: 3779 if (cmsg_data_len < (int)sizeof(struct in6_addr)) { 3780 *error = EINVAL; 3781 return (NULL); 3782 } 3783 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3784 sin6.sin6_family = AF_INET6; 3785 sin6.sin6_len = sizeof(struct sockaddr_in6); 3786 sin6.sin6_port = port; 3787 m_copydata(control, cmsg_data_off, sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3788 #ifdef INET 3789 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3790 in6_sin6_2_sin(&sin, &sin6); 3791 addr = (struct sockaddr *)&sin; 3792 } else 3793 #endif 3794 addr = (struct sockaddr *)&sin6; 3795 break; 3796 #endif 3797 default: 3798 addr = NULL; 3799 break; 3800 } 3801 if (addr) { 3802 stcb = sctp_findassociation_ep_addr(inp_p, addr, net_p, NULL, NULL); 3803 if (stcb != NULL) { 3804 return (stcb); 3805 } 3806 } 3807 } 3808 } 3809 return (NULL); 3810 } 3811 #endif 3812 3813 static struct mbuf * 3814 sctp_add_cookie(struct mbuf *init, int init_offset, 3815 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in, uint8_t **signature) 3816 { 3817 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 3818 struct sctp_state_cookie *stc; 3819 struct sctp_paramhdr *ph; 3820 uint16_t cookie_sz; 3821 3822 mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) + 3823 sizeof(struct sctp_paramhdr)), 0, 3824 M_NOWAIT, 1, MT_DATA); 3825 if (mret == NULL) { 3826 return (NULL); 3827 } 3828 copy_init = SCTP_M_COPYM(init, init_offset, M_COPYALL, M_NOWAIT); 3829 if (copy_init == NULL) { 3830 sctp_m_freem(mret); 3831 return (NULL); 3832 } 3833 #ifdef SCTP_MBUF_LOGGING 3834 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3835 sctp_log_mbc(copy_init, SCTP_MBUF_ICOPY); 3836 } 3837 #endif 3838 copy_initack = SCTP_M_COPYM(initack, initack_offset, M_COPYALL, 3839 M_NOWAIT); 3840 if (copy_initack == NULL) { 3841 sctp_m_freem(mret); 3842 sctp_m_freem(copy_init); 3843 return (NULL); 3844 } 3845 #ifdef SCTP_MBUF_LOGGING 3846 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3847 sctp_log_mbc(copy_initack, SCTP_MBUF_ICOPY); 3848 } 3849 #endif 3850 /* easy side we just drop it on the end */ 3851 ph = mtod(mret, struct sctp_paramhdr *); 3852 SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) + 3853 sizeof(struct sctp_paramhdr); 3854 stc = (struct sctp_state_cookie *)((caddr_t)ph + 3855 sizeof(struct sctp_paramhdr)); 3856 ph->param_type = htons(SCTP_STATE_COOKIE); 3857 ph->param_length = 0; /* fill in at the end */ 3858 /* Fill in the stc cookie data */ 3859 memcpy(stc, stc_in, sizeof(struct sctp_state_cookie)); 3860 3861 /* tack the INIT and then the INIT-ACK onto the chain */ 3862 cookie_sz = 0; 3863 for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3864 cookie_sz += SCTP_BUF_LEN(m_at); 3865 if (SCTP_BUF_NEXT(m_at) == NULL) { 3866 SCTP_BUF_NEXT(m_at) = copy_init; 3867 break; 3868 } 3869 } 3870 for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3871 cookie_sz += SCTP_BUF_LEN(m_at); 3872 if (SCTP_BUF_NEXT(m_at) == NULL) { 3873 SCTP_BUF_NEXT(m_at) = copy_initack; 3874 break; 3875 } 3876 } 3877 for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3878 cookie_sz += SCTP_BUF_LEN(m_at); 3879 if (SCTP_BUF_NEXT(m_at) == NULL) { 3880 break; 3881 } 3882 } 3883 sig = sctp_get_mbuf_for_msg(SCTP_SIGNATURE_SIZE, 0, M_NOWAIT, 1, MT_DATA); 3884 if (sig == NULL) { 3885 /* no space, so free the entire chain */ 3886 sctp_m_freem(mret); 3887 return (NULL); 3888 } 3889 SCTP_BUF_NEXT(m_at) = sig; 3890 SCTP_BUF_LEN(sig) = SCTP_SIGNATURE_SIZE; 3891 cookie_sz += SCTP_SIGNATURE_SIZE; 3892 ph->param_length = htons(cookie_sz); 3893 *signature = (uint8_t *)mtod(sig, caddr_t); 3894 memset(*signature, 0, SCTP_SIGNATURE_SIZE); 3895 return (mret); 3896 } 3897 3898 static uint8_t 3899 sctp_get_ect(struct sctp_tcb *stcb) 3900 { 3901 if ((stcb != NULL) && (stcb->asoc.ecn_supported == 1)) { 3902 return (SCTP_ECT0_BIT); 3903 } else { 3904 return (0); 3905 } 3906 } 3907 3908 #if defined(INET) || defined(INET6) 3909 static void 3910 sctp_handle_no_route(struct sctp_tcb *stcb, 3911 struct sctp_nets *net, 3912 int so_locked) 3913 { 3914 SCTPDBG(SCTP_DEBUG_OUTPUT1, "dropped packet - no valid source addr\n"); 3915 3916 if (net) { 3917 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Destination was "); 3918 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT1, &net->ro._l_addr.sa); 3919 if (net->dest_state & SCTP_ADDR_CONFIRMED) { 3920 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) { 3921 SCTPDBG(SCTP_DEBUG_OUTPUT1, "no route takes interface %p down\n", (void *)net); 3922 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 3923 stcb, 0, 3924 (void *)net, 3925 so_locked); 3926 net->dest_state &= ~SCTP_ADDR_REACHABLE; 3927 net->dest_state &= ~SCTP_ADDR_PF; 3928 } 3929 } 3930 if (stcb) { 3931 if (net == stcb->asoc.primary_destination) { 3932 /* need a new primary */ 3933 struct sctp_nets *alt; 3934 3935 alt = sctp_find_alternate_net(stcb, net, 0); 3936 if (alt != net) { 3937 if (stcb->asoc.alternate) { 3938 sctp_free_remote_addr(stcb->asoc.alternate); 3939 } 3940 stcb->asoc.alternate = alt; 3941 atomic_add_int(&stcb->asoc.alternate->ref_count, 1); 3942 if (net->ro._s_addr) { 3943 sctp_free_ifa(net->ro._s_addr); 3944 net->ro._s_addr = NULL; 3945 } 3946 net->src_addr_selected = 0; 3947 } 3948 } 3949 } 3950 } 3951 } 3952 #endif 3953 3954 static int 3955 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 3956 struct sctp_tcb *stcb, /* may be NULL */ 3957 struct sctp_nets *net, 3958 struct sockaddr *to, 3959 struct mbuf *m, 3960 uint32_t auth_offset, 3961 struct sctp_auth_chunk *auth, 3962 uint16_t auth_keyid, 3963 int nofragment_flag, 3964 int ecn_ok, 3965 int out_of_asoc_ok, 3966 uint16_t src_port, 3967 uint16_t dest_port, 3968 uint32_t v_tag, 3969 uint16_t port, 3970 union sctp_sockstore *over_addr, 3971 uint8_t mflowtype, uint32_t mflowid, 3972 bool use_zero_crc, 3973 int so_locked) 3974 { 3975 /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 3976 /** 3977 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet header 3978 * WITH an SCTPHDR but no IP header, endpoint inp and sa structure: 3979 * - fill in the HMAC digest of any AUTH chunk in the packet. 3980 * - calculate and fill in the SCTP checksum. 3981 * - prepend an IP address header. 3982 * - if boundall use INADDR_ANY. 3983 * - if boundspecific do source address selection. 3984 * - set fragmentation option for ipV4. 3985 * - On return from IP output, check/adjust mtu size of output 3986 * interface and smallest_mtu size as well. 3987 */ 3988 /* Will need ifdefs around this */ 3989 struct mbuf *newm; 3990 struct sctphdr *sctphdr; 3991 int packet_length; 3992 int ret; 3993 #if defined(INET) || defined(INET6) 3994 uint32_t vrf_id; 3995 #endif 3996 #if defined(INET) || defined(INET6) 3997 struct mbuf *o_pak; 3998 sctp_route_t *ro = NULL; 3999 struct udphdr *udp = NULL; 4000 #endif 4001 uint8_t tos_value; 4002 4003 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 4004 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4005 sctp_m_freem(m); 4006 return (EFAULT); 4007 } 4008 #if defined(INET) || defined(INET6) 4009 if (stcb) { 4010 vrf_id = stcb->asoc.vrf_id; 4011 } else { 4012 vrf_id = inp->def_vrf_id; 4013 } 4014 #endif 4015 /* fill in the HMAC digest for any AUTH chunk in the packet */ 4016 if ((auth != NULL) && (stcb != NULL)) { 4017 sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb, auth_keyid); 4018 } 4019 4020 if (net) { 4021 tos_value = net->dscp; 4022 } else if (stcb) { 4023 tos_value = stcb->asoc.default_dscp; 4024 } else { 4025 tos_value = inp->sctp_ep.default_dscp; 4026 } 4027 4028 switch (to->sa_family) { 4029 #ifdef INET 4030 case AF_INET: 4031 { 4032 struct ip *ip = NULL; 4033 sctp_route_t iproute; 4034 int len; 4035 4036 len = SCTP_MIN_V4_OVERHEAD; 4037 if (port) { 4038 len += sizeof(struct udphdr); 4039 } 4040 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4041 if (newm == NULL) { 4042 sctp_m_freem(m); 4043 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4044 return (ENOMEM); 4045 } 4046 SCTP_ALIGN_TO_END(newm, len); 4047 SCTP_BUF_LEN(newm) = len; 4048 SCTP_BUF_NEXT(newm) = m; 4049 m = newm; 4050 if (net != NULL) { 4051 m->m_pkthdr.flowid = net->flowid; 4052 M_HASHTYPE_SET(m, net->flowtype); 4053 } else { 4054 m->m_pkthdr.flowid = mflowid; 4055 M_HASHTYPE_SET(m, mflowtype); 4056 } 4057 packet_length = sctp_calculate_len(m); 4058 ip = mtod(m, struct ip *); 4059 ip->ip_v = IPVERSION; 4060 ip->ip_hl = (sizeof(struct ip) >> 2); 4061 if (tos_value == 0) { 4062 /* 4063 * This means especially, that it is not set 4064 * at the SCTP layer. So use the value from 4065 * the IP layer. 4066 */ 4067 tos_value = inp->ip_inp.inp.inp_ip_tos; 4068 } 4069 tos_value &= 0xfc; 4070 if (ecn_ok) { 4071 tos_value |= sctp_get_ect(stcb); 4072 } 4073 if ((nofragment_flag) && (port == 0)) { 4074 ip->ip_off = htons(IP_DF); 4075 } else { 4076 ip->ip_off = htons(0); 4077 } 4078 /* FreeBSD has a function for ip_id's */ 4079 ip_fillid(ip); 4080 4081 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl; 4082 ip->ip_len = htons(packet_length); 4083 ip->ip_tos = tos_value; 4084 if (port) { 4085 ip->ip_p = IPPROTO_UDP; 4086 } else { 4087 ip->ip_p = IPPROTO_SCTP; 4088 } 4089 ip->ip_sum = 0; 4090 if (net == NULL) { 4091 ro = &iproute; 4092 memset(&iproute, 0, sizeof(iproute)); 4093 memcpy(&ro->ro_dst, to, to->sa_len); 4094 } else { 4095 ro = (sctp_route_t *)&net->ro; 4096 } 4097 /* Now the address selection part */ 4098 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr; 4099 4100 /* call the routine to select the src address */ 4101 if (net && out_of_asoc_ok == 0) { 4102 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4103 sctp_free_ifa(net->ro._s_addr); 4104 net->ro._s_addr = NULL; 4105 net->src_addr_selected = 0; 4106 RO_NHFREE(ro); 4107 } 4108 if (net->src_addr_selected == 0) { 4109 /* Cache the source address */ 4110 net->ro._s_addr = sctp_source_address_selection(inp, stcb, 4111 ro, net, 0, 4112 vrf_id); 4113 net->src_addr_selected = 1; 4114 } 4115 if (net->ro._s_addr == NULL) { 4116 /* No route to host */ 4117 net->src_addr_selected = 0; 4118 sctp_handle_no_route(stcb, net, so_locked); 4119 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4120 sctp_m_freem(m); 4121 return (EHOSTUNREACH); 4122 } 4123 ip->ip_src = net->ro._s_addr->address.sin.sin_addr; 4124 } else { 4125 if (over_addr == NULL) { 4126 struct sctp_ifa *_lsrc; 4127 4128 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4129 net, 4130 out_of_asoc_ok, 4131 vrf_id); 4132 if (_lsrc == NULL) { 4133 sctp_handle_no_route(stcb, net, so_locked); 4134 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4135 sctp_m_freem(m); 4136 return (EHOSTUNREACH); 4137 } 4138 ip->ip_src = _lsrc->address.sin.sin_addr; 4139 sctp_free_ifa(_lsrc); 4140 } else { 4141 ip->ip_src = over_addr->sin.sin_addr; 4142 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4143 } 4144 } 4145 if (port) { 4146 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4147 sctp_handle_no_route(stcb, net, so_locked); 4148 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4149 sctp_m_freem(m); 4150 return (EHOSTUNREACH); 4151 } 4152 udp = (struct udphdr *)((caddr_t)ip + sizeof(struct ip)); 4153 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4154 udp->uh_dport = port; 4155 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip))); 4156 if (V_udp_cksum) { 4157 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 4158 } else { 4159 udp->uh_sum = 0; 4160 } 4161 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4162 } else { 4163 sctphdr = (struct sctphdr *)((caddr_t)ip + sizeof(struct ip)); 4164 } 4165 4166 sctphdr->src_port = src_port; 4167 sctphdr->dest_port = dest_port; 4168 sctphdr->v_tag = v_tag; 4169 sctphdr->checksum = 0; 4170 4171 /* 4172 * If source address selection fails and we find no 4173 * route then the ip_output should fail as well with 4174 * a NO_ROUTE_TO_HOST type error. We probably should 4175 * catch that somewhere and abort the association 4176 * right away (assuming this is an INIT being sent). 4177 */ 4178 if (ro->ro_nh == NULL) { 4179 /* 4180 * src addr selection failed to find a route 4181 * (or valid source addr), so we can't get 4182 * there from here (yet)! 4183 */ 4184 sctp_handle_no_route(stcb, net, so_locked); 4185 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4186 sctp_m_freem(m); 4187 return (EHOSTUNREACH); 4188 } 4189 if (ro != &iproute) { 4190 memcpy(&iproute, ro, sizeof(*ro)); 4191 } 4192 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv4 output routine from low level src addr:%x\n", 4193 (uint32_t)(ntohl(ip->ip_src.s_addr))); 4194 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Destination is %x\n", 4195 (uint32_t)(ntohl(ip->ip_dst.s_addr))); 4196 SCTPDBG(SCTP_DEBUG_OUTPUT3, "RTP route is %p through\n", 4197 (void *)ro->ro_nh); 4198 4199 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4200 /* failed to prepend data, give up */ 4201 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4202 sctp_m_freem(m); 4203 return (ENOMEM); 4204 } 4205 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4206 if (port) { 4207 if (use_zero_crc) { 4208 SCTP_STAT_INCR(sctps_sendzerocrc); 4209 } else { 4210 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip) + sizeof(struct udphdr)); 4211 SCTP_STAT_INCR(sctps_sendswcrc); 4212 } 4213 if (V_udp_cksum) { 4214 SCTP_ENABLE_UDP_CSUM(o_pak); 4215 } 4216 } else { 4217 if (use_zero_crc) { 4218 SCTP_STAT_INCR(sctps_sendzerocrc); 4219 } else { 4220 m->m_pkthdr.csum_flags = CSUM_SCTP; 4221 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4222 SCTP_STAT_INCR(sctps_sendhwcrc); 4223 } 4224 } 4225 #ifdef SCTP_PACKET_LOGGING 4226 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4227 sctp_packet_log(o_pak); 4228 #endif 4229 /* send it out. table id is taken from stcb */ 4230 SCTP_PROBE5(send, NULL, stcb, ip, stcb, sctphdr); 4231 SCTP_IP_OUTPUT(ret, o_pak, ro, inp, vrf_id); 4232 if (port) { 4233 UDPSTAT_INC(udps_opackets); 4234 } 4235 SCTP_STAT_INCR(sctps_sendpackets); 4236 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4237 if (ret) 4238 SCTP_STAT_INCR(sctps_senderrors); 4239 4240 SCTPDBG(SCTP_DEBUG_OUTPUT3, "IP output returns %d\n", ret); 4241 if (net == NULL) { 4242 /* free tempy routes */ 4243 RO_NHFREE(ro); 4244 } else { 4245 if ((ro->ro_nh != NULL) && (net->ro._s_addr) && 4246 ((net->dest_state & SCTP_ADDR_NO_PMTUD) == 0)) { 4247 uint32_t mtu; 4248 4249 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_nh); 4250 if (mtu > 0) { 4251 if (net->port) { 4252 mtu -= sizeof(struct udphdr); 4253 } 4254 if (mtu < net->mtu) { 4255 net->mtu = mtu; 4256 if ((stcb != NULL) && (stcb->asoc.smallest_mtu > mtu)) { 4257 sctp_pathmtu_adjustment(stcb, mtu, true); 4258 } 4259 } 4260 } 4261 } else if (ro->ro_nh == NULL) { 4262 /* route was freed */ 4263 if (net->ro._s_addr && 4264 net->src_addr_selected) { 4265 sctp_free_ifa(net->ro._s_addr); 4266 net->ro._s_addr = NULL; 4267 } 4268 net->src_addr_selected = 0; 4269 } 4270 } 4271 return (ret); 4272 } 4273 #endif 4274 #ifdef INET6 4275 case AF_INET6: 4276 { 4277 uint32_t flowlabel, flowinfo; 4278 struct ip6_hdr *ip6h; 4279 struct route_in6 ip6route; 4280 struct ifnet *ifp; 4281 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 4282 int prev_scope = 0; 4283 struct sockaddr_in6 lsa6_storage; 4284 int error; 4285 u_short prev_port = 0; 4286 int len; 4287 4288 if (net) { 4289 flowlabel = net->flowlabel; 4290 } else if (stcb) { 4291 flowlabel = stcb->asoc.default_flowlabel; 4292 } else { 4293 flowlabel = inp->sctp_ep.default_flowlabel; 4294 } 4295 if (flowlabel == 0) { 4296 /* 4297 * This means especially, that it is not set 4298 * at the SCTP layer. So use the value from 4299 * the IP layer. 4300 */ 4301 flowlabel = ntohl(((struct inpcb *)inp)->inp_flow); 4302 } 4303 flowlabel &= 0x000fffff; 4304 len = SCTP_MIN_OVERHEAD; 4305 if (port) { 4306 len += sizeof(struct udphdr); 4307 } 4308 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4309 if (newm == NULL) { 4310 sctp_m_freem(m); 4311 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4312 return (ENOMEM); 4313 } 4314 SCTP_ALIGN_TO_END(newm, len); 4315 SCTP_BUF_LEN(newm) = len; 4316 SCTP_BUF_NEXT(newm) = m; 4317 m = newm; 4318 if (net != NULL) { 4319 m->m_pkthdr.flowid = net->flowid; 4320 M_HASHTYPE_SET(m, net->flowtype); 4321 } else { 4322 m->m_pkthdr.flowid = mflowid; 4323 M_HASHTYPE_SET(m, mflowtype); 4324 } 4325 packet_length = sctp_calculate_len(m); 4326 4327 ip6h = mtod(m, struct ip6_hdr *); 4328 /* protect *sin6 from overwrite */ 4329 sin6 = (struct sockaddr_in6 *)to; 4330 tmp = *sin6; 4331 sin6 = &tmp; 4332 4333 /* KAME hack: embed scopeid */ 4334 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4335 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4336 sctp_m_freem(m); 4337 return (EINVAL); 4338 } 4339 if (net == NULL) { 4340 memset(&ip6route, 0, sizeof(ip6route)); 4341 ro = (sctp_route_t *)&ip6route; 4342 memcpy(&ro->ro_dst, sin6, sin6->sin6_len); 4343 } else { 4344 ro = (sctp_route_t *)&net->ro; 4345 } 4346 /* 4347 * We assume here that inp_flow is in host byte 4348 * order within the TCB! 4349 */ 4350 if (tos_value == 0) { 4351 /* 4352 * This means especially, that it is not set 4353 * at the SCTP layer. So use the value from 4354 * the IP layer. 4355 */ 4356 tos_value = (ntohl(((struct inpcb *)inp)->inp_flow) >> 20) & 0xff; 4357 } 4358 tos_value &= 0xfc; 4359 if (ecn_ok) { 4360 tos_value |= sctp_get_ect(stcb); 4361 } 4362 flowinfo = 0x06; 4363 flowinfo <<= 8; 4364 flowinfo |= tos_value; 4365 flowinfo <<= 20; 4366 flowinfo |= flowlabel; 4367 ip6h->ip6_flow = htonl(flowinfo); 4368 if (port) { 4369 ip6h->ip6_nxt = IPPROTO_UDP; 4370 } else { 4371 ip6h->ip6_nxt = IPPROTO_SCTP; 4372 } 4373 ip6h->ip6_plen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4374 ip6h->ip6_dst = sin6->sin6_addr; 4375 4376 /* 4377 * Add SRC address selection here: we can only reuse 4378 * to a limited degree the kame src-addr-sel, since 4379 * we can try their selection but it may not be 4380 * bound. 4381 */ 4382 memset(&lsa6_tmp, 0, sizeof(lsa6_tmp)); 4383 lsa6_tmp.sin6_family = AF_INET6; 4384 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 4385 lsa6 = &lsa6_tmp; 4386 if (net && out_of_asoc_ok == 0) { 4387 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4388 sctp_free_ifa(net->ro._s_addr); 4389 net->ro._s_addr = NULL; 4390 net->src_addr_selected = 0; 4391 RO_NHFREE(ro); 4392 } 4393 if (net->src_addr_selected == 0) { 4394 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4395 /* KAME hack: embed scopeid */ 4396 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4397 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4398 sctp_m_freem(m); 4399 return (EINVAL); 4400 } 4401 /* Cache the source address */ 4402 net->ro._s_addr = sctp_source_address_selection(inp, 4403 stcb, 4404 ro, 4405 net, 4406 0, 4407 vrf_id); 4408 (void)sa6_recoverscope(sin6); 4409 net->src_addr_selected = 1; 4410 } 4411 if (net->ro._s_addr == NULL) { 4412 SCTPDBG(SCTP_DEBUG_OUTPUT3, "V6:No route to host\n"); 4413 net->src_addr_selected = 0; 4414 sctp_handle_no_route(stcb, net, so_locked); 4415 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4416 sctp_m_freem(m); 4417 return (EHOSTUNREACH); 4418 } 4419 lsa6->sin6_addr = net->ro._s_addr->address.sin6.sin6_addr; 4420 } else { 4421 sin6 = (struct sockaddr_in6 *)&ro->ro_dst; 4422 /* KAME hack: embed scopeid */ 4423 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4424 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4425 sctp_m_freem(m); 4426 return (EINVAL); 4427 } 4428 if (over_addr == NULL) { 4429 struct sctp_ifa *_lsrc; 4430 4431 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4432 net, 4433 out_of_asoc_ok, 4434 vrf_id); 4435 if (_lsrc == NULL) { 4436 sctp_handle_no_route(stcb, net, so_locked); 4437 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4438 sctp_m_freem(m); 4439 return (EHOSTUNREACH); 4440 } 4441 lsa6->sin6_addr = _lsrc->address.sin6.sin6_addr; 4442 sctp_free_ifa(_lsrc); 4443 } else { 4444 lsa6->sin6_addr = over_addr->sin6.sin6_addr; 4445 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4446 } 4447 (void)sa6_recoverscope(sin6); 4448 } 4449 lsa6->sin6_port = inp->sctp_lport; 4450 4451 if (ro->ro_nh == NULL) { 4452 /* 4453 * src addr selection failed to find a route 4454 * (or valid source addr), so we can't get 4455 * there from here! 4456 */ 4457 sctp_handle_no_route(stcb, net, so_locked); 4458 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4459 sctp_m_freem(m); 4460 return (EHOSTUNREACH); 4461 } 4462 /* 4463 * XXX: sa6 may not have a valid sin6_scope_id in 4464 * the non-SCOPEDROUTING case. 4465 */ 4466 memset(&lsa6_storage, 0, sizeof(lsa6_storage)); 4467 lsa6_storage.sin6_family = AF_INET6; 4468 lsa6_storage.sin6_len = sizeof(lsa6_storage); 4469 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4470 if ((error = sa6_recoverscope(&lsa6_storage)) != 0) { 4471 SCTPDBG(SCTP_DEBUG_OUTPUT3, "recover scope fails error %d\n", error); 4472 sctp_m_freem(m); 4473 return (error); 4474 } 4475 /* XXX */ 4476 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4477 lsa6_storage.sin6_port = inp->sctp_lport; 4478 lsa6 = &lsa6_storage; 4479 ip6h->ip6_src = lsa6->sin6_addr; 4480 4481 if (port) { 4482 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4483 sctp_handle_no_route(stcb, net, so_locked); 4484 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4485 sctp_m_freem(m); 4486 return (EHOSTUNREACH); 4487 } 4488 udp = (struct udphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4489 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4490 udp->uh_dport = port; 4491 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4492 udp->uh_sum = 0; 4493 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4494 } else { 4495 sctphdr = (struct sctphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4496 } 4497 4498 sctphdr->src_port = src_port; 4499 sctphdr->dest_port = dest_port; 4500 sctphdr->v_tag = v_tag; 4501 sctphdr->checksum = 0; 4502 4503 /* 4504 * We set the hop limit now since there is a good 4505 * chance that our ro pointer is now filled 4506 */ 4507 ip6h->ip6_hlim = SCTP_GET_HLIM(inp, ro); 4508 ifp = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 4509 4510 #ifdef SCTP_DEBUG 4511 /* Copy to be sure something bad is not happening */ 4512 sin6->sin6_addr = ip6h->ip6_dst; 4513 lsa6->sin6_addr = ip6h->ip6_src; 4514 #endif 4515 4516 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv6 output routine from low level\n"); 4517 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src: "); 4518 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)lsa6); 4519 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst: "); 4520 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)sin6); 4521 if (net) { 4522 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4523 /* 4524 * preserve the port and scope for link 4525 * local send 4526 */ 4527 prev_scope = sin6->sin6_scope_id; 4528 prev_port = sin6->sin6_port; 4529 } 4530 4531 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4532 /* failed to prepend data, give up */ 4533 sctp_m_freem(m); 4534 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4535 return (ENOMEM); 4536 } 4537 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4538 if (port) { 4539 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 4540 SCTP_STAT_INCR(sctps_sendswcrc); 4541 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), packet_length - sizeof(struct ip6_hdr))) == 0) { 4542 udp->uh_sum = 0xffff; 4543 } 4544 } else { 4545 m->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 4546 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4547 SCTP_STAT_INCR(sctps_sendhwcrc); 4548 } 4549 /* send it out. table id is taken from stcb */ 4550 #ifdef SCTP_PACKET_LOGGING 4551 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4552 sctp_packet_log(o_pak); 4553 #endif 4554 SCTP_PROBE5(send, NULL, stcb, ip6h, stcb, sctphdr); 4555 SCTP_IP6_OUTPUT(ret, o_pak, (struct route_in6 *)ro, &ifp, inp, vrf_id); 4556 if (net) { 4557 /* for link local this must be done */ 4558 sin6->sin6_scope_id = prev_scope; 4559 sin6->sin6_port = prev_port; 4560 } 4561 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 4562 if (port) { 4563 UDPSTAT_INC(udps_opackets); 4564 } 4565 SCTP_STAT_INCR(sctps_sendpackets); 4566 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4567 if (ret) { 4568 SCTP_STAT_INCR(sctps_senderrors); 4569 } 4570 if (net == NULL) { 4571 /* Now if we had a temp route free it */ 4572 RO_NHFREE(ro); 4573 } else { 4574 /* 4575 * PMTU check versus smallest asoc MTU goes 4576 * here 4577 */ 4578 if (ro->ro_nh == NULL) { 4579 /* Route was freed */ 4580 if (net->ro._s_addr && 4581 net->src_addr_selected) { 4582 sctp_free_ifa(net->ro._s_addr); 4583 net->ro._s_addr = NULL; 4584 } 4585 net->src_addr_selected = 0; 4586 } 4587 if ((ro->ro_nh != NULL) && (net->ro._s_addr) && 4588 ((net->dest_state & SCTP_ADDR_NO_PMTUD) == 0)) { 4589 uint32_t mtu; 4590 4591 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_nh); 4592 if (mtu > 0) { 4593 if (net->port) { 4594 mtu -= sizeof(struct udphdr); 4595 } 4596 if (mtu < net->mtu) { 4597 net->mtu = mtu; 4598 if ((stcb != NULL) && (stcb->asoc.smallest_mtu > mtu)) { 4599 sctp_pathmtu_adjustment(stcb, mtu, false); 4600 } 4601 } 4602 } 4603 } else if (ifp != NULL) { 4604 if ((ND_IFINFO(ifp)->linkmtu > 0) && 4605 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) { 4606 sctp_pathmtu_adjustment(stcb, ND_IFINFO(ifp)->linkmtu, false); 4607 } 4608 } 4609 } 4610 return (ret); 4611 } 4612 #endif 4613 default: 4614 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 4615 ((struct sockaddr *)to)->sa_family); 4616 sctp_m_freem(m); 4617 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4618 return (EFAULT); 4619 } 4620 } 4621 4622 void 4623 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int so_locked) 4624 { 4625 struct mbuf *m, *m_last; 4626 struct sctp_nets *net; 4627 struct sctp_init_chunk *init; 4628 struct sctp_supported_addr_param *sup_addr; 4629 struct sctp_adaptation_layer_indication *ali; 4630 struct sctp_supported_chunk_types_param *pr_supported; 4631 struct sctp_paramhdr *ph; 4632 int cnt_inits_to = 0; 4633 int error; 4634 uint16_t num_ext, chunk_len, padding_len, parameter_len; 4635 4636 /* INIT's always go to the primary (and usually ONLY address) */ 4637 net = stcb->asoc.primary_destination; 4638 if (net == NULL) { 4639 net = TAILQ_FIRST(&stcb->asoc.nets); 4640 if (net == NULL) { 4641 /* TSNH */ 4642 return; 4643 } 4644 /* we confirm any address we send an INIT to */ 4645 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4646 (void)sctp_set_primary_addr(stcb, NULL, net); 4647 } else { 4648 /* we confirm any address we send an INIT to */ 4649 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4650 } 4651 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT\n"); 4652 #ifdef INET6 4653 if (net->ro._l_addr.sa.sa_family == AF_INET6) { 4654 /* 4655 * special hook, if we are sending to link local it will not 4656 * show up in our private address count. 4657 */ 4658 if (IN6_IS_ADDR_LINKLOCAL(&net->ro._l_addr.sin6.sin6_addr)) 4659 cnt_inits_to = 1; 4660 } 4661 #endif 4662 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 4663 /* This case should not happen */ 4664 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - failed timer?\n"); 4665 return; 4666 } 4667 /* start the INIT timer */ 4668 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 4669 4670 m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_NOWAIT, 1, MT_DATA); 4671 if (m == NULL) { 4672 /* No memory, INIT timer will re-attempt. */ 4673 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - mbuf?\n"); 4674 return; 4675 } 4676 chunk_len = (uint16_t)sizeof(struct sctp_init_chunk); 4677 padding_len = 0; 4678 /* Now lets put the chunk header in place */ 4679 init = mtod(m, struct sctp_init_chunk *); 4680 /* now the chunk header */ 4681 init->ch.chunk_type = SCTP_INITIATION; 4682 init->ch.chunk_flags = 0; 4683 /* fill in later from mbuf we build */ 4684 init->ch.chunk_length = 0; 4685 /* place in my tag */ 4686 init->init.initiate_tag = htonl(stcb->asoc.my_vtag); 4687 /* set up some of the credits. */ 4688 init->init.a_rwnd = htonl(max(inp->sctp_socket ? SCTP_SB_LIMIT_RCV(inp->sctp_socket) : 0, 4689 SCTP_MINIMAL_RWND)); 4690 init->init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 4691 init->init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 4692 init->init.initial_tsn = htonl(stcb->asoc.init_seq_number); 4693 4694 /* Adaptation layer indication parameter */ 4695 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 4696 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 4697 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 4698 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 4699 ali->ph.param_length = htons(parameter_len); 4700 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 4701 chunk_len += parameter_len; 4702 } 4703 4704 /* ECN parameter */ 4705 if (stcb->asoc.ecn_supported == 1) { 4706 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4707 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4708 ph->param_type = htons(SCTP_ECN_CAPABLE); 4709 ph->param_length = htons(parameter_len); 4710 chunk_len += parameter_len; 4711 } 4712 4713 /* PR-SCTP supported parameter */ 4714 if (stcb->asoc.prsctp_supported == 1) { 4715 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4716 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4717 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 4718 ph->param_length = htons(parameter_len); 4719 chunk_len += parameter_len; 4720 } 4721 4722 /* Zero checksum acceptable parameter */ 4723 if (stcb->asoc.zero_checksum > 0) { 4724 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4725 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4726 ph->param_type = htons(SCTP_ZERO_CHECKSUM_ACCEPTABLE); 4727 ph->param_length = htons(parameter_len); 4728 chunk_len += parameter_len; 4729 } 4730 4731 /* Add NAT friendly parameter. */ 4732 if (SCTP_BASE_SYSCTL(sctp_inits_include_nat_friendly)) { 4733 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4734 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4735 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 4736 ph->param_length = htons(parameter_len); 4737 chunk_len += parameter_len; 4738 } 4739 4740 /* And now tell the peer which extensions we support */ 4741 num_ext = 0; 4742 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 4743 if (stcb->asoc.prsctp_supported == 1) { 4744 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 4745 if (stcb->asoc.idata_supported) { 4746 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 4747 } 4748 } 4749 if (stcb->asoc.auth_supported == 1) { 4750 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 4751 } 4752 if (stcb->asoc.asconf_supported == 1) { 4753 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 4754 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 4755 } 4756 if (stcb->asoc.reconfig_supported == 1) { 4757 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 4758 } 4759 if (stcb->asoc.idata_supported) { 4760 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 4761 } 4762 if (stcb->asoc.nrsack_supported == 1) { 4763 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 4764 } 4765 if (stcb->asoc.pktdrop_supported == 1) { 4766 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 4767 } 4768 if (num_ext > 0) { 4769 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 4770 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 4771 pr_supported->ph.param_length = htons(parameter_len); 4772 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4773 chunk_len += parameter_len; 4774 } 4775 /* add authentication parameters */ 4776 if (stcb->asoc.auth_supported) { 4777 /* attach RANDOM parameter, if available */ 4778 if (stcb->asoc.authinfo.random != NULL) { 4779 struct sctp_auth_random *randp; 4780 4781 if (padding_len > 0) { 4782 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4783 chunk_len += padding_len; 4784 padding_len = 0; 4785 } 4786 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 4787 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + stcb->asoc.authinfo.random_len; 4788 /* random key already contains the header */ 4789 memcpy(randp, stcb->asoc.authinfo.random->key, parameter_len); 4790 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4791 chunk_len += parameter_len; 4792 } 4793 /* add HMAC_ALGO parameter */ 4794 if (stcb->asoc.local_hmacs != NULL) { 4795 struct sctp_auth_hmac_algo *hmacs; 4796 4797 if (padding_len > 0) { 4798 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4799 chunk_len += padding_len; 4800 padding_len = 0; 4801 } 4802 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 4803 parameter_len = (uint16_t)(sizeof(struct sctp_auth_hmac_algo) + 4804 stcb->asoc.local_hmacs->num_algo * sizeof(uint16_t)); 4805 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 4806 hmacs->ph.param_length = htons(parameter_len); 4807 sctp_serialize_hmaclist(stcb->asoc.local_hmacs, (uint8_t *)hmacs->hmac_ids); 4808 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4809 chunk_len += parameter_len; 4810 } 4811 /* add CHUNKS parameter */ 4812 if (stcb->asoc.local_auth_chunks != NULL) { 4813 struct sctp_auth_chunk_list *chunks; 4814 4815 if (padding_len > 0) { 4816 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4817 chunk_len += padding_len; 4818 padding_len = 0; 4819 } 4820 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 4821 parameter_len = (uint16_t)(sizeof(struct sctp_auth_chunk_list) + 4822 sctp_auth_get_chklist_size(stcb->asoc.local_auth_chunks)); 4823 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 4824 chunks->ph.param_length = htons(parameter_len); 4825 sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks, chunks->chunk_types); 4826 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4827 chunk_len += parameter_len; 4828 } 4829 } 4830 4831 /* now any cookie time extensions */ 4832 if (stcb->asoc.cookie_preserve_req > 0) { 4833 struct sctp_cookie_perserve_param *cookie_preserve; 4834 4835 if (padding_len > 0) { 4836 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4837 chunk_len += padding_len; 4838 padding_len = 0; 4839 } 4840 parameter_len = (uint16_t)sizeof(struct sctp_cookie_perserve_param); 4841 cookie_preserve = (struct sctp_cookie_perserve_param *)(mtod(m, caddr_t)+chunk_len); 4842 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 4843 cookie_preserve->ph.param_length = htons(parameter_len); 4844 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 4845 stcb->asoc.cookie_preserve_req = 0; 4846 chunk_len += parameter_len; 4847 } 4848 4849 if (stcb->asoc.scope.ipv4_addr_legal || stcb->asoc.scope.ipv6_addr_legal) { 4850 uint8_t i; 4851 4852 if (padding_len > 0) { 4853 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4854 chunk_len += padding_len; 4855 padding_len = 0; 4856 } 4857 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4858 if (stcb->asoc.scope.ipv4_addr_legal) { 4859 parameter_len += (uint16_t)sizeof(uint16_t); 4860 } 4861 if (stcb->asoc.scope.ipv6_addr_legal) { 4862 parameter_len += (uint16_t)sizeof(uint16_t); 4863 } 4864 sup_addr = (struct sctp_supported_addr_param *)(mtod(m, caddr_t)+chunk_len); 4865 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 4866 sup_addr->ph.param_length = htons(parameter_len); 4867 i = 0; 4868 if (stcb->asoc.scope.ipv4_addr_legal) { 4869 sup_addr->addr_type[i++] = htons(SCTP_IPV4_ADDRESS); 4870 } 4871 if (stcb->asoc.scope.ipv6_addr_legal) { 4872 sup_addr->addr_type[i++] = htons(SCTP_IPV6_ADDRESS); 4873 } 4874 padding_len = 4 - 2 * i; 4875 chunk_len += parameter_len; 4876 } 4877 4878 SCTP_BUF_LEN(m) = chunk_len; 4879 /* now the addresses */ 4880 /* 4881 * To optimize this we could put the scoping stuff into a structure 4882 * and remove the individual uint8's from the assoc structure. Then 4883 * we could just sifa in the address within the stcb. But for now 4884 * this is a quick hack to get the address stuff teased apart. 4885 */ 4886 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &stcb->asoc.scope, 4887 m, cnt_inits_to, 4888 &padding_len, &chunk_len); 4889 4890 init->ch.chunk_length = htons(chunk_len); 4891 if (padding_len > 0) { 4892 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 4893 sctp_m_freem(m); 4894 return; 4895 } 4896 } 4897 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - calls lowlevel_output\n"); 4898 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 4899 (struct sockaddr *)&net->ro._l_addr, 4900 m, 0, NULL, 0, 0, 0, 0, 4901 inp->sctp_lport, stcb->rport, htonl(0), 4902 net->port, NULL, 4903 0, 0, 4904 false, so_locked))) { 4905 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 4906 if (error == ENOBUFS) { 4907 stcb->asoc.ifp_had_enobuf = 1; 4908 SCTP_STAT_INCR(sctps_lowlevelerr); 4909 } 4910 } else { 4911 stcb->asoc.ifp_had_enobuf = 0; 4912 } 4913 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 4914 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 4915 } 4916 4917 struct mbuf * 4918 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 4919 int param_offset, int *abort_processing, 4920 struct sctp_chunkhdr *cp, 4921 int *nat_friendly, 4922 int *cookie_found) 4923 { 4924 /* 4925 * Given a mbuf containing an INIT or INIT-ACK with the param_offset 4926 * being equal to the beginning of the params i.e. (iphlen + 4927 * sizeof(struct sctp_init_msg) parse through the parameters to the 4928 * end of the mbuf verifying that all parameters are known. 4929 * 4930 * For unknown parameters build and return a mbuf with 4931 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop 4932 * processing this chunk stop, and set *abort_processing to 1. 4933 * 4934 * By having param_offset be pre-set to where parameters begin it is 4935 * hoped that this routine may be reused in the future by new 4936 * features. 4937 */ 4938 struct sctp_paramhdr *phdr, params; 4939 4940 struct mbuf *mat, *m_tmp, *op_err, *op_err_last; 4941 int at, limit, pad_needed; 4942 uint16_t ptype, plen, padded_size; 4943 4944 *abort_processing = 0; 4945 if (cookie_found != NULL) { 4946 *cookie_found = 0; 4947 } 4948 mat = in_initpkt; 4949 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 4950 at = param_offset; 4951 op_err = NULL; 4952 op_err_last = NULL; 4953 pad_needed = 0; 4954 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Check for unrecognized param's\n"); 4955 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 4956 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 4957 ptype = ntohs(phdr->param_type); 4958 plen = ntohs(phdr->param_length); 4959 if ((plen > limit) || (plen < sizeof(struct sctp_paramhdr))) { 4960 /* wacked parameter */ 4961 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error %d\n", plen); 4962 goto invalid_size; 4963 } 4964 limit -= SCTP_SIZE32(plen); 4965 /*- 4966 * All parameters for all chunks that we know/understand are 4967 * listed here. We process them other places and make 4968 * appropriate stop actions per the upper bits. However this 4969 * is the generic routine processor's can call to get back 4970 * an operr.. to either incorporate (init-ack) or send. 4971 */ 4972 padded_size = SCTP_SIZE32(plen); 4973 switch (ptype) { 4974 /* Param's with variable size */ 4975 case SCTP_HEARTBEAT_INFO: 4976 case SCTP_UNRECOG_PARAM: 4977 case SCTP_ERROR_CAUSE_IND: 4978 /* ok skip fwd */ 4979 at += padded_size; 4980 break; 4981 case SCTP_STATE_COOKIE: 4982 if (cookie_found != NULL) { 4983 *cookie_found = 1; 4984 } 4985 at += padded_size; 4986 break; 4987 /* Param's with variable size within a range */ 4988 case SCTP_CHUNK_LIST: 4989 case SCTP_SUPPORTED_CHUNK_EXT: 4990 if (padded_size > (sizeof(struct sctp_supported_chunk_types_param) + (sizeof(uint8_t) * SCTP_MAX_SUPPORTED_EXT))) { 4991 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error chklist %d\n", plen); 4992 goto invalid_size; 4993 } 4994 at += padded_size; 4995 break; 4996 case SCTP_SUPPORTED_ADDRTYPE: 4997 if (padded_size > SCTP_MAX_ADDR_PARAMS_SIZE) { 4998 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error supaddrtype %d\n", plen); 4999 goto invalid_size; 5000 } 5001 at += padded_size; 5002 break; 5003 case SCTP_RANDOM: 5004 if (padded_size > (sizeof(struct sctp_auth_random) + SCTP_RANDOM_MAX_SIZE)) { 5005 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error random %d\n", plen); 5006 goto invalid_size; 5007 } 5008 at += padded_size; 5009 break; 5010 case SCTP_SET_PRIM_ADDR: 5011 case SCTP_DEL_IP_ADDRESS: 5012 case SCTP_ADD_IP_ADDRESS: 5013 if ((padded_size != sizeof(struct sctp_asconf_addrv4_param)) && 5014 (padded_size != sizeof(struct sctp_asconf_addr_param))) { 5015 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error setprim %d\n", plen); 5016 goto invalid_size; 5017 } 5018 at += padded_size; 5019 break; 5020 /* Param's with a fixed size */ 5021 case SCTP_IPV4_ADDRESS: 5022 if (padded_size != sizeof(struct sctp_ipv4addr_param)) { 5023 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv4 addr %d\n", plen); 5024 goto invalid_size; 5025 } 5026 at += padded_size; 5027 break; 5028 case SCTP_IPV6_ADDRESS: 5029 if (padded_size != sizeof(struct sctp_ipv6addr_param)) { 5030 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv6 addr %d\n", plen); 5031 goto invalid_size; 5032 } 5033 at += padded_size; 5034 break; 5035 case SCTP_COOKIE_PRESERVE: 5036 if (padded_size != sizeof(struct sctp_cookie_perserve_param)) { 5037 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error cookie-preserve %d\n", plen); 5038 goto invalid_size; 5039 } 5040 at += padded_size; 5041 break; 5042 case SCTP_HAS_NAT_SUPPORT: 5043 *nat_friendly = 1; 5044 /* FALLTHROUGH */ 5045 case SCTP_PRSCTP_SUPPORTED: 5046 if (padded_size != sizeof(struct sctp_paramhdr)) { 5047 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error prsctp/nat support %d\n", plen); 5048 goto invalid_size; 5049 } 5050 at += padded_size; 5051 break; 5052 case SCTP_ECN_CAPABLE: 5053 if (padded_size != sizeof(struct sctp_paramhdr)) { 5054 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecn %d\n", plen); 5055 goto invalid_size; 5056 } 5057 at += padded_size; 5058 break; 5059 case SCTP_ULP_ADAPTATION: 5060 if (padded_size != sizeof(struct sctp_adaptation_layer_indication)) { 5061 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error adapatation %d\n", plen); 5062 goto invalid_size; 5063 } 5064 at += padded_size; 5065 break; 5066 case SCTP_SUCCESS_REPORT: 5067 if (padded_size != sizeof(struct sctp_asconf_paramhdr)) { 5068 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error success %d\n", plen); 5069 goto invalid_size; 5070 } 5071 at += padded_size; 5072 break; 5073 case SCTP_HOSTNAME_ADDRESS: 5074 { 5075 /* Hostname parameters are deprecated. */ 5076 struct sctp_gen_error_cause *cause; 5077 int l_len; 5078 5079 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Can't handle hostname addresses.. abort processing\n"); 5080 *abort_processing = 1; 5081 sctp_m_freem(op_err); 5082 op_err = NULL; 5083 op_err_last = NULL; 5084 #ifdef INET6 5085 l_len = SCTP_MIN_OVERHEAD; 5086 #else 5087 l_len = SCTP_MIN_V4_OVERHEAD; 5088 #endif 5089 l_len += sizeof(struct sctp_chunkhdr); 5090 l_len += sizeof(struct sctp_gen_error_cause); 5091 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5092 if (op_err != NULL) { 5093 /* 5094 * Pre-reserve space for IP, SCTP, 5095 * and chunk header. 5096 */ 5097 #ifdef INET6 5098 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5099 #else 5100 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5101 #endif 5102 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5103 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5104 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause); 5105 cause = mtod(op_err, struct sctp_gen_error_cause *); 5106 cause->code = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR); 5107 cause->length = htons((uint16_t)(sizeof(struct sctp_gen_error_cause) + plen)); 5108 SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(mat, at, plen, M_NOWAIT); 5109 if (SCTP_BUF_NEXT(op_err) == NULL) { 5110 sctp_m_freem(op_err); 5111 op_err = NULL; 5112 op_err_last = NULL; 5113 } 5114 } 5115 return (op_err); 5116 } 5117 default: 5118 /* 5119 * we do not recognize the parameter figure out what 5120 * we do. 5121 */ 5122 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Hit default param %x\n", ptype); 5123 if ((ptype & 0x4000) == 0x4000) { 5124 /* Report bit is set?? */ 5125 SCTPDBG(SCTP_DEBUG_OUTPUT1, "report op err\n"); 5126 if (op_err == NULL) { 5127 int l_len; 5128 5129 /* Ok need to try to get an mbuf */ 5130 #ifdef INET6 5131 l_len = SCTP_MIN_OVERHEAD; 5132 #else 5133 l_len = SCTP_MIN_V4_OVERHEAD; 5134 #endif 5135 l_len += sizeof(struct sctp_chunkhdr); 5136 l_len += sizeof(struct sctp_paramhdr); 5137 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5138 if (op_err) { 5139 SCTP_BUF_LEN(op_err) = 0; 5140 #ifdef INET6 5141 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5142 #else 5143 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5144 #endif 5145 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5146 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5147 op_err_last = op_err; 5148 } 5149 } 5150 if (op_err != NULL) { 5151 /* If we have space */ 5152 struct sctp_paramhdr *param; 5153 5154 if (pad_needed > 0) { 5155 op_err_last = sctp_add_pad_tombuf(op_err_last, pad_needed); 5156 } 5157 if (op_err_last == NULL) { 5158 sctp_m_freem(op_err); 5159 op_err = NULL; 5160 op_err_last = NULL; 5161 goto more_processing; 5162 } 5163 if (M_TRAILINGSPACE(op_err_last) < (int)sizeof(struct sctp_paramhdr)) { 5164 m_tmp = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_NOWAIT, 1, MT_DATA); 5165 if (m_tmp == NULL) { 5166 sctp_m_freem(op_err); 5167 op_err = NULL; 5168 op_err_last = NULL; 5169 goto more_processing; 5170 } 5171 SCTP_BUF_LEN(m_tmp) = 0; 5172 SCTP_BUF_NEXT(m_tmp) = NULL; 5173 SCTP_BUF_NEXT(op_err_last) = m_tmp; 5174 op_err_last = m_tmp; 5175 } 5176 param = (struct sctp_paramhdr *)(mtod(op_err_last, caddr_t)+SCTP_BUF_LEN(op_err_last)); 5177 param->param_type = htons(SCTP_UNRECOG_PARAM); 5178 param->param_length = htons((uint16_t)sizeof(struct sctp_paramhdr) + plen); 5179 SCTP_BUF_LEN(op_err_last) += sizeof(struct sctp_paramhdr); 5180 SCTP_BUF_NEXT(op_err_last) = SCTP_M_COPYM(mat, at, plen, M_NOWAIT); 5181 if (SCTP_BUF_NEXT(op_err_last) == NULL) { 5182 sctp_m_freem(op_err); 5183 op_err = NULL; 5184 op_err_last = NULL; 5185 goto more_processing; 5186 } else { 5187 while (SCTP_BUF_NEXT(op_err_last) != NULL) { 5188 op_err_last = SCTP_BUF_NEXT(op_err_last); 5189 } 5190 } 5191 if (plen % 4 != 0) { 5192 pad_needed = 4 - (plen % 4); 5193 } else { 5194 pad_needed = 0; 5195 } 5196 } 5197 } 5198 more_processing: 5199 if ((ptype & 0x8000) == 0x0000) { 5200 SCTPDBG(SCTP_DEBUG_OUTPUT1, "stop proc\n"); 5201 return (op_err); 5202 } else { 5203 /* skip this chunk and continue processing */ 5204 SCTPDBG(SCTP_DEBUG_OUTPUT1, "move on\n"); 5205 at += SCTP_SIZE32(plen); 5206 } 5207 break; 5208 } 5209 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5210 } 5211 return (op_err); 5212 invalid_size: 5213 SCTPDBG(SCTP_DEBUG_OUTPUT1, "abort flag set\n"); 5214 *abort_processing = 1; 5215 sctp_m_freem(op_err); 5216 op_err = NULL; 5217 op_err_last = NULL; 5218 if (phdr != NULL) { 5219 struct sctp_paramhdr *param; 5220 int l_len; 5221 #ifdef INET6 5222 l_len = SCTP_MIN_OVERHEAD; 5223 #else 5224 l_len = SCTP_MIN_V4_OVERHEAD; 5225 #endif 5226 l_len += sizeof(struct sctp_chunkhdr); 5227 l_len += (2 * sizeof(struct sctp_paramhdr)); 5228 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5229 if (op_err) { 5230 SCTP_BUF_LEN(op_err) = 0; 5231 #ifdef INET6 5232 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5233 #else 5234 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5235 #endif 5236 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5237 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5238 SCTP_BUF_LEN(op_err) = 2 * sizeof(struct sctp_paramhdr); 5239 param = mtod(op_err, struct sctp_paramhdr *); 5240 param->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 5241 param->param_length = htons(2 * sizeof(struct sctp_paramhdr)); 5242 param++; 5243 param->param_type = htons(ptype); 5244 param->param_length = htons(plen); 5245 } 5246 } 5247 return (op_err); 5248 } 5249 5250 /* 5251 * Given a INIT chunk, look through the parameters to verify that there 5252 * are no new addresses. 5253 * Return true, if there is a new address or there is a problem parsing 5254 the parameters. Provide an optional error cause used when sending an ABORT. 5255 * Return false, if there are no new addresses and there is no problem in 5256 parameter processing. 5257 */ 5258 static bool 5259 sctp_are_there_new_addresses(struct sctp_association *asoc, 5260 struct mbuf *in_initpkt, int offset, int limit, struct sockaddr *src, 5261 struct mbuf **op_err) 5262 { 5263 struct sockaddr *sa_touse; 5264 struct sockaddr *sa; 5265 struct sctp_paramhdr *phdr, params; 5266 struct sctp_nets *net; 5267 #ifdef INET 5268 struct sockaddr_in sin4, *sa4; 5269 #endif 5270 #ifdef INET6 5271 struct sockaddr_in6 sin6, *sa6; 5272 #endif 5273 uint16_t ptype, plen; 5274 bool fnd, check_src; 5275 5276 *op_err = NULL; 5277 #ifdef INET 5278 memset(&sin4, 0, sizeof(sin4)); 5279 sin4.sin_family = AF_INET; 5280 sin4.sin_len = sizeof(sin4); 5281 #endif 5282 #ifdef INET6 5283 memset(&sin6, 0, sizeof(sin6)); 5284 sin6.sin6_family = AF_INET6; 5285 sin6.sin6_len = sizeof(sin6); 5286 #endif 5287 /* First what about the src address of the pkt ? */ 5288 check_src = false; 5289 switch (src->sa_family) { 5290 #ifdef INET 5291 case AF_INET: 5292 if (asoc->scope.ipv4_addr_legal) { 5293 check_src = true; 5294 } 5295 break; 5296 #endif 5297 #ifdef INET6 5298 case AF_INET6: 5299 if (asoc->scope.ipv6_addr_legal) { 5300 check_src = true; 5301 } 5302 break; 5303 #endif 5304 default: 5305 /* TSNH */ 5306 break; 5307 } 5308 if (check_src) { 5309 fnd = false; 5310 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5311 sa = (struct sockaddr *)&net->ro._l_addr; 5312 if (sa->sa_family == src->sa_family) { 5313 #ifdef INET 5314 if (sa->sa_family == AF_INET) { 5315 struct sockaddr_in *src4; 5316 5317 sa4 = (struct sockaddr_in *)sa; 5318 src4 = (struct sockaddr_in *)src; 5319 if (sa4->sin_addr.s_addr == src4->sin_addr.s_addr) { 5320 fnd = true; 5321 break; 5322 } 5323 } 5324 #endif 5325 #ifdef INET6 5326 if (sa->sa_family == AF_INET6) { 5327 struct sockaddr_in6 *src6; 5328 5329 sa6 = (struct sockaddr_in6 *)sa; 5330 src6 = (struct sockaddr_in6 *)src; 5331 if (SCTP6_ARE_ADDR_EQUAL(sa6, src6)) { 5332 fnd = true; 5333 break; 5334 } 5335 } 5336 #endif 5337 } 5338 } 5339 if (!fnd) { 5340 /* 5341 * If sending an ABORT in case of an additional 5342 * address, don't use the new address error cause. 5343 * This looks no different than if no listener was 5344 * present. 5345 */ 5346 *op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), "Address added"); 5347 return (true); 5348 } 5349 } 5350 /* Ok so far lets munge through the rest of the packet */ 5351 offset += sizeof(struct sctp_init_chunk); 5352 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5353 while (phdr) { 5354 sa_touse = NULL; 5355 ptype = ntohs(phdr->param_type); 5356 plen = ntohs(phdr->param_length); 5357 if (offset + plen > limit) { 5358 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, "Partial parameter"); 5359 return (true); 5360 } 5361 if (plen < sizeof(struct sctp_paramhdr)) { 5362 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, "Parameter length too small"); 5363 return (true); 5364 } 5365 switch (ptype) { 5366 #ifdef INET 5367 case SCTP_IPV4_ADDRESS: 5368 { 5369 struct sctp_ipv4addr_param *p4, p4_buf; 5370 5371 if (plen != sizeof(struct sctp_ipv4addr_param)) { 5372 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, "Parameter length illegal"); 5373 return (true); 5374 } 5375 phdr = sctp_get_next_param(in_initpkt, offset, 5376 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 5377 if (phdr == NULL) { 5378 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, ""); 5379 return (true); 5380 } 5381 if (asoc->scope.ipv4_addr_legal) { 5382 p4 = (struct sctp_ipv4addr_param *)phdr; 5383 sin4.sin_addr.s_addr = p4->addr; 5384 sa_touse = (struct sockaddr *)&sin4; 5385 } 5386 break; 5387 } 5388 #endif 5389 #ifdef INET6 5390 case SCTP_IPV6_ADDRESS: 5391 { 5392 struct sctp_ipv6addr_param *p6, p6_buf; 5393 5394 if (plen != sizeof(struct sctp_ipv6addr_param)) { 5395 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, "Parameter length illegal"); 5396 return (true); 5397 } 5398 phdr = sctp_get_next_param(in_initpkt, offset, 5399 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 5400 if (phdr == NULL) { 5401 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, ""); 5402 return (true); 5403 } 5404 if (asoc->scope.ipv6_addr_legal) { 5405 p6 = (struct sctp_ipv6addr_param *)phdr; 5406 memcpy((caddr_t)&sin6.sin6_addr, p6->addr, 5407 sizeof(p6->addr)); 5408 sa_touse = (struct sockaddr *)&sin6; 5409 } 5410 break; 5411 } 5412 #endif 5413 default: 5414 sa_touse = NULL; 5415 break; 5416 } 5417 if (sa_touse) { 5418 /* ok, sa_touse points to one to check */ 5419 fnd = false; 5420 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5421 sa = (struct sockaddr *)&net->ro._l_addr; 5422 if (sa->sa_family != sa_touse->sa_family) { 5423 continue; 5424 } 5425 #ifdef INET 5426 if (sa->sa_family == AF_INET) { 5427 sa4 = (struct sockaddr_in *)sa; 5428 if (sa4->sin_addr.s_addr == 5429 sin4.sin_addr.s_addr) { 5430 fnd = true; 5431 break; 5432 } 5433 } 5434 #endif 5435 #ifdef INET6 5436 if (sa->sa_family == AF_INET6) { 5437 sa6 = (struct sockaddr_in6 *)sa; 5438 if (SCTP6_ARE_ADDR_EQUAL( 5439 sa6, &sin6)) { 5440 fnd = true; 5441 break; 5442 } 5443 } 5444 #endif 5445 } 5446 if (!fnd) { 5447 /* 5448 * If sending an ABORT in case of an 5449 * additional address, don't use the new 5450 * address error cause. This looks no 5451 * different than if no listener was 5452 * present. 5453 */ 5454 *op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), "Address added"); 5455 return (true); 5456 } 5457 } 5458 offset += SCTP_SIZE32(plen); 5459 if (offset >= limit) { 5460 break; 5461 } 5462 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5463 } 5464 return (false); 5465 } 5466 5467 /* 5468 * Given a MBUF chain that was sent into us containing an INIT. Build a 5469 * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done 5470 * a pullup to include IPv6/4header, SCTP header and initial part of INIT 5471 * message (i.e. the struct sctp_init_msg). 5472 */ 5473 void 5474 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 5475 struct sctp_nets *src_net, struct mbuf *init_pkt, 5476 int iphlen, int offset, 5477 struct sockaddr *src, struct sockaddr *dst, 5478 struct sctphdr *sh, struct sctp_init_chunk *init_chk, 5479 uint8_t mflowtype, uint32_t mflowid, 5480 uint32_t vrf_id, uint16_t port) 5481 { 5482 struct sctp_association *asoc; 5483 struct mbuf *m, *m_tmp, *m_last, *m_cookie, *op_err; 5484 struct sctp_init_ack_chunk *initack; 5485 struct sctp_adaptation_layer_indication *ali; 5486 struct sctp_supported_chunk_types_param *pr_supported; 5487 struct sctp_paramhdr *ph; 5488 union sctp_sockstore *over_addr; 5489 struct sctp_scoping scp; 5490 struct timeval now; 5491 #ifdef INET 5492 struct sockaddr_in *dst4 = (struct sockaddr_in *)dst; 5493 struct sockaddr_in *src4 = (struct sockaddr_in *)src; 5494 struct sockaddr_in *sin; 5495 #endif 5496 #ifdef INET6 5497 struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst; 5498 struct sockaddr_in6 *src6 = (struct sockaddr_in6 *)src; 5499 struct sockaddr_in6 *sin6; 5500 #endif 5501 struct sockaddr *to; 5502 struct sctp_state_cookie stc; 5503 struct sctp_nets *net = NULL; 5504 uint8_t *signature = NULL; 5505 int cnt_inits_to = 0; 5506 uint16_t his_limit, i_want; 5507 int abort_flag; 5508 int nat_friendly = 0; 5509 int error; 5510 struct socket *so; 5511 uint16_t num_ext, chunk_len, padding_len, parameter_len; 5512 5513 if (stcb) { 5514 asoc = &stcb->asoc; 5515 } else { 5516 asoc = NULL; 5517 } 5518 if ((asoc != NULL) && 5519 (SCTP_GET_STATE(stcb) != SCTP_STATE_COOKIE_WAIT)) { 5520 if (sctp_are_there_new_addresses(asoc, init_pkt, offset, offset + ntohs(init_chk->ch.chunk_length), src, &op_err)) { 5521 /* 5522 * new addresses, out of here in non-cookie-wait 5523 * states 5524 */ 5525 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5526 mflowtype, mflowid, inp->fibnum, 5527 vrf_id, port); 5528 return; 5529 } 5530 if (src_net != NULL && (src_net->port != port)) { 5531 /* 5532 * change of remote encapsulation port, out of here 5533 * in non-cookie-wait states 5534 * 5535 * Send an ABORT, without an specific error cause. 5536 * This looks no different than if no listener was 5537 * present. 5538 */ 5539 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5540 "Remote encapsulation port changed"); 5541 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5542 mflowtype, mflowid, inp->fibnum, 5543 vrf_id, port); 5544 return; 5545 } 5546 } 5547 abort_flag = 0; 5548 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 5549 (offset + sizeof(struct sctp_init_chunk)), 5550 &abort_flag, 5551 (struct sctp_chunkhdr *)init_chk, 5552 &nat_friendly, NULL); 5553 if (abort_flag) { 5554 do_a_abort: 5555 if (op_err == NULL) { 5556 char msg[SCTP_DIAG_INFO_LEN]; 5557 5558 SCTP_SNPRINTF(msg, sizeof(msg), "%s:%d at %s", __FILE__, __LINE__, __func__); 5559 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5560 msg); 5561 } 5562 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 5563 init_chk->init.initiate_tag, op_err, 5564 mflowtype, mflowid, inp->fibnum, 5565 vrf_id, port); 5566 return; 5567 } 5568 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 5569 if (m == NULL) { 5570 /* No memory, INIT timer will re-attempt. */ 5571 sctp_m_freem(op_err); 5572 return; 5573 } 5574 chunk_len = (uint16_t)sizeof(struct sctp_init_ack_chunk); 5575 padding_len = 0; 5576 5577 /* 5578 * We might not overwrite the identification[] completely and on 5579 * some platforms time_entered will contain some padding. Therefore 5580 * zero out the cookie to avoid putting uninitialized memory on the 5581 * wire. 5582 */ 5583 memset(&stc, 0, sizeof(struct sctp_state_cookie)); 5584 5585 /* the time I built cookie */ 5586 (void)SCTP_GETTIME_TIMEVAL(&now); 5587 stc.time_entered.tv_sec = now.tv_sec; 5588 stc.time_entered.tv_usec = now.tv_usec; 5589 5590 /* populate any tie tags */ 5591 if (asoc != NULL) { 5592 /* unlock before tag selections */ 5593 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 5594 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 5595 stc.cookie_life = asoc->cookie_life; 5596 net = asoc->primary_destination; 5597 } else { 5598 stc.tie_tag_my_vtag = 0; 5599 stc.tie_tag_peer_vtag = 0; 5600 /* life I will award this cookie */ 5601 stc.cookie_life = inp->sctp_ep.def_cookie_life; 5602 } 5603 5604 /* copy in the ports for later check */ 5605 stc.myport = sh->dest_port; 5606 stc.peerport = sh->src_port; 5607 5608 /* 5609 * If we wanted to honor cookie life extensions, we would add to 5610 * stc.cookie_life. For now we should NOT honor any extension 5611 */ 5612 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 5613 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5614 stc.ipv6_addr_legal = 1; 5615 if (SCTP_IPV6_V6ONLY(inp)) { 5616 stc.ipv4_addr_legal = 0; 5617 } else { 5618 stc.ipv4_addr_legal = 1; 5619 } 5620 } else { 5621 stc.ipv6_addr_legal = 0; 5622 stc.ipv4_addr_legal = 1; 5623 } 5624 stc.ipv4_scope = 0; 5625 if (net == NULL) { 5626 to = src; 5627 switch (dst->sa_family) { 5628 #ifdef INET 5629 case AF_INET: 5630 { 5631 /* lookup address */ 5632 stc.address[0] = src4->sin_addr.s_addr; 5633 stc.address[1] = 0; 5634 stc.address[2] = 0; 5635 stc.address[3] = 0; 5636 stc.addr_type = SCTP_IPV4_ADDRESS; 5637 /* local from address */ 5638 stc.laddress[0] = dst4->sin_addr.s_addr; 5639 stc.laddress[1] = 0; 5640 stc.laddress[2] = 0; 5641 stc.laddress[3] = 0; 5642 stc.laddr_type = SCTP_IPV4_ADDRESS; 5643 /* scope_id is only for v6 */ 5644 stc.scope_id = 0; 5645 if ((IN4_ISPRIVATE_ADDRESS(&src4->sin_addr)) || 5646 (IN4_ISPRIVATE_ADDRESS(&dst4->sin_addr))) { 5647 stc.ipv4_scope = 1; 5648 } 5649 /* Must use the address in this case */ 5650 if (sctp_is_address_on_local_host(src, vrf_id)) { 5651 stc.loopback_scope = 1; 5652 stc.ipv4_scope = 1; 5653 stc.site_scope = 1; 5654 stc.local_scope = 0; 5655 } 5656 break; 5657 } 5658 #endif 5659 #ifdef INET6 5660 case AF_INET6: 5661 { 5662 stc.addr_type = SCTP_IPV6_ADDRESS; 5663 memcpy(&stc.address, &src6->sin6_addr, sizeof(struct in6_addr)); 5664 stc.scope_id = ntohs(in6_getscope(&src6->sin6_addr)); 5665 if (sctp_is_address_on_local_host(src, vrf_id)) { 5666 stc.loopback_scope = 1; 5667 stc.local_scope = 0; 5668 stc.site_scope = 1; 5669 stc.ipv4_scope = 1; 5670 } else if (IN6_IS_ADDR_LINKLOCAL(&src6->sin6_addr) || 5671 IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr)) { 5672 /* 5673 * If the new destination or source 5674 * is a LINK_LOCAL we must have 5675 * common both site and local scope. 5676 * Don't set local scope though 5677 * since we must depend on the 5678 * source to be added implicitly. We 5679 * cannot assure just because we 5680 * share one link that all links are 5681 * common. 5682 */ 5683 stc.local_scope = 0; 5684 stc.site_scope = 1; 5685 stc.ipv4_scope = 1; 5686 /* 5687 * we start counting for the private 5688 * address stuff at 1. since the 5689 * link local we source from won't 5690 * show up in our scoped count. 5691 */ 5692 cnt_inits_to = 1; 5693 /* 5694 * pull out the scope_id from 5695 * incoming pkt 5696 */ 5697 } else if (IN6_IS_ADDR_SITELOCAL(&src6->sin6_addr) || 5698 IN6_IS_ADDR_SITELOCAL(&dst6->sin6_addr)) { 5699 /* 5700 * If the new destination or source 5701 * is SITE_LOCAL then we must have 5702 * site scope in common. 5703 */ 5704 stc.site_scope = 1; 5705 } 5706 memcpy(&stc.laddress, &dst6->sin6_addr, sizeof(struct in6_addr)); 5707 stc.laddr_type = SCTP_IPV6_ADDRESS; 5708 break; 5709 } 5710 #endif 5711 default: 5712 /* TSNH */ 5713 goto do_a_abort; 5714 break; 5715 } 5716 } else { 5717 /* set the scope per the existing tcb */ 5718 5719 #ifdef INET6 5720 struct sctp_nets *lnet; 5721 #endif 5722 5723 stc.loopback_scope = asoc->scope.loopback_scope; 5724 stc.ipv4_scope = asoc->scope.ipv4_local_scope; 5725 stc.site_scope = asoc->scope.site_scope; 5726 stc.local_scope = asoc->scope.local_scope; 5727 #ifdef INET6 5728 /* Why do we not consider IPv4 LL addresses? */ 5729 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 5730 if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) { 5731 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) { 5732 /* 5733 * if we have a LL address, start 5734 * counting at 1. 5735 */ 5736 cnt_inits_to = 1; 5737 } 5738 } 5739 } 5740 #endif 5741 /* use the net pointer */ 5742 to = (struct sockaddr *)&net->ro._l_addr; 5743 switch (to->sa_family) { 5744 #ifdef INET 5745 case AF_INET: 5746 sin = (struct sockaddr_in *)to; 5747 stc.address[0] = sin->sin_addr.s_addr; 5748 stc.address[1] = 0; 5749 stc.address[2] = 0; 5750 stc.address[3] = 0; 5751 stc.addr_type = SCTP_IPV4_ADDRESS; 5752 if (net->src_addr_selected == 0) { 5753 /* 5754 * strange case here, the INIT should have 5755 * did the selection. 5756 */ 5757 net->ro._s_addr = sctp_source_address_selection(inp, 5758 stcb, (sctp_route_t *)&net->ro, 5759 net, 0, vrf_id); 5760 if (net->ro._s_addr == NULL) { 5761 sctp_m_freem(op_err); 5762 sctp_m_freem(m); 5763 return; 5764 } 5765 5766 net->src_addr_selected = 1; 5767 } 5768 stc.laddress[0] = net->ro._s_addr->address.sin.sin_addr.s_addr; 5769 stc.laddress[1] = 0; 5770 stc.laddress[2] = 0; 5771 stc.laddress[3] = 0; 5772 stc.laddr_type = SCTP_IPV4_ADDRESS; 5773 /* scope_id is only for v6 */ 5774 stc.scope_id = 0; 5775 break; 5776 #endif 5777 #ifdef INET6 5778 case AF_INET6: 5779 sin6 = (struct sockaddr_in6 *)to; 5780 memcpy(&stc.address, &sin6->sin6_addr, 5781 sizeof(struct in6_addr)); 5782 stc.addr_type = SCTP_IPV6_ADDRESS; 5783 stc.scope_id = sin6->sin6_scope_id; 5784 if (net->src_addr_selected == 0) { 5785 /* 5786 * strange case here, the INIT should have 5787 * done the selection. 5788 */ 5789 net->ro._s_addr = sctp_source_address_selection(inp, 5790 stcb, (sctp_route_t *)&net->ro, 5791 net, 0, vrf_id); 5792 if (net->ro._s_addr == NULL) { 5793 sctp_m_freem(op_err); 5794 sctp_m_freem(m); 5795 return; 5796 } 5797 5798 net->src_addr_selected = 1; 5799 } 5800 memcpy(&stc.laddress, &net->ro._s_addr->address.sin6.sin6_addr, 5801 sizeof(struct in6_addr)); 5802 stc.laddr_type = SCTP_IPV6_ADDRESS; 5803 break; 5804 #endif 5805 } 5806 } 5807 if (asoc != NULL) { 5808 stc.zero_checksum = asoc->zero_checksum > 0 ? 1 : 0; 5809 } else { 5810 stc.zero_checksum = inp->zero_checksum; 5811 } 5812 /* Now lets put the SCTP header in place */ 5813 initack = mtod(m, struct sctp_init_ack_chunk *); 5814 /* Save it off for quick ref */ 5815 stc.peers_vtag = ntohl(init_chk->init.initiate_tag); 5816 /* who are we */ 5817 memcpy(stc.identification, SCTP_VERSION_STRING, 5818 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 5819 memset(stc.reserved, 0, SCTP_RESERVE_SPACE); 5820 /* now the chunk header */ 5821 initack->ch.chunk_type = SCTP_INITIATION_ACK; 5822 initack->ch.chunk_flags = 0; 5823 /* fill in later from mbuf we build */ 5824 initack->ch.chunk_length = 0; 5825 /* place in my tag */ 5826 if ((asoc != NULL) && 5827 ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 5828 (SCTP_GET_STATE(stcb) == SCTP_STATE_INUSE) || 5829 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED))) { 5830 /* re-use the v-tags and init-seq here */ 5831 initack->init.initiate_tag = htonl(asoc->my_vtag); 5832 initack->init.initial_tsn = htonl(asoc->init_seq_number); 5833 } else { 5834 uint32_t vtag, itsn; 5835 5836 if (asoc) { 5837 atomic_add_int(&asoc->refcnt, 1); 5838 SCTP_TCB_UNLOCK(stcb); 5839 new_tag: 5840 SCTP_INP_INFO_RLOCK(); 5841 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5842 SCTP_INP_INFO_RUNLOCK(); 5843 if ((asoc->peer_supports_nat) && (vtag == asoc->my_vtag)) { 5844 /* 5845 * Got a duplicate vtag on some guy behind a 5846 * nat make sure we don't use it. 5847 */ 5848 goto new_tag; 5849 } 5850 initack->init.initiate_tag = htonl(vtag); 5851 /* get a TSN to use too */ 5852 itsn = sctp_select_initial_TSN(&inp->sctp_ep); 5853 initack->init.initial_tsn = htonl(itsn); 5854 SCTP_TCB_LOCK(stcb); 5855 atomic_subtract_int(&asoc->refcnt, 1); 5856 } else { 5857 SCTP_INP_INCR_REF(inp); 5858 SCTP_INP_RUNLOCK(inp); 5859 SCTP_INP_INFO_RLOCK(); 5860 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5861 SCTP_INP_INFO_RUNLOCK(); 5862 initack->init.initiate_tag = htonl(vtag); 5863 /* get a TSN to use too */ 5864 initack->init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 5865 SCTP_INP_RLOCK(inp); 5866 SCTP_INP_DECR_REF(inp); 5867 } 5868 } 5869 /* save away my tag to */ 5870 stc.my_vtag = initack->init.initiate_tag; 5871 5872 /* set up some of the credits. */ 5873 so = inp->sctp_socket; 5874 if (so == NULL) { 5875 /* memory problem */ 5876 sctp_m_freem(op_err); 5877 sctp_m_freem(m); 5878 return; 5879 } else { 5880 initack->init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(so), SCTP_MINIMAL_RWND)); 5881 } 5882 /* set what I want */ 5883 his_limit = ntohs(init_chk->init.num_inbound_streams); 5884 /* choose what I want */ 5885 if (asoc != NULL) { 5886 if (asoc->streamoutcnt > asoc->pre_open_streams) { 5887 i_want = asoc->streamoutcnt; 5888 } else { 5889 i_want = asoc->pre_open_streams; 5890 } 5891 } else { 5892 i_want = inp->sctp_ep.pre_open_stream_count; 5893 } 5894 if (his_limit < i_want) { 5895 /* I Want more :< */ 5896 initack->init.num_outbound_streams = init_chk->init.num_inbound_streams; 5897 } else { 5898 /* I can have what I want :> */ 5899 initack->init.num_outbound_streams = htons(i_want); 5900 } 5901 /* tell him his limit. */ 5902 initack->init.num_inbound_streams = 5903 htons(inp->sctp_ep.max_open_streams_intome); 5904 5905 /* adaptation layer indication parameter */ 5906 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 5907 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 5908 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 5909 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 5910 ali->ph.param_length = htons(parameter_len); 5911 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 5912 chunk_len += parameter_len; 5913 } 5914 5915 /* ECN parameter */ 5916 if (((asoc != NULL) && (asoc->ecn_supported == 1)) || 5917 ((asoc == NULL) && (inp->ecn_supported == 1))) { 5918 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5919 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5920 ph->param_type = htons(SCTP_ECN_CAPABLE); 5921 ph->param_length = htons(parameter_len); 5922 chunk_len += parameter_len; 5923 } 5924 5925 /* PR-SCTP supported parameter */ 5926 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5927 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5928 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5929 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5930 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 5931 ph->param_length = htons(parameter_len); 5932 chunk_len += parameter_len; 5933 } 5934 5935 /* Zero checksum acceptable parameter */ 5936 if (((asoc != NULL) && (asoc->zero_checksum > 0)) || 5937 ((asoc == NULL) && (inp->zero_checksum == 1))) { 5938 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5939 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5940 ph->param_type = htons(SCTP_ZERO_CHECKSUM_ACCEPTABLE); 5941 ph->param_length = htons(parameter_len); 5942 chunk_len += parameter_len; 5943 } 5944 5945 /* Add NAT friendly parameter */ 5946 if (nat_friendly) { 5947 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5948 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5949 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 5950 ph->param_length = htons(parameter_len); 5951 chunk_len += parameter_len; 5952 } 5953 5954 /* And now tell the peer which extensions we support */ 5955 num_ext = 0; 5956 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 5957 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5958 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5959 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 5960 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5961 ((asoc == NULL) && (inp->idata_supported == 1))) { 5962 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 5963 } 5964 } 5965 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5966 ((asoc == NULL) && (inp->auth_supported == 1))) { 5967 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 5968 } 5969 if (((asoc != NULL) && (asoc->asconf_supported == 1)) || 5970 ((asoc == NULL) && (inp->asconf_supported == 1))) { 5971 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 5972 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 5973 } 5974 if (((asoc != NULL) && (asoc->reconfig_supported == 1)) || 5975 ((asoc == NULL) && (inp->reconfig_supported == 1))) { 5976 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 5977 } 5978 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5979 ((asoc == NULL) && (inp->idata_supported == 1))) { 5980 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 5981 } 5982 if (((asoc != NULL) && (asoc->nrsack_supported == 1)) || 5983 ((asoc == NULL) && (inp->nrsack_supported == 1))) { 5984 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 5985 } 5986 if (((asoc != NULL) && (asoc->pktdrop_supported == 1)) || 5987 ((asoc == NULL) && (inp->pktdrop_supported == 1))) { 5988 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 5989 } 5990 if (num_ext > 0) { 5991 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 5992 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 5993 pr_supported->ph.param_length = htons(parameter_len); 5994 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5995 chunk_len += parameter_len; 5996 } 5997 5998 /* add authentication parameters */ 5999 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 6000 ((asoc == NULL) && (inp->auth_supported == 1))) { 6001 struct sctp_auth_random *randp; 6002 struct sctp_auth_hmac_algo *hmacs; 6003 struct sctp_auth_chunk_list *chunks; 6004 6005 if (padding_len > 0) { 6006 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6007 chunk_len += padding_len; 6008 padding_len = 0; 6009 } 6010 /* generate and add RANDOM parameter */ 6011 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 6012 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + 6013 SCTP_AUTH_RANDOM_SIZE_DEFAULT; 6014 randp->ph.param_type = htons(SCTP_RANDOM); 6015 randp->ph.param_length = htons(parameter_len); 6016 SCTP_READ_RANDOM(randp->random_data, SCTP_AUTH_RANDOM_SIZE_DEFAULT); 6017 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6018 chunk_len += parameter_len; 6019 6020 if (padding_len > 0) { 6021 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6022 chunk_len += padding_len; 6023 padding_len = 0; 6024 } 6025 /* add HMAC_ALGO parameter */ 6026 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 6027 parameter_len = (uint16_t)sizeof(struct sctp_auth_hmac_algo) + 6028 sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs, 6029 (uint8_t *)hmacs->hmac_ids); 6030 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 6031 hmacs->ph.param_length = htons(parameter_len); 6032 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6033 chunk_len += parameter_len; 6034 6035 if (padding_len > 0) { 6036 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6037 chunk_len += padding_len; 6038 padding_len = 0; 6039 } 6040 /* add CHUNKS parameter */ 6041 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 6042 parameter_len = (uint16_t)sizeof(struct sctp_auth_chunk_list) + 6043 sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks, 6044 chunks->chunk_types); 6045 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 6046 chunks->ph.param_length = htons(parameter_len); 6047 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6048 chunk_len += parameter_len; 6049 } 6050 SCTP_BUF_LEN(m) = chunk_len; 6051 m_last = m; 6052 /* now the addresses */ 6053 /* 6054 * To optimize this we could put the scoping stuff into a structure 6055 * and remove the individual uint8's from the stc structure. Then we 6056 * could just sifa in the address within the stc.. but for now this 6057 * is a quick hack to get the address stuff teased apart. 6058 */ 6059 scp.ipv4_addr_legal = stc.ipv4_addr_legal; 6060 scp.ipv6_addr_legal = stc.ipv6_addr_legal; 6061 scp.loopback_scope = stc.loopback_scope; 6062 scp.ipv4_local_scope = stc.ipv4_scope; 6063 scp.local_scope = stc.local_scope; 6064 scp.site_scope = stc.site_scope; 6065 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &scp, m_last, 6066 cnt_inits_to, 6067 &padding_len, &chunk_len); 6068 /* padding_len can only be positive, if no addresses have been added */ 6069 if (padding_len > 0) { 6070 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6071 chunk_len += padding_len; 6072 SCTP_BUF_LEN(m) += padding_len; 6073 padding_len = 0; 6074 } 6075 6076 /* tack on the operational error if present */ 6077 if (op_err) { 6078 parameter_len = 0; 6079 for (m_tmp = op_err; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6080 parameter_len += SCTP_BUF_LEN(m_tmp); 6081 } 6082 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6083 SCTP_BUF_NEXT(m_last) = op_err; 6084 while (SCTP_BUF_NEXT(m_last) != NULL) { 6085 m_last = SCTP_BUF_NEXT(m_last); 6086 } 6087 chunk_len += parameter_len; 6088 } 6089 if (padding_len > 0) { 6090 m_last = sctp_add_pad_tombuf(m_last, padding_len); 6091 if (m_last == NULL) { 6092 /* Houston we have a problem, no space */ 6093 sctp_m_freem(m); 6094 return; 6095 } 6096 chunk_len += padding_len; 6097 padding_len = 0; 6098 } 6099 /* Now we must build a cookie */ 6100 m_cookie = sctp_add_cookie(init_pkt, offset, m, 0, &stc, &signature); 6101 if (m_cookie == NULL) { 6102 /* memory problem */ 6103 sctp_m_freem(m); 6104 return; 6105 } 6106 /* Now append the cookie to the end and update the space/size */ 6107 SCTP_BUF_NEXT(m_last) = m_cookie; 6108 parameter_len = 0; 6109 for (m_tmp = m_cookie; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6110 parameter_len += SCTP_BUF_LEN(m_tmp); 6111 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 6112 m_last = m_tmp; 6113 } 6114 } 6115 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6116 chunk_len += parameter_len; 6117 6118 /* 6119 * Place in the size, but we don't include the last pad (if any) in 6120 * the INIT-ACK. 6121 */ 6122 initack->ch.chunk_length = htons(chunk_len); 6123 6124 /* 6125 * Time to sign the cookie, we don't sign over the cookie signature 6126 * though thus we set trailer. 6127 */ 6128 (void)sctp_hmac_m(SCTP_HMAC, 6129 (uint8_t *)inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)], 6130 SCTP_SECRET_SIZE, m_cookie, sizeof(struct sctp_paramhdr), 6131 (uint8_t *)signature, SCTP_SIGNATURE_SIZE); 6132 /* 6133 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return 6134 * here since the timer will drive a retranmission. 6135 */ 6136 if (padding_len > 0) { 6137 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 6138 sctp_m_freem(m); 6139 return; 6140 } 6141 } 6142 if (stc.loopback_scope) { 6143 over_addr = (union sctp_sockstore *)dst; 6144 } else { 6145 over_addr = NULL; 6146 } 6147 6148 if ((error = sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0, 6149 0, 0, 6150 inp->sctp_lport, sh->src_port, init_chk->init.initiate_tag, 6151 port, over_addr, 6152 mflowtype, mflowid, 6153 false, /* XXXMT: Improve this! */ 6154 SCTP_SO_NOT_LOCKED))) { 6155 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 6156 if (error == ENOBUFS) { 6157 if (asoc != NULL) { 6158 asoc->ifp_had_enobuf = 1; 6159 } 6160 SCTP_STAT_INCR(sctps_lowlevelerr); 6161 } 6162 } else { 6163 if (asoc != NULL) { 6164 asoc->ifp_had_enobuf = 0; 6165 } 6166 } 6167 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 6168 } 6169 6170 static void 6171 sctp_prune_prsctp(struct sctp_tcb *stcb, 6172 struct sctp_association *asoc, 6173 struct sctp_nonpad_sndrcvinfo *srcv, 6174 int dataout) 6175 { 6176 int freed_spc = 0; 6177 struct sctp_tmit_chunk *chk, *nchk; 6178 6179 SCTP_TCB_LOCK_ASSERT(stcb); 6180 if ((asoc->prsctp_supported) && 6181 (asoc->sent_queue_cnt_removeable > 0)) { 6182 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6183 /* 6184 * Look for chunks marked with the PR_SCTP flag AND 6185 * the buffer space flag. If the one being sent is 6186 * equal or greater priority then purge the old one 6187 * and free some space. 6188 */ 6189 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6190 /* 6191 * This one is PR-SCTP AND buffer space 6192 * limited type 6193 */ 6194 if (chk->rec.data.timetodrop.tv_sec > (long)srcv->sinfo_timetolive) { 6195 /* 6196 * Lower numbers equates to higher 6197 * priority. So if the one we are 6198 * looking at has a larger priority, 6199 * we want to drop the data and NOT 6200 * retransmit it. 6201 */ 6202 if (chk->data) { 6203 /* 6204 * We release the book_size 6205 * if the mbuf is here 6206 */ 6207 int ret_spc; 6208 uint8_t sent; 6209 6210 if (chk->sent > SCTP_DATAGRAM_UNSENT) 6211 sent = 1; 6212 else 6213 sent = 0; 6214 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6215 sent, 6216 SCTP_SO_LOCKED); 6217 freed_spc += ret_spc; 6218 if (freed_spc >= dataout) { 6219 return; 6220 } 6221 } /* if chunk was present */ 6222 } /* if of sufficient priority */ 6223 } /* if chunk has enabled */ 6224 } /* tailqforeach */ 6225 6226 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 6227 /* Here we must move to the sent queue and mark */ 6228 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6229 if (chk->rec.data.timetodrop.tv_sec > (long)srcv->sinfo_timetolive) { 6230 if (chk->data) { 6231 /* 6232 * We release the book_size 6233 * if the mbuf is here 6234 */ 6235 int ret_spc; 6236 6237 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6238 0, SCTP_SO_LOCKED); 6239 6240 freed_spc += ret_spc; 6241 if (freed_spc >= dataout) { 6242 return; 6243 } 6244 } /* end if chk->data */ 6245 } /* end if right class */ 6246 } /* end if chk pr-sctp */ 6247 } /* tailqforeachsafe (chk) */ 6248 } /* if enabled in asoc */ 6249 } 6250 6251 uint32_t 6252 sctp_get_frag_point(struct sctp_tcb *stcb) 6253 { 6254 struct sctp_association *asoc; 6255 uint32_t frag_point, overhead; 6256 6257 asoc = &stcb->asoc; 6258 /* Consider IP header and SCTP common header. */ 6259 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6260 overhead = SCTP_MIN_OVERHEAD; 6261 } else { 6262 overhead = SCTP_MIN_V4_OVERHEAD; 6263 } 6264 /* Consider DATA/IDATA chunk header and AUTH header, if needed. */ 6265 if (asoc->idata_supported) { 6266 overhead += sizeof(struct sctp_idata_chunk); 6267 if (sctp_auth_is_required_chunk(SCTP_IDATA, asoc->peer_auth_chunks)) { 6268 overhead += sctp_get_auth_chunk_len(asoc->peer_hmac_id); 6269 } 6270 } else { 6271 overhead += sizeof(struct sctp_data_chunk); 6272 if (sctp_auth_is_required_chunk(SCTP_DATA, asoc->peer_auth_chunks)) { 6273 overhead += sctp_get_auth_chunk_len(asoc->peer_hmac_id); 6274 } 6275 } 6276 KASSERT(overhead % 4 == 0, 6277 ("overhead (%u) not a multiple of 4", overhead)); 6278 /* Consider padding. */ 6279 if (asoc->smallest_mtu % 4 > 0) { 6280 overhead += (asoc->smallest_mtu % 4); 6281 } 6282 KASSERT(asoc->smallest_mtu > overhead, 6283 ("Association MTU (%u) too small for overhead (%u)", 6284 asoc->smallest_mtu, overhead)); 6285 frag_point = asoc->smallest_mtu - overhead; 6286 KASSERT(frag_point % 4 == 0, 6287 ("frag_point (%u) not a multiple of 4", frag_point)); 6288 /* Honor MAXSEG socket option. */ 6289 if ((asoc->sctp_frag_point > 0) && 6290 (asoc->sctp_frag_point < frag_point)) { 6291 frag_point = asoc->sctp_frag_point; 6292 } 6293 return (frag_point); 6294 } 6295 6296 static void 6297 sctp_set_prsctp_policy(struct sctp_stream_queue_pending *sp) 6298 { 6299 /* 6300 * We assume that the user wants PR_SCTP_TTL if the user provides a 6301 * positive lifetime but does not specify any PR_SCTP policy. 6302 */ 6303 if (PR_SCTP_ENABLED(sp->sinfo_flags)) { 6304 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6305 } else if (sp->timetolive > 0) { 6306 sp->sinfo_flags |= SCTP_PR_SCTP_TTL; 6307 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6308 } else { 6309 return; 6310 } 6311 switch (PR_SCTP_POLICY(sp->sinfo_flags)) { 6312 case CHUNK_FLAGS_PR_SCTP_BUF: 6313 /* 6314 * Time to live is a priority stored in tv_sec when doing 6315 * the buffer drop thing. 6316 */ 6317 sp->ts.tv_sec = sp->timetolive; 6318 sp->ts.tv_usec = 0; 6319 break; 6320 case CHUNK_FLAGS_PR_SCTP_TTL: 6321 { 6322 struct timeval tv; 6323 6324 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6325 tv.tv_sec = sp->timetolive / 1000; 6326 tv.tv_usec = (sp->timetolive * 1000) % 1000000; 6327 /* 6328 * TODO sctp_constants.h needs alternative time 6329 * macros when _KERNEL is undefined. 6330 */ 6331 timevaladd(&sp->ts, &tv); 6332 } 6333 break; 6334 case CHUNK_FLAGS_PR_SCTP_RTX: 6335 /* 6336 * Time to live is a the number or retransmissions stored in 6337 * tv_sec. 6338 */ 6339 sp->ts.tv_sec = sp->timetolive; 6340 sp->ts.tv_usec = 0; 6341 break; 6342 default: 6343 SCTPDBG(SCTP_DEBUG_USRREQ1, 6344 "Unknown PR_SCTP policy %u.\n", 6345 PR_SCTP_POLICY(sp->sinfo_flags)); 6346 break; 6347 } 6348 } 6349 6350 static int 6351 sctp_msg_append(struct sctp_tcb *stcb, 6352 struct sctp_nets *net, 6353 struct mbuf *m, 6354 struct sctp_nonpad_sndrcvinfo *srcv) 6355 { 6356 int error = 0; 6357 struct mbuf *at; 6358 struct sctp_stream_queue_pending *sp = NULL; 6359 struct sctp_stream_out *strm; 6360 6361 SCTP_TCB_LOCK_ASSERT(stcb); 6362 6363 /* 6364 * Given an mbuf chain, put it into the association send queue and 6365 * place it on the wheel 6366 */ 6367 if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) { 6368 /* Invalid stream number */ 6369 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6370 error = EINVAL; 6371 goto out_now; 6372 } 6373 if ((stcb->asoc.stream_locked) && 6374 (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) { 6375 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6376 error = EINVAL; 6377 goto out_now; 6378 } 6379 if ((stcb->asoc.strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPEN) && 6380 (stcb->asoc.strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPENING)) { 6381 /* 6382 * Can't queue any data while stream reset is underway. 6383 */ 6384 if (stcb->asoc.strmout[srcv->sinfo_stream].state > SCTP_STREAM_OPEN) { 6385 error = EAGAIN; 6386 } else { 6387 error = EINVAL; 6388 } 6389 goto out_now; 6390 } 6391 /* Now can we send this? */ 6392 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 6393 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 6394 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 6395 (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) { 6396 /* got data while shutting down */ 6397 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EPIPE); 6398 error = EPIPE; 6399 goto out_now; 6400 } 6401 sctp_alloc_a_strmoq(stcb, sp); 6402 if (sp == NULL) { 6403 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6404 error = ENOMEM; 6405 goto out_now; 6406 } 6407 sp->sinfo_flags = srcv->sinfo_flags; 6408 sp->timetolive = srcv->sinfo_timetolive; 6409 sp->ppid = srcv->sinfo_ppid; 6410 sp->context = srcv->sinfo_context; 6411 sp->fsn = 0; 6412 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 6413 sp->net = net; 6414 atomic_add_int(&sp->net->ref_count, 1); 6415 } else { 6416 sp->net = NULL; 6417 } 6418 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6419 sp->sid = srcv->sinfo_stream; 6420 sp->msg_is_complete = 1; 6421 sp->sender_all_done = 1; 6422 sp->some_taken = 0; 6423 sp->data = m; 6424 sp->tail_mbuf = NULL; 6425 sctp_set_prsctp_policy(sp); 6426 /* 6427 * We could in theory (for sendall) sifa the length in, but we would 6428 * still have to hunt through the chain since we need to setup the 6429 * tail_mbuf 6430 */ 6431 sp->length = 0; 6432 for (at = m; at; at = SCTP_BUF_NEXT(at)) { 6433 if (SCTP_BUF_NEXT(at) == NULL) 6434 sp->tail_mbuf = at; 6435 sp->length += SCTP_BUF_LEN(at); 6436 } 6437 if (srcv->sinfo_keynumber_valid) { 6438 sp->auth_keyid = srcv->sinfo_keynumber; 6439 } else { 6440 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 6441 } 6442 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 6443 sctp_auth_key_acquire(stcb, sp->auth_keyid); 6444 sp->holds_key_ref = 1; 6445 } 6446 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 6447 sctp_snd_sb_alloc(stcb, sp->length); 6448 atomic_add_int(&stcb->asoc.stream_queue_cnt, 1); 6449 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 6450 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, &stcb->asoc, strm, sp); 6451 m = NULL; 6452 out_now: 6453 if (m) { 6454 sctp_m_freem(m); 6455 } 6456 return (error); 6457 } 6458 6459 static struct mbuf * 6460 sctp_copy_mbufchain(struct mbuf *clonechain, 6461 struct mbuf *outchain, 6462 struct mbuf **endofchain, 6463 int can_take_mbuf, 6464 int sizeofcpy, 6465 uint8_t copy_by_ref) 6466 { 6467 struct mbuf *m; 6468 struct mbuf *appendchain; 6469 caddr_t cp; 6470 int len; 6471 6472 if (endofchain == NULL) { 6473 /* error */ 6474 error_out: 6475 if (outchain) 6476 sctp_m_freem(outchain); 6477 return (NULL); 6478 } 6479 if (can_take_mbuf) { 6480 appendchain = clonechain; 6481 } else { 6482 if (!copy_by_ref && 6483 (sizeofcpy <= (int)((((SCTP_BASE_SYSCTL(sctp_mbuf_threshold_count) - 1) * MLEN) + MHLEN)))) { 6484 /* Its not in a cluster */ 6485 if (*endofchain == NULL) { 6486 /* lets get a mbuf cluster */ 6487 if (outchain == NULL) { 6488 /* This is the general case */ 6489 new_mbuf: 6490 outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6491 if (outchain == NULL) { 6492 goto error_out; 6493 } 6494 SCTP_BUF_LEN(outchain) = 0; 6495 *endofchain = outchain; 6496 /* get the prepend space */ 6497 SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4)); 6498 } else { 6499 /* 6500 * We really should not get a NULL 6501 * in endofchain 6502 */ 6503 /* find end */ 6504 m = outchain; 6505 while (m) { 6506 if (SCTP_BUF_NEXT(m) == NULL) { 6507 *endofchain = m; 6508 break; 6509 } 6510 m = SCTP_BUF_NEXT(m); 6511 } 6512 /* sanity */ 6513 if (*endofchain == NULL) { 6514 /* 6515 * huh, TSNH XXX maybe we 6516 * should panic 6517 */ 6518 sctp_m_freem(outchain); 6519 goto new_mbuf; 6520 } 6521 } 6522 /* get the new end of length */ 6523 len = (int)M_TRAILINGSPACE(*endofchain); 6524 } else { 6525 /* how much is left at the end? */ 6526 len = (int)M_TRAILINGSPACE(*endofchain); 6527 } 6528 /* Find the end of the data, for appending */ 6529 cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain))); 6530 6531 /* Now lets copy it out */ 6532 if (len >= sizeofcpy) { 6533 /* It all fits, copy it in */ 6534 m_copydata(clonechain, 0, sizeofcpy, cp); 6535 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6536 } else { 6537 /* fill up the end of the chain */ 6538 if (len > 0) { 6539 m_copydata(clonechain, 0, len, cp); 6540 SCTP_BUF_LEN((*endofchain)) += len; 6541 /* now we need another one */ 6542 sizeofcpy -= len; 6543 } 6544 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6545 if (m == NULL) { 6546 /* We failed */ 6547 goto error_out; 6548 } 6549 SCTP_BUF_NEXT((*endofchain)) = m; 6550 *endofchain = m; 6551 cp = mtod((*endofchain), caddr_t); 6552 m_copydata(clonechain, len, sizeofcpy, cp); 6553 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6554 } 6555 return (outchain); 6556 } else { 6557 /* copy the old fashion way */ 6558 appendchain = SCTP_M_COPYM(clonechain, 0, M_COPYALL, M_NOWAIT); 6559 #ifdef SCTP_MBUF_LOGGING 6560 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6561 sctp_log_mbc(appendchain, SCTP_MBUF_ICOPY); 6562 } 6563 #endif 6564 } 6565 } 6566 if (appendchain == NULL) { 6567 /* error */ 6568 if (outchain) 6569 sctp_m_freem(outchain); 6570 return (NULL); 6571 } 6572 if (outchain) { 6573 /* tack on to the end */ 6574 if (*endofchain != NULL) { 6575 SCTP_BUF_NEXT(((*endofchain))) = appendchain; 6576 } else { 6577 m = outchain; 6578 while (m) { 6579 if (SCTP_BUF_NEXT(m) == NULL) { 6580 SCTP_BUF_NEXT(m) = appendchain; 6581 break; 6582 } 6583 m = SCTP_BUF_NEXT(m); 6584 } 6585 } 6586 /* 6587 * save off the end and update the end-chain position 6588 */ 6589 m = appendchain; 6590 while (m) { 6591 if (SCTP_BUF_NEXT(m) == NULL) { 6592 *endofchain = m; 6593 break; 6594 } 6595 m = SCTP_BUF_NEXT(m); 6596 } 6597 return (outchain); 6598 } else { 6599 /* save off the end and update the end-chain position */ 6600 m = appendchain; 6601 while (m) { 6602 if (SCTP_BUF_NEXT(m) == NULL) { 6603 *endofchain = m; 6604 break; 6605 } 6606 m = SCTP_BUF_NEXT(m); 6607 } 6608 return (appendchain); 6609 } 6610 } 6611 6612 static int 6613 sctp_med_chunk_output(struct sctp_inpcb *inp, 6614 struct sctp_tcb *stcb, 6615 struct sctp_association *asoc, 6616 int *num_out, 6617 int *reason_code, 6618 int control_only, int from_where, 6619 struct timeval *now, int *now_filled, 6620 uint32_t frag_point, int so_locked); 6621 6622 static void 6623 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, 6624 uint32_t val SCTP_UNUSED) 6625 { 6626 struct sctp_copy_all *ca; 6627 struct mbuf *m; 6628 int ret = 0; 6629 int added_control = 0; 6630 int un_sent, do_chunk_output = 1; 6631 struct sctp_association *asoc; 6632 struct sctp_nets *net; 6633 6634 ca = (struct sctp_copy_all *)ptr; 6635 if (ca->m == NULL) { 6636 return; 6637 } 6638 if (ca->inp != inp) { 6639 /* TSNH */ 6640 return; 6641 } 6642 if (ca->sndlen > 0) { 6643 m = SCTP_M_COPYM(ca->m, 0, M_COPYALL, M_NOWAIT); 6644 if (m == NULL) { 6645 /* can't copy so we are done */ 6646 ca->cnt_failed++; 6647 return; 6648 } 6649 #ifdef SCTP_MBUF_LOGGING 6650 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6651 sctp_log_mbc(m, SCTP_MBUF_ICOPY); 6652 } 6653 #endif 6654 } else { 6655 m = NULL; 6656 } 6657 SCTP_TCB_LOCK_ASSERT(stcb); 6658 if (stcb->asoc.alternate) { 6659 net = stcb->asoc.alternate; 6660 } else { 6661 net = stcb->asoc.primary_destination; 6662 } 6663 if (ca->sndrcv.sinfo_flags & SCTP_ABORT) { 6664 /* Abort this assoc with m as the user defined reason */ 6665 if (m != NULL) { 6666 SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_NOWAIT); 6667 } else { 6668 m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 6669 0, M_NOWAIT, 1, MT_DATA); 6670 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr); 6671 } 6672 if (m != NULL) { 6673 struct sctp_paramhdr *ph; 6674 6675 ph = mtod(m, struct sctp_paramhdr *); 6676 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 6677 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + ca->sndlen)); 6678 } 6679 /* 6680 * We add one here to keep the assoc from dis-appearing on 6681 * us. 6682 */ 6683 atomic_add_int(&stcb->asoc.refcnt, 1); 6684 sctp_abort_an_association(inp, stcb, m, false, SCTP_SO_NOT_LOCKED); 6685 /* 6686 * sctp_abort_an_association calls sctp_free_asoc() free 6687 * association will NOT free it since we incremented the 6688 * refcnt .. we do this to prevent it being freed and things 6689 * getting tricky since we could end up (from free_asoc) 6690 * calling inpcb_free which would get a recursive lock call 6691 * to the iterator lock.. But as a consequence of that the 6692 * stcb will return to us un-locked.. since free_asoc 6693 * returns with either no TCB or the TCB unlocked, we must 6694 * relock.. to unlock in the iterator timer :-0 6695 */ 6696 SCTP_TCB_LOCK(stcb); 6697 atomic_subtract_int(&stcb->asoc.refcnt, 1); 6698 goto no_chunk_output; 6699 } else { 6700 if (m != NULL) { 6701 ret = sctp_msg_append(stcb, net, m, &ca->sndrcv); 6702 } 6703 asoc = &stcb->asoc; 6704 if (ca->sndrcv.sinfo_flags & SCTP_EOF) { 6705 /* shutdown this assoc */ 6706 if (TAILQ_EMPTY(&asoc->send_queue) && 6707 TAILQ_EMPTY(&asoc->sent_queue) && 6708 sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED) == 0) { 6709 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6710 goto abort_anyway; 6711 } 6712 /* 6713 * there is nothing queued to send, so I'm 6714 * done... 6715 */ 6716 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 6717 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6718 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6719 /* 6720 * only send SHUTDOWN the first time 6721 * through 6722 */ 6723 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 6724 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 6725 } 6726 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT); 6727 sctp_stop_timers_for_shutdown(stcb); 6728 sctp_send_shutdown(stcb, net); 6729 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 6730 net); 6731 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6732 NULL); 6733 added_control = 1; 6734 do_chunk_output = 0; 6735 } 6736 } else { 6737 /* 6738 * we still got (or just got) data to send, 6739 * so set SHUTDOWN_PENDING 6740 */ 6741 /* 6742 * XXX sockets draft says that SCTP_EOF 6743 * should be sent with no data. currently, 6744 * we will allow user data to be sent first 6745 * and move to SHUTDOWN-PENDING 6746 */ 6747 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 6748 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6749 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6750 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6751 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT); 6752 } 6753 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 6754 if (TAILQ_EMPTY(&asoc->send_queue) && 6755 TAILQ_EMPTY(&asoc->sent_queue) && 6756 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 6757 struct mbuf *op_err; 6758 char msg[SCTP_DIAG_INFO_LEN]; 6759 6760 abort_anyway: 6761 SCTP_SNPRINTF(msg, sizeof(msg), 6762 "%s:%d at %s", __FILE__, __LINE__, __func__); 6763 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 6764 msg); 6765 atomic_add_int(&stcb->asoc.refcnt, 1); 6766 sctp_abort_an_association(stcb->sctp_ep, stcb, 6767 op_err, false, SCTP_SO_NOT_LOCKED); 6768 atomic_subtract_int(&stcb->asoc.refcnt, 1); 6769 goto no_chunk_output; 6770 } 6771 } 6772 } 6773 } 6774 } 6775 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 6776 (stcb->asoc.stream_queue_cnt * SCTP_DATA_CHUNK_OVERHEAD(stcb))); 6777 6778 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 6779 (stcb->asoc.total_flight > 0) && 6780 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 6781 do_chunk_output = 0; 6782 } 6783 if (do_chunk_output) 6784 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_NOT_LOCKED); 6785 else if (added_control) { 6786 struct timeval now; 6787 int num_out, reason, now_filled = 0; 6788 6789 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 6790 &reason, 1, 1, &now, &now_filled, 6791 sctp_get_frag_point(stcb), 6792 SCTP_SO_NOT_LOCKED); 6793 } 6794 no_chunk_output: 6795 if (ret) { 6796 ca->cnt_failed++; 6797 } else { 6798 ca->cnt_sent++; 6799 } 6800 } 6801 6802 static void 6803 sctp_sendall_completes(void *ptr, uint32_t val SCTP_UNUSED) 6804 { 6805 struct sctp_copy_all *ca; 6806 6807 ca = (struct sctp_copy_all *)ptr; 6808 /* 6809 * Do a notify here? Kacheong suggests that the notify be done at 6810 * the send time.. so you would push up a notification if any send 6811 * failed. Don't know if this is feasible since the only failures we 6812 * have is "memory" related and if you cannot get an mbuf to send 6813 * the data you surely can't get an mbuf to send up to notify the 6814 * user you can't send the data :-> 6815 */ 6816 6817 /* now free everything */ 6818 if (ca->inp) { 6819 /* Lets clear the flag to allow others to run. */ 6820 SCTP_INP_WLOCK(ca->inp); 6821 ca->inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6822 SCTP_INP_WUNLOCK(ca->inp); 6823 } 6824 sctp_m_freem(ca->m); 6825 SCTP_FREE(ca, SCTP_M_COPYAL); 6826 } 6827 6828 static struct mbuf * 6829 sctp_copy_out_all(struct uio *uio, ssize_t len) 6830 { 6831 struct mbuf *ret, *at; 6832 ssize_t left, willcpy, cancpy, error; 6833 6834 ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAITOK, 1, MT_DATA); 6835 if (ret == NULL) { 6836 /* TSNH */ 6837 return (NULL); 6838 } 6839 left = len; 6840 SCTP_BUF_LEN(ret) = 0; 6841 /* save space for the data chunk header */ 6842 cancpy = (int)M_TRAILINGSPACE(ret); 6843 willcpy = min(cancpy, left); 6844 at = ret; 6845 while (left > 0) { 6846 /* Align data to the end */ 6847 error = uiomove(mtod(at, caddr_t), (int)willcpy, uio); 6848 if (error) { 6849 err_out_now: 6850 sctp_m_freem(at); 6851 return (NULL); 6852 } 6853 SCTP_BUF_LEN(at) = (int)willcpy; 6854 SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0; 6855 left -= willcpy; 6856 if (left > 0) { 6857 SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg((unsigned int)left, 0, M_WAITOK, 1, MT_DATA); 6858 if (SCTP_BUF_NEXT(at) == NULL) { 6859 goto err_out_now; 6860 } 6861 at = SCTP_BUF_NEXT(at); 6862 SCTP_BUF_LEN(at) = 0; 6863 cancpy = (int)M_TRAILINGSPACE(at); 6864 willcpy = min(cancpy, left); 6865 } 6866 } 6867 return (ret); 6868 } 6869 6870 static int 6871 sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, 6872 struct sctp_nonpad_sndrcvinfo *srcv) 6873 { 6874 int ret; 6875 struct sctp_copy_all *ca; 6876 6877 if (uio->uio_resid > (ssize_t)SCTP_BASE_SYSCTL(sctp_sendall_limit)) { 6878 /* You must not be larger than the limit! */ 6879 return (EMSGSIZE); 6880 } 6881 SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all), 6882 SCTP_M_COPYAL); 6883 if (ca == NULL) { 6884 sctp_m_freem(m); 6885 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6886 return (ENOMEM); 6887 } 6888 memset(ca, 0, sizeof(struct sctp_copy_all)); 6889 6890 ca->inp = inp; 6891 if (srcv != NULL) { 6892 memcpy(&ca->sndrcv, srcv, sizeof(struct sctp_nonpad_sndrcvinfo)); 6893 } 6894 6895 /* Serialize. */ 6896 SCTP_INP_WLOCK(inp); 6897 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SND_ITERATOR_UP) != 0) { 6898 SCTP_INP_WUNLOCK(inp); 6899 sctp_m_freem(m); 6900 SCTP_FREE(ca, SCTP_M_COPYAL); 6901 return (EBUSY); 6902 } 6903 inp->sctp_flags |= SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6904 SCTP_INP_WUNLOCK(inp); 6905 6906 /* 6907 * take off the sendall flag, it would be bad if we failed to do 6908 * this :-0 6909 */ 6910 ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL; 6911 /* get length and mbuf chain */ 6912 if (uio) { 6913 ca->sndlen = uio->uio_resid; 6914 ca->m = sctp_copy_out_all(uio, ca->sndlen); 6915 if (ca->m == NULL) { 6916 SCTP_FREE(ca, SCTP_M_COPYAL); 6917 sctp_m_freem(m); 6918 SCTP_INP_WLOCK(inp); 6919 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6920 SCTP_INP_WUNLOCK(inp); 6921 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6922 return (ENOMEM); 6923 } 6924 } else { 6925 /* Gather the length of the send */ 6926 struct mbuf *mat; 6927 6928 ca->sndlen = 0; 6929 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 6930 ca->sndlen += SCTP_BUF_LEN(mat); 6931 } 6932 } 6933 ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, NULL, 6934 SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES, 6935 SCTP_ASOC_ANY_STATE, 6936 (void *)ca, 0, 6937 sctp_sendall_completes, inp, 1); 6938 if (ret) { 6939 SCTP_INP_WLOCK(inp); 6940 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6941 SCTP_INP_WUNLOCK(inp); 6942 SCTP_FREE(ca, SCTP_M_COPYAL); 6943 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 6944 return (EFAULT); 6945 } 6946 return (0); 6947 } 6948 6949 void 6950 sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc) 6951 { 6952 struct sctp_tmit_chunk *chk, *nchk; 6953 6954 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 6955 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 6956 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 6957 asoc->ctrl_queue_cnt--; 6958 if (chk->data) { 6959 sctp_m_freem(chk->data); 6960 chk->data = NULL; 6961 } 6962 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6963 } 6964 } 6965 } 6966 6967 void 6968 sctp_toss_old_asconf(struct sctp_tcb *stcb) 6969 { 6970 struct sctp_association *asoc; 6971 struct sctp_tmit_chunk *chk, *nchk; 6972 struct sctp_asconf_chunk *acp; 6973 6974 asoc = &stcb->asoc; 6975 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 6976 /* find SCTP_ASCONF chunk in queue */ 6977 if (chk->rec.chunk_id.id == SCTP_ASCONF) { 6978 if (chk->data) { 6979 acp = mtod(chk->data, struct sctp_asconf_chunk *); 6980 if (SCTP_TSN_GT(ntohl(acp->serial_number), asoc->asconf_seq_out_acked)) { 6981 /* Not Acked yet */ 6982 break; 6983 } 6984 } 6985 TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next); 6986 asoc->ctrl_queue_cnt--; 6987 if (chk->data) { 6988 sctp_m_freem(chk->data); 6989 chk->data = NULL; 6990 } 6991 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6992 } 6993 } 6994 } 6995 6996 static void 6997 sctp_clean_up_datalist(struct sctp_tcb *stcb, 6998 struct sctp_association *asoc, 6999 struct sctp_tmit_chunk **data_list, 7000 int bundle_at, 7001 struct sctp_nets *net) 7002 { 7003 int i; 7004 struct sctp_tmit_chunk *tp1; 7005 7006 for (i = 0; i < bundle_at; i++) { 7007 /* off of the send queue */ 7008 TAILQ_REMOVE(&asoc->send_queue, data_list[i], sctp_next); 7009 asoc->send_queue_cnt--; 7010 if (i > 0) { 7011 /* 7012 * Any chunk NOT 0 you zap the time chunk 0 gets 7013 * zapped or set based on if a RTO measurement is 7014 * needed. 7015 */ 7016 data_list[i]->do_rtt = 0; 7017 } 7018 /* record time */ 7019 data_list[i]->sent_rcv_time = net->last_sent_time; 7020 data_list[i]->rec.data.cwnd_at_send = net->cwnd; 7021 data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.tsn; 7022 if (data_list[i]->whoTo == NULL) { 7023 data_list[i]->whoTo = net; 7024 atomic_add_int(&net->ref_count, 1); 7025 } 7026 /* on to the sent queue */ 7027 tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead); 7028 if ((tp1) && SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 7029 struct sctp_tmit_chunk *tpp; 7030 7031 /* need to move back */ 7032 back_up_more: 7033 tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next); 7034 if (tpp == NULL) { 7035 TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next); 7036 goto all_done; 7037 } 7038 tp1 = tpp; 7039 if (SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 7040 goto back_up_more; 7041 } 7042 TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next); 7043 } else { 7044 TAILQ_INSERT_TAIL(&asoc->sent_queue, 7045 data_list[i], 7046 sctp_next); 7047 } 7048 all_done: 7049 /* This does not lower until the cum-ack passes it */ 7050 asoc->sent_queue_cnt++; 7051 if ((asoc->peers_rwnd <= 0) && 7052 (asoc->total_flight == 0) && 7053 (bundle_at == 1)) { 7054 /* Mark the chunk as being a window probe */ 7055 SCTP_STAT_INCR(sctps_windowprobed); 7056 } 7057 #ifdef SCTP_AUDITING_ENABLED 7058 sctp_audit_log(0xC2, 3); 7059 #endif 7060 data_list[i]->sent = SCTP_DATAGRAM_SENT; 7061 data_list[i]->snd_count = 1; 7062 data_list[i]->rec.data.chunk_was_revoked = 0; 7063 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 7064 sctp_misc_ints(SCTP_FLIGHT_LOG_UP, 7065 data_list[i]->whoTo->flight_size, 7066 data_list[i]->book_size, 7067 (uint32_t)(uintptr_t)data_list[i]->whoTo, 7068 data_list[i]->rec.data.tsn); 7069 } 7070 sctp_flight_size_increase(data_list[i]); 7071 sctp_total_flight_increase(stcb, data_list[i]); 7072 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 7073 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 7074 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 7075 } 7076 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 7077 (uint32_t)(data_list[i]->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 7078 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 7079 /* SWS sender side engages */ 7080 asoc->peers_rwnd = 0; 7081 } 7082 } 7083 if (asoc->cc_functions.sctp_cwnd_update_packet_transmitted) { 7084 (*asoc->cc_functions.sctp_cwnd_update_packet_transmitted) (stcb, net); 7085 } 7086 } 7087 7088 static void 7089 sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc, int so_locked) 7090 { 7091 struct sctp_tmit_chunk *chk, *nchk; 7092 7093 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 7094 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7095 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 7096 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 7097 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 7098 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) || 7099 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 7100 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 7101 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 7102 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 7103 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 7104 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 7105 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 7106 /* Stray chunks must be cleaned up */ 7107 clean_up_anyway: 7108 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7109 asoc->ctrl_queue_cnt--; 7110 if (chk->data) { 7111 sctp_m_freem(chk->data); 7112 chk->data = NULL; 7113 } 7114 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 7115 asoc->fwd_tsn_cnt--; 7116 } 7117 sctp_free_a_chunk(stcb, chk, so_locked); 7118 } else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 7119 /* special handling, we must look into the param */ 7120 if (chk != asoc->str_reset) { 7121 goto clean_up_anyway; 7122 } 7123 } 7124 } 7125 } 7126 7127 static uint32_t 7128 sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length, 7129 uint32_t space_left, uint32_t frag_point, int eeor_on) 7130 { 7131 /* 7132 * Make a decision on if I should split a msg into multiple parts. 7133 * This is only asked of incomplete messages. 7134 */ 7135 if (eeor_on) { 7136 /* 7137 * If we are doing EEOR we need to always send it if its the 7138 * entire thing, since it might be all the guy is putting in 7139 * the hopper. 7140 */ 7141 if (space_left >= length) { 7142 /*- 7143 * If we have data outstanding, 7144 * we get another chance when the sack 7145 * arrives to transmit - wait for more data 7146 */ 7147 if (stcb->asoc.total_flight == 0) { 7148 /* 7149 * If nothing is in flight, we zero the 7150 * packet counter. 7151 */ 7152 return (length); 7153 } 7154 return (0); 7155 7156 } else { 7157 /* You can fill the rest */ 7158 return (space_left); 7159 } 7160 } 7161 /*- 7162 * For those strange folk that make the send buffer 7163 * smaller than our fragmentation point, we can't 7164 * get a full msg in so we have to allow splitting. 7165 */ 7166 if (SCTP_SB_LIMIT_SND(stcb->sctp_socket) < frag_point) { 7167 return (length); 7168 } 7169 if ((length <= space_left) || 7170 ((length - space_left) < SCTP_BASE_SYSCTL(sctp_min_residual))) { 7171 /* Sub-optimal residual don't split in non-eeor mode. */ 7172 return (0); 7173 } 7174 /* 7175 * If we reach here length is larger than the space_left. Do we wish 7176 * to split it for the sake of packet putting together? 7177 */ 7178 if (space_left >= min(SCTP_BASE_SYSCTL(sctp_min_split_point), frag_point)) { 7179 /* Its ok to split it */ 7180 return (min(space_left, frag_point)); 7181 } 7182 /* Nope, can't split */ 7183 return (0); 7184 } 7185 7186 static uint32_t 7187 sctp_move_to_outqueue(struct sctp_tcb *stcb, 7188 struct sctp_nets *net, 7189 struct sctp_stream_out *strq, 7190 uint32_t space_left, 7191 uint32_t frag_point, 7192 int *giveup, 7193 int eeor_mode, 7194 int *bail, 7195 int so_locked) 7196 { 7197 /* Move from the stream to the send_queue keeping track of the total */ 7198 struct sctp_association *asoc; 7199 struct sctp_stream_queue_pending *sp; 7200 struct sctp_tmit_chunk *chk; 7201 struct sctp_data_chunk *dchkh = NULL; 7202 struct sctp_idata_chunk *ndchkh = NULL; 7203 uint32_t to_move, length; 7204 int leading; 7205 uint8_t rcv_flags = 0; 7206 uint8_t some_taken; 7207 7208 SCTP_TCB_LOCK_ASSERT(stcb); 7209 asoc = &stcb->asoc; 7210 one_more_time: 7211 /* sa_ignore FREED_MEMORY */ 7212 sp = TAILQ_FIRST(&strq->outqueue); 7213 if (sp == NULL) { 7214 sp = TAILQ_FIRST(&strq->outqueue); 7215 if (sp) { 7216 goto one_more_time; 7217 } 7218 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_EXPLICIT_EOR) == 0) && 7219 (stcb->asoc.idata_supported == 0) && 7220 (strq->last_msg_incomplete)) { 7221 SCTP_PRINTF("Huh? Stream:%d lm_in_c=%d but queue is NULL\n", 7222 strq->sid, 7223 strq->last_msg_incomplete); 7224 strq->last_msg_incomplete = 0; 7225 } 7226 to_move = 0; 7227 goto out_of; 7228 } 7229 if ((sp->msg_is_complete) && (sp->length == 0)) { 7230 if (sp->sender_all_done) { 7231 /* 7232 * We are doing deferred cleanup. Last time through 7233 * when we took all the data the sender_all_done was 7234 * not set. 7235 */ 7236 if ((sp->put_last_out == 0) && (sp->discard_rest == 0)) { 7237 SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n"); 7238 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n", 7239 sp->sender_all_done, 7240 sp->length, 7241 sp->msg_is_complete, 7242 sp->put_last_out); 7243 } 7244 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7245 TAILQ_REMOVE(&strq->outqueue, sp, next); 7246 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp); 7247 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7248 (strq->chunks_on_queues == 0) && 7249 TAILQ_EMPTY(&strq->outqueue)) { 7250 stcb->asoc.trigger_reset = 1; 7251 } 7252 if (sp->net) { 7253 sctp_free_remote_addr(sp->net); 7254 sp->net = NULL; 7255 } 7256 if (sp->data) { 7257 sctp_m_freem(sp->data); 7258 sp->data = NULL; 7259 } 7260 sctp_free_a_strmoq(stcb, sp, so_locked); 7261 /* back to get the next msg */ 7262 goto one_more_time; 7263 } else { 7264 /* 7265 * sender just finished this but still holds a 7266 * reference 7267 */ 7268 *giveup = 1; 7269 to_move = 0; 7270 goto out_of; 7271 } 7272 } else { 7273 /* is there some to get */ 7274 if (sp->length == 0) { 7275 /* no */ 7276 *giveup = 1; 7277 to_move = 0; 7278 goto out_of; 7279 } else if (sp->discard_rest) { 7280 /* Whack down the size */ 7281 atomic_subtract_int(&stcb->asoc.total_output_queue_size, sp->length); 7282 if ((stcb->sctp_socket != NULL) && 7283 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 7284 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 7285 atomic_subtract_int(&stcb->sctp_socket->so_snd.sb_cc, sp->length); 7286 } 7287 if (sp->data) { 7288 sctp_m_freem(sp->data); 7289 sp->data = NULL; 7290 sp->tail_mbuf = NULL; 7291 } 7292 sp->length = 0; 7293 sp->some_taken = 1; 7294 *giveup = 1; 7295 to_move = 0; 7296 goto out_of; 7297 } 7298 } 7299 some_taken = sp->some_taken; 7300 length = sp->length; 7301 if (sp->msg_is_complete) { 7302 /* The message is complete */ 7303 to_move = min(length, frag_point); 7304 if (to_move == length) { 7305 /* All of it fits in the MTU */ 7306 if (sp->some_taken) { 7307 rcv_flags |= SCTP_DATA_LAST_FRAG; 7308 } else { 7309 rcv_flags |= SCTP_DATA_NOT_FRAG; 7310 } 7311 sp->put_last_out = 1; 7312 if (sp->sinfo_flags & SCTP_SACK_IMMEDIATELY) { 7313 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7314 } 7315 } else { 7316 /* Not all of it fits, we fragment */ 7317 if (sp->some_taken == 0) { 7318 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7319 } 7320 sp->some_taken = 1; 7321 } 7322 } else { 7323 to_move = sctp_can_we_split_this(stcb, length, space_left, frag_point, eeor_mode); 7324 if (to_move > 0) { 7325 if (to_move >= length) { 7326 to_move = length; 7327 } 7328 if (sp->some_taken == 0) { 7329 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7330 sp->some_taken = 1; 7331 } 7332 } else { 7333 /* Nothing to take. */ 7334 *giveup = 1; 7335 to_move = 0; 7336 goto out_of; 7337 } 7338 } 7339 7340 /* If we reach here, we can copy out a chunk */ 7341 sctp_alloc_a_chunk(stcb, chk); 7342 if (chk == NULL) { 7343 /* No chunk memory */ 7344 *giveup = 1; 7345 to_move = 0; 7346 goto out_of; 7347 } 7348 /* 7349 * Setup for unordered if needed by looking at the user sent info 7350 * flags. 7351 */ 7352 if (sp->sinfo_flags & SCTP_UNORDERED) { 7353 rcv_flags |= SCTP_DATA_UNORDERED; 7354 } 7355 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 7356 (sp->sinfo_flags & SCTP_EOF) == SCTP_EOF) { 7357 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7358 } 7359 /* clear out the chunk before setting up */ 7360 memset(chk, 0, sizeof(*chk)); 7361 chk->rec.data.rcv_flags = rcv_flags; 7362 7363 if (to_move >= length) { 7364 /* we think we can steal the whole thing */ 7365 if (to_move < sp->length) { 7366 /* bail, it changed */ 7367 goto dont_do_it; 7368 } 7369 chk->data = sp->data; 7370 chk->last_mbuf = sp->tail_mbuf; 7371 /* register the stealing */ 7372 sp->data = sp->tail_mbuf = NULL; 7373 } else { 7374 struct mbuf *m; 7375 7376 dont_do_it: 7377 chk->data = SCTP_M_COPYM(sp->data, 0, to_move, M_NOWAIT); 7378 chk->last_mbuf = NULL; 7379 if (chk->data == NULL) { 7380 sp->some_taken = some_taken; 7381 sctp_free_a_chunk(stcb, chk, so_locked); 7382 *bail = 1; 7383 to_move = 0; 7384 goto out_of; 7385 } 7386 #ifdef SCTP_MBUF_LOGGING 7387 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 7388 sctp_log_mbc(chk->data, SCTP_MBUF_ICOPY); 7389 } 7390 #endif 7391 /* Pull off the data */ 7392 m_adj(sp->data, to_move); 7393 /* Now lets work our way down and compact it */ 7394 m = sp->data; 7395 while (m && (SCTP_BUF_LEN(m) == 0)) { 7396 sp->data = SCTP_BUF_NEXT(m); 7397 SCTP_BUF_NEXT(m) = NULL; 7398 if (sp->tail_mbuf == m) { 7399 /*- 7400 * Freeing tail? TSNH since 7401 * we supposedly were taking less 7402 * than the sp->length. 7403 */ 7404 #ifdef INVARIANTS 7405 panic("Huh, freeing tail? - TSNH"); 7406 #else 7407 SCTP_PRINTF("Huh, freeing tail? - TSNH\n"); 7408 sp->tail_mbuf = sp->data = NULL; 7409 sp->length = 0; 7410 #endif 7411 } 7412 sctp_m_free(m); 7413 m = sp->data; 7414 } 7415 } 7416 if (SCTP_BUF_IS_EXTENDED(chk->data)) { 7417 chk->copy_by_ref = 1; 7418 } else { 7419 chk->copy_by_ref = 0; 7420 } 7421 /* 7422 * get last_mbuf and counts of mb usage This is ugly but hopefully 7423 * its only one mbuf. 7424 */ 7425 if (chk->last_mbuf == NULL) { 7426 chk->last_mbuf = chk->data; 7427 while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) { 7428 chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf); 7429 } 7430 } 7431 7432 if (to_move > length) { 7433 /*- This should not happen either 7434 * since we always lower to_move to the size 7435 * of sp->length if its larger. 7436 */ 7437 #ifdef INVARIANTS 7438 panic("Huh, how can to_move be larger?"); 7439 #else 7440 SCTP_PRINTF("Huh, how can to_move be larger?\n"); 7441 sp->length = 0; 7442 #endif 7443 } else { 7444 atomic_subtract_int(&sp->length, to_move); 7445 } 7446 leading = SCTP_DATA_CHUNK_OVERHEAD(stcb); 7447 if (M_LEADINGSPACE(chk->data) < leading) { 7448 /* Not enough room for a chunk header, get some */ 7449 struct mbuf *m; 7450 7451 m = sctp_get_mbuf_for_msg(1, 0, M_NOWAIT, 1, MT_DATA); 7452 if (m == NULL) { 7453 /* 7454 * we're in trouble here. _PREPEND below will free 7455 * all the data if there is no leading space, so we 7456 * must put the data back and restore. 7457 */ 7458 if (sp->data == NULL) { 7459 /* unsteal the data */ 7460 sp->data = chk->data; 7461 sp->tail_mbuf = chk->last_mbuf; 7462 } else { 7463 struct mbuf *m_tmp; 7464 7465 /* reassemble the data */ 7466 m_tmp = sp->data; 7467 sp->data = chk->data; 7468 SCTP_BUF_NEXT(chk->last_mbuf) = m_tmp; 7469 } 7470 sp->some_taken = some_taken; 7471 atomic_add_int(&sp->length, to_move); 7472 chk->data = NULL; 7473 *bail = 1; 7474 sctp_free_a_chunk(stcb, chk, so_locked); 7475 to_move = 0; 7476 goto out_of; 7477 } else { 7478 SCTP_BUF_LEN(m) = 0; 7479 SCTP_BUF_NEXT(m) = chk->data; 7480 chk->data = m; 7481 M_ALIGN(chk->data, 4); 7482 } 7483 } 7484 SCTP_BUF_PREPEND(chk->data, SCTP_DATA_CHUNK_OVERHEAD(stcb), M_NOWAIT); 7485 if (chk->data == NULL) { 7486 /* HELP, TSNH since we assured it would not above? */ 7487 #ifdef INVARIANTS 7488 panic("prepend fails HELP?"); 7489 #else 7490 SCTP_PRINTF("prepend fails HELP?\n"); 7491 sctp_free_a_chunk(stcb, chk, so_locked); 7492 #endif 7493 *bail = 1; 7494 to_move = 0; 7495 goto out_of; 7496 } 7497 sctp_snd_sb_alloc(stcb, SCTP_DATA_CHUNK_OVERHEAD(stcb)); 7498 chk->book_size = chk->send_size = (uint16_t)(to_move + SCTP_DATA_CHUNK_OVERHEAD(stcb)); 7499 chk->book_size_scale = 0; 7500 chk->sent = SCTP_DATAGRAM_UNSENT; 7501 7502 chk->flags = 0; 7503 chk->asoc = &stcb->asoc; 7504 chk->pad_inplace = 0; 7505 chk->no_fr_allowed = 0; 7506 if (stcb->asoc.idata_supported == 0) { 7507 if (rcv_flags & SCTP_DATA_UNORDERED) { 7508 /* Just use 0. The receiver ignores the values. */ 7509 chk->rec.data.mid = 0; 7510 } else { 7511 chk->rec.data.mid = strq->next_mid_ordered; 7512 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7513 strq->next_mid_ordered++; 7514 } 7515 } 7516 } else { 7517 if (rcv_flags & SCTP_DATA_UNORDERED) { 7518 chk->rec.data.mid = strq->next_mid_unordered; 7519 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7520 strq->next_mid_unordered++; 7521 } 7522 } else { 7523 chk->rec.data.mid = strq->next_mid_ordered; 7524 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7525 strq->next_mid_ordered++; 7526 } 7527 } 7528 } 7529 chk->rec.data.sid = sp->sid; 7530 chk->rec.data.ppid = sp->ppid; 7531 chk->rec.data.context = sp->context; 7532 chk->rec.data.doing_fast_retransmit = 0; 7533 7534 chk->rec.data.timetodrop = sp->ts; 7535 chk->flags = sp->act_flags; 7536 7537 if (sp->net) { 7538 chk->whoTo = sp->net; 7539 atomic_add_int(&chk->whoTo->ref_count, 1); 7540 } else 7541 chk->whoTo = NULL; 7542 7543 if (sp->holds_key_ref) { 7544 chk->auth_keyid = sp->auth_keyid; 7545 sctp_auth_key_acquire(stcb, chk->auth_keyid); 7546 chk->holds_key_ref = 1; 7547 } 7548 stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, to_move); 7549 chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1); 7550 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) { 7551 sctp_misc_ints(SCTP_STRMOUT_LOG_SEND, 7552 (uint32_t)(uintptr_t)stcb, sp->length, 7553 (uint32_t)((chk->rec.data.sid << 16) | (0x0000ffff & chk->rec.data.mid)), 7554 chk->rec.data.tsn); 7555 } 7556 if (stcb->asoc.idata_supported == 0) { 7557 dchkh = mtod(chk->data, struct sctp_data_chunk *); 7558 } else { 7559 ndchkh = mtod(chk->data, struct sctp_idata_chunk *); 7560 } 7561 /* 7562 * Put the rest of the things in place now. Size was done earlier in 7563 * previous loop prior to padding. 7564 */ 7565 7566 SCTP_TCB_LOCK_ASSERT(stcb); 7567 #ifdef SCTP_ASOCLOG_OF_TSNS 7568 if (asoc->tsn_out_at >= SCTP_TSN_LOG_SIZE) { 7569 asoc->tsn_out_at = 0; 7570 asoc->tsn_out_wrapped = 1; 7571 } 7572 asoc->out_tsnlog[asoc->tsn_out_at].tsn = chk->rec.data.tsn; 7573 asoc->out_tsnlog[asoc->tsn_out_at].strm = chk->rec.data.sid; 7574 asoc->out_tsnlog[asoc->tsn_out_at].seq = chk->rec.data.mid; 7575 asoc->out_tsnlog[asoc->tsn_out_at].sz = chk->send_size; 7576 asoc->out_tsnlog[asoc->tsn_out_at].flgs = chk->rec.data.rcv_flags; 7577 asoc->out_tsnlog[asoc->tsn_out_at].stcb = (void *)stcb; 7578 asoc->out_tsnlog[asoc->tsn_out_at].in_pos = asoc->tsn_out_at; 7579 asoc->out_tsnlog[asoc->tsn_out_at].in_out = 2; 7580 asoc->tsn_out_at++; 7581 #endif 7582 if (stcb->asoc.idata_supported == 0) { 7583 dchkh->ch.chunk_type = SCTP_DATA; 7584 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7585 dchkh->dp.tsn = htonl(chk->rec.data.tsn); 7586 dchkh->dp.sid = htons(strq->sid); 7587 dchkh->dp.ssn = htons((uint16_t)chk->rec.data.mid); 7588 dchkh->dp.ppid = chk->rec.data.ppid; 7589 dchkh->ch.chunk_length = htons(chk->send_size); 7590 } else { 7591 ndchkh->ch.chunk_type = SCTP_IDATA; 7592 ndchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7593 ndchkh->dp.tsn = htonl(chk->rec.data.tsn); 7594 ndchkh->dp.sid = htons(strq->sid); 7595 ndchkh->dp.reserved = htons(0); 7596 ndchkh->dp.mid = htonl(chk->rec.data.mid); 7597 if (sp->fsn == 0) 7598 ndchkh->dp.ppid_fsn.ppid = chk->rec.data.ppid; 7599 else 7600 ndchkh->dp.ppid_fsn.fsn = htonl(sp->fsn); 7601 sp->fsn++; 7602 ndchkh->ch.chunk_length = htons(chk->send_size); 7603 } 7604 /* Now advance the chk->send_size by the actual pad needed. */ 7605 if (chk->send_size < SCTP_SIZE32(chk->book_size)) { 7606 /* need a pad */ 7607 struct mbuf *lm; 7608 int pads; 7609 7610 pads = SCTP_SIZE32(chk->book_size) - chk->send_size; 7611 lm = sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf); 7612 if (lm != NULL) { 7613 chk->last_mbuf = lm; 7614 chk->pad_inplace = 1; 7615 } 7616 chk->send_size += pads; 7617 } 7618 if (PR_SCTP_ENABLED(chk->flags)) { 7619 asoc->pr_sctp_cnt++; 7620 } 7621 if (sp->msg_is_complete && (sp->length == 0) && (sp->sender_all_done)) { 7622 /* All done pull and kill the message */ 7623 if (sp->put_last_out == 0) { 7624 SCTP_PRINTF("Gak, put out entire msg with NO end!-2\n"); 7625 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n", 7626 sp->sender_all_done, 7627 sp->length, 7628 sp->msg_is_complete, 7629 sp->put_last_out); 7630 } 7631 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7632 TAILQ_REMOVE(&strq->outqueue, sp, next); 7633 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp); 7634 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7635 (strq->chunks_on_queues == 0) && 7636 TAILQ_EMPTY(&strq->outqueue)) { 7637 stcb->asoc.trigger_reset = 1; 7638 } 7639 if (sp->net) { 7640 sctp_free_remote_addr(sp->net); 7641 sp->net = NULL; 7642 } 7643 if (sp->data) { 7644 sctp_m_freem(sp->data); 7645 sp->data = NULL; 7646 } 7647 sctp_free_a_strmoq(stcb, sp, so_locked); 7648 } 7649 asoc->chunks_on_out_queue++; 7650 strq->chunks_on_queues++; 7651 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 7652 asoc->send_queue_cnt++; 7653 out_of: 7654 return (to_move); 7655 } 7656 7657 static void 7658 sctp_fill_outqueue(struct sctp_tcb *stcb, struct sctp_nets *net, 7659 uint32_t frag_point, int eeor_mode, int *quit_now, 7660 int so_locked) 7661 { 7662 struct sctp_association *asoc; 7663 struct sctp_stream_out *strq; 7664 uint32_t space_left, moved, total_moved; 7665 int bail, giveup; 7666 7667 SCTP_TCB_LOCK_ASSERT(stcb); 7668 asoc = &stcb->asoc; 7669 total_moved = 0; 7670 switch (net->ro._l_addr.sa.sa_family) { 7671 #ifdef INET 7672 case AF_INET: 7673 space_left = net->mtu - SCTP_MIN_V4_OVERHEAD; 7674 break; 7675 #endif 7676 #ifdef INET6 7677 case AF_INET6: 7678 space_left = net->mtu - SCTP_MIN_OVERHEAD; 7679 break; 7680 #endif 7681 default: 7682 /* TSNH */ 7683 space_left = net->mtu; 7684 break; 7685 } 7686 /* Need an allowance for the data chunk header too */ 7687 space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb); 7688 7689 /* must make even word boundary */ 7690 space_left &= 0xfffffffc; 7691 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7692 giveup = 0; 7693 bail = 0; 7694 while ((space_left > 0) && (strq != NULL)) { 7695 moved = sctp_move_to_outqueue(stcb, net, strq, space_left, 7696 frag_point, &giveup, eeor_mode, 7697 &bail, so_locked); 7698 if ((giveup != 0) || (bail != 0)) { 7699 break; 7700 } 7701 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7702 total_moved += moved; 7703 if (space_left >= moved) { 7704 space_left -= moved; 7705 } else { 7706 space_left = 0; 7707 } 7708 if (space_left >= SCTP_DATA_CHUNK_OVERHEAD(stcb)) { 7709 space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb); 7710 } else { 7711 space_left = 0; 7712 } 7713 space_left &= 0xfffffffc; 7714 } 7715 if (bail != 0) 7716 *quit_now = 1; 7717 7718 stcb->asoc.ss_functions.sctp_ss_packet_done(stcb, net, asoc); 7719 7720 if (total_moved == 0) { 7721 if ((stcb->asoc.sctp_cmt_on_off == 0) && 7722 (net == stcb->asoc.primary_destination)) { 7723 /* ran dry for primary network net */ 7724 SCTP_STAT_INCR(sctps_primary_randry); 7725 } else if (stcb->asoc.sctp_cmt_on_off > 0) { 7726 /* ran dry with CMT on */ 7727 SCTP_STAT_INCR(sctps_cmt_randry); 7728 } 7729 } 7730 } 7731 7732 void 7733 sctp_fix_ecn_echo(struct sctp_association *asoc) 7734 { 7735 struct sctp_tmit_chunk *chk; 7736 7737 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7738 if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 7739 chk->sent = SCTP_DATAGRAM_UNSENT; 7740 } 7741 } 7742 } 7743 7744 void 7745 sctp_move_chunks_from_net(struct sctp_tcb *stcb, struct sctp_nets *net) 7746 { 7747 struct sctp_association *asoc; 7748 struct sctp_tmit_chunk *chk; 7749 struct sctp_stream_queue_pending *sp; 7750 unsigned int i; 7751 7752 if (net == NULL) { 7753 return; 7754 } 7755 asoc = &stcb->asoc; 7756 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 7757 TAILQ_FOREACH(sp, &stcb->asoc.strmout[i].outqueue, next) { 7758 if (sp->net == net) { 7759 sctp_free_remote_addr(sp->net); 7760 sp->net = NULL; 7761 } 7762 } 7763 } 7764 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7765 if (chk->whoTo == net) { 7766 sctp_free_remote_addr(chk->whoTo); 7767 chk->whoTo = NULL; 7768 } 7769 } 7770 } 7771 7772 int 7773 sctp_med_chunk_output(struct sctp_inpcb *inp, 7774 struct sctp_tcb *stcb, 7775 struct sctp_association *asoc, 7776 int *num_out, 7777 int *reason_code, 7778 int control_only, int from_where, 7779 struct timeval *now, int *now_filled, 7780 uint32_t frag_point, int so_locked) 7781 { 7782 /** 7783 * Ok this is the generic chunk service queue. we must do the 7784 * following: 7785 * - Service the stream queue that is next, moving any 7786 * message (note I must get a complete message i.e. FIRST/MIDDLE and 7787 * LAST to the out queue in one pass) and assigning TSN's. This 7788 * only applies though if the peer does not support NDATA. For NDATA 7789 * chunks its ok to not send the entire message ;-) 7790 * - Check to see if the cwnd/rwnd allows any output, if so we go ahead and 7791 * formulate and send the low level chunks. Making sure to combine 7792 * any control in the control chunk queue also. 7793 */ 7794 struct sctp_nets *net, *start_at, *sack_goes_to = NULL, *old_start_at = NULL; 7795 struct mbuf *outchain, *endoutchain; 7796 struct sctp_tmit_chunk *chk, *nchk; 7797 7798 /* temp arrays for unlinking */ 7799 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 7800 int no_fragmentflg, error; 7801 unsigned int max_rwnd_per_dest, max_send_per_dest; 7802 int one_chunk, hbflag, skip_data_for_this_net; 7803 int asconf, cookie, no_out_cnt; 7804 int bundle_at, ctl_cnt, no_data_chunks, eeor_mode; 7805 unsigned int mtu, r_mtu, omtu, mx_mtu, to_out; 7806 int tsns_sent = 0; 7807 uint32_t auth_offset; 7808 struct sctp_auth_chunk *auth; 7809 uint16_t auth_keyid; 7810 int override_ok = 1; 7811 int skip_fill_up = 0; 7812 int data_auth_reqd = 0; 7813 7814 /* 7815 * JRS 5/14/07 - Add flag for whether a heartbeat is sent to the 7816 * destination. 7817 */ 7818 int quit_now = 0; 7819 bool use_zero_crc; 7820 7821 *num_out = 0; 7822 *reason_code = 0; 7823 auth_keyid = stcb->asoc.authinfo.active_keyid; 7824 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) || 7825 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 7826 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 7827 eeor_mode = 1; 7828 } else { 7829 eeor_mode = 0; 7830 } 7831 ctl_cnt = no_out_cnt = asconf = cookie = 0; 7832 /* 7833 * First lets prime the pump. For each destination, if there is room 7834 * in the flight size, attempt to pull an MTU's worth out of the 7835 * stream queues into the general send_queue 7836 */ 7837 #ifdef SCTP_AUDITING_ENABLED 7838 sctp_audit_log(0xC2, 2); 7839 #endif 7840 SCTP_TCB_LOCK_ASSERT(stcb); 7841 hbflag = 0; 7842 if (control_only) 7843 no_data_chunks = 1; 7844 else 7845 no_data_chunks = 0; 7846 7847 /* Nothing to possible to send? */ 7848 if ((TAILQ_EMPTY(&asoc->control_send_queue) || 7849 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) && 7850 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7851 TAILQ_EMPTY(&asoc->send_queue) && 7852 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 7853 nothing_to_send: 7854 *reason_code = 9; 7855 return (0); 7856 } 7857 if (asoc->peers_rwnd == 0) { 7858 /* No room in peers rwnd */ 7859 *reason_code = 1; 7860 if (asoc->total_flight > 0) { 7861 /* we are allowed one chunk in flight */ 7862 no_data_chunks = 1; 7863 } 7864 } 7865 if (stcb->asoc.ecn_echo_cnt_onq) { 7866 /* Record where a sack goes, if any */ 7867 if (no_data_chunks && 7868 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) { 7869 /* Nothing but ECNe to send - we don't do that */ 7870 goto nothing_to_send; 7871 } 7872 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7873 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7874 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 7875 sack_goes_to = chk->whoTo; 7876 break; 7877 } 7878 } 7879 } 7880 max_rwnd_per_dest = ((asoc->peers_rwnd + asoc->total_flight) / asoc->numnets); 7881 if (stcb->sctp_socket) 7882 max_send_per_dest = SCTP_SB_LIMIT_SND(stcb->sctp_socket) / asoc->numnets; 7883 else 7884 max_send_per_dest = 0; 7885 if (no_data_chunks == 0) { 7886 /* How many non-directed chunks are there? */ 7887 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7888 if (chk->whoTo == NULL) { 7889 /* 7890 * We already have non-directed chunks on 7891 * the queue, no need to do a fill-up. 7892 */ 7893 skip_fill_up = 1; 7894 break; 7895 } 7896 } 7897 } 7898 if ((no_data_chunks == 0) && 7899 (skip_fill_up == 0) && 7900 (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc))) { 7901 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 7902 /* 7903 * This for loop we are in takes in each net, if 7904 * its's got space in cwnd and has data sent to it 7905 * (when CMT is off) then it calls 7906 * sctp_fill_outqueue for the net. This gets data on 7907 * the send queue for that network. 7908 * 7909 * In sctp_fill_outqueue TSN's are assigned and data 7910 * is copied out of the stream buffers. Note mostly 7911 * copy by reference (we hope). 7912 */ 7913 net->window_probe = 0; 7914 if ((net != stcb->asoc.alternate) && 7915 ((net->dest_state & SCTP_ADDR_PF) || 7916 ((net->dest_state & SCTP_ADDR_REACHABLE) == 0) || 7917 (net->dest_state & SCTP_ADDR_UNCONFIRMED))) { 7918 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7919 sctp_log_cwnd(stcb, net, 1, 7920 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7921 } 7922 continue; 7923 } 7924 if ((stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) && 7925 (net->flight_size == 0)) { 7926 (*stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) (stcb, net); 7927 } 7928 if (net->flight_size >= net->cwnd) { 7929 /* skip this network, no room - can't fill */ 7930 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7931 sctp_log_cwnd(stcb, net, 3, 7932 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7933 } 7934 continue; 7935 } 7936 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7937 sctp_log_cwnd(stcb, net, 4, SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7938 } 7939 sctp_fill_outqueue(stcb, net, frag_point, eeor_mode, &quit_now, so_locked); 7940 if (quit_now) { 7941 /* memory alloc failure */ 7942 no_data_chunks = 1; 7943 break; 7944 } 7945 } 7946 } 7947 /* now service each destination and send out what we can for it */ 7948 /* Nothing to send? */ 7949 if (TAILQ_EMPTY(&asoc->control_send_queue) && 7950 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7951 TAILQ_EMPTY(&asoc->send_queue)) { 7952 *reason_code = 8; 7953 return (0); 7954 } 7955 7956 if (asoc->sctp_cmt_on_off > 0) { 7957 /* get the last start point */ 7958 start_at = asoc->last_net_cmt_send_started; 7959 if (start_at == NULL) { 7960 /* null so to beginning */ 7961 start_at = TAILQ_FIRST(&asoc->nets); 7962 } else { 7963 start_at = TAILQ_NEXT(asoc->last_net_cmt_send_started, sctp_next); 7964 if (start_at == NULL) { 7965 start_at = TAILQ_FIRST(&asoc->nets); 7966 } 7967 } 7968 asoc->last_net_cmt_send_started = start_at; 7969 } else { 7970 start_at = TAILQ_FIRST(&asoc->nets); 7971 } 7972 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7973 if (chk->whoTo == NULL) { 7974 if (asoc->alternate) { 7975 chk->whoTo = asoc->alternate; 7976 } else { 7977 chk->whoTo = asoc->primary_destination; 7978 } 7979 atomic_add_int(&chk->whoTo->ref_count, 1); 7980 } 7981 } 7982 old_start_at = NULL; 7983 again_one_more_time: 7984 for (net = start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) { 7985 /* how much can we send? */ 7986 /* SCTPDBG("Examine for sending net:%x\n", (uint32_t)net); */ 7987 if (old_start_at && (old_start_at == net)) { 7988 /* through list completely. */ 7989 break; 7990 } 7991 tsns_sent = 0xa; 7992 if (TAILQ_EMPTY(&asoc->control_send_queue) && 7993 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7994 (net->flight_size >= net->cwnd)) { 7995 /* 7996 * Nothing on control or asconf and flight is full, 7997 * we can skip even in the CMT case. 7998 */ 7999 continue; 8000 } 8001 bundle_at = 0; 8002 endoutchain = outchain = NULL; 8003 auth = NULL; 8004 auth_offset = 0; 8005 no_fragmentflg = 1; 8006 one_chunk = 0; 8007 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 8008 skip_data_for_this_net = 1; 8009 } else { 8010 skip_data_for_this_net = 0; 8011 } 8012 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8013 #ifdef INET 8014 case AF_INET: 8015 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8016 break; 8017 #endif 8018 #ifdef INET6 8019 case AF_INET6: 8020 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8021 break; 8022 #endif 8023 default: 8024 /* TSNH */ 8025 mtu = net->mtu; 8026 break; 8027 } 8028 mx_mtu = mtu; 8029 to_out = 0; 8030 if (mtu > asoc->peers_rwnd) { 8031 if (asoc->total_flight > 0) { 8032 /* We have a packet in flight somewhere */ 8033 r_mtu = asoc->peers_rwnd; 8034 } else { 8035 /* We are always allowed to send one MTU out */ 8036 one_chunk = 1; 8037 r_mtu = mtu; 8038 } 8039 } else { 8040 r_mtu = mtu; 8041 } 8042 error = 0; 8043 /************************/ 8044 /* ASCONF transmission */ 8045 /************************/ 8046 /* Now first lets go through the asconf queue */ 8047 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 8048 if (chk->rec.chunk_id.id != SCTP_ASCONF) { 8049 continue; 8050 } 8051 if (chk->whoTo == NULL) { 8052 if (asoc->alternate == NULL) { 8053 if (asoc->primary_destination != net) { 8054 break; 8055 } 8056 } else { 8057 if (asoc->alternate != net) { 8058 break; 8059 } 8060 } 8061 } else { 8062 if (chk->whoTo != net) { 8063 break; 8064 } 8065 } 8066 if (chk->data == NULL) { 8067 break; 8068 } 8069 if (chk->sent != SCTP_DATAGRAM_UNSENT && 8070 chk->sent != SCTP_DATAGRAM_RESEND) { 8071 break; 8072 } 8073 /* 8074 * if no AUTH is yet included and this chunk 8075 * requires it, make sure to account for it. We 8076 * don't apply the size until the AUTH chunk is 8077 * actually added below in case there is no room for 8078 * this chunk. NOTE: we overload the use of "omtu" 8079 * here 8080 */ 8081 if ((auth == NULL) && 8082 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8083 stcb->asoc.peer_auth_chunks)) { 8084 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8085 } else 8086 omtu = 0; 8087 /* Here we do NOT factor the r_mtu */ 8088 if ((chk->send_size < (int)(mtu - omtu)) || 8089 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8090 /* 8091 * We probably should glom the mbuf chain 8092 * from the chk->data for control but the 8093 * problem is it becomes yet one more level 8094 * of tracking to do if for some reason 8095 * output fails. Then I have got to 8096 * reconstruct the merged control chain.. el 8097 * yucko.. for now we take the easy way and 8098 * do the copy 8099 */ 8100 /* 8101 * Add an AUTH chunk, if chunk requires it 8102 * save the offset into the chain for AUTH 8103 */ 8104 if ((auth == NULL) && 8105 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8106 stcb->asoc.peer_auth_chunks))) { 8107 outchain = sctp_add_auth_chunk(outchain, 8108 &endoutchain, 8109 &auth, 8110 &auth_offset, 8111 stcb, 8112 chk->rec.chunk_id.id); 8113 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8114 } 8115 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8116 (int)chk->rec.chunk_id.can_take_data, 8117 chk->send_size, chk->copy_by_ref); 8118 if (outchain == NULL) { 8119 *reason_code = 8; 8120 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8121 return (ENOMEM); 8122 } 8123 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8124 /* update our MTU size */ 8125 if (mtu > (chk->send_size + omtu)) 8126 mtu -= (chk->send_size + omtu); 8127 else 8128 mtu = 0; 8129 to_out += (chk->send_size + omtu); 8130 /* Do clear IP_DF ? */ 8131 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8132 no_fragmentflg = 0; 8133 } 8134 if (chk->rec.chunk_id.can_take_data) 8135 chk->data = NULL; 8136 /* 8137 * set hb flag since we can use these for 8138 * RTO 8139 */ 8140 hbflag = 1; 8141 asconf = 1; 8142 /* 8143 * should sysctl this: don't bundle data 8144 * with ASCONF since it requires AUTH 8145 */ 8146 no_data_chunks = 1; 8147 chk->sent = SCTP_DATAGRAM_SENT; 8148 if (chk->whoTo == NULL) { 8149 chk->whoTo = net; 8150 atomic_add_int(&net->ref_count, 1); 8151 } 8152 chk->snd_count++; 8153 if (mtu == 0) { 8154 /* 8155 * Ok we are out of room but we can 8156 * output without effecting the 8157 * flight size since this little guy 8158 * is a control only packet. 8159 */ 8160 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8161 /* 8162 * do NOT clear the asconf flag as 8163 * it is used to do appropriate 8164 * source address selection. 8165 */ 8166 if (*now_filled == 0) { 8167 (void)SCTP_GETTIME_TIMEVAL(now); 8168 *now_filled = 1; 8169 } 8170 net->last_sent_time = *now; 8171 hbflag = 0; 8172 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8173 (struct sockaddr *)&net->ro._l_addr, 8174 outchain, auth_offset, auth, 8175 stcb->asoc.authinfo.active_keyid, 8176 no_fragmentflg, 0, asconf, 8177 inp->sctp_lport, stcb->rport, 8178 htonl(stcb->asoc.peer_vtag), 8179 net->port, NULL, 8180 0, 0, 8181 false, so_locked))) { 8182 /* 8183 * error, we could not 8184 * output 8185 */ 8186 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8187 if (from_where == 0) { 8188 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8189 } 8190 if (error == ENOBUFS) { 8191 asoc->ifp_had_enobuf = 1; 8192 SCTP_STAT_INCR(sctps_lowlevelerr); 8193 } 8194 /* error, could not output */ 8195 if (error == EHOSTUNREACH) { 8196 /* 8197 * Destination went 8198 * unreachable 8199 * during this send 8200 */ 8201 sctp_move_chunks_from_net(stcb, net); 8202 } 8203 asconf = 0; 8204 *reason_code = 7; 8205 break; 8206 } else { 8207 asoc->ifp_had_enobuf = 0; 8208 } 8209 /* 8210 * increase the number we sent, if a 8211 * cookie is sent we don't tell them 8212 * any was sent out. 8213 */ 8214 outchain = endoutchain = NULL; 8215 auth = NULL; 8216 auth_offset = 0; 8217 asconf = 0; 8218 if (!no_out_cnt) 8219 *num_out += ctl_cnt; 8220 /* recalc a clean slate and setup */ 8221 switch (net->ro._l_addr.sa.sa_family) { 8222 #ifdef INET 8223 case AF_INET: 8224 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8225 break; 8226 #endif 8227 #ifdef INET6 8228 case AF_INET6: 8229 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8230 break; 8231 #endif 8232 default: 8233 /* TSNH */ 8234 mtu = net->mtu; 8235 break; 8236 } 8237 to_out = 0; 8238 no_fragmentflg = 1; 8239 } 8240 } 8241 } 8242 if (error != 0) { 8243 /* try next net */ 8244 continue; 8245 } 8246 /************************/ 8247 /* Control transmission */ 8248 /************************/ 8249 /* Now first lets go through the control queue */ 8250 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 8251 if ((sack_goes_to) && 8252 (chk->rec.chunk_id.id == SCTP_ECN_ECHO) && 8253 (chk->whoTo != sack_goes_to)) { 8254 /* 8255 * if we have a sack in queue, and we are 8256 * looking at an ecn echo that is NOT queued 8257 * to where the sack is going.. 8258 */ 8259 if (chk->whoTo == net) { 8260 /* 8261 * Don't transmit it to where its 8262 * going (current net) 8263 */ 8264 continue; 8265 } else if (sack_goes_to == net) { 8266 /* 8267 * But do transmit it to this 8268 * address 8269 */ 8270 goto skip_net_check; 8271 } 8272 } 8273 if (chk->whoTo == NULL) { 8274 if (asoc->alternate == NULL) { 8275 if (asoc->primary_destination != net) { 8276 continue; 8277 } 8278 } else { 8279 if (asoc->alternate != net) { 8280 continue; 8281 } 8282 } 8283 } else { 8284 if (chk->whoTo != net) { 8285 continue; 8286 } 8287 } 8288 skip_net_check: 8289 if (chk->data == NULL) { 8290 continue; 8291 } 8292 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 8293 /* 8294 * It must be unsent. Cookies and ASCONF's 8295 * hang around but there timers will force 8296 * when marked for resend. 8297 */ 8298 continue; 8299 } 8300 /* 8301 * if no AUTH is yet included and this chunk 8302 * requires it, make sure to account for it. We 8303 * don't apply the size until the AUTH chunk is 8304 * actually added below in case there is no room for 8305 * this chunk. NOTE: we overload the use of "omtu" 8306 * here 8307 */ 8308 if ((auth == NULL) && 8309 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8310 stcb->asoc.peer_auth_chunks)) { 8311 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8312 } else 8313 omtu = 0; 8314 /* Here we do NOT factor the r_mtu */ 8315 if ((chk->send_size <= (int)(mtu - omtu)) || 8316 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8317 /* 8318 * We probably should glom the mbuf chain 8319 * from the chk->data for control but the 8320 * problem is it becomes yet one more level 8321 * of tracking to do if for some reason 8322 * output fails. Then I have got to 8323 * reconstruct the merged control chain.. el 8324 * yucko.. for now we take the easy way and 8325 * do the copy 8326 */ 8327 /* 8328 * Add an AUTH chunk, if chunk requires it 8329 * save the offset into the chain for AUTH 8330 */ 8331 if ((auth == NULL) && 8332 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8333 stcb->asoc.peer_auth_chunks))) { 8334 outchain = sctp_add_auth_chunk(outchain, 8335 &endoutchain, 8336 &auth, 8337 &auth_offset, 8338 stcb, 8339 chk->rec.chunk_id.id); 8340 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8341 } 8342 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8343 (int)chk->rec.chunk_id.can_take_data, 8344 chk->send_size, chk->copy_by_ref); 8345 if (outchain == NULL) { 8346 *reason_code = 8; 8347 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8348 return (ENOMEM); 8349 } 8350 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8351 /* update our MTU size */ 8352 if (mtu > (chk->send_size + omtu)) 8353 mtu -= (chk->send_size + omtu); 8354 else 8355 mtu = 0; 8356 to_out += (chk->send_size + omtu); 8357 /* Do clear IP_DF ? */ 8358 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8359 no_fragmentflg = 0; 8360 } 8361 if (chk->rec.chunk_id.can_take_data) 8362 chk->data = NULL; 8363 /* Mark things to be removed, if needed */ 8364 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8365 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 8366 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 8367 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 8368 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 8369 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 8370 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 8371 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 8372 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 8373 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 8374 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 8375 if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) { 8376 hbflag = 1; 8377 } 8378 /* remove these chunks at the end */ 8379 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8380 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 8381 /* turn off the timer */ 8382 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 8383 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 8384 inp, stcb, NULL, 8385 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1); 8386 } 8387 } 8388 ctl_cnt++; 8389 } else { 8390 /* 8391 * Other chunks, since they have 8392 * timers running (i.e. COOKIE) we 8393 * just "trust" that it gets sent or 8394 * retransmitted. 8395 */ 8396 ctl_cnt++; 8397 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 8398 cookie = 1; 8399 no_out_cnt = 1; 8400 } else if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 8401 /* 8402 * Increment ecne send count 8403 * here this means we may be 8404 * over-zealous in our 8405 * counting if the send 8406 * fails, but its the best 8407 * place to do it (we used 8408 * to do it in the queue of 8409 * the chunk, but that did 8410 * not tell how many times 8411 * it was sent. 8412 */ 8413 SCTP_STAT_INCR(sctps_sendecne); 8414 } 8415 chk->sent = SCTP_DATAGRAM_SENT; 8416 if (chk->whoTo == NULL) { 8417 chk->whoTo = net; 8418 atomic_add_int(&net->ref_count, 1); 8419 } 8420 chk->snd_count++; 8421 } 8422 if (mtu == 0) { 8423 /* 8424 * Ok we are out of room but we can 8425 * output without effecting the 8426 * flight size since this little guy 8427 * is a control only packet. 8428 */ 8429 use_zero_crc = asoc->zero_checksum == 2; 8430 if (asconf) { 8431 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8432 use_zero_crc = false; 8433 /* 8434 * do NOT clear the asconf 8435 * flag as it is used to do 8436 * appropriate source 8437 * address selection. 8438 */ 8439 } 8440 if (cookie) { 8441 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8442 use_zero_crc = false; 8443 cookie = 0; 8444 } 8445 /* Only HB or ASCONF advances time */ 8446 if (hbflag) { 8447 if (*now_filled == 0) { 8448 (void)SCTP_GETTIME_TIMEVAL(now); 8449 *now_filled = 1; 8450 } 8451 net->last_sent_time = *now; 8452 hbflag = 0; 8453 } 8454 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8455 (struct sockaddr *)&net->ro._l_addr, 8456 outchain, 8457 auth_offset, auth, 8458 stcb->asoc.authinfo.active_keyid, 8459 no_fragmentflg, 0, asconf, 8460 inp->sctp_lport, stcb->rport, 8461 htonl(stcb->asoc.peer_vtag), 8462 net->port, NULL, 8463 0, 0, 8464 use_zero_crc, so_locked))) { 8465 /* 8466 * error, we could not 8467 * output 8468 */ 8469 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8470 if (from_where == 0) { 8471 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8472 } 8473 if (error == ENOBUFS) { 8474 asoc->ifp_had_enobuf = 1; 8475 SCTP_STAT_INCR(sctps_lowlevelerr); 8476 } 8477 if (error == EHOSTUNREACH) { 8478 /* 8479 * Destination went 8480 * unreachable 8481 * during this send 8482 */ 8483 sctp_move_chunks_from_net(stcb, net); 8484 } 8485 asconf = 0; 8486 *reason_code = 7; 8487 break; 8488 } else { 8489 asoc->ifp_had_enobuf = 0; 8490 } 8491 /* 8492 * increase the number we sent, if a 8493 * cookie is sent we don't tell them 8494 * any was sent out. 8495 */ 8496 outchain = endoutchain = NULL; 8497 auth = NULL; 8498 auth_offset = 0; 8499 asconf = 0; 8500 if (!no_out_cnt) 8501 *num_out += ctl_cnt; 8502 /* recalc a clean slate and setup */ 8503 switch (net->ro._l_addr.sa.sa_family) { 8504 #ifdef INET 8505 case AF_INET: 8506 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8507 break; 8508 #endif 8509 #ifdef INET6 8510 case AF_INET6: 8511 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8512 break; 8513 #endif 8514 default: 8515 /* TSNH */ 8516 mtu = net->mtu; 8517 break; 8518 } 8519 to_out = 0; 8520 no_fragmentflg = 1; 8521 } 8522 } 8523 } 8524 if (error != 0) { 8525 /* try next net */ 8526 continue; 8527 } 8528 /* JRI: if dest is in PF state, do not send data to it */ 8529 if ((asoc->sctp_cmt_on_off > 0) && 8530 (net != stcb->asoc.alternate) && 8531 (net->dest_state & SCTP_ADDR_PF)) { 8532 goto no_data_fill; 8533 } 8534 if (net->flight_size >= net->cwnd) { 8535 goto no_data_fill; 8536 } 8537 if ((asoc->sctp_cmt_on_off > 0) && 8538 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_RECV_BUFFER_SPLITTING) && 8539 (net->flight_size > max_rwnd_per_dest)) { 8540 goto no_data_fill; 8541 } 8542 /* 8543 * We need a specific accounting for the usage of the send 8544 * buffer. We also need to check the number of messages per 8545 * net. For now, this is better than nothing and it disabled 8546 * by default... 8547 */ 8548 if ((asoc->sctp_cmt_on_off > 0) && 8549 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_SEND_BUFFER_SPLITTING) && 8550 (max_send_per_dest > 0) && 8551 (net->flight_size > max_send_per_dest)) { 8552 goto no_data_fill; 8553 } 8554 /*********************/ 8555 /* Data transmission */ 8556 /*********************/ 8557 /* 8558 * if AUTH for DATA is required and no AUTH has been added 8559 * yet, account for this in the mtu now... if no data can be 8560 * bundled, this adjustment won't matter anyways since the 8561 * packet will be going out... 8562 */ 8563 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, 8564 stcb->asoc.peer_auth_chunks); 8565 if (data_auth_reqd && (auth == NULL)) { 8566 mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8567 } 8568 /* now lets add any data within the MTU constraints */ 8569 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8570 #ifdef INET 8571 case AF_INET: 8572 if (net->mtu > SCTP_MIN_V4_OVERHEAD) 8573 omtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8574 else 8575 omtu = 0; 8576 break; 8577 #endif 8578 #ifdef INET6 8579 case AF_INET6: 8580 if (net->mtu > SCTP_MIN_OVERHEAD) 8581 omtu = net->mtu - SCTP_MIN_OVERHEAD; 8582 else 8583 omtu = 0; 8584 break; 8585 #endif 8586 default: 8587 /* TSNH */ 8588 omtu = 0; 8589 break; 8590 } 8591 if ((((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) || 8592 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) && 8593 (skip_data_for_this_net == 0)) || 8594 (cookie)) { 8595 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 8596 if (no_data_chunks) { 8597 /* let only control go out */ 8598 *reason_code = 1; 8599 break; 8600 } 8601 if (net->flight_size >= net->cwnd) { 8602 /* skip this net, no room for data */ 8603 *reason_code = 2; 8604 break; 8605 } 8606 if ((chk->whoTo != NULL) && 8607 (chk->whoTo != net)) { 8608 /* Don't send the chunk on this net */ 8609 continue; 8610 } 8611 8612 if (asoc->sctp_cmt_on_off == 0) { 8613 if ((asoc->alternate) && 8614 (asoc->alternate != net) && 8615 (chk->whoTo == NULL)) { 8616 continue; 8617 } else if ((net != asoc->primary_destination) && 8618 (asoc->alternate == NULL) && 8619 (chk->whoTo == NULL)) { 8620 continue; 8621 } 8622 } 8623 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 8624 /*- 8625 * strange, we have a chunk that is 8626 * to big for its destination and 8627 * yet no fragment ok flag. 8628 * Something went wrong when the 8629 * PMTU changed...we did not mark 8630 * this chunk for some reason?? I 8631 * will fix it here by letting IP 8632 * fragment it for now and printing 8633 * a warning. This really should not 8634 * happen ... 8635 */ 8636 SCTP_PRINTF("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 8637 chk->send_size, mtu); 8638 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 8639 } 8640 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 8641 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 8642 struct sctp_data_chunk *dchkh; 8643 8644 dchkh = mtod(chk->data, struct sctp_data_chunk *); 8645 dchkh->ch.chunk_flags |= SCTP_DATA_SACK_IMMEDIATELY; 8646 } 8647 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 8648 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 8649 /* ok we will add this one */ 8650 8651 /* 8652 * Add an AUTH chunk, if chunk 8653 * requires it, save the offset into 8654 * the chain for AUTH 8655 */ 8656 if (data_auth_reqd) { 8657 if (auth == NULL) { 8658 outchain = sctp_add_auth_chunk(outchain, 8659 &endoutchain, 8660 &auth, 8661 &auth_offset, 8662 stcb, 8663 SCTP_DATA); 8664 auth_keyid = chk->auth_keyid; 8665 override_ok = 0; 8666 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8667 } else if (override_ok) { 8668 /* 8669 * use this data's 8670 * keyid 8671 */ 8672 auth_keyid = chk->auth_keyid; 8673 override_ok = 0; 8674 } else if (auth_keyid != chk->auth_keyid) { 8675 /* 8676 * different keyid, 8677 * so done bundling 8678 */ 8679 break; 8680 } 8681 } 8682 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0, 8683 chk->send_size, chk->copy_by_ref); 8684 if (outchain == NULL) { 8685 SCTPDBG(SCTP_DEBUG_OUTPUT3, "No memory?\n"); 8686 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 8687 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8688 } 8689 *reason_code = 3; 8690 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8691 return (ENOMEM); 8692 } 8693 /* update our MTU size */ 8694 /* Do clear IP_DF ? */ 8695 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8696 no_fragmentflg = 0; 8697 } 8698 /* unsigned subtraction of mtu */ 8699 if (mtu > chk->send_size) 8700 mtu -= chk->send_size; 8701 else 8702 mtu = 0; 8703 /* unsigned subtraction of r_mtu */ 8704 if (r_mtu > chk->send_size) 8705 r_mtu -= chk->send_size; 8706 else 8707 r_mtu = 0; 8708 8709 to_out += chk->send_size; 8710 if ((to_out > mx_mtu) && no_fragmentflg) { 8711 #ifdef INVARIANTS 8712 panic("Exceeding mtu of %d out size is %d", mx_mtu, to_out); 8713 #else 8714 SCTP_PRINTF("Exceeding mtu of %d out size is %d\n", 8715 mx_mtu, to_out); 8716 #endif 8717 } 8718 chk->window_probe = 0; 8719 data_list[bundle_at++] = chk; 8720 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 8721 break; 8722 } 8723 if (chk->sent == SCTP_DATAGRAM_UNSENT) { 8724 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 8725 SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks); 8726 } else { 8727 SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks); 8728 } 8729 if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) && 8730 ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0)) 8731 /* 8732 * Count number of 8733 * user msg's that 8734 * were fragmented 8735 * we do this by 8736 * counting when we 8737 * see a LAST 8738 * fragment only. 8739 */ 8740 SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs); 8741 } 8742 if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) { 8743 if ((one_chunk) && (stcb->asoc.total_flight == 0)) { 8744 data_list[0]->window_probe = 1; 8745 net->window_probe = 1; 8746 } 8747 break; 8748 } 8749 } else { 8750 /* 8751 * Must be sent in order of the 8752 * TSN's (on a network) 8753 */ 8754 break; 8755 } 8756 } /* for (chunk gather loop for this net) */ 8757 } /* if asoc.state OPEN */ 8758 no_data_fill: 8759 /* Is there something to send for this destination? */ 8760 if (outchain) { 8761 /* We may need to start a control timer or two */ 8762 use_zero_crc = asoc->zero_checksum == 2; 8763 if (asconf) { 8764 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, 8765 stcb, net); 8766 use_zero_crc = false; 8767 /* 8768 * do NOT clear the asconf flag as it is 8769 * used to do appropriate source address 8770 * selection. 8771 */ 8772 } 8773 if (cookie) { 8774 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8775 use_zero_crc = false; 8776 cookie = 0; 8777 } 8778 /* must start a send timer if data is being sent */ 8779 if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) { 8780 /* 8781 * no timer running on this destination 8782 * restart it. 8783 */ 8784 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8785 } 8786 if (bundle_at || hbflag) { 8787 /* For data/asconf and hb set time */ 8788 if (*now_filled == 0) { 8789 (void)SCTP_GETTIME_TIMEVAL(now); 8790 *now_filled = 1; 8791 } 8792 net->last_sent_time = *now; 8793 } 8794 /* Now send it, if there is anything to send :> */ 8795 if ((error = sctp_lowlevel_chunk_output(inp, 8796 stcb, 8797 net, 8798 (struct sockaddr *)&net->ro._l_addr, 8799 outchain, 8800 auth_offset, 8801 auth, 8802 auth_keyid, 8803 no_fragmentflg, 8804 bundle_at, 8805 asconf, 8806 inp->sctp_lport, stcb->rport, 8807 htonl(stcb->asoc.peer_vtag), 8808 net->port, NULL, 8809 0, 0, 8810 use_zero_crc, 8811 so_locked))) { 8812 /* error, we could not output */ 8813 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8814 if (from_where == 0) { 8815 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8816 } 8817 if (error == ENOBUFS) { 8818 asoc->ifp_had_enobuf = 1; 8819 SCTP_STAT_INCR(sctps_lowlevelerr); 8820 } 8821 if (error == EHOSTUNREACH) { 8822 /* 8823 * Destination went unreachable 8824 * during this send 8825 */ 8826 sctp_move_chunks_from_net(stcb, net); 8827 } 8828 asconf = 0; 8829 *reason_code = 6; 8830 /*- 8831 * I add this line to be paranoid. As far as 8832 * I can tell the continue, takes us back to 8833 * the top of the for, but just to make sure 8834 * I will reset these again here. 8835 */ 8836 ctl_cnt = 0; 8837 continue; /* This takes us back to the 8838 * for() for the nets. */ 8839 } else { 8840 asoc->ifp_had_enobuf = 0; 8841 } 8842 endoutchain = NULL; 8843 auth = NULL; 8844 auth_offset = 0; 8845 asconf = 0; 8846 if (!no_out_cnt) { 8847 *num_out += (ctl_cnt + bundle_at); 8848 } 8849 if (bundle_at) { 8850 /* setup for a RTO measurement */ 8851 tsns_sent = data_list[0]->rec.data.tsn; 8852 /* fill time if not already filled */ 8853 if (*now_filled == 0) { 8854 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 8855 *now_filled = 1; 8856 *now = asoc->time_last_sent; 8857 } else { 8858 asoc->time_last_sent = *now; 8859 } 8860 if (net->rto_needed) { 8861 data_list[0]->do_rtt = 1; 8862 net->rto_needed = 0; 8863 } 8864 SCTP_STAT_INCR_BY(sctps_senddata, bundle_at); 8865 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 8866 } 8867 if (one_chunk) { 8868 break; 8869 } 8870 } 8871 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8872 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND); 8873 } 8874 } 8875 if (old_start_at == NULL) { 8876 old_start_at = start_at; 8877 start_at = TAILQ_FIRST(&asoc->nets); 8878 if (old_start_at) 8879 goto again_one_more_time; 8880 } 8881 8882 /* 8883 * At the end there should be no NON timed chunks hanging on this 8884 * queue. 8885 */ 8886 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8887 sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND); 8888 } 8889 if ((*num_out == 0) && (*reason_code == 0)) { 8890 *reason_code = 4; 8891 } else { 8892 *reason_code = 5; 8893 } 8894 sctp_clean_up_ctl(stcb, asoc, so_locked); 8895 return (0); 8896 } 8897 8898 void 8899 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 8900 { 8901 /*- 8902 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of 8903 * the control chunk queue. 8904 */ 8905 struct sctp_chunkhdr *hdr; 8906 struct sctp_tmit_chunk *chk; 8907 struct mbuf *mat, *last_mbuf; 8908 uint32_t chunk_length; 8909 uint16_t padding_length; 8910 8911 SCTP_TCB_LOCK_ASSERT(stcb); 8912 SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_NOWAIT); 8913 if (op_err == NULL) { 8914 return; 8915 } 8916 last_mbuf = NULL; 8917 chunk_length = 0; 8918 for (mat = op_err; mat != NULL; mat = SCTP_BUF_NEXT(mat)) { 8919 chunk_length += SCTP_BUF_LEN(mat); 8920 if (SCTP_BUF_NEXT(mat) == NULL) { 8921 last_mbuf = mat; 8922 } 8923 } 8924 if (chunk_length > SCTP_MAX_CHUNK_LENGTH) { 8925 sctp_m_freem(op_err); 8926 return; 8927 } 8928 padding_length = chunk_length % 4; 8929 if (padding_length != 0) { 8930 padding_length = 4 - padding_length; 8931 } 8932 if (padding_length != 0) { 8933 if (sctp_add_pad_tombuf(last_mbuf, padding_length) == NULL) { 8934 sctp_m_freem(op_err); 8935 return; 8936 } 8937 } 8938 sctp_alloc_a_chunk(stcb, chk); 8939 if (chk == NULL) { 8940 /* no memory */ 8941 sctp_m_freem(op_err); 8942 return; 8943 } 8944 chk->copy_by_ref = 0; 8945 chk->rec.chunk_id.id = SCTP_OPERATION_ERROR; 8946 chk->rec.chunk_id.can_take_data = 0; 8947 chk->flags = 0; 8948 chk->send_size = (uint16_t)chunk_length; 8949 chk->sent = SCTP_DATAGRAM_UNSENT; 8950 chk->snd_count = 0; 8951 chk->asoc = &stcb->asoc; 8952 chk->data = op_err; 8953 chk->whoTo = NULL; 8954 hdr = mtod(op_err, struct sctp_chunkhdr *); 8955 hdr->chunk_type = SCTP_OPERATION_ERROR; 8956 hdr->chunk_flags = 0; 8957 hdr->chunk_length = htons(chk->send_size); 8958 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 8959 chk->asoc->ctrl_queue_cnt++; 8960 } 8961 8962 int 8963 sctp_send_cookie_echo(struct mbuf *m, 8964 int offset, int limit, 8965 struct sctp_tcb *stcb, 8966 struct sctp_nets *net) 8967 { 8968 /*- 8969 * pull out the cookie and put it at the front of the control chunk 8970 * queue. 8971 */ 8972 int at; 8973 struct mbuf *cookie; 8974 struct sctp_paramhdr param, *phdr; 8975 struct sctp_chunkhdr *hdr; 8976 struct sctp_tmit_chunk *chk; 8977 uint16_t ptype, plen; 8978 8979 SCTP_TCB_LOCK_ASSERT(stcb); 8980 /* First find the cookie in the param area */ 8981 cookie = NULL; 8982 at = offset + sizeof(struct sctp_init_chunk); 8983 for (;;) { 8984 phdr = sctp_get_next_param(m, at, ¶m, sizeof(param)); 8985 if (phdr == NULL) { 8986 return (-3); 8987 } 8988 ptype = ntohs(phdr->param_type); 8989 plen = ntohs(phdr->param_length); 8990 if (plen < sizeof(struct sctp_paramhdr)) { 8991 return (-6); 8992 } 8993 if (ptype == SCTP_STATE_COOKIE) { 8994 int pad; 8995 8996 /* found the cookie */ 8997 if (at + plen > limit) { 8998 return (-7); 8999 } 9000 cookie = SCTP_M_COPYM(m, at, plen, M_NOWAIT); 9001 if (cookie == NULL) { 9002 /* No memory */ 9003 return (-2); 9004 } 9005 if ((pad = (plen % 4)) > 0) { 9006 pad = 4 - pad; 9007 } 9008 if (pad > 0) { 9009 if (sctp_pad_lastmbuf(cookie, pad, NULL) == NULL) { 9010 return (-8); 9011 } 9012 } 9013 #ifdef SCTP_MBUF_LOGGING 9014 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9015 sctp_log_mbc(cookie, SCTP_MBUF_ICOPY); 9016 } 9017 #endif 9018 break; 9019 } 9020 at += SCTP_SIZE32(plen); 9021 } 9022 /* ok, we got the cookie lets change it into a cookie echo chunk */ 9023 /* first the change from param to cookie */ 9024 hdr = mtod(cookie, struct sctp_chunkhdr *); 9025 hdr->chunk_type = SCTP_COOKIE_ECHO; 9026 hdr->chunk_flags = 0; 9027 /* get the chunk stuff now and place it in the FRONT of the queue */ 9028 sctp_alloc_a_chunk(stcb, chk); 9029 if (chk == NULL) { 9030 /* no memory */ 9031 sctp_m_freem(cookie); 9032 return (-5); 9033 } 9034 chk->copy_by_ref = 0; 9035 chk->rec.chunk_id.id = SCTP_COOKIE_ECHO; 9036 chk->rec.chunk_id.can_take_data = 0; 9037 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9038 chk->send_size = SCTP_SIZE32(plen); 9039 chk->sent = SCTP_DATAGRAM_UNSENT; 9040 chk->snd_count = 0; 9041 chk->asoc = &stcb->asoc; 9042 chk->data = cookie; 9043 chk->whoTo = net; 9044 atomic_add_int(&chk->whoTo->ref_count, 1); 9045 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 9046 chk->asoc->ctrl_queue_cnt++; 9047 return (0); 9048 } 9049 9050 void 9051 sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 9052 struct mbuf *m, 9053 int offset, 9054 int chk_length, 9055 struct sctp_nets *net) 9056 { 9057 /* 9058 * take a HB request and make it into a HB ack and send it. 9059 */ 9060 struct mbuf *outchain; 9061 struct sctp_chunkhdr *chdr; 9062 struct sctp_tmit_chunk *chk; 9063 9064 if (net == NULL) 9065 /* must have a net pointer */ 9066 return; 9067 9068 outchain = SCTP_M_COPYM(m, offset, chk_length, M_NOWAIT); 9069 if (outchain == NULL) { 9070 /* gak out of memory */ 9071 return; 9072 } 9073 #ifdef SCTP_MBUF_LOGGING 9074 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9075 sctp_log_mbc(outchain, SCTP_MBUF_ICOPY); 9076 } 9077 #endif 9078 chdr = mtod(outchain, struct sctp_chunkhdr *); 9079 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 9080 chdr->chunk_flags = 0; 9081 if (chk_length % 4 != 0) { 9082 sctp_pad_lastmbuf(outchain, 4 - (chk_length % 4), NULL); 9083 } 9084 sctp_alloc_a_chunk(stcb, chk); 9085 if (chk == NULL) { 9086 /* no memory */ 9087 sctp_m_freem(outchain); 9088 return; 9089 } 9090 chk->copy_by_ref = 0; 9091 chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK; 9092 chk->rec.chunk_id.can_take_data = 1; 9093 chk->flags = 0; 9094 chk->send_size = chk_length; 9095 chk->sent = SCTP_DATAGRAM_UNSENT; 9096 chk->snd_count = 0; 9097 chk->asoc = &stcb->asoc; 9098 chk->data = outchain; 9099 chk->whoTo = net; 9100 atomic_add_int(&chk->whoTo->ref_count, 1); 9101 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9102 chk->asoc->ctrl_queue_cnt++; 9103 } 9104 9105 void 9106 sctp_send_cookie_ack(struct sctp_tcb *stcb) 9107 { 9108 /* formulate and queue a cookie-ack back to sender */ 9109 struct mbuf *cookie_ack; 9110 struct sctp_chunkhdr *hdr; 9111 struct sctp_tmit_chunk *chk; 9112 9113 SCTP_TCB_LOCK_ASSERT(stcb); 9114 9115 cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 9116 if (cookie_ack == NULL) { 9117 /* no mbuf's */ 9118 return; 9119 } 9120 SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD); 9121 sctp_alloc_a_chunk(stcb, chk); 9122 if (chk == NULL) { 9123 /* no memory */ 9124 sctp_m_freem(cookie_ack); 9125 return; 9126 } 9127 chk->copy_by_ref = 0; 9128 chk->rec.chunk_id.id = SCTP_COOKIE_ACK; 9129 chk->rec.chunk_id.can_take_data = 1; 9130 chk->flags = 0; 9131 chk->send_size = sizeof(struct sctp_chunkhdr); 9132 chk->sent = SCTP_DATAGRAM_UNSENT; 9133 chk->snd_count = 0; 9134 chk->asoc = &stcb->asoc; 9135 chk->data = cookie_ack; 9136 if (chk->asoc->last_control_chunk_from != NULL) { 9137 chk->whoTo = chk->asoc->last_control_chunk_from; 9138 atomic_add_int(&chk->whoTo->ref_count, 1); 9139 } else { 9140 chk->whoTo = NULL; 9141 } 9142 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 9143 hdr->chunk_type = SCTP_COOKIE_ACK; 9144 hdr->chunk_flags = 0; 9145 hdr->chunk_length = htons(chk->send_size); 9146 SCTP_BUF_LEN(cookie_ack) = chk->send_size; 9147 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9148 chk->asoc->ctrl_queue_cnt++; 9149 return; 9150 } 9151 9152 void 9153 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 9154 { 9155 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 9156 struct mbuf *m_shutdown_ack; 9157 struct sctp_shutdown_ack_chunk *ack_cp; 9158 struct sctp_tmit_chunk *chk; 9159 9160 m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9161 if (m_shutdown_ack == NULL) { 9162 /* no mbuf's */ 9163 return; 9164 } 9165 SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD); 9166 sctp_alloc_a_chunk(stcb, chk); 9167 if (chk == NULL) { 9168 /* no memory */ 9169 sctp_m_freem(m_shutdown_ack); 9170 return; 9171 } 9172 chk->copy_by_ref = 0; 9173 chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK; 9174 chk->rec.chunk_id.can_take_data = 1; 9175 chk->flags = 0; 9176 chk->send_size = sizeof(struct sctp_chunkhdr); 9177 chk->sent = SCTP_DATAGRAM_UNSENT; 9178 chk->snd_count = 0; 9179 chk->asoc = &stcb->asoc; 9180 chk->data = m_shutdown_ack; 9181 chk->whoTo = net; 9182 if (chk->whoTo) { 9183 atomic_add_int(&chk->whoTo->ref_count, 1); 9184 } 9185 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 9186 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 9187 ack_cp->ch.chunk_flags = 0; 9188 ack_cp->ch.chunk_length = htons(chk->send_size); 9189 SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size; 9190 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9191 chk->asoc->ctrl_queue_cnt++; 9192 return; 9193 } 9194 9195 void 9196 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 9197 { 9198 /* formulate and queue a SHUTDOWN to the sender */ 9199 struct mbuf *m_shutdown; 9200 struct sctp_shutdown_chunk *shutdown_cp; 9201 struct sctp_tmit_chunk *chk; 9202 9203 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 9204 if (chk->rec.chunk_id.id == SCTP_SHUTDOWN) { 9205 /* We already have a SHUTDOWN queued. Reuse it. */ 9206 if (chk->whoTo) { 9207 sctp_free_remote_addr(chk->whoTo); 9208 chk->whoTo = NULL; 9209 } 9210 break; 9211 } 9212 } 9213 if (chk == NULL) { 9214 m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9215 if (m_shutdown == NULL) { 9216 /* no mbuf's */ 9217 return; 9218 } 9219 SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD); 9220 sctp_alloc_a_chunk(stcb, chk); 9221 if (chk == NULL) { 9222 /* no memory */ 9223 sctp_m_freem(m_shutdown); 9224 return; 9225 } 9226 chk->copy_by_ref = 0; 9227 chk->rec.chunk_id.id = SCTP_SHUTDOWN; 9228 chk->rec.chunk_id.can_take_data = 1; 9229 chk->flags = 0; 9230 chk->send_size = sizeof(struct sctp_shutdown_chunk); 9231 chk->sent = SCTP_DATAGRAM_UNSENT; 9232 chk->snd_count = 0; 9233 chk->asoc = &stcb->asoc; 9234 chk->data = m_shutdown; 9235 chk->whoTo = net; 9236 if (chk->whoTo) { 9237 atomic_add_int(&chk->whoTo->ref_count, 1); 9238 } 9239 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 9240 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 9241 shutdown_cp->ch.chunk_flags = 0; 9242 shutdown_cp->ch.chunk_length = htons(chk->send_size); 9243 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9244 SCTP_BUF_LEN(m_shutdown) = chk->send_size; 9245 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9246 chk->asoc->ctrl_queue_cnt++; 9247 } else { 9248 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, sctp_next); 9249 chk->whoTo = net; 9250 if (chk->whoTo) { 9251 atomic_add_int(&chk->whoTo->ref_count, 1); 9252 } 9253 shutdown_cp = mtod(chk->data, struct sctp_shutdown_chunk *); 9254 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9255 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 9256 } 9257 return; 9258 } 9259 9260 void 9261 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked) 9262 { 9263 /* 9264 * formulate and queue an ASCONF to the peer. ASCONF parameters 9265 * should be queued on the assoc queue. 9266 */ 9267 struct sctp_tmit_chunk *chk; 9268 struct mbuf *m_asconf; 9269 int len; 9270 9271 SCTP_TCB_LOCK_ASSERT(stcb); 9272 9273 if ((!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) && 9274 (!sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS))) { 9275 /* can't send a new one if there is one in flight already */ 9276 return; 9277 } 9278 9279 /* compose an ASCONF chunk, maximum length is PMTU */ 9280 m_asconf = sctp_compose_asconf(stcb, &len, addr_locked); 9281 if (m_asconf == NULL) { 9282 return; 9283 } 9284 9285 sctp_alloc_a_chunk(stcb, chk); 9286 if (chk == NULL) { 9287 /* no memory */ 9288 sctp_m_freem(m_asconf); 9289 return; 9290 } 9291 9292 chk->copy_by_ref = 0; 9293 chk->rec.chunk_id.id = SCTP_ASCONF; 9294 chk->rec.chunk_id.can_take_data = 0; 9295 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9296 chk->data = m_asconf; 9297 chk->send_size = len; 9298 chk->sent = SCTP_DATAGRAM_UNSENT; 9299 chk->snd_count = 0; 9300 chk->asoc = &stcb->asoc; 9301 chk->whoTo = net; 9302 if (chk->whoTo) { 9303 atomic_add_int(&chk->whoTo->ref_count, 1); 9304 } 9305 TAILQ_INSERT_TAIL(&chk->asoc->asconf_send_queue, chk, sctp_next); 9306 chk->asoc->ctrl_queue_cnt++; 9307 return; 9308 } 9309 9310 void 9311 sctp_send_asconf_ack(struct sctp_tcb *stcb) 9312 { 9313 /* 9314 * formulate and queue a asconf-ack back to sender. the asconf-ack 9315 * must be stored in the tcb. 9316 */ 9317 struct sctp_tmit_chunk *chk; 9318 struct sctp_asconf_ack *ack, *latest_ack; 9319 struct mbuf *m_ack; 9320 struct sctp_nets *net = NULL; 9321 9322 SCTP_TCB_LOCK_ASSERT(stcb); 9323 /* Get the latest ASCONF-ACK */ 9324 latest_ack = TAILQ_LAST(&stcb->asoc.asconf_ack_sent, sctp_asconf_ackhead); 9325 if (latest_ack == NULL) { 9326 return; 9327 } 9328 if (latest_ack->last_sent_to != NULL && 9329 latest_ack->last_sent_to == stcb->asoc.last_control_chunk_from) { 9330 /* we're doing a retransmission */ 9331 net = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0); 9332 if (net == NULL) { 9333 /* no alternate */ 9334 if (stcb->asoc.last_control_chunk_from == NULL) { 9335 if (stcb->asoc.alternate) { 9336 net = stcb->asoc.alternate; 9337 } else { 9338 net = stcb->asoc.primary_destination; 9339 } 9340 } else { 9341 net = stcb->asoc.last_control_chunk_from; 9342 } 9343 } 9344 } else { 9345 /* normal case */ 9346 if (stcb->asoc.last_control_chunk_from == NULL) { 9347 if (stcb->asoc.alternate) { 9348 net = stcb->asoc.alternate; 9349 } else { 9350 net = stcb->asoc.primary_destination; 9351 } 9352 } else { 9353 net = stcb->asoc.last_control_chunk_from; 9354 } 9355 } 9356 latest_ack->last_sent_to = net; 9357 9358 TAILQ_FOREACH(ack, &stcb->asoc.asconf_ack_sent, next) { 9359 if (ack->data == NULL) { 9360 continue; 9361 } 9362 9363 /* copy the asconf_ack */ 9364 m_ack = SCTP_M_COPYM(ack->data, 0, M_COPYALL, M_NOWAIT); 9365 if (m_ack == NULL) { 9366 /* couldn't copy it */ 9367 return; 9368 } 9369 #ifdef SCTP_MBUF_LOGGING 9370 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9371 sctp_log_mbc(m_ack, SCTP_MBUF_ICOPY); 9372 } 9373 #endif 9374 9375 sctp_alloc_a_chunk(stcb, chk); 9376 if (chk == NULL) { 9377 /* no memory */ 9378 if (m_ack) 9379 sctp_m_freem(m_ack); 9380 return; 9381 } 9382 chk->copy_by_ref = 0; 9383 chk->rec.chunk_id.id = SCTP_ASCONF_ACK; 9384 chk->rec.chunk_id.can_take_data = 1; 9385 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9386 chk->whoTo = net; 9387 if (chk->whoTo) { 9388 atomic_add_int(&chk->whoTo->ref_count, 1); 9389 } 9390 chk->data = m_ack; 9391 chk->send_size = ack->len; 9392 chk->sent = SCTP_DATAGRAM_UNSENT; 9393 chk->snd_count = 0; 9394 chk->asoc = &stcb->asoc; 9395 9396 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9397 chk->asoc->ctrl_queue_cnt++; 9398 } 9399 return; 9400 } 9401 9402 static int 9403 sctp_chunk_retransmission(struct sctp_inpcb *inp, 9404 struct sctp_tcb *stcb, 9405 struct sctp_association *asoc, 9406 int *cnt_out, struct timeval *now, int *now_filled, int *fr_done, int so_locked) 9407 { 9408 /*- 9409 * send out one MTU of retransmission. If fast_retransmit is 9410 * happening we ignore the cwnd. Otherwise we obey the cwnd and 9411 * rwnd. For a Cookie or Asconf in the control chunk queue we 9412 * retransmit them by themselves. 9413 * 9414 * For data chunks we will pick out the lowest TSN's in the sent_queue 9415 * marked for resend and bundle them all together (up to a MTU of 9416 * destination). The address to send to should have been 9417 * selected/changed where the retransmission was marked (i.e. in FR 9418 * or t3-timeout routines). 9419 */ 9420 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 9421 struct sctp_tmit_chunk *chk, *fwd; 9422 struct mbuf *m, *endofchain; 9423 struct sctp_nets *net = NULL; 9424 uint32_t tsns_sent = 0; 9425 int no_fragmentflg, bundle_at; 9426 unsigned int mtu; 9427 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 9428 struct sctp_auth_chunk *auth = NULL; 9429 uint32_t auth_offset = 0; 9430 uint16_t auth_keyid; 9431 int override_ok = 1; 9432 int data_auth_reqd = 0; 9433 uint32_t dmtu = 0; 9434 bool use_zero_crc; 9435 9436 SCTP_TCB_LOCK_ASSERT(stcb); 9437 tmr_started = ctl_cnt = 0; 9438 no_fragmentflg = 1; 9439 fwd_tsn = 0; 9440 *cnt_out = 0; 9441 fwd = NULL; 9442 endofchain = m = NULL; 9443 auth_keyid = stcb->asoc.authinfo.active_keyid; 9444 #ifdef SCTP_AUDITING_ENABLED 9445 sctp_audit_log(0xC3, 1); 9446 #endif 9447 if ((TAILQ_EMPTY(&asoc->sent_queue)) && 9448 (TAILQ_EMPTY(&asoc->control_send_queue))) { 9449 SCTPDBG(SCTP_DEBUG_OUTPUT1, "SCTP hits empty queue with cnt set to %d?\n", 9450 asoc->sent_queue_retran_cnt); 9451 asoc->sent_queue_cnt = 0; 9452 asoc->sent_queue_cnt_removeable = 0; 9453 /* send back 0/0 so we enter normal transmission */ 9454 *cnt_out = 0; 9455 return (0); 9456 } 9457 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 9458 if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) || 9459 (chk->rec.chunk_id.id == SCTP_STREAM_RESET) || 9460 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) { 9461 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9462 continue; 9463 } 9464 if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 9465 if (chk != asoc->str_reset) { 9466 /* 9467 * not eligible for retran if its 9468 * not ours 9469 */ 9470 continue; 9471 } 9472 } 9473 ctl_cnt++; 9474 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 9475 fwd_tsn = 1; 9476 } 9477 /* 9478 * Add an AUTH chunk, if chunk requires it save the 9479 * offset into the chain for AUTH 9480 */ 9481 if ((auth == NULL) && 9482 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 9483 stcb->asoc.peer_auth_chunks))) { 9484 m = sctp_add_auth_chunk(m, &endofchain, 9485 &auth, &auth_offset, 9486 stcb, 9487 chk->rec.chunk_id.id); 9488 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9489 } 9490 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9491 break; 9492 } 9493 } 9494 one_chunk = 0; 9495 /* do we have control chunks to retransmit? */ 9496 if (m != NULL) { 9497 /* Start a timer no matter if we succeed or fail */ 9498 use_zero_crc = asoc->zero_checksum == 2; 9499 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 9500 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 9501 use_zero_crc = false; 9502 } else if (chk->rec.chunk_id.id == SCTP_ASCONF) { 9503 /* XXXMT: Can this happen? */ 9504 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 9505 use_zero_crc = false; 9506 } 9507 chk->snd_count++; /* update our count */ 9508 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 9509 (struct sockaddr *)&chk->whoTo->ro._l_addr, m, 9510 auth_offset, auth, stcb->asoc.authinfo.active_keyid, 9511 no_fragmentflg, 0, 0, 9512 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9513 chk->whoTo->port, NULL, 9514 0, 0, 9515 use_zero_crc, 9516 so_locked))) { 9517 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9518 if (error == ENOBUFS) { 9519 asoc->ifp_had_enobuf = 1; 9520 SCTP_STAT_INCR(sctps_lowlevelerr); 9521 } 9522 return (error); 9523 } else { 9524 asoc->ifp_had_enobuf = 0; 9525 } 9526 endofchain = NULL; 9527 auth = NULL; 9528 auth_offset = 0; 9529 /* 9530 * We don't want to mark the net->sent time here since this 9531 * we use this for HB and retrans cannot measure RTT 9532 */ 9533 /* (void)SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */ 9534 *cnt_out += 1; 9535 chk->sent = SCTP_DATAGRAM_SENT; 9536 sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt); 9537 if (fwd_tsn == 0) { 9538 return (0); 9539 } else { 9540 /* Clean up the fwd-tsn list */ 9541 sctp_clean_up_ctl(stcb, asoc, so_locked); 9542 return (0); 9543 } 9544 } 9545 /* 9546 * Ok, it is just data retransmission we need to do or that and a 9547 * fwd-tsn with it all. 9548 */ 9549 if (TAILQ_EMPTY(&asoc->sent_queue)) { 9550 return (SCTP_RETRAN_DONE); 9551 } 9552 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED) || 9553 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT)) { 9554 /* not yet open, resend the cookie and that is it */ 9555 return (1); 9556 } 9557 #ifdef SCTP_AUDITING_ENABLED 9558 sctp_auditing(20, inp, stcb, NULL); 9559 #endif 9560 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks); 9561 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 9562 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9563 /* No, not sent to this net or not ready for rtx */ 9564 continue; 9565 } 9566 if (chk->data == NULL) { 9567 SCTP_PRINTF("TSN:%x chk->snd_count:%d chk->sent:%d can't retran - no data\n", 9568 chk->rec.data.tsn, chk->snd_count, chk->sent); 9569 continue; 9570 } 9571 if ((SCTP_BASE_SYSCTL(sctp_max_retran_chunk)) && 9572 (chk->snd_count >= SCTP_BASE_SYSCTL(sctp_max_retran_chunk))) { 9573 struct mbuf *op_err; 9574 char msg[SCTP_DIAG_INFO_LEN]; 9575 9576 SCTP_SNPRINTF(msg, sizeof(msg), "TSN %8.8x retransmitted %d times, giving up", 9577 chk->rec.data.tsn, chk->snd_count); 9578 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 9579 msg); 9580 atomic_add_int(&stcb->asoc.refcnt, 1); 9581 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, 9582 false, so_locked); 9583 SCTP_TCB_LOCK(stcb); 9584 atomic_subtract_int(&stcb->asoc.refcnt, 1); 9585 return (SCTP_RETRAN_EXIT); 9586 } 9587 /* pick up the net */ 9588 net = chk->whoTo; 9589 switch (net->ro._l_addr.sa.sa_family) { 9590 #ifdef INET 9591 case AF_INET: 9592 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 9593 break; 9594 #endif 9595 #ifdef INET6 9596 case AF_INET6: 9597 mtu = net->mtu - SCTP_MIN_OVERHEAD; 9598 break; 9599 #endif 9600 default: 9601 /* TSNH */ 9602 mtu = net->mtu; 9603 break; 9604 } 9605 9606 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 9607 /* No room in peers rwnd */ 9608 uint32_t tsn; 9609 9610 tsn = asoc->last_acked_seq + 1; 9611 if (tsn == chk->rec.data.tsn) { 9612 /* 9613 * we make a special exception for this 9614 * case. The peer has no rwnd but is missing 9615 * the lowest chunk.. which is probably what 9616 * is holding up the rwnd. 9617 */ 9618 goto one_chunk_around; 9619 } 9620 return (1); 9621 } 9622 one_chunk_around: 9623 if (asoc->peers_rwnd < mtu) { 9624 one_chunk = 1; 9625 if ((asoc->peers_rwnd == 0) && 9626 (asoc->total_flight == 0)) { 9627 chk->window_probe = 1; 9628 chk->whoTo->window_probe = 1; 9629 } 9630 } 9631 #ifdef SCTP_AUDITING_ENABLED 9632 sctp_audit_log(0xC3, 2); 9633 #endif 9634 bundle_at = 0; 9635 m = NULL; 9636 net->fast_retran_ip = 0; 9637 if (chk->rec.data.doing_fast_retransmit == 0) { 9638 /* 9639 * if no FR in progress skip destination that have 9640 * flight_size > cwnd. 9641 */ 9642 if (net->flight_size >= net->cwnd) { 9643 continue; 9644 } 9645 } else { 9646 /* 9647 * Mark the destination net to have FR recovery 9648 * limits put on it. 9649 */ 9650 *fr_done = 1; 9651 net->fast_retran_ip = 1; 9652 } 9653 9654 /* 9655 * if no AUTH is yet included and this chunk requires it, 9656 * make sure to account for it. We don't apply the size 9657 * until the AUTH chunk is actually added below in case 9658 * there is no room for this chunk. 9659 */ 9660 if (data_auth_reqd && (auth == NULL)) { 9661 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9662 } else 9663 dmtu = 0; 9664 9665 if ((chk->send_size <= (mtu - dmtu)) || 9666 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 9667 /* ok we will add this one */ 9668 if (data_auth_reqd) { 9669 if (auth == NULL) { 9670 m = sctp_add_auth_chunk(m, 9671 &endofchain, 9672 &auth, 9673 &auth_offset, 9674 stcb, 9675 SCTP_DATA); 9676 auth_keyid = chk->auth_keyid; 9677 override_ok = 0; 9678 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9679 } else if (override_ok) { 9680 auth_keyid = chk->auth_keyid; 9681 override_ok = 0; 9682 } else if (chk->auth_keyid != auth_keyid) { 9683 /* different keyid, so done bundling */ 9684 break; 9685 } 9686 } 9687 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9688 if (m == NULL) { 9689 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9690 return (ENOMEM); 9691 } 9692 /* Do clear IP_DF ? */ 9693 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9694 no_fragmentflg = 0; 9695 } 9696 /* update our MTU size */ 9697 if (mtu > (chk->send_size + dmtu)) 9698 mtu -= (chk->send_size + dmtu); 9699 else 9700 mtu = 0; 9701 data_list[bundle_at++] = chk; 9702 if (one_chunk && (asoc->total_flight <= 0)) { 9703 SCTP_STAT_INCR(sctps_windowprobed); 9704 } 9705 } 9706 if (one_chunk == 0) { 9707 /* 9708 * now are there anymore forward from chk to pick 9709 * up? 9710 */ 9711 for (fwd = TAILQ_NEXT(chk, sctp_next); fwd != NULL; fwd = TAILQ_NEXT(fwd, sctp_next)) { 9712 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 9713 /* Nope, not for retran */ 9714 continue; 9715 } 9716 if (fwd->whoTo != net) { 9717 /* Nope, not the net in question */ 9718 continue; 9719 } 9720 if (data_auth_reqd && (auth == NULL)) { 9721 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9722 } else 9723 dmtu = 0; 9724 if (fwd->send_size <= (mtu - dmtu)) { 9725 if (data_auth_reqd) { 9726 if (auth == NULL) { 9727 m = sctp_add_auth_chunk(m, 9728 &endofchain, 9729 &auth, 9730 &auth_offset, 9731 stcb, 9732 SCTP_DATA); 9733 auth_keyid = fwd->auth_keyid; 9734 override_ok = 0; 9735 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9736 } else if (override_ok) { 9737 auth_keyid = fwd->auth_keyid; 9738 override_ok = 0; 9739 } else if (fwd->auth_keyid != auth_keyid) { 9740 /* 9741 * different keyid, 9742 * so done bundling 9743 */ 9744 break; 9745 } 9746 } 9747 m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref); 9748 if (m == NULL) { 9749 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9750 return (ENOMEM); 9751 } 9752 /* Do clear IP_DF ? */ 9753 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9754 no_fragmentflg = 0; 9755 } 9756 /* update our MTU size */ 9757 if (mtu > (fwd->send_size + dmtu)) 9758 mtu -= (fwd->send_size + dmtu); 9759 else 9760 mtu = 0; 9761 data_list[bundle_at++] = fwd; 9762 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 9763 break; 9764 } 9765 } else { 9766 /* can't fit so we are done */ 9767 break; 9768 } 9769 } 9770 } 9771 /* Is there something to send for this destination? */ 9772 if (m) { 9773 /* 9774 * No matter if we fail/or succeed we should start a 9775 * timer. A failure is like a lost IP packet :-) 9776 */ 9777 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9778 /* 9779 * no timer running on this destination 9780 * restart it. 9781 */ 9782 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9783 tmr_started = 1; 9784 } 9785 /* Now lets send it, if there is anything to send :> */ 9786 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 9787 (struct sockaddr *)&net->ro._l_addr, m, 9788 auth_offset, auth, auth_keyid, 9789 no_fragmentflg, 0, 0, 9790 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9791 net->port, NULL, 9792 0, 0, 9793 asoc->zero_checksum == 2, 9794 so_locked))) { 9795 /* error, we could not output */ 9796 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9797 if (error == ENOBUFS) { 9798 asoc->ifp_had_enobuf = 1; 9799 SCTP_STAT_INCR(sctps_lowlevelerr); 9800 } 9801 return (error); 9802 } else { 9803 asoc->ifp_had_enobuf = 0; 9804 } 9805 endofchain = NULL; 9806 auth = NULL; 9807 auth_offset = 0; 9808 /* For HB's */ 9809 /* 9810 * We don't want to mark the net->sent time here 9811 * since this we use this for HB and retrans cannot 9812 * measure RTT 9813 */ 9814 /* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */ 9815 9816 /* For auto-close */ 9817 if (*now_filled == 0) { 9818 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 9819 *now = asoc->time_last_sent; 9820 *now_filled = 1; 9821 } else { 9822 asoc->time_last_sent = *now; 9823 } 9824 *cnt_out += bundle_at; 9825 #ifdef SCTP_AUDITING_ENABLED 9826 sctp_audit_log(0xC4, bundle_at); 9827 #endif 9828 if (bundle_at) { 9829 tsns_sent = data_list[0]->rec.data.tsn; 9830 } 9831 for (i = 0; i < bundle_at; i++) { 9832 SCTP_STAT_INCR(sctps_sendretransdata); 9833 data_list[i]->sent = SCTP_DATAGRAM_SENT; 9834 /* 9835 * When we have a revoked data, and we 9836 * retransmit it, then we clear the revoked 9837 * flag since this flag dictates if we 9838 * subtracted from the fs 9839 */ 9840 if (data_list[i]->rec.data.chunk_was_revoked) { 9841 /* Deflate the cwnd */ 9842 data_list[i]->whoTo->cwnd -= data_list[i]->book_size; 9843 data_list[i]->rec.data.chunk_was_revoked = 0; 9844 } 9845 data_list[i]->snd_count++; 9846 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 9847 /* record the time */ 9848 data_list[i]->sent_rcv_time = asoc->time_last_sent; 9849 if (data_list[i]->book_size_scale) { 9850 /* 9851 * need to double the book size on 9852 * this one 9853 */ 9854 data_list[i]->book_size_scale = 0; 9855 /* 9856 * Since we double the booksize, we 9857 * must also double the output queue 9858 * size, since this get shrunk when 9859 * we free by this amount. 9860 */ 9861 atomic_add_int(&((asoc)->total_output_queue_size), data_list[i]->book_size); 9862 data_list[i]->book_size *= 2; 9863 } else { 9864 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 9865 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 9866 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 9867 } 9868 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 9869 (uint32_t)(data_list[i]->send_size + 9870 SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 9871 } 9872 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 9873 sctp_misc_ints(SCTP_FLIGHT_LOG_UP_RSND, 9874 data_list[i]->whoTo->flight_size, 9875 data_list[i]->book_size, 9876 (uint32_t)(uintptr_t)data_list[i]->whoTo, 9877 data_list[i]->rec.data.tsn); 9878 } 9879 sctp_flight_size_increase(data_list[i]); 9880 sctp_total_flight_increase(stcb, data_list[i]); 9881 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 9882 /* SWS sender side engages */ 9883 asoc->peers_rwnd = 0; 9884 } 9885 if ((i == 0) && 9886 (data_list[i]->rec.data.doing_fast_retransmit)) { 9887 SCTP_STAT_INCR(sctps_sendfastretrans); 9888 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 9889 (tmr_started == 0)) { 9890 /*- 9891 * ok we just fast-retrans'd 9892 * the lowest TSN, i.e the 9893 * first on the list. In 9894 * this case we want to give 9895 * some more time to get a 9896 * SACK back without a 9897 * t3-expiring. 9898 */ 9899 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 9900 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_2); 9901 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9902 } 9903 } 9904 } 9905 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 9906 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND); 9907 } 9908 #ifdef SCTP_AUDITING_ENABLED 9909 sctp_auditing(21, inp, stcb, NULL); 9910 #endif 9911 } else { 9912 /* None will fit */ 9913 return (1); 9914 } 9915 if (asoc->sent_queue_retran_cnt <= 0) { 9916 /* all done we have no more to retran */ 9917 asoc->sent_queue_retran_cnt = 0; 9918 break; 9919 } 9920 if (one_chunk) { 9921 /* No more room in rwnd */ 9922 return (1); 9923 } 9924 /* stop the for loop here. we sent out a packet */ 9925 break; 9926 } 9927 return (0); 9928 } 9929 9930 static void 9931 sctp_timer_validation(struct sctp_inpcb *inp, 9932 struct sctp_tcb *stcb, 9933 struct sctp_association *asoc) 9934 { 9935 struct sctp_nets *net; 9936 9937 /* Validate that a timer is running somewhere */ 9938 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 9939 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9940 /* Here is a timer */ 9941 return; 9942 } 9943 } 9944 SCTP_TCB_LOCK_ASSERT(stcb); 9945 /* Gak, we did not have a timer somewhere */ 9946 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Deadlock avoided starting timer on a dest at retran\n"); 9947 if (asoc->alternate) { 9948 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->alternate); 9949 } else { 9950 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 9951 } 9952 return; 9953 } 9954 9955 void 9956 sctp_chunk_output(struct sctp_inpcb *inp, 9957 struct sctp_tcb *stcb, 9958 int from_where, 9959 int so_locked) 9960 { 9961 /*- 9962 * Ok this is the generic chunk service queue. we must do the 9963 * following: 9964 * - See if there are retransmits pending, if so we must 9965 * do these first. 9966 * - Service the stream queue that is next, moving any 9967 * message (note I must get a complete message i.e. 9968 * FIRST/MIDDLE and LAST to the out queue in one pass) and assigning 9969 * TSN's 9970 * - Check to see if the cwnd/rwnd allows any output, if so we 9971 * go ahead and formulate and send the low level chunks. Making sure 9972 * to combine any control in the control chunk queue also. 9973 */ 9974 struct sctp_association *asoc; 9975 struct sctp_nets *net; 9976 int error = 0, num_out, tot_out = 0, ret = 0, reason_code; 9977 unsigned int burst_cnt = 0; 9978 struct timeval now; 9979 int now_filled = 0; 9980 int nagle_on; 9981 uint32_t frag_point = sctp_get_frag_point(stcb); 9982 int un_sent = 0; 9983 int fr_done; 9984 unsigned int tot_frs = 0; 9985 9986 asoc = &stcb->asoc; 9987 do_it_again: 9988 /* The Nagle algorithm is only applied when handling a send call. */ 9989 if (from_where == SCTP_OUTPUT_FROM_USR_SEND) { 9990 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) { 9991 nagle_on = 0; 9992 } else { 9993 nagle_on = 1; 9994 } 9995 } else { 9996 nagle_on = 0; 9997 } 9998 SCTP_TCB_LOCK_ASSERT(stcb); 9999 10000 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 10001 10002 if ((un_sent <= 0) && 10003 (TAILQ_EMPTY(&asoc->control_send_queue)) && 10004 (TAILQ_EMPTY(&asoc->asconf_send_queue)) && 10005 (asoc->sent_queue_retran_cnt == 0) && 10006 (asoc->trigger_reset == 0)) { 10007 /* Nothing to do unless there is something to be sent left */ 10008 return; 10009 } 10010 /* 10011 * Do we have something to send, data or control AND a sack timer 10012 * running, if so piggy-back the sack. 10013 */ 10014 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 10015 sctp_send_sack(stcb, so_locked); 10016 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, 10017 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_3); 10018 } 10019 while (asoc->sent_queue_retran_cnt) { 10020 /*- 10021 * Ok, it is retransmission time only, we send out only ONE 10022 * packet with a single call off to the retran code. 10023 */ 10024 if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) { 10025 /*- 10026 * Special hook for handling cookies discarded 10027 * by peer that carried data. Send cookie-ack only 10028 * and then the next call with get the retran's. 10029 */ 10030 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10031 from_where, 10032 &now, &now_filled, frag_point, so_locked); 10033 return; 10034 } else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) { 10035 /* if its not from a HB then do it */ 10036 fr_done = 0; 10037 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled, &fr_done, so_locked); 10038 if (fr_done) { 10039 tot_frs++; 10040 } 10041 } else { 10042 /* 10043 * its from any other place, we don't allow retran 10044 * output (only control) 10045 */ 10046 ret = 1; 10047 } 10048 if (ret > 0) { 10049 /* Can't send anymore */ 10050 /*- 10051 * now lets push out control by calling med-level 10052 * output once. this assures that we WILL send HB's 10053 * if queued too. 10054 */ 10055 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10056 from_where, 10057 &now, &now_filled, frag_point, so_locked); 10058 #ifdef SCTP_AUDITING_ENABLED 10059 sctp_auditing(8, inp, stcb, NULL); 10060 #endif 10061 sctp_timer_validation(inp, stcb, asoc); 10062 return; 10063 } 10064 if (ret < 0) { 10065 /*- 10066 * The count was off.. retran is not happening so do 10067 * the normal retransmission. 10068 */ 10069 #ifdef SCTP_AUDITING_ENABLED 10070 sctp_auditing(9, inp, stcb, NULL); 10071 #endif 10072 if (ret == SCTP_RETRAN_EXIT) { 10073 return; 10074 } 10075 break; 10076 } 10077 if (from_where == SCTP_OUTPUT_FROM_T3) { 10078 /* Only one transmission allowed out of a timeout */ 10079 #ifdef SCTP_AUDITING_ENABLED 10080 sctp_auditing(10, inp, stcb, NULL); 10081 #endif 10082 /* Push out any control */ 10083 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, from_where, 10084 &now, &now_filled, frag_point, so_locked); 10085 return; 10086 } 10087 if ((asoc->fr_max_burst > 0) && (tot_frs >= asoc->fr_max_burst)) { 10088 /* Hit FR burst limit */ 10089 return; 10090 } 10091 if ((num_out == 0) && (ret == 0)) { 10092 /* No more retrans to send */ 10093 break; 10094 } 10095 } 10096 #ifdef SCTP_AUDITING_ENABLED 10097 sctp_auditing(12, inp, stcb, NULL); 10098 #endif 10099 /* Check for bad destinations, if they exist move chunks around. */ 10100 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 10101 if ((net->dest_state & SCTP_ADDR_REACHABLE) == 0) { 10102 /*- 10103 * if possible move things off of this address we 10104 * still may send below due to the dormant state but 10105 * we try to find an alternate address to send to 10106 * and if we have one we move all queued data on the 10107 * out wheel to this alternate address. 10108 */ 10109 if (net->ref_count > 1) 10110 sctp_move_chunks_from_net(stcb, net); 10111 } else { 10112 /*- 10113 * if ((asoc->sat_network) || (net->addr_is_local)) 10114 * { burst_limit = asoc->max_burst * 10115 * SCTP_SAT_NETWORK_BURST_INCR; } 10116 */ 10117 if (asoc->max_burst > 0) { 10118 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst)) { 10119 if ((net->flight_size + (asoc->max_burst * net->mtu)) < net->cwnd) { 10120 /* 10121 * JRS - Use the congestion 10122 * control given in the 10123 * congestion control module 10124 */ 10125 asoc->cc_functions.sctp_cwnd_update_after_output(stcb, net, asoc->max_burst); 10126 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10127 sctp_log_maxburst(stcb, net, 0, asoc->max_burst, SCTP_MAX_BURST_APPLIED); 10128 } 10129 SCTP_STAT_INCR(sctps_maxburstqueued); 10130 } 10131 net->fast_retran_ip = 0; 10132 } else { 10133 if (net->flight_size == 0) { 10134 /* 10135 * Should be decaying the 10136 * cwnd here 10137 */ 10138 ; 10139 } 10140 } 10141 } 10142 } 10143 } 10144 burst_cnt = 0; 10145 do { 10146 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 10147 &reason_code, 0, from_where, 10148 &now, &now_filled, frag_point, so_locked); 10149 if (error) { 10150 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Error %d was returned from med-c-op\n", error); 10151 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10152 sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 10153 } 10154 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10155 sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES); 10156 sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES); 10157 } 10158 break; 10159 } 10160 SCTPDBG(SCTP_DEBUG_OUTPUT3, "m-c-o put out %d\n", num_out); 10161 10162 tot_out += num_out; 10163 burst_cnt++; 10164 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10165 sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES); 10166 if (num_out == 0) { 10167 sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES); 10168 } 10169 } 10170 if (nagle_on) { 10171 /* 10172 * When the Nagle algorithm is used, look at how 10173 * much is unsent, then if its smaller than an MTU 10174 * and we have data in flight we stop, except if we 10175 * are handling a fragmented user message. 10176 */ 10177 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 10178 if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) && 10179 (stcb->asoc.total_flight > 0)) { 10180 /* && sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) {*/ 10181 break; 10182 } 10183 } 10184 if (TAILQ_EMPTY(&asoc->control_send_queue) && 10185 TAILQ_EMPTY(&asoc->send_queue) && 10186 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 10187 /* Nothing left to send */ 10188 break; 10189 } 10190 if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) { 10191 /* Nothing left to send */ 10192 break; 10193 } 10194 } while (num_out && 10195 ((asoc->max_burst == 0) || 10196 SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) || 10197 (burst_cnt < asoc->max_burst))); 10198 10199 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) == 0) { 10200 if ((asoc->max_burst > 0) && (burst_cnt >= asoc->max_burst)) { 10201 SCTP_STAT_INCR(sctps_maxburstqueued); 10202 asoc->burst_limit_applied = 1; 10203 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10204 sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED); 10205 } 10206 } else { 10207 asoc->burst_limit_applied = 0; 10208 } 10209 } 10210 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10211 sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES); 10212 } 10213 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, we have put out %d chunks\n", 10214 tot_out); 10215 10216 /*- 10217 * Now we need to clean up the control chunk chain if a ECNE is on 10218 * it. It must be marked as UNSENT again so next call will continue 10219 * to send it until such time that we get a CWR, to remove it. 10220 */ 10221 if (stcb->asoc.ecn_echo_cnt_onq) 10222 sctp_fix_ecn_echo(asoc); 10223 10224 if (stcb->asoc.trigger_reset) { 10225 if (sctp_send_stream_reset_out_if_possible(stcb, so_locked) == 0) { 10226 goto do_it_again; 10227 } 10228 } 10229 return; 10230 } 10231 10232 int 10233 sctp_output( 10234 struct sctp_inpcb *inp, 10235 struct mbuf *m, 10236 struct sockaddr *addr, 10237 struct mbuf *control, 10238 struct thread *p, 10239 int flags) 10240 { 10241 if (inp == NULL) { 10242 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10243 return (EINVAL); 10244 } 10245 10246 if (inp->sctp_socket == NULL) { 10247 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10248 return (EINVAL); 10249 } 10250 return (sctp_sosend(inp->sctp_socket, 10251 addr, 10252 (struct uio *)NULL, 10253 m, 10254 control, 10255 flags, p 10256 )); 10257 } 10258 10259 void 10260 send_forward_tsn(struct sctp_tcb *stcb, 10261 struct sctp_association *asoc) 10262 { 10263 struct sctp_tmit_chunk *chk, *at, *tp1, *last; 10264 struct sctp_forward_tsn_chunk *fwdtsn; 10265 struct sctp_strseq *strseq; 10266 struct sctp_strseq_mid *strseq_m; 10267 uint32_t advance_peer_ack_point; 10268 unsigned int cnt_of_space, i, ovh; 10269 unsigned int space_needed; 10270 unsigned int cnt_of_skipped = 0; 10271 10272 SCTP_TCB_LOCK_ASSERT(stcb); 10273 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10274 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 10275 /* mark it to unsent */ 10276 chk->sent = SCTP_DATAGRAM_UNSENT; 10277 chk->snd_count = 0; 10278 /* Do we correct its output location? */ 10279 if (chk->whoTo) { 10280 sctp_free_remote_addr(chk->whoTo); 10281 chk->whoTo = NULL; 10282 } 10283 goto sctp_fill_in_rest; 10284 } 10285 } 10286 /* Ok if we reach here we must build one */ 10287 sctp_alloc_a_chunk(stcb, chk); 10288 if (chk == NULL) { 10289 return; 10290 } 10291 asoc->fwd_tsn_cnt++; 10292 chk->copy_by_ref = 0; 10293 /* 10294 * We don't do the old thing here since this is used not for on-wire 10295 * but to tell if we are sending a fwd-tsn by the stack during 10296 * output. And if its a IFORWARD or a FORWARD it is a fwd-tsn. 10297 */ 10298 chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN; 10299 chk->rec.chunk_id.can_take_data = 0; 10300 chk->flags = 0; 10301 chk->asoc = asoc; 10302 chk->whoTo = NULL; 10303 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 10304 if (chk->data == NULL) { 10305 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 10306 return; 10307 } 10308 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 10309 chk->sent = SCTP_DATAGRAM_UNSENT; 10310 chk->snd_count = 0; 10311 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 10312 asoc->ctrl_queue_cnt++; 10313 sctp_fill_in_rest: 10314 /*- 10315 * Here we go through and fill out the part that deals with 10316 * stream/seq of the ones we skip. 10317 */ 10318 SCTP_BUF_LEN(chk->data) = 0; 10319 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10320 if ((at->sent != SCTP_FORWARD_TSN_SKIP) && 10321 (at->sent != SCTP_DATAGRAM_NR_ACKED)) { 10322 /* no more to look at */ 10323 break; 10324 } 10325 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10326 /* We don't report these */ 10327 continue; 10328 } 10329 cnt_of_skipped++; 10330 } 10331 if (asoc->idata_supported) { 10332 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10333 (cnt_of_skipped * sizeof(struct sctp_strseq_mid))); 10334 } else { 10335 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10336 (cnt_of_skipped * sizeof(struct sctp_strseq))); 10337 } 10338 cnt_of_space = (unsigned int)M_TRAILINGSPACE(chk->data); 10339 10340 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 10341 ovh = SCTP_MIN_OVERHEAD; 10342 } else { 10343 ovh = SCTP_MIN_V4_OVERHEAD; 10344 } 10345 if (cnt_of_space > (asoc->smallest_mtu - ovh)) { 10346 /* trim to a mtu size */ 10347 cnt_of_space = asoc->smallest_mtu - ovh; 10348 } 10349 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10350 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10351 0xff, 0, cnt_of_skipped, 10352 asoc->advanced_peer_ack_point); 10353 } 10354 advance_peer_ack_point = asoc->advanced_peer_ack_point; 10355 if (cnt_of_space < space_needed) { 10356 /*- 10357 * ok we must trim down the chunk by lowering the 10358 * advance peer ack point. 10359 */ 10360 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10361 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10362 0xff, 0xff, cnt_of_space, 10363 space_needed); 10364 } 10365 cnt_of_skipped = cnt_of_space - sizeof(struct sctp_forward_tsn_chunk); 10366 if (asoc->idata_supported) { 10367 cnt_of_skipped /= sizeof(struct sctp_strseq_mid); 10368 } else { 10369 cnt_of_skipped /= sizeof(struct sctp_strseq); 10370 } 10371 /*- 10372 * Go through and find the TSN that will be the one 10373 * we report. 10374 */ 10375 at = TAILQ_FIRST(&asoc->sent_queue); 10376 if (at != NULL) { 10377 for (i = 0; i < cnt_of_skipped; i++) { 10378 tp1 = TAILQ_NEXT(at, sctp_next); 10379 if (tp1 == NULL) { 10380 break; 10381 } 10382 at = tp1; 10383 } 10384 } 10385 if (at && SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10386 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10387 0xff, cnt_of_skipped, at->rec.data.tsn, 10388 asoc->advanced_peer_ack_point); 10389 } 10390 last = at; 10391 /*- 10392 * last now points to last one I can report, update 10393 * peer ack point 10394 */ 10395 if (last) { 10396 advance_peer_ack_point = last->rec.data.tsn; 10397 } 10398 if (asoc->idata_supported) { 10399 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10400 cnt_of_skipped * sizeof(struct sctp_strseq_mid); 10401 } else { 10402 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10403 cnt_of_skipped * sizeof(struct sctp_strseq); 10404 } 10405 } 10406 chk->send_size = space_needed; 10407 /* Setup the chunk */ 10408 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 10409 fwdtsn->ch.chunk_length = htons(chk->send_size); 10410 fwdtsn->ch.chunk_flags = 0; 10411 if (asoc->idata_supported) { 10412 fwdtsn->ch.chunk_type = SCTP_IFORWARD_CUM_TSN; 10413 } else { 10414 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 10415 } 10416 fwdtsn->new_cumulative_tsn = htonl(advance_peer_ack_point); 10417 SCTP_BUF_LEN(chk->data) = chk->send_size; 10418 fwdtsn++; 10419 /*- 10420 * Move pointer to after the fwdtsn and transfer to the 10421 * strseq pointer. 10422 */ 10423 if (asoc->idata_supported) { 10424 strseq_m = (struct sctp_strseq_mid *)fwdtsn; 10425 strseq = NULL; 10426 } else { 10427 strseq = (struct sctp_strseq *)fwdtsn; 10428 strseq_m = NULL; 10429 } 10430 /*- 10431 * Now populate the strseq list. This is done blindly 10432 * without pulling out duplicate stream info. This is 10433 * inefficient but won't harm the process since the peer will 10434 * look at these in sequence and will thus release anything. 10435 * It could mean we exceed the PMTU and chop off some that 10436 * we could have included.. but this is unlikely (aka 1432/4 10437 * would mean 300+ stream seq's would have to be reported in 10438 * one FWD-TSN. With a bit of work we can later FIX this to 10439 * optimize and pull out duplicates.. but it does add more 10440 * overhead. So for now... not! 10441 */ 10442 i = 0; 10443 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10444 if (i >= cnt_of_skipped) { 10445 break; 10446 } 10447 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10448 /* We don't report these */ 10449 continue; 10450 } 10451 if (at->rec.data.tsn == advance_peer_ack_point) { 10452 at->rec.data.fwd_tsn_cnt = 0; 10453 } 10454 if (asoc->idata_supported) { 10455 strseq_m->sid = htons(at->rec.data.sid); 10456 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 10457 strseq_m->flags = htons(PR_SCTP_UNORDERED_FLAG); 10458 } else { 10459 strseq_m->flags = 0; 10460 } 10461 strseq_m->mid = htonl(at->rec.data.mid); 10462 strseq_m++; 10463 } else { 10464 strseq->sid = htons(at->rec.data.sid); 10465 strseq->ssn = htons((uint16_t)at->rec.data.mid); 10466 strseq++; 10467 } 10468 i++; 10469 } 10470 return; 10471 } 10472 10473 void 10474 sctp_send_sack(struct sctp_tcb *stcb, int so_locked) 10475 { 10476 /*- 10477 * Queue up a SACK or NR-SACK in the control queue. 10478 * We must first check to see if a SACK or NR-SACK is 10479 * somehow on the control queue. 10480 * If so, we will take and and remove the old one. 10481 */ 10482 struct sctp_association *asoc; 10483 struct sctp_tmit_chunk *chk, *a_chk; 10484 struct sctp_sack_chunk *sack; 10485 struct sctp_nr_sack_chunk *nr_sack; 10486 struct sctp_gap_ack_block *gap_descriptor; 10487 const struct sack_track *selector; 10488 int mergeable = 0; 10489 int offset; 10490 caddr_t limit; 10491 uint32_t *dup; 10492 int limit_reached = 0; 10493 unsigned int i, siz, j; 10494 unsigned int num_gap_blocks = 0, num_nr_gap_blocks = 0, space; 10495 int num_dups = 0; 10496 int space_req; 10497 uint32_t highest_tsn; 10498 uint8_t flags; 10499 uint8_t type; 10500 uint8_t tsn_map; 10501 10502 if (stcb->asoc.nrsack_supported == 1) { 10503 type = SCTP_NR_SELECTIVE_ACK; 10504 } else { 10505 type = SCTP_SELECTIVE_ACK; 10506 } 10507 a_chk = NULL; 10508 asoc = &stcb->asoc; 10509 SCTP_TCB_LOCK_ASSERT(stcb); 10510 if (asoc->last_data_chunk_from == NULL) { 10511 /* Hmm we never received anything */ 10512 return; 10513 } 10514 sctp_slide_mapping_arrays(stcb); 10515 sctp_set_rwnd(stcb, asoc); 10516 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10517 if (chk->rec.chunk_id.id == type) { 10518 /* Hmm, found a sack already on queue, remove it */ 10519 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 10520 asoc->ctrl_queue_cnt--; 10521 a_chk = chk; 10522 if (a_chk->data) { 10523 sctp_m_freem(a_chk->data); 10524 a_chk->data = NULL; 10525 } 10526 if (a_chk->whoTo) { 10527 sctp_free_remote_addr(a_chk->whoTo); 10528 a_chk->whoTo = NULL; 10529 } 10530 break; 10531 } 10532 } 10533 if (a_chk == NULL) { 10534 sctp_alloc_a_chunk(stcb, a_chk); 10535 if (a_chk == NULL) { 10536 /* No memory so we drop the idea, and set a timer */ 10537 if (stcb->asoc.delayed_ack) { 10538 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10539 stcb->sctp_ep, stcb, NULL, 10540 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4); 10541 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10542 stcb->sctp_ep, stcb, NULL); 10543 } else { 10544 stcb->asoc.send_sack = 1; 10545 } 10546 return; 10547 } 10548 a_chk->copy_by_ref = 0; 10549 a_chk->rec.chunk_id.id = type; 10550 a_chk->rec.chunk_id.can_take_data = 1; 10551 } 10552 /* Clear our pkt counts */ 10553 asoc->data_pkts_seen = 0; 10554 10555 a_chk->flags = 0; 10556 a_chk->asoc = asoc; 10557 a_chk->snd_count = 0; 10558 a_chk->send_size = 0; /* fill in later */ 10559 a_chk->sent = SCTP_DATAGRAM_UNSENT; 10560 a_chk->whoTo = NULL; 10561 10562 if ((asoc->last_data_chunk_from->dest_state & SCTP_ADDR_REACHABLE) == 0) { 10563 /*- 10564 * Ok, the destination for the SACK is unreachable, lets see if 10565 * we can select an alternate to asoc->last_data_chunk_from 10566 */ 10567 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0); 10568 if (a_chk->whoTo == NULL) { 10569 /* Nope, no alternate */ 10570 a_chk->whoTo = asoc->last_data_chunk_from; 10571 } 10572 } else { 10573 a_chk->whoTo = asoc->last_data_chunk_from; 10574 } 10575 if (a_chk->whoTo) { 10576 atomic_add_int(&a_chk->whoTo->ref_count, 1); 10577 } 10578 if (SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->highest_tsn_inside_nr_map)) { 10579 highest_tsn = asoc->highest_tsn_inside_map; 10580 } else { 10581 highest_tsn = asoc->highest_tsn_inside_nr_map; 10582 } 10583 if (highest_tsn == asoc->cumulative_tsn) { 10584 /* no gaps */ 10585 if (type == SCTP_SELECTIVE_ACK) { 10586 space_req = sizeof(struct sctp_sack_chunk); 10587 } else { 10588 space_req = sizeof(struct sctp_nr_sack_chunk); 10589 } 10590 } else { 10591 /* gaps get a cluster */ 10592 space_req = MCLBYTES; 10593 } 10594 /* Ok now lets formulate a MBUF with our sack */ 10595 a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_NOWAIT, 1, MT_DATA); 10596 if ((a_chk->data == NULL) || 10597 (a_chk->whoTo == NULL)) { 10598 /* rats, no mbuf memory */ 10599 if (a_chk->data) { 10600 /* was a problem with the destination */ 10601 sctp_m_freem(a_chk->data); 10602 a_chk->data = NULL; 10603 } 10604 sctp_free_a_chunk(stcb, a_chk, so_locked); 10605 /* sa_ignore NO_NULL_CHK */ 10606 if (stcb->asoc.delayed_ack) { 10607 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10608 stcb->sctp_ep, stcb, NULL, 10609 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5); 10610 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10611 stcb->sctp_ep, stcb, NULL); 10612 } else { 10613 stcb->asoc.send_sack = 1; 10614 } 10615 return; 10616 } 10617 /* ok, lets go through and fill it in */ 10618 SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD); 10619 space = (unsigned int)M_TRAILINGSPACE(a_chk->data); 10620 if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) { 10621 space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD); 10622 } 10623 limit = mtod(a_chk->data, caddr_t); 10624 limit += space; 10625 10626 flags = 0; 10627 10628 if ((asoc->sctp_cmt_on_off > 0) && 10629 SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) { 10630 /*- 10631 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been 10632 * received, then set high bit to 1, else 0. Reset 10633 * pkts_rcvd. 10634 */ 10635 flags |= (asoc->cmt_dac_pkts_rcvd << 6); 10636 asoc->cmt_dac_pkts_rcvd = 0; 10637 } 10638 #ifdef SCTP_ASOCLOG_OF_TSNS 10639 stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn; 10640 stcb->asoc.cumack_log_atsnt++; 10641 if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) { 10642 stcb->asoc.cumack_log_atsnt = 0; 10643 } 10644 #endif 10645 /* reset the readers interpretation */ 10646 stcb->freed_by_sorcv_sincelast = 0; 10647 10648 if (type == SCTP_SELECTIVE_ACK) { 10649 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 10650 nr_sack = NULL; 10651 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk)); 10652 if (highest_tsn > asoc->mapping_array_base_tsn) { 10653 siz = (((highest_tsn - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10654 } else { 10655 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + highest_tsn + 7) / 8; 10656 } 10657 } else { 10658 sack = NULL; 10659 nr_sack = mtod(a_chk->data, struct sctp_nr_sack_chunk *); 10660 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)nr_sack + sizeof(struct sctp_nr_sack_chunk)); 10661 if (asoc->highest_tsn_inside_map > asoc->mapping_array_base_tsn) { 10662 siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10663 } else { 10664 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_map + 7) / 8; 10665 } 10666 } 10667 10668 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10669 offset = 1; 10670 } else { 10671 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10672 } 10673 if (((type == SCTP_SELECTIVE_ACK) && 10674 SCTP_TSN_GT(highest_tsn, asoc->cumulative_tsn)) || 10675 ((type == SCTP_NR_SELECTIVE_ACK) && 10676 SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->cumulative_tsn))) { 10677 /* we have a gap .. maybe */ 10678 for (i = 0; i < siz; i++) { 10679 tsn_map = asoc->mapping_array[i]; 10680 if (type == SCTP_SELECTIVE_ACK) { 10681 tsn_map |= asoc->nr_mapping_array[i]; 10682 } 10683 if (i == 0) { 10684 /* 10685 * Clear all bits corresponding to TSNs 10686 * smaller or equal to the cumulative TSN. 10687 */ 10688 tsn_map &= (~0U << (1 - offset)); 10689 } 10690 selector = &sack_array[tsn_map]; 10691 if (mergeable && selector->right_edge) { 10692 /* 10693 * Backup, left and right edges were ok to 10694 * merge. 10695 */ 10696 num_gap_blocks--; 10697 gap_descriptor--; 10698 } 10699 if (selector->num_entries == 0) 10700 mergeable = 0; 10701 else { 10702 for (j = 0; j < selector->num_entries; j++) { 10703 if (mergeable && selector->right_edge) { 10704 /* 10705 * do a merge by NOT setting 10706 * the left side 10707 */ 10708 mergeable = 0; 10709 } else { 10710 /* 10711 * no merge, set the left 10712 * side 10713 */ 10714 mergeable = 0; 10715 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10716 } 10717 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10718 num_gap_blocks++; 10719 gap_descriptor++; 10720 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10721 /* no more room */ 10722 limit_reached = 1; 10723 break; 10724 } 10725 } 10726 if (selector->left_edge) { 10727 mergeable = 1; 10728 } 10729 } 10730 if (limit_reached) { 10731 /* Reached the limit stop */ 10732 break; 10733 } 10734 offset += 8; 10735 } 10736 } 10737 if ((type == SCTP_NR_SELECTIVE_ACK) && 10738 (limit_reached == 0)) { 10739 mergeable = 0; 10740 10741 if (asoc->highest_tsn_inside_nr_map > asoc->mapping_array_base_tsn) { 10742 siz = (((asoc->highest_tsn_inside_nr_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10743 } else { 10744 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_nr_map + 7) / 8; 10745 } 10746 10747 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10748 offset = 1; 10749 } else { 10750 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10751 } 10752 if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->cumulative_tsn)) { 10753 /* we have a gap .. maybe */ 10754 for (i = 0; i < siz; i++) { 10755 tsn_map = asoc->nr_mapping_array[i]; 10756 if (i == 0) { 10757 /* 10758 * Clear all bits corresponding to 10759 * TSNs smaller or equal to the 10760 * cumulative TSN. 10761 */ 10762 tsn_map &= (~0U << (1 - offset)); 10763 } 10764 selector = &sack_array[tsn_map]; 10765 if (mergeable && selector->right_edge) { 10766 /* 10767 * Backup, left and right edges were 10768 * ok to merge. 10769 */ 10770 num_nr_gap_blocks--; 10771 gap_descriptor--; 10772 } 10773 if (selector->num_entries == 0) 10774 mergeable = 0; 10775 else { 10776 for (j = 0; j < selector->num_entries; j++) { 10777 if (mergeable && selector->right_edge) { 10778 /* 10779 * do a merge by NOT 10780 * setting the left 10781 * side 10782 */ 10783 mergeable = 0; 10784 } else { 10785 /* 10786 * no merge, set the 10787 * left side 10788 */ 10789 mergeable = 0; 10790 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10791 } 10792 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10793 num_nr_gap_blocks++; 10794 gap_descriptor++; 10795 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10796 /* no more room */ 10797 limit_reached = 1; 10798 break; 10799 } 10800 } 10801 if (selector->left_edge) { 10802 mergeable = 1; 10803 } 10804 } 10805 if (limit_reached) { 10806 /* Reached the limit stop */ 10807 break; 10808 } 10809 offset += 8; 10810 } 10811 } 10812 } 10813 /* now we must add any dups we are going to report. */ 10814 if ((limit_reached == 0) && (asoc->numduptsns)) { 10815 dup = (uint32_t *)gap_descriptor; 10816 for (i = 0; i < asoc->numduptsns; i++) { 10817 *dup = htonl(asoc->dup_tsns[i]); 10818 dup++; 10819 num_dups++; 10820 if (((caddr_t)dup + sizeof(uint32_t)) > limit) { 10821 /* no more room */ 10822 break; 10823 } 10824 } 10825 asoc->numduptsns = 0; 10826 } 10827 /* 10828 * now that the chunk is prepared queue it to the control chunk 10829 * queue. 10830 */ 10831 if (type == SCTP_SELECTIVE_ACK) { 10832 a_chk->send_size = (uint16_t)(sizeof(struct sctp_sack_chunk) + 10833 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10834 num_dups * sizeof(int32_t)); 10835 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10836 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10837 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 10838 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 10839 sack->sack.num_dup_tsns = htons(num_dups); 10840 sack->ch.chunk_type = type; 10841 sack->ch.chunk_flags = flags; 10842 sack->ch.chunk_length = htons(a_chk->send_size); 10843 } else { 10844 a_chk->send_size = (uint16_t)(sizeof(struct sctp_nr_sack_chunk) + 10845 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10846 num_dups * sizeof(int32_t)); 10847 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10848 nr_sack->nr_sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10849 nr_sack->nr_sack.a_rwnd = htonl(asoc->my_rwnd); 10850 nr_sack->nr_sack.num_gap_ack_blks = htons(num_gap_blocks); 10851 nr_sack->nr_sack.num_nr_gap_ack_blks = htons(num_nr_gap_blocks); 10852 nr_sack->nr_sack.num_dup_tsns = htons(num_dups); 10853 nr_sack->nr_sack.reserved = 0; 10854 nr_sack->ch.chunk_type = type; 10855 nr_sack->ch.chunk_flags = flags; 10856 nr_sack->ch.chunk_length = htons(a_chk->send_size); 10857 } 10858 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 10859 asoc->my_last_reported_rwnd = asoc->my_rwnd; 10860 asoc->ctrl_queue_cnt++; 10861 asoc->send_sack = 0; 10862 SCTP_STAT_INCR(sctps_sendsacks); 10863 return; 10864 } 10865 10866 void 10867 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr, int so_locked) 10868 { 10869 struct mbuf *m_abort, *m, *m_last; 10870 struct mbuf *m_out, *m_end = NULL; 10871 struct sctp_abort_chunk *abort; 10872 struct sctp_auth_chunk *auth = NULL; 10873 struct sctp_nets *net; 10874 uint32_t vtag; 10875 uint32_t auth_offset = 0; 10876 int error; 10877 uint16_t cause_len, chunk_len, padding_len; 10878 10879 SCTP_TCB_LOCK_ASSERT(stcb); 10880 /*- 10881 * Add an AUTH chunk, if chunk requires it and save the offset into 10882 * the chain for AUTH 10883 */ 10884 if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION, 10885 stcb->asoc.peer_auth_chunks)) { 10886 m_out = sctp_add_auth_chunk(NULL, &m_end, &auth, &auth_offset, 10887 stcb, SCTP_ABORT_ASSOCIATION); 10888 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10889 } else { 10890 m_out = NULL; 10891 } 10892 m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_NOWAIT, 1, MT_HEADER); 10893 if (m_abort == NULL) { 10894 if (m_out) { 10895 sctp_m_freem(m_out); 10896 } 10897 if (operr) { 10898 sctp_m_freem(operr); 10899 } 10900 return; 10901 } 10902 /* link in any error */ 10903 SCTP_BUF_NEXT(m_abort) = operr; 10904 cause_len = 0; 10905 m_last = NULL; 10906 for (m = operr; m; m = SCTP_BUF_NEXT(m)) { 10907 cause_len += (uint16_t)SCTP_BUF_LEN(m); 10908 if (SCTP_BUF_NEXT(m) == NULL) { 10909 m_last = m; 10910 } 10911 } 10912 SCTP_BUF_LEN(m_abort) = sizeof(struct sctp_abort_chunk); 10913 chunk_len = (uint16_t)sizeof(struct sctp_abort_chunk) + cause_len; 10914 padding_len = SCTP_SIZE32(chunk_len) - chunk_len; 10915 if (m_out == NULL) { 10916 /* NO Auth chunk prepended, so reserve space in front */ 10917 SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD); 10918 m_out = m_abort; 10919 } else { 10920 /* Put AUTH chunk at the front of the chain */ 10921 SCTP_BUF_NEXT(m_end) = m_abort; 10922 } 10923 if (stcb->asoc.alternate) { 10924 net = stcb->asoc.alternate; 10925 } else { 10926 net = stcb->asoc.primary_destination; 10927 } 10928 /* Fill in the ABORT chunk header. */ 10929 abort = mtod(m_abort, struct sctp_abort_chunk *); 10930 abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION; 10931 if (stcb->asoc.peer_vtag == 0) { 10932 /* This happens iff the assoc is in COOKIE-WAIT state. */ 10933 vtag = stcb->asoc.my_vtag; 10934 abort->ch.chunk_flags = SCTP_HAD_NO_TCB; 10935 } else { 10936 vtag = stcb->asoc.peer_vtag; 10937 abort->ch.chunk_flags = 0; 10938 } 10939 abort->ch.chunk_length = htons(chunk_len); 10940 /* Add padding, if necessary. */ 10941 if (padding_len > 0) { 10942 if ((m_last == NULL) || 10943 (sctp_add_pad_tombuf(m_last, padding_len) == NULL)) { 10944 sctp_m_freem(m_out); 10945 return; 10946 } 10947 } 10948 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10949 (struct sockaddr *)&net->ro._l_addr, 10950 m_out, auth_offset, auth, stcb->asoc.authinfo.active_keyid, 1, 0, 0, 10951 stcb->sctp_ep->sctp_lport, stcb->rport, htonl(vtag), 10952 stcb->asoc.primary_destination->port, NULL, 10953 0, 0, 10954 stcb->asoc.zero_checksum == 2, 10955 so_locked))) { 10956 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 10957 if (error == ENOBUFS) { 10958 stcb->asoc.ifp_had_enobuf = 1; 10959 SCTP_STAT_INCR(sctps_lowlevelerr); 10960 } 10961 } else { 10962 stcb->asoc.ifp_had_enobuf = 0; 10963 } 10964 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10965 } 10966 10967 void 10968 sctp_send_shutdown_complete(struct sctp_tcb *stcb, 10969 struct sctp_nets *net, 10970 int reflect_vtag) 10971 { 10972 /* formulate and SEND a SHUTDOWN-COMPLETE */ 10973 struct mbuf *m_shutdown_comp; 10974 struct sctp_shutdown_complete_chunk *shutdown_complete; 10975 uint32_t vtag; 10976 int error; 10977 uint8_t flags; 10978 10979 m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 10980 if (m_shutdown_comp == NULL) { 10981 /* no mbuf's */ 10982 return; 10983 } 10984 if (reflect_vtag) { 10985 flags = SCTP_HAD_NO_TCB; 10986 vtag = stcb->asoc.my_vtag; 10987 } else { 10988 flags = 0; 10989 vtag = stcb->asoc.peer_vtag; 10990 } 10991 shutdown_complete = mtod(m_shutdown_comp, struct sctp_shutdown_complete_chunk *); 10992 shutdown_complete->ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 10993 shutdown_complete->ch.chunk_flags = flags; 10994 shutdown_complete->ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 10995 SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_chunk); 10996 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10997 (struct sockaddr *)&net->ro._l_addr, 10998 m_shutdown_comp, 0, NULL, 0, 1, 0, 0, 10999 stcb->sctp_ep->sctp_lport, stcb->rport, 11000 htonl(vtag), 11001 net->port, NULL, 11002 0, 0, 11003 stcb->asoc.zero_checksum == 2, 11004 SCTP_SO_NOT_LOCKED))) { 11005 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 11006 if (error == ENOBUFS) { 11007 stcb->asoc.ifp_had_enobuf = 1; 11008 SCTP_STAT_INCR(sctps_lowlevelerr); 11009 } 11010 } else { 11011 stcb->asoc.ifp_had_enobuf = 0; 11012 } 11013 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11014 return; 11015 } 11016 11017 static void 11018 sctp_send_resp_msg(struct sockaddr *src, struct sockaddr *dst, 11019 struct sctphdr *sh, uint32_t vtag, 11020 uint8_t type, struct mbuf *cause, 11021 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11022 uint32_t vrf_id, uint16_t port) 11023 { 11024 struct mbuf *o_pak; 11025 struct mbuf *mout; 11026 struct sctphdr *shout; 11027 struct sctp_chunkhdr *ch; 11028 #if defined(INET) || defined(INET6) 11029 struct udphdr *udp; 11030 #endif 11031 int ret, len, cause_len, padding_len; 11032 #ifdef INET 11033 struct sockaddr_in *src_sin, *dst_sin; 11034 struct ip *ip; 11035 #endif 11036 #ifdef INET6 11037 struct sockaddr_in6 *src_sin6, *dst_sin6; 11038 struct ip6_hdr *ip6; 11039 #endif 11040 11041 /* Compute the length of the cause and add final padding. */ 11042 cause_len = 0; 11043 if (cause != NULL) { 11044 struct mbuf *m_at, *m_last = NULL; 11045 11046 for (m_at = cause; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 11047 if (SCTP_BUF_NEXT(m_at) == NULL) 11048 m_last = m_at; 11049 cause_len += SCTP_BUF_LEN(m_at); 11050 } 11051 padding_len = cause_len % 4; 11052 if (padding_len != 0) { 11053 padding_len = 4 - padding_len; 11054 } 11055 if (padding_len != 0) { 11056 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 11057 sctp_m_freem(cause); 11058 return; 11059 } 11060 } 11061 } else { 11062 padding_len = 0; 11063 } 11064 /* Get an mbuf for the header. */ 11065 len = sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 11066 switch (dst->sa_family) { 11067 #ifdef INET 11068 case AF_INET: 11069 len += sizeof(struct ip); 11070 break; 11071 #endif 11072 #ifdef INET6 11073 case AF_INET6: 11074 len += sizeof(struct ip6_hdr); 11075 break; 11076 #endif 11077 default: 11078 break; 11079 } 11080 #if defined(INET) || defined(INET6) 11081 if (port) { 11082 len += sizeof(struct udphdr); 11083 } 11084 #endif 11085 mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_NOWAIT, 1, MT_DATA); 11086 if (mout == NULL) { 11087 if (cause) { 11088 sctp_m_freem(cause); 11089 } 11090 return; 11091 } 11092 SCTP_BUF_RESV_UF(mout, max_linkhdr); 11093 SCTP_BUF_LEN(mout) = len; 11094 SCTP_BUF_NEXT(mout) = cause; 11095 M_SETFIB(mout, fibnum); 11096 mout->m_pkthdr.flowid = mflowid; 11097 M_HASHTYPE_SET(mout, mflowtype); 11098 #ifdef INET 11099 ip = NULL; 11100 #endif 11101 #ifdef INET6 11102 ip6 = NULL; 11103 #endif 11104 switch (dst->sa_family) { 11105 #ifdef INET 11106 case AF_INET: 11107 src_sin = (struct sockaddr_in *)src; 11108 dst_sin = (struct sockaddr_in *)dst; 11109 ip = mtod(mout, struct ip *); 11110 ip->ip_v = IPVERSION; 11111 ip->ip_hl = (sizeof(struct ip) >> 2); 11112 ip->ip_tos = 0; 11113 ip->ip_off = htons(IP_DF); 11114 ip_fillid(ip); 11115 ip->ip_ttl = MODULE_GLOBAL(ip_defttl); 11116 if (port) { 11117 ip->ip_p = IPPROTO_UDP; 11118 } else { 11119 ip->ip_p = IPPROTO_SCTP; 11120 } 11121 ip->ip_src.s_addr = dst_sin->sin_addr.s_addr; 11122 ip->ip_dst.s_addr = src_sin->sin_addr.s_addr; 11123 ip->ip_sum = 0; 11124 len = sizeof(struct ip); 11125 shout = (struct sctphdr *)((caddr_t)ip + len); 11126 break; 11127 #endif 11128 #ifdef INET6 11129 case AF_INET6: 11130 src_sin6 = (struct sockaddr_in6 *)src; 11131 dst_sin6 = (struct sockaddr_in6 *)dst; 11132 ip6 = mtod(mout, struct ip6_hdr *); 11133 ip6->ip6_flow = htonl(0x60000000); 11134 if (V_ip6_auto_flowlabel) { 11135 ip6->ip6_flow |= (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK); 11136 } 11137 ip6->ip6_hlim = MODULE_GLOBAL(ip6_defhlim); 11138 if (port) { 11139 ip6->ip6_nxt = IPPROTO_UDP; 11140 } else { 11141 ip6->ip6_nxt = IPPROTO_SCTP; 11142 } 11143 ip6->ip6_src = dst_sin6->sin6_addr; 11144 ip6->ip6_dst = src_sin6->sin6_addr; 11145 len = sizeof(struct ip6_hdr); 11146 shout = (struct sctphdr *)((caddr_t)ip6 + len); 11147 break; 11148 #endif 11149 default: 11150 len = 0; 11151 shout = mtod(mout, struct sctphdr *); 11152 break; 11153 } 11154 #if defined(INET) || defined(INET6) 11155 if (port) { 11156 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 11157 sctp_m_freem(mout); 11158 return; 11159 } 11160 udp = (struct udphdr *)shout; 11161 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 11162 udp->uh_dport = port; 11163 udp->uh_sum = 0; 11164 udp->uh_ulen = htons((uint16_t)(sizeof(struct udphdr) + 11165 sizeof(struct sctphdr) + 11166 sizeof(struct sctp_chunkhdr) + 11167 cause_len + padding_len)); 11168 len += sizeof(struct udphdr); 11169 shout = (struct sctphdr *)((caddr_t)shout + sizeof(struct udphdr)); 11170 } else { 11171 udp = NULL; 11172 } 11173 #endif 11174 shout->src_port = sh->dest_port; 11175 shout->dest_port = sh->src_port; 11176 shout->checksum = 0; 11177 if (vtag) { 11178 shout->v_tag = htonl(vtag); 11179 } else { 11180 shout->v_tag = sh->v_tag; 11181 } 11182 len += sizeof(struct sctphdr); 11183 ch = (struct sctp_chunkhdr *)((caddr_t)shout + sizeof(struct sctphdr)); 11184 ch->chunk_type = type; 11185 if (vtag) { 11186 ch->chunk_flags = 0; 11187 } else { 11188 ch->chunk_flags = SCTP_HAD_NO_TCB; 11189 } 11190 ch->chunk_length = htons((uint16_t)(sizeof(struct sctp_chunkhdr) + cause_len)); 11191 len += sizeof(struct sctp_chunkhdr); 11192 len += cause_len + padding_len; 11193 11194 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 11195 sctp_m_freem(mout); 11196 return; 11197 } 11198 SCTP_ATTACH_CHAIN(o_pak, mout, len); 11199 switch (dst->sa_family) { 11200 #ifdef INET 11201 case AF_INET: 11202 if (port) { 11203 if (V_udp_cksum) { 11204 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 11205 } else { 11206 udp->uh_sum = 0; 11207 } 11208 } 11209 ip->ip_len = htons(len); 11210 if (port) { 11211 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip) + sizeof(struct udphdr)); 11212 SCTP_STAT_INCR(sctps_sendswcrc); 11213 if (V_udp_cksum) { 11214 SCTP_ENABLE_UDP_CSUM(o_pak); 11215 } 11216 } else { 11217 mout->m_pkthdr.csum_flags = CSUM_SCTP; 11218 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11219 SCTP_STAT_INCR(sctps_sendhwcrc); 11220 } 11221 #ifdef SCTP_PACKET_LOGGING 11222 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11223 sctp_packet_log(o_pak); 11224 } 11225 #endif 11226 SCTP_PROBE5(send, NULL, NULL, ip, NULL, shout); 11227 SCTP_IP_OUTPUT(ret, o_pak, NULL, NULL, vrf_id); 11228 break; 11229 #endif 11230 #ifdef INET6 11231 case AF_INET6: 11232 ip6->ip6_plen = htons((uint16_t)(len - sizeof(struct ip6_hdr))); 11233 if (port) { 11234 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 11235 SCTP_STAT_INCR(sctps_sendswcrc); 11236 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), len - sizeof(struct ip6_hdr))) == 0) { 11237 udp->uh_sum = 0xffff; 11238 } 11239 } else { 11240 mout->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 11241 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11242 SCTP_STAT_INCR(sctps_sendhwcrc); 11243 } 11244 #ifdef SCTP_PACKET_LOGGING 11245 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11246 sctp_packet_log(o_pak); 11247 } 11248 #endif 11249 SCTP_PROBE5(send, NULL, NULL, ip6, NULL, shout); 11250 SCTP_IP6_OUTPUT(ret, o_pak, NULL, NULL, NULL, vrf_id); 11251 break; 11252 #endif 11253 default: 11254 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 11255 dst->sa_family); 11256 sctp_m_freem(mout); 11257 SCTP_LTRACE_ERR_RET_PKT(mout, NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 11258 return; 11259 } 11260 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 11261 if (port) { 11262 UDPSTAT_INC(udps_opackets); 11263 } 11264 SCTP_STAT_INCR(sctps_sendpackets); 11265 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 11266 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11267 if (ret) { 11268 SCTP_STAT_INCR(sctps_senderrors); 11269 } 11270 return; 11271 } 11272 11273 void 11274 sctp_send_shutdown_complete2(struct sockaddr *src, struct sockaddr *dst, 11275 struct sctphdr *sh, 11276 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11277 uint32_t vrf_id, uint16_t port) 11278 { 11279 sctp_send_resp_msg(src, dst, sh, 0, SCTP_SHUTDOWN_COMPLETE, NULL, 11280 mflowtype, mflowid, fibnum, 11281 vrf_id, port); 11282 } 11283 11284 void 11285 sctp_send_hb(struct sctp_tcb *stcb, struct sctp_nets *net, int so_locked) 11286 { 11287 struct sctp_tmit_chunk *chk; 11288 struct sctp_heartbeat_chunk *hb; 11289 struct timeval now; 11290 11291 SCTP_TCB_LOCK_ASSERT(stcb); 11292 if (net == NULL) { 11293 return; 11294 } 11295 (void)SCTP_GETTIME_TIMEVAL(&now); 11296 switch (net->ro._l_addr.sa.sa_family) { 11297 #ifdef INET 11298 case AF_INET: 11299 break; 11300 #endif 11301 #ifdef INET6 11302 case AF_INET6: 11303 break; 11304 #endif 11305 default: 11306 return; 11307 } 11308 sctp_alloc_a_chunk(stcb, chk); 11309 if (chk == NULL) { 11310 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak, can't get a chunk for hb\n"); 11311 return; 11312 } 11313 11314 chk->copy_by_ref = 0; 11315 chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST; 11316 chk->rec.chunk_id.can_take_data = 1; 11317 chk->flags = 0; 11318 chk->asoc = &stcb->asoc; 11319 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 11320 11321 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11322 if (chk->data == NULL) { 11323 sctp_free_a_chunk(stcb, chk, so_locked); 11324 return; 11325 } 11326 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11327 SCTP_BUF_LEN(chk->data) = chk->send_size; 11328 chk->sent = SCTP_DATAGRAM_UNSENT; 11329 chk->snd_count = 0; 11330 chk->whoTo = net; 11331 atomic_add_int(&chk->whoTo->ref_count, 1); 11332 /* Now we have a mbuf that we can fill in with the details */ 11333 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 11334 memset(hb, 0, sizeof(struct sctp_heartbeat_chunk)); 11335 /* fill out chunk header */ 11336 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 11337 hb->ch.chunk_flags = 0; 11338 hb->ch.chunk_length = htons(chk->send_size); 11339 /* Fill out hb parameter */ 11340 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 11341 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 11342 hb->heartbeat.hb_info.time_value_1 = (uint32_t)now.tv_sec; 11343 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 11344 /* Did our user request this one, put it in */ 11345 hb->heartbeat.hb_info.addr_family = (uint8_t)net->ro._l_addr.sa.sa_family; 11346 hb->heartbeat.hb_info.addr_len = net->ro._l_addr.sa.sa_len; 11347 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 11348 /* 11349 * we only take from the entropy pool if the address is not 11350 * confirmed. 11351 */ 11352 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11353 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11354 } else { 11355 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 11356 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 11357 } 11358 switch (net->ro._l_addr.sa.sa_family) { 11359 #ifdef INET 11360 case AF_INET: 11361 memcpy(hb->heartbeat.hb_info.address, 11362 &net->ro._l_addr.sin.sin_addr, 11363 sizeof(net->ro._l_addr.sin.sin_addr)); 11364 break; 11365 #endif 11366 #ifdef INET6 11367 case AF_INET6: 11368 memcpy(hb->heartbeat.hb_info.address, 11369 &net->ro._l_addr.sin6.sin6_addr, 11370 sizeof(net->ro._l_addr.sin6.sin6_addr)); 11371 break; 11372 #endif 11373 default: 11374 if (chk->data) { 11375 sctp_m_freem(chk->data); 11376 chk->data = NULL; 11377 } 11378 sctp_free_a_chunk(stcb, chk, so_locked); 11379 return; 11380 break; 11381 } 11382 net->hb_responded = 0; 11383 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11384 stcb->asoc.ctrl_queue_cnt++; 11385 SCTP_STAT_INCR(sctps_sendheartbeat); 11386 return; 11387 } 11388 11389 void 11390 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 11391 uint32_t high_tsn) 11392 { 11393 struct sctp_association *asoc; 11394 struct sctp_ecne_chunk *ecne; 11395 struct sctp_tmit_chunk *chk; 11396 11397 if (net == NULL) { 11398 return; 11399 } 11400 asoc = &stcb->asoc; 11401 SCTP_TCB_LOCK_ASSERT(stcb); 11402 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11403 if ((chk->rec.chunk_id.id == SCTP_ECN_ECHO) && (net == chk->whoTo)) { 11404 /* found a previous ECN_ECHO update it if needed */ 11405 uint32_t cnt, ctsn; 11406 11407 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11408 ctsn = ntohl(ecne->tsn); 11409 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11410 ecne->tsn = htonl(high_tsn); 11411 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11412 } 11413 cnt = ntohl(ecne->num_pkts_since_cwr); 11414 cnt++; 11415 ecne->num_pkts_since_cwr = htonl(cnt); 11416 return; 11417 } 11418 } 11419 /* nope could not find one to update so we must build one */ 11420 sctp_alloc_a_chunk(stcb, chk); 11421 if (chk == NULL) { 11422 return; 11423 } 11424 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11425 chk->copy_by_ref = 0; 11426 chk->rec.chunk_id.id = SCTP_ECN_ECHO; 11427 chk->rec.chunk_id.can_take_data = 0; 11428 chk->flags = 0; 11429 chk->asoc = &stcb->asoc; 11430 chk->send_size = sizeof(struct sctp_ecne_chunk); 11431 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11432 if (chk->data == NULL) { 11433 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11434 return; 11435 } 11436 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11437 SCTP_BUF_LEN(chk->data) = chk->send_size; 11438 chk->sent = SCTP_DATAGRAM_UNSENT; 11439 chk->snd_count = 0; 11440 chk->whoTo = net; 11441 atomic_add_int(&chk->whoTo->ref_count, 1); 11442 11443 stcb->asoc.ecn_echo_cnt_onq++; 11444 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11445 ecne->ch.chunk_type = SCTP_ECN_ECHO; 11446 ecne->ch.chunk_flags = 0; 11447 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 11448 ecne->tsn = htonl(high_tsn); 11449 ecne->num_pkts_since_cwr = htonl(1); 11450 TAILQ_INSERT_HEAD(&stcb->asoc.control_send_queue, chk, sctp_next); 11451 asoc->ctrl_queue_cnt++; 11452 } 11453 11454 void 11455 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 11456 struct mbuf *m, int len, int iphlen, int bad_crc) 11457 { 11458 struct sctp_association *asoc; 11459 struct sctp_pktdrop_chunk *drp; 11460 struct sctp_tmit_chunk *chk; 11461 uint8_t *datap; 11462 int was_trunc = 0; 11463 int fullsz = 0; 11464 long spc; 11465 int offset; 11466 struct sctp_chunkhdr *ch, chunk_buf; 11467 unsigned int chk_length; 11468 11469 if (!stcb) { 11470 return; 11471 } 11472 asoc = &stcb->asoc; 11473 SCTP_TCB_LOCK_ASSERT(stcb); 11474 if (asoc->pktdrop_supported == 0) { 11475 /*- 11476 * peer must declare support before I send one. 11477 */ 11478 return; 11479 } 11480 if (stcb->sctp_socket == NULL) { 11481 return; 11482 } 11483 sctp_alloc_a_chunk(stcb, chk); 11484 if (chk == NULL) { 11485 return; 11486 } 11487 chk->copy_by_ref = 0; 11488 chk->rec.chunk_id.id = SCTP_PACKET_DROPPED; 11489 chk->rec.chunk_id.can_take_data = 1; 11490 chk->flags = 0; 11491 len -= iphlen; 11492 chk->send_size = len; 11493 /* Validate that we do not have an ABORT in here. */ 11494 offset = iphlen + sizeof(struct sctphdr); 11495 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11496 sizeof(*ch), (uint8_t *)&chunk_buf); 11497 while (ch != NULL) { 11498 chk_length = ntohs(ch->chunk_length); 11499 if (chk_length < sizeof(*ch)) { 11500 /* break to abort land */ 11501 break; 11502 } 11503 switch (ch->chunk_type) { 11504 case SCTP_PACKET_DROPPED: 11505 case SCTP_ABORT_ASSOCIATION: 11506 case SCTP_INITIATION_ACK: 11507 /** 11508 * We don't respond with an PKT-DROP to an ABORT 11509 * or PKT-DROP. We also do not respond to an 11510 * INIT-ACK, because we can't know if the initiation 11511 * tag is correct or not. 11512 */ 11513 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11514 return; 11515 default: 11516 break; 11517 } 11518 offset += SCTP_SIZE32(chk_length); 11519 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11520 sizeof(*ch), (uint8_t *)&chunk_buf); 11521 } 11522 11523 if ((len + SCTP_MAX_OVERHEAD + sizeof(struct sctp_pktdrop_chunk)) > 11524 min(stcb->asoc.smallest_mtu, MCLBYTES)) { 11525 /* 11526 * only send 1 mtu worth, trim off the excess on the end. 11527 */ 11528 fullsz = len; 11529 len = min(stcb->asoc.smallest_mtu, MCLBYTES) - SCTP_MAX_OVERHEAD; 11530 was_trunc = 1; 11531 } 11532 chk->asoc = &stcb->asoc; 11533 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11534 if (chk->data == NULL) { 11535 jump_out: 11536 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11537 return; 11538 } 11539 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11540 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 11541 if (drp == NULL) { 11542 sctp_m_freem(chk->data); 11543 chk->data = NULL; 11544 goto jump_out; 11545 } 11546 chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 11547 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD)); 11548 chk->book_size_scale = 0; 11549 if (was_trunc) { 11550 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 11551 drp->trunc_len = htons(fullsz); 11552 /* 11553 * Len is already adjusted to size minus overhead above take 11554 * out the pkt_drop chunk itself from it. 11555 */ 11556 chk->send_size = (uint16_t)(len - sizeof(struct sctp_pktdrop_chunk)); 11557 len = chk->send_size; 11558 } else { 11559 /* no truncation needed */ 11560 drp->ch.chunk_flags = 0; 11561 drp->trunc_len = htons(0); 11562 } 11563 if (bad_crc) { 11564 drp->ch.chunk_flags |= SCTP_BADCRC; 11565 } 11566 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 11567 SCTP_BUF_LEN(chk->data) = chk->send_size; 11568 chk->sent = SCTP_DATAGRAM_UNSENT; 11569 chk->snd_count = 0; 11570 if (net) { 11571 /* we should hit here */ 11572 chk->whoTo = net; 11573 atomic_add_int(&chk->whoTo->ref_count, 1); 11574 } else { 11575 chk->whoTo = NULL; 11576 } 11577 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 11578 drp->ch.chunk_length = htons(chk->send_size); 11579 spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket); 11580 if (spc < 0) { 11581 spc = 0; 11582 } 11583 drp->bottle_bw = htonl(spc); 11584 if (asoc->my_rwnd) { 11585 drp->current_onq = htonl(asoc->size_on_reasm_queue + 11586 asoc->size_on_all_streams + 11587 asoc->my_rwnd_control_len + 11588 SCTP_SBAVAIL(&stcb->sctp_socket->so_rcv)); 11589 } else { 11590 /*- 11591 * If my rwnd is 0, possibly from mbuf depletion as well as 11592 * space used, tell the peer there is NO space aka onq == bw 11593 */ 11594 drp->current_onq = htonl(spc); 11595 } 11596 drp->reserved = 0; 11597 datap = drp->data; 11598 m_copydata(m, iphlen, len, (caddr_t)datap); 11599 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11600 asoc->ctrl_queue_cnt++; 11601 } 11602 11603 void 11604 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn, uint8_t override) 11605 { 11606 struct sctp_association *asoc; 11607 struct sctp_cwr_chunk *cwr; 11608 struct sctp_tmit_chunk *chk; 11609 11610 SCTP_TCB_LOCK_ASSERT(stcb); 11611 if (net == NULL) { 11612 return; 11613 } 11614 asoc = &stcb->asoc; 11615 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11616 if ((chk->rec.chunk_id.id == SCTP_ECN_CWR) && (net == chk->whoTo)) { 11617 /* 11618 * found a previous CWR queued to same destination 11619 * update it if needed 11620 */ 11621 uint32_t ctsn; 11622 11623 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11624 ctsn = ntohl(cwr->tsn); 11625 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11626 cwr->tsn = htonl(high_tsn); 11627 } 11628 if (override & SCTP_CWR_REDUCE_OVERRIDE) { 11629 /* Make sure override is carried */ 11630 cwr->ch.chunk_flags |= SCTP_CWR_REDUCE_OVERRIDE; 11631 } 11632 return; 11633 } 11634 } 11635 sctp_alloc_a_chunk(stcb, chk); 11636 if (chk == NULL) { 11637 return; 11638 } 11639 chk->copy_by_ref = 0; 11640 chk->rec.chunk_id.id = SCTP_ECN_CWR; 11641 chk->rec.chunk_id.can_take_data = 1; 11642 chk->flags = 0; 11643 chk->asoc = asoc; 11644 chk->send_size = sizeof(struct sctp_cwr_chunk); 11645 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11646 if (chk->data == NULL) { 11647 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11648 return; 11649 } 11650 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11651 SCTP_BUF_LEN(chk->data) = chk->send_size; 11652 chk->sent = SCTP_DATAGRAM_UNSENT; 11653 chk->snd_count = 0; 11654 chk->whoTo = net; 11655 atomic_add_int(&chk->whoTo->ref_count, 1); 11656 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11657 cwr->ch.chunk_type = SCTP_ECN_CWR; 11658 cwr->ch.chunk_flags = override; 11659 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 11660 cwr->tsn = htonl(high_tsn); 11661 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 11662 asoc->ctrl_queue_cnt++; 11663 } 11664 11665 static int 11666 sctp_add_stream_reset_out(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk, 11667 uint32_t seq, uint32_t resp_seq, uint32_t last_sent) 11668 { 11669 uint16_t len, old_len, i; 11670 struct sctp_stream_reset_out_request *req_out; 11671 struct sctp_chunkhdr *ch; 11672 int at; 11673 int number_entries = 0; 11674 11675 ch = mtod(chk->data, struct sctp_chunkhdr *); 11676 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11677 /* get to new offset for the param. */ 11678 req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len); 11679 /* now how long will this param be? */ 11680 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11681 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11682 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11683 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11684 number_entries++; 11685 } 11686 } 11687 if (number_entries == 0) { 11688 return (0); 11689 } 11690 if (number_entries == stcb->asoc.streamoutcnt) { 11691 number_entries = 0; 11692 } 11693 if (number_entries > SCTP_MAX_STREAMS_AT_ONCE_RESET) { 11694 number_entries = SCTP_MAX_STREAMS_AT_ONCE_RESET; 11695 } 11696 len = (uint16_t)(sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries)); 11697 req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST); 11698 req_out->ph.param_length = htons(len); 11699 req_out->request_seq = htonl(seq); 11700 req_out->response_seq = htonl(resp_seq); 11701 req_out->send_reset_at_tsn = htonl(last_sent); 11702 at = 0; 11703 if (number_entries) { 11704 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11705 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11706 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11707 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11708 req_out->list_of_streams[at] = htons(i); 11709 at++; 11710 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11711 if (at >= number_entries) { 11712 break; 11713 } 11714 } 11715 } 11716 } else { 11717 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11718 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11719 } 11720 } 11721 if (SCTP_SIZE32(len) > len) { 11722 /*- 11723 * Need to worry about the pad we may end up adding to the 11724 * end. This is easy since the struct is either aligned to 4 11725 * bytes or 2 bytes off. 11726 */ 11727 req_out->list_of_streams[number_entries] = 0; 11728 } 11729 /* now fix the chunk length */ 11730 ch->chunk_length = htons(len + old_len); 11731 chk->book_size = len + old_len; 11732 chk->book_size_scale = 0; 11733 chk->send_size = SCTP_SIZE32(chk->book_size); 11734 SCTP_BUF_LEN(chk->data) = chk->send_size; 11735 return (1); 11736 } 11737 11738 static void 11739 sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk, 11740 int number_entries, uint16_t *list, 11741 uint32_t seq) 11742 { 11743 uint16_t len, old_len, i; 11744 struct sctp_stream_reset_in_request *req_in; 11745 struct sctp_chunkhdr *ch; 11746 11747 ch = mtod(chk->data, struct sctp_chunkhdr *); 11748 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11749 11750 /* get to new offset for the param. */ 11751 req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len); 11752 /* now how long will this param be? */ 11753 len = (uint16_t)(sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries)); 11754 req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST); 11755 req_in->ph.param_length = htons(len); 11756 req_in->request_seq = htonl(seq); 11757 if (number_entries) { 11758 for (i = 0; i < number_entries; i++) { 11759 req_in->list_of_streams[i] = htons(list[i]); 11760 } 11761 } 11762 if (SCTP_SIZE32(len) > len) { 11763 /*- 11764 * Need to worry about the pad we may end up adding to the 11765 * end. This is easy since the struct is either aligned to 4 11766 * bytes or 2 bytes off. 11767 */ 11768 req_in->list_of_streams[number_entries] = 0; 11769 } 11770 /* now fix the chunk length */ 11771 ch->chunk_length = htons(len + old_len); 11772 chk->book_size = len + old_len; 11773 chk->book_size_scale = 0; 11774 chk->send_size = SCTP_SIZE32(chk->book_size); 11775 SCTP_BUF_LEN(chk->data) = chk->send_size; 11776 return; 11777 } 11778 11779 static void 11780 sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk, 11781 uint32_t seq) 11782 { 11783 uint16_t len, old_len; 11784 struct sctp_stream_reset_tsn_request *req_tsn; 11785 struct sctp_chunkhdr *ch; 11786 11787 ch = mtod(chk->data, struct sctp_chunkhdr *); 11788 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11789 11790 /* get to new offset for the param. */ 11791 req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len); 11792 /* now how long will this param be? */ 11793 len = sizeof(struct sctp_stream_reset_tsn_request); 11794 req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST); 11795 req_tsn->ph.param_length = htons(len); 11796 req_tsn->request_seq = htonl(seq); 11797 11798 /* now fix the chunk length */ 11799 ch->chunk_length = htons(len + old_len); 11800 chk->send_size = len + old_len; 11801 chk->book_size = SCTP_SIZE32(chk->send_size); 11802 chk->book_size_scale = 0; 11803 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11804 return; 11805 } 11806 11807 void 11808 sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk, 11809 uint32_t resp_seq, uint32_t result) 11810 { 11811 uint16_t len, old_len; 11812 struct sctp_stream_reset_response *resp; 11813 struct sctp_chunkhdr *ch; 11814 11815 ch = mtod(chk->data, struct sctp_chunkhdr *); 11816 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11817 11818 /* get to new offset for the param. */ 11819 resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len); 11820 /* now how long will this param be? */ 11821 len = sizeof(struct sctp_stream_reset_response); 11822 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11823 resp->ph.param_length = htons(len); 11824 resp->response_seq = htonl(resp_seq); 11825 resp->result = ntohl(result); 11826 11827 /* now fix the chunk length */ 11828 ch->chunk_length = htons(len + old_len); 11829 chk->book_size = len + old_len; 11830 chk->book_size_scale = 0; 11831 chk->send_size = SCTP_SIZE32(chk->book_size); 11832 SCTP_BUF_LEN(chk->data) = chk->send_size; 11833 return; 11834 } 11835 11836 void 11837 sctp_send_deferred_reset_response(struct sctp_tcb *stcb, 11838 struct sctp_stream_reset_list *ent, 11839 int response) 11840 { 11841 struct sctp_association *asoc; 11842 struct sctp_tmit_chunk *chk; 11843 struct sctp_chunkhdr *ch; 11844 11845 asoc = &stcb->asoc; 11846 11847 /* 11848 * Reset our last reset action to the new one IP -> response 11849 * (PERFORMED probably). This assures that if we fail to send, a 11850 * retran from the peer will get the new response. 11851 */ 11852 asoc->last_reset_action[0] = response; 11853 if (asoc->stream_reset_outstanding) { 11854 return; 11855 } 11856 sctp_alloc_a_chunk(stcb, chk); 11857 if (chk == NULL) { 11858 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11859 return; 11860 } 11861 chk->copy_by_ref = 0; 11862 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 11863 chk->rec.chunk_id.can_take_data = 0; 11864 chk->flags = 0; 11865 chk->asoc = &stcb->asoc; 11866 chk->book_size = sizeof(struct sctp_chunkhdr); 11867 chk->send_size = SCTP_SIZE32(chk->book_size); 11868 chk->book_size_scale = 0; 11869 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11870 if (chk->data == NULL) { 11871 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 11872 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11873 return; 11874 } 11875 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11876 /* setup chunk parameters */ 11877 chk->sent = SCTP_DATAGRAM_UNSENT; 11878 chk->snd_count = 0; 11879 if (stcb->asoc.alternate) { 11880 chk->whoTo = stcb->asoc.alternate; 11881 } else { 11882 chk->whoTo = stcb->asoc.primary_destination; 11883 } 11884 ch = mtod(chk->data, struct sctp_chunkhdr *); 11885 ch->chunk_type = SCTP_STREAM_RESET; 11886 ch->chunk_flags = 0; 11887 ch->chunk_length = htons(chk->book_size); 11888 atomic_add_int(&chk->whoTo->ref_count, 1); 11889 SCTP_BUF_LEN(chk->data) = chk->send_size; 11890 sctp_add_stream_reset_result(chk, ent->seq, response); 11891 /* insert the chunk for sending */ 11892 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 11893 chk, 11894 sctp_next); 11895 asoc->ctrl_queue_cnt++; 11896 } 11897 11898 void 11899 sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk, 11900 uint32_t resp_seq, uint32_t result, 11901 uint32_t send_una, uint32_t recv_next) 11902 { 11903 uint16_t len, old_len; 11904 struct sctp_stream_reset_response_tsn *resp; 11905 struct sctp_chunkhdr *ch; 11906 11907 ch = mtod(chk->data, struct sctp_chunkhdr *); 11908 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11909 11910 /* get to new offset for the param. */ 11911 resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len); 11912 /* now how long will this param be? */ 11913 len = sizeof(struct sctp_stream_reset_response_tsn); 11914 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11915 resp->ph.param_length = htons(len); 11916 resp->response_seq = htonl(resp_seq); 11917 resp->result = htonl(result); 11918 resp->senders_next_tsn = htonl(send_una); 11919 resp->receivers_next_tsn = htonl(recv_next); 11920 11921 /* now fix the chunk length */ 11922 ch->chunk_length = htons(len + old_len); 11923 chk->book_size = len + old_len; 11924 chk->send_size = SCTP_SIZE32(chk->book_size); 11925 chk->book_size_scale = 0; 11926 SCTP_BUF_LEN(chk->data) = chk->send_size; 11927 return; 11928 } 11929 11930 static void 11931 sctp_add_an_out_stream(struct sctp_tmit_chunk *chk, 11932 uint32_t seq, 11933 uint16_t adding) 11934 { 11935 uint16_t len, old_len; 11936 struct sctp_chunkhdr *ch; 11937 struct sctp_stream_reset_add_strm *addstr; 11938 11939 ch = mtod(chk->data, struct sctp_chunkhdr *); 11940 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11941 11942 /* get to new offset for the param. */ 11943 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11944 /* now how long will this param be? */ 11945 len = sizeof(struct sctp_stream_reset_add_strm); 11946 11947 /* Fill it out. */ 11948 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_OUT_STREAMS); 11949 addstr->ph.param_length = htons(len); 11950 addstr->request_seq = htonl(seq); 11951 addstr->number_of_streams = htons(adding); 11952 addstr->reserved = 0; 11953 11954 /* now fix the chunk length */ 11955 ch->chunk_length = htons(len + old_len); 11956 chk->send_size = len + old_len; 11957 chk->book_size = SCTP_SIZE32(chk->send_size); 11958 chk->book_size_scale = 0; 11959 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11960 return; 11961 } 11962 11963 static void 11964 sctp_add_an_in_stream(struct sctp_tmit_chunk *chk, 11965 uint32_t seq, 11966 uint16_t adding) 11967 { 11968 uint16_t len, old_len; 11969 struct sctp_chunkhdr *ch; 11970 struct sctp_stream_reset_add_strm *addstr; 11971 11972 ch = mtod(chk->data, struct sctp_chunkhdr *); 11973 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11974 11975 /* get to new offset for the param. */ 11976 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11977 /* now how long will this param be? */ 11978 len = sizeof(struct sctp_stream_reset_add_strm); 11979 /* Fill it out. */ 11980 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_IN_STREAMS); 11981 addstr->ph.param_length = htons(len); 11982 addstr->request_seq = htonl(seq); 11983 addstr->number_of_streams = htons(adding); 11984 addstr->reserved = 0; 11985 11986 /* now fix the chunk length */ 11987 ch->chunk_length = htons(len + old_len); 11988 chk->send_size = len + old_len; 11989 chk->book_size = SCTP_SIZE32(chk->send_size); 11990 chk->book_size_scale = 0; 11991 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11992 return; 11993 } 11994 11995 int 11996 sctp_send_stream_reset_out_if_possible(struct sctp_tcb *stcb, int so_locked) 11997 { 11998 struct sctp_association *asoc; 11999 struct sctp_tmit_chunk *chk; 12000 struct sctp_chunkhdr *ch; 12001 uint32_t seq; 12002 12003 asoc = &stcb->asoc; 12004 asoc->trigger_reset = 0; 12005 if (asoc->stream_reset_outstanding) { 12006 return (EALREADY); 12007 } 12008 sctp_alloc_a_chunk(stcb, chk); 12009 if (chk == NULL) { 12010 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12011 return (ENOMEM); 12012 } 12013 chk->copy_by_ref = 0; 12014 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12015 chk->rec.chunk_id.can_take_data = 0; 12016 chk->flags = 0; 12017 chk->asoc = &stcb->asoc; 12018 chk->book_size = sizeof(struct sctp_chunkhdr); 12019 chk->send_size = SCTP_SIZE32(chk->book_size); 12020 chk->book_size_scale = 0; 12021 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12022 if (chk->data == NULL) { 12023 sctp_free_a_chunk(stcb, chk, so_locked); 12024 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12025 return (ENOMEM); 12026 } 12027 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12028 12029 /* setup chunk parameters */ 12030 chk->sent = SCTP_DATAGRAM_UNSENT; 12031 chk->snd_count = 0; 12032 if (stcb->asoc.alternate) { 12033 chk->whoTo = stcb->asoc.alternate; 12034 } else { 12035 chk->whoTo = stcb->asoc.primary_destination; 12036 } 12037 ch = mtod(chk->data, struct sctp_chunkhdr *); 12038 ch->chunk_type = SCTP_STREAM_RESET; 12039 ch->chunk_flags = 0; 12040 ch->chunk_length = htons(chk->book_size); 12041 atomic_add_int(&chk->whoTo->ref_count, 1); 12042 SCTP_BUF_LEN(chk->data) = chk->send_size; 12043 seq = stcb->asoc.str_reset_seq_out; 12044 if (sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1))) { 12045 seq++; 12046 asoc->stream_reset_outstanding++; 12047 } else { 12048 m_freem(chk->data); 12049 chk->data = NULL; 12050 sctp_free_a_chunk(stcb, chk, so_locked); 12051 return (ENOENT); 12052 } 12053 asoc->str_reset = chk; 12054 /* insert the chunk for sending */ 12055 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12056 chk, 12057 sctp_next); 12058 asoc->ctrl_queue_cnt++; 12059 12060 if (stcb->asoc.send_sack) { 12061 sctp_send_sack(stcb, so_locked); 12062 } 12063 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12064 return (0); 12065 } 12066 12067 int 12068 sctp_send_str_reset_req(struct sctp_tcb *stcb, 12069 uint16_t number_entries, uint16_t *list, 12070 uint8_t send_in_req, 12071 uint8_t send_tsn_req, 12072 uint8_t add_stream, 12073 uint16_t adding_o, 12074 uint16_t adding_i, uint8_t peer_asked) 12075 { 12076 struct sctp_association *asoc; 12077 struct sctp_tmit_chunk *chk; 12078 struct sctp_chunkhdr *ch; 12079 int can_send_out_req = 0; 12080 uint32_t seq; 12081 12082 SCTP_TCB_LOCK_ASSERT(stcb); 12083 12084 asoc = &stcb->asoc; 12085 if (asoc->stream_reset_outstanding) { 12086 /*- 12087 * Already one pending, must get ACK back to clear the flag. 12088 */ 12089 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EBUSY); 12090 return (EBUSY); 12091 } 12092 if ((send_in_req == 0) && (send_tsn_req == 0) && 12093 (add_stream == 0)) { 12094 /* nothing to do */ 12095 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12096 return (EINVAL); 12097 } 12098 if (send_tsn_req && send_in_req) { 12099 /* error, can't do that */ 12100 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12101 return (EINVAL); 12102 } else if (send_in_req) { 12103 can_send_out_req = 1; 12104 } 12105 if (number_entries > (MCLBYTES - 12106 SCTP_MIN_OVERHEAD - 12107 sizeof(struct sctp_chunkhdr) - 12108 sizeof(struct sctp_stream_reset_out_request)) / 12109 sizeof(uint16_t)) { 12110 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12111 return (ENOMEM); 12112 } 12113 sctp_alloc_a_chunk(stcb, chk); 12114 if (chk == NULL) { 12115 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12116 return (ENOMEM); 12117 } 12118 chk->copy_by_ref = 0; 12119 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12120 chk->rec.chunk_id.can_take_data = 0; 12121 chk->flags = 0; 12122 chk->asoc = &stcb->asoc; 12123 chk->book_size = sizeof(struct sctp_chunkhdr); 12124 chk->send_size = SCTP_SIZE32(chk->book_size); 12125 chk->book_size_scale = 0; 12126 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12127 if (chk->data == NULL) { 12128 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 12129 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12130 return (ENOMEM); 12131 } 12132 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12133 12134 /* setup chunk parameters */ 12135 chk->sent = SCTP_DATAGRAM_UNSENT; 12136 chk->snd_count = 0; 12137 if (stcb->asoc.alternate) { 12138 chk->whoTo = stcb->asoc.alternate; 12139 } else { 12140 chk->whoTo = stcb->asoc.primary_destination; 12141 } 12142 atomic_add_int(&chk->whoTo->ref_count, 1); 12143 ch = mtod(chk->data, struct sctp_chunkhdr *); 12144 ch->chunk_type = SCTP_STREAM_RESET; 12145 ch->chunk_flags = 0; 12146 ch->chunk_length = htons(chk->book_size); 12147 SCTP_BUF_LEN(chk->data) = chk->send_size; 12148 12149 seq = stcb->asoc.str_reset_seq_out; 12150 if (can_send_out_req) { 12151 int ret; 12152 12153 ret = sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1)); 12154 if (ret) { 12155 seq++; 12156 asoc->stream_reset_outstanding++; 12157 } 12158 } 12159 if ((add_stream & 1) && 12160 ((stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt) < adding_o)) { 12161 /* Need to allocate more */ 12162 struct sctp_stream_out *oldstream; 12163 struct sctp_stream_queue_pending *sp, *nsp; 12164 int i; 12165 #if defined(SCTP_DETAILED_STR_STATS) 12166 int j; 12167 #endif 12168 12169 oldstream = stcb->asoc.strmout; 12170 /* get some more */ 12171 SCTP_MALLOC(stcb->asoc.strmout, struct sctp_stream_out *, 12172 (stcb->asoc.streamoutcnt + adding_o) * sizeof(struct sctp_stream_out), 12173 SCTP_M_STRMO); 12174 if (stcb->asoc.strmout == NULL) { 12175 uint8_t x; 12176 12177 stcb->asoc.strmout = oldstream; 12178 /* Turn off the bit */ 12179 x = add_stream & 0xfe; 12180 add_stream = x; 12181 goto skip_stuff; 12182 } 12183 /* 12184 * Ok now we proceed with copying the old out stuff and 12185 * initializing the new stuff. 12186 */ 12187 stcb->asoc.ss_functions.sctp_ss_clear(stcb, &stcb->asoc, false); 12188 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 12189 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12190 /* FIX ME FIX ME */ 12191 /* 12192 * This should be a SS_COPY operation FIX ME STREAM 12193 * SCHEDULER EXPERT 12194 */ 12195 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], &oldstream[i]); 12196 stcb->asoc.strmout[i].chunks_on_queues = oldstream[i].chunks_on_queues; 12197 #if defined(SCTP_DETAILED_STR_STATS) 12198 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 12199 stcb->asoc.strmout[i].abandoned_sent[j] = oldstream[i].abandoned_sent[j]; 12200 stcb->asoc.strmout[i].abandoned_unsent[j] = oldstream[i].abandoned_unsent[j]; 12201 } 12202 #else 12203 stcb->asoc.strmout[i].abandoned_sent[0] = oldstream[i].abandoned_sent[0]; 12204 stcb->asoc.strmout[i].abandoned_unsent[0] = oldstream[i].abandoned_unsent[0]; 12205 #endif 12206 stcb->asoc.strmout[i].next_mid_ordered = oldstream[i].next_mid_ordered; 12207 stcb->asoc.strmout[i].next_mid_unordered = oldstream[i].next_mid_unordered; 12208 stcb->asoc.strmout[i].last_msg_incomplete = oldstream[i].last_msg_incomplete; 12209 stcb->asoc.strmout[i].sid = i; 12210 stcb->asoc.strmout[i].state = oldstream[i].state; 12211 /* now anything on those queues? */ 12212 TAILQ_FOREACH_SAFE(sp, &oldstream[i].outqueue, next, nsp) { 12213 TAILQ_REMOVE(&oldstream[i].outqueue, sp, next); 12214 TAILQ_INSERT_TAIL(&stcb->asoc.strmout[i].outqueue, sp, next); 12215 } 12216 } 12217 /* now the new streams */ 12218 stcb->asoc.ss_functions.sctp_ss_init(stcb, &stcb->asoc); 12219 for (i = stcb->asoc.streamoutcnt; i < (stcb->asoc.streamoutcnt + adding_o); i++) { 12220 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12221 stcb->asoc.strmout[i].chunks_on_queues = 0; 12222 #if defined(SCTP_DETAILED_STR_STATS) 12223 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 12224 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 12225 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 12226 } 12227 #else 12228 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 12229 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 12230 #endif 12231 stcb->asoc.strmout[i].next_mid_ordered = 0; 12232 stcb->asoc.strmout[i].next_mid_unordered = 0; 12233 stcb->asoc.strmout[i].sid = i; 12234 stcb->asoc.strmout[i].last_msg_incomplete = 0; 12235 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 12236 stcb->asoc.strmout[i].state = SCTP_STREAM_CLOSED; 12237 } 12238 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt + adding_o; 12239 SCTP_FREE(oldstream, SCTP_M_STRMO); 12240 } 12241 skip_stuff: 12242 if ((add_stream & 1) && (adding_o > 0)) { 12243 asoc->strm_pending_add_size = adding_o; 12244 asoc->peer_req_out = peer_asked; 12245 sctp_add_an_out_stream(chk, seq, adding_o); 12246 seq++; 12247 asoc->stream_reset_outstanding++; 12248 } 12249 if ((add_stream & 2) && (adding_i > 0)) { 12250 sctp_add_an_in_stream(chk, seq, adding_i); 12251 seq++; 12252 asoc->stream_reset_outstanding++; 12253 } 12254 if (send_in_req) { 12255 sctp_add_stream_reset_in(chk, number_entries, list, seq); 12256 seq++; 12257 asoc->stream_reset_outstanding++; 12258 } 12259 if (send_tsn_req) { 12260 sctp_add_stream_reset_tsn(chk, seq); 12261 asoc->stream_reset_outstanding++; 12262 } 12263 asoc->str_reset = chk; 12264 /* insert the chunk for sending */ 12265 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12266 chk, 12267 sctp_next); 12268 asoc->ctrl_queue_cnt++; 12269 if (stcb->asoc.send_sack) { 12270 sctp_send_sack(stcb, SCTP_SO_LOCKED); 12271 } 12272 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12273 return (0); 12274 } 12275 12276 void 12277 sctp_send_abort(struct mbuf *m, int iphlen, struct sockaddr *src, struct sockaddr *dst, 12278 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12279 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12280 uint32_t vrf_id, uint16_t port) 12281 { 12282 /* Don't respond to an ABORT with an ABORT. */ 12283 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 12284 if (cause) 12285 sctp_m_freem(cause); 12286 return; 12287 } 12288 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_ABORT_ASSOCIATION, cause, 12289 mflowtype, mflowid, fibnum, 12290 vrf_id, port); 12291 return; 12292 } 12293 12294 void 12295 sctp_send_operr_to(struct sockaddr *src, struct sockaddr *dst, 12296 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12297 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12298 uint32_t vrf_id, uint16_t port) 12299 { 12300 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_OPERATION_ERROR, cause, 12301 mflowtype, mflowid, fibnum, 12302 vrf_id, port); 12303 return; 12304 } 12305 12306 static struct mbuf * 12307 sctp_copy_resume(struct uio *uio, 12308 int max_send_len, 12309 int user_marks_eor, 12310 int *error, 12311 uint32_t *sndout, 12312 struct mbuf **new_tail) 12313 { 12314 struct mbuf *m; 12315 12316 m = m_uiotombuf(uio, M_WAITOK, max_send_len, 0, 12317 (M_PKTHDR | (user_marks_eor ? M_EOR : 0))); 12318 if (m == NULL) { 12319 /* The only possible error is EFAULT. */ 12320 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 12321 *error = EFAULT; 12322 } else { 12323 *sndout = m_length(m, NULL); 12324 *new_tail = m_last(m); 12325 } 12326 return (m); 12327 } 12328 12329 static int 12330 sctp_copy_one(struct sctp_stream_queue_pending *sp, 12331 struct uio *uio, 12332 int resv_upfront) 12333 { 12334 sp->data = m_uiotombuf(uio, M_WAITOK, sp->length, resv_upfront, 0); 12335 if (sp->data == NULL) { 12336 /* The only possible error is EFAULT. */ 12337 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 12338 return (EFAULT); 12339 } 12340 sp->tail_mbuf = m_last(sp->data); 12341 return (0); 12342 } 12343 12344 static struct sctp_stream_queue_pending * 12345 sctp_copy_it_in(struct sctp_tcb *stcb, 12346 struct sctp_association *asoc, 12347 struct sctp_nonpad_sndrcvinfo *srcv, 12348 struct uio *uio, 12349 struct sctp_nets *net, 12350 ssize_t max_send_len, 12351 int user_marks_eor, 12352 int *error) 12353 { 12354 12355 /*- 12356 * This routine must be very careful in its work. Protocol 12357 * processing is up and running so care must be taken to spl...() 12358 * when you need to do something that may effect the stcb/asoc. The 12359 * sb is locked however. When data is copied the protocol processing 12360 * should be enabled since this is a slower operation... 12361 */ 12362 struct sctp_stream_queue_pending *sp; 12363 int resv_in_first; 12364 12365 *error = 0; 12366 sctp_alloc_a_strmoq(stcb, sp); 12367 if (sp == NULL) { 12368 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12369 *error = ENOMEM; 12370 goto out_now; 12371 } 12372 sp->act_flags = 0; 12373 sp->sender_all_done = 0; 12374 sp->sinfo_flags = srcv->sinfo_flags; 12375 sp->timetolive = srcv->sinfo_timetolive; 12376 sp->ppid = srcv->sinfo_ppid; 12377 sp->context = srcv->sinfo_context; 12378 sp->fsn = 0; 12379 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 12380 sp->sid = srcv->sinfo_stream; 12381 sp->length = (uint32_t)min(uio->uio_resid, max_send_len); 12382 if ((sp->length == (uint32_t)uio->uio_resid) && 12383 ((user_marks_eor == 0) || 12384 (srcv->sinfo_flags & SCTP_EOF) || 12385 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 12386 sp->msg_is_complete = 1; 12387 } else { 12388 sp->msg_is_complete = 0; 12389 } 12390 sp->sender_all_done = 0; 12391 sp->some_taken = 0; 12392 sp->put_last_out = 0; 12393 resv_in_first = SCTP_DATA_CHUNK_OVERHEAD(stcb); 12394 sp->data = sp->tail_mbuf = NULL; 12395 if (sp->length == 0) { 12396 goto skip_copy; 12397 } 12398 if (srcv->sinfo_keynumber_valid) { 12399 sp->auth_keyid = srcv->sinfo_keynumber; 12400 } else { 12401 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 12402 } 12403 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 12404 sctp_auth_key_acquire(stcb, sp->auth_keyid); 12405 sp->holds_key_ref = 1; 12406 } 12407 *error = sctp_copy_one(sp, uio, resv_in_first); 12408 skip_copy: 12409 if (*error) { 12410 sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); 12411 sp = NULL; 12412 } else { 12413 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 12414 sp->net = net; 12415 atomic_add_int(&sp->net->ref_count, 1); 12416 } else { 12417 sp->net = NULL; 12418 } 12419 sctp_set_prsctp_policy(sp); 12420 } 12421 out_now: 12422 return (sp); 12423 } 12424 12425 int 12426 sctp_sosend(struct socket *so, 12427 struct sockaddr *addr, 12428 struct uio *uio, 12429 struct mbuf *top, 12430 struct mbuf *control, 12431 int flags, 12432 struct thread *p) 12433 { 12434 struct sctp_sndrcvinfo sndrcvninfo; 12435 #if defined(INET) && defined(INET6) 12436 struct sockaddr_in sin; 12437 #endif 12438 struct sockaddr *addr_to_use; 12439 int error; 12440 bool use_sndinfo; 12441 12442 if (control != NULL) { 12443 /* process cmsg snd/rcv info (maybe a assoc-id) */ 12444 use_sndinfo = sctp_find_cmsg(SCTP_SNDRCV, (void *)&sndrcvninfo, control, sizeof(sndrcvninfo)); 12445 } else { 12446 use_sndinfo = false; 12447 } 12448 #if defined(INET) && defined(INET6) 12449 if ((addr != NULL) && (addr->sa_family == AF_INET6)) { 12450 struct sockaddr_in6 *sin6; 12451 12452 if (addr->sa_len != sizeof(struct sockaddr_in6)) { 12453 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12454 return (EINVAL); 12455 } 12456 sin6 = (struct sockaddr_in6 *)addr; 12457 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 12458 in6_sin6_2_sin(&sin, sin6); 12459 addr_to_use = (struct sockaddr *)&sin; 12460 } else { 12461 addr_to_use = addr; 12462 } 12463 } else { 12464 addr_to_use = addr; 12465 } 12466 #else 12467 addr_to_use = addr; 12468 #endif 12469 error = sctp_lower_sosend(so, addr_to_use, uio, top, control, flags, 12470 use_sndinfo ? &sndrcvninfo : NULL, p); 12471 return (error); 12472 } 12473 12474 int 12475 sctp_lower_sosend(struct socket *so, 12476 struct sockaddr *addr, 12477 struct uio *uio, 12478 struct mbuf *top, 12479 struct mbuf *control, 12480 int flags, 12481 struct sctp_sndrcvinfo *srcv, 12482 struct thread *p) 12483 { 12484 struct sctp_nonpad_sndrcvinfo sndrcvninfo_buf; 12485 struct epoch_tracker et; 12486 struct timeval now; 12487 struct sctp_block_entry be; 12488 struct sctp_inpcb *inp; 12489 struct sctp_tcb *stcb = NULL; 12490 struct sctp_nets *net; 12491 struct sctp_association *asoc; 12492 struct sctp_inpcb *t_inp; 12493 struct sctp_nonpad_sndrcvinfo *sndrcvninfo; 12494 ssize_t sndlen = 0, max_len, local_add_more; 12495 ssize_t local_soresv = 0; 12496 sctp_assoc_t sinfo_assoc_id; 12497 int user_marks_eor; 12498 int nagle_applies = 0; 12499 int error; 12500 int queue_only = 0, queue_only_for_init = 0; 12501 int un_sent; 12502 int now_filled = 0; 12503 unsigned int inqueue_bytes = 0; 12504 uint16_t port; 12505 uint16_t sinfo_flags; 12506 uint16_t sinfo_stream; 12507 bool create_lock_applied = false; 12508 bool free_cnt_applied = false; 12509 bool some_on_control; 12510 bool got_all_of_the_send = false; 12511 bool non_blocking = false; 12512 12513 error = 0; 12514 net = NULL; 12515 stcb = NULL; 12516 12517 if ((uio == NULL) && (top == NULL)) { 12518 error = EINVAL; 12519 goto out_unlocked; 12520 } 12521 if (addr != NULL) { 12522 union sctp_sockstore *raddr = (union sctp_sockstore *)addr; 12523 12524 switch (raddr->sa.sa_family) { 12525 #ifdef INET 12526 case AF_INET: 12527 if (raddr->sin.sin_len != sizeof(struct sockaddr_in)) { 12528 error = EINVAL; 12529 goto out_unlocked; 12530 } 12531 port = raddr->sin.sin_port; 12532 break; 12533 #endif 12534 #ifdef INET6 12535 case AF_INET6: 12536 if (raddr->sin6.sin6_len != sizeof(struct sockaddr_in6)) { 12537 error = EINVAL; 12538 goto out_unlocked; 12539 } 12540 port = raddr->sin6.sin6_port; 12541 break; 12542 #endif 12543 default: 12544 error = EAFNOSUPPORT; 12545 goto out_unlocked; 12546 } 12547 } else { 12548 port = 0; 12549 } 12550 if (uio != NULL) { 12551 if (uio->uio_resid < 0) { 12552 error = EINVAL; 12553 goto out_unlocked; 12554 } 12555 sndlen = uio->uio_resid; 12556 } else { 12557 sndlen = SCTP_HEADER_LEN(top); 12558 } 12559 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %zd\n", 12560 (void *)addr, sndlen); 12561 12562 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 12563 if (inp == NULL) { 12564 error = EINVAL; 12565 goto out_unlocked; 12566 } 12567 user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 12568 if ((uio == NULL) && (user_marks_eor != 0)) { 12569 /*- 12570 * We do not support eeor mode for 12571 * sending with mbuf chains (like sendfile). 12572 */ 12573 error = EINVAL; 12574 goto out_unlocked; 12575 } 12576 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 12577 SCTP_IS_LISTENING(inp)) { 12578 /* The listener can NOT send. */ 12579 error = EINVAL; 12580 goto out_unlocked; 12581 } 12582 atomic_add_int(&inp->total_sends, 1); 12583 12584 if (srcv != NULL) { 12585 sndrcvninfo = (struct sctp_nonpad_sndrcvinfo *)srcv; 12586 sinfo_assoc_id = sndrcvninfo->sinfo_assoc_id; 12587 sinfo_flags = sndrcvninfo->sinfo_flags; 12588 if (INVALID_SINFO_FLAG(sinfo_flags) || 12589 PR_SCTP_INVALID_POLICY(sinfo_flags)) { 12590 error = EINVAL; 12591 goto out_unlocked; 12592 } 12593 if (sinfo_flags != 0) { 12594 SCTP_STAT_INCR(sctps_sends_with_flags); 12595 } 12596 } else { 12597 sndrcvninfo = NULL; 12598 sinfo_flags = inp->def_send.sinfo_flags; 12599 sinfo_assoc_id = inp->def_send.sinfo_assoc_id; 12600 } 12601 if (flags & MSG_EOR) { 12602 sinfo_flags |= SCTP_EOR; 12603 } 12604 if (flags & MSG_EOF) { 12605 sinfo_flags |= SCTP_EOF; 12606 } 12607 if ((sinfo_flags & SCTP_ADDR_OVER) && (addr == NULL)) { 12608 error = EINVAL; 12609 goto out_unlocked; 12610 } 12611 SCTP_INP_RLOCK(inp); 12612 if ((sinfo_flags & SCTP_SENDALL) && 12613 (inp->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) { 12614 SCTP_INP_RUNLOCK(inp); 12615 error = sctp_sendall(inp, uio, top, sndrcvninfo); 12616 top = NULL; 12617 goto out_unlocked; 12618 } 12619 /* Now we must find the association. */ 12620 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) || 12621 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 12622 stcb = LIST_FIRST(&inp->sctp_asoc_list); 12623 if (stcb != NULL) { 12624 SCTP_TCB_LOCK(stcb); 12625 } 12626 SCTP_INP_RUNLOCK(inp); 12627 } else if (sinfo_assoc_id > SCTP_ALL_ASSOC) { 12628 stcb = sctp_findasoc_ep_asocid_locked(inp, sinfo_assoc_id, 1); 12629 SCTP_INP_RUNLOCK(inp); 12630 if (stcb != NULL) { 12631 SCTP_TCB_LOCK_ASSERT(stcb); 12632 } 12633 } else if (addr != NULL) { 12634 /*- 12635 * Since we did not use findep we must 12636 * increment it, and if we don't find a tcb 12637 * decrement it. 12638 */ 12639 SCTP_INP_INCR_REF(inp); 12640 SCTP_INP_RUNLOCK(inp); 12641 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12642 if (stcb == NULL) { 12643 SCTP_INP_WLOCK(inp); 12644 SCTP_INP_DECR_REF(inp); 12645 SCTP_INP_WUNLOCK(inp); 12646 } else { 12647 SCTP_TCB_LOCK_ASSERT(stcb); 12648 } 12649 } else { 12650 SCTP_INP_RUNLOCK(inp); 12651 } 12652 12653 #ifdef INVARIANTS 12654 if (stcb != NULL) { 12655 SCTP_TCB_LOCK_ASSERT(stcb); 12656 } 12657 #endif 12658 12659 if ((stcb == NULL) && (addr != NULL)) { 12660 /* Possible implicit send? */ 12661 SCTP_ASOC_CREATE_LOCK(inp); 12662 create_lock_applied = true; 12663 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 12664 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 12665 error = EINVAL; 12666 goto out_unlocked; 12667 } 12668 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 12669 (addr->sa_family == AF_INET6)) { 12670 error = EINVAL; 12671 goto out_unlocked; 12672 } 12673 SCTP_INP_WLOCK(inp); 12674 SCTP_INP_INCR_REF(inp); 12675 SCTP_INP_WUNLOCK(inp); 12676 /* With the lock applied look again */ 12677 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12678 #if defined(INET) || defined(INET6) 12679 if ((stcb == NULL) && (control != NULL) && (port > 0)) { 12680 stcb = sctp_findassociation_cmsgs(&t_inp, port, control, &net, &error); 12681 } 12682 #endif 12683 if (stcb == NULL) { 12684 SCTP_INP_WLOCK(inp); 12685 SCTP_INP_DECR_REF(inp); 12686 SCTP_INP_WUNLOCK(inp); 12687 } else { 12688 SCTP_TCB_LOCK_ASSERT(stcb); 12689 SCTP_ASOC_CREATE_UNLOCK(inp); 12690 create_lock_applied = false; 12691 } 12692 if (error != 0) { 12693 goto out_unlocked; 12694 } 12695 if (t_inp != inp) { 12696 error = ENOTCONN; 12697 goto out_unlocked; 12698 } 12699 } 12700 if (stcb == NULL) { 12701 if (addr == NULL) { 12702 error = ENOENT; 12703 goto out_unlocked; 12704 } else { 12705 /* We must go ahead and start the INIT process */ 12706 uint32_t vrf_id; 12707 12708 if ((sinfo_flags & SCTP_ABORT) || 12709 ((sinfo_flags & SCTP_EOF) && (sndlen == 0))) { 12710 /*- 12711 * User asks to abort a non-existent assoc, 12712 * or EOF a non-existent assoc with no data 12713 */ 12714 error = ENOENT; 12715 goto out_unlocked; 12716 } 12717 /* get an asoc/stcb struct */ 12718 vrf_id = inp->def_vrf_id; 12719 KASSERT(create_lock_applied, ("create_lock_applied is false")); 12720 stcb = sctp_aloc_assoc_connected(inp, addr, &error, 0, 0, vrf_id, 12721 inp->sctp_ep.pre_open_stream_count, 12722 inp->sctp_ep.port, 12723 p, 12724 SCTP_INITIALIZE_AUTH_PARAMS); 12725 if (stcb == NULL) { 12726 /* error is setup for us in the call. */ 12727 KASSERT(error != 0, ("error is 0 although stcb is NULL")); 12728 goto out_unlocked; 12729 } 12730 SCTP_TCB_LOCK_ASSERT(stcb); 12731 SCTP_ASOC_CREATE_UNLOCK(inp); 12732 create_lock_applied = false; 12733 /* 12734 * Turn on queue only flag to prevent data from 12735 * being sent 12736 */ 12737 queue_only = 1; 12738 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 12739 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered); 12740 if (control != NULL) { 12741 if (sctp_process_cmsgs_for_init(stcb, control, &error)) { 12742 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 12743 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_6); 12744 stcb = NULL; 12745 KASSERT(error != 0, 12746 ("error is 0 although sctp_process_cmsgs_for_init() indicated an error")); 12747 goto out_unlocked; 12748 } 12749 } 12750 /* out with the INIT */ 12751 queue_only_for_init = 1; 12752 /*- 12753 * we may want to dig in after this call and adjust the MTU 12754 * value. It defaulted to 1500 (constant) but the ro 12755 * structure may now have an update and thus we may need to 12756 * change it BEFORE we append the message. 12757 */ 12758 } 12759 } 12760 12761 KASSERT(!create_lock_applied, ("create_lock_applied is true")); 12762 KASSERT(stcb != NULL, ("stcb is NULL")); 12763 SCTP_TCB_LOCK_ASSERT(stcb); 12764 12765 asoc = &stcb->asoc; 12766 if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) || 12767 (asoc->state & SCTP_STATE_WAS_ABORTED)) { 12768 if (asoc->state & SCTP_STATE_WAS_ABORTED) { 12769 /* XXX: Could also be ECONNABORTED, not enough info. */ 12770 error = ECONNRESET; 12771 } else { 12772 error = ENOTCONN; 12773 } 12774 goto out_unlocked; 12775 } 12776 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 12777 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 12778 queue_only = 1; 12779 } 12780 /* Keep the stcb from being freed under our feet. */ 12781 atomic_add_int(&asoc->refcnt, 1); 12782 free_cnt_applied = true; 12783 if (sndrcvninfo == NULL) { 12784 /* Use a local copy to have a consistent view. */ 12785 sndrcvninfo_buf = asoc->def_send; 12786 sndrcvninfo = &sndrcvninfo_buf; 12787 sinfo_flags = sndrcvninfo->sinfo_flags; 12788 if (flags & MSG_EOR) { 12789 sinfo_flags |= SCTP_EOR; 12790 } 12791 if (flags & MSG_EOF) { 12792 sinfo_flags |= SCTP_EOF; 12793 } 12794 } 12795 /* Are we aborting? */ 12796 if (sinfo_flags & SCTP_ABORT) { 12797 struct mbuf *mm; 12798 struct sctp_paramhdr *ph; 12799 ssize_t tot_demand, tot_out = 0, max_out; 12800 12801 SCTP_STAT_INCR(sctps_sends_with_abort); 12802 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 12803 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 12804 /* It has to be up before we abort. */ 12805 error = EINVAL; 12806 goto out_unlocked; 12807 } 12808 /* How big is the user initiated abort? */ 12809 if (top != NULL) { 12810 struct mbuf *cntm; 12811 12812 if (sndlen != 0) { 12813 for (cntm = top; cntm; cntm = SCTP_BUF_NEXT(cntm)) { 12814 tot_out += SCTP_BUF_LEN(cntm); 12815 } 12816 } 12817 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_NOWAIT, 1, MT_DATA); 12818 } else { 12819 /* Must fit in a MTU */ 12820 tot_out = sndlen; 12821 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 12822 if (tot_demand > SCTP_DEFAULT_ADD_MORE) { 12823 error = EMSGSIZE; 12824 goto out_unlocked; 12825 } 12826 mm = sctp_get_mbuf_for_msg((unsigned int)tot_demand, 0, M_NOWAIT, 1, MT_DATA); 12827 } 12828 if (mm == NULL) { 12829 error = ENOMEM; 12830 goto out_unlocked; 12831 } 12832 max_out = asoc->smallest_mtu - sizeof(struct sctp_paramhdr); 12833 max_out -= sizeof(struct sctp_abort_msg); 12834 if (tot_out > max_out) { 12835 tot_out = max_out; 12836 } 12837 ph = mtod(mm, struct sctp_paramhdr *); 12838 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 12839 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + tot_out)); 12840 ph++; 12841 SCTP_BUF_LEN(mm) = (int)(tot_out + sizeof(struct sctp_paramhdr)); 12842 if (top == NULL) { 12843 SCTP_TCB_UNLOCK(stcb); 12844 error = uiomove((caddr_t)ph, (int)tot_out, uio); 12845 SCTP_TCB_LOCK(stcb); 12846 if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) || 12847 (asoc->state & SCTP_STATE_WAS_ABORTED)) { 12848 sctp_m_freem(mm); 12849 if (asoc->state & SCTP_STATE_WAS_ABORTED) { 12850 /* 12851 * XXX: Could also be ECONNABORTED, 12852 * not enough info. 12853 */ 12854 error = ECONNRESET; 12855 } else { 12856 error = ENOTCONN; 12857 } 12858 goto out_unlocked; 12859 } 12860 if (error != 0) { 12861 /*- 12862 * Here if we can't get his data we 12863 * still abort we just don't get to 12864 * send the users note :-0 12865 */ 12866 sctp_m_freem(mm); 12867 mm = NULL; 12868 error = 0; 12869 } 12870 } else { 12871 if (sndlen != 0) { 12872 SCTP_BUF_NEXT(mm) = top; 12873 } 12874 } 12875 atomic_subtract_int(&asoc->refcnt, 1); 12876 free_cnt_applied = false; 12877 /* release this lock, otherwise we hang on ourselves */ 12878 NET_EPOCH_ENTER(et); 12879 sctp_abort_an_association(stcb->sctp_ep, stcb, mm, false, SCTP_SO_LOCKED); 12880 NET_EPOCH_EXIT(et); 12881 stcb = NULL; 12882 /* 12883 * In this case top is already chained to mm avoid double 12884 * free, since we free it below if top != NULL and driver 12885 * would free it after sending the packet out 12886 */ 12887 if (sndlen != 0) { 12888 top = NULL; 12889 } 12890 goto out_unlocked; 12891 } 12892 12893 KASSERT(stcb != NULL, ("stcb is NULL")); 12894 SCTP_TCB_LOCK_ASSERT(stcb); 12895 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 12896 ("Association about to be freed")); 12897 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 12898 ("Association was aborted")); 12899 12900 if (sinfo_flags & SCTP_ADDR_OVER) { 12901 if (addr != NULL) { 12902 net = sctp_findnet(stcb, addr); 12903 } else { 12904 net = NULL; 12905 } 12906 if ((net == NULL) || 12907 ((port != 0) && (port != stcb->rport))) { 12908 error = EINVAL; 12909 goto out_unlocked; 12910 } 12911 } else { 12912 if (asoc->alternate != NULL) { 12913 net = asoc->alternate; 12914 } else { 12915 net = asoc->primary_destination; 12916 } 12917 } 12918 if (sndlen == 0) { 12919 if (sinfo_flags & SCTP_EOF) { 12920 got_all_of_the_send = true; 12921 goto dataless_eof; 12922 } else { 12923 error = EINVAL; 12924 goto out_unlocked; 12925 } 12926 } 12927 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NO_FRAGMENT)) { 12928 if (sndlen > (ssize_t)asoc->smallest_mtu) { 12929 error = EMSGSIZE; 12930 goto out_unlocked; 12931 } 12932 } 12933 sinfo_stream = sndrcvninfo->sinfo_stream; 12934 /* Is the stream no. valid? */ 12935 if (sinfo_stream >= asoc->streamoutcnt) { 12936 /* Invalid stream number */ 12937 error = EINVAL; 12938 goto out_unlocked; 12939 } 12940 if ((asoc->strmout[sinfo_stream].state != SCTP_STREAM_OPEN) && 12941 (asoc->strmout[sinfo_stream].state != SCTP_STREAM_OPENING)) { 12942 /* 12943 * Can't queue any data while stream reset is underway. 12944 */ 12945 if (asoc->strmout[sinfo_stream].state > SCTP_STREAM_OPEN) { 12946 error = EAGAIN; 12947 } else { 12948 error = EINVAL; 12949 } 12950 goto out_unlocked; 12951 } 12952 atomic_add_int(&stcb->total_sends, 1); 12953 if (SCTP_SO_IS_NBIO(so) || (flags & (MSG_NBIO | MSG_DONTWAIT)) != 0) { 12954 non_blocking = true; 12955 } 12956 if (non_blocking) { 12957 ssize_t amount; 12958 12959 inqueue_bytes = asoc->total_output_queue_size - (asoc->chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 12960 if (user_marks_eor == 0) { 12961 amount = sndlen; 12962 } else { 12963 amount = 1; 12964 } 12965 if ((SCTP_SB_LIMIT_SND(so) < (amount + inqueue_bytes + asoc->sb_send_resv)) || 12966 (asoc->chunks_on_out_queue >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12967 if ((sndlen > (ssize_t)SCTP_SB_LIMIT_SND(so)) && 12968 (user_marks_eor == 0)) { 12969 error = EMSGSIZE; 12970 } else { 12971 error = EWOULDBLOCK; 12972 } 12973 goto out_unlocked; 12974 } 12975 } 12976 atomic_add_int(&asoc->sb_send_resv, (int)sndlen); 12977 local_soresv = sndlen; 12978 12979 KASSERT(stcb != NULL, ("stcb is NULL")); 12980 SCTP_TCB_LOCK_ASSERT(stcb); 12981 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 12982 ("Association about to be freed")); 12983 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 12984 ("Association was aborted")); 12985 12986 /* Ok, we will attempt a msgsnd :> */ 12987 if (p != NULL) { 12988 p->td_ru.ru_msgsnd++; 12989 } 12990 /* Calculate the maximum we can send */ 12991 inqueue_bytes = asoc->total_output_queue_size - (asoc->chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 12992 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 12993 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 12994 } else { 12995 max_len = 0; 12996 } 12997 /* Unless E_EOR mode is on, we must make a send FIT in one call. */ 12998 if ((user_marks_eor == 0) && 12999 (sndlen > (ssize_t)SCTP_SB_LIMIT_SND(stcb->sctp_socket))) { 13000 /* It will NEVER fit. */ 13001 error = EMSGSIZE; 13002 goto out_unlocked; 13003 } 13004 if (user_marks_eor != 0) { 13005 local_add_more = (ssize_t)min(SCTP_SB_LIMIT_SND(so), SCTP_BASE_SYSCTL(sctp_add_more_threshold)); 13006 } else { 13007 /*- 13008 * For non-eeor the whole message must fit in 13009 * the socket send buffer. 13010 */ 13011 local_add_more = sndlen; 13012 } 13013 if (non_blocking) { 13014 goto skip_preblock; 13015 } 13016 if (((max_len <= local_add_more) && ((ssize_t)SCTP_SB_LIMIT_SND(so) >= local_add_more)) || 13017 (max_len == 0) || 13018 ((asoc->chunks_on_out_queue + asoc->stream_queue_cnt) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13019 /* No room right now! */ 13020 inqueue_bytes = asoc->total_output_queue_size - (asoc->chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13021 SOCKBUF_LOCK(&so->so_snd); 13022 while ((SCTP_SB_LIMIT_SND(so) < (inqueue_bytes + local_add_more)) || 13023 ((asoc->stream_queue_cnt + asoc->chunks_on_out_queue) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13024 SCTPDBG(SCTP_DEBUG_OUTPUT1, "pre_block limit:%u <(inq:%d + %zd) || (%d+%d > %d)\n", 13025 (unsigned int)SCTP_SB_LIMIT_SND(so), 13026 inqueue_bytes, 13027 local_add_more, 13028 asoc->stream_queue_cnt, 13029 asoc->chunks_on_out_queue, 13030 SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)); 13031 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13032 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA, asoc, sndlen); 13033 } 13034 be.error = 0; 13035 stcb->block_entry = &be; 13036 SCTP_TCB_UNLOCK(stcb); 13037 error = sbwait(so, SO_SND); 13038 if (error == 0) { 13039 if (so->so_error != 0) { 13040 error = so->so_error; 13041 } 13042 if (be.error != 0) { 13043 error = be.error; 13044 } 13045 } 13046 SOCKBUF_UNLOCK(&so->so_snd); 13047 SCTP_TCB_LOCK(stcb); 13048 stcb->block_entry = NULL; 13049 if (error != 0) { 13050 goto out_unlocked; 13051 } 13052 if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13053 (asoc->state & SCTP_STATE_WAS_ABORTED)) { 13054 if (asoc->state & SCTP_STATE_WAS_ABORTED) { 13055 /* 13056 * XXX: Could also be ECONNABORTED, 13057 * not enough info. 13058 */ 13059 error = ECONNRESET; 13060 } else { 13061 error = ENOTCONN; 13062 } 13063 goto out_unlocked; 13064 } 13065 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13066 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13067 asoc, asoc->total_output_queue_size); 13068 } 13069 inqueue_bytes = asoc->total_output_queue_size - (asoc->chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13070 SOCKBUF_LOCK(&so->so_snd); 13071 } 13072 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13073 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13074 } else { 13075 max_len = 0; 13076 } 13077 SOCKBUF_UNLOCK(&so->so_snd); 13078 } 13079 13080 skip_preblock: 13081 KASSERT(stcb != NULL, ("stcb is NULL")); 13082 SCTP_TCB_LOCK_ASSERT(stcb); 13083 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 13084 ("Association about to be freed")); 13085 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 13086 ("Association was aborted")); 13087 13088 /* 13089 * sndlen covers for mbuf case uio_resid covers for the non-mbuf 13090 * case NOTE: uio will be null when top/mbuf is passed 13091 */ 13092 if (top == NULL) { 13093 struct sctp_stream_queue_pending *sp; 13094 struct sctp_stream_out *strm; 13095 uint32_t sndout; 13096 13097 if ((asoc->stream_locked) && 13098 (asoc->stream_locked_on != sinfo_stream)) { 13099 error = EINVAL; 13100 goto out; 13101 } 13102 strm = &asoc->strmout[sinfo_stream]; 13103 if (strm->last_msg_incomplete == 0) { 13104 do_a_copy_in: 13105 SCTP_TCB_UNLOCK(stcb); 13106 sp = sctp_copy_it_in(stcb, asoc, sndrcvninfo, uio, net, max_len, user_marks_eor, &error); 13107 SCTP_TCB_LOCK(stcb); 13108 if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13109 (asoc->state & SCTP_STATE_WAS_ABORTED)) { 13110 if (asoc->state & SCTP_STATE_WAS_ABORTED) { 13111 /* 13112 * XXX: Could also be ECONNABORTED, 13113 * not enough info. 13114 */ 13115 error = ECONNRESET; 13116 } else { 13117 error = ENOTCONN; 13118 } 13119 goto out; 13120 } 13121 if (error != 0) { 13122 goto out; 13123 } 13124 /* 13125 * Reject the sending of a new user message, if the 13126 * association is about to be shut down. 13127 */ 13128 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 13129 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 13130 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 13131 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 13132 if (sp->data != 0) { 13133 sctp_m_freem(sp->data); 13134 sp->data = NULL; 13135 sp->tail_mbuf = NULL; 13136 sp->length = 0; 13137 } 13138 if (sp->net != NULL) { 13139 sctp_free_remote_addr(sp->net); 13140 sp->net = NULL; 13141 } 13142 sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); 13143 error = EPIPE; 13144 goto out_unlocked; 13145 } 13146 /* The out streams might be reallocated. */ 13147 strm = &asoc->strmout[sinfo_stream]; 13148 if (sp->msg_is_complete) { 13149 strm->last_msg_incomplete = 0; 13150 asoc->stream_locked = 0; 13151 } else { 13152 /* 13153 * Just got locked to this guy in case of an 13154 * interrupt. 13155 */ 13156 strm->last_msg_incomplete = 1; 13157 if (asoc->idata_supported == 0) { 13158 asoc->stream_locked = 1; 13159 asoc->stream_locked_on = sinfo_stream; 13160 } 13161 sp->sender_all_done = 0; 13162 } 13163 sctp_snd_sb_alloc(stcb, sp->length); 13164 atomic_add_int(&asoc->stream_queue_cnt, 1); 13165 if (sinfo_flags & SCTP_UNORDERED) { 13166 SCTP_STAT_INCR(sctps_sends_with_unord); 13167 } 13168 sp->processing = 1; 13169 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 13170 asoc->ss_functions.sctp_ss_add_to_stream(stcb, asoc, strm, sp); 13171 } else { 13172 sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead); 13173 if (sp == NULL) { 13174 /* ???? Huh ??? last msg is gone */ 13175 #ifdef INVARIANTS 13176 panic("Warning: Last msg marked incomplete, yet nothing left?"); 13177 #else 13178 SCTP_PRINTF("Warning: Last msg marked incomplete, yet nothing left?\n"); 13179 strm->last_msg_incomplete = 0; 13180 #endif 13181 goto do_a_copy_in; 13182 } 13183 if (sp->processing != 0) { 13184 error = EINVAL; 13185 goto out; 13186 } else { 13187 sp->processing = 1; 13188 } 13189 } 13190 13191 KASSERT(stcb != NULL, ("stcb is NULL")); 13192 SCTP_TCB_LOCK_ASSERT(stcb); 13193 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 13194 ("Association about to be freed")); 13195 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 13196 ("Association was aborted")); 13197 13198 while (uio->uio_resid > 0) { 13199 /* How much room do we have? */ 13200 struct mbuf *new_tail, *mm; 13201 13202 inqueue_bytes = asoc->total_output_queue_size - (asoc->chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13203 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13204 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13205 } else { 13206 max_len = 0; 13207 } 13208 if ((max_len > (ssize_t)SCTP_BASE_SYSCTL(sctp_add_more_threshold)) || 13209 ((max_len > 0) && (SCTP_SB_LIMIT_SND(so) < SCTP_BASE_SYSCTL(sctp_add_more_threshold))) || 13210 (uio->uio_resid <= max_len)) { 13211 SCTP_TCB_UNLOCK(stcb); 13212 sndout = 0; 13213 new_tail = NULL; 13214 mm = sctp_copy_resume(uio, (int)max_len, user_marks_eor, &error, &sndout, &new_tail); 13215 SCTP_TCB_LOCK(stcb); 13216 if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13217 (asoc->state & SCTP_STATE_WAS_ABORTED)) { 13218 /* 13219 * We need to get out. Peer probably 13220 * aborted. 13221 */ 13222 sctp_m_freem(mm); 13223 if (asoc->state & SCTP_STATE_WAS_ABORTED) { 13224 /* 13225 * XXX: Could also be 13226 * ECONNABORTED, not enough 13227 * info. 13228 */ 13229 error = ECONNRESET; 13230 } else { 13231 error = ENOTCONN; 13232 } 13233 goto out; 13234 } 13235 if ((mm == NULL) || (error != 0)) { 13236 if (mm != NULL) { 13237 sctp_m_freem(mm); 13238 } 13239 if (sp != NULL) { 13240 sp->processing = 0; 13241 } 13242 goto out; 13243 } 13244 /* Update the mbuf and count */ 13245 if (sp->tail_mbuf != NULL) { 13246 /* Tack it to the end. */ 13247 SCTP_BUF_NEXT(sp->tail_mbuf) = mm; 13248 } else { 13249 /* A stolen mbuf. */ 13250 sp->data = mm; 13251 } 13252 sp->tail_mbuf = new_tail; 13253 sctp_snd_sb_alloc(stcb, sndout); 13254 atomic_add_int(&sp->length, sndout); 13255 if (sinfo_flags & SCTP_SACK_IMMEDIATELY) { 13256 sp->sinfo_flags |= SCTP_SACK_IMMEDIATELY; 13257 } 13258 13259 /* Did we reach EOR? */ 13260 if ((uio->uio_resid == 0) && 13261 ((user_marks_eor == 0) || 13262 (sinfo_flags & SCTP_EOF) || 13263 (user_marks_eor && (sinfo_flags & SCTP_EOR)))) { 13264 sp->msg_is_complete = 1; 13265 } else { 13266 sp->msg_is_complete = 0; 13267 } 13268 } 13269 13270 KASSERT(stcb != NULL, ("stcb is NULL")); 13271 SCTP_TCB_LOCK_ASSERT(stcb); 13272 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 13273 ("Association about to be freed")); 13274 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 13275 ("Association was aborted")); 13276 13277 if (uio->uio_resid == 0) { 13278 /* got it all? */ 13279 continue; 13280 } 13281 /* PR-SCTP? */ 13282 if ((asoc->prsctp_supported) && (asoc->sent_queue_cnt_removeable > 0)) { 13283 /* 13284 * This is ugly but we must assure locking 13285 * order 13286 */ 13287 sctp_prune_prsctp(stcb, asoc, sndrcvninfo, (int)sndlen); 13288 inqueue_bytes = asoc->total_output_queue_size - (asoc->chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13289 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) 13290 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13291 else 13292 max_len = 0; 13293 if (max_len > 0) { 13294 continue; 13295 } 13296 } 13297 /* wait for space now */ 13298 if (non_blocking) { 13299 /* Non-blocking io in place out */ 13300 if (sp != NULL) { 13301 sp->processing = 0; 13302 } 13303 goto skip_out_eof; 13304 } 13305 /* What about the INIT, send it maybe */ 13306 if (queue_only_for_init) { 13307 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13308 /* a collision took us forward? */ 13309 queue_only = 0; 13310 } else { 13311 NET_EPOCH_ENTER(et); 13312 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13313 NET_EPOCH_EXIT(et); 13314 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 13315 queue_only = 1; 13316 } 13317 } 13318 if ((net->flight_size > net->cwnd) && 13319 (asoc->sctp_cmt_on_off == 0)) { 13320 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13321 queue_only = 1; 13322 } else if (asoc->ifp_had_enobuf) { 13323 SCTP_STAT_INCR(sctps_ifnomemqueued); 13324 if (net->flight_size > (2 * net->mtu)) { 13325 queue_only = 1; 13326 } 13327 asoc->ifp_had_enobuf = 0; 13328 } 13329 un_sent = asoc->total_output_queue_size - asoc->total_flight; 13330 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13331 (asoc->total_flight > 0) && 13332 (asoc->stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13333 (un_sent < (int)(asoc->smallest_mtu - SCTP_MIN_OVERHEAD))) { 13334 /*- 13335 * Ok, Nagle is set on and we have data outstanding. 13336 * Don't send anything and let SACKs drive out the 13337 * data unless we have a "full" segment to send. 13338 */ 13339 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13340 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13341 } 13342 SCTP_STAT_INCR(sctps_naglequeued); 13343 nagle_applies = 1; 13344 } else { 13345 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13346 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13347 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13348 } 13349 SCTP_STAT_INCR(sctps_naglesent); 13350 nagle_applies = 0; 13351 } 13352 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13353 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13354 nagle_applies, un_sent); 13355 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, asoc->total_output_queue_size, 13356 asoc->total_flight, 13357 asoc->chunks_on_out_queue, asoc->total_flight_count); 13358 } 13359 if (queue_only_for_init) { 13360 queue_only_for_init = 0; 13361 } 13362 if ((queue_only == 0) && (nagle_applies == 0)) { 13363 /*- 13364 * need to start chunk output 13365 * before blocking.. note that if 13366 * a lock is already applied, then 13367 * the input via the net is happening 13368 * and I don't need to start output :-D 13369 */ 13370 NET_EPOCH_ENTER(et); 13371 sctp_chunk_output(inp, stcb, 13372 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13373 NET_EPOCH_EXIT(et); 13374 } 13375 /*- 13376 * This is a bit strange, but I think it will 13377 * work. The total_output_queue_size is locked and 13378 * protected by the TCB_LOCK, which we just released. 13379 * There is a race that can occur between releasing it 13380 * above, and me getting the socket lock, where sacks 13381 * come in but we have not put the SB_WAIT on the 13382 * so_snd buffer to get the wakeup. After the LOCK 13383 * is applied the sack_processing will also need to 13384 * LOCK the so->so_snd to do the actual sowwakeup(). So 13385 * once we have the socket buffer lock if we recheck the 13386 * size we KNOW we will get to sleep safely with the 13387 * wakeup flag in place. 13388 */ 13389 inqueue_bytes = asoc->total_output_queue_size - (asoc->chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13390 SOCKBUF_LOCK(&so->so_snd); 13391 if (SCTP_SB_LIMIT_SND(so) <= (inqueue_bytes + 13392 min(SCTP_BASE_SYSCTL(sctp_add_more_threshold), SCTP_SB_LIMIT_SND(so)))) { 13393 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13394 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 13395 asoc, uio->uio_resid); 13396 } 13397 be.error = 0; 13398 stcb->block_entry = &be; 13399 SCTP_TCB_UNLOCK(stcb); 13400 error = sbwait(so, SO_SND); 13401 if (error == 0) { 13402 if (so->so_error != 0) 13403 error = so->so_error; 13404 if (be.error != 0) { 13405 error = be.error; 13406 } 13407 } 13408 SOCKBUF_UNLOCK(&so->so_snd); 13409 SCTP_TCB_LOCK(stcb); 13410 stcb->block_entry = NULL; 13411 if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13412 (asoc->state & SCTP_STATE_WAS_ABORTED)) { 13413 if (asoc->state & SCTP_STATE_WAS_ABORTED) { 13414 /* 13415 * XXX: Could also be 13416 * ECONNABORTED, not enough 13417 * info. 13418 */ 13419 error = ECONNRESET; 13420 } else { 13421 error = ENOTCONN; 13422 } 13423 goto out_unlocked; 13424 } 13425 if (error != 0) { 13426 if (sp != NULL) { 13427 sp->processing = 0; 13428 } 13429 goto out_unlocked; 13430 } 13431 } else { 13432 SOCKBUF_UNLOCK(&so->so_snd); 13433 } 13434 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13435 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13436 asoc, asoc->total_output_queue_size); 13437 } 13438 } 13439 13440 KASSERT(stcb != NULL, ("stcb is NULL")); 13441 SCTP_TCB_LOCK_ASSERT(stcb); 13442 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 13443 ("Association about to be freed")); 13444 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 13445 ("Association was aborted")); 13446 13447 /* The out streams might be reallocated. */ 13448 strm = &asoc->strmout[sinfo_stream]; 13449 if (sp != NULL) { 13450 if (sp->msg_is_complete == 0) { 13451 strm->last_msg_incomplete = 1; 13452 if (asoc->idata_supported == 0) { 13453 asoc->stream_locked = 1; 13454 asoc->stream_locked_on = sinfo_stream; 13455 } 13456 } else { 13457 sp->sender_all_done = 1; 13458 strm->last_msg_incomplete = 0; 13459 asoc->stream_locked = 0; 13460 } 13461 sp->processing = 0; 13462 } else { 13463 SCTP_PRINTF("Huh no sp TSNH?\n"); 13464 strm->last_msg_incomplete = 0; 13465 asoc->stream_locked = 0; 13466 } 13467 if (uio->uio_resid == 0) { 13468 got_all_of_the_send = true; 13469 } 13470 } else { 13471 error = sctp_msg_append(stcb, net, top, sndrcvninfo); 13472 top = NULL; 13473 if ((sinfo_flags & SCTP_EOF) != 0) { 13474 got_all_of_the_send = true; 13475 } 13476 } 13477 if (error != 0) { 13478 goto out; 13479 } 13480 13481 dataless_eof: 13482 KASSERT(stcb != NULL, ("stcb is NULL")); 13483 SCTP_TCB_LOCK_ASSERT(stcb); 13484 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 13485 ("Association about to be freed")); 13486 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 13487 ("Association was aborted")); 13488 13489 /* EOF thing ? */ 13490 if ((sinfo_flags & SCTP_EOF) && got_all_of_the_send) { 13491 SCTP_STAT_INCR(sctps_sends_with_eof); 13492 error = 0; 13493 if (TAILQ_EMPTY(&asoc->send_queue) && 13494 TAILQ_EMPTY(&asoc->sent_queue) && 13495 sctp_is_there_unsent_data(stcb, SCTP_SO_LOCKED) == 0) { 13496 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13497 goto abort_anyway; 13498 } 13499 /* there is nothing queued to send, so I'm done... */ 13500 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 13501 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13502 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13503 struct sctp_nets *netp; 13504 13505 /* only send SHUTDOWN the first time through */ 13506 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13507 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 13508 } 13509 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT); 13510 sctp_stop_timers_for_shutdown(stcb); 13511 if (asoc->alternate != NULL) { 13512 netp = asoc->alternate; 13513 } else { 13514 netp = asoc->primary_destination; 13515 } 13516 sctp_send_shutdown(stcb, netp); 13517 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 13518 netp); 13519 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13520 NULL); 13521 } 13522 } else { 13523 /*- 13524 * we still got (or just got) data to send, so set 13525 * SHUTDOWN_PENDING 13526 */ 13527 /*- 13528 * XXX sockets draft says that SCTP_EOF should be 13529 * sent with no data. currently, we will allow user 13530 * data to be sent first and move to 13531 * SHUTDOWN-PENDING 13532 */ 13533 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 13534 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13535 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13536 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13537 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT); 13538 } 13539 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 13540 if (TAILQ_EMPTY(&asoc->send_queue) && 13541 TAILQ_EMPTY(&asoc->sent_queue) && 13542 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 13543 struct mbuf *op_err; 13544 char msg[SCTP_DIAG_INFO_LEN]; 13545 13546 abort_anyway: 13547 if (free_cnt_applied) { 13548 atomic_subtract_int(&asoc->refcnt, 1); 13549 free_cnt_applied = false; 13550 } 13551 SCTP_SNPRINTF(msg, sizeof(msg), 13552 "%s:%d at %s", __FILE__, __LINE__, __func__); 13553 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 13554 msg); 13555 NET_EPOCH_ENTER(et); 13556 sctp_abort_an_association(stcb->sctp_ep, stcb, 13557 op_err, false, SCTP_SO_LOCKED); 13558 NET_EPOCH_EXIT(et); 13559 stcb = NULL; 13560 error = ECONNABORTED; 13561 goto out; 13562 } 13563 sctp_feature_off(inp, SCTP_PCB_FLAGS_NODELAY); 13564 } 13565 } 13566 } 13567 13568 skip_out_eof: 13569 KASSERT(stcb != NULL, ("stcb is NULL")); 13570 SCTP_TCB_LOCK_ASSERT(stcb); 13571 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 13572 ("Association about to be freed")); 13573 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 13574 ("Association was aborted")); 13575 13576 some_on_control = !TAILQ_EMPTY(&asoc->control_send_queue); 13577 if (queue_only_for_init) { 13578 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13579 /* a collision took us forward? */ 13580 queue_only = 0; 13581 } else { 13582 NET_EPOCH_ENTER(et); 13583 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13584 NET_EPOCH_EXIT(et); 13585 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 13586 queue_only = 1; 13587 } 13588 } 13589 13590 KASSERT(stcb != NULL, ("stcb is NULL")); 13591 SCTP_TCB_LOCK_ASSERT(stcb); 13592 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 13593 ("Association about to be freed")); 13594 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 13595 ("Association was aborted")); 13596 13597 if ((net->flight_size > net->cwnd) && 13598 (asoc->sctp_cmt_on_off == 0)) { 13599 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13600 queue_only = 1; 13601 } else if (asoc->ifp_had_enobuf) { 13602 SCTP_STAT_INCR(sctps_ifnomemqueued); 13603 if (net->flight_size > (2 * net->mtu)) { 13604 queue_only = 1; 13605 } 13606 asoc->ifp_had_enobuf = 0; 13607 } 13608 un_sent = asoc->total_output_queue_size - asoc->total_flight; 13609 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13610 (asoc->total_flight > 0) && 13611 (asoc->stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13612 (un_sent < (int)(asoc->smallest_mtu - SCTP_MIN_OVERHEAD))) { 13613 /*- 13614 * Ok, Nagle is set on and we have data outstanding. 13615 * Don't send anything and let SACKs drive out the 13616 * data unless wen have a "full" segment to send. 13617 */ 13618 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13619 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13620 } 13621 SCTP_STAT_INCR(sctps_naglequeued); 13622 nagle_applies = 1; 13623 } else { 13624 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13625 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13626 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13627 } 13628 SCTP_STAT_INCR(sctps_naglesent); 13629 nagle_applies = 0; 13630 } 13631 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13632 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13633 nagle_applies, un_sent); 13634 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, asoc->total_output_queue_size, 13635 asoc->total_flight, 13636 asoc->chunks_on_out_queue, asoc->total_flight_count); 13637 } 13638 13639 KASSERT(stcb != NULL, ("stcb is NULL")); 13640 SCTP_TCB_LOCK_ASSERT(stcb); 13641 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 13642 ("Association about to be freed")); 13643 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 13644 ("Association was aborted")); 13645 13646 NET_EPOCH_ENTER(et); 13647 if ((queue_only == 0) && (nagle_applies == 0) && (asoc->peers_rwnd && un_sent)) { 13648 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13649 } else if ((queue_only == 0) && 13650 (asoc->peers_rwnd == 0) && 13651 (asoc->total_flight == 0)) { 13652 /* We get to have a probe outstanding */ 13653 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13654 } else if (some_on_control) { 13655 int num_out, reason; 13656 13657 /* Here we do control only */ 13658 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, 13659 &reason, 1, 1, &now, &now_filled, 13660 sctp_get_frag_point(stcb), 13661 SCTP_SO_LOCKED); 13662 } 13663 NET_EPOCH_EXIT(et); 13664 SCTPDBG(SCTP_DEBUG_OUTPUT1, "USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d err:%d\n", 13665 queue_only, asoc->peers_rwnd, un_sent, 13666 asoc->total_flight, asoc->chunks_on_out_queue, 13667 asoc->total_output_queue_size, error); 13668 13669 KASSERT(stcb != NULL, ("stcb is NULL")); 13670 SCTP_TCB_LOCK_ASSERT(stcb); 13671 KASSERT((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0, 13672 ("Association about to be freed")); 13673 KASSERT((asoc->state & SCTP_STATE_WAS_ABORTED) == 0, 13674 ("Association was aborted")); 13675 13676 out: 13677 out_unlocked: 13678 if (create_lock_applied) { 13679 SCTP_ASOC_CREATE_UNLOCK(inp); 13680 } 13681 if (stcb != NULL) { 13682 if (local_soresv) { 13683 atomic_subtract_int(&asoc->sb_send_resv, (int)sndlen); 13684 } 13685 if (free_cnt_applied) { 13686 atomic_subtract_int(&asoc->refcnt, 1); 13687 } 13688 SCTP_TCB_UNLOCK(stcb); 13689 } 13690 if (top != NULL) { 13691 sctp_m_freem(top); 13692 } 13693 if (control != NULL) { 13694 sctp_m_freem(control); 13695 } 13696 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, error); 13697 return (error); 13698 } 13699 13700 /* 13701 * generate an AUTHentication chunk, if required 13702 */ 13703 struct mbuf * 13704 sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end, 13705 struct sctp_auth_chunk **auth_ret, uint32_t *offset, 13706 struct sctp_tcb *stcb, uint8_t chunk) 13707 { 13708 struct mbuf *m_auth; 13709 struct sctp_auth_chunk *auth; 13710 int chunk_len; 13711 struct mbuf *cn; 13712 13713 if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) || 13714 (stcb == NULL)) 13715 return (m); 13716 13717 if (stcb->asoc.auth_supported == 0) { 13718 return (m); 13719 } 13720 /* does the requested chunk require auth? */ 13721 if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) { 13722 return (m); 13723 } 13724 m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_NOWAIT, 1, MT_HEADER); 13725 if (m_auth == NULL) { 13726 /* no mbuf's */ 13727 return (m); 13728 } 13729 /* reserve some space if this will be the first mbuf */ 13730 if (m == NULL) 13731 SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD); 13732 /* fill in the AUTH chunk details */ 13733 auth = mtod(m_auth, struct sctp_auth_chunk *); 13734 memset(auth, 0, sizeof(*auth)); 13735 auth->ch.chunk_type = SCTP_AUTHENTICATION; 13736 auth->ch.chunk_flags = 0; 13737 chunk_len = sizeof(*auth) + 13738 sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id); 13739 auth->ch.chunk_length = htons(chunk_len); 13740 auth->hmac_id = htons(stcb->asoc.peer_hmac_id); 13741 /* key id and hmac digest will be computed and filled in upon send */ 13742 13743 /* save the offset where the auth was inserted into the chain */ 13744 *offset = 0; 13745 for (cn = m; cn; cn = SCTP_BUF_NEXT(cn)) { 13746 *offset += SCTP_BUF_LEN(cn); 13747 } 13748 13749 /* update length and return pointer to the auth chunk */ 13750 SCTP_BUF_LEN(m_auth) = chunk_len; 13751 m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0); 13752 if (auth_ret != NULL) 13753 *auth_ret = auth; 13754 13755 return (m); 13756 } 13757 13758 #ifdef INET6 13759 int 13760 sctp_v6src_match_nexthop(struct sockaddr_in6 *src6, sctp_route_t *ro) 13761 { 13762 struct nd_prefix *pfx = NULL; 13763 struct nd_pfxrouter *pfxrtr = NULL; 13764 struct sockaddr_in6 gw6; 13765 13766 if (ro == NULL || ro->ro_nh == NULL || src6->sin6_family != AF_INET6) 13767 return (0); 13768 13769 /* get prefix entry of address */ 13770 ND6_RLOCK(); 13771 LIST_FOREACH(pfx, &MODULE_GLOBAL(nd_prefix), ndpr_entry) { 13772 if (pfx->ndpr_stateflags & NDPRF_DETACHED) 13773 continue; 13774 if (IN6_ARE_MASKED_ADDR_EQUAL(&pfx->ndpr_prefix.sin6_addr, 13775 &src6->sin6_addr, &pfx->ndpr_mask)) 13776 break; 13777 } 13778 /* no prefix entry in the prefix list */ 13779 if (pfx == NULL) { 13780 ND6_RUNLOCK(); 13781 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefix entry for "); 13782 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13783 return (0); 13784 } 13785 13786 SCTPDBG(SCTP_DEBUG_OUTPUT2, "v6src_match_nexthop(), Prefix entry is "); 13787 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13788 13789 /* search installed gateway from prefix entry */ 13790 LIST_FOREACH(pfxrtr, &pfx->ndpr_advrtrs, pfr_entry) { 13791 memset(&gw6, 0, sizeof(struct sockaddr_in6)); 13792 gw6.sin6_family = AF_INET6; 13793 gw6.sin6_len = sizeof(struct sockaddr_in6); 13794 memcpy(&gw6.sin6_addr, &pfxrtr->router->rtaddr, 13795 sizeof(struct in6_addr)); 13796 SCTPDBG(SCTP_DEBUG_OUTPUT2, "prefix router is "); 13797 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&gw6); 13798 SCTPDBG(SCTP_DEBUG_OUTPUT2, "installed router is "); 13799 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ro->ro_nh->gw_sa); 13800 if (sctp_cmpaddr((struct sockaddr *)&gw6, &ro->ro_nh->gw_sa)) { 13801 ND6_RUNLOCK(); 13802 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is installed\n"); 13803 return (1); 13804 } 13805 } 13806 ND6_RUNLOCK(); 13807 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is not installed\n"); 13808 return (0); 13809 } 13810 #endif 13811 13812 int 13813 sctp_v4src_match_nexthop(struct sctp_ifa *sifa, sctp_route_t *ro) 13814 { 13815 #ifdef INET 13816 struct sockaddr_in *sin, *mask; 13817 struct ifaddr *ifa; 13818 struct in_addr srcnetaddr, gwnetaddr; 13819 13820 if (ro == NULL || ro->ro_nh == NULL || 13821 sifa->address.sa.sa_family != AF_INET) { 13822 return (0); 13823 } 13824 ifa = (struct ifaddr *)sifa->ifa; 13825 mask = (struct sockaddr_in *)(ifa->ifa_netmask); 13826 sin = &sifa->address.sin; 13827 srcnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13828 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: src address is "); 13829 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 13830 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", srcnetaddr.s_addr); 13831 13832 sin = &ro->ro_nh->gw4_sa; 13833 gwnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13834 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: nexthop is "); 13835 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ro->ro_nh->gw_sa); 13836 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", gwnetaddr.s_addr); 13837 if (srcnetaddr.s_addr == gwnetaddr.s_addr) { 13838 return (1); 13839 } 13840 #endif 13841 return (0); 13842 } 13843