1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 5 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 6 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions are met: 10 * 11 * a) Redistributions of source code must retain the above copyright notice, 12 * this list of conditions and the following disclaimer. 13 * 14 * b) Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the distribution. 17 * 18 * c) Neither the name of Cisco Systems, Inc. nor the names of its 19 * contributors may be used to endorse or promote products derived 20 * from this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 26 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 32 * THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include <sys/cdefs.h> 36 __FBSDID("$FreeBSD$"); 37 38 #include <netinet/sctp_os.h> 39 #include <sys/proc.h> 40 #include <netinet/sctp_var.h> 41 #include <netinet/sctp_sysctl.h> 42 #include <netinet/sctp_header.h> 43 #include <netinet/sctp_pcb.h> 44 #include <netinet/sctputil.h> 45 #include <netinet/sctp_output.h> 46 #include <netinet/sctp_uio.h> 47 #include <netinet/sctputil.h> 48 #include <netinet/sctp_auth.h> 49 #include <netinet/sctp_timer.h> 50 #include <netinet/sctp_asconf.h> 51 #include <netinet/sctp_indata.h> 52 #include <netinet/sctp_bsd_addr.h> 53 #include <netinet/sctp_input.h> 54 #include <netinet/sctp_crc32.h> 55 #include <netinet/sctp_kdtrace.h> 56 #if defined(INET) || defined(INET6) 57 #include <netinet/udp.h> 58 #endif 59 #include <netinet/udp_var.h> 60 #include <machine/in_cksum.h> 61 62 #define SCTP_MAX_GAPS_INARRAY 4 63 struct sack_track { 64 uint8_t right_edge; /* mergable on the right edge */ 65 uint8_t left_edge; /* mergable on the left edge */ 66 uint8_t num_entries; 67 uint8_t spare; 68 struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY]; 69 }; 70 71 const struct sack_track sack_array[256] = { 72 {0, 0, 0, 0, /* 0x00 */ 73 {{0, 0}, 74 {0, 0}, 75 {0, 0}, 76 {0, 0} 77 } 78 }, 79 {1, 0, 1, 0, /* 0x01 */ 80 {{0, 0}, 81 {0, 0}, 82 {0, 0}, 83 {0, 0} 84 } 85 }, 86 {0, 0, 1, 0, /* 0x02 */ 87 {{1, 1}, 88 {0, 0}, 89 {0, 0}, 90 {0, 0} 91 } 92 }, 93 {1, 0, 1, 0, /* 0x03 */ 94 {{0, 1}, 95 {0, 0}, 96 {0, 0}, 97 {0, 0} 98 } 99 }, 100 {0, 0, 1, 0, /* 0x04 */ 101 {{2, 2}, 102 {0, 0}, 103 {0, 0}, 104 {0, 0} 105 } 106 }, 107 {1, 0, 2, 0, /* 0x05 */ 108 {{0, 0}, 109 {2, 2}, 110 {0, 0}, 111 {0, 0} 112 } 113 }, 114 {0, 0, 1, 0, /* 0x06 */ 115 {{1, 2}, 116 {0, 0}, 117 {0, 0}, 118 {0, 0} 119 } 120 }, 121 {1, 0, 1, 0, /* 0x07 */ 122 {{0, 2}, 123 {0, 0}, 124 {0, 0}, 125 {0, 0} 126 } 127 }, 128 {0, 0, 1, 0, /* 0x08 */ 129 {{3, 3}, 130 {0, 0}, 131 {0, 0}, 132 {0, 0} 133 } 134 }, 135 {1, 0, 2, 0, /* 0x09 */ 136 {{0, 0}, 137 {3, 3}, 138 {0, 0}, 139 {0, 0} 140 } 141 }, 142 {0, 0, 2, 0, /* 0x0a */ 143 {{1, 1}, 144 {3, 3}, 145 {0, 0}, 146 {0, 0} 147 } 148 }, 149 {1, 0, 2, 0, /* 0x0b */ 150 {{0, 1}, 151 {3, 3}, 152 {0, 0}, 153 {0, 0} 154 } 155 }, 156 {0, 0, 1, 0, /* 0x0c */ 157 {{2, 3}, 158 {0, 0}, 159 {0, 0}, 160 {0, 0} 161 } 162 }, 163 {1, 0, 2, 0, /* 0x0d */ 164 {{0, 0}, 165 {2, 3}, 166 {0, 0}, 167 {0, 0} 168 } 169 }, 170 {0, 0, 1, 0, /* 0x0e */ 171 {{1, 3}, 172 {0, 0}, 173 {0, 0}, 174 {0, 0} 175 } 176 }, 177 {1, 0, 1, 0, /* 0x0f */ 178 {{0, 3}, 179 {0, 0}, 180 {0, 0}, 181 {0, 0} 182 } 183 }, 184 {0, 0, 1, 0, /* 0x10 */ 185 {{4, 4}, 186 {0, 0}, 187 {0, 0}, 188 {0, 0} 189 } 190 }, 191 {1, 0, 2, 0, /* 0x11 */ 192 {{0, 0}, 193 {4, 4}, 194 {0, 0}, 195 {0, 0} 196 } 197 }, 198 {0, 0, 2, 0, /* 0x12 */ 199 {{1, 1}, 200 {4, 4}, 201 {0, 0}, 202 {0, 0} 203 } 204 }, 205 {1, 0, 2, 0, /* 0x13 */ 206 {{0, 1}, 207 {4, 4}, 208 {0, 0}, 209 {0, 0} 210 } 211 }, 212 {0, 0, 2, 0, /* 0x14 */ 213 {{2, 2}, 214 {4, 4}, 215 {0, 0}, 216 {0, 0} 217 } 218 }, 219 {1, 0, 3, 0, /* 0x15 */ 220 {{0, 0}, 221 {2, 2}, 222 {4, 4}, 223 {0, 0} 224 } 225 }, 226 {0, 0, 2, 0, /* 0x16 */ 227 {{1, 2}, 228 {4, 4}, 229 {0, 0}, 230 {0, 0} 231 } 232 }, 233 {1, 0, 2, 0, /* 0x17 */ 234 {{0, 2}, 235 {4, 4}, 236 {0, 0}, 237 {0, 0} 238 } 239 }, 240 {0, 0, 1, 0, /* 0x18 */ 241 {{3, 4}, 242 {0, 0}, 243 {0, 0}, 244 {0, 0} 245 } 246 }, 247 {1, 0, 2, 0, /* 0x19 */ 248 {{0, 0}, 249 {3, 4}, 250 {0, 0}, 251 {0, 0} 252 } 253 }, 254 {0, 0, 2, 0, /* 0x1a */ 255 {{1, 1}, 256 {3, 4}, 257 {0, 0}, 258 {0, 0} 259 } 260 }, 261 {1, 0, 2, 0, /* 0x1b */ 262 {{0, 1}, 263 {3, 4}, 264 {0, 0}, 265 {0, 0} 266 } 267 }, 268 {0, 0, 1, 0, /* 0x1c */ 269 {{2, 4}, 270 {0, 0}, 271 {0, 0}, 272 {0, 0} 273 } 274 }, 275 {1, 0, 2, 0, /* 0x1d */ 276 {{0, 0}, 277 {2, 4}, 278 {0, 0}, 279 {0, 0} 280 } 281 }, 282 {0, 0, 1, 0, /* 0x1e */ 283 {{1, 4}, 284 {0, 0}, 285 {0, 0}, 286 {0, 0} 287 } 288 }, 289 {1, 0, 1, 0, /* 0x1f */ 290 {{0, 4}, 291 {0, 0}, 292 {0, 0}, 293 {0, 0} 294 } 295 }, 296 {0, 0, 1, 0, /* 0x20 */ 297 {{5, 5}, 298 {0, 0}, 299 {0, 0}, 300 {0, 0} 301 } 302 }, 303 {1, 0, 2, 0, /* 0x21 */ 304 {{0, 0}, 305 {5, 5}, 306 {0, 0}, 307 {0, 0} 308 } 309 }, 310 {0, 0, 2, 0, /* 0x22 */ 311 {{1, 1}, 312 {5, 5}, 313 {0, 0}, 314 {0, 0} 315 } 316 }, 317 {1, 0, 2, 0, /* 0x23 */ 318 {{0, 1}, 319 {5, 5}, 320 {0, 0}, 321 {0, 0} 322 } 323 }, 324 {0, 0, 2, 0, /* 0x24 */ 325 {{2, 2}, 326 {5, 5}, 327 {0, 0}, 328 {0, 0} 329 } 330 }, 331 {1, 0, 3, 0, /* 0x25 */ 332 {{0, 0}, 333 {2, 2}, 334 {5, 5}, 335 {0, 0} 336 } 337 }, 338 {0, 0, 2, 0, /* 0x26 */ 339 {{1, 2}, 340 {5, 5}, 341 {0, 0}, 342 {0, 0} 343 } 344 }, 345 {1, 0, 2, 0, /* 0x27 */ 346 {{0, 2}, 347 {5, 5}, 348 {0, 0}, 349 {0, 0} 350 } 351 }, 352 {0, 0, 2, 0, /* 0x28 */ 353 {{3, 3}, 354 {5, 5}, 355 {0, 0}, 356 {0, 0} 357 } 358 }, 359 {1, 0, 3, 0, /* 0x29 */ 360 {{0, 0}, 361 {3, 3}, 362 {5, 5}, 363 {0, 0} 364 } 365 }, 366 {0, 0, 3, 0, /* 0x2a */ 367 {{1, 1}, 368 {3, 3}, 369 {5, 5}, 370 {0, 0} 371 } 372 }, 373 {1, 0, 3, 0, /* 0x2b */ 374 {{0, 1}, 375 {3, 3}, 376 {5, 5}, 377 {0, 0} 378 } 379 }, 380 {0, 0, 2, 0, /* 0x2c */ 381 {{2, 3}, 382 {5, 5}, 383 {0, 0}, 384 {0, 0} 385 } 386 }, 387 {1, 0, 3, 0, /* 0x2d */ 388 {{0, 0}, 389 {2, 3}, 390 {5, 5}, 391 {0, 0} 392 } 393 }, 394 {0, 0, 2, 0, /* 0x2e */ 395 {{1, 3}, 396 {5, 5}, 397 {0, 0}, 398 {0, 0} 399 } 400 }, 401 {1, 0, 2, 0, /* 0x2f */ 402 {{0, 3}, 403 {5, 5}, 404 {0, 0}, 405 {0, 0} 406 } 407 }, 408 {0, 0, 1, 0, /* 0x30 */ 409 {{4, 5}, 410 {0, 0}, 411 {0, 0}, 412 {0, 0} 413 } 414 }, 415 {1, 0, 2, 0, /* 0x31 */ 416 {{0, 0}, 417 {4, 5}, 418 {0, 0}, 419 {0, 0} 420 } 421 }, 422 {0, 0, 2, 0, /* 0x32 */ 423 {{1, 1}, 424 {4, 5}, 425 {0, 0}, 426 {0, 0} 427 } 428 }, 429 {1, 0, 2, 0, /* 0x33 */ 430 {{0, 1}, 431 {4, 5}, 432 {0, 0}, 433 {0, 0} 434 } 435 }, 436 {0, 0, 2, 0, /* 0x34 */ 437 {{2, 2}, 438 {4, 5}, 439 {0, 0}, 440 {0, 0} 441 } 442 }, 443 {1, 0, 3, 0, /* 0x35 */ 444 {{0, 0}, 445 {2, 2}, 446 {4, 5}, 447 {0, 0} 448 } 449 }, 450 {0, 0, 2, 0, /* 0x36 */ 451 {{1, 2}, 452 {4, 5}, 453 {0, 0}, 454 {0, 0} 455 } 456 }, 457 {1, 0, 2, 0, /* 0x37 */ 458 {{0, 2}, 459 {4, 5}, 460 {0, 0}, 461 {0, 0} 462 } 463 }, 464 {0, 0, 1, 0, /* 0x38 */ 465 {{3, 5}, 466 {0, 0}, 467 {0, 0}, 468 {0, 0} 469 } 470 }, 471 {1, 0, 2, 0, /* 0x39 */ 472 {{0, 0}, 473 {3, 5}, 474 {0, 0}, 475 {0, 0} 476 } 477 }, 478 {0, 0, 2, 0, /* 0x3a */ 479 {{1, 1}, 480 {3, 5}, 481 {0, 0}, 482 {0, 0} 483 } 484 }, 485 {1, 0, 2, 0, /* 0x3b */ 486 {{0, 1}, 487 {3, 5}, 488 {0, 0}, 489 {0, 0} 490 } 491 }, 492 {0, 0, 1, 0, /* 0x3c */ 493 {{2, 5}, 494 {0, 0}, 495 {0, 0}, 496 {0, 0} 497 } 498 }, 499 {1, 0, 2, 0, /* 0x3d */ 500 {{0, 0}, 501 {2, 5}, 502 {0, 0}, 503 {0, 0} 504 } 505 }, 506 {0, 0, 1, 0, /* 0x3e */ 507 {{1, 5}, 508 {0, 0}, 509 {0, 0}, 510 {0, 0} 511 } 512 }, 513 {1, 0, 1, 0, /* 0x3f */ 514 {{0, 5}, 515 {0, 0}, 516 {0, 0}, 517 {0, 0} 518 } 519 }, 520 {0, 0, 1, 0, /* 0x40 */ 521 {{6, 6}, 522 {0, 0}, 523 {0, 0}, 524 {0, 0} 525 } 526 }, 527 {1, 0, 2, 0, /* 0x41 */ 528 {{0, 0}, 529 {6, 6}, 530 {0, 0}, 531 {0, 0} 532 } 533 }, 534 {0, 0, 2, 0, /* 0x42 */ 535 {{1, 1}, 536 {6, 6}, 537 {0, 0}, 538 {0, 0} 539 } 540 }, 541 {1, 0, 2, 0, /* 0x43 */ 542 {{0, 1}, 543 {6, 6}, 544 {0, 0}, 545 {0, 0} 546 } 547 }, 548 {0, 0, 2, 0, /* 0x44 */ 549 {{2, 2}, 550 {6, 6}, 551 {0, 0}, 552 {0, 0} 553 } 554 }, 555 {1, 0, 3, 0, /* 0x45 */ 556 {{0, 0}, 557 {2, 2}, 558 {6, 6}, 559 {0, 0} 560 } 561 }, 562 {0, 0, 2, 0, /* 0x46 */ 563 {{1, 2}, 564 {6, 6}, 565 {0, 0}, 566 {0, 0} 567 } 568 }, 569 {1, 0, 2, 0, /* 0x47 */ 570 {{0, 2}, 571 {6, 6}, 572 {0, 0}, 573 {0, 0} 574 } 575 }, 576 {0, 0, 2, 0, /* 0x48 */ 577 {{3, 3}, 578 {6, 6}, 579 {0, 0}, 580 {0, 0} 581 } 582 }, 583 {1, 0, 3, 0, /* 0x49 */ 584 {{0, 0}, 585 {3, 3}, 586 {6, 6}, 587 {0, 0} 588 } 589 }, 590 {0, 0, 3, 0, /* 0x4a */ 591 {{1, 1}, 592 {3, 3}, 593 {6, 6}, 594 {0, 0} 595 } 596 }, 597 {1, 0, 3, 0, /* 0x4b */ 598 {{0, 1}, 599 {3, 3}, 600 {6, 6}, 601 {0, 0} 602 } 603 }, 604 {0, 0, 2, 0, /* 0x4c */ 605 {{2, 3}, 606 {6, 6}, 607 {0, 0}, 608 {0, 0} 609 } 610 }, 611 {1, 0, 3, 0, /* 0x4d */ 612 {{0, 0}, 613 {2, 3}, 614 {6, 6}, 615 {0, 0} 616 } 617 }, 618 {0, 0, 2, 0, /* 0x4e */ 619 {{1, 3}, 620 {6, 6}, 621 {0, 0}, 622 {0, 0} 623 } 624 }, 625 {1, 0, 2, 0, /* 0x4f */ 626 {{0, 3}, 627 {6, 6}, 628 {0, 0}, 629 {0, 0} 630 } 631 }, 632 {0, 0, 2, 0, /* 0x50 */ 633 {{4, 4}, 634 {6, 6}, 635 {0, 0}, 636 {0, 0} 637 } 638 }, 639 {1, 0, 3, 0, /* 0x51 */ 640 {{0, 0}, 641 {4, 4}, 642 {6, 6}, 643 {0, 0} 644 } 645 }, 646 {0, 0, 3, 0, /* 0x52 */ 647 {{1, 1}, 648 {4, 4}, 649 {6, 6}, 650 {0, 0} 651 } 652 }, 653 {1, 0, 3, 0, /* 0x53 */ 654 {{0, 1}, 655 {4, 4}, 656 {6, 6}, 657 {0, 0} 658 } 659 }, 660 {0, 0, 3, 0, /* 0x54 */ 661 {{2, 2}, 662 {4, 4}, 663 {6, 6}, 664 {0, 0} 665 } 666 }, 667 {1, 0, 4, 0, /* 0x55 */ 668 {{0, 0}, 669 {2, 2}, 670 {4, 4}, 671 {6, 6} 672 } 673 }, 674 {0, 0, 3, 0, /* 0x56 */ 675 {{1, 2}, 676 {4, 4}, 677 {6, 6}, 678 {0, 0} 679 } 680 }, 681 {1, 0, 3, 0, /* 0x57 */ 682 {{0, 2}, 683 {4, 4}, 684 {6, 6}, 685 {0, 0} 686 } 687 }, 688 {0, 0, 2, 0, /* 0x58 */ 689 {{3, 4}, 690 {6, 6}, 691 {0, 0}, 692 {0, 0} 693 } 694 }, 695 {1, 0, 3, 0, /* 0x59 */ 696 {{0, 0}, 697 {3, 4}, 698 {6, 6}, 699 {0, 0} 700 } 701 }, 702 {0, 0, 3, 0, /* 0x5a */ 703 {{1, 1}, 704 {3, 4}, 705 {6, 6}, 706 {0, 0} 707 } 708 }, 709 {1, 0, 3, 0, /* 0x5b */ 710 {{0, 1}, 711 {3, 4}, 712 {6, 6}, 713 {0, 0} 714 } 715 }, 716 {0, 0, 2, 0, /* 0x5c */ 717 {{2, 4}, 718 {6, 6}, 719 {0, 0}, 720 {0, 0} 721 } 722 }, 723 {1, 0, 3, 0, /* 0x5d */ 724 {{0, 0}, 725 {2, 4}, 726 {6, 6}, 727 {0, 0} 728 } 729 }, 730 {0, 0, 2, 0, /* 0x5e */ 731 {{1, 4}, 732 {6, 6}, 733 {0, 0}, 734 {0, 0} 735 } 736 }, 737 {1, 0, 2, 0, /* 0x5f */ 738 {{0, 4}, 739 {6, 6}, 740 {0, 0}, 741 {0, 0} 742 } 743 }, 744 {0, 0, 1, 0, /* 0x60 */ 745 {{5, 6}, 746 {0, 0}, 747 {0, 0}, 748 {0, 0} 749 } 750 }, 751 {1, 0, 2, 0, /* 0x61 */ 752 {{0, 0}, 753 {5, 6}, 754 {0, 0}, 755 {0, 0} 756 } 757 }, 758 {0, 0, 2, 0, /* 0x62 */ 759 {{1, 1}, 760 {5, 6}, 761 {0, 0}, 762 {0, 0} 763 } 764 }, 765 {1, 0, 2, 0, /* 0x63 */ 766 {{0, 1}, 767 {5, 6}, 768 {0, 0}, 769 {0, 0} 770 } 771 }, 772 {0, 0, 2, 0, /* 0x64 */ 773 {{2, 2}, 774 {5, 6}, 775 {0, 0}, 776 {0, 0} 777 } 778 }, 779 {1, 0, 3, 0, /* 0x65 */ 780 {{0, 0}, 781 {2, 2}, 782 {5, 6}, 783 {0, 0} 784 } 785 }, 786 {0, 0, 2, 0, /* 0x66 */ 787 {{1, 2}, 788 {5, 6}, 789 {0, 0}, 790 {0, 0} 791 } 792 }, 793 {1, 0, 2, 0, /* 0x67 */ 794 {{0, 2}, 795 {5, 6}, 796 {0, 0}, 797 {0, 0} 798 } 799 }, 800 {0, 0, 2, 0, /* 0x68 */ 801 {{3, 3}, 802 {5, 6}, 803 {0, 0}, 804 {0, 0} 805 } 806 }, 807 {1, 0, 3, 0, /* 0x69 */ 808 {{0, 0}, 809 {3, 3}, 810 {5, 6}, 811 {0, 0} 812 } 813 }, 814 {0, 0, 3, 0, /* 0x6a */ 815 {{1, 1}, 816 {3, 3}, 817 {5, 6}, 818 {0, 0} 819 } 820 }, 821 {1, 0, 3, 0, /* 0x6b */ 822 {{0, 1}, 823 {3, 3}, 824 {5, 6}, 825 {0, 0} 826 } 827 }, 828 {0, 0, 2, 0, /* 0x6c */ 829 {{2, 3}, 830 {5, 6}, 831 {0, 0}, 832 {0, 0} 833 } 834 }, 835 {1, 0, 3, 0, /* 0x6d */ 836 {{0, 0}, 837 {2, 3}, 838 {5, 6}, 839 {0, 0} 840 } 841 }, 842 {0, 0, 2, 0, /* 0x6e */ 843 {{1, 3}, 844 {5, 6}, 845 {0, 0}, 846 {0, 0} 847 } 848 }, 849 {1, 0, 2, 0, /* 0x6f */ 850 {{0, 3}, 851 {5, 6}, 852 {0, 0}, 853 {0, 0} 854 } 855 }, 856 {0, 0, 1, 0, /* 0x70 */ 857 {{4, 6}, 858 {0, 0}, 859 {0, 0}, 860 {0, 0} 861 } 862 }, 863 {1, 0, 2, 0, /* 0x71 */ 864 {{0, 0}, 865 {4, 6}, 866 {0, 0}, 867 {0, 0} 868 } 869 }, 870 {0, 0, 2, 0, /* 0x72 */ 871 {{1, 1}, 872 {4, 6}, 873 {0, 0}, 874 {0, 0} 875 } 876 }, 877 {1, 0, 2, 0, /* 0x73 */ 878 {{0, 1}, 879 {4, 6}, 880 {0, 0}, 881 {0, 0} 882 } 883 }, 884 {0, 0, 2, 0, /* 0x74 */ 885 {{2, 2}, 886 {4, 6}, 887 {0, 0}, 888 {0, 0} 889 } 890 }, 891 {1, 0, 3, 0, /* 0x75 */ 892 {{0, 0}, 893 {2, 2}, 894 {4, 6}, 895 {0, 0} 896 } 897 }, 898 {0, 0, 2, 0, /* 0x76 */ 899 {{1, 2}, 900 {4, 6}, 901 {0, 0}, 902 {0, 0} 903 } 904 }, 905 {1, 0, 2, 0, /* 0x77 */ 906 {{0, 2}, 907 {4, 6}, 908 {0, 0}, 909 {0, 0} 910 } 911 }, 912 {0, 0, 1, 0, /* 0x78 */ 913 {{3, 6}, 914 {0, 0}, 915 {0, 0}, 916 {0, 0} 917 } 918 }, 919 {1, 0, 2, 0, /* 0x79 */ 920 {{0, 0}, 921 {3, 6}, 922 {0, 0}, 923 {0, 0} 924 } 925 }, 926 {0, 0, 2, 0, /* 0x7a */ 927 {{1, 1}, 928 {3, 6}, 929 {0, 0}, 930 {0, 0} 931 } 932 }, 933 {1, 0, 2, 0, /* 0x7b */ 934 {{0, 1}, 935 {3, 6}, 936 {0, 0}, 937 {0, 0} 938 } 939 }, 940 {0, 0, 1, 0, /* 0x7c */ 941 {{2, 6}, 942 {0, 0}, 943 {0, 0}, 944 {0, 0} 945 } 946 }, 947 {1, 0, 2, 0, /* 0x7d */ 948 {{0, 0}, 949 {2, 6}, 950 {0, 0}, 951 {0, 0} 952 } 953 }, 954 {0, 0, 1, 0, /* 0x7e */ 955 {{1, 6}, 956 {0, 0}, 957 {0, 0}, 958 {0, 0} 959 } 960 }, 961 {1, 0, 1, 0, /* 0x7f */ 962 {{0, 6}, 963 {0, 0}, 964 {0, 0}, 965 {0, 0} 966 } 967 }, 968 {0, 1, 1, 0, /* 0x80 */ 969 {{7, 7}, 970 {0, 0}, 971 {0, 0}, 972 {0, 0} 973 } 974 }, 975 {1, 1, 2, 0, /* 0x81 */ 976 {{0, 0}, 977 {7, 7}, 978 {0, 0}, 979 {0, 0} 980 } 981 }, 982 {0, 1, 2, 0, /* 0x82 */ 983 {{1, 1}, 984 {7, 7}, 985 {0, 0}, 986 {0, 0} 987 } 988 }, 989 {1, 1, 2, 0, /* 0x83 */ 990 {{0, 1}, 991 {7, 7}, 992 {0, 0}, 993 {0, 0} 994 } 995 }, 996 {0, 1, 2, 0, /* 0x84 */ 997 {{2, 2}, 998 {7, 7}, 999 {0, 0}, 1000 {0, 0} 1001 } 1002 }, 1003 {1, 1, 3, 0, /* 0x85 */ 1004 {{0, 0}, 1005 {2, 2}, 1006 {7, 7}, 1007 {0, 0} 1008 } 1009 }, 1010 {0, 1, 2, 0, /* 0x86 */ 1011 {{1, 2}, 1012 {7, 7}, 1013 {0, 0}, 1014 {0, 0} 1015 } 1016 }, 1017 {1, 1, 2, 0, /* 0x87 */ 1018 {{0, 2}, 1019 {7, 7}, 1020 {0, 0}, 1021 {0, 0} 1022 } 1023 }, 1024 {0, 1, 2, 0, /* 0x88 */ 1025 {{3, 3}, 1026 {7, 7}, 1027 {0, 0}, 1028 {0, 0} 1029 } 1030 }, 1031 {1, 1, 3, 0, /* 0x89 */ 1032 {{0, 0}, 1033 {3, 3}, 1034 {7, 7}, 1035 {0, 0} 1036 } 1037 }, 1038 {0, 1, 3, 0, /* 0x8a */ 1039 {{1, 1}, 1040 {3, 3}, 1041 {7, 7}, 1042 {0, 0} 1043 } 1044 }, 1045 {1, 1, 3, 0, /* 0x8b */ 1046 {{0, 1}, 1047 {3, 3}, 1048 {7, 7}, 1049 {0, 0} 1050 } 1051 }, 1052 {0, 1, 2, 0, /* 0x8c */ 1053 {{2, 3}, 1054 {7, 7}, 1055 {0, 0}, 1056 {0, 0} 1057 } 1058 }, 1059 {1, 1, 3, 0, /* 0x8d */ 1060 {{0, 0}, 1061 {2, 3}, 1062 {7, 7}, 1063 {0, 0} 1064 } 1065 }, 1066 {0, 1, 2, 0, /* 0x8e */ 1067 {{1, 3}, 1068 {7, 7}, 1069 {0, 0}, 1070 {0, 0} 1071 } 1072 }, 1073 {1, 1, 2, 0, /* 0x8f */ 1074 {{0, 3}, 1075 {7, 7}, 1076 {0, 0}, 1077 {0, 0} 1078 } 1079 }, 1080 {0, 1, 2, 0, /* 0x90 */ 1081 {{4, 4}, 1082 {7, 7}, 1083 {0, 0}, 1084 {0, 0} 1085 } 1086 }, 1087 {1, 1, 3, 0, /* 0x91 */ 1088 {{0, 0}, 1089 {4, 4}, 1090 {7, 7}, 1091 {0, 0} 1092 } 1093 }, 1094 {0, 1, 3, 0, /* 0x92 */ 1095 {{1, 1}, 1096 {4, 4}, 1097 {7, 7}, 1098 {0, 0} 1099 } 1100 }, 1101 {1, 1, 3, 0, /* 0x93 */ 1102 {{0, 1}, 1103 {4, 4}, 1104 {7, 7}, 1105 {0, 0} 1106 } 1107 }, 1108 {0, 1, 3, 0, /* 0x94 */ 1109 {{2, 2}, 1110 {4, 4}, 1111 {7, 7}, 1112 {0, 0} 1113 } 1114 }, 1115 {1, 1, 4, 0, /* 0x95 */ 1116 {{0, 0}, 1117 {2, 2}, 1118 {4, 4}, 1119 {7, 7} 1120 } 1121 }, 1122 {0, 1, 3, 0, /* 0x96 */ 1123 {{1, 2}, 1124 {4, 4}, 1125 {7, 7}, 1126 {0, 0} 1127 } 1128 }, 1129 {1, 1, 3, 0, /* 0x97 */ 1130 {{0, 2}, 1131 {4, 4}, 1132 {7, 7}, 1133 {0, 0} 1134 } 1135 }, 1136 {0, 1, 2, 0, /* 0x98 */ 1137 {{3, 4}, 1138 {7, 7}, 1139 {0, 0}, 1140 {0, 0} 1141 } 1142 }, 1143 {1, 1, 3, 0, /* 0x99 */ 1144 {{0, 0}, 1145 {3, 4}, 1146 {7, 7}, 1147 {0, 0} 1148 } 1149 }, 1150 {0, 1, 3, 0, /* 0x9a */ 1151 {{1, 1}, 1152 {3, 4}, 1153 {7, 7}, 1154 {0, 0} 1155 } 1156 }, 1157 {1, 1, 3, 0, /* 0x9b */ 1158 {{0, 1}, 1159 {3, 4}, 1160 {7, 7}, 1161 {0, 0} 1162 } 1163 }, 1164 {0, 1, 2, 0, /* 0x9c */ 1165 {{2, 4}, 1166 {7, 7}, 1167 {0, 0}, 1168 {0, 0} 1169 } 1170 }, 1171 {1, 1, 3, 0, /* 0x9d */ 1172 {{0, 0}, 1173 {2, 4}, 1174 {7, 7}, 1175 {0, 0} 1176 } 1177 }, 1178 {0, 1, 2, 0, /* 0x9e */ 1179 {{1, 4}, 1180 {7, 7}, 1181 {0, 0}, 1182 {0, 0} 1183 } 1184 }, 1185 {1, 1, 2, 0, /* 0x9f */ 1186 {{0, 4}, 1187 {7, 7}, 1188 {0, 0}, 1189 {0, 0} 1190 } 1191 }, 1192 {0, 1, 2, 0, /* 0xa0 */ 1193 {{5, 5}, 1194 {7, 7}, 1195 {0, 0}, 1196 {0, 0} 1197 } 1198 }, 1199 {1, 1, 3, 0, /* 0xa1 */ 1200 {{0, 0}, 1201 {5, 5}, 1202 {7, 7}, 1203 {0, 0} 1204 } 1205 }, 1206 {0, 1, 3, 0, /* 0xa2 */ 1207 {{1, 1}, 1208 {5, 5}, 1209 {7, 7}, 1210 {0, 0} 1211 } 1212 }, 1213 {1, 1, 3, 0, /* 0xa3 */ 1214 {{0, 1}, 1215 {5, 5}, 1216 {7, 7}, 1217 {0, 0} 1218 } 1219 }, 1220 {0, 1, 3, 0, /* 0xa4 */ 1221 {{2, 2}, 1222 {5, 5}, 1223 {7, 7}, 1224 {0, 0} 1225 } 1226 }, 1227 {1, 1, 4, 0, /* 0xa5 */ 1228 {{0, 0}, 1229 {2, 2}, 1230 {5, 5}, 1231 {7, 7} 1232 } 1233 }, 1234 {0, 1, 3, 0, /* 0xa6 */ 1235 {{1, 2}, 1236 {5, 5}, 1237 {7, 7}, 1238 {0, 0} 1239 } 1240 }, 1241 {1, 1, 3, 0, /* 0xa7 */ 1242 {{0, 2}, 1243 {5, 5}, 1244 {7, 7}, 1245 {0, 0} 1246 } 1247 }, 1248 {0, 1, 3, 0, /* 0xa8 */ 1249 {{3, 3}, 1250 {5, 5}, 1251 {7, 7}, 1252 {0, 0} 1253 } 1254 }, 1255 {1, 1, 4, 0, /* 0xa9 */ 1256 {{0, 0}, 1257 {3, 3}, 1258 {5, 5}, 1259 {7, 7} 1260 } 1261 }, 1262 {0, 1, 4, 0, /* 0xaa */ 1263 {{1, 1}, 1264 {3, 3}, 1265 {5, 5}, 1266 {7, 7} 1267 } 1268 }, 1269 {1, 1, 4, 0, /* 0xab */ 1270 {{0, 1}, 1271 {3, 3}, 1272 {5, 5}, 1273 {7, 7} 1274 } 1275 }, 1276 {0, 1, 3, 0, /* 0xac */ 1277 {{2, 3}, 1278 {5, 5}, 1279 {7, 7}, 1280 {0, 0} 1281 } 1282 }, 1283 {1, 1, 4, 0, /* 0xad */ 1284 {{0, 0}, 1285 {2, 3}, 1286 {5, 5}, 1287 {7, 7} 1288 } 1289 }, 1290 {0, 1, 3, 0, /* 0xae */ 1291 {{1, 3}, 1292 {5, 5}, 1293 {7, 7}, 1294 {0, 0} 1295 } 1296 }, 1297 {1, 1, 3, 0, /* 0xaf */ 1298 {{0, 3}, 1299 {5, 5}, 1300 {7, 7}, 1301 {0, 0} 1302 } 1303 }, 1304 {0, 1, 2, 0, /* 0xb0 */ 1305 {{4, 5}, 1306 {7, 7}, 1307 {0, 0}, 1308 {0, 0} 1309 } 1310 }, 1311 {1, 1, 3, 0, /* 0xb1 */ 1312 {{0, 0}, 1313 {4, 5}, 1314 {7, 7}, 1315 {0, 0} 1316 } 1317 }, 1318 {0, 1, 3, 0, /* 0xb2 */ 1319 {{1, 1}, 1320 {4, 5}, 1321 {7, 7}, 1322 {0, 0} 1323 } 1324 }, 1325 {1, 1, 3, 0, /* 0xb3 */ 1326 {{0, 1}, 1327 {4, 5}, 1328 {7, 7}, 1329 {0, 0} 1330 } 1331 }, 1332 {0, 1, 3, 0, /* 0xb4 */ 1333 {{2, 2}, 1334 {4, 5}, 1335 {7, 7}, 1336 {0, 0} 1337 } 1338 }, 1339 {1, 1, 4, 0, /* 0xb5 */ 1340 {{0, 0}, 1341 {2, 2}, 1342 {4, 5}, 1343 {7, 7} 1344 } 1345 }, 1346 {0, 1, 3, 0, /* 0xb6 */ 1347 {{1, 2}, 1348 {4, 5}, 1349 {7, 7}, 1350 {0, 0} 1351 } 1352 }, 1353 {1, 1, 3, 0, /* 0xb7 */ 1354 {{0, 2}, 1355 {4, 5}, 1356 {7, 7}, 1357 {0, 0} 1358 } 1359 }, 1360 {0, 1, 2, 0, /* 0xb8 */ 1361 {{3, 5}, 1362 {7, 7}, 1363 {0, 0}, 1364 {0, 0} 1365 } 1366 }, 1367 {1, 1, 3, 0, /* 0xb9 */ 1368 {{0, 0}, 1369 {3, 5}, 1370 {7, 7}, 1371 {0, 0} 1372 } 1373 }, 1374 {0, 1, 3, 0, /* 0xba */ 1375 {{1, 1}, 1376 {3, 5}, 1377 {7, 7}, 1378 {0, 0} 1379 } 1380 }, 1381 {1, 1, 3, 0, /* 0xbb */ 1382 {{0, 1}, 1383 {3, 5}, 1384 {7, 7}, 1385 {0, 0} 1386 } 1387 }, 1388 {0, 1, 2, 0, /* 0xbc */ 1389 {{2, 5}, 1390 {7, 7}, 1391 {0, 0}, 1392 {0, 0} 1393 } 1394 }, 1395 {1, 1, 3, 0, /* 0xbd */ 1396 {{0, 0}, 1397 {2, 5}, 1398 {7, 7}, 1399 {0, 0} 1400 } 1401 }, 1402 {0, 1, 2, 0, /* 0xbe */ 1403 {{1, 5}, 1404 {7, 7}, 1405 {0, 0}, 1406 {0, 0} 1407 } 1408 }, 1409 {1, 1, 2, 0, /* 0xbf */ 1410 {{0, 5}, 1411 {7, 7}, 1412 {0, 0}, 1413 {0, 0} 1414 } 1415 }, 1416 {0, 1, 1, 0, /* 0xc0 */ 1417 {{6, 7}, 1418 {0, 0}, 1419 {0, 0}, 1420 {0, 0} 1421 } 1422 }, 1423 {1, 1, 2, 0, /* 0xc1 */ 1424 {{0, 0}, 1425 {6, 7}, 1426 {0, 0}, 1427 {0, 0} 1428 } 1429 }, 1430 {0, 1, 2, 0, /* 0xc2 */ 1431 {{1, 1}, 1432 {6, 7}, 1433 {0, 0}, 1434 {0, 0} 1435 } 1436 }, 1437 {1, 1, 2, 0, /* 0xc3 */ 1438 {{0, 1}, 1439 {6, 7}, 1440 {0, 0}, 1441 {0, 0} 1442 } 1443 }, 1444 {0, 1, 2, 0, /* 0xc4 */ 1445 {{2, 2}, 1446 {6, 7}, 1447 {0, 0}, 1448 {0, 0} 1449 } 1450 }, 1451 {1, 1, 3, 0, /* 0xc5 */ 1452 {{0, 0}, 1453 {2, 2}, 1454 {6, 7}, 1455 {0, 0} 1456 } 1457 }, 1458 {0, 1, 2, 0, /* 0xc6 */ 1459 {{1, 2}, 1460 {6, 7}, 1461 {0, 0}, 1462 {0, 0} 1463 } 1464 }, 1465 {1, 1, 2, 0, /* 0xc7 */ 1466 {{0, 2}, 1467 {6, 7}, 1468 {0, 0}, 1469 {0, 0} 1470 } 1471 }, 1472 {0, 1, 2, 0, /* 0xc8 */ 1473 {{3, 3}, 1474 {6, 7}, 1475 {0, 0}, 1476 {0, 0} 1477 } 1478 }, 1479 {1, 1, 3, 0, /* 0xc9 */ 1480 {{0, 0}, 1481 {3, 3}, 1482 {6, 7}, 1483 {0, 0} 1484 } 1485 }, 1486 {0, 1, 3, 0, /* 0xca */ 1487 {{1, 1}, 1488 {3, 3}, 1489 {6, 7}, 1490 {0, 0} 1491 } 1492 }, 1493 {1, 1, 3, 0, /* 0xcb */ 1494 {{0, 1}, 1495 {3, 3}, 1496 {6, 7}, 1497 {0, 0} 1498 } 1499 }, 1500 {0, 1, 2, 0, /* 0xcc */ 1501 {{2, 3}, 1502 {6, 7}, 1503 {0, 0}, 1504 {0, 0} 1505 } 1506 }, 1507 {1, 1, 3, 0, /* 0xcd */ 1508 {{0, 0}, 1509 {2, 3}, 1510 {6, 7}, 1511 {0, 0} 1512 } 1513 }, 1514 {0, 1, 2, 0, /* 0xce */ 1515 {{1, 3}, 1516 {6, 7}, 1517 {0, 0}, 1518 {0, 0} 1519 } 1520 }, 1521 {1, 1, 2, 0, /* 0xcf */ 1522 {{0, 3}, 1523 {6, 7}, 1524 {0, 0}, 1525 {0, 0} 1526 } 1527 }, 1528 {0, 1, 2, 0, /* 0xd0 */ 1529 {{4, 4}, 1530 {6, 7}, 1531 {0, 0}, 1532 {0, 0} 1533 } 1534 }, 1535 {1, 1, 3, 0, /* 0xd1 */ 1536 {{0, 0}, 1537 {4, 4}, 1538 {6, 7}, 1539 {0, 0} 1540 } 1541 }, 1542 {0, 1, 3, 0, /* 0xd2 */ 1543 {{1, 1}, 1544 {4, 4}, 1545 {6, 7}, 1546 {0, 0} 1547 } 1548 }, 1549 {1, 1, 3, 0, /* 0xd3 */ 1550 {{0, 1}, 1551 {4, 4}, 1552 {6, 7}, 1553 {0, 0} 1554 } 1555 }, 1556 {0, 1, 3, 0, /* 0xd4 */ 1557 {{2, 2}, 1558 {4, 4}, 1559 {6, 7}, 1560 {0, 0} 1561 } 1562 }, 1563 {1, 1, 4, 0, /* 0xd5 */ 1564 {{0, 0}, 1565 {2, 2}, 1566 {4, 4}, 1567 {6, 7} 1568 } 1569 }, 1570 {0, 1, 3, 0, /* 0xd6 */ 1571 {{1, 2}, 1572 {4, 4}, 1573 {6, 7}, 1574 {0, 0} 1575 } 1576 }, 1577 {1, 1, 3, 0, /* 0xd7 */ 1578 {{0, 2}, 1579 {4, 4}, 1580 {6, 7}, 1581 {0, 0} 1582 } 1583 }, 1584 {0, 1, 2, 0, /* 0xd8 */ 1585 {{3, 4}, 1586 {6, 7}, 1587 {0, 0}, 1588 {0, 0} 1589 } 1590 }, 1591 {1, 1, 3, 0, /* 0xd9 */ 1592 {{0, 0}, 1593 {3, 4}, 1594 {6, 7}, 1595 {0, 0} 1596 } 1597 }, 1598 {0, 1, 3, 0, /* 0xda */ 1599 {{1, 1}, 1600 {3, 4}, 1601 {6, 7}, 1602 {0, 0} 1603 } 1604 }, 1605 {1, 1, 3, 0, /* 0xdb */ 1606 {{0, 1}, 1607 {3, 4}, 1608 {6, 7}, 1609 {0, 0} 1610 } 1611 }, 1612 {0, 1, 2, 0, /* 0xdc */ 1613 {{2, 4}, 1614 {6, 7}, 1615 {0, 0}, 1616 {0, 0} 1617 } 1618 }, 1619 {1, 1, 3, 0, /* 0xdd */ 1620 {{0, 0}, 1621 {2, 4}, 1622 {6, 7}, 1623 {0, 0} 1624 } 1625 }, 1626 {0, 1, 2, 0, /* 0xde */ 1627 {{1, 4}, 1628 {6, 7}, 1629 {0, 0}, 1630 {0, 0} 1631 } 1632 }, 1633 {1, 1, 2, 0, /* 0xdf */ 1634 {{0, 4}, 1635 {6, 7}, 1636 {0, 0}, 1637 {0, 0} 1638 } 1639 }, 1640 {0, 1, 1, 0, /* 0xe0 */ 1641 {{5, 7}, 1642 {0, 0}, 1643 {0, 0}, 1644 {0, 0} 1645 } 1646 }, 1647 {1, 1, 2, 0, /* 0xe1 */ 1648 {{0, 0}, 1649 {5, 7}, 1650 {0, 0}, 1651 {0, 0} 1652 } 1653 }, 1654 {0, 1, 2, 0, /* 0xe2 */ 1655 {{1, 1}, 1656 {5, 7}, 1657 {0, 0}, 1658 {0, 0} 1659 } 1660 }, 1661 {1, 1, 2, 0, /* 0xe3 */ 1662 {{0, 1}, 1663 {5, 7}, 1664 {0, 0}, 1665 {0, 0} 1666 } 1667 }, 1668 {0, 1, 2, 0, /* 0xe4 */ 1669 {{2, 2}, 1670 {5, 7}, 1671 {0, 0}, 1672 {0, 0} 1673 } 1674 }, 1675 {1, 1, 3, 0, /* 0xe5 */ 1676 {{0, 0}, 1677 {2, 2}, 1678 {5, 7}, 1679 {0, 0} 1680 } 1681 }, 1682 {0, 1, 2, 0, /* 0xe6 */ 1683 {{1, 2}, 1684 {5, 7}, 1685 {0, 0}, 1686 {0, 0} 1687 } 1688 }, 1689 {1, 1, 2, 0, /* 0xe7 */ 1690 {{0, 2}, 1691 {5, 7}, 1692 {0, 0}, 1693 {0, 0} 1694 } 1695 }, 1696 {0, 1, 2, 0, /* 0xe8 */ 1697 {{3, 3}, 1698 {5, 7}, 1699 {0, 0}, 1700 {0, 0} 1701 } 1702 }, 1703 {1, 1, 3, 0, /* 0xe9 */ 1704 {{0, 0}, 1705 {3, 3}, 1706 {5, 7}, 1707 {0, 0} 1708 } 1709 }, 1710 {0, 1, 3, 0, /* 0xea */ 1711 {{1, 1}, 1712 {3, 3}, 1713 {5, 7}, 1714 {0, 0} 1715 } 1716 }, 1717 {1, 1, 3, 0, /* 0xeb */ 1718 {{0, 1}, 1719 {3, 3}, 1720 {5, 7}, 1721 {0, 0} 1722 } 1723 }, 1724 {0, 1, 2, 0, /* 0xec */ 1725 {{2, 3}, 1726 {5, 7}, 1727 {0, 0}, 1728 {0, 0} 1729 } 1730 }, 1731 {1, 1, 3, 0, /* 0xed */ 1732 {{0, 0}, 1733 {2, 3}, 1734 {5, 7}, 1735 {0, 0} 1736 } 1737 }, 1738 {0, 1, 2, 0, /* 0xee */ 1739 {{1, 3}, 1740 {5, 7}, 1741 {0, 0}, 1742 {0, 0} 1743 } 1744 }, 1745 {1, 1, 2, 0, /* 0xef */ 1746 {{0, 3}, 1747 {5, 7}, 1748 {0, 0}, 1749 {0, 0} 1750 } 1751 }, 1752 {0, 1, 1, 0, /* 0xf0 */ 1753 {{4, 7}, 1754 {0, 0}, 1755 {0, 0}, 1756 {0, 0} 1757 } 1758 }, 1759 {1, 1, 2, 0, /* 0xf1 */ 1760 {{0, 0}, 1761 {4, 7}, 1762 {0, 0}, 1763 {0, 0} 1764 } 1765 }, 1766 {0, 1, 2, 0, /* 0xf2 */ 1767 {{1, 1}, 1768 {4, 7}, 1769 {0, 0}, 1770 {0, 0} 1771 } 1772 }, 1773 {1, 1, 2, 0, /* 0xf3 */ 1774 {{0, 1}, 1775 {4, 7}, 1776 {0, 0}, 1777 {0, 0} 1778 } 1779 }, 1780 {0, 1, 2, 0, /* 0xf4 */ 1781 {{2, 2}, 1782 {4, 7}, 1783 {0, 0}, 1784 {0, 0} 1785 } 1786 }, 1787 {1, 1, 3, 0, /* 0xf5 */ 1788 {{0, 0}, 1789 {2, 2}, 1790 {4, 7}, 1791 {0, 0} 1792 } 1793 }, 1794 {0, 1, 2, 0, /* 0xf6 */ 1795 {{1, 2}, 1796 {4, 7}, 1797 {0, 0}, 1798 {0, 0} 1799 } 1800 }, 1801 {1, 1, 2, 0, /* 0xf7 */ 1802 {{0, 2}, 1803 {4, 7}, 1804 {0, 0}, 1805 {0, 0} 1806 } 1807 }, 1808 {0, 1, 1, 0, /* 0xf8 */ 1809 {{3, 7}, 1810 {0, 0}, 1811 {0, 0}, 1812 {0, 0} 1813 } 1814 }, 1815 {1, 1, 2, 0, /* 0xf9 */ 1816 {{0, 0}, 1817 {3, 7}, 1818 {0, 0}, 1819 {0, 0} 1820 } 1821 }, 1822 {0, 1, 2, 0, /* 0xfa */ 1823 {{1, 1}, 1824 {3, 7}, 1825 {0, 0}, 1826 {0, 0} 1827 } 1828 }, 1829 {1, 1, 2, 0, /* 0xfb */ 1830 {{0, 1}, 1831 {3, 7}, 1832 {0, 0}, 1833 {0, 0} 1834 } 1835 }, 1836 {0, 1, 1, 0, /* 0xfc */ 1837 {{2, 7}, 1838 {0, 0}, 1839 {0, 0}, 1840 {0, 0} 1841 } 1842 }, 1843 {1, 1, 2, 0, /* 0xfd */ 1844 {{0, 0}, 1845 {2, 7}, 1846 {0, 0}, 1847 {0, 0} 1848 } 1849 }, 1850 {0, 1, 1, 0, /* 0xfe */ 1851 {{1, 7}, 1852 {0, 0}, 1853 {0, 0}, 1854 {0, 0} 1855 } 1856 }, 1857 {1, 1, 1, 0, /* 0xff */ 1858 {{0, 7}, 1859 {0, 0}, 1860 {0, 0}, 1861 {0, 0} 1862 } 1863 } 1864 }; 1865 1866 int 1867 sctp_is_address_in_scope(struct sctp_ifa *ifa, 1868 struct sctp_scoping *scope, 1869 int do_update) 1870 { 1871 if ((scope->loopback_scope == 0) && 1872 (ifa->ifn_p) && SCTP_IFN_IS_IFT_LOOP(ifa->ifn_p)) { 1873 /* 1874 * skip loopback if not in scope * 1875 */ 1876 return (0); 1877 } 1878 switch (ifa->address.sa.sa_family) { 1879 #ifdef INET 1880 case AF_INET: 1881 if (scope->ipv4_addr_legal) { 1882 struct sockaddr_in *sin; 1883 1884 sin = &ifa->address.sin; 1885 if (sin->sin_addr.s_addr == 0) { 1886 /* not in scope , unspecified */ 1887 return (0); 1888 } 1889 if ((scope->ipv4_local_scope == 0) && 1890 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 1891 /* private address not in scope */ 1892 return (0); 1893 } 1894 } else { 1895 return (0); 1896 } 1897 break; 1898 #endif 1899 #ifdef INET6 1900 case AF_INET6: 1901 if (scope->ipv6_addr_legal) { 1902 struct sockaddr_in6 *sin6; 1903 1904 /* 1905 * Must update the flags, bummer, which means any 1906 * IFA locks must now be applied HERE <-> 1907 */ 1908 if (do_update) { 1909 sctp_gather_internal_ifa_flags(ifa); 1910 } 1911 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 1912 return (0); 1913 } 1914 /* ok to use deprecated addresses? */ 1915 sin6 = &ifa->address.sin6; 1916 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1917 /* skip unspecifed addresses */ 1918 return (0); 1919 } 1920 if ( /* (local_scope == 0) && */ 1921 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) { 1922 return (0); 1923 } 1924 if ((scope->site_scope == 0) && 1925 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 1926 return (0); 1927 } 1928 } else { 1929 return (0); 1930 } 1931 break; 1932 #endif 1933 default: 1934 return (0); 1935 } 1936 return (1); 1937 } 1938 1939 static struct mbuf * 1940 sctp_add_addr_to_mbuf(struct mbuf *m, struct sctp_ifa *ifa, uint16_t *len) 1941 { 1942 #if defined(INET) || defined(INET6) 1943 struct sctp_paramhdr *paramh; 1944 struct mbuf *mret; 1945 uint16_t plen; 1946 #endif 1947 1948 switch (ifa->address.sa.sa_family) { 1949 #ifdef INET 1950 case AF_INET: 1951 plen = (uint16_t)sizeof(struct sctp_ipv4addr_param); 1952 break; 1953 #endif 1954 #ifdef INET6 1955 case AF_INET6: 1956 plen = (uint16_t)sizeof(struct sctp_ipv6addr_param); 1957 break; 1958 #endif 1959 default: 1960 return (m); 1961 } 1962 #if defined(INET) || defined(INET6) 1963 if (M_TRAILINGSPACE(m) >= plen) { 1964 /* easy side we just drop it on the end */ 1965 paramh = (struct sctp_paramhdr *)(SCTP_BUF_AT(m, SCTP_BUF_LEN(m))); 1966 mret = m; 1967 } else { 1968 /* Need more space */ 1969 mret = m; 1970 while (SCTP_BUF_NEXT(mret) != NULL) { 1971 mret = SCTP_BUF_NEXT(mret); 1972 } 1973 SCTP_BUF_NEXT(mret) = sctp_get_mbuf_for_msg(plen, 0, M_NOWAIT, 1, MT_DATA); 1974 if (SCTP_BUF_NEXT(mret) == NULL) { 1975 /* We are hosed, can't add more addresses */ 1976 return (m); 1977 } 1978 mret = SCTP_BUF_NEXT(mret); 1979 paramh = mtod(mret, struct sctp_paramhdr *); 1980 } 1981 /* now add the parameter */ 1982 switch (ifa->address.sa.sa_family) { 1983 #ifdef INET 1984 case AF_INET: 1985 { 1986 struct sctp_ipv4addr_param *ipv4p; 1987 struct sockaddr_in *sin; 1988 1989 sin = &ifa->address.sin; 1990 ipv4p = (struct sctp_ipv4addr_param *)paramh; 1991 paramh->param_type = htons(SCTP_IPV4_ADDRESS); 1992 paramh->param_length = htons(plen); 1993 ipv4p->addr = sin->sin_addr.s_addr; 1994 SCTP_BUF_LEN(mret) += plen; 1995 break; 1996 } 1997 #endif 1998 #ifdef INET6 1999 case AF_INET6: 2000 { 2001 struct sctp_ipv6addr_param *ipv6p; 2002 struct sockaddr_in6 *sin6; 2003 2004 sin6 = &ifa->address.sin6; 2005 ipv6p = (struct sctp_ipv6addr_param *)paramh; 2006 paramh->param_type = htons(SCTP_IPV6_ADDRESS); 2007 paramh->param_length = htons(plen); 2008 memcpy(ipv6p->addr, &sin6->sin6_addr, 2009 sizeof(ipv6p->addr)); 2010 /* clear embedded scope in the address */ 2011 in6_clearscope((struct in6_addr *)ipv6p->addr); 2012 SCTP_BUF_LEN(mret) += plen; 2013 break; 2014 } 2015 #endif 2016 default: 2017 return (m); 2018 } 2019 if (len != NULL) { 2020 *len += plen; 2021 } 2022 return (mret); 2023 #endif 2024 } 2025 2026 struct mbuf * 2027 sctp_add_addresses_to_i_ia(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2028 struct sctp_scoping *scope, 2029 struct mbuf *m_at, int cnt_inits_to, 2030 uint16_t *padding_len, uint16_t *chunk_len) 2031 { 2032 struct sctp_vrf *vrf = NULL; 2033 int cnt, limit_out = 0, total_count; 2034 uint32_t vrf_id; 2035 2036 vrf_id = inp->def_vrf_id; 2037 SCTP_IPI_ADDR_RLOCK(); 2038 vrf = sctp_find_vrf(vrf_id); 2039 if (vrf == NULL) { 2040 SCTP_IPI_ADDR_RUNLOCK(); 2041 return (m_at); 2042 } 2043 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 2044 struct sctp_ifa *sctp_ifap; 2045 struct sctp_ifn *sctp_ifnp; 2046 2047 cnt = cnt_inits_to; 2048 if (vrf->total_ifa_count > SCTP_COUNT_LIMIT) { 2049 limit_out = 1; 2050 cnt = SCTP_ADDRESS_LIMIT; 2051 goto skip_count; 2052 } 2053 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2054 if ((scope->loopback_scope == 0) && 2055 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2056 /* 2057 * Skip loopback devices if loopback_scope 2058 * not set 2059 */ 2060 continue; 2061 } 2062 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2063 #ifdef INET 2064 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2065 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2066 &sctp_ifap->address.sin.sin_addr) != 0)) { 2067 continue; 2068 } 2069 #endif 2070 #ifdef INET6 2071 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2072 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2073 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2074 continue; 2075 } 2076 #endif 2077 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2078 continue; 2079 } 2080 if (sctp_is_address_in_scope(sctp_ifap, scope, 1) == 0) { 2081 continue; 2082 } 2083 cnt++; 2084 if (cnt > SCTP_ADDRESS_LIMIT) { 2085 break; 2086 } 2087 } 2088 if (cnt > SCTP_ADDRESS_LIMIT) { 2089 break; 2090 } 2091 } 2092 skip_count: 2093 if (cnt > 1) { 2094 total_count = 0; 2095 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2096 cnt = 0; 2097 if ((scope->loopback_scope == 0) && 2098 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2099 /* 2100 * Skip loopback devices if 2101 * loopback_scope not set 2102 */ 2103 continue; 2104 } 2105 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2106 #ifdef INET 2107 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2108 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2109 &sctp_ifap->address.sin.sin_addr) != 0)) { 2110 continue; 2111 } 2112 #endif 2113 #ifdef INET6 2114 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2115 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2116 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2117 continue; 2118 } 2119 #endif 2120 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2121 continue; 2122 } 2123 if (sctp_is_address_in_scope(sctp_ifap, 2124 scope, 0) == 0) { 2125 continue; 2126 } 2127 if ((chunk_len != NULL) && 2128 (padding_len != NULL) && 2129 (*padding_len > 0)) { 2130 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2131 SCTP_BUF_LEN(m_at) += *padding_len; 2132 *chunk_len += *padding_len; 2133 *padding_len = 0; 2134 } 2135 m_at = sctp_add_addr_to_mbuf(m_at, sctp_ifap, chunk_len); 2136 if (limit_out) { 2137 cnt++; 2138 total_count++; 2139 if (cnt >= 2) { 2140 /* 2141 * two from each 2142 * address 2143 */ 2144 break; 2145 } 2146 if (total_count > SCTP_ADDRESS_LIMIT) { 2147 /* No more addresses */ 2148 break; 2149 } 2150 } 2151 } 2152 } 2153 } 2154 } else { 2155 struct sctp_laddr *laddr; 2156 2157 cnt = cnt_inits_to; 2158 /* First, how many ? */ 2159 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2160 if (laddr->ifa == NULL) { 2161 continue; 2162 } 2163 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) 2164 /* 2165 * Address being deleted by the system, dont 2166 * list. 2167 */ 2168 continue; 2169 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2170 /* 2171 * Address being deleted on this ep don't 2172 * list. 2173 */ 2174 continue; 2175 } 2176 if (sctp_is_address_in_scope(laddr->ifa, 2177 scope, 1) == 0) { 2178 continue; 2179 } 2180 cnt++; 2181 } 2182 /* 2183 * To get through a NAT we only list addresses if we have 2184 * more than one. That way if you just bind a single address 2185 * we let the source of the init dictate our address. 2186 */ 2187 if (cnt > 1) { 2188 cnt = cnt_inits_to; 2189 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2190 if (laddr->ifa == NULL) { 2191 continue; 2192 } 2193 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) { 2194 continue; 2195 } 2196 if (sctp_is_address_in_scope(laddr->ifa, 2197 scope, 0) == 0) { 2198 continue; 2199 } 2200 if ((chunk_len != NULL) && 2201 (padding_len != NULL) && 2202 (*padding_len > 0)) { 2203 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2204 SCTP_BUF_LEN(m_at) += *padding_len; 2205 *chunk_len += *padding_len; 2206 *padding_len = 0; 2207 } 2208 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa, chunk_len); 2209 cnt++; 2210 if (cnt >= SCTP_ADDRESS_LIMIT) { 2211 break; 2212 } 2213 } 2214 } 2215 } 2216 SCTP_IPI_ADDR_RUNLOCK(); 2217 return (m_at); 2218 } 2219 2220 static struct sctp_ifa * 2221 sctp_is_ifa_addr_preferred(struct sctp_ifa *ifa, 2222 uint8_t dest_is_loop, 2223 uint8_t dest_is_priv, 2224 sa_family_t fam) 2225 { 2226 uint8_t dest_is_global = 0; 2227 2228 /* dest_is_priv is true if destination is a private address */ 2229 /* dest_is_loop is true if destination is a loopback addresses */ 2230 2231 /** 2232 * Here we determine if its a preferred address. A preferred address 2233 * means it is the same scope or higher scope then the destination. 2234 * L = loopback, P = private, G = global 2235 * ----------------------------------------- 2236 * src | dest | result 2237 * ---------------------------------------- 2238 * L | L | yes 2239 * ----------------------------------------- 2240 * P | L | yes-v4 no-v6 2241 * ----------------------------------------- 2242 * G | L | yes-v4 no-v6 2243 * ----------------------------------------- 2244 * L | P | no 2245 * ----------------------------------------- 2246 * P | P | yes 2247 * ----------------------------------------- 2248 * G | P | no 2249 * ----------------------------------------- 2250 * L | G | no 2251 * ----------------------------------------- 2252 * P | G | no 2253 * ----------------------------------------- 2254 * G | G | yes 2255 * ----------------------------------------- 2256 */ 2257 2258 if (ifa->address.sa.sa_family != fam) { 2259 /* forget mis-matched family */ 2260 return (NULL); 2261 } 2262 if ((dest_is_priv == 0) && (dest_is_loop == 0)) { 2263 dest_is_global = 1; 2264 } 2265 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Is destination preferred:"); 2266 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ifa->address.sa); 2267 /* Ok the address may be ok */ 2268 #ifdef INET6 2269 if (fam == AF_INET6) { 2270 /* ok to use deprecated addresses? no lets not! */ 2271 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2272 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:1\n"); 2273 return (NULL); 2274 } 2275 if (ifa->src_is_priv && !ifa->src_is_loop) { 2276 if (dest_is_loop) { 2277 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:2\n"); 2278 return (NULL); 2279 } 2280 } 2281 if (ifa->src_is_glob) { 2282 if (dest_is_loop) { 2283 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:3\n"); 2284 return (NULL); 2285 } 2286 } 2287 } 2288 #endif 2289 /* 2290 * Now that we know what is what, implement or table this could in 2291 * theory be done slicker (it used to be), but this is 2292 * straightforward and easier to validate :-) 2293 */ 2294 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src_loop:%d src_priv:%d src_glob:%d\n", 2295 ifa->src_is_loop, ifa->src_is_priv, ifa->src_is_glob); 2296 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dest_loop:%d dest_priv:%d dest_glob:%d\n", 2297 dest_is_loop, dest_is_priv, dest_is_global); 2298 2299 if ((ifa->src_is_loop) && (dest_is_priv)) { 2300 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:4\n"); 2301 return (NULL); 2302 } 2303 if ((ifa->src_is_glob) && (dest_is_priv)) { 2304 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:5\n"); 2305 return (NULL); 2306 } 2307 if ((ifa->src_is_loop) && (dest_is_global)) { 2308 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:6\n"); 2309 return (NULL); 2310 } 2311 if ((ifa->src_is_priv) && (dest_is_global)) { 2312 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:7\n"); 2313 return (NULL); 2314 } 2315 SCTPDBG(SCTP_DEBUG_OUTPUT3, "YES\n"); 2316 /* its a preferred address */ 2317 return (ifa); 2318 } 2319 2320 static struct sctp_ifa * 2321 sctp_is_ifa_addr_acceptable(struct sctp_ifa *ifa, 2322 uint8_t dest_is_loop, 2323 uint8_t dest_is_priv, 2324 sa_family_t fam) 2325 { 2326 uint8_t dest_is_global = 0; 2327 2328 /** 2329 * Here we determine if its a acceptable address. A acceptable 2330 * address means it is the same scope or higher scope but we can 2331 * allow for NAT which means its ok to have a global dest and a 2332 * private src. 2333 * 2334 * L = loopback, P = private, G = global 2335 * ----------------------------------------- 2336 * src | dest | result 2337 * ----------------------------------------- 2338 * L | L | yes 2339 * ----------------------------------------- 2340 * P | L | yes-v4 no-v6 2341 * ----------------------------------------- 2342 * G | L | yes 2343 * ----------------------------------------- 2344 * L | P | no 2345 * ----------------------------------------- 2346 * P | P | yes 2347 * ----------------------------------------- 2348 * G | P | yes - May not work 2349 * ----------------------------------------- 2350 * L | G | no 2351 * ----------------------------------------- 2352 * P | G | yes - May not work 2353 * ----------------------------------------- 2354 * G | G | yes 2355 * ----------------------------------------- 2356 */ 2357 2358 if (ifa->address.sa.sa_family != fam) { 2359 /* forget non matching family */ 2360 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa_fam:%d fam:%d\n", 2361 ifa->address.sa.sa_family, fam); 2362 return (NULL); 2363 } 2364 /* Ok the address may be ok */ 2365 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, &ifa->address.sa); 2366 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst_is_loop:%d dest_is_priv:%d\n", 2367 dest_is_loop, dest_is_priv); 2368 if ((dest_is_loop == 0) && (dest_is_priv == 0)) { 2369 dest_is_global = 1; 2370 } 2371 #ifdef INET6 2372 if (fam == AF_INET6) { 2373 /* ok to use deprecated addresses? */ 2374 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2375 return (NULL); 2376 } 2377 if (ifa->src_is_priv) { 2378 /* Special case, linklocal to loop */ 2379 if (dest_is_loop) 2380 return (NULL); 2381 } 2382 } 2383 #endif 2384 /* 2385 * Now that we know what is what, implement our table. This could in 2386 * theory be done slicker (it used to be), but this is 2387 * straightforward and easier to validate :-) 2388 */ 2389 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_priv:%d\n", 2390 ifa->src_is_loop, 2391 dest_is_priv); 2392 if ((ifa->src_is_loop == 1) && (dest_is_priv)) { 2393 return (NULL); 2394 } 2395 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_glob:%d\n", 2396 ifa->src_is_loop, 2397 dest_is_global); 2398 if ((ifa->src_is_loop == 1) && (dest_is_global)) { 2399 return (NULL); 2400 } 2401 SCTPDBG(SCTP_DEBUG_OUTPUT3, "address is acceptable\n"); 2402 /* its an acceptable address */ 2403 return (ifa); 2404 } 2405 2406 int 2407 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa) 2408 { 2409 struct sctp_laddr *laddr; 2410 2411 if (stcb == NULL) { 2412 /* There are no restrictions, no TCB :-) */ 2413 return (0); 2414 } 2415 LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) { 2416 if (laddr->ifa == NULL) { 2417 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2418 __func__); 2419 continue; 2420 } 2421 if (laddr->ifa == ifa) { 2422 /* Yes it is on the list */ 2423 return (1); 2424 } 2425 } 2426 return (0); 2427 } 2428 2429 int 2430 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa) 2431 { 2432 struct sctp_laddr *laddr; 2433 2434 if (ifa == NULL) 2435 return (0); 2436 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2437 if (laddr->ifa == NULL) { 2438 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2439 __func__); 2440 continue; 2441 } 2442 if ((laddr->ifa == ifa) && laddr->action == 0) 2443 /* same pointer */ 2444 return (1); 2445 } 2446 return (0); 2447 } 2448 2449 static struct sctp_ifa * 2450 sctp_choose_boundspecific_inp(struct sctp_inpcb *inp, 2451 sctp_route_t *ro, 2452 uint32_t vrf_id, 2453 int non_asoc_addr_ok, 2454 uint8_t dest_is_priv, 2455 uint8_t dest_is_loop, 2456 sa_family_t fam) 2457 { 2458 struct sctp_laddr *laddr, *starting_point; 2459 void *ifn; 2460 int resettotop = 0; 2461 struct sctp_ifn *sctp_ifn; 2462 struct sctp_ifa *sctp_ifa, *sifa; 2463 struct sctp_vrf *vrf; 2464 uint32_t ifn_index; 2465 2466 vrf = sctp_find_vrf(vrf_id); 2467 if (vrf == NULL) 2468 return (NULL); 2469 2470 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2471 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2472 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2473 /* 2474 * first question, is the ifn we will emit on in our list, if so, we 2475 * want such an address. Note that we first looked for a preferred 2476 * address. 2477 */ 2478 if (sctp_ifn) { 2479 /* is a preferred one on the interface we route out? */ 2480 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2481 #ifdef INET 2482 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2483 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2484 &sctp_ifa->address.sin.sin_addr) != 0)) { 2485 continue; 2486 } 2487 #endif 2488 #ifdef INET6 2489 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2490 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2491 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2492 continue; 2493 } 2494 #endif 2495 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2496 (non_asoc_addr_ok == 0)) 2497 continue; 2498 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, 2499 dest_is_loop, 2500 dest_is_priv, fam); 2501 if (sifa == NULL) 2502 continue; 2503 if (sctp_is_addr_in_ep(inp, sifa)) { 2504 atomic_add_int(&sifa->refcount, 1); 2505 return (sifa); 2506 } 2507 } 2508 } 2509 /* 2510 * ok, now we now need to find one on the list of the addresses. We 2511 * can't get one on the emitting interface so let's find first a 2512 * preferred one. If not that an acceptable one otherwise... we 2513 * return NULL. 2514 */ 2515 starting_point = inp->next_addr_touse; 2516 once_again: 2517 if (inp->next_addr_touse == NULL) { 2518 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2519 resettotop = 1; 2520 } 2521 for (laddr = inp->next_addr_touse; laddr; 2522 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2523 if (laddr->ifa == NULL) { 2524 /* address has been removed */ 2525 continue; 2526 } 2527 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2528 /* address is being deleted */ 2529 continue; 2530 } 2531 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, 2532 dest_is_priv, fam); 2533 if (sifa == NULL) 2534 continue; 2535 atomic_add_int(&sifa->refcount, 1); 2536 return (sifa); 2537 } 2538 if (resettotop == 0) { 2539 inp->next_addr_touse = NULL; 2540 goto once_again; 2541 } 2542 2543 inp->next_addr_touse = starting_point; 2544 resettotop = 0; 2545 once_again_too: 2546 if (inp->next_addr_touse == NULL) { 2547 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2548 resettotop = 1; 2549 } 2550 2551 /* ok, what about an acceptable address in the inp */ 2552 for (laddr = inp->next_addr_touse; laddr; 2553 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2554 if (laddr->ifa == NULL) { 2555 /* address has been removed */ 2556 continue; 2557 } 2558 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2559 /* address is being deleted */ 2560 continue; 2561 } 2562 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2563 dest_is_priv, fam); 2564 if (sifa == NULL) 2565 continue; 2566 atomic_add_int(&sifa->refcount, 1); 2567 return (sifa); 2568 } 2569 if (resettotop == 0) { 2570 inp->next_addr_touse = NULL; 2571 goto once_again_too; 2572 } 2573 2574 /* 2575 * no address bound can be a source for the destination we are in 2576 * trouble 2577 */ 2578 return (NULL); 2579 } 2580 2581 static struct sctp_ifa * 2582 sctp_choose_boundspecific_stcb(struct sctp_inpcb *inp, 2583 struct sctp_tcb *stcb, 2584 sctp_route_t *ro, 2585 uint32_t vrf_id, 2586 uint8_t dest_is_priv, 2587 uint8_t dest_is_loop, 2588 int non_asoc_addr_ok, 2589 sa_family_t fam) 2590 { 2591 struct sctp_laddr *laddr, *starting_point; 2592 void *ifn; 2593 struct sctp_ifn *sctp_ifn; 2594 struct sctp_ifa *sctp_ifa, *sifa; 2595 uint8_t start_at_beginning = 0; 2596 struct sctp_vrf *vrf; 2597 uint32_t ifn_index; 2598 2599 /* 2600 * first question, is the ifn we will emit on in our list, if so, we 2601 * want that one. 2602 */ 2603 vrf = sctp_find_vrf(vrf_id); 2604 if (vrf == NULL) 2605 return (NULL); 2606 2607 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2608 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2609 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2610 2611 /* 2612 * first question, is the ifn we will emit on in our list? If so, 2613 * we want that one. First we look for a preferred. Second, we go 2614 * for an acceptable. 2615 */ 2616 if (sctp_ifn) { 2617 /* first try for a preferred address on the ep */ 2618 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2619 #ifdef INET 2620 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2621 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2622 &sctp_ifa->address.sin.sin_addr) != 0)) { 2623 continue; 2624 } 2625 #endif 2626 #ifdef INET6 2627 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2628 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2629 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2630 continue; 2631 } 2632 #endif 2633 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2634 continue; 2635 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2636 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2637 if (sifa == NULL) 2638 continue; 2639 if (((non_asoc_addr_ok == 0) && 2640 (sctp_is_addr_restricted(stcb, sifa))) || 2641 (non_asoc_addr_ok && 2642 (sctp_is_addr_restricted(stcb, sifa)) && 2643 (!sctp_is_addr_pending(stcb, sifa)))) { 2644 /* on the no-no list */ 2645 continue; 2646 } 2647 atomic_add_int(&sifa->refcount, 1); 2648 return (sifa); 2649 } 2650 } 2651 /* next try for an acceptable address on the ep */ 2652 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2653 #ifdef INET 2654 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2655 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2656 &sctp_ifa->address.sin.sin_addr) != 0)) { 2657 continue; 2658 } 2659 #endif 2660 #ifdef INET6 2661 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2662 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2663 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2664 continue; 2665 } 2666 #endif 2667 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2668 continue; 2669 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2670 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2671 if (sifa == NULL) 2672 continue; 2673 if (((non_asoc_addr_ok == 0) && 2674 (sctp_is_addr_restricted(stcb, sifa))) || 2675 (non_asoc_addr_ok && 2676 (sctp_is_addr_restricted(stcb, sifa)) && 2677 (!sctp_is_addr_pending(stcb, sifa)))) { 2678 /* on the no-no list */ 2679 continue; 2680 } 2681 atomic_add_int(&sifa->refcount, 1); 2682 return (sifa); 2683 } 2684 } 2685 } 2686 /* 2687 * if we can't find one like that then we must look at all addresses 2688 * bound to pick one at first preferable then secondly acceptable. 2689 */ 2690 starting_point = stcb->asoc.last_used_address; 2691 sctp_from_the_top: 2692 if (stcb->asoc.last_used_address == NULL) { 2693 start_at_beginning = 1; 2694 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2695 } 2696 /* search beginning with the last used address */ 2697 for (laddr = stcb->asoc.last_used_address; laddr; 2698 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2699 if (laddr->ifa == NULL) { 2700 /* address has been removed */ 2701 continue; 2702 } 2703 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2704 /* address is being deleted */ 2705 continue; 2706 } 2707 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, dest_is_priv, fam); 2708 if (sifa == NULL) 2709 continue; 2710 if (((non_asoc_addr_ok == 0) && 2711 (sctp_is_addr_restricted(stcb, sifa))) || 2712 (non_asoc_addr_ok && 2713 (sctp_is_addr_restricted(stcb, sifa)) && 2714 (!sctp_is_addr_pending(stcb, sifa)))) { 2715 /* on the no-no list */ 2716 continue; 2717 } 2718 stcb->asoc.last_used_address = laddr; 2719 atomic_add_int(&sifa->refcount, 1); 2720 return (sifa); 2721 } 2722 if (start_at_beginning == 0) { 2723 stcb->asoc.last_used_address = NULL; 2724 goto sctp_from_the_top; 2725 } 2726 /* now try for any higher scope than the destination */ 2727 stcb->asoc.last_used_address = starting_point; 2728 start_at_beginning = 0; 2729 sctp_from_the_top2: 2730 if (stcb->asoc.last_used_address == NULL) { 2731 start_at_beginning = 1; 2732 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2733 } 2734 /* search beginning with the last used address */ 2735 for (laddr = stcb->asoc.last_used_address; laddr; 2736 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2737 if (laddr->ifa == NULL) { 2738 /* address has been removed */ 2739 continue; 2740 } 2741 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2742 /* address is being deleted */ 2743 continue; 2744 } 2745 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2746 dest_is_priv, fam); 2747 if (sifa == NULL) 2748 continue; 2749 if (((non_asoc_addr_ok == 0) && 2750 (sctp_is_addr_restricted(stcb, sifa))) || 2751 (non_asoc_addr_ok && 2752 (sctp_is_addr_restricted(stcb, sifa)) && 2753 (!sctp_is_addr_pending(stcb, sifa)))) { 2754 /* on the no-no list */ 2755 continue; 2756 } 2757 stcb->asoc.last_used_address = laddr; 2758 atomic_add_int(&sifa->refcount, 1); 2759 return (sifa); 2760 } 2761 if (start_at_beginning == 0) { 2762 stcb->asoc.last_used_address = NULL; 2763 goto sctp_from_the_top2; 2764 } 2765 return (NULL); 2766 } 2767 2768 static struct sctp_ifa * 2769 sctp_select_nth_preferred_addr_from_ifn_boundall(struct sctp_ifn *ifn, 2770 struct sctp_inpcb *inp, 2771 struct sctp_tcb *stcb, 2772 int non_asoc_addr_ok, 2773 uint8_t dest_is_loop, 2774 uint8_t dest_is_priv, 2775 int addr_wanted, 2776 sa_family_t fam, 2777 sctp_route_t *ro) 2778 { 2779 struct sctp_ifa *ifa, *sifa; 2780 int num_eligible_addr = 0; 2781 #ifdef INET6 2782 struct sockaddr_in6 sin6, lsa6; 2783 2784 if (fam == AF_INET6) { 2785 memcpy(&sin6, &ro->ro_dst, sizeof(struct sockaddr_in6)); 2786 (void)sa6_recoverscope(&sin6); 2787 } 2788 #endif /* INET6 */ 2789 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2790 #ifdef INET 2791 if ((ifa->address.sa.sa_family == AF_INET) && 2792 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2793 &ifa->address.sin.sin_addr) != 0)) { 2794 continue; 2795 } 2796 #endif 2797 #ifdef INET6 2798 if ((ifa->address.sa.sa_family == AF_INET6) && 2799 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2800 &ifa->address.sin6.sin6_addr) != 0)) { 2801 continue; 2802 } 2803 #endif 2804 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2805 (non_asoc_addr_ok == 0)) 2806 continue; 2807 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2808 dest_is_priv, fam); 2809 if (sifa == NULL) 2810 continue; 2811 #ifdef INET6 2812 if (fam == AF_INET6 && 2813 dest_is_loop && 2814 sifa->src_is_loop && sifa->src_is_priv) { 2815 /* 2816 * don't allow fe80::1 to be a src on loop ::1, we 2817 * don't list it to the peer so we will get an 2818 * abort. 2819 */ 2820 continue; 2821 } 2822 if (fam == AF_INET6 && 2823 IN6_IS_ADDR_LINKLOCAL(&sifa->address.sin6.sin6_addr) && 2824 IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) { 2825 /* 2826 * link-local <-> link-local must belong to the same 2827 * scope. 2828 */ 2829 memcpy(&lsa6, &sifa->address.sin6, sizeof(struct sockaddr_in6)); 2830 (void)sa6_recoverscope(&lsa6); 2831 if (sin6.sin6_scope_id != lsa6.sin6_scope_id) { 2832 continue; 2833 } 2834 } 2835 #endif /* INET6 */ 2836 2837 /* 2838 * Check if the IPv6 address matches to next-hop. In the 2839 * mobile case, old IPv6 address may be not deleted from the 2840 * interface. Then, the interface has previous and new 2841 * addresses. We should use one corresponding to the 2842 * next-hop. (by micchie) 2843 */ 2844 #ifdef INET6 2845 if (stcb && fam == AF_INET6 && 2846 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2847 if (sctp_v6src_match_nexthop(&sifa->address.sin6, ro) 2848 == 0) { 2849 continue; 2850 } 2851 } 2852 #endif 2853 #ifdef INET 2854 /* Avoid topologically incorrect IPv4 address */ 2855 if (stcb && fam == AF_INET && 2856 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2857 if (sctp_v4src_match_nexthop(sifa, ro) == 0) { 2858 continue; 2859 } 2860 } 2861 #endif 2862 if (stcb) { 2863 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2864 continue; 2865 } 2866 if (((non_asoc_addr_ok == 0) && 2867 (sctp_is_addr_restricted(stcb, sifa))) || 2868 (non_asoc_addr_ok && 2869 (sctp_is_addr_restricted(stcb, sifa)) && 2870 (!sctp_is_addr_pending(stcb, sifa)))) { 2871 /* 2872 * It is restricted for some reason.. 2873 * probably not yet added. 2874 */ 2875 continue; 2876 } 2877 } 2878 if (num_eligible_addr >= addr_wanted) { 2879 return (sifa); 2880 } 2881 num_eligible_addr++; 2882 } 2883 return (NULL); 2884 } 2885 2886 static int 2887 sctp_count_num_preferred_boundall(struct sctp_ifn *ifn, 2888 struct sctp_inpcb *inp, 2889 struct sctp_tcb *stcb, 2890 int non_asoc_addr_ok, 2891 uint8_t dest_is_loop, 2892 uint8_t dest_is_priv, 2893 sa_family_t fam) 2894 { 2895 struct sctp_ifa *ifa, *sifa; 2896 int num_eligible_addr = 0; 2897 2898 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2899 #ifdef INET 2900 if ((ifa->address.sa.sa_family == AF_INET) && 2901 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2902 &ifa->address.sin.sin_addr) != 0)) { 2903 continue; 2904 } 2905 #endif 2906 #ifdef INET6 2907 if ((ifa->address.sa.sa_family == AF_INET6) && 2908 (stcb != NULL) && 2909 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2910 &ifa->address.sin6.sin6_addr) != 0)) { 2911 continue; 2912 } 2913 #endif 2914 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2915 (non_asoc_addr_ok == 0)) { 2916 continue; 2917 } 2918 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2919 dest_is_priv, fam); 2920 if (sifa == NULL) { 2921 continue; 2922 } 2923 if (stcb) { 2924 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2925 continue; 2926 } 2927 if (((non_asoc_addr_ok == 0) && 2928 (sctp_is_addr_restricted(stcb, sifa))) || 2929 (non_asoc_addr_ok && 2930 (sctp_is_addr_restricted(stcb, sifa)) && 2931 (!sctp_is_addr_pending(stcb, sifa)))) { 2932 /* 2933 * It is restricted for some reason.. 2934 * probably not yet added. 2935 */ 2936 continue; 2937 } 2938 } 2939 num_eligible_addr++; 2940 } 2941 return (num_eligible_addr); 2942 } 2943 2944 static struct sctp_ifa * 2945 sctp_choose_boundall(struct sctp_inpcb *inp, 2946 struct sctp_tcb *stcb, 2947 struct sctp_nets *net, 2948 sctp_route_t *ro, 2949 uint32_t vrf_id, 2950 uint8_t dest_is_priv, 2951 uint8_t dest_is_loop, 2952 int non_asoc_addr_ok, 2953 sa_family_t fam) 2954 { 2955 int cur_addr_num = 0, num_preferred = 0; 2956 void *ifn; 2957 struct sctp_ifn *sctp_ifn, *looked_at = NULL, *emit_ifn; 2958 struct sctp_ifa *sctp_ifa, *sifa; 2959 uint32_t ifn_index; 2960 struct sctp_vrf *vrf; 2961 #ifdef INET 2962 int retried = 0; 2963 #endif 2964 2965 /*- 2966 * For boundall we can use any address in the association. 2967 * If non_asoc_addr_ok is set we can use any address (at least in 2968 * theory). So we look for preferred addresses first. If we find one, 2969 * we use it. Otherwise we next try to get an address on the 2970 * interface, which we should be able to do (unless non_asoc_addr_ok 2971 * is false and we are routed out that way). In these cases where we 2972 * can't use the address of the interface we go through all the 2973 * ifn's looking for an address we can use and fill that in. Punting 2974 * means we send back address 0, which will probably cause problems 2975 * actually since then IP will fill in the address of the route ifn, 2976 * which means we probably already rejected it.. i.e. here comes an 2977 * abort :-<. 2978 */ 2979 vrf = sctp_find_vrf(vrf_id); 2980 if (vrf == NULL) 2981 return (NULL); 2982 2983 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2984 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2985 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn from route:%p ifn_index:%d\n", ifn, ifn_index); 2986 emit_ifn = looked_at = sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2987 if (sctp_ifn == NULL) { 2988 /* ?? We don't have this guy ?? */ 2989 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No ifn emit interface?\n"); 2990 goto bound_all_plan_b; 2991 } 2992 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn_index:%d name:%s is emit interface\n", 2993 ifn_index, sctp_ifn->ifn_name); 2994 2995 if (net) { 2996 cur_addr_num = net->indx_of_eligible_next_to_use; 2997 } 2998 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, 2999 inp, stcb, 3000 non_asoc_addr_ok, 3001 dest_is_loop, 3002 dest_is_priv, fam); 3003 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Found %d preferred source addresses for intf:%s\n", 3004 num_preferred, sctp_ifn->ifn_name); 3005 if (num_preferred == 0) { 3006 /* 3007 * no eligible addresses, we must use some other interface 3008 * address if we can find one. 3009 */ 3010 goto bound_all_plan_b; 3011 } 3012 /* 3013 * Ok we have num_eligible_addr set with how many we can use, this 3014 * may vary from call to call due to addresses being deprecated 3015 * etc.. 3016 */ 3017 if (cur_addr_num >= num_preferred) { 3018 cur_addr_num = 0; 3019 } 3020 /* 3021 * select the nth address from the list (where cur_addr_num is the 3022 * nth) and 0 is the first one, 1 is the second one etc... 3023 */ 3024 SCTPDBG(SCTP_DEBUG_OUTPUT2, "cur_addr_num:%d\n", cur_addr_num); 3025 3026 sctp_ifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3027 dest_is_priv, cur_addr_num, fam, ro); 3028 3029 /* if sctp_ifa is NULL something changed??, fall to plan b. */ 3030 if (sctp_ifa) { 3031 atomic_add_int(&sctp_ifa->refcount, 1); 3032 if (net) { 3033 /* save off where the next one we will want */ 3034 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3035 } 3036 return (sctp_ifa); 3037 } 3038 /* 3039 * plan_b: Look at all interfaces and find a preferred address. If 3040 * no preferred fall through to plan_c. 3041 */ 3042 bound_all_plan_b: 3043 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan B\n"); 3044 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3045 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Examine interface %s\n", 3046 sctp_ifn->ifn_name); 3047 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3048 /* wrong base scope */ 3049 SCTPDBG(SCTP_DEBUG_OUTPUT2, "skip\n"); 3050 continue; 3051 } 3052 if ((sctp_ifn == looked_at) && looked_at) { 3053 /* already looked at this guy */ 3054 SCTPDBG(SCTP_DEBUG_OUTPUT2, "already seen\n"); 3055 continue; 3056 } 3057 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, 3058 dest_is_loop, dest_is_priv, fam); 3059 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3060 "Found ifn:%p %d preferred source addresses\n", 3061 ifn, num_preferred); 3062 if (num_preferred == 0) { 3063 /* None on this interface. */ 3064 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No preferred -- skipping to next\n"); 3065 continue; 3066 } 3067 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3068 "num preferred:%d on interface:%p cur_addr_num:%d\n", 3069 num_preferred, (void *)sctp_ifn, cur_addr_num); 3070 3071 /* 3072 * Ok we have num_eligible_addr set with how many we can 3073 * use, this may vary from call to call due to addresses 3074 * being deprecated etc.. 3075 */ 3076 if (cur_addr_num >= num_preferred) { 3077 cur_addr_num = 0; 3078 } 3079 sifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3080 dest_is_priv, cur_addr_num, fam, ro); 3081 if (sifa == NULL) 3082 continue; 3083 if (net) { 3084 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3085 SCTPDBG(SCTP_DEBUG_OUTPUT2, "we selected %d\n", 3086 cur_addr_num); 3087 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Source:"); 3088 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 3089 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Dest:"); 3090 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &net->ro._l_addr.sa); 3091 } 3092 atomic_add_int(&sifa->refcount, 1); 3093 return (sifa); 3094 } 3095 #ifdef INET 3096 again_with_private_addresses_allowed: 3097 #endif 3098 /* plan_c: do we have an acceptable address on the emit interface */ 3099 sifa = NULL; 3100 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan C: find acceptable on interface\n"); 3101 if (emit_ifn == NULL) { 3102 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jump to Plan D - no emit_ifn\n"); 3103 goto plan_d; 3104 } 3105 LIST_FOREACH(sctp_ifa, &emit_ifn->ifalist, next_ifa) { 3106 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifa:%p\n", (void *)sctp_ifa); 3107 #ifdef INET 3108 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3109 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3110 &sctp_ifa->address.sin.sin_addr) != 0)) { 3111 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3112 continue; 3113 } 3114 #endif 3115 #ifdef INET6 3116 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3117 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3118 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3119 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3120 continue; 3121 } 3122 #endif 3123 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3124 (non_asoc_addr_ok == 0)) { 3125 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Defer\n"); 3126 continue; 3127 } 3128 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, 3129 dest_is_priv, fam); 3130 if (sifa == NULL) { 3131 SCTPDBG(SCTP_DEBUG_OUTPUT2, "IFA not acceptable\n"); 3132 continue; 3133 } 3134 if (stcb) { 3135 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3136 SCTPDBG(SCTP_DEBUG_OUTPUT2, "NOT in scope\n"); 3137 sifa = NULL; 3138 continue; 3139 } 3140 if (((non_asoc_addr_ok == 0) && 3141 (sctp_is_addr_restricted(stcb, sifa))) || 3142 (non_asoc_addr_ok && 3143 (sctp_is_addr_restricted(stcb, sifa)) && 3144 (!sctp_is_addr_pending(stcb, sifa)))) { 3145 /* 3146 * It is restricted for some reason.. 3147 * probably not yet added. 3148 */ 3149 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Its restricted\n"); 3150 sifa = NULL; 3151 continue; 3152 } 3153 } 3154 atomic_add_int(&sifa->refcount, 1); 3155 goto out; 3156 } 3157 plan_d: 3158 /* 3159 * plan_d: We are in trouble. No preferred address on the emit 3160 * interface. And not even a preferred address on all interfaces. Go 3161 * out and see if we can find an acceptable address somewhere 3162 * amongst all interfaces. 3163 */ 3164 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan D looked_at is %p\n", (void *)looked_at); 3165 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3166 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3167 /* wrong base scope */ 3168 continue; 3169 } 3170 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3171 #ifdef INET 3172 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3173 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3174 &sctp_ifa->address.sin.sin_addr) != 0)) { 3175 continue; 3176 } 3177 #endif 3178 #ifdef INET6 3179 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3180 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3181 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3182 continue; 3183 } 3184 #endif 3185 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3186 (non_asoc_addr_ok == 0)) 3187 continue; 3188 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3189 dest_is_loop, 3190 dest_is_priv, fam); 3191 if (sifa == NULL) 3192 continue; 3193 if (stcb) { 3194 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3195 sifa = NULL; 3196 continue; 3197 } 3198 if (((non_asoc_addr_ok == 0) && 3199 (sctp_is_addr_restricted(stcb, sifa))) || 3200 (non_asoc_addr_ok && 3201 (sctp_is_addr_restricted(stcb, sifa)) && 3202 (!sctp_is_addr_pending(stcb, sifa)))) { 3203 /* 3204 * It is restricted for some 3205 * reason.. probably not yet added. 3206 */ 3207 sifa = NULL; 3208 continue; 3209 } 3210 } 3211 goto out; 3212 } 3213 } 3214 #ifdef INET 3215 if (stcb) { 3216 if ((retried == 0) && (stcb->asoc.scope.ipv4_local_scope == 0)) { 3217 stcb->asoc.scope.ipv4_local_scope = 1; 3218 retried = 1; 3219 goto again_with_private_addresses_allowed; 3220 } else if (retried == 1) { 3221 stcb->asoc.scope.ipv4_local_scope = 0; 3222 } 3223 } 3224 #endif 3225 out: 3226 #ifdef INET 3227 if (sifa) { 3228 if (retried == 1) { 3229 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3230 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3231 /* wrong base scope */ 3232 continue; 3233 } 3234 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3235 struct sctp_ifa *tmp_sifa; 3236 3237 #ifdef INET 3238 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3239 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3240 &sctp_ifa->address.sin.sin_addr) != 0)) { 3241 continue; 3242 } 3243 #endif 3244 #ifdef INET6 3245 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3246 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3247 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3248 continue; 3249 } 3250 #endif 3251 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3252 (non_asoc_addr_ok == 0)) 3253 continue; 3254 tmp_sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3255 dest_is_loop, 3256 dest_is_priv, fam); 3257 if (tmp_sifa == NULL) { 3258 continue; 3259 } 3260 if (tmp_sifa == sifa) { 3261 continue; 3262 } 3263 if (stcb) { 3264 if (sctp_is_address_in_scope(tmp_sifa, 3265 &stcb->asoc.scope, 0) == 0) { 3266 continue; 3267 } 3268 if (((non_asoc_addr_ok == 0) && 3269 (sctp_is_addr_restricted(stcb, tmp_sifa))) || 3270 (non_asoc_addr_ok && 3271 (sctp_is_addr_restricted(stcb, tmp_sifa)) && 3272 (!sctp_is_addr_pending(stcb, tmp_sifa)))) { 3273 /* 3274 * It is restricted 3275 * for some reason.. 3276 * probably not yet 3277 * added. 3278 */ 3279 continue; 3280 } 3281 } 3282 if ((tmp_sifa->address.sin.sin_family == AF_INET) && 3283 (IN4_ISPRIVATE_ADDRESS(&(tmp_sifa->address.sin.sin_addr)))) { 3284 sctp_add_local_addr_restricted(stcb, tmp_sifa); 3285 } 3286 } 3287 } 3288 } 3289 atomic_add_int(&sifa->refcount, 1); 3290 } 3291 #endif 3292 return (sifa); 3293 } 3294 3295 /* tcb may be NULL */ 3296 struct sctp_ifa * 3297 sctp_source_address_selection(struct sctp_inpcb *inp, 3298 struct sctp_tcb *stcb, 3299 sctp_route_t *ro, 3300 struct sctp_nets *net, 3301 int non_asoc_addr_ok, uint32_t vrf_id) 3302 { 3303 struct sctp_ifa *answer; 3304 uint8_t dest_is_priv, dest_is_loop; 3305 sa_family_t fam; 3306 #ifdef INET 3307 struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst; 3308 #endif 3309 #ifdef INET6 3310 struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&ro->ro_dst; 3311 #endif 3312 3313 /** 3314 * Rules: 3315 * - Find the route if needed, cache if I can. 3316 * - Look at interface address in route, Is it in the bound list. If so we 3317 * have the best source. 3318 * - If not we must rotate amongst the addresses. 3319 * 3320 * Cavets and issues 3321 * 3322 * Do we need to pay attention to scope. We can have a private address 3323 * or a global address we are sourcing or sending to. So if we draw 3324 * it out 3325 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3326 * For V4 3327 * ------------------------------------------ 3328 * source * dest * result 3329 * ----------------------------------------- 3330 * <a> Private * Global * NAT 3331 * ----------------------------------------- 3332 * <b> Private * Private * No problem 3333 * ----------------------------------------- 3334 * <c> Global * Private * Huh, How will this work? 3335 * ----------------------------------------- 3336 * <d> Global * Global * No Problem 3337 *------------------------------------------ 3338 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3339 * For V6 3340 *------------------------------------------ 3341 * source * dest * result 3342 * ----------------------------------------- 3343 * <a> Linklocal * Global * 3344 * ----------------------------------------- 3345 * <b> Linklocal * Linklocal * No problem 3346 * ----------------------------------------- 3347 * <c> Global * Linklocal * Huh, How will this work? 3348 * ----------------------------------------- 3349 * <d> Global * Global * No Problem 3350 *------------------------------------------ 3351 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3352 * 3353 * And then we add to that what happens if there are multiple addresses 3354 * assigned to an interface. Remember the ifa on a ifn is a linked 3355 * list of addresses. So one interface can have more than one IP 3356 * address. What happens if we have both a private and a global 3357 * address? Do we then use context of destination to sort out which 3358 * one is best? And what about NAT's sending P->G may get you a NAT 3359 * translation, or should you select the G thats on the interface in 3360 * preference. 3361 * 3362 * Decisions: 3363 * 3364 * - count the number of addresses on the interface. 3365 * - if it is one, no problem except case <c>. 3366 * For <a> we will assume a NAT out there. 3367 * - if there are more than one, then we need to worry about scope P 3368 * or G. We should prefer G -> G and P -> P if possible. 3369 * Then as a secondary fall back to mixed types G->P being a last 3370 * ditch one. 3371 * - The above all works for bound all, but bound specific we need to 3372 * use the same concept but instead only consider the bound 3373 * addresses. If the bound set is NOT assigned to the interface then 3374 * we must use rotation amongst the bound addresses.. 3375 */ 3376 if (ro->ro_nh == NULL) { 3377 /* 3378 * Need a route to cache. 3379 */ 3380 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 3381 } 3382 if (ro->ro_nh == NULL) { 3383 return (NULL); 3384 } 3385 fam = ro->ro_dst.sa_family; 3386 dest_is_priv = dest_is_loop = 0; 3387 /* Setup our scopes for the destination */ 3388 switch (fam) { 3389 #ifdef INET 3390 case AF_INET: 3391 /* Scope based on outbound address */ 3392 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) { 3393 dest_is_loop = 1; 3394 if (net != NULL) { 3395 /* mark it as local */ 3396 net->addr_is_local = 1; 3397 } 3398 } else if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) { 3399 dest_is_priv = 1; 3400 } 3401 break; 3402 #endif 3403 #ifdef INET6 3404 case AF_INET6: 3405 /* Scope based on outbound address */ 3406 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr) || 3407 SCTP_ROUTE_IS_REAL_LOOP(ro)) { 3408 /* 3409 * If the address is a loopback address, which 3410 * consists of "::1" OR "fe80::1%lo0", we are 3411 * loopback scope. But we don't use dest_is_priv 3412 * (link local addresses). 3413 */ 3414 dest_is_loop = 1; 3415 if (net != NULL) { 3416 /* mark it as local */ 3417 net->addr_is_local = 1; 3418 } 3419 } else if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) { 3420 dest_is_priv = 1; 3421 } 3422 break; 3423 #endif 3424 } 3425 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Select source addr for:"); 3426 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&ro->ro_dst); 3427 SCTP_IPI_ADDR_RLOCK(); 3428 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3429 /* 3430 * Bound all case 3431 */ 3432 answer = sctp_choose_boundall(inp, stcb, net, ro, vrf_id, 3433 dest_is_priv, dest_is_loop, 3434 non_asoc_addr_ok, fam); 3435 SCTP_IPI_ADDR_RUNLOCK(); 3436 return (answer); 3437 } 3438 /* 3439 * Subset bound case 3440 */ 3441 if (stcb) { 3442 answer = sctp_choose_boundspecific_stcb(inp, stcb, ro, 3443 vrf_id, dest_is_priv, 3444 dest_is_loop, 3445 non_asoc_addr_ok, fam); 3446 } else { 3447 answer = sctp_choose_boundspecific_inp(inp, ro, vrf_id, 3448 non_asoc_addr_ok, 3449 dest_is_priv, 3450 dest_is_loop, fam); 3451 } 3452 SCTP_IPI_ADDR_RUNLOCK(); 3453 return (answer); 3454 } 3455 3456 static int 3457 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, size_t cpsize) 3458 { 3459 struct cmsghdr cmh; 3460 struct sctp_sndinfo sndinfo; 3461 struct sctp_prinfo prinfo; 3462 struct sctp_authinfo authinfo; 3463 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3464 int found; 3465 3466 /* 3467 * Independent of how many mbufs, find the c_type inside the control 3468 * structure and copy out the data. 3469 */ 3470 found = 0; 3471 tot_len = SCTP_BUF_LEN(control); 3472 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3473 rem_len = tot_len - off; 3474 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3475 /* There is not enough room for one more. */ 3476 return (found); 3477 } 3478 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3479 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3480 /* We dont't have a complete CMSG header. */ 3481 return (found); 3482 } 3483 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3484 /* We don't have the complete CMSG. */ 3485 return (found); 3486 } 3487 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3488 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3489 if ((cmh.cmsg_level == IPPROTO_SCTP) && 3490 ((c_type == cmh.cmsg_type) || 3491 ((c_type == SCTP_SNDRCV) && 3492 ((cmh.cmsg_type == SCTP_SNDINFO) || 3493 (cmh.cmsg_type == SCTP_PRINFO) || 3494 (cmh.cmsg_type == SCTP_AUTHINFO))))) { 3495 if (c_type == cmh.cmsg_type) { 3496 if (cpsize > INT_MAX) { 3497 return (found); 3498 } 3499 if (cmsg_data_len < (int)cpsize) { 3500 return (found); 3501 } 3502 /* It is exactly what we want. Copy it out. */ 3503 m_copydata(control, cmsg_data_off, (int)cpsize, (caddr_t)data); 3504 return (1); 3505 } else { 3506 struct sctp_sndrcvinfo *sndrcvinfo; 3507 3508 sndrcvinfo = (struct sctp_sndrcvinfo *)data; 3509 if (found == 0) { 3510 if (cpsize < sizeof(struct sctp_sndrcvinfo)) { 3511 return (found); 3512 } 3513 memset(sndrcvinfo, 0, sizeof(struct sctp_sndrcvinfo)); 3514 } 3515 switch (cmh.cmsg_type) { 3516 case SCTP_SNDINFO: 3517 if (cmsg_data_len < (int)sizeof(struct sctp_sndinfo)) { 3518 return (found); 3519 } 3520 m_copydata(control, cmsg_data_off, sizeof(struct sctp_sndinfo), (caddr_t)&sndinfo); 3521 sndrcvinfo->sinfo_stream = sndinfo.snd_sid; 3522 sndrcvinfo->sinfo_flags = sndinfo.snd_flags; 3523 sndrcvinfo->sinfo_ppid = sndinfo.snd_ppid; 3524 sndrcvinfo->sinfo_context = sndinfo.snd_context; 3525 sndrcvinfo->sinfo_assoc_id = sndinfo.snd_assoc_id; 3526 break; 3527 case SCTP_PRINFO: 3528 if (cmsg_data_len < (int)sizeof(struct sctp_prinfo)) { 3529 return (found); 3530 } 3531 m_copydata(control, cmsg_data_off, sizeof(struct sctp_prinfo), (caddr_t)&prinfo); 3532 if (prinfo.pr_policy != SCTP_PR_SCTP_NONE) { 3533 sndrcvinfo->sinfo_timetolive = prinfo.pr_value; 3534 } else { 3535 sndrcvinfo->sinfo_timetolive = 0; 3536 } 3537 sndrcvinfo->sinfo_flags |= prinfo.pr_policy; 3538 break; 3539 case SCTP_AUTHINFO: 3540 if (cmsg_data_len < (int)sizeof(struct sctp_authinfo)) { 3541 return (found); 3542 } 3543 m_copydata(control, cmsg_data_off, sizeof(struct sctp_authinfo), (caddr_t)&authinfo); 3544 sndrcvinfo->sinfo_keynumber_valid = 1; 3545 sndrcvinfo->sinfo_keynumber = authinfo.auth_keynumber; 3546 break; 3547 default: 3548 return (found); 3549 } 3550 found = 1; 3551 } 3552 } 3553 } 3554 return (found); 3555 } 3556 3557 static int 3558 sctp_process_cmsgs_for_init(struct sctp_tcb *stcb, struct mbuf *control, int *error) 3559 { 3560 struct cmsghdr cmh; 3561 struct sctp_initmsg initmsg; 3562 #ifdef INET 3563 struct sockaddr_in sin; 3564 #endif 3565 #ifdef INET6 3566 struct sockaddr_in6 sin6; 3567 #endif 3568 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3569 3570 tot_len = SCTP_BUF_LEN(control); 3571 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3572 rem_len = tot_len - off; 3573 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3574 /* There is not enough room for one more. */ 3575 *error = EINVAL; 3576 return (1); 3577 } 3578 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3579 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3580 /* We dont't have a complete CMSG header. */ 3581 *error = EINVAL; 3582 return (1); 3583 } 3584 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3585 /* We don't have the complete CMSG. */ 3586 *error = EINVAL; 3587 return (1); 3588 } 3589 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3590 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3591 if (cmh.cmsg_level == IPPROTO_SCTP) { 3592 switch (cmh.cmsg_type) { 3593 case SCTP_INIT: 3594 if (cmsg_data_len < (int)sizeof(struct sctp_initmsg)) { 3595 *error = EINVAL; 3596 return (1); 3597 } 3598 m_copydata(control, cmsg_data_off, sizeof(struct sctp_initmsg), (caddr_t)&initmsg); 3599 if (initmsg.sinit_max_attempts) 3600 stcb->asoc.max_init_times = initmsg.sinit_max_attempts; 3601 if (initmsg.sinit_num_ostreams) 3602 stcb->asoc.pre_open_streams = initmsg.sinit_num_ostreams; 3603 if (initmsg.sinit_max_instreams) 3604 stcb->asoc.max_inbound_streams = initmsg.sinit_max_instreams; 3605 if (initmsg.sinit_max_init_timeo) 3606 stcb->asoc.initial_init_rto_max = initmsg.sinit_max_init_timeo; 3607 if (stcb->asoc.streamoutcnt < stcb->asoc.pre_open_streams) { 3608 struct sctp_stream_out *tmp_str; 3609 unsigned int i; 3610 #if defined(SCTP_DETAILED_STR_STATS) 3611 int j; 3612 #endif 3613 3614 /* Default is NOT correct */ 3615 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, default:%d pre_open:%d\n", 3616 stcb->asoc.streamoutcnt, stcb->asoc.pre_open_streams); 3617 SCTP_TCB_UNLOCK(stcb); 3618 SCTP_MALLOC(tmp_str, 3619 struct sctp_stream_out *, 3620 (stcb->asoc.pre_open_streams * sizeof(struct sctp_stream_out)), 3621 SCTP_M_STRMO); 3622 SCTP_TCB_LOCK(stcb); 3623 if (tmp_str != NULL) { 3624 SCTP_FREE(stcb->asoc.strmout, SCTP_M_STRMO); 3625 stcb->asoc.strmout = tmp_str; 3626 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt = stcb->asoc.pre_open_streams; 3627 } else { 3628 stcb->asoc.pre_open_streams = stcb->asoc.streamoutcnt; 3629 } 3630 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3631 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 3632 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 3633 stcb->asoc.strmout[i].chunks_on_queues = 0; 3634 #if defined(SCTP_DETAILED_STR_STATS) 3635 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 3636 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 3637 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 3638 } 3639 #else 3640 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 3641 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 3642 #endif 3643 stcb->asoc.strmout[i].next_mid_ordered = 0; 3644 stcb->asoc.strmout[i].next_mid_unordered = 0; 3645 stcb->asoc.strmout[i].sid = i; 3646 stcb->asoc.strmout[i].last_msg_incomplete = 0; 3647 stcb->asoc.strmout[i].state = SCTP_STREAM_OPENING; 3648 } 3649 } 3650 break; 3651 #ifdef INET 3652 case SCTP_DSTADDRV4: 3653 if (cmsg_data_len < (int)sizeof(struct in_addr)) { 3654 *error = EINVAL; 3655 return (1); 3656 } 3657 memset(&sin, 0, sizeof(struct sockaddr_in)); 3658 sin.sin_family = AF_INET; 3659 sin.sin_len = sizeof(struct sockaddr_in); 3660 sin.sin_port = stcb->rport; 3661 m_copydata(control, cmsg_data_off, sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3662 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3663 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3664 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3665 *error = EINVAL; 3666 return (1); 3667 } 3668 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3669 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3670 *error = ENOBUFS; 3671 return (1); 3672 } 3673 break; 3674 #endif 3675 #ifdef INET6 3676 case SCTP_DSTADDRV6: 3677 if (cmsg_data_len < (int)sizeof(struct in6_addr)) { 3678 *error = EINVAL; 3679 return (1); 3680 } 3681 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3682 sin6.sin6_family = AF_INET6; 3683 sin6.sin6_len = sizeof(struct sockaddr_in6); 3684 sin6.sin6_port = stcb->rport; 3685 m_copydata(control, cmsg_data_off, sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3686 if (IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr) || 3687 IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) { 3688 *error = EINVAL; 3689 return (1); 3690 } 3691 #ifdef INET 3692 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3693 in6_sin6_2_sin(&sin, &sin6); 3694 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3695 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3696 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3697 *error = EINVAL; 3698 return (1); 3699 } 3700 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3701 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3702 *error = ENOBUFS; 3703 return (1); 3704 } 3705 } else 3706 #endif 3707 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin6, NULL, stcb->asoc.port, 3708 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3709 *error = ENOBUFS; 3710 return (1); 3711 } 3712 break; 3713 #endif 3714 default: 3715 break; 3716 } 3717 } 3718 } 3719 return (0); 3720 } 3721 3722 #if defined(INET) || defined(INET6) 3723 static struct sctp_tcb * 3724 sctp_findassociation_cmsgs(struct sctp_inpcb **inp_p, 3725 uint16_t port, 3726 struct mbuf *control, 3727 struct sctp_nets **net_p, 3728 int *error) 3729 { 3730 struct cmsghdr cmh; 3731 struct sctp_tcb *stcb; 3732 struct sockaddr *addr; 3733 #ifdef INET 3734 struct sockaddr_in sin; 3735 #endif 3736 #ifdef INET6 3737 struct sockaddr_in6 sin6; 3738 #endif 3739 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3740 3741 tot_len = SCTP_BUF_LEN(control); 3742 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3743 rem_len = tot_len - off; 3744 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3745 /* There is not enough room for one more. */ 3746 *error = EINVAL; 3747 return (NULL); 3748 } 3749 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3750 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3751 /* We dont't have a complete CMSG header. */ 3752 *error = EINVAL; 3753 return (NULL); 3754 } 3755 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3756 /* We don't have the complete CMSG. */ 3757 *error = EINVAL; 3758 return (NULL); 3759 } 3760 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3761 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3762 if (cmh.cmsg_level == IPPROTO_SCTP) { 3763 switch (cmh.cmsg_type) { 3764 #ifdef INET 3765 case SCTP_DSTADDRV4: 3766 if (cmsg_data_len < (int)sizeof(struct in_addr)) { 3767 *error = EINVAL; 3768 return (NULL); 3769 } 3770 memset(&sin, 0, sizeof(struct sockaddr_in)); 3771 sin.sin_family = AF_INET; 3772 sin.sin_len = sizeof(struct sockaddr_in); 3773 sin.sin_port = port; 3774 m_copydata(control, cmsg_data_off, sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3775 addr = (struct sockaddr *)&sin; 3776 break; 3777 #endif 3778 #ifdef INET6 3779 case SCTP_DSTADDRV6: 3780 if (cmsg_data_len < (int)sizeof(struct in6_addr)) { 3781 *error = EINVAL; 3782 return (NULL); 3783 } 3784 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3785 sin6.sin6_family = AF_INET6; 3786 sin6.sin6_len = sizeof(struct sockaddr_in6); 3787 sin6.sin6_port = port; 3788 m_copydata(control, cmsg_data_off, sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3789 #ifdef INET 3790 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3791 in6_sin6_2_sin(&sin, &sin6); 3792 addr = (struct sockaddr *)&sin; 3793 } else 3794 #endif 3795 addr = (struct sockaddr *)&sin6; 3796 break; 3797 #endif 3798 default: 3799 addr = NULL; 3800 break; 3801 } 3802 if (addr) { 3803 stcb = sctp_findassociation_ep_addr(inp_p, addr, net_p, NULL, NULL); 3804 if (stcb != NULL) { 3805 return (stcb); 3806 } 3807 } 3808 } 3809 } 3810 return (NULL); 3811 } 3812 #endif 3813 3814 static struct mbuf * 3815 sctp_add_cookie(struct mbuf *init, int init_offset, 3816 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in, uint8_t **signature) 3817 { 3818 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 3819 struct sctp_state_cookie *stc; 3820 struct sctp_paramhdr *ph; 3821 uint16_t cookie_sz; 3822 3823 mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) + 3824 sizeof(struct sctp_paramhdr)), 0, 3825 M_NOWAIT, 1, MT_DATA); 3826 if (mret == NULL) { 3827 return (NULL); 3828 } 3829 copy_init = SCTP_M_COPYM(init, init_offset, M_COPYALL, M_NOWAIT); 3830 if (copy_init == NULL) { 3831 sctp_m_freem(mret); 3832 return (NULL); 3833 } 3834 #ifdef SCTP_MBUF_LOGGING 3835 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3836 sctp_log_mbc(copy_init, SCTP_MBUF_ICOPY); 3837 } 3838 #endif 3839 copy_initack = SCTP_M_COPYM(initack, initack_offset, M_COPYALL, 3840 M_NOWAIT); 3841 if (copy_initack == NULL) { 3842 sctp_m_freem(mret); 3843 sctp_m_freem(copy_init); 3844 return (NULL); 3845 } 3846 #ifdef SCTP_MBUF_LOGGING 3847 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3848 sctp_log_mbc(copy_initack, SCTP_MBUF_ICOPY); 3849 } 3850 #endif 3851 /* easy side we just drop it on the end */ 3852 ph = mtod(mret, struct sctp_paramhdr *); 3853 SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) + 3854 sizeof(struct sctp_paramhdr); 3855 stc = (struct sctp_state_cookie *)((caddr_t)ph + 3856 sizeof(struct sctp_paramhdr)); 3857 ph->param_type = htons(SCTP_STATE_COOKIE); 3858 ph->param_length = 0; /* fill in at the end */ 3859 /* Fill in the stc cookie data */ 3860 memcpy(stc, stc_in, sizeof(struct sctp_state_cookie)); 3861 3862 /* tack the INIT and then the INIT-ACK onto the chain */ 3863 cookie_sz = 0; 3864 for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3865 cookie_sz += SCTP_BUF_LEN(m_at); 3866 if (SCTP_BUF_NEXT(m_at) == NULL) { 3867 SCTP_BUF_NEXT(m_at) = copy_init; 3868 break; 3869 } 3870 } 3871 for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3872 cookie_sz += SCTP_BUF_LEN(m_at); 3873 if (SCTP_BUF_NEXT(m_at) == NULL) { 3874 SCTP_BUF_NEXT(m_at) = copy_initack; 3875 break; 3876 } 3877 } 3878 for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3879 cookie_sz += SCTP_BUF_LEN(m_at); 3880 if (SCTP_BUF_NEXT(m_at) == NULL) { 3881 break; 3882 } 3883 } 3884 sig = sctp_get_mbuf_for_msg(SCTP_SIGNATURE_SIZE, 0, M_NOWAIT, 1, MT_DATA); 3885 if (sig == NULL) { 3886 /* no space, so free the entire chain */ 3887 sctp_m_freem(mret); 3888 return (NULL); 3889 } 3890 SCTP_BUF_NEXT(m_at) = sig; 3891 SCTP_BUF_LEN(sig) = SCTP_SIGNATURE_SIZE; 3892 cookie_sz += SCTP_SIGNATURE_SIZE; 3893 ph->param_length = htons(cookie_sz); 3894 *signature = (uint8_t *)mtod(sig, caddr_t); 3895 memset(*signature, 0, SCTP_SIGNATURE_SIZE); 3896 return (mret); 3897 } 3898 3899 static uint8_t 3900 sctp_get_ect(struct sctp_tcb *stcb) 3901 { 3902 if ((stcb != NULL) && (stcb->asoc.ecn_supported == 1)) { 3903 return (SCTP_ECT0_BIT); 3904 } else { 3905 return (0); 3906 } 3907 } 3908 3909 #if defined(INET) || defined(INET6) 3910 static void 3911 sctp_handle_no_route(struct sctp_tcb *stcb, 3912 struct sctp_nets *net, 3913 int so_locked) 3914 { 3915 SCTPDBG(SCTP_DEBUG_OUTPUT1, "dropped packet - no valid source addr\n"); 3916 3917 if (net) { 3918 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Destination was "); 3919 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT1, &net->ro._l_addr.sa); 3920 if (net->dest_state & SCTP_ADDR_CONFIRMED) { 3921 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) { 3922 SCTPDBG(SCTP_DEBUG_OUTPUT1, "no route takes interface %p down\n", (void *)net); 3923 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 3924 stcb, 0, 3925 (void *)net, 3926 so_locked); 3927 net->dest_state &= ~SCTP_ADDR_REACHABLE; 3928 net->dest_state &= ~SCTP_ADDR_PF; 3929 } 3930 } 3931 if (stcb) { 3932 if (net == stcb->asoc.primary_destination) { 3933 /* need a new primary */ 3934 struct sctp_nets *alt; 3935 3936 alt = sctp_find_alternate_net(stcb, net, 0); 3937 if (alt != net) { 3938 if (stcb->asoc.alternate) { 3939 sctp_free_remote_addr(stcb->asoc.alternate); 3940 } 3941 stcb->asoc.alternate = alt; 3942 atomic_add_int(&stcb->asoc.alternate->ref_count, 1); 3943 if (net->ro._s_addr) { 3944 sctp_free_ifa(net->ro._s_addr); 3945 net->ro._s_addr = NULL; 3946 } 3947 net->src_addr_selected = 0; 3948 } 3949 } 3950 } 3951 } 3952 } 3953 #endif 3954 3955 static int 3956 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 3957 struct sctp_tcb *stcb, /* may be NULL */ 3958 struct sctp_nets *net, 3959 struct sockaddr *to, 3960 struct mbuf *m, 3961 uint32_t auth_offset, 3962 struct sctp_auth_chunk *auth, 3963 uint16_t auth_keyid, 3964 int nofragment_flag, 3965 int ecn_ok, 3966 int out_of_asoc_ok, 3967 uint16_t src_port, 3968 uint16_t dest_port, 3969 uint32_t v_tag, 3970 uint16_t port, 3971 union sctp_sockstore *over_addr, 3972 uint8_t mflowtype, uint32_t mflowid, 3973 int so_locked) 3974 { 3975 /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 3976 /** 3977 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet header 3978 * WITH an SCTPHDR but no IP header, endpoint inp and sa structure: 3979 * - fill in the HMAC digest of any AUTH chunk in the packet. 3980 * - calculate and fill in the SCTP checksum. 3981 * - prepend an IP address header. 3982 * - if boundall use INADDR_ANY. 3983 * - if boundspecific do source address selection. 3984 * - set fragmentation option for ipV4. 3985 * - On return from IP output, check/adjust mtu size of output 3986 * interface and smallest_mtu size as well. 3987 */ 3988 /* Will need ifdefs around this */ 3989 struct mbuf *newm; 3990 struct sctphdr *sctphdr; 3991 int packet_length; 3992 int ret; 3993 #if defined(INET) || defined(INET6) 3994 uint32_t vrf_id; 3995 #endif 3996 #if defined(INET) || defined(INET6) 3997 struct mbuf *o_pak; 3998 sctp_route_t *ro = NULL; 3999 struct udphdr *udp = NULL; 4000 #endif 4001 uint8_t tos_value; 4002 4003 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 4004 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4005 sctp_m_freem(m); 4006 return (EFAULT); 4007 } 4008 #if defined(INET) || defined(INET6) 4009 if (stcb) { 4010 vrf_id = stcb->asoc.vrf_id; 4011 } else { 4012 vrf_id = inp->def_vrf_id; 4013 } 4014 #endif 4015 /* fill in the HMAC digest for any AUTH chunk in the packet */ 4016 if ((auth != NULL) && (stcb != NULL)) { 4017 sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb, auth_keyid); 4018 } 4019 4020 if (net) { 4021 tos_value = net->dscp; 4022 } else if (stcb) { 4023 tos_value = stcb->asoc.default_dscp; 4024 } else { 4025 tos_value = inp->sctp_ep.default_dscp; 4026 } 4027 4028 switch (to->sa_family) { 4029 #ifdef INET 4030 case AF_INET: 4031 { 4032 struct ip *ip = NULL; 4033 sctp_route_t iproute; 4034 int len; 4035 4036 len = SCTP_MIN_V4_OVERHEAD; 4037 if (port) { 4038 len += sizeof(struct udphdr); 4039 } 4040 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4041 if (newm == NULL) { 4042 sctp_m_freem(m); 4043 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4044 return (ENOMEM); 4045 } 4046 SCTP_ALIGN_TO_END(newm, len); 4047 SCTP_BUF_LEN(newm) = len; 4048 SCTP_BUF_NEXT(newm) = m; 4049 m = newm; 4050 if (net != NULL) { 4051 m->m_pkthdr.flowid = net->flowid; 4052 M_HASHTYPE_SET(m, net->flowtype); 4053 } else { 4054 m->m_pkthdr.flowid = mflowid; 4055 M_HASHTYPE_SET(m, mflowtype); 4056 } 4057 packet_length = sctp_calculate_len(m); 4058 ip = mtod(m, struct ip *); 4059 ip->ip_v = IPVERSION; 4060 ip->ip_hl = (sizeof(struct ip) >> 2); 4061 if (tos_value == 0) { 4062 /* 4063 * This means especially, that it is not set 4064 * at the SCTP layer. So use the value from 4065 * the IP layer. 4066 */ 4067 tos_value = inp->ip_inp.inp.inp_ip_tos; 4068 } 4069 tos_value &= 0xfc; 4070 if (ecn_ok) { 4071 tos_value |= sctp_get_ect(stcb); 4072 } 4073 if ((nofragment_flag) && (port == 0)) { 4074 ip->ip_off = htons(IP_DF); 4075 } else { 4076 ip->ip_off = htons(0); 4077 } 4078 /* FreeBSD has a function for ip_id's */ 4079 ip_fillid(ip); 4080 4081 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl; 4082 ip->ip_len = htons(packet_length); 4083 ip->ip_tos = tos_value; 4084 if (port) { 4085 ip->ip_p = IPPROTO_UDP; 4086 } else { 4087 ip->ip_p = IPPROTO_SCTP; 4088 } 4089 ip->ip_sum = 0; 4090 if (net == NULL) { 4091 ro = &iproute; 4092 memset(&iproute, 0, sizeof(iproute)); 4093 memcpy(&ro->ro_dst, to, to->sa_len); 4094 } else { 4095 ro = (sctp_route_t *)&net->ro; 4096 } 4097 /* Now the address selection part */ 4098 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr; 4099 4100 /* call the routine to select the src address */ 4101 if (net && out_of_asoc_ok == 0) { 4102 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4103 sctp_free_ifa(net->ro._s_addr); 4104 net->ro._s_addr = NULL; 4105 net->src_addr_selected = 0; 4106 RO_NHFREE(ro); 4107 } 4108 if (net->src_addr_selected == 0) { 4109 /* Cache the source address */ 4110 net->ro._s_addr = sctp_source_address_selection(inp, stcb, 4111 ro, net, 0, 4112 vrf_id); 4113 net->src_addr_selected = 1; 4114 } 4115 if (net->ro._s_addr == NULL) { 4116 /* No route to host */ 4117 net->src_addr_selected = 0; 4118 sctp_handle_no_route(stcb, net, so_locked); 4119 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4120 sctp_m_freem(m); 4121 return (EHOSTUNREACH); 4122 } 4123 ip->ip_src = net->ro._s_addr->address.sin.sin_addr; 4124 } else { 4125 if (over_addr == NULL) { 4126 struct sctp_ifa *_lsrc; 4127 4128 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4129 net, 4130 out_of_asoc_ok, 4131 vrf_id); 4132 if (_lsrc == NULL) { 4133 sctp_handle_no_route(stcb, net, so_locked); 4134 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4135 sctp_m_freem(m); 4136 return (EHOSTUNREACH); 4137 } 4138 ip->ip_src = _lsrc->address.sin.sin_addr; 4139 sctp_free_ifa(_lsrc); 4140 } else { 4141 ip->ip_src = over_addr->sin.sin_addr; 4142 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4143 } 4144 } 4145 if (port) { 4146 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4147 sctp_handle_no_route(stcb, net, so_locked); 4148 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4149 sctp_m_freem(m); 4150 return (EHOSTUNREACH); 4151 } 4152 udp = (struct udphdr *)((caddr_t)ip + sizeof(struct ip)); 4153 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4154 udp->uh_dport = port; 4155 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip))); 4156 if (V_udp_cksum) { 4157 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 4158 } else { 4159 udp->uh_sum = 0; 4160 } 4161 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4162 } else { 4163 sctphdr = (struct sctphdr *)((caddr_t)ip + sizeof(struct ip)); 4164 } 4165 4166 sctphdr->src_port = src_port; 4167 sctphdr->dest_port = dest_port; 4168 sctphdr->v_tag = v_tag; 4169 sctphdr->checksum = 0; 4170 4171 /* 4172 * If source address selection fails and we find no 4173 * route then the ip_output should fail as well with 4174 * a NO_ROUTE_TO_HOST type error. We probably should 4175 * catch that somewhere and abort the association 4176 * right away (assuming this is an INIT being sent). 4177 */ 4178 if (ro->ro_nh == NULL) { 4179 /* 4180 * src addr selection failed to find a route 4181 * (or valid source addr), so we can't get 4182 * there from here (yet)! 4183 */ 4184 sctp_handle_no_route(stcb, net, so_locked); 4185 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4186 sctp_m_freem(m); 4187 return (EHOSTUNREACH); 4188 } 4189 if (ro != &iproute) { 4190 memcpy(&iproute, ro, sizeof(*ro)); 4191 } 4192 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv4 output routine from low level src addr:%x\n", 4193 (uint32_t)(ntohl(ip->ip_src.s_addr))); 4194 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Destination is %x\n", 4195 (uint32_t)(ntohl(ip->ip_dst.s_addr))); 4196 SCTPDBG(SCTP_DEBUG_OUTPUT3, "RTP route is %p through\n", 4197 (void *)ro->ro_nh); 4198 4199 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4200 /* failed to prepend data, give up */ 4201 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4202 sctp_m_freem(m); 4203 return (ENOMEM); 4204 } 4205 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4206 if (port) { 4207 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip) + sizeof(struct udphdr)); 4208 SCTP_STAT_INCR(sctps_sendswcrc); 4209 if (V_udp_cksum) { 4210 SCTP_ENABLE_UDP_CSUM(o_pak); 4211 } 4212 } else { 4213 m->m_pkthdr.csum_flags = CSUM_SCTP; 4214 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4215 SCTP_STAT_INCR(sctps_sendhwcrc); 4216 } 4217 #ifdef SCTP_PACKET_LOGGING 4218 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4219 sctp_packet_log(o_pak); 4220 #endif 4221 /* send it out. table id is taken from stcb */ 4222 SCTP_PROBE5(send, NULL, stcb, ip, stcb, sctphdr); 4223 SCTP_IP_OUTPUT(ret, o_pak, ro, inp, vrf_id); 4224 if (port) { 4225 UDPSTAT_INC(udps_opackets); 4226 } 4227 SCTP_STAT_INCR(sctps_sendpackets); 4228 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4229 if (ret) 4230 SCTP_STAT_INCR(sctps_senderrors); 4231 4232 SCTPDBG(SCTP_DEBUG_OUTPUT3, "IP output returns %d\n", ret); 4233 if (net == NULL) { 4234 /* free tempy routes */ 4235 RO_NHFREE(ro); 4236 } else { 4237 if ((ro->ro_nh != NULL) && (net->ro._s_addr) && 4238 ((net->dest_state & SCTP_ADDR_NO_PMTUD) == 0)) { 4239 uint32_t mtu; 4240 4241 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_nh); 4242 if (mtu > 0) { 4243 if (net->port) { 4244 mtu -= sizeof(struct udphdr); 4245 } 4246 if (mtu < net->mtu) { 4247 if ((stcb != NULL) && (stcb->asoc.smallest_mtu > mtu)) { 4248 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4249 } 4250 net->mtu = mtu; 4251 } 4252 } 4253 } else if (ro->ro_nh == NULL) { 4254 /* route was freed */ 4255 if (net->ro._s_addr && 4256 net->src_addr_selected) { 4257 sctp_free_ifa(net->ro._s_addr); 4258 net->ro._s_addr = NULL; 4259 } 4260 net->src_addr_selected = 0; 4261 } 4262 } 4263 return (ret); 4264 } 4265 #endif 4266 #ifdef INET6 4267 case AF_INET6: 4268 { 4269 uint32_t flowlabel, flowinfo; 4270 struct ip6_hdr *ip6h; 4271 struct route_in6 ip6route; 4272 struct ifnet *ifp; 4273 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 4274 int prev_scope = 0; 4275 struct sockaddr_in6 lsa6_storage; 4276 int error; 4277 u_short prev_port = 0; 4278 int len; 4279 4280 if (net) { 4281 flowlabel = net->flowlabel; 4282 } else if (stcb) { 4283 flowlabel = stcb->asoc.default_flowlabel; 4284 } else { 4285 flowlabel = inp->sctp_ep.default_flowlabel; 4286 } 4287 if (flowlabel == 0) { 4288 /* 4289 * This means especially, that it is not set 4290 * at the SCTP layer. So use the value from 4291 * the IP layer. 4292 */ 4293 flowlabel = ntohl(((struct inpcb *)inp)->inp_flow); 4294 } 4295 flowlabel &= 0x000fffff; 4296 len = SCTP_MIN_OVERHEAD; 4297 if (port) { 4298 len += sizeof(struct udphdr); 4299 } 4300 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4301 if (newm == NULL) { 4302 sctp_m_freem(m); 4303 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4304 return (ENOMEM); 4305 } 4306 SCTP_ALIGN_TO_END(newm, len); 4307 SCTP_BUF_LEN(newm) = len; 4308 SCTP_BUF_NEXT(newm) = m; 4309 m = newm; 4310 if (net != NULL) { 4311 m->m_pkthdr.flowid = net->flowid; 4312 M_HASHTYPE_SET(m, net->flowtype); 4313 } else { 4314 m->m_pkthdr.flowid = mflowid; 4315 M_HASHTYPE_SET(m, mflowtype); 4316 } 4317 packet_length = sctp_calculate_len(m); 4318 4319 ip6h = mtod(m, struct ip6_hdr *); 4320 /* protect *sin6 from overwrite */ 4321 sin6 = (struct sockaddr_in6 *)to; 4322 tmp = *sin6; 4323 sin6 = &tmp; 4324 4325 /* KAME hack: embed scopeid */ 4326 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4327 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4328 sctp_m_freem(m); 4329 return (EINVAL); 4330 } 4331 if (net == NULL) { 4332 memset(&ip6route, 0, sizeof(ip6route)); 4333 ro = (sctp_route_t *)&ip6route; 4334 memcpy(&ro->ro_dst, sin6, sin6->sin6_len); 4335 } else { 4336 ro = (sctp_route_t *)&net->ro; 4337 } 4338 /* 4339 * We assume here that inp_flow is in host byte 4340 * order within the TCB! 4341 */ 4342 if (tos_value == 0) { 4343 /* 4344 * This means especially, that it is not set 4345 * at the SCTP layer. So use the value from 4346 * the IP layer. 4347 */ 4348 tos_value = (ntohl(((struct inpcb *)inp)->inp_flow) >> 20) & 0xff; 4349 } 4350 tos_value &= 0xfc; 4351 if (ecn_ok) { 4352 tos_value |= sctp_get_ect(stcb); 4353 } 4354 flowinfo = 0x06; 4355 flowinfo <<= 8; 4356 flowinfo |= tos_value; 4357 flowinfo <<= 20; 4358 flowinfo |= flowlabel; 4359 ip6h->ip6_flow = htonl(flowinfo); 4360 if (port) { 4361 ip6h->ip6_nxt = IPPROTO_UDP; 4362 } else { 4363 ip6h->ip6_nxt = IPPROTO_SCTP; 4364 } 4365 ip6h->ip6_plen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4366 ip6h->ip6_dst = sin6->sin6_addr; 4367 4368 /* 4369 * Add SRC address selection here: we can only reuse 4370 * to a limited degree the kame src-addr-sel, since 4371 * we can try their selection but it may not be 4372 * bound. 4373 */ 4374 memset(&lsa6_tmp, 0, sizeof(lsa6_tmp)); 4375 lsa6_tmp.sin6_family = AF_INET6; 4376 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 4377 lsa6 = &lsa6_tmp; 4378 if (net && out_of_asoc_ok == 0) { 4379 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4380 sctp_free_ifa(net->ro._s_addr); 4381 net->ro._s_addr = NULL; 4382 net->src_addr_selected = 0; 4383 RO_NHFREE(ro); 4384 } 4385 if (net->src_addr_selected == 0) { 4386 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4387 /* KAME hack: embed scopeid */ 4388 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4389 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4390 sctp_m_freem(m); 4391 return (EINVAL); 4392 } 4393 /* Cache the source address */ 4394 net->ro._s_addr = sctp_source_address_selection(inp, 4395 stcb, 4396 ro, 4397 net, 4398 0, 4399 vrf_id); 4400 (void)sa6_recoverscope(sin6); 4401 net->src_addr_selected = 1; 4402 } 4403 if (net->ro._s_addr == NULL) { 4404 SCTPDBG(SCTP_DEBUG_OUTPUT3, "V6:No route to host\n"); 4405 net->src_addr_selected = 0; 4406 sctp_handle_no_route(stcb, net, so_locked); 4407 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4408 sctp_m_freem(m); 4409 return (EHOSTUNREACH); 4410 } 4411 lsa6->sin6_addr = net->ro._s_addr->address.sin6.sin6_addr; 4412 } else { 4413 sin6 = (struct sockaddr_in6 *)&ro->ro_dst; 4414 /* KAME hack: embed scopeid */ 4415 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4416 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4417 sctp_m_freem(m); 4418 return (EINVAL); 4419 } 4420 if (over_addr == NULL) { 4421 struct sctp_ifa *_lsrc; 4422 4423 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4424 net, 4425 out_of_asoc_ok, 4426 vrf_id); 4427 if (_lsrc == NULL) { 4428 sctp_handle_no_route(stcb, net, so_locked); 4429 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4430 sctp_m_freem(m); 4431 return (EHOSTUNREACH); 4432 } 4433 lsa6->sin6_addr = _lsrc->address.sin6.sin6_addr; 4434 sctp_free_ifa(_lsrc); 4435 } else { 4436 lsa6->sin6_addr = over_addr->sin6.sin6_addr; 4437 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4438 } 4439 (void)sa6_recoverscope(sin6); 4440 } 4441 lsa6->sin6_port = inp->sctp_lport; 4442 4443 if (ro->ro_nh == NULL) { 4444 /* 4445 * src addr selection failed to find a route 4446 * (or valid source addr), so we can't get 4447 * there from here! 4448 */ 4449 sctp_handle_no_route(stcb, net, so_locked); 4450 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4451 sctp_m_freem(m); 4452 return (EHOSTUNREACH); 4453 } 4454 /* 4455 * XXX: sa6 may not have a valid sin6_scope_id in 4456 * the non-SCOPEDROUTING case. 4457 */ 4458 memset(&lsa6_storage, 0, sizeof(lsa6_storage)); 4459 lsa6_storage.sin6_family = AF_INET6; 4460 lsa6_storage.sin6_len = sizeof(lsa6_storage); 4461 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4462 if ((error = sa6_recoverscope(&lsa6_storage)) != 0) { 4463 SCTPDBG(SCTP_DEBUG_OUTPUT3, "recover scope fails error %d\n", error); 4464 sctp_m_freem(m); 4465 return (error); 4466 } 4467 /* XXX */ 4468 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4469 lsa6_storage.sin6_port = inp->sctp_lport; 4470 lsa6 = &lsa6_storage; 4471 ip6h->ip6_src = lsa6->sin6_addr; 4472 4473 if (port) { 4474 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4475 sctp_handle_no_route(stcb, net, so_locked); 4476 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4477 sctp_m_freem(m); 4478 return (EHOSTUNREACH); 4479 } 4480 udp = (struct udphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4481 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4482 udp->uh_dport = port; 4483 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4484 udp->uh_sum = 0; 4485 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4486 } else { 4487 sctphdr = (struct sctphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4488 } 4489 4490 sctphdr->src_port = src_port; 4491 sctphdr->dest_port = dest_port; 4492 sctphdr->v_tag = v_tag; 4493 sctphdr->checksum = 0; 4494 4495 /* 4496 * We set the hop limit now since there is a good 4497 * chance that our ro pointer is now filled 4498 */ 4499 ip6h->ip6_hlim = SCTP_GET_HLIM(inp, ro); 4500 ifp = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 4501 4502 #ifdef SCTP_DEBUG 4503 /* Copy to be sure something bad is not happening */ 4504 sin6->sin6_addr = ip6h->ip6_dst; 4505 lsa6->sin6_addr = ip6h->ip6_src; 4506 #endif 4507 4508 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv6 output routine from low level\n"); 4509 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src: "); 4510 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)lsa6); 4511 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst: "); 4512 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)sin6); 4513 if (net) { 4514 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4515 /* 4516 * preserve the port and scope for link 4517 * local send 4518 */ 4519 prev_scope = sin6->sin6_scope_id; 4520 prev_port = sin6->sin6_port; 4521 } 4522 4523 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4524 /* failed to prepend data, give up */ 4525 sctp_m_freem(m); 4526 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4527 return (ENOMEM); 4528 } 4529 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4530 if (port) { 4531 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 4532 SCTP_STAT_INCR(sctps_sendswcrc); 4533 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), packet_length - sizeof(struct ip6_hdr))) == 0) { 4534 udp->uh_sum = 0xffff; 4535 } 4536 } else { 4537 m->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 4538 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4539 SCTP_STAT_INCR(sctps_sendhwcrc); 4540 } 4541 /* send it out. table id is taken from stcb */ 4542 #ifdef SCTP_PACKET_LOGGING 4543 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4544 sctp_packet_log(o_pak); 4545 #endif 4546 SCTP_PROBE5(send, NULL, stcb, ip6h, stcb, sctphdr); 4547 SCTP_IP6_OUTPUT(ret, o_pak, (struct route_in6 *)ro, &ifp, inp, vrf_id); 4548 if (net) { 4549 /* for link local this must be done */ 4550 sin6->sin6_scope_id = prev_scope; 4551 sin6->sin6_port = prev_port; 4552 } 4553 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 4554 if (port) { 4555 UDPSTAT_INC(udps_opackets); 4556 } 4557 SCTP_STAT_INCR(sctps_sendpackets); 4558 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4559 if (ret) { 4560 SCTP_STAT_INCR(sctps_senderrors); 4561 } 4562 if (net == NULL) { 4563 /* Now if we had a temp route free it */ 4564 RO_NHFREE(ro); 4565 } else { 4566 /* 4567 * PMTU check versus smallest asoc MTU goes 4568 * here 4569 */ 4570 if (ro->ro_nh == NULL) { 4571 /* Route was freed */ 4572 if (net->ro._s_addr && 4573 net->src_addr_selected) { 4574 sctp_free_ifa(net->ro._s_addr); 4575 net->ro._s_addr = NULL; 4576 } 4577 net->src_addr_selected = 0; 4578 } 4579 if ((ro->ro_nh != NULL) && (net->ro._s_addr) && 4580 ((net->dest_state & SCTP_ADDR_NO_PMTUD) == 0)) { 4581 uint32_t mtu; 4582 4583 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_nh); 4584 if (mtu > 0) { 4585 if (net->port) { 4586 mtu -= sizeof(struct udphdr); 4587 } 4588 if (mtu < net->mtu) { 4589 if ((stcb != NULL) && (stcb->asoc.smallest_mtu > mtu)) { 4590 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4591 } 4592 net->mtu = mtu; 4593 } 4594 } 4595 } else if (ifp) { 4596 if (ND_IFINFO(ifp)->linkmtu && 4597 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) { 4598 sctp_mtu_size_reset(inp, 4599 &stcb->asoc, 4600 ND_IFINFO(ifp)->linkmtu); 4601 } 4602 } 4603 } 4604 return (ret); 4605 } 4606 #endif 4607 default: 4608 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 4609 ((struct sockaddr *)to)->sa_family); 4610 sctp_m_freem(m); 4611 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4612 return (EFAULT); 4613 } 4614 } 4615 4616 void 4617 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int so_locked) 4618 { 4619 struct mbuf *m, *m_last; 4620 struct sctp_nets *net; 4621 struct sctp_init_chunk *init; 4622 struct sctp_supported_addr_param *sup_addr; 4623 struct sctp_adaptation_layer_indication *ali; 4624 struct sctp_supported_chunk_types_param *pr_supported; 4625 struct sctp_paramhdr *ph; 4626 int cnt_inits_to = 0; 4627 int error; 4628 uint16_t num_ext, chunk_len, padding_len, parameter_len; 4629 4630 /* INIT's always go to the primary (and usually ONLY address) */ 4631 net = stcb->asoc.primary_destination; 4632 if (net == NULL) { 4633 net = TAILQ_FIRST(&stcb->asoc.nets); 4634 if (net == NULL) { 4635 /* TSNH */ 4636 return; 4637 } 4638 /* we confirm any address we send an INIT to */ 4639 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4640 (void)sctp_set_primary_addr(stcb, NULL, net); 4641 } else { 4642 /* we confirm any address we send an INIT to */ 4643 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4644 } 4645 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT\n"); 4646 #ifdef INET6 4647 if (net->ro._l_addr.sa.sa_family == AF_INET6) { 4648 /* 4649 * special hook, if we are sending to link local it will not 4650 * show up in our private address count. 4651 */ 4652 if (IN6_IS_ADDR_LINKLOCAL(&net->ro._l_addr.sin6.sin6_addr)) 4653 cnt_inits_to = 1; 4654 } 4655 #endif 4656 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 4657 /* This case should not happen */ 4658 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - failed timer?\n"); 4659 return; 4660 } 4661 /* start the INIT timer */ 4662 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 4663 4664 m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_NOWAIT, 1, MT_DATA); 4665 if (m == NULL) { 4666 /* No memory, INIT timer will re-attempt. */ 4667 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - mbuf?\n"); 4668 return; 4669 } 4670 chunk_len = (uint16_t)sizeof(struct sctp_init_chunk); 4671 padding_len = 0; 4672 /* Now lets put the chunk header in place */ 4673 init = mtod(m, struct sctp_init_chunk *); 4674 /* now the chunk header */ 4675 init->ch.chunk_type = SCTP_INITIATION; 4676 init->ch.chunk_flags = 0; 4677 /* fill in later from mbuf we build */ 4678 init->ch.chunk_length = 0; 4679 /* place in my tag */ 4680 init->init.initiate_tag = htonl(stcb->asoc.my_vtag); 4681 /* set up some of the credits. */ 4682 init->init.a_rwnd = htonl(max(inp->sctp_socket ? SCTP_SB_LIMIT_RCV(inp->sctp_socket) : 0, 4683 SCTP_MINIMAL_RWND)); 4684 init->init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 4685 init->init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 4686 init->init.initial_tsn = htonl(stcb->asoc.init_seq_number); 4687 4688 /* Adaptation layer indication parameter */ 4689 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 4690 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 4691 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 4692 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 4693 ali->ph.param_length = htons(parameter_len); 4694 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 4695 chunk_len += parameter_len; 4696 } 4697 4698 /* ECN parameter */ 4699 if (stcb->asoc.ecn_supported == 1) { 4700 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4701 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4702 ph->param_type = htons(SCTP_ECN_CAPABLE); 4703 ph->param_length = htons(parameter_len); 4704 chunk_len += parameter_len; 4705 } 4706 4707 /* PR-SCTP supported parameter */ 4708 if (stcb->asoc.prsctp_supported == 1) { 4709 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4710 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4711 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 4712 ph->param_length = htons(parameter_len); 4713 chunk_len += parameter_len; 4714 } 4715 4716 /* Add NAT friendly parameter. */ 4717 if (SCTP_BASE_SYSCTL(sctp_inits_include_nat_friendly)) { 4718 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4719 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4720 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 4721 ph->param_length = htons(parameter_len); 4722 chunk_len += parameter_len; 4723 } 4724 4725 /* And now tell the peer which extensions we support */ 4726 num_ext = 0; 4727 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 4728 if (stcb->asoc.prsctp_supported == 1) { 4729 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 4730 if (stcb->asoc.idata_supported) { 4731 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 4732 } 4733 } 4734 if (stcb->asoc.auth_supported == 1) { 4735 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 4736 } 4737 if (stcb->asoc.asconf_supported == 1) { 4738 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 4739 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 4740 } 4741 if (stcb->asoc.reconfig_supported == 1) { 4742 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 4743 } 4744 if (stcb->asoc.idata_supported) { 4745 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 4746 } 4747 if (stcb->asoc.nrsack_supported == 1) { 4748 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 4749 } 4750 if (stcb->asoc.pktdrop_supported == 1) { 4751 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 4752 } 4753 if (num_ext > 0) { 4754 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 4755 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 4756 pr_supported->ph.param_length = htons(parameter_len); 4757 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4758 chunk_len += parameter_len; 4759 } 4760 /* add authentication parameters */ 4761 if (stcb->asoc.auth_supported) { 4762 /* attach RANDOM parameter, if available */ 4763 if (stcb->asoc.authinfo.random != NULL) { 4764 struct sctp_auth_random *randp; 4765 4766 if (padding_len > 0) { 4767 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4768 chunk_len += padding_len; 4769 padding_len = 0; 4770 } 4771 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 4772 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + stcb->asoc.authinfo.random_len; 4773 /* random key already contains the header */ 4774 memcpy(randp, stcb->asoc.authinfo.random->key, parameter_len); 4775 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4776 chunk_len += parameter_len; 4777 } 4778 /* add HMAC_ALGO parameter */ 4779 if (stcb->asoc.local_hmacs != NULL) { 4780 struct sctp_auth_hmac_algo *hmacs; 4781 4782 if (padding_len > 0) { 4783 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4784 chunk_len += padding_len; 4785 padding_len = 0; 4786 } 4787 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 4788 parameter_len = (uint16_t)(sizeof(struct sctp_auth_hmac_algo) + 4789 stcb->asoc.local_hmacs->num_algo * sizeof(uint16_t)); 4790 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 4791 hmacs->ph.param_length = htons(parameter_len); 4792 sctp_serialize_hmaclist(stcb->asoc.local_hmacs, (uint8_t *)hmacs->hmac_ids); 4793 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4794 chunk_len += parameter_len; 4795 } 4796 /* add CHUNKS parameter */ 4797 if (stcb->asoc.local_auth_chunks != NULL) { 4798 struct sctp_auth_chunk_list *chunks; 4799 4800 if (padding_len > 0) { 4801 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4802 chunk_len += padding_len; 4803 padding_len = 0; 4804 } 4805 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 4806 parameter_len = (uint16_t)(sizeof(struct sctp_auth_chunk_list) + 4807 sctp_auth_get_chklist_size(stcb->asoc.local_auth_chunks)); 4808 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 4809 chunks->ph.param_length = htons(parameter_len); 4810 sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks, chunks->chunk_types); 4811 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4812 chunk_len += parameter_len; 4813 } 4814 } 4815 4816 /* now any cookie time extensions */ 4817 if (stcb->asoc.cookie_preserve_req > 0) { 4818 struct sctp_cookie_perserve_param *cookie_preserve; 4819 4820 if (padding_len > 0) { 4821 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4822 chunk_len += padding_len; 4823 padding_len = 0; 4824 } 4825 parameter_len = (uint16_t)sizeof(struct sctp_cookie_perserve_param); 4826 cookie_preserve = (struct sctp_cookie_perserve_param *)(mtod(m, caddr_t)+chunk_len); 4827 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 4828 cookie_preserve->ph.param_length = htons(parameter_len); 4829 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 4830 stcb->asoc.cookie_preserve_req = 0; 4831 chunk_len += parameter_len; 4832 } 4833 4834 if (stcb->asoc.scope.ipv4_addr_legal || stcb->asoc.scope.ipv6_addr_legal) { 4835 uint8_t i; 4836 4837 if (padding_len > 0) { 4838 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4839 chunk_len += padding_len; 4840 padding_len = 0; 4841 } 4842 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4843 if (stcb->asoc.scope.ipv4_addr_legal) { 4844 parameter_len += (uint16_t)sizeof(uint16_t); 4845 } 4846 if (stcb->asoc.scope.ipv6_addr_legal) { 4847 parameter_len += (uint16_t)sizeof(uint16_t); 4848 } 4849 sup_addr = (struct sctp_supported_addr_param *)(mtod(m, caddr_t)+chunk_len); 4850 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 4851 sup_addr->ph.param_length = htons(parameter_len); 4852 i = 0; 4853 if (stcb->asoc.scope.ipv4_addr_legal) { 4854 sup_addr->addr_type[i++] = htons(SCTP_IPV4_ADDRESS); 4855 } 4856 if (stcb->asoc.scope.ipv6_addr_legal) { 4857 sup_addr->addr_type[i++] = htons(SCTP_IPV6_ADDRESS); 4858 } 4859 padding_len = 4 - 2 * i; 4860 chunk_len += parameter_len; 4861 } 4862 4863 SCTP_BUF_LEN(m) = chunk_len; 4864 /* now the addresses */ 4865 /* 4866 * To optimize this we could put the scoping stuff into a structure 4867 * and remove the individual uint8's from the assoc structure. Then 4868 * we could just sifa in the address within the stcb. But for now 4869 * this is a quick hack to get the address stuff teased apart. 4870 */ 4871 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &stcb->asoc.scope, 4872 m, cnt_inits_to, 4873 &padding_len, &chunk_len); 4874 4875 init->ch.chunk_length = htons(chunk_len); 4876 if (padding_len > 0) { 4877 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 4878 sctp_m_freem(m); 4879 return; 4880 } 4881 } 4882 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - calls lowlevel_output\n"); 4883 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 4884 (struct sockaddr *)&net->ro._l_addr, 4885 m, 0, NULL, 0, 0, 0, 0, 4886 inp->sctp_lport, stcb->rport, htonl(0), 4887 net->port, NULL, 4888 0, 0, 4889 so_locked))) { 4890 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 4891 if (error == ENOBUFS) { 4892 stcb->asoc.ifp_had_enobuf = 1; 4893 SCTP_STAT_INCR(sctps_lowlevelerr); 4894 } 4895 } else { 4896 stcb->asoc.ifp_had_enobuf = 0; 4897 } 4898 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 4899 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 4900 } 4901 4902 struct mbuf * 4903 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 4904 int param_offset, int *abort_processing, 4905 struct sctp_chunkhdr *cp, 4906 int *nat_friendly, 4907 int *cookie_found) 4908 { 4909 /* 4910 * Given a mbuf containing an INIT or INIT-ACK with the param_offset 4911 * being equal to the beginning of the params i.e. (iphlen + 4912 * sizeof(struct sctp_init_msg) parse through the parameters to the 4913 * end of the mbuf verifying that all parameters are known. 4914 * 4915 * For unknown parameters build and return a mbuf with 4916 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop 4917 * processing this chunk stop, and set *abort_processing to 1. 4918 * 4919 * By having param_offset be pre-set to where parameters begin it is 4920 * hoped that this routine may be reused in the future by new 4921 * features. 4922 */ 4923 struct sctp_paramhdr *phdr, params; 4924 4925 struct mbuf *mat, *m_tmp, *op_err, *op_err_last; 4926 int at, limit, pad_needed; 4927 uint16_t ptype, plen, padded_size; 4928 4929 *abort_processing = 0; 4930 if (cookie_found != NULL) { 4931 *cookie_found = 0; 4932 } 4933 mat = in_initpkt; 4934 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 4935 at = param_offset; 4936 op_err = NULL; 4937 op_err_last = NULL; 4938 pad_needed = 0; 4939 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Check for unrecognized param's\n"); 4940 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 4941 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 4942 ptype = ntohs(phdr->param_type); 4943 plen = ntohs(phdr->param_length); 4944 if ((plen > limit) || (plen < sizeof(struct sctp_paramhdr))) { 4945 /* wacked parameter */ 4946 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error %d\n", plen); 4947 goto invalid_size; 4948 } 4949 limit -= SCTP_SIZE32(plen); 4950 /*- 4951 * All parameters for all chunks that we know/understand are 4952 * listed here. We process them other places and make 4953 * appropriate stop actions per the upper bits. However this 4954 * is the generic routine processor's can call to get back 4955 * an operr.. to either incorporate (init-ack) or send. 4956 */ 4957 padded_size = SCTP_SIZE32(plen); 4958 switch (ptype) { 4959 /* Param's with variable size */ 4960 case SCTP_HEARTBEAT_INFO: 4961 case SCTP_UNRECOG_PARAM: 4962 case SCTP_ERROR_CAUSE_IND: 4963 /* ok skip fwd */ 4964 at += padded_size; 4965 break; 4966 case SCTP_STATE_COOKIE: 4967 if (cookie_found != NULL) { 4968 *cookie_found = 1; 4969 } 4970 at += padded_size; 4971 break; 4972 /* Param's with variable size within a range */ 4973 case SCTP_CHUNK_LIST: 4974 case SCTP_SUPPORTED_CHUNK_EXT: 4975 if (padded_size > (sizeof(struct sctp_supported_chunk_types_param) + (sizeof(uint8_t) * SCTP_MAX_SUPPORTED_EXT))) { 4976 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error chklist %d\n", plen); 4977 goto invalid_size; 4978 } 4979 at += padded_size; 4980 break; 4981 case SCTP_SUPPORTED_ADDRTYPE: 4982 if (padded_size > SCTP_MAX_ADDR_PARAMS_SIZE) { 4983 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error supaddrtype %d\n", plen); 4984 goto invalid_size; 4985 } 4986 at += padded_size; 4987 break; 4988 case SCTP_RANDOM: 4989 if (padded_size > (sizeof(struct sctp_auth_random) + SCTP_RANDOM_MAX_SIZE)) { 4990 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error random %d\n", plen); 4991 goto invalid_size; 4992 } 4993 at += padded_size; 4994 break; 4995 case SCTP_SET_PRIM_ADDR: 4996 case SCTP_DEL_IP_ADDRESS: 4997 case SCTP_ADD_IP_ADDRESS: 4998 if ((padded_size != sizeof(struct sctp_asconf_addrv4_param)) && 4999 (padded_size != sizeof(struct sctp_asconf_addr_param))) { 5000 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error setprim %d\n", plen); 5001 goto invalid_size; 5002 } 5003 at += padded_size; 5004 break; 5005 /* Param's with a fixed size */ 5006 case SCTP_IPV4_ADDRESS: 5007 if (padded_size != sizeof(struct sctp_ipv4addr_param)) { 5008 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv4 addr %d\n", plen); 5009 goto invalid_size; 5010 } 5011 at += padded_size; 5012 break; 5013 case SCTP_IPV6_ADDRESS: 5014 if (padded_size != sizeof(struct sctp_ipv6addr_param)) { 5015 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv6 addr %d\n", plen); 5016 goto invalid_size; 5017 } 5018 at += padded_size; 5019 break; 5020 case SCTP_COOKIE_PRESERVE: 5021 if (padded_size != sizeof(struct sctp_cookie_perserve_param)) { 5022 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error cookie-preserve %d\n", plen); 5023 goto invalid_size; 5024 } 5025 at += padded_size; 5026 break; 5027 case SCTP_HAS_NAT_SUPPORT: 5028 *nat_friendly = 1; 5029 /* fall through */ 5030 case SCTP_PRSCTP_SUPPORTED: 5031 if (padded_size != sizeof(struct sctp_paramhdr)) { 5032 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error prsctp/nat support %d\n", plen); 5033 goto invalid_size; 5034 } 5035 at += padded_size; 5036 break; 5037 case SCTP_ECN_CAPABLE: 5038 if (padded_size != sizeof(struct sctp_paramhdr)) { 5039 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecn %d\n", plen); 5040 goto invalid_size; 5041 } 5042 at += padded_size; 5043 break; 5044 case SCTP_ULP_ADAPTATION: 5045 if (padded_size != sizeof(struct sctp_adaptation_layer_indication)) { 5046 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error adapatation %d\n", plen); 5047 goto invalid_size; 5048 } 5049 at += padded_size; 5050 break; 5051 case SCTP_SUCCESS_REPORT: 5052 if (padded_size != sizeof(struct sctp_asconf_paramhdr)) { 5053 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error success %d\n", plen); 5054 goto invalid_size; 5055 } 5056 at += padded_size; 5057 break; 5058 case SCTP_HOSTNAME_ADDRESS: 5059 { 5060 /* Hostname parameters are deprecated. */ 5061 struct sctp_gen_error_cause *cause; 5062 int l_len; 5063 5064 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Can't handle hostname addresses.. abort processing\n"); 5065 *abort_processing = 1; 5066 sctp_m_freem(op_err); 5067 op_err = NULL; 5068 op_err_last = NULL; 5069 #ifdef INET6 5070 l_len = SCTP_MIN_OVERHEAD; 5071 #else 5072 l_len = SCTP_MIN_V4_OVERHEAD; 5073 #endif 5074 l_len += sizeof(struct sctp_chunkhdr); 5075 l_len += sizeof(struct sctp_gen_error_cause); 5076 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5077 if (op_err != NULL) { 5078 /* 5079 * Pre-reserve space for IP, SCTP, 5080 * and chunk header. 5081 */ 5082 #ifdef INET6 5083 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5084 #else 5085 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5086 #endif 5087 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5088 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5089 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause); 5090 cause = mtod(op_err, struct sctp_gen_error_cause *); 5091 cause->code = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR); 5092 cause->length = htons((uint16_t)(sizeof(struct sctp_gen_error_cause) + plen)); 5093 SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(mat, at, plen, M_NOWAIT); 5094 if (SCTP_BUF_NEXT(op_err) == NULL) { 5095 sctp_m_freem(op_err); 5096 op_err = NULL; 5097 op_err_last = NULL; 5098 } 5099 } 5100 return (op_err); 5101 } 5102 default: 5103 /* 5104 * we do not recognize the parameter figure out what 5105 * we do. 5106 */ 5107 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Hit default param %x\n", ptype); 5108 if ((ptype & 0x4000) == 0x4000) { 5109 /* Report bit is set?? */ 5110 SCTPDBG(SCTP_DEBUG_OUTPUT1, "report op err\n"); 5111 if (op_err == NULL) { 5112 int l_len; 5113 5114 /* Ok need to try to get an mbuf */ 5115 #ifdef INET6 5116 l_len = SCTP_MIN_OVERHEAD; 5117 #else 5118 l_len = SCTP_MIN_V4_OVERHEAD; 5119 #endif 5120 l_len += sizeof(struct sctp_chunkhdr); 5121 l_len += sizeof(struct sctp_paramhdr); 5122 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5123 if (op_err) { 5124 SCTP_BUF_LEN(op_err) = 0; 5125 #ifdef INET6 5126 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5127 #else 5128 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5129 #endif 5130 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5131 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5132 op_err_last = op_err; 5133 } 5134 } 5135 if (op_err != NULL) { 5136 /* If we have space */ 5137 struct sctp_paramhdr *param; 5138 5139 if (pad_needed > 0) { 5140 op_err_last = sctp_add_pad_tombuf(op_err_last, pad_needed); 5141 } 5142 if (op_err_last == NULL) { 5143 sctp_m_freem(op_err); 5144 op_err = NULL; 5145 op_err_last = NULL; 5146 goto more_processing; 5147 } 5148 if (M_TRAILINGSPACE(op_err_last) < (int)sizeof(struct sctp_paramhdr)) { 5149 m_tmp = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_NOWAIT, 1, MT_DATA); 5150 if (m_tmp == NULL) { 5151 sctp_m_freem(op_err); 5152 op_err = NULL; 5153 op_err_last = NULL; 5154 goto more_processing; 5155 } 5156 SCTP_BUF_LEN(m_tmp) = 0; 5157 SCTP_BUF_NEXT(m_tmp) = NULL; 5158 SCTP_BUF_NEXT(op_err_last) = m_tmp; 5159 op_err_last = m_tmp; 5160 } 5161 param = (struct sctp_paramhdr *)(mtod(op_err_last, caddr_t)+SCTP_BUF_LEN(op_err_last)); 5162 param->param_type = htons(SCTP_UNRECOG_PARAM); 5163 param->param_length = htons((uint16_t)sizeof(struct sctp_paramhdr) + plen); 5164 SCTP_BUF_LEN(op_err_last) += sizeof(struct sctp_paramhdr); 5165 SCTP_BUF_NEXT(op_err_last) = SCTP_M_COPYM(mat, at, plen, M_NOWAIT); 5166 if (SCTP_BUF_NEXT(op_err_last) == NULL) { 5167 sctp_m_freem(op_err); 5168 op_err = NULL; 5169 op_err_last = NULL; 5170 goto more_processing; 5171 } else { 5172 while (SCTP_BUF_NEXT(op_err_last) != NULL) { 5173 op_err_last = SCTP_BUF_NEXT(op_err_last); 5174 } 5175 } 5176 if (plen % 4 != 0) { 5177 pad_needed = 4 - (plen % 4); 5178 } else { 5179 pad_needed = 0; 5180 } 5181 } 5182 } 5183 more_processing: 5184 if ((ptype & 0x8000) == 0x0000) { 5185 SCTPDBG(SCTP_DEBUG_OUTPUT1, "stop proc\n"); 5186 return (op_err); 5187 } else { 5188 /* skip this chunk and continue processing */ 5189 SCTPDBG(SCTP_DEBUG_OUTPUT1, "move on\n"); 5190 at += SCTP_SIZE32(plen); 5191 } 5192 break; 5193 } 5194 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5195 } 5196 return (op_err); 5197 invalid_size: 5198 SCTPDBG(SCTP_DEBUG_OUTPUT1, "abort flag set\n"); 5199 *abort_processing = 1; 5200 sctp_m_freem(op_err); 5201 op_err = NULL; 5202 op_err_last = NULL; 5203 if (phdr != NULL) { 5204 struct sctp_paramhdr *param; 5205 int l_len; 5206 #ifdef INET6 5207 l_len = SCTP_MIN_OVERHEAD; 5208 #else 5209 l_len = SCTP_MIN_V4_OVERHEAD; 5210 #endif 5211 l_len += sizeof(struct sctp_chunkhdr); 5212 l_len += (2 * sizeof(struct sctp_paramhdr)); 5213 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5214 if (op_err) { 5215 SCTP_BUF_LEN(op_err) = 0; 5216 #ifdef INET6 5217 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5218 #else 5219 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5220 #endif 5221 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5222 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5223 SCTP_BUF_LEN(op_err) = 2 * sizeof(struct sctp_paramhdr); 5224 param = mtod(op_err, struct sctp_paramhdr *); 5225 param->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 5226 param->param_length = htons(2 * sizeof(struct sctp_paramhdr)); 5227 param++; 5228 param->param_type = htons(ptype); 5229 param->param_length = htons(plen); 5230 } 5231 } 5232 return (op_err); 5233 } 5234 5235 /* 5236 * Given a INIT chunk, look through the parameters to verify that there 5237 * are no new addresses. 5238 * Return true, if there is a new address or there is a problem parsing 5239 the parameters. Provide an optional error cause used when sending an ABORT. 5240 * Return false, if there are no new addresses and there is no problem in 5241 parameter processing. 5242 */ 5243 static bool 5244 sctp_are_there_new_addresses(struct sctp_association *asoc, 5245 struct mbuf *in_initpkt, int offset, int limit, struct sockaddr *src, 5246 struct mbuf **op_err) 5247 { 5248 struct sockaddr *sa_touse; 5249 struct sockaddr *sa; 5250 struct sctp_paramhdr *phdr, params; 5251 struct sctp_nets *net; 5252 #ifdef INET 5253 struct sockaddr_in sin4, *sa4; 5254 #endif 5255 #ifdef INET6 5256 struct sockaddr_in6 sin6, *sa6; 5257 #endif 5258 uint16_t ptype, plen; 5259 bool fnd, check_src; 5260 5261 *op_err = NULL; 5262 #ifdef INET 5263 memset(&sin4, 0, sizeof(sin4)); 5264 sin4.sin_family = AF_INET; 5265 sin4.sin_len = sizeof(sin4); 5266 #endif 5267 #ifdef INET6 5268 memset(&sin6, 0, sizeof(sin6)); 5269 sin6.sin6_family = AF_INET6; 5270 sin6.sin6_len = sizeof(sin6); 5271 #endif 5272 /* First what about the src address of the pkt ? */ 5273 check_src = false; 5274 switch (src->sa_family) { 5275 #ifdef INET 5276 case AF_INET: 5277 if (asoc->scope.ipv4_addr_legal) { 5278 check_src = true; 5279 } 5280 break; 5281 #endif 5282 #ifdef INET6 5283 case AF_INET6: 5284 if (asoc->scope.ipv6_addr_legal) { 5285 check_src = true; 5286 } 5287 break; 5288 #endif 5289 default: 5290 /* TSNH */ 5291 break; 5292 } 5293 if (check_src) { 5294 fnd = false; 5295 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5296 sa = (struct sockaddr *)&net->ro._l_addr; 5297 if (sa->sa_family == src->sa_family) { 5298 #ifdef INET 5299 if (sa->sa_family == AF_INET) { 5300 struct sockaddr_in *src4; 5301 5302 sa4 = (struct sockaddr_in *)sa; 5303 src4 = (struct sockaddr_in *)src; 5304 if (sa4->sin_addr.s_addr == src4->sin_addr.s_addr) { 5305 fnd = true; 5306 break; 5307 } 5308 } 5309 #endif 5310 #ifdef INET6 5311 if (sa->sa_family == AF_INET6) { 5312 struct sockaddr_in6 *src6; 5313 5314 sa6 = (struct sockaddr_in6 *)sa; 5315 src6 = (struct sockaddr_in6 *)src; 5316 if (SCTP6_ARE_ADDR_EQUAL(sa6, src6)) { 5317 fnd = true; 5318 break; 5319 } 5320 } 5321 #endif 5322 } 5323 } 5324 if (!fnd) { 5325 /* 5326 * If sending an ABORT in case of an additional 5327 * address, don't use the new address error cause. 5328 * This looks no different than if no listener was 5329 * present. 5330 */ 5331 *op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), "Address added"); 5332 return (true); 5333 } 5334 } 5335 /* Ok so far lets munge through the rest of the packet */ 5336 offset += sizeof(struct sctp_init_chunk); 5337 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5338 while (phdr) { 5339 sa_touse = NULL; 5340 ptype = ntohs(phdr->param_type); 5341 plen = ntohs(phdr->param_length); 5342 if (offset + plen > limit) { 5343 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, "Partial parameter"); 5344 return (true); 5345 } 5346 if (plen < sizeof(struct sctp_paramhdr)) { 5347 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, "Parameter length too small"); 5348 return (true); 5349 } 5350 switch (ptype) { 5351 #ifdef INET 5352 case SCTP_IPV4_ADDRESS: 5353 { 5354 struct sctp_ipv4addr_param *p4, p4_buf; 5355 5356 if (plen != sizeof(struct sctp_ipv4addr_param)) { 5357 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, "Parameter length illegal"); 5358 return (true); 5359 } 5360 phdr = sctp_get_next_param(in_initpkt, offset, 5361 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 5362 if (phdr == NULL) { 5363 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, ""); 5364 return (true); 5365 } 5366 if (asoc->scope.ipv4_addr_legal) { 5367 p4 = (struct sctp_ipv4addr_param *)phdr; 5368 sin4.sin_addr.s_addr = p4->addr; 5369 sa_touse = (struct sockaddr *)&sin4; 5370 } 5371 break; 5372 } 5373 #endif 5374 #ifdef INET6 5375 case SCTP_IPV6_ADDRESS: 5376 { 5377 struct sctp_ipv6addr_param *p6, p6_buf; 5378 5379 if (plen != sizeof(struct sctp_ipv6addr_param)) { 5380 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, "Parameter length illegal"); 5381 return (true); 5382 } 5383 phdr = sctp_get_next_param(in_initpkt, offset, 5384 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 5385 if (phdr == NULL) { 5386 *op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, ""); 5387 return (true); 5388 } 5389 if (asoc->scope.ipv6_addr_legal) { 5390 p6 = (struct sctp_ipv6addr_param *)phdr; 5391 memcpy((caddr_t)&sin6.sin6_addr, p6->addr, 5392 sizeof(p6->addr)); 5393 sa_touse = (struct sockaddr *)&sin6; 5394 } 5395 break; 5396 } 5397 #endif 5398 default: 5399 sa_touse = NULL; 5400 break; 5401 } 5402 if (sa_touse) { 5403 /* ok, sa_touse points to one to check */ 5404 fnd = false; 5405 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5406 sa = (struct sockaddr *)&net->ro._l_addr; 5407 if (sa->sa_family != sa_touse->sa_family) { 5408 continue; 5409 } 5410 #ifdef INET 5411 if (sa->sa_family == AF_INET) { 5412 sa4 = (struct sockaddr_in *)sa; 5413 if (sa4->sin_addr.s_addr == 5414 sin4.sin_addr.s_addr) { 5415 fnd = true; 5416 break; 5417 } 5418 } 5419 #endif 5420 #ifdef INET6 5421 if (sa->sa_family == AF_INET6) { 5422 sa6 = (struct sockaddr_in6 *)sa; 5423 if (SCTP6_ARE_ADDR_EQUAL( 5424 sa6, &sin6)) { 5425 fnd = true; 5426 break; 5427 } 5428 } 5429 #endif 5430 } 5431 if (!fnd) { 5432 /* 5433 * If sending an ABORT in case of an 5434 * additional address, don't use the new 5435 * address error cause. This looks no 5436 * different than if no listener was 5437 * present. 5438 */ 5439 *op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), "Address added"); 5440 return (true); 5441 } 5442 } 5443 offset += SCTP_SIZE32(plen); 5444 if (offset >= limit) { 5445 break; 5446 } 5447 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5448 } 5449 return (false); 5450 } 5451 5452 /* 5453 * Given a MBUF chain that was sent into us containing an INIT. Build a 5454 * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done 5455 * a pullup to include IPv6/4header, SCTP header and initial part of INIT 5456 * message (i.e. the struct sctp_init_msg). 5457 */ 5458 void 5459 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 5460 struct sctp_nets *src_net, struct mbuf *init_pkt, 5461 int iphlen, int offset, 5462 struct sockaddr *src, struct sockaddr *dst, 5463 struct sctphdr *sh, struct sctp_init_chunk *init_chk, 5464 uint8_t mflowtype, uint32_t mflowid, 5465 uint32_t vrf_id, uint16_t port) 5466 { 5467 struct sctp_association *asoc; 5468 struct mbuf *m, *m_tmp, *m_last, *m_cookie, *op_err; 5469 struct sctp_init_ack_chunk *initack; 5470 struct sctp_adaptation_layer_indication *ali; 5471 struct sctp_supported_chunk_types_param *pr_supported; 5472 struct sctp_paramhdr *ph; 5473 union sctp_sockstore *over_addr; 5474 struct sctp_scoping scp; 5475 struct timeval now; 5476 #ifdef INET 5477 struct sockaddr_in *dst4 = (struct sockaddr_in *)dst; 5478 struct sockaddr_in *src4 = (struct sockaddr_in *)src; 5479 struct sockaddr_in *sin; 5480 #endif 5481 #ifdef INET6 5482 struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst; 5483 struct sockaddr_in6 *src6 = (struct sockaddr_in6 *)src; 5484 struct sockaddr_in6 *sin6; 5485 #endif 5486 struct sockaddr *to; 5487 struct sctp_state_cookie stc; 5488 struct sctp_nets *net = NULL; 5489 uint8_t *signature = NULL; 5490 int cnt_inits_to = 0; 5491 uint16_t his_limit, i_want; 5492 int abort_flag; 5493 int nat_friendly = 0; 5494 int error; 5495 struct socket *so; 5496 uint16_t num_ext, chunk_len, padding_len, parameter_len; 5497 5498 if (stcb) { 5499 asoc = &stcb->asoc; 5500 } else { 5501 asoc = NULL; 5502 } 5503 if ((asoc != NULL) && 5504 (SCTP_GET_STATE(stcb) != SCTP_STATE_COOKIE_WAIT)) { 5505 if (sctp_are_there_new_addresses(asoc, init_pkt, offset, offset + ntohs(init_chk->ch.chunk_length), src, &op_err)) { 5506 /* 5507 * new addresses, out of here in non-cookie-wait 5508 * states 5509 */ 5510 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5511 mflowtype, mflowid, inp->fibnum, 5512 vrf_id, port); 5513 return; 5514 } 5515 if (src_net != NULL && (src_net->port != port)) { 5516 /* 5517 * change of remote encapsulation port, out of here 5518 * in non-cookie-wait states 5519 * 5520 * Send an ABORT, without an specific error cause. 5521 * This looks no different than if no listener was 5522 * present. 5523 */ 5524 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5525 "Remote encapsulation port changed"); 5526 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5527 mflowtype, mflowid, inp->fibnum, 5528 vrf_id, port); 5529 return; 5530 } 5531 } 5532 abort_flag = 0; 5533 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 5534 (offset + sizeof(struct sctp_init_chunk)), 5535 &abort_flag, 5536 (struct sctp_chunkhdr *)init_chk, 5537 &nat_friendly, NULL); 5538 if (abort_flag) { 5539 do_a_abort: 5540 if (op_err == NULL) { 5541 char msg[SCTP_DIAG_INFO_LEN]; 5542 5543 SCTP_SNPRINTF(msg, sizeof(msg), "%s:%d at %s", __FILE__, __LINE__, __func__); 5544 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5545 msg); 5546 } 5547 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 5548 init_chk->init.initiate_tag, op_err, 5549 mflowtype, mflowid, inp->fibnum, 5550 vrf_id, port); 5551 return; 5552 } 5553 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 5554 if (m == NULL) { 5555 /* No memory, INIT timer will re-attempt. */ 5556 sctp_m_freem(op_err); 5557 return; 5558 } 5559 chunk_len = (uint16_t)sizeof(struct sctp_init_ack_chunk); 5560 padding_len = 0; 5561 5562 /* 5563 * We might not overwrite the identification[] completely and on 5564 * some platforms time_entered will contain some padding. Therefore 5565 * zero out the cookie to avoid putting uninitialized memory on the 5566 * wire. 5567 */ 5568 memset(&stc, 0, sizeof(struct sctp_state_cookie)); 5569 5570 /* the time I built cookie */ 5571 (void)SCTP_GETTIME_TIMEVAL(&now); 5572 stc.time_entered.tv_sec = now.tv_sec; 5573 stc.time_entered.tv_usec = now.tv_usec; 5574 5575 /* populate any tie tags */ 5576 if (asoc != NULL) { 5577 /* unlock before tag selections */ 5578 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 5579 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 5580 stc.cookie_life = asoc->cookie_life; 5581 net = asoc->primary_destination; 5582 } else { 5583 stc.tie_tag_my_vtag = 0; 5584 stc.tie_tag_peer_vtag = 0; 5585 /* life I will award this cookie */ 5586 stc.cookie_life = inp->sctp_ep.def_cookie_life; 5587 } 5588 5589 /* copy in the ports for later check */ 5590 stc.myport = sh->dest_port; 5591 stc.peerport = sh->src_port; 5592 5593 /* 5594 * If we wanted to honor cookie life extensions, we would add to 5595 * stc.cookie_life. For now we should NOT honor any extension 5596 */ 5597 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 5598 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5599 stc.ipv6_addr_legal = 1; 5600 if (SCTP_IPV6_V6ONLY(inp)) { 5601 stc.ipv4_addr_legal = 0; 5602 } else { 5603 stc.ipv4_addr_legal = 1; 5604 } 5605 } else { 5606 stc.ipv6_addr_legal = 0; 5607 stc.ipv4_addr_legal = 1; 5608 } 5609 stc.ipv4_scope = 0; 5610 if (net == NULL) { 5611 to = src; 5612 switch (dst->sa_family) { 5613 #ifdef INET 5614 case AF_INET: 5615 { 5616 /* lookup address */ 5617 stc.address[0] = src4->sin_addr.s_addr; 5618 stc.address[1] = 0; 5619 stc.address[2] = 0; 5620 stc.address[3] = 0; 5621 stc.addr_type = SCTP_IPV4_ADDRESS; 5622 /* local from address */ 5623 stc.laddress[0] = dst4->sin_addr.s_addr; 5624 stc.laddress[1] = 0; 5625 stc.laddress[2] = 0; 5626 stc.laddress[3] = 0; 5627 stc.laddr_type = SCTP_IPV4_ADDRESS; 5628 /* scope_id is only for v6 */ 5629 stc.scope_id = 0; 5630 if ((IN4_ISPRIVATE_ADDRESS(&src4->sin_addr)) || 5631 (IN4_ISPRIVATE_ADDRESS(&dst4->sin_addr))) { 5632 stc.ipv4_scope = 1; 5633 } 5634 /* Must use the address in this case */ 5635 if (sctp_is_address_on_local_host(src, vrf_id)) { 5636 stc.loopback_scope = 1; 5637 stc.ipv4_scope = 1; 5638 stc.site_scope = 1; 5639 stc.local_scope = 0; 5640 } 5641 break; 5642 } 5643 #endif 5644 #ifdef INET6 5645 case AF_INET6: 5646 { 5647 stc.addr_type = SCTP_IPV6_ADDRESS; 5648 memcpy(&stc.address, &src6->sin6_addr, sizeof(struct in6_addr)); 5649 stc.scope_id = ntohs(in6_getscope(&src6->sin6_addr)); 5650 if (sctp_is_address_on_local_host(src, vrf_id)) { 5651 stc.loopback_scope = 1; 5652 stc.local_scope = 0; 5653 stc.site_scope = 1; 5654 stc.ipv4_scope = 1; 5655 } else if (IN6_IS_ADDR_LINKLOCAL(&src6->sin6_addr) || 5656 IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr)) { 5657 /* 5658 * If the new destination or source 5659 * is a LINK_LOCAL we must have 5660 * common both site and local scope. 5661 * Don't set local scope though 5662 * since we must depend on the 5663 * source to be added implicitly. We 5664 * cannot assure just because we 5665 * share one link that all links are 5666 * common. 5667 */ 5668 stc.local_scope = 0; 5669 stc.site_scope = 1; 5670 stc.ipv4_scope = 1; 5671 /* 5672 * we start counting for the private 5673 * address stuff at 1. since the 5674 * link local we source from won't 5675 * show up in our scoped count. 5676 */ 5677 cnt_inits_to = 1; 5678 /* 5679 * pull out the scope_id from 5680 * incoming pkt 5681 */ 5682 } else if (IN6_IS_ADDR_SITELOCAL(&src6->sin6_addr) || 5683 IN6_IS_ADDR_SITELOCAL(&dst6->sin6_addr)) { 5684 /* 5685 * If the new destination or source 5686 * is SITE_LOCAL then we must have 5687 * site scope in common. 5688 */ 5689 stc.site_scope = 1; 5690 } 5691 memcpy(&stc.laddress, &dst6->sin6_addr, sizeof(struct in6_addr)); 5692 stc.laddr_type = SCTP_IPV6_ADDRESS; 5693 break; 5694 } 5695 #endif 5696 default: 5697 /* TSNH */ 5698 goto do_a_abort; 5699 break; 5700 } 5701 } else { 5702 /* set the scope per the existing tcb */ 5703 5704 #ifdef INET6 5705 struct sctp_nets *lnet; 5706 #endif 5707 5708 stc.loopback_scope = asoc->scope.loopback_scope; 5709 stc.ipv4_scope = asoc->scope.ipv4_local_scope; 5710 stc.site_scope = asoc->scope.site_scope; 5711 stc.local_scope = asoc->scope.local_scope; 5712 #ifdef INET6 5713 /* Why do we not consider IPv4 LL addresses? */ 5714 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 5715 if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) { 5716 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) { 5717 /* 5718 * if we have a LL address, start 5719 * counting at 1. 5720 */ 5721 cnt_inits_to = 1; 5722 } 5723 } 5724 } 5725 #endif 5726 /* use the net pointer */ 5727 to = (struct sockaddr *)&net->ro._l_addr; 5728 switch (to->sa_family) { 5729 #ifdef INET 5730 case AF_INET: 5731 sin = (struct sockaddr_in *)to; 5732 stc.address[0] = sin->sin_addr.s_addr; 5733 stc.address[1] = 0; 5734 stc.address[2] = 0; 5735 stc.address[3] = 0; 5736 stc.addr_type = SCTP_IPV4_ADDRESS; 5737 if (net->src_addr_selected == 0) { 5738 /* 5739 * strange case here, the INIT should have 5740 * did the selection. 5741 */ 5742 net->ro._s_addr = sctp_source_address_selection(inp, 5743 stcb, (sctp_route_t *)&net->ro, 5744 net, 0, vrf_id); 5745 if (net->ro._s_addr == NULL) { 5746 sctp_m_freem(op_err); 5747 sctp_m_freem(m); 5748 return; 5749 } 5750 5751 net->src_addr_selected = 1; 5752 } 5753 stc.laddress[0] = net->ro._s_addr->address.sin.sin_addr.s_addr; 5754 stc.laddress[1] = 0; 5755 stc.laddress[2] = 0; 5756 stc.laddress[3] = 0; 5757 stc.laddr_type = SCTP_IPV4_ADDRESS; 5758 /* scope_id is only for v6 */ 5759 stc.scope_id = 0; 5760 break; 5761 #endif 5762 #ifdef INET6 5763 case AF_INET6: 5764 sin6 = (struct sockaddr_in6 *)to; 5765 memcpy(&stc.address, &sin6->sin6_addr, 5766 sizeof(struct in6_addr)); 5767 stc.addr_type = SCTP_IPV6_ADDRESS; 5768 stc.scope_id = sin6->sin6_scope_id; 5769 if (net->src_addr_selected == 0) { 5770 /* 5771 * strange case here, the INIT should have 5772 * done the selection. 5773 */ 5774 net->ro._s_addr = sctp_source_address_selection(inp, 5775 stcb, (sctp_route_t *)&net->ro, 5776 net, 0, vrf_id); 5777 if (net->ro._s_addr == NULL) { 5778 sctp_m_freem(op_err); 5779 sctp_m_freem(m); 5780 return; 5781 } 5782 5783 net->src_addr_selected = 1; 5784 } 5785 memcpy(&stc.laddress, &net->ro._s_addr->address.sin6.sin6_addr, 5786 sizeof(struct in6_addr)); 5787 stc.laddr_type = SCTP_IPV6_ADDRESS; 5788 break; 5789 #endif 5790 } 5791 } 5792 /* Now lets put the SCTP header in place */ 5793 initack = mtod(m, struct sctp_init_ack_chunk *); 5794 /* Save it off for quick ref */ 5795 stc.peers_vtag = ntohl(init_chk->init.initiate_tag); 5796 /* who are we */ 5797 memcpy(stc.identification, SCTP_VERSION_STRING, 5798 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 5799 memset(stc.reserved, 0, SCTP_RESERVE_SPACE); 5800 /* now the chunk header */ 5801 initack->ch.chunk_type = SCTP_INITIATION_ACK; 5802 initack->ch.chunk_flags = 0; 5803 /* fill in later from mbuf we build */ 5804 initack->ch.chunk_length = 0; 5805 /* place in my tag */ 5806 if ((asoc != NULL) && 5807 ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 5808 (SCTP_GET_STATE(stcb) == SCTP_STATE_INUSE) || 5809 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED))) { 5810 /* re-use the v-tags and init-seq here */ 5811 initack->init.initiate_tag = htonl(asoc->my_vtag); 5812 initack->init.initial_tsn = htonl(asoc->init_seq_number); 5813 } else { 5814 uint32_t vtag, itsn; 5815 5816 if (asoc) { 5817 atomic_add_int(&asoc->refcnt, 1); 5818 SCTP_TCB_UNLOCK(stcb); 5819 new_tag: 5820 SCTP_INP_INFO_RLOCK(); 5821 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5822 SCTP_INP_INFO_RUNLOCK(); 5823 if ((asoc->peer_supports_nat) && (vtag == asoc->my_vtag)) { 5824 /* 5825 * Got a duplicate vtag on some guy behind a 5826 * nat make sure we don't use it. 5827 */ 5828 goto new_tag; 5829 } 5830 initack->init.initiate_tag = htonl(vtag); 5831 /* get a TSN to use too */ 5832 itsn = sctp_select_initial_TSN(&inp->sctp_ep); 5833 initack->init.initial_tsn = htonl(itsn); 5834 SCTP_TCB_LOCK(stcb); 5835 atomic_subtract_int(&asoc->refcnt, 1); 5836 } else { 5837 SCTP_INP_INCR_REF(inp); 5838 SCTP_INP_RUNLOCK(inp); 5839 SCTP_INP_INFO_RLOCK(); 5840 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5841 SCTP_INP_INFO_RUNLOCK(); 5842 initack->init.initiate_tag = htonl(vtag); 5843 /* get a TSN to use too */ 5844 initack->init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 5845 SCTP_INP_RLOCK(inp); 5846 SCTP_INP_DECR_REF(inp); 5847 } 5848 } 5849 /* save away my tag to */ 5850 stc.my_vtag = initack->init.initiate_tag; 5851 5852 /* set up some of the credits. */ 5853 so = inp->sctp_socket; 5854 if (so == NULL) { 5855 /* memory problem */ 5856 sctp_m_freem(op_err); 5857 sctp_m_freem(m); 5858 return; 5859 } else { 5860 initack->init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(so), SCTP_MINIMAL_RWND)); 5861 } 5862 /* set what I want */ 5863 his_limit = ntohs(init_chk->init.num_inbound_streams); 5864 /* choose what I want */ 5865 if (asoc != NULL) { 5866 if (asoc->streamoutcnt > asoc->pre_open_streams) { 5867 i_want = asoc->streamoutcnt; 5868 } else { 5869 i_want = asoc->pre_open_streams; 5870 } 5871 } else { 5872 i_want = inp->sctp_ep.pre_open_stream_count; 5873 } 5874 if (his_limit < i_want) { 5875 /* I Want more :< */ 5876 initack->init.num_outbound_streams = init_chk->init.num_inbound_streams; 5877 } else { 5878 /* I can have what I want :> */ 5879 initack->init.num_outbound_streams = htons(i_want); 5880 } 5881 /* tell him his limit. */ 5882 initack->init.num_inbound_streams = 5883 htons(inp->sctp_ep.max_open_streams_intome); 5884 5885 /* adaptation layer indication parameter */ 5886 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 5887 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 5888 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 5889 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 5890 ali->ph.param_length = htons(parameter_len); 5891 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 5892 chunk_len += parameter_len; 5893 } 5894 5895 /* ECN parameter */ 5896 if (((asoc != NULL) && (asoc->ecn_supported == 1)) || 5897 ((asoc == NULL) && (inp->ecn_supported == 1))) { 5898 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5899 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5900 ph->param_type = htons(SCTP_ECN_CAPABLE); 5901 ph->param_length = htons(parameter_len); 5902 chunk_len += parameter_len; 5903 } 5904 5905 /* PR-SCTP supported parameter */ 5906 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5907 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5908 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5909 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5910 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 5911 ph->param_length = htons(parameter_len); 5912 chunk_len += parameter_len; 5913 } 5914 5915 /* Add NAT friendly parameter */ 5916 if (nat_friendly) { 5917 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5918 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5919 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 5920 ph->param_length = htons(parameter_len); 5921 chunk_len += parameter_len; 5922 } 5923 5924 /* And now tell the peer which extensions we support */ 5925 num_ext = 0; 5926 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 5927 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5928 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5929 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 5930 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5931 ((asoc == NULL) && (inp->idata_supported == 1))) { 5932 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 5933 } 5934 } 5935 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5936 ((asoc == NULL) && (inp->auth_supported == 1))) { 5937 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 5938 } 5939 if (((asoc != NULL) && (asoc->asconf_supported == 1)) || 5940 ((asoc == NULL) && (inp->asconf_supported == 1))) { 5941 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 5942 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 5943 } 5944 if (((asoc != NULL) && (asoc->reconfig_supported == 1)) || 5945 ((asoc == NULL) && (inp->reconfig_supported == 1))) { 5946 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 5947 } 5948 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5949 ((asoc == NULL) && (inp->idata_supported == 1))) { 5950 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 5951 } 5952 if (((asoc != NULL) && (asoc->nrsack_supported == 1)) || 5953 ((asoc == NULL) && (inp->nrsack_supported == 1))) { 5954 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 5955 } 5956 if (((asoc != NULL) && (asoc->pktdrop_supported == 1)) || 5957 ((asoc == NULL) && (inp->pktdrop_supported == 1))) { 5958 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 5959 } 5960 if (num_ext > 0) { 5961 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 5962 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 5963 pr_supported->ph.param_length = htons(parameter_len); 5964 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5965 chunk_len += parameter_len; 5966 } 5967 5968 /* add authentication parameters */ 5969 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5970 ((asoc == NULL) && (inp->auth_supported == 1))) { 5971 struct sctp_auth_random *randp; 5972 struct sctp_auth_hmac_algo *hmacs; 5973 struct sctp_auth_chunk_list *chunks; 5974 5975 if (padding_len > 0) { 5976 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 5977 chunk_len += padding_len; 5978 padding_len = 0; 5979 } 5980 /* generate and add RANDOM parameter */ 5981 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 5982 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + 5983 SCTP_AUTH_RANDOM_SIZE_DEFAULT; 5984 randp->ph.param_type = htons(SCTP_RANDOM); 5985 randp->ph.param_length = htons(parameter_len); 5986 SCTP_READ_RANDOM(randp->random_data, SCTP_AUTH_RANDOM_SIZE_DEFAULT); 5987 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5988 chunk_len += parameter_len; 5989 5990 if (padding_len > 0) { 5991 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 5992 chunk_len += padding_len; 5993 padding_len = 0; 5994 } 5995 /* add HMAC_ALGO parameter */ 5996 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 5997 parameter_len = (uint16_t)sizeof(struct sctp_auth_hmac_algo) + 5998 sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs, 5999 (uint8_t *)hmacs->hmac_ids); 6000 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 6001 hmacs->ph.param_length = htons(parameter_len); 6002 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6003 chunk_len += parameter_len; 6004 6005 if (padding_len > 0) { 6006 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6007 chunk_len += padding_len; 6008 padding_len = 0; 6009 } 6010 /* add CHUNKS parameter */ 6011 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 6012 parameter_len = (uint16_t)sizeof(struct sctp_auth_chunk_list) + 6013 sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks, 6014 chunks->chunk_types); 6015 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 6016 chunks->ph.param_length = htons(parameter_len); 6017 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6018 chunk_len += parameter_len; 6019 } 6020 SCTP_BUF_LEN(m) = chunk_len; 6021 m_last = m; 6022 /* now the addresses */ 6023 /* 6024 * To optimize this we could put the scoping stuff into a structure 6025 * and remove the individual uint8's from the stc structure. Then we 6026 * could just sifa in the address within the stc.. but for now this 6027 * is a quick hack to get the address stuff teased apart. 6028 */ 6029 scp.ipv4_addr_legal = stc.ipv4_addr_legal; 6030 scp.ipv6_addr_legal = stc.ipv6_addr_legal; 6031 scp.loopback_scope = stc.loopback_scope; 6032 scp.ipv4_local_scope = stc.ipv4_scope; 6033 scp.local_scope = stc.local_scope; 6034 scp.site_scope = stc.site_scope; 6035 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &scp, m_last, 6036 cnt_inits_to, 6037 &padding_len, &chunk_len); 6038 /* padding_len can only be positive, if no addresses have been added */ 6039 if (padding_len > 0) { 6040 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6041 chunk_len += padding_len; 6042 SCTP_BUF_LEN(m) += padding_len; 6043 padding_len = 0; 6044 } 6045 6046 /* tack on the operational error if present */ 6047 if (op_err) { 6048 parameter_len = 0; 6049 for (m_tmp = op_err; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6050 parameter_len += SCTP_BUF_LEN(m_tmp); 6051 } 6052 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6053 SCTP_BUF_NEXT(m_last) = op_err; 6054 while (SCTP_BUF_NEXT(m_last) != NULL) { 6055 m_last = SCTP_BUF_NEXT(m_last); 6056 } 6057 chunk_len += parameter_len; 6058 } 6059 if (padding_len > 0) { 6060 m_last = sctp_add_pad_tombuf(m_last, padding_len); 6061 if (m_last == NULL) { 6062 /* Houston we have a problem, no space */ 6063 sctp_m_freem(m); 6064 return; 6065 } 6066 chunk_len += padding_len; 6067 padding_len = 0; 6068 } 6069 /* Now we must build a cookie */ 6070 m_cookie = sctp_add_cookie(init_pkt, offset, m, 0, &stc, &signature); 6071 if (m_cookie == NULL) { 6072 /* memory problem */ 6073 sctp_m_freem(m); 6074 return; 6075 } 6076 /* Now append the cookie to the end and update the space/size */ 6077 SCTP_BUF_NEXT(m_last) = m_cookie; 6078 parameter_len = 0; 6079 for (m_tmp = m_cookie; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6080 parameter_len += SCTP_BUF_LEN(m_tmp); 6081 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 6082 m_last = m_tmp; 6083 } 6084 } 6085 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6086 chunk_len += parameter_len; 6087 6088 /* 6089 * Place in the size, but we don't include the last pad (if any) in 6090 * the INIT-ACK. 6091 */ 6092 initack->ch.chunk_length = htons(chunk_len); 6093 6094 /* 6095 * Time to sign the cookie, we don't sign over the cookie signature 6096 * though thus we set trailer. 6097 */ 6098 (void)sctp_hmac_m(SCTP_HMAC, 6099 (uint8_t *)inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)], 6100 SCTP_SECRET_SIZE, m_cookie, sizeof(struct sctp_paramhdr), 6101 (uint8_t *)signature, SCTP_SIGNATURE_SIZE); 6102 /* 6103 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return 6104 * here since the timer will drive a retranmission. 6105 */ 6106 if (padding_len > 0) { 6107 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 6108 sctp_m_freem(m); 6109 return; 6110 } 6111 } 6112 if (stc.loopback_scope) { 6113 over_addr = (union sctp_sockstore *)dst; 6114 } else { 6115 over_addr = NULL; 6116 } 6117 6118 if ((error = sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0, 6119 0, 0, 6120 inp->sctp_lport, sh->src_port, init_chk->init.initiate_tag, 6121 port, over_addr, 6122 mflowtype, mflowid, 6123 SCTP_SO_NOT_LOCKED))) { 6124 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 6125 if (error == ENOBUFS) { 6126 if (asoc != NULL) { 6127 asoc->ifp_had_enobuf = 1; 6128 } 6129 SCTP_STAT_INCR(sctps_lowlevelerr); 6130 } 6131 } else { 6132 if (asoc != NULL) { 6133 asoc->ifp_had_enobuf = 0; 6134 } 6135 } 6136 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 6137 } 6138 6139 static void 6140 sctp_prune_prsctp(struct sctp_tcb *stcb, 6141 struct sctp_association *asoc, 6142 struct sctp_sndrcvinfo *srcv, 6143 int dataout) 6144 { 6145 int freed_spc = 0; 6146 struct sctp_tmit_chunk *chk, *nchk; 6147 6148 SCTP_TCB_LOCK_ASSERT(stcb); 6149 if ((asoc->prsctp_supported) && 6150 (asoc->sent_queue_cnt_removeable > 0)) { 6151 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6152 /* 6153 * Look for chunks marked with the PR_SCTP flag AND 6154 * the buffer space flag. If the one being sent is 6155 * equal or greater priority then purge the old one 6156 * and free some space. 6157 */ 6158 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6159 /* 6160 * This one is PR-SCTP AND buffer space 6161 * limited type 6162 */ 6163 if (chk->rec.data.timetodrop.tv_sec > (long)srcv->sinfo_timetolive) { 6164 /* 6165 * Lower numbers equates to higher 6166 * priority. So if the one we are 6167 * looking at has a larger priority, 6168 * we want to drop the data and NOT 6169 * retransmit it. 6170 */ 6171 if (chk->data) { 6172 /* 6173 * We release the book_size 6174 * if the mbuf is here 6175 */ 6176 int ret_spc; 6177 uint8_t sent; 6178 6179 if (chk->sent > SCTP_DATAGRAM_UNSENT) 6180 sent = 1; 6181 else 6182 sent = 0; 6183 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6184 sent, 6185 SCTP_SO_LOCKED); 6186 freed_spc += ret_spc; 6187 if (freed_spc >= dataout) { 6188 return; 6189 } 6190 } /* if chunk was present */ 6191 } /* if of sufficient priority */ 6192 } /* if chunk has enabled */ 6193 } /* tailqforeach */ 6194 6195 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 6196 /* Here we must move to the sent queue and mark */ 6197 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6198 if (chk->rec.data.timetodrop.tv_sec > (long)srcv->sinfo_timetolive) { 6199 if (chk->data) { 6200 /* 6201 * We release the book_size 6202 * if the mbuf is here 6203 */ 6204 int ret_spc; 6205 6206 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6207 0, SCTP_SO_LOCKED); 6208 6209 freed_spc += ret_spc; 6210 if (freed_spc >= dataout) { 6211 return; 6212 } 6213 } /* end if chk->data */ 6214 } /* end if right class */ 6215 } /* end if chk pr-sctp */ 6216 } /* tailqforeachsafe (chk) */ 6217 } /* if enabled in asoc */ 6218 } 6219 6220 int 6221 sctp_get_frag_point(struct sctp_tcb *stcb, 6222 struct sctp_association *asoc) 6223 { 6224 int siz, ovh; 6225 6226 /* 6227 * For endpoints that have both v6 and v4 addresses we must reserve 6228 * room for the ipv6 header, for those that are only dealing with V4 6229 * we use a larger frag point. 6230 */ 6231 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6232 ovh = SCTP_MIN_OVERHEAD; 6233 } else { 6234 ovh = SCTP_MIN_V4_OVERHEAD; 6235 } 6236 ovh += SCTP_DATA_CHUNK_OVERHEAD(stcb); 6237 if (stcb->asoc.sctp_frag_point > asoc->smallest_mtu) 6238 siz = asoc->smallest_mtu - ovh; 6239 else 6240 siz = (stcb->asoc.sctp_frag_point - ovh); 6241 /* 6242 * if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { 6243 */ 6244 /* A data chunk MUST fit in a cluster */ 6245 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk)); */ 6246 /* } */ 6247 6248 /* adjust for an AUTH chunk if DATA requires auth */ 6249 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) 6250 siz -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 6251 6252 if (siz % 4) { 6253 /* make it an even word boundary please */ 6254 siz -= (siz % 4); 6255 } 6256 return (siz); 6257 } 6258 6259 static void 6260 sctp_set_prsctp_policy(struct sctp_stream_queue_pending *sp) 6261 { 6262 /* 6263 * We assume that the user wants PR_SCTP_TTL if the user provides a 6264 * positive lifetime but does not specify any PR_SCTP policy. 6265 */ 6266 if (PR_SCTP_ENABLED(sp->sinfo_flags)) { 6267 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6268 } else if (sp->timetolive > 0) { 6269 sp->sinfo_flags |= SCTP_PR_SCTP_TTL; 6270 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6271 } else { 6272 return; 6273 } 6274 switch (PR_SCTP_POLICY(sp->sinfo_flags)) { 6275 case CHUNK_FLAGS_PR_SCTP_BUF: 6276 /* 6277 * Time to live is a priority stored in tv_sec when doing 6278 * the buffer drop thing. 6279 */ 6280 sp->ts.tv_sec = sp->timetolive; 6281 sp->ts.tv_usec = 0; 6282 break; 6283 case CHUNK_FLAGS_PR_SCTP_TTL: 6284 { 6285 struct timeval tv; 6286 6287 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6288 tv.tv_sec = sp->timetolive / 1000; 6289 tv.tv_usec = (sp->timetolive * 1000) % 1000000; 6290 /* 6291 * TODO sctp_constants.h needs alternative time 6292 * macros when _KERNEL is undefined. 6293 */ 6294 timevaladd(&sp->ts, &tv); 6295 } 6296 break; 6297 case CHUNK_FLAGS_PR_SCTP_RTX: 6298 /* 6299 * Time to live is a the number or retransmissions stored in 6300 * tv_sec. 6301 */ 6302 sp->ts.tv_sec = sp->timetolive; 6303 sp->ts.tv_usec = 0; 6304 break; 6305 default: 6306 SCTPDBG(SCTP_DEBUG_USRREQ1, 6307 "Unknown PR_SCTP policy %u.\n", 6308 PR_SCTP_POLICY(sp->sinfo_flags)); 6309 break; 6310 } 6311 } 6312 6313 static int 6314 sctp_msg_append(struct sctp_tcb *stcb, 6315 struct sctp_nets *net, 6316 struct mbuf *m, 6317 struct sctp_sndrcvinfo *srcv, int hold_stcb_lock) 6318 { 6319 int error = 0; 6320 struct mbuf *at; 6321 struct sctp_stream_queue_pending *sp = NULL; 6322 struct sctp_stream_out *strm; 6323 6324 /* 6325 * Given an mbuf chain, put it into the association send queue and 6326 * place it on the wheel 6327 */ 6328 if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) { 6329 /* Invalid stream number */ 6330 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6331 error = EINVAL; 6332 goto out_now; 6333 } 6334 if ((stcb->asoc.stream_locked) && 6335 (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) { 6336 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6337 error = EINVAL; 6338 goto out_now; 6339 } 6340 /* Now can we send this? */ 6341 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 6342 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 6343 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 6344 (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) { 6345 /* got data while shutting down */ 6346 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 6347 error = ECONNRESET; 6348 goto out_now; 6349 } 6350 sctp_alloc_a_strmoq(stcb, sp); 6351 if (sp == NULL) { 6352 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6353 error = ENOMEM; 6354 goto out_now; 6355 } 6356 sp->sinfo_flags = srcv->sinfo_flags; 6357 sp->timetolive = srcv->sinfo_timetolive; 6358 sp->ppid = srcv->sinfo_ppid; 6359 sp->context = srcv->sinfo_context; 6360 sp->fsn = 0; 6361 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 6362 sp->net = net; 6363 atomic_add_int(&sp->net->ref_count, 1); 6364 } else { 6365 sp->net = NULL; 6366 } 6367 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6368 sp->sid = srcv->sinfo_stream; 6369 sp->msg_is_complete = 1; 6370 sp->sender_all_done = 1; 6371 sp->some_taken = 0; 6372 sp->data = m; 6373 sp->tail_mbuf = NULL; 6374 sctp_set_prsctp_policy(sp); 6375 /* 6376 * We could in theory (for sendall) sifa the length in, but we would 6377 * still have to hunt through the chain since we need to setup the 6378 * tail_mbuf 6379 */ 6380 sp->length = 0; 6381 for (at = m; at; at = SCTP_BUF_NEXT(at)) { 6382 if (SCTP_BUF_NEXT(at) == NULL) 6383 sp->tail_mbuf = at; 6384 sp->length += SCTP_BUF_LEN(at); 6385 } 6386 if (srcv->sinfo_keynumber_valid) { 6387 sp->auth_keyid = srcv->sinfo_keynumber; 6388 } else { 6389 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 6390 } 6391 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 6392 sctp_auth_key_acquire(stcb, sp->auth_keyid); 6393 sp->holds_key_ref = 1; 6394 } 6395 if (hold_stcb_lock == 0) { 6396 SCTP_TCB_SEND_LOCK(stcb); 6397 } 6398 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 6399 sctp_snd_sb_alloc(stcb, sp->length); 6400 atomic_add_int(&stcb->asoc.stream_queue_cnt, 1); 6401 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 6402 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, &stcb->asoc, strm, sp); 6403 m = NULL; 6404 if (hold_stcb_lock == 0) { 6405 SCTP_TCB_SEND_UNLOCK(stcb); 6406 } 6407 out_now: 6408 if (m) { 6409 sctp_m_freem(m); 6410 } 6411 return (error); 6412 } 6413 6414 static struct mbuf * 6415 sctp_copy_mbufchain(struct mbuf *clonechain, 6416 struct mbuf *outchain, 6417 struct mbuf **endofchain, 6418 int can_take_mbuf, 6419 int sizeofcpy, 6420 uint8_t copy_by_ref) 6421 { 6422 struct mbuf *m; 6423 struct mbuf *appendchain; 6424 caddr_t cp; 6425 int len; 6426 6427 if (endofchain == NULL) { 6428 /* error */ 6429 error_out: 6430 if (outchain) 6431 sctp_m_freem(outchain); 6432 return (NULL); 6433 } 6434 if (can_take_mbuf) { 6435 appendchain = clonechain; 6436 } else { 6437 if (!copy_by_ref && 6438 (sizeofcpy <= (int)((((SCTP_BASE_SYSCTL(sctp_mbuf_threshold_count) - 1) * MLEN) + MHLEN)))) { 6439 /* Its not in a cluster */ 6440 if (*endofchain == NULL) { 6441 /* lets get a mbuf cluster */ 6442 if (outchain == NULL) { 6443 /* This is the general case */ 6444 new_mbuf: 6445 outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6446 if (outchain == NULL) { 6447 goto error_out; 6448 } 6449 SCTP_BUF_LEN(outchain) = 0; 6450 *endofchain = outchain; 6451 /* get the prepend space */ 6452 SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4)); 6453 } else { 6454 /* 6455 * We really should not get a NULL 6456 * in endofchain 6457 */ 6458 /* find end */ 6459 m = outchain; 6460 while (m) { 6461 if (SCTP_BUF_NEXT(m) == NULL) { 6462 *endofchain = m; 6463 break; 6464 } 6465 m = SCTP_BUF_NEXT(m); 6466 } 6467 /* sanity */ 6468 if (*endofchain == NULL) { 6469 /* 6470 * huh, TSNH XXX maybe we 6471 * should panic 6472 */ 6473 sctp_m_freem(outchain); 6474 goto new_mbuf; 6475 } 6476 } 6477 /* get the new end of length */ 6478 len = (int)M_TRAILINGSPACE(*endofchain); 6479 } else { 6480 /* how much is left at the end? */ 6481 len = (int)M_TRAILINGSPACE(*endofchain); 6482 } 6483 /* Find the end of the data, for appending */ 6484 cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain))); 6485 6486 /* Now lets copy it out */ 6487 if (len >= sizeofcpy) { 6488 /* It all fits, copy it in */ 6489 m_copydata(clonechain, 0, sizeofcpy, cp); 6490 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6491 } else { 6492 /* fill up the end of the chain */ 6493 if (len > 0) { 6494 m_copydata(clonechain, 0, len, cp); 6495 SCTP_BUF_LEN((*endofchain)) += len; 6496 /* now we need another one */ 6497 sizeofcpy -= len; 6498 } 6499 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6500 if (m == NULL) { 6501 /* We failed */ 6502 goto error_out; 6503 } 6504 SCTP_BUF_NEXT((*endofchain)) = m; 6505 *endofchain = m; 6506 cp = mtod((*endofchain), caddr_t); 6507 m_copydata(clonechain, len, sizeofcpy, cp); 6508 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6509 } 6510 return (outchain); 6511 } else { 6512 /* copy the old fashion way */ 6513 appendchain = SCTP_M_COPYM(clonechain, 0, M_COPYALL, M_NOWAIT); 6514 #ifdef SCTP_MBUF_LOGGING 6515 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6516 sctp_log_mbc(appendchain, SCTP_MBUF_ICOPY); 6517 } 6518 #endif 6519 } 6520 } 6521 if (appendchain == NULL) { 6522 /* error */ 6523 if (outchain) 6524 sctp_m_freem(outchain); 6525 return (NULL); 6526 } 6527 if (outchain) { 6528 /* tack on to the end */ 6529 if (*endofchain != NULL) { 6530 SCTP_BUF_NEXT(((*endofchain))) = appendchain; 6531 } else { 6532 m = outchain; 6533 while (m) { 6534 if (SCTP_BUF_NEXT(m) == NULL) { 6535 SCTP_BUF_NEXT(m) = appendchain; 6536 break; 6537 } 6538 m = SCTP_BUF_NEXT(m); 6539 } 6540 } 6541 /* 6542 * save off the end and update the end-chain position 6543 */ 6544 m = appendchain; 6545 while (m) { 6546 if (SCTP_BUF_NEXT(m) == NULL) { 6547 *endofchain = m; 6548 break; 6549 } 6550 m = SCTP_BUF_NEXT(m); 6551 } 6552 return (outchain); 6553 } else { 6554 /* save off the end and update the end-chain position */ 6555 m = appendchain; 6556 while (m) { 6557 if (SCTP_BUF_NEXT(m) == NULL) { 6558 *endofchain = m; 6559 break; 6560 } 6561 m = SCTP_BUF_NEXT(m); 6562 } 6563 return (appendchain); 6564 } 6565 } 6566 6567 static int 6568 sctp_med_chunk_output(struct sctp_inpcb *inp, 6569 struct sctp_tcb *stcb, 6570 struct sctp_association *asoc, 6571 int *num_out, 6572 int *reason_code, 6573 int control_only, int from_where, 6574 struct timeval *now, int *now_filled, int frag_point, int so_locked); 6575 6576 static void 6577 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, 6578 uint32_t val SCTP_UNUSED) 6579 { 6580 struct sctp_copy_all *ca; 6581 struct mbuf *m; 6582 int ret = 0; 6583 int added_control = 0; 6584 int un_sent, do_chunk_output = 1; 6585 struct sctp_association *asoc; 6586 struct sctp_nets *net; 6587 6588 ca = (struct sctp_copy_all *)ptr; 6589 if (ca->m == NULL) { 6590 return; 6591 } 6592 if (ca->inp != inp) { 6593 /* TSNH */ 6594 return; 6595 } 6596 if (ca->sndlen > 0) { 6597 m = SCTP_M_COPYM(ca->m, 0, M_COPYALL, M_NOWAIT); 6598 if (m == NULL) { 6599 /* can't copy so we are done */ 6600 ca->cnt_failed++; 6601 return; 6602 } 6603 #ifdef SCTP_MBUF_LOGGING 6604 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6605 sctp_log_mbc(m, SCTP_MBUF_ICOPY); 6606 } 6607 #endif 6608 } else { 6609 m = NULL; 6610 } 6611 SCTP_TCB_LOCK_ASSERT(stcb); 6612 if (stcb->asoc.alternate) { 6613 net = stcb->asoc.alternate; 6614 } else { 6615 net = stcb->asoc.primary_destination; 6616 } 6617 if (ca->sndrcv.sinfo_flags & SCTP_ABORT) { 6618 /* Abort this assoc with m as the user defined reason */ 6619 if (m != NULL) { 6620 SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_NOWAIT); 6621 } else { 6622 m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 6623 0, M_NOWAIT, 1, MT_DATA); 6624 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr); 6625 } 6626 if (m != NULL) { 6627 struct sctp_paramhdr *ph; 6628 6629 ph = mtod(m, struct sctp_paramhdr *); 6630 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 6631 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + ca->sndlen)); 6632 } 6633 /* 6634 * We add one here to keep the assoc from dis-appearing on 6635 * us. 6636 */ 6637 atomic_add_int(&stcb->asoc.refcnt, 1); 6638 sctp_abort_an_association(inp, stcb, m, false, SCTP_SO_NOT_LOCKED); 6639 /* 6640 * sctp_abort_an_association calls sctp_free_asoc() free 6641 * association will NOT free it since we incremented the 6642 * refcnt .. we do this to prevent it being freed and things 6643 * getting tricky since we could end up (from free_asoc) 6644 * calling inpcb_free which would get a recursive lock call 6645 * to the iterator lock.. But as a consequence of that the 6646 * stcb will return to us un-locked.. since free_asoc 6647 * returns with either no TCB or the TCB unlocked, we must 6648 * relock.. to unlock in the iterator timer :-0 6649 */ 6650 SCTP_TCB_LOCK(stcb); 6651 atomic_subtract_int(&stcb->asoc.refcnt, 1); 6652 goto no_chunk_output; 6653 } else { 6654 if (m) { 6655 ret = sctp_msg_append(stcb, net, m, 6656 &ca->sndrcv, 1); 6657 } 6658 asoc = &stcb->asoc; 6659 if (ca->sndrcv.sinfo_flags & SCTP_EOF) { 6660 /* shutdown this assoc */ 6661 if (TAILQ_EMPTY(&asoc->send_queue) && 6662 TAILQ_EMPTY(&asoc->sent_queue) && 6663 sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED) == 0) { 6664 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6665 goto abort_anyway; 6666 } 6667 /* 6668 * there is nothing queued to send, so I'm 6669 * done... 6670 */ 6671 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 6672 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6673 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6674 /* 6675 * only send SHUTDOWN the first time 6676 * through 6677 */ 6678 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 6679 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 6680 } 6681 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT); 6682 sctp_stop_timers_for_shutdown(stcb); 6683 sctp_send_shutdown(stcb, net); 6684 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 6685 net); 6686 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6687 NULL); 6688 added_control = 1; 6689 do_chunk_output = 0; 6690 } 6691 } else { 6692 /* 6693 * we still got (or just got) data to send, 6694 * so set SHUTDOWN_PENDING 6695 */ 6696 /* 6697 * XXX sockets draft says that SCTP_EOF 6698 * should be sent with no data. currently, 6699 * we will allow user data to be sent first 6700 * and move to SHUTDOWN-PENDING 6701 */ 6702 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 6703 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6704 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6705 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6706 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT); 6707 } 6708 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 6709 if (TAILQ_EMPTY(&asoc->send_queue) && 6710 TAILQ_EMPTY(&asoc->sent_queue) && 6711 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 6712 struct mbuf *op_err; 6713 char msg[SCTP_DIAG_INFO_LEN]; 6714 6715 abort_anyway: 6716 SCTP_SNPRINTF(msg, sizeof(msg), 6717 "%s:%d at %s", __FILE__, __LINE__, __func__); 6718 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 6719 msg); 6720 atomic_add_int(&stcb->asoc.refcnt, 1); 6721 sctp_abort_an_association(stcb->sctp_ep, stcb, 6722 op_err, false, SCTP_SO_NOT_LOCKED); 6723 atomic_subtract_int(&stcb->asoc.refcnt, 1); 6724 goto no_chunk_output; 6725 } 6726 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6727 NULL); 6728 } 6729 } 6730 } 6731 } 6732 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 6733 (stcb->asoc.stream_queue_cnt * SCTP_DATA_CHUNK_OVERHEAD(stcb))); 6734 6735 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 6736 (stcb->asoc.total_flight > 0) && 6737 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 6738 do_chunk_output = 0; 6739 } 6740 if (do_chunk_output) 6741 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_NOT_LOCKED); 6742 else if (added_control) { 6743 int num_out, reason, now_filled = 0; 6744 struct timeval now; 6745 int frag_point; 6746 6747 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 6748 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 6749 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_NOT_LOCKED); 6750 } 6751 no_chunk_output: 6752 if (ret) { 6753 ca->cnt_failed++; 6754 } else { 6755 ca->cnt_sent++; 6756 } 6757 } 6758 6759 static void 6760 sctp_sendall_completes(void *ptr, uint32_t val SCTP_UNUSED) 6761 { 6762 struct sctp_copy_all *ca; 6763 6764 ca = (struct sctp_copy_all *)ptr; 6765 /* 6766 * Do a notify here? Kacheong suggests that the notify be done at 6767 * the send time.. so you would push up a notification if any send 6768 * failed. Don't know if this is feasible since the only failures we 6769 * have is "memory" related and if you cannot get an mbuf to send 6770 * the data you surely can't get an mbuf to send up to notify the 6771 * user you can't send the data :-> 6772 */ 6773 6774 /* now free everything */ 6775 if (ca->inp) { 6776 /* Lets clear the flag to allow others to run. */ 6777 SCTP_INP_WLOCK(ca->inp); 6778 ca->inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6779 SCTP_INP_WUNLOCK(ca->inp); 6780 } 6781 sctp_m_freem(ca->m); 6782 SCTP_FREE(ca, SCTP_M_COPYAL); 6783 } 6784 6785 static struct mbuf * 6786 sctp_copy_out_all(struct uio *uio, ssize_t len) 6787 { 6788 struct mbuf *ret, *at; 6789 ssize_t left, willcpy, cancpy, error; 6790 6791 ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAITOK, 1, MT_DATA); 6792 if (ret == NULL) { 6793 /* TSNH */ 6794 return (NULL); 6795 } 6796 left = len; 6797 SCTP_BUF_LEN(ret) = 0; 6798 /* save space for the data chunk header */ 6799 cancpy = (int)M_TRAILINGSPACE(ret); 6800 willcpy = min(cancpy, left); 6801 at = ret; 6802 while (left > 0) { 6803 /* Align data to the end */ 6804 error = uiomove(mtod(at, caddr_t), (int)willcpy, uio); 6805 if (error) { 6806 err_out_now: 6807 sctp_m_freem(at); 6808 return (NULL); 6809 } 6810 SCTP_BUF_LEN(at) = (int)willcpy; 6811 SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0; 6812 left -= willcpy; 6813 if (left > 0) { 6814 SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg((unsigned int)left, 0, M_WAITOK, 1, MT_DATA); 6815 if (SCTP_BUF_NEXT(at) == NULL) { 6816 goto err_out_now; 6817 } 6818 at = SCTP_BUF_NEXT(at); 6819 SCTP_BUF_LEN(at) = 0; 6820 cancpy = (int)M_TRAILINGSPACE(at); 6821 willcpy = min(cancpy, left); 6822 } 6823 } 6824 return (ret); 6825 } 6826 6827 static int 6828 sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, 6829 struct sctp_sndrcvinfo *srcv) 6830 { 6831 int ret; 6832 struct sctp_copy_all *ca; 6833 6834 if (uio->uio_resid > (ssize_t)SCTP_BASE_SYSCTL(sctp_sendall_limit)) { 6835 /* You must not be larger than the limit! */ 6836 return (EMSGSIZE); 6837 } 6838 SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all), 6839 SCTP_M_COPYAL); 6840 if (ca == NULL) { 6841 sctp_m_freem(m); 6842 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6843 return (ENOMEM); 6844 } 6845 memset(ca, 0, sizeof(struct sctp_copy_all)); 6846 6847 ca->inp = inp; 6848 if (srcv) { 6849 memcpy(&ca->sndrcv, srcv, sizeof(struct sctp_nonpad_sndrcvinfo)); 6850 } 6851 6852 /* Serialize. */ 6853 SCTP_INP_WLOCK(inp); 6854 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SND_ITERATOR_UP) != 0) { 6855 SCTP_INP_WUNLOCK(inp); 6856 sctp_m_freem(m); 6857 SCTP_FREE(ca, SCTP_M_COPYAL); 6858 return (EBUSY); 6859 } 6860 inp->sctp_flags |= SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6861 SCTP_INP_WUNLOCK(inp); 6862 6863 /* 6864 * take off the sendall flag, it would be bad if we failed to do 6865 * this :-0 6866 */ 6867 ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL; 6868 /* get length and mbuf chain */ 6869 if (uio) { 6870 ca->sndlen = uio->uio_resid; 6871 ca->m = sctp_copy_out_all(uio, ca->sndlen); 6872 if (ca->m == NULL) { 6873 SCTP_FREE(ca, SCTP_M_COPYAL); 6874 sctp_m_freem(m); 6875 SCTP_INP_WLOCK(inp); 6876 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6877 SCTP_INP_WUNLOCK(inp); 6878 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6879 return (ENOMEM); 6880 } 6881 } else { 6882 /* Gather the length of the send */ 6883 struct mbuf *mat; 6884 6885 ca->sndlen = 0; 6886 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 6887 ca->sndlen += SCTP_BUF_LEN(mat); 6888 } 6889 } 6890 ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, NULL, 6891 SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES, 6892 SCTP_ASOC_ANY_STATE, 6893 (void *)ca, 0, 6894 sctp_sendall_completes, inp, 1); 6895 if (ret) { 6896 SCTP_INP_WLOCK(inp); 6897 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6898 SCTP_INP_WUNLOCK(inp); 6899 SCTP_FREE(ca, SCTP_M_COPYAL); 6900 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 6901 return (EFAULT); 6902 } 6903 return (0); 6904 } 6905 6906 void 6907 sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc) 6908 { 6909 struct sctp_tmit_chunk *chk, *nchk; 6910 6911 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 6912 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 6913 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 6914 asoc->ctrl_queue_cnt--; 6915 if (chk->data) { 6916 sctp_m_freem(chk->data); 6917 chk->data = NULL; 6918 } 6919 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6920 } 6921 } 6922 } 6923 6924 void 6925 sctp_toss_old_asconf(struct sctp_tcb *stcb) 6926 { 6927 struct sctp_association *asoc; 6928 struct sctp_tmit_chunk *chk, *nchk; 6929 struct sctp_asconf_chunk *acp; 6930 6931 asoc = &stcb->asoc; 6932 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 6933 /* find SCTP_ASCONF chunk in queue */ 6934 if (chk->rec.chunk_id.id == SCTP_ASCONF) { 6935 if (chk->data) { 6936 acp = mtod(chk->data, struct sctp_asconf_chunk *); 6937 if (SCTP_TSN_GT(ntohl(acp->serial_number), asoc->asconf_seq_out_acked)) { 6938 /* Not Acked yet */ 6939 break; 6940 } 6941 } 6942 TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next); 6943 asoc->ctrl_queue_cnt--; 6944 if (chk->data) { 6945 sctp_m_freem(chk->data); 6946 chk->data = NULL; 6947 } 6948 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6949 } 6950 } 6951 } 6952 6953 static void 6954 sctp_clean_up_datalist(struct sctp_tcb *stcb, 6955 struct sctp_association *asoc, 6956 struct sctp_tmit_chunk **data_list, 6957 int bundle_at, 6958 struct sctp_nets *net) 6959 { 6960 int i; 6961 struct sctp_tmit_chunk *tp1; 6962 6963 for (i = 0; i < bundle_at; i++) { 6964 /* off of the send queue */ 6965 TAILQ_REMOVE(&asoc->send_queue, data_list[i], sctp_next); 6966 asoc->send_queue_cnt--; 6967 if (i > 0) { 6968 /* 6969 * Any chunk NOT 0 you zap the time chunk 0 gets 6970 * zapped or set based on if a RTO measurment is 6971 * needed. 6972 */ 6973 data_list[i]->do_rtt = 0; 6974 } 6975 /* record time */ 6976 data_list[i]->sent_rcv_time = net->last_sent_time; 6977 data_list[i]->rec.data.cwnd_at_send = net->cwnd; 6978 data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.tsn; 6979 if (data_list[i]->whoTo == NULL) { 6980 data_list[i]->whoTo = net; 6981 atomic_add_int(&net->ref_count, 1); 6982 } 6983 /* on to the sent queue */ 6984 tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead); 6985 if ((tp1) && SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 6986 struct sctp_tmit_chunk *tpp; 6987 6988 /* need to move back */ 6989 back_up_more: 6990 tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next); 6991 if (tpp == NULL) { 6992 TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next); 6993 goto all_done; 6994 } 6995 tp1 = tpp; 6996 if (SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 6997 goto back_up_more; 6998 } 6999 TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next); 7000 } else { 7001 TAILQ_INSERT_TAIL(&asoc->sent_queue, 7002 data_list[i], 7003 sctp_next); 7004 } 7005 all_done: 7006 /* This does not lower until the cum-ack passes it */ 7007 asoc->sent_queue_cnt++; 7008 if ((asoc->peers_rwnd <= 0) && 7009 (asoc->total_flight == 0) && 7010 (bundle_at == 1)) { 7011 /* Mark the chunk as being a window probe */ 7012 SCTP_STAT_INCR(sctps_windowprobed); 7013 } 7014 #ifdef SCTP_AUDITING_ENABLED 7015 sctp_audit_log(0xC2, 3); 7016 #endif 7017 data_list[i]->sent = SCTP_DATAGRAM_SENT; 7018 data_list[i]->snd_count = 1; 7019 data_list[i]->rec.data.chunk_was_revoked = 0; 7020 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 7021 sctp_misc_ints(SCTP_FLIGHT_LOG_UP, 7022 data_list[i]->whoTo->flight_size, 7023 data_list[i]->book_size, 7024 (uint32_t)(uintptr_t)data_list[i]->whoTo, 7025 data_list[i]->rec.data.tsn); 7026 } 7027 sctp_flight_size_increase(data_list[i]); 7028 sctp_total_flight_increase(stcb, data_list[i]); 7029 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 7030 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 7031 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 7032 } 7033 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 7034 (uint32_t)(data_list[i]->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 7035 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 7036 /* SWS sender side engages */ 7037 asoc->peers_rwnd = 0; 7038 } 7039 } 7040 if (asoc->cc_functions.sctp_cwnd_update_packet_transmitted) { 7041 (*asoc->cc_functions.sctp_cwnd_update_packet_transmitted) (stcb, net); 7042 } 7043 } 7044 7045 static void 7046 sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc, int so_locked) 7047 { 7048 struct sctp_tmit_chunk *chk, *nchk; 7049 7050 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 7051 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7052 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 7053 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 7054 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 7055 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) || 7056 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 7057 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 7058 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 7059 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 7060 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 7061 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 7062 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 7063 /* Stray chunks must be cleaned up */ 7064 clean_up_anyway: 7065 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7066 asoc->ctrl_queue_cnt--; 7067 if (chk->data) { 7068 sctp_m_freem(chk->data); 7069 chk->data = NULL; 7070 } 7071 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 7072 asoc->fwd_tsn_cnt--; 7073 } 7074 sctp_free_a_chunk(stcb, chk, so_locked); 7075 } else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 7076 /* special handling, we must look into the param */ 7077 if (chk != asoc->str_reset) { 7078 goto clean_up_anyway; 7079 } 7080 } 7081 } 7082 } 7083 7084 static uint32_t 7085 sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length, 7086 uint32_t space_left, uint32_t frag_point, int eeor_on) 7087 { 7088 /* 7089 * Make a decision on if I should split a msg into multiple parts. 7090 * This is only asked of incomplete messages. 7091 */ 7092 if (eeor_on) { 7093 /* 7094 * If we are doing EEOR we need to always send it if its the 7095 * entire thing, since it might be all the guy is putting in 7096 * the hopper. 7097 */ 7098 if (space_left >= length) { 7099 /*- 7100 * If we have data outstanding, 7101 * we get another chance when the sack 7102 * arrives to transmit - wait for more data 7103 */ 7104 if (stcb->asoc.total_flight == 0) { 7105 /* 7106 * If nothing is in flight, we zero the 7107 * packet counter. 7108 */ 7109 return (length); 7110 } 7111 return (0); 7112 7113 } else { 7114 /* You can fill the rest */ 7115 return (space_left); 7116 } 7117 } 7118 /*- 7119 * For those strange folk that make the send buffer 7120 * smaller than our fragmentation point, we can't 7121 * get a full msg in so we have to allow splitting. 7122 */ 7123 if (SCTP_SB_LIMIT_SND(stcb->sctp_socket) < frag_point) { 7124 return (length); 7125 } 7126 if ((length <= space_left) || 7127 ((length - space_left) < SCTP_BASE_SYSCTL(sctp_min_residual))) { 7128 /* Sub-optimial residual don't split in non-eeor mode. */ 7129 return (0); 7130 } 7131 /* 7132 * If we reach here length is larger than the space_left. Do we wish 7133 * to split it for the sake of packet putting together? 7134 */ 7135 if (space_left >= min(SCTP_BASE_SYSCTL(sctp_min_split_point), frag_point)) { 7136 /* Its ok to split it */ 7137 return (min(space_left, frag_point)); 7138 } 7139 /* Nope, can't split */ 7140 return (0); 7141 } 7142 7143 static uint32_t 7144 sctp_move_to_outqueue(struct sctp_tcb *stcb, 7145 struct sctp_nets *net, 7146 struct sctp_stream_out *strq, 7147 uint32_t space_left, 7148 uint32_t frag_point, 7149 int *giveup, 7150 int eeor_mode, 7151 int *bail, 7152 int so_locked) 7153 { 7154 /* Move from the stream to the send_queue keeping track of the total */ 7155 struct sctp_association *asoc; 7156 struct sctp_stream_queue_pending *sp; 7157 struct sctp_tmit_chunk *chk; 7158 struct sctp_data_chunk *dchkh = NULL; 7159 struct sctp_idata_chunk *ndchkh = NULL; 7160 uint32_t to_move, length; 7161 int leading; 7162 uint8_t rcv_flags = 0; 7163 uint8_t some_taken; 7164 uint8_t send_lock_up = 0; 7165 7166 SCTP_TCB_LOCK_ASSERT(stcb); 7167 asoc = &stcb->asoc; 7168 one_more_time: 7169 /* sa_ignore FREED_MEMORY */ 7170 sp = TAILQ_FIRST(&strq->outqueue); 7171 if (sp == NULL) { 7172 if (send_lock_up == 0) { 7173 SCTP_TCB_SEND_LOCK(stcb); 7174 send_lock_up = 1; 7175 } 7176 sp = TAILQ_FIRST(&strq->outqueue); 7177 if (sp) { 7178 goto one_more_time; 7179 } 7180 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_EXPLICIT_EOR) == 0) && 7181 (stcb->asoc.idata_supported == 0) && 7182 (strq->last_msg_incomplete)) { 7183 SCTP_PRINTF("Huh? Stream:%d lm_in_c=%d but queue is NULL\n", 7184 strq->sid, 7185 strq->last_msg_incomplete); 7186 strq->last_msg_incomplete = 0; 7187 } 7188 to_move = 0; 7189 if (send_lock_up) { 7190 SCTP_TCB_SEND_UNLOCK(stcb); 7191 send_lock_up = 0; 7192 } 7193 goto out_of; 7194 } 7195 if ((sp->msg_is_complete) && (sp->length == 0)) { 7196 if (sp->sender_all_done) { 7197 /* 7198 * We are doing deferred cleanup. Last time through 7199 * when we took all the data the sender_all_done was 7200 * not set. 7201 */ 7202 if ((sp->put_last_out == 0) && (sp->discard_rest == 0)) { 7203 SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n"); 7204 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7205 sp->sender_all_done, 7206 sp->length, 7207 sp->msg_is_complete, 7208 sp->put_last_out, 7209 send_lock_up); 7210 } 7211 if (send_lock_up == 0) { 7212 SCTP_TCB_SEND_LOCK(stcb); 7213 send_lock_up = 1; 7214 } 7215 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7216 TAILQ_REMOVE(&strq->outqueue, sp, next); 7217 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp); 7218 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7219 (strq->chunks_on_queues == 0) && 7220 TAILQ_EMPTY(&strq->outqueue)) { 7221 stcb->asoc.trigger_reset = 1; 7222 } 7223 if (sp->net) { 7224 sctp_free_remote_addr(sp->net); 7225 sp->net = NULL; 7226 } 7227 if (sp->data) { 7228 sctp_m_freem(sp->data); 7229 sp->data = NULL; 7230 } 7231 sctp_free_a_strmoq(stcb, sp, so_locked); 7232 /* we can't be locked to it */ 7233 if (send_lock_up) { 7234 SCTP_TCB_SEND_UNLOCK(stcb); 7235 send_lock_up = 0; 7236 } 7237 /* back to get the next msg */ 7238 goto one_more_time; 7239 } else { 7240 /* 7241 * sender just finished this but still holds a 7242 * reference 7243 */ 7244 *giveup = 1; 7245 to_move = 0; 7246 goto out_of; 7247 } 7248 } else { 7249 /* is there some to get */ 7250 if (sp->length == 0) { 7251 /* no */ 7252 *giveup = 1; 7253 to_move = 0; 7254 goto out_of; 7255 } else if (sp->discard_rest) { 7256 if (send_lock_up == 0) { 7257 SCTP_TCB_SEND_LOCK(stcb); 7258 send_lock_up = 1; 7259 } 7260 /* Whack down the size */ 7261 atomic_subtract_int(&stcb->asoc.total_output_queue_size, sp->length); 7262 if ((stcb->sctp_socket != NULL) && 7263 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 7264 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 7265 atomic_subtract_int(&stcb->sctp_socket->so_snd.sb_cc, sp->length); 7266 } 7267 if (sp->data) { 7268 sctp_m_freem(sp->data); 7269 sp->data = NULL; 7270 sp->tail_mbuf = NULL; 7271 } 7272 sp->length = 0; 7273 sp->some_taken = 1; 7274 *giveup = 1; 7275 to_move = 0; 7276 goto out_of; 7277 } 7278 } 7279 some_taken = sp->some_taken; 7280 re_look: 7281 length = sp->length; 7282 if (sp->msg_is_complete) { 7283 /* The message is complete */ 7284 to_move = min(length, frag_point); 7285 if (to_move == length) { 7286 /* All of it fits in the MTU */ 7287 if (sp->some_taken) { 7288 rcv_flags |= SCTP_DATA_LAST_FRAG; 7289 } else { 7290 rcv_flags |= SCTP_DATA_NOT_FRAG; 7291 } 7292 sp->put_last_out = 1; 7293 if (sp->sinfo_flags & SCTP_SACK_IMMEDIATELY) { 7294 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7295 } 7296 } else { 7297 /* Not all of it fits, we fragment */ 7298 if (sp->some_taken == 0) { 7299 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7300 } 7301 sp->some_taken = 1; 7302 } 7303 } else { 7304 to_move = sctp_can_we_split_this(stcb, length, space_left, frag_point, eeor_mode); 7305 if (to_move) { 7306 /*- 7307 * We use a snapshot of length in case it 7308 * is expanding during the compare. 7309 */ 7310 uint32_t llen; 7311 7312 llen = length; 7313 if (to_move >= llen) { 7314 to_move = llen; 7315 if (send_lock_up == 0) { 7316 /*- 7317 * We are taking all of an incomplete msg 7318 * thus we need a send lock. 7319 */ 7320 SCTP_TCB_SEND_LOCK(stcb); 7321 send_lock_up = 1; 7322 if (sp->msg_is_complete) { 7323 /* 7324 * the sender finished the 7325 * msg 7326 */ 7327 goto re_look; 7328 } 7329 } 7330 } 7331 if (sp->some_taken == 0) { 7332 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7333 sp->some_taken = 1; 7334 } 7335 } else { 7336 /* Nothing to take. */ 7337 *giveup = 1; 7338 to_move = 0; 7339 goto out_of; 7340 } 7341 } 7342 7343 /* If we reach here, we can copy out a chunk */ 7344 sctp_alloc_a_chunk(stcb, chk); 7345 if (chk == NULL) { 7346 /* No chunk memory */ 7347 *giveup = 1; 7348 to_move = 0; 7349 goto out_of; 7350 } 7351 /* 7352 * Setup for unordered if needed by looking at the user sent info 7353 * flags. 7354 */ 7355 if (sp->sinfo_flags & SCTP_UNORDERED) { 7356 rcv_flags |= SCTP_DATA_UNORDERED; 7357 } 7358 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 7359 (sp->sinfo_flags & SCTP_EOF) == SCTP_EOF) { 7360 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7361 } 7362 /* clear out the chunk before setting up */ 7363 memset(chk, 0, sizeof(*chk)); 7364 chk->rec.data.rcv_flags = rcv_flags; 7365 7366 if (to_move >= length) { 7367 /* we think we can steal the whole thing */ 7368 if ((sp->sender_all_done == 0) && (send_lock_up == 0)) { 7369 SCTP_TCB_SEND_LOCK(stcb); 7370 send_lock_up = 1; 7371 } 7372 if (to_move < sp->length) { 7373 /* bail, it changed */ 7374 goto dont_do_it; 7375 } 7376 chk->data = sp->data; 7377 chk->last_mbuf = sp->tail_mbuf; 7378 /* register the stealing */ 7379 sp->data = sp->tail_mbuf = NULL; 7380 } else { 7381 struct mbuf *m; 7382 7383 dont_do_it: 7384 chk->data = SCTP_M_COPYM(sp->data, 0, to_move, M_NOWAIT); 7385 chk->last_mbuf = NULL; 7386 if (chk->data == NULL) { 7387 sp->some_taken = some_taken; 7388 sctp_free_a_chunk(stcb, chk, so_locked); 7389 *bail = 1; 7390 to_move = 0; 7391 goto out_of; 7392 } 7393 #ifdef SCTP_MBUF_LOGGING 7394 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 7395 sctp_log_mbc(chk->data, SCTP_MBUF_ICOPY); 7396 } 7397 #endif 7398 /* Pull off the data */ 7399 m_adj(sp->data, to_move); 7400 /* Now lets work our way down and compact it */ 7401 m = sp->data; 7402 while (m && (SCTP_BUF_LEN(m) == 0)) { 7403 sp->data = SCTP_BUF_NEXT(m); 7404 SCTP_BUF_NEXT(m) = NULL; 7405 if (sp->tail_mbuf == m) { 7406 /*- 7407 * Freeing tail? TSNH since 7408 * we supposedly were taking less 7409 * than the sp->length. 7410 */ 7411 #ifdef INVARIANTS 7412 panic("Huh, freing tail? - TSNH"); 7413 #else 7414 SCTP_PRINTF("Huh, freeing tail? - TSNH\n"); 7415 sp->tail_mbuf = sp->data = NULL; 7416 sp->length = 0; 7417 #endif 7418 } 7419 sctp_m_free(m); 7420 m = sp->data; 7421 } 7422 } 7423 if (SCTP_BUF_IS_EXTENDED(chk->data)) { 7424 chk->copy_by_ref = 1; 7425 } else { 7426 chk->copy_by_ref = 0; 7427 } 7428 /* 7429 * get last_mbuf and counts of mb usage This is ugly but hopefully 7430 * its only one mbuf. 7431 */ 7432 if (chk->last_mbuf == NULL) { 7433 chk->last_mbuf = chk->data; 7434 while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) { 7435 chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf); 7436 } 7437 } 7438 7439 if (to_move > length) { 7440 /*- This should not happen either 7441 * since we always lower to_move to the size 7442 * of sp->length if its larger. 7443 */ 7444 #ifdef INVARIANTS 7445 panic("Huh, how can to_move be larger?"); 7446 #else 7447 SCTP_PRINTF("Huh, how can to_move be larger?\n"); 7448 sp->length = 0; 7449 #endif 7450 } else { 7451 atomic_subtract_int(&sp->length, to_move); 7452 } 7453 leading = SCTP_DATA_CHUNK_OVERHEAD(stcb); 7454 if (M_LEADINGSPACE(chk->data) < leading) { 7455 /* Not enough room for a chunk header, get some */ 7456 struct mbuf *m; 7457 7458 m = sctp_get_mbuf_for_msg(1, 0, M_NOWAIT, 1, MT_DATA); 7459 if (m == NULL) { 7460 /* 7461 * we're in trouble here. _PREPEND below will free 7462 * all the data if there is no leading space, so we 7463 * must put the data back and restore. 7464 */ 7465 if (send_lock_up == 0) { 7466 SCTP_TCB_SEND_LOCK(stcb); 7467 send_lock_up = 1; 7468 } 7469 if (sp->data == NULL) { 7470 /* unsteal the data */ 7471 sp->data = chk->data; 7472 sp->tail_mbuf = chk->last_mbuf; 7473 } else { 7474 struct mbuf *m_tmp; 7475 7476 /* reassemble the data */ 7477 m_tmp = sp->data; 7478 sp->data = chk->data; 7479 SCTP_BUF_NEXT(chk->last_mbuf) = m_tmp; 7480 } 7481 sp->some_taken = some_taken; 7482 atomic_add_int(&sp->length, to_move); 7483 chk->data = NULL; 7484 *bail = 1; 7485 sctp_free_a_chunk(stcb, chk, so_locked); 7486 to_move = 0; 7487 goto out_of; 7488 } else { 7489 SCTP_BUF_LEN(m) = 0; 7490 SCTP_BUF_NEXT(m) = chk->data; 7491 chk->data = m; 7492 M_ALIGN(chk->data, 4); 7493 } 7494 } 7495 SCTP_BUF_PREPEND(chk->data, SCTP_DATA_CHUNK_OVERHEAD(stcb), M_NOWAIT); 7496 if (chk->data == NULL) { 7497 /* HELP, TSNH since we assured it would not above? */ 7498 #ifdef INVARIANTS 7499 panic("prepend failes HELP?"); 7500 #else 7501 SCTP_PRINTF("prepend fails HELP?\n"); 7502 sctp_free_a_chunk(stcb, chk, so_locked); 7503 #endif 7504 *bail = 1; 7505 to_move = 0; 7506 goto out_of; 7507 } 7508 sctp_snd_sb_alloc(stcb, SCTP_DATA_CHUNK_OVERHEAD(stcb)); 7509 chk->book_size = chk->send_size = (uint16_t)(to_move + SCTP_DATA_CHUNK_OVERHEAD(stcb)); 7510 chk->book_size_scale = 0; 7511 chk->sent = SCTP_DATAGRAM_UNSENT; 7512 7513 chk->flags = 0; 7514 chk->asoc = &stcb->asoc; 7515 chk->pad_inplace = 0; 7516 chk->no_fr_allowed = 0; 7517 if (stcb->asoc.idata_supported == 0) { 7518 if (rcv_flags & SCTP_DATA_UNORDERED) { 7519 /* Just use 0. The receiver ignores the values. */ 7520 chk->rec.data.mid = 0; 7521 } else { 7522 chk->rec.data.mid = strq->next_mid_ordered; 7523 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7524 strq->next_mid_ordered++; 7525 } 7526 } 7527 } else { 7528 if (rcv_flags & SCTP_DATA_UNORDERED) { 7529 chk->rec.data.mid = strq->next_mid_unordered; 7530 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7531 strq->next_mid_unordered++; 7532 } 7533 } else { 7534 chk->rec.data.mid = strq->next_mid_ordered; 7535 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7536 strq->next_mid_ordered++; 7537 } 7538 } 7539 } 7540 chk->rec.data.sid = sp->sid; 7541 chk->rec.data.ppid = sp->ppid; 7542 chk->rec.data.context = sp->context; 7543 chk->rec.data.doing_fast_retransmit = 0; 7544 7545 chk->rec.data.timetodrop = sp->ts; 7546 chk->flags = sp->act_flags; 7547 7548 if (sp->net) { 7549 chk->whoTo = sp->net; 7550 atomic_add_int(&chk->whoTo->ref_count, 1); 7551 } else 7552 chk->whoTo = NULL; 7553 7554 if (sp->holds_key_ref) { 7555 chk->auth_keyid = sp->auth_keyid; 7556 sctp_auth_key_acquire(stcb, chk->auth_keyid); 7557 chk->holds_key_ref = 1; 7558 } 7559 stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, to_move); 7560 chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1); 7561 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) { 7562 sctp_misc_ints(SCTP_STRMOUT_LOG_SEND, 7563 (uint32_t)(uintptr_t)stcb, sp->length, 7564 (uint32_t)((chk->rec.data.sid << 16) | (0x0000ffff & chk->rec.data.mid)), 7565 chk->rec.data.tsn); 7566 } 7567 if (stcb->asoc.idata_supported == 0) { 7568 dchkh = mtod(chk->data, struct sctp_data_chunk *); 7569 } else { 7570 ndchkh = mtod(chk->data, struct sctp_idata_chunk *); 7571 } 7572 /* 7573 * Put the rest of the things in place now. Size was done earlier in 7574 * previous loop prior to padding. 7575 */ 7576 7577 #ifdef SCTP_ASOCLOG_OF_TSNS 7578 SCTP_TCB_LOCK_ASSERT(stcb); 7579 if (asoc->tsn_out_at >= SCTP_TSN_LOG_SIZE) { 7580 asoc->tsn_out_at = 0; 7581 asoc->tsn_out_wrapped = 1; 7582 } 7583 asoc->out_tsnlog[asoc->tsn_out_at].tsn = chk->rec.data.tsn; 7584 asoc->out_tsnlog[asoc->tsn_out_at].strm = chk->rec.data.sid; 7585 asoc->out_tsnlog[asoc->tsn_out_at].seq = chk->rec.data.mid; 7586 asoc->out_tsnlog[asoc->tsn_out_at].sz = chk->send_size; 7587 asoc->out_tsnlog[asoc->tsn_out_at].flgs = chk->rec.data.rcv_flags; 7588 asoc->out_tsnlog[asoc->tsn_out_at].stcb = (void *)stcb; 7589 asoc->out_tsnlog[asoc->tsn_out_at].in_pos = asoc->tsn_out_at; 7590 asoc->out_tsnlog[asoc->tsn_out_at].in_out = 2; 7591 asoc->tsn_out_at++; 7592 #endif 7593 if (stcb->asoc.idata_supported == 0) { 7594 dchkh->ch.chunk_type = SCTP_DATA; 7595 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7596 dchkh->dp.tsn = htonl(chk->rec.data.tsn); 7597 dchkh->dp.sid = htons(strq->sid); 7598 dchkh->dp.ssn = htons((uint16_t)chk->rec.data.mid); 7599 dchkh->dp.ppid = chk->rec.data.ppid; 7600 dchkh->ch.chunk_length = htons(chk->send_size); 7601 } else { 7602 ndchkh->ch.chunk_type = SCTP_IDATA; 7603 ndchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7604 ndchkh->dp.tsn = htonl(chk->rec.data.tsn); 7605 ndchkh->dp.sid = htons(strq->sid); 7606 ndchkh->dp.reserved = htons(0); 7607 ndchkh->dp.mid = htonl(chk->rec.data.mid); 7608 if (sp->fsn == 0) 7609 ndchkh->dp.ppid_fsn.ppid = chk->rec.data.ppid; 7610 else 7611 ndchkh->dp.ppid_fsn.fsn = htonl(sp->fsn); 7612 sp->fsn++; 7613 ndchkh->ch.chunk_length = htons(chk->send_size); 7614 } 7615 /* Now advance the chk->send_size by the actual pad needed. */ 7616 if (chk->send_size < SCTP_SIZE32(chk->book_size)) { 7617 /* need a pad */ 7618 struct mbuf *lm; 7619 int pads; 7620 7621 pads = SCTP_SIZE32(chk->book_size) - chk->send_size; 7622 lm = sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf); 7623 if (lm != NULL) { 7624 chk->last_mbuf = lm; 7625 chk->pad_inplace = 1; 7626 } 7627 chk->send_size += pads; 7628 } 7629 if (PR_SCTP_ENABLED(chk->flags)) { 7630 asoc->pr_sctp_cnt++; 7631 } 7632 if (sp->msg_is_complete && (sp->length == 0) && (sp->sender_all_done)) { 7633 /* All done pull and kill the message */ 7634 if (sp->put_last_out == 0) { 7635 SCTP_PRINTF("Gak, put out entire msg with NO end!-2\n"); 7636 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7637 sp->sender_all_done, 7638 sp->length, 7639 sp->msg_is_complete, 7640 sp->put_last_out, 7641 send_lock_up); 7642 } 7643 if (send_lock_up == 0) { 7644 SCTP_TCB_SEND_LOCK(stcb); 7645 send_lock_up = 1; 7646 } 7647 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7648 TAILQ_REMOVE(&strq->outqueue, sp, next); 7649 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp); 7650 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7651 (strq->chunks_on_queues == 0) && 7652 TAILQ_EMPTY(&strq->outqueue)) { 7653 stcb->asoc.trigger_reset = 1; 7654 } 7655 if (sp->net) { 7656 sctp_free_remote_addr(sp->net); 7657 sp->net = NULL; 7658 } 7659 if (sp->data) { 7660 sctp_m_freem(sp->data); 7661 sp->data = NULL; 7662 } 7663 sctp_free_a_strmoq(stcb, sp, so_locked); 7664 } 7665 asoc->chunks_on_out_queue++; 7666 strq->chunks_on_queues++; 7667 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 7668 asoc->send_queue_cnt++; 7669 out_of: 7670 if (send_lock_up) { 7671 SCTP_TCB_SEND_UNLOCK(stcb); 7672 } 7673 return (to_move); 7674 } 7675 7676 static void 7677 sctp_fill_outqueue(struct sctp_tcb *stcb, struct sctp_nets *net, int frag_point, 7678 int eeor_mode, int *quit_now, int so_locked) 7679 { 7680 struct sctp_association *asoc; 7681 struct sctp_stream_out *strq; 7682 uint32_t space_left, moved, total_moved; 7683 int bail, giveup; 7684 7685 SCTP_TCB_LOCK_ASSERT(stcb); 7686 asoc = &stcb->asoc; 7687 total_moved = 0; 7688 switch (net->ro._l_addr.sa.sa_family) { 7689 #ifdef INET 7690 case AF_INET: 7691 space_left = net->mtu - SCTP_MIN_V4_OVERHEAD; 7692 break; 7693 #endif 7694 #ifdef INET6 7695 case AF_INET6: 7696 space_left = net->mtu - SCTP_MIN_OVERHEAD; 7697 break; 7698 #endif 7699 default: 7700 /* TSNH */ 7701 space_left = net->mtu; 7702 break; 7703 } 7704 /* Need an allowance for the data chunk header too */ 7705 space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb); 7706 7707 /* must make even word boundary */ 7708 space_left &= 0xfffffffc; 7709 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7710 giveup = 0; 7711 bail = 0; 7712 while ((space_left > 0) && (strq != NULL)) { 7713 moved = sctp_move_to_outqueue(stcb, net, strq, space_left, 7714 frag_point, &giveup, eeor_mode, 7715 &bail, so_locked); 7716 if ((giveup != 0) || (bail != 0)) { 7717 break; 7718 } 7719 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7720 total_moved += moved; 7721 if (space_left >= moved) { 7722 space_left -= moved; 7723 } else { 7724 space_left = 0; 7725 } 7726 if (space_left >= SCTP_DATA_CHUNK_OVERHEAD(stcb)) { 7727 space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb); 7728 } else { 7729 space_left = 0; 7730 } 7731 space_left &= 0xfffffffc; 7732 } 7733 if (bail != 0) 7734 *quit_now = 1; 7735 7736 stcb->asoc.ss_functions.sctp_ss_packet_done(stcb, net, asoc); 7737 7738 if (total_moved == 0) { 7739 if ((stcb->asoc.sctp_cmt_on_off == 0) && 7740 (net == stcb->asoc.primary_destination)) { 7741 /* ran dry for primary network net */ 7742 SCTP_STAT_INCR(sctps_primary_randry); 7743 } else if (stcb->asoc.sctp_cmt_on_off > 0) { 7744 /* ran dry with CMT on */ 7745 SCTP_STAT_INCR(sctps_cmt_randry); 7746 } 7747 } 7748 } 7749 7750 void 7751 sctp_fix_ecn_echo(struct sctp_association *asoc) 7752 { 7753 struct sctp_tmit_chunk *chk; 7754 7755 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7756 if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 7757 chk->sent = SCTP_DATAGRAM_UNSENT; 7758 } 7759 } 7760 } 7761 7762 void 7763 sctp_move_chunks_from_net(struct sctp_tcb *stcb, struct sctp_nets *net) 7764 { 7765 struct sctp_association *asoc; 7766 struct sctp_tmit_chunk *chk; 7767 struct sctp_stream_queue_pending *sp; 7768 unsigned int i; 7769 7770 if (net == NULL) { 7771 return; 7772 } 7773 asoc = &stcb->asoc; 7774 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 7775 TAILQ_FOREACH(sp, &stcb->asoc.strmout[i].outqueue, next) { 7776 if (sp->net == net) { 7777 sctp_free_remote_addr(sp->net); 7778 sp->net = NULL; 7779 } 7780 } 7781 } 7782 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7783 if (chk->whoTo == net) { 7784 sctp_free_remote_addr(chk->whoTo); 7785 chk->whoTo = NULL; 7786 } 7787 } 7788 } 7789 7790 int 7791 sctp_med_chunk_output(struct sctp_inpcb *inp, 7792 struct sctp_tcb *stcb, 7793 struct sctp_association *asoc, 7794 int *num_out, 7795 int *reason_code, 7796 int control_only, int from_where, 7797 struct timeval *now, int *now_filled, int frag_point, int so_locked) 7798 { 7799 /** 7800 * Ok this is the generic chunk service queue. we must do the 7801 * following: 7802 * - Service the stream queue that is next, moving any 7803 * message (note I must get a complete message i.e. FIRST/MIDDLE and 7804 * LAST to the out queue in one pass) and assigning TSN's. This 7805 * only applys though if the peer does not support NDATA. For NDATA 7806 * chunks its ok to not send the entire message ;-) 7807 * - Check to see if the cwnd/rwnd allows any output, if so we go ahead and 7808 * fomulate and send the low level chunks. Making sure to combine 7809 * any control in the control chunk queue also. 7810 */ 7811 struct sctp_nets *net, *start_at, *sack_goes_to = NULL, *old_start_at = NULL; 7812 struct mbuf *outchain, *endoutchain; 7813 struct sctp_tmit_chunk *chk, *nchk; 7814 7815 /* temp arrays for unlinking */ 7816 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 7817 int no_fragmentflg, error; 7818 unsigned int max_rwnd_per_dest, max_send_per_dest; 7819 int one_chunk, hbflag, skip_data_for_this_net; 7820 int asconf, cookie, no_out_cnt; 7821 int bundle_at, ctl_cnt, no_data_chunks, eeor_mode; 7822 unsigned int mtu, r_mtu, omtu, mx_mtu, to_out; 7823 int tsns_sent = 0; 7824 uint32_t auth_offset; 7825 struct sctp_auth_chunk *auth; 7826 uint16_t auth_keyid; 7827 int override_ok = 1; 7828 int skip_fill_up = 0; 7829 int data_auth_reqd = 0; 7830 7831 /* 7832 * JRS 5/14/07 - Add flag for whether a heartbeat is sent to the 7833 * destination. 7834 */ 7835 int quit_now = 0; 7836 7837 *num_out = 0; 7838 *reason_code = 0; 7839 auth_keyid = stcb->asoc.authinfo.active_keyid; 7840 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) || 7841 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 7842 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 7843 eeor_mode = 1; 7844 } else { 7845 eeor_mode = 0; 7846 } 7847 ctl_cnt = no_out_cnt = asconf = cookie = 0; 7848 /* 7849 * First lets prime the pump. For each destination, if there is room 7850 * in the flight size, attempt to pull an MTU's worth out of the 7851 * stream queues into the general send_queue 7852 */ 7853 #ifdef SCTP_AUDITING_ENABLED 7854 sctp_audit_log(0xC2, 2); 7855 #endif 7856 SCTP_TCB_LOCK_ASSERT(stcb); 7857 hbflag = 0; 7858 if (control_only) 7859 no_data_chunks = 1; 7860 else 7861 no_data_chunks = 0; 7862 7863 /* Nothing to possible to send? */ 7864 if ((TAILQ_EMPTY(&asoc->control_send_queue) || 7865 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) && 7866 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7867 TAILQ_EMPTY(&asoc->send_queue) && 7868 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 7869 nothing_to_send: 7870 *reason_code = 9; 7871 return (0); 7872 } 7873 if (asoc->peers_rwnd == 0) { 7874 /* No room in peers rwnd */ 7875 *reason_code = 1; 7876 if (asoc->total_flight > 0) { 7877 /* we are allowed one chunk in flight */ 7878 no_data_chunks = 1; 7879 } 7880 } 7881 if (stcb->asoc.ecn_echo_cnt_onq) { 7882 /* Record where a sack goes, if any */ 7883 if (no_data_chunks && 7884 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) { 7885 /* Nothing but ECNe to send - we don't do that */ 7886 goto nothing_to_send; 7887 } 7888 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7889 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7890 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 7891 sack_goes_to = chk->whoTo; 7892 break; 7893 } 7894 } 7895 } 7896 max_rwnd_per_dest = ((asoc->peers_rwnd + asoc->total_flight) / asoc->numnets); 7897 if (stcb->sctp_socket) 7898 max_send_per_dest = SCTP_SB_LIMIT_SND(stcb->sctp_socket) / asoc->numnets; 7899 else 7900 max_send_per_dest = 0; 7901 if (no_data_chunks == 0) { 7902 /* How many non-directed chunks are there? */ 7903 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7904 if (chk->whoTo == NULL) { 7905 /* 7906 * We already have non-directed chunks on 7907 * the queue, no need to do a fill-up. 7908 */ 7909 skip_fill_up = 1; 7910 break; 7911 } 7912 } 7913 } 7914 if ((no_data_chunks == 0) && 7915 (skip_fill_up == 0) && 7916 (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc))) { 7917 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 7918 /* 7919 * This for loop we are in takes in each net, if 7920 * its's got space in cwnd and has data sent to it 7921 * (when CMT is off) then it calls 7922 * sctp_fill_outqueue for the net. This gets data on 7923 * the send queue for that network. 7924 * 7925 * In sctp_fill_outqueue TSN's are assigned and data 7926 * is copied out of the stream buffers. Note mostly 7927 * copy by reference (we hope). 7928 */ 7929 net->window_probe = 0; 7930 if ((net != stcb->asoc.alternate) && 7931 ((net->dest_state & SCTP_ADDR_PF) || 7932 (!(net->dest_state & SCTP_ADDR_REACHABLE)) || 7933 (net->dest_state & SCTP_ADDR_UNCONFIRMED))) { 7934 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7935 sctp_log_cwnd(stcb, net, 1, 7936 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7937 } 7938 continue; 7939 } 7940 if ((stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) && 7941 (net->flight_size == 0)) { 7942 (*stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) (stcb, net); 7943 } 7944 if (net->flight_size >= net->cwnd) { 7945 /* skip this network, no room - can't fill */ 7946 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7947 sctp_log_cwnd(stcb, net, 3, 7948 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7949 } 7950 continue; 7951 } 7952 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7953 sctp_log_cwnd(stcb, net, 4, SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7954 } 7955 sctp_fill_outqueue(stcb, net, frag_point, eeor_mode, &quit_now, so_locked); 7956 if (quit_now) { 7957 /* memory alloc failure */ 7958 no_data_chunks = 1; 7959 break; 7960 } 7961 } 7962 } 7963 /* now service each destination and send out what we can for it */ 7964 /* Nothing to send? */ 7965 if (TAILQ_EMPTY(&asoc->control_send_queue) && 7966 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7967 TAILQ_EMPTY(&asoc->send_queue)) { 7968 *reason_code = 8; 7969 return (0); 7970 } 7971 7972 if (asoc->sctp_cmt_on_off > 0) { 7973 /* get the last start point */ 7974 start_at = asoc->last_net_cmt_send_started; 7975 if (start_at == NULL) { 7976 /* null so to beginning */ 7977 start_at = TAILQ_FIRST(&asoc->nets); 7978 } else { 7979 start_at = TAILQ_NEXT(asoc->last_net_cmt_send_started, sctp_next); 7980 if (start_at == NULL) { 7981 start_at = TAILQ_FIRST(&asoc->nets); 7982 } 7983 } 7984 asoc->last_net_cmt_send_started = start_at; 7985 } else { 7986 start_at = TAILQ_FIRST(&asoc->nets); 7987 } 7988 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7989 if (chk->whoTo == NULL) { 7990 if (asoc->alternate) { 7991 chk->whoTo = asoc->alternate; 7992 } else { 7993 chk->whoTo = asoc->primary_destination; 7994 } 7995 atomic_add_int(&chk->whoTo->ref_count, 1); 7996 } 7997 } 7998 old_start_at = NULL; 7999 again_one_more_time: 8000 for (net = start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) { 8001 /* how much can we send? */ 8002 /* SCTPDBG("Examine for sending net:%x\n", (uint32_t)net); */ 8003 if (old_start_at && (old_start_at == net)) { 8004 /* through list ocmpletely. */ 8005 break; 8006 } 8007 tsns_sent = 0xa; 8008 if (TAILQ_EMPTY(&asoc->control_send_queue) && 8009 TAILQ_EMPTY(&asoc->asconf_send_queue) && 8010 (net->flight_size >= net->cwnd)) { 8011 /* 8012 * Nothing on control or asconf and flight is full, 8013 * we can skip even in the CMT case. 8014 */ 8015 continue; 8016 } 8017 bundle_at = 0; 8018 endoutchain = outchain = NULL; 8019 auth = NULL; 8020 auth_offset = 0; 8021 no_fragmentflg = 1; 8022 one_chunk = 0; 8023 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 8024 skip_data_for_this_net = 1; 8025 } else { 8026 skip_data_for_this_net = 0; 8027 } 8028 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8029 #ifdef INET 8030 case AF_INET: 8031 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8032 break; 8033 #endif 8034 #ifdef INET6 8035 case AF_INET6: 8036 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8037 break; 8038 #endif 8039 default: 8040 /* TSNH */ 8041 mtu = net->mtu; 8042 break; 8043 } 8044 mx_mtu = mtu; 8045 to_out = 0; 8046 if (mtu > asoc->peers_rwnd) { 8047 if (asoc->total_flight > 0) { 8048 /* We have a packet in flight somewhere */ 8049 r_mtu = asoc->peers_rwnd; 8050 } else { 8051 /* We are always allowed to send one MTU out */ 8052 one_chunk = 1; 8053 r_mtu = mtu; 8054 } 8055 } else { 8056 r_mtu = mtu; 8057 } 8058 error = 0; 8059 /************************/ 8060 /* ASCONF transmission */ 8061 /************************/ 8062 /* Now first lets go through the asconf queue */ 8063 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 8064 if (chk->rec.chunk_id.id != SCTP_ASCONF) { 8065 continue; 8066 } 8067 if (chk->whoTo == NULL) { 8068 if (asoc->alternate == NULL) { 8069 if (asoc->primary_destination != net) { 8070 break; 8071 } 8072 } else { 8073 if (asoc->alternate != net) { 8074 break; 8075 } 8076 } 8077 } else { 8078 if (chk->whoTo != net) { 8079 break; 8080 } 8081 } 8082 if (chk->data == NULL) { 8083 break; 8084 } 8085 if (chk->sent != SCTP_DATAGRAM_UNSENT && 8086 chk->sent != SCTP_DATAGRAM_RESEND) { 8087 break; 8088 } 8089 /* 8090 * if no AUTH is yet included and this chunk 8091 * requires it, make sure to account for it. We 8092 * don't apply the size until the AUTH chunk is 8093 * actually added below in case there is no room for 8094 * this chunk. NOTE: we overload the use of "omtu" 8095 * here 8096 */ 8097 if ((auth == NULL) && 8098 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8099 stcb->asoc.peer_auth_chunks)) { 8100 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8101 } else 8102 omtu = 0; 8103 /* Here we do NOT factor the r_mtu */ 8104 if ((chk->send_size < (int)(mtu - omtu)) || 8105 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8106 /* 8107 * We probably should glom the mbuf chain 8108 * from the chk->data for control but the 8109 * problem is it becomes yet one more level 8110 * of tracking to do if for some reason 8111 * output fails. Then I have got to 8112 * reconstruct the merged control chain.. el 8113 * yucko.. for now we take the easy way and 8114 * do the copy 8115 */ 8116 /* 8117 * Add an AUTH chunk, if chunk requires it 8118 * save the offset into the chain for AUTH 8119 */ 8120 if ((auth == NULL) && 8121 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8122 stcb->asoc.peer_auth_chunks))) { 8123 outchain = sctp_add_auth_chunk(outchain, 8124 &endoutchain, 8125 &auth, 8126 &auth_offset, 8127 stcb, 8128 chk->rec.chunk_id.id); 8129 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8130 } 8131 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8132 (int)chk->rec.chunk_id.can_take_data, 8133 chk->send_size, chk->copy_by_ref); 8134 if (outchain == NULL) { 8135 *reason_code = 8; 8136 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8137 return (ENOMEM); 8138 } 8139 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8140 /* update our MTU size */ 8141 if (mtu > (chk->send_size + omtu)) 8142 mtu -= (chk->send_size + omtu); 8143 else 8144 mtu = 0; 8145 to_out += (chk->send_size + omtu); 8146 /* Do clear IP_DF ? */ 8147 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8148 no_fragmentflg = 0; 8149 } 8150 if (chk->rec.chunk_id.can_take_data) 8151 chk->data = NULL; 8152 /* 8153 * set hb flag since we can use these for 8154 * RTO 8155 */ 8156 hbflag = 1; 8157 asconf = 1; 8158 /* 8159 * should sysctl this: don't bundle data 8160 * with ASCONF since it requires AUTH 8161 */ 8162 no_data_chunks = 1; 8163 chk->sent = SCTP_DATAGRAM_SENT; 8164 if (chk->whoTo == NULL) { 8165 chk->whoTo = net; 8166 atomic_add_int(&net->ref_count, 1); 8167 } 8168 chk->snd_count++; 8169 if (mtu == 0) { 8170 /* 8171 * Ok we are out of room but we can 8172 * output without effecting the 8173 * flight size since this little guy 8174 * is a control only packet. 8175 */ 8176 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8177 /* 8178 * do NOT clear the asconf flag as 8179 * it is used to do appropriate 8180 * source address selection. 8181 */ 8182 if (*now_filled == 0) { 8183 (void)SCTP_GETTIME_TIMEVAL(now); 8184 *now_filled = 1; 8185 } 8186 net->last_sent_time = *now; 8187 hbflag = 0; 8188 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8189 (struct sockaddr *)&net->ro._l_addr, 8190 outchain, auth_offset, auth, 8191 stcb->asoc.authinfo.active_keyid, 8192 no_fragmentflg, 0, asconf, 8193 inp->sctp_lport, stcb->rport, 8194 htonl(stcb->asoc.peer_vtag), 8195 net->port, NULL, 8196 0, 0, 8197 so_locked))) { 8198 /* 8199 * error, we could not 8200 * output 8201 */ 8202 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8203 if (from_where == 0) { 8204 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8205 } 8206 if (error == ENOBUFS) { 8207 asoc->ifp_had_enobuf = 1; 8208 SCTP_STAT_INCR(sctps_lowlevelerr); 8209 } 8210 /* error, could not output */ 8211 if (error == EHOSTUNREACH) { 8212 /* 8213 * Destination went 8214 * unreachable 8215 * during this send 8216 */ 8217 sctp_move_chunks_from_net(stcb, net); 8218 } 8219 *reason_code = 7; 8220 break; 8221 } else { 8222 asoc->ifp_had_enobuf = 0; 8223 } 8224 /* 8225 * increase the number we sent, if a 8226 * cookie is sent we don't tell them 8227 * any was sent out. 8228 */ 8229 outchain = endoutchain = NULL; 8230 auth = NULL; 8231 auth_offset = 0; 8232 if (!no_out_cnt) 8233 *num_out += ctl_cnt; 8234 /* recalc a clean slate and setup */ 8235 switch (net->ro._l_addr.sa.sa_family) { 8236 #ifdef INET 8237 case AF_INET: 8238 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8239 break; 8240 #endif 8241 #ifdef INET6 8242 case AF_INET6: 8243 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8244 break; 8245 #endif 8246 default: 8247 /* TSNH */ 8248 mtu = net->mtu; 8249 break; 8250 } 8251 to_out = 0; 8252 no_fragmentflg = 1; 8253 } 8254 } 8255 } 8256 if (error != 0) { 8257 /* try next net */ 8258 continue; 8259 } 8260 /************************/ 8261 /* Control transmission */ 8262 /************************/ 8263 /* Now first lets go through the control queue */ 8264 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 8265 if ((sack_goes_to) && 8266 (chk->rec.chunk_id.id == SCTP_ECN_ECHO) && 8267 (chk->whoTo != sack_goes_to)) { 8268 /* 8269 * if we have a sack in queue, and we are 8270 * looking at an ecn echo that is NOT queued 8271 * to where the sack is going.. 8272 */ 8273 if (chk->whoTo == net) { 8274 /* 8275 * Don't transmit it to where its 8276 * going (current net) 8277 */ 8278 continue; 8279 } else if (sack_goes_to == net) { 8280 /* 8281 * But do transmit it to this 8282 * address 8283 */ 8284 goto skip_net_check; 8285 } 8286 } 8287 if (chk->whoTo == NULL) { 8288 if (asoc->alternate == NULL) { 8289 if (asoc->primary_destination != net) { 8290 continue; 8291 } 8292 } else { 8293 if (asoc->alternate != net) { 8294 continue; 8295 } 8296 } 8297 } else { 8298 if (chk->whoTo != net) { 8299 continue; 8300 } 8301 } 8302 skip_net_check: 8303 if (chk->data == NULL) { 8304 continue; 8305 } 8306 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 8307 /* 8308 * It must be unsent. Cookies and ASCONF's 8309 * hang around but there timers will force 8310 * when marked for resend. 8311 */ 8312 continue; 8313 } 8314 /* 8315 * if no AUTH is yet included and this chunk 8316 * requires it, make sure to account for it. We 8317 * don't apply the size until the AUTH chunk is 8318 * actually added below in case there is no room for 8319 * this chunk. NOTE: we overload the use of "omtu" 8320 * here 8321 */ 8322 if ((auth == NULL) && 8323 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8324 stcb->asoc.peer_auth_chunks)) { 8325 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8326 } else 8327 omtu = 0; 8328 /* Here we do NOT factor the r_mtu */ 8329 if ((chk->send_size <= (int)(mtu - omtu)) || 8330 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8331 /* 8332 * We probably should glom the mbuf chain 8333 * from the chk->data for control but the 8334 * problem is it becomes yet one more level 8335 * of tracking to do if for some reason 8336 * output fails. Then I have got to 8337 * reconstruct the merged control chain.. el 8338 * yucko.. for now we take the easy way and 8339 * do the copy 8340 */ 8341 /* 8342 * Add an AUTH chunk, if chunk requires it 8343 * save the offset into the chain for AUTH 8344 */ 8345 if ((auth == NULL) && 8346 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8347 stcb->asoc.peer_auth_chunks))) { 8348 outchain = sctp_add_auth_chunk(outchain, 8349 &endoutchain, 8350 &auth, 8351 &auth_offset, 8352 stcb, 8353 chk->rec.chunk_id.id); 8354 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8355 } 8356 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8357 (int)chk->rec.chunk_id.can_take_data, 8358 chk->send_size, chk->copy_by_ref); 8359 if (outchain == NULL) { 8360 *reason_code = 8; 8361 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8362 return (ENOMEM); 8363 } 8364 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8365 /* update our MTU size */ 8366 if (mtu > (chk->send_size + omtu)) 8367 mtu -= (chk->send_size + omtu); 8368 else 8369 mtu = 0; 8370 to_out += (chk->send_size + omtu); 8371 /* Do clear IP_DF ? */ 8372 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8373 no_fragmentflg = 0; 8374 } 8375 if (chk->rec.chunk_id.can_take_data) 8376 chk->data = NULL; 8377 /* Mark things to be removed, if needed */ 8378 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8379 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 8380 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 8381 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 8382 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 8383 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 8384 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 8385 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 8386 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 8387 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 8388 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 8389 if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) { 8390 hbflag = 1; 8391 } 8392 /* remove these chunks at the end */ 8393 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8394 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 8395 /* turn off the timer */ 8396 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 8397 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 8398 inp, stcb, NULL, 8399 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1); 8400 } 8401 } 8402 ctl_cnt++; 8403 } else { 8404 /* 8405 * Other chunks, since they have 8406 * timers running (i.e. COOKIE) we 8407 * just "trust" that it gets sent or 8408 * retransmitted. 8409 */ 8410 ctl_cnt++; 8411 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 8412 cookie = 1; 8413 no_out_cnt = 1; 8414 } else if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 8415 /* 8416 * Increment ecne send count 8417 * here this means we may be 8418 * over-zealous in our 8419 * counting if the send 8420 * fails, but its the best 8421 * place to do it (we used 8422 * to do it in the queue of 8423 * the chunk, but that did 8424 * not tell how many times 8425 * it was sent. 8426 */ 8427 SCTP_STAT_INCR(sctps_sendecne); 8428 } 8429 chk->sent = SCTP_DATAGRAM_SENT; 8430 if (chk->whoTo == NULL) { 8431 chk->whoTo = net; 8432 atomic_add_int(&net->ref_count, 1); 8433 } 8434 chk->snd_count++; 8435 } 8436 if (mtu == 0) { 8437 /* 8438 * Ok we are out of room but we can 8439 * output without effecting the 8440 * flight size since this little guy 8441 * is a control only packet. 8442 */ 8443 if (asconf) { 8444 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8445 /* 8446 * do NOT clear the asconf 8447 * flag as it is used to do 8448 * appropriate source 8449 * address selection. 8450 */ 8451 } 8452 if (cookie) { 8453 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8454 cookie = 0; 8455 } 8456 /* Only HB or ASCONF advances time */ 8457 if (hbflag) { 8458 if (*now_filled == 0) { 8459 (void)SCTP_GETTIME_TIMEVAL(now); 8460 *now_filled = 1; 8461 } 8462 net->last_sent_time = *now; 8463 hbflag = 0; 8464 } 8465 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8466 (struct sockaddr *)&net->ro._l_addr, 8467 outchain, 8468 auth_offset, auth, 8469 stcb->asoc.authinfo.active_keyid, 8470 no_fragmentflg, 0, asconf, 8471 inp->sctp_lport, stcb->rport, 8472 htonl(stcb->asoc.peer_vtag), 8473 net->port, NULL, 8474 0, 0, 8475 so_locked))) { 8476 /* 8477 * error, we could not 8478 * output 8479 */ 8480 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8481 if (from_where == 0) { 8482 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8483 } 8484 if (error == ENOBUFS) { 8485 asoc->ifp_had_enobuf = 1; 8486 SCTP_STAT_INCR(sctps_lowlevelerr); 8487 } 8488 if (error == EHOSTUNREACH) { 8489 /* 8490 * Destination went 8491 * unreachable 8492 * during this send 8493 */ 8494 sctp_move_chunks_from_net(stcb, net); 8495 } 8496 *reason_code = 7; 8497 break; 8498 } else { 8499 asoc->ifp_had_enobuf = 0; 8500 } 8501 /* 8502 * increase the number we sent, if a 8503 * cookie is sent we don't tell them 8504 * any was sent out. 8505 */ 8506 outchain = endoutchain = NULL; 8507 auth = NULL; 8508 auth_offset = 0; 8509 if (!no_out_cnt) 8510 *num_out += ctl_cnt; 8511 /* recalc a clean slate and setup */ 8512 switch (net->ro._l_addr.sa.sa_family) { 8513 #ifdef INET 8514 case AF_INET: 8515 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8516 break; 8517 #endif 8518 #ifdef INET6 8519 case AF_INET6: 8520 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8521 break; 8522 #endif 8523 default: 8524 /* TSNH */ 8525 mtu = net->mtu; 8526 break; 8527 } 8528 to_out = 0; 8529 no_fragmentflg = 1; 8530 } 8531 } 8532 } 8533 if (error != 0) { 8534 /* try next net */ 8535 continue; 8536 } 8537 /* JRI: if dest is in PF state, do not send data to it */ 8538 if ((asoc->sctp_cmt_on_off > 0) && 8539 (net != stcb->asoc.alternate) && 8540 (net->dest_state & SCTP_ADDR_PF)) { 8541 goto no_data_fill; 8542 } 8543 if (net->flight_size >= net->cwnd) { 8544 goto no_data_fill; 8545 } 8546 if ((asoc->sctp_cmt_on_off > 0) && 8547 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_RECV_BUFFER_SPLITTING) && 8548 (net->flight_size > max_rwnd_per_dest)) { 8549 goto no_data_fill; 8550 } 8551 /* 8552 * We need a specific accounting for the usage of the send 8553 * buffer. We also need to check the number of messages per 8554 * net. For now, this is better than nothing and it disabled 8555 * by default... 8556 */ 8557 if ((asoc->sctp_cmt_on_off > 0) && 8558 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_SEND_BUFFER_SPLITTING) && 8559 (max_send_per_dest > 0) && 8560 (net->flight_size > max_send_per_dest)) { 8561 goto no_data_fill; 8562 } 8563 /*********************/ 8564 /* Data transmission */ 8565 /*********************/ 8566 /* 8567 * if AUTH for DATA is required and no AUTH has been added 8568 * yet, account for this in the mtu now... if no data can be 8569 * bundled, this adjustment won't matter anyways since the 8570 * packet will be going out... 8571 */ 8572 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, 8573 stcb->asoc.peer_auth_chunks); 8574 if (data_auth_reqd && (auth == NULL)) { 8575 mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8576 } 8577 /* now lets add any data within the MTU constraints */ 8578 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8579 #ifdef INET 8580 case AF_INET: 8581 if (net->mtu > SCTP_MIN_V4_OVERHEAD) 8582 omtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8583 else 8584 omtu = 0; 8585 break; 8586 #endif 8587 #ifdef INET6 8588 case AF_INET6: 8589 if (net->mtu > SCTP_MIN_OVERHEAD) 8590 omtu = net->mtu - SCTP_MIN_OVERHEAD; 8591 else 8592 omtu = 0; 8593 break; 8594 #endif 8595 default: 8596 /* TSNH */ 8597 omtu = 0; 8598 break; 8599 } 8600 if ((((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) || 8601 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) && 8602 (skip_data_for_this_net == 0)) || 8603 (cookie)) { 8604 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 8605 if (no_data_chunks) { 8606 /* let only control go out */ 8607 *reason_code = 1; 8608 break; 8609 } 8610 if (net->flight_size >= net->cwnd) { 8611 /* skip this net, no room for data */ 8612 *reason_code = 2; 8613 break; 8614 } 8615 if ((chk->whoTo != NULL) && 8616 (chk->whoTo != net)) { 8617 /* Don't send the chunk on this net */ 8618 continue; 8619 } 8620 8621 if (asoc->sctp_cmt_on_off == 0) { 8622 if ((asoc->alternate) && 8623 (asoc->alternate != net) && 8624 (chk->whoTo == NULL)) { 8625 continue; 8626 } else if ((net != asoc->primary_destination) && 8627 (asoc->alternate == NULL) && 8628 (chk->whoTo == NULL)) { 8629 continue; 8630 } 8631 } 8632 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 8633 /*- 8634 * strange, we have a chunk that is 8635 * to big for its destination and 8636 * yet no fragment ok flag. 8637 * Something went wrong when the 8638 * PMTU changed...we did not mark 8639 * this chunk for some reason?? I 8640 * will fix it here by letting IP 8641 * fragment it for now and printing 8642 * a warning. This really should not 8643 * happen ... 8644 */ 8645 SCTP_PRINTF("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 8646 chk->send_size, mtu); 8647 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 8648 } 8649 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 8650 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 8651 struct sctp_data_chunk *dchkh; 8652 8653 dchkh = mtod(chk->data, struct sctp_data_chunk *); 8654 dchkh->ch.chunk_flags |= SCTP_DATA_SACK_IMMEDIATELY; 8655 } 8656 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 8657 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 8658 /* ok we will add this one */ 8659 8660 /* 8661 * Add an AUTH chunk, if chunk 8662 * requires it, save the offset into 8663 * the chain for AUTH 8664 */ 8665 if (data_auth_reqd) { 8666 if (auth == NULL) { 8667 outchain = sctp_add_auth_chunk(outchain, 8668 &endoutchain, 8669 &auth, 8670 &auth_offset, 8671 stcb, 8672 SCTP_DATA); 8673 auth_keyid = chk->auth_keyid; 8674 override_ok = 0; 8675 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8676 } else if (override_ok) { 8677 /* 8678 * use this data's 8679 * keyid 8680 */ 8681 auth_keyid = chk->auth_keyid; 8682 override_ok = 0; 8683 } else if (auth_keyid != chk->auth_keyid) { 8684 /* 8685 * different keyid, 8686 * so done bundling 8687 */ 8688 break; 8689 } 8690 } 8691 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0, 8692 chk->send_size, chk->copy_by_ref); 8693 if (outchain == NULL) { 8694 SCTPDBG(SCTP_DEBUG_OUTPUT3, "No memory?\n"); 8695 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 8696 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8697 } 8698 *reason_code = 3; 8699 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8700 return (ENOMEM); 8701 } 8702 /* upate our MTU size */ 8703 /* Do clear IP_DF ? */ 8704 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8705 no_fragmentflg = 0; 8706 } 8707 /* unsigned subtraction of mtu */ 8708 if (mtu > chk->send_size) 8709 mtu -= chk->send_size; 8710 else 8711 mtu = 0; 8712 /* unsigned subtraction of r_mtu */ 8713 if (r_mtu > chk->send_size) 8714 r_mtu -= chk->send_size; 8715 else 8716 r_mtu = 0; 8717 8718 to_out += chk->send_size; 8719 if ((to_out > mx_mtu) && no_fragmentflg) { 8720 #ifdef INVARIANTS 8721 panic("Exceeding mtu of %d out size is %d", mx_mtu, to_out); 8722 #else 8723 SCTP_PRINTF("Exceeding mtu of %d out size is %d\n", 8724 mx_mtu, to_out); 8725 #endif 8726 } 8727 chk->window_probe = 0; 8728 data_list[bundle_at++] = chk; 8729 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 8730 break; 8731 } 8732 if (chk->sent == SCTP_DATAGRAM_UNSENT) { 8733 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 8734 SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks); 8735 } else { 8736 SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks); 8737 } 8738 if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) && 8739 ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0)) 8740 /* 8741 * Count number of 8742 * user msg's that 8743 * were fragmented 8744 * we do this by 8745 * counting when we 8746 * see a LAST 8747 * fragment only. 8748 */ 8749 SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs); 8750 } 8751 if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) { 8752 if ((one_chunk) && (stcb->asoc.total_flight == 0)) { 8753 data_list[0]->window_probe = 1; 8754 net->window_probe = 1; 8755 } 8756 break; 8757 } 8758 } else { 8759 /* 8760 * Must be sent in order of the 8761 * TSN's (on a network) 8762 */ 8763 break; 8764 } 8765 } /* for (chunk gather loop for this net) */ 8766 } /* if asoc.state OPEN */ 8767 no_data_fill: 8768 /* Is there something to send for this destination? */ 8769 if (outchain) { 8770 /* We may need to start a control timer or two */ 8771 if (asconf) { 8772 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, 8773 stcb, net); 8774 /* 8775 * do NOT clear the asconf flag as it is 8776 * used to do appropriate source address 8777 * selection. 8778 */ 8779 } 8780 if (cookie) { 8781 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8782 cookie = 0; 8783 } 8784 /* must start a send timer if data is being sent */ 8785 if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) { 8786 /* 8787 * no timer running on this destination 8788 * restart it. 8789 */ 8790 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8791 } 8792 if (bundle_at || hbflag) { 8793 /* For data/asconf and hb set time */ 8794 if (*now_filled == 0) { 8795 (void)SCTP_GETTIME_TIMEVAL(now); 8796 *now_filled = 1; 8797 } 8798 net->last_sent_time = *now; 8799 } 8800 /* Now send it, if there is anything to send :> */ 8801 if ((error = sctp_lowlevel_chunk_output(inp, 8802 stcb, 8803 net, 8804 (struct sockaddr *)&net->ro._l_addr, 8805 outchain, 8806 auth_offset, 8807 auth, 8808 auth_keyid, 8809 no_fragmentflg, 8810 bundle_at, 8811 asconf, 8812 inp->sctp_lport, stcb->rport, 8813 htonl(stcb->asoc.peer_vtag), 8814 net->port, NULL, 8815 0, 0, 8816 so_locked))) { 8817 /* error, we could not output */ 8818 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8819 if (from_where == 0) { 8820 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8821 } 8822 if (error == ENOBUFS) { 8823 asoc->ifp_had_enobuf = 1; 8824 SCTP_STAT_INCR(sctps_lowlevelerr); 8825 } 8826 if (error == EHOSTUNREACH) { 8827 /* 8828 * Destination went unreachable 8829 * during this send 8830 */ 8831 sctp_move_chunks_from_net(stcb, net); 8832 } 8833 *reason_code = 6; 8834 /*- 8835 * I add this line to be paranoid. As far as 8836 * I can tell the continue, takes us back to 8837 * the top of the for, but just to make sure 8838 * I will reset these again here. 8839 */ 8840 ctl_cnt = 0; 8841 continue; /* This takes us back to the 8842 * for() for the nets. */ 8843 } else { 8844 asoc->ifp_had_enobuf = 0; 8845 } 8846 endoutchain = NULL; 8847 auth = NULL; 8848 auth_offset = 0; 8849 if (!no_out_cnt) { 8850 *num_out += (ctl_cnt + bundle_at); 8851 } 8852 if (bundle_at) { 8853 /* setup for a RTO measurement */ 8854 tsns_sent = data_list[0]->rec.data.tsn; 8855 /* fill time if not already filled */ 8856 if (*now_filled == 0) { 8857 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 8858 *now_filled = 1; 8859 *now = asoc->time_last_sent; 8860 } else { 8861 asoc->time_last_sent = *now; 8862 } 8863 if (net->rto_needed) { 8864 data_list[0]->do_rtt = 1; 8865 net->rto_needed = 0; 8866 } 8867 SCTP_STAT_INCR_BY(sctps_senddata, bundle_at); 8868 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 8869 } 8870 if (one_chunk) { 8871 break; 8872 } 8873 } 8874 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8875 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND); 8876 } 8877 } 8878 if (old_start_at == NULL) { 8879 old_start_at = start_at; 8880 start_at = TAILQ_FIRST(&asoc->nets); 8881 if (old_start_at) 8882 goto again_one_more_time; 8883 } 8884 8885 /* 8886 * At the end there should be no NON timed chunks hanging on this 8887 * queue. 8888 */ 8889 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8890 sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND); 8891 } 8892 if ((*num_out == 0) && (*reason_code == 0)) { 8893 *reason_code = 4; 8894 } else { 8895 *reason_code = 5; 8896 } 8897 sctp_clean_up_ctl(stcb, asoc, so_locked); 8898 return (0); 8899 } 8900 8901 void 8902 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 8903 { 8904 /*- 8905 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of 8906 * the control chunk queue. 8907 */ 8908 struct sctp_chunkhdr *hdr; 8909 struct sctp_tmit_chunk *chk; 8910 struct mbuf *mat, *last_mbuf; 8911 uint32_t chunk_length; 8912 uint16_t padding_length; 8913 8914 SCTP_TCB_LOCK_ASSERT(stcb); 8915 SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_NOWAIT); 8916 if (op_err == NULL) { 8917 return; 8918 } 8919 last_mbuf = NULL; 8920 chunk_length = 0; 8921 for (mat = op_err; mat != NULL; mat = SCTP_BUF_NEXT(mat)) { 8922 chunk_length += SCTP_BUF_LEN(mat); 8923 if (SCTP_BUF_NEXT(mat) == NULL) { 8924 last_mbuf = mat; 8925 } 8926 } 8927 if (chunk_length > SCTP_MAX_CHUNK_LENGTH) { 8928 sctp_m_freem(op_err); 8929 return; 8930 } 8931 padding_length = chunk_length % 4; 8932 if (padding_length != 0) { 8933 padding_length = 4 - padding_length; 8934 } 8935 if (padding_length != 0) { 8936 if (sctp_add_pad_tombuf(last_mbuf, padding_length) == NULL) { 8937 sctp_m_freem(op_err); 8938 return; 8939 } 8940 } 8941 sctp_alloc_a_chunk(stcb, chk); 8942 if (chk == NULL) { 8943 /* no memory */ 8944 sctp_m_freem(op_err); 8945 return; 8946 } 8947 chk->copy_by_ref = 0; 8948 chk->rec.chunk_id.id = SCTP_OPERATION_ERROR; 8949 chk->rec.chunk_id.can_take_data = 0; 8950 chk->flags = 0; 8951 chk->send_size = (uint16_t)chunk_length; 8952 chk->sent = SCTP_DATAGRAM_UNSENT; 8953 chk->snd_count = 0; 8954 chk->asoc = &stcb->asoc; 8955 chk->data = op_err; 8956 chk->whoTo = NULL; 8957 hdr = mtod(op_err, struct sctp_chunkhdr *); 8958 hdr->chunk_type = SCTP_OPERATION_ERROR; 8959 hdr->chunk_flags = 0; 8960 hdr->chunk_length = htons(chk->send_size); 8961 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 8962 chk->asoc->ctrl_queue_cnt++; 8963 } 8964 8965 int 8966 sctp_send_cookie_echo(struct mbuf *m, 8967 int offset, int limit, 8968 struct sctp_tcb *stcb, 8969 struct sctp_nets *net) 8970 { 8971 /*- 8972 * pull out the cookie and put it at the front of the control chunk 8973 * queue. 8974 */ 8975 int at; 8976 struct mbuf *cookie; 8977 struct sctp_paramhdr param, *phdr; 8978 struct sctp_chunkhdr *hdr; 8979 struct sctp_tmit_chunk *chk; 8980 uint16_t ptype, plen; 8981 8982 SCTP_TCB_LOCK_ASSERT(stcb); 8983 /* First find the cookie in the param area */ 8984 cookie = NULL; 8985 at = offset + sizeof(struct sctp_init_chunk); 8986 for (;;) { 8987 phdr = sctp_get_next_param(m, at, ¶m, sizeof(param)); 8988 if (phdr == NULL) { 8989 return (-3); 8990 } 8991 ptype = ntohs(phdr->param_type); 8992 plen = ntohs(phdr->param_length); 8993 if (plen < sizeof(struct sctp_paramhdr)) { 8994 return (-6); 8995 } 8996 if (ptype == SCTP_STATE_COOKIE) { 8997 int pad; 8998 8999 /* found the cookie */ 9000 if (at + plen > limit) { 9001 return (-7); 9002 } 9003 cookie = SCTP_M_COPYM(m, at, plen, M_NOWAIT); 9004 if (cookie == NULL) { 9005 /* No memory */ 9006 return (-2); 9007 } 9008 if ((pad = (plen % 4)) > 0) { 9009 pad = 4 - pad; 9010 } 9011 if (pad > 0) { 9012 if (sctp_pad_lastmbuf(cookie, pad, NULL) == NULL) { 9013 return (-8); 9014 } 9015 } 9016 #ifdef SCTP_MBUF_LOGGING 9017 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9018 sctp_log_mbc(cookie, SCTP_MBUF_ICOPY); 9019 } 9020 #endif 9021 break; 9022 } 9023 at += SCTP_SIZE32(plen); 9024 } 9025 /* ok, we got the cookie lets change it into a cookie echo chunk */ 9026 /* first the change from param to cookie */ 9027 hdr = mtod(cookie, struct sctp_chunkhdr *); 9028 hdr->chunk_type = SCTP_COOKIE_ECHO; 9029 hdr->chunk_flags = 0; 9030 /* get the chunk stuff now and place it in the FRONT of the queue */ 9031 sctp_alloc_a_chunk(stcb, chk); 9032 if (chk == NULL) { 9033 /* no memory */ 9034 sctp_m_freem(cookie); 9035 return (-5); 9036 } 9037 chk->copy_by_ref = 0; 9038 chk->rec.chunk_id.id = SCTP_COOKIE_ECHO; 9039 chk->rec.chunk_id.can_take_data = 0; 9040 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9041 chk->send_size = SCTP_SIZE32(plen); 9042 chk->sent = SCTP_DATAGRAM_UNSENT; 9043 chk->snd_count = 0; 9044 chk->asoc = &stcb->asoc; 9045 chk->data = cookie; 9046 chk->whoTo = net; 9047 atomic_add_int(&chk->whoTo->ref_count, 1); 9048 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 9049 chk->asoc->ctrl_queue_cnt++; 9050 return (0); 9051 } 9052 9053 void 9054 sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 9055 struct mbuf *m, 9056 int offset, 9057 int chk_length, 9058 struct sctp_nets *net) 9059 { 9060 /* 9061 * take a HB request and make it into a HB ack and send it. 9062 */ 9063 struct mbuf *outchain; 9064 struct sctp_chunkhdr *chdr; 9065 struct sctp_tmit_chunk *chk; 9066 9067 if (net == NULL) 9068 /* must have a net pointer */ 9069 return; 9070 9071 outchain = SCTP_M_COPYM(m, offset, chk_length, M_NOWAIT); 9072 if (outchain == NULL) { 9073 /* gak out of memory */ 9074 return; 9075 } 9076 #ifdef SCTP_MBUF_LOGGING 9077 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9078 sctp_log_mbc(outchain, SCTP_MBUF_ICOPY); 9079 } 9080 #endif 9081 chdr = mtod(outchain, struct sctp_chunkhdr *); 9082 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 9083 chdr->chunk_flags = 0; 9084 if (chk_length % 4 != 0) { 9085 sctp_pad_lastmbuf(outchain, 4 - (chk_length % 4), NULL); 9086 } 9087 sctp_alloc_a_chunk(stcb, chk); 9088 if (chk == NULL) { 9089 /* no memory */ 9090 sctp_m_freem(outchain); 9091 return; 9092 } 9093 chk->copy_by_ref = 0; 9094 chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK; 9095 chk->rec.chunk_id.can_take_data = 1; 9096 chk->flags = 0; 9097 chk->send_size = chk_length; 9098 chk->sent = SCTP_DATAGRAM_UNSENT; 9099 chk->snd_count = 0; 9100 chk->asoc = &stcb->asoc; 9101 chk->data = outchain; 9102 chk->whoTo = net; 9103 atomic_add_int(&chk->whoTo->ref_count, 1); 9104 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9105 chk->asoc->ctrl_queue_cnt++; 9106 } 9107 9108 void 9109 sctp_send_cookie_ack(struct sctp_tcb *stcb) 9110 { 9111 /* formulate and queue a cookie-ack back to sender */ 9112 struct mbuf *cookie_ack; 9113 struct sctp_chunkhdr *hdr; 9114 struct sctp_tmit_chunk *chk; 9115 9116 SCTP_TCB_LOCK_ASSERT(stcb); 9117 9118 cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 9119 if (cookie_ack == NULL) { 9120 /* no mbuf's */ 9121 return; 9122 } 9123 SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD); 9124 sctp_alloc_a_chunk(stcb, chk); 9125 if (chk == NULL) { 9126 /* no memory */ 9127 sctp_m_freem(cookie_ack); 9128 return; 9129 } 9130 chk->copy_by_ref = 0; 9131 chk->rec.chunk_id.id = SCTP_COOKIE_ACK; 9132 chk->rec.chunk_id.can_take_data = 1; 9133 chk->flags = 0; 9134 chk->send_size = sizeof(struct sctp_chunkhdr); 9135 chk->sent = SCTP_DATAGRAM_UNSENT; 9136 chk->snd_count = 0; 9137 chk->asoc = &stcb->asoc; 9138 chk->data = cookie_ack; 9139 if (chk->asoc->last_control_chunk_from != NULL) { 9140 chk->whoTo = chk->asoc->last_control_chunk_from; 9141 atomic_add_int(&chk->whoTo->ref_count, 1); 9142 } else { 9143 chk->whoTo = NULL; 9144 } 9145 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 9146 hdr->chunk_type = SCTP_COOKIE_ACK; 9147 hdr->chunk_flags = 0; 9148 hdr->chunk_length = htons(chk->send_size); 9149 SCTP_BUF_LEN(cookie_ack) = chk->send_size; 9150 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9151 chk->asoc->ctrl_queue_cnt++; 9152 return; 9153 } 9154 9155 void 9156 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 9157 { 9158 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 9159 struct mbuf *m_shutdown_ack; 9160 struct sctp_shutdown_ack_chunk *ack_cp; 9161 struct sctp_tmit_chunk *chk; 9162 9163 m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9164 if (m_shutdown_ack == NULL) { 9165 /* no mbuf's */ 9166 return; 9167 } 9168 SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD); 9169 sctp_alloc_a_chunk(stcb, chk); 9170 if (chk == NULL) { 9171 /* no memory */ 9172 sctp_m_freem(m_shutdown_ack); 9173 return; 9174 } 9175 chk->copy_by_ref = 0; 9176 chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK; 9177 chk->rec.chunk_id.can_take_data = 1; 9178 chk->flags = 0; 9179 chk->send_size = sizeof(struct sctp_chunkhdr); 9180 chk->sent = SCTP_DATAGRAM_UNSENT; 9181 chk->snd_count = 0; 9182 chk->asoc = &stcb->asoc; 9183 chk->data = m_shutdown_ack; 9184 chk->whoTo = net; 9185 if (chk->whoTo) { 9186 atomic_add_int(&chk->whoTo->ref_count, 1); 9187 } 9188 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 9189 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 9190 ack_cp->ch.chunk_flags = 0; 9191 ack_cp->ch.chunk_length = htons(chk->send_size); 9192 SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size; 9193 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9194 chk->asoc->ctrl_queue_cnt++; 9195 return; 9196 } 9197 9198 void 9199 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 9200 { 9201 /* formulate and queue a SHUTDOWN to the sender */ 9202 struct mbuf *m_shutdown; 9203 struct sctp_shutdown_chunk *shutdown_cp; 9204 struct sctp_tmit_chunk *chk; 9205 9206 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 9207 if (chk->rec.chunk_id.id == SCTP_SHUTDOWN) { 9208 /* We already have a SHUTDOWN queued. Reuse it. */ 9209 if (chk->whoTo) { 9210 sctp_free_remote_addr(chk->whoTo); 9211 chk->whoTo = NULL; 9212 } 9213 break; 9214 } 9215 } 9216 if (chk == NULL) { 9217 m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9218 if (m_shutdown == NULL) { 9219 /* no mbuf's */ 9220 return; 9221 } 9222 SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD); 9223 sctp_alloc_a_chunk(stcb, chk); 9224 if (chk == NULL) { 9225 /* no memory */ 9226 sctp_m_freem(m_shutdown); 9227 return; 9228 } 9229 chk->copy_by_ref = 0; 9230 chk->rec.chunk_id.id = SCTP_SHUTDOWN; 9231 chk->rec.chunk_id.can_take_data = 1; 9232 chk->flags = 0; 9233 chk->send_size = sizeof(struct sctp_shutdown_chunk); 9234 chk->sent = SCTP_DATAGRAM_UNSENT; 9235 chk->snd_count = 0; 9236 chk->asoc = &stcb->asoc; 9237 chk->data = m_shutdown; 9238 chk->whoTo = net; 9239 if (chk->whoTo) { 9240 atomic_add_int(&chk->whoTo->ref_count, 1); 9241 } 9242 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 9243 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 9244 shutdown_cp->ch.chunk_flags = 0; 9245 shutdown_cp->ch.chunk_length = htons(chk->send_size); 9246 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9247 SCTP_BUF_LEN(m_shutdown) = chk->send_size; 9248 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9249 chk->asoc->ctrl_queue_cnt++; 9250 } else { 9251 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, sctp_next); 9252 chk->whoTo = net; 9253 if (chk->whoTo) { 9254 atomic_add_int(&chk->whoTo->ref_count, 1); 9255 } 9256 shutdown_cp = mtod(chk->data, struct sctp_shutdown_chunk *); 9257 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9258 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 9259 } 9260 return; 9261 } 9262 9263 void 9264 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked) 9265 { 9266 /* 9267 * formulate and queue an ASCONF to the peer. ASCONF parameters 9268 * should be queued on the assoc queue. 9269 */ 9270 struct sctp_tmit_chunk *chk; 9271 struct mbuf *m_asconf; 9272 int len; 9273 9274 SCTP_TCB_LOCK_ASSERT(stcb); 9275 9276 if ((!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) && 9277 (!sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS))) { 9278 /* can't send a new one if there is one in flight already */ 9279 return; 9280 } 9281 9282 /* compose an ASCONF chunk, maximum length is PMTU */ 9283 m_asconf = sctp_compose_asconf(stcb, &len, addr_locked); 9284 if (m_asconf == NULL) { 9285 return; 9286 } 9287 9288 sctp_alloc_a_chunk(stcb, chk); 9289 if (chk == NULL) { 9290 /* no memory */ 9291 sctp_m_freem(m_asconf); 9292 return; 9293 } 9294 9295 chk->copy_by_ref = 0; 9296 chk->rec.chunk_id.id = SCTP_ASCONF; 9297 chk->rec.chunk_id.can_take_data = 0; 9298 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9299 chk->data = m_asconf; 9300 chk->send_size = len; 9301 chk->sent = SCTP_DATAGRAM_UNSENT; 9302 chk->snd_count = 0; 9303 chk->asoc = &stcb->asoc; 9304 chk->whoTo = net; 9305 if (chk->whoTo) { 9306 atomic_add_int(&chk->whoTo->ref_count, 1); 9307 } 9308 TAILQ_INSERT_TAIL(&chk->asoc->asconf_send_queue, chk, sctp_next); 9309 chk->asoc->ctrl_queue_cnt++; 9310 return; 9311 } 9312 9313 void 9314 sctp_send_asconf_ack(struct sctp_tcb *stcb) 9315 { 9316 /* 9317 * formulate and queue a asconf-ack back to sender. the asconf-ack 9318 * must be stored in the tcb. 9319 */ 9320 struct sctp_tmit_chunk *chk; 9321 struct sctp_asconf_ack *ack, *latest_ack; 9322 struct mbuf *m_ack; 9323 struct sctp_nets *net = NULL; 9324 9325 SCTP_TCB_LOCK_ASSERT(stcb); 9326 /* Get the latest ASCONF-ACK */ 9327 latest_ack = TAILQ_LAST(&stcb->asoc.asconf_ack_sent, sctp_asconf_ackhead); 9328 if (latest_ack == NULL) { 9329 return; 9330 } 9331 if (latest_ack->last_sent_to != NULL && 9332 latest_ack->last_sent_to == stcb->asoc.last_control_chunk_from) { 9333 /* we're doing a retransmission */ 9334 net = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0); 9335 if (net == NULL) { 9336 /* no alternate */ 9337 if (stcb->asoc.last_control_chunk_from == NULL) { 9338 if (stcb->asoc.alternate) { 9339 net = stcb->asoc.alternate; 9340 } else { 9341 net = stcb->asoc.primary_destination; 9342 } 9343 } else { 9344 net = stcb->asoc.last_control_chunk_from; 9345 } 9346 } 9347 } else { 9348 /* normal case */ 9349 if (stcb->asoc.last_control_chunk_from == NULL) { 9350 if (stcb->asoc.alternate) { 9351 net = stcb->asoc.alternate; 9352 } else { 9353 net = stcb->asoc.primary_destination; 9354 } 9355 } else { 9356 net = stcb->asoc.last_control_chunk_from; 9357 } 9358 } 9359 latest_ack->last_sent_to = net; 9360 9361 TAILQ_FOREACH(ack, &stcb->asoc.asconf_ack_sent, next) { 9362 if (ack->data == NULL) { 9363 continue; 9364 } 9365 9366 /* copy the asconf_ack */ 9367 m_ack = SCTP_M_COPYM(ack->data, 0, M_COPYALL, M_NOWAIT); 9368 if (m_ack == NULL) { 9369 /* couldn't copy it */ 9370 return; 9371 } 9372 #ifdef SCTP_MBUF_LOGGING 9373 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9374 sctp_log_mbc(m_ack, SCTP_MBUF_ICOPY); 9375 } 9376 #endif 9377 9378 sctp_alloc_a_chunk(stcb, chk); 9379 if (chk == NULL) { 9380 /* no memory */ 9381 if (m_ack) 9382 sctp_m_freem(m_ack); 9383 return; 9384 } 9385 chk->copy_by_ref = 0; 9386 chk->rec.chunk_id.id = SCTP_ASCONF_ACK; 9387 chk->rec.chunk_id.can_take_data = 1; 9388 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9389 chk->whoTo = net; 9390 if (chk->whoTo) { 9391 atomic_add_int(&chk->whoTo->ref_count, 1); 9392 } 9393 chk->data = m_ack; 9394 chk->send_size = ack->len; 9395 chk->sent = SCTP_DATAGRAM_UNSENT; 9396 chk->snd_count = 0; 9397 chk->asoc = &stcb->asoc; 9398 9399 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9400 chk->asoc->ctrl_queue_cnt++; 9401 } 9402 return; 9403 } 9404 9405 static int 9406 sctp_chunk_retransmission(struct sctp_inpcb *inp, 9407 struct sctp_tcb *stcb, 9408 struct sctp_association *asoc, 9409 int *cnt_out, struct timeval *now, int *now_filled, int *fr_done, int so_locked) 9410 { 9411 /*- 9412 * send out one MTU of retransmission. If fast_retransmit is 9413 * happening we ignore the cwnd. Otherwise we obey the cwnd and 9414 * rwnd. For a Cookie or Asconf in the control chunk queue we 9415 * retransmit them by themselves. 9416 * 9417 * For data chunks we will pick out the lowest TSN's in the sent_queue 9418 * marked for resend and bundle them all together (up to a MTU of 9419 * destination). The address to send to should have been 9420 * selected/changed where the retransmission was marked (i.e. in FR 9421 * or t3-timeout routines). 9422 */ 9423 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 9424 struct sctp_tmit_chunk *chk, *fwd; 9425 struct mbuf *m, *endofchain; 9426 struct sctp_nets *net = NULL; 9427 uint32_t tsns_sent = 0; 9428 int no_fragmentflg, bundle_at, cnt_thru; 9429 unsigned int mtu; 9430 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 9431 struct sctp_auth_chunk *auth = NULL; 9432 uint32_t auth_offset = 0; 9433 uint16_t auth_keyid; 9434 int override_ok = 1; 9435 int data_auth_reqd = 0; 9436 uint32_t dmtu = 0; 9437 9438 SCTP_TCB_LOCK_ASSERT(stcb); 9439 tmr_started = ctl_cnt = 0; 9440 no_fragmentflg = 1; 9441 fwd_tsn = 0; 9442 *cnt_out = 0; 9443 fwd = NULL; 9444 endofchain = m = NULL; 9445 auth_keyid = stcb->asoc.authinfo.active_keyid; 9446 #ifdef SCTP_AUDITING_ENABLED 9447 sctp_audit_log(0xC3, 1); 9448 #endif 9449 if ((TAILQ_EMPTY(&asoc->sent_queue)) && 9450 (TAILQ_EMPTY(&asoc->control_send_queue))) { 9451 SCTPDBG(SCTP_DEBUG_OUTPUT1, "SCTP hits empty queue with cnt set to %d?\n", 9452 asoc->sent_queue_retran_cnt); 9453 asoc->sent_queue_cnt = 0; 9454 asoc->sent_queue_cnt_removeable = 0; 9455 /* send back 0/0 so we enter normal transmission */ 9456 *cnt_out = 0; 9457 return (0); 9458 } 9459 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 9460 if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) || 9461 (chk->rec.chunk_id.id == SCTP_STREAM_RESET) || 9462 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) { 9463 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9464 continue; 9465 } 9466 if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 9467 if (chk != asoc->str_reset) { 9468 /* 9469 * not eligible for retran if its 9470 * not ours 9471 */ 9472 continue; 9473 } 9474 } 9475 ctl_cnt++; 9476 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 9477 fwd_tsn = 1; 9478 } 9479 /* 9480 * Add an AUTH chunk, if chunk requires it save the 9481 * offset into the chain for AUTH 9482 */ 9483 if ((auth == NULL) && 9484 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 9485 stcb->asoc.peer_auth_chunks))) { 9486 m = sctp_add_auth_chunk(m, &endofchain, 9487 &auth, &auth_offset, 9488 stcb, 9489 chk->rec.chunk_id.id); 9490 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9491 } 9492 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9493 break; 9494 } 9495 } 9496 one_chunk = 0; 9497 cnt_thru = 0; 9498 /* do we have control chunks to retransmit? */ 9499 if (m != NULL) { 9500 /* Start a timer no matter if we succeed or fail */ 9501 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 9502 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 9503 } else if (chk->rec.chunk_id.id == SCTP_ASCONF) 9504 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 9505 chk->snd_count++; /* update our count */ 9506 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 9507 (struct sockaddr *)&chk->whoTo->ro._l_addr, m, 9508 auth_offset, auth, stcb->asoc.authinfo.active_keyid, 9509 no_fragmentflg, 0, 0, 9510 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9511 chk->whoTo->port, NULL, 9512 0, 0, 9513 so_locked))) { 9514 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9515 if (error == ENOBUFS) { 9516 asoc->ifp_had_enobuf = 1; 9517 SCTP_STAT_INCR(sctps_lowlevelerr); 9518 } 9519 return (error); 9520 } else { 9521 asoc->ifp_had_enobuf = 0; 9522 } 9523 endofchain = NULL; 9524 auth = NULL; 9525 auth_offset = 0; 9526 /* 9527 * We don't want to mark the net->sent time here since this 9528 * we use this for HB and retrans cannot measure RTT 9529 */ 9530 /* (void)SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */ 9531 *cnt_out += 1; 9532 chk->sent = SCTP_DATAGRAM_SENT; 9533 sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt); 9534 if (fwd_tsn == 0) { 9535 return (0); 9536 } else { 9537 /* Clean up the fwd-tsn list */ 9538 sctp_clean_up_ctl(stcb, asoc, so_locked); 9539 return (0); 9540 } 9541 } 9542 /* 9543 * Ok, it is just data retransmission we need to do or that and a 9544 * fwd-tsn with it all. 9545 */ 9546 if (TAILQ_EMPTY(&asoc->sent_queue)) { 9547 return (SCTP_RETRAN_DONE); 9548 } 9549 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED) || 9550 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT)) { 9551 /* not yet open, resend the cookie and that is it */ 9552 return (1); 9553 } 9554 #ifdef SCTP_AUDITING_ENABLED 9555 sctp_auditing(20, inp, stcb, NULL); 9556 #endif 9557 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks); 9558 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 9559 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9560 /* No, not sent to this net or not ready for rtx */ 9561 continue; 9562 } 9563 if (chk->data == NULL) { 9564 SCTP_PRINTF("TSN:%x chk->snd_count:%d chk->sent:%d can't retran - no data\n", 9565 chk->rec.data.tsn, chk->snd_count, chk->sent); 9566 continue; 9567 } 9568 if ((SCTP_BASE_SYSCTL(sctp_max_retran_chunk)) && 9569 (chk->snd_count >= SCTP_BASE_SYSCTL(sctp_max_retran_chunk))) { 9570 struct mbuf *op_err; 9571 char msg[SCTP_DIAG_INFO_LEN]; 9572 9573 SCTP_SNPRINTF(msg, sizeof(msg), "TSN %8.8x retransmitted %d times, giving up", 9574 chk->rec.data.tsn, chk->snd_count); 9575 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 9576 msg); 9577 atomic_add_int(&stcb->asoc.refcnt, 1); 9578 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, 9579 false, so_locked); 9580 SCTP_TCB_LOCK(stcb); 9581 atomic_subtract_int(&stcb->asoc.refcnt, 1); 9582 return (SCTP_RETRAN_EXIT); 9583 } 9584 /* pick up the net */ 9585 net = chk->whoTo; 9586 switch (net->ro._l_addr.sa.sa_family) { 9587 #ifdef INET 9588 case AF_INET: 9589 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 9590 break; 9591 #endif 9592 #ifdef INET6 9593 case AF_INET6: 9594 mtu = net->mtu - SCTP_MIN_OVERHEAD; 9595 break; 9596 #endif 9597 default: 9598 /* TSNH */ 9599 mtu = net->mtu; 9600 break; 9601 } 9602 9603 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 9604 /* No room in peers rwnd */ 9605 uint32_t tsn; 9606 9607 tsn = asoc->last_acked_seq + 1; 9608 if (tsn == chk->rec.data.tsn) { 9609 /* 9610 * we make a special exception for this 9611 * case. The peer has no rwnd but is missing 9612 * the lowest chunk.. which is probably what 9613 * is holding up the rwnd. 9614 */ 9615 goto one_chunk_around; 9616 } 9617 return (1); 9618 } 9619 one_chunk_around: 9620 if (asoc->peers_rwnd < mtu) { 9621 one_chunk = 1; 9622 if ((asoc->peers_rwnd == 0) && 9623 (asoc->total_flight == 0)) { 9624 chk->window_probe = 1; 9625 chk->whoTo->window_probe = 1; 9626 } 9627 } 9628 #ifdef SCTP_AUDITING_ENABLED 9629 sctp_audit_log(0xC3, 2); 9630 #endif 9631 bundle_at = 0; 9632 m = NULL; 9633 net->fast_retran_ip = 0; 9634 if (chk->rec.data.doing_fast_retransmit == 0) { 9635 /* 9636 * if no FR in progress skip destination that have 9637 * flight_size > cwnd. 9638 */ 9639 if (net->flight_size >= net->cwnd) { 9640 continue; 9641 } 9642 } else { 9643 /* 9644 * Mark the destination net to have FR recovery 9645 * limits put on it. 9646 */ 9647 *fr_done = 1; 9648 net->fast_retran_ip = 1; 9649 } 9650 9651 /* 9652 * if no AUTH is yet included and this chunk requires it, 9653 * make sure to account for it. We don't apply the size 9654 * until the AUTH chunk is actually added below in case 9655 * there is no room for this chunk. 9656 */ 9657 if (data_auth_reqd && (auth == NULL)) { 9658 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9659 } else 9660 dmtu = 0; 9661 9662 if ((chk->send_size <= (mtu - dmtu)) || 9663 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 9664 /* ok we will add this one */ 9665 if (data_auth_reqd) { 9666 if (auth == NULL) { 9667 m = sctp_add_auth_chunk(m, 9668 &endofchain, 9669 &auth, 9670 &auth_offset, 9671 stcb, 9672 SCTP_DATA); 9673 auth_keyid = chk->auth_keyid; 9674 override_ok = 0; 9675 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9676 } else if (override_ok) { 9677 auth_keyid = chk->auth_keyid; 9678 override_ok = 0; 9679 } else if (chk->auth_keyid != auth_keyid) { 9680 /* different keyid, so done bundling */ 9681 break; 9682 } 9683 } 9684 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9685 if (m == NULL) { 9686 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9687 return (ENOMEM); 9688 } 9689 /* Do clear IP_DF ? */ 9690 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9691 no_fragmentflg = 0; 9692 } 9693 /* upate our MTU size */ 9694 if (mtu > (chk->send_size + dmtu)) 9695 mtu -= (chk->send_size + dmtu); 9696 else 9697 mtu = 0; 9698 data_list[bundle_at++] = chk; 9699 if (one_chunk && (asoc->total_flight <= 0)) { 9700 SCTP_STAT_INCR(sctps_windowprobed); 9701 } 9702 } 9703 if (one_chunk == 0) { 9704 /* 9705 * now are there anymore forward from chk to pick 9706 * up? 9707 */ 9708 for (fwd = TAILQ_NEXT(chk, sctp_next); fwd != NULL; fwd = TAILQ_NEXT(fwd, sctp_next)) { 9709 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 9710 /* Nope, not for retran */ 9711 continue; 9712 } 9713 if (fwd->whoTo != net) { 9714 /* Nope, not the net in question */ 9715 continue; 9716 } 9717 if (data_auth_reqd && (auth == NULL)) { 9718 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9719 } else 9720 dmtu = 0; 9721 if (fwd->send_size <= (mtu - dmtu)) { 9722 if (data_auth_reqd) { 9723 if (auth == NULL) { 9724 m = sctp_add_auth_chunk(m, 9725 &endofchain, 9726 &auth, 9727 &auth_offset, 9728 stcb, 9729 SCTP_DATA); 9730 auth_keyid = fwd->auth_keyid; 9731 override_ok = 0; 9732 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9733 } else if (override_ok) { 9734 auth_keyid = fwd->auth_keyid; 9735 override_ok = 0; 9736 } else if (fwd->auth_keyid != auth_keyid) { 9737 /* 9738 * different keyid, 9739 * so done bundling 9740 */ 9741 break; 9742 } 9743 } 9744 m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref); 9745 if (m == NULL) { 9746 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9747 return (ENOMEM); 9748 } 9749 /* Do clear IP_DF ? */ 9750 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9751 no_fragmentflg = 0; 9752 } 9753 /* upate our MTU size */ 9754 if (mtu > (fwd->send_size + dmtu)) 9755 mtu -= (fwd->send_size + dmtu); 9756 else 9757 mtu = 0; 9758 data_list[bundle_at++] = fwd; 9759 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 9760 break; 9761 } 9762 } else { 9763 /* can't fit so we are done */ 9764 break; 9765 } 9766 } 9767 } 9768 /* Is there something to send for this destination? */ 9769 if (m) { 9770 /* 9771 * No matter if we fail/or succeed we should start a 9772 * timer. A failure is like a lost IP packet :-) 9773 */ 9774 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9775 /* 9776 * no timer running on this destination 9777 * restart it. 9778 */ 9779 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9780 tmr_started = 1; 9781 } 9782 /* Now lets send it, if there is anything to send :> */ 9783 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 9784 (struct sockaddr *)&net->ro._l_addr, m, 9785 auth_offset, auth, auth_keyid, 9786 no_fragmentflg, 0, 0, 9787 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9788 net->port, NULL, 9789 0, 0, 9790 so_locked))) { 9791 /* error, we could not output */ 9792 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9793 if (error == ENOBUFS) { 9794 asoc->ifp_had_enobuf = 1; 9795 SCTP_STAT_INCR(sctps_lowlevelerr); 9796 } 9797 return (error); 9798 } else { 9799 asoc->ifp_had_enobuf = 0; 9800 } 9801 endofchain = NULL; 9802 auth = NULL; 9803 auth_offset = 0; 9804 /* For HB's */ 9805 /* 9806 * We don't want to mark the net->sent time here 9807 * since this we use this for HB and retrans cannot 9808 * measure RTT 9809 */ 9810 /* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */ 9811 9812 /* For auto-close */ 9813 cnt_thru++; 9814 if (*now_filled == 0) { 9815 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 9816 *now = asoc->time_last_sent; 9817 *now_filled = 1; 9818 } else { 9819 asoc->time_last_sent = *now; 9820 } 9821 *cnt_out += bundle_at; 9822 #ifdef SCTP_AUDITING_ENABLED 9823 sctp_audit_log(0xC4, bundle_at); 9824 #endif 9825 if (bundle_at) { 9826 tsns_sent = data_list[0]->rec.data.tsn; 9827 } 9828 for (i = 0; i < bundle_at; i++) { 9829 SCTP_STAT_INCR(sctps_sendretransdata); 9830 data_list[i]->sent = SCTP_DATAGRAM_SENT; 9831 /* 9832 * When we have a revoked data, and we 9833 * retransmit it, then we clear the revoked 9834 * flag since this flag dictates if we 9835 * subtracted from the fs 9836 */ 9837 if (data_list[i]->rec.data.chunk_was_revoked) { 9838 /* Deflate the cwnd */ 9839 data_list[i]->whoTo->cwnd -= data_list[i]->book_size; 9840 data_list[i]->rec.data.chunk_was_revoked = 0; 9841 } 9842 data_list[i]->snd_count++; 9843 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 9844 /* record the time */ 9845 data_list[i]->sent_rcv_time = asoc->time_last_sent; 9846 if (data_list[i]->book_size_scale) { 9847 /* 9848 * need to double the book size on 9849 * this one 9850 */ 9851 data_list[i]->book_size_scale = 0; 9852 /* 9853 * Since we double the booksize, we 9854 * must also double the output queue 9855 * size, since this get shrunk when 9856 * we free by this amount. 9857 */ 9858 atomic_add_int(&((asoc)->total_output_queue_size), data_list[i]->book_size); 9859 data_list[i]->book_size *= 2; 9860 } else { 9861 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 9862 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 9863 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 9864 } 9865 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 9866 (uint32_t)(data_list[i]->send_size + 9867 SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 9868 } 9869 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 9870 sctp_misc_ints(SCTP_FLIGHT_LOG_UP_RSND, 9871 data_list[i]->whoTo->flight_size, 9872 data_list[i]->book_size, 9873 (uint32_t)(uintptr_t)data_list[i]->whoTo, 9874 data_list[i]->rec.data.tsn); 9875 } 9876 sctp_flight_size_increase(data_list[i]); 9877 sctp_total_flight_increase(stcb, data_list[i]); 9878 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 9879 /* SWS sender side engages */ 9880 asoc->peers_rwnd = 0; 9881 } 9882 if ((i == 0) && 9883 (data_list[i]->rec.data.doing_fast_retransmit)) { 9884 SCTP_STAT_INCR(sctps_sendfastretrans); 9885 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 9886 (tmr_started == 0)) { 9887 /*- 9888 * ok we just fast-retrans'd 9889 * the lowest TSN, i.e the 9890 * first on the list. In 9891 * this case we want to give 9892 * some more time to get a 9893 * SACK back without a 9894 * t3-expiring. 9895 */ 9896 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 9897 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_2); 9898 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9899 } 9900 } 9901 } 9902 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 9903 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND); 9904 } 9905 #ifdef SCTP_AUDITING_ENABLED 9906 sctp_auditing(21, inp, stcb, NULL); 9907 #endif 9908 } else { 9909 /* None will fit */ 9910 return (1); 9911 } 9912 if (asoc->sent_queue_retran_cnt <= 0) { 9913 /* all done we have no more to retran */ 9914 asoc->sent_queue_retran_cnt = 0; 9915 break; 9916 } 9917 if (one_chunk) { 9918 /* No more room in rwnd */ 9919 return (1); 9920 } 9921 /* stop the for loop here. we sent out a packet */ 9922 break; 9923 } 9924 return (0); 9925 } 9926 9927 static void 9928 sctp_timer_validation(struct sctp_inpcb *inp, 9929 struct sctp_tcb *stcb, 9930 struct sctp_association *asoc) 9931 { 9932 struct sctp_nets *net; 9933 9934 /* Validate that a timer is running somewhere */ 9935 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 9936 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9937 /* Here is a timer */ 9938 return; 9939 } 9940 } 9941 SCTP_TCB_LOCK_ASSERT(stcb); 9942 /* Gak, we did not have a timer somewhere */ 9943 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Deadlock avoided starting timer on a dest at retran\n"); 9944 if (asoc->alternate) { 9945 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->alternate); 9946 } else { 9947 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 9948 } 9949 return; 9950 } 9951 9952 void 9953 sctp_chunk_output(struct sctp_inpcb *inp, 9954 struct sctp_tcb *stcb, 9955 int from_where, 9956 int so_locked) 9957 { 9958 /*- 9959 * Ok this is the generic chunk service queue. we must do the 9960 * following: 9961 * - See if there are retransmits pending, if so we must 9962 * do these first. 9963 * - Service the stream queue that is next, moving any 9964 * message (note I must get a complete message i.e. 9965 * FIRST/MIDDLE and LAST to the out queue in one pass) and assigning 9966 * TSN's 9967 * - Check to see if the cwnd/rwnd allows any output, if so we 9968 * go ahead and fomulate and send the low level chunks. Making sure 9969 * to combine any control in the control chunk queue also. 9970 */ 9971 struct sctp_association *asoc; 9972 struct sctp_nets *net; 9973 int error = 0, num_out, tot_out = 0, ret = 0, reason_code; 9974 unsigned int burst_cnt = 0; 9975 struct timeval now; 9976 int now_filled = 0; 9977 int nagle_on; 9978 int frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 9979 int un_sent = 0; 9980 int fr_done; 9981 unsigned int tot_frs = 0; 9982 9983 asoc = &stcb->asoc; 9984 do_it_again: 9985 /* The Nagle algorithm is only applied when handling a send call. */ 9986 if (from_where == SCTP_OUTPUT_FROM_USR_SEND) { 9987 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) { 9988 nagle_on = 0; 9989 } else { 9990 nagle_on = 1; 9991 } 9992 } else { 9993 nagle_on = 0; 9994 } 9995 SCTP_TCB_LOCK_ASSERT(stcb); 9996 9997 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 9998 9999 if ((un_sent <= 0) && 10000 (TAILQ_EMPTY(&asoc->control_send_queue)) && 10001 (TAILQ_EMPTY(&asoc->asconf_send_queue)) && 10002 (asoc->sent_queue_retran_cnt == 0) && 10003 (asoc->trigger_reset == 0)) { 10004 /* Nothing to do unless there is something to be sent left */ 10005 return; 10006 } 10007 /* 10008 * Do we have something to send, data or control AND a sack timer 10009 * running, if so piggy-back the sack. 10010 */ 10011 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 10012 sctp_send_sack(stcb, so_locked); 10013 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, 10014 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_3); 10015 } 10016 while (asoc->sent_queue_retran_cnt) { 10017 /*- 10018 * Ok, it is retransmission time only, we send out only ONE 10019 * packet with a single call off to the retran code. 10020 */ 10021 if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) { 10022 /*- 10023 * Special hook for handling cookiess discarded 10024 * by peer that carried data. Send cookie-ack only 10025 * and then the next call with get the retran's. 10026 */ 10027 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10028 from_where, 10029 &now, &now_filled, frag_point, so_locked); 10030 return; 10031 } else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) { 10032 /* if its not from a HB then do it */ 10033 fr_done = 0; 10034 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled, &fr_done, so_locked); 10035 if (fr_done) { 10036 tot_frs++; 10037 } 10038 } else { 10039 /* 10040 * its from any other place, we don't allow retran 10041 * output (only control) 10042 */ 10043 ret = 1; 10044 } 10045 if (ret > 0) { 10046 /* Can't send anymore */ 10047 /*- 10048 * now lets push out control by calling med-level 10049 * output once. this assures that we WILL send HB's 10050 * if queued too. 10051 */ 10052 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10053 from_where, 10054 &now, &now_filled, frag_point, so_locked); 10055 #ifdef SCTP_AUDITING_ENABLED 10056 sctp_auditing(8, inp, stcb, NULL); 10057 #endif 10058 sctp_timer_validation(inp, stcb, asoc); 10059 return; 10060 } 10061 if (ret < 0) { 10062 /*- 10063 * The count was off.. retran is not happening so do 10064 * the normal retransmission. 10065 */ 10066 #ifdef SCTP_AUDITING_ENABLED 10067 sctp_auditing(9, inp, stcb, NULL); 10068 #endif 10069 if (ret == SCTP_RETRAN_EXIT) { 10070 return; 10071 } 10072 break; 10073 } 10074 if (from_where == SCTP_OUTPUT_FROM_T3) { 10075 /* Only one transmission allowed out of a timeout */ 10076 #ifdef SCTP_AUDITING_ENABLED 10077 sctp_auditing(10, inp, stcb, NULL); 10078 #endif 10079 /* Push out any control */ 10080 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, from_where, 10081 &now, &now_filled, frag_point, so_locked); 10082 return; 10083 } 10084 if ((asoc->fr_max_burst > 0) && (tot_frs >= asoc->fr_max_burst)) { 10085 /* Hit FR burst limit */ 10086 return; 10087 } 10088 if ((num_out == 0) && (ret == 0)) { 10089 /* No more retrans to send */ 10090 break; 10091 } 10092 } 10093 #ifdef SCTP_AUDITING_ENABLED 10094 sctp_auditing(12, inp, stcb, NULL); 10095 #endif 10096 /* Check for bad destinations, if they exist move chunks around. */ 10097 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 10098 if (!(net->dest_state & SCTP_ADDR_REACHABLE)) { 10099 /*- 10100 * if possible move things off of this address we 10101 * still may send below due to the dormant state but 10102 * we try to find an alternate address to send to 10103 * and if we have one we move all queued data on the 10104 * out wheel to this alternate address. 10105 */ 10106 if (net->ref_count > 1) 10107 sctp_move_chunks_from_net(stcb, net); 10108 } else { 10109 /*- 10110 * if ((asoc->sat_network) || (net->addr_is_local)) 10111 * { burst_limit = asoc->max_burst * 10112 * SCTP_SAT_NETWORK_BURST_INCR; } 10113 */ 10114 if (asoc->max_burst > 0) { 10115 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst)) { 10116 if ((net->flight_size + (asoc->max_burst * net->mtu)) < net->cwnd) { 10117 /* 10118 * JRS - Use the congestion 10119 * control given in the 10120 * congestion control module 10121 */ 10122 asoc->cc_functions.sctp_cwnd_update_after_output(stcb, net, asoc->max_burst); 10123 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10124 sctp_log_maxburst(stcb, net, 0, asoc->max_burst, SCTP_MAX_BURST_APPLIED); 10125 } 10126 SCTP_STAT_INCR(sctps_maxburstqueued); 10127 } 10128 net->fast_retran_ip = 0; 10129 } else { 10130 if (net->flight_size == 0) { 10131 /* 10132 * Should be decaying the 10133 * cwnd here 10134 */ 10135 ; 10136 } 10137 } 10138 } 10139 } 10140 } 10141 burst_cnt = 0; 10142 do { 10143 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 10144 &reason_code, 0, from_where, 10145 &now, &now_filled, frag_point, so_locked); 10146 if (error) { 10147 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Error %d was returned from med-c-op\n", error); 10148 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10149 sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 10150 } 10151 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10152 sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES); 10153 sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES); 10154 } 10155 break; 10156 } 10157 SCTPDBG(SCTP_DEBUG_OUTPUT3, "m-c-o put out %d\n", num_out); 10158 10159 tot_out += num_out; 10160 burst_cnt++; 10161 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10162 sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES); 10163 if (num_out == 0) { 10164 sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES); 10165 } 10166 } 10167 if (nagle_on) { 10168 /* 10169 * When the Nagle algorithm is used, look at how 10170 * much is unsent, then if its smaller than an MTU 10171 * and we have data in flight we stop, except if we 10172 * are handling a fragmented user message. 10173 */ 10174 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 10175 if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) && 10176 (stcb->asoc.total_flight > 0)) { 10177 /* && sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) {*/ 10178 break; 10179 } 10180 } 10181 if (TAILQ_EMPTY(&asoc->control_send_queue) && 10182 TAILQ_EMPTY(&asoc->send_queue) && 10183 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 10184 /* Nothing left to send */ 10185 break; 10186 } 10187 if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) { 10188 /* Nothing left to send */ 10189 break; 10190 } 10191 } while (num_out && 10192 ((asoc->max_burst == 0) || 10193 SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) || 10194 (burst_cnt < asoc->max_burst))); 10195 10196 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) == 0) { 10197 if ((asoc->max_burst > 0) && (burst_cnt >= asoc->max_burst)) { 10198 SCTP_STAT_INCR(sctps_maxburstqueued); 10199 asoc->burst_limit_applied = 1; 10200 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10201 sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED); 10202 } 10203 } else { 10204 asoc->burst_limit_applied = 0; 10205 } 10206 } 10207 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10208 sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES); 10209 } 10210 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, we have put out %d chunks\n", 10211 tot_out); 10212 10213 /*- 10214 * Now we need to clean up the control chunk chain if a ECNE is on 10215 * it. It must be marked as UNSENT again so next call will continue 10216 * to send it until such time that we get a CWR, to remove it. 10217 */ 10218 if (stcb->asoc.ecn_echo_cnt_onq) 10219 sctp_fix_ecn_echo(asoc); 10220 10221 if (stcb->asoc.trigger_reset) { 10222 if (sctp_send_stream_reset_out_if_possible(stcb, so_locked) == 0) { 10223 goto do_it_again; 10224 } 10225 } 10226 return; 10227 } 10228 10229 int 10230 sctp_output( 10231 struct sctp_inpcb *inp, 10232 struct mbuf *m, 10233 struct sockaddr *addr, 10234 struct mbuf *control, 10235 struct thread *p, 10236 int flags) 10237 { 10238 if (inp == NULL) { 10239 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10240 return (EINVAL); 10241 } 10242 10243 if (inp->sctp_socket == NULL) { 10244 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10245 return (EINVAL); 10246 } 10247 return (sctp_sosend(inp->sctp_socket, 10248 addr, 10249 (struct uio *)NULL, 10250 m, 10251 control, 10252 flags, p 10253 )); 10254 } 10255 10256 void 10257 send_forward_tsn(struct sctp_tcb *stcb, 10258 struct sctp_association *asoc) 10259 { 10260 struct sctp_tmit_chunk *chk, *at, *tp1, *last; 10261 struct sctp_forward_tsn_chunk *fwdtsn; 10262 struct sctp_strseq *strseq; 10263 struct sctp_strseq_mid *strseq_m; 10264 uint32_t advance_peer_ack_point; 10265 unsigned int cnt_of_space, i, ovh; 10266 unsigned int space_needed; 10267 unsigned int cnt_of_skipped = 0; 10268 10269 SCTP_TCB_LOCK_ASSERT(stcb); 10270 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10271 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 10272 /* mark it to unsent */ 10273 chk->sent = SCTP_DATAGRAM_UNSENT; 10274 chk->snd_count = 0; 10275 /* Do we correct its output location? */ 10276 if (chk->whoTo) { 10277 sctp_free_remote_addr(chk->whoTo); 10278 chk->whoTo = NULL; 10279 } 10280 goto sctp_fill_in_rest; 10281 } 10282 } 10283 /* Ok if we reach here we must build one */ 10284 sctp_alloc_a_chunk(stcb, chk); 10285 if (chk == NULL) { 10286 return; 10287 } 10288 asoc->fwd_tsn_cnt++; 10289 chk->copy_by_ref = 0; 10290 /* 10291 * We don't do the old thing here since this is used not for on-wire 10292 * but to tell if we are sending a fwd-tsn by the stack during 10293 * output. And if its a IFORWARD or a FORWARD it is a fwd-tsn. 10294 */ 10295 chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN; 10296 chk->rec.chunk_id.can_take_data = 0; 10297 chk->flags = 0; 10298 chk->asoc = asoc; 10299 chk->whoTo = NULL; 10300 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 10301 if (chk->data == NULL) { 10302 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 10303 return; 10304 } 10305 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 10306 chk->sent = SCTP_DATAGRAM_UNSENT; 10307 chk->snd_count = 0; 10308 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 10309 asoc->ctrl_queue_cnt++; 10310 sctp_fill_in_rest: 10311 /*- 10312 * Here we go through and fill out the part that deals with 10313 * stream/seq of the ones we skip. 10314 */ 10315 SCTP_BUF_LEN(chk->data) = 0; 10316 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10317 if ((at->sent != SCTP_FORWARD_TSN_SKIP) && 10318 (at->sent != SCTP_DATAGRAM_NR_ACKED)) { 10319 /* no more to look at */ 10320 break; 10321 } 10322 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10323 /* We don't report these */ 10324 continue; 10325 } 10326 cnt_of_skipped++; 10327 } 10328 if (asoc->idata_supported) { 10329 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10330 (cnt_of_skipped * sizeof(struct sctp_strseq_mid))); 10331 } else { 10332 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10333 (cnt_of_skipped * sizeof(struct sctp_strseq))); 10334 } 10335 cnt_of_space = (unsigned int)M_TRAILINGSPACE(chk->data); 10336 10337 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 10338 ovh = SCTP_MIN_OVERHEAD; 10339 } else { 10340 ovh = SCTP_MIN_V4_OVERHEAD; 10341 } 10342 if (cnt_of_space > (asoc->smallest_mtu - ovh)) { 10343 /* trim to a mtu size */ 10344 cnt_of_space = asoc->smallest_mtu - ovh; 10345 } 10346 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10347 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10348 0xff, 0, cnt_of_skipped, 10349 asoc->advanced_peer_ack_point); 10350 } 10351 advance_peer_ack_point = asoc->advanced_peer_ack_point; 10352 if (cnt_of_space < space_needed) { 10353 /*- 10354 * ok we must trim down the chunk by lowering the 10355 * advance peer ack point. 10356 */ 10357 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10358 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10359 0xff, 0xff, cnt_of_space, 10360 space_needed); 10361 } 10362 cnt_of_skipped = cnt_of_space - sizeof(struct sctp_forward_tsn_chunk); 10363 if (asoc->idata_supported) { 10364 cnt_of_skipped /= sizeof(struct sctp_strseq_mid); 10365 } else { 10366 cnt_of_skipped /= sizeof(struct sctp_strseq); 10367 } 10368 /*- 10369 * Go through and find the TSN that will be the one 10370 * we report. 10371 */ 10372 at = TAILQ_FIRST(&asoc->sent_queue); 10373 if (at != NULL) { 10374 for (i = 0; i < cnt_of_skipped; i++) { 10375 tp1 = TAILQ_NEXT(at, sctp_next); 10376 if (tp1 == NULL) { 10377 break; 10378 } 10379 at = tp1; 10380 } 10381 } 10382 if (at && SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10383 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10384 0xff, cnt_of_skipped, at->rec.data.tsn, 10385 asoc->advanced_peer_ack_point); 10386 } 10387 last = at; 10388 /*- 10389 * last now points to last one I can report, update 10390 * peer ack point 10391 */ 10392 if (last) { 10393 advance_peer_ack_point = last->rec.data.tsn; 10394 } 10395 if (asoc->idata_supported) { 10396 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10397 cnt_of_skipped * sizeof(struct sctp_strseq_mid); 10398 } else { 10399 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10400 cnt_of_skipped * sizeof(struct sctp_strseq); 10401 } 10402 } 10403 chk->send_size = space_needed; 10404 /* Setup the chunk */ 10405 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 10406 fwdtsn->ch.chunk_length = htons(chk->send_size); 10407 fwdtsn->ch.chunk_flags = 0; 10408 if (asoc->idata_supported) { 10409 fwdtsn->ch.chunk_type = SCTP_IFORWARD_CUM_TSN; 10410 } else { 10411 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 10412 } 10413 fwdtsn->new_cumulative_tsn = htonl(advance_peer_ack_point); 10414 SCTP_BUF_LEN(chk->data) = chk->send_size; 10415 fwdtsn++; 10416 /*- 10417 * Move pointer to after the fwdtsn and transfer to the 10418 * strseq pointer. 10419 */ 10420 if (asoc->idata_supported) { 10421 strseq_m = (struct sctp_strseq_mid *)fwdtsn; 10422 strseq = NULL; 10423 } else { 10424 strseq = (struct sctp_strseq *)fwdtsn; 10425 strseq_m = NULL; 10426 } 10427 /*- 10428 * Now populate the strseq list. This is done blindly 10429 * without pulling out duplicate stream info. This is 10430 * inefficent but won't harm the process since the peer will 10431 * look at these in sequence and will thus release anything. 10432 * It could mean we exceed the PMTU and chop off some that 10433 * we could have included.. but this is unlikely (aka 1432/4 10434 * would mean 300+ stream seq's would have to be reported in 10435 * one FWD-TSN. With a bit of work we can later FIX this to 10436 * optimize and pull out duplicates.. but it does add more 10437 * overhead. So for now... not! 10438 */ 10439 i = 0; 10440 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10441 if (i >= cnt_of_skipped) { 10442 break; 10443 } 10444 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10445 /* We don't report these */ 10446 continue; 10447 } 10448 if (at->rec.data.tsn == advance_peer_ack_point) { 10449 at->rec.data.fwd_tsn_cnt = 0; 10450 } 10451 if (asoc->idata_supported) { 10452 strseq_m->sid = htons(at->rec.data.sid); 10453 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 10454 strseq_m->flags = htons(PR_SCTP_UNORDERED_FLAG); 10455 } else { 10456 strseq_m->flags = 0; 10457 } 10458 strseq_m->mid = htonl(at->rec.data.mid); 10459 strseq_m++; 10460 } else { 10461 strseq->sid = htons(at->rec.data.sid); 10462 strseq->ssn = htons((uint16_t)at->rec.data.mid); 10463 strseq++; 10464 } 10465 i++; 10466 } 10467 return; 10468 } 10469 10470 void 10471 sctp_send_sack(struct sctp_tcb *stcb, int so_locked) 10472 { 10473 /*- 10474 * Queue up a SACK or NR-SACK in the control queue. 10475 * We must first check to see if a SACK or NR-SACK is 10476 * somehow on the control queue. 10477 * If so, we will take and and remove the old one. 10478 */ 10479 struct sctp_association *asoc; 10480 struct sctp_tmit_chunk *chk, *a_chk; 10481 struct sctp_sack_chunk *sack; 10482 struct sctp_nr_sack_chunk *nr_sack; 10483 struct sctp_gap_ack_block *gap_descriptor; 10484 const struct sack_track *selector; 10485 int mergeable = 0; 10486 int offset; 10487 caddr_t limit; 10488 uint32_t *dup; 10489 int limit_reached = 0; 10490 unsigned int i, siz, j; 10491 unsigned int num_gap_blocks = 0, num_nr_gap_blocks = 0, space; 10492 int num_dups = 0; 10493 int space_req; 10494 uint32_t highest_tsn; 10495 uint8_t flags; 10496 uint8_t type; 10497 uint8_t tsn_map; 10498 10499 if (stcb->asoc.nrsack_supported == 1) { 10500 type = SCTP_NR_SELECTIVE_ACK; 10501 } else { 10502 type = SCTP_SELECTIVE_ACK; 10503 } 10504 a_chk = NULL; 10505 asoc = &stcb->asoc; 10506 SCTP_TCB_LOCK_ASSERT(stcb); 10507 if (asoc->last_data_chunk_from == NULL) { 10508 /* Hmm we never received anything */ 10509 return; 10510 } 10511 sctp_slide_mapping_arrays(stcb); 10512 sctp_set_rwnd(stcb, asoc); 10513 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10514 if (chk->rec.chunk_id.id == type) { 10515 /* Hmm, found a sack already on queue, remove it */ 10516 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 10517 asoc->ctrl_queue_cnt--; 10518 a_chk = chk; 10519 if (a_chk->data) { 10520 sctp_m_freem(a_chk->data); 10521 a_chk->data = NULL; 10522 } 10523 if (a_chk->whoTo) { 10524 sctp_free_remote_addr(a_chk->whoTo); 10525 a_chk->whoTo = NULL; 10526 } 10527 break; 10528 } 10529 } 10530 if (a_chk == NULL) { 10531 sctp_alloc_a_chunk(stcb, a_chk); 10532 if (a_chk == NULL) { 10533 /* No memory so we drop the idea, and set a timer */ 10534 if (stcb->asoc.delayed_ack) { 10535 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10536 stcb->sctp_ep, stcb, NULL, 10537 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4); 10538 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10539 stcb->sctp_ep, stcb, NULL); 10540 } else { 10541 stcb->asoc.send_sack = 1; 10542 } 10543 return; 10544 } 10545 a_chk->copy_by_ref = 0; 10546 a_chk->rec.chunk_id.id = type; 10547 a_chk->rec.chunk_id.can_take_data = 1; 10548 } 10549 /* Clear our pkt counts */ 10550 asoc->data_pkts_seen = 0; 10551 10552 a_chk->flags = 0; 10553 a_chk->asoc = asoc; 10554 a_chk->snd_count = 0; 10555 a_chk->send_size = 0; /* fill in later */ 10556 a_chk->sent = SCTP_DATAGRAM_UNSENT; 10557 a_chk->whoTo = NULL; 10558 10559 if (!(asoc->last_data_chunk_from->dest_state & SCTP_ADDR_REACHABLE)) { 10560 /*- 10561 * Ok, the destination for the SACK is unreachable, lets see if 10562 * we can select an alternate to asoc->last_data_chunk_from 10563 */ 10564 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0); 10565 if (a_chk->whoTo == NULL) { 10566 /* Nope, no alternate */ 10567 a_chk->whoTo = asoc->last_data_chunk_from; 10568 } 10569 } else { 10570 a_chk->whoTo = asoc->last_data_chunk_from; 10571 } 10572 if (a_chk->whoTo) { 10573 atomic_add_int(&a_chk->whoTo->ref_count, 1); 10574 } 10575 if (SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->highest_tsn_inside_nr_map)) { 10576 highest_tsn = asoc->highest_tsn_inside_map; 10577 } else { 10578 highest_tsn = asoc->highest_tsn_inside_nr_map; 10579 } 10580 if (highest_tsn == asoc->cumulative_tsn) { 10581 /* no gaps */ 10582 if (type == SCTP_SELECTIVE_ACK) { 10583 space_req = sizeof(struct sctp_sack_chunk); 10584 } else { 10585 space_req = sizeof(struct sctp_nr_sack_chunk); 10586 } 10587 } else { 10588 /* gaps get a cluster */ 10589 space_req = MCLBYTES; 10590 } 10591 /* Ok now lets formulate a MBUF with our sack */ 10592 a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_NOWAIT, 1, MT_DATA); 10593 if ((a_chk->data == NULL) || 10594 (a_chk->whoTo == NULL)) { 10595 /* rats, no mbuf memory */ 10596 if (a_chk->data) { 10597 /* was a problem with the destination */ 10598 sctp_m_freem(a_chk->data); 10599 a_chk->data = NULL; 10600 } 10601 sctp_free_a_chunk(stcb, a_chk, so_locked); 10602 /* sa_ignore NO_NULL_CHK */ 10603 if (stcb->asoc.delayed_ack) { 10604 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10605 stcb->sctp_ep, stcb, NULL, 10606 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5); 10607 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10608 stcb->sctp_ep, stcb, NULL); 10609 } else { 10610 stcb->asoc.send_sack = 1; 10611 } 10612 return; 10613 } 10614 /* ok, lets go through and fill it in */ 10615 SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD); 10616 space = (unsigned int)M_TRAILINGSPACE(a_chk->data); 10617 if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) { 10618 space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD); 10619 } 10620 limit = mtod(a_chk->data, caddr_t); 10621 limit += space; 10622 10623 flags = 0; 10624 10625 if ((asoc->sctp_cmt_on_off > 0) && 10626 SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) { 10627 /*- 10628 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been 10629 * received, then set high bit to 1, else 0. Reset 10630 * pkts_rcvd. 10631 */ 10632 flags |= (asoc->cmt_dac_pkts_rcvd << 6); 10633 asoc->cmt_dac_pkts_rcvd = 0; 10634 } 10635 #ifdef SCTP_ASOCLOG_OF_TSNS 10636 stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn; 10637 stcb->asoc.cumack_log_atsnt++; 10638 if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) { 10639 stcb->asoc.cumack_log_atsnt = 0; 10640 } 10641 #endif 10642 /* reset the readers interpretation */ 10643 stcb->freed_by_sorcv_sincelast = 0; 10644 10645 if (type == SCTP_SELECTIVE_ACK) { 10646 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 10647 nr_sack = NULL; 10648 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk)); 10649 if (highest_tsn > asoc->mapping_array_base_tsn) { 10650 siz = (((highest_tsn - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10651 } else { 10652 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + highest_tsn + 7) / 8; 10653 } 10654 } else { 10655 sack = NULL; 10656 nr_sack = mtod(a_chk->data, struct sctp_nr_sack_chunk *); 10657 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)nr_sack + sizeof(struct sctp_nr_sack_chunk)); 10658 if (asoc->highest_tsn_inside_map > asoc->mapping_array_base_tsn) { 10659 siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10660 } else { 10661 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_map + 7) / 8; 10662 } 10663 } 10664 10665 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10666 offset = 1; 10667 } else { 10668 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10669 } 10670 if (((type == SCTP_SELECTIVE_ACK) && 10671 SCTP_TSN_GT(highest_tsn, asoc->cumulative_tsn)) || 10672 ((type == SCTP_NR_SELECTIVE_ACK) && 10673 SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->cumulative_tsn))) { 10674 /* we have a gap .. maybe */ 10675 for (i = 0; i < siz; i++) { 10676 tsn_map = asoc->mapping_array[i]; 10677 if (type == SCTP_SELECTIVE_ACK) { 10678 tsn_map |= asoc->nr_mapping_array[i]; 10679 } 10680 if (i == 0) { 10681 /* 10682 * Clear all bits corresponding to TSNs 10683 * smaller or equal to the cumulative TSN. 10684 */ 10685 tsn_map &= (~0U << (1 - offset)); 10686 } 10687 selector = &sack_array[tsn_map]; 10688 if (mergeable && selector->right_edge) { 10689 /* 10690 * Backup, left and right edges were ok to 10691 * merge. 10692 */ 10693 num_gap_blocks--; 10694 gap_descriptor--; 10695 } 10696 if (selector->num_entries == 0) 10697 mergeable = 0; 10698 else { 10699 for (j = 0; j < selector->num_entries; j++) { 10700 if (mergeable && selector->right_edge) { 10701 /* 10702 * do a merge by NOT setting 10703 * the left side 10704 */ 10705 mergeable = 0; 10706 } else { 10707 /* 10708 * no merge, set the left 10709 * side 10710 */ 10711 mergeable = 0; 10712 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10713 } 10714 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10715 num_gap_blocks++; 10716 gap_descriptor++; 10717 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10718 /* no more room */ 10719 limit_reached = 1; 10720 break; 10721 } 10722 } 10723 if (selector->left_edge) { 10724 mergeable = 1; 10725 } 10726 } 10727 if (limit_reached) { 10728 /* Reached the limit stop */ 10729 break; 10730 } 10731 offset += 8; 10732 } 10733 } 10734 if ((type == SCTP_NR_SELECTIVE_ACK) && 10735 (limit_reached == 0)) { 10736 mergeable = 0; 10737 10738 if (asoc->highest_tsn_inside_nr_map > asoc->mapping_array_base_tsn) { 10739 siz = (((asoc->highest_tsn_inside_nr_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10740 } else { 10741 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_nr_map + 7) / 8; 10742 } 10743 10744 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10745 offset = 1; 10746 } else { 10747 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10748 } 10749 if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->cumulative_tsn)) { 10750 /* we have a gap .. maybe */ 10751 for (i = 0; i < siz; i++) { 10752 tsn_map = asoc->nr_mapping_array[i]; 10753 if (i == 0) { 10754 /* 10755 * Clear all bits corresponding to 10756 * TSNs smaller or equal to the 10757 * cumulative TSN. 10758 */ 10759 tsn_map &= (~0U << (1 - offset)); 10760 } 10761 selector = &sack_array[tsn_map]; 10762 if (mergeable && selector->right_edge) { 10763 /* 10764 * Backup, left and right edges were 10765 * ok to merge. 10766 */ 10767 num_nr_gap_blocks--; 10768 gap_descriptor--; 10769 } 10770 if (selector->num_entries == 0) 10771 mergeable = 0; 10772 else { 10773 for (j = 0; j < selector->num_entries; j++) { 10774 if (mergeable && selector->right_edge) { 10775 /* 10776 * do a merge by NOT 10777 * setting the left 10778 * side 10779 */ 10780 mergeable = 0; 10781 } else { 10782 /* 10783 * no merge, set the 10784 * left side 10785 */ 10786 mergeable = 0; 10787 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10788 } 10789 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10790 num_nr_gap_blocks++; 10791 gap_descriptor++; 10792 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10793 /* no more room */ 10794 limit_reached = 1; 10795 break; 10796 } 10797 } 10798 if (selector->left_edge) { 10799 mergeable = 1; 10800 } 10801 } 10802 if (limit_reached) { 10803 /* Reached the limit stop */ 10804 break; 10805 } 10806 offset += 8; 10807 } 10808 } 10809 } 10810 /* now we must add any dups we are going to report. */ 10811 if ((limit_reached == 0) && (asoc->numduptsns)) { 10812 dup = (uint32_t *)gap_descriptor; 10813 for (i = 0; i < asoc->numduptsns; i++) { 10814 *dup = htonl(asoc->dup_tsns[i]); 10815 dup++; 10816 num_dups++; 10817 if (((caddr_t)dup + sizeof(uint32_t)) > limit) { 10818 /* no more room */ 10819 break; 10820 } 10821 } 10822 asoc->numduptsns = 0; 10823 } 10824 /* 10825 * now that the chunk is prepared queue it to the control chunk 10826 * queue. 10827 */ 10828 if (type == SCTP_SELECTIVE_ACK) { 10829 a_chk->send_size = (uint16_t)(sizeof(struct sctp_sack_chunk) + 10830 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10831 num_dups * sizeof(int32_t)); 10832 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10833 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10834 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 10835 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 10836 sack->sack.num_dup_tsns = htons(num_dups); 10837 sack->ch.chunk_type = type; 10838 sack->ch.chunk_flags = flags; 10839 sack->ch.chunk_length = htons(a_chk->send_size); 10840 } else { 10841 a_chk->send_size = (uint16_t)(sizeof(struct sctp_nr_sack_chunk) + 10842 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10843 num_dups * sizeof(int32_t)); 10844 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10845 nr_sack->nr_sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10846 nr_sack->nr_sack.a_rwnd = htonl(asoc->my_rwnd); 10847 nr_sack->nr_sack.num_gap_ack_blks = htons(num_gap_blocks); 10848 nr_sack->nr_sack.num_nr_gap_ack_blks = htons(num_nr_gap_blocks); 10849 nr_sack->nr_sack.num_dup_tsns = htons(num_dups); 10850 nr_sack->nr_sack.reserved = 0; 10851 nr_sack->ch.chunk_type = type; 10852 nr_sack->ch.chunk_flags = flags; 10853 nr_sack->ch.chunk_length = htons(a_chk->send_size); 10854 } 10855 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 10856 asoc->my_last_reported_rwnd = asoc->my_rwnd; 10857 asoc->ctrl_queue_cnt++; 10858 asoc->send_sack = 0; 10859 SCTP_STAT_INCR(sctps_sendsacks); 10860 return; 10861 } 10862 10863 void 10864 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr, int so_locked) 10865 { 10866 struct mbuf *m_abort, *m, *m_last; 10867 struct mbuf *m_out, *m_end = NULL; 10868 struct sctp_abort_chunk *abort; 10869 struct sctp_auth_chunk *auth = NULL; 10870 struct sctp_nets *net; 10871 uint32_t vtag; 10872 uint32_t auth_offset = 0; 10873 int error; 10874 uint16_t cause_len, chunk_len, padding_len; 10875 10876 SCTP_TCB_LOCK_ASSERT(stcb); 10877 /*- 10878 * Add an AUTH chunk, if chunk requires it and save the offset into 10879 * the chain for AUTH 10880 */ 10881 if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION, 10882 stcb->asoc.peer_auth_chunks)) { 10883 m_out = sctp_add_auth_chunk(NULL, &m_end, &auth, &auth_offset, 10884 stcb, SCTP_ABORT_ASSOCIATION); 10885 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10886 } else { 10887 m_out = NULL; 10888 } 10889 m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_NOWAIT, 1, MT_HEADER); 10890 if (m_abort == NULL) { 10891 if (m_out) { 10892 sctp_m_freem(m_out); 10893 } 10894 if (operr) { 10895 sctp_m_freem(operr); 10896 } 10897 return; 10898 } 10899 /* link in any error */ 10900 SCTP_BUF_NEXT(m_abort) = operr; 10901 cause_len = 0; 10902 m_last = NULL; 10903 for (m = operr; m; m = SCTP_BUF_NEXT(m)) { 10904 cause_len += (uint16_t)SCTP_BUF_LEN(m); 10905 if (SCTP_BUF_NEXT(m) == NULL) { 10906 m_last = m; 10907 } 10908 } 10909 SCTP_BUF_LEN(m_abort) = sizeof(struct sctp_abort_chunk); 10910 chunk_len = (uint16_t)sizeof(struct sctp_abort_chunk) + cause_len; 10911 padding_len = SCTP_SIZE32(chunk_len) - chunk_len; 10912 if (m_out == NULL) { 10913 /* NO Auth chunk prepended, so reserve space in front */ 10914 SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD); 10915 m_out = m_abort; 10916 } else { 10917 /* Put AUTH chunk at the front of the chain */ 10918 SCTP_BUF_NEXT(m_end) = m_abort; 10919 } 10920 if (stcb->asoc.alternate) { 10921 net = stcb->asoc.alternate; 10922 } else { 10923 net = stcb->asoc.primary_destination; 10924 } 10925 /* Fill in the ABORT chunk header. */ 10926 abort = mtod(m_abort, struct sctp_abort_chunk *); 10927 abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION; 10928 if (stcb->asoc.peer_vtag == 0) { 10929 /* This happens iff the assoc is in COOKIE-WAIT state. */ 10930 vtag = stcb->asoc.my_vtag; 10931 abort->ch.chunk_flags = SCTP_HAD_NO_TCB; 10932 } else { 10933 vtag = stcb->asoc.peer_vtag; 10934 abort->ch.chunk_flags = 0; 10935 } 10936 abort->ch.chunk_length = htons(chunk_len); 10937 /* Add padding, if necessary. */ 10938 if (padding_len > 0) { 10939 if ((m_last == NULL) || 10940 (sctp_add_pad_tombuf(m_last, padding_len) == NULL)) { 10941 sctp_m_freem(m_out); 10942 return; 10943 } 10944 } 10945 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10946 (struct sockaddr *)&net->ro._l_addr, 10947 m_out, auth_offset, auth, stcb->asoc.authinfo.active_keyid, 1, 0, 0, 10948 stcb->sctp_ep->sctp_lport, stcb->rport, htonl(vtag), 10949 stcb->asoc.primary_destination->port, NULL, 10950 0, 0, 10951 so_locked))) { 10952 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 10953 if (error == ENOBUFS) { 10954 stcb->asoc.ifp_had_enobuf = 1; 10955 SCTP_STAT_INCR(sctps_lowlevelerr); 10956 } 10957 } else { 10958 stcb->asoc.ifp_had_enobuf = 0; 10959 } 10960 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10961 } 10962 10963 void 10964 sctp_send_shutdown_complete(struct sctp_tcb *stcb, 10965 struct sctp_nets *net, 10966 int reflect_vtag) 10967 { 10968 /* formulate and SEND a SHUTDOWN-COMPLETE */ 10969 struct mbuf *m_shutdown_comp; 10970 struct sctp_shutdown_complete_chunk *shutdown_complete; 10971 uint32_t vtag; 10972 int error; 10973 uint8_t flags; 10974 10975 m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 10976 if (m_shutdown_comp == NULL) { 10977 /* no mbuf's */ 10978 return; 10979 } 10980 if (reflect_vtag) { 10981 flags = SCTP_HAD_NO_TCB; 10982 vtag = stcb->asoc.my_vtag; 10983 } else { 10984 flags = 0; 10985 vtag = stcb->asoc.peer_vtag; 10986 } 10987 shutdown_complete = mtod(m_shutdown_comp, struct sctp_shutdown_complete_chunk *); 10988 shutdown_complete->ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 10989 shutdown_complete->ch.chunk_flags = flags; 10990 shutdown_complete->ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 10991 SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_chunk); 10992 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10993 (struct sockaddr *)&net->ro._l_addr, 10994 m_shutdown_comp, 0, NULL, 0, 1, 0, 0, 10995 stcb->sctp_ep->sctp_lport, stcb->rport, 10996 htonl(vtag), 10997 net->port, NULL, 10998 0, 0, 10999 SCTP_SO_NOT_LOCKED))) { 11000 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 11001 if (error == ENOBUFS) { 11002 stcb->asoc.ifp_had_enobuf = 1; 11003 SCTP_STAT_INCR(sctps_lowlevelerr); 11004 } 11005 } else { 11006 stcb->asoc.ifp_had_enobuf = 0; 11007 } 11008 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11009 return; 11010 } 11011 11012 static void 11013 sctp_send_resp_msg(struct sockaddr *src, struct sockaddr *dst, 11014 struct sctphdr *sh, uint32_t vtag, 11015 uint8_t type, struct mbuf *cause, 11016 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11017 uint32_t vrf_id, uint16_t port) 11018 { 11019 struct mbuf *o_pak; 11020 struct mbuf *mout; 11021 struct sctphdr *shout; 11022 struct sctp_chunkhdr *ch; 11023 #if defined(INET) || defined(INET6) 11024 struct udphdr *udp; 11025 #endif 11026 int ret, len, cause_len, padding_len; 11027 #ifdef INET 11028 struct sockaddr_in *src_sin, *dst_sin; 11029 struct ip *ip; 11030 #endif 11031 #ifdef INET6 11032 struct sockaddr_in6 *src_sin6, *dst_sin6; 11033 struct ip6_hdr *ip6; 11034 #endif 11035 11036 /* Compute the length of the cause and add final padding. */ 11037 cause_len = 0; 11038 if (cause != NULL) { 11039 struct mbuf *m_at, *m_last = NULL; 11040 11041 for (m_at = cause; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 11042 if (SCTP_BUF_NEXT(m_at) == NULL) 11043 m_last = m_at; 11044 cause_len += SCTP_BUF_LEN(m_at); 11045 } 11046 padding_len = cause_len % 4; 11047 if (padding_len != 0) { 11048 padding_len = 4 - padding_len; 11049 } 11050 if (padding_len != 0) { 11051 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 11052 sctp_m_freem(cause); 11053 return; 11054 } 11055 } 11056 } else { 11057 padding_len = 0; 11058 } 11059 /* Get an mbuf for the header. */ 11060 len = sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 11061 switch (dst->sa_family) { 11062 #ifdef INET 11063 case AF_INET: 11064 len += sizeof(struct ip); 11065 break; 11066 #endif 11067 #ifdef INET6 11068 case AF_INET6: 11069 len += sizeof(struct ip6_hdr); 11070 break; 11071 #endif 11072 default: 11073 break; 11074 } 11075 #if defined(INET) || defined(INET6) 11076 if (port) { 11077 len += sizeof(struct udphdr); 11078 } 11079 #endif 11080 mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_NOWAIT, 1, MT_DATA); 11081 if (mout == NULL) { 11082 if (cause) { 11083 sctp_m_freem(cause); 11084 } 11085 return; 11086 } 11087 SCTP_BUF_RESV_UF(mout, max_linkhdr); 11088 SCTP_BUF_LEN(mout) = len; 11089 SCTP_BUF_NEXT(mout) = cause; 11090 M_SETFIB(mout, fibnum); 11091 mout->m_pkthdr.flowid = mflowid; 11092 M_HASHTYPE_SET(mout, mflowtype); 11093 #ifdef INET 11094 ip = NULL; 11095 #endif 11096 #ifdef INET6 11097 ip6 = NULL; 11098 #endif 11099 switch (dst->sa_family) { 11100 #ifdef INET 11101 case AF_INET: 11102 src_sin = (struct sockaddr_in *)src; 11103 dst_sin = (struct sockaddr_in *)dst; 11104 ip = mtod(mout, struct ip *); 11105 ip->ip_v = IPVERSION; 11106 ip->ip_hl = (sizeof(struct ip) >> 2); 11107 ip->ip_tos = 0; 11108 ip->ip_off = htons(IP_DF); 11109 ip_fillid(ip); 11110 ip->ip_ttl = MODULE_GLOBAL(ip_defttl); 11111 if (port) { 11112 ip->ip_p = IPPROTO_UDP; 11113 } else { 11114 ip->ip_p = IPPROTO_SCTP; 11115 } 11116 ip->ip_src.s_addr = dst_sin->sin_addr.s_addr; 11117 ip->ip_dst.s_addr = src_sin->sin_addr.s_addr; 11118 ip->ip_sum = 0; 11119 len = sizeof(struct ip); 11120 shout = (struct sctphdr *)((caddr_t)ip + len); 11121 break; 11122 #endif 11123 #ifdef INET6 11124 case AF_INET6: 11125 src_sin6 = (struct sockaddr_in6 *)src; 11126 dst_sin6 = (struct sockaddr_in6 *)dst; 11127 ip6 = mtod(mout, struct ip6_hdr *); 11128 ip6->ip6_flow = htonl(0x60000000); 11129 if (V_ip6_auto_flowlabel) { 11130 ip6->ip6_flow |= (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK); 11131 } 11132 ip6->ip6_hlim = MODULE_GLOBAL(ip6_defhlim); 11133 if (port) { 11134 ip6->ip6_nxt = IPPROTO_UDP; 11135 } else { 11136 ip6->ip6_nxt = IPPROTO_SCTP; 11137 } 11138 ip6->ip6_src = dst_sin6->sin6_addr; 11139 ip6->ip6_dst = src_sin6->sin6_addr; 11140 len = sizeof(struct ip6_hdr); 11141 shout = (struct sctphdr *)((caddr_t)ip6 + len); 11142 break; 11143 #endif 11144 default: 11145 len = 0; 11146 shout = mtod(mout, struct sctphdr *); 11147 break; 11148 } 11149 #if defined(INET) || defined(INET6) 11150 if (port) { 11151 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 11152 sctp_m_freem(mout); 11153 return; 11154 } 11155 udp = (struct udphdr *)shout; 11156 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 11157 udp->uh_dport = port; 11158 udp->uh_sum = 0; 11159 udp->uh_ulen = htons((uint16_t)(sizeof(struct udphdr) + 11160 sizeof(struct sctphdr) + 11161 sizeof(struct sctp_chunkhdr) + 11162 cause_len + padding_len)); 11163 len += sizeof(struct udphdr); 11164 shout = (struct sctphdr *)((caddr_t)shout + sizeof(struct udphdr)); 11165 } else { 11166 udp = NULL; 11167 } 11168 #endif 11169 shout->src_port = sh->dest_port; 11170 shout->dest_port = sh->src_port; 11171 shout->checksum = 0; 11172 if (vtag) { 11173 shout->v_tag = htonl(vtag); 11174 } else { 11175 shout->v_tag = sh->v_tag; 11176 } 11177 len += sizeof(struct sctphdr); 11178 ch = (struct sctp_chunkhdr *)((caddr_t)shout + sizeof(struct sctphdr)); 11179 ch->chunk_type = type; 11180 if (vtag) { 11181 ch->chunk_flags = 0; 11182 } else { 11183 ch->chunk_flags = SCTP_HAD_NO_TCB; 11184 } 11185 ch->chunk_length = htons((uint16_t)(sizeof(struct sctp_chunkhdr) + cause_len)); 11186 len += sizeof(struct sctp_chunkhdr); 11187 len += cause_len + padding_len; 11188 11189 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 11190 sctp_m_freem(mout); 11191 return; 11192 } 11193 SCTP_ATTACH_CHAIN(o_pak, mout, len); 11194 switch (dst->sa_family) { 11195 #ifdef INET 11196 case AF_INET: 11197 if (port) { 11198 if (V_udp_cksum) { 11199 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 11200 } else { 11201 udp->uh_sum = 0; 11202 } 11203 } 11204 ip->ip_len = htons(len); 11205 if (port) { 11206 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip) + sizeof(struct udphdr)); 11207 SCTP_STAT_INCR(sctps_sendswcrc); 11208 if (V_udp_cksum) { 11209 SCTP_ENABLE_UDP_CSUM(o_pak); 11210 } 11211 } else { 11212 mout->m_pkthdr.csum_flags = CSUM_SCTP; 11213 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11214 SCTP_STAT_INCR(sctps_sendhwcrc); 11215 } 11216 #ifdef SCTP_PACKET_LOGGING 11217 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11218 sctp_packet_log(o_pak); 11219 } 11220 #endif 11221 SCTP_PROBE5(send, NULL, NULL, ip, NULL, shout); 11222 SCTP_IP_OUTPUT(ret, o_pak, NULL, NULL, vrf_id); 11223 break; 11224 #endif 11225 #ifdef INET6 11226 case AF_INET6: 11227 ip6->ip6_plen = htons((uint16_t)(len - sizeof(struct ip6_hdr))); 11228 if (port) { 11229 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 11230 SCTP_STAT_INCR(sctps_sendswcrc); 11231 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), len - sizeof(struct ip6_hdr))) == 0) { 11232 udp->uh_sum = 0xffff; 11233 } 11234 } else { 11235 mout->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 11236 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11237 SCTP_STAT_INCR(sctps_sendhwcrc); 11238 } 11239 #ifdef SCTP_PACKET_LOGGING 11240 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11241 sctp_packet_log(o_pak); 11242 } 11243 #endif 11244 SCTP_PROBE5(send, NULL, NULL, ip6, NULL, shout); 11245 SCTP_IP6_OUTPUT(ret, o_pak, NULL, NULL, NULL, vrf_id); 11246 break; 11247 #endif 11248 default: 11249 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 11250 dst->sa_family); 11251 sctp_m_freem(mout); 11252 SCTP_LTRACE_ERR_RET_PKT(mout, NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 11253 return; 11254 } 11255 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 11256 if (port) { 11257 UDPSTAT_INC(udps_opackets); 11258 } 11259 SCTP_STAT_INCR(sctps_sendpackets); 11260 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 11261 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11262 if (ret) { 11263 SCTP_STAT_INCR(sctps_senderrors); 11264 } 11265 return; 11266 } 11267 11268 void 11269 sctp_send_shutdown_complete2(struct sockaddr *src, struct sockaddr *dst, 11270 struct sctphdr *sh, 11271 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11272 uint32_t vrf_id, uint16_t port) 11273 { 11274 sctp_send_resp_msg(src, dst, sh, 0, SCTP_SHUTDOWN_COMPLETE, NULL, 11275 mflowtype, mflowid, fibnum, 11276 vrf_id, port); 11277 } 11278 11279 void 11280 sctp_send_hb(struct sctp_tcb *stcb, struct sctp_nets *net, int so_locked) 11281 { 11282 struct sctp_tmit_chunk *chk; 11283 struct sctp_heartbeat_chunk *hb; 11284 struct timeval now; 11285 11286 SCTP_TCB_LOCK_ASSERT(stcb); 11287 if (net == NULL) { 11288 return; 11289 } 11290 (void)SCTP_GETTIME_TIMEVAL(&now); 11291 switch (net->ro._l_addr.sa.sa_family) { 11292 #ifdef INET 11293 case AF_INET: 11294 break; 11295 #endif 11296 #ifdef INET6 11297 case AF_INET6: 11298 break; 11299 #endif 11300 default: 11301 return; 11302 } 11303 sctp_alloc_a_chunk(stcb, chk); 11304 if (chk == NULL) { 11305 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak, can't get a chunk for hb\n"); 11306 return; 11307 } 11308 11309 chk->copy_by_ref = 0; 11310 chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST; 11311 chk->rec.chunk_id.can_take_data = 1; 11312 chk->flags = 0; 11313 chk->asoc = &stcb->asoc; 11314 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 11315 11316 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11317 if (chk->data == NULL) { 11318 sctp_free_a_chunk(stcb, chk, so_locked); 11319 return; 11320 } 11321 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11322 SCTP_BUF_LEN(chk->data) = chk->send_size; 11323 chk->sent = SCTP_DATAGRAM_UNSENT; 11324 chk->snd_count = 0; 11325 chk->whoTo = net; 11326 atomic_add_int(&chk->whoTo->ref_count, 1); 11327 /* Now we have a mbuf that we can fill in with the details */ 11328 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 11329 memset(hb, 0, sizeof(struct sctp_heartbeat_chunk)); 11330 /* fill out chunk header */ 11331 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 11332 hb->ch.chunk_flags = 0; 11333 hb->ch.chunk_length = htons(chk->send_size); 11334 /* Fill out hb parameter */ 11335 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 11336 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 11337 hb->heartbeat.hb_info.time_value_1 = (uint32_t)now.tv_sec; 11338 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 11339 /* Did our user request this one, put it in */ 11340 hb->heartbeat.hb_info.addr_family = (uint8_t)net->ro._l_addr.sa.sa_family; 11341 hb->heartbeat.hb_info.addr_len = net->ro._l_addr.sa.sa_len; 11342 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 11343 /* 11344 * we only take from the entropy pool if the address is not 11345 * confirmed. 11346 */ 11347 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11348 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11349 } else { 11350 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 11351 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 11352 } 11353 switch (net->ro._l_addr.sa.sa_family) { 11354 #ifdef INET 11355 case AF_INET: 11356 memcpy(hb->heartbeat.hb_info.address, 11357 &net->ro._l_addr.sin.sin_addr, 11358 sizeof(net->ro._l_addr.sin.sin_addr)); 11359 break; 11360 #endif 11361 #ifdef INET6 11362 case AF_INET6: 11363 memcpy(hb->heartbeat.hb_info.address, 11364 &net->ro._l_addr.sin6.sin6_addr, 11365 sizeof(net->ro._l_addr.sin6.sin6_addr)); 11366 break; 11367 #endif 11368 default: 11369 if (chk->data) { 11370 sctp_m_freem(chk->data); 11371 chk->data = NULL; 11372 } 11373 sctp_free_a_chunk(stcb, chk, so_locked); 11374 return; 11375 break; 11376 } 11377 net->hb_responded = 0; 11378 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11379 stcb->asoc.ctrl_queue_cnt++; 11380 SCTP_STAT_INCR(sctps_sendheartbeat); 11381 return; 11382 } 11383 11384 void 11385 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 11386 uint32_t high_tsn) 11387 { 11388 struct sctp_association *asoc; 11389 struct sctp_ecne_chunk *ecne; 11390 struct sctp_tmit_chunk *chk; 11391 11392 if (net == NULL) { 11393 return; 11394 } 11395 asoc = &stcb->asoc; 11396 SCTP_TCB_LOCK_ASSERT(stcb); 11397 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11398 if ((chk->rec.chunk_id.id == SCTP_ECN_ECHO) && (net == chk->whoTo)) { 11399 /* found a previous ECN_ECHO update it if needed */ 11400 uint32_t cnt, ctsn; 11401 11402 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11403 ctsn = ntohl(ecne->tsn); 11404 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11405 ecne->tsn = htonl(high_tsn); 11406 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11407 } 11408 cnt = ntohl(ecne->num_pkts_since_cwr); 11409 cnt++; 11410 ecne->num_pkts_since_cwr = htonl(cnt); 11411 return; 11412 } 11413 } 11414 /* nope could not find one to update so we must build one */ 11415 sctp_alloc_a_chunk(stcb, chk); 11416 if (chk == NULL) { 11417 return; 11418 } 11419 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11420 chk->copy_by_ref = 0; 11421 chk->rec.chunk_id.id = SCTP_ECN_ECHO; 11422 chk->rec.chunk_id.can_take_data = 0; 11423 chk->flags = 0; 11424 chk->asoc = &stcb->asoc; 11425 chk->send_size = sizeof(struct sctp_ecne_chunk); 11426 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11427 if (chk->data == NULL) { 11428 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11429 return; 11430 } 11431 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11432 SCTP_BUF_LEN(chk->data) = chk->send_size; 11433 chk->sent = SCTP_DATAGRAM_UNSENT; 11434 chk->snd_count = 0; 11435 chk->whoTo = net; 11436 atomic_add_int(&chk->whoTo->ref_count, 1); 11437 11438 stcb->asoc.ecn_echo_cnt_onq++; 11439 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11440 ecne->ch.chunk_type = SCTP_ECN_ECHO; 11441 ecne->ch.chunk_flags = 0; 11442 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 11443 ecne->tsn = htonl(high_tsn); 11444 ecne->num_pkts_since_cwr = htonl(1); 11445 TAILQ_INSERT_HEAD(&stcb->asoc.control_send_queue, chk, sctp_next); 11446 asoc->ctrl_queue_cnt++; 11447 } 11448 11449 void 11450 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 11451 struct mbuf *m, int len, int iphlen, int bad_crc) 11452 { 11453 struct sctp_association *asoc; 11454 struct sctp_pktdrop_chunk *drp; 11455 struct sctp_tmit_chunk *chk; 11456 uint8_t *datap; 11457 int was_trunc = 0; 11458 int fullsz = 0; 11459 long spc; 11460 int offset; 11461 struct sctp_chunkhdr *ch, chunk_buf; 11462 unsigned int chk_length; 11463 11464 if (!stcb) { 11465 return; 11466 } 11467 asoc = &stcb->asoc; 11468 SCTP_TCB_LOCK_ASSERT(stcb); 11469 if (asoc->pktdrop_supported == 0) { 11470 /*- 11471 * peer must declare support before I send one. 11472 */ 11473 return; 11474 } 11475 if (stcb->sctp_socket == NULL) { 11476 return; 11477 } 11478 sctp_alloc_a_chunk(stcb, chk); 11479 if (chk == NULL) { 11480 return; 11481 } 11482 chk->copy_by_ref = 0; 11483 chk->rec.chunk_id.id = SCTP_PACKET_DROPPED; 11484 chk->rec.chunk_id.can_take_data = 1; 11485 chk->flags = 0; 11486 len -= iphlen; 11487 chk->send_size = len; 11488 /* Validate that we do not have an ABORT in here. */ 11489 offset = iphlen + sizeof(struct sctphdr); 11490 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11491 sizeof(*ch), (uint8_t *)&chunk_buf); 11492 while (ch != NULL) { 11493 chk_length = ntohs(ch->chunk_length); 11494 if (chk_length < sizeof(*ch)) { 11495 /* break to abort land */ 11496 break; 11497 } 11498 switch (ch->chunk_type) { 11499 case SCTP_PACKET_DROPPED: 11500 case SCTP_ABORT_ASSOCIATION: 11501 case SCTP_INITIATION_ACK: 11502 /** 11503 * We don't respond with an PKT-DROP to an ABORT 11504 * or PKT-DROP. We also do not respond to an 11505 * INIT-ACK, because we can't know if the initiation 11506 * tag is correct or not. 11507 */ 11508 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11509 return; 11510 default: 11511 break; 11512 } 11513 offset += SCTP_SIZE32(chk_length); 11514 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11515 sizeof(*ch), (uint8_t *)&chunk_buf); 11516 } 11517 11518 if ((len + SCTP_MAX_OVERHEAD + sizeof(struct sctp_pktdrop_chunk)) > 11519 min(stcb->asoc.smallest_mtu, MCLBYTES)) { 11520 /* 11521 * only send 1 mtu worth, trim off the excess on the end. 11522 */ 11523 fullsz = len; 11524 len = min(stcb->asoc.smallest_mtu, MCLBYTES) - SCTP_MAX_OVERHEAD; 11525 was_trunc = 1; 11526 } 11527 chk->asoc = &stcb->asoc; 11528 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11529 if (chk->data == NULL) { 11530 jump_out: 11531 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11532 return; 11533 } 11534 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11535 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 11536 if (drp == NULL) { 11537 sctp_m_freem(chk->data); 11538 chk->data = NULL; 11539 goto jump_out; 11540 } 11541 chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 11542 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD)); 11543 chk->book_size_scale = 0; 11544 if (was_trunc) { 11545 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 11546 drp->trunc_len = htons(fullsz); 11547 /* 11548 * Len is already adjusted to size minus overhead above take 11549 * out the pkt_drop chunk itself from it. 11550 */ 11551 chk->send_size = (uint16_t)(len - sizeof(struct sctp_pktdrop_chunk)); 11552 len = chk->send_size; 11553 } else { 11554 /* no truncation needed */ 11555 drp->ch.chunk_flags = 0; 11556 drp->trunc_len = htons(0); 11557 } 11558 if (bad_crc) { 11559 drp->ch.chunk_flags |= SCTP_BADCRC; 11560 } 11561 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 11562 SCTP_BUF_LEN(chk->data) = chk->send_size; 11563 chk->sent = SCTP_DATAGRAM_UNSENT; 11564 chk->snd_count = 0; 11565 if (net) { 11566 /* we should hit here */ 11567 chk->whoTo = net; 11568 atomic_add_int(&chk->whoTo->ref_count, 1); 11569 } else { 11570 chk->whoTo = NULL; 11571 } 11572 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 11573 drp->ch.chunk_length = htons(chk->send_size); 11574 spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket); 11575 if (spc < 0) { 11576 spc = 0; 11577 } 11578 drp->bottle_bw = htonl(spc); 11579 if (asoc->my_rwnd) { 11580 drp->current_onq = htonl(asoc->size_on_reasm_queue + 11581 asoc->size_on_all_streams + 11582 asoc->my_rwnd_control_len + 11583 stcb->sctp_socket->so_rcv.sb_cc); 11584 } else { 11585 /*- 11586 * If my rwnd is 0, possibly from mbuf depletion as well as 11587 * space used, tell the peer there is NO space aka onq == bw 11588 */ 11589 drp->current_onq = htonl(spc); 11590 } 11591 drp->reserved = 0; 11592 datap = drp->data; 11593 m_copydata(m, iphlen, len, (caddr_t)datap); 11594 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11595 asoc->ctrl_queue_cnt++; 11596 } 11597 11598 void 11599 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn, uint8_t override) 11600 { 11601 struct sctp_association *asoc; 11602 struct sctp_cwr_chunk *cwr; 11603 struct sctp_tmit_chunk *chk; 11604 11605 SCTP_TCB_LOCK_ASSERT(stcb); 11606 if (net == NULL) { 11607 return; 11608 } 11609 asoc = &stcb->asoc; 11610 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11611 if ((chk->rec.chunk_id.id == SCTP_ECN_CWR) && (net == chk->whoTo)) { 11612 /* 11613 * found a previous CWR queued to same destination 11614 * update it if needed 11615 */ 11616 uint32_t ctsn; 11617 11618 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11619 ctsn = ntohl(cwr->tsn); 11620 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11621 cwr->tsn = htonl(high_tsn); 11622 } 11623 if (override & SCTP_CWR_REDUCE_OVERRIDE) { 11624 /* Make sure override is carried */ 11625 cwr->ch.chunk_flags |= SCTP_CWR_REDUCE_OVERRIDE; 11626 } 11627 return; 11628 } 11629 } 11630 sctp_alloc_a_chunk(stcb, chk); 11631 if (chk == NULL) { 11632 return; 11633 } 11634 chk->copy_by_ref = 0; 11635 chk->rec.chunk_id.id = SCTP_ECN_CWR; 11636 chk->rec.chunk_id.can_take_data = 1; 11637 chk->flags = 0; 11638 chk->asoc = &stcb->asoc; 11639 chk->send_size = sizeof(struct sctp_cwr_chunk); 11640 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11641 if (chk->data == NULL) { 11642 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11643 return; 11644 } 11645 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11646 SCTP_BUF_LEN(chk->data) = chk->send_size; 11647 chk->sent = SCTP_DATAGRAM_UNSENT; 11648 chk->snd_count = 0; 11649 chk->whoTo = net; 11650 atomic_add_int(&chk->whoTo->ref_count, 1); 11651 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11652 cwr->ch.chunk_type = SCTP_ECN_CWR; 11653 cwr->ch.chunk_flags = override; 11654 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 11655 cwr->tsn = htonl(high_tsn); 11656 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11657 asoc->ctrl_queue_cnt++; 11658 } 11659 11660 static int 11661 sctp_add_stream_reset_out(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk, 11662 uint32_t seq, uint32_t resp_seq, uint32_t last_sent) 11663 { 11664 uint16_t len, old_len, i; 11665 struct sctp_stream_reset_out_request *req_out; 11666 struct sctp_chunkhdr *ch; 11667 int at; 11668 int number_entries = 0; 11669 11670 ch = mtod(chk->data, struct sctp_chunkhdr *); 11671 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11672 /* get to new offset for the param. */ 11673 req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len); 11674 /* now how long will this param be? */ 11675 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11676 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11677 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11678 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11679 number_entries++; 11680 } 11681 } 11682 if (number_entries == 0) { 11683 return (0); 11684 } 11685 if (number_entries == stcb->asoc.streamoutcnt) { 11686 number_entries = 0; 11687 } 11688 if (number_entries > SCTP_MAX_STREAMS_AT_ONCE_RESET) { 11689 number_entries = SCTP_MAX_STREAMS_AT_ONCE_RESET; 11690 } 11691 len = (uint16_t)(sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries)); 11692 req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST); 11693 req_out->ph.param_length = htons(len); 11694 req_out->request_seq = htonl(seq); 11695 req_out->response_seq = htonl(resp_seq); 11696 req_out->send_reset_at_tsn = htonl(last_sent); 11697 at = 0; 11698 if (number_entries) { 11699 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11700 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11701 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11702 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11703 req_out->list_of_streams[at] = htons(i); 11704 at++; 11705 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11706 if (at >= number_entries) { 11707 break; 11708 } 11709 } 11710 } 11711 } else { 11712 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11713 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11714 } 11715 } 11716 if (SCTP_SIZE32(len) > len) { 11717 /*- 11718 * Need to worry about the pad we may end up adding to the 11719 * end. This is easy since the struct is either aligned to 4 11720 * bytes or 2 bytes off. 11721 */ 11722 req_out->list_of_streams[number_entries] = 0; 11723 } 11724 /* now fix the chunk length */ 11725 ch->chunk_length = htons(len + old_len); 11726 chk->book_size = len + old_len; 11727 chk->book_size_scale = 0; 11728 chk->send_size = SCTP_SIZE32(chk->book_size); 11729 SCTP_BUF_LEN(chk->data) = chk->send_size; 11730 return (1); 11731 } 11732 11733 static void 11734 sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk, 11735 int number_entries, uint16_t *list, 11736 uint32_t seq) 11737 { 11738 uint16_t len, old_len, i; 11739 struct sctp_stream_reset_in_request *req_in; 11740 struct sctp_chunkhdr *ch; 11741 11742 ch = mtod(chk->data, struct sctp_chunkhdr *); 11743 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11744 11745 /* get to new offset for the param. */ 11746 req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len); 11747 /* now how long will this param be? */ 11748 len = (uint16_t)(sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries)); 11749 req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST); 11750 req_in->ph.param_length = htons(len); 11751 req_in->request_seq = htonl(seq); 11752 if (number_entries) { 11753 for (i = 0; i < number_entries; i++) { 11754 req_in->list_of_streams[i] = htons(list[i]); 11755 } 11756 } 11757 if (SCTP_SIZE32(len) > len) { 11758 /*- 11759 * Need to worry about the pad we may end up adding to the 11760 * end. This is easy since the struct is either aligned to 4 11761 * bytes or 2 bytes off. 11762 */ 11763 req_in->list_of_streams[number_entries] = 0; 11764 } 11765 /* now fix the chunk length */ 11766 ch->chunk_length = htons(len + old_len); 11767 chk->book_size = len + old_len; 11768 chk->book_size_scale = 0; 11769 chk->send_size = SCTP_SIZE32(chk->book_size); 11770 SCTP_BUF_LEN(chk->data) = chk->send_size; 11771 return; 11772 } 11773 11774 static void 11775 sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk, 11776 uint32_t seq) 11777 { 11778 uint16_t len, old_len; 11779 struct sctp_stream_reset_tsn_request *req_tsn; 11780 struct sctp_chunkhdr *ch; 11781 11782 ch = mtod(chk->data, struct sctp_chunkhdr *); 11783 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11784 11785 /* get to new offset for the param. */ 11786 req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len); 11787 /* now how long will this param be? */ 11788 len = sizeof(struct sctp_stream_reset_tsn_request); 11789 req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST); 11790 req_tsn->ph.param_length = htons(len); 11791 req_tsn->request_seq = htonl(seq); 11792 11793 /* now fix the chunk length */ 11794 ch->chunk_length = htons(len + old_len); 11795 chk->send_size = len + old_len; 11796 chk->book_size = SCTP_SIZE32(chk->send_size); 11797 chk->book_size_scale = 0; 11798 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11799 return; 11800 } 11801 11802 void 11803 sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk, 11804 uint32_t resp_seq, uint32_t result) 11805 { 11806 uint16_t len, old_len; 11807 struct sctp_stream_reset_response *resp; 11808 struct sctp_chunkhdr *ch; 11809 11810 ch = mtod(chk->data, struct sctp_chunkhdr *); 11811 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11812 11813 /* get to new offset for the param. */ 11814 resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len); 11815 /* now how long will this param be? */ 11816 len = sizeof(struct sctp_stream_reset_response); 11817 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11818 resp->ph.param_length = htons(len); 11819 resp->response_seq = htonl(resp_seq); 11820 resp->result = ntohl(result); 11821 11822 /* now fix the chunk length */ 11823 ch->chunk_length = htons(len + old_len); 11824 chk->book_size = len + old_len; 11825 chk->book_size_scale = 0; 11826 chk->send_size = SCTP_SIZE32(chk->book_size); 11827 SCTP_BUF_LEN(chk->data) = chk->send_size; 11828 return; 11829 } 11830 11831 void 11832 sctp_send_deferred_reset_response(struct sctp_tcb *stcb, 11833 struct sctp_stream_reset_list *ent, 11834 int response) 11835 { 11836 struct sctp_association *asoc; 11837 struct sctp_tmit_chunk *chk; 11838 struct sctp_chunkhdr *ch; 11839 11840 asoc = &stcb->asoc; 11841 11842 /* 11843 * Reset our last reset action to the new one IP -> response 11844 * (PERFORMED probably). This assures that if we fail to send, a 11845 * retran from the peer will get the new response. 11846 */ 11847 asoc->last_reset_action[0] = response; 11848 if (asoc->stream_reset_outstanding) { 11849 return; 11850 } 11851 sctp_alloc_a_chunk(stcb, chk); 11852 if (chk == NULL) { 11853 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11854 return; 11855 } 11856 chk->copy_by_ref = 0; 11857 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 11858 chk->rec.chunk_id.can_take_data = 0; 11859 chk->flags = 0; 11860 chk->asoc = &stcb->asoc; 11861 chk->book_size = sizeof(struct sctp_chunkhdr); 11862 chk->send_size = SCTP_SIZE32(chk->book_size); 11863 chk->book_size_scale = 0; 11864 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11865 if (chk->data == NULL) { 11866 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 11867 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11868 return; 11869 } 11870 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11871 /* setup chunk parameters */ 11872 chk->sent = SCTP_DATAGRAM_UNSENT; 11873 chk->snd_count = 0; 11874 if (stcb->asoc.alternate) { 11875 chk->whoTo = stcb->asoc.alternate; 11876 } else { 11877 chk->whoTo = stcb->asoc.primary_destination; 11878 } 11879 ch = mtod(chk->data, struct sctp_chunkhdr *); 11880 ch->chunk_type = SCTP_STREAM_RESET; 11881 ch->chunk_flags = 0; 11882 ch->chunk_length = htons(chk->book_size); 11883 atomic_add_int(&chk->whoTo->ref_count, 1); 11884 SCTP_BUF_LEN(chk->data) = chk->send_size; 11885 sctp_add_stream_reset_result(chk, ent->seq, response); 11886 /* insert the chunk for sending */ 11887 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 11888 chk, 11889 sctp_next); 11890 asoc->ctrl_queue_cnt++; 11891 } 11892 11893 void 11894 sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk, 11895 uint32_t resp_seq, uint32_t result, 11896 uint32_t send_una, uint32_t recv_next) 11897 { 11898 uint16_t len, old_len; 11899 struct sctp_stream_reset_response_tsn *resp; 11900 struct sctp_chunkhdr *ch; 11901 11902 ch = mtod(chk->data, struct sctp_chunkhdr *); 11903 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11904 11905 /* get to new offset for the param. */ 11906 resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len); 11907 /* now how long will this param be? */ 11908 len = sizeof(struct sctp_stream_reset_response_tsn); 11909 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11910 resp->ph.param_length = htons(len); 11911 resp->response_seq = htonl(resp_seq); 11912 resp->result = htonl(result); 11913 resp->senders_next_tsn = htonl(send_una); 11914 resp->receivers_next_tsn = htonl(recv_next); 11915 11916 /* now fix the chunk length */ 11917 ch->chunk_length = htons(len + old_len); 11918 chk->book_size = len + old_len; 11919 chk->send_size = SCTP_SIZE32(chk->book_size); 11920 chk->book_size_scale = 0; 11921 SCTP_BUF_LEN(chk->data) = chk->send_size; 11922 return; 11923 } 11924 11925 static void 11926 sctp_add_an_out_stream(struct sctp_tmit_chunk *chk, 11927 uint32_t seq, 11928 uint16_t adding) 11929 { 11930 uint16_t len, old_len; 11931 struct sctp_chunkhdr *ch; 11932 struct sctp_stream_reset_add_strm *addstr; 11933 11934 ch = mtod(chk->data, struct sctp_chunkhdr *); 11935 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11936 11937 /* get to new offset for the param. */ 11938 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11939 /* now how long will this param be? */ 11940 len = sizeof(struct sctp_stream_reset_add_strm); 11941 11942 /* Fill it out. */ 11943 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_OUT_STREAMS); 11944 addstr->ph.param_length = htons(len); 11945 addstr->request_seq = htonl(seq); 11946 addstr->number_of_streams = htons(adding); 11947 addstr->reserved = 0; 11948 11949 /* now fix the chunk length */ 11950 ch->chunk_length = htons(len + old_len); 11951 chk->send_size = len + old_len; 11952 chk->book_size = SCTP_SIZE32(chk->send_size); 11953 chk->book_size_scale = 0; 11954 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11955 return; 11956 } 11957 11958 static void 11959 sctp_add_an_in_stream(struct sctp_tmit_chunk *chk, 11960 uint32_t seq, 11961 uint16_t adding) 11962 { 11963 uint16_t len, old_len; 11964 struct sctp_chunkhdr *ch; 11965 struct sctp_stream_reset_add_strm *addstr; 11966 11967 ch = mtod(chk->data, struct sctp_chunkhdr *); 11968 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11969 11970 /* get to new offset for the param. */ 11971 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11972 /* now how long will this param be? */ 11973 len = sizeof(struct sctp_stream_reset_add_strm); 11974 /* Fill it out. */ 11975 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_IN_STREAMS); 11976 addstr->ph.param_length = htons(len); 11977 addstr->request_seq = htonl(seq); 11978 addstr->number_of_streams = htons(adding); 11979 addstr->reserved = 0; 11980 11981 /* now fix the chunk length */ 11982 ch->chunk_length = htons(len + old_len); 11983 chk->send_size = len + old_len; 11984 chk->book_size = SCTP_SIZE32(chk->send_size); 11985 chk->book_size_scale = 0; 11986 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11987 return; 11988 } 11989 11990 int 11991 sctp_send_stream_reset_out_if_possible(struct sctp_tcb *stcb, int so_locked) 11992 { 11993 struct sctp_association *asoc; 11994 struct sctp_tmit_chunk *chk; 11995 struct sctp_chunkhdr *ch; 11996 uint32_t seq; 11997 11998 asoc = &stcb->asoc; 11999 asoc->trigger_reset = 0; 12000 if (asoc->stream_reset_outstanding) { 12001 return (EALREADY); 12002 } 12003 sctp_alloc_a_chunk(stcb, chk); 12004 if (chk == NULL) { 12005 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12006 return (ENOMEM); 12007 } 12008 chk->copy_by_ref = 0; 12009 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12010 chk->rec.chunk_id.can_take_data = 0; 12011 chk->flags = 0; 12012 chk->asoc = &stcb->asoc; 12013 chk->book_size = sizeof(struct sctp_chunkhdr); 12014 chk->send_size = SCTP_SIZE32(chk->book_size); 12015 chk->book_size_scale = 0; 12016 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12017 if (chk->data == NULL) { 12018 sctp_free_a_chunk(stcb, chk, so_locked); 12019 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12020 return (ENOMEM); 12021 } 12022 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12023 12024 /* setup chunk parameters */ 12025 chk->sent = SCTP_DATAGRAM_UNSENT; 12026 chk->snd_count = 0; 12027 if (stcb->asoc.alternate) { 12028 chk->whoTo = stcb->asoc.alternate; 12029 } else { 12030 chk->whoTo = stcb->asoc.primary_destination; 12031 } 12032 ch = mtod(chk->data, struct sctp_chunkhdr *); 12033 ch->chunk_type = SCTP_STREAM_RESET; 12034 ch->chunk_flags = 0; 12035 ch->chunk_length = htons(chk->book_size); 12036 atomic_add_int(&chk->whoTo->ref_count, 1); 12037 SCTP_BUF_LEN(chk->data) = chk->send_size; 12038 seq = stcb->asoc.str_reset_seq_out; 12039 if (sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1))) { 12040 seq++; 12041 asoc->stream_reset_outstanding++; 12042 } else { 12043 m_freem(chk->data); 12044 chk->data = NULL; 12045 sctp_free_a_chunk(stcb, chk, so_locked); 12046 return (ENOENT); 12047 } 12048 asoc->str_reset = chk; 12049 /* insert the chunk for sending */ 12050 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12051 chk, 12052 sctp_next); 12053 asoc->ctrl_queue_cnt++; 12054 12055 if (stcb->asoc.send_sack) { 12056 sctp_send_sack(stcb, so_locked); 12057 } 12058 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12059 return (0); 12060 } 12061 12062 int 12063 sctp_send_str_reset_req(struct sctp_tcb *stcb, 12064 uint16_t number_entries, uint16_t *list, 12065 uint8_t send_in_req, 12066 uint8_t send_tsn_req, 12067 uint8_t add_stream, 12068 uint16_t adding_o, 12069 uint16_t adding_i, uint8_t peer_asked) 12070 { 12071 struct sctp_association *asoc; 12072 struct sctp_tmit_chunk *chk; 12073 struct sctp_chunkhdr *ch; 12074 int can_send_out_req = 0; 12075 uint32_t seq; 12076 12077 asoc = &stcb->asoc; 12078 if (asoc->stream_reset_outstanding) { 12079 /*- 12080 * Already one pending, must get ACK back to clear the flag. 12081 */ 12082 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EBUSY); 12083 return (EBUSY); 12084 } 12085 if ((send_in_req == 0) && (send_tsn_req == 0) && 12086 (add_stream == 0)) { 12087 /* nothing to do */ 12088 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12089 return (EINVAL); 12090 } 12091 if (send_tsn_req && send_in_req) { 12092 /* error, can't do that */ 12093 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12094 return (EINVAL); 12095 } else if (send_in_req) { 12096 can_send_out_req = 1; 12097 } 12098 if (number_entries > (MCLBYTES - 12099 SCTP_MIN_OVERHEAD - 12100 sizeof(struct sctp_chunkhdr) - 12101 sizeof(struct sctp_stream_reset_out_request)) / 12102 sizeof(uint16_t)) { 12103 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12104 return (ENOMEM); 12105 } 12106 sctp_alloc_a_chunk(stcb, chk); 12107 if (chk == NULL) { 12108 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12109 return (ENOMEM); 12110 } 12111 chk->copy_by_ref = 0; 12112 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12113 chk->rec.chunk_id.can_take_data = 0; 12114 chk->flags = 0; 12115 chk->asoc = &stcb->asoc; 12116 chk->book_size = sizeof(struct sctp_chunkhdr); 12117 chk->send_size = SCTP_SIZE32(chk->book_size); 12118 chk->book_size_scale = 0; 12119 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12120 if (chk->data == NULL) { 12121 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 12122 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12123 return (ENOMEM); 12124 } 12125 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12126 12127 /* setup chunk parameters */ 12128 chk->sent = SCTP_DATAGRAM_UNSENT; 12129 chk->snd_count = 0; 12130 if (stcb->asoc.alternate) { 12131 chk->whoTo = stcb->asoc.alternate; 12132 } else { 12133 chk->whoTo = stcb->asoc.primary_destination; 12134 } 12135 atomic_add_int(&chk->whoTo->ref_count, 1); 12136 ch = mtod(chk->data, struct sctp_chunkhdr *); 12137 ch->chunk_type = SCTP_STREAM_RESET; 12138 ch->chunk_flags = 0; 12139 ch->chunk_length = htons(chk->book_size); 12140 SCTP_BUF_LEN(chk->data) = chk->send_size; 12141 12142 seq = stcb->asoc.str_reset_seq_out; 12143 if (can_send_out_req) { 12144 int ret; 12145 12146 ret = sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1)); 12147 if (ret) { 12148 seq++; 12149 asoc->stream_reset_outstanding++; 12150 } 12151 } 12152 if ((add_stream & 1) && 12153 ((stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt) < adding_o)) { 12154 /* Need to allocate more */ 12155 struct sctp_stream_out *oldstream; 12156 struct sctp_stream_queue_pending *sp, *nsp; 12157 int i; 12158 #if defined(SCTP_DETAILED_STR_STATS) 12159 int j; 12160 #endif 12161 12162 oldstream = stcb->asoc.strmout; 12163 /* get some more */ 12164 SCTP_MALLOC(stcb->asoc.strmout, struct sctp_stream_out *, 12165 (stcb->asoc.streamoutcnt + adding_o) * sizeof(struct sctp_stream_out), 12166 SCTP_M_STRMO); 12167 if (stcb->asoc.strmout == NULL) { 12168 uint8_t x; 12169 12170 stcb->asoc.strmout = oldstream; 12171 /* Turn off the bit */ 12172 x = add_stream & 0xfe; 12173 add_stream = x; 12174 goto skip_stuff; 12175 } 12176 /* 12177 * Ok now we proceed with copying the old out stuff and 12178 * initializing the new stuff. 12179 */ 12180 SCTP_TCB_SEND_LOCK(stcb); 12181 stcb->asoc.ss_functions.sctp_ss_clear(stcb, &stcb->asoc, false); 12182 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 12183 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12184 /* FIX ME FIX ME */ 12185 /* 12186 * This should be a SS_COPY operation FIX ME STREAM 12187 * SCHEDULER EXPERT 12188 */ 12189 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], &oldstream[i]); 12190 stcb->asoc.strmout[i].chunks_on_queues = oldstream[i].chunks_on_queues; 12191 #if defined(SCTP_DETAILED_STR_STATS) 12192 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 12193 stcb->asoc.strmout[i].abandoned_sent[j] = oldstream[i].abandoned_sent[j]; 12194 stcb->asoc.strmout[i].abandoned_unsent[j] = oldstream[i].abandoned_unsent[j]; 12195 } 12196 #else 12197 stcb->asoc.strmout[i].abandoned_sent[0] = oldstream[i].abandoned_sent[0]; 12198 stcb->asoc.strmout[i].abandoned_unsent[0] = oldstream[i].abandoned_unsent[0]; 12199 #endif 12200 stcb->asoc.strmout[i].next_mid_ordered = oldstream[i].next_mid_ordered; 12201 stcb->asoc.strmout[i].next_mid_unordered = oldstream[i].next_mid_unordered; 12202 stcb->asoc.strmout[i].last_msg_incomplete = oldstream[i].last_msg_incomplete; 12203 stcb->asoc.strmout[i].sid = i; 12204 stcb->asoc.strmout[i].state = oldstream[i].state; 12205 /* now anything on those queues? */ 12206 TAILQ_FOREACH_SAFE(sp, &oldstream[i].outqueue, next, nsp) { 12207 TAILQ_REMOVE(&oldstream[i].outqueue, sp, next); 12208 TAILQ_INSERT_TAIL(&stcb->asoc.strmout[i].outqueue, sp, next); 12209 } 12210 } 12211 /* now the new streams */ 12212 stcb->asoc.ss_functions.sctp_ss_init(stcb, &stcb->asoc); 12213 for (i = stcb->asoc.streamoutcnt; i < (stcb->asoc.streamoutcnt + adding_o); i++) { 12214 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12215 stcb->asoc.strmout[i].chunks_on_queues = 0; 12216 #if defined(SCTP_DETAILED_STR_STATS) 12217 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 12218 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 12219 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 12220 } 12221 #else 12222 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 12223 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 12224 #endif 12225 stcb->asoc.strmout[i].next_mid_ordered = 0; 12226 stcb->asoc.strmout[i].next_mid_unordered = 0; 12227 stcb->asoc.strmout[i].sid = i; 12228 stcb->asoc.strmout[i].last_msg_incomplete = 0; 12229 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 12230 stcb->asoc.strmout[i].state = SCTP_STREAM_CLOSED; 12231 } 12232 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt + adding_o; 12233 SCTP_FREE(oldstream, SCTP_M_STRMO); 12234 SCTP_TCB_SEND_UNLOCK(stcb); 12235 } 12236 skip_stuff: 12237 if ((add_stream & 1) && (adding_o > 0)) { 12238 asoc->strm_pending_add_size = adding_o; 12239 asoc->peer_req_out = peer_asked; 12240 sctp_add_an_out_stream(chk, seq, adding_o); 12241 seq++; 12242 asoc->stream_reset_outstanding++; 12243 } 12244 if ((add_stream & 2) && (adding_i > 0)) { 12245 sctp_add_an_in_stream(chk, seq, adding_i); 12246 seq++; 12247 asoc->stream_reset_outstanding++; 12248 } 12249 if (send_in_req) { 12250 sctp_add_stream_reset_in(chk, number_entries, list, seq); 12251 seq++; 12252 asoc->stream_reset_outstanding++; 12253 } 12254 if (send_tsn_req) { 12255 sctp_add_stream_reset_tsn(chk, seq); 12256 asoc->stream_reset_outstanding++; 12257 } 12258 asoc->str_reset = chk; 12259 /* insert the chunk for sending */ 12260 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12261 chk, 12262 sctp_next); 12263 asoc->ctrl_queue_cnt++; 12264 if (stcb->asoc.send_sack) { 12265 sctp_send_sack(stcb, SCTP_SO_LOCKED); 12266 } 12267 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12268 return (0); 12269 } 12270 12271 void 12272 sctp_send_abort(struct mbuf *m, int iphlen, struct sockaddr *src, struct sockaddr *dst, 12273 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12274 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12275 uint32_t vrf_id, uint16_t port) 12276 { 12277 /* Don't respond to an ABORT with an ABORT. */ 12278 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 12279 if (cause) 12280 sctp_m_freem(cause); 12281 return; 12282 } 12283 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_ABORT_ASSOCIATION, cause, 12284 mflowtype, mflowid, fibnum, 12285 vrf_id, port); 12286 return; 12287 } 12288 12289 void 12290 sctp_send_operr_to(struct sockaddr *src, struct sockaddr *dst, 12291 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12292 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12293 uint32_t vrf_id, uint16_t port) 12294 { 12295 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_OPERATION_ERROR, cause, 12296 mflowtype, mflowid, fibnum, 12297 vrf_id, port); 12298 return; 12299 } 12300 12301 static struct mbuf * 12302 sctp_copy_resume(struct uio *uio, 12303 int max_send_len, 12304 int user_marks_eor, 12305 int *error, 12306 uint32_t *sndout, 12307 struct mbuf **new_tail) 12308 { 12309 struct mbuf *m; 12310 12311 m = m_uiotombuf(uio, M_WAITOK, max_send_len, 0, 12312 (M_PKTHDR | (user_marks_eor ? M_EOR : 0))); 12313 if (m == NULL) { 12314 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12315 *error = ENOBUFS; 12316 } else { 12317 *sndout = m_length(m, NULL); 12318 *new_tail = m_last(m); 12319 } 12320 return (m); 12321 } 12322 12323 static int 12324 sctp_copy_one(struct sctp_stream_queue_pending *sp, 12325 struct uio *uio, 12326 int resv_upfront) 12327 { 12328 sp->data = m_uiotombuf(uio, M_WAITOK, sp->length, 12329 resv_upfront, 0); 12330 if (sp->data == NULL) { 12331 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12332 return (ENOBUFS); 12333 } 12334 12335 sp->tail_mbuf = m_last(sp->data); 12336 return (0); 12337 } 12338 12339 static struct sctp_stream_queue_pending * 12340 sctp_copy_it_in(struct sctp_tcb *stcb, 12341 struct sctp_association *asoc, 12342 struct sctp_sndrcvinfo *srcv, 12343 struct uio *uio, 12344 struct sctp_nets *net, 12345 ssize_t max_send_len, 12346 int user_marks_eor, 12347 int *error) 12348 { 12349 12350 /*- 12351 * This routine must be very careful in its work. Protocol 12352 * processing is up and running so care must be taken to spl...() 12353 * when you need to do something that may effect the stcb/asoc. The 12354 * sb is locked however. When data is copied the protocol processing 12355 * should be enabled since this is a slower operation... 12356 */ 12357 struct sctp_stream_queue_pending *sp = NULL; 12358 int resv_in_first; 12359 12360 *error = 0; 12361 /* Now can we send this? */ 12362 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 12363 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12364 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12365 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12366 /* got data while shutting down */ 12367 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12368 *error = ECONNRESET; 12369 goto out_now; 12370 } 12371 sctp_alloc_a_strmoq(stcb, sp); 12372 if (sp == NULL) { 12373 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12374 *error = ENOMEM; 12375 goto out_now; 12376 } 12377 sp->act_flags = 0; 12378 sp->sender_all_done = 0; 12379 sp->sinfo_flags = srcv->sinfo_flags; 12380 sp->timetolive = srcv->sinfo_timetolive; 12381 sp->ppid = srcv->sinfo_ppid; 12382 sp->context = srcv->sinfo_context; 12383 sp->fsn = 0; 12384 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 12385 12386 sp->sid = srcv->sinfo_stream; 12387 sp->length = (uint32_t)min(uio->uio_resid, max_send_len); 12388 if ((sp->length == (uint32_t)uio->uio_resid) && 12389 ((user_marks_eor == 0) || 12390 (srcv->sinfo_flags & SCTP_EOF) || 12391 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 12392 sp->msg_is_complete = 1; 12393 } else { 12394 sp->msg_is_complete = 0; 12395 } 12396 sp->sender_all_done = 0; 12397 sp->some_taken = 0; 12398 sp->put_last_out = 0; 12399 resv_in_first = SCTP_DATA_CHUNK_OVERHEAD(stcb); 12400 sp->data = sp->tail_mbuf = NULL; 12401 if (sp->length == 0) { 12402 goto skip_copy; 12403 } 12404 if (srcv->sinfo_keynumber_valid) { 12405 sp->auth_keyid = srcv->sinfo_keynumber; 12406 } else { 12407 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 12408 } 12409 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 12410 sctp_auth_key_acquire(stcb, sp->auth_keyid); 12411 sp->holds_key_ref = 1; 12412 } 12413 *error = sctp_copy_one(sp, uio, resv_in_first); 12414 skip_copy: 12415 if (*error) { 12416 sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); 12417 sp = NULL; 12418 } else { 12419 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 12420 sp->net = net; 12421 atomic_add_int(&sp->net->ref_count, 1); 12422 } else { 12423 sp->net = NULL; 12424 } 12425 sctp_set_prsctp_policy(sp); 12426 } 12427 out_now: 12428 return (sp); 12429 } 12430 12431 int 12432 sctp_sosend(struct socket *so, 12433 struct sockaddr *addr, 12434 struct uio *uio, 12435 struct mbuf *top, 12436 struct mbuf *control, 12437 int flags, 12438 struct thread *p 12439 ) 12440 { 12441 int error, use_sndinfo = 0; 12442 struct sctp_sndrcvinfo sndrcvninfo; 12443 struct sockaddr *addr_to_use; 12444 #if defined(INET) && defined(INET6) 12445 struct sockaddr_in sin; 12446 #endif 12447 12448 if (control) { 12449 /* process cmsg snd/rcv info (maybe a assoc-id) */ 12450 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&sndrcvninfo, control, 12451 sizeof(sndrcvninfo))) { 12452 /* got one */ 12453 use_sndinfo = 1; 12454 } 12455 } 12456 addr_to_use = addr; 12457 #if defined(INET) && defined(INET6) 12458 if ((addr != NULL) && (addr->sa_family == AF_INET6)) { 12459 struct sockaddr_in6 *sin6; 12460 12461 if (addr->sa_len != sizeof(struct sockaddr_in6)) { 12462 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12463 return (EINVAL); 12464 } 12465 sin6 = (struct sockaddr_in6 *)addr; 12466 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 12467 in6_sin6_2_sin(&sin, sin6); 12468 addr_to_use = (struct sockaddr *)&sin; 12469 } 12470 } 12471 #endif 12472 error = sctp_lower_sosend(so, addr_to_use, uio, top, 12473 control, 12474 flags, 12475 use_sndinfo ? &sndrcvninfo : NULL 12476 ,p 12477 ); 12478 return (error); 12479 } 12480 12481 int 12482 sctp_lower_sosend(struct socket *so, 12483 struct sockaddr *addr, 12484 struct uio *uio, 12485 struct mbuf *i_pak, 12486 struct mbuf *control, 12487 int flags, 12488 struct sctp_sndrcvinfo *srcv 12489 , 12490 struct thread *p 12491 ) 12492 { 12493 struct epoch_tracker et; 12494 ssize_t sndlen = 0, max_len, local_add_more; 12495 int error; 12496 struct mbuf *top = NULL; 12497 int queue_only = 0, queue_only_for_init = 0; 12498 int free_cnt_applied = 0; 12499 int un_sent; 12500 int now_filled = 0; 12501 unsigned int inqueue_bytes = 0; 12502 struct sctp_block_entry be; 12503 struct sctp_inpcb *inp; 12504 struct sctp_tcb *stcb = NULL; 12505 struct timeval now; 12506 struct sctp_nets *net; 12507 struct sctp_association *asoc; 12508 struct sctp_inpcb *t_inp; 12509 int user_marks_eor; 12510 int create_lock_applied = 0; 12511 int nagle_applies = 0; 12512 int some_on_control = 0; 12513 int got_all_of_the_send = 0; 12514 int hold_tcblock = 0; 12515 int non_blocking = 0; 12516 ssize_t local_soresv = 0; 12517 uint16_t port; 12518 uint16_t sinfo_flags; 12519 sctp_assoc_t sinfo_assoc_id; 12520 12521 error = 0; 12522 net = NULL; 12523 stcb = NULL; 12524 asoc = NULL; 12525 12526 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 12527 if (inp == NULL) { 12528 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12529 error = EINVAL; 12530 if (i_pak) { 12531 SCTP_RELEASE_PKT(i_pak); 12532 } 12533 return (error); 12534 } 12535 if ((uio == NULL) && (i_pak == NULL)) { 12536 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12537 return (EINVAL); 12538 } 12539 user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 12540 atomic_add_int(&inp->total_sends, 1); 12541 if (uio) { 12542 if (uio->uio_resid < 0) { 12543 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12544 return (EINVAL); 12545 } 12546 sndlen = uio->uio_resid; 12547 } else { 12548 top = SCTP_HEADER_TO_CHAIN(i_pak); 12549 sndlen = SCTP_HEADER_LEN(i_pak); 12550 } 12551 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %zd\n", 12552 (void *)addr, 12553 sndlen); 12554 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 12555 SCTP_IS_LISTENING(inp)) { 12556 /* The listener can NOT send */ 12557 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12558 error = ENOTCONN; 12559 goto out_unlocked; 12560 } 12561 /** 12562 * Pre-screen address, if one is given the sin-len 12563 * must be set correctly! 12564 */ 12565 if (addr) { 12566 union sctp_sockstore *raddr = (union sctp_sockstore *)addr; 12567 12568 switch (raddr->sa.sa_family) { 12569 #ifdef INET 12570 case AF_INET: 12571 if (raddr->sin.sin_len != sizeof(struct sockaddr_in)) { 12572 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12573 error = EINVAL; 12574 goto out_unlocked; 12575 } 12576 port = raddr->sin.sin_port; 12577 break; 12578 #endif 12579 #ifdef INET6 12580 case AF_INET6: 12581 if (raddr->sin6.sin6_len != sizeof(struct sockaddr_in6)) { 12582 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12583 error = EINVAL; 12584 goto out_unlocked; 12585 } 12586 port = raddr->sin6.sin6_port; 12587 break; 12588 #endif 12589 default: 12590 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAFNOSUPPORT); 12591 error = EAFNOSUPPORT; 12592 goto out_unlocked; 12593 } 12594 } else 12595 port = 0; 12596 12597 if (srcv) { 12598 sinfo_flags = srcv->sinfo_flags; 12599 sinfo_assoc_id = srcv->sinfo_assoc_id; 12600 if (INVALID_SINFO_FLAG(sinfo_flags) || 12601 PR_SCTP_INVALID_POLICY(sinfo_flags)) { 12602 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12603 error = EINVAL; 12604 goto out_unlocked; 12605 } 12606 if (srcv->sinfo_flags) 12607 SCTP_STAT_INCR(sctps_sends_with_flags); 12608 } else { 12609 sinfo_flags = inp->def_send.sinfo_flags; 12610 sinfo_assoc_id = inp->def_send.sinfo_assoc_id; 12611 } 12612 if (flags & MSG_EOR) { 12613 sinfo_flags |= SCTP_EOR; 12614 } 12615 if (flags & MSG_EOF) { 12616 sinfo_flags |= SCTP_EOF; 12617 } 12618 if (sinfo_flags & SCTP_SENDALL) { 12619 /* its a sendall */ 12620 error = sctp_sendall(inp, uio, top, srcv); 12621 top = NULL; 12622 goto out_unlocked; 12623 } 12624 if ((sinfo_flags & SCTP_ADDR_OVER) && (addr == NULL)) { 12625 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12626 error = EINVAL; 12627 goto out_unlocked; 12628 } 12629 /* now we must find the assoc */ 12630 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) || 12631 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 12632 SCTP_INP_RLOCK(inp); 12633 stcb = LIST_FIRST(&inp->sctp_asoc_list); 12634 if (stcb) { 12635 SCTP_TCB_LOCK(stcb); 12636 hold_tcblock = 1; 12637 } 12638 SCTP_INP_RUNLOCK(inp); 12639 } else if (sinfo_assoc_id) { 12640 stcb = sctp_findassociation_ep_asocid(inp, sinfo_assoc_id, 1); 12641 if (stcb != NULL) { 12642 hold_tcblock = 1; 12643 } 12644 } else if (addr) { 12645 /*- 12646 * Since we did not use findep we must 12647 * increment it, and if we don't find a tcb 12648 * decrement it. 12649 */ 12650 SCTP_INP_WLOCK(inp); 12651 SCTP_INP_INCR_REF(inp); 12652 SCTP_INP_WUNLOCK(inp); 12653 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12654 if (stcb == NULL) { 12655 SCTP_INP_WLOCK(inp); 12656 SCTP_INP_DECR_REF(inp); 12657 SCTP_INP_WUNLOCK(inp); 12658 } else { 12659 hold_tcblock = 1; 12660 } 12661 } 12662 if ((stcb == NULL) && (addr)) { 12663 /* Possible implicit send? */ 12664 SCTP_ASOC_CREATE_LOCK(inp); 12665 create_lock_applied = 1; 12666 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 12667 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 12668 /* Should I really unlock ? */ 12669 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12670 error = EINVAL; 12671 goto out_unlocked; 12672 } 12673 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 12674 (addr->sa_family == AF_INET6)) { 12675 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12676 error = EINVAL; 12677 goto out_unlocked; 12678 } 12679 SCTP_INP_WLOCK(inp); 12680 SCTP_INP_INCR_REF(inp); 12681 SCTP_INP_WUNLOCK(inp); 12682 /* With the lock applied look again */ 12683 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12684 #if defined(INET) || defined(INET6) 12685 if ((stcb == NULL) && (control != NULL) && (port > 0)) { 12686 stcb = sctp_findassociation_cmsgs(&t_inp, port, control, &net, &error); 12687 } 12688 #endif 12689 if (stcb == NULL) { 12690 SCTP_INP_WLOCK(inp); 12691 SCTP_INP_DECR_REF(inp); 12692 SCTP_INP_WUNLOCK(inp); 12693 } else { 12694 hold_tcblock = 1; 12695 } 12696 if (error) { 12697 goto out_unlocked; 12698 } 12699 if (t_inp != inp) { 12700 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12701 error = ENOTCONN; 12702 goto out_unlocked; 12703 } 12704 } 12705 if (stcb == NULL) { 12706 if (addr == NULL) { 12707 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12708 error = ENOENT; 12709 goto out_unlocked; 12710 } else { 12711 /* We must go ahead and start the INIT process */ 12712 uint32_t vrf_id; 12713 12714 if ((sinfo_flags & SCTP_ABORT) || 12715 ((sinfo_flags & SCTP_EOF) && (sndlen == 0))) { 12716 /*- 12717 * User asks to abort a non-existent assoc, 12718 * or EOF a non-existent assoc with no data 12719 */ 12720 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12721 error = ENOENT; 12722 goto out_unlocked; 12723 } 12724 /* get an asoc/stcb struct */ 12725 vrf_id = inp->def_vrf_id; 12726 #ifdef INVARIANTS 12727 if (create_lock_applied == 0) { 12728 panic("Error, should hold create lock and I don't?"); 12729 } 12730 #endif 12731 stcb = sctp_aloc_assoc_connected(inp, addr, &error, 0, 0, vrf_id, 12732 inp->sctp_ep.pre_open_stream_count, 12733 inp->sctp_ep.port, 12734 p, 12735 SCTP_INITIALIZE_AUTH_PARAMS); 12736 if (stcb == NULL) { 12737 /* Error is setup for us in the call */ 12738 goto out_unlocked; 12739 } 12740 hold_tcblock = 1; 12741 if (create_lock_applied) { 12742 SCTP_ASOC_CREATE_UNLOCK(inp); 12743 create_lock_applied = 0; 12744 } else { 12745 SCTP_PRINTF("Huh-3? create lock should have been on??\n"); 12746 } 12747 /* 12748 * Turn on queue only flag to prevent data from 12749 * being sent 12750 */ 12751 queue_only = 1; 12752 asoc = &stcb->asoc; 12753 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 12754 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 12755 12756 if (control) { 12757 if (sctp_process_cmsgs_for_init(stcb, control, &error)) { 12758 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 12759 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_6); 12760 hold_tcblock = 0; 12761 stcb = NULL; 12762 goto out_unlocked; 12763 } 12764 } 12765 /* out with the INIT */ 12766 queue_only_for_init = 1; 12767 /*- 12768 * we may want to dig in after this call and adjust the MTU 12769 * value. It defaulted to 1500 (constant) but the ro 12770 * structure may now have an update and thus we may need to 12771 * change it BEFORE we append the message. 12772 */ 12773 } 12774 } else 12775 asoc = &stcb->asoc; 12776 if (srcv == NULL) { 12777 srcv = (struct sctp_sndrcvinfo *)&asoc->def_send; 12778 sinfo_flags = srcv->sinfo_flags; 12779 if (flags & MSG_EOR) { 12780 sinfo_flags |= SCTP_EOR; 12781 } 12782 if (flags & MSG_EOF) { 12783 sinfo_flags |= SCTP_EOF; 12784 } 12785 } 12786 if (sinfo_flags & SCTP_ADDR_OVER) { 12787 if (addr) 12788 net = sctp_findnet(stcb, addr); 12789 else 12790 net = NULL; 12791 if ((net == NULL) || 12792 ((port != 0) && (port != stcb->rport))) { 12793 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12794 error = EINVAL; 12795 goto out_unlocked; 12796 } 12797 } else { 12798 if (stcb->asoc.alternate) { 12799 net = stcb->asoc.alternate; 12800 } else { 12801 net = stcb->asoc.primary_destination; 12802 } 12803 } 12804 atomic_add_int(&stcb->total_sends, 1); 12805 /* Keep the stcb from being freed under our feet */ 12806 atomic_add_int(&asoc->refcnt, 1); 12807 free_cnt_applied = 1; 12808 12809 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NO_FRAGMENT)) { 12810 if (sndlen > (ssize_t)asoc->smallest_mtu) { 12811 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12812 error = EMSGSIZE; 12813 goto out_unlocked; 12814 } 12815 } 12816 if (SCTP_SO_IS_NBIO(so) 12817 || (flags & (MSG_NBIO | MSG_DONTWAIT)) != 0 12818 ) { 12819 non_blocking = 1; 12820 } 12821 /* would we block? */ 12822 if (non_blocking) { 12823 ssize_t amount; 12824 12825 if (hold_tcblock == 0) { 12826 SCTP_TCB_LOCK(stcb); 12827 hold_tcblock = 1; 12828 } 12829 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 12830 if (user_marks_eor == 0) { 12831 amount = sndlen; 12832 } else { 12833 amount = 1; 12834 } 12835 if ((SCTP_SB_LIMIT_SND(so) < (amount + inqueue_bytes + stcb->asoc.sb_send_resv)) || 12836 (stcb->asoc.chunks_on_out_queue >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12837 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EWOULDBLOCK); 12838 if (sndlen > (ssize_t)SCTP_SB_LIMIT_SND(so)) 12839 error = EMSGSIZE; 12840 else 12841 error = EWOULDBLOCK; 12842 goto out_unlocked; 12843 } 12844 stcb->asoc.sb_send_resv += (uint32_t)sndlen; 12845 SCTP_TCB_UNLOCK(stcb); 12846 hold_tcblock = 0; 12847 } else { 12848 atomic_add_int(&stcb->asoc.sb_send_resv, (int)sndlen); 12849 } 12850 local_soresv = sndlen; 12851 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12852 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12853 error = ECONNRESET; 12854 goto out_unlocked; 12855 } 12856 if (create_lock_applied) { 12857 SCTP_ASOC_CREATE_UNLOCK(inp); 12858 create_lock_applied = 0; 12859 } 12860 /* Is the stream no. valid? */ 12861 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 12862 /* Invalid stream number */ 12863 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12864 error = EINVAL; 12865 goto out_unlocked; 12866 } 12867 if ((asoc->strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPEN) && 12868 (asoc->strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPENING)) { 12869 /* 12870 * Can't queue any data while stream reset is underway. 12871 */ 12872 if (asoc->strmout[srcv->sinfo_stream].state > SCTP_STREAM_OPEN) { 12873 error = EAGAIN; 12874 } else { 12875 error = EINVAL; 12876 } 12877 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, error); 12878 goto out_unlocked; 12879 } 12880 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 12881 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 12882 queue_only = 1; 12883 } 12884 /* we are now done with all control */ 12885 if (control) { 12886 sctp_m_freem(control); 12887 control = NULL; 12888 } 12889 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 12890 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12891 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12892 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12893 if (sinfo_flags & SCTP_ABORT) { 12894 ; 12895 } else { 12896 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12897 error = ECONNRESET; 12898 goto out_unlocked; 12899 } 12900 } 12901 /* Ok, we will attempt a msgsnd :> */ 12902 if (p) { 12903 p->td_ru.ru_msgsnd++; 12904 } 12905 /* Are we aborting? */ 12906 if (sinfo_flags & SCTP_ABORT) { 12907 struct mbuf *mm; 12908 ssize_t tot_demand, tot_out = 0, max_out; 12909 12910 SCTP_STAT_INCR(sctps_sends_with_abort); 12911 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 12912 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 12913 /* It has to be up before we abort */ 12914 /* how big is the user initiated abort? */ 12915 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12916 error = EINVAL; 12917 goto out; 12918 } 12919 if (hold_tcblock) { 12920 SCTP_TCB_UNLOCK(stcb); 12921 hold_tcblock = 0; 12922 } 12923 if (top) { 12924 struct mbuf *cntm = NULL; 12925 12926 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_WAITOK, 1, MT_DATA); 12927 if (sndlen != 0) { 12928 for (cntm = top; cntm; cntm = SCTP_BUF_NEXT(cntm)) { 12929 tot_out += SCTP_BUF_LEN(cntm); 12930 } 12931 } 12932 } else { 12933 /* Must fit in a MTU */ 12934 tot_out = sndlen; 12935 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 12936 if (tot_demand > SCTP_DEFAULT_ADD_MORE) { 12937 /* To big */ 12938 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12939 error = EMSGSIZE; 12940 goto out; 12941 } 12942 mm = sctp_get_mbuf_for_msg((unsigned int)tot_demand, 0, M_WAITOK, 1, MT_DATA); 12943 } 12944 if (mm == NULL) { 12945 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12946 error = ENOMEM; 12947 goto out; 12948 } 12949 max_out = asoc->smallest_mtu - sizeof(struct sctp_paramhdr); 12950 max_out -= sizeof(struct sctp_abort_msg); 12951 if (tot_out > max_out) { 12952 tot_out = max_out; 12953 } 12954 if (mm) { 12955 struct sctp_paramhdr *ph; 12956 12957 /* now move forward the data pointer */ 12958 ph = mtod(mm, struct sctp_paramhdr *); 12959 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 12960 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + tot_out)); 12961 ph++; 12962 SCTP_BUF_LEN(mm) = (int)(tot_out + sizeof(struct sctp_paramhdr)); 12963 if (top == NULL) { 12964 error = uiomove((caddr_t)ph, (int)tot_out, uio); 12965 if (error) { 12966 /*- 12967 * Here if we can't get his data we 12968 * still abort we just don't get to 12969 * send the users note :-0 12970 */ 12971 sctp_m_freem(mm); 12972 mm = NULL; 12973 } 12974 } else { 12975 if (sndlen != 0) { 12976 SCTP_BUF_NEXT(mm) = top; 12977 } 12978 } 12979 } 12980 if (hold_tcblock == 0) { 12981 SCTP_TCB_LOCK(stcb); 12982 } 12983 atomic_subtract_int(&stcb->asoc.refcnt, 1); 12984 free_cnt_applied = 0; 12985 /* release this lock, otherwise we hang on ourselves */ 12986 NET_EPOCH_ENTER(et); 12987 sctp_abort_an_association(stcb->sctp_ep, stcb, mm, false, SCTP_SO_LOCKED); 12988 NET_EPOCH_EXIT(et); 12989 /* now relock the stcb so everything is sane */ 12990 hold_tcblock = 0; 12991 stcb = NULL; 12992 /* 12993 * In this case top is already chained to mm avoid double 12994 * free, since we free it below if top != NULL and driver 12995 * would free it after sending the packet out 12996 */ 12997 if (sndlen != 0) { 12998 top = NULL; 12999 } 13000 goto out_unlocked; 13001 } 13002 /* Calculate the maximum we can send */ 13003 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13004 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13005 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13006 } else { 13007 max_len = 0; 13008 } 13009 if (hold_tcblock) { 13010 SCTP_TCB_UNLOCK(stcb); 13011 hold_tcblock = 0; 13012 } 13013 if (asoc->strmout == NULL) { 13014 /* huh? software error */ 13015 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 13016 error = EFAULT; 13017 goto out_unlocked; 13018 } 13019 13020 /* Unless E_EOR mode is on, we must make a send FIT in one call. */ 13021 if ((user_marks_eor == 0) && 13022 (sndlen > (ssize_t)SCTP_SB_LIMIT_SND(stcb->sctp_socket))) { 13023 /* It will NEVER fit */ 13024 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 13025 error = EMSGSIZE; 13026 goto out_unlocked; 13027 } 13028 if ((uio == NULL) && user_marks_eor) { 13029 /*- 13030 * We do not support eeor mode for 13031 * sending with mbuf chains (like sendfile). 13032 */ 13033 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13034 error = EINVAL; 13035 goto out_unlocked; 13036 } 13037 13038 if (user_marks_eor) { 13039 local_add_more = (ssize_t)min(SCTP_SB_LIMIT_SND(so), SCTP_BASE_SYSCTL(sctp_add_more_threshold)); 13040 } else { 13041 /*- 13042 * For non-eeor the whole message must fit in 13043 * the socket send buffer. 13044 */ 13045 local_add_more = sndlen; 13046 } 13047 if (non_blocking) { 13048 goto skip_preblock; 13049 } 13050 if (((max_len <= local_add_more) && 13051 ((ssize_t)SCTP_SB_LIMIT_SND(so) >= local_add_more)) || 13052 (max_len == 0) || 13053 ((stcb->asoc.chunks_on_out_queue + stcb->asoc.stream_queue_cnt) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13054 /* No room right now ! */ 13055 SOCKBUF_LOCK(&so->so_snd); 13056 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13057 while ((SCTP_SB_LIMIT_SND(so) < (inqueue_bytes + local_add_more)) || 13058 ((stcb->asoc.stream_queue_cnt + stcb->asoc.chunks_on_out_queue) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13059 SCTPDBG(SCTP_DEBUG_OUTPUT1, "pre_block limit:%u <(inq:%d + %zd) || (%d+%d > %d)\n", 13060 (unsigned int)SCTP_SB_LIMIT_SND(so), 13061 inqueue_bytes, 13062 local_add_more, 13063 stcb->asoc.stream_queue_cnt, 13064 stcb->asoc.chunks_on_out_queue, 13065 SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)); 13066 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13067 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA, asoc, sndlen); 13068 } 13069 be.error = 0; 13070 stcb->block_entry = &be; 13071 error = sbwait(&so->so_snd); 13072 stcb->block_entry = NULL; 13073 if (error || so->so_error || be.error) { 13074 if (error == 0) { 13075 if (so->so_error) 13076 error = so->so_error; 13077 if (be.error) { 13078 error = be.error; 13079 } 13080 } 13081 SOCKBUF_UNLOCK(&so->so_snd); 13082 goto out_unlocked; 13083 } 13084 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13085 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13086 asoc, stcb->asoc.total_output_queue_size); 13087 } 13088 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13089 SOCKBUF_UNLOCK(&so->so_snd); 13090 goto out_unlocked; 13091 } 13092 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13093 } 13094 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13095 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13096 } else { 13097 max_len = 0; 13098 } 13099 SOCKBUF_UNLOCK(&so->so_snd); 13100 } 13101 13102 skip_preblock: 13103 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13104 goto out_unlocked; 13105 } 13106 /* 13107 * sndlen covers for mbuf case uio_resid covers for the non-mbuf 13108 * case NOTE: uio will be null when top/mbuf is passed 13109 */ 13110 if (sndlen == 0) { 13111 if (sinfo_flags & SCTP_EOF) { 13112 got_all_of_the_send = 1; 13113 goto dataless_eof; 13114 } else { 13115 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13116 error = EINVAL; 13117 goto out; 13118 } 13119 } 13120 if (top == NULL) { 13121 struct sctp_stream_queue_pending *sp; 13122 struct sctp_stream_out *strm; 13123 uint32_t sndout; 13124 13125 SCTP_TCB_SEND_LOCK(stcb); 13126 if ((asoc->stream_locked) && 13127 (asoc->stream_locked_on != srcv->sinfo_stream)) { 13128 SCTP_TCB_SEND_UNLOCK(stcb); 13129 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13130 error = EINVAL; 13131 goto out; 13132 } 13133 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 13134 if (strm->last_msg_incomplete == 0) { 13135 do_a_copy_in: 13136 SCTP_TCB_SEND_UNLOCK(stcb); 13137 sp = sctp_copy_it_in(stcb, asoc, srcv, uio, net, max_len, user_marks_eor, &error); 13138 if (error) { 13139 goto out; 13140 } 13141 SCTP_TCB_SEND_LOCK(stcb); 13142 /* The out streams might be reallocated. */ 13143 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 13144 if (sp->msg_is_complete) { 13145 strm->last_msg_incomplete = 0; 13146 asoc->stream_locked = 0; 13147 } else { 13148 /* 13149 * Just got locked to this guy in case of an 13150 * interrupt. 13151 */ 13152 strm->last_msg_incomplete = 1; 13153 if (stcb->asoc.idata_supported == 0) { 13154 asoc->stream_locked = 1; 13155 asoc->stream_locked_on = srcv->sinfo_stream; 13156 } 13157 sp->sender_all_done = 0; 13158 } 13159 sctp_snd_sb_alloc(stcb, sp->length); 13160 atomic_add_int(&asoc->stream_queue_cnt, 1); 13161 if (sinfo_flags & SCTP_UNORDERED) { 13162 SCTP_STAT_INCR(sctps_sends_with_unord); 13163 } 13164 sp->processing = 1; 13165 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 13166 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, asoc, strm, sp); 13167 } else { 13168 sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead); 13169 if (sp == NULL) { 13170 /* ???? Huh ??? last msg is gone */ 13171 #ifdef INVARIANTS 13172 panic("Warning: Last msg marked incomplete, yet nothing left?"); 13173 #else 13174 SCTP_PRINTF("Warning: Last msg marked incomplete, yet nothing left?\n"); 13175 strm->last_msg_incomplete = 0; 13176 #endif 13177 goto do_a_copy_in; 13178 } 13179 if (sp->processing) { 13180 SCTP_TCB_SEND_UNLOCK(stcb); 13181 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13182 error = EINVAL; 13183 goto out; 13184 } else { 13185 sp->processing = 1; 13186 } 13187 } 13188 SCTP_TCB_SEND_UNLOCK(stcb); 13189 while (uio->uio_resid > 0) { 13190 /* How much room do we have? */ 13191 struct mbuf *new_tail, *mm; 13192 13193 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13194 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) 13195 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13196 else 13197 max_len = 0; 13198 13199 if ((max_len > (ssize_t)SCTP_BASE_SYSCTL(sctp_add_more_threshold)) || 13200 (max_len && (SCTP_SB_LIMIT_SND(so) < SCTP_BASE_SYSCTL(sctp_add_more_threshold))) || 13201 (uio->uio_resid && (uio->uio_resid <= max_len))) { 13202 sndout = 0; 13203 new_tail = NULL; 13204 if (hold_tcblock) { 13205 SCTP_TCB_UNLOCK(stcb); 13206 hold_tcblock = 0; 13207 } 13208 mm = sctp_copy_resume(uio, (int)max_len, user_marks_eor, &error, &sndout, &new_tail); 13209 if ((mm == NULL) || error) { 13210 if (mm) { 13211 sctp_m_freem(mm); 13212 } 13213 SCTP_TCB_SEND_LOCK(stcb); 13214 if (((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0) && 13215 ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) == 0) && 13216 (sp != NULL)) { 13217 sp->processing = 0; 13218 } 13219 SCTP_TCB_SEND_UNLOCK(stcb); 13220 goto out; 13221 } 13222 /* Update the mbuf and count */ 13223 SCTP_TCB_SEND_LOCK(stcb); 13224 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13225 (stcb->asoc.state & SCTP_STATE_WAS_ABORTED)) { 13226 /* 13227 * we need to get out. Peer probably 13228 * aborted. 13229 */ 13230 sctp_m_freem(mm); 13231 if (stcb->asoc.state & SCTP_STATE_WAS_ABORTED) { 13232 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 13233 error = ECONNRESET; 13234 } 13235 SCTP_TCB_SEND_UNLOCK(stcb); 13236 goto out; 13237 } 13238 if (sp->tail_mbuf) { 13239 /* tack it to the end */ 13240 SCTP_BUF_NEXT(sp->tail_mbuf) = mm; 13241 sp->tail_mbuf = new_tail; 13242 } else { 13243 /* A stolen mbuf */ 13244 sp->data = mm; 13245 sp->tail_mbuf = new_tail; 13246 } 13247 sctp_snd_sb_alloc(stcb, sndout); 13248 atomic_add_int(&sp->length, sndout); 13249 if (sinfo_flags & SCTP_SACK_IMMEDIATELY) { 13250 sp->sinfo_flags |= SCTP_SACK_IMMEDIATELY; 13251 } 13252 13253 /* Did we reach EOR? */ 13254 if ((uio->uio_resid == 0) && 13255 ((user_marks_eor == 0) || 13256 (sinfo_flags & SCTP_EOF) || 13257 (user_marks_eor && (sinfo_flags & SCTP_EOR)))) { 13258 sp->msg_is_complete = 1; 13259 } else { 13260 sp->msg_is_complete = 0; 13261 } 13262 SCTP_TCB_SEND_UNLOCK(stcb); 13263 } 13264 if (uio->uio_resid == 0) { 13265 /* got it all? */ 13266 continue; 13267 } 13268 /* PR-SCTP? */ 13269 if ((asoc->prsctp_supported) && (asoc->sent_queue_cnt_removeable > 0)) { 13270 /* 13271 * This is ugly but we must assure locking 13272 * order 13273 */ 13274 if (hold_tcblock == 0) { 13275 SCTP_TCB_LOCK(stcb); 13276 hold_tcblock = 1; 13277 } 13278 sctp_prune_prsctp(stcb, asoc, srcv, (int)sndlen); 13279 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13280 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) 13281 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13282 else 13283 max_len = 0; 13284 if (max_len > 0) { 13285 continue; 13286 } 13287 SCTP_TCB_UNLOCK(stcb); 13288 hold_tcblock = 0; 13289 } 13290 /* wait for space now */ 13291 if (non_blocking) { 13292 /* Non-blocking io in place out */ 13293 SCTP_TCB_SEND_LOCK(stcb); 13294 if (sp != NULL) { 13295 sp->processing = 0; 13296 } 13297 SCTP_TCB_SEND_UNLOCK(stcb); 13298 goto skip_out_eof; 13299 } 13300 /* What about the INIT, send it maybe */ 13301 if (queue_only_for_init) { 13302 if (hold_tcblock == 0) { 13303 SCTP_TCB_LOCK(stcb); 13304 hold_tcblock = 1; 13305 } 13306 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13307 /* a collision took us forward? */ 13308 queue_only = 0; 13309 } else { 13310 NET_EPOCH_ENTER(et); 13311 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13312 NET_EPOCH_EXIT(et); 13313 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 13314 queue_only = 1; 13315 } 13316 } 13317 if ((net->flight_size > net->cwnd) && 13318 (asoc->sctp_cmt_on_off == 0)) { 13319 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13320 queue_only = 1; 13321 } else if (asoc->ifp_had_enobuf) { 13322 SCTP_STAT_INCR(sctps_ifnomemqueued); 13323 if (net->flight_size > (2 * net->mtu)) { 13324 queue_only = 1; 13325 } 13326 asoc->ifp_had_enobuf = 0; 13327 } 13328 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 13329 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13330 (stcb->asoc.total_flight > 0) && 13331 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13332 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13333 /*- 13334 * Ok, Nagle is set on and we have data outstanding. 13335 * Don't send anything and let SACKs drive out the 13336 * data unless we have a "full" segment to send. 13337 */ 13338 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13339 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13340 } 13341 SCTP_STAT_INCR(sctps_naglequeued); 13342 nagle_applies = 1; 13343 } else { 13344 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13345 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13346 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13347 } 13348 SCTP_STAT_INCR(sctps_naglesent); 13349 nagle_applies = 0; 13350 } 13351 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13352 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13353 nagle_applies, un_sent); 13354 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13355 stcb->asoc.total_flight, 13356 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13357 } 13358 if (queue_only_for_init) 13359 queue_only_for_init = 0; 13360 if ((queue_only == 0) && (nagle_applies == 0)) { 13361 /*- 13362 * need to start chunk output 13363 * before blocking.. note that if 13364 * a lock is already applied, then 13365 * the input via the net is happening 13366 * and I don't need to start output :-D 13367 */ 13368 NET_EPOCH_ENTER(et); 13369 if (hold_tcblock == 0) { 13370 if (SCTP_TCB_TRYLOCK(stcb)) { 13371 hold_tcblock = 1; 13372 sctp_chunk_output(inp, 13373 stcb, 13374 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13375 } 13376 } else { 13377 sctp_chunk_output(inp, 13378 stcb, 13379 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13380 } 13381 NET_EPOCH_EXIT(et); 13382 } 13383 if (hold_tcblock == 1) { 13384 SCTP_TCB_UNLOCK(stcb); 13385 hold_tcblock = 0; 13386 } 13387 SOCKBUF_LOCK(&so->so_snd); 13388 /*- 13389 * This is a bit strange, but I think it will 13390 * work. The total_output_queue_size is locked and 13391 * protected by the TCB_LOCK, which we just released. 13392 * There is a race that can occur between releasing it 13393 * above, and me getting the socket lock, where sacks 13394 * come in but we have not put the SB_WAIT on the 13395 * so_snd buffer to get the wakeup. After the LOCK 13396 * is applied the sack_processing will also need to 13397 * LOCK the so->so_snd to do the actual sowwakeup(). So 13398 * once we have the socket buffer lock if we recheck the 13399 * size we KNOW we will get to sleep safely with the 13400 * wakeup flag in place. 13401 */ 13402 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13403 if (SCTP_SB_LIMIT_SND(so) <= (inqueue_bytes + 13404 min(SCTP_BASE_SYSCTL(sctp_add_more_threshold), SCTP_SB_LIMIT_SND(so)))) { 13405 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13406 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 13407 asoc, uio->uio_resid); 13408 } 13409 be.error = 0; 13410 stcb->block_entry = &be; 13411 error = sbwait(&so->so_snd); 13412 stcb->block_entry = NULL; 13413 13414 if (error || so->so_error || be.error) { 13415 if (error == 0) { 13416 if (so->so_error) 13417 error = so->so_error; 13418 if (be.error) { 13419 error = be.error; 13420 } 13421 } 13422 SOCKBUF_UNLOCK(&so->so_snd); 13423 SCTP_TCB_SEND_LOCK(stcb); 13424 if (((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0) && 13425 ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) == 0) && 13426 (sp != NULL)) { 13427 sp->processing = 0; 13428 } 13429 SCTP_TCB_SEND_UNLOCK(stcb); 13430 goto out_unlocked; 13431 } 13432 13433 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13434 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13435 asoc, stcb->asoc.total_output_queue_size); 13436 } 13437 } 13438 SOCKBUF_UNLOCK(&so->so_snd); 13439 SCTP_TCB_SEND_LOCK(stcb); 13440 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13441 (stcb->asoc.state & SCTP_STATE_WAS_ABORTED)) { 13442 SCTP_TCB_SEND_UNLOCK(stcb); 13443 goto out_unlocked; 13444 } 13445 SCTP_TCB_SEND_UNLOCK(stcb); 13446 } 13447 SCTP_TCB_SEND_LOCK(stcb); 13448 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13449 (stcb->asoc.state & SCTP_STATE_WAS_ABORTED)) { 13450 SCTP_TCB_SEND_UNLOCK(stcb); 13451 goto out_unlocked; 13452 } 13453 if (sp) { 13454 if (sp->msg_is_complete == 0) { 13455 strm->last_msg_incomplete = 1; 13456 if (stcb->asoc.idata_supported == 0) { 13457 asoc->stream_locked = 1; 13458 asoc->stream_locked_on = srcv->sinfo_stream; 13459 } 13460 } else { 13461 sp->sender_all_done = 1; 13462 strm->last_msg_incomplete = 0; 13463 asoc->stream_locked = 0; 13464 } 13465 sp->processing = 0; 13466 } else { 13467 SCTP_PRINTF("Huh no sp TSNH?\n"); 13468 strm->last_msg_incomplete = 0; 13469 asoc->stream_locked = 0; 13470 } 13471 SCTP_TCB_SEND_UNLOCK(stcb); 13472 if (uio->uio_resid == 0) { 13473 got_all_of_the_send = 1; 13474 } 13475 } else { 13476 /* We send in a 0, since we do NOT have any locks */ 13477 error = sctp_msg_append(stcb, net, top, srcv, 0); 13478 top = NULL; 13479 if (sinfo_flags & SCTP_EOF) { 13480 got_all_of_the_send = 1; 13481 } 13482 } 13483 if (error) { 13484 goto out; 13485 } 13486 dataless_eof: 13487 /* EOF thing ? */ 13488 if ((sinfo_flags & SCTP_EOF) && 13489 (got_all_of_the_send == 1)) { 13490 SCTP_STAT_INCR(sctps_sends_with_eof); 13491 error = 0; 13492 if (hold_tcblock == 0) { 13493 SCTP_TCB_LOCK(stcb); 13494 hold_tcblock = 1; 13495 } 13496 if (TAILQ_EMPTY(&asoc->send_queue) && 13497 TAILQ_EMPTY(&asoc->sent_queue) && 13498 sctp_is_there_unsent_data(stcb, SCTP_SO_LOCKED) == 0) { 13499 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13500 goto abort_anyway; 13501 } 13502 /* there is nothing queued to send, so I'm done... */ 13503 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 13504 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13505 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13506 struct sctp_nets *netp; 13507 13508 /* only send SHUTDOWN the first time through */ 13509 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13510 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 13511 } 13512 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT); 13513 sctp_stop_timers_for_shutdown(stcb); 13514 if (stcb->asoc.alternate) { 13515 netp = stcb->asoc.alternate; 13516 } else { 13517 netp = stcb->asoc.primary_destination; 13518 } 13519 sctp_send_shutdown(stcb, netp); 13520 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 13521 netp); 13522 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13523 NULL); 13524 } 13525 } else { 13526 /*- 13527 * we still got (or just got) data to send, so set 13528 * SHUTDOWN_PENDING 13529 */ 13530 /*- 13531 * XXX sockets draft says that SCTP_EOF should be 13532 * sent with no data. currently, we will allow user 13533 * data to be sent first and move to 13534 * SHUTDOWN-PENDING 13535 */ 13536 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 13537 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13538 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13539 if (hold_tcblock == 0) { 13540 SCTP_TCB_LOCK(stcb); 13541 hold_tcblock = 1; 13542 } 13543 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13544 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT); 13545 } 13546 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 13547 if (TAILQ_EMPTY(&asoc->send_queue) && 13548 TAILQ_EMPTY(&asoc->sent_queue) && 13549 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 13550 struct mbuf *op_err; 13551 char msg[SCTP_DIAG_INFO_LEN]; 13552 13553 abort_anyway: 13554 if (free_cnt_applied) { 13555 atomic_subtract_int(&stcb->asoc.refcnt, 1); 13556 free_cnt_applied = 0; 13557 } 13558 SCTP_SNPRINTF(msg, sizeof(msg), 13559 "%s:%d at %s", __FILE__, __LINE__, __func__); 13560 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 13561 msg); 13562 NET_EPOCH_ENTER(et); 13563 sctp_abort_an_association(stcb->sctp_ep, stcb, 13564 op_err, false, SCTP_SO_LOCKED); 13565 NET_EPOCH_EXIT(et); 13566 /* 13567 * now relock the stcb so everything 13568 * is sane 13569 */ 13570 hold_tcblock = 0; 13571 stcb = NULL; 13572 goto out; 13573 } 13574 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13575 NULL); 13576 sctp_feature_off(inp, SCTP_PCB_FLAGS_NODELAY); 13577 } 13578 } 13579 } 13580 skip_out_eof: 13581 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 13582 some_on_control = 1; 13583 } 13584 if (queue_only_for_init) { 13585 if (hold_tcblock == 0) { 13586 SCTP_TCB_LOCK(stcb); 13587 hold_tcblock = 1; 13588 } 13589 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13590 /* a collision took us forward? */ 13591 queue_only = 0; 13592 } else { 13593 NET_EPOCH_ENTER(et); 13594 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13595 NET_EPOCH_EXIT(et); 13596 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 13597 queue_only = 1; 13598 } 13599 } 13600 if ((net->flight_size > net->cwnd) && 13601 (stcb->asoc.sctp_cmt_on_off == 0)) { 13602 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13603 queue_only = 1; 13604 } else if (asoc->ifp_had_enobuf) { 13605 SCTP_STAT_INCR(sctps_ifnomemqueued); 13606 if (net->flight_size > (2 * net->mtu)) { 13607 queue_only = 1; 13608 } 13609 asoc->ifp_had_enobuf = 0; 13610 } 13611 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 13612 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13613 (stcb->asoc.total_flight > 0) && 13614 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13615 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13616 /*- 13617 * Ok, Nagle is set on and we have data outstanding. 13618 * Don't send anything and let SACKs drive out the 13619 * data unless wen have a "full" segment to send. 13620 */ 13621 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13622 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13623 } 13624 SCTP_STAT_INCR(sctps_naglequeued); 13625 nagle_applies = 1; 13626 } else { 13627 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13628 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13629 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13630 } 13631 SCTP_STAT_INCR(sctps_naglesent); 13632 nagle_applies = 0; 13633 } 13634 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13635 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13636 nagle_applies, un_sent); 13637 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13638 stcb->asoc.total_flight, 13639 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13640 } 13641 NET_EPOCH_ENTER(et); 13642 if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) { 13643 /* we can attempt to send too. */ 13644 if (hold_tcblock == 0) { 13645 /* 13646 * If there is activity recv'ing sacks no need to 13647 * send 13648 */ 13649 if (SCTP_TCB_TRYLOCK(stcb)) { 13650 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13651 hold_tcblock = 1; 13652 } 13653 } else { 13654 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13655 } 13656 } else if ((queue_only == 0) && 13657 (stcb->asoc.peers_rwnd == 0) && 13658 (stcb->asoc.total_flight == 0)) { 13659 /* We get to have a probe outstanding */ 13660 if (hold_tcblock == 0) { 13661 hold_tcblock = 1; 13662 SCTP_TCB_LOCK(stcb); 13663 } 13664 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13665 } else if (some_on_control) { 13666 int num_out, reason, frag_point; 13667 13668 /* Here we do control only */ 13669 if (hold_tcblock == 0) { 13670 hold_tcblock = 1; 13671 SCTP_TCB_LOCK(stcb); 13672 } 13673 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 13674 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 13675 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_LOCKED); 13676 } 13677 NET_EPOCH_EXIT(et); 13678 SCTPDBG(SCTP_DEBUG_OUTPUT1, "USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d err:%d\n", 13679 queue_only, stcb->asoc.peers_rwnd, un_sent, 13680 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue, 13681 stcb->asoc.total_output_queue_size, error); 13682 13683 out: 13684 out_unlocked: 13685 13686 if (local_soresv && stcb) { 13687 atomic_subtract_int(&stcb->asoc.sb_send_resv, (int)sndlen); 13688 } 13689 if (create_lock_applied) { 13690 SCTP_ASOC_CREATE_UNLOCK(inp); 13691 } 13692 if ((stcb) && hold_tcblock) { 13693 SCTP_TCB_UNLOCK(stcb); 13694 } 13695 if (stcb && free_cnt_applied) { 13696 atomic_subtract_int(&stcb->asoc.refcnt, 1); 13697 } 13698 #ifdef INVARIANTS 13699 if (stcb) { 13700 if (mtx_owned(&stcb->tcb_mtx)) { 13701 panic("Leaving with tcb mtx owned?"); 13702 } 13703 if (mtx_owned(&stcb->tcb_send_mtx)) { 13704 panic("Leaving with tcb send mtx owned?"); 13705 } 13706 } 13707 #endif 13708 if (top) { 13709 sctp_m_freem(top); 13710 } 13711 if (control) { 13712 sctp_m_freem(control); 13713 } 13714 return (error); 13715 } 13716 13717 /* 13718 * generate an AUTHentication chunk, if required 13719 */ 13720 struct mbuf * 13721 sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end, 13722 struct sctp_auth_chunk **auth_ret, uint32_t *offset, 13723 struct sctp_tcb *stcb, uint8_t chunk) 13724 { 13725 struct mbuf *m_auth; 13726 struct sctp_auth_chunk *auth; 13727 int chunk_len; 13728 struct mbuf *cn; 13729 13730 if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) || 13731 (stcb == NULL)) 13732 return (m); 13733 13734 if (stcb->asoc.auth_supported == 0) { 13735 return (m); 13736 } 13737 /* does the requested chunk require auth? */ 13738 if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) { 13739 return (m); 13740 } 13741 m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_NOWAIT, 1, MT_HEADER); 13742 if (m_auth == NULL) { 13743 /* no mbuf's */ 13744 return (m); 13745 } 13746 /* reserve some space if this will be the first mbuf */ 13747 if (m == NULL) 13748 SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD); 13749 /* fill in the AUTH chunk details */ 13750 auth = mtod(m_auth, struct sctp_auth_chunk *); 13751 memset(auth, 0, sizeof(*auth)); 13752 auth->ch.chunk_type = SCTP_AUTHENTICATION; 13753 auth->ch.chunk_flags = 0; 13754 chunk_len = sizeof(*auth) + 13755 sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id); 13756 auth->ch.chunk_length = htons(chunk_len); 13757 auth->hmac_id = htons(stcb->asoc.peer_hmac_id); 13758 /* key id and hmac digest will be computed and filled in upon send */ 13759 13760 /* save the offset where the auth was inserted into the chain */ 13761 *offset = 0; 13762 for (cn = m; cn; cn = SCTP_BUF_NEXT(cn)) { 13763 *offset += SCTP_BUF_LEN(cn); 13764 } 13765 13766 /* update length and return pointer to the auth chunk */ 13767 SCTP_BUF_LEN(m_auth) = chunk_len; 13768 m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0); 13769 if (auth_ret != NULL) 13770 *auth_ret = auth; 13771 13772 return (m); 13773 } 13774 13775 #ifdef INET6 13776 int 13777 sctp_v6src_match_nexthop(struct sockaddr_in6 *src6, sctp_route_t *ro) 13778 { 13779 struct nd_prefix *pfx = NULL; 13780 struct nd_pfxrouter *pfxrtr = NULL; 13781 struct sockaddr_in6 gw6; 13782 13783 if (ro == NULL || ro->ro_nh == NULL || src6->sin6_family != AF_INET6) 13784 return (0); 13785 13786 /* get prefix entry of address */ 13787 ND6_RLOCK(); 13788 LIST_FOREACH(pfx, &MODULE_GLOBAL(nd_prefix), ndpr_entry) { 13789 if (pfx->ndpr_stateflags & NDPRF_DETACHED) 13790 continue; 13791 if (IN6_ARE_MASKED_ADDR_EQUAL(&pfx->ndpr_prefix.sin6_addr, 13792 &src6->sin6_addr, &pfx->ndpr_mask)) 13793 break; 13794 } 13795 /* no prefix entry in the prefix list */ 13796 if (pfx == NULL) { 13797 ND6_RUNLOCK(); 13798 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefix entry for "); 13799 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13800 return (0); 13801 } 13802 13803 SCTPDBG(SCTP_DEBUG_OUTPUT2, "v6src_match_nexthop(), Prefix entry is "); 13804 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13805 13806 /* search installed gateway from prefix entry */ 13807 LIST_FOREACH(pfxrtr, &pfx->ndpr_advrtrs, pfr_entry) { 13808 memset(&gw6, 0, sizeof(struct sockaddr_in6)); 13809 gw6.sin6_family = AF_INET6; 13810 gw6.sin6_len = sizeof(struct sockaddr_in6); 13811 memcpy(&gw6.sin6_addr, &pfxrtr->router->rtaddr, 13812 sizeof(struct in6_addr)); 13813 SCTPDBG(SCTP_DEBUG_OUTPUT2, "prefix router is "); 13814 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&gw6); 13815 SCTPDBG(SCTP_DEBUG_OUTPUT2, "installed router is "); 13816 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ro->ro_nh->gw_sa); 13817 if (sctp_cmpaddr((struct sockaddr *)&gw6, &ro->ro_nh->gw_sa)) { 13818 ND6_RUNLOCK(); 13819 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is installed\n"); 13820 return (1); 13821 } 13822 } 13823 ND6_RUNLOCK(); 13824 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is not installed\n"); 13825 return (0); 13826 } 13827 #endif 13828 13829 int 13830 sctp_v4src_match_nexthop(struct sctp_ifa *sifa, sctp_route_t *ro) 13831 { 13832 #ifdef INET 13833 struct sockaddr_in *sin, *mask; 13834 struct ifaddr *ifa; 13835 struct in_addr srcnetaddr, gwnetaddr; 13836 13837 if (ro == NULL || ro->ro_nh == NULL || 13838 sifa->address.sa.sa_family != AF_INET) { 13839 return (0); 13840 } 13841 ifa = (struct ifaddr *)sifa->ifa; 13842 mask = (struct sockaddr_in *)(ifa->ifa_netmask); 13843 sin = &sifa->address.sin; 13844 srcnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13845 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: src address is "); 13846 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 13847 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", srcnetaddr.s_addr); 13848 13849 sin = &ro->ro_nh->gw4_sa; 13850 gwnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13851 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: nexthop is "); 13852 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ro->ro_nh->gw_sa); 13853 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", gwnetaddr.s_addr); 13854 if (srcnetaddr.s_addr == gwnetaddr.s_addr) { 13855 return (1); 13856 } 13857 #endif 13858 return (0); 13859 } 13860