1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 5 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 6 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions are met: 10 * 11 * a) Redistributions of source code must retain the above copyright notice, 12 * this list of conditions and the following disclaimer. 13 * 14 * b) Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the distribution. 17 * 18 * c) Neither the name of Cisco Systems, Inc. nor the names of its 19 * contributors may be used to endorse or promote products derived 20 * from this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 26 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 32 * THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include <sys/cdefs.h> 36 __FBSDID("$FreeBSD$"); 37 38 #include <netinet/sctp_os.h> 39 #include <sys/proc.h> 40 #include <netinet/sctp_var.h> 41 #include <netinet/sctp_sysctl.h> 42 #include <netinet/sctp_header.h> 43 #include <netinet/sctp_pcb.h> 44 #include <netinet/sctputil.h> 45 #include <netinet/sctp_output.h> 46 #include <netinet/sctp_uio.h> 47 #include <netinet/sctputil.h> 48 #include <netinet/sctp_auth.h> 49 #include <netinet/sctp_timer.h> 50 #include <netinet/sctp_asconf.h> 51 #include <netinet/sctp_indata.h> 52 #include <netinet/sctp_bsd_addr.h> 53 #include <netinet/sctp_input.h> 54 #include <netinet/sctp_crc32.h> 55 #if defined(INET) || defined(INET6) 56 #include <netinet/udp.h> 57 #endif 58 #include <netinet/udp_var.h> 59 #include <machine/in_cksum.h> 60 #include <netinet/in_kdtrace.h> 61 62 63 64 #define SCTP_MAX_GAPS_INARRAY 4 65 struct sack_track { 66 uint8_t right_edge; /* mergable on the right edge */ 67 uint8_t left_edge; /* mergable on the left edge */ 68 uint8_t num_entries; 69 uint8_t spare; 70 struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY]; 71 }; 72 73 const struct sack_track sack_array[256] = { 74 {0, 0, 0, 0, /* 0x00 */ 75 {{0, 0}, 76 {0, 0}, 77 {0, 0}, 78 {0, 0} 79 } 80 }, 81 {1, 0, 1, 0, /* 0x01 */ 82 {{0, 0}, 83 {0, 0}, 84 {0, 0}, 85 {0, 0} 86 } 87 }, 88 {0, 0, 1, 0, /* 0x02 */ 89 {{1, 1}, 90 {0, 0}, 91 {0, 0}, 92 {0, 0} 93 } 94 }, 95 {1, 0, 1, 0, /* 0x03 */ 96 {{0, 1}, 97 {0, 0}, 98 {0, 0}, 99 {0, 0} 100 } 101 }, 102 {0, 0, 1, 0, /* 0x04 */ 103 {{2, 2}, 104 {0, 0}, 105 {0, 0}, 106 {0, 0} 107 } 108 }, 109 {1, 0, 2, 0, /* 0x05 */ 110 {{0, 0}, 111 {2, 2}, 112 {0, 0}, 113 {0, 0} 114 } 115 }, 116 {0, 0, 1, 0, /* 0x06 */ 117 {{1, 2}, 118 {0, 0}, 119 {0, 0}, 120 {0, 0} 121 } 122 }, 123 {1, 0, 1, 0, /* 0x07 */ 124 {{0, 2}, 125 {0, 0}, 126 {0, 0}, 127 {0, 0} 128 } 129 }, 130 {0, 0, 1, 0, /* 0x08 */ 131 {{3, 3}, 132 {0, 0}, 133 {0, 0}, 134 {0, 0} 135 } 136 }, 137 {1, 0, 2, 0, /* 0x09 */ 138 {{0, 0}, 139 {3, 3}, 140 {0, 0}, 141 {0, 0} 142 } 143 }, 144 {0, 0, 2, 0, /* 0x0a */ 145 {{1, 1}, 146 {3, 3}, 147 {0, 0}, 148 {0, 0} 149 } 150 }, 151 {1, 0, 2, 0, /* 0x0b */ 152 {{0, 1}, 153 {3, 3}, 154 {0, 0}, 155 {0, 0} 156 } 157 }, 158 {0, 0, 1, 0, /* 0x0c */ 159 {{2, 3}, 160 {0, 0}, 161 {0, 0}, 162 {0, 0} 163 } 164 }, 165 {1, 0, 2, 0, /* 0x0d */ 166 {{0, 0}, 167 {2, 3}, 168 {0, 0}, 169 {0, 0} 170 } 171 }, 172 {0, 0, 1, 0, /* 0x0e */ 173 {{1, 3}, 174 {0, 0}, 175 {0, 0}, 176 {0, 0} 177 } 178 }, 179 {1, 0, 1, 0, /* 0x0f */ 180 {{0, 3}, 181 {0, 0}, 182 {0, 0}, 183 {0, 0} 184 } 185 }, 186 {0, 0, 1, 0, /* 0x10 */ 187 {{4, 4}, 188 {0, 0}, 189 {0, 0}, 190 {0, 0} 191 } 192 }, 193 {1, 0, 2, 0, /* 0x11 */ 194 {{0, 0}, 195 {4, 4}, 196 {0, 0}, 197 {0, 0} 198 } 199 }, 200 {0, 0, 2, 0, /* 0x12 */ 201 {{1, 1}, 202 {4, 4}, 203 {0, 0}, 204 {0, 0} 205 } 206 }, 207 {1, 0, 2, 0, /* 0x13 */ 208 {{0, 1}, 209 {4, 4}, 210 {0, 0}, 211 {0, 0} 212 } 213 }, 214 {0, 0, 2, 0, /* 0x14 */ 215 {{2, 2}, 216 {4, 4}, 217 {0, 0}, 218 {0, 0} 219 } 220 }, 221 {1, 0, 3, 0, /* 0x15 */ 222 {{0, 0}, 223 {2, 2}, 224 {4, 4}, 225 {0, 0} 226 } 227 }, 228 {0, 0, 2, 0, /* 0x16 */ 229 {{1, 2}, 230 {4, 4}, 231 {0, 0}, 232 {0, 0} 233 } 234 }, 235 {1, 0, 2, 0, /* 0x17 */ 236 {{0, 2}, 237 {4, 4}, 238 {0, 0}, 239 {0, 0} 240 } 241 }, 242 {0, 0, 1, 0, /* 0x18 */ 243 {{3, 4}, 244 {0, 0}, 245 {0, 0}, 246 {0, 0} 247 } 248 }, 249 {1, 0, 2, 0, /* 0x19 */ 250 {{0, 0}, 251 {3, 4}, 252 {0, 0}, 253 {0, 0} 254 } 255 }, 256 {0, 0, 2, 0, /* 0x1a */ 257 {{1, 1}, 258 {3, 4}, 259 {0, 0}, 260 {0, 0} 261 } 262 }, 263 {1, 0, 2, 0, /* 0x1b */ 264 {{0, 1}, 265 {3, 4}, 266 {0, 0}, 267 {0, 0} 268 } 269 }, 270 {0, 0, 1, 0, /* 0x1c */ 271 {{2, 4}, 272 {0, 0}, 273 {0, 0}, 274 {0, 0} 275 } 276 }, 277 {1, 0, 2, 0, /* 0x1d */ 278 {{0, 0}, 279 {2, 4}, 280 {0, 0}, 281 {0, 0} 282 } 283 }, 284 {0, 0, 1, 0, /* 0x1e */ 285 {{1, 4}, 286 {0, 0}, 287 {0, 0}, 288 {0, 0} 289 } 290 }, 291 {1, 0, 1, 0, /* 0x1f */ 292 {{0, 4}, 293 {0, 0}, 294 {0, 0}, 295 {0, 0} 296 } 297 }, 298 {0, 0, 1, 0, /* 0x20 */ 299 {{5, 5}, 300 {0, 0}, 301 {0, 0}, 302 {0, 0} 303 } 304 }, 305 {1, 0, 2, 0, /* 0x21 */ 306 {{0, 0}, 307 {5, 5}, 308 {0, 0}, 309 {0, 0} 310 } 311 }, 312 {0, 0, 2, 0, /* 0x22 */ 313 {{1, 1}, 314 {5, 5}, 315 {0, 0}, 316 {0, 0} 317 } 318 }, 319 {1, 0, 2, 0, /* 0x23 */ 320 {{0, 1}, 321 {5, 5}, 322 {0, 0}, 323 {0, 0} 324 } 325 }, 326 {0, 0, 2, 0, /* 0x24 */ 327 {{2, 2}, 328 {5, 5}, 329 {0, 0}, 330 {0, 0} 331 } 332 }, 333 {1, 0, 3, 0, /* 0x25 */ 334 {{0, 0}, 335 {2, 2}, 336 {5, 5}, 337 {0, 0} 338 } 339 }, 340 {0, 0, 2, 0, /* 0x26 */ 341 {{1, 2}, 342 {5, 5}, 343 {0, 0}, 344 {0, 0} 345 } 346 }, 347 {1, 0, 2, 0, /* 0x27 */ 348 {{0, 2}, 349 {5, 5}, 350 {0, 0}, 351 {0, 0} 352 } 353 }, 354 {0, 0, 2, 0, /* 0x28 */ 355 {{3, 3}, 356 {5, 5}, 357 {0, 0}, 358 {0, 0} 359 } 360 }, 361 {1, 0, 3, 0, /* 0x29 */ 362 {{0, 0}, 363 {3, 3}, 364 {5, 5}, 365 {0, 0} 366 } 367 }, 368 {0, 0, 3, 0, /* 0x2a */ 369 {{1, 1}, 370 {3, 3}, 371 {5, 5}, 372 {0, 0} 373 } 374 }, 375 {1, 0, 3, 0, /* 0x2b */ 376 {{0, 1}, 377 {3, 3}, 378 {5, 5}, 379 {0, 0} 380 } 381 }, 382 {0, 0, 2, 0, /* 0x2c */ 383 {{2, 3}, 384 {5, 5}, 385 {0, 0}, 386 {0, 0} 387 } 388 }, 389 {1, 0, 3, 0, /* 0x2d */ 390 {{0, 0}, 391 {2, 3}, 392 {5, 5}, 393 {0, 0} 394 } 395 }, 396 {0, 0, 2, 0, /* 0x2e */ 397 {{1, 3}, 398 {5, 5}, 399 {0, 0}, 400 {0, 0} 401 } 402 }, 403 {1, 0, 2, 0, /* 0x2f */ 404 {{0, 3}, 405 {5, 5}, 406 {0, 0}, 407 {0, 0} 408 } 409 }, 410 {0, 0, 1, 0, /* 0x30 */ 411 {{4, 5}, 412 {0, 0}, 413 {0, 0}, 414 {0, 0} 415 } 416 }, 417 {1, 0, 2, 0, /* 0x31 */ 418 {{0, 0}, 419 {4, 5}, 420 {0, 0}, 421 {0, 0} 422 } 423 }, 424 {0, 0, 2, 0, /* 0x32 */ 425 {{1, 1}, 426 {4, 5}, 427 {0, 0}, 428 {0, 0} 429 } 430 }, 431 {1, 0, 2, 0, /* 0x33 */ 432 {{0, 1}, 433 {4, 5}, 434 {0, 0}, 435 {0, 0} 436 } 437 }, 438 {0, 0, 2, 0, /* 0x34 */ 439 {{2, 2}, 440 {4, 5}, 441 {0, 0}, 442 {0, 0} 443 } 444 }, 445 {1, 0, 3, 0, /* 0x35 */ 446 {{0, 0}, 447 {2, 2}, 448 {4, 5}, 449 {0, 0} 450 } 451 }, 452 {0, 0, 2, 0, /* 0x36 */ 453 {{1, 2}, 454 {4, 5}, 455 {0, 0}, 456 {0, 0} 457 } 458 }, 459 {1, 0, 2, 0, /* 0x37 */ 460 {{0, 2}, 461 {4, 5}, 462 {0, 0}, 463 {0, 0} 464 } 465 }, 466 {0, 0, 1, 0, /* 0x38 */ 467 {{3, 5}, 468 {0, 0}, 469 {0, 0}, 470 {0, 0} 471 } 472 }, 473 {1, 0, 2, 0, /* 0x39 */ 474 {{0, 0}, 475 {3, 5}, 476 {0, 0}, 477 {0, 0} 478 } 479 }, 480 {0, 0, 2, 0, /* 0x3a */ 481 {{1, 1}, 482 {3, 5}, 483 {0, 0}, 484 {0, 0} 485 } 486 }, 487 {1, 0, 2, 0, /* 0x3b */ 488 {{0, 1}, 489 {3, 5}, 490 {0, 0}, 491 {0, 0} 492 } 493 }, 494 {0, 0, 1, 0, /* 0x3c */ 495 {{2, 5}, 496 {0, 0}, 497 {0, 0}, 498 {0, 0} 499 } 500 }, 501 {1, 0, 2, 0, /* 0x3d */ 502 {{0, 0}, 503 {2, 5}, 504 {0, 0}, 505 {0, 0} 506 } 507 }, 508 {0, 0, 1, 0, /* 0x3e */ 509 {{1, 5}, 510 {0, 0}, 511 {0, 0}, 512 {0, 0} 513 } 514 }, 515 {1, 0, 1, 0, /* 0x3f */ 516 {{0, 5}, 517 {0, 0}, 518 {0, 0}, 519 {0, 0} 520 } 521 }, 522 {0, 0, 1, 0, /* 0x40 */ 523 {{6, 6}, 524 {0, 0}, 525 {0, 0}, 526 {0, 0} 527 } 528 }, 529 {1, 0, 2, 0, /* 0x41 */ 530 {{0, 0}, 531 {6, 6}, 532 {0, 0}, 533 {0, 0} 534 } 535 }, 536 {0, 0, 2, 0, /* 0x42 */ 537 {{1, 1}, 538 {6, 6}, 539 {0, 0}, 540 {0, 0} 541 } 542 }, 543 {1, 0, 2, 0, /* 0x43 */ 544 {{0, 1}, 545 {6, 6}, 546 {0, 0}, 547 {0, 0} 548 } 549 }, 550 {0, 0, 2, 0, /* 0x44 */ 551 {{2, 2}, 552 {6, 6}, 553 {0, 0}, 554 {0, 0} 555 } 556 }, 557 {1, 0, 3, 0, /* 0x45 */ 558 {{0, 0}, 559 {2, 2}, 560 {6, 6}, 561 {0, 0} 562 } 563 }, 564 {0, 0, 2, 0, /* 0x46 */ 565 {{1, 2}, 566 {6, 6}, 567 {0, 0}, 568 {0, 0} 569 } 570 }, 571 {1, 0, 2, 0, /* 0x47 */ 572 {{0, 2}, 573 {6, 6}, 574 {0, 0}, 575 {0, 0} 576 } 577 }, 578 {0, 0, 2, 0, /* 0x48 */ 579 {{3, 3}, 580 {6, 6}, 581 {0, 0}, 582 {0, 0} 583 } 584 }, 585 {1, 0, 3, 0, /* 0x49 */ 586 {{0, 0}, 587 {3, 3}, 588 {6, 6}, 589 {0, 0} 590 } 591 }, 592 {0, 0, 3, 0, /* 0x4a */ 593 {{1, 1}, 594 {3, 3}, 595 {6, 6}, 596 {0, 0} 597 } 598 }, 599 {1, 0, 3, 0, /* 0x4b */ 600 {{0, 1}, 601 {3, 3}, 602 {6, 6}, 603 {0, 0} 604 } 605 }, 606 {0, 0, 2, 0, /* 0x4c */ 607 {{2, 3}, 608 {6, 6}, 609 {0, 0}, 610 {0, 0} 611 } 612 }, 613 {1, 0, 3, 0, /* 0x4d */ 614 {{0, 0}, 615 {2, 3}, 616 {6, 6}, 617 {0, 0} 618 } 619 }, 620 {0, 0, 2, 0, /* 0x4e */ 621 {{1, 3}, 622 {6, 6}, 623 {0, 0}, 624 {0, 0} 625 } 626 }, 627 {1, 0, 2, 0, /* 0x4f */ 628 {{0, 3}, 629 {6, 6}, 630 {0, 0}, 631 {0, 0} 632 } 633 }, 634 {0, 0, 2, 0, /* 0x50 */ 635 {{4, 4}, 636 {6, 6}, 637 {0, 0}, 638 {0, 0} 639 } 640 }, 641 {1, 0, 3, 0, /* 0x51 */ 642 {{0, 0}, 643 {4, 4}, 644 {6, 6}, 645 {0, 0} 646 } 647 }, 648 {0, 0, 3, 0, /* 0x52 */ 649 {{1, 1}, 650 {4, 4}, 651 {6, 6}, 652 {0, 0} 653 } 654 }, 655 {1, 0, 3, 0, /* 0x53 */ 656 {{0, 1}, 657 {4, 4}, 658 {6, 6}, 659 {0, 0} 660 } 661 }, 662 {0, 0, 3, 0, /* 0x54 */ 663 {{2, 2}, 664 {4, 4}, 665 {6, 6}, 666 {0, 0} 667 } 668 }, 669 {1, 0, 4, 0, /* 0x55 */ 670 {{0, 0}, 671 {2, 2}, 672 {4, 4}, 673 {6, 6} 674 } 675 }, 676 {0, 0, 3, 0, /* 0x56 */ 677 {{1, 2}, 678 {4, 4}, 679 {6, 6}, 680 {0, 0} 681 } 682 }, 683 {1, 0, 3, 0, /* 0x57 */ 684 {{0, 2}, 685 {4, 4}, 686 {6, 6}, 687 {0, 0} 688 } 689 }, 690 {0, 0, 2, 0, /* 0x58 */ 691 {{3, 4}, 692 {6, 6}, 693 {0, 0}, 694 {0, 0} 695 } 696 }, 697 {1, 0, 3, 0, /* 0x59 */ 698 {{0, 0}, 699 {3, 4}, 700 {6, 6}, 701 {0, 0} 702 } 703 }, 704 {0, 0, 3, 0, /* 0x5a */ 705 {{1, 1}, 706 {3, 4}, 707 {6, 6}, 708 {0, 0} 709 } 710 }, 711 {1, 0, 3, 0, /* 0x5b */ 712 {{0, 1}, 713 {3, 4}, 714 {6, 6}, 715 {0, 0} 716 } 717 }, 718 {0, 0, 2, 0, /* 0x5c */ 719 {{2, 4}, 720 {6, 6}, 721 {0, 0}, 722 {0, 0} 723 } 724 }, 725 {1, 0, 3, 0, /* 0x5d */ 726 {{0, 0}, 727 {2, 4}, 728 {6, 6}, 729 {0, 0} 730 } 731 }, 732 {0, 0, 2, 0, /* 0x5e */ 733 {{1, 4}, 734 {6, 6}, 735 {0, 0}, 736 {0, 0} 737 } 738 }, 739 {1, 0, 2, 0, /* 0x5f */ 740 {{0, 4}, 741 {6, 6}, 742 {0, 0}, 743 {0, 0} 744 } 745 }, 746 {0, 0, 1, 0, /* 0x60 */ 747 {{5, 6}, 748 {0, 0}, 749 {0, 0}, 750 {0, 0} 751 } 752 }, 753 {1, 0, 2, 0, /* 0x61 */ 754 {{0, 0}, 755 {5, 6}, 756 {0, 0}, 757 {0, 0} 758 } 759 }, 760 {0, 0, 2, 0, /* 0x62 */ 761 {{1, 1}, 762 {5, 6}, 763 {0, 0}, 764 {0, 0} 765 } 766 }, 767 {1, 0, 2, 0, /* 0x63 */ 768 {{0, 1}, 769 {5, 6}, 770 {0, 0}, 771 {0, 0} 772 } 773 }, 774 {0, 0, 2, 0, /* 0x64 */ 775 {{2, 2}, 776 {5, 6}, 777 {0, 0}, 778 {0, 0} 779 } 780 }, 781 {1, 0, 3, 0, /* 0x65 */ 782 {{0, 0}, 783 {2, 2}, 784 {5, 6}, 785 {0, 0} 786 } 787 }, 788 {0, 0, 2, 0, /* 0x66 */ 789 {{1, 2}, 790 {5, 6}, 791 {0, 0}, 792 {0, 0} 793 } 794 }, 795 {1, 0, 2, 0, /* 0x67 */ 796 {{0, 2}, 797 {5, 6}, 798 {0, 0}, 799 {0, 0} 800 } 801 }, 802 {0, 0, 2, 0, /* 0x68 */ 803 {{3, 3}, 804 {5, 6}, 805 {0, 0}, 806 {0, 0} 807 } 808 }, 809 {1, 0, 3, 0, /* 0x69 */ 810 {{0, 0}, 811 {3, 3}, 812 {5, 6}, 813 {0, 0} 814 } 815 }, 816 {0, 0, 3, 0, /* 0x6a */ 817 {{1, 1}, 818 {3, 3}, 819 {5, 6}, 820 {0, 0} 821 } 822 }, 823 {1, 0, 3, 0, /* 0x6b */ 824 {{0, 1}, 825 {3, 3}, 826 {5, 6}, 827 {0, 0} 828 } 829 }, 830 {0, 0, 2, 0, /* 0x6c */ 831 {{2, 3}, 832 {5, 6}, 833 {0, 0}, 834 {0, 0} 835 } 836 }, 837 {1, 0, 3, 0, /* 0x6d */ 838 {{0, 0}, 839 {2, 3}, 840 {5, 6}, 841 {0, 0} 842 } 843 }, 844 {0, 0, 2, 0, /* 0x6e */ 845 {{1, 3}, 846 {5, 6}, 847 {0, 0}, 848 {0, 0} 849 } 850 }, 851 {1, 0, 2, 0, /* 0x6f */ 852 {{0, 3}, 853 {5, 6}, 854 {0, 0}, 855 {0, 0} 856 } 857 }, 858 {0, 0, 1, 0, /* 0x70 */ 859 {{4, 6}, 860 {0, 0}, 861 {0, 0}, 862 {0, 0} 863 } 864 }, 865 {1, 0, 2, 0, /* 0x71 */ 866 {{0, 0}, 867 {4, 6}, 868 {0, 0}, 869 {0, 0} 870 } 871 }, 872 {0, 0, 2, 0, /* 0x72 */ 873 {{1, 1}, 874 {4, 6}, 875 {0, 0}, 876 {0, 0} 877 } 878 }, 879 {1, 0, 2, 0, /* 0x73 */ 880 {{0, 1}, 881 {4, 6}, 882 {0, 0}, 883 {0, 0} 884 } 885 }, 886 {0, 0, 2, 0, /* 0x74 */ 887 {{2, 2}, 888 {4, 6}, 889 {0, 0}, 890 {0, 0} 891 } 892 }, 893 {1, 0, 3, 0, /* 0x75 */ 894 {{0, 0}, 895 {2, 2}, 896 {4, 6}, 897 {0, 0} 898 } 899 }, 900 {0, 0, 2, 0, /* 0x76 */ 901 {{1, 2}, 902 {4, 6}, 903 {0, 0}, 904 {0, 0} 905 } 906 }, 907 {1, 0, 2, 0, /* 0x77 */ 908 {{0, 2}, 909 {4, 6}, 910 {0, 0}, 911 {0, 0} 912 } 913 }, 914 {0, 0, 1, 0, /* 0x78 */ 915 {{3, 6}, 916 {0, 0}, 917 {0, 0}, 918 {0, 0} 919 } 920 }, 921 {1, 0, 2, 0, /* 0x79 */ 922 {{0, 0}, 923 {3, 6}, 924 {0, 0}, 925 {0, 0} 926 } 927 }, 928 {0, 0, 2, 0, /* 0x7a */ 929 {{1, 1}, 930 {3, 6}, 931 {0, 0}, 932 {0, 0} 933 } 934 }, 935 {1, 0, 2, 0, /* 0x7b */ 936 {{0, 1}, 937 {3, 6}, 938 {0, 0}, 939 {0, 0} 940 } 941 }, 942 {0, 0, 1, 0, /* 0x7c */ 943 {{2, 6}, 944 {0, 0}, 945 {0, 0}, 946 {0, 0} 947 } 948 }, 949 {1, 0, 2, 0, /* 0x7d */ 950 {{0, 0}, 951 {2, 6}, 952 {0, 0}, 953 {0, 0} 954 } 955 }, 956 {0, 0, 1, 0, /* 0x7e */ 957 {{1, 6}, 958 {0, 0}, 959 {0, 0}, 960 {0, 0} 961 } 962 }, 963 {1, 0, 1, 0, /* 0x7f */ 964 {{0, 6}, 965 {0, 0}, 966 {0, 0}, 967 {0, 0} 968 } 969 }, 970 {0, 1, 1, 0, /* 0x80 */ 971 {{7, 7}, 972 {0, 0}, 973 {0, 0}, 974 {0, 0} 975 } 976 }, 977 {1, 1, 2, 0, /* 0x81 */ 978 {{0, 0}, 979 {7, 7}, 980 {0, 0}, 981 {0, 0} 982 } 983 }, 984 {0, 1, 2, 0, /* 0x82 */ 985 {{1, 1}, 986 {7, 7}, 987 {0, 0}, 988 {0, 0} 989 } 990 }, 991 {1, 1, 2, 0, /* 0x83 */ 992 {{0, 1}, 993 {7, 7}, 994 {0, 0}, 995 {0, 0} 996 } 997 }, 998 {0, 1, 2, 0, /* 0x84 */ 999 {{2, 2}, 1000 {7, 7}, 1001 {0, 0}, 1002 {0, 0} 1003 } 1004 }, 1005 {1, 1, 3, 0, /* 0x85 */ 1006 {{0, 0}, 1007 {2, 2}, 1008 {7, 7}, 1009 {0, 0} 1010 } 1011 }, 1012 {0, 1, 2, 0, /* 0x86 */ 1013 {{1, 2}, 1014 {7, 7}, 1015 {0, 0}, 1016 {0, 0} 1017 } 1018 }, 1019 {1, 1, 2, 0, /* 0x87 */ 1020 {{0, 2}, 1021 {7, 7}, 1022 {0, 0}, 1023 {0, 0} 1024 } 1025 }, 1026 {0, 1, 2, 0, /* 0x88 */ 1027 {{3, 3}, 1028 {7, 7}, 1029 {0, 0}, 1030 {0, 0} 1031 } 1032 }, 1033 {1, 1, 3, 0, /* 0x89 */ 1034 {{0, 0}, 1035 {3, 3}, 1036 {7, 7}, 1037 {0, 0} 1038 } 1039 }, 1040 {0, 1, 3, 0, /* 0x8a */ 1041 {{1, 1}, 1042 {3, 3}, 1043 {7, 7}, 1044 {0, 0} 1045 } 1046 }, 1047 {1, 1, 3, 0, /* 0x8b */ 1048 {{0, 1}, 1049 {3, 3}, 1050 {7, 7}, 1051 {0, 0} 1052 } 1053 }, 1054 {0, 1, 2, 0, /* 0x8c */ 1055 {{2, 3}, 1056 {7, 7}, 1057 {0, 0}, 1058 {0, 0} 1059 } 1060 }, 1061 {1, 1, 3, 0, /* 0x8d */ 1062 {{0, 0}, 1063 {2, 3}, 1064 {7, 7}, 1065 {0, 0} 1066 } 1067 }, 1068 {0, 1, 2, 0, /* 0x8e */ 1069 {{1, 3}, 1070 {7, 7}, 1071 {0, 0}, 1072 {0, 0} 1073 } 1074 }, 1075 {1, 1, 2, 0, /* 0x8f */ 1076 {{0, 3}, 1077 {7, 7}, 1078 {0, 0}, 1079 {0, 0} 1080 } 1081 }, 1082 {0, 1, 2, 0, /* 0x90 */ 1083 {{4, 4}, 1084 {7, 7}, 1085 {0, 0}, 1086 {0, 0} 1087 } 1088 }, 1089 {1, 1, 3, 0, /* 0x91 */ 1090 {{0, 0}, 1091 {4, 4}, 1092 {7, 7}, 1093 {0, 0} 1094 } 1095 }, 1096 {0, 1, 3, 0, /* 0x92 */ 1097 {{1, 1}, 1098 {4, 4}, 1099 {7, 7}, 1100 {0, 0} 1101 } 1102 }, 1103 {1, 1, 3, 0, /* 0x93 */ 1104 {{0, 1}, 1105 {4, 4}, 1106 {7, 7}, 1107 {0, 0} 1108 } 1109 }, 1110 {0, 1, 3, 0, /* 0x94 */ 1111 {{2, 2}, 1112 {4, 4}, 1113 {7, 7}, 1114 {0, 0} 1115 } 1116 }, 1117 {1, 1, 4, 0, /* 0x95 */ 1118 {{0, 0}, 1119 {2, 2}, 1120 {4, 4}, 1121 {7, 7} 1122 } 1123 }, 1124 {0, 1, 3, 0, /* 0x96 */ 1125 {{1, 2}, 1126 {4, 4}, 1127 {7, 7}, 1128 {0, 0} 1129 } 1130 }, 1131 {1, 1, 3, 0, /* 0x97 */ 1132 {{0, 2}, 1133 {4, 4}, 1134 {7, 7}, 1135 {0, 0} 1136 } 1137 }, 1138 {0, 1, 2, 0, /* 0x98 */ 1139 {{3, 4}, 1140 {7, 7}, 1141 {0, 0}, 1142 {0, 0} 1143 } 1144 }, 1145 {1, 1, 3, 0, /* 0x99 */ 1146 {{0, 0}, 1147 {3, 4}, 1148 {7, 7}, 1149 {0, 0} 1150 } 1151 }, 1152 {0, 1, 3, 0, /* 0x9a */ 1153 {{1, 1}, 1154 {3, 4}, 1155 {7, 7}, 1156 {0, 0} 1157 } 1158 }, 1159 {1, 1, 3, 0, /* 0x9b */ 1160 {{0, 1}, 1161 {3, 4}, 1162 {7, 7}, 1163 {0, 0} 1164 } 1165 }, 1166 {0, 1, 2, 0, /* 0x9c */ 1167 {{2, 4}, 1168 {7, 7}, 1169 {0, 0}, 1170 {0, 0} 1171 } 1172 }, 1173 {1, 1, 3, 0, /* 0x9d */ 1174 {{0, 0}, 1175 {2, 4}, 1176 {7, 7}, 1177 {0, 0} 1178 } 1179 }, 1180 {0, 1, 2, 0, /* 0x9e */ 1181 {{1, 4}, 1182 {7, 7}, 1183 {0, 0}, 1184 {0, 0} 1185 } 1186 }, 1187 {1, 1, 2, 0, /* 0x9f */ 1188 {{0, 4}, 1189 {7, 7}, 1190 {0, 0}, 1191 {0, 0} 1192 } 1193 }, 1194 {0, 1, 2, 0, /* 0xa0 */ 1195 {{5, 5}, 1196 {7, 7}, 1197 {0, 0}, 1198 {0, 0} 1199 } 1200 }, 1201 {1, 1, 3, 0, /* 0xa1 */ 1202 {{0, 0}, 1203 {5, 5}, 1204 {7, 7}, 1205 {0, 0} 1206 } 1207 }, 1208 {0, 1, 3, 0, /* 0xa2 */ 1209 {{1, 1}, 1210 {5, 5}, 1211 {7, 7}, 1212 {0, 0} 1213 } 1214 }, 1215 {1, 1, 3, 0, /* 0xa3 */ 1216 {{0, 1}, 1217 {5, 5}, 1218 {7, 7}, 1219 {0, 0} 1220 } 1221 }, 1222 {0, 1, 3, 0, /* 0xa4 */ 1223 {{2, 2}, 1224 {5, 5}, 1225 {7, 7}, 1226 {0, 0} 1227 } 1228 }, 1229 {1, 1, 4, 0, /* 0xa5 */ 1230 {{0, 0}, 1231 {2, 2}, 1232 {5, 5}, 1233 {7, 7} 1234 } 1235 }, 1236 {0, 1, 3, 0, /* 0xa6 */ 1237 {{1, 2}, 1238 {5, 5}, 1239 {7, 7}, 1240 {0, 0} 1241 } 1242 }, 1243 {1, 1, 3, 0, /* 0xa7 */ 1244 {{0, 2}, 1245 {5, 5}, 1246 {7, 7}, 1247 {0, 0} 1248 } 1249 }, 1250 {0, 1, 3, 0, /* 0xa8 */ 1251 {{3, 3}, 1252 {5, 5}, 1253 {7, 7}, 1254 {0, 0} 1255 } 1256 }, 1257 {1, 1, 4, 0, /* 0xa9 */ 1258 {{0, 0}, 1259 {3, 3}, 1260 {5, 5}, 1261 {7, 7} 1262 } 1263 }, 1264 {0, 1, 4, 0, /* 0xaa */ 1265 {{1, 1}, 1266 {3, 3}, 1267 {5, 5}, 1268 {7, 7} 1269 } 1270 }, 1271 {1, 1, 4, 0, /* 0xab */ 1272 {{0, 1}, 1273 {3, 3}, 1274 {5, 5}, 1275 {7, 7} 1276 } 1277 }, 1278 {0, 1, 3, 0, /* 0xac */ 1279 {{2, 3}, 1280 {5, 5}, 1281 {7, 7}, 1282 {0, 0} 1283 } 1284 }, 1285 {1, 1, 4, 0, /* 0xad */ 1286 {{0, 0}, 1287 {2, 3}, 1288 {5, 5}, 1289 {7, 7} 1290 } 1291 }, 1292 {0, 1, 3, 0, /* 0xae */ 1293 {{1, 3}, 1294 {5, 5}, 1295 {7, 7}, 1296 {0, 0} 1297 } 1298 }, 1299 {1, 1, 3, 0, /* 0xaf */ 1300 {{0, 3}, 1301 {5, 5}, 1302 {7, 7}, 1303 {0, 0} 1304 } 1305 }, 1306 {0, 1, 2, 0, /* 0xb0 */ 1307 {{4, 5}, 1308 {7, 7}, 1309 {0, 0}, 1310 {0, 0} 1311 } 1312 }, 1313 {1, 1, 3, 0, /* 0xb1 */ 1314 {{0, 0}, 1315 {4, 5}, 1316 {7, 7}, 1317 {0, 0} 1318 } 1319 }, 1320 {0, 1, 3, 0, /* 0xb2 */ 1321 {{1, 1}, 1322 {4, 5}, 1323 {7, 7}, 1324 {0, 0} 1325 } 1326 }, 1327 {1, 1, 3, 0, /* 0xb3 */ 1328 {{0, 1}, 1329 {4, 5}, 1330 {7, 7}, 1331 {0, 0} 1332 } 1333 }, 1334 {0, 1, 3, 0, /* 0xb4 */ 1335 {{2, 2}, 1336 {4, 5}, 1337 {7, 7}, 1338 {0, 0} 1339 } 1340 }, 1341 {1, 1, 4, 0, /* 0xb5 */ 1342 {{0, 0}, 1343 {2, 2}, 1344 {4, 5}, 1345 {7, 7} 1346 } 1347 }, 1348 {0, 1, 3, 0, /* 0xb6 */ 1349 {{1, 2}, 1350 {4, 5}, 1351 {7, 7}, 1352 {0, 0} 1353 } 1354 }, 1355 {1, 1, 3, 0, /* 0xb7 */ 1356 {{0, 2}, 1357 {4, 5}, 1358 {7, 7}, 1359 {0, 0} 1360 } 1361 }, 1362 {0, 1, 2, 0, /* 0xb8 */ 1363 {{3, 5}, 1364 {7, 7}, 1365 {0, 0}, 1366 {0, 0} 1367 } 1368 }, 1369 {1, 1, 3, 0, /* 0xb9 */ 1370 {{0, 0}, 1371 {3, 5}, 1372 {7, 7}, 1373 {0, 0} 1374 } 1375 }, 1376 {0, 1, 3, 0, /* 0xba */ 1377 {{1, 1}, 1378 {3, 5}, 1379 {7, 7}, 1380 {0, 0} 1381 } 1382 }, 1383 {1, 1, 3, 0, /* 0xbb */ 1384 {{0, 1}, 1385 {3, 5}, 1386 {7, 7}, 1387 {0, 0} 1388 } 1389 }, 1390 {0, 1, 2, 0, /* 0xbc */ 1391 {{2, 5}, 1392 {7, 7}, 1393 {0, 0}, 1394 {0, 0} 1395 } 1396 }, 1397 {1, 1, 3, 0, /* 0xbd */ 1398 {{0, 0}, 1399 {2, 5}, 1400 {7, 7}, 1401 {0, 0} 1402 } 1403 }, 1404 {0, 1, 2, 0, /* 0xbe */ 1405 {{1, 5}, 1406 {7, 7}, 1407 {0, 0}, 1408 {0, 0} 1409 } 1410 }, 1411 {1, 1, 2, 0, /* 0xbf */ 1412 {{0, 5}, 1413 {7, 7}, 1414 {0, 0}, 1415 {0, 0} 1416 } 1417 }, 1418 {0, 1, 1, 0, /* 0xc0 */ 1419 {{6, 7}, 1420 {0, 0}, 1421 {0, 0}, 1422 {0, 0} 1423 } 1424 }, 1425 {1, 1, 2, 0, /* 0xc1 */ 1426 {{0, 0}, 1427 {6, 7}, 1428 {0, 0}, 1429 {0, 0} 1430 } 1431 }, 1432 {0, 1, 2, 0, /* 0xc2 */ 1433 {{1, 1}, 1434 {6, 7}, 1435 {0, 0}, 1436 {0, 0} 1437 } 1438 }, 1439 {1, 1, 2, 0, /* 0xc3 */ 1440 {{0, 1}, 1441 {6, 7}, 1442 {0, 0}, 1443 {0, 0} 1444 } 1445 }, 1446 {0, 1, 2, 0, /* 0xc4 */ 1447 {{2, 2}, 1448 {6, 7}, 1449 {0, 0}, 1450 {0, 0} 1451 } 1452 }, 1453 {1, 1, 3, 0, /* 0xc5 */ 1454 {{0, 0}, 1455 {2, 2}, 1456 {6, 7}, 1457 {0, 0} 1458 } 1459 }, 1460 {0, 1, 2, 0, /* 0xc6 */ 1461 {{1, 2}, 1462 {6, 7}, 1463 {0, 0}, 1464 {0, 0} 1465 } 1466 }, 1467 {1, 1, 2, 0, /* 0xc7 */ 1468 {{0, 2}, 1469 {6, 7}, 1470 {0, 0}, 1471 {0, 0} 1472 } 1473 }, 1474 {0, 1, 2, 0, /* 0xc8 */ 1475 {{3, 3}, 1476 {6, 7}, 1477 {0, 0}, 1478 {0, 0} 1479 } 1480 }, 1481 {1, 1, 3, 0, /* 0xc9 */ 1482 {{0, 0}, 1483 {3, 3}, 1484 {6, 7}, 1485 {0, 0} 1486 } 1487 }, 1488 {0, 1, 3, 0, /* 0xca */ 1489 {{1, 1}, 1490 {3, 3}, 1491 {6, 7}, 1492 {0, 0} 1493 } 1494 }, 1495 {1, 1, 3, 0, /* 0xcb */ 1496 {{0, 1}, 1497 {3, 3}, 1498 {6, 7}, 1499 {0, 0} 1500 } 1501 }, 1502 {0, 1, 2, 0, /* 0xcc */ 1503 {{2, 3}, 1504 {6, 7}, 1505 {0, 0}, 1506 {0, 0} 1507 } 1508 }, 1509 {1, 1, 3, 0, /* 0xcd */ 1510 {{0, 0}, 1511 {2, 3}, 1512 {6, 7}, 1513 {0, 0} 1514 } 1515 }, 1516 {0, 1, 2, 0, /* 0xce */ 1517 {{1, 3}, 1518 {6, 7}, 1519 {0, 0}, 1520 {0, 0} 1521 } 1522 }, 1523 {1, 1, 2, 0, /* 0xcf */ 1524 {{0, 3}, 1525 {6, 7}, 1526 {0, 0}, 1527 {0, 0} 1528 } 1529 }, 1530 {0, 1, 2, 0, /* 0xd0 */ 1531 {{4, 4}, 1532 {6, 7}, 1533 {0, 0}, 1534 {0, 0} 1535 } 1536 }, 1537 {1, 1, 3, 0, /* 0xd1 */ 1538 {{0, 0}, 1539 {4, 4}, 1540 {6, 7}, 1541 {0, 0} 1542 } 1543 }, 1544 {0, 1, 3, 0, /* 0xd2 */ 1545 {{1, 1}, 1546 {4, 4}, 1547 {6, 7}, 1548 {0, 0} 1549 } 1550 }, 1551 {1, 1, 3, 0, /* 0xd3 */ 1552 {{0, 1}, 1553 {4, 4}, 1554 {6, 7}, 1555 {0, 0} 1556 } 1557 }, 1558 {0, 1, 3, 0, /* 0xd4 */ 1559 {{2, 2}, 1560 {4, 4}, 1561 {6, 7}, 1562 {0, 0} 1563 } 1564 }, 1565 {1, 1, 4, 0, /* 0xd5 */ 1566 {{0, 0}, 1567 {2, 2}, 1568 {4, 4}, 1569 {6, 7} 1570 } 1571 }, 1572 {0, 1, 3, 0, /* 0xd6 */ 1573 {{1, 2}, 1574 {4, 4}, 1575 {6, 7}, 1576 {0, 0} 1577 } 1578 }, 1579 {1, 1, 3, 0, /* 0xd7 */ 1580 {{0, 2}, 1581 {4, 4}, 1582 {6, 7}, 1583 {0, 0} 1584 } 1585 }, 1586 {0, 1, 2, 0, /* 0xd8 */ 1587 {{3, 4}, 1588 {6, 7}, 1589 {0, 0}, 1590 {0, 0} 1591 } 1592 }, 1593 {1, 1, 3, 0, /* 0xd9 */ 1594 {{0, 0}, 1595 {3, 4}, 1596 {6, 7}, 1597 {0, 0} 1598 } 1599 }, 1600 {0, 1, 3, 0, /* 0xda */ 1601 {{1, 1}, 1602 {3, 4}, 1603 {6, 7}, 1604 {0, 0} 1605 } 1606 }, 1607 {1, 1, 3, 0, /* 0xdb */ 1608 {{0, 1}, 1609 {3, 4}, 1610 {6, 7}, 1611 {0, 0} 1612 } 1613 }, 1614 {0, 1, 2, 0, /* 0xdc */ 1615 {{2, 4}, 1616 {6, 7}, 1617 {0, 0}, 1618 {0, 0} 1619 } 1620 }, 1621 {1, 1, 3, 0, /* 0xdd */ 1622 {{0, 0}, 1623 {2, 4}, 1624 {6, 7}, 1625 {0, 0} 1626 } 1627 }, 1628 {0, 1, 2, 0, /* 0xde */ 1629 {{1, 4}, 1630 {6, 7}, 1631 {0, 0}, 1632 {0, 0} 1633 } 1634 }, 1635 {1, 1, 2, 0, /* 0xdf */ 1636 {{0, 4}, 1637 {6, 7}, 1638 {0, 0}, 1639 {0, 0} 1640 } 1641 }, 1642 {0, 1, 1, 0, /* 0xe0 */ 1643 {{5, 7}, 1644 {0, 0}, 1645 {0, 0}, 1646 {0, 0} 1647 } 1648 }, 1649 {1, 1, 2, 0, /* 0xe1 */ 1650 {{0, 0}, 1651 {5, 7}, 1652 {0, 0}, 1653 {0, 0} 1654 } 1655 }, 1656 {0, 1, 2, 0, /* 0xe2 */ 1657 {{1, 1}, 1658 {5, 7}, 1659 {0, 0}, 1660 {0, 0} 1661 } 1662 }, 1663 {1, 1, 2, 0, /* 0xe3 */ 1664 {{0, 1}, 1665 {5, 7}, 1666 {0, 0}, 1667 {0, 0} 1668 } 1669 }, 1670 {0, 1, 2, 0, /* 0xe4 */ 1671 {{2, 2}, 1672 {5, 7}, 1673 {0, 0}, 1674 {0, 0} 1675 } 1676 }, 1677 {1, 1, 3, 0, /* 0xe5 */ 1678 {{0, 0}, 1679 {2, 2}, 1680 {5, 7}, 1681 {0, 0} 1682 } 1683 }, 1684 {0, 1, 2, 0, /* 0xe6 */ 1685 {{1, 2}, 1686 {5, 7}, 1687 {0, 0}, 1688 {0, 0} 1689 } 1690 }, 1691 {1, 1, 2, 0, /* 0xe7 */ 1692 {{0, 2}, 1693 {5, 7}, 1694 {0, 0}, 1695 {0, 0} 1696 } 1697 }, 1698 {0, 1, 2, 0, /* 0xe8 */ 1699 {{3, 3}, 1700 {5, 7}, 1701 {0, 0}, 1702 {0, 0} 1703 } 1704 }, 1705 {1, 1, 3, 0, /* 0xe9 */ 1706 {{0, 0}, 1707 {3, 3}, 1708 {5, 7}, 1709 {0, 0} 1710 } 1711 }, 1712 {0, 1, 3, 0, /* 0xea */ 1713 {{1, 1}, 1714 {3, 3}, 1715 {5, 7}, 1716 {0, 0} 1717 } 1718 }, 1719 {1, 1, 3, 0, /* 0xeb */ 1720 {{0, 1}, 1721 {3, 3}, 1722 {5, 7}, 1723 {0, 0} 1724 } 1725 }, 1726 {0, 1, 2, 0, /* 0xec */ 1727 {{2, 3}, 1728 {5, 7}, 1729 {0, 0}, 1730 {0, 0} 1731 } 1732 }, 1733 {1, 1, 3, 0, /* 0xed */ 1734 {{0, 0}, 1735 {2, 3}, 1736 {5, 7}, 1737 {0, 0} 1738 } 1739 }, 1740 {0, 1, 2, 0, /* 0xee */ 1741 {{1, 3}, 1742 {5, 7}, 1743 {0, 0}, 1744 {0, 0} 1745 } 1746 }, 1747 {1, 1, 2, 0, /* 0xef */ 1748 {{0, 3}, 1749 {5, 7}, 1750 {0, 0}, 1751 {0, 0} 1752 } 1753 }, 1754 {0, 1, 1, 0, /* 0xf0 */ 1755 {{4, 7}, 1756 {0, 0}, 1757 {0, 0}, 1758 {0, 0} 1759 } 1760 }, 1761 {1, 1, 2, 0, /* 0xf1 */ 1762 {{0, 0}, 1763 {4, 7}, 1764 {0, 0}, 1765 {0, 0} 1766 } 1767 }, 1768 {0, 1, 2, 0, /* 0xf2 */ 1769 {{1, 1}, 1770 {4, 7}, 1771 {0, 0}, 1772 {0, 0} 1773 } 1774 }, 1775 {1, 1, 2, 0, /* 0xf3 */ 1776 {{0, 1}, 1777 {4, 7}, 1778 {0, 0}, 1779 {0, 0} 1780 } 1781 }, 1782 {0, 1, 2, 0, /* 0xf4 */ 1783 {{2, 2}, 1784 {4, 7}, 1785 {0, 0}, 1786 {0, 0} 1787 } 1788 }, 1789 {1, 1, 3, 0, /* 0xf5 */ 1790 {{0, 0}, 1791 {2, 2}, 1792 {4, 7}, 1793 {0, 0} 1794 } 1795 }, 1796 {0, 1, 2, 0, /* 0xf6 */ 1797 {{1, 2}, 1798 {4, 7}, 1799 {0, 0}, 1800 {0, 0} 1801 } 1802 }, 1803 {1, 1, 2, 0, /* 0xf7 */ 1804 {{0, 2}, 1805 {4, 7}, 1806 {0, 0}, 1807 {0, 0} 1808 } 1809 }, 1810 {0, 1, 1, 0, /* 0xf8 */ 1811 {{3, 7}, 1812 {0, 0}, 1813 {0, 0}, 1814 {0, 0} 1815 } 1816 }, 1817 {1, 1, 2, 0, /* 0xf9 */ 1818 {{0, 0}, 1819 {3, 7}, 1820 {0, 0}, 1821 {0, 0} 1822 } 1823 }, 1824 {0, 1, 2, 0, /* 0xfa */ 1825 {{1, 1}, 1826 {3, 7}, 1827 {0, 0}, 1828 {0, 0} 1829 } 1830 }, 1831 {1, 1, 2, 0, /* 0xfb */ 1832 {{0, 1}, 1833 {3, 7}, 1834 {0, 0}, 1835 {0, 0} 1836 } 1837 }, 1838 {0, 1, 1, 0, /* 0xfc */ 1839 {{2, 7}, 1840 {0, 0}, 1841 {0, 0}, 1842 {0, 0} 1843 } 1844 }, 1845 {1, 1, 2, 0, /* 0xfd */ 1846 {{0, 0}, 1847 {2, 7}, 1848 {0, 0}, 1849 {0, 0} 1850 } 1851 }, 1852 {0, 1, 1, 0, /* 0xfe */ 1853 {{1, 7}, 1854 {0, 0}, 1855 {0, 0}, 1856 {0, 0} 1857 } 1858 }, 1859 {1, 1, 1, 0, /* 0xff */ 1860 {{0, 7}, 1861 {0, 0}, 1862 {0, 0}, 1863 {0, 0} 1864 } 1865 } 1866 }; 1867 1868 1869 int 1870 sctp_is_address_in_scope(struct sctp_ifa *ifa, 1871 struct sctp_scoping *scope, 1872 int do_update) 1873 { 1874 if ((scope->loopback_scope == 0) && 1875 (ifa->ifn_p) && SCTP_IFN_IS_IFT_LOOP(ifa->ifn_p)) { 1876 /* 1877 * skip loopback if not in scope * 1878 */ 1879 return (0); 1880 } 1881 switch (ifa->address.sa.sa_family) { 1882 #ifdef INET 1883 case AF_INET: 1884 if (scope->ipv4_addr_legal) { 1885 struct sockaddr_in *sin; 1886 1887 sin = &ifa->address.sin; 1888 if (sin->sin_addr.s_addr == 0) { 1889 /* not in scope , unspecified */ 1890 return (0); 1891 } 1892 if ((scope->ipv4_local_scope == 0) && 1893 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 1894 /* private address not in scope */ 1895 return (0); 1896 } 1897 } else { 1898 return (0); 1899 } 1900 break; 1901 #endif 1902 #ifdef INET6 1903 case AF_INET6: 1904 if (scope->ipv6_addr_legal) { 1905 struct sockaddr_in6 *sin6; 1906 1907 /* 1908 * Must update the flags, bummer, which means any 1909 * IFA locks must now be applied HERE <-> 1910 */ 1911 if (do_update) { 1912 sctp_gather_internal_ifa_flags(ifa); 1913 } 1914 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 1915 return (0); 1916 } 1917 /* ok to use deprecated addresses? */ 1918 sin6 = &ifa->address.sin6; 1919 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1920 /* skip unspecifed addresses */ 1921 return (0); 1922 } 1923 if ( /* (local_scope == 0) && */ 1924 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) { 1925 return (0); 1926 } 1927 if ((scope->site_scope == 0) && 1928 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 1929 return (0); 1930 } 1931 } else { 1932 return (0); 1933 } 1934 break; 1935 #endif 1936 default: 1937 return (0); 1938 } 1939 return (1); 1940 } 1941 1942 static struct mbuf * 1943 sctp_add_addr_to_mbuf(struct mbuf *m, struct sctp_ifa *ifa, uint16_t *len) 1944 { 1945 #if defined(INET) || defined(INET6) 1946 struct sctp_paramhdr *paramh; 1947 struct mbuf *mret; 1948 uint16_t plen; 1949 #endif 1950 1951 switch (ifa->address.sa.sa_family) { 1952 #ifdef INET 1953 case AF_INET: 1954 plen = (uint16_t)sizeof(struct sctp_ipv4addr_param); 1955 break; 1956 #endif 1957 #ifdef INET6 1958 case AF_INET6: 1959 plen = (uint16_t)sizeof(struct sctp_ipv6addr_param); 1960 break; 1961 #endif 1962 default: 1963 return (m); 1964 } 1965 #if defined(INET) || defined(INET6) 1966 if (M_TRAILINGSPACE(m) >= plen) { 1967 /* easy side we just drop it on the end */ 1968 paramh = (struct sctp_paramhdr *)(SCTP_BUF_AT(m, SCTP_BUF_LEN(m))); 1969 mret = m; 1970 } else { 1971 /* Need more space */ 1972 mret = m; 1973 while (SCTP_BUF_NEXT(mret) != NULL) { 1974 mret = SCTP_BUF_NEXT(mret); 1975 } 1976 SCTP_BUF_NEXT(mret) = sctp_get_mbuf_for_msg(plen, 0, M_NOWAIT, 1, MT_DATA); 1977 if (SCTP_BUF_NEXT(mret) == NULL) { 1978 /* We are hosed, can't add more addresses */ 1979 return (m); 1980 } 1981 mret = SCTP_BUF_NEXT(mret); 1982 paramh = mtod(mret, struct sctp_paramhdr *); 1983 } 1984 /* now add the parameter */ 1985 switch (ifa->address.sa.sa_family) { 1986 #ifdef INET 1987 case AF_INET: 1988 { 1989 struct sctp_ipv4addr_param *ipv4p; 1990 struct sockaddr_in *sin; 1991 1992 sin = &ifa->address.sin; 1993 ipv4p = (struct sctp_ipv4addr_param *)paramh; 1994 paramh->param_type = htons(SCTP_IPV4_ADDRESS); 1995 paramh->param_length = htons(plen); 1996 ipv4p->addr = sin->sin_addr.s_addr; 1997 SCTP_BUF_LEN(mret) += plen; 1998 break; 1999 } 2000 #endif 2001 #ifdef INET6 2002 case AF_INET6: 2003 { 2004 struct sctp_ipv6addr_param *ipv6p; 2005 struct sockaddr_in6 *sin6; 2006 2007 sin6 = &ifa->address.sin6; 2008 ipv6p = (struct sctp_ipv6addr_param *)paramh; 2009 paramh->param_type = htons(SCTP_IPV6_ADDRESS); 2010 paramh->param_length = htons(plen); 2011 memcpy(ipv6p->addr, &sin6->sin6_addr, 2012 sizeof(ipv6p->addr)); 2013 /* clear embedded scope in the address */ 2014 in6_clearscope((struct in6_addr *)ipv6p->addr); 2015 SCTP_BUF_LEN(mret) += plen; 2016 break; 2017 } 2018 #endif 2019 default: 2020 return (m); 2021 } 2022 if (len != NULL) { 2023 *len += plen; 2024 } 2025 return (mret); 2026 #endif 2027 } 2028 2029 2030 struct mbuf * 2031 sctp_add_addresses_to_i_ia(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2032 struct sctp_scoping *scope, 2033 struct mbuf *m_at, int cnt_inits_to, 2034 uint16_t *padding_len, uint16_t *chunk_len) 2035 { 2036 struct sctp_vrf *vrf = NULL; 2037 int cnt, limit_out = 0, total_count; 2038 uint32_t vrf_id; 2039 2040 vrf_id = inp->def_vrf_id; 2041 SCTP_IPI_ADDR_RLOCK(); 2042 vrf = sctp_find_vrf(vrf_id); 2043 if (vrf == NULL) { 2044 SCTP_IPI_ADDR_RUNLOCK(); 2045 return (m_at); 2046 } 2047 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 2048 struct sctp_ifa *sctp_ifap; 2049 struct sctp_ifn *sctp_ifnp; 2050 2051 cnt = cnt_inits_to; 2052 if (vrf->total_ifa_count > SCTP_COUNT_LIMIT) { 2053 limit_out = 1; 2054 cnt = SCTP_ADDRESS_LIMIT; 2055 goto skip_count; 2056 } 2057 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2058 if ((scope->loopback_scope == 0) && 2059 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2060 /* 2061 * Skip loopback devices if loopback_scope 2062 * not set 2063 */ 2064 continue; 2065 } 2066 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2067 #ifdef INET 2068 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2069 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2070 &sctp_ifap->address.sin.sin_addr) != 0)) { 2071 continue; 2072 } 2073 #endif 2074 #ifdef INET6 2075 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2076 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2077 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2078 continue; 2079 } 2080 #endif 2081 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2082 continue; 2083 } 2084 if (sctp_is_address_in_scope(sctp_ifap, scope, 1) == 0) { 2085 continue; 2086 } 2087 cnt++; 2088 if (cnt > SCTP_ADDRESS_LIMIT) { 2089 break; 2090 } 2091 } 2092 if (cnt > SCTP_ADDRESS_LIMIT) { 2093 break; 2094 } 2095 } 2096 skip_count: 2097 if (cnt > 1) { 2098 total_count = 0; 2099 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2100 cnt = 0; 2101 if ((scope->loopback_scope == 0) && 2102 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2103 /* 2104 * Skip loopback devices if 2105 * loopback_scope not set 2106 */ 2107 continue; 2108 } 2109 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2110 #ifdef INET 2111 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2112 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2113 &sctp_ifap->address.sin.sin_addr) != 0)) { 2114 continue; 2115 } 2116 #endif 2117 #ifdef INET6 2118 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2119 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2120 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2121 continue; 2122 } 2123 #endif 2124 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2125 continue; 2126 } 2127 if (sctp_is_address_in_scope(sctp_ifap, 2128 scope, 0) == 0) { 2129 continue; 2130 } 2131 if ((chunk_len != NULL) && 2132 (padding_len != NULL) && 2133 (*padding_len > 0)) { 2134 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2135 SCTP_BUF_LEN(m_at) += *padding_len; 2136 *chunk_len += *padding_len; 2137 *padding_len = 0; 2138 } 2139 m_at = sctp_add_addr_to_mbuf(m_at, sctp_ifap, chunk_len); 2140 if (limit_out) { 2141 cnt++; 2142 total_count++; 2143 if (cnt >= 2) { 2144 /* 2145 * two from each 2146 * address 2147 */ 2148 break; 2149 } 2150 if (total_count > SCTP_ADDRESS_LIMIT) { 2151 /* No more addresses */ 2152 break; 2153 } 2154 } 2155 } 2156 } 2157 } 2158 } else { 2159 struct sctp_laddr *laddr; 2160 2161 cnt = cnt_inits_to; 2162 /* First, how many ? */ 2163 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2164 if (laddr->ifa == NULL) { 2165 continue; 2166 } 2167 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) 2168 /* 2169 * Address being deleted by the system, dont 2170 * list. 2171 */ 2172 continue; 2173 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2174 /* 2175 * Address being deleted on this ep don't 2176 * list. 2177 */ 2178 continue; 2179 } 2180 if (sctp_is_address_in_scope(laddr->ifa, 2181 scope, 1) == 0) { 2182 continue; 2183 } 2184 cnt++; 2185 } 2186 /* 2187 * To get through a NAT we only list addresses if we have 2188 * more than one. That way if you just bind a single address 2189 * we let the source of the init dictate our address. 2190 */ 2191 if (cnt > 1) { 2192 cnt = cnt_inits_to; 2193 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2194 if (laddr->ifa == NULL) { 2195 continue; 2196 } 2197 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) { 2198 continue; 2199 } 2200 if (sctp_is_address_in_scope(laddr->ifa, 2201 scope, 0) == 0) { 2202 continue; 2203 } 2204 if ((chunk_len != NULL) && 2205 (padding_len != NULL) && 2206 (*padding_len > 0)) { 2207 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2208 SCTP_BUF_LEN(m_at) += *padding_len; 2209 *chunk_len += *padding_len; 2210 *padding_len = 0; 2211 } 2212 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa, chunk_len); 2213 cnt++; 2214 if (cnt >= SCTP_ADDRESS_LIMIT) { 2215 break; 2216 } 2217 } 2218 } 2219 } 2220 SCTP_IPI_ADDR_RUNLOCK(); 2221 return (m_at); 2222 } 2223 2224 static struct sctp_ifa * 2225 sctp_is_ifa_addr_preferred(struct sctp_ifa *ifa, 2226 uint8_t dest_is_loop, 2227 uint8_t dest_is_priv, 2228 sa_family_t fam) 2229 { 2230 uint8_t dest_is_global = 0; 2231 2232 /* dest_is_priv is true if destination is a private address */ 2233 /* dest_is_loop is true if destination is a loopback addresses */ 2234 2235 /** 2236 * Here we determine if its a preferred address. A preferred address 2237 * means it is the same scope or higher scope then the destination. 2238 * L = loopback, P = private, G = global 2239 * ----------------------------------------- 2240 * src | dest | result 2241 * ---------------------------------------- 2242 * L | L | yes 2243 * ----------------------------------------- 2244 * P | L | yes-v4 no-v6 2245 * ----------------------------------------- 2246 * G | L | yes-v4 no-v6 2247 * ----------------------------------------- 2248 * L | P | no 2249 * ----------------------------------------- 2250 * P | P | yes 2251 * ----------------------------------------- 2252 * G | P | no 2253 * ----------------------------------------- 2254 * L | G | no 2255 * ----------------------------------------- 2256 * P | G | no 2257 * ----------------------------------------- 2258 * G | G | yes 2259 * ----------------------------------------- 2260 */ 2261 2262 if (ifa->address.sa.sa_family != fam) { 2263 /* forget mis-matched family */ 2264 return (NULL); 2265 } 2266 if ((dest_is_priv == 0) && (dest_is_loop == 0)) { 2267 dest_is_global = 1; 2268 } 2269 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Is destination preferred:"); 2270 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ifa->address.sa); 2271 /* Ok the address may be ok */ 2272 #ifdef INET6 2273 if (fam == AF_INET6) { 2274 /* ok to use deprecated addresses? no lets not! */ 2275 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2276 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:1\n"); 2277 return (NULL); 2278 } 2279 if (ifa->src_is_priv && !ifa->src_is_loop) { 2280 if (dest_is_loop) { 2281 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:2\n"); 2282 return (NULL); 2283 } 2284 } 2285 if (ifa->src_is_glob) { 2286 if (dest_is_loop) { 2287 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:3\n"); 2288 return (NULL); 2289 } 2290 } 2291 } 2292 #endif 2293 /* 2294 * Now that we know what is what, implement or table this could in 2295 * theory be done slicker (it used to be), but this is 2296 * straightforward and easier to validate :-) 2297 */ 2298 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src_loop:%d src_priv:%d src_glob:%d\n", 2299 ifa->src_is_loop, ifa->src_is_priv, ifa->src_is_glob); 2300 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dest_loop:%d dest_priv:%d dest_glob:%d\n", 2301 dest_is_loop, dest_is_priv, dest_is_global); 2302 2303 if ((ifa->src_is_loop) && (dest_is_priv)) { 2304 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:4\n"); 2305 return (NULL); 2306 } 2307 if ((ifa->src_is_glob) && (dest_is_priv)) { 2308 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:5\n"); 2309 return (NULL); 2310 } 2311 if ((ifa->src_is_loop) && (dest_is_global)) { 2312 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:6\n"); 2313 return (NULL); 2314 } 2315 if ((ifa->src_is_priv) && (dest_is_global)) { 2316 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:7\n"); 2317 return (NULL); 2318 } 2319 SCTPDBG(SCTP_DEBUG_OUTPUT3, "YES\n"); 2320 /* its a preferred address */ 2321 return (ifa); 2322 } 2323 2324 static struct sctp_ifa * 2325 sctp_is_ifa_addr_acceptable(struct sctp_ifa *ifa, 2326 uint8_t dest_is_loop, 2327 uint8_t dest_is_priv, 2328 sa_family_t fam) 2329 { 2330 uint8_t dest_is_global = 0; 2331 2332 /** 2333 * Here we determine if its a acceptable address. A acceptable 2334 * address means it is the same scope or higher scope but we can 2335 * allow for NAT which means its ok to have a global dest and a 2336 * private src. 2337 * 2338 * L = loopback, P = private, G = global 2339 * ----------------------------------------- 2340 * src | dest | result 2341 * ----------------------------------------- 2342 * L | L | yes 2343 * ----------------------------------------- 2344 * P | L | yes-v4 no-v6 2345 * ----------------------------------------- 2346 * G | L | yes 2347 * ----------------------------------------- 2348 * L | P | no 2349 * ----------------------------------------- 2350 * P | P | yes 2351 * ----------------------------------------- 2352 * G | P | yes - May not work 2353 * ----------------------------------------- 2354 * L | G | no 2355 * ----------------------------------------- 2356 * P | G | yes - May not work 2357 * ----------------------------------------- 2358 * G | G | yes 2359 * ----------------------------------------- 2360 */ 2361 2362 if (ifa->address.sa.sa_family != fam) { 2363 /* forget non matching family */ 2364 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa_fam:%d fam:%d\n", 2365 ifa->address.sa.sa_family, fam); 2366 return (NULL); 2367 } 2368 /* Ok the address may be ok */ 2369 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, &ifa->address.sa); 2370 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst_is_loop:%d dest_is_priv:%d\n", 2371 dest_is_loop, dest_is_priv); 2372 if ((dest_is_loop == 0) && (dest_is_priv == 0)) { 2373 dest_is_global = 1; 2374 } 2375 #ifdef INET6 2376 if (fam == AF_INET6) { 2377 /* ok to use deprecated addresses? */ 2378 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2379 return (NULL); 2380 } 2381 if (ifa->src_is_priv) { 2382 /* Special case, linklocal to loop */ 2383 if (dest_is_loop) 2384 return (NULL); 2385 } 2386 } 2387 #endif 2388 /* 2389 * Now that we know what is what, implement our table. This could in 2390 * theory be done slicker (it used to be), but this is 2391 * straightforward and easier to validate :-) 2392 */ 2393 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_priv:%d\n", 2394 ifa->src_is_loop, 2395 dest_is_priv); 2396 if ((ifa->src_is_loop == 1) && (dest_is_priv)) { 2397 return (NULL); 2398 } 2399 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_glob:%d\n", 2400 ifa->src_is_loop, 2401 dest_is_global); 2402 if ((ifa->src_is_loop == 1) && (dest_is_global)) { 2403 return (NULL); 2404 } 2405 SCTPDBG(SCTP_DEBUG_OUTPUT3, "address is acceptable\n"); 2406 /* its an acceptable address */ 2407 return (ifa); 2408 } 2409 2410 int 2411 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa) 2412 { 2413 struct sctp_laddr *laddr; 2414 2415 if (stcb == NULL) { 2416 /* There are no restrictions, no TCB :-) */ 2417 return (0); 2418 } 2419 LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) { 2420 if (laddr->ifa == NULL) { 2421 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2422 __func__); 2423 continue; 2424 } 2425 if (laddr->ifa == ifa) { 2426 /* Yes it is on the list */ 2427 return (1); 2428 } 2429 } 2430 return (0); 2431 } 2432 2433 2434 int 2435 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa) 2436 { 2437 struct sctp_laddr *laddr; 2438 2439 if (ifa == NULL) 2440 return (0); 2441 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2442 if (laddr->ifa == NULL) { 2443 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2444 __func__); 2445 continue; 2446 } 2447 if ((laddr->ifa == ifa) && laddr->action == 0) 2448 /* same pointer */ 2449 return (1); 2450 } 2451 return (0); 2452 } 2453 2454 2455 2456 static struct sctp_ifa * 2457 sctp_choose_boundspecific_inp(struct sctp_inpcb *inp, 2458 sctp_route_t *ro, 2459 uint32_t vrf_id, 2460 int non_asoc_addr_ok, 2461 uint8_t dest_is_priv, 2462 uint8_t dest_is_loop, 2463 sa_family_t fam) 2464 { 2465 struct sctp_laddr *laddr, *starting_point; 2466 void *ifn; 2467 int resettotop = 0; 2468 struct sctp_ifn *sctp_ifn; 2469 struct sctp_ifa *sctp_ifa, *sifa; 2470 struct sctp_vrf *vrf; 2471 uint32_t ifn_index; 2472 2473 vrf = sctp_find_vrf(vrf_id); 2474 if (vrf == NULL) 2475 return (NULL); 2476 2477 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2478 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2479 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2480 /* 2481 * first question, is the ifn we will emit on in our list, if so, we 2482 * want such an address. Note that we first looked for a preferred 2483 * address. 2484 */ 2485 if (sctp_ifn) { 2486 /* is a preferred one on the interface we route out? */ 2487 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2488 #ifdef INET 2489 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2490 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2491 &sctp_ifa->address.sin.sin_addr) != 0)) { 2492 continue; 2493 } 2494 #endif 2495 #ifdef INET6 2496 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2497 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2498 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2499 continue; 2500 } 2501 #endif 2502 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2503 (non_asoc_addr_ok == 0)) 2504 continue; 2505 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, 2506 dest_is_loop, 2507 dest_is_priv, fam); 2508 if (sifa == NULL) 2509 continue; 2510 if (sctp_is_addr_in_ep(inp, sifa)) { 2511 atomic_add_int(&sifa->refcount, 1); 2512 return (sifa); 2513 } 2514 } 2515 } 2516 /* 2517 * ok, now we now need to find one on the list of the addresses. We 2518 * can't get one on the emitting interface so let's find first a 2519 * preferred one. If not that an acceptable one otherwise... we 2520 * return NULL. 2521 */ 2522 starting_point = inp->next_addr_touse; 2523 once_again: 2524 if (inp->next_addr_touse == NULL) { 2525 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2526 resettotop = 1; 2527 } 2528 for (laddr = inp->next_addr_touse; laddr; 2529 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2530 if (laddr->ifa == NULL) { 2531 /* address has been removed */ 2532 continue; 2533 } 2534 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2535 /* address is being deleted */ 2536 continue; 2537 } 2538 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, 2539 dest_is_priv, fam); 2540 if (sifa == NULL) 2541 continue; 2542 atomic_add_int(&sifa->refcount, 1); 2543 return (sifa); 2544 } 2545 if (resettotop == 0) { 2546 inp->next_addr_touse = NULL; 2547 goto once_again; 2548 } 2549 2550 inp->next_addr_touse = starting_point; 2551 resettotop = 0; 2552 once_again_too: 2553 if (inp->next_addr_touse == NULL) { 2554 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2555 resettotop = 1; 2556 } 2557 2558 /* ok, what about an acceptable address in the inp */ 2559 for (laddr = inp->next_addr_touse; laddr; 2560 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2561 if (laddr->ifa == NULL) { 2562 /* address has been removed */ 2563 continue; 2564 } 2565 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2566 /* address is being deleted */ 2567 continue; 2568 } 2569 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2570 dest_is_priv, fam); 2571 if (sifa == NULL) 2572 continue; 2573 atomic_add_int(&sifa->refcount, 1); 2574 return (sifa); 2575 } 2576 if (resettotop == 0) { 2577 inp->next_addr_touse = NULL; 2578 goto once_again_too; 2579 } 2580 2581 /* 2582 * no address bound can be a source for the destination we are in 2583 * trouble 2584 */ 2585 return (NULL); 2586 } 2587 2588 2589 2590 static struct sctp_ifa * 2591 sctp_choose_boundspecific_stcb(struct sctp_inpcb *inp, 2592 struct sctp_tcb *stcb, 2593 sctp_route_t *ro, 2594 uint32_t vrf_id, 2595 uint8_t dest_is_priv, 2596 uint8_t dest_is_loop, 2597 int non_asoc_addr_ok, 2598 sa_family_t fam) 2599 { 2600 struct sctp_laddr *laddr, *starting_point; 2601 void *ifn; 2602 struct sctp_ifn *sctp_ifn; 2603 struct sctp_ifa *sctp_ifa, *sifa; 2604 uint8_t start_at_beginning = 0; 2605 struct sctp_vrf *vrf; 2606 uint32_t ifn_index; 2607 2608 /* 2609 * first question, is the ifn we will emit on in our list, if so, we 2610 * want that one. 2611 */ 2612 vrf = sctp_find_vrf(vrf_id); 2613 if (vrf == NULL) 2614 return (NULL); 2615 2616 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2617 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2618 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2619 2620 /* 2621 * first question, is the ifn we will emit on in our list? If so, 2622 * we want that one. First we look for a preferred. Second, we go 2623 * for an acceptable. 2624 */ 2625 if (sctp_ifn) { 2626 /* first try for a preferred address on the ep */ 2627 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2628 #ifdef INET 2629 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2630 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2631 &sctp_ifa->address.sin.sin_addr) != 0)) { 2632 continue; 2633 } 2634 #endif 2635 #ifdef INET6 2636 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2637 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2638 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2639 continue; 2640 } 2641 #endif 2642 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2643 continue; 2644 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2645 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2646 if (sifa == NULL) 2647 continue; 2648 if (((non_asoc_addr_ok == 0) && 2649 (sctp_is_addr_restricted(stcb, sifa))) || 2650 (non_asoc_addr_ok && 2651 (sctp_is_addr_restricted(stcb, sifa)) && 2652 (!sctp_is_addr_pending(stcb, sifa)))) { 2653 /* on the no-no list */ 2654 continue; 2655 } 2656 atomic_add_int(&sifa->refcount, 1); 2657 return (sifa); 2658 } 2659 } 2660 /* next try for an acceptable address on the ep */ 2661 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2662 #ifdef INET 2663 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2664 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2665 &sctp_ifa->address.sin.sin_addr) != 0)) { 2666 continue; 2667 } 2668 #endif 2669 #ifdef INET6 2670 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2671 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2672 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2673 continue; 2674 } 2675 #endif 2676 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2677 continue; 2678 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2679 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2680 if (sifa == NULL) 2681 continue; 2682 if (((non_asoc_addr_ok == 0) && 2683 (sctp_is_addr_restricted(stcb, sifa))) || 2684 (non_asoc_addr_ok && 2685 (sctp_is_addr_restricted(stcb, sifa)) && 2686 (!sctp_is_addr_pending(stcb, sifa)))) { 2687 /* on the no-no list */ 2688 continue; 2689 } 2690 atomic_add_int(&sifa->refcount, 1); 2691 return (sifa); 2692 } 2693 } 2694 2695 } 2696 /* 2697 * if we can't find one like that then we must look at all addresses 2698 * bound to pick one at first preferable then secondly acceptable. 2699 */ 2700 starting_point = stcb->asoc.last_used_address; 2701 sctp_from_the_top: 2702 if (stcb->asoc.last_used_address == NULL) { 2703 start_at_beginning = 1; 2704 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2705 } 2706 /* search beginning with the last used address */ 2707 for (laddr = stcb->asoc.last_used_address; laddr; 2708 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2709 if (laddr->ifa == NULL) { 2710 /* address has been removed */ 2711 continue; 2712 } 2713 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2714 /* address is being deleted */ 2715 continue; 2716 } 2717 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, dest_is_priv, fam); 2718 if (sifa == NULL) 2719 continue; 2720 if (((non_asoc_addr_ok == 0) && 2721 (sctp_is_addr_restricted(stcb, sifa))) || 2722 (non_asoc_addr_ok && 2723 (sctp_is_addr_restricted(stcb, sifa)) && 2724 (!sctp_is_addr_pending(stcb, sifa)))) { 2725 /* on the no-no list */ 2726 continue; 2727 } 2728 stcb->asoc.last_used_address = laddr; 2729 atomic_add_int(&sifa->refcount, 1); 2730 return (sifa); 2731 } 2732 if (start_at_beginning == 0) { 2733 stcb->asoc.last_used_address = NULL; 2734 goto sctp_from_the_top; 2735 } 2736 /* now try for any higher scope than the destination */ 2737 stcb->asoc.last_used_address = starting_point; 2738 start_at_beginning = 0; 2739 sctp_from_the_top2: 2740 if (stcb->asoc.last_used_address == NULL) { 2741 start_at_beginning = 1; 2742 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2743 } 2744 /* search beginning with the last used address */ 2745 for (laddr = stcb->asoc.last_used_address; laddr; 2746 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2747 if (laddr->ifa == NULL) { 2748 /* address has been removed */ 2749 continue; 2750 } 2751 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2752 /* address is being deleted */ 2753 continue; 2754 } 2755 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2756 dest_is_priv, fam); 2757 if (sifa == NULL) 2758 continue; 2759 if (((non_asoc_addr_ok == 0) && 2760 (sctp_is_addr_restricted(stcb, sifa))) || 2761 (non_asoc_addr_ok && 2762 (sctp_is_addr_restricted(stcb, sifa)) && 2763 (!sctp_is_addr_pending(stcb, sifa)))) { 2764 /* on the no-no list */ 2765 continue; 2766 } 2767 stcb->asoc.last_used_address = laddr; 2768 atomic_add_int(&sifa->refcount, 1); 2769 return (sifa); 2770 } 2771 if (start_at_beginning == 0) { 2772 stcb->asoc.last_used_address = NULL; 2773 goto sctp_from_the_top2; 2774 } 2775 return (NULL); 2776 } 2777 2778 static struct sctp_ifa * 2779 sctp_select_nth_preferred_addr_from_ifn_boundall(struct sctp_ifn *ifn, 2780 struct sctp_inpcb *inp, 2781 struct sctp_tcb *stcb, 2782 int non_asoc_addr_ok, 2783 uint8_t dest_is_loop, 2784 uint8_t dest_is_priv, 2785 int addr_wanted, 2786 sa_family_t fam, 2787 sctp_route_t *ro 2788 ) 2789 { 2790 struct sctp_ifa *ifa, *sifa; 2791 int num_eligible_addr = 0; 2792 #ifdef INET6 2793 struct sockaddr_in6 sin6, lsa6; 2794 2795 if (fam == AF_INET6) { 2796 memcpy(&sin6, &ro->ro_dst, sizeof(struct sockaddr_in6)); 2797 (void)sa6_recoverscope(&sin6); 2798 } 2799 #endif /* INET6 */ 2800 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2801 #ifdef INET 2802 if ((ifa->address.sa.sa_family == AF_INET) && 2803 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2804 &ifa->address.sin.sin_addr) != 0)) { 2805 continue; 2806 } 2807 #endif 2808 #ifdef INET6 2809 if ((ifa->address.sa.sa_family == AF_INET6) && 2810 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2811 &ifa->address.sin6.sin6_addr) != 0)) { 2812 continue; 2813 } 2814 #endif 2815 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2816 (non_asoc_addr_ok == 0)) 2817 continue; 2818 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2819 dest_is_priv, fam); 2820 if (sifa == NULL) 2821 continue; 2822 #ifdef INET6 2823 if (fam == AF_INET6 && 2824 dest_is_loop && 2825 sifa->src_is_loop && sifa->src_is_priv) { 2826 /* 2827 * don't allow fe80::1 to be a src on loop ::1, we 2828 * don't list it to the peer so we will get an 2829 * abort. 2830 */ 2831 continue; 2832 } 2833 if (fam == AF_INET6 && 2834 IN6_IS_ADDR_LINKLOCAL(&sifa->address.sin6.sin6_addr) && 2835 IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) { 2836 /* 2837 * link-local <-> link-local must belong to the same 2838 * scope. 2839 */ 2840 memcpy(&lsa6, &sifa->address.sin6, sizeof(struct sockaddr_in6)); 2841 (void)sa6_recoverscope(&lsa6); 2842 if (sin6.sin6_scope_id != lsa6.sin6_scope_id) { 2843 continue; 2844 } 2845 } 2846 #endif /* INET6 */ 2847 2848 /* 2849 * Check if the IPv6 address matches to next-hop. In the 2850 * mobile case, old IPv6 address may be not deleted from the 2851 * interface. Then, the interface has previous and new 2852 * addresses. We should use one corresponding to the 2853 * next-hop. (by micchie) 2854 */ 2855 #ifdef INET6 2856 if (stcb && fam == AF_INET6 && 2857 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2858 if (sctp_v6src_match_nexthop(&sifa->address.sin6, ro) 2859 == 0) { 2860 continue; 2861 } 2862 } 2863 #endif 2864 #ifdef INET 2865 /* Avoid topologically incorrect IPv4 address */ 2866 if (stcb && fam == AF_INET && 2867 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2868 if (sctp_v4src_match_nexthop(sifa, ro) == 0) { 2869 continue; 2870 } 2871 } 2872 #endif 2873 if (stcb) { 2874 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2875 continue; 2876 } 2877 if (((non_asoc_addr_ok == 0) && 2878 (sctp_is_addr_restricted(stcb, sifa))) || 2879 (non_asoc_addr_ok && 2880 (sctp_is_addr_restricted(stcb, sifa)) && 2881 (!sctp_is_addr_pending(stcb, sifa)))) { 2882 /* 2883 * It is restricted for some reason.. 2884 * probably not yet added. 2885 */ 2886 continue; 2887 } 2888 } 2889 if (num_eligible_addr >= addr_wanted) { 2890 return (sifa); 2891 } 2892 num_eligible_addr++; 2893 } 2894 return (NULL); 2895 } 2896 2897 2898 static int 2899 sctp_count_num_preferred_boundall(struct sctp_ifn *ifn, 2900 struct sctp_inpcb *inp, 2901 struct sctp_tcb *stcb, 2902 int non_asoc_addr_ok, 2903 uint8_t dest_is_loop, 2904 uint8_t dest_is_priv, 2905 sa_family_t fam) 2906 { 2907 struct sctp_ifa *ifa, *sifa; 2908 int num_eligible_addr = 0; 2909 2910 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2911 #ifdef INET 2912 if ((ifa->address.sa.sa_family == AF_INET) && 2913 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2914 &ifa->address.sin.sin_addr) != 0)) { 2915 continue; 2916 } 2917 #endif 2918 #ifdef INET6 2919 if ((ifa->address.sa.sa_family == AF_INET6) && 2920 (stcb != NULL) && 2921 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2922 &ifa->address.sin6.sin6_addr) != 0)) { 2923 continue; 2924 } 2925 #endif 2926 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2927 (non_asoc_addr_ok == 0)) { 2928 continue; 2929 } 2930 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2931 dest_is_priv, fam); 2932 if (sifa == NULL) { 2933 continue; 2934 } 2935 if (stcb) { 2936 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2937 continue; 2938 } 2939 if (((non_asoc_addr_ok == 0) && 2940 (sctp_is_addr_restricted(stcb, sifa))) || 2941 (non_asoc_addr_ok && 2942 (sctp_is_addr_restricted(stcb, sifa)) && 2943 (!sctp_is_addr_pending(stcb, sifa)))) { 2944 /* 2945 * It is restricted for some reason.. 2946 * probably not yet added. 2947 */ 2948 continue; 2949 } 2950 } 2951 num_eligible_addr++; 2952 } 2953 return (num_eligible_addr); 2954 } 2955 2956 static struct sctp_ifa * 2957 sctp_choose_boundall(struct sctp_inpcb *inp, 2958 struct sctp_tcb *stcb, 2959 struct sctp_nets *net, 2960 sctp_route_t *ro, 2961 uint32_t vrf_id, 2962 uint8_t dest_is_priv, 2963 uint8_t dest_is_loop, 2964 int non_asoc_addr_ok, 2965 sa_family_t fam) 2966 { 2967 int cur_addr_num = 0, num_preferred = 0; 2968 void *ifn; 2969 struct sctp_ifn *sctp_ifn, *looked_at = NULL, *emit_ifn; 2970 struct sctp_ifa *sctp_ifa, *sifa; 2971 uint32_t ifn_index; 2972 struct sctp_vrf *vrf; 2973 #ifdef INET 2974 int retried = 0; 2975 #endif 2976 2977 /*- 2978 * For boundall we can use any address in the association. 2979 * If non_asoc_addr_ok is set we can use any address (at least in 2980 * theory). So we look for preferred addresses first. If we find one, 2981 * we use it. Otherwise we next try to get an address on the 2982 * interface, which we should be able to do (unless non_asoc_addr_ok 2983 * is false and we are routed out that way). In these cases where we 2984 * can't use the address of the interface we go through all the 2985 * ifn's looking for an address we can use and fill that in. Punting 2986 * means we send back address 0, which will probably cause problems 2987 * actually since then IP will fill in the address of the route ifn, 2988 * which means we probably already rejected it.. i.e. here comes an 2989 * abort :-<. 2990 */ 2991 vrf = sctp_find_vrf(vrf_id); 2992 if (vrf == NULL) 2993 return (NULL); 2994 2995 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2996 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2997 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn from route:%p ifn_index:%d\n", ifn, ifn_index); 2998 emit_ifn = looked_at = sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2999 if (sctp_ifn == NULL) { 3000 /* ?? We don't have this guy ?? */ 3001 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No ifn emit interface?\n"); 3002 goto bound_all_plan_b; 3003 } 3004 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn_index:%d name:%s is emit interface\n", 3005 ifn_index, sctp_ifn->ifn_name); 3006 3007 if (net) { 3008 cur_addr_num = net->indx_of_eligible_next_to_use; 3009 } 3010 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, 3011 inp, stcb, 3012 non_asoc_addr_ok, 3013 dest_is_loop, 3014 dest_is_priv, fam); 3015 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Found %d preferred source addresses for intf:%s\n", 3016 num_preferred, sctp_ifn->ifn_name); 3017 if (num_preferred == 0) { 3018 /* 3019 * no eligible addresses, we must use some other interface 3020 * address if we can find one. 3021 */ 3022 goto bound_all_plan_b; 3023 } 3024 /* 3025 * Ok we have num_eligible_addr set with how many we can use, this 3026 * may vary from call to call due to addresses being deprecated 3027 * etc.. 3028 */ 3029 if (cur_addr_num >= num_preferred) { 3030 cur_addr_num = 0; 3031 } 3032 /* 3033 * select the nth address from the list (where cur_addr_num is the 3034 * nth) and 0 is the first one, 1 is the second one etc... 3035 */ 3036 SCTPDBG(SCTP_DEBUG_OUTPUT2, "cur_addr_num:%d\n", cur_addr_num); 3037 3038 sctp_ifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3039 dest_is_priv, cur_addr_num, fam, ro); 3040 3041 /* if sctp_ifa is NULL something changed??, fall to plan b. */ 3042 if (sctp_ifa) { 3043 atomic_add_int(&sctp_ifa->refcount, 1); 3044 if (net) { 3045 /* save off where the next one we will want */ 3046 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3047 } 3048 return (sctp_ifa); 3049 } 3050 /* 3051 * plan_b: Look at all interfaces and find a preferred address. If 3052 * no preferred fall through to plan_c. 3053 */ 3054 bound_all_plan_b: 3055 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan B\n"); 3056 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3057 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Examine interface %s\n", 3058 sctp_ifn->ifn_name); 3059 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3060 /* wrong base scope */ 3061 SCTPDBG(SCTP_DEBUG_OUTPUT2, "skip\n"); 3062 continue; 3063 } 3064 if ((sctp_ifn == looked_at) && looked_at) { 3065 /* already looked at this guy */ 3066 SCTPDBG(SCTP_DEBUG_OUTPUT2, "already seen\n"); 3067 continue; 3068 } 3069 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, 3070 dest_is_loop, dest_is_priv, fam); 3071 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3072 "Found ifn:%p %d preferred source addresses\n", 3073 ifn, num_preferred); 3074 if (num_preferred == 0) { 3075 /* None on this interface. */ 3076 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No preferred -- skipping to next\n"); 3077 continue; 3078 } 3079 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3080 "num preferred:%d on interface:%p cur_addr_num:%d\n", 3081 num_preferred, (void *)sctp_ifn, cur_addr_num); 3082 3083 /* 3084 * Ok we have num_eligible_addr set with how many we can 3085 * use, this may vary from call to call due to addresses 3086 * being deprecated etc.. 3087 */ 3088 if (cur_addr_num >= num_preferred) { 3089 cur_addr_num = 0; 3090 } 3091 sifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3092 dest_is_priv, cur_addr_num, fam, ro); 3093 if (sifa == NULL) 3094 continue; 3095 if (net) { 3096 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3097 SCTPDBG(SCTP_DEBUG_OUTPUT2, "we selected %d\n", 3098 cur_addr_num); 3099 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Source:"); 3100 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 3101 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Dest:"); 3102 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &net->ro._l_addr.sa); 3103 } 3104 atomic_add_int(&sifa->refcount, 1); 3105 return (sifa); 3106 } 3107 #ifdef INET 3108 again_with_private_addresses_allowed: 3109 #endif 3110 /* plan_c: do we have an acceptable address on the emit interface */ 3111 sifa = NULL; 3112 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan C: find acceptable on interface\n"); 3113 if (emit_ifn == NULL) { 3114 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jump to Plan D - no emit_ifn\n"); 3115 goto plan_d; 3116 } 3117 LIST_FOREACH(sctp_ifa, &emit_ifn->ifalist, next_ifa) { 3118 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifa:%p\n", (void *)sctp_ifa); 3119 #ifdef INET 3120 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3121 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3122 &sctp_ifa->address.sin.sin_addr) != 0)) { 3123 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3124 continue; 3125 } 3126 #endif 3127 #ifdef INET6 3128 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3129 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3130 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3131 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3132 continue; 3133 } 3134 #endif 3135 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3136 (non_asoc_addr_ok == 0)) { 3137 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Defer\n"); 3138 continue; 3139 } 3140 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, 3141 dest_is_priv, fam); 3142 if (sifa == NULL) { 3143 SCTPDBG(SCTP_DEBUG_OUTPUT2, "IFA not acceptable\n"); 3144 continue; 3145 } 3146 if (stcb) { 3147 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3148 SCTPDBG(SCTP_DEBUG_OUTPUT2, "NOT in scope\n"); 3149 sifa = NULL; 3150 continue; 3151 } 3152 if (((non_asoc_addr_ok == 0) && 3153 (sctp_is_addr_restricted(stcb, sifa))) || 3154 (non_asoc_addr_ok && 3155 (sctp_is_addr_restricted(stcb, sifa)) && 3156 (!sctp_is_addr_pending(stcb, sifa)))) { 3157 /* 3158 * It is restricted for some reason.. 3159 * probably not yet added. 3160 */ 3161 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Its restricted\n"); 3162 sifa = NULL; 3163 continue; 3164 } 3165 } 3166 atomic_add_int(&sifa->refcount, 1); 3167 goto out; 3168 } 3169 plan_d: 3170 /* 3171 * plan_d: We are in trouble. No preferred address on the emit 3172 * interface. And not even a preferred address on all interfaces. Go 3173 * out and see if we can find an acceptable address somewhere 3174 * amongst all interfaces. 3175 */ 3176 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan D looked_at is %p\n", (void *)looked_at); 3177 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3178 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3179 /* wrong base scope */ 3180 continue; 3181 } 3182 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3183 #ifdef INET 3184 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3185 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3186 &sctp_ifa->address.sin.sin_addr) != 0)) { 3187 continue; 3188 } 3189 #endif 3190 #ifdef INET6 3191 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3192 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3193 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3194 continue; 3195 } 3196 #endif 3197 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3198 (non_asoc_addr_ok == 0)) 3199 continue; 3200 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3201 dest_is_loop, 3202 dest_is_priv, fam); 3203 if (sifa == NULL) 3204 continue; 3205 if (stcb) { 3206 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3207 sifa = NULL; 3208 continue; 3209 } 3210 if (((non_asoc_addr_ok == 0) && 3211 (sctp_is_addr_restricted(stcb, sifa))) || 3212 (non_asoc_addr_ok && 3213 (sctp_is_addr_restricted(stcb, sifa)) && 3214 (!sctp_is_addr_pending(stcb, sifa)))) { 3215 /* 3216 * It is restricted for some 3217 * reason.. probably not yet added. 3218 */ 3219 sifa = NULL; 3220 continue; 3221 } 3222 } 3223 goto out; 3224 } 3225 } 3226 #ifdef INET 3227 if (stcb) { 3228 if ((retried == 0) && (stcb->asoc.scope.ipv4_local_scope == 0)) { 3229 stcb->asoc.scope.ipv4_local_scope = 1; 3230 retried = 1; 3231 goto again_with_private_addresses_allowed; 3232 } else if (retried == 1) { 3233 stcb->asoc.scope.ipv4_local_scope = 0; 3234 } 3235 } 3236 #endif 3237 out: 3238 #ifdef INET 3239 if (sifa) { 3240 if (retried == 1) { 3241 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3242 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3243 /* wrong base scope */ 3244 continue; 3245 } 3246 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3247 struct sctp_ifa *tmp_sifa; 3248 3249 #ifdef INET 3250 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3251 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3252 &sctp_ifa->address.sin.sin_addr) != 0)) { 3253 continue; 3254 } 3255 #endif 3256 #ifdef INET6 3257 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3258 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3259 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3260 continue; 3261 } 3262 #endif 3263 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3264 (non_asoc_addr_ok == 0)) 3265 continue; 3266 tmp_sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3267 dest_is_loop, 3268 dest_is_priv, fam); 3269 if (tmp_sifa == NULL) { 3270 continue; 3271 } 3272 if (tmp_sifa == sifa) { 3273 continue; 3274 } 3275 if (stcb) { 3276 if (sctp_is_address_in_scope(tmp_sifa, 3277 &stcb->asoc.scope, 0) == 0) { 3278 continue; 3279 } 3280 if (((non_asoc_addr_ok == 0) && 3281 (sctp_is_addr_restricted(stcb, tmp_sifa))) || 3282 (non_asoc_addr_ok && 3283 (sctp_is_addr_restricted(stcb, tmp_sifa)) && 3284 (!sctp_is_addr_pending(stcb, tmp_sifa)))) { 3285 /* 3286 * It is restricted 3287 * for some reason.. 3288 * probably not yet 3289 * added. 3290 */ 3291 continue; 3292 } 3293 } 3294 if ((tmp_sifa->address.sin.sin_family == AF_INET) && 3295 (IN4_ISPRIVATE_ADDRESS(&(tmp_sifa->address.sin.sin_addr)))) { 3296 sctp_add_local_addr_restricted(stcb, tmp_sifa); 3297 } 3298 } 3299 } 3300 } 3301 atomic_add_int(&sifa->refcount, 1); 3302 } 3303 #endif 3304 return (sifa); 3305 } 3306 3307 3308 3309 /* tcb may be NULL */ 3310 struct sctp_ifa * 3311 sctp_source_address_selection(struct sctp_inpcb *inp, 3312 struct sctp_tcb *stcb, 3313 sctp_route_t *ro, 3314 struct sctp_nets *net, 3315 int non_asoc_addr_ok, uint32_t vrf_id) 3316 { 3317 struct sctp_ifa *answer; 3318 uint8_t dest_is_priv, dest_is_loop; 3319 sa_family_t fam; 3320 #ifdef INET 3321 struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst; 3322 #endif 3323 #ifdef INET6 3324 struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&ro->ro_dst; 3325 #endif 3326 3327 /** 3328 * Rules: 3329 * - Find the route if needed, cache if I can. 3330 * - Look at interface address in route, Is it in the bound list. If so we 3331 * have the best source. 3332 * - If not we must rotate amongst the addresses. 3333 * 3334 * Cavets and issues 3335 * 3336 * Do we need to pay attention to scope. We can have a private address 3337 * or a global address we are sourcing or sending to. So if we draw 3338 * it out 3339 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3340 * For V4 3341 * ------------------------------------------ 3342 * source * dest * result 3343 * ----------------------------------------- 3344 * <a> Private * Global * NAT 3345 * ----------------------------------------- 3346 * <b> Private * Private * No problem 3347 * ----------------------------------------- 3348 * <c> Global * Private * Huh, How will this work? 3349 * ----------------------------------------- 3350 * <d> Global * Global * No Problem 3351 *------------------------------------------ 3352 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3353 * For V6 3354 *------------------------------------------ 3355 * source * dest * result 3356 * ----------------------------------------- 3357 * <a> Linklocal * Global * 3358 * ----------------------------------------- 3359 * <b> Linklocal * Linklocal * No problem 3360 * ----------------------------------------- 3361 * <c> Global * Linklocal * Huh, How will this work? 3362 * ----------------------------------------- 3363 * <d> Global * Global * No Problem 3364 *------------------------------------------ 3365 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3366 * 3367 * And then we add to that what happens if there are multiple addresses 3368 * assigned to an interface. Remember the ifa on a ifn is a linked 3369 * list of addresses. So one interface can have more than one IP 3370 * address. What happens if we have both a private and a global 3371 * address? Do we then use context of destination to sort out which 3372 * one is best? And what about NAT's sending P->G may get you a NAT 3373 * translation, or should you select the G thats on the interface in 3374 * preference. 3375 * 3376 * Decisions: 3377 * 3378 * - count the number of addresses on the interface. 3379 * - if it is one, no problem except case <c>. 3380 * For <a> we will assume a NAT out there. 3381 * - if there are more than one, then we need to worry about scope P 3382 * or G. We should prefer G -> G and P -> P if possible. 3383 * Then as a secondary fall back to mixed types G->P being a last 3384 * ditch one. 3385 * - The above all works for bound all, but bound specific we need to 3386 * use the same concept but instead only consider the bound 3387 * addresses. If the bound set is NOT assigned to the interface then 3388 * we must use rotation amongst the bound addresses.. 3389 */ 3390 if (ro->ro_rt == NULL) { 3391 /* 3392 * Need a route to cache. 3393 */ 3394 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 3395 } 3396 if (ro->ro_rt == NULL) { 3397 return (NULL); 3398 } 3399 fam = ro->ro_dst.sa_family; 3400 dest_is_priv = dest_is_loop = 0; 3401 /* Setup our scopes for the destination */ 3402 switch (fam) { 3403 #ifdef INET 3404 case AF_INET: 3405 /* Scope based on outbound address */ 3406 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) { 3407 dest_is_loop = 1; 3408 if (net != NULL) { 3409 /* mark it as local */ 3410 net->addr_is_local = 1; 3411 } 3412 } else if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) { 3413 dest_is_priv = 1; 3414 } 3415 break; 3416 #endif 3417 #ifdef INET6 3418 case AF_INET6: 3419 /* Scope based on outbound address */ 3420 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr) || 3421 SCTP_ROUTE_IS_REAL_LOOP(ro)) { 3422 /* 3423 * If the address is a loopback address, which 3424 * consists of "::1" OR "fe80::1%lo0", we are 3425 * loopback scope. But we don't use dest_is_priv 3426 * (link local addresses). 3427 */ 3428 dest_is_loop = 1; 3429 if (net != NULL) { 3430 /* mark it as local */ 3431 net->addr_is_local = 1; 3432 } 3433 } else if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) { 3434 dest_is_priv = 1; 3435 } 3436 break; 3437 #endif 3438 } 3439 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Select source addr for:"); 3440 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&ro->ro_dst); 3441 SCTP_IPI_ADDR_RLOCK(); 3442 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3443 /* 3444 * Bound all case 3445 */ 3446 answer = sctp_choose_boundall(inp, stcb, net, ro, vrf_id, 3447 dest_is_priv, dest_is_loop, 3448 non_asoc_addr_ok, fam); 3449 SCTP_IPI_ADDR_RUNLOCK(); 3450 return (answer); 3451 } 3452 /* 3453 * Subset bound case 3454 */ 3455 if (stcb) { 3456 answer = sctp_choose_boundspecific_stcb(inp, stcb, ro, 3457 vrf_id, dest_is_priv, 3458 dest_is_loop, 3459 non_asoc_addr_ok, fam); 3460 } else { 3461 answer = sctp_choose_boundspecific_inp(inp, ro, vrf_id, 3462 non_asoc_addr_ok, 3463 dest_is_priv, 3464 dest_is_loop, fam); 3465 } 3466 SCTP_IPI_ADDR_RUNLOCK(); 3467 return (answer); 3468 } 3469 3470 static int 3471 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, size_t cpsize) 3472 { 3473 struct cmsghdr cmh; 3474 struct sctp_sndinfo sndinfo; 3475 struct sctp_prinfo prinfo; 3476 struct sctp_authinfo authinfo; 3477 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3478 int found; 3479 3480 /* 3481 * Independent of how many mbufs, find the c_type inside the control 3482 * structure and copy out the data. 3483 */ 3484 found = 0; 3485 tot_len = SCTP_BUF_LEN(control); 3486 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3487 rem_len = tot_len - off; 3488 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3489 /* There is not enough room for one more. */ 3490 return (found); 3491 } 3492 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3493 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3494 /* We dont't have a complete CMSG header. */ 3495 return (found); 3496 } 3497 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3498 /* We don't have the complete CMSG. */ 3499 return (found); 3500 } 3501 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3502 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3503 if ((cmh.cmsg_level == IPPROTO_SCTP) && 3504 ((c_type == cmh.cmsg_type) || 3505 ((c_type == SCTP_SNDRCV) && 3506 ((cmh.cmsg_type == SCTP_SNDINFO) || 3507 (cmh.cmsg_type == SCTP_PRINFO) || 3508 (cmh.cmsg_type == SCTP_AUTHINFO))))) { 3509 if (c_type == cmh.cmsg_type) { 3510 if (cpsize > INT_MAX) { 3511 return (found); 3512 } 3513 if (cmsg_data_len < (int)cpsize) { 3514 return (found); 3515 } 3516 /* It is exactly what we want. Copy it out. */ 3517 m_copydata(control, cmsg_data_off, (int)cpsize, (caddr_t)data); 3518 return (1); 3519 } else { 3520 struct sctp_sndrcvinfo *sndrcvinfo; 3521 3522 sndrcvinfo = (struct sctp_sndrcvinfo *)data; 3523 if (found == 0) { 3524 if (cpsize < sizeof(struct sctp_sndrcvinfo)) { 3525 return (found); 3526 } 3527 memset(sndrcvinfo, 0, sizeof(struct sctp_sndrcvinfo)); 3528 } 3529 switch (cmh.cmsg_type) { 3530 case SCTP_SNDINFO: 3531 if (cmsg_data_len < (int)sizeof(struct sctp_sndinfo)) { 3532 return (found); 3533 } 3534 m_copydata(control, cmsg_data_off, sizeof(struct sctp_sndinfo), (caddr_t)&sndinfo); 3535 sndrcvinfo->sinfo_stream = sndinfo.snd_sid; 3536 sndrcvinfo->sinfo_flags = sndinfo.snd_flags; 3537 sndrcvinfo->sinfo_ppid = sndinfo.snd_ppid; 3538 sndrcvinfo->sinfo_context = sndinfo.snd_context; 3539 sndrcvinfo->sinfo_assoc_id = sndinfo.snd_assoc_id; 3540 break; 3541 case SCTP_PRINFO: 3542 if (cmsg_data_len < (int)sizeof(struct sctp_prinfo)) { 3543 return (found); 3544 } 3545 m_copydata(control, cmsg_data_off, sizeof(struct sctp_prinfo), (caddr_t)&prinfo); 3546 if (prinfo.pr_policy != SCTP_PR_SCTP_NONE) { 3547 sndrcvinfo->sinfo_timetolive = prinfo.pr_value; 3548 } else { 3549 sndrcvinfo->sinfo_timetolive = 0; 3550 } 3551 sndrcvinfo->sinfo_flags |= prinfo.pr_policy; 3552 break; 3553 case SCTP_AUTHINFO: 3554 if (cmsg_data_len < (int)sizeof(struct sctp_authinfo)) { 3555 return (found); 3556 } 3557 m_copydata(control, cmsg_data_off, sizeof(struct sctp_authinfo), (caddr_t)&authinfo); 3558 sndrcvinfo->sinfo_keynumber_valid = 1; 3559 sndrcvinfo->sinfo_keynumber = authinfo.auth_keynumber; 3560 break; 3561 default: 3562 return (found); 3563 } 3564 found = 1; 3565 } 3566 } 3567 } 3568 return (found); 3569 } 3570 3571 static int 3572 sctp_process_cmsgs_for_init(struct sctp_tcb *stcb, struct mbuf *control, int *error) 3573 { 3574 struct cmsghdr cmh; 3575 struct sctp_initmsg initmsg; 3576 #ifdef INET 3577 struct sockaddr_in sin; 3578 #endif 3579 #ifdef INET6 3580 struct sockaddr_in6 sin6; 3581 #endif 3582 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3583 3584 tot_len = SCTP_BUF_LEN(control); 3585 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3586 rem_len = tot_len - off; 3587 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3588 /* There is not enough room for one more. */ 3589 *error = EINVAL; 3590 return (1); 3591 } 3592 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3593 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3594 /* We dont't have a complete CMSG header. */ 3595 *error = EINVAL; 3596 return (1); 3597 } 3598 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3599 /* We don't have the complete CMSG. */ 3600 *error = EINVAL; 3601 return (1); 3602 } 3603 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3604 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3605 if (cmh.cmsg_level == IPPROTO_SCTP) { 3606 switch (cmh.cmsg_type) { 3607 case SCTP_INIT: 3608 if (cmsg_data_len < (int)sizeof(struct sctp_initmsg)) { 3609 *error = EINVAL; 3610 return (1); 3611 } 3612 m_copydata(control, cmsg_data_off, sizeof(struct sctp_initmsg), (caddr_t)&initmsg); 3613 if (initmsg.sinit_max_attempts) 3614 stcb->asoc.max_init_times = initmsg.sinit_max_attempts; 3615 if (initmsg.sinit_num_ostreams) 3616 stcb->asoc.pre_open_streams = initmsg.sinit_num_ostreams; 3617 if (initmsg.sinit_max_instreams) 3618 stcb->asoc.max_inbound_streams = initmsg.sinit_max_instreams; 3619 if (initmsg.sinit_max_init_timeo) 3620 stcb->asoc.initial_init_rto_max = initmsg.sinit_max_init_timeo; 3621 if (stcb->asoc.streamoutcnt < stcb->asoc.pre_open_streams) { 3622 struct sctp_stream_out *tmp_str; 3623 unsigned int i; 3624 #if defined(SCTP_DETAILED_STR_STATS) 3625 int j; 3626 #endif 3627 3628 /* Default is NOT correct */ 3629 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, default:%d pre_open:%d\n", 3630 stcb->asoc.streamoutcnt, stcb->asoc.pre_open_streams); 3631 SCTP_TCB_UNLOCK(stcb); 3632 SCTP_MALLOC(tmp_str, 3633 struct sctp_stream_out *, 3634 (stcb->asoc.pre_open_streams * sizeof(struct sctp_stream_out)), 3635 SCTP_M_STRMO); 3636 SCTP_TCB_LOCK(stcb); 3637 if (tmp_str != NULL) { 3638 SCTP_FREE(stcb->asoc.strmout, SCTP_M_STRMO); 3639 stcb->asoc.strmout = tmp_str; 3640 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt = stcb->asoc.pre_open_streams; 3641 } else { 3642 stcb->asoc.pre_open_streams = stcb->asoc.streamoutcnt; 3643 } 3644 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3645 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 3646 stcb->asoc.strmout[i].chunks_on_queues = 0; 3647 stcb->asoc.strmout[i].next_mid_ordered = 0; 3648 stcb->asoc.strmout[i].next_mid_unordered = 0; 3649 #if defined(SCTP_DETAILED_STR_STATS) 3650 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 3651 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 3652 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 3653 } 3654 #else 3655 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 3656 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 3657 #endif 3658 stcb->asoc.strmout[i].sid = i; 3659 stcb->asoc.strmout[i].last_msg_incomplete = 0; 3660 stcb->asoc.strmout[i].state = SCTP_STREAM_OPENING; 3661 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 3662 } 3663 } 3664 break; 3665 #ifdef INET 3666 case SCTP_DSTADDRV4: 3667 if (cmsg_data_len < (int)sizeof(struct in_addr)) { 3668 *error = EINVAL; 3669 return (1); 3670 } 3671 memset(&sin, 0, sizeof(struct sockaddr_in)); 3672 sin.sin_family = AF_INET; 3673 sin.sin_len = sizeof(struct sockaddr_in); 3674 sin.sin_port = stcb->rport; 3675 m_copydata(control, cmsg_data_off, sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3676 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3677 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3678 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3679 *error = EINVAL; 3680 return (1); 3681 } 3682 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3683 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3684 *error = ENOBUFS; 3685 return (1); 3686 } 3687 break; 3688 #endif 3689 #ifdef INET6 3690 case SCTP_DSTADDRV6: 3691 if (cmsg_data_len < (int)sizeof(struct in6_addr)) { 3692 *error = EINVAL; 3693 return (1); 3694 } 3695 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3696 sin6.sin6_family = AF_INET6; 3697 sin6.sin6_len = sizeof(struct sockaddr_in6); 3698 sin6.sin6_port = stcb->rport; 3699 m_copydata(control, cmsg_data_off, sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3700 if (IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr) || 3701 IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) { 3702 *error = EINVAL; 3703 return (1); 3704 } 3705 #ifdef INET 3706 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3707 in6_sin6_2_sin(&sin, &sin6); 3708 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3709 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3710 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3711 *error = EINVAL; 3712 return (1); 3713 } 3714 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3715 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3716 *error = ENOBUFS; 3717 return (1); 3718 } 3719 } else 3720 #endif 3721 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin6, NULL, stcb->asoc.port, 3722 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3723 *error = ENOBUFS; 3724 return (1); 3725 } 3726 break; 3727 #endif 3728 default: 3729 break; 3730 } 3731 } 3732 } 3733 return (0); 3734 } 3735 3736 #if defined(INET) || defined(INET6) 3737 static struct sctp_tcb * 3738 sctp_findassociation_cmsgs(struct sctp_inpcb **inp_p, 3739 uint16_t port, 3740 struct mbuf *control, 3741 struct sctp_nets **net_p, 3742 int *error) 3743 { 3744 struct cmsghdr cmh; 3745 struct sctp_tcb *stcb; 3746 struct sockaddr *addr; 3747 #ifdef INET 3748 struct sockaddr_in sin; 3749 #endif 3750 #ifdef INET6 3751 struct sockaddr_in6 sin6; 3752 #endif 3753 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3754 3755 tot_len = SCTP_BUF_LEN(control); 3756 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3757 rem_len = tot_len - off; 3758 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3759 /* There is not enough room for one more. */ 3760 *error = EINVAL; 3761 return (NULL); 3762 } 3763 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3764 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3765 /* We dont't have a complete CMSG header. */ 3766 *error = EINVAL; 3767 return (NULL); 3768 } 3769 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3770 /* We don't have the complete CMSG. */ 3771 *error = EINVAL; 3772 return (NULL); 3773 } 3774 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3775 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3776 if (cmh.cmsg_level == IPPROTO_SCTP) { 3777 switch (cmh.cmsg_type) { 3778 #ifdef INET 3779 case SCTP_DSTADDRV4: 3780 if (cmsg_data_len < (int)sizeof(struct in_addr)) { 3781 *error = EINVAL; 3782 return (NULL); 3783 } 3784 memset(&sin, 0, sizeof(struct sockaddr_in)); 3785 sin.sin_family = AF_INET; 3786 sin.sin_len = sizeof(struct sockaddr_in); 3787 sin.sin_port = port; 3788 m_copydata(control, cmsg_data_off, sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3789 addr = (struct sockaddr *)&sin; 3790 break; 3791 #endif 3792 #ifdef INET6 3793 case SCTP_DSTADDRV6: 3794 if (cmsg_data_len < (int)sizeof(struct in6_addr)) { 3795 *error = EINVAL; 3796 return (NULL); 3797 } 3798 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3799 sin6.sin6_family = AF_INET6; 3800 sin6.sin6_len = sizeof(struct sockaddr_in6); 3801 sin6.sin6_port = port; 3802 m_copydata(control, cmsg_data_off, sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3803 #ifdef INET 3804 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3805 in6_sin6_2_sin(&sin, &sin6); 3806 addr = (struct sockaddr *)&sin; 3807 } else 3808 #endif 3809 addr = (struct sockaddr *)&sin6; 3810 break; 3811 #endif 3812 default: 3813 addr = NULL; 3814 break; 3815 } 3816 if (addr) { 3817 stcb = sctp_findassociation_ep_addr(inp_p, addr, net_p, NULL, NULL); 3818 if (stcb != NULL) { 3819 return (stcb); 3820 } 3821 } 3822 } 3823 } 3824 return (NULL); 3825 } 3826 #endif 3827 3828 static struct mbuf * 3829 sctp_add_cookie(struct mbuf *init, int init_offset, 3830 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in, uint8_t **signature) 3831 { 3832 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 3833 struct sctp_state_cookie *stc; 3834 struct sctp_paramhdr *ph; 3835 uint8_t *foo; 3836 int sig_offset; 3837 uint16_t cookie_sz; 3838 3839 mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) + 3840 sizeof(struct sctp_paramhdr)), 0, 3841 M_NOWAIT, 1, MT_DATA); 3842 if (mret == NULL) { 3843 return (NULL); 3844 } 3845 copy_init = SCTP_M_COPYM(init, init_offset, M_COPYALL, M_NOWAIT); 3846 if (copy_init == NULL) { 3847 sctp_m_freem(mret); 3848 return (NULL); 3849 } 3850 #ifdef SCTP_MBUF_LOGGING 3851 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3852 sctp_log_mbc(copy_init, SCTP_MBUF_ICOPY); 3853 } 3854 #endif 3855 copy_initack = SCTP_M_COPYM(initack, initack_offset, M_COPYALL, 3856 M_NOWAIT); 3857 if (copy_initack == NULL) { 3858 sctp_m_freem(mret); 3859 sctp_m_freem(copy_init); 3860 return (NULL); 3861 } 3862 #ifdef SCTP_MBUF_LOGGING 3863 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3864 sctp_log_mbc(copy_initack, SCTP_MBUF_ICOPY); 3865 } 3866 #endif 3867 /* easy side we just drop it on the end */ 3868 ph = mtod(mret, struct sctp_paramhdr *); 3869 SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) + 3870 sizeof(struct sctp_paramhdr); 3871 stc = (struct sctp_state_cookie *)((caddr_t)ph + 3872 sizeof(struct sctp_paramhdr)); 3873 ph->param_type = htons(SCTP_STATE_COOKIE); 3874 ph->param_length = 0; /* fill in at the end */ 3875 /* Fill in the stc cookie data */ 3876 memcpy(stc, stc_in, sizeof(struct sctp_state_cookie)); 3877 3878 /* tack the INIT and then the INIT-ACK onto the chain */ 3879 cookie_sz = 0; 3880 for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3881 cookie_sz += SCTP_BUF_LEN(m_at); 3882 if (SCTP_BUF_NEXT(m_at) == NULL) { 3883 SCTP_BUF_NEXT(m_at) = copy_init; 3884 break; 3885 } 3886 } 3887 for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3888 cookie_sz += SCTP_BUF_LEN(m_at); 3889 if (SCTP_BUF_NEXT(m_at) == NULL) { 3890 SCTP_BUF_NEXT(m_at) = copy_initack; 3891 break; 3892 } 3893 } 3894 for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3895 cookie_sz += SCTP_BUF_LEN(m_at); 3896 if (SCTP_BUF_NEXT(m_at) == NULL) { 3897 break; 3898 } 3899 } 3900 sig = sctp_get_mbuf_for_msg(SCTP_SECRET_SIZE, 0, M_NOWAIT, 1, MT_DATA); 3901 if (sig == NULL) { 3902 /* no space, so free the entire chain */ 3903 sctp_m_freem(mret); 3904 return (NULL); 3905 } 3906 SCTP_BUF_LEN(sig) = 0; 3907 SCTP_BUF_NEXT(m_at) = sig; 3908 sig_offset = 0; 3909 foo = (uint8_t *)(mtod(sig, caddr_t)+sig_offset); 3910 memset(foo, 0, SCTP_SIGNATURE_SIZE); 3911 *signature = foo; 3912 SCTP_BUF_LEN(sig) += SCTP_SIGNATURE_SIZE; 3913 cookie_sz += SCTP_SIGNATURE_SIZE; 3914 ph->param_length = htons(cookie_sz); 3915 return (mret); 3916 } 3917 3918 3919 static uint8_t 3920 sctp_get_ect(struct sctp_tcb *stcb) 3921 { 3922 if ((stcb != NULL) && (stcb->asoc.ecn_supported == 1)) { 3923 return (SCTP_ECT0_BIT); 3924 } else { 3925 return (0); 3926 } 3927 } 3928 3929 #if defined(INET) || defined(INET6) 3930 static void 3931 sctp_handle_no_route(struct sctp_tcb *stcb, 3932 struct sctp_nets *net, 3933 int so_locked) 3934 { 3935 SCTPDBG(SCTP_DEBUG_OUTPUT1, "dropped packet - no valid source addr\n"); 3936 3937 if (net) { 3938 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Destination was "); 3939 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT1, &net->ro._l_addr.sa); 3940 if (net->dest_state & SCTP_ADDR_CONFIRMED) { 3941 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) { 3942 SCTPDBG(SCTP_DEBUG_OUTPUT1, "no route takes interface %p down\n", (void *)net); 3943 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 3944 stcb, 0, 3945 (void *)net, 3946 so_locked); 3947 net->dest_state &= ~SCTP_ADDR_REACHABLE; 3948 net->dest_state &= ~SCTP_ADDR_PF; 3949 } 3950 } 3951 if (stcb) { 3952 if (net == stcb->asoc.primary_destination) { 3953 /* need a new primary */ 3954 struct sctp_nets *alt; 3955 3956 alt = sctp_find_alternate_net(stcb, net, 0); 3957 if (alt != net) { 3958 if (stcb->asoc.alternate) { 3959 sctp_free_remote_addr(stcb->asoc.alternate); 3960 } 3961 stcb->asoc.alternate = alt; 3962 atomic_add_int(&stcb->asoc.alternate->ref_count, 1); 3963 if (net->ro._s_addr) { 3964 sctp_free_ifa(net->ro._s_addr); 3965 net->ro._s_addr = NULL; 3966 } 3967 net->src_addr_selected = 0; 3968 } 3969 } 3970 } 3971 } 3972 } 3973 #endif 3974 3975 static int 3976 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 3977 struct sctp_tcb *stcb, /* may be NULL */ 3978 struct sctp_nets *net, 3979 struct sockaddr *to, 3980 struct mbuf *m, 3981 uint32_t auth_offset, 3982 struct sctp_auth_chunk *auth, 3983 uint16_t auth_keyid, 3984 int nofragment_flag, 3985 int ecn_ok, 3986 int out_of_asoc_ok, 3987 uint16_t src_port, 3988 uint16_t dest_port, 3989 uint32_t v_tag, 3990 uint16_t port, 3991 union sctp_sockstore *over_addr, 3992 uint8_t mflowtype, uint32_t mflowid, 3993 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 3994 int so_locked SCTP_UNUSED 3995 #else 3996 int so_locked 3997 #endif 3998 ) 3999 { 4000 /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 4001 /** 4002 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet header 4003 * WITH an SCTPHDR but no IP header, endpoint inp and sa structure: 4004 * - fill in the HMAC digest of any AUTH chunk in the packet. 4005 * - calculate and fill in the SCTP checksum. 4006 * - prepend an IP address header. 4007 * - if boundall use INADDR_ANY. 4008 * - if boundspecific do source address selection. 4009 * - set fragmentation option for ipV4. 4010 * - On return from IP output, check/adjust mtu size of output 4011 * interface and smallest_mtu size as well. 4012 */ 4013 /* Will need ifdefs around this */ 4014 struct mbuf *newm; 4015 struct sctphdr *sctphdr; 4016 int packet_length; 4017 int ret; 4018 #if defined(INET) || defined(INET6) 4019 uint32_t vrf_id; 4020 #endif 4021 #if defined(INET) || defined(INET6) 4022 struct mbuf *o_pak; 4023 sctp_route_t *ro = NULL; 4024 struct udphdr *udp = NULL; 4025 #endif 4026 uint8_t tos_value; 4027 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4028 struct socket *so = NULL; 4029 #endif 4030 4031 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 4032 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4033 sctp_m_freem(m); 4034 return (EFAULT); 4035 } 4036 #if defined(INET) || defined(INET6) 4037 if (stcb) { 4038 vrf_id = stcb->asoc.vrf_id; 4039 } else { 4040 vrf_id = inp->def_vrf_id; 4041 } 4042 #endif 4043 /* fill in the HMAC digest for any AUTH chunk in the packet */ 4044 if ((auth != NULL) && (stcb != NULL)) { 4045 sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb, auth_keyid); 4046 } 4047 4048 if (net) { 4049 tos_value = net->dscp; 4050 } else if (stcb) { 4051 tos_value = stcb->asoc.default_dscp; 4052 } else { 4053 tos_value = inp->sctp_ep.default_dscp; 4054 } 4055 4056 switch (to->sa_family) { 4057 #ifdef INET 4058 case AF_INET: 4059 { 4060 struct ip *ip = NULL; 4061 sctp_route_t iproute; 4062 int len; 4063 4064 len = SCTP_MIN_V4_OVERHEAD; 4065 if (port) { 4066 len += sizeof(struct udphdr); 4067 } 4068 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4069 if (newm == NULL) { 4070 sctp_m_freem(m); 4071 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4072 return (ENOMEM); 4073 } 4074 SCTP_ALIGN_TO_END(newm, len); 4075 SCTP_BUF_LEN(newm) = len; 4076 SCTP_BUF_NEXT(newm) = m; 4077 m = newm; 4078 if (net != NULL) { 4079 m->m_pkthdr.flowid = net->flowid; 4080 M_HASHTYPE_SET(m, net->flowtype); 4081 } else { 4082 m->m_pkthdr.flowid = mflowid; 4083 M_HASHTYPE_SET(m, mflowtype); 4084 } 4085 packet_length = sctp_calculate_len(m); 4086 ip = mtod(m, struct ip *); 4087 ip->ip_v = IPVERSION; 4088 ip->ip_hl = (sizeof(struct ip) >> 2); 4089 if (tos_value == 0) { 4090 /* 4091 * This means especially, that it is not set 4092 * at the SCTP layer. So use the value from 4093 * the IP layer. 4094 */ 4095 tos_value = inp->ip_inp.inp.inp_ip_tos; 4096 } 4097 tos_value &= 0xfc; 4098 if (ecn_ok) { 4099 tos_value |= sctp_get_ect(stcb); 4100 } 4101 if ((nofragment_flag) && (port == 0)) { 4102 ip->ip_off = htons(IP_DF); 4103 } else { 4104 ip->ip_off = htons(0); 4105 } 4106 /* FreeBSD has a function for ip_id's */ 4107 ip_fillid(ip); 4108 4109 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl; 4110 ip->ip_len = htons(packet_length); 4111 ip->ip_tos = tos_value; 4112 if (port) { 4113 ip->ip_p = IPPROTO_UDP; 4114 } else { 4115 ip->ip_p = IPPROTO_SCTP; 4116 } 4117 ip->ip_sum = 0; 4118 if (net == NULL) { 4119 ro = &iproute; 4120 memset(&iproute, 0, sizeof(iproute)); 4121 memcpy(&ro->ro_dst, to, to->sa_len); 4122 } else { 4123 ro = (sctp_route_t *)&net->ro; 4124 } 4125 /* Now the address selection part */ 4126 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr; 4127 4128 /* call the routine to select the src address */ 4129 if (net && out_of_asoc_ok == 0) { 4130 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4131 sctp_free_ifa(net->ro._s_addr); 4132 net->ro._s_addr = NULL; 4133 net->src_addr_selected = 0; 4134 if (ro->ro_rt) { 4135 RTFREE(ro->ro_rt); 4136 ro->ro_rt = NULL; 4137 } 4138 } 4139 if (net->src_addr_selected == 0) { 4140 /* Cache the source address */ 4141 net->ro._s_addr = sctp_source_address_selection(inp, stcb, 4142 ro, net, 0, 4143 vrf_id); 4144 net->src_addr_selected = 1; 4145 } 4146 if (net->ro._s_addr == NULL) { 4147 /* No route to host */ 4148 net->src_addr_selected = 0; 4149 sctp_handle_no_route(stcb, net, so_locked); 4150 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4151 sctp_m_freem(m); 4152 return (EHOSTUNREACH); 4153 } 4154 ip->ip_src = net->ro._s_addr->address.sin.sin_addr; 4155 } else { 4156 if (over_addr == NULL) { 4157 struct sctp_ifa *_lsrc; 4158 4159 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4160 net, 4161 out_of_asoc_ok, 4162 vrf_id); 4163 if (_lsrc == NULL) { 4164 sctp_handle_no_route(stcb, net, so_locked); 4165 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4166 sctp_m_freem(m); 4167 return (EHOSTUNREACH); 4168 } 4169 ip->ip_src = _lsrc->address.sin.sin_addr; 4170 sctp_free_ifa(_lsrc); 4171 } else { 4172 ip->ip_src = over_addr->sin.sin_addr; 4173 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4174 } 4175 } 4176 if (port) { 4177 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4178 sctp_handle_no_route(stcb, net, so_locked); 4179 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4180 sctp_m_freem(m); 4181 return (EHOSTUNREACH); 4182 } 4183 udp = (struct udphdr *)((caddr_t)ip + sizeof(struct ip)); 4184 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4185 udp->uh_dport = port; 4186 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip))); 4187 if (V_udp_cksum) { 4188 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 4189 } else { 4190 udp->uh_sum = 0; 4191 } 4192 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4193 } else { 4194 sctphdr = (struct sctphdr *)((caddr_t)ip + sizeof(struct ip)); 4195 } 4196 4197 sctphdr->src_port = src_port; 4198 sctphdr->dest_port = dest_port; 4199 sctphdr->v_tag = v_tag; 4200 sctphdr->checksum = 0; 4201 4202 /* 4203 * If source address selection fails and we find no 4204 * route then the ip_output should fail as well with 4205 * a NO_ROUTE_TO_HOST type error. We probably should 4206 * catch that somewhere and abort the association 4207 * right away (assuming this is an INIT being sent). 4208 */ 4209 if (ro->ro_rt == NULL) { 4210 /* 4211 * src addr selection failed to find a route 4212 * (or valid source addr), so we can't get 4213 * there from here (yet)! 4214 */ 4215 sctp_handle_no_route(stcb, net, so_locked); 4216 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4217 sctp_m_freem(m); 4218 return (EHOSTUNREACH); 4219 } 4220 if (ro != &iproute) { 4221 memcpy(&iproute, ro, sizeof(*ro)); 4222 } 4223 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv4 output routine from low level src addr:%x\n", 4224 (uint32_t)(ntohl(ip->ip_src.s_addr))); 4225 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Destination is %x\n", 4226 (uint32_t)(ntohl(ip->ip_dst.s_addr))); 4227 SCTPDBG(SCTP_DEBUG_OUTPUT3, "RTP route is %p through\n", 4228 (void *)ro->ro_rt); 4229 4230 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4231 /* failed to prepend data, give up */ 4232 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4233 sctp_m_freem(m); 4234 return (ENOMEM); 4235 } 4236 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4237 if (port) { 4238 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip) + sizeof(struct udphdr)); 4239 SCTP_STAT_INCR(sctps_sendswcrc); 4240 if (V_udp_cksum) { 4241 SCTP_ENABLE_UDP_CSUM(o_pak); 4242 } 4243 } else { 4244 m->m_pkthdr.csum_flags = CSUM_SCTP; 4245 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4246 SCTP_STAT_INCR(sctps_sendhwcrc); 4247 } 4248 #ifdef SCTP_PACKET_LOGGING 4249 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4250 sctp_packet_log(o_pak); 4251 #endif 4252 /* send it out. table id is taken from stcb */ 4253 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4254 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4255 so = SCTP_INP_SO(inp); 4256 SCTP_SOCKET_UNLOCK(so, 0); 4257 } 4258 #endif 4259 SCTP_PROBE5(send, NULL, stcb, ip, stcb, sctphdr); 4260 SCTP_IP_OUTPUT(ret, o_pak, ro, stcb, vrf_id); 4261 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4262 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4263 atomic_add_int(&stcb->asoc.refcnt, 1); 4264 SCTP_TCB_UNLOCK(stcb); 4265 SCTP_SOCKET_LOCK(so, 0); 4266 SCTP_TCB_LOCK(stcb); 4267 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4268 } 4269 #endif 4270 if (port) { 4271 UDPSTAT_INC(udps_opackets); 4272 } 4273 SCTP_STAT_INCR(sctps_sendpackets); 4274 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4275 if (ret) 4276 SCTP_STAT_INCR(sctps_senderrors); 4277 4278 SCTPDBG(SCTP_DEBUG_OUTPUT3, "IP output returns %d\n", ret); 4279 if (net == NULL) { 4280 /* free tempy routes */ 4281 RO_RTFREE(ro); 4282 } else { 4283 if ((ro->ro_rt != NULL) && (net->ro._s_addr) && 4284 ((net->dest_state & SCTP_ADDR_NO_PMTUD) == 0)) { 4285 uint32_t mtu; 4286 4287 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt); 4288 if (mtu > 0) { 4289 if (net->port) { 4290 mtu -= sizeof(struct udphdr); 4291 } 4292 if (mtu < net->mtu) { 4293 if ((stcb != NULL) && (stcb->asoc.smallest_mtu > mtu)) { 4294 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4295 } 4296 net->mtu = mtu; 4297 } 4298 } 4299 } else if (ro->ro_rt == NULL) { 4300 /* route was freed */ 4301 if (net->ro._s_addr && 4302 net->src_addr_selected) { 4303 sctp_free_ifa(net->ro._s_addr); 4304 net->ro._s_addr = NULL; 4305 } 4306 net->src_addr_selected = 0; 4307 } 4308 } 4309 return (ret); 4310 } 4311 #endif 4312 #ifdef INET6 4313 case AF_INET6: 4314 { 4315 uint32_t flowlabel, flowinfo; 4316 struct ip6_hdr *ip6h; 4317 struct route_in6 ip6route; 4318 struct ifnet *ifp; 4319 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 4320 int prev_scope = 0; 4321 struct sockaddr_in6 lsa6_storage; 4322 int error; 4323 u_short prev_port = 0; 4324 int len; 4325 4326 if (net) { 4327 flowlabel = net->flowlabel; 4328 } else if (stcb) { 4329 flowlabel = stcb->asoc.default_flowlabel; 4330 } else { 4331 flowlabel = inp->sctp_ep.default_flowlabel; 4332 } 4333 if (flowlabel == 0) { 4334 /* 4335 * This means especially, that it is not set 4336 * at the SCTP layer. So use the value from 4337 * the IP layer. 4338 */ 4339 flowlabel = ntohl(((struct inpcb *)inp)->inp_flow); 4340 } 4341 flowlabel &= 0x000fffff; 4342 len = SCTP_MIN_OVERHEAD; 4343 if (port) { 4344 len += sizeof(struct udphdr); 4345 } 4346 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4347 if (newm == NULL) { 4348 sctp_m_freem(m); 4349 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4350 return (ENOMEM); 4351 } 4352 SCTP_ALIGN_TO_END(newm, len); 4353 SCTP_BUF_LEN(newm) = len; 4354 SCTP_BUF_NEXT(newm) = m; 4355 m = newm; 4356 if (net != NULL) { 4357 m->m_pkthdr.flowid = net->flowid; 4358 M_HASHTYPE_SET(m, net->flowtype); 4359 } else { 4360 m->m_pkthdr.flowid = mflowid; 4361 M_HASHTYPE_SET(m, mflowtype); 4362 } 4363 packet_length = sctp_calculate_len(m); 4364 4365 ip6h = mtod(m, struct ip6_hdr *); 4366 /* protect *sin6 from overwrite */ 4367 sin6 = (struct sockaddr_in6 *)to; 4368 tmp = *sin6; 4369 sin6 = &tmp; 4370 4371 /* KAME hack: embed scopeid */ 4372 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4373 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4374 sctp_m_freem(m); 4375 return (EINVAL); 4376 } 4377 if (net == NULL) { 4378 memset(&ip6route, 0, sizeof(ip6route)); 4379 ro = (sctp_route_t *)&ip6route; 4380 memcpy(&ro->ro_dst, sin6, sin6->sin6_len); 4381 } else { 4382 ro = (sctp_route_t *)&net->ro; 4383 } 4384 /* 4385 * We assume here that inp_flow is in host byte 4386 * order within the TCB! 4387 */ 4388 if (tos_value == 0) { 4389 /* 4390 * This means especially, that it is not set 4391 * at the SCTP layer. So use the value from 4392 * the IP layer. 4393 */ 4394 tos_value = (ntohl(((struct inpcb *)inp)->inp_flow) >> 20) & 0xff; 4395 } 4396 tos_value &= 0xfc; 4397 if (ecn_ok) { 4398 tos_value |= sctp_get_ect(stcb); 4399 } 4400 flowinfo = 0x06; 4401 flowinfo <<= 8; 4402 flowinfo |= tos_value; 4403 flowinfo <<= 20; 4404 flowinfo |= flowlabel; 4405 ip6h->ip6_flow = htonl(flowinfo); 4406 if (port) { 4407 ip6h->ip6_nxt = IPPROTO_UDP; 4408 } else { 4409 ip6h->ip6_nxt = IPPROTO_SCTP; 4410 } 4411 ip6h->ip6_plen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4412 ip6h->ip6_dst = sin6->sin6_addr; 4413 4414 /* 4415 * Add SRC address selection here: we can only reuse 4416 * to a limited degree the kame src-addr-sel, since 4417 * we can try their selection but it may not be 4418 * bound. 4419 */ 4420 memset(&lsa6_tmp, 0, sizeof(lsa6_tmp)); 4421 lsa6_tmp.sin6_family = AF_INET6; 4422 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 4423 lsa6 = &lsa6_tmp; 4424 if (net && out_of_asoc_ok == 0) { 4425 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4426 sctp_free_ifa(net->ro._s_addr); 4427 net->ro._s_addr = NULL; 4428 net->src_addr_selected = 0; 4429 if (ro->ro_rt) { 4430 RTFREE(ro->ro_rt); 4431 ro->ro_rt = NULL; 4432 } 4433 } 4434 if (net->src_addr_selected == 0) { 4435 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4436 /* KAME hack: embed scopeid */ 4437 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4438 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4439 sctp_m_freem(m); 4440 return (EINVAL); 4441 } 4442 /* Cache the source address */ 4443 net->ro._s_addr = sctp_source_address_selection(inp, 4444 stcb, 4445 ro, 4446 net, 4447 0, 4448 vrf_id); 4449 (void)sa6_recoverscope(sin6); 4450 net->src_addr_selected = 1; 4451 } 4452 if (net->ro._s_addr == NULL) { 4453 SCTPDBG(SCTP_DEBUG_OUTPUT3, "V6:No route to host\n"); 4454 net->src_addr_selected = 0; 4455 sctp_handle_no_route(stcb, net, so_locked); 4456 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4457 sctp_m_freem(m); 4458 return (EHOSTUNREACH); 4459 } 4460 lsa6->sin6_addr = net->ro._s_addr->address.sin6.sin6_addr; 4461 } else { 4462 sin6 = (struct sockaddr_in6 *)&ro->ro_dst; 4463 /* KAME hack: embed scopeid */ 4464 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4465 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4466 sctp_m_freem(m); 4467 return (EINVAL); 4468 } 4469 if (over_addr == NULL) { 4470 struct sctp_ifa *_lsrc; 4471 4472 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4473 net, 4474 out_of_asoc_ok, 4475 vrf_id); 4476 if (_lsrc == NULL) { 4477 sctp_handle_no_route(stcb, net, so_locked); 4478 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4479 sctp_m_freem(m); 4480 return (EHOSTUNREACH); 4481 } 4482 lsa6->sin6_addr = _lsrc->address.sin6.sin6_addr; 4483 sctp_free_ifa(_lsrc); 4484 } else { 4485 lsa6->sin6_addr = over_addr->sin6.sin6_addr; 4486 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4487 } 4488 (void)sa6_recoverscope(sin6); 4489 } 4490 lsa6->sin6_port = inp->sctp_lport; 4491 4492 if (ro->ro_rt == NULL) { 4493 /* 4494 * src addr selection failed to find a route 4495 * (or valid source addr), so we can't get 4496 * there from here! 4497 */ 4498 sctp_handle_no_route(stcb, net, so_locked); 4499 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4500 sctp_m_freem(m); 4501 return (EHOSTUNREACH); 4502 } 4503 /* 4504 * XXX: sa6 may not have a valid sin6_scope_id in 4505 * the non-SCOPEDROUTING case. 4506 */ 4507 memset(&lsa6_storage, 0, sizeof(lsa6_storage)); 4508 lsa6_storage.sin6_family = AF_INET6; 4509 lsa6_storage.sin6_len = sizeof(lsa6_storage); 4510 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4511 if ((error = sa6_recoverscope(&lsa6_storage)) != 0) { 4512 SCTPDBG(SCTP_DEBUG_OUTPUT3, "recover scope fails error %d\n", error); 4513 sctp_m_freem(m); 4514 return (error); 4515 } 4516 /* XXX */ 4517 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4518 lsa6_storage.sin6_port = inp->sctp_lport; 4519 lsa6 = &lsa6_storage; 4520 ip6h->ip6_src = lsa6->sin6_addr; 4521 4522 if (port) { 4523 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4524 sctp_handle_no_route(stcb, net, so_locked); 4525 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4526 sctp_m_freem(m); 4527 return (EHOSTUNREACH); 4528 } 4529 udp = (struct udphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4530 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4531 udp->uh_dport = port; 4532 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4533 udp->uh_sum = 0; 4534 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4535 } else { 4536 sctphdr = (struct sctphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4537 } 4538 4539 sctphdr->src_port = src_port; 4540 sctphdr->dest_port = dest_port; 4541 sctphdr->v_tag = v_tag; 4542 sctphdr->checksum = 0; 4543 4544 /* 4545 * We set the hop limit now since there is a good 4546 * chance that our ro pointer is now filled 4547 */ 4548 ip6h->ip6_hlim = SCTP_GET_HLIM(inp, ro); 4549 ifp = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 4550 4551 #ifdef SCTP_DEBUG 4552 /* Copy to be sure something bad is not happening */ 4553 sin6->sin6_addr = ip6h->ip6_dst; 4554 lsa6->sin6_addr = ip6h->ip6_src; 4555 #endif 4556 4557 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv6 output routine from low level\n"); 4558 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src: "); 4559 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)lsa6); 4560 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst: "); 4561 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)sin6); 4562 if (net) { 4563 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4564 /* 4565 * preserve the port and scope for link 4566 * local send 4567 */ 4568 prev_scope = sin6->sin6_scope_id; 4569 prev_port = sin6->sin6_port; 4570 } 4571 4572 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4573 /* failed to prepend data, give up */ 4574 sctp_m_freem(m); 4575 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4576 return (ENOMEM); 4577 } 4578 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4579 if (port) { 4580 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 4581 SCTP_STAT_INCR(sctps_sendswcrc); 4582 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), packet_length - sizeof(struct ip6_hdr))) == 0) { 4583 udp->uh_sum = 0xffff; 4584 } 4585 } else { 4586 m->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 4587 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4588 SCTP_STAT_INCR(sctps_sendhwcrc); 4589 } 4590 /* send it out. table id is taken from stcb */ 4591 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4592 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4593 so = SCTP_INP_SO(inp); 4594 SCTP_SOCKET_UNLOCK(so, 0); 4595 } 4596 #endif 4597 #ifdef SCTP_PACKET_LOGGING 4598 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4599 sctp_packet_log(o_pak); 4600 #endif 4601 SCTP_PROBE5(send, NULL, stcb, ip6h, stcb, sctphdr); 4602 SCTP_IP6_OUTPUT(ret, o_pak, (struct route_in6 *)ro, &ifp, stcb, vrf_id); 4603 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4604 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4605 atomic_add_int(&stcb->asoc.refcnt, 1); 4606 SCTP_TCB_UNLOCK(stcb); 4607 SCTP_SOCKET_LOCK(so, 0); 4608 SCTP_TCB_LOCK(stcb); 4609 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4610 } 4611 #endif 4612 if (net) { 4613 /* for link local this must be done */ 4614 sin6->sin6_scope_id = prev_scope; 4615 sin6->sin6_port = prev_port; 4616 } 4617 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 4618 if (port) { 4619 UDPSTAT_INC(udps_opackets); 4620 } 4621 SCTP_STAT_INCR(sctps_sendpackets); 4622 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4623 if (ret) { 4624 SCTP_STAT_INCR(sctps_senderrors); 4625 } 4626 if (net == NULL) { 4627 /* Now if we had a temp route free it */ 4628 RO_RTFREE(ro); 4629 } else { 4630 /* 4631 * PMTU check versus smallest asoc MTU goes 4632 * here 4633 */ 4634 if (ro->ro_rt == NULL) { 4635 /* Route was freed */ 4636 if (net->ro._s_addr && 4637 net->src_addr_selected) { 4638 sctp_free_ifa(net->ro._s_addr); 4639 net->ro._s_addr = NULL; 4640 } 4641 net->src_addr_selected = 0; 4642 } 4643 if ((ro->ro_rt != NULL) && (net->ro._s_addr) && 4644 ((net->dest_state & SCTP_ADDR_NO_PMTUD) == 0)) { 4645 uint32_t mtu; 4646 4647 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt); 4648 if (mtu > 0) { 4649 if (net->port) { 4650 mtu -= sizeof(struct udphdr); 4651 } 4652 if (mtu < net->mtu) { 4653 if ((stcb != NULL) && (stcb->asoc.smallest_mtu > mtu)) { 4654 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4655 } 4656 net->mtu = mtu; 4657 } 4658 } 4659 } else if (ifp) { 4660 if (ND_IFINFO(ifp)->linkmtu && 4661 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) { 4662 sctp_mtu_size_reset(inp, 4663 &stcb->asoc, 4664 ND_IFINFO(ifp)->linkmtu); 4665 } 4666 } 4667 } 4668 return (ret); 4669 } 4670 #endif 4671 default: 4672 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 4673 ((struct sockaddr *)to)->sa_family); 4674 sctp_m_freem(m); 4675 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4676 return (EFAULT); 4677 } 4678 } 4679 4680 4681 void 4682 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int so_locked 4683 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 4684 SCTP_UNUSED 4685 #endif 4686 ) 4687 { 4688 struct mbuf *m, *m_last; 4689 struct sctp_nets *net; 4690 struct sctp_init_chunk *init; 4691 struct sctp_supported_addr_param *sup_addr; 4692 struct sctp_adaptation_layer_indication *ali; 4693 struct sctp_supported_chunk_types_param *pr_supported; 4694 struct sctp_paramhdr *ph; 4695 int cnt_inits_to = 0; 4696 int error; 4697 uint16_t num_ext, chunk_len, padding_len, parameter_len; 4698 4699 /* INIT's always go to the primary (and usually ONLY address) */ 4700 net = stcb->asoc.primary_destination; 4701 if (net == NULL) { 4702 net = TAILQ_FIRST(&stcb->asoc.nets); 4703 if (net == NULL) { 4704 /* TSNH */ 4705 return; 4706 } 4707 /* we confirm any address we send an INIT to */ 4708 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4709 (void)sctp_set_primary_addr(stcb, NULL, net); 4710 } else { 4711 /* we confirm any address we send an INIT to */ 4712 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4713 } 4714 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT\n"); 4715 #ifdef INET6 4716 if (net->ro._l_addr.sa.sa_family == AF_INET6) { 4717 /* 4718 * special hook, if we are sending to link local it will not 4719 * show up in our private address count. 4720 */ 4721 if (IN6_IS_ADDR_LINKLOCAL(&net->ro._l_addr.sin6.sin6_addr)) 4722 cnt_inits_to = 1; 4723 } 4724 #endif 4725 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 4726 /* This case should not happen */ 4727 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - failed timer?\n"); 4728 return; 4729 } 4730 /* start the INIT timer */ 4731 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 4732 4733 m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_NOWAIT, 1, MT_DATA); 4734 if (m == NULL) { 4735 /* No memory, INIT timer will re-attempt. */ 4736 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - mbuf?\n"); 4737 return; 4738 } 4739 chunk_len = (uint16_t)sizeof(struct sctp_init_chunk); 4740 padding_len = 0; 4741 /* Now lets put the chunk header in place */ 4742 init = mtod(m, struct sctp_init_chunk *); 4743 /* now the chunk header */ 4744 init->ch.chunk_type = SCTP_INITIATION; 4745 init->ch.chunk_flags = 0; 4746 /* fill in later from mbuf we build */ 4747 init->ch.chunk_length = 0; 4748 /* place in my tag */ 4749 init->init.initiate_tag = htonl(stcb->asoc.my_vtag); 4750 /* set up some of the credits. */ 4751 init->init.a_rwnd = htonl(max(inp->sctp_socket ? SCTP_SB_LIMIT_RCV(inp->sctp_socket) : 0, 4752 SCTP_MINIMAL_RWND)); 4753 init->init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 4754 init->init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 4755 init->init.initial_tsn = htonl(stcb->asoc.init_seq_number); 4756 4757 /* Adaptation layer indication parameter */ 4758 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 4759 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 4760 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 4761 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 4762 ali->ph.param_length = htons(parameter_len); 4763 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 4764 chunk_len += parameter_len; 4765 } 4766 4767 /* ECN parameter */ 4768 if (stcb->asoc.ecn_supported == 1) { 4769 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4770 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4771 ph->param_type = htons(SCTP_ECN_CAPABLE); 4772 ph->param_length = htons(parameter_len); 4773 chunk_len += parameter_len; 4774 } 4775 4776 /* PR-SCTP supported parameter */ 4777 if (stcb->asoc.prsctp_supported == 1) { 4778 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4779 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4780 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 4781 ph->param_length = htons(parameter_len); 4782 chunk_len += parameter_len; 4783 } 4784 4785 /* Add NAT friendly parameter. */ 4786 if (SCTP_BASE_SYSCTL(sctp_inits_include_nat_friendly)) { 4787 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4788 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4789 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 4790 ph->param_length = htons(parameter_len); 4791 chunk_len += parameter_len; 4792 } 4793 4794 /* And now tell the peer which extensions we support */ 4795 num_ext = 0; 4796 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 4797 if (stcb->asoc.prsctp_supported == 1) { 4798 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 4799 if (stcb->asoc.idata_supported) { 4800 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 4801 } 4802 } 4803 if (stcb->asoc.auth_supported == 1) { 4804 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 4805 } 4806 if (stcb->asoc.asconf_supported == 1) { 4807 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 4808 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 4809 } 4810 if (stcb->asoc.reconfig_supported == 1) { 4811 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 4812 } 4813 if (stcb->asoc.idata_supported) { 4814 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 4815 } 4816 if (stcb->asoc.nrsack_supported == 1) { 4817 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 4818 } 4819 if (stcb->asoc.pktdrop_supported == 1) { 4820 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 4821 } 4822 if (num_ext > 0) { 4823 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 4824 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 4825 pr_supported->ph.param_length = htons(parameter_len); 4826 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4827 chunk_len += parameter_len; 4828 } 4829 /* add authentication parameters */ 4830 if (stcb->asoc.auth_supported) { 4831 /* attach RANDOM parameter, if available */ 4832 if (stcb->asoc.authinfo.random != NULL) { 4833 struct sctp_auth_random *randp; 4834 4835 if (padding_len > 0) { 4836 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4837 chunk_len += padding_len; 4838 padding_len = 0; 4839 } 4840 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 4841 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + stcb->asoc.authinfo.random_len; 4842 /* random key already contains the header */ 4843 memcpy(randp, stcb->asoc.authinfo.random->key, parameter_len); 4844 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4845 chunk_len += parameter_len; 4846 } 4847 /* add HMAC_ALGO parameter */ 4848 if (stcb->asoc.local_hmacs != NULL) { 4849 struct sctp_auth_hmac_algo *hmacs; 4850 4851 if (padding_len > 0) { 4852 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4853 chunk_len += padding_len; 4854 padding_len = 0; 4855 } 4856 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 4857 parameter_len = (uint16_t)(sizeof(struct sctp_auth_hmac_algo) + 4858 stcb->asoc.local_hmacs->num_algo * sizeof(uint16_t)); 4859 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 4860 hmacs->ph.param_length = htons(parameter_len); 4861 sctp_serialize_hmaclist(stcb->asoc.local_hmacs, (uint8_t *)hmacs->hmac_ids); 4862 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4863 chunk_len += parameter_len; 4864 } 4865 /* add CHUNKS parameter */ 4866 if (stcb->asoc.local_auth_chunks != NULL) { 4867 struct sctp_auth_chunk_list *chunks; 4868 4869 if (padding_len > 0) { 4870 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4871 chunk_len += padding_len; 4872 padding_len = 0; 4873 } 4874 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 4875 parameter_len = (uint16_t)(sizeof(struct sctp_auth_chunk_list) + 4876 sctp_auth_get_chklist_size(stcb->asoc.local_auth_chunks)); 4877 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 4878 chunks->ph.param_length = htons(parameter_len); 4879 sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks, chunks->chunk_types); 4880 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4881 chunk_len += parameter_len; 4882 } 4883 } 4884 4885 /* now any cookie time extensions */ 4886 if (stcb->asoc.cookie_preserve_req) { 4887 struct sctp_cookie_perserve_param *cookie_preserve; 4888 4889 if (padding_len > 0) { 4890 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4891 chunk_len += padding_len; 4892 padding_len = 0; 4893 } 4894 parameter_len = (uint16_t)sizeof(struct sctp_cookie_perserve_param); 4895 cookie_preserve = (struct sctp_cookie_perserve_param *)(mtod(m, caddr_t)+chunk_len); 4896 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 4897 cookie_preserve->ph.param_length = htons(parameter_len); 4898 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 4899 stcb->asoc.cookie_preserve_req = 0; 4900 chunk_len += parameter_len; 4901 } 4902 4903 if (stcb->asoc.scope.ipv4_addr_legal || stcb->asoc.scope.ipv6_addr_legal) { 4904 uint8_t i; 4905 4906 if (padding_len > 0) { 4907 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4908 chunk_len += padding_len; 4909 padding_len = 0; 4910 } 4911 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4912 if (stcb->asoc.scope.ipv4_addr_legal) { 4913 parameter_len += (uint16_t)sizeof(uint16_t); 4914 } 4915 if (stcb->asoc.scope.ipv6_addr_legal) { 4916 parameter_len += (uint16_t)sizeof(uint16_t); 4917 } 4918 sup_addr = (struct sctp_supported_addr_param *)(mtod(m, caddr_t)+chunk_len); 4919 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 4920 sup_addr->ph.param_length = htons(parameter_len); 4921 i = 0; 4922 if (stcb->asoc.scope.ipv4_addr_legal) { 4923 sup_addr->addr_type[i++] = htons(SCTP_IPV4_ADDRESS); 4924 } 4925 if (stcb->asoc.scope.ipv6_addr_legal) { 4926 sup_addr->addr_type[i++] = htons(SCTP_IPV6_ADDRESS); 4927 } 4928 padding_len = 4 - 2 * i; 4929 chunk_len += parameter_len; 4930 } 4931 4932 SCTP_BUF_LEN(m) = chunk_len; 4933 /* now the addresses */ 4934 /* 4935 * To optimize this we could put the scoping stuff into a structure 4936 * and remove the individual uint8's from the assoc structure. Then 4937 * we could just sifa in the address within the stcb. But for now 4938 * this is a quick hack to get the address stuff teased apart. 4939 */ 4940 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &stcb->asoc.scope, 4941 m, cnt_inits_to, 4942 &padding_len, &chunk_len); 4943 4944 init->ch.chunk_length = htons(chunk_len); 4945 if (padding_len > 0) { 4946 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 4947 sctp_m_freem(m); 4948 return; 4949 } 4950 } 4951 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - calls lowlevel_output\n"); 4952 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 4953 (struct sockaddr *)&net->ro._l_addr, 4954 m, 0, NULL, 0, 0, 0, 0, 4955 inp->sctp_lport, stcb->rport, htonl(0), 4956 net->port, NULL, 4957 0, 0, 4958 so_locked))) { 4959 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 4960 if (error == ENOBUFS) { 4961 stcb->asoc.ifp_had_enobuf = 1; 4962 SCTP_STAT_INCR(sctps_lowlevelerr); 4963 } 4964 } else { 4965 stcb->asoc.ifp_had_enobuf = 0; 4966 } 4967 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 4968 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 4969 } 4970 4971 struct mbuf * 4972 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 4973 int param_offset, int *abort_processing, 4974 struct sctp_chunkhdr *cp, 4975 int *nat_friendly, 4976 int *cookie_found) 4977 { 4978 /* 4979 * Given a mbuf containing an INIT or INIT-ACK with the param_offset 4980 * being equal to the beginning of the params i.e. (iphlen + 4981 * sizeof(struct sctp_init_msg) parse through the parameters to the 4982 * end of the mbuf verifying that all parameters are known. 4983 * 4984 * For unknown parameters build and return a mbuf with 4985 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop 4986 * processing this chunk stop, and set *abort_processing to 1. 4987 * 4988 * By having param_offset be pre-set to where parameters begin it is 4989 * hoped that this routine may be reused in the future by new 4990 * features. 4991 */ 4992 struct sctp_paramhdr *phdr, params; 4993 4994 struct mbuf *mat, *m_tmp, *op_err, *op_err_last; 4995 int at, limit, pad_needed; 4996 uint16_t ptype, plen, padded_size; 4997 4998 *abort_processing = 0; 4999 if (cookie_found != NULL) { 5000 *cookie_found = 0; 5001 } 5002 mat = in_initpkt; 5003 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 5004 at = param_offset; 5005 op_err = NULL; 5006 op_err_last = NULL; 5007 pad_needed = 0; 5008 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Check for unrecognized param's\n"); 5009 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5010 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 5011 ptype = ntohs(phdr->param_type); 5012 plen = ntohs(phdr->param_length); 5013 if ((plen > limit) || (plen < sizeof(struct sctp_paramhdr))) { 5014 /* wacked parameter */ 5015 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error %d\n", plen); 5016 goto invalid_size; 5017 } 5018 limit -= SCTP_SIZE32(plen); 5019 /*- 5020 * All parameters for all chunks that we know/understand are 5021 * listed here. We process them other places and make 5022 * appropriate stop actions per the upper bits. However this 5023 * is the generic routine processor's can call to get back 5024 * an operr.. to either incorporate (init-ack) or send. 5025 */ 5026 padded_size = SCTP_SIZE32(plen); 5027 switch (ptype) { 5028 /* Param's with variable size */ 5029 case SCTP_HEARTBEAT_INFO: 5030 case SCTP_UNRECOG_PARAM: 5031 case SCTP_ERROR_CAUSE_IND: 5032 /* ok skip fwd */ 5033 at += padded_size; 5034 break; 5035 case SCTP_STATE_COOKIE: 5036 if (cookie_found != NULL) { 5037 *cookie_found = 1; 5038 } 5039 at += padded_size; 5040 break; 5041 /* Param's with variable size within a range */ 5042 case SCTP_CHUNK_LIST: 5043 case SCTP_SUPPORTED_CHUNK_EXT: 5044 if (padded_size > (sizeof(struct sctp_supported_chunk_types_param) + (sizeof(uint8_t) * SCTP_MAX_SUPPORTED_EXT))) { 5045 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error chklist %d\n", plen); 5046 goto invalid_size; 5047 } 5048 at += padded_size; 5049 break; 5050 case SCTP_SUPPORTED_ADDRTYPE: 5051 if (padded_size > SCTP_MAX_ADDR_PARAMS_SIZE) { 5052 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error supaddrtype %d\n", plen); 5053 goto invalid_size; 5054 } 5055 at += padded_size; 5056 break; 5057 case SCTP_RANDOM: 5058 if (padded_size > (sizeof(struct sctp_auth_random) + SCTP_RANDOM_MAX_SIZE)) { 5059 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error random %d\n", plen); 5060 goto invalid_size; 5061 } 5062 at += padded_size; 5063 break; 5064 case SCTP_SET_PRIM_ADDR: 5065 case SCTP_DEL_IP_ADDRESS: 5066 case SCTP_ADD_IP_ADDRESS: 5067 if ((padded_size != sizeof(struct sctp_asconf_addrv4_param)) && 5068 (padded_size != sizeof(struct sctp_asconf_addr_param))) { 5069 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error setprim %d\n", plen); 5070 goto invalid_size; 5071 } 5072 at += padded_size; 5073 break; 5074 /* Param's with a fixed size */ 5075 case SCTP_IPV4_ADDRESS: 5076 if (padded_size != sizeof(struct sctp_ipv4addr_param)) { 5077 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv4 addr %d\n", plen); 5078 goto invalid_size; 5079 } 5080 at += padded_size; 5081 break; 5082 case SCTP_IPV6_ADDRESS: 5083 if (padded_size != sizeof(struct sctp_ipv6addr_param)) { 5084 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv6 addr %d\n", plen); 5085 goto invalid_size; 5086 } 5087 at += padded_size; 5088 break; 5089 case SCTP_COOKIE_PRESERVE: 5090 if (padded_size != sizeof(struct sctp_cookie_perserve_param)) { 5091 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error cookie-preserve %d\n", plen); 5092 goto invalid_size; 5093 } 5094 at += padded_size; 5095 break; 5096 case SCTP_HAS_NAT_SUPPORT: 5097 *nat_friendly = 1; 5098 /* fall through */ 5099 case SCTP_PRSCTP_SUPPORTED: 5100 if (padded_size != sizeof(struct sctp_paramhdr)) { 5101 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error prsctp/nat support %d\n", plen); 5102 goto invalid_size; 5103 } 5104 at += padded_size; 5105 break; 5106 case SCTP_ECN_CAPABLE: 5107 if (padded_size != sizeof(struct sctp_paramhdr)) { 5108 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecn %d\n", plen); 5109 goto invalid_size; 5110 } 5111 at += padded_size; 5112 break; 5113 case SCTP_ULP_ADAPTATION: 5114 if (padded_size != sizeof(struct sctp_adaptation_layer_indication)) { 5115 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error adapatation %d\n", plen); 5116 goto invalid_size; 5117 } 5118 at += padded_size; 5119 break; 5120 case SCTP_SUCCESS_REPORT: 5121 if (padded_size != sizeof(struct sctp_asconf_paramhdr)) { 5122 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error success %d\n", plen); 5123 goto invalid_size; 5124 } 5125 at += padded_size; 5126 break; 5127 case SCTP_HOSTNAME_ADDRESS: 5128 { 5129 /* Hostname parameters are deprecated. */ 5130 struct sctp_gen_error_cause *cause; 5131 int l_len; 5132 5133 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Can't handle hostname addresses.. abort processing\n"); 5134 *abort_processing = 1; 5135 sctp_m_freem(op_err); 5136 op_err = NULL; 5137 op_err_last = NULL; 5138 #ifdef INET6 5139 l_len = SCTP_MIN_OVERHEAD; 5140 #else 5141 l_len = SCTP_MIN_V4_OVERHEAD; 5142 #endif 5143 l_len += sizeof(struct sctp_chunkhdr); 5144 l_len += sizeof(struct sctp_gen_error_cause); 5145 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5146 if (op_err != NULL) { 5147 /* 5148 * Pre-reserve space for IP, SCTP, 5149 * and chunk header. 5150 */ 5151 #ifdef INET6 5152 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5153 #else 5154 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5155 #endif 5156 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5157 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5158 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause); 5159 cause = mtod(op_err, struct sctp_gen_error_cause *); 5160 cause->code = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR); 5161 cause->length = htons((uint16_t)(sizeof(struct sctp_gen_error_cause) + plen)); 5162 SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(mat, at, plen, M_NOWAIT); 5163 if (SCTP_BUF_NEXT(op_err) == NULL) { 5164 sctp_m_freem(op_err); 5165 op_err = NULL; 5166 op_err_last = NULL; 5167 } 5168 } 5169 return (op_err); 5170 break; 5171 } 5172 default: 5173 /* 5174 * we do not recognize the parameter figure out what 5175 * we do. 5176 */ 5177 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Hit default param %x\n", ptype); 5178 if ((ptype & 0x4000) == 0x4000) { 5179 /* Report bit is set?? */ 5180 SCTPDBG(SCTP_DEBUG_OUTPUT1, "report op err\n"); 5181 if (op_err == NULL) { 5182 int l_len; 5183 5184 /* Ok need to try to get an mbuf */ 5185 #ifdef INET6 5186 l_len = SCTP_MIN_OVERHEAD; 5187 #else 5188 l_len = SCTP_MIN_V4_OVERHEAD; 5189 #endif 5190 l_len += sizeof(struct sctp_chunkhdr); 5191 l_len += sizeof(struct sctp_paramhdr); 5192 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5193 if (op_err) { 5194 SCTP_BUF_LEN(op_err) = 0; 5195 #ifdef INET6 5196 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5197 #else 5198 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5199 #endif 5200 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5201 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5202 op_err_last = op_err; 5203 } 5204 } 5205 if (op_err != NULL) { 5206 /* If we have space */ 5207 struct sctp_paramhdr *param; 5208 5209 if (pad_needed > 0) { 5210 op_err_last = sctp_add_pad_tombuf(op_err_last, pad_needed); 5211 } 5212 if (op_err_last == NULL) { 5213 sctp_m_freem(op_err); 5214 op_err = NULL; 5215 op_err_last = NULL; 5216 goto more_processing; 5217 } 5218 if (M_TRAILINGSPACE(op_err_last) < (int)sizeof(struct sctp_paramhdr)) { 5219 m_tmp = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_NOWAIT, 1, MT_DATA); 5220 if (m_tmp == NULL) { 5221 sctp_m_freem(op_err); 5222 op_err = NULL; 5223 op_err_last = NULL; 5224 goto more_processing; 5225 } 5226 SCTP_BUF_LEN(m_tmp) = 0; 5227 SCTP_BUF_NEXT(m_tmp) = NULL; 5228 SCTP_BUF_NEXT(op_err_last) = m_tmp; 5229 op_err_last = m_tmp; 5230 } 5231 param = (struct sctp_paramhdr *)(mtod(op_err_last, caddr_t)+SCTP_BUF_LEN(op_err_last)); 5232 param->param_type = htons(SCTP_UNRECOG_PARAM); 5233 param->param_length = htons((uint16_t)sizeof(struct sctp_paramhdr) + plen); 5234 SCTP_BUF_LEN(op_err_last) += sizeof(struct sctp_paramhdr); 5235 SCTP_BUF_NEXT(op_err_last) = SCTP_M_COPYM(mat, at, plen, M_NOWAIT); 5236 if (SCTP_BUF_NEXT(op_err_last) == NULL) { 5237 sctp_m_freem(op_err); 5238 op_err = NULL; 5239 op_err_last = NULL; 5240 goto more_processing; 5241 } else { 5242 while (SCTP_BUF_NEXT(op_err_last) != NULL) { 5243 op_err_last = SCTP_BUF_NEXT(op_err_last); 5244 } 5245 } 5246 if (plen % 4 != 0) { 5247 pad_needed = 4 - (plen % 4); 5248 } else { 5249 pad_needed = 0; 5250 } 5251 } 5252 } 5253 more_processing: 5254 if ((ptype & 0x8000) == 0x0000) { 5255 SCTPDBG(SCTP_DEBUG_OUTPUT1, "stop proc\n"); 5256 return (op_err); 5257 } else { 5258 /* skip this chunk and continue processing */ 5259 SCTPDBG(SCTP_DEBUG_OUTPUT1, "move on\n"); 5260 at += SCTP_SIZE32(plen); 5261 } 5262 break; 5263 5264 } 5265 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5266 } 5267 return (op_err); 5268 invalid_size: 5269 SCTPDBG(SCTP_DEBUG_OUTPUT1, "abort flag set\n"); 5270 *abort_processing = 1; 5271 sctp_m_freem(op_err); 5272 op_err = NULL; 5273 op_err_last = NULL; 5274 if (phdr != NULL) { 5275 struct sctp_paramhdr *param; 5276 int l_len; 5277 #ifdef INET6 5278 l_len = SCTP_MIN_OVERHEAD; 5279 #else 5280 l_len = SCTP_MIN_V4_OVERHEAD; 5281 #endif 5282 l_len += sizeof(struct sctp_chunkhdr); 5283 l_len += (2 * sizeof(struct sctp_paramhdr)); 5284 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5285 if (op_err) { 5286 SCTP_BUF_LEN(op_err) = 0; 5287 #ifdef INET6 5288 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5289 #else 5290 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5291 #endif 5292 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5293 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5294 SCTP_BUF_LEN(op_err) = 2 * sizeof(struct sctp_paramhdr); 5295 param = mtod(op_err, struct sctp_paramhdr *); 5296 param->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 5297 param->param_length = htons(2 * sizeof(struct sctp_paramhdr)); 5298 param++; 5299 param->param_type = htons(ptype); 5300 param->param_length = htons(plen); 5301 } 5302 } 5303 return (op_err); 5304 } 5305 5306 static int 5307 sctp_are_there_new_addresses(struct sctp_association *asoc, 5308 struct mbuf *in_initpkt, int offset, struct sockaddr *src) 5309 { 5310 /* 5311 * Given a INIT packet, look through the packet to verify that there 5312 * are NO new addresses. As we go through the parameters add reports 5313 * of any un-understood parameters that require an error. Also we 5314 * must return (1) to drop the packet if we see a un-understood 5315 * parameter that tells us to drop the chunk. 5316 */ 5317 struct sockaddr *sa_touse; 5318 struct sockaddr *sa; 5319 struct sctp_paramhdr *phdr, params; 5320 uint16_t ptype, plen; 5321 uint8_t fnd; 5322 struct sctp_nets *net; 5323 int check_src; 5324 #ifdef INET 5325 struct sockaddr_in sin4, *sa4; 5326 #endif 5327 #ifdef INET6 5328 struct sockaddr_in6 sin6, *sa6; 5329 #endif 5330 5331 #ifdef INET 5332 memset(&sin4, 0, sizeof(sin4)); 5333 sin4.sin_family = AF_INET; 5334 sin4.sin_len = sizeof(sin4); 5335 #endif 5336 #ifdef INET6 5337 memset(&sin6, 0, sizeof(sin6)); 5338 sin6.sin6_family = AF_INET6; 5339 sin6.sin6_len = sizeof(sin6); 5340 #endif 5341 /* First what about the src address of the pkt ? */ 5342 check_src = 0; 5343 switch (src->sa_family) { 5344 #ifdef INET 5345 case AF_INET: 5346 if (asoc->scope.ipv4_addr_legal) { 5347 check_src = 1; 5348 } 5349 break; 5350 #endif 5351 #ifdef INET6 5352 case AF_INET6: 5353 if (asoc->scope.ipv6_addr_legal) { 5354 check_src = 1; 5355 } 5356 break; 5357 #endif 5358 default: 5359 /* TSNH */ 5360 break; 5361 } 5362 if (check_src) { 5363 fnd = 0; 5364 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5365 sa = (struct sockaddr *)&net->ro._l_addr; 5366 if (sa->sa_family == src->sa_family) { 5367 #ifdef INET 5368 if (sa->sa_family == AF_INET) { 5369 struct sockaddr_in *src4; 5370 5371 sa4 = (struct sockaddr_in *)sa; 5372 src4 = (struct sockaddr_in *)src; 5373 if (sa4->sin_addr.s_addr == src4->sin_addr.s_addr) { 5374 fnd = 1; 5375 break; 5376 } 5377 } 5378 #endif 5379 #ifdef INET6 5380 if (sa->sa_family == AF_INET6) { 5381 struct sockaddr_in6 *src6; 5382 5383 sa6 = (struct sockaddr_in6 *)sa; 5384 src6 = (struct sockaddr_in6 *)src; 5385 if (SCTP6_ARE_ADDR_EQUAL(sa6, src6)) { 5386 fnd = 1; 5387 break; 5388 } 5389 } 5390 #endif 5391 } 5392 } 5393 if (fnd == 0) { 5394 /* New address added! no need to look further. */ 5395 return (1); 5396 } 5397 } 5398 /* Ok so far lets munge through the rest of the packet */ 5399 offset += sizeof(struct sctp_init_chunk); 5400 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5401 while (phdr) { 5402 sa_touse = NULL; 5403 ptype = ntohs(phdr->param_type); 5404 plen = ntohs(phdr->param_length); 5405 switch (ptype) { 5406 #ifdef INET 5407 case SCTP_IPV4_ADDRESS: 5408 { 5409 struct sctp_ipv4addr_param *p4, p4_buf; 5410 5411 if (plen != sizeof(struct sctp_ipv4addr_param)) { 5412 return (1); 5413 } 5414 phdr = sctp_get_next_param(in_initpkt, offset, 5415 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 5416 if (phdr == NULL) { 5417 return (1); 5418 } 5419 if (asoc->scope.ipv4_addr_legal) { 5420 p4 = (struct sctp_ipv4addr_param *)phdr; 5421 sin4.sin_addr.s_addr = p4->addr; 5422 sa_touse = (struct sockaddr *)&sin4; 5423 } 5424 break; 5425 } 5426 #endif 5427 #ifdef INET6 5428 case SCTP_IPV6_ADDRESS: 5429 { 5430 struct sctp_ipv6addr_param *p6, p6_buf; 5431 5432 if (plen != sizeof(struct sctp_ipv6addr_param)) { 5433 return (1); 5434 } 5435 phdr = sctp_get_next_param(in_initpkt, offset, 5436 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 5437 if (phdr == NULL) { 5438 return (1); 5439 } 5440 if (asoc->scope.ipv6_addr_legal) { 5441 p6 = (struct sctp_ipv6addr_param *)phdr; 5442 memcpy((caddr_t)&sin6.sin6_addr, p6->addr, 5443 sizeof(p6->addr)); 5444 sa_touse = (struct sockaddr *)&sin6; 5445 } 5446 break; 5447 } 5448 #endif 5449 default: 5450 sa_touse = NULL; 5451 break; 5452 } 5453 if (sa_touse) { 5454 /* ok, sa_touse points to one to check */ 5455 fnd = 0; 5456 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5457 sa = (struct sockaddr *)&net->ro._l_addr; 5458 if (sa->sa_family != sa_touse->sa_family) { 5459 continue; 5460 } 5461 #ifdef INET 5462 if (sa->sa_family == AF_INET) { 5463 sa4 = (struct sockaddr_in *)sa; 5464 if (sa4->sin_addr.s_addr == 5465 sin4.sin_addr.s_addr) { 5466 fnd = 1; 5467 break; 5468 } 5469 } 5470 #endif 5471 #ifdef INET6 5472 if (sa->sa_family == AF_INET6) { 5473 sa6 = (struct sockaddr_in6 *)sa; 5474 if (SCTP6_ARE_ADDR_EQUAL( 5475 sa6, &sin6)) { 5476 fnd = 1; 5477 break; 5478 } 5479 } 5480 #endif 5481 } 5482 if (!fnd) { 5483 /* New addr added! no need to look further */ 5484 return (1); 5485 } 5486 } 5487 offset += SCTP_SIZE32(plen); 5488 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5489 } 5490 return (0); 5491 } 5492 5493 /* 5494 * Given a MBUF chain that was sent into us containing an INIT. Build a 5495 * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done 5496 * a pullup to include IPv6/4header, SCTP header and initial part of INIT 5497 * message (i.e. the struct sctp_init_msg). 5498 */ 5499 void 5500 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 5501 struct sctp_nets *src_net, struct mbuf *init_pkt, 5502 int iphlen, int offset, 5503 struct sockaddr *src, struct sockaddr *dst, 5504 struct sctphdr *sh, struct sctp_init_chunk *init_chk, 5505 uint8_t mflowtype, uint32_t mflowid, 5506 uint32_t vrf_id, uint16_t port) 5507 { 5508 struct sctp_association *asoc; 5509 struct mbuf *m, *m_tmp, *m_last, *m_cookie, *op_err; 5510 struct sctp_init_ack_chunk *initack; 5511 struct sctp_adaptation_layer_indication *ali; 5512 struct sctp_supported_chunk_types_param *pr_supported; 5513 struct sctp_paramhdr *ph; 5514 union sctp_sockstore *over_addr; 5515 struct sctp_scoping scp; 5516 struct timeval now; 5517 #ifdef INET 5518 struct sockaddr_in *dst4 = (struct sockaddr_in *)dst; 5519 struct sockaddr_in *src4 = (struct sockaddr_in *)src; 5520 struct sockaddr_in *sin; 5521 #endif 5522 #ifdef INET6 5523 struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst; 5524 struct sockaddr_in6 *src6 = (struct sockaddr_in6 *)src; 5525 struct sockaddr_in6 *sin6; 5526 #endif 5527 struct sockaddr *to; 5528 struct sctp_state_cookie stc; 5529 struct sctp_nets *net = NULL; 5530 uint8_t *signature = NULL; 5531 int cnt_inits_to = 0; 5532 uint16_t his_limit, i_want; 5533 int abort_flag; 5534 int nat_friendly = 0; 5535 int error; 5536 struct socket *so; 5537 uint16_t num_ext, chunk_len, padding_len, parameter_len; 5538 5539 if (stcb) { 5540 asoc = &stcb->asoc; 5541 } else { 5542 asoc = NULL; 5543 } 5544 if ((asoc != NULL) && 5545 (SCTP_GET_STATE(stcb) != SCTP_STATE_COOKIE_WAIT)) { 5546 if (sctp_are_there_new_addresses(asoc, init_pkt, offset, src)) { 5547 /* 5548 * new addresses, out of here in non-cookie-wait 5549 * states 5550 * 5551 * Send an ABORT, without the new address error 5552 * cause. This looks no different than if no 5553 * listener was present. 5554 */ 5555 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5556 "Address added"); 5557 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5558 mflowtype, mflowid, inp->fibnum, 5559 vrf_id, port); 5560 return; 5561 } 5562 if (src_net != NULL && (src_net->port != port)) { 5563 /* 5564 * change of remote encapsulation port, out of here 5565 * in non-cookie-wait states 5566 * 5567 * Send an ABORT, without an specific error cause. 5568 * This looks no different than if no listener was 5569 * present. 5570 */ 5571 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5572 "Remote encapsulation port changed"); 5573 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5574 mflowtype, mflowid, inp->fibnum, 5575 vrf_id, port); 5576 return; 5577 } 5578 } 5579 abort_flag = 0; 5580 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 5581 (offset + sizeof(struct sctp_init_chunk)), 5582 &abort_flag, 5583 (struct sctp_chunkhdr *)init_chk, 5584 &nat_friendly, NULL); 5585 if (abort_flag) { 5586 do_a_abort: 5587 if (op_err == NULL) { 5588 char msg[SCTP_DIAG_INFO_LEN]; 5589 5590 snprintf(msg, sizeof(msg), "%s:%d at %s", __FILE__, __LINE__, __func__); 5591 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5592 msg); 5593 } 5594 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 5595 init_chk->init.initiate_tag, op_err, 5596 mflowtype, mflowid, inp->fibnum, 5597 vrf_id, port); 5598 return; 5599 } 5600 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 5601 if (m == NULL) { 5602 /* No memory, INIT timer will re-attempt. */ 5603 sctp_m_freem(op_err); 5604 return; 5605 } 5606 chunk_len = (uint16_t)sizeof(struct sctp_init_ack_chunk); 5607 padding_len = 0; 5608 5609 /* 5610 * We might not overwrite the identification[] completely and on 5611 * some platforms time_entered will contain some padding. Therefore 5612 * zero out the cookie to avoid putting uninitialized memory on the 5613 * wire. 5614 */ 5615 memset(&stc, 0, sizeof(struct sctp_state_cookie)); 5616 5617 /* the time I built cookie */ 5618 (void)SCTP_GETTIME_TIMEVAL(&now); 5619 stc.time_entered.tv_sec = now.tv_sec; 5620 stc.time_entered.tv_usec = now.tv_usec; 5621 5622 /* populate any tie tags */ 5623 if (asoc != NULL) { 5624 /* unlock before tag selections */ 5625 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 5626 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 5627 stc.cookie_life = asoc->cookie_life; 5628 net = asoc->primary_destination; 5629 } else { 5630 stc.tie_tag_my_vtag = 0; 5631 stc.tie_tag_peer_vtag = 0; 5632 /* life I will award this cookie */ 5633 stc.cookie_life = inp->sctp_ep.def_cookie_life; 5634 } 5635 5636 /* copy in the ports for later check */ 5637 stc.myport = sh->dest_port; 5638 stc.peerport = sh->src_port; 5639 5640 /* 5641 * If we wanted to honor cookie life extensions, we would add to 5642 * stc.cookie_life. For now we should NOT honor any extension 5643 */ 5644 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 5645 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5646 stc.ipv6_addr_legal = 1; 5647 if (SCTP_IPV6_V6ONLY(inp)) { 5648 stc.ipv4_addr_legal = 0; 5649 } else { 5650 stc.ipv4_addr_legal = 1; 5651 } 5652 } else { 5653 stc.ipv6_addr_legal = 0; 5654 stc.ipv4_addr_legal = 1; 5655 } 5656 stc.ipv4_scope = 0; 5657 if (net == NULL) { 5658 to = src; 5659 switch (dst->sa_family) { 5660 #ifdef INET 5661 case AF_INET: 5662 { 5663 /* lookup address */ 5664 stc.address[0] = src4->sin_addr.s_addr; 5665 stc.address[1] = 0; 5666 stc.address[2] = 0; 5667 stc.address[3] = 0; 5668 stc.addr_type = SCTP_IPV4_ADDRESS; 5669 /* local from address */ 5670 stc.laddress[0] = dst4->sin_addr.s_addr; 5671 stc.laddress[1] = 0; 5672 stc.laddress[2] = 0; 5673 stc.laddress[3] = 0; 5674 stc.laddr_type = SCTP_IPV4_ADDRESS; 5675 /* scope_id is only for v6 */ 5676 stc.scope_id = 0; 5677 if ((IN4_ISPRIVATE_ADDRESS(&src4->sin_addr)) || 5678 (IN4_ISPRIVATE_ADDRESS(&dst4->sin_addr))) { 5679 stc.ipv4_scope = 1; 5680 } 5681 /* Must use the address in this case */ 5682 if (sctp_is_address_on_local_host(src, vrf_id)) { 5683 stc.loopback_scope = 1; 5684 stc.ipv4_scope = 1; 5685 stc.site_scope = 1; 5686 stc.local_scope = 0; 5687 } 5688 break; 5689 } 5690 #endif 5691 #ifdef INET6 5692 case AF_INET6: 5693 { 5694 stc.addr_type = SCTP_IPV6_ADDRESS; 5695 memcpy(&stc.address, &src6->sin6_addr, sizeof(struct in6_addr)); 5696 stc.scope_id = ntohs(in6_getscope(&src6->sin6_addr)); 5697 if (sctp_is_address_on_local_host(src, vrf_id)) { 5698 stc.loopback_scope = 1; 5699 stc.local_scope = 0; 5700 stc.site_scope = 1; 5701 stc.ipv4_scope = 1; 5702 } else if (IN6_IS_ADDR_LINKLOCAL(&src6->sin6_addr) || 5703 IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr)) { 5704 /* 5705 * If the new destination or source 5706 * is a LINK_LOCAL we must have 5707 * common both site and local scope. 5708 * Don't set local scope though 5709 * since we must depend on the 5710 * source to be added implicitly. We 5711 * cannot assure just because we 5712 * share one link that all links are 5713 * common. 5714 */ 5715 stc.local_scope = 0; 5716 stc.site_scope = 1; 5717 stc.ipv4_scope = 1; 5718 /* 5719 * we start counting for the private 5720 * address stuff at 1. since the 5721 * link local we source from won't 5722 * show up in our scoped count. 5723 */ 5724 cnt_inits_to = 1; 5725 /* 5726 * pull out the scope_id from 5727 * incoming pkt 5728 */ 5729 } else if (IN6_IS_ADDR_SITELOCAL(&src6->sin6_addr) || 5730 IN6_IS_ADDR_SITELOCAL(&dst6->sin6_addr)) { 5731 /* 5732 * If the new destination or source 5733 * is SITE_LOCAL then we must have 5734 * site scope in common. 5735 */ 5736 stc.site_scope = 1; 5737 } 5738 memcpy(&stc.laddress, &dst6->sin6_addr, sizeof(struct in6_addr)); 5739 stc.laddr_type = SCTP_IPV6_ADDRESS; 5740 break; 5741 } 5742 #endif 5743 default: 5744 /* TSNH */ 5745 goto do_a_abort; 5746 break; 5747 } 5748 } else { 5749 /* set the scope per the existing tcb */ 5750 5751 #ifdef INET6 5752 struct sctp_nets *lnet; 5753 #endif 5754 5755 stc.loopback_scope = asoc->scope.loopback_scope; 5756 stc.ipv4_scope = asoc->scope.ipv4_local_scope; 5757 stc.site_scope = asoc->scope.site_scope; 5758 stc.local_scope = asoc->scope.local_scope; 5759 #ifdef INET6 5760 /* Why do we not consider IPv4 LL addresses? */ 5761 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 5762 if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) { 5763 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) { 5764 /* 5765 * if we have a LL address, start 5766 * counting at 1. 5767 */ 5768 cnt_inits_to = 1; 5769 } 5770 } 5771 } 5772 #endif 5773 /* use the net pointer */ 5774 to = (struct sockaddr *)&net->ro._l_addr; 5775 switch (to->sa_family) { 5776 #ifdef INET 5777 case AF_INET: 5778 sin = (struct sockaddr_in *)to; 5779 stc.address[0] = sin->sin_addr.s_addr; 5780 stc.address[1] = 0; 5781 stc.address[2] = 0; 5782 stc.address[3] = 0; 5783 stc.addr_type = SCTP_IPV4_ADDRESS; 5784 if (net->src_addr_selected == 0) { 5785 /* 5786 * strange case here, the INIT should have 5787 * did the selection. 5788 */ 5789 net->ro._s_addr = sctp_source_address_selection(inp, 5790 stcb, (sctp_route_t *)&net->ro, 5791 net, 0, vrf_id); 5792 if (net->ro._s_addr == NULL) { 5793 sctp_m_freem(op_err); 5794 sctp_m_freem(m); 5795 return; 5796 } 5797 5798 net->src_addr_selected = 1; 5799 5800 } 5801 stc.laddress[0] = net->ro._s_addr->address.sin.sin_addr.s_addr; 5802 stc.laddress[1] = 0; 5803 stc.laddress[2] = 0; 5804 stc.laddress[3] = 0; 5805 stc.laddr_type = SCTP_IPV4_ADDRESS; 5806 /* scope_id is only for v6 */ 5807 stc.scope_id = 0; 5808 break; 5809 #endif 5810 #ifdef INET6 5811 case AF_INET6: 5812 sin6 = (struct sockaddr_in6 *)to; 5813 memcpy(&stc.address, &sin6->sin6_addr, 5814 sizeof(struct in6_addr)); 5815 stc.addr_type = SCTP_IPV6_ADDRESS; 5816 stc.scope_id = sin6->sin6_scope_id; 5817 if (net->src_addr_selected == 0) { 5818 /* 5819 * strange case here, the INIT should have 5820 * done the selection. 5821 */ 5822 net->ro._s_addr = sctp_source_address_selection(inp, 5823 stcb, (sctp_route_t *)&net->ro, 5824 net, 0, vrf_id); 5825 if (net->ro._s_addr == NULL) { 5826 sctp_m_freem(op_err); 5827 sctp_m_freem(m); 5828 return; 5829 } 5830 5831 net->src_addr_selected = 1; 5832 } 5833 memcpy(&stc.laddress, &net->ro._s_addr->address.sin6.sin6_addr, 5834 sizeof(struct in6_addr)); 5835 stc.laddr_type = SCTP_IPV6_ADDRESS; 5836 break; 5837 #endif 5838 } 5839 } 5840 /* Now lets put the SCTP header in place */ 5841 initack = mtod(m, struct sctp_init_ack_chunk *); 5842 /* Save it off for quick ref */ 5843 stc.peers_vtag = ntohl(init_chk->init.initiate_tag); 5844 /* who are we */ 5845 memcpy(stc.identification, SCTP_VERSION_STRING, 5846 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 5847 memset(stc.reserved, 0, SCTP_RESERVE_SPACE); 5848 /* now the chunk header */ 5849 initack->ch.chunk_type = SCTP_INITIATION_ACK; 5850 initack->ch.chunk_flags = 0; 5851 /* fill in later from mbuf we build */ 5852 initack->ch.chunk_length = 0; 5853 /* place in my tag */ 5854 if ((asoc != NULL) && 5855 ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 5856 (SCTP_GET_STATE(stcb) == SCTP_STATE_INUSE) || 5857 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED))) { 5858 /* re-use the v-tags and init-seq here */ 5859 initack->init.initiate_tag = htonl(asoc->my_vtag); 5860 initack->init.initial_tsn = htonl(asoc->init_seq_number); 5861 } else { 5862 uint32_t vtag, itsn; 5863 5864 if (asoc) { 5865 atomic_add_int(&asoc->refcnt, 1); 5866 SCTP_TCB_UNLOCK(stcb); 5867 new_tag: 5868 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5869 if ((asoc->peer_supports_nat) && (vtag == asoc->my_vtag)) { 5870 /* 5871 * Got a duplicate vtag on some guy behind a 5872 * nat make sure we don't use it. 5873 */ 5874 goto new_tag; 5875 } 5876 initack->init.initiate_tag = htonl(vtag); 5877 /* get a TSN to use too */ 5878 itsn = sctp_select_initial_TSN(&inp->sctp_ep); 5879 initack->init.initial_tsn = htonl(itsn); 5880 SCTP_TCB_LOCK(stcb); 5881 atomic_add_int(&asoc->refcnt, -1); 5882 } else { 5883 SCTP_INP_INCR_REF(inp); 5884 SCTP_INP_RUNLOCK(inp); 5885 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5886 initack->init.initiate_tag = htonl(vtag); 5887 /* get a TSN to use too */ 5888 initack->init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 5889 SCTP_INP_RLOCK(inp); 5890 SCTP_INP_DECR_REF(inp); 5891 } 5892 } 5893 /* save away my tag to */ 5894 stc.my_vtag = initack->init.initiate_tag; 5895 5896 /* set up some of the credits. */ 5897 so = inp->sctp_socket; 5898 if (so == NULL) { 5899 /* memory problem */ 5900 sctp_m_freem(op_err); 5901 sctp_m_freem(m); 5902 return; 5903 } else { 5904 initack->init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(so), SCTP_MINIMAL_RWND)); 5905 } 5906 /* set what I want */ 5907 his_limit = ntohs(init_chk->init.num_inbound_streams); 5908 /* choose what I want */ 5909 if (asoc != NULL) { 5910 if (asoc->streamoutcnt > asoc->pre_open_streams) { 5911 i_want = asoc->streamoutcnt; 5912 } else { 5913 i_want = asoc->pre_open_streams; 5914 } 5915 } else { 5916 i_want = inp->sctp_ep.pre_open_stream_count; 5917 } 5918 if (his_limit < i_want) { 5919 /* I Want more :< */ 5920 initack->init.num_outbound_streams = init_chk->init.num_inbound_streams; 5921 } else { 5922 /* I can have what I want :> */ 5923 initack->init.num_outbound_streams = htons(i_want); 5924 } 5925 /* tell him his limit. */ 5926 initack->init.num_inbound_streams = 5927 htons(inp->sctp_ep.max_open_streams_intome); 5928 5929 /* adaptation layer indication parameter */ 5930 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 5931 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 5932 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 5933 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 5934 ali->ph.param_length = htons(parameter_len); 5935 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 5936 chunk_len += parameter_len; 5937 } 5938 5939 /* ECN parameter */ 5940 if (((asoc != NULL) && (asoc->ecn_supported == 1)) || 5941 ((asoc == NULL) && (inp->ecn_supported == 1))) { 5942 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5943 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5944 ph->param_type = htons(SCTP_ECN_CAPABLE); 5945 ph->param_length = htons(parameter_len); 5946 chunk_len += parameter_len; 5947 } 5948 5949 /* PR-SCTP supported parameter */ 5950 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5951 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5952 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5953 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5954 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 5955 ph->param_length = htons(parameter_len); 5956 chunk_len += parameter_len; 5957 } 5958 5959 /* Add NAT friendly parameter */ 5960 if (nat_friendly) { 5961 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5962 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5963 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 5964 ph->param_length = htons(parameter_len); 5965 chunk_len += parameter_len; 5966 } 5967 5968 /* And now tell the peer which extensions we support */ 5969 num_ext = 0; 5970 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 5971 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5972 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5973 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 5974 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5975 ((asoc == NULL) && (inp->idata_supported == 1))) { 5976 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 5977 } 5978 } 5979 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5980 ((asoc == NULL) && (inp->auth_supported == 1))) { 5981 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 5982 } 5983 if (((asoc != NULL) && (asoc->asconf_supported == 1)) || 5984 ((asoc == NULL) && (inp->asconf_supported == 1))) { 5985 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 5986 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 5987 } 5988 if (((asoc != NULL) && (asoc->reconfig_supported == 1)) || 5989 ((asoc == NULL) && (inp->reconfig_supported == 1))) { 5990 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 5991 } 5992 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5993 ((asoc == NULL) && (inp->idata_supported == 1))) { 5994 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 5995 } 5996 if (((asoc != NULL) && (asoc->nrsack_supported == 1)) || 5997 ((asoc == NULL) && (inp->nrsack_supported == 1))) { 5998 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 5999 } 6000 if (((asoc != NULL) && (asoc->pktdrop_supported == 1)) || 6001 ((asoc == NULL) && (inp->pktdrop_supported == 1))) { 6002 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 6003 } 6004 if (num_ext > 0) { 6005 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 6006 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 6007 pr_supported->ph.param_length = htons(parameter_len); 6008 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6009 chunk_len += parameter_len; 6010 } 6011 6012 /* add authentication parameters */ 6013 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 6014 ((asoc == NULL) && (inp->auth_supported == 1))) { 6015 struct sctp_auth_random *randp; 6016 struct sctp_auth_hmac_algo *hmacs; 6017 struct sctp_auth_chunk_list *chunks; 6018 6019 if (padding_len > 0) { 6020 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6021 chunk_len += padding_len; 6022 padding_len = 0; 6023 } 6024 /* generate and add RANDOM parameter */ 6025 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 6026 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + 6027 SCTP_AUTH_RANDOM_SIZE_DEFAULT; 6028 randp->ph.param_type = htons(SCTP_RANDOM); 6029 randp->ph.param_length = htons(parameter_len); 6030 SCTP_READ_RANDOM(randp->random_data, SCTP_AUTH_RANDOM_SIZE_DEFAULT); 6031 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6032 chunk_len += parameter_len; 6033 6034 if (padding_len > 0) { 6035 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6036 chunk_len += padding_len; 6037 padding_len = 0; 6038 } 6039 /* add HMAC_ALGO parameter */ 6040 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 6041 parameter_len = (uint16_t)sizeof(struct sctp_auth_hmac_algo) + 6042 sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs, 6043 (uint8_t *)hmacs->hmac_ids); 6044 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 6045 hmacs->ph.param_length = htons(parameter_len); 6046 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6047 chunk_len += parameter_len; 6048 6049 if (padding_len > 0) { 6050 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6051 chunk_len += padding_len; 6052 padding_len = 0; 6053 } 6054 /* add CHUNKS parameter */ 6055 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 6056 parameter_len = (uint16_t)sizeof(struct sctp_auth_chunk_list) + 6057 sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks, 6058 chunks->chunk_types); 6059 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 6060 chunks->ph.param_length = htons(parameter_len); 6061 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6062 chunk_len += parameter_len; 6063 } 6064 SCTP_BUF_LEN(m) = chunk_len; 6065 m_last = m; 6066 /* now the addresses */ 6067 /* 6068 * To optimize this we could put the scoping stuff into a structure 6069 * and remove the individual uint8's from the stc structure. Then we 6070 * could just sifa in the address within the stc.. but for now this 6071 * is a quick hack to get the address stuff teased apart. 6072 */ 6073 scp.ipv4_addr_legal = stc.ipv4_addr_legal; 6074 scp.ipv6_addr_legal = stc.ipv6_addr_legal; 6075 scp.loopback_scope = stc.loopback_scope; 6076 scp.ipv4_local_scope = stc.ipv4_scope; 6077 scp.local_scope = stc.local_scope; 6078 scp.site_scope = stc.site_scope; 6079 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &scp, m_last, 6080 cnt_inits_to, 6081 &padding_len, &chunk_len); 6082 /* padding_len can only be positive, if no addresses have been added */ 6083 if (padding_len > 0) { 6084 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6085 chunk_len += padding_len; 6086 SCTP_BUF_LEN(m) += padding_len; 6087 padding_len = 0; 6088 } 6089 6090 /* tack on the operational error if present */ 6091 if (op_err) { 6092 parameter_len = 0; 6093 for (m_tmp = op_err; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6094 parameter_len += SCTP_BUF_LEN(m_tmp); 6095 } 6096 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6097 SCTP_BUF_NEXT(m_last) = op_err; 6098 while (SCTP_BUF_NEXT(m_last) != NULL) { 6099 m_last = SCTP_BUF_NEXT(m_last); 6100 } 6101 chunk_len += parameter_len; 6102 } 6103 if (padding_len > 0) { 6104 m_last = sctp_add_pad_tombuf(m_last, padding_len); 6105 if (m_last == NULL) { 6106 /* Houston we have a problem, no space */ 6107 sctp_m_freem(m); 6108 return; 6109 } 6110 chunk_len += padding_len; 6111 padding_len = 0; 6112 } 6113 /* Now we must build a cookie */ 6114 m_cookie = sctp_add_cookie(init_pkt, offset, m, 0, &stc, &signature); 6115 if (m_cookie == NULL) { 6116 /* memory problem */ 6117 sctp_m_freem(m); 6118 return; 6119 } 6120 /* Now append the cookie to the end and update the space/size */ 6121 SCTP_BUF_NEXT(m_last) = m_cookie; 6122 parameter_len = 0; 6123 for (m_tmp = m_cookie; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6124 parameter_len += SCTP_BUF_LEN(m_tmp); 6125 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 6126 m_last = m_tmp; 6127 } 6128 } 6129 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6130 chunk_len += parameter_len; 6131 6132 /* 6133 * Place in the size, but we don't include the last pad (if any) in 6134 * the INIT-ACK. 6135 */ 6136 initack->ch.chunk_length = htons(chunk_len); 6137 6138 /* 6139 * Time to sign the cookie, we don't sign over the cookie signature 6140 * though thus we set trailer. 6141 */ 6142 (void)sctp_hmac_m(SCTP_HMAC, 6143 (uint8_t *)inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)], 6144 SCTP_SECRET_SIZE, m_cookie, sizeof(struct sctp_paramhdr), 6145 (uint8_t *)signature, SCTP_SIGNATURE_SIZE); 6146 /* 6147 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return 6148 * here since the timer will drive a retranmission. 6149 */ 6150 if (padding_len > 0) { 6151 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 6152 sctp_m_freem(m); 6153 return; 6154 } 6155 } 6156 if (stc.loopback_scope) { 6157 over_addr = (union sctp_sockstore *)dst; 6158 } else { 6159 over_addr = NULL; 6160 } 6161 6162 if ((error = sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0, 6163 0, 0, 6164 inp->sctp_lport, sh->src_port, init_chk->init.initiate_tag, 6165 port, over_addr, 6166 mflowtype, mflowid, 6167 SCTP_SO_NOT_LOCKED))) { 6168 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 6169 if (error == ENOBUFS) { 6170 if (asoc != NULL) { 6171 asoc->ifp_had_enobuf = 1; 6172 } 6173 SCTP_STAT_INCR(sctps_lowlevelerr); 6174 } 6175 } else { 6176 if (asoc != NULL) { 6177 asoc->ifp_had_enobuf = 0; 6178 } 6179 } 6180 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 6181 } 6182 6183 6184 static void 6185 sctp_prune_prsctp(struct sctp_tcb *stcb, 6186 struct sctp_association *asoc, 6187 struct sctp_sndrcvinfo *srcv, 6188 int dataout) 6189 { 6190 int freed_spc = 0; 6191 struct sctp_tmit_chunk *chk, *nchk; 6192 6193 SCTP_TCB_LOCK_ASSERT(stcb); 6194 if ((asoc->prsctp_supported) && 6195 (asoc->sent_queue_cnt_removeable > 0)) { 6196 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6197 /* 6198 * Look for chunks marked with the PR_SCTP flag AND 6199 * the buffer space flag. If the one being sent is 6200 * equal or greater priority then purge the old one 6201 * and free some space. 6202 */ 6203 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6204 /* 6205 * This one is PR-SCTP AND buffer space 6206 * limited type 6207 */ 6208 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 6209 /* 6210 * Lower numbers equates to higher 6211 * priority so if the one we are 6212 * looking at has a larger or equal 6213 * priority we want to drop the data 6214 * and NOT retransmit it. 6215 */ 6216 if (chk->data) { 6217 /* 6218 * We release the book_size 6219 * if the mbuf is here 6220 */ 6221 int ret_spc; 6222 uint8_t sent; 6223 6224 if (chk->sent > SCTP_DATAGRAM_UNSENT) 6225 sent = 1; 6226 else 6227 sent = 0; 6228 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6229 sent, 6230 SCTP_SO_LOCKED); 6231 freed_spc += ret_spc; 6232 if (freed_spc >= dataout) { 6233 return; 6234 } 6235 } /* if chunk was present */ 6236 } /* if of sufficient priority */ 6237 } /* if chunk has enabled */ 6238 } /* tailqforeach */ 6239 6240 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 6241 /* Here we must move to the sent queue and mark */ 6242 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6243 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 6244 if (chk->data) { 6245 /* 6246 * We release the book_size 6247 * if the mbuf is here 6248 */ 6249 int ret_spc; 6250 6251 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6252 0, SCTP_SO_LOCKED); 6253 6254 freed_spc += ret_spc; 6255 if (freed_spc >= dataout) { 6256 return; 6257 } 6258 } /* end if chk->data */ 6259 } /* end if right class */ 6260 } /* end if chk pr-sctp */ 6261 } /* tailqforeachsafe (chk) */ 6262 } /* if enabled in asoc */ 6263 } 6264 6265 int 6266 sctp_get_frag_point(struct sctp_tcb *stcb, 6267 struct sctp_association *asoc) 6268 { 6269 int siz, ovh; 6270 6271 /* 6272 * For endpoints that have both v6 and v4 addresses we must reserve 6273 * room for the ipv6 header, for those that are only dealing with V4 6274 * we use a larger frag point. 6275 */ 6276 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6277 ovh = SCTP_MIN_OVERHEAD; 6278 } else { 6279 ovh = SCTP_MIN_V4_OVERHEAD; 6280 } 6281 ovh += SCTP_DATA_CHUNK_OVERHEAD(stcb); 6282 if (stcb->asoc.sctp_frag_point > asoc->smallest_mtu) 6283 siz = asoc->smallest_mtu - ovh; 6284 else 6285 siz = (stcb->asoc.sctp_frag_point - ovh); 6286 /* 6287 * if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { 6288 */ 6289 /* A data chunk MUST fit in a cluster */ 6290 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk)); */ 6291 /* } */ 6292 6293 /* adjust for an AUTH chunk if DATA requires auth */ 6294 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) 6295 siz -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 6296 6297 if (siz % 4) { 6298 /* make it an even word boundary please */ 6299 siz -= (siz % 4); 6300 } 6301 return (siz); 6302 } 6303 6304 static void 6305 sctp_set_prsctp_policy(struct sctp_stream_queue_pending *sp) 6306 { 6307 /* 6308 * We assume that the user wants PR_SCTP_TTL if the user provides a 6309 * positive lifetime but does not specify any PR_SCTP policy. 6310 */ 6311 if (PR_SCTP_ENABLED(sp->sinfo_flags)) { 6312 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6313 } else if (sp->timetolive > 0) { 6314 sp->sinfo_flags |= SCTP_PR_SCTP_TTL; 6315 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6316 } else { 6317 return; 6318 } 6319 switch (PR_SCTP_POLICY(sp->sinfo_flags)) { 6320 case CHUNK_FLAGS_PR_SCTP_BUF: 6321 /* 6322 * Time to live is a priority stored in tv_sec when doing 6323 * the buffer drop thing. 6324 */ 6325 sp->ts.tv_sec = sp->timetolive; 6326 sp->ts.tv_usec = 0; 6327 break; 6328 case CHUNK_FLAGS_PR_SCTP_TTL: 6329 { 6330 struct timeval tv; 6331 6332 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6333 tv.tv_sec = sp->timetolive / 1000; 6334 tv.tv_usec = (sp->timetolive * 1000) % 1000000; 6335 /* 6336 * TODO sctp_constants.h needs alternative time 6337 * macros when _KERNEL is undefined. 6338 */ 6339 timevaladd(&sp->ts, &tv); 6340 } 6341 break; 6342 case CHUNK_FLAGS_PR_SCTP_RTX: 6343 /* 6344 * Time to live is a the number or retransmissions stored in 6345 * tv_sec. 6346 */ 6347 sp->ts.tv_sec = sp->timetolive; 6348 sp->ts.tv_usec = 0; 6349 break; 6350 default: 6351 SCTPDBG(SCTP_DEBUG_USRREQ1, 6352 "Unknown PR_SCTP policy %u.\n", 6353 PR_SCTP_POLICY(sp->sinfo_flags)); 6354 break; 6355 } 6356 } 6357 6358 static int 6359 sctp_msg_append(struct sctp_tcb *stcb, 6360 struct sctp_nets *net, 6361 struct mbuf *m, 6362 struct sctp_sndrcvinfo *srcv, int hold_stcb_lock) 6363 { 6364 int error = 0; 6365 struct mbuf *at; 6366 struct sctp_stream_queue_pending *sp = NULL; 6367 struct sctp_stream_out *strm; 6368 6369 /* 6370 * Given an mbuf chain, put it into the association send queue and 6371 * place it on the wheel 6372 */ 6373 if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) { 6374 /* Invalid stream number */ 6375 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6376 error = EINVAL; 6377 goto out_now; 6378 } 6379 if ((stcb->asoc.stream_locked) && 6380 (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) { 6381 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6382 error = EINVAL; 6383 goto out_now; 6384 } 6385 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 6386 /* Now can we send this? */ 6387 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 6388 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 6389 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 6390 (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) { 6391 /* got data while shutting down */ 6392 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 6393 error = ECONNRESET; 6394 goto out_now; 6395 } 6396 sctp_alloc_a_strmoq(stcb, sp); 6397 if (sp == NULL) { 6398 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6399 error = ENOMEM; 6400 goto out_now; 6401 } 6402 sp->sinfo_flags = srcv->sinfo_flags; 6403 sp->timetolive = srcv->sinfo_timetolive; 6404 sp->ppid = srcv->sinfo_ppid; 6405 sp->context = srcv->sinfo_context; 6406 sp->fsn = 0; 6407 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 6408 sp->net = net; 6409 atomic_add_int(&sp->net->ref_count, 1); 6410 } else { 6411 sp->net = NULL; 6412 } 6413 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6414 sp->sid = srcv->sinfo_stream; 6415 sp->msg_is_complete = 1; 6416 sp->sender_all_done = 1; 6417 sp->some_taken = 0; 6418 sp->data = m; 6419 sp->tail_mbuf = NULL; 6420 sctp_set_prsctp_policy(sp); 6421 /* 6422 * We could in theory (for sendall) sifa the length in, but we would 6423 * still have to hunt through the chain since we need to setup the 6424 * tail_mbuf 6425 */ 6426 sp->length = 0; 6427 for (at = m; at; at = SCTP_BUF_NEXT(at)) { 6428 if (SCTP_BUF_NEXT(at) == NULL) 6429 sp->tail_mbuf = at; 6430 sp->length += SCTP_BUF_LEN(at); 6431 } 6432 if (srcv->sinfo_keynumber_valid) { 6433 sp->auth_keyid = srcv->sinfo_keynumber; 6434 } else { 6435 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 6436 } 6437 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 6438 sctp_auth_key_acquire(stcb, sp->auth_keyid); 6439 sp->holds_key_ref = 1; 6440 } 6441 if (hold_stcb_lock == 0) { 6442 SCTP_TCB_SEND_LOCK(stcb); 6443 } 6444 sctp_snd_sb_alloc(stcb, sp->length); 6445 atomic_add_int(&stcb->asoc.stream_queue_cnt, 1); 6446 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 6447 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, &stcb->asoc, strm, sp, 1); 6448 m = NULL; 6449 if (hold_stcb_lock == 0) { 6450 SCTP_TCB_SEND_UNLOCK(stcb); 6451 } 6452 out_now: 6453 if (m) { 6454 sctp_m_freem(m); 6455 } 6456 return (error); 6457 } 6458 6459 6460 static struct mbuf * 6461 sctp_copy_mbufchain(struct mbuf *clonechain, 6462 struct mbuf *outchain, 6463 struct mbuf **endofchain, 6464 int can_take_mbuf, 6465 int sizeofcpy, 6466 uint8_t copy_by_ref) 6467 { 6468 struct mbuf *m; 6469 struct mbuf *appendchain; 6470 caddr_t cp; 6471 int len; 6472 6473 if (endofchain == NULL) { 6474 /* error */ 6475 error_out: 6476 if (outchain) 6477 sctp_m_freem(outchain); 6478 return (NULL); 6479 } 6480 if (can_take_mbuf) { 6481 appendchain = clonechain; 6482 } else { 6483 if (!copy_by_ref && 6484 (sizeofcpy <= (int)((((SCTP_BASE_SYSCTL(sctp_mbuf_threshold_count) - 1) * MLEN) + MHLEN))) 6485 ) { 6486 /* Its not in a cluster */ 6487 if (*endofchain == NULL) { 6488 /* lets get a mbuf cluster */ 6489 if (outchain == NULL) { 6490 /* This is the general case */ 6491 new_mbuf: 6492 outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6493 if (outchain == NULL) { 6494 goto error_out; 6495 } 6496 SCTP_BUF_LEN(outchain) = 0; 6497 *endofchain = outchain; 6498 /* get the prepend space */ 6499 SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4)); 6500 } else { 6501 /* 6502 * We really should not get a NULL 6503 * in endofchain 6504 */ 6505 /* find end */ 6506 m = outchain; 6507 while (m) { 6508 if (SCTP_BUF_NEXT(m) == NULL) { 6509 *endofchain = m; 6510 break; 6511 } 6512 m = SCTP_BUF_NEXT(m); 6513 } 6514 /* sanity */ 6515 if (*endofchain == NULL) { 6516 /* 6517 * huh, TSNH XXX maybe we 6518 * should panic 6519 */ 6520 sctp_m_freem(outchain); 6521 goto new_mbuf; 6522 } 6523 } 6524 /* get the new end of length */ 6525 len = (int)M_TRAILINGSPACE(*endofchain); 6526 } else { 6527 /* how much is left at the end? */ 6528 len = (int)M_TRAILINGSPACE(*endofchain); 6529 } 6530 /* Find the end of the data, for appending */ 6531 cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain))); 6532 6533 /* Now lets copy it out */ 6534 if (len >= sizeofcpy) { 6535 /* It all fits, copy it in */ 6536 m_copydata(clonechain, 0, sizeofcpy, cp); 6537 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6538 } else { 6539 /* fill up the end of the chain */ 6540 if (len > 0) { 6541 m_copydata(clonechain, 0, len, cp); 6542 SCTP_BUF_LEN((*endofchain)) += len; 6543 /* now we need another one */ 6544 sizeofcpy -= len; 6545 } 6546 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6547 if (m == NULL) { 6548 /* We failed */ 6549 goto error_out; 6550 } 6551 SCTP_BUF_NEXT((*endofchain)) = m; 6552 *endofchain = m; 6553 cp = mtod((*endofchain), caddr_t); 6554 m_copydata(clonechain, len, sizeofcpy, cp); 6555 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6556 } 6557 return (outchain); 6558 } else { 6559 /* copy the old fashion way */ 6560 appendchain = SCTP_M_COPYM(clonechain, 0, M_COPYALL, M_NOWAIT); 6561 #ifdef SCTP_MBUF_LOGGING 6562 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6563 sctp_log_mbc(appendchain, SCTP_MBUF_ICOPY); 6564 } 6565 #endif 6566 } 6567 } 6568 if (appendchain == NULL) { 6569 /* error */ 6570 if (outchain) 6571 sctp_m_freem(outchain); 6572 return (NULL); 6573 } 6574 if (outchain) { 6575 /* tack on to the end */ 6576 if (*endofchain != NULL) { 6577 SCTP_BUF_NEXT(((*endofchain))) = appendchain; 6578 } else { 6579 m = outchain; 6580 while (m) { 6581 if (SCTP_BUF_NEXT(m) == NULL) { 6582 SCTP_BUF_NEXT(m) = appendchain; 6583 break; 6584 } 6585 m = SCTP_BUF_NEXT(m); 6586 } 6587 } 6588 /* 6589 * save off the end and update the end-chain position 6590 */ 6591 m = appendchain; 6592 while (m) { 6593 if (SCTP_BUF_NEXT(m) == NULL) { 6594 *endofchain = m; 6595 break; 6596 } 6597 m = SCTP_BUF_NEXT(m); 6598 } 6599 return (outchain); 6600 } else { 6601 /* save off the end and update the end-chain position */ 6602 m = appendchain; 6603 while (m) { 6604 if (SCTP_BUF_NEXT(m) == NULL) { 6605 *endofchain = m; 6606 break; 6607 } 6608 m = SCTP_BUF_NEXT(m); 6609 } 6610 return (appendchain); 6611 } 6612 } 6613 6614 static int 6615 sctp_med_chunk_output(struct sctp_inpcb *inp, 6616 struct sctp_tcb *stcb, 6617 struct sctp_association *asoc, 6618 int *num_out, 6619 int *reason_code, 6620 int control_only, int from_where, 6621 struct timeval *now, int *now_filled, int frag_point, int so_locked 6622 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 6623 SCTP_UNUSED 6624 #endif 6625 ); 6626 6627 static void 6628 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, 6629 uint32_t val SCTP_UNUSED) 6630 { 6631 struct sctp_copy_all *ca; 6632 struct mbuf *m; 6633 int ret = 0; 6634 int added_control = 0; 6635 int un_sent, do_chunk_output = 1; 6636 struct sctp_association *asoc; 6637 struct sctp_nets *net; 6638 6639 ca = (struct sctp_copy_all *)ptr; 6640 if (ca->m == NULL) { 6641 return; 6642 } 6643 if (ca->inp != inp) { 6644 /* TSNH */ 6645 return; 6646 } 6647 if (ca->sndlen > 0) { 6648 m = SCTP_M_COPYM(ca->m, 0, M_COPYALL, M_NOWAIT); 6649 if (m == NULL) { 6650 /* can't copy so we are done */ 6651 ca->cnt_failed++; 6652 return; 6653 } 6654 #ifdef SCTP_MBUF_LOGGING 6655 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6656 sctp_log_mbc(m, SCTP_MBUF_ICOPY); 6657 } 6658 #endif 6659 } else { 6660 m = NULL; 6661 } 6662 SCTP_TCB_LOCK_ASSERT(stcb); 6663 if (stcb->asoc.alternate) { 6664 net = stcb->asoc.alternate; 6665 } else { 6666 net = stcb->asoc.primary_destination; 6667 } 6668 if (ca->sndrcv.sinfo_flags & SCTP_ABORT) { 6669 /* Abort this assoc with m as the user defined reason */ 6670 if (m != NULL) { 6671 SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_NOWAIT); 6672 } else { 6673 m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 6674 0, M_NOWAIT, 1, MT_DATA); 6675 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr); 6676 } 6677 if (m != NULL) { 6678 struct sctp_paramhdr *ph; 6679 6680 ph = mtod(m, struct sctp_paramhdr *); 6681 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 6682 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + ca->sndlen)); 6683 } 6684 /* 6685 * We add one here to keep the assoc from dis-appearing on 6686 * us. 6687 */ 6688 atomic_add_int(&stcb->asoc.refcnt, 1); 6689 sctp_abort_an_association(inp, stcb, m, SCTP_SO_NOT_LOCKED); 6690 /* 6691 * sctp_abort_an_association calls sctp_free_asoc() free 6692 * association will NOT free it since we incremented the 6693 * refcnt .. we do this to prevent it being freed and things 6694 * getting tricky since we could end up (from free_asoc) 6695 * calling inpcb_free which would get a recursive lock call 6696 * to the iterator lock.. But as a consequence of that the 6697 * stcb will return to us un-locked.. since free_asoc 6698 * returns with either no TCB or the TCB unlocked, we must 6699 * relock.. to unlock in the iterator timer :-0 6700 */ 6701 SCTP_TCB_LOCK(stcb); 6702 atomic_add_int(&stcb->asoc.refcnt, -1); 6703 goto no_chunk_output; 6704 } else { 6705 if (m) { 6706 ret = sctp_msg_append(stcb, net, m, 6707 &ca->sndrcv, 1); 6708 } 6709 asoc = &stcb->asoc; 6710 if (ca->sndrcv.sinfo_flags & SCTP_EOF) { 6711 /* shutdown this assoc */ 6712 if (TAILQ_EMPTY(&asoc->send_queue) && 6713 TAILQ_EMPTY(&asoc->sent_queue) && 6714 sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED) == 0) { 6715 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6716 goto abort_anyway; 6717 } 6718 /* 6719 * there is nothing queued to send, so I'm 6720 * done... 6721 */ 6722 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 6723 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6724 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6725 /* 6726 * only send SHUTDOWN the first time 6727 * through 6728 */ 6729 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 6730 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 6731 } 6732 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT); 6733 sctp_stop_timers_for_shutdown(stcb); 6734 sctp_send_shutdown(stcb, net); 6735 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 6736 net); 6737 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6738 asoc->primary_destination); 6739 added_control = 1; 6740 do_chunk_output = 0; 6741 } 6742 } else { 6743 /* 6744 * we still got (or just got) data to send, 6745 * so set SHUTDOWN_PENDING 6746 */ 6747 /* 6748 * XXX sockets draft says that SCTP_EOF 6749 * should be sent with no data. currently, 6750 * we will allow user data to be sent first 6751 * and move to SHUTDOWN-PENDING 6752 */ 6753 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 6754 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6755 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6756 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6757 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT); 6758 } 6759 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 6760 if (TAILQ_EMPTY(&asoc->send_queue) && 6761 TAILQ_EMPTY(&asoc->sent_queue) && 6762 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 6763 struct mbuf *op_err; 6764 char msg[SCTP_DIAG_INFO_LEN]; 6765 6766 abort_anyway: 6767 snprintf(msg, sizeof(msg), 6768 "%s:%d at %s", __FILE__, __LINE__, __func__); 6769 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 6770 msg); 6771 atomic_add_int(&stcb->asoc.refcnt, 1); 6772 sctp_abort_an_association(stcb->sctp_ep, stcb, 6773 op_err, SCTP_SO_NOT_LOCKED); 6774 atomic_add_int(&stcb->asoc.refcnt, -1); 6775 goto no_chunk_output; 6776 } 6777 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6778 asoc->primary_destination); 6779 } 6780 } 6781 6782 } 6783 } 6784 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 6785 (stcb->asoc.stream_queue_cnt * SCTP_DATA_CHUNK_OVERHEAD(stcb))); 6786 6787 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 6788 (stcb->asoc.total_flight > 0) && 6789 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 6790 do_chunk_output = 0; 6791 } 6792 if (do_chunk_output) 6793 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_NOT_LOCKED); 6794 else if (added_control) { 6795 int num_out, reason, now_filled = 0; 6796 struct timeval now; 6797 int frag_point; 6798 6799 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 6800 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 6801 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_NOT_LOCKED); 6802 } 6803 no_chunk_output: 6804 if (ret) { 6805 ca->cnt_failed++; 6806 } else { 6807 ca->cnt_sent++; 6808 } 6809 } 6810 6811 static void 6812 sctp_sendall_completes(void *ptr, uint32_t val SCTP_UNUSED) 6813 { 6814 struct sctp_copy_all *ca; 6815 6816 ca = (struct sctp_copy_all *)ptr; 6817 /* 6818 * Do a notify here? Kacheong suggests that the notify be done at 6819 * the send time.. so you would push up a notification if any send 6820 * failed. Don't know if this is feasible since the only failures we 6821 * have is "memory" related and if you cannot get an mbuf to send 6822 * the data you surely can't get an mbuf to send up to notify the 6823 * user you can't send the data :-> 6824 */ 6825 6826 /* now free everything */ 6827 if (ca->inp) { 6828 /* Lets clear the flag to allow others to run. */ 6829 ca->inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6830 } 6831 sctp_m_freem(ca->m); 6832 SCTP_FREE(ca, SCTP_M_COPYAL); 6833 } 6834 6835 static struct mbuf * 6836 sctp_copy_out_all(struct uio *uio, ssize_t len) 6837 { 6838 struct mbuf *ret, *at; 6839 ssize_t left, willcpy, cancpy, error; 6840 6841 ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAITOK, 1, MT_DATA); 6842 if (ret == NULL) { 6843 /* TSNH */ 6844 return (NULL); 6845 } 6846 left = len; 6847 SCTP_BUF_LEN(ret) = 0; 6848 /* save space for the data chunk header */ 6849 cancpy = (int)M_TRAILINGSPACE(ret); 6850 willcpy = min(cancpy, left); 6851 at = ret; 6852 while (left > 0) { 6853 /* Align data to the end */ 6854 error = uiomove(mtod(at, caddr_t), (int)willcpy, uio); 6855 if (error) { 6856 err_out_now: 6857 sctp_m_freem(at); 6858 return (NULL); 6859 } 6860 SCTP_BUF_LEN(at) = (int)willcpy; 6861 SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0; 6862 left -= willcpy; 6863 if (left > 0) { 6864 SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg((unsigned int)left, 0, M_WAITOK, 1, MT_DATA); 6865 if (SCTP_BUF_NEXT(at) == NULL) { 6866 goto err_out_now; 6867 } 6868 at = SCTP_BUF_NEXT(at); 6869 SCTP_BUF_LEN(at) = 0; 6870 cancpy = (int)M_TRAILINGSPACE(at); 6871 willcpy = min(cancpy, left); 6872 } 6873 } 6874 return (ret); 6875 } 6876 6877 static int 6878 sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, 6879 struct sctp_sndrcvinfo *srcv) 6880 { 6881 int ret; 6882 struct sctp_copy_all *ca; 6883 6884 if (inp->sctp_flags & SCTP_PCB_FLAGS_SND_ITERATOR_UP) { 6885 /* There is another. */ 6886 return (EBUSY); 6887 } 6888 if (uio->uio_resid > SCTP_MAX_SENDALL_LIMIT) { 6889 /* You must be less than the max! */ 6890 return (EMSGSIZE); 6891 } 6892 SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all), 6893 SCTP_M_COPYAL); 6894 if (ca == NULL) { 6895 sctp_m_freem(m); 6896 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6897 return (ENOMEM); 6898 } 6899 memset(ca, 0, sizeof(struct sctp_copy_all)); 6900 6901 ca->inp = inp; 6902 if (srcv) { 6903 memcpy(&ca->sndrcv, srcv, sizeof(struct sctp_nonpad_sndrcvinfo)); 6904 } 6905 /* 6906 * take off the sendall flag, it would be bad if we failed to do 6907 * this :-0 6908 */ 6909 ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL; 6910 /* get length and mbuf chain */ 6911 if (uio) { 6912 ca->sndlen = uio->uio_resid; 6913 ca->m = sctp_copy_out_all(uio, ca->sndlen); 6914 if (ca->m == NULL) { 6915 SCTP_FREE(ca, SCTP_M_COPYAL); 6916 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6917 return (ENOMEM); 6918 } 6919 } else { 6920 /* Gather the length of the send */ 6921 struct mbuf *mat; 6922 6923 ca->sndlen = 0; 6924 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 6925 ca->sndlen += SCTP_BUF_LEN(mat); 6926 } 6927 } 6928 inp->sctp_flags |= SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6929 ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, NULL, 6930 SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES, 6931 SCTP_ASOC_ANY_STATE, 6932 (void *)ca, 0, 6933 sctp_sendall_completes, inp, 1); 6934 if (ret) { 6935 SCTP_PRINTF("Failed to initiate iterator for sendall\n"); 6936 SCTP_FREE(ca, SCTP_M_COPYAL); 6937 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 6938 return (EFAULT); 6939 } 6940 return (0); 6941 } 6942 6943 6944 void 6945 sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc) 6946 { 6947 struct sctp_tmit_chunk *chk, *nchk; 6948 6949 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 6950 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 6951 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 6952 asoc->ctrl_queue_cnt--; 6953 if (chk->data) { 6954 sctp_m_freem(chk->data); 6955 chk->data = NULL; 6956 } 6957 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6958 } 6959 } 6960 } 6961 6962 void 6963 sctp_toss_old_asconf(struct sctp_tcb *stcb) 6964 { 6965 struct sctp_association *asoc; 6966 struct sctp_tmit_chunk *chk, *nchk; 6967 struct sctp_asconf_chunk *acp; 6968 6969 asoc = &stcb->asoc; 6970 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 6971 /* find SCTP_ASCONF chunk in queue */ 6972 if (chk->rec.chunk_id.id == SCTP_ASCONF) { 6973 if (chk->data) { 6974 acp = mtod(chk->data, struct sctp_asconf_chunk *); 6975 if (SCTP_TSN_GT(ntohl(acp->serial_number), asoc->asconf_seq_out_acked)) { 6976 /* Not Acked yet */ 6977 break; 6978 } 6979 } 6980 TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next); 6981 asoc->ctrl_queue_cnt--; 6982 if (chk->data) { 6983 sctp_m_freem(chk->data); 6984 chk->data = NULL; 6985 } 6986 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6987 } 6988 } 6989 } 6990 6991 6992 static void 6993 sctp_clean_up_datalist(struct sctp_tcb *stcb, 6994 struct sctp_association *asoc, 6995 struct sctp_tmit_chunk **data_list, 6996 int bundle_at, 6997 struct sctp_nets *net) 6998 { 6999 int i; 7000 struct sctp_tmit_chunk *tp1; 7001 7002 for (i = 0; i < bundle_at; i++) { 7003 /* off of the send queue */ 7004 TAILQ_REMOVE(&asoc->send_queue, data_list[i], sctp_next); 7005 asoc->send_queue_cnt--; 7006 if (i > 0) { 7007 /* 7008 * Any chunk NOT 0 you zap the time chunk 0 gets 7009 * zapped or set based on if a RTO measurment is 7010 * needed. 7011 */ 7012 data_list[i]->do_rtt = 0; 7013 } 7014 /* record time */ 7015 data_list[i]->sent_rcv_time = net->last_sent_time; 7016 data_list[i]->rec.data.cwnd_at_send = net->cwnd; 7017 data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.tsn; 7018 if (data_list[i]->whoTo == NULL) { 7019 data_list[i]->whoTo = net; 7020 atomic_add_int(&net->ref_count, 1); 7021 } 7022 /* on to the sent queue */ 7023 tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead); 7024 if ((tp1) && SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 7025 struct sctp_tmit_chunk *tpp; 7026 7027 /* need to move back */ 7028 back_up_more: 7029 tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next); 7030 if (tpp == NULL) { 7031 TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next); 7032 goto all_done; 7033 } 7034 tp1 = tpp; 7035 if (SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 7036 goto back_up_more; 7037 } 7038 TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next); 7039 } else { 7040 TAILQ_INSERT_TAIL(&asoc->sent_queue, 7041 data_list[i], 7042 sctp_next); 7043 } 7044 all_done: 7045 /* This does not lower until the cum-ack passes it */ 7046 asoc->sent_queue_cnt++; 7047 if ((asoc->peers_rwnd <= 0) && 7048 (asoc->total_flight == 0) && 7049 (bundle_at == 1)) { 7050 /* Mark the chunk as being a window probe */ 7051 SCTP_STAT_INCR(sctps_windowprobed); 7052 } 7053 #ifdef SCTP_AUDITING_ENABLED 7054 sctp_audit_log(0xC2, 3); 7055 #endif 7056 data_list[i]->sent = SCTP_DATAGRAM_SENT; 7057 data_list[i]->snd_count = 1; 7058 data_list[i]->rec.data.chunk_was_revoked = 0; 7059 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 7060 sctp_misc_ints(SCTP_FLIGHT_LOG_UP, 7061 data_list[i]->whoTo->flight_size, 7062 data_list[i]->book_size, 7063 (uint32_t)(uintptr_t)data_list[i]->whoTo, 7064 data_list[i]->rec.data.tsn); 7065 } 7066 sctp_flight_size_increase(data_list[i]); 7067 sctp_total_flight_increase(stcb, data_list[i]); 7068 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 7069 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 7070 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 7071 } 7072 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 7073 (uint32_t)(data_list[i]->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 7074 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 7075 /* SWS sender side engages */ 7076 asoc->peers_rwnd = 0; 7077 } 7078 } 7079 if (asoc->cc_functions.sctp_cwnd_update_packet_transmitted) { 7080 (*asoc->cc_functions.sctp_cwnd_update_packet_transmitted) (stcb, net); 7081 } 7082 } 7083 7084 static void 7085 sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc, int so_locked 7086 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7087 SCTP_UNUSED 7088 #endif 7089 ) 7090 { 7091 struct sctp_tmit_chunk *chk, *nchk; 7092 7093 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 7094 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7095 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 7096 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 7097 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 7098 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) || 7099 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 7100 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 7101 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 7102 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 7103 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 7104 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 7105 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 7106 /* Stray chunks must be cleaned up */ 7107 clean_up_anyway: 7108 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7109 asoc->ctrl_queue_cnt--; 7110 if (chk->data) { 7111 sctp_m_freem(chk->data); 7112 chk->data = NULL; 7113 } 7114 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 7115 asoc->fwd_tsn_cnt--; 7116 } 7117 sctp_free_a_chunk(stcb, chk, so_locked); 7118 } else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 7119 /* special handling, we must look into the param */ 7120 if (chk != asoc->str_reset) { 7121 goto clean_up_anyway; 7122 } 7123 } 7124 } 7125 } 7126 7127 static uint32_t 7128 sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length, 7129 uint32_t space_left, uint32_t frag_point, int eeor_on) 7130 { 7131 /* 7132 * Make a decision on if I should split a msg into multiple parts. 7133 * This is only asked of incomplete messages. 7134 */ 7135 if (eeor_on) { 7136 /* 7137 * If we are doing EEOR we need to always send it if its the 7138 * entire thing, since it might be all the guy is putting in 7139 * the hopper. 7140 */ 7141 if (space_left >= length) { 7142 /*- 7143 * If we have data outstanding, 7144 * we get another chance when the sack 7145 * arrives to transmit - wait for more data 7146 */ 7147 if (stcb->asoc.total_flight == 0) { 7148 /* 7149 * If nothing is in flight, we zero the 7150 * packet counter. 7151 */ 7152 return (length); 7153 } 7154 return (0); 7155 7156 } else { 7157 /* You can fill the rest */ 7158 return (space_left); 7159 } 7160 } 7161 /*- 7162 * For those strange folk that make the send buffer 7163 * smaller than our fragmentation point, we can't 7164 * get a full msg in so we have to allow splitting. 7165 */ 7166 if (SCTP_SB_LIMIT_SND(stcb->sctp_socket) < frag_point) { 7167 return (length); 7168 } 7169 if ((length <= space_left) || 7170 ((length - space_left) < SCTP_BASE_SYSCTL(sctp_min_residual))) { 7171 /* Sub-optimial residual don't split in non-eeor mode. */ 7172 return (0); 7173 } 7174 /* 7175 * If we reach here length is larger than the space_left. Do we wish 7176 * to split it for the sake of packet putting together? 7177 */ 7178 if (space_left >= min(SCTP_BASE_SYSCTL(sctp_min_split_point), frag_point)) { 7179 /* Its ok to split it */ 7180 return (min(space_left, frag_point)); 7181 } 7182 /* Nope, can't split */ 7183 return (0); 7184 } 7185 7186 static uint32_t 7187 sctp_move_to_outqueue(struct sctp_tcb *stcb, 7188 struct sctp_stream_out *strq, 7189 uint32_t space_left, 7190 uint32_t frag_point, 7191 int *giveup, 7192 int eeor_mode, 7193 int *bail, 7194 int so_locked 7195 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7196 SCTP_UNUSED 7197 #endif 7198 ) 7199 { 7200 /* Move from the stream to the send_queue keeping track of the total */ 7201 struct sctp_association *asoc; 7202 struct sctp_stream_queue_pending *sp; 7203 struct sctp_tmit_chunk *chk; 7204 struct sctp_data_chunk *dchkh = NULL; 7205 struct sctp_idata_chunk *ndchkh = NULL; 7206 uint32_t to_move, length; 7207 int leading; 7208 uint8_t rcv_flags = 0; 7209 uint8_t some_taken; 7210 uint8_t send_lock_up = 0; 7211 7212 SCTP_TCB_LOCK_ASSERT(stcb); 7213 asoc = &stcb->asoc; 7214 one_more_time: 7215 /* sa_ignore FREED_MEMORY */ 7216 sp = TAILQ_FIRST(&strq->outqueue); 7217 if (sp == NULL) { 7218 if (send_lock_up == 0) { 7219 SCTP_TCB_SEND_LOCK(stcb); 7220 send_lock_up = 1; 7221 } 7222 sp = TAILQ_FIRST(&strq->outqueue); 7223 if (sp) { 7224 goto one_more_time; 7225 } 7226 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_EXPLICIT_EOR) == 0) && 7227 (stcb->asoc.idata_supported == 0) && 7228 (strq->last_msg_incomplete)) { 7229 SCTP_PRINTF("Huh? Stream:%d lm_in_c=%d but queue is NULL\n", 7230 strq->sid, 7231 strq->last_msg_incomplete); 7232 strq->last_msg_incomplete = 0; 7233 } 7234 to_move = 0; 7235 if (send_lock_up) { 7236 SCTP_TCB_SEND_UNLOCK(stcb); 7237 send_lock_up = 0; 7238 } 7239 goto out_of; 7240 } 7241 if ((sp->msg_is_complete) && (sp->length == 0)) { 7242 if (sp->sender_all_done) { 7243 /* 7244 * We are doing deferred cleanup. Last time through 7245 * when we took all the data the sender_all_done was 7246 * not set. 7247 */ 7248 if ((sp->put_last_out == 0) && (sp->discard_rest == 0)) { 7249 SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n"); 7250 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7251 sp->sender_all_done, 7252 sp->length, 7253 sp->msg_is_complete, 7254 sp->put_last_out, 7255 send_lock_up); 7256 } 7257 if ((TAILQ_NEXT(sp, next) == NULL) && (send_lock_up == 0)) { 7258 SCTP_TCB_SEND_LOCK(stcb); 7259 send_lock_up = 1; 7260 } 7261 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7262 TAILQ_REMOVE(&strq->outqueue, sp, next); 7263 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7264 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7265 (strq->chunks_on_queues == 0) && 7266 TAILQ_EMPTY(&strq->outqueue)) { 7267 stcb->asoc.trigger_reset = 1; 7268 } 7269 if (sp->net) { 7270 sctp_free_remote_addr(sp->net); 7271 sp->net = NULL; 7272 } 7273 if (sp->data) { 7274 sctp_m_freem(sp->data); 7275 sp->data = NULL; 7276 } 7277 sctp_free_a_strmoq(stcb, sp, so_locked); 7278 /* we can't be locked to it */ 7279 if (send_lock_up) { 7280 SCTP_TCB_SEND_UNLOCK(stcb); 7281 send_lock_up = 0; 7282 } 7283 /* back to get the next msg */ 7284 goto one_more_time; 7285 } else { 7286 /* 7287 * sender just finished this but still holds a 7288 * reference 7289 */ 7290 *giveup = 1; 7291 to_move = 0; 7292 goto out_of; 7293 } 7294 } else { 7295 /* is there some to get */ 7296 if (sp->length == 0) { 7297 /* no */ 7298 *giveup = 1; 7299 to_move = 0; 7300 goto out_of; 7301 } else if (sp->discard_rest) { 7302 if (send_lock_up == 0) { 7303 SCTP_TCB_SEND_LOCK(stcb); 7304 send_lock_up = 1; 7305 } 7306 /* Whack down the size */ 7307 atomic_subtract_int(&stcb->asoc.total_output_queue_size, sp->length); 7308 if ((stcb->sctp_socket != NULL) && 7309 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 7310 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 7311 atomic_subtract_int(&stcb->sctp_socket->so_snd.sb_cc, sp->length); 7312 } 7313 if (sp->data) { 7314 sctp_m_freem(sp->data); 7315 sp->data = NULL; 7316 sp->tail_mbuf = NULL; 7317 } 7318 sp->length = 0; 7319 sp->some_taken = 1; 7320 *giveup = 1; 7321 to_move = 0; 7322 goto out_of; 7323 } 7324 } 7325 some_taken = sp->some_taken; 7326 re_look: 7327 length = sp->length; 7328 if (sp->msg_is_complete) { 7329 /* The message is complete */ 7330 to_move = min(length, frag_point); 7331 if (to_move == length) { 7332 /* All of it fits in the MTU */ 7333 if (sp->some_taken) { 7334 rcv_flags |= SCTP_DATA_LAST_FRAG; 7335 } else { 7336 rcv_flags |= SCTP_DATA_NOT_FRAG; 7337 } 7338 sp->put_last_out = 1; 7339 if (sp->sinfo_flags & SCTP_SACK_IMMEDIATELY) { 7340 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7341 } 7342 } else { 7343 /* Not all of it fits, we fragment */ 7344 if (sp->some_taken == 0) { 7345 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7346 } 7347 sp->some_taken = 1; 7348 } 7349 } else { 7350 to_move = sctp_can_we_split_this(stcb, length, space_left, frag_point, eeor_mode); 7351 if (to_move) { 7352 /*- 7353 * We use a snapshot of length in case it 7354 * is expanding during the compare. 7355 */ 7356 uint32_t llen; 7357 7358 llen = length; 7359 if (to_move >= llen) { 7360 to_move = llen; 7361 if (send_lock_up == 0) { 7362 /*- 7363 * We are taking all of an incomplete msg 7364 * thus we need a send lock. 7365 */ 7366 SCTP_TCB_SEND_LOCK(stcb); 7367 send_lock_up = 1; 7368 if (sp->msg_is_complete) { 7369 /* 7370 * the sender finished the 7371 * msg 7372 */ 7373 goto re_look; 7374 } 7375 } 7376 } 7377 if (sp->some_taken == 0) { 7378 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7379 sp->some_taken = 1; 7380 } 7381 } else { 7382 /* Nothing to take. */ 7383 *giveup = 1; 7384 to_move = 0; 7385 goto out_of; 7386 } 7387 } 7388 7389 /* If we reach here, we can copy out a chunk */ 7390 sctp_alloc_a_chunk(stcb, chk); 7391 if (chk == NULL) { 7392 /* No chunk memory */ 7393 *giveup = 1; 7394 to_move = 0; 7395 goto out_of; 7396 } 7397 /* 7398 * Setup for unordered if needed by looking at the user sent info 7399 * flags. 7400 */ 7401 if (sp->sinfo_flags & SCTP_UNORDERED) { 7402 rcv_flags |= SCTP_DATA_UNORDERED; 7403 } 7404 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 7405 (sp->sinfo_flags & SCTP_EOF) == SCTP_EOF) { 7406 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7407 } 7408 /* clear out the chunk before setting up */ 7409 memset(chk, 0, sizeof(*chk)); 7410 chk->rec.data.rcv_flags = rcv_flags; 7411 7412 if (to_move >= length) { 7413 /* we think we can steal the whole thing */ 7414 if ((sp->sender_all_done == 0) && (send_lock_up == 0)) { 7415 SCTP_TCB_SEND_LOCK(stcb); 7416 send_lock_up = 1; 7417 } 7418 if (to_move < sp->length) { 7419 /* bail, it changed */ 7420 goto dont_do_it; 7421 } 7422 chk->data = sp->data; 7423 chk->last_mbuf = sp->tail_mbuf; 7424 /* register the stealing */ 7425 sp->data = sp->tail_mbuf = NULL; 7426 } else { 7427 struct mbuf *m; 7428 7429 dont_do_it: 7430 chk->data = SCTP_M_COPYM(sp->data, 0, to_move, M_NOWAIT); 7431 chk->last_mbuf = NULL; 7432 if (chk->data == NULL) { 7433 sp->some_taken = some_taken; 7434 sctp_free_a_chunk(stcb, chk, so_locked); 7435 *bail = 1; 7436 to_move = 0; 7437 goto out_of; 7438 } 7439 #ifdef SCTP_MBUF_LOGGING 7440 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 7441 sctp_log_mbc(chk->data, SCTP_MBUF_ICOPY); 7442 } 7443 #endif 7444 /* Pull off the data */ 7445 m_adj(sp->data, to_move); 7446 /* Now lets work our way down and compact it */ 7447 m = sp->data; 7448 while (m && (SCTP_BUF_LEN(m) == 0)) { 7449 sp->data = SCTP_BUF_NEXT(m); 7450 SCTP_BUF_NEXT(m) = NULL; 7451 if (sp->tail_mbuf == m) { 7452 /*- 7453 * Freeing tail? TSNH since 7454 * we supposedly were taking less 7455 * than the sp->length. 7456 */ 7457 #ifdef INVARIANTS 7458 panic("Huh, freing tail? - TSNH"); 7459 #else 7460 SCTP_PRINTF("Huh, freeing tail? - TSNH\n"); 7461 sp->tail_mbuf = sp->data = NULL; 7462 sp->length = 0; 7463 #endif 7464 7465 } 7466 sctp_m_free(m); 7467 m = sp->data; 7468 } 7469 } 7470 if (SCTP_BUF_IS_EXTENDED(chk->data)) { 7471 chk->copy_by_ref = 1; 7472 } else { 7473 chk->copy_by_ref = 0; 7474 } 7475 /* 7476 * get last_mbuf and counts of mb usage This is ugly but hopefully 7477 * its only one mbuf. 7478 */ 7479 if (chk->last_mbuf == NULL) { 7480 chk->last_mbuf = chk->data; 7481 while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) { 7482 chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf); 7483 } 7484 } 7485 7486 if (to_move > length) { 7487 /*- This should not happen either 7488 * since we always lower to_move to the size 7489 * of sp->length if its larger. 7490 */ 7491 #ifdef INVARIANTS 7492 panic("Huh, how can to_move be larger?"); 7493 #else 7494 SCTP_PRINTF("Huh, how can to_move be larger?\n"); 7495 sp->length = 0; 7496 #endif 7497 } else { 7498 atomic_subtract_int(&sp->length, to_move); 7499 } 7500 leading = SCTP_DATA_CHUNK_OVERHEAD(stcb); 7501 if (M_LEADINGSPACE(chk->data) < leading) { 7502 /* Not enough room for a chunk header, get some */ 7503 struct mbuf *m; 7504 7505 m = sctp_get_mbuf_for_msg(1, 0, M_NOWAIT, 1, MT_DATA); 7506 if (m == NULL) { 7507 /* 7508 * we're in trouble here. _PREPEND below will free 7509 * all the data if there is no leading space, so we 7510 * must put the data back and restore. 7511 */ 7512 if (send_lock_up == 0) { 7513 SCTP_TCB_SEND_LOCK(stcb); 7514 send_lock_up = 1; 7515 } 7516 if (sp->data == NULL) { 7517 /* unsteal the data */ 7518 sp->data = chk->data; 7519 sp->tail_mbuf = chk->last_mbuf; 7520 } else { 7521 struct mbuf *m_tmp; 7522 7523 /* reassemble the data */ 7524 m_tmp = sp->data; 7525 sp->data = chk->data; 7526 SCTP_BUF_NEXT(chk->last_mbuf) = m_tmp; 7527 } 7528 sp->some_taken = some_taken; 7529 atomic_add_int(&sp->length, to_move); 7530 chk->data = NULL; 7531 *bail = 1; 7532 sctp_free_a_chunk(stcb, chk, so_locked); 7533 to_move = 0; 7534 goto out_of; 7535 } else { 7536 SCTP_BUF_LEN(m) = 0; 7537 SCTP_BUF_NEXT(m) = chk->data; 7538 chk->data = m; 7539 M_ALIGN(chk->data, 4); 7540 } 7541 } 7542 SCTP_BUF_PREPEND(chk->data, SCTP_DATA_CHUNK_OVERHEAD(stcb), M_NOWAIT); 7543 if (chk->data == NULL) { 7544 /* HELP, TSNH since we assured it would not above? */ 7545 #ifdef INVARIANTS 7546 panic("prepend failes HELP?"); 7547 #else 7548 SCTP_PRINTF("prepend fails HELP?\n"); 7549 sctp_free_a_chunk(stcb, chk, so_locked); 7550 #endif 7551 *bail = 1; 7552 to_move = 0; 7553 goto out_of; 7554 } 7555 sctp_snd_sb_alloc(stcb, SCTP_DATA_CHUNK_OVERHEAD(stcb)); 7556 chk->book_size = chk->send_size = (uint16_t)(to_move + SCTP_DATA_CHUNK_OVERHEAD(stcb)); 7557 chk->book_size_scale = 0; 7558 chk->sent = SCTP_DATAGRAM_UNSENT; 7559 7560 chk->flags = 0; 7561 chk->asoc = &stcb->asoc; 7562 chk->pad_inplace = 0; 7563 chk->no_fr_allowed = 0; 7564 if (stcb->asoc.idata_supported == 0) { 7565 if (rcv_flags & SCTP_DATA_UNORDERED) { 7566 /* Just use 0. The receiver ignores the values. */ 7567 chk->rec.data.mid = 0; 7568 } else { 7569 chk->rec.data.mid = strq->next_mid_ordered; 7570 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7571 strq->next_mid_ordered++; 7572 } 7573 } 7574 } else { 7575 if (rcv_flags & SCTP_DATA_UNORDERED) { 7576 chk->rec.data.mid = strq->next_mid_unordered; 7577 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7578 strq->next_mid_unordered++; 7579 } 7580 } else { 7581 chk->rec.data.mid = strq->next_mid_ordered; 7582 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7583 strq->next_mid_ordered++; 7584 } 7585 } 7586 } 7587 chk->rec.data.sid = sp->sid; 7588 chk->rec.data.ppid = sp->ppid; 7589 chk->rec.data.context = sp->context; 7590 chk->rec.data.doing_fast_retransmit = 0; 7591 7592 chk->rec.data.timetodrop = sp->ts; 7593 chk->flags = sp->act_flags; 7594 7595 if (sp->net) { 7596 chk->whoTo = sp->net; 7597 atomic_add_int(&chk->whoTo->ref_count, 1); 7598 } else 7599 chk->whoTo = NULL; 7600 7601 if (sp->holds_key_ref) { 7602 chk->auth_keyid = sp->auth_keyid; 7603 sctp_auth_key_acquire(stcb, chk->auth_keyid); 7604 chk->holds_key_ref = 1; 7605 } 7606 chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1); 7607 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) { 7608 sctp_misc_ints(SCTP_STRMOUT_LOG_SEND, 7609 (uint32_t)(uintptr_t)stcb, sp->length, 7610 (uint32_t)((chk->rec.data.sid << 16) | (0x0000ffff & chk->rec.data.mid)), 7611 chk->rec.data.tsn); 7612 } 7613 if (stcb->asoc.idata_supported == 0) { 7614 dchkh = mtod(chk->data, struct sctp_data_chunk *); 7615 } else { 7616 ndchkh = mtod(chk->data, struct sctp_idata_chunk *); 7617 } 7618 /* 7619 * Put the rest of the things in place now. Size was done earlier in 7620 * previous loop prior to padding. 7621 */ 7622 7623 #ifdef SCTP_ASOCLOG_OF_TSNS 7624 SCTP_TCB_LOCK_ASSERT(stcb); 7625 if (asoc->tsn_out_at >= SCTP_TSN_LOG_SIZE) { 7626 asoc->tsn_out_at = 0; 7627 asoc->tsn_out_wrapped = 1; 7628 } 7629 asoc->out_tsnlog[asoc->tsn_out_at].tsn = chk->rec.data.tsn; 7630 asoc->out_tsnlog[asoc->tsn_out_at].strm = chk->rec.data.sid; 7631 asoc->out_tsnlog[asoc->tsn_out_at].seq = chk->rec.data.mid; 7632 asoc->out_tsnlog[asoc->tsn_out_at].sz = chk->send_size; 7633 asoc->out_tsnlog[asoc->tsn_out_at].flgs = chk->rec.data.rcv_flags; 7634 asoc->out_tsnlog[asoc->tsn_out_at].stcb = (void *)stcb; 7635 asoc->out_tsnlog[asoc->tsn_out_at].in_pos = asoc->tsn_out_at; 7636 asoc->out_tsnlog[asoc->tsn_out_at].in_out = 2; 7637 asoc->tsn_out_at++; 7638 #endif 7639 if (stcb->asoc.idata_supported == 0) { 7640 dchkh->ch.chunk_type = SCTP_DATA; 7641 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7642 dchkh->dp.tsn = htonl(chk->rec.data.tsn); 7643 dchkh->dp.sid = htons(strq->sid); 7644 dchkh->dp.ssn = htons((uint16_t)chk->rec.data.mid); 7645 dchkh->dp.ppid = chk->rec.data.ppid; 7646 dchkh->ch.chunk_length = htons(chk->send_size); 7647 } else { 7648 ndchkh->ch.chunk_type = SCTP_IDATA; 7649 ndchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7650 ndchkh->dp.tsn = htonl(chk->rec.data.tsn); 7651 ndchkh->dp.sid = htons(strq->sid); 7652 ndchkh->dp.reserved = htons(0); 7653 ndchkh->dp.mid = htonl(chk->rec.data.mid); 7654 if (sp->fsn == 0) 7655 ndchkh->dp.ppid_fsn.ppid = chk->rec.data.ppid; 7656 else 7657 ndchkh->dp.ppid_fsn.fsn = htonl(sp->fsn); 7658 sp->fsn++; 7659 ndchkh->ch.chunk_length = htons(chk->send_size); 7660 } 7661 /* Now advance the chk->send_size by the actual pad needed. */ 7662 if (chk->send_size < SCTP_SIZE32(chk->book_size)) { 7663 /* need a pad */ 7664 struct mbuf *lm; 7665 int pads; 7666 7667 pads = SCTP_SIZE32(chk->book_size) - chk->send_size; 7668 lm = sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf); 7669 if (lm != NULL) { 7670 chk->last_mbuf = lm; 7671 chk->pad_inplace = 1; 7672 } 7673 chk->send_size += pads; 7674 } 7675 if (PR_SCTP_ENABLED(chk->flags)) { 7676 asoc->pr_sctp_cnt++; 7677 } 7678 if (sp->msg_is_complete && (sp->length == 0) && (sp->sender_all_done)) { 7679 /* All done pull and kill the message */ 7680 if (sp->put_last_out == 0) { 7681 SCTP_PRINTF("Gak, put out entire msg with NO end!-2\n"); 7682 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7683 sp->sender_all_done, 7684 sp->length, 7685 sp->msg_is_complete, 7686 sp->put_last_out, 7687 send_lock_up); 7688 } 7689 if ((send_lock_up == 0) && (TAILQ_NEXT(sp, next) == NULL)) { 7690 SCTP_TCB_SEND_LOCK(stcb); 7691 send_lock_up = 1; 7692 } 7693 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7694 TAILQ_REMOVE(&strq->outqueue, sp, next); 7695 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7696 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7697 (strq->chunks_on_queues == 0) && 7698 TAILQ_EMPTY(&strq->outqueue)) { 7699 stcb->asoc.trigger_reset = 1; 7700 } 7701 if (sp->net) { 7702 sctp_free_remote_addr(sp->net); 7703 sp->net = NULL; 7704 } 7705 if (sp->data) { 7706 sctp_m_freem(sp->data); 7707 sp->data = NULL; 7708 } 7709 sctp_free_a_strmoq(stcb, sp, so_locked); 7710 } 7711 asoc->chunks_on_out_queue++; 7712 strq->chunks_on_queues++; 7713 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 7714 asoc->send_queue_cnt++; 7715 out_of: 7716 if (send_lock_up) { 7717 SCTP_TCB_SEND_UNLOCK(stcb); 7718 } 7719 return (to_move); 7720 } 7721 7722 7723 static void 7724 sctp_fill_outqueue(struct sctp_tcb *stcb, 7725 struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked 7726 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7727 SCTP_UNUSED 7728 #endif 7729 ) 7730 { 7731 struct sctp_association *asoc; 7732 struct sctp_stream_out *strq; 7733 uint32_t space_left, moved, total_moved; 7734 int bail, giveup; 7735 7736 SCTP_TCB_LOCK_ASSERT(stcb); 7737 asoc = &stcb->asoc; 7738 total_moved = 0; 7739 switch (net->ro._l_addr.sa.sa_family) { 7740 #ifdef INET 7741 case AF_INET: 7742 space_left = net->mtu - SCTP_MIN_V4_OVERHEAD; 7743 break; 7744 #endif 7745 #ifdef INET6 7746 case AF_INET6: 7747 space_left = net->mtu - SCTP_MIN_OVERHEAD; 7748 break; 7749 #endif 7750 default: 7751 /* TSNH */ 7752 space_left = net->mtu; 7753 break; 7754 } 7755 /* Need an allowance for the data chunk header too */ 7756 space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb); 7757 7758 /* must make even word boundary */ 7759 space_left &= 0xfffffffc; 7760 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7761 giveup = 0; 7762 bail = 0; 7763 while ((space_left > 0) && (strq != NULL)) { 7764 moved = sctp_move_to_outqueue(stcb, strq, space_left, frag_point, 7765 &giveup, eeor_mode, &bail, so_locked); 7766 stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved); 7767 if ((giveup != 0) || (bail != 0)) { 7768 break; 7769 } 7770 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7771 total_moved += moved; 7772 space_left -= moved; 7773 if (space_left >= SCTP_DATA_CHUNK_OVERHEAD(stcb)) { 7774 space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb); 7775 } else { 7776 space_left = 0; 7777 } 7778 space_left &= 0xfffffffc; 7779 } 7780 if (bail != 0) 7781 *quit_now = 1; 7782 7783 stcb->asoc.ss_functions.sctp_ss_packet_done(stcb, net, asoc); 7784 7785 if (total_moved == 0) { 7786 if ((stcb->asoc.sctp_cmt_on_off == 0) && 7787 (net == stcb->asoc.primary_destination)) { 7788 /* ran dry for primary network net */ 7789 SCTP_STAT_INCR(sctps_primary_randry); 7790 } else if (stcb->asoc.sctp_cmt_on_off > 0) { 7791 /* ran dry with CMT on */ 7792 SCTP_STAT_INCR(sctps_cmt_randry); 7793 } 7794 } 7795 } 7796 7797 void 7798 sctp_fix_ecn_echo(struct sctp_association *asoc) 7799 { 7800 struct sctp_tmit_chunk *chk; 7801 7802 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7803 if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 7804 chk->sent = SCTP_DATAGRAM_UNSENT; 7805 } 7806 } 7807 } 7808 7809 void 7810 sctp_move_chunks_from_net(struct sctp_tcb *stcb, struct sctp_nets *net) 7811 { 7812 struct sctp_association *asoc; 7813 struct sctp_tmit_chunk *chk; 7814 struct sctp_stream_queue_pending *sp; 7815 unsigned int i; 7816 7817 if (net == NULL) { 7818 return; 7819 } 7820 asoc = &stcb->asoc; 7821 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 7822 TAILQ_FOREACH(sp, &stcb->asoc.strmout[i].outqueue, next) { 7823 if (sp->net == net) { 7824 sctp_free_remote_addr(sp->net); 7825 sp->net = NULL; 7826 } 7827 } 7828 } 7829 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7830 if (chk->whoTo == net) { 7831 sctp_free_remote_addr(chk->whoTo); 7832 chk->whoTo = NULL; 7833 } 7834 } 7835 } 7836 7837 int 7838 sctp_med_chunk_output(struct sctp_inpcb *inp, 7839 struct sctp_tcb *stcb, 7840 struct sctp_association *asoc, 7841 int *num_out, 7842 int *reason_code, 7843 int control_only, int from_where, 7844 struct timeval *now, int *now_filled, int frag_point, int so_locked 7845 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7846 SCTP_UNUSED 7847 #endif 7848 ) 7849 { 7850 /** 7851 * Ok this is the generic chunk service queue. we must do the 7852 * following: 7853 * - Service the stream queue that is next, moving any 7854 * message (note I must get a complete message i.e. FIRST/MIDDLE and 7855 * LAST to the out queue in one pass) and assigning TSN's. This 7856 * only applys though if the peer does not support NDATA. For NDATA 7857 * chunks its ok to not send the entire message ;-) 7858 * - Check to see if the cwnd/rwnd allows any output, if so we go ahead and 7859 * fomulate and send the low level chunks. Making sure to combine 7860 * any control in the control chunk queue also. 7861 */ 7862 struct sctp_nets *net, *start_at, *sack_goes_to = NULL, *old_start_at = NULL; 7863 struct mbuf *outchain, *endoutchain; 7864 struct sctp_tmit_chunk *chk, *nchk; 7865 7866 /* temp arrays for unlinking */ 7867 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 7868 int no_fragmentflg, error; 7869 unsigned int max_rwnd_per_dest, max_send_per_dest; 7870 int one_chunk, hbflag, skip_data_for_this_net; 7871 int asconf, cookie, no_out_cnt; 7872 int bundle_at, ctl_cnt, no_data_chunks, eeor_mode; 7873 unsigned int mtu, r_mtu, omtu, mx_mtu, to_out; 7874 int tsns_sent = 0; 7875 uint32_t auth_offset = 0; 7876 struct sctp_auth_chunk *auth = NULL; 7877 uint16_t auth_keyid; 7878 int override_ok = 1; 7879 int skip_fill_up = 0; 7880 int data_auth_reqd = 0; 7881 7882 /* 7883 * JRS 5/14/07 - Add flag for whether a heartbeat is sent to the 7884 * destination. 7885 */ 7886 int quit_now = 0; 7887 7888 *num_out = 0; 7889 *reason_code = 0; 7890 auth_keyid = stcb->asoc.authinfo.active_keyid; 7891 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) || 7892 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 7893 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 7894 eeor_mode = 1; 7895 } else { 7896 eeor_mode = 0; 7897 } 7898 ctl_cnt = no_out_cnt = asconf = cookie = 0; 7899 /* 7900 * First lets prime the pump. For each destination, if there is room 7901 * in the flight size, attempt to pull an MTU's worth out of the 7902 * stream queues into the general send_queue 7903 */ 7904 #ifdef SCTP_AUDITING_ENABLED 7905 sctp_audit_log(0xC2, 2); 7906 #endif 7907 SCTP_TCB_LOCK_ASSERT(stcb); 7908 hbflag = 0; 7909 if (control_only) 7910 no_data_chunks = 1; 7911 else 7912 no_data_chunks = 0; 7913 7914 /* Nothing to possible to send? */ 7915 if ((TAILQ_EMPTY(&asoc->control_send_queue) || 7916 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) && 7917 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7918 TAILQ_EMPTY(&asoc->send_queue) && 7919 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 7920 nothing_to_send: 7921 *reason_code = 9; 7922 return (0); 7923 } 7924 if (asoc->peers_rwnd == 0) { 7925 /* No room in peers rwnd */ 7926 *reason_code = 1; 7927 if (asoc->total_flight > 0) { 7928 /* we are allowed one chunk in flight */ 7929 no_data_chunks = 1; 7930 } 7931 } 7932 if (stcb->asoc.ecn_echo_cnt_onq) { 7933 /* Record where a sack goes, if any */ 7934 if (no_data_chunks && 7935 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) { 7936 /* Nothing but ECNe to send - we don't do that */ 7937 goto nothing_to_send; 7938 } 7939 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7940 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7941 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 7942 sack_goes_to = chk->whoTo; 7943 break; 7944 } 7945 } 7946 } 7947 max_rwnd_per_dest = ((asoc->peers_rwnd + asoc->total_flight) / asoc->numnets); 7948 if (stcb->sctp_socket) 7949 max_send_per_dest = SCTP_SB_LIMIT_SND(stcb->sctp_socket) / asoc->numnets; 7950 else 7951 max_send_per_dest = 0; 7952 if (no_data_chunks == 0) { 7953 /* How many non-directed chunks are there? */ 7954 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7955 if (chk->whoTo == NULL) { 7956 /* 7957 * We already have non-directed chunks on 7958 * the queue, no need to do a fill-up. 7959 */ 7960 skip_fill_up = 1; 7961 break; 7962 } 7963 } 7964 7965 } 7966 if ((no_data_chunks == 0) && 7967 (skip_fill_up == 0) && 7968 (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc))) { 7969 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 7970 /* 7971 * This for loop we are in takes in each net, if 7972 * its's got space in cwnd and has data sent to it 7973 * (when CMT is off) then it calls 7974 * sctp_fill_outqueue for the net. This gets data on 7975 * the send queue for that network. 7976 * 7977 * In sctp_fill_outqueue TSN's are assigned and data 7978 * is copied out of the stream buffers. Note mostly 7979 * copy by reference (we hope). 7980 */ 7981 net->window_probe = 0; 7982 if ((net != stcb->asoc.alternate) && 7983 ((net->dest_state & SCTP_ADDR_PF) || 7984 (!(net->dest_state & SCTP_ADDR_REACHABLE)) || 7985 (net->dest_state & SCTP_ADDR_UNCONFIRMED))) { 7986 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7987 sctp_log_cwnd(stcb, net, 1, 7988 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7989 } 7990 continue; 7991 } 7992 if ((stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) && 7993 (net->flight_size == 0)) { 7994 (*stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) (stcb, net); 7995 } 7996 if (net->flight_size >= net->cwnd) { 7997 /* skip this network, no room - can't fill */ 7998 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7999 sctp_log_cwnd(stcb, net, 3, 8000 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 8001 } 8002 continue; 8003 } 8004 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8005 sctp_log_cwnd(stcb, net, 4, SCTP_CWND_LOG_FILL_OUTQ_CALLED); 8006 } 8007 sctp_fill_outqueue(stcb, net, frag_point, eeor_mode, &quit_now, so_locked); 8008 if (quit_now) { 8009 /* memory alloc failure */ 8010 no_data_chunks = 1; 8011 break; 8012 } 8013 } 8014 } 8015 /* now service each destination and send out what we can for it */ 8016 /* Nothing to send? */ 8017 if (TAILQ_EMPTY(&asoc->control_send_queue) && 8018 TAILQ_EMPTY(&asoc->asconf_send_queue) && 8019 TAILQ_EMPTY(&asoc->send_queue)) { 8020 *reason_code = 8; 8021 return (0); 8022 } 8023 8024 if (asoc->sctp_cmt_on_off > 0) { 8025 /* get the last start point */ 8026 start_at = asoc->last_net_cmt_send_started; 8027 if (start_at == NULL) { 8028 /* null so to beginning */ 8029 start_at = TAILQ_FIRST(&asoc->nets); 8030 } else { 8031 start_at = TAILQ_NEXT(asoc->last_net_cmt_send_started, sctp_next); 8032 if (start_at == NULL) { 8033 start_at = TAILQ_FIRST(&asoc->nets); 8034 } 8035 } 8036 asoc->last_net_cmt_send_started = start_at; 8037 } else { 8038 start_at = TAILQ_FIRST(&asoc->nets); 8039 } 8040 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 8041 if (chk->whoTo == NULL) { 8042 if (asoc->alternate) { 8043 chk->whoTo = asoc->alternate; 8044 } else { 8045 chk->whoTo = asoc->primary_destination; 8046 } 8047 atomic_add_int(&chk->whoTo->ref_count, 1); 8048 } 8049 } 8050 old_start_at = NULL; 8051 again_one_more_time: 8052 for (net = start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) { 8053 /* how much can we send? */ 8054 /* SCTPDBG("Examine for sending net:%x\n", (uint32_t)net); */ 8055 if (old_start_at && (old_start_at == net)) { 8056 /* through list ocmpletely. */ 8057 break; 8058 } 8059 tsns_sent = 0xa; 8060 if (TAILQ_EMPTY(&asoc->control_send_queue) && 8061 TAILQ_EMPTY(&asoc->asconf_send_queue) && 8062 (net->flight_size >= net->cwnd)) { 8063 /* 8064 * Nothing on control or asconf and flight is full, 8065 * we can skip even in the CMT case. 8066 */ 8067 continue; 8068 } 8069 bundle_at = 0; 8070 endoutchain = outchain = NULL; 8071 no_fragmentflg = 1; 8072 one_chunk = 0; 8073 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 8074 skip_data_for_this_net = 1; 8075 } else { 8076 skip_data_for_this_net = 0; 8077 } 8078 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8079 #ifdef INET 8080 case AF_INET: 8081 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8082 break; 8083 #endif 8084 #ifdef INET6 8085 case AF_INET6: 8086 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8087 break; 8088 #endif 8089 default: 8090 /* TSNH */ 8091 mtu = net->mtu; 8092 break; 8093 } 8094 mx_mtu = mtu; 8095 to_out = 0; 8096 if (mtu > asoc->peers_rwnd) { 8097 if (asoc->total_flight > 0) { 8098 /* We have a packet in flight somewhere */ 8099 r_mtu = asoc->peers_rwnd; 8100 } else { 8101 /* We are always allowed to send one MTU out */ 8102 one_chunk = 1; 8103 r_mtu = mtu; 8104 } 8105 } else { 8106 r_mtu = mtu; 8107 } 8108 error = 0; 8109 /************************/ 8110 /* ASCONF transmission */ 8111 /************************/ 8112 /* Now first lets go through the asconf queue */ 8113 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 8114 if (chk->rec.chunk_id.id != SCTP_ASCONF) { 8115 continue; 8116 } 8117 if (chk->whoTo == NULL) { 8118 if (asoc->alternate == NULL) { 8119 if (asoc->primary_destination != net) { 8120 break; 8121 } 8122 } else { 8123 if (asoc->alternate != net) { 8124 break; 8125 } 8126 } 8127 } else { 8128 if (chk->whoTo != net) { 8129 break; 8130 } 8131 } 8132 if (chk->data == NULL) { 8133 break; 8134 } 8135 if (chk->sent != SCTP_DATAGRAM_UNSENT && 8136 chk->sent != SCTP_DATAGRAM_RESEND) { 8137 break; 8138 } 8139 /* 8140 * if no AUTH is yet included and this chunk 8141 * requires it, make sure to account for it. We 8142 * don't apply the size until the AUTH chunk is 8143 * actually added below in case there is no room for 8144 * this chunk. NOTE: we overload the use of "omtu" 8145 * here 8146 */ 8147 if ((auth == NULL) && 8148 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8149 stcb->asoc.peer_auth_chunks)) { 8150 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8151 } else 8152 omtu = 0; 8153 /* Here we do NOT factor the r_mtu */ 8154 if ((chk->send_size < (int)(mtu - omtu)) || 8155 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8156 /* 8157 * We probably should glom the mbuf chain 8158 * from the chk->data for control but the 8159 * problem is it becomes yet one more level 8160 * of tracking to do if for some reason 8161 * output fails. Then I have got to 8162 * reconstruct the merged control chain.. el 8163 * yucko.. for now we take the easy way and 8164 * do the copy 8165 */ 8166 /* 8167 * Add an AUTH chunk, if chunk requires it 8168 * save the offset into the chain for AUTH 8169 */ 8170 if ((auth == NULL) && 8171 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8172 stcb->asoc.peer_auth_chunks))) { 8173 outchain = sctp_add_auth_chunk(outchain, 8174 &endoutchain, 8175 &auth, 8176 &auth_offset, 8177 stcb, 8178 chk->rec.chunk_id.id); 8179 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8180 } 8181 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8182 (int)chk->rec.chunk_id.can_take_data, 8183 chk->send_size, chk->copy_by_ref); 8184 if (outchain == NULL) { 8185 *reason_code = 8; 8186 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8187 return (ENOMEM); 8188 } 8189 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8190 /* update our MTU size */ 8191 if (mtu > (chk->send_size + omtu)) 8192 mtu -= (chk->send_size + omtu); 8193 else 8194 mtu = 0; 8195 to_out += (chk->send_size + omtu); 8196 /* Do clear IP_DF ? */ 8197 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8198 no_fragmentflg = 0; 8199 } 8200 if (chk->rec.chunk_id.can_take_data) 8201 chk->data = NULL; 8202 /* 8203 * set hb flag since we can use these for 8204 * RTO 8205 */ 8206 hbflag = 1; 8207 asconf = 1; 8208 /* 8209 * should sysctl this: don't bundle data 8210 * with ASCONF since it requires AUTH 8211 */ 8212 no_data_chunks = 1; 8213 chk->sent = SCTP_DATAGRAM_SENT; 8214 if (chk->whoTo == NULL) { 8215 chk->whoTo = net; 8216 atomic_add_int(&net->ref_count, 1); 8217 } 8218 chk->snd_count++; 8219 if (mtu == 0) { 8220 /* 8221 * Ok we are out of room but we can 8222 * output without effecting the 8223 * flight size since this little guy 8224 * is a control only packet. 8225 */ 8226 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8227 /* 8228 * do NOT clear the asconf flag as 8229 * it is used to do appropriate 8230 * source address selection. 8231 */ 8232 if (*now_filled == 0) { 8233 (void)SCTP_GETTIME_TIMEVAL(now); 8234 *now_filled = 1; 8235 } 8236 net->last_sent_time = *now; 8237 hbflag = 0; 8238 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8239 (struct sockaddr *)&net->ro._l_addr, 8240 outchain, auth_offset, auth, 8241 stcb->asoc.authinfo.active_keyid, 8242 no_fragmentflg, 0, asconf, 8243 inp->sctp_lport, stcb->rport, 8244 htonl(stcb->asoc.peer_vtag), 8245 net->port, NULL, 8246 0, 0, 8247 so_locked))) { 8248 /* 8249 * error, we could not 8250 * output 8251 */ 8252 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8253 if (from_where == 0) { 8254 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8255 } 8256 if (error == ENOBUFS) { 8257 asoc->ifp_had_enobuf = 1; 8258 SCTP_STAT_INCR(sctps_lowlevelerr); 8259 } 8260 /* error, could not output */ 8261 if (error == EHOSTUNREACH) { 8262 /* 8263 * Destination went 8264 * unreachable 8265 * during this send 8266 */ 8267 sctp_move_chunks_from_net(stcb, net); 8268 } 8269 *reason_code = 7; 8270 break; 8271 } else { 8272 asoc->ifp_had_enobuf = 0; 8273 } 8274 /* 8275 * increase the number we sent, if a 8276 * cookie is sent we don't tell them 8277 * any was sent out. 8278 */ 8279 outchain = endoutchain = NULL; 8280 auth = NULL; 8281 auth_offset = 0; 8282 if (!no_out_cnt) 8283 *num_out += ctl_cnt; 8284 /* recalc a clean slate and setup */ 8285 switch (net->ro._l_addr.sa.sa_family) { 8286 #ifdef INET 8287 case AF_INET: 8288 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8289 break; 8290 #endif 8291 #ifdef INET6 8292 case AF_INET6: 8293 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8294 break; 8295 #endif 8296 default: 8297 /* TSNH */ 8298 mtu = net->mtu; 8299 break; 8300 } 8301 to_out = 0; 8302 no_fragmentflg = 1; 8303 } 8304 } 8305 } 8306 if (error != 0) { 8307 /* try next net */ 8308 continue; 8309 } 8310 /************************/ 8311 /* Control transmission */ 8312 /************************/ 8313 /* Now first lets go through the control queue */ 8314 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 8315 if ((sack_goes_to) && 8316 (chk->rec.chunk_id.id == SCTP_ECN_ECHO) && 8317 (chk->whoTo != sack_goes_to)) { 8318 /* 8319 * if we have a sack in queue, and we are 8320 * looking at an ecn echo that is NOT queued 8321 * to where the sack is going.. 8322 */ 8323 if (chk->whoTo == net) { 8324 /* 8325 * Don't transmit it to where its 8326 * going (current net) 8327 */ 8328 continue; 8329 } else if (sack_goes_to == net) { 8330 /* 8331 * But do transmit it to this 8332 * address 8333 */ 8334 goto skip_net_check; 8335 } 8336 } 8337 if (chk->whoTo == NULL) { 8338 if (asoc->alternate == NULL) { 8339 if (asoc->primary_destination != net) { 8340 continue; 8341 } 8342 } else { 8343 if (asoc->alternate != net) { 8344 continue; 8345 } 8346 } 8347 } else { 8348 if (chk->whoTo != net) { 8349 continue; 8350 } 8351 } 8352 skip_net_check: 8353 if (chk->data == NULL) { 8354 continue; 8355 } 8356 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 8357 /* 8358 * It must be unsent. Cookies and ASCONF's 8359 * hang around but there timers will force 8360 * when marked for resend. 8361 */ 8362 continue; 8363 } 8364 /* 8365 * if no AUTH is yet included and this chunk 8366 * requires it, make sure to account for it. We 8367 * don't apply the size until the AUTH chunk is 8368 * actually added below in case there is no room for 8369 * this chunk. NOTE: we overload the use of "omtu" 8370 * here 8371 */ 8372 if ((auth == NULL) && 8373 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8374 stcb->asoc.peer_auth_chunks)) { 8375 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8376 } else 8377 omtu = 0; 8378 /* Here we do NOT factor the r_mtu */ 8379 if ((chk->send_size <= (int)(mtu - omtu)) || 8380 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8381 /* 8382 * We probably should glom the mbuf chain 8383 * from the chk->data for control but the 8384 * problem is it becomes yet one more level 8385 * of tracking to do if for some reason 8386 * output fails. Then I have got to 8387 * reconstruct the merged control chain.. el 8388 * yucko.. for now we take the easy way and 8389 * do the copy 8390 */ 8391 /* 8392 * Add an AUTH chunk, if chunk requires it 8393 * save the offset into the chain for AUTH 8394 */ 8395 if ((auth == NULL) && 8396 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8397 stcb->asoc.peer_auth_chunks))) { 8398 outchain = sctp_add_auth_chunk(outchain, 8399 &endoutchain, 8400 &auth, 8401 &auth_offset, 8402 stcb, 8403 chk->rec.chunk_id.id); 8404 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8405 } 8406 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8407 (int)chk->rec.chunk_id.can_take_data, 8408 chk->send_size, chk->copy_by_ref); 8409 if (outchain == NULL) { 8410 *reason_code = 8; 8411 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8412 return (ENOMEM); 8413 } 8414 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8415 /* update our MTU size */ 8416 if (mtu > (chk->send_size + omtu)) 8417 mtu -= (chk->send_size + omtu); 8418 else 8419 mtu = 0; 8420 to_out += (chk->send_size + omtu); 8421 /* Do clear IP_DF ? */ 8422 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8423 no_fragmentflg = 0; 8424 } 8425 if (chk->rec.chunk_id.can_take_data) 8426 chk->data = NULL; 8427 /* Mark things to be removed, if needed */ 8428 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8429 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 8430 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 8431 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 8432 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 8433 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 8434 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 8435 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 8436 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 8437 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 8438 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 8439 if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) { 8440 hbflag = 1; 8441 } 8442 /* remove these chunks at the end */ 8443 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8444 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 8445 /* turn off the timer */ 8446 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 8447 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 8448 inp, stcb, net, 8449 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1); 8450 } 8451 } 8452 ctl_cnt++; 8453 } else { 8454 /* 8455 * Other chunks, since they have 8456 * timers running (i.e. COOKIE) we 8457 * just "trust" that it gets sent or 8458 * retransmitted. 8459 */ 8460 ctl_cnt++; 8461 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 8462 cookie = 1; 8463 no_out_cnt = 1; 8464 } else if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 8465 /* 8466 * Increment ecne send count 8467 * here this means we may be 8468 * over-zealous in our 8469 * counting if the send 8470 * fails, but its the best 8471 * place to do it (we used 8472 * to do it in the queue of 8473 * the chunk, but that did 8474 * not tell how many times 8475 * it was sent. 8476 */ 8477 SCTP_STAT_INCR(sctps_sendecne); 8478 } 8479 chk->sent = SCTP_DATAGRAM_SENT; 8480 if (chk->whoTo == NULL) { 8481 chk->whoTo = net; 8482 atomic_add_int(&net->ref_count, 1); 8483 } 8484 chk->snd_count++; 8485 } 8486 if (mtu == 0) { 8487 /* 8488 * Ok we are out of room but we can 8489 * output without effecting the 8490 * flight size since this little guy 8491 * is a control only packet. 8492 */ 8493 if (asconf) { 8494 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8495 /* 8496 * do NOT clear the asconf 8497 * flag as it is used to do 8498 * appropriate source 8499 * address selection. 8500 */ 8501 } 8502 if (cookie) { 8503 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8504 cookie = 0; 8505 } 8506 /* Only HB or ASCONF advances time */ 8507 if (hbflag) { 8508 if (*now_filled == 0) { 8509 (void)SCTP_GETTIME_TIMEVAL(now); 8510 *now_filled = 1; 8511 } 8512 net->last_sent_time = *now; 8513 hbflag = 0; 8514 } 8515 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8516 (struct sockaddr *)&net->ro._l_addr, 8517 outchain, 8518 auth_offset, auth, 8519 stcb->asoc.authinfo.active_keyid, 8520 no_fragmentflg, 0, asconf, 8521 inp->sctp_lport, stcb->rport, 8522 htonl(stcb->asoc.peer_vtag), 8523 net->port, NULL, 8524 0, 0, 8525 so_locked))) { 8526 /* 8527 * error, we could not 8528 * output 8529 */ 8530 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8531 if (from_where == 0) { 8532 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8533 } 8534 if (error == ENOBUFS) { 8535 asoc->ifp_had_enobuf = 1; 8536 SCTP_STAT_INCR(sctps_lowlevelerr); 8537 } 8538 if (error == EHOSTUNREACH) { 8539 /* 8540 * Destination went 8541 * unreachable 8542 * during this send 8543 */ 8544 sctp_move_chunks_from_net(stcb, net); 8545 } 8546 *reason_code = 7; 8547 break; 8548 } else { 8549 asoc->ifp_had_enobuf = 0; 8550 } 8551 /* 8552 * increase the number we sent, if a 8553 * cookie is sent we don't tell them 8554 * any was sent out. 8555 */ 8556 outchain = endoutchain = NULL; 8557 auth = NULL; 8558 auth_offset = 0; 8559 if (!no_out_cnt) 8560 *num_out += ctl_cnt; 8561 /* recalc a clean slate and setup */ 8562 switch (net->ro._l_addr.sa.sa_family) { 8563 #ifdef INET 8564 case AF_INET: 8565 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8566 break; 8567 #endif 8568 #ifdef INET6 8569 case AF_INET6: 8570 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8571 break; 8572 #endif 8573 default: 8574 /* TSNH */ 8575 mtu = net->mtu; 8576 break; 8577 } 8578 to_out = 0; 8579 no_fragmentflg = 1; 8580 } 8581 } 8582 } 8583 if (error != 0) { 8584 /* try next net */ 8585 continue; 8586 } 8587 /* JRI: if dest is in PF state, do not send data to it */ 8588 if ((asoc->sctp_cmt_on_off > 0) && 8589 (net != stcb->asoc.alternate) && 8590 (net->dest_state & SCTP_ADDR_PF)) { 8591 goto no_data_fill; 8592 } 8593 if (net->flight_size >= net->cwnd) { 8594 goto no_data_fill; 8595 } 8596 if ((asoc->sctp_cmt_on_off > 0) && 8597 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_RECV_BUFFER_SPLITTING) && 8598 (net->flight_size > max_rwnd_per_dest)) { 8599 goto no_data_fill; 8600 } 8601 /* 8602 * We need a specific accounting for the usage of the send 8603 * buffer. We also need to check the number of messages per 8604 * net. For now, this is better than nothing and it disabled 8605 * by default... 8606 */ 8607 if ((asoc->sctp_cmt_on_off > 0) && 8608 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_SEND_BUFFER_SPLITTING) && 8609 (max_send_per_dest > 0) && 8610 (net->flight_size > max_send_per_dest)) { 8611 goto no_data_fill; 8612 } 8613 /*********************/ 8614 /* Data transmission */ 8615 /*********************/ 8616 /* 8617 * if AUTH for DATA is required and no AUTH has been added 8618 * yet, account for this in the mtu now... if no data can be 8619 * bundled, this adjustment won't matter anyways since the 8620 * packet will be going out... 8621 */ 8622 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, 8623 stcb->asoc.peer_auth_chunks); 8624 if (data_auth_reqd && (auth == NULL)) { 8625 mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8626 } 8627 /* now lets add any data within the MTU constraints */ 8628 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8629 #ifdef INET 8630 case AF_INET: 8631 if (net->mtu > SCTP_MIN_V4_OVERHEAD) 8632 omtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8633 else 8634 omtu = 0; 8635 break; 8636 #endif 8637 #ifdef INET6 8638 case AF_INET6: 8639 if (net->mtu > SCTP_MIN_OVERHEAD) 8640 omtu = net->mtu - SCTP_MIN_OVERHEAD; 8641 else 8642 omtu = 0; 8643 break; 8644 #endif 8645 default: 8646 /* TSNH */ 8647 omtu = 0; 8648 break; 8649 } 8650 if ((((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) || 8651 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) && 8652 (skip_data_for_this_net == 0)) || 8653 (cookie)) { 8654 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 8655 if (no_data_chunks) { 8656 /* let only control go out */ 8657 *reason_code = 1; 8658 break; 8659 } 8660 if (net->flight_size >= net->cwnd) { 8661 /* skip this net, no room for data */ 8662 *reason_code = 2; 8663 break; 8664 } 8665 if ((chk->whoTo != NULL) && 8666 (chk->whoTo != net)) { 8667 /* Don't send the chunk on this net */ 8668 continue; 8669 } 8670 8671 if (asoc->sctp_cmt_on_off == 0) { 8672 if ((asoc->alternate) && 8673 (asoc->alternate != net) && 8674 (chk->whoTo == NULL)) { 8675 continue; 8676 } else if ((net != asoc->primary_destination) && 8677 (asoc->alternate == NULL) && 8678 (chk->whoTo == NULL)) { 8679 continue; 8680 } 8681 } 8682 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 8683 /*- 8684 * strange, we have a chunk that is 8685 * to big for its destination and 8686 * yet no fragment ok flag. 8687 * Something went wrong when the 8688 * PMTU changed...we did not mark 8689 * this chunk for some reason?? I 8690 * will fix it here by letting IP 8691 * fragment it for now and printing 8692 * a warning. This really should not 8693 * happen ... 8694 */ 8695 SCTP_PRINTF("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 8696 chk->send_size, mtu); 8697 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 8698 } 8699 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 8700 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 8701 struct sctp_data_chunk *dchkh; 8702 8703 dchkh = mtod(chk->data, struct sctp_data_chunk *); 8704 dchkh->ch.chunk_flags |= SCTP_DATA_SACK_IMMEDIATELY; 8705 } 8706 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 8707 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 8708 /* ok we will add this one */ 8709 8710 /* 8711 * Add an AUTH chunk, if chunk 8712 * requires it, save the offset into 8713 * the chain for AUTH 8714 */ 8715 if (data_auth_reqd) { 8716 if (auth == NULL) { 8717 outchain = sctp_add_auth_chunk(outchain, 8718 &endoutchain, 8719 &auth, 8720 &auth_offset, 8721 stcb, 8722 SCTP_DATA); 8723 auth_keyid = chk->auth_keyid; 8724 override_ok = 0; 8725 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8726 } else if (override_ok) { 8727 /* 8728 * use this data's 8729 * keyid 8730 */ 8731 auth_keyid = chk->auth_keyid; 8732 override_ok = 0; 8733 } else if (auth_keyid != chk->auth_keyid) { 8734 /* 8735 * different keyid, 8736 * so done bundling 8737 */ 8738 break; 8739 } 8740 } 8741 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0, 8742 chk->send_size, chk->copy_by_ref); 8743 if (outchain == NULL) { 8744 SCTPDBG(SCTP_DEBUG_OUTPUT3, "No memory?\n"); 8745 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 8746 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8747 } 8748 *reason_code = 3; 8749 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8750 return (ENOMEM); 8751 } 8752 /* upate our MTU size */ 8753 /* Do clear IP_DF ? */ 8754 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8755 no_fragmentflg = 0; 8756 } 8757 /* unsigned subtraction of mtu */ 8758 if (mtu > chk->send_size) 8759 mtu -= chk->send_size; 8760 else 8761 mtu = 0; 8762 /* unsigned subtraction of r_mtu */ 8763 if (r_mtu > chk->send_size) 8764 r_mtu -= chk->send_size; 8765 else 8766 r_mtu = 0; 8767 8768 to_out += chk->send_size; 8769 if ((to_out > mx_mtu) && no_fragmentflg) { 8770 #ifdef INVARIANTS 8771 panic("Exceeding mtu of %d out size is %d", mx_mtu, to_out); 8772 #else 8773 SCTP_PRINTF("Exceeding mtu of %d out size is %d\n", 8774 mx_mtu, to_out); 8775 #endif 8776 } 8777 chk->window_probe = 0; 8778 data_list[bundle_at++] = chk; 8779 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 8780 break; 8781 } 8782 if (chk->sent == SCTP_DATAGRAM_UNSENT) { 8783 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 8784 SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks); 8785 } else { 8786 SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks); 8787 } 8788 if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) && 8789 ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0)) 8790 /* 8791 * Count number of 8792 * user msg's that 8793 * were fragmented 8794 * we do this by 8795 * counting when we 8796 * see a LAST 8797 * fragment only. 8798 */ 8799 SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs); 8800 } 8801 if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) { 8802 if ((one_chunk) && (stcb->asoc.total_flight == 0)) { 8803 data_list[0]->window_probe = 1; 8804 net->window_probe = 1; 8805 } 8806 break; 8807 } 8808 } else { 8809 /* 8810 * Must be sent in order of the 8811 * TSN's (on a network) 8812 */ 8813 break; 8814 } 8815 } /* for (chunk gather loop for this net) */ 8816 } /* if asoc.state OPEN */ 8817 no_data_fill: 8818 /* Is there something to send for this destination? */ 8819 if (outchain) { 8820 /* We may need to start a control timer or two */ 8821 if (asconf) { 8822 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, 8823 stcb, net); 8824 /* 8825 * do NOT clear the asconf flag as it is 8826 * used to do appropriate source address 8827 * selection. 8828 */ 8829 } 8830 if (cookie) { 8831 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8832 cookie = 0; 8833 } 8834 /* must start a send timer if data is being sent */ 8835 if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) { 8836 /* 8837 * no timer running on this destination 8838 * restart it. 8839 */ 8840 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8841 } 8842 if (bundle_at || hbflag) { 8843 /* For data/asconf and hb set time */ 8844 if (*now_filled == 0) { 8845 (void)SCTP_GETTIME_TIMEVAL(now); 8846 *now_filled = 1; 8847 } 8848 net->last_sent_time = *now; 8849 } 8850 /* Now send it, if there is anything to send :> */ 8851 if ((error = sctp_lowlevel_chunk_output(inp, 8852 stcb, 8853 net, 8854 (struct sockaddr *)&net->ro._l_addr, 8855 outchain, 8856 auth_offset, 8857 auth, 8858 auth_keyid, 8859 no_fragmentflg, 8860 bundle_at, 8861 asconf, 8862 inp->sctp_lport, stcb->rport, 8863 htonl(stcb->asoc.peer_vtag), 8864 net->port, NULL, 8865 0, 0, 8866 so_locked))) { 8867 /* error, we could not output */ 8868 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8869 if (from_where == 0) { 8870 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8871 } 8872 if (error == ENOBUFS) { 8873 asoc->ifp_had_enobuf = 1; 8874 SCTP_STAT_INCR(sctps_lowlevelerr); 8875 } 8876 if (error == EHOSTUNREACH) { 8877 /* 8878 * Destination went unreachable 8879 * during this send 8880 */ 8881 sctp_move_chunks_from_net(stcb, net); 8882 } 8883 *reason_code = 6; 8884 /*- 8885 * I add this line to be paranoid. As far as 8886 * I can tell the continue, takes us back to 8887 * the top of the for, but just to make sure 8888 * I will reset these again here. 8889 */ 8890 ctl_cnt = bundle_at = 0; 8891 continue; /* This takes us back to the 8892 * for() for the nets. */ 8893 } else { 8894 asoc->ifp_had_enobuf = 0; 8895 } 8896 endoutchain = NULL; 8897 auth = NULL; 8898 auth_offset = 0; 8899 if (!no_out_cnt) { 8900 *num_out += (ctl_cnt + bundle_at); 8901 } 8902 if (bundle_at) { 8903 /* setup for a RTO measurement */ 8904 tsns_sent = data_list[0]->rec.data.tsn; 8905 /* fill time if not already filled */ 8906 if (*now_filled == 0) { 8907 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 8908 *now_filled = 1; 8909 *now = asoc->time_last_sent; 8910 } else { 8911 asoc->time_last_sent = *now; 8912 } 8913 if (net->rto_needed) { 8914 data_list[0]->do_rtt = 1; 8915 net->rto_needed = 0; 8916 } 8917 SCTP_STAT_INCR_BY(sctps_senddata, bundle_at); 8918 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 8919 } 8920 if (one_chunk) { 8921 break; 8922 } 8923 } 8924 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8925 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND); 8926 } 8927 } 8928 if (old_start_at == NULL) { 8929 old_start_at = start_at; 8930 start_at = TAILQ_FIRST(&asoc->nets); 8931 if (old_start_at) 8932 goto again_one_more_time; 8933 } 8934 8935 /* 8936 * At the end there should be no NON timed chunks hanging on this 8937 * queue. 8938 */ 8939 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8940 sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND); 8941 } 8942 if ((*num_out == 0) && (*reason_code == 0)) { 8943 *reason_code = 4; 8944 } else { 8945 *reason_code = 5; 8946 } 8947 sctp_clean_up_ctl(stcb, asoc, so_locked); 8948 return (0); 8949 } 8950 8951 void 8952 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 8953 { 8954 /*- 8955 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of 8956 * the control chunk queue. 8957 */ 8958 struct sctp_chunkhdr *hdr; 8959 struct sctp_tmit_chunk *chk; 8960 struct mbuf *mat, *last_mbuf; 8961 uint32_t chunk_length; 8962 uint16_t padding_length; 8963 8964 SCTP_TCB_LOCK_ASSERT(stcb); 8965 SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_NOWAIT); 8966 if (op_err == NULL) { 8967 return; 8968 } 8969 last_mbuf = NULL; 8970 chunk_length = 0; 8971 for (mat = op_err; mat != NULL; mat = SCTP_BUF_NEXT(mat)) { 8972 chunk_length += SCTP_BUF_LEN(mat); 8973 if (SCTP_BUF_NEXT(mat) == NULL) { 8974 last_mbuf = mat; 8975 } 8976 } 8977 if (chunk_length > SCTP_MAX_CHUNK_LENGTH) { 8978 sctp_m_freem(op_err); 8979 return; 8980 } 8981 padding_length = chunk_length % 4; 8982 if (padding_length != 0) { 8983 padding_length = 4 - padding_length; 8984 } 8985 if (padding_length != 0) { 8986 if (sctp_add_pad_tombuf(last_mbuf, padding_length) == NULL) { 8987 sctp_m_freem(op_err); 8988 return; 8989 } 8990 } 8991 sctp_alloc_a_chunk(stcb, chk); 8992 if (chk == NULL) { 8993 /* no memory */ 8994 sctp_m_freem(op_err); 8995 return; 8996 } 8997 chk->copy_by_ref = 0; 8998 chk->rec.chunk_id.id = SCTP_OPERATION_ERROR; 8999 chk->rec.chunk_id.can_take_data = 0; 9000 chk->flags = 0; 9001 chk->send_size = (uint16_t)chunk_length; 9002 chk->sent = SCTP_DATAGRAM_UNSENT; 9003 chk->snd_count = 0; 9004 chk->asoc = &stcb->asoc; 9005 chk->data = op_err; 9006 chk->whoTo = NULL; 9007 hdr = mtod(op_err, struct sctp_chunkhdr *); 9008 hdr->chunk_type = SCTP_OPERATION_ERROR; 9009 hdr->chunk_flags = 0; 9010 hdr->chunk_length = htons(chk->send_size); 9011 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9012 chk->asoc->ctrl_queue_cnt++; 9013 } 9014 9015 int 9016 sctp_send_cookie_echo(struct mbuf *m, 9017 int offset, int limit, 9018 struct sctp_tcb *stcb, 9019 struct sctp_nets *net) 9020 { 9021 /*- 9022 * pull out the cookie and put it at the front of the control chunk 9023 * queue. 9024 */ 9025 int at; 9026 struct mbuf *cookie; 9027 struct sctp_paramhdr param, *phdr; 9028 struct sctp_chunkhdr *hdr; 9029 struct sctp_tmit_chunk *chk; 9030 uint16_t ptype, plen; 9031 9032 SCTP_TCB_LOCK_ASSERT(stcb); 9033 /* First find the cookie in the param area */ 9034 cookie = NULL; 9035 at = offset + sizeof(struct sctp_init_chunk); 9036 for (;;) { 9037 phdr = sctp_get_next_param(m, at, ¶m, sizeof(param)); 9038 if (phdr == NULL) { 9039 return (-3); 9040 } 9041 ptype = ntohs(phdr->param_type); 9042 plen = ntohs(phdr->param_length); 9043 if (plen < sizeof(struct sctp_paramhdr)) { 9044 return (-6); 9045 } 9046 if (ptype == SCTP_STATE_COOKIE) { 9047 int pad; 9048 9049 /* found the cookie */ 9050 if (at + plen > limit) { 9051 return (-7); 9052 } 9053 cookie = SCTP_M_COPYM(m, at, plen, M_NOWAIT); 9054 if (cookie == NULL) { 9055 /* No memory */ 9056 return (-2); 9057 } 9058 if ((pad = (plen % 4)) > 0) { 9059 pad = 4 - pad; 9060 } 9061 if (pad > 0) { 9062 cookie = sctp_pad_lastmbuf(cookie, pad, NULL); 9063 if (cookie == NULL) { 9064 return (-8); 9065 } 9066 } 9067 #ifdef SCTP_MBUF_LOGGING 9068 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9069 sctp_log_mbc(cookie, SCTP_MBUF_ICOPY); 9070 } 9071 #endif 9072 break; 9073 } 9074 at += SCTP_SIZE32(plen); 9075 } 9076 /* ok, we got the cookie lets change it into a cookie echo chunk */ 9077 /* first the change from param to cookie */ 9078 hdr = mtod(cookie, struct sctp_chunkhdr *); 9079 hdr->chunk_type = SCTP_COOKIE_ECHO; 9080 hdr->chunk_flags = 0; 9081 /* get the chunk stuff now and place it in the FRONT of the queue */ 9082 sctp_alloc_a_chunk(stcb, chk); 9083 if (chk == NULL) { 9084 /* no memory */ 9085 sctp_m_freem(cookie); 9086 return (-5); 9087 } 9088 chk->copy_by_ref = 0; 9089 chk->rec.chunk_id.id = SCTP_COOKIE_ECHO; 9090 chk->rec.chunk_id.can_take_data = 0; 9091 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9092 chk->send_size = SCTP_SIZE32(plen); 9093 chk->sent = SCTP_DATAGRAM_UNSENT; 9094 chk->snd_count = 0; 9095 chk->asoc = &stcb->asoc; 9096 chk->data = cookie; 9097 chk->whoTo = net; 9098 atomic_add_int(&chk->whoTo->ref_count, 1); 9099 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 9100 chk->asoc->ctrl_queue_cnt++; 9101 return (0); 9102 } 9103 9104 void 9105 sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 9106 struct mbuf *m, 9107 int offset, 9108 int chk_length, 9109 struct sctp_nets *net) 9110 { 9111 /* 9112 * take a HB request and make it into a HB ack and send it. 9113 */ 9114 struct mbuf *outchain; 9115 struct sctp_chunkhdr *chdr; 9116 struct sctp_tmit_chunk *chk; 9117 9118 if (net == NULL) 9119 /* must have a net pointer */ 9120 return; 9121 9122 outchain = SCTP_M_COPYM(m, offset, chk_length, M_NOWAIT); 9123 if (outchain == NULL) { 9124 /* gak out of memory */ 9125 return; 9126 } 9127 #ifdef SCTP_MBUF_LOGGING 9128 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9129 sctp_log_mbc(outchain, SCTP_MBUF_ICOPY); 9130 } 9131 #endif 9132 chdr = mtod(outchain, struct sctp_chunkhdr *); 9133 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 9134 chdr->chunk_flags = 0; 9135 if (chk_length % 4 != 0) { 9136 sctp_pad_lastmbuf(outchain, 4 - (chk_length % 4), NULL); 9137 } 9138 sctp_alloc_a_chunk(stcb, chk); 9139 if (chk == NULL) { 9140 /* no memory */ 9141 sctp_m_freem(outchain); 9142 return; 9143 } 9144 chk->copy_by_ref = 0; 9145 chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK; 9146 chk->rec.chunk_id.can_take_data = 1; 9147 chk->flags = 0; 9148 chk->send_size = chk_length; 9149 chk->sent = SCTP_DATAGRAM_UNSENT; 9150 chk->snd_count = 0; 9151 chk->asoc = &stcb->asoc; 9152 chk->data = outchain; 9153 chk->whoTo = net; 9154 atomic_add_int(&chk->whoTo->ref_count, 1); 9155 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9156 chk->asoc->ctrl_queue_cnt++; 9157 } 9158 9159 void 9160 sctp_send_cookie_ack(struct sctp_tcb *stcb) 9161 { 9162 /* formulate and queue a cookie-ack back to sender */ 9163 struct mbuf *cookie_ack; 9164 struct sctp_chunkhdr *hdr; 9165 struct sctp_tmit_chunk *chk; 9166 9167 SCTP_TCB_LOCK_ASSERT(stcb); 9168 9169 cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 9170 if (cookie_ack == NULL) { 9171 /* no mbuf's */ 9172 return; 9173 } 9174 SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD); 9175 sctp_alloc_a_chunk(stcb, chk); 9176 if (chk == NULL) { 9177 /* no memory */ 9178 sctp_m_freem(cookie_ack); 9179 return; 9180 } 9181 chk->copy_by_ref = 0; 9182 chk->rec.chunk_id.id = SCTP_COOKIE_ACK; 9183 chk->rec.chunk_id.can_take_data = 1; 9184 chk->flags = 0; 9185 chk->send_size = sizeof(struct sctp_chunkhdr); 9186 chk->sent = SCTP_DATAGRAM_UNSENT; 9187 chk->snd_count = 0; 9188 chk->asoc = &stcb->asoc; 9189 chk->data = cookie_ack; 9190 if (chk->asoc->last_control_chunk_from != NULL) { 9191 chk->whoTo = chk->asoc->last_control_chunk_from; 9192 atomic_add_int(&chk->whoTo->ref_count, 1); 9193 } else { 9194 chk->whoTo = NULL; 9195 } 9196 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 9197 hdr->chunk_type = SCTP_COOKIE_ACK; 9198 hdr->chunk_flags = 0; 9199 hdr->chunk_length = htons(chk->send_size); 9200 SCTP_BUF_LEN(cookie_ack) = chk->send_size; 9201 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9202 chk->asoc->ctrl_queue_cnt++; 9203 return; 9204 } 9205 9206 9207 void 9208 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 9209 { 9210 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 9211 struct mbuf *m_shutdown_ack; 9212 struct sctp_shutdown_ack_chunk *ack_cp; 9213 struct sctp_tmit_chunk *chk; 9214 9215 m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9216 if (m_shutdown_ack == NULL) { 9217 /* no mbuf's */ 9218 return; 9219 } 9220 SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD); 9221 sctp_alloc_a_chunk(stcb, chk); 9222 if (chk == NULL) { 9223 /* no memory */ 9224 sctp_m_freem(m_shutdown_ack); 9225 return; 9226 } 9227 chk->copy_by_ref = 0; 9228 chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK; 9229 chk->rec.chunk_id.can_take_data = 1; 9230 chk->flags = 0; 9231 chk->send_size = sizeof(struct sctp_chunkhdr); 9232 chk->sent = SCTP_DATAGRAM_UNSENT; 9233 chk->snd_count = 0; 9234 chk->asoc = &stcb->asoc; 9235 chk->data = m_shutdown_ack; 9236 chk->whoTo = net; 9237 if (chk->whoTo) { 9238 atomic_add_int(&chk->whoTo->ref_count, 1); 9239 } 9240 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 9241 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 9242 ack_cp->ch.chunk_flags = 0; 9243 ack_cp->ch.chunk_length = htons(chk->send_size); 9244 SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size; 9245 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9246 chk->asoc->ctrl_queue_cnt++; 9247 return; 9248 } 9249 9250 void 9251 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 9252 { 9253 /* formulate and queue a SHUTDOWN to the sender */ 9254 struct mbuf *m_shutdown; 9255 struct sctp_shutdown_chunk *shutdown_cp; 9256 struct sctp_tmit_chunk *chk; 9257 9258 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 9259 if (chk->rec.chunk_id.id == SCTP_SHUTDOWN) { 9260 /* We already have a SHUTDOWN queued. Reuse it. */ 9261 if (chk->whoTo) { 9262 sctp_free_remote_addr(chk->whoTo); 9263 chk->whoTo = NULL; 9264 } 9265 break; 9266 } 9267 } 9268 if (chk == NULL) { 9269 m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9270 if (m_shutdown == NULL) { 9271 /* no mbuf's */ 9272 return; 9273 } 9274 SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD); 9275 sctp_alloc_a_chunk(stcb, chk); 9276 if (chk == NULL) { 9277 /* no memory */ 9278 sctp_m_freem(m_shutdown); 9279 return; 9280 } 9281 chk->copy_by_ref = 0; 9282 chk->rec.chunk_id.id = SCTP_SHUTDOWN; 9283 chk->rec.chunk_id.can_take_data = 1; 9284 chk->flags = 0; 9285 chk->send_size = sizeof(struct sctp_shutdown_chunk); 9286 chk->sent = SCTP_DATAGRAM_UNSENT; 9287 chk->snd_count = 0; 9288 chk->asoc = &stcb->asoc; 9289 chk->data = m_shutdown; 9290 chk->whoTo = net; 9291 if (chk->whoTo) { 9292 atomic_add_int(&chk->whoTo->ref_count, 1); 9293 } 9294 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 9295 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 9296 shutdown_cp->ch.chunk_flags = 0; 9297 shutdown_cp->ch.chunk_length = htons(chk->send_size); 9298 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9299 SCTP_BUF_LEN(m_shutdown) = chk->send_size; 9300 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9301 chk->asoc->ctrl_queue_cnt++; 9302 } else { 9303 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, sctp_next); 9304 chk->whoTo = net; 9305 if (chk->whoTo) { 9306 atomic_add_int(&chk->whoTo->ref_count, 1); 9307 } 9308 shutdown_cp = mtod(chk->data, struct sctp_shutdown_chunk *); 9309 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9310 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 9311 } 9312 return; 9313 } 9314 9315 void 9316 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked) 9317 { 9318 /* 9319 * formulate and queue an ASCONF to the peer. ASCONF parameters 9320 * should be queued on the assoc queue. 9321 */ 9322 struct sctp_tmit_chunk *chk; 9323 struct mbuf *m_asconf; 9324 int len; 9325 9326 SCTP_TCB_LOCK_ASSERT(stcb); 9327 9328 if ((!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) && 9329 (!sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS))) { 9330 /* can't send a new one if there is one in flight already */ 9331 return; 9332 } 9333 9334 /* compose an ASCONF chunk, maximum length is PMTU */ 9335 m_asconf = sctp_compose_asconf(stcb, &len, addr_locked); 9336 if (m_asconf == NULL) { 9337 return; 9338 } 9339 9340 sctp_alloc_a_chunk(stcb, chk); 9341 if (chk == NULL) { 9342 /* no memory */ 9343 sctp_m_freem(m_asconf); 9344 return; 9345 } 9346 9347 chk->copy_by_ref = 0; 9348 chk->rec.chunk_id.id = SCTP_ASCONF; 9349 chk->rec.chunk_id.can_take_data = 0; 9350 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9351 chk->data = m_asconf; 9352 chk->send_size = len; 9353 chk->sent = SCTP_DATAGRAM_UNSENT; 9354 chk->snd_count = 0; 9355 chk->asoc = &stcb->asoc; 9356 chk->whoTo = net; 9357 if (chk->whoTo) { 9358 atomic_add_int(&chk->whoTo->ref_count, 1); 9359 } 9360 TAILQ_INSERT_TAIL(&chk->asoc->asconf_send_queue, chk, sctp_next); 9361 chk->asoc->ctrl_queue_cnt++; 9362 return; 9363 } 9364 9365 void 9366 sctp_send_asconf_ack(struct sctp_tcb *stcb) 9367 { 9368 /* 9369 * formulate and queue a asconf-ack back to sender. the asconf-ack 9370 * must be stored in the tcb. 9371 */ 9372 struct sctp_tmit_chunk *chk; 9373 struct sctp_asconf_ack *ack, *latest_ack; 9374 struct mbuf *m_ack; 9375 struct sctp_nets *net = NULL; 9376 9377 SCTP_TCB_LOCK_ASSERT(stcb); 9378 /* Get the latest ASCONF-ACK */ 9379 latest_ack = TAILQ_LAST(&stcb->asoc.asconf_ack_sent, sctp_asconf_ackhead); 9380 if (latest_ack == NULL) { 9381 return; 9382 } 9383 if (latest_ack->last_sent_to != NULL && 9384 latest_ack->last_sent_to == stcb->asoc.last_control_chunk_from) { 9385 /* we're doing a retransmission */ 9386 net = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0); 9387 if (net == NULL) { 9388 /* no alternate */ 9389 if (stcb->asoc.last_control_chunk_from == NULL) { 9390 if (stcb->asoc.alternate) { 9391 net = stcb->asoc.alternate; 9392 } else { 9393 net = stcb->asoc.primary_destination; 9394 } 9395 } else { 9396 net = stcb->asoc.last_control_chunk_from; 9397 } 9398 } 9399 } else { 9400 /* normal case */ 9401 if (stcb->asoc.last_control_chunk_from == NULL) { 9402 if (stcb->asoc.alternate) { 9403 net = stcb->asoc.alternate; 9404 } else { 9405 net = stcb->asoc.primary_destination; 9406 } 9407 } else { 9408 net = stcb->asoc.last_control_chunk_from; 9409 } 9410 } 9411 latest_ack->last_sent_to = net; 9412 9413 TAILQ_FOREACH(ack, &stcb->asoc.asconf_ack_sent, next) { 9414 if (ack->data == NULL) { 9415 continue; 9416 } 9417 9418 /* copy the asconf_ack */ 9419 m_ack = SCTP_M_COPYM(ack->data, 0, M_COPYALL, M_NOWAIT); 9420 if (m_ack == NULL) { 9421 /* couldn't copy it */ 9422 return; 9423 } 9424 #ifdef SCTP_MBUF_LOGGING 9425 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9426 sctp_log_mbc(m_ack, SCTP_MBUF_ICOPY); 9427 } 9428 #endif 9429 9430 sctp_alloc_a_chunk(stcb, chk); 9431 if (chk == NULL) { 9432 /* no memory */ 9433 if (m_ack) 9434 sctp_m_freem(m_ack); 9435 return; 9436 } 9437 chk->copy_by_ref = 0; 9438 chk->rec.chunk_id.id = SCTP_ASCONF_ACK; 9439 chk->rec.chunk_id.can_take_data = 1; 9440 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9441 chk->whoTo = net; 9442 if (chk->whoTo) { 9443 atomic_add_int(&chk->whoTo->ref_count, 1); 9444 } 9445 chk->data = m_ack; 9446 chk->send_size = ack->len; 9447 chk->sent = SCTP_DATAGRAM_UNSENT; 9448 chk->snd_count = 0; 9449 chk->asoc = &stcb->asoc; 9450 9451 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9452 chk->asoc->ctrl_queue_cnt++; 9453 } 9454 return; 9455 } 9456 9457 9458 static int 9459 sctp_chunk_retransmission(struct sctp_inpcb *inp, 9460 struct sctp_tcb *stcb, 9461 struct sctp_association *asoc, 9462 int *cnt_out, struct timeval *now, int *now_filled, int *fr_done, int so_locked 9463 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 9464 SCTP_UNUSED 9465 #endif 9466 ) 9467 { 9468 /*- 9469 * send out one MTU of retransmission. If fast_retransmit is 9470 * happening we ignore the cwnd. Otherwise we obey the cwnd and 9471 * rwnd. For a Cookie or Asconf in the control chunk queue we 9472 * retransmit them by themselves. 9473 * 9474 * For data chunks we will pick out the lowest TSN's in the sent_queue 9475 * marked for resend and bundle them all together (up to a MTU of 9476 * destination). The address to send to should have been 9477 * selected/changed where the retransmission was marked (i.e. in FR 9478 * or t3-timeout routines). 9479 */ 9480 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 9481 struct sctp_tmit_chunk *chk, *fwd; 9482 struct mbuf *m, *endofchain; 9483 struct sctp_nets *net = NULL; 9484 uint32_t tsns_sent = 0; 9485 int no_fragmentflg, bundle_at, cnt_thru; 9486 unsigned int mtu; 9487 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 9488 struct sctp_auth_chunk *auth = NULL; 9489 uint32_t auth_offset = 0; 9490 uint16_t auth_keyid; 9491 int override_ok = 1; 9492 int data_auth_reqd = 0; 9493 uint32_t dmtu = 0; 9494 9495 SCTP_TCB_LOCK_ASSERT(stcb); 9496 tmr_started = ctl_cnt = bundle_at = error = 0; 9497 no_fragmentflg = 1; 9498 fwd_tsn = 0; 9499 *cnt_out = 0; 9500 fwd = NULL; 9501 endofchain = m = NULL; 9502 auth_keyid = stcb->asoc.authinfo.active_keyid; 9503 #ifdef SCTP_AUDITING_ENABLED 9504 sctp_audit_log(0xC3, 1); 9505 #endif 9506 if ((TAILQ_EMPTY(&asoc->sent_queue)) && 9507 (TAILQ_EMPTY(&asoc->control_send_queue))) { 9508 SCTPDBG(SCTP_DEBUG_OUTPUT1, "SCTP hits empty queue with cnt set to %d?\n", 9509 asoc->sent_queue_retran_cnt); 9510 asoc->sent_queue_cnt = 0; 9511 asoc->sent_queue_cnt_removeable = 0; 9512 /* send back 0/0 so we enter normal transmission */ 9513 *cnt_out = 0; 9514 return (0); 9515 } 9516 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 9517 if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) || 9518 (chk->rec.chunk_id.id == SCTP_STREAM_RESET) || 9519 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) { 9520 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9521 continue; 9522 } 9523 if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 9524 if (chk != asoc->str_reset) { 9525 /* 9526 * not eligible for retran if its 9527 * not ours 9528 */ 9529 continue; 9530 } 9531 } 9532 ctl_cnt++; 9533 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 9534 fwd_tsn = 1; 9535 } 9536 /* 9537 * Add an AUTH chunk, if chunk requires it save the 9538 * offset into the chain for AUTH 9539 */ 9540 if ((auth == NULL) && 9541 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 9542 stcb->asoc.peer_auth_chunks))) { 9543 m = sctp_add_auth_chunk(m, &endofchain, 9544 &auth, &auth_offset, 9545 stcb, 9546 chk->rec.chunk_id.id); 9547 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9548 } 9549 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9550 break; 9551 } 9552 } 9553 one_chunk = 0; 9554 cnt_thru = 0; 9555 /* do we have control chunks to retransmit? */ 9556 if (m != NULL) { 9557 /* Start a timer no matter if we succeed or fail */ 9558 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 9559 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 9560 } else if (chk->rec.chunk_id.id == SCTP_ASCONF) 9561 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 9562 chk->snd_count++; /* update our count */ 9563 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 9564 (struct sockaddr *)&chk->whoTo->ro._l_addr, m, 9565 auth_offset, auth, stcb->asoc.authinfo.active_keyid, 9566 no_fragmentflg, 0, 0, 9567 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9568 chk->whoTo->port, NULL, 9569 0, 0, 9570 so_locked))) { 9571 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9572 if (error == ENOBUFS) { 9573 asoc->ifp_had_enobuf = 1; 9574 SCTP_STAT_INCR(sctps_lowlevelerr); 9575 } 9576 return (error); 9577 } else { 9578 asoc->ifp_had_enobuf = 0; 9579 } 9580 endofchain = NULL; 9581 auth = NULL; 9582 auth_offset = 0; 9583 /* 9584 * We don't want to mark the net->sent time here since this 9585 * we use this for HB and retrans cannot measure RTT 9586 */ 9587 /* (void)SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */ 9588 *cnt_out += 1; 9589 chk->sent = SCTP_DATAGRAM_SENT; 9590 sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt); 9591 if (fwd_tsn == 0) { 9592 return (0); 9593 } else { 9594 /* Clean up the fwd-tsn list */ 9595 sctp_clean_up_ctl(stcb, asoc, so_locked); 9596 return (0); 9597 } 9598 } 9599 /* 9600 * Ok, it is just data retransmission we need to do or that and a 9601 * fwd-tsn with it all. 9602 */ 9603 if (TAILQ_EMPTY(&asoc->sent_queue)) { 9604 return (SCTP_RETRAN_DONE); 9605 } 9606 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED) || 9607 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT)) { 9608 /* not yet open, resend the cookie and that is it */ 9609 return (1); 9610 } 9611 #ifdef SCTP_AUDITING_ENABLED 9612 sctp_auditing(20, inp, stcb, NULL); 9613 #endif 9614 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks); 9615 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 9616 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9617 /* No, not sent to this net or not ready for rtx */ 9618 continue; 9619 } 9620 if (chk->data == NULL) { 9621 SCTP_PRINTF("TSN:%x chk->snd_count:%d chk->sent:%d can't retran - no data\n", 9622 chk->rec.data.tsn, chk->snd_count, chk->sent); 9623 continue; 9624 } 9625 if ((SCTP_BASE_SYSCTL(sctp_max_retran_chunk)) && 9626 (chk->snd_count >= SCTP_BASE_SYSCTL(sctp_max_retran_chunk))) { 9627 struct mbuf *op_err; 9628 char msg[SCTP_DIAG_INFO_LEN]; 9629 9630 snprintf(msg, sizeof(msg), "TSN %8.8x retransmitted %d times, giving up", 9631 chk->rec.data.tsn, chk->snd_count); 9632 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 9633 msg); 9634 atomic_add_int(&stcb->asoc.refcnt, 1); 9635 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, 9636 so_locked); 9637 SCTP_TCB_LOCK(stcb); 9638 atomic_subtract_int(&stcb->asoc.refcnt, 1); 9639 return (SCTP_RETRAN_EXIT); 9640 } 9641 /* pick up the net */ 9642 net = chk->whoTo; 9643 switch (net->ro._l_addr.sa.sa_family) { 9644 #ifdef INET 9645 case AF_INET: 9646 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 9647 break; 9648 #endif 9649 #ifdef INET6 9650 case AF_INET6: 9651 mtu = net->mtu - SCTP_MIN_OVERHEAD; 9652 break; 9653 #endif 9654 default: 9655 /* TSNH */ 9656 mtu = net->mtu; 9657 break; 9658 } 9659 9660 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 9661 /* No room in peers rwnd */ 9662 uint32_t tsn; 9663 9664 tsn = asoc->last_acked_seq + 1; 9665 if (tsn == chk->rec.data.tsn) { 9666 /* 9667 * we make a special exception for this 9668 * case. The peer has no rwnd but is missing 9669 * the lowest chunk.. which is probably what 9670 * is holding up the rwnd. 9671 */ 9672 goto one_chunk_around; 9673 } 9674 return (1); 9675 } 9676 one_chunk_around: 9677 if (asoc->peers_rwnd < mtu) { 9678 one_chunk = 1; 9679 if ((asoc->peers_rwnd == 0) && 9680 (asoc->total_flight == 0)) { 9681 chk->window_probe = 1; 9682 chk->whoTo->window_probe = 1; 9683 } 9684 } 9685 #ifdef SCTP_AUDITING_ENABLED 9686 sctp_audit_log(0xC3, 2); 9687 #endif 9688 bundle_at = 0; 9689 m = NULL; 9690 net->fast_retran_ip = 0; 9691 if (chk->rec.data.doing_fast_retransmit == 0) { 9692 /* 9693 * if no FR in progress skip destination that have 9694 * flight_size > cwnd. 9695 */ 9696 if (net->flight_size >= net->cwnd) { 9697 continue; 9698 } 9699 } else { 9700 /* 9701 * Mark the destination net to have FR recovery 9702 * limits put on it. 9703 */ 9704 *fr_done = 1; 9705 net->fast_retran_ip = 1; 9706 } 9707 9708 /* 9709 * if no AUTH is yet included and this chunk requires it, 9710 * make sure to account for it. We don't apply the size 9711 * until the AUTH chunk is actually added below in case 9712 * there is no room for this chunk. 9713 */ 9714 if (data_auth_reqd && (auth == NULL)) { 9715 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9716 } else 9717 dmtu = 0; 9718 9719 if ((chk->send_size <= (mtu - dmtu)) || 9720 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 9721 /* ok we will add this one */ 9722 if (data_auth_reqd) { 9723 if (auth == NULL) { 9724 m = sctp_add_auth_chunk(m, 9725 &endofchain, 9726 &auth, 9727 &auth_offset, 9728 stcb, 9729 SCTP_DATA); 9730 auth_keyid = chk->auth_keyid; 9731 override_ok = 0; 9732 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9733 } else if (override_ok) { 9734 auth_keyid = chk->auth_keyid; 9735 override_ok = 0; 9736 } else if (chk->auth_keyid != auth_keyid) { 9737 /* different keyid, so done bundling */ 9738 break; 9739 } 9740 } 9741 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9742 if (m == NULL) { 9743 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9744 return (ENOMEM); 9745 } 9746 /* Do clear IP_DF ? */ 9747 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9748 no_fragmentflg = 0; 9749 } 9750 /* upate our MTU size */ 9751 if (mtu > (chk->send_size + dmtu)) 9752 mtu -= (chk->send_size + dmtu); 9753 else 9754 mtu = 0; 9755 data_list[bundle_at++] = chk; 9756 if (one_chunk && (asoc->total_flight <= 0)) { 9757 SCTP_STAT_INCR(sctps_windowprobed); 9758 } 9759 } 9760 if (one_chunk == 0) { 9761 /* 9762 * now are there anymore forward from chk to pick 9763 * up? 9764 */ 9765 for (fwd = TAILQ_NEXT(chk, sctp_next); fwd != NULL; fwd = TAILQ_NEXT(fwd, sctp_next)) { 9766 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 9767 /* Nope, not for retran */ 9768 continue; 9769 } 9770 if (fwd->whoTo != net) { 9771 /* Nope, not the net in question */ 9772 continue; 9773 } 9774 if (data_auth_reqd && (auth == NULL)) { 9775 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9776 } else 9777 dmtu = 0; 9778 if (fwd->send_size <= (mtu - dmtu)) { 9779 if (data_auth_reqd) { 9780 if (auth == NULL) { 9781 m = sctp_add_auth_chunk(m, 9782 &endofchain, 9783 &auth, 9784 &auth_offset, 9785 stcb, 9786 SCTP_DATA); 9787 auth_keyid = fwd->auth_keyid; 9788 override_ok = 0; 9789 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9790 } else if (override_ok) { 9791 auth_keyid = fwd->auth_keyid; 9792 override_ok = 0; 9793 } else if (fwd->auth_keyid != auth_keyid) { 9794 /* 9795 * different keyid, 9796 * so done bundling 9797 */ 9798 break; 9799 } 9800 } 9801 m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref); 9802 if (m == NULL) { 9803 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9804 return (ENOMEM); 9805 } 9806 /* Do clear IP_DF ? */ 9807 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9808 no_fragmentflg = 0; 9809 } 9810 /* upate our MTU size */ 9811 if (mtu > (fwd->send_size + dmtu)) 9812 mtu -= (fwd->send_size + dmtu); 9813 else 9814 mtu = 0; 9815 data_list[bundle_at++] = fwd; 9816 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 9817 break; 9818 } 9819 } else { 9820 /* can't fit so we are done */ 9821 break; 9822 } 9823 } 9824 } 9825 /* Is there something to send for this destination? */ 9826 if (m) { 9827 /* 9828 * No matter if we fail/or succeed we should start a 9829 * timer. A failure is like a lost IP packet :-) 9830 */ 9831 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9832 /* 9833 * no timer running on this destination 9834 * restart it. 9835 */ 9836 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9837 tmr_started = 1; 9838 } 9839 /* Now lets send it, if there is anything to send :> */ 9840 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 9841 (struct sockaddr *)&net->ro._l_addr, m, 9842 auth_offset, auth, auth_keyid, 9843 no_fragmentflg, 0, 0, 9844 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9845 net->port, NULL, 9846 0, 0, 9847 so_locked))) { 9848 /* error, we could not output */ 9849 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9850 if (error == ENOBUFS) { 9851 asoc->ifp_had_enobuf = 1; 9852 SCTP_STAT_INCR(sctps_lowlevelerr); 9853 } 9854 return (error); 9855 } else { 9856 asoc->ifp_had_enobuf = 0; 9857 } 9858 endofchain = NULL; 9859 auth = NULL; 9860 auth_offset = 0; 9861 /* For HB's */ 9862 /* 9863 * We don't want to mark the net->sent time here 9864 * since this we use this for HB and retrans cannot 9865 * measure RTT 9866 */ 9867 /* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */ 9868 9869 /* For auto-close */ 9870 cnt_thru++; 9871 if (*now_filled == 0) { 9872 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 9873 *now = asoc->time_last_sent; 9874 *now_filled = 1; 9875 } else { 9876 asoc->time_last_sent = *now; 9877 } 9878 *cnt_out += bundle_at; 9879 #ifdef SCTP_AUDITING_ENABLED 9880 sctp_audit_log(0xC4, bundle_at); 9881 #endif 9882 if (bundle_at) { 9883 tsns_sent = data_list[0]->rec.data.tsn; 9884 } 9885 for (i = 0; i < bundle_at; i++) { 9886 SCTP_STAT_INCR(sctps_sendretransdata); 9887 data_list[i]->sent = SCTP_DATAGRAM_SENT; 9888 /* 9889 * When we have a revoked data, and we 9890 * retransmit it, then we clear the revoked 9891 * flag since this flag dictates if we 9892 * subtracted from the fs 9893 */ 9894 if (data_list[i]->rec.data.chunk_was_revoked) { 9895 /* Deflate the cwnd */ 9896 data_list[i]->whoTo->cwnd -= data_list[i]->book_size; 9897 data_list[i]->rec.data.chunk_was_revoked = 0; 9898 } 9899 data_list[i]->snd_count++; 9900 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 9901 /* record the time */ 9902 data_list[i]->sent_rcv_time = asoc->time_last_sent; 9903 if (data_list[i]->book_size_scale) { 9904 /* 9905 * need to double the book size on 9906 * this one 9907 */ 9908 data_list[i]->book_size_scale = 0; 9909 /* 9910 * Since we double the booksize, we 9911 * must also double the output queue 9912 * size, since this get shrunk when 9913 * we free by this amount. 9914 */ 9915 atomic_add_int(&((asoc)->total_output_queue_size), data_list[i]->book_size); 9916 data_list[i]->book_size *= 2; 9917 9918 9919 } else { 9920 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 9921 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 9922 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 9923 } 9924 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 9925 (uint32_t)(data_list[i]->send_size + 9926 SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 9927 } 9928 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 9929 sctp_misc_ints(SCTP_FLIGHT_LOG_UP_RSND, 9930 data_list[i]->whoTo->flight_size, 9931 data_list[i]->book_size, 9932 (uint32_t)(uintptr_t)data_list[i]->whoTo, 9933 data_list[i]->rec.data.tsn); 9934 } 9935 sctp_flight_size_increase(data_list[i]); 9936 sctp_total_flight_increase(stcb, data_list[i]); 9937 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 9938 /* SWS sender side engages */ 9939 asoc->peers_rwnd = 0; 9940 } 9941 if ((i == 0) && 9942 (data_list[i]->rec.data.doing_fast_retransmit)) { 9943 SCTP_STAT_INCR(sctps_sendfastretrans); 9944 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 9945 (tmr_started == 0)) { 9946 /*- 9947 * ok we just fast-retrans'd 9948 * the lowest TSN, i.e the 9949 * first on the list. In 9950 * this case we want to give 9951 * some more time to get a 9952 * SACK back without a 9953 * t3-expiring. 9954 */ 9955 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 9956 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_2); 9957 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9958 } 9959 } 9960 } 9961 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 9962 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND); 9963 } 9964 #ifdef SCTP_AUDITING_ENABLED 9965 sctp_auditing(21, inp, stcb, NULL); 9966 #endif 9967 } else { 9968 /* None will fit */ 9969 return (1); 9970 } 9971 if (asoc->sent_queue_retran_cnt <= 0) { 9972 /* all done we have no more to retran */ 9973 asoc->sent_queue_retran_cnt = 0; 9974 break; 9975 } 9976 if (one_chunk) { 9977 /* No more room in rwnd */ 9978 return (1); 9979 } 9980 /* stop the for loop here. we sent out a packet */ 9981 break; 9982 } 9983 return (0); 9984 } 9985 9986 static void 9987 sctp_timer_validation(struct sctp_inpcb *inp, 9988 struct sctp_tcb *stcb, 9989 struct sctp_association *asoc) 9990 { 9991 struct sctp_nets *net; 9992 9993 /* Validate that a timer is running somewhere */ 9994 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 9995 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9996 /* Here is a timer */ 9997 return; 9998 } 9999 } 10000 SCTP_TCB_LOCK_ASSERT(stcb); 10001 /* Gak, we did not have a timer somewhere */ 10002 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Deadlock avoided starting timer on a dest at retran\n"); 10003 if (asoc->alternate) { 10004 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->alternate); 10005 } else { 10006 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 10007 } 10008 return; 10009 } 10010 10011 void 10012 sctp_chunk_output(struct sctp_inpcb *inp, 10013 struct sctp_tcb *stcb, 10014 int from_where, 10015 int so_locked 10016 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10017 SCTP_UNUSED 10018 #endif 10019 ) 10020 { 10021 /*- 10022 * Ok this is the generic chunk service queue. we must do the 10023 * following: 10024 * - See if there are retransmits pending, if so we must 10025 * do these first. 10026 * - Service the stream queue that is next, moving any 10027 * message (note I must get a complete message i.e. 10028 * FIRST/MIDDLE and LAST to the out queue in one pass) and assigning 10029 * TSN's 10030 * - Check to see if the cwnd/rwnd allows any output, if so we 10031 * go ahead and fomulate and send the low level chunks. Making sure 10032 * to combine any control in the control chunk queue also. 10033 */ 10034 struct sctp_association *asoc; 10035 struct sctp_nets *net; 10036 int error = 0, num_out, tot_out = 0, ret = 0, reason_code; 10037 unsigned int burst_cnt = 0; 10038 struct timeval now; 10039 int now_filled = 0; 10040 int nagle_on; 10041 int frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 10042 int un_sent = 0; 10043 int fr_done; 10044 unsigned int tot_frs = 0; 10045 10046 asoc = &stcb->asoc; 10047 do_it_again: 10048 /* The Nagle algorithm is only applied when handling a send call. */ 10049 if (from_where == SCTP_OUTPUT_FROM_USR_SEND) { 10050 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) { 10051 nagle_on = 0; 10052 } else { 10053 nagle_on = 1; 10054 } 10055 } else { 10056 nagle_on = 0; 10057 } 10058 SCTP_TCB_LOCK_ASSERT(stcb); 10059 10060 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 10061 10062 if ((un_sent <= 0) && 10063 (TAILQ_EMPTY(&asoc->control_send_queue)) && 10064 (TAILQ_EMPTY(&asoc->asconf_send_queue)) && 10065 (asoc->sent_queue_retran_cnt == 0) && 10066 (asoc->trigger_reset == 0)) { 10067 /* Nothing to do unless there is something to be sent left */ 10068 return; 10069 } 10070 /* 10071 * Do we have something to send, data or control AND a sack timer 10072 * running, if so piggy-back the sack. 10073 */ 10074 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 10075 sctp_send_sack(stcb, so_locked); 10076 (void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer); 10077 } 10078 while (asoc->sent_queue_retran_cnt) { 10079 /*- 10080 * Ok, it is retransmission time only, we send out only ONE 10081 * packet with a single call off to the retran code. 10082 */ 10083 if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) { 10084 /*- 10085 * Special hook for handling cookiess discarded 10086 * by peer that carried data. Send cookie-ack only 10087 * and then the next call with get the retran's. 10088 */ 10089 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10090 from_where, 10091 &now, &now_filled, frag_point, so_locked); 10092 return; 10093 } else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) { 10094 /* if its not from a HB then do it */ 10095 fr_done = 0; 10096 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled, &fr_done, so_locked); 10097 if (fr_done) { 10098 tot_frs++; 10099 } 10100 } else { 10101 /* 10102 * its from any other place, we don't allow retran 10103 * output (only control) 10104 */ 10105 ret = 1; 10106 } 10107 if (ret > 0) { 10108 /* Can't send anymore */ 10109 /*- 10110 * now lets push out control by calling med-level 10111 * output once. this assures that we WILL send HB's 10112 * if queued too. 10113 */ 10114 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10115 from_where, 10116 &now, &now_filled, frag_point, so_locked); 10117 #ifdef SCTP_AUDITING_ENABLED 10118 sctp_auditing(8, inp, stcb, NULL); 10119 #endif 10120 sctp_timer_validation(inp, stcb, asoc); 10121 return; 10122 } 10123 if (ret < 0) { 10124 /*- 10125 * The count was off.. retran is not happening so do 10126 * the normal retransmission. 10127 */ 10128 #ifdef SCTP_AUDITING_ENABLED 10129 sctp_auditing(9, inp, stcb, NULL); 10130 #endif 10131 if (ret == SCTP_RETRAN_EXIT) { 10132 return; 10133 } 10134 break; 10135 } 10136 if (from_where == SCTP_OUTPUT_FROM_T3) { 10137 /* Only one transmission allowed out of a timeout */ 10138 #ifdef SCTP_AUDITING_ENABLED 10139 sctp_auditing(10, inp, stcb, NULL); 10140 #endif 10141 /* Push out any control */ 10142 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, from_where, 10143 &now, &now_filled, frag_point, so_locked); 10144 return; 10145 } 10146 if ((asoc->fr_max_burst > 0) && (tot_frs >= asoc->fr_max_burst)) { 10147 /* Hit FR burst limit */ 10148 return; 10149 } 10150 if ((num_out == 0) && (ret == 0)) { 10151 /* No more retrans to send */ 10152 break; 10153 } 10154 } 10155 #ifdef SCTP_AUDITING_ENABLED 10156 sctp_auditing(12, inp, stcb, NULL); 10157 #endif 10158 /* Check for bad destinations, if they exist move chunks around. */ 10159 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 10160 if (!(net->dest_state & SCTP_ADDR_REACHABLE)) { 10161 /*- 10162 * if possible move things off of this address we 10163 * still may send below due to the dormant state but 10164 * we try to find an alternate address to send to 10165 * and if we have one we move all queued data on the 10166 * out wheel to this alternate address. 10167 */ 10168 if (net->ref_count > 1) 10169 sctp_move_chunks_from_net(stcb, net); 10170 } else { 10171 /*- 10172 * if ((asoc->sat_network) || (net->addr_is_local)) 10173 * { burst_limit = asoc->max_burst * 10174 * SCTP_SAT_NETWORK_BURST_INCR; } 10175 */ 10176 if (asoc->max_burst > 0) { 10177 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst)) { 10178 if ((net->flight_size + (asoc->max_burst * net->mtu)) < net->cwnd) { 10179 /* 10180 * JRS - Use the congestion 10181 * control given in the 10182 * congestion control module 10183 */ 10184 asoc->cc_functions.sctp_cwnd_update_after_output(stcb, net, asoc->max_burst); 10185 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10186 sctp_log_maxburst(stcb, net, 0, asoc->max_burst, SCTP_MAX_BURST_APPLIED); 10187 } 10188 SCTP_STAT_INCR(sctps_maxburstqueued); 10189 } 10190 net->fast_retran_ip = 0; 10191 } else { 10192 if (net->flight_size == 0) { 10193 /* 10194 * Should be decaying the 10195 * cwnd here 10196 */ 10197 ; 10198 } 10199 } 10200 } 10201 } 10202 10203 } 10204 burst_cnt = 0; 10205 do { 10206 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 10207 &reason_code, 0, from_where, 10208 &now, &now_filled, frag_point, so_locked); 10209 if (error) { 10210 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Error %d was returned from med-c-op\n", error); 10211 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10212 sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 10213 } 10214 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10215 sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES); 10216 sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES); 10217 } 10218 break; 10219 } 10220 SCTPDBG(SCTP_DEBUG_OUTPUT3, "m-c-o put out %d\n", num_out); 10221 10222 tot_out += num_out; 10223 burst_cnt++; 10224 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10225 sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES); 10226 if (num_out == 0) { 10227 sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES); 10228 } 10229 } 10230 if (nagle_on) { 10231 /* 10232 * When the Nagle algorithm is used, look at how 10233 * much is unsent, then if its smaller than an MTU 10234 * and we have data in flight we stop, except if we 10235 * are handling a fragmented user message. 10236 */ 10237 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 10238 if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) && 10239 (stcb->asoc.total_flight > 0)) { 10240 /* && sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) {*/ 10241 break; 10242 } 10243 } 10244 if (TAILQ_EMPTY(&asoc->control_send_queue) && 10245 TAILQ_EMPTY(&asoc->send_queue) && 10246 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 10247 /* Nothing left to send */ 10248 break; 10249 } 10250 if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) { 10251 /* Nothing left to send */ 10252 break; 10253 } 10254 } while (num_out && 10255 ((asoc->max_burst == 0) || 10256 SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) || 10257 (burst_cnt < asoc->max_burst))); 10258 10259 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) == 0) { 10260 if ((asoc->max_burst > 0) && (burst_cnt >= asoc->max_burst)) { 10261 SCTP_STAT_INCR(sctps_maxburstqueued); 10262 asoc->burst_limit_applied = 1; 10263 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10264 sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED); 10265 } 10266 } else { 10267 asoc->burst_limit_applied = 0; 10268 } 10269 } 10270 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10271 sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES); 10272 } 10273 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, we have put out %d chunks\n", 10274 tot_out); 10275 10276 /*- 10277 * Now we need to clean up the control chunk chain if a ECNE is on 10278 * it. It must be marked as UNSENT again so next call will continue 10279 * to send it until such time that we get a CWR, to remove it. 10280 */ 10281 if (stcb->asoc.ecn_echo_cnt_onq) 10282 sctp_fix_ecn_echo(asoc); 10283 10284 if (stcb->asoc.trigger_reset) { 10285 if (sctp_send_stream_reset_out_if_possible(stcb, so_locked) == 0) { 10286 goto do_it_again; 10287 } 10288 } 10289 return; 10290 } 10291 10292 10293 int 10294 sctp_output( 10295 struct sctp_inpcb *inp, 10296 struct mbuf *m, 10297 struct sockaddr *addr, 10298 struct mbuf *control, 10299 struct thread *p, 10300 int flags) 10301 { 10302 if (inp == NULL) { 10303 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10304 return (EINVAL); 10305 } 10306 10307 if (inp->sctp_socket == NULL) { 10308 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10309 return (EINVAL); 10310 } 10311 return (sctp_sosend(inp->sctp_socket, 10312 addr, 10313 (struct uio *)NULL, 10314 m, 10315 control, 10316 flags, p 10317 )); 10318 } 10319 10320 void 10321 send_forward_tsn(struct sctp_tcb *stcb, 10322 struct sctp_association *asoc) 10323 { 10324 struct sctp_tmit_chunk *chk, *at, *tp1, *last; 10325 struct sctp_forward_tsn_chunk *fwdtsn; 10326 struct sctp_strseq *strseq; 10327 struct sctp_strseq_mid *strseq_m; 10328 uint32_t advance_peer_ack_point; 10329 unsigned int cnt_of_space, i, ovh; 10330 unsigned int space_needed; 10331 unsigned int cnt_of_skipped = 0; 10332 10333 SCTP_TCB_LOCK_ASSERT(stcb); 10334 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10335 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 10336 /* mark it to unsent */ 10337 chk->sent = SCTP_DATAGRAM_UNSENT; 10338 chk->snd_count = 0; 10339 /* Do we correct its output location? */ 10340 if (chk->whoTo) { 10341 sctp_free_remote_addr(chk->whoTo); 10342 chk->whoTo = NULL; 10343 } 10344 goto sctp_fill_in_rest; 10345 } 10346 } 10347 /* Ok if we reach here we must build one */ 10348 sctp_alloc_a_chunk(stcb, chk); 10349 if (chk == NULL) { 10350 return; 10351 } 10352 asoc->fwd_tsn_cnt++; 10353 chk->copy_by_ref = 0; 10354 /* 10355 * We don't do the old thing here since this is used not for on-wire 10356 * but to tell if we are sending a fwd-tsn by the stack during 10357 * output. And if its a IFORWARD or a FORWARD it is a fwd-tsn. 10358 */ 10359 chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN; 10360 chk->rec.chunk_id.can_take_data = 0; 10361 chk->flags = 0; 10362 chk->asoc = asoc; 10363 chk->whoTo = NULL; 10364 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 10365 if (chk->data == NULL) { 10366 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 10367 return; 10368 } 10369 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 10370 chk->sent = SCTP_DATAGRAM_UNSENT; 10371 chk->snd_count = 0; 10372 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 10373 asoc->ctrl_queue_cnt++; 10374 sctp_fill_in_rest: 10375 /*- 10376 * Here we go through and fill out the part that deals with 10377 * stream/seq of the ones we skip. 10378 */ 10379 SCTP_BUF_LEN(chk->data) = 0; 10380 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10381 if ((at->sent != SCTP_FORWARD_TSN_SKIP) && 10382 (at->sent != SCTP_DATAGRAM_NR_ACKED)) { 10383 /* no more to look at */ 10384 break; 10385 } 10386 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10387 /* We don't report these */ 10388 continue; 10389 } 10390 cnt_of_skipped++; 10391 } 10392 if (asoc->idata_supported) { 10393 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10394 (cnt_of_skipped * sizeof(struct sctp_strseq_mid))); 10395 } else { 10396 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10397 (cnt_of_skipped * sizeof(struct sctp_strseq))); 10398 } 10399 cnt_of_space = (unsigned int)M_TRAILINGSPACE(chk->data); 10400 10401 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 10402 ovh = SCTP_MIN_OVERHEAD; 10403 } else { 10404 ovh = SCTP_MIN_V4_OVERHEAD; 10405 } 10406 if (cnt_of_space > (asoc->smallest_mtu - ovh)) { 10407 /* trim to a mtu size */ 10408 cnt_of_space = asoc->smallest_mtu - ovh; 10409 } 10410 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10411 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10412 0xff, 0, cnt_of_skipped, 10413 asoc->advanced_peer_ack_point); 10414 } 10415 advance_peer_ack_point = asoc->advanced_peer_ack_point; 10416 if (cnt_of_space < space_needed) { 10417 /*- 10418 * ok we must trim down the chunk by lowering the 10419 * advance peer ack point. 10420 */ 10421 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10422 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10423 0xff, 0xff, cnt_of_space, 10424 space_needed); 10425 } 10426 cnt_of_skipped = cnt_of_space - sizeof(struct sctp_forward_tsn_chunk); 10427 if (asoc->idata_supported) { 10428 cnt_of_skipped /= sizeof(struct sctp_strseq_mid); 10429 } else { 10430 cnt_of_skipped /= sizeof(struct sctp_strseq); 10431 } 10432 /*- 10433 * Go through and find the TSN that will be the one 10434 * we report. 10435 */ 10436 at = TAILQ_FIRST(&asoc->sent_queue); 10437 if (at != NULL) { 10438 for (i = 0; i < cnt_of_skipped; i++) { 10439 tp1 = TAILQ_NEXT(at, sctp_next); 10440 if (tp1 == NULL) { 10441 break; 10442 } 10443 at = tp1; 10444 } 10445 } 10446 if (at && SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10447 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10448 0xff, cnt_of_skipped, at->rec.data.tsn, 10449 asoc->advanced_peer_ack_point); 10450 } 10451 last = at; 10452 /*- 10453 * last now points to last one I can report, update 10454 * peer ack point 10455 */ 10456 if (last) { 10457 advance_peer_ack_point = last->rec.data.tsn; 10458 } 10459 if (asoc->idata_supported) { 10460 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10461 cnt_of_skipped * sizeof(struct sctp_strseq_mid); 10462 } else { 10463 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10464 cnt_of_skipped * sizeof(struct sctp_strseq); 10465 } 10466 } 10467 chk->send_size = space_needed; 10468 /* Setup the chunk */ 10469 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 10470 fwdtsn->ch.chunk_length = htons(chk->send_size); 10471 fwdtsn->ch.chunk_flags = 0; 10472 if (asoc->idata_supported) { 10473 fwdtsn->ch.chunk_type = SCTP_IFORWARD_CUM_TSN; 10474 } else { 10475 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 10476 } 10477 fwdtsn->new_cumulative_tsn = htonl(advance_peer_ack_point); 10478 SCTP_BUF_LEN(chk->data) = chk->send_size; 10479 fwdtsn++; 10480 /*- 10481 * Move pointer to after the fwdtsn and transfer to the 10482 * strseq pointer. 10483 */ 10484 if (asoc->idata_supported) { 10485 strseq_m = (struct sctp_strseq_mid *)fwdtsn; 10486 strseq = NULL; 10487 } else { 10488 strseq = (struct sctp_strseq *)fwdtsn; 10489 strseq_m = NULL; 10490 } 10491 /*- 10492 * Now populate the strseq list. This is done blindly 10493 * without pulling out duplicate stream info. This is 10494 * inefficent but won't harm the process since the peer will 10495 * look at these in sequence and will thus release anything. 10496 * It could mean we exceed the PMTU and chop off some that 10497 * we could have included.. but this is unlikely (aka 1432/4 10498 * would mean 300+ stream seq's would have to be reported in 10499 * one FWD-TSN. With a bit of work we can later FIX this to 10500 * optimize and pull out duplicates.. but it does add more 10501 * overhead. So for now... not! 10502 */ 10503 i = 0; 10504 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10505 if (i >= cnt_of_skipped) { 10506 break; 10507 } 10508 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10509 /* We don't report these */ 10510 continue; 10511 } 10512 if (at->rec.data.tsn == advance_peer_ack_point) { 10513 at->rec.data.fwd_tsn_cnt = 0; 10514 } 10515 if (asoc->idata_supported) { 10516 strseq_m->sid = htons(at->rec.data.sid); 10517 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 10518 strseq_m->flags = htons(PR_SCTP_UNORDERED_FLAG); 10519 } else { 10520 strseq_m->flags = 0; 10521 } 10522 strseq_m->mid = htonl(at->rec.data.mid); 10523 strseq_m++; 10524 } else { 10525 strseq->sid = htons(at->rec.data.sid); 10526 strseq->ssn = htons((uint16_t)at->rec.data.mid); 10527 strseq++; 10528 } 10529 i++; 10530 } 10531 return; 10532 } 10533 10534 void 10535 sctp_send_sack(struct sctp_tcb *stcb, int so_locked 10536 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10537 SCTP_UNUSED 10538 #endif 10539 ) 10540 { 10541 /*- 10542 * Queue up a SACK or NR-SACK in the control queue. 10543 * We must first check to see if a SACK or NR-SACK is 10544 * somehow on the control queue. 10545 * If so, we will take and and remove the old one. 10546 */ 10547 struct sctp_association *asoc; 10548 struct sctp_tmit_chunk *chk, *a_chk; 10549 struct sctp_sack_chunk *sack; 10550 struct sctp_nr_sack_chunk *nr_sack; 10551 struct sctp_gap_ack_block *gap_descriptor; 10552 const struct sack_track *selector; 10553 int mergeable = 0; 10554 int offset; 10555 caddr_t limit; 10556 uint32_t *dup; 10557 int limit_reached = 0; 10558 unsigned int i, siz, j; 10559 unsigned int num_gap_blocks = 0, num_nr_gap_blocks = 0, space; 10560 int num_dups = 0; 10561 int space_req; 10562 uint32_t highest_tsn; 10563 uint8_t flags; 10564 uint8_t type; 10565 uint8_t tsn_map; 10566 10567 if (stcb->asoc.nrsack_supported == 1) { 10568 type = SCTP_NR_SELECTIVE_ACK; 10569 } else { 10570 type = SCTP_SELECTIVE_ACK; 10571 } 10572 a_chk = NULL; 10573 asoc = &stcb->asoc; 10574 SCTP_TCB_LOCK_ASSERT(stcb); 10575 if (asoc->last_data_chunk_from == NULL) { 10576 /* Hmm we never received anything */ 10577 return; 10578 } 10579 sctp_slide_mapping_arrays(stcb); 10580 sctp_set_rwnd(stcb, asoc); 10581 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10582 if (chk->rec.chunk_id.id == type) { 10583 /* Hmm, found a sack already on queue, remove it */ 10584 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 10585 asoc->ctrl_queue_cnt--; 10586 a_chk = chk; 10587 if (a_chk->data) { 10588 sctp_m_freem(a_chk->data); 10589 a_chk->data = NULL; 10590 } 10591 if (a_chk->whoTo) { 10592 sctp_free_remote_addr(a_chk->whoTo); 10593 a_chk->whoTo = NULL; 10594 } 10595 break; 10596 } 10597 } 10598 if (a_chk == NULL) { 10599 sctp_alloc_a_chunk(stcb, a_chk); 10600 if (a_chk == NULL) { 10601 /* No memory so we drop the idea, and set a timer */ 10602 if (stcb->asoc.delayed_ack) { 10603 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10604 stcb->sctp_ep, stcb, NULL, 10605 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_3); 10606 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10607 stcb->sctp_ep, stcb, NULL); 10608 } else { 10609 stcb->asoc.send_sack = 1; 10610 } 10611 return; 10612 } 10613 a_chk->copy_by_ref = 0; 10614 a_chk->rec.chunk_id.id = type; 10615 a_chk->rec.chunk_id.can_take_data = 1; 10616 } 10617 /* Clear our pkt counts */ 10618 asoc->data_pkts_seen = 0; 10619 10620 a_chk->flags = 0; 10621 a_chk->asoc = asoc; 10622 a_chk->snd_count = 0; 10623 a_chk->send_size = 0; /* fill in later */ 10624 a_chk->sent = SCTP_DATAGRAM_UNSENT; 10625 a_chk->whoTo = NULL; 10626 10627 if (!(asoc->last_data_chunk_from->dest_state & SCTP_ADDR_REACHABLE)) { 10628 /*- 10629 * Ok, the destination for the SACK is unreachable, lets see if 10630 * we can select an alternate to asoc->last_data_chunk_from 10631 */ 10632 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0); 10633 if (a_chk->whoTo == NULL) { 10634 /* Nope, no alternate */ 10635 a_chk->whoTo = asoc->last_data_chunk_from; 10636 } 10637 } else { 10638 a_chk->whoTo = asoc->last_data_chunk_from; 10639 } 10640 if (a_chk->whoTo) { 10641 atomic_add_int(&a_chk->whoTo->ref_count, 1); 10642 } 10643 if (SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->highest_tsn_inside_nr_map)) { 10644 highest_tsn = asoc->highest_tsn_inside_map; 10645 } else { 10646 highest_tsn = asoc->highest_tsn_inside_nr_map; 10647 } 10648 if (highest_tsn == asoc->cumulative_tsn) { 10649 /* no gaps */ 10650 if (type == SCTP_SELECTIVE_ACK) { 10651 space_req = sizeof(struct sctp_sack_chunk); 10652 } else { 10653 space_req = sizeof(struct sctp_nr_sack_chunk); 10654 } 10655 } else { 10656 /* gaps get a cluster */ 10657 space_req = MCLBYTES; 10658 } 10659 /* Ok now lets formulate a MBUF with our sack */ 10660 a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_NOWAIT, 1, MT_DATA); 10661 if ((a_chk->data == NULL) || 10662 (a_chk->whoTo == NULL)) { 10663 /* rats, no mbuf memory */ 10664 if (a_chk->data) { 10665 /* was a problem with the destination */ 10666 sctp_m_freem(a_chk->data); 10667 a_chk->data = NULL; 10668 } 10669 sctp_free_a_chunk(stcb, a_chk, so_locked); 10670 /* sa_ignore NO_NULL_CHK */ 10671 if (stcb->asoc.delayed_ack) { 10672 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10673 stcb->sctp_ep, stcb, NULL, 10674 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4); 10675 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10676 stcb->sctp_ep, stcb, NULL); 10677 } else { 10678 stcb->asoc.send_sack = 1; 10679 } 10680 return; 10681 } 10682 /* ok, lets go through and fill it in */ 10683 SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD); 10684 space = (unsigned int)M_TRAILINGSPACE(a_chk->data); 10685 if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) { 10686 space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD); 10687 } 10688 limit = mtod(a_chk->data, caddr_t); 10689 limit += space; 10690 10691 flags = 0; 10692 10693 if ((asoc->sctp_cmt_on_off > 0) && 10694 SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) { 10695 /*- 10696 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been 10697 * received, then set high bit to 1, else 0. Reset 10698 * pkts_rcvd. 10699 */ 10700 flags |= (asoc->cmt_dac_pkts_rcvd << 6); 10701 asoc->cmt_dac_pkts_rcvd = 0; 10702 } 10703 #ifdef SCTP_ASOCLOG_OF_TSNS 10704 stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn; 10705 stcb->asoc.cumack_log_atsnt++; 10706 if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) { 10707 stcb->asoc.cumack_log_atsnt = 0; 10708 } 10709 #endif 10710 /* reset the readers interpretation */ 10711 stcb->freed_by_sorcv_sincelast = 0; 10712 10713 if (type == SCTP_SELECTIVE_ACK) { 10714 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 10715 nr_sack = NULL; 10716 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk)); 10717 if (highest_tsn > asoc->mapping_array_base_tsn) { 10718 siz = (((highest_tsn - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10719 } else { 10720 siz = (((MAX_TSN - highest_tsn) + 1) + highest_tsn + 7) / 8; 10721 } 10722 } else { 10723 sack = NULL; 10724 nr_sack = mtod(a_chk->data, struct sctp_nr_sack_chunk *); 10725 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)nr_sack + sizeof(struct sctp_nr_sack_chunk)); 10726 if (asoc->highest_tsn_inside_map > asoc->mapping_array_base_tsn) { 10727 siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10728 } else { 10729 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_map + 7) / 8; 10730 } 10731 } 10732 10733 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10734 offset = 1; 10735 } else { 10736 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10737 } 10738 if (((type == SCTP_SELECTIVE_ACK) && 10739 SCTP_TSN_GT(highest_tsn, asoc->cumulative_tsn)) || 10740 ((type == SCTP_NR_SELECTIVE_ACK) && 10741 SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->cumulative_tsn))) { 10742 /* we have a gap .. maybe */ 10743 for (i = 0; i < siz; i++) { 10744 tsn_map = asoc->mapping_array[i]; 10745 if (type == SCTP_SELECTIVE_ACK) { 10746 tsn_map |= asoc->nr_mapping_array[i]; 10747 } 10748 if (i == 0) { 10749 /* 10750 * Clear all bits corresponding to TSNs 10751 * smaller or equal to the cumulative TSN. 10752 */ 10753 tsn_map &= (~0U << (1 - offset)); 10754 } 10755 selector = &sack_array[tsn_map]; 10756 if (mergeable && selector->right_edge) { 10757 /* 10758 * Backup, left and right edges were ok to 10759 * merge. 10760 */ 10761 num_gap_blocks--; 10762 gap_descriptor--; 10763 } 10764 if (selector->num_entries == 0) 10765 mergeable = 0; 10766 else { 10767 for (j = 0; j < selector->num_entries; j++) { 10768 if (mergeable && selector->right_edge) { 10769 /* 10770 * do a merge by NOT setting 10771 * the left side 10772 */ 10773 mergeable = 0; 10774 } else { 10775 /* 10776 * no merge, set the left 10777 * side 10778 */ 10779 mergeable = 0; 10780 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10781 } 10782 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10783 num_gap_blocks++; 10784 gap_descriptor++; 10785 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10786 /* no more room */ 10787 limit_reached = 1; 10788 break; 10789 } 10790 } 10791 if (selector->left_edge) { 10792 mergeable = 1; 10793 } 10794 } 10795 if (limit_reached) { 10796 /* Reached the limit stop */ 10797 break; 10798 } 10799 offset += 8; 10800 } 10801 } 10802 if ((type == SCTP_NR_SELECTIVE_ACK) && 10803 (limit_reached == 0)) { 10804 10805 mergeable = 0; 10806 10807 if (asoc->highest_tsn_inside_nr_map > asoc->mapping_array_base_tsn) { 10808 siz = (((asoc->highest_tsn_inside_nr_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10809 } else { 10810 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_nr_map + 7) / 8; 10811 } 10812 10813 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10814 offset = 1; 10815 } else { 10816 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10817 } 10818 if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->cumulative_tsn)) { 10819 /* we have a gap .. maybe */ 10820 for (i = 0; i < siz; i++) { 10821 tsn_map = asoc->nr_mapping_array[i]; 10822 if (i == 0) { 10823 /* 10824 * Clear all bits corresponding to 10825 * TSNs smaller or equal to the 10826 * cumulative TSN. 10827 */ 10828 tsn_map &= (~0U << (1 - offset)); 10829 } 10830 selector = &sack_array[tsn_map]; 10831 if (mergeable && selector->right_edge) { 10832 /* 10833 * Backup, left and right edges were 10834 * ok to merge. 10835 */ 10836 num_nr_gap_blocks--; 10837 gap_descriptor--; 10838 } 10839 if (selector->num_entries == 0) 10840 mergeable = 0; 10841 else { 10842 for (j = 0; j < selector->num_entries; j++) { 10843 if (mergeable && selector->right_edge) { 10844 /* 10845 * do a merge by NOT 10846 * setting the left 10847 * side 10848 */ 10849 mergeable = 0; 10850 } else { 10851 /* 10852 * no merge, set the 10853 * left side 10854 */ 10855 mergeable = 0; 10856 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10857 } 10858 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10859 num_nr_gap_blocks++; 10860 gap_descriptor++; 10861 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10862 /* no more room */ 10863 limit_reached = 1; 10864 break; 10865 } 10866 } 10867 if (selector->left_edge) { 10868 mergeable = 1; 10869 } 10870 } 10871 if (limit_reached) { 10872 /* Reached the limit stop */ 10873 break; 10874 } 10875 offset += 8; 10876 } 10877 } 10878 } 10879 /* now we must add any dups we are going to report. */ 10880 if ((limit_reached == 0) && (asoc->numduptsns)) { 10881 dup = (uint32_t *)gap_descriptor; 10882 for (i = 0; i < asoc->numduptsns; i++) { 10883 *dup = htonl(asoc->dup_tsns[i]); 10884 dup++; 10885 num_dups++; 10886 if (((caddr_t)dup + sizeof(uint32_t)) > limit) { 10887 /* no more room */ 10888 break; 10889 } 10890 } 10891 asoc->numduptsns = 0; 10892 } 10893 /* 10894 * now that the chunk is prepared queue it to the control chunk 10895 * queue. 10896 */ 10897 if (type == SCTP_SELECTIVE_ACK) { 10898 a_chk->send_size = (uint16_t)(sizeof(struct sctp_sack_chunk) + 10899 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10900 num_dups * sizeof(int32_t)); 10901 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10902 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10903 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 10904 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 10905 sack->sack.num_dup_tsns = htons(num_dups); 10906 sack->ch.chunk_type = type; 10907 sack->ch.chunk_flags = flags; 10908 sack->ch.chunk_length = htons(a_chk->send_size); 10909 } else { 10910 a_chk->send_size = (uint16_t)(sizeof(struct sctp_nr_sack_chunk) + 10911 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10912 num_dups * sizeof(int32_t)); 10913 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10914 nr_sack->nr_sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10915 nr_sack->nr_sack.a_rwnd = htonl(asoc->my_rwnd); 10916 nr_sack->nr_sack.num_gap_ack_blks = htons(num_gap_blocks); 10917 nr_sack->nr_sack.num_nr_gap_ack_blks = htons(num_nr_gap_blocks); 10918 nr_sack->nr_sack.num_dup_tsns = htons(num_dups); 10919 nr_sack->nr_sack.reserved = 0; 10920 nr_sack->ch.chunk_type = type; 10921 nr_sack->ch.chunk_flags = flags; 10922 nr_sack->ch.chunk_length = htons(a_chk->send_size); 10923 } 10924 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 10925 asoc->my_last_reported_rwnd = asoc->my_rwnd; 10926 asoc->ctrl_queue_cnt++; 10927 asoc->send_sack = 0; 10928 SCTP_STAT_INCR(sctps_sendsacks); 10929 return; 10930 } 10931 10932 void 10933 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr, int so_locked 10934 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10935 SCTP_UNUSED 10936 #endif 10937 ) 10938 { 10939 struct mbuf *m_abort, *m, *m_last; 10940 struct mbuf *m_out, *m_end = NULL; 10941 struct sctp_abort_chunk *abort; 10942 struct sctp_auth_chunk *auth = NULL; 10943 struct sctp_nets *net; 10944 uint32_t vtag; 10945 uint32_t auth_offset = 0; 10946 int error; 10947 uint16_t cause_len, chunk_len, padding_len; 10948 10949 SCTP_TCB_LOCK_ASSERT(stcb); 10950 /*- 10951 * Add an AUTH chunk, if chunk requires it and save the offset into 10952 * the chain for AUTH 10953 */ 10954 if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION, 10955 stcb->asoc.peer_auth_chunks)) { 10956 m_out = sctp_add_auth_chunk(NULL, &m_end, &auth, &auth_offset, 10957 stcb, SCTP_ABORT_ASSOCIATION); 10958 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10959 } else { 10960 m_out = NULL; 10961 } 10962 m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_NOWAIT, 1, MT_HEADER); 10963 if (m_abort == NULL) { 10964 if (m_out) { 10965 sctp_m_freem(m_out); 10966 } 10967 if (operr) { 10968 sctp_m_freem(operr); 10969 } 10970 return; 10971 } 10972 /* link in any error */ 10973 SCTP_BUF_NEXT(m_abort) = operr; 10974 cause_len = 0; 10975 m_last = NULL; 10976 for (m = operr; m; m = SCTP_BUF_NEXT(m)) { 10977 cause_len += (uint16_t)SCTP_BUF_LEN(m); 10978 if (SCTP_BUF_NEXT(m) == NULL) { 10979 m_last = m; 10980 } 10981 } 10982 SCTP_BUF_LEN(m_abort) = sizeof(struct sctp_abort_chunk); 10983 chunk_len = (uint16_t)sizeof(struct sctp_abort_chunk) + cause_len; 10984 padding_len = SCTP_SIZE32(chunk_len) - chunk_len; 10985 if (m_out == NULL) { 10986 /* NO Auth chunk prepended, so reserve space in front */ 10987 SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD); 10988 m_out = m_abort; 10989 } else { 10990 /* Put AUTH chunk at the front of the chain */ 10991 SCTP_BUF_NEXT(m_end) = m_abort; 10992 } 10993 if (stcb->asoc.alternate) { 10994 net = stcb->asoc.alternate; 10995 } else { 10996 net = stcb->asoc.primary_destination; 10997 } 10998 /* Fill in the ABORT chunk header. */ 10999 abort = mtod(m_abort, struct sctp_abort_chunk *); 11000 abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION; 11001 if (stcb->asoc.peer_vtag == 0) { 11002 /* This happens iff the assoc is in COOKIE-WAIT state. */ 11003 vtag = stcb->asoc.my_vtag; 11004 abort->ch.chunk_flags = SCTP_HAD_NO_TCB; 11005 } else { 11006 vtag = stcb->asoc.peer_vtag; 11007 abort->ch.chunk_flags = 0; 11008 } 11009 abort->ch.chunk_length = htons(chunk_len); 11010 /* Add padding, if necessary. */ 11011 if (padding_len > 0) { 11012 if ((m_last == NULL) || 11013 (sctp_add_pad_tombuf(m_last, padding_len) == NULL)) { 11014 sctp_m_freem(m_out); 11015 return; 11016 } 11017 } 11018 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 11019 (struct sockaddr *)&net->ro._l_addr, 11020 m_out, auth_offset, auth, stcb->asoc.authinfo.active_keyid, 1, 0, 0, 11021 stcb->sctp_ep->sctp_lport, stcb->rport, htonl(vtag), 11022 stcb->asoc.primary_destination->port, NULL, 11023 0, 0, 11024 so_locked))) { 11025 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 11026 if (error == ENOBUFS) { 11027 stcb->asoc.ifp_had_enobuf = 1; 11028 SCTP_STAT_INCR(sctps_lowlevelerr); 11029 } 11030 } else { 11031 stcb->asoc.ifp_had_enobuf = 0; 11032 } 11033 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11034 } 11035 11036 void 11037 sctp_send_shutdown_complete(struct sctp_tcb *stcb, 11038 struct sctp_nets *net, 11039 int reflect_vtag) 11040 { 11041 /* formulate and SEND a SHUTDOWN-COMPLETE */ 11042 struct mbuf *m_shutdown_comp; 11043 struct sctp_shutdown_complete_chunk *shutdown_complete; 11044 uint32_t vtag; 11045 int error; 11046 uint8_t flags; 11047 11048 m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 11049 if (m_shutdown_comp == NULL) { 11050 /* no mbuf's */ 11051 return; 11052 } 11053 if (reflect_vtag) { 11054 flags = SCTP_HAD_NO_TCB; 11055 vtag = stcb->asoc.my_vtag; 11056 } else { 11057 flags = 0; 11058 vtag = stcb->asoc.peer_vtag; 11059 } 11060 shutdown_complete = mtod(m_shutdown_comp, struct sctp_shutdown_complete_chunk *); 11061 shutdown_complete->ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 11062 shutdown_complete->ch.chunk_flags = flags; 11063 shutdown_complete->ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 11064 SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_chunk); 11065 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 11066 (struct sockaddr *)&net->ro._l_addr, 11067 m_shutdown_comp, 0, NULL, 0, 1, 0, 0, 11068 stcb->sctp_ep->sctp_lport, stcb->rport, 11069 htonl(vtag), 11070 net->port, NULL, 11071 0, 0, 11072 SCTP_SO_NOT_LOCKED))) { 11073 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 11074 if (error == ENOBUFS) { 11075 stcb->asoc.ifp_had_enobuf = 1; 11076 SCTP_STAT_INCR(sctps_lowlevelerr); 11077 } 11078 } else { 11079 stcb->asoc.ifp_had_enobuf = 0; 11080 } 11081 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11082 return; 11083 } 11084 11085 static void 11086 sctp_send_resp_msg(struct sockaddr *src, struct sockaddr *dst, 11087 struct sctphdr *sh, uint32_t vtag, 11088 uint8_t type, struct mbuf *cause, 11089 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11090 uint32_t vrf_id, uint16_t port) 11091 { 11092 struct mbuf *o_pak; 11093 struct mbuf *mout; 11094 struct sctphdr *shout; 11095 struct sctp_chunkhdr *ch; 11096 #if defined(INET) || defined(INET6) 11097 struct udphdr *udp; 11098 #endif 11099 int ret, len, cause_len, padding_len; 11100 #ifdef INET 11101 struct sockaddr_in *src_sin, *dst_sin; 11102 struct ip *ip; 11103 #endif 11104 #ifdef INET6 11105 struct sockaddr_in6 *src_sin6, *dst_sin6; 11106 struct ip6_hdr *ip6; 11107 #endif 11108 11109 /* Compute the length of the cause and add final padding. */ 11110 cause_len = 0; 11111 if (cause != NULL) { 11112 struct mbuf *m_at, *m_last = NULL; 11113 11114 for (m_at = cause; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 11115 if (SCTP_BUF_NEXT(m_at) == NULL) 11116 m_last = m_at; 11117 cause_len += SCTP_BUF_LEN(m_at); 11118 } 11119 padding_len = cause_len % 4; 11120 if (padding_len != 0) { 11121 padding_len = 4 - padding_len; 11122 } 11123 if (padding_len != 0) { 11124 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 11125 sctp_m_freem(cause); 11126 return; 11127 } 11128 } 11129 } else { 11130 padding_len = 0; 11131 } 11132 /* Get an mbuf for the header. */ 11133 len = sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 11134 switch (dst->sa_family) { 11135 #ifdef INET 11136 case AF_INET: 11137 len += sizeof(struct ip); 11138 break; 11139 #endif 11140 #ifdef INET6 11141 case AF_INET6: 11142 len += sizeof(struct ip6_hdr); 11143 break; 11144 #endif 11145 default: 11146 break; 11147 } 11148 #if defined(INET) || defined(INET6) 11149 if (port) { 11150 len += sizeof(struct udphdr); 11151 } 11152 #endif 11153 mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_NOWAIT, 1, MT_DATA); 11154 if (mout == NULL) { 11155 if (cause) { 11156 sctp_m_freem(cause); 11157 } 11158 return; 11159 } 11160 SCTP_BUF_RESV_UF(mout, max_linkhdr); 11161 SCTP_BUF_LEN(mout) = len; 11162 SCTP_BUF_NEXT(mout) = cause; 11163 M_SETFIB(mout, fibnum); 11164 mout->m_pkthdr.flowid = mflowid; 11165 M_HASHTYPE_SET(mout, mflowtype); 11166 #ifdef INET 11167 ip = NULL; 11168 #endif 11169 #ifdef INET6 11170 ip6 = NULL; 11171 #endif 11172 switch (dst->sa_family) { 11173 #ifdef INET 11174 case AF_INET: 11175 src_sin = (struct sockaddr_in *)src; 11176 dst_sin = (struct sockaddr_in *)dst; 11177 ip = mtod(mout, struct ip *); 11178 ip->ip_v = IPVERSION; 11179 ip->ip_hl = (sizeof(struct ip) >> 2); 11180 ip->ip_tos = 0; 11181 ip->ip_off = htons(IP_DF); 11182 ip_fillid(ip); 11183 ip->ip_ttl = MODULE_GLOBAL(ip_defttl); 11184 if (port) { 11185 ip->ip_p = IPPROTO_UDP; 11186 } else { 11187 ip->ip_p = IPPROTO_SCTP; 11188 } 11189 ip->ip_src.s_addr = dst_sin->sin_addr.s_addr; 11190 ip->ip_dst.s_addr = src_sin->sin_addr.s_addr; 11191 ip->ip_sum = 0; 11192 len = sizeof(struct ip); 11193 shout = (struct sctphdr *)((caddr_t)ip + len); 11194 break; 11195 #endif 11196 #ifdef INET6 11197 case AF_INET6: 11198 src_sin6 = (struct sockaddr_in6 *)src; 11199 dst_sin6 = (struct sockaddr_in6 *)dst; 11200 ip6 = mtod(mout, struct ip6_hdr *); 11201 ip6->ip6_flow = htonl(0x60000000); 11202 if (V_ip6_auto_flowlabel) { 11203 ip6->ip6_flow |= (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK); 11204 } 11205 ip6->ip6_hlim = MODULE_GLOBAL(ip6_defhlim); 11206 if (port) { 11207 ip6->ip6_nxt = IPPROTO_UDP; 11208 } else { 11209 ip6->ip6_nxt = IPPROTO_SCTP; 11210 } 11211 ip6->ip6_src = dst_sin6->sin6_addr; 11212 ip6->ip6_dst = src_sin6->sin6_addr; 11213 len = sizeof(struct ip6_hdr); 11214 shout = (struct sctphdr *)((caddr_t)ip6 + len); 11215 break; 11216 #endif 11217 default: 11218 len = 0; 11219 shout = mtod(mout, struct sctphdr *); 11220 break; 11221 } 11222 #if defined(INET) || defined(INET6) 11223 if (port) { 11224 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 11225 sctp_m_freem(mout); 11226 return; 11227 } 11228 udp = (struct udphdr *)shout; 11229 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 11230 udp->uh_dport = port; 11231 udp->uh_sum = 0; 11232 udp->uh_ulen = htons((uint16_t)(sizeof(struct udphdr) + 11233 sizeof(struct sctphdr) + 11234 sizeof(struct sctp_chunkhdr) + 11235 cause_len + padding_len)); 11236 len += sizeof(struct udphdr); 11237 shout = (struct sctphdr *)((caddr_t)shout + sizeof(struct udphdr)); 11238 } else { 11239 udp = NULL; 11240 } 11241 #endif 11242 shout->src_port = sh->dest_port; 11243 shout->dest_port = sh->src_port; 11244 shout->checksum = 0; 11245 if (vtag) { 11246 shout->v_tag = htonl(vtag); 11247 } else { 11248 shout->v_tag = sh->v_tag; 11249 } 11250 len += sizeof(struct sctphdr); 11251 ch = (struct sctp_chunkhdr *)((caddr_t)shout + sizeof(struct sctphdr)); 11252 ch->chunk_type = type; 11253 if (vtag) { 11254 ch->chunk_flags = 0; 11255 } else { 11256 ch->chunk_flags = SCTP_HAD_NO_TCB; 11257 } 11258 ch->chunk_length = htons((uint16_t)(sizeof(struct sctp_chunkhdr) + cause_len)); 11259 len += sizeof(struct sctp_chunkhdr); 11260 len += cause_len + padding_len; 11261 11262 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 11263 sctp_m_freem(mout); 11264 return; 11265 } 11266 SCTP_ATTACH_CHAIN(o_pak, mout, len); 11267 switch (dst->sa_family) { 11268 #ifdef INET 11269 case AF_INET: 11270 if (port) { 11271 if (V_udp_cksum) { 11272 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 11273 } else { 11274 udp->uh_sum = 0; 11275 } 11276 } 11277 ip->ip_len = htons(len); 11278 if (port) { 11279 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip) + sizeof(struct udphdr)); 11280 SCTP_STAT_INCR(sctps_sendswcrc); 11281 if (V_udp_cksum) { 11282 SCTP_ENABLE_UDP_CSUM(o_pak); 11283 } 11284 } else { 11285 mout->m_pkthdr.csum_flags = CSUM_SCTP; 11286 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11287 SCTP_STAT_INCR(sctps_sendhwcrc); 11288 } 11289 #ifdef SCTP_PACKET_LOGGING 11290 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11291 sctp_packet_log(o_pak); 11292 } 11293 #endif 11294 SCTP_PROBE5(send, NULL, NULL, ip, NULL, shout); 11295 SCTP_IP_OUTPUT(ret, o_pak, NULL, NULL, vrf_id); 11296 break; 11297 #endif 11298 #ifdef INET6 11299 case AF_INET6: 11300 ip6->ip6_plen = htons((uint16_t)(len - sizeof(struct ip6_hdr))); 11301 if (port) { 11302 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 11303 SCTP_STAT_INCR(sctps_sendswcrc); 11304 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), len - sizeof(struct ip6_hdr))) == 0) { 11305 udp->uh_sum = 0xffff; 11306 } 11307 } else { 11308 mout->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 11309 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11310 SCTP_STAT_INCR(sctps_sendhwcrc); 11311 } 11312 #ifdef SCTP_PACKET_LOGGING 11313 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11314 sctp_packet_log(o_pak); 11315 } 11316 #endif 11317 SCTP_PROBE5(send, NULL, NULL, ip6, NULL, shout); 11318 SCTP_IP6_OUTPUT(ret, o_pak, NULL, NULL, NULL, vrf_id); 11319 break; 11320 #endif 11321 default: 11322 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 11323 dst->sa_family); 11324 sctp_m_freem(mout); 11325 SCTP_LTRACE_ERR_RET_PKT(mout, NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 11326 return; 11327 } 11328 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 11329 if (port) { 11330 UDPSTAT_INC(udps_opackets); 11331 } 11332 SCTP_STAT_INCR(sctps_sendpackets); 11333 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 11334 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11335 if (ret) { 11336 SCTP_STAT_INCR(sctps_senderrors); 11337 } 11338 return; 11339 } 11340 11341 void 11342 sctp_send_shutdown_complete2(struct sockaddr *src, struct sockaddr *dst, 11343 struct sctphdr *sh, 11344 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11345 uint32_t vrf_id, uint16_t port) 11346 { 11347 sctp_send_resp_msg(src, dst, sh, 0, SCTP_SHUTDOWN_COMPLETE, NULL, 11348 mflowtype, mflowid, fibnum, 11349 vrf_id, port); 11350 } 11351 11352 void 11353 sctp_send_hb(struct sctp_tcb *stcb, struct sctp_nets *net, int so_locked 11354 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 11355 SCTP_UNUSED 11356 #endif 11357 ) 11358 { 11359 struct sctp_tmit_chunk *chk; 11360 struct sctp_heartbeat_chunk *hb; 11361 struct timeval now; 11362 11363 SCTP_TCB_LOCK_ASSERT(stcb); 11364 if (net == NULL) { 11365 return; 11366 } 11367 (void)SCTP_GETTIME_TIMEVAL(&now); 11368 switch (net->ro._l_addr.sa.sa_family) { 11369 #ifdef INET 11370 case AF_INET: 11371 break; 11372 #endif 11373 #ifdef INET6 11374 case AF_INET6: 11375 break; 11376 #endif 11377 default: 11378 return; 11379 } 11380 sctp_alloc_a_chunk(stcb, chk); 11381 if (chk == NULL) { 11382 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak, can't get a chunk for hb\n"); 11383 return; 11384 } 11385 11386 chk->copy_by_ref = 0; 11387 chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST; 11388 chk->rec.chunk_id.can_take_data = 1; 11389 chk->flags = 0; 11390 chk->asoc = &stcb->asoc; 11391 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 11392 11393 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11394 if (chk->data == NULL) { 11395 sctp_free_a_chunk(stcb, chk, so_locked); 11396 return; 11397 } 11398 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11399 SCTP_BUF_LEN(chk->data) = chk->send_size; 11400 chk->sent = SCTP_DATAGRAM_UNSENT; 11401 chk->snd_count = 0; 11402 chk->whoTo = net; 11403 atomic_add_int(&chk->whoTo->ref_count, 1); 11404 /* Now we have a mbuf that we can fill in with the details */ 11405 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 11406 memset(hb, 0, sizeof(struct sctp_heartbeat_chunk)); 11407 /* fill out chunk header */ 11408 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 11409 hb->ch.chunk_flags = 0; 11410 hb->ch.chunk_length = htons(chk->send_size); 11411 /* Fill out hb parameter */ 11412 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 11413 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 11414 hb->heartbeat.hb_info.time_value_1 = now.tv_sec; 11415 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 11416 /* Did our user request this one, put it in */ 11417 hb->heartbeat.hb_info.addr_family = (uint8_t)net->ro._l_addr.sa.sa_family; 11418 hb->heartbeat.hb_info.addr_len = net->ro._l_addr.sa.sa_len; 11419 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 11420 /* 11421 * we only take from the entropy pool if the address is not 11422 * confirmed. 11423 */ 11424 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11425 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11426 } else { 11427 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 11428 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 11429 } 11430 switch (net->ro._l_addr.sa.sa_family) { 11431 #ifdef INET 11432 case AF_INET: 11433 memcpy(hb->heartbeat.hb_info.address, 11434 &net->ro._l_addr.sin.sin_addr, 11435 sizeof(net->ro._l_addr.sin.sin_addr)); 11436 break; 11437 #endif 11438 #ifdef INET6 11439 case AF_INET6: 11440 memcpy(hb->heartbeat.hb_info.address, 11441 &net->ro._l_addr.sin6.sin6_addr, 11442 sizeof(net->ro._l_addr.sin6.sin6_addr)); 11443 break; 11444 #endif 11445 default: 11446 if (chk->data) { 11447 sctp_m_freem(chk->data); 11448 chk->data = NULL; 11449 } 11450 sctp_free_a_chunk(stcb, chk, so_locked); 11451 return; 11452 break; 11453 } 11454 net->hb_responded = 0; 11455 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11456 stcb->asoc.ctrl_queue_cnt++; 11457 SCTP_STAT_INCR(sctps_sendheartbeat); 11458 return; 11459 } 11460 11461 void 11462 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 11463 uint32_t high_tsn) 11464 { 11465 struct sctp_association *asoc; 11466 struct sctp_ecne_chunk *ecne; 11467 struct sctp_tmit_chunk *chk; 11468 11469 if (net == NULL) { 11470 return; 11471 } 11472 asoc = &stcb->asoc; 11473 SCTP_TCB_LOCK_ASSERT(stcb); 11474 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11475 if ((chk->rec.chunk_id.id == SCTP_ECN_ECHO) && (net == chk->whoTo)) { 11476 /* found a previous ECN_ECHO update it if needed */ 11477 uint32_t cnt, ctsn; 11478 11479 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11480 ctsn = ntohl(ecne->tsn); 11481 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11482 ecne->tsn = htonl(high_tsn); 11483 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11484 } 11485 cnt = ntohl(ecne->num_pkts_since_cwr); 11486 cnt++; 11487 ecne->num_pkts_since_cwr = htonl(cnt); 11488 return; 11489 } 11490 } 11491 /* nope could not find one to update so we must build one */ 11492 sctp_alloc_a_chunk(stcb, chk); 11493 if (chk == NULL) { 11494 return; 11495 } 11496 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11497 chk->copy_by_ref = 0; 11498 chk->rec.chunk_id.id = SCTP_ECN_ECHO; 11499 chk->rec.chunk_id.can_take_data = 0; 11500 chk->flags = 0; 11501 chk->asoc = &stcb->asoc; 11502 chk->send_size = sizeof(struct sctp_ecne_chunk); 11503 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11504 if (chk->data == NULL) { 11505 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11506 return; 11507 } 11508 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11509 SCTP_BUF_LEN(chk->data) = chk->send_size; 11510 chk->sent = SCTP_DATAGRAM_UNSENT; 11511 chk->snd_count = 0; 11512 chk->whoTo = net; 11513 atomic_add_int(&chk->whoTo->ref_count, 1); 11514 11515 stcb->asoc.ecn_echo_cnt_onq++; 11516 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11517 ecne->ch.chunk_type = SCTP_ECN_ECHO; 11518 ecne->ch.chunk_flags = 0; 11519 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 11520 ecne->tsn = htonl(high_tsn); 11521 ecne->num_pkts_since_cwr = htonl(1); 11522 TAILQ_INSERT_HEAD(&stcb->asoc.control_send_queue, chk, sctp_next); 11523 asoc->ctrl_queue_cnt++; 11524 } 11525 11526 void 11527 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 11528 struct mbuf *m, int len, int iphlen, int bad_crc) 11529 { 11530 struct sctp_association *asoc; 11531 struct sctp_pktdrop_chunk *drp; 11532 struct sctp_tmit_chunk *chk; 11533 uint8_t *datap; 11534 int was_trunc = 0; 11535 int fullsz = 0; 11536 long spc; 11537 int offset; 11538 struct sctp_chunkhdr *ch, chunk_buf; 11539 unsigned int chk_length; 11540 11541 if (!stcb) { 11542 return; 11543 } 11544 asoc = &stcb->asoc; 11545 SCTP_TCB_LOCK_ASSERT(stcb); 11546 if (asoc->pktdrop_supported == 0) { 11547 /*- 11548 * peer must declare support before I send one. 11549 */ 11550 return; 11551 } 11552 if (stcb->sctp_socket == NULL) { 11553 return; 11554 } 11555 sctp_alloc_a_chunk(stcb, chk); 11556 if (chk == NULL) { 11557 return; 11558 } 11559 chk->copy_by_ref = 0; 11560 chk->rec.chunk_id.id = SCTP_PACKET_DROPPED; 11561 chk->rec.chunk_id.can_take_data = 1; 11562 chk->flags = 0; 11563 len -= iphlen; 11564 chk->send_size = len; 11565 /* Validate that we do not have an ABORT in here. */ 11566 offset = iphlen + sizeof(struct sctphdr); 11567 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11568 sizeof(*ch), (uint8_t *)&chunk_buf); 11569 while (ch != NULL) { 11570 chk_length = ntohs(ch->chunk_length); 11571 if (chk_length < sizeof(*ch)) { 11572 /* break to abort land */ 11573 break; 11574 } 11575 switch (ch->chunk_type) { 11576 case SCTP_PACKET_DROPPED: 11577 case SCTP_ABORT_ASSOCIATION: 11578 case SCTP_INITIATION_ACK: 11579 /** 11580 * We don't respond with an PKT-DROP to an ABORT 11581 * or PKT-DROP. We also do not respond to an 11582 * INIT-ACK, because we can't know if the initiation 11583 * tag is correct or not. 11584 */ 11585 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11586 return; 11587 default: 11588 break; 11589 } 11590 offset += SCTP_SIZE32(chk_length); 11591 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11592 sizeof(*ch), (uint8_t *)&chunk_buf); 11593 } 11594 11595 if ((len + SCTP_MAX_OVERHEAD + sizeof(struct sctp_pktdrop_chunk)) > 11596 min(stcb->asoc.smallest_mtu, MCLBYTES)) { 11597 /* 11598 * only send 1 mtu worth, trim off the excess on the end. 11599 */ 11600 fullsz = len; 11601 len = min(stcb->asoc.smallest_mtu, MCLBYTES) - SCTP_MAX_OVERHEAD; 11602 was_trunc = 1; 11603 } 11604 chk->asoc = &stcb->asoc; 11605 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11606 if (chk->data == NULL) { 11607 jump_out: 11608 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11609 return; 11610 } 11611 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11612 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 11613 if (drp == NULL) { 11614 sctp_m_freem(chk->data); 11615 chk->data = NULL; 11616 goto jump_out; 11617 } 11618 chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 11619 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD)); 11620 chk->book_size_scale = 0; 11621 if (was_trunc) { 11622 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 11623 drp->trunc_len = htons(fullsz); 11624 /* 11625 * Len is already adjusted to size minus overhead above take 11626 * out the pkt_drop chunk itself from it. 11627 */ 11628 chk->send_size = (uint16_t)(len - sizeof(struct sctp_pktdrop_chunk)); 11629 len = chk->send_size; 11630 } else { 11631 /* no truncation needed */ 11632 drp->ch.chunk_flags = 0; 11633 drp->trunc_len = htons(0); 11634 } 11635 if (bad_crc) { 11636 drp->ch.chunk_flags |= SCTP_BADCRC; 11637 } 11638 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 11639 SCTP_BUF_LEN(chk->data) = chk->send_size; 11640 chk->sent = SCTP_DATAGRAM_UNSENT; 11641 chk->snd_count = 0; 11642 if (net) { 11643 /* we should hit here */ 11644 chk->whoTo = net; 11645 atomic_add_int(&chk->whoTo->ref_count, 1); 11646 } else { 11647 chk->whoTo = NULL; 11648 } 11649 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 11650 drp->ch.chunk_length = htons(chk->send_size); 11651 spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket); 11652 if (spc < 0) { 11653 spc = 0; 11654 } 11655 drp->bottle_bw = htonl(spc); 11656 if (asoc->my_rwnd) { 11657 drp->current_onq = htonl(asoc->size_on_reasm_queue + 11658 asoc->size_on_all_streams + 11659 asoc->my_rwnd_control_len + 11660 stcb->sctp_socket->so_rcv.sb_cc); 11661 } else { 11662 /*- 11663 * If my rwnd is 0, possibly from mbuf depletion as well as 11664 * space used, tell the peer there is NO space aka onq == bw 11665 */ 11666 drp->current_onq = htonl(spc); 11667 } 11668 drp->reserved = 0; 11669 datap = drp->data; 11670 m_copydata(m, iphlen, len, (caddr_t)datap); 11671 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11672 asoc->ctrl_queue_cnt++; 11673 } 11674 11675 void 11676 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn, uint8_t override) 11677 { 11678 struct sctp_association *asoc; 11679 struct sctp_cwr_chunk *cwr; 11680 struct sctp_tmit_chunk *chk; 11681 11682 SCTP_TCB_LOCK_ASSERT(stcb); 11683 if (net == NULL) { 11684 return; 11685 } 11686 asoc = &stcb->asoc; 11687 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11688 if ((chk->rec.chunk_id.id == SCTP_ECN_CWR) && (net == chk->whoTo)) { 11689 /* 11690 * found a previous CWR queued to same destination 11691 * update it if needed 11692 */ 11693 uint32_t ctsn; 11694 11695 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11696 ctsn = ntohl(cwr->tsn); 11697 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11698 cwr->tsn = htonl(high_tsn); 11699 } 11700 if (override & SCTP_CWR_REDUCE_OVERRIDE) { 11701 /* Make sure override is carried */ 11702 cwr->ch.chunk_flags |= SCTP_CWR_REDUCE_OVERRIDE; 11703 } 11704 return; 11705 } 11706 } 11707 sctp_alloc_a_chunk(stcb, chk); 11708 if (chk == NULL) { 11709 return; 11710 } 11711 chk->copy_by_ref = 0; 11712 chk->rec.chunk_id.id = SCTP_ECN_CWR; 11713 chk->rec.chunk_id.can_take_data = 1; 11714 chk->flags = 0; 11715 chk->asoc = &stcb->asoc; 11716 chk->send_size = sizeof(struct sctp_cwr_chunk); 11717 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11718 if (chk->data == NULL) { 11719 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11720 return; 11721 } 11722 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11723 SCTP_BUF_LEN(chk->data) = chk->send_size; 11724 chk->sent = SCTP_DATAGRAM_UNSENT; 11725 chk->snd_count = 0; 11726 chk->whoTo = net; 11727 atomic_add_int(&chk->whoTo->ref_count, 1); 11728 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11729 cwr->ch.chunk_type = SCTP_ECN_CWR; 11730 cwr->ch.chunk_flags = override; 11731 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 11732 cwr->tsn = htonl(high_tsn); 11733 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11734 asoc->ctrl_queue_cnt++; 11735 } 11736 11737 static int 11738 sctp_add_stream_reset_out(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk, 11739 uint32_t seq, uint32_t resp_seq, uint32_t last_sent) 11740 { 11741 uint16_t len, old_len, i; 11742 struct sctp_stream_reset_out_request *req_out; 11743 struct sctp_chunkhdr *ch; 11744 int at; 11745 int number_entries = 0; 11746 11747 ch = mtod(chk->data, struct sctp_chunkhdr *); 11748 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11749 /* get to new offset for the param. */ 11750 req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len); 11751 /* now how long will this param be? */ 11752 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11753 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11754 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11755 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11756 number_entries++; 11757 } 11758 } 11759 if (number_entries == 0) { 11760 return (0); 11761 } 11762 if (number_entries == stcb->asoc.streamoutcnt) { 11763 number_entries = 0; 11764 } 11765 if (number_entries > SCTP_MAX_STREAMS_AT_ONCE_RESET) { 11766 number_entries = SCTP_MAX_STREAMS_AT_ONCE_RESET; 11767 } 11768 len = (uint16_t)(sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries)); 11769 req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST); 11770 req_out->ph.param_length = htons(len); 11771 req_out->request_seq = htonl(seq); 11772 req_out->response_seq = htonl(resp_seq); 11773 req_out->send_reset_at_tsn = htonl(last_sent); 11774 at = 0; 11775 if (number_entries) { 11776 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11777 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11778 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11779 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11780 req_out->list_of_streams[at] = htons(i); 11781 at++; 11782 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11783 if (at >= number_entries) { 11784 break; 11785 } 11786 } 11787 } 11788 } else { 11789 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11790 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11791 } 11792 } 11793 if (SCTP_SIZE32(len) > len) { 11794 /*- 11795 * Need to worry about the pad we may end up adding to the 11796 * end. This is easy since the struct is either aligned to 4 11797 * bytes or 2 bytes off. 11798 */ 11799 req_out->list_of_streams[number_entries] = 0; 11800 } 11801 /* now fix the chunk length */ 11802 ch->chunk_length = htons(len + old_len); 11803 chk->book_size = len + old_len; 11804 chk->book_size_scale = 0; 11805 chk->send_size = SCTP_SIZE32(chk->book_size); 11806 SCTP_BUF_LEN(chk->data) = chk->send_size; 11807 return (1); 11808 } 11809 11810 static void 11811 sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk, 11812 int number_entries, uint16_t *list, 11813 uint32_t seq) 11814 { 11815 uint16_t len, old_len, i; 11816 struct sctp_stream_reset_in_request *req_in; 11817 struct sctp_chunkhdr *ch; 11818 11819 ch = mtod(chk->data, struct sctp_chunkhdr *); 11820 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11821 11822 /* get to new offset for the param. */ 11823 req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len); 11824 /* now how long will this param be? */ 11825 len = (uint16_t)(sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries)); 11826 req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST); 11827 req_in->ph.param_length = htons(len); 11828 req_in->request_seq = htonl(seq); 11829 if (number_entries) { 11830 for (i = 0; i < number_entries; i++) { 11831 req_in->list_of_streams[i] = htons(list[i]); 11832 } 11833 } 11834 if (SCTP_SIZE32(len) > len) { 11835 /*- 11836 * Need to worry about the pad we may end up adding to the 11837 * end. This is easy since the struct is either aligned to 4 11838 * bytes or 2 bytes off. 11839 */ 11840 req_in->list_of_streams[number_entries] = 0; 11841 } 11842 /* now fix the chunk length */ 11843 ch->chunk_length = htons(len + old_len); 11844 chk->book_size = len + old_len; 11845 chk->book_size_scale = 0; 11846 chk->send_size = SCTP_SIZE32(chk->book_size); 11847 SCTP_BUF_LEN(chk->data) = chk->send_size; 11848 return; 11849 } 11850 11851 static void 11852 sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk, 11853 uint32_t seq) 11854 { 11855 uint16_t len, old_len; 11856 struct sctp_stream_reset_tsn_request *req_tsn; 11857 struct sctp_chunkhdr *ch; 11858 11859 ch = mtod(chk->data, struct sctp_chunkhdr *); 11860 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11861 11862 /* get to new offset for the param. */ 11863 req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len); 11864 /* now how long will this param be? */ 11865 len = sizeof(struct sctp_stream_reset_tsn_request); 11866 req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST); 11867 req_tsn->ph.param_length = htons(len); 11868 req_tsn->request_seq = htonl(seq); 11869 11870 /* now fix the chunk length */ 11871 ch->chunk_length = htons(len + old_len); 11872 chk->send_size = len + old_len; 11873 chk->book_size = SCTP_SIZE32(chk->send_size); 11874 chk->book_size_scale = 0; 11875 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11876 return; 11877 } 11878 11879 void 11880 sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk, 11881 uint32_t resp_seq, uint32_t result) 11882 { 11883 uint16_t len, old_len; 11884 struct sctp_stream_reset_response *resp; 11885 struct sctp_chunkhdr *ch; 11886 11887 ch = mtod(chk->data, struct sctp_chunkhdr *); 11888 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11889 11890 /* get to new offset for the param. */ 11891 resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len); 11892 /* now how long will this param be? */ 11893 len = sizeof(struct sctp_stream_reset_response); 11894 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11895 resp->ph.param_length = htons(len); 11896 resp->response_seq = htonl(resp_seq); 11897 resp->result = ntohl(result); 11898 11899 /* now fix the chunk length */ 11900 ch->chunk_length = htons(len + old_len); 11901 chk->book_size = len + old_len; 11902 chk->book_size_scale = 0; 11903 chk->send_size = SCTP_SIZE32(chk->book_size); 11904 SCTP_BUF_LEN(chk->data) = chk->send_size; 11905 return; 11906 } 11907 11908 void 11909 sctp_send_deferred_reset_response(struct sctp_tcb *stcb, 11910 struct sctp_stream_reset_list *ent, 11911 int response) 11912 { 11913 struct sctp_association *asoc; 11914 struct sctp_tmit_chunk *chk; 11915 struct sctp_chunkhdr *ch; 11916 11917 asoc = &stcb->asoc; 11918 11919 /* 11920 * Reset our last reset action to the new one IP -> response 11921 * (PERFORMED probably). This assures that if we fail to send, a 11922 * retran from the peer will get the new response. 11923 */ 11924 asoc->last_reset_action[0] = response; 11925 if (asoc->stream_reset_outstanding) { 11926 return; 11927 } 11928 sctp_alloc_a_chunk(stcb, chk); 11929 if (chk == NULL) { 11930 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11931 return; 11932 } 11933 chk->copy_by_ref = 0; 11934 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 11935 chk->rec.chunk_id.can_take_data = 0; 11936 chk->flags = 0; 11937 chk->asoc = &stcb->asoc; 11938 chk->book_size = sizeof(struct sctp_chunkhdr); 11939 chk->send_size = SCTP_SIZE32(chk->book_size); 11940 chk->book_size_scale = 0; 11941 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11942 if (chk->data == NULL) { 11943 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 11944 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11945 return; 11946 } 11947 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11948 /* setup chunk parameters */ 11949 chk->sent = SCTP_DATAGRAM_UNSENT; 11950 chk->snd_count = 0; 11951 if (stcb->asoc.alternate) { 11952 chk->whoTo = stcb->asoc.alternate; 11953 } else { 11954 chk->whoTo = stcb->asoc.primary_destination; 11955 } 11956 ch = mtod(chk->data, struct sctp_chunkhdr *); 11957 ch->chunk_type = SCTP_STREAM_RESET; 11958 ch->chunk_flags = 0; 11959 ch->chunk_length = htons(chk->book_size); 11960 atomic_add_int(&chk->whoTo->ref_count, 1); 11961 SCTP_BUF_LEN(chk->data) = chk->send_size; 11962 sctp_add_stream_reset_result(chk, ent->seq, response); 11963 /* insert the chunk for sending */ 11964 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 11965 chk, 11966 sctp_next); 11967 asoc->ctrl_queue_cnt++; 11968 } 11969 11970 void 11971 sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk, 11972 uint32_t resp_seq, uint32_t result, 11973 uint32_t send_una, uint32_t recv_next) 11974 { 11975 uint16_t len, old_len; 11976 struct sctp_stream_reset_response_tsn *resp; 11977 struct sctp_chunkhdr *ch; 11978 11979 ch = mtod(chk->data, struct sctp_chunkhdr *); 11980 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11981 11982 /* get to new offset for the param. */ 11983 resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len); 11984 /* now how long will this param be? */ 11985 len = sizeof(struct sctp_stream_reset_response_tsn); 11986 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11987 resp->ph.param_length = htons(len); 11988 resp->response_seq = htonl(resp_seq); 11989 resp->result = htonl(result); 11990 resp->senders_next_tsn = htonl(send_una); 11991 resp->receivers_next_tsn = htonl(recv_next); 11992 11993 /* now fix the chunk length */ 11994 ch->chunk_length = htons(len + old_len); 11995 chk->book_size = len + old_len; 11996 chk->send_size = SCTP_SIZE32(chk->book_size); 11997 chk->book_size_scale = 0; 11998 SCTP_BUF_LEN(chk->data) = chk->send_size; 11999 return; 12000 } 12001 12002 static void 12003 sctp_add_an_out_stream(struct sctp_tmit_chunk *chk, 12004 uint32_t seq, 12005 uint16_t adding) 12006 { 12007 uint16_t len, old_len; 12008 struct sctp_chunkhdr *ch; 12009 struct sctp_stream_reset_add_strm *addstr; 12010 12011 ch = mtod(chk->data, struct sctp_chunkhdr *); 12012 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 12013 12014 /* get to new offset for the param. */ 12015 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 12016 /* now how long will this param be? */ 12017 len = sizeof(struct sctp_stream_reset_add_strm); 12018 12019 /* Fill it out. */ 12020 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_OUT_STREAMS); 12021 addstr->ph.param_length = htons(len); 12022 addstr->request_seq = htonl(seq); 12023 addstr->number_of_streams = htons(adding); 12024 addstr->reserved = 0; 12025 12026 /* now fix the chunk length */ 12027 ch->chunk_length = htons(len + old_len); 12028 chk->send_size = len + old_len; 12029 chk->book_size = SCTP_SIZE32(chk->send_size); 12030 chk->book_size_scale = 0; 12031 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 12032 return; 12033 } 12034 12035 static void 12036 sctp_add_an_in_stream(struct sctp_tmit_chunk *chk, 12037 uint32_t seq, 12038 uint16_t adding) 12039 { 12040 uint16_t len, old_len; 12041 struct sctp_chunkhdr *ch; 12042 struct sctp_stream_reset_add_strm *addstr; 12043 12044 ch = mtod(chk->data, struct sctp_chunkhdr *); 12045 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 12046 12047 /* get to new offset for the param. */ 12048 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 12049 /* now how long will this param be? */ 12050 len = sizeof(struct sctp_stream_reset_add_strm); 12051 /* Fill it out. */ 12052 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_IN_STREAMS); 12053 addstr->ph.param_length = htons(len); 12054 addstr->request_seq = htonl(seq); 12055 addstr->number_of_streams = htons(adding); 12056 addstr->reserved = 0; 12057 12058 /* now fix the chunk length */ 12059 ch->chunk_length = htons(len + old_len); 12060 chk->send_size = len + old_len; 12061 chk->book_size = SCTP_SIZE32(chk->send_size); 12062 chk->book_size_scale = 0; 12063 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 12064 return; 12065 } 12066 12067 int 12068 sctp_send_stream_reset_out_if_possible(struct sctp_tcb *stcb, int so_locked) 12069 { 12070 struct sctp_association *asoc; 12071 struct sctp_tmit_chunk *chk; 12072 struct sctp_chunkhdr *ch; 12073 uint32_t seq; 12074 12075 asoc = &stcb->asoc; 12076 asoc->trigger_reset = 0; 12077 if (asoc->stream_reset_outstanding) { 12078 return (EALREADY); 12079 } 12080 sctp_alloc_a_chunk(stcb, chk); 12081 if (chk == NULL) { 12082 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12083 return (ENOMEM); 12084 } 12085 chk->copy_by_ref = 0; 12086 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12087 chk->rec.chunk_id.can_take_data = 0; 12088 chk->flags = 0; 12089 chk->asoc = &stcb->asoc; 12090 chk->book_size = sizeof(struct sctp_chunkhdr); 12091 chk->send_size = SCTP_SIZE32(chk->book_size); 12092 chk->book_size_scale = 0; 12093 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12094 if (chk->data == NULL) { 12095 sctp_free_a_chunk(stcb, chk, so_locked); 12096 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12097 return (ENOMEM); 12098 } 12099 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12100 12101 /* setup chunk parameters */ 12102 chk->sent = SCTP_DATAGRAM_UNSENT; 12103 chk->snd_count = 0; 12104 if (stcb->asoc.alternate) { 12105 chk->whoTo = stcb->asoc.alternate; 12106 } else { 12107 chk->whoTo = stcb->asoc.primary_destination; 12108 } 12109 ch = mtod(chk->data, struct sctp_chunkhdr *); 12110 ch->chunk_type = SCTP_STREAM_RESET; 12111 ch->chunk_flags = 0; 12112 ch->chunk_length = htons(chk->book_size); 12113 atomic_add_int(&chk->whoTo->ref_count, 1); 12114 SCTP_BUF_LEN(chk->data) = chk->send_size; 12115 seq = stcb->asoc.str_reset_seq_out; 12116 if (sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1))) { 12117 seq++; 12118 asoc->stream_reset_outstanding++; 12119 } else { 12120 m_freem(chk->data); 12121 chk->data = NULL; 12122 sctp_free_a_chunk(stcb, chk, so_locked); 12123 return (ENOENT); 12124 } 12125 asoc->str_reset = chk; 12126 /* insert the chunk for sending */ 12127 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12128 chk, 12129 sctp_next); 12130 asoc->ctrl_queue_cnt++; 12131 12132 if (stcb->asoc.send_sack) { 12133 sctp_send_sack(stcb, so_locked); 12134 } 12135 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12136 return (0); 12137 } 12138 12139 int 12140 sctp_send_str_reset_req(struct sctp_tcb *stcb, 12141 uint16_t number_entries, uint16_t *list, 12142 uint8_t send_in_req, 12143 uint8_t send_tsn_req, 12144 uint8_t add_stream, 12145 uint16_t adding_o, 12146 uint16_t adding_i, uint8_t peer_asked) 12147 { 12148 struct sctp_association *asoc; 12149 struct sctp_tmit_chunk *chk; 12150 struct sctp_chunkhdr *ch; 12151 int can_send_out_req = 0; 12152 uint32_t seq; 12153 12154 asoc = &stcb->asoc; 12155 if (asoc->stream_reset_outstanding) { 12156 /*- 12157 * Already one pending, must get ACK back to clear the flag. 12158 */ 12159 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EBUSY); 12160 return (EBUSY); 12161 } 12162 if ((send_in_req == 0) && (send_tsn_req == 0) && 12163 (add_stream == 0)) { 12164 /* nothing to do */ 12165 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12166 return (EINVAL); 12167 } 12168 if (send_tsn_req && send_in_req) { 12169 /* error, can't do that */ 12170 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12171 return (EINVAL); 12172 } else if (send_in_req) { 12173 can_send_out_req = 1; 12174 } 12175 if (number_entries > (MCLBYTES - 12176 SCTP_MIN_OVERHEAD - 12177 sizeof(struct sctp_chunkhdr) - 12178 sizeof(struct sctp_stream_reset_out_request)) / 12179 sizeof(uint16_t)) { 12180 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12181 return (ENOMEM); 12182 } 12183 sctp_alloc_a_chunk(stcb, chk); 12184 if (chk == NULL) { 12185 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12186 return (ENOMEM); 12187 } 12188 chk->copy_by_ref = 0; 12189 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12190 chk->rec.chunk_id.can_take_data = 0; 12191 chk->flags = 0; 12192 chk->asoc = &stcb->asoc; 12193 chk->book_size = sizeof(struct sctp_chunkhdr); 12194 chk->send_size = SCTP_SIZE32(chk->book_size); 12195 chk->book_size_scale = 0; 12196 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12197 if (chk->data == NULL) { 12198 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 12199 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12200 return (ENOMEM); 12201 } 12202 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12203 12204 /* setup chunk parameters */ 12205 chk->sent = SCTP_DATAGRAM_UNSENT; 12206 chk->snd_count = 0; 12207 if (stcb->asoc.alternate) { 12208 chk->whoTo = stcb->asoc.alternate; 12209 } else { 12210 chk->whoTo = stcb->asoc.primary_destination; 12211 } 12212 atomic_add_int(&chk->whoTo->ref_count, 1); 12213 ch = mtod(chk->data, struct sctp_chunkhdr *); 12214 ch->chunk_type = SCTP_STREAM_RESET; 12215 ch->chunk_flags = 0; 12216 ch->chunk_length = htons(chk->book_size); 12217 SCTP_BUF_LEN(chk->data) = chk->send_size; 12218 12219 seq = stcb->asoc.str_reset_seq_out; 12220 if (can_send_out_req) { 12221 int ret; 12222 12223 ret = sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1)); 12224 if (ret) { 12225 seq++; 12226 asoc->stream_reset_outstanding++; 12227 } 12228 } 12229 if ((add_stream & 1) && 12230 ((stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt) < adding_o)) { 12231 /* Need to allocate more */ 12232 struct sctp_stream_out *oldstream; 12233 struct sctp_stream_queue_pending *sp, *nsp; 12234 int i; 12235 #if defined(SCTP_DETAILED_STR_STATS) 12236 int j; 12237 #endif 12238 12239 oldstream = stcb->asoc.strmout; 12240 /* get some more */ 12241 SCTP_MALLOC(stcb->asoc.strmout, struct sctp_stream_out *, 12242 (stcb->asoc.streamoutcnt + adding_o) * sizeof(struct sctp_stream_out), 12243 SCTP_M_STRMO); 12244 if (stcb->asoc.strmout == NULL) { 12245 uint8_t x; 12246 12247 stcb->asoc.strmout = oldstream; 12248 /* Turn off the bit */ 12249 x = add_stream & 0xfe; 12250 add_stream = x; 12251 goto skip_stuff; 12252 } 12253 /* 12254 * Ok now we proceed with copying the old out stuff and 12255 * initializing the new stuff. 12256 */ 12257 SCTP_TCB_SEND_LOCK(stcb); 12258 stcb->asoc.ss_functions.sctp_ss_clear(stcb, &stcb->asoc, 0, 1); 12259 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 12260 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12261 stcb->asoc.strmout[i].chunks_on_queues = oldstream[i].chunks_on_queues; 12262 stcb->asoc.strmout[i].next_mid_ordered = oldstream[i].next_mid_ordered; 12263 stcb->asoc.strmout[i].next_mid_unordered = oldstream[i].next_mid_unordered; 12264 stcb->asoc.strmout[i].last_msg_incomplete = oldstream[i].last_msg_incomplete; 12265 stcb->asoc.strmout[i].sid = i; 12266 stcb->asoc.strmout[i].state = oldstream[i].state; 12267 /* FIX ME FIX ME */ 12268 /* 12269 * This should be a SS_COPY operation FIX ME STREAM 12270 * SCHEDULER EXPERT 12271 */ 12272 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], &oldstream[i]); 12273 /* now anything on those queues? */ 12274 TAILQ_FOREACH_SAFE(sp, &oldstream[i].outqueue, next, nsp) { 12275 TAILQ_REMOVE(&oldstream[i].outqueue, sp, next); 12276 TAILQ_INSERT_TAIL(&stcb->asoc.strmout[i].outqueue, sp, next); 12277 } 12278 12279 } 12280 /* now the new streams */ 12281 stcb->asoc.ss_functions.sctp_ss_init(stcb, &stcb->asoc, 1); 12282 for (i = stcb->asoc.streamoutcnt; i < (stcb->asoc.streamoutcnt + adding_o); i++) { 12283 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12284 stcb->asoc.strmout[i].chunks_on_queues = 0; 12285 #if defined(SCTP_DETAILED_STR_STATS) 12286 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 12287 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 12288 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 12289 } 12290 #else 12291 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 12292 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 12293 #endif 12294 stcb->asoc.strmout[i].next_mid_ordered = 0; 12295 stcb->asoc.strmout[i].next_mid_unordered = 0; 12296 stcb->asoc.strmout[i].sid = i; 12297 stcb->asoc.strmout[i].last_msg_incomplete = 0; 12298 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 12299 stcb->asoc.strmout[i].state = SCTP_STREAM_CLOSED; 12300 } 12301 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt + adding_o; 12302 SCTP_FREE(oldstream, SCTP_M_STRMO); 12303 SCTP_TCB_SEND_UNLOCK(stcb); 12304 } 12305 skip_stuff: 12306 if ((add_stream & 1) && (adding_o > 0)) { 12307 asoc->strm_pending_add_size = adding_o; 12308 asoc->peer_req_out = peer_asked; 12309 sctp_add_an_out_stream(chk, seq, adding_o); 12310 seq++; 12311 asoc->stream_reset_outstanding++; 12312 } 12313 if ((add_stream & 2) && (adding_i > 0)) { 12314 sctp_add_an_in_stream(chk, seq, adding_i); 12315 seq++; 12316 asoc->stream_reset_outstanding++; 12317 } 12318 if (send_in_req) { 12319 sctp_add_stream_reset_in(chk, number_entries, list, seq); 12320 seq++; 12321 asoc->stream_reset_outstanding++; 12322 } 12323 if (send_tsn_req) { 12324 sctp_add_stream_reset_tsn(chk, seq); 12325 asoc->stream_reset_outstanding++; 12326 } 12327 asoc->str_reset = chk; 12328 /* insert the chunk for sending */ 12329 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12330 chk, 12331 sctp_next); 12332 asoc->ctrl_queue_cnt++; 12333 if (stcb->asoc.send_sack) { 12334 sctp_send_sack(stcb, SCTP_SO_LOCKED); 12335 } 12336 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12337 return (0); 12338 } 12339 12340 void 12341 sctp_send_abort(struct mbuf *m, int iphlen, struct sockaddr *src, struct sockaddr *dst, 12342 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12343 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12344 uint32_t vrf_id, uint16_t port) 12345 { 12346 /* Don't respond to an ABORT with an ABORT. */ 12347 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 12348 if (cause) 12349 sctp_m_freem(cause); 12350 return; 12351 } 12352 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_ABORT_ASSOCIATION, cause, 12353 mflowtype, mflowid, fibnum, 12354 vrf_id, port); 12355 return; 12356 } 12357 12358 void 12359 sctp_send_operr_to(struct sockaddr *src, struct sockaddr *dst, 12360 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12361 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12362 uint32_t vrf_id, uint16_t port) 12363 { 12364 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_OPERATION_ERROR, cause, 12365 mflowtype, mflowid, fibnum, 12366 vrf_id, port); 12367 return; 12368 } 12369 12370 static struct mbuf * 12371 sctp_copy_resume(struct uio *uio, 12372 int max_send_len, 12373 int user_marks_eor, 12374 int *error, 12375 uint32_t *sndout, 12376 struct mbuf **new_tail) 12377 { 12378 struct mbuf *m; 12379 12380 m = m_uiotombuf(uio, M_WAITOK, max_send_len, 0, 12381 (M_PKTHDR | (user_marks_eor ? M_EOR : 0))); 12382 if (m == NULL) { 12383 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12384 *error = ENOBUFS; 12385 } else { 12386 *sndout = m_length(m, NULL); 12387 *new_tail = m_last(m); 12388 } 12389 return (m); 12390 } 12391 12392 static int 12393 sctp_copy_one(struct sctp_stream_queue_pending *sp, 12394 struct uio *uio, 12395 int resv_upfront) 12396 { 12397 sp->data = m_uiotombuf(uio, M_WAITOK, sp->length, 12398 resv_upfront, 0); 12399 if (sp->data == NULL) { 12400 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12401 return (ENOBUFS); 12402 } 12403 12404 sp->tail_mbuf = m_last(sp->data); 12405 return (0); 12406 } 12407 12408 12409 12410 static struct sctp_stream_queue_pending * 12411 sctp_copy_it_in(struct sctp_tcb *stcb, 12412 struct sctp_association *asoc, 12413 struct sctp_sndrcvinfo *srcv, 12414 struct uio *uio, 12415 struct sctp_nets *net, 12416 ssize_t max_send_len, 12417 int user_marks_eor, 12418 int *error) 12419 { 12420 12421 /*- 12422 * This routine must be very careful in its work. Protocol 12423 * processing is up and running so care must be taken to spl...() 12424 * when you need to do something that may effect the stcb/asoc. The 12425 * sb is locked however. When data is copied the protocol processing 12426 * should be enabled since this is a slower operation... 12427 */ 12428 struct sctp_stream_queue_pending *sp = NULL; 12429 int resv_in_first; 12430 12431 *error = 0; 12432 /* Now can we send this? */ 12433 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 12434 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12435 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12436 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12437 /* got data while shutting down */ 12438 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12439 *error = ECONNRESET; 12440 goto out_now; 12441 } 12442 sctp_alloc_a_strmoq(stcb, sp); 12443 if (sp == NULL) { 12444 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12445 *error = ENOMEM; 12446 goto out_now; 12447 } 12448 sp->act_flags = 0; 12449 sp->sender_all_done = 0; 12450 sp->sinfo_flags = srcv->sinfo_flags; 12451 sp->timetolive = srcv->sinfo_timetolive; 12452 sp->ppid = srcv->sinfo_ppid; 12453 sp->context = srcv->sinfo_context; 12454 sp->fsn = 0; 12455 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 12456 12457 sp->sid = srcv->sinfo_stream; 12458 sp->length = (uint32_t)min(uio->uio_resid, max_send_len); 12459 if ((sp->length == (uint32_t)uio->uio_resid) && 12460 ((user_marks_eor == 0) || 12461 (srcv->sinfo_flags & SCTP_EOF) || 12462 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 12463 sp->msg_is_complete = 1; 12464 } else { 12465 sp->msg_is_complete = 0; 12466 } 12467 sp->sender_all_done = 0; 12468 sp->some_taken = 0; 12469 sp->put_last_out = 0; 12470 resv_in_first = SCTP_DATA_CHUNK_OVERHEAD(stcb); 12471 sp->data = sp->tail_mbuf = NULL; 12472 if (sp->length == 0) { 12473 goto skip_copy; 12474 } 12475 if (srcv->sinfo_keynumber_valid) { 12476 sp->auth_keyid = srcv->sinfo_keynumber; 12477 } else { 12478 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 12479 } 12480 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 12481 sctp_auth_key_acquire(stcb, sp->auth_keyid); 12482 sp->holds_key_ref = 1; 12483 } 12484 *error = sctp_copy_one(sp, uio, resv_in_first); 12485 skip_copy: 12486 if (*error) { 12487 sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); 12488 sp = NULL; 12489 } else { 12490 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 12491 sp->net = net; 12492 atomic_add_int(&sp->net->ref_count, 1); 12493 } else { 12494 sp->net = NULL; 12495 } 12496 sctp_set_prsctp_policy(sp); 12497 } 12498 out_now: 12499 return (sp); 12500 } 12501 12502 12503 int 12504 sctp_sosend(struct socket *so, 12505 struct sockaddr *addr, 12506 struct uio *uio, 12507 struct mbuf *top, 12508 struct mbuf *control, 12509 int flags, 12510 struct thread *p 12511 ) 12512 { 12513 int error, use_sndinfo = 0; 12514 struct sctp_sndrcvinfo sndrcvninfo; 12515 struct sockaddr *addr_to_use; 12516 #if defined(INET) && defined(INET6) 12517 struct sockaddr_in sin; 12518 #endif 12519 12520 if (control) { 12521 /* process cmsg snd/rcv info (maybe a assoc-id) */ 12522 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&sndrcvninfo, control, 12523 sizeof(sndrcvninfo))) { 12524 /* got one */ 12525 use_sndinfo = 1; 12526 } 12527 } 12528 addr_to_use = addr; 12529 #if defined(INET) && defined(INET6) 12530 if ((addr) && (addr->sa_family == AF_INET6)) { 12531 struct sockaddr_in6 *sin6; 12532 12533 sin6 = (struct sockaddr_in6 *)addr; 12534 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 12535 in6_sin6_2_sin(&sin, sin6); 12536 addr_to_use = (struct sockaddr *)&sin; 12537 } 12538 } 12539 #endif 12540 error = sctp_lower_sosend(so, addr_to_use, uio, top, 12541 control, 12542 flags, 12543 use_sndinfo ? &sndrcvninfo : NULL 12544 ,p 12545 ); 12546 return (error); 12547 } 12548 12549 12550 int 12551 sctp_lower_sosend(struct socket *so, 12552 struct sockaddr *addr, 12553 struct uio *uio, 12554 struct mbuf *i_pak, 12555 struct mbuf *control, 12556 int flags, 12557 struct sctp_sndrcvinfo *srcv 12558 , 12559 struct thread *p 12560 ) 12561 { 12562 ssize_t sndlen = 0, max_len, local_add_more; 12563 int error, len; 12564 struct mbuf *top = NULL; 12565 int queue_only = 0, queue_only_for_init = 0; 12566 int free_cnt_applied = 0; 12567 int un_sent; 12568 int now_filled = 0; 12569 unsigned int inqueue_bytes = 0; 12570 struct sctp_block_entry be; 12571 struct sctp_inpcb *inp; 12572 struct sctp_tcb *stcb = NULL; 12573 struct timeval now; 12574 struct sctp_nets *net; 12575 struct sctp_association *asoc; 12576 struct sctp_inpcb *t_inp; 12577 int user_marks_eor; 12578 int create_lock_applied = 0; 12579 int nagle_applies = 0; 12580 int some_on_control = 0; 12581 int got_all_of_the_send = 0; 12582 int hold_tcblock = 0; 12583 int non_blocking = 0; 12584 ssize_t local_soresv = 0; 12585 uint16_t port; 12586 uint16_t sinfo_flags; 12587 sctp_assoc_t sinfo_assoc_id; 12588 12589 error = 0; 12590 net = NULL; 12591 stcb = NULL; 12592 asoc = NULL; 12593 12594 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 12595 if (inp == NULL) { 12596 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12597 error = EINVAL; 12598 if (i_pak) { 12599 SCTP_RELEASE_PKT(i_pak); 12600 } 12601 return (error); 12602 } 12603 if ((uio == NULL) && (i_pak == NULL)) { 12604 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12605 return (EINVAL); 12606 } 12607 user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 12608 atomic_add_int(&inp->total_sends, 1); 12609 if (uio) { 12610 if (uio->uio_resid < 0) { 12611 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12612 return (EINVAL); 12613 } 12614 sndlen = uio->uio_resid; 12615 } else { 12616 top = SCTP_HEADER_TO_CHAIN(i_pak); 12617 sndlen = SCTP_HEADER_LEN(i_pak); 12618 } 12619 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %zu\n", 12620 (void *)addr, 12621 sndlen); 12622 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 12623 SCTP_IS_LISTENING(inp)) { 12624 /* The listener can NOT send */ 12625 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12626 error = ENOTCONN; 12627 goto out_unlocked; 12628 } 12629 /** 12630 * Pre-screen address, if one is given the sin-len 12631 * must be set correctly! 12632 */ 12633 if (addr) { 12634 union sctp_sockstore *raddr = (union sctp_sockstore *)addr; 12635 12636 switch (raddr->sa.sa_family) { 12637 #ifdef INET 12638 case AF_INET: 12639 if (raddr->sin.sin_len != sizeof(struct sockaddr_in)) { 12640 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12641 error = EINVAL; 12642 goto out_unlocked; 12643 } 12644 port = raddr->sin.sin_port; 12645 break; 12646 #endif 12647 #ifdef INET6 12648 case AF_INET6: 12649 if (raddr->sin6.sin6_len != sizeof(struct sockaddr_in6)) { 12650 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12651 error = EINVAL; 12652 goto out_unlocked; 12653 } 12654 port = raddr->sin6.sin6_port; 12655 break; 12656 #endif 12657 default: 12658 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAFNOSUPPORT); 12659 error = EAFNOSUPPORT; 12660 goto out_unlocked; 12661 } 12662 } else 12663 port = 0; 12664 12665 if (srcv) { 12666 sinfo_flags = srcv->sinfo_flags; 12667 sinfo_assoc_id = srcv->sinfo_assoc_id; 12668 if (INVALID_SINFO_FLAG(sinfo_flags) || 12669 PR_SCTP_INVALID_POLICY(sinfo_flags)) { 12670 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12671 error = EINVAL; 12672 goto out_unlocked; 12673 } 12674 if (srcv->sinfo_flags) 12675 SCTP_STAT_INCR(sctps_sends_with_flags); 12676 } else { 12677 sinfo_flags = inp->def_send.sinfo_flags; 12678 sinfo_assoc_id = inp->def_send.sinfo_assoc_id; 12679 } 12680 if (flags & MSG_EOR) { 12681 sinfo_flags |= SCTP_EOR; 12682 } 12683 if (flags & MSG_EOF) { 12684 sinfo_flags |= SCTP_EOF; 12685 } 12686 if (sinfo_flags & SCTP_SENDALL) { 12687 /* its a sendall */ 12688 error = sctp_sendall(inp, uio, top, srcv); 12689 top = NULL; 12690 goto out_unlocked; 12691 } 12692 if ((sinfo_flags & SCTP_ADDR_OVER) && (addr == NULL)) { 12693 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12694 error = EINVAL; 12695 goto out_unlocked; 12696 } 12697 /* now we must find the assoc */ 12698 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) || 12699 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 12700 SCTP_INP_RLOCK(inp); 12701 stcb = LIST_FIRST(&inp->sctp_asoc_list); 12702 if (stcb) { 12703 SCTP_TCB_LOCK(stcb); 12704 hold_tcblock = 1; 12705 } 12706 SCTP_INP_RUNLOCK(inp); 12707 } else if (sinfo_assoc_id) { 12708 stcb = sctp_findassociation_ep_asocid(inp, sinfo_assoc_id, 1); 12709 if (stcb != NULL) { 12710 hold_tcblock = 1; 12711 } 12712 } else if (addr) { 12713 /*- 12714 * Since we did not use findep we must 12715 * increment it, and if we don't find a tcb 12716 * decrement it. 12717 */ 12718 SCTP_INP_WLOCK(inp); 12719 SCTP_INP_INCR_REF(inp); 12720 SCTP_INP_WUNLOCK(inp); 12721 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12722 if (stcb == NULL) { 12723 SCTP_INP_WLOCK(inp); 12724 SCTP_INP_DECR_REF(inp); 12725 SCTP_INP_WUNLOCK(inp); 12726 } else { 12727 hold_tcblock = 1; 12728 } 12729 } 12730 if ((stcb == NULL) && (addr)) { 12731 /* Possible implicit send? */ 12732 SCTP_ASOC_CREATE_LOCK(inp); 12733 create_lock_applied = 1; 12734 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 12735 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 12736 /* Should I really unlock ? */ 12737 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12738 error = EINVAL; 12739 goto out_unlocked; 12740 12741 } 12742 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 12743 (addr->sa_family == AF_INET6)) { 12744 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12745 error = EINVAL; 12746 goto out_unlocked; 12747 } 12748 SCTP_INP_WLOCK(inp); 12749 SCTP_INP_INCR_REF(inp); 12750 SCTP_INP_WUNLOCK(inp); 12751 /* With the lock applied look again */ 12752 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12753 #if defined(INET) || defined(INET6) 12754 if ((stcb == NULL) && (control != NULL) && (port > 0)) { 12755 stcb = sctp_findassociation_cmsgs(&t_inp, port, control, &net, &error); 12756 } 12757 #endif 12758 if (stcb == NULL) { 12759 SCTP_INP_WLOCK(inp); 12760 SCTP_INP_DECR_REF(inp); 12761 SCTP_INP_WUNLOCK(inp); 12762 } else { 12763 hold_tcblock = 1; 12764 } 12765 if (error) { 12766 goto out_unlocked; 12767 } 12768 if (t_inp != inp) { 12769 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12770 error = ENOTCONN; 12771 goto out_unlocked; 12772 } 12773 } 12774 if (stcb == NULL) { 12775 if (addr == NULL) { 12776 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12777 error = ENOENT; 12778 goto out_unlocked; 12779 } else { 12780 /* We must go ahead and start the INIT process */ 12781 uint32_t vrf_id; 12782 12783 if ((sinfo_flags & SCTP_ABORT) || 12784 ((sinfo_flags & SCTP_EOF) && (sndlen == 0))) { 12785 /*- 12786 * User asks to abort a non-existant assoc, 12787 * or EOF a non-existant assoc with no data 12788 */ 12789 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12790 error = ENOENT; 12791 goto out_unlocked; 12792 } 12793 /* get an asoc/stcb struct */ 12794 vrf_id = inp->def_vrf_id; 12795 #ifdef INVARIANTS 12796 if (create_lock_applied == 0) { 12797 panic("Error, should hold create lock and I don't?"); 12798 } 12799 #endif 12800 stcb = sctp_aloc_assoc(inp, addr, &error, 0, vrf_id, 12801 inp->sctp_ep.pre_open_stream_count, 12802 inp->sctp_ep.port, 12803 p, 12804 SCTP_INITIALIZE_AUTH_PARAMS); 12805 if (stcb == NULL) { 12806 /* Error is setup for us in the call */ 12807 goto out_unlocked; 12808 } 12809 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 12810 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 12811 /* 12812 * Set the connected flag so we can queue 12813 * data 12814 */ 12815 soisconnecting(so); 12816 } 12817 hold_tcblock = 1; 12818 if (create_lock_applied) { 12819 SCTP_ASOC_CREATE_UNLOCK(inp); 12820 create_lock_applied = 0; 12821 } else { 12822 SCTP_PRINTF("Huh-3? create lock should have been on??\n"); 12823 } 12824 /* 12825 * Turn on queue only flag to prevent data from 12826 * being sent 12827 */ 12828 queue_only = 1; 12829 asoc = &stcb->asoc; 12830 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 12831 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 12832 12833 if (control) { 12834 if (sctp_process_cmsgs_for_init(stcb, control, &error)) { 12835 sctp_free_assoc(inp, stcb, SCTP_PCBFREE_FORCE, 12836 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5); 12837 hold_tcblock = 0; 12838 stcb = NULL; 12839 goto out_unlocked; 12840 } 12841 } 12842 /* out with the INIT */ 12843 queue_only_for_init = 1; 12844 /*- 12845 * we may want to dig in after this call and adjust the MTU 12846 * value. It defaulted to 1500 (constant) but the ro 12847 * structure may now have an update and thus we may need to 12848 * change it BEFORE we append the message. 12849 */ 12850 } 12851 } else 12852 asoc = &stcb->asoc; 12853 if (srcv == NULL) { 12854 srcv = (struct sctp_sndrcvinfo *)&asoc->def_send; 12855 sinfo_flags = srcv->sinfo_flags; 12856 if (flags & MSG_EOR) { 12857 sinfo_flags |= SCTP_EOR; 12858 } 12859 if (flags & MSG_EOF) { 12860 sinfo_flags |= SCTP_EOF; 12861 } 12862 } 12863 if (sinfo_flags & SCTP_ADDR_OVER) { 12864 if (addr) 12865 net = sctp_findnet(stcb, addr); 12866 else 12867 net = NULL; 12868 if ((net == NULL) || 12869 ((port != 0) && (port != stcb->rport))) { 12870 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12871 error = EINVAL; 12872 goto out_unlocked; 12873 } 12874 } else { 12875 if (stcb->asoc.alternate) { 12876 net = stcb->asoc.alternate; 12877 } else { 12878 net = stcb->asoc.primary_destination; 12879 } 12880 } 12881 atomic_add_int(&stcb->total_sends, 1); 12882 /* Keep the stcb from being freed under our feet */ 12883 atomic_add_int(&asoc->refcnt, 1); 12884 free_cnt_applied = 1; 12885 12886 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NO_FRAGMENT)) { 12887 if (sndlen > (ssize_t)asoc->smallest_mtu) { 12888 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12889 error = EMSGSIZE; 12890 goto out_unlocked; 12891 } 12892 } 12893 if (SCTP_SO_IS_NBIO(so) 12894 || (flags & (MSG_NBIO | MSG_DONTWAIT)) != 0 12895 ) { 12896 non_blocking = 1; 12897 } 12898 /* would we block? */ 12899 if (non_blocking) { 12900 ssize_t amount; 12901 12902 if (hold_tcblock == 0) { 12903 SCTP_TCB_LOCK(stcb); 12904 hold_tcblock = 1; 12905 } 12906 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 12907 if (user_marks_eor == 0) { 12908 amount = sndlen; 12909 } else { 12910 amount = 1; 12911 } 12912 if ((SCTP_SB_LIMIT_SND(so) < (amount + inqueue_bytes + stcb->asoc.sb_send_resv)) || 12913 (stcb->asoc.chunks_on_out_queue >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12914 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EWOULDBLOCK); 12915 if (sndlen > (ssize_t)SCTP_SB_LIMIT_SND(so)) 12916 error = EMSGSIZE; 12917 else 12918 error = EWOULDBLOCK; 12919 goto out_unlocked; 12920 } 12921 stcb->asoc.sb_send_resv += (uint32_t)sndlen; 12922 SCTP_TCB_UNLOCK(stcb); 12923 hold_tcblock = 0; 12924 } else { 12925 atomic_add_int(&stcb->asoc.sb_send_resv, sndlen); 12926 } 12927 local_soresv = sndlen; 12928 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12929 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12930 error = ECONNRESET; 12931 goto out_unlocked; 12932 } 12933 if (create_lock_applied) { 12934 SCTP_ASOC_CREATE_UNLOCK(inp); 12935 create_lock_applied = 0; 12936 } 12937 /* Is the stream no. valid? */ 12938 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 12939 /* Invalid stream number */ 12940 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12941 error = EINVAL; 12942 goto out_unlocked; 12943 } 12944 if ((asoc->strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPEN) && 12945 (asoc->strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPENING)) { 12946 /* 12947 * Can't queue any data while stream reset is underway. 12948 */ 12949 if (asoc->strmout[srcv->sinfo_stream].state > SCTP_STREAM_OPEN) { 12950 error = EAGAIN; 12951 } else { 12952 error = EINVAL; 12953 } 12954 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, error); 12955 goto out_unlocked; 12956 } 12957 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 12958 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 12959 queue_only = 1; 12960 } 12961 /* we are now done with all control */ 12962 if (control) { 12963 sctp_m_freem(control); 12964 control = NULL; 12965 } 12966 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 12967 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12968 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12969 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12970 if (sinfo_flags & SCTP_ABORT) { 12971 ; 12972 } else { 12973 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12974 error = ECONNRESET; 12975 goto out_unlocked; 12976 } 12977 } 12978 /* Ok, we will attempt a msgsnd :> */ 12979 if (p) { 12980 p->td_ru.ru_msgsnd++; 12981 } 12982 /* Are we aborting? */ 12983 if (sinfo_flags & SCTP_ABORT) { 12984 struct mbuf *mm; 12985 ssize_t tot_demand, tot_out = 0, max_out; 12986 12987 SCTP_STAT_INCR(sctps_sends_with_abort); 12988 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 12989 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 12990 /* It has to be up before we abort */ 12991 /* how big is the user initiated abort? */ 12992 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12993 error = EINVAL; 12994 goto out; 12995 } 12996 if (hold_tcblock) { 12997 SCTP_TCB_UNLOCK(stcb); 12998 hold_tcblock = 0; 12999 } 13000 if (top) { 13001 struct mbuf *cntm = NULL; 13002 13003 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_WAITOK, 1, MT_DATA); 13004 if (sndlen != 0) { 13005 for (cntm = top; cntm; cntm = SCTP_BUF_NEXT(cntm)) { 13006 tot_out += SCTP_BUF_LEN(cntm); 13007 } 13008 } 13009 } else { 13010 /* Must fit in a MTU */ 13011 tot_out = sndlen; 13012 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 13013 if (tot_demand > SCTP_DEFAULT_ADD_MORE) { 13014 /* To big */ 13015 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 13016 error = EMSGSIZE; 13017 goto out; 13018 } 13019 mm = sctp_get_mbuf_for_msg((unsigned int)tot_demand, 0, M_WAITOK, 1, MT_DATA); 13020 } 13021 if (mm == NULL) { 13022 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 13023 error = ENOMEM; 13024 goto out; 13025 } 13026 max_out = asoc->smallest_mtu - sizeof(struct sctp_paramhdr); 13027 max_out -= sizeof(struct sctp_abort_msg); 13028 if (tot_out > max_out) { 13029 tot_out = max_out; 13030 } 13031 if (mm) { 13032 struct sctp_paramhdr *ph; 13033 13034 /* now move forward the data pointer */ 13035 ph = mtod(mm, struct sctp_paramhdr *); 13036 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 13037 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + tot_out)); 13038 ph++; 13039 SCTP_BUF_LEN(mm) = (int)(tot_out + sizeof(struct sctp_paramhdr)); 13040 if (top == NULL) { 13041 error = uiomove((caddr_t)ph, (int)tot_out, uio); 13042 if (error) { 13043 /*- 13044 * Here if we can't get his data we 13045 * still abort we just don't get to 13046 * send the users note :-0 13047 */ 13048 sctp_m_freem(mm); 13049 mm = NULL; 13050 } 13051 } else { 13052 if (sndlen != 0) { 13053 SCTP_BUF_NEXT(mm) = top; 13054 } 13055 } 13056 } 13057 if (hold_tcblock == 0) { 13058 SCTP_TCB_LOCK(stcb); 13059 } 13060 atomic_add_int(&stcb->asoc.refcnt, -1); 13061 free_cnt_applied = 0; 13062 /* release this lock, otherwise we hang on ourselves */ 13063 sctp_abort_an_association(stcb->sctp_ep, stcb, mm, SCTP_SO_LOCKED); 13064 /* now relock the stcb so everything is sane */ 13065 hold_tcblock = 0; 13066 stcb = NULL; 13067 /* 13068 * In this case top is already chained to mm avoid double 13069 * free, since we free it below if top != NULL and driver 13070 * would free it after sending the packet out 13071 */ 13072 if (sndlen != 0) { 13073 top = NULL; 13074 } 13075 goto out_unlocked; 13076 } 13077 /* Calculate the maximum we can send */ 13078 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13079 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13080 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13081 } else { 13082 max_len = 0; 13083 } 13084 if (hold_tcblock) { 13085 SCTP_TCB_UNLOCK(stcb); 13086 hold_tcblock = 0; 13087 } 13088 if (asoc->strmout == NULL) { 13089 /* huh? software error */ 13090 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 13091 error = EFAULT; 13092 goto out_unlocked; 13093 } 13094 13095 /* Unless E_EOR mode is on, we must make a send FIT in one call. */ 13096 if ((user_marks_eor == 0) && 13097 (sndlen > (ssize_t)SCTP_SB_LIMIT_SND(stcb->sctp_socket))) { 13098 /* It will NEVER fit */ 13099 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 13100 error = EMSGSIZE; 13101 goto out_unlocked; 13102 } 13103 if ((uio == NULL) && user_marks_eor) { 13104 /*- 13105 * We do not support eeor mode for 13106 * sending with mbuf chains (like sendfile). 13107 */ 13108 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13109 error = EINVAL; 13110 goto out_unlocked; 13111 } 13112 13113 if (user_marks_eor) { 13114 local_add_more = (ssize_t)min(SCTP_SB_LIMIT_SND(so), SCTP_BASE_SYSCTL(sctp_add_more_threshold)); 13115 } else { 13116 /*- 13117 * For non-eeor the whole message must fit in 13118 * the socket send buffer. 13119 */ 13120 local_add_more = sndlen; 13121 } 13122 len = 0; 13123 if (non_blocking) { 13124 goto skip_preblock; 13125 } 13126 if (((max_len <= local_add_more) && 13127 ((ssize_t)SCTP_SB_LIMIT_SND(so) >= local_add_more)) || 13128 (max_len == 0) || 13129 ((stcb->asoc.chunks_on_out_queue + stcb->asoc.stream_queue_cnt) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13130 /* No room right now ! */ 13131 SOCKBUF_LOCK(&so->so_snd); 13132 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13133 while ((SCTP_SB_LIMIT_SND(so) < (inqueue_bytes + local_add_more)) || 13134 ((stcb->asoc.stream_queue_cnt + stcb->asoc.chunks_on_out_queue) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13135 SCTPDBG(SCTP_DEBUG_OUTPUT1, "pre_block limit:%u <(inq:%d + %zd) || (%d+%d > %d)\n", 13136 (unsigned int)SCTP_SB_LIMIT_SND(so), 13137 inqueue_bytes, 13138 local_add_more, 13139 stcb->asoc.stream_queue_cnt, 13140 stcb->asoc.chunks_on_out_queue, 13141 SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)); 13142 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13143 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA, asoc, sndlen); 13144 } 13145 be.error = 0; 13146 stcb->block_entry = &be; 13147 error = sbwait(&so->so_snd); 13148 stcb->block_entry = NULL; 13149 if (error || so->so_error || be.error) { 13150 if (error == 0) { 13151 if (so->so_error) 13152 error = so->so_error; 13153 if (be.error) { 13154 error = be.error; 13155 } 13156 } 13157 SOCKBUF_UNLOCK(&so->so_snd); 13158 goto out_unlocked; 13159 } 13160 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13161 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13162 asoc, stcb->asoc.total_output_queue_size); 13163 } 13164 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13165 SOCKBUF_UNLOCK(&so->so_snd); 13166 goto out_unlocked; 13167 } 13168 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13169 } 13170 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13171 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13172 } else { 13173 max_len = 0; 13174 } 13175 SOCKBUF_UNLOCK(&so->so_snd); 13176 } 13177 13178 skip_preblock: 13179 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13180 goto out_unlocked; 13181 } 13182 /* 13183 * sndlen covers for mbuf case uio_resid covers for the non-mbuf 13184 * case NOTE: uio will be null when top/mbuf is passed 13185 */ 13186 if (sndlen == 0) { 13187 if (sinfo_flags & SCTP_EOF) { 13188 got_all_of_the_send = 1; 13189 goto dataless_eof; 13190 } else { 13191 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13192 error = EINVAL; 13193 goto out; 13194 } 13195 } 13196 if (top == NULL) { 13197 struct sctp_stream_queue_pending *sp; 13198 struct sctp_stream_out *strm; 13199 uint32_t sndout; 13200 13201 SCTP_TCB_SEND_LOCK(stcb); 13202 if ((asoc->stream_locked) && 13203 (asoc->stream_locked_on != srcv->sinfo_stream)) { 13204 SCTP_TCB_SEND_UNLOCK(stcb); 13205 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13206 error = EINVAL; 13207 goto out; 13208 } 13209 SCTP_TCB_SEND_UNLOCK(stcb); 13210 13211 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 13212 if (strm->last_msg_incomplete == 0) { 13213 do_a_copy_in: 13214 sp = sctp_copy_it_in(stcb, asoc, srcv, uio, net, max_len, user_marks_eor, &error); 13215 if (error) { 13216 goto out; 13217 } 13218 SCTP_TCB_SEND_LOCK(stcb); 13219 if (sp->msg_is_complete) { 13220 strm->last_msg_incomplete = 0; 13221 asoc->stream_locked = 0; 13222 } else { 13223 /* 13224 * Just got locked to this guy in case of an 13225 * interrupt. 13226 */ 13227 strm->last_msg_incomplete = 1; 13228 if (stcb->asoc.idata_supported == 0) { 13229 asoc->stream_locked = 1; 13230 asoc->stream_locked_on = srcv->sinfo_stream; 13231 } 13232 sp->sender_all_done = 0; 13233 } 13234 sctp_snd_sb_alloc(stcb, sp->length); 13235 atomic_add_int(&asoc->stream_queue_cnt, 1); 13236 if (sinfo_flags & SCTP_UNORDERED) { 13237 SCTP_STAT_INCR(sctps_sends_with_unord); 13238 } 13239 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 13240 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, asoc, strm, sp, 1); 13241 SCTP_TCB_SEND_UNLOCK(stcb); 13242 } else { 13243 SCTP_TCB_SEND_LOCK(stcb); 13244 sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead); 13245 SCTP_TCB_SEND_UNLOCK(stcb); 13246 if (sp == NULL) { 13247 /* ???? Huh ??? last msg is gone */ 13248 #ifdef INVARIANTS 13249 panic("Warning: Last msg marked incomplete, yet nothing left?"); 13250 #else 13251 SCTP_PRINTF("Warning: Last msg marked incomplete, yet nothing left?\n"); 13252 strm->last_msg_incomplete = 0; 13253 #endif 13254 goto do_a_copy_in; 13255 13256 } 13257 } 13258 while (uio->uio_resid > 0) { 13259 /* How much room do we have? */ 13260 struct mbuf *new_tail, *mm; 13261 13262 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13263 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) 13264 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13265 else 13266 max_len = 0; 13267 13268 if ((max_len > (ssize_t)SCTP_BASE_SYSCTL(sctp_add_more_threshold)) || 13269 (max_len && (SCTP_SB_LIMIT_SND(so) < SCTP_BASE_SYSCTL(sctp_add_more_threshold))) || 13270 (uio->uio_resid && (uio->uio_resid <= max_len))) { 13271 sndout = 0; 13272 new_tail = NULL; 13273 if (hold_tcblock) { 13274 SCTP_TCB_UNLOCK(stcb); 13275 hold_tcblock = 0; 13276 } 13277 mm = sctp_copy_resume(uio, (int)max_len, user_marks_eor, &error, &sndout, &new_tail); 13278 if ((mm == NULL) || error) { 13279 if (mm) { 13280 sctp_m_freem(mm); 13281 } 13282 goto out; 13283 } 13284 /* Update the mbuf and count */ 13285 SCTP_TCB_SEND_LOCK(stcb); 13286 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13287 /* 13288 * we need to get out. Peer probably 13289 * aborted. 13290 */ 13291 sctp_m_freem(mm); 13292 if (stcb->asoc.state & SCTP_PCB_FLAGS_WAS_ABORTED) { 13293 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 13294 error = ECONNRESET; 13295 } 13296 SCTP_TCB_SEND_UNLOCK(stcb); 13297 goto out; 13298 } 13299 if (sp->tail_mbuf) { 13300 /* tack it to the end */ 13301 SCTP_BUF_NEXT(sp->tail_mbuf) = mm; 13302 sp->tail_mbuf = new_tail; 13303 } else { 13304 /* A stolen mbuf */ 13305 sp->data = mm; 13306 sp->tail_mbuf = new_tail; 13307 } 13308 sctp_snd_sb_alloc(stcb, sndout); 13309 atomic_add_int(&sp->length, sndout); 13310 len += sndout; 13311 if (sinfo_flags & SCTP_SACK_IMMEDIATELY) { 13312 sp->sinfo_flags |= SCTP_SACK_IMMEDIATELY; 13313 } 13314 13315 /* Did we reach EOR? */ 13316 if ((uio->uio_resid == 0) && 13317 ((user_marks_eor == 0) || 13318 (sinfo_flags & SCTP_EOF) || 13319 (user_marks_eor && (sinfo_flags & SCTP_EOR)))) { 13320 sp->msg_is_complete = 1; 13321 } else { 13322 sp->msg_is_complete = 0; 13323 } 13324 SCTP_TCB_SEND_UNLOCK(stcb); 13325 } 13326 if (uio->uio_resid == 0) { 13327 /* got it all? */ 13328 continue; 13329 } 13330 /* PR-SCTP? */ 13331 if ((asoc->prsctp_supported) && (asoc->sent_queue_cnt_removeable > 0)) { 13332 /* 13333 * This is ugly but we must assure locking 13334 * order 13335 */ 13336 if (hold_tcblock == 0) { 13337 SCTP_TCB_LOCK(stcb); 13338 hold_tcblock = 1; 13339 } 13340 sctp_prune_prsctp(stcb, asoc, srcv, (int)sndlen); 13341 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13342 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) 13343 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13344 else 13345 max_len = 0; 13346 if (max_len > 0) { 13347 continue; 13348 } 13349 SCTP_TCB_UNLOCK(stcb); 13350 hold_tcblock = 0; 13351 } 13352 /* wait for space now */ 13353 if (non_blocking) { 13354 /* Non-blocking io in place out */ 13355 goto skip_out_eof; 13356 } 13357 /* What about the INIT, send it maybe */ 13358 if (queue_only_for_init) { 13359 if (hold_tcblock == 0) { 13360 SCTP_TCB_LOCK(stcb); 13361 hold_tcblock = 1; 13362 } 13363 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13364 /* a collision took us forward? */ 13365 queue_only = 0; 13366 } else { 13367 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13368 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 13369 queue_only = 1; 13370 } 13371 } 13372 if ((net->flight_size > net->cwnd) && 13373 (asoc->sctp_cmt_on_off == 0)) { 13374 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13375 queue_only = 1; 13376 } else if (asoc->ifp_had_enobuf) { 13377 SCTP_STAT_INCR(sctps_ifnomemqueued); 13378 if (net->flight_size > (2 * net->mtu)) { 13379 queue_only = 1; 13380 } 13381 asoc->ifp_had_enobuf = 0; 13382 } 13383 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 13384 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13385 (stcb->asoc.total_flight > 0) && 13386 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13387 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13388 13389 /*- 13390 * Ok, Nagle is set on and we have data outstanding. 13391 * Don't send anything and let SACKs drive out the 13392 * data unless we have a "full" segment to send. 13393 */ 13394 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13395 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13396 } 13397 SCTP_STAT_INCR(sctps_naglequeued); 13398 nagle_applies = 1; 13399 } else { 13400 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13401 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13402 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13403 } 13404 SCTP_STAT_INCR(sctps_naglesent); 13405 nagle_applies = 0; 13406 } 13407 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13408 13409 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13410 nagle_applies, un_sent); 13411 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13412 stcb->asoc.total_flight, 13413 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13414 } 13415 if (queue_only_for_init) 13416 queue_only_for_init = 0; 13417 if ((queue_only == 0) && (nagle_applies == 0)) { 13418 /*- 13419 * need to start chunk output 13420 * before blocking.. note that if 13421 * a lock is already applied, then 13422 * the input via the net is happening 13423 * and I don't need to start output :-D 13424 */ 13425 if (hold_tcblock == 0) { 13426 if (SCTP_TCB_TRYLOCK(stcb)) { 13427 hold_tcblock = 1; 13428 sctp_chunk_output(inp, 13429 stcb, 13430 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13431 } 13432 } else { 13433 sctp_chunk_output(inp, 13434 stcb, 13435 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13436 } 13437 } 13438 if (hold_tcblock == 1) { 13439 SCTP_TCB_UNLOCK(stcb); 13440 hold_tcblock = 0; 13441 } 13442 SOCKBUF_LOCK(&so->so_snd); 13443 /*- 13444 * This is a bit strange, but I think it will 13445 * work. The total_output_queue_size is locked and 13446 * protected by the TCB_LOCK, which we just released. 13447 * There is a race that can occur between releasing it 13448 * above, and me getting the socket lock, where sacks 13449 * come in but we have not put the SB_WAIT on the 13450 * so_snd buffer to get the wakeup. After the LOCK 13451 * is applied the sack_processing will also need to 13452 * LOCK the so->so_snd to do the actual sowwakeup(). So 13453 * once we have the socket buffer lock if we recheck the 13454 * size we KNOW we will get to sleep safely with the 13455 * wakeup flag in place. 13456 */ 13457 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13458 if (SCTP_SB_LIMIT_SND(so) <= (inqueue_bytes + 13459 min(SCTP_BASE_SYSCTL(sctp_add_more_threshold), SCTP_SB_LIMIT_SND(so)))) { 13460 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13461 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 13462 asoc, uio->uio_resid); 13463 } 13464 be.error = 0; 13465 stcb->block_entry = &be; 13466 error = sbwait(&so->so_snd); 13467 stcb->block_entry = NULL; 13468 13469 if (error || so->so_error || be.error) { 13470 if (error == 0) { 13471 if (so->so_error) 13472 error = so->so_error; 13473 if (be.error) { 13474 error = be.error; 13475 } 13476 } 13477 SOCKBUF_UNLOCK(&so->so_snd); 13478 goto out_unlocked; 13479 } 13480 13481 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13482 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13483 asoc, stcb->asoc.total_output_queue_size); 13484 } 13485 } 13486 SOCKBUF_UNLOCK(&so->so_snd); 13487 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13488 goto out_unlocked; 13489 } 13490 } 13491 SCTP_TCB_SEND_LOCK(stcb); 13492 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13493 SCTP_TCB_SEND_UNLOCK(stcb); 13494 goto out_unlocked; 13495 } 13496 if (sp) { 13497 if (sp->msg_is_complete == 0) { 13498 strm->last_msg_incomplete = 1; 13499 if (stcb->asoc.idata_supported == 0) { 13500 asoc->stream_locked = 1; 13501 asoc->stream_locked_on = srcv->sinfo_stream; 13502 } 13503 } else { 13504 sp->sender_all_done = 1; 13505 strm->last_msg_incomplete = 0; 13506 asoc->stream_locked = 0; 13507 } 13508 } else { 13509 SCTP_PRINTF("Huh no sp TSNH?\n"); 13510 strm->last_msg_incomplete = 0; 13511 asoc->stream_locked = 0; 13512 } 13513 SCTP_TCB_SEND_UNLOCK(stcb); 13514 if (uio->uio_resid == 0) { 13515 got_all_of_the_send = 1; 13516 } 13517 } else { 13518 /* We send in a 0, since we do NOT have any locks */ 13519 error = sctp_msg_append(stcb, net, top, srcv, 0); 13520 top = NULL; 13521 if (sinfo_flags & SCTP_EOF) { 13522 /* 13523 * This should only happen for Panda for the mbuf 13524 * send case, which does NOT yet support EEOR mode. 13525 * Thus, we can just set this flag to do the proper 13526 * EOF handling. 13527 */ 13528 got_all_of_the_send = 1; 13529 } 13530 } 13531 if (error) { 13532 goto out; 13533 } 13534 dataless_eof: 13535 /* EOF thing ? */ 13536 if ((sinfo_flags & SCTP_EOF) && 13537 (got_all_of_the_send == 1)) { 13538 SCTP_STAT_INCR(sctps_sends_with_eof); 13539 error = 0; 13540 if (hold_tcblock == 0) { 13541 SCTP_TCB_LOCK(stcb); 13542 hold_tcblock = 1; 13543 } 13544 if (TAILQ_EMPTY(&asoc->send_queue) && 13545 TAILQ_EMPTY(&asoc->sent_queue) && 13546 sctp_is_there_unsent_data(stcb, SCTP_SO_LOCKED) == 0) { 13547 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13548 goto abort_anyway; 13549 } 13550 /* there is nothing queued to send, so I'm done... */ 13551 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 13552 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13553 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13554 struct sctp_nets *netp; 13555 13556 /* only send SHUTDOWN the first time through */ 13557 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13558 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 13559 } 13560 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT); 13561 sctp_stop_timers_for_shutdown(stcb); 13562 if (stcb->asoc.alternate) { 13563 netp = stcb->asoc.alternate; 13564 } else { 13565 netp = stcb->asoc.primary_destination; 13566 } 13567 sctp_send_shutdown(stcb, netp); 13568 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 13569 netp); 13570 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13571 asoc->primary_destination); 13572 } 13573 } else { 13574 /*- 13575 * we still got (or just got) data to send, so set 13576 * SHUTDOWN_PENDING 13577 */ 13578 /*- 13579 * XXX sockets draft says that SCTP_EOF should be 13580 * sent with no data. currently, we will allow user 13581 * data to be sent first and move to 13582 * SHUTDOWN-PENDING 13583 */ 13584 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 13585 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13586 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13587 if (hold_tcblock == 0) { 13588 SCTP_TCB_LOCK(stcb); 13589 hold_tcblock = 1; 13590 } 13591 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13592 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT); 13593 } 13594 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 13595 if (TAILQ_EMPTY(&asoc->send_queue) && 13596 TAILQ_EMPTY(&asoc->sent_queue) && 13597 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 13598 struct mbuf *op_err; 13599 char msg[SCTP_DIAG_INFO_LEN]; 13600 13601 abort_anyway: 13602 if (free_cnt_applied) { 13603 atomic_add_int(&stcb->asoc.refcnt, -1); 13604 free_cnt_applied = 0; 13605 } 13606 snprintf(msg, sizeof(msg), 13607 "%s:%d at %s", __FILE__, __LINE__, __func__); 13608 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 13609 msg); 13610 sctp_abort_an_association(stcb->sctp_ep, stcb, 13611 op_err, SCTP_SO_LOCKED); 13612 /* 13613 * now relock the stcb so everything 13614 * is sane 13615 */ 13616 hold_tcblock = 0; 13617 stcb = NULL; 13618 goto out; 13619 } 13620 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13621 asoc->primary_destination); 13622 sctp_feature_off(inp, SCTP_PCB_FLAGS_NODELAY); 13623 } 13624 } 13625 } 13626 skip_out_eof: 13627 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 13628 some_on_control = 1; 13629 } 13630 if (queue_only_for_init) { 13631 if (hold_tcblock == 0) { 13632 SCTP_TCB_LOCK(stcb); 13633 hold_tcblock = 1; 13634 } 13635 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13636 /* a collision took us forward? */ 13637 queue_only = 0; 13638 } else { 13639 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13640 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 13641 queue_only = 1; 13642 } 13643 } 13644 if ((net->flight_size > net->cwnd) && 13645 (stcb->asoc.sctp_cmt_on_off == 0)) { 13646 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13647 queue_only = 1; 13648 } else if (asoc->ifp_had_enobuf) { 13649 SCTP_STAT_INCR(sctps_ifnomemqueued); 13650 if (net->flight_size > (2 * net->mtu)) { 13651 queue_only = 1; 13652 } 13653 asoc->ifp_had_enobuf = 0; 13654 } 13655 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 13656 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13657 (stcb->asoc.total_flight > 0) && 13658 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13659 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13660 /*- 13661 * Ok, Nagle is set on and we have data outstanding. 13662 * Don't send anything and let SACKs drive out the 13663 * data unless wen have a "full" segment to send. 13664 */ 13665 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13666 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13667 } 13668 SCTP_STAT_INCR(sctps_naglequeued); 13669 nagle_applies = 1; 13670 } else { 13671 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13672 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13673 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13674 } 13675 SCTP_STAT_INCR(sctps_naglesent); 13676 nagle_applies = 0; 13677 } 13678 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13679 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13680 nagle_applies, un_sent); 13681 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13682 stcb->asoc.total_flight, 13683 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13684 } 13685 if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) { 13686 /* we can attempt to send too. */ 13687 if (hold_tcblock == 0) { 13688 /* 13689 * If there is activity recv'ing sacks no need to 13690 * send 13691 */ 13692 if (SCTP_TCB_TRYLOCK(stcb)) { 13693 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13694 hold_tcblock = 1; 13695 } 13696 } else { 13697 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13698 } 13699 } else if ((queue_only == 0) && 13700 (stcb->asoc.peers_rwnd == 0) && 13701 (stcb->asoc.total_flight == 0)) { 13702 /* We get to have a probe outstanding */ 13703 if (hold_tcblock == 0) { 13704 hold_tcblock = 1; 13705 SCTP_TCB_LOCK(stcb); 13706 } 13707 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13708 } else if (some_on_control) { 13709 int num_out, reason, frag_point; 13710 13711 /* Here we do control only */ 13712 if (hold_tcblock == 0) { 13713 hold_tcblock = 1; 13714 SCTP_TCB_LOCK(stcb); 13715 } 13716 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 13717 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 13718 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_LOCKED); 13719 } 13720 SCTPDBG(SCTP_DEBUG_OUTPUT1, "USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d err:%d\n", 13721 queue_only, stcb->asoc.peers_rwnd, un_sent, 13722 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue, 13723 stcb->asoc.total_output_queue_size, error); 13724 13725 out: 13726 out_unlocked: 13727 13728 if (local_soresv && stcb) { 13729 atomic_subtract_int(&stcb->asoc.sb_send_resv, sndlen); 13730 } 13731 if (create_lock_applied) { 13732 SCTP_ASOC_CREATE_UNLOCK(inp); 13733 } 13734 if ((stcb) && hold_tcblock) { 13735 SCTP_TCB_UNLOCK(stcb); 13736 } 13737 if (stcb && free_cnt_applied) { 13738 atomic_add_int(&stcb->asoc.refcnt, -1); 13739 } 13740 #ifdef INVARIANTS 13741 if (stcb) { 13742 if (mtx_owned(&stcb->tcb_mtx)) { 13743 panic("Leaving with tcb mtx owned?"); 13744 } 13745 if (mtx_owned(&stcb->tcb_send_mtx)) { 13746 panic("Leaving with tcb send mtx owned?"); 13747 } 13748 } 13749 #endif 13750 if (top) { 13751 sctp_m_freem(top); 13752 } 13753 if (control) { 13754 sctp_m_freem(control); 13755 } 13756 return (error); 13757 } 13758 13759 13760 /* 13761 * generate an AUTHentication chunk, if required 13762 */ 13763 struct mbuf * 13764 sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end, 13765 struct sctp_auth_chunk **auth_ret, uint32_t *offset, 13766 struct sctp_tcb *stcb, uint8_t chunk) 13767 { 13768 struct mbuf *m_auth; 13769 struct sctp_auth_chunk *auth; 13770 int chunk_len; 13771 struct mbuf *cn; 13772 13773 if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) || 13774 (stcb == NULL)) 13775 return (m); 13776 13777 if (stcb->asoc.auth_supported == 0) { 13778 return (m); 13779 } 13780 /* does the requested chunk require auth? */ 13781 if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) { 13782 return (m); 13783 } 13784 m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_NOWAIT, 1, MT_HEADER); 13785 if (m_auth == NULL) { 13786 /* no mbuf's */ 13787 return (m); 13788 } 13789 /* reserve some space if this will be the first mbuf */ 13790 if (m == NULL) 13791 SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD); 13792 /* fill in the AUTH chunk details */ 13793 auth = mtod(m_auth, struct sctp_auth_chunk *); 13794 memset(auth, 0, sizeof(*auth)); 13795 auth->ch.chunk_type = SCTP_AUTHENTICATION; 13796 auth->ch.chunk_flags = 0; 13797 chunk_len = sizeof(*auth) + 13798 sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id); 13799 auth->ch.chunk_length = htons(chunk_len); 13800 auth->hmac_id = htons(stcb->asoc.peer_hmac_id); 13801 /* key id and hmac digest will be computed and filled in upon send */ 13802 13803 /* save the offset where the auth was inserted into the chain */ 13804 *offset = 0; 13805 for (cn = m; cn; cn = SCTP_BUF_NEXT(cn)) { 13806 *offset += SCTP_BUF_LEN(cn); 13807 } 13808 13809 /* update length and return pointer to the auth chunk */ 13810 SCTP_BUF_LEN(m_auth) = chunk_len; 13811 m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0); 13812 if (auth_ret != NULL) 13813 *auth_ret = auth; 13814 13815 return (m); 13816 } 13817 13818 #ifdef INET6 13819 int 13820 sctp_v6src_match_nexthop(struct sockaddr_in6 *src6, sctp_route_t *ro) 13821 { 13822 struct nd_prefix *pfx = NULL; 13823 struct nd_pfxrouter *pfxrtr = NULL; 13824 struct sockaddr_in6 gw6; 13825 13826 if (ro == NULL || ro->ro_rt == NULL || src6->sin6_family != AF_INET6) 13827 return (0); 13828 13829 /* get prefix entry of address */ 13830 ND6_RLOCK(); 13831 LIST_FOREACH(pfx, &MODULE_GLOBAL(nd_prefix), ndpr_entry) { 13832 if (pfx->ndpr_stateflags & NDPRF_DETACHED) 13833 continue; 13834 if (IN6_ARE_MASKED_ADDR_EQUAL(&pfx->ndpr_prefix.sin6_addr, 13835 &src6->sin6_addr, &pfx->ndpr_mask)) 13836 break; 13837 } 13838 /* no prefix entry in the prefix list */ 13839 if (pfx == NULL) { 13840 ND6_RUNLOCK(); 13841 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefix entry for "); 13842 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13843 return (0); 13844 } 13845 13846 SCTPDBG(SCTP_DEBUG_OUTPUT2, "v6src_match_nexthop(), Prefix entry is "); 13847 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13848 13849 /* search installed gateway from prefix entry */ 13850 LIST_FOREACH(pfxrtr, &pfx->ndpr_advrtrs, pfr_entry) { 13851 memset(&gw6, 0, sizeof(struct sockaddr_in6)); 13852 gw6.sin6_family = AF_INET6; 13853 gw6.sin6_len = sizeof(struct sockaddr_in6); 13854 memcpy(&gw6.sin6_addr, &pfxrtr->router->rtaddr, 13855 sizeof(struct in6_addr)); 13856 SCTPDBG(SCTP_DEBUG_OUTPUT2, "prefix router is "); 13857 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&gw6); 13858 SCTPDBG(SCTP_DEBUG_OUTPUT2, "installed router is "); 13859 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway); 13860 if (sctp_cmpaddr((struct sockaddr *)&gw6, ro->ro_rt->rt_gateway)) { 13861 ND6_RUNLOCK(); 13862 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is installed\n"); 13863 return (1); 13864 } 13865 } 13866 ND6_RUNLOCK(); 13867 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is not installed\n"); 13868 return (0); 13869 } 13870 #endif 13871 13872 int 13873 sctp_v4src_match_nexthop(struct sctp_ifa *sifa, sctp_route_t *ro) 13874 { 13875 #ifdef INET 13876 struct sockaddr_in *sin, *mask; 13877 struct ifaddr *ifa; 13878 struct in_addr srcnetaddr, gwnetaddr; 13879 13880 if (ro == NULL || ro->ro_rt == NULL || 13881 sifa->address.sa.sa_family != AF_INET) { 13882 return (0); 13883 } 13884 ifa = (struct ifaddr *)sifa->ifa; 13885 mask = (struct sockaddr_in *)(ifa->ifa_netmask); 13886 sin = &sifa->address.sin; 13887 srcnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13888 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: src address is "); 13889 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 13890 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", srcnetaddr.s_addr); 13891 13892 sin = (struct sockaddr_in *)ro->ro_rt->rt_gateway; 13893 gwnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13894 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: nexthop is "); 13895 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway); 13896 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", gwnetaddr.s_addr); 13897 if (srcnetaddr.s_addr == gwnetaddr.s_addr) { 13898 return (1); 13899 } 13900 #endif 13901 return (0); 13902 } 13903