1 /*- 2 * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * a) Redistributions of source code must retain the above copyright notice, 8 * this list of conditions and the following disclaimer. 9 * 10 * b) Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the distribution. 13 * 14 * c) Neither the name of Cisco Systems, Inc. nor the names of its 15 * contributors may be used to endorse or promote products derived 16 * from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 20 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 28 * THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 /* $KAME: sctp_output.c,v 1.46 2005/03/06 16:04:17 itojun Exp $ */ 32 33 #include <sys/cdefs.h> 34 __FBSDID("$FreeBSD$"); 35 36 #include "opt_ipsec.h" 37 #include "opt_compat.h" 38 #include "opt_inet6.h" 39 #include "opt_inet.h" 40 #include "opt_sctp.h" 41 #include <sys/param.h> 42 #include <sys/systm.h> 43 #include <sys/malloc.h> 44 #include <sys/mbuf.h> 45 #include <sys/domain.h> 46 #include <sys/protosw.h> 47 #include <sys/socket.h> 48 #include <sys/socketvar.h> 49 #include <sys/proc.h> 50 #include <sys/kernel.h> 51 #include <sys/sysctl.h> 52 #include <sys/resourcevar.h> 53 #include <sys/uio.h> 54 #ifdef INET6 55 #include <sys/domain.h> 56 #endif 57 58 #include <sys/limits.h> 59 #include <machine/cpu.h> 60 61 #include <net/if.h> 62 #include <net/if_types.h> 63 64 #include <net/if_var.h> 65 66 #include <net/route.h> 67 68 #include <netinet/in.h> 69 #include <netinet/in_systm.h> 70 #include <netinet/ip.h> 71 #include <netinet/in_pcb.h> 72 #include <netinet/in_var.h> 73 #include <netinet/ip_var.h> 74 75 #ifdef INET6 76 #include <netinet/ip6.h> 77 #include <netinet6/ip6_var.h> 78 #include <netinet6/scope6_var.h> 79 #include <netinet6/nd6.h> 80 81 #include <netinet6/in6_pcb.h> 82 83 #include <netinet/icmp6.h> 84 85 #endif /* INET6 */ 86 87 88 89 #ifndef in6pcb 90 #define in6pcb inpcb 91 #endif 92 93 #ifdef IPSEC 94 #include <netinet6/ipsec.h> 95 #include <netkey/key.h> 96 #endif /* IPSEC */ 97 98 #include <netinet/sctp_os.h> 99 #include <netinet/sctp_var.h> 100 #include <netinet/sctp_header.h> 101 #include <netinet/sctp_pcb.h> 102 #include <netinet/sctputil.h> 103 #include <netinet/sctp_output.h> 104 #include <netinet/sctp_uio.h> 105 #include <netinet/sctputil.h> 106 #include <netinet/sctp_auth.h> 107 #include <netinet/sctp_timer.h> 108 #include <netinet/sctp_asconf.h> 109 #include <netinet/sctp_indata.h> 110 #include <netinet/sctp_bsd_addr.h> 111 112 #ifdef SCTP_DEBUG 113 extern uint32_t sctp_debug_on; 114 115 #endif 116 117 118 119 #define SCTP_MAX_GAPS_INARRAY 4 120 struct sack_track { 121 uint8_t right_edge; /* mergable on the right edge */ 122 uint8_t left_edge; /* mergable on the left edge */ 123 uint8_t num_entries; 124 uint8_t spare; 125 struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY]; 126 }; 127 128 struct sack_track sack_array[256] = { 129 {0, 0, 0, 0, /* 0x00 */ 130 {{0, 0}, 131 {0, 0}, 132 {0, 0}, 133 {0, 0} 134 } 135 }, 136 {1, 0, 1, 0, /* 0x01 */ 137 {{0, 0}, 138 {0, 0}, 139 {0, 0}, 140 {0, 0} 141 } 142 }, 143 {0, 0, 1, 0, /* 0x02 */ 144 {{1, 1}, 145 {0, 0}, 146 {0, 0}, 147 {0, 0} 148 } 149 }, 150 {1, 0, 1, 0, /* 0x03 */ 151 {{0, 1}, 152 {0, 0}, 153 {0, 0}, 154 {0, 0} 155 } 156 }, 157 {0, 0, 1, 0, /* 0x04 */ 158 {{2, 2}, 159 {0, 0}, 160 {0, 0}, 161 {0, 0} 162 } 163 }, 164 {1, 0, 2, 0, /* 0x05 */ 165 {{0, 0}, 166 {2, 2}, 167 {0, 0}, 168 {0, 0} 169 } 170 }, 171 {0, 0, 1, 0, /* 0x06 */ 172 {{1, 2}, 173 {0, 0}, 174 {0, 0}, 175 {0, 0} 176 } 177 }, 178 {1, 0, 1, 0, /* 0x07 */ 179 {{0, 2}, 180 {0, 0}, 181 {0, 0}, 182 {0, 0} 183 } 184 }, 185 {0, 0, 1, 0, /* 0x08 */ 186 {{3, 3}, 187 {0, 0}, 188 {0, 0}, 189 {0, 0} 190 } 191 }, 192 {1, 0, 2, 0, /* 0x09 */ 193 {{0, 0}, 194 {3, 3}, 195 {0, 0}, 196 {0, 0} 197 } 198 }, 199 {0, 0, 2, 0, /* 0x0a */ 200 {{1, 1}, 201 {3, 3}, 202 {0, 0}, 203 {0, 0} 204 } 205 }, 206 {1, 0, 2, 0, /* 0x0b */ 207 {{0, 1}, 208 {3, 3}, 209 {0, 0}, 210 {0, 0} 211 } 212 }, 213 {0, 0, 1, 0, /* 0x0c */ 214 {{2, 3}, 215 {0, 0}, 216 {0, 0}, 217 {0, 0} 218 } 219 }, 220 {1, 0, 2, 0, /* 0x0d */ 221 {{0, 0}, 222 {2, 3}, 223 {0, 0}, 224 {0, 0} 225 } 226 }, 227 {0, 0, 1, 0, /* 0x0e */ 228 {{1, 3}, 229 {0, 0}, 230 {0, 0}, 231 {0, 0} 232 } 233 }, 234 {1, 0, 1, 0, /* 0x0f */ 235 {{0, 3}, 236 {0, 0}, 237 {0, 0}, 238 {0, 0} 239 } 240 }, 241 {0, 0, 1, 0, /* 0x10 */ 242 {{4, 4}, 243 {0, 0}, 244 {0, 0}, 245 {0, 0} 246 } 247 }, 248 {1, 0, 2, 0, /* 0x11 */ 249 {{0, 0}, 250 {4, 4}, 251 {0, 0}, 252 {0, 0} 253 } 254 }, 255 {0, 0, 2, 0, /* 0x12 */ 256 {{1, 1}, 257 {4, 4}, 258 {0, 0}, 259 {0, 0} 260 } 261 }, 262 {1, 0, 2, 0, /* 0x13 */ 263 {{0, 1}, 264 {4, 4}, 265 {0, 0}, 266 {0, 0} 267 } 268 }, 269 {0, 0, 2, 0, /* 0x14 */ 270 {{2, 2}, 271 {4, 4}, 272 {0, 0}, 273 {0, 0} 274 } 275 }, 276 {1, 0, 3, 0, /* 0x15 */ 277 {{0, 0}, 278 {2, 2}, 279 {4, 4}, 280 {0, 0} 281 } 282 }, 283 {0, 0, 2, 0, /* 0x16 */ 284 {{1, 2}, 285 {4, 4}, 286 {0, 0}, 287 {0, 0} 288 } 289 }, 290 {1, 0, 2, 0, /* 0x17 */ 291 {{0, 2}, 292 {4, 4}, 293 {0, 0}, 294 {0, 0} 295 } 296 }, 297 {0, 0, 1, 0, /* 0x18 */ 298 {{3, 4}, 299 {0, 0}, 300 {0, 0}, 301 {0, 0} 302 } 303 }, 304 {1, 0, 2, 0, /* 0x19 */ 305 {{0, 0}, 306 {3, 4}, 307 {0, 0}, 308 {0, 0} 309 } 310 }, 311 {0, 0, 2, 0, /* 0x1a */ 312 {{1, 1}, 313 {3, 4}, 314 {0, 0}, 315 {0, 0} 316 } 317 }, 318 {1, 0, 2, 0, /* 0x1b */ 319 {{0, 1}, 320 {3, 4}, 321 {0, 0}, 322 {0, 0} 323 } 324 }, 325 {0, 0, 1, 0, /* 0x1c */ 326 {{2, 4}, 327 {0, 0}, 328 {0, 0}, 329 {0, 0} 330 } 331 }, 332 {1, 0, 2, 0, /* 0x1d */ 333 {{0, 0}, 334 {2, 4}, 335 {0, 0}, 336 {0, 0} 337 } 338 }, 339 {0, 0, 1, 0, /* 0x1e */ 340 {{1, 4}, 341 {0, 0}, 342 {0, 0}, 343 {0, 0} 344 } 345 }, 346 {1, 0, 1, 0, /* 0x1f */ 347 {{0, 4}, 348 {0, 0}, 349 {0, 0}, 350 {0, 0} 351 } 352 }, 353 {0, 0, 1, 0, /* 0x20 */ 354 {{5, 5}, 355 {0, 0}, 356 {0, 0}, 357 {0, 0} 358 } 359 }, 360 {1, 0, 2, 0, /* 0x21 */ 361 {{0, 0}, 362 {5, 5}, 363 {0, 0}, 364 {0, 0} 365 } 366 }, 367 {0, 0, 2, 0, /* 0x22 */ 368 {{1, 1}, 369 {5, 5}, 370 {0, 0}, 371 {0, 0} 372 } 373 }, 374 {1, 0, 2, 0, /* 0x23 */ 375 {{0, 1}, 376 {5, 5}, 377 {0, 0}, 378 {0, 0} 379 } 380 }, 381 {0, 0, 2, 0, /* 0x24 */ 382 {{2, 2}, 383 {5, 5}, 384 {0, 0}, 385 {0, 0} 386 } 387 }, 388 {1, 0, 3, 0, /* 0x25 */ 389 {{0, 0}, 390 {2, 2}, 391 {5, 5}, 392 {0, 0} 393 } 394 }, 395 {0, 0, 2, 0, /* 0x26 */ 396 {{1, 2}, 397 {5, 5}, 398 {0, 0}, 399 {0, 0} 400 } 401 }, 402 {1, 0, 2, 0, /* 0x27 */ 403 {{0, 2}, 404 {5, 5}, 405 {0, 0}, 406 {0, 0} 407 } 408 }, 409 {0, 0, 2, 0, /* 0x28 */ 410 {{3, 3}, 411 {5, 5}, 412 {0, 0}, 413 {0, 0} 414 } 415 }, 416 {1, 0, 3, 0, /* 0x29 */ 417 {{0, 0}, 418 {3, 3}, 419 {5, 5}, 420 {0, 0} 421 } 422 }, 423 {0, 0, 3, 0, /* 0x2a */ 424 {{1, 1}, 425 {3, 3}, 426 {5, 5}, 427 {0, 0} 428 } 429 }, 430 {1, 0, 3, 0, /* 0x2b */ 431 {{0, 1}, 432 {3, 3}, 433 {5, 5}, 434 {0, 0} 435 } 436 }, 437 {0, 0, 2, 0, /* 0x2c */ 438 {{2, 3}, 439 {5, 5}, 440 {0, 0}, 441 {0, 0} 442 } 443 }, 444 {1, 0, 3, 0, /* 0x2d */ 445 {{0, 0}, 446 {2, 3}, 447 {5, 5}, 448 {0, 0} 449 } 450 }, 451 {0, 0, 2, 0, /* 0x2e */ 452 {{1, 3}, 453 {5, 5}, 454 {0, 0}, 455 {0, 0} 456 } 457 }, 458 {1, 0, 2, 0, /* 0x2f */ 459 {{0, 3}, 460 {5, 5}, 461 {0, 0}, 462 {0, 0} 463 } 464 }, 465 {0, 0, 1, 0, /* 0x30 */ 466 {{4, 5}, 467 {0, 0}, 468 {0, 0}, 469 {0, 0} 470 } 471 }, 472 {1, 0, 2, 0, /* 0x31 */ 473 {{0, 0}, 474 {4, 5}, 475 {0, 0}, 476 {0, 0} 477 } 478 }, 479 {0, 0, 2, 0, /* 0x32 */ 480 {{1, 1}, 481 {4, 5}, 482 {0, 0}, 483 {0, 0} 484 } 485 }, 486 {1, 0, 2, 0, /* 0x33 */ 487 {{0, 1}, 488 {4, 5}, 489 {0, 0}, 490 {0, 0} 491 } 492 }, 493 {0, 0, 2, 0, /* 0x34 */ 494 {{2, 2}, 495 {4, 5}, 496 {0, 0}, 497 {0, 0} 498 } 499 }, 500 {1, 0, 3, 0, /* 0x35 */ 501 {{0, 0}, 502 {2, 2}, 503 {4, 5}, 504 {0, 0} 505 } 506 }, 507 {0, 0, 2, 0, /* 0x36 */ 508 {{1, 2}, 509 {4, 5}, 510 {0, 0}, 511 {0, 0} 512 } 513 }, 514 {1, 0, 2, 0, /* 0x37 */ 515 {{0, 2}, 516 {4, 5}, 517 {0, 0}, 518 {0, 0} 519 } 520 }, 521 {0, 0, 1, 0, /* 0x38 */ 522 {{3, 5}, 523 {0, 0}, 524 {0, 0}, 525 {0, 0} 526 } 527 }, 528 {1, 0, 2, 0, /* 0x39 */ 529 {{0, 0}, 530 {3, 5}, 531 {0, 0}, 532 {0, 0} 533 } 534 }, 535 {0, 0, 2, 0, /* 0x3a */ 536 {{1, 1}, 537 {3, 5}, 538 {0, 0}, 539 {0, 0} 540 } 541 }, 542 {1, 0, 2, 0, /* 0x3b */ 543 {{0, 1}, 544 {3, 5}, 545 {0, 0}, 546 {0, 0} 547 } 548 }, 549 {0, 0, 1, 0, /* 0x3c */ 550 {{2, 5}, 551 {0, 0}, 552 {0, 0}, 553 {0, 0} 554 } 555 }, 556 {1, 0, 2, 0, /* 0x3d */ 557 {{0, 0}, 558 {2, 5}, 559 {0, 0}, 560 {0, 0} 561 } 562 }, 563 {0, 0, 1, 0, /* 0x3e */ 564 {{1, 5}, 565 {0, 0}, 566 {0, 0}, 567 {0, 0} 568 } 569 }, 570 {1, 0, 1, 0, /* 0x3f */ 571 {{0, 5}, 572 {0, 0}, 573 {0, 0}, 574 {0, 0} 575 } 576 }, 577 {0, 0, 1, 0, /* 0x40 */ 578 {{6, 6}, 579 {0, 0}, 580 {0, 0}, 581 {0, 0} 582 } 583 }, 584 {1, 0, 2, 0, /* 0x41 */ 585 {{0, 0}, 586 {6, 6}, 587 {0, 0}, 588 {0, 0} 589 } 590 }, 591 {0, 0, 2, 0, /* 0x42 */ 592 {{1, 1}, 593 {6, 6}, 594 {0, 0}, 595 {0, 0} 596 } 597 }, 598 {1, 0, 2, 0, /* 0x43 */ 599 {{0, 1}, 600 {6, 6}, 601 {0, 0}, 602 {0, 0} 603 } 604 }, 605 {0, 0, 2, 0, /* 0x44 */ 606 {{2, 2}, 607 {6, 6}, 608 {0, 0}, 609 {0, 0} 610 } 611 }, 612 {1, 0, 3, 0, /* 0x45 */ 613 {{0, 0}, 614 {2, 2}, 615 {6, 6}, 616 {0, 0} 617 } 618 }, 619 {0, 0, 2, 0, /* 0x46 */ 620 {{1, 2}, 621 {6, 6}, 622 {0, 0}, 623 {0, 0} 624 } 625 }, 626 {1, 0, 2, 0, /* 0x47 */ 627 {{0, 2}, 628 {6, 6}, 629 {0, 0}, 630 {0, 0} 631 } 632 }, 633 {0, 0, 2, 0, /* 0x48 */ 634 {{3, 3}, 635 {6, 6}, 636 {0, 0}, 637 {0, 0} 638 } 639 }, 640 {1, 0, 3, 0, /* 0x49 */ 641 {{0, 0}, 642 {3, 3}, 643 {6, 6}, 644 {0, 0} 645 } 646 }, 647 {0, 0, 3, 0, /* 0x4a */ 648 {{1, 1}, 649 {3, 3}, 650 {6, 6}, 651 {0, 0} 652 } 653 }, 654 {1, 0, 3, 0, /* 0x4b */ 655 {{0, 1}, 656 {3, 3}, 657 {6, 6}, 658 {0, 0} 659 } 660 }, 661 {0, 0, 2, 0, /* 0x4c */ 662 {{2, 3}, 663 {6, 6}, 664 {0, 0}, 665 {0, 0} 666 } 667 }, 668 {1, 0, 3, 0, /* 0x4d */ 669 {{0, 0}, 670 {2, 3}, 671 {6, 6}, 672 {0, 0} 673 } 674 }, 675 {0, 0, 2, 0, /* 0x4e */ 676 {{1, 3}, 677 {6, 6}, 678 {0, 0}, 679 {0, 0} 680 } 681 }, 682 {1, 0, 2, 0, /* 0x4f */ 683 {{0, 3}, 684 {6, 6}, 685 {0, 0}, 686 {0, 0} 687 } 688 }, 689 {0, 0, 2, 0, /* 0x50 */ 690 {{4, 4}, 691 {6, 6}, 692 {0, 0}, 693 {0, 0} 694 } 695 }, 696 {1, 0, 3, 0, /* 0x51 */ 697 {{0, 0}, 698 {4, 4}, 699 {6, 6}, 700 {0, 0} 701 } 702 }, 703 {0, 0, 3, 0, /* 0x52 */ 704 {{1, 1}, 705 {4, 4}, 706 {6, 6}, 707 {0, 0} 708 } 709 }, 710 {1, 0, 3, 0, /* 0x53 */ 711 {{0, 1}, 712 {4, 4}, 713 {6, 6}, 714 {0, 0} 715 } 716 }, 717 {0, 0, 3, 0, /* 0x54 */ 718 {{2, 2}, 719 {4, 4}, 720 {6, 6}, 721 {0, 0} 722 } 723 }, 724 {1, 0, 4, 0, /* 0x55 */ 725 {{0, 0}, 726 {2, 2}, 727 {4, 4}, 728 {6, 6} 729 } 730 }, 731 {0, 0, 3, 0, /* 0x56 */ 732 {{1, 2}, 733 {4, 4}, 734 {6, 6}, 735 {0, 0} 736 } 737 }, 738 {1, 0, 3, 0, /* 0x57 */ 739 {{0, 2}, 740 {4, 4}, 741 {6, 6}, 742 {0, 0} 743 } 744 }, 745 {0, 0, 2, 0, /* 0x58 */ 746 {{3, 4}, 747 {6, 6}, 748 {0, 0}, 749 {0, 0} 750 } 751 }, 752 {1, 0, 3, 0, /* 0x59 */ 753 {{0, 0}, 754 {3, 4}, 755 {6, 6}, 756 {0, 0} 757 } 758 }, 759 {0, 0, 3, 0, /* 0x5a */ 760 {{1, 1}, 761 {3, 4}, 762 {6, 6}, 763 {0, 0} 764 } 765 }, 766 {1, 0, 3, 0, /* 0x5b */ 767 {{0, 1}, 768 {3, 4}, 769 {6, 6}, 770 {0, 0} 771 } 772 }, 773 {0, 0, 2, 0, /* 0x5c */ 774 {{2, 4}, 775 {6, 6}, 776 {0, 0}, 777 {0, 0} 778 } 779 }, 780 {1, 0, 3, 0, /* 0x5d */ 781 {{0, 0}, 782 {2, 4}, 783 {6, 6}, 784 {0, 0} 785 } 786 }, 787 {0, 0, 2, 0, /* 0x5e */ 788 {{1, 4}, 789 {6, 6}, 790 {0, 0}, 791 {0, 0} 792 } 793 }, 794 {1, 0, 2, 0, /* 0x5f */ 795 {{0, 4}, 796 {6, 6}, 797 {0, 0}, 798 {0, 0} 799 } 800 }, 801 {0, 0, 1, 0, /* 0x60 */ 802 {{5, 6}, 803 {0, 0}, 804 {0, 0}, 805 {0, 0} 806 } 807 }, 808 {1, 0, 2, 0, /* 0x61 */ 809 {{0, 0}, 810 {5, 6}, 811 {0, 0}, 812 {0, 0} 813 } 814 }, 815 {0, 0, 2, 0, /* 0x62 */ 816 {{1, 1}, 817 {5, 6}, 818 {0, 0}, 819 {0, 0} 820 } 821 }, 822 {1, 0, 2, 0, /* 0x63 */ 823 {{0, 1}, 824 {5, 6}, 825 {0, 0}, 826 {0, 0} 827 } 828 }, 829 {0, 0, 2, 0, /* 0x64 */ 830 {{2, 2}, 831 {5, 6}, 832 {0, 0}, 833 {0, 0} 834 } 835 }, 836 {1, 0, 3, 0, /* 0x65 */ 837 {{0, 0}, 838 {2, 2}, 839 {5, 6}, 840 {0, 0} 841 } 842 }, 843 {0, 0, 2, 0, /* 0x66 */ 844 {{1, 2}, 845 {5, 6}, 846 {0, 0}, 847 {0, 0} 848 } 849 }, 850 {1, 0, 2, 0, /* 0x67 */ 851 {{0, 2}, 852 {5, 6}, 853 {0, 0}, 854 {0, 0} 855 } 856 }, 857 {0, 0, 2, 0, /* 0x68 */ 858 {{3, 3}, 859 {5, 6}, 860 {0, 0}, 861 {0, 0} 862 } 863 }, 864 {1, 0, 3, 0, /* 0x69 */ 865 {{0, 0}, 866 {3, 3}, 867 {5, 6}, 868 {0, 0} 869 } 870 }, 871 {0, 0, 3, 0, /* 0x6a */ 872 {{1, 1}, 873 {3, 3}, 874 {5, 6}, 875 {0, 0} 876 } 877 }, 878 {1, 0, 3, 0, /* 0x6b */ 879 {{0, 1}, 880 {3, 3}, 881 {5, 6}, 882 {0, 0} 883 } 884 }, 885 {0, 0, 2, 0, /* 0x6c */ 886 {{2, 3}, 887 {5, 6}, 888 {0, 0}, 889 {0, 0} 890 } 891 }, 892 {1, 0, 3, 0, /* 0x6d */ 893 {{0, 0}, 894 {2, 3}, 895 {5, 6}, 896 {0, 0} 897 } 898 }, 899 {0, 0, 2, 0, /* 0x6e */ 900 {{1, 3}, 901 {5, 6}, 902 {0, 0}, 903 {0, 0} 904 } 905 }, 906 {1, 0, 2, 0, /* 0x6f */ 907 {{0, 3}, 908 {5, 6}, 909 {0, 0}, 910 {0, 0} 911 } 912 }, 913 {0, 0, 1, 0, /* 0x70 */ 914 {{4, 6}, 915 {0, 0}, 916 {0, 0}, 917 {0, 0} 918 } 919 }, 920 {1, 0, 2, 0, /* 0x71 */ 921 {{0, 0}, 922 {4, 6}, 923 {0, 0}, 924 {0, 0} 925 } 926 }, 927 {0, 0, 2, 0, /* 0x72 */ 928 {{1, 1}, 929 {4, 6}, 930 {0, 0}, 931 {0, 0} 932 } 933 }, 934 {1, 0, 2, 0, /* 0x73 */ 935 {{0, 1}, 936 {4, 6}, 937 {0, 0}, 938 {0, 0} 939 } 940 }, 941 {0, 0, 2, 0, /* 0x74 */ 942 {{2, 2}, 943 {4, 6}, 944 {0, 0}, 945 {0, 0} 946 } 947 }, 948 {1, 0, 3, 0, /* 0x75 */ 949 {{0, 0}, 950 {2, 2}, 951 {4, 6}, 952 {0, 0} 953 } 954 }, 955 {0, 0, 2, 0, /* 0x76 */ 956 {{1, 2}, 957 {4, 6}, 958 {0, 0}, 959 {0, 0} 960 } 961 }, 962 {1, 0, 2, 0, /* 0x77 */ 963 {{0, 2}, 964 {4, 6}, 965 {0, 0}, 966 {0, 0} 967 } 968 }, 969 {0, 0, 1, 0, /* 0x78 */ 970 {{3, 6}, 971 {0, 0}, 972 {0, 0}, 973 {0, 0} 974 } 975 }, 976 {1, 0, 2, 0, /* 0x79 */ 977 {{0, 0}, 978 {3, 6}, 979 {0, 0}, 980 {0, 0} 981 } 982 }, 983 {0, 0, 2, 0, /* 0x7a */ 984 {{1, 1}, 985 {3, 6}, 986 {0, 0}, 987 {0, 0} 988 } 989 }, 990 {1, 0, 2, 0, /* 0x7b */ 991 {{0, 1}, 992 {3, 6}, 993 {0, 0}, 994 {0, 0} 995 } 996 }, 997 {0, 0, 1, 0, /* 0x7c */ 998 {{2, 6}, 999 {0, 0}, 1000 {0, 0}, 1001 {0, 0} 1002 } 1003 }, 1004 {1, 0, 2, 0, /* 0x7d */ 1005 {{0, 0}, 1006 {2, 6}, 1007 {0, 0}, 1008 {0, 0} 1009 } 1010 }, 1011 {0, 0, 1, 0, /* 0x7e */ 1012 {{1, 6}, 1013 {0, 0}, 1014 {0, 0}, 1015 {0, 0} 1016 } 1017 }, 1018 {1, 0, 1, 0, /* 0x7f */ 1019 {{0, 6}, 1020 {0, 0}, 1021 {0, 0}, 1022 {0, 0} 1023 } 1024 }, 1025 {0, 1, 1, 0, /* 0x80 */ 1026 {{7, 7}, 1027 {0, 0}, 1028 {0, 0}, 1029 {0, 0} 1030 } 1031 }, 1032 {1, 1, 2, 0, /* 0x81 */ 1033 {{0, 0}, 1034 {7, 7}, 1035 {0, 0}, 1036 {0, 0} 1037 } 1038 }, 1039 {0, 1, 2, 0, /* 0x82 */ 1040 {{1, 1}, 1041 {7, 7}, 1042 {0, 0}, 1043 {0, 0} 1044 } 1045 }, 1046 {1, 1, 2, 0, /* 0x83 */ 1047 {{0, 1}, 1048 {7, 7}, 1049 {0, 0}, 1050 {0, 0} 1051 } 1052 }, 1053 {0, 1, 2, 0, /* 0x84 */ 1054 {{2, 2}, 1055 {7, 7}, 1056 {0, 0}, 1057 {0, 0} 1058 } 1059 }, 1060 {1, 1, 3, 0, /* 0x85 */ 1061 {{0, 0}, 1062 {2, 2}, 1063 {7, 7}, 1064 {0, 0} 1065 } 1066 }, 1067 {0, 1, 2, 0, /* 0x86 */ 1068 {{1, 2}, 1069 {7, 7}, 1070 {0, 0}, 1071 {0, 0} 1072 } 1073 }, 1074 {1, 1, 2, 0, /* 0x87 */ 1075 {{0, 2}, 1076 {7, 7}, 1077 {0, 0}, 1078 {0, 0} 1079 } 1080 }, 1081 {0, 1, 2, 0, /* 0x88 */ 1082 {{3, 3}, 1083 {7, 7}, 1084 {0, 0}, 1085 {0, 0} 1086 } 1087 }, 1088 {1, 1, 3, 0, /* 0x89 */ 1089 {{0, 0}, 1090 {3, 3}, 1091 {7, 7}, 1092 {0, 0} 1093 } 1094 }, 1095 {0, 1, 3, 0, /* 0x8a */ 1096 {{1, 1}, 1097 {3, 3}, 1098 {7, 7}, 1099 {0, 0} 1100 } 1101 }, 1102 {1, 1, 3, 0, /* 0x8b */ 1103 {{0, 1}, 1104 {3, 3}, 1105 {7, 7}, 1106 {0, 0} 1107 } 1108 }, 1109 {0, 1, 2, 0, /* 0x8c */ 1110 {{2, 3}, 1111 {7, 7}, 1112 {0, 0}, 1113 {0, 0} 1114 } 1115 }, 1116 {1, 1, 3, 0, /* 0x8d */ 1117 {{0, 0}, 1118 {2, 3}, 1119 {7, 7}, 1120 {0, 0} 1121 } 1122 }, 1123 {0, 1, 2, 0, /* 0x8e */ 1124 {{1, 3}, 1125 {7, 7}, 1126 {0, 0}, 1127 {0, 0} 1128 } 1129 }, 1130 {1, 1, 2, 0, /* 0x8f */ 1131 {{0, 3}, 1132 {7, 7}, 1133 {0, 0}, 1134 {0, 0} 1135 } 1136 }, 1137 {0, 1, 2, 0, /* 0x90 */ 1138 {{4, 4}, 1139 {7, 7}, 1140 {0, 0}, 1141 {0, 0} 1142 } 1143 }, 1144 {1, 1, 3, 0, /* 0x91 */ 1145 {{0, 0}, 1146 {4, 4}, 1147 {7, 7}, 1148 {0, 0} 1149 } 1150 }, 1151 {0, 1, 3, 0, /* 0x92 */ 1152 {{1, 1}, 1153 {4, 4}, 1154 {7, 7}, 1155 {0, 0} 1156 } 1157 }, 1158 {1, 1, 3, 0, /* 0x93 */ 1159 {{0, 1}, 1160 {4, 4}, 1161 {7, 7}, 1162 {0, 0} 1163 } 1164 }, 1165 {0, 1, 3, 0, /* 0x94 */ 1166 {{2, 2}, 1167 {4, 4}, 1168 {7, 7}, 1169 {0, 0} 1170 } 1171 }, 1172 {1, 1, 4, 0, /* 0x95 */ 1173 {{0, 0}, 1174 {2, 2}, 1175 {4, 4}, 1176 {7, 7} 1177 } 1178 }, 1179 {0, 1, 3, 0, /* 0x96 */ 1180 {{1, 2}, 1181 {4, 4}, 1182 {7, 7}, 1183 {0, 0} 1184 } 1185 }, 1186 {1, 1, 3, 0, /* 0x97 */ 1187 {{0, 2}, 1188 {4, 4}, 1189 {7, 7}, 1190 {0, 0} 1191 } 1192 }, 1193 {0, 1, 2, 0, /* 0x98 */ 1194 {{3, 4}, 1195 {7, 7}, 1196 {0, 0}, 1197 {0, 0} 1198 } 1199 }, 1200 {1, 1, 3, 0, /* 0x99 */ 1201 {{0, 0}, 1202 {3, 4}, 1203 {7, 7}, 1204 {0, 0} 1205 } 1206 }, 1207 {0, 1, 3, 0, /* 0x9a */ 1208 {{1, 1}, 1209 {3, 4}, 1210 {7, 7}, 1211 {0, 0} 1212 } 1213 }, 1214 {1, 1, 3, 0, /* 0x9b */ 1215 {{0, 1}, 1216 {3, 4}, 1217 {7, 7}, 1218 {0, 0} 1219 } 1220 }, 1221 {0, 1, 2, 0, /* 0x9c */ 1222 {{2, 4}, 1223 {7, 7}, 1224 {0, 0}, 1225 {0, 0} 1226 } 1227 }, 1228 {1, 1, 3, 0, /* 0x9d */ 1229 {{0, 0}, 1230 {2, 4}, 1231 {7, 7}, 1232 {0, 0} 1233 } 1234 }, 1235 {0, 1, 2, 0, /* 0x9e */ 1236 {{1, 4}, 1237 {7, 7}, 1238 {0, 0}, 1239 {0, 0} 1240 } 1241 }, 1242 {1, 1, 2, 0, /* 0x9f */ 1243 {{0, 4}, 1244 {7, 7}, 1245 {0, 0}, 1246 {0, 0} 1247 } 1248 }, 1249 {0, 1, 2, 0, /* 0xa0 */ 1250 {{5, 5}, 1251 {7, 7}, 1252 {0, 0}, 1253 {0, 0} 1254 } 1255 }, 1256 {1, 1, 3, 0, /* 0xa1 */ 1257 {{0, 0}, 1258 {5, 5}, 1259 {7, 7}, 1260 {0, 0} 1261 } 1262 }, 1263 {0, 1, 3, 0, /* 0xa2 */ 1264 {{1, 1}, 1265 {5, 5}, 1266 {7, 7}, 1267 {0, 0} 1268 } 1269 }, 1270 {1, 1, 3, 0, /* 0xa3 */ 1271 {{0, 1}, 1272 {5, 5}, 1273 {7, 7}, 1274 {0, 0} 1275 } 1276 }, 1277 {0, 1, 3, 0, /* 0xa4 */ 1278 {{2, 2}, 1279 {5, 5}, 1280 {7, 7}, 1281 {0, 0} 1282 } 1283 }, 1284 {1, 1, 4, 0, /* 0xa5 */ 1285 {{0, 0}, 1286 {2, 2}, 1287 {5, 5}, 1288 {7, 7} 1289 } 1290 }, 1291 {0, 1, 3, 0, /* 0xa6 */ 1292 {{1, 2}, 1293 {5, 5}, 1294 {7, 7}, 1295 {0, 0} 1296 } 1297 }, 1298 {1, 1, 3, 0, /* 0xa7 */ 1299 {{0, 2}, 1300 {5, 5}, 1301 {7, 7}, 1302 {0, 0} 1303 } 1304 }, 1305 {0, 1, 3, 0, /* 0xa8 */ 1306 {{3, 3}, 1307 {5, 5}, 1308 {7, 7}, 1309 {0, 0} 1310 } 1311 }, 1312 {1, 1, 4, 0, /* 0xa9 */ 1313 {{0, 0}, 1314 {3, 3}, 1315 {5, 5}, 1316 {7, 7} 1317 } 1318 }, 1319 {0, 1, 4, 0, /* 0xaa */ 1320 {{1, 1}, 1321 {3, 3}, 1322 {5, 5}, 1323 {7, 7} 1324 } 1325 }, 1326 {1, 1, 4, 0, /* 0xab */ 1327 {{0, 1}, 1328 {3, 3}, 1329 {5, 5}, 1330 {7, 7} 1331 } 1332 }, 1333 {0, 1, 3, 0, /* 0xac */ 1334 {{2, 3}, 1335 {5, 5}, 1336 {7, 7}, 1337 {0, 0} 1338 } 1339 }, 1340 {1, 1, 4, 0, /* 0xad */ 1341 {{0, 0}, 1342 {2, 3}, 1343 {5, 5}, 1344 {7, 7} 1345 } 1346 }, 1347 {0, 1, 3, 0, /* 0xae */ 1348 {{1, 3}, 1349 {5, 5}, 1350 {7, 7}, 1351 {0, 0} 1352 } 1353 }, 1354 {1, 1, 3, 0, /* 0xaf */ 1355 {{0, 3}, 1356 {5, 5}, 1357 {7, 7}, 1358 {0, 0} 1359 } 1360 }, 1361 {0, 1, 2, 0, /* 0xb0 */ 1362 {{4, 5}, 1363 {7, 7}, 1364 {0, 0}, 1365 {0, 0} 1366 } 1367 }, 1368 {1, 1, 3, 0, /* 0xb1 */ 1369 {{0, 0}, 1370 {4, 5}, 1371 {7, 7}, 1372 {0, 0} 1373 } 1374 }, 1375 {0, 1, 3, 0, /* 0xb2 */ 1376 {{1, 1}, 1377 {4, 5}, 1378 {7, 7}, 1379 {0, 0} 1380 } 1381 }, 1382 {1, 1, 3, 0, /* 0xb3 */ 1383 {{0, 1}, 1384 {4, 5}, 1385 {7, 7}, 1386 {0, 0} 1387 } 1388 }, 1389 {0, 1, 3, 0, /* 0xb4 */ 1390 {{2, 2}, 1391 {4, 5}, 1392 {7, 7}, 1393 {0, 0} 1394 } 1395 }, 1396 {1, 1, 4, 0, /* 0xb5 */ 1397 {{0, 0}, 1398 {2, 2}, 1399 {4, 5}, 1400 {7, 7} 1401 } 1402 }, 1403 {0, 1, 3, 0, /* 0xb6 */ 1404 {{1, 2}, 1405 {4, 5}, 1406 {7, 7}, 1407 {0, 0} 1408 } 1409 }, 1410 {1, 1, 3, 0, /* 0xb7 */ 1411 {{0, 2}, 1412 {4, 5}, 1413 {7, 7}, 1414 {0, 0} 1415 } 1416 }, 1417 {0, 1, 2, 0, /* 0xb8 */ 1418 {{3, 5}, 1419 {7, 7}, 1420 {0, 0}, 1421 {0, 0} 1422 } 1423 }, 1424 {1, 1, 3, 0, /* 0xb9 */ 1425 {{0, 0}, 1426 {3, 5}, 1427 {7, 7}, 1428 {0, 0} 1429 } 1430 }, 1431 {0, 1, 3, 0, /* 0xba */ 1432 {{1, 1}, 1433 {3, 5}, 1434 {7, 7}, 1435 {0, 0} 1436 } 1437 }, 1438 {1, 1, 3, 0, /* 0xbb */ 1439 {{0, 1}, 1440 {3, 5}, 1441 {7, 7}, 1442 {0, 0} 1443 } 1444 }, 1445 {0, 1, 2, 0, /* 0xbc */ 1446 {{2, 5}, 1447 {7, 7}, 1448 {0, 0}, 1449 {0, 0} 1450 } 1451 }, 1452 {1, 1, 3, 0, /* 0xbd */ 1453 {{0, 0}, 1454 {2, 5}, 1455 {7, 7}, 1456 {0, 0} 1457 } 1458 }, 1459 {0, 1, 2, 0, /* 0xbe */ 1460 {{1, 5}, 1461 {7, 7}, 1462 {0, 0}, 1463 {0, 0} 1464 } 1465 }, 1466 {1, 1, 2, 0, /* 0xbf */ 1467 {{0, 5}, 1468 {7, 7}, 1469 {0, 0}, 1470 {0, 0} 1471 } 1472 }, 1473 {0, 1, 1, 0, /* 0xc0 */ 1474 {{6, 7}, 1475 {0, 0}, 1476 {0, 0}, 1477 {0, 0} 1478 } 1479 }, 1480 {1, 1, 2, 0, /* 0xc1 */ 1481 {{0, 0}, 1482 {6, 7}, 1483 {0, 0}, 1484 {0, 0} 1485 } 1486 }, 1487 {0, 1, 2, 0, /* 0xc2 */ 1488 {{1, 1}, 1489 {6, 7}, 1490 {0, 0}, 1491 {0, 0} 1492 } 1493 }, 1494 {1, 1, 2, 0, /* 0xc3 */ 1495 {{0, 1}, 1496 {6, 7}, 1497 {0, 0}, 1498 {0, 0} 1499 } 1500 }, 1501 {0, 1, 2, 0, /* 0xc4 */ 1502 {{2, 2}, 1503 {6, 7}, 1504 {0, 0}, 1505 {0, 0} 1506 } 1507 }, 1508 {1, 1, 3, 0, /* 0xc5 */ 1509 {{0, 0}, 1510 {2, 2}, 1511 {6, 7}, 1512 {0, 0} 1513 } 1514 }, 1515 {0, 1, 2, 0, /* 0xc6 */ 1516 {{1, 2}, 1517 {6, 7}, 1518 {0, 0}, 1519 {0, 0} 1520 } 1521 }, 1522 {1, 1, 2, 0, /* 0xc7 */ 1523 {{0, 2}, 1524 {6, 7}, 1525 {0, 0}, 1526 {0, 0} 1527 } 1528 }, 1529 {0, 1, 2, 0, /* 0xc8 */ 1530 {{3, 3}, 1531 {6, 7}, 1532 {0, 0}, 1533 {0, 0} 1534 } 1535 }, 1536 {1, 1, 3, 0, /* 0xc9 */ 1537 {{0, 0}, 1538 {3, 3}, 1539 {6, 7}, 1540 {0, 0} 1541 } 1542 }, 1543 {0, 1, 3, 0, /* 0xca */ 1544 {{1, 1}, 1545 {3, 3}, 1546 {6, 7}, 1547 {0, 0} 1548 } 1549 }, 1550 {1, 1, 3, 0, /* 0xcb */ 1551 {{0, 1}, 1552 {3, 3}, 1553 {6, 7}, 1554 {0, 0} 1555 } 1556 }, 1557 {0, 1, 2, 0, /* 0xcc */ 1558 {{2, 3}, 1559 {6, 7}, 1560 {0, 0}, 1561 {0, 0} 1562 } 1563 }, 1564 {1, 1, 3, 0, /* 0xcd */ 1565 {{0, 0}, 1566 {2, 3}, 1567 {6, 7}, 1568 {0, 0} 1569 } 1570 }, 1571 {0, 1, 2, 0, /* 0xce */ 1572 {{1, 3}, 1573 {6, 7}, 1574 {0, 0}, 1575 {0, 0} 1576 } 1577 }, 1578 {1, 1, 2, 0, /* 0xcf */ 1579 {{0, 3}, 1580 {6, 7}, 1581 {0, 0}, 1582 {0, 0} 1583 } 1584 }, 1585 {0, 1, 2, 0, /* 0xd0 */ 1586 {{4, 4}, 1587 {6, 7}, 1588 {0, 0}, 1589 {0, 0} 1590 } 1591 }, 1592 {1, 1, 3, 0, /* 0xd1 */ 1593 {{0, 0}, 1594 {4, 4}, 1595 {6, 7}, 1596 {0, 0} 1597 } 1598 }, 1599 {0, 1, 3, 0, /* 0xd2 */ 1600 {{1, 1}, 1601 {4, 4}, 1602 {6, 7}, 1603 {0, 0} 1604 } 1605 }, 1606 {1, 1, 3, 0, /* 0xd3 */ 1607 {{0, 1}, 1608 {4, 4}, 1609 {6, 7}, 1610 {0, 0} 1611 } 1612 }, 1613 {0, 1, 3, 0, /* 0xd4 */ 1614 {{2, 2}, 1615 {4, 4}, 1616 {6, 7}, 1617 {0, 0} 1618 } 1619 }, 1620 {1, 1, 4, 0, /* 0xd5 */ 1621 {{0, 0}, 1622 {2, 2}, 1623 {4, 4}, 1624 {6, 7} 1625 } 1626 }, 1627 {0, 1, 3, 0, /* 0xd6 */ 1628 {{1, 2}, 1629 {4, 4}, 1630 {6, 7}, 1631 {0, 0} 1632 } 1633 }, 1634 {1, 1, 3, 0, /* 0xd7 */ 1635 {{0, 2}, 1636 {4, 4}, 1637 {6, 7}, 1638 {0, 0} 1639 } 1640 }, 1641 {0, 1, 2, 0, /* 0xd8 */ 1642 {{3, 4}, 1643 {6, 7}, 1644 {0, 0}, 1645 {0, 0} 1646 } 1647 }, 1648 {1, 1, 3, 0, /* 0xd9 */ 1649 {{0, 0}, 1650 {3, 4}, 1651 {6, 7}, 1652 {0, 0} 1653 } 1654 }, 1655 {0, 1, 3, 0, /* 0xda */ 1656 {{1, 1}, 1657 {3, 4}, 1658 {6, 7}, 1659 {0, 0} 1660 } 1661 }, 1662 {1, 1, 3, 0, /* 0xdb */ 1663 {{0, 1}, 1664 {3, 4}, 1665 {6, 7}, 1666 {0, 0} 1667 } 1668 }, 1669 {0, 1, 2, 0, /* 0xdc */ 1670 {{2, 4}, 1671 {6, 7}, 1672 {0, 0}, 1673 {0, 0} 1674 } 1675 }, 1676 {1, 1, 3, 0, /* 0xdd */ 1677 {{0, 0}, 1678 {2, 4}, 1679 {6, 7}, 1680 {0, 0} 1681 } 1682 }, 1683 {0, 1, 2, 0, /* 0xde */ 1684 {{1, 4}, 1685 {6, 7}, 1686 {0, 0}, 1687 {0, 0} 1688 } 1689 }, 1690 {1, 1, 2, 0, /* 0xdf */ 1691 {{0, 4}, 1692 {6, 7}, 1693 {0, 0}, 1694 {0, 0} 1695 } 1696 }, 1697 {0, 1, 1, 0, /* 0xe0 */ 1698 {{5, 7}, 1699 {0, 0}, 1700 {0, 0}, 1701 {0, 0} 1702 } 1703 }, 1704 {1, 1, 2, 0, /* 0xe1 */ 1705 {{0, 0}, 1706 {5, 7}, 1707 {0, 0}, 1708 {0, 0} 1709 } 1710 }, 1711 {0, 1, 2, 0, /* 0xe2 */ 1712 {{1, 1}, 1713 {5, 7}, 1714 {0, 0}, 1715 {0, 0} 1716 } 1717 }, 1718 {1, 1, 2, 0, /* 0xe3 */ 1719 {{0, 1}, 1720 {5, 7}, 1721 {0, 0}, 1722 {0, 0} 1723 } 1724 }, 1725 {0, 1, 2, 0, /* 0xe4 */ 1726 {{2, 2}, 1727 {5, 7}, 1728 {0, 0}, 1729 {0, 0} 1730 } 1731 }, 1732 {1, 1, 3, 0, /* 0xe5 */ 1733 {{0, 0}, 1734 {2, 2}, 1735 {5, 7}, 1736 {0, 0} 1737 } 1738 }, 1739 {0, 1, 2, 0, /* 0xe6 */ 1740 {{1, 2}, 1741 {5, 7}, 1742 {0, 0}, 1743 {0, 0} 1744 } 1745 }, 1746 {1, 1, 2, 0, /* 0xe7 */ 1747 {{0, 2}, 1748 {5, 7}, 1749 {0, 0}, 1750 {0, 0} 1751 } 1752 }, 1753 {0, 1, 2, 0, /* 0xe8 */ 1754 {{3, 3}, 1755 {5, 7}, 1756 {0, 0}, 1757 {0, 0} 1758 } 1759 }, 1760 {1, 1, 3, 0, /* 0xe9 */ 1761 {{0, 0}, 1762 {3, 3}, 1763 {5, 7}, 1764 {0, 0} 1765 } 1766 }, 1767 {0, 1, 3, 0, /* 0xea */ 1768 {{1, 1}, 1769 {3, 3}, 1770 {5, 7}, 1771 {0, 0} 1772 } 1773 }, 1774 {1, 1, 3, 0, /* 0xeb */ 1775 {{0, 1}, 1776 {3, 3}, 1777 {5, 7}, 1778 {0, 0} 1779 } 1780 }, 1781 {0, 1, 2, 0, /* 0xec */ 1782 {{2, 3}, 1783 {5, 7}, 1784 {0, 0}, 1785 {0, 0} 1786 } 1787 }, 1788 {1, 1, 3, 0, /* 0xed */ 1789 {{0, 0}, 1790 {2, 3}, 1791 {5, 7}, 1792 {0, 0} 1793 } 1794 }, 1795 {0, 1, 2, 0, /* 0xee */ 1796 {{1, 3}, 1797 {5, 7}, 1798 {0, 0}, 1799 {0, 0} 1800 } 1801 }, 1802 {1, 1, 2, 0, /* 0xef */ 1803 {{0, 3}, 1804 {5, 7}, 1805 {0, 0}, 1806 {0, 0} 1807 } 1808 }, 1809 {0, 1, 1, 0, /* 0xf0 */ 1810 {{4, 7}, 1811 {0, 0}, 1812 {0, 0}, 1813 {0, 0} 1814 } 1815 }, 1816 {1, 1, 2, 0, /* 0xf1 */ 1817 {{0, 0}, 1818 {4, 7}, 1819 {0, 0}, 1820 {0, 0} 1821 } 1822 }, 1823 {0, 1, 2, 0, /* 0xf2 */ 1824 {{1, 1}, 1825 {4, 7}, 1826 {0, 0}, 1827 {0, 0} 1828 } 1829 }, 1830 {1, 1, 2, 0, /* 0xf3 */ 1831 {{0, 1}, 1832 {4, 7}, 1833 {0, 0}, 1834 {0, 0} 1835 } 1836 }, 1837 {0, 1, 2, 0, /* 0xf4 */ 1838 {{2, 2}, 1839 {4, 7}, 1840 {0, 0}, 1841 {0, 0} 1842 } 1843 }, 1844 {1, 1, 3, 0, /* 0xf5 */ 1845 {{0, 0}, 1846 {2, 2}, 1847 {4, 7}, 1848 {0, 0} 1849 } 1850 }, 1851 {0, 1, 2, 0, /* 0xf6 */ 1852 {{1, 2}, 1853 {4, 7}, 1854 {0, 0}, 1855 {0, 0} 1856 } 1857 }, 1858 {1, 1, 2, 0, /* 0xf7 */ 1859 {{0, 2}, 1860 {4, 7}, 1861 {0, 0}, 1862 {0, 0} 1863 } 1864 }, 1865 {0, 1, 1, 0, /* 0xf8 */ 1866 {{3, 7}, 1867 {0, 0}, 1868 {0, 0}, 1869 {0, 0} 1870 } 1871 }, 1872 {1, 1, 2, 0, /* 0xf9 */ 1873 {{0, 0}, 1874 {3, 7}, 1875 {0, 0}, 1876 {0, 0} 1877 } 1878 }, 1879 {0, 1, 2, 0, /* 0xfa */ 1880 {{1, 1}, 1881 {3, 7}, 1882 {0, 0}, 1883 {0, 0} 1884 } 1885 }, 1886 {1, 1, 2, 0, /* 0xfb */ 1887 {{0, 1}, 1888 {3, 7}, 1889 {0, 0}, 1890 {0, 0} 1891 } 1892 }, 1893 {0, 1, 1, 0, /* 0xfc */ 1894 {{2, 7}, 1895 {0, 0}, 1896 {0, 0}, 1897 {0, 0} 1898 } 1899 }, 1900 {1, 1, 2, 0, /* 0xfd */ 1901 {{0, 0}, 1902 {2, 7}, 1903 {0, 0}, 1904 {0, 0} 1905 } 1906 }, 1907 {0, 1, 1, 0, /* 0xfe */ 1908 {{1, 7}, 1909 {0, 0}, 1910 {0, 0}, 1911 {0, 0} 1912 } 1913 }, 1914 {1, 1, 1, 0, /* 0xff */ 1915 {{0, 7}, 1916 {0, 0}, 1917 {0, 0}, 1918 {0, 0} 1919 } 1920 } 1921 }; 1922 1923 1924 1925 1926 extern int sctp_peer_chunk_oh; 1927 1928 static int 1929 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize) 1930 { 1931 struct cmsghdr cmh; 1932 int tlen, at; 1933 1934 tlen = SCTP_BUF_LEN(control); 1935 at = 0; 1936 /* 1937 * Independent of how many mbufs, find the c_type inside the control 1938 * structure and copy out the data. 1939 */ 1940 while (at < tlen) { 1941 if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) { 1942 /* not enough room for one more we are done. */ 1943 return (0); 1944 } 1945 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh); 1946 if ((cmh.cmsg_len + at) > tlen) { 1947 /* 1948 * this is real messed up since there is not enough 1949 * data here to cover the cmsg header. We are done. 1950 */ 1951 return (0); 1952 } 1953 if ((cmh.cmsg_level == IPPROTO_SCTP) && 1954 (c_type == cmh.cmsg_type)) { 1955 /* found the one we want, copy it out */ 1956 at += CMSG_ALIGN(sizeof(struct cmsghdr)); 1957 if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) { 1958 /* 1959 * space of cmsg_len after header not big 1960 * enough 1961 */ 1962 return (0); 1963 } 1964 m_copydata(control, at, cpsize, data); 1965 return (1); 1966 } else { 1967 at += CMSG_ALIGN(cmh.cmsg_len); 1968 if (cmh.cmsg_len == 0) { 1969 break; 1970 } 1971 } 1972 } 1973 /* not found */ 1974 return (0); 1975 } 1976 1977 1978 extern int sctp_mbuf_threshold_count; 1979 1980 1981 __inline struct mbuf * 1982 sctp_get_mbuf_for_msg(unsigned int space_needed, int want_header, 1983 int how, int allonebuf, int type) 1984 { 1985 struct mbuf *m = NULL; 1986 int aloc_size; 1987 int index = 0; 1988 int mbuf_threshold; 1989 1990 if (want_header) { 1991 MGETHDR(m, how, type); 1992 } else { 1993 MGET(m, how, type); 1994 } 1995 if (m == NULL) { 1996 return (NULL); 1997 } 1998 if (allonebuf == 0) 1999 mbuf_threshold = sctp_mbuf_threshold_count; 2000 else 2001 mbuf_threshold = 1; 2002 2003 2004 if (space_needed > (((mbuf_threshold - 1) * MLEN) + MHLEN)) { 2005 try_again: 2006 index = 4; 2007 if (space_needed <= MCLBYTES) { 2008 aloc_size = MCLBYTES; 2009 } else if (space_needed <= MJUMPAGESIZE) { 2010 aloc_size = MJUMPAGESIZE; 2011 index = 5; 2012 } else if (space_needed <= MJUM9BYTES) { 2013 aloc_size = MJUM9BYTES; 2014 index = 6; 2015 } else { 2016 aloc_size = MJUM16BYTES; 2017 index = 7; 2018 } 2019 m_cljget(m, how, aloc_size); 2020 if (m == NULL) { 2021 return (NULL); 2022 } 2023 if (SCTP_BUF_IS_EXTENDED(m) == 0) { 2024 if ((aloc_size != MCLBYTES) && 2025 (allonebuf == 0)) { 2026 aloc_size -= 10; 2027 goto try_again; 2028 } 2029 sctp_m_freem(m); 2030 return (NULL); 2031 } 2032 } 2033 SCTP_BUF_LEN(m) = 0; 2034 SCTP_BUF_NEXT(m) = SCTP_BUF_NEXT_PKT(m) = NULL; 2035 #ifdef SCTP_MBUF_LOGGING 2036 if (SCTP_BUF_IS_EXTENDED(m)) { 2037 sctp_log_mb(m, SCTP_MBUF_IALLOC); 2038 } 2039 #endif 2040 return (m); 2041 } 2042 2043 2044 2045 static struct mbuf * 2046 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset, 2047 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in) 2048 { 2049 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 2050 struct sctp_state_cookie *stc; 2051 struct sctp_paramhdr *ph; 2052 uint8_t *signature; 2053 int sig_offset; 2054 uint16_t cookie_sz; 2055 2056 mret = NULL; 2057 2058 2059 mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) + 2060 sizeof(struct sctp_paramhdr)), 0, M_DONTWAIT, 1, MT_DATA); 2061 if (mret == NULL) { 2062 return (NULL); 2063 } 2064 copy_init = sctp_m_copym(init, init_offset, M_COPYALL, M_DONTWAIT); 2065 if (copy_init == NULL) { 2066 sctp_m_freem(mret); 2067 return (NULL); 2068 } 2069 copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL, 2070 M_DONTWAIT); 2071 if (copy_initack == NULL) { 2072 sctp_m_freem(mret); 2073 sctp_m_freem(copy_init); 2074 return (NULL); 2075 } 2076 /* easy side we just drop it on the end */ 2077 ph = mtod(mret, struct sctp_paramhdr *); 2078 SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) + 2079 sizeof(struct sctp_paramhdr); 2080 stc = (struct sctp_state_cookie *)((caddr_t)ph + 2081 sizeof(struct sctp_paramhdr)); 2082 ph->param_type = htons(SCTP_STATE_COOKIE); 2083 ph->param_length = 0; /* fill in at the end */ 2084 /* Fill in the stc cookie data */ 2085 *stc = *stc_in; 2086 2087 /* tack the INIT and then the INIT-ACK onto the chain */ 2088 cookie_sz = 0; 2089 m_at = mret; 2090 for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 2091 cookie_sz += SCTP_BUF_LEN(m_at); 2092 if (SCTP_BUF_NEXT(m_at) == NULL) { 2093 SCTP_BUF_NEXT(m_at) = copy_init; 2094 break; 2095 } 2096 } 2097 2098 for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 2099 cookie_sz += SCTP_BUF_LEN(m_at); 2100 if (SCTP_BUF_NEXT(m_at) == NULL) { 2101 SCTP_BUF_NEXT(m_at) = copy_initack; 2102 break; 2103 } 2104 } 2105 2106 for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 2107 cookie_sz += SCTP_BUF_LEN(m_at); 2108 if (SCTP_BUF_NEXT(m_at) == NULL) { 2109 break; 2110 } 2111 } 2112 sig = sctp_get_mbuf_for_msg(SCTP_SECRET_SIZE, 0, M_DONTWAIT, 1, MT_DATA); 2113 if (sig == NULL) { 2114 /* no space, so free the entire chain */ 2115 sctp_m_freem(mret); 2116 return (NULL); 2117 } 2118 SCTP_BUF_LEN(sig) = 0; 2119 SCTP_BUF_NEXT(m_at) = sig; 2120 sig_offset = 0; 2121 signature = (uint8_t *) (mtod(sig, caddr_t)+sig_offset); 2122 /* Time to sign the cookie */ 2123 sctp_hmac_m(SCTP_HMAC, 2124 (uint8_t *) inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)], 2125 SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr), 2126 (uint8_t *) signature); 2127 SCTP_BUF_LEN(sig) += SCTP_SIGNATURE_SIZE; 2128 cookie_sz += SCTP_SIGNATURE_SIZE; 2129 2130 ph->param_length = htons(cookie_sz); 2131 return (mret); 2132 } 2133 2134 2135 static __inline uint8_t 2136 sctp_get_ect(struct sctp_tcb *stcb, 2137 struct sctp_tmit_chunk *chk) 2138 { 2139 uint8_t this_random; 2140 2141 /* Huh? */ 2142 if (sctp_ecn_enable == 0) 2143 return (0); 2144 2145 if (sctp_ecn_nonce == 0) 2146 /* no nonce, always return ECT0 */ 2147 return (SCTP_ECT0_BIT); 2148 2149 if (stcb->asoc.peer_supports_ecn_nonce == 0) { 2150 /* Peer does NOT support it, so we send a ECT0 only */ 2151 return (SCTP_ECT0_BIT); 2152 } 2153 if (chk == NULL) 2154 return (SCTP_ECT0_BIT); 2155 2156 if (((stcb->asoc.hb_random_idx == 3) && 2157 (stcb->asoc.hb_ect_randombit > 7)) || 2158 (stcb->asoc.hb_random_idx > 3)) { 2159 uint32_t rndval; 2160 2161 rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 2162 memcpy(stcb->asoc.hb_random_values, &rndval, 2163 sizeof(stcb->asoc.hb_random_values)); 2164 this_random = stcb->asoc.hb_random_values[0]; 2165 stcb->asoc.hb_random_idx = 0; 2166 stcb->asoc.hb_ect_randombit = 0; 2167 } else { 2168 if (stcb->asoc.hb_ect_randombit > 7) { 2169 stcb->asoc.hb_ect_randombit = 0; 2170 stcb->asoc.hb_random_idx++; 2171 } 2172 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx]; 2173 } 2174 if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) { 2175 if (chk != NULL) 2176 /* ECN Nonce stuff */ 2177 chk->rec.data.ect_nonce = SCTP_ECT1_BIT; 2178 stcb->asoc.hb_ect_randombit++; 2179 return (SCTP_ECT1_BIT); 2180 } else { 2181 stcb->asoc.hb_ect_randombit++; 2182 return (SCTP_ECT0_BIT); 2183 } 2184 } 2185 2186 extern int sctp_no_csum_on_loopback; 2187 2188 static int 2189 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 2190 struct sctp_tcb *stcb, /* may be NULL */ 2191 struct sctp_nets *net, 2192 struct sockaddr *to, 2193 struct mbuf *m, 2194 uint32_t auth_offset, 2195 struct sctp_auth_chunk *auth, 2196 int nofragment_flag, 2197 int ecn_ok, 2198 struct sctp_tmit_chunk *chk, 2199 int out_of_asoc_ok) 2200 /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 2201 { 2202 /* 2203 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet 2204 * header WITH a SCTPHDR but no IP header, endpoint inp and sa 2205 * structure. - fill in the HMAC digest of any AUTH chunk in the 2206 * packet - calculate SCTP checksum and fill in - prepend a IP 2207 * address header - if boundall use INADDR_ANY - if boundspecific do 2208 * source address selection - set fragmentation option for ipV4 - On 2209 * return from IP output, check/adjust mtu size - of output 2210 * interface and smallest_mtu size as well. 2211 */ 2212 /* Will need ifdefs around this */ 2213 struct mbuf *o_pak; 2214 2215 struct sctphdr *sctphdr; 2216 int packet_length; 2217 int o_flgs; 2218 uint32_t csum; 2219 int ret; 2220 unsigned int have_mtu; 2221 struct route *ro; 2222 2223 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 2224 sctp_m_freem(m); 2225 return (EFAULT); 2226 } 2227 /* fill in the HMAC digest for any AUTH chunk in the packet */ 2228 if ((auth != NULL) && (stcb != NULL)) { 2229 sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb); 2230 } 2231 /* Calculate the csum and fill in the length of the packet */ 2232 sctphdr = mtod(m, struct sctphdr *); 2233 have_mtu = 0; 2234 if (sctp_no_csum_on_loopback && 2235 (stcb) && 2236 (stcb->asoc.loopback_scope)) { 2237 sctphdr->checksum = 0; 2238 /* 2239 * This can probably now be taken out since my audit shows 2240 * no more bad pktlen's coming in. But we will wait a while 2241 * yet. 2242 */ 2243 packet_length = sctp_calculate_len(m); 2244 } else { 2245 sctphdr->checksum = 0; 2246 csum = sctp_calculate_sum(m, &packet_length, 0); 2247 sctphdr->checksum = csum; 2248 } 2249 2250 if (to->sa_family == AF_INET) { 2251 struct ip *ip; 2252 struct route iproute; 2253 uint8_t tos_value; 2254 2255 o_pak = SCTP_GET_HEADER_FOR_OUTPUT(sizeof(struct ip)); 2256 if (o_pak == NULL) { 2257 /* failed to prepend data, give up */ 2258 sctp_m_freem(m); 2259 return (ENOMEM); 2260 } 2261 SCTP_BUF_LEN(SCTP_HEADER_TO_CHAIN(o_pak)) = sizeof(struct ip); 2262 packet_length += sizeof(struct ip); 2263 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 2264 ip = mtod(SCTP_HEADER_TO_CHAIN(o_pak), struct ip *); 2265 ip->ip_v = IPVERSION; 2266 ip->ip_hl = (sizeof(struct ip) >> 2); 2267 if (net) { 2268 tos_value = net->tos_flowlabel & 0x000000ff; 2269 } else { 2270 tos_value = inp->ip_inp.inp.inp_ip_tos; 2271 } 2272 if (nofragment_flag) { 2273 #if defined(WITH_CONVERT_IP_OFF) || defined(__FreeBSD__) || defined(__APPLE__) 2274 ip->ip_off = IP_DF; 2275 #else 2276 ip->ip_off = htons(IP_DF); 2277 #endif 2278 } else 2279 ip->ip_off = 0; 2280 2281 2282 /* FreeBSD has a function for ip_id's */ 2283 ip->ip_id = ip_newid(); 2284 2285 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl; 2286 ip->ip_len = SCTP_HEADER_LEN(o_pak); 2287 if (stcb) { 2288 if ((stcb->asoc.ecn_allowed) && ecn_ok) { 2289 /* Enable ECN */ 2290 ip->ip_tos = ((u_char)(tos_value & 0xfc) | sctp_get_ect(stcb, chk)); 2291 } else { 2292 /* No ECN */ 2293 ip->ip_tos = (u_char)(tos_value & 0xfc); 2294 } 2295 } else { 2296 /* no association at all */ 2297 ip->ip_tos = (tos_value & 0xfc); 2298 } 2299 ip->ip_p = IPPROTO_SCTP; 2300 ip->ip_sum = 0; 2301 if (net == NULL) { 2302 ro = &iproute; 2303 memset(&iproute, 0, sizeof(iproute)); 2304 memcpy(&ro->ro_dst, to, to->sa_len); 2305 } else { 2306 ro = (struct route *)&net->ro; 2307 } 2308 /* Now the address selection part */ 2309 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr; 2310 2311 /* call the routine to select the src address */ 2312 if (net) { 2313 if (net->src_addr_selected == 0) { 2314 /* Cache the source address */ 2315 ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp, 2316 stcb, 2317 ro, net, out_of_asoc_ok); 2318 if (ro->ro_rt) 2319 net->src_addr_selected = 1; 2320 } 2321 ip->ip_src = ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr; 2322 } else { 2323 ip->ip_src = sctp_ipv4_source_address_selection(inp, 2324 stcb, ro, net, out_of_asoc_ok); 2325 } 2326 2327 /* 2328 * If source address selection fails and we find no route 2329 * then the ip_output should fail as well with a 2330 * NO_ROUTE_TO_HOST type error. We probably should catch 2331 * that somewhere and abort the association right away 2332 * (assuming this is an INIT being sent). 2333 */ 2334 if ((ro->ro_rt == NULL)) { 2335 /* 2336 * src addr selection failed to find a route (or 2337 * valid source addr), so we can't get there from 2338 * here! 2339 */ 2340 #ifdef SCTP_DEBUG 2341 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2342 printf("low_level_output: dropped v4 packet- no valid source addr\n"); 2343 printf("Destination was %x\n", (uint32_t) (ntohl(ip->ip_dst.s_addr))); 2344 } 2345 #endif /* SCTP_DEBUG */ 2346 if (net) { 2347 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) 2348 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 2349 stcb, 2350 SCTP_FAILED_THRESHOLD, 2351 (void *)net); 2352 net->dest_state &= ~SCTP_ADDR_REACHABLE; 2353 net->dest_state |= SCTP_ADDR_NOT_REACHABLE; 2354 if (stcb) { 2355 if (net == stcb->asoc.primary_destination) { 2356 /* need a new primary */ 2357 struct sctp_nets *alt; 2358 2359 alt = sctp_find_alternate_net(stcb, net, 0); 2360 if (alt != net) { 2361 if (sctp_set_primary_addr(stcb, 2362 (struct sockaddr *)NULL, 2363 alt) == 0) { 2364 net->dest_state |= SCTP_ADDR_WAS_PRIMARY; 2365 net->src_addr_selected = 0; 2366 } 2367 } 2368 } 2369 } 2370 } 2371 sctp_m_freem(o_pak); 2372 return (EHOSTUNREACH); 2373 } else { 2374 have_mtu = ro->ro_rt->rt_ifp->if_mtu; 2375 } 2376 if (inp->sctp_socket) { 2377 o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST))); 2378 } else { 2379 o_flgs = IP_RAWOUTPUT; 2380 } 2381 #ifdef SCTP_DEBUG 2382 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2383 printf("Calling ipv4 output routine from low level src addr:%x\n", 2384 (uint32_t) (ntohl(ip->ip_src.s_addr))); 2385 printf("Destination is %x\n", (uint32_t) (ntohl(ip->ip_dst.s_addr))); 2386 printf("RTP route is %p through\n", ro->ro_rt); 2387 } 2388 #endif 2389 2390 if ((have_mtu) && (net) && (have_mtu > net->mtu)) { 2391 ro->ro_rt->rt_ifp->if_mtu = net->mtu; 2392 } 2393 if (ro != &iproute) { 2394 memcpy(&iproute, ro, sizeof(*ro)); 2395 } 2396 ret = ip_output(o_pak, inp->ip_inp.inp.inp_options, 2397 ro, o_flgs, inp->ip_inp.inp.inp_moptions 2398 ,(struct inpcb *)NULL 2399 ); 2400 if ((ro->ro_rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) { 2401 ro->ro_rt->rt_ifp->if_mtu = have_mtu; 2402 } 2403 SCTP_STAT_INCR(sctps_sendpackets); 2404 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 2405 if (ret) 2406 SCTP_STAT_INCR(sctps_senderrors); 2407 #ifdef SCTP_DEBUG 2408 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2409 printf("Ip output returns %d\n", ret); 2410 } 2411 #endif 2412 if (net == NULL) { 2413 /* free tempy routes */ 2414 if (ro->ro_rt) 2415 RTFREE(ro->ro_rt); 2416 } else { 2417 /* PMTU check versus smallest asoc MTU goes here */ 2418 if (ro->ro_rt != NULL) { 2419 if (ro->ro_rt->rt_rmx.rmx_mtu && 2420 (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) { 2421 sctp_mtu_size_reset(inp, &stcb->asoc, 2422 ro->ro_rt->rt_rmx.rmx_mtu); 2423 } 2424 } else { 2425 /* route was freed */ 2426 net->src_addr_selected = 0; 2427 } 2428 } 2429 return (ret); 2430 } 2431 #ifdef INET6 2432 else if (to->sa_family == AF_INET6) { 2433 uint32_t flowlabel; 2434 struct ip6_hdr *ip6h; 2435 2436 struct route_in6 ip6route; 2437 2438 struct ifnet *ifp; 2439 u_char flowTop; 2440 uint16_t flowBottom; 2441 u_char tosBottom, tosTop; 2442 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 2443 struct sockaddr_in6 lsa6_storage; 2444 int prev_scope = 0; 2445 int error; 2446 u_short prev_port = 0; 2447 2448 if (net != NULL) { 2449 flowlabel = net->tos_flowlabel; 2450 } else { 2451 flowlabel = ((struct in6pcb *)inp)->in6p_flowinfo; 2452 } 2453 o_pak = SCTP_GET_HEADER_FOR_OUTPUT(sizeof(struct ip6_hdr)); 2454 if (o_pak == NULL) { 2455 /* failed to prepend data, give up */ 2456 sctp_m_freem(m); 2457 return (ENOMEM); 2458 } 2459 SCTP_BUF_LEN(SCTP_HEADER_TO_CHAIN(o_pak)) = sizeof(struct ip6_hdr); 2460 packet_length += sizeof(struct ip6_hdr); 2461 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 2462 ip6h = mtod(SCTP_HEADER_TO_CHAIN(o_pak), struct ip6_hdr *); 2463 /* 2464 * We assume here that inp_flow is in host byte order within 2465 * the TCB! 2466 */ 2467 flowBottom = flowlabel & 0x0000ffff; 2468 flowTop = ((flowlabel & 0x000f0000) >> 16); 2469 tosTop = (((flowlabel & 0xf0) >> 4) | IPV6_VERSION); 2470 /* protect *sin6 from overwrite */ 2471 sin6 = (struct sockaddr_in6 *)to; 2472 tmp = *sin6; 2473 sin6 = &tmp; 2474 2475 /* KAME hack: embed scopeid */ 2476 if (sa6_embedscope(sin6, ip6_use_defzone) != 0) 2477 return (EINVAL); 2478 if (net == NULL) { 2479 memset(&ip6route, 0, sizeof(ip6route)); 2480 ro = (struct route *)&ip6route; 2481 memcpy(&ro->ro_dst, sin6, sin6->sin6_len); 2482 } else { 2483 ro = (struct route *)&net->ro; 2484 } 2485 if (stcb != NULL) { 2486 if ((stcb->asoc.ecn_allowed) && ecn_ok) { 2487 /* Enable ECN */ 2488 tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4); 2489 } else { 2490 /* No ECN */ 2491 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4); 2492 } 2493 } else { 2494 /* we could get no asoc if it is a O-O-T-B packet */ 2495 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4); 2496 } 2497 ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom | flowTop) << 16) | flowBottom)); 2498 ip6h->ip6_nxt = IPPROTO_SCTP; 2499 ip6h->ip6_plen = (SCTP_HEADER_LEN(o_pak) - sizeof(struct ip6_hdr)); 2500 ip6h->ip6_dst = sin6->sin6_addr; 2501 2502 /* 2503 * Add SRC address selection here: we can only reuse to a 2504 * limited degree the kame src-addr-sel, since we can try 2505 * their selection but it may not be bound. 2506 */ 2507 bzero(&lsa6_tmp, sizeof(lsa6_tmp)); 2508 lsa6_tmp.sin6_family = AF_INET6; 2509 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 2510 lsa6 = &lsa6_tmp; 2511 if (net) { 2512 if (net->src_addr_selected == 0) { 2513 /* Cache the source address */ 2514 ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp, 2515 stcb, ro, net, out_of_asoc_ok); 2516 2517 if (ro->ro_rt) 2518 net->src_addr_selected = 1; 2519 } 2520 lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr; 2521 } else { 2522 lsa6->sin6_addr = sctp_ipv6_source_address_selection( 2523 inp, stcb, ro, net, out_of_asoc_ok); 2524 } 2525 lsa6->sin6_port = inp->sctp_lport; 2526 2527 if ((ro->ro_rt == NULL)) { 2528 /* 2529 * src addr selection failed to find a route (or 2530 * valid source addr), so we can't get there from 2531 * here! 2532 */ 2533 #ifdef SCTP_DEBUG 2534 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2535 printf("low_level_output: dropped v6 pkt- no valid source addr\n"); 2536 } 2537 #endif 2538 sctp_m_freem(o_pak); 2539 if (net) { 2540 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) 2541 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 2542 stcb, 2543 SCTP_FAILED_THRESHOLD, 2544 (void *)net); 2545 net->dest_state &= ~SCTP_ADDR_REACHABLE; 2546 net->dest_state |= SCTP_ADDR_NOT_REACHABLE; 2547 if (stcb) { 2548 if (net == stcb->asoc.primary_destination) { 2549 /* need a new primary */ 2550 struct sctp_nets *alt; 2551 2552 alt = sctp_find_alternate_net(stcb, net, 0); 2553 if (alt != net) { 2554 if (sctp_set_primary_addr(stcb, 2555 (struct sockaddr *)NULL, 2556 alt) == 0) { 2557 net->dest_state |= SCTP_ADDR_WAS_PRIMARY; 2558 net->src_addr_selected = 0; 2559 } 2560 } 2561 } 2562 } 2563 } 2564 return (EHOSTUNREACH); 2565 } 2566 /* 2567 * XXX: sa6 may not have a valid sin6_scope_id in the 2568 * non-SCOPEDROUTING case. 2569 */ 2570 bzero(&lsa6_storage, sizeof(lsa6_storage)); 2571 lsa6_storage.sin6_family = AF_INET6; 2572 lsa6_storage.sin6_len = sizeof(lsa6_storage); 2573 if ((error = sa6_recoverscope(&lsa6_storage)) != 0) { 2574 sctp_m_freem(o_pak); 2575 return (error); 2576 } 2577 /* XXX */ 2578 lsa6_storage.sin6_addr = lsa6->sin6_addr; 2579 lsa6_storage.sin6_port = inp->sctp_lport; 2580 lsa6 = &lsa6_storage; 2581 ip6h->ip6_src = lsa6->sin6_addr; 2582 2583 /* 2584 * We set the hop limit now since there is a good chance 2585 * that our ro pointer is now filled 2586 */ 2587 ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp, 2588 (ro ? 2589 (ro->ro_rt ? (ro->ro_rt->rt_ifp) : (NULL)) : 2590 (NULL))); 2591 o_flgs = 0; 2592 ifp = ro->ro_rt->rt_ifp; 2593 #ifdef SCTP_DEBUG 2594 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2595 /* Copy to be sure something bad is not happening */ 2596 sin6->sin6_addr = ip6h->ip6_dst; 2597 lsa6->sin6_addr = ip6h->ip6_src; 2598 2599 printf("Calling ipv6 output routine from low level\n"); 2600 printf("src: "); 2601 sctp_print_address((struct sockaddr *)lsa6); 2602 printf("dst: "); 2603 sctp_print_address((struct sockaddr *)sin6); 2604 } 2605 #endif /* SCTP_DEBUG */ 2606 if (net) { 2607 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 2608 /* preserve the port and scope for link local send */ 2609 prev_scope = sin6->sin6_scope_id; 2610 prev_port = sin6->sin6_port; 2611 } 2612 ret = ip6_output(o_pak, ((struct in6pcb *)inp)->in6p_outputopts, 2613 (struct route_in6 *)ro, 2614 o_flgs, 2615 ((struct in6pcb *)inp)->in6p_moptions, 2616 &ifp 2617 ,NULL 2618 ); 2619 if (net) { 2620 /* for link local this must be done */ 2621 sin6->sin6_scope_id = prev_scope; 2622 sin6->sin6_port = prev_port; 2623 } 2624 #ifdef SCTP_DEBUG 2625 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2626 printf("return from send is %d\n", ret); 2627 } 2628 #endif /* SCTP_DEBUG_OUTPUT */ 2629 SCTP_STAT_INCR(sctps_sendpackets); 2630 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 2631 if (ret) 2632 SCTP_STAT_INCR(sctps_senderrors); 2633 if (net == NULL) { 2634 /* Now if we had a temp route free it */ 2635 if (ro->ro_rt) { 2636 RTFREE(ro->ro_rt); 2637 } 2638 } else { 2639 /* PMTU check versus smallest asoc MTU goes here */ 2640 if (ro->ro_rt == NULL) { 2641 /* Route was freed */ 2642 net->src_addr_selected = 0; 2643 } 2644 if (ro->ro_rt != NULL) { 2645 if (ro->ro_rt->rt_rmx.rmx_mtu && 2646 (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) { 2647 sctp_mtu_size_reset(inp, 2648 &stcb->asoc, 2649 ro->ro_rt->rt_rmx.rmx_mtu); 2650 } 2651 } else if (ifp) { 2652 if (ND_IFINFO(ifp)->linkmtu && 2653 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) { 2654 sctp_mtu_size_reset(inp, 2655 &stcb->asoc, 2656 ND_IFINFO(ifp)->linkmtu); 2657 } 2658 } 2659 } 2660 return (ret); 2661 } 2662 #endif 2663 else { 2664 #ifdef SCTP_DEBUG 2665 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2666 printf("Unknown protocol (TSNH) type %d\n", ((struct sockaddr *)to)->sa_family); 2667 } 2668 #endif 2669 sctp_m_freem(m); 2670 return (EFAULT); 2671 } 2672 } 2673 2674 2675 void 2676 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 2677 { 2678 struct mbuf *m, *m_at, *m_last; 2679 struct sctp_nets *net; 2680 struct sctp_init_msg *initm; 2681 struct sctp_supported_addr_param *sup_addr; 2682 struct sctp_ecn_supported_param *ecn; 2683 struct sctp_prsctp_supported_param *prsctp; 2684 struct sctp_ecn_nonce_supported_param *ecn_nonce; 2685 struct sctp_supported_chunk_types_param *pr_supported; 2686 int cnt_inits_to = 0; 2687 int padval, ret; 2688 int num_ext; 2689 int p_len; 2690 2691 /* INIT's always go to the primary (and usually ONLY address) */ 2692 m_last = NULL; 2693 net = stcb->asoc.primary_destination; 2694 if (net == NULL) { 2695 net = TAILQ_FIRST(&stcb->asoc.nets); 2696 if (net == NULL) { 2697 /* TSNH */ 2698 return; 2699 } 2700 /* we confirm any address we send an INIT to */ 2701 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2702 sctp_set_primary_addr(stcb, NULL, net); 2703 } else { 2704 /* we confirm any address we send an INIT to */ 2705 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2706 } 2707 #ifdef SCTP_DEBUG 2708 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2709 printf("Sending INIT\n"); 2710 } 2711 #endif 2712 if (((struct sockaddr *)&(net->ro._l_addr))->sa_family == AF_INET6) { 2713 /* 2714 * special hook, if we are sending to link local it will not 2715 * show up in our private address count. 2716 */ 2717 struct sockaddr_in6 *sin6l; 2718 2719 sin6l = &net->ro._l_addr.sin6; 2720 if (IN6_IS_ADDR_LINKLOCAL(&sin6l->sin6_addr)) 2721 cnt_inits_to = 1; 2722 } 2723 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 2724 /* This case should not happen */ 2725 return; 2726 } 2727 /* start the INIT timer */ 2728 if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) { 2729 /* we are hosed since I can't start the INIT timer? */ 2730 return; 2731 } 2732 m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_DONTWAIT, 1, MT_DATA); 2733 if (m == NULL) { 2734 /* No memory, INIT timer will re-attempt. */ 2735 return; 2736 } 2737 SCTP_BUF_LEN(m) = sizeof(struct sctp_init_msg); 2738 /* Now lets put the SCTP header in place */ 2739 initm = mtod(m, struct sctp_init_msg *); 2740 initm->sh.src_port = inp->sctp_lport; 2741 initm->sh.dest_port = stcb->rport; 2742 initm->sh.v_tag = 0; 2743 initm->sh.checksum = 0; /* calculate later */ 2744 /* now the chunk header */ 2745 initm->msg.ch.chunk_type = SCTP_INITIATION; 2746 initm->msg.ch.chunk_flags = 0; 2747 /* fill in later from mbuf we build */ 2748 initm->msg.ch.chunk_length = 0; 2749 /* place in my tag */ 2750 initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag); 2751 /* set up some of the credits. */ 2752 initm->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.sb_hiwat, 2753 SCTP_MINIMAL_RWND)); 2754 2755 initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 2756 initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 2757 initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number); 2758 /* now the address restriction */ 2759 sup_addr = (struct sctp_supported_addr_param *)((caddr_t)initm + 2760 sizeof(*initm)); 2761 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 2762 /* we support 2 types IPv6/IPv4 */ 2763 sup_addr->ph.param_length = htons(sizeof(*sup_addr) + 2764 sizeof(uint16_t)); 2765 sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS); 2766 sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS); 2767 SCTP_BUF_LEN(m) += sizeof(*sup_addr) + sizeof(uint16_t); 2768 2769 if (inp->sctp_ep.adaptation_layer_indicator) { 2770 struct sctp_adaptation_layer_indication *ali; 2771 2772 ali = (struct sctp_adaptation_layer_indication *)( 2773 (caddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t)); 2774 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 2775 ali->ph.param_length = htons(sizeof(*ali)); 2776 ali->indication = ntohl(inp->sctp_ep.adaptation_layer_indicator); 2777 SCTP_BUF_LEN(m) += sizeof(*ali); 2778 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali + 2779 sizeof(*ali)); 2780 } else { 2781 ecn = (struct sctp_ecn_supported_param *)((caddr_t)sup_addr + 2782 sizeof(*sup_addr) + sizeof(uint16_t)); 2783 } 2784 2785 /* now any cookie time extensions */ 2786 if (stcb->asoc.cookie_preserve_req) { 2787 struct sctp_cookie_perserve_param *cookie_preserve; 2788 2789 cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn); 2790 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 2791 cookie_preserve->ph.param_length = htons( 2792 sizeof(*cookie_preserve)); 2793 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 2794 SCTP_BUF_LEN(m) += sizeof(*cookie_preserve); 2795 ecn = (struct sctp_ecn_supported_param *)( 2796 (caddr_t)cookie_preserve + sizeof(*cookie_preserve)); 2797 stcb->asoc.cookie_preserve_req = 0; 2798 } 2799 /* ECN parameter */ 2800 if (sctp_ecn_enable == 1) { 2801 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE); 2802 ecn->ph.param_length = htons(sizeof(*ecn)); 2803 SCTP_BUF_LEN(m) += sizeof(*ecn); 2804 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn + 2805 sizeof(*ecn)); 2806 } else { 2807 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn); 2808 } 2809 /* And now tell the peer we do pr-sctp */ 2810 prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED); 2811 prsctp->ph.param_length = htons(sizeof(*prsctp)); 2812 SCTP_BUF_LEN(m) += sizeof(*prsctp); 2813 2814 /* And now tell the peer we do all the extensions */ 2815 pr_supported = (struct sctp_supported_chunk_types_param *) 2816 ((caddr_t)prsctp + sizeof(*prsctp)); 2817 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 2818 num_ext = 0; 2819 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 2820 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 2821 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 2822 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 2823 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 2824 if (!sctp_auth_disable) 2825 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 2826 p_len = sizeof(*pr_supported) + num_ext; 2827 pr_supported->ph.param_length = htons(p_len); 2828 bzero((caddr_t)pr_supported + p_len, SCTP_SIZE32(p_len) - p_len); 2829 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 2830 2831 /* ECN nonce: And now tell the peer we support ECN nonce */ 2832 if (sctp_ecn_nonce) { 2833 ecn_nonce = (struct sctp_ecn_nonce_supported_param *) 2834 ((caddr_t)pr_supported + SCTP_SIZE32(p_len)); 2835 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED); 2836 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce)); 2837 SCTP_BUF_LEN(m) += sizeof(*ecn_nonce); 2838 } 2839 /* add authentication parameters */ 2840 if (!sctp_auth_disable) { 2841 struct sctp_auth_random *random; 2842 struct sctp_auth_hmac_algo *hmacs; 2843 struct sctp_auth_chunk_list *chunks; 2844 2845 /* attach RANDOM parameter, if available */ 2846 if (stcb->asoc.authinfo.random != NULL) { 2847 random = (struct sctp_auth_random *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 2848 random->ph.param_type = htons(SCTP_RANDOM); 2849 p_len = sizeof(*random) + stcb->asoc.authinfo.random_len; 2850 random->ph.param_length = htons(p_len); 2851 bcopy(stcb->asoc.authinfo.random->key, random->random_data, 2852 stcb->asoc.authinfo.random_len); 2853 /* zero out any padding required */ 2854 bzero((caddr_t)random + p_len, SCTP_SIZE32(p_len) - p_len); 2855 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 2856 } 2857 /* add HMAC_ALGO parameter */ 2858 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 2859 p_len = sctp_serialize_hmaclist(stcb->asoc.local_hmacs, 2860 (uint8_t *) hmacs->hmac_ids); 2861 if (p_len > 0) { 2862 p_len += sizeof(*hmacs); 2863 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 2864 hmacs->ph.param_length = htons(p_len); 2865 /* zero out any padding required */ 2866 bzero((caddr_t)hmacs + p_len, SCTP_SIZE32(p_len) - p_len); 2867 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 2868 } 2869 /* add CHUNKS parameter */ 2870 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 2871 p_len = sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks, 2872 chunks->chunk_types); 2873 if (p_len > 0) { 2874 p_len += sizeof(*chunks); 2875 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 2876 chunks->ph.param_length = htons(p_len); 2877 /* zero out any padding required */ 2878 bzero((caddr_t)chunks + p_len, SCTP_SIZE32(p_len) - p_len); 2879 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 2880 } 2881 } 2882 m_at = m; 2883 /* now the addresses */ 2884 { 2885 struct sctp_scoping scp; 2886 2887 /* 2888 * To optimize this we could put the scoping stuff into a 2889 * structure and remove the individual uint8's from the 2890 * assoc structure. Then we could just pass in the address 2891 * within the stcb.. but for now this is a quick hack to get 2892 * the address stuff teased apart. 2893 */ 2894 scp.ipv4_addr_legal = stcb->asoc.ipv4_addr_legal; 2895 scp.ipv6_addr_legal = stcb->asoc.ipv6_addr_legal; 2896 scp.loopback_scope = stcb->asoc.loopback_scope; 2897 scp.ipv4_local_scope = stcb->asoc.ipv4_local_scope; 2898 scp.local_scope = stcb->asoc.local_scope; 2899 scp.site_scope = stcb->asoc.site_scope; 2900 2901 m_at = sctp_add_addresses_to_i_ia(inp, &scp, m_at, cnt_inits_to); 2902 } 2903 2904 2905 /* calulate the size and update pkt header and chunk header */ 2906 p_len = 0; 2907 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 2908 if (SCTP_BUF_NEXT(m_at) == NULL) 2909 m_last = m_at; 2910 p_len += SCTP_BUF_LEN(m_at); 2911 } 2912 initm->msg.ch.chunk_length = htons((p_len - sizeof(struct sctphdr))); 2913 /* 2914 * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the return 2915 * here since the timer will drive a retranmission. 2916 */ 2917 2918 /* I don't expect this to execute but we will be safe here */ 2919 padval = p_len % 4; 2920 if ((padval) && (m_last)) { 2921 /* 2922 * The compiler worries that m_last may not be set even 2923 * though I think it is impossible :-> however we add m_last 2924 * here just in case. 2925 */ 2926 int ret; 2927 2928 ret = sctp_add_pad_tombuf(m_last, (4 - padval)); 2929 if (ret) { 2930 /* Houston we have a problem, no space */ 2931 sctp_m_freem(m); 2932 return; 2933 } 2934 p_len += padval; 2935 } 2936 ret = sctp_lowlevel_chunk_output(inp, stcb, net, 2937 (struct sockaddr *)&net->ro._l_addr, 2938 m, 0, NULL, 0, 0, NULL, 0); 2939 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 2940 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 2941 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 2942 } 2943 2944 struct mbuf * 2945 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 2946 int param_offset, int *abort_processing, struct sctp_chunkhdr *cp) 2947 { 2948 /* 2949 * Given a mbuf containing an INIT or INIT-ACK with the param_offset 2950 * being equal to the beginning of the params i.e. (iphlen + 2951 * sizeof(struct sctp_init_msg) parse through the parameters to the 2952 * end of the mbuf verifying that all parameters are known. 2953 * 2954 * For unknown parameters build and return a mbuf with 2955 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop 2956 * processing this chunk stop, and set *abort_processing to 1. 2957 * 2958 * By having param_offset be pre-set to where parameters begin it is 2959 * hoped that this routine may be reused in the future by new 2960 * features. 2961 */ 2962 struct sctp_paramhdr *phdr, params; 2963 2964 struct mbuf *mat, *op_err; 2965 char tempbuf[2048]; 2966 int at, limit, pad_needed; 2967 uint16_t ptype, plen; 2968 int err_at; 2969 2970 *abort_processing = 0; 2971 mat = in_initpkt; 2972 err_at = 0; 2973 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 2974 at = param_offset; 2975 op_err = NULL; 2976 2977 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 2978 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 2979 ptype = ntohs(phdr->param_type); 2980 plen = ntohs(phdr->param_length); 2981 limit -= SCTP_SIZE32(plen); 2982 if (plen < sizeof(struct sctp_paramhdr)) { 2983 #ifdef SCTP_DEBUG 2984 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2985 printf("sctp_output.c:Impossible length in parameter < %d\n", plen); 2986 } 2987 #endif 2988 *abort_processing = 1; 2989 break; 2990 } 2991 /* 2992 * All parameters for all chunks that we know/understand are 2993 * listed here. We process them other places and make 2994 * appropriate stop actions per the upper bits. However this 2995 * is the generic routine processor's can call to get back 2996 * an operr.. to either incorporate (init-ack) or send. 2997 */ 2998 if ((ptype == SCTP_HEARTBEAT_INFO) || 2999 (ptype == SCTP_IPV4_ADDRESS) || 3000 (ptype == SCTP_IPV6_ADDRESS) || 3001 (ptype == SCTP_STATE_COOKIE) || 3002 (ptype == SCTP_UNRECOG_PARAM) || 3003 (ptype == SCTP_COOKIE_PRESERVE) || 3004 (ptype == SCTP_SUPPORTED_ADDRTYPE) || 3005 (ptype == SCTP_PRSCTP_SUPPORTED) || 3006 (ptype == SCTP_ADD_IP_ADDRESS) || 3007 (ptype == SCTP_DEL_IP_ADDRESS) || 3008 (ptype == SCTP_ECN_CAPABLE) || 3009 (ptype == SCTP_ULP_ADAPTATION) || 3010 (ptype == SCTP_ERROR_CAUSE_IND) || 3011 (ptype == SCTP_RANDOM) || 3012 (ptype == SCTP_CHUNK_LIST) || 3013 (ptype == SCTP_CHUNK_LIST) || 3014 (ptype == SCTP_SET_PRIM_ADDR) || 3015 (ptype == SCTP_SUCCESS_REPORT) || 3016 (ptype == SCTP_ULP_ADAPTATION) || 3017 (ptype == SCTP_SUPPORTED_CHUNK_EXT) || 3018 (ptype == SCTP_ECN_NONCE_SUPPORTED) 3019 ) { 3020 /* no skip it */ 3021 at += SCTP_SIZE32(plen); 3022 } else if (ptype == SCTP_HOSTNAME_ADDRESS) { 3023 /* We can NOT handle HOST NAME addresses!! */ 3024 int l_len; 3025 3026 #ifdef SCTP_DEBUG 3027 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 3028 printf("Can't handle hostname addresses.. abort processing\n"); 3029 } 3030 #endif 3031 *abort_processing = 1; 3032 if (op_err == NULL) { 3033 /* Ok need to try to get a mbuf */ 3034 l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 3035 l_len += plen; 3036 l_len += sizeof(struct sctp_paramhdr); 3037 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA); 3038 if (op_err) { 3039 SCTP_BUF_LEN(op_err) = 0; 3040 /* 3041 * pre-reserve space for ip and sctp 3042 * header and chunk hdr 3043 */ 3044 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 3045 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 3046 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 3047 } 3048 } 3049 if (op_err) { 3050 /* If we have space */ 3051 struct sctp_paramhdr s; 3052 3053 if (err_at % 4) { 3054 uint32_t cpthis = 0; 3055 3056 pad_needed = 4 - (err_at % 4); 3057 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 3058 err_at += pad_needed; 3059 } 3060 s.param_type = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR); 3061 s.param_length = htons(sizeof(s) + plen); 3062 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 3063 err_at += sizeof(s); 3064 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen); 3065 if (phdr == NULL) { 3066 sctp_m_freem(op_err); 3067 /* 3068 * we are out of memory but we still 3069 * need to have a look at what to do 3070 * (the system is in trouble 3071 * though). 3072 */ 3073 return (NULL); 3074 } 3075 m_copyback(op_err, err_at, plen, (caddr_t)phdr); 3076 err_at += plen; 3077 } 3078 return (op_err); 3079 } else { 3080 /* 3081 * we do not recognize the parameter figure out what 3082 * we do. 3083 */ 3084 if ((ptype & 0x4000) == 0x4000) { 3085 /* Report bit is set?? */ 3086 if (op_err == NULL) { 3087 int l_len; 3088 3089 /* Ok need to try to get an mbuf */ 3090 l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 3091 l_len += plen; 3092 l_len += sizeof(struct sctp_paramhdr); 3093 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA); 3094 if (op_err) { 3095 SCTP_BUF_LEN(op_err) = 0; 3096 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 3097 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 3098 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 3099 } 3100 } 3101 if (op_err) { 3102 /* If we have space */ 3103 struct sctp_paramhdr s; 3104 3105 if (err_at % 4) { 3106 uint32_t cpthis = 0; 3107 3108 pad_needed = 4 - (err_at % 4); 3109 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 3110 err_at += pad_needed; 3111 } 3112 s.param_type = htons(SCTP_UNRECOG_PARAM); 3113 s.param_length = htons(sizeof(s) + plen); 3114 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 3115 err_at += sizeof(s); 3116 if (plen > sizeof(tempbuf)) { 3117 plen = sizeof(tempbuf); 3118 } 3119 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen); 3120 if (phdr == NULL) { 3121 sctp_m_freem(op_err); 3122 /* 3123 * we are out of memory but 3124 * we still need to have a 3125 * look at what to do (the 3126 * system is in trouble 3127 * though). 3128 */ 3129 goto more_processing; 3130 } 3131 m_copyback(op_err, err_at, plen, (caddr_t)phdr); 3132 err_at += plen; 3133 } 3134 } 3135 more_processing: 3136 if ((ptype & 0x8000) == 0x0000) { 3137 return (op_err); 3138 } else { 3139 /* skip this chunk and continue processing */ 3140 at += SCTP_SIZE32(plen); 3141 } 3142 3143 } 3144 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 3145 } 3146 return (op_err); 3147 } 3148 3149 static int 3150 sctp_are_there_new_addresses(struct sctp_association *asoc, 3151 struct mbuf *in_initpkt, int iphlen, int offset) 3152 { 3153 /* 3154 * Given a INIT packet, look through the packet to verify that there 3155 * are NO new addresses. As we go through the parameters add reports 3156 * of any un-understood parameters that require an error. Also we 3157 * must return (1) to drop the packet if we see a un-understood 3158 * parameter that tells us to drop the chunk. 3159 */ 3160 struct sockaddr_in sin4, *sa4; 3161 struct sockaddr_in6 sin6, *sa6; 3162 struct sockaddr *sa_touse; 3163 struct sockaddr *sa; 3164 struct sctp_paramhdr *phdr, params; 3165 struct ip *iph; 3166 struct mbuf *mat; 3167 uint16_t ptype, plen; 3168 int err_at; 3169 uint8_t fnd; 3170 struct sctp_nets *net; 3171 3172 memset(&sin4, 0, sizeof(sin4)); 3173 memset(&sin6, 0, sizeof(sin6)); 3174 sin4.sin_family = AF_INET; 3175 sin4.sin_len = sizeof(sin4); 3176 sin6.sin6_family = AF_INET6; 3177 sin6.sin6_len = sizeof(sin6); 3178 3179 sa_touse = NULL; 3180 /* First what about the src address of the pkt ? */ 3181 iph = mtod(in_initpkt, struct ip *); 3182 if (iph->ip_v == IPVERSION) { 3183 /* source addr is IPv4 */ 3184 sin4.sin_addr = iph->ip_src; 3185 sa_touse = (struct sockaddr *)&sin4; 3186 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 3187 /* source addr is IPv6 */ 3188 struct ip6_hdr *ip6h; 3189 3190 ip6h = mtod(in_initpkt, struct ip6_hdr *); 3191 sin6.sin6_addr = ip6h->ip6_src; 3192 sa_touse = (struct sockaddr *)&sin6; 3193 } else { 3194 return (1); 3195 } 3196 3197 fnd = 0; 3198 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3199 sa = (struct sockaddr *)&net->ro._l_addr; 3200 if (sa->sa_family == sa_touse->sa_family) { 3201 if (sa->sa_family == AF_INET) { 3202 sa4 = (struct sockaddr_in *)sa; 3203 if (sa4->sin_addr.s_addr == 3204 sin4.sin_addr.s_addr) { 3205 fnd = 1; 3206 break; 3207 } 3208 } else if (sa->sa_family == AF_INET6) { 3209 sa6 = (struct sockaddr_in6 *)sa; 3210 if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr, 3211 &sin6.sin6_addr)) { 3212 fnd = 1; 3213 break; 3214 } 3215 } 3216 } 3217 } 3218 if (fnd == 0) { 3219 /* New address added! no need to look futher. */ 3220 return (1); 3221 } 3222 /* Ok so far lets munge through the rest of the packet */ 3223 mat = in_initpkt; 3224 err_at = 0; 3225 sa_touse = NULL; 3226 offset += sizeof(struct sctp_init_chunk); 3227 phdr = sctp_get_next_param(mat, offset, ¶ms, sizeof(params)); 3228 while (phdr) { 3229 ptype = ntohs(phdr->param_type); 3230 plen = ntohs(phdr->param_length); 3231 if (ptype == SCTP_IPV4_ADDRESS) { 3232 struct sctp_ipv4addr_param *p4, p4_buf; 3233 3234 phdr = sctp_get_next_param(mat, offset, 3235 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 3236 if (plen != sizeof(struct sctp_ipv4addr_param) || 3237 phdr == NULL) { 3238 return (1); 3239 } 3240 p4 = (struct sctp_ipv4addr_param *)phdr; 3241 sin4.sin_addr.s_addr = p4->addr; 3242 sa_touse = (struct sockaddr *)&sin4; 3243 } else if (ptype == SCTP_IPV6_ADDRESS) { 3244 struct sctp_ipv6addr_param *p6, p6_buf; 3245 3246 phdr = sctp_get_next_param(mat, offset, 3247 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 3248 if (plen != sizeof(struct sctp_ipv6addr_param) || 3249 phdr == NULL) { 3250 return (1); 3251 } 3252 p6 = (struct sctp_ipv6addr_param *)phdr; 3253 memcpy((caddr_t)&sin6.sin6_addr, p6->addr, 3254 sizeof(p6->addr)); 3255 sa_touse = (struct sockaddr *)&sin4; 3256 } 3257 if (sa_touse) { 3258 /* ok, sa_touse points to one to check */ 3259 fnd = 0; 3260 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3261 sa = (struct sockaddr *)&net->ro._l_addr; 3262 if (sa->sa_family != sa_touse->sa_family) { 3263 continue; 3264 } 3265 if (sa->sa_family == AF_INET) { 3266 sa4 = (struct sockaddr_in *)sa; 3267 if (sa4->sin_addr.s_addr == 3268 sin4.sin_addr.s_addr) { 3269 fnd = 1; 3270 break; 3271 } 3272 } else if (sa->sa_family == AF_INET6) { 3273 sa6 = (struct sockaddr_in6 *)sa; 3274 if (SCTP6_ARE_ADDR_EQUAL( 3275 &sa6->sin6_addr, &sin6.sin6_addr)) { 3276 fnd = 1; 3277 break; 3278 } 3279 } 3280 } 3281 if (!fnd) { 3282 /* New addr added! no need to look further */ 3283 return (1); 3284 } 3285 } 3286 offset += SCTP_SIZE32(plen); 3287 phdr = sctp_get_next_param(mat, offset, ¶ms, sizeof(params)); 3288 } 3289 return (0); 3290 } 3291 3292 /* 3293 * Given a MBUF chain that was sent into us containing an INIT. Build a 3294 * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done 3295 * a pullup to include IPv6/4header, SCTP header and initial part of INIT 3296 * message (i.e. the struct sctp_init_msg). 3297 */ 3298 void 3299 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 3300 struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh, 3301 struct sctp_init_chunk *init_chk) 3302 { 3303 struct sctp_association *asoc; 3304 struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last; 3305 struct sctp_init_msg *initackm_out; 3306 struct sctp_ecn_supported_param *ecn; 3307 struct sctp_prsctp_supported_param *prsctp; 3308 struct sctp_ecn_nonce_supported_param *ecn_nonce; 3309 struct sctp_supported_chunk_types_param *pr_supported; 3310 struct sockaddr_storage store; 3311 struct sockaddr_in *sin; 3312 struct sockaddr_in6 *sin6; 3313 struct route *ro; 3314 struct ip *iph; 3315 struct ip6_hdr *ip6; 3316 struct sockaddr *to; 3317 struct sctp_state_cookie stc; 3318 struct sctp_nets *net = NULL; 3319 int cnt_inits_to = 0; 3320 uint16_t his_limit, i_want; 3321 int abort_flag, padval, sz_of; 3322 int num_ext; 3323 int p_len; 3324 3325 if (stcb) { 3326 asoc = &stcb->asoc; 3327 } else { 3328 asoc = NULL; 3329 } 3330 m_last = NULL; 3331 if ((asoc != NULL) && 3332 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) && 3333 (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) { 3334 /* new addresses, out of here in non-cookie-wait states */ 3335 /* 3336 * Send a ABORT, we don't add the new address error clause 3337 * though we even set the T bit and copy in the 0 tag.. this 3338 * looks no different than if no listener was present. 3339 */ 3340 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL); 3341 return; 3342 } 3343 abort_flag = 0; 3344 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 3345 (offset + sizeof(struct sctp_init_chunk)), 3346 &abort_flag, (struct sctp_chunkhdr *)init_chk); 3347 if (abort_flag) { 3348 sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err); 3349 return; 3350 } 3351 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 3352 if (m == NULL) { 3353 /* No memory, INIT timer will re-attempt. */ 3354 if (op_err) 3355 sctp_m_freem(op_err); 3356 return; 3357 } 3358 SCTP_BUF_LEN(m) = sizeof(struct sctp_init_msg); 3359 3360 /* the time I built cookie */ 3361 SCTP_GETTIME_TIMEVAL(&stc.time_entered); 3362 3363 /* populate any tie tags */ 3364 if (asoc != NULL) { 3365 /* unlock before tag selections */ 3366 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 3367 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 3368 stc.cookie_life = asoc->cookie_life; 3369 net = asoc->primary_destination; 3370 } else { 3371 stc.tie_tag_my_vtag = 0; 3372 stc.tie_tag_peer_vtag = 0; 3373 /* life I will award this cookie */ 3374 stc.cookie_life = inp->sctp_ep.def_cookie_life; 3375 } 3376 3377 /* copy in the ports for later check */ 3378 stc.myport = sh->dest_port; 3379 stc.peerport = sh->src_port; 3380 3381 /* 3382 * If we wanted to honor cookie life extentions, we would add to 3383 * stc.cookie_life. For now we should NOT honor any extension 3384 */ 3385 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 3386 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 3387 struct inpcb *in_inp; 3388 3389 /* Its a V6 socket */ 3390 in_inp = (struct inpcb *)inp; 3391 stc.ipv6_addr_legal = 1; 3392 /* Now look at the binding flag to see if V4 will be legal */ 3393 if ( 3394 (in_inp->inp_flags & IN6P_IPV6_V6ONLY) 3395 == 0) { 3396 stc.ipv4_addr_legal = 1; 3397 } else { 3398 /* V4 addresses are NOT legal on the association */ 3399 stc.ipv4_addr_legal = 0; 3400 } 3401 } else { 3402 /* Its a V4 socket, no - V6 */ 3403 stc.ipv4_addr_legal = 1; 3404 stc.ipv6_addr_legal = 0; 3405 } 3406 3407 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE 3408 stc.ipv4_scope = 1; 3409 #else 3410 stc.ipv4_scope = 0; 3411 #endif 3412 /* now for scope setup */ 3413 memset((caddr_t)&store, 0, sizeof(store)); 3414 sin = (struct sockaddr_in *)&store; 3415 sin6 = (struct sockaddr_in6 *)&store; 3416 if (net == NULL) { 3417 to = (struct sockaddr *)&store; 3418 iph = mtod(init_pkt, struct ip *); 3419 if (iph->ip_v == IPVERSION) { 3420 struct in_addr addr; 3421 struct route iproute; 3422 3423 sin->sin_family = AF_INET; 3424 sin->sin_len = sizeof(struct sockaddr_in); 3425 sin->sin_port = sh->src_port; 3426 sin->sin_addr = iph->ip_src; 3427 /* lookup address */ 3428 stc.address[0] = sin->sin_addr.s_addr; 3429 stc.address[1] = 0; 3430 stc.address[2] = 0; 3431 stc.address[3] = 0; 3432 stc.addr_type = SCTP_IPV4_ADDRESS; 3433 /* local from address */ 3434 memset(&iproute, 0, sizeof(iproute)); 3435 ro = &iproute; 3436 memcpy(&ro->ro_dst, sin, sizeof(*sin)); 3437 addr = sctp_ipv4_source_address_selection(inp, NULL, 3438 ro, NULL, 0); 3439 if (ro->ro_rt) { 3440 RTFREE(ro->ro_rt); 3441 } 3442 stc.laddress[0] = addr.s_addr; 3443 stc.laddress[1] = 0; 3444 stc.laddress[2] = 0; 3445 stc.laddress[3] = 0; 3446 stc.laddr_type = SCTP_IPV4_ADDRESS; 3447 /* scope_id is only for v6 */ 3448 stc.scope_id = 0; 3449 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE 3450 if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) { 3451 stc.ipv4_scope = 1; 3452 } 3453 #else 3454 stc.ipv4_scope = 1; 3455 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */ 3456 /* Must use the address in this case */ 3457 if (sctp_is_address_on_local_host((struct sockaddr *)sin)) { 3458 stc.loopback_scope = 1; 3459 stc.ipv4_scope = 1; 3460 stc.site_scope = 1; 3461 stc.local_scope = 1; 3462 } 3463 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 3464 struct in6_addr addr; 3465 3466 struct route_in6 iproute6; 3467 3468 ip6 = mtod(init_pkt, struct ip6_hdr *); 3469 sin6->sin6_family = AF_INET6; 3470 sin6->sin6_len = sizeof(struct sockaddr_in6); 3471 sin6->sin6_port = sh->src_port; 3472 sin6->sin6_addr = ip6->ip6_src; 3473 /* lookup address */ 3474 memcpy(&stc.address, &sin6->sin6_addr, 3475 sizeof(struct in6_addr)); 3476 sin6->sin6_scope_id = 0; 3477 stc.addr_type = SCTP_IPV6_ADDRESS; 3478 stc.scope_id = 0; 3479 if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) { 3480 stc.loopback_scope = 1; 3481 stc.local_scope = 1; 3482 stc.site_scope = 1; 3483 stc.ipv4_scope = 1; 3484 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 3485 /* 3486 * If the new destination is a LINK_LOCAL we 3487 * must have common both site and local 3488 * scope. Don't set local scope though since 3489 * we must depend on the source to be added 3490 * implicitly. We cannot assure just because 3491 * we share one link that all links are 3492 * common. 3493 */ 3494 stc.local_scope = 0; 3495 stc.site_scope = 1; 3496 stc.ipv4_scope = 1; 3497 /* 3498 * we start counting for the private address 3499 * stuff at 1. since the link local we 3500 * source from won't show up in our scoped 3501 * count. 3502 */ 3503 cnt_inits_to = 1; 3504 /* pull out the scope_id from incoming pkt */ 3505 /* FIX ME: does this have scope from rcvif? */ 3506 (void)sa6_recoverscope(sin6); 3507 3508 sa6_embedscope(sin6, ip6_use_defzone); 3509 stc.scope_id = sin6->sin6_scope_id; 3510 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) { 3511 /* 3512 * If the new destination is SITE_LOCAL then 3513 * we must have site scope in common. 3514 */ 3515 stc.site_scope = 1; 3516 } 3517 /* local from address */ 3518 memset(&iproute6, 0, sizeof(iproute6)); 3519 ro = (struct route *)&iproute6; 3520 memcpy(&ro->ro_dst, sin6, sizeof(*sin6)); 3521 addr = sctp_ipv6_source_address_selection(inp, NULL, 3522 ro, NULL, 0); 3523 if (ro->ro_rt) { 3524 RTFREE(ro->ro_rt); 3525 } 3526 memcpy(&stc.laddress, &addr, sizeof(struct in6_addr)); 3527 stc.laddr_type = SCTP_IPV6_ADDRESS; 3528 } 3529 } else { 3530 /* set the scope per the existing tcb */ 3531 struct sctp_nets *lnet; 3532 3533 stc.loopback_scope = asoc->loopback_scope; 3534 stc.ipv4_scope = asoc->ipv4_local_scope; 3535 stc.site_scope = asoc->site_scope; 3536 stc.local_scope = asoc->local_scope; 3537 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 3538 if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) { 3539 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) { 3540 /* 3541 * if we have a LL address, start 3542 * counting at 1. 3543 */ 3544 cnt_inits_to = 1; 3545 } 3546 } 3547 } 3548 3549 /* use the net pointer */ 3550 to = (struct sockaddr *)&net->ro._l_addr; 3551 if (to->sa_family == AF_INET) { 3552 sin = (struct sockaddr_in *)to; 3553 stc.address[0] = sin->sin_addr.s_addr; 3554 stc.address[1] = 0; 3555 stc.address[2] = 0; 3556 stc.address[3] = 0; 3557 stc.addr_type = SCTP_IPV4_ADDRESS; 3558 if (net->src_addr_selected == 0) { 3559 /* 3560 * strange case here, the INIT should have 3561 * did the selection. 3562 */ 3563 net->ro._s_addr.sin.sin_addr = 3564 sctp_ipv4_source_address_selection(inp, 3565 stcb, (struct route *)&net->ro, net, 0); 3566 net->src_addr_selected = 1; 3567 3568 } 3569 stc.laddress[0] = net->ro._s_addr.sin.sin_addr.s_addr; 3570 stc.laddress[1] = 0; 3571 stc.laddress[2] = 0; 3572 stc.laddress[3] = 0; 3573 stc.laddr_type = SCTP_IPV4_ADDRESS; 3574 } else if (to->sa_family == AF_INET6) { 3575 sin6 = (struct sockaddr_in6 *)to; 3576 memcpy(&stc.address, &sin6->sin6_addr, 3577 sizeof(struct in6_addr)); 3578 stc.addr_type = SCTP_IPV6_ADDRESS; 3579 if (net->src_addr_selected == 0) { 3580 /* 3581 * strange case here, the INIT should have 3582 * did the selection. 3583 */ 3584 net->ro._s_addr.sin6.sin6_addr = 3585 sctp_ipv6_source_address_selection(inp, 3586 stcb, (struct route *)&net->ro, net, 0); 3587 net->src_addr_selected = 1; 3588 } 3589 memcpy(&stc.laddress, &net->ro._l_addr.sin6.sin6_addr, 3590 sizeof(struct in6_addr)); 3591 stc.laddr_type = SCTP_IPV6_ADDRESS; 3592 } 3593 } 3594 /* Now lets put the SCTP header in place */ 3595 initackm_out = mtod(m, struct sctp_init_msg *); 3596 initackm_out->sh.src_port = inp->sctp_lport; 3597 initackm_out->sh.dest_port = sh->src_port; 3598 initackm_out->sh.v_tag = init_chk->init.initiate_tag; 3599 /* Save it off for quick ref */ 3600 stc.peers_vtag = init_chk->init.initiate_tag; 3601 initackm_out->sh.checksum = 0; /* calculate later */ 3602 /* who are we */ 3603 memcpy(stc.identification, SCTP_VERSION_STRING, 3604 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 3605 /* now the chunk header */ 3606 initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK; 3607 initackm_out->msg.ch.chunk_flags = 0; 3608 /* fill in later from mbuf we build */ 3609 initackm_out->msg.ch.chunk_length = 0; 3610 /* place in my tag */ 3611 if ((asoc != NULL) && 3612 ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 3613 (SCTP_GET_STATE(asoc) == SCTP_STATE_INUSE) || 3614 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) { 3615 /* re-use the v-tags and init-seq here */ 3616 initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag); 3617 initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number); 3618 } else { 3619 if (asoc) { 3620 atomic_add_int(&asoc->refcnt, 1); 3621 SCTP_TCB_UNLOCK(stcb); 3622 initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp)); 3623 /* get a TSN to use too */ 3624 initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 3625 SCTP_TCB_LOCK(stcb); 3626 atomic_add_int(&asoc->refcnt, -1); 3627 } else { 3628 initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp)); 3629 /* get a TSN to use too */ 3630 initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 3631 } 3632 } 3633 /* save away my tag to */ 3634 stc.my_vtag = initackm_out->msg.init.initiate_tag; 3635 3636 /* set up some of the credits. */ 3637 initackm_out->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.sb_hiwat, SCTP_MINIMAL_RWND)); 3638 /* set what I want */ 3639 his_limit = ntohs(init_chk->init.num_inbound_streams); 3640 /* choose what I want */ 3641 if (asoc != NULL) { 3642 if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) { 3643 i_want = asoc->streamoutcnt; 3644 } else { 3645 i_want = inp->sctp_ep.pre_open_stream_count; 3646 } 3647 } else { 3648 i_want = inp->sctp_ep.pre_open_stream_count; 3649 } 3650 if (his_limit < i_want) { 3651 /* I Want more :< */ 3652 initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams; 3653 } else { 3654 /* I can have what I want :> */ 3655 initackm_out->msg.init.num_outbound_streams = htons(i_want); 3656 } 3657 /* tell him his limt. */ 3658 initackm_out->msg.init.num_inbound_streams = 3659 htons(inp->sctp_ep.max_open_streams_intome); 3660 /* setup the ECN pointer */ 3661 3662 if (inp->sctp_ep.adaptation_layer_indicator) { 3663 struct sctp_adaptation_layer_indication *ali; 3664 3665 ali = (struct sctp_adaptation_layer_indication *)( 3666 (caddr_t)initackm_out + sizeof(*initackm_out)); 3667 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 3668 ali->ph.param_length = htons(sizeof(*ali)); 3669 ali->indication = ntohl(inp->sctp_ep.adaptation_layer_indicator); 3670 SCTP_BUF_LEN(m) += sizeof(*ali); 3671 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali + 3672 sizeof(*ali)); 3673 } else { 3674 ecn = (struct sctp_ecn_supported_param *)( 3675 (caddr_t)initackm_out + sizeof(*initackm_out)); 3676 } 3677 3678 /* ECN parameter */ 3679 if (sctp_ecn_enable == 1) { 3680 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE); 3681 ecn->ph.param_length = htons(sizeof(*ecn)); 3682 SCTP_BUF_LEN(m) += sizeof(*ecn); 3683 3684 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn + 3685 sizeof(*ecn)); 3686 } else { 3687 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn); 3688 } 3689 /* And now tell the peer we do pr-sctp */ 3690 prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED); 3691 prsctp->ph.param_length = htons(sizeof(*prsctp)); 3692 SCTP_BUF_LEN(m) += sizeof(*prsctp); 3693 3694 /* And now tell the peer we do all the extensions */ 3695 pr_supported = (struct sctp_supported_chunk_types_param *) 3696 ((caddr_t)prsctp + sizeof(*prsctp)); 3697 3698 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 3699 num_ext = 0; 3700 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 3701 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 3702 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 3703 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 3704 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 3705 if (!sctp_auth_disable) 3706 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 3707 p_len = sizeof(*pr_supported) + num_ext; 3708 pr_supported->ph.param_length = htons(p_len); 3709 bzero((caddr_t)pr_supported + p_len, SCTP_SIZE32(p_len) - p_len); 3710 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 3711 3712 /* ECN nonce: And now tell the peer we support ECN nonce */ 3713 if (sctp_ecn_nonce) { 3714 ecn_nonce = (struct sctp_ecn_nonce_supported_param *) 3715 ((caddr_t)pr_supported + SCTP_SIZE32(p_len)); 3716 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED); 3717 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce)); 3718 SCTP_BUF_LEN(m) += sizeof(*ecn_nonce); 3719 } 3720 /* add authentication parameters */ 3721 if (!sctp_auth_disable) { 3722 struct sctp_auth_random *random; 3723 struct sctp_auth_hmac_algo *hmacs; 3724 struct sctp_auth_chunk_list *chunks; 3725 uint16_t random_len; 3726 3727 /* generate and add RANDOM parameter */ 3728 random_len = sctp_auth_random_len; 3729 random = (struct sctp_auth_random *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 3730 random->ph.param_type = htons(SCTP_RANDOM); 3731 p_len = sizeof(*random) + random_len; 3732 random->ph.param_length = htons(p_len); 3733 SCTP_READ_RANDOM(random->random_data, random_len); 3734 /* zero out any padding required */ 3735 bzero((caddr_t)random + p_len, SCTP_SIZE32(p_len) - p_len); 3736 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 3737 3738 /* add HMAC_ALGO parameter */ 3739 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 3740 p_len = sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs, 3741 (uint8_t *) hmacs->hmac_ids); 3742 if (p_len > 0) { 3743 p_len += sizeof(*hmacs); 3744 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 3745 hmacs->ph.param_length = htons(p_len); 3746 /* zero out any padding required */ 3747 bzero((caddr_t)hmacs + p_len, SCTP_SIZE32(p_len) - p_len); 3748 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 3749 } 3750 /* add CHUNKS parameter */ 3751 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 3752 p_len = sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks, 3753 chunks->chunk_types); 3754 if (p_len > 0) { 3755 p_len += sizeof(*chunks); 3756 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 3757 chunks->ph.param_length = htons(p_len); 3758 /* zero out any padding required */ 3759 bzero((caddr_t)chunks + p_len, SCTP_SIZE32(p_len) - p_len); 3760 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 3761 } 3762 } 3763 m_at = m; 3764 /* now the addresses */ 3765 { 3766 struct sctp_scoping scp; 3767 3768 /* 3769 * To optimize this we could put the scoping stuff into a 3770 * structure and remove the individual uint8's from the stc 3771 * structure. Then we could just pass in the address within 3772 * the stc.. but for now this is a quick hack to get the 3773 * address stuff teased apart. 3774 */ 3775 scp.ipv4_addr_legal = stc.ipv4_addr_legal; 3776 scp.ipv6_addr_legal = stc.ipv6_addr_legal; 3777 scp.loopback_scope = stc.loopback_scope; 3778 scp.ipv4_local_scope = stc.ipv4_scope; 3779 scp.local_scope = stc.local_scope; 3780 scp.site_scope = stc.site_scope; 3781 m_at = sctp_add_addresses_to_i_ia(inp, &scp, m_at, cnt_inits_to); 3782 } 3783 3784 /* tack on the operational error if present */ 3785 if (op_err) { 3786 struct mbuf *ol; 3787 int llen; 3788 3789 llen = 0; 3790 ol = op_err; 3791 while (ol) { 3792 llen += SCTP_BUF_LEN(ol); 3793 ol = SCTP_BUF_NEXT(ol); 3794 } 3795 if (llen % 4) { 3796 /* must add a pad to the param */ 3797 uint32_t cpthis = 0; 3798 int padlen; 3799 3800 padlen = 4 - (llen % 4); 3801 m_copyback(op_err, llen, padlen, (caddr_t)&cpthis); 3802 } 3803 while (SCTP_BUF_NEXT(m_at) != NULL) { 3804 m_at = SCTP_BUF_NEXT(m_at); 3805 } 3806 SCTP_BUF_NEXT(m_at) = op_err; 3807 while (SCTP_BUF_NEXT(m_at) != NULL) { 3808 m_at = SCTP_BUF_NEXT(m_at); 3809 } 3810 } 3811 /* Get total size of init packet */ 3812 sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length)); 3813 /* pre-calulate the size and update pkt header and chunk header */ 3814 p_len = 0; 3815 for (m_tmp = m; m_tmp; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 3816 p_len += SCTP_BUF_LEN(m_tmp); 3817 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 3818 /* m_tmp should now point to last one */ 3819 break; 3820 } 3821 } 3822 /* 3823 * Figure now the size of the cookie. We know the size of the 3824 * INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK, 3825 * COOKIE-STRUCTURE and SIGNATURE. 3826 */ 3827 3828 /* 3829 * take our earlier INIT calc and add in the sz we just calculated 3830 * minus the size of the sctphdr (its not included in chunk size 3831 */ 3832 3833 /* add once for the INIT-ACK */ 3834 sz_of += (p_len - sizeof(struct sctphdr)); 3835 3836 /* add a second time for the INIT-ACK in the cookie */ 3837 sz_of += (p_len - sizeof(struct sctphdr)); 3838 3839 /* Now add the cookie header and cookie message struct */ 3840 sz_of += sizeof(struct sctp_state_cookie_param); 3841 /* ...and add the size of our signature */ 3842 sz_of += SCTP_SIGNATURE_SIZE; 3843 initackm_out->msg.ch.chunk_length = htons(sz_of); 3844 3845 /* Now we must build a cookie */ 3846 m_cookie = sctp_add_cookie(inp, init_pkt, offset, m, 3847 sizeof(struct sctphdr), &stc); 3848 if (m_cookie == NULL) { 3849 /* memory problem */ 3850 sctp_m_freem(m); 3851 return; 3852 } 3853 /* Now append the cookie to the end and update the space/size */ 3854 SCTP_BUF_NEXT(m_tmp) = m_cookie; 3855 for (; m_tmp; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 3856 p_len += SCTP_BUF_LEN(m_tmp); 3857 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 3858 /* m_tmp should now point to last one */ 3859 m_last = m_tmp; 3860 break; 3861 } 3862 } 3863 3864 /* 3865 * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the return 3866 * here since the timer will drive a retranmission. 3867 */ 3868 padval = p_len % 4; 3869 if ((padval) && (m_last)) { 3870 /* see my previous comments on m_last */ 3871 int ret; 3872 3873 ret = sctp_add_pad_tombuf(m_last, (4 - padval)); 3874 if (ret) { 3875 /* Houston we have a problem, no space */ 3876 sctp_m_freem(m); 3877 return; 3878 } 3879 p_len += padval; 3880 } 3881 sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0, 3882 NULL, 0); 3883 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 3884 } 3885 3886 3887 void 3888 sctp_insert_on_wheel(struct sctp_tcb *stcb, 3889 struct sctp_association *asoc, 3890 struct sctp_stream_out *strq, int holds_lock) 3891 { 3892 struct sctp_stream_out *stre, *strn; 3893 3894 if (holds_lock == 0) 3895 SCTP_TCB_SEND_LOCK(stcb); 3896 if ((strq->next_spoke.tqe_next) || 3897 (strq->next_spoke.tqe_prev)) { 3898 /* already on wheel */ 3899 goto outof_here; 3900 } 3901 stre = TAILQ_FIRST(&asoc->out_wheel); 3902 if (stre == NULL) { 3903 /* only one on wheel */ 3904 TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke); 3905 goto outof_here; 3906 } 3907 for (; stre; stre = strn) { 3908 strn = TAILQ_NEXT(stre, next_spoke); 3909 if (stre->stream_no > strq->stream_no) { 3910 TAILQ_INSERT_BEFORE(stre, strq, next_spoke); 3911 goto outof_here; 3912 } else if (stre->stream_no == strq->stream_no) { 3913 /* huh, should not happen */ 3914 goto outof_here; 3915 } else if (strn == NULL) { 3916 /* next one is null */ 3917 TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq, 3918 next_spoke); 3919 } 3920 } 3921 outof_here: 3922 if (holds_lock == 0) 3923 SCTP_TCB_SEND_UNLOCK(stcb); 3924 3925 3926 } 3927 3928 static void 3929 sctp_remove_from_wheel(struct sctp_tcb *stcb, 3930 struct sctp_association *asoc, 3931 struct sctp_stream_out *strq) 3932 { 3933 /* take off and then setup so we know it is not on the wheel */ 3934 SCTP_TCB_SEND_LOCK(stcb); 3935 if (TAILQ_FIRST(&strq->outqueue)) { 3936 /* more was added */ 3937 SCTP_TCB_SEND_UNLOCK(stcb); 3938 return; 3939 } 3940 TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke); 3941 strq->next_spoke.tqe_next = NULL; 3942 strq->next_spoke.tqe_prev = NULL; 3943 SCTP_TCB_SEND_UNLOCK(stcb); 3944 } 3945 3946 static void 3947 sctp_prune_prsctp(struct sctp_tcb *stcb, 3948 struct sctp_association *asoc, 3949 struct sctp_sndrcvinfo *srcv, 3950 int dataout) 3951 { 3952 int freed_spc = 0; 3953 struct sctp_tmit_chunk *chk, *nchk; 3954 3955 SCTP_TCB_LOCK_ASSERT(stcb); 3956 if ((asoc->peer_supports_prsctp) && 3957 (asoc->sent_queue_cnt_removeable > 0)) { 3958 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 3959 /* 3960 * Look for chunks marked with the PR_SCTP flag AND 3961 * the buffer space flag. If the one being sent is 3962 * equal or greater priority then purge the old one 3963 * and free some space. 3964 */ 3965 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 3966 /* 3967 * This one is PR-SCTP AND buffer space 3968 * limited type 3969 */ 3970 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 3971 /* 3972 * Lower numbers equates to higher 3973 * priority so if the one we are 3974 * looking at has a larger or equal 3975 * priority we want to drop the data 3976 * and NOT retransmit it. 3977 */ 3978 if (chk->data) { 3979 /* 3980 * We release the book_size 3981 * if the mbuf is here 3982 */ 3983 int ret_spc; 3984 int cause; 3985 3986 if (chk->sent > SCTP_DATAGRAM_UNSENT) 3987 cause = SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT; 3988 else 3989 cause = SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_UNSENT; 3990 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 3991 cause, 3992 &asoc->sent_queue); 3993 freed_spc += ret_spc; 3994 if (freed_spc >= dataout) { 3995 return; 3996 } 3997 } /* if chunk was present */ 3998 } /* if of sufficent priority */ 3999 } /* if chunk has enabled */ 4000 } /* tailqforeach */ 4001 4002 chk = TAILQ_FIRST(&asoc->send_queue); 4003 while (chk) { 4004 nchk = TAILQ_NEXT(chk, sctp_next); 4005 /* Here we must move to the sent queue and mark */ 4006 if (PR_SCTP_TTL_ENABLED(chk->flags)) { 4007 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 4008 if (chk->data) { 4009 /* 4010 * We release the book_size 4011 * if the mbuf is here 4012 */ 4013 int ret_spc; 4014 4015 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 4016 SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_UNSENT, 4017 &asoc->send_queue); 4018 4019 freed_spc += ret_spc; 4020 if (freed_spc >= dataout) { 4021 return; 4022 } 4023 } /* end if chk->data */ 4024 } /* end if right class */ 4025 } /* end if chk pr-sctp */ 4026 chk = nchk; 4027 } /* end while (chk) */ 4028 } /* if enabled in asoc */ 4029 } 4030 4031 __inline int 4032 sctp_get_frag_point(struct sctp_tcb *stcb, 4033 struct sctp_association *asoc) 4034 { 4035 int siz, ovh; 4036 4037 /* 4038 * For endpoints that have both v6 and v4 addresses we must reserve 4039 * room for the ipv6 header, for those that are only dealing with V4 4040 * we use a larger frag point. 4041 */ 4042 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 4043 ovh = SCTP_MED_OVERHEAD; 4044 } else { 4045 ovh = SCTP_MED_V4_OVERHEAD; 4046 } 4047 4048 if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu) 4049 siz = asoc->smallest_mtu - ovh; 4050 else 4051 siz = (stcb->sctp_ep->sctp_frag_point - ovh); 4052 /* 4053 * if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { 4054 */ 4055 /* A data chunk MUST fit in a cluster */ 4056 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk)); */ 4057 /* } */ 4058 4059 /* adjust for an AUTH chunk if DATA requires auth */ 4060 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) 4061 siz -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 4062 4063 if (siz % 4) { 4064 /* make it an even word boundary please */ 4065 siz -= (siz % 4); 4066 } 4067 return (siz); 4068 } 4069 extern unsigned int sctp_max_chunks_on_queue; 4070 4071 static void 4072 sctp_set_prsctp_policy(struct sctp_tcb *stcb, 4073 struct sctp_stream_queue_pending *sp) 4074 { 4075 sp->pr_sctp_on = 0; 4076 if (stcb->asoc.peer_supports_prsctp) { 4077 /* 4078 * We assume that the user wants PR_SCTP_TTL if the user 4079 * provides a positive lifetime but does not specify any 4080 * PR_SCTP policy. This is a BAD assumption and causes 4081 * problems at least with the U-Vancovers MPI folks. I will 4082 * change this to be no policy means NO PR-SCTP. 4083 */ 4084 if (PR_SCTP_ENABLED(sp->sinfo_flags)) { 4085 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 4086 sp->pr_sctp_on = 1; 4087 } else { 4088 return; 4089 } 4090 switch (PR_SCTP_POLICY(sp->sinfo_flags)) { 4091 case CHUNK_FLAGS_PR_SCTP_BUF: 4092 /* 4093 * Time to live is a priority stored in tv_sec when 4094 * doing the buffer drop thing. 4095 */ 4096 sp->ts.tv_sec = sp->timetolive; 4097 sp->ts.tv_usec = 0; 4098 break; 4099 case CHUNK_FLAGS_PR_SCTP_TTL: 4100 { 4101 struct timeval tv; 4102 4103 SCTP_GETTIME_TIMEVAL(&sp->ts); 4104 tv.tv_sec = sp->timetolive / 1000; 4105 tv.tv_usec = (sp->timetolive * 1000) % 1000000; 4106 timevaladd(&sp->ts, &tv); 4107 } 4108 break; 4109 case CHUNK_FLAGS_PR_SCTP_RTX: 4110 /* 4111 * Time to live is a the number or retransmissions 4112 * stored in tv_sec. 4113 */ 4114 sp->ts.tv_sec = sp->timetolive; 4115 sp->ts.tv_usec = 0; 4116 break; 4117 default: 4118 #ifdef SCTP_DEBUG 4119 if (sctp_debug_on & SCTP_DEBUG_USRREQ1) { 4120 printf("Unknown PR_SCTP policy %u.\n", PR_SCTP_POLICY(sp->sinfo_flags)); 4121 } 4122 #endif 4123 break; 4124 } 4125 } 4126 } 4127 4128 static int 4129 sctp_msg_append(struct sctp_tcb *stcb, 4130 struct sctp_nets *net, 4131 struct mbuf *m, 4132 struct sctp_sndrcvinfo *srcv, int hold_stcb_lock) 4133 { 4134 int error = 0, holds_lock; 4135 struct mbuf *at; 4136 struct sctp_stream_queue_pending *sp = NULL; 4137 struct sctp_stream_out *strm; 4138 4139 /* 4140 * Given an mbuf chain, put it into the association send queue and 4141 * place it on the wheel 4142 */ 4143 holds_lock = hold_stcb_lock; 4144 if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) { 4145 /* Invalid stream number */ 4146 error = EINVAL; 4147 goto out_now; 4148 } 4149 if ((stcb->asoc.stream_locked) && 4150 (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) { 4151 error = EAGAIN; 4152 goto out_now; 4153 } 4154 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 4155 /* Now can we send this? */ 4156 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_SENT) || 4157 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 4158 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 4159 (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) { 4160 /* got data while shutting down */ 4161 error = ECONNRESET; 4162 goto out_now; 4163 } 4164 sp = (struct sctp_stream_queue_pending *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_strmoq); 4165 if (sp == NULL) { 4166 error = ENOMEM; 4167 goto out_now; 4168 } 4169 SCTP_INCR_STRMOQ_COUNT(); 4170 sp->sinfo_flags = srcv->sinfo_flags; 4171 sp->timetolive = srcv->sinfo_timetolive; 4172 sp->ppid = srcv->sinfo_ppid; 4173 sp->context = srcv->sinfo_context; 4174 sp->strseq = 0; 4175 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 4176 sp->net = net; 4177 sp->addr_over = 1; 4178 } else { 4179 sp->net = stcb->asoc.primary_destination; 4180 sp->addr_over = 0; 4181 } 4182 atomic_add_int(&sp->net->ref_count, 1); 4183 SCTP_GETTIME_TIMEVAL(&sp->ts); 4184 sp->stream = srcv->sinfo_stream; 4185 sp->msg_is_complete = 1; 4186 sp->some_taken = 0; 4187 sp->data = m; 4188 sp->tail_mbuf = NULL; 4189 sp->length = 0; 4190 at = m; 4191 sctp_set_prsctp_policy(stcb, sp); 4192 /* 4193 * We could in theory (for sendall) pass the length in, but we would 4194 * still have to hunt through the chain since we need to setup the 4195 * tail_mbuf 4196 */ 4197 while (at) { 4198 if (SCTP_BUF_NEXT(at) == NULL) 4199 sp->tail_mbuf = at; 4200 sp->length += SCTP_BUF_LEN(at); 4201 at = SCTP_BUF_NEXT(at); 4202 } 4203 SCTP_TCB_SEND_LOCK(stcb); 4204 sctp_snd_sb_alloc(stcb, sp->length); 4205 stcb->asoc.stream_queue_cnt++; 4206 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 4207 if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) { 4208 sp->strseq = strm->next_sequence_sent; 4209 strm->next_sequence_sent++; 4210 } 4211 if ((strm->next_spoke.tqe_next == NULL) && 4212 (strm->next_spoke.tqe_prev == NULL)) { 4213 /* Not on wheel, insert */ 4214 sctp_insert_on_wheel(stcb, &stcb->asoc, strm, 1); 4215 } 4216 m = NULL; 4217 SCTP_TCB_SEND_UNLOCK(stcb); 4218 out_now: 4219 if (m) { 4220 sctp_m_freem(m); 4221 } 4222 return (error); 4223 } 4224 4225 4226 static struct mbuf * 4227 sctp_copy_mbufchain(struct mbuf *clonechain, 4228 struct mbuf *outchain, 4229 struct mbuf **endofchain, 4230 int can_take_mbuf, 4231 int sizeofcpy, 4232 uint8_t copy_by_ref) 4233 { 4234 struct mbuf *m; 4235 struct mbuf *appendchain; 4236 caddr_t cp; 4237 int len; 4238 4239 if (endofchain == NULL) { 4240 /* error */ 4241 error_out: 4242 if (outchain) 4243 sctp_m_freem(outchain); 4244 return (NULL); 4245 } 4246 if (can_take_mbuf) { 4247 appendchain = clonechain; 4248 } else { 4249 if (!copy_by_ref && (sizeofcpy <= ((((sctp_mbuf_threshold_count - 1) * MLEN) + MHLEN)))) { 4250 /* Its not in a cluster */ 4251 if (*endofchain == NULL) { 4252 /* lets get a mbuf cluster */ 4253 if (outchain == NULL) { 4254 /* This is the general case */ 4255 new_mbuf: 4256 outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_HEADER); 4257 if (outchain == NULL) { 4258 goto error_out; 4259 } 4260 SCTP_BUF_LEN(outchain) = 0; 4261 *endofchain = outchain; 4262 /* get the prepend space */ 4263 SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4)); 4264 } else { 4265 /* 4266 * We really should not get a NULL 4267 * in endofchain 4268 */ 4269 /* find end */ 4270 m = outchain; 4271 while (m) { 4272 if (SCTP_BUF_NEXT(m) == NULL) { 4273 *endofchain = m; 4274 break; 4275 } 4276 m = SCTP_BUF_NEXT(m); 4277 } 4278 /* sanity */ 4279 if (*endofchain == NULL) { 4280 /* 4281 * huh, TSNH XXX maybe we 4282 * should panic 4283 */ 4284 sctp_m_freem(outchain); 4285 goto new_mbuf; 4286 } 4287 } 4288 /* get the new end of length */ 4289 len = M_TRAILINGSPACE(*endofchain); 4290 } else { 4291 /* how much is left at the end? */ 4292 len = M_TRAILINGSPACE(*endofchain); 4293 } 4294 /* Find the end of the data, for appending */ 4295 cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain))); 4296 4297 /* Now lets copy it out */ 4298 if (len >= sizeofcpy) { 4299 /* It all fits, copy it in */ 4300 m_copydata(clonechain, 0, sizeofcpy, cp); 4301 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 4302 } else { 4303 /* fill up the end of the chain */ 4304 if (len > 0) { 4305 m_copydata(clonechain, 0, len, cp); 4306 SCTP_BUF_LEN((*endofchain)) += len; 4307 /* now we need another one */ 4308 sizeofcpy -= len; 4309 } 4310 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_HEADER); 4311 if (m == NULL) { 4312 /* We failed */ 4313 goto error_out; 4314 } 4315 SCTP_BUF_NEXT((*endofchain)) = m; 4316 *endofchain = m; 4317 cp = mtod((*endofchain), caddr_t); 4318 m_copydata(clonechain, len, sizeofcpy, cp); 4319 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 4320 } 4321 return (outchain); 4322 } else { 4323 /* copy the old fashion way */ 4324 appendchain = m_copy(clonechain, 0, M_COPYALL); 4325 } 4326 } 4327 if (appendchain == NULL) { 4328 /* error */ 4329 if (outchain) 4330 sctp_m_freem(outchain); 4331 return (NULL); 4332 } 4333 if (outchain) { 4334 /* tack on to the end */ 4335 if (*endofchain != NULL) { 4336 SCTP_BUF_NEXT(((*endofchain))) = appendchain; 4337 } else { 4338 m = outchain; 4339 while (m) { 4340 if (SCTP_BUF_NEXT(m) == NULL) { 4341 SCTP_BUF_NEXT(m) = appendchain; 4342 break; 4343 } 4344 m = SCTP_BUF_NEXT(m); 4345 } 4346 } 4347 /* 4348 * save off the end and update the end-chain postion 4349 */ 4350 m = appendchain; 4351 while (m) { 4352 if (SCTP_BUF_NEXT(m) == NULL) { 4353 *endofchain = m; 4354 break; 4355 } 4356 m = SCTP_BUF_NEXT(m); 4357 } 4358 return (outchain); 4359 } else { 4360 /* save off the end and update the end-chain postion */ 4361 m = appendchain; 4362 while (m) { 4363 if (SCTP_BUF_NEXT(m) == NULL) { 4364 *endofchain = m; 4365 break; 4366 } 4367 m = SCTP_BUF_NEXT(m); 4368 } 4369 return (appendchain); 4370 } 4371 } 4372 4373 int 4374 sctp_med_chunk_output(struct sctp_inpcb *inp, 4375 struct sctp_tcb *stcb, 4376 struct sctp_association *asoc, 4377 int *num_out, 4378 int *reason_code, 4379 int control_only, int *cwnd_full, int from_where, 4380 struct timeval *now, int *now_filled, int frag_point); 4381 4382 static void 4383 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, 4384 uint32_t val) 4385 { 4386 struct sctp_copy_all *ca; 4387 struct mbuf *m; 4388 int ret = 0; 4389 int added_control = 0; 4390 int un_sent, do_chunk_output = 1; 4391 struct sctp_association *asoc; 4392 4393 ca = (struct sctp_copy_all *)ptr; 4394 if (ca->m == NULL) { 4395 return; 4396 } 4397 if (ca->inp != inp) { 4398 /* TSNH */ 4399 return; 4400 } 4401 if ((ca->m) && ca->sndlen) { 4402 m = m_copym(ca->m, 0, M_COPYALL, M_DONTWAIT); 4403 if (m == NULL) { 4404 /* can't copy so we are done */ 4405 ca->cnt_failed++; 4406 return; 4407 } 4408 } else { 4409 m = NULL; 4410 } 4411 SCTP_TCB_LOCK_ASSERT(stcb); 4412 if (ca->sndrcv.sinfo_flags & SCTP_ABORT) { 4413 /* Abort this assoc with m as the user defined reason */ 4414 if (m) { 4415 struct sctp_paramhdr *ph; 4416 4417 SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_DONTWAIT); 4418 if (m) { 4419 ph = mtod(m, struct sctp_paramhdr *); 4420 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 4421 ph->param_length = htons(ca->sndlen); 4422 } 4423 /* 4424 * We add one here to keep the assoc from 4425 * dis-appearing on us. 4426 */ 4427 atomic_add_int(&stcb->asoc.refcnt, 1); 4428 sctp_abort_an_association(inp, stcb, 4429 SCTP_RESPONSE_TO_USER_REQ, 4430 m); 4431 /* 4432 * sctp_abort_an_association calls sctp_free_asoc() 4433 * free association will NOT free it since we 4434 * incremented the refcnt .. we do this to prevent 4435 * it being freed and things getting tricky since we 4436 * could end up (from free_asoc) calling inpcb_free 4437 * which would get a recursive lock call to the 4438 * iterator lock.. But as a consequence of that the 4439 * stcb will return to us un-locked.. since 4440 * free_asoc returns with either no TCB or the TCB 4441 * unlocked, we must relock.. to unlock in the 4442 * iterator timer :-0 4443 */ 4444 SCTP_TCB_LOCK(stcb); 4445 atomic_add_int(&stcb->asoc.refcnt, -1); 4446 goto no_chunk_output; 4447 } 4448 } else { 4449 if (m) { 4450 ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m, 4451 &ca->sndrcv, 1); 4452 } 4453 asoc = &stcb->asoc; 4454 if (ca->sndrcv.sinfo_flags & SCTP_EOF) { 4455 /* shutdown this assoc */ 4456 if (TAILQ_EMPTY(&asoc->send_queue) && 4457 TAILQ_EMPTY(&asoc->sent_queue) && 4458 (asoc->stream_queue_cnt == 0)) { 4459 if (asoc->locked_on_sending) { 4460 goto abort_anyway; 4461 } 4462 /* 4463 * there is nothing queued to send, so I'm 4464 * done... 4465 */ 4466 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 4467 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 4468 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 4469 /* 4470 * only send SHUTDOWN the first time 4471 * through 4472 */ 4473 sctp_send_shutdown(stcb, stcb->asoc.primary_destination); 4474 asoc->state = SCTP_STATE_SHUTDOWN_SENT; 4475 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 4476 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 4477 asoc->primary_destination); 4478 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 4479 asoc->primary_destination); 4480 added_control = 1; 4481 do_chunk_output = 0; 4482 } 4483 } else { 4484 /* 4485 * we still got (or just got) data to send, 4486 * so set SHUTDOWN_PENDING 4487 */ 4488 /* 4489 * XXX sockets draft says that SCTP_EOF 4490 * should be sent with no data. currently, 4491 * we will allow user data to be sent first 4492 * and move to SHUTDOWN-PENDING 4493 */ 4494 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 4495 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 4496 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 4497 if (asoc->locked_on_sending) { 4498 /* 4499 * Locked to send out the 4500 * data 4501 */ 4502 struct sctp_stream_queue_pending *sp; 4503 4504 sp = TAILQ_LAST(&asoc->locked_on_sending->outqueue, sctp_streamhead); 4505 if (sp) { 4506 if ((sp->length == 0) && (sp->msg_is_complete == 0)) 4507 asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT; 4508 } 4509 } 4510 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 4511 if (TAILQ_EMPTY(&asoc->send_queue) && 4512 TAILQ_EMPTY(&asoc->sent_queue) && 4513 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 4514 abort_anyway: 4515 atomic_add_int(&stcb->asoc.refcnt, 1); 4516 sctp_abort_an_association(stcb->sctp_ep, stcb, 4517 SCTP_RESPONSE_TO_USER_REQ, 4518 NULL); 4519 atomic_add_int(&stcb->asoc.refcnt, -1); 4520 goto no_chunk_output; 4521 } 4522 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 4523 asoc->primary_destination); 4524 } 4525 } 4526 4527 } 4528 } 4529 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 4530 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk))); 4531 4532 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 4533 (stcb->asoc.total_flight > 0) && 4534 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) 4535 ) { 4536 do_chunk_output = 0; 4537 } 4538 if (do_chunk_output) 4539 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND); 4540 else if (added_control) { 4541 int num_out = 0, reason = 0, cwnd_full = 0, now_filled = 0; 4542 struct timeval now; 4543 int frag_point; 4544 4545 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 4546 sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 4547 &reason, 1, &cwnd_full, 1, &now, &now_filled, frag_point); 4548 } 4549 no_chunk_output: 4550 if (ret) { 4551 ca->cnt_failed++; 4552 } else { 4553 ca->cnt_sent++; 4554 } 4555 } 4556 4557 static void 4558 sctp_sendall_completes(void *ptr, uint32_t val) 4559 { 4560 struct sctp_copy_all *ca; 4561 4562 ca = (struct sctp_copy_all *)ptr; 4563 /* 4564 * Do a notify here? Kacheong suggests that the notify be done at 4565 * the send time.. so you would push up a notification if any send 4566 * failed. Don't know if this is feasable since the only failures we 4567 * have is "memory" related and if you cannot get an mbuf to send 4568 * the data you surely can't get an mbuf to send up to notify the 4569 * user you can't send the data :-> 4570 */ 4571 4572 /* now free everything */ 4573 sctp_m_freem(ca->m); 4574 SCTP_FREE(ca); 4575 } 4576 4577 4578 #define MC_ALIGN(m, len) do { \ 4579 SCTP_BUF_RESV_UF(m, ((MCLBYTES - (len)) & ~(sizeof(long) - 1)); \ 4580 } while (0) 4581 4582 4583 4584 static struct mbuf * 4585 sctp_copy_out_all(struct uio *uio, int len) 4586 { 4587 struct mbuf *ret, *at; 4588 int left, willcpy, cancpy, error; 4589 4590 ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAIT, 1, MT_DATA); 4591 if (ret == NULL) { 4592 /* TSNH */ 4593 return (NULL); 4594 } 4595 left = len; 4596 SCTP_BUF_LEN(ret) = 0; 4597 /* save space for the data chunk header */ 4598 cancpy = M_TRAILINGSPACE(ret); 4599 willcpy = min(cancpy, left); 4600 at = ret; 4601 while (left > 0) { 4602 /* Align data to the end */ 4603 error = uiomove(mtod(at, caddr_t), willcpy, uio); 4604 if (error) { 4605 err_out_now: 4606 sctp_m_freem(at); 4607 return (NULL); 4608 } 4609 SCTP_BUF_LEN(at) = willcpy; 4610 SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0; 4611 left -= willcpy; 4612 if (left > 0) { 4613 SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg(left, 0, M_WAIT, 1, MT_DATA); 4614 if (SCTP_BUF_NEXT(at) == NULL) { 4615 goto err_out_now; 4616 } 4617 at = SCTP_BUF_NEXT(at); 4618 SCTP_BUF_LEN(at) = 0; 4619 cancpy = M_TRAILINGSPACE(at); 4620 willcpy = min(cancpy, left); 4621 } 4622 } 4623 return (ret); 4624 } 4625 4626 static int 4627 sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, 4628 struct sctp_sndrcvinfo *srcv) 4629 { 4630 int ret; 4631 struct sctp_copy_all *ca; 4632 4633 SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all), 4634 "CopyAll"); 4635 if (ca == NULL) { 4636 sctp_m_freem(m); 4637 return (ENOMEM); 4638 } 4639 memset(ca, 0, sizeof(struct sctp_copy_all)); 4640 4641 ca->inp = inp; 4642 ca->sndrcv = *srcv; 4643 /* 4644 * take off the sendall flag, it would be bad if we failed to do 4645 * this :-0 4646 */ 4647 ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL; 4648 /* get length and mbuf chain */ 4649 if (uio) { 4650 ca->sndlen = uio->uio_resid; 4651 ca->m = sctp_copy_out_all(uio, ca->sndlen); 4652 if (ca->m == NULL) { 4653 SCTP_FREE(ca); 4654 return (ENOMEM); 4655 } 4656 } else { 4657 /* Gather the length of the send */ 4658 struct mbuf *mat; 4659 4660 mat = m; 4661 ca->sndlen = 0; 4662 while (m) { 4663 ca->sndlen += SCTP_BUF_LEN(m); 4664 m = SCTP_BUF_NEXT(m); 4665 } 4666 ca->m = m; 4667 } 4668 ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, 4669 SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES, SCTP_ASOC_ANY_STATE, 4670 (void *)ca, 0, 4671 sctp_sendall_completes, inp, 1); 4672 if (ret) { 4673 #ifdef SCTP_DEBUG 4674 printf("Failed to initiate iterator for sendall\n"); 4675 #endif 4676 SCTP_FREE(ca); 4677 return (EFAULT); 4678 } 4679 return (0); 4680 } 4681 4682 4683 void 4684 sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc) 4685 { 4686 struct sctp_tmit_chunk *chk, *nchk; 4687 4688 chk = TAILQ_FIRST(&asoc->control_send_queue); 4689 while (chk) { 4690 nchk = TAILQ_NEXT(chk, sctp_next); 4691 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 4692 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 4693 if (chk->data) { 4694 sctp_m_freem(chk->data); 4695 chk->data = NULL; 4696 } 4697 asoc->ctrl_queue_cnt--; 4698 if (chk->whoTo) 4699 sctp_free_remote_addr(chk->whoTo); 4700 sctp_free_a_chunk(stcb, chk); 4701 } 4702 chk = nchk; 4703 } 4704 } 4705 4706 void 4707 sctp_toss_old_asconf(struct sctp_tcb *stcb) 4708 { 4709 struct sctp_association *asoc; 4710 struct sctp_tmit_chunk *chk, *chk_tmp; 4711 4712 asoc = &stcb->asoc; 4713 for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL; 4714 chk = chk_tmp) { 4715 /* get next chk */ 4716 chk_tmp = TAILQ_NEXT(chk, sctp_next); 4717 /* find SCTP_ASCONF chunk in queue (only one ever in queue) */ 4718 if (chk->rec.chunk_id.id == SCTP_ASCONF) { 4719 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 4720 if (chk->data) { 4721 sctp_m_freem(chk->data); 4722 chk->data = NULL; 4723 } 4724 asoc->ctrl_queue_cnt--; 4725 if (chk->whoTo) 4726 sctp_free_remote_addr(chk->whoTo); 4727 sctp_free_a_chunk(stcb, chk); 4728 } 4729 } 4730 } 4731 4732 4733 static __inline void 4734 sctp_clean_up_datalist(struct sctp_tcb *stcb, 4735 4736 struct sctp_association *asoc, 4737 struct sctp_tmit_chunk **data_list, 4738 int bundle_at, 4739 struct sctp_nets *net) 4740 { 4741 int i; 4742 struct sctp_tmit_chunk *tp1; 4743 4744 for (i = 0; i < bundle_at; i++) { 4745 /* off of the send queue */ 4746 if (i) { 4747 /* 4748 * Any chunk NOT 0 you zap the time chunk 0 gets 4749 * zapped or set based on if a RTO measurment is 4750 * needed. 4751 */ 4752 data_list[i]->do_rtt = 0; 4753 } 4754 /* record time */ 4755 data_list[i]->sent_rcv_time = net->last_sent_time; 4756 data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.TSN_seq; 4757 TAILQ_REMOVE(&asoc->send_queue, 4758 data_list[i], 4759 sctp_next); 4760 /* on to the sent queue */ 4761 tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead); 4762 if ((tp1) && (compare_with_wrap(tp1->rec.data.TSN_seq, 4763 data_list[i]->rec.data.TSN_seq, MAX_TSN))) { 4764 struct sctp_tmit_chunk *tpp; 4765 4766 /* need to move back */ 4767 back_up_more: 4768 tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next); 4769 if (tpp == NULL) { 4770 TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next); 4771 goto all_done; 4772 } 4773 tp1 = tpp; 4774 if (compare_with_wrap(tp1->rec.data.TSN_seq, 4775 data_list[i]->rec.data.TSN_seq, MAX_TSN)) { 4776 goto back_up_more; 4777 } 4778 TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next); 4779 } else { 4780 TAILQ_INSERT_TAIL(&asoc->sent_queue, 4781 data_list[i], 4782 sctp_next); 4783 } 4784 all_done: 4785 /* This does not lower until the cum-ack passes it */ 4786 asoc->sent_queue_cnt++; 4787 asoc->send_queue_cnt--; 4788 if ((asoc->peers_rwnd <= 0) && 4789 (asoc->total_flight == 0) && 4790 (bundle_at == 1)) { 4791 /* Mark the chunk as being a window probe */ 4792 SCTP_STAT_INCR(sctps_windowprobed); 4793 data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE; 4794 } else { 4795 data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE; 4796 } 4797 #ifdef SCTP_AUDITING_ENABLED 4798 sctp_audit_log(0xC2, 3); 4799 #endif 4800 data_list[i]->sent = SCTP_DATAGRAM_SENT; 4801 data_list[i]->snd_count = 1; 4802 data_list[i]->rec.data.chunk_was_revoked = 0; 4803 #ifdef SCTP_FLIGHT_LOGGING 4804 sctp_misc_ints(SCTP_FLIGHT_LOG_UP, 4805 data_list[i]->whoTo->flight_size, 4806 data_list[i]->book_size, 4807 (uintptr_t) stcb, 4808 data_list[i]->rec.data.TSN_seq); 4809 #endif 4810 net->flight_size += data_list[i]->book_size; 4811 asoc->total_flight += data_list[i]->book_size; 4812 asoc->total_flight_count++; 4813 #ifdef SCTP_LOG_RWND 4814 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 4815 asoc->peers_rwnd, data_list[i]->send_size, sctp_peer_chunk_oh); 4816 #endif 4817 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 4818 (uint32_t) (data_list[i]->send_size + sctp_peer_chunk_oh)); 4819 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 4820 /* SWS sender side engages */ 4821 asoc->peers_rwnd = 0; 4822 } 4823 } 4824 } 4825 4826 static __inline void 4827 sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc) 4828 { 4829 struct sctp_tmit_chunk *chk, *nchk; 4830 4831 for (chk = TAILQ_FIRST(&asoc->control_send_queue); 4832 chk; chk = nchk) { 4833 nchk = TAILQ_NEXT(chk, sctp_next); 4834 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 4835 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 4836 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 4837 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 4838 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 4839 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 4840 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 4841 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 4842 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 4843 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 4844 /* Stray chunks must be cleaned up */ 4845 clean_up_anyway: 4846 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 4847 if (chk->data) { 4848 sctp_m_freem(chk->data); 4849 chk->data = NULL; 4850 } 4851 asoc->ctrl_queue_cnt--; 4852 sctp_free_remote_addr(chk->whoTo); 4853 sctp_free_a_chunk(stcb, chk); 4854 } else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 4855 /* special handling, we must look into the param */ 4856 if (chk != asoc->str_reset) { 4857 goto clean_up_anyway; 4858 } 4859 } 4860 } 4861 } 4862 4863 extern int sctp_min_split_point; 4864 4865 static __inline int 4866 sctp_can_we_split_this(struct sctp_tcb *stcb, 4867 struct sctp_stream_queue_pending *sp, 4868 int goal_mtu, int frag_point, int eeor_on) 4869 { 4870 /* 4871 * Make a decision on if I should split a msg into multiple parts. 4872 */ 4873 if (goal_mtu < sctp_min_split_point) { 4874 /* you don't want enough */ 4875 return (0); 4876 } 4877 if (sp->msg_is_complete == 0) { 4878 if (eeor_on) { 4879 /* 4880 * If we are doing EEOR we need to always send it if 4881 * its the entire thing. 4882 */ 4883 if (goal_mtu >= sp->length) 4884 return (sp->length); 4885 } else { 4886 if (goal_mtu >= sp->length) { 4887 /* 4888 * If we cannot fill the amount needed there 4889 * is no sense of splitting the chunk. 4890 */ 4891 return (0); 4892 } 4893 } 4894 /* 4895 * If we reach here sp->length is larger than the goal_mtu. 4896 * Do we wish to split it for the sake of packet putting 4897 * together? 4898 */ 4899 if (goal_mtu >= min(sctp_min_split_point, stcb->asoc.smallest_mtu)) { 4900 /* Its ok to split it */ 4901 return (min(goal_mtu, frag_point)); 4902 } 4903 } else { 4904 /* We can always split a complete message to make it fit */ 4905 if (goal_mtu >= sp->length) 4906 /* Take it all */ 4907 return (sp->length); 4908 4909 return (min(goal_mtu, frag_point)); 4910 } 4911 /* Nope, can't split */ 4912 return (0); 4913 4914 } 4915 4916 static int 4917 sctp_move_to_outqueue(struct sctp_tcb *stcb, struct sctp_nets *net, 4918 struct sctp_stream_out *strq, 4919 int goal_mtu, 4920 int frag_point, 4921 int *locked, 4922 int *giveup, 4923 int eeor_mode) 4924 { 4925 /* Move from the stream to the send_queue keeping track of the total */ 4926 struct sctp_association *asoc; 4927 struct sctp_stream_queue_pending *sp; 4928 struct sctp_tmit_chunk *chk; 4929 struct sctp_data_chunk *dchkh; 4930 int to_move; 4931 uint8_t rcv_flags = 0; 4932 uint8_t some_taken; 4933 uint8_t took_all = 0; 4934 4935 SCTP_TCB_LOCK_ASSERT(stcb); 4936 asoc = &stcb->asoc; 4937 sp = TAILQ_FIRST(&strq->outqueue); 4938 if (sp == NULL) { 4939 *locked = 0; 4940 SCTP_TCB_SEND_LOCK(stcb); 4941 if (strq->last_msg_incomplete) { 4942 printf("Huh? Stream:%d lm_in_c=%d but queue is NULL\n", 4943 strq->stream_no, strq->last_msg_incomplete); 4944 strq->last_msg_incomplete = 0; 4945 } 4946 SCTP_TCB_SEND_UNLOCK(stcb); 4947 return (0); 4948 } 4949 SCTP_TCB_SEND_LOCK(stcb); 4950 if ((sp->length == 0) && (sp->msg_is_complete == 0)) { 4951 /* Must wait for more data, must be last msg */ 4952 *locked = 1; 4953 *giveup = 1; 4954 SCTP_TCB_SEND_UNLOCK(stcb); 4955 return (0); 4956 } else if (sp->length == 0) { 4957 /* This should not happen */ 4958 panic("sp length is 0?"); 4959 } 4960 some_taken = sp->some_taken; 4961 if ((goal_mtu >= sp->length) && (sp->msg_is_complete)) { 4962 /* It all fits and its a complete msg, no brainer */ 4963 to_move = min(sp->length, frag_point); 4964 if (to_move == sp->length) { 4965 /* Getting it all */ 4966 if (sp->some_taken) { 4967 rcv_flags |= SCTP_DATA_LAST_FRAG; 4968 } else { 4969 rcv_flags |= SCTP_DATA_NOT_FRAG; 4970 } 4971 } else { 4972 /* Not getting it all, frag point overrides */ 4973 if (sp->some_taken == 0) { 4974 rcv_flags |= SCTP_DATA_FIRST_FRAG; 4975 } 4976 sp->some_taken = 1; 4977 } 4978 } else { 4979 to_move = sctp_can_we_split_this(stcb, sp, goal_mtu, 4980 frag_point, eeor_mode); 4981 if (to_move) { 4982 if (to_move >= sp->length) { 4983 to_move = sp->length; 4984 } 4985 if (sp->some_taken == 0) { 4986 rcv_flags |= SCTP_DATA_FIRST_FRAG; 4987 } 4988 sp->some_taken = 1; 4989 } else { 4990 if (sp->some_taken) { 4991 *locked = 1; 4992 } 4993 *giveup = 1; 4994 SCTP_TCB_SEND_UNLOCK(stcb); 4995 return (0); 4996 } 4997 } 4998 SCTP_TCB_SEND_UNLOCK(stcb); 4999 /* If we reach here, we can copy out a chunk */ 5000 sctp_alloc_a_chunk(stcb, chk); 5001 if (chk == NULL) { 5002 /* No chunk memory */ 5003 out_gu: 5004 *giveup = 1; 5005 return (0); 5006 } 5007 /* 5008 * Setup for unordered if needed by looking at the user sent info 5009 * flags. 5010 */ 5011 if (sp->sinfo_flags & SCTP_UNORDERED) { 5012 rcv_flags |= SCTP_DATA_UNORDERED; 5013 } 5014 /* clear out the chunk before setting up */ 5015 memset(chk, sizeof(*chk), 0); 5016 chk->rec.data.rcv_flags = rcv_flags; 5017 SCTP_TCB_SEND_LOCK(stcb); 5018 if (SCTP_BUF_IS_EXTENDED(sp->data)) { 5019 chk->copy_by_ref = 1; 5020 } else { 5021 chk->copy_by_ref = 0; 5022 } 5023 if (to_move >= sp->length) { 5024 /* we can steal the whole thing */ 5025 chk->data = sp->data; 5026 chk->last_mbuf = sp->tail_mbuf; 5027 /* register the stealing */ 5028 sp->data = sp->tail_mbuf = NULL; 5029 took_all = 1; 5030 } else { 5031 struct mbuf *m; 5032 5033 chk->data = m_copym(sp->data, 0, to_move, M_DONTWAIT); 5034 chk->last_mbuf = NULL; 5035 if (chk->data == NULL) { 5036 sp->some_taken = some_taken; 5037 sctp_free_a_chunk(stcb, chk); 5038 SCTP_TCB_SEND_UNLOCK(stcb); 5039 goto out_gu; 5040 } 5041 /* Pull off the data */ 5042 m_adj(sp->data, to_move); 5043 /* Now lets work our way down and compact it */ 5044 m = sp->data; 5045 while (m && (SCTP_BUF_LEN(m) == 0)) { 5046 sp->data = SCTP_BUF_NEXT(m); 5047 SCTP_BUF_NEXT(m) = NULL; 5048 if (sp->tail_mbuf == m) { 5049 /* freeing tail */ 5050 sp->tail_mbuf = sp->data; 5051 } 5052 sctp_m_free(m); 5053 m = sp->data; 5054 } 5055 } 5056 if (to_move > sp->length) { 5057 panic("Huh, how can to_move be larger?"); 5058 } else { 5059 sp->length -= to_move; 5060 } 5061 5062 if (M_LEADINGSPACE(chk->data) < sizeof(struct sctp_data_chunk)) { 5063 /* Not enough room for a chunk header, get some */ 5064 struct mbuf *m; 5065 5066 m = sctp_get_mbuf_for_msg(1, 0, M_DONTWAIT, 0, MT_DATA); 5067 if (m == NULL) { 5068 /* 5069 * we're in trouble here. _PREPEND below will free 5070 * all the data if there is no leading space, so we 5071 * must put the data back and restore. 5072 */ 5073 if (took_all) { 5074 /* unsteal the data */ 5075 sp->data = chk->data; 5076 sp->tail_mbuf = chk->last_mbuf; 5077 } else { 5078 struct mbuf *m; 5079 5080 /* reassemble the data */ 5081 m = sp->data; 5082 sp->data = chk->data; 5083 SCTP_BUF_NEXT(sp->data) = m; 5084 } 5085 sp->some_taken = some_taken; 5086 sp->length += to_move; 5087 sctp_free_a_chunk(stcb, chk); 5088 SCTP_TCB_SEND_UNLOCK(stcb); 5089 goto out_gu; 5090 } else { 5091 SCTP_BUF_LEN(m) = 0; 5092 SCTP_BUF_NEXT(m) = chk->data; 5093 chk->data = m; 5094 M_ALIGN(chk->data, 4); 5095 } 5096 } 5097 SCTP_BUF_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_DONTWAIT); 5098 if (chk->data == NULL) { 5099 /* HELP */ 5100 sctp_free_a_chunk(stcb, chk); 5101 SCTP_TCB_SEND_UNLOCK(stcb); 5102 goto out_gu; 5103 } 5104 sctp_snd_sb_alloc(stcb, sizeof(struct sctp_data_chunk)); 5105 chk->book_size = chk->send_size = (to_move + 5106 sizeof(struct sctp_data_chunk)); 5107 chk->sent = SCTP_DATAGRAM_UNSENT; 5108 5109 /* 5110 * get last_mbuf and counts of mb useage This is ugly but hopefully 5111 * its only one mbuf. 5112 */ 5113 if (chk->last_mbuf == NULL) { 5114 chk->last_mbuf = chk->data; 5115 while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) { 5116 chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf); 5117 } 5118 } 5119 chk->flags = 0; 5120 chk->asoc = &stcb->asoc; 5121 chk->pad_inplace = 0; 5122 chk->no_fr_allowed = 0; 5123 chk->rec.data.stream_seq = sp->strseq; 5124 chk->rec.data.stream_number = sp->stream; 5125 chk->rec.data.payloadtype = sp->ppid; 5126 chk->rec.data.context = sp->context; 5127 chk->rec.data.doing_fast_retransmit = 0; 5128 chk->rec.data.ect_nonce = 0; /* ECN Nonce */ 5129 5130 chk->rec.data.timetodrop = sp->ts; 5131 chk->flags = sp->act_flags; 5132 chk->addr_over = sp->addr_over; 5133 5134 chk->whoTo = net; 5135 atomic_add_int(&chk->whoTo->ref_count, 1); 5136 5137 chk->rec.data.TSN_seq = atomic_fetchadd_int(&asoc->sending_seq, 1); 5138 #ifdef SCTP_LOG_SENDING_STR 5139 sctp_misc_ints(SCTP_STRMOUT_LOG_SEND, 5140 (uintptr_t) stcb, (uintptr_t) sp, 5141 (uint32_t) ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq), 5142 chk->rec.data.TSN_seq); 5143 #endif 5144 5145 dchkh = mtod(chk->data, struct sctp_data_chunk *); 5146 /* 5147 * Put the rest of the things in place now. Size was done earlier in 5148 * previous loop prior to padding. 5149 */ 5150 dchkh->ch.chunk_type = SCTP_DATA; 5151 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 5152 dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq); 5153 dchkh->dp.stream_id = htons(strq->stream_no); 5154 dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq); 5155 dchkh->dp.protocol_id = chk->rec.data.payloadtype; 5156 dchkh->ch.chunk_length = htons(chk->send_size); 5157 /* Now advance the chk->send_size by the actual pad needed. */ 5158 if (chk->send_size < SCTP_SIZE32(chk->book_size)) { 5159 /* need a pad */ 5160 struct mbuf *lm; 5161 int pads; 5162 5163 pads = SCTP_SIZE32(chk->book_size) - chk->send_size; 5164 if (sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf) == 0) { 5165 chk->pad_inplace = 1; 5166 } 5167 if ((lm = SCTP_BUF_NEXT(chk->last_mbuf)) != NULL) { 5168 /* pad added an mbuf */ 5169 chk->last_mbuf = lm; 5170 } 5171 chk->send_size += pads; 5172 } 5173 /* We only re-set the policy if it is on */ 5174 if (sp->pr_sctp_on) { 5175 sctp_set_prsctp_policy(stcb, sp); 5176 } 5177 if (sp->msg_is_complete && (sp->length == 0)) { 5178 /* All done pull and kill the message */ 5179 asoc->stream_queue_cnt--; 5180 TAILQ_REMOVE(&strq->outqueue, sp, next); 5181 sctp_free_remote_addr(sp->net); 5182 if (sp->data) { 5183 sctp_m_freem(sp->data); 5184 sp->data = NULL; 5185 } 5186 sctp_free_a_strmoq(stcb, sp); 5187 5188 /* we can't be locked to it */ 5189 *locked = 0; 5190 stcb->asoc.locked_on_sending = NULL; 5191 } else { 5192 /* more to go, we are locked */ 5193 *locked = 1; 5194 } 5195 asoc->chunks_on_out_queue++; 5196 if (sp->pr_sctp_on) { 5197 asoc->pr_sctp_cnt++; 5198 chk->pr_sctp_on = 1; 5199 } else { 5200 chk->pr_sctp_on = 0; 5201 } 5202 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 5203 asoc->send_queue_cnt++; 5204 SCTP_TCB_SEND_UNLOCK(stcb); 5205 return (to_move); 5206 } 5207 5208 5209 static struct sctp_stream_out * 5210 sctp_select_a_stream(struct sctp_tcb *stcb, struct sctp_association *asoc) 5211 { 5212 struct sctp_stream_out *strq; 5213 5214 /* Find the next stream to use */ 5215 if (asoc->last_out_stream == NULL) { 5216 strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel); 5217 if (asoc->last_out_stream == NULL) { 5218 /* huh nothing on the wheel, TSNH */ 5219 return (NULL); 5220 } 5221 goto done_it; 5222 } 5223 strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke); 5224 done_it: 5225 if (strq == NULL) { 5226 strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel); 5227 } 5228 return (strq); 5229 5230 } 5231 5232 static void 5233 sctp_fill_outqueue(struct sctp_tcb *stcb, 5234 struct sctp_nets *net, int frag_point, int eeor_mode) 5235 { 5236 struct sctp_association *asoc; 5237 struct sctp_stream_out *strq, *strqn; 5238 int goal_mtu, moved_how_much, total_moved = 0; 5239 int locked, giveup; 5240 struct sctp_stream_queue_pending *sp; 5241 5242 SCTP_TCB_LOCK_ASSERT(stcb); 5243 asoc = &stcb->asoc; 5244 #ifdef AF_INET6 5245 if (net->ro._l_addr.sin6.sin6_family == AF_INET6) { 5246 goal_mtu = net->mtu - SCTP_MIN_OVERHEAD; 5247 } else { 5248 /* ?? not sure what else to do */ 5249 goal_mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 5250 } 5251 #else 5252 goal_mtu = net->mtu - SCTP_MIN_OVERHEAD; 5253 mtu_fromwheel = 0; 5254 #endif 5255 /* Need an allowance for the data chunk header too */ 5256 goal_mtu -= sizeof(struct sctp_data_chunk); 5257 5258 /* must make even word boundary */ 5259 goal_mtu &= 0xfffffffc; 5260 if (asoc->locked_on_sending) { 5261 /* We are stuck on one stream until the message completes. */ 5262 strqn = strq = asoc->locked_on_sending; 5263 locked = 1; 5264 } else { 5265 strqn = strq = sctp_select_a_stream(stcb, asoc); 5266 locked = 0; 5267 } 5268 5269 while ((goal_mtu > 0) && strq) { 5270 sp = TAILQ_FIRST(&strq->outqueue); 5271 /* 5272 * If CMT is off, we must validate that the stream in 5273 * question has the first item pointed towards are network 5274 * destionation requested by the caller. Note that if we 5275 * turn out to be locked to a stream (assigning TSN's then 5276 * we must stop, since we cannot look for another stream 5277 * with data to send to that destination). In CMT's case, by 5278 * skipping this check, we will send one data packet towards 5279 * the requested net. 5280 */ 5281 if (sp == NULL) { 5282 break; 5283 } 5284 if ((sp->net != net) && (sctp_cmt_on_off == 0)) { 5285 /* none for this network */ 5286 if (locked) { 5287 break; 5288 } else { 5289 strq = sctp_select_a_stream(stcb, asoc); 5290 if (strq == NULL) 5291 /* none left */ 5292 break; 5293 if (strqn == strq) { 5294 /* I have circled */ 5295 break; 5296 } 5297 continue; 5298 } 5299 } 5300 giveup = 0; 5301 moved_how_much = sctp_move_to_outqueue(stcb, net, strq, goal_mtu, frag_point, &locked, 5302 &giveup, eeor_mode); 5303 asoc->last_out_stream = strq; 5304 if (locked) { 5305 asoc->locked_on_sending = strq; 5306 if ((moved_how_much == 0) || (giveup)) 5307 /* no more to move for now */ 5308 break; 5309 } else { 5310 asoc->locked_on_sending = NULL; 5311 if (TAILQ_FIRST(&strq->outqueue) == NULL) { 5312 sctp_remove_from_wheel(stcb, asoc, strq); 5313 } 5314 if (giveup) { 5315 break; 5316 } 5317 strq = sctp_select_a_stream(stcb, asoc); 5318 if (strq == NULL) { 5319 break; 5320 } 5321 } 5322 total_moved += moved_how_much; 5323 goal_mtu -= moved_how_much; 5324 goal_mtu &= 0xfffffffc; 5325 } 5326 if (total_moved == 0) { 5327 if ((sctp_cmt_on_off == 0) && 5328 (net == stcb->asoc.primary_destination)) { 5329 /* ran dry for primary network net */ 5330 SCTP_STAT_INCR(sctps_primary_randry); 5331 } else if (sctp_cmt_on_off) { 5332 /* ran dry with CMT on */ 5333 SCTP_STAT_INCR(sctps_cmt_randry); 5334 } 5335 } 5336 } 5337 5338 __inline void 5339 sctp_fix_ecn_echo(struct sctp_association *asoc) 5340 { 5341 struct sctp_tmit_chunk *chk; 5342 5343 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 5344 if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 5345 chk->sent = SCTP_DATAGRAM_UNSENT; 5346 } 5347 } 5348 } 5349 5350 static void 5351 sctp_move_to_an_alt(struct sctp_tcb *stcb, 5352 struct sctp_association *asoc, 5353 struct sctp_nets *net) 5354 { 5355 struct sctp_tmit_chunk *chk; 5356 struct sctp_nets *a_net; 5357 5358 SCTP_TCB_LOCK_ASSERT(stcb); 5359 a_net = sctp_find_alternate_net(stcb, net, 0); 5360 if ((a_net != net) && 5361 ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) { 5362 /* 5363 * We only proceed if a valid alternate is found that is not 5364 * this one and is reachable. Here we must move all chunks 5365 * queued in the send queue off of the destination address 5366 * to our alternate. 5367 */ 5368 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 5369 if (chk->whoTo == net) { 5370 /* Move the chunk to our alternate */ 5371 sctp_free_remote_addr(chk->whoTo); 5372 chk->whoTo = a_net; 5373 atomic_add_int(&a_net->ref_count, 1); 5374 } 5375 } 5376 } 5377 } 5378 5379 extern int sctp_early_fr; 5380 5381 int 5382 sctp_med_chunk_output(struct sctp_inpcb *inp, 5383 struct sctp_tcb *stcb, 5384 struct sctp_association *asoc, 5385 int *num_out, 5386 int *reason_code, 5387 int control_only, int *cwnd_full, int from_where, 5388 struct timeval *now, int *now_filled, int frag_point) 5389 { 5390 /* 5391 * Ok this is the generic chunk service queue. we must do the 5392 * following: - Service the stream queue that is next, moving any 5393 * message (note I must get a complete message i.e. FIRST/MIDDLE and 5394 * LAST to the out queue in one pass) and assigning TSN's - Check to 5395 * see if the cwnd/rwnd allows any output, if so we go ahead and 5396 * fomulate and send the low level chunks. Making sure to combine 5397 * any control in the control chunk queue also. 5398 */ 5399 struct sctp_nets *net; 5400 struct mbuf *outchain, *endoutchain; 5401 struct sctp_tmit_chunk *chk, *nchk; 5402 struct sctphdr *shdr; 5403 5404 /* temp arrays for unlinking */ 5405 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 5406 int no_fragmentflg, error; 5407 int one_chunk, hbflag; 5408 int asconf, cookie, no_out_cnt; 5409 int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind, eeor_mode; 5410 unsigned int mtu, r_mtu, omtu, mx_mtu, to_out; 5411 5412 *num_out = 0; 5413 struct sctp_nets *start_at, *old_startat = NULL, *send_start_at; 5414 5415 cwnd_full_ind = 0; 5416 int tsns_sent = 0; 5417 uint32_t auth_offset = 0; 5418 struct sctp_auth_chunk *auth = NULL; 5419 5420 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) || 5421 (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED) || 5422 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 5423 eeor_mode = 1; 5424 } else { 5425 eeor_mode = 0; 5426 } 5427 ctl_cnt = no_out_cnt = asconf = cookie = 0; 5428 /* 5429 * First lets prime the pump. For each destination, if there is room 5430 * in the flight size, attempt to pull an MTU's worth out of the 5431 * stream queues into the general send_queue 5432 */ 5433 #ifdef SCTP_AUDITING_ENABLED 5434 sctp_audit_log(0xC2, 2); 5435 #endif 5436 SCTP_TCB_LOCK_ASSERT(stcb); 5437 hbflag = 0; 5438 if ((control_only) || (asoc->stream_reset_outstanding)) 5439 no_data_chunks = 1; 5440 else 5441 no_data_chunks = 0; 5442 5443 /* Nothing to possible to send? */ 5444 if (TAILQ_EMPTY(&asoc->control_send_queue) && 5445 TAILQ_EMPTY(&asoc->send_queue) && 5446 TAILQ_EMPTY(&asoc->out_wheel)) { 5447 *reason_code = 9; 5448 return (0); 5449 } 5450 if (asoc->peers_rwnd == 0) { 5451 /* No room in peers rwnd */ 5452 *cwnd_full = 1; 5453 *reason_code = 1; 5454 if (asoc->total_flight > 0) { 5455 /* we are allowed one chunk in flight */ 5456 no_data_chunks = 1; 5457 } 5458 } 5459 if ((no_data_chunks == 0) && (!TAILQ_EMPTY(&asoc->out_wheel))) { 5460 if (sctp_cmt_on_off) { 5461 /* 5462 * for CMT we start at the next one past the one we 5463 * last added data to. 5464 */ 5465 if (TAILQ_FIRST(&asoc->send_queue) != NULL) { 5466 goto skip_the_fill_from_streams; 5467 } 5468 if (asoc->last_net_data_came_from) { 5469 net = TAILQ_NEXT(asoc->last_net_data_came_from, sctp_next); 5470 if (net == NULL) { 5471 net = TAILQ_FIRST(&asoc->nets); 5472 } 5473 } else { 5474 /* back to start */ 5475 net = TAILQ_FIRST(&asoc->nets); 5476 } 5477 5478 } else { 5479 net = asoc->primary_destination; 5480 if (net == NULL) { 5481 /* TSNH */ 5482 net = TAILQ_FIRST(&asoc->nets); 5483 } 5484 } 5485 start_at = net; 5486 one_more_time: 5487 for (; net != NULL; net = TAILQ_NEXT(net, sctp_next)) { 5488 if (old_startat && (old_startat == net)) { 5489 break; 5490 } 5491 if ((sctp_cmt_on_off == 0) && (net->ref_count < 2)) { 5492 /* nothing can be in queue for this guy */ 5493 continue; 5494 } 5495 if (net->flight_size >= net->cwnd) { 5496 /* skip this network, no room */ 5497 cwnd_full_ind++; 5498 continue; 5499 } 5500 /* 5501 * @@@ JRI : this for loop we are in takes in each 5502 * net, if its's got space in cwnd and has data sent 5503 * to it (when CMT is off) then it calls 5504 * sctp_fill_outqueue for the net. This gets data on 5505 * the send queue for that network. 5506 * 5507 * In sctp_fill_outqueue TSN's are assigned and data is 5508 * copied out of the stream buffers. Note mostly 5509 * copy by reference (we hope). 5510 */ 5511 #ifdef SCTP_CWND_LOGGING 5512 sctp_log_cwnd(stcb, net, 0, SCTP_CWND_LOG_FILL_OUTQ_CALLED); 5513 #endif 5514 sctp_fill_outqueue(stcb, net, frag_point, eeor_mode); 5515 } 5516 if (start_at != TAILQ_FIRST(&asoc->nets)) { 5517 /* got to pick up the beginning stuff. */ 5518 old_startat = start_at; 5519 start_at = net = TAILQ_FIRST(&asoc->nets); 5520 goto one_more_time; 5521 } 5522 } 5523 skip_the_fill_from_streams: 5524 *cwnd_full = cwnd_full_ind; 5525 /* now service each destination and send out what we can for it */ 5526 /* Nothing to send? */ 5527 if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) && 5528 (TAILQ_FIRST(&asoc->send_queue) == NULL)) { 5529 *reason_code = 8; 5530 return (0); 5531 } 5532 chk = TAILQ_FIRST(&asoc->send_queue); 5533 if (chk) { 5534 send_start_at = chk->whoTo; 5535 } else { 5536 send_start_at = TAILQ_FIRST(&asoc->nets); 5537 } 5538 old_startat = NULL; 5539 again_one_more_time: 5540 for (net = send_start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) { 5541 /* how much can we send? */ 5542 /* printf("Examine for sending net:%x\n", (uint32_t)net); */ 5543 if (old_startat && (old_startat == net)) { 5544 /* through list ocmpletely. */ 5545 break; 5546 } 5547 tsns_sent = 0; 5548 if (net->ref_count < 2) { 5549 /* 5550 * Ref-count of 1 so we cannot have data or control 5551 * queued to this address. Skip it. 5552 */ 5553 continue; 5554 } 5555 ctl_cnt = bundle_at = 0; 5556 endoutchain = outchain = NULL; 5557 no_fragmentflg = 1; 5558 one_chunk = 0; 5559 5560 if ((net->ro.ro_rt) && (net->ro.ro_rt->rt_ifp)) { 5561 /* 5562 * if we have a route and an ifp check to see if we 5563 * have room to send to this guy 5564 */ 5565 struct ifnet *ifp; 5566 5567 ifp = net->ro.ro_rt->rt_ifp; 5568 if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) { 5569 SCTP_STAT_INCR(sctps_ifnomemqueued); 5570 #ifdef SCTP_LOG_MAXBURST 5571 sctp_log_maxburst(stcb, net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED); 5572 #endif 5573 continue; 5574 } 5575 } 5576 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) { 5577 mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr)); 5578 } else { 5579 mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)); 5580 } 5581 mx_mtu = mtu; 5582 to_out = 0; 5583 if (mtu > asoc->peers_rwnd) { 5584 if (asoc->total_flight > 0) { 5585 /* We have a packet in flight somewhere */ 5586 r_mtu = asoc->peers_rwnd; 5587 } else { 5588 /* We are always allowed to send one MTU out */ 5589 one_chunk = 1; 5590 r_mtu = mtu; 5591 } 5592 } else { 5593 r_mtu = mtu; 5594 } 5595 /************************/ 5596 /* Control transmission */ 5597 /************************/ 5598 /* Now first lets go through the control queue */ 5599 for (chk = TAILQ_FIRST(&asoc->control_send_queue); 5600 chk; chk = nchk) { 5601 nchk = TAILQ_NEXT(chk, sctp_next); 5602 if (chk->whoTo != net) { 5603 /* 5604 * No, not sent to the network we are 5605 * looking at 5606 */ 5607 continue; 5608 } 5609 if (chk->data == NULL) { 5610 continue; 5611 } 5612 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 5613 /* 5614 * It must be unsent. Cookies and ASCONF's 5615 * hang around but there timers will force 5616 * when marked for resend. 5617 */ 5618 continue; 5619 } 5620 /* 5621 * if no AUTH is yet included and this chunk 5622 * requires it, make sure to account for it. We 5623 * don't apply the size until the AUTH chunk is 5624 * actually added below in case there is no room for 5625 * this chunk. NOTE: we overload the use of "omtu" 5626 * here 5627 */ 5628 if ((auth == NULL) && 5629 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 5630 stcb->asoc.peer_auth_chunks)) { 5631 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 5632 } else 5633 omtu = 0; 5634 /* Here we do NOT factor the r_mtu */ 5635 if ((chk->send_size < (int)(mtu - omtu)) || 5636 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 5637 /* 5638 * We probably should glom the mbuf chain 5639 * from the chk->data for control but the 5640 * problem is it becomes yet one more level 5641 * of tracking to do if for some reason 5642 * output fails. Then I have got to 5643 * reconstruct the merged control chain.. el 5644 * yucko.. for now we take the easy way and 5645 * do the copy 5646 */ 5647 /* 5648 * Add an AUTH chunk, if chunk requires it 5649 * save the offset into the chain for AUTH 5650 */ 5651 if ((auth == NULL) && 5652 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 5653 stcb->asoc.peer_auth_chunks))) { 5654 outchain = sctp_add_auth_chunk(outchain, 5655 &endoutchain, 5656 &auth, 5657 &auth_offset, 5658 stcb, 5659 chk->rec.chunk_id.id); 5660 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 5661 } 5662 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 5663 (int)chk->rec.chunk_id.can_take_data, 5664 chk->send_size, chk->copy_by_ref); 5665 if (outchain == NULL) { 5666 *reason_code = 8; 5667 return (ENOMEM); 5668 } 5669 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 5670 /* update our MTU size */ 5671 if (mtu > (chk->send_size + omtu)) 5672 mtu -= (chk->send_size + omtu); 5673 else 5674 mtu = 0; 5675 to_out += (chk->send_size + omtu); 5676 /* Do clear IP_DF ? */ 5677 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 5678 no_fragmentflg = 0; 5679 } 5680 if (chk->rec.chunk_id.can_take_data) 5681 chk->data = NULL; 5682 /* Mark things to be removed, if needed */ 5683 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 5684 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 5685 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 5686 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 5687 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 5688 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 5689 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 5690 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 5691 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 5692 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 5693 5694 if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) 5695 hbflag = 1; 5696 /* remove these chunks at the end */ 5697 if (chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) { 5698 /* turn off the timer */ 5699 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 5700 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 5701 inp, stcb, net, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1); 5702 } 5703 } 5704 ctl_cnt++; 5705 } else { 5706 /* 5707 * Other chunks, since they have 5708 * timers running (i.e. COOKIE or 5709 * ASCONF) we just "trust" that it 5710 * gets sent or retransmitted. 5711 */ 5712 ctl_cnt++; 5713 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 5714 cookie = 1; 5715 no_out_cnt = 1; 5716 } else if (chk->rec.chunk_id.id == SCTP_ASCONF) { 5717 /* 5718 * set hb flag since we can 5719 * use these for RTO 5720 */ 5721 hbflag = 1; 5722 asconf = 1; 5723 } 5724 chk->sent = SCTP_DATAGRAM_SENT; 5725 chk->snd_count++; 5726 } 5727 if (mtu == 0) { 5728 /* 5729 * Ok we are out of room but we can 5730 * output without effecting the 5731 * flight size since this little guy 5732 * is a control only packet. 5733 */ 5734 if (asconf) { 5735 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 5736 asconf = 0; 5737 } 5738 if (cookie) { 5739 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 5740 cookie = 0; 5741 } 5742 SCTP_BUF_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT); 5743 if (outchain == NULL) { 5744 /* no memory */ 5745 error = ENOBUFS; 5746 goto error_out_again; 5747 } 5748 shdr = mtod(outchain, struct sctphdr *); 5749 shdr->src_port = inp->sctp_lport; 5750 shdr->dest_port = stcb->rport; 5751 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 5752 shdr->checksum = 0; 5753 auth_offset += sizeof(struct sctphdr); 5754 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 5755 (struct sockaddr *)&net->ro._l_addr, 5756 outchain, auth_offset, auth, 5757 no_fragmentflg, 0, NULL, asconf))) { 5758 if (error == ENOBUFS) { 5759 asoc->ifp_had_enobuf = 1; 5760 } 5761 SCTP_STAT_INCR(sctps_lowlevelerr); 5762 if (from_where == 0) { 5763 SCTP_STAT_INCR(sctps_lowlevelerrusr); 5764 } 5765 error_out_again: 5766 /* error, could not output */ 5767 if (hbflag) { 5768 if (*now_filled == 0) { 5769 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 5770 *now_filled = 1; 5771 *now = net->last_sent_time; 5772 } else { 5773 net->last_sent_time = *now; 5774 } 5775 hbflag = 0; 5776 } 5777 if (error == EHOSTUNREACH) { 5778 /* 5779 * Destination went 5780 * unreachable 5781 * during this send 5782 */ 5783 sctp_move_to_an_alt(stcb, asoc, net); 5784 } 5785 sctp_clean_up_ctl(stcb, asoc); 5786 *reason_code = 7; 5787 return (error); 5788 } else 5789 asoc->ifp_had_enobuf = 0; 5790 /* Only HB or ASCONF advances time */ 5791 if (hbflag) { 5792 if (*now_filled == 0) { 5793 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 5794 *now_filled = 1; 5795 *now = net->last_sent_time; 5796 } else { 5797 net->last_sent_time = *now; 5798 } 5799 hbflag = 0; 5800 } 5801 /* 5802 * increase the number we sent, if a 5803 * cookie is sent we don't tell them 5804 * any was sent out. 5805 */ 5806 outchain = endoutchain = NULL; 5807 auth = NULL; 5808 auth_offset = 0; 5809 if (!no_out_cnt) 5810 *num_out += ctl_cnt; 5811 /* recalc a clean slate and setup */ 5812 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5813 mtu = (net->mtu - SCTP_MIN_OVERHEAD); 5814 } else { 5815 mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD); 5816 } 5817 to_out = 0; 5818 no_fragmentflg = 1; 5819 } 5820 } 5821 } 5822 /*********************/ 5823 /* Data transmission */ 5824 /*********************/ 5825 /* 5826 * if AUTH for DATA is required and no AUTH has been added 5827 * yet, account for this in the mtu now... if no data can be 5828 * bundled, this adjustment won't matter anyways since the 5829 * packet will be going out... 5830 */ 5831 if ((auth == NULL) && 5832 sctp_auth_is_required_chunk(SCTP_DATA, 5833 stcb->asoc.peer_auth_chunks)) { 5834 mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 5835 } 5836 /* now lets add any data within the MTU constraints */ 5837 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) { 5838 if (net->mtu > (sizeof(struct ip) + sizeof(struct sctphdr))) 5839 omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr)); 5840 else 5841 omtu = 0; 5842 } else { 5843 if (net->mtu > (sizeof(struct ip6_hdr) + sizeof(struct sctphdr))) 5844 omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)); 5845 else 5846 omtu = 0; 5847 } 5848 if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) || 5849 (cookie)) { 5850 for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) { 5851 if (no_data_chunks) { 5852 /* let only control go out */ 5853 *reason_code = 1; 5854 break; 5855 } 5856 if (net->flight_size >= net->cwnd) { 5857 /* skip this net, no room for data */ 5858 *reason_code = 2; 5859 break; 5860 } 5861 nchk = TAILQ_NEXT(chk, sctp_next); 5862 if (chk->whoTo != net) { 5863 /* No, not sent to this net */ 5864 continue; 5865 } 5866 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 5867 /* 5868 * strange, we have a chunk that is 5869 * to bit for its destination and 5870 * yet no fragment ok flag. 5871 * Something went wrong when the 5872 * PMTU changed...we did not mark 5873 * this chunk for some reason?? I 5874 * will fix it here by letting IP 5875 * fragment it for now and printing 5876 * a warning. This really should not 5877 * happen ... 5878 */ 5879 #ifdef SCTP_DEBUG 5880 printf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 5881 chk->send_size, mtu); 5882 #endif 5883 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 5884 } 5885 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 5886 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 5887 /* ok we will add this one */ 5888 5889 /* 5890 * Add an AUTH chunk, if chunk 5891 * requires it, save the offset into 5892 * the chain for AUTH 5893 */ 5894 if ((auth == NULL) && 5895 (sctp_auth_is_required_chunk(SCTP_DATA, 5896 stcb->asoc.peer_auth_chunks))) { 5897 5898 outchain = sctp_add_auth_chunk(outchain, 5899 &endoutchain, 5900 &auth, 5901 &auth_offset, 5902 stcb, 5903 SCTP_DATA); 5904 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 5905 } 5906 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0, 5907 chk->send_size, chk->copy_by_ref); 5908 if (outchain == NULL) { 5909 #ifdef SCTP_DEBUG 5910 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5911 printf("No memory?\n"); 5912 } 5913 #endif 5914 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 5915 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 5916 } 5917 *reason_code = 3; 5918 return (ENOMEM); 5919 } 5920 /* upate our MTU size */ 5921 /* Do clear IP_DF ? */ 5922 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 5923 no_fragmentflg = 0; 5924 } 5925 /* unsigned subtraction of mtu */ 5926 if (mtu > chk->send_size) 5927 mtu -= chk->send_size; 5928 else 5929 mtu = 0; 5930 /* unsigned subtraction of r_mtu */ 5931 if (r_mtu > chk->send_size) 5932 r_mtu -= chk->send_size; 5933 else 5934 r_mtu = 0; 5935 5936 to_out += chk->send_size; 5937 if (to_out > mx_mtu) { 5938 #ifdef INVARIANTS 5939 panic("gag"); 5940 #else 5941 printf("Exceeding mtu of %d out size is %d\n", 5942 mx_mtu, to_out); 5943 #endif 5944 } 5945 data_list[bundle_at++] = chk; 5946 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 5947 mtu = 0; 5948 break; 5949 } 5950 if (chk->sent == SCTP_DATAGRAM_UNSENT) { 5951 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 5952 SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks); 5953 } else { 5954 SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks); 5955 } 5956 if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) && 5957 ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0)) 5958 SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs); 5959 } 5960 if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) { 5961 break; 5962 } 5963 } else { 5964 /* 5965 * Must be sent in order of the 5966 * TSN's (on a network) 5967 */ 5968 break; 5969 } 5970 } /* for () */ 5971 } /* if asoc.state OPEN */ 5972 /* Is there something to send for this destination? */ 5973 if (outchain) { 5974 /* We may need to start a control timer or two */ 5975 if (asconf) { 5976 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 5977 asconf = 0; 5978 } 5979 if (cookie) { 5980 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 5981 cookie = 0; 5982 } 5983 /* must start a send timer if data is being sent */ 5984 if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) { 5985 /* 5986 * no timer running on this destination 5987 * restart it. 5988 */ 5989 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 5990 } 5991 /* Now send it, if there is anything to send :> */ 5992 SCTP_BUF_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT); 5993 if (outchain == NULL) { 5994 /* out of mbufs */ 5995 error = ENOBUFS; 5996 goto errored_send; 5997 } 5998 shdr = mtod(outchain, struct sctphdr *); 5999 shdr->src_port = inp->sctp_lport; 6000 shdr->dest_port = stcb->rport; 6001 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 6002 shdr->checksum = 0; 6003 auth_offset += sizeof(struct sctphdr); 6004 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 6005 (struct sockaddr *)&net->ro._l_addr, 6006 outchain, 6007 auth_offset, 6008 auth, 6009 no_fragmentflg, 6010 bundle_at, 6011 data_list[0], 6012 asconf))) { 6013 /* error, we could not output */ 6014 if (error == ENOBUFS) { 6015 asoc->ifp_had_enobuf = 1; 6016 } 6017 SCTP_STAT_INCR(sctps_lowlevelerr); 6018 if (from_where == 0) { 6019 SCTP_STAT_INCR(sctps_lowlevelerrusr); 6020 } 6021 errored_send: 6022 #ifdef SCTP_DEBUG 6023 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 6024 printf("Gak send error %d\n", error); 6025 } 6026 #endif 6027 if (hbflag) { 6028 if (*now_filled == 0) { 6029 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 6030 *now_filled = 1; 6031 *now = net->last_sent_time; 6032 } else { 6033 net->last_sent_time = *now; 6034 } 6035 hbflag = 0; 6036 } 6037 if (error == EHOSTUNREACH) { 6038 /* 6039 * Destination went unreachable 6040 * during this send 6041 */ 6042 sctp_move_to_an_alt(stcb, asoc, net); 6043 } 6044 sctp_clean_up_ctl(stcb, asoc); 6045 *reason_code = 6; 6046 return (error); 6047 } else { 6048 asoc->ifp_had_enobuf = 0; 6049 } 6050 outchain = endoutchain = NULL; 6051 auth = NULL; 6052 auth_offset = 0; 6053 if (bundle_at || hbflag) { 6054 /* For data/asconf and hb set time */ 6055 if (*now_filled == 0) { 6056 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 6057 *now_filled = 1; 6058 *now = net->last_sent_time; 6059 } else { 6060 net->last_sent_time = *now; 6061 } 6062 } 6063 if (!no_out_cnt) { 6064 *num_out += (ctl_cnt + bundle_at); 6065 } 6066 if (bundle_at) { 6067 /* if (!net->rto_pending) { */ 6068 /* setup for a RTO measurement */ 6069 /* net->rto_pending = 1; */ 6070 tsns_sent = data_list[0]->rec.data.TSN_seq; 6071 6072 data_list[0]->do_rtt = 1; 6073 /* } else { */ 6074 /* data_list[0]->do_rtt = 0; */ 6075 /* } */ 6076 SCTP_STAT_INCR_BY(sctps_senddata, bundle_at); 6077 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 6078 if (sctp_early_fr) { 6079 if (net->flight_size < net->cwnd) { 6080 /* start or restart it */ 6081 if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) { 6082 sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, inp, stcb, net, 6083 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_2); 6084 } 6085 SCTP_STAT_INCR(sctps_earlyfrstrout); 6086 sctp_timer_start(SCTP_TIMER_TYPE_EARLYFR, inp, stcb, net); 6087 } else { 6088 /* stop it if its running */ 6089 if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) { 6090 SCTP_STAT_INCR(sctps_earlyfrstpout); 6091 sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, inp, stcb, net, 6092 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_3); 6093 } 6094 } 6095 } 6096 } 6097 if (one_chunk) { 6098 break; 6099 } 6100 } 6101 #ifdef SCTP_CWND_LOGGING 6102 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND); 6103 #endif 6104 } 6105 if (old_startat == NULL) { 6106 old_startat = send_start_at; 6107 send_start_at = TAILQ_FIRST(&asoc->nets); 6108 goto again_one_more_time; 6109 } 6110 /* 6111 * At the end there should be no NON timed chunks hanging on this 6112 * queue. 6113 */ 6114 #ifdef SCTP_CWND_LOGGING 6115 sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND); 6116 #endif 6117 if ((*num_out == 0) && (*reason_code == 0)) { 6118 *reason_code = 4; 6119 } else { 6120 *reason_code = 5; 6121 } 6122 sctp_clean_up_ctl(stcb, asoc); 6123 return (0); 6124 } 6125 6126 void 6127 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 6128 { 6129 /* 6130 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of 6131 * the control chunk queue. 6132 */ 6133 struct sctp_chunkhdr *hdr; 6134 struct sctp_tmit_chunk *chk; 6135 struct mbuf *mat; 6136 6137 SCTP_TCB_LOCK_ASSERT(stcb); 6138 sctp_alloc_a_chunk(stcb, chk); 6139 if (chk == NULL) { 6140 /* no memory */ 6141 sctp_m_freem(op_err); 6142 return; 6143 } 6144 chk->copy_by_ref = 0; 6145 SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_DONTWAIT); 6146 if (op_err == NULL) { 6147 sctp_free_a_chunk(stcb, chk); 6148 return; 6149 } 6150 chk->send_size = 0; 6151 mat = op_err; 6152 while (mat != NULL) { 6153 chk->send_size += SCTP_BUF_LEN(mat); 6154 mat = SCTP_BUF_NEXT(mat); 6155 } 6156 chk->rec.chunk_id.id = SCTP_OPERATION_ERROR; 6157 chk->rec.chunk_id.can_take_data = 1; 6158 chk->sent = SCTP_DATAGRAM_UNSENT; 6159 chk->snd_count = 0; 6160 chk->flags = 0; 6161 chk->asoc = &stcb->asoc; 6162 chk->data = op_err; 6163 chk->whoTo = chk->asoc->primary_destination; 6164 atomic_add_int(&chk->whoTo->ref_count, 1); 6165 hdr = mtod(op_err, struct sctp_chunkhdr *); 6166 hdr->chunk_type = SCTP_OPERATION_ERROR; 6167 hdr->chunk_flags = 0; 6168 hdr->chunk_length = htons(chk->send_size); 6169 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, 6170 chk, 6171 sctp_next); 6172 chk->asoc->ctrl_queue_cnt++; 6173 } 6174 6175 int 6176 sctp_send_cookie_echo(struct mbuf *m, 6177 int offset, 6178 struct sctp_tcb *stcb, 6179 struct sctp_nets *net) 6180 { 6181 /* 6182 * pull out the cookie and put it at the front of the control chunk 6183 * queue. 6184 */ 6185 int at; 6186 struct mbuf *cookie; 6187 struct sctp_paramhdr parm, *phdr; 6188 struct sctp_chunkhdr *hdr; 6189 struct sctp_tmit_chunk *chk; 6190 uint16_t ptype, plen; 6191 6192 /* First find the cookie in the param area */ 6193 cookie = NULL; 6194 at = offset + sizeof(struct sctp_init_chunk); 6195 6196 SCTP_TCB_LOCK_ASSERT(stcb); 6197 do { 6198 phdr = sctp_get_next_param(m, at, &parm, sizeof(parm)); 6199 if (phdr == NULL) { 6200 return (-3); 6201 } 6202 ptype = ntohs(phdr->param_type); 6203 plen = ntohs(phdr->param_length); 6204 if (ptype == SCTP_STATE_COOKIE) { 6205 int pad; 6206 6207 /* found the cookie */ 6208 if ((pad = (plen % 4))) { 6209 plen += 4 - pad; 6210 } 6211 cookie = sctp_m_copym(m, at, plen, M_DONTWAIT); 6212 if (cookie == NULL) { 6213 /* No memory */ 6214 return (-2); 6215 } 6216 break; 6217 } 6218 at += SCTP_SIZE32(plen); 6219 } while (phdr); 6220 if (cookie == NULL) { 6221 /* Did not find the cookie */ 6222 return (-3); 6223 } 6224 /* ok, we got the cookie lets change it into a cookie echo chunk */ 6225 6226 /* first the change from param to cookie */ 6227 hdr = mtod(cookie, struct sctp_chunkhdr *); 6228 hdr->chunk_type = SCTP_COOKIE_ECHO; 6229 hdr->chunk_flags = 0; 6230 /* get the chunk stuff now and place it in the FRONT of the queue */ 6231 sctp_alloc_a_chunk(stcb, chk); 6232 if (chk == NULL) { 6233 /* no memory */ 6234 sctp_m_freem(cookie); 6235 return (-5); 6236 } 6237 chk->copy_by_ref = 0; 6238 chk->send_size = plen; 6239 chk->rec.chunk_id.id = SCTP_COOKIE_ECHO; 6240 chk->rec.chunk_id.can_take_data = 0; 6241 chk->sent = SCTP_DATAGRAM_UNSENT; 6242 chk->snd_count = 0; 6243 chk->flags = 0; 6244 chk->asoc = &stcb->asoc; 6245 chk->data = cookie; 6246 chk->whoTo = chk->asoc->primary_destination; 6247 atomic_add_int(&chk->whoTo->ref_count, 1); 6248 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 6249 chk->asoc->ctrl_queue_cnt++; 6250 return (0); 6251 } 6252 6253 void 6254 sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 6255 struct mbuf *m, 6256 int offset, 6257 int chk_length, 6258 struct sctp_nets *net) 6259 { 6260 /* 6261 * take a HB request and make it into a HB ack and send it. 6262 */ 6263 struct mbuf *outchain; 6264 struct sctp_chunkhdr *chdr; 6265 struct sctp_tmit_chunk *chk; 6266 6267 6268 if (net == NULL) 6269 /* must have a net pointer */ 6270 return; 6271 6272 outchain = sctp_m_copym(m, offset, chk_length, M_DONTWAIT); 6273 if (outchain == NULL) { 6274 /* gak out of memory */ 6275 return; 6276 } 6277 chdr = mtod(outchain, struct sctp_chunkhdr *); 6278 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 6279 chdr->chunk_flags = 0; 6280 if (chk_length % 4) { 6281 /* need pad */ 6282 uint32_t cpthis = 0; 6283 int padlen; 6284 6285 padlen = 4 - (chk_length % 4); 6286 m_copyback(outchain, chk_length, padlen, (caddr_t)&cpthis); 6287 } 6288 sctp_alloc_a_chunk(stcb, chk); 6289 if (chk == NULL) { 6290 /* no memory */ 6291 sctp_m_freem(outchain); 6292 return; 6293 } 6294 chk->copy_by_ref = 0; 6295 chk->send_size = chk_length; 6296 chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK; 6297 chk->rec.chunk_id.can_take_data = 1; 6298 chk->sent = SCTP_DATAGRAM_UNSENT; 6299 chk->snd_count = 0; 6300 chk->flags = 0; 6301 chk->asoc = &stcb->asoc; 6302 chk->data = outchain; 6303 chk->whoTo = net; 6304 atomic_add_int(&chk->whoTo->ref_count, 1); 6305 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6306 chk->asoc->ctrl_queue_cnt++; 6307 } 6308 6309 int 6310 sctp_send_cookie_ack(struct sctp_tcb *stcb) 6311 { 6312 /* formulate and queue a cookie-ack back to sender */ 6313 struct mbuf *cookie_ack; 6314 struct sctp_chunkhdr *hdr; 6315 struct sctp_tmit_chunk *chk; 6316 6317 cookie_ack = NULL; 6318 SCTP_TCB_LOCK_ASSERT(stcb); 6319 6320 cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_DONTWAIT, 1, MT_HEADER); 6321 if (cookie_ack == NULL) { 6322 /* no mbuf's */ 6323 return (-1); 6324 } 6325 SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD); 6326 sctp_alloc_a_chunk(stcb, chk); 6327 if (chk == NULL) { 6328 /* no memory */ 6329 sctp_m_freem(cookie_ack); 6330 return (-1); 6331 } 6332 chk->copy_by_ref = 0; 6333 chk->send_size = sizeof(struct sctp_chunkhdr); 6334 chk->rec.chunk_id.id = SCTP_COOKIE_ACK; 6335 chk->rec.chunk_id.can_take_data = 1; 6336 chk->sent = SCTP_DATAGRAM_UNSENT; 6337 chk->snd_count = 0; 6338 chk->flags = 0; 6339 chk->asoc = &stcb->asoc; 6340 chk->data = cookie_ack; 6341 if (chk->asoc->last_control_chunk_from != NULL) { 6342 chk->whoTo = chk->asoc->last_control_chunk_from; 6343 } else { 6344 chk->whoTo = chk->asoc->primary_destination; 6345 } 6346 atomic_add_int(&chk->whoTo->ref_count, 1); 6347 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 6348 hdr->chunk_type = SCTP_COOKIE_ACK; 6349 hdr->chunk_flags = 0; 6350 hdr->chunk_length = htons(chk->send_size); 6351 SCTP_BUF_LEN(cookie_ack) = chk->send_size; 6352 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6353 chk->asoc->ctrl_queue_cnt++; 6354 return (0); 6355 } 6356 6357 6358 int 6359 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 6360 { 6361 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 6362 struct mbuf *m_shutdown_ack; 6363 struct sctp_shutdown_ack_chunk *ack_cp; 6364 struct sctp_tmit_chunk *chk; 6365 6366 m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_DONTWAIT, 1, MT_HEADER); 6367 if (m_shutdown_ack == NULL) { 6368 /* no mbuf's */ 6369 return (-1); 6370 } 6371 SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD); 6372 sctp_alloc_a_chunk(stcb, chk); 6373 if (chk == NULL) { 6374 /* no memory */ 6375 sctp_m_freem(m_shutdown_ack); 6376 return (-1); 6377 } 6378 chk->copy_by_ref = 0; 6379 6380 chk->send_size = sizeof(struct sctp_chunkhdr); 6381 chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK; 6382 chk->rec.chunk_id.can_take_data = 1; 6383 chk->sent = SCTP_DATAGRAM_UNSENT; 6384 chk->snd_count = 0; 6385 chk->flags = 0; 6386 chk->asoc = &stcb->asoc; 6387 chk->data = m_shutdown_ack; 6388 chk->whoTo = net; 6389 atomic_add_int(&net->ref_count, 1); 6390 6391 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 6392 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 6393 ack_cp->ch.chunk_flags = 0; 6394 ack_cp->ch.chunk_length = htons(chk->send_size); 6395 SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size; 6396 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6397 chk->asoc->ctrl_queue_cnt++; 6398 return (0); 6399 } 6400 6401 int 6402 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 6403 { 6404 /* formulate and queue a SHUTDOWN to the sender */ 6405 struct mbuf *m_shutdown; 6406 struct sctp_shutdown_chunk *shutdown_cp; 6407 struct sctp_tmit_chunk *chk; 6408 6409 m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_DONTWAIT, 1, MT_HEADER); 6410 if (m_shutdown == NULL) { 6411 /* no mbuf's */ 6412 return (-1); 6413 } 6414 SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD); 6415 sctp_alloc_a_chunk(stcb, chk); 6416 if (chk == NULL) { 6417 /* no memory */ 6418 sctp_m_freem(m_shutdown); 6419 return (-1); 6420 } 6421 chk->copy_by_ref = 0; 6422 chk->send_size = sizeof(struct sctp_shutdown_chunk); 6423 chk->rec.chunk_id.id = SCTP_SHUTDOWN; 6424 chk->rec.chunk_id.can_take_data = 1; 6425 chk->sent = SCTP_DATAGRAM_UNSENT; 6426 chk->snd_count = 0; 6427 chk->flags = 0; 6428 chk->asoc = &stcb->asoc; 6429 chk->data = m_shutdown; 6430 chk->whoTo = net; 6431 atomic_add_int(&net->ref_count, 1); 6432 6433 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 6434 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 6435 shutdown_cp->ch.chunk_flags = 0; 6436 shutdown_cp->ch.chunk_length = htons(chk->send_size); 6437 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 6438 SCTP_BUF_LEN(m_shutdown) = chk->send_size; 6439 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6440 chk->asoc->ctrl_queue_cnt++; 6441 return (0); 6442 } 6443 6444 int 6445 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net) 6446 { 6447 /* 6448 * formulate and queue an ASCONF to the peer ASCONF parameters 6449 * should be queued on the assoc queue 6450 */ 6451 struct sctp_tmit_chunk *chk; 6452 struct mbuf *m_asconf; 6453 struct sctp_asconf_chunk *acp; 6454 int len; 6455 6456 6457 SCTP_TCB_LOCK_ASSERT(stcb); 6458 /* compose an ASCONF chunk, maximum length is PMTU */ 6459 m_asconf = sctp_compose_asconf(stcb, &len); 6460 if (m_asconf == NULL) { 6461 return (-1); 6462 } 6463 acp = mtod(m_asconf, struct sctp_asconf_chunk *); 6464 sctp_alloc_a_chunk(stcb, chk); 6465 if (chk == NULL) { 6466 /* no memory */ 6467 sctp_m_freem(m_asconf); 6468 return (-1); 6469 } 6470 chk->copy_by_ref = 0; 6471 chk->data = m_asconf; 6472 chk->send_size = len; 6473 chk->rec.chunk_id.id = SCTP_ASCONF; 6474 chk->rec.chunk_id.can_take_data = 0; 6475 chk->sent = SCTP_DATAGRAM_UNSENT; 6476 chk->snd_count = 0; 6477 chk->flags = 0; 6478 chk->asoc = &stcb->asoc; 6479 chk->whoTo = chk->asoc->primary_destination; 6480 atomic_add_int(&chk->whoTo->ref_count, 1); 6481 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6482 chk->asoc->ctrl_queue_cnt++; 6483 return (0); 6484 } 6485 6486 int 6487 sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans) 6488 { 6489 /* 6490 * formulate and queue a asconf-ack back to sender the asconf-ack 6491 * must be stored in the tcb 6492 */ 6493 struct sctp_tmit_chunk *chk; 6494 struct mbuf *m_ack, *m; 6495 6496 SCTP_TCB_LOCK_ASSERT(stcb); 6497 /* is there a asconf-ack mbuf chain to send? */ 6498 if (stcb->asoc.last_asconf_ack_sent == NULL) { 6499 return (-1); 6500 } 6501 /* copy the asconf_ack */ 6502 /* We no longer have pak headers here so m_copy is it */ 6503 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL); 6504 if (m_ack == NULL) { 6505 /* couldn't copy it */ 6506 6507 return (-1); 6508 } 6509 sctp_alloc_a_chunk(stcb, chk); 6510 if (chk == NULL) { 6511 /* no memory */ 6512 if (m_ack) 6513 sctp_m_freem(m_ack); 6514 return (-1); 6515 } 6516 chk->copy_by_ref = 0; 6517 /* figure out where it goes to */ 6518 if (retrans) { 6519 /* we're doing a retransmission */ 6520 if (stcb->asoc.used_alt_asconfack > 2) { 6521 /* tried alternate nets already, go back */ 6522 chk->whoTo = NULL; 6523 } else { 6524 /* need to try and alternate net */ 6525 chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0); 6526 stcb->asoc.used_alt_asconfack++; 6527 } 6528 if (chk->whoTo == NULL) { 6529 /* no alternate */ 6530 if (stcb->asoc.last_control_chunk_from == NULL) 6531 chk->whoTo = stcb->asoc.primary_destination; 6532 else 6533 chk->whoTo = stcb->asoc.last_control_chunk_from; 6534 stcb->asoc.used_alt_asconfack = 0; 6535 } 6536 } else { 6537 /* normal case */ 6538 if (stcb->asoc.last_control_chunk_from == NULL) 6539 chk->whoTo = stcb->asoc.primary_destination; 6540 else 6541 chk->whoTo = stcb->asoc.last_control_chunk_from; 6542 stcb->asoc.used_alt_asconfack = 0; 6543 } 6544 chk->data = m_ack; 6545 chk->send_size = 0; 6546 /* Get size */ 6547 m = m_ack; 6548 while (m) { 6549 chk->send_size += SCTP_BUF_LEN(m); 6550 m = SCTP_BUF_NEXT(m); 6551 } 6552 chk->rec.chunk_id.id = SCTP_ASCONF_ACK; 6553 chk->rec.chunk_id.can_take_data = 1; 6554 chk->sent = SCTP_DATAGRAM_UNSENT; 6555 chk->snd_count = 0; 6556 chk->flags = 0; 6557 chk->asoc = &stcb->asoc; 6558 atomic_add_int(&chk->whoTo->ref_count, 1); 6559 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6560 chk->asoc->ctrl_queue_cnt++; 6561 return (0); 6562 } 6563 6564 6565 static int 6566 sctp_chunk_retransmission(struct sctp_inpcb *inp, 6567 struct sctp_tcb *stcb, 6568 struct sctp_association *asoc, 6569 int *cnt_out, struct timeval *now, int *now_filled) 6570 { 6571 /* 6572 * send out one MTU of retransmission. If fast_retransmit is 6573 * happening we ignore the cwnd. Otherwise we obey the cwnd and 6574 * rwnd. For a Cookie or Asconf in the control chunk queue we 6575 * retransmit them by themselves. 6576 * 6577 * For data chunks we will pick out the lowest TSN's in the sent_queue 6578 * marked for resend and bundle them all together (up to a MTU of 6579 * destination). The address to send to should have been 6580 * selected/changed where the retransmission was marked (i.e. in FR 6581 * or t3-timeout routines). 6582 */ 6583 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 6584 struct sctp_tmit_chunk *chk, *fwd; 6585 struct mbuf *m, *endofchain; 6586 struct sctphdr *shdr; 6587 int asconf; 6588 struct sctp_nets *net; 6589 uint32_t tsns_sent = 0; 6590 int no_fragmentflg, bundle_at, cnt_thru; 6591 unsigned int mtu; 6592 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 6593 struct sctp_auth_chunk *auth = NULL; 6594 uint32_t auth_offset = 0; 6595 uint32_t dmtu = 0; 6596 6597 SCTP_TCB_LOCK_ASSERT(stcb); 6598 tmr_started = ctl_cnt = bundle_at = error = 0; 6599 no_fragmentflg = 1; 6600 asconf = 0; 6601 fwd_tsn = 0; 6602 *cnt_out = 0; 6603 fwd = NULL; 6604 endofchain = m = NULL; 6605 #ifdef SCTP_AUDITING_ENABLED 6606 sctp_audit_log(0xC3, 1); 6607 #endif 6608 if (TAILQ_EMPTY(&asoc->sent_queue)) { 6609 #ifdef SCTP_DEBUG 6610 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6611 printf("SCTP hits empty queue with cnt set to %d?\n", 6612 asoc->sent_queue_retran_cnt); 6613 } 6614 #endif 6615 asoc->sent_queue_cnt = 0; 6616 asoc->sent_queue_cnt_removeable = 0; 6617 } 6618 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 6619 if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) || 6620 (chk->rec.chunk_id.id == SCTP_ASCONF) || 6621 (chk->rec.chunk_id.id == SCTP_STREAM_RESET) || 6622 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) { 6623 if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 6624 if (chk != asoc->str_reset) { 6625 /* 6626 * not eligible for retran if its 6627 * not ours 6628 */ 6629 continue; 6630 } 6631 } 6632 ctl_cnt++; 6633 if (chk->rec.chunk_id.id == SCTP_ASCONF) { 6634 no_fragmentflg = 1; 6635 asconf = 1; 6636 } 6637 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 6638 fwd_tsn = 1; 6639 fwd = chk; 6640 } 6641 /* 6642 * Add an AUTH chunk, if chunk requires it save the 6643 * offset into the chain for AUTH 6644 */ 6645 if ((auth == NULL) && 6646 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 6647 stcb->asoc.peer_auth_chunks))) { 6648 m = sctp_add_auth_chunk(m, &endofchain, 6649 &auth, &auth_offset, 6650 stcb, 6651 chk->rec.chunk_id.id); 6652 } 6653 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 6654 break; 6655 } 6656 } 6657 one_chunk = 0; 6658 cnt_thru = 0; 6659 /* do we have control chunks to retransmit? */ 6660 if (m != NULL) { 6661 /* Start a timer no matter if we suceed or fail */ 6662 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 6663 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 6664 } else if (chk->rec.chunk_id.id == SCTP_ASCONF) 6665 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 6666 6667 SCTP_BUF_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT); 6668 if (m == NULL) { 6669 return (ENOBUFS); 6670 } 6671 shdr = mtod(m, struct sctphdr *); 6672 shdr->src_port = inp->sctp_lport; 6673 shdr->dest_port = stcb->rport; 6674 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 6675 shdr->checksum = 0; 6676 auth_offset += sizeof(struct sctphdr); 6677 chk->snd_count++; /* update our count */ 6678 6679 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 6680 (struct sockaddr *)&chk->whoTo->ro._l_addr, m, auth_offset, 6681 auth, no_fragmentflg, 0, NULL, asconf))) { 6682 SCTP_STAT_INCR(sctps_lowlevelerr); 6683 return (error); 6684 } 6685 m = endofchain = NULL; 6686 auth = NULL; 6687 auth_offset = 0; 6688 /* 6689 * We don't want to mark the net->sent time here since this 6690 * we use this for HB and retrans cannot measure RTT 6691 */ 6692 /* SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */ 6693 *cnt_out += 1; 6694 chk->sent = SCTP_DATAGRAM_SENT; 6695 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 6696 if (fwd_tsn == 0) { 6697 return (0); 6698 } else { 6699 /* Clean up the fwd-tsn list */ 6700 sctp_clean_up_ctl(stcb, asoc); 6701 return (0); 6702 } 6703 } 6704 /* 6705 * Ok, it is just data retransmission we need to do or that and a 6706 * fwd-tsn with it all. 6707 */ 6708 if (TAILQ_EMPTY(&asoc->sent_queue)) { 6709 return (-1); 6710 } 6711 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) || 6712 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) { 6713 /* not yet open, resend the cookie and that is it */ 6714 return (1); 6715 } 6716 #ifdef SCTP_AUDITING_ENABLED 6717 sctp_auditing(20, inp, stcb, NULL); 6718 #endif 6719 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6720 if (chk->sent != SCTP_DATAGRAM_RESEND) { 6721 /* No, not sent to this net or not ready for rtx */ 6722 continue; 6723 6724 } 6725 /* pick up the net */ 6726 net = chk->whoTo; 6727 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6728 mtu = (net->mtu - SCTP_MIN_OVERHEAD); 6729 } else { 6730 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 6731 } 6732 6733 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 6734 /* No room in peers rwnd */ 6735 uint32_t tsn; 6736 6737 tsn = asoc->last_acked_seq + 1; 6738 if (tsn == chk->rec.data.TSN_seq) { 6739 /* 6740 * we make a special exception for this 6741 * case. The peer has no rwnd but is missing 6742 * the lowest chunk.. which is probably what 6743 * is holding up the rwnd. 6744 */ 6745 goto one_chunk_around; 6746 } 6747 return (1); 6748 } 6749 one_chunk_around: 6750 if (asoc->peers_rwnd < mtu) { 6751 one_chunk = 1; 6752 } 6753 #ifdef SCTP_AUDITING_ENABLED 6754 sctp_audit_log(0xC3, 2); 6755 #endif 6756 bundle_at = 0; 6757 m = NULL; 6758 net->fast_retran_ip = 0; 6759 if (chk->rec.data.doing_fast_retransmit == 0) { 6760 /* 6761 * if no FR in progress skip destination that have 6762 * flight_size > cwnd. 6763 */ 6764 if (net->flight_size >= net->cwnd) { 6765 continue; 6766 } 6767 } else { 6768 /* 6769 * Mark the destination net to have FR recovery 6770 * limits put on it. 6771 */ 6772 net->fast_retran_ip = 1; 6773 } 6774 6775 /* 6776 * if no AUTH is yet included and this chunk requires it, 6777 * make sure to account for it. We don't apply the size 6778 * until the AUTH chunk is actually added below in case 6779 * there is no room for this chunk. 6780 */ 6781 if ((auth == NULL) && 6782 sctp_auth_is_required_chunk(SCTP_DATA, 6783 stcb->asoc.peer_auth_chunks)) { 6784 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 6785 } else 6786 dmtu = 0; 6787 6788 if ((chk->send_size <= (mtu - dmtu)) || 6789 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 6790 /* ok we will add this one */ 6791 if ((auth == NULL) && 6792 (sctp_auth_is_required_chunk(SCTP_DATA, 6793 stcb->asoc.peer_auth_chunks))) { 6794 m = sctp_add_auth_chunk(m, &endofchain, 6795 &auth, &auth_offset, 6796 stcb, SCTP_DATA); 6797 } 6798 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 6799 if (m == NULL) { 6800 return (ENOMEM); 6801 } 6802 /* Do clear IP_DF ? */ 6803 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 6804 no_fragmentflg = 0; 6805 } 6806 /* upate our MTU size */ 6807 if (mtu > (chk->send_size + dmtu)) 6808 mtu -= (chk->send_size + dmtu); 6809 else 6810 mtu = 0; 6811 data_list[bundle_at++] = chk; 6812 if (one_chunk && (asoc->total_flight <= 0)) { 6813 SCTP_STAT_INCR(sctps_windowprobed); 6814 chk->rec.data.state_flags |= SCTP_WINDOW_PROBE; 6815 } 6816 } 6817 if (one_chunk == 0) { 6818 /* 6819 * now are there anymore forward from chk to pick 6820 * up? 6821 */ 6822 fwd = TAILQ_NEXT(chk, sctp_next); 6823 while (fwd) { 6824 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 6825 /* Nope, not for retran */ 6826 fwd = TAILQ_NEXT(fwd, sctp_next); 6827 continue; 6828 } 6829 if (fwd->whoTo != net) { 6830 /* Nope, not the net in question */ 6831 fwd = TAILQ_NEXT(fwd, sctp_next); 6832 continue; 6833 } 6834 if ((auth == NULL) && 6835 sctp_auth_is_required_chunk(SCTP_DATA, 6836 stcb->asoc.peer_auth_chunks)) { 6837 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 6838 } else 6839 dmtu = 0; 6840 if (fwd->send_size <= (mtu - dmtu)) { 6841 if ((auth == NULL) && 6842 (sctp_auth_is_required_chunk(SCTP_DATA, 6843 stcb->asoc.peer_auth_chunks))) { 6844 m = sctp_add_auth_chunk(m, 6845 &endofchain, 6846 &auth, &auth_offset, 6847 stcb, 6848 SCTP_DATA); 6849 } 6850 m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref); 6851 if (m == NULL) { 6852 return (ENOMEM); 6853 } 6854 /* Do clear IP_DF ? */ 6855 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 6856 no_fragmentflg = 0; 6857 } 6858 /* upate our MTU size */ 6859 if (mtu > (fwd->send_size + dmtu)) 6860 mtu -= (fwd->send_size + dmtu); 6861 else 6862 mtu = 0; 6863 data_list[bundle_at++] = fwd; 6864 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 6865 break; 6866 } 6867 fwd = TAILQ_NEXT(fwd, sctp_next); 6868 } else { 6869 /* can't fit so we are done */ 6870 break; 6871 } 6872 } 6873 } 6874 /* Is there something to send for this destination? */ 6875 if (m) { 6876 /* 6877 * No matter if we fail/or suceed we should start a 6878 * timer. A failure is like a lost IP packet :-) 6879 */ 6880 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 6881 /* 6882 * no timer running on this destination 6883 * restart it. 6884 */ 6885 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 6886 tmr_started = 1; 6887 } 6888 SCTP_BUF_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT); 6889 if (m == NULL) { 6890 return (ENOBUFS); 6891 } 6892 shdr = mtod(m, struct sctphdr *); 6893 shdr->src_port = inp->sctp_lport; 6894 shdr->dest_port = stcb->rport; 6895 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 6896 shdr->checksum = 0; 6897 auth_offset += sizeof(struct sctphdr); 6898 /* Now lets send it, if there is anything to send :> */ 6899 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 6900 (struct sockaddr *)&net->ro._l_addr, m, auth_offset, 6901 auth, no_fragmentflg, 0, NULL, asconf))) { 6902 /* error, we could not output */ 6903 SCTP_STAT_INCR(sctps_lowlevelerr); 6904 return (error); 6905 } 6906 m = endofchain = NULL; 6907 auth = NULL; 6908 auth_offset = 0; 6909 /* For HB's */ 6910 /* 6911 * We don't want to mark the net->sent time here 6912 * since this we use this for HB and retrans cannot 6913 * measure RTT 6914 */ 6915 /* SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */ 6916 6917 /* For auto-close */ 6918 cnt_thru++; 6919 if (*now_filled == 0) { 6920 SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 6921 *now = asoc->time_last_sent; 6922 *now_filled = 1; 6923 } else { 6924 asoc->time_last_sent = *now; 6925 } 6926 *cnt_out += bundle_at; 6927 #ifdef SCTP_AUDITING_ENABLED 6928 sctp_audit_log(0xC4, bundle_at); 6929 #endif 6930 if (bundle_at) { 6931 tsns_sent = data_list[0]->rec.data.TSN_seq; 6932 } 6933 for (i = 0; i < bundle_at; i++) { 6934 SCTP_STAT_INCR(sctps_sendretransdata); 6935 data_list[i]->sent = SCTP_DATAGRAM_SENT; 6936 /* 6937 * When we have a revoked data, and we 6938 * retransmit it, then we clear the revoked 6939 * flag since this flag dictates if we 6940 * subtracted from the fs 6941 */ 6942 data_list[i]->rec.data.chunk_was_revoked = 0; 6943 data_list[i]->snd_count++; 6944 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 6945 /* record the time */ 6946 data_list[i]->sent_rcv_time = asoc->time_last_sent; 6947 if (asoc->sent_queue_retran_cnt < 0) { 6948 asoc->sent_queue_retran_cnt = 0; 6949 } 6950 #ifdef SCTP_FLIGHT_LOGGING 6951 sctp_misc_ints(SCTP_FLIGHT_LOG_UP, 6952 data_list[i]->whoTo->flight_size, 6953 data_list[i]->book_size, 6954 (uintptr_t) stcb, 6955 data_list[i]->rec.data.TSN_seq); 6956 #endif 6957 net->flight_size += data_list[i]->book_size; 6958 asoc->total_flight += data_list[i]->book_size; 6959 if (data_list[i]->book_size_scale) { 6960 /* 6961 * need to double the book size on 6962 * this one 6963 */ 6964 data_list[i]->book_size_scale = 0; 6965 data_list[i]->book_size *= 2; 6966 } else { 6967 sctp_ucount_incr(asoc->total_flight_count); 6968 #ifdef SCTP_LOG_RWND 6969 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 6970 asoc->peers_rwnd, data_list[i]->send_size, sctp_peer_chunk_oh); 6971 #endif 6972 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 6973 (uint32_t) (data_list[i]->send_size + 6974 sctp_peer_chunk_oh)); 6975 } 6976 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 6977 /* SWS sender side engages */ 6978 asoc->peers_rwnd = 0; 6979 } 6980 if ((i == 0) && 6981 (data_list[i]->rec.data.doing_fast_retransmit)) { 6982 SCTP_STAT_INCR(sctps_sendfastretrans); 6983 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 6984 (tmr_started == 0)) { 6985 /* 6986 * ok we just fast-retrans'd 6987 * the lowest TSN, i.e the 6988 * first on the list. In 6989 * this case we want to give 6990 * some more time to get a 6991 * SACK back without a 6992 * t3-expiring. 6993 */ 6994 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 6995 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4); 6996 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 6997 } 6998 } 6999 } 7000 #ifdef SCTP_CWND_LOGGING 7001 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND); 7002 #endif 7003 #ifdef SCTP_AUDITING_ENABLED 7004 sctp_auditing(21, inp, stcb, NULL); 7005 #endif 7006 } else { 7007 /* None will fit */ 7008 return (1); 7009 } 7010 if (asoc->sent_queue_retran_cnt <= 0) { 7011 /* all done we have no more to retran */ 7012 asoc->sent_queue_retran_cnt = 0; 7013 break; 7014 } 7015 if (one_chunk) { 7016 /* No more room in rwnd */ 7017 return (1); 7018 } 7019 /* stop the for loop here. we sent out a packet */ 7020 break; 7021 } 7022 return (0); 7023 } 7024 7025 7026 static int 7027 sctp_timer_validation(struct sctp_inpcb *inp, 7028 struct sctp_tcb *stcb, 7029 struct sctp_association *asoc, 7030 int ret) 7031 { 7032 struct sctp_nets *net; 7033 7034 /* Validate that a timer is running somewhere */ 7035 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 7036 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 7037 /* Here is a timer */ 7038 return (ret); 7039 } 7040 } 7041 SCTP_TCB_LOCK_ASSERT(stcb); 7042 /* Gak, we did not have a timer somewhere */ 7043 #ifdef SCTP_DEBUG 7044 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 7045 printf("Deadlock avoided starting timer on a dest at retran\n"); 7046 } 7047 #endif 7048 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 7049 return (ret); 7050 } 7051 7052 int 7053 sctp_chunk_output(struct sctp_inpcb *inp, 7054 struct sctp_tcb *stcb, 7055 int from_where) 7056 { 7057 /* 7058 * Ok this is the generic chunk service queue. we must do the 7059 * following: - See if there are retransmits pending, if so we must 7060 * do these first and return. - Service the stream queue that is 7061 * next, moving any message (note I must get a complete message i.e. 7062 * FIRST/MIDDLE and LAST to the out queue in one pass) and assigning 7063 * TSN's - Check to see if the cwnd/rwnd allows any output, if so we 7064 * go ahead and fomulate and send the low level chunks. Making sure 7065 * to combine any control in the control chunk queue also. 7066 */ 7067 struct sctp_association *asoc; 7068 struct sctp_nets *net; 7069 int error = 0, num_out = 0, tot_out = 0, ret = 0, reason_code = 0, 7070 burst_cnt = 0, burst_limit = 0; 7071 struct timeval now; 7072 int now_filled = 0; 7073 int cwnd_full = 0; 7074 int nagle_on = 0; 7075 int frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 7076 int un_sent = 0; 7077 7078 asoc = &stcb->asoc; 7079 if (from_where == SCTP_OUTPUT_FROM_USR_SEND) { 7080 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) { 7081 nagle_on = 0; 7082 } else { 7083 nagle_on = 1; 7084 } 7085 } 7086 SCTP_TCB_LOCK_ASSERT(stcb); 7087 7088 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 7089 7090 if ((un_sent <= 0) && 7091 (TAILQ_EMPTY(&asoc->control_send_queue)) && 7092 (asoc->sent_queue_retran_cnt == 0)) { 7093 /* Nothing to do unless there is something to be sent left */ 7094 return (error); 7095 } 7096 /* 7097 * Do we have something to send, data or control AND a sack timer 7098 * running, if so piggy-back the sack. 7099 */ 7100 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 7101 sctp_send_sack(stcb); 7102 SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer); 7103 } 7104 while (asoc->sent_queue_retran_cnt) { 7105 /* 7106 * Ok, it is retransmission time only, we send out only ONE 7107 * packet with a single call off to the retran code. 7108 */ 7109 if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) { 7110 /* 7111 * Special hook for handling cookiess discarded by 7112 * peer that carried data. Send cookie-ack only and 7113 * then the next call with get the retran's. 7114 */ 7115 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 7116 &cwnd_full, from_where, 7117 &now, &now_filled, frag_point); 7118 return (0); 7119 } else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) { 7120 /* if its not from a HB then do it */ 7121 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled); 7122 } else { 7123 /* 7124 * its from any other place, we don't allow retran 7125 * output (only control) 7126 */ 7127 ret = 1; 7128 } 7129 if (ret > 0) { 7130 /* Can't send anymore */ 7131 /* 7132 * now lets push out control by calling med-level 7133 * output once. this assures that we WILL send HB's 7134 * if queued too. 7135 */ 7136 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 7137 &cwnd_full, from_where, 7138 &now, &now_filled, frag_point); 7139 #ifdef SCTP_AUDITING_ENABLED 7140 sctp_auditing(8, inp, stcb, NULL); 7141 #endif 7142 return (sctp_timer_validation(inp, stcb, asoc, ret)); 7143 } 7144 if (ret < 0) { 7145 /* 7146 * The count was off.. retran is not happening so do 7147 * the normal retransmission. 7148 */ 7149 #ifdef SCTP_AUDITING_ENABLED 7150 sctp_auditing(9, inp, stcb, NULL); 7151 #endif 7152 break; 7153 } 7154 if (from_where == SCTP_OUTPUT_FROM_T3) { 7155 /* Only one transmission allowed out of a timeout */ 7156 #ifdef SCTP_AUDITING_ENABLED 7157 sctp_auditing(10, inp, stcb, NULL); 7158 #endif 7159 /* Push out any control */ 7160 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where, 7161 &now, &now_filled, frag_point); 7162 return (ret); 7163 } 7164 if ((num_out == 0) && (ret == 0)) { 7165 /* No more retrans to send */ 7166 break; 7167 } 7168 } 7169 #ifdef SCTP_AUDITING_ENABLED 7170 sctp_auditing(12, inp, stcb, NULL); 7171 #endif 7172 /* Check for bad destinations, if they exist move chunks around. */ 7173 burst_limit = asoc->max_burst; 7174 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 7175 if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) == 7176 SCTP_ADDR_NOT_REACHABLE) { 7177 /* 7178 * if possible move things off of this address we 7179 * still may send below due to the dormant state but 7180 * we try to find an alternate address to send to 7181 * and if we have one we move all queued data on the 7182 * out wheel to this alternate address. 7183 */ 7184 if (net->ref_count > 1) 7185 sctp_move_to_an_alt(stcb, asoc, net); 7186 } else { 7187 /* 7188 * if ((asoc->sat_network) || (net->addr_is_local)) 7189 * { burst_limit = asoc->max_burst * 7190 * SCTP_SAT_NETWORK_BURST_INCR; } 7191 */ 7192 if (sctp_use_cwnd_based_maxburst) { 7193 if ((net->flight_size + (burst_limit * net->mtu)) < net->cwnd) { 7194 int old_cwnd; 7195 7196 if (net->ssthresh < net->cwnd) 7197 net->ssthresh = net->cwnd; 7198 old_cwnd = net->cwnd; 7199 net->cwnd = (net->flight_size + (burst_limit * net->mtu)); 7200 7201 #ifdef SCTP_CWND_MONITOR 7202 sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_BRST); 7203 #endif 7204 7205 #ifdef SCTP_LOG_MAXBURST 7206 sctp_log_maxburst(stcb, net, 0, burst_limit, SCTP_MAX_BURST_APPLIED); 7207 #endif 7208 SCTP_STAT_INCR(sctps_maxburstqueued); 7209 } 7210 net->fast_retran_ip = 0; 7211 } else { 7212 if (net->flight_size == 0) { 7213 /* Should be decaying the cwnd here */ 7214 ; 7215 } 7216 } 7217 } 7218 7219 } 7220 burst_cnt = 0; 7221 cwnd_full = 0; 7222 do { 7223 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 7224 &reason_code, 0, &cwnd_full, from_where, 7225 &now, &now_filled, frag_point); 7226 if (error) { 7227 #ifdef SCTP_DEBUG 7228 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7229 printf("Error %d was returned from med-c-op\n", error); 7230 } 7231 #endif 7232 #ifdef SCTP_LOG_MAXBURST 7233 sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 7234 #endif 7235 #ifdef SCTP_CWND_LOGGING 7236 sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES); 7237 sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES); 7238 #endif 7239 7240 break; 7241 } 7242 #ifdef SCTP_DEBUG 7243 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 7244 printf("m-c-o put out %d\n", num_out); 7245 } 7246 #endif 7247 tot_out += num_out; 7248 burst_cnt++; 7249 #ifdef SCTP_CWND_LOGGING 7250 sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES); 7251 if (num_out == 0) { 7252 sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES); 7253 } 7254 #endif 7255 if (nagle_on) { 7256 /* 7257 * When nagle is on, we look at how much is un_sent, 7258 * then if its smaller than an MTU and we have data 7259 * in flight we stop. 7260 */ 7261 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 7262 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) 7263 * sizeof(struct sctp_data_chunk))); 7264 if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) && 7265 (stcb->asoc.total_flight > 0)) { 7266 break; 7267 } 7268 } 7269 if (TAILQ_EMPTY(&asoc->control_send_queue) && 7270 TAILQ_EMPTY(&asoc->send_queue) && 7271 TAILQ_EMPTY(&asoc->out_wheel)) { 7272 /* Nothing left to send */ 7273 break; 7274 } 7275 if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) { 7276 /* Nothing left to send */ 7277 break; 7278 } 7279 } while (num_out && (sctp_use_cwnd_based_maxburst || 7280 (burst_cnt < burst_limit))); 7281 7282 if (sctp_use_cwnd_based_maxburst == 0) { 7283 if (burst_cnt >= burst_limit) { 7284 SCTP_STAT_INCR(sctps_maxburstqueued); 7285 asoc->burst_limit_applied = 1; 7286 #ifdef SCTP_LOG_MAXBURST 7287 sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED); 7288 #endif 7289 } else { 7290 asoc->burst_limit_applied = 0; 7291 } 7292 } 7293 #ifdef SCTP_CWND_LOGGING 7294 sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES); 7295 #endif 7296 #ifdef SCTP_DEBUG 7297 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7298 printf("Ok, we have put out %d chunks\n", tot_out); 7299 } 7300 #endif 7301 /* 7302 * Now we need to clean up the control chunk chain if a ECNE is on 7303 * it. It must be marked as UNSENT again so next call will continue 7304 * to send it until such time that we get a CWR, to remove it. 7305 */ 7306 if (stcb->asoc.ecn_echo_cnt_onq) 7307 sctp_fix_ecn_echo(asoc); 7308 return (error); 7309 } 7310 7311 7312 int 7313 sctp_output(inp, m, addr, control, p, flags) 7314 struct sctp_inpcb *inp; 7315 struct mbuf *m; 7316 struct sockaddr *addr; 7317 struct mbuf *control; 7318 7319 struct thread *p; 7320 int flags; 7321 { 7322 if (inp == NULL) { 7323 return (EINVAL); 7324 } 7325 if (inp->sctp_socket == NULL) { 7326 return (EINVAL); 7327 } 7328 return (sctp_sosend(inp->sctp_socket, 7329 addr, 7330 (struct uio *)NULL, 7331 m, 7332 control, 7333 flags, 7334 p)); 7335 } 7336 7337 void 7338 send_forward_tsn(struct sctp_tcb *stcb, 7339 struct sctp_association *asoc) 7340 { 7341 struct sctp_tmit_chunk *chk; 7342 struct sctp_forward_tsn_chunk *fwdtsn; 7343 7344 SCTP_TCB_LOCK_ASSERT(stcb); 7345 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7346 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 7347 /* mark it to unsent */ 7348 chk->sent = SCTP_DATAGRAM_UNSENT; 7349 chk->snd_count = 0; 7350 /* Do we correct its output location? */ 7351 if (chk->whoTo != asoc->primary_destination) { 7352 sctp_free_remote_addr(chk->whoTo); 7353 chk->whoTo = asoc->primary_destination; 7354 atomic_add_int(&chk->whoTo->ref_count, 1); 7355 } 7356 goto sctp_fill_in_rest; 7357 } 7358 } 7359 /* Ok if we reach here we must build one */ 7360 sctp_alloc_a_chunk(stcb, chk); 7361 if (chk == NULL) { 7362 return; 7363 } 7364 chk->copy_by_ref = 0; 7365 chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN; 7366 chk->rec.chunk_id.can_take_data = 0; 7367 chk->asoc = asoc; 7368 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 7369 if (chk->data == NULL) { 7370 atomic_subtract_int(&chk->whoTo->ref_count, 1); 7371 sctp_free_a_chunk(stcb, chk); 7372 return; 7373 } 7374 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 7375 chk->sent = SCTP_DATAGRAM_UNSENT; 7376 chk->snd_count = 0; 7377 chk->whoTo = asoc->primary_destination; 7378 atomic_add_int(&chk->whoTo->ref_count, 1); 7379 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 7380 asoc->ctrl_queue_cnt++; 7381 sctp_fill_in_rest: 7382 /* 7383 * Here we go through and fill out the part that deals with 7384 * stream/seq of the ones we skip. 7385 */ 7386 SCTP_BUF_LEN(chk->data) = 0; 7387 { 7388 struct sctp_tmit_chunk *at, *tp1, *last; 7389 struct sctp_strseq *strseq; 7390 unsigned int cnt_of_space, i, ovh; 7391 unsigned int space_needed; 7392 unsigned int cnt_of_skipped = 0; 7393 7394 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 7395 if (at->sent != SCTP_FORWARD_TSN_SKIP) { 7396 /* no more to look at */ 7397 break; 7398 } 7399 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 7400 /* We don't report these */ 7401 continue; 7402 } 7403 cnt_of_skipped++; 7404 } 7405 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 7406 (cnt_of_skipped * sizeof(struct sctp_strseq))); 7407 7408 cnt_of_space = M_TRAILINGSPACE(chk->data); 7409 7410 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 7411 ovh = SCTP_MIN_OVERHEAD; 7412 } else { 7413 ovh = SCTP_MIN_V4_OVERHEAD; 7414 } 7415 if (cnt_of_space > (asoc->smallest_mtu - ovh)) { 7416 /* trim to a mtu size */ 7417 cnt_of_space = asoc->smallest_mtu - ovh; 7418 } 7419 if (cnt_of_space < space_needed) { 7420 /* 7421 * ok we must trim down the chunk by lowering the 7422 * advance peer ack point. 7423 */ 7424 cnt_of_skipped = (cnt_of_space - 7425 ((sizeof(struct sctp_forward_tsn_chunk)) / 7426 sizeof(struct sctp_strseq))); 7427 /* 7428 * Go through and find the TSN that will be the one 7429 * we report. 7430 */ 7431 at = TAILQ_FIRST(&asoc->sent_queue); 7432 for (i = 0; i < cnt_of_skipped; i++) { 7433 tp1 = TAILQ_NEXT(at, sctp_next); 7434 at = tp1; 7435 } 7436 last = at; 7437 /* 7438 * last now points to last one I can report, update 7439 * peer ack point 7440 */ 7441 asoc->advanced_peer_ack_point = last->rec.data.TSN_seq; 7442 space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq)); 7443 } 7444 chk->send_size = space_needed; 7445 /* Setup the chunk */ 7446 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 7447 fwdtsn->ch.chunk_length = htons(chk->send_size); 7448 fwdtsn->ch.chunk_flags = 0; 7449 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 7450 fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point); 7451 chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) + 7452 (cnt_of_skipped * sizeof(struct sctp_strseq))); 7453 SCTP_BUF_LEN(chk->data) = chk->send_size; 7454 fwdtsn++; 7455 /* 7456 * Move pointer to after the fwdtsn and transfer to the 7457 * strseq pointer. 7458 */ 7459 strseq = (struct sctp_strseq *)fwdtsn; 7460 /* 7461 * Now populate the strseq list. This is done blindly 7462 * without pulling out duplicate stream info. This is 7463 * inefficent but won't harm the process since the peer will 7464 * look at these in sequence and will thus release anything. 7465 * It could mean we exceed the PMTU and chop off some that 7466 * we could have included.. but this is unlikely (aka 1432/4 7467 * would mean 300+ stream seq's would have to be reported in 7468 * one FWD-TSN. With a bit of work we can later FIX this to 7469 * optimize and pull out duplcates.. but it does add more 7470 * overhead. So for now... not! 7471 */ 7472 at = TAILQ_FIRST(&asoc->sent_queue); 7473 for (i = 0; i < cnt_of_skipped; i++) { 7474 tp1 = TAILQ_NEXT(at, sctp_next); 7475 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 7476 /* We don't report these */ 7477 i--; 7478 at = tp1; 7479 continue; 7480 } 7481 strseq->stream = ntohs(at->rec.data.stream_number); 7482 strseq->sequence = ntohs(at->rec.data.stream_seq); 7483 strseq++; 7484 at = tp1; 7485 } 7486 } 7487 return; 7488 7489 } 7490 7491 void 7492 sctp_send_sack(struct sctp_tcb *stcb) 7493 { 7494 /* 7495 * Queue up a SACK in the control queue. We must first check to see 7496 * if a SACK is somehow on the control queue. If so, we will take 7497 * and and remove the old one. 7498 */ 7499 struct sctp_association *asoc; 7500 struct sctp_tmit_chunk *chk, *a_chk; 7501 struct sctp_sack_chunk *sack; 7502 struct sctp_gap_ack_block *gap_descriptor; 7503 struct sack_track *selector; 7504 int mergeable = 0; 7505 int offset; 7506 caddr_t limit; 7507 uint32_t *dup; 7508 int limit_reached = 0; 7509 unsigned int i, jstart, siz, j; 7510 unsigned int num_gap_blocks = 0, space; 7511 int num_dups = 0; 7512 int space_req; 7513 7514 7515 a_chk = NULL; 7516 asoc = &stcb->asoc; 7517 SCTP_TCB_LOCK_ASSERT(stcb); 7518 if (asoc->last_data_chunk_from == NULL) { 7519 /* Hmm we never received anything */ 7520 return; 7521 } 7522 sctp_set_rwnd(stcb, asoc); 7523 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7524 if (chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) { 7525 /* Hmm, found a sack already on queue, remove it */ 7526 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7527 asoc->ctrl_queue_cnt++; 7528 a_chk = chk; 7529 if (a_chk->data) { 7530 sctp_m_freem(a_chk->data); 7531 a_chk->data = NULL; 7532 } 7533 sctp_free_remote_addr(a_chk->whoTo); 7534 a_chk->whoTo = NULL; 7535 break; 7536 } 7537 } 7538 if (a_chk == NULL) { 7539 sctp_alloc_a_chunk(stcb, a_chk); 7540 if (a_chk == NULL) { 7541 /* No memory so we drop the idea, and set a timer */ 7542 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 7543 stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5); 7544 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 7545 stcb->sctp_ep, stcb, NULL); 7546 return; 7547 } 7548 a_chk->copy_by_ref = 0; 7549 /* a_chk->rec.chunk_id.id = SCTP_SELECTIVE_ACK; */ 7550 a_chk->rec.chunk_id.id = SCTP_SELECTIVE_ACK; 7551 a_chk->rec.chunk_id.can_take_data = 1; 7552 } 7553 a_chk->asoc = asoc; 7554 a_chk->snd_count = 0; 7555 a_chk->send_size = 0; /* fill in later */ 7556 a_chk->sent = SCTP_DATAGRAM_UNSENT; 7557 7558 if ((asoc->numduptsns) || 7559 (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE) 7560 ) { 7561 /* 7562 * Ok, we have some duplicates or the destination for the 7563 * sack is unreachable, lets see if we can select an 7564 * alternate than asoc->last_data_chunk_from 7565 */ 7566 if ((!(asoc->last_data_chunk_from->dest_state & 7567 SCTP_ADDR_NOT_REACHABLE)) && 7568 (asoc->used_alt_onsack > asoc->numnets)) { 7569 /* We used an alt last time, don't this time */ 7570 a_chk->whoTo = NULL; 7571 } else { 7572 asoc->used_alt_onsack++; 7573 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0); 7574 } 7575 if (a_chk->whoTo == NULL) { 7576 /* Nope, no alternate */ 7577 a_chk->whoTo = asoc->last_data_chunk_from; 7578 asoc->used_alt_onsack = 0; 7579 } 7580 } else { 7581 /* 7582 * No duplicates so we use the last place we received data 7583 * from. 7584 */ 7585 asoc->used_alt_onsack = 0; 7586 a_chk->whoTo = asoc->last_data_chunk_from; 7587 } 7588 if (a_chk->whoTo) { 7589 atomic_add_int(&a_chk->whoTo->ref_count, 1); 7590 } 7591 if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) { 7592 /* no gaps */ 7593 space_req = sizeof(struct sctp_sack_chunk); 7594 } else { 7595 /* gaps get a cluster */ 7596 space_req = MCLBYTES; 7597 } 7598 /* Ok now lets formulate a MBUF with our sack */ 7599 a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_DONTWAIT, 1, MT_DATA); 7600 if ((a_chk->data == NULL) || 7601 (a_chk->whoTo == NULL)) { 7602 /* rats, no mbuf memory */ 7603 if (a_chk->data) { 7604 /* was a problem with the destination */ 7605 sctp_m_freem(a_chk->data); 7606 a_chk->data = NULL; 7607 } 7608 if (a_chk->whoTo) 7609 atomic_subtract_int(&a_chk->whoTo->ref_count, 1); 7610 sctp_free_a_chunk(stcb, a_chk); 7611 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 7612 stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_6); 7613 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 7614 stcb->sctp_ep, stcb, NULL); 7615 return; 7616 } 7617 /* ok, lets go through and fill it in */ 7618 SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD); 7619 space = M_TRAILINGSPACE(a_chk->data); 7620 if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) { 7621 space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD); 7622 } 7623 limit = mtod(a_chk->data, caddr_t); 7624 limit += space; 7625 7626 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 7627 sack->ch.chunk_type = SCTP_SELECTIVE_ACK; 7628 /* 0x01 is used by nonce for ecn */ 7629 sack->ch.chunk_flags = (asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM); 7630 if (sctp_cmt_on_off && sctp_cmt_use_dac) { 7631 /* 7632 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been 7633 * received, then set high bit to 1, else 0. Reset 7634 * pkts_rcvd. 7635 */ 7636 sack->ch.chunk_flags |= (asoc->cmt_dac_pkts_rcvd << 6); 7637 asoc->cmt_dac_pkts_rcvd = 0; 7638 } 7639 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 7640 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 7641 asoc->my_last_reported_rwnd = asoc->my_rwnd; 7642 7643 /* reset the readers interpretation */ 7644 stcb->freed_by_sorcv_sincelast = 0; 7645 7646 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk)); 7647 7648 7649 siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 7650 if (asoc->cumulative_tsn < asoc->mapping_array_base_tsn) { 7651 offset = 1; 7652 /* 7653 * cum-ack behind the mapping array, so we start and use all 7654 * entries. 7655 */ 7656 jstart = 0; 7657 } else { 7658 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 7659 /* 7660 * we skip the first one when the cum-ack is at or above the 7661 * mapping array base. 7662 */ 7663 jstart = 1; 7664 } 7665 if (compare_with_wrap(asoc->highest_tsn_inside_map, asoc->cumulative_tsn, MAX_TSN)) { 7666 /* we have a gap .. maybe */ 7667 for (i = 0; i < siz; i++) { 7668 selector = &sack_array[asoc->mapping_array[i]]; 7669 if (mergeable && selector->right_edge) { 7670 /* 7671 * Backup, left and right edges were ok to 7672 * merge. 7673 */ 7674 num_gap_blocks--; 7675 gap_descriptor--; 7676 } 7677 if (selector->num_entries == 0) 7678 mergeable = 0; 7679 else { 7680 for (j = jstart; j < selector->num_entries; j++) { 7681 if (mergeable && selector->right_edge) { 7682 /* 7683 * do a merge by NOT setting 7684 * the left side 7685 */ 7686 mergeable = 0; 7687 } else { 7688 /* 7689 * no merge, set the left 7690 * side 7691 */ 7692 mergeable = 0; 7693 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 7694 } 7695 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 7696 num_gap_blocks++; 7697 gap_descriptor++; 7698 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 7699 /* no more room */ 7700 limit_reached = 1; 7701 break; 7702 } 7703 } 7704 if (selector->left_edge) { 7705 mergeable = 1; 7706 } 7707 } 7708 jstart = 0; 7709 offset += 8; 7710 } 7711 if (num_gap_blocks == 0) { 7712 /* reneged all chunks */ 7713 asoc->highest_tsn_inside_map = asoc->cumulative_tsn; 7714 } 7715 } 7716 /* now we must add any dups we are going to report. */ 7717 if ((limit_reached == 0) && (asoc->numduptsns)) { 7718 dup = (uint32_t *) gap_descriptor; 7719 for (i = 0; i < asoc->numduptsns; i++) { 7720 *dup = htonl(asoc->dup_tsns[i]); 7721 dup++; 7722 num_dups++; 7723 if (((caddr_t)dup + sizeof(uint32_t)) > limit) { 7724 /* no more room */ 7725 break; 7726 } 7727 } 7728 asoc->numduptsns = 0; 7729 } 7730 /* 7731 * now that the chunk is prepared queue it to the control chunk 7732 * queue. 7733 */ 7734 a_chk->send_size = (sizeof(struct sctp_sack_chunk) + 7735 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) + 7736 (num_dups * sizeof(int32_t))); 7737 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 7738 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 7739 sack->sack.num_dup_tsns = htons(num_dups); 7740 sack->ch.chunk_length = htons(a_chk->send_size); 7741 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 7742 asoc->ctrl_queue_cnt++; 7743 SCTP_STAT_INCR(sctps_sendsacks); 7744 return; 7745 } 7746 7747 7748 void 7749 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr) 7750 { 7751 struct mbuf *m_abort; 7752 struct mbuf *m_out = NULL, *m_end = NULL; 7753 struct sctp_abort_chunk *abort = NULL; 7754 int sz; 7755 uint32_t auth_offset = 0; 7756 struct sctp_auth_chunk *auth = NULL; 7757 struct sctphdr *shdr; 7758 7759 /* 7760 * Add an AUTH chunk, if chunk requires it and save the offset into 7761 * the chain for AUTH 7762 */ 7763 if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION, 7764 stcb->asoc.peer_auth_chunks)) { 7765 m_out = sctp_add_auth_chunk(m_out, &m_end, &auth, &auth_offset, 7766 stcb, SCTP_ABORT_ASSOCIATION); 7767 } 7768 SCTP_TCB_LOCK_ASSERT(stcb); 7769 m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_DONTWAIT, 1, MT_HEADER); 7770 if (m_abort == NULL) { 7771 /* no mbuf's */ 7772 if (m_out) 7773 sctp_m_freem(m_out); 7774 return; 7775 } 7776 /* link in any error */ 7777 SCTP_BUF_NEXT(m_abort) = operr; 7778 sz = 0; 7779 if (operr) { 7780 struct mbuf *n; 7781 7782 n = operr; 7783 while (n) { 7784 sz += SCTP_BUF_LEN(n); 7785 n = SCTP_BUF_NEXT(n); 7786 } 7787 } 7788 SCTP_BUF_LEN(m_abort) = sizeof(*abort); 7789 if (m_out == NULL) { 7790 /* NO Auth chunk prepended, so reserve space in front */ 7791 SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD); 7792 m_out = m_abort; 7793 } else { 7794 /* Put AUTH chunk at the front of the chain */ 7795 SCTP_BUF_NEXT(m_end) = m_abort; 7796 } 7797 7798 /* fill in the ABORT chunk */ 7799 abort = mtod(m_abort, struct sctp_abort_chunk *); 7800 abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION; 7801 abort->ch.chunk_flags = 0; 7802 abort->ch.chunk_length = htons(sizeof(*abort) + sz); 7803 7804 /* prepend and fill in the SCTP header */ 7805 SCTP_BUF_PREPEND(m_out, sizeof(struct sctphdr), M_DONTWAIT); 7806 if (m_out == NULL) { 7807 /* TSNH: no memory */ 7808 return; 7809 } 7810 shdr = mtod(m_out, struct sctphdr *); 7811 shdr->src_port = stcb->sctp_ep->sctp_lport; 7812 shdr->dest_port = stcb->rport; 7813 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 7814 shdr->checksum = 0; 7815 auth_offset += sizeof(struct sctphdr); 7816 7817 sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, 7818 stcb->asoc.primary_destination, 7819 (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr, 7820 m_out, auth_offset, auth, 1, 0, NULL, 0); 7821 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 7822 } 7823 7824 int 7825 sctp_send_shutdown_complete(struct sctp_tcb *stcb, 7826 struct sctp_nets *net) 7827 { 7828 /* formulate and SEND a SHUTDOWN-COMPLETE */ 7829 struct mbuf *m_shutdown_comp; 7830 struct sctp_shutdown_complete_msg *comp_cp; 7831 7832 m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_complete_msg), 0, M_DONTWAIT, 1, MT_HEADER); 7833 if (m_shutdown_comp == NULL) { 7834 /* no mbuf's */ 7835 return (-1); 7836 } 7837 comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *); 7838 comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 7839 comp_cp->shut_cmp.ch.chunk_flags = 0; 7840 comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 7841 comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport; 7842 comp_cp->sh.dest_port = stcb->rport; 7843 comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag); 7844 comp_cp->sh.checksum = 0; 7845 7846 SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_msg); 7847 sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 7848 (struct sockaddr *)&net->ro._l_addr, 7849 m_shutdown_comp, 0, NULL, 1, 0, NULL, 0); 7850 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 7851 return (0); 7852 } 7853 7854 int 7855 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh) 7856 { 7857 /* formulate and SEND a SHUTDOWN-COMPLETE */ 7858 struct mbuf *o_pak; 7859 struct mbuf *mout; 7860 struct ip *iph, *iph_out; 7861 struct ip6_hdr *ip6, *ip6_out; 7862 int offset_out, len; 7863 struct sctp_shutdown_complete_msg *comp_cp; 7864 7865 /* Get room for the largest message */ 7866 len = (sizeof(struct ip6_hdr) + sizeof(struct sctp_shutdown_complete_msg)); 7867 7868 o_pak = SCTP_GET_HEADER_FOR_OUTPUT(len); 7869 if (o_pak == NULL) { 7870 /* no mbuf's */ 7871 return (-1); 7872 } 7873 mout = SCTP_HEADER_TO_CHAIN(o_pak); 7874 iph = mtod(m, struct ip *); 7875 iph_out = NULL; 7876 ip6_out = NULL; 7877 offset_out = 0; 7878 if (iph->ip_v == IPVERSION) { 7879 SCTP_BUF_LEN(mout) = sizeof(struct ip) + 7880 sizeof(struct sctp_shutdown_complete_msg); 7881 SCTP_BUF_NEXT(mout) = NULL; 7882 iph_out = mtod(mout, struct ip *); 7883 7884 /* Fill in the IP header for the ABORT */ 7885 iph_out->ip_v = IPVERSION; 7886 iph_out->ip_hl = (sizeof(struct ip) / 4); 7887 iph_out->ip_tos = (u_char)0; 7888 iph_out->ip_id = 0; 7889 iph_out->ip_off = 0; 7890 iph_out->ip_ttl = MAXTTL; 7891 iph_out->ip_p = IPPROTO_SCTP; 7892 iph_out->ip_src.s_addr = iph->ip_dst.s_addr; 7893 iph_out->ip_dst.s_addr = iph->ip_src.s_addr; 7894 7895 /* let IP layer calculate this */ 7896 iph_out->ip_sum = 0; 7897 offset_out += sizeof(*iph_out); 7898 comp_cp = (struct sctp_shutdown_complete_msg *)( 7899 (caddr_t)iph_out + offset_out); 7900 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 7901 ip6 = (struct ip6_hdr *)iph; 7902 SCTP_BUF_LEN(mout) = sizeof(struct ip6_hdr) + 7903 sizeof(struct sctp_shutdown_complete_msg); 7904 SCTP_BUF_NEXT(mout) = NULL; 7905 ip6_out = mtod(mout, struct ip6_hdr *); 7906 7907 /* Fill in the IPv6 header for the ABORT */ 7908 ip6_out->ip6_flow = ip6->ip6_flow; 7909 ip6_out->ip6_hlim = ip6_defhlim; 7910 ip6_out->ip6_nxt = IPPROTO_SCTP; 7911 ip6_out->ip6_src = ip6->ip6_dst; 7912 ip6_out->ip6_dst = ip6->ip6_src; 7913 /* 7914 * ?? The old code had both the iph len + payload, I think 7915 * this is wrong and would never have worked 7916 */ 7917 ip6_out->ip6_plen = sizeof(struct sctp_shutdown_complete_msg); 7918 offset_out += sizeof(*ip6_out); 7919 comp_cp = (struct sctp_shutdown_complete_msg *)( 7920 (caddr_t)ip6_out + offset_out); 7921 } else { 7922 /* Currently not supported. */ 7923 return (-1); 7924 } 7925 7926 SCTP_HEADER_LEN(o_pak) = SCTP_BUF_LEN(mout); 7927 /* Now copy in and fill in the ABORT tags etc. */ 7928 comp_cp->sh.src_port = sh->dest_port; 7929 comp_cp->sh.dest_port = sh->src_port; 7930 comp_cp->sh.checksum = 0; 7931 comp_cp->sh.v_tag = sh->v_tag; 7932 comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB; 7933 comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 7934 comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 7935 7936 /* add checksum */ 7937 if ((sctp_no_csum_on_loopback) && SCTP_IS_IT_LOOPBACK(o_pak)) { 7938 comp_cp->sh.checksum = 0; 7939 } else { 7940 comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out); 7941 } 7942 if (iph_out != NULL) { 7943 struct route ro; 7944 7945 bzero(&ro, sizeof ro); 7946 /* set IPv4 length */ 7947 iph_out->ip_len = SCTP_HEADER_LEN(o_pak); 7948 /* out it goes */ 7949 ip_output(o_pak, 0, &ro, IP_RAWOUTPUT, NULL 7950 ,NULL 7951 ); 7952 /* Free the route if we got one back */ 7953 if (ro.ro_rt) 7954 RTFREE(ro.ro_rt); 7955 } else if (ip6_out != NULL) { 7956 struct route_in6 ro; 7957 7958 7959 bzero(&ro, sizeof(ro)); 7960 ip6_output(o_pak, NULL, &ro, 0, NULL, NULL 7961 ,NULL 7962 ); 7963 /* Free the route if we got one back */ 7964 if (ro.ro_rt) 7965 RTFREE(ro.ro_rt); 7966 } 7967 SCTP_STAT_INCR(sctps_sendpackets); 7968 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 7969 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 7970 return (0); 7971 } 7972 7973 static struct sctp_nets * 7974 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now) 7975 { 7976 struct sctp_nets *net, *hnet; 7977 int ms_goneby, highest_ms, state_overide = 0; 7978 7979 SCTP_GETTIME_TIMEVAL(now); 7980 highest_ms = 0; 7981 hnet = NULL; 7982 SCTP_TCB_LOCK_ASSERT(stcb); 7983 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 7984 if ( 7985 ((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) || 7986 (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE) 7987 ) { 7988 /* 7989 * Skip this guy from consideration if HB is off AND 7990 * its confirmed 7991 */ 7992 continue; 7993 } 7994 if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro._l_addr) == 0) { 7995 /* skip this dest net from consideration */ 7996 continue; 7997 } 7998 if (net->last_sent_time.tv_sec) { 7999 /* Sent to so we subtract */ 8000 ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000; 8001 } else 8002 /* Never been sent to */ 8003 ms_goneby = 0x7fffffff; 8004 /* 8005 * When the address state is unconfirmed but still 8006 * considered reachable, we HB at a higher rate. Once it 8007 * goes confirmed OR reaches the "unreachable" state, thenw 8008 * we cut it back to HB at a more normal pace. 8009 */ 8010 if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED | SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) { 8011 state_overide = 1; 8012 } else { 8013 state_overide = 0; 8014 } 8015 8016 if ((((unsigned int)ms_goneby >= net->RTO) || (state_overide)) && 8017 (ms_goneby > highest_ms)) { 8018 highest_ms = ms_goneby; 8019 hnet = net; 8020 } 8021 } 8022 if (hnet && 8023 ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED | SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) { 8024 state_overide = 1; 8025 } else { 8026 state_overide = 0; 8027 } 8028 8029 if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_overide)) { 8030 /* 8031 * Found the one with longest delay bounds OR it is 8032 * unconfirmed and still not marked unreachable. 8033 */ 8034 #ifdef SCTP_DEBUG 8035 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8036 printf("net:%p is the hb winner -", 8037 hnet); 8038 if (hnet) 8039 sctp_print_address((struct sockaddr *)&hnet->ro._l_addr); 8040 else 8041 printf(" none\n"); 8042 } 8043 #endif 8044 /* update the timer now */ 8045 hnet->last_sent_time = *now; 8046 return (hnet); 8047 } 8048 /* Nothing to HB */ 8049 return (NULL); 8050 } 8051 8052 int 8053 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net) 8054 { 8055 struct sctp_tmit_chunk *chk; 8056 struct sctp_nets *net; 8057 struct sctp_heartbeat_chunk *hb; 8058 struct timeval now; 8059 struct sockaddr_in *sin; 8060 struct sockaddr_in6 *sin6; 8061 8062 SCTP_TCB_LOCK_ASSERT(stcb); 8063 if (user_req == 0) { 8064 net = sctp_select_hb_destination(stcb, &now); 8065 if (net == NULL) { 8066 /* 8067 * All our busy none to send to, just start the 8068 * timer again. 8069 */ 8070 if (stcb->asoc.state == 0) { 8071 return (0); 8072 } 8073 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, 8074 stcb->sctp_ep, 8075 stcb, 8076 net); 8077 return (0); 8078 } 8079 } else { 8080 net = u_net; 8081 if (net == NULL) { 8082 return (0); 8083 } 8084 SCTP_GETTIME_TIMEVAL(&now); 8085 } 8086 sin = (struct sockaddr_in *)&net->ro._l_addr; 8087 if (sin->sin_family != AF_INET) { 8088 if (sin->sin_family != AF_INET6) { 8089 /* huh */ 8090 return (0); 8091 } 8092 } 8093 sctp_alloc_a_chunk(stcb, chk); 8094 if (chk == NULL) { 8095 #ifdef SCTP_DEBUG 8096 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8097 printf("Gak, can't get a chunk for hb\n"); 8098 } 8099 #endif 8100 return (0); 8101 } 8102 chk->copy_by_ref = 0; 8103 chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST; 8104 chk->rec.chunk_id.can_take_data = 1; 8105 chk->asoc = &stcb->asoc; 8106 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 8107 8108 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER); 8109 if (chk->data == NULL) { 8110 sctp_free_a_chunk(stcb, chk); 8111 return (0); 8112 } 8113 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 8114 SCTP_BUF_LEN(chk->data) = chk->send_size; 8115 chk->sent = SCTP_DATAGRAM_UNSENT; 8116 chk->snd_count = 0; 8117 chk->whoTo = net; 8118 atomic_add_int(&chk->whoTo->ref_count, 1); 8119 /* Now we have a mbuf that we can fill in with the details */ 8120 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 8121 8122 /* fill out chunk header */ 8123 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 8124 hb->ch.chunk_flags = 0; 8125 hb->ch.chunk_length = htons(chk->send_size); 8126 /* Fill out hb parameter */ 8127 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 8128 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 8129 hb->heartbeat.hb_info.time_value_1 = now.tv_sec; 8130 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 8131 /* Did our user request this one, put it in */ 8132 hb->heartbeat.hb_info.user_req = user_req; 8133 hb->heartbeat.hb_info.addr_family = sin->sin_family; 8134 hb->heartbeat.hb_info.addr_len = sin->sin_len; 8135 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 8136 /* 8137 * we only take from the entropy pool if the address is not 8138 * confirmed. 8139 */ 8140 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 8141 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 8142 } else { 8143 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 8144 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 8145 } 8146 if (sin->sin_family == AF_INET) { 8147 memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr)); 8148 } else if (sin->sin_family == AF_INET6) { 8149 /* We leave the scope the way it is in our lookup table. */ 8150 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 8151 memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr)); 8152 } else { 8153 /* huh compiler bug */ 8154 return (0); 8155 } 8156 /* ok we have a destination that needs a beat */ 8157 /* lets do the theshold management Qiaobing style */ 8158 8159 if (sctp_threshold_management(stcb->sctp_ep, stcb, net, 8160 stcb->asoc.max_send_times)) { 8161 /* 8162 * we have lost the association, in a way this is quite bad 8163 * since we really are one less time since we really did not 8164 * send yet. This is the down side to the Q's style as 8165 * defined in the RFC and not my alternate style defined in 8166 * the RFC. 8167 */ 8168 atomic_subtract_int(&chk->whoTo->ref_count, 1); 8169 if (chk->data != NULL) { 8170 sctp_m_freem(chk->data); 8171 chk->data = NULL; 8172 } 8173 sctp_free_a_chunk(stcb, chk); 8174 return (-1); 8175 } 8176 net->hb_responded = 0; 8177 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8178 stcb->asoc.ctrl_queue_cnt++; 8179 SCTP_STAT_INCR(sctps_sendheartbeat); 8180 /* 8181 * Call directly med level routine to put out the chunk. It will 8182 * always tumble out control chunks aka HB but it may even tumble 8183 * out data too. 8184 */ 8185 return (1); 8186 } 8187 8188 void 8189 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 8190 uint32_t high_tsn) 8191 { 8192 struct sctp_association *asoc; 8193 struct sctp_ecne_chunk *ecne; 8194 struct sctp_tmit_chunk *chk; 8195 8196 asoc = &stcb->asoc; 8197 SCTP_TCB_LOCK_ASSERT(stcb); 8198 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 8199 if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 8200 /* found a previous ECN_ECHO update it if needed */ 8201 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 8202 ecne->tsn = htonl(high_tsn); 8203 return; 8204 } 8205 } 8206 /* nope could not find one to update so we must build one */ 8207 sctp_alloc_a_chunk(stcb, chk); 8208 if (chk == NULL) { 8209 return; 8210 } 8211 chk->copy_by_ref = 0; 8212 SCTP_STAT_INCR(sctps_sendecne); 8213 chk->rec.chunk_id.id = SCTP_ECN_ECHO; 8214 chk->rec.chunk_id.can_take_data = 0; 8215 chk->asoc = &stcb->asoc; 8216 chk->send_size = sizeof(struct sctp_ecne_chunk); 8217 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER); 8218 if (chk->data == NULL) { 8219 sctp_free_a_chunk(stcb, chk); 8220 return; 8221 } 8222 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 8223 SCTP_BUF_LEN(chk->data) = chk->send_size; 8224 chk->sent = SCTP_DATAGRAM_UNSENT; 8225 chk->snd_count = 0; 8226 chk->whoTo = net; 8227 atomic_add_int(&chk->whoTo->ref_count, 1); 8228 stcb->asoc.ecn_echo_cnt_onq++; 8229 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 8230 ecne->ch.chunk_type = SCTP_ECN_ECHO; 8231 ecne->ch.chunk_flags = 0; 8232 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 8233 ecne->tsn = htonl(high_tsn); 8234 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8235 asoc->ctrl_queue_cnt++; 8236 } 8237 8238 void 8239 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 8240 struct mbuf *m, int iphlen, int bad_crc) 8241 { 8242 struct sctp_association *asoc; 8243 struct sctp_pktdrop_chunk *drp; 8244 struct sctp_tmit_chunk *chk; 8245 uint8_t *datap; 8246 int len; 8247 unsigned int small_one; 8248 struct ip *iph; 8249 8250 long spc; 8251 8252 asoc = &stcb->asoc; 8253 SCTP_TCB_LOCK_ASSERT(stcb); 8254 if (asoc->peer_supports_pktdrop == 0) { 8255 /* 8256 * peer must declare support before I send one. 8257 */ 8258 return; 8259 } 8260 if (stcb->sctp_socket == NULL) { 8261 return; 8262 } 8263 sctp_alloc_a_chunk(stcb, chk); 8264 if (chk == NULL) { 8265 return; 8266 } 8267 chk->copy_by_ref = 0; 8268 iph = mtod(m, struct ip *); 8269 if (iph == NULL) { 8270 return; 8271 } 8272 if (iph->ip_v == IPVERSION) { 8273 /* IPv4 */ 8274 len = chk->send_size = iph->ip_len; 8275 } else { 8276 struct ip6_hdr *ip6h; 8277 8278 /* IPv6 */ 8279 ip6h = mtod(m, struct ip6_hdr *); 8280 len = chk->send_size = htons(ip6h->ip6_plen); 8281 } 8282 chk->asoc = &stcb->asoc; 8283 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 8284 if (chk->data == NULL) { 8285 jump_out: 8286 sctp_free_a_chunk(stcb, chk); 8287 return; 8288 } 8289 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 8290 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 8291 if (drp == NULL) { 8292 sctp_m_freem(chk->data); 8293 chk->data = NULL; 8294 goto jump_out; 8295 } 8296 small_one = asoc->smallest_mtu; 8297 if (small_one > MCLBYTES) { 8298 /* Only one cluster worth of data MAX */ 8299 small_one = MCLBYTES; 8300 } 8301 chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 8302 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD)); 8303 if (chk->book_size > small_one) { 8304 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 8305 drp->trunc_len = htons(chk->send_size); 8306 chk->send_size = small_one - (SCTP_MED_OVERHEAD + 8307 sizeof(struct sctp_pktdrop_chunk) + 8308 sizeof(struct sctphdr)); 8309 len = chk->send_size; 8310 } else { 8311 /* no truncation needed */ 8312 drp->ch.chunk_flags = 0; 8313 drp->trunc_len = htons(0); 8314 } 8315 if (bad_crc) { 8316 drp->ch.chunk_flags |= SCTP_BADCRC; 8317 } 8318 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 8319 SCTP_BUF_LEN(chk->data) = chk->send_size; 8320 chk->sent = SCTP_DATAGRAM_UNSENT; 8321 chk->snd_count = 0; 8322 if (net) { 8323 /* we should hit here */ 8324 chk->whoTo = net; 8325 } else { 8326 chk->whoTo = asoc->primary_destination; 8327 } 8328 atomic_add_int(&chk->whoTo->ref_count, 1); 8329 chk->rec.chunk_id.id = SCTP_PACKET_DROPPED; 8330 chk->rec.chunk_id.can_take_data = 1; 8331 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 8332 drp->ch.chunk_length = htons(chk->send_size); 8333 spc = stcb->sctp_socket->so_rcv.sb_hiwat; 8334 if (spc < 0) { 8335 spc = 0; 8336 } 8337 drp->bottle_bw = htonl(spc); 8338 if (asoc->my_rwnd) { 8339 drp->current_onq = htonl(asoc->size_on_reasm_queue + 8340 asoc->size_on_all_streams + 8341 asoc->my_rwnd_control_len + 8342 stcb->sctp_socket->so_rcv.sb_cc); 8343 } else { 8344 /* 8345 * If my rwnd is 0, possibly from mbuf depletion as well as 8346 * space used, tell the peer there is NO space aka onq == bw 8347 */ 8348 drp->current_onq = htonl(spc); 8349 } 8350 drp->reserved = 0; 8351 datap = drp->data; 8352 m_copydata(m, iphlen, len, (caddr_t)datap); 8353 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8354 asoc->ctrl_queue_cnt++; 8355 } 8356 8357 void 8358 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn) 8359 { 8360 struct sctp_association *asoc; 8361 struct sctp_cwr_chunk *cwr; 8362 struct sctp_tmit_chunk *chk; 8363 8364 asoc = &stcb->asoc; 8365 SCTP_TCB_LOCK_ASSERT(stcb); 8366 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 8367 if (chk->rec.chunk_id.id == SCTP_ECN_CWR) { 8368 /* found a previous ECN_CWR update it if needed */ 8369 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 8370 if (compare_with_wrap(high_tsn, ntohl(cwr->tsn), 8371 MAX_TSN)) { 8372 cwr->tsn = htonl(high_tsn); 8373 } 8374 return; 8375 } 8376 } 8377 /* nope could not find one to update so we must build one */ 8378 sctp_alloc_a_chunk(stcb, chk); 8379 if (chk == NULL) { 8380 return; 8381 } 8382 chk->copy_by_ref = 0; 8383 chk->rec.chunk_id.id = SCTP_ECN_CWR; 8384 chk->rec.chunk_id.can_take_data = 1; 8385 chk->asoc = &stcb->asoc; 8386 chk->send_size = sizeof(struct sctp_cwr_chunk); 8387 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER); 8388 if (chk->data == NULL) { 8389 sctp_free_a_chunk(stcb, chk); 8390 return; 8391 } 8392 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 8393 SCTP_BUF_LEN(chk->data) = chk->send_size; 8394 chk->sent = SCTP_DATAGRAM_UNSENT; 8395 chk->snd_count = 0; 8396 chk->whoTo = net; 8397 atomic_add_int(&chk->whoTo->ref_count, 1); 8398 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 8399 cwr->ch.chunk_type = SCTP_ECN_CWR; 8400 cwr->ch.chunk_flags = 0; 8401 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 8402 cwr->tsn = htonl(high_tsn); 8403 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8404 asoc->ctrl_queue_cnt++; 8405 } 8406 8407 void 8408 sctp_add_stream_reset_out(struct sctp_tmit_chunk *chk, 8409 int number_entries, uint16_t * list, 8410 uint32_t seq, uint32_t resp_seq, uint32_t last_sent) 8411 { 8412 int len, old_len, i; 8413 struct sctp_stream_reset_out_request *req_out; 8414 struct sctp_chunkhdr *ch; 8415 8416 ch = mtod(chk->data, struct sctp_chunkhdr *); 8417 8418 8419 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 8420 8421 /* get to new offset for the param. */ 8422 req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len); 8423 /* now how long will this param be? */ 8424 len = (sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries)); 8425 req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST); 8426 req_out->ph.param_length = htons(len); 8427 req_out->request_seq = htonl(seq); 8428 req_out->response_seq = htonl(resp_seq); 8429 req_out->send_reset_at_tsn = htonl(last_sent); 8430 if (number_entries) { 8431 for (i = 0; i < number_entries; i++) { 8432 req_out->list_of_streams[i] = htons(list[i]); 8433 } 8434 } 8435 if (SCTP_SIZE32(len) > len) { 8436 /* 8437 * Need to worry about the pad we may end up adding to the 8438 * end. This is easy since the struct is either aligned to 4 8439 * bytes or 2 bytes off. 8440 */ 8441 req_out->list_of_streams[number_entries] = 0; 8442 } 8443 /* now fix the chunk length */ 8444 ch->chunk_length = htons(len + old_len); 8445 chk->book_size = len + old_len; 8446 chk->send_size = SCTP_SIZE32(chk->book_size); 8447 SCTP_BUF_LEN(chk->data) = chk->send_size; 8448 return; 8449 } 8450 8451 8452 void 8453 sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk, 8454 int number_entries, uint16_t * list, 8455 uint32_t seq) 8456 { 8457 int len, old_len, i; 8458 struct sctp_stream_reset_in_request *req_in; 8459 struct sctp_chunkhdr *ch; 8460 8461 ch = mtod(chk->data, struct sctp_chunkhdr *); 8462 8463 8464 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 8465 8466 /* get to new offset for the param. */ 8467 req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len); 8468 /* now how long will this param be? */ 8469 len = (sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries)); 8470 req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST); 8471 req_in->ph.param_length = htons(len); 8472 req_in->request_seq = htonl(seq); 8473 if (number_entries) { 8474 for (i = 0; i < number_entries; i++) { 8475 req_in->list_of_streams[i] = htons(list[i]); 8476 } 8477 } 8478 if (SCTP_SIZE32(len) > len) { 8479 /* 8480 * Need to worry about the pad we may end up adding to the 8481 * end. This is easy since the struct is either aligned to 4 8482 * bytes or 2 bytes off. 8483 */ 8484 req_in->list_of_streams[number_entries] = 0; 8485 } 8486 /* now fix the chunk length */ 8487 ch->chunk_length = htons(len + old_len); 8488 chk->book_size = len + old_len; 8489 chk->send_size = SCTP_SIZE32(chk->book_size); 8490 SCTP_BUF_LEN(chk->data) = chk->send_size; 8491 return; 8492 } 8493 8494 8495 void 8496 sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk, 8497 uint32_t seq) 8498 { 8499 int len, old_len; 8500 struct sctp_stream_reset_tsn_request *req_tsn; 8501 struct sctp_chunkhdr *ch; 8502 8503 ch = mtod(chk->data, struct sctp_chunkhdr *); 8504 8505 8506 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 8507 8508 /* get to new offset for the param. */ 8509 req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len); 8510 /* now how long will this param be? */ 8511 len = sizeof(struct sctp_stream_reset_tsn_request); 8512 req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST); 8513 req_tsn->ph.param_length = htons(len); 8514 req_tsn->request_seq = htonl(seq); 8515 8516 /* now fix the chunk length */ 8517 ch->chunk_length = htons(len + old_len); 8518 chk->send_size = len + old_len; 8519 chk->book_size = SCTP_SIZE32(chk->send_size); 8520 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 8521 return; 8522 } 8523 8524 void 8525 sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk, 8526 uint32_t resp_seq, uint32_t result) 8527 { 8528 int len, old_len; 8529 struct sctp_stream_reset_response *resp; 8530 struct sctp_chunkhdr *ch; 8531 8532 ch = mtod(chk->data, struct sctp_chunkhdr *); 8533 8534 8535 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 8536 8537 /* get to new offset for the param. */ 8538 resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len); 8539 /* now how long will this param be? */ 8540 len = sizeof(struct sctp_stream_reset_response); 8541 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 8542 resp->ph.param_length = htons(len); 8543 resp->response_seq = htonl(resp_seq); 8544 resp->result = ntohl(result); 8545 8546 /* now fix the chunk length */ 8547 ch->chunk_length = htons(len + old_len); 8548 chk->book_size = len + old_len; 8549 chk->send_size = SCTP_SIZE32(chk->book_size); 8550 SCTP_BUF_LEN(chk->data) = chk->send_size; 8551 return; 8552 8553 } 8554 8555 8556 void 8557 sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk, 8558 uint32_t resp_seq, uint32_t result, 8559 uint32_t send_una, uint32_t recv_next) 8560 { 8561 int len, old_len; 8562 struct sctp_stream_reset_response_tsn *resp; 8563 struct sctp_chunkhdr *ch; 8564 8565 ch = mtod(chk->data, struct sctp_chunkhdr *); 8566 8567 8568 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 8569 8570 /* get to new offset for the param. */ 8571 resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len); 8572 /* now how long will this param be? */ 8573 len = sizeof(struct sctp_stream_reset_response_tsn); 8574 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 8575 resp->ph.param_length = htons(len); 8576 resp->response_seq = htonl(resp_seq); 8577 resp->result = htonl(result); 8578 resp->senders_next_tsn = htonl(send_una); 8579 resp->receivers_next_tsn = htonl(recv_next); 8580 8581 /* now fix the chunk length */ 8582 ch->chunk_length = htons(len + old_len); 8583 chk->book_size = len + old_len; 8584 chk->send_size = SCTP_SIZE32(chk->book_size); 8585 SCTP_BUF_LEN(chk->data) = chk->send_size; 8586 return; 8587 } 8588 8589 8590 int 8591 sctp_send_str_reset_req(struct sctp_tcb *stcb, 8592 int number_entries, uint16_t * list, 8593 uint8_t send_out_req, uint32_t resp_seq, 8594 uint8_t send_in_req, 8595 uint8_t send_tsn_req) 8596 { 8597 8598 struct sctp_association *asoc; 8599 struct sctp_tmit_chunk *chk; 8600 struct sctp_chunkhdr *ch; 8601 uint32_t seq; 8602 8603 asoc = &stcb->asoc; 8604 if (asoc->stream_reset_outstanding) { 8605 /* 8606 * Already one pending, must get ACK back to clear the flag. 8607 */ 8608 return (EBUSY); 8609 } 8610 if ((send_out_req == 0) && (send_in_req == 0) && (send_tsn_req == 0)) { 8611 /* nothing to do */ 8612 return (EINVAL); 8613 } 8614 if (send_tsn_req && (send_out_req || send_in_req)) { 8615 /* error, can't do that */ 8616 return (EINVAL); 8617 } 8618 sctp_alloc_a_chunk(stcb, chk); 8619 if (chk == NULL) { 8620 return (ENOMEM); 8621 } 8622 chk->copy_by_ref = 0; 8623 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 8624 chk->rec.chunk_id.can_take_data = 0; 8625 chk->asoc = &stcb->asoc; 8626 chk->book_size = sizeof(struct sctp_chunkhdr); 8627 chk->send_size = SCTP_SIZE32(chk->book_size); 8628 8629 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 8630 if (chk->data == NULL) { 8631 sctp_free_a_chunk(stcb, chk); 8632 return (ENOMEM); 8633 } 8634 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 8635 8636 /* setup chunk parameters */ 8637 chk->sent = SCTP_DATAGRAM_UNSENT; 8638 chk->snd_count = 0; 8639 chk->whoTo = asoc->primary_destination; 8640 atomic_add_int(&chk->whoTo->ref_count, 1); 8641 8642 ch = mtod(chk->data, struct sctp_chunkhdr *); 8643 ch->chunk_type = SCTP_STREAM_RESET; 8644 ch->chunk_flags = 0; 8645 ch->chunk_length = htons(chk->book_size); 8646 SCTP_BUF_LEN(chk->data) = chk->send_size; 8647 8648 seq = stcb->asoc.str_reset_seq_out; 8649 if (send_out_req) { 8650 sctp_add_stream_reset_out(chk, number_entries, list, 8651 seq, resp_seq, (stcb->asoc.sending_seq - 1)); 8652 asoc->stream_reset_out_is_outstanding = 1; 8653 seq++; 8654 asoc->stream_reset_outstanding++; 8655 } 8656 if (send_in_req) { 8657 sctp_add_stream_reset_in(chk, number_entries, list, seq); 8658 asoc->stream_reset_outstanding++; 8659 } 8660 if (send_tsn_req) { 8661 sctp_add_stream_reset_tsn(chk, seq); 8662 asoc->stream_reset_outstanding++; 8663 } 8664 asoc->str_reset = chk; 8665 8666 /* insert the chunk for sending */ 8667 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 8668 chk, 8669 sctp_next); 8670 asoc->ctrl_queue_cnt++; 8671 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 8672 return (0); 8673 } 8674 8675 void 8676 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag, 8677 struct mbuf *err_cause) 8678 { 8679 /* 8680 * Formulate the abort message, and send it back down. 8681 */ 8682 struct mbuf *o_pak; 8683 struct mbuf *mout; 8684 struct sctp_abort_msg *abm; 8685 struct ip *iph, *iph_out; 8686 struct ip6_hdr *ip6, *ip6_out; 8687 int iphlen_out; 8688 8689 /* don't respond to ABORT with ABORT */ 8690 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 8691 if (err_cause) 8692 sctp_m_freem(err_cause); 8693 return; 8694 } 8695 o_pak = SCTP_GET_HEADER_FOR_OUTPUT((sizeof(struct ip6_hdr) + sizeof(struct sctp_abort_msg))); 8696 if (o_pak == NULL) { 8697 if (err_cause) 8698 sctp_m_freem(err_cause); 8699 return; 8700 } 8701 mout = SCTP_HEADER_TO_CHAIN(o_pak); 8702 iph = mtod(m, struct ip *); 8703 iph_out = NULL; 8704 ip6_out = NULL; 8705 if (iph->ip_v == IPVERSION) { 8706 iph_out = mtod(mout, struct ip *); 8707 SCTP_BUF_LEN(mout) = sizeof(*iph_out) + sizeof(*abm); 8708 SCTP_BUF_NEXT(mout) = err_cause; 8709 8710 /* Fill in the IP header for the ABORT */ 8711 iph_out->ip_v = IPVERSION; 8712 iph_out->ip_hl = (sizeof(struct ip) / 4); 8713 iph_out->ip_tos = (u_char)0; 8714 iph_out->ip_id = 0; 8715 iph_out->ip_off = 0; 8716 iph_out->ip_ttl = MAXTTL; 8717 iph_out->ip_p = IPPROTO_SCTP; 8718 iph_out->ip_src.s_addr = iph->ip_dst.s_addr; 8719 iph_out->ip_dst.s_addr = iph->ip_src.s_addr; 8720 /* let IP layer calculate this */ 8721 iph_out->ip_sum = 0; 8722 8723 iphlen_out = sizeof(*iph_out); 8724 abm = (struct sctp_abort_msg *)((caddr_t)iph_out + iphlen_out); 8725 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 8726 ip6 = (struct ip6_hdr *)iph; 8727 ip6_out = mtod(mout, struct ip6_hdr *); 8728 SCTP_BUF_LEN(mout) = sizeof(*ip6_out) + sizeof(*abm); 8729 SCTP_BUF_NEXT(mout) = err_cause; 8730 8731 /* Fill in the IP6 header for the ABORT */ 8732 ip6_out->ip6_flow = ip6->ip6_flow; 8733 ip6_out->ip6_hlim = ip6_defhlim; 8734 ip6_out->ip6_nxt = IPPROTO_SCTP; 8735 ip6_out->ip6_src = ip6->ip6_dst; 8736 ip6_out->ip6_dst = ip6->ip6_src; 8737 8738 iphlen_out = sizeof(*ip6_out); 8739 abm = (struct sctp_abort_msg *)((caddr_t)ip6_out + iphlen_out); 8740 } else { 8741 /* Currently not supported */ 8742 return; 8743 } 8744 8745 abm->sh.src_port = sh->dest_port; 8746 abm->sh.dest_port = sh->src_port; 8747 abm->sh.checksum = 0; 8748 if (vtag == 0) { 8749 abm->sh.v_tag = sh->v_tag; 8750 abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB; 8751 } else { 8752 abm->sh.v_tag = htonl(vtag); 8753 abm->msg.ch.chunk_flags = 0; 8754 } 8755 abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION; 8756 8757 if (err_cause) { 8758 struct mbuf *m_tmp = err_cause; 8759 int err_len = 0; 8760 8761 /* get length of the err_cause chain */ 8762 while (m_tmp != NULL) { 8763 err_len += SCTP_BUF_LEN(m_tmp); 8764 m_tmp = SCTP_BUF_NEXT(m_tmp); 8765 } 8766 SCTP_HEADER_LEN(o_pak) = SCTP_BUF_LEN(mout) + err_len; 8767 if (err_len % 4) { 8768 /* need pad at end of chunk */ 8769 uint32_t cpthis = 0; 8770 int padlen; 8771 8772 padlen = 4 - (SCTP_HEADER_LEN(o_pak) % 4); 8773 m_copyback(mout, SCTP_HEADER_LEN(o_pak), padlen, (caddr_t)&cpthis); 8774 SCTP_HEADER_LEN(o_pak) += padlen; 8775 } 8776 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len); 8777 } else { 8778 SCTP_HEADER_LEN(mout) = SCTP_BUF_LEN(mout); 8779 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch)); 8780 } 8781 8782 /* add checksum */ 8783 if ((sctp_no_csum_on_loopback) && SCTP_IS_IT_LOOPBACK(m)) { 8784 abm->sh.checksum = 0; 8785 } else { 8786 abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out); 8787 } 8788 if (iph_out != NULL) { 8789 struct route ro; 8790 8791 /* zap the stack pointer to the route */ 8792 bzero(&ro, sizeof ro); 8793 #ifdef SCTP_DEBUG 8794 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 8795 printf("sctp_send_abort calling ip_output:\n"); 8796 sctp_print_address_pkt(iph_out, &abm->sh); 8797 } 8798 #endif 8799 /* set IPv4 length */ 8800 iph_out->ip_len = SCTP_HEADER_LEN(o_pak); 8801 /* out it goes */ 8802 (void)ip_output(o_pak, 0, &ro, IP_RAWOUTPUT, NULL 8803 ,NULL 8804 ); 8805 /* Free the route if we got one back */ 8806 if (ro.ro_rt) 8807 RTFREE(ro.ro_rt); 8808 } else if (ip6_out != NULL) { 8809 struct route_in6 ro; 8810 8811 8812 /* zap the stack pointer to the route */ 8813 bzero(&ro, sizeof(ro)); 8814 #ifdef SCTP_DEBUG 8815 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 8816 printf("sctp_send_abort calling ip6_output:\n"); 8817 sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh); 8818 } 8819 #endif 8820 ip6_out->ip6_plen = SCTP_HEADER_LEN(o_pak) - sizeof(*ip6_out); 8821 ip6_output(o_pak, NULL, &ro, 0, NULL, NULL 8822 ,NULL 8823 ); 8824 /* Free the route if we got one back */ 8825 if (ro.ro_rt) 8826 RTFREE(ro.ro_rt); 8827 } 8828 SCTP_STAT_INCR(sctps_sendpackets); 8829 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 8830 } 8831 8832 void 8833 sctp_send_operr_to(struct mbuf *m, int iphlen, 8834 struct mbuf *scm, 8835 uint32_t vtag) 8836 { 8837 struct mbuf *o_pak; 8838 struct sctphdr *ihdr; 8839 int retcode; 8840 struct sctphdr *ohdr; 8841 struct sctp_chunkhdr *ophdr; 8842 8843 struct ip *iph; 8844 8845 #ifdef SCTP_DEBUG 8846 struct sockaddr_in6 lsa6, fsa6; 8847 8848 #endif 8849 uint32_t val; 8850 struct mbuf *at; 8851 int len; 8852 8853 iph = mtod(m, struct ip *); 8854 ihdr = (struct sctphdr *)((caddr_t)iph + iphlen); 8855 8856 SCTP_BUF_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), M_DONTWAIT); 8857 if (scm == NULL) { 8858 /* can't send because we can't add a mbuf */ 8859 return; 8860 } 8861 ohdr = mtod(scm, struct sctphdr *); 8862 ohdr->src_port = ihdr->dest_port; 8863 ohdr->dest_port = ihdr->src_port; 8864 ohdr->v_tag = vtag; 8865 ohdr->checksum = 0; 8866 ophdr = (struct sctp_chunkhdr *)(ohdr + 1); 8867 ophdr->chunk_type = SCTP_OPERATION_ERROR; 8868 ophdr->chunk_flags = 0; 8869 len = 0; 8870 at = scm; 8871 while (at) { 8872 len += SCTP_BUF_LEN(at); 8873 at = SCTP_BUF_NEXT(at); 8874 } 8875 8876 ophdr->chunk_length = htons(len - sizeof(struct sctphdr)); 8877 if (len % 4) { 8878 /* need padding */ 8879 uint32_t cpthis = 0; 8880 int padlen; 8881 8882 padlen = 4 - (len % 4); 8883 m_copyback(scm, len, padlen, (caddr_t)&cpthis); 8884 len += padlen; 8885 } 8886 if ((sctp_no_csum_on_loopback) && SCTP_IS_IT_LOOPBACK(m)) { 8887 val = 0; 8888 } else { 8889 val = sctp_calculate_sum(scm, NULL, 0); 8890 } 8891 ohdr->checksum = val; 8892 if (iph->ip_v == IPVERSION) { 8893 /* V4 */ 8894 struct ip *out; 8895 struct route ro; 8896 8897 o_pak = SCTP_GET_HEADER_FOR_OUTPUT(sizeof(struct ip)); 8898 if (o_pak == NULL) { 8899 sctp_m_freem(scm); 8900 return; 8901 } 8902 SCTP_BUF_LEN(SCTP_HEADER_TO_CHAIN(o_pak)) = sizeof(struct ip); 8903 len += sizeof(struct ip); 8904 SCTP_ATTACH_CHAIN(o_pak, scm, len); 8905 bzero(&ro, sizeof ro); 8906 out = mtod(SCTP_HEADER_TO_CHAIN(o_pak), struct ip *); 8907 out->ip_v = iph->ip_v; 8908 out->ip_hl = (sizeof(struct ip) / 4); 8909 out->ip_tos = iph->ip_tos; 8910 out->ip_id = iph->ip_id; 8911 out->ip_off = 0; 8912 out->ip_ttl = MAXTTL; 8913 out->ip_p = IPPROTO_SCTP; 8914 out->ip_sum = 0; 8915 out->ip_src = iph->ip_dst; 8916 out->ip_dst = iph->ip_src; 8917 out->ip_len = SCTP_HEADER_LEN(o_pak); 8918 retcode = ip_output(o_pak, 0, &ro, IP_RAWOUTPUT, NULL 8919 ,NULL 8920 ); 8921 SCTP_STAT_INCR(sctps_sendpackets); 8922 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 8923 /* Free the route if we got one back */ 8924 if (ro.ro_rt) 8925 RTFREE(ro.ro_rt); 8926 } else { 8927 /* V6 */ 8928 struct route_in6 ro; 8929 8930 struct ip6_hdr *out6, *in6; 8931 8932 o_pak = SCTP_GET_HEADER_FOR_OUTPUT(sizeof(struct ip6_hdr)); 8933 if (o_pak == NULL) { 8934 sctp_m_freem(scm); 8935 return; 8936 } 8937 SCTP_BUF_LEN(SCTP_HEADER_TO_CHAIN(o_pak)) = sizeof(struct ip6_hdr); 8938 len += sizeof(struct ip6_hdr); 8939 SCTP_ATTACH_CHAIN(o_pak, scm, len); 8940 8941 bzero(&ro, sizeof ro); 8942 in6 = mtod(m, struct ip6_hdr *); 8943 out6 = mtod(SCTP_HEADER_TO_CHAIN(o_pak), struct ip6_hdr *); 8944 out6->ip6_flow = in6->ip6_flow; 8945 out6->ip6_hlim = ip6_defhlim; 8946 out6->ip6_nxt = IPPROTO_SCTP; 8947 out6->ip6_src = in6->ip6_dst; 8948 out6->ip6_dst = in6->ip6_src; 8949 out6->ip6_plen = len - sizeof(struct ip6_hdr); 8950 #ifdef SCTP_DEBUG 8951 bzero(&lsa6, sizeof(lsa6)); 8952 lsa6.sin6_len = sizeof(lsa6); 8953 lsa6.sin6_family = AF_INET6; 8954 lsa6.sin6_addr = out6->ip6_src; 8955 bzero(&fsa6, sizeof(fsa6)); 8956 fsa6.sin6_len = sizeof(fsa6); 8957 fsa6.sin6_family = AF_INET6; 8958 fsa6.sin6_addr = out6->ip6_dst; 8959 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 8960 printf("sctp_operr_to calling ipv6 output:\n"); 8961 printf("src: "); 8962 sctp_print_address((struct sockaddr *)&lsa6); 8963 printf("dst "); 8964 sctp_print_address((struct sockaddr *)&fsa6); 8965 } 8966 #endif /* SCTP_DEBUG */ 8967 ip6_output(o_pak, NULL, &ro, 0, NULL, NULL 8968 ,NULL 8969 ); 8970 SCTP_STAT_INCR(sctps_sendpackets); 8971 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 8972 /* Free the route if we got one back */ 8973 if (ro.ro_rt) 8974 RTFREE(ro.ro_rt); 8975 } 8976 } 8977 8978 8979 8980 static struct mbuf * 8981 sctp_copy_resume(struct sctp_stream_queue_pending *sp, 8982 struct uio *uio, 8983 struct sctp_sndrcvinfo *srcv, 8984 int max_send_len, 8985 int user_marks_eor, 8986 int *error, 8987 uint32_t * sndout, 8988 struct mbuf **new_tail) 8989 { 8990 int left, cancpy, willcpy; 8991 struct mbuf *m, *prev, *head; 8992 8993 left = min(uio->uio_resid, max_send_len); 8994 /* Always get a header just in case */ 8995 head = sctp_get_mbuf_for_msg(left, 0, M_WAIT, 0, MT_DATA); 8996 cancpy = M_TRAILINGSPACE(head); 8997 willcpy = min(cancpy, left); 8998 *error = uiomove(mtod(head, caddr_t), willcpy, uio); 8999 if (*error) { 9000 sctp_m_freem(head); 9001 return (NULL); 9002 } 9003 *sndout += willcpy; 9004 left -= willcpy; 9005 SCTP_BUF_LEN(head) = willcpy; 9006 m = head; 9007 *new_tail = head; 9008 while (left > 0) { 9009 /* move in user data */ 9010 SCTP_BUF_NEXT(m) = sctp_get_mbuf_for_msg(left, 0, M_WAIT, 0, MT_DATA); 9011 if (SCTP_BUF_NEXT(m) == NULL) { 9012 sctp_m_freem(head); 9013 *new_tail = NULL; 9014 *error = ENOMEM; 9015 return (NULL); 9016 } 9017 prev = m; 9018 m = SCTP_BUF_NEXT(m); 9019 cancpy = M_TRAILINGSPACE(m); 9020 willcpy = min(cancpy, left); 9021 *error = uiomove(mtod(m, caddr_t), willcpy, uio); 9022 if (*error) { 9023 sctp_m_freem(head); 9024 *new_tail = NULL; 9025 *error = EFAULT; 9026 return (NULL); 9027 } 9028 SCTP_BUF_LEN(m) = willcpy; 9029 left -= willcpy; 9030 *sndout += willcpy; 9031 *new_tail = m; 9032 if (left == 0) { 9033 SCTP_BUF_NEXT(m) = NULL; 9034 } 9035 } 9036 return (head); 9037 } 9038 9039 static int 9040 sctp_copy_one(struct sctp_stream_queue_pending *sp, 9041 struct uio *uio, 9042 int resv_upfront) 9043 { 9044 int left, cancpy, willcpy, error; 9045 struct mbuf *m, *head; 9046 int cpsz = 0; 9047 9048 /* First one gets a header */ 9049 left = sp->length; 9050 head = m = sctp_get_mbuf_for_msg((left + resv_upfront), 0, M_WAIT, 0, MT_DATA); 9051 if (m == NULL) { 9052 return (ENOMEM); 9053 } 9054 /* 9055 * Add this one for m in now, that way if the alloc fails we won't 9056 * have a bad cnt. 9057 */ 9058 SCTP_BUF_RESV_UF(m, resv_upfront); 9059 cancpy = M_TRAILINGSPACE(m); 9060 willcpy = min(cancpy, left); 9061 while (left > 0) { 9062 /* move in user data */ 9063 error = uiomove(mtod(m, caddr_t), willcpy, uio); 9064 if (error) { 9065 sctp_m_freem(head); 9066 return (error); 9067 } 9068 SCTP_BUF_LEN(m) = willcpy; 9069 left -= willcpy; 9070 cpsz += willcpy; 9071 if (left > 0) { 9072 SCTP_BUF_NEXT(m) = sctp_get_mbuf_for_msg(left, 0, M_WAIT, 0, MT_DATA); 9073 if (SCTP_BUF_NEXT(m) == NULL) { 9074 /* 9075 * the head goes back to caller, he can free 9076 * the rest 9077 */ 9078 sctp_m_freem(head); 9079 return (ENOMEM); 9080 } 9081 m = SCTP_BUF_NEXT(m); 9082 cancpy = M_TRAILINGSPACE(m); 9083 willcpy = min(cancpy, left); 9084 } else { 9085 sp->tail_mbuf = m; 9086 SCTP_BUF_NEXT(m) = NULL; 9087 } 9088 } 9089 sp->data = head; 9090 sp->length = cpsz; 9091 return (0); 9092 } 9093 9094 9095 9096 static struct sctp_stream_queue_pending * 9097 sctp_copy_it_in(struct sctp_tcb *stcb, 9098 struct sctp_association *asoc, 9099 struct sctp_sndrcvinfo *srcv, 9100 struct uio *uio, 9101 struct sctp_nets *net, 9102 int max_send_len, 9103 int user_marks_eor, 9104 int *errno, 9105 int non_blocking) 9106 { 9107 /* 9108 * This routine must be very careful in its work. Protocol 9109 * processing is up and running so care must be taken to spl...() 9110 * when you need to do something that may effect the stcb/asoc. The 9111 * sb is locked however. When data is copied the protocol processing 9112 * should be enabled since this is a slower operation... 9113 */ 9114 struct sctp_stream_queue_pending *sp = NULL; 9115 int resv_in_first; 9116 9117 *errno = 0; 9118 /* 9119 * Unless E_EOR mode is on, we must make a send FIT in one call. 9120 */ 9121 if (((user_marks_eor == 0) && non_blocking) && 9122 (uio->uio_resid > stcb->sctp_socket->so_snd.sb_hiwat)) { 9123 /* It will NEVER fit */ 9124 *errno = EMSGSIZE; 9125 goto out_now; 9126 } 9127 /* Now can we send this? */ 9128 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 9129 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 9130 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 9131 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 9132 /* got data while shutting down */ 9133 *errno = ECONNRESET; 9134 goto out_now; 9135 } 9136 sp = (struct sctp_stream_queue_pending *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_strmoq); 9137 if (sp == NULL) { 9138 *errno = ENOMEM; 9139 goto out_now; 9140 } 9141 SCTP_INCR_STRMOQ_COUNT(); 9142 sp->act_flags = 0; 9143 sp->sinfo_flags = srcv->sinfo_flags; 9144 sp->timetolive = srcv->sinfo_timetolive; 9145 sp->ppid = srcv->sinfo_ppid; 9146 sp->context = srcv->sinfo_context; 9147 sp->strseq = 0; 9148 SCTP_GETTIME_TIMEVAL(&sp->ts); 9149 9150 sp->stream = srcv->sinfo_stream; 9151 sp->length = min(uio->uio_resid, max_send_len); 9152 if ((sp->length == uio->uio_resid) && 9153 ((user_marks_eor == 0) || 9154 (srcv->sinfo_flags & SCTP_EOF) || 9155 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR))) 9156 ) { 9157 sp->msg_is_complete = 1; 9158 } else { 9159 sp->msg_is_complete = 0; 9160 } 9161 sp->some_taken = 0; 9162 resv_in_first = sizeof(struct sctp_data_chunk); 9163 sp->data = sp->tail_mbuf = NULL; 9164 *errno = sctp_copy_one(sp, uio, resv_in_first); 9165 if (*errno) { 9166 sctp_free_a_strmoq(stcb, sp); 9167 sp->data = NULL; 9168 sp->net = NULL; 9169 sp = NULL; 9170 } else { 9171 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 9172 sp->net = net; 9173 sp->addr_over = 1; 9174 } else { 9175 sp->net = asoc->primary_destination; 9176 sp->addr_over = 0; 9177 } 9178 atomic_add_int(&sp->net->ref_count, 1); 9179 sctp_set_prsctp_policy(stcb, sp); 9180 } 9181 out_now: 9182 return (sp); 9183 } 9184 9185 9186 int 9187 sctp_sosend(struct socket *so, 9188 struct sockaddr *addr, 9189 struct uio *uio, 9190 struct mbuf *top, 9191 struct mbuf *control, 9192 int flags 9193 , 9194 struct thread *p 9195 ) 9196 { 9197 struct sctp_inpcb *inp; 9198 int s, error, use_rcvinfo = 0; 9199 struct sctp_sndrcvinfo srcv; 9200 9201 inp = (struct sctp_inpcb *)so->so_pcb; 9202 s = splnet(); 9203 if (control) { 9204 /* process cmsg snd/rcv info (maybe a assoc-id) */ 9205 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control, 9206 sizeof(srcv))) { 9207 /* got one */ 9208 use_rcvinfo = 1; 9209 } 9210 } 9211 error = sctp_lower_sosend(so, addr, uio, top, control, flags, 9212 use_rcvinfo, &srcv, p); 9213 splx(s); 9214 return (error); 9215 } 9216 9217 9218 extern unsigned int sctp_add_more_threshold; 9219 int 9220 sctp_lower_sosend(struct socket *so, 9221 struct sockaddr *addr, 9222 struct uio *uio, 9223 struct mbuf *i_pak, 9224 struct mbuf *control, 9225 int flags, 9226 int use_rcvinfo, 9227 struct sctp_sndrcvinfo *srcv, 9228 struct thread *p 9229 ) 9230 { 9231 unsigned int sndlen, max_len; 9232 int error, len; 9233 struct mbuf *top = NULL; 9234 int s, queue_only = 0, queue_only_for_init = 0; 9235 int free_cnt_applied = 0; 9236 int un_sent = 0; 9237 int now_filled = 0; 9238 struct sctp_block_entry be; 9239 struct sctp_inpcb *inp; 9240 struct sctp_tcb *stcb = NULL; 9241 struct timeval now; 9242 struct sctp_nets *net; 9243 struct sctp_association *asoc; 9244 struct sctp_inpcb *t_inp; 9245 int create_lock_applied = 0; 9246 int nagle_applies = 0; 9247 int some_on_control = 0; 9248 int got_all_of_the_send = 0; 9249 int hold_tcblock = 0; 9250 int non_blocking = 0; 9251 9252 error = 0; 9253 net = NULL; 9254 stcb = NULL; 9255 asoc = NULL; 9256 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 9257 if (inp == NULL) { 9258 error = EFAULT; 9259 splx(s); 9260 goto out_unlocked; 9261 } 9262 atomic_add_int(&inp->total_sends, 1); 9263 if (uio) 9264 sndlen = uio->uio_resid; 9265 else { 9266 sndlen = SCTP_HEADER_LEN(i_pak); 9267 top = SCTP_HEADER_TO_CHAIN(i_pak); 9268 } 9269 9270 s = splnet(); 9271 hold_tcblock = 0; 9272 9273 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 9274 (inp->sctp_socket->so_qlimit)) { 9275 /* The listener can NOT send */ 9276 error = EFAULT; 9277 splx(s); 9278 goto out_unlocked; 9279 } 9280 if ((use_rcvinfo) && srcv) { 9281 if (srcv->sinfo_flags) 9282 SCTP_STAT_INCR(sctps_sends_with_flags); 9283 9284 if (srcv->sinfo_flags & SCTP_SENDALL) { 9285 /* its a sendall */ 9286 error = sctp_sendall(inp, uio, top, srcv); 9287 top = NULL; 9288 splx(s); 9289 goto out_unlocked; 9290 } 9291 } 9292 /* now we must find the assoc */ 9293 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 9294 SCTP_INP_RLOCK(inp); 9295 stcb = LIST_FIRST(&inp->sctp_asoc_list); 9296 if (stcb == NULL) { 9297 SCTP_INP_RUNLOCK(inp); 9298 error = ENOTCONN; 9299 splx(s); 9300 goto out_unlocked; 9301 } 9302 hold_tcblock = 0; 9303 SCTP_INP_RUNLOCK(inp); 9304 if (addr) 9305 /* Must locate the net structure if addr given */ 9306 net = sctp_findnet(stcb, addr); 9307 else 9308 net = stcb->asoc.primary_destination; 9309 9310 } else if (use_rcvinfo && srcv && srcv->sinfo_assoc_id) { 9311 stcb = sctp_findassociation_ep_asocid(inp, srcv->sinfo_assoc_id, 0); 9312 if (stcb) { 9313 if (addr) 9314 /* 9315 * Must locate the net structure if addr 9316 * given 9317 */ 9318 net = sctp_findnet(stcb, addr); 9319 else 9320 net = stcb->asoc.primary_destination; 9321 } 9322 hold_tcblock = 0; 9323 } else if (addr) { 9324 /* 9325 * Since we did not use findep we must increment it, and if 9326 * we don't find a tcb decrement it. 9327 */ 9328 SCTP_INP_WLOCK(inp); 9329 SCTP_INP_INCR_REF(inp); 9330 SCTP_INP_WUNLOCK(inp); 9331 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 9332 if (stcb == NULL) { 9333 SCTP_INP_WLOCK(inp); 9334 SCTP_INP_DECR_REF(inp); 9335 SCTP_INP_WUNLOCK(inp); 9336 } else { 9337 hold_tcblock = 1; 9338 } 9339 } 9340 if ((stcb == NULL) && (addr)) { 9341 /* Possible implicit send? */ 9342 SCTP_ASOC_CREATE_LOCK(inp); 9343 create_lock_applied = 1; 9344 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 9345 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 9346 /* Should I really unlock ? */ 9347 error = EFAULT; 9348 splx(s); 9349 goto out_unlocked; 9350 9351 } 9352 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 9353 (addr->sa_family == AF_INET6)) { 9354 error = EINVAL; 9355 splx(s); 9356 goto out_unlocked; 9357 } 9358 SCTP_INP_WLOCK(inp); 9359 SCTP_INP_INCR_REF(inp); 9360 SCTP_INP_WUNLOCK(inp); 9361 /* With the lock applied look again */ 9362 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 9363 if (stcb == NULL) { 9364 SCTP_INP_WLOCK(inp); 9365 SCTP_INP_DECR_REF(inp); 9366 SCTP_INP_WUNLOCK(inp); 9367 } else { 9368 hold_tcblock = 1; 9369 } 9370 } 9371 if (stcb == NULL) { 9372 if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 9373 error = ENOTCONN; 9374 splx(s); 9375 goto out_unlocked; 9376 } else if (addr == NULL) { 9377 error = ENOENT; 9378 splx(s); 9379 goto out_unlocked; 9380 } else { 9381 /* 9382 * UDP style, we must go ahead and start the INIT 9383 * process 9384 */ 9385 if ((use_rcvinfo) && (srcv) && 9386 (srcv->sinfo_flags & SCTP_ABORT)) { 9387 /* User asks to abort a non-existant asoc */ 9388 error = ENOENT; 9389 splx(s); 9390 goto out_unlocked; 9391 } 9392 /* get an asoc/stcb struct */ 9393 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0); 9394 if (stcb == NULL) { 9395 /* Error is setup for us in the call */ 9396 splx(s); 9397 goto out_unlocked; 9398 } 9399 if (create_lock_applied) { 9400 SCTP_ASOC_CREATE_UNLOCK(inp); 9401 create_lock_applied = 0; 9402 } else { 9403 printf("Huh-3? create lock should have been on??\n"); 9404 } 9405 /* 9406 * Turn on queue only flag to prevent data from 9407 * being sent 9408 */ 9409 queue_only = 1; 9410 asoc = &stcb->asoc; 9411 asoc->state = SCTP_STATE_COOKIE_WAIT; 9412 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 9413 9414 /* initialize authentication params for the assoc */ 9415 sctp_initialize_auth_params(inp, stcb); 9416 9417 if (control) { 9418 /* 9419 * see if a init structure exists in cmsg 9420 * headers 9421 */ 9422 struct sctp_initmsg initm; 9423 int i; 9424 9425 if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, 9426 sizeof(initm))) { 9427 /* 9428 * we have an INIT override of the 9429 * default 9430 */ 9431 if (initm.sinit_max_attempts) 9432 asoc->max_init_times = initm.sinit_max_attempts; 9433 if (initm.sinit_num_ostreams) 9434 asoc->pre_open_streams = initm.sinit_num_ostreams; 9435 if (initm.sinit_max_instreams) 9436 asoc->max_inbound_streams = initm.sinit_max_instreams; 9437 if (initm.sinit_max_init_timeo) 9438 asoc->initial_init_rto_max = initm.sinit_max_init_timeo; 9439 if (asoc->streamoutcnt < asoc->pre_open_streams) { 9440 /* Default is NOT correct */ 9441 #ifdef SCTP_DEBUG 9442 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 9443 printf("Ok, defout:%d pre_open:%d\n", 9444 asoc->streamoutcnt, asoc->pre_open_streams); 9445 } 9446 #endif 9447 SCTP_FREE(asoc->strmout); 9448 asoc->strmout = NULL; 9449 asoc->streamoutcnt = asoc->pre_open_streams; 9450 /* 9451 * What happens if this 9452 * fails? .. we panic ... 9453 */ 9454 { 9455 struct sctp_stream_out *tmp_str; 9456 int had_lock = 0; 9457 9458 if (hold_tcblock) { 9459 had_lock = 1; 9460 SCTP_TCB_UNLOCK(stcb); 9461 } 9462 SCTP_MALLOC(tmp_str, 9463 struct sctp_stream_out *, 9464 asoc->streamoutcnt * 9465 sizeof(struct sctp_stream_out), 9466 "StreamsOut"); 9467 if (had_lock) { 9468 SCTP_TCB_LOCK(stcb); 9469 } 9470 asoc->strmout = tmp_str; 9471 } 9472 for (i = 0; i < asoc->streamoutcnt; i++) { 9473 /* 9474 * inbound side must 9475 * be set to 0xffff, 9476 * also NOTE when we 9477 * get the INIT-ACK 9478 * back (for INIT 9479 * sender) we MUST 9480 * reduce the count 9481 * (streamoutcnt) 9482 * but first check 9483 * if we sent to any 9484 * of the upper 9485 * streams that were 9486 * dropped (if some 9487 * were). Those that 9488 * were dropped must 9489 * be notified to 9490 * the upper layer 9491 * as failed to 9492 * send. 9493 */ 9494 asoc->strmout[i].next_sequence_sent = 0x0; 9495 TAILQ_INIT(&asoc->strmout[i].outqueue); 9496 asoc->strmout[i].stream_no = i; 9497 asoc->strmout[i].last_msg_incomplete = 0; 9498 asoc->strmout[i].next_spoke.tqe_next = 0; 9499 asoc->strmout[i].next_spoke.tqe_prev = 0; 9500 } 9501 } 9502 } 9503 } 9504 hold_tcblock = 1; 9505 /* out with the INIT */ 9506 queue_only_for_init = 1; 9507 /* 9508 * we may want to dig in after this call and adjust 9509 * the MTU value. It defaulted to 1500 (constant) 9510 * but the ro structure may now have an update and 9511 * thus we may need to change it BEFORE we append 9512 * the message. 9513 */ 9514 net = stcb->asoc.primary_destination; 9515 asoc = &stcb->asoc; 9516 } 9517 } 9518 if (((so->so_state & SS_NBIO) 9519 || (flags & MSG_NBIO) 9520 )) { 9521 non_blocking = 1; 9522 } 9523 asoc = &stcb->asoc; 9524 /* would we block? */ 9525 if (non_blocking) { 9526 if ((so->so_snd.sb_hiwat < 9527 (sndlen + stcb->asoc.total_output_queue_size)) || 9528 (stcb->asoc.chunks_on_out_queue > 9529 sctp_max_chunks_on_queue)) { 9530 error = EWOULDBLOCK; 9531 atomic_add_int(&stcb->sctp_ep->total_nospaces, 1); 9532 splx(s); 9533 goto out_unlocked; 9534 } 9535 } 9536 /* Keep the stcb from being freed under our feet */ 9537 atomic_add_int(&stcb->asoc.refcnt, 1); 9538 free_cnt_applied = 1; 9539 9540 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 9541 error = ECONNRESET; 9542 goto out_unlocked; 9543 } 9544 if (create_lock_applied) { 9545 SCTP_ASOC_CREATE_UNLOCK(inp); 9546 create_lock_applied = 0; 9547 } 9548 if (asoc->stream_reset_outstanding) { 9549 /* 9550 * Can't queue any data while stream reset is underway. 9551 */ 9552 error = EAGAIN; 9553 goto out_unlocked; 9554 } 9555 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 9556 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 9557 queue_only = 1; 9558 } 9559 if ((use_rcvinfo == 0) || (srcv == NULL)) { 9560 /* Grab the default stuff from the asoc */ 9561 srcv = &stcb->asoc.def_send; 9562 } 9563 /* we are now done with all control */ 9564 if (control) { 9565 sctp_m_freem(control); 9566 control = NULL; 9567 } 9568 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 9569 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 9570 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 9571 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 9572 if ((use_rcvinfo) && 9573 (srcv->sinfo_flags & SCTP_ABORT)) { 9574 ; 9575 } else { 9576 error = ECONNRESET; 9577 splx(s); 9578 goto out_unlocked; 9579 } 9580 } 9581 /* Ok, we will attempt a msgsnd :> */ 9582 if (p) { 9583 p->td_proc->p_stats->p_ru.ru_msgsnd++; 9584 } 9585 if (stcb) { 9586 if (net && ((srcv->sinfo_flags & SCTP_ADDR_OVER))) { 9587 /* we take the override or the unconfirmed */ 9588 ; 9589 } else { 9590 net = stcb->asoc.primary_destination; 9591 } 9592 } 9593 if ((net->flight_size > net->cwnd) && (sctp_cmt_on_off == 0)) { 9594 /* 9595 * CMT: Added check for CMT above. net above is the primary 9596 * dest. If CMT is ON, sender should always attempt to send 9597 * with the output routine sctp_fill_outqueue() that loops 9598 * through all destination addresses. Therefore, if CMT is 9599 * ON, queue_only is NOT set to 1 here, so that 9600 * sctp_chunk_output() can be called below. 9601 */ 9602 queue_only = 1; 9603 9604 } else if (asoc->ifp_had_enobuf) { 9605 SCTP_STAT_INCR(sctps_ifnomemqueued); 9606 if (net->flight_size > (net->mtu * 2)) 9607 queue_only = 1; 9608 asoc->ifp_had_enobuf = 0; 9609 } else { 9610 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 9611 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk))); 9612 } 9613 /* Are we aborting? */ 9614 if (srcv->sinfo_flags & SCTP_ABORT) { 9615 struct mbuf *mm; 9616 int tot_demand, tot_out, max; 9617 9618 SCTP_STAT_INCR(sctps_sends_with_abort); 9619 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 9620 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 9621 /* It has to be up before we abort */ 9622 /* how big is the user initiated abort? */ 9623 error = EINVAL; 9624 goto out; 9625 } 9626 if (hold_tcblock) { 9627 SCTP_TCB_UNLOCK(stcb); 9628 hold_tcblock = 0; 9629 } 9630 if (top) { 9631 struct mbuf *cntm; 9632 9633 mm = sctp_get_mbuf_for_msg(1, 0, M_WAIT, 1, MT_DATA); 9634 9635 tot_out = 0; 9636 cntm = top; 9637 while (cntm) { 9638 tot_out += SCTP_BUF_LEN(cntm); 9639 cntm = SCTP_BUF_NEXT(cntm); 9640 } 9641 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 9642 } else { 9643 /* Must fit in a MTU */ 9644 tot_out = uio->uio_resid; 9645 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 9646 mm = sctp_get_mbuf_for_msg(tot_demand, 0, M_WAIT, 1, MT_DATA); 9647 } 9648 if (mm == NULL) { 9649 error = ENOMEM; 9650 goto out; 9651 } 9652 max = asoc->smallest_mtu - sizeof(struct sctp_paramhdr); 9653 max -= sizeof(struct sctp_abort_msg); 9654 if (tot_out > max) { 9655 tot_out = max; 9656 } 9657 if (mm) { 9658 struct sctp_paramhdr *ph; 9659 9660 /* now move forward the data pointer */ 9661 ph = mtod(mm, struct sctp_paramhdr *); 9662 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 9663 ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out)); 9664 ph++; 9665 SCTP_BUF_LEN(mm) = tot_out + sizeof(struct sctp_paramhdr); 9666 if (top == NULL) { 9667 error = uiomove((caddr_t)ph, (int)tot_out, uio); 9668 if (error) { 9669 /* 9670 * Here if we can't get his data we 9671 * still abort we just don't get to 9672 * send the users note :-0 9673 */ 9674 sctp_m_freem(mm); 9675 mm = NULL; 9676 } 9677 } else { 9678 SCTP_BUF_NEXT(mm) = top; 9679 } 9680 } 9681 if (hold_tcblock == 0) { 9682 SCTP_TCB_LOCK(stcb); 9683 hold_tcblock = 1; 9684 } 9685 atomic_add_int(&stcb->asoc.refcnt, -1); 9686 free_cnt_applied = 0; 9687 /* release this lock, otherwise we hang on ourselves */ 9688 sctp_abort_an_association(stcb->sctp_ep, stcb, 9689 SCTP_RESPONSE_TO_USER_REQ, 9690 mm); 9691 /* now relock the stcb so everything is sane */ 9692 hold_tcblock = 0; 9693 stcb = NULL; 9694 goto out_unlocked; 9695 } 9696 /* Calculate the maximum we can send */ 9697 if (so->so_snd.sb_hiwat > stcb->asoc.total_output_queue_size) { 9698 max_len = so->so_snd.sb_hiwat - stcb->asoc.total_output_queue_size; 9699 } else { 9700 max_len = 0; 9701 } 9702 if (hold_tcblock) { 9703 SCTP_TCB_UNLOCK(stcb); 9704 hold_tcblock = 0; 9705 } 9706 splx(s); 9707 /* Is the stream no. valid? */ 9708 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 9709 /* Invalid stream number */ 9710 error = EINVAL; 9711 goto out_unlocked; 9712 } 9713 if (asoc->strmout == NULL) { 9714 /* huh? software error */ 9715 error = EFAULT; 9716 goto out_unlocked; 9717 } 9718 len = 0; 9719 if (max_len < sctp_add_more_threshold) { 9720 /* No room right no ! */ 9721 SOCKBUF_LOCK(&so->so_snd); 9722 while (so->so_snd.sb_hiwat < (stcb->asoc.total_output_queue_size + sctp_add_more_threshold)) { 9723 #ifdef SCTP_BLK_LOGGING 9724 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA, 9725 so, asoc, uio->uio_resid); 9726 #endif 9727 be.error = 0; 9728 stcb->block_entry = &be; 9729 error = sbwait(&so->so_snd); 9730 stcb->block_entry = NULL; 9731 if (error || so->so_error || be.error) { 9732 if (error == 0) { 9733 if (so->so_error) 9734 error = so->so_error; 9735 if (be.error) { 9736 error = be.error; 9737 } 9738 } 9739 SOCKBUF_UNLOCK(&so->so_snd); 9740 goto out_unlocked; 9741 } 9742 #ifdef SCTP_BLK_LOGGING 9743 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 9744 so, asoc, stcb->asoc.total_output_queue_size); 9745 #endif 9746 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 9747 goto out_unlocked; 9748 } 9749 } 9750 if (so->so_snd.sb_hiwat > stcb->asoc.total_output_queue_size) { 9751 max_len = so->so_snd.sb_hiwat - stcb->asoc.total_output_queue_size; 9752 } else { 9753 max_len = 0; 9754 } 9755 SOCKBUF_UNLOCK(&so->so_snd); 9756 } 9757 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 9758 goto out_unlocked; 9759 } 9760 atomic_add_int(&stcb->total_sends, 1); 9761 if (top == NULL) { 9762 struct sctp_stream_queue_pending *sp; 9763 struct sctp_stream_out *strm; 9764 uint32_t sndout, initial_out; 9765 int user_marks_eor; 9766 9767 if (uio->uio_resid == 0) { 9768 if (srcv->sinfo_flags & SCTP_EOF) { 9769 got_all_of_the_send = 1; 9770 goto dataless_eof; 9771 } else { 9772 error = EINVAL; 9773 goto out; 9774 } 9775 } 9776 initial_out = uio->uio_resid; 9777 9778 if ((asoc->stream_locked) && 9779 (asoc->stream_locked_on != srcv->sinfo_stream)) { 9780 error = EAGAIN; 9781 goto out; 9782 } 9783 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 9784 user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 9785 if (strm->last_msg_incomplete == 0) { 9786 do_a_copy_in: 9787 sp = sctp_copy_it_in(stcb, asoc, srcv, uio, net, max_len, user_marks_eor, &error, non_blocking); 9788 if ((sp == NULL) || (error)) { 9789 goto out; 9790 } 9791 SCTP_TCB_SEND_LOCK(stcb); 9792 if (sp->msg_is_complete) { 9793 strm->last_msg_incomplete = 0; 9794 asoc->stream_locked = 0; 9795 } else { 9796 /* 9797 * Just got locked to this guy in case of an 9798 * interupt. 9799 */ 9800 strm->last_msg_incomplete = 1; 9801 asoc->stream_locked = 1; 9802 asoc->stream_locked_on = srcv->sinfo_stream; 9803 } 9804 sctp_snd_sb_alloc(stcb, sp->length); 9805 9806 asoc->stream_queue_cnt++; 9807 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 9808 if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) { 9809 sp->strseq = strm->next_sequence_sent; 9810 #ifdef SCTP_LOG_SENDING_STR 9811 sctp_misc_ints(SCTP_STRMOUT_LOG_ASSIGN, 9812 (uintptr_t) stcb, (uintptr_t) sp, 9813 (uint32_t) ((srcv->sinfo_stream << 16) | sp->strseq), 0); 9814 #endif 9815 strm->next_sequence_sent++; 9816 } else { 9817 SCTP_STAT_INCR(sctps_sends_with_unord); 9818 } 9819 9820 if ((strm->next_spoke.tqe_next == NULL) && 9821 (strm->next_spoke.tqe_prev == NULL)) { 9822 /* Not on wheel, insert */ 9823 sctp_insert_on_wheel(stcb, asoc, strm, 1); 9824 } 9825 SCTP_TCB_SEND_UNLOCK(stcb); 9826 } else { 9827 sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead); 9828 if (sp == NULL) { 9829 /* ???? Huh ??? last msg is gone */ 9830 #ifdef INVARIANTS 9831 panic("Warning: Last msg marked incomplete, yet nothing left?"); 9832 #else 9833 printf("Warning: Last msg marked incomplete, yet nothing left?\n"); 9834 strm->last_msg_incomplete = 0; 9835 #endif 9836 goto do_a_copy_in; 9837 9838 } 9839 } 9840 while (uio->uio_resid > 0) { 9841 /* How much room do we have? */ 9842 struct mbuf *new_tail, *mm; 9843 9844 if (so->so_snd.sb_hiwat > stcb->asoc.total_output_queue_size) 9845 max_len = so->so_snd.sb_hiwat - stcb->asoc.total_output_queue_size; 9846 else 9847 max_len = 0; 9848 9849 if ((max_len > sctp_add_more_threshold) || 9850 (uio->uio_resid && (uio->uio_resid < max_len))) { 9851 sndout = 0; 9852 new_tail = NULL; 9853 if (hold_tcblock) { 9854 SCTP_TCB_UNLOCK(stcb); 9855 hold_tcblock = 0; 9856 } 9857 mm = sctp_copy_resume(sp, uio, srcv, max_len, user_marks_eor, &error, &sndout, &new_tail); 9858 if ((mm == NULL) || error) { 9859 if (mm) { 9860 sctp_m_freem(mm); 9861 } 9862 goto out; 9863 } 9864 /* Update the mbuf and count */ 9865 SCTP_TCB_SEND_LOCK(stcb); 9866 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 9867 /* 9868 * we need to get out. Peer probably 9869 * aborted. 9870 */ 9871 sctp_m_freem(mm); 9872 if (stcb->asoc.state & SCTP_PCB_FLAGS_WAS_ABORTED) 9873 error = ECONNRESET; 9874 goto out; 9875 } 9876 if (sp->tail_mbuf) { 9877 /* tack it to the end */ 9878 SCTP_BUF_NEXT(sp->tail_mbuf) = mm; 9879 sp->tail_mbuf = new_tail; 9880 } else { 9881 /* A stolen mbuf */ 9882 sp->data = mm; 9883 sp->tail_mbuf = new_tail; 9884 } 9885 sctp_snd_sb_alloc(stcb, sndout); 9886 sp->length += sndout; 9887 len += sndout; 9888 /* Did we reach EOR? */ 9889 if ((uio->uio_resid == 0) && 9890 ((user_marks_eor == 0) || 9891 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR))) 9892 ) { 9893 sp->msg_is_complete = 1; 9894 } else { 9895 sp->msg_is_complete = 0; 9896 } 9897 SCTP_TCB_SEND_UNLOCK(stcb); 9898 } 9899 if (uio->uio_resid == 0) { 9900 /* got it all? */ 9901 continue; 9902 } 9903 /* PR-SCTP? */ 9904 if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) { 9905 /* 9906 * This is ugly but we must assure locking 9907 * order 9908 */ 9909 if (hold_tcblock == 0) { 9910 SCTP_TCB_LOCK(stcb); 9911 hold_tcblock = 1; 9912 } 9913 sctp_prune_prsctp(stcb, asoc, srcv, sndlen); 9914 if (so->so_snd.sb_hiwat > stcb->asoc.total_output_queue_size) 9915 max_len = so->so_snd.sb_hiwat - stcb->asoc.total_output_queue_size; 9916 else 9917 max_len = 0; 9918 if (max_len > 0) { 9919 continue; 9920 } 9921 SCTP_TCB_UNLOCK(stcb); 9922 hold_tcblock = 0; 9923 } 9924 /* wait for space now */ 9925 if (non_blocking) { 9926 /* Non-blocking io in place out */ 9927 goto skip_out_eof; 9928 } 9929 if ((net->flight_size > net->cwnd) && 9930 (sctp_cmt_on_off == 0)) { 9931 queue_only = 1; 9932 9933 } else if (asoc->ifp_had_enobuf) { 9934 SCTP_STAT_INCR(sctps_ifnomemqueued); 9935 if (net->flight_size > (net->mtu * 2)) { 9936 queue_only = 1; 9937 } else { 9938 queue_only = 0; 9939 } 9940 asoc->ifp_had_enobuf = 0; 9941 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 9942 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * 9943 sizeof(struct sctp_data_chunk))); 9944 } else { 9945 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 9946 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * 9947 sizeof(struct sctp_data_chunk))); 9948 queue_only = 0; 9949 } 9950 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 9951 (stcb->asoc.total_flight > 0) && 9952 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) 9953 ) { 9954 9955 /* 9956 * Ok, Nagle is set on and we have data 9957 * outstanding. Don't send anything and let 9958 * SACKs drive out the data unless wen have 9959 * a "full" segment to send. 9960 */ 9961 #ifdef SCTP_NAGLE_LOGGING 9962 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 9963 #endif 9964 SCTP_STAT_INCR(sctps_naglequeued); 9965 nagle_applies = 1; 9966 } else { 9967 #ifdef SCTP_NAGLE_LOGGING 9968 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 9969 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 9970 #endif 9971 SCTP_STAT_INCR(sctps_naglesent); 9972 nagle_applies = 0; 9973 } 9974 /* What about the INIT, send it maybe */ 9975 #ifdef SCTP_BLK_LOGGING 9976 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, nagle_applies, un_sent); 9977 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, stcb->asoc.total_flight, 9978 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 9979 #endif 9980 if (queue_only_for_init) { 9981 if (hold_tcblock == 0) { 9982 SCTP_TCB_LOCK(stcb); 9983 hold_tcblock = 1; 9984 } 9985 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) { 9986 /* a collision took us forward? */ 9987 queue_only_for_init = 0; 9988 queue_only = 0; 9989 } else { 9990 sctp_send_initiate(inp, stcb); 9991 stcb->asoc.state = SCTP_STATE_COOKIE_WAIT; 9992 queue_only_for_init = 0; 9993 queue_only = 1; 9994 } 9995 } 9996 if ((queue_only == 0) && (nagle_applies == 0) 9997 ) { 9998 /* 9999 * need to start chunk output before 10000 * blocking.. note that if a lock is already 10001 * applied, then the input via the net is 10002 * happening and I don't need to start 10003 * output :-D 10004 */ 10005 if (hold_tcblock == 0) { 10006 if (SCTP_TCB_TRYLOCK(stcb)) { 10007 hold_tcblock = 1; 10008 sctp_chunk_output(inp, 10009 stcb, 10010 SCTP_OUTPUT_FROM_USR_SEND); 10011 10012 } 10013 } else { 10014 sctp_chunk_output(inp, 10015 stcb, 10016 SCTP_OUTPUT_FROM_USR_SEND); 10017 } 10018 if (hold_tcblock == 1) { 10019 SCTP_TCB_UNLOCK(stcb); 10020 hold_tcblock = 0; 10021 } 10022 } 10023 SOCKBUF_LOCK(&so->so_snd); 10024 /* 10025 * This is a bit strange, but I think it will work. 10026 * The total_output_queue_size is locked and 10027 * protected by the TCB_LOCK, which we just 10028 * released. There is a race that can occur between 10029 * releasing it above, and me getting the socket 10030 * lock, where sacks come in but we have not put the 10031 * SB_WAIT on the so_snd buffer to get the wakeup. 10032 * After the LOCK is applied the sack_processing 10033 * will also need to LOCK the so->so_snd to do the 10034 * actual sowwakeup(). So once we have the socket 10035 * buffer lock if we recheck the size we KNOW we 10036 * will get to sleep safely with the wakeup flag in 10037 * place. 10038 */ 10039 if (so->so_snd.sb_hiwat < (stcb->asoc.total_output_queue_size + sctp_add_more_threshold)) { 10040 #ifdef SCTP_BLK_LOGGING 10041 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 10042 so, asoc, uio->uio_resid); 10043 #endif 10044 be.error = 0; 10045 stcb->block_entry = &be; 10046 error = sbwait(&so->so_snd); 10047 stcb->block_entry = NULL; 10048 10049 if (error || so->so_error || be.error) { 10050 if (error == 0) { 10051 if (so->so_error) 10052 error = so->so_error; 10053 if (be.error) { 10054 error = be.error; 10055 } 10056 } 10057 SOCKBUF_UNLOCK(&so->so_snd); 10058 goto out_unlocked; 10059 } 10060 #ifdef SCTP_BLK_LOGGING 10061 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 10062 so, asoc, stcb->asoc.total_output_queue_size); 10063 #endif 10064 } 10065 SOCKBUF_UNLOCK(&so->so_snd); 10066 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 10067 goto out_unlocked; 10068 } 10069 } 10070 SCTP_TCB_SEND_LOCK(stcb); 10071 if (sp->msg_is_complete == 0) { 10072 strm->last_msg_incomplete = 1; 10073 asoc->stream_locked = 1; 10074 asoc->stream_locked_on = srcv->sinfo_stream; 10075 } else { 10076 strm->last_msg_incomplete = 0; 10077 asoc->stream_locked = 0; 10078 } 10079 SCTP_TCB_SEND_UNLOCK(stcb); 10080 if (uio->uio_resid == 0) { 10081 got_all_of_the_send = 1; 10082 } 10083 } else if (top) { 10084 /* We send in a 0, since we do NOT have any locks */ 10085 error = sctp_msg_append(stcb, net, top, srcv, 0); 10086 top = NULL; 10087 } 10088 if (error) { 10089 goto out; 10090 } 10091 dataless_eof: 10092 /* EOF thing ? */ 10093 if ((srcv->sinfo_flags & SCTP_EOF) && 10094 (got_all_of_the_send == 1) && 10095 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) 10096 ) { 10097 SCTP_STAT_INCR(sctps_sends_with_eof); 10098 error = 0; 10099 if (hold_tcblock == 0) { 10100 SCTP_TCB_LOCK(stcb); 10101 hold_tcblock = 1; 10102 } 10103 if (TAILQ_EMPTY(&asoc->send_queue) && 10104 TAILQ_EMPTY(&asoc->sent_queue) && 10105 (asoc->stream_queue_cnt == 0)) { 10106 if (asoc->locked_on_sending) { 10107 goto abort_anyway; 10108 } 10109 /* there is nothing queued to send, so I'm done... */ 10110 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 10111 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 10112 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 10113 /* only send SHUTDOWN the first time through */ 10114 sctp_send_shutdown(stcb, stcb->asoc.primary_destination); 10115 asoc->state = SCTP_STATE_SHUTDOWN_SENT; 10116 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 10117 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 10118 asoc->primary_destination); 10119 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 10120 asoc->primary_destination); 10121 } 10122 } else { 10123 /* 10124 * we still got (or just got) data to send, so set 10125 * SHUTDOWN_PENDING 10126 */ 10127 /* 10128 * XXX sockets draft says that SCTP_EOF should be 10129 * sent with no data. currently, we will allow user 10130 * data to be sent first and move to 10131 * SHUTDOWN-PENDING 10132 */ 10133 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 10134 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 10135 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 10136 if (hold_tcblock == 0) { 10137 SCTP_TCB_LOCK(stcb); 10138 hold_tcblock = 1; 10139 } 10140 if (asoc->locked_on_sending) { 10141 /* Locked to send out the data */ 10142 struct sctp_stream_queue_pending *sp; 10143 10144 sp = TAILQ_LAST(&asoc->locked_on_sending->outqueue, sctp_streamhead); 10145 if (sp) { 10146 if ((sp->length == 0) && (sp->msg_is_complete == 0)) 10147 asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT; 10148 } 10149 } 10150 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 10151 if (TAILQ_EMPTY(&asoc->send_queue) && 10152 TAILQ_EMPTY(&asoc->sent_queue) && 10153 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 10154 abort_anyway: 10155 if (free_cnt_applied) { 10156 atomic_add_int(&stcb->asoc.refcnt, -1); 10157 free_cnt_applied = 0; 10158 } 10159 sctp_abort_an_association(stcb->sctp_ep, stcb, 10160 SCTP_RESPONSE_TO_USER_REQ, 10161 NULL); 10162 /* 10163 * now relock the stcb so everything 10164 * is sane 10165 */ 10166 hold_tcblock = 0; 10167 stcb = NULL; 10168 goto out; 10169 } 10170 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 10171 asoc->primary_destination); 10172 } 10173 } 10174 } 10175 skip_out_eof: 10176 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 10177 some_on_control = 1; 10178 } 10179 if ((net->flight_size > net->cwnd) && 10180 (sctp_cmt_on_off == 0)) { 10181 queue_only = 1; 10182 } else if (asoc->ifp_had_enobuf) { 10183 SCTP_STAT_INCR(sctps_ifnomemqueued); 10184 if (net->flight_size > (net->mtu * 2)) { 10185 queue_only = 1; 10186 } else { 10187 queue_only = 0; 10188 } 10189 asoc->ifp_had_enobuf = 0; 10190 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 10191 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * 10192 sizeof(struct sctp_data_chunk))); 10193 } else { 10194 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 10195 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * 10196 sizeof(struct sctp_data_chunk))); 10197 queue_only = 0; 10198 } 10199 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 10200 (stcb->asoc.total_flight > 0) && 10201 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) 10202 ) { 10203 10204 /* 10205 * Ok, Nagle is set on and we have data outstanding. Don't 10206 * send anything and let SACKs drive out the data unless wen 10207 * have a "full" segment to send. 10208 */ 10209 #ifdef SCTP_NAGLE_LOGGING 10210 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 10211 #endif 10212 SCTP_STAT_INCR(sctps_naglequeued); 10213 nagle_applies = 1; 10214 } else { 10215 #ifdef SCTP_NAGLE_LOGGING 10216 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 10217 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 10218 #endif 10219 SCTP_STAT_INCR(sctps_naglesent); 10220 nagle_applies = 0; 10221 } 10222 if (queue_only_for_init) { 10223 if (hold_tcblock == 0) { 10224 SCTP_TCB_LOCK(stcb); 10225 hold_tcblock = 1; 10226 } 10227 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) { 10228 /* a collision took us forward? */ 10229 queue_only_for_init = 0; 10230 queue_only = 0; 10231 } else { 10232 sctp_send_initiate(inp, stcb); 10233 stcb->asoc.state = SCTP_STATE_COOKIE_WAIT; 10234 queue_only_for_init = 0; 10235 queue_only = 1; 10236 } 10237 } 10238 if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) { 10239 /* we can attempt to send too. */ 10240 s = splnet(); 10241 if (hold_tcblock == 0) { 10242 /* 10243 * If there is activity recv'ing sacks no need to 10244 * send 10245 */ 10246 if (SCTP_TCB_TRYLOCK(stcb)) { 10247 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND); 10248 hold_tcblock = 1; 10249 } 10250 } else { 10251 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND); 10252 } 10253 splx(s); 10254 } else if ((queue_only == 0) && 10255 (stcb->asoc.peers_rwnd == 0) && 10256 (stcb->asoc.total_flight == 0)) { 10257 /* We get to have a probe outstanding */ 10258 if (hold_tcblock == 0) { 10259 hold_tcblock = 1; 10260 SCTP_TCB_LOCK(stcb); 10261 } 10262 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND); 10263 } else if (some_on_control) { 10264 int num_out, reason, cwnd_full, frag_point; 10265 10266 /* Here we do control only */ 10267 if (hold_tcblock == 0) { 10268 hold_tcblock = 1; 10269 SCTP_TCB_LOCK(stcb); 10270 } 10271 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 10272 sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 10273 &reason, 1, &cwnd_full, 1, &now, &now_filled, frag_point); 10274 } 10275 #ifdef SCTP_DEBUG 10276 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 10277 printf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n", 10278 queue_only, stcb->asoc.peers_rwnd, un_sent, 10279 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue, 10280 stcb->asoc.total_output_queue_size); 10281 } 10282 #endif 10283 out: 10284 out_unlocked: 10285 10286 if (create_lock_applied) { 10287 SCTP_ASOC_CREATE_UNLOCK(inp); 10288 create_lock_applied = 0; 10289 } 10290 if ((stcb) && hold_tcblock) { 10291 SCTP_TCB_UNLOCK(stcb); 10292 } 10293 if (stcb && free_cnt_applied) { 10294 atomic_add_int(&stcb->asoc.refcnt, -1); 10295 } 10296 #ifdef INVARIANTS 10297 if (stcb) { 10298 if (mtx_owned(&stcb->tcb_mtx)) { 10299 panic("Leaving with tcb mtx owned?"); 10300 } 10301 if (mtx_owned(&stcb->tcb_send_mtx)) { 10302 panic("Leaving with tcb send mtx owned?"); 10303 } 10304 } 10305 #endif 10306 if (top) { 10307 sctp_m_freem(top); 10308 } 10309 if (control) { 10310 sctp_m_freem(control); 10311 } 10312 return (error); 10313 } 10314 10315 10316 /* 10317 * generate an AUTHentication chunk, if required 10318 */ 10319 struct mbuf * 10320 sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end, 10321 struct sctp_auth_chunk **auth_ret, uint32_t * offset, 10322 struct sctp_tcb *stcb, uint8_t chunk) 10323 { 10324 struct mbuf *m_auth; 10325 struct sctp_auth_chunk *auth; 10326 int chunk_len; 10327 10328 if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) || 10329 (stcb == NULL)) 10330 return (m); 10331 10332 /* sysctl disabled auth? */ 10333 if (sctp_auth_disable) 10334 return (m); 10335 10336 /* peer doesn't do auth... */ 10337 if (!stcb->asoc.peer_supports_auth) { 10338 return (m); 10339 } 10340 /* does the requested chunk require auth? */ 10341 if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) { 10342 return (m); 10343 } 10344 m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_DONTWAIT, 1, MT_HEADER); 10345 if (m_auth == NULL) { 10346 /* no mbuf's */ 10347 return (m); 10348 } 10349 /* reserve some space if this will be the first mbuf */ 10350 if (m == NULL) 10351 SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD); 10352 /* fill in the AUTH chunk details */ 10353 auth = mtod(m_auth, struct sctp_auth_chunk *); 10354 bzero(auth, sizeof(*auth)); 10355 auth->ch.chunk_type = SCTP_AUTHENTICATION; 10356 auth->ch.chunk_flags = 0; 10357 chunk_len = sizeof(*auth) + 10358 sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id); 10359 auth->ch.chunk_length = htons(chunk_len); 10360 auth->hmac_id = htons(stcb->asoc.peer_hmac_id); 10361 /* key id and hmac digest will be computed and filled in upon send */ 10362 10363 /* save the offset where the auth was inserted into the chain */ 10364 if (m != NULL) { 10365 struct mbuf *cn; 10366 10367 *offset = 0; 10368 cn = m; 10369 while (cn) { 10370 *offset += SCTP_BUF_LEN(cn); 10371 cn = SCTP_BUF_NEXT(cn); 10372 } 10373 } else 10374 *offset = 0; 10375 10376 /* update length and return pointer to the auth chunk */ 10377 SCTP_BUF_LEN(m_auth) = chunk_len; 10378 m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0); 10379 if (auth_ret != NULL) 10380 *auth_ret = auth; 10381 10382 return (m); 10383 } 10384