1 /*- 2 * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * a) Redistributions of source code must retain the above copyright notice, 8 * this list of conditions and the following disclaimer. 9 * 10 * b) Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the distribution. 13 * 14 * c) Neither the name of Cisco Systems, Inc. nor the names of its 15 * contributors may be used to endorse or promote products derived 16 * from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 20 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 28 * THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 /* $KAME: sctp_pcb.c,v 1.38 2005/03/06 16:04:18 itojun Exp $ */ 32 33 #include <sys/cdefs.h> 34 __FBSDID("$FreeBSD$"); 35 36 #include "opt_ipsec.h" 37 #include "opt_compat.h" 38 #include "opt_inet6.h" 39 #include "opt_inet.h" 40 #include "opt_sctp.h" 41 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/malloc.h> 45 #include <sys/mbuf.h> 46 #include <sys/domain.h> 47 #include <sys/protosw.h> 48 #include <sys/socket.h> 49 #include <sys/socketvar.h> 50 #include <sys/priv.h> 51 #include <sys/proc.h> 52 #include <sys/kernel.h> 53 #include <sys/sysctl.h> 54 55 #include <sys/callout.h> 56 57 #include <sys/limits.h> 58 #include <machine/cpu.h> 59 60 #include <net/if.h> 61 #include <net/if_types.h> 62 #include <net/route.h> 63 #include <netinet/in.h> 64 #include <netinet/in_systm.h> 65 #include <netinet/ip.h> 66 #include <netinet/in_pcb.h> 67 #include <netinet/in_var.h> 68 #include <netinet/ip_var.h> 69 70 #ifdef INET6 71 #include <netinet/ip6.h> 72 #include <netinet6/ip6_var.h> 73 #include <netinet6/scope6_var.h> 74 #include <netinet6/in6_pcb.h> 75 #endif /* INET6 */ 76 77 #ifdef IPSEC 78 #include <netinet6/ipsec.h> 79 #include <netkey/key.h> 80 #endif /* IPSEC */ 81 82 #include <netinet/sctp_os.h> 83 #include <netinet/sctp_var.h> 84 #include <netinet/sctp_pcb.h> 85 #include <netinet/sctputil.h> 86 #include <netinet/sctp.h> 87 #include <netinet/sctp_header.h> 88 #include <netinet/sctp_asconf.h> 89 #include <netinet/sctp_output.h> 90 #include <netinet/sctp_timer.h> 91 92 93 #ifdef SCTP_DEBUG 94 uint32_t sctp_debug_on = 0; 95 96 #endif /* SCTP_DEBUG */ 97 98 99 extern int sctp_pcbtblsize; 100 extern int sctp_hashtblsize; 101 extern int sctp_chunkscale; 102 103 struct sctp_epinfo sctppcbinfo; 104 105 /* FIX: we don't handle multiple link local scopes */ 106 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */ 107 int 108 SCTP6_ARE_ADDR_EQUAL(struct in6_addr *a, struct in6_addr *b) 109 { 110 struct in6_addr tmp_a, tmp_b; 111 112 /* use a copy of a and b */ 113 tmp_a = *a; 114 tmp_b = *b; 115 in6_clearscope(&tmp_a); 116 in6_clearscope(&tmp_b); 117 return (IN6_ARE_ADDR_EQUAL(&tmp_a, &tmp_b)); 118 } 119 120 121 void 122 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb) 123 { 124 /* 125 * We really don't need to lock this, but I will just because it 126 * does not hurt. 127 */ 128 SCTP_INP_INFO_RLOCK(); 129 spcb->ep_count = sctppcbinfo.ipi_count_ep; 130 spcb->asoc_count = sctppcbinfo.ipi_count_asoc; 131 spcb->laddr_count = sctppcbinfo.ipi_count_laddr; 132 spcb->raddr_count = sctppcbinfo.ipi_count_raddr; 133 spcb->chk_count = sctppcbinfo.ipi_count_chunk; 134 spcb->readq_count = sctppcbinfo.ipi_count_readq; 135 spcb->stream_oque = sctppcbinfo.ipi_count_strmoq; 136 spcb->free_chunks = sctppcbinfo.ipi_free_chunks; 137 138 SCTP_INP_INFO_RUNLOCK(); 139 } 140 141 142 /* 143 * Notes on locks for FreeBSD 5 and up. All association lookups that have a 144 * definte ep, the INP structure is assumed to be locked for reading. If we 145 * need to go find the INP (ususally when a **inp is passed) then we must 146 * lock the INFO structure first and if needed lock the INP too. Note that if 147 * we lock it we must 148 * 149 */ 150 151 152 /* 153 * Given a endpoint, look and find in its association list any association 154 * with the "to" address given. This can be a "from" address, too, for 155 * inbound packets. For outbound packets it is a true "to" address. 156 */ 157 158 static struct sctp_tcb * 159 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from, 160 struct sockaddr *to, struct sctp_nets **netp) 161 { 162 /**** ASSUMSES THE CALLER holds the INP_INFO_RLOCK */ 163 164 /* 165 * Note for this module care must be taken when observing what to is 166 * for. In most of the rest of the code the TO field represents my 167 * peer and the FROM field represents my address. For this module it 168 * is reversed of that. 169 */ 170 /* 171 * If we support the TCP model, then we must now dig through to see 172 * if we can find our endpoint in the list of tcp ep's. 173 */ 174 uint16_t lport, rport; 175 struct sctppcbhead *ephead; 176 struct sctp_inpcb *inp; 177 struct sctp_laddr *laddr; 178 struct sctp_tcb *stcb; 179 struct sctp_nets *net; 180 181 if ((to == NULL) || (from == NULL)) { 182 return (NULL); 183 } 184 if (to->sa_family == AF_INET && from->sa_family == AF_INET) { 185 lport = ((struct sockaddr_in *)to)->sin_port; 186 rport = ((struct sockaddr_in *)from)->sin_port; 187 } else if (to->sa_family == AF_INET6 && from->sa_family == AF_INET6) { 188 lport = ((struct sockaddr_in6 *)to)->sin6_port; 189 rport = ((struct sockaddr_in6 *)from)->sin6_port; 190 } else { 191 return NULL; 192 } 193 ephead = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR( 194 (lport + rport), sctppcbinfo.hashtcpmark)]; 195 /* 196 * Ok now for each of the guys in this bucket we must look and see: 197 * - Does the remote port match. - Does there single association's 198 * addresses match this address (to). If so we update p_ep to point 199 * to this ep and return the tcb from it. 200 */ 201 LIST_FOREACH(inp, ephead, sctp_hash) { 202 if (lport != inp->sctp_lport) { 203 continue; 204 } 205 SCTP_INP_RLOCK(inp); 206 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 207 SCTP_INP_RUNLOCK(inp); 208 continue; 209 } 210 /* check to see if the ep has one of the addresses */ 211 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 212 /* We are NOT bound all, so look further */ 213 int match = 0; 214 215 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 216 217 if (laddr->ifa == NULL) { 218 #ifdef SCTP_DEBUG 219 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 220 printf("An ounce of prevention is worth a pound of cure\n"); 221 } 222 #endif 223 continue; 224 } 225 if (laddr->ifa->ifa_addr == NULL) { 226 #ifdef SCTP_DEBUG 227 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 228 printf("ifa with a NULL address\n"); 229 } 230 #endif 231 continue; 232 } 233 if (laddr->ifa->ifa_addr->sa_family == 234 to->sa_family) { 235 /* see if it matches */ 236 struct sockaddr_in *intf_addr, *sin; 237 238 intf_addr = (struct sockaddr_in *) 239 laddr->ifa->ifa_addr; 240 sin = (struct sockaddr_in *)to; 241 if (from->sa_family == AF_INET) { 242 if (sin->sin_addr.s_addr == 243 intf_addr->sin_addr.s_addr) { 244 match = 1; 245 break; 246 } 247 } else { 248 struct sockaddr_in6 *intf_addr6; 249 struct sockaddr_in6 *sin6; 250 251 sin6 = (struct sockaddr_in6 *) 252 to; 253 intf_addr6 = (struct sockaddr_in6 *) 254 laddr->ifa->ifa_addr; 255 256 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 257 &intf_addr6->sin6_addr)) { 258 match = 1; 259 break; 260 } 261 } 262 } 263 } 264 if (match == 0) { 265 /* This endpoint does not have this address */ 266 SCTP_INP_RUNLOCK(inp); 267 continue; 268 } 269 } 270 /* 271 * Ok if we hit here the ep has the address, does it hold 272 * the tcb? 273 */ 274 275 stcb = LIST_FIRST(&inp->sctp_asoc_list); 276 if (stcb == NULL) { 277 SCTP_INP_RUNLOCK(inp); 278 continue; 279 } 280 SCTP_TCB_LOCK(stcb); 281 if (stcb->rport != rport) { 282 /* remote port does not match. */ 283 SCTP_TCB_UNLOCK(stcb); 284 SCTP_INP_RUNLOCK(inp); 285 continue; 286 } 287 /* Does this TCB have a matching address? */ 288 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 289 290 if (net->ro._l_addr.sa.sa_family != from->sa_family) { 291 /* not the same family, can't be a match */ 292 continue; 293 } 294 if (from->sa_family == AF_INET) { 295 struct sockaddr_in *sin, *rsin; 296 297 sin = (struct sockaddr_in *)&net->ro._l_addr; 298 rsin = (struct sockaddr_in *)from; 299 if (sin->sin_addr.s_addr == 300 rsin->sin_addr.s_addr) { 301 /* found it */ 302 if (netp != NULL) { 303 *netp = net; 304 } 305 /* Update the endpoint pointer */ 306 *inp_p = inp; 307 SCTP_INP_RUNLOCK(inp); 308 return (stcb); 309 } 310 } else { 311 struct sockaddr_in6 *sin6, *rsin6; 312 313 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 314 rsin6 = (struct sockaddr_in6 *)from; 315 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 316 &rsin6->sin6_addr)) { 317 /* found it */ 318 if (netp != NULL) { 319 *netp = net; 320 } 321 /* Update the endpoint pointer */ 322 *inp_p = inp; 323 SCTP_INP_RUNLOCK(inp); 324 return (stcb); 325 } 326 } 327 } 328 SCTP_TCB_UNLOCK(stcb); 329 SCTP_INP_RUNLOCK(inp); 330 } 331 return (NULL); 332 } 333 334 /* 335 * rules for use 336 * 337 * 1) If I return a NULL you must decrement any INP ref cnt. 2) If I find an 338 * stcb, both will be locked (locked_tcb and stcb) but decrement will be done 339 * (if locked == NULL). 3) Decrement happens on return ONLY if locked == 340 * NULL. 341 */ 342 343 struct sctp_tcb * 344 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote, 345 struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb) 346 { 347 struct sctpasochead *head; 348 struct sctp_inpcb *inp; 349 struct sctp_tcb *stcb; 350 struct sctp_nets *net; 351 uint16_t rport; 352 353 inp = *inp_p; 354 if (remote->sa_family == AF_INET) { 355 rport = (((struct sockaddr_in *)remote)->sin_port); 356 } else if (remote->sa_family == AF_INET6) { 357 rport = (((struct sockaddr_in6 *)remote)->sin6_port); 358 } else { 359 return (NULL); 360 } 361 if (locked_tcb) { 362 /* 363 * UN-lock so we can do proper locking here this occurs when 364 * called from load_addresses_from_init. 365 */ 366 SCTP_TCB_UNLOCK(locked_tcb); 367 } 368 SCTP_INP_INFO_RLOCK(); 369 if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 370 /* 371 * Now either this guy is our listener or it's the 372 * connector. If it is the one that issued the connect, then 373 * it's only chance is to be the first TCB in the list. If 374 * it is the acceptor, then do the special_lookup to hash 375 * and find the real inp. 376 */ 377 if ((inp->sctp_socket) && (inp->sctp_socket->so_qlimit)) { 378 /* to is peer addr, from is my addr */ 379 stcb = sctp_tcb_special_locate(inp_p, remote, local, 380 netp); 381 if ((stcb != NULL) && (locked_tcb == NULL)) { 382 /* we have a locked tcb, lower refcount */ 383 SCTP_INP_WLOCK(inp); 384 SCTP_INP_DECR_REF(inp); 385 SCTP_INP_WUNLOCK(inp); 386 } 387 if ((locked_tcb != NULL) && (locked_tcb != stcb)) { 388 SCTP_INP_RLOCK(locked_tcb->sctp_ep); 389 SCTP_TCB_LOCK(locked_tcb); 390 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep); 391 } 392 SCTP_INP_INFO_RUNLOCK(); 393 return (stcb); 394 } else { 395 SCTP_INP_WLOCK(inp); 396 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 397 goto null_return; 398 } 399 stcb = LIST_FIRST(&inp->sctp_asoc_list); 400 if (stcb == NULL) { 401 goto null_return; 402 } 403 SCTP_TCB_LOCK(stcb); 404 if (stcb->rport != rport) { 405 /* remote port does not match. */ 406 SCTP_TCB_UNLOCK(stcb); 407 goto null_return; 408 } 409 /* now look at the list of remote addresses */ 410 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 411 #ifdef INVARIANTS 412 if (net == (TAILQ_NEXT(net, sctp_next))) { 413 panic("Corrupt net list"); 414 } 415 #endif 416 if (net->ro._l_addr.sa.sa_family != 417 remote->sa_family) { 418 /* not the same family */ 419 continue; 420 } 421 if (remote->sa_family == AF_INET) { 422 struct sockaddr_in *sin, *rsin; 423 424 sin = (struct sockaddr_in *) 425 &net->ro._l_addr; 426 rsin = (struct sockaddr_in *)remote; 427 if (sin->sin_addr.s_addr == 428 rsin->sin_addr.s_addr) { 429 /* found it */ 430 if (netp != NULL) { 431 *netp = net; 432 } 433 if (locked_tcb == NULL) { 434 SCTP_INP_DECR_REF(inp); 435 } else if (locked_tcb != stcb) { 436 SCTP_TCB_LOCK(locked_tcb); 437 } 438 SCTP_INP_WUNLOCK(inp); 439 SCTP_INP_INFO_RUNLOCK(); 440 return (stcb); 441 } 442 } else if (remote->sa_family == AF_INET6) { 443 struct sockaddr_in6 *sin6, *rsin6; 444 445 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 446 rsin6 = (struct sockaddr_in6 *)remote; 447 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 448 &rsin6->sin6_addr)) { 449 /* found it */ 450 if (netp != NULL) { 451 *netp = net; 452 } 453 if (locked_tcb == NULL) { 454 SCTP_INP_DECR_REF(inp); 455 } else if (locked_tcb != stcb) { 456 SCTP_TCB_LOCK(locked_tcb); 457 } 458 SCTP_INP_WUNLOCK(inp); 459 SCTP_INP_INFO_RUNLOCK(); 460 return (stcb); 461 } 462 } 463 } 464 SCTP_TCB_UNLOCK(stcb); 465 } 466 } else { 467 SCTP_INP_WLOCK(inp); 468 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 469 goto null_return; 470 } 471 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport, 472 inp->sctp_hashmark)]; 473 if (head == NULL) { 474 goto null_return; 475 } 476 LIST_FOREACH(stcb, head, sctp_tcbhash) { 477 if (stcb->rport != rport) { 478 /* remote port does not match */ 479 continue; 480 } 481 /* now look at the list of remote addresses */ 482 SCTP_TCB_LOCK(stcb); 483 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 484 #ifdef INVARIANTS 485 if (net == (TAILQ_NEXT(net, sctp_next))) { 486 panic("Corrupt net list"); 487 } 488 #endif 489 if (net->ro._l_addr.sa.sa_family != 490 remote->sa_family) { 491 /* not the same family */ 492 continue; 493 } 494 if (remote->sa_family == AF_INET) { 495 struct sockaddr_in *sin, *rsin; 496 497 sin = (struct sockaddr_in *) 498 &net->ro._l_addr; 499 rsin = (struct sockaddr_in *)remote; 500 if (sin->sin_addr.s_addr == 501 rsin->sin_addr.s_addr) { 502 /* found it */ 503 if (netp != NULL) { 504 *netp = net; 505 } 506 if (locked_tcb == NULL) { 507 SCTP_INP_DECR_REF(inp); 508 } else if (locked_tcb != stcb) { 509 SCTP_TCB_LOCK(locked_tcb); 510 } 511 SCTP_INP_WUNLOCK(inp); 512 SCTP_INP_INFO_RUNLOCK(); 513 return (stcb); 514 } 515 } else if (remote->sa_family == AF_INET6) { 516 struct sockaddr_in6 *sin6, *rsin6; 517 518 sin6 = (struct sockaddr_in6 *) 519 &net->ro._l_addr; 520 rsin6 = (struct sockaddr_in6 *)remote; 521 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 522 &rsin6->sin6_addr)) { 523 /* found it */ 524 if (netp != NULL) { 525 *netp = net; 526 } 527 if (locked_tcb == NULL) { 528 SCTP_INP_DECR_REF(inp); 529 } else if (locked_tcb != stcb) { 530 SCTP_TCB_LOCK(locked_tcb); 531 } 532 SCTP_INP_WUNLOCK(inp); 533 SCTP_INP_INFO_RUNLOCK(); 534 return (stcb); 535 } 536 } 537 } 538 SCTP_TCB_UNLOCK(stcb); 539 } 540 } 541 null_return: 542 /* clean up for returning null */ 543 if (locked_tcb) { 544 SCTP_TCB_LOCK(locked_tcb); 545 } 546 SCTP_INP_WUNLOCK(inp); 547 SCTP_INP_INFO_RUNLOCK(); 548 /* not found */ 549 return (NULL); 550 } 551 552 /* 553 * Find an association for a specific endpoint using the association id given 554 * out in the COMM_UP notification 555 */ 556 557 struct sctp_tcb * 558 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, sctp_assoc_t asoc_id, int want_lock) 559 { 560 /* 561 * Use my the assoc_id to find a endpoint 562 */ 563 struct sctpasochead *head; 564 struct sctp_tcb *stcb; 565 uint32_t id; 566 567 if (asoc_id == 0 || inp == NULL) { 568 return (NULL); 569 } 570 SCTP_INP_INFO_RLOCK(); 571 id = (uint32_t) asoc_id; 572 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(id, 573 sctppcbinfo.hashasocmark)]; 574 if (head == NULL) { 575 /* invalid id TSNH */ 576 SCTP_INP_INFO_RUNLOCK(); 577 return (NULL); 578 } 579 LIST_FOREACH(stcb, head, sctp_asocs) { 580 SCTP_INP_RLOCK(stcb->sctp_ep); 581 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 582 SCTP_INP_RUNLOCK(stcb->sctp_ep); 583 SCTP_INP_INFO_RUNLOCK(); 584 return (NULL); 585 } 586 if (stcb->asoc.assoc_id == id) { 587 /* candidate */ 588 if (inp != stcb->sctp_ep) { 589 /* 590 * some other guy has the same id active (id 591 * collision ??). 592 */ 593 SCTP_INP_RUNLOCK(stcb->sctp_ep); 594 continue; 595 } 596 if (want_lock) { 597 SCTP_TCB_LOCK(stcb); 598 } 599 SCTP_INP_RUNLOCK(stcb->sctp_ep); 600 SCTP_INP_INFO_RUNLOCK(); 601 return (stcb); 602 } 603 SCTP_INP_RUNLOCK(stcb->sctp_ep); 604 } 605 /* Ok if we missed here, lets try the restart hash */ 606 head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(id, sctppcbinfo.hashrestartmark)]; 607 if (head == NULL) { 608 /* invalid id TSNH */ 609 SCTP_INP_INFO_RUNLOCK(); 610 return (NULL); 611 } 612 LIST_FOREACH(stcb, head, sctp_tcbrestarhash) { 613 SCTP_INP_RLOCK(stcb->sctp_ep); 614 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 615 SCTP_INP_RUNLOCK(stcb->sctp_ep); 616 SCTP_INP_INFO_RUNLOCK(); 617 return (NULL); 618 } 619 SCTP_TCB_LOCK(stcb); 620 SCTP_INP_RUNLOCK(stcb->sctp_ep); 621 if (stcb->asoc.assoc_id == id) { 622 /* candidate */ 623 if (inp != stcb->sctp_ep) { 624 /* 625 * some other guy has the same id active (id 626 * collision ??). 627 */ 628 SCTP_TCB_UNLOCK(stcb); 629 continue; 630 } 631 SCTP_INP_INFO_RUNLOCK(); 632 return (stcb); 633 } 634 SCTP_TCB_UNLOCK(stcb); 635 } 636 SCTP_INP_INFO_RUNLOCK(); 637 return (NULL); 638 } 639 640 641 static struct sctp_inpcb * 642 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head, 643 uint16_t lport) 644 { 645 struct sctp_inpcb *inp; 646 struct sockaddr_in *sin; 647 struct sockaddr_in6 *sin6; 648 struct sctp_laddr *laddr; 649 650 /* 651 * Endpoing probe expects that the INP_INFO is locked. 652 */ 653 if (nam->sa_family == AF_INET) { 654 sin = (struct sockaddr_in *)nam; 655 sin6 = NULL; 656 } else if (nam->sa_family == AF_INET6) { 657 sin6 = (struct sockaddr_in6 *)nam; 658 sin = NULL; 659 } else { 660 /* unsupported family */ 661 return (NULL); 662 } 663 if (head == NULL) 664 return (NULL); 665 LIST_FOREACH(inp, head, sctp_hash) { 666 SCTP_INP_RLOCK(inp); 667 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 668 SCTP_INP_RUNLOCK(inp); 669 continue; 670 } 671 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) && 672 (inp->sctp_lport == lport)) { 673 /* got it */ 674 if ((nam->sa_family == AF_INET) && 675 (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 676 (((struct inpcb *)inp)->inp_flags & IN6P_IPV6_V6ONLY) 677 ) { 678 /* IPv4 on a IPv6 socket with ONLY IPv6 set */ 679 SCTP_INP_RUNLOCK(inp); 680 continue; 681 } 682 /* A V6 address and the endpoint is NOT bound V6 */ 683 if (nam->sa_family == AF_INET6 && 684 (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) { 685 SCTP_INP_RUNLOCK(inp); 686 continue; 687 } 688 SCTP_INP_RUNLOCK(inp); 689 return (inp); 690 } 691 SCTP_INP_RUNLOCK(inp); 692 } 693 694 if ((nam->sa_family == AF_INET) && 695 (sin->sin_addr.s_addr == INADDR_ANY)) { 696 /* Can't hunt for one that has no address specified */ 697 return (NULL); 698 } else if ((nam->sa_family == AF_INET6) && 699 (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) { 700 /* Can't hunt for one that has no address specified */ 701 return (NULL); 702 } 703 /* 704 * ok, not bound to all so see if we can find a EP bound to this 705 * address. 706 */ 707 LIST_FOREACH(inp, head, sctp_hash) { 708 SCTP_INP_RLOCK(inp); 709 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 710 SCTP_INP_RUNLOCK(inp); 711 continue; 712 } 713 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) { 714 SCTP_INP_RUNLOCK(inp); 715 continue; 716 } 717 /* 718 * Ok this could be a likely candidate, look at all of its 719 * addresses 720 */ 721 if (inp->sctp_lport != lport) { 722 SCTP_INP_RUNLOCK(inp); 723 continue; 724 } 725 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 726 if (laddr->ifa == NULL) { 727 #ifdef SCTP_DEBUG 728 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 729 printf("An ounce of prevention is worth a pound of cure\n"); 730 } 731 #endif 732 continue; 733 } 734 #ifdef SCTP_DEBUG 735 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 736 printf("Ok laddr->ifa:%p is possible, ", 737 laddr->ifa); 738 } 739 #endif 740 if (laddr->ifa->ifa_addr == NULL) { 741 #ifdef SCTP_DEBUG 742 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 743 printf("Huh IFA as an ifa_addr=NULL, "); 744 } 745 #endif 746 continue; 747 } 748 if (laddr->ifa->ifa_addr->sa_family == nam->sa_family) { 749 /* possible, see if it matches */ 750 struct sockaddr_in *intf_addr; 751 752 intf_addr = (struct sockaddr_in *) 753 laddr->ifa->ifa_addr; 754 if (nam->sa_family == AF_INET) { 755 if (sin->sin_addr.s_addr == 756 intf_addr->sin_addr.s_addr) { 757 SCTP_INP_RUNLOCK(inp); 758 return (inp); 759 } 760 } else if (nam->sa_family == AF_INET6) { 761 struct sockaddr_in6 *intf_addr6; 762 763 intf_addr6 = (struct sockaddr_in6 *) 764 laddr->ifa->ifa_addr; 765 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 766 &intf_addr6->sin6_addr)) { 767 SCTP_INP_RUNLOCK(inp); 768 return (inp); 769 } 770 } 771 } 772 } 773 SCTP_INP_RUNLOCK(inp); 774 } 775 return (NULL); 776 } 777 778 779 struct sctp_inpcb * 780 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock) 781 { 782 /* 783 * First we check the hash table to see if someone has this port 784 * bound with just the port. 785 */ 786 struct sctp_inpcb *inp; 787 struct sctppcbhead *head; 788 struct sockaddr_in *sin; 789 struct sockaddr_in6 *sin6; 790 int lport; 791 792 if (nam->sa_family == AF_INET) { 793 sin = (struct sockaddr_in *)nam; 794 lport = ((struct sockaddr_in *)nam)->sin_port; 795 } else if (nam->sa_family == AF_INET6) { 796 sin6 = (struct sockaddr_in6 *)nam; 797 lport = ((struct sockaddr_in6 *)nam)->sin6_port; 798 } else { 799 /* unsupported family */ 800 return (NULL); 801 } 802 /* 803 * I could cheat here and just cast to one of the types but we will 804 * do it right. It also provides the check against an Unsupported 805 * type too. 806 */ 807 /* Find the head of the ALLADDR chain */ 808 if (have_lock == 0) { 809 SCTP_INP_INFO_RLOCK(); 810 811 } 812 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 813 sctppcbinfo.hashmark)]; 814 inp = sctp_endpoint_probe(nam, head, lport); 815 816 /* 817 * If the TCP model exists it could be that the main listening 818 * endpoint is gone but there exists a connected socket for this guy 819 * yet. If so we can return the first one that we find. This may NOT 820 * be the correct one but the sctp_findassociation_ep_addr has 821 * further code to look at all TCP models. 822 */ 823 if (inp == NULL && find_tcp_pool) { 824 unsigned int i; 825 826 for (i = 0; i < sctppcbinfo.hashtblsize; i++) { 827 /* 828 * This is real gross, but we do NOT have a remote 829 * port at this point depending on who is calling. 830 * We must therefore look for ANY one that matches 831 * our local port :/ 832 */ 833 head = &sctppcbinfo.sctp_tcpephash[i]; 834 if (LIST_FIRST(head)) { 835 inp = sctp_endpoint_probe(nam, head, lport); 836 if (inp) { 837 /* Found one */ 838 break; 839 } 840 } 841 } 842 } 843 if (inp) { 844 SCTP_INP_INCR_REF(inp); 845 } 846 if (have_lock == 0) { 847 SCTP_INP_INFO_RUNLOCK(); 848 } 849 return (inp); 850 } 851 852 /* 853 * Find an association for an endpoint with the pointer to whom you want to 854 * send to and the endpoint pointer. The address can be IPv4 or IPv6. We may 855 * need to change the *to to some other struct like a mbuf... 856 */ 857 struct sctp_tcb * 858 sctp_findassociation_addr_sa(struct sockaddr *to, struct sockaddr *from, 859 struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool) 860 { 861 struct sctp_inpcb *inp; 862 struct sctp_tcb *retval; 863 864 SCTP_INP_INFO_RLOCK(); 865 if (find_tcp_pool) { 866 if (inp_p != NULL) { 867 retval = sctp_tcb_special_locate(inp_p, from, to, netp); 868 } else { 869 retval = sctp_tcb_special_locate(&inp, from, to, netp); 870 } 871 if (retval != NULL) { 872 SCTP_INP_INFO_RUNLOCK(); 873 return (retval); 874 } 875 } 876 inp = sctp_pcb_findep(to, 0, 1); 877 if (inp_p != NULL) { 878 *inp_p = inp; 879 } 880 SCTP_INP_INFO_RUNLOCK(); 881 882 if (inp == NULL) { 883 return (NULL); 884 } 885 /* 886 * ok, we have an endpoint, now lets find the assoc for it (if any) 887 * we now place the source address or from in the to of the find 888 * endpoint call. Since in reality this chain is used from the 889 * inbound packet side. 890 */ 891 if (inp_p != NULL) { 892 retval = sctp_findassociation_ep_addr(inp_p, from, netp, to, NULL); 893 } else { 894 retval = sctp_findassociation_ep_addr(&inp, from, netp, to, NULL); 895 } 896 return retval; 897 } 898 899 900 /* 901 * This routine will grub through the mbuf that is a INIT or INIT-ACK and 902 * find all addresses that the sender has specified in any address list. Each 903 * address will be used to lookup the TCB and see if one exits. 904 */ 905 static struct sctp_tcb * 906 sctp_findassociation_special_addr(struct mbuf *m, int iphlen, int offset, 907 struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp, 908 struct sockaddr *dest) 909 { 910 struct sockaddr_in sin4; 911 struct sockaddr_in6 sin6; 912 struct sctp_paramhdr *phdr, parm_buf; 913 struct sctp_tcb *retval; 914 uint32_t ptype, plen; 915 916 memset(&sin4, 0, sizeof(sin4)); 917 memset(&sin6, 0, sizeof(sin6)); 918 sin4.sin_len = sizeof(sin4); 919 sin4.sin_family = AF_INET; 920 sin4.sin_port = sh->src_port; 921 sin6.sin6_len = sizeof(sin6); 922 sin6.sin6_family = AF_INET6; 923 sin6.sin6_port = sh->src_port; 924 925 retval = NULL; 926 offset += sizeof(struct sctp_init_chunk); 927 928 phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf)); 929 while (phdr != NULL) { 930 /* now we must see if we want the parameter */ 931 ptype = ntohs(phdr->param_type); 932 plen = ntohs(phdr->param_length); 933 if (plen == 0) { 934 break; 935 } 936 if (ptype == SCTP_IPV4_ADDRESS && 937 plen == sizeof(struct sctp_ipv4addr_param)) { 938 /* Get the rest of the address */ 939 struct sctp_ipv4addr_param ip4_parm, *p4; 940 941 phdr = sctp_get_next_param(m, offset, 942 (struct sctp_paramhdr *)&ip4_parm, plen); 943 if (phdr == NULL) { 944 return (NULL); 945 } 946 p4 = (struct sctp_ipv4addr_param *)phdr; 947 memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr)); 948 /* look it up */ 949 retval = sctp_findassociation_ep_addr(inp_p, 950 (struct sockaddr *)&sin4, netp, dest, NULL); 951 if (retval != NULL) { 952 return (retval); 953 } 954 } else if (ptype == SCTP_IPV6_ADDRESS && 955 plen == sizeof(struct sctp_ipv6addr_param)) { 956 /* Get the rest of the address */ 957 struct sctp_ipv6addr_param ip6_parm, *p6; 958 959 phdr = sctp_get_next_param(m, offset, 960 (struct sctp_paramhdr *)&ip6_parm, plen); 961 if (phdr == NULL) { 962 return (NULL); 963 } 964 p6 = (struct sctp_ipv6addr_param *)phdr; 965 memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr)); 966 /* look it up */ 967 retval = sctp_findassociation_ep_addr(inp_p, 968 (struct sockaddr *)&sin6, netp, dest, NULL); 969 if (retval != NULL) { 970 return (retval); 971 } 972 } 973 offset += SCTP_SIZE32(plen); 974 phdr = sctp_get_next_param(m, offset, &parm_buf, 975 sizeof(parm_buf)); 976 } 977 return (NULL); 978 } 979 980 981 static struct sctp_tcb * 982 sctp_findassoc_by_vtag(struct sockaddr *from, uint32_t vtag, 983 struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport, 984 uint16_t lport, int skip_src_check) 985 { 986 /* 987 * Use my vtag to hash. If we find it we then verify the source addr 988 * is in the assoc. If all goes well we save a bit on rec of a 989 * packet. 990 */ 991 struct sctpasochead *head; 992 struct sctp_nets *net; 993 struct sctp_tcb *stcb; 994 995 *netp = NULL; 996 *inp_p = NULL; 997 SCTP_INP_INFO_RLOCK(); 998 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag, 999 sctppcbinfo.hashasocmark)]; 1000 if (head == NULL) { 1001 /* invalid vtag */ 1002 SCTP_INP_INFO_RUNLOCK(); 1003 return (NULL); 1004 } 1005 LIST_FOREACH(stcb, head, sctp_asocs) { 1006 SCTP_INP_RLOCK(stcb->sctp_ep); 1007 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 1008 SCTP_INP_RUNLOCK(stcb->sctp_ep); 1009 SCTP_INP_INFO_RUNLOCK(); 1010 return (NULL); 1011 } 1012 SCTP_TCB_LOCK(stcb); 1013 SCTP_INP_RUNLOCK(stcb->sctp_ep); 1014 if (stcb->asoc.my_vtag == vtag) { 1015 /* candidate */ 1016 if (stcb->rport != rport) { 1017 /* 1018 * we could remove this if vtags are unique 1019 * across the system. 1020 */ 1021 SCTP_TCB_UNLOCK(stcb); 1022 continue; 1023 } 1024 if (stcb->sctp_ep->sctp_lport != lport) { 1025 /* 1026 * we could remove this if vtags are unique 1027 * across the system. 1028 */ 1029 SCTP_TCB_UNLOCK(stcb); 1030 continue; 1031 } 1032 if (skip_src_check) { 1033 *netp = NULL; /* unknown */ 1034 *inp_p = stcb->sctp_ep; 1035 SCTP_INP_INFO_RUNLOCK(); 1036 return (stcb); 1037 } 1038 net = sctp_findnet(stcb, from); 1039 if (net) { 1040 /* yep its him. */ 1041 *netp = net; 1042 SCTP_STAT_INCR(sctps_vtagexpress); 1043 *inp_p = stcb->sctp_ep; 1044 SCTP_INP_INFO_RUNLOCK(); 1045 return (stcb); 1046 } else { 1047 /* 1048 * not him, this should only happen in rare 1049 * cases so I peg it. 1050 */ 1051 SCTP_STAT_INCR(sctps_vtagbogus); 1052 } 1053 } 1054 SCTP_TCB_UNLOCK(stcb); 1055 } 1056 SCTP_INP_INFO_RUNLOCK(); 1057 return (NULL); 1058 } 1059 1060 /* 1061 * Find an association with the pointer to the inbound IP packet. This can be 1062 * a IPv4 or IPv6 packet. 1063 */ 1064 struct sctp_tcb * 1065 sctp_findassociation_addr(struct mbuf *m, int iphlen, int offset, 1066 struct sctphdr *sh, struct sctp_chunkhdr *ch, 1067 struct sctp_inpcb **inp_p, struct sctp_nets **netp) 1068 { 1069 int find_tcp_pool; 1070 struct ip *iph; 1071 struct sctp_tcb *retval; 1072 struct sockaddr_storage to_store, from_store; 1073 struct sockaddr *to = (struct sockaddr *)&to_store; 1074 struct sockaddr *from = (struct sockaddr *)&from_store; 1075 struct sctp_inpcb *inp; 1076 1077 1078 iph = mtod(m, struct ip *); 1079 if (iph->ip_v == IPVERSION) { 1080 /* its IPv4 */ 1081 struct sockaddr_in *from4; 1082 1083 from4 = (struct sockaddr_in *)&from_store; 1084 bzero(from4, sizeof(*from4)); 1085 from4->sin_family = AF_INET; 1086 from4->sin_len = sizeof(struct sockaddr_in); 1087 from4->sin_addr.s_addr = iph->ip_src.s_addr; 1088 from4->sin_port = sh->src_port; 1089 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1090 /* its IPv6 */ 1091 struct ip6_hdr *ip6; 1092 struct sockaddr_in6 *from6; 1093 1094 ip6 = mtod(m, struct ip6_hdr *); 1095 from6 = (struct sockaddr_in6 *)&from_store; 1096 bzero(from6, sizeof(*from6)); 1097 from6->sin6_family = AF_INET6; 1098 from6->sin6_len = sizeof(struct sockaddr_in6); 1099 from6->sin6_addr = ip6->ip6_src; 1100 from6->sin6_port = sh->src_port; 1101 /* Get the scopes in properly to the sin6 addr's */ 1102 /* we probably don't need these operations */ 1103 (void)sa6_recoverscope(from6); 1104 sa6_embedscope(from6, ip6_use_defzone); 1105 } else { 1106 /* Currently not supported. */ 1107 return (NULL); 1108 } 1109 if (sh->v_tag) { 1110 /* we only go down this path if vtag is non-zero */ 1111 retval = sctp_findassoc_by_vtag(from, ntohl(sh->v_tag), 1112 inp_p, netp, sh->src_port, sh->dest_port, 0); 1113 if (retval) { 1114 return (retval); 1115 } 1116 } 1117 if (iph->ip_v == IPVERSION) { 1118 /* its IPv4 */ 1119 struct sockaddr_in *to4; 1120 1121 to4 = (struct sockaddr_in *)&to_store; 1122 bzero(to4, sizeof(*to4)); 1123 to4->sin_family = AF_INET; 1124 to4->sin_len = sizeof(struct sockaddr_in); 1125 to4->sin_addr.s_addr = iph->ip_dst.s_addr; 1126 to4->sin_port = sh->dest_port; 1127 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1128 /* its IPv6 */ 1129 struct ip6_hdr *ip6; 1130 struct sockaddr_in6 *to6; 1131 1132 ip6 = mtod(m, struct ip6_hdr *); 1133 to6 = (struct sockaddr_in6 *)&to_store; 1134 bzero(to6, sizeof(*to6)); 1135 to6->sin6_family = AF_INET6; 1136 to6->sin6_len = sizeof(struct sockaddr_in6); 1137 to6->sin6_addr = ip6->ip6_dst; 1138 to6->sin6_port = sh->dest_port; 1139 /* Get the scopes in properly to the sin6 addr's */ 1140 /* we probably don't need these operations */ 1141 (void)sa6_recoverscope(to6); 1142 sa6_embedscope(to6, ip6_use_defzone); 1143 } 1144 find_tcp_pool = 0; 1145 /* 1146 * FIX FIX?, I think we only need to look in the TCP pool if its an 1147 * INIT or COOKIE-ECHO, We really don't need to find it that way if 1148 * its a INIT-ACK or COOKIE_ACK since these in bot one-2-one and 1149 * one-2-N would be in the main pool anyway. 1150 */ 1151 if ((ch->chunk_type != SCTP_INITIATION) && 1152 (ch->chunk_type != SCTP_INITIATION_ACK) && 1153 (ch->chunk_type != SCTP_COOKIE_ACK) && 1154 (ch->chunk_type != SCTP_COOKIE_ECHO)) { 1155 /* Other chunk types go to the tcp pool. */ 1156 find_tcp_pool = 1; 1157 } 1158 if (inp_p) { 1159 retval = sctp_findassociation_addr_sa(to, from, inp_p, netp, 1160 find_tcp_pool); 1161 inp = *inp_p; 1162 } else { 1163 retval = sctp_findassociation_addr_sa(to, from, &inp, netp, 1164 find_tcp_pool); 1165 } 1166 #ifdef SCTP_DEBUG 1167 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1168 printf("retval:%p inp:%p\n", retval, inp); 1169 } 1170 #endif 1171 if (retval == NULL && inp) { 1172 /* Found a EP but not this address */ 1173 if ((ch->chunk_type == SCTP_INITIATION) || 1174 (ch->chunk_type == SCTP_INITIATION_ACK)) { 1175 /* 1176 * special hook, we do NOT return linp or an 1177 * association that is linked to an existing 1178 * association that is under the TCP pool (i.e. no 1179 * listener exists). The endpoint finding routine 1180 * will always find a listner before examining the 1181 * TCP pool. 1182 */ 1183 if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) { 1184 if (inp_p) { 1185 *inp_p = NULL; 1186 } 1187 return (NULL); 1188 } 1189 retval = sctp_findassociation_special_addr(m, iphlen, 1190 offset, sh, &inp, netp, to); 1191 if (inp_p != NULL) { 1192 *inp_p = inp; 1193 } 1194 } 1195 } 1196 #ifdef SCTP_DEBUG 1197 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1198 printf("retval is %p\n", retval); 1199 } 1200 #endif 1201 return (retval); 1202 } 1203 1204 /* 1205 * lookup an association by an ASCONF lookup address. 1206 * if the lookup address is 0.0.0.0 or ::0, use the vtag to do the lookup 1207 */ 1208 struct sctp_tcb * 1209 sctp_findassociation_ep_asconf(struct mbuf *m, int iphlen, int offset, 1210 struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp) 1211 { 1212 struct sctp_tcb *stcb; 1213 struct sockaddr_in *sin; 1214 struct sockaddr_in6 *sin6; 1215 struct sockaddr_storage local_store, remote_store; 1216 struct ip *iph; 1217 struct sctp_paramhdr parm_buf, *phdr; 1218 int ptype; 1219 int zero_address = 0; 1220 1221 1222 memset(&local_store, 0, sizeof(local_store)); 1223 memset(&remote_store, 0, sizeof(remote_store)); 1224 1225 /* First get the destination address setup too. */ 1226 iph = mtod(m, struct ip *); 1227 if (iph->ip_v == IPVERSION) { 1228 /* its IPv4 */ 1229 sin = (struct sockaddr_in *)&local_store; 1230 sin->sin_family = AF_INET; 1231 sin->sin_len = sizeof(*sin); 1232 sin->sin_port = sh->dest_port; 1233 sin->sin_addr.s_addr = iph->ip_dst.s_addr; 1234 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1235 /* its IPv6 */ 1236 struct ip6_hdr *ip6; 1237 1238 ip6 = mtod(m, struct ip6_hdr *); 1239 sin6 = (struct sockaddr_in6 *)&local_store; 1240 sin6->sin6_family = AF_INET6; 1241 sin6->sin6_len = sizeof(*sin6); 1242 sin6->sin6_port = sh->dest_port; 1243 sin6->sin6_addr = ip6->ip6_dst; 1244 } else { 1245 return NULL; 1246 } 1247 1248 phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk), 1249 &parm_buf, sizeof(struct sctp_paramhdr)); 1250 if (phdr == NULL) { 1251 #ifdef SCTP_DEBUG 1252 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 1253 printf("findassociation_ep_asconf: failed to get asconf lookup addr\n"); 1254 } 1255 #endif /* SCTP_DEBUG */ 1256 return NULL; 1257 } 1258 ptype = (int)((uint32_t) ntohs(phdr->param_type)); 1259 /* get the correlation address */ 1260 if (ptype == SCTP_IPV6_ADDRESS) { 1261 /* ipv6 address param */ 1262 struct sctp_ipv6addr_param *p6, p6_buf; 1263 1264 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) { 1265 return NULL; 1266 } 1267 p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m, 1268 offset + sizeof(struct sctp_asconf_chunk), 1269 &p6_buf.ph, sizeof(*p6)); 1270 if (p6 == NULL) { 1271 #ifdef SCTP_DEBUG 1272 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 1273 printf("findassociation_ep_asconf: failed to get asconf v6 lookup addr\n"); 1274 } 1275 #endif /* SCTP_DEBUG */ 1276 return (NULL); 1277 } 1278 sin6 = (struct sockaddr_in6 *)&remote_store; 1279 sin6->sin6_family = AF_INET6; 1280 sin6->sin6_len = sizeof(*sin6); 1281 sin6->sin6_port = sh->src_port; 1282 memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr)); 1283 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 1284 zero_address = 1; 1285 } else if (ptype == SCTP_IPV4_ADDRESS) { 1286 /* ipv4 address param */ 1287 struct sctp_ipv4addr_param *p4, p4_buf; 1288 1289 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) { 1290 return NULL; 1291 } 1292 p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m, 1293 offset + sizeof(struct sctp_asconf_chunk), 1294 &p4_buf.ph, sizeof(*p4)); 1295 if (p4 == NULL) { 1296 #ifdef SCTP_DEBUG 1297 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 1298 printf("findassociation_ep_asconf: failed to get asconf v4 lookup addr\n"); 1299 } 1300 #endif /* SCTP_DEBUG */ 1301 return (NULL); 1302 } 1303 sin = (struct sockaddr_in *)&remote_store; 1304 sin->sin_family = AF_INET; 1305 sin->sin_len = sizeof(*sin); 1306 sin->sin_port = sh->src_port; 1307 memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr)); 1308 if (sin->sin_addr.s_addr == INADDR_ANY) 1309 zero_address = 1; 1310 } else { 1311 /* invalid address param type */ 1312 return NULL; 1313 } 1314 1315 if (zero_address) { 1316 stcb = sctp_findassoc_by_vtag(NULL, ntohl(sh->v_tag), inp_p, 1317 netp, sh->src_port, sh->dest_port, 1); 1318 /* 1319 * printf("findassociation_ep_asconf: zero lookup address 1320 * finds stcb 0x%x\n", (uint32_t)stcb); 1321 */ 1322 } else { 1323 stcb = sctp_findassociation_ep_addr(inp_p, 1324 (struct sockaddr *)&remote_store, netp, 1325 (struct sockaddr *)&local_store, NULL); 1326 } 1327 return (stcb); 1328 } 1329 1330 1331 extern int sctp_max_burst_default; 1332 1333 extern unsigned int sctp_delayed_sack_time_default; 1334 extern unsigned int sctp_heartbeat_interval_default; 1335 extern unsigned int sctp_pmtu_raise_time_default; 1336 extern unsigned int sctp_shutdown_guard_time_default; 1337 extern unsigned int sctp_secret_lifetime_default; 1338 1339 extern unsigned int sctp_rto_max_default; 1340 extern unsigned int sctp_rto_min_default; 1341 extern unsigned int sctp_rto_initial_default; 1342 extern unsigned int sctp_init_rto_max_default; 1343 extern unsigned int sctp_valid_cookie_life_default; 1344 extern unsigned int sctp_init_rtx_max_default; 1345 extern unsigned int sctp_assoc_rtx_max_default; 1346 extern unsigned int sctp_path_rtx_max_default; 1347 extern unsigned int sctp_nr_outgoing_streams_default; 1348 1349 /* 1350 * allocate a sctp_inpcb and setup a temporary binding to a port/all 1351 * addresses. This way if we don't get a bind we by default pick a ephemeral 1352 * port with all addresses bound. 1353 */ 1354 int 1355 sctp_inpcb_alloc(struct socket *so) 1356 { 1357 /* 1358 * we get called when a new endpoint starts up. We need to allocate 1359 * the sctp_inpcb structure from the zone and init it. Mark it as 1360 * unbound and find a port that we can use as an ephemeral with 1361 * INADDR_ANY. If the user binds later no problem we can then add in 1362 * the specific addresses. And setup the default parameters for the 1363 * EP. 1364 */ 1365 int i, error; 1366 struct sctp_inpcb *inp; 1367 1368 struct sctp_pcb *m; 1369 struct timeval time; 1370 sctp_sharedkey_t *null_key; 1371 1372 error = 0; 1373 1374 SCTP_INP_INFO_WLOCK(); 1375 inp = (struct sctp_inpcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_ep); 1376 if (inp == NULL) { 1377 printf("Out of SCTP-INPCB structures - no resources\n"); 1378 SCTP_INP_INFO_WUNLOCK(); 1379 return (ENOBUFS); 1380 } 1381 /* zap it */ 1382 bzero(inp, sizeof(*inp)); 1383 1384 /* bump generations */ 1385 /* setup socket pointers */ 1386 inp->sctp_socket = so; 1387 inp->ip_inp.inp.inp_socket = so; 1388 1389 inp->partial_delivery_point = so->so_rcv.sb_hiwat >> SCTP_PARTIAL_DELIVERY_SHIFT; 1390 inp->sctp_frag_point = SCTP_DEFAULT_MAXSEGMENT; 1391 1392 #ifdef IPSEC 1393 { 1394 struct inpcbpolicy *pcb_sp = NULL; 1395 1396 error = ipsec_init_pcbpolicy(so, &pcb_sp); 1397 /* Arrange to share the policy */ 1398 inp->ip_inp.inp.inp_sp = pcb_sp; 1399 ((struct in6pcb *)(&inp->ip_inp.inp))->in6p_sp = pcb_sp; 1400 } 1401 if (error != 0) { 1402 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1403 SCTP_INP_INFO_WUNLOCK(); 1404 return error; 1405 } 1406 #endif /* IPSEC */ 1407 SCTP_INCR_EP_COUNT(); 1408 inp->ip_inp.inp.inp_ip_ttl = ip_defttl; 1409 SCTP_INP_INFO_WUNLOCK(); 1410 1411 so->so_pcb = (caddr_t)inp; 1412 1413 if ((so->so_type == SOCK_DGRAM) || 1414 (so->so_type == SOCK_SEQPACKET)) { 1415 /* UDP style socket */ 1416 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE | 1417 SCTP_PCB_FLAGS_UNBOUND); 1418 sctp_feature_on(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT); 1419 /* Be sure it is NON-BLOCKING IO for UDP */ 1420 /* so->so_state |= SS_NBIO; */ 1421 } else if (so->so_type == SOCK_STREAM) { 1422 /* TCP style socket */ 1423 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 1424 SCTP_PCB_FLAGS_UNBOUND); 1425 sctp_feature_on(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT); 1426 /* Be sure we have blocking IO by default */ 1427 so->so_state &= ~SS_NBIO; 1428 } else { 1429 /* 1430 * unsupported socket type (RAW, etc)- in case we missed it 1431 * in protosw 1432 */ 1433 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1434 return (EOPNOTSUPP); 1435 } 1436 inp->sctp_tcbhash = hashinit(sctp_pcbtblsize, 1437 M_PCB, 1438 &inp->sctp_hashmark); 1439 if (inp->sctp_tcbhash == NULL) { 1440 printf("Out of SCTP-INPCB->hashinit - no resources\n"); 1441 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1442 return (ENOBUFS); 1443 } 1444 SCTP_INP_INFO_WLOCK(); 1445 SCTP_INP_LOCK_INIT(inp); 1446 SCTP_INP_READ_INIT(inp); 1447 SCTP_ASOC_CREATE_LOCK_INIT(inp); 1448 /* lock the new ep */ 1449 SCTP_INP_WLOCK(inp); 1450 1451 /* add it to the info area */ 1452 LIST_INSERT_HEAD(&sctppcbinfo.listhead, inp, sctp_list); 1453 SCTP_INP_INFO_WUNLOCK(); 1454 1455 TAILQ_INIT(&inp->read_queue); 1456 LIST_INIT(&inp->sctp_addr_list); 1457 LIST_INIT(&inp->sctp_asoc_list); 1458 1459 #ifdef SCTP_TRACK_FREED_ASOCS 1460 /* TEMP CODE */ 1461 LIST_INIT(&inp->sctp_asoc_free_list); 1462 #endif 1463 /* Init the timer structure for signature change */ 1464 callout_init(&inp->sctp_ep.signature_change.timer, 1); 1465 inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE; 1466 1467 /* now init the actual endpoint default data */ 1468 m = &inp->sctp_ep; 1469 1470 /* setup the base timeout information */ 1471 m->sctp_timeoutticks[SCTP_TIMER_SEND] = SEC_TO_TICKS(SCTP_SEND_SEC); /* needed ? */ 1472 m->sctp_timeoutticks[SCTP_TIMER_INIT] = SEC_TO_TICKS(SCTP_INIT_SEC); /* needed ? */ 1473 m->sctp_timeoutticks[SCTP_TIMER_RECV] = MSEC_TO_TICKS(sctp_delayed_sack_time_default); 1474 m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = MSEC_TO_TICKS(sctp_heartbeat_interval_default); 1475 m->sctp_timeoutticks[SCTP_TIMER_PMTU] = SEC_TO_TICKS(sctp_pmtu_raise_time_default); 1476 m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = SEC_TO_TICKS(sctp_shutdown_guard_time_default); 1477 m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = SEC_TO_TICKS(sctp_secret_lifetime_default); 1478 /* all max/min max are in ms */ 1479 m->sctp_maxrto = sctp_rto_max_default; 1480 m->sctp_minrto = sctp_rto_min_default; 1481 m->initial_rto = sctp_rto_initial_default; 1482 m->initial_init_rto_max = sctp_init_rto_max_default; 1483 1484 m->max_open_streams_intome = MAX_SCTP_STREAMS; 1485 1486 m->max_init_times = sctp_init_rtx_max_default; 1487 m->max_send_times = sctp_assoc_rtx_max_default; 1488 m->def_net_failure = sctp_path_rtx_max_default; 1489 m->sctp_sws_sender = SCTP_SWS_SENDER_DEF; 1490 m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF; 1491 m->max_burst = sctp_max_burst_default; 1492 /* number of streams to pre-open on a association */ 1493 m->pre_open_stream_count = sctp_nr_outgoing_streams_default; 1494 1495 /* Add adaptation cookie */ 1496 m->adaptation_layer_indicator = 0x504C5253; 1497 1498 /* seed random number generator */ 1499 m->random_counter = 1; 1500 m->store_at = SCTP_SIGNATURE_SIZE; 1501 sctp_read_random(m->random_numbers, sizeof(m->random_numbers)); 1502 sctp_fill_random_store(m); 1503 1504 /* Minimum cookie size */ 1505 m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) + 1506 sizeof(struct sctp_state_cookie); 1507 m->size_of_a_cookie += SCTP_SIGNATURE_SIZE; 1508 1509 /* Setup the initial secret */ 1510 SCTP_GETTIME_TIMEVAL(&time); 1511 m->time_of_secret_change = time.tv_sec; 1512 1513 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) { 1514 m->secret_key[0][i] = sctp_select_initial_TSN(m); 1515 } 1516 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL); 1517 1518 /* How long is a cookie good for ? */ 1519 m->def_cookie_life = sctp_valid_cookie_life_default; 1520 1521 /* 1522 * Initialize authentication parameters 1523 */ 1524 m->local_hmacs = sctp_default_supported_hmaclist(); 1525 m->local_auth_chunks = sctp_alloc_chunklist(); 1526 sctp_auth_set_default_chunks(m->local_auth_chunks); 1527 LIST_INIT(&m->shared_keys); 1528 /* add default NULL key as key id 0 */ 1529 null_key = sctp_alloc_sharedkey(); 1530 sctp_insert_sharedkey(&m->shared_keys, null_key); 1531 SCTP_INP_WUNLOCK(inp); 1532 #ifdef SCTP_LOG_CLOSING 1533 sctp_log_closing(inp, NULL, 12); 1534 #endif 1535 return (error); 1536 } 1537 1538 1539 void 1540 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp, 1541 struct sctp_tcb *stcb) 1542 { 1543 struct sctp_nets *net; 1544 uint16_t lport, rport; 1545 struct sctppcbhead *head; 1546 struct sctp_laddr *laddr, *oladdr; 1547 1548 SCTP_TCB_UNLOCK(stcb); 1549 SCTP_INP_INFO_WLOCK(); 1550 SCTP_INP_WLOCK(old_inp); 1551 SCTP_INP_WLOCK(new_inp); 1552 SCTP_TCB_LOCK(stcb); 1553 1554 new_inp->sctp_ep.time_of_secret_change = 1555 old_inp->sctp_ep.time_of_secret_change; 1556 memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key, 1557 sizeof(old_inp->sctp_ep.secret_key)); 1558 new_inp->sctp_ep.current_secret_number = 1559 old_inp->sctp_ep.current_secret_number; 1560 new_inp->sctp_ep.last_secret_number = 1561 old_inp->sctp_ep.last_secret_number; 1562 new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie; 1563 1564 /* make it so new data pours into the new socket */ 1565 stcb->sctp_socket = new_inp->sctp_socket; 1566 stcb->sctp_ep = new_inp; 1567 1568 /* Copy the port across */ 1569 lport = new_inp->sctp_lport = old_inp->sctp_lport; 1570 rport = stcb->rport; 1571 /* Pull the tcb from the old association */ 1572 LIST_REMOVE(stcb, sctp_tcbhash); 1573 LIST_REMOVE(stcb, sctp_tcblist); 1574 1575 /* Now insert the new_inp into the TCP connected hash */ 1576 head = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR((lport + rport), 1577 sctppcbinfo.hashtcpmark)]; 1578 1579 LIST_INSERT_HEAD(head, new_inp, sctp_hash); 1580 1581 /* Now move the tcb into the endpoint list */ 1582 LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist); 1583 /* 1584 * Question, do we even need to worry about the ep-hash since we 1585 * only have one connection? Probably not :> so lets get rid of it 1586 * and not suck up any kernel memory in that. 1587 */ 1588 1589 /* Ok. Let's restart timer. */ 1590 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 1591 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, new_inp, 1592 stcb, net); 1593 } 1594 1595 SCTP_INP_INFO_WUNLOCK(); 1596 if (new_inp->sctp_tcbhash != NULL) { 1597 SCTP_FREE(new_inp->sctp_tcbhash); 1598 new_inp->sctp_tcbhash = NULL; 1599 } 1600 if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 1601 /* Subset bound, so copy in the laddr list from the old_inp */ 1602 LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) { 1603 laddr = (struct sctp_laddr *)SCTP_ZONE_GET( 1604 sctppcbinfo.ipi_zone_laddr); 1605 if (laddr == NULL) { 1606 /* 1607 * Gak, what can we do? This assoc is really 1608 * HOSED. We probably should send an abort 1609 * here. 1610 */ 1611 #ifdef SCTP_DEBUG 1612 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1613 printf("Association hosed in TCP model, out of laddr memory\n"); 1614 } 1615 #endif /* SCTP_DEBUG */ 1616 continue; 1617 } 1618 SCTP_INCR_LADDR_COUNT(); 1619 bzero(laddr, sizeof(*laddr)); 1620 laddr->ifa = oladdr->ifa; 1621 LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr, 1622 sctp_nxt_addr); 1623 new_inp->laddr_count++; 1624 } 1625 } 1626 /* 1627 * Now any running timers need to be adjusted since we really don't 1628 * care if they are running or not just blast in the new_inp into 1629 * all of them. 1630 */ 1631 1632 stcb->asoc.hb_timer.ep = (void *)new_inp; 1633 stcb->asoc.dack_timer.ep = (void *)new_inp; 1634 stcb->asoc.asconf_timer.ep = (void *)new_inp; 1635 stcb->asoc.strreset_timer.ep = (void *)new_inp; 1636 stcb->asoc.shut_guard_timer.ep = (void *)new_inp; 1637 stcb->asoc.autoclose_timer.ep = (void *)new_inp; 1638 stcb->asoc.delayed_event_timer.ep = (void *)new_inp; 1639 /* now what about the nets? */ 1640 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 1641 net->pmtu_timer.ep = (void *)new_inp; 1642 net->rxt_timer.ep = (void *)new_inp; 1643 net->fr_timer.ep = (void *)new_inp; 1644 } 1645 SCTP_INP_WUNLOCK(new_inp); 1646 SCTP_INP_WUNLOCK(old_inp); 1647 } 1648 1649 static int 1650 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport) 1651 { 1652 struct sctppcbhead *head; 1653 struct sctp_inpcb *t_inp; 1654 1655 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 1656 sctppcbinfo.hashmark)]; 1657 1658 LIST_FOREACH(t_inp, head, sctp_hash) { 1659 if (t_inp->sctp_lport != lport) { 1660 continue; 1661 } 1662 /* This one is in use. */ 1663 /* check the v6/v4 binding issue */ 1664 if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 1665 (((struct inpcb *)t_inp)->inp_flags & IN6P_IPV6_V6ONLY) 1666 ) { 1667 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 1668 /* collision in V6 space */ 1669 return (1); 1670 } else { 1671 /* inp is BOUND_V4 no conflict */ 1672 continue; 1673 } 1674 } else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 1675 /* t_inp is bound v4 and v6, conflict always */ 1676 return (1); 1677 } else { 1678 /* t_inp is bound only V4 */ 1679 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 1680 (((struct inpcb *)inp)->inp_flags & IN6P_IPV6_V6ONLY) 1681 ) { 1682 /* no conflict */ 1683 continue; 1684 } 1685 /* else fall through to conflict */ 1686 } 1687 return (1); 1688 } 1689 return (0); 1690 } 1691 1692 1693 1694 int 1695 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct thread *p) 1696 { 1697 /* bind a ep to a socket address */ 1698 struct sctppcbhead *head; 1699 struct sctp_inpcb *inp, *inp_tmp; 1700 struct inpcb *ip_inp; 1701 int bindall; 1702 uint16_t lport; 1703 int error; 1704 1705 lport = 0; 1706 error = 0; 1707 bindall = 1; 1708 inp = (struct sctp_inpcb *)so->so_pcb; 1709 ip_inp = (struct inpcb *)so->so_pcb; 1710 #ifdef SCTP_DEBUG 1711 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1712 if (addr) { 1713 printf("Bind called port:%d\n", 1714 ntohs(((struct sockaddr_in *)addr)->sin_port)); 1715 printf("Addr :"); 1716 sctp_print_address(addr); 1717 } 1718 } 1719 #endif /* SCTP_DEBUG */ 1720 if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) { 1721 /* already did a bind, subsequent binds NOT allowed ! */ 1722 return (EINVAL); 1723 } 1724 if (addr != NULL) { 1725 if (addr->sa_family == AF_INET) { 1726 struct sockaddr_in *sin; 1727 1728 /* IPV6_V6ONLY socket? */ 1729 if ( 1730 (ip_inp->inp_flags & IN6P_IPV6_V6ONLY) 1731 ) { 1732 return (EINVAL); 1733 } 1734 if (addr->sa_len != sizeof(*sin)) 1735 return (EINVAL); 1736 1737 sin = (struct sockaddr_in *)addr; 1738 lport = sin->sin_port; 1739 1740 if (sin->sin_addr.s_addr != INADDR_ANY) { 1741 bindall = 0; 1742 } 1743 } else if (addr->sa_family == AF_INET6) { 1744 /* Only for pure IPv6 Address. (No IPv4 Mapped!) */ 1745 struct sockaddr_in6 *sin6; 1746 1747 sin6 = (struct sockaddr_in6 *)addr; 1748 1749 if (addr->sa_len != sizeof(*sin6)) 1750 return (EINVAL); 1751 1752 lport = sin6->sin6_port; 1753 if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1754 bindall = 0; 1755 /* KAME hack: embed scopeid */ 1756 if (sa6_embedscope(sin6, ip6_use_defzone) != 0) 1757 return (EINVAL); 1758 } 1759 /* this must be cleared for ifa_ifwithaddr() */ 1760 sin6->sin6_scope_id = 0; 1761 } else { 1762 return (EAFNOSUPPORT); 1763 } 1764 } 1765 SCTP_INP_INFO_WLOCK(); 1766 SCTP_INP_WLOCK(inp); 1767 /* increase our count due to the unlock we do */ 1768 SCTP_INP_INCR_REF(inp); 1769 if (lport) { 1770 /* 1771 * Did the caller specify a port? if so we must see if a ep 1772 * already has this one bound. 1773 */ 1774 /* got to be root to get at low ports */ 1775 if (ntohs(lport) < IPPORT_RESERVED) { 1776 if (p && (error = 1777 priv_check(p, 1778 PRIV_NETINET_RESERVEDPORT) 1779 )) { 1780 SCTP_INP_DECR_REF(inp); 1781 SCTP_INP_WUNLOCK(inp); 1782 SCTP_INP_INFO_WUNLOCK(); 1783 return (error); 1784 } 1785 } 1786 if (p == NULL) { 1787 SCTP_INP_DECR_REF(inp); 1788 SCTP_INP_WUNLOCK(inp); 1789 SCTP_INP_INFO_WUNLOCK(); 1790 return (error); 1791 } 1792 SCTP_INP_WUNLOCK(inp); 1793 inp_tmp = sctp_pcb_findep(addr, 0, 1); 1794 if (inp_tmp != NULL) { 1795 /* 1796 * lock guy returned and lower count note that we 1797 * are not bound so inp_tmp should NEVER be inp. And 1798 * it is this inp (inp_tmp) that gets the reference 1799 * bump, so we must lower it. 1800 */ 1801 SCTP_INP_DECR_REF(inp_tmp); 1802 SCTP_INP_DECR_REF(inp); 1803 /* unlock info */ 1804 SCTP_INP_INFO_WUNLOCK(); 1805 return (EADDRNOTAVAIL); 1806 } 1807 SCTP_INP_WLOCK(inp); 1808 if (bindall) { 1809 /* verify that no lport is not used by a singleton */ 1810 if (sctp_isport_inuse(inp, lport)) { 1811 /* Sorry someone already has this one bound */ 1812 SCTP_INP_DECR_REF(inp); 1813 SCTP_INP_WUNLOCK(inp); 1814 SCTP_INP_INFO_WUNLOCK(); 1815 return (EADDRNOTAVAIL); 1816 } 1817 } 1818 } else { 1819 /* 1820 * get any port but lets make sure no one has any address 1821 * with this port bound 1822 */ 1823 1824 /* 1825 * setup the inp to the top (I could use the union but this 1826 * is just as easy 1827 */ 1828 uint32_t port_guess; 1829 uint16_t port_attempt; 1830 int not_done = 1; 1831 1832 while (not_done) { 1833 port_guess = sctp_select_initial_TSN(&inp->sctp_ep); 1834 port_attempt = (port_guess & 0x0000ffff); 1835 if (port_attempt == 0) { 1836 goto next_half; 1837 } 1838 if (port_attempt < IPPORT_RESERVED) { 1839 port_attempt += IPPORT_RESERVED; 1840 } 1841 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1842 /* got a port we can use */ 1843 not_done = 0; 1844 continue; 1845 } 1846 /* try upper half */ 1847 next_half: 1848 port_attempt = ((port_guess >> 16) & 0x0000ffff); 1849 if (port_attempt == 0) { 1850 goto last_try; 1851 } 1852 if (port_attempt < IPPORT_RESERVED) { 1853 port_attempt += IPPORT_RESERVED; 1854 } 1855 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1856 /* got a port we can use */ 1857 not_done = 0; 1858 continue; 1859 } 1860 /* try two half's added together */ 1861 last_try: 1862 port_attempt = (((port_guess >> 16) & 0x0000ffff) + 1863 (port_guess & 0x0000ffff)); 1864 if (port_attempt == 0) { 1865 /* get a new random number */ 1866 continue; 1867 } 1868 if (port_attempt < IPPORT_RESERVED) { 1869 port_attempt += IPPORT_RESERVED; 1870 } 1871 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1872 /* got a port we can use */ 1873 not_done = 0; 1874 continue; 1875 } 1876 } 1877 /* we don't get out of the loop until we have a port */ 1878 lport = htons(port_attempt); 1879 } 1880 SCTP_INP_DECR_REF(inp); 1881 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE | 1882 SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 1883 /* 1884 * this really should not happen. The guy did a non-blocking 1885 * bind and then did a close at the same time. 1886 */ 1887 SCTP_INP_WUNLOCK(inp); 1888 SCTP_INP_INFO_WUNLOCK(); 1889 return (EINVAL); 1890 } 1891 /* ok we look clear to give out this port, so lets setup the binding */ 1892 if (bindall) { 1893 /* binding to all addresses, so just set in the proper flags */ 1894 inp->sctp_flags |= SCTP_PCB_FLAGS_BOUNDALL; 1895 sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF); 1896 /* set the automatic addr changes from kernel flag */ 1897 if (sctp_auto_asconf == 0) { 1898 sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF); 1899 } else { 1900 sctp_feature_on(inp, SCTP_PCB_FLAGS_AUTO_ASCONF); 1901 } 1902 } else { 1903 /* 1904 * bind specific, make sure flags is off and add a new 1905 * address structure to the sctp_addr_list inside the ep 1906 * structure. 1907 * 1908 * We will need to allocate one and insert it at the head. The 1909 * socketopt call can just insert new addresses in there as 1910 * well. It will also have to do the embed scope kame hack 1911 * too (before adding). 1912 */ 1913 struct ifaddr *ifa; 1914 struct sockaddr_storage store_sa; 1915 1916 memset(&store_sa, 0, sizeof(store_sa)); 1917 if (addr->sa_family == AF_INET) { 1918 struct sockaddr_in *sin; 1919 1920 sin = (struct sockaddr_in *)&store_sa; 1921 memcpy(sin, addr, sizeof(struct sockaddr_in)); 1922 sin->sin_port = 0; 1923 } else if (addr->sa_family == AF_INET6) { 1924 struct sockaddr_in6 *sin6; 1925 1926 sin6 = (struct sockaddr_in6 *)&store_sa; 1927 memcpy(sin6, addr, sizeof(struct sockaddr_in6)); 1928 sin6->sin6_port = 0; 1929 } 1930 /* 1931 * first find the interface with the bound address need to 1932 * zero out the port to find the address! yuck! can't do 1933 * this earlier since need port for sctp_pcb_findep() 1934 */ 1935 ifa = sctp_find_ifa_by_addr((struct sockaddr *)&store_sa); 1936 if (ifa == NULL) { 1937 /* Can't find an interface with that address */ 1938 SCTP_INP_WUNLOCK(inp); 1939 SCTP_INP_INFO_WUNLOCK(); 1940 return (EADDRNOTAVAIL); 1941 } 1942 if (addr->sa_family == AF_INET6) { 1943 struct in6_ifaddr *ifa6; 1944 1945 ifa6 = (struct in6_ifaddr *)ifa; 1946 /* 1947 * allow binding of deprecated addresses as per RFC 1948 * 2462 and ipng discussion 1949 */ 1950 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 1951 IN6_IFF_ANYCAST | 1952 IN6_IFF_NOTREADY)) { 1953 /* Can't bind a non-existent addr. */ 1954 SCTP_INP_WUNLOCK(inp); 1955 SCTP_INP_INFO_WUNLOCK(); 1956 return (EINVAL); 1957 } 1958 } 1959 /* we're not bound all */ 1960 inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL; 1961 /* set the automatic addr changes from kernel flag */ 1962 if (sctp_auto_asconf == 0) { 1963 sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF); 1964 } else { 1965 sctp_feature_on(inp, SCTP_PCB_FLAGS_AUTO_ASCONF); 1966 } 1967 /* allow bindx() to send ASCONF's for binding changes */ 1968 sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF); 1969 /* add this address to the endpoint list */ 1970 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa); 1971 if (error != 0) { 1972 SCTP_INP_WUNLOCK(inp); 1973 SCTP_INP_INFO_WUNLOCK(); 1974 return (error); 1975 } 1976 inp->laddr_count++; 1977 } 1978 /* find the bucket */ 1979 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 1980 sctppcbinfo.hashmark)]; 1981 /* put it in the bucket */ 1982 LIST_INSERT_HEAD(head, inp, sctp_hash); 1983 #ifdef SCTP_DEBUG 1984 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1985 printf("Main hash to bind at head:%p, bound port:%d\n", head, ntohs(lport)); 1986 } 1987 #endif 1988 /* set in the port */ 1989 inp->sctp_lport = lport; 1990 1991 /* turn off just the unbound flag */ 1992 inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND; 1993 SCTP_INP_WUNLOCK(inp); 1994 SCTP_INP_INFO_WUNLOCK(); 1995 return (0); 1996 } 1997 1998 1999 static void 2000 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp, struct sctp_inpcb *inp_next) 2001 { 2002 struct sctp_iterator *it; 2003 2004 /* 2005 * We enter with the only the ITERATOR_LOCK in place and a write 2006 * lock on the inp_info stuff. 2007 */ 2008 2009 /* 2010 * Go through all iterators, we must do this since it is possible 2011 * that some iterator does NOT have the lock, but is waiting for it. 2012 * And the one that had the lock has either moved in the last 2013 * iteration or we just cleared it above. We need to find all of 2014 * those guys. The list of iterators should never be very big 2015 * though. 2016 */ 2017 LIST_FOREACH(it, &sctppcbinfo.iteratorhead, sctp_nxt_itr) { 2018 if (it == inp->inp_starting_point_for_iterator) 2019 /* skip this guy, he's special */ 2020 continue; 2021 if (it->inp == inp) { 2022 /* 2023 * This is tricky and we DON'T lock the iterator. 2024 * Reason is he's running but waiting for me since 2025 * inp->inp_starting_point_for_iterator has the lock 2026 * on me (the guy above we skipped). This tells us 2027 * its is not running but waiting for 2028 * inp->inp_starting_point_for_iterator to be 2029 * released by the guy that does have our INP in a 2030 * lock. 2031 */ 2032 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 2033 it->inp = NULL; 2034 it->stcb = NULL; 2035 } else { 2036 /* set him up to do the next guy not me */ 2037 it->inp = inp_next; 2038 it->stcb = NULL; 2039 } 2040 } 2041 } 2042 it = inp->inp_starting_point_for_iterator; 2043 if (it) { 2044 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 2045 it->inp = NULL; 2046 } else { 2047 it->inp = inp_next; 2048 } 2049 it->stcb = NULL; 2050 } 2051 } 2052 2053 /* release sctp_inpcb unbind the port */ 2054 void 2055 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from) 2056 { 2057 /* 2058 * Here we free a endpoint. We must find it (if it is in the Hash 2059 * table) and remove it from there. Then we must also find it in the 2060 * overall list and remove it from there. After all removals are 2061 * complete then any timer has to be stopped. Then start the actual 2062 * freeing. a) Any local lists. b) Any associations. c) The hash of 2063 * all associations. d) finally the ep itself. 2064 */ 2065 struct sctp_pcb *m; 2066 struct sctp_inpcb *inp_save; 2067 struct sctp_tcb *asoc, *nasoc; 2068 struct sctp_laddr *laddr, *nladdr; 2069 struct inpcb *ip_pcb; 2070 struct socket *so; 2071 2072 struct sctp_queued_to_read *sq; 2073 2074 int s, cnt; 2075 sctp_sharedkey_t *shared_key; 2076 2077 s = splnet(); 2078 2079 #ifdef SCTP_LOG_CLOSING 2080 sctp_log_closing(inp, NULL, 0); 2081 #endif 2082 2083 SCTP_ITERATOR_LOCK(); 2084 so = inp->sctp_socket; 2085 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 2086 /* been here before.. eeks.. get out of here */ 2087 splx(s); 2088 printf("This conflict in free SHOULD not be happening!\n"); 2089 SCTP_ITERATOR_UNLOCK(); 2090 #ifdef SCTP_LOG_CLOSING 2091 sctp_log_closing(inp, NULL, 1); 2092 #endif 2093 return; 2094 } 2095 SCTP_ASOC_CREATE_LOCK(inp); 2096 SCTP_INP_INFO_WLOCK(); 2097 2098 SCTP_INP_WLOCK(inp); 2099 /* 2100 * First time through we have the socket lock, after that no more. 2101 */ 2102 if (from == 1) { 2103 /* 2104 * Once we are in we can remove the flag from = 1 is only 2105 * passed from the actual closing routines that are called 2106 * via the sockets layer. 2107 */ 2108 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CLOSE_IP; 2109 } 2110 sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL, 2111 SCTP_FROM_SCTP_PCB + SCTP_LOC_1); 2112 2113 if (inp->control) { 2114 sctp_m_freem(inp->control); 2115 inp->control = NULL; 2116 } 2117 if (inp->pkt) { 2118 sctp_m_freem(inp->pkt); 2119 inp->pkt = NULL; 2120 } 2121 m = &inp->sctp_ep; 2122 ip_pcb = &inp->ip_inp.inp; /* we could just cast the main pointer 2123 * here but I will be nice :> (i.e. 2124 * ip_pcb = ep;) */ 2125 if (immediate == 0) { 2126 int cnt_in_sd; 2127 2128 cnt_in_sd = 0; 2129 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL; 2130 asoc = nasoc) { 2131 nasoc = LIST_NEXT(asoc, sctp_tcblist); 2132 if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 2133 /* Skip guys being freed */ 2134 asoc->sctp_socket = NULL; 2135 cnt_in_sd++; 2136 continue; 2137 } 2138 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_WAIT) || 2139 (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 2140 /* Just abandon things in the front states */ 2141 if (asoc->asoc.total_output_queue_size == 0) { 2142 sctp_free_assoc(inp, asoc, SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_2); 2143 continue; 2144 } 2145 } 2146 SCTP_TCB_LOCK(asoc); 2147 /* Disconnect the socket please */ 2148 asoc->sctp_socket = NULL; 2149 asoc->asoc.state |= SCTP_STATE_CLOSED_SOCKET; 2150 if ((asoc->asoc.size_on_reasm_queue > 0) || 2151 (asoc->asoc.control_pdapi) || 2152 (asoc->asoc.size_on_all_streams > 0) || 2153 (so && (so->so_rcv.sb_cc > 0)) 2154 ) { 2155 /* Left with Data unread */ 2156 struct mbuf *op_err; 2157 2158 op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)), 2159 0, M_DONTWAIT, 1, MT_DATA); 2160 if (op_err) { 2161 /* Fill in the user initiated abort */ 2162 struct sctp_paramhdr *ph; 2163 uint32_t *ippp; 2164 2165 op_err->m_len = 2166 sizeof(struct sctp_paramhdr) + sizeof(uint32_t); 2167 ph = mtod(op_err, 2168 struct sctp_paramhdr *); 2169 ph->param_type = htons( 2170 SCTP_CAUSE_USER_INITIATED_ABT); 2171 ph->param_length = htons(op_err->m_len); 2172 ippp = (uint32_t *) (ph + 1); 2173 *ippp = htonl(SCTP_FROM_SCTP_PCB + SCTP_LOC_3); 2174 } 2175 asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_3; 2176 sctp_send_abort_tcb(asoc, op_err); 2177 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 2178 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) || 2179 (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 2180 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 2181 } 2182 sctp_free_assoc(inp, asoc, SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_4); 2183 continue; 2184 } else if (TAILQ_EMPTY(&asoc->asoc.send_queue) && 2185 TAILQ_EMPTY(&asoc->asoc.sent_queue) && 2186 (asoc->asoc.stream_queue_cnt == 0) 2187 ) { 2188 if (asoc->asoc.locked_on_sending) { 2189 goto abort_anyway; 2190 } 2191 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_SENT) && 2192 (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 2193 /* 2194 * there is nothing queued to send, 2195 * so I send shutdown 2196 */ 2197 sctp_send_shutdown(asoc, asoc->asoc.primary_destination); 2198 asoc->asoc.state = SCTP_STATE_SHUTDOWN_SENT; 2199 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 2200 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, asoc->sctp_ep, asoc, 2201 asoc->asoc.primary_destination); 2202 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc, 2203 asoc->asoc.primary_destination); 2204 sctp_chunk_output(inp, asoc, SCTP_OUTPUT_FROM_SHUT_TMR); 2205 } 2206 } else { 2207 /* mark into shutdown pending */ 2208 struct sctp_stream_queue_pending *sp; 2209 2210 asoc->asoc.state |= SCTP_STATE_SHUTDOWN_PENDING; 2211 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc, 2212 asoc->asoc.primary_destination); 2213 if (asoc->asoc.locked_on_sending) { 2214 sp = TAILQ_LAST(&((asoc->asoc.locked_on_sending)->outqueue), 2215 sctp_streamhead); 2216 if (sp == NULL) { 2217 printf("Error, sp is NULL, locked on sending is %p strm:%d\n", 2218 asoc->asoc.locked_on_sending, 2219 asoc->asoc.locked_on_sending->stream_no); 2220 } else { 2221 if ((sp->length == 0) && (sp->msg_is_complete == 0)) 2222 asoc->asoc.state |= SCTP_STATE_PARTIAL_MSG_LEFT; 2223 } 2224 } 2225 if (TAILQ_EMPTY(&asoc->asoc.send_queue) && 2226 TAILQ_EMPTY(&asoc->asoc.sent_queue) && 2227 (asoc->asoc.state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 2228 struct mbuf *op_err; 2229 2230 abort_anyway: 2231 op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)), 2232 0, M_DONTWAIT, 1, MT_DATA); 2233 if (op_err) { 2234 /* 2235 * Fill in the user 2236 * initiated abort 2237 */ 2238 struct sctp_paramhdr *ph; 2239 uint32_t *ippp; 2240 2241 op_err->m_len = 2242 (sizeof(struct sctp_paramhdr) + 2243 sizeof(uint32_t)); 2244 ph = mtod(op_err, 2245 struct sctp_paramhdr *); 2246 ph->param_type = htons( 2247 SCTP_CAUSE_USER_INITIATED_ABT); 2248 ph->param_length = htons(op_err->m_len); 2249 ippp = (uint32_t *) (ph + 1); 2250 *ippp = htonl(SCTP_FROM_SCTP_PCB + SCTP_LOC_5); 2251 } 2252 asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_5; 2253 sctp_send_abort_tcb(asoc, op_err); 2254 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 2255 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) || 2256 (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 2257 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 2258 } 2259 sctp_free_assoc(inp, asoc, SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_6); 2260 continue; 2261 } 2262 } 2263 cnt_in_sd++; 2264 SCTP_TCB_UNLOCK(asoc); 2265 } 2266 /* now is there some left in our SHUTDOWN state? */ 2267 if (cnt_in_sd) { 2268 splx(s); 2269 2270 SCTP_INP_WUNLOCK(inp); 2271 SCTP_ASOC_CREATE_UNLOCK(inp); 2272 SCTP_INP_INFO_WUNLOCK(); 2273 SCTP_ITERATOR_UNLOCK(); 2274 #ifdef SCTP_LOG_CLOSING 2275 sctp_log_closing(inp, NULL, 2); 2276 #endif 2277 return; 2278 } 2279 } 2280 inp->sctp_socket = NULL; 2281 if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) != 2282 SCTP_PCB_FLAGS_UNBOUND) { 2283 /* 2284 * ok, this guy has been bound. It's port is somewhere in 2285 * the sctppcbinfo hash table. Remove it! 2286 */ 2287 LIST_REMOVE(inp, sctp_hash); 2288 inp->sctp_flags |= SCTP_PCB_FLAGS_UNBOUND; 2289 } 2290 /* 2291 * If there is a timer running to kill us, forget it, since it may 2292 * have a contest on the INP lock.. which would cause us to die ... 2293 */ 2294 cnt = 0; 2295 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL; 2296 asoc = nasoc) { 2297 nasoc = LIST_NEXT(asoc, sctp_tcblist); 2298 if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 2299 cnt++; 2300 continue; 2301 } 2302 /* Free associations that are NOT killing us */ 2303 SCTP_TCB_LOCK(asoc); 2304 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_COOKIE_WAIT) && 2305 ((asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) { 2306 struct mbuf *op_err; 2307 uint32_t *ippp; 2308 2309 op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)), 2310 0, M_DONTWAIT, 1, MT_DATA); 2311 if (op_err) { 2312 /* Fill in the user initiated abort */ 2313 struct sctp_paramhdr *ph; 2314 2315 op_err->m_len = (sizeof(struct sctp_paramhdr) + 2316 sizeof(uint32_t)); 2317 ph = mtod(op_err, struct sctp_paramhdr *); 2318 ph->param_type = htons( 2319 SCTP_CAUSE_USER_INITIATED_ABT); 2320 ph->param_length = htons(op_err->m_len); 2321 ippp = (uint32_t *) (ph + 1); 2322 *ippp = htonl(SCTP_FROM_SCTP_PCB + SCTP_LOC_7); 2323 2324 } 2325 asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_7; 2326 sctp_send_abort_tcb(asoc, op_err); 2327 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 2328 } else if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 2329 cnt++; 2330 SCTP_TCB_UNLOCK(asoc); 2331 continue; 2332 } 2333 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) || 2334 (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 2335 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 2336 } 2337 sctp_free_assoc(inp, asoc, SCTP_PCBFREE_FORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_8); 2338 } 2339 if (cnt) { 2340 /* Ok we have someone out there that will kill us */ 2341 callout_stop(&inp->sctp_ep.signature_change.timer); 2342 SCTP_INP_WUNLOCK(inp); 2343 SCTP_ASOC_CREATE_UNLOCK(inp); 2344 SCTP_INP_INFO_WUNLOCK(); 2345 SCTP_ITERATOR_UNLOCK(); 2346 #ifdef SCTP_LOG_CLOSING 2347 sctp_log_closing(inp, NULL, 3); 2348 #endif 2349 return; 2350 } 2351 if ((inp->refcount) || (inp->sctp_flags & SCTP_PCB_FLAGS_CLOSE_IP)) { 2352 callout_stop(&inp->sctp_ep.signature_change.timer); 2353 sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL); 2354 SCTP_INP_WUNLOCK(inp); 2355 SCTP_ASOC_CREATE_UNLOCK(inp); 2356 SCTP_INP_INFO_WUNLOCK(); 2357 SCTP_ITERATOR_UNLOCK(); 2358 #ifdef SCTP_LOG_CLOSING 2359 sctp_log_closing(inp, NULL, 4); 2360 #endif 2361 return; 2362 } 2363 callout_stop(&inp->sctp_ep.signature_change.timer); 2364 inp->sctp_ep.signature_change.type = 0; 2365 inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE; 2366 2367 #ifdef SCTP_LOG_CLOSING 2368 sctp_log_closing(inp, NULL, 5); 2369 #endif 2370 2371 callout_stop(&inp->sctp_ep.signature_change.timer); 2372 inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NONE; 2373 /* Clear the read queue */ 2374 while ((sq = TAILQ_FIRST(&inp->read_queue)) != NULL) { 2375 TAILQ_REMOVE(&inp->read_queue, sq, next); 2376 sctp_free_remote_addr(sq->whoFrom); 2377 if (so) 2378 so->so_rcv.sb_cc -= sq->length; 2379 if (sq->data) { 2380 sctp_m_freem(sq->data); 2381 sq->data = NULL; 2382 } 2383 /* 2384 * no need to free the net count, since at this point all 2385 * assoc's are gone. 2386 */ 2387 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, sq); 2388 SCTP_DECR_READQ_COUNT(); 2389 } 2390 /* Now the sctp_pcb things */ 2391 /* 2392 * free each asoc if it is not already closed/free. we can't use the 2393 * macro here since le_next will get freed as part of the 2394 * sctp_free_assoc() call. 2395 */ 2396 cnt = 0; 2397 if (so) { 2398 #ifdef IPSEC 2399 ipsec4_delete_pcbpolicy(ip_pcb); 2400 #endif /* IPSEC */ 2401 2402 /* Unlocks not needed since the socket is gone now */ 2403 } 2404 if (ip_pcb->inp_options) { 2405 (void)sctp_m_free(ip_pcb->inp_options); 2406 ip_pcb->inp_options = 0; 2407 } 2408 if (ip_pcb->inp_moptions) { 2409 ip_freemoptions(ip_pcb->inp_moptions); 2410 ip_pcb->inp_moptions = 0; 2411 } 2412 #ifdef INET6 2413 if (ip_pcb->inp_vflag & INP_IPV6) { 2414 struct in6pcb *in6p; 2415 2416 in6p = (struct in6pcb *)inp; 2417 ip6_freepcbopts(in6p->in6p_outputopts); 2418 } 2419 #endif /* INET6 */ 2420 ip_pcb->inp_vflag = 0; 2421 /* free up authentication fields */ 2422 if (inp->sctp_ep.local_auth_chunks != NULL) 2423 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks); 2424 if (inp->sctp_ep.local_hmacs != NULL) 2425 sctp_free_hmaclist(inp->sctp_ep.local_hmacs); 2426 2427 shared_key = LIST_FIRST(&inp->sctp_ep.shared_keys); 2428 while (shared_key) { 2429 LIST_REMOVE(shared_key, next); 2430 sctp_free_sharedkey(shared_key); 2431 shared_key = LIST_FIRST(&inp->sctp_ep.shared_keys); 2432 } 2433 2434 inp_save = LIST_NEXT(inp, sctp_list); 2435 LIST_REMOVE(inp, sctp_list); 2436 2437 /* fix any iterators only after out of the list */ 2438 sctp_iterator_inp_being_freed(inp, inp_save); 2439 /* 2440 * if we have an address list the following will free the list of 2441 * ifaddr's that are set into this ep. Again macro limitations here, 2442 * since the LIST_FOREACH could be a bad idea. 2443 */ 2444 for ((laddr = LIST_FIRST(&inp->sctp_addr_list)); laddr != NULL; 2445 laddr = nladdr) { 2446 nladdr = LIST_NEXT(laddr, sctp_nxt_addr); 2447 LIST_REMOVE(laddr, sctp_nxt_addr); 2448 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 2449 SCTP_DECR_LADDR_COUNT(); 2450 } 2451 2452 #ifdef SCTP_TRACK_FREED_ASOCS 2453 /* TEMP CODE */ 2454 for ((asoc = LIST_FIRST(&inp->sctp_asoc_free_list)); asoc != NULL; 2455 asoc = nasoc) { 2456 nasoc = LIST_NEXT(asoc, sctp_tcblist); 2457 LIST_REMOVE(asoc, sctp_tcblist); 2458 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, asoc); 2459 SCTP_DECR_ASOC_COUNT(); 2460 } 2461 /* *** END TEMP CODE *** */ 2462 #endif 2463 /* Now lets see about freeing the EP hash table. */ 2464 if (inp->sctp_tcbhash != NULL) { 2465 SCTP_FREE(inp->sctp_tcbhash); 2466 inp->sctp_tcbhash = 0; 2467 } 2468 /* Now we must put the ep memory back into the zone pool */ 2469 SCTP_INP_LOCK_DESTROY(inp); 2470 SCTP_INP_READ_DESTROY(inp); 2471 SCTP_ASOC_CREATE_LOCK_DESTROY(inp); 2472 SCTP_INP_INFO_WUNLOCK(); 2473 2474 SCTP_ITERATOR_UNLOCK(); 2475 2476 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 2477 SCTP_DECR_EP_COUNT(); 2478 2479 splx(s); 2480 } 2481 2482 2483 struct sctp_nets * 2484 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr) 2485 { 2486 struct sctp_nets *net; 2487 2488 /* locate the address */ 2489 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 2490 if (sctp_cmpaddr(addr, (struct sockaddr *)&net->ro._l_addr)) 2491 return (net); 2492 } 2493 return (NULL); 2494 } 2495 2496 2497 /* 2498 * add's a remote endpoint address, done with the INIT/INIT-ACK as well as 2499 * when a ASCONF arrives that adds it. It will also initialize all the cwnd 2500 * stats of stuff. 2501 */ 2502 int 2503 sctp_is_address_on_local_host(struct sockaddr *addr) 2504 { 2505 struct ifnet *ifn; 2506 struct ifaddr *ifa; 2507 2508 TAILQ_FOREACH(ifn, &ifnet, if_list) { 2509 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) { 2510 if (addr->sa_family == ifa->ifa_addr->sa_family) { 2511 /* same family */ 2512 if (addr->sa_family == AF_INET) { 2513 struct sockaddr_in *sin, *sin_c; 2514 2515 sin = (struct sockaddr_in *)addr; 2516 sin_c = (struct sockaddr_in *) 2517 ifa->ifa_addr; 2518 if (sin->sin_addr.s_addr == 2519 sin_c->sin_addr.s_addr) { 2520 /* 2521 * we are on the same 2522 * machine 2523 */ 2524 return (1); 2525 } 2526 } else if (addr->sa_family == AF_INET6) { 2527 struct sockaddr_in6 *sin6, *sin_c6; 2528 2529 sin6 = (struct sockaddr_in6 *)addr; 2530 sin_c6 = (struct sockaddr_in6 *) 2531 ifa->ifa_addr; 2532 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 2533 &sin_c6->sin6_addr)) { 2534 /* 2535 * we are on the same 2536 * machine 2537 */ 2538 return (1); 2539 } 2540 } 2541 } 2542 } 2543 } 2544 return (0); 2545 } 2546 2547 int 2548 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr, 2549 int set_scope, int from) 2550 { 2551 /* 2552 * The following is redundant to the same lines in the 2553 * sctp_aloc_assoc() but is needed since other's call the add 2554 * address function 2555 */ 2556 struct sctp_nets *net, *netfirst; 2557 int addr_inscope; 2558 2559 #ifdef SCTP_DEBUG 2560 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 2561 printf("Adding an address (from:%d) to the peer: ", from); 2562 sctp_print_address(newaddr); 2563 } 2564 #endif 2565 2566 netfirst = sctp_findnet(stcb, newaddr); 2567 if (netfirst) { 2568 /* 2569 * Lie and return ok, we don't want to make the association 2570 * go away for this behavior. It will happen in the TCP 2571 * model in a connected socket. It does not reach the hash 2572 * table until after the association is built so it can't be 2573 * found. Mark as reachable, since the initial creation will 2574 * have been cleared and the NOT_IN_ASSOC flag will have 2575 * been added... and we don't want to end up removing it 2576 * back out. 2577 */ 2578 if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) { 2579 netfirst->dest_state = (SCTP_ADDR_REACHABLE | 2580 SCTP_ADDR_UNCONFIRMED); 2581 } else { 2582 netfirst->dest_state = SCTP_ADDR_REACHABLE; 2583 } 2584 2585 return (0); 2586 } 2587 addr_inscope = 1; 2588 if (newaddr->sa_family == AF_INET) { 2589 struct sockaddr_in *sin; 2590 2591 sin = (struct sockaddr_in *)newaddr; 2592 if (sin->sin_addr.s_addr == 0) { 2593 /* Invalid address */ 2594 return (-1); 2595 } 2596 /* zero out the bzero area */ 2597 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero)); 2598 2599 /* assure len is set */ 2600 sin->sin_len = sizeof(struct sockaddr_in); 2601 if (set_scope) { 2602 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE 2603 stcb->ipv4_local_scope = 1; 2604 #else 2605 if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) { 2606 stcb->asoc.ipv4_local_scope = 1; 2607 } 2608 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */ 2609 2610 if (sctp_is_address_on_local_host(newaddr)) { 2611 stcb->asoc.loopback_scope = 1; 2612 stcb->asoc.ipv4_local_scope = 1; 2613 stcb->asoc.local_scope = 1; 2614 stcb->asoc.site_scope = 1; 2615 } 2616 } else { 2617 if (from == SCTP_ADDR_IS_CONFIRMED) { 2618 /* From connectx */ 2619 if (sctp_is_address_on_local_host(newaddr)) { 2620 stcb->asoc.loopback_scope = 1; 2621 stcb->asoc.ipv4_local_scope = 1; 2622 stcb->asoc.local_scope = 1; 2623 stcb->asoc.site_scope = 1; 2624 } 2625 } 2626 /* Validate the address is in scope */ 2627 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) && 2628 (stcb->asoc.ipv4_local_scope == 0)) { 2629 addr_inscope = 0; 2630 } 2631 } 2632 } else if (newaddr->sa_family == AF_INET6) { 2633 struct sockaddr_in6 *sin6; 2634 2635 sin6 = (struct sockaddr_in6 *)newaddr; 2636 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 2637 /* Invalid address */ 2638 return (-1); 2639 } 2640 /* assure len is set */ 2641 sin6->sin6_len = sizeof(struct sockaddr_in6); 2642 if (set_scope) { 2643 if (sctp_is_address_on_local_host(newaddr)) { 2644 stcb->asoc.loopback_scope = 1; 2645 stcb->asoc.local_scope = 1; 2646 stcb->asoc.ipv4_local_scope = 1; 2647 stcb->asoc.site_scope = 1; 2648 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 2649 /* 2650 * If the new destination is a LINK_LOCAL we 2651 * must have common site scope. Don't set 2652 * the local scope since we may not share 2653 * all links, only loopback can do this. 2654 * Links on the local network would also be 2655 * on our private network for v4 too. 2656 */ 2657 stcb->asoc.ipv4_local_scope = 1; 2658 stcb->asoc.site_scope = 1; 2659 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) { 2660 /* 2661 * If the new destination is SITE_LOCAL then 2662 * we must have site scope in common. 2663 */ 2664 stcb->asoc.site_scope = 1; 2665 } 2666 } else { 2667 if (from == SCTP_ADDR_IS_CONFIRMED) { 2668 /* From connectx so we check for localhost. */ 2669 if (sctp_is_address_on_local_host(newaddr)) { 2670 stcb->asoc.loopback_scope = 1; 2671 stcb->asoc.ipv4_local_scope = 1; 2672 stcb->asoc.local_scope = 1; 2673 stcb->asoc.site_scope = 1; 2674 } 2675 } 2676 /* Validate the address is in scope */ 2677 if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) && 2678 (stcb->asoc.loopback_scope == 0)) { 2679 addr_inscope = 0; 2680 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) && 2681 (stcb->asoc.local_scope == 0)) { 2682 addr_inscope = 0; 2683 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) && 2684 (stcb->asoc.site_scope == 0)) { 2685 addr_inscope = 0; 2686 } 2687 } 2688 } else { 2689 /* not supported family type */ 2690 return (-1); 2691 } 2692 net = (struct sctp_nets *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_net); 2693 if (net == NULL) { 2694 return (-1); 2695 } 2696 SCTP_INCR_RADDR_COUNT(); 2697 bzero(net, sizeof(*net)); 2698 memcpy(&net->ro._l_addr, newaddr, newaddr->sa_len); 2699 if (newaddr->sa_family == AF_INET) { 2700 ((struct sockaddr_in *)&net->ro._l_addr)->sin_port = stcb->rport; 2701 } else if (newaddr->sa_family == AF_INET6) { 2702 ((struct sockaddr_in6 *)&net->ro._l_addr)->sin6_port = stcb->rport; 2703 } 2704 net->addr_is_local = sctp_is_address_on_local_host(newaddr); 2705 net->failure_threshold = stcb->asoc.def_net_failure; 2706 if (addr_inscope == 0) { 2707 net->dest_state = (SCTP_ADDR_REACHABLE | 2708 SCTP_ADDR_OUT_OF_SCOPE); 2709 } else { 2710 if (from == SCTP_ADDR_IS_CONFIRMED) 2711 /* SCTP_ADDR_IS_CONFIRMED is passed by connect_x */ 2712 net->dest_state = SCTP_ADDR_REACHABLE; 2713 else 2714 net->dest_state = SCTP_ADDR_REACHABLE | 2715 SCTP_ADDR_UNCONFIRMED; 2716 } 2717 net->RTO = stcb->asoc.initial_rto; 2718 stcb->asoc.numnets++; 2719 *(&net->ref_count) = 1; 2720 net->tos_flowlabel = 0; 2721 #ifdef AF_INET 2722 if (newaddr->sa_family == AF_INET) 2723 net->tos_flowlabel = stcb->asoc.default_tos; 2724 #endif 2725 #ifdef AF_INET6 2726 if (newaddr->sa_family == AF_INET6) 2727 net->tos_flowlabel = stcb->asoc.default_flowlabel; 2728 #endif 2729 /* Init the timer structure */ 2730 callout_init(&net->rxt_timer.timer, 1); 2731 callout_init(&net->fr_timer.timer, 1); 2732 callout_init(&net->pmtu_timer.timer, 1); 2733 2734 /* Now generate a route for this guy */ 2735 /* KAME hack: embed scopeid */ 2736 if (newaddr->sa_family == AF_INET6) { 2737 struct sockaddr_in6 *sin6; 2738 2739 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 2740 (void)sa6_embedscope(sin6, ip6_use_defzone); 2741 sin6->sin6_scope_id = 0; 2742 } 2743 rtalloc_ign((struct route *)&net->ro, 0UL); 2744 if (newaddr->sa_family == AF_INET6) { 2745 struct sockaddr_in6 *sin6; 2746 2747 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 2748 (void)sa6_recoverscope(sin6); 2749 } 2750 if ((net->ro.ro_rt) && 2751 (net->ro.ro_rt->rt_ifp)) { 2752 net->mtu = net->ro.ro_rt->rt_ifp->if_mtu; 2753 if (from == SCTP_ALLOC_ASOC) { 2754 stcb->asoc.smallest_mtu = net->mtu; 2755 } 2756 /* start things off to match mtu of interface please. */ 2757 net->ro.ro_rt->rt_rmx.rmx_mtu = net->ro.ro_rt->rt_ifp->if_mtu; 2758 } else { 2759 net->mtu = stcb->asoc.smallest_mtu; 2760 } 2761 2762 if (stcb->asoc.smallest_mtu > net->mtu) { 2763 stcb->asoc.smallest_mtu = net->mtu; 2764 } 2765 /* 2766 * We take the max of the burst limit times a MTU or the 2767 * INITIAL_CWND. We then limit this to 4 MTU's of sending. 2768 */ 2769 net->cwnd = min((net->mtu * 4), max((2 * net->mtu), SCTP_INITIAL_CWND)); 2770 2771 /* we always get at LEAST 2 MTU's */ 2772 if (net->cwnd < (2 * net->mtu)) { 2773 net->cwnd = 2 * net->mtu; 2774 } 2775 net->ssthresh = stcb->asoc.peers_rwnd; 2776 2777 #if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING) 2778 sctp_log_cwnd(stcb, net, 0, SCTP_CWND_INITIALIZATION); 2779 #endif 2780 2781 /* 2782 * CMT: CUC algo - set find_pseudo_cumack to TRUE (1) at beginning 2783 * of assoc (2005/06/27, iyengar@cis.udel.edu) 2784 */ 2785 net->find_pseudo_cumack = 1; 2786 net->find_rtx_pseudo_cumack = 1; 2787 net->src_addr_selected = 0; 2788 netfirst = TAILQ_FIRST(&stcb->asoc.nets); 2789 if (net->ro.ro_rt == NULL) { 2790 /* Since we have no route put it at the back */ 2791 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next); 2792 } else if (netfirst == NULL) { 2793 /* We are the first one in the pool. */ 2794 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2795 } else if (netfirst->ro.ro_rt == NULL) { 2796 /* 2797 * First one has NO route. Place this one ahead of the first 2798 * one. 2799 */ 2800 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2801 } else if (net->ro.ro_rt->rt_ifp != netfirst->ro.ro_rt->rt_ifp) { 2802 /* 2803 * This one has a different interface than the one at the 2804 * top of the list. Place it ahead. 2805 */ 2806 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2807 } else { 2808 /* 2809 * Ok we have the same interface as the first one. Move 2810 * forward until we find either a) one with a NULL route... 2811 * insert ahead of that b) one with a different ifp.. insert 2812 * after that. c) end of the list.. insert at the tail. 2813 */ 2814 struct sctp_nets *netlook; 2815 2816 do { 2817 netlook = TAILQ_NEXT(netfirst, sctp_next); 2818 if (netlook == NULL) { 2819 /* End of the list */ 2820 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, 2821 sctp_next); 2822 break; 2823 } else if (netlook->ro.ro_rt == NULL) { 2824 /* next one has NO route */ 2825 TAILQ_INSERT_BEFORE(netfirst, net, sctp_next); 2826 break; 2827 } else if (netlook->ro.ro_rt->rt_ifp != 2828 net->ro.ro_rt->rt_ifp) { 2829 TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook, 2830 net, sctp_next); 2831 break; 2832 } 2833 /* Shift forward */ 2834 netfirst = netlook; 2835 } while (netlook != NULL); 2836 } 2837 2838 /* got to have a primary set */ 2839 if (stcb->asoc.primary_destination == 0) { 2840 stcb->asoc.primary_destination = net; 2841 } else if ((stcb->asoc.primary_destination->ro.ro_rt == NULL) && 2842 (net->ro.ro_rt) && 2843 ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) { 2844 /* No route to current primary adopt new primary */ 2845 stcb->asoc.primary_destination = net; 2846 } 2847 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, 2848 net); 2849 /* Validate primary is first */ 2850 net = TAILQ_FIRST(&stcb->asoc.nets); 2851 if ((net != stcb->asoc.primary_destination) && 2852 (stcb->asoc.primary_destination)) { 2853 /* 2854 * first one on the list is NOT the primary sctp_cmpaddr() 2855 * is much more efficent if the primary is the first on the 2856 * list, make it so. 2857 */ 2858 TAILQ_REMOVE(&stcb->asoc.nets, 2859 stcb->asoc.primary_destination, sctp_next); 2860 TAILQ_INSERT_HEAD(&stcb->asoc.nets, 2861 stcb->asoc.primary_destination, sctp_next); 2862 } 2863 return (0); 2864 } 2865 2866 2867 /* 2868 * allocate an association and add it to the endpoint. The caller must be 2869 * careful to add all additional addresses once they are know right away or 2870 * else the assoc will be may experience a blackout scenario. 2871 */ 2872 struct sctp_tcb * 2873 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr, 2874 int for_a_init, int *error, uint32_t override_tag) 2875 { 2876 struct sctp_tcb *stcb; 2877 struct sctp_association *asoc; 2878 struct sctpasochead *head; 2879 uint16_t rport; 2880 int err; 2881 2882 /* 2883 * Assumption made here: Caller has done a 2884 * sctp_findassociation_ep_addr(ep, addr's); to make sure the 2885 * address does not exist already. 2886 */ 2887 if (sctppcbinfo.ipi_count_asoc >= SCTP_MAX_NUM_OF_ASOC) { 2888 /* Hit max assoc, sorry no more */ 2889 *error = ENOBUFS; 2890 return (NULL); 2891 } 2892 SCTP_INP_RLOCK(inp); 2893 if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) { 2894 /* 2895 * If its in the TCP pool, its NOT allowed to create an 2896 * association. The parent listener needs to call 2897 * sctp_aloc_assoc.. or the one-2-many socket. If a peeled 2898 * off, or connected one does this.. its an error. 2899 */ 2900 SCTP_INP_RUNLOCK(inp); 2901 *error = EINVAL; 2902 return (NULL); 2903 } 2904 #ifdef SCTP_DEBUG 2905 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2906 printf("Allocate an association for peer:"); 2907 if (firstaddr) 2908 sctp_print_address(firstaddr); 2909 else 2910 printf("None\n"); 2911 printf("Port:%d\n", 2912 ntohs(((struct sockaddr_in *)firstaddr)->sin_port)); 2913 } 2914 #endif /* SCTP_DEBUG */ 2915 if (firstaddr->sa_family == AF_INET) { 2916 struct sockaddr_in *sin; 2917 2918 sin = (struct sockaddr_in *)firstaddr; 2919 if ((sin->sin_port == 0) || (sin->sin_addr.s_addr == 0)) { 2920 /* Invalid address */ 2921 SCTP_INP_RUNLOCK(inp); 2922 *error = EINVAL; 2923 return (NULL); 2924 } 2925 rport = sin->sin_port; 2926 } else if (firstaddr->sa_family == AF_INET6) { 2927 struct sockaddr_in6 *sin6; 2928 2929 sin6 = (struct sockaddr_in6 *)firstaddr; 2930 if ((sin6->sin6_port == 0) || 2931 (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) { 2932 /* Invalid address */ 2933 SCTP_INP_RUNLOCK(inp); 2934 *error = EINVAL; 2935 return (NULL); 2936 } 2937 rport = sin6->sin6_port; 2938 } else { 2939 /* not supported family type */ 2940 SCTP_INP_RUNLOCK(inp); 2941 *error = EINVAL; 2942 return (NULL); 2943 } 2944 SCTP_INP_RUNLOCK(inp); 2945 if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) { 2946 /* 2947 * If you have not performed a bind, then we need to do the 2948 * ephemerial bind for you. 2949 */ 2950 if ((err = sctp_inpcb_bind(inp->sctp_socket, 2951 (struct sockaddr *)NULL, 2952 (struct thread *)NULL 2953 ))) { 2954 /* bind error, probably perm */ 2955 *error = err; 2956 return (NULL); 2957 } 2958 } 2959 stcb = (struct sctp_tcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asoc); 2960 if (stcb == NULL) { 2961 /* out of memory? */ 2962 *error = ENOMEM; 2963 return (NULL); 2964 } 2965 SCTP_INCR_ASOC_COUNT(); 2966 2967 bzero(stcb, sizeof(*stcb)); 2968 asoc = &stcb->asoc; 2969 SCTP_TCB_LOCK_INIT(stcb); 2970 SCTP_TCB_SEND_LOCK_INIT(stcb); 2971 /* setup back pointer's */ 2972 stcb->sctp_ep = inp; 2973 stcb->sctp_socket = inp->sctp_socket; 2974 if ((err = sctp_init_asoc(inp, asoc, for_a_init, override_tag))) { 2975 /* failed */ 2976 SCTP_TCB_LOCK_DESTROY(stcb); 2977 SCTP_TCB_SEND_LOCK_DESTROY(stcb); 2978 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2979 SCTP_DECR_ASOC_COUNT(); 2980 *error = err; 2981 return (NULL); 2982 } 2983 /* and the port */ 2984 stcb->rport = rport; 2985 SCTP_INP_INFO_WLOCK(); 2986 SCTP_INP_WLOCK(inp); 2987 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE | SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 2988 /* inpcb freed while alloc going on */ 2989 SCTP_TCB_LOCK_DESTROY(stcb); 2990 SCTP_TCB_SEND_LOCK_DESTROY(stcb); 2991 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2992 SCTP_INP_WUNLOCK(inp); 2993 SCTP_INP_INFO_WUNLOCK(); 2994 SCTP_DECR_ASOC_COUNT(); 2995 *error = EINVAL; 2996 return (NULL); 2997 } 2998 SCTP_TCB_LOCK(stcb); 2999 3000 /* now that my_vtag is set, add it to the hash */ 3001 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, 3002 sctppcbinfo.hashasocmark)]; 3003 /* put it in the bucket in the vtag hash of assoc's for the system */ 3004 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 3005 SCTP_INP_INFO_WUNLOCK(); 3006 3007 if ((err = sctp_add_remote_addr(stcb, firstaddr, SCTP_DO_SETSCOPE, SCTP_ALLOC_ASOC))) { 3008 /* failure.. memory error? */ 3009 if (asoc->strmout) 3010 SCTP_FREE(asoc->strmout); 3011 if (asoc->mapping_array) 3012 SCTP_FREE(asoc->mapping_array); 3013 3014 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 3015 SCTP_DECR_ASOC_COUNT(); 3016 SCTP_TCB_LOCK_DESTROY(stcb); 3017 SCTP_TCB_SEND_LOCK_DESTROY(stcb); 3018 *error = ENOBUFS; 3019 return (NULL); 3020 } 3021 /* Init all the timers */ 3022 callout_init(&asoc->hb_timer.timer, 1); 3023 callout_init(&asoc->dack_timer.timer, 1); 3024 callout_init(&asoc->asconf_timer.timer, 1); 3025 callout_init(&asoc->strreset_timer.timer, 1); 3026 callout_init(&asoc->shut_guard_timer.timer, 1); 3027 callout_init(&asoc->autoclose_timer.timer, 1); 3028 callout_init(&asoc->delayed_event_timer.timer, 1); 3029 LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist); 3030 /* now file the port under the hash as well */ 3031 if (inp->sctp_tcbhash != NULL) { 3032 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport, 3033 inp->sctp_hashmark)]; 3034 LIST_INSERT_HEAD(head, stcb, sctp_tcbhash); 3035 } 3036 SCTP_INP_WUNLOCK(inp); 3037 #ifdef SCTP_DEBUG 3038 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 3039 printf("Association %p now allocated\n", stcb); 3040 } 3041 #endif 3042 return (stcb); 3043 } 3044 3045 3046 void 3047 sctp_remove_net(struct sctp_tcb *stcb, struct sctp_nets *net) 3048 { 3049 struct sctp_association *asoc; 3050 3051 asoc = &stcb->asoc; 3052 asoc->numnets--; 3053 TAILQ_REMOVE(&asoc->nets, net, sctp_next); 3054 sctp_free_remote_addr(net); 3055 if (net == asoc->primary_destination) { 3056 /* Reset primary */ 3057 struct sctp_nets *lnet; 3058 3059 lnet = TAILQ_FIRST(&asoc->nets); 3060 /* Try to find a confirmed primary */ 3061 asoc->primary_destination = sctp_find_alternate_net(stcb, lnet, 3062 0); 3063 } 3064 if (net == asoc->last_data_chunk_from) { 3065 /* Reset primary */ 3066 asoc->last_data_chunk_from = TAILQ_FIRST(&asoc->nets); 3067 } 3068 if (net == asoc->last_control_chunk_from) { 3069 /* Clear net */ 3070 asoc->last_control_chunk_from = NULL; 3071 } 3072 /* if (net == asoc->asconf_last_sent_to) {*/ 3073 /* Reset primary */ 3074 /* asoc->asconf_last_sent_to = TAILQ_FIRST(&asoc->nets);*/ 3075 /* }*/ 3076 } 3077 3078 /* 3079 * remove a remote endpoint address from an association, it will fail if the 3080 * address does not exist. 3081 */ 3082 int 3083 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr) 3084 { 3085 /* 3086 * Here we need to remove a remote address. This is quite simple, we 3087 * first find it in the list of address for the association 3088 * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE 3089 * on that item. Note we do not allow it to be removed if there are 3090 * no other addresses. 3091 */ 3092 struct sctp_association *asoc; 3093 struct sctp_nets *net, *net_tmp; 3094 3095 asoc = &stcb->asoc; 3096 3097 /* locate the address */ 3098 for (net = TAILQ_FIRST(&asoc->nets); net != NULL; net = net_tmp) { 3099 net_tmp = TAILQ_NEXT(net, sctp_next); 3100 if (net->ro._l_addr.sa.sa_family != remaddr->sa_family) { 3101 continue; 3102 } 3103 if (sctp_cmpaddr((struct sockaddr *)&net->ro._l_addr, 3104 remaddr)) { 3105 /* we found the guy */ 3106 if (asoc->numnets < 2) { 3107 /* Must have at LEAST two remote addresses */ 3108 return (-1); 3109 } else { 3110 sctp_remove_net(stcb, net); 3111 return (0); 3112 } 3113 } 3114 } 3115 /* not found. */ 3116 return (-2); 3117 } 3118 3119 3120 static void 3121 sctp_add_vtag_to_timewait(struct sctp_inpcb *inp, uint32_t tag) 3122 { 3123 struct sctpvtaghead *chain; 3124 struct sctp_tagblock *twait_block; 3125 struct timeval now; 3126 int set, i; 3127 3128 SCTP_GETTIME_TIMEVAL(&now); 3129 chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)]; 3130 set = 0; 3131 if (!LIST_EMPTY(chain)) { 3132 /* Block(s) present, lets find space, and expire on the fly */ 3133 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) { 3134 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) { 3135 if ((twait_block->vtag_block[i].v_tag == 0) && 3136 !set) { 3137 twait_block->vtag_block[i].tv_sec_at_expire = 3138 now.tv_sec + SCTP_TIME_WAIT; 3139 twait_block->vtag_block[i].v_tag = tag; 3140 set = 1; 3141 } else if ((twait_block->vtag_block[i].v_tag) && 3142 ((long)twait_block->vtag_block[i].tv_sec_at_expire > 3143 now.tv_sec)) { 3144 /* Audit expires this guy */ 3145 twait_block->vtag_block[i].tv_sec_at_expire = 0; 3146 twait_block->vtag_block[i].v_tag = 0; 3147 if (set == 0) { 3148 /* Reuse it for my new tag */ 3149 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + SCTP_TIME_WAIT; 3150 twait_block->vtag_block[0].v_tag = tag; 3151 set = 1; 3152 } 3153 } 3154 } 3155 if (set) { 3156 /* 3157 * We only do up to the block where we can 3158 * place our tag for audits 3159 */ 3160 break; 3161 } 3162 } 3163 } 3164 /* Need to add a new block to chain */ 3165 if (!set) { 3166 SCTP_MALLOC(twait_block, struct sctp_tagblock *, 3167 sizeof(struct sctp_tagblock), "TimeWait"); 3168 if (twait_block == NULL) { 3169 return; 3170 } 3171 memset(twait_block, 0, sizeof(struct sctp_timewait)); 3172 LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock); 3173 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + 3174 SCTP_TIME_WAIT; 3175 twait_block->vtag_block[0].v_tag = tag; 3176 } 3177 } 3178 3179 3180 static void 3181 sctp_iterator_asoc_being_freed(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 3182 { 3183 struct sctp_iterator *it; 3184 3185 /* 3186 * Unlock the tcb lock we do this so we avoid a dead lock scenario 3187 * where the iterator is waiting on the TCB lock and the TCB lock is 3188 * waiting on the iterator lock. 3189 */ 3190 it = stcb->asoc.stcb_starting_point_for_iterator; 3191 if (it == NULL) { 3192 return; 3193 } 3194 if (it->inp != stcb->sctp_ep) { 3195 /* hmm, focused on the wrong one? */ 3196 return; 3197 } 3198 if (it->stcb != stcb) { 3199 return; 3200 } 3201 it->stcb = LIST_NEXT(stcb, sctp_tcblist); 3202 if (it->stcb == NULL) { 3203 /* done with all asoc's in this assoc */ 3204 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 3205 it->inp = NULL; 3206 } else { 3207 it->inp = LIST_NEXT(inp, sctp_list); 3208 } 3209 } 3210 } 3211 3212 /* 3213 * Free the association after un-hashing the remote port. 3214 */ 3215 int 3216 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfree, int from_location) 3217 { 3218 int i; 3219 struct sctp_association *asoc; 3220 struct sctp_nets *net, *prev; 3221 struct sctp_laddr *laddr; 3222 struct sctp_tmit_chunk *chk; 3223 struct sctp_asconf_addr *aparam; 3224 struct sctp_stream_reset_list *liste; 3225 struct sctp_queued_to_read *sq; 3226 struct sctp_stream_queue_pending *sp; 3227 sctp_sharedkey_t *shared_key; 3228 struct socket *so; 3229 int ccnt = 0; 3230 int s, cnt = 0; 3231 3232 /* first, lets purge the entry from the hash table. */ 3233 s = splnet(); 3234 3235 #ifdef SCTP_LOG_CLOSING 3236 sctp_log_closing(inp, stcb, 6); 3237 #endif 3238 if (stcb->asoc.state == 0) { 3239 #ifdef SCTP_LOG_CLOSING 3240 sctp_log_closing(inp, NULL, 7); 3241 #endif 3242 splx(s); 3243 /* there is no asoc, really TSNH :-0 */ 3244 return (1); 3245 } 3246 /* TEMP CODE */ 3247 if (stcb->freed_from_where == 0) { 3248 /* Only record the first place free happened from */ 3249 stcb->freed_from_where = from_location; 3250 } 3251 /* TEMP CODE */ 3252 3253 asoc = &stcb->asoc; 3254 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 3255 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) 3256 /* nothing around */ 3257 so = NULL; 3258 else 3259 so = inp->sctp_socket; 3260 3261 /* 3262 * We used timer based freeing if a reader or writer is in the way. 3263 * So we first check if we are actually being called from a timer, 3264 * if so we abort early if a reader or writer is still in the way. 3265 */ 3266 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) && 3267 (from_inpcbfree == SCTP_NORMAL_PROC)) { 3268 /* 3269 * is it the timer driving us? if so are the reader/writers 3270 * gone? 3271 */ 3272 if (stcb->asoc.refcnt) { 3273 /* nope, reader or writer in the way */ 3274 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL); 3275 /* no asoc destroyed */ 3276 SCTP_TCB_UNLOCK(stcb); 3277 splx(s); 3278 #ifdef SCTP_LOG_CLOSING 3279 sctp_log_closing(inp, stcb, 8); 3280 #endif 3281 return (0); 3282 } 3283 } 3284 /* now clean up any other timers */ 3285 callout_stop(&asoc->hb_timer.timer); 3286 callout_stop(&asoc->dack_timer.timer); 3287 callout_stop(&asoc->strreset_timer.timer); 3288 callout_stop(&asoc->asconf_timer.timer); 3289 callout_stop(&asoc->autoclose_timer.timer); 3290 callout_stop(&asoc->shut_guard_timer.timer); 3291 callout_stop(&asoc->delayed_event_timer.timer); 3292 3293 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3294 callout_stop(&net->fr_timer.timer); 3295 callout_stop(&net->rxt_timer.timer); 3296 callout_stop(&net->pmtu_timer.timer); 3297 } 3298 /* Now the read queue needs to be cleaned up (only once) */ 3299 cnt = 0; 3300 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0) { 3301 SCTP_INP_READ_LOCK(inp); 3302 TAILQ_FOREACH(sq, &inp->read_queue, next) { 3303 if (sq->stcb == stcb) { 3304 sq->do_not_ref_stcb = 1; 3305 sq->sinfo_cumtsn = stcb->asoc.cumulative_tsn; 3306 /* 3307 * If there is no end, there never will be 3308 * now. 3309 */ 3310 if (sq->end_added == 0) { 3311 /* Held for PD-API clear that. */ 3312 sq->pdapi_aborted = 1; 3313 sq->held_length = 0; 3314 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PDAPIEVNT)) { 3315 /* 3316 * Need to add a PD-API 3317 * aborted indication. 3318 * Setting the control_pdapi 3319 * assures that it will be 3320 * added right after this 3321 * msg. 3322 */ 3323 stcb->asoc.control_pdapi = sq; 3324 sctp_notify_partial_delivery_indication(stcb, 3325 SCTP_PARTIAL_DELIVERY_ABORTED, 1); 3326 stcb->asoc.control_pdapi = NULL; 3327 } 3328 } 3329 /* Add an end to wake them */ 3330 sq->end_added = 1; 3331 cnt++; 3332 } 3333 } 3334 SCTP_INP_READ_UNLOCK(inp); 3335 if (stcb->block_entry) { 3336 cnt++; 3337 stcb->block_entry->error = ECONNRESET; 3338 stcb->block_entry = NULL; 3339 } 3340 } 3341 stcb->asoc.state |= SCTP_STATE_ABOUT_TO_BE_FREED; 3342 if ((from_inpcbfree != SCTP_PCBFREE_FORCE) && (stcb->asoc.refcnt)) { 3343 /* 3344 * reader or writer in the way, we have hopefully given him 3345 * something to chew on above. 3346 */ 3347 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL); 3348 SCTP_TCB_UNLOCK(stcb); 3349 if (so) { 3350 SCTP_INP_RLOCK(inp); 3351 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 3352 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) 3353 /* nothing around */ 3354 so = NULL; 3355 if (so) { 3356 /* Wake any reader/writers */ 3357 sctp_sorwakeup(inp, so); 3358 sctp_sowwakeup(inp, so); 3359 } 3360 SCTP_INP_RUNLOCK(inp); 3361 3362 } 3363 splx(s); 3364 #ifdef SCTP_LOG_CLOSING 3365 sctp_log_closing(inp, stcb, 9); 3366 #endif 3367 /* no asoc destroyed */ 3368 return (0); 3369 } 3370 #ifdef SCTP_LOG_CLOSING 3371 sctp_log_closing(inp, stcb, 10); 3372 #endif 3373 /* 3374 * When I reach here, no others want to kill the assoc yet.. and I 3375 * own the lock. Now its possible an abort comes in when I do the 3376 * lock exchange below to grab all the locks to do the final take 3377 * out. to prevent this we increment the count, which will start a 3378 * timer and blow out above thus assuring us that we hold exclusive 3379 * killing of the asoc. Note that after getting back the TCB lock we 3380 * will go ahead and increment the counter back up and stop any 3381 * timer a passing stranger may have started :-S 3382 */ 3383 if (from_inpcbfree == SCTP_NORMAL_PROC) { 3384 atomic_add_int(&stcb->asoc.refcnt, 1); 3385 3386 SCTP_TCB_UNLOCK(stcb); 3387 3388 SCTP_ITERATOR_LOCK(); 3389 SCTP_INP_INFO_WLOCK(); 3390 SCTP_INP_WLOCK(inp); 3391 SCTP_TCB_LOCK(stcb); 3392 } 3393 /* Double check the GONE flag */ 3394 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 3395 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) 3396 /* nothing around */ 3397 so = NULL; 3398 3399 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 3400 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 3401 /* 3402 * For TCP type we need special handling when we are 3403 * connected. We also include the peel'ed off ones to. 3404 */ 3405 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 3406 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED; 3407 inp->sctp_flags |= SCTP_PCB_FLAGS_WAS_CONNECTED; 3408 if (so) { 3409 SOCK_LOCK(so); 3410 if (so->so_rcv.sb_cc == 0) { 3411 so->so_state &= ~(SS_ISCONNECTING | 3412 SS_ISDISCONNECTING | 3413 SS_ISCONFIRMING | 3414 SS_ISCONNECTED); 3415 } 3416 SOCK_UNLOCK(so); 3417 sctp_sowwakeup(inp, so); 3418 sctp_sorwakeup(inp, so); 3419 wakeup(&so->so_timeo); 3420 } 3421 } 3422 } 3423 /* Stop any timer someone may have started */ 3424 callout_stop(&asoc->strreset_timer.timer); 3425 /* 3426 * Make it invalid too, that way if its about to run it will abort 3427 * and return. 3428 */ 3429 asoc->strreset_timer.type = SCTP_TIMER_TYPE_NONE; 3430 sctp_iterator_asoc_being_freed(inp, stcb); 3431 /* re-increment the lock */ 3432 if (from_inpcbfree == SCTP_NORMAL_PROC) { 3433 atomic_add_int(&stcb->asoc.refcnt, -1); 3434 } 3435 /* now restop the timers to be sure - this is paranoia at is finest! */ 3436 callout_stop(&asoc->hb_timer.timer); 3437 callout_stop(&asoc->dack_timer.timer); 3438 callout_stop(&asoc->strreset_timer.timer); 3439 callout_stop(&asoc->asconf_timer.timer); 3440 callout_stop(&asoc->shut_guard_timer.timer); 3441 callout_stop(&asoc->autoclose_timer.timer); 3442 callout_stop(&asoc->delayed_event_timer.timer); 3443 3444 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3445 callout_stop(&net->fr_timer.timer); 3446 callout_stop(&net->rxt_timer.timer); 3447 callout_stop(&net->pmtu_timer.timer); 3448 } 3449 asoc->state = 0; 3450 if (inp->sctp_tcbhash) { 3451 LIST_REMOVE(stcb, sctp_tcbhash); 3452 } 3453 if (stcb->asoc.in_restart_hash) { 3454 LIST_REMOVE(stcb, sctp_tcbrestarhash); 3455 } 3456 /* Now lets remove it from the list of ALL associations in the EP */ 3457 LIST_REMOVE(stcb, sctp_tcblist); 3458 if (from_inpcbfree == SCTP_NORMAL_PROC) { 3459 SCTP_INP_INCR_REF(inp); 3460 SCTP_INP_WUNLOCK(inp); 3461 SCTP_ITERATOR_UNLOCK(); 3462 } 3463 /* pull from vtag hash */ 3464 LIST_REMOVE(stcb, sctp_asocs); 3465 sctp_add_vtag_to_timewait(inp, asoc->my_vtag); 3466 3467 prev = NULL; 3468 /* 3469 * The chunk lists and such SHOULD be empty but we check them just 3470 * in case. 3471 */ 3472 /* anything on the wheel needs to be removed */ 3473 for (i = 0; i < asoc->streamoutcnt; i++) { 3474 struct sctp_stream_out *outs; 3475 3476 outs = &asoc->strmout[i]; 3477 /* now clean up any chunks here */ 3478 sp = TAILQ_FIRST(&outs->outqueue); 3479 while (sp) { 3480 TAILQ_REMOVE(&outs->outqueue, sp, next); 3481 if (sp->data) { 3482 sctp_m_freem(sp->data); 3483 sp->data = NULL; 3484 sp->tail_mbuf = NULL; 3485 } 3486 sctp_free_remote_addr(sp->net); 3487 sctp_free_spbufspace(stcb, asoc, sp); 3488 /* Free the zone stuff */ 3489 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_strmoq, sp); 3490 SCTP_DECR_STRMOQ_COUNT(); 3491 sp = TAILQ_FIRST(&outs->outqueue); 3492 } 3493 } 3494 3495 while ((sp = TAILQ_FIRST(&asoc->free_strmoq)) != NULL) { 3496 TAILQ_REMOVE(&asoc->free_strmoq, sp, next); 3497 if (sp->data) { 3498 sctp_m_freem(sp->data); 3499 sp->data = NULL; 3500 sp->tail_mbuf = NULL; 3501 } 3502 /* Free the zone stuff */ 3503 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_strmoq, sp); 3504 SCTP_DECR_STRMOQ_COUNT(); 3505 atomic_add_int(&sctppcbinfo.ipi_free_strmoq, -1); 3506 } 3507 3508 while ((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) { 3509 TAILQ_REMOVE(&asoc->resetHead, liste, next_resp); 3510 SCTP_FREE(liste); 3511 } 3512 3513 sq = TAILQ_FIRST(&asoc->pending_reply_queue); 3514 while (sq) { 3515 TAILQ_REMOVE(&asoc->pending_reply_queue, sq, next); 3516 if (sq->data) { 3517 sctp_m_freem(sq->data); 3518 sq->data = NULL; 3519 } 3520 sctp_free_remote_addr(sq->whoFrom); 3521 sq->whoFrom = NULL; 3522 sq->stcb = NULL; 3523 /* Free the ctl entry */ 3524 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, sq); 3525 SCTP_DECR_READQ_COUNT(); 3526 sq = TAILQ_FIRST(&asoc->pending_reply_queue); 3527 } 3528 3529 chk = TAILQ_FIRST(&asoc->free_chunks); 3530 while (chk) { 3531 TAILQ_REMOVE(&asoc->free_chunks, chk, sctp_next); 3532 if (chk->data) { 3533 sctp_m_freem(chk->data); 3534 chk->data = NULL; 3535 } 3536 ccnt++; 3537 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3538 SCTP_DECR_CHK_COUNT(); 3539 atomic_subtract_int(&sctppcbinfo.ipi_free_chunks, 1); 3540 asoc->free_chunk_cnt--; 3541 chk = TAILQ_FIRST(&asoc->free_chunks); 3542 } 3543 /* pending send queue SHOULD be empty */ 3544 if (!TAILQ_EMPTY(&asoc->send_queue)) { 3545 chk = TAILQ_FIRST(&asoc->send_queue); 3546 while (chk) { 3547 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next); 3548 if (chk->data) { 3549 sctp_m_freem(chk->data); 3550 chk->data = NULL; 3551 } 3552 ccnt++; 3553 sctp_free_remote_addr(chk->whoTo); 3554 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3555 SCTP_DECR_CHK_COUNT(); 3556 chk = TAILQ_FIRST(&asoc->send_queue); 3557 } 3558 } 3559 /* 3560 if(ccnt) { 3561 printf("Freed %d from send_queue\n", ccnt); 3562 ccnt = 0; 3563 } 3564 */ 3565 /* sent queue SHOULD be empty */ 3566 if (!TAILQ_EMPTY(&asoc->sent_queue)) { 3567 chk = TAILQ_FIRST(&asoc->sent_queue); 3568 while (chk) { 3569 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next); 3570 if (chk->data) { 3571 sctp_m_freem(chk->data); 3572 chk->data = NULL; 3573 } 3574 ccnt++; 3575 sctp_free_remote_addr(chk->whoTo); 3576 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3577 SCTP_DECR_CHK_COUNT(); 3578 chk = TAILQ_FIRST(&asoc->sent_queue); 3579 } 3580 } 3581 /* 3582 if(ccnt) { 3583 printf("Freed %d from sent_queue\n", ccnt); 3584 ccnt = 0; 3585 } 3586 */ 3587 /* control queue MAY not be empty */ 3588 if (!TAILQ_EMPTY(&asoc->control_send_queue)) { 3589 chk = TAILQ_FIRST(&asoc->control_send_queue); 3590 while (chk) { 3591 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 3592 if (chk->data) { 3593 sctp_m_freem(chk->data); 3594 chk->data = NULL; 3595 } 3596 ccnt++; 3597 sctp_free_remote_addr(chk->whoTo); 3598 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3599 SCTP_DECR_CHK_COUNT(); 3600 chk = TAILQ_FIRST(&asoc->control_send_queue); 3601 } 3602 } 3603 /* 3604 if(ccnt) { 3605 printf("Freed %d from ctrl_queue\n", ccnt); 3606 ccnt = 0; 3607 } 3608 */ 3609 if (!TAILQ_EMPTY(&asoc->reasmqueue)) { 3610 chk = TAILQ_FIRST(&asoc->reasmqueue); 3611 while (chk) { 3612 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next); 3613 if (chk->data) { 3614 sctp_m_freem(chk->data); 3615 chk->data = NULL; 3616 } 3617 sctp_free_remote_addr(chk->whoTo); 3618 ccnt++; 3619 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3620 SCTP_DECR_CHK_COUNT(); 3621 chk = TAILQ_FIRST(&asoc->reasmqueue); 3622 } 3623 } 3624 /* 3625 if(ccnt) { 3626 printf("Freed %d from reasm_queue\n", ccnt); 3627 ccnt = 0; 3628 } 3629 */ 3630 if (asoc->mapping_array) { 3631 SCTP_FREE(asoc->mapping_array); 3632 asoc->mapping_array = NULL; 3633 } 3634 /* the stream outs */ 3635 if (asoc->strmout) { 3636 SCTP_FREE(asoc->strmout); 3637 asoc->strmout = NULL; 3638 } 3639 asoc->streamoutcnt = 0; 3640 if (asoc->strmin) { 3641 struct sctp_queued_to_read *ctl; 3642 int i; 3643 3644 for (i = 0; i < asoc->streamincnt; i++) { 3645 if (!TAILQ_EMPTY(&asoc->strmin[i].inqueue)) { 3646 /* We have somethings on the streamin queue */ 3647 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 3648 while (ctl) { 3649 TAILQ_REMOVE(&asoc->strmin[i].inqueue, 3650 ctl, next); 3651 sctp_free_remote_addr(ctl->whoFrom); 3652 if (ctl->data) { 3653 sctp_m_freem(ctl->data); 3654 ctl->data = NULL; 3655 } 3656 /* 3657 * We don't free the address here 3658 * since all the net's were freed 3659 * above. 3660 */ 3661 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, ctl); 3662 SCTP_DECR_READQ_COUNT(); 3663 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 3664 } 3665 } 3666 } 3667 SCTP_FREE(asoc->strmin); 3668 asoc->strmin = NULL; 3669 } 3670 asoc->streamincnt = 0; 3671 while (!TAILQ_EMPTY(&asoc->nets)) { 3672 net = TAILQ_FIRST(&asoc->nets); 3673 /* pull from list */ 3674 if ((sctppcbinfo.ipi_count_raddr == 0) || (prev == net)) { 3675 #ifdef INVARIANTS 3676 panic("no net's left alloc'ed, or list points to itself"); 3677 #endif 3678 break; 3679 } 3680 prev = net; 3681 TAILQ_REMOVE(&asoc->nets, net, sctp_next); 3682 sctp_free_remote_addr(net); 3683 } 3684 3685 /* local addresses, if any */ 3686 while (!LIST_EMPTY(&asoc->sctp_local_addr_list)) { 3687 laddr = LIST_FIRST(&asoc->sctp_local_addr_list); 3688 LIST_REMOVE(laddr, sctp_nxt_addr); 3689 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 3690 SCTP_DECR_LADDR_COUNT(); 3691 } 3692 /* pending asconf (address) parameters */ 3693 while (!TAILQ_EMPTY(&asoc->asconf_queue)) { 3694 aparam = TAILQ_FIRST(&asoc->asconf_queue); 3695 TAILQ_REMOVE(&asoc->asconf_queue, aparam, next); 3696 SCTP_FREE(aparam); 3697 } 3698 if (asoc->last_asconf_ack_sent != NULL) { 3699 sctp_m_freem(asoc->last_asconf_ack_sent); 3700 asoc->last_asconf_ack_sent = NULL; 3701 } 3702 /* clean up auth stuff */ 3703 if (asoc->local_hmacs) 3704 sctp_free_hmaclist(asoc->local_hmacs); 3705 if (asoc->peer_hmacs) 3706 sctp_free_hmaclist(asoc->peer_hmacs); 3707 3708 if (asoc->local_auth_chunks) 3709 sctp_free_chunklist(asoc->local_auth_chunks); 3710 if (asoc->peer_auth_chunks) 3711 sctp_free_chunklist(asoc->peer_auth_chunks); 3712 3713 sctp_free_authinfo(&asoc->authinfo); 3714 3715 shared_key = LIST_FIRST(&asoc->shared_keys); 3716 while (shared_key) { 3717 LIST_REMOVE(shared_key, next); 3718 sctp_free_sharedkey(shared_key); 3719 shared_key = LIST_FIRST(&asoc->shared_keys); 3720 } 3721 3722 /* Insert new items here :> */ 3723 3724 /* Get rid of LOCK */ 3725 SCTP_TCB_LOCK_DESTROY(stcb); 3726 SCTP_TCB_SEND_LOCK_DESTROY(stcb); 3727 if (from_inpcbfree == SCTP_NORMAL_PROC) { 3728 SCTP_INP_INFO_WUNLOCK(); 3729 SCTP_INP_RLOCK(inp); 3730 } 3731 #ifdef SCTP_TRACK_FREED_ASOCS 3732 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3733 /* now clean up the tasoc itself */ 3734 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 3735 SCTP_DECR_ASOC_COUNT(); 3736 } else { 3737 LIST_INSERT_HEAD(&inp->sctp_asoc_free_list, stcb, sctp_tcblist); 3738 } 3739 #else 3740 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 3741 SCTP_DECR_ASOC_COUNT(); 3742 #endif 3743 if (from_inpcbfree == SCTP_NORMAL_PROC) { 3744 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3745 /* 3746 * If its NOT the inp_free calling us AND sctp_close 3747 * as been called, we call back... 3748 */ 3749 SCTP_INP_RUNLOCK(inp); 3750 /* 3751 * This will start the kill timer (if we are the 3752 * lastone) since we hold an increment yet. But this 3753 * is the only safe way to do this since otherwise 3754 * if the socket closes at the same time we are here 3755 * we might collide in the cleanup. 3756 */ 3757 sctp_inpcb_free(inp, 0, 0); 3758 SCTP_INP_DECR_REF(inp); 3759 goto out_of; 3760 } else { 3761 /* The socket is still open. */ 3762 SCTP_INP_DECR_REF(inp); 3763 } 3764 } 3765 if (from_inpcbfree == SCTP_NORMAL_PROC) { 3766 SCTP_INP_RUNLOCK(inp); 3767 } 3768 out_of: 3769 splx(s); 3770 /* destroyed the asoc */ 3771 #ifdef SCTP_LOG_CLOSING 3772 sctp_log_closing(inp, NULL, 11); 3773 #endif 3774 return (1); 3775 } 3776 3777 3778 3779 /* 3780 * determine if a destination is "reachable" based upon the addresses bound 3781 * to the current endpoint (e.g. only v4 or v6 currently bound) 3782 */ 3783 /* 3784 * FIX: if we allow assoc-level bindx(), then this needs to be fixed to use 3785 * assoc level v4/v6 flags, as the assoc *may* not have the same address 3786 * types bound as its endpoint 3787 */ 3788 int 3789 sctp_destination_is_reachable(struct sctp_tcb *stcb, struct sockaddr *destaddr) 3790 { 3791 struct sctp_inpcb *inp; 3792 int answer; 3793 3794 /* 3795 * No locks here, the TCB, in all cases is already locked and an 3796 * assoc is up. There is either a INP lock by the caller applied (in 3797 * asconf case when deleting an address) or NOT in the HB case, 3798 * however if HB then the INP increment is up and the INP will not 3799 * be removed (on top of the fact that we have a TCB lock). So we 3800 * only want to read the sctp_flags, which is either bound-all or 3801 * not.. no protection needed since once an assoc is up you can't be 3802 * changing your binding. 3803 */ 3804 inp = stcb->sctp_ep; 3805 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3806 /* if bound all, destination is not restricted */ 3807 /* 3808 * RRS: Question during lock work: Is this correct? If you 3809 * are bound-all you still might need to obey the V4--V6 3810 * flags??? IMO this bound-all stuff needs to be removed! 3811 */ 3812 return (1); 3813 } 3814 /* NOTE: all "scope" checks are done when local addresses are added */ 3815 if (destaddr->sa_family == AF_INET6) { 3816 answer = inp->ip_inp.inp.inp_vflag & INP_IPV6; 3817 } else if (destaddr->sa_family == AF_INET) { 3818 answer = inp->ip_inp.inp.inp_vflag & INP_IPV4; 3819 } else { 3820 /* invalid family, so it's unreachable */ 3821 answer = 0; 3822 } 3823 return (answer); 3824 } 3825 3826 /* 3827 * update the inp_vflags on an endpoint 3828 */ 3829 static void 3830 sctp_update_ep_vflag(struct sctp_inpcb *inp) 3831 { 3832 struct sctp_laddr *laddr; 3833 3834 /* first clear the flag */ 3835 inp->ip_inp.inp.inp_vflag = 0; 3836 /* set the flag based on addresses on the ep list */ 3837 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3838 if (laddr->ifa == NULL) { 3839 #ifdef SCTP_DEBUG 3840 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 3841 printf("An ounce of prevention is worth a pound of cure\n"); 3842 } 3843 #endif /* SCTP_DEBUG */ 3844 continue; 3845 } 3846 if (laddr->ifa->ifa_addr) { 3847 continue; 3848 } 3849 if (laddr->ifa->ifa_addr->sa_family == AF_INET6) { 3850 inp->ip_inp.inp.inp_vflag |= INP_IPV6; 3851 } else if (laddr->ifa->ifa_addr->sa_family == AF_INET) { 3852 inp->ip_inp.inp.inp_vflag |= INP_IPV4; 3853 } 3854 } 3855 } 3856 3857 /* 3858 * Add the address to the endpoint local address list There is nothing to be 3859 * done if we are bound to all addresses 3860 */ 3861 int 3862 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa) 3863 { 3864 struct sctp_laddr *laddr; 3865 int fnd, error; 3866 3867 fnd = 0; 3868 3869 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3870 /* You are already bound to all. You have it already */ 3871 return (0); 3872 } 3873 if (ifa->ifa_addr->sa_family == AF_INET6) { 3874 struct in6_ifaddr *ifa6; 3875 3876 ifa6 = (struct in6_ifaddr *)ifa; 3877 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 3878 IN6_IFF_DEPRECATED | IN6_IFF_ANYCAST | IN6_IFF_NOTREADY)) 3879 /* Can't bind a non-existent addr. */ 3880 return (-1); 3881 } 3882 /* first, is it already present? */ 3883 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3884 if (laddr->ifa == ifa) { 3885 fnd = 1; 3886 break; 3887 } 3888 } 3889 3890 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd == 0)) { 3891 /* Not bound to all */ 3892 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa); 3893 if (error != 0) 3894 return (error); 3895 inp->laddr_count++; 3896 /* update inp_vflag flags */ 3897 if (ifa->ifa_addr->sa_family == AF_INET6) { 3898 inp->ip_inp.inp.inp_vflag |= INP_IPV6; 3899 } else if (ifa->ifa_addr->sa_family == AF_INET) { 3900 inp->ip_inp.inp.inp_vflag |= INP_IPV4; 3901 } 3902 } 3903 return (0); 3904 } 3905 3906 3907 /* 3908 * select a new (hopefully reachable) destination net (should only be used 3909 * when we deleted an ep addr that is the only usable source address to reach 3910 * the destination net) 3911 */ 3912 static void 3913 sctp_select_primary_destination(struct sctp_tcb *stcb) 3914 { 3915 struct sctp_nets *net; 3916 3917 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 3918 /* for now, we'll just pick the first reachable one we find */ 3919 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) 3920 continue; 3921 if (sctp_destination_is_reachable(stcb, 3922 (struct sockaddr *)&net->ro._l_addr)) { 3923 /* found a reachable destination */ 3924 stcb->asoc.primary_destination = net; 3925 } 3926 } 3927 /* I can't there from here! ...we're gonna die shortly... */ 3928 } 3929 3930 3931 /* 3932 * Delete the address from the endpoint local address list There is nothing 3933 * to be done if we are bound to all addresses 3934 */ 3935 int 3936 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa) 3937 { 3938 struct sctp_laddr *laddr; 3939 int fnd; 3940 3941 fnd = 0; 3942 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3943 /* You are already bound to all. You have it already */ 3944 return (EINVAL); 3945 } 3946 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3947 if (laddr->ifa == ifa) { 3948 fnd = 1; 3949 break; 3950 } 3951 } 3952 if (fnd && (inp->laddr_count < 2)) { 3953 /* can't delete unless there are at LEAST 2 addresses */ 3954 return (-1); 3955 } 3956 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd)) { 3957 /* 3958 * clean up any use of this address go through our 3959 * associations and clear any last_used_address that match 3960 * this one for each assoc, see if a new primary_destination 3961 * is needed 3962 */ 3963 struct sctp_tcb *stcb; 3964 3965 /* clean up "next_addr_touse" */ 3966 if (inp->next_addr_touse == laddr) 3967 /* delete this address */ 3968 inp->next_addr_touse = NULL; 3969 3970 /* clean up "last_used_address" */ 3971 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 3972 if (stcb->asoc.last_used_address == laddr) 3973 /* delete this address */ 3974 stcb->asoc.last_used_address = NULL; 3975 } /* for each tcb */ 3976 3977 /* remove it from the ep list */ 3978 sctp_remove_laddr(laddr); 3979 inp->laddr_count--; 3980 /* update inp_vflag flags */ 3981 sctp_update_ep_vflag(inp); 3982 /* select a new primary destination if needed */ 3983 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 3984 /* 3985 * presume caller (sctp_asconf.c) already owns INP 3986 * lock 3987 */ 3988 SCTP_TCB_LOCK(stcb); 3989 if (sctp_destination_is_reachable(stcb, 3990 (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr) == 0) { 3991 sctp_select_primary_destination(stcb); 3992 } 3993 SCTP_TCB_UNLOCK(stcb); 3994 } /* for each tcb */ 3995 } 3996 return (0); 3997 } 3998 3999 /* 4000 * Add the addr to the TCB local address list For the BOUNDALL or dynamic 4001 * case, this is a "pending" address list (eg. addresses waiting for an 4002 * ASCONF-ACK response) For the subset binding, static case, this is a 4003 * "valid" address list 4004 */ 4005 int 4006 sctp_add_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa) 4007 { 4008 struct sctp_inpcb *inp; 4009 struct sctp_laddr *laddr; 4010 int error; 4011 4012 /* 4013 * Assumes TCP is locked.. and possiblye the INP. May need to 4014 * confirm/fix that if we need it and is not the case. 4015 */ 4016 inp = stcb->sctp_ep; 4017 if (ifa->ifa_addr->sa_family == AF_INET6) { 4018 struct in6_ifaddr *ifa6; 4019 4020 ifa6 = (struct in6_ifaddr *)ifa; 4021 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 4022 /* IN6_IFF_DEPRECATED | */ 4023 IN6_IFF_ANYCAST | 4024 IN6_IFF_NOTREADY)) 4025 /* Can't bind a non-existent addr. */ 4026 return (-1); 4027 } 4028 /* does the address already exist? */ 4029 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 4030 if (laddr->ifa == ifa) { 4031 return (-1); 4032 } 4033 } 4034 4035 /* add to the list */ 4036 error = sctp_insert_laddr(&stcb->asoc.sctp_local_addr_list, ifa); 4037 if (error != 0) 4038 return (error); 4039 return (0); 4040 } 4041 4042 /* 4043 * insert an laddr entry with the given ifa for the desired list 4044 */ 4045 int 4046 sctp_insert_laddr(struct sctpladdr *list, struct ifaddr *ifa) 4047 { 4048 struct sctp_laddr *laddr; 4049 int s; 4050 4051 s = splnet(); 4052 4053 laddr = (struct sctp_laddr *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr); 4054 if (laddr == NULL) { 4055 /* out of memory? */ 4056 splx(s); 4057 return (EINVAL); 4058 } 4059 SCTP_INCR_LADDR_COUNT(); 4060 bzero(laddr, sizeof(*laddr)); 4061 laddr->ifa = ifa; 4062 /* insert it */ 4063 LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr); 4064 4065 splx(s); 4066 return (0); 4067 } 4068 4069 /* 4070 * Remove an laddr entry from the local address list (on an assoc) 4071 */ 4072 void 4073 sctp_remove_laddr(struct sctp_laddr *laddr) 4074 { 4075 int s; 4076 4077 s = splnet(); 4078 /* remove from the list */ 4079 LIST_REMOVE(laddr, sctp_nxt_addr); 4080 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 4081 SCTP_DECR_LADDR_COUNT(); 4082 splx(s); 4083 } 4084 4085 /* 4086 * Remove an address from the TCB local address list 4087 */ 4088 int 4089 sctp_del_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa) 4090 { 4091 struct sctp_inpcb *inp; 4092 struct sctp_laddr *laddr; 4093 4094 /* 4095 * This is called by asconf work. It is assumed that a) The TCB is 4096 * locked and b) The INP is locked. This is true in as much as I can 4097 * trace through the entry asconf code where I did these locks. 4098 * Again, the ASCONF code is a bit different in that it does lock 4099 * the INP during its work often times. This must be since we don't 4100 * want other proc's looking up things while what they are looking 4101 * up is changing :-D 4102 */ 4103 4104 inp = stcb->sctp_ep; 4105 /* if subset bound and don't allow ASCONF's, can't delete last */ 4106 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && 4107 (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF) == 0)) { 4108 if (stcb->asoc.numnets < 2) { 4109 /* can't delete last address */ 4110 return (-1); 4111 } 4112 } 4113 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 4114 /* remove the address if it exists */ 4115 if (laddr->ifa == NULL) 4116 continue; 4117 if (laddr->ifa == ifa) { 4118 sctp_remove_laddr(laddr); 4119 return (0); 4120 } 4121 } 4122 4123 /* address not found! */ 4124 return (-1); 4125 } 4126 4127 /* 4128 * Remove an address from the TCB local address list lookup using a sockaddr 4129 * addr 4130 */ 4131 int 4132 sctp_del_local_addr_assoc_sa(struct sctp_tcb *stcb, struct sockaddr *sa) 4133 { 4134 struct sctp_inpcb *inp; 4135 struct sctp_laddr *laddr; 4136 struct sockaddr *l_sa; 4137 4138 /* 4139 * This function I find does not seem to have a caller. As such we 4140 * NEED TO DELETE this code. If we do find a caller, the caller MUST 4141 * have locked the TCB at the least and probably the INP as well. 4142 */ 4143 inp = stcb->sctp_ep; 4144 /* if subset bound and don't allow ASCONF's, can't delete last */ 4145 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && 4146 (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF) == 0)) { 4147 if (stcb->asoc.numnets < 2) { 4148 /* can't delete last address */ 4149 return (-1); 4150 } 4151 } 4152 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 4153 /* make sure the address exists */ 4154 if (laddr->ifa == NULL) 4155 continue; 4156 if (laddr->ifa->ifa_addr == NULL) 4157 continue; 4158 4159 l_sa = laddr->ifa->ifa_addr; 4160 if (l_sa->sa_family == AF_INET6) { 4161 /* IPv6 address */ 4162 struct sockaddr_in6 *sin1, *sin2; 4163 4164 sin1 = (struct sockaddr_in6 *)l_sa; 4165 sin2 = (struct sockaddr_in6 *)sa; 4166 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr, 4167 sizeof(struct in6_addr)) == 0) { 4168 /* matched */ 4169 sctp_remove_laddr(laddr); 4170 return (0); 4171 } 4172 } else if (l_sa->sa_family == AF_INET) { 4173 /* IPv4 address */ 4174 struct sockaddr_in *sin1, *sin2; 4175 4176 sin1 = (struct sockaddr_in *)l_sa; 4177 sin2 = (struct sockaddr_in *)sa; 4178 if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) { 4179 /* matched */ 4180 sctp_remove_laddr(laddr); 4181 return (0); 4182 } 4183 } else { 4184 /* invalid family */ 4185 return (-1); 4186 } 4187 } /* end foreach */ 4188 /* address not found! */ 4189 return (-1); 4190 } 4191 4192 static char sctp_pcb_initialized = 0; 4193 4194 /* 4195 * Temporarily remove for __APPLE__ until we use the Tiger equivalents 4196 */ 4197 /* sysctl */ 4198 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC; 4199 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR; 4200 4201 4202 void 4203 sctp_pcb_init() 4204 { 4205 /* 4206 * SCTP initialization for the PCB structures should be called by 4207 * the sctp_init() funciton. 4208 */ 4209 int i; 4210 4211 if (sctp_pcb_initialized != 0) { 4212 /* error I was called twice */ 4213 return; 4214 } 4215 sctp_pcb_initialized = 1; 4216 4217 bzero(&sctpstat, sizeof(struct sctpstat)); 4218 4219 /* init the empty list of (All) Endpoints */ 4220 LIST_INIT(&sctppcbinfo.listhead); 4221 4222 /* init the iterator head */ 4223 LIST_INIT(&sctppcbinfo.iteratorhead); 4224 4225 /* init the hash table of endpoints */ 4226 TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &sctp_hashtblsize); 4227 TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &sctp_pcbtblsize); 4228 TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &sctp_chunkscale); 4229 4230 sctppcbinfo.sctp_asochash = hashinit((sctp_hashtblsize * 31), 4231 M_PCB, 4232 &sctppcbinfo.hashasocmark); 4233 4234 sctppcbinfo.sctp_ephash = hashinit(sctp_hashtblsize, 4235 M_PCB, 4236 &sctppcbinfo.hashmark); 4237 4238 sctppcbinfo.sctp_tcpephash = hashinit(sctp_hashtblsize, 4239 M_PCB, 4240 &sctppcbinfo.hashtcpmark); 4241 4242 sctppcbinfo.hashtblsize = sctp_hashtblsize; 4243 4244 /* 4245 * init the small hash table we use to track restarted asoc's 4246 */ 4247 sctppcbinfo.sctp_restarthash = hashinit(SCTP_STACK_VTAG_HASH_SIZE, 4248 M_PCB, 4249 &sctppcbinfo.hashrestartmark); 4250 4251 /* init the zones */ 4252 /* 4253 * FIX ME: Should check for NULL returns, but if it does fail we are 4254 * doomed to panic anyways... add later maybe. 4255 */ 4256 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_ep, "sctp_ep", 4257 sizeof(struct sctp_inpcb), maxsockets); 4258 4259 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_asoc, "sctp_asoc", 4260 sizeof(struct sctp_tcb), sctp_max_number_of_assoc); 4261 4262 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_laddr, "sctp_laddr", 4263 sizeof(struct sctp_laddr), 4264 (sctp_max_number_of_assoc * sctp_scale_up_for_address)); 4265 4266 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_net, "sctp_raddr", 4267 sizeof(struct sctp_nets), 4268 (sctp_max_number_of_assoc * sctp_scale_up_for_address)); 4269 4270 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_chunk, "sctp_chunk", 4271 sizeof(struct sctp_tmit_chunk), 4272 (sctp_max_number_of_assoc * sctp_chunkscale)); 4273 4274 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_readq, "sctp_readq", 4275 sizeof(struct sctp_queued_to_read), 4276 (sctp_max_number_of_assoc * sctp_chunkscale)); 4277 4278 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_strmoq, "sctp_stream_msg_out", 4279 sizeof(struct sctp_stream_queue_pending), 4280 (sctp_max_number_of_assoc * sctp_chunkscale)); 4281 4282 /* Master Lock INIT for info structure */ 4283 SCTP_INP_INFO_LOCK_INIT(); 4284 SCTP_STATLOG_INIT_LOCK(); 4285 SCTP_ITERATOR_LOCK_INIT(); 4286 4287 SCTP_IPI_COUNT_INIT(); 4288 SCTP_IPI_ADDR_INIT(); 4289 LIST_INIT(&sctppcbinfo.addr_wq); 4290 4291 /* not sure if we need all the counts */ 4292 sctppcbinfo.ipi_count_ep = 0; 4293 /* assoc/tcb zone info */ 4294 sctppcbinfo.ipi_count_asoc = 0; 4295 /* local addrlist zone info */ 4296 sctppcbinfo.ipi_count_laddr = 0; 4297 /* remote addrlist zone info */ 4298 sctppcbinfo.ipi_count_raddr = 0; 4299 /* chunk info */ 4300 sctppcbinfo.ipi_count_chunk = 0; 4301 4302 /* socket queue zone info */ 4303 sctppcbinfo.ipi_count_readq = 0; 4304 4305 /* stream out queue cont */ 4306 sctppcbinfo.ipi_count_strmoq = 0; 4307 4308 sctppcbinfo.ipi_free_strmoq = 0; 4309 sctppcbinfo.ipi_free_chunks = 0; 4310 4311 4312 callout_init(&sctppcbinfo.addr_wq_timer.timer, 1); 4313 4314 /* port stuff */ 4315 sctppcbinfo.lastlow = ipport_firstauto; 4316 /* Init the TIMEWAIT list */ 4317 for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) { 4318 LIST_INIT(&sctppcbinfo.vtag_timewait[i]); 4319 } 4320 4321 } 4322 4323 4324 int 4325 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m, 4326 int iphlen, int offset, int limit, struct sctphdr *sh, 4327 struct sockaddr *altsa) 4328 { 4329 /* 4330 * grub through the INIT pulling addresses and loading them to the 4331 * nets structure in the asoc. The from address in the mbuf should 4332 * also be loaded (if it is not already). This routine can be called 4333 * with either INIT or INIT-ACK's as long as the m points to the IP 4334 * packet and the offset points to the beginning of the parameters. 4335 */ 4336 struct sctp_inpcb *inp, *l_inp; 4337 struct sctp_nets *net, *net_tmp; 4338 struct ip *iph; 4339 struct sctp_paramhdr *phdr, parm_buf; 4340 struct sctp_tcb *stcb_tmp; 4341 uint16_t ptype, plen; 4342 struct sockaddr *sa; 4343 struct sockaddr_storage dest_store; 4344 struct sockaddr *local_sa = (struct sockaddr *)&dest_store; 4345 struct sockaddr_in sin; 4346 struct sockaddr_in6 sin6; 4347 uint8_t store[384]; 4348 struct sctp_auth_random *random = NULL; 4349 uint16_t random_len = 0; 4350 struct sctp_auth_hmac_algo *hmacs = NULL; 4351 uint16_t hmacs_len = 0; 4352 struct sctp_auth_chunk_list *chunks = NULL; 4353 uint16_t num_chunks = 0; 4354 sctp_key_t *new_key; 4355 uint32_t keylen; 4356 int got_random = 0, got_hmacs = 0, got_chklist = 0; 4357 4358 /* First get the destination address setup too. */ 4359 memset(&sin, 0, sizeof(sin)); 4360 memset(&sin6, 0, sizeof(sin6)); 4361 4362 sin.sin_family = AF_INET; 4363 sin.sin_len = sizeof(sin); 4364 sin.sin_port = stcb->rport; 4365 4366 sin6.sin6_family = AF_INET6; 4367 sin6.sin6_len = sizeof(struct sockaddr_in6); 4368 sin6.sin6_port = stcb->rport; 4369 if (altsa == NULL) { 4370 iph = mtod(m, struct ip *); 4371 if (iph->ip_v == IPVERSION) { 4372 /* its IPv4 */ 4373 struct sockaddr_in *sin_2; 4374 4375 sin_2 = (struct sockaddr_in *)(local_sa); 4376 memset(sin_2, 0, sizeof(sin)); 4377 sin_2->sin_family = AF_INET; 4378 sin_2->sin_len = sizeof(sin); 4379 sin_2->sin_port = sh->dest_port; 4380 sin_2->sin_addr.s_addr = iph->ip_dst.s_addr; 4381 sin.sin_addr = iph->ip_src; 4382 sa = (struct sockaddr *)&sin; 4383 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 4384 /* its IPv6 */ 4385 struct ip6_hdr *ip6; 4386 struct sockaddr_in6 *sin6_2; 4387 4388 ip6 = mtod(m, struct ip6_hdr *); 4389 sin6_2 = (struct sockaddr_in6 *)(local_sa); 4390 memset(sin6_2, 0, sizeof(sin6)); 4391 sin6_2->sin6_family = AF_INET6; 4392 sin6_2->sin6_len = sizeof(struct sockaddr_in6); 4393 sin6_2->sin6_port = sh->dest_port; 4394 sin6.sin6_addr = ip6->ip6_src; 4395 sa = (struct sockaddr *)&sin6; 4396 } else { 4397 sa = NULL; 4398 } 4399 } else { 4400 /* 4401 * For cookies we use the src address NOT from the packet 4402 * but from the original INIT 4403 */ 4404 sa = altsa; 4405 } 4406 /* Turn off ECN until we get through all params */ 4407 stcb->asoc.ecn_allowed = 0; 4408 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 4409 /* mark all addresses that we have currently on the list */ 4410 net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC; 4411 } 4412 /* does the source address already exist? if so skip it */ 4413 l_inp = inp = stcb->sctp_ep; 4414 4415 atomic_add_int(&stcb->asoc.refcnt, 1); 4416 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, local_sa, stcb); 4417 atomic_add_int(&stcb->asoc.refcnt, -1); 4418 4419 if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) { 4420 /* we must add the source address */ 4421 /* no scope set here since we have a tcb already. */ 4422 if ((sa->sa_family == AF_INET) && 4423 (stcb->asoc.ipv4_addr_legal)) { 4424 if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_2)) { 4425 return (-1); 4426 } 4427 } else if ((sa->sa_family == AF_INET6) && 4428 (stcb->asoc.ipv6_addr_legal)) { 4429 if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_3)) { 4430 return (-2); 4431 } 4432 } 4433 } else { 4434 if (net_tmp != NULL && stcb_tmp == stcb) { 4435 net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC; 4436 } else if (stcb_tmp != stcb) { 4437 /* It belongs to another association? */ 4438 SCTP_TCB_UNLOCK(stcb_tmp); 4439 return (-3); 4440 } 4441 } 4442 if (stcb->asoc.state == 0) { 4443 /* the assoc was freed? */ 4444 return (-4); 4445 } 4446 /* now we must go through each of the params. */ 4447 phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf)); 4448 while (phdr) { 4449 ptype = ntohs(phdr->param_type); 4450 plen = ntohs(phdr->param_length); 4451 /* 4452 * printf("ptype => %0x, plen => %d\n", (uint32_t)ptype, 4453 * (int)plen); 4454 */ 4455 if (offset + plen > limit) { 4456 break; 4457 } 4458 if (plen == 0) { 4459 break; 4460 } 4461 if (ptype == SCTP_IPV4_ADDRESS) { 4462 if (stcb->asoc.ipv4_addr_legal) { 4463 struct sctp_ipv4addr_param *p4, p4_buf; 4464 4465 /* ok get the v4 address and check/add */ 4466 phdr = sctp_get_next_param(m, offset, 4467 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 4468 if (plen != sizeof(struct sctp_ipv4addr_param) || 4469 phdr == NULL) { 4470 return (-5); 4471 } 4472 p4 = (struct sctp_ipv4addr_param *)phdr; 4473 sin.sin_addr.s_addr = p4->addr; 4474 sa = (struct sockaddr *)&sin; 4475 inp = stcb->sctp_ep; 4476 atomic_add_int(&stcb->asoc.refcnt, 1); 4477 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net, 4478 local_sa, stcb); 4479 atomic_add_int(&stcb->asoc.refcnt, -1); 4480 4481 if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || 4482 inp == NULL) { 4483 /* we must add the source address */ 4484 /* 4485 * no scope set since we have a tcb 4486 * already 4487 */ 4488 4489 /* 4490 * we must validate the state again 4491 * here 4492 */ 4493 if (stcb->asoc.state == 0) { 4494 /* the assoc was freed? */ 4495 return (-7); 4496 } 4497 if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_4)) { 4498 return (-8); 4499 } 4500 } else if (stcb_tmp == stcb) { 4501 if (stcb->asoc.state == 0) { 4502 /* the assoc was freed? */ 4503 return (-10); 4504 } 4505 if (net != NULL) { 4506 /* clear flag */ 4507 net->dest_state &= 4508 ~SCTP_ADDR_NOT_IN_ASSOC; 4509 } 4510 } else { 4511 /* 4512 * strange, address is in another 4513 * assoc? straighten out locks. 4514 */ 4515 if (stcb->asoc.state == 0) { 4516 /* the assoc was freed? */ 4517 return (-12); 4518 } 4519 return (-13); 4520 } 4521 } 4522 } else if (ptype == SCTP_IPV6_ADDRESS) { 4523 if (stcb->asoc.ipv6_addr_legal) { 4524 /* ok get the v6 address and check/add */ 4525 struct sctp_ipv6addr_param *p6, p6_buf; 4526 4527 phdr = sctp_get_next_param(m, offset, 4528 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 4529 if (plen != sizeof(struct sctp_ipv6addr_param) || 4530 phdr == NULL) { 4531 return (-14); 4532 } 4533 p6 = (struct sctp_ipv6addr_param *)phdr; 4534 memcpy((caddr_t)&sin6.sin6_addr, p6->addr, 4535 sizeof(p6->addr)); 4536 sa = (struct sockaddr *)&sin6; 4537 inp = stcb->sctp_ep; 4538 atomic_add_int(&stcb->asoc.refcnt, 1); 4539 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net, 4540 local_sa, stcb); 4541 atomic_add_int(&stcb->asoc.refcnt, -1); 4542 if (stcb_tmp == NULL && (inp == stcb->sctp_ep || 4543 inp == NULL)) { 4544 /* 4545 * we must validate the state again 4546 * here 4547 */ 4548 if (stcb->asoc.state == 0) { 4549 /* the assoc was freed? */ 4550 return (-16); 4551 } 4552 /* 4553 * we must add the address, no scope 4554 * set 4555 */ 4556 if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_5)) { 4557 return (-17); 4558 } 4559 } else if (stcb_tmp == stcb) { 4560 /* 4561 * we must validate the state again 4562 * here 4563 */ 4564 if (stcb->asoc.state == 0) { 4565 /* the assoc was freed? */ 4566 return (-19); 4567 } 4568 if (net != NULL) { 4569 /* clear flag */ 4570 net->dest_state &= 4571 ~SCTP_ADDR_NOT_IN_ASSOC; 4572 } 4573 } else { 4574 /* 4575 * strange, address is in another 4576 * assoc? straighten out locks. 4577 */ 4578 if (stcb->asoc.state == 0) { 4579 /* the assoc was freed? */ 4580 return (-21); 4581 } 4582 return (-22); 4583 } 4584 } 4585 } else if (ptype == SCTP_ECN_CAPABLE) { 4586 stcb->asoc.ecn_allowed = 1; 4587 } else if (ptype == SCTP_ULP_ADAPTATION) { 4588 if (stcb->asoc.state != SCTP_STATE_OPEN) { 4589 struct sctp_adaptation_layer_indication ai, 4590 *aip; 4591 4592 phdr = sctp_get_next_param(m, offset, 4593 (struct sctp_paramhdr *)&ai, sizeof(ai)); 4594 aip = (struct sctp_adaptation_layer_indication *)phdr; 4595 sctp_ulp_notify(SCTP_NOTIFY_ADAPTATION_INDICATION, 4596 stcb, ntohl(aip->indication), NULL); 4597 } 4598 } else if (ptype == SCTP_SET_PRIM_ADDR) { 4599 struct sctp_asconf_addr_param lstore, *fee; 4600 struct sctp_asconf_addrv4_param *fii; 4601 int lptype; 4602 struct sockaddr *lsa = NULL; 4603 4604 stcb->asoc.peer_supports_asconf = 1; 4605 if (plen > sizeof(lstore)) { 4606 return (-23); 4607 } 4608 phdr = sctp_get_next_param(m, offset, 4609 (struct sctp_paramhdr *)&lstore, plen); 4610 if (phdr == NULL) { 4611 return (-24); 4612 } 4613 fee = (struct sctp_asconf_addr_param *)phdr; 4614 lptype = ntohs(fee->addrp.ph.param_type); 4615 if (lptype == SCTP_IPV4_ADDRESS) { 4616 if (plen != 4617 sizeof(struct sctp_asconf_addrv4_param)) { 4618 printf("Sizeof setprim in init/init ack not %d but %d - ignored\n", 4619 (int)sizeof(struct sctp_asconf_addrv4_param), 4620 plen); 4621 } else { 4622 fii = (struct sctp_asconf_addrv4_param *)fee; 4623 sin.sin_addr.s_addr = fii->addrp.addr; 4624 lsa = (struct sockaddr *)&sin; 4625 } 4626 } else if (lptype == SCTP_IPV6_ADDRESS) { 4627 if (plen != 4628 sizeof(struct sctp_asconf_addr_param)) { 4629 printf("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n", 4630 (int)sizeof(struct sctp_asconf_addr_param), 4631 plen); 4632 } else { 4633 memcpy(sin6.sin6_addr.s6_addr, 4634 fee->addrp.addr, 4635 sizeof(fee->addrp.addr)); 4636 lsa = (struct sockaddr *)&sin6; 4637 } 4638 } 4639 if (lsa) { 4640 sctp_set_primary_addr(stcb, sa, NULL); 4641 } 4642 } else if (ptype == SCTP_PRSCTP_SUPPORTED) { 4643 /* Peer supports pr-sctp */ 4644 stcb->asoc.peer_supports_prsctp = 1; 4645 } else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) { 4646 /* A supported extension chunk */ 4647 struct sctp_supported_chunk_types_param *pr_supported; 4648 uint8_t local_store[128]; 4649 int num_ent, i; 4650 4651 phdr = sctp_get_next_param(m, offset, 4652 (struct sctp_paramhdr *)&local_store, plen); 4653 if (phdr == NULL) { 4654 return (-25); 4655 } 4656 stcb->asoc.peer_supports_asconf = 0; 4657 stcb->asoc.peer_supports_prsctp = 0; 4658 stcb->asoc.peer_supports_pktdrop = 0; 4659 stcb->asoc.peer_supports_strreset = 0; 4660 stcb->asoc.peer_supports_auth = 0; 4661 pr_supported = (struct sctp_supported_chunk_types_param *)phdr; 4662 num_ent = plen - sizeof(struct sctp_paramhdr); 4663 for (i = 0; i < num_ent; i++) { 4664 switch (pr_supported->chunk_types[i]) { 4665 case SCTP_ASCONF: 4666 case SCTP_ASCONF_ACK: 4667 stcb->asoc.peer_supports_asconf = 1; 4668 break; 4669 case SCTP_FORWARD_CUM_TSN: 4670 stcb->asoc.peer_supports_prsctp = 1; 4671 break; 4672 case SCTP_PACKET_DROPPED: 4673 stcb->asoc.peer_supports_pktdrop = 1; 4674 break; 4675 case SCTP_STREAM_RESET: 4676 stcb->asoc.peer_supports_strreset = 1; 4677 break; 4678 case SCTP_AUTHENTICATION: 4679 stcb->asoc.peer_supports_auth = 1; 4680 break; 4681 default: 4682 /* one I have not learned yet */ 4683 break; 4684 4685 } 4686 } 4687 } else if (ptype == SCTP_ECN_NONCE_SUPPORTED) { 4688 /* Peer supports ECN-nonce */ 4689 stcb->asoc.peer_supports_ecn_nonce = 1; 4690 stcb->asoc.ecn_nonce_allowed = 1; 4691 } else if (ptype == SCTP_RANDOM) { 4692 if (plen > sizeof(store)) 4693 break; 4694 if (got_random) { 4695 /* already processed a RANDOM */ 4696 goto next_param; 4697 } 4698 phdr = sctp_get_next_param(m, offset, 4699 (struct sctp_paramhdr *)store, 4700 plen); 4701 if (phdr == NULL) 4702 return (-26); 4703 random = (struct sctp_auth_random *)phdr; 4704 random_len = plen - sizeof(*random); 4705 /* enforce the random length */ 4706 if (random_len != SCTP_AUTH_RANDOM_SIZE_REQUIRED) { 4707 #ifdef SCTP_DEBUG 4708 if (sctp_debug_on & SCTP_DEBUG_AUTH1) 4709 printf("SCTP: invalid RANDOM len\n"); 4710 #endif 4711 return (-27); 4712 } 4713 got_random = 1; 4714 } else if (ptype == SCTP_HMAC_LIST) { 4715 int num_hmacs; 4716 int i; 4717 4718 if (plen > sizeof(store)) 4719 break; 4720 if (got_hmacs) { 4721 /* already processed a HMAC list */ 4722 goto next_param; 4723 } 4724 phdr = sctp_get_next_param(m, offset, 4725 (struct sctp_paramhdr *)store, 4726 plen); 4727 if (phdr == NULL) 4728 return (-28); 4729 hmacs = (struct sctp_auth_hmac_algo *)phdr; 4730 hmacs_len = plen - sizeof(*hmacs); 4731 num_hmacs = hmacs_len / sizeof(hmacs->hmac_ids[0]); 4732 /* validate the hmac list */ 4733 if (sctp_verify_hmac_param(hmacs, num_hmacs)) { 4734 return (-29); 4735 } 4736 if (stcb->asoc.peer_hmacs != NULL) 4737 sctp_free_hmaclist(stcb->asoc.peer_hmacs); 4738 stcb->asoc.peer_hmacs = sctp_alloc_hmaclist(num_hmacs); 4739 if (stcb->asoc.peer_hmacs != NULL) { 4740 for (i = 0; i < num_hmacs; i++) { 4741 sctp_auth_add_hmacid(stcb->asoc.peer_hmacs, 4742 ntohs(hmacs->hmac_ids[i])); 4743 } 4744 } 4745 got_hmacs = 1; 4746 } else if (ptype == SCTP_CHUNK_LIST) { 4747 int i; 4748 4749 if (plen > sizeof(store)) 4750 break; 4751 if (got_chklist) { 4752 /* already processed a Chunks list */ 4753 goto next_param; 4754 } 4755 phdr = sctp_get_next_param(m, offset, 4756 (struct sctp_paramhdr *)store, 4757 plen); 4758 if (phdr == NULL) 4759 return (-30); 4760 chunks = (struct sctp_auth_chunk_list *)phdr; 4761 num_chunks = plen - sizeof(*chunks); 4762 if (stcb->asoc.peer_auth_chunks != NULL) 4763 sctp_clear_chunklist(stcb->asoc.peer_auth_chunks); 4764 else 4765 stcb->asoc.peer_auth_chunks = sctp_alloc_chunklist(); 4766 for (i = 0; i < num_chunks; i++) { 4767 sctp_auth_add_chunk(chunks->chunk_types[i], 4768 stcb->asoc.peer_auth_chunks); 4769 } 4770 got_chklist = 1; 4771 } else if ((ptype == SCTP_HEARTBEAT_INFO) || 4772 (ptype == SCTP_STATE_COOKIE) || 4773 (ptype == SCTP_UNRECOG_PARAM) || 4774 (ptype == SCTP_COOKIE_PRESERVE) || 4775 (ptype == SCTP_SUPPORTED_ADDRTYPE) || 4776 (ptype == SCTP_ADD_IP_ADDRESS) || 4777 (ptype == SCTP_DEL_IP_ADDRESS) || 4778 (ptype == SCTP_ERROR_CAUSE_IND) || 4779 (ptype == SCTP_SUCCESS_REPORT)) { 4780 /* don't care */ ; 4781 } else { 4782 if ((ptype & 0x8000) == 0x0000) { 4783 /* 4784 * must stop processing the rest of the 4785 * param's. Any report bits were handled 4786 * with the call to 4787 * sctp_arethere_unrecognized_parameters() 4788 * when the INIT or INIT-ACK was first seen. 4789 */ 4790 break; 4791 } 4792 } 4793 next_param: 4794 offset += SCTP_SIZE32(plen); 4795 if (offset >= limit) { 4796 break; 4797 } 4798 phdr = sctp_get_next_param(m, offset, &parm_buf, 4799 sizeof(parm_buf)); 4800 } 4801 /* Now check to see if we need to purge any addresses */ 4802 for (net = TAILQ_FIRST(&stcb->asoc.nets); net != NULL; net = net_tmp) { 4803 net_tmp = TAILQ_NEXT(net, sctp_next); 4804 if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) == 4805 SCTP_ADDR_NOT_IN_ASSOC) { 4806 /* This address has been removed from the asoc */ 4807 /* remove and free it */ 4808 stcb->asoc.numnets--; 4809 TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next); 4810 sctp_free_remote_addr(net); 4811 if (net == stcb->asoc.primary_destination) { 4812 stcb->asoc.primary_destination = NULL; 4813 sctp_select_primary_destination(stcb); 4814 } 4815 } 4816 } 4817 /* validate authentication required parameters */ 4818 if (got_random && got_hmacs) { 4819 stcb->asoc.peer_supports_auth = 1; 4820 } else { 4821 stcb->asoc.peer_supports_auth = 0; 4822 } 4823 if (!sctp_asconf_auth_nochk && stcb->asoc.peer_supports_asconf && 4824 !stcb->asoc.peer_supports_auth) { 4825 return (-31); 4826 } 4827 /* concatenate the full random key */ 4828 keylen = random_len + num_chunks + hmacs_len; 4829 new_key = sctp_alloc_key(keylen); 4830 if (new_key != NULL) { 4831 /* copy in the RANDOM */ 4832 if (random != NULL) 4833 bcopy(random->random_data, new_key->key, random_len); 4834 /* append in the AUTH chunks */ 4835 if (chunks != NULL) 4836 bcopy(chunks->chunk_types, new_key->key + random_len, 4837 num_chunks); 4838 /* append in the HMACs */ 4839 if (hmacs != NULL) 4840 bcopy(hmacs->hmac_ids, new_key->key + random_len + num_chunks, 4841 hmacs_len); 4842 } else { 4843 return (-32); 4844 } 4845 if (stcb->asoc.authinfo.peer_random != NULL) 4846 sctp_free_key(stcb->asoc.authinfo.peer_random); 4847 stcb->asoc.authinfo.peer_random = new_key; 4848 #ifdef SCTP_AUTH_DRAFT_04 4849 /* don't include the chunks and hmacs for draft -04 */ 4850 stcb->asoc.authinfo.peer_random->keylen = random_len; 4851 #endif 4852 sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.assoc_keyid); 4853 sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.recv_keyid); 4854 4855 return (0); 4856 } 4857 4858 int 4859 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa, 4860 struct sctp_nets *net) 4861 { 4862 /* make sure the requested primary address exists in the assoc */ 4863 if (net == NULL && sa) 4864 net = sctp_findnet(stcb, sa); 4865 4866 if (net == NULL) { 4867 /* didn't find the requested primary address! */ 4868 return (-1); 4869 } else { 4870 /* set the primary address */ 4871 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 4872 /* Must be confirmed */ 4873 return (-1); 4874 } 4875 stcb->asoc.primary_destination = net; 4876 net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY; 4877 net = TAILQ_FIRST(&stcb->asoc.nets); 4878 if (net != stcb->asoc.primary_destination) { 4879 /* 4880 * first one on the list is NOT the primary 4881 * sctp_cmpaddr() is much more efficent if the 4882 * primary is the first on the list, make it so. 4883 */ 4884 TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next); 4885 TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next); 4886 } 4887 return (0); 4888 } 4889 } 4890 4891 4892 int 4893 sctp_is_vtag_good(struct sctp_inpcb *inp, uint32_t tag, struct timeval *now) 4894 { 4895 /* 4896 * This function serves two purposes. It will see if a TAG can be 4897 * re-used and return 1 for yes it is ok and 0 for don't use that 4898 * tag. A secondary function it will do is purge out old tags that 4899 * can be removed. 4900 */ 4901 struct sctpasochead *head; 4902 struct sctpvtaghead *chain; 4903 struct sctp_tagblock *twait_block; 4904 struct sctp_tcb *stcb; 4905 int i; 4906 4907 SCTP_INP_INFO_WLOCK(); 4908 chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)]; 4909 /* First is the vtag in use ? */ 4910 4911 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(tag, 4912 sctppcbinfo.hashasocmark)]; 4913 if (head == NULL) { 4914 goto check_restart; 4915 } 4916 LIST_FOREACH(stcb, head, sctp_asocs) { 4917 4918 if (stcb->asoc.my_vtag == tag) { 4919 /* 4920 * We should remove this if and return 0 always if 4921 * we want vtags unique across all endpoints. For 4922 * now within a endpoint is ok. 4923 */ 4924 if (inp == stcb->sctp_ep) { 4925 /* bad tag, in use */ 4926 SCTP_INP_INFO_WUNLOCK(); 4927 return (0); 4928 } 4929 } 4930 } 4931 check_restart: 4932 /* Now lets check the restart hash */ 4933 head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(tag, 4934 sctppcbinfo.hashrestartmark)]; 4935 if (head == NULL) { 4936 goto check_time_wait; 4937 } 4938 LIST_FOREACH(stcb, head, sctp_tcbrestarhash) { 4939 if (stcb->asoc.assoc_id == tag) { 4940 /* candidate */ 4941 if (inp == stcb->sctp_ep) { 4942 /* bad tag, in use */ 4943 SCTP_INP_INFO_WUNLOCK(); 4944 return (0); 4945 } 4946 } 4947 } 4948 check_time_wait: 4949 /* Now what about timed wait ? */ 4950 if (!LIST_EMPTY(chain)) { 4951 /* 4952 * Block(s) are present, lets see if we have this tag in the 4953 * list 4954 */ 4955 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) { 4956 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) { 4957 if (twait_block->vtag_block[i].v_tag == 0) { 4958 /* not used */ 4959 continue; 4960 } else if ((long)twait_block->vtag_block[i].tv_sec_at_expire > 4961 now->tv_sec) { 4962 /* Audit expires this guy */ 4963 twait_block->vtag_block[i].tv_sec_at_expire = 0; 4964 twait_block->vtag_block[i].v_tag = 0; 4965 } else if (twait_block->vtag_block[i].v_tag == 4966 tag) { 4967 /* Bad tag, sorry :< */ 4968 SCTP_INP_INFO_WUNLOCK(); 4969 return (0); 4970 } 4971 } 4972 } 4973 } 4974 /* Not found, ok to use the tag */ 4975 SCTP_INP_INFO_WUNLOCK(); 4976 return (1); 4977 } 4978 4979 4980 /* 4981 * Delete the address from the endpoint local address list Lookup using a 4982 * sockaddr address (ie. not an ifaddr) 4983 */ 4984 int 4985 sctp_del_local_addr_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa) 4986 { 4987 struct sctp_laddr *laddr; 4988 struct sockaddr *l_sa; 4989 int found = 0; 4990 4991 /* 4992 * Here is another function I cannot find a caller for. As such we 4993 * SHOULD delete it if we have no users. If we find a user that user 4994 * MUST have the INP locked. 4995 * 4996 */ 4997 4998 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 4999 /* You are already bound to all. You have it already */ 5000 return (EINVAL); 5001 } 5002 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 5003 /* make sure the address exists */ 5004 if (laddr->ifa == NULL) 5005 continue; 5006 if (laddr->ifa->ifa_addr == NULL) 5007 continue; 5008 5009 l_sa = laddr->ifa->ifa_addr; 5010 if (l_sa->sa_family == AF_INET6) { 5011 /* IPv6 address */ 5012 struct sockaddr_in6 *sin1, *sin2; 5013 5014 sin1 = (struct sockaddr_in6 *)l_sa; 5015 sin2 = (struct sockaddr_in6 *)sa; 5016 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr, 5017 sizeof(struct in6_addr)) == 0) { 5018 /* matched */ 5019 found = 1; 5020 break; 5021 } 5022 } else if (l_sa->sa_family == AF_INET) { 5023 /* IPv4 address */ 5024 struct sockaddr_in *sin1, *sin2; 5025 5026 sin1 = (struct sockaddr_in *)l_sa; 5027 sin2 = (struct sockaddr_in *)sa; 5028 if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) { 5029 /* matched */ 5030 found = 1; 5031 break; 5032 } 5033 } else { 5034 /* invalid family */ 5035 return (-1); 5036 } 5037 } 5038 5039 if (found && inp->laddr_count < 2) { 5040 /* can't delete unless there are at LEAST 2 addresses */ 5041 return (-1); 5042 } 5043 if (found && (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 5044 /* 5045 * remove it from the ep list, this should NOT be done until 5046 * its really gone from the interface list and we won't be 5047 * receiving more of these. Probably right away. If we do 5048 * allow a removal of an address from an association 5049 * (sub-set bind) than this should NOT be called until the 5050 * all ASCONF come back from this association. 5051 */ 5052 sctp_remove_laddr(laddr); 5053 return (0); 5054 } else { 5055 return (-1); 5056 } 5057 } 5058 5059 static sctp_assoc_t reneged_asoc_ids[256]; 5060 static uint8_t reneged_at = 0; 5061 5062 extern int sctp_do_drain; 5063 5064 static void 5065 sctp_drain_mbufs(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 5066 { 5067 /* 5068 * We must hunt this association for MBUF's past the cumack (i.e. 5069 * out of order data that we can renege on). 5070 */ 5071 struct sctp_association *asoc; 5072 struct sctp_tmit_chunk *chk, *nchk; 5073 uint32_t cumulative_tsn_p1, tsn; 5074 struct sctp_queued_to_read *ctl, *nctl; 5075 int cnt, strmat, gap; 5076 5077 /* We look for anything larger than the cum-ack + 1 */ 5078 5079 SCTP_STAT_INCR(sctps_protocol_drain_calls); 5080 if (sctp_do_drain == 0) { 5081 return; 5082 } 5083 asoc = &stcb->asoc; 5084 if (asoc->cumulative_tsn == asoc->highest_tsn_inside_map) { 5085 /* none we can reneg on. */ 5086 return; 5087 } 5088 SCTP_STAT_INCR(sctps_protocol_drains_done); 5089 cumulative_tsn_p1 = asoc->cumulative_tsn + 1; 5090 cnt = 0; 5091 /* First look in the re-assembly queue */ 5092 chk = TAILQ_FIRST(&asoc->reasmqueue); 5093 while (chk) { 5094 /* Get the next one */ 5095 nchk = TAILQ_NEXT(chk, sctp_next); 5096 if (compare_with_wrap(chk->rec.data.TSN_seq, 5097 cumulative_tsn_p1, MAX_TSN)) { 5098 /* Yep it is above cum-ack */ 5099 cnt++; 5100 tsn = chk->rec.data.TSN_seq; 5101 if (tsn >= asoc->mapping_array_base_tsn) { 5102 gap = tsn - asoc->mapping_array_base_tsn; 5103 } else { 5104 gap = (MAX_TSN - asoc->mapping_array_base_tsn) + 5105 tsn + 1; 5106 } 5107 asoc->size_on_reasm_queue = sctp_sbspace_sub(asoc->size_on_reasm_queue, chk->send_size); 5108 sctp_ucount_decr(asoc->cnt_on_reasm_queue); 5109 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap); 5110 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next); 5111 if (chk->data) { 5112 sctp_m_freem(chk->data); 5113 chk->data = NULL; 5114 } 5115 sctp_free_remote_addr(chk->whoTo); 5116 sctp_free_a_chunk(stcb, chk); 5117 } 5118 chk = nchk; 5119 } 5120 /* Ok that was fun, now we will drain all the inbound streams? */ 5121 for (strmat = 0; strmat < asoc->streamincnt; strmat++) { 5122 ctl = TAILQ_FIRST(&asoc->strmin[strmat].inqueue); 5123 while (ctl) { 5124 nctl = TAILQ_NEXT(ctl, next); 5125 if (compare_with_wrap(ctl->sinfo_tsn, 5126 cumulative_tsn_p1, MAX_TSN)) { 5127 /* Yep it is above cum-ack */ 5128 cnt++; 5129 tsn = ctl->sinfo_tsn; 5130 if (tsn >= asoc->mapping_array_base_tsn) { 5131 gap = tsn - 5132 asoc->mapping_array_base_tsn; 5133 } else { 5134 gap = (MAX_TSN - 5135 asoc->mapping_array_base_tsn) + 5136 tsn + 1; 5137 } 5138 asoc->size_on_all_streams = sctp_sbspace_sub(asoc->size_on_all_streams, ctl->length); 5139 sctp_ucount_decr(asoc->cnt_on_all_streams); 5140 5141 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, 5142 gap); 5143 TAILQ_REMOVE(&asoc->strmin[strmat].inqueue, 5144 ctl, next); 5145 if (ctl->data) { 5146 sctp_m_freem(ctl->data); 5147 ctl->data = NULL; 5148 } 5149 sctp_free_remote_addr(ctl->whoFrom); 5150 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, ctl); 5151 SCTP_DECR_READQ_COUNT(); 5152 } 5153 ctl = nctl; 5154 } 5155 } 5156 /* 5157 * Question, should we go through the delivery queue? The only 5158 * reason things are on here is the app not reading OR a p-d-api up. 5159 * An attacker COULD send enough in to initiate the PD-API and then 5160 * send a bunch of stuff to other streams... these would wind up on 5161 * the delivery queue.. and then we would not get to them. But in 5162 * order to do this I then have to back-track and un-deliver 5163 * sequence numbers in streams.. el-yucko. I think for now we will 5164 * NOT look at the delivery queue and leave it to be something to 5165 * consider later. An alternative would be to abort the P-D-API with 5166 * a notification and then deliver the data.... Or another method 5167 * might be to keep track of how many times the situation occurs and 5168 * if we see a possible attack underway just abort the association. 5169 */ 5170 #ifdef SCTP_DEBUG 5171 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 5172 if (cnt) { 5173 printf("Freed %d chunks from reneg harvest\n", cnt); 5174 } 5175 } 5176 #endif /* SCTP_DEBUG */ 5177 if (cnt) { 5178 /* 5179 * Now do we need to find a new 5180 * asoc->highest_tsn_inside_map? 5181 */ 5182 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) { 5183 gap = asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn; 5184 } else { 5185 gap = (MAX_TSN - asoc->mapping_array_base_tsn) + 5186 asoc->highest_tsn_inside_map + 1; 5187 } 5188 if (gap >= (asoc->mapping_array_size << 3)) { 5189 /* 5190 * Something bad happened or cum-ack and high were 5191 * behind the base, but if so earlier checks should 5192 * have found NO data... wierd... we will start at 5193 * end of mapping array. 5194 */ 5195 printf("Gap was larger than array?? %d set to max:%d maparraymax:%x\n", 5196 (int)gap, 5197 (int)(asoc->mapping_array_size << 3), 5198 (int)asoc->highest_tsn_inside_map); 5199 gap = asoc->mapping_array_size << 3; 5200 } 5201 while (gap > 0) { 5202 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) { 5203 /* found the new highest */ 5204 asoc->highest_tsn_inside_map = asoc->mapping_array_base_tsn + gap; 5205 break; 5206 } 5207 gap--; 5208 } 5209 if (gap == 0) { 5210 /* Nothing left in map */ 5211 memset(asoc->mapping_array, 0, asoc->mapping_array_size); 5212 asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1; 5213 asoc->highest_tsn_inside_map = asoc->cumulative_tsn; 5214 } 5215 asoc->last_revoke_count = cnt; 5216 callout_stop(&stcb->asoc.dack_timer.timer); 5217 sctp_send_sack(stcb); 5218 reneged_asoc_ids[reneged_at] = sctp_get_associd(stcb); 5219 reneged_at++; 5220 } 5221 /* 5222 * Another issue, in un-setting the TSN's in the mapping array we 5223 * DID NOT adjust the higest_tsn marker. This will cause one of two 5224 * things to occur. It may cause us to do extra work in checking for 5225 * our mapping array movement. More importantly it may cause us to 5226 * SACK every datagram. This may not be a bad thing though since we 5227 * will recover once we get our cum-ack above and all this stuff we 5228 * dumped recovered. 5229 */ 5230 } 5231 5232 void 5233 sctp_drain() 5234 { 5235 /* 5236 * We must walk the PCB lists for ALL associations here. The system 5237 * is LOW on MBUF's and needs help. This is where reneging will 5238 * occur. We really hope this does NOT happen! 5239 */ 5240 struct sctp_inpcb *inp; 5241 struct sctp_tcb *stcb; 5242 5243 SCTP_INP_INFO_RLOCK(); 5244 LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) { 5245 /* For each endpoint */ 5246 SCTP_INP_RLOCK(inp); 5247 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 5248 /* For each association */ 5249 SCTP_TCB_LOCK(stcb); 5250 sctp_drain_mbufs(inp, stcb); 5251 SCTP_TCB_UNLOCK(stcb); 5252 } 5253 SCTP_INP_RUNLOCK(inp); 5254 } 5255 SCTP_INP_INFO_RUNLOCK(); 5256 } 5257 5258 /* 5259 * start a new iterator 5260 * iterates through all endpoints and associations based on the pcb_state 5261 * flags and asoc_state. "af" (mandatory) is executed for all matching 5262 * assocs and "ef" (optional) is executed when the iterator completes. 5263 * "inpf" (optional) is executed for each new endpoint as it is being 5264 * iterated through. 5265 */ 5266 int 5267 sctp_initiate_iterator(inp_func inpf, asoc_func af, uint32_t pcb_state, 5268 uint32_t pcb_features, uint32_t asoc_state, void *argp, uint32_t argi, 5269 end_func ef, struct sctp_inpcb *s_inp, uint8_t chunk_output_off) 5270 { 5271 struct sctp_iterator *it = NULL; 5272 int s; 5273 5274 if (af == NULL) { 5275 return (-1); 5276 } 5277 SCTP_MALLOC(it, struct sctp_iterator *, sizeof(struct sctp_iterator), 5278 "Iterator"); 5279 if (it == NULL) { 5280 return (ENOMEM); 5281 } 5282 memset(it, 0, sizeof(*it)); 5283 it->function_assoc = af; 5284 it->function_inp = inpf; 5285 it->function_atend = ef; 5286 it->pointer = argp; 5287 it->val = argi; 5288 it->pcb_flags = pcb_state; 5289 it->pcb_features = pcb_features; 5290 it->asoc_state = asoc_state; 5291 it->no_chunk_output = chunk_output_off; 5292 if (s_inp) { 5293 it->inp = s_inp; 5294 it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP; 5295 } else { 5296 SCTP_INP_INFO_RLOCK(); 5297 it->inp = LIST_FIRST(&sctppcbinfo.listhead); 5298 SCTP_INP_INFO_RUNLOCK(); 5299 it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP; 5300 5301 } 5302 /* Init the timer */ 5303 callout_init(&it->tmr.timer, 1); 5304 /* add to the list of all iterators */ 5305 SCTP_INP_INFO_WLOCK(); 5306 LIST_INSERT_HEAD(&sctppcbinfo.iteratorhead, it, sctp_nxt_itr); 5307 SCTP_INP_INFO_WUNLOCK(); 5308 s = splnet(); 5309 sctp_timer_start(SCTP_TIMER_TYPE_ITERATOR, (struct sctp_inpcb *)it, 5310 NULL, NULL); 5311 splx(s); 5312 return (0); 5313 } 5314 5315 5316 /* 5317 * Callout/Timer routines for OS that doesn't have them 5318 */ 5319