1 /*- 2 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 3 * Copyright (c) 2008-2011, by Randall Stewart. All rights reserved. 4 * Copyright (c) 2008-2011, by Michael Tuexen. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions are met: 8 * 9 * a) Redistributions of source code must retain the above copyright notice, 10 * this list of conditions and the following disclaimer. 11 * 12 * b) Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the distribution. 15 * 16 * c) Neither the name of Cisco Systems, Inc. nor the names of its 17 * contributors may be used to endorse or promote products derived 18 * from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 24 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 30 * THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 /* $KAME: sctputil.c,v 1.37 2005/03/07 23:26:09 itojun Exp $ */ 34 35 #include <sys/cdefs.h> 36 __FBSDID("$FreeBSD$"); 37 38 #include <netinet/sctp_os.h> 39 #include <netinet/sctp_pcb.h> 40 #include <netinet/sctputil.h> 41 #include <netinet/sctp_var.h> 42 #include <netinet/sctp_sysctl.h> 43 #ifdef INET6 44 #endif 45 #include <netinet/sctp_header.h> 46 #include <netinet/sctp_output.h> 47 #include <netinet/sctp_uio.h> 48 #include <netinet/sctp_timer.h> 49 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */ 50 #include <netinet/sctp_auth.h> 51 #include <netinet/sctp_asconf.h> 52 #include <netinet/sctp_bsd_addr.h> 53 54 55 #ifndef KTR_SCTP 56 #define KTR_SCTP KTR_SUBSYS 57 #endif 58 59 extern struct sctp_cc_functions sctp_cc_functions[]; 60 extern struct sctp_ss_functions sctp_ss_functions[]; 61 62 void 63 sctp_sblog(struct sockbuf *sb, 64 struct sctp_tcb *stcb, int from, int incr) 65 { 66 struct sctp_cwnd_log sctp_clog; 67 68 sctp_clog.x.sb.stcb = stcb; 69 sctp_clog.x.sb.so_sbcc = sb->sb_cc; 70 if (stcb) 71 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc; 72 else 73 sctp_clog.x.sb.stcb_sbcc = 0; 74 sctp_clog.x.sb.incr = incr; 75 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 76 SCTP_LOG_EVENT_SB, 77 from, 78 sctp_clog.x.misc.log1, 79 sctp_clog.x.misc.log2, 80 sctp_clog.x.misc.log3, 81 sctp_clog.x.misc.log4); 82 } 83 84 void 85 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc) 86 { 87 struct sctp_cwnd_log sctp_clog; 88 89 sctp_clog.x.close.inp = (void *)inp; 90 sctp_clog.x.close.sctp_flags = inp->sctp_flags; 91 if (stcb) { 92 sctp_clog.x.close.stcb = (void *)stcb; 93 sctp_clog.x.close.state = (uint16_t) stcb->asoc.state; 94 } else { 95 sctp_clog.x.close.stcb = 0; 96 sctp_clog.x.close.state = 0; 97 } 98 sctp_clog.x.close.loc = loc; 99 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 100 SCTP_LOG_EVENT_CLOSE, 101 0, 102 sctp_clog.x.misc.log1, 103 sctp_clog.x.misc.log2, 104 sctp_clog.x.misc.log3, 105 sctp_clog.x.misc.log4); 106 } 107 108 109 void 110 rto_logging(struct sctp_nets *net, int from) 111 { 112 struct sctp_cwnd_log sctp_clog; 113 114 memset(&sctp_clog, 0, sizeof(sctp_clog)); 115 sctp_clog.x.rto.net = (void *)net; 116 sctp_clog.x.rto.rtt = net->rtt / 1000; 117 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 118 SCTP_LOG_EVENT_RTT, 119 from, 120 sctp_clog.x.misc.log1, 121 sctp_clog.x.misc.log2, 122 sctp_clog.x.misc.log3, 123 sctp_clog.x.misc.log4); 124 } 125 126 void 127 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from) 128 { 129 struct sctp_cwnd_log sctp_clog; 130 131 sctp_clog.x.strlog.stcb = stcb; 132 sctp_clog.x.strlog.n_tsn = tsn; 133 sctp_clog.x.strlog.n_sseq = sseq; 134 sctp_clog.x.strlog.e_tsn = 0; 135 sctp_clog.x.strlog.e_sseq = 0; 136 sctp_clog.x.strlog.strm = stream; 137 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 138 SCTP_LOG_EVENT_STRM, 139 from, 140 sctp_clog.x.misc.log1, 141 sctp_clog.x.misc.log2, 142 sctp_clog.x.misc.log3, 143 sctp_clog.x.misc.log4); 144 } 145 146 void 147 sctp_log_nagle_event(struct sctp_tcb *stcb, int action) 148 { 149 struct sctp_cwnd_log sctp_clog; 150 151 sctp_clog.x.nagle.stcb = (void *)stcb; 152 sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight; 153 sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size; 154 sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue; 155 sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count; 156 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 157 SCTP_LOG_EVENT_NAGLE, 158 action, 159 sctp_clog.x.misc.log1, 160 sctp_clog.x.misc.log2, 161 sctp_clog.x.misc.log3, 162 sctp_clog.x.misc.log4); 163 } 164 165 void 166 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from) 167 { 168 struct sctp_cwnd_log sctp_clog; 169 170 sctp_clog.x.sack.cumack = cumack; 171 sctp_clog.x.sack.oldcumack = old_cumack; 172 sctp_clog.x.sack.tsn = tsn; 173 sctp_clog.x.sack.numGaps = gaps; 174 sctp_clog.x.sack.numDups = dups; 175 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 176 SCTP_LOG_EVENT_SACK, 177 from, 178 sctp_clog.x.misc.log1, 179 sctp_clog.x.misc.log2, 180 sctp_clog.x.misc.log3, 181 sctp_clog.x.misc.log4); 182 } 183 184 void 185 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from) 186 { 187 struct sctp_cwnd_log sctp_clog; 188 189 memset(&sctp_clog, 0, sizeof(sctp_clog)); 190 sctp_clog.x.map.base = map; 191 sctp_clog.x.map.cum = cum; 192 sctp_clog.x.map.high = high; 193 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 194 SCTP_LOG_EVENT_MAP, 195 from, 196 sctp_clog.x.misc.log1, 197 sctp_clog.x.misc.log2, 198 sctp_clog.x.misc.log3, 199 sctp_clog.x.misc.log4); 200 } 201 202 void 203 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, 204 int from) 205 { 206 struct sctp_cwnd_log sctp_clog; 207 208 memset(&sctp_clog, 0, sizeof(sctp_clog)); 209 sctp_clog.x.fr.largest_tsn = biggest_tsn; 210 sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn; 211 sctp_clog.x.fr.tsn = tsn; 212 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 213 SCTP_LOG_EVENT_FR, 214 from, 215 sctp_clog.x.misc.log1, 216 sctp_clog.x.misc.log2, 217 sctp_clog.x.misc.log3, 218 sctp_clog.x.misc.log4); 219 } 220 221 void 222 sctp_log_mb(struct mbuf *m, int from) 223 { 224 struct sctp_cwnd_log sctp_clog; 225 226 sctp_clog.x.mb.mp = m; 227 sctp_clog.x.mb.mbuf_flags = (uint8_t) (SCTP_BUF_GET_FLAGS(m)); 228 sctp_clog.x.mb.size = (uint16_t) (SCTP_BUF_LEN(m)); 229 sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0); 230 if (SCTP_BUF_IS_EXTENDED(m)) { 231 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m); 232 sctp_clog.x.mb.refcnt = (uint8_t) (SCTP_BUF_EXTEND_REFCNT(m)); 233 } else { 234 sctp_clog.x.mb.ext = 0; 235 sctp_clog.x.mb.refcnt = 0; 236 } 237 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 238 SCTP_LOG_EVENT_MBUF, 239 from, 240 sctp_clog.x.misc.log1, 241 sctp_clog.x.misc.log2, 242 sctp_clog.x.misc.log3, 243 sctp_clog.x.misc.log4); 244 } 245 246 void 247 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, 248 int from) 249 { 250 struct sctp_cwnd_log sctp_clog; 251 252 if (control == NULL) { 253 SCTP_PRINTF("Gak log of NULL?\n"); 254 return; 255 } 256 sctp_clog.x.strlog.stcb = control->stcb; 257 sctp_clog.x.strlog.n_tsn = control->sinfo_tsn; 258 sctp_clog.x.strlog.n_sseq = control->sinfo_ssn; 259 sctp_clog.x.strlog.strm = control->sinfo_stream; 260 if (poschk != NULL) { 261 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn; 262 sctp_clog.x.strlog.e_sseq = poschk->sinfo_ssn; 263 } else { 264 sctp_clog.x.strlog.e_tsn = 0; 265 sctp_clog.x.strlog.e_sseq = 0; 266 } 267 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 268 SCTP_LOG_EVENT_STRM, 269 from, 270 sctp_clog.x.misc.log1, 271 sctp_clog.x.misc.log2, 272 sctp_clog.x.misc.log3, 273 sctp_clog.x.misc.log4); 274 } 275 276 void 277 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from) 278 { 279 struct sctp_cwnd_log sctp_clog; 280 281 sctp_clog.x.cwnd.net = net; 282 if (stcb->asoc.send_queue_cnt > 255) 283 sctp_clog.x.cwnd.cnt_in_send = 255; 284 else 285 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt; 286 if (stcb->asoc.stream_queue_cnt > 255) 287 sctp_clog.x.cwnd.cnt_in_str = 255; 288 else 289 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt; 290 291 if (net) { 292 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd; 293 sctp_clog.x.cwnd.inflight = net->flight_size; 294 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack; 295 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack; 296 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack; 297 } 298 if (SCTP_CWNDLOG_PRESEND == from) { 299 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd; 300 } 301 sctp_clog.x.cwnd.cwnd_augment = augment; 302 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 303 SCTP_LOG_EVENT_CWND, 304 from, 305 sctp_clog.x.misc.log1, 306 sctp_clog.x.misc.log2, 307 sctp_clog.x.misc.log3, 308 sctp_clog.x.misc.log4); 309 } 310 311 void 312 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from) 313 { 314 struct sctp_cwnd_log sctp_clog; 315 316 memset(&sctp_clog, 0, sizeof(sctp_clog)); 317 if (inp) { 318 sctp_clog.x.lock.sock = (void *)inp->sctp_socket; 319 320 } else { 321 sctp_clog.x.lock.sock = (void *)NULL; 322 } 323 sctp_clog.x.lock.inp = (void *)inp; 324 if (stcb) { 325 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx); 326 } else { 327 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN; 328 } 329 if (inp) { 330 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx); 331 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx); 332 } else { 333 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN; 334 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN; 335 } 336 sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx)); 337 if (inp && (inp->sctp_socket)) { 338 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx)); 339 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx)); 340 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx)); 341 } else { 342 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN; 343 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN; 344 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN; 345 } 346 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 347 SCTP_LOG_LOCK_EVENT, 348 from, 349 sctp_clog.x.misc.log1, 350 sctp_clog.x.misc.log2, 351 sctp_clog.x.misc.log3, 352 sctp_clog.x.misc.log4); 353 } 354 355 void 356 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from) 357 { 358 struct sctp_cwnd_log sctp_clog; 359 360 memset(&sctp_clog, 0, sizeof(sctp_clog)); 361 sctp_clog.x.cwnd.net = net; 362 sctp_clog.x.cwnd.cwnd_new_value = error; 363 sctp_clog.x.cwnd.inflight = net->flight_size; 364 sctp_clog.x.cwnd.cwnd_augment = burst; 365 if (stcb->asoc.send_queue_cnt > 255) 366 sctp_clog.x.cwnd.cnt_in_send = 255; 367 else 368 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt; 369 if (stcb->asoc.stream_queue_cnt > 255) 370 sctp_clog.x.cwnd.cnt_in_str = 255; 371 else 372 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt; 373 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 374 SCTP_LOG_EVENT_MAXBURST, 375 from, 376 sctp_clog.x.misc.log1, 377 sctp_clog.x.misc.log2, 378 sctp_clog.x.misc.log3, 379 sctp_clog.x.misc.log4); 380 } 381 382 void 383 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead) 384 { 385 struct sctp_cwnd_log sctp_clog; 386 387 sctp_clog.x.rwnd.rwnd = peers_rwnd; 388 sctp_clog.x.rwnd.send_size = snd_size; 389 sctp_clog.x.rwnd.overhead = overhead; 390 sctp_clog.x.rwnd.new_rwnd = 0; 391 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 392 SCTP_LOG_EVENT_RWND, 393 from, 394 sctp_clog.x.misc.log1, 395 sctp_clog.x.misc.log2, 396 sctp_clog.x.misc.log3, 397 sctp_clog.x.misc.log4); 398 } 399 400 void 401 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval) 402 { 403 struct sctp_cwnd_log sctp_clog; 404 405 sctp_clog.x.rwnd.rwnd = peers_rwnd; 406 sctp_clog.x.rwnd.send_size = flight_size; 407 sctp_clog.x.rwnd.overhead = overhead; 408 sctp_clog.x.rwnd.new_rwnd = a_rwndval; 409 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 410 SCTP_LOG_EVENT_RWND, 411 from, 412 sctp_clog.x.misc.log1, 413 sctp_clog.x.misc.log2, 414 sctp_clog.x.misc.log3, 415 sctp_clog.x.misc.log4); 416 } 417 418 void 419 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt) 420 { 421 struct sctp_cwnd_log sctp_clog; 422 423 sctp_clog.x.mbcnt.total_queue_size = total_oq; 424 sctp_clog.x.mbcnt.size_change = book; 425 sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q; 426 sctp_clog.x.mbcnt.mbcnt_change = mbcnt; 427 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 428 SCTP_LOG_EVENT_MBCNT, 429 from, 430 sctp_clog.x.misc.log1, 431 sctp_clog.x.misc.log2, 432 sctp_clog.x.misc.log3, 433 sctp_clog.x.misc.log4); 434 } 435 436 void 437 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d) 438 { 439 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 440 SCTP_LOG_MISC_EVENT, 441 from, 442 a, b, c, d); 443 } 444 445 void 446 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from) 447 { 448 struct sctp_cwnd_log sctp_clog; 449 450 sctp_clog.x.wake.stcb = (void *)stcb; 451 sctp_clog.x.wake.wake_cnt = wake_cnt; 452 sctp_clog.x.wake.flight = stcb->asoc.total_flight_count; 453 sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt; 454 sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt; 455 456 if (stcb->asoc.stream_queue_cnt < 0xff) 457 sctp_clog.x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt; 458 else 459 sctp_clog.x.wake.stream_qcnt = 0xff; 460 461 if (stcb->asoc.chunks_on_out_queue < 0xff) 462 sctp_clog.x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue; 463 else 464 sctp_clog.x.wake.chunks_on_oque = 0xff; 465 466 sctp_clog.x.wake.sctpflags = 0; 467 /* set in the defered mode stuff */ 468 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE) 469 sctp_clog.x.wake.sctpflags |= 1; 470 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT) 471 sctp_clog.x.wake.sctpflags |= 2; 472 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT) 473 sctp_clog.x.wake.sctpflags |= 4; 474 /* what about the sb */ 475 if (stcb->sctp_socket) { 476 struct socket *so = stcb->sctp_socket; 477 478 sctp_clog.x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff)); 479 } else { 480 sctp_clog.x.wake.sbflags = 0xff; 481 } 482 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 483 SCTP_LOG_EVENT_WAKE, 484 from, 485 sctp_clog.x.misc.log1, 486 sctp_clog.x.misc.log2, 487 sctp_clog.x.misc.log3, 488 sctp_clog.x.misc.log4); 489 } 490 491 void 492 sctp_log_block(uint8_t from, struct sctp_association *asoc, int sendlen) 493 { 494 struct sctp_cwnd_log sctp_clog; 495 496 sctp_clog.x.blk.onsb = asoc->total_output_queue_size; 497 sctp_clog.x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt); 498 sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd; 499 sctp_clog.x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt; 500 sctp_clog.x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue; 501 sctp_clog.x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024); 502 sctp_clog.x.blk.sndlen = sendlen; 503 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 504 SCTP_LOG_EVENT_BLOCK, 505 from, 506 sctp_clog.x.misc.log1, 507 sctp_clog.x.misc.log2, 508 sctp_clog.x.misc.log3, 509 sctp_clog.x.misc.log4); 510 } 511 512 int 513 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED) 514 { 515 /* May need to fix this if ktrdump does not work */ 516 return (0); 517 } 518 519 #ifdef SCTP_AUDITING_ENABLED 520 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2]; 521 static int sctp_audit_indx = 0; 522 523 static 524 void 525 sctp_print_audit_report(void) 526 { 527 int i; 528 int cnt; 529 530 cnt = 0; 531 for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) { 532 if ((sctp_audit_data[i][0] == 0xe0) && 533 (sctp_audit_data[i][1] == 0x01)) { 534 cnt = 0; 535 SCTP_PRINTF("\n"); 536 } else if (sctp_audit_data[i][0] == 0xf0) { 537 cnt = 0; 538 SCTP_PRINTF("\n"); 539 } else if ((sctp_audit_data[i][0] == 0xc0) && 540 (sctp_audit_data[i][1] == 0x01)) { 541 SCTP_PRINTF("\n"); 542 cnt = 0; 543 } 544 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0], 545 (uint32_t) sctp_audit_data[i][1]); 546 cnt++; 547 if ((cnt % 14) == 0) 548 SCTP_PRINTF("\n"); 549 } 550 for (i = 0; i < sctp_audit_indx; i++) { 551 if ((sctp_audit_data[i][0] == 0xe0) && 552 (sctp_audit_data[i][1] == 0x01)) { 553 cnt = 0; 554 SCTP_PRINTF("\n"); 555 } else if (sctp_audit_data[i][0] == 0xf0) { 556 cnt = 0; 557 SCTP_PRINTF("\n"); 558 } else if ((sctp_audit_data[i][0] == 0xc0) && 559 (sctp_audit_data[i][1] == 0x01)) { 560 SCTP_PRINTF("\n"); 561 cnt = 0; 562 } 563 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0], 564 (uint32_t) sctp_audit_data[i][1]); 565 cnt++; 566 if ((cnt % 14) == 0) 567 SCTP_PRINTF("\n"); 568 } 569 SCTP_PRINTF("\n"); 570 } 571 572 void 573 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 574 struct sctp_nets *net) 575 { 576 int resend_cnt, tot_out, rep, tot_book_cnt; 577 struct sctp_nets *lnet; 578 struct sctp_tmit_chunk *chk; 579 580 sctp_audit_data[sctp_audit_indx][0] = 0xAA; 581 sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from; 582 sctp_audit_indx++; 583 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 584 sctp_audit_indx = 0; 585 } 586 if (inp == NULL) { 587 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 588 sctp_audit_data[sctp_audit_indx][1] = 0x01; 589 sctp_audit_indx++; 590 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 591 sctp_audit_indx = 0; 592 } 593 return; 594 } 595 if (stcb == NULL) { 596 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 597 sctp_audit_data[sctp_audit_indx][1] = 0x02; 598 sctp_audit_indx++; 599 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 600 sctp_audit_indx = 0; 601 } 602 return; 603 } 604 sctp_audit_data[sctp_audit_indx][0] = 0xA1; 605 sctp_audit_data[sctp_audit_indx][1] = 606 (0x000000ff & stcb->asoc.sent_queue_retran_cnt); 607 sctp_audit_indx++; 608 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 609 sctp_audit_indx = 0; 610 } 611 rep = 0; 612 tot_book_cnt = 0; 613 resend_cnt = tot_out = 0; 614 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 615 if (chk->sent == SCTP_DATAGRAM_RESEND) { 616 resend_cnt++; 617 } else if (chk->sent < SCTP_DATAGRAM_RESEND) { 618 tot_out += chk->book_size; 619 tot_book_cnt++; 620 } 621 } 622 if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) { 623 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 624 sctp_audit_data[sctp_audit_indx][1] = 0xA1; 625 sctp_audit_indx++; 626 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 627 sctp_audit_indx = 0; 628 } 629 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n", 630 resend_cnt, stcb->asoc.sent_queue_retran_cnt); 631 rep = 1; 632 stcb->asoc.sent_queue_retran_cnt = resend_cnt; 633 sctp_audit_data[sctp_audit_indx][0] = 0xA2; 634 sctp_audit_data[sctp_audit_indx][1] = 635 (0x000000ff & stcb->asoc.sent_queue_retran_cnt); 636 sctp_audit_indx++; 637 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 638 sctp_audit_indx = 0; 639 } 640 } 641 if (tot_out != stcb->asoc.total_flight) { 642 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 643 sctp_audit_data[sctp_audit_indx][1] = 0xA2; 644 sctp_audit_indx++; 645 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 646 sctp_audit_indx = 0; 647 } 648 rep = 1; 649 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out, 650 (int)stcb->asoc.total_flight); 651 stcb->asoc.total_flight = tot_out; 652 } 653 if (tot_book_cnt != stcb->asoc.total_flight_count) { 654 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 655 sctp_audit_data[sctp_audit_indx][1] = 0xA5; 656 sctp_audit_indx++; 657 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 658 sctp_audit_indx = 0; 659 } 660 rep = 1; 661 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt); 662 663 stcb->asoc.total_flight_count = tot_book_cnt; 664 } 665 tot_out = 0; 666 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) { 667 tot_out += lnet->flight_size; 668 } 669 if (tot_out != stcb->asoc.total_flight) { 670 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 671 sctp_audit_data[sctp_audit_indx][1] = 0xA3; 672 sctp_audit_indx++; 673 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 674 sctp_audit_indx = 0; 675 } 676 rep = 1; 677 SCTP_PRINTF("real flight:%d net total was %d\n", 678 stcb->asoc.total_flight, tot_out); 679 /* now corrective action */ 680 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) { 681 682 tot_out = 0; 683 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 684 if ((chk->whoTo == lnet) && 685 (chk->sent < SCTP_DATAGRAM_RESEND)) { 686 tot_out += chk->book_size; 687 } 688 } 689 if (lnet->flight_size != tot_out) { 690 SCTP_PRINTF("net:%p flight was %d corrected to %d\n", 691 lnet, lnet->flight_size, 692 tot_out); 693 lnet->flight_size = tot_out; 694 } 695 } 696 } 697 if (rep) { 698 sctp_print_audit_report(); 699 } 700 } 701 702 void 703 sctp_audit_log(uint8_t ev, uint8_t fd) 704 { 705 706 sctp_audit_data[sctp_audit_indx][0] = ev; 707 sctp_audit_data[sctp_audit_indx][1] = fd; 708 sctp_audit_indx++; 709 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 710 sctp_audit_indx = 0; 711 } 712 } 713 714 #endif 715 716 /* 717 * sctp_stop_timers_for_shutdown() should be called 718 * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT 719 * state to make sure that all timers are stopped. 720 */ 721 void 722 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb) 723 { 724 struct sctp_association *asoc; 725 struct sctp_nets *net; 726 727 asoc = &stcb->asoc; 728 729 (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer); 730 (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer); 731 (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer); 732 (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer); 733 (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer); 734 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 735 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer); 736 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer); 737 } 738 } 739 740 /* 741 * a list of sizes based on typical mtu's, used only if next hop size not 742 * returned. 743 */ 744 static uint32_t sctp_mtu_sizes[] = { 745 68, 746 296, 747 508, 748 512, 749 544, 750 576, 751 1006, 752 1492, 753 1500, 754 1536, 755 2002, 756 2048, 757 4352, 758 4464, 759 8166, 760 17914, 761 32000, 762 65535 763 }; 764 765 /* 766 * Return the largest MTU smaller than val. If there is no 767 * entry, just return val. 768 */ 769 uint32_t 770 sctp_get_prev_mtu(uint32_t val) 771 { 772 uint32_t i; 773 774 if (val <= sctp_mtu_sizes[0]) { 775 return (val); 776 } 777 for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) { 778 if (val <= sctp_mtu_sizes[i]) { 779 break; 780 } 781 } 782 return (sctp_mtu_sizes[i - 1]); 783 } 784 785 /* 786 * Return the smallest MTU larger than val. If there is no 787 * entry, just return val. 788 */ 789 uint32_t 790 sctp_get_next_mtu(uint32_t val) 791 { 792 /* select another MTU that is just bigger than this one */ 793 uint32_t i; 794 795 for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) { 796 if (val < sctp_mtu_sizes[i]) { 797 return (sctp_mtu_sizes[i]); 798 } 799 } 800 return (val); 801 } 802 803 void 804 sctp_fill_random_store(struct sctp_pcb *m) 805 { 806 /* 807 * Here we use the MD5/SHA-1 to hash with our good randomNumbers and 808 * our counter. The result becomes our good random numbers and we 809 * then setup to give these out. Note that we do no locking to 810 * protect this. This is ok, since if competing folks call this we 811 * will get more gobbled gook in the random store which is what we 812 * want. There is a danger that two guys will use the same random 813 * numbers, but thats ok too since that is random as well :-> 814 */ 815 m->store_at = 0; 816 (void)sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers, 817 sizeof(m->random_numbers), (uint8_t *) & m->random_counter, 818 sizeof(m->random_counter), (uint8_t *) m->random_store); 819 m->random_counter++; 820 } 821 822 uint32_t 823 sctp_select_initial_TSN(struct sctp_pcb *inp) 824 { 825 /* 826 * A true implementation should use random selection process to get 827 * the initial stream sequence number, using RFC1750 as a good 828 * guideline 829 */ 830 uint32_t x, *xp; 831 uint8_t *p; 832 int store_at, new_store; 833 834 if (inp->initial_sequence_debug != 0) { 835 uint32_t ret; 836 837 ret = inp->initial_sequence_debug; 838 inp->initial_sequence_debug++; 839 return (ret); 840 } 841 retry: 842 store_at = inp->store_at; 843 new_store = store_at + sizeof(uint32_t); 844 if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) { 845 new_store = 0; 846 } 847 if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) { 848 goto retry; 849 } 850 if (new_store == 0) { 851 /* Refill the random store */ 852 sctp_fill_random_store(inp); 853 } 854 p = &inp->random_store[store_at]; 855 xp = (uint32_t *) p; 856 x = *xp; 857 return (x); 858 } 859 860 uint32_t 861 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check) 862 { 863 uint32_t x; 864 struct timeval now; 865 866 if (check) { 867 (void)SCTP_GETTIME_TIMEVAL(&now); 868 } 869 for (;;) { 870 x = sctp_select_initial_TSN(&inp->sctp_ep); 871 if (x == 0) { 872 /* we never use 0 */ 873 continue; 874 } 875 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) { 876 break; 877 } 878 } 879 return (x); 880 } 881 882 int 883 sctp_init_asoc(struct sctp_inpcb *m, struct sctp_tcb *stcb, 884 uint32_t override_tag, uint32_t vrf_id) 885 { 886 struct sctp_association *asoc; 887 888 /* 889 * Anything set to zero is taken care of by the allocation routine's 890 * bzero 891 */ 892 893 /* 894 * Up front select what scoping to apply on addresses I tell my peer 895 * Not sure what to do with these right now, we will need to come up 896 * with a way to set them. We may need to pass them through from the 897 * caller in the sctp_aloc_assoc() function. 898 */ 899 int i; 900 901 asoc = &stcb->asoc; 902 /* init all variables to a known value. */ 903 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE); 904 asoc->max_burst = m->sctp_ep.max_burst; 905 asoc->fr_max_burst = m->sctp_ep.fr_max_burst; 906 asoc->heart_beat_delay = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]); 907 asoc->cookie_life = m->sctp_ep.def_cookie_life; 908 asoc->sctp_cmt_on_off = m->sctp_cmt_on_off; 909 asoc->ecn_allowed = m->sctp_ecn_enable; 910 asoc->sctp_nr_sack_on_off = (uint8_t) SCTP_BASE_SYSCTL(sctp_nr_sack_on_off); 911 asoc->sctp_cmt_pf = (uint8_t) 0; 912 asoc->sctp_frag_point = m->sctp_frag_point; 913 asoc->sctp_features = m->sctp_features; 914 asoc->default_dscp = m->sctp_ep.default_dscp; 915 #ifdef INET6 916 if (m->sctp_ep.default_flowlabel) { 917 asoc->default_flowlabel = m->sctp_ep.default_flowlabel; 918 } else { 919 if (m->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) { 920 asoc->default_flowlabel = sctp_select_initial_TSN(&m->sctp_ep); 921 asoc->default_flowlabel &= 0x000fffff; 922 asoc->default_flowlabel |= 0x80000000; 923 } else { 924 asoc->default_flowlabel = 0; 925 } 926 } 927 #endif 928 asoc->sb_send_resv = 0; 929 if (override_tag) { 930 asoc->my_vtag = override_tag; 931 } else { 932 asoc->my_vtag = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 1); 933 } 934 /* Get the nonce tags */ 935 asoc->my_vtag_nonce = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 0); 936 asoc->peer_vtag_nonce = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 0); 937 asoc->vrf_id = vrf_id; 938 939 #ifdef SCTP_ASOCLOG_OF_TSNS 940 asoc->tsn_in_at = 0; 941 asoc->tsn_out_at = 0; 942 asoc->tsn_in_wrapped = 0; 943 asoc->tsn_out_wrapped = 0; 944 asoc->cumack_log_at = 0; 945 asoc->cumack_log_atsnt = 0; 946 #endif 947 #ifdef SCTP_FS_SPEC_LOG 948 asoc->fs_index = 0; 949 #endif 950 asoc->refcnt = 0; 951 asoc->assoc_up_sent = 0; 952 asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq = 953 sctp_select_initial_TSN(&m->sctp_ep); 954 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1; 955 /* we are optimisitic here */ 956 asoc->peer_supports_pktdrop = 1; 957 asoc->peer_supports_nat = 0; 958 asoc->sent_queue_retran_cnt = 0; 959 960 /* for CMT */ 961 asoc->last_net_cmt_send_started = NULL; 962 963 /* This will need to be adjusted */ 964 asoc->last_acked_seq = asoc->init_seq_number - 1; 965 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 966 asoc->asconf_seq_in = asoc->last_acked_seq; 967 968 /* here we are different, we hold the next one we expect */ 969 asoc->str_reset_seq_in = asoc->last_acked_seq + 1; 970 971 asoc->initial_init_rto_max = m->sctp_ep.initial_init_rto_max; 972 asoc->initial_rto = m->sctp_ep.initial_rto; 973 974 asoc->max_init_times = m->sctp_ep.max_init_times; 975 asoc->max_send_times = m->sctp_ep.max_send_times; 976 asoc->def_net_failure = m->sctp_ep.def_net_failure; 977 asoc->def_net_pf_threshold = m->sctp_ep.def_net_pf_threshold; 978 asoc->free_chunk_cnt = 0; 979 980 asoc->iam_blocking = 0; 981 asoc->context = m->sctp_context; 982 asoc->local_strreset_support = m->local_strreset_support; 983 asoc->def_send = m->def_send; 984 asoc->delayed_ack = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]); 985 asoc->sack_freq = m->sctp_ep.sctp_sack_freq; 986 asoc->pr_sctp_cnt = 0; 987 asoc->total_output_queue_size = 0; 988 989 if (m->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 990 struct in6pcb *inp6; 991 992 /* Its a V6 socket */ 993 inp6 = (struct in6pcb *)m; 994 asoc->ipv6_addr_legal = 1; 995 /* Now look at the binding flag to see if V4 will be legal */ 996 if (SCTP_IPV6_V6ONLY(inp6) == 0) { 997 asoc->ipv4_addr_legal = 1; 998 } else { 999 /* V4 addresses are NOT legal on the association */ 1000 asoc->ipv4_addr_legal = 0; 1001 } 1002 } else { 1003 /* Its a V4 socket, no - V6 */ 1004 asoc->ipv4_addr_legal = 1; 1005 asoc->ipv6_addr_legal = 0; 1006 } 1007 1008 asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(m->sctp_socket), SCTP_MINIMAL_RWND); 1009 asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(m->sctp_socket); 1010 1011 asoc->smallest_mtu = m->sctp_frag_point; 1012 asoc->minrto = m->sctp_ep.sctp_minrto; 1013 asoc->maxrto = m->sctp_ep.sctp_maxrto; 1014 1015 asoc->locked_on_sending = NULL; 1016 asoc->stream_locked_on = 0; 1017 asoc->ecn_echo_cnt_onq = 0; 1018 asoc->stream_locked = 0; 1019 1020 asoc->send_sack = 1; 1021 1022 LIST_INIT(&asoc->sctp_restricted_addrs); 1023 1024 TAILQ_INIT(&asoc->nets); 1025 TAILQ_INIT(&asoc->pending_reply_queue); 1026 TAILQ_INIT(&asoc->asconf_ack_sent); 1027 /* Setup to fill the hb random cache at first HB */ 1028 asoc->hb_random_idx = 4; 1029 1030 asoc->sctp_autoclose_ticks = m->sctp_ep.auto_close_time; 1031 1032 stcb->asoc.congestion_control_module = m->sctp_ep.sctp_default_cc_module; 1033 stcb->asoc.cc_functions = sctp_cc_functions[m->sctp_ep.sctp_default_cc_module]; 1034 1035 stcb->asoc.stream_scheduling_module = m->sctp_ep.sctp_default_ss_module; 1036 stcb->asoc.ss_functions = sctp_ss_functions[m->sctp_ep.sctp_default_ss_module]; 1037 1038 /* 1039 * Now the stream parameters, here we allocate space for all streams 1040 * that we request by default. 1041 */ 1042 asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams = 1043 m->sctp_ep.pre_open_stream_count; 1044 SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *, 1045 asoc->streamoutcnt * sizeof(struct sctp_stream_out), 1046 SCTP_M_STRMO); 1047 if (asoc->strmout == NULL) { 1048 /* big trouble no memory */ 1049 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 1050 return (ENOMEM); 1051 } 1052 for (i = 0; i < asoc->streamoutcnt; i++) { 1053 /* 1054 * inbound side must be set to 0xffff, also NOTE when we get 1055 * the INIT-ACK back (for INIT sender) we MUST reduce the 1056 * count (streamoutcnt) but first check if we sent to any of 1057 * the upper streams that were dropped (if some were). Those 1058 * that were dropped must be notified to the upper layer as 1059 * failed to send. 1060 */ 1061 asoc->strmout[i].next_sequence_sent = 0x0; 1062 TAILQ_INIT(&asoc->strmout[i].outqueue); 1063 asoc->strmout[i].stream_no = i; 1064 asoc->strmout[i].last_msg_incomplete = 0; 1065 asoc->ss_functions.sctp_ss_init_stream(&asoc->strmout[i], NULL); 1066 } 1067 asoc->ss_functions.sctp_ss_init(stcb, asoc, 0); 1068 1069 /* Now the mapping array */ 1070 asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY; 1071 SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size, 1072 SCTP_M_MAP); 1073 if (asoc->mapping_array == NULL) { 1074 SCTP_FREE(asoc->strmout, SCTP_M_STRMO); 1075 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 1076 return (ENOMEM); 1077 } 1078 memset(asoc->mapping_array, 0, asoc->mapping_array_size); 1079 SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size, 1080 SCTP_M_MAP); 1081 if (asoc->nr_mapping_array == NULL) { 1082 SCTP_FREE(asoc->strmout, SCTP_M_STRMO); 1083 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP); 1084 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 1085 return (ENOMEM); 1086 } 1087 memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size); 1088 1089 /* Now the init of the other outqueues */ 1090 TAILQ_INIT(&asoc->free_chunks); 1091 TAILQ_INIT(&asoc->control_send_queue); 1092 TAILQ_INIT(&asoc->asconf_send_queue); 1093 TAILQ_INIT(&asoc->send_queue); 1094 TAILQ_INIT(&asoc->sent_queue); 1095 TAILQ_INIT(&asoc->reasmqueue); 1096 TAILQ_INIT(&asoc->resetHead); 1097 asoc->max_inbound_streams = m->sctp_ep.max_open_streams_intome; 1098 TAILQ_INIT(&asoc->asconf_queue); 1099 /* authentication fields */ 1100 asoc->authinfo.random = NULL; 1101 asoc->authinfo.active_keyid = 0; 1102 asoc->authinfo.assoc_key = NULL; 1103 asoc->authinfo.assoc_keyid = 0; 1104 asoc->authinfo.recv_key = NULL; 1105 asoc->authinfo.recv_keyid = 0; 1106 LIST_INIT(&asoc->shared_keys); 1107 asoc->marked_retrans = 0; 1108 asoc->port = m->sctp_ep.port; 1109 asoc->timoinit = 0; 1110 asoc->timodata = 0; 1111 asoc->timosack = 0; 1112 asoc->timoshutdown = 0; 1113 asoc->timoheartbeat = 0; 1114 asoc->timocookie = 0; 1115 asoc->timoshutdownack = 0; 1116 (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time); 1117 asoc->discontinuity_time = asoc->start_time; 1118 /* 1119 * sa_ignore MEMLEAK {memory is put in the assoc mapping array and 1120 * freed later when the association is freed. 1121 */ 1122 return (0); 1123 } 1124 1125 void 1126 sctp_print_mapping_array(struct sctp_association *asoc) 1127 { 1128 unsigned int i, limit; 1129 1130 printf("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n", 1131 asoc->mapping_array_size, 1132 asoc->mapping_array_base_tsn, 1133 asoc->cumulative_tsn, 1134 asoc->highest_tsn_inside_map, 1135 asoc->highest_tsn_inside_nr_map); 1136 for (limit = asoc->mapping_array_size; limit > 1; limit--) { 1137 if (asoc->mapping_array[limit - 1] != 0) { 1138 break; 1139 } 1140 } 1141 printf("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit); 1142 for (i = 0; i < limit; i++) { 1143 printf("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n'); 1144 } 1145 if (limit % 16) 1146 printf("\n"); 1147 for (limit = asoc->mapping_array_size; limit > 1; limit--) { 1148 if (asoc->nr_mapping_array[limit - 1]) { 1149 break; 1150 } 1151 } 1152 printf("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit); 1153 for (i = 0; i < limit; i++) { 1154 printf("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n'); 1155 } 1156 if (limit % 16) 1157 printf("\n"); 1158 } 1159 1160 int 1161 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed) 1162 { 1163 /* mapping array needs to grow */ 1164 uint8_t *new_array1, *new_array2; 1165 uint32_t new_size; 1166 1167 new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR); 1168 SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP); 1169 SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP); 1170 if ((new_array1 == NULL) || (new_array2 == NULL)) { 1171 /* can't get more, forget it */ 1172 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size); 1173 if (new_array1) { 1174 SCTP_FREE(new_array1, SCTP_M_MAP); 1175 } 1176 if (new_array2) { 1177 SCTP_FREE(new_array2, SCTP_M_MAP); 1178 } 1179 return (-1); 1180 } 1181 memset(new_array1, 0, new_size); 1182 memset(new_array2, 0, new_size); 1183 memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size); 1184 memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size); 1185 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP); 1186 SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP); 1187 asoc->mapping_array = new_array1; 1188 asoc->nr_mapping_array = new_array2; 1189 asoc->mapping_array_size = new_size; 1190 return (0); 1191 } 1192 1193 1194 static void 1195 sctp_iterator_work(struct sctp_iterator *it) 1196 { 1197 int iteration_count = 0; 1198 int inp_skip = 0; 1199 int first_in = 1; 1200 struct sctp_inpcb *tinp; 1201 1202 SCTP_INP_INFO_RLOCK(); 1203 SCTP_ITERATOR_LOCK(); 1204 if (it->inp) { 1205 SCTP_INP_RLOCK(it->inp); 1206 SCTP_INP_DECR_REF(it->inp); 1207 } 1208 if (it->inp == NULL) { 1209 /* iterator is complete */ 1210 done_with_iterator: 1211 SCTP_ITERATOR_UNLOCK(); 1212 SCTP_INP_INFO_RUNLOCK(); 1213 if (it->function_atend != NULL) { 1214 (*it->function_atend) (it->pointer, it->val); 1215 } 1216 SCTP_FREE(it, SCTP_M_ITER); 1217 return; 1218 } 1219 select_a_new_ep: 1220 if (first_in) { 1221 first_in = 0; 1222 } else { 1223 SCTP_INP_RLOCK(it->inp); 1224 } 1225 while (((it->pcb_flags) && 1226 ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) || 1227 ((it->pcb_features) && 1228 ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) { 1229 /* endpoint flags or features don't match, so keep looking */ 1230 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 1231 SCTP_INP_RUNLOCK(it->inp); 1232 goto done_with_iterator; 1233 } 1234 tinp = it->inp; 1235 it->inp = LIST_NEXT(it->inp, sctp_list); 1236 SCTP_INP_RUNLOCK(tinp); 1237 if (it->inp == NULL) { 1238 goto done_with_iterator; 1239 } 1240 SCTP_INP_RLOCK(it->inp); 1241 } 1242 /* now go through each assoc which is in the desired state */ 1243 if (it->done_current_ep == 0) { 1244 if (it->function_inp != NULL) 1245 inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val); 1246 it->done_current_ep = 1; 1247 } 1248 if (it->stcb == NULL) { 1249 /* run the per instance function */ 1250 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list); 1251 } 1252 if ((inp_skip) || it->stcb == NULL) { 1253 if (it->function_inp_end != NULL) { 1254 inp_skip = (*it->function_inp_end) (it->inp, 1255 it->pointer, 1256 it->val); 1257 } 1258 SCTP_INP_RUNLOCK(it->inp); 1259 goto no_stcb; 1260 } 1261 while (it->stcb) { 1262 SCTP_TCB_LOCK(it->stcb); 1263 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) { 1264 /* not in the right state... keep looking */ 1265 SCTP_TCB_UNLOCK(it->stcb); 1266 goto next_assoc; 1267 } 1268 /* see if we have limited out the iterator loop */ 1269 iteration_count++; 1270 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) { 1271 /* Pause to let others grab the lock */ 1272 atomic_add_int(&it->stcb->asoc.refcnt, 1); 1273 SCTP_TCB_UNLOCK(it->stcb); 1274 SCTP_INP_INCR_REF(it->inp); 1275 SCTP_INP_RUNLOCK(it->inp); 1276 SCTP_ITERATOR_UNLOCK(); 1277 SCTP_INP_INFO_RUNLOCK(); 1278 SCTP_INP_INFO_RLOCK(); 1279 SCTP_ITERATOR_LOCK(); 1280 if (sctp_it_ctl.iterator_flags) { 1281 /* We won't be staying here */ 1282 SCTP_INP_DECR_REF(it->inp); 1283 atomic_add_int(&it->stcb->asoc.refcnt, -1); 1284 if (sctp_it_ctl.iterator_flags & 1285 SCTP_ITERATOR_STOP_CUR_IT) { 1286 sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT; 1287 goto done_with_iterator; 1288 } 1289 if (sctp_it_ctl.iterator_flags & 1290 SCTP_ITERATOR_STOP_CUR_INP) { 1291 sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP; 1292 goto no_stcb; 1293 } 1294 /* If we reach here huh? */ 1295 printf("Unknown it ctl flag %x\n", 1296 sctp_it_ctl.iterator_flags); 1297 sctp_it_ctl.iterator_flags = 0; 1298 } 1299 SCTP_INP_RLOCK(it->inp); 1300 SCTP_INP_DECR_REF(it->inp); 1301 SCTP_TCB_LOCK(it->stcb); 1302 atomic_add_int(&it->stcb->asoc.refcnt, -1); 1303 iteration_count = 0; 1304 } 1305 /* run function on this one */ 1306 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val); 1307 1308 /* 1309 * we lie here, it really needs to have its own type but 1310 * first I must verify that this won't effect things :-0 1311 */ 1312 if (it->no_chunk_output == 0) 1313 sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED); 1314 1315 SCTP_TCB_UNLOCK(it->stcb); 1316 next_assoc: 1317 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist); 1318 if (it->stcb == NULL) { 1319 /* Run last function */ 1320 if (it->function_inp_end != NULL) { 1321 inp_skip = (*it->function_inp_end) (it->inp, 1322 it->pointer, 1323 it->val); 1324 } 1325 } 1326 } 1327 SCTP_INP_RUNLOCK(it->inp); 1328 no_stcb: 1329 /* done with all assocs on this endpoint, move on to next endpoint */ 1330 it->done_current_ep = 0; 1331 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 1332 it->inp = NULL; 1333 } else { 1334 it->inp = LIST_NEXT(it->inp, sctp_list); 1335 } 1336 if (it->inp == NULL) { 1337 goto done_with_iterator; 1338 } 1339 goto select_a_new_ep; 1340 } 1341 1342 void 1343 sctp_iterator_worker(void) 1344 { 1345 struct sctp_iterator *it, *nit; 1346 1347 /* This function is called with the WQ lock in place */ 1348 1349 sctp_it_ctl.iterator_running = 1; 1350 TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) { 1351 sctp_it_ctl.cur_it = it; 1352 /* now lets work on this one */ 1353 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr); 1354 SCTP_IPI_ITERATOR_WQ_UNLOCK(); 1355 CURVNET_SET(it->vn); 1356 sctp_iterator_work(it); 1357 sctp_it_ctl.cur_it = NULL; 1358 CURVNET_RESTORE(); 1359 SCTP_IPI_ITERATOR_WQ_LOCK(); 1360 /* sa_ignore FREED_MEMORY */ 1361 } 1362 sctp_it_ctl.iterator_running = 0; 1363 return; 1364 } 1365 1366 1367 static void 1368 sctp_handle_addr_wq(void) 1369 { 1370 /* deal with the ADDR wq from the rtsock calls */ 1371 struct sctp_laddr *wi, *nwi; 1372 struct sctp_asconf_iterator *asc; 1373 1374 SCTP_MALLOC(asc, struct sctp_asconf_iterator *, 1375 sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT); 1376 if (asc == NULL) { 1377 /* Try later, no memory */ 1378 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ, 1379 (struct sctp_inpcb *)NULL, 1380 (struct sctp_tcb *)NULL, 1381 (struct sctp_nets *)NULL); 1382 return; 1383 } 1384 LIST_INIT(&asc->list_of_work); 1385 asc->cnt = 0; 1386 1387 SCTP_WQ_ADDR_LOCK(); 1388 LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) { 1389 LIST_REMOVE(wi, sctp_nxt_addr); 1390 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr); 1391 asc->cnt++; 1392 } 1393 SCTP_WQ_ADDR_UNLOCK(); 1394 1395 if (asc->cnt == 0) { 1396 SCTP_FREE(asc, SCTP_M_ASC_IT); 1397 } else { 1398 (void)sctp_initiate_iterator(sctp_asconf_iterator_ep, 1399 sctp_asconf_iterator_stcb, 1400 NULL, /* No ep end for boundall */ 1401 SCTP_PCB_FLAGS_BOUNDALL, 1402 SCTP_PCB_ANY_FEATURES, 1403 SCTP_ASOC_ANY_STATE, 1404 (void *)asc, 0, 1405 sctp_asconf_iterator_end, NULL, 0); 1406 } 1407 } 1408 1409 void 1410 sctp_timeout_handler(void *t) 1411 { 1412 struct sctp_inpcb *inp; 1413 struct sctp_tcb *stcb; 1414 struct sctp_nets *net; 1415 struct sctp_timer *tmr; 1416 1417 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1418 struct socket *so; 1419 1420 #endif 1421 int did_output, type; 1422 1423 tmr = (struct sctp_timer *)t; 1424 inp = (struct sctp_inpcb *)tmr->ep; 1425 stcb = (struct sctp_tcb *)tmr->tcb; 1426 net = (struct sctp_nets *)tmr->net; 1427 CURVNET_SET((struct vnet *)tmr->vnet); 1428 did_output = 1; 1429 1430 #ifdef SCTP_AUDITING_ENABLED 1431 sctp_audit_log(0xF0, (uint8_t) tmr->type); 1432 sctp_auditing(3, inp, stcb, net); 1433 #endif 1434 1435 /* sanity checks... */ 1436 if (tmr->self != (void *)tmr) { 1437 /* 1438 * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n", 1439 * tmr); 1440 */ 1441 CURVNET_RESTORE(); 1442 return; 1443 } 1444 tmr->stopped_from = 0xa001; 1445 if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) { 1446 /* 1447 * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n", 1448 * tmr->type); 1449 */ 1450 CURVNET_RESTORE(); 1451 return; 1452 } 1453 tmr->stopped_from = 0xa002; 1454 if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) { 1455 CURVNET_RESTORE(); 1456 return; 1457 } 1458 /* if this is an iterator timeout, get the struct and clear inp */ 1459 tmr->stopped_from = 0xa003; 1460 type = tmr->type; 1461 if (inp) { 1462 SCTP_INP_INCR_REF(inp); 1463 if ((inp->sctp_socket == NULL) && 1464 ((tmr->type != SCTP_TIMER_TYPE_INPKILL) && 1465 (tmr->type != SCTP_TIMER_TYPE_INIT) && 1466 (tmr->type != SCTP_TIMER_TYPE_SEND) && 1467 (tmr->type != SCTP_TIMER_TYPE_RECV) && 1468 (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) && 1469 (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) && 1470 (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) && 1471 (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) && 1472 (tmr->type != SCTP_TIMER_TYPE_ASOCKILL)) 1473 ) { 1474 SCTP_INP_DECR_REF(inp); 1475 CURVNET_RESTORE(); 1476 return; 1477 } 1478 } 1479 tmr->stopped_from = 0xa004; 1480 if (stcb) { 1481 atomic_add_int(&stcb->asoc.refcnt, 1); 1482 if (stcb->asoc.state == 0) { 1483 atomic_add_int(&stcb->asoc.refcnt, -1); 1484 if (inp) { 1485 SCTP_INP_DECR_REF(inp); 1486 } 1487 CURVNET_RESTORE(); 1488 return; 1489 } 1490 } 1491 tmr->stopped_from = 0xa005; 1492 SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", tmr->type); 1493 if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) { 1494 if (inp) { 1495 SCTP_INP_DECR_REF(inp); 1496 } 1497 if (stcb) { 1498 atomic_add_int(&stcb->asoc.refcnt, -1); 1499 } 1500 CURVNET_RESTORE(); 1501 return; 1502 } 1503 tmr->stopped_from = 0xa006; 1504 1505 if (stcb) { 1506 SCTP_TCB_LOCK(stcb); 1507 atomic_add_int(&stcb->asoc.refcnt, -1); 1508 if ((tmr->type != SCTP_TIMER_TYPE_ASOCKILL) && 1509 ((stcb->asoc.state == 0) || 1510 (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) { 1511 SCTP_TCB_UNLOCK(stcb); 1512 if (inp) { 1513 SCTP_INP_DECR_REF(inp); 1514 } 1515 CURVNET_RESTORE(); 1516 return; 1517 } 1518 } 1519 /* record in stopped what t-o occured */ 1520 tmr->stopped_from = tmr->type; 1521 1522 /* mark as being serviced now */ 1523 if (SCTP_OS_TIMER_PENDING(&tmr->timer)) { 1524 /* 1525 * Callout has been rescheduled. 1526 */ 1527 goto get_out; 1528 } 1529 if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) { 1530 /* 1531 * Not active, so no action. 1532 */ 1533 goto get_out; 1534 } 1535 SCTP_OS_TIMER_DEACTIVATE(&tmr->timer); 1536 1537 /* call the handler for the appropriate timer type */ 1538 switch (tmr->type) { 1539 case SCTP_TIMER_TYPE_ZERO_COPY: 1540 if (inp == NULL) { 1541 break; 1542 } 1543 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) { 1544 SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket); 1545 } 1546 break; 1547 case SCTP_TIMER_TYPE_ZCOPY_SENDQ: 1548 if (inp == NULL) { 1549 break; 1550 } 1551 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) { 1552 SCTP_ZERO_COPY_SENDQ_EVENT(inp, inp->sctp_socket); 1553 } 1554 break; 1555 case SCTP_TIMER_TYPE_ADDR_WQ: 1556 sctp_handle_addr_wq(); 1557 break; 1558 case SCTP_TIMER_TYPE_SEND: 1559 if ((stcb == NULL) || (inp == NULL)) { 1560 break; 1561 } 1562 SCTP_STAT_INCR(sctps_timodata); 1563 stcb->asoc.timodata++; 1564 stcb->asoc.num_send_timers_up--; 1565 if (stcb->asoc.num_send_timers_up < 0) { 1566 stcb->asoc.num_send_timers_up = 0; 1567 } 1568 SCTP_TCB_LOCK_ASSERT(stcb); 1569 if (sctp_t3rxt_timer(inp, stcb, net)) { 1570 /* no need to unlock on tcb its gone */ 1571 1572 goto out_decr; 1573 } 1574 SCTP_TCB_LOCK_ASSERT(stcb); 1575 #ifdef SCTP_AUDITING_ENABLED 1576 sctp_auditing(4, inp, stcb, net); 1577 #endif 1578 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED); 1579 if ((stcb->asoc.num_send_timers_up == 0) && 1580 (stcb->asoc.sent_queue_cnt > 0)) { 1581 struct sctp_tmit_chunk *chk; 1582 1583 /* 1584 * safeguard. If there on some on the sent queue 1585 * somewhere but no timers running something is 1586 * wrong... so we start a timer on the first chunk 1587 * on the send queue on whatever net it is sent to. 1588 */ 1589 chk = TAILQ_FIRST(&stcb->asoc.sent_queue); 1590 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, 1591 chk->whoTo); 1592 } 1593 break; 1594 case SCTP_TIMER_TYPE_INIT: 1595 if ((stcb == NULL) || (inp == NULL)) { 1596 break; 1597 } 1598 SCTP_STAT_INCR(sctps_timoinit); 1599 stcb->asoc.timoinit++; 1600 if (sctp_t1init_timer(inp, stcb, net)) { 1601 /* no need to unlock on tcb its gone */ 1602 goto out_decr; 1603 } 1604 /* We do output but not here */ 1605 did_output = 0; 1606 break; 1607 case SCTP_TIMER_TYPE_RECV: 1608 if ((stcb == NULL) || (inp == NULL)) { 1609 break; 1610 } 1611 SCTP_STAT_INCR(sctps_timosack); 1612 stcb->asoc.timosack++; 1613 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED); 1614 #ifdef SCTP_AUDITING_ENABLED 1615 sctp_auditing(4, inp, stcb, net); 1616 #endif 1617 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED); 1618 break; 1619 case SCTP_TIMER_TYPE_SHUTDOWN: 1620 if ((stcb == NULL) || (inp == NULL)) { 1621 break; 1622 } 1623 if (sctp_shutdown_timer(inp, stcb, net)) { 1624 /* no need to unlock on tcb its gone */ 1625 goto out_decr; 1626 } 1627 SCTP_STAT_INCR(sctps_timoshutdown); 1628 stcb->asoc.timoshutdown++; 1629 #ifdef SCTP_AUDITING_ENABLED 1630 sctp_auditing(4, inp, stcb, net); 1631 #endif 1632 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED); 1633 break; 1634 case SCTP_TIMER_TYPE_HEARTBEAT: 1635 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) { 1636 break; 1637 } 1638 SCTP_STAT_INCR(sctps_timoheartbeat); 1639 stcb->asoc.timoheartbeat++; 1640 if (sctp_heartbeat_timer(inp, stcb, net)) { 1641 /* no need to unlock on tcb its gone */ 1642 goto out_decr; 1643 } 1644 #ifdef SCTP_AUDITING_ENABLED 1645 sctp_auditing(4, inp, stcb, net); 1646 #endif 1647 if (!(net->dest_state & SCTP_ADDR_NOHB)) { 1648 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net); 1649 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED); 1650 } 1651 break; 1652 case SCTP_TIMER_TYPE_COOKIE: 1653 if ((stcb == NULL) || (inp == NULL)) { 1654 break; 1655 } 1656 if (sctp_cookie_timer(inp, stcb, net)) { 1657 /* no need to unlock on tcb its gone */ 1658 goto out_decr; 1659 } 1660 SCTP_STAT_INCR(sctps_timocookie); 1661 stcb->asoc.timocookie++; 1662 #ifdef SCTP_AUDITING_ENABLED 1663 sctp_auditing(4, inp, stcb, net); 1664 #endif 1665 /* 1666 * We consider T3 and Cookie timer pretty much the same with 1667 * respect to where from in chunk_output. 1668 */ 1669 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED); 1670 break; 1671 case SCTP_TIMER_TYPE_NEWCOOKIE: 1672 { 1673 struct timeval tv; 1674 int i, secret; 1675 1676 if (inp == NULL) { 1677 break; 1678 } 1679 SCTP_STAT_INCR(sctps_timosecret); 1680 (void)SCTP_GETTIME_TIMEVAL(&tv); 1681 SCTP_INP_WLOCK(inp); 1682 inp->sctp_ep.time_of_secret_change = tv.tv_sec; 1683 inp->sctp_ep.last_secret_number = 1684 inp->sctp_ep.current_secret_number; 1685 inp->sctp_ep.current_secret_number++; 1686 if (inp->sctp_ep.current_secret_number >= 1687 SCTP_HOW_MANY_SECRETS) { 1688 inp->sctp_ep.current_secret_number = 0; 1689 } 1690 secret = (int)inp->sctp_ep.current_secret_number; 1691 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) { 1692 inp->sctp_ep.secret_key[secret][i] = 1693 sctp_select_initial_TSN(&inp->sctp_ep); 1694 } 1695 SCTP_INP_WUNLOCK(inp); 1696 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net); 1697 } 1698 did_output = 0; 1699 break; 1700 case SCTP_TIMER_TYPE_PATHMTURAISE: 1701 if ((stcb == NULL) || (inp == NULL)) { 1702 break; 1703 } 1704 SCTP_STAT_INCR(sctps_timopathmtu); 1705 sctp_pathmtu_timer(inp, stcb, net); 1706 did_output = 0; 1707 break; 1708 case SCTP_TIMER_TYPE_SHUTDOWNACK: 1709 if ((stcb == NULL) || (inp == NULL)) { 1710 break; 1711 } 1712 if (sctp_shutdownack_timer(inp, stcb, net)) { 1713 /* no need to unlock on tcb its gone */ 1714 goto out_decr; 1715 } 1716 SCTP_STAT_INCR(sctps_timoshutdownack); 1717 stcb->asoc.timoshutdownack++; 1718 #ifdef SCTP_AUDITING_ENABLED 1719 sctp_auditing(4, inp, stcb, net); 1720 #endif 1721 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED); 1722 break; 1723 case SCTP_TIMER_TYPE_SHUTDOWNGUARD: 1724 if ((stcb == NULL) || (inp == NULL)) { 1725 break; 1726 } 1727 SCTP_STAT_INCR(sctps_timoshutdownguard); 1728 sctp_abort_an_association(inp, stcb, 1729 SCTP_SHUTDOWN_GUARD_EXPIRES, NULL, SCTP_SO_NOT_LOCKED); 1730 /* no need to unlock on tcb its gone */ 1731 goto out_decr; 1732 1733 case SCTP_TIMER_TYPE_STRRESET: 1734 if ((stcb == NULL) || (inp == NULL)) { 1735 break; 1736 } 1737 if (sctp_strreset_timer(inp, stcb, net)) { 1738 /* no need to unlock on tcb its gone */ 1739 goto out_decr; 1740 } 1741 SCTP_STAT_INCR(sctps_timostrmrst); 1742 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED); 1743 break; 1744 case SCTP_TIMER_TYPE_ASCONF: 1745 if ((stcb == NULL) || (inp == NULL)) { 1746 break; 1747 } 1748 if (sctp_asconf_timer(inp, stcb, net)) { 1749 /* no need to unlock on tcb its gone */ 1750 goto out_decr; 1751 } 1752 SCTP_STAT_INCR(sctps_timoasconf); 1753 #ifdef SCTP_AUDITING_ENABLED 1754 sctp_auditing(4, inp, stcb, net); 1755 #endif 1756 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED); 1757 break; 1758 case SCTP_TIMER_TYPE_PRIM_DELETED: 1759 if ((stcb == NULL) || (inp == NULL)) { 1760 break; 1761 } 1762 sctp_delete_prim_timer(inp, stcb, net); 1763 SCTP_STAT_INCR(sctps_timodelprim); 1764 break; 1765 1766 case SCTP_TIMER_TYPE_AUTOCLOSE: 1767 if ((stcb == NULL) || (inp == NULL)) { 1768 break; 1769 } 1770 SCTP_STAT_INCR(sctps_timoautoclose); 1771 sctp_autoclose_timer(inp, stcb, net); 1772 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED); 1773 did_output = 0; 1774 break; 1775 case SCTP_TIMER_TYPE_ASOCKILL: 1776 if ((stcb == NULL) || (inp == NULL)) { 1777 break; 1778 } 1779 SCTP_STAT_INCR(sctps_timoassockill); 1780 /* Can we free it yet? */ 1781 SCTP_INP_DECR_REF(inp); 1782 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_1); 1783 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1784 so = SCTP_INP_SO(inp); 1785 atomic_add_int(&stcb->asoc.refcnt, 1); 1786 SCTP_TCB_UNLOCK(stcb); 1787 SCTP_SOCKET_LOCK(so, 1); 1788 SCTP_TCB_LOCK(stcb); 1789 atomic_subtract_int(&stcb->asoc.refcnt, 1); 1790 #endif 1791 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_2); 1792 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 1793 SCTP_SOCKET_UNLOCK(so, 1); 1794 #endif 1795 /* 1796 * free asoc, always unlocks (or destroy's) so prevent 1797 * duplicate unlock or unlock of a free mtx :-0 1798 */ 1799 stcb = NULL; 1800 goto out_no_decr; 1801 case SCTP_TIMER_TYPE_INPKILL: 1802 SCTP_STAT_INCR(sctps_timoinpkill); 1803 if (inp == NULL) { 1804 break; 1805 } 1806 /* 1807 * special case, take away our increment since WE are the 1808 * killer 1809 */ 1810 SCTP_INP_DECR_REF(inp); 1811 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_3); 1812 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT, 1813 SCTP_CALLED_FROM_INPKILL_TIMER); 1814 inp = NULL; 1815 goto out_no_decr; 1816 default: 1817 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n", 1818 tmr->type); 1819 break; 1820 } 1821 #ifdef SCTP_AUDITING_ENABLED 1822 sctp_audit_log(0xF1, (uint8_t) tmr->type); 1823 if (inp) 1824 sctp_auditing(5, inp, stcb, net); 1825 #endif 1826 if ((did_output) && stcb) { 1827 /* 1828 * Now we need to clean up the control chunk chain if an 1829 * ECNE is on it. It must be marked as UNSENT again so next 1830 * call will continue to send it until such time that we get 1831 * a CWR, to remove it. It is, however, less likely that we 1832 * will find a ecn echo on the chain though. 1833 */ 1834 sctp_fix_ecn_echo(&stcb->asoc); 1835 } 1836 get_out: 1837 if (stcb) { 1838 SCTP_TCB_UNLOCK(stcb); 1839 } 1840 out_decr: 1841 if (inp) { 1842 SCTP_INP_DECR_REF(inp); 1843 } 1844 out_no_decr: 1845 SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type %d)\n", 1846 type); 1847 CURVNET_RESTORE(); 1848 } 1849 1850 void 1851 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 1852 struct sctp_nets *net) 1853 { 1854 uint32_t to_ticks; 1855 struct sctp_timer *tmr; 1856 1857 if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) 1858 return; 1859 1860 tmr = NULL; 1861 if (stcb) { 1862 SCTP_TCB_LOCK_ASSERT(stcb); 1863 } 1864 switch (t_type) { 1865 case SCTP_TIMER_TYPE_ZERO_COPY: 1866 tmr = &inp->sctp_ep.zero_copy_timer; 1867 to_ticks = SCTP_ZERO_COPY_TICK_DELAY; 1868 break; 1869 case SCTP_TIMER_TYPE_ZCOPY_SENDQ: 1870 tmr = &inp->sctp_ep.zero_copy_sendq_timer; 1871 to_ticks = SCTP_ZERO_COPY_SENDQ_TICK_DELAY; 1872 break; 1873 case SCTP_TIMER_TYPE_ADDR_WQ: 1874 /* Only 1 tick away :-) */ 1875 tmr = &SCTP_BASE_INFO(addr_wq_timer); 1876 to_ticks = SCTP_ADDRESS_TICK_DELAY; 1877 break; 1878 case SCTP_TIMER_TYPE_SEND: 1879 /* Here we use the RTO timer */ 1880 { 1881 int rto_val; 1882 1883 if ((stcb == NULL) || (net == NULL)) { 1884 return; 1885 } 1886 tmr = &net->rxt_timer; 1887 if (net->RTO == 0) { 1888 rto_val = stcb->asoc.initial_rto; 1889 } else { 1890 rto_val = net->RTO; 1891 } 1892 to_ticks = MSEC_TO_TICKS(rto_val); 1893 } 1894 break; 1895 case SCTP_TIMER_TYPE_INIT: 1896 /* 1897 * Here we use the INIT timer default usually about 1 1898 * minute. 1899 */ 1900 if ((stcb == NULL) || (net == NULL)) { 1901 return; 1902 } 1903 tmr = &net->rxt_timer; 1904 if (net->RTO == 0) { 1905 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto); 1906 } else { 1907 to_ticks = MSEC_TO_TICKS(net->RTO); 1908 } 1909 break; 1910 case SCTP_TIMER_TYPE_RECV: 1911 /* 1912 * Here we use the Delayed-Ack timer value from the inp 1913 * ususually about 200ms. 1914 */ 1915 if (stcb == NULL) { 1916 return; 1917 } 1918 tmr = &stcb->asoc.dack_timer; 1919 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack); 1920 break; 1921 case SCTP_TIMER_TYPE_SHUTDOWN: 1922 /* Here we use the RTO of the destination. */ 1923 if ((stcb == NULL) || (net == NULL)) { 1924 return; 1925 } 1926 if (net->RTO == 0) { 1927 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto); 1928 } else { 1929 to_ticks = MSEC_TO_TICKS(net->RTO); 1930 } 1931 tmr = &net->rxt_timer; 1932 break; 1933 case SCTP_TIMER_TYPE_HEARTBEAT: 1934 /* 1935 * the net is used here so that we can add in the RTO. Even 1936 * though we use a different timer. We also add the HB timer 1937 * PLUS a random jitter. 1938 */ 1939 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 1940 return; 1941 } else { 1942 uint32_t rndval; 1943 uint32_t jitter; 1944 1945 if ((net->dest_state & SCTP_ADDR_NOHB) && 1946 !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) { 1947 return; 1948 } 1949 if (net->RTO == 0) { 1950 to_ticks = stcb->asoc.initial_rto; 1951 } else { 1952 to_ticks = net->RTO; 1953 } 1954 rndval = sctp_select_initial_TSN(&inp->sctp_ep); 1955 jitter = rndval % to_ticks; 1956 if (jitter >= (to_ticks >> 1)) { 1957 to_ticks = to_ticks + (jitter - (to_ticks >> 1)); 1958 } else { 1959 to_ticks = to_ticks - jitter; 1960 } 1961 if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) && 1962 !(net->dest_state & SCTP_ADDR_PF)) { 1963 to_ticks += net->heart_beat_delay; 1964 } 1965 /* 1966 * Now we must convert the to_ticks that are now in 1967 * ms to ticks. 1968 */ 1969 to_ticks = MSEC_TO_TICKS(to_ticks); 1970 tmr = &net->hb_timer; 1971 } 1972 break; 1973 case SCTP_TIMER_TYPE_COOKIE: 1974 /* 1975 * Here we can use the RTO timer from the network since one 1976 * RTT was compelete. If a retran happened then we will be 1977 * using the RTO initial value. 1978 */ 1979 if ((stcb == NULL) || (net == NULL)) { 1980 return; 1981 } 1982 if (net->RTO == 0) { 1983 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto); 1984 } else { 1985 to_ticks = MSEC_TO_TICKS(net->RTO); 1986 } 1987 tmr = &net->rxt_timer; 1988 break; 1989 case SCTP_TIMER_TYPE_NEWCOOKIE: 1990 /* 1991 * nothing needed but the endpoint here ususually about 60 1992 * minutes. 1993 */ 1994 if (inp == NULL) { 1995 return; 1996 } 1997 tmr = &inp->sctp_ep.signature_change; 1998 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE]; 1999 break; 2000 case SCTP_TIMER_TYPE_ASOCKILL: 2001 if (stcb == NULL) { 2002 return; 2003 } 2004 tmr = &stcb->asoc.strreset_timer; 2005 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT); 2006 break; 2007 case SCTP_TIMER_TYPE_INPKILL: 2008 /* 2009 * The inp is setup to die. We re-use the signature_chage 2010 * timer since that has stopped and we are in the GONE 2011 * state. 2012 */ 2013 if (inp == NULL) { 2014 return; 2015 } 2016 tmr = &inp->sctp_ep.signature_change; 2017 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT); 2018 break; 2019 case SCTP_TIMER_TYPE_PATHMTURAISE: 2020 /* 2021 * Here we use the value found in the EP for PMTU ususually 2022 * about 10 minutes. 2023 */ 2024 if ((stcb == NULL) || (inp == NULL)) { 2025 return; 2026 } 2027 if (net == NULL) { 2028 return; 2029 } 2030 if (net->dest_state & SCTP_ADDR_NO_PMTUD) { 2031 return; 2032 } 2033 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU]; 2034 tmr = &net->pmtu_timer; 2035 break; 2036 case SCTP_TIMER_TYPE_SHUTDOWNACK: 2037 /* Here we use the RTO of the destination */ 2038 if ((stcb == NULL) || (net == NULL)) { 2039 return; 2040 } 2041 if (net->RTO == 0) { 2042 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto); 2043 } else { 2044 to_ticks = MSEC_TO_TICKS(net->RTO); 2045 } 2046 tmr = &net->rxt_timer; 2047 break; 2048 case SCTP_TIMER_TYPE_SHUTDOWNGUARD: 2049 /* 2050 * Here we use the endpoints shutdown guard timer usually 2051 * about 3 minutes. 2052 */ 2053 if ((inp == NULL) || (stcb == NULL)) { 2054 return; 2055 } 2056 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN]; 2057 tmr = &stcb->asoc.shut_guard_timer; 2058 break; 2059 case SCTP_TIMER_TYPE_STRRESET: 2060 /* 2061 * Here the timer comes from the stcb but its value is from 2062 * the net's RTO. 2063 */ 2064 if ((stcb == NULL) || (net == NULL)) { 2065 return; 2066 } 2067 if (net->RTO == 0) { 2068 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto); 2069 } else { 2070 to_ticks = MSEC_TO_TICKS(net->RTO); 2071 } 2072 tmr = &stcb->asoc.strreset_timer; 2073 break; 2074 case SCTP_TIMER_TYPE_ASCONF: 2075 /* 2076 * Here the timer comes from the stcb but its value is from 2077 * the net's RTO. 2078 */ 2079 if ((stcb == NULL) || (net == NULL)) { 2080 return; 2081 } 2082 if (net->RTO == 0) { 2083 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto); 2084 } else { 2085 to_ticks = MSEC_TO_TICKS(net->RTO); 2086 } 2087 tmr = &stcb->asoc.asconf_timer; 2088 break; 2089 case SCTP_TIMER_TYPE_PRIM_DELETED: 2090 if ((stcb == NULL) || (net != NULL)) { 2091 return; 2092 } 2093 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto); 2094 tmr = &stcb->asoc.delete_prim_timer; 2095 break; 2096 case SCTP_TIMER_TYPE_AUTOCLOSE: 2097 if (stcb == NULL) { 2098 return; 2099 } 2100 if (stcb->asoc.sctp_autoclose_ticks == 0) { 2101 /* 2102 * Really an error since stcb is NOT set to 2103 * autoclose 2104 */ 2105 return; 2106 } 2107 to_ticks = stcb->asoc.sctp_autoclose_ticks; 2108 tmr = &stcb->asoc.autoclose_timer; 2109 break; 2110 default: 2111 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n", 2112 __FUNCTION__, t_type); 2113 return; 2114 break; 2115 } 2116 if ((to_ticks <= 0) || (tmr == NULL)) { 2117 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n", 2118 __FUNCTION__, t_type, to_ticks, tmr); 2119 return; 2120 } 2121 if (SCTP_OS_TIMER_PENDING(&tmr->timer)) { 2122 /* 2123 * we do NOT allow you to have it already running. if it is 2124 * we leave the current one up unchanged 2125 */ 2126 return; 2127 } 2128 /* At this point we can proceed */ 2129 if (t_type == SCTP_TIMER_TYPE_SEND) { 2130 stcb->asoc.num_send_timers_up++; 2131 } 2132 tmr->stopped_from = 0; 2133 tmr->type = t_type; 2134 tmr->ep = (void *)inp; 2135 tmr->tcb = (void *)stcb; 2136 tmr->net = (void *)net; 2137 tmr->self = (void *)tmr; 2138 tmr->vnet = (void *)curvnet; 2139 tmr->ticks = sctp_get_tick_count(); 2140 (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr); 2141 return; 2142 } 2143 2144 void 2145 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2146 struct sctp_nets *net, uint32_t from) 2147 { 2148 struct sctp_timer *tmr; 2149 2150 if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && 2151 (inp == NULL)) 2152 return; 2153 2154 tmr = NULL; 2155 if (stcb) { 2156 SCTP_TCB_LOCK_ASSERT(stcb); 2157 } 2158 switch (t_type) { 2159 case SCTP_TIMER_TYPE_ZERO_COPY: 2160 tmr = &inp->sctp_ep.zero_copy_timer; 2161 break; 2162 case SCTP_TIMER_TYPE_ZCOPY_SENDQ: 2163 tmr = &inp->sctp_ep.zero_copy_sendq_timer; 2164 break; 2165 case SCTP_TIMER_TYPE_ADDR_WQ: 2166 tmr = &SCTP_BASE_INFO(addr_wq_timer); 2167 break; 2168 case SCTP_TIMER_TYPE_SEND: 2169 if ((stcb == NULL) || (net == NULL)) { 2170 return; 2171 } 2172 tmr = &net->rxt_timer; 2173 break; 2174 case SCTP_TIMER_TYPE_INIT: 2175 if ((stcb == NULL) || (net == NULL)) { 2176 return; 2177 } 2178 tmr = &net->rxt_timer; 2179 break; 2180 case SCTP_TIMER_TYPE_RECV: 2181 if (stcb == NULL) { 2182 return; 2183 } 2184 tmr = &stcb->asoc.dack_timer; 2185 break; 2186 case SCTP_TIMER_TYPE_SHUTDOWN: 2187 if ((stcb == NULL) || (net == NULL)) { 2188 return; 2189 } 2190 tmr = &net->rxt_timer; 2191 break; 2192 case SCTP_TIMER_TYPE_HEARTBEAT: 2193 if ((stcb == NULL) || (net == NULL)) { 2194 return; 2195 } 2196 tmr = &net->hb_timer; 2197 break; 2198 case SCTP_TIMER_TYPE_COOKIE: 2199 if ((stcb == NULL) || (net == NULL)) { 2200 return; 2201 } 2202 tmr = &net->rxt_timer; 2203 break; 2204 case SCTP_TIMER_TYPE_NEWCOOKIE: 2205 /* nothing needed but the endpoint here */ 2206 tmr = &inp->sctp_ep.signature_change; 2207 /* 2208 * We re-use the newcookie timer for the INP kill timer. We 2209 * must assure that we do not kill it by accident. 2210 */ 2211 break; 2212 case SCTP_TIMER_TYPE_ASOCKILL: 2213 /* 2214 * Stop the asoc kill timer. 2215 */ 2216 if (stcb == NULL) { 2217 return; 2218 } 2219 tmr = &stcb->asoc.strreset_timer; 2220 break; 2221 2222 case SCTP_TIMER_TYPE_INPKILL: 2223 /* 2224 * The inp is setup to die. We re-use the signature_chage 2225 * timer since that has stopped and we are in the GONE 2226 * state. 2227 */ 2228 tmr = &inp->sctp_ep.signature_change; 2229 break; 2230 case SCTP_TIMER_TYPE_PATHMTURAISE: 2231 if ((stcb == NULL) || (net == NULL)) { 2232 return; 2233 } 2234 tmr = &net->pmtu_timer; 2235 break; 2236 case SCTP_TIMER_TYPE_SHUTDOWNACK: 2237 if ((stcb == NULL) || (net == NULL)) { 2238 return; 2239 } 2240 tmr = &net->rxt_timer; 2241 break; 2242 case SCTP_TIMER_TYPE_SHUTDOWNGUARD: 2243 if (stcb == NULL) { 2244 return; 2245 } 2246 tmr = &stcb->asoc.shut_guard_timer; 2247 break; 2248 case SCTP_TIMER_TYPE_STRRESET: 2249 if (stcb == NULL) { 2250 return; 2251 } 2252 tmr = &stcb->asoc.strreset_timer; 2253 break; 2254 case SCTP_TIMER_TYPE_ASCONF: 2255 if (stcb == NULL) { 2256 return; 2257 } 2258 tmr = &stcb->asoc.asconf_timer; 2259 break; 2260 case SCTP_TIMER_TYPE_PRIM_DELETED: 2261 if (stcb == NULL) { 2262 return; 2263 } 2264 tmr = &stcb->asoc.delete_prim_timer; 2265 break; 2266 case SCTP_TIMER_TYPE_AUTOCLOSE: 2267 if (stcb == NULL) { 2268 return; 2269 } 2270 tmr = &stcb->asoc.autoclose_timer; 2271 break; 2272 default: 2273 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n", 2274 __FUNCTION__, t_type); 2275 break; 2276 } 2277 if (tmr == NULL) { 2278 return; 2279 } 2280 if ((tmr->type != t_type) && tmr->type) { 2281 /* 2282 * Ok we have a timer that is under joint use. Cookie timer 2283 * per chance with the SEND timer. We therefore are NOT 2284 * running the timer that the caller wants stopped. So just 2285 * return. 2286 */ 2287 return; 2288 } 2289 if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) { 2290 stcb->asoc.num_send_timers_up--; 2291 if (stcb->asoc.num_send_timers_up < 0) { 2292 stcb->asoc.num_send_timers_up = 0; 2293 } 2294 } 2295 tmr->self = NULL; 2296 tmr->stopped_from = from; 2297 (void)SCTP_OS_TIMER_STOP(&tmr->timer); 2298 return; 2299 } 2300 2301 uint32_t 2302 sctp_calculate_len(struct mbuf *m) 2303 { 2304 uint32_t tlen = 0; 2305 struct mbuf *at; 2306 2307 at = m; 2308 while (at) { 2309 tlen += SCTP_BUF_LEN(at); 2310 at = SCTP_BUF_NEXT(at); 2311 } 2312 return (tlen); 2313 } 2314 2315 void 2316 sctp_mtu_size_reset(struct sctp_inpcb *inp, 2317 struct sctp_association *asoc, uint32_t mtu) 2318 { 2319 /* 2320 * Reset the P-MTU size on this association, this involves changing 2321 * the asoc MTU, going through ANY chunk+overhead larger than mtu to 2322 * allow the DF flag to be cleared. 2323 */ 2324 struct sctp_tmit_chunk *chk; 2325 unsigned int eff_mtu, ovh; 2326 2327 asoc->smallest_mtu = mtu; 2328 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 2329 ovh = SCTP_MIN_OVERHEAD; 2330 } else { 2331 ovh = SCTP_MIN_V4_OVERHEAD; 2332 } 2333 eff_mtu = mtu - ovh; 2334 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 2335 if (chk->send_size > eff_mtu) { 2336 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 2337 } 2338 } 2339 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 2340 if (chk->send_size > eff_mtu) { 2341 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 2342 } 2343 } 2344 } 2345 2346 2347 /* 2348 * given an association and starting time of the current RTT period return 2349 * RTO in number of msecs net should point to the current network 2350 */ 2351 2352 uint32_t 2353 sctp_calculate_rto(struct sctp_tcb *stcb, 2354 struct sctp_association *asoc, 2355 struct sctp_nets *net, 2356 struct timeval *told, 2357 int safe, int rtt_from_sack) 2358 { 2359 /*- 2360 * given an association and the starting time of the current RTT 2361 * period (in value1/value2) return RTO in number of msecs. 2362 */ 2363 int32_t rtt; /* RTT in ms */ 2364 uint32_t new_rto; 2365 int first_measure = 0; 2366 struct timeval now, then, *old; 2367 2368 /* Copy it out for sparc64 */ 2369 if (safe == sctp_align_unsafe_makecopy) { 2370 old = &then; 2371 memcpy(&then, told, sizeof(struct timeval)); 2372 } else if (safe == sctp_align_safe_nocopy) { 2373 old = told; 2374 } else { 2375 /* error */ 2376 SCTP_PRINTF("Huh, bad rto calc call\n"); 2377 return (0); 2378 } 2379 /************************/ 2380 /* 1. calculate new RTT */ 2381 /************************/ 2382 /* get the current time */ 2383 if (stcb->asoc.use_precise_time) { 2384 (void)SCTP_GETPTIME_TIMEVAL(&now); 2385 } else { 2386 (void)SCTP_GETTIME_TIMEVAL(&now); 2387 } 2388 timevalsub(&now, old); 2389 /* store the current RTT in us */ 2390 net->rtt = (uint64_t) 10000000 *(uint64_t) now.tv_sec + 2391 (uint64_t) now.tv_usec; 2392 2393 /* computer rtt in ms */ 2394 rtt = net->rtt / 1000; 2395 if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) { 2396 /* 2397 * Tell the CC module that a new update has just occurred 2398 * from a sack 2399 */ 2400 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now); 2401 } 2402 /* 2403 * Do we need to determine the lan? We do this only on sacks i.e. 2404 * RTT being determined from data not non-data (HB/INIT->INITACK). 2405 */ 2406 if ((rtt_from_sack == SCTP_RTT_FROM_DATA) && 2407 (net->lan_type == SCTP_LAN_UNKNOWN)) { 2408 if (net->rtt > SCTP_LOCAL_LAN_RTT) { 2409 net->lan_type = SCTP_LAN_INTERNET; 2410 } else { 2411 net->lan_type = SCTP_LAN_LOCAL; 2412 } 2413 } 2414 /***************************/ 2415 /* 2. update RTTVAR & SRTT */ 2416 /***************************/ 2417 /*- 2418 * Compute the scaled average lastsa and the 2419 * scaled variance lastsv as described in van Jacobson 2420 * Paper "Congestion Avoidance and Control", Annex A. 2421 * 2422 * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt 2423 * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar 2424 */ 2425 if (net->RTO_measured) { 2426 rtt -= (net->lastsa >> SCTP_RTT_SHIFT); 2427 net->lastsa += rtt; 2428 if (rtt < 0) { 2429 rtt = -rtt; 2430 } 2431 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT); 2432 net->lastsv += rtt; 2433 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) { 2434 rto_logging(net, SCTP_LOG_RTTVAR); 2435 } 2436 } else { 2437 /* First RTO measurment */ 2438 net->RTO_measured = 1; 2439 first_measure = 1; 2440 net->lastsa = rtt << SCTP_RTT_SHIFT; 2441 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT; 2442 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) { 2443 rto_logging(net, SCTP_LOG_INITIAL_RTT); 2444 } 2445 } 2446 if (net->lastsv == 0) { 2447 net->lastsv = SCTP_CLOCK_GRANULARITY; 2448 } 2449 new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv; 2450 if ((new_rto > SCTP_SAT_NETWORK_MIN) && 2451 (stcb->asoc.sat_network_lockout == 0)) { 2452 stcb->asoc.sat_network = 1; 2453 } else if ((!first_measure) && stcb->asoc.sat_network) { 2454 stcb->asoc.sat_network = 0; 2455 stcb->asoc.sat_network_lockout = 1; 2456 } 2457 /* bound it, per C6/C7 in Section 5.3.1 */ 2458 if (new_rto < stcb->asoc.minrto) { 2459 new_rto = stcb->asoc.minrto; 2460 } 2461 if (new_rto > stcb->asoc.maxrto) { 2462 new_rto = stcb->asoc.maxrto; 2463 } 2464 /* we are now returning the RTO */ 2465 return (new_rto); 2466 } 2467 2468 /* 2469 * return a pointer to a contiguous piece of data from the given mbuf chain 2470 * starting at 'off' for 'len' bytes. If the desired piece spans more than 2471 * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size 2472 * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain. 2473 */ 2474 caddr_t 2475 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr) 2476 { 2477 uint32_t count; 2478 uint8_t *ptr; 2479 2480 ptr = in_ptr; 2481 if ((off < 0) || (len <= 0)) 2482 return (NULL); 2483 2484 /* find the desired start location */ 2485 while ((m != NULL) && (off > 0)) { 2486 if (off < SCTP_BUF_LEN(m)) 2487 break; 2488 off -= SCTP_BUF_LEN(m); 2489 m = SCTP_BUF_NEXT(m); 2490 } 2491 if (m == NULL) 2492 return (NULL); 2493 2494 /* is the current mbuf large enough (eg. contiguous)? */ 2495 if ((SCTP_BUF_LEN(m) - off) >= len) { 2496 return (mtod(m, caddr_t)+off); 2497 } else { 2498 /* else, it spans more than one mbuf, so save a temp copy... */ 2499 while ((m != NULL) && (len > 0)) { 2500 count = min(SCTP_BUF_LEN(m) - off, len); 2501 bcopy(mtod(m, caddr_t)+off, ptr, count); 2502 len -= count; 2503 ptr += count; 2504 off = 0; 2505 m = SCTP_BUF_NEXT(m); 2506 } 2507 if ((m == NULL) && (len > 0)) 2508 return (NULL); 2509 else 2510 return ((caddr_t)in_ptr); 2511 } 2512 } 2513 2514 2515 2516 struct sctp_paramhdr * 2517 sctp_get_next_param(struct mbuf *m, 2518 int offset, 2519 struct sctp_paramhdr *pull, 2520 int pull_limit) 2521 { 2522 /* This just provides a typed signature to Peter's Pull routine */ 2523 return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit, 2524 (uint8_t *) pull)); 2525 } 2526 2527 2528 int 2529 sctp_add_pad_tombuf(struct mbuf *m, int padlen) 2530 { 2531 /* 2532 * add padlen bytes of 0 filled padding to the end of the mbuf. If 2533 * padlen is > 3 this routine will fail. 2534 */ 2535 uint8_t *dp; 2536 int i; 2537 2538 if (padlen > 3) { 2539 SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS); 2540 return (ENOBUFS); 2541 } 2542 if (padlen <= M_TRAILINGSPACE(m)) { 2543 /* 2544 * The easy way. We hope the majority of the time we hit 2545 * here :) 2546 */ 2547 dp = (uint8_t *) (mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 2548 SCTP_BUF_LEN(m) += padlen; 2549 } else { 2550 /* Hard way we must grow the mbuf */ 2551 struct mbuf *tmp; 2552 2553 tmp = sctp_get_mbuf_for_msg(padlen, 0, M_DONTWAIT, 1, MT_DATA); 2554 if (tmp == NULL) { 2555 /* Out of space GAK! we are in big trouble. */ 2556 SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 2557 return (ENOSPC); 2558 } 2559 /* setup and insert in middle */ 2560 SCTP_BUF_LEN(tmp) = padlen; 2561 SCTP_BUF_NEXT(tmp) = NULL; 2562 SCTP_BUF_NEXT(m) = tmp; 2563 dp = mtod(tmp, uint8_t *); 2564 } 2565 /* zero out the pad */ 2566 for (i = 0; i < padlen; i++) { 2567 *dp = 0; 2568 dp++; 2569 } 2570 return (0); 2571 } 2572 2573 int 2574 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf) 2575 { 2576 /* find the last mbuf in chain and pad it */ 2577 struct mbuf *m_at; 2578 2579 m_at = m; 2580 if (last_mbuf) { 2581 return (sctp_add_pad_tombuf(last_mbuf, padval)); 2582 } else { 2583 while (m_at) { 2584 if (SCTP_BUF_NEXT(m_at) == NULL) { 2585 return (sctp_add_pad_tombuf(m_at, padval)); 2586 } 2587 m_at = SCTP_BUF_NEXT(m_at); 2588 } 2589 } 2590 SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT); 2591 return (EFAULT); 2592 } 2593 2594 static void 2595 sctp_notify_assoc_change(uint32_t event, struct sctp_tcb *stcb, 2596 uint32_t error, int so_locked 2597 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 2598 SCTP_UNUSED 2599 #endif 2600 ) 2601 { 2602 struct mbuf *m_notify; 2603 struct sctp_assoc_change *sac; 2604 struct sctp_queued_to_read *control; 2605 2606 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2607 struct socket *so; 2608 2609 #endif 2610 2611 /* 2612 * For TCP model AND UDP connected sockets we will send an error up 2613 * when an ABORT comes in. 2614 */ 2615 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 2616 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 2617 ((event == SCTP_COMM_LOST) || (event == SCTP_CANT_STR_ASSOC))) { 2618 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) { 2619 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED); 2620 stcb->sctp_socket->so_error = ECONNREFUSED; 2621 } else { 2622 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET); 2623 stcb->sctp_socket->so_error = ECONNRESET; 2624 } 2625 /* Wake ANY sleepers */ 2626 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2627 so = SCTP_INP_SO(stcb->sctp_ep); 2628 if (!so_locked) { 2629 atomic_add_int(&stcb->asoc.refcnt, 1); 2630 SCTP_TCB_UNLOCK(stcb); 2631 SCTP_SOCKET_LOCK(so, 1); 2632 SCTP_TCB_LOCK(stcb); 2633 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2634 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 2635 SCTP_SOCKET_UNLOCK(so, 1); 2636 return; 2637 } 2638 } 2639 #endif 2640 socantrcvmore(stcb->sctp_socket); 2641 sorwakeup(stcb->sctp_socket); 2642 sowwakeup(stcb->sctp_socket); 2643 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2644 if (!so_locked) { 2645 SCTP_SOCKET_UNLOCK(so, 1); 2646 } 2647 #endif 2648 } 2649 if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) { 2650 /* event not enabled */ 2651 return; 2652 } 2653 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_change), 0, M_DONTWAIT, 1, MT_DATA); 2654 if (m_notify == NULL) 2655 /* no space left */ 2656 return; 2657 SCTP_BUF_LEN(m_notify) = 0; 2658 2659 sac = mtod(m_notify, struct sctp_assoc_change *); 2660 sac->sac_type = SCTP_ASSOC_CHANGE; 2661 sac->sac_flags = 0; 2662 sac->sac_length = sizeof(struct sctp_assoc_change); 2663 sac->sac_state = event; 2664 sac->sac_error = error; 2665 /* XXX verify these stream counts */ 2666 sac->sac_outbound_streams = stcb->asoc.streamoutcnt; 2667 sac->sac_inbound_streams = stcb->asoc.streamincnt; 2668 sac->sac_assoc_id = sctp_get_associd(stcb); 2669 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_change); 2670 SCTP_BUF_NEXT(m_notify) = NULL; 2671 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 2672 0, 0, stcb->asoc.context, 0, 0, 0, 2673 m_notify); 2674 if (control == NULL) { 2675 /* no memory */ 2676 sctp_m_freem(m_notify); 2677 return; 2678 } 2679 control->length = SCTP_BUF_LEN(m_notify); 2680 /* not that we need this */ 2681 control->tail_mbuf = m_notify; 2682 control->spec_flags = M_NOTIFICATION; 2683 sctp_add_to_readq(stcb->sctp_ep, stcb, 2684 control, 2685 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, 2686 so_locked); 2687 if (event == SCTP_COMM_LOST) { 2688 /* Wake up any sleeper */ 2689 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2690 so = SCTP_INP_SO(stcb->sctp_ep); 2691 if (!so_locked) { 2692 atomic_add_int(&stcb->asoc.refcnt, 1); 2693 SCTP_TCB_UNLOCK(stcb); 2694 SCTP_SOCKET_LOCK(so, 1); 2695 SCTP_TCB_LOCK(stcb); 2696 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2697 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 2698 SCTP_SOCKET_UNLOCK(so, 1); 2699 return; 2700 } 2701 } 2702 #endif 2703 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket); 2704 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 2705 if (!so_locked) { 2706 SCTP_SOCKET_UNLOCK(so, 1); 2707 } 2708 #endif 2709 } 2710 } 2711 2712 static void 2713 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state, 2714 struct sockaddr *sa, uint32_t error) 2715 { 2716 struct mbuf *m_notify; 2717 struct sctp_paddr_change *spc; 2718 struct sctp_queued_to_read *control; 2719 2720 if ((stcb == NULL) || 2721 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) { 2722 /* event not enabled */ 2723 return; 2724 } 2725 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_DONTWAIT, 1, MT_DATA); 2726 if (m_notify == NULL) 2727 return; 2728 SCTP_BUF_LEN(m_notify) = 0; 2729 spc = mtod(m_notify, struct sctp_paddr_change *); 2730 spc->spc_type = SCTP_PEER_ADDR_CHANGE; 2731 spc->spc_flags = 0; 2732 spc->spc_length = sizeof(struct sctp_paddr_change); 2733 switch (sa->sa_family) { 2734 #ifdef INET 2735 case AF_INET: 2736 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in)); 2737 break; 2738 #endif 2739 #ifdef INET6 2740 case AF_INET6: 2741 { 2742 struct sockaddr_in6 *sin6; 2743 2744 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6)); 2745 2746 sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr; 2747 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) { 2748 if (sin6->sin6_scope_id == 0) { 2749 /* recover scope_id for user */ 2750 (void)sa6_recoverscope(sin6); 2751 } else { 2752 /* clear embedded scope_id for user */ 2753 in6_clearscope(&sin6->sin6_addr); 2754 } 2755 } 2756 break; 2757 } 2758 #endif 2759 default: 2760 /* TSNH */ 2761 break; 2762 } 2763 spc->spc_state = state; 2764 spc->spc_error = error; 2765 spc->spc_assoc_id = sctp_get_associd(stcb); 2766 2767 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change); 2768 SCTP_BUF_NEXT(m_notify) = NULL; 2769 2770 /* append to socket */ 2771 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 2772 0, 0, stcb->asoc.context, 0, 0, 0, 2773 m_notify); 2774 if (control == NULL) { 2775 /* no memory */ 2776 sctp_m_freem(m_notify); 2777 return; 2778 } 2779 control->length = SCTP_BUF_LEN(m_notify); 2780 control->spec_flags = M_NOTIFICATION; 2781 /* not that we need this */ 2782 control->tail_mbuf = m_notify; 2783 sctp_add_to_readq(stcb->sctp_ep, stcb, 2784 control, 2785 &stcb->sctp_socket->so_rcv, 1, 2786 SCTP_READ_LOCK_NOT_HELD, 2787 SCTP_SO_NOT_LOCKED); 2788 } 2789 2790 2791 static void 2792 sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error, 2793 struct sctp_tmit_chunk *chk, int so_locked 2794 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 2795 SCTP_UNUSED 2796 #endif 2797 ) 2798 { 2799 struct mbuf *m_notify; 2800 struct sctp_send_failed *ssf; 2801 struct sctp_queued_to_read *control; 2802 int length; 2803 2804 if ((stcb == NULL) || 2805 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT)) { 2806 /* event not enabled */ 2807 return; 2808 } 2809 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_send_failed), 0, M_DONTWAIT, 1, MT_DATA); 2810 if (m_notify == NULL) 2811 /* no space left */ 2812 return; 2813 length = sizeof(struct sctp_send_failed) + chk->send_size; 2814 length -= sizeof(struct sctp_data_chunk); 2815 SCTP_BUF_LEN(m_notify) = 0; 2816 ssf = mtod(m_notify, struct sctp_send_failed *); 2817 ssf->ssf_type = SCTP_SEND_FAILED; 2818 if (error == SCTP_NOTIFY_DATAGRAM_UNSENT) 2819 ssf->ssf_flags = SCTP_DATA_UNSENT; 2820 else 2821 ssf->ssf_flags = SCTP_DATA_SENT; 2822 ssf->ssf_length = length; 2823 ssf->ssf_error = error; 2824 /* not exactly what the user sent in, but should be close :) */ 2825 bzero(&ssf->ssf_info, sizeof(ssf->ssf_info)); 2826 ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number; 2827 ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq; 2828 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags; 2829 ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype; 2830 ssf->ssf_info.sinfo_context = chk->rec.data.context; 2831 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb); 2832 ssf->ssf_assoc_id = sctp_get_associd(stcb); 2833 2834 if (chk->data) { 2835 /* 2836 * trim off the sctp chunk header(it should be there) 2837 */ 2838 if (chk->send_size >= sizeof(struct sctp_data_chunk)) { 2839 m_adj(chk->data, sizeof(struct sctp_data_chunk)); 2840 sctp_mbuf_crush(chk->data); 2841 chk->send_size -= sizeof(struct sctp_data_chunk); 2842 } 2843 } 2844 SCTP_BUF_NEXT(m_notify) = chk->data; 2845 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed); 2846 /* Steal off the mbuf */ 2847 chk->data = NULL; 2848 /* 2849 * For this case, we check the actual socket buffer, since the assoc 2850 * is going away we don't want to overfill the socket buffer for a 2851 * non-reader 2852 */ 2853 if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 2854 sctp_m_freem(m_notify); 2855 return; 2856 } 2857 /* append to socket */ 2858 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 2859 0, 0, stcb->asoc.context, 0, 0, 0, 2860 m_notify); 2861 if (control == NULL) { 2862 /* no memory */ 2863 sctp_m_freem(m_notify); 2864 return; 2865 } 2866 control->spec_flags = M_NOTIFICATION; 2867 sctp_add_to_readq(stcb->sctp_ep, stcb, 2868 control, 2869 &stcb->sctp_socket->so_rcv, 1, 2870 SCTP_READ_LOCK_NOT_HELD, 2871 so_locked); 2872 } 2873 2874 2875 static void 2876 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error, 2877 struct sctp_stream_queue_pending *sp, int so_locked 2878 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 2879 SCTP_UNUSED 2880 #endif 2881 ) 2882 { 2883 struct mbuf *m_notify; 2884 struct sctp_send_failed *ssf; 2885 struct sctp_queued_to_read *control; 2886 int length; 2887 2888 if ((stcb == NULL) || 2889 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT)) { 2890 /* event not enabled */ 2891 return; 2892 } 2893 length = sizeof(struct sctp_send_failed) + sp->length; 2894 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_send_failed), 0, M_DONTWAIT, 1, MT_DATA); 2895 if (m_notify == NULL) 2896 /* no space left */ 2897 return; 2898 SCTP_BUF_LEN(m_notify) = 0; 2899 ssf = mtod(m_notify, struct sctp_send_failed *); 2900 ssf->ssf_type = SCTP_SEND_FAILED; 2901 if (error == SCTP_NOTIFY_DATAGRAM_UNSENT) 2902 ssf->ssf_flags = SCTP_DATA_UNSENT; 2903 else 2904 ssf->ssf_flags = SCTP_DATA_SENT; 2905 ssf->ssf_length = length; 2906 ssf->ssf_error = error; 2907 /* not exactly what the user sent in, but should be close :) */ 2908 bzero(&ssf->ssf_info, sizeof(ssf->ssf_info)); 2909 ssf->ssf_info.sinfo_stream = sp->stream; 2910 ssf->ssf_info.sinfo_ssn = sp->strseq; 2911 if (sp->some_taken) { 2912 ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG; 2913 } else { 2914 ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG; 2915 } 2916 ssf->ssf_info.sinfo_ppid = sp->ppid; 2917 ssf->ssf_info.sinfo_context = sp->context; 2918 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb); 2919 ssf->ssf_assoc_id = sctp_get_associd(stcb); 2920 SCTP_BUF_NEXT(m_notify) = sp->data; 2921 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed); 2922 2923 /* Steal off the mbuf */ 2924 sp->data = NULL; 2925 /* 2926 * For this case, we check the actual socket buffer, since the assoc 2927 * is going away we don't want to overfill the socket buffer for a 2928 * non-reader 2929 */ 2930 if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 2931 sctp_m_freem(m_notify); 2932 return; 2933 } 2934 /* append to socket */ 2935 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 2936 0, 0, stcb->asoc.context, 0, 0, 0, 2937 m_notify); 2938 if (control == NULL) { 2939 /* no memory */ 2940 sctp_m_freem(m_notify); 2941 return; 2942 } 2943 control->spec_flags = M_NOTIFICATION; 2944 sctp_add_to_readq(stcb->sctp_ep, stcb, 2945 control, 2946 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked); 2947 } 2948 2949 2950 2951 static void 2952 sctp_notify_adaptation_layer(struct sctp_tcb *stcb) 2953 { 2954 struct mbuf *m_notify; 2955 struct sctp_adaptation_event *sai; 2956 struct sctp_queued_to_read *control; 2957 2958 if ((stcb == NULL) || 2959 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) { 2960 /* event not enabled */ 2961 return; 2962 } 2963 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_DONTWAIT, 1, MT_DATA); 2964 if (m_notify == NULL) 2965 /* no space left */ 2966 return; 2967 SCTP_BUF_LEN(m_notify) = 0; 2968 sai = mtod(m_notify, struct sctp_adaptation_event *); 2969 sai->sai_type = SCTP_ADAPTATION_INDICATION; 2970 sai->sai_flags = 0; 2971 sai->sai_length = sizeof(struct sctp_adaptation_event); 2972 sai->sai_adaptation_ind = stcb->asoc.peers_adaptation; 2973 sai->sai_assoc_id = sctp_get_associd(stcb); 2974 2975 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event); 2976 SCTP_BUF_NEXT(m_notify) = NULL; 2977 2978 /* append to socket */ 2979 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 2980 0, 0, stcb->asoc.context, 0, 0, 0, 2981 m_notify); 2982 if (control == NULL) { 2983 /* no memory */ 2984 sctp_m_freem(m_notify); 2985 return; 2986 } 2987 control->length = SCTP_BUF_LEN(m_notify); 2988 control->spec_flags = M_NOTIFICATION; 2989 /* not that we need this */ 2990 control->tail_mbuf = m_notify; 2991 sctp_add_to_readq(stcb->sctp_ep, stcb, 2992 control, 2993 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 2994 } 2995 2996 /* This always must be called with the read-queue LOCKED in the INP */ 2997 static void 2998 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error, 2999 uint32_t val, int so_locked 3000 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 3001 SCTP_UNUSED 3002 #endif 3003 ) 3004 { 3005 struct mbuf *m_notify; 3006 struct sctp_pdapi_event *pdapi; 3007 struct sctp_queued_to_read *control; 3008 struct sockbuf *sb; 3009 3010 if ((stcb == NULL) || 3011 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) { 3012 /* event not enabled */ 3013 return; 3014 } 3015 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) { 3016 return; 3017 } 3018 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_DONTWAIT, 1, MT_DATA); 3019 if (m_notify == NULL) 3020 /* no space left */ 3021 return; 3022 SCTP_BUF_LEN(m_notify) = 0; 3023 pdapi = mtod(m_notify, struct sctp_pdapi_event *); 3024 pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT; 3025 pdapi->pdapi_flags = 0; 3026 pdapi->pdapi_length = sizeof(struct sctp_pdapi_event); 3027 pdapi->pdapi_indication = error; 3028 pdapi->pdapi_stream = (val >> 16); 3029 pdapi->pdapi_seq = (val & 0x0000ffff); 3030 pdapi->pdapi_assoc_id = sctp_get_associd(stcb); 3031 3032 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event); 3033 SCTP_BUF_NEXT(m_notify) = NULL; 3034 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3035 0, 0, stcb->asoc.context, 0, 0, 0, 3036 m_notify); 3037 if (control == NULL) { 3038 /* no memory */ 3039 sctp_m_freem(m_notify); 3040 return; 3041 } 3042 control->spec_flags = M_NOTIFICATION; 3043 control->length = SCTP_BUF_LEN(m_notify); 3044 /* not that we need this */ 3045 control->tail_mbuf = m_notify; 3046 control->held_length = 0; 3047 control->length = 0; 3048 sb = &stcb->sctp_socket->so_rcv; 3049 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 3050 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify)); 3051 } 3052 sctp_sballoc(stcb, sb, m_notify); 3053 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 3054 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 3055 } 3056 atomic_add_int(&control->length, SCTP_BUF_LEN(m_notify)); 3057 control->end_added = 1; 3058 if (stcb->asoc.control_pdapi) 3059 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next); 3060 else { 3061 /* we really should not see this case */ 3062 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next); 3063 } 3064 if (stcb->sctp_ep && stcb->sctp_socket) { 3065 /* This should always be the case */ 3066 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3067 struct socket *so; 3068 3069 so = SCTP_INP_SO(stcb->sctp_ep); 3070 if (!so_locked) { 3071 atomic_add_int(&stcb->asoc.refcnt, 1); 3072 SCTP_TCB_UNLOCK(stcb); 3073 SCTP_SOCKET_LOCK(so, 1); 3074 SCTP_TCB_LOCK(stcb); 3075 atomic_subtract_int(&stcb->asoc.refcnt, 1); 3076 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3077 SCTP_SOCKET_UNLOCK(so, 1); 3078 return; 3079 } 3080 } 3081 #endif 3082 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 3083 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3084 if (!so_locked) { 3085 SCTP_SOCKET_UNLOCK(so, 1); 3086 } 3087 #endif 3088 } 3089 } 3090 3091 static void 3092 sctp_notify_shutdown_event(struct sctp_tcb *stcb) 3093 { 3094 struct mbuf *m_notify; 3095 struct sctp_shutdown_event *sse; 3096 struct sctp_queued_to_read *control; 3097 3098 /* 3099 * For TCP model AND UDP connected sockets we will send an error up 3100 * when an SHUTDOWN completes 3101 */ 3102 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 3103 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 3104 /* mark socket closed for read/write and wakeup! */ 3105 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3106 struct socket *so; 3107 3108 so = SCTP_INP_SO(stcb->sctp_ep); 3109 atomic_add_int(&stcb->asoc.refcnt, 1); 3110 SCTP_TCB_UNLOCK(stcb); 3111 SCTP_SOCKET_LOCK(so, 1); 3112 SCTP_TCB_LOCK(stcb); 3113 atomic_subtract_int(&stcb->asoc.refcnt, 1); 3114 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 3115 SCTP_SOCKET_UNLOCK(so, 1); 3116 return; 3117 } 3118 #endif 3119 socantsendmore(stcb->sctp_socket); 3120 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3121 SCTP_SOCKET_UNLOCK(so, 1); 3122 #endif 3123 } 3124 if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) { 3125 /* event not enabled */ 3126 return; 3127 } 3128 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_DONTWAIT, 1, MT_DATA); 3129 if (m_notify == NULL) 3130 /* no space left */ 3131 return; 3132 sse = mtod(m_notify, struct sctp_shutdown_event *); 3133 sse->sse_type = SCTP_SHUTDOWN_EVENT; 3134 sse->sse_flags = 0; 3135 sse->sse_length = sizeof(struct sctp_shutdown_event); 3136 sse->sse_assoc_id = sctp_get_associd(stcb); 3137 3138 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event); 3139 SCTP_BUF_NEXT(m_notify) = NULL; 3140 3141 /* append to socket */ 3142 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3143 0, 0, stcb->asoc.context, 0, 0, 0, 3144 m_notify); 3145 if (control == NULL) { 3146 /* no memory */ 3147 sctp_m_freem(m_notify); 3148 return; 3149 } 3150 control->spec_flags = M_NOTIFICATION; 3151 control->length = SCTP_BUF_LEN(m_notify); 3152 /* not that we need this */ 3153 control->tail_mbuf = m_notify; 3154 sctp_add_to_readq(stcb->sctp_ep, stcb, 3155 control, 3156 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3157 } 3158 3159 static void 3160 sctp_notify_sender_dry_event(struct sctp_tcb *stcb, 3161 int so_locked 3162 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 3163 SCTP_UNUSED 3164 #endif 3165 ) 3166 { 3167 struct mbuf *m_notify; 3168 struct sctp_sender_dry_event *event; 3169 struct sctp_queued_to_read *control; 3170 3171 if ((stcb == NULL) || 3172 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) { 3173 /* event not enabled */ 3174 return; 3175 } 3176 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_DONTWAIT, 1, MT_DATA); 3177 if (m_notify == NULL) { 3178 /* no space left */ 3179 return; 3180 } 3181 SCTP_BUF_LEN(m_notify) = 0; 3182 event = mtod(m_notify, struct sctp_sender_dry_event *); 3183 event->sender_dry_type = SCTP_SENDER_DRY_EVENT; 3184 event->sender_dry_flags = 0; 3185 event->sender_dry_length = sizeof(struct sctp_sender_dry_event); 3186 event->sender_dry_assoc_id = sctp_get_associd(stcb); 3187 3188 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event); 3189 SCTP_BUF_NEXT(m_notify) = NULL; 3190 3191 /* append to socket */ 3192 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3193 0, 0, stcb->asoc.context, 0, 0, 0, 3194 m_notify); 3195 if (control == NULL) { 3196 /* no memory */ 3197 sctp_m_freem(m_notify); 3198 return; 3199 } 3200 control->length = SCTP_BUF_LEN(m_notify); 3201 control->spec_flags = M_NOTIFICATION; 3202 /* not that we need this */ 3203 control->tail_mbuf = m_notify; 3204 sctp_add_to_readq(stcb->sctp_ep, stcb, control, 3205 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked); 3206 } 3207 3208 3209 void 3210 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag) 3211 { 3212 struct mbuf *m_notify; 3213 struct sctp_queued_to_read *control; 3214 struct sctp_stream_change_event *stradd; 3215 int len; 3216 3217 if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_STREAM_RESETEVNT)) { 3218 /* event not enabled */ 3219 return; 3220 } 3221 if ((stcb->asoc.peer_req_out) && flag) { 3222 /* Peer made the request, don't tell the local user */ 3223 stcb->asoc.peer_req_out = 0; 3224 return; 3225 } 3226 stcb->asoc.peer_req_out = 0; 3227 m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 3228 if (m_notify == NULL) 3229 /* no space left */ 3230 return; 3231 SCTP_BUF_LEN(m_notify) = 0; 3232 len = sizeof(struct sctp_stream_change_event); 3233 if (len > M_TRAILINGSPACE(m_notify)) { 3234 /* never enough room */ 3235 sctp_m_freem(m_notify); 3236 return; 3237 } 3238 stradd = mtod(m_notify, struct sctp_stream_change_event *); 3239 stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT; 3240 stradd->strchange_flags = flag; 3241 stradd->strchange_length = len; 3242 stradd->strchange_assoc_id = sctp_get_associd(stcb); 3243 stradd->strchange_instrms = numberin; 3244 stradd->strchange_outstrms = numberout; 3245 SCTP_BUF_LEN(m_notify) = len; 3246 SCTP_BUF_NEXT(m_notify) = NULL; 3247 if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3248 /* no space */ 3249 sctp_m_freem(m_notify); 3250 return; 3251 } 3252 /* append to socket */ 3253 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3254 0, 0, stcb->asoc.context, 0, 0, 0, 3255 m_notify); 3256 if (control == NULL) { 3257 /* no memory */ 3258 sctp_m_freem(m_notify); 3259 return; 3260 } 3261 control->spec_flags = M_NOTIFICATION; 3262 control->length = SCTP_BUF_LEN(m_notify); 3263 /* not that we need this */ 3264 control->tail_mbuf = m_notify; 3265 sctp_add_to_readq(stcb->sctp_ep, stcb, 3266 control, 3267 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3268 } 3269 3270 void 3271 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag) 3272 { 3273 struct mbuf *m_notify; 3274 struct sctp_queued_to_read *control; 3275 struct sctp_assoc_reset_event *strasoc; 3276 int len; 3277 3278 if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_STREAM_RESETEVNT)) { 3279 /* event not enabled */ 3280 return; 3281 } 3282 m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 3283 if (m_notify == NULL) 3284 /* no space left */ 3285 return; 3286 SCTP_BUF_LEN(m_notify) = 0; 3287 len = sizeof(struct sctp_assoc_reset_event); 3288 if (len > M_TRAILINGSPACE(m_notify)) { 3289 /* never enough room */ 3290 sctp_m_freem(m_notify); 3291 return; 3292 } 3293 strasoc = mtod(m_notify, struct sctp_assoc_reset_event *); 3294 strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT; 3295 strasoc->assocreset_flags = flag; 3296 strasoc->assocreset_length = len; 3297 strasoc->assocreset_assoc_id = sctp_get_associd(stcb); 3298 strasoc->assocreset_local_tsn = sending_tsn; 3299 strasoc->assocreset_remote_tsn = recv_tsn; 3300 SCTP_BUF_LEN(m_notify) = len; 3301 SCTP_BUF_NEXT(m_notify) = NULL; 3302 if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3303 /* no space */ 3304 sctp_m_freem(m_notify); 3305 return; 3306 } 3307 /* append to socket */ 3308 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3309 0, 0, stcb->asoc.context, 0, 0, 0, 3310 m_notify); 3311 if (control == NULL) { 3312 /* no memory */ 3313 sctp_m_freem(m_notify); 3314 return; 3315 } 3316 control->spec_flags = M_NOTIFICATION; 3317 control->length = SCTP_BUF_LEN(m_notify); 3318 /* not that we need this */ 3319 control->tail_mbuf = m_notify; 3320 sctp_add_to_readq(stcb->sctp_ep, stcb, 3321 control, 3322 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3323 } 3324 3325 3326 3327 static void 3328 sctp_notify_stream_reset(struct sctp_tcb *stcb, 3329 int number_entries, uint16_t * list, int flag) 3330 { 3331 struct mbuf *m_notify; 3332 struct sctp_queued_to_read *control; 3333 struct sctp_stream_reset_event *strreset; 3334 int len; 3335 3336 if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_STREAM_RESETEVNT)) { 3337 /* event not enabled */ 3338 return; 3339 } 3340 m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 3341 if (m_notify == NULL) 3342 /* no space left */ 3343 return; 3344 SCTP_BUF_LEN(m_notify) = 0; 3345 len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t)); 3346 if (len > M_TRAILINGSPACE(m_notify)) { 3347 /* never enough room */ 3348 sctp_m_freem(m_notify); 3349 return; 3350 } 3351 strreset = mtod(m_notify, struct sctp_stream_reset_event *); 3352 strreset->strreset_type = SCTP_STREAM_RESET_EVENT; 3353 strreset->strreset_flags = flag; 3354 strreset->strreset_length = len; 3355 strreset->strreset_assoc_id = sctp_get_associd(stcb); 3356 if (number_entries) { 3357 int i; 3358 3359 for (i = 0; i < number_entries; i++) { 3360 strreset->strreset_stream_list[i] = ntohs(list[i]); 3361 } 3362 } 3363 SCTP_BUF_LEN(m_notify) = len; 3364 SCTP_BUF_NEXT(m_notify) = NULL; 3365 if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3366 /* no space */ 3367 sctp_m_freem(m_notify); 3368 return; 3369 } 3370 /* append to socket */ 3371 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3372 0, 0, stcb->asoc.context, 0, 0, 0, 3373 m_notify); 3374 if (control == NULL) { 3375 /* no memory */ 3376 sctp_m_freem(m_notify); 3377 return; 3378 } 3379 control->spec_flags = M_NOTIFICATION; 3380 control->length = SCTP_BUF_LEN(m_notify); 3381 /* not that we need this */ 3382 control->tail_mbuf = m_notify; 3383 sctp_add_to_readq(stcb->sctp_ep, stcb, 3384 control, 3385 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3386 } 3387 3388 3389 void 3390 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb, 3391 uint32_t error, void *data, int so_locked 3392 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 3393 SCTP_UNUSED 3394 #endif 3395 ) 3396 { 3397 if ((stcb == NULL) || 3398 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 3399 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 3400 (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) { 3401 /* If the socket is gone we are out of here */ 3402 return; 3403 } 3404 if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) { 3405 return; 3406 } 3407 if (stcb && ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) || 3408 (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED))) { 3409 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) || 3410 (notification == SCTP_NOTIFY_INTERFACE_UP) || 3411 (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) { 3412 /* Don't report these in front states */ 3413 return; 3414 } 3415 } 3416 switch (notification) { 3417 case SCTP_NOTIFY_ASSOC_UP: 3418 if (stcb->asoc.assoc_up_sent == 0) { 3419 sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, so_locked); 3420 stcb->asoc.assoc_up_sent = 1; 3421 } 3422 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) { 3423 sctp_notify_adaptation_layer(stcb); 3424 } 3425 if (stcb->asoc.peer_supports_auth == 0) { 3426 sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0, 3427 NULL, so_locked); 3428 } 3429 break; 3430 case SCTP_NOTIFY_ASSOC_DOWN: 3431 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, so_locked); 3432 break; 3433 case SCTP_NOTIFY_INTERFACE_DOWN: 3434 { 3435 struct sctp_nets *net; 3436 3437 net = (struct sctp_nets *)data; 3438 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE, 3439 (struct sockaddr *)&net->ro._l_addr, error); 3440 break; 3441 } 3442 case SCTP_NOTIFY_INTERFACE_UP: 3443 { 3444 struct sctp_nets *net; 3445 3446 net = (struct sctp_nets *)data; 3447 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE, 3448 (struct sockaddr *)&net->ro._l_addr, error); 3449 break; 3450 } 3451 case SCTP_NOTIFY_INTERFACE_CONFIRMED: 3452 { 3453 struct sctp_nets *net; 3454 3455 net = (struct sctp_nets *)data; 3456 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED, 3457 (struct sockaddr *)&net->ro._l_addr, error); 3458 break; 3459 } 3460 case SCTP_NOTIFY_SPECIAL_SP_FAIL: 3461 sctp_notify_send_failed2(stcb, error, 3462 (struct sctp_stream_queue_pending *)data, so_locked); 3463 break; 3464 case SCTP_NOTIFY_DG_FAIL: 3465 sctp_notify_send_failed(stcb, error, 3466 (struct sctp_tmit_chunk *)data, so_locked); 3467 break; 3468 case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION: 3469 { 3470 uint32_t val; 3471 3472 val = *((uint32_t *) data); 3473 3474 sctp_notify_partial_delivery_indication(stcb, error, val, so_locked); 3475 break; 3476 } 3477 case SCTP_NOTIFY_STRDATA_ERR: 3478 break; 3479 case SCTP_NOTIFY_ASSOC_ABORTED: 3480 if ((stcb) && (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) || 3481 ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED))) { 3482 sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, so_locked); 3483 } else { 3484 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, so_locked); 3485 } 3486 break; 3487 case SCTP_NOTIFY_PEER_OPENED_STREAM: 3488 break; 3489 case SCTP_NOTIFY_STREAM_OPENED_OK: 3490 break; 3491 case SCTP_NOTIFY_ASSOC_RESTART: 3492 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, so_locked); 3493 if (stcb->asoc.peer_supports_auth == 0) { 3494 sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0, 3495 NULL, so_locked); 3496 } 3497 break; 3498 case SCTP_NOTIFY_HB_RESP: 3499 break; 3500 case SCTP_NOTIFY_STR_RESET_SEND: 3501 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_INCOMING); 3502 break; 3503 case SCTP_NOTIFY_STR_RESET_RECV: 3504 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_OUTGOING); 3505 break; 3506 case SCTP_NOTIFY_STR_RESET_FAILED_OUT: 3507 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), 3508 (SCTP_STREAM_RESET_OUTGOING | SCTP_STREAM_RESET_INCOMING)); 3509 break; 3510 case SCTP_NOTIFY_STR_RESET_FAILED_IN: 3511 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), 3512 (SCTP_STREAM_RESET_OUTGOING | SCTP_STREAM_RESET_INCOMING)); 3513 break; 3514 case SCTP_NOTIFY_ASCONF_ADD_IP: 3515 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data, 3516 error); 3517 break; 3518 case SCTP_NOTIFY_ASCONF_DELETE_IP: 3519 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data, 3520 error); 3521 break; 3522 case SCTP_NOTIFY_ASCONF_SET_PRIMARY: 3523 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data, 3524 error); 3525 break; 3526 case SCTP_NOTIFY_ASCONF_SUCCESS: 3527 break; 3528 case SCTP_NOTIFY_ASCONF_FAILED: 3529 break; 3530 case SCTP_NOTIFY_PEER_SHUTDOWN: 3531 sctp_notify_shutdown_event(stcb); 3532 break; 3533 case SCTP_NOTIFY_AUTH_NEW_KEY: 3534 sctp_notify_authentication(stcb, SCTP_AUTH_NEWKEY, error, 3535 (uint16_t) (uintptr_t) data, 3536 so_locked); 3537 break; 3538 case SCTP_NOTIFY_AUTH_FREE_KEY: 3539 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error, 3540 (uint16_t) (uintptr_t) data, 3541 so_locked); 3542 break; 3543 case SCTP_NOTIFY_NO_PEER_AUTH: 3544 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error, 3545 (uint16_t) (uintptr_t) data, 3546 so_locked); 3547 break; 3548 case SCTP_NOTIFY_SENDER_DRY: 3549 sctp_notify_sender_dry_event(stcb, so_locked); 3550 break; 3551 default: 3552 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n", 3553 __FUNCTION__, notification, notification); 3554 break; 3555 } /* end switch */ 3556 } 3557 3558 void 3559 sctp_report_all_outbound(struct sctp_tcb *stcb, int holds_lock, int so_locked 3560 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 3561 SCTP_UNUSED 3562 #endif 3563 ) 3564 { 3565 struct sctp_association *asoc; 3566 struct sctp_stream_out *outs; 3567 struct sctp_tmit_chunk *chk, *nchk; 3568 struct sctp_stream_queue_pending *sp, *nsp; 3569 int i; 3570 3571 if (stcb == NULL) { 3572 return; 3573 } 3574 asoc = &stcb->asoc; 3575 if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) { 3576 /* already being freed */ 3577 return; 3578 } 3579 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 3580 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 3581 (asoc->state & SCTP_STATE_CLOSED_SOCKET)) { 3582 return; 3583 } 3584 /* now through all the gunk freeing chunks */ 3585 if (holds_lock == 0) { 3586 SCTP_TCB_SEND_LOCK(stcb); 3587 } 3588 /* sent queue SHOULD be empty */ 3589 TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) { 3590 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next); 3591 asoc->sent_queue_cnt--; 3592 if (chk->data != NULL) { 3593 sctp_free_bufspace(stcb, asoc, chk, 1); 3594 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, 3595 SCTP_NOTIFY_DATAGRAM_SENT, chk, so_locked); 3596 if (chk->data) { 3597 sctp_m_freem(chk->data); 3598 chk->data = NULL; 3599 } 3600 } 3601 sctp_free_a_chunk(stcb, chk, so_locked); 3602 /* sa_ignore FREED_MEMORY */ 3603 } 3604 /* pending send queue SHOULD be empty */ 3605 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 3606 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next); 3607 asoc->send_queue_cnt--; 3608 if (chk->data != NULL) { 3609 sctp_free_bufspace(stcb, asoc, chk, 1); 3610 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, 3611 SCTP_NOTIFY_DATAGRAM_UNSENT, chk, so_locked); 3612 if (chk->data) { 3613 sctp_m_freem(chk->data); 3614 chk->data = NULL; 3615 } 3616 } 3617 sctp_free_a_chunk(stcb, chk, so_locked); 3618 /* sa_ignore FREED_MEMORY */ 3619 } 3620 for (i = 0; i < asoc->streamoutcnt; i++) { 3621 /* For each stream */ 3622 outs = &asoc->strmout[i]; 3623 /* clean up any sends there */ 3624 asoc->locked_on_sending = NULL; 3625 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) { 3626 asoc->stream_queue_cnt--; 3627 TAILQ_REMOVE(&outs->outqueue, sp, next); 3628 sctp_free_spbufspace(stcb, asoc, sp); 3629 if (sp->data) { 3630 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb, 3631 SCTP_NOTIFY_DATAGRAM_UNSENT, (void *)sp, so_locked); 3632 if (sp->data) { 3633 sctp_m_freem(sp->data); 3634 sp->data = NULL; 3635 } 3636 } 3637 if (sp->net) { 3638 sctp_free_remote_addr(sp->net); 3639 sp->net = NULL; 3640 } 3641 /* Free the chunk */ 3642 sctp_free_a_strmoq(stcb, sp, so_locked); 3643 /* sa_ignore FREED_MEMORY */ 3644 } 3645 } 3646 3647 if (holds_lock == 0) { 3648 SCTP_TCB_SEND_UNLOCK(stcb); 3649 } 3650 } 3651 3652 void 3653 sctp_abort_notification(struct sctp_tcb *stcb, int error, int so_locked 3654 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 3655 SCTP_UNUSED 3656 #endif 3657 ) 3658 { 3659 if (stcb == NULL) { 3660 return; 3661 } 3662 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) || 3663 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 3664 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) { 3665 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED; 3666 } 3667 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 3668 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 3669 (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) { 3670 return; 3671 } 3672 /* Tell them we lost the asoc */ 3673 sctp_report_all_outbound(stcb, 1, so_locked); 3674 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_ABORTED, stcb, error, NULL, so_locked); 3675 } 3676 3677 void 3678 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 3679 struct mbuf *m, int iphlen, struct sctphdr *sh, struct mbuf *op_err, 3680 uint32_t vrf_id, uint16_t port) 3681 { 3682 uint32_t vtag; 3683 3684 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3685 struct socket *so; 3686 3687 #endif 3688 3689 vtag = 0; 3690 if (stcb != NULL) { 3691 /* We have a TCB to abort, send notification too */ 3692 vtag = stcb->asoc.peer_vtag; 3693 sctp_abort_notification(stcb, 0, SCTP_SO_NOT_LOCKED); 3694 /* get the assoc vrf id and table id */ 3695 vrf_id = stcb->asoc.vrf_id; 3696 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED; 3697 } 3698 sctp_send_abort(m, iphlen, sh, vtag, op_err, vrf_id, port); 3699 if (stcb != NULL) { 3700 /* Ok, now lets free it */ 3701 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3702 so = SCTP_INP_SO(inp); 3703 atomic_add_int(&stcb->asoc.refcnt, 1); 3704 SCTP_TCB_UNLOCK(stcb); 3705 SCTP_SOCKET_LOCK(so, 1); 3706 SCTP_TCB_LOCK(stcb); 3707 atomic_subtract_int(&stcb->asoc.refcnt, 1); 3708 #endif 3709 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 3710 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) || 3711 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 3712 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 3713 } 3714 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_4); 3715 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3716 SCTP_SOCKET_UNLOCK(so, 1); 3717 #endif 3718 } 3719 } 3720 3721 #ifdef SCTP_ASOCLOG_OF_TSNS 3722 void 3723 sctp_print_out_track_log(struct sctp_tcb *stcb) 3724 { 3725 #ifdef NOSIY_PRINTS 3726 int i; 3727 3728 SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code); 3729 SCTP_PRINTF("IN bound TSN log-aaa\n"); 3730 if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) { 3731 SCTP_PRINTF("None rcvd\n"); 3732 goto none_in; 3733 } 3734 if (stcb->asoc.tsn_in_wrapped) { 3735 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) { 3736 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 3737 stcb->asoc.in_tsnlog[i].tsn, 3738 stcb->asoc.in_tsnlog[i].strm, 3739 stcb->asoc.in_tsnlog[i].seq, 3740 stcb->asoc.in_tsnlog[i].flgs, 3741 stcb->asoc.in_tsnlog[i].sz); 3742 } 3743 } 3744 if (stcb->asoc.tsn_in_at) { 3745 for (i = 0; i < stcb->asoc.tsn_in_at; i++) { 3746 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 3747 stcb->asoc.in_tsnlog[i].tsn, 3748 stcb->asoc.in_tsnlog[i].strm, 3749 stcb->asoc.in_tsnlog[i].seq, 3750 stcb->asoc.in_tsnlog[i].flgs, 3751 stcb->asoc.in_tsnlog[i].sz); 3752 } 3753 } 3754 none_in: 3755 SCTP_PRINTF("OUT bound TSN log-aaa\n"); 3756 if ((stcb->asoc.tsn_out_at == 0) && 3757 (stcb->asoc.tsn_out_wrapped == 0)) { 3758 SCTP_PRINTF("None sent\n"); 3759 } 3760 if (stcb->asoc.tsn_out_wrapped) { 3761 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) { 3762 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 3763 stcb->asoc.out_tsnlog[i].tsn, 3764 stcb->asoc.out_tsnlog[i].strm, 3765 stcb->asoc.out_tsnlog[i].seq, 3766 stcb->asoc.out_tsnlog[i].flgs, 3767 stcb->asoc.out_tsnlog[i].sz); 3768 } 3769 } 3770 if (stcb->asoc.tsn_out_at) { 3771 for (i = 0; i < stcb->asoc.tsn_out_at; i++) { 3772 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 3773 stcb->asoc.out_tsnlog[i].tsn, 3774 stcb->asoc.out_tsnlog[i].strm, 3775 stcb->asoc.out_tsnlog[i].seq, 3776 stcb->asoc.out_tsnlog[i].flgs, 3777 stcb->asoc.out_tsnlog[i].sz); 3778 } 3779 } 3780 #endif 3781 } 3782 3783 #endif 3784 3785 void 3786 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 3787 int error, struct mbuf *op_err, 3788 int so_locked 3789 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 3790 SCTP_UNUSED 3791 #endif 3792 ) 3793 { 3794 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3795 struct socket *so; 3796 3797 #endif 3798 3799 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3800 so = SCTP_INP_SO(inp); 3801 #endif 3802 if (stcb == NULL) { 3803 /* Got to have a TCB */ 3804 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3805 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) { 3806 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT, 3807 SCTP_CALLED_DIRECTLY_NOCMPSET); 3808 } 3809 } 3810 return; 3811 } else { 3812 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED; 3813 } 3814 /* notify the ulp */ 3815 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) 3816 sctp_abort_notification(stcb, error, so_locked); 3817 /* notify the peer */ 3818 #if defined(SCTP_PANIC_ON_ABORT) 3819 panic("aborting an association"); 3820 #endif 3821 sctp_send_abort_tcb(stcb, op_err, so_locked); 3822 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 3823 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) || 3824 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 3825 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 3826 } 3827 /* now free the asoc */ 3828 #ifdef SCTP_ASOCLOG_OF_TSNS 3829 sctp_print_out_track_log(stcb); 3830 #endif 3831 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3832 if (!so_locked) { 3833 atomic_add_int(&stcb->asoc.refcnt, 1); 3834 SCTP_TCB_UNLOCK(stcb); 3835 SCTP_SOCKET_LOCK(so, 1); 3836 SCTP_TCB_LOCK(stcb); 3837 atomic_subtract_int(&stcb->asoc.refcnt, 1); 3838 } 3839 #endif 3840 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_5); 3841 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 3842 if (!so_locked) { 3843 SCTP_SOCKET_UNLOCK(so, 1); 3844 } 3845 #endif 3846 } 3847 3848 void 3849 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh, 3850 struct sctp_inpcb *inp, struct mbuf *op_err, uint32_t vrf_id, uint16_t port) 3851 { 3852 struct sctp_chunkhdr *ch, chunk_buf; 3853 unsigned int chk_length; 3854 int contains_init_chunk; 3855 3856 SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue); 3857 /* Generate a TO address for future reference */ 3858 if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 3859 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) { 3860 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT, 3861 SCTP_CALLED_DIRECTLY_NOCMPSET); 3862 } 3863 } 3864 contains_init_chunk = 0; 3865 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 3866 sizeof(*ch), (uint8_t *) & chunk_buf); 3867 while (ch != NULL) { 3868 chk_length = ntohs(ch->chunk_length); 3869 if (chk_length < sizeof(*ch)) { 3870 /* break to abort land */ 3871 break; 3872 } 3873 switch (ch->chunk_type) { 3874 case SCTP_INIT: 3875 contains_init_chunk = 1; 3876 break; 3877 case SCTP_COOKIE_ECHO: 3878 /* We hit here only if the assoc is being freed */ 3879 return; 3880 case SCTP_PACKET_DROPPED: 3881 /* we don't respond to pkt-dropped */ 3882 return; 3883 case SCTP_ABORT_ASSOCIATION: 3884 /* we don't respond with an ABORT to an ABORT */ 3885 return; 3886 case SCTP_SHUTDOWN_COMPLETE: 3887 /* 3888 * we ignore it since we are not waiting for it and 3889 * peer is gone 3890 */ 3891 return; 3892 case SCTP_SHUTDOWN_ACK: 3893 sctp_send_shutdown_complete2(m, sh, vrf_id, port); 3894 return; 3895 default: 3896 break; 3897 } 3898 offset += SCTP_SIZE32(chk_length); 3899 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 3900 sizeof(*ch), (uint8_t *) & chunk_buf); 3901 } 3902 if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) || 3903 ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) && 3904 (contains_init_chunk == 0))) { 3905 sctp_send_abort(m, iphlen, sh, 0, op_err, vrf_id, port); 3906 } 3907 } 3908 3909 /* 3910 * check the inbound datagram to make sure there is not an abort inside it, 3911 * if there is return 1, else return 0. 3912 */ 3913 int 3914 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill) 3915 { 3916 struct sctp_chunkhdr *ch; 3917 struct sctp_init_chunk *init_chk, chunk_buf; 3918 int offset; 3919 unsigned int chk_length; 3920 3921 offset = iphlen + sizeof(struct sctphdr); 3922 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch), 3923 (uint8_t *) & chunk_buf); 3924 while (ch != NULL) { 3925 chk_length = ntohs(ch->chunk_length); 3926 if (chk_length < sizeof(*ch)) { 3927 /* packet is probably corrupt */ 3928 break; 3929 } 3930 /* we seem to be ok, is it an abort? */ 3931 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) { 3932 /* yep, tell them */ 3933 return (1); 3934 } 3935 if (ch->chunk_type == SCTP_INITIATION) { 3936 /* need to update the Vtag */ 3937 init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m, 3938 offset, sizeof(*init_chk), (uint8_t *) & chunk_buf); 3939 if (init_chk != NULL) { 3940 *vtagfill = ntohl(init_chk->init.initiate_tag); 3941 } 3942 } 3943 /* Nope, move to the next chunk */ 3944 offset += SCTP_SIZE32(chk_length); 3945 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 3946 sizeof(*ch), (uint8_t *) & chunk_buf); 3947 } 3948 return (0); 3949 } 3950 3951 /* 3952 * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id 3953 * set (i.e. it's 0) so, create this function to compare link local scopes 3954 */ 3955 #ifdef INET6 3956 uint32_t 3957 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2) 3958 { 3959 struct sockaddr_in6 a, b; 3960 3961 /* save copies */ 3962 a = *addr1; 3963 b = *addr2; 3964 3965 if (a.sin6_scope_id == 0) 3966 if (sa6_recoverscope(&a)) { 3967 /* can't get scope, so can't match */ 3968 return (0); 3969 } 3970 if (b.sin6_scope_id == 0) 3971 if (sa6_recoverscope(&b)) { 3972 /* can't get scope, so can't match */ 3973 return (0); 3974 } 3975 if (a.sin6_scope_id != b.sin6_scope_id) 3976 return (0); 3977 3978 return (1); 3979 } 3980 3981 /* 3982 * returns a sockaddr_in6 with embedded scope recovered and removed 3983 */ 3984 struct sockaddr_in6 * 3985 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store) 3986 { 3987 /* check and strip embedded scope junk */ 3988 if (addr->sin6_family == AF_INET6) { 3989 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) { 3990 if (addr->sin6_scope_id == 0) { 3991 *store = *addr; 3992 if (!sa6_recoverscope(store)) { 3993 /* use the recovered scope */ 3994 addr = store; 3995 } 3996 } else { 3997 /* else, return the original "to" addr */ 3998 in6_clearscope(&addr->sin6_addr); 3999 } 4000 } 4001 } 4002 return (addr); 4003 } 4004 4005 #endif 4006 4007 /* 4008 * are the two addresses the same? currently a "scopeless" check returns: 1 4009 * if same, 0 if not 4010 */ 4011 int 4012 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2) 4013 { 4014 4015 /* must be valid */ 4016 if (sa1 == NULL || sa2 == NULL) 4017 return (0); 4018 4019 /* must be the same family */ 4020 if (sa1->sa_family != sa2->sa_family) 4021 return (0); 4022 4023 switch (sa1->sa_family) { 4024 #ifdef INET6 4025 case AF_INET6: 4026 { 4027 /* IPv6 addresses */ 4028 struct sockaddr_in6 *sin6_1, *sin6_2; 4029 4030 sin6_1 = (struct sockaddr_in6 *)sa1; 4031 sin6_2 = (struct sockaddr_in6 *)sa2; 4032 return (SCTP6_ARE_ADDR_EQUAL(sin6_1, 4033 sin6_2)); 4034 } 4035 #endif 4036 #ifdef INET 4037 case AF_INET: 4038 { 4039 /* IPv4 addresses */ 4040 struct sockaddr_in *sin_1, *sin_2; 4041 4042 sin_1 = (struct sockaddr_in *)sa1; 4043 sin_2 = (struct sockaddr_in *)sa2; 4044 return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr); 4045 } 4046 #endif 4047 default: 4048 /* we don't do these... */ 4049 return (0); 4050 } 4051 } 4052 4053 void 4054 sctp_print_address(struct sockaddr *sa) 4055 { 4056 #ifdef INET6 4057 char ip6buf[INET6_ADDRSTRLEN]; 4058 4059 ip6buf[0] = 0; 4060 #endif 4061 4062 switch (sa->sa_family) { 4063 #ifdef INET6 4064 case AF_INET6: 4065 { 4066 struct sockaddr_in6 *sin6; 4067 4068 sin6 = (struct sockaddr_in6 *)sa; 4069 SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n", 4070 ip6_sprintf(ip6buf, &sin6->sin6_addr), 4071 ntohs(sin6->sin6_port), 4072 sin6->sin6_scope_id); 4073 break; 4074 } 4075 #endif 4076 #ifdef INET 4077 case AF_INET: 4078 { 4079 struct sockaddr_in *sin; 4080 unsigned char *p; 4081 4082 sin = (struct sockaddr_in *)sa; 4083 p = (unsigned char *)&sin->sin_addr; 4084 SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n", 4085 p[0], p[1], p[2], p[3], ntohs(sin->sin_port)); 4086 break; 4087 } 4088 #endif 4089 default: 4090 SCTP_PRINTF("?\n"); 4091 break; 4092 } 4093 } 4094 4095 void 4096 sctp_print_address_pkt(struct ip *iph, struct sctphdr *sh) 4097 { 4098 switch (iph->ip_v) { 4099 #ifdef INET 4100 case IPVERSION: 4101 { 4102 struct sockaddr_in lsa, fsa; 4103 4104 bzero(&lsa, sizeof(lsa)); 4105 lsa.sin_len = sizeof(lsa); 4106 lsa.sin_family = AF_INET; 4107 lsa.sin_addr = iph->ip_src; 4108 lsa.sin_port = sh->src_port; 4109 bzero(&fsa, sizeof(fsa)); 4110 fsa.sin_len = sizeof(fsa); 4111 fsa.sin_family = AF_INET; 4112 fsa.sin_addr = iph->ip_dst; 4113 fsa.sin_port = sh->dest_port; 4114 SCTP_PRINTF("src: "); 4115 sctp_print_address((struct sockaddr *)&lsa); 4116 SCTP_PRINTF("dest: "); 4117 sctp_print_address((struct sockaddr *)&fsa); 4118 break; 4119 } 4120 #endif 4121 #ifdef INET6 4122 case IPV6_VERSION >> 4: 4123 { 4124 struct ip6_hdr *ip6; 4125 struct sockaddr_in6 lsa6, fsa6; 4126 4127 ip6 = (struct ip6_hdr *)iph; 4128 bzero(&lsa6, sizeof(lsa6)); 4129 lsa6.sin6_len = sizeof(lsa6); 4130 lsa6.sin6_family = AF_INET6; 4131 lsa6.sin6_addr = ip6->ip6_src; 4132 lsa6.sin6_port = sh->src_port; 4133 bzero(&fsa6, sizeof(fsa6)); 4134 fsa6.sin6_len = sizeof(fsa6); 4135 fsa6.sin6_family = AF_INET6; 4136 fsa6.sin6_addr = ip6->ip6_dst; 4137 fsa6.sin6_port = sh->dest_port; 4138 SCTP_PRINTF("src: "); 4139 sctp_print_address((struct sockaddr *)&lsa6); 4140 SCTP_PRINTF("dest: "); 4141 sctp_print_address((struct sockaddr *)&fsa6); 4142 break; 4143 } 4144 #endif 4145 default: 4146 /* TSNH */ 4147 break; 4148 } 4149 } 4150 4151 void 4152 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp, 4153 struct sctp_inpcb *new_inp, 4154 struct sctp_tcb *stcb, 4155 int waitflags) 4156 { 4157 /* 4158 * go through our old INP and pull off any control structures that 4159 * belong to stcb and move then to the new inp. 4160 */ 4161 struct socket *old_so, *new_so; 4162 struct sctp_queued_to_read *control, *nctl; 4163 struct sctp_readhead tmp_queue; 4164 struct mbuf *m; 4165 int error = 0; 4166 4167 old_so = old_inp->sctp_socket; 4168 new_so = new_inp->sctp_socket; 4169 TAILQ_INIT(&tmp_queue); 4170 error = sblock(&old_so->so_rcv, waitflags); 4171 if (error) { 4172 /* 4173 * Gak, can't get sblock, we have a problem. data will be 4174 * left stranded.. and we don't dare look at it since the 4175 * other thread may be reading something. Oh well, its a 4176 * screwed up app that does a peeloff OR a accept while 4177 * reading from the main socket... actually its only the 4178 * peeloff() case, since I think read will fail on a 4179 * listening socket.. 4180 */ 4181 return; 4182 } 4183 /* lock the socket buffers */ 4184 SCTP_INP_READ_LOCK(old_inp); 4185 TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) { 4186 /* Pull off all for out target stcb */ 4187 if (control->stcb == stcb) { 4188 /* remove it we want it */ 4189 TAILQ_REMOVE(&old_inp->read_queue, control, next); 4190 TAILQ_INSERT_TAIL(&tmp_queue, control, next); 4191 m = control->data; 4192 while (m) { 4193 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4194 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m)); 4195 } 4196 sctp_sbfree(control, stcb, &old_so->so_rcv, m); 4197 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4198 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 4199 } 4200 m = SCTP_BUF_NEXT(m); 4201 } 4202 } 4203 } 4204 SCTP_INP_READ_UNLOCK(old_inp); 4205 /* Remove the sb-lock on the old socket */ 4206 4207 sbunlock(&old_so->so_rcv); 4208 /* Now we move them over to the new socket buffer */ 4209 SCTP_INP_READ_LOCK(new_inp); 4210 TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) { 4211 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next); 4212 m = control->data; 4213 while (m) { 4214 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4215 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m)); 4216 } 4217 sctp_sballoc(stcb, &new_so->so_rcv, m); 4218 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4219 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 4220 } 4221 m = SCTP_BUF_NEXT(m); 4222 } 4223 } 4224 SCTP_INP_READ_UNLOCK(new_inp); 4225 } 4226 4227 void 4228 sctp_add_to_readq(struct sctp_inpcb *inp, 4229 struct sctp_tcb *stcb, 4230 struct sctp_queued_to_read *control, 4231 struct sockbuf *sb, 4232 int end, 4233 int inp_read_lock_held, 4234 int so_locked 4235 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 4236 SCTP_UNUSED 4237 #endif 4238 ) 4239 { 4240 /* 4241 * Here we must place the control on the end of the socket read 4242 * queue AND increment sb_cc so that select will work properly on 4243 * read. 4244 */ 4245 struct mbuf *m, *prev = NULL; 4246 4247 if (inp == NULL) { 4248 /* Gak, TSNH!! */ 4249 #ifdef INVARIANTS 4250 panic("Gak, inp NULL on add_to_readq"); 4251 #endif 4252 return; 4253 } 4254 if (inp_read_lock_held == 0) 4255 SCTP_INP_READ_LOCK(inp); 4256 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) { 4257 sctp_free_remote_addr(control->whoFrom); 4258 if (control->data) { 4259 sctp_m_freem(control->data); 4260 control->data = NULL; 4261 } 4262 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control); 4263 if (inp_read_lock_held == 0) 4264 SCTP_INP_READ_UNLOCK(inp); 4265 return; 4266 } 4267 if (!(control->spec_flags & M_NOTIFICATION)) { 4268 atomic_add_int(&inp->total_recvs, 1); 4269 if (!control->do_not_ref_stcb) { 4270 atomic_add_int(&stcb->total_recvs, 1); 4271 } 4272 } 4273 m = control->data; 4274 control->held_length = 0; 4275 control->length = 0; 4276 while (m) { 4277 if (SCTP_BUF_LEN(m) == 0) { 4278 /* Skip mbufs with NO length */ 4279 if (prev == NULL) { 4280 /* First one */ 4281 control->data = sctp_m_free(m); 4282 m = control->data; 4283 } else { 4284 SCTP_BUF_NEXT(prev) = sctp_m_free(m); 4285 m = SCTP_BUF_NEXT(prev); 4286 } 4287 if (m == NULL) { 4288 control->tail_mbuf = prev; 4289 } 4290 continue; 4291 } 4292 prev = m; 4293 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4294 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m)); 4295 } 4296 sctp_sballoc(stcb, sb, m); 4297 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4298 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 4299 } 4300 atomic_add_int(&control->length, SCTP_BUF_LEN(m)); 4301 m = SCTP_BUF_NEXT(m); 4302 } 4303 if (prev != NULL) { 4304 control->tail_mbuf = prev; 4305 } else { 4306 /* Everything got collapsed out?? */ 4307 sctp_free_remote_addr(control->whoFrom); 4308 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control); 4309 if (inp_read_lock_held == 0) 4310 SCTP_INP_READ_UNLOCK(inp); 4311 return; 4312 } 4313 if (end) { 4314 control->end_added = 1; 4315 } 4316 TAILQ_INSERT_TAIL(&inp->read_queue, control, next); 4317 if (inp_read_lock_held == 0) 4318 SCTP_INP_READ_UNLOCK(inp); 4319 if (inp && inp->sctp_socket) { 4320 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) { 4321 SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket); 4322 } else { 4323 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4324 struct socket *so; 4325 4326 so = SCTP_INP_SO(inp); 4327 if (!so_locked) { 4328 if (stcb) { 4329 atomic_add_int(&stcb->asoc.refcnt, 1); 4330 SCTP_TCB_UNLOCK(stcb); 4331 } 4332 SCTP_SOCKET_LOCK(so, 1); 4333 if (stcb) { 4334 SCTP_TCB_LOCK(stcb); 4335 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4336 } 4337 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4338 SCTP_SOCKET_UNLOCK(so, 1); 4339 return; 4340 } 4341 } 4342 #endif 4343 sctp_sorwakeup(inp, inp->sctp_socket); 4344 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4345 if (!so_locked) { 4346 SCTP_SOCKET_UNLOCK(so, 1); 4347 } 4348 #endif 4349 } 4350 } 4351 } 4352 4353 4354 int 4355 sctp_append_to_readq(struct sctp_inpcb *inp, 4356 struct sctp_tcb *stcb, 4357 struct sctp_queued_to_read *control, 4358 struct mbuf *m, 4359 int end, 4360 int ctls_cumack, 4361 struct sockbuf *sb) 4362 { 4363 /* 4364 * A partial delivery API event is underway. OR we are appending on 4365 * the reassembly queue. 4366 * 4367 * If PDAPI this means we need to add m to the end of the data. 4368 * Increase the length in the control AND increment the sb_cc. 4369 * Otherwise sb is NULL and all we need to do is put it at the end 4370 * of the mbuf chain. 4371 */ 4372 int len = 0; 4373 struct mbuf *mm, *tail = NULL, *prev = NULL; 4374 4375 if (inp) { 4376 SCTP_INP_READ_LOCK(inp); 4377 } 4378 if (control == NULL) { 4379 get_out: 4380 if (inp) { 4381 SCTP_INP_READ_UNLOCK(inp); 4382 } 4383 return (-1); 4384 } 4385 if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ)) { 4386 SCTP_INP_READ_UNLOCK(inp); 4387 return (0); 4388 } 4389 if (control->end_added) { 4390 /* huh this one is complete? */ 4391 goto get_out; 4392 } 4393 mm = m; 4394 if (mm == NULL) { 4395 goto get_out; 4396 } 4397 while (mm) { 4398 if (SCTP_BUF_LEN(mm) == 0) { 4399 /* Skip mbufs with NO lenght */ 4400 if (prev == NULL) { 4401 /* First one */ 4402 m = sctp_m_free(mm); 4403 mm = m; 4404 } else { 4405 SCTP_BUF_NEXT(prev) = sctp_m_free(mm); 4406 mm = SCTP_BUF_NEXT(prev); 4407 } 4408 continue; 4409 } 4410 prev = mm; 4411 len += SCTP_BUF_LEN(mm); 4412 if (sb) { 4413 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4414 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(mm)); 4415 } 4416 sctp_sballoc(stcb, sb, mm); 4417 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4418 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 4419 } 4420 } 4421 mm = SCTP_BUF_NEXT(mm); 4422 } 4423 if (prev) { 4424 tail = prev; 4425 } else { 4426 /* Really there should always be a prev */ 4427 if (m == NULL) { 4428 /* Huh nothing left? */ 4429 #ifdef INVARIANTS 4430 panic("Nothing left to add?"); 4431 #else 4432 goto get_out; 4433 #endif 4434 } 4435 tail = m; 4436 } 4437 if (control->tail_mbuf) { 4438 /* append */ 4439 SCTP_BUF_NEXT(control->tail_mbuf) = m; 4440 control->tail_mbuf = tail; 4441 } else { 4442 /* nothing there */ 4443 #ifdef INVARIANTS 4444 if (control->data != NULL) { 4445 panic("This should NOT happen"); 4446 } 4447 #endif 4448 control->data = m; 4449 control->tail_mbuf = tail; 4450 } 4451 atomic_add_int(&control->length, len); 4452 if (end) { 4453 /* message is complete */ 4454 if (stcb && (control == stcb->asoc.control_pdapi)) { 4455 stcb->asoc.control_pdapi = NULL; 4456 } 4457 control->held_length = 0; 4458 control->end_added = 1; 4459 } 4460 if (stcb == NULL) { 4461 control->do_not_ref_stcb = 1; 4462 } 4463 /* 4464 * When we are appending in partial delivery, the cum-ack is used 4465 * for the actual pd-api highest tsn on this mbuf. The true cum-ack 4466 * is populated in the outbound sinfo structure from the true cumack 4467 * if the association exists... 4468 */ 4469 control->sinfo_tsn = control->sinfo_cumtsn = ctls_cumack; 4470 if (inp) { 4471 SCTP_INP_READ_UNLOCK(inp); 4472 } 4473 if (inp && inp->sctp_socket) { 4474 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) { 4475 SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket); 4476 } else { 4477 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4478 struct socket *so; 4479 4480 so = SCTP_INP_SO(inp); 4481 if (stcb) { 4482 atomic_add_int(&stcb->asoc.refcnt, 1); 4483 SCTP_TCB_UNLOCK(stcb); 4484 } 4485 SCTP_SOCKET_LOCK(so, 1); 4486 if (stcb) { 4487 SCTP_TCB_LOCK(stcb); 4488 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4489 } 4490 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4491 SCTP_SOCKET_UNLOCK(so, 1); 4492 return (0); 4493 } 4494 #endif 4495 sctp_sorwakeup(inp, inp->sctp_socket); 4496 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4497 SCTP_SOCKET_UNLOCK(so, 1); 4498 #endif 4499 } 4500 } 4501 return (0); 4502 } 4503 4504 4505 4506 /*************HOLD THIS COMMENT FOR PATCH FILE OF 4507 *************ALTERNATE ROUTING CODE 4508 */ 4509 4510 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF 4511 *************ALTERNATE ROUTING CODE 4512 */ 4513 4514 struct mbuf * 4515 sctp_generate_invmanparam(int err) 4516 { 4517 /* Return a MBUF with a invalid mandatory parameter */ 4518 struct mbuf *m; 4519 4520 m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_DONTWAIT, 1, MT_DATA); 4521 if (m) { 4522 struct sctp_paramhdr *ph; 4523 4524 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr); 4525 ph = mtod(m, struct sctp_paramhdr *); 4526 ph->param_length = htons(sizeof(struct sctp_paramhdr)); 4527 ph->param_type = htons(err); 4528 } 4529 return (m); 4530 } 4531 4532 #ifdef SCTP_MBCNT_LOGGING 4533 void 4534 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc, 4535 struct sctp_tmit_chunk *tp1, int chk_cnt) 4536 { 4537 if (tp1->data == NULL) { 4538 return; 4539 } 4540 asoc->chunks_on_out_queue -= chk_cnt; 4541 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) { 4542 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE, 4543 asoc->total_output_queue_size, 4544 tp1->book_size, 4545 0, 4546 tp1->mbcnt); 4547 } 4548 if (asoc->total_output_queue_size >= tp1->book_size) { 4549 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size); 4550 } else { 4551 asoc->total_output_queue_size = 0; 4552 } 4553 4554 if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) || 4555 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) { 4556 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) { 4557 stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size; 4558 } else { 4559 stcb->sctp_socket->so_snd.sb_cc = 0; 4560 4561 } 4562 } 4563 } 4564 4565 #endif 4566 4567 int 4568 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1, 4569 int reason, int so_locked 4570 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 4571 SCTP_UNUSED 4572 #endif 4573 ) 4574 { 4575 struct sctp_stream_out *strq; 4576 struct sctp_tmit_chunk *chk = NULL, *tp2; 4577 struct sctp_stream_queue_pending *sp; 4578 uint16_t stream = 0, seq = 0; 4579 uint8_t foundeom = 0; 4580 int ret_sz = 0; 4581 int notdone; 4582 int do_wakeup_routine = 0; 4583 4584 stream = tp1->rec.data.stream_number; 4585 seq = tp1->rec.data.stream_seq; 4586 do { 4587 ret_sz += tp1->book_size; 4588 if (tp1->data != NULL) { 4589 if (tp1->sent < SCTP_DATAGRAM_RESEND) { 4590 sctp_flight_size_decrease(tp1); 4591 sctp_total_flight_decrease(stcb, tp1); 4592 } 4593 sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1); 4594 stcb->asoc.peers_rwnd += tp1->send_size; 4595 stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh); 4596 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1, so_locked); 4597 if (tp1->data) { 4598 sctp_m_freem(tp1->data); 4599 tp1->data = NULL; 4600 } 4601 do_wakeup_routine = 1; 4602 if (PR_SCTP_BUF_ENABLED(tp1->flags)) { 4603 stcb->asoc.sent_queue_cnt_removeable--; 4604 } 4605 } 4606 tp1->sent = SCTP_FORWARD_TSN_SKIP; 4607 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) == 4608 SCTP_DATA_NOT_FRAG) { 4609 /* not frag'ed we ae done */ 4610 notdone = 0; 4611 foundeom = 1; 4612 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 4613 /* end of frag, we are done */ 4614 notdone = 0; 4615 foundeom = 1; 4616 } else { 4617 /* 4618 * Its a begin or middle piece, we must mark all of 4619 * it 4620 */ 4621 notdone = 1; 4622 tp1 = TAILQ_NEXT(tp1, sctp_next); 4623 } 4624 } while (tp1 && notdone); 4625 if (foundeom == 0) { 4626 /* 4627 * The multi-part message was scattered across the send and 4628 * sent queue. 4629 */ 4630 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) { 4631 if ((tp1->rec.data.stream_number != stream) || 4632 (tp1->rec.data.stream_seq != seq)) { 4633 break; 4634 } 4635 /* 4636 * save to chk in case we have some on stream out 4637 * queue. If so and we have an un-transmitted one we 4638 * don't have to fudge the TSN. 4639 */ 4640 chk = tp1; 4641 ret_sz += tp1->book_size; 4642 sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1); 4643 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1, so_locked); 4644 if (tp1->data) { 4645 sctp_m_freem(tp1->data); 4646 tp1->data = NULL; 4647 } 4648 /* No flight involved here book the size to 0 */ 4649 tp1->book_size = 0; 4650 if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 4651 foundeom = 1; 4652 } 4653 do_wakeup_routine = 1; 4654 tp1->sent = SCTP_FORWARD_TSN_SKIP; 4655 TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next); 4656 /* 4657 * on to the sent queue so we can wait for it to be 4658 * passed by. 4659 */ 4660 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1, 4661 sctp_next); 4662 stcb->asoc.send_queue_cnt--; 4663 stcb->asoc.sent_queue_cnt++; 4664 } 4665 } 4666 if (foundeom == 0) { 4667 /* 4668 * Still no eom found. That means there is stuff left on the 4669 * stream out queue.. yuck. 4670 */ 4671 strq = &stcb->asoc.strmout[stream]; 4672 SCTP_TCB_SEND_LOCK(stcb); 4673 TAILQ_FOREACH(sp, &strq->outqueue, next) { 4674 /* FIXME: Shouldn't this be a serial number check? */ 4675 if (sp->strseq > seq) { 4676 break; 4677 } 4678 /* Check if its our SEQ */ 4679 if (sp->strseq == seq) { 4680 sp->discard_rest = 1; 4681 /* 4682 * We may need to put a chunk on the queue 4683 * that holds the TSN that would have been 4684 * sent with the LAST bit. 4685 */ 4686 if (chk == NULL) { 4687 /* Yep, we have to */ 4688 sctp_alloc_a_chunk(stcb, chk); 4689 if (chk == NULL) { 4690 /* 4691 * we are hosed. All we can 4692 * do is nothing.. which 4693 * will cause an abort if 4694 * the peer is paying 4695 * attention. 4696 */ 4697 goto oh_well; 4698 } 4699 memset(chk, 0, sizeof(*chk)); 4700 chk->rec.data.rcv_flags = SCTP_DATA_LAST_FRAG; 4701 chk->sent = SCTP_FORWARD_TSN_SKIP; 4702 chk->asoc = &stcb->asoc; 4703 chk->rec.data.stream_seq = sp->strseq; 4704 chk->rec.data.stream_number = sp->stream; 4705 chk->rec.data.payloadtype = sp->ppid; 4706 chk->rec.data.context = sp->context; 4707 chk->flags = sp->act_flags; 4708 if (sp->net) 4709 chk->whoTo = sp->net; 4710 else 4711 chk->whoTo = stcb->asoc.primary_destination; 4712 atomic_add_int(&chk->whoTo->ref_count, 1); 4713 chk->rec.data.TSN_seq = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1); 4714 stcb->asoc.pr_sctp_cnt++; 4715 chk->pr_sctp_on = 1; 4716 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next); 4717 stcb->asoc.sent_queue_cnt++; 4718 stcb->asoc.pr_sctp_cnt++; 4719 } else { 4720 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG; 4721 } 4722 oh_well: 4723 if (sp->data) { 4724 /* 4725 * Pull any data to free up the SB 4726 * and allow sender to "add more" 4727 * whilc we will throw away :-) 4728 */ 4729 sctp_free_spbufspace(stcb, &stcb->asoc, 4730 sp); 4731 ret_sz += sp->length; 4732 do_wakeup_routine = 1; 4733 sp->some_taken = 1; 4734 sctp_m_freem(sp->data); 4735 sp->length = 0; 4736 sp->data = NULL; 4737 sp->tail_mbuf = NULL; 4738 } 4739 break; 4740 } 4741 } /* End tailq_foreach */ 4742 SCTP_TCB_SEND_UNLOCK(stcb); 4743 } 4744 if (do_wakeup_routine) { 4745 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4746 struct socket *so; 4747 4748 so = SCTP_INP_SO(stcb->sctp_ep); 4749 if (!so_locked) { 4750 atomic_add_int(&stcb->asoc.refcnt, 1); 4751 SCTP_TCB_UNLOCK(stcb); 4752 SCTP_SOCKET_LOCK(so, 1); 4753 SCTP_TCB_LOCK(stcb); 4754 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4755 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 4756 /* assoc was freed while we were unlocked */ 4757 SCTP_SOCKET_UNLOCK(so, 1); 4758 return (ret_sz); 4759 } 4760 } 4761 #endif 4762 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket); 4763 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4764 if (!so_locked) { 4765 SCTP_SOCKET_UNLOCK(so, 1); 4766 } 4767 #endif 4768 } 4769 return (ret_sz); 4770 } 4771 4772 /* 4773 * checks to see if the given address, sa, is one that is currently known by 4774 * the kernel note: can't distinguish the same address on multiple interfaces 4775 * and doesn't handle multiple addresses with different zone/scope id's note: 4776 * ifa_ifwithaddr() compares the entire sockaddr struct 4777 */ 4778 struct sctp_ifa * 4779 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr, 4780 int holds_lock) 4781 { 4782 struct sctp_laddr *laddr; 4783 4784 if (holds_lock == 0) { 4785 SCTP_INP_RLOCK(inp); 4786 } 4787 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 4788 if (laddr->ifa == NULL) 4789 continue; 4790 if (addr->sa_family != laddr->ifa->address.sa.sa_family) 4791 continue; 4792 #ifdef INET 4793 if (addr->sa_family == AF_INET) { 4794 if (((struct sockaddr_in *)addr)->sin_addr.s_addr == 4795 laddr->ifa->address.sin.sin_addr.s_addr) { 4796 /* found him. */ 4797 if (holds_lock == 0) { 4798 SCTP_INP_RUNLOCK(inp); 4799 } 4800 return (laddr->ifa); 4801 break; 4802 } 4803 } 4804 #endif 4805 #ifdef INET6 4806 if (addr->sa_family == AF_INET6) { 4807 if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr, 4808 &laddr->ifa->address.sin6)) { 4809 /* found him. */ 4810 if (holds_lock == 0) { 4811 SCTP_INP_RUNLOCK(inp); 4812 } 4813 return (laddr->ifa); 4814 break; 4815 } 4816 } 4817 #endif 4818 } 4819 if (holds_lock == 0) { 4820 SCTP_INP_RUNLOCK(inp); 4821 } 4822 return (NULL); 4823 } 4824 4825 uint32_t 4826 sctp_get_ifa_hash_val(struct sockaddr *addr) 4827 { 4828 switch (addr->sa_family) { 4829 #ifdef INET 4830 case AF_INET: 4831 { 4832 struct sockaddr_in *sin; 4833 4834 sin = (struct sockaddr_in *)addr; 4835 return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16)); 4836 } 4837 #endif 4838 #ifdef INET6 4839 case INET6: 4840 { 4841 struct sockaddr_in6 *sin6; 4842 uint32_t hash_of_addr; 4843 4844 sin6 = (struct sockaddr_in6 *)addr; 4845 hash_of_addr = (sin6->sin6_addr.s6_addr32[0] + 4846 sin6->sin6_addr.s6_addr32[1] + 4847 sin6->sin6_addr.s6_addr32[2] + 4848 sin6->sin6_addr.s6_addr32[3]); 4849 hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16)); 4850 return (hash_of_addr); 4851 } 4852 #endif 4853 default: 4854 break; 4855 } 4856 return (0); 4857 } 4858 4859 struct sctp_ifa * 4860 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock) 4861 { 4862 struct sctp_ifa *sctp_ifap; 4863 struct sctp_vrf *vrf; 4864 struct sctp_ifalist *hash_head; 4865 uint32_t hash_of_addr; 4866 4867 if (holds_lock == 0) 4868 SCTP_IPI_ADDR_RLOCK(); 4869 4870 vrf = sctp_find_vrf(vrf_id); 4871 if (vrf == NULL) { 4872 stage_right: 4873 if (holds_lock == 0) 4874 SCTP_IPI_ADDR_RUNLOCK(); 4875 return (NULL); 4876 } 4877 hash_of_addr = sctp_get_ifa_hash_val(addr); 4878 4879 hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)]; 4880 if (hash_head == NULL) { 4881 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ", 4882 hash_of_addr, (uint32_t) vrf->vrf_addr_hashmark, 4883 (uint32_t) (hash_of_addr & vrf->vrf_addr_hashmark)); 4884 sctp_print_address(addr); 4885 SCTP_PRINTF("No such bucket for address\n"); 4886 if (holds_lock == 0) 4887 SCTP_IPI_ADDR_RUNLOCK(); 4888 4889 return (NULL); 4890 } 4891 LIST_FOREACH(sctp_ifap, hash_head, next_bucket) { 4892 if (sctp_ifap == NULL) { 4893 #ifdef INVARIANTS 4894 panic("Huh LIST_FOREACH corrupt"); 4895 goto stage_right; 4896 #else 4897 SCTP_PRINTF("LIST corrupt of sctp_ifap's?\n"); 4898 goto stage_right; 4899 #endif 4900 } 4901 if (addr->sa_family != sctp_ifap->address.sa.sa_family) 4902 continue; 4903 #ifdef INET 4904 if (addr->sa_family == AF_INET) { 4905 if (((struct sockaddr_in *)addr)->sin_addr.s_addr == 4906 sctp_ifap->address.sin.sin_addr.s_addr) { 4907 /* found him. */ 4908 if (holds_lock == 0) 4909 SCTP_IPI_ADDR_RUNLOCK(); 4910 return (sctp_ifap); 4911 break; 4912 } 4913 } 4914 #endif 4915 #ifdef INET6 4916 if (addr->sa_family == AF_INET6) { 4917 if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr, 4918 &sctp_ifap->address.sin6)) { 4919 /* found him. */ 4920 if (holds_lock == 0) 4921 SCTP_IPI_ADDR_RUNLOCK(); 4922 return (sctp_ifap); 4923 break; 4924 } 4925 } 4926 #endif 4927 } 4928 if (holds_lock == 0) 4929 SCTP_IPI_ADDR_RUNLOCK(); 4930 return (NULL); 4931 } 4932 4933 static void 4934 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t * freed_so_far, int hold_rlock, 4935 uint32_t rwnd_req) 4936 { 4937 /* User pulled some data, do we need a rwnd update? */ 4938 int r_unlocked = 0; 4939 uint32_t dif, rwnd; 4940 struct socket *so = NULL; 4941 4942 if (stcb == NULL) 4943 return; 4944 4945 atomic_add_int(&stcb->asoc.refcnt, 1); 4946 4947 if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED | 4948 SCTP_STATE_SHUTDOWN_RECEIVED | 4949 SCTP_STATE_SHUTDOWN_ACK_SENT)) { 4950 /* Pre-check If we are freeing no update */ 4951 goto no_lock; 4952 } 4953 SCTP_INP_INCR_REF(stcb->sctp_ep); 4954 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 4955 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4956 goto out; 4957 } 4958 so = stcb->sctp_socket; 4959 if (so == NULL) { 4960 goto out; 4961 } 4962 atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far); 4963 /* Have you have freed enough to look */ 4964 *freed_so_far = 0; 4965 /* Yep, its worth a look and the lock overhead */ 4966 4967 /* Figure out what the rwnd would be */ 4968 rwnd = sctp_calc_rwnd(stcb, &stcb->asoc); 4969 if (rwnd >= stcb->asoc.my_last_reported_rwnd) { 4970 dif = rwnd - stcb->asoc.my_last_reported_rwnd; 4971 } else { 4972 dif = 0; 4973 } 4974 if (dif >= rwnd_req) { 4975 if (hold_rlock) { 4976 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 4977 r_unlocked = 1; 4978 } 4979 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 4980 /* 4981 * One last check before we allow the guy possibly 4982 * to get in. There is a race, where the guy has not 4983 * reached the gate. In that case 4984 */ 4985 goto out; 4986 } 4987 SCTP_TCB_LOCK(stcb); 4988 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 4989 /* No reports here */ 4990 SCTP_TCB_UNLOCK(stcb); 4991 goto out; 4992 } 4993 SCTP_STAT_INCR(sctps_wu_sacks_sent); 4994 sctp_send_sack(stcb, SCTP_SO_LOCKED); 4995 4996 sctp_chunk_output(stcb->sctp_ep, stcb, 4997 SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED); 4998 /* make sure no timer is running */ 4999 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_6); 5000 SCTP_TCB_UNLOCK(stcb); 5001 } else { 5002 /* Update how much we have pending */ 5003 stcb->freed_by_sorcv_sincelast = dif; 5004 } 5005 out: 5006 if (so && r_unlocked && hold_rlock) { 5007 SCTP_INP_READ_LOCK(stcb->sctp_ep); 5008 } 5009 SCTP_INP_DECR_REF(stcb->sctp_ep); 5010 no_lock: 5011 atomic_add_int(&stcb->asoc.refcnt, -1); 5012 return; 5013 } 5014 5015 int 5016 sctp_sorecvmsg(struct socket *so, 5017 struct uio *uio, 5018 struct mbuf **mp, 5019 struct sockaddr *from, 5020 int fromlen, 5021 int *msg_flags, 5022 struct sctp_sndrcvinfo *sinfo, 5023 int filling_sinfo) 5024 { 5025 /* 5026 * MSG flags we will look at MSG_DONTWAIT - non-blocking IO. 5027 * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy 5028 * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ?? 5029 * On the way out we may send out any combination of: 5030 * MSG_NOTIFICATION MSG_EOR 5031 * 5032 */ 5033 struct sctp_inpcb *inp = NULL; 5034 int my_len = 0; 5035 int cp_len = 0, error = 0; 5036 struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL; 5037 struct mbuf *m = NULL; 5038 struct sctp_tcb *stcb = NULL; 5039 int wakeup_read_socket = 0; 5040 int freecnt_applied = 0; 5041 int out_flags = 0, in_flags = 0; 5042 int block_allowed = 1; 5043 uint32_t freed_so_far = 0; 5044 uint32_t copied_so_far = 0; 5045 int in_eeor_mode = 0; 5046 int no_rcv_needed = 0; 5047 uint32_t rwnd_req = 0; 5048 int hold_sblock = 0; 5049 int hold_rlock = 0; 5050 int slen = 0; 5051 uint32_t held_length = 0; 5052 int sockbuf_lock = 0; 5053 5054 if (uio == NULL) { 5055 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 5056 return (EINVAL); 5057 } 5058 if (msg_flags) { 5059 in_flags = *msg_flags; 5060 if (in_flags & MSG_PEEK) 5061 SCTP_STAT_INCR(sctps_read_peeks); 5062 } else { 5063 in_flags = 0; 5064 } 5065 slen = uio->uio_resid; 5066 5067 /* Pull in and set up our int flags */ 5068 if (in_flags & MSG_OOB) { 5069 /* Out of band's NOT supported */ 5070 return (EOPNOTSUPP); 5071 } 5072 if ((in_flags & MSG_PEEK) && (mp != NULL)) { 5073 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 5074 return (EINVAL); 5075 } 5076 if ((in_flags & (MSG_DONTWAIT 5077 | MSG_NBIO 5078 )) || 5079 SCTP_SO_IS_NBIO(so)) { 5080 block_allowed = 0; 5081 } 5082 /* setup the endpoint */ 5083 inp = (struct sctp_inpcb *)so->so_pcb; 5084 if (inp == NULL) { 5085 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT); 5086 return (EFAULT); 5087 } 5088 rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT); 5089 /* Must be at least a MTU's worth */ 5090 if (rwnd_req < SCTP_MIN_RWND) 5091 rwnd_req = SCTP_MIN_RWND; 5092 in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 5093 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) { 5094 sctp_misc_ints(SCTP_SORECV_ENTER, 5095 rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid); 5096 } 5097 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) { 5098 sctp_misc_ints(SCTP_SORECV_ENTERPL, 5099 rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid); 5100 } 5101 error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0)); 5102 sockbuf_lock = 1; 5103 if (error) { 5104 goto release_unlocked; 5105 } 5106 restart: 5107 5108 5109 restart_nosblocks: 5110 if (hold_sblock == 0) { 5111 SOCKBUF_LOCK(&so->so_rcv); 5112 hold_sblock = 1; 5113 } 5114 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 5115 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 5116 goto out; 5117 } 5118 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) { 5119 if (so->so_error) { 5120 error = so->so_error; 5121 if ((in_flags & MSG_PEEK) == 0) 5122 so->so_error = 0; 5123 goto out; 5124 } else { 5125 if (so->so_rcv.sb_cc == 0) { 5126 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN); 5127 /* indicate EOF */ 5128 error = 0; 5129 goto out; 5130 } 5131 } 5132 } 5133 if ((so->so_rcv.sb_cc <= held_length) && block_allowed) { 5134 /* we need to wait for data */ 5135 if ((so->so_rcv.sb_cc == 0) && 5136 ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 5137 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 5138 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) { 5139 /* 5140 * For active open side clear flags for 5141 * re-use passive open is blocked by 5142 * connect. 5143 */ 5144 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) { 5145 /* 5146 * You were aborted, passive side 5147 * always hits here 5148 */ 5149 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET); 5150 error = ECONNRESET; 5151 } 5152 so->so_state &= ~(SS_ISCONNECTING | 5153 SS_ISDISCONNECTING | 5154 SS_ISCONFIRMING | 5155 SS_ISCONNECTED); 5156 if (error == 0) { 5157 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) { 5158 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN); 5159 error = ENOTCONN; 5160 } 5161 } 5162 goto out; 5163 } 5164 } 5165 error = sbwait(&so->so_rcv); 5166 if (error) { 5167 goto out; 5168 } 5169 held_length = 0; 5170 goto restart_nosblocks; 5171 } else if (so->so_rcv.sb_cc == 0) { 5172 if (so->so_error) { 5173 error = so->so_error; 5174 if ((in_flags & MSG_PEEK) == 0) 5175 so->so_error = 0; 5176 } else { 5177 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 5178 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 5179 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) { 5180 /* 5181 * For active open side clear flags 5182 * for re-use passive open is 5183 * blocked by connect. 5184 */ 5185 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) { 5186 /* 5187 * You were aborted, passive 5188 * side always hits here 5189 */ 5190 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET); 5191 error = ECONNRESET; 5192 } 5193 so->so_state &= ~(SS_ISCONNECTING | 5194 SS_ISDISCONNECTING | 5195 SS_ISCONFIRMING | 5196 SS_ISCONNECTED); 5197 if (error == 0) { 5198 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) { 5199 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN); 5200 error = ENOTCONN; 5201 } 5202 } 5203 goto out; 5204 } 5205 } 5206 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK); 5207 error = EWOULDBLOCK; 5208 } 5209 goto out; 5210 } 5211 if (hold_sblock == 1) { 5212 SOCKBUF_UNLOCK(&so->so_rcv); 5213 hold_sblock = 0; 5214 } 5215 /* we possibly have data we can read */ 5216 /* sa_ignore FREED_MEMORY */ 5217 control = TAILQ_FIRST(&inp->read_queue); 5218 if (control == NULL) { 5219 /* 5220 * This could be happening since the appender did the 5221 * increment but as not yet did the tailq insert onto the 5222 * read_queue 5223 */ 5224 if (hold_rlock == 0) { 5225 SCTP_INP_READ_LOCK(inp); 5226 } 5227 control = TAILQ_FIRST(&inp->read_queue); 5228 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) { 5229 #ifdef INVARIANTS 5230 panic("Huh, its non zero and nothing on control?"); 5231 #endif 5232 so->so_rcv.sb_cc = 0; 5233 } 5234 SCTP_INP_READ_UNLOCK(inp); 5235 hold_rlock = 0; 5236 goto restart; 5237 } 5238 if ((control->length == 0) && 5239 (control->do_not_ref_stcb)) { 5240 /* 5241 * Clean up code for freeing assoc that left behind a 5242 * pdapi.. maybe a peer in EEOR that just closed after 5243 * sending and never indicated a EOR. 5244 */ 5245 if (hold_rlock == 0) { 5246 hold_rlock = 1; 5247 SCTP_INP_READ_LOCK(inp); 5248 } 5249 control->held_length = 0; 5250 if (control->data) { 5251 /* Hmm there is data here .. fix */ 5252 struct mbuf *m_tmp; 5253 int cnt = 0; 5254 5255 m_tmp = control->data; 5256 while (m_tmp) { 5257 cnt += SCTP_BUF_LEN(m_tmp); 5258 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 5259 control->tail_mbuf = m_tmp; 5260 control->end_added = 1; 5261 } 5262 m_tmp = SCTP_BUF_NEXT(m_tmp); 5263 } 5264 control->length = cnt; 5265 } else { 5266 /* remove it */ 5267 TAILQ_REMOVE(&inp->read_queue, control, next); 5268 /* Add back any hiddend data */ 5269 sctp_free_remote_addr(control->whoFrom); 5270 sctp_free_a_readq(stcb, control); 5271 } 5272 if (hold_rlock) { 5273 hold_rlock = 0; 5274 SCTP_INP_READ_UNLOCK(inp); 5275 } 5276 goto restart; 5277 } 5278 if ((control->length == 0) && 5279 (control->end_added == 1)) { 5280 /* 5281 * Do we also need to check for (control->pdapi_aborted == 5282 * 1)? 5283 */ 5284 if (hold_rlock == 0) { 5285 hold_rlock = 1; 5286 SCTP_INP_READ_LOCK(inp); 5287 } 5288 TAILQ_REMOVE(&inp->read_queue, control, next); 5289 if (control->data) { 5290 #ifdef INVARIANTS 5291 panic("control->data not null but control->length == 0"); 5292 #else 5293 SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n"); 5294 sctp_m_freem(control->data); 5295 control->data = NULL; 5296 #endif 5297 } 5298 if (control->aux_data) { 5299 sctp_m_free(control->aux_data); 5300 control->aux_data = NULL; 5301 } 5302 sctp_free_remote_addr(control->whoFrom); 5303 sctp_free_a_readq(stcb, control); 5304 if (hold_rlock) { 5305 hold_rlock = 0; 5306 SCTP_INP_READ_UNLOCK(inp); 5307 } 5308 goto restart; 5309 } 5310 if (control->length == 0) { 5311 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) && 5312 (filling_sinfo)) { 5313 /* find a more suitable one then this */ 5314 ctl = TAILQ_NEXT(control, next); 5315 while (ctl) { 5316 if ((ctl->stcb != control->stcb) && (ctl->length) && 5317 (ctl->some_taken || 5318 (ctl->spec_flags & M_NOTIFICATION) || 5319 ((ctl->do_not_ref_stcb == 0) && 5320 (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0))) 5321 ) { 5322 /*- 5323 * If we have a different TCB next, and there is data 5324 * present. If we have already taken some (pdapi), OR we can 5325 * ref the tcb and no delivery as started on this stream, we 5326 * take it. Note we allow a notification on a different 5327 * assoc to be delivered.. 5328 */ 5329 control = ctl; 5330 goto found_one; 5331 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) && 5332 (ctl->length) && 5333 ((ctl->some_taken) || 5334 ((ctl->do_not_ref_stcb == 0) && 5335 ((ctl->spec_flags & M_NOTIFICATION) == 0) && 5336 (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) { 5337 /*- 5338 * If we have the same tcb, and there is data present, and we 5339 * have the strm interleave feature present. Then if we have 5340 * taken some (pdapi) or we can refer to tht tcb AND we have 5341 * not started a delivery for this stream, we can take it. 5342 * Note we do NOT allow a notificaiton on the same assoc to 5343 * be delivered. 5344 */ 5345 control = ctl; 5346 goto found_one; 5347 } 5348 ctl = TAILQ_NEXT(ctl, next); 5349 } 5350 } 5351 /* 5352 * if we reach here, not suitable replacement is available 5353 * <or> fragment interleave is NOT on. So stuff the sb_cc 5354 * into the our held count, and its time to sleep again. 5355 */ 5356 held_length = so->so_rcv.sb_cc; 5357 control->held_length = so->so_rcv.sb_cc; 5358 goto restart; 5359 } 5360 /* Clear the held length since there is something to read */ 5361 control->held_length = 0; 5362 if (hold_rlock) { 5363 SCTP_INP_READ_UNLOCK(inp); 5364 hold_rlock = 0; 5365 } 5366 found_one: 5367 /* 5368 * If we reach here, control has a some data for us to read off. 5369 * Note that stcb COULD be NULL. 5370 */ 5371 control->some_taken++; 5372 if (hold_sblock) { 5373 SOCKBUF_UNLOCK(&so->so_rcv); 5374 hold_sblock = 0; 5375 } 5376 stcb = control->stcb; 5377 if (stcb) { 5378 if ((control->do_not_ref_stcb == 0) && 5379 (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) { 5380 if (freecnt_applied == 0) 5381 stcb = NULL; 5382 } else if (control->do_not_ref_stcb == 0) { 5383 /* you can't free it on me please */ 5384 /* 5385 * The lock on the socket buffer protects us so the 5386 * free code will stop. But since we used the 5387 * socketbuf lock and the sender uses the tcb_lock 5388 * to increment, we need to use the atomic add to 5389 * the refcnt 5390 */ 5391 if (freecnt_applied) { 5392 #ifdef INVARIANTS 5393 panic("refcnt already incremented"); 5394 #else 5395 printf("refcnt already incremented?\n"); 5396 #endif 5397 } else { 5398 atomic_add_int(&stcb->asoc.refcnt, 1); 5399 freecnt_applied = 1; 5400 } 5401 /* 5402 * Setup to remember how much we have not yet told 5403 * the peer our rwnd has opened up. Note we grab the 5404 * value from the tcb from last time. Note too that 5405 * sack sending clears this when a sack is sent, 5406 * which is fine. Once we hit the rwnd_req, we then 5407 * will go to the sctp_user_rcvd() that will not 5408 * lock until it KNOWs it MUST send a WUP-SACK. 5409 */ 5410 freed_so_far = stcb->freed_by_sorcv_sincelast; 5411 stcb->freed_by_sorcv_sincelast = 0; 5412 } 5413 } 5414 if (stcb && 5415 ((control->spec_flags & M_NOTIFICATION) == 0) && 5416 control->do_not_ref_stcb == 0) { 5417 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1; 5418 } 5419 /* First lets get off the sinfo and sockaddr info */ 5420 if ((sinfo) && filling_sinfo) { 5421 memcpy(sinfo, control, sizeof(struct sctp_nonpad_sndrcvinfo)); 5422 nxt = TAILQ_NEXT(control, next); 5423 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) || 5424 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) { 5425 struct sctp_extrcvinfo *s_extra; 5426 5427 s_extra = (struct sctp_extrcvinfo *)sinfo; 5428 if ((nxt) && 5429 (nxt->length)) { 5430 s_extra->sreinfo_next_flags = SCTP_NEXT_MSG_AVAIL; 5431 if (nxt->sinfo_flags & SCTP_UNORDERED) { 5432 s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED; 5433 } 5434 if (nxt->spec_flags & M_NOTIFICATION) { 5435 s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION; 5436 } 5437 s_extra->sreinfo_next_aid = nxt->sinfo_assoc_id; 5438 s_extra->sreinfo_next_length = nxt->length; 5439 s_extra->sreinfo_next_ppid = nxt->sinfo_ppid; 5440 s_extra->sreinfo_next_stream = nxt->sinfo_stream; 5441 if (nxt->tail_mbuf != NULL) { 5442 if (nxt->end_added) { 5443 s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE; 5444 } 5445 } 5446 } else { 5447 /* 5448 * we explicitly 0 this, since the memcpy 5449 * got some other things beyond the older 5450 * sinfo_ that is on the control's structure 5451 * :-D 5452 */ 5453 nxt = NULL; 5454 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG; 5455 s_extra->sreinfo_next_aid = 0; 5456 s_extra->sreinfo_next_length = 0; 5457 s_extra->sreinfo_next_ppid = 0; 5458 s_extra->sreinfo_next_stream = 0; 5459 } 5460 } 5461 /* 5462 * update off the real current cum-ack, if we have an stcb. 5463 */ 5464 if ((control->do_not_ref_stcb == 0) && stcb) 5465 sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn; 5466 /* 5467 * mask off the high bits, we keep the actual chunk bits in 5468 * there. 5469 */ 5470 sinfo->sinfo_flags &= 0x00ff; 5471 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) { 5472 sinfo->sinfo_flags |= SCTP_UNORDERED; 5473 } 5474 } 5475 #ifdef SCTP_ASOCLOG_OF_TSNS 5476 { 5477 int index, newindex; 5478 struct sctp_pcbtsn_rlog *entry; 5479 5480 do { 5481 index = inp->readlog_index; 5482 newindex = index + 1; 5483 if (newindex >= SCTP_READ_LOG_SIZE) { 5484 newindex = 0; 5485 } 5486 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0); 5487 entry = &inp->readlog[index]; 5488 entry->vtag = control->sinfo_assoc_id; 5489 entry->strm = control->sinfo_stream; 5490 entry->seq = control->sinfo_ssn; 5491 entry->sz = control->length; 5492 entry->flgs = control->sinfo_flags; 5493 } 5494 #endif 5495 if (fromlen && from) { 5496 cp_len = min((size_t)fromlen, (size_t)control->whoFrom->ro._l_addr.sa.sa_len); 5497 switch (control->whoFrom->ro._l_addr.sa.sa_family) { 5498 #ifdef INET6 5499 case AF_INET6: 5500 ((struct sockaddr_in6 *)from)->sin6_port = control->port_from; 5501 break; 5502 #endif 5503 #ifdef INET 5504 case AF_INET: 5505 ((struct sockaddr_in *)from)->sin_port = control->port_from; 5506 break; 5507 #endif 5508 default: 5509 break; 5510 } 5511 memcpy(from, &control->whoFrom->ro._l_addr, cp_len); 5512 5513 #if defined(INET) && defined(INET6) 5514 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) && 5515 (from->sa_family == AF_INET) && 5516 ((size_t)fromlen >= sizeof(struct sockaddr_in6))) { 5517 struct sockaddr_in *sin; 5518 struct sockaddr_in6 sin6; 5519 5520 sin = (struct sockaddr_in *)from; 5521 bzero(&sin6, sizeof(sin6)); 5522 sin6.sin6_family = AF_INET6; 5523 sin6.sin6_len = sizeof(struct sockaddr_in6); 5524 sin6.sin6_addr.s6_addr32[2] = htonl(0xffff); 5525 bcopy(&sin->sin_addr, 5526 &sin6.sin6_addr.s6_addr32[3], 5527 sizeof(sin6.sin6_addr.s6_addr32[3])); 5528 sin6.sin6_port = sin->sin_port; 5529 memcpy(from, &sin6, sizeof(struct sockaddr_in6)); 5530 } 5531 #endif 5532 #if defined(INET6) 5533 { 5534 struct sockaddr_in6 lsa6, *from6; 5535 5536 from6 = (struct sockaddr_in6 *)from; 5537 sctp_recover_scope_mac(from6, (&lsa6)); 5538 } 5539 #endif 5540 } 5541 /* now copy out what data we can */ 5542 if (mp == NULL) { 5543 /* copy out each mbuf in the chain up to length */ 5544 get_more_data: 5545 m = control->data; 5546 while (m) { 5547 /* Move out all we can */ 5548 cp_len = (int)uio->uio_resid; 5549 my_len = (int)SCTP_BUF_LEN(m); 5550 if (cp_len > my_len) { 5551 /* not enough in this buf */ 5552 cp_len = my_len; 5553 } 5554 if (hold_rlock) { 5555 SCTP_INP_READ_UNLOCK(inp); 5556 hold_rlock = 0; 5557 } 5558 if (cp_len > 0) 5559 error = uiomove(mtod(m, char *), cp_len, uio); 5560 /* re-read */ 5561 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 5562 goto release; 5563 } 5564 if ((control->do_not_ref_stcb == 0) && stcb && 5565 stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 5566 no_rcv_needed = 1; 5567 } 5568 if (error) { 5569 /* error we are out of here */ 5570 goto release; 5571 } 5572 if ((SCTP_BUF_NEXT(m) == NULL) && 5573 (cp_len >= SCTP_BUF_LEN(m)) && 5574 ((control->end_added == 0) || 5575 (control->end_added && 5576 (TAILQ_NEXT(control, next) == NULL))) 5577 ) { 5578 SCTP_INP_READ_LOCK(inp); 5579 hold_rlock = 1; 5580 } 5581 if (cp_len == SCTP_BUF_LEN(m)) { 5582 if ((SCTP_BUF_NEXT(m) == NULL) && 5583 (control->end_added)) { 5584 out_flags |= MSG_EOR; 5585 if ((control->do_not_ref_stcb == 0) && 5586 (control->stcb != NULL) && 5587 ((control->spec_flags & M_NOTIFICATION) == 0)) 5588 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 5589 } 5590 if (control->spec_flags & M_NOTIFICATION) { 5591 out_flags |= MSG_NOTIFICATION; 5592 } 5593 /* we ate up the mbuf */ 5594 if (in_flags & MSG_PEEK) { 5595 /* just looking */ 5596 m = SCTP_BUF_NEXT(m); 5597 copied_so_far += cp_len; 5598 } else { 5599 /* dispose of the mbuf */ 5600 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 5601 sctp_sblog(&so->so_rcv, 5602 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m)); 5603 } 5604 sctp_sbfree(control, stcb, &so->so_rcv, m); 5605 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 5606 sctp_sblog(&so->so_rcv, 5607 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 5608 } 5609 copied_so_far += cp_len; 5610 freed_so_far += cp_len; 5611 freed_so_far += MSIZE; 5612 atomic_subtract_int(&control->length, cp_len); 5613 control->data = sctp_m_free(m); 5614 m = control->data; 5615 /* 5616 * been through it all, must hold sb 5617 * lock ok to null tail 5618 */ 5619 if (control->data == NULL) { 5620 #ifdef INVARIANTS 5621 if ((control->end_added == 0) || 5622 (TAILQ_NEXT(control, next) == NULL)) { 5623 /* 5624 * If the end is not 5625 * added, OR the 5626 * next is NOT null 5627 * we MUST have the 5628 * lock. 5629 */ 5630 if (mtx_owned(&inp->inp_rdata_mtx) == 0) { 5631 panic("Hmm we don't own the lock?"); 5632 } 5633 } 5634 #endif 5635 control->tail_mbuf = NULL; 5636 #ifdef INVARIANTS 5637 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) { 5638 panic("end_added, nothing left and no MSG_EOR"); 5639 } 5640 #endif 5641 } 5642 } 5643 } else { 5644 /* Do we need to trim the mbuf? */ 5645 if (control->spec_flags & M_NOTIFICATION) { 5646 out_flags |= MSG_NOTIFICATION; 5647 } 5648 if ((in_flags & MSG_PEEK) == 0) { 5649 SCTP_BUF_RESV_UF(m, cp_len); 5650 SCTP_BUF_LEN(m) -= cp_len; 5651 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 5652 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len); 5653 } 5654 atomic_subtract_int(&so->so_rcv.sb_cc, cp_len); 5655 if ((control->do_not_ref_stcb == 0) && 5656 stcb) { 5657 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len); 5658 } 5659 copied_so_far += cp_len; 5660 freed_so_far += cp_len; 5661 freed_so_far += MSIZE; 5662 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 5663 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, 5664 SCTP_LOG_SBRESULT, 0); 5665 } 5666 atomic_subtract_int(&control->length, cp_len); 5667 } else { 5668 copied_so_far += cp_len; 5669 } 5670 } 5671 if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) { 5672 break; 5673 } 5674 if (((stcb) && (in_flags & MSG_PEEK) == 0) && 5675 (control->do_not_ref_stcb == 0) && 5676 (freed_so_far >= rwnd_req)) { 5677 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 5678 } 5679 } /* end while(m) */ 5680 /* 5681 * At this point we have looked at it all and we either have 5682 * a MSG_EOR/or read all the user wants... <OR> 5683 * control->length == 0. 5684 */ 5685 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) { 5686 /* we are done with this control */ 5687 if (control->length == 0) { 5688 if (control->data) { 5689 #ifdef INVARIANTS 5690 panic("control->data not null at read eor?"); 5691 #else 5692 SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n"); 5693 sctp_m_freem(control->data); 5694 control->data = NULL; 5695 #endif 5696 } 5697 done_with_control: 5698 if (TAILQ_NEXT(control, next) == NULL) { 5699 /* 5700 * If we don't have a next we need a 5701 * lock, if there is a next 5702 * interrupt is filling ahead of us 5703 * and we don't need a lock to 5704 * remove this guy (which is the 5705 * head of the queue). 5706 */ 5707 if (hold_rlock == 0) { 5708 SCTP_INP_READ_LOCK(inp); 5709 hold_rlock = 1; 5710 } 5711 } 5712 TAILQ_REMOVE(&inp->read_queue, control, next); 5713 /* Add back any hiddend data */ 5714 if (control->held_length) { 5715 held_length = 0; 5716 control->held_length = 0; 5717 wakeup_read_socket = 1; 5718 } 5719 if (control->aux_data) { 5720 sctp_m_free(control->aux_data); 5721 control->aux_data = NULL; 5722 } 5723 no_rcv_needed = control->do_not_ref_stcb; 5724 sctp_free_remote_addr(control->whoFrom); 5725 control->data = NULL; 5726 sctp_free_a_readq(stcb, control); 5727 control = NULL; 5728 if ((freed_so_far >= rwnd_req) && 5729 (no_rcv_needed == 0)) 5730 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 5731 5732 } else { 5733 /* 5734 * The user did not read all of this 5735 * message, turn off the returned MSG_EOR 5736 * since we are leaving more behind on the 5737 * control to read. 5738 */ 5739 #ifdef INVARIANTS 5740 if (control->end_added && 5741 (control->data == NULL) && 5742 (control->tail_mbuf == NULL)) { 5743 panic("Gak, control->length is corrupt?"); 5744 } 5745 #endif 5746 no_rcv_needed = control->do_not_ref_stcb; 5747 out_flags &= ~MSG_EOR; 5748 } 5749 } 5750 if (out_flags & MSG_EOR) { 5751 goto release; 5752 } 5753 if ((uio->uio_resid == 0) || 5754 ((in_eeor_mode) && (copied_so_far >= max(so->so_rcv.sb_lowat, 1))) 5755 ) { 5756 goto release; 5757 } 5758 /* 5759 * If I hit here the receiver wants more and this message is 5760 * NOT done (pd-api). So two questions. Can we block? if not 5761 * we are done. Did the user NOT set MSG_WAITALL? 5762 */ 5763 if (block_allowed == 0) { 5764 goto release; 5765 } 5766 /* 5767 * We need to wait for more data a few things: - We don't 5768 * sbunlock() so we don't get someone else reading. - We 5769 * must be sure to account for the case where what is added 5770 * is NOT to our control when we wakeup. 5771 */ 5772 5773 /* 5774 * Do we need to tell the transport a rwnd update might be 5775 * needed before we go to sleep? 5776 */ 5777 if (((stcb) && (in_flags & MSG_PEEK) == 0) && 5778 ((freed_so_far >= rwnd_req) && 5779 (control->do_not_ref_stcb == 0) && 5780 (no_rcv_needed == 0))) { 5781 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 5782 } 5783 wait_some_more: 5784 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) { 5785 goto release; 5786 } 5787 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) 5788 goto release; 5789 5790 if (hold_rlock == 1) { 5791 SCTP_INP_READ_UNLOCK(inp); 5792 hold_rlock = 0; 5793 } 5794 if (hold_sblock == 0) { 5795 SOCKBUF_LOCK(&so->so_rcv); 5796 hold_sblock = 1; 5797 } 5798 if ((copied_so_far) && (control->length == 0) && 5799 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) { 5800 goto release; 5801 } 5802 if (so->so_rcv.sb_cc <= control->held_length) { 5803 error = sbwait(&so->so_rcv); 5804 if (error) { 5805 goto release; 5806 } 5807 control->held_length = 0; 5808 } 5809 if (hold_sblock) { 5810 SOCKBUF_UNLOCK(&so->so_rcv); 5811 hold_sblock = 0; 5812 } 5813 if (control->length == 0) { 5814 /* still nothing here */ 5815 if (control->end_added == 1) { 5816 /* he aborted, or is done i.e.did a shutdown */ 5817 out_flags |= MSG_EOR; 5818 if (control->pdapi_aborted) { 5819 if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0)) 5820 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 5821 5822 out_flags |= MSG_TRUNC; 5823 } else { 5824 if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0)) 5825 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 5826 } 5827 goto done_with_control; 5828 } 5829 if (so->so_rcv.sb_cc > held_length) { 5830 control->held_length = so->so_rcv.sb_cc; 5831 held_length = 0; 5832 } 5833 goto wait_some_more; 5834 } else if (control->data == NULL) { 5835 /* 5836 * we must re-sync since data is probably being 5837 * added 5838 */ 5839 SCTP_INP_READ_LOCK(inp); 5840 if ((control->length > 0) && (control->data == NULL)) { 5841 /* 5842 * big trouble.. we have the lock and its 5843 * corrupt? 5844 */ 5845 #ifdef INVARIANTS 5846 panic("Impossible data==NULL length !=0"); 5847 #endif 5848 out_flags |= MSG_EOR; 5849 out_flags |= MSG_TRUNC; 5850 control->length = 0; 5851 SCTP_INP_READ_UNLOCK(inp); 5852 goto done_with_control; 5853 } 5854 SCTP_INP_READ_UNLOCK(inp); 5855 /* We will fall around to get more data */ 5856 } 5857 goto get_more_data; 5858 } else { 5859 /*- 5860 * Give caller back the mbuf chain, 5861 * store in uio_resid the length 5862 */ 5863 wakeup_read_socket = 0; 5864 if ((control->end_added == 0) || 5865 (TAILQ_NEXT(control, next) == NULL)) { 5866 /* Need to get rlock */ 5867 if (hold_rlock == 0) { 5868 SCTP_INP_READ_LOCK(inp); 5869 hold_rlock = 1; 5870 } 5871 } 5872 if (control->end_added) { 5873 out_flags |= MSG_EOR; 5874 if ((control->do_not_ref_stcb == 0) && 5875 (control->stcb != NULL) && 5876 ((control->spec_flags & M_NOTIFICATION) == 0)) 5877 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 5878 } 5879 if (control->spec_flags & M_NOTIFICATION) { 5880 out_flags |= MSG_NOTIFICATION; 5881 } 5882 uio->uio_resid = control->length; 5883 *mp = control->data; 5884 m = control->data; 5885 while (m) { 5886 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 5887 sctp_sblog(&so->so_rcv, 5888 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m)); 5889 } 5890 sctp_sbfree(control, stcb, &so->so_rcv, m); 5891 freed_so_far += SCTP_BUF_LEN(m); 5892 freed_so_far += MSIZE; 5893 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 5894 sctp_sblog(&so->so_rcv, 5895 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 5896 } 5897 m = SCTP_BUF_NEXT(m); 5898 } 5899 control->data = control->tail_mbuf = NULL; 5900 control->length = 0; 5901 if (out_flags & MSG_EOR) { 5902 /* Done with this control */ 5903 goto done_with_control; 5904 } 5905 } 5906 release: 5907 if (hold_rlock == 1) { 5908 SCTP_INP_READ_UNLOCK(inp); 5909 hold_rlock = 0; 5910 } 5911 if (hold_sblock == 1) { 5912 SOCKBUF_UNLOCK(&so->so_rcv); 5913 hold_sblock = 0; 5914 } 5915 sbunlock(&so->so_rcv); 5916 sockbuf_lock = 0; 5917 5918 release_unlocked: 5919 if (hold_sblock) { 5920 SOCKBUF_UNLOCK(&so->so_rcv); 5921 hold_sblock = 0; 5922 } 5923 if ((stcb) && (in_flags & MSG_PEEK) == 0) { 5924 if ((freed_so_far >= rwnd_req) && 5925 (control && (control->do_not_ref_stcb == 0)) && 5926 (no_rcv_needed == 0)) 5927 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 5928 } 5929 out: 5930 if (msg_flags) { 5931 *msg_flags = out_flags; 5932 } 5933 if (((out_flags & MSG_EOR) == 0) && 5934 ((in_flags & MSG_PEEK) == 0) && 5935 (sinfo) && 5936 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) || 5937 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) { 5938 struct sctp_extrcvinfo *s_extra; 5939 5940 s_extra = (struct sctp_extrcvinfo *)sinfo; 5941 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG; 5942 } 5943 if (hold_rlock == 1) { 5944 SCTP_INP_READ_UNLOCK(inp); 5945 } 5946 if (hold_sblock) { 5947 SOCKBUF_UNLOCK(&so->so_rcv); 5948 } 5949 if (sockbuf_lock) { 5950 sbunlock(&so->so_rcv); 5951 } 5952 if (freecnt_applied) { 5953 /* 5954 * The lock on the socket buffer protects us so the free 5955 * code will stop. But since we used the socketbuf lock and 5956 * the sender uses the tcb_lock to increment, we need to use 5957 * the atomic add to the refcnt. 5958 */ 5959 if (stcb == NULL) { 5960 #ifdef INVARIANTS 5961 panic("stcb for refcnt has gone NULL?"); 5962 goto stage_left; 5963 #else 5964 goto stage_left; 5965 #endif 5966 } 5967 atomic_add_int(&stcb->asoc.refcnt, -1); 5968 /* Save the value back for next time */ 5969 stcb->freed_by_sorcv_sincelast = freed_so_far; 5970 } 5971 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) { 5972 if (stcb) { 5973 sctp_misc_ints(SCTP_SORECV_DONE, 5974 freed_so_far, 5975 ((uio) ? (slen - uio->uio_resid) : slen), 5976 stcb->asoc.my_rwnd, 5977 so->so_rcv.sb_cc); 5978 } else { 5979 sctp_misc_ints(SCTP_SORECV_DONE, 5980 freed_so_far, 5981 ((uio) ? (slen - uio->uio_resid) : slen), 5982 0, 5983 so->so_rcv.sb_cc); 5984 } 5985 } 5986 stage_left: 5987 if (wakeup_read_socket) { 5988 sctp_sorwakeup(inp, so); 5989 } 5990 return (error); 5991 } 5992 5993 5994 #ifdef SCTP_MBUF_LOGGING 5995 struct mbuf * 5996 sctp_m_free(struct mbuf *m) 5997 { 5998 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 5999 if (SCTP_BUF_IS_EXTENDED(m)) { 6000 sctp_log_mb(m, SCTP_MBUF_IFREE); 6001 } 6002 } 6003 return (m_free(m)); 6004 } 6005 6006 void 6007 sctp_m_freem(struct mbuf *mb) 6008 { 6009 while (mb != NULL) 6010 mb = sctp_m_free(mb); 6011 } 6012 6013 #endif 6014 6015 int 6016 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id) 6017 { 6018 /* 6019 * Given a local address. For all associations that holds the 6020 * address, request a peer-set-primary. 6021 */ 6022 struct sctp_ifa *ifa; 6023 struct sctp_laddr *wi; 6024 6025 ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0); 6026 if (ifa == NULL) { 6027 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL); 6028 return (EADDRNOTAVAIL); 6029 } 6030 /* 6031 * Now that we have the ifa we must awaken the iterator with this 6032 * message. 6033 */ 6034 wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr); 6035 if (wi == NULL) { 6036 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 6037 return (ENOMEM); 6038 } 6039 /* Now incr the count and int wi structure */ 6040 SCTP_INCR_LADDR_COUNT(); 6041 bzero(wi, sizeof(*wi)); 6042 (void)SCTP_GETTIME_TIMEVAL(&wi->start_time); 6043 wi->ifa = ifa; 6044 wi->action = SCTP_SET_PRIM_ADDR; 6045 atomic_add_int(&ifa->refcount, 1); 6046 6047 /* Now add it to the work queue */ 6048 SCTP_WQ_ADDR_LOCK(); 6049 /* 6050 * Should this really be a tailq? As it is we will process the 6051 * newest first :-0 6052 */ 6053 LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr); 6054 SCTP_WQ_ADDR_UNLOCK(); 6055 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ, 6056 (struct sctp_inpcb *)NULL, 6057 (struct sctp_tcb *)NULL, 6058 (struct sctp_nets *)NULL); 6059 return (0); 6060 } 6061 6062 6063 int 6064 sctp_soreceive(struct socket *so, 6065 struct sockaddr **psa, 6066 struct uio *uio, 6067 struct mbuf **mp0, 6068 struct mbuf **controlp, 6069 int *flagsp) 6070 { 6071 int error, fromlen; 6072 uint8_t sockbuf[256]; 6073 struct sockaddr *from; 6074 struct sctp_extrcvinfo sinfo; 6075 int filling_sinfo = 1; 6076 struct sctp_inpcb *inp; 6077 6078 inp = (struct sctp_inpcb *)so->so_pcb; 6079 /* pickup the assoc we are reading from */ 6080 if (inp == NULL) { 6081 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6082 return (EINVAL); 6083 } 6084 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) && 6085 sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) && 6086 sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) || 6087 (controlp == NULL)) { 6088 /* user does not want the sndrcv ctl */ 6089 filling_sinfo = 0; 6090 } 6091 if (psa) { 6092 from = (struct sockaddr *)sockbuf; 6093 fromlen = sizeof(sockbuf); 6094 from->sa_len = 0; 6095 } else { 6096 from = NULL; 6097 fromlen = 0; 6098 } 6099 6100 error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp, 6101 (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo); 6102 if ((controlp) && (filling_sinfo)) { 6103 /* copy back the sinfo in a CMSG format */ 6104 if (filling_sinfo) 6105 *controlp = sctp_build_ctl_nchunk(inp, 6106 (struct sctp_sndrcvinfo *)&sinfo); 6107 else 6108 *controlp = NULL; 6109 } 6110 if (psa) { 6111 /* copy back the address info */ 6112 if (from && from->sa_len) { 6113 *psa = sodupsockaddr(from, M_NOWAIT); 6114 } else { 6115 *psa = NULL; 6116 } 6117 } 6118 return (error); 6119 } 6120 6121 6122 6123 6124 6125 int 6126 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr, 6127 int totaddr, int *error) 6128 { 6129 int added = 0; 6130 int i; 6131 struct sctp_inpcb *inp; 6132 struct sockaddr *sa; 6133 size_t incr = 0; 6134 6135 #ifdef INET 6136 struct sockaddr_in *sin; 6137 6138 #endif 6139 #ifdef INET6 6140 struct sockaddr_in6 *sin6; 6141 6142 #endif 6143 6144 sa = addr; 6145 inp = stcb->sctp_ep; 6146 *error = 0; 6147 for (i = 0; i < totaddr; i++) { 6148 switch (sa->sa_family) { 6149 #ifdef INET 6150 case AF_INET: 6151 incr = sizeof(struct sockaddr_in); 6152 sin = (struct sockaddr_in *)sa; 6153 if ((sin->sin_addr.s_addr == INADDR_ANY) || 6154 (sin->sin_addr.s_addr == INADDR_BROADCAST) || 6155 IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) { 6156 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6157 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7); 6158 *error = EINVAL; 6159 goto out_now; 6160 } 6161 if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 6162 /* assoc gone no un-lock */ 6163 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS); 6164 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7); 6165 *error = ENOBUFS; 6166 goto out_now; 6167 } 6168 added++; 6169 break; 6170 #endif 6171 #ifdef INET6 6172 case AF_INET6: 6173 incr = sizeof(struct sockaddr_in6); 6174 sin6 = (struct sockaddr_in6 *)sa; 6175 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) || 6176 IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) { 6177 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6178 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8); 6179 *error = EINVAL; 6180 goto out_now; 6181 } 6182 if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 6183 /* assoc gone no un-lock */ 6184 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS); 6185 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8); 6186 *error = ENOBUFS; 6187 goto out_now; 6188 } 6189 added++; 6190 break; 6191 #endif 6192 default: 6193 break; 6194 } 6195 sa = (struct sockaddr *)((caddr_t)sa + incr); 6196 } 6197 out_now: 6198 return (added); 6199 } 6200 6201 struct sctp_tcb * 6202 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr, 6203 int *totaddr, int *num_v4, int *num_v6, int *error, 6204 int limit, int *bad_addr) 6205 { 6206 struct sockaddr *sa; 6207 struct sctp_tcb *stcb = NULL; 6208 size_t incr, at, i; 6209 6210 at = incr = 0; 6211 sa = addr; 6212 6213 *error = *num_v6 = *num_v4 = 0; 6214 /* account and validate addresses */ 6215 for (i = 0; i < (size_t)*totaddr; i++) { 6216 switch (sa->sa_family) { 6217 #ifdef INET 6218 case AF_INET: 6219 (*num_v4) += 1; 6220 incr = sizeof(struct sockaddr_in); 6221 if (sa->sa_len != incr) { 6222 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6223 *error = EINVAL; 6224 *bad_addr = 1; 6225 return (NULL); 6226 } 6227 break; 6228 #endif 6229 #ifdef INET6 6230 case AF_INET6: 6231 { 6232 struct sockaddr_in6 *sin6; 6233 6234 sin6 = (struct sockaddr_in6 *)sa; 6235 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6236 /* Must be non-mapped for connectx */ 6237 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6238 *error = EINVAL; 6239 *bad_addr = 1; 6240 return (NULL); 6241 } 6242 (*num_v6) += 1; 6243 incr = sizeof(struct sockaddr_in6); 6244 if (sa->sa_len != incr) { 6245 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6246 *error = EINVAL; 6247 *bad_addr = 1; 6248 return (NULL); 6249 } 6250 break; 6251 } 6252 #endif 6253 default: 6254 *totaddr = i; 6255 /* we are done */ 6256 break; 6257 } 6258 if (i == (size_t)*totaddr) { 6259 break; 6260 } 6261 SCTP_INP_INCR_REF(inp); 6262 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL); 6263 if (stcb != NULL) { 6264 /* Already have or am bring up an association */ 6265 return (stcb); 6266 } else { 6267 SCTP_INP_DECR_REF(inp); 6268 } 6269 if ((at + incr) > (size_t)limit) { 6270 *totaddr = i; 6271 break; 6272 } 6273 sa = (struct sockaddr *)((caddr_t)sa + incr); 6274 } 6275 return ((struct sctp_tcb *)NULL); 6276 } 6277 6278 /* 6279 * sctp_bindx(ADD) for one address. 6280 * assumes all arguments are valid/checked by caller. 6281 */ 6282 void 6283 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp, 6284 struct sockaddr *sa, sctp_assoc_t assoc_id, 6285 uint32_t vrf_id, int *error, void *p) 6286 { 6287 struct sockaddr *addr_touse; 6288 6289 #ifdef INET6 6290 struct sockaddr_in sin; 6291 6292 #endif 6293 6294 /* see if we're bound all already! */ 6295 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 6296 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6297 *error = EINVAL; 6298 return; 6299 } 6300 addr_touse = sa; 6301 #ifdef INET6 6302 if (sa->sa_family == AF_INET6) { 6303 struct sockaddr_in6 *sin6; 6304 6305 if (sa->sa_len != sizeof(struct sockaddr_in6)) { 6306 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6307 *error = EINVAL; 6308 return; 6309 } 6310 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) { 6311 /* can only bind v6 on PF_INET6 sockets */ 6312 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6313 *error = EINVAL; 6314 return; 6315 } 6316 sin6 = (struct sockaddr_in6 *)addr_touse; 6317 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6318 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6319 SCTP_IPV6_V6ONLY(inp)) { 6320 /* can't bind v4-mapped on PF_INET sockets */ 6321 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6322 *error = EINVAL; 6323 return; 6324 } 6325 in6_sin6_2_sin(&sin, sin6); 6326 addr_touse = (struct sockaddr *)&sin; 6327 } 6328 } 6329 #endif 6330 #ifdef INET 6331 if (sa->sa_family == AF_INET) { 6332 if (sa->sa_len != sizeof(struct sockaddr_in)) { 6333 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6334 *error = EINVAL; 6335 return; 6336 } 6337 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6338 SCTP_IPV6_V6ONLY(inp)) { 6339 /* can't bind v4 on PF_INET sockets */ 6340 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6341 *error = EINVAL; 6342 return; 6343 } 6344 } 6345 #endif 6346 if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) { 6347 if (p == NULL) { 6348 /* Can't get proc for Net/Open BSD */ 6349 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6350 *error = EINVAL; 6351 return; 6352 } 6353 *error = sctp_inpcb_bind(so, addr_touse, NULL, p); 6354 return; 6355 } 6356 /* 6357 * No locks required here since bind and mgmt_ep_sa all do their own 6358 * locking. If we do something for the FIX: below we may need to 6359 * lock in that case. 6360 */ 6361 if (assoc_id == 0) { 6362 /* add the address */ 6363 struct sctp_inpcb *lep; 6364 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse; 6365 6366 /* validate the incoming port */ 6367 if ((lsin->sin_port != 0) && 6368 (lsin->sin_port != inp->sctp_lport)) { 6369 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6370 *error = EINVAL; 6371 return; 6372 } else { 6373 /* user specified 0 port, set it to existing port */ 6374 lsin->sin_port = inp->sctp_lport; 6375 } 6376 6377 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id); 6378 if (lep != NULL) { 6379 /* 6380 * We must decrement the refcount since we have the 6381 * ep already and are binding. No remove going on 6382 * here. 6383 */ 6384 SCTP_INP_DECR_REF(lep); 6385 } 6386 if (lep == inp) { 6387 /* already bound to it.. ok */ 6388 return; 6389 } else if (lep == NULL) { 6390 ((struct sockaddr_in *)addr_touse)->sin_port = 0; 6391 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse, 6392 SCTP_ADD_IP_ADDRESS, 6393 vrf_id, NULL); 6394 } else { 6395 *error = EADDRINUSE; 6396 } 6397 if (*error) 6398 return; 6399 } else { 6400 /* 6401 * FIX: decide whether we allow assoc based bindx 6402 */ 6403 } 6404 } 6405 6406 /* 6407 * sctp_bindx(DELETE) for one address. 6408 * assumes all arguments are valid/checked by caller. 6409 */ 6410 void 6411 sctp_bindx_delete_address(struct sctp_inpcb *inp, 6412 struct sockaddr *sa, sctp_assoc_t assoc_id, 6413 uint32_t vrf_id, int *error) 6414 { 6415 struct sockaddr *addr_touse; 6416 6417 #ifdef INET6 6418 struct sockaddr_in sin; 6419 6420 #endif 6421 6422 /* see if we're bound all already! */ 6423 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 6424 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6425 *error = EINVAL; 6426 return; 6427 } 6428 addr_touse = sa; 6429 #if defined(INET6) 6430 if (sa->sa_family == AF_INET6) { 6431 struct sockaddr_in6 *sin6; 6432 6433 if (sa->sa_len != sizeof(struct sockaddr_in6)) { 6434 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6435 *error = EINVAL; 6436 return; 6437 } 6438 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) { 6439 /* can only bind v6 on PF_INET6 sockets */ 6440 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6441 *error = EINVAL; 6442 return; 6443 } 6444 sin6 = (struct sockaddr_in6 *)addr_touse; 6445 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6446 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6447 SCTP_IPV6_V6ONLY(inp)) { 6448 /* can't bind mapped-v4 on PF_INET sockets */ 6449 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6450 *error = EINVAL; 6451 return; 6452 } 6453 in6_sin6_2_sin(&sin, sin6); 6454 addr_touse = (struct sockaddr *)&sin; 6455 } 6456 } 6457 #endif 6458 #ifdef INET 6459 if (sa->sa_family == AF_INET) { 6460 if (sa->sa_len != sizeof(struct sockaddr_in)) { 6461 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6462 *error = EINVAL; 6463 return; 6464 } 6465 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6466 SCTP_IPV6_V6ONLY(inp)) { 6467 /* can't bind v4 on PF_INET sockets */ 6468 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6469 *error = EINVAL; 6470 return; 6471 } 6472 } 6473 #endif 6474 /* 6475 * No lock required mgmt_ep_sa does its own locking. If the FIX: 6476 * below is ever changed we may need to lock before calling 6477 * association level binding. 6478 */ 6479 if (assoc_id == 0) { 6480 /* delete the address */ 6481 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse, 6482 SCTP_DEL_IP_ADDRESS, 6483 vrf_id, NULL); 6484 } else { 6485 /* 6486 * FIX: decide whether we allow assoc based bindx 6487 */ 6488 } 6489 } 6490 6491 /* 6492 * returns the valid local address count for an assoc, taking into account 6493 * all scoping rules 6494 */ 6495 int 6496 sctp_local_addr_count(struct sctp_tcb *stcb) 6497 { 6498 int loopback_scope, ipv4_local_scope, local_scope, site_scope; 6499 int ipv4_addr_legal, ipv6_addr_legal; 6500 struct sctp_vrf *vrf; 6501 struct sctp_ifn *sctp_ifn; 6502 struct sctp_ifa *sctp_ifa; 6503 int count = 0; 6504 6505 /* Turn on all the appropriate scopes */ 6506 loopback_scope = stcb->asoc.loopback_scope; 6507 ipv4_local_scope = stcb->asoc.ipv4_local_scope; 6508 local_scope = stcb->asoc.local_scope; 6509 site_scope = stcb->asoc.site_scope; 6510 ipv4_addr_legal = ipv6_addr_legal = 0; 6511 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6512 ipv6_addr_legal = 1; 6513 if (SCTP_IPV6_V6ONLY(stcb->sctp_ep) == 0) { 6514 ipv4_addr_legal = 1; 6515 } 6516 } else { 6517 ipv4_addr_legal = 1; 6518 } 6519 6520 SCTP_IPI_ADDR_RLOCK(); 6521 vrf = sctp_find_vrf(stcb->asoc.vrf_id); 6522 if (vrf == NULL) { 6523 /* no vrf, no addresses */ 6524 SCTP_IPI_ADDR_RUNLOCK(); 6525 return (0); 6526 } 6527 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 6528 /* 6529 * bound all case: go through all ifns on the vrf 6530 */ 6531 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 6532 if ((loopback_scope == 0) && 6533 SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 6534 continue; 6535 } 6536 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 6537 if (sctp_is_addr_restricted(stcb, sctp_ifa)) 6538 continue; 6539 switch (sctp_ifa->address.sa.sa_family) { 6540 #ifdef INET 6541 case AF_INET: 6542 if (ipv4_addr_legal) { 6543 struct sockaddr_in *sin; 6544 6545 sin = (struct sockaddr_in *)&sctp_ifa->address.sa; 6546 if (sin->sin_addr.s_addr == 0) { 6547 /* 6548 * skip unspecified 6549 * addrs 6550 */ 6551 continue; 6552 } 6553 if ((ipv4_local_scope == 0) && 6554 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 6555 continue; 6556 } 6557 /* count this one */ 6558 count++; 6559 } else { 6560 continue; 6561 } 6562 break; 6563 #endif 6564 #ifdef INET6 6565 case AF_INET6: 6566 if (ipv6_addr_legal) { 6567 struct sockaddr_in6 *sin6; 6568 6569 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa; 6570 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 6571 continue; 6572 } 6573 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 6574 if (local_scope == 0) 6575 continue; 6576 if (sin6->sin6_scope_id == 0) { 6577 if (sa6_recoverscope(sin6) != 0) 6578 /* 6579 * 6580 * bad 6581 * 6582 * li 6583 * nk 6584 * 6585 * loc 6586 * al 6587 * 6588 * add 6589 * re 6590 * ss 6591 * */ 6592 continue; 6593 } 6594 } 6595 if ((site_scope == 0) && 6596 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 6597 continue; 6598 } 6599 /* count this one */ 6600 count++; 6601 } 6602 break; 6603 #endif 6604 default: 6605 /* TSNH */ 6606 break; 6607 } 6608 } 6609 } 6610 } else { 6611 /* 6612 * subset bound case 6613 */ 6614 struct sctp_laddr *laddr; 6615 6616 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, 6617 sctp_nxt_addr) { 6618 if (sctp_is_addr_restricted(stcb, laddr->ifa)) { 6619 continue; 6620 } 6621 /* count this one */ 6622 count++; 6623 } 6624 } 6625 SCTP_IPI_ADDR_RUNLOCK(); 6626 return (count); 6627 } 6628 6629 #if defined(SCTP_LOCAL_TRACE_BUF) 6630 6631 void 6632 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f) 6633 { 6634 uint32_t saveindex, newindex; 6635 6636 do { 6637 saveindex = SCTP_BASE_SYSCTL(sctp_log).index; 6638 if (saveindex >= SCTP_MAX_LOGGING_SIZE) { 6639 newindex = 1; 6640 } else { 6641 newindex = saveindex + 1; 6642 } 6643 } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0); 6644 if (saveindex >= SCTP_MAX_LOGGING_SIZE) { 6645 saveindex = 0; 6646 } 6647 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT; 6648 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys; 6649 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a; 6650 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b; 6651 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c; 6652 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d; 6653 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e; 6654 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f; 6655 } 6656 6657 #endif 6658 /* XXX: Remove the #ifdef after tunneling over IPv6 works also on FreeBSD. */ 6659 #ifdef INET 6660 /* We will need to add support 6661 * to bind the ports and such here 6662 * so we can do UDP tunneling. In 6663 * the mean-time, we return error 6664 */ 6665 #include <netinet/udp.h> 6666 #include <netinet/udp_var.h> 6667 #include <sys/proc.h> 6668 #ifdef INET6 6669 #include <netinet6/sctp6_var.h> 6670 #endif 6671 6672 static void 6673 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *ignored) 6674 { 6675 struct ip *iph; 6676 struct mbuf *sp, *last; 6677 struct udphdr *uhdr; 6678 uint16_t port = 0; 6679 int header_size = sizeof(struct udphdr) + sizeof(struct sctphdr); 6680 6681 /* 6682 * Split out the mbuf chain. Leave the IP header in m, place the 6683 * rest in the sp. 6684 */ 6685 if ((m->m_flags & M_PKTHDR) == 0) { 6686 /* Can't handle one that is not a pkt hdr */ 6687 goto out; 6688 } 6689 /* pull the src port */ 6690 iph = mtod(m, struct ip *); 6691 uhdr = (struct udphdr *)((caddr_t)iph + off); 6692 6693 port = uhdr->uh_sport; 6694 sp = m_split(m, off, M_DONTWAIT); 6695 if (sp == NULL) { 6696 /* Gak, drop packet, we can't do a split */ 6697 goto out; 6698 } 6699 if (sp->m_pkthdr.len < header_size) { 6700 /* Gak, packet can't have an SCTP header in it - to small */ 6701 m_freem(sp); 6702 goto out; 6703 } 6704 /* ok now pull up the UDP header and SCTP header together */ 6705 sp = m_pullup(sp, header_size); 6706 if (sp == NULL) { 6707 /* Gak pullup failed */ 6708 goto out; 6709 } 6710 /* trim out the UDP header */ 6711 m_adj(sp, sizeof(struct udphdr)); 6712 6713 /* Now reconstruct the mbuf chain */ 6714 /* 1) find last one */ 6715 last = m; 6716 while (last->m_next != NULL) { 6717 last = last->m_next; 6718 } 6719 last->m_next = sp; 6720 m->m_pkthdr.len += sp->m_pkthdr.len; 6721 last = m; 6722 while (last != NULL) { 6723 last = last->m_next; 6724 } 6725 /* Now its ready for sctp_input or sctp6_input */ 6726 iph = mtod(m, struct ip *); 6727 switch (iph->ip_v) { 6728 #ifdef INET 6729 case IPVERSION: 6730 { 6731 uint16_t len; 6732 6733 /* its IPv4 */ 6734 len = SCTP_GET_IPV4_LENGTH(iph); 6735 len -= sizeof(struct udphdr); 6736 SCTP_GET_IPV4_LENGTH(iph) = len; 6737 sctp_input_with_port(m, off, port); 6738 break; 6739 } 6740 #endif 6741 #ifdef INET6 6742 case IPV6_VERSION >> 4: 6743 { 6744 /* its IPv6 - NOT supported */ 6745 goto out; 6746 break; 6747 6748 } 6749 #endif 6750 default: 6751 { 6752 m_freem(m); 6753 break; 6754 } 6755 } 6756 return; 6757 out: 6758 m_freem(m); 6759 } 6760 6761 void 6762 sctp_over_udp_stop(void) 6763 { 6764 struct socket *sop; 6765 6766 /* 6767 * This function assumes sysctl caller holds sctp_sysctl_info_lock() 6768 * for writting! 6769 */ 6770 if (SCTP_BASE_INFO(udp_tun_socket) == NULL) { 6771 /* Nothing to do */ 6772 return; 6773 } 6774 sop = SCTP_BASE_INFO(udp_tun_socket); 6775 soclose(sop); 6776 SCTP_BASE_INFO(udp_tun_socket) = NULL; 6777 } 6778 6779 int 6780 sctp_over_udp_start(void) 6781 { 6782 uint16_t port; 6783 int ret; 6784 struct sockaddr_in sin; 6785 struct socket *sop = NULL; 6786 struct thread *th; 6787 struct ucred *cred; 6788 6789 /* 6790 * This function assumes sysctl caller holds sctp_sysctl_info_lock() 6791 * for writting! 6792 */ 6793 port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port); 6794 if (port == 0) { 6795 /* Must have a port set */ 6796 return (EINVAL); 6797 } 6798 if (SCTP_BASE_INFO(udp_tun_socket) != NULL) { 6799 /* Already running -- must stop first */ 6800 return (EALREADY); 6801 } 6802 th = curthread; 6803 cred = th->td_ucred; 6804 if ((ret = socreate(PF_INET, &sop, 6805 SOCK_DGRAM, IPPROTO_UDP, cred, th))) { 6806 return (ret); 6807 } 6808 SCTP_BASE_INFO(udp_tun_socket) = sop; 6809 /* call the special UDP hook */ 6810 ret = udp_set_kernel_tunneling(sop, sctp_recv_udp_tunneled_packet); 6811 if (ret) { 6812 goto exit_stage_left; 6813 } 6814 /* Ok we have a socket, bind it to the port */ 6815 memset(&sin, 0, sizeof(sin)); 6816 sin.sin_len = sizeof(sin); 6817 sin.sin_family = AF_INET; 6818 sin.sin_port = htons(port); 6819 ret = sobind(sop, (struct sockaddr *)&sin, th); 6820 if (ret) { 6821 /* Close up we cant get the port */ 6822 exit_stage_left: 6823 sctp_over_udp_stop(); 6824 return (ret); 6825 } 6826 /* 6827 * Ok we should now get UDP packets directly to our input routine 6828 * sctp_recv_upd_tunneled_packet(). 6829 */ 6830 return (0); 6831 } 6832 6833 #endif 6834