1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 5 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 6 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions are met: 10 * 11 * a) Redistributions of source code must retain the above copyright notice, 12 * this list of conditions and the following disclaimer. 13 * 14 * b) Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the distribution. 17 * 18 * c) Neither the name of Cisco Systems, Inc. nor the names of its 19 * contributors may be used to endorse or promote products derived 20 * from this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 26 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 32 * THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include <sys/cdefs.h> 36 __FBSDID("$FreeBSD$"); 37 38 #include <netinet/sctp_os.h> 39 #include <netinet/sctp_pcb.h> 40 #include <netinet/sctputil.h> 41 #include <netinet/sctp_var.h> 42 #include <netinet/sctp_sysctl.h> 43 #ifdef INET6 44 #include <netinet6/sctp6_var.h> 45 #endif 46 #include <netinet/sctp_header.h> 47 #include <netinet/sctp_output.h> 48 #include <netinet/sctp_uio.h> 49 #include <netinet/sctp_timer.h> 50 #include <netinet/sctp_indata.h> 51 #include <netinet/sctp_auth.h> 52 #include <netinet/sctp_asconf.h> 53 #include <netinet/sctp_bsd_addr.h> 54 #include <netinet/sctp_kdtrace.h> 55 #if defined(INET6) || defined(INET) 56 #include <netinet/tcp_var.h> 57 #endif 58 #include <netinet/udp.h> 59 #include <netinet/udp_var.h> 60 #include <sys/proc.h> 61 #ifdef INET6 62 #include <netinet/icmp6.h> 63 #endif 64 65 #ifndef KTR_SCTP 66 #define KTR_SCTP KTR_SUBSYS 67 #endif 68 69 extern const struct sctp_cc_functions sctp_cc_functions[]; 70 extern const struct sctp_ss_functions sctp_ss_functions[]; 71 72 void 73 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr) 74 { 75 #if defined(SCTP_LOCAL_TRACE_BUF) 76 struct sctp_cwnd_log sctp_clog; 77 78 sctp_clog.x.sb.stcb = stcb; 79 sctp_clog.x.sb.so_sbcc = sb->sb_cc; 80 if (stcb) 81 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc; 82 else 83 sctp_clog.x.sb.stcb_sbcc = 0; 84 sctp_clog.x.sb.incr = incr; 85 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 86 SCTP_LOG_EVENT_SB, 87 from, 88 sctp_clog.x.misc.log1, 89 sctp_clog.x.misc.log2, 90 sctp_clog.x.misc.log3, 91 sctp_clog.x.misc.log4); 92 #endif 93 } 94 95 void 96 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc) 97 { 98 #if defined(SCTP_LOCAL_TRACE_BUF) 99 struct sctp_cwnd_log sctp_clog; 100 101 sctp_clog.x.close.inp = (void *)inp; 102 sctp_clog.x.close.sctp_flags = inp->sctp_flags; 103 if (stcb) { 104 sctp_clog.x.close.stcb = (void *)stcb; 105 sctp_clog.x.close.state = (uint16_t)stcb->asoc.state; 106 } else { 107 sctp_clog.x.close.stcb = 0; 108 sctp_clog.x.close.state = 0; 109 } 110 sctp_clog.x.close.loc = loc; 111 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 112 SCTP_LOG_EVENT_CLOSE, 113 0, 114 sctp_clog.x.misc.log1, 115 sctp_clog.x.misc.log2, 116 sctp_clog.x.misc.log3, 117 sctp_clog.x.misc.log4); 118 #endif 119 } 120 121 void 122 rto_logging(struct sctp_nets *net, int from) 123 { 124 #if defined(SCTP_LOCAL_TRACE_BUF) 125 struct sctp_cwnd_log sctp_clog; 126 127 memset(&sctp_clog, 0, sizeof(sctp_clog)); 128 sctp_clog.x.rto.net = (void *)net; 129 sctp_clog.x.rto.rtt = net->rtt / 1000; 130 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 131 SCTP_LOG_EVENT_RTT, 132 from, 133 sctp_clog.x.misc.log1, 134 sctp_clog.x.misc.log2, 135 sctp_clog.x.misc.log3, 136 sctp_clog.x.misc.log4); 137 #endif 138 } 139 140 void 141 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from) 142 { 143 #if defined(SCTP_LOCAL_TRACE_BUF) 144 struct sctp_cwnd_log sctp_clog; 145 146 sctp_clog.x.strlog.stcb = stcb; 147 sctp_clog.x.strlog.n_tsn = tsn; 148 sctp_clog.x.strlog.n_sseq = sseq; 149 sctp_clog.x.strlog.e_tsn = 0; 150 sctp_clog.x.strlog.e_sseq = 0; 151 sctp_clog.x.strlog.strm = stream; 152 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 153 SCTP_LOG_EVENT_STRM, 154 from, 155 sctp_clog.x.misc.log1, 156 sctp_clog.x.misc.log2, 157 sctp_clog.x.misc.log3, 158 sctp_clog.x.misc.log4); 159 #endif 160 } 161 162 void 163 sctp_log_nagle_event(struct sctp_tcb *stcb, int action) 164 { 165 #if defined(SCTP_LOCAL_TRACE_BUF) 166 struct sctp_cwnd_log sctp_clog; 167 168 sctp_clog.x.nagle.stcb = (void *)stcb; 169 sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight; 170 sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size; 171 sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue; 172 sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count; 173 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 174 SCTP_LOG_EVENT_NAGLE, 175 action, 176 sctp_clog.x.misc.log1, 177 sctp_clog.x.misc.log2, 178 sctp_clog.x.misc.log3, 179 sctp_clog.x.misc.log4); 180 #endif 181 } 182 183 void 184 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from) 185 { 186 #if defined(SCTP_LOCAL_TRACE_BUF) 187 struct sctp_cwnd_log sctp_clog; 188 189 sctp_clog.x.sack.cumack = cumack; 190 sctp_clog.x.sack.oldcumack = old_cumack; 191 sctp_clog.x.sack.tsn = tsn; 192 sctp_clog.x.sack.numGaps = gaps; 193 sctp_clog.x.sack.numDups = dups; 194 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 195 SCTP_LOG_EVENT_SACK, 196 from, 197 sctp_clog.x.misc.log1, 198 sctp_clog.x.misc.log2, 199 sctp_clog.x.misc.log3, 200 sctp_clog.x.misc.log4); 201 #endif 202 } 203 204 void 205 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from) 206 { 207 #if defined(SCTP_LOCAL_TRACE_BUF) 208 struct sctp_cwnd_log sctp_clog; 209 210 memset(&sctp_clog, 0, sizeof(sctp_clog)); 211 sctp_clog.x.map.base = map; 212 sctp_clog.x.map.cum = cum; 213 sctp_clog.x.map.high = high; 214 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 215 SCTP_LOG_EVENT_MAP, 216 from, 217 sctp_clog.x.misc.log1, 218 sctp_clog.x.misc.log2, 219 sctp_clog.x.misc.log3, 220 sctp_clog.x.misc.log4); 221 #endif 222 } 223 224 void 225 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from) 226 { 227 #if defined(SCTP_LOCAL_TRACE_BUF) 228 struct sctp_cwnd_log sctp_clog; 229 230 memset(&sctp_clog, 0, sizeof(sctp_clog)); 231 sctp_clog.x.fr.largest_tsn = biggest_tsn; 232 sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn; 233 sctp_clog.x.fr.tsn = tsn; 234 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 235 SCTP_LOG_EVENT_FR, 236 from, 237 sctp_clog.x.misc.log1, 238 sctp_clog.x.misc.log2, 239 sctp_clog.x.misc.log3, 240 sctp_clog.x.misc.log4); 241 #endif 242 } 243 244 #ifdef SCTP_MBUF_LOGGING 245 void 246 sctp_log_mb(struct mbuf *m, int from) 247 { 248 #if defined(SCTP_LOCAL_TRACE_BUF) 249 struct sctp_cwnd_log sctp_clog; 250 251 sctp_clog.x.mb.mp = m; 252 sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m)); 253 sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m)); 254 sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0); 255 if (SCTP_BUF_IS_EXTENDED(m)) { 256 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m); 257 sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m)); 258 } else { 259 sctp_clog.x.mb.ext = 0; 260 sctp_clog.x.mb.refcnt = 0; 261 } 262 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 263 SCTP_LOG_EVENT_MBUF, 264 from, 265 sctp_clog.x.misc.log1, 266 sctp_clog.x.misc.log2, 267 sctp_clog.x.misc.log3, 268 sctp_clog.x.misc.log4); 269 #endif 270 } 271 272 void 273 sctp_log_mbc(struct mbuf *m, int from) 274 { 275 struct mbuf *mat; 276 277 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 278 sctp_log_mb(mat, from); 279 } 280 } 281 #endif 282 283 void 284 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from) 285 { 286 #if defined(SCTP_LOCAL_TRACE_BUF) 287 struct sctp_cwnd_log sctp_clog; 288 289 if (control == NULL) { 290 SCTP_PRINTF("Gak log of NULL?\n"); 291 return; 292 } 293 sctp_clog.x.strlog.stcb = control->stcb; 294 sctp_clog.x.strlog.n_tsn = control->sinfo_tsn; 295 sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid; 296 sctp_clog.x.strlog.strm = control->sinfo_stream; 297 if (poschk != NULL) { 298 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn; 299 sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid; 300 } else { 301 sctp_clog.x.strlog.e_tsn = 0; 302 sctp_clog.x.strlog.e_sseq = 0; 303 } 304 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 305 SCTP_LOG_EVENT_STRM, 306 from, 307 sctp_clog.x.misc.log1, 308 sctp_clog.x.misc.log2, 309 sctp_clog.x.misc.log3, 310 sctp_clog.x.misc.log4); 311 #endif 312 } 313 314 void 315 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from) 316 { 317 #if defined(SCTP_LOCAL_TRACE_BUF) 318 struct sctp_cwnd_log sctp_clog; 319 320 sctp_clog.x.cwnd.net = net; 321 if (stcb->asoc.send_queue_cnt > 255) 322 sctp_clog.x.cwnd.cnt_in_send = 255; 323 else 324 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt; 325 if (stcb->asoc.stream_queue_cnt > 255) 326 sctp_clog.x.cwnd.cnt_in_str = 255; 327 else 328 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt; 329 330 if (net) { 331 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd; 332 sctp_clog.x.cwnd.inflight = net->flight_size; 333 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack; 334 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack; 335 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack; 336 } 337 if (SCTP_CWNDLOG_PRESEND == from) { 338 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd; 339 } 340 sctp_clog.x.cwnd.cwnd_augment = augment; 341 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 342 SCTP_LOG_EVENT_CWND, 343 from, 344 sctp_clog.x.misc.log1, 345 sctp_clog.x.misc.log2, 346 sctp_clog.x.misc.log3, 347 sctp_clog.x.misc.log4); 348 #endif 349 } 350 351 void 352 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from) 353 { 354 #if defined(SCTP_LOCAL_TRACE_BUF) 355 struct sctp_cwnd_log sctp_clog; 356 357 memset(&sctp_clog, 0, sizeof(sctp_clog)); 358 if (inp) { 359 sctp_clog.x.lock.sock = (void *)inp->sctp_socket; 360 361 } else { 362 sctp_clog.x.lock.sock = (void *)NULL; 363 } 364 sctp_clog.x.lock.inp = (void *)inp; 365 if (stcb) { 366 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx); 367 } else { 368 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN; 369 } 370 if (inp) { 371 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx); 372 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx); 373 } else { 374 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN; 375 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN; 376 } 377 sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx)); 378 if (inp && (inp->sctp_socket)) { 379 sctp_clog.x.lock.sock_lock = mtx_owned(SOCK_MTX(inp->sctp_socket)); 380 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(SOCKBUF_MTX(&inp->sctp_socket->so_rcv)); 381 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(SOCKBUF_MTX(&inp->sctp_socket->so_snd)); 382 } else { 383 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN; 384 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN; 385 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN; 386 } 387 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 388 SCTP_LOG_LOCK_EVENT, 389 from, 390 sctp_clog.x.misc.log1, 391 sctp_clog.x.misc.log2, 392 sctp_clog.x.misc.log3, 393 sctp_clog.x.misc.log4); 394 #endif 395 } 396 397 void 398 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from) 399 { 400 #if defined(SCTP_LOCAL_TRACE_BUF) 401 struct sctp_cwnd_log sctp_clog; 402 403 memset(&sctp_clog, 0, sizeof(sctp_clog)); 404 sctp_clog.x.cwnd.net = net; 405 sctp_clog.x.cwnd.cwnd_new_value = error; 406 sctp_clog.x.cwnd.inflight = net->flight_size; 407 sctp_clog.x.cwnd.cwnd_augment = burst; 408 if (stcb->asoc.send_queue_cnt > 255) 409 sctp_clog.x.cwnd.cnt_in_send = 255; 410 else 411 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt; 412 if (stcb->asoc.stream_queue_cnt > 255) 413 sctp_clog.x.cwnd.cnt_in_str = 255; 414 else 415 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt; 416 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 417 SCTP_LOG_EVENT_MAXBURST, 418 from, 419 sctp_clog.x.misc.log1, 420 sctp_clog.x.misc.log2, 421 sctp_clog.x.misc.log3, 422 sctp_clog.x.misc.log4); 423 #endif 424 } 425 426 void 427 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead) 428 { 429 #if defined(SCTP_LOCAL_TRACE_BUF) 430 struct sctp_cwnd_log sctp_clog; 431 432 sctp_clog.x.rwnd.rwnd = peers_rwnd; 433 sctp_clog.x.rwnd.send_size = snd_size; 434 sctp_clog.x.rwnd.overhead = overhead; 435 sctp_clog.x.rwnd.new_rwnd = 0; 436 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 437 SCTP_LOG_EVENT_RWND, 438 from, 439 sctp_clog.x.misc.log1, 440 sctp_clog.x.misc.log2, 441 sctp_clog.x.misc.log3, 442 sctp_clog.x.misc.log4); 443 #endif 444 } 445 446 void 447 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval) 448 { 449 #if defined(SCTP_LOCAL_TRACE_BUF) 450 struct sctp_cwnd_log sctp_clog; 451 452 sctp_clog.x.rwnd.rwnd = peers_rwnd; 453 sctp_clog.x.rwnd.send_size = flight_size; 454 sctp_clog.x.rwnd.overhead = overhead; 455 sctp_clog.x.rwnd.new_rwnd = a_rwndval; 456 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 457 SCTP_LOG_EVENT_RWND, 458 from, 459 sctp_clog.x.misc.log1, 460 sctp_clog.x.misc.log2, 461 sctp_clog.x.misc.log3, 462 sctp_clog.x.misc.log4); 463 #endif 464 } 465 466 #ifdef SCTP_MBCNT_LOGGING 467 static void 468 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt) 469 { 470 #if defined(SCTP_LOCAL_TRACE_BUF) 471 struct sctp_cwnd_log sctp_clog; 472 473 sctp_clog.x.mbcnt.total_queue_size = total_oq; 474 sctp_clog.x.mbcnt.size_change = book; 475 sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q; 476 sctp_clog.x.mbcnt.mbcnt_change = mbcnt; 477 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 478 SCTP_LOG_EVENT_MBCNT, 479 from, 480 sctp_clog.x.misc.log1, 481 sctp_clog.x.misc.log2, 482 sctp_clog.x.misc.log3, 483 sctp_clog.x.misc.log4); 484 #endif 485 } 486 #endif 487 488 void 489 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d) 490 { 491 #if defined(SCTP_LOCAL_TRACE_BUF) 492 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 493 SCTP_LOG_MISC_EVENT, 494 from, 495 a, b, c, d); 496 #endif 497 } 498 499 void 500 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from) 501 { 502 #if defined(SCTP_LOCAL_TRACE_BUF) 503 struct sctp_cwnd_log sctp_clog; 504 505 sctp_clog.x.wake.stcb = (void *)stcb; 506 sctp_clog.x.wake.wake_cnt = wake_cnt; 507 sctp_clog.x.wake.flight = stcb->asoc.total_flight_count; 508 sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt; 509 sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt; 510 511 if (stcb->asoc.stream_queue_cnt < 0xff) 512 sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt; 513 else 514 sctp_clog.x.wake.stream_qcnt = 0xff; 515 516 if (stcb->asoc.chunks_on_out_queue < 0xff) 517 sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue; 518 else 519 sctp_clog.x.wake.chunks_on_oque = 0xff; 520 521 sctp_clog.x.wake.sctpflags = 0; 522 /* set in the defered mode stuff */ 523 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE) 524 sctp_clog.x.wake.sctpflags |= 1; 525 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT) 526 sctp_clog.x.wake.sctpflags |= 2; 527 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT) 528 sctp_clog.x.wake.sctpflags |= 4; 529 /* what about the sb */ 530 if (stcb->sctp_socket) { 531 struct socket *so = stcb->sctp_socket; 532 533 sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff)); 534 } else { 535 sctp_clog.x.wake.sbflags = 0xff; 536 } 537 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 538 SCTP_LOG_EVENT_WAKE, 539 from, 540 sctp_clog.x.misc.log1, 541 sctp_clog.x.misc.log2, 542 sctp_clog.x.misc.log3, 543 sctp_clog.x.misc.log4); 544 #endif 545 } 546 547 void 548 sctp_log_block(uint8_t from, struct sctp_association *asoc, ssize_t sendlen) 549 { 550 #if defined(SCTP_LOCAL_TRACE_BUF) 551 struct sctp_cwnd_log sctp_clog; 552 553 sctp_clog.x.blk.onsb = asoc->total_output_queue_size; 554 sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt); 555 sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd; 556 sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt; 557 sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue; 558 sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024); 559 sctp_clog.x.blk.sndlen = (uint32_t)sendlen; 560 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 561 SCTP_LOG_EVENT_BLOCK, 562 from, 563 sctp_clog.x.misc.log1, 564 sctp_clog.x.misc.log2, 565 sctp_clog.x.misc.log3, 566 sctp_clog.x.misc.log4); 567 #endif 568 } 569 570 int 571 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED) 572 { 573 /* May need to fix this if ktrdump does not work */ 574 return (0); 575 } 576 577 #ifdef SCTP_AUDITING_ENABLED 578 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2]; 579 static int sctp_audit_indx = 0; 580 581 static 582 void 583 sctp_print_audit_report(void) 584 { 585 int i; 586 int cnt; 587 588 cnt = 0; 589 for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) { 590 if ((sctp_audit_data[i][0] == 0xe0) && 591 (sctp_audit_data[i][1] == 0x01)) { 592 cnt = 0; 593 SCTP_PRINTF("\n"); 594 } else if (sctp_audit_data[i][0] == 0xf0) { 595 cnt = 0; 596 SCTP_PRINTF("\n"); 597 } else if ((sctp_audit_data[i][0] == 0xc0) && 598 (sctp_audit_data[i][1] == 0x01)) { 599 SCTP_PRINTF("\n"); 600 cnt = 0; 601 } 602 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0], 603 (uint32_t)sctp_audit_data[i][1]); 604 cnt++; 605 if ((cnt % 14) == 0) 606 SCTP_PRINTF("\n"); 607 } 608 for (i = 0; i < sctp_audit_indx; i++) { 609 if ((sctp_audit_data[i][0] == 0xe0) && 610 (sctp_audit_data[i][1] == 0x01)) { 611 cnt = 0; 612 SCTP_PRINTF("\n"); 613 } else if (sctp_audit_data[i][0] == 0xf0) { 614 cnt = 0; 615 SCTP_PRINTF("\n"); 616 } else if ((sctp_audit_data[i][0] == 0xc0) && 617 (sctp_audit_data[i][1] == 0x01)) { 618 SCTP_PRINTF("\n"); 619 cnt = 0; 620 } 621 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0], 622 (uint32_t)sctp_audit_data[i][1]); 623 cnt++; 624 if ((cnt % 14) == 0) 625 SCTP_PRINTF("\n"); 626 } 627 SCTP_PRINTF("\n"); 628 } 629 630 void 631 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 632 struct sctp_nets *net) 633 { 634 int resend_cnt, tot_out, rep, tot_book_cnt; 635 struct sctp_nets *lnet; 636 struct sctp_tmit_chunk *chk; 637 638 sctp_audit_data[sctp_audit_indx][0] = 0xAA; 639 sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from; 640 sctp_audit_indx++; 641 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 642 sctp_audit_indx = 0; 643 } 644 if (inp == NULL) { 645 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 646 sctp_audit_data[sctp_audit_indx][1] = 0x01; 647 sctp_audit_indx++; 648 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 649 sctp_audit_indx = 0; 650 } 651 return; 652 } 653 if (stcb == NULL) { 654 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 655 sctp_audit_data[sctp_audit_indx][1] = 0x02; 656 sctp_audit_indx++; 657 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 658 sctp_audit_indx = 0; 659 } 660 return; 661 } 662 sctp_audit_data[sctp_audit_indx][0] = 0xA1; 663 sctp_audit_data[sctp_audit_indx][1] = 664 (0x000000ff & stcb->asoc.sent_queue_retran_cnt); 665 sctp_audit_indx++; 666 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 667 sctp_audit_indx = 0; 668 } 669 rep = 0; 670 tot_book_cnt = 0; 671 resend_cnt = tot_out = 0; 672 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 673 if (chk->sent == SCTP_DATAGRAM_RESEND) { 674 resend_cnt++; 675 } else if (chk->sent < SCTP_DATAGRAM_RESEND) { 676 tot_out += chk->book_size; 677 tot_book_cnt++; 678 } 679 } 680 if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) { 681 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 682 sctp_audit_data[sctp_audit_indx][1] = 0xA1; 683 sctp_audit_indx++; 684 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 685 sctp_audit_indx = 0; 686 } 687 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n", 688 resend_cnt, stcb->asoc.sent_queue_retran_cnt); 689 rep = 1; 690 stcb->asoc.sent_queue_retran_cnt = resend_cnt; 691 sctp_audit_data[sctp_audit_indx][0] = 0xA2; 692 sctp_audit_data[sctp_audit_indx][1] = 693 (0x000000ff & stcb->asoc.sent_queue_retran_cnt); 694 sctp_audit_indx++; 695 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 696 sctp_audit_indx = 0; 697 } 698 } 699 if (tot_out != stcb->asoc.total_flight) { 700 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 701 sctp_audit_data[sctp_audit_indx][1] = 0xA2; 702 sctp_audit_indx++; 703 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 704 sctp_audit_indx = 0; 705 } 706 rep = 1; 707 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out, 708 (int)stcb->asoc.total_flight); 709 stcb->asoc.total_flight = tot_out; 710 } 711 if (tot_book_cnt != stcb->asoc.total_flight_count) { 712 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 713 sctp_audit_data[sctp_audit_indx][1] = 0xA5; 714 sctp_audit_indx++; 715 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 716 sctp_audit_indx = 0; 717 } 718 rep = 1; 719 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt); 720 721 stcb->asoc.total_flight_count = tot_book_cnt; 722 } 723 tot_out = 0; 724 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) { 725 tot_out += lnet->flight_size; 726 } 727 if (tot_out != stcb->asoc.total_flight) { 728 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 729 sctp_audit_data[sctp_audit_indx][1] = 0xA3; 730 sctp_audit_indx++; 731 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 732 sctp_audit_indx = 0; 733 } 734 rep = 1; 735 SCTP_PRINTF("real flight:%d net total was %d\n", 736 stcb->asoc.total_flight, tot_out); 737 /* now corrective action */ 738 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) { 739 tot_out = 0; 740 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 741 if ((chk->whoTo == lnet) && 742 (chk->sent < SCTP_DATAGRAM_RESEND)) { 743 tot_out += chk->book_size; 744 } 745 } 746 if (lnet->flight_size != tot_out) { 747 SCTP_PRINTF("net:%p flight was %d corrected to %d\n", 748 (void *)lnet, lnet->flight_size, 749 tot_out); 750 lnet->flight_size = tot_out; 751 } 752 } 753 } 754 if (rep) { 755 sctp_print_audit_report(); 756 } 757 } 758 759 void 760 sctp_audit_log(uint8_t ev, uint8_t fd) 761 { 762 763 sctp_audit_data[sctp_audit_indx][0] = ev; 764 sctp_audit_data[sctp_audit_indx][1] = fd; 765 sctp_audit_indx++; 766 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 767 sctp_audit_indx = 0; 768 } 769 } 770 771 #endif 772 773 /* 774 * The conversion from time to ticks and vice versa is done by rounding 775 * upwards. This way we can test in the code the time to be positive and 776 * know that this corresponds to a positive number of ticks. 777 */ 778 779 uint32_t 780 sctp_msecs_to_ticks(uint32_t msecs) 781 { 782 uint64_t temp; 783 uint32_t ticks; 784 785 if (hz == 1000) { 786 ticks = msecs; 787 } else { 788 temp = (((uint64_t)msecs * hz) + 999) / 1000; 789 if (temp > UINT32_MAX) { 790 ticks = UINT32_MAX; 791 } else { 792 ticks = (uint32_t)temp; 793 } 794 } 795 return (ticks); 796 } 797 798 uint32_t 799 sctp_ticks_to_msecs(uint32_t ticks) 800 { 801 uint64_t temp; 802 uint32_t msecs; 803 804 if (hz == 1000) { 805 msecs = ticks; 806 } else { 807 temp = (((uint64_t)ticks * 1000) + (hz - 1)) / hz; 808 if (temp > UINT32_MAX) { 809 msecs = UINT32_MAX; 810 } else { 811 msecs = (uint32_t)temp; 812 } 813 } 814 return (msecs); 815 } 816 817 uint32_t 818 sctp_secs_to_ticks(uint32_t secs) 819 { 820 uint64_t temp; 821 uint32_t ticks; 822 823 temp = (uint64_t)secs * hz; 824 if (temp > UINT32_MAX) { 825 ticks = UINT32_MAX; 826 } else { 827 ticks = (uint32_t)temp; 828 } 829 return (ticks); 830 } 831 832 uint32_t 833 sctp_ticks_to_secs(uint32_t ticks) 834 { 835 uint64_t temp; 836 uint32_t secs; 837 838 temp = ((uint64_t)ticks + (hz - 1)) / hz; 839 if (temp > UINT32_MAX) { 840 secs = UINT32_MAX; 841 } else { 842 secs = (uint32_t)temp; 843 } 844 return (secs); 845 } 846 847 /* 848 * sctp_stop_timers_for_shutdown() should be called 849 * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT 850 * state to make sure that all timers are stopped. 851 */ 852 void 853 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb) 854 { 855 struct sctp_inpcb *inp; 856 struct sctp_nets *net; 857 858 inp = stcb->sctp_ep; 859 860 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL, 861 SCTP_FROM_SCTPUTIL + SCTP_LOC_12); 862 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL, 863 SCTP_FROM_SCTPUTIL + SCTP_LOC_13); 864 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL, 865 SCTP_FROM_SCTPUTIL + SCTP_LOC_14); 866 sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL, 867 SCTP_FROM_SCTPUTIL + SCTP_LOC_15); 868 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 869 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net, 870 SCTP_FROM_SCTPUTIL + SCTP_LOC_16); 871 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, 872 SCTP_FROM_SCTPUTIL + SCTP_LOC_17); 873 } 874 } 875 876 void 877 sctp_stop_association_timers(struct sctp_tcb *stcb, bool stop_assoc_kill_timer) 878 { 879 struct sctp_inpcb *inp; 880 struct sctp_nets *net; 881 882 inp = stcb->sctp_ep; 883 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL, 884 SCTP_FROM_SCTPUTIL + SCTP_LOC_18); 885 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL, 886 SCTP_FROM_SCTPUTIL + SCTP_LOC_19); 887 if (stop_assoc_kill_timer) { 888 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, 889 SCTP_FROM_SCTPUTIL + SCTP_LOC_20); 890 } 891 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL, 892 SCTP_FROM_SCTPUTIL + SCTP_LOC_21); 893 sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL, 894 SCTP_FROM_SCTPUTIL + SCTP_LOC_22); 895 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNGUARD, inp, stcb, NULL, 896 SCTP_FROM_SCTPUTIL + SCTP_LOC_23); 897 /* Mobility adaptation */ 898 sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, inp, stcb, NULL, 899 SCTP_FROM_SCTPUTIL + SCTP_LOC_24); 900 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 901 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 902 SCTP_FROM_SCTPUTIL + SCTP_LOC_25); 903 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, 904 SCTP_FROM_SCTPUTIL + SCTP_LOC_26); 905 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, inp, stcb, net, 906 SCTP_FROM_SCTPUTIL + SCTP_LOC_27); 907 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net, 908 SCTP_FROM_SCTPUTIL + SCTP_LOC_28); 909 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, inp, stcb, net, 910 SCTP_FROM_SCTPUTIL + SCTP_LOC_29); 911 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net, 912 SCTP_FROM_SCTPUTIL + SCTP_LOC_30); 913 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, 914 SCTP_FROM_SCTPUTIL + SCTP_LOC_31); 915 } 916 } 917 918 /* 919 * A list of sizes based on typical mtu's, used only if next hop size not 920 * returned. These values MUST be multiples of 4 and MUST be ordered. 921 */ 922 static uint32_t sctp_mtu_sizes[] = { 923 68, 924 296, 925 508, 926 512, 927 544, 928 576, 929 1004, 930 1492, 931 1500, 932 1536, 933 2000, 934 2048, 935 4352, 936 4464, 937 8168, 938 17912, 939 32000, 940 65532 941 }; 942 943 /* 944 * Return the largest MTU in sctp_mtu_sizes smaller than val. 945 * If val is smaller than the minimum, just return the largest 946 * multiple of 4 smaller or equal to val. 947 * Ensure that the result is a multiple of 4. 948 */ 949 uint32_t 950 sctp_get_prev_mtu(uint32_t val) 951 { 952 uint32_t i; 953 954 val &= 0xfffffffc; 955 if (val <= sctp_mtu_sizes[0]) { 956 return (val); 957 } 958 for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) { 959 if (val <= sctp_mtu_sizes[i]) { 960 break; 961 } 962 } 963 KASSERT((sctp_mtu_sizes[i - 1] & 0x00000003) == 0, 964 ("sctp_mtu_sizes[%u] not a multiple of 4", i - 1)); 965 return (sctp_mtu_sizes[i - 1]); 966 } 967 968 /* 969 * Return the smallest MTU in sctp_mtu_sizes larger than val. 970 * If val is larger than the maximum, just return the largest multiple of 4 smaller 971 * or equal to val. 972 * Ensure that the result is a multiple of 4. 973 */ 974 uint32_t 975 sctp_get_next_mtu(uint32_t val) 976 { 977 /* select another MTU that is just bigger than this one */ 978 uint32_t i; 979 980 val &= 0xfffffffc; 981 for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) { 982 if (val < sctp_mtu_sizes[i]) { 983 KASSERT((sctp_mtu_sizes[i] & 0x00000003) == 0, 984 ("sctp_mtu_sizes[%u] not a multiple of 4", i)); 985 return (sctp_mtu_sizes[i]); 986 } 987 } 988 return (val); 989 } 990 991 void 992 sctp_fill_random_store(struct sctp_pcb *m) 993 { 994 /* 995 * Here we use the MD5/SHA-1 to hash with our good randomNumbers and 996 * our counter. The result becomes our good random numbers and we 997 * then setup to give these out. Note that we do no locking to 998 * protect this. This is ok, since if competing folks call this we 999 * will get more gobbled gook in the random store which is what we 1000 * want. There is a danger that two guys will use the same random 1001 * numbers, but thats ok too since that is random as well :-> 1002 */ 1003 m->store_at = 0; 1004 (void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers, 1005 sizeof(m->random_numbers), (uint8_t *)&m->random_counter, 1006 sizeof(m->random_counter), (uint8_t *)m->random_store); 1007 m->random_counter++; 1008 } 1009 1010 uint32_t 1011 sctp_select_initial_TSN(struct sctp_pcb *inp) 1012 { 1013 /* 1014 * A true implementation should use random selection process to get 1015 * the initial stream sequence number, using RFC1750 as a good 1016 * guideline 1017 */ 1018 uint32_t x, *xp; 1019 uint8_t *p; 1020 int store_at, new_store; 1021 1022 if (inp->initial_sequence_debug != 0) { 1023 uint32_t ret; 1024 1025 ret = inp->initial_sequence_debug; 1026 inp->initial_sequence_debug++; 1027 return (ret); 1028 } 1029 retry: 1030 store_at = inp->store_at; 1031 new_store = store_at + sizeof(uint32_t); 1032 if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) { 1033 new_store = 0; 1034 } 1035 if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) { 1036 goto retry; 1037 } 1038 if (new_store == 0) { 1039 /* Refill the random store */ 1040 sctp_fill_random_store(inp); 1041 } 1042 p = &inp->random_store[store_at]; 1043 xp = (uint32_t *)p; 1044 x = *xp; 1045 return (x); 1046 } 1047 1048 uint32_t 1049 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check) 1050 { 1051 uint32_t x; 1052 struct timeval now; 1053 1054 if (check) { 1055 (void)SCTP_GETTIME_TIMEVAL(&now); 1056 } 1057 for (;;) { 1058 x = sctp_select_initial_TSN(&inp->sctp_ep); 1059 if (x == 0) { 1060 /* we never use 0 */ 1061 continue; 1062 } 1063 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) { 1064 break; 1065 } 1066 } 1067 return (x); 1068 } 1069 1070 int32_t 1071 sctp_map_assoc_state(int kernel_state) 1072 { 1073 int32_t user_state; 1074 1075 if (kernel_state & SCTP_STATE_WAS_ABORTED) { 1076 user_state = SCTP_CLOSED; 1077 } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) { 1078 user_state = SCTP_SHUTDOWN_PENDING; 1079 } else { 1080 switch (kernel_state & SCTP_STATE_MASK) { 1081 case SCTP_STATE_EMPTY: 1082 user_state = SCTP_CLOSED; 1083 break; 1084 case SCTP_STATE_INUSE: 1085 user_state = SCTP_CLOSED; 1086 break; 1087 case SCTP_STATE_COOKIE_WAIT: 1088 user_state = SCTP_COOKIE_WAIT; 1089 break; 1090 case SCTP_STATE_COOKIE_ECHOED: 1091 user_state = SCTP_COOKIE_ECHOED; 1092 break; 1093 case SCTP_STATE_OPEN: 1094 user_state = SCTP_ESTABLISHED; 1095 break; 1096 case SCTP_STATE_SHUTDOWN_SENT: 1097 user_state = SCTP_SHUTDOWN_SENT; 1098 break; 1099 case SCTP_STATE_SHUTDOWN_RECEIVED: 1100 user_state = SCTP_SHUTDOWN_RECEIVED; 1101 break; 1102 case SCTP_STATE_SHUTDOWN_ACK_SENT: 1103 user_state = SCTP_SHUTDOWN_ACK_SENT; 1104 break; 1105 default: 1106 user_state = SCTP_CLOSED; 1107 break; 1108 } 1109 } 1110 return (user_state); 1111 } 1112 1113 int 1114 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 1115 uint32_t override_tag, uint32_t initial_tsn, uint32_t vrf_id, 1116 uint16_t o_strms) 1117 { 1118 struct sctp_association *asoc; 1119 1120 /* 1121 * Anything set to zero is taken care of by the allocation routine's 1122 * bzero 1123 */ 1124 1125 /* 1126 * Up front select what scoping to apply on addresses I tell my peer 1127 * Not sure what to do with these right now, we will need to come up 1128 * with a way to set them. We may need to pass them through from the 1129 * caller in the sctp_aloc_assoc() function. 1130 */ 1131 int i; 1132 #if defined(SCTP_DETAILED_STR_STATS) 1133 int j; 1134 #endif 1135 1136 asoc = &stcb->asoc; 1137 /* init all variables to a known value. */ 1138 SCTP_SET_STATE(stcb, SCTP_STATE_INUSE); 1139 asoc->max_burst = inp->sctp_ep.max_burst; 1140 asoc->fr_max_burst = inp->sctp_ep.fr_max_burst; 1141 asoc->heart_beat_delay = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]); 1142 asoc->cookie_life = inp->sctp_ep.def_cookie_life; 1143 asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off; 1144 asoc->ecn_supported = inp->ecn_supported; 1145 asoc->prsctp_supported = inp->prsctp_supported; 1146 asoc->auth_supported = inp->auth_supported; 1147 asoc->asconf_supported = inp->asconf_supported; 1148 asoc->reconfig_supported = inp->reconfig_supported; 1149 asoc->nrsack_supported = inp->nrsack_supported; 1150 asoc->pktdrop_supported = inp->pktdrop_supported; 1151 asoc->idata_supported = inp->idata_supported; 1152 asoc->sctp_cmt_pf = (uint8_t)0; 1153 asoc->sctp_frag_point = inp->sctp_frag_point; 1154 asoc->sctp_features = inp->sctp_features; 1155 asoc->default_dscp = inp->sctp_ep.default_dscp; 1156 asoc->max_cwnd = inp->max_cwnd; 1157 #ifdef INET6 1158 if (inp->sctp_ep.default_flowlabel) { 1159 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel; 1160 } else { 1161 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) { 1162 asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep); 1163 asoc->default_flowlabel &= 0x000fffff; 1164 asoc->default_flowlabel |= 0x80000000; 1165 } else { 1166 asoc->default_flowlabel = 0; 1167 } 1168 } 1169 #endif 1170 asoc->sb_send_resv = 0; 1171 if (override_tag) { 1172 asoc->my_vtag = override_tag; 1173 } else { 1174 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1); 1175 } 1176 /* Get the nonce tags */ 1177 asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0); 1178 asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0); 1179 asoc->vrf_id = vrf_id; 1180 1181 #ifdef SCTP_ASOCLOG_OF_TSNS 1182 asoc->tsn_in_at = 0; 1183 asoc->tsn_out_at = 0; 1184 asoc->tsn_in_wrapped = 0; 1185 asoc->tsn_out_wrapped = 0; 1186 asoc->cumack_log_at = 0; 1187 asoc->cumack_log_atsnt = 0; 1188 #endif 1189 #ifdef SCTP_FS_SPEC_LOG 1190 asoc->fs_index = 0; 1191 #endif 1192 asoc->refcnt = 0; 1193 asoc->assoc_up_sent = 0; 1194 if (override_tag) { 1195 asoc->init_seq_number = initial_tsn; 1196 } else { 1197 asoc->init_seq_number = sctp_select_initial_TSN(&inp->sctp_ep); 1198 } 1199 asoc->asconf_seq_out = asoc->init_seq_number; 1200 asoc->str_reset_seq_out = asoc->init_seq_number; 1201 asoc->sending_seq = asoc->init_seq_number; 1202 asoc->asconf_seq_out_acked = asoc->init_seq_number - 1; 1203 /* we are optimisitic here */ 1204 asoc->peer_supports_nat = 0; 1205 asoc->sent_queue_retran_cnt = 0; 1206 1207 /* for CMT */ 1208 asoc->last_net_cmt_send_started = NULL; 1209 1210 asoc->last_acked_seq = asoc->init_seq_number - 1; 1211 asoc->advanced_peer_ack_point = asoc->init_seq_number - 1; 1212 asoc->asconf_seq_in = asoc->init_seq_number - 1; 1213 1214 /* here we are different, we hold the next one we expect */ 1215 asoc->str_reset_seq_in = asoc->init_seq_number; 1216 1217 asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max; 1218 asoc->initial_rto = inp->sctp_ep.initial_rto; 1219 1220 asoc->default_mtu = inp->sctp_ep.default_mtu; 1221 asoc->max_init_times = inp->sctp_ep.max_init_times; 1222 asoc->max_send_times = inp->sctp_ep.max_send_times; 1223 asoc->def_net_failure = inp->sctp_ep.def_net_failure; 1224 asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold; 1225 asoc->free_chunk_cnt = 0; 1226 1227 asoc->iam_blocking = 0; 1228 asoc->context = inp->sctp_context; 1229 asoc->local_strreset_support = inp->local_strreset_support; 1230 asoc->def_send = inp->def_send; 1231 asoc->delayed_ack = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]); 1232 asoc->sack_freq = inp->sctp_ep.sctp_sack_freq; 1233 asoc->pr_sctp_cnt = 0; 1234 asoc->total_output_queue_size = 0; 1235 1236 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 1237 asoc->scope.ipv6_addr_legal = 1; 1238 if (SCTP_IPV6_V6ONLY(inp) == 0) { 1239 asoc->scope.ipv4_addr_legal = 1; 1240 } else { 1241 asoc->scope.ipv4_addr_legal = 0; 1242 } 1243 } else { 1244 asoc->scope.ipv6_addr_legal = 0; 1245 asoc->scope.ipv4_addr_legal = 1; 1246 } 1247 1248 asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND); 1249 asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket); 1250 1251 asoc->smallest_mtu = inp->sctp_frag_point; 1252 asoc->minrto = inp->sctp_ep.sctp_minrto; 1253 asoc->maxrto = inp->sctp_ep.sctp_maxrto; 1254 1255 asoc->stream_locked_on = 0; 1256 asoc->ecn_echo_cnt_onq = 0; 1257 asoc->stream_locked = 0; 1258 1259 asoc->send_sack = 1; 1260 1261 LIST_INIT(&asoc->sctp_restricted_addrs); 1262 1263 TAILQ_INIT(&asoc->nets); 1264 TAILQ_INIT(&asoc->pending_reply_queue); 1265 TAILQ_INIT(&asoc->asconf_ack_sent); 1266 /* Setup to fill the hb random cache at first HB */ 1267 asoc->hb_random_idx = 4; 1268 1269 asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time; 1270 1271 stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module; 1272 stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module]; 1273 1274 stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module; 1275 stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module]; 1276 1277 /* 1278 * Now the stream parameters, here we allocate space for all streams 1279 * that we request by default. 1280 */ 1281 asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams = 1282 o_strms; 1283 SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *, 1284 asoc->streamoutcnt * sizeof(struct sctp_stream_out), 1285 SCTP_M_STRMO); 1286 if (asoc->strmout == NULL) { 1287 /* big trouble no memory */ 1288 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 1289 return (ENOMEM); 1290 } 1291 for (i = 0; i < asoc->streamoutcnt; i++) { 1292 /* 1293 * inbound side must be set to 0xffff, also NOTE when we get 1294 * the INIT-ACK back (for INIT sender) we MUST reduce the 1295 * count (streamoutcnt) but first check if we sent to any of 1296 * the upper streams that were dropped (if some were). Those 1297 * that were dropped must be notified to the upper layer as 1298 * failed to send. 1299 */ 1300 TAILQ_INIT(&asoc->strmout[i].outqueue); 1301 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL); 1302 asoc->strmout[i].chunks_on_queues = 0; 1303 #if defined(SCTP_DETAILED_STR_STATS) 1304 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 1305 asoc->strmout[i].abandoned_sent[j] = 0; 1306 asoc->strmout[i].abandoned_unsent[j] = 0; 1307 } 1308 #else 1309 asoc->strmout[i].abandoned_sent[0] = 0; 1310 asoc->strmout[i].abandoned_unsent[0] = 0; 1311 #endif 1312 asoc->strmout[i].next_mid_ordered = 0; 1313 asoc->strmout[i].next_mid_unordered = 0; 1314 asoc->strmout[i].sid = i; 1315 asoc->strmout[i].last_msg_incomplete = 0; 1316 asoc->strmout[i].state = SCTP_STREAM_OPENING; 1317 } 1318 asoc->ss_functions.sctp_ss_init(stcb, asoc, 0); 1319 1320 /* Now the mapping array */ 1321 asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY; 1322 SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size, 1323 SCTP_M_MAP); 1324 if (asoc->mapping_array == NULL) { 1325 SCTP_FREE(asoc->strmout, SCTP_M_STRMO); 1326 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 1327 return (ENOMEM); 1328 } 1329 memset(asoc->mapping_array, 0, asoc->mapping_array_size); 1330 SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size, 1331 SCTP_M_MAP); 1332 if (asoc->nr_mapping_array == NULL) { 1333 SCTP_FREE(asoc->strmout, SCTP_M_STRMO); 1334 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP); 1335 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 1336 return (ENOMEM); 1337 } 1338 memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size); 1339 1340 /* Now the init of the other outqueues */ 1341 TAILQ_INIT(&asoc->free_chunks); 1342 TAILQ_INIT(&asoc->control_send_queue); 1343 TAILQ_INIT(&asoc->asconf_send_queue); 1344 TAILQ_INIT(&asoc->send_queue); 1345 TAILQ_INIT(&asoc->sent_queue); 1346 TAILQ_INIT(&asoc->resetHead); 1347 asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome; 1348 TAILQ_INIT(&asoc->asconf_queue); 1349 /* authentication fields */ 1350 asoc->authinfo.random = NULL; 1351 asoc->authinfo.active_keyid = 0; 1352 asoc->authinfo.assoc_key = NULL; 1353 asoc->authinfo.assoc_keyid = 0; 1354 asoc->authinfo.recv_key = NULL; 1355 asoc->authinfo.recv_keyid = 0; 1356 LIST_INIT(&asoc->shared_keys); 1357 asoc->marked_retrans = 0; 1358 asoc->port = inp->sctp_ep.port; 1359 asoc->timoinit = 0; 1360 asoc->timodata = 0; 1361 asoc->timosack = 0; 1362 asoc->timoshutdown = 0; 1363 asoc->timoheartbeat = 0; 1364 asoc->timocookie = 0; 1365 asoc->timoshutdownack = 0; 1366 (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time); 1367 asoc->discontinuity_time = asoc->start_time; 1368 for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) { 1369 asoc->abandoned_unsent[i] = 0; 1370 asoc->abandoned_sent[i] = 0; 1371 } 1372 /* 1373 * sa_ignore MEMLEAK {memory is put in the assoc mapping array and 1374 * freed later when the association is freed. 1375 */ 1376 return (0); 1377 } 1378 1379 void 1380 sctp_print_mapping_array(struct sctp_association *asoc) 1381 { 1382 unsigned int i, limit; 1383 1384 SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n", 1385 asoc->mapping_array_size, 1386 asoc->mapping_array_base_tsn, 1387 asoc->cumulative_tsn, 1388 asoc->highest_tsn_inside_map, 1389 asoc->highest_tsn_inside_nr_map); 1390 for (limit = asoc->mapping_array_size; limit > 1; limit--) { 1391 if (asoc->mapping_array[limit - 1] != 0) { 1392 break; 1393 } 1394 } 1395 SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit); 1396 for (i = 0; i < limit; i++) { 1397 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n'); 1398 } 1399 if (limit % 16) 1400 SCTP_PRINTF("\n"); 1401 for (limit = asoc->mapping_array_size; limit > 1; limit--) { 1402 if (asoc->nr_mapping_array[limit - 1]) { 1403 break; 1404 } 1405 } 1406 SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit); 1407 for (i = 0; i < limit; i++) { 1408 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n'); 1409 } 1410 if (limit % 16) 1411 SCTP_PRINTF("\n"); 1412 } 1413 1414 int 1415 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed) 1416 { 1417 /* mapping array needs to grow */ 1418 uint8_t *new_array1, *new_array2; 1419 uint32_t new_size; 1420 1421 new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR); 1422 SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP); 1423 SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP); 1424 if ((new_array1 == NULL) || (new_array2 == NULL)) { 1425 /* can't get more, forget it */ 1426 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size); 1427 if (new_array1) { 1428 SCTP_FREE(new_array1, SCTP_M_MAP); 1429 } 1430 if (new_array2) { 1431 SCTP_FREE(new_array2, SCTP_M_MAP); 1432 } 1433 return (-1); 1434 } 1435 memset(new_array1, 0, new_size); 1436 memset(new_array2, 0, new_size); 1437 memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size); 1438 memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size); 1439 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP); 1440 SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP); 1441 asoc->mapping_array = new_array1; 1442 asoc->nr_mapping_array = new_array2; 1443 asoc->mapping_array_size = new_size; 1444 return (0); 1445 } 1446 1447 static void 1448 sctp_iterator_work(struct sctp_iterator *it) 1449 { 1450 struct epoch_tracker et; 1451 struct sctp_inpcb *tinp; 1452 int iteration_count = 0; 1453 int inp_skip = 0; 1454 int first_in = 1; 1455 1456 NET_EPOCH_ENTER(et); 1457 SCTP_INP_INFO_RLOCK(); 1458 SCTP_ITERATOR_LOCK(); 1459 sctp_it_ctl.cur_it = it; 1460 if (it->inp) { 1461 SCTP_INP_RLOCK(it->inp); 1462 SCTP_INP_DECR_REF(it->inp); 1463 } 1464 if (it->inp == NULL) { 1465 /* iterator is complete */ 1466 done_with_iterator: 1467 sctp_it_ctl.cur_it = NULL; 1468 SCTP_ITERATOR_UNLOCK(); 1469 SCTP_INP_INFO_RUNLOCK(); 1470 if (it->function_atend != NULL) { 1471 (*it->function_atend) (it->pointer, it->val); 1472 } 1473 SCTP_FREE(it, SCTP_M_ITER); 1474 NET_EPOCH_EXIT(et); 1475 return; 1476 } 1477 select_a_new_ep: 1478 if (first_in) { 1479 first_in = 0; 1480 } else { 1481 SCTP_INP_RLOCK(it->inp); 1482 } 1483 while (((it->pcb_flags) && 1484 ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) || 1485 ((it->pcb_features) && 1486 ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) { 1487 /* endpoint flags or features don't match, so keep looking */ 1488 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 1489 SCTP_INP_RUNLOCK(it->inp); 1490 goto done_with_iterator; 1491 } 1492 tinp = it->inp; 1493 it->inp = LIST_NEXT(it->inp, sctp_list); 1494 it->stcb = NULL; 1495 SCTP_INP_RUNLOCK(tinp); 1496 if (it->inp == NULL) { 1497 goto done_with_iterator; 1498 } 1499 SCTP_INP_RLOCK(it->inp); 1500 } 1501 /* now go through each assoc which is in the desired state */ 1502 if (it->done_current_ep == 0) { 1503 if (it->function_inp != NULL) 1504 inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val); 1505 it->done_current_ep = 1; 1506 } 1507 if (it->stcb == NULL) { 1508 /* run the per instance function */ 1509 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list); 1510 } 1511 if ((inp_skip) || it->stcb == NULL) { 1512 if (it->function_inp_end != NULL) { 1513 inp_skip = (*it->function_inp_end) (it->inp, 1514 it->pointer, 1515 it->val); 1516 } 1517 SCTP_INP_RUNLOCK(it->inp); 1518 goto no_stcb; 1519 } 1520 while (it->stcb) { 1521 SCTP_TCB_LOCK(it->stcb); 1522 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) { 1523 /* not in the right state... keep looking */ 1524 SCTP_TCB_UNLOCK(it->stcb); 1525 goto next_assoc; 1526 } 1527 /* see if we have limited out the iterator loop */ 1528 iteration_count++; 1529 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) { 1530 /* Pause to let others grab the lock */ 1531 atomic_add_int(&it->stcb->asoc.refcnt, 1); 1532 SCTP_TCB_UNLOCK(it->stcb); 1533 SCTP_INP_INCR_REF(it->inp); 1534 SCTP_INP_RUNLOCK(it->inp); 1535 SCTP_ITERATOR_UNLOCK(); 1536 SCTP_INP_INFO_RUNLOCK(); 1537 SCTP_INP_INFO_RLOCK(); 1538 SCTP_ITERATOR_LOCK(); 1539 if (sctp_it_ctl.iterator_flags) { 1540 /* We won't be staying here */ 1541 SCTP_INP_DECR_REF(it->inp); 1542 atomic_add_int(&it->stcb->asoc.refcnt, -1); 1543 if (sctp_it_ctl.iterator_flags & 1544 SCTP_ITERATOR_STOP_CUR_IT) { 1545 sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT; 1546 goto done_with_iterator; 1547 } 1548 if (sctp_it_ctl.iterator_flags & 1549 SCTP_ITERATOR_STOP_CUR_INP) { 1550 sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP; 1551 goto no_stcb; 1552 } 1553 /* If we reach here huh? */ 1554 SCTP_PRINTF("Unknown it ctl flag %x\n", 1555 sctp_it_ctl.iterator_flags); 1556 sctp_it_ctl.iterator_flags = 0; 1557 } 1558 SCTP_INP_RLOCK(it->inp); 1559 SCTP_INP_DECR_REF(it->inp); 1560 SCTP_TCB_LOCK(it->stcb); 1561 atomic_add_int(&it->stcb->asoc.refcnt, -1); 1562 iteration_count = 0; 1563 } 1564 KASSERT(it->inp == it->stcb->sctp_ep, 1565 ("%s: stcb %p does not belong to inp %p, but inp %p", 1566 __func__, it->stcb, it->inp, it->stcb->sctp_ep)); 1567 1568 /* run function on this one */ 1569 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val); 1570 1571 /* 1572 * we lie here, it really needs to have its own type but 1573 * first I must verify that this won't effect things :-0 1574 */ 1575 if (it->no_chunk_output == 0) 1576 sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED); 1577 1578 SCTP_TCB_UNLOCK(it->stcb); 1579 next_assoc: 1580 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist); 1581 if (it->stcb == NULL) { 1582 /* Run last function */ 1583 if (it->function_inp_end != NULL) { 1584 inp_skip = (*it->function_inp_end) (it->inp, 1585 it->pointer, 1586 it->val); 1587 } 1588 } 1589 } 1590 SCTP_INP_RUNLOCK(it->inp); 1591 no_stcb: 1592 /* done with all assocs on this endpoint, move on to next endpoint */ 1593 it->done_current_ep = 0; 1594 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 1595 it->inp = NULL; 1596 } else { 1597 it->inp = LIST_NEXT(it->inp, sctp_list); 1598 } 1599 it->stcb = NULL; 1600 if (it->inp == NULL) { 1601 goto done_with_iterator; 1602 } 1603 goto select_a_new_ep; 1604 } 1605 1606 void 1607 sctp_iterator_worker(void) 1608 { 1609 struct sctp_iterator *it; 1610 1611 /* This function is called with the WQ lock in place */ 1612 sctp_it_ctl.iterator_running = 1; 1613 while ((it = TAILQ_FIRST(&sctp_it_ctl.iteratorhead)) != NULL) { 1614 /* now lets work on this one */ 1615 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr); 1616 SCTP_IPI_ITERATOR_WQ_UNLOCK(); 1617 CURVNET_SET(it->vn); 1618 sctp_iterator_work(it); 1619 CURVNET_RESTORE(); 1620 SCTP_IPI_ITERATOR_WQ_LOCK(); 1621 /* sa_ignore FREED_MEMORY */ 1622 } 1623 sctp_it_ctl.iterator_running = 0; 1624 return; 1625 } 1626 1627 static void 1628 sctp_handle_addr_wq(void) 1629 { 1630 /* deal with the ADDR wq from the rtsock calls */ 1631 struct sctp_laddr *wi, *nwi; 1632 struct sctp_asconf_iterator *asc; 1633 1634 SCTP_MALLOC(asc, struct sctp_asconf_iterator *, 1635 sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT); 1636 if (asc == NULL) { 1637 /* Try later, no memory */ 1638 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ, 1639 (struct sctp_inpcb *)NULL, 1640 (struct sctp_tcb *)NULL, 1641 (struct sctp_nets *)NULL); 1642 return; 1643 } 1644 LIST_INIT(&asc->list_of_work); 1645 asc->cnt = 0; 1646 1647 LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) { 1648 LIST_REMOVE(wi, sctp_nxt_addr); 1649 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr); 1650 asc->cnt++; 1651 } 1652 1653 if (asc->cnt == 0) { 1654 SCTP_FREE(asc, SCTP_M_ASC_IT); 1655 } else { 1656 int ret; 1657 1658 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep, 1659 sctp_asconf_iterator_stcb, 1660 NULL, /* No ep end for boundall */ 1661 SCTP_PCB_FLAGS_BOUNDALL, 1662 SCTP_PCB_ANY_FEATURES, 1663 SCTP_ASOC_ANY_STATE, 1664 (void *)asc, 0, 1665 sctp_asconf_iterator_end, NULL, 0); 1666 if (ret) { 1667 SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n"); 1668 /* 1669 * Freeing if we are stopping or put back on the 1670 * addr_wq. 1671 */ 1672 if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) { 1673 sctp_asconf_iterator_end(asc, 0); 1674 } else { 1675 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) { 1676 LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr); 1677 } 1678 SCTP_FREE(asc, SCTP_M_ASC_IT); 1679 } 1680 } 1681 } 1682 } 1683 1684 /*- 1685 * The following table shows which pointers for the inp, stcb, or net are 1686 * stored for each timer after it was started. 1687 * 1688 *|Name |Timer |inp |stcb|net | 1689 *|-----------------------------|-----------------------------|----|----|----| 1690 *|SCTP_TIMER_TYPE_SEND |net->rxt_timer |Yes |Yes |Yes | 1691 *|SCTP_TIMER_TYPE_INIT |net->rxt_timer |Yes |Yes |Yes | 1692 *|SCTP_TIMER_TYPE_RECV |stcb->asoc.dack_timer |Yes |Yes |No | 1693 *|SCTP_TIMER_TYPE_SHUTDOWN |net->rxt_timer |Yes |Yes |Yes | 1694 *|SCTP_TIMER_TYPE_HEARTBEAT |net->hb_timer |Yes |Yes |Yes | 1695 *|SCTP_TIMER_TYPE_COOKIE |net->rxt_timer |Yes |Yes |Yes | 1696 *|SCTP_TIMER_TYPE_NEWCOOKIE |inp->sctp_ep.signature_change|Yes |No |No | 1697 *|SCTP_TIMER_TYPE_PATHMTURAISE |net->pmtu_timer |Yes |Yes |Yes | 1698 *|SCTP_TIMER_TYPE_SHUTDOWNACK |net->rxt_timer |Yes |Yes |Yes | 1699 *|SCTP_TIMER_TYPE_ASCONF |stcb->asoc.asconf_timer |Yes |Yes |Yes | 1700 *|SCTP_TIMER_TYPE_SHUTDOWNGUARD|stcb->asoc.shut_guard_timer |Yes |Yes |No | 1701 *|SCTP_TIMER_TYPE_AUTOCLOSE |stcb->asoc.autoclose_timer |Yes |Yes |No | 1702 *|SCTP_TIMER_TYPE_STRRESET |stcb->asoc.strreset_timer |Yes |Yes |No | 1703 *|SCTP_TIMER_TYPE_INPKILL |inp->sctp_ep.signature_change|Yes |No |No | 1704 *|SCTP_TIMER_TYPE_ASOCKILL |stcb->asoc.strreset_timer |Yes |Yes |No | 1705 *|SCTP_TIMER_TYPE_ADDR_WQ |SCTP_BASE_INFO(addr_wq_timer)|No |No |No | 1706 *|SCTP_TIMER_TYPE_PRIM_DELETED |stcb->asoc.delete_prim_timer |Yes |Yes |No | 1707 */ 1708 1709 void 1710 sctp_timeout_handler(void *t) 1711 { 1712 struct epoch_tracker et; 1713 struct timeval tv; 1714 struct sctp_inpcb *inp; 1715 struct sctp_tcb *stcb; 1716 struct sctp_nets *net; 1717 struct sctp_timer *tmr; 1718 struct mbuf *op_err; 1719 int type; 1720 int i, secret; 1721 bool did_output, released_asoc_reference; 1722 1723 /* 1724 * If inp, stcb or net are not NULL, then references to these were 1725 * added when the timer was started, and must be released before 1726 * this function returns. 1727 */ 1728 tmr = (struct sctp_timer *)t; 1729 inp = (struct sctp_inpcb *)tmr->ep; 1730 stcb = (struct sctp_tcb *)tmr->tcb; 1731 net = (struct sctp_nets *)tmr->net; 1732 CURVNET_SET((struct vnet *)tmr->vnet); 1733 NET_EPOCH_ENTER(et); 1734 released_asoc_reference = false; 1735 1736 #ifdef SCTP_AUDITING_ENABLED 1737 sctp_audit_log(0xF0, (uint8_t)tmr->type); 1738 sctp_auditing(3, inp, stcb, net); 1739 #endif 1740 1741 /* sanity checks... */ 1742 KASSERT(tmr->self == NULL || tmr->self == tmr, 1743 ("sctp_timeout_handler: tmr->self corrupted")); 1744 KASSERT(SCTP_IS_TIMER_TYPE_VALID(tmr->type), 1745 ("sctp_timeout_handler: invalid timer type %d", tmr->type)); 1746 type = tmr->type; 1747 KASSERT(stcb == NULL || stcb->sctp_ep == inp, 1748 ("sctp_timeout_handler of type %d: inp = %p, stcb->sctp_ep %p", 1749 type, stcb, stcb->sctp_ep)); 1750 tmr->stopped_from = 0xa001; 1751 if ((stcb != NULL) && (stcb->asoc.state == SCTP_STATE_EMPTY)) { 1752 SCTPDBG(SCTP_DEBUG_TIMER2, 1753 "Timer type %d handler exiting due to CLOSED association.\n", 1754 type); 1755 goto out_decr; 1756 } 1757 tmr->stopped_from = 0xa002; 1758 SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d goes off.\n", type); 1759 if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) { 1760 SCTPDBG(SCTP_DEBUG_TIMER2, 1761 "Timer type %d handler exiting due to not being active.\n", 1762 type); 1763 goto out_decr; 1764 } 1765 1766 tmr->stopped_from = 0xa003; 1767 if (stcb) { 1768 SCTP_TCB_LOCK(stcb); 1769 /* 1770 * Release reference so that association can be freed if 1771 * necessary below. This is safe now that we have acquired 1772 * the lock. 1773 */ 1774 atomic_add_int(&stcb->asoc.refcnt, -1); 1775 released_asoc_reference = true; 1776 if ((type != SCTP_TIMER_TYPE_ASOCKILL) && 1777 ((stcb->asoc.state == SCTP_STATE_EMPTY) || 1778 (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) { 1779 SCTPDBG(SCTP_DEBUG_TIMER2, 1780 "Timer type %d handler exiting due to CLOSED association.\n", 1781 type); 1782 goto out; 1783 } 1784 } else if (inp != NULL) { 1785 SCTP_INP_WLOCK(inp); 1786 } else { 1787 SCTP_WQ_ADDR_LOCK(); 1788 } 1789 1790 /* Record in stopped_from which timeout occurred. */ 1791 tmr->stopped_from = type; 1792 /* mark as being serviced now */ 1793 if (SCTP_OS_TIMER_PENDING(&tmr->timer)) { 1794 /* 1795 * Callout has been rescheduled. 1796 */ 1797 goto out; 1798 } 1799 if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) { 1800 /* 1801 * Not active, so no action. 1802 */ 1803 goto out; 1804 } 1805 SCTP_OS_TIMER_DEACTIVATE(&tmr->timer); 1806 1807 /* call the handler for the appropriate timer type */ 1808 switch (type) { 1809 case SCTP_TIMER_TYPE_SEND: 1810 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1811 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1812 type, inp, stcb, net)); 1813 SCTP_STAT_INCR(sctps_timodata); 1814 stcb->asoc.timodata++; 1815 stcb->asoc.num_send_timers_up--; 1816 if (stcb->asoc.num_send_timers_up < 0) { 1817 stcb->asoc.num_send_timers_up = 0; 1818 } 1819 SCTP_TCB_LOCK_ASSERT(stcb); 1820 if (sctp_t3rxt_timer(inp, stcb, net)) { 1821 /* no need to unlock on tcb its gone */ 1822 1823 goto out_decr; 1824 } 1825 SCTP_TCB_LOCK_ASSERT(stcb); 1826 #ifdef SCTP_AUDITING_ENABLED 1827 sctp_auditing(4, inp, stcb, net); 1828 #endif 1829 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED); 1830 did_output = true; 1831 if ((stcb->asoc.num_send_timers_up == 0) && 1832 (stcb->asoc.sent_queue_cnt > 0)) { 1833 struct sctp_tmit_chunk *chk; 1834 1835 /* 1836 * Safeguard. If there on some on the sent queue 1837 * somewhere but no timers running something is 1838 * wrong... so we start a timer on the first chunk 1839 * on the send queue on whatever net it is sent to. 1840 */ 1841 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 1842 if (chk->whoTo != NULL) { 1843 break; 1844 } 1845 } 1846 if (chk != NULL) { 1847 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo); 1848 } 1849 } 1850 break; 1851 case SCTP_TIMER_TYPE_INIT: 1852 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1853 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1854 type, inp, stcb, net)); 1855 SCTP_STAT_INCR(sctps_timoinit); 1856 stcb->asoc.timoinit++; 1857 if (sctp_t1init_timer(inp, stcb, net)) { 1858 /* no need to unlock on tcb its gone */ 1859 goto out_decr; 1860 } 1861 did_output = false; 1862 break; 1863 case SCTP_TIMER_TYPE_RECV: 1864 KASSERT(inp != NULL && stcb != NULL && net == NULL, 1865 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1866 type, inp, stcb, net)); 1867 SCTP_STAT_INCR(sctps_timosack); 1868 stcb->asoc.timosack++; 1869 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED); 1870 #ifdef SCTP_AUDITING_ENABLED 1871 sctp_auditing(4, inp, stcb, NULL); 1872 #endif 1873 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED); 1874 did_output = true; 1875 break; 1876 case SCTP_TIMER_TYPE_SHUTDOWN: 1877 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1878 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1879 type, inp, stcb, net)); 1880 SCTP_STAT_INCR(sctps_timoshutdown); 1881 stcb->asoc.timoshutdown++; 1882 if (sctp_shutdown_timer(inp, stcb, net)) { 1883 /* no need to unlock on tcb its gone */ 1884 goto out_decr; 1885 } 1886 #ifdef SCTP_AUDITING_ENABLED 1887 sctp_auditing(4, inp, stcb, net); 1888 #endif 1889 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED); 1890 did_output = true; 1891 break; 1892 case SCTP_TIMER_TYPE_HEARTBEAT: 1893 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1894 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1895 type, inp, stcb, net)); 1896 SCTP_STAT_INCR(sctps_timoheartbeat); 1897 stcb->asoc.timoheartbeat++; 1898 if (sctp_heartbeat_timer(inp, stcb, net)) { 1899 /* no need to unlock on tcb its gone */ 1900 goto out_decr; 1901 } 1902 #ifdef SCTP_AUDITING_ENABLED 1903 sctp_auditing(4, inp, stcb, net); 1904 #endif 1905 if (!(net->dest_state & SCTP_ADDR_NOHB)) { 1906 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net); 1907 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED); 1908 did_output = true; 1909 } else { 1910 did_output = false; 1911 } 1912 break; 1913 case SCTP_TIMER_TYPE_COOKIE: 1914 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1915 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1916 type, inp, stcb, net)); 1917 SCTP_STAT_INCR(sctps_timocookie); 1918 stcb->asoc.timocookie++; 1919 if (sctp_cookie_timer(inp, stcb, net)) { 1920 /* no need to unlock on tcb its gone */ 1921 goto out_decr; 1922 } 1923 #ifdef SCTP_AUDITING_ENABLED 1924 sctp_auditing(4, inp, stcb, net); 1925 #endif 1926 /* 1927 * We consider T3 and Cookie timer pretty much the same with 1928 * respect to where from in chunk_output. 1929 */ 1930 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED); 1931 did_output = true; 1932 break; 1933 case SCTP_TIMER_TYPE_NEWCOOKIE: 1934 KASSERT(inp != NULL && stcb == NULL && net == NULL, 1935 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1936 type, inp, stcb, net)); 1937 SCTP_STAT_INCR(sctps_timosecret); 1938 (void)SCTP_GETTIME_TIMEVAL(&tv); 1939 inp->sctp_ep.time_of_secret_change = tv.tv_sec; 1940 inp->sctp_ep.last_secret_number = 1941 inp->sctp_ep.current_secret_number; 1942 inp->sctp_ep.current_secret_number++; 1943 if (inp->sctp_ep.current_secret_number >= 1944 SCTP_HOW_MANY_SECRETS) { 1945 inp->sctp_ep.current_secret_number = 0; 1946 } 1947 secret = (int)inp->sctp_ep.current_secret_number; 1948 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) { 1949 inp->sctp_ep.secret_key[secret][i] = 1950 sctp_select_initial_TSN(&inp->sctp_ep); 1951 } 1952 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL); 1953 did_output = false; 1954 break; 1955 case SCTP_TIMER_TYPE_PATHMTURAISE: 1956 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1957 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1958 type, inp, stcb, net)); 1959 SCTP_STAT_INCR(sctps_timopathmtu); 1960 sctp_pathmtu_timer(inp, stcb, net); 1961 did_output = false; 1962 break; 1963 case SCTP_TIMER_TYPE_SHUTDOWNACK: 1964 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1965 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1966 type, inp, stcb, net)); 1967 if (sctp_shutdownack_timer(inp, stcb, net)) { 1968 /* no need to unlock on tcb its gone */ 1969 goto out_decr; 1970 } 1971 SCTP_STAT_INCR(sctps_timoshutdownack); 1972 stcb->asoc.timoshutdownack++; 1973 #ifdef SCTP_AUDITING_ENABLED 1974 sctp_auditing(4, inp, stcb, net); 1975 #endif 1976 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED); 1977 did_output = true; 1978 break; 1979 case SCTP_TIMER_TYPE_ASCONF: 1980 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1981 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1982 type, inp, stcb, net)); 1983 SCTP_STAT_INCR(sctps_timoasconf); 1984 if (sctp_asconf_timer(inp, stcb, net)) { 1985 /* no need to unlock on tcb its gone */ 1986 goto out_decr; 1987 } 1988 #ifdef SCTP_AUDITING_ENABLED 1989 sctp_auditing(4, inp, stcb, net); 1990 #endif 1991 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED); 1992 did_output = true; 1993 break; 1994 case SCTP_TIMER_TYPE_SHUTDOWNGUARD: 1995 KASSERT(inp != NULL && stcb != NULL && net == NULL, 1996 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1997 type, inp, stcb, net)); 1998 SCTP_STAT_INCR(sctps_timoshutdownguard); 1999 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 2000 "Shutdown guard timer expired"); 2001 sctp_abort_an_association(inp, stcb, op_err, true, SCTP_SO_NOT_LOCKED); 2002 /* no need to unlock on tcb its gone */ 2003 goto out_decr; 2004 case SCTP_TIMER_TYPE_AUTOCLOSE: 2005 KASSERT(inp != NULL && stcb != NULL && net == NULL, 2006 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2007 type, inp, stcb, net)); 2008 SCTP_STAT_INCR(sctps_timoautoclose); 2009 sctp_autoclose_timer(inp, stcb); 2010 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED); 2011 did_output = true; 2012 break; 2013 case SCTP_TIMER_TYPE_STRRESET: 2014 KASSERT(inp != NULL && stcb != NULL && net == NULL, 2015 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2016 type, inp, stcb, net)); 2017 SCTP_STAT_INCR(sctps_timostrmrst); 2018 if (sctp_strreset_timer(inp, stcb)) { 2019 /* no need to unlock on tcb its gone */ 2020 goto out_decr; 2021 } 2022 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED); 2023 did_output = true; 2024 break; 2025 case SCTP_TIMER_TYPE_INPKILL: 2026 KASSERT(inp != NULL && stcb == NULL && net == NULL, 2027 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2028 type, inp, stcb, net)); 2029 SCTP_STAT_INCR(sctps_timoinpkill); 2030 /* 2031 * special case, take away our increment since WE are the 2032 * killer 2033 */ 2034 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL, 2035 SCTP_FROM_SCTPUTIL + SCTP_LOC_3); 2036 SCTP_INP_DECR_REF(inp); 2037 SCTP_INP_WUNLOCK(inp); 2038 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT, 2039 SCTP_CALLED_FROM_INPKILL_TIMER); 2040 inp = NULL; 2041 goto out_decr; 2042 case SCTP_TIMER_TYPE_ASOCKILL: 2043 KASSERT(inp != NULL && stcb != NULL && net == NULL, 2044 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2045 type, inp, stcb, net)); 2046 SCTP_STAT_INCR(sctps_timoassockill); 2047 /* Can we free it yet? */ 2048 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, 2049 SCTP_FROM_SCTPUTIL + SCTP_LOC_1); 2050 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 2051 SCTP_FROM_SCTPUTIL + SCTP_LOC_2); 2052 /* 2053 * free asoc, always unlocks (or destroy's) so prevent 2054 * duplicate unlock or unlock of a free mtx :-0 2055 */ 2056 stcb = NULL; 2057 goto out_decr; 2058 case SCTP_TIMER_TYPE_ADDR_WQ: 2059 KASSERT(inp == NULL && stcb == NULL && net == NULL, 2060 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2061 type, inp, stcb, net)); 2062 sctp_handle_addr_wq(); 2063 did_output = true; 2064 break; 2065 case SCTP_TIMER_TYPE_PRIM_DELETED: 2066 KASSERT(inp != NULL && stcb != NULL && net == NULL, 2067 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2068 type, inp, stcb, net)); 2069 SCTP_STAT_INCR(sctps_timodelprim); 2070 sctp_delete_prim_timer(inp, stcb); 2071 did_output = false; 2072 break; 2073 default: 2074 #ifdef INVARIANTS 2075 panic("Unknown timer type %d", type); 2076 #else 2077 goto out; 2078 #endif 2079 } 2080 #ifdef SCTP_AUDITING_ENABLED 2081 sctp_audit_log(0xF1, (uint8_t)type); 2082 if (inp != NULL) 2083 sctp_auditing(5, inp, stcb, net); 2084 #endif 2085 if (did_output && (stcb != NULL)) { 2086 /* 2087 * Now we need to clean up the control chunk chain if an 2088 * ECNE is on it. It must be marked as UNSENT again so next 2089 * call will continue to send it until such time that we get 2090 * a CWR, to remove it. It is, however, less likely that we 2091 * will find a ecn echo on the chain though. 2092 */ 2093 sctp_fix_ecn_echo(&stcb->asoc); 2094 } 2095 out: 2096 if (stcb != NULL) { 2097 SCTP_TCB_UNLOCK(stcb); 2098 } else if (inp != NULL) { 2099 SCTP_INP_WUNLOCK(inp); 2100 } else { 2101 SCTP_WQ_ADDR_UNLOCK(); 2102 } 2103 2104 out_decr: 2105 /* These reference counts were incremented in sctp_timer_start(). */ 2106 if (inp != NULL) { 2107 SCTP_INP_DECR_REF(inp); 2108 } 2109 if ((stcb != NULL) && !released_asoc_reference) { 2110 atomic_add_int(&stcb->asoc.refcnt, -1); 2111 } 2112 if (net != NULL) { 2113 sctp_free_remote_addr(net); 2114 } 2115 SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d handler finished.\n", type); 2116 CURVNET_RESTORE(); 2117 NET_EPOCH_EXIT(et); 2118 } 2119 2120 /*- 2121 * The following table shows which parameters must be provided 2122 * when calling sctp_timer_start(). For parameters not being 2123 * provided, NULL must be used. 2124 * 2125 * |Name |inp |stcb|net | 2126 * |-----------------------------|----|----|----| 2127 * |SCTP_TIMER_TYPE_SEND |Yes |Yes |Yes | 2128 * |SCTP_TIMER_TYPE_INIT |Yes |Yes |Yes | 2129 * |SCTP_TIMER_TYPE_RECV |Yes |Yes |No | 2130 * |SCTP_TIMER_TYPE_SHUTDOWN |Yes |Yes |Yes | 2131 * |SCTP_TIMER_TYPE_HEARTBEAT |Yes |Yes |Yes | 2132 * |SCTP_TIMER_TYPE_COOKIE |Yes |Yes |Yes | 2133 * |SCTP_TIMER_TYPE_NEWCOOKIE |Yes |No |No | 2134 * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes | 2135 * |SCTP_TIMER_TYPE_SHUTDOWNACK |Yes |Yes |Yes | 2136 * |SCTP_TIMER_TYPE_ASCONF |Yes |Yes |Yes | 2137 * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No | 2138 * |SCTP_TIMER_TYPE_AUTOCLOSE |Yes |Yes |No | 2139 * |SCTP_TIMER_TYPE_STRRESET |Yes |Yes |Yes | 2140 * |SCTP_TIMER_TYPE_INPKILL |Yes |No |No | 2141 * |SCTP_TIMER_TYPE_ASOCKILL |Yes |Yes |No | 2142 * |SCTP_TIMER_TYPE_ADDR_WQ |No |No |No | 2143 * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No | 2144 * 2145 */ 2146 2147 void 2148 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2149 struct sctp_nets *net) 2150 { 2151 struct sctp_timer *tmr; 2152 uint32_t to_ticks; 2153 uint32_t rndval, jitter; 2154 2155 KASSERT(stcb == NULL || stcb->sctp_ep == inp, 2156 ("sctp_timer_start of type %d: inp = %p, stcb->sctp_ep %p", 2157 t_type, stcb, stcb->sctp_ep)); 2158 tmr = NULL; 2159 if (stcb != NULL) { 2160 SCTP_TCB_LOCK_ASSERT(stcb); 2161 } else if (inp != NULL) { 2162 SCTP_INP_WLOCK_ASSERT(inp); 2163 } else { 2164 SCTP_WQ_ADDR_LOCK_ASSERT(); 2165 } 2166 if (stcb != NULL) { 2167 /* 2168 * Don't restart timer on association that's about to be 2169 * killed. 2170 */ 2171 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) && 2172 (t_type != SCTP_TIMER_TYPE_ASOCKILL)) { 2173 SCTPDBG(SCTP_DEBUG_TIMER2, 2174 "Timer type %d not started: inp=%p, stcb=%p, net=%p (stcb deleted).\n", 2175 t_type, inp, stcb, net); 2176 return; 2177 } 2178 /* Don't restart timer on net that's been removed. */ 2179 if (net != NULL && (net->dest_state & SCTP_ADDR_BEING_DELETED)) { 2180 SCTPDBG(SCTP_DEBUG_TIMER2, 2181 "Timer type %d not started: inp=%p, stcb=%p, net=%p (net deleted).\n", 2182 t_type, inp, stcb, net); 2183 return; 2184 } 2185 } 2186 switch (t_type) { 2187 case SCTP_TIMER_TYPE_SEND: 2188 /* Here we use the RTO timer. */ 2189 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2190 #ifdef INVARIANTS 2191 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2192 t_type, inp, stcb, net); 2193 #else 2194 return; 2195 #endif 2196 } 2197 tmr = &net->rxt_timer; 2198 if (net->RTO == 0) { 2199 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2200 } else { 2201 to_ticks = sctp_msecs_to_ticks(net->RTO); 2202 } 2203 break; 2204 case SCTP_TIMER_TYPE_INIT: 2205 /* 2206 * Here we use the INIT timer default usually about 1 2207 * second. 2208 */ 2209 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2210 #ifdef INVARIANTS 2211 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2212 t_type, inp, stcb, net); 2213 #else 2214 return; 2215 #endif 2216 } 2217 tmr = &net->rxt_timer; 2218 if (net->RTO == 0) { 2219 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2220 } else { 2221 to_ticks = sctp_msecs_to_ticks(net->RTO); 2222 } 2223 break; 2224 case SCTP_TIMER_TYPE_RECV: 2225 /* 2226 * Here we use the Delayed-Ack timer value from the inp, 2227 * ususually about 200ms. 2228 */ 2229 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2230 #ifdef INVARIANTS 2231 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2232 t_type, inp, stcb, net); 2233 #else 2234 return; 2235 #endif 2236 } 2237 tmr = &stcb->asoc.dack_timer; 2238 to_ticks = sctp_msecs_to_ticks(stcb->asoc.delayed_ack); 2239 break; 2240 case SCTP_TIMER_TYPE_SHUTDOWN: 2241 /* Here we use the RTO of the destination. */ 2242 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2243 #ifdef INVARIANTS 2244 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2245 t_type, inp, stcb, net); 2246 #else 2247 return; 2248 #endif 2249 } 2250 tmr = &net->rxt_timer; 2251 if (net->RTO == 0) { 2252 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2253 } else { 2254 to_ticks = sctp_msecs_to_ticks(net->RTO); 2255 } 2256 break; 2257 case SCTP_TIMER_TYPE_HEARTBEAT: 2258 /* 2259 * The net is used here so that we can add in the RTO. Even 2260 * though we use a different timer. We also add the HB timer 2261 * PLUS a random jitter. 2262 */ 2263 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2264 #ifdef INVARIANTS 2265 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2266 t_type, inp, stcb, net); 2267 #else 2268 return; 2269 #endif 2270 } 2271 if ((net->dest_state & SCTP_ADDR_NOHB) && 2272 !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) { 2273 SCTPDBG(SCTP_DEBUG_TIMER2, 2274 "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n", 2275 t_type, inp, stcb, net); 2276 return; 2277 } 2278 tmr = &net->hb_timer; 2279 if (net->RTO == 0) { 2280 to_ticks = stcb->asoc.initial_rto; 2281 } else { 2282 to_ticks = net->RTO; 2283 } 2284 rndval = sctp_select_initial_TSN(&inp->sctp_ep); 2285 jitter = rndval % to_ticks; 2286 if (to_ticks > 1) { 2287 to_ticks >>= 1; 2288 } 2289 if (jitter < (UINT32_MAX - to_ticks)) { 2290 to_ticks += jitter; 2291 } else { 2292 to_ticks = UINT32_MAX; 2293 } 2294 if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) && 2295 !(net->dest_state & SCTP_ADDR_PF)) { 2296 if (net->heart_beat_delay < (UINT32_MAX - to_ticks)) { 2297 to_ticks += net->heart_beat_delay; 2298 } else { 2299 to_ticks = UINT32_MAX; 2300 } 2301 } 2302 /* 2303 * Now we must convert the to_ticks that are now in ms to 2304 * ticks. 2305 */ 2306 to_ticks = sctp_msecs_to_ticks(to_ticks); 2307 break; 2308 case SCTP_TIMER_TYPE_COOKIE: 2309 /* 2310 * Here we can use the RTO timer from the network since one 2311 * RTT was complete. If a retransmission happened then we 2312 * will be using the RTO initial value. 2313 */ 2314 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2315 #ifdef INVARIANTS 2316 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2317 t_type, inp, stcb, net); 2318 #else 2319 return; 2320 #endif 2321 } 2322 tmr = &net->rxt_timer; 2323 if (net->RTO == 0) { 2324 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2325 } else { 2326 to_ticks = sctp_msecs_to_ticks(net->RTO); 2327 } 2328 break; 2329 case SCTP_TIMER_TYPE_NEWCOOKIE: 2330 /* 2331 * Nothing needed but the endpoint here ususually about 60 2332 * minutes. 2333 */ 2334 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) { 2335 #ifdef INVARIANTS 2336 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2337 t_type, inp, stcb, net); 2338 #else 2339 return; 2340 #endif 2341 } 2342 tmr = &inp->sctp_ep.signature_change; 2343 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE]; 2344 break; 2345 case SCTP_TIMER_TYPE_PATHMTURAISE: 2346 /* 2347 * Here we use the value found in the EP for PMTUD, 2348 * ususually about 10 minutes. 2349 */ 2350 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2351 #ifdef INVARIANTS 2352 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2353 t_type, inp, stcb, net); 2354 #else 2355 return; 2356 #endif 2357 } 2358 if (net->dest_state & SCTP_ADDR_NO_PMTUD) { 2359 SCTPDBG(SCTP_DEBUG_TIMER2, 2360 "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n", 2361 t_type, inp, stcb, net); 2362 return; 2363 } 2364 tmr = &net->pmtu_timer; 2365 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU]; 2366 break; 2367 case SCTP_TIMER_TYPE_SHUTDOWNACK: 2368 /* Here we use the RTO of the destination. */ 2369 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2370 #ifdef INVARIANTS 2371 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2372 t_type, inp, stcb, net); 2373 #else 2374 return; 2375 #endif 2376 } 2377 tmr = &net->rxt_timer; 2378 if (net->RTO == 0) { 2379 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2380 } else { 2381 to_ticks = sctp_msecs_to_ticks(net->RTO); 2382 } 2383 break; 2384 case SCTP_TIMER_TYPE_ASCONF: 2385 /* 2386 * Here the timer comes from the stcb but its value is from 2387 * the net's RTO. 2388 */ 2389 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2390 #ifdef INVARIANTS 2391 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2392 t_type, inp, stcb, net); 2393 #else 2394 return; 2395 #endif 2396 } 2397 tmr = &stcb->asoc.asconf_timer; 2398 if (net->RTO == 0) { 2399 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2400 } else { 2401 to_ticks = sctp_msecs_to_ticks(net->RTO); 2402 } 2403 break; 2404 case SCTP_TIMER_TYPE_SHUTDOWNGUARD: 2405 /* 2406 * Here we use the endpoints shutdown guard timer usually 2407 * about 3 minutes. 2408 */ 2409 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2410 #ifdef INVARIANTS 2411 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2412 t_type, inp, stcb, net); 2413 #else 2414 return; 2415 #endif 2416 } 2417 tmr = &stcb->asoc.shut_guard_timer; 2418 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) { 2419 if (stcb->asoc.maxrto < UINT32_MAX / 5) { 2420 to_ticks = sctp_msecs_to_ticks(5 * stcb->asoc.maxrto); 2421 } else { 2422 to_ticks = sctp_msecs_to_ticks(UINT32_MAX); 2423 } 2424 } else { 2425 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN]; 2426 } 2427 break; 2428 case SCTP_TIMER_TYPE_AUTOCLOSE: 2429 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2430 #ifdef INVARIANTS 2431 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2432 t_type, inp, stcb, net); 2433 #else 2434 return; 2435 #endif 2436 } 2437 tmr = &stcb->asoc.autoclose_timer; 2438 to_ticks = stcb->asoc.sctp_autoclose_ticks; 2439 break; 2440 case SCTP_TIMER_TYPE_STRRESET: 2441 /* 2442 * Here the timer comes from the stcb but its value is from 2443 * the net's RTO. 2444 */ 2445 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2446 #ifdef INVARIANTS 2447 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2448 t_type, inp, stcb, net); 2449 #else 2450 return; 2451 #endif 2452 } 2453 tmr = &stcb->asoc.strreset_timer; 2454 if (net->RTO == 0) { 2455 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2456 } else { 2457 to_ticks = sctp_msecs_to_ticks(net->RTO); 2458 } 2459 break; 2460 case SCTP_TIMER_TYPE_INPKILL: 2461 /* 2462 * The inp is setup to die. We re-use the signature_chage 2463 * timer since that has stopped and we are in the GONE 2464 * state. 2465 */ 2466 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) { 2467 #ifdef INVARIANTS 2468 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2469 t_type, inp, stcb, net); 2470 #else 2471 return; 2472 #endif 2473 } 2474 tmr = &inp->sctp_ep.signature_change; 2475 to_ticks = sctp_msecs_to_ticks(SCTP_INP_KILL_TIMEOUT); 2476 break; 2477 case SCTP_TIMER_TYPE_ASOCKILL: 2478 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2479 #ifdef INVARIANTS 2480 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2481 t_type, inp, stcb, net); 2482 #else 2483 return; 2484 #endif 2485 } 2486 tmr = &stcb->asoc.strreset_timer; 2487 to_ticks = sctp_msecs_to_ticks(SCTP_ASOC_KILL_TIMEOUT); 2488 break; 2489 case SCTP_TIMER_TYPE_ADDR_WQ: 2490 if ((inp != NULL) || (stcb != NULL) || (net != NULL)) { 2491 #ifdef INVARIANTS 2492 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2493 t_type, inp, stcb, net); 2494 #else 2495 return; 2496 #endif 2497 } 2498 /* Only 1 tick away :-) */ 2499 tmr = &SCTP_BASE_INFO(addr_wq_timer); 2500 to_ticks = SCTP_ADDRESS_TICK_DELAY; 2501 break; 2502 case SCTP_TIMER_TYPE_PRIM_DELETED: 2503 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2504 #ifdef INVARIANTS 2505 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2506 t_type, inp, stcb, net); 2507 #else 2508 return; 2509 #endif 2510 } 2511 tmr = &stcb->asoc.delete_prim_timer; 2512 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2513 break; 2514 default: 2515 #ifdef INVARIANTS 2516 panic("Unknown timer type %d", t_type); 2517 #else 2518 return; 2519 #endif 2520 } 2521 KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type)); 2522 KASSERT(to_ticks > 0, ("to_ticks == 0 for timer type %d", t_type)); 2523 if (SCTP_OS_TIMER_PENDING(&tmr->timer)) { 2524 /* 2525 * We do NOT allow you to have it already running. If it is, 2526 * we leave the current one up unchanged. 2527 */ 2528 SCTPDBG(SCTP_DEBUG_TIMER2, 2529 "Timer type %d already running: inp=%p, stcb=%p, net=%p.\n", 2530 t_type, inp, stcb, net); 2531 return; 2532 } 2533 /* At this point we can proceed. */ 2534 if (t_type == SCTP_TIMER_TYPE_SEND) { 2535 stcb->asoc.num_send_timers_up++; 2536 } 2537 tmr->stopped_from = 0; 2538 tmr->type = t_type; 2539 tmr->ep = (void *)inp; 2540 tmr->tcb = (void *)stcb; 2541 if (t_type == SCTP_TIMER_TYPE_STRRESET) { 2542 tmr->net = NULL; 2543 } else { 2544 tmr->net = (void *)net; 2545 } 2546 tmr->self = (void *)tmr; 2547 tmr->vnet = (void *)curvnet; 2548 tmr->ticks = sctp_get_tick_count(); 2549 if (SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr) == 0) { 2550 SCTPDBG(SCTP_DEBUG_TIMER2, 2551 "Timer type %d started: ticks=%u, inp=%p, stcb=%p, net=%p.\n", 2552 t_type, to_ticks, inp, stcb, net); 2553 /* 2554 * If this is a newly scheduled callout, as opposed to a 2555 * rescheduled one, increment relevant reference counts. 2556 */ 2557 if (tmr->ep != NULL) { 2558 SCTP_INP_INCR_REF(inp); 2559 } 2560 if (tmr->tcb != NULL) { 2561 atomic_add_int(&stcb->asoc.refcnt, 1); 2562 } 2563 if (tmr->net != NULL) { 2564 atomic_add_int(&net->ref_count, 1); 2565 } 2566 } else { 2567 /* 2568 * This should not happen, since we checked for pending 2569 * above. 2570 */ 2571 SCTPDBG(SCTP_DEBUG_TIMER2, 2572 "Timer type %d restarted: ticks=%u, inp=%p, stcb=%p, net=%p.\n", 2573 t_type, to_ticks, inp, stcb, net); 2574 } 2575 return; 2576 } 2577 2578 /*- 2579 * The following table shows which parameters must be provided 2580 * when calling sctp_timer_stop(). For parameters not being 2581 * provided, NULL must be used. 2582 * 2583 * |Name |inp |stcb|net | 2584 * |-----------------------------|----|----|----| 2585 * |SCTP_TIMER_TYPE_SEND |Yes |Yes |Yes | 2586 * |SCTP_TIMER_TYPE_INIT |Yes |Yes |Yes | 2587 * |SCTP_TIMER_TYPE_RECV |Yes |Yes |No | 2588 * |SCTP_TIMER_TYPE_SHUTDOWN |Yes |Yes |Yes | 2589 * |SCTP_TIMER_TYPE_HEARTBEAT |Yes |Yes |Yes | 2590 * |SCTP_TIMER_TYPE_COOKIE |Yes |Yes |Yes | 2591 * |SCTP_TIMER_TYPE_NEWCOOKIE |Yes |No |No | 2592 * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes | 2593 * |SCTP_TIMER_TYPE_SHUTDOWNACK |Yes |Yes |Yes | 2594 * |SCTP_TIMER_TYPE_ASCONF |Yes |Yes |No | 2595 * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No | 2596 * |SCTP_TIMER_TYPE_AUTOCLOSE |Yes |Yes |No | 2597 * |SCTP_TIMER_TYPE_STRRESET |Yes |Yes |No | 2598 * |SCTP_TIMER_TYPE_INPKILL |Yes |No |No | 2599 * |SCTP_TIMER_TYPE_ASOCKILL |Yes |Yes |No | 2600 * |SCTP_TIMER_TYPE_ADDR_WQ |No |No |No | 2601 * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No | 2602 * 2603 */ 2604 2605 void 2606 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2607 struct sctp_nets *net, uint32_t from) 2608 { 2609 struct sctp_timer *tmr; 2610 2611 KASSERT(stcb == NULL || stcb->sctp_ep == inp, 2612 ("sctp_timer_stop of type %d: inp = %p, stcb->sctp_ep %p", 2613 t_type, stcb, stcb->sctp_ep)); 2614 if (stcb != NULL) { 2615 SCTP_TCB_LOCK_ASSERT(stcb); 2616 } else if (inp != NULL) { 2617 SCTP_INP_WLOCK_ASSERT(inp); 2618 } else { 2619 SCTP_WQ_ADDR_LOCK_ASSERT(); 2620 } 2621 tmr = NULL; 2622 switch (t_type) { 2623 case SCTP_TIMER_TYPE_SEND: 2624 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2625 #ifdef INVARIANTS 2626 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2627 t_type, inp, stcb, net); 2628 #else 2629 return; 2630 #endif 2631 } 2632 tmr = &net->rxt_timer; 2633 break; 2634 case SCTP_TIMER_TYPE_INIT: 2635 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2636 #ifdef INVARIANTS 2637 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2638 t_type, inp, stcb, net); 2639 #else 2640 return; 2641 #endif 2642 } 2643 tmr = &net->rxt_timer; 2644 break; 2645 case SCTP_TIMER_TYPE_RECV: 2646 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2647 #ifdef INVARIANTS 2648 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2649 t_type, inp, stcb, net); 2650 #else 2651 return; 2652 #endif 2653 } 2654 tmr = &stcb->asoc.dack_timer; 2655 break; 2656 case SCTP_TIMER_TYPE_SHUTDOWN: 2657 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2658 #ifdef INVARIANTS 2659 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2660 t_type, inp, stcb, net); 2661 #else 2662 return; 2663 #endif 2664 } 2665 tmr = &net->rxt_timer; 2666 break; 2667 case SCTP_TIMER_TYPE_HEARTBEAT: 2668 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2669 #ifdef INVARIANTS 2670 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2671 t_type, inp, stcb, net); 2672 #else 2673 return; 2674 #endif 2675 } 2676 tmr = &net->hb_timer; 2677 break; 2678 case SCTP_TIMER_TYPE_COOKIE: 2679 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2680 #ifdef INVARIANTS 2681 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2682 t_type, inp, stcb, net); 2683 #else 2684 return; 2685 #endif 2686 } 2687 tmr = &net->rxt_timer; 2688 break; 2689 case SCTP_TIMER_TYPE_NEWCOOKIE: 2690 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) { 2691 #ifdef INVARIANTS 2692 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2693 t_type, inp, stcb, net); 2694 #else 2695 return; 2696 #endif 2697 } 2698 tmr = &inp->sctp_ep.signature_change; 2699 break; 2700 case SCTP_TIMER_TYPE_PATHMTURAISE: 2701 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2702 #ifdef INVARIANTS 2703 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2704 t_type, inp, stcb, net); 2705 #else 2706 return; 2707 #endif 2708 } 2709 tmr = &net->pmtu_timer; 2710 break; 2711 case SCTP_TIMER_TYPE_SHUTDOWNACK: 2712 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2713 #ifdef INVARIANTS 2714 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2715 t_type, inp, stcb, net); 2716 #else 2717 return; 2718 #endif 2719 } 2720 tmr = &net->rxt_timer; 2721 break; 2722 case SCTP_TIMER_TYPE_ASCONF: 2723 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2724 #ifdef INVARIANTS 2725 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2726 t_type, inp, stcb, net); 2727 #else 2728 return; 2729 #endif 2730 } 2731 tmr = &stcb->asoc.asconf_timer; 2732 break; 2733 case SCTP_TIMER_TYPE_SHUTDOWNGUARD: 2734 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2735 #ifdef INVARIANTS 2736 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2737 t_type, inp, stcb, net); 2738 #else 2739 return; 2740 #endif 2741 } 2742 tmr = &stcb->asoc.shut_guard_timer; 2743 break; 2744 case SCTP_TIMER_TYPE_AUTOCLOSE: 2745 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2746 #ifdef INVARIANTS 2747 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2748 t_type, inp, stcb, net); 2749 #else 2750 return; 2751 #endif 2752 } 2753 tmr = &stcb->asoc.autoclose_timer; 2754 break; 2755 case SCTP_TIMER_TYPE_STRRESET: 2756 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2757 #ifdef INVARIANTS 2758 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2759 t_type, inp, stcb, net); 2760 #else 2761 return; 2762 #endif 2763 } 2764 tmr = &stcb->asoc.strreset_timer; 2765 break; 2766 case SCTP_TIMER_TYPE_INPKILL: 2767 /* 2768 * The inp is setup to die. We re-use the signature_chage 2769 * timer since that has stopped and we are in the GONE 2770 * state. 2771 */ 2772 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) { 2773 #ifdef INVARIANTS 2774 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2775 t_type, inp, stcb, net); 2776 #else 2777 return; 2778 #endif 2779 } 2780 tmr = &inp->sctp_ep.signature_change; 2781 break; 2782 case SCTP_TIMER_TYPE_ASOCKILL: 2783 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2784 #ifdef INVARIANTS 2785 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2786 t_type, inp, stcb, net); 2787 #else 2788 return; 2789 #endif 2790 } 2791 tmr = &stcb->asoc.strreset_timer; 2792 break; 2793 case SCTP_TIMER_TYPE_ADDR_WQ: 2794 if ((inp != NULL) || (stcb != NULL) || (net != NULL)) { 2795 #ifdef INVARIANTS 2796 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2797 t_type, inp, stcb, net); 2798 #else 2799 return; 2800 #endif 2801 } 2802 tmr = &SCTP_BASE_INFO(addr_wq_timer); 2803 break; 2804 case SCTP_TIMER_TYPE_PRIM_DELETED: 2805 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2806 #ifdef INVARIANTS 2807 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2808 t_type, inp, stcb, net); 2809 #else 2810 return; 2811 #endif 2812 } 2813 tmr = &stcb->asoc.delete_prim_timer; 2814 break; 2815 default: 2816 #ifdef INVARIANTS 2817 panic("Unknown timer type %d", t_type); 2818 #else 2819 return; 2820 #endif 2821 } 2822 KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type)); 2823 if ((tmr->type != SCTP_TIMER_TYPE_NONE) && 2824 (tmr->type != t_type)) { 2825 /* 2826 * Ok we have a timer that is under joint use. Cookie timer 2827 * per chance with the SEND timer. We therefore are NOT 2828 * running the timer that the caller wants stopped. So just 2829 * return. 2830 */ 2831 SCTPDBG(SCTP_DEBUG_TIMER2, 2832 "Shared timer type %d not running: inp=%p, stcb=%p, net=%p.\n", 2833 t_type, inp, stcb, net); 2834 return; 2835 } 2836 if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) { 2837 stcb->asoc.num_send_timers_up--; 2838 if (stcb->asoc.num_send_timers_up < 0) { 2839 stcb->asoc.num_send_timers_up = 0; 2840 } 2841 } 2842 tmr->self = NULL; 2843 tmr->stopped_from = from; 2844 if (SCTP_OS_TIMER_STOP(&tmr->timer) == 1) { 2845 KASSERT(tmr->ep == inp, 2846 ("sctp_timer_stop of type %d: inp = %p, tmr->inp = %p", 2847 t_type, inp, tmr->ep)); 2848 KASSERT(tmr->tcb == stcb, 2849 ("sctp_timer_stop of type %d: stcb = %p, tmr->stcb = %p", 2850 t_type, stcb, tmr->tcb)); 2851 KASSERT(((t_type == SCTP_TIMER_TYPE_ASCONF) && (tmr->net != NULL)) || 2852 ((t_type != SCTP_TIMER_TYPE_ASCONF) && (tmr->net == net)), 2853 ("sctp_timer_stop of type %d: net = %p, tmr->net = %p", 2854 t_type, net, tmr->net)); 2855 SCTPDBG(SCTP_DEBUG_TIMER2, 2856 "Timer type %d stopped: inp=%p, stcb=%p, net=%p.\n", 2857 t_type, inp, stcb, net); 2858 /* 2859 * If the timer was actually stopped, decrement reference 2860 * counts that were incremented in sctp_timer_start(). 2861 */ 2862 if (tmr->ep != NULL) { 2863 SCTP_INP_DECR_REF(inp); 2864 tmr->ep = NULL; 2865 } 2866 if (tmr->tcb != NULL) { 2867 atomic_add_int(&stcb->asoc.refcnt, -1); 2868 tmr->tcb = NULL; 2869 } 2870 if (tmr->net != NULL) { 2871 /* 2872 * Can't use net, since it doesn't work for 2873 * SCTP_TIMER_TYPE_ASCONF. 2874 */ 2875 sctp_free_remote_addr((struct sctp_nets *)tmr->net); 2876 tmr->net = NULL; 2877 } 2878 } else { 2879 SCTPDBG(SCTP_DEBUG_TIMER2, 2880 "Timer type %d not stopped: inp=%p, stcb=%p, net=%p.\n", 2881 t_type, inp, stcb, net); 2882 } 2883 return; 2884 } 2885 2886 uint32_t 2887 sctp_calculate_len(struct mbuf *m) 2888 { 2889 uint32_t tlen = 0; 2890 struct mbuf *at; 2891 2892 at = m; 2893 while (at) { 2894 tlen += SCTP_BUF_LEN(at); 2895 at = SCTP_BUF_NEXT(at); 2896 } 2897 return (tlen); 2898 } 2899 2900 void 2901 sctp_mtu_size_reset(struct sctp_inpcb *inp, 2902 struct sctp_association *asoc, uint32_t mtu) 2903 { 2904 /* 2905 * Reset the P-MTU size on this association, this involves changing 2906 * the asoc MTU, going through ANY chunk+overhead larger than mtu to 2907 * allow the DF flag to be cleared. 2908 */ 2909 struct sctp_tmit_chunk *chk; 2910 unsigned int eff_mtu, ovh; 2911 2912 asoc->smallest_mtu = mtu; 2913 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 2914 ovh = SCTP_MIN_OVERHEAD; 2915 } else { 2916 ovh = SCTP_MIN_V4_OVERHEAD; 2917 } 2918 eff_mtu = mtu - ovh; 2919 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 2920 if (chk->send_size > eff_mtu) { 2921 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 2922 } 2923 } 2924 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 2925 if (chk->send_size > eff_mtu) { 2926 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 2927 } 2928 } 2929 } 2930 2931 /* 2932 * Given an association and starting time of the current RTT period, update 2933 * RTO in number of msecs. net should point to the current network. 2934 * Return 1, if an RTO update was performed, return 0 if no update was 2935 * performed due to invalid starting point. 2936 */ 2937 2938 int 2939 sctp_calculate_rto(struct sctp_tcb *stcb, 2940 struct sctp_association *asoc, 2941 struct sctp_nets *net, 2942 struct timeval *old, 2943 int rtt_from_sack) 2944 { 2945 struct timeval now; 2946 uint64_t rtt_us; /* RTT in us */ 2947 int32_t rtt; /* RTT in ms */ 2948 uint32_t new_rto; 2949 int first_measure = 0; 2950 2951 /************************/ 2952 /* 1. calculate new RTT */ 2953 /************************/ 2954 /* get the current time */ 2955 if (stcb->asoc.use_precise_time) { 2956 (void)SCTP_GETPTIME_TIMEVAL(&now); 2957 } else { 2958 (void)SCTP_GETTIME_TIMEVAL(&now); 2959 } 2960 if ((old->tv_sec > now.tv_sec) || 2961 ((old->tv_sec == now.tv_sec) && (old->tv_usec > now.tv_usec))) { 2962 /* The starting point is in the future. */ 2963 return (0); 2964 } 2965 timevalsub(&now, old); 2966 rtt_us = (uint64_t)1000000 * (uint64_t)now.tv_sec + (uint64_t)now.tv_usec; 2967 if (rtt_us > SCTP_RTO_UPPER_BOUND * 1000) { 2968 /* The RTT is larger than a sane value. */ 2969 return (0); 2970 } 2971 /* store the current RTT in us */ 2972 net->rtt = rtt_us; 2973 /* compute rtt in ms */ 2974 rtt = (int32_t)(net->rtt / 1000); 2975 if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) { 2976 /* 2977 * Tell the CC module that a new update has just occurred 2978 * from a sack 2979 */ 2980 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now); 2981 } 2982 /* 2983 * Do we need to determine the lan? We do this only on sacks i.e. 2984 * RTT being determined from data not non-data (HB/INIT->INITACK). 2985 */ 2986 if ((rtt_from_sack == SCTP_RTT_FROM_DATA) && 2987 (net->lan_type == SCTP_LAN_UNKNOWN)) { 2988 if (net->rtt > SCTP_LOCAL_LAN_RTT) { 2989 net->lan_type = SCTP_LAN_INTERNET; 2990 } else { 2991 net->lan_type = SCTP_LAN_LOCAL; 2992 } 2993 } 2994 2995 /***************************/ 2996 /* 2. update RTTVAR & SRTT */ 2997 /***************************/ 2998 /*- 2999 * Compute the scaled average lastsa and the 3000 * scaled variance lastsv as described in van Jacobson 3001 * Paper "Congestion Avoidance and Control", Annex A. 3002 * 3003 * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt 3004 * (net->lastsv >> SCTP_RTT_VAR_SHIFT) is the rttvar 3005 */ 3006 if (net->RTO_measured) { 3007 rtt -= (net->lastsa >> SCTP_RTT_SHIFT); 3008 net->lastsa += rtt; 3009 if (rtt < 0) { 3010 rtt = -rtt; 3011 } 3012 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT); 3013 net->lastsv += rtt; 3014 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) { 3015 rto_logging(net, SCTP_LOG_RTTVAR); 3016 } 3017 } else { 3018 /* First RTO measurment */ 3019 net->RTO_measured = 1; 3020 first_measure = 1; 3021 net->lastsa = rtt << SCTP_RTT_SHIFT; 3022 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT; 3023 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) { 3024 rto_logging(net, SCTP_LOG_INITIAL_RTT); 3025 } 3026 } 3027 if (net->lastsv == 0) { 3028 net->lastsv = SCTP_CLOCK_GRANULARITY; 3029 } 3030 new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv; 3031 if ((new_rto > SCTP_SAT_NETWORK_MIN) && 3032 (stcb->asoc.sat_network_lockout == 0)) { 3033 stcb->asoc.sat_network = 1; 3034 } else if ((!first_measure) && stcb->asoc.sat_network) { 3035 stcb->asoc.sat_network = 0; 3036 stcb->asoc.sat_network_lockout = 1; 3037 } 3038 /* bound it, per C6/C7 in Section 5.3.1 */ 3039 if (new_rto < stcb->asoc.minrto) { 3040 new_rto = stcb->asoc.minrto; 3041 } 3042 if (new_rto > stcb->asoc.maxrto) { 3043 new_rto = stcb->asoc.maxrto; 3044 } 3045 net->RTO = new_rto; 3046 return (1); 3047 } 3048 3049 /* 3050 * return a pointer to a contiguous piece of data from the given mbuf chain 3051 * starting at 'off' for 'len' bytes. If the desired piece spans more than 3052 * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size 3053 * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain. 3054 */ 3055 caddr_t 3056 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr) 3057 { 3058 uint32_t count; 3059 uint8_t *ptr; 3060 3061 ptr = in_ptr; 3062 if ((off < 0) || (len <= 0)) 3063 return (NULL); 3064 3065 /* find the desired start location */ 3066 while ((m != NULL) && (off > 0)) { 3067 if (off < SCTP_BUF_LEN(m)) 3068 break; 3069 off -= SCTP_BUF_LEN(m); 3070 m = SCTP_BUF_NEXT(m); 3071 } 3072 if (m == NULL) 3073 return (NULL); 3074 3075 /* is the current mbuf large enough (eg. contiguous)? */ 3076 if ((SCTP_BUF_LEN(m) - off) >= len) { 3077 return (mtod(m, caddr_t)+off); 3078 } else { 3079 /* else, it spans more than one mbuf, so save a temp copy... */ 3080 while ((m != NULL) && (len > 0)) { 3081 count = min(SCTP_BUF_LEN(m) - off, len); 3082 memcpy(ptr, mtod(m, caddr_t)+off, count); 3083 len -= count; 3084 ptr += count; 3085 off = 0; 3086 m = SCTP_BUF_NEXT(m); 3087 } 3088 if ((m == NULL) && (len > 0)) 3089 return (NULL); 3090 else 3091 return ((caddr_t)in_ptr); 3092 } 3093 } 3094 3095 struct sctp_paramhdr * 3096 sctp_get_next_param(struct mbuf *m, 3097 int offset, 3098 struct sctp_paramhdr *pull, 3099 int pull_limit) 3100 { 3101 /* This just provides a typed signature to Peter's Pull routine */ 3102 return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit, 3103 (uint8_t *)pull)); 3104 } 3105 3106 struct mbuf * 3107 sctp_add_pad_tombuf(struct mbuf *m, int padlen) 3108 { 3109 struct mbuf *m_last; 3110 caddr_t dp; 3111 3112 if (padlen > 3) { 3113 return (NULL); 3114 } 3115 if (padlen <= M_TRAILINGSPACE(m)) { 3116 /* 3117 * The easy way. We hope the majority of the time we hit 3118 * here :) 3119 */ 3120 m_last = m; 3121 } else { 3122 /* Hard way we must grow the mbuf chain */ 3123 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA); 3124 if (m_last == NULL) { 3125 return (NULL); 3126 } 3127 SCTP_BUF_LEN(m_last) = 0; 3128 SCTP_BUF_NEXT(m_last) = NULL; 3129 SCTP_BUF_NEXT(m) = m_last; 3130 } 3131 dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last); 3132 SCTP_BUF_LEN(m_last) += padlen; 3133 memset(dp, 0, padlen); 3134 return (m_last); 3135 } 3136 3137 struct mbuf * 3138 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf) 3139 { 3140 /* find the last mbuf in chain and pad it */ 3141 struct mbuf *m_at; 3142 3143 if (last_mbuf != NULL) { 3144 return (sctp_add_pad_tombuf(last_mbuf, padval)); 3145 } else { 3146 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3147 if (SCTP_BUF_NEXT(m_at) == NULL) { 3148 return (sctp_add_pad_tombuf(m_at, padval)); 3149 } 3150 } 3151 } 3152 return (NULL); 3153 } 3154 3155 static void 3156 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb, 3157 uint16_t error, struct sctp_abort_chunk *abort, 3158 bool from_peer, bool timedout, int so_locked) 3159 { 3160 struct mbuf *m_notify; 3161 struct sctp_assoc_change *sac; 3162 struct sctp_queued_to_read *control; 3163 unsigned int notif_len; 3164 uint16_t abort_len; 3165 unsigned int i; 3166 3167 KASSERT(abort == NULL || from_peer, 3168 ("sctp_notify_assoc_change: ABORT chunk provided for local termination")); 3169 KASSERT(!from_peer || !timedout, 3170 ("sctp_notify_assoc_change: timeouts can only be local")); 3171 if (stcb == NULL) { 3172 return; 3173 } 3174 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) { 3175 notif_len = (unsigned int)sizeof(struct sctp_assoc_change); 3176 if (abort != NULL) { 3177 abort_len = ntohs(abort->ch.chunk_length); 3178 /* 3179 * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be 3180 * contiguous. 3181 */ 3182 if (abort_len > SCTP_CHUNK_BUFFER_SIZE) { 3183 abort_len = SCTP_CHUNK_BUFFER_SIZE; 3184 } 3185 } else { 3186 abort_len = 0; 3187 } 3188 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) { 3189 notif_len += SCTP_ASSOC_SUPPORTS_MAX; 3190 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) { 3191 notif_len += abort_len; 3192 } 3193 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA); 3194 if (m_notify == NULL) { 3195 /* Retry with smaller value. */ 3196 notif_len = (unsigned int)sizeof(struct sctp_assoc_change); 3197 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA); 3198 if (m_notify == NULL) { 3199 goto set_error; 3200 } 3201 } 3202 SCTP_BUF_NEXT(m_notify) = NULL; 3203 sac = mtod(m_notify, struct sctp_assoc_change *); 3204 memset(sac, 0, notif_len); 3205 sac->sac_type = SCTP_ASSOC_CHANGE; 3206 sac->sac_flags = 0; 3207 sac->sac_length = sizeof(struct sctp_assoc_change); 3208 sac->sac_state = state; 3209 sac->sac_error = error; 3210 if (state == SCTP_CANT_STR_ASSOC) { 3211 sac->sac_outbound_streams = 0; 3212 sac->sac_inbound_streams = 0; 3213 } else { 3214 sac->sac_outbound_streams = stcb->asoc.streamoutcnt; 3215 sac->sac_inbound_streams = stcb->asoc.streamincnt; 3216 } 3217 sac->sac_assoc_id = sctp_get_associd(stcb); 3218 if (notif_len > sizeof(struct sctp_assoc_change)) { 3219 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) { 3220 i = 0; 3221 if (stcb->asoc.prsctp_supported == 1) { 3222 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR; 3223 } 3224 if (stcb->asoc.auth_supported == 1) { 3225 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH; 3226 } 3227 if (stcb->asoc.asconf_supported == 1) { 3228 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF; 3229 } 3230 if (stcb->asoc.idata_supported == 1) { 3231 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING; 3232 } 3233 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF; 3234 if (stcb->asoc.reconfig_supported == 1) { 3235 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG; 3236 } 3237 sac->sac_length += i; 3238 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) { 3239 memcpy(sac->sac_info, abort, abort_len); 3240 sac->sac_length += abort_len; 3241 } 3242 } 3243 SCTP_BUF_LEN(m_notify) = sac->sac_length; 3244 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3245 0, 0, stcb->asoc.context, 0, 0, 0, 3246 m_notify); 3247 if (control != NULL) { 3248 control->length = SCTP_BUF_LEN(m_notify); 3249 control->spec_flags = M_NOTIFICATION; 3250 /* not that we need this */ 3251 control->tail_mbuf = m_notify; 3252 sctp_add_to_readq(stcb->sctp_ep, stcb, 3253 control, 3254 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, 3255 so_locked); 3256 } else { 3257 sctp_m_freem(m_notify); 3258 } 3259 } 3260 /* 3261 * For 1-to-1 style sockets, we send up and error when an ABORT 3262 * comes in. 3263 */ 3264 set_error: 3265 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 3266 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 3267 ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) { 3268 SOCK_LOCK(stcb->sctp_socket); 3269 if (from_peer) { 3270 if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) { 3271 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED); 3272 stcb->sctp_socket->so_error = ECONNREFUSED; 3273 } else { 3274 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET); 3275 stcb->sctp_socket->so_error = ECONNRESET; 3276 } 3277 } else { 3278 if (timedout) { 3279 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT); 3280 stcb->sctp_socket->so_error = ETIMEDOUT; 3281 } else { 3282 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED); 3283 stcb->sctp_socket->so_error = ECONNABORTED; 3284 } 3285 } 3286 SOCK_UNLOCK(stcb->sctp_socket); 3287 } 3288 /* Wake ANY sleepers */ 3289 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 3290 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 3291 ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) { 3292 socantrcvmore(stcb->sctp_socket); 3293 } 3294 sorwakeup(stcb->sctp_socket); 3295 sowwakeup(stcb->sctp_socket); 3296 } 3297 3298 static void 3299 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state, 3300 struct sockaddr *sa, uint32_t error, int so_locked) 3301 { 3302 struct mbuf *m_notify; 3303 struct sctp_paddr_change *spc; 3304 struct sctp_queued_to_read *control; 3305 3306 if ((stcb == NULL) || 3307 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) { 3308 /* event not enabled */ 3309 return; 3310 } 3311 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA); 3312 if (m_notify == NULL) 3313 return; 3314 SCTP_BUF_LEN(m_notify) = 0; 3315 spc = mtod(m_notify, struct sctp_paddr_change *); 3316 memset(spc, 0, sizeof(struct sctp_paddr_change)); 3317 spc->spc_type = SCTP_PEER_ADDR_CHANGE; 3318 spc->spc_flags = 0; 3319 spc->spc_length = sizeof(struct sctp_paddr_change); 3320 switch (sa->sa_family) { 3321 #ifdef INET 3322 case AF_INET: 3323 #ifdef INET6 3324 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) { 3325 in6_sin_2_v4mapsin6((struct sockaddr_in *)sa, 3326 (struct sockaddr_in6 *)&spc->spc_aaddr); 3327 } else { 3328 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in)); 3329 } 3330 #else 3331 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in)); 3332 #endif 3333 break; 3334 #endif 3335 #ifdef INET6 3336 case AF_INET6: 3337 { 3338 struct sockaddr_in6 *sin6; 3339 3340 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6)); 3341 3342 sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr; 3343 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) { 3344 if (sin6->sin6_scope_id == 0) { 3345 /* recover scope_id for user */ 3346 (void)sa6_recoverscope(sin6); 3347 } else { 3348 /* clear embedded scope_id for user */ 3349 in6_clearscope(&sin6->sin6_addr); 3350 } 3351 } 3352 break; 3353 } 3354 #endif 3355 default: 3356 /* TSNH */ 3357 break; 3358 } 3359 spc->spc_state = state; 3360 spc->spc_error = error; 3361 spc->spc_assoc_id = sctp_get_associd(stcb); 3362 3363 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change); 3364 SCTP_BUF_NEXT(m_notify) = NULL; 3365 3366 /* append to socket */ 3367 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3368 0, 0, stcb->asoc.context, 0, 0, 0, 3369 m_notify); 3370 if (control == NULL) { 3371 /* no memory */ 3372 sctp_m_freem(m_notify); 3373 return; 3374 } 3375 control->length = SCTP_BUF_LEN(m_notify); 3376 control->spec_flags = M_NOTIFICATION; 3377 /* not that we need this */ 3378 control->tail_mbuf = m_notify; 3379 sctp_add_to_readq(stcb->sctp_ep, stcb, 3380 control, 3381 &stcb->sctp_socket->so_rcv, 1, 3382 SCTP_READ_LOCK_NOT_HELD, 3383 so_locked); 3384 } 3385 3386 static void 3387 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error, 3388 struct sctp_tmit_chunk *chk, int so_locked) 3389 { 3390 struct mbuf *m_notify; 3391 struct sctp_send_failed *ssf; 3392 struct sctp_send_failed_event *ssfe; 3393 struct sctp_queued_to_read *control; 3394 struct sctp_chunkhdr *chkhdr; 3395 int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len; 3396 3397 if ((stcb == NULL) || 3398 (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) && 3399 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) { 3400 /* event not enabled */ 3401 return; 3402 } 3403 3404 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { 3405 notifhdr_len = sizeof(struct sctp_send_failed_event); 3406 } else { 3407 notifhdr_len = sizeof(struct sctp_send_failed); 3408 } 3409 m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA); 3410 if (m_notify == NULL) 3411 /* no space left */ 3412 return; 3413 SCTP_BUF_LEN(m_notify) = notifhdr_len; 3414 if (stcb->asoc.idata_supported) { 3415 chkhdr_len = sizeof(struct sctp_idata_chunk); 3416 } else { 3417 chkhdr_len = sizeof(struct sctp_data_chunk); 3418 } 3419 /* Use some defaults in case we can't access the chunk header */ 3420 if (chk->send_size >= chkhdr_len) { 3421 payload_len = chk->send_size - chkhdr_len; 3422 } else { 3423 payload_len = 0; 3424 } 3425 padding_len = 0; 3426 if (chk->data != NULL) { 3427 chkhdr = mtod(chk->data, struct sctp_chunkhdr *); 3428 if (chkhdr != NULL) { 3429 chk_len = ntohs(chkhdr->chunk_length); 3430 if ((chk_len >= chkhdr_len) && 3431 (chk->send_size >= chk_len) && 3432 (chk->send_size - chk_len < 4)) { 3433 padding_len = chk->send_size - chk_len; 3434 payload_len = chk->send_size - chkhdr_len - padding_len; 3435 } 3436 } 3437 } 3438 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { 3439 ssfe = mtod(m_notify, struct sctp_send_failed_event *); 3440 memset(ssfe, 0, notifhdr_len); 3441 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; 3442 if (sent) { 3443 ssfe->ssfe_flags = SCTP_DATA_SENT; 3444 } else { 3445 ssfe->ssfe_flags = SCTP_DATA_UNSENT; 3446 } 3447 ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len); 3448 ssfe->ssfe_error = error; 3449 /* not exactly what the user sent in, but should be close :) */ 3450 ssfe->ssfe_info.snd_sid = chk->rec.data.sid; 3451 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags; 3452 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid; 3453 ssfe->ssfe_info.snd_context = chk->rec.data.context; 3454 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb); 3455 ssfe->ssfe_assoc_id = sctp_get_associd(stcb); 3456 } else { 3457 ssf = mtod(m_notify, struct sctp_send_failed *); 3458 memset(ssf, 0, notifhdr_len); 3459 ssf->ssf_type = SCTP_SEND_FAILED; 3460 if (sent) { 3461 ssf->ssf_flags = SCTP_DATA_SENT; 3462 } else { 3463 ssf->ssf_flags = SCTP_DATA_UNSENT; 3464 } 3465 ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len); 3466 ssf->ssf_error = error; 3467 /* not exactly what the user sent in, but should be close :) */ 3468 ssf->ssf_info.sinfo_stream = chk->rec.data.sid; 3469 ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid; 3470 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags; 3471 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid; 3472 ssf->ssf_info.sinfo_context = chk->rec.data.context; 3473 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb); 3474 ssf->ssf_assoc_id = sctp_get_associd(stcb); 3475 } 3476 if (chk->data != NULL) { 3477 /* Trim off the sctp chunk header (it should be there) */ 3478 if (chk->send_size == chkhdr_len + payload_len + padding_len) { 3479 m_adj(chk->data, chkhdr_len); 3480 m_adj(chk->data, -padding_len); 3481 sctp_mbuf_crush(chk->data); 3482 chk->send_size -= (chkhdr_len + padding_len); 3483 } 3484 } 3485 SCTP_BUF_NEXT(m_notify) = chk->data; 3486 /* Steal off the mbuf */ 3487 chk->data = NULL; 3488 /* 3489 * For this case, we check the actual socket buffer, since the assoc 3490 * is going away we don't want to overfill the socket buffer for a 3491 * non-reader 3492 */ 3493 if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3494 sctp_m_freem(m_notify); 3495 return; 3496 } 3497 /* append to socket */ 3498 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3499 0, 0, stcb->asoc.context, 0, 0, 0, 3500 m_notify); 3501 if (control == NULL) { 3502 /* no memory */ 3503 sctp_m_freem(m_notify); 3504 return; 3505 } 3506 control->length = SCTP_BUF_LEN(m_notify); 3507 control->spec_flags = M_NOTIFICATION; 3508 /* not that we need this */ 3509 control->tail_mbuf = m_notify; 3510 sctp_add_to_readq(stcb->sctp_ep, stcb, 3511 control, 3512 &stcb->sctp_socket->so_rcv, 1, 3513 SCTP_READ_LOCK_NOT_HELD, 3514 so_locked); 3515 } 3516 3517 static void 3518 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error, 3519 struct sctp_stream_queue_pending *sp, int so_locked) 3520 { 3521 struct mbuf *m_notify; 3522 struct sctp_send_failed *ssf; 3523 struct sctp_send_failed_event *ssfe; 3524 struct sctp_queued_to_read *control; 3525 int notifhdr_len; 3526 3527 if ((stcb == NULL) || 3528 (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) && 3529 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) { 3530 /* event not enabled */ 3531 return; 3532 } 3533 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { 3534 notifhdr_len = sizeof(struct sctp_send_failed_event); 3535 } else { 3536 notifhdr_len = sizeof(struct sctp_send_failed); 3537 } 3538 m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA); 3539 if (m_notify == NULL) { 3540 /* no space left */ 3541 return; 3542 } 3543 SCTP_BUF_LEN(m_notify) = notifhdr_len; 3544 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { 3545 ssfe = mtod(m_notify, struct sctp_send_failed_event *); 3546 memset(ssfe, 0, notifhdr_len); 3547 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; 3548 ssfe->ssfe_flags = SCTP_DATA_UNSENT; 3549 ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length); 3550 ssfe->ssfe_error = error; 3551 /* not exactly what the user sent in, but should be close :) */ 3552 ssfe->ssfe_info.snd_sid = sp->sid; 3553 if (sp->some_taken) { 3554 ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG; 3555 } else { 3556 ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG; 3557 } 3558 ssfe->ssfe_info.snd_ppid = sp->ppid; 3559 ssfe->ssfe_info.snd_context = sp->context; 3560 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb); 3561 ssfe->ssfe_assoc_id = sctp_get_associd(stcb); 3562 } else { 3563 ssf = mtod(m_notify, struct sctp_send_failed *); 3564 memset(ssf, 0, notifhdr_len); 3565 ssf->ssf_type = SCTP_SEND_FAILED; 3566 ssf->ssf_flags = SCTP_DATA_UNSENT; 3567 ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length); 3568 ssf->ssf_error = error; 3569 /* not exactly what the user sent in, but should be close :) */ 3570 ssf->ssf_info.sinfo_stream = sp->sid; 3571 ssf->ssf_info.sinfo_ssn = 0; 3572 if (sp->some_taken) { 3573 ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG; 3574 } else { 3575 ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG; 3576 } 3577 ssf->ssf_info.sinfo_ppid = sp->ppid; 3578 ssf->ssf_info.sinfo_context = sp->context; 3579 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb); 3580 ssf->ssf_assoc_id = sctp_get_associd(stcb); 3581 } 3582 SCTP_BUF_NEXT(m_notify) = sp->data; 3583 3584 /* Steal off the mbuf */ 3585 sp->data = NULL; 3586 /* 3587 * For this case, we check the actual socket buffer, since the assoc 3588 * is going away we don't want to overfill the socket buffer for a 3589 * non-reader 3590 */ 3591 if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3592 sctp_m_freem(m_notify); 3593 return; 3594 } 3595 /* append to socket */ 3596 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3597 0, 0, stcb->asoc.context, 0, 0, 0, 3598 m_notify); 3599 if (control == NULL) { 3600 /* no memory */ 3601 sctp_m_freem(m_notify); 3602 return; 3603 } 3604 control->length = SCTP_BUF_LEN(m_notify); 3605 control->spec_flags = M_NOTIFICATION; 3606 /* not that we need this */ 3607 control->tail_mbuf = m_notify; 3608 sctp_add_to_readq(stcb->sctp_ep, stcb, 3609 control, 3610 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked); 3611 } 3612 3613 static void 3614 sctp_notify_adaptation_layer(struct sctp_tcb *stcb) 3615 { 3616 struct mbuf *m_notify; 3617 struct sctp_adaptation_event *sai; 3618 struct sctp_queued_to_read *control; 3619 3620 if ((stcb == NULL) || 3621 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) { 3622 /* event not enabled */ 3623 return; 3624 } 3625 3626 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA); 3627 if (m_notify == NULL) 3628 /* no space left */ 3629 return; 3630 SCTP_BUF_LEN(m_notify) = 0; 3631 sai = mtod(m_notify, struct sctp_adaptation_event *); 3632 memset(sai, 0, sizeof(struct sctp_adaptation_event)); 3633 sai->sai_type = SCTP_ADAPTATION_INDICATION; 3634 sai->sai_flags = 0; 3635 sai->sai_length = sizeof(struct sctp_adaptation_event); 3636 sai->sai_adaptation_ind = stcb->asoc.peers_adaptation; 3637 sai->sai_assoc_id = sctp_get_associd(stcb); 3638 3639 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event); 3640 SCTP_BUF_NEXT(m_notify) = NULL; 3641 3642 /* append to socket */ 3643 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3644 0, 0, stcb->asoc.context, 0, 0, 0, 3645 m_notify); 3646 if (control == NULL) { 3647 /* no memory */ 3648 sctp_m_freem(m_notify); 3649 return; 3650 } 3651 control->length = SCTP_BUF_LEN(m_notify); 3652 control->spec_flags = M_NOTIFICATION; 3653 /* not that we need this */ 3654 control->tail_mbuf = m_notify; 3655 sctp_add_to_readq(stcb->sctp_ep, stcb, 3656 control, 3657 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3658 } 3659 3660 /* This always must be called with the read-queue LOCKED in the INP */ 3661 static void 3662 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error, 3663 uint32_t val, int so_locked) 3664 { 3665 struct mbuf *m_notify; 3666 struct sctp_pdapi_event *pdapi; 3667 struct sctp_queued_to_read *control; 3668 struct sockbuf *sb; 3669 3670 if ((stcb == NULL) || 3671 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) { 3672 /* event not enabled */ 3673 return; 3674 } 3675 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) { 3676 return; 3677 } 3678 3679 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA); 3680 if (m_notify == NULL) 3681 /* no space left */ 3682 return; 3683 SCTP_BUF_LEN(m_notify) = 0; 3684 pdapi = mtod(m_notify, struct sctp_pdapi_event *); 3685 memset(pdapi, 0, sizeof(struct sctp_pdapi_event)); 3686 pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT; 3687 pdapi->pdapi_flags = 0; 3688 pdapi->pdapi_length = sizeof(struct sctp_pdapi_event); 3689 pdapi->pdapi_indication = error; 3690 pdapi->pdapi_stream = (val >> 16); 3691 pdapi->pdapi_seq = (val & 0x0000ffff); 3692 pdapi->pdapi_assoc_id = sctp_get_associd(stcb); 3693 3694 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event); 3695 SCTP_BUF_NEXT(m_notify) = NULL; 3696 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3697 0, 0, stcb->asoc.context, 0, 0, 0, 3698 m_notify); 3699 if (control == NULL) { 3700 /* no memory */ 3701 sctp_m_freem(m_notify); 3702 return; 3703 } 3704 control->length = SCTP_BUF_LEN(m_notify); 3705 control->spec_flags = M_NOTIFICATION; 3706 /* not that we need this */ 3707 control->tail_mbuf = m_notify; 3708 sb = &stcb->sctp_socket->so_rcv; 3709 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 3710 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify)); 3711 } 3712 sctp_sballoc(stcb, sb, m_notify); 3713 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 3714 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 3715 } 3716 control->end_added = 1; 3717 if (stcb->asoc.control_pdapi) 3718 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next); 3719 else { 3720 /* we really should not see this case */ 3721 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next); 3722 } 3723 if (stcb->sctp_ep && stcb->sctp_socket) { 3724 /* This should always be the case */ 3725 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 3726 } 3727 } 3728 3729 static void 3730 sctp_notify_shutdown_event(struct sctp_tcb *stcb) 3731 { 3732 struct mbuf *m_notify; 3733 struct sctp_shutdown_event *sse; 3734 struct sctp_queued_to_read *control; 3735 3736 /* 3737 * For TCP model AND UDP connected sockets we will send an error up 3738 * when an SHUTDOWN completes 3739 */ 3740 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 3741 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 3742 /* mark socket closed for read/write and wakeup! */ 3743 socantsendmore(stcb->sctp_socket); 3744 } 3745 if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) { 3746 /* event not enabled */ 3747 return; 3748 } 3749 3750 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA); 3751 if (m_notify == NULL) 3752 /* no space left */ 3753 return; 3754 sse = mtod(m_notify, struct sctp_shutdown_event *); 3755 memset(sse, 0, sizeof(struct sctp_shutdown_event)); 3756 sse->sse_type = SCTP_SHUTDOWN_EVENT; 3757 sse->sse_flags = 0; 3758 sse->sse_length = sizeof(struct sctp_shutdown_event); 3759 sse->sse_assoc_id = sctp_get_associd(stcb); 3760 3761 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event); 3762 SCTP_BUF_NEXT(m_notify) = NULL; 3763 3764 /* append to socket */ 3765 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3766 0, 0, stcb->asoc.context, 0, 0, 0, 3767 m_notify); 3768 if (control == NULL) { 3769 /* no memory */ 3770 sctp_m_freem(m_notify); 3771 return; 3772 } 3773 control->length = SCTP_BUF_LEN(m_notify); 3774 control->spec_flags = M_NOTIFICATION; 3775 /* not that we need this */ 3776 control->tail_mbuf = m_notify; 3777 sctp_add_to_readq(stcb->sctp_ep, stcb, 3778 control, 3779 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3780 } 3781 3782 static void 3783 sctp_notify_sender_dry_event(struct sctp_tcb *stcb, 3784 int so_locked) 3785 { 3786 struct mbuf *m_notify; 3787 struct sctp_sender_dry_event *event; 3788 struct sctp_queued_to_read *control; 3789 3790 if ((stcb == NULL) || 3791 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) { 3792 /* event not enabled */ 3793 return; 3794 } 3795 3796 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA); 3797 if (m_notify == NULL) { 3798 /* no space left */ 3799 return; 3800 } 3801 SCTP_BUF_LEN(m_notify) = 0; 3802 event = mtod(m_notify, struct sctp_sender_dry_event *); 3803 memset(event, 0, sizeof(struct sctp_sender_dry_event)); 3804 event->sender_dry_type = SCTP_SENDER_DRY_EVENT; 3805 event->sender_dry_flags = 0; 3806 event->sender_dry_length = sizeof(struct sctp_sender_dry_event); 3807 event->sender_dry_assoc_id = sctp_get_associd(stcb); 3808 3809 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event); 3810 SCTP_BUF_NEXT(m_notify) = NULL; 3811 3812 /* append to socket */ 3813 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3814 0, 0, stcb->asoc.context, 0, 0, 0, 3815 m_notify); 3816 if (control == NULL) { 3817 /* no memory */ 3818 sctp_m_freem(m_notify); 3819 return; 3820 } 3821 control->length = SCTP_BUF_LEN(m_notify); 3822 control->spec_flags = M_NOTIFICATION; 3823 /* not that we need this */ 3824 control->tail_mbuf = m_notify; 3825 sctp_add_to_readq(stcb->sctp_ep, stcb, control, 3826 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked); 3827 } 3828 3829 void 3830 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag) 3831 { 3832 struct mbuf *m_notify; 3833 struct sctp_queued_to_read *control; 3834 struct sctp_stream_change_event *stradd; 3835 3836 if ((stcb == NULL) || 3837 (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) { 3838 /* event not enabled */ 3839 return; 3840 } 3841 if ((stcb->asoc.peer_req_out) && flag) { 3842 /* Peer made the request, don't tell the local user */ 3843 stcb->asoc.peer_req_out = 0; 3844 return; 3845 } 3846 stcb->asoc.peer_req_out = 0; 3847 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA); 3848 if (m_notify == NULL) 3849 /* no space left */ 3850 return; 3851 SCTP_BUF_LEN(m_notify) = 0; 3852 stradd = mtod(m_notify, struct sctp_stream_change_event *); 3853 memset(stradd, 0, sizeof(struct sctp_stream_change_event)); 3854 stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT; 3855 stradd->strchange_flags = flag; 3856 stradd->strchange_length = sizeof(struct sctp_stream_change_event); 3857 stradd->strchange_assoc_id = sctp_get_associd(stcb); 3858 stradd->strchange_instrms = numberin; 3859 stradd->strchange_outstrms = numberout; 3860 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event); 3861 SCTP_BUF_NEXT(m_notify) = NULL; 3862 if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3863 /* no space */ 3864 sctp_m_freem(m_notify); 3865 return; 3866 } 3867 /* append to socket */ 3868 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3869 0, 0, stcb->asoc.context, 0, 0, 0, 3870 m_notify); 3871 if (control == NULL) { 3872 /* no memory */ 3873 sctp_m_freem(m_notify); 3874 return; 3875 } 3876 control->length = SCTP_BUF_LEN(m_notify); 3877 control->spec_flags = M_NOTIFICATION; 3878 /* not that we need this */ 3879 control->tail_mbuf = m_notify; 3880 sctp_add_to_readq(stcb->sctp_ep, stcb, 3881 control, 3882 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3883 } 3884 3885 void 3886 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag) 3887 { 3888 struct mbuf *m_notify; 3889 struct sctp_queued_to_read *control; 3890 struct sctp_assoc_reset_event *strasoc; 3891 3892 if ((stcb == NULL) || 3893 (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) { 3894 /* event not enabled */ 3895 return; 3896 } 3897 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA); 3898 if (m_notify == NULL) 3899 /* no space left */ 3900 return; 3901 SCTP_BUF_LEN(m_notify) = 0; 3902 strasoc = mtod(m_notify, struct sctp_assoc_reset_event *); 3903 memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event)); 3904 strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT; 3905 strasoc->assocreset_flags = flag; 3906 strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event); 3907 strasoc->assocreset_assoc_id = sctp_get_associd(stcb); 3908 strasoc->assocreset_local_tsn = sending_tsn; 3909 strasoc->assocreset_remote_tsn = recv_tsn; 3910 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event); 3911 SCTP_BUF_NEXT(m_notify) = NULL; 3912 if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3913 /* no space */ 3914 sctp_m_freem(m_notify); 3915 return; 3916 } 3917 /* append to socket */ 3918 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3919 0, 0, stcb->asoc.context, 0, 0, 0, 3920 m_notify); 3921 if (control == NULL) { 3922 /* no memory */ 3923 sctp_m_freem(m_notify); 3924 return; 3925 } 3926 control->length = SCTP_BUF_LEN(m_notify); 3927 control->spec_flags = M_NOTIFICATION; 3928 /* not that we need this */ 3929 control->tail_mbuf = m_notify; 3930 sctp_add_to_readq(stcb->sctp_ep, stcb, 3931 control, 3932 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3933 } 3934 3935 static void 3936 sctp_notify_stream_reset(struct sctp_tcb *stcb, 3937 int number_entries, uint16_t *list, int flag) 3938 { 3939 struct mbuf *m_notify; 3940 struct sctp_queued_to_read *control; 3941 struct sctp_stream_reset_event *strreset; 3942 int len; 3943 3944 if ((stcb == NULL) || 3945 (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) { 3946 /* event not enabled */ 3947 return; 3948 } 3949 3950 m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 3951 if (m_notify == NULL) 3952 /* no space left */ 3953 return; 3954 SCTP_BUF_LEN(m_notify) = 0; 3955 len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t)); 3956 if (len > M_TRAILINGSPACE(m_notify)) { 3957 /* never enough room */ 3958 sctp_m_freem(m_notify); 3959 return; 3960 } 3961 strreset = mtod(m_notify, struct sctp_stream_reset_event *); 3962 memset(strreset, 0, len); 3963 strreset->strreset_type = SCTP_STREAM_RESET_EVENT; 3964 strreset->strreset_flags = flag; 3965 strreset->strreset_length = len; 3966 strreset->strreset_assoc_id = sctp_get_associd(stcb); 3967 if (number_entries) { 3968 int i; 3969 3970 for (i = 0; i < number_entries; i++) { 3971 strreset->strreset_stream_list[i] = ntohs(list[i]); 3972 } 3973 } 3974 SCTP_BUF_LEN(m_notify) = len; 3975 SCTP_BUF_NEXT(m_notify) = NULL; 3976 if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3977 /* no space */ 3978 sctp_m_freem(m_notify); 3979 return; 3980 } 3981 /* append to socket */ 3982 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3983 0, 0, stcb->asoc.context, 0, 0, 0, 3984 m_notify); 3985 if (control == NULL) { 3986 /* no memory */ 3987 sctp_m_freem(m_notify); 3988 return; 3989 } 3990 control->length = SCTP_BUF_LEN(m_notify); 3991 control->spec_flags = M_NOTIFICATION; 3992 /* not that we need this */ 3993 control->tail_mbuf = m_notify; 3994 sctp_add_to_readq(stcb->sctp_ep, stcb, 3995 control, 3996 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3997 } 3998 3999 static void 4000 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk) 4001 { 4002 struct mbuf *m_notify; 4003 struct sctp_remote_error *sre; 4004 struct sctp_queued_to_read *control; 4005 unsigned int notif_len; 4006 uint16_t chunk_len; 4007 4008 if ((stcb == NULL) || 4009 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) { 4010 return; 4011 } 4012 if (chunk != NULL) { 4013 chunk_len = ntohs(chunk->ch.chunk_length); 4014 /* 4015 * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be 4016 * contiguous. 4017 */ 4018 if (chunk_len > SCTP_CHUNK_BUFFER_SIZE) { 4019 chunk_len = SCTP_CHUNK_BUFFER_SIZE; 4020 } 4021 } else { 4022 chunk_len = 0; 4023 } 4024 notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len); 4025 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA); 4026 if (m_notify == NULL) { 4027 /* Retry with smaller value. */ 4028 notif_len = (unsigned int)sizeof(struct sctp_remote_error); 4029 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA); 4030 if (m_notify == NULL) { 4031 return; 4032 } 4033 } 4034 SCTP_BUF_NEXT(m_notify) = NULL; 4035 sre = mtod(m_notify, struct sctp_remote_error *); 4036 memset(sre, 0, notif_len); 4037 sre->sre_type = SCTP_REMOTE_ERROR; 4038 sre->sre_flags = 0; 4039 sre->sre_length = sizeof(struct sctp_remote_error); 4040 sre->sre_error = error; 4041 sre->sre_assoc_id = sctp_get_associd(stcb); 4042 if (notif_len > sizeof(struct sctp_remote_error)) { 4043 memcpy(sre->sre_data, chunk, chunk_len); 4044 sre->sre_length += chunk_len; 4045 } 4046 SCTP_BUF_LEN(m_notify) = sre->sre_length; 4047 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 4048 0, 0, stcb->asoc.context, 0, 0, 0, 4049 m_notify); 4050 if (control != NULL) { 4051 control->length = SCTP_BUF_LEN(m_notify); 4052 control->spec_flags = M_NOTIFICATION; 4053 /* not that we need this */ 4054 control->tail_mbuf = m_notify; 4055 sctp_add_to_readq(stcb->sctp_ep, stcb, 4056 control, 4057 &stcb->sctp_socket->so_rcv, 1, 4058 SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 4059 } else { 4060 sctp_m_freem(m_notify); 4061 } 4062 } 4063 4064 void 4065 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb, 4066 uint32_t error, void *data, int so_locked) 4067 { 4068 if ((stcb == NULL) || 4069 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 4070 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 4071 (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) { 4072 /* If the socket is gone we are out of here */ 4073 return; 4074 } 4075 if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) { 4076 return; 4077 } 4078 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 4079 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 4080 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) || 4081 (notification == SCTP_NOTIFY_INTERFACE_UP) || 4082 (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) { 4083 /* Don't report these in front states */ 4084 return; 4085 } 4086 } 4087 switch (notification) { 4088 case SCTP_NOTIFY_ASSOC_UP: 4089 if (stcb->asoc.assoc_up_sent == 0) { 4090 sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, false, false, so_locked); 4091 stcb->asoc.assoc_up_sent = 1; 4092 } 4093 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) { 4094 sctp_notify_adaptation_layer(stcb); 4095 } 4096 if (stcb->asoc.auth_supported == 0) { 4097 sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0, 4098 NULL, so_locked); 4099 } 4100 break; 4101 case SCTP_NOTIFY_ASSOC_DOWN: 4102 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, false, false, so_locked); 4103 break; 4104 case SCTP_NOTIFY_INTERFACE_DOWN: 4105 { 4106 struct sctp_nets *net; 4107 4108 net = (struct sctp_nets *)data; 4109 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE, 4110 (struct sockaddr *)&net->ro._l_addr, error, so_locked); 4111 break; 4112 } 4113 case SCTP_NOTIFY_INTERFACE_UP: 4114 { 4115 struct sctp_nets *net; 4116 4117 net = (struct sctp_nets *)data; 4118 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE, 4119 (struct sockaddr *)&net->ro._l_addr, error, so_locked); 4120 break; 4121 } 4122 case SCTP_NOTIFY_INTERFACE_CONFIRMED: 4123 { 4124 struct sctp_nets *net; 4125 4126 net = (struct sctp_nets *)data; 4127 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED, 4128 (struct sockaddr *)&net->ro._l_addr, error, so_locked); 4129 break; 4130 } 4131 case SCTP_NOTIFY_SPECIAL_SP_FAIL: 4132 sctp_notify_send_failed2(stcb, error, 4133 (struct sctp_stream_queue_pending *)data, so_locked); 4134 break; 4135 case SCTP_NOTIFY_SENT_DG_FAIL: 4136 sctp_notify_send_failed(stcb, 1, error, 4137 (struct sctp_tmit_chunk *)data, so_locked); 4138 break; 4139 case SCTP_NOTIFY_UNSENT_DG_FAIL: 4140 sctp_notify_send_failed(stcb, 0, error, 4141 (struct sctp_tmit_chunk *)data, so_locked); 4142 break; 4143 case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION: 4144 { 4145 uint32_t val; 4146 4147 val = *((uint32_t *)data); 4148 4149 sctp_notify_partial_delivery_indication(stcb, error, val, so_locked); 4150 break; 4151 } 4152 case SCTP_NOTIFY_ASSOC_LOC_ABORTED: 4153 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 4154 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 4155 sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, false, false, so_locked); 4156 } else { 4157 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, false, false, so_locked); 4158 } 4159 break; 4160 case SCTP_NOTIFY_ASSOC_REM_ABORTED: 4161 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 4162 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 4163 sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, true, false, so_locked); 4164 } else { 4165 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, true, false, so_locked); 4166 } 4167 break; 4168 case SCTP_NOTIFY_ASSOC_TIMEDOUT: 4169 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 4170 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 4171 sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, false, true, so_locked); 4172 } else { 4173 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, false, true, so_locked); 4174 } 4175 break; 4176 case SCTP_NOTIFY_ASSOC_RESTART: 4177 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, false, false, so_locked); 4178 if (stcb->asoc.auth_supported == 0) { 4179 sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0, 4180 NULL, so_locked); 4181 } 4182 break; 4183 case SCTP_NOTIFY_STR_RESET_SEND: 4184 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN); 4185 break; 4186 case SCTP_NOTIFY_STR_RESET_RECV: 4187 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING); 4188 break; 4189 case SCTP_NOTIFY_STR_RESET_FAILED_OUT: 4190 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), 4191 (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED)); 4192 break; 4193 case SCTP_NOTIFY_STR_RESET_DENIED_OUT: 4194 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), 4195 (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED)); 4196 break; 4197 case SCTP_NOTIFY_STR_RESET_FAILED_IN: 4198 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), 4199 (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED)); 4200 break; 4201 case SCTP_NOTIFY_STR_RESET_DENIED_IN: 4202 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), 4203 (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED)); 4204 break; 4205 case SCTP_NOTIFY_ASCONF_ADD_IP: 4206 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data, 4207 error, so_locked); 4208 break; 4209 case SCTP_NOTIFY_ASCONF_DELETE_IP: 4210 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data, 4211 error, so_locked); 4212 break; 4213 case SCTP_NOTIFY_ASCONF_SET_PRIMARY: 4214 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data, 4215 error, so_locked); 4216 break; 4217 case SCTP_NOTIFY_PEER_SHUTDOWN: 4218 sctp_notify_shutdown_event(stcb); 4219 break; 4220 case SCTP_NOTIFY_AUTH_NEW_KEY: 4221 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error, 4222 (uint16_t)(uintptr_t)data, 4223 so_locked); 4224 break; 4225 case SCTP_NOTIFY_AUTH_FREE_KEY: 4226 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error, 4227 (uint16_t)(uintptr_t)data, 4228 so_locked); 4229 break; 4230 case SCTP_NOTIFY_NO_PEER_AUTH: 4231 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error, 4232 (uint16_t)(uintptr_t)data, 4233 so_locked); 4234 break; 4235 case SCTP_NOTIFY_SENDER_DRY: 4236 sctp_notify_sender_dry_event(stcb, so_locked); 4237 break; 4238 case SCTP_NOTIFY_REMOTE_ERROR: 4239 sctp_notify_remote_error(stcb, error, data); 4240 break; 4241 default: 4242 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n", 4243 __func__, notification, notification); 4244 break; 4245 } /* end switch */ 4246 } 4247 4248 void 4249 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int so_locked) 4250 { 4251 struct sctp_association *asoc; 4252 struct sctp_stream_out *outs; 4253 struct sctp_tmit_chunk *chk, *nchk; 4254 struct sctp_stream_queue_pending *sp, *nsp; 4255 int i; 4256 4257 if (stcb == NULL) { 4258 return; 4259 } 4260 asoc = &stcb->asoc; 4261 if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) { 4262 /* already being freed */ 4263 return; 4264 } 4265 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 4266 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 4267 (asoc->state & SCTP_STATE_CLOSED_SOCKET)) { 4268 return; 4269 } 4270 /* now through all the gunk freeing chunks */ 4271 /* sent queue SHOULD be empty */ 4272 TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) { 4273 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next); 4274 asoc->sent_queue_cnt--; 4275 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) { 4276 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) { 4277 asoc->strmout[chk->rec.data.sid].chunks_on_queues--; 4278 #ifdef INVARIANTS 4279 } else { 4280 panic("No chunks on the queues for sid %u.", chk->rec.data.sid); 4281 #endif 4282 } 4283 } 4284 if (chk->data != NULL) { 4285 sctp_free_bufspace(stcb, asoc, chk, 1); 4286 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 4287 error, chk, so_locked); 4288 if (chk->data) { 4289 sctp_m_freem(chk->data); 4290 chk->data = NULL; 4291 } 4292 } 4293 sctp_free_a_chunk(stcb, chk, so_locked); 4294 /* sa_ignore FREED_MEMORY */ 4295 } 4296 /* pending send queue SHOULD be empty */ 4297 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 4298 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next); 4299 asoc->send_queue_cnt--; 4300 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) { 4301 asoc->strmout[chk->rec.data.sid].chunks_on_queues--; 4302 #ifdef INVARIANTS 4303 } else { 4304 panic("No chunks on the queues for sid %u.", chk->rec.data.sid); 4305 #endif 4306 } 4307 if (chk->data != NULL) { 4308 sctp_free_bufspace(stcb, asoc, chk, 1); 4309 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 4310 error, chk, so_locked); 4311 if (chk->data) { 4312 sctp_m_freem(chk->data); 4313 chk->data = NULL; 4314 } 4315 } 4316 sctp_free_a_chunk(stcb, chk, so_locked); 4317 /* sa_ignore FREED_MEMORY */ 4318 } 4319 for (i = 0; i < asoc->streamoutcnt; i++) { 4320 /* For each stream */ 4321 outs = &asoc->strmout[i]; 4322 /* clean up any sends there */ 4323 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) { 4324 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 4325 TAILQ_REMOVE(&outs->outqueue, sp, next); 4326 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1); 4327 sctp_free_spbufspace(stcb, asoc, sp); 4328 if (sp->data) { 4329 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb, 4330 error, (void *)sp, so_locked); 4331 if (sp->data) { 4332 sctp_m_freem(sp->data); 4333 sp->data = NULL; 4334 sp->tail_mbuf = NULL; 4335 sp->length = 0; 4336 } 4337 } 4338 if (sp->net) { 4339 sctp_free_remote_addr(sp->net); 4340 sp->net = NULL; 4341 } 4342 /* Free the chunk */ 4343 sctp_free_a_strmoq(stcb, sp, so_locked); 4344 /* sa_ignore FREED_MEMORY */ 4345 } 4346 } 4347 } 4348 4349 void 4350 sctp_abort_notification(struct sctp_tcb *stcb, bool from_peer, bool timeout, 4351 uint16_t error, struct sctp_abort_chunk *abort, 4352 int so_locked) 4353 { 4354 if (stcb == NULL) { 4355 return; 4356 } 4357 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) || 4358 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 4359 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) { 4360 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED; 4361 } 4362 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 4363 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 4364 (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) { 4365 return; 4366 } 4367 SCTP_TCB_SEND_LOCK(stcb); 4368 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED); 4369 /* Tell them we lost the asoc */ 4370 sctp_report_all_outbound(stcb, error, so_locked); 4371 SCTP_TCB_SEND_UNLOCK(stcb); 4372 if (from_peer) { 4373 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked); 4374 } else { 4375 if (timeout) { 4376 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_TIMEDOUT, stcb, error, abort, so_locked); 4377 } else { 4378 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked); 4379 } 4380 } 4381 } 4382 4383 void 4384 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 4385 struct mbuf *m, int iphlen, 4386 struct sockaddr *src, struct sockaddr *dst, 4387 struct sctphdr *sh, struct mbuf *op_err, 4388 uint8_t mflowtype, uint32_t mflowid, 4389 uint32_t vrf_id, uint16_t port) 4390 { 4391 struct sctp_gen_error_cause *cause; 4392 uint32_t vtag; 4393 uint16_t cause_code; 4394 4395 if (stcb != NULL) { 4396 vtag = stcb->asoc.peer_vtag; 4397 vrf_id = stcb->asoc.vrf_id; 4398 if (op_err != NULL) { 4399 /* Read the cause code from the error cause. */ 4400 cause = mtod(op_err, struct sctp_gen_error_cause *); 4401 cause_code = ntohs(cause->code); 4402 } else { 4403 cause_code = 0; 4404 } 4405 } else { 4406 vtag = 0; 4407 } 4408 sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err, 4409 mflowtype, mflowid, inp->fibnum, 4410 vrf_id, port); 4411 if (stcb != NULL) { 4412 /* We have a TCB to abort, send notification too */ 4413 sctp_abort_notification(stcb, false, false, cause_code, NULL, SCTP_SO_NOT_LOCKED); 4414 /* Ok, now lets free it */ 4415 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 4416 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) || 4417 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 4418 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 4419 } 4420 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 4421 SCTP_FROM_SCTPUTIL + SCTP_LOC_4); 4422 } 4423 } 4424 #ifdef SCTP_ASOCLOG_OF_TSNS 4425 void 4426 sctp_print_out_track_log(struct sctp_tcb *stcb) 4427 { 4428 #ifdef NOSIY_PRINTS 4429 int i; 4430 4431 SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code); 4432 SCTP_PRINTF("IN bound TSN log-aaa\n"); 4433 if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) { 4434 SCTP_PRINTF("None rcvd\n"); 4435 goto none_in; 4436 } 4437 if (stcb->asoc.tsn_in_wrapped) { 4438 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) { 4439 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 4440 stcb->asoc.in_tsnlog[i].tsn, 4441 stcb->asoc.in_tsnlog[i].strm, 4442 stcb->asoc.in_tsnlog[i].seq, 4443 stcb->asoc.in_tsnlog[i].flgs, 4444 stcb->asoc.in_tsnlog[i].sz); 4445 } 4446 } 4447 if (stcb->asoc.tsn_in_at) { 4448 for (i = 0; i < stcb->asoc.tsn_in_at; i++) { 4449 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 4450 stcb->asoc.in_tsnlog[i].tsn, 4451 stcb->asoc.in_tsnlog[i].strm, 4452 stcb->asoc.in_tsnlog[i].seq, 4453 stcb->asoc.in_tsnlog[i].flgs, 4454 stcb->asoc.in_tsnlog[i].sz); 4455 } 4456 } 4457 none_in: 4458 SCTP_PRINTF("OUT bound TSN log-aaa\n"); 4459 if ((stcb->asoc.tsn_out_at == 0) && 4460 (stcb->asoc.tsn_out_wrapped == 0)) { 4461 SCTP_PRINTF("None sent\n"); 4462 } 4463 if (stcb->asoc.tsn_out_wrapped) { 4464 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) { 4465 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 4466 stcb->asoc.out_tsnlog[i].tsn, 4467 stcb->asoc.out_tsnlog[i].strm, 4468 stcb->asoc.out_tsnlog[i].seq, 4469 stcb->asoc.out_tsnlog[i].flgs, 4470 stcb->asoc.out_tsnlog[i].sz); 4471 } 4472 } 4473 if (stcb->asoc.tsn_out_at) { 4474 for (i = 0; i < stcb->asoc.tsn_out_at; i++) { 4475 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 4476 stcb->asoc.out_tsnlog[i].tsn, 4477 stcb->asoc.out_tsnlog[i].strm, 4478 stcb->asoc.out_tsnlog[i].seq, 4479 stcb->asoc.out_tsnlog[i].flgs, 4480 stcb->asoc.out_tsnlog[i].sz); 4481 } 4482 } 4483 #endif 4484 } 4485 #endif 4486 4487 void 4488 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 4489 struct mbuf *op_err, bool timedout, int so_locked) 4490 { 4491 struct sctp_gen_error_cause *cause; 4492 uint16_t cause_code; 4493 4494 if (stcb == NULL) { 4495 /* Got to have a TCB */ 4496 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4497 if (LIST_EMPTY(&inp->sctp_asoc_list)) { 4498 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT, 4499 SCTP_CALLED_DIRECTLY_NOCMPSET); 4500 } 4501 } 4502 return; 4503 } 4504 if (op_err != NULL) { 4505 /* Read the cause code from the error cause. */ 4506 cause = mtod(op_err, struct sctp_gen_error_cause *); 4507 cause_code = ntohs(cause->code); 4508 } else { 4509 cause_code = 0; 4510 } 4511 /* notify the peer */ 4512 sctp_send_abort_tcb(stcb, op_err, so_locked); 4513 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 4514 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) || 4515 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 4516 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 4517 } 4518 /* notify the ulp */ 4519 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) { 4520 sctp_abort_notification(stcb, false, timedout, cause_code, NULL, so_locked); 4521 } 4522 /* now free the asoc */ 4523 #ifdef SCTP_ASOCLOG_OF_TSNS 4524 sctp_print_out_track_log(stcb); 4525 #endif 4526 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 4527 SCTP_FROM_SCTPUTIL + SCTP_LOC_5); 4528 } 4529 4530 void 4531 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, 4532 struct sockaddr *src, struct sockaddr *dst, 4533 struct sctphdr *sh, struct sctp_inpcb *inp, 4534 struct mbuf *cause, 4535 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 4536 uint32_t vrf_id, uint16_t port) 4537 { 4538 struct sctp_chunkhdr *ch, chunk_buf; 4539 unsigned int chk_length; 4540 int contains_init_chunk; 4541 4542 SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue); 4543 /* Generate a TO address for future reference */ 4544 if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 4545 if (LIST_EMPTY(&inp->sctp_asoc_list)) { 4546 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT, 4547 SCTP_CALLED_DIRECTLY_NOCMPSET); 4548 } 4549 } 4550 contains_init_chunk = 0; 4551 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 4552 sizeof(*ch), (uint8_t *)&chunk_buf); 4553 while (ch != NULL) { 4554 chk_length = ntohs(ch->chunk_length); 4555 if (chk_length < sizeof(*ch)) { 4556 /* break to abort land */ 4557 break; 4558 } 4559 switch (ch->chunk_type) { 4560 case SCTP_INIT: 4561 contains_init_chunk = 1; 4562 break; 4563 case SCTP_PACKET_DROPPED: 4564 /* we don't respond to pkt-dropped */ 4565 return; 4566 case SCTP_ABORT_ASSOCIATION: 4567 /* we don't respond with an ABORT to an ABORT */ 4568 return; 4569 case SCTP_SHUTDOWN_COMPLETE: 4570 /* 4571 * we ignore it since we are not waiting for it and 4572 * peer is gone 4573 */ 4574 return; 4575 case SCTP_SHUTDOWN_ACK: 4576 sctp_send_shutdown_complete2(src, dst, sh, 4577 mflowtype, mflowid, fibnum, 4578 vrf_id, port); 4579 return; 4580 default: 4581 break; 4582 } 4583 offset += SCTP_SIZE32(chk_length); 4584 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 4585 sizeof(*ch), (uint8_t *)&chunk_buf); 4586 } 4587 if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) || 4588 ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) && 4589 (contains_init_chunk == 0))) { 4590 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause, 4591 mflowtype, mflowid, fibnum, 4592 vrf_id, port); 4593 } 4594 } 4595 4596 /* 4597 * check the inbound datagram to make sure there is not an abort inside it, 4598 * if there is return 1, else return 0. 4599 */ 4600 int 4601 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtag) 4602 { 4603 struct sctp_chunkhdr *ch; 4604 struct sctp_init_chunk *init_chk, chunk_buf; 4605 int offset; 4606 unsigned int chk_length; 4607 4608 offset = iphlen + sizeof(struct sctphdr); 4609 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch), 4610 (uint8_t *)&chunk_buf); 4611 while (ch != NULL) { 4612 chk_length = ntohs(ch->chunk_length); 4613 if (chk_length < sizeof(*ch)) { 4614 /* packet is probably corrupt */ 4615 break; 4616 } 4617 /* we seem to be ok, is it an abort? */ 4618 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) { 4619 /* yep, tell them */ 4620 return (1); 4621 } 4622 if ((ch->chunk_type == SCTP_INITIATION) || 4623 (ch->chunk_type == SCTP_INITIATION_ACK)) { 4624 /* need to update the Vtag */ 4625 init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m, 4626 offset, sizeof(struct sctp_init_chunk), (uint8_t *)&chunk_buf); 4627 if (init_chk != NULL) { 4628 *vtag = ntohl(init_chk->init.initiate_tag); 4629 } 4630 } 4631 /* Nope, move to the next chunk */ 4632 offset += SCTP_SIZE32(chk_length); 4633 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 4634 sizeof(*ch), (uint8_t *)&chunk_buf); 4635 } 4636 return (0); 4637 } 4638 4639 /* 4640 * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id 4641 * set (i.e. it's 0) so, create this function to compare link local scopes 4642 */ 4643 #ifdef INET6 4644 uint32_t 4645 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2) 4646 { 4647 struct sockaddr_in6 a, b; 4648 4649 /* save copies */ 4650 a = *addr1; 4651 b = *addr2; 4652 4653 if (a.sin6_scope_id == 0) 4654 if (sa6_recoverscope(&a)) { 4655 /* can't get scope, so can't match */ 4656 return (0); 4657 } 4658 if (b.sin6_scope_id == 0) 4659 if (sa6_recoverscope(&b)) { 4660 /* can't get scope, so can't match */ 4661 return (0); 4662 } 4663 if (a.sin6_scope_id != b.sin6_scope_id) 4664 return (0); 4665 4666 return (1); 4667 } 4668 4669 /* 4670 * returns a sockaddr_in6 with embedded scope recovered and removed 4671 */ 4672 struct sockaddr_in6 * 4673 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store) 4674 { 4675 /* check and strip embedded scope junk */ 4676 if (addr->sin6_family == AF_INET6) { 4677 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) { 4678 if (addr->sin6_scope_id == 0) { 4679 *store = *addr; 4680 if (!sa6_recoverscope(store)) { 4681 /* use the recovered scope */ 4682 addr = store; 4683 } 4684 } else { 4685 /* else, return the original "to" addr */ 4686 in6_clearscope(&addr->sin6_addr); 4687 } 4688 } 4689 } 4690 return (addr); 4691 } 4692 #endif 4693 4694 /* 4695 * are the two addresses the same? currently a "scopeless" check returns: 1 4696 * if same, 0 if not 4697 */ 4698 int 4699 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2) 4700 { 4701 4702 /* must be valid */ 4703 if (sa1 == NULL || sa2 == NULL) 4704 return (0); 4705 4706 /* must be the same family */ 4707 if (sa1->sa_family != sa2->sa_family) 4708 return (0); 4709 4710 switch (sa1->sa_family) { 4711 #ifdef INET6 4712 case AF_INET6: 4713 { 4714 /* IPv6 addresses */ 4715 struct sockaddr_in6 *sin6_1, *sin6_2; 4716 4717 sin6_1 = (struct sockaddr_in6 *)sa1; 4718 sin6_2 = (struct sockaddr_in6 *)sa2; 4719 return (SCTP6_ARE_ADDR_EQUAL(sin6_1, 4720 sin6_2)); 4721 } 4722 #endif 4723 #ifdef INET 4724 case AF_INET: 4725 { 4726 /* IPv4 addresses */ 4727 struct sockaddr_in *sin_1, *sin_2; 4728 4729 sin_1 = (struct sockaddr_in *)sa1; 4730 sin_2 = (struct sockaddr_in *)sa2; 4731 return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr); 4732 } 4733 #endif 4734 default: 4735 /* we don't do these... */ 4736 return (0); 4737 } 4738 } 4739 4740 void 4741 sctp_print_address(struct sockaddr *sa) 4742 { 4743 #ifdef INET6 4744 char ip6buf[INET6_ADDRSTRLEN]; 4745 #endif 4746 4747 switch (sa->sa_family) { 4748 #ifdef INET6 4749 case AF_INET6: 4750 { 4751 struct sockaddr_in6 *sin6; 4752 4753 sin6 = (struct sockaddr_in6 *)sa; 4754 SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n", 4755 ip6_sprintf(ip6buf, &sin6->sin6_addr), 4756 ntohs(sin6->sin6_port), 4757 sin6->sin6_scope_id); 4758 break; 4759 } 4760 #endif 4761 #ifdef INET 4762 case AF_INET: 4763 { 4764 struct sockaddr_in *sin; 4765 unsigned char *p; 4766 4767 sin = (struct sockaddr_in *)sa; 4768 p = (unsigned char *)&sin->sin_addr; 4769 SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n", 4770 p[0], p[1], p[2], p[3], ntohs(sin->sin_port)); 4771 break; 4772 } 4773 #endif 4774 default: 4775 SCTP_PRINTF("?\n"); 4776 break; 4777 } 4778 } 4779 4780 void 4781 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp, 4782 struct sctp_inpcb *new_inp, 4783 struct sctp_tcb *stcb, 4784 int waitflags) 4785 { 4786 /* 4787 * go through our old INP and pull off any control structures that 4788 * belong to stcb and move then to the new inp. 4789 */ 4790 struct socket *old_so, *new_so; 4791 struct sctp_queued_to_read *control, *nctl; 4792 struct sctp_readhead tmp_queue; 4793 struct mbuf *m; 4794 int error = 0; 4795 4796 old_so = old_inp->sctp_socket; 4797 new_so = new_inp->sctp_socket; 4798 TAILQ_INIT(&tmp_queue); 4799 error = sblock(&old_so->so_rcv, waitflags); 4800 if (error) { 4801 /* 4802 * Gak, can't get sblock, we have a problem. data will be 4803 * left stranded.. and we don't dare look at it since the 4804 * other thread may be reading something. Oh well, its a 4805 * screwed up app that does a peeloff OR a accept while 4806 * reading from the main socket... actually its only the 4807 * peeloff() case, since I think read will fail on a 4808 * listening socket.. 4809 */ 4810 return; 4811 } 4812 /* lock the socket buffers */ 4813 SCTP_INP_READ_LOCK(old_inp); 4814 TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) { 4815 /* Pull off all for out target stcb */ 4816 if (control->stcb == stcb) { 4817 /* remove it we want it */ 4818 TAILQ_REMOVE(&old_inp->read_queue, control, next); 4819 TAILQ_INSERT_TAIL(&tmp_queue, control, next); 4820 m = control->data; 4821 while (m) { 4822 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4823 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m)); 4824 } 4825 sctp_sbfree(control, stcb, &old_so->so_rcv, m); 4826 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4827 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 4828 } 4829 m = SCTP_BUF_NEXT(m); 4830 } 4831 } 4832 } 4833 SCTP_INP_READ_UNLOCK(old_inp); 4834 /* Remove the sb-lock on the old socket */ 4835 4836 sbunlock(&old_so->so_rcv); 4837 /* Now we move them over to the new socket buffer */ 4838 SCTP_INP_READ_LOCK(new_inp); 4839 TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) { 4840 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next); 4841 m = control->data; 4842 while (m) { 4843 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4844 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m)); 4845 } 4846 sctp_sballoc(stcb, &new_so->so_rcv, m); 4847 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4848 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 4849 } 4850 m = SCTP_BUF_NEXT(m); 4851 } 4852 } 4853 SCTP_INP_READ_UNLOCK(new_inp); 4854 } 4855 4856 void 4857 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp, 4858 struct sctp_tcb *stcb, 4859 int so_locked 4860 SCTP_UNUSED 4861 ) 4862 { 4863 if ((inp != NULL) && (inp->sctp_socket != NULL)) { 4864 sctp_sorwakeup(inp, inp->sctp_socket); 4865 } 4866 } 4867 4868 void 4869 sctp_add_to_readq(struct sctp_inpcb *inp, 4870 struct sctp_tcb *stcb, 4871 struct sctp_queued_to_read *control, 4872 struct sockbuf *sb, 4873 int end, 4874 int inp_read_lock_held, 4875 int so_locked) 4876 { 4877 /* 4878 * Here we must place the control on the end of the socket read 4879 * queue AND increment sb_cc so that select will work properly on 4880 * read. 4881 */ 4882 struct mbuf *m, *prev = NULL; 4883 4884 if (inp == NULL) { 4885 /* Gak, TSNH!! */ 4886 #ifdef INVARIANTS 4887 panic("Gak, inp NULL on add_to_readq"); 4888 #endif 4889 return; 4890 } 4891 if (inp_read_lock_held == 0) 4892 SCTP_INP_READ_LOCK(inp); 4893 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) { 4894 if (!control->on_strm_q) { 4895 sctp_free_remote_addr(control->whoFrom); 4896 if (control->data) { 4897 sctp_m_freem(control->data); 4898 control->data = NULL; 4899 } 4900 sctp_free_a_readq(stcb, control); 4901 } 4902 if (inp_read_lock_held == 0) 4903 SCTP_INP_READ_UNLOCK(inp); 4904 return; 4905 } 4906 if (!(control->spec_flags & M_NOTIFICATION)) { 4907 atomic_add_int(&inp->total_recvs, 1); 4908 if (!control->do_not_ref_stcb) { 4909 atomic_add_int(&stcb->total_recvs, 1); 4910 } 4911 } 4912 m = control->data; 4913 control->held_length = 0; 4914 control->length = 0; 4915 while (m) { 4916 if (SCTP_BUF_LEN(m) == 0) { 4917 /* Skip mbufs with NO length */ 4918 if (prev == NULL) { 4919 /* First one */ 4920 control->data = sctp_m_free(m); 4921 m = control->data; 4922 } else { 4923 SCTP_BUF_NEXT(prev) = sctp_m_free(m); 4924 m = SCTP_BUF_NEXT(prev); 4925 } 4926 if (m == NULL) { 4927 control->tail_mbuf = prev; 4928 } 4929 continue; 4930 } 4931 prev = m; 4932 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4933 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m)); 4934 } 4935 sctp_sballoc(stcb, sb, m); 4936 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4937 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 4938 } 4939 atomic_add_int(&control->length, SCTP_BUF_LEN(m)); 4940 m = SCTP_BUF_NEXT(m); 4941 } 4942 if (prev != NULL) { 4943 control->tail_mbuf = prev; 4944 } else { 4945 /* Everything got collapsed out?? */ 4946 if (!control->on_strm_q) { 4947 sctp_free_remote_addr(control->whoFrom); 4948 sctp_free_a_readq(stcb, control); 4949 } 4950 if (inp_read_lock_held == 0) 4951 SCTP_INP_READ_UNLOCK(inp); 4952 return; 4953 } 4954 if (end) { 4955 control->end_added = 1; 4956 } 4957 TAILQ_INSERT_TAIL(&inp->read_queue, control, next); 4958 control->on_read_q = 1; 4959 if (inp_read_lock_held == 0) 4960 SCTP_INP_READ_UNLOCK(inp); 4961 if (inp && inp->sctp_socket) { 4962 sctp_wakeup_the_read_socket(inp, stcb, so_locked); 4963 } 4964 } 4965 4966 /*************HOLD THIS COMMENT FOR PATCH FILE OF 4967 *************ALTERNATE ROUTING CODE 4968 */ 4969 4970 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF 4971 *************ALTERNATE ROUTING CODE 4972 */ 4973 4974 struct mbuf * 4975 sctp_generate_cause(uint16_t code, char *info) 4976 { 4977 struct mbuf *m; 4978 struct sctp_gen_error_cause *cause; 4979 size_t info_len; 4980 uint16_t len; 4981 4982 if ((code == 0) || (info == NULL)) { 4983 return (NULL); 4984 } 4985 info_len = strlen(info); 4986 if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) { 4987 return (NULL); 4988 } 4989 len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len); 4990 m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA); 4991 if (m != NULL) { 4992 SCTP_BUF_LEN(m) = len; 4993 cause = mtod(m, struct sctp_gen_error_cause *); 4994 cause->code = htons(code); 4995 cause->length = htons(len); 4996 memcpy(cause->info, info, info_len); 4997 } 4998 return (m); 4999 } 5000 5001 struct mbuf * 5002 sctp_generate_no_user_data_cause(uint32_t tsn) 5003 { 5004 struct mbuf *m; 5005 struct sctp_error_no_user_data *no_user_data_cause; 5006 uint16_t len; 5007 5008 len = (uint16_t)sizeof(struct sctp_error_no_user_data); 5009 m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA); 5010 if (m != NULL) { 5011 SCTP_BUF_LEN(m) = len; 5012 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *); 5013 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA); 5014 no_user_data_cause->cause.length = htons(len); 5015 no_user_data_cause->tsn = htonl(tsn); 5016 } 5017 return (m); 5018 } 5019 5020 #ifdef SCTP_MBCNT_LOGGING 5021 void 5022 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc, 5023 struct sctp_tmit_chunk *tp1, int chk_cnt) 5024 { 5025 if (tp1->data == NULL) { 5026 return; 5027 } 5028 asoc->chunks_on_out_queue -= chk_cnt; 5029 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) { 5030 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE, 5031 asoc->total_output_queue_size, 5032 tp1->book_size, 5033 0, 5034 tp1->mbcnt); 5035 } 5036 if (asoc->total_output_queue_size >= tp1->book_size) { 5037 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size); 5038 } else { 5039 asoc->total_output_queue_size = 0; 5040 } 5041 5042 if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) || 5043 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) { 5044 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) { 5045 stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size; 5046 } else { 5047 stcb->sctp_socket->so_snd.sb_cc = 0; 5048 } 5049 } 5050 } 5051 5052 #endif 5053 5054 int 5055 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1, 5056 uint8_t sent, int so_locked) 5057 { 5058 struct sctp_stream_out *strq; 5059 struct sctp_tmit_chunk *chk = NULL, *tp2; 5060 struct sctp_stream_queue_pending *sp; 5061 uint32_t mid; 5062 uint16_t sid; 5063 uint8_t foundeom = 0; 5064 int ret_sz = 0; 5065 int notdone; 5066 int do_wakeup_routine = 0; 5067 5068 sid = tp1->rec.data.sid; 5069 mid = tp1->rec.data.mid; 5070 if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) { 5071 stcb->asoc.abandoned_sent[0]++; 5072 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++; 5073 stcb->asoc.strmout[sid].abandoned_sent[0]++; 5074 #if defined(SCTP_DETAILED_STR_STATS) 5075 stcb->asoc.strmout[sid].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++; 5076 #endif 5077 } else { 5078 stcb->asoc.abandoned_unsent[0]++; 5079 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++; 5080 stcb->asoc.strmout[sid].abandoned_unsent[0]++; 5081 #if defined(SCTP_DETAILED_STR_STATS) 5082 stcb->asoc.strmout[sid].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++; 5083 #endif 5084 } 5085 do { 5086 ret_sz += tp1->book_size; 5087 if (tp1->data != NULL) { 5088 if (tp1->sent < SCTP_DATAGRAM_RESEND) { 5089 sctp_flight_size_decrease(tp1); 5090 sctp_total_flight_decrease(stcb, tp1); 5091 } 5092 sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1); 5093 stcb->asoc.peers_rwnd += tp1->send_size; 5094 stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh); 5095 if (sent) { 5096 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked); 5097 } else { 5098 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked); 5099 } 5100 if (tp1->data) { 5101 sctp_m_freem(tp1->data); 5102 tp1->data = NULL; 5103 } 5104 do_wakeup_routine = 1; 5105 if (PR_SCTP_BUF_ENABLED(tp1->flags)) { 5106 stcb->asoc.sent_queue_cnt_removeable--; 5107 } 5108 } 5109 tp1->sent = SCTP_FORWARD_TSN_SKIP; 5110 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) == 5111 SCTP_DATA_NOT_FRAG) { 5112 /* not frag'ed we ae done */ 5113 notdone = 0; 5114 foundeom = 1; 5115 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 5116 /* end of frag, we are done */ 5117 notdone = 0; 5118 foundeom = 1; 5119 } else { 5120 /* 5121 * Its a begin or middle piece, we must mark all of 5122 * it 5123 */ 5124 notdone = 1; 5125 tp1 = TAILQ_NEXT(tp1, sctp_next); 5126 } 5127 } while (tp1 && notdone); 5128 if (foundeom == 0) { 5129 /* 5130 * The multi-part message was scattered across the send and 5131 * sent queue. 5132 */ 5133 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) { 5134 if ((tp1->rec.data.sid != sid) || 5135 (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) { 5136 break; 5137 } 5138 /* 5139 * save to chk in case we have some on stream out 5140 * queue. If so and we have an un-transmitted one we 5141 * don't have to fudge the TSN. 5142 */ 5143 chk = tp1; 5144 ret_sz += tp1->book_size; 5145 sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1); 5146 if (sent) { 5147 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked); 5148 } else { 5149 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked); 5150 } 5151 if (tp1->data) { 5152 sctp_m_freem(tp1->data); 5153 tp1->data = NULL; 5154 } 5155 /* No flight involved here book the size to 0 */ 5156 tp1->book_size = 0; 5157 if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 5158 foundeom = 1; 5159 } 5160 do_wakeup_routine = 1; 5161 tp1->sent = SCTP_FORWARD_TSN_SKIP; 5162 TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next); 5163 /* 5164 * on to the sent queue so we can wait for it to be 5165 * passed by. 5166 */ 5167 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1, 5168 sctp_next); 5169 stcb->asoc.send_queue_cnt--; 5170 stcb->asoc.sent_queue_cnt++; 5171 } 5172 } 5173 if (foundeom == 0) { 5174 /* 5175 * Still no eom found. That means there is stuff left on the 5176 * stream out queue.. yuck. 5177 */ 5178 SCTP_TCB_SEND_LOCK(stcb); 5179 strq = &stcb->asoc.strmout[sid]; 5180 sp = TAILQ_FIRST(&strq->outqueue); 5181 if (sp != NULL) { 5182 sp->discard_rest = 1; 5183 /* 5184 * We may need to put a chunk on the queue that 5185 * holds the TSN that would have been sent with the 5186 * LAST bit. 5187 */ 5188 if (chk == NULL) { 5189 /* Yep, we have to */ 5190 sctp_alloc_a_chunk(stcb, chk); 5191 if (chk == NULL) { 5192 /* 5193 * we are hosed. All we can do is 5194 * nothing.. which will cause an 5195 * abort if the peer is paying 5196 * attention. 5197 */ 5198 goto oh_well; 5199 } 5200 memset(chk, 0, sizeof(*chk)); 5201 chk->rec.data.rcv_flags = 0; 5202 chk->sent = SCTP_FORWARD_TSN_SKIP; 5203 chk->asoc = &stcb->asoc; 5204 if (stcb->asoc.idata_supported == 0) { 5205 if (sp->sinfo_flags & SCTP_UNORDERED) { 5206 chk->rec.data.mid = 0; 5207 } else { 5208 chk->rec.data.mid = strq->next_mid_ordered; 5209 } 5210 } else { 5211 if (sp->sinfo_flags & SCTP_UNORDERED) { 5212 chk->rec.data.mid = strq->next_mid_unordered; 5213 } else { 5214 chk->rec.data.mid = strq->next_mid_ordered; 5215 } 5216 } 5217 chk->rec.data.sid = sp->sid; 5218 chk->rec.data.ppid = sp->ppid; 5219 chk->rec.data.context = sp->context; 5220 chk->flags = sp->act_flags; 5221 chk->whoTo = NULL; 5222 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1); 5223 strq->chunks_on_queues++; 5224 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next); 5225 stcb->asoc.sent_queue_cnt++; 5226 stcb->asoc.pr_sctp_cnt++; 5227 } 5228 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG; 5229 if (sp->sinfo_flags & SCTP_UNORDERED) { 5230 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED; 5231 } 5232 if (stcb->asoc.idata_supported == 0) { 5233 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) { 5234 strq->next_mid_ordered++; 5235 } 5236 } else { 5237 if (sp->sinfo_flags & SCTP_UNORDERED) { 5238 strq->next_mid_unordered++; 5239 } else { 5240 strq->next_mid_ordered++; 5241 } 5242 } 5243 oh_well: 5244 if (sp->data) { 5245 /* 5246 * Pull any data to free up the SB and allow 5247 * sender to "add more" while we will throw 5248 * away :-) 5249 */ 5250 sctp_free_spbufspace(stcb, &stcb->asoc, sp); 5251 ret_sz += sp->length; 5252 do_wakeup_routine = 1; 5253 sp->some_taken = 1; 5254 sctp_m_freem(sp->data); 5255 sp->data = NULL; 5256 sp->tail_mbuf = NULL; 5257 sp->length = 0; 5258 } 5259 } 5260 SCTP_TCB_SEND_UNLOCK(stcb); 5261 } 5262 if (do_wakeup_routine) { 5263 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket); 5264 } 5265 return (ret_sz); 5266 } 5267 5268 /* 5269 * checks to see if the given address, sa, is one that is currently known by 5270 * the kernel note: can't distinguish the same address on multiple interfaces 5271 * and doesn't handle multiple addresses with different zone/scope id's note: 5272 * ifa_ifwithaddr() compares the entire sockaddr struct 5273 */ 5274 struct sctp_ifa * 5275 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr, 5276 int holds_lock) 5277 { 5278 struct sctp_laddr *laddr; 5279 5280 if (holds_lock == 0) { 5281 SCTP_INP_RLOCK(inp); 5282 } 5283 5284 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 5285 if (laddr->ifa == NULL) 5286 continue; 5287 if (addr->sa_family != laddr->ifa->address.sa.sa_family) 5288 continue; 5289 #ifdef INET 5290 if (addr->sa_family == AF_INET) { 5291 if (((struct sockaddr_in *)addr)->sin_addr.s_addr == 5292 laddr->ifa->address.sin.sin_addr.s_addr) { 5293 /* found him. */ 5294 break; 5295 } 5296 } 5297 #endif 5298 #ifdef INET6 5299 if (addr->sa_family == AF_INET6) { 5300 if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr, 5301 &laddr->ifa->address.sin6)) { 5302 /* found him. */ 5303 break; 5304 } 5305 } 5306 #endif 5307 } 5308 if (holds_lock == 0) { 5309 SCTP_INP_RUNLOCK(inp); 5310 } 5311 if (laddr != NULL) { 5312 return (laddr->ifa); 5313 } else { 5314 return (NULL); 5315 } 5316 } 5317 5318 uint32_t 5319 sctp_get_ifa_hash_val(struct sockaddr *addr) 5320 { 5321 switch (addr->sa_family) { 5322 #ifdef INET 5323 case AF_INET: 5324 { 5325 struct sockaddr_in *sin; 5326 5327 sin = (struct sockaddr_in *)addr; 5328 return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16)); 5329 } 5330 #endif 5331 #ifdef INET6 5332 case AF_INET6: 5333 { 5334 struct sockaddr_in6 *sin6; 5335 uint32_t hash_of_addr; 5336 5337 sin6 = (struct sockaddr_in6 *)addr; 5338 hash_of_addr = (sin6->sin6_addr.s6_addr32[0] + 5339 sin6->sin6_addr.s6_addr32[1] + 5340 sin6->sin6_addr.s6_addr32[2] + 5341 sin6->sin6_addr.s6_addr32[3]); 5342 hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16)); 5343 return (hash_of_addr); 5344 } 5345 #endif 5346 default: 5347 break; 5348 } 5349 return (0); 5350 } 5351 5352 struct sctp_ifa * 5353 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock) 5354 { 5355 struct sctp_ifa *sctp_ifap; 5356 struct sctp_vrf *vrf; 5357 struct sctp_ifalist *hash_head; 5358 uint32_t hash_of_addr; 5359 5360 if (holds_lock == 0) { 5361 SCTP_IPI_ADDR_RLOCK(); 5362 } else { 5363 SCTP_IPI_ADDR_LOCK_ASSERT(); 5364 } 5365 5366 vrf = sctp_find_vrf(vrf_id); 5367 if (vrf == NULL) { 5368 if (holds_lock == 0) 5369 SCTP_IPI_ADDR_RUNLOCK(); 5370 return (NULL); 5371 } 5372 5373 hash_of_addr = sctp_get_ifa_hash_val(addr); 5374 5375 hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)]; 5376 if (hash_head == NULL) { 5377 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ", 5378 hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark, 5379 (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark)); 5380 sctp_print_address(addr); 5381 SCTP_PRINTF("No such bucket for address\n"); 5382 if (holds_lock == 0) 5383 SCTP_IPI_ADDR_RUNLOCK(); 5384 5385 return (NULL); 5386 } 5387 LIST_FOREACH(sctp_ifap, hash_head, next_bucket) { 5388 if (addr->sa_family != sctp_ifap->address.sa.sa_family) 5389 continue; 5390 #ifdef INET 5391 if (addr->sa_family == AF_INET) { 5392 if (((struct sockaddr_in *)addr)->sin_addr.s_addr == 5393 sctp_ifap->address.sin.sin_addr.s_addr) { 5394 /* found him. */ 5395 break; 5396 } 5397 } 5398 #endif 5399 #ifdef INET6 5400 if (addr->sa_family == AF_INET6) { 5401 if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr, 5402 &sctp_ifap->address.sin6)) { 5403 /* found him. */ 5404 break; 5405 } 5406 } 5407 #endif 5408 } 5409 if (holds_lock == 0) 5410 SCTP_IPI_ADDR_RUNLOCK(); 5411 return (sctp_ifap); 5412 } 5413 5414 static void 5415 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock, 5416 uint32_t rwnd_req) 5417 { 5418 /* User pulled some data, do we need a rwnd update? */ 5419 struct epoch_tracker et; 5420 int r_unlocked = 0; 5421 uint32_t dif, rwnd; 5422 struct socket *so = NULL; 5423 5424 if (stcb == NULL) 5425 return; 5426 5427 atomic_add_int(&stcb->asoc.refcnt, 1); 5428 5429 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 5430 (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED | SCTP_STATE_SHUTDOWN_RECEIVED))) { 5431 /* Pre-check If we are freeing no update */ 5432 goto no_lock; 5433 } 5434 SCTP_INP_INCR_REF(stcb->sctp_ep); 5435 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 5436 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 5437 goto out; 5438 } 5439 so = stcb->sctp_socket; 5440 if (so == NULL) { 5441 goto out; 5442 } 5443 atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far); 5444 /* Have you have freed enough to look */ 5445 *freed_so_far = 0; 5446 /* Yep, its worth a look and the lock overhead */ 5447 5448 /* Figure out what the rwnd would be */ 5449 rwnd = sctp_calc_rwnd(stcb, &stcb->asoc); 5450 if (rwnd >= stcb->asoc.my_last_reported_rwnd) { 5451 dif = rwnd - stcb->asoc.my_last_reported_rwnd; 5452 } else { 5453 dif = 0; 5454 } 5455 if (dif >= rwnd_req) { 5456 if (hold_rlock) { 5457 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 5458 r_unlocked = 1; 5459 } 5460 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 5461 /* 5462 * One last check before we allow the guy possibly 5463 * to get in. There is a race, where the guy has not 5464 * reached the gate. In that case 5465 */ 5466 goto out; 5467 } 5468 SCTP_TCB_LOCK(stcb); 5469 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 5470 /* No reports here */ 5471 SCTP_TCB_UNLOCK(stcb); 5472 goto out; 5473 } 5474 SCTP_STAT_INCR(sctps_wu_sacks_sent); 5475 NET_EPOCH_ENTER(et); 5476 sctp_send_sack(stcb, SCTP_SO_LOCKED); 5477 5478 sctp_chunk_output(stcb->sctp_ep, stcb, 5479 SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED); 5480 /* make sure no timer is running */ 5481 NET_EPOCH_EXIT(et); 5482 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, 5483 SCTP_FROM_SCTPUTIL + SCTP_LOC_6); 5484 SCTP_TCB_UNLOCK(stcb); 5485 } else { 5486 /* Update how much we have pending */ 5487 stcb->freed_by_sorcv_sincelast = dif; 5488 } 5489 out: 5490 if (so && r_unlocked && hold_rlock) { 5491 SCTP_INP_READ_LOCK(stcb->sctp_ep); 5492 } 5493 5494 SCTP_INP_DECR_REF(stcb->sctp_ep); 5495 no_lock: 5496 atomic_add_int(&stcb->asoc.refcnt, -1); 5497 return; 5498 } 5499 5500 int 5501 sctp_sorecvmsg(struct socket *so, 5502 struct uio *uio, 5503 struct mbuf **mp, 5504 struct sockaddr *from, 5505 int fromlen, 5506 int *msg_flags, 5507 struct sctp_sndrcvinfo *sinfo, 5508 int filling_sinfo) 5509 { 5510 /* 5511 * MSG flags we will look at MSG_DONTWAIT - non-blocking IO. 5512 * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy 5513 * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ?? 5514 * On the way out we may send out any combination of: 5515 * MSG_NOTIFICATION MSG_EOR 5516 * 5517 */ 5518 struct sctp_inpcb *inp = NULL; 5519 ssize_t my_len = 0; 5520 ssize_t cp_len = 0; 5521 int error = 0; 5522 struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL; 5523 struct mbuf *m = NULL; 5524 struct sctp_tcb *stcb = NULL; 5525 int wakeup_read_socket = 0; 5526 int freecnt_applied = 0; 5527 int out_flags = 0, in_flags = 0; 5528 int block_allowed = 1; 5529 uint32_t freed_so_far = 0; 5530 ssize_t copied_so_far = 0; 5531 int in_eeor_mode = 0; 5532 int no_rcv_needed = 0; 5533 uint32_t rwnd_req = 0; 5534 int hold_sblock = 0; 5535 int hold_rlock = 0; 5536 ssize_t slen = 0; 5537 uint32_t held_length = 0; 5538 int sockbuf_lock = 0; 5539 5540 if (uio == NULL) { 5541 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 5542 return (EINVAL); 5543 } 5544 5545 if (msg_flags) { 5546 in_flags = *msg_flags; 5547 if (in_flags & MSG_PEEK) 5548 SCTP_STAT_INCR(sctps_read_peeks); 5549 } else { 5550 in_flags = 0; 5551 } 5552 slen = uio->uio_resid; 5553 5554 /* Pull in and set up our int flags */ 5555 if (in_flags & MSG_OOB) { 5556 /* Out of band's NOT supported */ 5557 return (EOPNOTSUPP); 5558 } 5559 if ((in_flags & MSG_PEEK) && (mp != NULL)) { 5560 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 5561 return (EINVAL); 5562 } 5563 if ((in_flags & (MSG_DONTWAIT 5564 | MSG_NBIO 5565 )) || 5566 SCTP_SO_IS_NBIO(so)) { 5567 block_allowed = 0; 5568 } 5569 /* setup the endpoint */ 5570 inp = (struct sctp_inpcb *)so->so_pcb; 5571 if (inp == NULL) { 5572 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT); 5573 return (EFAULT); 5574 } 5575 rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT); 5576 /* Must be at least a MTU's worth */ 5577 if (rwnd_req < SCTP_MIN_RWND) 5578 rwnd_req = SCTP_MIN_RWND; 5579 in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 5580 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) { 5581 sctp_misc_ints(SCTP_SORECV_ENTER, 5582 rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid); 5583 } 5584 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) { 5585 sctp_misc_ints(SCTP_SORECV_ENTERPL, 5586 rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid); 5587 } 5588 5589 error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0)); 5590 if (error) { 5591 goto release_unlocked; 5592 } 5593 sockbuf_lock = 1; 5594 restart: 5595 5596 restart_nosblocks: 5597 if (hold_sblock == 0) { 5598 SOCKBUF_LOCK(&so->so_rcv); 5599 hold_sblock = 1; 5600 } 5601 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 5602 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 5603 goto out; 5604 } 5605 if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) { 5606 if (so->so_error) { 5607 error = so->so_error; 5608 if ((in_flags & MSG_PEEK) == 0) 5609 so->so_error = 0; 5610 goto out; 5611 } else { 5612 if (so->so_rcv.sb_cc == 0) { 5613 /* indicate EOF */ 5614 error = 0; 5615 goto out; 5616 } 5617 } 5618 } 5619 if (so->so_rcv.sb_cc <= held_length) { 5620 if (so->so_error) { 5621 error = so->so_error; 5622 if ((in_flags & MSG_PEEK) == 0) { 5623 so->so_error = 0; 5624 } 5625 goto out; 5626 } 5627 if ((so->so_rcv.sb_cc == 0) && 5628 ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 5629 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 5630 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) { 5631 /* 5632 * For active open side clear flags for 5633 * re-use passive open is blocked by 5634 * connect. 5635 */ 5636 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) { 5637 /* 5638 * You were aborted, passive side 5639 * always hits here 5640 */ 5641 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET); 5642 error = ECONNRESET; 5643 } 5644 so->so_state &= ~(SS_ISCONNECTING | 5645 SS_ISDISCONNECTING | 5646 SS_ISCONFIRMING | 5647 SS_ISCONNECTED); 5648 if (error == 0) { 5649 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) { 5650 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN); 5651 error = ENOTCONN; 5652 } 5653 } 5654 goto out; 5655 } 5656 } 5657 if (block_allowed) { 5658 error = sbwait(&so->so_rcv); 5659 if (error) { 5660 goto out; 5661 } 5662 held_length = 0; 5663 goto restart_nosblocks; 5664 } else { 5665 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK); 5666 error = EWOULDBLOCK; 5667 goto out; 5668 } 5669 } 5670 if (hold_sblock == 1) { 5671 SOCKBUF_UNLOCK(&so->so_rcv); 5672 hold_sblock = 0; 5673 } 5674 /* we possibly have data we can read */ 5675 /* sa_ignore FREED_MEMORY */ 5676 control = TAILQ_FIRST(&inp->read_queue); 5677 if (control == NULL) { 5678 /* 5679 * This could be happening since the appender did the 5680 * increment but as not yet did the tailq insert onto the 5681 * read_queue 5682 */ 5683 if (hold_rlock == 0) { 5684 SCTP_INP_READ_LOCK(inp); 5685 } 5686 control = TAILQ_FIRST(&inp->read_queue); 5687 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) { 5688 #ifdef INVARIANTS 5689 panic("Huh, its non zero and nothing on control?"); 5690 #endif 5691 so->so_rcv.sb_cc = 0; 5692 } 5693 SCTP_INP_READ_UNLOCK(inp); 5694 hold_rlock = 0; 5695 goto restart; 5696 } 5697 5698 if ((control->length == 0) && 5699 (control->do_not_ref_stcb)) { 5700 /* 5701 * Clean up code for freeing assoc that left behind a 5702 * pdapi.. maybe a peer in EEOR that just closed after 5703 * sending and never indicated a EOR. 5704 */ 5705 if (hold_rlock == 0) { 5706 hold_rlock = 1; 5707 SCTP_INP_READ_LOCK(inp); 5708 } 5709 control->held_length = 0; 5710 if (control->data) { 5711 /* Hmm there is data here .. fix */ 5712 struct mbuf *m_tmp; 5713 int cnt = 0; 5714 5715 m_tmp = control->data; 5716 while (m_tmp) { 5717 cnt += SCTP_BUF_LEN(m_tmp); 5718 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 5719 control->tail_mbuf = m_tmp; 5720 control->end_added = 1; 5721 } 5722 m_tmp = SCTP_BUF_NEXT(m_tmp); 5723 } 5724 control->length = cnt; 5725 } else { 5726 /* remove it */ 5727 TAILQ_REMOVE(&inp->read_queue, control, next); 5728 /* Add back any hiddend data */ 5729 sctp_free_remote_addr(control->whoFrom); 5730 sctp_free_a_readq(stcb, control); 5731 } 5732 if (hold_rlock) { 5733 hold_rlock = 0; 5734 SCTP_INP_READ_UNLOCK(inp); 5735 } 5736 goto restart; 5737 } 5738 if ((control->length == 0) && 5739 (control->end_added == 1)) { 5740 /* 5741 * Do we also need to check for (control->pdapi_aborted == 5742 * 1)? 5743 */ 5744 if (hold_rlock == 0) { 5745 hold_rlock = 1; 5746 SCTP_INP_READ_LOCK(inp); 5747 } 5748 TAILQ_REMOVE(&inp->read_queue, control, next); 5749 if (control->data) { 5750 #ifdef INVARIANTS 5751 panic("control->data not null but control->length == 0"); 5752 #else 5753 SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n"); 5754 sctp_m_freem(control->data); 5755 control->data = NULL; 5756 #endif 5757 } 5758 if (control->aux_data) { 5759 sctp_m_free(control->aux_data); 5760 control->aux_data = NULL; 5761 } 5762 #ifdef INVARIANTS 5763 if (control->on_strm_q) { 5764 panic("About to free ctl:%p so:%p and its in %d", 5765 control, so, control->on_strm_q); 5766 } 5767 #endif 5768 sctp_free_remote_addr(control->whoFrom); 5769 sctp_free_a_readq(stcb, control); 5770 if (hold_rlock) { 5771 hold_rlock = 0; 5772 SCTP_INP_READ_UNLOCK(inp); 5773 } 5774 goto restart; 5775 } 5776 if (control->length == 0) { 5777 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) && 5778 (filling_sinfo)) { 5779 /* find a more suitable one then this */ 5780 ctl = TAILQ_NEXT(control, next); 5781 while (ctl) { 5782 if ((ctl->stcb != control->stcb) && (ctl->length) && 5783 (ctl->some_taken || 5784 (ctl->spec_flags & M_NOTIFICATION) || 5785 ((ctl->do_not_ref_stcb == 0) && 5786 (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0))) 5787 ) { 5788 /*- 5789 * If we have a different TCB next, and there is data 5790 * present. If we have already taken some (pdapi), OR we can 5791 * ref the tcb and no delivery as started on this stream, we 5792 * take it. Note we allow a notification on a different 5793 * assoc to be delivered.. 5794 */ 5795 control = ctl; 5796 goto found_one; 5797 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) && 5798 (ctl->length) && 5799 ((ctl->some_taken) || 5800 ((ctl->do_not_ref_stcb == 0) && 5801 ((ctl->spec_flags & M_NOTIFICATION) == 0) && 5802 (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) { 5803 /*- 5804 * If we have the same tcb, and there is data present, and we 5805 * have the strm interleave feature present. Then if we have 5806 * taken some (pdapi) or we can refer to tht tcb AND we have 5807 * not started a delivery for this stream, we can take it. 5808 * Note we do NOT allow a notificaiton on the same assoc to 5809 * be delivered. 5810 */ 5811 control = ctl; 5812 goto found_one; 5813 } 5814 ctl = TAILQ_NEXT(ctl, next); 5815 } 5816 } 5817 /* 5818 * if we reach here, not suitable replacement is available 5819 * <or> fragment interleave is NOT on. So stuff the sb_cc 5820 * into the our held count, and its time to sleep again. 5821 */ 5822 held_length = so->so_rcv.sb_cc; 5823 control->held_length = so->so_rcv.sb_cc; 5824 goto restart; 5825 } 5826 /* Clear the held length since there is something to read */ 5827 control->held_length = 0; 5828 found_one: 5829 /* 5830 * If we reach here, control has a some data for us to read off. 5831 * Note that stcb COULD be NULL. 5832 */ 5833 if (hold_rlock == 0) { 5834 hold_rlock = 1; 5835 SCTP_INP_READ_LOCK(inp); 5836 } 5837 control->some_taken++; 5838 stcb = control->stcb; 5839 if (stcb) { 5840 if ((control->do_not_ref_stcb == 0) && 5841 (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) { 5842 if (freecnt_applied == 0) 5843 stcb = NULL; 5844 } else if (control->do_not_ref_stcb == 0) { 5845 /* you can't free it on me please */ 5846 /* 5847 * The lock on the socket buffer protects us so the 5848 * free code will stop. But since we used the 5849 * socketbuf lock and the sender uses the tcb_lock 5850 * to increment, we need to use the atomic add to 5851 * the refcnt 5852 */ 5853 if (freecnt_applied) { 5854 #ifdef INVARIANTS 5855 panic("refcnt already incremented"); 5856 #else 5857 SCTP_PRINTF("refcnt already incremented?\n"); 5858 #endif 5859 } else { 5860 atomic_add_int(&stcb->asoc.refcnt, 1); 5861 freecnt_applied = 1; 5862 } 5863 /* 5864 * Setup to remember how much we have not yet told 5865 * the peer our rwnd has opened up. Note we grab the 5866 * value from the tcb from last time. Note too that 5867 * sack sending clears this when a sack is sent, 5868 * which is fine. Once we hit the rwnd_req, we then 5869 * will go to the sctp_user_rcvd() that will not 5870 * lock until it KNOWs it MUST send a WUP-SACK. 5871 */ 5872 freed_so_far = (uint32_t)stcb->freed_by_sorcv_sincelast; 5873 stcb->freed_by_sorcv_sincelast = 0; 5874 } 5875 } 5876 if (stcb && 5877 ((control->spec_flags & M_NOTIFICATION) == 0) && 5878 control->do_not_ref_stcb == 0) { 5879 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1; 5880 } 5881 5882 /* First lets get off the sinfo and sockaddr info */ 5883 if ((sinfo != NULL) && (filling_sinfo != 0)) { 5884 sinfo->sinfo_stream = control->sinfo_stream; 5885 sinfo->sinfo_ssn = (uint16_t)control->mid; 5886 sinfo->sinfo_flags = control->sinfo_flags; 5887 sinfo->sinfo_ppid = control->sinfo_ppid; 5888 sinfo->sinfo_context = control->sinfo_context; 5889 sinfo->sinfo_timetolive = control->sinfo_timetolive; 5890 sinfo->sinfo_tsn = control->sinfo_tsn; 5891 sinfo->sinfo_cumtsn = control->sinfo_cumtsn; 5892 sinfo->sinfo_assoc_id = control->sinfo_assoc_id; 5893 nxt = TAILQ_NEXT(control, next); 5894 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) || 5895 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) { 5896 struct sctp_extrcvinfo *s_extra; 5897 5898 s_extra = (struct sctp_extrcvinfo *)sinfo; 5899 if ((nxt) && 5900 (nxt->length)) { 5901 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL; 5902 if (nxt->sinfo_flags & SCTP_UNORDERED) { 5903 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED; 5904 } 5905 if (nxt->spec_flags & M_NOTIFICATION) { 5906 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION; 5907 } 5908 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id; 5909 s_extra->serinfo_next_length = nxt->length; 5910 s_extra->serinfo_next_ppid = nxt->sinfo_ppid; 5911 s_extra->serinfo_next_stream = nxt->sinfo_stream; 5912 if (nxt->tail_mbuf != NULL) { 5913 if (nxt->end_added) { 5914 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE; 5915 } 5916 } 5917 } else { 5918 /* 5919 * we explicitly 0 this, since the memcpy 5920 * got some other things beyond the older 5921 * sinfo_ that is on the control's structure 5922 * :-D 5923 */ 5924 nxt = NULL; 5925 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG; 5926 s_extra->serinfo_next_aid = 0; 5927 s_extra->serinfo_next_length = 0; 5928 s_extra->serinfo_next_ppid = 0; 5929 s_extra->serinfo_next_stream = 0; 5930 } 5931 } 5932 /* 5933 * update off the real current cum-ack, if we have an stcb. 5934 */ 5935 if ((control->do_not_ref_stcb == 0) && stcb) 5936 sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn; 5937 /* 5938 * mask off the high bits, we keep the actual chunk bits in 5939 * there. 5940 */ 5941 sinfo->sinfo_flags &= 0x00ff; 5942 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) { 5943 sinfo->sinfo_flags |= SCTP_UNORDERED; 5944 } 5945 } 5946 #ifdef SCTP_ASOCLOG_OF_TSNS 5947 { 5948 int index, newindex; 5949 struct sctp_pcbtsn_rlog *entry; 5950 5951 do { 5952 index = inp->readlog_index; 5953 newindex = index + 1; 5954 if (newindex >= SCTP_READ_LOG_SIZE) { 5955 newindex = 0; 5956 } 5957 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0); 5958 entry = &inp->readlog[index]; 5959 entry->vtag = control->sinfo_assoc_id; 5960 entry->strm = control->sinfo_stream; 5961 entry->seq = (uint16_t)control->mid; 5962 entry->sz = control->length; 5963 entry->flgs = control->sinfo_flags; 5964 } 5965 #endif 5966 if ((fromlen > 0) && (from != NULL)) { 5967 union sctp_sockstore store; 5968 size_t len; 5969 5970 switch (control->whoFrom->ro._l_addr.sa.sa_family) { 5971 #ifdef INET6 5972 case AF_INET6: 5973 len = sizeof(struct sockaddr_in6); 5974 store.sin6 = control->whoFrom->ro._l_addr.sin6; 5975 store.sin6.sin6_port = control->port_from; 5976 break; 5977 #endif 5978 #ifdef INET 5979 case AF_INET: 5980 #ifdef INET6 5981 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) { 5982 len = sizeof(struct sockaddr_in6); 5983 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin, 5984 &store.sin6); 5985 store.sin6.sin6_port = control->port_from; 5986 } else { 5987 len = sizeof(struct sockaddr_in); 5988 store.sin = control->whoFrom->ro._l_addr.sin; 5989 store.sin.sin_port = control->port_from; 5990 } 5991 #else 5992 len = sizeof(struct sockaddr_in); 5993 store.sin = control->whoFrom->ro._l_addr.sin; 5994 store.sin.sin_port = control->port_from; 5995 #endif 5996 break; 5997 #endif 5998 default: 5999 len = 0; 6000 break; 6001 } 6002 memcpy(from, &store, min((size_t)fromlen, len)); 6003 #ifdef INET6 6004 { 6005 struct sockaddr_in6 lsa6, *from6; 6006 6007 from6 = (struct sockaddr_in6 *)from; 6008 sctp_recover_scope_mac(from6, (&lsa6)); 6009 } 6010 #endif 6011 } 6012 if (hold_rlock) { 6013 SCTP_INP_READ_UNLOCK(inp); 6014 hold_rlock = 0; 6015 } 6016 if (hold_sblock) { 6017 SOCKBUF_UNLOCK(&so->so_rcv); 6018 hold_sblock = 0; 6019 } 6020 /* now copy out what data we can */ 6021 if (mp == NULL) { 6022 /* copy out each mbuf in the chain up to length */ 6023 get_more_data: 6024 m = control->data; 6025 while (m) { 6026 /* Move out all we can */ 6027 cp_len = uio->uio_resid; 6028 my_len = SCTP_BUF_LEN(m); 6029 if (cp_len > my_len) { 6030 /* not enough in this buf */ 6031 cp_len = my_len; 6032 } 6033 if (hold_rlock) { 6034 SCTP_INP_READ_UNLOCK(inp); 6035 hold_rlock = 0; 6036 } 6037 if (cp_len > 0) 6038 error = uiomove(mtod(m, char *), (int)cp_len, uio); 6039 /* re-read */ 6040 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 6041 goto release; 6042 } 6043 6044 if ((control->do_not_ref_stcb == 0) && stcb && 6045 stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 6046 no_rcv_needed = 1; 6047 } 6048 if (error) { 6049 /* error we are out of here */ 6050 goto release; 6051 } 6052 SCTP_INP_READ_LOCK(inp); 6053 hold_rlock = 1; 6054 if (cp_len == SCTP_BUF_LEN(m)) { 6055 if ((SCTP_BUF_NEXT(m) == NULL) && 6056 (control->end_added)) { 6057 out_flags |= MSG_EOR; 6058 if ((control->do_not_ref_stcb == 0) && 6059 (control->stcb != NULL) && 6060 ((control->spec_flags & M_NOTIFICATION) == 0)) 6061 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 6062 } 6063 if (control->spec_flags & M_NOTIFICATION) { 6064 out_flags |= MSG_NOTIFICATION; 6065 } 6066 /* we ate up the mbuf */ 6067 if (in_flags & MSG_PEEK) { 6068 /* just looking */ 6069 m = SCTP_BUF_NEXT(m); 6070 copied_so_far += cp_len; 6071 } else { 6072 /* dispose of the mbuf */ 6073 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6074 sctp_sblog(&so->so_rcv, 6075 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m)); 6076 } 6077 sctp_sbfree(control, stcb, &so->so_rcv, m); 6078 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6079 sctp_sblog(&so->so_rcv, 6080 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 6081 } 6082 copied_so_far += cp_len; 6083 freed_so_far += (uint32_t)cp_len; 6084 freed_so_far += MSIZE; 6085 atomic_subtract_int(&control->length, cp_len); 6086 control->data = sctp_m_free(m); 6087 m = control->data; 6088 /* 6089 * been through it all, must hold sb 6090 * lock ok to null tail 6091 */ 6092 if (control->data == NULL) { 6093 #ifdef INVARIANTS 6094 if ((control->end_added == 0) || 6095 (TAILQ_NEXT(control, next) == NULL)) { 6096 /* 6097 * If the end is not 6098 * added, OR the 6099 * next is NOT null 6100 * we MUST have the 6101 * lock. 6102 */ 6103 if (mtx_owned(&inp->inp_rdata_mtx) == 0) { 6104 panic("Hmm we don't own the lock?"); 6105 } 6106 } 6107 #endif 6108 control->tail_mbuf = NULL; 6109 #ifdef INVARIANTS 6110 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) { 6111 panic("end_added, nothing left and no MSG_EOR"); 6112 } 6113 #endif 6114 } 6115 } 6116 } else { 6117 /* Do we need to trim the mbuf? */ 6118 if (control->spec_flags & M_NOTIFICATION) { 6119 out_flags |= MSG_NOTIFICATION; 6120 } 6121 if ((in_flags & MSG_PEEK) == 0) { 6122 SCTP_BUF_RESV_UF(m, cp_len); 6123 SCTP_BUF_LEN(m) -= (int)cp_len; 6124 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6125 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, (int)cp_len); 6126 } 6127 atomic_subtract_int(&so->so_rcv.sb_cc, cp_len); 6128 if ((control->do_not_ref_stcb == 0) && 6129 stcb) { 6130 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len); 6131 } 6132 copied_so_far += cp_len; 6133 freed_so_far += (uint32_t)cp_len; 6134 freed_so_far += MSIZE; 6135 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6136 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, 6137 SCTP_LOG_SBRESULT, 0); 6138 } 6139 atomic_subtract_int(&control->length, cp_len); 6140 } else { 6141 copied_so_far += cp_len; 6142 } 6143 } 6144 if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) { 6145 break; 6146 } 6147 if (((stcb) && (in_flags & MSG_PEEK) == 0) && 6148 (control->do_not_ref_stcb == 0) && 6149 (freed_so_far >= rwnd_req)) { 6150 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 6151 } 6152 } /* end while(m) */ 6153 /* 6154 * At this point we have looked at it all and we either have 6155 * a MSG_EOR/or read all the user wants... <OR> 6156 * control->length == 0. 6157 */ 6158 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) { 6159 /* we are done with this control */ 6160 if (control->length == 0) { 6161 if (control->data) { 6162 #ifdef INVARIANTS 6163 panic("control->data not null at read eor?"); 6164 #else 6165 SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n"); 6166 sctp_m_freem(control->data); 6167 control->data = NULL; 6168 #endif 6169 } 6170 done_with_control: 6171 if (hold_rlock == 0) { 6172 SCTP_INP_READ_LOCK(inp); 6173 hold_rlock = 1; 6174 } 6175 TAILQ_REMOVE(&inp->read_queue, control, next); 6176 /* Add back any hiddend data */ 6177 if (control->held_length) { 6178 held_length = 0; 6179 control->held_length = 0; 6180 wakeup_read_socket = 1; 6181 } 6182 if (control->aux_data) { 6183 sctp_m_free(control->aux_data); 6184 control->aux_data = NULL; 6185 } 6186 no_rcv_needed = control->do_not_ref_stcb; 6187 sctp_free_remote_addr(control->whoFrom); 6188 control->data = NULL; 6189 #ifdef INVARIANTS 6190 if (control->on_strm_q) { 6191 panic("About to free ctl:%p so:%p and its in %d", 6192 control, so, control->on_strm_q); 6193 } 6194 #endif 6195 sctp_free_a_readq(stcb, control); 6196 control = NULL; 6197 if ((freed_so_far >= rwnd_req) && 6198 (no_rcv_needed == 0)) 6199 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 6200 6201 } else { 6202 /* 6203 * The user did not read all of this 6204 * message, turn off the returned MSG_EOR 6205 * since we are leaving more behind on the 6206 * control to read. 6207 */ 6208 #ifdef INVARIANTS 6209 if (control->end_added && 6210 (control->data == NULL) && 6211 (control->tail_mbuf == NULL)) { 6212 panic("Gak, control->length is corrupt?"); 6213 } 6214 #endif 6215 no_rcv_needed = control->do_not_ref_stcb; 6216 out_flags &= ~MSG_EOR; 6217 } 6218 } 6219 if (out_flags & MSG_EOR) { 6220 goto release; 6221 } 6222 if ((uio->uio_resid == 0) || 6223 ((in_eeor_mode) && 6224 (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))) { 6225 goto release; 6226 } 6227 /* 6228 * If I hit here the receiver wants more and this message is 6229 * NOT done (pd-api). So two questions. Can we block? if not 6230 * we are done. Did the user NOT set MSG_WAITALL? 6231 */ 6232 if (block_allowed == 0) { 6233 goto release; 6234 } 6235 /* 6236 * We need to wait for more data a few things: - We don't 6237 * sbunlock() so we don't get someone else reading. - We 6238 * must be sure to account for the case where what is added 6239 * is NOT to our control when we wakeup. 6240 */ 6241 6242 /* 6243 * Do we need to tell the transport a rwnd update might be 6244 * needed before we go to sleep? 6245 */ 6246 if (((stcb) && (in_flags & MSG_PEEK) == 0) && 6247 ((freed_so_far >= rwnd_req) && 6248 (control->do_not_ref_stcb == 0) && 6249 (no_rcv_needed == 0))) { 6250 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 6251 } 6252 wait_some_more: 6253 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) { 6254 goto release; 6255 } 6256 6257 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) 6258 goto release; 6259 6260 if (hold_rlock == 1) { 6261 SCTP_INP_READ_UNLOCK(inp); 6262 hold_rlock = 0; 6263 } 6264 if (hold_sblock == 0) { 6265 SOCKBUF_LOCK(&so->so_rcv); 6266 hold_sblock = 1; 6267 } 6268 if ((copied_so_far) && (control->length == 0) && 6269 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) { 6270 goto release; 6271 } 6272 if (so->so_rcv.sb_cc <= control->held_length) { 6273 error = sbwait(&so->so_rcv); 6274 if (error) { 6275 goto release; 6276 } 6277 control->held_length = 0; 6278 } 6279 if (hold_sblock) { 6280 SOCKBUF_UNLOCK(&so->so_rcv); 6281 hold_sblock = 0; 6282 } 6283 if (control->length == 0) { 6284 /* still nothing here */ 6285 if (control->end_added == 1) { 6286 /* he aborted, or is done i.e.did a shutdown */ 6287 out_flags |= MSG_EOR; 6288 if (control->pdapi_aborted) { 6289 if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0)) 6290 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 6291 6292 out_flags |= MSG_TRUNC; 6293 } else { 6294 if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0)) 6295 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 6296 } 6297 goto done_with_control; 6298 } 6299 if (so->so_rcv.sb_cc > held_length) { 6300 control->held_length = so->so_rcv.sb_cc; 6301 held_length = 0; 6302 } 6303 goto wait_some_more; 6304 } else if (control->data == NULL) { 6305 /* 6306 * we must re-sync since data is probably being 6307 * added 6308 */ 6309 SCTP_INP_READ_LOCK(inp); 6310 if ((control->length > 0) && (control->data == NULL)) { 6311 /* 6312 * big trouble.. we have the lock and its 6313 * corrupt? 6314 */ 6315 #ifdef INVARIANTS 6316 panic("Impossible data==NULL length !=0"); 6317 #endif 6318 out_flags |= MSG_EOR; 6319 out_flags |= MSG_TRUNC; 6320 control->length = 0; 6321 SCTP_INP_READ_UNLOCK(inp); 6322 goto done_with_control; 6323 } 6324 SCTP_INP_READ_UNLOCK(inp); 6325 /* We will fall around to get more data */ 6326 } 6327 goto get_more_data; 6328 } else { 6329 /*- 6330 * Give caller back the mbuf chain, 6331 * store in uio_resid the length 6332 */ 6333 wakeup_read_socket = 0; 6334 if ((control->end_added == 0) || 6335 (TAILQ_NEXT(control, next) == NULL)) { 6336 /* Need to get rlock */ 6337 if (hold_rlock == 0) { 6338 SCTP_INP_READ_LOCK(inp); 6339 hold_rlock = 1; 6340 } 6341 } 6342 if (control->end_added) { 6343 out_flags |= MSG_EOR; 6344 if ((control->do_not_ref_stcb == 0) && 6345 (control->stcb != NULL) && 6346 ((control->spec_flags & M_NOTIFICATION) == 0)) 6347 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 6348 } 6349 if (control->spec_flags & M_NOTIFICATION) { 6350 out_flags |= MSG_NOTIFICATION; 6351 } 6352 uio->uio_resid = control->length; 6353 *mp = control->data; 6354 m = control->data; 6355 while (m) { 6356 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6357 sctp_sblog(&so->so_rcv, 6358 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m)); 6359 } 6360 sctp_sbfree(control, stcb, &so->so_rcv, m); 6361 freed_so_far += (uint32_t)SCTP_BUF_LEN(m); 6362 freed_so_far += MSIZE; 6363 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6364 sctp_sblog(&so->so_rcv, 6365 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 6366 } 6367 m = SCTP_BUF_NEXT(m); 6368 } 6369 control->data = control->tail_mbuf = NULL; 6370 control->length = 0; 6371 if (out_flags & MSG_EOR) { 6372 /* Done with this control */ 6373 goto done_with_control; 6374 } 6375 } 6376 release: 6377 if (hold_rlock == 1) { 6378 SCTP_INP_READ_UNLOCK(inp); 6379 hold_rlock = 0; 6380 } 6381 if (hold_sblock == 1) { 6382 SOCKBUF_UNLOCK(&so->so_rcv); 6383 hold_sblock = 0; 6384 } 6385 6386 sbunlock(&so->so_rcv); 6387 sockbuf_lock = 0; 6388 6389 release_unlocked: 6390 if (hold_sblock) { 6391 SOCKBUF_UNLOCK(&so->so_rcv); 6392 hold_sblock = 0; 6393 } 6394 if ((stcb) && (in_flags & MSG_PEEK) == 0) { 6395 if ((freed_so_far >= rwnd_req) && 6396 (control && (control->do_not_ref_stcb == 0)) && 6397 (no_rcv_needed == 0)) 6398 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 6399 } 6400 out: 6401 if (msg_flags) { 6402 *msg_flags = out_flags; 6403 } 6404 if (((out_flags & MSG_EOR) == 0) && 6405 ((in_flags & MSG_PEEK) == 0) && 6406 (sinfo) && 6407 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) || 6408 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) { 6409 struct sctp_extrcvinfo *s_extra; 6410 6411 s_extra = (struct sctp_extrcvinfo *)sinfo; 6412 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG; 6413 } 6414 if (hold_rlock == 1) { 6415 SCTP_INP_READ_UNLOCK(inp); 6416 } 6417 if (hold_sblock) { 6418 SOCKBUF_UNLOCK(&so->so_rcv); 6419 } 6420 if (sockbuf_lock) { 6421 sbunlock(&so->so_rcv); 6422 } 6423 6424 if (freecnt_applied) { 6425 /* 6426 * The lock on the socket buffer protects us so the free 6427 * code will stop. But since we used the socketbuf lock and 6428 * the sender uses the tcb_lock to increment, we need to use 6429 * the atomic add to the refcnt. 6430 */ 6431 if (stcb == NULL) { 6432 #ifdef INVARIANTS 6433 panic("stcb for refcnt has gone NULL?"); 6434 goto stage_left; 6435 #else 6436 goto stage_left; 6437 #endif 6438 } 6439 /* Save the value back for next time */ 6440 stcb->freed_by_sorcv_sincelast = freed_so_far; 6441 atomic_add_int(&stcb->asoc.refcnt, -1); 6442 } 6443 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) { 6444 if (stcb) { 6445 sctp_misc_ints(SCTP_SORECV_DONE, 6446 freed_so_far, 6447 (uint32_t)((uio) ? (slen - uio->uio_resid) : slen), 6448 stcb->asoc.my_rwnd, 6449 so->so_rcv.sb_cc); 6450 } else { 6451 sctp_misc_ints(SCTP_SORECV_DONE, 6452 freed_so_far, 6453 (uint32_t)((uio) ? (slen - uio->uio_resid) : slen), 6454 0, 6455 so->so_rcv.sb_cc); 6456 } 6457 } 6458 stage_left: 6459 if (wakeup_read_socket) { 6460 sctp_sorwakeup(inp, so); 6461 } 6462 return (error); 6463 } 6464 6465 #ifdef SCTP_MBUF_LOGGING 6466 struct mbuf * 6467 sctp_m_free(struct mbuf *m) 6468 { 6469 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6470 sctp_log_mb(m, SCTP_MBUF_IFREE); 6471 } 6472 return (m_free(m)); 6473 } 6474 6475 void 6476 sctp_m_freem(struct mbuf *mb) 6477 { 6478 while (mb != NULL) 6479 mb = sctp_m_free(mb); 6480 } 6481 6482 #endif 6483 6484 int 6485 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id) 6486 { 6487 /* 6488 * Given a local address. For all associations that holds the 6489 * address, request a peer-set-primary. 6490 */ 6491 struct sctp_ifa *ifa; 6492 struct sctp_laddr *wi; 6493 6494 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED); 6495 if (ifa == NULL) { 6496 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL); 6497 return (EADDRNOTAVAIL); 6498 } 6499 /* 6500 * Now that we have the ifa we must awaken the iterator with this 6501 * message. 6502 */ 6503 wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr); 6504 if (wi == NULL) { 6505 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 6506 return (ENOMEM); 6507 } 6508 /* Now incr the count and int wi structure */ 6509 SCTP_INCR_LADDR_COUNT(); 6510 memset(wi, 0, sizeof(*wi)); 6511 (void)SCTP_GETTIME_TIMEVAL(&wi->start_time); 6512 wi->ifa = ifa; 6513 wi->action = SCTP_SET_PRIM_ADDR; 6514 atomic_add_int(&ifa->refcount, 1); 6515 6516 /* Now add it to the work queue */ 6517 SCTP_WQ_ADDR_LOCK(); 6518 /* 6519 * Should this really be a tailq? As it is we will process the 6520 * newest first :-0 6521 */ 6522 LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr); 6523 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ, 6524 (struct sctp_inpcb *)NULL, 6525 (struct sctp_tcb *)NULL, 6526 (struct sctp_nets *)NULL); 6527 SCTP_WQ_ADDR_UNLOCK(); 6528 return (0); 6529 } 6530 6531 int 6532 sctp_soreceive(struct socket *so, 6533 struct sockaddr **psa, 6534 struct uio *uio, 6535 struct mbuf **mp0, 6536 struct mbuf **controlp, 6537 int *flagsp) 6538 { 6539 int error, fromlen; 6540 uint8_t sockbuf[256]; 6541 struct sockaddr *from; 6542 struct sctp_extrcvinfo sinfo; 6543 int filling_sinfo = 1; 6544 int flags; 6545 struct sctp_inpcb *inp; 6546 6547 inp = (struct sctp_inpcb *)so->so_pcb; 6548 /* pickup the assoc we are reading from */ 6549 if (inp == NULL) { 6550 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6551 return (EINVAL); 6552 } 6553 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) && 6554 sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) && 6555 sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) || 6556 (controlp == NULL)) { 6557 /* user does not want the sndrcv ctl */ 6558 filling_sinfo = 0; 6559 } 6560 if (psa) { 6561 from = (struct sockaddr *)sockbuf; 6562 fromlen = sizeof(sockbuf); 6563 from->sa_len = 0; 6564 } else { 6565 from = NULL; 6566 fromlen = 0; 6567 } 6568 6569 if (filling_sinfo) { 6570 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo)); 6571 } 6572 if (flagsp != NULL) { 6573 flags = *flagsp; 6574 } else { 6575 flags = 0; 6576 } 6577 error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, &flags, 6578 (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo); 6579 if (flagsp != NULL) { 6580 *flagsp = flags; 6581 } 6582 if (controlp != NULL) { 6583 /* copy back the sinfo in a CMSG format */ 6584 if (filling_sinfo && ((flags & MSG_NOTIFICATION) == 0)) { 6585 *controlp = sctp_build_ctl_nchunk(inp, 6586 (struct sctp_sndrcvinfo *)&sinfo); 6587 } else { 6588 *controlp = NULL; 6589 } 6590 } 6591 if (psa) { 6592 /* copy back the address info */ 6593 if (from && from->sa_len) { 6594 *psa = sodupsockaddr(from, M_NOWAIT); 6595 } else { 6596 *psa = NULL; 6597 } 6598 } 6599 return (error); 6600 } 6601 6602 int 6603 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr, 6604 int totaddr, int *error) 6605 { 6606 int added = 0; 6607 int i; 6608 struct sctp_inpcb *inp; 6609 struct sockaddr *sa; 6610 size_t incr = 0; 6611 #ifdef INET 6612 struct sockaddr_in *sin; 6613 #endif 6614 #ifdef INET6 6615 struct sockaddr_in6 *sin6; 6616 #endif 6617 6618 sa = addr; 6619 inp = stcb->sctp_ep; 6620 *error = 0; 6621 for (i = 0; i < totaddr; i++) { 6622 switch (sa->sa_family) { 6623 #ifdef INET 6624 case AF_INET: 6625 incr = sizeof(struct sockaddr_in); 6626 sin = (struct sockaddr_in *)sa; 6627 if ((sin->sin_addr.s_addr == INADDR_ANY) || 6628 (sin->sin_addr.s_addr == INADDR_BROADCAST) || 6629 IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) { 6630 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6631 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 6632 SCTP_FROM_SCTPUTIL + SCTP_LOC_7); 6633 *error = EINVAL; 6634 goto out_now; 6635 } 6636 if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port, 6637 SCTP_DONOT_SETSCOPE, 6638 SCTP_ADDR_IS_CONFIRMED)) { 6639 /* assoc gone no un-lock */ 6640 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS); 6641 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 6642 SCTP_FROM_SCTPUTIL + SCTP_LOC_8); 6643 *error = ENOBUFS; 6644 goto out_now; 6645 } 6646 added++; 6647 break; 6648 #endif 6649 #ifdef INET6 6650 case AF_INET6: 6651 incr = sizeof(struct sockaddr_in6); 6652 sin6 = (struct sockaddr_in6 *)sa; 6653 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) || 6654 IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) { 6655 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6656 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 6657 SCTP_FROM_SCTPUTIL + SCTP_LOC_9); 6658 *error = EINVAL; 6659 goto out_now; 6660 } 6661 if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port, 6662 SCTP_DONOT_SETSCOPE, 6663 SCTP_ADDR_IS_CONFIRMED)) { 6664 /* assoc gone no un-lock */ 6665 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS); 6666 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 6667 SCTP_FROM_SCTPUTIL + SCTP_LOC_10); 6668 *error = ENOBUFS; 6669 goto out_now; 6670 } 6671 added++; 6672 break; 6673 #endif 6674 default: 6675 break; 6676 } 6677 sa = (struct sockaddr *)((caddr_t)sa + incr); 6678 } 6679 out_now: 6680 return (added); 6681 } 6682 6683 int 6684 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr, 6685 unsigned int totaddr, 6686 unsigned int *num_v4, unsigned int *num_v6, 6687 unsigned int limit) 6688 { 6689 struct sockaddr *sa; 6690 struct sctp_tcb *stcb; 6691 unsigned int incr, at, i; 6692 6693 at = 0; 6694 sa = addr; 6695 *num_v6 = *num_v4 = 0; 6696 /* account and validate addresses */ 6697 if (totaddr == 0) { 6698 return (EINVAL); 6699 } 6700 for (i = 0; i < totaddr; i++) { 6701 if (at + sizeof(struct sockaddr) > limit) { 6702 return (EINVAL); 6703 } 6704 switch (sa->sa_family) { 6705 #ifdef INET 6706 case AF_INET: 6707 incr = (unsigned int)sizeof(struct sockaddr_in); 6708 if (sa->sa_len != incr) { 6709 return (EINVAL); 6710 } 6711 (*num_v4) += 1; 6712 break; 6713 #endif 6714 #ifdef INET6 6715 case AF_INET6: 6716 { 6717 struct sockaddr_in6 *sin6; 6718 6719 sin6 = (struct sockaddr_in6 *)sa; 6720 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6721 /* Must be non-mapped for connectx */ 6722 return (EINVAL); 6723 } 6724 incr = (unsigned int)sizeof(struct sockaddr_in6); 6725 if (sa->sa_len != incr) { 6726 return (EINVAL); 6727 } 6728 (*num_v6) += 1; 6729 break; 6730 } 6731 #endif 6732 default: 6733 return (EINVAL); 6734 } 6735 if ((at + incr) > limit) { 6736 return (EINVAL); 6737 } 6738 SCTP_INP_INCR_REF(inp); 6739 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL); 6740 if (stcb != NULL) { 6741 SCTP_TCB_UNLOCK(stcb); 6742 return (EALREADY); 6743 } else { 6744 SCTP_INP_DECR_REF(inp); 6745 } 6746 at += incr; 6747 sa = (struct sockaddr *)((caddr_t)sa + incr); 6748 } 6749 return (0); 6750 } 6751 6752 /* 6753 * sctp_bindx(ADD) for one address. 6754 * assumes all arguments are valid/checked by caller. 6755 */ 6756 void 6757 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp, 6758 struct sockaddr *sa, uint32_t vrf_id, int *error, 6759 void *p) 6760 { 6761 #if defined(INET) && defined(INET6) 6762 struct sockaddr_in sin; 6763 #endif 6764 #ifdef INET6 6765 struct sockaddr_in6 *sin6; 6766 #endif 6767 #ifdef INET 6768 struct sockaddr_in *sinp; 6769 #endif 6770 struct sockaddr *addr_to_use; 6771 struct sctp_inpcb *lep; 6772 uint16_t port; 6773 6774 /* see if we're bound all already! */ 6775 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 6776 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6777 *error = EINVAL; 6778 return; 6779 } 6780 switch (sa->sa_family) { 6781 #ifdef INET6 6782 case AF_INET6: 6783 if (sa->sa_len != sizeof(struct sockaddr_in6)) { 6784 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6785 *error = EINVAL; 6786 return; 6787 } 6788 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) { 6789 /* can only bind v6 on PF_INET6 sockets */ 6790 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6791 *error = EINVAL; 6792 return; 6793 } 6794 sin6 = (struct sockaddr_in6 *)sa; 6795 port = sin6->sin6_port; 6796 #ifdef INET 6797 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6798 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6799 SCTP_IPV6_V6ONLY(inp)) { 6800 /* can't bind v4-mapped on PF_INET sockets */ 6801 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6802 *error = EINVAL; 6803 return; 6804 } 6805 in6_sin6_2_sin(&sin, sin6); 6806 addr_to_use = (struct sockaddr *)&sin; 6807 } else { 6808 addr_to_use = sa; 6809 } 6810 #else 6811 addr_to_use = sa; 6812 #endif 6813 break; 6814 #endif 6815 #ifdef INET 6816 case AF_INET: 6817 if (sa->sa_len != sizeof(struct sockaddr_in)) { 6818 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6819 *error = EINVAL; 6820 return; 6821 } 6822 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6823 SCTP_IPV6_V6ONLY(inp)) { 6824 /* can't bind v4 on PF_INET sockets */ 6825 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6826 *error = EINVAL; 6827 return; 6828 } 6829 sinp = (struct sockaddr_in *)sa; 6830 port = sinp->sin_port; 6831 addr_to_use = sa; 6832 break; 6833 #endif 6834 default: 6835 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6836 *error = EINVAL; 6837 return; 6838 } 6839 if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) { 6840 if (p == NULL) { 6841 /* Can't get proc for Net/Open BSD */ 6842 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6843 *error = EINVAL; 6844 return; 6845 } 6846 *error = sctp_inpcb_bind(so, addr_to_use, NULL, p); 6847 return; 6848 } 6849 /* Validate the incoming port. */ 6850 if ((port != 0) && (port != inp->sctp_lport)) { 6851 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6852 *error = EINVAL; 6853 return; 6854 } 6855 lep = sctp_pcb_findep(addr_to_use, 1, 0, vrf_id); 6856 if (lep == NULL) { 6857 /* add the address */ 6858 *error = sctp_addr_mgmt_ep_sa(inp, addr_to_use, 6859 SCTP_ADD_IP_ADDRESS, vrf_id); 6860 } else { 6861 if (lep != inp) { 6862 *error = EADDRINUSE; 6863 } 6864 SCTP_INP_DECR_REF(lep); 6865 } 6866 } 6867 6868 /* 6869 * sctp_bindx(DELETE) for one address. 6870 * assumes all arguments are valid/checked by caller. 6871 */ 6872 void 6873 sctp_bindx_delete_address(struct sctp_inpcb *inp, 6874 struct sockaddr *sa, uint32_t vrf_id, int *error) 6875 { 6876 struct sockaddr *addr_to_use; 6877 #if defined(INET) && defined(INET6) 6878 struct sockaddr_in6 *sin6; 6879 struct sockaddr_in sin; 6880 #endif 6881 6882 /* see if we're bound all already! */ 6883 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 6884 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6885 *error = EINVAL; 6886 return; 6887 } 6888 switch (sa->sa_family) { 6889 #ifdef INET6 6890 case AF_INET6: 6891 if (sa->sa_len != sizeof(struct sockaddr_in6)) { 6892 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6893 *error = EINVAL; 6894 return; 6895 } 6896 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) { 6897 /* can only bind v6 on PF_INET6 sockets */ 6898 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6899 *error = EINVAL; 6900 return; 6901 } 6902 #ifdef INET 6903 sin6 = (struct sockaddr_in6 *)sa; 6904 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6905 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6906 SCTP_IPV6_V6ONLY(inp)) { 6907 /* can't bind mapped-v4 on PF_INET sockets */ 6908 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6909 *error = EINVAL; 6910 return; 6911 } 6912 in6_sin6_2_sin(&sin, sin6); 6913 addr_to_use = (struct sockaddr *)&sin; 6914 } else { 6915 addr_to_use = sa; 6916 } 6917 #else 6918 addr_to_use = sa; 6919 #endif 6920 break; 6921 #endif 6922 #ifdef INET 6923 case AF_INET: 6924 if (sa->sa_len != sizeof(struct sockaddr_in)) { 6925 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6926 *error = EINVAL; 6927 return; 6928 } 6929 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6930 SCTP_IPV6_V6ONLY(inp)) { 6931 /* can't bind v4 on PF_INET sockets */ 6932 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6933 *error = EINVAL; 6934 return; 6935 } 6936 addr_to_use = sa; 6937 break; 6938 #endif 6939 default: 6940 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6941 *error = EINVAL; 6942 return; 6943 } 6944 /* No lock required mgmt_ep_sa does its own locking. */ 6945 *error = sctp_addr_mgmt_ep_sa(inp, addr_to_use, SCTP_DEL_IP_ADDRESS, 6946 vrf_id); 6947 } 6948 6949 /* 6950 * returns the valid local address count for an assoc, taking into account 6951 * all scoping rules 6952 */ 6953 int 6954 sctp_local_addr_count(struct sctp_tcb *stcb) 6955 { 6956 int loopback_scope; 6957 #if defined(INET) 6958 int ipv4_local_scope, ipv4_addr_legal; 6959 #endif 6960 #if defined(INET6) 6961 int local_scope, site_scope, ipv6_addr_legal; 6962 #endif 6963 struct sctp_vrf *vrf; 6964 struct sctp_ifn *sctp_ifn; 6965 struct sctp_ifa *sctp_ifa; 6966 int count = 0; 6967 6968 /* Turn on all the appropriate scopes */ 6969 loopback_scope = stcb->asoc.scope.loopback_scope; 6970 #if defined(INET) 6971 ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope; 6972 ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal; 6973 #endif 6974 #if defined(INET6) 6975 local_scope = stcb->asoc.scope.local_scope; 6976 site_scope = stcb->asoc.scope.site_scope; 6977 ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal; 6978 #endif 6979 SCTP_IPI_ADDR_RLOCK(); 6980 vrf = sctp_find_vrf(stcb->asoc.vrf_id); 6981 if (vrf == NULL) { 6982 /* no vrf, no addresses */ 6983 SCTP_IPI_ADDR_RUNLOCK(); 6984 return (0); 6985 } 6986 6987 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 6988 /* 6989 * bound all case: go through all ifns on the vrf 6990 */ 6991 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 6992 if ((loopback_scope == 0) && 6993 SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 6994 continue; 6995 } 6996 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 6997 if (sctp_is_addr_restricted(stcb, sctp_ifa)) 6998 continue; 6999 switch (sctp_ifa->address.sa.sa_family) { 7000 #ifdef INET 7001 case AF_INET: 7002 if (ipv4_addr_legal) { 7003 struct sockaddr_in *sin; 7004 7005 sin = &sctp_ifa->address.sin; 7006 if (sin->sin_addr.s_addr == 0) { 7007 /* 7008 * skip unspecified 7009 * addrs 7010 */ 7011 continue; 7012 } 7013 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred, 7014 &sin->sin_addr) != 0) { 7015 continue; 7016 } 7017 if ((ipv4_local_scope == 0) && 7018 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 7019 continue; 7020 } 7021 /* count this one */ 7022 count++; 7023 } else { 7024 continue; 7025 } 7026 break; 7027 #endif 7028 #ifdef INET6 7029 case AF_INET6: 7030 if (ipv6_addr_legal) { 7031 struct sockaddr_in6 *sin6; 7032 7033 sin6 = &sctp_ifa->address.sin6; 7034 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 7035 continue; 7036 } 7037 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred, 7038 &sin6->sin6_addr) != 0) { 7039 continue; 7040 } 7041 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 7042 if (local_scope == 0) 7043 continue; 7044 if (sin6->sin6_scope_id == 0) { 7045 if (sa6_recoverscope(sin6) != 0) 7046 /* 7047 * 7048 * bad 7049 * link 7050 * 7051 * local 7052 * 7053 * address 7054 */ 7055 continue; 7056 } 7057 } 7058 if ((site_scope == 0) && 7059 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 7060 continue; 7061 } 7062 /* count this one */ 7063 count++; 7064 } 7065 break; 7066 #endif 7067 default: 7068 /* TSNH */ 7069 break; 7070 } 7071 } 7072 } 7073 } else { 7074 /* 7075 * subset bound case 7076 */ 7077 struct sctp_laddr *laddr; 7078 7079 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, 7080 sctp_nxt_addr) { 7081 if (sctp_is_addr_restricted(stcb, laddr->ifa)) { 7082 continue; 7083 } 7084 /* count this one */ 7085 count++; 7086 } 7087 } 7088 SCTP_IPI_ADDR_RUNLOCK(); 7089 return (count); 7090 } 7091 7092 #if defined(SCTP_LOCAL_TRACE_BUF) 7093 7094 void 7095 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f) 7096 { 7097 uint32_t saveindex, newindex; 7098 7099 do { 7100 saveindex = SCTP_BASE_SYSCTL(sctp_log).index; 7101 if (saveindex >= SCTP_MAX_LOGGING_SIZE) { 7102 newindex = 1; 7103 } else { 7104 newindex = saveindex + 1; 7105 } 7106 } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0); 7107 if (saveindex >= SCTP_MAX_LOGGING_SIZE) { 7108 saveindex = 0; 7109 } 7110 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT; 7111 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys; 7112 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a; 7113 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b; 7114 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c; 7115 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d; 7116 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e; 7117 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f; 7118 } 7119 7120 #endif 7121 static void 7122 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp, 7123 const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED) 7124 { 7125 struct ip *iph; 7126 #ifdef INET6 7127 struct ip6_hdr *ip6; 7128 #endif 7129 struct mbuf *sp, *last; 7130 struct udphdr *uhdr; 7131 uint16_t port; 7132 7133 if ((m->m_flags & M_PKTHDR) == 0) { 7134 /* Can't handle one that is not a pkt hdr */ 7135 goto out; 7136 } 7137 /* Pull the src port */ 7138 iph = mtod(m, struct ip *); 7139 uhdr = (struct udphdr *)((caddr_t)iph + off); 7140 port = uhdr->uh_sport; 7141 /* 7142 * Split out the mbuf chain. Leave the IP header in m, place the 7143 * rest in the sp. 7144 */ 7145 sp = m_split(m, off, M_NOWAIT); 7146 if (sp == NULL) { 7147 /* Gak, drop packet, we can't do a split */ 7148 goto out; 7149 } 7150 if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) { 7151 /* Gak, packet can't have an SCTP header in it - too small */ 7152 m_freem(sp); 7153 goto out; 7154 } 7155 /* Now pull up the UDP header and SCTP header together */ 7156 sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr)); 7157 if (sp == NULL) { 7158 /* Gak pullup failed */ 7159 goto out; 7160 } 7161 /* Trim out the UDP header */ 7162 m_adj(sp, sizeof(struct udphdr)); 7163 7164 /* Now reconstruct the mbuf chain */ 7165 for (last = m; last->m_next; last = last->m_next); 7166 last->m_next = sp; 7167 m->m_pkthdr.len += sp->m_pkthdr.len; 7168 /* 7169 * The CSUM_DATA_VALID flags indicates that the HW checked the UDP 7170 * checksum and it was valid. Since CSUM_DATA_VALID == 7171 * CSUM_SCTP_VALID this would imply that the HW also verified the 7172 * SCTP checksum. Therefore, clear the bit. 7173 */ 7174 SCTPDBG(SCTP_DEBUG_CRCOFFLOAD, 7175 "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n", 7176 m->m_pkthdr.len, 7177 if_name(m->m_pkthdr.rcvif), 7178 (int)m->m_pkthdr.csum_flags, CSUM_BITS); 7179 m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID; 7180 iph = mtod(m, struct ip *); 7181 switch (iph->ip_v) { 7182 #ifdef INET 7183 case IPVERSION: 7184 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr)); 7185 sctp_input_with_port(m, off, port); 7186 break; 7187 #endif 7188 #ifdef INET6 7189 case IPV6_VERSION >> 4: 7190 ip6 = mtod(m, struct ip6_hdr *); 7191 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr)); 7192 sctp6_input_with_port(&m, &off, port); 7193 break; 7194 #endif 7195 default: 7196 goto out; 7197 break; 7198 } 7199 return; 7200 out: 7201 m_freem(m); 7202 } 7203 7204 #ifdef INET 7205 static void 7206 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED) 7207 { 7208 struct ip *outer_ip, *inner_ip; 7209 struct sctphdr *sh; 7210 struct icmp *icmp; 7211 struct udphdr *udp; 7212 struct sctp_inpcb *inp; 7213 struct sctp_tcb *stcb; 7214 struct sctp_nets *net; 7215 struct sctp_init_chunk *ch; 7216 struct sockaddr_in src, dst; 7217 uint8_t type, code; 7218 7219 inner_ip = (struct ip *)vip; 7220 icmp = (struct icmp *)((caddr_t)inner_ip - 7221 (sizeof(struct icmp) - sizeof(struct ip))); 7222 outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip)); 7223 if (ntohs(outer_ip->ip_len) < 7224 sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) { 7225 return; 7226 } 7227 udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2)); 7228 sh = (struct sctphdr *)(udp + 1); 7229 memset(&src, 0, sizeof(struct sockaddr_in)); 7230 src.sin_family = AF_INET; 7231 src.sin_len = sizeof(struct sockaddr_in); 7232 src.sin_port = sh->src_port; 7233 src.sin_addr = inner_ip->ip_src; 7234 memset(&dst, 0, sizeof(struct sockaddr_in)); 7235 dst.sin_family = AF_INET; 7236 dst.sin_len = sizeof(struct sockaddr_in); 7237 dst.sin_port = sh->dest_port; 7238 dst.sin_addr = inner_ip->ip_dst; 7239 /* 7240 * 'dst' holds the dest of the packet that failed to be sent. 'src' 7241 * holds our local endpoint address. Thus we reverse the dst and the 7242 * src in the lookup. 7243 */ 7244 inp = NULL; 7245 net = NULL; 7246 stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst, 7247 (struct sockaddr *)&src, 7248 &inp, &net, 1, 7249 SCTP_DEFAULT_VRFID); 7250 if ((stcb != NULL) && 7251 (net != NULL) && 7252 (inp != NULL)) { 7253 /* Check the UDP port numbers */ 7254 if ((udp->uh_dport != net->port) || 7255 (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) { 7256 SCTP_TCB_UNLOCK(stcb); 7257 return; 7258 } 7259 /* Check the verification tag */ 7260 if (ntohl(sh->v_tag) != 0) { 7261 /* 7262 * This must be the verification tag used for 7263 * sending out packets. We don't consider packets 7264 * reflecting the verification tag. 7265 */ 7266 if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) { 7267 SCTP_TCB_UNLOCK(stcb); 7268 return; 7269 } 7270 } else { 7271 if (ntohs(outer_ip->ip_len) >= 7272 sizeof(struct ip) + 7273 8 + (inner_ip->ip_hl << 2) + 8 + 20) { 7274 /* 7275 * In this case we can check if we got an 7276 * INIT chunk and if the initiate tag 7277 * matches. 7278 */ 7279 ch = (struct sctp_init_chunk *)(sh + 1); 7280 if ((ch->ch.chunk_type != SCTP_INITIATION) || 7281 (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) { 7282 SCTP_TCB_UNLOCK(stcb); 7283 return; 7284 } 7285 } else { 7286 SCTP_TCB_UNLOCK(stcb); 7287 return; 7288 } 7289 } 7290 type = icmp->icmp_type; 7291 code = icmp->icmp_code; 7292 if ((type == ICMP_UNREACH) && 7293 (code == ICMP_UNREACH_PORT)) { 7294 code = ICMP_UNREACH_PROTOCOL; 7295 } 7296 sctp_notify(inp, stcb, net, type, code, 7297 ntohs(inner_ip->ip_len), 7298 (uint32_t)ntohs(icmp->icmp_nextmtu)); 7299 } else { 7300 if ((stcb == NULL) && (inp != NULL)) { 7301 /* reduce ref-count */ 7302 SCTP_INP_WLOCK(inp); 7303 SCTP_INP_DECR_REF(inp); 7304 SCTP_INP_WUNLOCK(inp); 7305 } 7306 if (stcb) { 7307 SCTP_TCB_UNLOCK(stcb); 7308 } 7309 } 7310 return; 7311 } 7312 #endif 7313 7314 #ifdef INET6 7315 static void 7316 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED) 7317 { 7318 struct ip6ctlparam *ip6cp; 7319 struct sctp_inpcb *inp; 7320 struct sctp_tcb *stcb; 7321 struct sctp_nets *net; 7322 struct sctphdr sh; 7323 struct udphdr udp; 7324 struct sockaddr_in6 src, dst; 7325 uint8_t type, code; 7326 7327 ip6cp = (struct ip6ctlparam *)d; 7328 /* 7329 * XXX: We assume that when IPV6 is non NULL, M and OFF are valid. 7330 */ 7331 if (ip6cp->ip6c_m == NULL) { 7332 return; 7333 } 7334 /* 7335 * Check if we can safely examine the ports and the verification tag 7336 * of the SCTP common header. 7337 */ 7338 if (ip6cp->ip6c_m->m_pkthdr.len < 7339 ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) { 7340 return; 7341 } 7342 /* Copy out the UDP header. */ 7343 memset(&udp, 0, sizeof(struct udphdr)); 7344 m_copydata(ip6cp->ip6c_m, 7345 ip6cp->ip6c_off, 7346 sizeof(struct udphdr), 7347 (caddr_t)&udp); 7348 /* Copy out the port numbers and the verification tag. */ 7349 memset(&sh, 0, sizeof(struct sctphdr)); 7350 m_copydata(ip6cp->ip6c_m, 7351 ip6cp->ip6c_off + sizeof(struct udphdr), 7352 sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t), 7353 (caddr_t)&sh); 7354 memset(&src, 0, sizeof(struct sockaddr_in6)); 7355 src.sin6_family = AF_INET6; 7356 src.sin6_len = sizeof(struct sockaddr_in6); 7357 src.sin6_port = sh.src_port; 7358 src.sin6_addr = ip6cp->ip6c_ip6->ip6_src; 7359 if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) { 7360 return; 7361 } 7362 memset(&dst, 0, sizeof(struct sockaddr_in6)); 7363 dst.sin6_family = AF_INET6; 7364 dst.sin6_len = sizeof(struct sockaddr_in6); 7365 dst.sin6_port = sh.dest_port; 7366 dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst; 7367 if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) { 7368 return; 7369 } 7370 inp = NULL; 7371 net = NULL; 7372 stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst, 7373 (struct sockaddr *)&src, 7374 &inp, &net, 1, SCTP_DEFAULT_VRFID); 7375 if ((stcb != NULL) && 7376 (net != NULL) && 7377 (inp != NULL)) { 7378 /* Check the UDP port numbers */ 7379 if ((udp.uh_dport != net->port) || 7380 (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) { 7381 SCTP_TCB_UNLOCK(stcb); 7382 return; 7383 } 7384 /* Check the verification tag */ 7385 if (ntohl(sh.v_tag) != 0) { 7386 /* 7387 * This must be the verification tag used for 7388 * sending out packets. We don't consider packets 7389 * reflecting the verification tag. 7390 */ 7391 if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) { 7392 SCTP_TCB_UNLOCK(stcb); 7393 return; 7394 } 7395 } else { 7396 if (ip6cp->ip6c_m->m_pkthdr.len >= 7397 ip6cp->ip6c_off + sizeof(struct udphdr) + 7398 sizeof(struct sctphdr) + 7399 sizeof(struct sctp_chunkhdr) + 7400 offsetof(struct sctp_init, a_rwnd)) { 7401 /* 7402 * In this case we can check if we got an 7403 * INIT chunk and if the initiate tag 7404 * matches. 7405 */ 7406 uint32_t initiate_tag; 7407 uint8_t chunk_type; 7408 7409 m_copydata(ip6cp->ip6c_m, 7410 ip6cp->ip6c_off + 7411 sizeof(struct udphdr) + 7412 sizeof(struct sctphdr), 7413 sizeof(uint8_t), 7414 (caddr_t)&chunk_type); 7415 m_copydata(ip6cp->ip6c_m, 7416 ip6cp->ip6c_off + 7417 sizeof(struct udphdr) + 7418 sizeof(struct sctphdr) + 7419 sizeof(struct sctp_chunkhdr), 7420 sizeof(uint32_t), 7421 (caddr_t)&initiate_tag); 7422 if ((chunk_type != SCTP_INITIATION) || 7423 (ntohl(initiate_tag) != stcb->asoc.my_vtag)) { 7424 SCTP_TCB_UNLOCK(stcb); 7425 return; 7426 } 7427 } else { 7428 SCTP_TCB_UNLOCK(stcb); 7429 return; 7430 } 7431 } 7432 type = ip6cp->ip6c_icmp6->icmp6_type; 7433 code = ip6cp->ip6c_icmp6->icmp6_code; 7434 if ((type == ICMP6_DST_UNREACH) && 7435 (code == ICMP6_DST_UNREACH_NOPORT)) { 7436 type = ICMP6_PARAM_PROB; 7437 code = ICMP6_PARAMPROB_NEXTHEADER; 7438 } 7439 sctp6_notify(inp, stcb, net, type, code, 7440 ntohl(ip6cp->ip6c_icmp6->icmp6_mtu)); 7441 } else { 7442 if ((stcb == NULL) && (inp != NULL)) { 7443 /* reduce inp's ref-count */ 7444 SCTP_INP_WLOCK(inp); 7445 SCTP_INP_DECR_REF(inp); 7446 SCTP_INP_WUNLOCK(inp); 7447 } 7448 if (stcb) { 7449 SCTP_TCB_UNLOCK(stcb); 7450 } 7451 } 7452 } 7453 #endif 7454 7455 void 7456 sctp_over_udp_stop(void) 7457 { 7458 /* 7459 * This function assumes sysctl caller holds sctp_sysctl_info_lock() 7460 * for writting! 7461 */ 7462 #ifdef INET 7463 if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) { 7464 soclose(SCTP_BASE_INFO(udp4_tun_socket)); 7465 SCTP_BASE_INFO(udp4_tun_socket) = NULL; 7466 } 7467 #endif 7468 #ifdef INET6 7469 if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) { 7470 soclose(SCTP_BASE_INFO(udp6_tun_socket)); 7471 SCTP_BASE_INFO(udp6_tun_socket) = NULL; 7472 } 7473 #endif 7474 } 7475 7476 int 7477 sctp_over_udp_start(void) 7478 { 7479 uint16_t port; 7480 int ret; 7481 #ifdef INET 7482 struct sockaddr_in sin; 7483 #endif 7484 #ifdef INET6 7485 struct sockaddr_in6 sin6; 7486 #endif 7487 /* 7488 * This function assumes sysctl caller holds sctp_sysctl_info_lock() 7489 * for writting! 7490 */ 7491 port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port); 7492 if (ntohs(port) == 0) { 7493 /* Must have a port set */ 7494 return (EINVAL); 7495 } 7496 #ifdef INET 7497 if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) { 7498 /* Already running -- must stop first */ 7499 return (EALREADY); 7500 } 7501 #endif 7502 #ifdef INET6 7503 if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) { 7504 /* Already running -- must stop first */ 7505 return (EALREADY); 7506 } 7507 #endif 7508 #ifdef INET 7509 if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket), 7510 SOCK_DGRAM, IPPROTO_UDP, 7511 curthread->td_ucred, curthread))) { 7512 sctp_over_udp_stop(); 7513 return (ret); 7514 } 7515 /* Call the special UDP hook. */ 7516 if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket), 7517 sctp_recv_udp_tunneled_packet, 7518 sctp_recv_icmp_tunneled_packet, 7519 NULL))) { 7520 sctp_over_udp_stop(); 7521 return (ret); 7522 } 7523 /* Ok, we have a socket, bind it to the port. */ 7524 memset(&sin, 0, sizeof(struct sockaddr_in)); 7525 sin.sin_len = sizeof(struct sockaddr_in); 7526 sin.sin_family = AF_INET; 7527 sin.sin_port = htons(port); 7528 if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket), 7529 (struct sockaddr *)&sin, curthread))) { 7530 sctp_over_udp_stop(); 7531 return (ret); 7532 } 7533 #endif 7534 #ifdef INET6 7535 if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket), 7536 SOCK_DGRAM, IPPROTO_UDP, 7537 curthread->td_ucred, curthread))) { 7538 sctp_over_udp_stop(); 7539 return (ret); 7540 } 7541 /* Call the special UDP hook. */ 7542 if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket), 7543 sctp_recv_udp_tunneled_packet, 7544 sctp_recv_icmp6_tunneled_packet, 7545 NULL))) { 7546 sctp_over_udp_stop(); 7547 return (ret); 7548 } 7549 /* Ok, we have a socket, bind it to the port. */ 7550 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 7551 sin6.sin6_len = sizeof(struct sockaddr_in6); 7552 sin6.sin6_family = AF_INET6; 7553 sin6.sin6_port = htons(port); 7554 if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket), 7555 (struct sockaddr *)&sin6, curthread))) { 7556 sctp_over_udp_stop(); 7557 return (ret); 7558 } 7559 #endif 7560 return (0); 7561 } 7562 7563 /* 7564 * sctp_min_mtu ()returns the minimum of all non-zero arguments. 7565 * If all arguments are zero, zero is returned. 7566 */ 7567 uint32_t 7568 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3) 7569 { 7570 if (mtu1 > 0) { 7571 if (mtu2 > 0) { 7572 if (mtu3 > 0) { 7573 return (min(mtu1, min(mtu2, mtu3))); 7574 } else { 7575 return (min(mtu1, mtu2)); 7576 } 7577 } else { 7578 if (mtu3 > 0) { 7579 return (min(mtu1, mtu3)); 7580 } else { 7581 return (mtu1); 7582 } 7583 } 7584 } else { 7585 if (mtu2 > 0) { 7586 if (mtu3 > 0) { 7587 return (min(mtu2, mtu3)); 7588 } else { 7589 return (mtu2); 7590 } 7591 } else { 7592 return (mtu3); 7593 } 7594 } 7595 } 7596 7597 void 7598 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu) 7599 { 7600 struct in_conninfo inc; 7601 7602 memset(&inc, 0, sizeof(struct in_conninfo)); 7603 inc.inc_fibnum = fibnum; 7604 switch (addr->sa.sa_family) { 7605 #ifdef INET 7606 case AF_INET: 7607 inc.inc_faddr = addr->sin.sin_addr; 7608 break; 7609 #endif 7610 #ifdef INET6 7611 case AF_INET6: 7612 inc.inc_flags |= INC_ISIPV6; 7613 inc.inc6_faddr = addr->sin6.sin6_addr; 7614 break; 7615 #endif 7616 default: 7617 return; 7618 } 7619 tcp_hc_updatemtu(&inc, (u_long)mtu); 7620 } 7621 7622 uint32_t 7623 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum) 7624 { 7625 struct in_conninfo inc; 7626 7627 memset(&inc, 0, sizeof(struct in_conninfo)); 7628 inc.inc_fibnum = fibnum; 7629 switch (addr->sa.sa_family) { 7630 #ifdef INET 7631 case AF_INET: 7632 inc.inc_faddr = addr->sin.sin_addr; 7633 break; 7634 #endif 7635 #ifdef INET6 7636 case AF_INET6: 7637 inc.inc_flags |= INC_ISIPV6; 7638 inc.inc6_faddr = addr->sin6.sin6_addr; 7639 break; 7640 #endif 7641 default: 7642 return (0); 7643 } 7644 return ((uint32_t)tcp_hc_getmtu(&inc)); 7645 } 7646 7647 void 7648 sctp_set_state(struct sctp_tcb *stcb, int new_state) 7649 { 7650 #if defined(KDTRACE_HOOKS) 7651 int old_state = stcb->asoc.state; 7652 #endif 7653 7654 KASSERT((new_state & ~SCTP_STATE_MASK) == 0, 7655 ("sctp_set_state: Can't set substate (new_state = %x)", 7656 new_state)); 7657 stcb->asoc.state = (stcb->asoc.state & ~SCTP_STATE_MASK) | new_state; 7658 if ((new_state == SCTP_STATE_SHUTDOWN_RECEIVED) || 7659 (new_state == SCTP_STATE_SHUTDOWN_SENT) || 7660 (new_state == SCTP_STATE_SHUTDOWN_ACK_SENT)) { 7661 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 7662 } 7663 #if defined(KDTRACE_HOOKS) 7664 if (((old_state & SCTP_STATE_MASK) != new_state) && 7665 !(((old_state & SCTP_STATE_MASK) == SCTP_STATE_EMPTY) && 7666 (new_state == SCTP_STATE_INUSE))) { 7667 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state); 7668 } 7669 #endif 7670 } 7671 7672 void 7673 sctp_add_substate(struct sctp_tcb *stcb, int substate) 7674 { 7675 #if defined(KDTRACE_HOOKS) 7676 int old_state = stcb->asoc.state; 7677 #endif 7678 7679 KASSERT((substate & SCTP_STATE_MASK) == 0, 7680 ("sctp_add_substate: Can't set state (substate = %x)", 7681 substate)); 7682 stcb->asoc.state |= substate; 7683 #if defined(KDTRACE_HOOKS) 7684 if (((substate & SCTP_STATE_ABOUT_TO_BE_FREED) && 7685 ((old_state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) || 7686 ((substate & SCTP_STATE_SHUTDOWN_PENDING) && 7687 ((old_state & SCTP_STATE_SHUTDOWN_PENDING) == 0))) { 7688 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state); 7689 } 7690 #endif 7691 } 7692