1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 5 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 6 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions are met: 10 * 11 * a) Redistributions of source code must retain the above copyright notice, 12 * this list of conditions and the following disclaimer. 13 * 14 * b) Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the distribution. 17 * 18 * c) Neither the name of Cisco Systems, Inc. nor the names of its 19 * contributors may be used to endorse or promote products derived 20 * from this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 26 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 32 * THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include <sys/cdefs.h> 36 __FBSDID("$FreeBSD$"); 37 38 #include <netinet/sctp_os.h> 39 #include <netinet/sctp_pcb.h> 40 #include <netinet/sctputil.h> 41 #include <netinet/sctp_var.h> 42 #include <netinet/sctp_sysctl.h> 43 #ifdef INET6 44 #include <netinet6/sctp6_var.h> 45 #endif 46 #include <netinet/sctp_header.h> 47 #include <netinet/sctp_output.h> 48 #include <netinet/sctp_uio.h> 49 #include <netinet/sctp_timer.h> 50 #include <netinet/sctp_indata.h> 51 #include <netinet/sctp_auth.h> 52 #include <netinet/sctp_asconf.h> 53 #include <netinet/sctp_bsd_addr.h> 54 #include <netinet/sctp_kdtrace.h> 55 #if defined(INET6) || defined(INET) 56 #include <netinet/tcp_var.h> 57 #endif 58 #include <netinet/udp.h> 59 #include <netinet/udp_var.h> 60 #include <sys/proc.h> 61 #ifdef INET6 62 #include <netinet/icmp6.h> 63 #endif 64 65 #ifndef KTR_SCTP 66 #define KTR_SCTP KTR_SUBSYS 67 #endif 68 69 extern const struct sctp_cc_functions sctp_cc_functions[]; 70 extern const struct sctp_ss_functions sctp_ss_functions[]; 71 72 void 73 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr) 74 { 75 #if defined(SCTP_LOCAL_TRACE_BUF) 76 struct sctp_cwnd_log sctp_clog; 77 78 sctp_clog.x.sb.stcb = stcb; 79 sctp_clog.x.sb.so_sbcc = sb->sb_cc; 80 if (stcb) 81 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc; 82 else 83 sctp_clog.x.sb.stcb_sbcc = 0; 84 sctp_clog.x.sb.incr = incr; 85 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 86 SCTP_LOG_EVENT_SB, 87 from, 88 sctp_clog.x.misc.log1, 89 sctp_clog.x.misc.log2, 90 sctp_clog.x.misc.log3, 91 sctp_clog.x.misc.log4); 92 #endif 93 } 94 95 void 96 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc) 97 { 98 #if defined(SCTP_LOCAL_TRACE_BUF) 99 struct sctp_cwnd_log sctp_clog; 100 101 sctp_clog.x.close.inp = (void *)inp; 102 sctp_clog.x.close.sctp_flags = inp->sctp_flags; 103 if (stcb) { 104 sctp_clog.x.close.stcb = (void *)stcb; 105 sctp_clog.x.close.state = (uint16_t)stcb->asoc.state; 106 } else { 107 sctp_clog.x.close.stcb = 0; 108 sctp_clog.x.close.state = 0; 109 } 110 sctp_clog.x.close.loc = loc; 111 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 112 SCTP_LOG_EVENT_CLOSE, 113 0, 114 sctp_clog.x.misc.log1, 115 sctp_clog.x.misc.log2, 116 sctp_clog.x.misc.log3, 117 sctp_clog.x.misc.log4); 118 #endif 119 } 120 121 void 122 rto_logging(struct sctp_nets *net, int from) 123 { 124 #if defined(SCTP_LOCAL_TRACE_BUF) 125 struct sctp_cwnd_log sctp_clog; 126 127 memset(&sctp_clog, 0, sizeof(sctp_clog)); 128 sctp_clog.x.rto.net = (void *)net; 129 sctp_clog.x.rto.rtt = net->rtt / 1000; 130 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 131 SCTP_LOG_EVENT_RTT, 132 from, 133 sctp_clog.x.misc.log1, 134 sctp_clog.x.misc.log2, 135 sctp_clog.x.misc.log3, 136 sctp_clog.x.misc.log4); 137 #endif 138 } 139 140 void 141 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from) 142 { 143 #if defined(SCTP_LOCAL_TRACE_BUF) 144 struct sctp_cwnd_log sctp_clog; 145 146 sctp_clog.x.strlog.stcb = stcb; 147 sctp_clog.x.strlog.n_tsn = tsn; 148 sctp_clog.x.strlog.n_sseq = sseq; 149 sctp_clog.x.strlog.e_tsn = 0; 150 sctp_clog.x.strlog.e_sseq = 0; 151 sctp_clog.x.strlog.strm = stream; 152 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 153 SCTP_LOG_EVENT_STRM, 154 from, 155 sctp_clog.x.misc.log1, 156 sctp_clog.x.misc.log2, 157 sctp_clog.x.misc.log3, 158 sctp_clog.x.misc.log4); 159 #endif 160 } 161 162 void 163 sctp_log_nagle_event(struct sctp_tcb *stcb, int action) 164 { 165 #if defined(SCTP_LOCAL_TRACE_BUF) 166 struct sctp_cwnd_log sctp_clog; 167 168 sctp_clog.x.nagle.stcb = (void *)stcb; 169 sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight; 170 sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size; 171 sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue; 172 sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count; 173 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 174 SCTP_LOG_EVENT_NAGLE, 175 action, 176 sctp_clog.x.misc.log1, 177 sctp_clog.x.misc.log2, 178 sctp_clog.x.misc.log3, 179 sctp_clog.x.misc.log4); 180 #endif 181 } 182 183 void 184 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from) 185 { 186 #if defined(SCTP_LOCAL_TRACE_BUF) 187 struct sctp_cwnd_log sctp_clog; 188 189 sctp_clog.x.sack.cumack = cumack; 190 sctp_clog.x.sack.oldcumack = old_cumack; 191 sctp_clog.x.sack.tsn = tsn; 192 sctp_clog.x.sack.numGaps = gaps; 193 sctp_clog.x.sack.numDups = dups; 194 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 195 SCTP_LOG_EVENT_SACK, 196 from, 197 sctp_clog.x.misc.log1, 198 sctp_clog.x.misc.log2, 199 sctp_clog.x.misc.log3, 200 sctp_clog.x.misc.log4); 201 #endif 202 } 203 204 void 205 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from) 206 { 207 #if defined(SCTP_LOCAL_TRACE_BUF) 208 struct sctp_cwnd_log sctp_clog; 209 210 memset(&sctp_clog, 0, sizeof(sctp_clog)); 211 sctp_clog.x.map.base = map; 212 sctp_clog.x.map.cum = cum; 213 sctp_clog.x.map.high = high; 214 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 215 SCTP_LOG_EVENT_MAP, 216 from, 217 sctp_clog.x.misc.log1, 218 sctp_clog.x.misc.log2, 219 sctp_clog.x.misc.log3, 220 sctp_clog.x.misc.log4); 221 #endif 222 } 223 224 void 225 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from) 226 { 227 #if defined(SCTP_LOCAL_TRACE_BUF) 228 struct sctp_cwnd_log sctp_clog; 229 230 memset(&sctp_clog, 0, sizeof(sctp_clog)); 231 sctp_clog.x.fr.largest_tsn = biggest_tsn; 232 sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn; 233 sctp_clog.x.fr.tsn = tsn; 234 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 235 SCTP_LOG_EVENT_FR, 236 from, 237 sctp_clog.x.misc.log1, 238 sctp_clog.x.misc.log2, 239 sctp_clog.x.misc.log3, 240 sctp_clog.x.misc.log4); 241 #endif 242 } 243 244 #ifdef SCTP_MBUF_LOGGING 245 void 246 sctp_log_mb(struct mbuf *m, int from) 247 { 248 #if defined(SCTP_LOCAL_TRACE_BUF) 249 struct sctp_cwnd_log sctp_clog; 250 251 sctp_clog.x.mb.mp = m; 252 sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m)); 253 sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m)); 254 sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0); 255 if (SCTP_BUF_IS_EXTENDED(m)) { 256 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m); 257 sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m)); 258 } else { 259 sctp_clog.x.mb.ext = 0; 260 sctp_clog.x.mb.refcnt = 0; 261 } 262 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 263 SCTP_LOG_EVENT_MBUF, 264 from, 265 sctp_clog.x.misc.log1, 266 sctp_clog.x.misc.log2, 267 sctp_clog.x.misc.log3, 268 sctp_clog.x.misc.log4); 269 #endif 270 } 271 272 void 273 sctp_log_mbc(struct mbuf *m, int from) 274 { 275 struct mbuf *mat; 276 277 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 278 sctp_log_mb(mat, from); 279 } 280 } 281 #endif 282 283 void 284 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from) 285 { 286 #if defined(SCTP_LOCAL_TRACE_BUF) 287 struct sctp_cwnd_log sctp_clog; 288 289 if (control == NULL) { 290 SCTP_PRINTF("Gak log of NULL?\n"); 291 return; 292 } 293 sctp_clog.x.strlog.stcb = control->stcb; 294 sctp_clog.x.strlog.n_tsn = control->sinfo_tsn; 295 sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid; 296 sctp_clog.x.strlog.strm = control->sinfo_stream; 297 if (poschk != NULL) { 298 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn; 299 sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid; 300 } else { 301 sctp_clog.x.strlog.e_tsn = 0; 302 sctp_clog.x.strlog.e_sseq = 0; 303 } 304 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 305 SCTP_LOG_EVENT_STRM, 306 from, 307 sctp_clog.x.misc.log1, 308 sctp_clog.x.misc.log2, 309 sctp_clog.x.misc.log3, 310 sctp_clog.x.misc.log4); 311 #endif 312 } 313 314 void 315 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from) 316 { 317 #if defined(SCTP_LOCAL_TRACE_BUF) 318 struct sctp_cwnd_log sctp_clog; 319 320 sctp_clog.x.cwnd.net = net; 321 if (stcb->asoc.send_queue_cnt > 255) 322 sctp_clog.x.cwnd.cnt_in_send = 255; 323 else 324 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt; 325 if (stcb->asoc.stream_queue_cnt > 255) 326 sctp_clog.x.cwnd.cnt_in_str = 255; 327 else 328 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt; 329 330 if (net) { 331 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd; 332 sctp_clog.x.cwnd.inflight = net->flight_size; 333 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack; 334 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack; 335 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack; 336 } 337 if (SCTP_CWNDLOG_PRESEND == from) { 338 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd; 339 } 340 sctp_clog.x.cwnd.cwnd_augment = augment; 341 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 342 SCTP_LOG_EVENT_CWND, 343 from, 344 sctp_clog.x.misc.log1, 345 sctp_clog.x.misc.log2, 346 sctp_clog.x.misc.log3, 347 sctp_clog.x.misc.log4); 348 #endif 349 } 350 351 void 352 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from) 353 { 354 #if defined(SCTP_LOCAL_TRACE_BUF) 355 struct sctp_cwnd_log sctp_clog; 356 357 memset(&sctp_clog, 0, sizeof(sctp_clog)); 358 if (inp) { 359 sctp_clog.x.lock.sock = (void *)inp->sctp_socket; 360 361 } else { 362 sctp_clog.x.lock.sock = (void *)NULL; 363 } 364 sctp_clog.x.lock.inp = (void *)inp; 365 if (stcb) { 366 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx); 367 } else { 368 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN; 369 } 370 if (inp) { 371 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx); 372 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx); 373 } else { 374 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN; 375 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN; 376 } 377 sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx)); 378 if (inp && (inp->sctp_socket)) { 379 sctp_clog.x.lock.sock_lock = mtx_owned(SOCK_MTX(inp->sctp_socket)); 380 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(SOCKBUF_MTX(&inp->sctp_socket->so_rcv)); 381 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(SOCKBUF_MTX(&inp->sctp_socket->so_snd)); 382 } else { 383 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN; 384 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN; 385 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN; 386 } 387 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 388 SCTP_LOG_LOCK_EVENT, 389 from, 390 sctp_clog.x.misc.log1, 391 sctp_clog.x.misc.log2, 392 sctp_clog.x.misc.log3, 393 sctp_clog.x.misc.log4); 394 #endif 395 } 396 397 void 398 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from) 399 { 400 #if defined(SCTP_LOCAL_TRACE_BUF) 401 struct sctp_cwnd_log sctp_clog; 402 403 memset(&sctp_clog, 0, sizeof(sctp_clog)); 404 sctp_clog.x.cwnd.net = net; 405 sctp_clog.x.cwnd.cwnd_new_value = error; 406 sctp_clog.x.cwnd.inflight = net->flight_size; 407 sctp_clog.x.cwnd.cwnd_augment = burst; 408 if (stcb->asoc.send_queue_cnt > 255) 409 sctp_clog.x.cwnd.cnt_in_send = 255; 410 else 411 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt; 412 if (stcb->asoc.stream_queue_cnt > 255) 413 sctp_clog.x.cwnd.cnt_in_str = 255; 414 else 415 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt; 416 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 417 SCTP_LOG_EVENT_MAXBURST, 418 from, 419 sctp_clog.x.misc.log1, 420 sctp_clog.x.misc.log2, 421 sctp_clog.x.misc.log3, 422 sctp_clog.x.misc.log4); 423 #endif 424 } 425 426 void 427 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead) 428 { 429 #if defined(SCTP_LOCAL_TRACE_BUF) 430 struct sctp_cwnd_log sctp_clog; 431 432 sctp_clog.x.rwnd.rwnd = peers_rwnd; 433 sctp_clog.x.rwnd.send_size = snd_size; 434 sctp_clog.x.rwnd.overhead = overhead; 435 sctp_clog.x.rwnd.new_rwnd = 0; 436 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 437 SCTP_LOG_EVENT_RWND, 438 from, 439 sctp_clog.x.misc.log1, 440 sctp_clog.x.misc.log2, 441 sctp_clog.x.misc.log3, 442 sctp_clog.x.misc.log4); 443 #endif 444 } 445 446 void 447 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval) 448 { 449 #if defined(SCTP_LOCAL_TRACE_BUF) 450 struct sctp_cwnd_log sctp_clog; 451 452 sctp_clog.x.rwnd.rwnd = peers_rwnd; 453 sctp_clog.x.rwnd.send_size = flight_size; 454 sctp_clog.x.rwnd.overhead = overhead; 455 sctp_clog.x.rwnd.new_rwnd = a_rwndval; 456 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 457 SCTP_LOG_EVENT_RWND, 458 from, 459 sctp_clog.x.misc.log1, 460 sctp_clog.x.misc.log2, 461 sctp_clog.x.misc.log3, 462 sctp_clog.x.misc.log4); 463 #endif 464 } 465 466 #ifdef SCTP_MBCNT_LOGGING 467 static void 468 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt) 469 { 470 #if defined(SCTP_LOCAL_TRACE_BUF) 471 struct sctp_cwnd_log sctp_clog; 472 473 sctp_clog.x.mbcnt.total_queue_size = total_oq; 474 sctp_clog.x.mbcnt.size_change = book; 475 sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q; 476 sctp_clog.x.mbcnt.mbcnt_change = mbcnt; 477 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 478 SCTP_LOG_EVENT_MBCNT, 479 from, 480 sctp_clog.x.misc.log1, 481 sctp_clog.x.misc.log2, 482 sctp_clog.x.misc.log3, 483 sctp_clog.x.misc.log4); 484 #endif 485 } 486 #endif 487 488 void 489 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d) 490 { 491 #if defined(SCTP_LOCAL_TRACE_BUF) 492 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 493 SCTP_LOG_MISC_EVENT, 494 from, 495 a, b, c, d); 496 #endif 497 } 498 499 void 500 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from) 501 { 502 #if defined(SCTP_LOCAL_TRACE_BUF) 503 struct sctp_cwnd_log sctp_clog; 504 505 sctp_clog.x.wake.stcb = (void *)stcb; 506 sctp_clog.x.wake.wake_cnt = wake_cnt; 507 sctp_clog.x.wake.flight = stcb->asoc.total_flight_count; 508 sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt; 509 sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt; 510 511 if (stcb->asoc.stream_queue_cnt < 0xff) 512 sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt; 513 else 514 sctp_clog.x.wake.stream_qcnt = 0xff; 515 516 if (stcb->asoc.chunks_on_out_queue < 0xff) 517 sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue; 518 else 519 sctp_clog.x.wake.chunks_on_oque = 0xff; 520 521 sctp_clog.x.wake.sctpflags = 0; 522 /* set in the defered mode stuff */ 523 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE) 524 sctp_clog.x.wake.sctpflags |= 1; 525 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT) 526 sctp_clog.x.wake.sctpflags |= 2; 527 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT) 528 sctp_clog.x.wake.sctpflags |= 4; 529 /* what about the sb */ 530 if (stcb->sctp_socket) { 531 struct socket *so = stcb->sctp_socket; 532 533 sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff)); 534 } else { 535 sctp_clog.x.wake.sbflags = 0xff; 536 } 537 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 538 SCTP_LOG_EVENT_WAKE, 539 from, 540 sctp_clog.x.misc.log1, 541 sctp_clog.x.misc.log2, 542 sctp_clog.x.misc.log3, 543 sctp_clog.x.misc.log4); 544 #endif 545 } 546 547 void 548 sctp_log_block(uint8_t from, struct sctp_association *asoc, ssize_t sendlen) 549 { 550 #if defined(SCTP_LOCAL_TRACE_BUF) 551 struct sctp_cwnd_log sctp_clog; 552 553 sctp_clog.x.blk.onsb = asoc->total_output_queue_size; 554 sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt); 555 sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd; 556 sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt; 557 sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue; 558 sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024); 559 sctp_clog.x.blk.sndlen = (uint32_t)sendlen; 560 SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x", 561 SCTP_LOG_EVENT_BLOCK, 562 from, 563 sctp_clog.x.misc.log1, 564 sctp_clog.x.misc.log2, 565 sctp_clog.x.misc.log3, 566 sctp_clog.x.misc.log4); 567 #endif 568 } 569 570 int 571 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED) 572 { 573 /* May need to fix this if ktrdump does not work */ 574 return (0); 575 } 576 577 #ifdef SCTP_AUDITING_ENABLED 578 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2]; 579 static int sctp_audit_indx = 0; 580 581 static 582 void 583 sctp_print_audit_report(void) 584 { 585 int i; 586 int cnt; 587 588 cnt = 0; 589 for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) { 590 if ((sctp_audit_data[i][0] == 0xe0) && 591 (sctp_audit_data[i][1] == 0x01)) { 592 cnt = 0; 593 SCTP_PRINTF("\n"); 594 } else if (sctp_audit_data[i][0] == 0xf0) { 595 cnt = 0; 596 SCTP_PRINTF("\n"); 597 } else if ((sctp_audit_data[i][0] == 0xc0) && 598 (sctp_audit_data[i][1] == 0x01)) { 599 SCTP_PRINTF("\n"); 600 cnt = 0; 601 } 602 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0], 603 (uint32_t)sctp_audit_data[i][1]); 604 cnt++; 605 if ((cnt % 14) == 0) 606 SCTP_PRINTF("\n"); 607 } 608 for (i = 0; i < sctp_audit_indx; i++) { 609 if ((sctp_audit_data[i][0] == 0xe0) && 610 (sctp_audit_data[i][1] == 0x01)) { 611 cnt = 0; 612 SCTP_PRINTF("\n"); 613 } else if (sctp_audit_data[i][0] == 0xf0) { 614 cnt = 0; 615 SCTP_PRINTF("\n"); 616 } else if ((sctp_audit_data[i][0] == 0xc0) && 617 (sctp_audit_data[i][1] == 0x01)) { 618 SCTP_PRINTF("\n"); 619 cnt = 0; 620 } 621 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0], 622 (uint32_t)sctp_audit_data[i][1]); 623 cnt++; 624 if ((cnt % 14) == 0) 625 SCTP_PRINTF("\n"); 626 } 627 SCTP_PRINTF("\n"); 628 } 629 630 void 631 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 632 struct sctp_nets *net) 633 { 634 int resend_cnt, tot_out, rep, tot_book_cnt; 635 struct sctp_nets *lnet; 636 struct sctp_tmit_chunk *chk; 637 638 sctp_audit_data[sctp_audit_indx][0] = 0xAA; 639 sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from; 640 sctp_audit_indx++; 641 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 642 sctp_audit_indx = 0; 643 } 644 if (inp == NULL) { 645 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 646 sctp_audit_data[sctp_audit_indx][1] = 0x01; 647 sctp_audit_indx++; 648 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 649 sctp_audit_indx = 0; 650 } 651 return; 652 } 653 if (stcb == NULL) { 654 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 655 sctp_audit_data[sctp_audit_indx][1] = 0x02; 656 sctp_audit_indx++; 657 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 658 sctp_audit_indx = 0; 659 } 660 return; 661 } 662 sctp_audit_data[sctp_audit_indx][0] = 0xA1; 663 sctp_audit_data[sctp_audit_indx][1] = 664 (0x000000ff & stcb->asoc.sent_queue_retran_cnt); 665 sctp_audit_indx++; 666 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 667 sctp_audit_indx = 0; 668 } 669 rep = 0; 670 tot_book_cnt = 0; 671 resend_cnt = tot_out = 0; 672 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 673 if (chk->sent == SCTP_DATAGRAM_RESEND) { 674 resend_cnt++; 675 } else if (chk->sent < SCTP_DATAGRAM_RESEND) { 676 tot_out += chk->book_size; 677 tot_book_cnt++; 678 } 679 } 680 if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) { 681 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 682 sctp_audit_data[sctp_audit_indx][1] = 0xA1; 683 sctp_audit_indx++; 684 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 685 sctp_audit_indx = 0; 686 } 687 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n", 688 resend_cnt, stcb->asoc.sent_queue_retran_cnt); 689 rep = 1; 690 stcb->asoc.sent_queue_retran_cnt = resend_cnt; 691 sctp_audit_data[sctp_audit_indx][0] = 0xA2; 692 sctp_audit_data[sctp_audit_indx][1] = 693 (0x000000ff & stcb->asoc.sent_queue_retran_cnt); 694 sctp_audit_indx++; 695 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 696 sctp_audit_indx = 0; 697 } 698 } 699 if (tot_out != stcb->asoc.total_flight) { 700 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 701 sctp_audit_data[sctp_audit_indx][1] = 0xA2; 702 sctp_audit_indx++; 703 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 704 sctp_audit_indx = 0; 705 } 706 rep = 1; 707 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out, 708 (int)stcb->asoc.total_flight); 709 stcb->asoc.total_flight = tot_out; 710 } 711 if (tot_book_cnt != stcb->asoc.total_flight_count) { 712 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 713 sctp_audit_data[sctp_audit_indx][1] = 0xA5; 714 sctp_audit_indx++; 715 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 716 sctp_audit_indx = 0; 717 } 718 rep = 1; 719 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt); 720 721 stcb->asoc.total_flight_count = tot_book_cnt; 722 } 723 tot_out = 0; 724 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) { 725 tot_out += lnet->flight_size; 726 } 727 if (tot_out != stcb->asoc.total_flight) { 728 sctp_audit_data[sctp_audit_indx][0] = 0xAF; 729 sctp_audit_data[sctp_audit_indx][1] = 0xA3; 730 sctp_audit_indx++; 731 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 732 sctp_audit_indx = 0; 733 } 734 rep = 1; 735 SCTP_PRINTF("real flight:%d net total was %d\n", 736 stcb->asoc.total_flight, tot_out); 737 /* now corrective action */ 738 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) { 739 tot_out = 0; 740 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 741 if ((chk->whoTo == lnet) && 742 (chk->sent < SCTP_DATAGRAM_RESEND)) { 743 tot_out += chk->book_size; 744 } 745 } 746 if (lnet->flight_size != tot_out) { 747 SCTP_PRINTF("net:%p flight was %d corrected to %d\n", 748 (void *)lnet, lnet->flight_size, 749 tot_out); 750 lnet->flight_size = tot_out; 751 } 752 } 753 } 754 if (rep) { 755 sctp_print_audit_report(); 756 } 757 } 758 759 void 760 sctp_audit_log(uint8_t ev, uint8_t fd) 761 { 762 763 sctp_audit_data[sctp_audit_indx][0] = ev; 764 sctp_audit_data[sctp_audit_indx][1] = fd; 765 sctp_audit_indx++; 766 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) { 767 sctp_audit_indx = 0; 768 } 769 } 770 771 #endif 772 773 /* 774 * The conversion from time to ticks and vice versa is done by rounding 775 * upwards. This way we can test in the code the time to be positive and 776 * know that this corresponds to a positive number of ticks. 777 */ 778 779 uint32_t 780 sctp_msecs_to_ticks(uint32_t msecs) 781 { 782 uint64_t temp; 783 uint32_t ticks; 784 785 if (hz == 1000) { 786 ticks = msecs; 787 } else { 788 temp = (((uint64_t)msecs * hz) + 999) / 1000; 789 if (temp > UINT32_MAX) { 790 ticks = UINT32_MAX; 791 } else { 792 ticks = (uint32_t)temp; 793 } 794 } 795 return (ticks); 796 } 797 798 uint32_t 799 sctp_ticks_to_msecs(uint32_t ticks) 800 { 801 uint64_t temp; 802 uint32_t msecs; 803 804 if (hz == 1000) { 805 msecs = ticks; 806 } else { 807 temp = (((uint64_t)ticks * 1000) + (hz - 1)) / hz; 808 if (temp > UINT32_MAX) { 809 msecs = UINT32_MAX; 810 } else { 811 msecs = (uint32_t)temp; 812 } 813 } 814 return (msecs); 815 } 816 817 uint32_t 818 sctp_secs_to_ticks(uint32_t secs) 819 { 820 uint64_t temp; 821 uint32_t ticks; 822 823 temp = (uint64_t)secs * hz; 824 if (temp > UINT32_MAX) { 825 ticks = UINT32_MAX; 826 } else { 827 ticks = (uint32_t)temp; 828 } 829 return (ticks); 830 } 831 832 uint32_t 833 sctp_ticks_to_secs(uint32_t ticks) 834 { 835 uint64_t temp; 836 uint32_t secs; 837 838 temp = ((uint64_t)ticks + (hz - 1)) / hz; 839 if (temp > UINT32_MAX) { 840 secs = UINT32_MAX; 841 } else { 842 secs = (uint32_t)temp; 843 } 844 return (secs); 845 } 846 847 /* 848 * sctp_stop_timers_for_shutdown() should be called 849 * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT 850 * state to make sure that all timers are stopped. 851 */ 852 void 853 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb) 854 { 855 struct sctp_inpcb *inp; 856 struct sctp_nets *net; 857 858 inp = stcb->sctp_ep; 859 860 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL, 861 SCTP_FROM_SCTPUTIL + SCTP_LOC_12); 862 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL, 863 SCTP_FROM_SCTPUTIL + SCTP_LOC_13); 864 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL, 865 SCTP_FROM_SCTPUTIL + SCTP_LOC_14); 866 sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL, 867 SCTP_FROM_SCTPUTIL + SCTP_LOC_15); 868 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 869 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net, 870 SCTP_FROM_SCTPUTIL + SCTP_LOC_16); 871 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, 872 SCTP_FROM_SCTPUTIL + SCTP_LOC_17); 873 } 874 } 875 876 void 877 sctp_stop_association_timers(struct sctp_tcb *stcb, bool stop_assoc_kill_timer) 878 { 879 struct sctp_inpcb *inp; 880 struct sctp_nets *net; 881 882 inp = stcb->sctp_ep; 883 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL, 884 SCTP_FROM_SCTPUTIL + SCTP_LOC_18); 885 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL, 886 SCTP_FROM_SCTPUTIL + SCTP_LOC_19); 887 if (stop_assoc_kill_timer) { 888 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, 889 SCTP_FROM_SCTPUTIL + SCTP_LOC_20); 890 } 891 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL, 892 SCTP_FROM_SCTPUTIL + SCTP_LOC_21); 893 sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL, 894 SCTP_FROM_SCTPUTIL + SCTP_LOC_22); 895 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNGUARD, inp, stcb, NULL, 896 SCTP_FROM_SCTPUTIL + SCTP_LOC_23); 897 /* Mobility adaptation */ 898 sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, inp, stcb, NULL, 899 SCTP_FROM_SCTPUTIL + SCTP_LOC_24); 900 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 901 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 902 SCTP_FROM_SCTPUTIL + SCTP_LOC_25); 903 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, 904 SCTP_FROM_SCTPUTIL + SCTP_LOC_26); 905 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, inp, stcb, net, 906 SCTP_FROM_SCTPUTIL + SCTP_LOC_27); 907 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net, 908 SCTP_FROM_SCTPUTIL + SCTP_LOC_28); 909 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, inp, stcb, net, 910 SCTP_FROM_SCTPUTIL + SCTP_LOC_29); 911 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net, 912 SCTP_FROM_SCTPUTIL + SCTP_LOC_30); 913 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, 914 SCTP_FROM_SCTPUTIL + SCTP_LOC_31); 915 } 916 } 917 918 /* 919 * A list of sizes based on typical mtu's, used only if next hop size not 920 * returned. These values MUST be multiples of 4 and MUST be ordered. 921 */ 922 static uint32_t sctp_mtu_sizes[] = { 923 68, 924 296, 925 508, 926 512, 927 544, 928 576, 929 1004, 930 1492, 931 1500, 932 1536, 933 2000, 934 2048, 935 4352, 936 4464, 937 8168, 938 17912, 939 32000, 940 65532 941 }; 942 943 /* 944 * Return the largest MTU in sctp_mtu_sizes smaller than val. 945 * If val is smaller than the minimum, just return the largest 946 * multiple of 4 smaller or equal to val. 947 * Ensure that the result is a multiple of 4. 948 */ 949 uint32_t 950 sctp_get_prev_mtu(uint32_t val) 951 { 952 uint32_t i; 953 954 val &= 0xfffffffc; 955 if (val <= sctp_mtu_sizes[0]) { 956 return (val); 957 } 958 for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) { 959 if (val <= sctp_mtu_sizes[i]) { 960 break; 961 } 962 } 963 KASSERT((sctp_mtu_sizes[i - 1] & 0x00000003) == 0, 964 ("sctp_mtu_sizes[%u] not a multiple of 4", i - 1)); 965 return (sctp_mtu_sizes[i - 1]); 966 } 967 968 /* 969 * Return the smallest MTU in sctp_mtu_sizes larger than val. 970 * If val is larger than the maximum, just return the largest multiple of 4 smaller 971 * or equal to val. 972 * Ensure that the result is a multiple of 4. 973 */ 974 uint32_t 975 sctp_get_next_mtu(uint32_t val) 976 { 977 /* select another MTU that is just bigger than this one */ 978 uint32_t i; 979 980 val &= 0xfffffffc; 981 for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) { 982 if (val < sctp_mtu_sizes[i]) { 983 KASSERT((sctp_mtu_sizes[i] & 0x00000003) == 0, 984 ("sctp_mtu_sizes[%u] not a multiple of 4", i)); 985 return (sctp_mtu_sizes[i]); 986 } 987 } 988 return (val); 989 } 990 991 void 992 sctp_fill_random_store(struct sctp_pcb *m) 993 { 994 /* 995 * Here we use the MD5/SHA-1 to hash with our good randomNumbers and 996 * our counter. The result becomes our good random numbers and we 997 * then setup to give these out. Note that we do no locking to 998 * protect this. This is ok, since if competing folks call this we 999 * will get more gobbled gook in the random store which is what we 1000 * want. There is a danger that two guys will use the same random 1001 * numbers, but thats ok too since that is random as well :-> 1002 */ 1003 m->store_at = 0; 1004 (void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers, 1005 sizeof(m->random_numbers), (uint8_t *)&m->random_counter, 1006 sizeof(m->random_counter), (uint8_t *)m->random_store); 1007 m->random_counter++; 1008 } 1009 1010 uint32_t 1011 sctp_select_initial_TSN(struct sctp_pcb *inp) 1012 { 1013 /* 1014 * A true implementation should use random selection process to get 1015 * the initial stream sequence number, using RFC1750 as a good 1016 * guideline 1017 */ 1018 uint32_t x, *xp; 1019 uint8_t *p; 1020 int store_at, new_store; 1021 1022 if (inp->initial_sequence_debug != 0) { 1023 uint32_t ret; 1024 1025 ret = inp->initial_sequence_debug; 1026 inp->initial_sequence_debug++; 1027 return (ret); 1028 } 1029 retry: 1030 store_at = inp->store_at; 1031 new_store = store_at + sizeof(uint32_t); 1032 if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) { 1033 new_store = 0; 1034 } 1035 if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) { 1036 goto retry; 1037 } 1038 if (new_store == 0) { 1039 /* Refill the random store */ 1040 sctp_fill_random_store(inp); 1041 } 1042 p = &inp->random_store[store_at]; 1043 xp = (uint32_t *)p; 1044 x = *xp; 1045 return (x); 1046 } 1047 1048 uint32_t 1049 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check) 1050 { 1051 uint32_t x; 1052 struct timeval now; 1053 1054 if (check) { 1055 (void)SCTP_GETTIME_TIMEVAL(&now); 1056 } 1057 for (;;) { 1058 x = sctp_select_initial_TSN(&inp->sctp_ep); 1059 if (x == 0) { 1060 /* we never use 0 */ 1061 continue; 1062 } 1063 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) { 1064 break; 1065 } 1066 } 1067 return (x); 1068 } 1069 1070 int32_t 1071 sctp_map_assoc_state(int kernel_state) 1072 { 1073 int32_t user_state; 1074 1075 if (kernel_state & SCTP_STATE_WAS_ABORTED) { 1076 user_state = SCTP_CLOSED; 1077 } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) { 1078 user_state = SCTP_SHUTDOWN_PENDING; 1079 } else { 1080 switch (kernel_state & SCTP_STATE_MASK) { 1081 case SCTP_STATE_EMPTY: 1082 user_state = SCTP_CLOSED; 1083 break; 1084 case SCTP_STATE_INUSE: 1085 user_state = SCTP_CLOSED; 1086 break; 1087 case SCTP_STATE_COOKIE_WAIT: 1088 user_state = SCTP_COOKIE_WAIT; 1089 break; 1090 case SCTP_STATE_COOKIE_ECHOED: 1091 user_state = SCTP_COOKIE_ECHOED; 1092 break; 1093 case SCTP_STATE_OPEN: 1094 user_state = SCTP_ESTABLISHED; 1095 break; 1096 case SCTP_STATE_SHUTDOWN_SENT: 1097 user_state = SCTP_SHUTDOWN_SENT; 1098 break; 1099 case SCTP_STATE_SHUTDOWN_RECEIVED: 1100 user_state = SCTP_SHUTDOWN_RECEIVED; 1101 break; 1102 case SCTP_STATE_SHUTDOWN_ACK_SENT: 1103 user_state = SCTP_SHUTDOWN_ACK_SENT; 1104 break; 1105 default: 1106 user_state = SCTP_CLOSED; 1107 break; 1108 } 1109 } 1110 return (user_state); 1111 } 1112 1113 int 1114 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 1115 uint32_t override_tag, uint32_t initial_tsn, uint32_t vrf_id, 1116 uint16_t o_strms) 1117 { 1118 struct sctp_association *asoc; 1119 1120 /* 1121 * Anything set to zero is taken care of by the allocation routine's 1122 * bzero 1123 */ 1124 1125 /* 1126 * Up front select what scoping to apply on addresses I tell my peer 1127 * Not sure what to do with these right now, we will need to come up 1128 * with a way to set them. We may need to pass them through from the 1129 * caller in the sctp_aloc_assoc() function. 1130 */ 1131 int i; 1132 #if defined(SCTP_DETAILED_STR_STATS) 1133 int j; 1134 #endif 1135 1136 asoc = &stcb->asoc; 1137 /* init all variables to a known value. */ 1138 SCTP_SET_STATE(stcb, SCTP_STATE_INUSE); 1139 asoc->max_burst = inp->sctp_ep.max_burst; 1140 asoc->fr_max_burst = inp->sctp_ep.fr_max_burst; 1141 asoc->heart_beat_delay = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]); 1142 asoc->cookie_life = inp->sctp_ep.def_cookie_life; 1143 asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off; 1144 asoc->ecn_supported = inp->ecn_supported; 1145 asoc->prsctp_supported = inp->prsctp_supported; 1146 asoc->auth_supported = inp->auth_supported; 1147 asoc->asconf_supported = inp->asconf_supported; 1148 asoc->reconfig_supported = inp->reconfig_supported; 1149 asoc->nrsack_supported = inp->nrsack_supported; 1150 asoc->pktdrop_supported = inp->pktdrop_supported; 1151 asoc->idata_supported = inp->idata_supported; 1152 asoc->sctp_cmt_pf = (uint8_t)0; 1153 asoc->sctp_frag_point = inp->sctp_frag_point; 1154 asoc->sctp_features = inp->sctp_features; 1155 asoc->default_dscp = inp->sctp_ep.default_dscp; 1156 asoc->max_cwnd = inp->max_cwnd; 1157 #ifdef INET6 1158 if (inp->sctp_ep.default_flowlabel) { 1159 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel; 1160 } else { 1161 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) { 1162 asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep); 1163 asoc->default_flowlabel &= 0x000fffff; 1164 asoc->default_flowlabel |= 0x80000000; 1165 } else { 1166 asoc->default_flowlabel = 0; 1167 } 1168 } 1169 #endif 1170 asoc->sb_send_resv = 0; 1171 if (override_tag) { 1172 asoc->my_vtag = override_tag; 1173 } else { 1174 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1); 1175 } 1176 /* Get the nonce tags */ 1177 asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0); 1178 asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0); 1179 asoc->vrf_id = vrf_id; 1180 1181 #ifdef SCTP_ASOCLOG_OF_TSNS 1182 asoc->tsn_in_at = 0; 1183 asoc->tsn_out_at = 0; 1184 asoc->tsn_in_wrapped = 0; 1185 asoc->tsn_out_wrapped = 0; 1186 asoc->cumack_log_at = 0; 1187 asoc->cumack_log_atsnt = 0; 1188 #endif 1189 #ifdef SCTP_FS_SPEC_LOG 1190 asoc->fs_index = 0; 1191 #endif 1192 asoc->refcnt = 0; 1193 asoc->assoc_up_sent = 0; 1194 if (override_tag) { 1195 asoc->init_seq_number = initial_tsn; 1196 } else { 1197 asoc->init_seq_number = sctp_select_initial_TSN(&inp->sctp_ep); 1198 } 1199 asoc->asconf_seq_out = asoc->init_seq_number; 1200 asoc->str_reset_seq_out = asoc->init_seq_number; 1201 asoc->sending_seq = asoc->init_seq_number; 1202 asoc->asconf_seq_out_acked = asoc->init_seq_number - 1; 1203 /* we are optimisitic here */ 1204 asoc->peer_supports_nat = 0; 1205 asoc->sent_queue_retran_cnt = 0; 1206 1207 /* for CMT */ 1208 asoc->last_net_cmt_send_started = NULL; 1209 1210 asoc->last_acked_seq = asoc->init_seq_number - 1; 1211 asoc->advanced_peer_ack_point = asoc->init_seq_number - 1; 1212 asoc->asconf_seq_in = asoc->init_seq_number - 1; 1213 1214 /* here we are different, we hold the next one we expect */ 1215 asoc->str_reset_seq_in = asoc->init_seq_number; 1216 1217 asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max; 1218 asoc->initial_rto = inp->sctp_ep.initial_rto; 1219 1220 asoc->default_mtu = inp->sctp_ep.default_mtu; 1221 asoc->max_init_times = inp->sctp_ep.max_init_times; 1222 asoc->max_send_times = inp->sctp_ep.max_send_times; 1223 asoc->def_net_failure = inp->sctp_ep.def_net_failure; 1224 asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold; 1225 asoc->free_chunk_cnt = 0; 1226 1227 asoc->iam_blocking = 0; 1228 asoc->context = inp->sctp_context; 1229 asoc->local_strreset_support = inp->local_strreset_support; 1230 asoc->def_send = inp->def_send; 1231 asoc->delayed_ack = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]); 1232 asoc->sack_freq = inp->sctp_ep.sctp_sack_freq; 1233 asoc->pr_sctp_cnt = 0; 1234 asoc->total_output_queue_size = 0; 1235 1236 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 1237 asoc->scope.ipv6_addr_legal = 1; 1238 if (SCTP_IPV6_V6ONLY(inp) == 0) { 1239 asoc->scope.ipv4_addr_legal = 1; 1240 } else { 1241 asoc->scope.ipv4_addr_legal = 0; 1242 } 1243 } else { 1244 asoc->scope.ipv6_addr_legal = 0; 1245 asoc->scope.ipv4_addr_legal = 1; 1246 } 1247 1248 asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND); 1249 asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket); 1250 1251 asoc->smallest_mtu = 0; 1252 asoc->minrto = inp->sctp_ep.sctp_minrto; 1253 asoc->maxrto = inp->sctp_ep.sctp_maxrto; 1254 1255 asoc->stream_locked_on = 0; 1256 asoc->ecn_echo_cnt_onq = 0; 1257 asoc->stream_locked = 0; 1258 1259 asoc->send_sack = 1; 1260 1261 LIST_INIT(&asoc->sctp_restricted_addrs); 1262 1263 TAILQ_INIT(&asoc->nets); 1264 TAILQ_INIT(&asoc->pending_reply_queue); 1265 TAILQ_INIT(&asoc->asconf_ack_sent); 1266 /* Setup to fill the hb random cache at first HB */ 1267 asoc->hb_random_idx = 4; 1268 1269 asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time; 1270 1271 stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module; 1272 stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module]; 1273 1274 stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module; 1275 stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module]; 1276 1277 /* 1278 * Now the stream parameters, here we allocate space for all streams 1279 * that we request by default. 1280 */ 1281 asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams = 1282 o_strms; 1283 SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *, 1284 asoc->streamoutcnt * sizeof(struct sctp_stream_out), 1285 SCTP_M_STRMO); 1286 if (asoc->strmout == NULL) { 1287 /* big trouble no memory */ 1288 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 1289 return (ENOMEM); 1290 } 1291 SCTP_TCB_SEND_LOCK(stcb); 1292 for (i = 0; i < asoc->streamoutcnt; i++) { 1293 /* 1294 * inbound side must be set to 0xffff, also NOTE when we get 1295 * the INIT-ACK back (for INIT sender) we MUST reduce the 1296 * count (streamoutcnt) but first check if we sent to any of 1297 * the upper streams that were dropped (if some were). Those 1298 * that were dropped must be notified to the upper layer as 1299 * failed to send. 1300 */ 1301 TAILQ_INIT(&asoc->strmout[i].outqueue); 1302 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL); 1303 asoc->strmout[i].chunks_on_queues = 0; 1304 #if defined(SCTP_DETAILED_STR_STATS) 1305 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 1306 asoc->strmout[i].abandoned_sent[j] = 0; 1307 asoc->strmout[i].abandoned_unsent[j] = 0; 1308 } 1309 #else 1310 asoc->strmout[i].abandoned_sent[0] = 0; 1311 asoc->strmout[i].abandoned_unsent[0] = 0; 1312 #endif 1313 asoc->strmout[i].next_mid_ordered = 0; 1314 asoc->strmout[i].next_mid_unordered = 0; 1315 asoc->strmout[i].sid = i; 1316 asoc->strmout[i].last_msg_incomplete = 0; 1317 asoc->strmout[i].state = SCTP_STREAM_OPENING; 1318 } 1319 asoc->ss_functions.sctp_ss_init(stcb, asoc); 1320 SCTP_TCB_SEND_UNLOCK(stcb); 1321 1322 /* Now the mapping array */ 1323 asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY; 1324 SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size, 1325 SCTP_M_MAP); 1326 if (asoc->mapping_array == NULL) { 1327 SCTP_FREE(asoc->strmout, SCTP_M_STRMO); 1328 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 1329 return (ENOMEM); 1330 } 1331 memset(asoc->mapping_array, 0, asoc->mapping_array_size); 1332 SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size, 1333 SCTP_M_MAP); 1334 if (asoc->nr_mapping_array == NULL) { 1335 SCTP_FREE(asoc->strmout, SCTP_M_STRMO); 1336 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP); 1337 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 1338 return (ENOMEM); 1339 } 1340 memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size); 1341 1342 /* Now the init of the other outqueues */ 1343 TAILQ_INIT(&asoc->free_chunks); 1344 TAILQ_INIT(&asoc->control_send_queue); 1345 TAILQ_INIT(&asoc->asconf_send_queue); 1346 TAILQ_INIT(&asoc->send_queue); 1347 TAILQ_INIT(&asoc->sent_queue); 1348 TAILQ_INIT(&asoc->resetHead); 1349 asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome; 1350 TAILQ_INIT(&asoc->asconf_queue); 1351 /* authentication fields */ 1352 asoc->authinfo.random = NULL; 1353 asoc->authinfo.active_keyid = 0; 1354 asoc->authinfo.assoc_key = NULL; 1355 asoc->authinfo.assoc_keyid = 0; 1356 asoc->authinfo.recv_key = NULL; 1357 asoc->authinfo.recv_keyid = 0; 1358 LIST_INIT(&asoc->shared_keys); 1359 asoc->marked_retrans = 0; 1360 asoc->port = inp->sctp_ep.port; 1361 asoc->timoinit = 0; 1362 asoc->timodata = 0; 1363 asoc->timosack = 0; 1364 asoc->timoshutdown = 0; 1365 asoc->timoheartbeat = 0; 1366 asoc->timocookie = 0; 1367 asoc->timoshutdownack = 0; 1368 (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time); 1369 asoc->discontinuity_time = asoc->start_time; 1370 for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) { 1371 asoc->abandoned_unsent[i] = 0; 1372 asoc->abandoned_sent[i] = 0; 1373 } 1374 /* 1375 * sa_ignore MEMLEAK {memory is put in the assoc mapping array and 1376 * freed later when the association is freed. 1377 */ 1378 return (0); 1379 } 1380 1381 void 1382 sctp_print_mapping_array(struct sctp_association *asoc) 1383 { 1384 unsigned int i, limit; 1385 1386 SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n", 1387 asoc->mapping_array_size, 1388 asoc->mapping_array_base_tsn, 1389 asoc->cumulative_tsn, 1390 asoc->highest_tsn_inside_map, 1391 asoc->highest_tsn_inside_nr_map); 1392 for (limit = asoc->mapping_array_size; limit > 1; limit--) { 1393 if (asoc->mapping_array[limit - 1] != 0) { 1394 break; 1395 } 1396 } 1397 SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit); 1398 for (i = 0; i < limit; i++) { 1399 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n'); 1400 } 1401 if (limit % 16) 1402 SCTP_PRINTF("\n"); 1403 for (limit = asoc->mapping_array_size; limit > 1; limit--) { 1404 if (asoc->nr_mapping_array[limit - 1]) { 1405 break; 1406 } 1407 } 1408 SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit); 1409 for (i = 0; i < limit; i++) { 1410 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n'); 1411 } 1412 if (limit % 16) 1413 SCTP_PRINTF("\n"); 1414 } 1415 1416 int 1417 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed) 1418 { 1419 /* mapping array needs to grow */ 1420 uint8_t *new_array1, *new_array2; 1421 uint32_t new_size; 1422 1423 new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR); 1424 SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP); 1425 SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP); 1426 if ((new_array1 == NULL) || (new_array2 == NULL)) { 1427 /* can't get more, forget it */ 1428 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size); 1429 if (new_array1) { 1430 SCTP_FREE(new_array1, SCTP_M_MAP); 1431 } 1432 if (new_array2) { 1433 SCTP_FREE(new_array2, SCTP_M_MAP); 1434 } 1435 return (-1); 1436 } 1437 memset(new_array1, 0, new_size); 1438 memset(new_array2, 0, new_size); 1439 memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size); 1440 memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size); 1441 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP); 1442 SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP); 1443 asoc->mapping_array = new_array1; 1444 asoc->nr_mapping_array = new_array2; 1445 asoc->mapping_array_size = new_size; 1446 return (0); 1447 } 1448 1449 static void 1450 sctp_iterator_work(struct sctp_iterator *it) 1451 { 1452 struct epoch_tracker et; 1453 struct sctp_inpcb *tinp; 1454 int iteration_count = 0; 1455 int inp_skip = 0; 1456 int first_in = 1; 1457 1458 NET_EPOCH_ENTER(et); 1459 SCTP_INP_INFO_RLOCK(); 1460 SCTP_ITERATOR_LOCK(); 1461 sctp_it_ctl.cur_it = it; 1462 if (it->inp) { 1463 SCTP_INP_RLOCK(it->inp); 1464 SCTP_INP_DECR_REF(it->inp); 1465 } 1466 if (it->inp == NULL) { 1467 /* iterator is complete */ 1468 done_with_iterator: 1469 sctp_it_ctl.cur_it = NULL; 1470 SCTP_ITERATOR_UNLOCK(); 1471 SCTP_INP_INFO_RUNLOCK(); 1472 if (it->function_atend != NULL) { 1473 (*it->function_atend) (it->pointer, it->val); 1474 } 1475 SCTP_FREE(it, SCTP_M_ITER); 1476 NET_EPOCH_EXIT(et); 1477 return; 1478 } 1479 select_a_new_ep: 1480 if (first_in) { 1481 first_in = 0; 1482 } else { 1483 SCTP_INP_RLOCK(it->inp); 1484 } 1485 while (((it->pcb_flags) && 1486 ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) || 1487 ((it->pcb_features) && 1488 ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) { 1489 /* endpoint flags or features don't match, so keep looking */ 1490 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 1491 SCTP_INP_RUNLOCK(it->inp); 1492 goto done_with_iterator; 1493 } 1494 tinp = it->inp; 1495 it->inp = LIST_NEXT(it->inp, sctp_list); 1496 it->stcb = NULL; 1497 SCTP_INP_RUNLOCK(tinp); 1498 if (it->inp == NULL) { 1499 goto done_with_iterator; 1500 } 1501 SCTP_INP_RLOCK(it->inp); 1502 } 1503 /* now go through each assoc which is in the desired state */ 1504 if (it->done_current_ep == 0) { 1505 if (it->function_inp != NULL) 1506 inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val); 1507 it->done_current_ep = 1; 1508 } 1509 if (it->stcb == NULL) { 1510 /* run the per instance function */ 1511 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list); 1512 } 1513 if ((inp_skip) || it->stcb == NULL) { 1514 if (it->function_inp_end != NULL) { 1515 inp_skip = (*it->function_inp_end) (it->inp, 1516 it->pointer, 1517 it->val); 1518 } 1519 SCTP_INP_RUNLOCK(it->inp); 1520 goto no_stcb; 1521 } 1522 while (it->stcb != NULL) { 1523 SCTP_TCB_LOCK(it->stcb); 1524 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) { 1525 /* not in the right state... keep looking */ 1526 SCTP_TCB_UNLOCK(it->stcb); 1527 goto next_assoc; 1528 } 1529 /* see if we have limited out the iterator loop */ 1530 iteration_count++; 1531 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) { 1532 /* Pause to let others grab the lock */ 1533 atomic_add_int(&it->stcb->asoc.refcnt, 1); 1534 SCTP_TCB_UNLOCK(it->stcb); 1535 SCTP_INP_INCR_REF(it->inp); 1536 SCTP_INP_RUNLOCK(it->inp); 1537 SCTP_ITERATOR_UNLOCK(); 1538 SCTP_INP_INFO_RUNLOCK(); 1539 SCTP_INP_INFO_RLOCK(); 1540 SCTP_ITERATOR_LOCK(); 1541 if (sctp_it_ctl.iterator_flags) { 1542 /* We won't be staying here */ 1543 SCTP_INP_DECR_REF(it->inp); 1544 atomic_subtract_int(&it->stcb->asoc.refcnt, 1); 1545 if (sctp_it_ctl.iterator_flags & 1546 SCTP_ITERATOR_STOP_CUR_IT) { 1547 sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT; 1548 goto done_with_iterator; 1549 } 1550 if (sctp_it_ctl.iterator_flags & 1551 SCTP_ITERATOR_STOP_CUR_INP) { 1552 sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP; 1553 goto no_stcb; 1554 } 1555 /* If we reach here huh? */ 1556 SCTP_PRINTF("Unknown it ctl flag %x\n", 1557 sctp_it_ctl.iterator_flags); 1558 sctp_it_ctl.iterator_flags = 0; 1559 } 1560 SCTP_INP_RLOCK(it->inp); 1561 SCTP_INP_DECR_REF(it->inp); 1562 SCTP_TCB_LOCK(it->stcb); 1563 atomic_subtract_int(&it->stcb->asoc.refcnt, 1); 1564 iteration_count = 0; 1565 } 1566 KASSERT(it->inp == it->stcb->sctp_ep, 1567 ("%s: stcb %p does not belong to inp %p, but inp %p", 1568 __func__, it->stcb, it->inp, it->stcb->sctp_ep)); 1569 SCTP_INP_RLOCK_ASSERT(it->inp); 1570 SCTP_TCB_LOCK_ASSERT(it->stcb); 1571 1572 /* run function on this one */ 1573 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val); 1574 SCTP_INP_RLOCK_ASSERT(it->inp); 1575 SCTP_TCB_LOCK_ASSERT(it->stcb); 1576 1577 /* 1578 * we lie here, it really needs to have its own type but 1579 * first I must verify that this won't effect things :-0 1580 */ 1581 if (it->no_chunk_output == 0) { 1582 sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED); 1583 SCTP_INP_RLOCK_ASSERT(it->inp); 1584 SCTP_TCB_LOCK_ASSERT(it->stcb); 1585 } 1586 1587 SCTP_TCB_UNLOCK(it->stcb); 1588 next_assoc: 1589 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist); 1590 if (it->stcb == NULL) { 1591 /* Run last function */ 1592 if (it->function_inp_end != NULL) { 1593 inp_skip = (*it->function_inp_end) (it->inp, 1594 it->pointer, 1595 it->val); 1596 } 1597 } 1598 } 1599 SCTP_INP_RUNLOCK(it->inp); 1600 no_stcb: 1601 /* done with all assocs on this endpoint, move on to next endpoint */ 1602 it->done_current_ep = 0; 1603 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 1604 it->inp = NULL; 1605 } else { 1606 it->inp = LIST_NEXT(it->inp, sctp_list); 1607 } 1608 it->stcb = NULL; 1609 if (it->inp == NULL) { 1610 goto done_with_iterator; 1611 } 1612 goto select_a_new_ep; 1613 } 1614 1615 void 1616 sctp_iterator_worker(void) 1617 { 1618 struct sctp_iterator *it; 1619 1620 /* This function is called with the WQ lock in place */ 1621 sctp_it_ctl.iterator_running = 1; 1622 while ((it = TAILQ_FIRST(&sctp_it_ctl.iteratorhead)) != NULL) { 1623 /* now lets work on this one */ 1624 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr); 1625 SCTP_IPI_ITERATOR_WQ_UNLOCK(); 1626 CURVNET_SET(it->vn); 1627 sctp_iterator_work(it); 1628 CURVNET_RESTORE(); 1629 SCTP_IPI_ITERATOR_WQ_LOCK(); 1630 /* sa_ignore FREED_MEMORY */ 1631 } 1632 sctp_it_ctl.iterator_running = 0; 1633 return; 1634 } 1635 1636 static void 1637 sctp_handle_addr_wq(void) 1638 { 1639 /* deal with the ADDR wq from the rtsock calls */ 1640 struct sctp_laddr *wi, *nwi; 1641 struct sctp_asconf_iterator *asc; 1642 1643 SCTP_MALLOC(asc, struct sctp_asconf_iterator *, 1644 sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT); 1645 if (asc == NULL) { 1646 /* Try later, no memory */ 1647 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ, 1648 (struct sctp_inpcb *)NULL, 1649 (struct sctp_tcb *)NULL, 1650 (struct sctp_nets *)NULL); 1651 return; 1652 } 1653 LIST_INIT(&asc->list_of_work); 1654 asc->cnt = 0; 1655 1656 LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) { 1657 LIST_REMOVE(wi, sctp_nxt_addr); 1658 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr); 1659 asc->cnt++; 1660 } 1661 1662 if (asc->cnt == 0) { 1663 SCTP_FREE(asc, SCTP_M_ASC_IT); 1664 } else { 1665 int ret; 1666 1667 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep, 1668 sctp_asconf_iterator_stcb, 1669 NULL, /* No ep end for boundall */ 1670 SCTP_PCB_FLAGS_BOUNDALL, 1671 SCTP_PCB_ANY_FEATURES, 1672 SCTP_ASOC_ANY_STATE, 1673 (void *)asc, 0, 1674 sctp_asconf_iterator_end, NULL, 0); 1675 if (ret) { 1676 SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n"); 1677 /* 1678 * Freeing if we are stopping or put back on the 1679 * addr_wq. 1680 */ 1681 if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) { 1682 sctp_asconf_iterator_end(asc, 0); 1683 } else { 1684 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) { 1685 LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr); 1686 } 1687 SCTP_FREE(asc, SCTP_M_ASC_IT); 1688 } 1689 } 1690 } 1691 } 1692 1693 /*- 1694 * The following table shows which pointers for the inp, stcb, or net are 1695 * stored for each timer after it was started. 1696 * 1697 *|Name |Timer |inp |stcb|net | 1698 *|-----------------------------|-----------------------------|----|----|----| 1699 *|SCTP_TIMER_TYPE_SEND |net->rxt_timer |Yes |Yes |Yes | 1700 *|SCTP_TIMER_TYPE_INIT |net->rxt_timer |Yes |Yes |Yes | 1701 *|SCTP_TIMER_TYPE_RECV |stcb->asoc.dack_timer |Yes |Yes |No | 1702 *|SCTP_TIMER_TYPE_SHUTDOWN |net->rxt_timer |Yes |Yes |Yes | 1703 *|SCTP_TIMER_TYPE_HEARTBEAT |net->hb_timer |Yes |Yes |Yes | 1704 *|SCTP_TIMER_TYPE_COOKIE |net->rxt_timer |Yes |Yes |Yes | 1705 *|SCTP_TIMER_TYPE_NEWCOOKIE |inp->sctp_ep.signature_change|Yes |No |No | 1706 *|SCTP_TIMER_TYPE_PATHMTURAISE |net->pmtu_timer |Yes |Yes |Yes | 1707 *|SCTP_TIMER_TYPE_SHUTDOWNACK |net->rxt_timer |Yes |Yes |Yes | 1708 *|SCTP_TIMER_TYPE_ASCONF |stcb->asoc.asconf_timer |Yes |Yes |Yes | 1709 *|SCTP_TIMER_TYPE_SHUTDOWNGUARD|stcb->asoc.shut_guard_timer |Yes |Yes |No | 1710 *|SCTP_TIMER_TYPE_AUTOCLOSE |stcb->asoc.autoclose_timer |Yes |Yes |No | 1711 *|SCTP_TIMER_TYPE_STRRESET |stcb->asoc.strreset_timer |Yes |Yes |No | 1712 *|SCTP_TIMER_TYPE_INPKILL |inp->sctp_ep.signature_change|Yes |No |No | 1713 *|SCTP_TIMER_TYPE_ASOCKILL |stcb->asoc.strreset_timer |Yes |Yes |No | 1714 *|SCTP_TIMER_TYPE_ADDR_WQ |SCTP_BASE_INFO(addr_wq_timer)|No |No |No | 1715 *|SCTP_TIMER_TYPE_PRIM_DELETED |stcb->asoc.delete_prim_timer |Yes |Yes |No | 1716 */ 1717 1718 void 1719 sctp_timeout_handler(void *t) 1720 { 1721 struct epoch_tracker et; 1722 struct timeval tv; 1723 struct sctp_inpcb *inp; 1724 struct sctp_tcb *stcb; 1725 struct sctp_nets *net; 1726 struct sctp_timer *tmr; 1727 struct mbuf *op_err; 1728 int type; 1729 int i, secret; 1730 bool did_output, released_asoc_reference; 1731 1732 /* 1733 * If inp, stcb or net are not NULL, then references to these were 1734 * added when the timer was started, and must be released before 1735 * this function returns. 1736 */ 1737 tmr = (struct sctp_timer *)t; 1738 inp = (struct sctp_inpcb *)tmr->ep; 1739 stcb = (struct sctp_tcb *)tmr->tcb; 1740 net = (struct sctp_nets *)tmr->net; 1741 CURVNET_SET((struct vnet *)tmr->vnet); 1742 NET_EPOCH_ENTER(et); 1743 released_asoc_reference = false; 1744 1745 #ifdef SCTP_AUDITING_ENABLED 1746 sctp_audit_log(0xF0, (uint8_t)tmr->type); 1747 sctp_auditing(3, inp, stcb, net); 1748 #endif 1749 1750 /* sanity checks... */ 1751 KASSERT(tmr->self == NULL || tmr->self == tmr, 1752 ("sctp_timeout_handler: tmr->self corrupted")); 1753 KASSERT(SCTP_IS_TIMER_TYPE_VALID(tmr->type), 1754 ("sctp_timeout_handler: invalid timer type %d", tmr->type)); 1755 type = tmr->type; 1756 KASSERT(stcb == NULL || stcb->sctp_ep == inp, 1757 ("sctp_timeout_handler of type %d: inp = %p, stcb->sctp_ep %p", 1758 type, stcb, stcb->sctp_ep)); 1759 tmr->stopped_from = 0xa001; 1760 if ((stcb != NULL) && (stcb->asoc.state == SCTP_STATE_EMPTY)) { 1761 SCTPDBG(SCTP_DEBUG_TIMER2, 1762 "Timer type %d handler exiting due to CLOSED association.\n", 1763 type); 1764 goto out_decr; 1765 } 1766 tmr->stopped_from = 0xa002; 1767 SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d goes off.\n", type); 1768 if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) { 1769 SCTPDBG(SCTP_DEBUG_TIMER2, 1770 "Timer type %d handler exiting due to not being active.\n", 1771 type); 1772 goto out_decr; 1773 } 1774 1775 tmr->stopped_from = 0xa003; 1776 if (stcb) { 1777 SCTP_TCB_LOCK(stcb); 1778 /* 1779 * Release reference so that association can be freed if 1780 * necessary below. This is safe now that we have acquired 1781 * the lock. 1782 */ 1783 atomic_subtract_int(&stcb->asoc.refcnt, 1); 1784 released_asoc_reference = true; 1785 if ((type != SCTP_TIMER_TYPE_ASOCKILL) && 1786 ((stcb->asoc.state == SCTP_STATE_EMPTY) || 1787 (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) { 1788 SCTPDBG(SCTP_DEBUG_TIMER2, 1789 "Timer type %d handler exiting due to CLOSED association.\n", 1790 type); 1791 goto out; 1792 } 1793 } else if (inp != NULL) { 1794 SCTP_INP_WLOCK(inp); 1795 } else { 1796 SCTP_WQ_ADDR_LOCK(); 1797 } 1798 1799 /* Record in stopped_from which timeout occurred. */ 1800 tmr->stopped_from = type; 1801 /* mark as being serviced now */ 1802 if (SCTP_OS_TIMER_PENDING(&tmr->timer)) { 1803 /* 1804 * Callout has been rescheduled. 1805 */ 1806 goto out; 1807 } 1808 if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) { 1809 /* 1810 * Not active, so no action. 1811 */ 1812 goto out; 1813 } 1814 SCTP_OS_TIMER_DEACTIVATE(&tmr->timer); 1815 1816 /* call the handler for the appropriate timer type */ 1817 switch (type) { 1818 case SCTP_TIMER_TYPE_SEND: 1819 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1820 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1821 type, inp, stcb, net)); 1822 SCTP_STAT_INCR(sctps_timodata); 1823 stcb->asoc.timodata++; 1824 stcb->asoc.num_send_timers_up--; 1825 if (stcb->asoc.num_send_timers_up < 0) { 1826 stcb->asoc.num_send_timers_up = 0; 1827 } 1828 SCTP_TCB_LOCK_ASSERT(stcb); 1829 if (sctp_t3rxt_timer(inp, stcb, net)) { 1830 /* no need to unlock on tcb its gone */ 1831 1832 goto out_decr; 1833 } 1834 SCTP_TCB_LOCK_ASSERT(stcb); 1835 #ifdef SCTP_AUDITING_ENABLED 1836 sctp_auditing(4, inp, stcb, net); 1837 #endif 1838 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED); 1839 did_output = true; 1840 if ((stcb->asoc.num_send_timers_up == 0) && 1841 (stcb->asoc.sent_queue_cnt > 0)) { 1842 struct sctp_tmit_chunk *chk; 1843 1844 /* 1845 * Safeguard. If there on some on the sent queue 1846 * somewhere but no timers running something is 1847 * wrong... so we start a timer on the first chunk 1848 * on the send queue on whatever net it is sent to. 1849 */ 1850 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 1851 if (chk->whoTo != NULL) { 1852 break; 1853 } 1854 } 1855 if (chk != NULL) { 1856 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo); 1857 } 1858 } 1859 break; 1860 case SCTP_TIMER_TYPE_INIT: 1861 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1862 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1863 type, inp, stcb, net)); 1864 SCTP_STAT_INCR(sctps_timoinit); 1865 stcb->asoc.timoinit++; 1866 if (sctp_t1init_timer(inp, stcb, net)) { 1867 /* no need to unlock on tcb its gone */ 1868 goto out_decr; 1869 } 1870 did_output = false; 1871 break; 1872 case SCTP_TIMER_TYPE_RECV: 1873 KASSERT(inp != NULL && stcb != NULL && net == NULL, 1874 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1875 type, inp, stcb, net)); 1876 SCTP_STAT_INCR(sctps_timosack); 1877 stcb->asoc.timosack++; 1878 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED); 1879 #ifdef SCTP_AUDITING_ENABLED 1880 sctp_auditing(4, inp, stcb, NULL); 1881 #endif 1882 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED); 1883 did_output = true; 1884 break; 1885 case SCTP_TIMER_TYPE_SHUTDOWN: 1886 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1887 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1888 type, inp, stcb, net)); 1889 SCTP_STAT_INCR(sctps_timoshutdown); 1890 stcb->asoc.timoshutdown++; 1891 if (sctp_shutdown_timer(inp, stcb, net)) { 1892 /* no need to unlock on tcb its gone */ 1893 goto out_decr; 1894 } 1895 #ifdef SCTP_AUDITING_ENABLED 1896 sctp_auditing(4, inp, stcb, net); 1897 #endif 1898 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED); 1899 did_output = true; 1900 break; 1901 case SCTP_TIMER_TYPE_HEARTBEAT: 1902 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1903 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1904 type, inp, stcb, net)); 1905 SCTP_STAT_INCR(sctps_timoheartbeat); 1906 stcb->asoc.timoheartbeat++; 1907 if (sctp_heartbeat_timer(inp, stcb, net)) { 1908 /* no need to unlock on tcb its gone */ 1909 goto out_decr; 1910 } 1911 #ifdef SCTP_AUDITING_ENABLED 1912 sctp_auditing(4, inp, stcb, net); 1913 #endif 1914 if (!(net->dest_state & SCTP_ADDR_NOHB)) { 1915 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net); 1916 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED); 1917 did_output = true; 1918 } else { 1919 did_output = false; 1920 } 1921 break; 1922 case SCTP_TIMER_TYPE_COOKIE: 1923 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1924 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1925 type, inp, stcb, net)); 1926 SCTP_STAT_INCR(sctps_timocookie); 1927 stcb->asoc.timocookie++; 1928 if (sctp_cookie_timer(inp, stcb, net)) { 1929 /* no need to unlock on tcb its gone */ 1930 goto out_decr; 1931 } 1932 #ifdef SCTP_AUDITING_ENABLED 1933 sctp_auditing(4, inp, stcb, net); 1934 #endif 1935 /* 1936 * We consider T3 and Cookie timer pretty much the same with 1937 * respect to where from in chunk_output. 1938 */ 1939 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED); 1940 did_output = true; 1941 break; 1942 case SCTP_TIMER_TYPE_NEWCOOKIE: 1943 KASSERT(inp != NULL && stcb == NULL && net == NULL, 1944 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1945 type, inp, stcb, net)); 1946 SCTP_STAT_INCR(sctps_timosecret); 1947 (void)SCTP_GETTIME_TIMEVAL(&tv); 1948 inp->sctp_ep.time_of_secret_change = (unsigned int)tv.tv_sec; 1949 inp->sctp_ep.last_secret_number = 1950 inp->sctp_ep.current_secret_number; 1951 inp->sctp_ep.current_secret_number++; 1952 if (inp->sctp_ep.current_secret_number >= 1953 SCTP_HOW_MANY_SECRETS) { 1954 inp->sctp_ep.current_secret_number = 0; 1955 } 1956 secret = (int)inp->sctp_ep.current_secret_number; 1957 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) { 1958 inp->sctp_ep.secret_key[secret][i] = 1959 sctp_select_initial_TSN(&inp->sctp_ep); 1960 } 1961 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL); 1962 did_output = false; 1963 break; 1964 case SCTP_TIMER_TYPE_PATHMTURAISE: 1965 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1966 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1967 type, inp, stcb, net)); 1968 SCTP_STAT_INCR(sctps_timopathmtu); 1969 sctp_pathmtu_timer(inp, stcb, net); 1970 did_output = false; 1971 break; 1972 case SCTP_TIMER_TYPE_SHUTDOWNACK: 1973 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1974 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1975 type, inp, stcb, net)); 1976 if (sctp_shutdownack_timer(inp, stcb, net)) { 1977 /* no need to unlock on tcb its gone */ 1978 goto out_decr; 1979 } 1980 SCTP_STAT_INCR(sctps_timoshutdownack); 1981 stcb->asoc.timoshutdownack++; 1982 #ifdef SCTP_AUDITING_ENABLED 1983 sctp_auditing(4, inp, stcb, net); 1984 #endif 1985 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED); 1986 did_output = true; 1987 break; 1988 case SCTP_TIMER_TYPE_ASCONF: 1989 KASSERT(inp != NULL && stcb != NULL && net != NULL, 1990 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 1991 type, inp, stcb, net)); 1992 SCTP_STAT_INCR(sctps_timoasconf); 1993 if (sctp_asconf_timer(inp, stcb, net)) { 1994 /* no need to unlock on tcb its gone */ 1995 goto out_decr; 1996 } 1997 #ifdef SCTP_AUDITING_ENABLED 1998 sctp_auditing(4, inp, stcb, net); 1999 #endif 2000 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED); 2001 did_output = true; 2002 break; 2003 case SCTP_TIMER_TYPE_SHUTDOWNGUARD: 2004 KASSERT(inp != NULL && stcb != NULL && net == NULL, 2005 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2006 type, inp, stcb, net)); 2007 SCTP_STAT_INCR(sctps_timoshutdownguard); 2008 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 2009 "Shutdown guard timer expired"); 2010 sctp_abort_an_association(inp, stcb, op_err, true, SCTP_SO_NOT_LOCKED); 2011 /* no need to unlock on tcb its gone */ 2012 goto out_decr; 2013 case SCTP_TIMER_TYPE_AUTOCLOSE: 2014 KASSERT(inp != NULL && stcb != NULL && net == NULL, 2015 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2016 type, inp, stcb, net)); 2017 SCTP_STAT_INCR(sctps_timoautoclose); 2018 sctp_autoclose_timer(inp, stcb); 2019 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED); 2020 did_output = true; 2021 break; 2022 case SCTP_TIMER_TYPE_STRRESET: 2023 KASSERT(inp != NULL && stcb != NULL && net == NULL, 2024 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2025 type, inp, stcb, net)); 2026 SCTP_STAT_INCR(sctps_timostrmrst); 2027 if (sctp_strreset_timer(inp, stcb)) { 2028 /* no need to unlock on tcb its gone */ 2029 goto out_decr; 2030 } 2031 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED); 2032 did_output = true; 2033 break; 2034 case SCTP_TIMER_TYPE_INPKILL: 2035 KASSERT(inp != NULL && stcb == NULL && net == NULL, 2036 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2037 type, inp, stcb, net)); 2038 SCTP_STAT_INCR(sctps_timoinpkill); 2039 /* 2040 * special case, take away our increment since WE are the 2041 * killer 2042 */ 2043 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL, 2044 SCTP_FROM_SCTPUTIL + SCTP_LOC_3); 2045 SCTP_INP_DECR_REF(inp); 2046 SCTP_INP_WUNLOCK(inp); 2047 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT, 2048 SCTP_CALLED_FROM_INPKILL_TIMER); 2049 inp = NULL; 2050 goto out_decr; 2051 case SCTP_TIMER_TYPE_ASOCKILL: 2052 KASSERT(inp != NULL && stcb != NULL && net == NULL, 2053 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2054 type, inp, stcb, net)); 2055 SCTP_STAT_INCR(sctps_timoassockill); 2056 /* Can we free it yet? */ 2057 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, 2058 SCTP_FROM_SCTPUTIL + SCTP_LOC_1); 2059 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 2060 SCTP_FROM_SCTPUTIL + SCTP_LOC_2); 2061 /* 2062 * free asoc, always unlocks (or destroy's) so prevent 2063 * duplicate unlock or unlock of a free mtx :-0 2064 */ 2065 stcb = NULL; 2066 goto out_decr; 2067 case SCTP_TIMER_TYPE_ADDR_WQ: 2068 KASSERT(inp == NULL && stcb == NULL && net == NULL, 2069 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2070 type, inp, stcb, net)); 2071 sctp_handle_addr_wq(); 2072 did_output = true; 2073 break; 2074 case SCTP_TIMER_TYPE_PRIM_DELETED: 2075 KASSERT(inp != NULL && stcb != NULL && net == NULL, 2076 ("timeout of type %d: inp = %p, stcb = %p, net = %p", 2077 type, inp, stcb, net)); 2078 SCTP_STAT_INCR(sctps_timodelprim); 2079 sctp_delete_prim_timer(inp, stcb); 2080 did_output = false; 2081 break; 2082 default: 2083 #ifdef INVARIANTS 2084 panic("Unknown timer type %d", type); 2085 #else 2086 goto out; 2087 #endif 2088 } 2089 #ifdef SCTP_AUDITING_ENABLED 2090 sctp_audit_log(0xF1, (uint8_t)type); 2091 if (inp != NULL) 2092 sctp_auditing(5, inp, stcb, net); 2093 #endif 2094 if (did_output && (stcb != NULL)) { 2095 /* 2096 * Now we need to clean up the control chunk chain if an 2097 * ECNE is on it. It must be marked as UNSENT again so next 2098 * call will continue to send it until such time that we get 2099 * a CWR, to remove it. It is, however, less likely that we 2100 * will find a ecn echo on the chain though. 2101 */ 2102 sctp_fix_ecn_echo(&stcb->asoc); 2103 } 2104 out: 2105 if (stcb != NULL) { 2106 SCTP_TCB_UNLOCK(stcb); 2107 } else if (inp != NULL) { 2108 SCTP_INP_WUNLOCK(inp); 2109 } else { 2110 SCTP_WQ_ADDR_UNLOCK(); 2111 } 2112 2113 out_decr: 2114 /* These reference counts were incremented in sctp_timer_start(). */ 2115 if (inp != NULL) { 2116 SCTP_INP_DECR_REF(inp); 2117 } 2118 if ((stcb != NULL) && !released_asoc_reference) { 2119 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2120 } 2121 if (net != NULL) { 2122 sctp_free_remote_addr(net); 2123 } 2124 SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d handler finished.\n", type); 2125 CURVNET_RESTORE(); 2126 NET_EPOCH_EXIT(et); 2127 } 2128 2129 /*- 2130 * The following table shows which parameters must be provided 2131 * when calling sctp_timer_start(). For parameters not being 2132 * provided, NULL must be used. 2133 * 2134 * |Name |inp |stcb|net | 2135 * |-----------------------------|----|----|----| 2136 * |SCTP_TIMER_TYPE_SEND |Yes |Yes |Yes | 2137 * |SCTP_TIMER_TYPE_INIT |Yes |Yes |Yes | 2138 * |SCTP_TIMER_TYPE_RECV |Yes |Yes |No | 2139 * |SCTP_TIMER_TYPE_SHUTDOWN |Yes |Yes |Yes | 2140 * |SCTP_TIMER_TYPE_HEARTBEAT |Yes |Yes |Yes | 2141 * |SCTP_TIMER_TYPE_COOKIE |Yes |Yes |Yes | 2142 * |SCTP_TIMER_TYPE_NEWCOOKIE |Yes |No |No | 2143 * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes | 2144 * |SCTP_TIMER_TYPE_SHUTDOWNACK |Yes |Yes |Yes | 2145 * |SCTP_TIMER_TYPE_ASCONF |Yes |Yes |Yes | 2146 * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No | 2147 * |SCTP_TIMER_TYPE_AUTOCLOSE |Yes |Yes |No | 2148 * |SCTP_TIMER_TYPE_STRRESET |Yes |Yes |Yes | 2149 * |SCTP_TIMER_TYPE_INPKILL |Yes |No |No | 2150 * |SCTP_TIMER_TYPE_ASOCKILL |Yes |Yes |No | 2151 * |SCTP_TIMER_TYPE_ADDR_WQ |No |No |No | 2152 * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No | 2153 * 2154 */ 2155 2156 void 2157 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2158 struct sctp_nets *net) 2159 { 2160 struct sctp_timer *tmr; 2161 uint32_t to_ticks; 2162 uint32_t rndval, jitter; 2163 2164 KASSERT(stcb == NULL || stcb->sctp_ep == inp, 2165 ("sctp_timer_start of type %d: inp = %p, stcb->sctp_ep %p", 2166 t_type, stcb, stcb->sctp_ep)); 2167 tmr = NULL; 2168 if (stcb != NULL) { 2169 SCTP_TCB_LOCK_ASSERT(stcb); 2170 } else if (inp != NULL) { 2171 SCTP_INP_WLOCK_ASSERT(inp); 2172 } else { 2173 SCTP_WQ_ADDR_LOCK_ASSERT(); 2174 } 2175 if (stcb != NULL) { 2176 /* 2177 * Don't restart timer on association that's about to be 2178 * killed. 2179 */ 2180 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) && 2181 (t_type != SCTP_TIMER_TYPE_ASOCKILL)) { 2182 SCTPDBG(SCTP_DEBUG_TIMER2, 2183 "Timer type %d not started: inp=%p, stcb=%p, net=%p (stcb deleted).\n", 2184 t_type, inp, stcb, net); 2185 return; 2186 } 2187 /* Don't restart timer on net that's been removed. */ 2188 if (net != NULL && (net->dest_state & SCTP_ADDR_BEING_DELETED)) { 2189 SCTPDBG(SCTP_DEBUG_TIMER2, 2190 "Timer type %d not started: inp=%p, stcb=%p, net=%p (net deleted).\n", 2191 t_type, inp, stcb, net); 2192 return; 2193 } 2194 } 2195 switch (t_type) { 2196 case SCTP_TIMER_TYPE_SEND: 2197 /* Here we use the RTO timer. */ 2198 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2199 #ifdef INVARIANTS 2200 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2201 t_type, inp, stcb, net); 2202 #else 2203 return; 2204 #endif 2205 } 2206 tmr = &net->rxt_timer; 2207 if (net->RTO == 0) { 2208 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2209 } else { 2210 to_ticks = sctp_msecs_to_ticks(net->RTO); 2211 } 2212 break; 2213 case SCTP_TIMER_TYPE_INIT: 2214 /* 2215 * Here we use the INIT timer default usually about 1 2216 * second. 2217 */ 2218 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2219 #ifdef INVARIANTS 2220 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2221 t_type, inp, stcb, net); 2222 #else 2223 return; 2224 #endif 2225 } 2226 tmr = &net->rxt_timer; 2227 if (net->RTO == 0) { 2228 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2229 } else { 2230 to_ticks = sctp_msecs_to_ticks(net->RTO); 2231 } 2232 break; 2233 case SCTP_TIMER_TYPE_RECV: 2234 /* 2235 * Here we use the Delayed-Ack timer value from the inp, 2236 * ususually about 200ms. 2237 */ 2238 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2239 #ifdef INVARIANTS 2240 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2241 t_type, inp, stcb, net); 2242 #else 2243 return; 2244 #endif 2245 } 2246 tmr = &stcb->asoc.dack_timer; 2247 to_ticks = sctp_msecs_to_ticks(stcb->asoc.delayed_ack); 2248 break; 2249 case SCTP_TIMER_TYPE_SHUTDOWN: 2250 /* Here we use the RTO of the destination. */ 2251 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2252 #ifdef INVARIANTS 2253 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2254 t_type, inp, stcb, net); 2255 #else 2256 return; 2257 #endif 2258 } 2259 tmr = &net->rxt_timer; 2260 if (net->RTO == 0) { 2261 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2262 } else { 2263 to_ticks = sctp_msecs_to_ticks(net->RTO); 2264 } 2265 break; 2266 case SCTP_TIMER_TYPE_HEARTBEAT: 2267 /* 2268 * The net is used here so that we can add in the RTO. Even 2269 * though we use a different timer. We also add the HB timer 2270 * PLUS a random jitter. 2271 */ 2272 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2273 #ifdef INVARIANTS 2274 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2275 t_type, inp, stcb, net); 2276 #else 2277 return; 2278 #endif 2279 } 2280 if ((net->dest_state & SCTP_ADDR_NOHB) && 2281 !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) { 2282 SCTPDBG(SCTP_DEBUG_TIMER2, 2283 "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n", 2284 t_type, inp, stcb, net); 2285 return; 2286 } 2287 tmr = &net->hb_timer; 2288 if (net->RTO == 0) { 2289 to_ticks = stcb->asoc.initial_rto; 2290 } else { 2291 to_ticks = net->RTO; 2292 } 2293 rndval = sctp_select_initial_TSN(&inp->sctp_ep); 2294 jitter = rndval % to_ticks; 2295 if (to_ticks > 1) { 2296 to_ticks >>= 1; 2297 } 2298 if (jitter < (UINT32_MAX - to_ticks)) { 2299 to_ticks += jitter; 2300 } else { 2301 to_ticks = UINT32_MAX; 2302 } 2303 if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) && 2304 !(net->dest_state & SCTP_ADDR_PF)) { 2305 if (net->heart_beat_delay < (UINT32_MAX - to_ticks)) { 2306 to_ticks += net->heart_beat_delay; 2307 } else { 2308 to_ticks = UINT32_MAX; 2309 } 2310 } 2311 /* 2312 * Now we must convert the to_ticks that are now in ms to 2313 * ticks. 2314 */ 2315 to_ticks = sctp_msecs_to_ticks(to_ticks); 2316 break; 2317 case SCTP_TIMER_TYPE_COOKIE: 2318 /* 2319 * Here we can use the RTO timer from the network since one 2320 * RTT was complete. If a retransmission happened then we 2321 * will be using the RTO initial value. 2322 */ 2323 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2324 #ifdef INVARIANTS 2325 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2326 t_type, inp, stcb, net); 2327 #else 2328 return; 2329 #endif 2330 } 2331 tmr = &net->rxt_timer; 2332 if (net->RTO == 0) { 2333 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2334 } else { 2335 to_ticks = sctp_msecs_to_ticks(net->RTO); 2336 } 2337 break; 2338 case SCTP_TIMER_TYPE_NEWCOOKIE: 2339 /* 2340 * Nothing needed but the endpoint here ususually about 60 2341 * minutes. 2342 */ 2343 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) { 2344 #ifdef INVARIANTS 2345 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2346 t_type, inp, stcb, net); 2347 #else 2348 return; 2349 #endif 2350 } 2351 tmr = &inp->sctp_ep.signature_change; 2352 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE]; 2353 break; 2354 case SCTP_TIMER_TYPE_PATHMTURAISE: 2355 /* 2356 * Here we use the value found in the EP for PMTUD, 2357 * ususually about 10 minutes. 2358 */ 2359 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2360 #ifdef INVARIANTS 2361 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2362 t_type, inp, stcb, net); 2363 #else 2364 return; 2365 #endif 2366 } 2367 if (net->dest_state & SCTP_ADDR_NO_PMTUD) { 2368 SCTPDBG(SCTP_DEBUG_TIMER2, 2369 "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n", 2370 t_type, inp, stcb, net); 2371 return; 2372 } 2373 tmr = &net->pmtu_timer; 2374 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU]; 2375 break; 2376 case SCTP_TIMER_TYPE_SHUTDOWNACK: 2377 /* Here we use the RTO of the destination. */ 2378 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2379 #ifdef INVARIANTS 2380 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2381 t_type, inp, stcb, net); 2382 #else 2383 return; 2384 #endif 2385 } 2386 tmr = &net->rxt_timer; 2387 if (net->RTO == 0) { 2388 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2389 } else { 2390 to_ticks = sctp_msecs_to_ticks(net->RTO); 2391 } 2392 break; 2393 case SCTP_TIMER_TYPE_ASCONF: 2394 /* 2395 * Here the timer comes from the stcb but its value is from 2396 * the net's RTO. 2397 */ 2398 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2399 #ifdef INVARIANTS 2400 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2401 t_type, inp, stcb, net); 2402 #else 2403 return; 2404 #endif 2405 } 2406 tmr = &stcb->asoc.asconf_timer; 2407 if (net->RTO == 0) { 2408 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2409 } else { 2410 to_ticks = sctp_msecs_to_ticks(net->RTO); 2411 } 2412 break; 2413 case SCTP_TIMER_TYPE_SHUTDOWNGUARD: 2414 /* 2415 * Here we use the endpoints shutdown guard timer usually 2416 * about 3 minutes. 2417 */ 2418 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2419 #ifdef INVARIANTS 2420 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2421 t_type, inp, stcb, net); 2422 #else 2423 return; 2424 #endif 2425 } 2426 tmr = &stcb->asoc.shut_guard_timer; 2427 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) { 2428 if (stcb->asoc.maxrto < UINT32_MAX / 5) { 2429 to_ticks = sctp_msecs_to_ticks(5 * stcb->asoc.maxrto); 2430 } else { 2431 to_ticks = sctp_msecs_to_ticks(UINT32_MAX); 2432 } 2433 } else { 2434 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN]; 2435 } 2436 break; 2437 case SCTP_TIMER_TYPE_AUTOCLOSE: 2438 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2439 #ifdef INVARIANTS 2440 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2441 t_type, inp, stcb, net); 2442 #else 2443 return; 2444 #endif 2445 } 2446 tmr = &stcb->asoc.autoclose_timer; 2447 to_ticks = stcb->asoc.sctp_autoclose_ticks; 2448 break; 2449 case SCTP_TIMER_TYPE_STRRESET: 2450 /* 2451 * Here the timer comes from the stcb but its value is from 2452 * the net's RTO. 2453 */ 2454 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2455 #ifdef INVARIANTS 2456 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2457 t_type, inp, stcb, net); 2458 #else 2459 return; 2460 #endif 2461 } 2462 tmr = &stcb->asoc.strreset_timer; 2463 if (net->RTO == 0) { 2464 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2465 } else { 2466 to_ticks = sctp_msecs_to_ticks(net->RTO); 2467 } 2468 break; 2469 case SCTP_TIMER_TYPE_INPKILL: 2470 /* 2471 * The inp is setup to die. We re-use the signature_chage 2472 * timer since that has stopped and we are in the GONE 2473 * state. 2474 */ 2475 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) { 2476 #ifdef INVARIANTS 2477 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2478 t_type, inp, stcb, net); 2479 #else 2480 return; 2481 #endif 2482 } 2483 tmr = &inp->sctp_ep.signature_change; 2484 to_ticks = sctp_msecs_to_ticks(SCTP_INP_KILL_TIMEOUT); 2485 break; 2486 case SCTP_TIMER_TYPE_ASOCKILL: 2487 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2488 #ifdef INVARIANTS 2489 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2490 t_type, inp, stcb, net); 2491 #else 2492 return; 2493 #endif 2494 } 2495 tmr = &stcb->asoc.strreset_timer; 2496 to_ticks = sctp_msecs_to_ticks(SCTP_ASOC_KILL_TIMEOUT); 2497 break; 2498 case SCTP_TIMER_TYPE_ADDR_WQ: 2499 if ((inp != NULL) || (stcb != NULL) || (net != NULL)) { 2500 #ifdef INVARIANTS 2501 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2502 t_type, inp, stcb, net); 2503 #else 2504 return; 2505 #endif 2506 } 2507 /* Only 1 tick away :-) */ 2508 tmr = &SCTP_BASE_INFO(addr_wq_timer); 2509 to_ticks = SCTP_ADDRESS_TICK_DELAY; 2510 break; 2511 case SCTP_TIMER_TYPE_PRIM_DELETED: 2512 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2513 #ifdef INVARIANTS 2514 panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p", 2515 t_type, inp, stcb, net); 2516 #else 2517 return; 2518 #endif 2519 } 2520 tmr = &stcb->asoc.delete_prim_timer; 2521 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto); 2522 break; 2523 default: 2524 #ifdef INVARIANTS 2525 panic("Unknown timer type %d", t_type); 2526 #else 2527 return; 2528 #endif 2529 } 2530 KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type)); 2531 KASSERT(to_ticks > 0, ("to_ticks == 0 for timer type %d", t_type)); 2532 if (SCTP_OS_TIMER_PENDING(&tmr->timer)) { 2533 /* 2534 * We do NOT allow you to have it already running. If it is, 2535 * we leave the current one up unchanged. 2536 */ 2537 SCTPDBG(SCTP_DEBUG_TIMER2, 2538 "Timer type %d already running: inp=%p, stcb=%p, net=%p.\n", 2539 t_type, inp, stcb, net); 2540 return; 2541 } 2542 /* At this point we can proceed. */ 2543 if (t_type == SCTP_TIMER_TYPE_SEND) { 2544 stcb->asoc.num_send_timers_up++; 2545 } 2546 tmr->stopped_from = 0; 2547 tmr->type = t_type; 2548 tmr->ep = (void *)inp; 2549 tmr->tcb = (void *)stcb; 2550 if (t_type == SCTP_TIMER_TYPE_STRRESET) { 2551 tmr->net = NULL; 2552 } else { 2553 tmr->net = (void *)net; 2554 } 2555 tmr->self = (void *)tmr; 2556 tmr->vnet = (void *)curvnet; 2557 tmr->ticks = sctp_get_tick_count(); 2558 if (SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr) == 0) { 2559 SCTPDBG(SCTP_DEBUG_TIMER2, 2560 "Timer type %d started: ticks=%u, inp=%p, stcb=%p, net=%p.\n", 2561 t_type, to_ticks, inp, stcb, net); 2562 /* 2563 * If this is a newly scheduled callout, as opposed to a 2564 * rescheduled one, increment relevant reference counts. 2565 */ 2566 if (tmr->ep != NULL) { 2567 SCTP_INP_INCR_REF(inp); 2568 } 2569 if (tmr->tcb != NULL) { 2570 atomic_add_int(&stcb->asoc.refcnt, 1); 2571 } 2572 if (tmr->net != NULL) { 2573 atomic_add_int(&net->ref_count, 1); 2574 } 2575 } else { 2576 /* 2577 * This should not happen, since we checked for pending 2578 * above. 2579 */ 2580 SCTPDBG(SCTP_DEBUG_TIMER2, 2581 "Timer type %d restarted: ticks=%u, inp=%p, stcb=%p, net=%p.\n", 2582 t_type, to_ticks, inp, stcb, net); 2583 } 2584 return; 2585 } 2586 2587 /*- 2588 * The following table shows which parameters must be provided 2589 * when calling sctp_timer_stop(). For parameters not being 2590 * provided, NULL must be used. 2591 * 2592 * |Name |inp |stcb|net | 2593 * |-----------------------------|----|----|----| 2594 * |SCTP_TIMER_TYPE_SEND |Yes |Yes |Yes | 2595 * |SCTP_TIMER_TYPE_INIT |Yes |Yes |Yes | 2596 * |SCTP_TIMER_TYPE_RECV |Yes |Yes |No | 2597 * |SCTP_TIMER_TYPE_SHUTDOWN |Yes |Yes |Yes | 2598 * |SCTP_TIMER_TYPE_HEARTBEAT |Yes |Yes |Yes | 2599 * |SCTP_TIMER_TYPE_COOKIE |Yes |Yes |Yes | 2600 * |SCTP_TIMER_TYPE_NEWCOOKIE |Yes |No |No | 2601 * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes | 2602 * |SCTP_TIMER_TYPE_SHUTDOWNACK |Yes |Yes |Yes | 2603 * |SCTP_TIMER_TYPE_ASCONF |Yes |Yes |No | 2604 * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No | 2605 * |SCTP_TIMER_TYPE_AUTOCLOSE |Yes |Yes |No | 2606 * |SCTP_TIMER_TYPE_STRRESET |Yes |Yes |No | 2607 * |SCTP_TIMER_TYPE_INPKILL |Yes |No |No | 2608 * |SCTP_TIMER_TYPE_ASOCKILL |Yes |Yes |No | 2609 * |SCTP_TIMER_TYPE_ADDR_WQ |No |No |No | 2610 * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No | 2611 * 2612 */ 2613 2614 void 2615 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2616 struct sctp_nets *net, uint32_t from) 2617 { 2618 struct sctp_timer *tmr; 2619 2620 KASSERT(stcb == NULL || stcb->sctp_ep == inp, 2621 ("sctp_timer_stop of type %d: inp = %p, stcb->sctp_ep %p", 2622 t_type, stcb, stcb->sctp_ep)); 2623 if (stcb != NULL) { 2624 SCTP_TCB_LOCK_ASSERT(stcb); 2625 } else if (inp != NULL) { 2626 SCTP_INP_WLOCK_ASSERT(inp); 2627 } else { 2628 SCTP_WQ_ADDR_LOCK_ASSERT(); 2629 } 2630 tmr = NULL; 2631 switch (t_type) { 2632 case SCTP_TIMER_TYPE_SEND: 2633 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2634 #ifdef INVARIANTS 2635 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2636 t_type, inp, stcb, net); 2637 #else 2638 return; 2639 #endif 2640 } 2641 tmr = &net->rxt_timer; 2642 break; 2643 case SCTP_TIMER_TYPE_INIT: 2644 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2645 #ifdef INVARIANTS 2646 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2647 t_type, inp, stcb, net); 2648 #else 2649 return; 2650 #endif 2651 } 2652 tmr = &net->rxt_timer; 2653 break; 2654 case SCTP_TIMER_TYPE_RECV: 2655 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2656 #ifdef INVARIANTS 2657 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2658 t_type, inp, stcb, net); 2659 #else 2660 return; 2661 #endif 2662 } 2663 tmr = &stcb->asoc.dack_timer; 2664 break; 2665 case SCTP_TIMER_TYPE_SHUTDOWN: 2666 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2667 #ifdef INVARIANTS 2668 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2669 t_type, inp, stcb, net); 2670 #else 2671 return; 2672 #endif 2673 } 2674 tmr = &net->rxt_timer; 2675 break; 2676 case SCTP_TIMER_TYPE_HEARTBEAT: 2677 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2678 #ifdef INVARIANTS 2679 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2680 t_type, inp, stcb, net); 2681 #else 2682 return; 2683 #endif 2684 } 2685 tmr = &net->hb_timer; 2686 break; 2687 case SCTP_TIMER_TYPE_COOKIE: 2688 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2689 #ifdef INVARIANTS 2690 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2691 t_type, inp, stcb, net); 2692 #else 2693 return; 2694 #endif 2695 } 2696 tmr = &net->rxt_timer; 2697 break; 2698 case SCTP_TIMER_TYPE_NEWCOOKIE: 2699 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) { 2700 #ifdef INVARIANTS 2701 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2702 t_type, inp, stcb, net); 2703 #else 2704 return; 2705 #endif 2706 } 2707 tmr = &inp->sctp_ep.signature_change; 2708 break; 2709 case SCTP_TIMER_TYPE_PATHMTURAISE: 2710 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2711 #ifdef INVARIANTS 2712 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2713 t_type, inp, stcb, net); 2714 #else 2715 return; 2716 #endif 2717 } 2718 tmr = &net->pmtu_timer; 2719 break; 2720 case SCTP_TIMER_TYPE_SHUTDOWNACK: 2721 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) { 2722 #ifdef INVARIANTS 2723 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2724 t_type, inp, stcb, net); 2725 #else 2726 return; 2727 #endif 2728 } 2729 tmr = &net->rxt_timer; 2730 break; 2731 case SCTP_TIMER_TYPE_ASCONF: 2732 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2733 #ifdef INVARIANTS 2734 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2735 t_type, inp, stcb, net); 2736 #else 2737 return; 2738 #endif 2739 } 2740 tmr = &stcb->asoc.asconf_timer; 2741 break; 2742 case SCTP_TIMER_TYPE_SHUTDOWNGUARD: 2743 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2744 #ifdef INVARIANTS 2745 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2746 t_type, inp, stcb, net); 2747 #else 2748 return; 2749 #endif 2750 } 2751 tmr = &stcb->asoc.shut_guard_timer; 2752 break; 2753 case SCTP_TIMER_TYPE_AUTOCLOSE: 2754 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2755 #ifdef INVARIANTS 2756 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2757 t_type, inp, stcb, net); 2758 #else 2759 return; 2760 #endif 2761 } 2762 tmr = &stcb->asoc.autoclose_timer; 2763 break; 2764 case SCTP_TIMER_TYPE_STRRESET: 2765 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2766 #ifdef INVARIANTS 2767 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2768 t_type, inp, stcb, net); 2769 #else 2770 return; 2771 #endif 2772 } 2773 tmr = &stcb->asoc.strreset_timer; 2774 break; 2775 case SCTP_TIMER_TYPE_INPKILL: 2776 /* 2777 * The inp is setup to die. We re-use the signature_chage 2778 * timer since that has stopped and we are in the GONE 2779 * state. 2780 */ 2781 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) { 2782 #ifdef INVARIANTS 2783 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2784 t_type, inp, stcb, net); 2785 #else 2786 return; 2787 #endif 2788 } 2789 tmr = &inp->sctp_ep.signature_change; 2790 break; 2791 case SCTP_TIMER_TYPE_ASOCKILL: 2792 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2793 #ifdef INVARIANTS 2794 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2795 t_type, inp, stcb, net); 2796 #else 2797 return; 2798 #endif 2799 } 2800 tmr = &stcb->asoc.strreset_timer; 2801 break; 2802 case SCTP_TIMER_TYPE_ADDR_WQ: 2803 if ((inp != NULL) || (stcb != NULL) || (net != NULL)) { 2804 #ifdef INVARIANTS 2805 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2806 t_type, inp, stcb, net); 2807 #else 2808 return; 2809 #endif 2810 } 2811 tmr = &SCTP_BASE_INFO(addr_wq_timer); 2812 break; 2813 case SCTP_TIMER_TYPE_PRIM_DELETED: 2814 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) { 2815 #ifdef INVARIANTS 2816 panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p", 2817 t_type, inp, stcb, net); 2818 #else 2819 return; 2820 #endif 2821 } 2822 tmr = &stcb->asoc.delete_prim_timer; 2823 break; 2824 default: 2825 #ifdef INVARIANTS 2826 panic("Unknown timer type %d", t_type); 2827 #else 2828 return; 2829 #endif 2830 } 2831 KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type)); 2832 if ((tmr->type != SCTP_TIMER_TYPE_NONE) && 2833 (tmr->type != t_type)) { 2834 /* 2835 * Ok we have a timer that is under joint use. Cookie timer 2836 * per chance with the SEND timer. We therefore are NOT 2837 * running the timer that the caller wants stopped. So just 2838 * return. 2839 */ 2840 SCTPDBG(SCTP_DEBUG_TIMER2, 2841 "Shared timer type %d not running: inp=%p, stcb=%p, net=%p.\n", 2842 t_type, inp, stcb, net); 2843 return; 2844 } 2845 if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) { 2846 stcb->asoc.num_send_timers_up--; 2847 if (stcb->asoc.num_send_timers_up < 0) { 2848 stcb->asoc.num_send_timers_up = 0; 2849 } 2850 } 2851 tmr->self = NULL; 2852 tmr->stopped_from = from; 2853 if (SCTP_OS_TIMER_STOP(&tmr->timer) == 1) { 2854 KASSERT(tmr->ep == inp, 2855 ("sctp_timer_stop of type %d: inp = %p, tmr->inp = %p", 2856 t_type, inp, tmr->ep)); 2857 KASSERT(tmr->tcb == stcb, 2858 ("sctp_timer_stop of type %d: stcb = %p, tmr->stcb = %p", 2859 t_type, stcb, tmr->tcb)); 2860 KASSERT(((t_type == SCTP_TIMER_TYPE_ASCONF) && (tmr->net != NULL)) || 2861 ((t_type != SCTP_TIMER_TYPE_ASCONF) && (tmr->net == net)), 2862 ("sctp_timer_stop of type %d: net = %p, tmr->net = %p", 2863 t_type, net, tmr->net)); 2864 SCTPDBG(SCTP_DEBUG_TIMER2, 2865 "Timer type %d stopped: inp=%p, stcb=%p, net=%p.\n", 2866 t_type, inp, stcb, net); 2867 /* 2868 * If the timer was actually stopped, decrement reference 2869 * counts that were incremented in sctp_timer_start(). 2870 */ 2871 if (tmr->ep != NULL) { 2872 SCTP_INP_DECR_REF(inp); 2873 tmr->ep = NULL; 2874 } 2875 if (tmr->tcb != NULL) { 2876 atomic_subtract_int(&stcb->asoc.refcnt, 1); 2877 tmr->tcb = NULL; 2878 } 2879 if (tmr->net != NULL) { 2880 /* 2881 * Can't use net, since it doesn't work for 2882 * SCTP_TIMER_TYPE_ASCONF. 2883 */ 2884 sctp_free_remote_addr((struct sctp_nets *)tmr->net); 2885 tmr->net = NULL; 2886 } 2887 } else { 2888 SCTPDBG(SCTP_DEBUG_TIMER2, 2889 "Timer type %d not stopped: inp=%p, stcb=%p, net=%p.\n", 2890 t_type, inp, stcb, net); 2891 } 2892 return; 2893 } 2894 2895 uint32_t 2896 sctp_calculate_len(struct mbuf *m) 2897 { 2898 struct mbuf *at; 2899 uint32_t tlen; 2900 2901 tlen = 0; 2902 for (at = m; at != NULL; at = SCTP_BUF_NEXT(at)) { 2903 tlen += SCTP_BUF_LEN(at); 2904 } 2905 return (tlen); 2906 } 2907 2908 void 2909 sctp_mtu_size_reset(struct sctp_inpcb *inp, 2910 struct sctp_association *asoc, uint32_t mtu) 2911 { 2912 /* 2913 * Reset the P-MTU size on this association, this involves changing 2914 * the asoc MTU, going through ANY chunk+overhead larger than mtu to 2915 * allow the DF flag to be cleared. 2916 */ 2917 struct sctp_tmit_chunk *chk; 2918 unsigned int eff_mtu, ovh; 2919 2920 asoc->smallest_mtu = mtu; 2921 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 2922 ovh = SCTP_MIN_OVERHEAD; 2923 } else { 2924 ovh = SCTP_MIN_V4_OVERHEAD; 2925 } 2926 eff_mtu = mtu - ovh; 2927 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 2928 if (chk->send_size > eff_mtu) { 2929 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 2930 } 2931 } 2932 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 2933 if (chk->send_size > eff_mtu) { 2934 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 2935 } 2936 } 2937 } 2938 2939 /* 2940 * Given an association and starting time of the current RTT period, update 2941 * RTO in number of msecs. net should point to the current network. 2942 * Return 1, if an RTO update was performed, return 0 if no update was 2943 * performed due to invalid starting point. 2944 */ 2945 2946 int 2947 sctp_calculate_rto(struct sctp_tcb *stcb, 2948 struct sctp_association *asoc, 2949 struct sctp_nets *net, 2950 struct timeval *old, 2951 int rtt_from_sack) 2952 { 2953 struct timeval now; 2954 uint64_t rtt_us; /* RTT in us */ 2955 int32_t rtt; /* RTT in ms */ 2956 uint32_t new_rto; 2957 int first_measure = 0; 2958 2959 /************************/ 2960 /* 1. calculate new RTT */ 2961 /************************/ 2962 /* get the current time */ 2963 if (stcb->asoc.use_precise_time) { 2964 (void)SCTP_GETPTIME_TIMEVAL(&now); 2965 } else { 2966 (void)SCTP_GETTIME_TIMEVAL(&now); 2967 } 2968 if ((old->tv_sec > now.tv_sec) || 2969 ((old->tv_sec == now.tv_sec) && (old->tv_usec > now.tv_usec))) { 2970 /* The starting point is in the future. */ 2971 return (0); 2972 } 2973 timevalsub(&now, old); 2974 rtt_us = (uint64_t)1000000 * (uint64_t)now.tv_sec + (uint64_t)now.tv_usec; 2975 if (rtt_us > SCTP_RTO_UPPER_BOUND * 1000) { 2976 /* The RTT is larger than a sane value. */ 2977 return (0); 2978 } 2979 /* store the current RTT in us */ 2980 net->rtt = rtt_us; 2981 /* compute rtt in ms */ 2982 rtt = (int32_t)(net->rtt / 1000); 2983 if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) { 2984 /* 2985 * Tell the CC module that a new update has just occurred 2986 * from a sack 2987 */ 2988 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now); 2989 } 2990 /* 2991 * Do we need to determine the lan? We do this only on sacks i.e. 2992 * RTT being determined from data not non-data (HB/INIT->INITACK). 2993 */ 2994 if ((rtt_from_sack == SCTP_RTT_FROM_DATA) && 2995 (net->lan_type == SCTP_LAN_UNKNOWN)) { 2996 if (net->rtt > SCTP_LOCAL_LAN_RTT) { 2997 net->lan_type = SCTP_LAN_INTERNET; 2998 } else { 2999 net->lan_type = SCTP_LAN_LOCAL; 3000 } 3001 } 3002 3003 /***************************/ 3004 /* 2. update RTTVAR & SRTT */ 3005 /***************************/ 3006 /*- 3007 * Compute the scaled average lastsa and the 3008 * scaled variance lastsv as described in van Jacobson 3009 * Paper "Congestion Avoidance and Control", Annex A. 3010 * 3011 * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt 3012 * (net->lastsv >> SCTP_RTT_VAR_SHIFT) is the rttvar 3013 */ 3014 if (net->RTO_measured) { 3015 rtt -= (net->lastsa >> SCTP_RTT_SHIFT); 3016 net->lastsa += rtt; 3017 if (rtt < 0) { 3018 rtt = -rtt; 3019 } 3020 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT); 3021 net->lastsv += rtt; 3022 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) { 3023 rto_logging(net, SCTP_LOG_RTTVAR); 3024 } 3025 } else { 3026 /* First RTO measurment */ 3027 net->RTO_measured = 1; 3028 first_measure = 1; 3029 net->lastsa = rtt << SCTP_RTT_SHIFT; 3030 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT; 3031 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) { 3032 rto_logging(net, SCTP_LOG_INITIAL_RTT); 3033 } 3034 } 3035 if (net->lastsv == 0) { 3036 net->lastsv = SCTP_CLOCK_GRANULARITY; 3037 } 3038 new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv; 3039 if ((new_rto > SCTP_SAT_NETWORK_MIN) && 3040 (stcb->asoc.sat_network_lockout == 0)) { 3041 stcb->asoc.sat_network = 1; 3042 } else if ((!first_measure) && stcb->asoc.sat_network) { 3043 stcb->asoc.sat_network = 0; 3044 stcb->asoc.sat_network_lockout = 1; 3045 } 3046 /* bound it, per C6/C7 in Section 5.3.1 */ 3047 if (new_rto < stcb->asoc.minrto) { 3048 new_rto = stcb->asoc.minrto; 3049 } 3050 if (new_rto > stcb->asoc.maxrto) { 3051 new_rto = stcb->asoc.maxrto; 3052 } 3053 net->RTO = new_rto; 3054 return (1); 3055 } 3056 3057 /* 3058 * return a pointer to a contiguous piece of data from the given mbuf chain 3059 * starting at 'off' for 'len' bytes. If the desired piece spans more than 3060 * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size 3061 * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain. 3062 */ 3063 caddr_t 3064 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr) 3065 { 3066 uint32_t count; 3067 uint8_t *ptr; 3068 3069 ptr = in_ptr; 3070 if ((off < 0) || (len <= 0)) 3071 return (NULL); 3072 3073 /* find the desired start location */ 3074 while ((m != NULL) && (off > 0)) { 3075 if (off < SCTP_BUF_LEN(m)) 3076 break; 3077 off -= SCTP_BUF_LEN(m); 3078 m = SCTP_BUF_NEXT(m); 3079 } 3080 if (m == NULL) 3081 return (NULL); 3082 3083 /* is the current mbuf large enough (eg. contiguous)? */ 3084 if ((SCTP_BUF_LEN(m) - off) >= len) { 3085 return (mtod(m, caddr_t)+off); 3086 } else { 3087 /* else, it spans more than one mbuf, so save a temp copy... */ 3088 while ((m != NULL) && (len > 0)) { 3089 count = min(SCTP_BUF_LEN(m) - off, len); 3090 memcpy(ptr, mtod(m, caddr_t)+off, count); 3091 len -= count; 3092 ptr += count; 3093 off = 0; 3094 m = SCTP_BUF_NEXT(m); 3095 } 3096 if ((m == NULL) && (len > 0)) 3097 return (NULL); 3098 else 3099 return ((caddr_t)in_ptr); 3100 } 3101 } 3102 3103 struct sctp_paramhdr * 3104 sctp_get_next_param(struct mbuf *m, 3105 int offset, 3106 struct sctp_paramhdr *pull, 3107 int pull_limit) 3108 { 3109 /* This just provides a typed signature to Peter's Pull routine */ 3110 return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit, 3111 (uint8_t *)pull)); 3112 } 3113 3114 struct mbuf * 3115 sctp_add_pad_tombuf(struct mbuf *m, int padlen) 3116 { 3117 struct mbuf *m_last; 3118 caddr_t dp; 3119 3120 if (padlen > 3) { 3121 return (NULL); 3122 } 3123 if (padlen <= M_TRAILINGSPACE(m)) { 3124 /* 3125 * The easy way. We hope the majority of the time we hit 3126 * here :) 3127 */ 3128 m_last = m; 3129 } else { 3130 /* Hard way we must grow the mbuf chain */ 3131 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA); 3132 if (m_last == NULL) { 3133 return (NULL); 3134 } 3135 SCTP_BUF_LEN(m_last) = 0; 3136 SCTP_BUF_NEXT(m_last) = NULL; 3137 SCTP_BUF_NEXT(m) = m_last; 3138 } 3139 dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last); 3140 SCTP_BUF_LEN(m_last) += padlen; 3141 memset(dp, 0, padlen); 3142 return (m_last); 3143 } 3144 3145 struct mbuf * 3146 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf) 3147 { 3148 /* find the last mbuf in chain and pad it */ 3149 struct mbuf *m_at; 3150 3151 if (last_mbuf != NULL) { 3152 return (sctp_add_pad_tombuf(last_mbuf, padval)); 3153 } else { 3154 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3155 if (SCTP_BUF_NEXT(m_at) == NULL) { 3156 return (sctp_add_pad_tombuf(m_at, padval)); 3157 } 3158 } 3159 } 3160 return (NULL); 3161 } 3162 3163 static void 3164 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb, 3165 uint16_t error, struct sctp_abort_chunk *abort, 3166 bool from_peer, bool timedout, int so_locked) 3167 { 3168 struct mbuf *m_notify; 3169 struct sctp_assoc_change *sac; 3170 struct sctp_queued_to_read *control; 3171 unsigned int notif_len; 3172 uint16_t abort_len; 3173 unsigned int i; 3174 3175 KASSERT(abort == NULL || from_peer, 3176 ("sctp_notify_assoc_change: ABORT chunk provided for local termination")); 3177 KASSERT(!from_peer || !timedout, 3178 ("sctp_notify_assoc_change: timeouts can only be local")); 3179 if (stcb == NULL) { 3180 return; 3181 } 3182 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) { 3183 notif_len = (unsigned int)sizeof(struct sctp_assoc_change); 3184 if (abort != NULL) { 3185 abort_len = ntohs(abort->ch.chunk_length); 3186 /* 3187 * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be 3188 * contiguous. 3189 */ 3190 if (abort_len > SCTP_CHUNK_BUFFER_SIZE) { 3191 abort_len = SCTP_CHUNK_BUFFER_SIZE; 3192 } 3193 } else { 3194 abort_len = 0; 3195 } 3196 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) { 3197 notif_len += SCTP_ASSOC_SUPPORTS_MAX; 3198 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) { 3199 notif_len += abort_len; 3200 } 3201 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA); 3202 if (m_notify == NULL) { 3203 /* Retry with smaller value. */ 3204 notif_len = (unsigned int)sizeof(struct sctp_assoc_change); 3205 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA); 3206 if (m_notify == NULL) { 3207 goto set_error; 3208 } 3209 } 3210 SCTP_BUF_NEXT(m_notify) = NULL; 3211 sac = mtod(m_notify, struct sctp_assoc_change *); 3212 memset(sac, 0, notif_len); 3213 sac->sac_type = SCTP_ASSOC_CHANGE; 3214 sac->sac_flags = 0; 3215 sac->sac_length = sizeof(struct sctp_assoc_change); 3216 sac->sac_state = state; 3217 sac->sac_error = error; 3218 if (state == SCTP_CANT_STR_ASSOC) { 3219 sac->sac_outbound_streams = 0; 3220 sac->sac_inbound_streams = 0; 3221 } else { 3222 sac->sac_outbound_streams = stcb->asoc.streamoutcnt; 3223 sac->sac_inbound_streams = stcb->asoc.streamincnt; 3224 } 3225 sac->sac_assoc_id = sctp_get_associd(stcb); 3226 if (notif_len > sizeof(struct sctp_assoc_change)) { 3227 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) { 3228 i = 0; 3229 if (stcb->asoc.prsctp_supported == 1) { 3230 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR; 3231 } 3232 if (stcb->asoc.auth_supported == 1) { 3233 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH; 3234 } 3235 if (stcb->asoc.asconf_supported == 1) { 3236 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF; 3237 } 3238 if (stcb->asoc.idata_supported == 1) { 3239 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING; 3240 } 3241 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF; 3242 if (stcb->asoc.reconfig_supported == 1) { 3243 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG; 3244 } 3245 sac->sac_length += i; 3246 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) { 3247 memcpy(sac->sac_info, abort, abort_len); 3248 sac->sac_length += abort_len; 3249 } 3250 } 3251 SCTP_BUF_LEN(m_notify) = sac->sac_length; 3252 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3253 0, 0, stcb->asoc.context, 0, 0, 0, 3254 m_notify); 3255 if (control != NULL) { 3256 control->length = SCTP_BUF_LEN(m_notify); 3257 control->spec_flags = M_NOTIFICATION; 3258 /* not that we need this */ 3259 control->tail_mbuf = m_notify; 3260 sctp_add_to_readq(stcb->sctp_ep, stcb, 3261 control, 3262 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, 3263 so_locked); 3264 } else { 3265 sctp_m_freem(m_notify); 3266 } 3267 } 3268 /* 3269 * For 1-to-1 style sockets, we send up and error when an ABORT 3270 * comes in. 3271 */ 3272 set_error: 3273 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 3274 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 3275 ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) { 3276 SOCK_LOCK(stcb->sctp_socket); 3277 if (from_peer) { 3278 if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) { 3279 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED); 3280 stcb->sctp_socket->so_error = ECONNREFUSED; 3281 } else { 3282 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET); 3283 stcb->sctp_socket->so_error = ECONNRESET; 3284 } 3285 } else { 3286 if (timedout) { 3287 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT); 3288 stcb->sctp_socket->so_error = ETIMEDOUT; 3289 } else { 3290 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED); 3291 stcb->sctp_socket->so_error = ECONNABORTED; 3292 } 3293 } 3294 SOCK_UNLOCK(stcb->sctp_socket); 3295 } 3296 /* Wake ANY sleepers */ 3297 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 3298 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 3299 ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) { 3300 socantrcvmore(stcb->sctp_socket); 3301 } 3302 sorwakeup(stcb->sctp_socket); 3303 sowwakeup(stcb->sctp_socket); 3304 } 3305 3306 static void 3307 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state, 3308 struct sockaddr *sa, uint32_t error, int so_locked) 3309 { 3310 struct mbuf *m_notify; 3311 struct sctp_paddr_change *spc; 3312 struct sctp_queued_to_read *control; 3313 3314 if ((stcb == NULL) || 3315 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) { 3316 /* event not enabled */ 3317 return; 3318 } 3319 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA); 3320 if (m_notify == NULL) 3321 return; 3322 SCTP_BUF_LEN(m_notify) = 0; 3323 spc = mtod(m_notify, struct sctp_paddr_change *); 3324 memset(spc, 0, sizeof(struct sctp_paddr_change)); 3325 spc->spc_type = SCTP_PEER_ADDR_CHANGE; 3326 spc->spc_flags = 0; 3327 spc->spc_length = sizeof(struct sctp_paddr_change); 3328 switch (sa->sa_family) { 3329 #ifdef INET 3330 case AF_INET: 3331 #ifdef INET6 3332 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) { 3333 in6_sin_2_v4mapsin6((struct sockaddr_in *)sa, 3334 (struct sockaddr_in6 *)&spc->spc_aaddr); 3335 } else { 3336 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in)); 3337 } 3338 #else 3339 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in)); 3340 #endif 3341 break; 3342 #endif 3343 #ifdef INET6 3344 case AF_INET6: 3345 { 3346 struct sockaddr_in6 *sin6; 3347 3348 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6)); 3349 3350 sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr; 3351 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) { 3352 if (sin6->sin6_scope_id == 0) { 3353 /* recover scope_id for user */ 3354 (void)sa6_recoverscope(sin6); 3355 } else { 3356 /* clear embedded scope_id for user */ 3357 in6_clearscope(&sin6->sin6_addr); 3358 } 3359 } 3360 break; 3361 } 3362 #endif 3363 default: 3364 /* TSNH */ 3365 break; 3366 } 3367 spc->spc_state = state; 3368 spc->spc_error = error; 3369 spc->spc_assoc_id = sctp_get_associd(stcb); 3370 3371 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change); 3372 SCTP_BUF_NEXT(m_notify) = NULL; 3373 3374 /* append to socket */ 3375 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3376 0, 0, stcb->asoc.context, 0, 0, 0, 3377 m_notify); 3378 if (control == NULL) { 3379 /* no memory */ 3380 sctp_m_freem(m_notify); 3381 return; 3382 } 3383 control->length = SCTP_BUF_LEN(m_notify); 3384 control->spec_flags = M_NOTIFICATION; 3385 /* not that we need this */ 3386 control->tail_mbuf = m_notify; 3387 sctp_add_to_readq(stcb->sctp_ep, stcb, 3388 control, 3389 &stcb->sctp_socket->so_rcv, 1, 3390 SCTP_READ_LOCK_NOT_HELD, 3391 so_locked); 3392 } 3393 3394 static void 3395 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error, 3396 struct sctp_tmit_chunk *chk, int so_locked) 3397 { 3398 struct mbuf *m_notify; 3399 struct sctp_send_failed *ssf; 3400 struct sctp_send_failed_event *ssfe; 3401 struct sctp_queued_to_read *control; 3402 struct sctp_chunkhdr *chkhdr; 3403 int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len; 3404 3405 if ((stcb == NULL) || 3406 (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) && 3407 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) { 3408 /* event not enabled */ 3409 return; 3410 } 3411 3412 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { 3413 notifhdr_len = sizeof(struct sctp_send_failed_event); 3414 } else { 3415 notifhdr_len = sizeof(struct sctp_send_failed); 3416 } 3417 m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA); 3418 if (m_notify == NULL) 3419 /* no space left */ 3420 return; 3421 SCTP_BUF_LEN(m_notify) = notifhdr_len; 3422 if (stcb->asoc.idata_supported) { 3423 chkhdr_len = sizeof(struct sctp_idata_chunk); 3424 } else { 3425 chkhdr_len = sizeof(struct sctp_data_chunk); 3426 } 3427 /* Use some defaults in case we can't access the chunk header */ 3428 if (chk->send_size >= chkhdr_len) { 3429 payload_len = chk->send_size - chkhdr_len; 3430 } else { 3431 payload_len = 0; 3432 } 3433 padding_len = 0; 3434 if (chk->data != NULL) { 3435 chkhdr = mtod(chk->data, struct sctp_chunkhdr *); 3436 if (chkhdr != NULL) { 3437 chk_len = ntohs(chkhdr->chunk_length); 3438 if ((chk_len >= chkhdr_len) && 3439 (chk->send_size >= chk_len) && 3440 (chk->send_size - chk_len < 4)) { 3441 padding_len = chk->send_size - chk_len; 3442 payload_len = chk->send_size - chkhdr_len - padding_len; 3443 } 3444 } 3445 } 3446 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { 3447 ssfe = mtod(m_notify, struct sctp_send_failed_event *); 3448 memset(ssfe, 0, notifhdr_len); 3449 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; 3450 if (sent) { 3451 ssfe->ssfe_flags = SCTP_DATA_SENT; 3452 } else { 3453 ssfe->ssfe_flags = SCTP_DATA_UNSENT; 3454 } 3455 ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len); 3456 ssfe->ssfe_error = error; 3457 /* not exactly what the user sent in, but should be close :) */ 3458 ssfe->ssfe_info.snd_sid = chk->rec.data.sid; 3459 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags; 3460 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid; 3461 ssfe->ssfe_info.snd_context = chk->rec.data.context; 3462 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb); 3463 ssfe->ssfe_assoc_id = sctp_get_associd(stcb); 3464 } else { 3465 ssf = mtod(m_notify, struct sctp_send_failed *); 3466 memset(ssf, 0, notifhdr_len); 3467 ssf->ssf_type = SCTP_SEND_FAILED; 3468 if (sent) { 3469 ssf->ssf_flags = SCTP_DATA_SENT; 3470 } else { 3471 ssf->ssf_flags = SCTP_DATA_UNSENT; 3472 } 3473 ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len); 3474 ssf->ssf_error = error; 3475 /* not exactly what the user sent in, but should be close :) */ 3476 ssf->ssf_info.sinfo_stream = chk->rec.data.sid; 3477 ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid; 3478 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags; 3479 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid; 3480 ssf->ssf_info.sinfo_context = chk->rec.data.context; 3481 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb); 3482 ssf->ssf_assoc_id = sctp_get_associd(stcb); 3483 } 3484 if (chk->data != NULL) { 3485 /* Trim off the sctp chunk header (it should be there) */ 3486 if (chk->send_size == chkhdr_len + payload_len + padding_len) { 3487 m_adj(chk->data, chkhdr_len); 3488 m_adj(chk->data, -padding_len); 3489 sctp_mbuf_crush(chk->data); 3490 chk->send_size -= (chkhdr_len + padding_len); 3491 } 3492 } 3493 SCTP_BUF_NEXT(m_notify) = chk->data; 3494 /* Steal off the mbuf */ 3495 chk->data = NULL; 3496 /* 3497 * For this case, we check the actual socket buffer, since the assoc 3498 * is going away we don't want to overfill the socket buffer for a 3499 * non-reader 3500 */ 3501 if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3502 sctp_m_freem(m_notify); 3503 return; 3504 } 3505 /* append to socket */ 3506 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3507 0, 0, stcb->asoc.context, 0, 0, 0, 3508 m_notify); 3509 if (control == NULL) { 3510 /* no memory */ 3511 sctp_m_freem(m_notify); 3512 return; 3513 } 3514 control->length = SCTP_BUF_LEN(m_notify); 3515 control->spec_flags = M_NOTIFICATION; 3516 /* not that we need this */ 3517 control->tail_mbuf = m_notify; 3518 sctp_add_to_readq(stcb->sctp_ep, stcb, 3519 control, 3520 &stcb->sctp_socket->so_rcv, 1, 3521 SCTP_READ_LOCK_NOT_HELD, 3522 so_locked); 3523 } 3524 3525 static void 3526 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error, 3527 struct sctp_stream_queue_pending *sp, int so_locked) 3528 { 3529 struct mbuf *m_notify; 3530 struct sctp_send_failed *ssf; 3531 struct sctp_send_failed_event *ssfe; 3532 struct sctp_queued_to_read *control; 3533 int notifhdr_len; 3534 3535 if ((stcb == NULL) || 3536 (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) && 3537 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) { 3538 /* event not enabled */ 3539 return; 3540 } 3541 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { 3542 notifhdr_len = sizeof(struct sctp_send_failed_event); 3543 } else { 3544 notifhdr_len = sizeof(struct sctp_send_failed); 3545 } 3546 m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA); 3547 if (m_notify == NULL) { 3548 /* no space left */ 3549 return; 3550 } 3551 SCTP_BUF_LEN(m_notify) = notifhdr_len; 3552 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { 3553 ssfe = mtod(m_notify, struct sctp_send_failed_event *); 3554 memset(ssfe, 0, notifhdr_len); 3555 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; 3556 ssfe->ssfe_flags = SCTP_DATA_UNSENT; 3557 ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length); 3558 ssfe->ssfe_error = error; 3559 /* not exactly what the user sent in, but should be close :) */ 3560 ssfe->ssfe_info.snd_sid = sp->sid; 3561 if (sp->some_taken) { 3562 ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG; 3563 } else { 3564 ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG; 3565 } 3566 ssfe->ssfe_info.snd_ppid = sp->ppid; 3567 ssfe->ssfe_info.snd_context = sp->context; 3568 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb); 3569 ssfe->ssfe_assoc_id = sctp_get_associd(stcb); 3570 } else { 3571 ssf = mtod(m_notify, struct sctp_send_failed *); 3572 memset(ssf, 0, notifhdr_len); 3573 ssf->ssf_type = SCTP_SEND_FAILED; 3574 ssf->ssf_flags = SCTP_DATA_UNSENT; 3575 ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length); 3576 ssf->ssf_error = error; 3577 /* not exactly what the user sent in, but should be close :) */ 3578 ssf->ssf_info.sinfo_stream = sp->sid; 3579 ssf->ssf_info.sinfo_ssn = 0; 3580 if (sp->some_taken) { 3581 ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG; 3582 } else { 3583 ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG; 3584 } 3585 ssf->ssf_info.sinfo_ppid = sp->ppid; 3586 ssf->ssf_info.sinfo_context = sp->context; 3587 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb); 3588 ssf->ssf_assoc_id = sctp_get_associd(stcb); 3589 } 3590 SCTP_BUF_NEXT(m_notify) = sp->data; 3591 3592 /* Steal off the mbuf */ 3593 sp->data = NULL; 3594 /* 3595 * For this case, we check the actual socket buffer, since the assoc 3596 * is going away we don't want to overfill the socket buffer for a 3597 * non-reader 3598 */ 3599 if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3600 sctp_m_freem(m_notify); 3601 return; 3602 } 3603 /* append to socket */ 3604 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3605 0, 0, stcb->asoc.context, 0, 0, 0, 3606 m_notify); 3607 if (control == NULL) { 3608 /* no memory */ 3609 sctp_m_freem(m_notify); 3610 return; 3611 } 3612 control->length = SCTP_BUF_LEN(m_notify); 3613 control->spec_flags = M_NOTIFICATION; 3614 /* not that we need this */ 3615 control->tail_mbuf = m_notify; 3616 sctp_add_to_readq(stcb->sctp_ep, stcb, 3617 control, 3618 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked); 3619 } 3620 3621 static void 3622 sctp_notify_adaptation_layer(struct sctp_tcb *stcb) 3623 { 3624 struct mbuf *m_notify; 3625 struct sctp_adaptation_event *sai; 3626 struct sctp_queued_to_read *control; 3627 3628 if ((stcb == NULL) || 3629 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) { 3630 /* event not enabled */ 3631 return; 3632 } 3633 3634 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA); 3635 if (m_notify == NULL) 3636 /* no space left */ 3637 return; 3638 SCTP_BUF_LEN(m_notify) = 0; 3639 sai = mtod(m_notify, struct sctp_adaptation_event *); 3640 memset(sai, 0, sizeof(struct sctp_adaptation_event)); 3641 sai->sai_type = SCTP_ADAPTATION_INDICATION; 3642 sai->sai_flags = 0; 3643 sai->sai_length = sizeof(struct sctp_adaptation_event); 3644 sai->sai_adaptation_ind = stcb->asoc.peers_adaptation; 3645 sai->sai_assoc_id = sctp_get_associd(stcb); 3646 3647 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event); 3648 SCTP_BUF_NEXT(m_notify) = NULL; 3649 3650 /* append to socket */ 3651 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3652 0, 0, stcb->asoc.context, 0, 0, 0, 3653 m_notify); 3654 if (control == NULL) { 3655 /* no memory */ 3656 sctp_m_freem(m_notify); 3657 return; 3658 } 3659 control->length = SCTP_BUF_LEN(m_notify); 3660 control->spec_flags = M_NOTIFICATION; 3661 /* not that we need this */ 3662 control->tail_mbuf = m_notify; 3663 sctp_add_to_readq(stcb->sctp_ep, stcb, 3664 control, 3665 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3666 } 3667 3668 /* This always must be called with the read-queue LOCKED in the INP */ 3669 static void 3670 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error, 3671 uint32_t val, int so_locked) 3672 { 3673 struct mbuf *m_notify; 3674 struct sctp_pdapi_event *pdapi; 3675 struct sctp_queued_to_read *control; 3676 struct sockbuf *sb; 3677 3678 if ((stcb == NULL) || 3679 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) { 3680 /* event not enabled */ 3681 return; 3682 } 3683 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) { 3684 return; 3685 } 3686 3687 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA); 3688 if (m_notify == NULL) 3689 /* no space left */ 3690 return; 3691 SCTP_BUF_LEN(m_notify) = 0; 3692 pdapi = mtod(m_notify, struct sctp_pdapi_event *); 3693 memset(pdapi, 0, sizeof(struct sctp_pdapi_event)); 3694 pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT; 3695 pdapi->pdapi_flags = 0; 3696 pdapi->pdapi_length = sizeof(struct sctp_pdapi_event); 3697 pdapi->pdapi_indication = error; 3698 pdapi->pdapi_stream = (val >> 16); 3699 pdapi->pdapi_seq = (val & 0x0000ffff); 3700 pdapi->pdapi_assoc_id = sctp_get_associd(stcb); 3701 3702 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event); 3703 SCTP_BUF_NEXT(m_notify) = NULL; 3704 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3705 0, 0, stcb->asoc.context, 0, 0, 0, 3706 m_notify); 3707 if (control == NULL) { 3708 /* no memory */ 3709 sctp_m_freem(m_notify); 3710 return; 3711 } 3712 control->length = SCTP_BUF_LEN(m_notify); 3713 control->spec_flags = M_NOTIFICATION; 3714 /* not that we need this */ 3715 control->tail_mbuf = m_notify; 3716 sb = &stcb->sctp_socket->so_rcv; 3717 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 3718 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify)); 3719 } 3720 sctp_sballoc(stcb, sb, m_notify); 3721 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 3722 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 3723 } 3724 control->end_added = 1; 3725 if (stcb->asoc.control_pdapi) 3726 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next); 3727 else { 3728 /* we really should not see this case */ 3729 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next); 3730 } 3731 if (stcb->sctp_ep && stcb->sctp_socket) { 3732 /* This should always be the case */ 3733 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 3734 } 3735 } 3736 3737 static void 3738 sctp_notify_shutdown_event(struct sctp_tcb *stcb) 3739 { 3740 struct mbuf *m_notify; 3741 struct sctp_shutdown_event *sse; 3742 struct sctp_queued_to_read *control; 3743 3744 /* 3745 * For TCP model AND UDP connected sockets we will send an error up 3746 * when an SHUTDOWN completes 3747 */ 3748 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 3749 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 3750 /* mark socket closed for read/write and wakeup! */ 3751 socantsendmore(stcb->sctp_socket); 3752 } 3753 if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) { 3754 /* event not enabled */ 3755 return; 3756 } 3757 3758 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA); 3759 if (m_notify == NULL) 3760 /* no space left */ 3761 return; 3762 sse = mtod(m_notify, struct sctp_shutdown_event *); 3763 memset(sse, 0, sizeof(struct sctp_shutdown_event)); 3764 sse->sse_type = SCTP_SHUTDOWN_EVENT; 3765 sse->sse_flags = 0; 3766 sse->sse_length = sizeof(struct sctp_shutdown_event); 3767 sse->sse_assoc_id = sctp_get_associd(stcb); 3768 3769 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event); 3770 SCTP_BUF_NEXT(m_notify) = NULL; 3771 3772 /* append to socket */ 3773 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3774 0, 0, stcb->asoc.context, 0, 0, 0, 3775 m_notify); 3776 if (control == NULL) { 3777 /* no memory */ 3778 sctp_m_freem(m_notify); 3779 return; 3780 } 3781 control->length = SCTP_BUF_LEN(m_notify); 3782 control->spec_flags = M_NOTIFICATION; 3783 /* not that we need this */ 3784 control->tail_mbuf = m_notify; 3785 sctp_add_to_readq(stcb->sctp_ep, stcb, 3786 control, 3787 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3788 } 3789 3790 static void 3791 sctp_notify_sender_dry_event(struct sctp_tcb *stcb, 3792 int so_locked) 3793 { 3794 struct mbuf *m_notify; 3795 struct sctp_sender_dry_event *event; 3796 struct sctp_queued_to_read *control; 3797 3798 if ((stcb == NULL) || 3799 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) { 3800 /* event not enabled */ 3801 return; 3802 } 3803 3804 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA); 3805 if (m_notify == NULL) { 3806 /* no space left */ 3807 return; 3808 } 3809 SCTP_BUF_LEN(m_notify) = 0; 3810 event = mtod(m_notify, struct sctp_sender_dry_event *); 3811 memset(event, 0, sizeof(struct sctp_sender_dry_event)); 3812 event->sender_dry_type = SCTP_SENDER_DRY_EVENT; 3813 event->sender_dry_flags = 0; 3814 event->sender_dry_length = sizeof(struct sctp_sender_dry_event); 3815 event->sender_dry_assoc_id = sctp_get_associd(stcb); 3816 3817 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event); 3818 SCTP_BUF_NEXT(m_notify) = NULL; 3819 3820 /* append to socket */ 3821 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3822 0, 0, stcb->asoc.context, 0, 0, 0, 3823 m_notify); 3824 if (control == NULL) { 3825 /* no memory */ 3826 sctp_m_freem(m_notify); 3827 return; 3828 } 3829 control->length = SCTP_BUF_LEN(m_notify); 3830 control->spec_flags = M_NOTIFICATION; 3831 /* not that we need this */ 3832 control->tail_mbuf = m_notify; 3833 sctp_add_to_readq(stcb->sctp_ep, stcb, control, 3834 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked); 3835 } 3836 3837 void 3838 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag) 3839 { 3840 struct mbuf *m_notify; 3841 struct sctp_queued_to_read *control; 3842 struct sctp_stream_change_event *stradd; 3843 3844 if ((stcb == NULL) || 3845 (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) { 3846 /* event not enabled */ 3847 return; 3848 } 3849 if ((stcb->asoc.peer_req_out) && flag) { 3850 /* Peer made the request, don't tell the local user */ 3851 stcb->asoc.peer_req_out = 0; 3852 return; 3853 } 3854 stcb->asoc.peer_req_out = 0; 3855 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA); 3856 if (m_notify == NULL) 3857 /* no space left */ 3858 return; 3859 SCTP_BUF_LEN(m_notify) = 0; 3860 stradd = mtod(m_notify, struct sctp_stream_change_event *); 3861 memset(stradd, 0, sizeof(struct sctp_stream_change_event)); 3862 stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT; 3863 stradd->strchange_flags = flag; 3864 stradd->strchange_length = sizeof(struct sctp_stream_change_event); 3865 stradd->strchange_assoc_id = sctp_get_associd(stcb); 3866 stradd->strchange_instrms = numberin; 3867 stradd->strchange_outstrms = numberout; 3868 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event); 3869 SCTP_BUF_NEXT(m_notify) = NULL; 3870 if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3871 /* no space */ 3872 sctp_m_freem(m_notify); 3873 return; 3874 } 3875 /* append to socket */ 3876 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3877 0, 0, stcb->asoc.context, 0, 0, 0, 3878 m_notify); 3879 if (control == NULL) { 3880 /* no memory */ 3881 sctp_m_freem(m_notify); 3882 return; 3883 } 3884 control->length = SCTP_BUF_LEN(m_notify); 3885 control->spec_flags = M_NOTIFICATION; 3886 /* not that we need this */ 3887 control->tail_mbuf = m_notify; 3888 sctp_add_to_readq(stcb->sctp_ep, stcb, 3889 control, 3890 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3891 } 3892 3893 void 3894 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag) 3895 { 3896 struct mbuf *m_notify; 3897 struct sctp_queued_to_read *control; 3898 struct sctp_assoc_reset_event *strasoc; 3899 3900 if ((stcb == NULL) || 3901 (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) { 3902 /* event not enabled */ 3903 return; 3904 } 3905 m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA); 3906 if (m_notify == NULL) 3907 /* no space left */ 3908 return; 3909 SCTP_BUF_LEN(m_notify) = 0; 3910 strasoc = mtod(m_notify, struct sctp_assoc_reset_event *); 3911 memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event)); 3912 strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT; 3913 strasoc->assocreset_flags = flag; 3914 strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event); 3915 strasoc->assocreset_assoc_id = sctp_get_associd(stcb); 3916 strasoc->assocreset_local_tsn = sending_tsn; 3917 strasoc->assocreset_remote_tsn = recv_tsn; 3918 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event); 3919 SCTP_BUF_NEXT(m_notify) = NULL; 3920 if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3921 /* no space */ 3922 sctp_m_freem(m_notify); 3923 return; 3924 } 3925 /* append to socket */ 3926 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3927 0, 0, stcb->asoc.context, 0, 0, 0, 3928 m_notify); 3929 if (control == NULL) { 3930 /* no memory */ 3931 sctp_m_freem(m_notify); 3932 return; 3933 } 3934 control->length = SCTP_BUF_LEN(m_notify); 3935 control->spec_flags = M_NOTIFICATION; 3936 /* not that we need this */ 3937 control->tail_mbuf = m_notify; 3938 sctp_add_to_readq(stcb->sctp_ep, stcb, 3939 control, 3940 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 3941 } 3942 3943 static void 3944 sctp_notify_stream_reset(struct sctp_tcb *stcb, 3945 int number_entries, uint16_t *list, int flag) 3946 { 3947 struct mbuf *m_notify; 3948 struct sctp_queued_to_read *control; 3949 struct sctp_stream_reset_event *strreset; 3950 int len; 3951 3952 if ((stcb == NULL) || 3953 (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) { 3954 /* event not enabled */ 3955 return; 3956 } 3957 3958 m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 3959 if (m_notify == NULL) 3960 /* no space left */ 3961 return; 3962 SCTP_BUF_LEN(m_notify) = 0; 3963 len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t)); 3964 if (len > M_TRAILINGSPACE(m_notify)) { 3965 /* never enough room */ 3966 sctp_m_freem(m_notify); 3967 return; 3968 } 3969 strreset = mtod(m_notify, struct sctp_stream_reset_event *); 3970 memset(strreset, 0, len); 3971 strreset->strreset_type = SCTP_STREAM_RESET_EVENT; 3972 strreset->strreset_flags = flag; 3973 strreset->strreset_length = len; 3974 strreset->strreset_assoc_id = sctp_get_associd(stcb); 3975 if (number_entries) { 3976 int i; 3977 3978 for (i = 0; i < number_entries; i++) { 3979 strreset->strreset_stream_list[i] = ntohs(list[i]); 3980 } 3981 } 3982 SCTP_BUF_LEN(m_notify) = len; 3983 SCTP_BUF_NEXT(m_notify) = NULL; 3984 if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { 3985 /* no space */ 3986 sctp_m_freem(m_notify); 3987 return; 3988 } 3989 /* append to socket */ 3990 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 3991 0, 0, stcb->asoc.context, 0, 0, 0, 3992 m_notify); 3993 if (control == NULL) { 3994 /* no memory */ 3995 sctp_m_freem(m_notify); 3996 return; 3997 } 3998 control->length = SCTP_BUF_LEN(m_notify); 3999 control->spec_flags = M_NOTIFICATION; 4000 /* not that we need this */ 4001 control->tail_mbuf = m_notify; 4002 sctp_add_to_readq(stcb->sctp_ep, stcb, 4003 control, 4004 &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 4005 } 4006 4007 static void 4008 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk) 4009 { 4010 struct mbuf *m_notify; 4011 struct sctp_remote_error *sre; 4012 struct sctp_queued_to_read *control; 4013 unsigned int notif_len; 4014 uint16_t chunk_len; 4015 4016 if ((stcb == NULL) || 4017 sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) { 4018 return; 4019 } 4020 if (chunk != NULL) { 4021 chunk_len = ntohs(chunk->ch.chunk_length); 4022 /* 4023 * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be 4024 * contiguous. 4025 */ 4026 if (chunk_len > SCTP_CHUNK_BUFFER_SIZE) { 4027 chunk_len = SCTP_CHUNK_BUFFER_SIZE; 4028 } 4029 } else { 4030 chunk_len = 0; 4031 } 4032 notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len); 4033 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA); 4034 if (m_notify == NULL) { 4035 /* Retry with smaller value. */ 4036 notif_len = (unsigned int)sizeof(struct sctp_remote_error); 4037 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA); 4038 if (m_notify == NULL) { 4039 return; 4040 } 4041 } 4042 SCTP_BUF_NEXT(m_notify) = NULL; 4043 sre = mtod(m_notify, struct sctp_remote_error *); 4044 memset(sre, 0, notif_len); 4045 sre->sre_type = SCTP_REMOTE_ERROR; 4046 sre->sre_flags = 0; 4047 sre->sre_length = sizeof(struct sctp_remote_error); 4048 sre->sre_error = error; 4049 sre->sre_assoc_id = sctp_get_associd(stcb); 4050 if (notif_len > sizeof(struct sctp_remote_error)) { 4051 memcpy(sre->sre_data, chunk, chunk_len); 4052 sre->sre_length += chunk_len; 4053 } 4054 SCTP_BUF_LEN(m_notify) = sre->sre_length; 4055 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination, 4056 0, 0, stcb->asoc.context, 0, 0, 0, 4057 m_notify); 4058 if (control != NULL) { 4059 control->length = SCTP_BUF_LEN(m_notify); 4060 control->spec_flags = M_NOTIFICATION; 4061 /* not that we need this */ 4062 control->tail_mbuf = m_notify; 4063 sctp_add_to_readq(stcb->sctp_ep, stcb, 4064 control, 4065 &stcb->sctp_socket->so_rcv, 1, 4066 SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED); 4067 } else { 4068 sctp_m_freem(m_notify); 4069 } 4070 } 4071 4072 void 4073 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb, 4074 uint32_t error, void *data, int so_locked) 4075 { 4076 if ((stcb == NULL) || 4077 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 4078 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 4079 (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) { 4080 /* If the socket is gone we are out of here */ 4081 return; 4082 } 4083 if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) { 4084 return; 4085 } 4086 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 4087 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 4088 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) || 4089 (notification == SCTP_NOTIFY_INTERFACE_UP) || 4090 (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) { 4091 /* Don't report these in front states */ 4092 return; 4093 } 4094 } 4095 switch (notification) { 4096 case SCTP_NOTIFY_ASSOC_UP: 4097 if (stcb->asoc.assoc_up_sent == 0) { 4098 sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, false, false, so_locked); 4099 stcb->asoc.assoc_up_sent = 1; 4100 } 4101 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) { 4102 sctp_notify_adaptation_layer(stcb); 4103 } 4104 if (stcb->asoc.auth_supported == 0) { 4105 sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0, 4106 NULL, so_locked); 4107 } 4108 break; 4109 case SCTP_NOTIFY_ASSOC_DOWN: 4110 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, false, false, so_locked); 4111 break; 4112 case SCTP_NOTIFY_INTERFACE_DOWN: 4113 { 4114 struct sctp_nets *net; 4115 4116 net = (struct sctp_nets *)data; 4117 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE, 4118 (struct sockaddr *)&net->ro._l_addr, error, so_locked); 4119 break; 4120 } 4121 case SCTP_NOTIFY_INTERFACE_UP: 4122 { 4123 struct sctp_nets *net; 4124 4125 net = (struct sctp_nets *)data; 4126 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE, 4127 (struct sockaddr *)&net->ro._l_addr, error, so_locked); 4128 break; 4129 } 4130 case SCTP_NOTIFY_INTERFACE_CONFIRMED: 4131 { 4132 struct sctp_nets *net; 4133 4134 net = (struct sctp_nets *)data; 4135 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED, 4136 (struct sockaddr *)&net->ro._l_addr, error, so_locked); 4137 break; 4138 } 4139 case SCTP_NOTIFY_SPECIAL_SP_FAIL: 4140 sctp_notify_send_failed2(stcb, error, 4141 (struct sctp_stream_queue_pending *)data, so_locked); 4142 break; 4143 case SCTP_NOTIFY_SENT_DG_FAIL: 4144 sctp_notify_send_failed(stcb, 1, error, 4145 (struct sctp_tmit_chunk *)data, so_locked); 4146 break; 4147 case SCTP_NOTIFY_UNSENT_DG_FAIL: 4148 sctp_notify_send_failed(stcb, 0, error, 4149 (struct sctp_tmit_chunk *)data, so_locked); 4150 break; 4151 case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION: 4152 { 4153 uint32_t val; 4154 4155 val = *((uint32_t *)data); 4156 4157 sctp_notify_partial_delivery_indication(stcb, error, val, so_locked); 4158 break; 4159 } 4160 case SCTP_NOTIFY_ASSOC_LOC_ABORTED: 4161 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 4162 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 4163 sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, false, false, so_locked); 4164 } else { 4165 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, false, false, so_locked); 4166 } 4167 break; 4168 case SCTP_NOTIFY_ASSOC_REM_ABORTED: 4169 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 4170 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 4171 sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, true, false, so_locked); 4172 } else { 4173 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, true, false, so_locked); 4174 } 4175 break; 4176 case SCTP_NOTIFY_ASSOC_TIMEDOUT: 4177 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 4178 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 4179 sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, false, true, so_locked); 4180 } else { 4181 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, false, true, so_locked); 4182 } 4183 break; 4184 case SCTP_NOTIFY_ASSOC_RESTART: 4185 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, false, false, so_locked); 4186 if (stcb->asoc.auth_supported == 0) { 4187 sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0, 4188 NULL, so_locked); 4189 } 4190 break; 4191 case SCTP_NOTIFY_STR_RESET_SEND: 4192 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN); 4193 break; 4194 case SCTP_NOTIFY_STR_RESET_RECV: 4195 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING); 4196 break; 4197 case SCTP_NOTIFY_STR_RESET_FAILED_OUT: 4198 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), 4199 (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED)); 4200 break; 4201 case SCTP_NOTIFY_STR_RESET_DENIED_OUT: 4202 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), 4203 (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED)); 4204 break; 4205 case SCTP_NOTIFY_STR_RESET_FAILED_IN: 4206 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), 4207 (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED)); 4208 break; 4209 case SCTP_NOTIFY_STR_RESET_DENIED_IN: 4210 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), 4211 (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED)); 4212 break; 4213 case SCTP_NOTIFY_ASCONF_ADD_IP: 4214 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data, 4215 error, so_locked); 4216 break; 4217 case SCTP_NOTIFY_ASCONF_DELETE_IP: 4218 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data, 4219 error, so_locked); 4220 break; 4221 case SCTP_NOTIFY_ASCONF_SET_PRIMARY: 4222 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data, 4223 error, so_locked); 4224 break; 4225 case SCTP_NOTIFY_PEER_SHUTDOWN: 4226 sctp_notify_shutdown_event(stcb); 4227 break; 4228 case SCTP_NOTIFY_AUTH_NEW_KEY: 4229 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error, 4230 (uint16_t)(uintptr_t)data, 4231 so_locked); 4232 break; 4233 case SCTP_NOTIFY_AUTH_FREE_KEY: 4234 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error, 4235 (uint16_t)(uintptr_t)data, 4236 so_locked); 4237 break; 4238 case SCTP_NOTIFY_NO_PEER_AUTH: 4239 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error, 4240 (uint16_t)(uintptr_t)data, 4241 so_locked); 4242 break; 4243 case SCTP_NOTIFY_SENDER_DRY: 4244 sctp_notify_sender_dry_event(stcb, so_locked); 4245 break; 4246 case SCTP_NOTIFY_REMOTE_ERROR: 4247 sctp_notify_remote_error(stcb, error, data); 4248 break; 4249 default: 4250 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n", 4251 __func__, notification, notification); 4252 break; 4253 } /* end switch */ 4254 } 4255 4256 void 4257 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int so_locked) 4258 { 4259 struct sctp_association *asoc; 4260 struct sctp_stream_out *outs; 4261 struct sctp_tmit_chunk *chk, *nchk; 4262 struct sctp_stream_queue_pending *sp, *nsp; 4263 int i; 4264 4265 if (stcb == NULL) { 4266 return; 4267 } 4268 asoc = &stcb->asoc; 4269 if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) { 4270 /* already being freed */ 4271 return; 4272 } 4273 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 4274 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 4275 (asoc->state & SCTP_STATE_CLOSED_SOCKET)) { 4276 return; 4277 } 4278 /* now through all the gunk freeing chunks */ 4279 /* sent queue SHOULD be empty */ 4280 TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) { 4281 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next); 4282 asoc->sent_queue_cnt--; 4283 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) { 4284 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) { 4285 asoc->strmout[chk->rec.data.sid].chunks_on_queues--; 4286 #ifdef INVARIANTS 4287 } else { 4288 panic("No chunks on the queues for sid %u.", chk->rec.data.sid); 4289 #endif 4290 } 4291 } 4292 if (chk->data != NULL) { 4293 sctp_free_bufspace(stcb, asoc, chk, 1); 4294 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 4295 error, chk, so_locked); 4296 if (chk->data) { 4297 sctp_m_freem(chk->data); 4298 chk->data = NULL; 4299 } 4300 } 4301 sctp_free_a_chunk(stcb, chk, so_locked); 4302 /* sa_ignore FREED_MEMORY */ 4303 } 4304 /* pending send queue SHOULD be empty */ 4305 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 4306 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next); 4307 asoc->send_queue_cnt--; 4308 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) { 4309 asoc->strmout[chk->rec.data.sid].chunks_on_queues--; 4310 #ifdef INVARIANTS 4311 } else { 4312 panic("No chunks on the queues for sid %u.", chk->rec.data.sid); 4313 #endif 4314 } 4315 if (chk->data != NULL) { 4316 sctp_free_bufspace(stcb, asoc, chk, 1); 4317 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 4318 error, chk, so_locked); 4319 if (chk->data) { 4320 sctp_m_freem(chk->data); 4321 chk->data = NULL; 4322 } 4323 } 4324 sctp_free_a_chunk(stcb, chk, so_locked); 4325 /* sa_ignore FREED_MEMORY */ 4326 } 4327 for (i = 0; i < asoc->streamoutcnt; i++) { 4328 /* For each stream */ 4329 outs = &asoc->strmout[i]; 4330 /* clean up any sends there */ 4331 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) { 4332 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 4333 TAILQ_REMOVE(&outs->outqueue, sp, next); 4334 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp); 4335 sctp_free_spbufspace(stcb, asoc, sp); 4336 if (sp->data) { 4337 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb, 4338 error, (void *)sp, so_locked); 4339 if (sp->data) { 4340 sctp_m_freem(sp->data); 4341 sp->data = NULL; 4342 sp->tail_mbuf = NULL; 4343 sp->length = 0; 4344 } 4345 } 4346 if (sp->net) { 4347 sctp_free_remote_addr(sp->net); 4348 sp->net = NULL; 4349 } 4350 /* Free the chunk */ 4351 sctp_free_a_strmoq(stcb, sp, so_locked); 4352 /* sa_ignore FREED_MEMORY */ 4353 } 4354 } 4355 } 4356 4357 void 4358 sctp_abort_notification(struct sctp_tcb *stcb, bool from_peer, bool timeout, 4359 uint16_t error, struct sctp_abort_chunk *abort, 4360 int so_locked) 4361 { 4362 if (stcb == NULL) { 4363 return; 4364 } 4365 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) || 4366 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 4367 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) { 4368 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED; 4369 } 4370 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 4371 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || 4372 (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) { 4373 return; 4374 } 4375 SCTP_TCB_SEND_LOCK(stcb); 4376 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED); 4377 /* Tell them we lost the asoc */ 4378 sctp_report_all_outbound(stcb, error, so_locked); 4379 SCTP_TCB_SEND_UNLOCK(stcb); 4380 if (from_peer) { 4381 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked); 4382 } else { 4383 if (timeout) { 4384 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_TIMEDOUT, stcb, error, abort, so_locked); 4385 } else { 4386 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked); 4387 } 4388 } 4389 } 4390 4391 void 4392 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 4393 struct mbuf *m, int iphlen, 4394 struct sockaddr *src, struct sockaddr *dst, 4395 struct sctphdr *sh, struct mbuf *op_err, 4396 uint8_t mflowtype, uint32_t mflowid, 4397 uint32_t vrf_id, uint16_t port) 4398 { 4399 struct sctp_gen_error_cause *cause; 4400 uint32_t vtag; 4401 uint16_t cause_code; 4402 4403 if (stcb != NULL) { 4404 vtag = stcb->asoc.peer_vtag; 4405 vrf_id = stcb->asoc.vrf_id; 4406 if (op_err != NULL) { 4407 /* Read the cause code from the error cause. */ 4408 cause = mtod(op_err, struct sctp_gen_error_cause *); 4409 cause_code = ntohs(cause->code); 4410 } else { 4411 cause_code = 0; 4412 } 4413 } else { 4414 vtag = 0; 4415 } 4416 sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err, 4417 mflowtype, mflowid, inp->fibnum, 4418 vrf_id, port); 4419 if (stcb != NULL) { 4420 /* We have a TCB to abort, send notification too */ 4421 sctp_abort_notification(stcb, false, false, cause_code, NULL, SCTP_SO_NOT_LOCKED); 4422 /* Ok, now lets free it */ 4423 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 4424 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) || 4425 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 4426 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 4427 } 4428 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 4429 SCTP_FROM_SCTPUTIL + SCTP_LOC_4); 4430 } 4431 } 4432 #ifdef SCTP_ASOCLOG_OF_TSNS 4433 void 4434 sctp_print_out_track_log(struct sctp_tcb *stcb) 4435 { 4436 #ifdef NOSIY_PRINTS 4437 int i; 4438 4439 SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code); 4440 SCTP_PRINTF("IN bound TSN log-aaa\n"); 4441 if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) { 4442 SCTP_PRINTF("None rcvd\n"); 4443 goto none_in; 4444 } 4445 if (stcb->asoc.tsn_in_wrapped) { 4446 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) { 4447 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 4448 stcb->asoc.in_tsnlog[i].tsn, 4449 stcb->asoc.in_tsnlog[i].strm, 4450 stcb->asoc.in_tsnlog[i].seq, 4451 stcb->asoc.in_tsnlog[i].flgs, 4452 stcb->asoc.in_tsnlog[i].sz); 4453 } 4454 } 4455 if (stcb->asoc.tsn_in_at) { 4456 for (i = 0; i < stcb->asoc.tsn_in_at; i++) { 4457 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 4458 stcb->asoc.in_tsnlog[i].tsn, 4459 stcb->asoc.in_tsnlog[i].strm, 4460 stcb->asoc.in_tsnlog[i].seq, 4461 stcb->asoc.in_tsnlog[i].flgs, 4462 stcb->asoc.in_tsnlog[i].sz); 4463 } 4464 } 4465 none_in: 4466 SCTP_PRINTF("OUT bound TSN log-aaa\n"); 4467 if ((stcb->asoc.tsn_out_at == 0) && 4468 (stcb->asoc.tsn_out_wrapped == 0)) { 4469 SCTP_PRINTF("None sent\n"); 4470 } 4471 if (stcb->asoc.tsn_out_wrapped) { 4472 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) { 4473 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 4474 stcb->asoc.out_tsnlog[i].tsn, 4475 stcb->asoc.out_tsnlog[i].strm, 4476 stcb->asoc.out_tsnlog[i].seq, 4477 stcb->asoc.out_tsnlog[i].flgs, 4478 stcb->asoc.out_tsnlog[i].sz); 4479 } 4480 } 4481 if (stcb->asoc.tsn_out_at) { 4482 for (i = 0; i < stcb->asoc.tsn_out_at; i++) { 4483 SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n", 4484 stcb->asoc.out_tsnlog[i].tsn, 4485 stcb->asoc.out_tsnlog[i].strm, 4486 stcb->asoc.out_tsnlog[i].seq, 4487 stcb->asoc.out_tsnlog[i].flgs, 4488 stcb->asoc.out_tsnlog[i].sz); 4489 } 4490 } 4491 #endif 4492 } 4493 #endif 4494 4495 void 4496 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 4497 struct mbuf *op_err, bool timedout, int so_locked) 4498 { 4499 struct sctp_gen_error_cause *cause; 4500 uint16_t cause_code; 4501 4502 if (stcb == NULL) { 4503 /* Got to have a TCB */ 4504 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4505 if (LIST_EMPTY(&inp->sctp_asoc_list)) { 4506 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT, 4507 SCTP_CALLED_DIRECTLY_NOCMPSET); 4508 } 4509 } 4510 return; 4511 } 4512 if (op_err != NULL) { 4513 /* Read the cause code from the error cause. */ 4514 cause = mtod(op_err, struct sctp_gen_error_cause *); 4515 cause_code = ntohs(cause->code); 4516 } else { 4517 cause_code = 0; 4518 } 4519 /* notify the peer */ 4520 sctp_send_abort_tcb(stcb, op_err, so_locked); 4521 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 4522 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) || 4523 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 4524 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 4525 } 4526 /* notify the ulp */ 4527 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) { 4528 sctp_abort_notification(stcb, false, timedout, cause_code, NULL, so_locked); 4529 } 4530 /* now free the asoc */ 4531 #ifdef SCTP_ASOCLOG_OF_TSNS 4532 sctp_print_out_track_log(stcb); 4533 #endif 4534 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 4535 SCTP_FROM_SCTPUTIL + SCTP_LOC_5); 4536 } 4537 4538 void 4539 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, 4540 struct sockaddr *src, struct sockaddr *dst, 4541 struct sctphdr *sh, struct sctp_inpcb *inp, 4542 struct mbuf *cause, 4543 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 4544 uint32_t vrf_id, uint16_t port) 4545 { 4546 struct sctp_chunkhdr *ch, chunk_buf; 4547 unsigned int chk_length; 4548 int contains_init_chunk; 4549 4550 SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue); 4551 /* Generate a TO address for future reference */ 4552 if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 4553 if (LIST_EMPTY(&inp->sctp_asoc_list)) { 4554 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT, 4555 SCTP_CALLED_DIRECTLY_NOCMPSET); 4556 } 4557 } 4558 contains_init_chunk = 0; 4559 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 4560 sizeof(*ch), (uint8_t *)&chunk_buf); 4561 while (ch != NULL) { 4562 chk_length = ntohs(ch->chunk_length); 4563 if (chk_length < sizeof(*ch)) { 4564 /* break to abort land */ 4565 break; 4566 } 4567 switch (ch->chunk_type) { 4568 case SCTP_INIT: 4569 contains_init_chunk = 1; 4570 break; 4571 case SCTP_PACKET_DROPPED: 4572 /* we don't respond to pkt-dropped */ 4573 return; 4574 case SCTP_ABORT_ASSOCIATION: 4575 /* we don't respond with an ABORT to an ABORT */ 4576 return; 4577 case SCTP_SHUTDOWN_COMPLETE: 4578 /* 4579 * we ignore it since we are not waiting for it and 4580 * peer is gone 4581 */ 4582 return; 4583 case SCTP_SHUTDOWN_ACK: 4584 sctp_send_shutdown_complete2(src, dst, sh, 4585 mflowtype, mflowid, fibnum, 4586 vrf_id, port); 4587 return; 4588 default: 4589 break; 4590 } 4591 offset += SCTP_SIZE32(chk_length); 4592 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 4593 sizeof(*ch), (uint8_t *)&chunk_buf); 4594 } 4595 if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) || 4596 ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) && 4597 (contains_init_chunk == 0))) { 4598 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause, 4599 mflowtype, mflowid, fibnum, 4600 vrf_id, port); 4601 } 4602 } 4603 4604 /* 4605 * check the inbound datagram to make sure there is not an abort inside it, 4606 * if there is return 1, else return 0. 4607 */ 4608 int 4609 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtag) 4610 { 4611 struct sctp_chunkhdr *ch; 4612 struct sctp_init_chunk *init_chk, chunk_buf; 4613 int offset; 4614 unsigned int chk_length; 4615 4616 offset = iphlen + sizeof(struct sctphdr); 4617 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch), 4618 (uint8_t *)&chunk_buf); 4619 while (ch != NULL) { 4620 chk_length = ntohs(ch->chunk_length); 4621 if (chk_length < sizeof(*ch)) { 4622 /* packet is probably corrupt */ 4623 break; 4624 } 4625 /* we seem to be ok, is it an abort? */ 4626 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) { 4627 /* yep, tell them */ 4628 return (1); 4629 } 4630 if ((ch->chunk_type == SCTP_INITIATION) || 4631 (ch->chunk_type == SCTP_INITIATION_ACK)) { 4632 /* need to update the Vtag */ 4633 init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m, 4634 offset, sizeof(struct sctp_init_chunk), (uint8_t *)&chunk_buf); 4635 if (init_chk != NULL) { 4636 *vtag = ntohl(init_chk->init.initiate_tag); 4637 } 4638 } 4639 /* Nope, move to the next chunk */ 4640 offset += SCTP_SIZE32(chk_length); 4641 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 4642 sizeof(*ch), (uint8_t *)&chunk_buf); 4643 } 4644 return (0); 4645 } 4646 4647 /* 4648 * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id 4649 * set (i.e. it's 0) so, create this function to compare link local scopes 4650 */ 4651 #ifdef INET6 4652 uint32_t 4653 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2) 4654 { 4655 struct sockaddr_in6 a, b; 4656 4657 /* save copies */ 4658 a = *addr1; 4659 b = *addr2; 4660 4661 if (a.sin6_scope_id == 0) 4662 if (sa6_recoverscope(&a)) { 4663 /* can't get scope, so can't match */ 4664 return (0); 4665 } 4666 if (b.sin6_scope_id == 0) 4667 if (sa6_recoverscope(&b)) { 4668 /* can't get scope, so can't match */ 4669 return (0); 4670 } 4671 if (a.sin6_scope_id != b.sin6_scope_id) 4672 return (0); 4673 4674 return (1); 4675 } 4676 4677 /* 4678 * returns a sockaddr_in6 with embedded scope recovered and removed 4679 */ 4680 struct sockaddr_in6 * 4681 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store) 4682 { 4683 /* check and strip embedded scope junk */ 4684 if (addr->sin6_family == AF_INET6) { 4685 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) { 4686 if (addr->sin6_scope_id == 0) { 4687 *store = *addr; 4688 if (!sa6_recoverscope(store)) { 4689 /* use the recovered scope */ 4690 addr = store; 4691 } 4692 } else { 4693 /* else, return the original "to" addr */ 4694 in6_clearscope(&addr->sin6_addr); 4695 } 4696 } 4697 } 4698 return (addr); 4699 } 4700 #endif 4701 4702 /* 4703 * are the two addresses the same? currently a "scopeless" check returns: 1 4704 * if same, 0 if not 4705 */ 4706 int 4707 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2) 4708 { 4709 4710 /* must be valid */ 4711 if (sa1 == NULL || sa2 == NULL) 4712 return (0); 4713 4714 /* must be the same family */ 4715 if (sa1->sa_family != sa2->sa_family) 4716 return (0); 4717 4718 switch (sa1->sa_family) { 4719 #ifdef INET6 4720 case AF_INET6: 4721 { 4722 /* IPv6 addresses */ 4723 struct sockaddr_in6 *sin6_1, *sin6_2; 4724 4725 sin6_1 = (struct sockaddr_in6 *)sa1; 4726 sin6_2 = (struct sockaddr_in6 *)sa2; 4727 return (SCTP6_ARE_ADDR_EQUAL(sin6_1, 4728 sin6_2)); 4729 } 4730 #endif 4731 #ifdef INET 4732 case AF_INET: 4733 { 4734 /* IPv4 addresses */ 4735 struct sockaddr_in *sin_1, *sin_2; 4736 4737 sin_1 = (struct sockaddr_in *)sa1; 4738 sin_2 = (struct sockaddr_in *)sa2; 4739 return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr); 4740 } 4741 #endif 4742 default: 4743 /* we don't do these... */ 4744 return (0); 4745 } 4746 } 4747 4748 void 4749 sctp_print_address(struct sockaddr *sa) 4750 { 4751 #ifdef INET6 4752 char ip6buf[INET6_ADDRSTRLEN]; 4753 #endif 4754 4755 switch (sa->sa_family) { 4756 #ifdef INET6 4757 case AF_INET6: 4758 { 4759 struct sockaddr_in6 *sin6; 4760 4761 sin6 = (struct sockaddr_in6 *)sa; 4762 SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n", 4763 ip6_sprintf(ip6buf, &sin6->sin6_addr), 4764 ntohs(sin6->sin6_port), 4765 sin6->sin6_scope_id); 4766 break; 4767 } 4768 #endif 4769 #ifdef INET 4770 case AF_INET: 4771 { 4772 struct sockaddr_in *sin; 4773 unsigned char *p; 4774 4775 sin = (struct sockaddr_in *)sa; 4776 p = (unsigned char *)&sin->sin_addr; 4777 SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n", 4778 p[0], p[1], p[2], p[3], ntohs(sin->sin_port)); 4779 break; 4780 } 4781 #endif 4782 default: 4783 SCTP_PRINTF("?\n"); 4784 break; 4785 } 4786 } 4787 4788 void 4789 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp, 4790 struct sctp_inpcb *new_inp, 4791 struct sctp_tcb *stcb, 4792 int waitflags) 4793 { 4794 /* 4795 * go through our old INP and pull off any control structures that 4796 * belong to stcb and move then to the new inp. 4797 */ 4798 struct socket *old_so, *new_so; 4799 struct sctp_queued_to_read *control, *nctl; 4800 struct sctp_readhead tmp_queue; 4801 struct mbuf *m; 4802 int error = 0; 4803 4804 old_so = old_inp->sctp_socket; 4805 new_so = new_inp->sctp_socket; 4806 TAILQ_INIT(&tmp_queue); 4807 error = SOCK_IO_RECV_LOCK(old_so, waitflags); 4808 if (error) { 4809 /* 4810 * Gak, can't get I/O lock, we have a problem. data will be 4811 * left stranded.. and we don't dare look at it since the 4812 * other thread may be reading something. Oh well, its a 4813 * screwed up app that does a peeloff OR a accept while 4814 * reading from the main socket... actually its only the 4815 * peeloff() case, since I think read will fail on a 4816 * listening socket.. 4817 */ 4818 return; 4819 } 4820 /* lock the socket buffers */ 4821 SCTP_INP_READ_LOCK(old_inp); 4822 TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) { 4823 /* Pull off all for out target stcb */ 4824 if (control->stcb == stcb) { 4825 /* remove it we want it */ 4826 TAILQ_REMOVE(&old_inp->read_queue, control, next); 4827 TAILQ_INSERT_TAIL(&tmp_queue, control, next); 4828 m = control->data; 4829 while (m) { 4830 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4831 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m)); 4832 } 4833 sctp_sbfree(control, stcb, &old_so->so_rcv, m); 4834 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4835 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 4836 } 4837 m = SCTP_BUF_NEXT(m); 4838 } 4839 } 4840 } 4841 SCTP_INP_READ_UNLOCK(old_inp); 4842 /* Remove the recv-lock on the old socket */ 4843 SOCK_IO_RECV_UNLOCK(old_so); 4844 /* Now we move them over to the new socket buffer */ 4845 SCTP_INP_READ_LOCK(new_inp); 4846 TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) { 4847 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next); 4848 m = control->data; 4849 while (m) { 4850 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4851 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m)); 4852 } 4853 sctp_sballoc(stcb, &new_so->so_rcv, m); 4854 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4855 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 4856 } 4857 m = SCTP_BUF_NEXT(m); 4858 } 4859 } 4860 SCTP_INP_READ_UNLOCK(new_inp); 4861 } 4862 4863 void 4864 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp, 4865 struct sctp_tcb *stcb, 4866 int so_locked 4867 SCTP_UNUSED 4868 ) 4869 { 4870 if ((inp != NULL) && (inp->sctp_socket != NULL)) { 4871 sctp_sorwakeup(inp, inp->sctp_socket); 4872 } 4873 } 4874 4875 void 4876 sctp_add_to_readq(struct sctp_inpcb *inp, 4877 struct sctp_tcb *stcb, 4878 struct sctp_queued_to_read *control, 4879 struct sockbuf *sb, 4880 int end, 4881 int inp_read_lock_held, 4882 int so_locked) 4883 { 4884 /* 4885 * Here we must place the control on the end of the socket read 4886 * queue AND increment sb_cc so that select will work properly on 4887 * read. 4888 */ 4889 struct mbuf *m, *prev = NULL; 4890 4891 if (inp == NULL) { 4892 /* Gak, TSNH!! */ 4893 #ifdef INVARIANTS 4894 panic("Gak, inp NULL on add_to_readq"); 4895 #endif 4896 return; 4897 } 4898 if (inp_read_lock_held == 0) 4899 SCTP_INP_READ_LOCK(inp); 4900 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) { 4901 if (!control->on_strm_q) { 4902 sctp_free_remote_addr(control->whoFrom); 4903 if (control->data) { 4904 sctp_m_freem(control->data); 4905 control->data = NULL; 4906 } 4907 sctp_free_a_readq(stcb, control); 4908 } 4909 if (inp_read_lock_held == 0) 4910 SCTP_INP_READ_UNLOCK(inp); 4911 return; 4912 } 4913 if (!(control->spec_flags & M_NOTIFICATION)) { 4914 atomic_add_int(&inp->total_recvs, 1); 4915 if (!control->do_not_ref_stcb) { 4916 atomic_add_int(&stcb->total_recvs, 1); 4917 } 4918 } 4919 m = control->data; 4920 control->held_length = 0; 4921 control->length = 0; 4922 while (m) { 4923 if (SCTP_BUF_LEN(m) == 0) { 4924 /* Skip mbufs with NO length */ 4925 if (prev == NULL) { 4926 /* First one */ 4927 control->data = sctp_m_free(m); 4928 m = control->data; 4929 } else { 4930 SCTP_BUF_NEXT(prev) = sctp_m_free(m); 4931 m = SCTP_BUF_NEXT(prev); 4932 } 4933 if (m == NULL) { 4934 control->tail_mbuf = prev; 4935 } 4936 continue; 4937 } 4938 prev = m; 4939 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4940 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m)); 4941 } 4942 sctp_sballoc(stcb, sb, m); 4943 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 4944 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 4945 } 4946 atomic_add_int(&control->length, SCTP_BUF_LEN(m)); 4947 m = SCTP_BUF_NEXT(m); 4948 } 4949 if (prev != NULL) { 4950 control->tail_mbuf = prev; 4951 } else { 4952 /* Everything got collapsed out?? */ 4953 if (!control->on_strm_q) { 4954 sctp_free_remote_addr(control->whoFrom); 4955 sctp_free_a_readq(stcb, control); 4956 } 4957 if (inp_read_lock_held == 0) 4958 SCTP_INP_READ_UNLOCK(inp); 4959 return; 4960 } 4961 if (end) { 4962 control->end_added = 1; 4963 } 4964 TAILQ_INSERT_TAIL(&inp->read_queue, control, next); 4965 control->on_read_q = 1; 4966 if (inp_read_lock_held == 0) 4967 SCTP_INP_READ_UNLOCK(inp); 4968 if (inp && inp->sctp_socket) { 4969 sctp_wakeup_the_read_socket(inp, stcb, so_locked); 4970 } 4971 } 4972 4973 /*************HOLD THIS COMMENT FOR PATCH FILE OF 4974 *************ALTERNATE ROUTING CODE 4975 */ 4976 4977 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF 4978 *************ALTERNATE ROUTING CODE 4979 */ 4980 4981 struct mbuf * 4982 sctp_generate_cause(uint16_t code, char *info) 4983 { 4984 struct mbuf *m; 4985 struct sctp_gen_error_cause *cause; 4986 size_t info_len; 4987 uint16_t len; 4988 4989 if ((code == 0) || (info == NULL)) { 4990 return (NULL); 4991 } 4992 info_len = strlen(info); 4993 if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) { 4994 return (NULL); 4995 } 4996 len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len); 4997 m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA); 4998 if (m != NULL) { 4999 SCTP_BUF_LEN(m) = len; 5000 cause = mtod(m, struct sctp_gen_error_cause *); 5001 cause->code = htons(code); 5002 cause->length = htons(len); 5003 memcpy(cause->info, info, info_len); 5004 } 5005 return (m); 5006 } 5007 5008 struct mbuf * 5009 sctp_generate_no_user_data_cause(uint32_t tsn) 5010 { 5011 struct mbuf *m; 5012 struct sctp_error_no_user_data *no_user_data_cause; 5013 uint16_t len; 5014 5015 len = (uint16_t)sizeof(struct sctp_error_no_user_data); 5016 m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA); 5017 if (m != NULL) { 5018 SCTP_BUF_LEN(m) = len; 5019 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *); 5020 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA); 5021 no_user_data_cause->cause.length = htons(len); 5022 no_user_data_cause->tsn = htonl(tsn); 5023 } 5024 return (m); 5025 } 5026 5027 #ifdef SCTP_MBCNT_LOGGING 5028 void 5029 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc, 5030 struct sctp_tmit_chunk *tp1, int chk_cnt) 5031 { 5032 if (tp1->data == NULL) { 5033 return; 5034 } 5035 asoc->chunks_on_out_queue -= chk_cnt; 5036 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) { 5037 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE, 5038 asoc->total_output_queue_size, 5039 tp1->book_size, 5040 0, 5041 tp1->mbcnt); 5042 } 5043 if (asoc->total_output_queue_size >= tp1->book_size) { 5044 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size); 5045 } else { 5046 asoc->total_output_queue_size = 0; 5047 } 5048 5049 if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) || 5050 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) { 5051 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) { 5052 stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size; 5053 } else { 5054 stcb->sctp_socket->so_snd.sb_cc = 0; 5055 } 5056 } 5057 } 5058 5059 #endif 5060 5061 int 5062 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1, 5063 uint8_t sent, int so_locked) 5064 { 5065 struct sctp_stream_out *strq; 5066 struct sctp_tmit_chunk *chk = NULL, *tp2; 5067 struct sctp_stream_queue_pending *sp; 5068 uint32_t mid; 5069 uint16_t sid; 5070 uint8_t foundeom = 0; 5071 int ret_sz = 0; 5072 int notdone; 5073 int do_wakeup_routine = 0; 5074 5075 sid = tp1->rec.data.sid; 5076 mid = tp1->rec.data.mid; 5077 if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) { 5078 stcb->asoc.abandoned_sent[0]++; 5079 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++; 5080 stcb->asoc.strmout[sid].abandoned_sent[0]++; 5081 #if defined(SCTP_DETAILED_STR_STATS) 5082 stcb->asoc.strmout[sid].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++; 5083 #endif 5084 } else { 5085 stcb->asoc.abandoned_unsent[0]++; 5086 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++; 5087 stcb->asoc.strmout[sid].abandoned_unsent[0]++; 5088 #if defined(SCTP_DETAILED_STR_STATS) 5089 stcb->asoc.strmout[sid].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++; 5090 #endif 5091 } 5092 do { 5093 ret_sz += tp1->book_size; 5094 if (tp1->data != NULL) { 5095 if (tp1->sent < SCTP_DATAGRAM_RESEND) { 5096 sctp_flight_size_decrease(tp1); 5097 sctp_total_flight_decrease(stcb, tp1); 5098 } 5099 sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1); 5100 stcb->asoc.peers_rwnd += tp1->send_size; 5101 stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh); 5102 if (sent) { 5103 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked); 5104 } else { 5105 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked); 5106 } 5107 if (tp1->data) { 5108 sctp_m_freem(tp1->data); 5109 tp1->data = NULL; 5110 } 5111 do_wakeup_routine = 1; 5112 if (PR_SCTP_BUF_ENABLED(tp1->flags)) { 5113 stcb->asoc.sent_queue_cnt_removeable--; 5114 } 5115 } 5116 tp1->sent = SCTP_FORWARD_TSN_SKIP; 5117 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) == 5118 SCTP_DATA_NOT_FRAG) { 5119 /* not frag'ed we ae done */ 5120 notdone = 0; 5121 foundeom = 1; 5122 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 5123 /* end of frag, we are done */ 5124 notdone = 0; 5125 foundeom = 1; 5126 } else { 5127 /* 5128 * Its a begin or middle piece, we must mark all of 5129 * it 5130 */ 5131 notdone = 1; 5132 tp1 = TAILQ_NEXT(tp1, sctp_next); 5133 } 5134 } while (tp1 && notdone); 5135 if (foundeom == 0) { 5136 /* 5137 * The multi-part message was scattered across the send and 5138 * sent queue. 5139 */ 5140 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) { 5141 if ((tp1->rec.data.sid != sid) || 5142 (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) { 5143 break; 5144 } 5145 /* 5146 * save to chk in case we have some on stream out 5147 * queue. If so and we have an un-transmitted one we 5148 * don't have to fudge the TSN. 5149 */ 5150 chk = tp1; 5151 ret_sz += tp1->book_size; 5152 sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1); 5153 if (sent) { 5154 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked); 5155 } else { 5156 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked); 5157 } 5158 if (tp1->data) { 5159 sctp_m_freem(tp1->data); 5160 tp1->data = NULL; 5161 } 5162 /* No flight involved here book the size to 0 */ 5163 tp1->book_size = 0; 5164 if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 5165 foundeom = 1; 5166 } 5167 do_wakeup_routine = 1; 5168 tp1->sent = SCTP_FORWARD_TSN_SKIP; 5169 TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next); 5170 /* 5171 * on to the sent queue so we can wait for it to be 5172 * passed by. 5173 */ 5174 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1, 5175 sctp_next); 5176 stcb->asoc.send_queue_cnt--; 5177 stcb->asoc.sent_queue_cnt++; 5178 } 5179 } 5180 if (foundeom == 0) { 5181 /* 5182 * Still no eom found. That means there is stuff left on the 5183 * stream out queue.. yuck. 5184 */ 5185 SCTP_TCB_SEND_LOCK(stcb); 5186 strq = &stcb->asoc.strmout[sid]; 5187 sp = TAILQ_FIRST(&strq->outqueue); 5188 if (sp != NULL) { 5189 sp->discard_rest = 1; 5190 /* 5191 * We may need to put a chunk on the queue that 5192 * holds the TSN that would have been sent with the 5193 * LAST bit. 5194 */ 5195 if (chk == NULL) { 5196 /* Yep, we have to */ 5197 sctp_alloc_a_chunk(stcb, chk); 5198 if (chk == NULL) { 5199 /* 5200 * we are hosed. All we can do is 5201 * nothing.. which will cause an 5202 * abort if the peer is paying 5203 * attention. 5204 */ 5205 goto oh_well; 5206 } 5207 memset(chk, 0, sizeof(*chk)); 5208 chk->rec.data.rcv_flags = 0; 5209 chk->sent = SCTP_FORWARD_TSN_SKIP; 5210 chk->asoc = &stcb->asoc; 5211 if (stcb->asoc.idata_supported == 0) { 5212 if (sp->sinfo_flags & SCTP_UNORDERED) { 5213 chk->rec.data.mid = 0; 5214 } else { 5215 chk->rec.data.mid = strq->next_mid_ordered; 5216 } 5217 } else { 5218 if (sp->sinfo_flags & SCTP_UNORDERED) { 5219 chk->rec.data.mid = strq->next_mid_unordered; 5220 } else { 5221 chk->rec.data.mid = strq->next_mid_ordered; 5222 } 5223 } 5224 chk->rec.data.sid = sp->sid; 5225 chk->rec.data.ppid = sp->ppid; 5226 chk->rec.data.context = sp->context; 5227 chk->flags = sp->act_flags; 5228 chk->whoTo = NULL; 5229 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1); 5230 strq->chunks_on_queues++; 5231 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next); 5232 stcb->asoc.sent_queue_cnt++; 5233 stcb->asoc.pr_sctp_cnt++; 5234 } 5235 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG; 5236 if (sp->sinfo_flags & SCTP_UNORDERED) { 5237 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED; 5238 } 5239 if (stcb->asoc.idata_supported == 0) { 5240 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) { 5241 strq->next_mid_ordered++; 5242 } 5243 } else { 5244 if (sp->sinfo_flags & SCTP_UNORDERED) { 5245 strq->next_mid_unordered++; 5246 } else { 5247 strq->next_mid_ordered++; 5248 } 5249 } 5250 oh_well: 5251 if (sp->data) { 5252 /* 5253 * Pull any data to free up the SB and allow 5254 * sender to "add more" while we will throw 5255 * away :-) 5256 */ 5257 sctp_free_spbufspace(stcb, &stcb->asoc, sp); 5258 ret_sz += sp->length; 5259 do_wakeup_routine = 1; 5260 sp->some_taken = 1; 5261 sctp_m_freem(sp->data); 5262 sp->data = NULL; 5263 sp->tail_mbuf = NULL; 5264 sp->length = 0; 5265 } 5266 } 5267 SCTP_TCB_SEND_UNLOCK(stcb); 5268 } 5269 if (do_wakeup_routine) { 5270 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket); 5271 } 5272 return (ret_sz); 5273 } 5274 5275 /* 5276 * checks to see if the given address, sa, is one that is currently known by 5277 * the kernel note: can't distinguish the same address on multiple interfaces 5278 * and doesn't handle multiple addresses with different zone/scope id's note: 5279 * ifa_ifwithaddr() compares the entire sockaddr struct 5280 */ 5281 struct sctp_ifa * 5282 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr, 5283 int holds_lock) 5284 { 5285 struct sctp_laddr *laddr; 5286 5287 if (holds_lock == 0) { 5288 SCTP_INP_RLOCK(inp); 5289 } 5290 5291 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 5292 if (laddr->ifa == NULL) 5293 continue; 5294 if (addr->sa_family != laddr->ifa->address.sa.sa_family) 5295 continue; 5296 #ifdef INET 5297 if (addr->sa_family == AF_INET) { 5298 if (((struct sockaddr_in *)addr)->sin_addr.s_addr == 5299 laddr->ifa->address.sin.sin_addr.s_addr) { 5300 /* found him. */ 5301 break; 5302 } 5303 } 5304 #endif 5305 #ifdef INET6 5306 if (addr->sa_family == AF_INET6) { 5307 if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr, 5308 &laddr->ifa->address.sin6)) { 5309 /* found him. */ 5310 break; 5311 } 5312 } 5313 #endif 5314 } 5315 if (holds_lock == 0) { 5316 SCTP_INP_RUNLOCK(inp); 5317 } 5318 if (laddr != NULL) { 5319 return (laddr->ifa); 5320 } else { 5321 return (NULL); 5322 } 5323 } 5324 5325 uint32_t 5326 sctp_get_ifa_hash_val(struct sockaddr *addr) 5327 { 5328 switch (addr->sa_family) { 5329 #ifdef INET 5330 case AF_INET: 5331 { 5332 struct sockaddr_in *sin; 5333 5334 sin = (struct sockaddr_in *)addr; 5335 return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16)); 5336 } 5337 #endif 5338 #ifdef INET6 5339 case AF_INET6: 5340 { 5341 struct sockaddr_in6 *sin6; 5342 uint32_t hash_of_addr; 5343 5344 sin6 = (struct sockaddr_in6 *)addr; 5345 hash_of_addr = (sin6->sin6_addr.s6_addr32[0] + 5346 sin6->sin6_addr.s6_addr32[1] + 5347 sin6->sin6_addr.s6_addr32[2] + 5348 sin6->sin6_addr.s6_addr32[3]); 5349 hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16)); 5350 return (hash_of_addr); 5351 } 5352 #endif 5353 default: 5354 break; 5355 } 5356 return (0); 5357 } 5358 5359 struct sctp_ifa * 5360 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock) 5361 { 5362 struct sctp_ifa *sctp_ifap; 5363 struct sctp_vrf *vrf; 5364 struct sctp_ifalist *hash_head; 5365 uint32_t hash_of_addr; 5366 5367 if (holds_lock == 0) { 5368 SCTP_IPI_ADDR_RLOCK(); 5369 } else { 5370 SCTP_IPI_ADDR_LOCK_ASSERT(); 5371 } 5372 5373 vrf = sctp_find_vrf(vrf_id); 5374 if (vrf == NULL) { 5375 if (holds_lock == 0) 5376 SCTP_IPI_ADDR_RUNLOCK(); 5377 return (NULL); 5378 } 5379 5380 hash_of_addr = sctp_get_ifa_hash_val(addr); 5381 5382 hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)]; 5383 if (hash_head == NULL) { 5384 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ", 5385 hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark, 5386 (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark)); 5387 sctp_print_address(addr); 5388 SCTP_PRINTF("No such bucket for address\n"); 5389 if (holds_lock == 0) 5390 SCTP_IPI_ADDR_RUNLOCK(); 5391 5392 return (NULL); 5393 } 5394 LIST_FOREACH(sctp_ifap, hash_head, next_bucket) { 5395 if (addr->sa_family != sctp_ifap->address.sa.sa_family) 5396 continue; 5397 #ifdef INET 5398 if (addr->sa_family == AF_INET) { 5399 if (((struct sockaddr_in *)addr)->sin_addr.s_addr == 5400 sctp_ifap->address.sin.sin_addr.s_addr) { 5401 /* found him. */ 5402 break; 5403 } 5404 } 5405 #endif 5406 #ifdef INET6 5407 if (addr->sa_family == AF_INET6) { 5408 if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr, 5409 &sctp_ifap->address.sin6)) { 5410 /* found him. */ 5411 break; 5412 } 5413 } 5414 #endif 5415 } 5416 if (holds_lock == 0) 5417 SCTP_IPI_ADDR_RUNLOCK(); 5418 return (sctp_ifap); 5419 } 5420 5421 static void 5422 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock, 5423 uint32_t rwnd_req) 5424 { 5425 /* User pulled some data, do we need a rwnd update? */ 5426 struct epoch_tracker et; 5427 int r_unlocked = 0; 5428 uint32_t dif, rwnd; 5429 struct socket *so = NULL; 5430 5431 if (stcb == NULL) 5432 return; 5433 5434 atomic_add_int(&stcb->asoc.refcnt, 1); 5435 5436 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 5437 (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED | SCTP_STATE_SHUTDOWN_RECEIVED))) { 5438 /* Pre-check If we are freeing no update */ 5439 goto no_lock; 5440 } 5441 SCTP_INP_INCR_REF(stcb->sctp_ep); 5442 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 5443 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 5444 goto out; 5445 } 5446 so = stcb->sctp_socket; 5447 if (so == NULL) { 5448 goto out; 5449 } 5450 atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far); 5451 /* Have you have freed enough to look */ 5452 *freed_so_far = 0; 5453 /* Yep, its worth a look and the lock overhead */ 5454 5455 /* Figure out what the rwnd would be */ 5456 rwnd = sctp_calc_rwnd(stcb, &stcb->asoc); 5457 if (rwnd >= stcb->asoc.my_last_reported_rwnd) { 5458 dif = rwnd - stcb->asoc.my_last_reported_rwnd; 5459 } else { 5460 dif = 0; 5461 } 5462 if (dif >= rwnd_req) { 5463 if (hold_rlock) { 5464 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 5465 r_unlocked = 1; 5466 } 5467 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 5468 /* 5469 * One last check before we allow the guy possibly 5470 * to get in. There is a race, where the guy has not 5471 * reached the gate. In that case 5472 */ 5473 goto out; 5474 } 5475 SCTP_TCB_LOCK(stcb); 5476 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 5477 /* No reports here */ 5478 SCTP_TCB_UNLOCK(stcb); 5479 goto out; 5480 } 5481 SCTP_STAT_INCR(sctps_wu_sacks_sent); 5482 NET_EPOCH_ENTER(et); 5483 sctp_send_sack(stcb, SCTP_SO_LOCKED); 5484 5485 sctp_chunk_output(stcb->sctp_ep, stcb, 5486 SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED); 5487 /* make sure no timer is running */ 5488 NET_EPOCH_EXIT(et); 5489 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, 5490 SCTP_FROM_SCTPUTIL + SCTP_LOC_6); 5491 SCTP_TCB_UNLOCK(stcb); 5492 } else { 5493 /* Update how much we have pending */ 5494 stcb->freed_by_sorcv_sincelast = dif; 5495 } 5496 out: 5497 if (so && r_unlocked && hold_rlock) { 5498 SCTP_INP_READ_LOCK(stcb->sctp_ep); 5499 } 5500 5501 SCTP_INP_DECR_REF(stcb->sctp_ep); 5502 no_lock: 5503 atomic_subtract_int(&stcb->asoc.refcnt, 1); 5504 return; 5505 } 5506 5507 int 5508 sctp_sorecvmsg(struct socket *so, 5509 struct uio *uio, 5510 struct mbuf **mp, 5511 struct sockaddr *from, 5512 int fromlen, 5513 int *msg_flags, 5514 struct sctp_sndrcvinfo *sinfo, 5515 int filling_sinfo) 5516 { 5517 /* 5518 * MSG flags we will look at MSG_DONTWAIT - non-blocking IO. 5519 * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy 5520 * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ?? 5521 * On the way out we may send out any combination of: 5522 * MSG_NOTIFICATION MSG_EOR 5523 * 5524 */ 5525 struct sctp_inpcb *inp = NULL; 5526 ssize_t my_len = 0; 5527 ssize_t cp_len = 0; 5528 int error = 0; 5529 struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL; 5530 struct mbuf *m = NULL; 5531 struct sctp_tcb *stcb = NULL; 5532 int wakeup_read_socket = 0; 5533 int freecnt_applied = 0; 5534 int out_flags = 0, in_flags = 0; 5535 int block_allowed = 1; 5536 uint32_t freed_so_far = 0; 5537 ssize_t copied_so_far = 0; 5538 int in_eeor_mode = 0; 5539 int no_rcv_needed = 0; 5540 uint32_t rwnd_req = 0; 5541 int hold_sblock = 0; 5542 int hold_rlock = 0; 5543 ssize_t slen = 0; 5544 uint32_t held_length = 0; 5545 int sockbuf_lock = 0; 5546 5547 if (uio == NULL) { 5548 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 5549 return (EINVAL); 5550 } 5551 5552 if (msg_flags) { 5553 in_flags = *msg_flags; 5554 if (in_flags & MSG_PEEK) 5555 SCTP_STAT_INCR(sctps_read_peeks); 5556 } else { 5557 in_flags = 0; 5558 } 5559 slen = uio->uio_resid; 5560 5561 /* Pull in and set up our int flags */ 5562 if (in_flags & MSG_OOB) { 5563 /* Out of band's NOT supported */ 5564 return (EOPNOTSUPP); 5565 } 5566 if ((in_flags & MSG_PEEK) && (mp != NULL)) { 5567 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 5568 return (EINVAL); 5569 } 5570 if ((in_flags & (MSG_DONTWAIT 5571 | MSG_NBIO 5572 )) || 5573 SCTP_SO_IS_NBIO(so)) { 5574 block_allowed = 0; 5575 } 5576 /* setup the endpoint */ 5577 inp = (struct sctp_inpcb *)so->so_pcb; 5578 if (inp == NULL) { 5579 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT); 5580 return (EFAULT); 5581 } 5582 rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT); 5583 /* Must be at least a MTU's worth */ 5584 if (rwnd_req < SCTP_MIN_RWND) 5585 rwnd_req = SCTP_MIN_RWND; 5586 in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 5587 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) { 5588 sctp_misc_ints(SCTP_SORECV_ENTER, 5589 rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid); 5590 } 5591 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) { 5592 sctp_misc_ints(SCTP_SORECV_ENTERPL, 5593 rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid); 5594 } 5595 5596 error = SOCK_IO_RECV_LOCK(so, SBLOCKWAIT(in_flags)); 5597 if (error) { 5598 goto release_unlocked; 5599 } 5600 sockbuf_lock = 1; 5601 restart: 5602 5603 restart_nosblocks: 5604 if (hold_sblock == 0) { 5605 SOCKBUF_LOCK(&so->so_rcv); 5606 hold_sblock = 1; 5607 } 5608 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 5609 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 5610 goto out; 5611 } 5612 if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) { 5613 if (so->so_error) { 5614 error = so->so_error; 5615 if ((in_flags & MSG_PEEK) == 0) 5616 so->so_error = 0; 5617 goto out; 5618 } else { 5619 if (so->so_rcv.sb_cc == 0) { 5620 /* indicate EOF */ 5621 error = 0; 5622 goto out; 5623 } 5624 } 5625 } 5626 if (so->so_rcv.sb_cc <= held_length) { 5627 if (so->so_error) { 5628 error = so->so_error; 5629 if ((in_flags & MSG_PEEK) == 0) { 5630 so->so_error = 0; 5631 } 5632 goto out; 5633 } 5634 if ((so->so_rcv.sb_cc == 0) && 5635 ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 5636 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 5637 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) { 5638 /* 5639 * For active open side clear flags for 5640 * re-use passive open is blocked by 5641 * connect. 5642 */ 5643 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) { 5644 /* 5645 * You were aborted, passive side 5646 * always hits here 5647 */ 5648 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET); 5649 error = ECONNRESET; 5650 } 5651 so->so_state &= ~(SS_ISCONNECTING | 5652 SS_ISDISCONNECTING | 5653 SS_ISCONFIRMING | 5654 SS_ISCONNECTED); 5655 if (error == 0) { 5656 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) { 5657 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN); 5658 error = ENOTCONN; 5659 } 5660 } 5661 goto out; 5662 } 5663 } 5664 if (block_allowed) { 5665 error = sbwait(&so->so_rcv); 5666 if (error) { 5667 goto out; 5668 } 5669 held_length = 0; 5670 goto restart_nosblocks; 5671 } else { 5672 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK); 5673 error = EWOULDBLOCK; 5674 goto out; 5675 } 5676 } 5677 if (hold_sblock == 1) { 5678 SOCKBUF_UNLOCK(&so->so_rcv); 5679 hold_sblock = 0; 5680 } 5681 /* we possibly have data we can read */ 5682 /* sa_ignore FREED_MEMORY */ 5683 control = TAILQ_FIRST(&inp->read_queue); 5684 if (control == NULL) { 5685 /* 5686 * This could be happening since the appender did the 5687 * increment but as not yet did the tailq insert onto the 5688 * read_queue 5689 */ 5690 if (hold_rlock == 0) { 5691 SCTP_INP_READ_LOCK(inp); 5692 } 5693 control = TAILQ_FIRST(&inp->read_queue); 5694 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) { 5695 #ifdef INVARIANTS 5696 panic("Huh, its non zero and nothing on control?"); 5697 #endif 5698 so->so_rcv.sb_cc = 0; 5699 } 5700 SCTP_INP_READ_UNLOCK(inp); 5701 hold_rlock = 0; 5702 goto restart; 5703 } 5704 5705 if ((control->length == 0) && 5706 (control->do_not_ref_stcb)) { 5707 /* 5708 * Clean up code for freeing assoc that left behind a 5709 * pdapi.. maybe a peer in EEOR that just closed after 5710 * sending and never indicated a EOR. 5711 */ 5712 if (hold_rlock == 0) { 5713 hold_rlock = 1; 5714 SCTP_INP_READ_LOCK(inp); 5715 } 5716 control->held_length = 0; 5717 if (control->data) { 5718 /* Hmm there is data here .. fix */ 5719 struct mbuf *m_tmp; 5720 int cnt = 0; 5721 5722 m_tmp = control->data; 5723 while (m_tmp) { 5724 cnt += SCTP_BUF_LEN(m_tmp); 5725 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 5726 control->tail_mbuf = m_tmp; 5727 control->end_added = 1; 5728 } 5729 m_tmp = SCTP_BUF_NEXT(m_tmp); 5730 } 5731 control->length = cnt; 5732 } else { 5733 /* remove it */ 5734 TAILQ_REMOVE(&inp->read_queue, control, next); 5735 /* Add back any hiddend data */ 5736 sctp_free_remote_addr(control->whoFrom); 5737 sctp_free_a_readq(stcb, control); 5738 } 5739 if (hold_rlock) { 5740 hold_rlock = 0; 5741 SCTP_INP_READ_UNLOCK(inp); 5742 } 5743 goto restart; 5744 } 5745 if ((control->length == 0) && 5746 (control->end_added == 1)) { 5747 /* 5748 * Do we also need to check for (control->pdapi_aborted == 5749 * 1)? 5750 */ 5751 if (hold_rlock == 0) { 5752 hold_rlock = 1; 5753 SCTP_INP_READ_LOCK(inp); 5754 } 5755 TAILQ_REMOVE(&inp->read_queue, control, next); 5756 if (control->data) { 5757 #ifdef INVARIANTS 5758 panic("control->data not null but control->length == 0"); 5759 #else 5760 SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n"); 5761 sctp_m_freem(control->data); 5762 control->data = NULL; 5763 #endif 5764 } 5765 if (control->aux_data) { 5766 sctp_m_free(control->aux_data); 5767 control->aux_data = NULL; 5768 } 5769 #ifdef INVARIANTS 5770 if (control->on_strm_q) { 5771 panic("About to free ctl:%p so:%p and its in %d", 5772 control, so, control->on_strm_q); 5773 } 5774 #endif 5775 sctp_free_remote_addr(control->whoFrom); 5776 sctp_free_a_readq(stcb, control); 5777 if (hold_rlock) { 5778 hold_rlock = 0; 5779 SCTP_INP_READ_UNLOCK(inp); 5780 } 5781 goto restart; 5782 } 5783 if (control->length == 0) { 5784 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) && 5785 (filling_sinfo)) { 5786 /* find a more suitable one then this */ 5787 ctl = TAILQ_NEXT(control, next); 5788 while (ctl) { 5789 if ((ctl->stcb != control->stcb) && (ctl->length) && 5790 (ctl->some_taken || 5791 (ctl->spec_flags & M_NOTIFICATION) || 5792 ((ctl->do_not_ref_stcb == 0) && 5793 (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0))) 5794 ) { 5795 /*- 5796 * If we have a different TCB next, and there is data 5797 * present. If we have already taken some (pdapi), OR we can 5798 * ref the tcb and no delivery as started on this stream, we 5799 * take it. Note we allow a notification on a different 5800 * assoc to be delivered.. 5801 */ 5802 control = ctl; 5803 goto found_one; 5804 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) && 5805 (ctl->length) && 5806 ((ctl->some_taken) || 5807 ((ctl->do_not_ref_stcb == 0) && 5808 ((ctl->spec_flags & M_NOTIFICATION) == 0) && 5809 (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) { 5810 /*- 5811 * If we have the same tcb, and there is data present, and we 5812 * have the strm interleave feature present. Then if we have 5813 * taken some (pdapi) or we can refer to tht tcb AND we have 5814 * not started a delivery for this stream, we can take it. 5815 * Note we do NOT allow a notificaiton on the same assoc to 5816 * be delivered. 5817 */ 5818 control = ctl; 5819 goto found_one; 5820 } 5821 ctl = TAILQ_NEXT(ctl, next); 5822 } 5823 } 5824 /* 5825 * if we reach here, not suitable replacement is available 5826 * <or> fragment interleave is NOT on. So stuff the sb_cc 5827 * into the our held count, and its time to sleep again. 5828 */ 5829 held_length = so->so_rcv.sb_cc; 5830 control->held_length = so->so_rcv.sb_cc; 5831 goto restart; 5832 } 5833 /* Clear the held length since there is something to read */ 5834 control->held_length = 0; 5835 found_one: 5836 /* 5837 * If we reach here, control has a some data for us to read off. 5838 * Note that stcb COULD be NULL. 5839 */ 5840 if (hold_rlock == 0) { 5841 hold_rlock = 1; 5842 SCTP_INP_READ_LOCK(inp); 5843 } 5844 control->some_taken++; 5845 stcb = control->stcb; 5846 if (stcb) { 5847 if ((control->do_not_ref_stcb == 0) && 5848 (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) { 5849 if (freecnt_applied == 0) 5850 stcb = NULL; 5851 } else if (control->do_not_ref_stcb == 0) { 5852 /* you can't free it on me please */ 5853 /* 5854 * The lock on the socket buffer protects us so the 5855 * free code will stop. But since we used the 5856 * socketbuf lock and the sender uses the tcb_lock 5857 * to increment, we need to use the atomic add to 5858 * the refcnt 5859 */ 5860 if (freecnt_applied) { 5861 #ifdef INVARIANTS 5862 panic("refcnt already incremented"); 5863 #else 5864 SCTP_PRINTF("refcnt already incremented?\n"); 5865 #endif 5866 } else { 5867 atomic_add_int(&stcb->asoc.refcnt, 1); 5868 freecnt_applied = 1; 5869 } 5870 /* 5871 * Setup to remember how much we have not yet told 5872 * the peer our rwnd has opened up. Note we grab the 5873 * value from the tcb from last time. Note too that 5874 * sack sending clears this when a sack is sent, 5875 * which is fine. Once we hit the rwnd_req, we then 5876 * will go to the sctp_user_rcvd() that will not 5877 * lock until it KNOWs it MUST send a WUP-SACK. 5878 */ 5879 freed_so_far = (uint32_t)stcb->freed_by_sorcv_sincelast; 5880 stcb->freed_by_sorcv_sincelast = 0; 5881 } 5882 } 5883 if (stcb && 5884 ((control->spec_flags & M_NOTIFICATION) == 0) && 5885 control->do_not_ref_stcb == 0) { 5886 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1; 5887 } 5888 5889 /* First lets get off the sinfo and sockaddr info */ 5890 if ((sinfo != NULL) && (filling_sinfo != 0)) { 5891 sinfo->sinfo_stream = control->sinfo_stream; 5892 sinfo->sinfo_ssn = (uint16_t)control->mid; 5893 sinfo->sinfo_flags = control->sinfo_flags; 5894 sinfo->sinfo_ppid = control->sinfo_ppid; 5895 sinfo->sinfo_context = control->sinfo_context; 5896 sinfo->sinfo_timetolive = control->sinfo_timetolive; 5897 sinfo->sinfo_tsn = control->sinfo_tsn; 5898 sinfo->sinfo_cumtsn = control->sinfo_cumtsn; 5899 sinfo->sinfo_assoc_id = control->sinfo_assoc_id; 5900 nxt = TAILQ_NEXT(control, next); 5901 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) || 5902 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) { 5903 struct sctp_extrcvinfo *s_extra; 5904 5905 s_extra = (struct sctp_extrcvinfo *)sinfo; 5906 if ((nxt) && 5907 (nxt->length)) { 5908 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL; 5909 if (nxt->sinfo_flags & SCTP_UNORDERED) { 5910 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED; 5911 } 5912 if (nxt->spec_flags & M_NOTIFICATION) { 5913 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION; 5914 } 5915 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id; 5916 s_extra->serinfo_next_length = nxt->length; 5917 s_extra->serinfo_next_ppid = nxt->sinfo_ppid; 5918 s_extra->serinfo_next_stream = nxt->sinfo_stream; 5919 if (nxt->tail_mbuf != NULL) { 5920 if (nxt->end_added) { 5921 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE; 5922 } 5923 } 5924 } else { 5925 /* 5926 * we explicitly 0 this, since the memcpy 5927 * got some other things beyond the older 5928 * sinfo_ that is on the control's structure 5929 * :-D 5930 */ 5931 nxt = NULL; 5932 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG; 5933 s_extra->serinfo_next_aid = 0; 5934 s_extra->serinfo_next_length = 0; 5935 s_extra->serinfo_next_ppid = 0; 5936 s_extra->serinfo_next_stream = 0; 5937 } 5938 } 5939 /* 5940 * update off the real current cum-ack, if we have an stcb. 5941 */ 5942 if ((control->do_not_ref_stcb == 0) && stcb) 5943 sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn; 5944 /* 5945 * mask off the high bits, we keep the actual chunk bits in 5946 * there. 5947 */ 5948 sinfo->sinfo_flags &= 0x00ff; 5949 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) { 5950 sinfo->sinfo_flags |= SCTP_UNORDERED; 5951 } 5952 } 5953 #ifdef SCTP_ASOCLOG_OF_TSNS 5954 { 5955 int index, newindex; 5956 struct sctp_pcbtsn_rlog *entry; 5957 5958 do { 5959 index = inp->readlog_index; 5960 newindex = index + 1; 5961 if (newindex >= SCTP_READ_LOG_SIZE) { 5962 newindex = 0; 5963 } 5964 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0); 5965 entry = &inp->readlog[index]; 5966 entry->vtag = control->sinfo_assoc_id; 5967 entry->strm = control->sinfo_stream; 5968 entry->seq = (uint16_t)control->mid; 5969 entry->sz = control->length; 5970 entry->flgs = control->sinfo_flags; 5971 } 5972 #endif 5973 if ((fromlen > 0) && (from != NULL)) { 5974 union sctp_sockstore store; 5975 size_t len; 5976 5977 switch (control->whoFrom->ro._l_addr.sa.sa_family) { 5978 #ifdef INET6 5979 case AF_INET6: 5980 len = sizeof(struct sockaddr_in6); 5981 store.sin6 = control->whoFrom->ro._l_addr.sin6; 5982 store.sin6.sin6_port = control->port_from; 5983 break; 5984 #endif 5985 #ifdef INET 5986 case AF_INET: 5987 #ifdef INET6 5988 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) { 5989 len = sizeof(struct sockaddr_in6); 5990 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin, 5991 &store.sin6); 5992 store.sin6.sin6_port = control->port_from; 5993 } else { 5994 len = sizeof(struct sockaddr_in); 5995 store.sin = control->whoFrom->ro._l_addr.sin; 5996 store.sin.sin_port = control->port_from; 5997 } 5998 #else 5999 len = sizeof(struct sockaddr_in); 6000 store.sin = control->whoFrom->ro._l_addr.sin; 6001 store.sin.sin_port = control->port_from; 6002 #endif 6003 break; 6004 #endif 6005 default: 6006 len = 0; 6007 break; 6008 } 6009 memcpy(from, &store, min((size_t)fromlen, len)); 6010 #ifdef INET6 6011 { 6012 struct sockaddr_in6 lsa6, *from6; 6013 6014 from6 = (struct sockaddr_in6 *)from; 6015 sctp_recover_scope_mac(from6, (&lsa6)); 6016 } 6017 #endif 6018 } 6019 if (hold_rlock) { 6020 SCTP_INP_READ_UNLOCK(inp); 6021 hold_rlock = 0; 6022 } 6023 if (hold_sblock) { 6024 SOCKBUF_UNLOCK(&so->so_rcv); 6025 hold_sblock = 0; 6026 } 6027 /* now copy out what data we can */ 6028 if (mp == NULL) { 6029 /* copy out each mbuf in the chain up to length */ 6030 get_more_data: 6031 m = control->data; 6032 while (m) { 6033 /* Move out all we can */ 6034 cp_len = uio->uio_resid; 6035 my_len = SCTP_BUF_LEN(m); 6036 if (cp_len > my_len) { 6037 /* not enough in this buf */ 6038 cp_len = my_len; 6039 } 6040 if (hold_rlock) { 6041 SCTP_INP_READ_UNLOCK(inp); 6042 hold_rlock = 0; 6043 } 6044 if (cp_len > 0) 6045 error = uiomove(mtod(m, char *), (int)cp_len, uio); 6046 /* re-read */ 6047 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 6048 goto release; 6049 } 6050 6051 if ((control->do_not_ref_stcb == 0) && stcb && 6052 stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 6053 no_rcv_needed = 1; 6054 } 6055 if (error) { 6056 /* error we are out of here */ 6057 goto release; 6058 } 6059 SCTP_INP_READ_LOCK(inp); 6060 hold_rlock = 1; 6061 if (cp_len == SCTP_BUF_LEN(m)) { 6062 if ((SCTP_BUF_NEXT(m) == NULL) && 6063 (control->end_added)) { 6064 out_flags |= MSG_EOR; 6065 if ((control->do_not_ref_stcb == 0) && 6066 (control->stcb != NULL) && 6067 ((control->spec_flags & M_NOTIFICATION) == 0)) 6068 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 6069 } 6070 if (control->spec_flags & M_NOTIFICATION) { 6071 out_flags |= MSG_NOTIFICATION; 6072 } 6073 /* we ate up the mbuf */ 6074 if (in_flags & MSG_PEEK) { 6075 /* just looking */ 6076 m = SCTP_BUF_NEXT(m); 6077 copied_so_far += cp_len; 6078 } else { 6079 /* dispose of the mbuf */ 6080 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6081 sctp_sblog(&so->so_rcv, 6082 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m)); 6083 } 6084 sctp_sbfree(control, stcb, &so->so_rcv, m); 6085 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6086 sctp_sblog(&so->so_rcv, 6087 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 6088 } 6089 copied_so_far += cp_len; 6090 freed_so_far += (uint32_t)cp_len; 6091 freed_so_far += MSIZE; 6092 atomic_subtract_int(&control->length, (int)cp_len); 6093 control->data = sctp_m_free(m); 6094 m = control->data; 6095 /* 6096 * been through it all, must hold sb 6097 * lock ok to null tail 6098 */ 6099 if (control->data == NULL) { 6100 #ifdef INVARIANTS 6101 if ((control->end_added == 0) || 6102 (TAILQ_NEXT(control, next) == NULL)) { 6103 /* 6104 * If the end is not 6105 * added, OR the 6106 * next is NOT null 6107 * we MUST have the 6108 * lock. 6109 */ 6110 if (mtx_owned(&inp->inp_rdata_mtx) == 0) { 6111 panic("Hmm we don't own the lock?"); 6112 } 6113 } 6114 #endif 6115 control->tail_mbuf = NULL; 6116 #ifdef INVARIANTS 6117 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) { 6118 panic("end_added, nothing left and no MSG_EOR"); 6119 } 6120 #endif 6121 } 6122 } 6123 } else { 6124 /* Do we need to trim the mbuf? */ 6125 if (control->spec_flags & M_NOTIFICATION) { 6126 out_flags |= MSG_NOTIFICATION; 6127 } 6128 if ((in_flags & MSG_PEEK) == 0) { 6129 SCTP_BUF_RESV_UF(m, cp_len); 6130 SCTP_BUF_LEN(m) -= (int)cp_len; 6131 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6132 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, (int)cp_len); 6133 } 6134 atomic_subtract_int(&so->so_rcv.sb_cc, (int)cp_len); 6135 if ((control->do_not_ref_stcb == 0) && 6136 stcb) { 6137 atomic_subtract_int(&stcb->asoc.sb_cc, (int)cp_len); 6138 } 6139 copied_so_far += cp_len; 6140 freed_so_far += (uint32_t)cp_len; 6141 freed_so_far += MSIZE; 6142 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6143 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, 6144 SCTP_LOG_SBRESULT, 0); 6145 } 6146 atomic_subtract_int(&control->length, (int)cp_len); 6147 } else { 6148 copied_so_far += cp_len; 6149 } 6150 } 6151 if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) { 6152 break; 6153 } 6154 if (((stcb) && (in_flags & MSG_PEEK) == 0) && 6155 (control->do_not_ref_stcb == 0) && 6156 (freed_so_far >= rwnd_req)) { 6157 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 6158 } 6159 } /* end while(m) */ 6160 /* 6161 * At this point we have looked at it all and we either have 6162 * a MSG_EOR/or read all the user wants... <OR> 6163 * control->length == 0. 6164 */ 6165 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) { 6166 /* we are done with this control */ 6167 if (control->length == 0) { 6168 if (control->data) { 6169 #ifdef INVARIANTS 6170 panic("control->data not null at read eor?"); 6171 #else 6172 SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n"); 6173 sctp_m_freem(control->data); 6174 control->data = NULL; 6175 #endif 6176 } 6177 done_with_control: 6178 if (hold_rlock == 0) { 6179 SCTP_INP_READ_LOCK(inp); 6180 hold_rlock = 1; 6181 } 6182 TAILQ_REMOVE(&inp->read_queue, control, next); 6183 /* Add back any hiddend data */ 6184 if (control->held_length) { 6185 held_length = 0; 6186 control->held_length = 0; 6187 wakeup_read_socket = 1; 6188 } 6189 if (control->aux_data) { 6190 sctp_m_free(control->aux_data); 6191 control->aux_data = NULL; 6192 } 6193 no_rcv_needed = control->do_not_ref_stcb; 6194 sctp_free_remote_addr(control->whoFrom); 6195 control->data = NULL; 6196 #ifdef INVARIANTS 6197 if (control->on_strm_q) { 6198 panic("About to free ctl:%p so:%p and its in %d", 6199 control, so, control->on_strm_q); 6200 } 6201 #endif 6202 sctp_free_a_readq(stcb, control); 6203 control = NULL; 6204 if ((freed_so_far >= rwnd_req) && 6205 (no_rcv_needed == 0)) 6206 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 6207 6208 } else { 6209 /* 6210 * The user did not read all of this 6211 * message, turn off the returned MSG_EOR 6212 * since we are leaving more behind on the 6213 * control to read. 6214 */ 6215 #ifdef INVARIANTS 6216 if (control->end_added && 6217 (control->data == NULL) && 6218 (control->tail_mbuf == NULL)) { 6219 panic("Gak, control->length is corrupt?"); 6220 } 6221 #endif 6222 no_rcv_needed = control->do_not_ref_stcb; 6223 out_flags &= ~MSG_EOR; 6224 } 6225 } 6226 if (out_flags & MSG_EOR) { 6227 goto release; 6228 } 6229 if ((uio->uio_resid == 0) || 6230 ((in_eeor_mode) && 6231 (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))) { 6232 goto release; 6233 } 6234 /* 6235 * If I hit here the receiver wants more and this message is 6236 * NOT done (pd-api). So two questions. Can we block? if not 6237 * we are done. Did the user NOT set MSG_WAITALL? 6238 */ 6239 if (block_allowed == 0) { 6240 goto release; 6241 } 6242 /* 6243 * We need to wait for more data a few things: - We don't 6244 * release the I/O lock so we don't get someone else 6245 * reading. - We must be sure to account for the case where 6246 * what is added is NOT to our control when we wakeup. 6247 */ 6248 6249 /* 6250 * Do we need to tell the transport a rwnd update might be 6251 * needed before we go to sleep? 6252 */ 6253 if (((stcb) && (in_flags & MSG_PEEK) == 0) && 6254 ((freed_so_far >= rwnd_req) && 6255 (control->do_not_ref_stcb == 0) && 6256 (no_rcv_needed == 0))) { 6257 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 6258 } 6259 wait_some_more: 6260 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) { 6261 goto release; 6262 } 6263 6264 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) 6265 goto release; 6266 6267 if (hold_rlock == 1) { 6268 SCTP_INP_READ_UNLOCK(inp); 6269 hold_rlock = 0; 6270 } 6271 if (hold_sblock == 0) { 6272 SOCKBUF_LOCK(&so->so_rcv); 6273 hold_sblock = 1; 6274 } 6275 if ((copied_so_far) && (control->length == 0) && 6276 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) { 6277 goto release; 6278 } 6279 if (so->so_rcv.sb_cc <= control->held_length) { 6280 error = sbwait(&so->so_rcv); 6281 if (error) { 6282 goto release; 6283 } 6284 control->held_length = 0; 6285 } 6286 if (hold_sblock) { 6287 SOCKBUF_UNLOCK(&so->so_rcv); 6288 hold_sblock = 0; 6289 } 6290 if (control->length == 0) { 6291 /* still nothing here */ 6292 if (control->end_added == 1) { 6293 /* he aborted, or is done i.e.did a shutdown */ 6294 out_flags |= MSG_EOR; 6295 if (control->pdapi_aborted) { 6296 if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0)) 6297 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 6298 6299 out_flags |= MSG_TRUNC; 6300 } else { 6301 if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0)) 6302 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 6303 } 6304 goto done_with_control; 6305 } 6306 if (so->so_rcv.sb_cc > held_length) { 6307 control->held_length = so->so_rcv.sb_cc; 6308 held_length = 0; 6309 } 6310 goto wait_some_more; 6311 } else if (control->data == NULL) { 6312 /* 6313 * we must re-sync since data is probably being 6314 * added 6315 */ 6316 SCTP_INP_READ_LOCK(inp); 6317 if ((control->length > 0) && (control->data == NULL)) { 6318 /* 6319 * big trouble.. we have the lock and its 6320 * corrupt? 6321 */ 6322 #ifdef INVARIANTS 6323 panic("Impossible data==NULL length !=0"); 6324 #endif 6325 out_flags |= MSG_EOR; 6326 out_flags |= MSG_TRUNC; 6327 control->length = 0; 6328 SCTP_INP_READ_UNLOCK(inp); 6329 goto done_with_control; 6330 } 6331 SCTP_INP_READ_UNLOCK(inp); 6332 /* We will fall around to get more data */ 6333 } 6334 goto get_more_data; 6335 } else { 6336 /*- 6337 * Give caller back the mbuf chain, 6338 * store in uio_resid the length 6339 */ 6340 wakeup_read_socket = 0; 6341 if ((control->end_added == 0) || 6342 (TAILQ_NEXT(control, next) == NULL)) { 6343 /* Need to get rlock */ 6344 if (hold_rlock == 0) { 6345 SCTP_INP_READ_LOCK(inp); 6346 hold_rlock = 1; 6347 } 6348 } 6349 if (control->end_added) { 6350 out_flags |= MSG_EOR; 6351 if ((control->do_not_ref_stcb == 0) && 6352 (control->stcb != NULL) && 6353 ((control->spec_flags & M_NOTIFICATION) == 0)) 6354 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0; 6355 } 6356 if (control->spec_flags & M_NOTIFICATION) { 6357 out_flags |= MSG_NOTIFICATION; 6358 } 6359 uio->uio_resid = control->length; 6360 *mp = control->data; 6361 m = control->data; 6362 while (m) { 6363 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6364 sctp_sblog(&so->so_rcv, 6365 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m)); 6366 } 6367 sctp_sbfree(control, stcb, &so->so_rcv, m); 6368 freed_so_far += (uint32_t)SCTP_BUF_LEN(m); 6369 freed_so_far += MSIZE; 6370 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) { 6371 sctp_sblog(&so->so_rcv, 6372 control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0); 6373 } 6374 m = SCTP_BUF_NEXT(m); 6375 } 6376 control->data = control->tail_mbuf = NULL; 6377 control->length = 0; 6378 if (out_flags & MSG_EOR) { 6379 /* Done with this control */ 6380 goto done_with_control; 6381 } 6382 } 6383 release: 6384 if (hold_rlock == 1) { 6385 SCTP_INP_READ_UNLOCK(inp); 6386 hold_rlock = 0; 6387 } 6388 if (hold_sblock == 1) { 6389 SOCKBUF_UNLOCK(&so->so_rcv); 6390 hold_sblock = 0; 6391 } 6392 6393 SOCK_IO_RECV_UNLOCK(so); 6394 sockbuf_lock = 0; 6395 6396 release_unlocked: 6397 if (hold_sblock) { 6398 SOCKBUF_UNLOCK(&so->so_rcv); 6399 hold_sblock = 0; 6400 } 6401 if ((stcb) && (in_flags & MSG_PEEK) == 0) { 6402 if ((freed_so_far >= rwnd_req) && 6403 (control && (control->do_not_ref_stcb == 0)) && 6404 (no_rcv_needed == 0)) 6405 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req); 6406 } 6407 out: 6408 if (msg_flags) { 6409 *msg_flags = out_flags; 6410 } 6411 if (((out_flags & MSG_EOR) == 0) && 6412 ((in_flags & MSG_PEEK) == 0) && 6413 (sinfo) && 6414 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) || 6415 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) { 6416 struct sctp_extrcvinfo *s_extra; 6417 6418 s_extra = (struct sctp_extrcvinfo *)sinfo; 6419 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG; 6420 } 6421 if (hold_rlock == 1) { 6422 SCTP_INP_READ_UNLOCK(inp); 6423 } 6424 if (hold_sblock) { 6425 SOCKBUF_UNLOCK(&so->so_rcv); 6426 } 6427 if (sockbuf_lock) { 6428 SOCK_IO_RECV_UNLOCK(so); 6429 } 6430 6431 if (freecnt_applied) { 6432 /* 6433 * The lock on the socket buffer protects us so the free 6434 * code will stop. But since we used the socketbuf lock and 6435 * the sender uses the tcb_lock to increment, we need to use 6436 * the atomic add to the refcnt. 6437 */ 6438 if (stcb == NULL) { 6439 #ifdef INVARIANTS 6440 panic("stcb for refcnt has gone NULL?"); 6441 goto stage_left; 6442 #else 6443 goto stage_left; 6444 #endif 6445 } 6446 /* Save the value back for next time */ 6447 stcb->freed_by_sorcv_sincelast = freed_so_far; 6448 atomic_subtract_int(&stcb->asoc.refcnt, 1); 6449 } 6450 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) { 6451 if (stcb) { 6452 sctp_misc_ints(SCTP_SORECV_DONE, 6453 freed_so_far, 6454 (uint32_t)((uio) ? (slen - uio->uio_resid) : slen), 6455 stcb->asoc.my_rwnd, 6456 so->so_rcv.sb_cc); 6457 } else { 6458 sctp_misc_ints(SCTP_SORECV_DONE, 6459 freed_so_far, 6460 (uint32_t)((uio) ? (slen - uio->uio_resid) : slen), 6461 0, 6462 so->so_rcv.sb_cc); 6463 } 6464 } 6465 stage_left: 6466 if (wakeup_read_socket) { 6467 sctp_sorwakeup(inp, so); 6468 } 6469 return (error); 6470 } 6471 6472 #ifdef SCTP_MBUF_LOGGING 6473 struct mbuf * 6474 sctp_m_free(struct mbuf *m) 6475 { 6476 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6477 sctp_log_mb(m, SCTP_MBUF_IFREE); 6478 } 6479 return (m_free(m)); 6480 } 6481 6482 void 6483 sctp_m_freem(struct mbuf *mb) 6484 { 6485 while (mb != NULL) 6486 mb = sctp_m_free(mb); 6487 } 6488 6489 #endif 6490 6491 int 6492 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id) 6493 { 6494 /* 6495 * Given a local address. For all associations that holds the 6496 * address, request a peer-set-primary. 6497 */ 6498 struct sctp_ifa *ifa; 6499 struct sctp_laddr *wi; 6500 6501 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED); 6502 if (ifa == NULL) { 6503 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL); 6504 return (EADDRNOTAVAIL); 6505 } 6506 /* 6507 * Now that we have the ifa we must awaken the iterator with this 6508 * message. 6509 */ 6510 wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr); 6511 if (wi == NULL) { 6512 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM); 6513 return (ENOMEM); 6514 } 6515 /* Now incr the count and int wi structure */ 6516 SCTP_INCR_LADDR_COUNT(); 6517 memset(wi, 0, sizeof(*wi)); 6518 (void)SCTP_GETTIME_TIMEVAL(&wi->start_time); 6519 wi->ifa = ifa; 6520 wi->action = SCTP_SET_PRIM_ADDR; 6521 atomic_add_int(&ifa->refcount, 1); 6522 6523 /* Now add it to the work queue */ 6524 SCTP_WQ_ADDR_LOCK(); 6525 /* 6526 * Should this really be a tailq? As it is we will process the 6527 * newest first :-0 6528 */ 6529 LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr); 6530 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ, 6531 (struct sctp_inpcb *)NULL, 6532 (struct sctp_tcb *)NULL, 6533 (struct sctp_nets *)NULL); 6534 SCTP_WQ_ADDR_UNLOCK(); 6535 return (0); 6536 } 6537 6538 int 6539 sctp_soreceive(struct socket *so, 6540 struct sockaddr **psa, 6541 struct uio *uio, 6542 struct mbuf **mp0, 6543 struct mbuf **controlp, 6544 int *flagsp) 6545 { 6546 int error, fromlen; 6547 uint8_t sockbuf[256]; 6548 struct sockaddr *from; 6549 struct sctp_extrcvinfo sinfo; 6550 int filling_sinfo = 1; 6551 int flags; 6552 struct sctp_inpcb *inp; 6553 6554 inp = (struct sctp_inpcb *)so->so_pcb; 6555 /* pickup the assoc we are reading from */ 6556 if (inp == NULL) { 6557 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6558 return (EINVAL); 6559 } 6560 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) && 6561 sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) && 6562 sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) || 6563 (controlp == NULL)) { 6564 /* user does not want the sndrcv ctl */ 6565 filling_sinfo = 0; 6566 } 6567 if (psa) { 6568 from = (struct sockaddr *)sockbuf; 6569 fromlen = sizeof(sockbuf); 6570 from->sa_len = 0; 6571 } else { 6572 from = NULL; 6573 fromlen = 0; 6574 } 6575 6576 if (filling_sinfo) { 6577 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo)); 6578 } 6579 if (flagsp != NULL) { 6580 flags = *flagsp; 6581 } else { 6582 flags = 0; 6583 } 6584 error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, &flags, 6585 (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo); 6586 if (flagsp != NULL) { 6587 *flagsp = flags; 6588 } 6589 if (controlp != NULL) { 6590 /* copy back the sinfo in a CMSG format */ 6591 if (filling_sinfo && ((flags & MSG_NOTIFICATION) == 0)) { 6592 *controlp = sctp_build_ctl_nchunk(inp, 6593 (struct sctp_sndrcvinfo *)&sinfo); 6594 } else { 6595 *controlp = NULL; 6596 } 6597 } 6598 if (psa) { 6599 /* copy back the address info */ 6600 if (from && from->sa_len) { 6601 *psa = sodupsockaddr(from, M_NOWAIT); 6602 } else { 6603 *psa = NULL; 6604 } 6605 } 6606 return (error); 6607 } 6608 6609 int 6610 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr, 6611 int totaddr, int *error) 6612 { 6613 int added = 0; 6614 int i; 6615 struct sctp_inpcb *inp; 6616 struct sockaddr *sa; 6617 size_t incr = 0; 6618 #ifdef INET 6619 struct sockaddr_in *sin; 6620 #endif 6621 #ifdef INET6 6622 struct sockaddr_in6 *sin6; 6623 #endif 6624 6625 sa = addr; 6626 inp = stcb->sctp_ep; 6627 *error = 0; 6628 for (i = 0; i < totaddr; i++) { 6629 switch (sa->sa_family) { 6630 #ifdef INET 6631 case AF_INET: 6632 incr = sizeof(struct sockaddr_in); 6633 sin = (struct sockaddr_in *)sa; 6634 if ((sin->sin_addr.s_addr == INADDR_ANY) || 6635 (sin->sin_addr.s_addr == INADDR_BROADCAST) || 6636 IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) { 6637 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6638 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 6639 SCTP_FROM_SCTPUTIL + SCTP_LOC_7); 6640 *error = EINVAL; 6641 goto out_now; 6642 } 6643 if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port, 6644 SCTP_DONOT_SETSCOPE, 6645 SCTP_ADDR_IS_CONFIRMED)) { 6646 /* assoc gone no un-lock */ 6647 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS); 6648 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 6649 SCTP_FROM_SCTPUTIL + SCTP_LOC_8); 6650 *error = ENOBUFS; 6651 goto out_now; 6652 } 6653 added++; 6654 break; 6655 #endif 6656 #ifdef INET6 6657 case AF_INET6: 6658 incr = sizeof(struct sockaddr_in6); 6659 sin6 = (struct sockaddr_in6 *)sa; 6660 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) || 6661 IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) { 6662 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6663 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 6664 SCTP_FROM_SCTPUTIL + SCTP_LOC_9); 6665 *error = EINVAL; 6666 goto out_now; 6667 } 6668 if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port, 6669 SCTP_DONOT_SETSCOPE, 6670 SCTP_ADDR_IS_CONFIRMED)) { 6671 /* assoc gone no un-lock */ 6672 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS); 6673 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, 6674 SCTP_FROM_SCTPUTIL + SCTP_LOC_10); 6675 *error = ENOBUFS; 6676 goto out_now; 6677 } 6678 added++; 6679 break; 6680 #endif 6681 default: 6682 break; 6683 } 6684 sa = (struct sockaddr *)((caddr_t)sa + incr); 6685 } 6686 out_now: 6687 return (added); 6688 } 6689 6690 int 6691 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr, 6692 unsigned int totaddr, 6693 unsigned int *num_v4, unsigned int *num_v6, 6694 unsigned int limit) 6695 { 6696 struct sockaddr *sa; 6697 struct sctp_tcb *stcb; 6698 unsigned int incr, at, i; 6699 6700 at = 0; 6701 sa = addr; 6702 *num_v6 = *num_v4 = 0; 6703 /* account and validate addresses */ 6704 if (totaddr == 0) { 6705 return (EINVAL); 6706 } 6707 for (i = 0; i < totaddr; i++) { 6708 if (at + sizeof(struct sockaddr) > limit) { 6709 return (EINVAL); 6710 } 6711 switch (sa->sa_family) { 6712 #ifdef INET 6713 case AF_INET: 6714 incr = (unsigned int)sizeof(struct sockaddr_in); 6715 if (sa->sa_len != incr) { 6716 return (EINVAL); 6717 } 6718 (*num_v4) += 1; 6719 break; 6720 #endif 6721 #ifdef INET6 6722 case AF_INET6: 6723 { 6724 struct sockaddr_in6 *sin6; 6725 6726 incr = (unsigned int)sizeof(struct sockaddr_in6); 6727 if (sa->sa_len != incr) { 6728 return (EINVAL); 6729 } 6730 sin6 = (struct sockaddr_in6 *)sa; 6731 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6732 /* Must be non-mapped for connectx */ 6733 return (EINVAL); 6734 } 6735 (*num_v6) += 1; 6736 break; 6737 } 6738 #endif 6739 default: 6740 return (EINVAL); 6741 } 6742 if ((at + incr) > limit) { 6743 return (EINVAL); 6744 } 6745 SCTP_INP_INCR_REF(inp); 6746 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL); 6747 if (stcb != NULL) { 6748 SCTP_TCB_UNLOCK(stcb); 6749 return (EALREADY); 6750 } else { 6751 SCTP_INP_DECR_REF(inp); 6752 } 6753 at += incr; 6754 sa = (struct sockaddr *)((caddr_t)sa + incr); 6755 } 6756 return (0); 6757 } 6758 6759 /* 6760 * sctp_bindx(ADD) for one address. 6761 * assumes all arguments are valid/checked by caller. 6762 */ 6763 void 6764 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp, 6765 struct sockaddr *sa, uint32_t vrf_id, int *error, 6766 void *p) 6767 { 6768 #if defined(INET) && defined(INET6) 6769 struct sockaddr_in sin; 6770 #endif 6771 #ifdef INET6 6772 struct sockaddr_in6 *sin6; 6773 #endif 6774 #ifdef INET 6775 struct sockaddr_in *sinp; 6776 #endif 6777 struct sockaddr *addr_to_use; 6778 struct sctp_inpcb *lep; 6779 uint16_t port; 6780 6781 /* see if we're bound all already! */ 6782 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 6783 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6784 *error = EINVAL; 6785 return; 6786 } 6787 switch (sa->sa_family) { 6788 #ifdef INET6 6789 case AF_INET6: 6790 if (sa->sa_len != sizeof(struct sockaddr_in6)) { 6791 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6792 *error = EINVAL; 6793 return; 6794 } 6795 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) { 6796 /* can only bind v6 on PF_INET6 sockets */ 6797 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6798 *error = EINVAL; 6799 return; 6800 } 6801 sin6 = (struct sockaddr_in6 *)sa; 6802 port = sin6->sin6_port; 6803 #ifdef INET 6804 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6805 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6806 SCTP_IPV6_V6ONLY(inp)) { 6807 /* can't bind v4-mapped on PF_INET sockets */ 6808 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6809 *error = EINVAL; 6810 return; 6811 } 6812 in6_sin6_2_sin(&sin, sin6); 6813 addr_to_use = (struct sockaddr *)&sin; 6814 } else { 6815 addr_to_use = sa; 6816 } 6817 #else 6818 addr_to_use = sa; 6819 #endif 6820 break; 6821 #endif 6822 #ifdef INET 6823 case AF_INET: 6824 if (sa->sa_len != sizeof(struct sockaddr_in)) { 6825 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6826 *error = EINVAL; 6827 return; 6828 } 6829 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6830 SCTP_IPV6_V6ONLY(inp)) { 6831 /* can't bind v4 on PF_INET sockets */ 6832 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6833 *error = EINVAL; 6834 return; 6835 } 6836 sinp = (struct sockaddr_in *)sa; 6837 port = sinp->sin_port; 6838 addr_to_use = sa; 6839 break; 6840 #endif 6841 default: 6842 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6843 *error = EINVAL; 6844 return; 6845 } 6846 if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) { 6847 if (p == NULL) { 6848 /* Can't get proc for Net/Open BSD */ 6849 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6850 *error = EINVAL; 6851 return; 6852 } 6853 *error = sctp_inpcb_bind(so, addr_to_use, NULL, p); 6854 return; 6855 } 6856 /* Validate the incoming port. */ 6857 if ((port != 0) && (port != inp->sctp_lport)) { 6858 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6859 *error = EINVAL; 6860 return; 6861 } 6862 lep = sctp_pcb_findep(addr_to_use, 1, 0, vrf_id); 6863 if (lep == NULL) { 6864 /* add the address */ 6865 *error = sctp_addr_mgmt_ep_sa(inp, addr_to_use, 6866 SCTP_ADD_IP_ADDRESS, vrf_id); 6867 } else { 6868 if (lep != inp) { 6869 *error = EADDRINUSE; 6870 } 6871 SCTP_INP_DECR_REF(lep); 6872 } 6873 } 6874 6875 /* 6876 * sctp_bindx(DELETE) for one address. 6877 * assumes all arguments are valid/checked by caller. 6878 */ 6879 void 6880 sctp_bindx_delete_address(struct sctp_inpcb *inp, 6881 struct sockaddr *sa, uint32_t vrf_id, int *error) 6882 { 6883 struct sockaddr *addr_to_use; 6884 #if defined(INET) && defined(INET6) 6885 struct sockaddr_in6 *sin6; 6886 struct sockaddr_in sin; 6887 #endif 6888 6889 /* see if we're bound all already! */ 6890 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 6891 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6892 *error = EINVAL; 6893 return; 6894 } 6895 switch (sa->sa_family) { 6896 #ifdef INET6 6897 case AF_INET6: 6898 if (sa->sa_len != sizeof(struct sockaddr_in6)) { 6899 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6900 *error = EINVAL; 6901 return; 6902 } 6903 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) { 6904 /* can only bind v6 on PF_INET6 sockets */ 6905 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6906 *error = EINVAL; 6907 return; 6908 } 6909 #ifdef INET 6910 sin6 = (struct sockaddr_in6 *)sa; 6911 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6912 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6913 SCTP_IPV6_V6ONLY(inp)) { 6914 /* can't bind mapped-v4 on PF_INET sockets */ 6915 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6916 *error = EINVAL; 6917 return; 6918 } 6919 in6_sin6_2_sin(&sin, sin6); 6920 addr_to_use = (struct sockaddr *)&sin; 6921 } else { 6922 addr_to_use = sa; 6923 } 6924 #else 6925 addr_to_use = sa; 6926 #endif 6927 break; 6928 #endif 6929 #ifdef INET 6930 case AF_INET: 6931 if (sa->sa_len != sizeof(struct sockaddr_in)) { 6932 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6933 *error = EINVAL; 6934 return; 6935 } 6936 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 6937 SCTP_IPV6_V6ONLY(inp)) { 6938 /* can't bind v4 on PF_INET sockets */ 6939 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6940 *error = EINVAL; 6941 return; 6942 } 6943 addr_to_use = sa; 6944 break; 6945 #endif 6946 default: 6947 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL); 6948 *error = EINVAL; 6949 return; 6950 } 6951 /* No lock required mgmt_ep_sa does its own locking. */ 6952 *error = sctp_addr_mgmt_ep_sa(inp, addr_to_use, SCTP_DEL_IP_ADDRESS, 6953 vrf_id); 6954 } 6955 6956 /* 6957 * returns the valid local address count for an assoc, taking into account 6958 * all scoping rules 6959 */ 6960 int 6961 sctp_local_addr_count(struct sctp_tcb *stcb) 6962 { 6963 int loopback_scope; 6964 #if defined(INET) 6965 int ipv4_local_scope, ipv4_addr_legal; 6966 #endif 6967 #if defined(INET6) 6968 int local_scope, site_scope, ipv6_addr_legal; 6969 #endif 6970 struct sctp_vrf *vrf; 6971 struct sctp_ifn *sctp_ifn; 6972 struct sctp_ifa *sctp_ifa; 6973 int count = 0; 6974 6975 /* Turn on all the appropriate scopes */ 6976 loopback_scope = stcb->asoc.scope.loopback_scope; 6977 #if defined(INET) 6978 ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope; 6979 ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal; 6980 #endif 6981 #if defined(INET6) 6982 local_scope = stcb->asoc.scope.local_scope; 6983 site_scope = stcb->asoc.scope.site_scope; 6984 ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal; 6985 #endif 6986 SCTP_IPI_ADDR_RLOCK(); 6987 vrf = sctp_find_vrf(stcb->asoc.vrf_id); 6988 if (vrf == NULL) { 6989 /* no vrf, no addresses */ 6990 SCTP_IPI_ADDR_RUNLOCK(); 6991 return (0); 6992 } 6993 6994 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 6995 /* 6996 * bound all case: go through all ifns on the vrf 6997 */ 6998 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 6999 if ((loopback_scope == 0) && 7000 SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 7001 continue; 7002 } 7003 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 7004 if (sctp_is_addr_restricted(stcb, sctp_ifa)) 7005 continue; 7006 switch (sctp_ifa->address.sa.sa_family) { 7007 #ifdef INET 7008 case AF_INET: 7009 if (ipv4_addr_legal) { 7010 struct sockaddr_in *sin; 7011 7012 sin = &sctp_ifa->address.sin; 7013 if (sin->sin_addr.s_addr == 0) { 7014 /* 7015 * skip unspecified 7016 * addrs 7017 */ 7018 continue; 7019 } 7020 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred, 7021 &sin->sin_addr) != 0) { 7022 continue; 7023 } 7024 if ((ipv4_local_scope == 0) && 7025 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 7026 continue; 7027 } 7028 /* count this one */ 7029 count++; 7030 } else { 7031 continue; 7032 } 7033 break; 7034 #endif 7035 #ifdef INET6 7036 case AF_INET6: 7037 if (ipv6_addr_legal) { 7038 struct sockaddr_in6 *sin6; 7039 7040 sin6 = &sctp_ifa->address.sin6; 7041 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 7042 continue; 7043 } 7044 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred, 7045 &sin6->sin6_addr) != 0) { 7046 continue; 7047 } 7048 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 7049 if (local_scope == 0) 7050 continue; 7051 if (sin6->sin6_scope_id == 0) { 7052 if (sa6_recoverscope(sin6) != 0) 7053 /* 7054 * 7055 * bad 7056 * link 7057 * 7058 * local 7059 * 7060 * address 7061 */ 7062 continue; 7063 } 7064 } 7065 if ((site_scope == 0) && 7066 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 7067 continue; 7068 } 7069 /* count this one */ 7070 count++; 7071 } 7072 break; 7073 #endif 7074 default: 7075 /* TSNH */ 7076 break; 7077 } 7078 } 7079 } 7080 } else { 7081 /* 7082 * subset bound case 7083 */ 7084 struct sctp_laddr *laddr; 7085 7086 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, 7087 sctp_nxt_addr) { 7088 if (sctp_is_addr_restricted(stcb, laddr->ifa)) { 7089 continue; 7090 } 7091 /* count this one */ 7092 count++; 7093 } 7094 } 7095 SCTP_IPI_ADDR_RUNLOCK(); 7096 return (count); 7097 } 7098 7099 #if defined(SCTP_LOCAL_TRACE_BUF) 7100 7101 void 7102 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f) 7103 { 7104 uint32_t saveindex, newindex; 7105 7106 do { 7107 saveindex = SCTP_BASE_SYSCTL(sctp_log).index; 7108 if (saveindex >= SCTP_MAX_LOGGING_SIZE) { 7109 newindex = 1; 7110 } else { 7111 newindex = saveindex + 1; 7112 } 7113 } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0); 7114 if (saveindex >= SCTP_MAX_LOGGING_SIZE) { 7115 saveindex = 0; 7116 } 7117 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT; 7118 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys; 7119 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a; 7120 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b; 7121 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c; 7122 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d; 7123 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e; 7124 SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f; 7125 } 7126 7127 #endif 7128 static void 7129 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp, 7130 const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED) 7131 { 7132 struct ip *iph; 7133 #ifdef INET6 7134 struct ip6_hdr *ip6; 7135 #endif 7136 struct mbuf *sp, *last; 7137 struct udphdr *uhdr; 7138 uint16_t port; 7139 7140 if ((m->m_flags & M_PKTHDR) == 0) { 7141 /* Can't handle one that is not a pkt hdr */ 7142 goto out; 7143 } 7144 /* Pull the src port */ 7145 iph = mtod(m, struct ip *); 7146 uhdr = (struct udphdr *)((caddr_t)iph + off); 7147 port = uhdr->uh_sport; 7148 /* 7149 * Split out the mbuf chain. Leave the IP header in m, place the 7150 * rest in the sp. 7151 */ 7152 sp = m_split(m, off, M_NOWAIT); 7153 if (sp == NULL) { 7154 /* Gak, drop packet, we can't do a split */ 7155 goto out; 7156 } 7157 if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) { 7158 /* Gak, packet can't have an SCTP header in it - too small */ 7159 m_freem(sp); 7160 goto out; 7161 } 7162 /* Now pull up the UDP header and SCTP header together */ 7163 sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr)); 7164 if (sp == NULL) { 7165 /* Gak pullup failed */ 7166 goto out; 7167 } 7168 /* Trim out the UDP header */ 7169 m_adj(sp, sizeof(struct udphdr)); 7170 7171 /* Now reconstruct the mbuf chain */ 7172 for (last = m; last->m_next; last = last->m_next); 7173 last->m_next = sp; 7174 m->m_pkthdr.len += sp->m_pkthdr.len; 7175 /* 7176 * The CSUM_DATA_VALID flags indicates that the HW checked the UDP 7177 * checksum and it was valid. Since CSUM_DATA_VALID == 7178 * CSUM_SCTP_VALID this would imply that the HW also verified the 7179 * SCTP checksum. Therefore, clear the bit. 7180 */ 7181 SCTPDBG(SCTP_DEBUG_CRCOFFLOAD, 7182 "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n", 7183 m->m_pkthdr.len, 7184 if_name(m->m_pkthdr.rcvif), 7185 (int)m->m_pkthdr.csum_flags, CSUM_BITS); 7186 m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID; 7187 iph = mtod(m, struct ip *); 7188 switch (iph->ip_v) { 7189 #ifdef INET 7190 case IPVERSION: 7191 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr)); 7192 sctp_input_with_port(m, off, port); 7193 break; 7194 #endif 7195 #ifdef INET6 7196 case IPV6_VERSION >> 4: 7197 ip6 = mtod(m, struct ip6_hdr *); 7198 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr)); 7199 sctp6_input_with_port(&m, &off, port); 7200 break; 7201 #endif 7202 default: 7203 goto out; 7204 break; 7205 } 7206 return; 7207 out: 7208 m_freem(m); 7209 } 7210 7211 #ifdef INET 7212 static void 7213 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED) 7214 { 7215 struct ip *outer_ip, *inner_ip; 7216 struct sctphdr *sh; 7217 struct icmp *icmp; 7218 struct udphdr *udp; 7219 struct sctp_inpcb *inp; 7220 struct sctp_tcb *stcb; 7221 struct sctp_nets *net; 7222 struct sctp_init_chunk *ch; 7223 struct sockaddr_in src, dst; 7224 uint8_t type, code; 7225 7226 inner_ip = (struct ip *)vip; 7227 icmp = (struct icmp *)((caddr_t)inner_ip - 7228 (sizeof(struct icmp) - sizeof(struct ip))); 7229 outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip)); 7230 if (ntohs(outer_ip->ip_len) < 7231 sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) { 7232 return; 7233 } 7234 udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2)); 7235 sh = (struct sctphdr *)(udp + 1); 7236 memset(&src, 0, sizeof(struct sockaddr_in)); 7237 src.sin_family = AF_INET; 7238 src.sin_len = sizeof(struct sockaddr_in); 7239 src.sin_port = sh->src_port; 7240 src.sin_addr = inner_ip->ip_src; 7241 memset(&dst, 0, sizeof(struct sockaddr_in)); 7242 dst.sin_family = AF_INET; 7243 dst.sin_len = sizeof(struct sockaddr_in); 7244 dst.sin_port = sh->dest_port; 7245 dst.sin_addr = inner_ip->ip_dst; 7246 /* 7247 * 'dst' holds the dest of the packet that failed to be sent. 'src' 7248 * holds our local endpoint address. Thus we reverse the dst and the 7249 * src in the lookup. 7250 */ 7251 inp = NULL; 7252 net = NULL; 7253 stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst, 7254 (struct sockaddr *)&src, 7255 &inp, &net, 1, 7256 SCTP_DEFAULT_VRFID); 7257 if ((stcb != NULL) && 7258 (net != NULL) && 7259 (inp != NULL)) { 7260 /* Check the UDP port numbers */ 7261 if ((udp->uh_dport != net->port) || 7262 (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) { 7263 SCTP_TCB_UNLOCK(stcb); 7264 return; 7265 } 7266 /* Check the verification tag */ 7267 if (ntohl(sh->v_tag) != 0) { 7268 /* 7269 * This must be the verification tag used for 7270 * sending out packets. We don't consider packets 7271 * reflecting the verification tag. 7272 */ 7273 if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) { 7274 SCTP_TCB_UNLOCK(stcb); 7275 return; 7276 } 7277 } else { 7278 if (ntohs(outer_ip->ip_len) >= 7279 sizeof(struct ip) + 7280 8 + (inner_ip->ip_hl << 2) + 8 + 20) { 7281 /* 7282 * In this case we can check if we got an 7283 * INIT chunk and if the initiate tag 7284 * matches. 7285 */ 7286 ch = (struct sctp_init_chunk *)(sh + 1); 7287 if ((ch->ch.chunk_type != SCTP_INITIATION) || 7288 (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) { 7289 SCTP_TCB_UNLOCK(stcb); 7290 return; 7291 } 7292 } else { 7293 SCTP_TCB_UNLOCK(stcb); 7294 return; 7295 } 7296 } 7297 type = icmp->icmp_type; 7298 code = icmp->icmp_code; 7299 if ((type == ICMP_UNREACH) && 7300 (code == ICMP_UNREACH_PORT)) { 7301 code = ICMP_UNREACH_PROTOCOL; 7302 } 7303 sctp_notify(inp, stcb, net, type, code, 7304 ntohs(inner_ip->ip_len), 7305 (uint32_t)ntohs(icmp->icmp_nextmtu)); 7306 } else { 7307 if ((stcb == NULL) && (inp != NULL)) { 7308 /* reduce ref-count */ 7309 SCTP_INP_WLOCK(inp); 7310 SCTP_INP_DECR_REF(inp); 7311 SCTP_INP_WUNLOCK(inp); 7312 } 7313 if (stcb) { 7314 SCTP_TCB_UNLOCK(stcb); 7315 } 7316 } 7317 return; 7318 } 7319 #endif 7320 7321 #ifdef INET6 7322 static void 7323 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED) 7324 { 7325 struct ip6ctlparam *ip6cp; 7326 struct sctp_inpcb *inp; 7327 struct sctp_tcb *stcb; 7328 struct sctp_nets *net; 7329 struct sctphdr sh; 7330 struct udphdr udp; 7331 struct sockaddr_in6 src, dst; 7332 uint8_t type, code; 7333 7334 ip6cp = (struct ip6ctlparam *)d; 7335 /* 7336 * XXX: We assume that when IPV6 is non NULL, M and OFF are valid. 7337 */ 7338 if (ip6cp->ip6c_m == NULL) { 7339 return; 7340 } 7341 /* 7342 * Check if we can safely examine the ports and the verification tag 7343 * of the SCTP common header. 7344 */ 7345 if (ip6cp->ip6c_m->m_pkthdr.len < 7346 ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) { 7347 return; 7348 } 7349 /* Copy out the UDP header. */ 7350 memset(&udp, 0, sizeof(struct udphdr)); 7351 m_copydata(ip6cp->ip6c_m, 7352 ip6cp->ip6c_off, 7353 sizeof(struct udphdr), 7354 (caddr_t)&udp); 7355 /* Copy out the port numbers and the verification tag. */ 7356 memset(&sh, 0, sizeof(struct sctphdr)); 7357 m_copydata(ip6cp->ip6c_m, 7358 ip6cp->ip6c_off + sizeof(struct udphdr), 7359 sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t), 7360 (caddr_t)&sh); 7361 memset(&src, 0, sizeof(struct sockaddr_in6)); 7362 src.sin6_family = AF_INET6; 7363 src.sin6_len = sizeof(struct sockaddr_in6); 7364 src.sin6_port = sh.src_port; 7365 src.sin6_addr = ip6cp->ip6c_ip6->ip6_src; 7366 if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) { 7367 return; 7368 } 7369 memset(&dst, 0, sizeof(struct sockaddr_in6)); 7370 dst.sin6_family = AF_INET6; 7371 dst.sin6_len = sizeof(struct sockaddr_in6); 7372 dst.sin6_port = sh.dest_port; 7373 dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst; 7374 if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) { 7375 return; 7376 } 7377 inp = NULL; 7378 net = NULL; 7379 stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst, 7380 (struct sockaddr *)&src, 7381 &inp, &net, 1, SCTP_DEFAULT_VRFID); 7382 if ((stcb != NULL) && 7383 (net != NULL) && 7384 (inp != NULL)) { 7385 /* Check the UDP port numbers */ 7386 if ((udp.uh_dport != net->port) || 7387 (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) { 7388 SCTP_TCB_UNLOCK(stcb); 7389 return; 7390 } 7391 /* Check the verification tag */ 7392 if (ntohl(sh.v_tag) != 0) { 7393 /* 7394 * This must be the verification tag used for 7395 * sending out packets. We don't consider packets 7396 * reflecting the verification tag. 7397 */ 7398 if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) { 7399 SCTP_TCB_UNLOCK(stcb); 7400 return; 7401 } 7402 } else { 7403 if (ip6cp->ip6c_m->m_pkthdr.len >= 7404 ip6cp->ip6c_off + sizeof(struct udphdr) + 7405 sizeof(struct sctphdr) + 7406 sizeof(struct sctp_chunkhdr) + 7407 offsetof(struct sctp_init, a_rwnd)) { 7408 /* 7409 * In this case we can check if we got an 7410 * INIT chunk and if the initiate tag 7411 * matches. 7412 */ 7413 uint32_t initiate_tag; 7414 uint8_t chunk_type; 7415 7416 m_copydata(ip6cp->ip6c_m, 7417 ip6cp->ip6c_off + 7418 sizeof(struct udphdr) + 7419 sizeof(struct sctphdr), 7420 sizeof(uint8_t), 7421 (caddr_t)&chunk_type); 7422 m_copydata(ip6cp->ip6c_m, 7423 ip6cp->ip6c_off + 7424 sizeof(struct udphdr) + 7425 sizeof(struct sctphdr) + 7426 sizeof(struct sctp_chunkhdr), 7427 sizeof(uint32_t), 7428 (caddr_t)&initiate_tag); 7429 if ((chunk_type != SCTP_INITIATION) || 7430 (ntohl(initiate_tag) != stcb->asoc.my_vtag)) { 7431 SCTP_TCB_UNLOCK(stcb); 7432 return; 7433 } 7434 } else { 7435 SCTP_TCB_UNLOCK(stcb); 7436 return; 7437 } 7438 } 7439 type = ip6cp->ip6c_icmp6->icmp6_type; 7440 code = ip6cp->ip6c_icmp6->icmp6_code; 7441 if ((type == ICMP6_DST_UNREACH) && 7442 (code == ICMP6_DST_UNREACH_NOPORT)) { 7443 type = ICMP6_PARAM_PROB; 7444 code = ICMP6_PARAMPROB_NEXTHEADER; 7445 } 7446 sctp6_notify(inp, stcb, net, type, code, 7447 ntohl(ip6cp->ip6c_icmp6->icmp6_mtu)); 7448 } else { 7449 if ((stcb == NULL) && (inp != NULL)) { 7450 /* reduce inp's ref-count */ 7451 SCTP_INP_WLOCK(inp); 7452 SCTP_INP_DECR_REF(inp); 7453 SCTP_INP_WUNLOCK(inp); 7454 } 7455 if (stcb) { 7456 SCTP_TCB_UNLOCK(stcb); 7457 } 7458 } 7459 } 7460 #endif 7461 7462 void 7463 sctp_over_udp_stop(void) 7464 { 7465 /* 7466 * This function assumes sysctl caller holds sctp_sysctl_info_lock() 7467 * for writing! 7468 */ 7469 #ifdef INET 7470 if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) { 7471 soclose(SCTP_BASE_INFO(udp4_tun_socket)); 7472 SCTP_BASE_INFO(udp4_tun_socket) = NULL; 7473 } 7474 #endif 7475 #ifdef INET6 7476 if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) { 7477 soclose(SCTP_BASE_INFO(udp6_tun_socket)); 7478 SCTP_BASE_INFO(udp6_tun_socket) = NULL; 7479 } 7480 #endif 7481 } 7482 7483 int 7484 sctp_over_udp_start(void) 7485 { 7486 uint16_t port; 7487 int ret; 7488 #ifdef INET 7489 struct sockaddr_in sin; 7490 #endif 7491 #ifdef INET6 7492 struct sockaddr_in6 sin6; 7493 #endif 7494 /* 7495 * This function assumes sysctl caller holds sctp_sysctl_info_lock() 7496 * for writing! 7497 */ 7498 port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port); 7499 if (ntohs(port) == 0) { 7500 /* Must have a port set */ 7501 return (EINVAL); 7502 } 7503 #ifdef INET 7504 if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) { 7505 /* Already running -- must stop first */ 7506 return (EALREADY); 7507 } 7508 #endif 7509 #ifdef INET6 7510 if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) { 7511 /* Already running -- must stop first */ 7512 return (EALREADY); 7513 } 7514 #endif 7515 #ifdef INET 7516 if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket), 7517 SOCK_DGRAM, IPPROTO_UDP, 7518 curthread->td_ucred, curthread))) { 7519 sctp_over_udp_stop(); 7520 return (ret); 7521 } 7522 /* Call the special UDP hook. */ 7523 if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket), 7524 sctp_recv_udp_tunneled_packet, 7525 sctp_recv_icmp_tunneled_packet, 7526 NULL))) { 7527 sctp_over_udp_stop(); 7528 return (ret); 7529 } 7530 /* Ok, we have a socket, bind it to the port. */ 7531 memset(&sin, 0, sizeof(struct sockaddr_in)); 7532 sin.sin_len = sizeof(struct sockaddr_in); 7533 sin.sin_family = AF_INET; 7534 sin.sin_port = htons(port); 7535 if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket), 7536 (struct sockaddr *)&sin, curthread))) { 7537 sctp_over_udp_stop(); 7538 return (ret); 7539 } 7540 #endif 7541 #ifdef INET6 7542 if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket), 7543 SOCK_DGRAM, IPPROTO_UDP, 7544 curthread->td_ucred, curthread))) { 7545 sctp_over_udp_stop(); 7546 return (ret); 7547 } 7548 /* Call the special UDP hook. */ 7549 if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket), 7550 sctp_recv_udp_tunneled_packet, 7551 sctp_recv_icmp6_tunneled_packet, 7552 NULL))) { 7553 sctp_over_udp_stop(); 7554 return (ret); 7555 } 7556 /* Ok, we have a socket, bind it to the port. */ 7557 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 7558 sin6.sin6_len = sizeof(struct sockaddr_in6); 7559 sin6.sin6_family = AF_INET6; 7560 sin6.sin6_port = htons(port); 7561 if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket), 7562 (struct sockaddr *)&sin6, curthread))) { 7563 sctp_over_udp_stop(); 7564 return (ret); 7565 } 7566 #endif 7567 return (0); 7568 } 7569 7570 /* 7571 * sctp_min_mtu ()returns the minimum of all non-zero arguments. 7572 * If all arguments are zero, zero is returned. 7573 */ 7574 uint32_t 7575 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3) 7576 { 7577 if (mtu1 > 0) { 7578 if (mtu2 > 0) { 7579 if (mtu3 > 0) { 7580 return (min(mtu1, min(mtu2, mtu3))); 7581 } else { 7582 return (min(mtu1, mtu2)); 7583 } 7584 } else { 7585 if (mtu3 > 0) { 7586 return (min(mtu1, mtu3)); 7587 } else { 7588 return (mtu1); 7589 } 7590 } 7591 } else { 7592 if (mtu2 > 0) { 7593 if (mtu3 > 0) { 7594 return (min(mtu2, mtu3)); 7595 } else { 7596 return (mtu2); 7597 } 7598 } else { 7599 return (mtu3); 7600 } 7601 } 7602 } 7603 7604 void 7605 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu) 7606 { 7607 struct in_conninfo inc; 7608 7609 memset(&inc, 0, sizeof(struct in_conninfo)); 7610 inc.inc_fibnum = fibnum; 7611 switch (addr->sa.sa_family) { 7612 #ifdef INET 7613 case AF_INET: 7614 inc.inc_faddr = addr->sin.sin_addr; 7615 break; 7616 #endif 7617 #ifdef INET6 7618 case AF_INET6: 7619 inc.inc_flags |= INC_ISIPV6; 7620 inc.inc6_faddr = addr->sin6.sin6_addr; 7621 break; 7622 #endif 7623 default: 7624 return; 7625 } 7626 tcp_hc_updatemtu(&inc, (u_long)mtu); 7627 } 7628 7629 uint32_t 7630 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum) 7631 { 7632 struct in_conninfo inc; 7633 7634 memset(&inc, 0, sizeof(struct in_conninfo)); 7635 inc.inc_fibnum = fibnum; 7636 switch (addr->sa.sa_family) { 7637 #ifdef INET 7638 case AF_INET: 7639 inc.inc_faddr = addr->sin.sin_addr; 7640 break; 7641 #endif 7642 #ifdef INET6 7643 case AF_INET6: 7644 inc.inc_flags |= INC_ISIPV6; 7645 inc.inc6_faddr = addr->sin6.sin6_addr; 7646 break; 7647 #endif 7648 default: 7649 return (0); 7650 } 7651 return ((uint32_t)tcp_hc_getmtu(&inc)); 7652 } 7653 7654 void 7655 sctp_set_state(struct sctp_tcb *stcb, int new_state) 7656 { 7657 #if defined(KDTRACE_HOOKS) 7658 int old_state = stcb->asoc.state; 7659 #endif 7660 7661 KASSERT((new_state & ~SCTP_STATE_MASK) == 0, 7662 ("sctp_set_state: Can't set substate (new_state = %x)", 7663 new_state)); 7664 stcb->asoc.state = (stcb->asoc.state & ~SCTP_STATE_MASK) | new_state; 7665 if ((new_state == SCTP_STATE_SHUTDOWN_RECEIVED) || 7666 (new_state == SCTP_STATE_SHUTDOWN_SENT) || 7667 (new_state == SCTP_STATE_SHUTDOWN_ACK_SENT)) { 7668 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 7669 } 7670 #if defined(KDTRACE_HOOKS) 7671 if (((old_state & SCTP_STATE_MASK) != new_state) && 7672 !(((old_state & SCTP_STATE_MASK) == SCTP_STATE_EMPTY) && 7673 (new_state == SCTP_STATE_INUSE))) { 7674 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state); 7675 } 7676 #endif 7677 } 7678 7679 void 7680 sctp_add_substate(struct sctp_tcb *stcb, int substate) 7681 { 7682 #if defined(KDTRACE_HOOKS) 7683 int old_state = stcb->asoc.state; 7684 #endif 7685 7686 KASSERT((substate & SCTP_STATE_MASK) == 0, 7687 ("sctp_add_substate: Can't set state (substate = %x)", 7688 substate)); 7689 stcb->asoc.state |= substate; 7690 #if defined(KDTRACE_HOOKS) 7691 if (((substate & SCTP_STATE_ABOUT_TO_BE_FREED) && 7692 ((old_state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) || 7693 ((substate & SCTP_STATE_SHUTDOWN_PENDING) && 7694 ((old_state & SCTP_STATE_SHUTDOWN_PENDING) == 0))) { 7695 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state); 7696 } 7697 #endif 7698 } 7699