1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #pragma ident "%Z%%M% %I% %E% SMI" 28 29 #include <sys/types.h> 30 #include <sys/systm.h> 31 #include <sys/stream.h> 32 #include <sys/cmn_err.h> 33 #include <sys/kmem.h> 34 #define _SUN_TPI_VERSION 2 35 #include <sys/tihdr.h> 36 #include <sys/socket.h> 37 #include <sys/strsun.h> 38 #include <sys/strsubr.h> 39 40 #include <netinet/in.h> 41 #include <netinet/ip6.h> 42 #include <netinet/tcp_seq.h> 43 #include <netinet/sctp.h> 44 45 #include <inet/common.h> 46 #include <inet/ip.h> 47 #include <inet/ip6.h> 48 #include <inet/mib2.h> 49 #include <inet/ipclassifier.h> 50 #include <inet/ipp_common.h> 51 #include <inet/ipsec_impl.h> 52 #include <inet/sctp_ip.h> 53 54 #include "sctp_impl.h" 55 #include "sctp_asconf.h" 56 #include "sctp_addr.h" 57 58 static struct kmem_cache *sctp_kmem_set_cache; 59 60 /* 61 * PR-SCTP comments. 62 * 63 * When we get a valid Forward TSN chunk, we check the fragment list for this 64 * SSN and preceeding SSNs free all them. Further, if this Forward TSN causes 65 * the next expected SSN to be present in the stream queue, we deliver any 66 * such stranded messages upstream. We also update the SACK info. appropriately. 67 * When checking for advancing the cumulative ack (in sctp_cumack()) we must 68 * check for abandoned chunks and messages. While traversing the tramsmit 69 * list if we come across an abandoned chunk, we can skip the message (i.e. 70 * take it out of the (re)transmit list) since this message, and hence this 71 * chunk, has been marked abandoned by sctp_rexmit(). If we come across an 72 * unsent chunk for a message this now abandoned we need to check if a 73 * Forward TSN needs to be sent, this could be a case where we deferred sending 74 * a Forward TSN in sctp_get_msg_to_send(). Further, after processing a 75 * SACK we check if the Advanced peer ack point can be moved ahead, i.e. 76 * if we can send a Forward TSN via sctp_check_abandoned_data(). 77 */ 78 void 79 sctp_free_set(sctp_set_t *s) 80 { 81 sctp_set_t *p; 82 83 while (s) { 84 p = s->next; 85 kmem_cache_free(sctp_kmem_set_cache, s); 86 s = p; 87 } 88 } 89 90 static void 91 sctp_ack_add(sctp_set_t **head, uint32_t tsn, int *num) 92 { 93 sctp_set_t *p, *t; 94 95 if (head == NULL || num == NULL) 96 return; 97 98 ASSERT(*num >= 0); 99 ASSERT((*num == 0 && *head == NULL) || (*num > 0 && *head != NULL)); 100 101 if (*head == NULL) { 102 *head = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP); 103 if (*head == NULL) 104 return; 105 (*head)->prev = (*head)->next = NULL; 106 (*head)->begin = tsn; 107 (*head)->end = tsn; 108 *num = 1; 109 return; 110 } 111 112 ASSERT((*head)->prev == NULL); 113 114 /* 115 * Handle this special case here so we don't have to check 116 * for it each time in the loop. 117 */ 118 if (SEQ_LT(tsn + 1, (*head)->begin)) { 119 /* add a new set, and move the head pointer */ 120 t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP); 121 if (t == NULL) 122 return; 123 t->next = *head; 124 t->prev = NULL; 125 (*head)->prev = t; 126 t->begin = tsn; 127 t->end = tsn; 128 (*num)++; 129 *head = t; 130 return; 131 } 132 133 /* 134 * We need to handle the following cases, where p points to 135 * the current set (as we walk through the loop): 136 * 137 * 1. tsn is entirely less than p; create a new set before p. 138 * 2. tsn borders p from less; coalesce p with tsn. 139 * 3. tsn is withing p; do nothing. 140 * 4. tsn borders p from greater; coalesce p with tsn. 141 * 4a. p may now border p->next from less; if so, coalesce those 142 * two sets. 143 * 5. tsn is entirely greater then all sets; add a new set at 144 * the end. 145 */ 146 for (p = *head; ; p = p->next) { 147 if (SEQ_LT(tsn + 1, p->begin)) { 148 /* 1: add a new set before p. */ 149 t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP); 150 if (t == NULL) 151 return; 152 t->next = p; 153 t->prev = NULL; 154 t->begin = tsn; 155 t->end = tsn; 156 if (p->prev) { 157 t->prev = p->prev; 158 p->prev->next = t; 159 } 160 p->prev = t; 161 (*num)++; 162 return; 163 } 164 165 if ((tsn + 1) == p->begin) { 166 /* 2: adjust p->begin */ 167 p->begin = tsn; 168 return; 169 } 170 171 if (SEQ_GEQ(tsn, p->begin) && SEQ_LEQ(tsn, p->end)) { 172 /* 3; do nothing */ 173 return; 174 } 175 176 if ((p->end + 1) == tsn) { 177 /* 4; adjust p->end */ 178 p->end = tsn; 179 180 if (p->next != NULL && (tsn + 1) == p->next->begin) { 181 /* 4a: coalesce p and p->next */ 182 t = p->next; 183 p->end = t->end; 184 p->next = t->next; 185 if (t->next != NULL) 186 t->next->prev = p; 187 kmem_cache_free(sctp_kmem_set_cache, t); 188 (*num)--; 189 } 190 return; 191 } 192 193 if (p->next == NULL) { 194 /* 5: add new set at the end */ 195 t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP); 196 if (t == NULL) 197 return; 198 t->next = NULL; 199 t->prev = p; 200 t->begin = tsn; 201 t->end = tsn; 202 p->next = t; 203 (*num)++; 204 return; 205 } 206 207 if (SEQ_GT(tsn, p->end + 1)) 208 continue; 209 } 210 } 211 212 static void 213 sctp_ack_rem(sctp_set_t **head, uint32_t end, int *num) 214 { 215 sctp_set_t *p, *t; 216 217 if (head == NULL || *head == NULL || num == NULL) 218 return; 219 220 /* Nothing to remove */ 221 if (SEQ_LT(end, (*head)->begin)) 222 return; 223 224 /* Find out where to start removing sets */ 225 for (p = *head; p->next; p = p->next) { 226 if (SEQ_LEQ(end, p->end)) 227 break; 228 } 229 230 if (SEQ_LT(end, p->end) && SEQ_GEQ(end, p->begin)) { 231 /* adjust p */ 232 p->begin = end + 1; 233 /* all done */ 234 if (p == *head) 235 return; 236 } else if (SEQ_GEQ(end, p->end)) { 237 /* remove this set too */ 238 p = p->next; 239 } 240 241 /* unlink everything before this set */ 242 t = *head; 243 *head = p; 244 if (p != NULL && p->prev != NULL) { 245 p->prev->next = NULL; 246 p->prev = NULL; 247 } 248 249 sctp_free_set(t); 250 251 /* recount the number of sets */ 252 *num = 0; 253 254 for (p = *head; p != NULL; p = p->next) 255 (*num)++; 256 } 257 258 void 259 sctp_sets_init() 260 { 261 sctp_kmem_set_cache = kmem_cache_create("sctp_set_cache", 262 sizeof (sctp_set_t), 0, NULL, NULL, NULL, NULL, 263 NULL, 0); 264 } 265 266 void 267 sctp_sets_fini() 268 { 269 kmem_cache_destroy(sctp_kmem_set_cache); 270 } 271 272 sctp_chunk_hdr_t * 273 sctp_first_chunk(uchar_t *rptr, ssize_t remaining) 274 { 275 sctp_chunk_hdr_t *ch; 276 uint16_t ch_len; 277 278 if (remaining < sizeof (*ch)) { 279 return (NULL); 280 } 281 282 ch = (sctp_chunk_hdr_t *)rptr; 283 ch_len = ntohs(ch->sch_len); 284 285 if (ch_len < sizeof (*ch) || remaining < ch_len) { 286 return (NULL); 287 } 288 289 return (ch); 290 } 291 292 sctp_chunk_hdr_t * 293 sctp_next_chunk(sctp_chunk_hdr_t *ch, ssize_t *remaining) 294 { 295 int pad; 296 uint16_t ch_len; 297 298 if (!ch) { 299 return (NULL); 300 } 301 302 ch_len = ntohs(ch->sch_len); 303 304 if ((pad = ch_len & (SCTP_ALIGN - 1)) != 0) { 305 pad = SCTP_ALIGN - pad; 306 } 307 308 *remaining -= (ch_len + pad); 309 ch = (sctp_chunk_hdr_t *)((char *)ch + ch_len + pad); 310 311 return (sctp_first_chunk((uchar_t *)ch, *remaining)); 312 } 313 314 /* 315 * Attach ancillary data to a received SCTP segments. 316 * If the source address (fp) is not the primary, send up a 317 * unitdata_ind so recvfrom() can populate the msg_name field. 318 * If ancillary data is also requested, we append it to the 319 * unitdata_req. Otherwise, we just send up an optdata_ind. 320 */ 321 static int 322 sctp_input_add_ancillary(sctp_t *sctp, mblk_t **mp, sctp_data_hdr_t *dcp, 323 sctp_faddr_t *fp, ip6_pkt_t *ipp) 324 { 325 struct T_unitdata_ind *tudi; 326 int optlen; 327 int hdrlen; 328 uchar_t *optptr; 329 struct cmsghdr *cmsg; 330 mblk_t *mp1; 331 struct sockaddr_in6 sin_buf[1]; 332 struct sockaddr_in6 *sin6; 333 struct sockaddr_in *sin4; 334 uint_t addflag = 0; 335 336 sin4 = NULL; 337 sin6 = NULL; 338 339 optlen = hdrlen = 0; 340 341 /* Figure out address size */ 342 if (sctp->sctp_ipversion == IPV4_VERSION) { 343 sin4 = (struct sockaddr_in *)sin_buf; 344 sin4->sin_family = AF_INET; 345 sin4->sin_port = sctp->sctp_fport; 346 IN6_V4MAPPED_TO_IPADDR(&fp->faddr, sin4->sin_addr.s_addr); 347 hdrlen = sizeof (*tudi) + sizeof (*sin4); 348 } else { 349 sin6 = sin_buf; 350 sin6->sin6_family = AF_INET6; 351 sin6->sin6_port = sctp->sctp_fport; 352 sin6->sin6_addr = fp->faddr; 353 hdrlen = sizeof (*tudi) + sizeof (*sin6); 354 } 355 356 /* If app asked to receive send / recv info */ 357 if (sctp->sctp_recvsndrcvinfo) { 358 optlen += sizeof (*cmsg) + sizeof (struct sctp_sndrcvinfo); 359 if (hdrlen == 0) 360 hdrlen = sizeof (struct T_optdata_ind); 361 } 362 363 if (sctp->sctp_ipv6_recvancillary == 0) 364 goto noancillary; 365 366 if ((ipp->ipp_fields & IPPF_IFINDEX) && 367 ipp->ipp_ifindex != sctp->sctp_recvifindex && 368 (sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVPKTINFO)) { 369 optlen += sizeof (*cmsg) + sizeof (struct in6_pktinfo); 370 if (hdrlen == 0) 371 hdrlen = sizeof (struct T_unitdata_ind); 372 addflag |= SCTP_IPV6_RECVPKTINFO; 373 } 374 /* If app asked for hoplimit and it has changed ... */ 375 if ((ipp->ipp_fields & IPPF_HOPLIMIT) && 376 ipp->ipp_hoplimit != sctp->sctp_recvhops && 377 (sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVHOPLIMIT)) { 378 optlen += sizeof (*cmsg) + sizeof (uint_t); 379 if (hdrlen == 0) 380 hdrlen = sizeof (struct T_unitdata_ind); 381 addflag |= SCTP_IPV6_RECVHOPLIMIT; 382 } 383 /* If app asked for hopbyhop headers and it has changed ... */ 384 if ((sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVHOPOPTS) && 385 ip_cmpbuf(sctp->sctp_hopopts, sctp->sctp_hopoptslen, 386 (ipp->ipp_fields & IPPF_HOPOPTS), 387 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) { 388 optlen += sizeof (*cmsg) + ipp->ipp_hopoptslen - 389 sctp->sctp_v6label_len; 390 if (hdrlen == 0) 391 hdrlen = sizeof (struct T_unitdata_ind); 392 addflag |= SCTP_IPV6_RECVHOPOPTS; 393 if (!ip_allocbuf((void **)&sctp->sctp_hopopts, 394 &sctp->sctp_hopoptslen, 395 (ipp->ipp_fields & IPPF_HOPOPTS), 396 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) 397 return (-1); 398 } 399 /* If app asked for dst headers before routing headers ... */ 400 if ((sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVRTDSTOPTS) && 401 ip_cmpbuf(sctp->sctp_rtdstopts, sctp->sctp_rtdstoptslen, 402 (ipp->ipp_fields & IPPF_RTDSTOPTS), 403 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) { 404 optlen += sizeof (*cmsg) + ipp->ipp_rtdstoptslen; 405 if (hdrlen == 0) 406 hdrlen = sizeof (struct T_unitdata_ind); 407 addflag |= SCTP_IPV6_RECVRTDSTOPTS; 408 if (!ip_allocbuf((void **)&sctp->sctp_rtdstopts, 409 &sctp->sctp_rtdstoptslen, 410 (ipp->ipp_fields & IPPF_RTDSTOPTS), 411 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) 412 return (-1); 413 } 414 /* If app asked for routing headers and it has changed ... */ 415 if (sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVRTHDR) { 416 if (ip_cmpbuf(sctp->sctp_rthdr, sctp->sctp_rthdrlen, 417 (ipp->ipp_fields & IPPF_RTHDR), 418 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) { 419 optlen += sizeof (*cmsg) + ipp->ipp_rthdrlen; 420 if (hdrlen == 0) 421 hdrlen = sizeof (struct T_unitdata_ind); 422 addflag |= SCTP_IPV6_RECVRTHDR; 423 if (!ip_allocbuf((void **)&sctp->sctp_rthdr, 424 &sctp->sctp_rthdrlen, 425 (ipp->ipp_fields & IPPF_RTHDR), 426 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) 427 return (-1); 428 } 429 } 430 /* If app asked for dest headers and it has changed ... */ 431 if ((sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVDSTOPTS) && 432 ip_cmpbuf(sctp->sctp_dstopts, sctp->sctp_dstoptslen, 433 (ipp->ipp_fields & IPPF_DSTOPTS), 434 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) { 435 optlen += sizeof (*cmsg) + ipp->ipp_dstoptslen; 436 if (hdrlen == 0) 437 hdrlen = sizeof (struct T_unitdata_ind); 438 addflag |= SCTP_IPV6_RECVDSTOPTS; 439 if (!ip_allocbuf((void **)&sctp->sctp_dstopts, 440 &sctp->sctp_dstoptslen, 441 (ipp->ipp_fields & IPPF_DSTOPTS), 442 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) 443 return (-1); 444 } 445 noancillary: 446 /* Nothing to add */ 447 if (hdrlen == 0) 448 return (-1); 449 450 mp1 = allocb(hdrlen + optlen + sizeof (void *), BPRI_MED); 451 if (mp1 == NULL) 452 return (-1); 453 mp1->b_cont = *mp; 454 *mp = mp1; 455 mp1->b_rptr += sizeof (void *); /* pointer worth of padding */ 456 mp1->b_wptr = mp1->b_rptr + hdrlen + optlen; 457 DB_TYPE(mp1) = M_PROTO; 458 tudi = (struct T_unitdata_ind *)mp1->b_rptr; 459 tudi->PRIM_type = T_UNITDATA_IND; 460 tudi->SRC_length = sin4 ? sizeof (*sin4) : sizeof (*sin6); 461 tudi->SRC_offset = sizeof (*tudi); 462 tudi->OPT_offset = sizeof (*tudi) + tudi->SRC_length; 463 tudi->OPT_length = optlen; 464 if (sin4) { 465 bcopy(sin4, tudi + 1, sizeof (*sin4)); 466 } else { 467 bcopy(sin6, tudi + 1, sizeof (*sin6)); 468 } 469 optptr = (uchar_t *)tudi + tudi->OPT_offset; 470 471 if (sctp->sctp_recvsndrcvinfo) { 472 /* XXX need backout method if memory allocation fails. */ 473 struct sctp_sndrcvinfo *sri; 474 475 cmsg = (struct cmsghdr *)optptr; 476 cmsg->cmsg_level = IPPROTO_SCTP; 477 cmsg->cmsg_type = SCTP_SNDRCV; 478 cmsg->cmsg_len = sizeof (*cmsg) + sizeof (*sri); 479 optptr += sizeof (*cmsg); 480 481 sri = (struct sctp_sndrcvinfo *)(cmsg + 1); 482 ASSERT(OK_32PTR(sri)); 483 sri->sinfo_stream = ntohs(dcp->sdh_sid); 484 sri->sinfo_ssn = ntohs(dcp->sdh_ssn); 485 if (SCTP_DATA_GET_UBIT(dcp)) { 486 sri->sinfo_flags = MSG_UNORDERED; 487 } else { 488 sri->sinfo_flags = 0; 489 } 490 sri->sinfo_ppid = dcp->sdh_payload_id; 491 sri->sinfo_context = 0; 492 sri->sinfo_timetolive = 0; 493 sri->sinfo_tsn = ntohl(dcp->sdh_tsn); 494 sri->sinfo_cumtsn = sctp->sctp_ftsn; 495 sri->sinfo_assoc_id = 0; 496 497 optptr += sizeof (*sri); 498 } 499 500 /* 501 * If app asked for pktinfo and the index has changed ... 502 * Note that the local address never changes for the connection. 503 */ 504 if (addflag & SCTP_IPV6_RECVPKTINFO) { 505 struct in6_pktinfo *pkti; 506 507 cmsg = (struct cmsghdr *)optptr; 508 cmsg->cmsg_level = IPPROTO_IPV6; 509 cmsg->cmsg_type = IPV6_PKTINFO; 510 cmsg->cmsg_len = sizeof (*cmsg) + sizeof (*pkti); 511 optptr += sizeof (*cmsg); 512 513 pkti = (struct in6_pktinfo *)optptr; 514 if (sctp->sctp_ipversion == IPV6_VERSION) 515 pkti->ipi6_addr = sctp->sctp_ip6h->ip6_src; 516 else 517 IN6_IPADDR_TO_V4MAPPED(sctp->sctp_ipha->ipha_src, 518 &pkti->ipi6_addr); 519 pkti->ipi6_ifindex = ipp->ipp_ifindex; 520 optptr += sizeof (*pkti); 521 ASSERT(OK_32PTR(optptr)); 522 /* Save as "last" value */ 523 sctp->sctp_recvifindex = ipp->ipp_ifindex; 524 } 525 /* If app asked for hoplimit and it has changed ... */ 526 if (addflag & SCTP_IPV6_RECVHOPLIMIT) { 527 cmsg = (struct cmsghdr *)optptr; 528 cmsg->cmsg_level = IPPROTO_IPV6; 529 cmsg->cmsg_type = IPV6_HOPLIMIT; 530 cmsg->cmsg_len = sizeof (*cmsg) + sizeof (uint_t); 531 optptr += sizeof (*cmsg); 532 533 *(uint_t *)optptr = ipp->ipp_hoplimit; 534 optptr += sizeof (uint_t); 535 ASSERT(OK_32PTR(optptr)); 536 /* Save as "last" value */ 537 sctp->sctp_recvhops = ipp->ipp_hoplimit; 538 } 539 if (addflag & SCTP_IPV6_RECVHOPOPTS) { 540 cmsg = (struct cmsghdr *)optptr; 541 cmsg->cmsg_level = IPPROTO_IPV6; 542 cmsg->cmsg_type = IPV6_HOPOPTS; 543 cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_hopoptslen; 544 optptr += sizeof (*cmsg); 545 546 bcopy(ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen); 547 optptr += ipp->ipp_hopoptslen; 548 ASSERT(OK_32PTR(optptr)); 549 /* Save as last value */ 550 ip_savebuf((void **)&sctp->sctp_hopopts, 551 &sctp->sctp_hopoptslen, 552 (ipp->ipp_fields & IPPF_HOPOPTS), 553 ipp->ipp_hopopts, ipp->ipp_hopoptslen); 554 } 555 if (addflag & SCTP_IPV6_RECVRTDSTOPTS) { 556 cmsg = (struct cmsghdr *)optptr; 557 cmsg->cmsg_level = IPPROTO_IPV6; 558 cmsg->cmsg_type = IPV6_RTHDRDSTOPTS; 559 cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_rtdstoptslen; 560 optptr += sizeof (*cmsg); 561 562 bcopy(ipp->ipp_rtdstopts, optptr, ipp->ipp_rtdstoptslen); 563 optptr += ipp->ipp_rtdstoptslen; 564 ASSERT(OK_32PTR(optptr)); 565 /* Save as last value */ 566 ip_savebuf((void **)&sctp->sctp_rtdstopts, 567 &sctp->sctp_rtdstoptslen, 568 (ipp->ipp_fields & IPPF_RTDSTOPTS), 569 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen); 570 } 571 if (addflag & SCTP_IPV6_RECVRTHDR) { 572 cmsg = (struct cmsghdr *)optptr; 573 cmsg->cmsg_level = IPPROTO_IPV6; 574 cmsg->cmsg_type = IPV6_RTHDR; 575 cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_rthdrlen; 576 optptr += sizeof (*cmsg); 577 578 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen); 579 optptr += ipp->ipp_rthdrlen; 580 ASSERT(OK_32PTR(optptr)); 581 /* Save as last value */ 582 ip_savebuf((void **)&sctp->sctp_rthdr, 583 &sctp->sctp_rthdrlen, 584 (ipp->ipp_fields & IPPF_RTHDR), 585 ipp->ipp_rthdr, ipp->ipp_rthdrlen); 586 } 587 if (addflag & SCTP_IPV6_RECVDSTOPTS) { 588 cmsg = (struct cmsghdr *)optptr; 589 cmsg->cmsg_level = IPPROTO_IPV6; 590 cmsg->cmsg_type = IPV6_DSTOPTS; 591 cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_dstoptslen; 592 optptr += sizeof (*cmsg); 593 594 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen); 595 optptr += ipp->ipp_dstoptslen; 596 ASSERT(OK_32PTR(optptr)); 597 /* Save as last value */ 598 ip_savebuf((void **)&sctp->sctp_dstopts, 599 &sctp->sctp_dstoptslen, 600 (ipp->ipp_fields & IPPF_DSTOPTS), 601 ipp->ipp_dstopts, ipp->ipp_dstoptslen); 602 } 603 604 ASSERT(optptr == mp1->b_wptr); 605 606 return (0); 607 } 608 609 void 610 sctp_free_reass(sctp_instr_t *sip) 611 { 612 mblk_t *mp, *mpnext, *mctl; 613 614 for (mp = sip->istr_reass; mp != NULL; mp = mpnext) { 615 mpnext = mp->b_next; 616 mp->b_next = NULL; 617 mp->b_prev = NULL; 618 if (DB_TYPE(mp) == M_CTL) { 619 mctl = mp; 620 ASSERT(mp->b_cont != NULL); 621 mp = mp->b_cont; 622 mctl->b_cont = NULL; 623 freeb(mctl); 624 } 625 freemsg(mp); 626 } 627 } 628 629 /* 630 * If the series of data fragments of which dmp is a part is successfully 631 * reassembled, the first mblk in the series is returned. dc is adjusted 632 * to point at the data chunk in the lead mblk, and b_rptr also points to 633 * the data chunk; the following mblk's b_rptr's point at the actual payload. 634 * 635 * If the series is not yet reassembled, NULL is returned. dc is not changed. 636 * XXX should probably move this up into the state machine. 637 */ 638 639 /* Fragment list for un-ordered messages. Partial delivery is not supported */ 640 static mblk_t * 641 sctp_uodata_frag(sctp_t *sctp, mblk_t *dmp, sctp_data_hdr_t **dc) 642 { 643 mblk_t *hmp; 644 mblk_t *begin = NULL; 645 mblk_t *end = NULL; 646 sctp_data_hdr_t *qdc; 647 uint32_t ntsn; 648 uint32_t tsn = ntohl((*dc)->sdh_tsn); 649 #ifdef DEBUG 650 mblk_t *mp1; 651 #endif 652 653 /* First frag. */ 654 if (sctp->sctp_uo_frags == NULL) { 655 sctp->sctp_uo_frags = dmp; 656 return (NULL); 657 } 658 hmp = sctp->sctp_uo_frags; 659 /* 660 * Insert the segment according to the TSN, fragmented unordered 661 * chunks are sequenced by TSN. 662 */ 663 while (hmp != NULL) { 664 qdc = (sctp_data_hdr_t *)hmp->b_rptr; 665 ntsn = ntohl(qdc->sdh_tsn); 666 if (SEQ_GT(ntsn, tsn)) { 667 if (hmp->b_prev == NULL) { 668 dmp->b_next = hmp; 669 hmp->b_prev = dmp; 670 sctp->sctp_uo_frags = dmp; 671 } else { 672 dmp->b_next = hmp; 673 dmp->b_prev = hmp->b_prev; 674 hmp->b_prev->b_next = dmp; 675 hmp->b_prev = dmp; 676 } 677 break; 678 } 679 if (hmp->b_next == NULL) { 680 hmp->b_next = dmp; 681 dmp->b_prev = hmp; 682 break; 683 } 684 hmp = hmp->b_next; 685 } 686 /* check if we completed a msg */ 687 if (SCTP_DATA_GET_BBIT(*dc)) { 688 begin = dmp; 689 } else if (SCTP_DATA_GET_EBIT(*dc)) { 690 end = dmp; 691 } 692 /* 693 * We walk consecutive TSNs backwards till we get a seg. with 694 * the B bit 695 */ 696 if (begin == NULL) { 697 for (hmp = dmp->b_prev; hmp != NULL; hmp = hmp->b_prev) { 698 qdc = (sctp_data_hdr_t *)hmp->b_rptr; 699 ntsn = ntohl(qdc->sdh_tsn); 700 if ((int32_t)(tsn - ntsn) > 1) { 701 return (NULL); 702 } 703 if (SCTP_DATA_GET_BBIT(qdc)) { 704 begin = hmp; 705 break; 706 } 707 tsn = ntsn; 708 } 709 } 710 tsn = ntohl((*dc)->sdh_tsn); 711 /* 712 * We walk consecutive TSNs till we get a seg. with the E bit 713 */ 714 if (end == NULL) { 715 for (hmp = dmp->b_next; hmp != NULL; hmp = hmp->b_next) { 716 qdc = (sctp_data_hdr_t *)hmp->b_rptr; 717 ntsn = ntohl(qdc->sdh_tsn); 718 if ((int32_t)(ntsn - tsn) > 1) { 719 return (NULL); 720 } 721 if (SCTP_DATA_GET_EBIT(qdc)) { 722 end = hmp; 723 break; 724 } 725 tsn = ntsn; 726 } 727 } 728 if (begin == NULL || end == NULL) { 729 return (NULL); 730 } 731 /* Got one!, Remove the msg from the list */ 732 if (sctp->sctp_uo_frags == begin) { 733 ASSERT(begin->b_prev == NULL); 734 sctp->sctp_uo_frags = end->b_next; 735 if (end->b_next != NULL) 736 end->b_next->b_prev = NULL; 737 } else { 738 begin->b_prev->b_next = end->b_next; 739 if (end->b_next != NULL) 740 end->b_next->b_prev = begin->b_prev; 741 } 742 begin->b_prev = NULL; 743 end->b_next = NULL; 744 745 /* 746 * Null out b_next and b_prev and chain using b_cont. 747 */ 748 dmp = end = begin; 749 hmp = begin->b_next; 750 *dc = (sctp_data_hdr_t *)begin->b_rptr; 751 begin->b_next = NULL; 752 while (hmp != NULL) { 753 qdc = (sctp_data_hdr_t *)hmp->b_rptr; 754 hmp->b_rptr = (uchar_t *)(qdc + 1); 755 end = hmp->b_next; 756 dmp->b_cont = hmp; 757 dmp = hmp; 758 759 if (end != NULL) 760 hmp->b_next = NULL; 761 hmp->b_prev = NULL; 762 hmp = end; 763 } 764 BUMP_LOCAL(sctp->sctp_reassmsgs); 765 #ifdef DEBUG 766 mp1 = begin; 767 while (mp1 != NULL) { 768 ASSERT(mp1->b_next == NULL); 769 ASSERT(mp1->b_prev == NULL); 770 mp1 = mp1->b_cont; 771 } 772 #endif 773 return (begin); 774 } 775 /* 776 * Fragment list for ordered messages. 777 * If no error occures, error is set to 0. If we run out of memory, error 778 * is set to 1. If the peer commits a fatal error (like using different 779 * sequence numbers for the same data fragment series), the association is 780 * aborted and error is set to 2. 781 */ 782 static mblk_t * 783 sctp_data_frag(sctp_t *sctp, mblk_t *dmp, sctp_data_hdr_t **dc, int *error, 784 sctp_instr_t *sip, int trypartial, int *tpfinished) 785 { 786 mblk_t *hmp; 787 mblk_t *pmp; 788 mblk_t *qmp; 789 mblk_t *mp; 790 mblk_t *prev; 791 mblk_t *prevprev; 792 mblk_t *first_mp; 793 sctp_reass_t *srp; 794 sctp_data_hdr_t *qdc; 795 sctp_data_hdr_t *bdc; 796 sctp_data_hdr_t *edc; 797 uint32_t tsn; 798 799 /* 800 * We can overwrite the Link Layer + IP header here, I suppose. 801 * The M_CTL does not leave this function. We need to check 802 * DB_REF(dmp) before using DB_BASE(dmp), since there could be 803 * two fragments for different ssns in the same mblk. 804 */ 805 #define SCTP_NEW_REASS(nmp, dmp, srp, seterror) \ 806 if ((DB_REF(dmp) == 2) && (MBLKHEAD(dmp) >= \ 807 (sizeof (*(srp)) + sizeof (sctp_hdr_t))) && \ 808 (IS_P2ALIGNED(DB_BASE(dmp), sizeof (uintptr_t)))) { \ 809 (nmp) = (dmp); \ 810 } else { \ 811 (nmp) = allocb(sizeof (*(srp)), BPRI_MED); \ 812 if ((nmp) == NULL) { \ 813 switch (seterror) { \ 814 case B_TRUE: \ 815 *error = 1; \ 816 break; \ 817 } \ 818 return (NULL); \ 819 } \ 820 DB_TYPE(nmp) = M_CTL; \ 821 (nmp)->b_cont = dmp; \ 822 } \ 823 (srp) = (sctp_reass_t *)DB_BASE(nmp); 824 825 *error = 0; 826 827 /* find the reassembly queue for this data chunk */ 828 hmp = qmp = sip->istr_reass; 829 for (; hmp != NULL; hmp = hmp->b_next) { 830 srp = (sctp_reass_t *)DB_BASE(hmp); 831 if (ntohs((*dc)->sdh_ssn) == srp->ssn) 832 goto foundit; 833 else if (SSN_GT(srp->ssn, ntohs((*dc)->sdh_ssn))) 834 break; 835 qmp = hmp; 836 } 837 838 SCTP_NEW_REASS(pmp, dmp, srp, B_TRUE); 839 srp->ssn = ntohs((*dc)->sdh_ssn); 840 srp->needed = 0; 841 srp->got = 1; 842 srp->tail = dmp; 843 srp->partial_delivered = B_FALSE; 844 845 if (hmp != NULL) { 846 if (sip->istr_reass == hmp) { 847 sip->istr_reass = pmp; 848 pmp->b_next = hmp; 849 pmp->b_prev = NULL; 850 hmp->b_prev = pmp; 851 } else { 852 qmp->b_next = pmp; 853 pmp->b_prev = qmp; 854 pmp->b_next = hmp; 855 hmp->b_prev = pmp; 856 } 857 } else { 858 /* make a new reass head and stick it on the end */ 859 if (sip->istr_reass == NULL) { 860 sip->istr_reass = pmp; 861 pmp->b_prev = NULL; 862 } else { 863 qmp->b_next = pmp; 864 pmp->b_prev = qmp; 865 } 866 pmp->b_next = NULL; 867 } 868 return (NULL); 869 foundit: 870 /* 871 * else already have a reassembly queue. Insert the new data chunk 872 * in the reassemble queue. Try the tail first, on the assumption 873 * that the fragments are coming in in order. 874 */ 875 876 qmp = srp->tail; 877 qdc = (sctp_data_hdr_t *)qmp->b_rptr; 878 ASSERT(qmp->b_cont == NULL); 879 880 /* XXXIs it fine to do this just here? */ 881 if ((*dc)->sdh_sid != qdc->sdh_sid) { 882 /* our peer is fatally confused; XXX abort the assc */ 883 *error = 2; 884 return (NULL); 885 } 886 if (SEQ_GT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) { 887 qmp->b_cont = dmp; 888 srp->tail = dmp; 889 dmp->b_cont = NULL; 890 goto inserted; 891 } 892 893 /* Next check for insertion at the beginning */ 894 qmp = (DB_TYPE(hmp) == M_DATA) ? hmp : hmp->b_cont; 895 qdc = (sctp_data_hdr_t *)qmp->b_rptr; 896 if (SEQ_LT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) { 897 if (DB_TYPE(hmp) == M_DATA) { 898 sctp_reass_t *srp1 = srp; 899 900 SCTP_NEW_REASS(pmp, dmp, srp, B_TRUE); 901 ASSERT(pmp->b_prev == NULL && pmp->b_next == NULL); 902 if (sip->istr_reass == hmp) { 903 sip->istr_reass = pmp; 904 if (hmp->b_next != NULL) { 905 hmp->b_next->b_prev = pmp; 906 pmp->b_next = hmp->b_next; 907 } 908 } else { 909 hmp->b_prev->b_next = pmp; 910 pmp->b_prev = hmp->b_prev; 911 if (hmp->b_next != NULL) { 912 hmp->b_next->b_prev = pmp; 913 pmp->b_next = hmp->b_next; 914 } 915 } 916 srp->ssn = srp1->ssn; 917 srp->needed = srp1->needed; 918 srp->got = srp1->got; 919 srp->tail = srp1->tail; 920 srp->partial_delivered = srp1->partial_delivered; 921 hmp->b_next = hmp->b_prev = NULL; 922 dmp->b_cont = hmp; 923 hmp = pmp; 924 } else { 925 ASSERT(DB_TYPE(hmp) == M_CTL); 926 dmp->b_cont = qmp; 927 hmp->b_cont = dmp; 928 } 929 goto inserted; 930 } 931 932 /* Insert somewhere in the middle */ 933 for (;;) { 934 /* Tail check above should have caught this */ 935 ASSERT(qmp->b_cont != NULL); 936 937 qdc = (sctp_data_hdr_t *)qmp->b_cont->b_rptr; 938 if (SEQ_LT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) { 939 /* insert here */ 940 dmp->b_cont = qmp->b_cont; 941 qmp->b_cont = dmp; 942 break; 943 } 944 qmp = qmp->b_cont; 945 } 946 947 inserted: 948 (srp->got)++; 949 first_mp = (DB_TYPE(hmp) == M_DATA) ? hmp : hmp->b_cont; 950 if (srp->needed == 0) { 951 /* check if we have the first and last fragments */ 952 bdc = (sctp_data_hdr_t *)first_mp->b_rptr; 953 edc = (sctp_data_hdr_t *)srp->tail->b_rptr; 954 955 /* calculate how many fragments are needed, if possible */ 956 if (SCTP_DATA_GET_BBIT(bdc) && SCTP_DATA_GET_EBIT(edc)) 957 srp->needed = ntohl(edc->sdh_tsn) - 958 ntohl(bdc->sdh_tsn) + 1; 959 } 960 961 if (srp->needed != srp->got) { 962 if (!trypartial) 963 return (NULL); 964 /* 965 * Try partial delivery. We need a consecutive run of 966 * at least two chunks, starting from the first chunk 967 * (which may have been the last + 1 chunk from a 968 * previous partial delivery). 969 */ 970 dprint(4, ("trypartial: got=%d, needed=%d\n", 971 (int)(srp->got), (int)(srp->needed))); 972 mp = first_mp; 973 if (mp->b_cont == NULL) { 974 /* need at least two chunks */ 975 dprint(4, ("trypartial: only 1 chunk\n")); 976 return (NULL); 977 } 978 979 qdc = (sctp_data_hdr_t *)mp->b_rptr; 980 if (!SCTP_DATA_GET_BBIT(qdc)) { 981 /* don't have first chunk; can't do it. */ 982 dprint(4, ("trypartial: no beginning\n")); 983 return (NULL); 984 } 985 986 tsn = ntohl(qdc->sdh_tsn) + 1; 987 988 /* 989 * This loop has two exit conditions: the 990 * end of received chunks has been reached, or 991 * there is a break in the sequence. We want 992 * to chop the reassembly list as follows (the 993 * numbers are TSNs): 994 * 10 -> 11 -> | 12 (end of chunks) 995 * 10 -> 11 -> | 12 -> 14 (break in sequence) 996 */ 997 prevprev = prev = mp; 998 mp = mp->b_cont; 999 while (mp != NULL) { 1000 qdc = (sctp_data_hdr_t *)mp->b_rptr; 1001 if (ntohl(qdc->sdh_tsn) != tsn) { 1002 /* 1003 * break in sequence. 1004 * 1st and 2nd chunks are not sequntial. 1005 */ 1006 if (mp == first_mp->b_cont) 1007 return (NULL); 1008 /* Back up mp and prev */ 1009 mp = prev; 1010 prev = prevprev; 1011 break; 1012 } 1013 1014 /* end of sequence */ 1015 if (mp->b_cont == NULL) 1016 break; 1017 1018 prevprev = prev; 1019 prev = mp; 1020 mp = mp->b_cont; 1021 tsn++; 1022 } 1023 if (DB_TYPE(hmp) == M_DATA) { 1024 sctp_reass_t *srp1 = srp; 1025 1026 SCTP_NEW_REASS(pmp, mp, srp, B_FALSE); 1027 ASSERT(pmp->b_prev == NULL && pmp->b_next == NULL); 1028 if (sip->istr_reass == hmp) { 1029 sip->istr_reass = pmp; 1030 if (hmp->b_next != NULL) { 1031 hmp->b_next->b_prev = pmp; 1032 pmp->b_next = hmp->b_next; 1033 } 1034 } else { 1035 hmp->b_prev->b_next = pmp; 1036 pmp->b_prev = hmp->b_prev; 1037 if (hmp->b_next != NULL) { 1038 hmp->b_next->b_prev = pmp; 1039 pmp->b_next = hmp->b_next; 1040 } 1041 } 1042 srp->ssn = srp1->ssn; 1043 srp->needed = srp1->needed; 1044 srp->got = srp1->got; 1045 srp->tail = srp1->tail; 1046 hmp->b_next = hmp->b_prev = NULL; 1047 dmp = hmp; 1048 hmp = pmp; 1049 } else { 1050 ASSERT(DB_TYPE(hmp) == M_CTL); 1051 dmp = hmp->b_cont; 1052 hmp->b_cont = mp; 1053 } 1054 /* 1055 * mp now points at the last chunk in the sequence, 1056 * and prev points to mp's previous in the list. 1057 * We chop the list at prev, and convert mp into the 1058 * new list head by setting the B bit. Subsequence 1059 * fragment deliveries will follow the normal reassembly 1060 * path. 1061 */ 1062 prev->b_cont = NULL; 1063 bdc = (sctp_data_hdr_t *)mp->b_rptr; 1064 SCTP_DATA_SET_BBIT(bdc); 1065 *tpfinished = 0; 1066 srp->partial_delivered = B_TRUE; 1067 1068 dprint(4, ("trypartial: got some, got=%d, needed=%d\n", 1069 (int)(srp->got), (int)(srp->needed))); 1070 goto fixup; 1071 } 1072 1073 /* 1074 * else reassembly done; prepare the data for delivery. 1075 * First unlink hmp from the ssn list. 1076 */ 1077 if (sip->istr_reass == hmp) { 1078 sip->istr_reass = hmp->b_next; 1079 if (hmp->b_next) { 1080 hmp->b_next->b_prev = NULL; 1081 } 1082 } else { 1083 ASSERT(hmp->b_prev != NULL); 1084 hmp->b_prev->b_next = hmp->b_next; 1085 if (hmp->b_next) { 1086 hmp->b_next->b_prev = hmp->b_prev; 1087 } 1088 } 1089 1090 /* 1091 * Using b_prev and b_next was a little sinful, but OK since 1092 * this mblk is never put*'d. However, freeb() will still 1093 * ASSERT that they are unused, so we need to NULL them out now. 1094 */ 1095 hmp->b_next = NULL; 1096 hmp->b_prev = NULL; 1097 dmp = hmp; 1098 if (DB_TYPE(hmp) == M_CTL) { 1099 dmp = dmp->b_cont; 1100 hmp->b_cont = NULL; 1101 freeb(hmp); 1102 } 1103 *tpfinished = 1; 1104 1105 fixup: 1106 /* 1107 * Adjust all mblk's except the lead so their rptr's point to the 1108 * payload. sctp_data_chunk() will need to process the lead's 1109 * data chunk section, so leave it's rptr pointing at the data chunk. 1110 */ 1111 *dc = (sctp_data_hdr_t *)dmp->b_rptr; 1112 if (trypartial && !(*tpfinished)) { 1113 (srp->got)--; 1114 ASSERT(srp->got != 0); 1115 if (srp->needed != 0) { 1116 (srp->needed)--; 1117 ASSERT(srp->needed != 0); 1118 } 1119 } 1120 for (qmp = dmp->b_cont; qmp; qmp = qmp->b_cont) { 1121 qdc = (sctp_data_hdr_t *)qmp->b_rptr; 1122 qmp->b_rptr = (uchar_t *)(qdc + 1); 1123 1124 /* 1125 * If in partial delivery, deduct the balance from got 1126 * and needed here, now that we know we are actually 1127 * delivering these data. 1128 */ 1129 if (trypartial && !(*tpfinished)) { 1130 (srp->got)--; 1131 ASSERT(srp->got != 0); 1132 if (srp->needed != 0) { 1133 (srp->needed)--; 1134 ASSERT(srp->needed != 0); 1135 } 1136 } 1137 } 1138 BUMP_LOCAL(sctp->sctp_reassmsgs); 1139 1140 return (dmp); 1141 } 1142 1143 static void 1144 sctp_add_dup(uint32_t tsn, mblk_t **dups) 1145 { 1146 mblk_t *mp; 1147 size_t bsize = SCTP_DUP_MBLK_SZ * sizeof (tsn); 1148 1149 if (dups == NULL) { 1150 return; 1151 } 1152 1153 /* first time? */ 1154 if (*dups == NULL) { 1155 *dups = allocb(bsize, BPRI_MED); 1156 if (*dups == NULL) { 1157 return; 1158 } 1159 } 1160 1161 mp = *dups; 1162 if ((mp->b_wptr - mp->b_rptr) >= bsize) { 1163 /* maximum reached */ 1164 return; 1165 } 1166 1167 /* add the duplicate tsn */ 1168 bcopy(&tsn, mp->b_wptr, sizeof (tsn)); 1169 mp->b_wptr += sizeof (tsn); 1170 ASSERT((mp->b_wptr - mp->b_rptr) <= bsize); 1171 } 1172 1173 static void 1174 sctp_data_chunk(sctp_t *sctp, sctp_chunk_hdr_t *ch, mblk_t *mp, mblk_t **dups, 1175 sctp_faddr_t *fp, ip6_pkt_t *ipp) 1176 { 1177 sctp_data_hdr_t *dc; 1178 mblk_t *dmp, *pmp; 1179 mblk_t *errmp; 1180 sctp_instr_t *instr; 1181 int ubit; 1182 int isfrag; 1183 uint16_t ssn; 1184 uint32_t oftsn; 1185 boolean_t can_deliver = B_TRUE; 1186 uint32_t tsn; 1187 int dlen; 1188 int trypartial = 0; 1189 int tpfinished = 1; 1190 int32_t new_rwnd; 1191 1192 /* The following are used multiple times, so we inline them */ 1193 #define SCTP_ACK_IT(sctp, tsn) \ 1194 if (tsn == sctp->sctp_ftsn) { \ 1195 dprint(2, ("data_chunk: acking next %x\n", tsn)); \ 1196 (sctp)->sctp_ftsn++; \ 1197 if ((sctp)->sctp_sack_gaps > 0) \ 1198 (sctp)->sctp_force_sack = 1; \ 1199 } else if (SEQ_GT(tsn, sctp->sctp_ftsn)) { \ 1200 /* Got a gap; record it */ \ 1201 dprint(2, ("data_chunk: acking gap %x\n", tsn)); \ 1202 sctp_ack_add(&sctp->sctp_sack_info, tsn, \ 1203 &sctp->sctp_sack_gaps); \ 1204 sctp->sctp_force_sack = 1; \ 1205 } 1206 1207 errmp = NULL; 1208 dmp = NULL; 1209 1210 dc = (sctp_data_hdr_t *)ch; 1211 tsn = ntohl(dc->sdh_tsn); 1212 1213 dprint(3, ("sctp_data_chunk: mp=%p tsn=%x\n", (void *)mp, tsn)); 1214 1215 /* Check for duplicates */ 1216 if (SEQ_LT(tsn, sctp->sctp_ftsn)) { 1217 dprint(4, ("sctp_data_chunk: dropping duplicate\n")); 1218 sctp->sctp_force_sack = 1; 1219 sctp_add_dup(dc->sdh_tsn, dups); 1220 return; 1221 } 1222 1223 if (sctp->sctp_sack_info != NULL) { 1224 sctp_set_t *sp; 1225 1226 for (sp = sctp->sctp_sack_info; sp; sp = sp->next) { 1227 if (SEQ_GEQ(tsn, sp->begin) && SEQ_LEQ(tsn, sp->end)) { 1228 dprint(4, 1229 ("sctp_data_chunk: dropping dup > cumtsn\n")); 1230 sctp->sctp_force_sack = 1; 1231 sctp_add_dup(dc->sdh_tsn, dups); 1232 return; 1233 } 1234 } 1235 } 1236 1237 /* We cannot deliver anything up now but we still need to handle it. */ 1238 if (SCTP_IS_DETACHED(sctp)) { 1239 BUMP_MIB(&sctp_mib, sctpInClosed); 1240 can_deliver = B_FALSE; 1241 } 1242 1243 dlen = ntohs(dc->sdh_len) - sizeof (*dc); 1244 1245 /* Check for buffer space */ 1246 if (sctp->sctp_rwnd - sctp->sctp_rxqueued < dlen) { 1247 /* Drop and SACK, but don't advance the cumulative TSN. */ 1248 sctp->sctp_force_sack = 1; 1249 dprint(0, ("sctp_data_chunk: exceed rwnd %d rxqueued %d " 1250 "ssn %d tsn %x\n", sctp->sctp_rwnd, 1251 sctp->sctp_rxqueued, dc->sdh_ssn, ntohl(dc->sdh_tsn))); 1252 return; 1253 } 1254 1255 if (ntohs(dc->sdh_sid) >= sctp->sctp_num_istr) { 1256 uint16_t inval_parm[2]; 1257 1258 inval_parm[0] = dc->sdh_sid; 1259 /* RESERVED to be ignored at the receiving end */ 1260 inval_parm[1] = 0; 1261 /* ack and drop it */ 1262 errmp = sctp_make_err(sctp, SCTP_ERR_BAD_SID, 1263 (char *)inval_parm, sizeof (inval_parm)); 1264 SCTP_ACK_IT(sctp, tsn); 1265 if (errmp != NULL) 1266 sctp_send_err(sctp, errmp, NULL); 1267 return; 1268 } 1269 1270 ubit = SCTP_DATA_GET_UBIT(dc); 1271 ASSERT(sctp->sctp_instr != NULL); 1272 instr = &sctp->sctp_instr[ntohs(dc->sdh_sid)]; 1273 /* Initialize the stream, if not yet used */ 1274 if (instr->sctp == NULL) 1275 instr->sctp = sctp; 1276 /* 1277 * If we are getting low on buffers set trypartial to try 1278 * a partial delivery if we are reassembling a fragmented 1279 * message. Only do this if we can immediately deliver the 1280 * partially assembled message, and only partially deliver 1281 * one message at a time (i.e. messages cannot be intermixed 1282 * arriving at the upper layer). A simple way to enforce 1283 * this is to only try partial delivery if this TSN is 1284 * the next expected TSN. Partial Delivery not supported 1285 * for un-ordered message. 1286 */ 1287 isfrag = !(SCTP_DATA_GET_BBIT(dc) && SCTP_DATA_GET_EBIT(dc)); 1288 ssn = ntohs(dc->sdh_ssn); 1289 if ((sctp->sctp_rwnd - sctp->sctp_rxqueued < SCTP_RECV_LOWATER) && 1290 !ubit && isfrag && (tsn == sctp->sctp_ftsn)) { 1291 trypartial = 1; 1292 } 1293 1294 dmp = dupb(mp); 1295 if (dmp == NULL) { 1296 /* drop it and don't ack it, causing the peer to retransmit */ 1297 return; 1298 } 1299 dmp->b_wptr = (uchar_t *)ch + ntohs(ch->sch_len); 1300 1301 sctp->sctp_rxqueued += dlen; 1302 1303 oftsn = sctp->sctp_ftsn; 1304 1305 if (isfrag) { 1306 int error = 0; 1307 1308 /* fragmented data chunk */ 1309 dmp->b_rptr = (uchar_t *)dc; 1310 if (ubit) { 1311 dmp = sctp_uodata_frag(sctp, dmp, &dc); 1312 #if DEBUG 1313 if (dmp != NULL) { 1314 ASSERT(instr == 1315 &sctp->sctp_instr[ntohs(dc->sdh_sid)]); 1316 } 1317 #endif 1318 } else { 1319 dmp = sctp_data_frag(sctp, dmp, &dc, &error, instr, 1320 trypartial, &tpfinished); 1321 } 1322 if (error != 0) { 1323 sctp->sctp_rxqueued -= dlen; 1324 if (error == 1) { 1325 /* 1326 * out of memory; don't ack it so 1327 * the peer retransmits 1328 */ 1329 return; 1330 } else if (error == 2) { 1331 /* 1332 * fatal error (i.e. peer used different 1333 * ssn's for same fragmented data) -- 1334 * the association has been aborted. 1335 * XXX need to return errval so state 1336 * machine can also abort processing. 1337 */ 1338 dprint(0, ("error 2: must not happen!\n")); 1339 return; 1340 } 1341 } 1342 1343 if (dmp == NULL) { 1344 /* 1345 * Can't process this data now, but the cumulative 1346 * TSN may be advanced, so do the checks at done. 1347 */ 1348 SCTP_ACK_IT(sctp, tsn); 1349 goto done; 1350 } 1351 } 1352 1353 if (!ubit && !trypartial && ssn != instr->nextseq) { 1354 /* Adjust rptr to point at the data chunk for compares */ 1355 dmp->b_rptr = (uchar_t *)dc; 1356 1357 dprint(2, 1358 ("data_chunk: inserted %x in pq (ssn %d expected %d)\n", 1359 ntohl(dc->sdh_tsn), (int)(ssn), (int)(instr->nextseq))); 1360 1361 if (instr->istr_msgs == NULL) { 1362 instr->istr_msgs = dmp; 1363 ASSERT(dmp->b_prev == NULL && dmp->b_next == NULL); 1364 } else { 1365 mblk_t *imblk = instr->istr_msgs; 1366 sctp_data_hdr_t *idc; 1367 1368 /* 1369 * XXXNeed to take sequence wraps into account, 1370 * ... and a more efficient insertion algo. 1371 */ 1372 for (;;) { 1373 idc = (sctp_data_hdr_t *)imblk->b_rptr; 1374 if (SSN_GT(ntohs(idc->sdh_ssn), 1375 ntohs(dc->sdh_ssn))) { 1376 if (instr->istr_msgs == imblk) { 1377 instr->istr_msgs = dmp; 1378 dmp->b_next = imblk; 1379 imblk->b_prev = dmp; 1380 } else { 1381 ASSERT(imblk->b_prev != NULL); 1382 imblk->b_prev->b_next = dmp; 1383 dmp->b_prev = imblk->b_prev; 1384 imblk->b_prev = dmp; 1385 dmp->b_next = imblk; 1386 } 1387 break; 1388 } 1389 if (imblk->b_next == NULL) { 1390 imblk->b_next = dmp; 1391 dmp->b_prev = imblk; 1392 break; 1393 } 1394 imblk = imblk->b_next; 1395 } 1396 } 1397 (instr->istr_nmsgs)++; 1398 (sctp->sctp_istr_nmsgs)++; 1399 SCTP_ACK_IT(sctp, tsn); 1400 return; 1401 } 1402 1403 /* 1404 * Else we can deliver the data directly. Recalculate 1405 * dlen now since we may have reassembled data. 1406 */ 1407 dlen = dmp->b_wptr - (uchar_t *)dc - sizeof (*dc); 1408 for (pmp = dmp->b_cont; pmp != NULL; pmp = pmp->b_cont) 1409 dlen += pmp->b_wptr - pmp->b_rptr; 1410 ASSERT(sctp->sctp_rxqueued >= dlen); 1411 ASSERT(sctp->sctp_rwnd >= dlen); 1412 1413 /* Deliver the message. */ 1414 sctp->sctp_rxqueued -= dlen; 1415 1416 if (can_deliver) { 1417 dmp->b_rptr = (uchar_t *)(dc + 1); 1418 if (sctp_input_add_ancillary(sctp, &dmp, dc, fp, ipp) == 0) { 1419 dprint(1, ("sctp_data_chunk: delivering %lu bytes\n", 1420 msgdsize(dmp))); 1421 sctp->sctp_rwnd -= dlen; 1422 new_rwnd = sctp->sctp_ulp_recv(sctp->sctp_ulpd, dmp, 1423 tpfinished ? 0 : SCTP_PARTIAL_DATA); 1424 if (new_rwnd > sctp->sctp_rwnd) { 1425 sctp->sctp_rwnd = new_rwnd; 1426 } 1427 SCTP_ACK_IT(sctp, tsn); 1428 } else { 1429 /* Just free the message if we don't have memory. */ 1430 freemsg(dmp); 1431 return; 1432 } 1433 } else { 1434 /* About to free the data */ 1435 freemsg(dmp); 1436 SCTP_ACK_IT(sctp, tsn); 1437 } 1438 1439 /* 1440 * data, now enqueued, may already have been processed and free'd 1441 * by the ULP (or we may have just freed it above, if we could not 1442 * deliver it), so we must not reference it (this is why we kept 1443 * the ssn and ubit above). 1444 */ 1445 if (ubit != 0) { 1446 BUMP_LOCAL(sctp->sctp_iudchunks); 1447 goto done; 1448 } 1449 BUMP_LOCAL(sctp->sctp_idchunks); 1450 1451 /* 1452 * If there was a partial delivery and it has not finished, 1453 * don't pull anything from the pqueues. 1454 */ 1455 if (!tpfinished) { 1456 goto done; 1457 } 1458 1459 instr->nextseq = ssn + 1; 1460 /* Deliver any successive data chunks in the instr queue */ 1461 while (instr->istr_nmsgs > 0) { 1462 dmp = (mblk_t *)instr->istr_msgs; 1463 dc = (sctp_data_hdr_t *)dmp->b_rptr; 1464 ssn = ntohs(dc->sdh_ssn); 1465 /* Gap in the sequence */ 1466 if (ssn != instr->nextseq) 1467 break; 1468 1469 /* Else deliver the data */ 1470 (instr->istr_nmsgs)--; 1471 (instr->nextseq)++; 1472 (sctp->sctp_istr_nmsgs)--; 1473 1474 instr->istr_msgs = instr->istr_msgs->b_next; 1475 if (instr->istr_msgs != NULL) 1476 instr->istr_msgs->b_prev = NULL; 1477 dmp->b_next = dmp->b_prev = NULL; 1478 1479 dprint(2, ("data_chunk: pulling %x from pq (ssn %d)\n", 1480 ntohl(dc->sdh_tsn), (int)ssn)); 1481 1482 /* 1483 * If this chunk was reassembled, each b_cont represents 1484 * another TSN; advance ftsn now. 1485 */ 1486 dlen = dmp->b_wptr - dmp->b_rptr - sizeof (*dc); 1487 for (pmp = dmp->b_cont; pmp; pmp = pmp->b_cont) 1488 dlen += pmp->b_wptr - pmp->b_rptr; 1489 1490 ASSERT(sctp->sctp_rxqueued >= dlen); 1491 ASSERT(sctp->sctp_rwnd >= dlen); 1492 1493 sctp->sctp_rxqueued -= dlen; 1494 if (can_deliver) { 1495 dmp->b_rptr = (uchar_t *)(dc + 1); 1496 if (sctp_input_add_ancillary(sctp, &dmp, dc, fp, 1497 ipp) == 0) { 1498 dprint(1, ("sctp_data_chunk: delivering %lu " 1499 "bytes\n", msgdsize(dmp))); 1500 sctp->sctp_rwnd -= dlen; 1501 new_rwnd = sctp->sctp_ulp_recv(sctp->sctp_ulpd, 1502 dmp, tpfinished ? 0 : SCTP_PARTIAL_DATA); 1503 if (new_rwnd > sctp->sctp_rwnd) { 1504 sctp->sctp_rwnd = new_rwnd; 1505 } 1506 SCTP_ACK_IT(sctp, tsn); 1507 } else { 1508 freemsg(dmp); 1509 return; 1510 } 1511 } else { 1512 /* About to free the data */ 1513 freemsg(dmp); 1514 SCTP_ACK_IT(sctp, tsn); 1515 } 1516 } 1517 1518 done: 1519 1520 /* 1521 * If there are gap reports pending, check if advancing 1522 * the ftsn here closes a gap. If so, we can advance 1523 * ftsn to the end of the set. 1524 */ 1525 if (sctp->sctp_sack_info != NULL && 1526 sctp->sctp_ftsn == sctp->sctp_sack_info->begin) { 1527 sctp->sctp_ftsn = sctp->sctp_sack_info->end + 1; 1528 } 1529 /* 1530 * If ftsn has moved forward, maybe we can remove gap reports. 1531 * NB: dmp may now be NULL, so don't dereference it here. 1532 */ 1533 if (oftsn != sctp->sctp_ftsn && sctp->sctp_sack_info != NULL) { 1534 sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1, 1535 &sctp->sctp_sack_gaps); 1536 dprint(2, ("data_chunk: removed acks before %x (num=%d)\n", 1537 sctp->sctp_ftsn - 1, sctp->sctp_sack_gaps)); 1538 } 1539 1540 #ifdef DEBUG 1541 if (sctp->sctp_sack_info != NULL) { 1542 ASSERT(sctp->sctp_ftsn != sctp->sctp_sack_info->begin); 1543 } 1544 #endif 1545 1546 #undef SCTP_ACK_IT 1547 } 1548 1549 void 1550 sctp_fill_sack(sctp_t *sctp, unsigned char *dst, int sacklen) 1551 { 1552 sctp_chunk_hdr_t *sch; 1553 sctp_sack_chunk_t *sc; 1554 sctp_sack_frag_t *sf; 1555 uint16_t num_gaps = sctp->sctp_sack_gaps; 1556 sctp_set_t *sp; 1557 1558 /* Chunk hdr */ 1559 sch = (sctp_chunk_hdr_t *)dst; 1560 sch->sch_id = CHUNK_SACK; 1561 sch->sch_flags = 0; 1562 sch->sch_len = htons(sacklen); 1563 1564 /* SACK chunk */ 1565 sctp->sctp_lastacked = sctp->sctp_ftsn - 1; 1566 1567 sc = (sctp_sack_chunk_t *)(sch + 1); 1568 sc->ssc_cumtsn = htonl(sctp->sctp_lastacked); 1569 if (sctp->sctp_rxqueued < sctp->sctp_rwnd) { 1570 sc->ssc_a_rwnd = htonl(sctp->sctp_rwnd - sctp->sctp_rxqueued); 1571 } else { 1572 sc->ssc_a_rwnd = 0; 1573 } 1574 sc->ssc_numfrags = htons(num_gaps); 1575 sc->ssc_numdups = 0; 1576 1577 /* lay in gap reports */ 1578 sf = (sctp_sack_frag_t *)(sc + 1); 1579 for (sp = sctp->sctp_sack_info; sp; sp = sp->next) { 1580 uint16_t offset; 1581 1582 /* start */ 1583 if (sp->begin > sctp->sctp_lastacked) { 1584 offset = (uint16_t)(sp->begin - sctp->sctp_lastacked); 1585 } else { 1586 /* sequence number wrap */ 1587 offset = (uint16_t)(UINT32_MAX - sctp->sctp_lastacked + 1588 sp->begin); 1589 } 1590 sf->ssf_start = htons(offset); 1591 1592 /* end */ 1593 if (sp->end >= sp->begin) { 1594 offset += (uint16_t)(sp->end - sp->begin); 1595 } else { 1596 /* sequence number wrap */ 1597 offset += (uint16_t)(UINT32_MAX - sp->begin + sp->end); 1598 } 1599 sf->ssf_end = htons(offset); 1600 1601 sf++; 1602 /* This is just for debugging (a la the following assertion) */ 1603 num_gaps--; 1604 } 1605 1606 ASSERT(num_gaps == 0); 1607 1608 /* If the SACK timer is running, stop it */ 1609 if (sctp->sctp_ack_timer_running) { 1610 sctp_timer_stop(sctp->sctp_ack_mp); 1611 sctp->sctp_ack_timer_running = B_FALSE; 1612 } 1613 1614 BUMP_LOCAL(sctp->sctp_obchunks); 1615 } 1616 1617 mblk_t * 1618 sctp_make_sack(sctp_t *sctp, sctp_faddr_t *sendto, mblk_t *dups) 1619 { 1620 mblk_t *smp; 1621 size_t slen; 1622 sctp_chunk_hdr_t *sch; 1623 sctp_sack_chunk_t *sc; 1624 1625 if (sctp->sctp_force_sack) { 1626 sctp->sctp_force_sack = 0; 1627 goto checks_done; 1628 } 1629 1630 if (sctp->sctp_state == SCTPS_ESTABLISHED) { 1631 if (sctp->sctp_sack_toggle < 2) { 1632 /* no need to SACK right now */ 1633 dprint(2, ("sctp_make_sack: %p no sack (toggle)\n", 1634 (void *)sctp)); 1635 return (NULL); 1636 } else if (sctp->sctp_sack_toggle >= 2) { 1637 sctp->sctp_sack_toggle = 0; 1638 } 1639 } 1640 1641 if (sctp->sctp_ftsn == sctp->sctp_lastacked + 1) { 1642 dprint(2, ("sctp_make_sack: %p no sack (already)\n", 1643 (void *)sctp)); 1644 return (NULL); 1645 } 1646 1647 checks_done: 1648 dprint(2, ("sctp_make_sack: acking %x\n", sctp->sctp_ftsn - 1)); 1649 1650 slen = sizeof (*sch) + sizeof (*sc) + 1651 (sizeof (sctp_sack_frag_t) * sctp->sctp_sack_gaps); 1652 smp = sctp_make_mp(sctp, sendto, slen); 1653 if (smp == NULL) { 1654 SCTP_KSTAT(sctp_send_sack_failed); 1655 return (NULL); 1656 } 1657 sch = (sctp_chunk_hdr_t *)smp->b_wptr; 1658 1659 sctp_fill_sack(sctp, smp->b_wptr, slen); 1660 smp->b_wptr += slen; 1661 if (dups) { 1662 sc = (sctp_sack_chunk_t *)(sch + 1); 1663 sc->ssc_numdups = htons((dups->b_wptr - dups->b_rptr) 1664 / sizeof (uint32_t)); 1665 sch->sch_len = htons(slen + (dups->b_wptr - dups->b_rptr)); 1666 smp->b_cont = dups; 1667 } 1668 1669 return (smp); 1670 } 1671 1672 void 1673 sctp_sack(sctp_t *sctp, mblk_t *dups) 1674 { 1675 mblk_t *smp; 1676 1677 /* If we are shutting down, let send_shutdown() bundle the SACK */ 1678 if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) { 1679 sctp_send_shutdown(sctp, 0); 1680 } 1681 1682 ASSERT(sctp->sctp_lastdata != NULL); 1683 1684 if ((smp = sctp_make_sack(sctp, sctp->sctp_lastdata, dups)) == NULL) { 1685 /* The caller of sctp_sack() will not free the dups mblk. */ 1686 if (dups != NULL) 1687 freeb(dups); 1688 return; 1689 } 1690 1691 sctp_set_iplen(sctp, smp); 1692 1693 dprint(2, ("sctp_sack: sending to %p %x:%x:%x:%x\n", 1694 (void *)sctp->sctp_lastdata, 1695 SCTP_PRINTADDR(sctp->sctp_lastdata->faddr))); 1696 1697 sctp->sctp_active = lbolt64; 1698 1699 BUMP_MIB(&sctp_mib, sctpOutAck); 1700 sctp_add_sendq(sctp, smp); 1701 } 1702 1703 /* 1704 * This is called if we have a message that was partially sent and is 1705 * abandoned. The cum TSN will be the last chunk sent for this message, 1706 * subsequent chunks will be marked ABANDONED. We send a Forward TSN 1707 * chunk in this case with the TSN of the last sent chunk so that the 1708 * peer can clean up its fragment list for this message. This message 1709 * will be removed from the transmit list when the peer sends a SACK 1710 * back. 1711 */ 1712 int 1713 sctp_check_abandoned_msg(sctp_t *sctp, mblk_t *meta) 1714 { 1715 sctp_data_hdr_t *dh; 1716 mblk_t *nmp; 1717 mblk_t *head; 1718 int32_t unsent = 0; 1719 mblk_t *mp1 = meta->b_cont; 1720 uint32_t adv_pap = sctp->sctp_adv_pap; 1721 sctp_faddr_t *fp = sctp->sctp_current; 1722 1723 dh = (sctp_data_hdr_t *)mp1->b_rptr; 1724 if (SEQ_GEQ(sctp->sctp_lastack_rxd, ntohl(dh->sdh_tsn))) { 1725 sctp_ftsn_set_t *sets = NULL; 1726 uint_t nsets = 0; 1727 uint32_t seglen = sizeof (uint32_t); 1728 boolean_t ubit = SCTP_DATA_GET_UBIT(dh); 1729 1730 while (mp1->b_next != NULL && SCTP_CHUNK_ISSENT(mp1->b_next)) 1731 mp1 = mp1->b_next; 1732 dh = (sctp_data_hdr_t *)mp1->b_rptr; 1733 sctp->sctp_adv_pap = ntohl(dh->sdh_tsn); 1734 if (!ubit && 1735 !sctp_add_ftsn_set(&sets, fp, meta, &nsets, &seglen)) { 1736 sctp->sctp_adv_pap = adv_pap; 1737 return (ENOMEM); 1738 } 1739 nmp = sctp_make_ftsn_chunk(sctp, fp, sets, nsets, seglen); 1740 sctp_free_ftsn_set(sets); 1741 if (nmp == NULL) { 1742 sctp->sctp_adv_pap = adv_pap; 1743 return (ENOMEM); 1744 } 1745 head = sctp_add_proto_hdr(sctp, fp, nmp, 0, NULL); 1746 if (head == NULL) { 1747 sctp->sctp_adv_pap = adv_pap; 1748 freemsg(nmp); 1749 SCTP_KSTAT(sctp_send_ftsn_failed); 1750 return (ENOMEM); 1751 } 1752 SCTP_MSG_SET_ABANDONED(meta); 1753 sctp_set_iplen(sctp, head); 1754 sctp_add_sendq(sctp, head); 1755 if (!fp->timer_running) 1756 SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 1757 mp1 = mp1->b_next; 1758 while (mp1 != NULL) { 1759 ASSERT(!SCTP_CHUNK_ISSENT(mp1)); 1760 ASSERT(!SCTP_CHUNK_ABANDONED(mp1)); 1761 SCTP_ABANDON_CHUNK(mp1); 1762 dh = (sctp_data_hdr_t *)mp1->b_rptr; 1763 unsent += ntohs(dh->sdh_len) - sizeof (*dh); 1764 mp1 = mp1->b_next; 1765 } 1766 ASSERT(sctp->sctp_unsent >= unsent); 1767 sctp->sctp_unsent -= unsent; 1768 /* 1769 * Update ULP the amount of queued data, which is 1770 * sent-unack'ed + unsent. 1771 */ 1772 if (!SCTP_IS_DETACHED(sctp)) { 1773 sctp->sctp_ulp_xmitted(sctp->sctp_ulpd, 1774 sctp->sctp_unacked + sctp->sctp_unsent); 1775 } 1776 return (0); 1777 } 1778 return (-1); 1779 } 1780 1781 uint32_t 1782 sctp_cumack(sctp_t *sctp, uint32_t tsn, mblk_t **first_unacked) 1783 { 1784 mblk_t *ump, *nump, *mp = NULL; 1785 uint16_t chunklen; 1786 uint32_t xtsn; 1787 sctp_faddr_t *fp; 1788 sctp_data_hdr_t *sdc; 1789 uint32_t cumack_forward = 0; 1790 sctp_msg_hdr_t *mhdr; 1791 1792 ump = sctp->sctp_xmit_head; 1793 1794 /* 1795 * Free messages only when they're completely acked. 1796 */ 1797 while (ump != NULL) { 1798 mhdr = (sctp_msg_hdr_t *)ump->b_rptr; 1799 for (mp = ump->b_cont; mp != NULL; mp = mp->b_next) { 1800 if (SCTP_CHUNK_ABANDONED(mp)) { 1801 ASSERT(SCTP_IS_MSG_ABANDONED(ump)); 1802 mp = NULL; 1803 break; 1804 } 1805 /* 1806 * We check for abandoned message if we are PR-SCTP 1807 * aware, if this is not the first chunk in the 1808 * message (b_cont) and if the message is marked 1809 * abandoned. 1810 */ 1811 if (!SCTP_CHUNK_ISSENT(mp)) { 1812 if (sctp->sctp_prsctp_aware && 1813 mp != ump->b_cont && 1814 (SCTP_IS_MSG_ABANDONED(ump) || 1815 SCTP_MSG_TO_BE_ABANDONED(ump, mhdr, 1816 sctp))) { 1817 (void) sctp_check_abandoned_msg(sctp, 1818 ump); 1819 } 1820 goto cum_ack_done; 1821 } 1822 sdc = (sctp_data_hdr_t *)mp->b_rptr; 1823 xtsn = ntohl(sdc->sdh_tsn); 1824 if (SEQ_GEQ(sctp->sctp_lastack_rxd, xtsn)) 1825 continue; 1826 if (SEQ_GEQ(tsn, xtsn)) { 1827 fp = SCTP_CHUNK_DEST(mp); 1828 chunklen = ntohs(sdc->sdh_len); 1829 1830 if (sctp->sctp_out_time != 0 && 1831 xtsn == sctp->sctp_rtt_tsn) { 1832 /* Got a new RTT measurement */ 1833 sctp_update_rtt(sctp, fp, 1834 lbolt64 - sctp->sctp_out_time); 1835 sctp->sctp_out_time = 0; 1836 } 1837 if (SCTP_CHUNK_ISACKED(mp)) 1838 continue; 1839 SCTP_CHUNK_SET_SACKCNT(mp, 0); 1840 SCTP_CHUNK_ACKED(mp); 1841 ASSERT(fp->suna >= chunklen); 1842 fp->suna -= chunklen; 1843 fp->acked += chunklen; 1844 cumack_forward += chunklen; 1845 ASSERT(sctp->sctp_unacked >= 1846 (chunklen - sizeof (*sdc))); 1847 sctp->sctp_unacked -= 1848 (chunklen - sizeof (*sdc)); 1849 if (fp->suna == 0) { 1850 /* all outstanding data acked */ 1851 fp->pba = 0; 1852 SCTP_FADDR_TIMER_STOP(fp); 1853 } else { 1854 SCTP_FADDR_TIMER_RESTART(sctp, fp, 1855 fp->rto); 1856 } 1857 } else { 1858 goto cum_ack_done; 1859 } 1860 } 1861 nump = ump->b_next; 1862 if (nump != NULL) 1863 nump->b_prev = NULL; 1864 if (ump == sctp->sctp_xmit_tail) 1865 sctp->sctp_xmit_tail = nump; 1866 if (SCTP_IS_MSG_ABANDONED(ump)) { 1867 BUMP_LOCAL(sctp->sctp_prsctpdrop); 1868 ump->b_next = NULL; 1869 sctp_sendfail_event(sctp, ump, 0, B_TRUE); 1870 } else { 1871 sctp_free_msg(ump); 1872 } 1873 sctp->sctp_xmit_head = ump = nump; 1874 } 1875 cum_ack_done: 1876 *first_unacked = mp; 1877 if (cumack_forward > 0) { 1878 BUMP_MIB(&sctp_mib, sctpInAck); 1879 if (SEQ_GT(sctp->sctp_lastack_rxd, sctp->sctp_recovery_tsn)) { 1880 sctp->sctp_recovery_tsn = sctp->sctp_lastack_rxd; 1881 } 1882 1883 /* 1884 * Update ULP the amount of queued data, which is 1885 * sent-unack'ed + unsent. 1886 */ 1887 if (!SCTP_IS_DETACHED(sctp)) { 1888 sctp->sctp_ulp_xmitted(sctp->sctp_ulpd, 1889 sctp->sctp_unacked + sctp->sctp_unsent); 1890 } 1891 1892 /* Time to send a shutdown? */ 1893 if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) { 1894 sctp_send_shutdown(sctp, 0); 1895 } 1896 sctp->sctp_xmit_unacked = mp; 1897 } else { 1898 /* dup ack */ 1899 BUMP_MIB(&sctp_mib, sctpInDupAck); 1900 } 1901 sctp->sctp_lastack_rxd = tsn; 1902 if (SEQ_LT(sctp->sctp_adv_pap, sctp->sctp_lastack_rxd)) 1903 sctp->sctp_adv_pap = sctp->sctp_lastack_rxd; 1904 ASSERT(sctp->sctp_xmit_head || sctp->sctp_unacked == 0); 1905 1906 return (cumack_forward); 1907 } 1908 1909 static int 1910 sctp_set_frwnd(sctp_t *sctp, uint32_t frwnd) 1911 { 1912 uint32_t orwnd; 1913 1914 if (sctp->sctp_unacked > frwnd) { 1915 sctp->sctp_frwnd = 0; 1916 return (0); 1917 } 1918 orwnd = sctp->sctp_frwnd; 1919 sctp->sctp_frwnd = frwnd - sctp->sctp_unacked; 1920 if (orwnd < sctp->sctp_frwnd) { 1921 return (1); 1922 } else { 1923 return (0); 1924 } 1925 } 1926 1927 /* 1928 * For un-ordered messages. 1929 * Walk the sctp->sctp_uo_frag list and remove any fragments with TSN 1930 * less than/equal to ftsn. Fragments for un-ordered messages are 1931 * strictly in sequence (w.r.t TSN). 1932 */ 1933 static int 1934 sctp_ftsn_check_uo_frag(sctp_t *sctp, uint32_t ftsn) 1935 { 1936 mblk_t *hmp; 1937 mblk_t *hmp_next; 1938 sctp_data_hdr_t *dc; 1939 int dlen = 0; 1940 1941 hmp = sctp->sctp_uo_frags; 1942 while (hmp != NULL) { 1943 hmp_next = hmp->b_next; 1944 dc = (sctp_data_hdr_t *)hmp->b_rptr; 1945 if (SEQ_GT(ntohl(dc->sdh_tsn), ftsn)) 1946 return (dlen); 1947 sctp->sctp_uo_frags = hmp_next; 1948 if (hmp_next != NULL) 1949 hmp_next->b_prev = NULL; 1950 hmp->b_next = NULL; 1951 dlen += ntohs(dc->sdh_len) - sizeof (*dc); 1952 freeb(hmp); 1953 hmp = hmp_next; 1954 } 1955 return (dlen); 1956 } 1957 1958 /* 1959 * For ordered messages. 1960 * Check for existing fragments for an sid-ssn pair reported as abandoned, 1961 * hence will not receive, in the Forward TSN. If there are fragments, then 1962 * we just nuke them. If and when Partial Delivery API is supported, we 1963 * would need to send a notification to the upper layer about this. 1964 */ 1965 static int 1966 sctp_ftsn_check_frag(sctp_t *sctp, uint16_t ssn, sctp_instr_t *sip) 1967 { 1968 sctp_reass_t *srp; 1969 mblk_t *hmp; 1970 mblk_t *dmp; 1971 mblk_t *hmp_next; 1972 sctp_data_hdr_t *dc; 1973 int dlen = 0; 1974 1975 hmp = sip->istr_reass; 1976 while (hmp != NULL) { 1977 hmp_next = hmp->b_next; 1978 srp = (sctp_reass_t *)DB_BASE(hmp); 1979 if (SSN_GT(srp->ssn, ssn)) 1980 return (dlen); 1981 /* 1982 * If we had sent part of this message up, send a partial 1983 * delivery event. Since this is ordered delivery, we should 1984 * have sent partial message only for the next in sequence, 1985 * hence the ASSERT. See comments in sctp_data_chunk() for 1986 * trypartial. 1987 */ 1988 if (srp->partial_delivered) { 1989 ASSERT(sip->nextseq == srp->ssn); 1990 sctp_partial_delivery_event(sctp); 1991 } 1992 /* Take it out of the reass queue */ 1993 sip->istr_reass = hmp_next; 1994 if (hmp_next != NULL) 1995 hmp_next->b_prev = NULL; 1996 hmp->b_next = NULL; 1997 ASSERT(hmp->b_prev == NULL); 1998 dmp = hmp; 1999 if (DB_TYPE(hmp) == M_CTL) { 2000 dmp = hmp->b_cont; 2001 hmp->b_cont = NULL; 2002 freeb(hmp); 2003 hmp = dmp; 2004 } 2005 while (dmp != NULL) { 2006 dc = (sctp_data_hdr_t *)dmp->b_rptr; 2007 dlen += ntohs(dc->sdh_len) - sizeof (*dc); 2008 dmp = dmp->b_cont; 2009 } 2010 freemsg(hmp); 2011 hmp = hmp_next; 2012 } 2013 return (dlen); 2014 } 2015 2016 /* 2017 * Update sctp_ftsn to the cumulative TSN from the Forward TSN chunk. Remove 2018 * any SACK gaps less than the newly updated sctp_ftsn. Walk through the 2019 * sid-ssn pair in the Forward TSN and for each, clean the fragment list 2020 * for this pair, if needed, and check if we can deliver subsequent 2021 * messages, if any, from the instream queue (that were waiting for this 2022 * sid-ssn message to show up). Once we are done try to update the SACK 2023 * info. We could get a duplicate Forward TSN, in which case just send 2024 * a SACK. If any of the sid values in the the Forward TSN is invalid, 2025 * send back an "Invalid Stream Identifier" error and continue processing 2026 * the rest. 2027 */ 2028 static void 2029 sctp_process_forward_tsn(sctp_t *sctp, sctp_chunk_hdr_t *ch, sctp_faddr_t *fp, 2030 ip6_pkt_t *ipp) 2031 { 2032 uint32_t *ftsn = (uint32_t *)(ch + 1); 2033 ftsn_entry_t *ftsn_entry; 2034 sctp_instr_t *instr; 2035 boolean_t can_deliver = B_TRUE; 2036 size_t dlen; 2037 int flen; 2038 mblk_t *dmp; 2039 mblk_t *pmp; 2040 sctp_data_hdr_t *dc; 2041 ssize_t remaining; 2042 2043 *ftsn = ntohl(*ftsn); 2044 remaining = ntohs(ch->sch_len) - sizeof (*ch) - sizeof (*ftsn); 2045 2046 if (SCTP_IS_DETACHED(sctp)) { 2047 BUMP_MIB(&sctp_mib, sctpInClosed); 2048 can_deliver = B_FALSE; 2049 } 2050 /* 2051 * un-ordered messages don't have SID-SSN pair entries, we check 2052 * for any fragments (for un-ordered message) to be discarded using 2053 * the cumulative FTSN. 2054 */ 2055 flen = sctp_ftsn_check_uo_frag(sctp, *ftsn); 2056 if (flen > 0) { 2057 ASSERT(sctp->sctp_rxqueued >= flen); 2058 sctp->sctp_rxqueued -= flen; 2059 } 2060 ftsn_entry = (ftsn_entry_t *)(ftsn + 1); 2061 while (remaining >= sizeof (*ftsn_entry)) { 2062 ftsn_entry->ftsn_sid = ntohs(ftsn_entry->ftsn_sid); 2063 ftsn_entry->ftsn_ssn = ntohs(ftsn_entry->ftsn_ssn); 2064 if (ftsn_entry->ftsn_sid >= sctp->sctp_num_istr) { 2065 uint16_t inval_parm[2]; 2066 mblk_t *errmp; 2067 2068 inval_parm[0] = htons(ftsn_entry->ftsn_sid); 2069 /* RESERVED to be ignored at the receiving end */ 2070 inval_parm[1] = 0; 2071 errmp = sctp_make_err(sctp, SCTP_ERR_BAD_SID, 2072 (char *)inval_parm, sizeof (inval_parm)); 2073 if (errmp != NULL) 2074 sctp_send_err(sctp, errmp, NULL); 2075 ftsn_entry++; 2076 remaining -= sizeof (*ftsn_entry); 2077 continue; 2078 } 2079 instr = &sctp->sctp_instr[ftsn_entry->ftsn_sid]; 2080 flen = sctp_ftsn_check_frag(sctp, ftsn_entry->ftsn_ssn, instr); 2081 /* Indicates frags were nuked, update rxqueued */ 2082 if (flen > 0) { 2083 ASSERT(sctp->sctp_rxqueued >= flen); 2084 sctp->sctp_rxqueued -= flen; 2085 } 2086 /* 2087 * It is possible to receive an FTSN chunk with SSN smaller 2088 * than then nextseq if this chunk is a retransmission because 2089 * of incomplete processing when it was first processed. 2090 */ 2091 if (SSN_GE(ftsn_entry->ftsn_ssn, instr->nextseq)) 2092 instr->nextseq = ftsn_entry->ftsn_ssn + 1; 2093 while (instr->istr_nmsgs > 0) { 2094 mblk_t *next; 2095 2096 dmp = (mblk_t *)instr->istr_msgs; 2097 dc = (sctp_data_hdr_t *)dmp->b_rptr; 2098 if (ntohs(dc->sdh_ssn) != instr->nextseq) 2099 break; 2100 2101 next = dmp->b_next; 2102 dlen = dmp->b_wptr - dmp->b_rptr - sizeof (*dc); 2103 for (pmp = dmp->b_cont; pmp != NULL; 2104 pmp = pmp->b_cont) { 2105 dlen += pmp->b_wptr - pmp->b_rptr; 2106 } 2107 if (can_deliver) { 2108 int32_t nrwnd; 2109 2110 dmp->b_rptr = (uchar_t *)(dc + 1); 2111 dmp->b_next = NULL; 2112 ASSERT(dmp->b_prev == NULL); 2113 if (sctp_input_add_ancillary(sctp, 2114 &dmp, dc, fp, ipp) == 0) { 2115 sctp->sctp_rxqueued -= dlen; 2116 sctp->sctp_rwnd -= dlen; 2117 nrwnd = sctp->sctp_ulp_recv( 2118 sctp->sctp_ulpd, dmp, 0); 2119 if (nrwnd > sctp->sctp_rwnd) 2120 sctp->sctp_rwnd = nrwnd; 2121 } else { 2122 /* 2123 * We will resume processing when 2124 * the FTSN chunk is re-xmitted. 2125 */ 2126 dmp->b_rptr = (uchar_t *)dc; 2127 dmp->b_next = next; 2128 dprint(0, 2129 ("FTSN dequeuing %u failed\n", 2130 ntohs(dc->sdh_ssn))); 2131 return; 2132 } 2133 } else { 2134 sctp->sctp_rxqueued -= dlen; 2135 ASSERT(dmp->b_prev == NULL); 2136 dmp->b_next = NULL; 2137 freemsg(dmp); 2138 } 2139 instr->istr_nmsgs--; 2140 instr->nextseq++; 2141 sctp->sctp_istr_nmsgs--; 2142 if (next != NULL) 2143 next->b_prev = NULL; 2144 instr->istr_msgs = next; 2145 } 2146 ftsn_entry++; 2147 remaining -= sizeof (*ftsn_entry); 2148 } 2149 /* Duplicate FTSN */ 2150 if (*ftsn <= (sctp->sctp_ftsn - 1)) { 2151 sctp->sctp_force_sack = 1; 2152 return; 2153 } 2154 /* Advance cum TSN to that reported in the Forward TSN chunk */ 2155 sctp->sctp_ftsn = *ftsn + 1; 2156 2157 /* Remove all the SACK gaps before the new cum TSN */ 2158 if (sctp->sctp_sack_info != NULL) { 2159 sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1, 2160 &sctp->sctp_sack_gaps); 2161 } 2162 /* 2163 * If there are gap reports pending, check if advancing 2164 * the ftsn here closes a gap. If so, we can advance 2165 * ftsn to the end of the set. 2166 * If ftsn has moved forward, maybe we can remove gap reports. 2167 */ 2168 if (sctp->sctp_sack_info != NULL && 2169 sctp->sctp_ftsn == sctp->sctp_sack_info->begin) { 2170 sctp->sctp_ftsn = sctp->sctp_sack_info->end + 1; 2171 sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1, 2172 &sctp->sctp_sack_gaps); 2173 } 2174 } 2175 2176 /* 2177 * When we have processed a SACK we check to see if we can advance the 2178 * cumulative TSN if there are abandoned chunks immediately following 2179 * the updated cumulative TSN. If there are, we attempt to send a 2180 * Forward TSN chunk. 2181 */ 2182 static void 2183 sctp_check_abandoned_data(sctp_t *sctp, sctp_faddr_t *fp) 2184 { 2185 mblk_t *meta = sctp->sctp_xmit_head; 2186 mblk_t *mp; 2187 mblk_t *nmp; 2188 uint32_t seglen; 2189 uint32_t adv_pap = sctp->sctp_adv_pap; 2190 2191 /* 2192 * We only check in the first meta since otherwise we can't 2193 * advance the cumulative ack point. We just look for chunks 2194 * marked for retransmission, else we might prematurely 2195 * send an FTSN for a sent, but unacked, chunk. 2196 */ 2197 for (mp = meta->b_cont; mp != NULL; mp = mp->b_next) { 2198 if (!SCTP_CHUNK_ISSENT(mp)) 2199 return; 2200 if (SCTP_CHUNK_WANT_REXMIT(mp)) 2201 break; 2202 } 2203 if (mp == NULL) 2204 return; 2205 sctp_check_adv_ack_pt(sctp, meta, mp); 2206 if (SEQ_GT(sctp->sctp_adv_pap, adv_pap)) { 2207 sctp_make_ftsns(sctp, meta, mp, &nmp, fp, &seglen); 2208 if (nmp == NULL) { 2209 sctp->sctp_adv_pap = adv_pap; 2210 if (!fp->timer_running) 2211 SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 2212 return; 2213 } 2214 sctp_set_iplen(sctp, nmp); 2215 sctp_add_sendq(sctp, nmp); 2216 if (!fp->timer_running) 2217 SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 2218 } 2219 } 2220 2221 /* 2222 * The processing here follows the same logic in sctp_got_sack(), the reason 2223 * we do this separately is because, usually, gap blocks are ordered and 2224 * we can process it in sctp_got_sack(). However if they aren't we would 2225 * need to do some additional non-optimal stuff when we start processing the 2226 * unordered gaps. To that effect sctp_got_sack() does the processing in the 2227 * simple case and this does the same in the more involved case. 2228 */ 2229 static uint32_t 2230 sctp_process_uo_gaps(sctp_t *sctp, uint32_t ctsn, sctp_sack_frag_t *ssf, 2231 int num_gaps, mblk_t *umphead, mblk_t *mphead, int *trysend, 2232 boolean_t *fast_recovery, uint32_t fr_xtsn) 2233 { 2234 uint32_t xtsn; 2235 uint32_t gapstart = 0; 2236 uint32_t gapend = 0; 2237 int gapcnt; 2238 uint16_t chunklen; 2239 sctp_data_hdr_t *sdc; 2240 int gstart; 2241 mblk_t *ump = umphead; 2242 mblk_t *mp = mphead; 2243 sctp_faddr_t *fp; 2244 uint32_t acked = 0; 2245 2246 /* 2247 * gstart tracks the last (in the order of TSN) gapstart that 2248 * we process in this SACK gaps walk. 2249 */ 2250 gstart = ctsn; 2251 2252 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2253 xtsn = ntohl(sdc->sdh_tsn); 2254 for (gapcnt = 0; gapcnt < num_gaps; gapcnt++, ssf++) { 2255 if (gapstart != 0) { 2256 /* 2257 * If we have reached the end of the transmit list or 2258 * hit an unsent chunk or encountered an unordered gap 2259 * block start from the ctsn again. 2260 */ 2261 if (ump == NULL || !SCTP_CHUNK_ISSENT(mp) || 2262 SEQ_LT(ctsn + ntohs(ssf->ssf_start), xtsn)) { 2263 ump = umphead; 2264 mp = mphead; 2265 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2266 xtsn = ntohl(sdc->sdh_tsn); 2267 } 2268 } 2269 2270 gapstart = ctsn + ntohs(ssf->ssf_start); 2271 gapend = ctsn + ntohs(ssf->ssf_end); 2272 2273 /* SACK for TSN we have not sent - ABORT */ 2274 if (SEQ_GT(gapstart, sctp->sctp_ltsn - 1) || 2275 SEQ_GT(gapend, sctp->sctp_ltsn - 1)) { 2276 BUMP_MIB(&sctp_mib, sctpInAckUnsent); 2277 *trysend = -1; 2278 return (acked); 2279 } else if (SEQ_LT(gapend, gapstart)) { 2280 break; 2281 } 2282 /* 2283 * The xtsn can be the TSN processed for the last gap 2284 * (gapend) or it could be the cumulative TSN. We continue 2285 * with the last xtsn as long as the gaps are ordered, when 2286 * we hit an unordered gap, we re-start from the cumulative 2287 * TSN. For the first gap it is always the cumulative TSN. 2288 */ 2289 while (xtsn != gapstart) { 2290 /* 2291 * We can't reliably check for reneged chunks 2292 * when walking the unordered list, so we don't. 2293 * In case the peer reneges then we will end up 2294 * sending the reneged chunk via timeout. 2295 */ 2296 mp = mp->b_next; 2297 if (mp == NULL) { 2298 ump = ump->b_next; 2299 /* 2300 * ump can't be NULL because of the sanity 2301 * check above. 2302 */ 2303 ASSERT(ump != NULL); 2304 mp = ump->b_cont; 2305 } 2306 /* 2307 * mp can't be unsent because of the sanity check 2308 * above. 2309 */ 2310 ASSERT(SCTP_CHUNK_ISSENT(mp)); 2311 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2312 xtsn = ntohl(sdc->sdh_tsn); 2313 } 2314 /* 2315 * Now that we have found the chunk with TSN == 'gapstart', 2316 * let's walk till we hit the chunk with TSN == 'gapend'. 2317 * All intermediate chunks will be marked ACKED, if they 2318 * haven't already been. 2319 */ 2320 while (SEQ_LEQ(xtsn, gapend)) { 2321 /* 2322 * SACKed 2323 */ 2324 SCTP_CHUNK_SET_SACKCNT(mp, 0); 2325 if (!SCTP_CHUNK_ISACKED(mp)) { 2326 SCTP_CHUNK_ACKED(mp); 2327 2328 fp = SCTP_CHUNK_DEST(mp); 2329 chunklen = ntohs(sdc->sdh_len); 2330 ASSERT(fp->suna >= chunklen); 2331 fp->suna -= chunklen; 2332 if (fp->suna == 0) { 2333 /* All outstanding data acked. */ 2334 fp->pba = 0; 2335 SCTP_FADDR_TIMER_STOP(fp); 2336 } 2337 fp->acked += chunklen; 2338 acked += chunklen; 2339 sctp->sctp_unacked -= chunklen - sizeof (*sdc); 2340 ASSERT(sctp->sctp_unacked >= 0); 2341 } 2342 /* 2343 * Move to the next message in the transmit list 2344 * if we are done with all the chunks from the current 2345 * message. Note, it is possible to hit the end of the 2346 * transmit list here, i.e. if we have already completed 2347 * processing the gap block. 2348 */ 2349 mp = mp->b_next; 2350 if (mp == NULL) { 2351 ump = ump->b_next; 2352 if (ump == NULL) { 2353 ASSERT(xtsn == gapend); 2354 break; 2355 } 2356 mp = ump->b_cont; 2357 } 2358 /* 2359 * Likewise, we can hit an unsent chunk once we have 2360 * completed processing the gap block. 2361 */ 2362 if (!SCTP_CHUNK_ISSENT(mp)) { 2363 ASSERT(xtsn == gapend); 2364 break; 2365 } 2366 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2367 xtsn = ntohl(sdc->sdh_tsn); 2368 } 2369 /* 2370 * We keep track of the last gap we successfully processed 2371 * so that we can terminate the walk below for incrementing 2372 * the SACK count. 2373 */ 2374 if (SEQ_LT(gstart, gapstart)) 2375 gstart = gapstart; 2376 } 2377 /* 2378 * Check if have incremented the SACK count for all unacked TSNs in 2379 * sctp_got_sack(), if so we are done. 2380 */ 2381 if (SEQ_LEQ(gstart, fr_xtsn)) 2382 return (acked); 2383 2384 ump = umphead; 2385 mp = mphead; 2386 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2387 xtsn = ntohl(sdc->sdh_tsn); 2388 while (SEQ_LT(xtsn, gstart)) { 2389 /* 2390 * We have incremented SACK count for TSNs less than fr_tsn 2391 * in sctp_got_sack(), so don't increment them again here. 2392 */ 2393 if (SEQ_GT(xtsn, fr_xtsn) && !SCTP_CHUNK_ISACKED(mp)) { 2394 SCTP_CHUNK_SET_SACKCNT(mp, SCTP_CHUNK_SACKCNT(mp) + 1); 2395 if (SCTP_CHUNK_SACKCNT(mp) == sctp_fast_rxt_thresh) { 2396 SCTP_CHUNK_REXMIT(mp); 2397 sctp->sctp_chk_fast_rexmit = B_TRUE; 2398 *trysend = 1; 2399 if (!*fast_recovery) { 2400 /* 2401 * Entering fast recovery. 2402 */ 2403 fp = SCTP_CHUNK_DEST(mp); 2404 fp->ssthresh = fp->cwnd / 2; 2405 if (fp->ssthresh < 2 * fp->sfa_pmss) { 2406 fp->ssthresh = 2407 2 * fp->sfa_pmss; 2408 } 2409 fp->cwnd = fp->ssthresh; 2410 fp->pba = 0; 2411 sctp->sctp_recovery_tsn = 2412 sctp->sctp_ltsn - 1; 2413 *fast_recovery = B_TRUE; 2414 } 2415 } 2416 } 2417 mp = mp->b_next; 2418 if (mp == NULL) { 2419 ump = ump->b_next; 2420 /* We can't get to the end of the transmit list here */ 2421 ASSERT(ump != NULL); 2422 mp = ump->b_cont; 2423 } 2424 /* We can't hit an unsent chunk here */ 2425 ASSERT(SCTP_CHUNK_ISSENT(mp)); 2426 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2427 xtsn = ntohl(sdc->sdh_tsn); 2428 } 2429 return (acked); 2430 } 2431 2432 static int 2433 sctp_got_sack(sctp_t *sctp, sctp_chunk_hdr_t *sch) 2434 { 2435 sctp_sack_chunk_t *sc; 2436 sctp_data_hdr_t *sdc; 2437 sctp_sack_frag_t *ssf; 2438 mblk_t *ump; 2439 mblk_t *mp; 2440 mblk_t *mp1; 2441 uint32_t cumtsn; 2442 uint32_t xtsn; 2443 uint32_t gapstart = 0; 2444 uint32_t gapend = 0; 2445 uint32_t acked = 0; 2446 uint16_t chunklen; 2447 sctp_faddr_t *fp; 2448 int num_gaps; 2449 int trysend = 0; 2450 int i; 2451 boolean_t fast_recovery = B_FALSE; 2452 boolean_t cumack_forward = B_FALSE; 2453 boolean_t fwd_tsn = B_FALSE; 2454 2455 BUMP_LOCAL(sctp->sctp_ibchunks); 2456 chunklen = ntohs(sch->sch_len); 2457 if (chunklen < (sizeof (*sch) + sizeof (*sc))) 2458 return (0); 2459 2460 sc = (sctp_sack_chunk_t *)(sch + 1); 2461 cumtsn = ntohl(sc->ssc_cumtsn); 2462 2463 dprint(2, ("got sack cumtsn %x -> %x\n", sctp->sctp_lastack_rxd, 2464 cumtsn)); 2465 2466 /* out of order */ 2467 if (SEQ_LT(cumtsn, sctp->sctp_lastack_rxd)) 2468 return (0); 2469 2470 if (SEQ_GT(cumtsn, sctp->sctp_ltsn - 1)) { 2471 BUMP_MIB(&sctp_mib, sctpInAckUnsent); 2472 /* Send an ABORT */ 2473 return (-1); 2474 } 2475 2476 /* 2477 * Cwnd only done when not in fast recovery mode. 2478 */ 2479 if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_recovery_tsn)) 2480 fast_recovery = B_TRUE; 2481 2482 /* 2483 * .. and if the cum TSN is not moving ahead on account Forward TSN 2484 */ 2485 if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_adv_pap)) 2486 fwd_tsn = B_TRUE; 2487 2488 if (cumtsn == sctp->sctp_lastack_rxd && 2489 (sctp->sctp_xmit_unacked == NULL || 2490 !SCTP_CHUNK_ABANDONED(sctp->sctp_xmit_unacked))) { 2491 if (sctp->sctp_xmit_unacked != NULL) 2492 mp = sctp->sctp_xmit_unacked; 2493 else if (sctp->sctp_xmit_head != NULL) 2494 mp = sctp->sctp_xmit_head->b_cont; 2495 else 2496 mp = NULL; 2497 BUMP_MIB(&sctp_mib, sctpInDupAck); 2498 /* 2499 * If we were doing a zero win probe and the win 2500 * has now opened to at least MSS, re-transmit the 2501 * zero win probe via sctp_rexmit_packet(). 2502 */ 2503 if (mp != NULL && sctp->sctp_zero_win_probe && 2504 ntohl(sc->ssc_a_rwnd) >= sctp->sctp_current->sfa_pmss) { 2505 mblk_t *pkt; 2506 uint_t pkt_len; 2507 mblk_t *mp1 = mp; 2508 mblk_t *meta = sctp->sctp_xmit_head; 2509 2510 /* 2511 * Reset the RTO since we have been backing-off 2512 * to send the ZWP. 2513 */ 2514 fp = sctp->sctp_current; 2515 fp->rto = fp->srtt + 4 * fp->rttvar; 2516 /* Resend the ZWP */ 2517 pkt = sctp_rexmit_packet(sctp, &meta, &mp1, fp, 2518 &pkt_len); 2519 if (pkt == NULL) { 2520 SCTP_KSTAT(sctp_ss_rexmit_failed); 2521 return (0); 2522 } 2523 ASSERT(pkt_len <= fp->sfa_pmss); 2524 sctp->sctp_zero_win_probe = B_FALSE; 2525 sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn; 2526 sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn; 2527 sctp_set_iplen(sctp, pkt); 2528 sctp_add_sendq(sctp, pkt); 2529 } 2530 } else { 2531 if (sctp->sctp_zero_win_probe) { 2532 /* 2533 * Reset the RTO since we have been backing-off 2534 * to send the ZWP. 2535 */ 2536 fp = sctp->sctp_current; 2537 fp->rto = fp->srtt + 4 * fp->rttvar; 2538 sctp->sctp_zero_win_probe = B_FALSE; 2539 /* This is probably not required */ 2540 if (!sctp->sctp_rexmitting) { 2541 sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn; 2542 sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn; 2543 } 2544 } 2545 acked = sctp_cumack(sctp, cumtsn, &mp); 2546 sctp->sctp_xmit_unacked = mp; 2547 if (acked > 0) { 2548 trysend = 1; 2549 cumack_forward = B_TRUE; 2550 if (fwd_tsn && SEQ_GEQ(sctp->sctp_lastack_rxd, 2551 sctp->sctp_adv_pap)) { 2552 cumack_forward = B_FALSE; 2553 } 2554 } 2555 } 2556 num_gaps = ntohs(sc->ssc_numfrags); 2557 if (num_gaps == 0 || mp == NULL || !SCTP_CHUNK_ISSENT(mp) || 2558 chunklen < (sizeof (*sch) + sizeof (*sc) + 2559 num_gaps * sizeof (*ssf))) { 2560 goto ret; 2561 } 2562 #ifdef DEBUG 2563 /* 2564 * Since we delete any message that has been acked completely, 2565 * the unacked chunk must belong to sctp_xmit_head (as 2566 * we don't have a back pointer from the mp to the meta data 2567 * we do this). 2568 */ 2569 { 2570 mblk_t *mp2 = sctp->sctp_xmit_head->b_cont; 2571 2572 while (mp2 != NULL) { 2573 if (mp2 == mp) 2574 break; 2575 mp2 = mp2->b_next; 2576 } 2577 ASSERT(mp2 != NULL); 2578 } 2579 #endif 2580 ump = sctp->sctp_xmit_head; 2581 2582 /* 2583 * Just remember where we started from, in case we need to call 2584 * sctp_process_uo_gaps() if the gap blocks are unordered. 2585 */ 2586 mp1 = mp; 2587 2588 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2589 xtsn = ntohl(sdc->sdh_tsn); 2590 ASSERT(xtsn == cumtsn + 1); 2591 2592 /* 2593 * Go through SACK gaps. They are ordered based on start TSN. 2594 */ 2595 ssf = (sctp_sack_frag_t *)(sc + 1); 2596 for (i = 0; i < num_gaps; i++, ssf++) { 2597 if (gapstart != 0) { 2598 /* check for unordered gap */ 2599 if (SEQ_LEQ(cumtsn + ntohs(ssf->ssf_start), gapstart)) { 2600 acked += sctp_process_uo_gaps(sctp, 2601 cumtsn, ssf, num_gaps - i, 2602 sctp->sctp_xmit_head, mp1, 2603 &trysend, &fast_recovery, gapstart); 2604 if (trysend < 0) { 2605 BUMP_MIB(&sctp_mib, sctpInAckUnsent); 2606 return (-1); 2607 } 2608 break; 2609 } 2610 } 2611 gapstart = cumtsn + ntohs(ssf->ssf_start); 2612 gapend = cumtsn + ntohs(ssf->ssf_end); 2613 2614 /* SACK for TSN we have not sent - ABORT */ 2615 if (SEQ_GT(gapstart, sctp->sctp_ltsn - 1) || 2616 SEQ_GT(gapend, sctp->sctp_ltsn - 1)) { 2617 BUMP_MIB(&sctp_mib, sctpInAckUnsent); 2618 return (-1); 2619 } else if (SEQ_LT(gapend, gapstart)) { 2620 break; 2621 } 2622 /* 2623 * Let's start at the current TSN (for the 1st gap we start 2624 * from the cumulative TSN, for subsequent ones we start from 2625 * where the previous gapend was found - second while loop 2626 * below) and walk the transmit list till we find the TSN 2627 * corresponding to gapstart. All the unacked chunks till we 2628 * get to the chunk with TSN == gapstart will have their 2629 * SACKCNT incremented by 1. Note since the gap blocks are 2630 * ordered, we won't be incrementing the SACKCNT for an 2631 * unacked chunk by more than one while processing the gap 2632 * blocks. If the SACKCNT for any unacked chunk exceeds 2633 * the fast retransmit threshold, we will fast retransmit 2634 * after processing all the gap blocks. 2635 */ 2636 ASSERT(SEQ_LT(xtsn, gapstart)); 2637 while (xtsn != gapstart) { 2638 SCTP_CHUNK_SET_SACKCNT(mp, SCTP_CHUNK_SACKCNT(mp) + 1); 2639 if (SCTP_CHUNK_SACKCNT(mp) == sctp_fast_rxt_thresh) { 2640 SCTP_CHUNK_REXMIT(mp); 2641 sctp->sctp_chk_fast_rexmit = B_TRUE; 2642 trysend = 1; 2643 if (!fast_recovery) { 2644 /* 2645 * Entering fast recovery. 2646 */ 2647 fp = SCTP_CHUNK_DEST(mp); 2648 fp->ssthresh = fp->cwnd / 2; 2649 if (fp->ssthresh < 2 * fp->sfa_pmss) { 2650 fp->ssthresh = 2651 2 * fp->sfa_pmss; 2652 } 2653 fp->cwnd = fp->ssthresh; 2654 fp->pba = 0; 2655 sctp->sctp_recovery_tsn = 2656 sctp->sctp_ltsn - 1; 2657 fast_recovery = B_TRUE; 2658 } 2659 } 2660 2661 /* 2662 * Peer may have reneged on this chunk, so un-sack 2663 * it now. If the peer did renege, we need to 2664 * readjust unacked. 2665 */ 2666 if (SCTP_CHUNK_ISACKED(mp)) { 2667 chunklen = ntohs(sdc->sdh_len); 2668 fp = SCTP_CHUNK_DEST(mp); 2669 fp->suna += chunklen; 2670 sctp->sctp_unacked += chunklen - sizeof (*sdc); 2671 SCTP_CHUNK_CLEAR_ACKED(mp); 2672 if (!fp->timer_running) { 2673 SCTP_FADDR_TIMER_RESTART(sctp, fp, 2674 fp->rto); 2675 } 2676 } 2677 2678 mp = mp->b_next; 2679 if (mp == NULL) { 2680 ump = ump->b_next; 2681 /* 2682 * ump can't be NULL given the sanity check 2683 * above. 2684 */ 2685 ASSERT(ump != NULL); 2686 mp = ump->b_cont; 2687 } 2688 /* 2689 * mp can't be unsent given the sanity check above. 2690 */ 2691 ASSERT(SCTP_CHUNK_ISSENT(mp)); 2692 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2693 xtsn = ntohl(sdc->sdh_tsn); 2694 } 2695 /* 2696 * Now that we have found the chunk with TSN == 'gapstart', 2697 * let's walk till we hit the chunk with TSN == 'gapend'. 2698 * All intermediate chunks will be marked ACKED, if they 2699 * haven't already been. 2700 */ 2701 while (SEQ_LEQ(xtsn, gapend)) { 2702 /* 2703 * SACKed 2704 */ 2705 SCTP_CHUNK_SET_SACKCNT(mp, 0); 2706 if (!SCTP_CHUNK_ISACKED(mp)) { 2707 SCTP_CHUNK_ACKED(mp); 2708 2709 fp = SCTP_CHUNK_DEST(mp); 2710 chunklen = ntohs(sdc->sdh_len); 2711 ASSERT(fp->suna >= chunklen); 2712 fp->suna -= chunklen; 2713 if (fp->suna == 0) { 2714 /* All outstanding data acked. */ 2715 fp->pba = 0; 2716 SCTP_FADDR_TIMER_STOP(fp); 2717 } 2718 fp->acked += chunklen; 2719 acked += chunklen; 2720 sctp->sctp_unacked -= chunklen - sizeof (*sdc); 2721 ASSERT(sctp->sctp_unacked >= 0); 2722 } 2723 /* Go to the next chunk of the current message */ 2724 mp = mp->b_next; 2725 /* 2726 * Move to the next message in the transmit list 2727 * if we are done with all the chunks from the current 2728 * message. Note, it is possible to hit the end of the 2729 * transmit list here, i.e. if we have already completed 2730 * processing the gap block. 2731 * Also, note that we break here, which means we 2732 * continue processing gap blocks, if any. In case of 2733 * ordered gap blocks there can't be any following 2734 * this (if there is it will fail the sanity check 2735 * above). In case of un-ordered gap blocks we will 2736 * switch to sctp_process_uo_gaps(). In either case 2737 * it should be fine to continue with NULL ump/mp, 2738 * but we just reset it to xmit_head. 2739 */ 2740 if (mp == NULL) { 2741 ump = ump->b_next; 2742 if (ump == NULL) { 2743 ASSERT(xtsn == gapend); 2744 ump = sctp->sctp_xmit_head; 2745 mp = mp1; 2746 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2747 xtsn = ntohl(sdc->sdh_tsn); 2748 break; 2749 } 2750 mp = ump->b_cont; 2751 } 2752 /* 2753 * Likewise, we could hit an unsent chunk once we have 2754 * completed processing the gap block. Again, it is 2755 * fine to continue processing gap blocks with mp 2756 * pointing to the unsent chunk, because if there 2757 * are more ordered gap blocks, they will fail the 2758 * sanity check, and if there are un-ordered gap blocks, 2759 * we will continue processing in sctp_process_uo_gaps() 2760 * We just reset the mp to the one we started with. 2761 */ 2762 if (!SCTP_CHUNK_ISSENT(mp)) { 2763 ASSERT(xtsn == gapend); 2764 ump = sctp->sctp_xmit_head; 2765 mp = mp1; 2766 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2767 xtsn = ntohl(sdc->sdh_tsn); 2768 break; 2769 } 2770 sdc = (sctp_data_hdr_t *)mp->b_rptr; 2771 xtsn = ntohl(sdc->sdh_tsn); 2772 } 2773 } 2774 if (sctp->sctp_prsctp_aware) 2775 sctp_check_abandoned_data(sctp, sctp->sctp_current); 2776 if (sctp->sctp_chk_fast_rexmit) 2777 sctp_fast_rexmit(sctp); 2778 ret: 2779 trysend += sctp_set_frwnd(sctp, ntohl(sc->ssc_a_rwnd)); 2780 2781 /* 2782 * If receive window is closed while there is unsent data, 2783 * set a timer for doing zero window probes. 2784 */ 2785 if (sctp->sctp_frwnd == 0 && sctp->sctp_unacked == 0 && 2786 sctp->sctp_unsent != 0) { 2787 SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current, 2788 sctp->sctp_current->rto); 2789 } 2790 2791 /* 2792 * Set cwnd for all destinations. 2793 * Congestion window gets increased only when cumulative 2794 * TSN moves forward, we're not in fast recovery, and 2795 * cwnd has been fully utilized (almost fully, need to allow 2796 * some leeway due to non-MSS sized messages). 2797 */ 2798 if (sctp->sctp_current->acked == acked) { 2799 /* 2800 * Fast-path, only data sent to sctp_current got acked. 2801 */ 2802 fp = sctp->sctp_current; 2803 if (cumack_forward && !fast_recovery && 2804 (fp->acked + fp->suna > fp->cwnd - fp->sfa_pmss)) { 2805 if (fp->cwnd < fp->ssthresh) { 2806 /* 2807 * Slow start 2808 */ 2809 if (fp->acked > fp->sfa_pmss) { 2810 fp->cwnd += fp->sfa_pmss; 2811 } else { 2812 fp->cwnd += fp->acked; 2813 } 2814 fp->cwnd = MIN(fp->cwnd, sctp->sctp_cwnd_max); 2815 } else { 2816 /* 2817 * Congestion avoidance 2818 */ 2819 fp->pba += fp->acked; 2820 if (fp->pba >= fp->cwnd) { 2821 fp->pba -= fp->cwnd; 2822 fp->cwnd += fp->sfa_pmss; 2823 fp->cwnd = MIN(fp->cwnd, 2824 sctp->sctp_cwnd_max); 2825 } 2826 } 2827 } 2828 /* 2829 * Limit the burst of transmitted data segments. 2830 */ 2831 if (fp->suna + sctp_maxburst * fp->sfa_pmss < fp->cwnd) { 2832 fp->cwnd = fp->suna + sctp_maxburst * fp->sfa_pmss; 2833 } 2834 fp->acked = 0; 2835 goto check_ss_rxmit; 2836 } 2837 for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) { 2838 if (cumack_forward && fp->acked && !fast_recovery && 2839 (fp->acked + fp->suna > fp->cwnd - fp->sfa_pmss)) { 2840 if (fp->cwnd < fp->ssthresh) { 2841 if (fp->acked > fp->sfa_pmss) { 2842 fp->cwnd += fp->sfa_pmss; 2843 } else { 2844 fp->cwnd += fp->acked; 2845 } 2846 fp->cwnd = MIN(fp->cwnd, sctp->sctp_cwnd_max); 2847 } else { 2848 fp->pba += fp->acked; 2849 if (fp->pba >= fp->cwnd) { 2850 fp->pba -= fp->cwnd; 2851 fp->cwnd += fp->sfa_pmss; 2852 fp->cwnd = MIN(fp->cwnd, 2853 sctp->sctp_cwnd_max); 2854 } 2855 } 2856 } 2857 if (fp->suna + sctp_maxburst * fp->sfa_pmss < fp->cwnd) { 2858 fp->cwnd = fp->suna + sctp_maxburst * fp->sfa_pmss; 2859 } 2860 fp->acked = 0; 2861 } 2862 check_ss_rxmit: 2863 /* 2864 * If this is a SACK following a timeout, check if there are 2865 * still unacked chunks (sent before the timeout) that we can 2866 * send. 2867 */ 2868 if (sctp->sctp_rexmitting) { 2869 if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_rxt_maxtsn)) { 2870 /* 2871 * As we are in retransmission phase, we may get a 2872 * SACK which indicates some new chunks are received 2873 * but cum_tsn does not advance. During this 2874 * phase, the other side advances cum_tsn only because 2875 * it receives our retransmitted chunks. Only 2876 * this signals that some chunks are still 2877 * missing. 2878 */ 2879 if (cumack_forward) 2880 sctp_ss_rexmit(sctp); 2881 } else { 2882 sctp->sctp_rexmitting = B_FALSE; 2883 sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn; 2884 sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn; 2885 } 2886 } 2887 return (trysend); 2888 } 2889 2890 /* 2891 * Returns 0 if the caller should stop processing any more chunks, 2892 * 1 if the caller should skip this chunk and continue processing. 2893 */ 2894 static int 2895 sctp_strange_chunk(sctp_t *sctp, sctp_chunk_hdr_t *ch, sctp_faddr_t *fp) 2896 { 2897 mblk_t *errmp; 2898 size_t len; 2899 2900 BUMP_LOCAL(sctp->sctp_ibchunks); 2901 /* check top two bits for action required */ 2902 if (ch->sch_id & 0x40) { /* also matches 0xc0 */ 2903 len = ntohs(ch->sch_len); 2904 errmp = sctp_make_err(sctp, SCTP_ERR_UNREC_CHUNK, ch, len); 2905 if (errmp != NULL) 2906 sctp_send_err(sctp, errmp, fp); 2907 if ((ch->sch_id & 0xc0) == 0xc0) { 2908 /* skip and continue */ 2909 return (1); 2910 } else { 2911 /* stop processing */ 2912 return (0); 2913 } 2914 } 2915 if (ch->sch_id & 0x80) { 2916 /* skip and continue, no error */ 2917 return (1); 2918 } 2919 /* top two bits are clear; stop processing and no error */ 2920 return (0); 2921 } 2922 2923 /* 2924 * Basic sanity checks on all input chunks and parameters: they must 2925 * be of legitimate size for their purported type, and must follow 2926 * ordering conventions as defined in rfc2960. 2927 * 2928 * Returns 1 if the chunk and all encloded params are legitimate, 2929 * 0 otherwise. 2930 */ 2931 /*ARGSUSED*/ 2932 static int 2933 sctp_check_input(sctp_t *sctp, sctp_chunk_hdr_t *ch, ssize_t len, int first) 2934 { 2935 sctp_parm_hdr_t *ph; 2936 void *p = NULL; 2937 ssize_t clen; 2938 uint16_t ch_len; 2939 2940 ch_len = ntohs(ch->sch_len); 2941 if (ch_len > len) { 2942 return (0); 2943 } 2944 2945 switch (ch->sch_id) { 2946 case CHUNK_DATA: 2947 if (ch_len < sizeof (sctp_data_hdr_t)) { 2948 return (0); 2949 } 2950 return (1); 2951 case CHUNK_INIT: 2952 case CHUNK_INIT_ACK: 2953 { 2954 ssize_t remlen = len; 2955 2956 /* 2957 * INIT and INIT-ACK chunks must not be bundled with 2958 * any other. 2959 */ 2960 if (!first || sctp_next_chunk(ch, &remlen) != NULL || 2961 (ch_len < (sizeof (*ch) + 2962 sizeof (sctp_init_chunk_t)))) { 2963 return (0); 2964 } 2965 /* may have params that need checking */ 2966 p = (char *)(ch + 1) + sizeof (sctp_init_chunk_t); 2967 clen = ch_len - (sizeof (*ch) + 2968 sizeof (sctp_init_chunk_t)); 2969 } 2970 break; 2971 case CHUNK_SACK: 2972 if (ch_len < (sizeof (*ch) + sizeof (sctp_sack_chunk_t))) { 2973 return (0); 2974 } 2975 /* dup and gap reports checked by got_sack() */ 2976 return (1); 2977 case CHUNK_SHUTDOWN: 2978 if (ch_len < (sizeof (*ch) + sizeof (uint32_t))) { 2979 return (0); 2980 } 2981 return (1); 2982 case CHUNK_ABORT: 2983 case CHUNK_ERROR: 2984 if (ch_len < sizeof (*ch)) { 2985 return (0); 2986 } 2987 /* may have params that need checking */ 2988 p = ch + 1; 2989 clen = ch_len - sizeof (*ch); 2990 break; 2991 case CHUNK_ECNE: 2992 case CHUNK_CWR: 2993 case CHUNK_HEARTBEAT: 2994 case CHUNK_HEARTBEAT_ACK: 2995 /* Full ASCONF chunk and parameter checks are in asconf.c */ 2996 case CHUNK_ASCONF: 2997 case CHUNK_ASCONF_ACK: 2998 if (ch_len < sizeof (*ch)) { 2999 return (0); 3000 } 3001 /* heartbeat data checked by process_heartbeat() */ 3002 return (1); 3003 case CHUNK_SHUTDOWN_COMPLETE: 3004 { 3005 ssize_t remlen = len; 3006 3007 /* 3008 * SHUTDOWN-COMPLETE chunk must not be bundled with any 3009 * other 3010 */ 3011 if (!first || sctp_next_chunk(ch, &remlen) != NULL || 3012 ch_len < sizeof (*ch)) { 3013 return (0); 3014 } 3015 } 3016 return (1); 3017 case CHUNK_COOKIE: 3018 case CHUNK_COOKIE_ACK: 3019 case CHUNK_SHUTDOWN_ACK: 3020 if (ch_len < sizeof (*ch) || !first) { 3021 return (0); 3022 } 3023 return (1); 3024 case CHUNK_FORWARD_TSN: 3025 if (ch_len < (sizeof (*ch) + sizeof (uint32_t))) 3026 return (0); 3027 return (1); 3028 default: 3029 return (1); /* handled by strange_chunk() */ 3030 } 3031 3032 /* check and byteorder parameters */ 3033 if (clen <= 0) { 3034 return (1); 3035 } 3036 ASSERT(p != NULL); 3037 3038 ph = p; 3039 while (ph != NULL && clen > 0) { 3040 ch_len = ntohs(ph->sph_len); 3041 if (ch_len > len || ch_len < sizeof (*ph)) { 3042 return (0); 3043 } 3044 ph = sctp_next_parm(ph, &clen); 3045 } 3046 3047 /* All OK */ 3048 return (1); 3049 } 3050 3051 /* ARGSUSED */ 3052 static sctp_hdr_t * 3053 find_sctp_hdrs(mblk_t *mp, in6_addr_t *src, in6_addr_t *dst, 3054 uint_t *ifindex, uint_t *ip_hdr_len, ip6_pkt_t *ipp, in_pktinfo_t *pinfo) 3055 { 3056 uchar_t *rptr; 3057 ipha_t *ip4h; 3058 ip6_t *ip6h; 3059 mblk_t *mp1; 3060 3061 rptr = mp->b_rptr; 3062 if (IPH_HDR_VERSION(rptr) == IPV4_VERSION) { 3063 *ip_hdr_len = IPH_HDR_LENGTH(rptr); 3064 ip4h = (ipha_t *)rptr; 3065 IN6_IPADDR_TO_V4MAPPED(ip4h->ipha_src, src); 3066 IN6_IPADDR_TO_V4MAPPED(ip4h->ipha_dst, dst); 3067 3068 ipp->ipp_fields |= IPPF_HOPLIMIT; 3069 ipp->ipp_hoplimit = ((ipha_t *)rptr)->ipha_ttl; 3070 if (pinfo != NULL && (pinfo->in_pkt_flags & IPF_RECVIF)) { 3071 ipp->ipp_fields |= IPPF_IFINDEX; 3072 ipp->ipp_ifindex = pinfo->in_pkt_ifindex; 3073 } 3074 } else { 3075 ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION); 3076 ip6h = (ip6_t *)rptr; 3077 ipp->ipp_fields = IPPF_HOPLIMIT; 3078 ipp->ipp_hoplimit = ip6h->ip6_hops; 3079 3080 if (ip6h->ip6_nxt != IPPROTO_SCTP) { 3081 /* Look for ifindex information */ 3082 if (ip6h->ip6_nxt == IPPROTO_RAW) { 3083 ip6i_t *ip6i = (ip6i_t *)ip6h; 3084 3085 if (ip6i->ip6i_flags & IP6I_IFINDEX) { 3086 ASSERT(ip6i->ip6i_ifindex != 0); 3087 ipp->ipp_fields |= IPPF_IFINDEX; 3088 ipp->ipp_ifindex = ip6i->ip6i_ifindex; 3089 } 3090 rptr = (uchar_t *)&ip6i[1]; 3091 mp->b_rptr = rptr; 3092 if (rptr == mp->b_wptr) { 3093 mp1 = mp->b_cont; 3094 freeb(mp); 3095 mp = mp1; 3096 rptr = mp->b_rptr; 3097 } 3098 ASSERT(mp->b_wptr - rptr >= 3099 IPV6_HDR_LEN + sizeof (sctp_hdr_t)); 3100 ip6h = (ip6_t *)rptr; 3101 } 3102 /* 3103 * Find any potentially interesting extension headers 3104 * as well as the length of the IPv6 + extension 3105 * headers. 3106 */ 3107 *ip_hdr_len = ip_find_hdr_v6(mp, ip6h, ipp, NULL); 3108 } else { 3109 *ip_hdr_len = IPV6_HDR_LEN; 3110 } 3111 *src = ip6h->ip6_src; 3112 *dst = ip6h->ip6_dst; 3113 } 3114 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 3115 return ((sctp_hdr_t *)&rptr[*ip_hdr_len]); 3116 #undef IPVER 3117 } 3118 3119 static mblk_t * 3120 sctp_check_in_policy(mblk_t *mp, mblk_t *ipsec_mp) 3121 { 3122 ipsec_in_t *ii; 3123 boolean_t check = B_TRUE; 3124 boolean_t policy_present; 3125 ipha_t *ipha; 3126 ip6_t *ip6h; 3127 3128 ii = (ipsec_in_t *)ipsec_mp->b_rptr; 3129 ASSERT(ii->ipsec_in_type == IPSEC_IN); 3130 if (ii->ipsec_in_dont_check) { 3131 check = B_FALSE; 3132 if (!ii->ipsec_in_secure) { 3133 freeb(ipsec_mp); 3134 ipsec_mp = NULL; 3135 } 3136 } 3137 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 3138 policy_present = ipsec_inbound_v4_policy_present; 3139 ipha = (ipha_t *)mp->b_rptr; 3140 ip6h = NULL; 3141 } else { 3142 policy_present = ipsec_inbound_v6_policy_present; 3143 ipha = NULL; 3144 ip6h = (ip6_t *)mp->b_rptr; 3145 } 3146 3147 if (check && policy_present) { 3148 /* 3149 * The conn_t parameter is NULL because we already know 3150 * nobody's home. 3151 */ 3152 ipsec_mp = ipsec_check_global_policy(ipsec_mp, (conn_t *)NULL, 3153 ipha, ip6h, B_TRUE); 3154 if (ipsec_mp == NULL) 3155 return (NULL); 3156 } 3157 if (ipsec_mp != NULL) 3158 freeb(ipsec_mp); 3159 return (mp); 3160 } 3161 3162 /* Handle out-of-the-blue packets */ 3163 void 3164 sctp_ootb_input(mblk_t *mp, ill_t *recv_ill, uint_t ipif_seqid, 3165 zoneid_t zoneid, boolean_t mctl_present) 3166 { 3167 sctp_t *sctp; 3168 sctp_chunk_hdr_t *ch; 3169 sctp_hdr_t *sctph; 3170 in6_addr_t src, dst; 3171 uint_t ip_hdr_len; 3172 uint_t ifindex; 3173 ip6_pkt_t ipp; 3174 ssize_t mlen; 3175 in_pktinfo_t *pinfo = NULL; 3176 mblk_t *first_mp; 3177 3178 BUMP_MIB(&sctp_mib, sctpOutOfBlue); 3179 BUMP_MIB(&sctp_mib, sctpInSCTPPkts); 3180 3181 first_mp = mp; 3182 if (mctl_present) 3183 mp = mp->b_cont; 3184 3185 /* Initiate IPPf processing, if needed. */ 3186 if (IPP_ENABLED(IPP_LOCAL_IN)) { 3187 ip_process(IPP_LOCAL_IN, &mp, 3188 recv_ill->ill_phyint->phyint_ifindex); 3189 if (mp == NULL) { 3190 if (mctl_present) 3191 freeb(first_mp); 3192 return; 3193 } 3194 } 3195 3196 if (mp->b_cont != NULL) { 3197 /* 3198 * All subsequent code is vastly simplified if it can 3199 * assume a single contiguous chunk of data. 3200 */ 3201 if (pullupmsg(mp, -1) == 0) { 3202 BUMP_MIB(&ip_mib, ipInDiscards); 3203 freemsg(first_mp); 3204 return; 3205 } 3206 } 3207 3208 /* 3209 * We don't really need to call this function... Need to 3210 * optimize later. 3211 */ 3212 sctph = find_sctp_hdrs(mp, &src, &dst, &ifindex, &ip_hdr_len, 3213 &ipp, pinfo); 3214 mlen = mp->b_wptr - (uchar_t *)(sctph + 1); 3215 if ((ch = sctp_first_chunk((uchar_t *)(sctph + 1), mlen)) == NULL) { 3216 dprint(3, ("sctp_ootb_input: invalid packet\n")); 3217 BUMP_MIB(&ip_mib, ipInDiscards); 3218 freemsg(first_mp); 3219 return; 3220 } 3221 3222 switch (ch->sch_id) { 3223 case CHUNK_INIT: 3224 /* no listener; send abort */ 3225 if (mctl_present && sctp_check_in_policy(mp, first_mp) == NULL) 3226 return; 3227 sctp_send_abort(gsctp, sctp_init2vtag(ch), 0, 3228 NULL, 0, mp, 0, B_TRUE); 3229 break; 3230 case CHUNK_INIT_ACK: 3231 /* check for changed src addr */ 3232 sctp = sctp_addrlist2sctp(mp, sctph, ch, ipif_seqid, zoneid); 3233 if (sctp != NULL) { 3234 /* success; proceed to normal path */ 3235 mutex_enter(&sctp->sctp_lock); 3236 if (sctp->sctp_running) { 3237 if (!sctp_add_recvq(sctp, mp, B_FALSE)) { 3238 BUMP_MIB(&ip_mib, ipInDiscards); 3239 freemsg(mp); 3240 } 3241 mutex_exit(&sctp->sctp_lock); 3242 } else { 3243 /* 3244 * If the source address is changed, we 3245 * don't need to worry too much about 3246 * out of order processing. So we don't 3247 * check if the recvq is empty or not here. 3248 */ 3249 sctp->sctp_running = B_TRUE; 3250 mutex_exit(&sctp->sctp_lock); 3251 sctp_input_data(sctp, mp, NULL); 3252 WAKE_SCTP(sctp); 3253 sctp_process_sendq(sctp); 3254 } 3255 SCTP_REFRELE(sctp); 3256 return; 3257 } 3258 if (mctl_present) 3259 freeb(first_mp); 3260 /* else bogus init ack; drop it */ 3261 break; 3262 case CHUNK_SHUTDOWN_ACK: 3263 if (mctl_present && sctp_check_in_policy(mp, first_mp) == NULL) 3264 return; 3265 sctp_ootb_shutdown_ack(gsctp, mp, ip_hdr_len); 3266 sctp_process_sendq(gsctp); 3267 return; 3268 case CHUNK_ERROR: 3269 case CHUNK_ABORT: 3270 case CHUNK_COOKIE_ACK: 3271 case CHUNK_SHUTDOWN_COMPLETE: 3272 if (mctl_present) 3273 freeb(first_mp); 3274 break; 3275 default: 3276 if (mctl_present && sctp_check_in_policy(mp, first_mp) == NULL) 3277 return; 3278 sctp_send_abort(gsctp, sctph->sh_verf, 0, NULL, 0, mp, 0, 3279 B_TRUE); 3280 break; 3281 } 3282 sctp_process_sendq(gsctp); 3283 freemsg(mp); 3284 } 3285 3286 void 3287 sctp_input(conn_t *connp, ipha_t *ipha, mblk_t *mp, mblk_t *first_mp, 3288 ill_t *recv_ill, boolean_t isv4, boolean_t mctl_present) 3289 { 3290 sctp_t *sctp = CONN2SCTP(connp); 3291 3292 /* 3293 * We check some fields in conn_t without holding a lock. 3294 * This should be fine. 3295 */ 3296 if (CONN_INBOUND_POLICY_PRESENT(connp) || mctl_present) { 3297 first_mp = ipsec_check_inbound_policy(first_mp, connp, 3298 ipha, NULL, mctl_present); 3299 if (first_mp == NULL) { 3300 SCTP_REFRELE(sctp); 3301 return; 3302 } 3303 } 3304 3305 /* Initiate IPPF processing for fastpath */ 3306 if (IPP_ENABLED(IPP_LOCAL_IN)) { 3307 ip_process(IPP_LOCAL_IN, &mp, 3308 recv_ill->ill_phyint->phyint_ifindex); 3309 if (mp == NULL) { 3310 SCTP_REFRELE(sctp); 3311 if (mctl_present) 3312 freeb(first_mp); 3313 return; 3314 } else if (mctl_present) { 3315 /* 3316 * ip_process might return a new mp. 3317 */ 3318 ASSERT(first_mp != mp); 3319 first_mp->b_cont = mp; 3320 } else { 3321 first_mp = mp; 3322 } 3323 } 3324 3325 if (connp->conn_recvif || connp->conn_recvslla || 3326 connp->conn_ipv6_recvpktinfo) { 3327 int in_flags = 0; 3328 3329 if (connp->conn_recvif || connp->conn_ipv6_recvpktinfo) { 3330 in_flags = IPF_RECVIF; 3331 } 3332 if (connp->conn_recvslla) { 3333 in_flags |= IPF_RECVSLLA; 3334 } 3335 if (isv4) { 3336 mp = ip_add_info(mp, recv_ill, in_flags); 3337 } else { 3338 mp = ip_add_info_v6(mp, recv_ill, 3339 &(((ip6_t *)ipha)->ip6_dst)); 3340 } 3341 if (mp == NULL) { 3342 SCTP_REFRELE(sctp); 3343 if (mctl_present) 3344 freeb(first_mp); 3345 return; 3346 } else if (mctl_present) { 3347 /* 3348 * ip_add_info might return a new mp. 3349 */ 3350 ASSERT(first_mp != mp); 3351 first_mp->b_cont = mp; 3352 } else { 3353 first_mp = mp; 3354 } 3355 } 3356 3357 mutex_enter(&sctp->sctp_lock); 3358 if (sctp->sctp_running) { 3359 if (mctl_present) 3360 mp->b_prev = first_mp; 3361 if (!sctp_add_recvq(sctp, mp, B_FALSE)) { 3362 BUMP_MIB(&ip_mib, ipInDiscards); 3363 freemsg(first_mp); 3364 } 3365 mutex_exit(&sctp->sctp_lock); 3366 SCTP_REFRELE(sctp); 3367 return; 3368 } else { 3369 sctp->sctp_running = B_TRUE; 3370 mutex_exit(&sctp->sctp_lock); 3371 3372 mutex_enter(&sctp->sctp_recvq_lock); 3373 if (sctp->sctp_recvq != NULL) { 3374 if (mctl_present) 3375 mp->b_prev = first_mp; 3376 if (!sctp_add_recvq(sctp, mp, B_TRUE)) { 3377 BUMP_MIB(&ip_mib, ipInDiscards); 3378 freemsg(first_mp); 3379 } 3380 mutex_exit(&sctp->sctp_recvq_lock); 3381 WAKE_SCTP(sctp); 3382 SCTP_REFRELE(sctp); 3383 return; 3384 } 3385 } 3386 mutex_exit(&sctp->sctp_recvq_lock); 3387 sctp_input_data(sctp, mp, (mctl_present ? first_mp : NULL)); 3388 WAKE_SCTP(sctp); 3389 sctp_process_sendq(sctp); 3390 SCTP_REFRELE(sctp); 3391 } 3392 3393 static void 3394 sctp_process_abort(sctp_t *sctp, sctp_chunk_hdr_t *ch, int err) 3395 { 3396 BUMP_MIB(&sctp_mib, sctpAborted); 3397 BUMP_LOCAL(sctp->sctp_ibchunks); 3398 3399 sctp_assoc_event(sctp, SCTP_COMM_LOST, 3400 ntohs(((sctp_parm_hdr_t *)(ch + 1))->sph_type), ch); 3401 sctp_clean_death(sctp, err); 3402 } 3403 3404 void 3405 sctp_input_data(sctp_t *sctp, mblk_t *mp, mblk_t *ipsec_mp) 3406 { 3407 sctp_chunk_hdr_t *ch; 3408 ssize_t mlen; 3409 int gotdata; 3410 int trysend; 3411 sctp_faddr_t *fp; 3412 sctp_init_chunk_t *iack; 3413 uint32_t tsn; 3414 sctp_data_hdr_t *sdc; 3415 ip6_pkt_t ipp; 3416 in6_addr_t src; 3417 in6_addr_t dst; 3418 uint_t ifindex; 3419 sctp_hdr_t *sctph; 3420 uint_t ip_hdr_len; 3421 mblk_t *dups = NULL; 3422 int recv_adaption; 3423 boolean_t wake_eager = B_FALSE; 3424 mblk_t *pinfo_mp; 3425 in_pktinfo_t *pinfo = NULL; 3426 in6_addr_t peer_src; 3427 int64_t now; 3428 3429 if (DB_TYPE(mp) != M_DATA) { 3430 ASSERT(DB_TYPE(mp) == M_CTL); 3431 if (MBLKL(mp) == sizeof (in_pktinfo_t) && 3432 ((in_pktinfo_t *)mp->b_rptr)->in_pkt_ulp_type == 3433 IN_PKTINFO) { 3434 pinfo = (in_pktinfo_t *)mp->b_rptr; 3435 pinfo_mp = mp; 3436 mp = mp->b_cont; 3437 } else { 3438 if (ipsec_mp != NULL) 3439 freeb(ipsec_mp); 3440 sctp_icmp_error(sctp, mp); 3441 return; 3442 } 3443 } 3444 ASSERT(DB_TYPE(mp) == M_DATA); 3445 3446 if (mp->b_cont != NULL) { 3447 /* 3448 * All subsequent code is vastly simplified if it can 3449 * assume a single contiguous chunk of data. 3450 */ 3451 if (pullupmsg(mp, -1) == 0) { 3452 BUMP_MIB(&ip_mib, ipInDiscards); 3453 if (ipsec_mp != NULL) 3454 freeb(ipsec_mp); 3455 if (pinfo != NULL) 3456 freeb(pinfo_mp); 3457 freemsg(mp); 3458 return; 3459 } 3460 } 3461 3462 BUMP_LOCAL(sctp->sctp_ipkts); 3463 sctph = find_sctp_hdrs(mp, &src, &dst, &ifindex, &ip_hdr_len, 3464 &ipp, pinfo); 3465 if (pinfo != NULL) 3466 freeb(pinfo_mp); 3467 mlen = mp->b_wptr - (uchar_t *)(sctph + 1); 3468 ch = sctp_first_chunk((uchar_t *)(sctph + 1), mlen); 3469 if (ch == NULL) { 3470 BUMP_MIB(&ip_mib, ipInDiscards); 3471 if (ipsec_mp != NULL) 3472 freeb(ipsec_mp); 3473 freemsg(mp); 3474 return; 3475 } 3476 3477 if (!sctp_check_input(sctp, ch, mlen, 1)) { 3478 BUMP_MIB(&ip_mib, ipInDiscards); 3479 goto done; 3480 } 3481 /* 3482 * Check verfication tag (special handling for INIT, 3483 * COOKIE, SHUTDOWN_COMPLETE and SHUTDOWN_ACK chunks). 3484 * ABORTs are handled in the chunk processing loop, since 3485 * may not appear first. All other checked chunks must 3486 * appear first, or will have been dropped by check_input(). 3487 */ 3488 switch (ch->sch_id) { 3489 case CHUNK_INIT: 3490 if (sctph->sh_verf != 0) { 3491 /* drop it */ 3492 goto done; 3493 } 3494 break; 3495 case CHUNK_SHUTDOWN_COMPLETE: 3496 if (sctph->sh_verf == sctp->sctp_lvtag) 3497 break; 3498 if (sctph->sh_verf == sctp->sctp_fvtag && 3499 SCTP_GET_TBIT(ch)) { 3500 break; 3501 } 3502 /* else drop it */ 3503 goto done; 3504 case CHUNK_ABORT: 3505 case CHUNK_COOKIE: 3506 /* handled below */ 3507 break; 3508 case CHUNK_SHUTDOWN_ACK: 3509 if (sctp->sctp_state > SCTPS_BOUND && 3510 sctp->sctp_state < SCTPS_ESTABLISHED) { 3511 /* treat as OOTB */ 3512 sctp_ootb_shutdown_ack(sctp, mp, ip_hdr_len); 3513 if (ipsec_mp != NULL) 3514 freeb(ipsec_mp); 3515 return; 3516 } 3517 /* else fallthru */ 3518 default: 3519 /* 3520 * All other packets must have a valid 3521 * verification tag, however if this is a 3522 * listener, we use a refined version of 3523 * out-of-the-blue logic. 3524 */ 3525 if (sctph->sh_verf != sctp->sctp_lvtag && 3526 sctp->sctp_state != SCTPS_LISTEN) { 3527 /* drop it */ 3528 goto done; 3529 } 3530 break; 3531 } 3532 3533 /* Have a valid sctp for this packet */ 3534 fp = sctp_lookup_faddr(sctp, &src); 3535 dprint(2, ("sctp_dispatch_rput: mp=%p fp=%p sctp=%p\n", (void *)mp, 3536 (void *)fp, (void *)sctp)); 3537 3538 gotdata = 0; 3539 trysend = 0; 3540 3541 now = lbolt64; 3542 /* Process the chunks */ 3543 do { 3544 dprint(3, ("sctp_dispatch_rput: state=%d, chunk id=%d\n", 3545 sctp->sctp_state, (int)(ch->sch_id))); 3546 3547 if (ch->sch_id == CHUNK_ABORT) { 3548 if (sctph->sh_verf != sctp->sctp_lvtag && 3549 sctph->sh_verf != sctp->sctp_fvtag) { 3550 /* drop it */ 3551 goto done; 3552 } 3553 } 3554 3555 switch (sctp->sctp_state) { 3556 3557 case SCTPS_ESTABLISHED: 3558 case SCTPS_SHUTDOWN_PENDING: 3559 case SCTPS_SHUTDOWN_SENT: 3560 switch (ch->sch_id) { 3561 case CHUNK_DATA: 3562 /* 0-length data chunks are not allowed */ 3563 if (ntohs(ch->sch_len) == sizeof (*sdc)) { 3564 sdc = (sctp_data_hdr_t *)ch; 3565 tsn = sdc->sdh_tsn; 3566 sctp_send_abort(sctp, sctp->sctp_fvtag, 3567 SCTP_ERR_NO_USR_DATA, (char *)&tsn, 3568 sizeof (tsn), mp, 0, B_FALSE); 3569 sctp_assoc_event(sctp, SCTP_COMM_LOST, 3570 0, NULL); 3571 sctp_clean_death(sctp, ECONNABORTED); 3572 goto done; 3573 } 3574 3575 ASSERT(fp != NULL); 3576 sctp->sctp_lastdata = fp; 3577 sctp_data_chunk(sctp, ch, mp, &dups, fp, &ipp); 3578 gotdata = 1; 3579 /* Restart shutdown timer if shutting down */ 3580 if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) { 3581 /* 3582 * If we have exceeded our max 3583 * wait bound for waiting for a 3584 * shutdown ack from the peer, 3585 * abort the association. 3586 */ 3587 if (sctp_shutack_wait_bound != 0 && 3588 TICK_TO_MSEC(now - 3589 sctp->sctp_out_time) > 3590 sctp_shutack_wait_bound) { 3591 sctp_send_abort(sctp, 3592 sctp->sctp_fvtag, 0, NULL, 3593 0, mp, 0, B_FALSE); 3594 sctp_assoc_event(sctp, 3595 SCTP_COMM_LOST, 0, NULL); 3596 sctp_clean_death(sctp, 3597 ECONNABORTED); 3598 goto done; 3599 } 3600 SCTP_FADDR_TIMER_RESTART(sctp, fp, 3601 fp->rto); 3602 } 3603 break; 3604 case CHUNK_SACK: 3605 ASSERT(fp != NULL); 3606 /* 3607 * Peer is real and alive if it can ack our 3608 * data. 3609 */ 3610 sctp_faddr_alive(sctp, fp); 3611 trysend = sctp_got_sack(sctp, ch); 3612 if (trysend < 0) { 3613 sctp_send_abort(sctp, sctph->sh_verf, 3614 0, NULL, 0, mp, 0, B_FALSE); 3615 sctp_assoc_event(sctp, 3616 SCTP_COMM_LOST, 0, NULL); 3617 sctp_clean_death(sctp, 3618 ECONNABORTED); 3619 goto done; 3620 } 3621 break; 3622 case CHUNK_HEARTBEAT: 3623 sctp_return_heartbeat(sctp, ch, mp); 3624 break; 3625 case CHUNK_HEARTBEAT_ACK: 3626 sctp_process_heartbeat(sctp, ch); 3627 break; 3628 case CHUNK_SHUTDOWN: 3629 sctp_shutdown_event(sctp); 3630 trysend = sctp_shutdown_received(sctp, ch, 3631 B_FALSE, B_FALSE, fp); 3632 BUMP_LOCAL(sctp->sctp_ibchunks); 3633 break; 3634 case CHUNK_SHUTDOWN_ACK: 3635 BUMP_LOCAL(sctp->sctp_ibchunks); 3636 if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) { 3637 sctp_shutdown_complete(sctp); 3638 BUMP_MIB(&sctp_mib, sctpShutdowns); 3639 sctp_assoc_event(sctp, 3640 SCTP_SHUTDOWN_COMP, 0, NULL); 3641 sctp_clean_death(sctp, 0); 3642 goto done; 3643 } 3644 break; 3645 case CHUNK_ABORT: { 3646 sctp_saddr_ipif_t *sp; 3647 3648 /* Ignore if delete pending */ 3649 sp = sctp_saddr_lookup(sctp, &dst, 0); 3650 ASSERT(sp != NULL); 3651 if (sp->saddr_ipif_delete_pending) { 3652 BUMP_LOCAL(sctp->sctp_ibchunks); 3653 break; 3654 } 3655 3656 sctp_process_abort(sctp, ch, ECONNRESET); 3657 goto done; 3658 } 3659 case CHUNK_INIT: 3660 sctp_send_initack(sctp, sctph, ch, mp); 3661 break; 3662 case CHUNK_COOKIE: 3663 if (sctp_process_cookie(sctp, ch, mp, &iack, 3664 sctph, &recv_adaption, NULL) != -1) { 3665 sctp_send_cookie_ack(sctp); 3666 sctp_assoc_event(sctp, SCTP_RESTART, 3667 0, NULL); 3668 if (recv_adaption) { 3669 sctp->sctp_recv_adaption = 1; 3670 sctp_adaption_event(sctp); 3671 } 3672 } else { 3673 BUMP_MIB(&sctp_mib, 3674 sctpInInvalidCookie); 3675 } 3676 break; 3677 case CHUNK_ERROR: { 3678 int error; 3679 3680 BUMP_LOCAL(sctp->sctp_ibchunks); 3681 error = sctp_handle_error(sctp, sctph, ch, mp); 3682 if (error != 0) { 3683 sctp_clean_death(sctp, error); 3684 goto done; 3685 } 3686 break; 3687 } 3688 case CHUNK_ASCONF: 3689 ASSERT(fp != NULL); 3690 sctp_input_asconf(sctp, ch, fp); 3691 BUMP_LOCAL(sctp->sctp_ibchunks); 3692 break; 3693 case CHUNK_ASCONF_ACK: 3694 ASSERT(fp != NULL); 3695 sctp_faddr_alive(sctp, fp); 3696 sctp_input_asconf_ack(sctp, ch, fp); 3697 BUMP_LOCAL(sctp->sctp_ibchunks); 3698 break; 3699 case CHUNK_FORWARD_TSN: 3700 ASSERT(fp != NULL); 3701 sctp->sctp_lastdata = fp; 3702 sctp_process_forward_tsn(sctp, ch, fp, &ipp); 3703 gotdata = 1; 3704 BUMP_LOCAL(sctp->sctp_ibchunks); 3705 break; 3706 default: 3707 if (sctp_strange_chunk(sctp, ch, fp) == 0) { 3708 goto nomorechunks; 3709 } /* else skip and continue processing */ 3710 break; 3711 } 3712 break; 3713 3714 case SCTPS_LISTEN: 3715 switch (ch->sch_id) { 3716 case CHUNK_INIT: 3717 sctp_send_initack(sctp, sctph, ch, mp); 3718 break; 3719 case CHUNK_COOKIE: { 3720 sctp_t *eager; 3721 3722 if (sctp_process_cookie(sctp, ch, mp, &iack, 3723 sctph, &recv_adaption, &peer_src) == -1) { 3724 BUMP_MIB(&sctp_mib, 3725 sctpInInvalidCookie); 3726 goto done; 3727 } 3728 3729 /* 3730 * The cookie is good; ensure that 3731 * the peer used the verification 3732 * tag from the init ack in the header. 3733 */ 3734 if (iack->sic_inittag != sctph->sh_verf) 3735 goto done; 3736 3737 eager = sctp_conn_request(sctp, mp, ifindex, 3738 ip_hdr_len, iack, ipsec_mp); 3739 if (eager == NULL) { 3740 sctp_send_abort(sctp, sctph->sh_verf, 3741 SCTP_ERR_NO_RESOURCES, NULL, 0, mp, 3742 0, B_FALSE); 3743 goto done; 3744 } 3745 3746 /* 3747 * If there were extra chunks 3748 * bundled with the cookie, 3749 * they must be processed 3750 * on the eager's queue. We 3751 * accomplish this by refeeding 3752 * the whole packet into the 3753 * state machine on the right 3754 * q. The packet (mp) gets 3755 * there via the eager's 3756 * cookie_mp field (overloaded 3757 * with the active open role). 3758 * This is picked up when 3759 * processing the null bind 3760 * request put on the eager's 3761 * q by sctp_accept(). We must 3762 * first revert the cookie 3763 * chunk's length field to network 3764 * byteorder so it can be 3765 * properly reprocessed on the 3766 * eager's queue. 3767 */ 3768 BUMP_MIB(&sctp_mib, sctpPassiveEstab); 3769 if (mlen > ntohs(ch->sch_len)) { 3770 eager->sctp_cookie_mp = dupb(mp); 3771 mblk_setcred(eager->sctp_cookie_mp, 3772 CONN_CRED(eager->sctp_connp)); 3773 /* 3774 * If no mem, just let 3775 * the peer retransmit. 3776 */ 3777 } 3778 sctp_assoc_event(eager, SCTP_COMM_UP, 0, NULL); 3779 if (recv_adaption) { 3780 eager->sctp_recv_adaption = 1; 3781 eager->sctp_rx_adaption_code = 3782 sctp->sctp_rx_adaption_code; 3783 sctp_adaption_event(eager); 3784 } 3785 3786 eager->sctp_active = now; 3787 sctp_send_cookie_ack(eager); 3788 3789 wake_eager = B_TRUE; 3790 3791 /* 3792 * Process rest of the chunks with eager. 3793 */ 3794 sctp = eager; 3795 fp = sctp_lookup_faddr(sctp, &peer_src); 3796 /* 3797 * Confirm peer's original source. fp can 3798 * only be NULL if peer does not use the 3799 * original source as one of its addresses... 3800 */ 3801 if (fp == NULL) 3802 fp = sctp_lookup_faddr(sctp, &src); 3803 else 3804 sctp_faddr_alive(sctp, fp); 3805 3806 /* 3807 * Validate the peer addresses. It also starts 3808 * the heartbeat timer. 3809 */ 3810 sctp_validate_peer(sctp); 3811 break; 3812 } 3813 /* Anything else is considered out-of-the-blue */ 3814 case CHUNK_ERROR: 3815 case CHUNK_ABORT: 3816 case CHUNK_COOKIE_ACK: 3817 case CHUNK_SHUTDOWN_COMPLETE: 3818 BUMP_LOCAL(sctp->sctp_ibchunks); 3819 goto done; 3820 default: 3821 BUMP_LOCAL(sctp->sctp_ibchunks); 3822 sctp_send_abort(sctp, sctph->sh_verf, 0, NULL, 3823 0, mp, 0, B_TRUE); 3824 goto done; 3825 } 3826 break; 3827 3828 case SCTPS_COOKIE_WAIT: 3829 switch (ch->sch_id) { 3830 case CHUNK_INIT_ACK: 3831 sctp_stop_faddr_timers(sctp); 3832 sctp_faddr_alive(sctp, sctp->sctp_current); 3833 sctp_send_cookie_echo(sctp, ch, mp); 3834 BUMP_LOCAL(sctp->sctp_ibchunks); 3835 break; 3836 case CHUNK_ABORT: 3837 sctp_process_abort(sctp, ch, ECONNREFUSED); 3838 goto done; 3839 case CHUNK_INIT: 3840 sctp_send_initack(sctp, sctph, ch, mp); 3841 break; 3842 case CHUNK_COOKIE: 3843 if (sctp_process_cookie(sctp, ch, mp, &iack, 3844 sctph, &recv_adaption, NULL) == -1) { 3845 BUMP_MIB(&sctp_mib, 3846 sctpInInvalidCookie); 3847 break; 3848 } 3849 sctp_send_cookie_ack(sctp); 3850 sctp_stop_faddr_timers(sctp); 3851 if (!SCTP_IS_DETACHED(sctp)) { 3852 sctp->sctp_ulp_connected(sctp->sctp_ulpd); 3853 sctp_set_ulp_prop(sctp); 3854 } 3855 sctp->sctp_state = SCTPS_ESTABLISHED; 3856 sctp->sctp_assoc_start_time = (uint32_t)lbolt; 3857 BUMP_MIB(&sctp_mib, sctpActiveEstab); 3858 if (sctp->sctp_cookie_mp) { 3859 freemsg(sctp->sctp_cookie_mp); 3860 sctp->sctp_cookie_mp = NULL; 3861 } 3862 3863 /* Validate the peer addresses. */ 3864 sctp->sctp_active = now; 3865 sctp_validate_peer(sctp); 3866 3867 sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL); 3868 if (recv_adaption) { 3869 sctp->sctp_recv_adaption = 1; 3870 sctp_adaption_event(sctp); 3871 } 3872 /* Try sending queued data, or ASCONFs */ 3873 trysend = 1; 3874 break; 3875 default: 3876 if (sctp_strange_chunk(sctp, ch, fp) == 0) { 3877 goto nomorechunks; 3878 } /* else skip and continue processing */ 3879 break; 3880 } 3881 break; 3882 3883 case SCTPS_COOKIE_ECHOED: 3884 switch (ch->sch_id) { 3885 case CHUNK_COOKIE_ACK: 3886 if (!SCTP_IS_DETACHED(sctp)) { 3887 sctp->sctp_ulp_connected(sctp->sctp_ulpd); 3888 sctp_set_ulp_prop(sctp); 3889 } 3890 if (sctp->sctp_unacked == 0) 3891 sctp_stop_faddr_timers(sctp); 3892 sctp->sctp_state = SCTPS_ESTABLISHED; 3893 sctp->sctp_assoc_start_time = (uint32_t)lbolt; 3894 BUMP_MIB(&sctp_mib, sctpActiveEstab); 3895 BUMP_LOCAL(sctp->sctp_ibchunks); 3896 if (sctp->sctp_cookie_mp) { 3897 freemsg(sctp->sctp_cookie_mp); 3898 sctp->sctp_cookie_mp = NULL; 3899 } 3900 sctp_faddr_alive(sctp, fp); 3901 /* Validate the peer addresses. */ 3902 sctp->sctp_active = now; 3903 sctp_validate_peer(sctp); 3904 3905 /* Try sending queued data, or ASCONFs */ 3906 trysend = 1; 3907 sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL); 3908 sctp_adaption_event(sctp); 3909 break; 3910 case CHUNK_ABORT: 3911 sctp_process_abort(sctp, ch, ECONNREFUSED); 3912 goto done; 3913 case CHUNK_COOKIE: 3914 if (sctp_process_cookie(sctp, ch, mp, &iack, 3915 sctph, &recv_adaption, NULL) == -1) { 3916 BUMP_MIB(&sctp_mib, 3917 sctpInInvalidCookie); 3918 break; 3919 } 3920 sctp_send_cookie_ack(sctp); 3921 3922 if (!SCTP_IS_DETACHED(sctp)) { 3923 sctp->sctp_ulp_connected(sctp->sctp_ulpd); 3924 sctp_set_ulp_prop(sctp); 3925 } 3926 if (sctp->sctp_unacked == 0) 3927 sctp_stop_faddr_timers(sctp); 3928 sctp->sctp_state = SCTPS_ESTABLISHED; 3929 sctp->sctp_assoc_start_time = (uint32_t)lbolt; 3930 BUMP_MIB(&sctp_mib, sctpActiveEstab); 3931 if (sctp->sctp_cookie_mp) { 3932 freemsg(sctp->sctp_cookie_mp); 3933 sctp->sctp_cookie_mp = NULL; 3934 } 3935 /* Validate the peer addresses. */ 3936 sctp->sctp_active = now; 3937 sctp_validate_peer(sctp); 3938 3939 sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL); 3940 if (recv_adaption) { 3941 sctp->sctp_recv_adaption = 1; 3942 sctp_adaption_event(sctp); 3943 } 3944 /* Try sending queued data, or ASCONFs */ 3945 trysend = 1; 3946 break; 3947 case CHUNK_INIT: 3948 sctp_send_initack(sctp, sctph, ch, mp); 3949 break; 3950 case CHUNK_ERROR: { 3951 sctp_parm_hdr_t *p; 3952 3953 BUMP_LOCAL(sctp->sctp_ibchunks); 3954 /* check for a stale cookie */ 3955 if (ntohs(ch->sch_len) >= 3956 (sizeof (*p) + sizeof (*ch)) + 3957 sizeof (uint32_t)) { 3958 3959 p = (sctp_parm_hdr_t *)(ch + 1); 3960 if (p->sph_type == 3961 htons(SCTP_ERR_STALE_COOKIE)) { 3962 BUMP_MIB(&sctp_mib, 3963 sctpAborted); 3964 sctp_error_event(sctp, ch); 3965 sctp_clean_death(sctp, 3966 ECONNREFUSED); 3967 goto done; 3968 } 3969 } 3970 break; 3971 } 3972 case CHUNK_HEARTBEAT: 3973 sctp_return_heartbeat(sctp, ch, mp); 3974 break; 3975 default: 3976 if (sctp_strange_chunk(sctp, ch, fp) == 0) { 3977 goto nomorechunks; 3978 } /* else skip and continue processing */ 3979 } /* switch (ch->sch_id) */ 3980 break; 3981 3982 case SCTPS_SHUTDOWN_ACK_SENT: 3983 switch (ch->sch_id) { 3984 case CHUNK_ABORT: 3985 /* Pass gathered wisdom to IP for keeping */ 3986 sctp_update_ire(sctp); 3987 sctp_process_abort(sctp, ch, 0); 3988 goto done; 3989 case CHUNK_SHUTDOWN_COMPLETE: 3990 BUMP_LOCAL(sctp->sctp_ibchunks); 3991 BUMP_MIB(&sctp_mib, sctpShutdowns); 3992 sctp_assoc_event(sctp, SCTP_SHUTDOWN_COMP, 0, 3993 NULL); 3994 3995 /* Pass gathered wisdom to IP for keeping */ 3996 sctp_update_ire(sctp); 3997 sctp_clean_death(sctp, 0); 3998 goto done; 3999 case CHUNK_SHUTDOWN_ACK: 4000 sctp_shutdown_complete(sctp); 4001 BUMP_LOCAL(sctp->sctp_ibchunks); 4002 BUMP_MIB(&sctp_mib, sctpShutdowns); 4003 sctp_assoc_event(sctp, SCTP_SHUTDOWN_COMP, 0, 4004 NULL); 4005 sctp_clean_death(sctp, 0); 4006 goto done; 4007 case CHUNK_COOKIE: 4008 (void) sctp_shutdown_received(sctp, NULL, 4009 B_TRUE, B_FALSE, fp); 4010 BUMP_LOCAL(sctp->sctp_ibchunks); 4011 break; 4012 case CHUNK_HEARTBEAT: 4013 sctp_return_heartbeat(sctp, ch, mp); 4014 break; 4015 default: 4016 if (sctp_strange_chunk(sctp, ch, fp) == 0) { 4017 goto nomorechunks; 4018 } /* else skip and continue processing */ 4019 break; 4020 } 4021 break; 4022 4023 case SCTPS_SHUTDOWN_RECEIVED: 4024 switch (ch->sch_id) { 4025 case CHUNK_SHUTDOWN: 4026 trysend = sctp_shutdown_received(sctp, ch, 4027 B_FALSE, B_FALSE, fp); 4028 break; 4029 case CHUNK_SACK: 4030 trysend = sctp_got_sack(sctp, ch); 4031 if (trysend < 0) { 4032 sctp_send_abort(sctp, sctph->sh_verf, 4033 0, NULL, 0, mp, 0, B_FALSE); 4034 sctp_assoc_event(sctp, 4035 SCTP_COMM_LOST, 0, NULL); 4036 sctp_clean_death(sctp, 4037 ECONNABORTED); 4038 goto done; 4039 } 4040 break; 4041 case CHUNK_ABORT: 4042 sctp_process_abort(sctp, ch, ECONNRESET); 4043 goto done; 4044 case CHUNK_HEARTBEAT: 4045 sctp_return_heartbeat(sctp, ch, mp); 4046 break; 4047 default: 4048 if (sctp_strange_chunk(sctp, ch, fp) == 0) { 4049 goto nomorechunks; 4050 } /* else skip and continue processing */ 4051 break; 4052 } 4053 break; 4054 4055 default: 4056 /* 4057 * The only remaining states are SCTPS_IDLE and 4058 * SCTPS_BOUND, and we should not be getting here 4059 * for these. 4060 */ 4061 ASSERT(0); 4062 } /* switch (sctp->sctp_state) */ 4063 4064 ch = sctp_next_chunk(ch, &mlen); 4065 if (ch != NULL && !sctp_check_input(sctp, ch, mlen, 0)) 4066 goto done; 4067 } while (ch != NULL); 4068 4069 /* Finished processing all chunks in packet */ 4070 4071 nomorechunks: 4072 /* SACK if necessary */ 4073 if (gotdata) { 4074 (sctp->sctp_sack_toggle)++; 4075 sctp_sack(sctp, dups); 4076 dups = NULL; 4077 4078 if (!sctp->sctp_ack_timer_running) { 4079 sctp->sctp_ack_timer_running = B_TRUE; 4080 sctp_timer(sctp, sctp->sctp_ack_mp, 4081 MSEC_TO_TICK(sctp_deferred_ack_interval)); 4082 } 4083 } 4084 4085 if (trysend) { 4086 sctp_output(sctp); 4087 if (sctp->sctp_cxmit_list != NULL) 4088 sctp_wput_asconf(sctp, NULL); 4089 } 4090 /* If there is unsent data, make sure a timer is running */ 4091 if (sctp->sctp_unsent > 0 && !sctp->sctp_current->timer_running) { 4092 SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current, 4093 sctp->sctp_current->rto); 4094 } 4095 4096 done: 4097 if (dups != NULL) 4098 freeb(dups); 4099 if (ipsec_mp != NULL) 4100 freeb(ipsec_mp); 4101 freemsg(mp); 4102 4103 if (wake_eager) { 4104 /* 4105 * sctp points to newly created control block, need to 4106 * release it before exiting. Before releasing it and 4107 * processing the sendq, need to grab a hold on it. 4108 * Otherwise, another thread can close it while processing 4109 * the sendq. 4110 */ 4111 SCTP_REFHOLD(sctp); 4112 WAKE_SCTP(sctp); 4113 sctp_process_sendq(sctp); 4114 SCTP_REFRELE(sctp); 4115 } 4116 } 4117 4118 /* 4119 * Some amount of data got removed from rx q. 4120 * Check if we should send a window update. 4121 * 4122 * Due to way sctp_rwnd updates are made, ULP can give reports out-of-order. 4123 * To keep from dropping incoming data due to this, we only update 4124 * sctp_rwnd when if it's larger than what we've reported to peer earlier. 4125 */ 4126 void 4127 sctp_recvd(sctp_t *sctp, int len) 4128 { 4129 int32_t old, new; 4130 4131 ASSERT(sctp != NULL); 4132 RUN_SCTP(sctp); 4133 4134 if (len < sctp->sctp_rwnd) { 4135 WAKE_SCTP(sctp); 4136 return; 4137 } 4138 ASSERT(sctp->sctp_rwnd >= sctp->sctp_rxqueued); 4139 old = sctp->sctp_rwnd - sctp->sctp_rxqueued; 4140 new = len - sctp->sctp_rxqueued; 4141 sctp->sctp_rwnd = len; 4142 4143 if (sctp->sctp_state >= SCTPS_ESTABLISHED && 4144 ((old <= new >> 1) || (old < sctp->sctp_mss))) { 4145 sctp->sctp_force_sack = 1; 4146 BUMP_MIB(&sctp_mib, sctpOutWinUpdate); 4147 sctp_sack(sctp, NULL); 4148 old = 1; 4149 } else { 4150 old = 0; 4151 } 4152 WAKE_SCTP(sctp); 4153 if (old > 0) { 4154 sctp_process_sendq(sctp); 4155 } 4156 } 4157