sctp_input.c revision 169378
1161370Simp/*- 2161370Simp * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved. 3161370Simp * 4161370Simp * Redistribution and use in source and binary forms, with or without 5161370Simp * modification, are permitted provided that the following conditions are met: 6161370Simp * 7161370Simp * a) Redistributions of source code must retain the above copyright notice, 8161370Simp * this list of conditions and the following disclaimer. 9161370Simp * 10161370Simp * b) Redistributions in binary form must reproduce the above copyright 11161370Simp * notice, this list of conditions and the following disclaimer in 12161370Simp * the documentation and/or other materials provided with the distribution. 13161370Simp * 14161370Simp * c) Neither the name of Cisco Systems, Inc. nor the names of its 15161370Simp * contributors may be used to endorse or promote products derived 16161370Simp * from this software without specific prior written permission. 17161370Simp * 18161370Simp * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19161370Simp * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 20161370Simp * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21161370Simp * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 22161370Simp * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23161370Simp * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24161370Simp * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25161370Simp * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26161370Simp * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27161370Simp * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 28161370Simp * THE POSSIBILITY OF SUCH DAMAGE. 29161370Simp */ 30161370Simp 31161370Simp/* $KAME: sctp_input.c,v 1.27 2005/03/06 16:04:17 itojun Exp $ */ 32161370Simp 33161370Simp#include <sys/cdefs.h> 34161370Simp__FBSDID("$FreeBSD: head/sys/netinet/sctp_input.c 169378 2007-05-08 14:32:53Z rrs $"); 35161370Simp 36161370Simp#include <netinet/sctp_os.h> 37161370Simp#include <netinet/sctp_var.h> 38161370Simp#include <netinet/sctp_sysctl.h> 39161370Simp#include <netinet/sctp_pcb.h> 40161370Simp#include <netinet/sctp_header.h> 41161370Simp#include <netinet/sctputil.h> 42161370Simp#include <netinet/sctp_output.h> 43161370Simp#include <netinet/sctp_input.h> 44161370Simp#include <netinet/sctp_auth.h> 45161370Simp#include <netinet/sctp_indata.h> 46161370Simp#include <netinet/sctp_asconf.h> 47161370Simp 48161370Simp 49163533Simp 50161370Simp 51161370Simpstatic void 52161370Simpsctp_stop_all_cookie_timers(struct sctp_tcb *stcb) 53163533Simp{ 54161370Simp struct sctp_nets *net; 55161370Simp 56161370Simp /* 57161370Simp * This now not only stops all cookie timers it also stops any INIT 58161370Simp * timers as well. This will make sure that the timers are stopped 59161370Simp * in all collision cases. 60161370Simp */ 61161370Simp SCTP_TCB_LOCK_ASSERT(stcb); 62161370Simp TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 63161370Simp if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) { 64161370Simp sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, 65161370Simp stcb->sctp_ep, 66161370Simp stcb, 67161370Simp net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1); 68161370Simp } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) { 69161370Simp sctp_timer_stop(SCTP_TIMER_TYPE_INIT, 70161370Simp stcb->sctp_ep, 71161370Simp stcb, 72161370Simp net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2); 73161370Simp } 74161370Simp } 75161370Simp} 76161370Simp 77161370Simp/* INIT handler */ 78161370Simpstatic void 79161370Simpsctp_handle_init(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh, 80163533Simp struct sctp_init_chunk *cp, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 81163533Simp struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id, 82163533Simp uint32_t table_id) 83161370Simp{ 84163533Simp struct sctp_init *init; 85161370Simp struct mbuf *op_err; 86161370Simp uint32_t init_limit; 87161370Simp 88161370Simp#ifdef SCTP_DEBUG 89161370Simp if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 90161370Simp printf("sctp_handle_init: handling INIT tcb:%p\n", stcb); 91164137Simp } 92164137Simp#endif 93164137Simp op_err = NULL; 94164137Simp init = &cp->init; 95164137Simp /* First are we accepting? */ 96164137Simp if ((inp->sctp_socket->so_qlimit == 0) && (stcb == NULL)) { 97164137Simp#ifdef SCTP_DEBUG 98164137Simp if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 99161370Simp printf("sctp_handle_init: Abort, so_qlimit:%d\n", inp->sctp_socket->so_qlimit); 100163533Simp } 101163533Simp#endif 102163533Simp /* 103163533Simp * FIX ME ?? What about TCP model and we have a 104163533Simp * match/restart case? 105163533Simp */ 106163533Simp sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 107163533Simp vrf_id, table_id); 108163533Simp if (stcb) 109163533Simp *abort_no_unlock = 1; 110163533Simp return; 111163533Simp } 112163533Simp if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) { 113163533Simp /* Invalid length */ 114163533Simp op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 115163533Simp sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 116163533Simp vrf_id, table_id); 117163533Simp if (stcb) 118163533Simp *abort_no_unlock = 1; 119163533Simp return; 120163533Simp } 121163533Simp /* validate parameters */ 122163533Simp if (init->initiate_tag == 0) { 123163533Simp /* protocol error... send abort */ 124163533Simp op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 125163533Simp sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 126163533Simp vrf_id, table_id); 127163533Simp if (stcb) 128163533Simp *abort_no_unlock = 1; 129163533Simp return; 130163533Simp } 131163533Simp if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) { 132163533Simp /* invalid parameter... send abort */ 133163533Simp op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 134163533Simp sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 135163533Simp vrf_id, table_id); 136163533Simp return; 137163533Simp } 138163533Simp if (init->num_inbound_streams == 0) { 139163533Simp /* protocol error... send abort */ 140163533Simp op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 141163533Simp sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 142163533Simp vrf_id, table_id); 143163533Simp if (stcb) 144163533Simp *abort_no_unlock = 1; 145163533Simp return; 146161370Simp } 147163533Simp if (init->num_outbound_streams == 0) { 148163533Simp /* protocol error... send abort */ 149163533Simp op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 150161370Simp sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 151161370Simp vrf_id, table_id); 152161370Simp if (stcb) 153161370Simp *abort_no_unlock = 1; 154161370Simp return; 155163533Simp } 156163533Simp init_limit = offset + ntohs(cp->ch.chunk_length); 157163533Simp if (sctp_validate_init_auth_params(m, offset + sizeof(*cp), 158163533Simp init_limit)) { 159163533Simp /* auth parameter(s) error... send abort */ 160163533Simp sctp_abort_association(inp, stcb, m, iphlen, sh, NULL, vrf_id, 161163533Simp table_id); 162161370Simp if (stcb) 163163533Simp *abort_no_unlock = 1; 164163533Simp return; 165163533Simp } 166163533Simp /* send an INIT-ACK w/cookie */ 167163533Simp#ifdef SCTP_DEBUG 168161370Simp if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 169163533Simp printf("sctp_handle_init: sending INIT-ACK\n"); 170163533Simp } 171163533Simp#endif 172163533Simp sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp, vrf_id, 173163533Simp table_id); 174163533Simp} 175161370Simp 176163533Simp/* 177163533Simp * process peer "INIT/INIT-ACK" chunk returns value < 0 on error 178163533Simp */ 179161370Simpstatic int 180163533Simpsctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb, 181163533Simp struct sctp_nets *net) 182163533Simp{ 183163533Simp struct sctp_init *init; 184163533Simp struct sctp_association *asoc; 185163533Simp struct sctp_nets *lnet; 186163533Simp unsigned int i; 187163533Simp 188163533Simp init = &cp->init; 189163533Simp asoc = &stcb->asoc; 190163533Simp /* save off parameters */ 191163533Simp asoc->peer_vtag = ntohl(init->initiate_tag); 192163533Simp asoc->peers_rwnd = ntohl(init->a_rwnd); 193163533Simp if (TAILQ_FIRST(&asoc->nets)) { 194163533Simp /* update any ssthresh's that may have a default */ 195163533Simp TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 196163533Simp lnet->ssthresh = asoc->peers_rwnd; 197163533Simp 198163533Simp#if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING) 199163533Simp sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION); 200163533Simp#endif 201163533Simp 202163533Simp } 203163533Simp } 204163533Simp SCTP_TCB_SEND_LOCK(stcb); 205163533Simp if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) { 206161370Simp unsigned int newcnt; 207161370Simp struct sctp_stream_out *outs; 208161370Simp struct sctp_stream_queue_pending *sp; 209161370Simp 210163533Simp /* cut back on number of streams */ 211163533Simp newcnt = ntohs(init->num_inbound_streams); 212163533Simp /* This if is probably not needed but I am cautious */ 213161370Simp if (asoc->strmout) { 214161370Simp /* First make sure no data chunks are trapped */ 215161370Simp for (i = newcnt; i < asoc->pre_open_streams; i++) { 216161370Simp outs = &asoc->strmout[i]; 217161370Simp sp = TAILQ_FIRST(&outs->outqueue); 218163533Simp while (sp) { 219161370Simp TAILQ_REMOVE(&outs->outqueue, sp, 220161370Simp next); 221161370Simp asoc->stream_queue_cnt--; 222161370Simp sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, 223161370Simp stcb, SCTP_NOTIFY_DATAGRAM_UNSENT, 224163533Simp sp); 225163533Simp if (sp->data) { 226163533Simp sctp_m_freem(sp->data); 227161370Simp sp->data = NULL; 228161370Simp } 229161370Simp sctp_free_remote_addr(sp->net); 230161370Simp sp->net = NULL; 231161370Simp /* Free the chunk */ 232161370Simp printf("sp:%p tcb:%p weird free case\n", 233163533Simp sp, stcb); 234163533Simp 235163533Simp sctp_free_a_strmoq(stcb, sp); 236161370Simp sp = TAILQ_FIRST(&outs->outqueue); 237161370Simp } 238161370Simp } 239161370Simp } 240161370Simp /* cut back the count and abandon the upper streams */ 241161370Simp asoc->pre_open_streams = newcnt; 242163533Simp } 243163533Simp SCTP_TCB_SEND_UNLOCK(stcb); 244163533Simp asoc->streamoutcnt = asoc->pre_open_streams; 245163533Simp /* init tsn's */ 246163533Simp asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1; 247163533Simp#ifdef SCTP_MAP_LOGGING 248163533Simp sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 249161370Simp#endif 250161370Simp /* This is the next one we expect */ 251161370Simp asoc->str_reset_seq_in = asoc->asconf_seq_in + 1; 252161370Simp 253161370Simp asoc->mapping_array_base_tsn = ntohl(init->initial_tsn); 254163533Simp asoc->cumulative_tsn = asoc->asconf_seq_in; 255161370Simp asoc->last_echo_tsn = asoc->asconf_seq_in; 256161370Simp asoc->advanced_peer_ack_point = asoc->last_acked_seq; 257161370Simp /* open the requested streams */ 258161370Simp if (asoc->strmin != NULL) { 259161370Simp /* Free the old ones */ 260163533Simp struct sctp_queued_to_read *ctl; 261163533Simp 262161370Simp for (i = 0; i < asoc->streamincnt; i++) { 263163533Simp ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 264163533Simp while (ctl) { 265163533Simp TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next); 266163533Simp sctp_free_remote_addr(ctl->whoFrom); 267163533Simp sctp_m_freem(ctl->data); 268163533Simp ctl->data = NULL; 269163533Simp sctp_free_a_readq(stcb, ctl); 270161370Simp ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 271163533Simp } 272163533Simp } 273163533Simp SCTP_FREE(asoc->strmin); 274163533Simp } 275163533Simp asoc->streamincnt = ntohs(init->num_outbound_streams); 276163533Simp if (asoc->streamincnt > MAX_SCTP_STREAMS) { 277163533Simp asoc->streamincnt = MAX_SCTP_STREAMS; 278161370Simp } 279161370Simp SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt * 280161370Simp sizeof(struct sctp_stream_in), "StreamsIn"); 281161370Simp if (asoc->strmin == NULL) { 282161370Simp /* we didn't get memory for the streams! */ 283163533Simp#ifdef SCTP_DEBUG 284163533Simp if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 285161370Simp printf("process_init: couldn't get memory for the streams!\n"); 286163533Simp } 287161370Simp#endif 288163533Simp return (-1); 289161370Simp } 290161370Simp for (i = 0; i < asoc->streamincnt; i++) { 291161370Simp asoc->strmin[i].stream_no = i; 292161370Simp asoc->strmin[i].last_sequence_delivered = 0xffff; 293161370Simp /* 294161370Simp * U-stream ranges will be set when the cookie is unpacked. 295161370Simp * Or for the INIT sender they are un set (if pr-sctp not 296161370Simp * supported) when the INIT-ACK arrives. 297161370Simp */ 298161370Simp TAILQ_INIT(&asoc->strmin[i].inqueue); 299161370Simp asoc->strmin[i].delivery_started = 0; 300161370Simp } 301161370Simp /* 302161370Simp * load_address_from_init will put the addresses into the 303161370Simp * association when the COOKIE is processed or the INIT-ACK is 304161370Simp * processed. Both types of COOKIE's existing and new call this 305161370Simp * routine. It will remove addresses that are no longer in the 306161370Simp * association (for the restarting case where addresses are 307161370Simp * removed). Up front when the INIT arrives we will discard it if it 308161370Simp * is a restart and new addresses have been added. 309261455Seadler */ 310161370Simp return (0); 311163533Simp} 312163533Simp 313161370Simp/* 314163533Simp * INIT-ACK message processing/consumption returns value < 0 on error 315161370Simp */ 316163533Simpstatic int 317161370Simpsctp_process_init_ack(struct mbuf *m, int iphlen, int offset, 318161370Simp struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 319161370Simp struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id, 320161370Simp uint32_t table_id) 321161370Simp{ 322161370Simp struct sctp_association *asoc; 323161370Simp struct mbuf *op_err; 324161370Simp int retval, abort_flag; 325161370Simp uint32_t initack_limit; 326161370Simp 327161370Simp /* First verify that we have no illegal param's */ 328161370Simp abort_flag = 0; 329161370Simp op_err = NULL; 330163533Simp 331163533Simp op_err = sctp_arethere_unrecognized_parameters(m, 332163533Simp (offset + sizeof(struct sctp_init_chunk)), 333161370Simp &abort_flag, (struct sctp_chunkhdr *)cp); 334163533Simp if (abort_flag) { 335163533Simp /* Send an abort and notify peer */ 336163533Simp if (op_err != NULL) { 337161370Simp sctp_send_operr_to(m, iphlen, op_err, 338161370Simp cp->init.initiate_tag, vrf_id, 339163533Simp table_id); 340163533Simp } else { 341163533Simp /* 342163533Simp * Just notify (abort_assoc does this if we send an 343163533Simp * abort). 344163533Simp */ 345163533Simp sctp_abort_notification(stcb, 0); 346163533Simp /* 347163533Simp * No sense in further INIT's since we will get the 348163533Simp * same param back 349163533Simp */ 350163533Simp sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3); 351163533Simp *abort_no_unlock = 1; 352163533Simp } 353163533Simp return (-1); 354163533Simp } 355163533Simp asoc = &stcb->asoc; 356163533Simp /* process the peer's parameters in the INIT-ACK */ 357163533Simp retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net); 358163533Simp if (retval < 0) { 359163533Simp return (retval); 360163533Simp } 361163533Simp initack_limit = offset + ntohs(cp->ch.chunk_length); 362163533Simp /* load all addresses */ 363163533Simp if ((retval = sctp_load_addresses_from_init(stcb, m, iphlen, 364163533Simp (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh, 365163533Simp NULL))) { 366163533Simp /* Huh, we should abort */ 367161370Simp#ifdef SCTP_DEBUG 368161370Simp if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 369163533Simp printf("Load addresses from INIT causes an abort %d\n", retval); 370163533Simp } 371163533Simp#endif 372163533Simp sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 373163533Simp NULL, 0, 0); 374163533Simp *abort_no_unlock = 1; 375161370Simp return (-1); 376163533Simp } 377163533Simp stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs, 378163533Simp stcb->asoc.local_hmacs); 379163533Simp if (op_err) { 380163533Simp sctp_queue_op_err(stcb, op_err); 381163533Simp /* queuing will steal away the mbuf chain to the out queue */ 382161370Simp op_err = NULL; 383163533Simp } 384163533Simp /* extract the cookie and queue it to "echo" it back... */ 385163533Simp stcb->asoc.overall_error_count = 0; 386163533Simp net->error_count = 0; 387163533Simp 388163533Simp /* 389163533Simp * Cancel the INIT timer, We do this first before queueing the 390163533Simp * cookie. We always cancel at the primary to assue that we are 391163533Simp * canceling the timer started by the INIT which always goes to the 392163533Simp * primary. 393163533Simp */ 394163533Simp sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb, 395161370Simp asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4); 396161370Simp 397163533Simp /* calculate the RTO */ 398163533Simp net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered); 399163533Simp 400163533Simp retval = sctp_send_cookie_echo(m, offset, stcb, net); 401163533Simp if (retval < 0) { 402163533Simp /* 403163533Simp * No cookie, we probably should send a op error. But in any 404163533Simp * case if there is no cookie in the INIT-ACK, we can 405163533Simp * abandon the peer, its broke. 406163533Simp */ 407163533Simp if (retval == -3) { 408163533Simp /* We abort with an error of missing mandatory param */ 409163533Simp struct mbuf *op_err; 410163533Simp 411163533Simp op_err = 412163533Simp sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM); 413161370Simp if (op_err) { 414161370Simp /* 415163533Simp * Expand beyond to include the mandatory 416163533Simp * param cookie 417163533Simp */ 418163533Simp struct sctp_inv_mandatory_param *mp; 419163533Simp 420163533Simp SCTP_BUF_LEN(op_err) = 421163533Simp sizeof(struct sctp_inv_mandatory_param); 422163533Simp mp = mtod(op_err, 423163533Simp struct sctp_inv_mandatory_param *); 424163533Simp /* Subtract the reserved param */ 425163533Simp mp->length = 426163533Simp htons(sizeof(struct sctp_inv_mandatory_param) - 2); 427161370Simp mp->num_param = htonl(1); 428163533Simp mp->param = htons(SCTP_STATE_COOKIE); 429161370Simp mp->resv = 0; 430 } 431 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 432 sh, op_err, 0, 0); 433 *abort_no_unlock = 1; 434 } 435 return (retval); 436 } 437 return (0); 438} 439 440static void 441sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp, 442 struct sctp_tcb *stcb, struct sctp_nets *net) 443{ 444 struct sockaddr_storage store; 445 struct sockaddr_in *sin; 446 struct sockaddr_in6 *sin6; 447 struct sctp_nets *r_net; 448 struct timeval tv; 449 450 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) { 451 /* Invalid length */ 452 return; 453 } 454 sin = (struct sockaddr_in *)&store; 455 sin6 = (struct sockaddr_in6 *)&store; 456 457 memset(&store, 0, sizeof(store)); 458 if (cp->heartbeat.hb_info.addr_family == AF_INET && 459 cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) { 460 sin->sin_family = cp->heartbeat.hb_info.addr_family; 461 sin->sin_len = cp->heartbeat.hb_info.addr_len; 462 sin->sin_port = stcb->rport; 463 memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address, 464 sizeof(sin->sin_addr)); 465 } else if (cp->heartbeat.hb_info.addr_family == AF_INET6 && 466 cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) { 467 sin6->sin6_family = cp->heartbeat.hb_info.addr_family; 468 sin6->sin6_len = cp->heartbeat.hb_info.addr_len; 469 sin6->sin6_port = stcb->rport; 470 memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address, 471 sizeof(sin6->sin6_addr)); 472 } else { 473 return; 474 } 475 r_net = sctp_findnet(stcb, (struct sockaddr *)sin); 476 if (r_net == NULL) { 477#ifdef SCTP_DEBUG 478 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 479 printf("Huh? I can't find the address I sent it to, discard\n"); 480 } 481#endif 482 return; 483 } 484 if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) && 485 (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) && 486 (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) { 487 /* 488 * If the its a HB and it's random value is correct when can 489 * confirm the destination. 490 */ 491 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 492 if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) { 493 stcb->asoc.primary_destination = r_net; 494 r_net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY; 495 r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY; 496 r_net = TAILQ_FIRST(&stcb->asoc.nets); 497 if (r_net != stcb->asoc.primary_destination) { 498 /* 499 * first one on the list is NOT the primary 500 * sctp_cmpaddr() is much more efficent if 501 * the primary is the first on the list, 502 * make it so. 503 */ 504 TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next); 505 TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next); 506 } 507 } 508 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 509 stcb, 0, (void *)r_net); 510 } 511 r_net->error_count = 0; 512 r_net->hb_responded = 1; 513 tv.tv_sec = cp->heartbeat.hb_info.time_value_1; 514 tv.tv_usec = cp->heartbeat.hb_info.time_value_2; 515 if (r_net->dest_state & SCTP_ADDR_NOT_REACHABLE) { 516 r_net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE; 517 r_net->dest_state |= SCTP_ADDR_REACHABLE; 518 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb, 519 SCTP_HEARTBEAT_SUCCESS, (void *)r_net); 520 /* now was it the primary? if so restore */ 521 if (r_net->dest_state & SCTP_ADDR_WAS_PRIMARY) { 522 sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, r_net); 523 } 524 } 525 /* Now lets do a RTO with this */ 526 r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv); 527} 528 529static void 530sctp_handle_abort(struct sctp_abort_chunk *cp, 531 struct sctp_tcb *stcb, struct sctp_nets *net) 532{ 533 534#ifdef SCTP_DEBUG 535 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 536 printf("sctp_handle_abort: handling ABORT\n"); 537 } 538#endif 539 if (stcb == NULL) 540 return; 541 /* verify that the destination addr is in the association */ 542 /* ignore abort for addresses being deleted */ 543 544 /* stop any receive timers */ 545 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5); 546 /* notify user of the abort and clean up... */ 547 sctp_abort_notification(stcb, 0); 548 /* free the tcb */ 549 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 550 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) || 551 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 552 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 553 } 554#ifdef SCTP_ASOCLOG_OF_TSNS 555 sctp_print_out_track_log(stcb); 556#endif 557 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6); 558#ifdef SCTP_DEBUG 559 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 560 printf("sctp_handle_abort: finished\n"); 561 } 562#endif 563} 564 565static void 566sctp_handle_shutdown(struct sctp_shutdown_chunk *cp, 567 struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag) 568{ 569 struct sctp_association *asoc; 570 int some_on_streamwheel; 571 572#ifdef SCTP_DEBUG 573 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 574 printf("sctp_handle_shutdown: handling SHUTDOWN\n"); 575 } 576#endif 577 if (stcb == NULL) 578 return; 579 asoc = &stcb->asoc; 580 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 581 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 582 return; 583 } 584 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) { 585 /* Shutdown NOT the expected size */ 586 return; 587 } else { 588 sctp_update_acked(stcb, cp, net, abort_flag); 589 } 590 if (asoc->control_pdapi) { 591 /* 592 * With a normal shutdown we assume the end of last record. 593 */ 594 SCTP_INP_READ_LOCK(stcb->sctp_ep); 595 asoc->control_pdapi->end_added = 1; 596 asoc->control_pdapi->pdapi_aborted = 1; 597 asoc->control_pdapi = NULL; 598 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 599 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 600 } 601 /* goto SHUTDOWN_RECEIVED state to block new requests */ 602 if (stcb->sctp_socket) { 603 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 604 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 605 asoc->state = SCTP_STATE_SHUTDOWN_RECEIVED; 606 /* 607 * notify upper layer that peer has initiated a 608 * shutdown 609 */ 610 sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL); 611 612 /* reset time */ 613 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 614 } 615 } 616 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) { 617 /* 618 * stop the shutdown timer, since we WILL move to 619 * SHUTDOWN-ACK-SENT. 620 */ 621 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_7); 622 } 623 /* Now are we there yet? */ 624 some_on_streamwheel = 0; 625 if (!TAILQ_EMPTY(&asoc->out_wheel)) { 626 /* Check to see if some data queued */ 627 struct sctp_stream_out *outs; 628 629 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 630 if (!TAILQ_EMPTY(&outs->outqueue)) { 631 some_on_streamwheel = 1; 632 break; 633 } 634 } 635 } 636 if (!TAILQ_EMPTY(&asoc->send_queue) || 637 !TAILQ_EMPTY(&asoc->sent_queue) || 638 some_on_streamwheel) { 639 /* By returning we will push more data out */ 640 return; 641 } else { 642 /* no outstanding data to send, so move on... */ 643 /* send SHUTDOWN-ACK */ 644 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 645 /* move to SHUTDOWN-ACK-SENT state */ 646 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) || 647 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 648 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 649 } 650 asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT; 651 652 /* start SHUTDOWN timer */ 653 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, 654 stcb, net); 655 } 656} 657 658static void 659sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp, 660 struct sctp_tcb *stcb, struct sctp_nets *net) 661{ 662 struct sctp_association *asoc; 663 664#ifdef SCTP_DEBUG 665 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 666 printf("sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n"); 667 } 668#endif 669 if (stcb == NULL) 670 return; 671 672 asoc = &stcb->asoc; 673 /* process according to association state */ 674 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 675 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 676 /* unexpected SHUTDOWN-ACK... so ignore... */ 677 SCTP_TCB_UNLOCK(stcb); 678 return; 679 } 680 if (asoc->control_pdapi) { 681 /* 682 * With a normal shutdown we assume the end of last record. 683 */ 684 SCTP_INP_READ_LOCK(stcb->sctp_ep); 685 asoc->control_pdapi->end_added = 1; 686 asoc->control_pdapi->pdapi_aborted = 1; 687 asoc->control_pdapi = NULL; 688 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 689 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 690 } 691 /* are the queues empty? */ 692 if (!TAILQ_EMPTY(&asoc->send_queue) || 693 !TAILQ_EMPTY(&asoc->sent_queue) || 694 !TAILQ_EMPTY(&asoc->out_wheel)) { 695 sctp_report_all_outbound(stcb, 0); 696 } 697 /* stop the timer */ 698 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8); 699 /* send SHUTDOWN-COMPLETE */ 700 sctp_send_shutdown_complete(stcb, net); 701 /* notify upper layer protocol */ 702 if (stcb->sctp_socket) { 703 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 704 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 705 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 706 /* Set the connected flag to disconnected */ 707 stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 708 } 709 } 710 SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 711 /* free the TCB but first save off the ep */ 712 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, 713 SCTP_FROM_SCTP_INPUT + SCTP_LOC_9); 714} 715 716/* 717 * Skip past the param header and then we will find the chunk that caused the 718 * problem. There are two possiblities ASCONF or FWD-TSN other than that and 719 * our peer must be broken. 720 */ 721static void 722sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr, 723 struct sctp_nets *net) 724{ 725 struct sctp_chunkhdr *chk; 726 727 chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr)); 728 switch (chk->chunk_type) { 729 case SCTP_ASCONF_ACK: 730 case SCTP_ASCONF: 731 sctp_asconf_cleanup(stcb, net); 732 break; 733 case SCTP_FORWARD_CUM_TSN: 734 stcb->asoc.peer_supports_prsctp = 0; 735 break; 736 default: 737#ifdef SCTP_DEBUG 738 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 739 printf("Peer does not support chunk type %d(%x)??\n", 740 chk->chunk_type, (uint32_t) chk->chunk_type); 741 } 742#endif 743 break; 744 } 745} 746 747/* 748 * Skip past the param header and then we will find the param that caused the 749 * problem. There are a number of param's in a ASCONF OR the prsctp param 750 * these will turn of specific features. 751 */ 752static void 753sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr) 754{ 755 struct sctp_paramhdr *pbad; 756 757 pbad = phdr + 1; 758 switch (ntohs(pbad->param_type)) { 759 /* pr-sctp draft */ 760 case SCTP_PRSCTP_SUPPORTED: 761 stcb->asoc.peer_supports_prsctp = 0; 762 break; 763 case SCTP_SUPPORTED_CHUNK_EXT: 764 break; 765 /* draft-ietf-tsvwg-addip-sctp */ 766 case SCTP_ECN_NONCE_SUPPORTED: 767 stcb->asoc.peer_supports_ecn_nonce = 0; 768 stcb->asoc.ecn_nonce_allowed = 0; 769 stcb->asoc.ecn_allowed = 0; 770 break; 771 case SCTP_ADD_IP_ADDRESS: 772 case SCTP_DEL_IP_ADDRESS: 773 case SCTP_SET_PRIM_ADDR: 774 stcb->asoc.peer_supports_asconf = 0; 775 break; 776 case SCTP_SUCCESS_REPORT: 777 case SCTP_ERROR_CAUSE_IND: 778#ifdef SCTP_DEBUG 779 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 780 printf("Huh, the peer does not support success? or error cause?\n"); 781 printf("Turning off ASCONF to this strange peer\n"); 782 } 783#endif 784 stcb->asoc.peer_supports_asconf = 0; 785 break; 786 default: 787#ifdef SCTP_DEBUG 788 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 789 printf("Peer does not support param type %d(%x)??\n", 790 pbad->param_type, (uint32_t) pbad->param_type); 791 } 792#endif 793 break; 794 } 795} 796 797static int 798sctp_handle_error(struct sctp_chunkhdr *ch, 799 struct sctp_tcb *stcb, struct sctp_nets *net) 800{ 801 int chklen; 802 struct sctp_paramhdr *phdr; 803 uint16_t error_type; 804 uint16_t error_len; 805 struct sctp_association *asoc; 806 807 int adjust; 808 809 /* parse through all of the errors and process */ 810 asoc = &stcb->asoc; 811 phdr = (struct sctp_paramhdr *)((caddr_t)ch + 812 sizeof(struct sctp_chunkhdr)); 813 chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr); 814 while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) { 815 /* Process an Error Cause */ 816 error_type = ntohs(phdr->param_type); 817 error_len = ntohs(phdr->param_length); 818 if ((error_len > chklen) || (error_len == 0)) { 819 /* invalid param length for this param */ 820#ifdef SCTP_DEBUG 821 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 822 printf("Bogus length in error param- chunk left:%d errorlen:%d\n", 823 chklen, error_len); 824 } 825#endif /* SCTP_DEBUG */ 826 return (0); 827 } 828 switch (error_type) { 829 case SCTP_CAUSE_INVALID_STREAM: 830 case SCTP_CAUSE_MISSING_PARAM: 831 case SCTP_CAUSE_INVALID_PARAM: 832 case SCTP_CAUSE_NO_USER_DATA: 833#ifdef SCTP_DEBUG 834 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 835 printf("Software error we got a %d back? We have a bug :/ (or do they?)\n", 836 error_type); 837 } 838#endif 839 break; 840 case SCTP_CAUSE_STALE_COOKIE: 841 /* 842 * We only act if we have echoed a cookie and are 843 * waiting. 844 */ 845 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 846 int *p; 847 848 p = (int *)((caddr_t)phdr + sizeof(*phdr)); 849 /* Save the time doubled */ 850 asoc->cookie_preserve_req = ntohl(*p) << 1; 851 asoc->stale_cookie_count++; 852 if (asoc->stale_cookie_count > 853 asoc->max_init_times) { 854 sctp_abort_notification(stcb, 0); 855 /* now free the asoc */ 856 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_10); 857 return (-1); 858 } 859 /* blast back to INIT state */ 860 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED; 861 asoc->state |= SCTP_STATE_COOKIE_WAIT; 862 863 sctp_stop_all_cookie_timers(stcb); 864 sctp_send_initiate(stcb->sctp_ep, stcb); 865 } 866 break; 867 case SCTP_CAUSE_UNRESOLVABLE_ADDR: 868 /* 869 * Nothing we can do here, we don't do hostname 870 * addresses so if the peer does not like my IPv6 871 * (or IPv4 for that matter) it does not matter. If 872 * they don't support that type of address, they can 873 * NOT possibly get that packet type... i.e. with no 874 * IPv6 you can't recieve a IPv6 packet. so we can 875 * safely ignore this one. If we ever added support 876 * for HOSTNAME Addresses, then we would need to do 877 * something here. 878 */ 879 break; 880 case SCTP_CAUSE_UNRECOG_CHUNK: 881 sctp_process_unrecog_chunk(stcb, phdr, net); 882 break; 883 case SCTP_CAUSE_UNRECOG_PARAM: 884 sctp_process_unrecog_param(stcb, phdr); 885 break; 886 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN: 887 /* 888 * We ignore this since the timer will drive out a 889 * new cookie anyway and there timer will drive us 890 * to send a SHUTDOWN_COMPLETE. We can't send one 891 * here since we don't have their tag. 892 */ 893 break; 894 case SCTP_CAUSE_DELETING_LAST_ADDR: 895 case SCTP_CAUSE_RESOURCE_SHORTAGE: 896 case SCTP_CAUSE_DELETING_SRC_ADDR: 897 /* 898 * We should NOT get these here, but in a 899 * ASCONF-ACK. 900 */ 901#ifdef SCTP_DEBUG 902 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 903 printf("Peer sends ASCONF errors in a Operational Error?<%d>?\n", 904 error_type); 905 } 906#endif 907 break; 908 case SCTP_CAUSE_OUT_OF_RESC: 909 /* 910 * And what, pray tell do we do with the fact that 911 * the peer is out of resources? Not really sure we 912 * could do anything but abort. I suspect this 913 * should have came WITH an abort instead of in a 914 * OP-ERROR. 915 */ 916 break; 917 default: 918#ifdef SCTP_DEBUG 919 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 920 /* don't know what this error cause is... */ 921 printf("sctp_handle_error: unknown error type = 0x%xh\n", 922 error_type); 923 } 924#endif /* SCTP_DEBUG */ 925 break; 926 } 927 adjust = SCTP_SIZE32(error_len); 928 chklen -= adjust; 929 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust); 930 } 931 return (0); 932} 933 934static int 935sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset, 936 struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 937 struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id, 938 uint32_t table_id) 939{ 940 struct sctp_init_ack *init_ack; 941 int *state; 942 struct mbuf *op_err; 943 944#ifdef SCTP_DEBUG 945 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 946 printf("sctp_handle_init_ack: handling INIT-ACK\n"); 947 } 948#endif 949 if (stcb == NULL) { 950#ifdef SCTP_DEBUG 951 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 952 printf("sctp_handle_init_ack: TCB is null\n"); 953 } 954#endif 955 return (-1); 956 } 957 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) { 958 /* Invalid length */ 959 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 960 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 961 op_err, 0, 0); 962 *abort_no_unlock = 1; 963 return (-1); 964 } 965 init_ack = &cp->init; 966 /* validate parameters */ 967 if (init_ack->initiate_tag == 0) { 968 /* protocol error... send an abort */ 969 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 970 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 971 op_err, 0, 0); 972 *abort_no_unlock = 1; 973 return (-1); 974 } 975 if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) { 976 /* protocol error... send an abort */ 977 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 978 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 979 op_err, 0, 0); 980 *abort_no_unlock = 1; 981 return (-1); 982 } 983 if (init_ack->num_inbound_streams == 0) { 984 /* protocol error... send an abort */ 985 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 986 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 987 op_err, 0, 0); 988 *abort_no_unlock = 1; 989 return (-1); 990 } 991 if (init_ack->num_outbound_streams == 0) { 992 /* protocol error... send an abort */ 993 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 994 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 995 op_err, 0, 0); 996 *abort_no_unlock = 1; 997 return (-1); 998 } 999 /* process according to association state... */ 1000 state = &stcb->asoc.state; 1001 switch (*state & SCTP_STATE_MASK) { 1002 case SCTP_STATE_COOKIE_WAIT: 1003 /* this is the expected state for this chunk */ 1004 /* process the INIT-ACK parameters */ 1005 if (stcb->asoc.primary_destination->dest_state & 1006 SCTP_ADDR_UNCONFIRMED) { 1007 /* 1008 * The primary is where we sent the INIT, we can 1009 * always consider it confirmed when the INIT-ACK is 1010 * returned. Do this before we load addresses 1011 * though. 1012 */ 1013 stcb->asoc.primary_destination->dest_state &= 1014 ~SCTP_ADDR_UNCONFIRMED; 1015 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 1016 stcb, 0, (void *)stcb->asoc.primary_destination); 1017 } 1018 if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb, 1019 net, abort_no_unlock, vrf_id, 1020 table_id) < 0) { 1021 /* error in parsing parameters */ 1022 return (-1); 1023 } 1024 /* update our state */ 1025#ifdef SCTP_DEBUG 1026 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1027 printf("moving to COOKIE-ECHOED state\n"); 1028 } 1029#endif 1030 if (*state & SCTP_STATE_SHUTDOWN_PENDING) { 1031 *state = SCTP_STATE_COOKIE_ECHOED | 1032 SCTP_STATE_SHUTDOWN_PENDING; 1033 } else { 1034 *state = SCTP_STATE_COOKIE_ECHOED; 1035 } 1036 1037 /* reset the RTO calc */ 1038 stcb->asoc.overall_error_count = 0; 1039 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered); 1040 /* 1041 * collapse the init timer back in case of a exponential 1042 * backoff 1043 */ 1044 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep, 1045 stcb, net); 1046 /* 1047 * the send at the end of the inbound data processing will 1048 * cause the cookie to be sent 1049 */ 1050 break; 1051 case SCTP_STATE_SHUTDOWN_SENT: 1052 /* incorrect state... discard */ 1053 break; 1054 case SCTP_STATE_COOKIE_ECHOED: 1055 /* incorrect state... discard */ 1056 break; 1057 case SCTP_STATE_OPEN: 1058 /* incorrect state... discard */ 1059 break; 1060 case SCTP_STATE_EMPTY: 1061 case SCTP_STATE_INUSE: 1062 default: 1063 /* incorrect state... discard */ 1064 return (-1); 1065 break; 1066 } /* end switch asoc state */ 1067#ifdef SCTP_DEBUG 1068 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1069 printf("Leaving handle-init-ack end\n"); 1070 } 1071#endif 1072 return (0); 1073} 1074 1075 1076/* 1077 * handle a state cookie for an existing association m: input packet mbuf 1078 * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a 1079 * "split" mbuf and the cookie signature does not exist offset: offset into 1080 * mbuf to the cookie-echo chunk 1081 */ 1082static struct sctp_tcb * 1083sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset, 1084 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1085 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 1086 struct sockaddr *init_src, int *notification, sctp_assoc_t * sac_assoc_id, 1087 uint32_t vrf_id, uint32_t table_id) 1088{ 1089 struct sctp_association *asoc; 1090 struct sctp_init_chunk *init_cp, init_buf; 1091 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1092 int chk_length; 1093 int init_offset, initack_offset, i; 1094 int retval; 1095 int spec_flag = 0; 1096 int how_indx; 1097 1098 /* I know that the TCB is non-NULL from the caller */ 1099 asoc = &stcb->asoc; 1100 for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) { 1101 if (asoc->cookie_how[how_indx] == 0) 1102 break; 1103 } 1104 if (how_indx < sizeof(asoc->cookie_how)) { 1105 asoc->cookie_how[how_indx] = 1; 1106 } 1107 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) { 1108 /* SHUTDOWN came in after sending INIT-ACK */ 1109 struct mbuf *op_err; 1110 struct sctp_paramhdr *ph; 1111 1112 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 1113 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 1114 0, M_DONTWAIT, 1, MT_DATA); 1115 if (op_err == NULL) { 1116 /* FOOBAR */ 1117 return (NULL); 1118 } 1119 /* pre-reserve some space */ 1120 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 1121 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 1122 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 1123 /* Set the len */ 1124 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr); 1125 ph = mtod(op_err, struct sctp_paramhdr *); 1126 ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN); 1127 ph->param_length = htons(sizeof(struct sctp_paramhdr)); 1128 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag, 1129 vrf_id, table_id); 1130 if (how_indx < sizeof(asoc->cookie_how)) 1131 asoc->cookie_how[how_indx] = 2; 1132 return (NULL); 1133 } 1134 /* 1135 * find and validate the INIT chunk in the cookie (peer's info) the 1136 * INIT should start after the cookie-echo header struct (chunk 1137 * header, state cookie header struct) 1138 */ 1139 init_offset = offset += sizeof(struct sctp_cookie_echo_chunk); 1140 1141 init_cp = (struct sctp_init_chunk *) 1142 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1143 (uint8_t *) & init_buf); 1144 if (init_cp == NULL) { 1145 /* could not pull a INIT chunk in cookie */ 1146 return (NULL); 1147 } 1148 chk_length = ntohs(init_cp->ch.chunk_length); 1149 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1150 return (NULL); 1151 } 1152 /* 1153 * find and validate the INIT-ACK chunk in the cookie (my info) the 1154 * INIT-ACK follows the INIT chunk 1155 */ 1156 initack_offset = init_offset + SCTP_SIZE32(chk_length); 1157 initack_cp = (struct sctp_init_ack_chunk *) 1158 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1159 (uint8_t *) & initack_buf); 1160 if (initack_cp == NULL) { 1161 /* could not pull INIT-ACK chunk in cookie */ 1162 return (NULL); 1163 } 1164 chk_length = ntohs(initack_cp->ch.chunk_length); 1165 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1166 return (NULL); 1167 } 1168 if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) && 1169 (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) { 1170 /* 1171 * case D in Section 5.2.4 Table 2: MMAA process accordingly 1172 * to get into the OPEN state 1173 */ 1174 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) { 1175#ifdef INVARIANTS 1176 panic("Case D and non-match seq?"); 1177#else 1178 printf("Case D, seq non-match %x vs %x?\n", 1179 ntohl(initack_cp->init.initial_tsn), asoc->init_seq_number); 1180#endif 1181 } 1182 switch SCTP_GET_STATE 1183 (asoc) { 1184 case SCTP_STATE_COOKIE_WAIT: 1185 case SCTP_STATE_COOKIE_ECHOED: 1186 /* 1187 * INIT was sent but got a COOKIE_ECHO with the 1188 * correct tags... just accept it...but we must 1189 * process the init so that we can make sure we have 1190 * the right seq no's. 1191 */ 1192 /* First we must process the INIT !! */ 1193 retval = sctp_process_init(init_cp, stcb, net); 1194 if (retval < 0) { 1195 if (how_indx < sizeof(asoc->cookie_how)) 1196 asoc->cookie_how[how_indx] = 3; 1197 return (NULL); 1198 } 1199 /* we have already processed the INIT so no problem */ 1200 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, 1201 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_11); 1202 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12); 1203 /* update current state */ 1204 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) 1205 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1206 else 1207 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1208 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1209 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1210 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1211 stcb->sctp_ep, stcb, asoc->primary_destination); 1212 1213 } else { 1214 /* if ok, move to OPEN state */ 1215 asoc->state = SCTP_STATE_OPEN; 1216 } 1217 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1218 sctp_stop_all_cookie_timers(stcb); 1219 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1220 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1221 (inp->sctp_socket->so_qlimit == 0) 1222 ) { 1223 /* 1224 * Here is where collision would go if we 1225 * did a connect() and instead got a 1226 * init/init-ack/cookie done before the 1227 * init-ack came back.. 1228 */ 1229 stcb->sctp_ep->sctp_flags |= 1230 SCTP_PCB_FLAGS_CONNECTED; 1231 soisconnected(stcb->sctp_ep->sctp_socket); 1232 } 1233 /* notify upper layer */ 1234 *notification = SCTP_NOTIFY_ASSOC_UP; 1235 /* 1236 * since we did not send a HB make sure we don't 1237 * double things 1238 */ 1239 net->hb_responded = 1; 1240 1241 if (stcb->asoc.sctp_autoclose_ticks && 1242 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) { 1243 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 1244 inp, stcb, NULL); 1245 } 1246 break; 1247 default: 1248 /* 1249 * we're in the OPEN state (or beyond), so peer must 1250 * have simply lost the COOKIE-ACK 1251 */ 1252 break; 1253 } /* end switch */ 1254 sctp_stop_all_cookie_timers(stcb); 1255 /* 1256 * We ignore the return code here.. not sure if we should 1257 * somehow abort.. but we do have an existing asoc. This 1258 * really should not fail. 1259 */ 1260 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1261 init_offset + sizeof(struct sctp_init_chunk), 1262 initack_offset, sh, init_src)) { 1263 if (how_indx < sizeof(asoc->cookie_how)) 1264 asoc->cookie_how[how_indx] = 4; 1265 return (NULL); 1266 } 1267 /* respond with a COOKIE-ACK */ 1268 sctp_toss_old_cookies(stcb, asoc); 1269 sctp_send_cookie_ack(stcb); 1270 if (how_indx < sizeof(asoc->cookie_how)) 1271 asoc->cookie_how[how_indx] = 5; 1272 return (stcb); 1273 } 1274 if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1275 ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag && 1276 cookie->tie_tag_my_vtag == 0 && 1277 cookie->tie_tag_peer_vtag == 0) { 1278 /* 1279 * case C in Section 5.2.4 Table 2: XMOO silently discard 1280 */ 1281 if (how_indx < sizeof(asoc->cookie_how)) 1282 asoc->cookie_how[how_indx] = 6; 1283 return (NULL); 1284 } 1285 if (ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag && 1286 (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag || 1287 init_cp->init.initiate_tag == 0)) { 1288 /* 1289 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info 1290 * should be ok, re-accept peer info 1291 */ 1292 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) { 1293 /* 1294 * Extension of case C. If we hit this, then the 1295 * random number generator returned the same vtag 1296 * when we first sent our INIT-ACK and when we later 1297 * sent our INIT. The side with the seq numbers that 1298 * are different will be the one that normnally 1299 * would have hit case C. This in effect "extends" 1300 * our vtags in this collision case to be 64 bits. 1301 * The same collision could occur aka you get both 1302 * vtag and seq number the same twice in a row.. but 1303 * is much less likely. If it did happen then we 1304 * would proceed through and bring up the assoc.. we 1305 * may end up with the wrong stream setup however.. 1306 * which would be bad.. but there is no way to 1307 * tell.. until we send on a stream that does not 1308 * exist :-) 1309 */ 1310 if (how_indx < sizeof(asoc->cookie_how)) 1311 asoc->cookie_how[how_indx] = 7; 1312 1313 return (NULL); 1314 } 1315 if (how_indx < sizeof(asoc->cookie_how)) 1316 asoc->cookie_how[how_indx] = 8; 1317 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13); 1318 sctp_stop_all_cookie_timers(stcb); 1319 /* 1320 * since we did not send a HB make sure we don't double 1321 * things 1322 */ 1323 net->hb_responded = 1; 1324 if (stcb->asoc.sctp_autoclose_ticks && 1325 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1326 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, 1327 NULL); 1328 } 1329 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1330 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1331 1332 /* Note last_cwr_tsn? where is this used? */ 1333 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1334 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) { 1335 /* 1336 * Ok the peer probably discarded our data (if we 1337 * echoed a cookie+data). So anything on the 1338 * sent_queue should be marked for retransmit, we 1339 * may not get something to kick us so it COULD 1340 * still take a timeout to move these.. but it can't 1341 * hurt to mark them. 1342 */ 1343 struct sctp_tmit_chunk *chk; 1344 1345 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 1346 if (chk->sent < SCTP_DATAGRAM_RESEND) { 1347 chk->sent = SCTP_DATAGRAM_RESEND; 1348 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 1349 spec_flag++; 1350 } 1351 } 1352 1353 } 1354 /* process the INIT info (peer's info) */ 1355 retval = sctp_process_init(init_cp, stcb, net); 1356 if (retval < 0) { 1357 if (how_indx < sizeof(asoc->cookie_how)) 1358 asoc->cookie_how[how_indx] = 9; 1359 return (NULL); 1360 } 1361 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1362 init_offset + sizeof(struct sctp_init_chunk), 1363 initack_offset, sh, init_src)) { 1364 if (how_indx < sizeof(asoc->cookie_how)) 1365 asoc->cookie_how[how_indx] = 10; 1366 return (NULL); 1367 } 1368 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) || 1369 (asoc->state & SCTP_STATE_COOKIE_ECHOED)) { 1370 *notification = SCTP_NOTIFY_ASSOC_UP; 1371 1372 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1373 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1374 (inp->sctp_socket->so_qlimit == 0)) { 1375 stcb->sctp_ep->sctp_flags |= 1376 SCTP_PCB_FLAGS_CONNECTED; 1377 soisconnected(stcb->sctp_ep->sctp_socket); 1378 } 1379 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) 1380 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1381 else 1382 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1383 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 1384 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1385 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 1386 SCTP_STAT_INCR_COUNTER32(sctps_restartestab); 1387 } else { 1388 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab); 1389 } 1390 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1391 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1392 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1393 stcb->sctp_ep, stcb, asoc->primary_destination); 1394 1395 } else { 1396 asoc->state = SCTP_STATE_OPEN; 1397 } 1398 sctp_stop_all_cookie_timers(stcb); 1399 sctp_toss_old_cookies(stcb, asoc); 1400 sctp_send_cookie_ack(stcb); 1401 if (spec_flag) { 1402 /* 1403 * only if we have retrans set do we do this. What 1404 * this call does is get only the COOKIE-ACK out and 1405 * then when we return the normal call to 1406 * sctp_chunk_output will get the retrans out behind 1407 * this. 1408 */ 1409 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK); 1410 } 1411 if (how_indx < sizeof(asoc->cookie_how)) 1412 asoc->cookie_how[how_indx] = 11; 1413 1414 return (stcb); 1415 } 1416 if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1417 ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) && 1418 cookie->tie_tag_my_vtag == asoc->my_vtag_nonce && 1419 cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce && 1420 cookie->tie_tag_peer_vtag != 0) { 1421 struct sctpasochead *head; 1422 1423 /* 1424 * case A in Section 5.2.4 Table 2: XXMM (peer restarted) 1425 */ 1426 /* temp code */ 1427 if (how_indx < sizeof(asoc->cookie_how)) 1428 asoc->cookie_how[how_indx] = 12; 1429 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14); 1430 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15); 1431 1432 *sac_assoc_id = sctp_get_associd(stcb); 1433 /* notify upper layer */ 1434 *notification = SCTP_NOTIFY_ASSOC_RESTART; 1435 atomic_add_int(&stcb->asoc.refcnt, 1); 1436 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) && 1437 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 1438 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 1439 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1440 } 1441 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 1442 SCTP_STAT_INCR_GAUGE32(sctps_restartestab); 1443 } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) { 1444 SCTP_STAT_INCR_GAUGE32(sctps_collisionestab); 1445 } 1446 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1447 asoc->state = SCTP_STATE_OPEN | 1448 SCTP_STATE_SHUTDOWN_PENDING; 1449 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1450 stcb->sctp_ep, stcb, asoc->primary_destination); 1451 1452 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) { 1453 /* move to OPEN state, if not in SHUTDOWN_SENT */ 1454 asoc->state = SCTP_STATE_OPEN; 1455 } 1456 asoc->pre_open_streams = 1457 ntohs(initack_cp->init.num_outbound_streams); 1458 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1459 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1460 1461 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1462 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1463 1464 asoc->str_reset_seq_in = asoc->init_seq_number; 1465 1466 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1467 if (asoc->mapping_array) 1468 memset(asoc->mapping_array, 0, 1469 asoc->mapping_array_size); 1470 SCTP_TCB_UNLOCK(stcb); 1471 SCTP_INP_INFO_WLOCK(); 1472 SCTP_INP_WLOCK(stcb->sctp_ep); 1473 SCTP_TCB_LOCK(stcb); 1474 atomic_add_int(&stcb->asoc.refcnt, -1); 1475 /* send up all the data */ 1476 SCTP_TCB_SEND_LOCK(stcb); 1477 1478 sctp_report_all_outbound(stcb, 1); 1479 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 1480 stcb->asoc.strmout[i].stream_no = i; 1481 stcb->asoc.strmout[i].next_sequence_sent = 0; 1482 stcb->asoc.strmout[i].last_msg_incomplete = 0; 1483 } 1484 /* process the INIT-ACK info (my info) */ 1485 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1486 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1487 1488 /* pull from vtag hash */ 1489 LIST_REMOVE(stcb, sctp_asocs); 1490 /* re-insert to new vtag position */ 1491 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, 1492 sctppcbinfo.hashasocmark)]; 1493 /* 1494 * put it in the bucket in the vtag hash of assoc's for the 1495 * system 1496 */ 1497 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 1498 1499 /* Is this the first restart? */ 1500 if (stcb->asoc.in_restart_hash == 0) { 1501 /* Ok add it to assoc_id vtag hash */ 1502 head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id, 1503 sctppcbinfo.hashrestartmark)]; 1504 LIST_INSERT_HEAD(head, stcb, sctp_tcbrestarhash); 1505 stcb->asoc.in_restart_hash = 1; 1506 } 1507 /* process the INIT info (peer's info) */ 1508 SCTP_TCB_SEND_UNLOCK(stcb); 1509 SCTP_INP_WUNLOCK(stcb->sctp_ep); 1510 SCTP_INP_INFO_WUNLOCK(); 1511 1512 retval = sctp_process_init(init_cp, stcb, net); 1513 if (retval < 0) { 1514 if (how_indx < sizeof(asoc->cookie_how)) 1515 asoc->cookie_how[how_indx] = 13; 1516 1517 return (NULL); 1518 } 1519 /* 1520 * since we did not send a HB make sure we don't double 1521 * things 1522 */ 1523 net->hb_responded = 1; 1524 1525 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1526 init_offset + sizeof(struct sctp_init_chunk), 1527 initack_offset, sh, init_src)) { 1528 if (how_indx < sizeof(asoc->cookie_how)) 1529 asoc->cookie_how[how_indx] = 14; 1530 1531 return (NULL); 1532 } 1533 /* respond with a COOKIE-ACK */ 1534 sctp_stop_all_cookie_timers(stcb); 1535 sctp_toss_old_cookies(stcb, asoc); 1536 sctp_send_cookie_ack(stcb); 1537 if (how_indx < sizeof(asoc->cookie_how)) 1538 asoc->cookie_how[how_indx] = 15; 1539 1540 return (stcb); 1541 } 1542 if (how_indx < sizeof(asoc->cookie_how)) 1543 asoc->cookie_how[how_indx] = 16; 1544 /* all other cases... */ 1545 return (NULL); 1546} 1547 1548 1549/* 1550 * handle a state cookie for a new association m: input packet mbuf chain-- 1551 * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf 1552 * and the cookie signature does not exist offset: offset into mbuf to the 1553 * cookie-echo chunk length: length of the cookie chunk to: where the init 1554 * was from returns a new TCB 1555 */ 1556static struct sctp_tcb * 1557sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset, 1558 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1559 struct sctp_inpcb *inp, struct sctp_nets **netp, 1560 struct sockaddr *init_src, int *notification, 1561 int auth_skipped, uint32_t auth_offset, uint32_t auth_len, 1562 uint32_t vrf_id, uint32_t table_id) 1563{ 1564 struct sctp_tcb *stcb; 1565 struct sctp_init_chunk *init_cp, init_buf; 1566 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1567 struct sockaddr_storage sa_store; 1568 struct sockaddr *initack_src = (struct sockaddr *)&sa_store; 1569 struct sockaddr_in *sin; 1570 struct sockaddr_in6 *sin6; 1571 struct sctp_association *asoc; 1572 int chk_length; 1573 int init_offset, initack_offset, initack_limit; 1574 int retval; 1575 int error = 0; 1576 uint32_t old_tag; 1577 uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE]; 1578 1579 /* 1580 * find and validate the INIT chunk in the cookie (peer's info) the 1581 * INIT should start after the cookie-echo header struct (chunk 1582 * header, state cookie header struct) 1583 */ 1584 init_offset = offset + sizeof(struct sctp_cookie_echo_chunk); 1585 init_cp = (struct sctp_init_chunk *) 1586 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1587 (uint8_t *) & init_buf); 1588 if (init_cp == NULL) { 1589 /* could not pull a INIT chunk in cookie */ 1590#ifdef SCTP_DEBUG 1591 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1592 printf("process_cookie_new: could not pull INIT chunk hdr\n"); 1593 } 1594#endif /* SCTP_DEBUG */ 1595 return (NULL); 1596 } 1597 chk_length = ntohs(init_cp->ch.chunk_length); 1598 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1599#ifdef SCTP_DEBUG 1600 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1601 printf("HUH? process_cookie_new: could not find INIT chunk!\n"); 1602 } 1603#endif /* SCTP_DEBUG */ 1604 return (NULL); 1605 } 1606 initack_offset = init_offset + SCTP_SIZE32(chk_length); 1607 /* 1608 * find and validate the INIT-ACK chunk in the cookie (my info) the 1609 * INIT-ACK follows the INIT chunk 1610 */ 1611 initack_cp = (struct sctp_init_ack_chunk *) 1612 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1613 (uint8_t *) & initack_buf); 1614 if (initack_cp == NULL) { 1615 /* could not pull INIT-ACK chunk in cookie */ 1616#ifdef SCTP_DEBUG 1617 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1618 printf("process_cookie_new: could not pull INIT-ACK chunk hdr\n"); 1619 } 1620#endif /* SCTP_DEBUG */ 1621 return (NULL); 1622 } 1623 chk_length = ntohs(initack_cp->ch.chunk_length); 1624 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1625 return (NULL); 1626 } 1627 /* 1628 * NOTE: We can't use the INIT_ACK's chk_length to determine the 1629 * "initack_limit" value. This is because the chk_length field 1630 * includes the length of the cookie, but the cookie is omitted when 1631 * the INIT and INIT_ACK are tacked onto the cookie... 1632 */ 1633 initack_limit = offset + cookie_len; 1634 1635 /* 1636 * now that we know the INIT/INIT-ACK are in place, create a new TCB 1637 * and popluate 1638 */ 1639 stcb = sctp_aloc_assoc(inp, init_src, 0, &error, 1640 ntohl(initack_cp->init.initiate_tag), vrf_id); 1641 if (stcb == NULL) { 1642 struct mbuf *op_err; 1643 1644 /* memory problem? */ 1645#ifdef SCTP_DEBUG 1646 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1647 printf("process_cookie_new: no room for another TCB!\n"); 1648 } 1649#endif 1650 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1651 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 1652 sh, op_err, vrf_id, table_id); 1653 return (NULL); 1654 } 1655 /* get the correct sctp_nets */ 1656 *netp = sctp_findnet(stcb, init_src); 1657 asoc = &stcb->asoc; 1658 /* save the table id (vrf_id is done in aloc_assoc) */ 1659 asoc->table_id = table_id; 1660 /* get scope variables out of cookie */ 1661 asoc->ipv4_local_scope = cookie->ipv4_scope; 1662 asoc->site_scope = cookie->site_scope; 1663 asoc->local_scope = cookie->local_scope; 1664 asoc->loopback_scope = cookie->loopback_scope; 1665 1666 if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) || 1667 (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) { 1668 struct mbuf *op_err; 1669 1670 /* 1671 * Houston we have a problem. The EP changed while the 1672 * cookie was in flight. Only recourse is to abort the 1673 * association. 1674 */ 1675 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1676 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 1677 sh, op_err, vrf_id, table_id); 1678 return (NULL); 1679 } 1680 /* process the INIT-ACK info (my info) */ 1681 old_tag = asoc->my_vtag; 1682 asoc->assoc_id = asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1683 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1684 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1685 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1686 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1687 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1688 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1689 asoc->str_reset_seq_in = asoc->init_seq_number; 1690 1691 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1692 1693 /* process the INIT info (peer's info) */ 1694 retval = sctp_process_init(init_cp, stcb, *netp); 1695 if (retval < 0) { 1696 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16); 1697 return (NULL); 1698 } 1699 /* load all addresses */ 1700 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1701 init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh, 1702 init_src)) { 1703 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17); 1704 return (NULL); 1705 } 1706 /* 1707 * verify any preceding AUTH chunk that was skipped 1708 */ 1709 /* pull the local authentication parameters from the cookie/init-ack */ 1710 sctp_auth_get_cookie_params(stcb, m, 1711 initack_offset + sizeof(struct sctp_init_ack_chunk), 1712 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk))); 1713 if (auth_skipped) { 1714 struct sctp_auth_chunk *auth; 1715 1716 auth = (struct sctp_auth_chunk *) 1717 sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf); 1718 if (sctp_handle_auth(stcb, auth, m, auth_offset)) { 1719 /* auth HMAC failed, dump the assoc and packet */ 1720#ifdef SCTP_DEBUG 1721 if (sctp_debug_on & SCTP_DEBUG_AUTH1) 1722 printf("COOKIE-ECHO: AUTH failed\n"); 1723#endif /* SCTP_DEBUG */ 1724 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18); 1725 return (NULL); 1726 } else { 1727 /* remaining chunks checked... good to go */ 1728 stcb->asoc.authenticated = 1; 1729 } 1730 } 1731 /* update current state */ 1732#ifdef SCTP_DEBUG 1733 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1734 printf("moving to OPEN state\n"); 1735 } 1736#endif 1737 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1738 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1739 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1740 stcb->sctp_ep, stcb, asoc->primary_destination); 1741 } else { 1742 asoc->state = SCTP_STATE_OPEN; 1743 } 1744 sctp_stop_all_cookie_timers(stcb); 1745 SCTP_STAT_INCR_COUNTER32(sctps_passiveestab); 1746 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1747 1748 /* 1749 * if we're doing ASCONFs, check to see if we have any new local 1750 * addresses that need to get added to the peer (eg. addresses 1751 * changed while cookie echo in flight). This needs to be done 1752 * after we go to the OPEN state to do the correct asconf 1753 * processing. else, make sure we have the correct addresses in our 1754 * lists 1755 */ 1756 1757 /* warning, we re-use sin, sin6, sa_store here! */ 1758 /* pull in local_address (our "from" address) */ 1759 if (cookie->laddr_type == SCTP_IPV4_ADDRESS) { 1760 /* source addr is IPv4 */ 1761 sin = (struct sockaddr_in *)initack_src; 1762 memset(sin, 0, sizeof(*sin)); 1763 sin->sin_family = AF_INET; 1764 sin->sin_len = sizeof(struct sockaddr_in); 1765 sin->sin_addr.s_addr = cookie->laddress[0]; 1766 } else if (cookie->laddr_type == SCTP_IPV6_ADDRESS) { 1767 /* source addr is IPv6 */ 1768 sin6 = (struct sockaddr_in6 *)initack_src; 1769 memset(sin6, 0, sizeof(*sin6)); 1770 sin6->sin6_family = AF_INET6; 1771 sin6->sin6_len = sizeof(struct sockaddr_in6); 1772 sin6->sin6_scope_id = cookie->scope_id; 1773 memcpy(&sin6->sin6_addr, cookie->laddress, 1774 sizeof(sin6->sin6_addr)); 1775 } else { 1776 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19); 1777 return (NULL); 1778 } 1779 1780 sctp_check_address_list(stcb, m, 1781 initack_offset + sizeof(struct sctp_init_ack_chunk), 1782 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)), 1783 initack_src, cookie->local_scope, cookie->site_scope, 1784 cookie->ipv4_scope, cookie->loopback_scope); 1785 1786 1787 /* set up to notify upper layer */ 1788 *notification = SCTP_NOTIFY_ASSOC_UP; 1789 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1790 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1791 (inp->sctp_socket->so_qlimit == 0)) { 1792 /* 1793 * This is an endpoint that called connect() how it got a 1794 * cookie that is NEW is a bit of a mystery. It must be that 1795 * the INIT was sent, but before it got there.. a complete 1796 * INIT/INIT-ACK/COOKIE arrived. But of course then it 1797 * should have went to the other code.. not here.. oh well.. 1798 * a bit of protection is worth having.. 1799 */ 1800 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 1801 soisconnected(stcb->sctp_ep->sctp_socket); 1802 } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 1803 (inp->sctp_socket->so_qlimit)) { 1804 /* 1805 * We don't want to do anything with this one. Since it is 1806 * the listening guy. The timer will get started for 1807 * accepted connections in the caller. 1808 */ 1809 ; 1810 } 1811 /* since we did not send a HB make sure we don't double things */ 1812 (*netp)->hb_responded = 1; 1813 1814 if (stcb->asoc.sctp_autoclose_ticks && 1815 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1816 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL); 1817 } 1818 /* respond with a COOKIE-ACK */ 1819 /* calculate the RTT */ 1820 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp, 1821 &cookie->time_entered); 1822 sctp_send_cookie_ack(stcb); 1823 return (stcb); 1824} 1825 1826 1827/* 1828 * handles a COOKIE-ECHO message stcb: modified to either a new or left as 1829 * existing (non-NULL) TCB 1830 */ 1831static struct mbuf * 1832sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset, 1833 struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp, 1834 struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp, 1835 int auth_skipped, uint32_t auth_offset, uint32_t auth_len, 1836 struct sctp_tcb **locked_tcb, uint32_t vrf_id, uint32_t table_id) 1837{ 1838 struct sctp_state_cookie *cookie; 1839 struct sockaddr_in6 sin6; 1840 struct sockaddr_in sin; 1841 struct sctp_tcb *l_stcb = *stcb; 1842 struct sctp_inpcb *l_inp; 1843 struct sockaddr *to; 1844 sctp_assoc_t sac_restart_id; 1845 struct sctp_pcb *ep; 1846 struct mbuf *m_sig; 1847 uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE]; 1848 uint8_t *sig; 1849 uint8_t cookie_ok = 0; 1850 unsigned int size_of_pkt, sig_offset, cookie_offset; 1851 unsigned int cookie_len; 1852 struct timeval now; 1853 struct timeval time_expires; 1854 struct sockaddr_storage dest_store; 1855 struct sockaddr *localep_sa = (struct sockaddr *)&dest_store; 1856 struct ip *iph; 1857 int notification = 0; 1858 struct sctp_nets *netl; 1859 int had_a_existing_tcb = 0; 1860 1861#ifdef SCTP_DEBUG 1862 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1863 printf("sctp_handle_cookie: handling COOKIE-ECHO\n"); 1864 } 1865#endif 1866 1867 if (inp_p == NULL) { 1868 return (NULL); 1869 } 1870 /* First get the destination address setup too. */ 1871 iph = mtod(m, struct ip *); 1872 if (iph->ip_v == IPVERSION) { 1873 /* its IPv4 */ 1874 struct sockaddr_in *sin; 1875 1876 sin = (struct sockaddr_in *)(localep_sa); 1877 memset(sin, 0, sizeof(*sin)); 1878 sin->sin_family = AF_INET; 1879 sin->sin_len = sizeof(*sin); 1880 sin->sin_port = sh->dest_port; 1881 sin->sin_addr.s_addr = iph->ip_dst.s_addr; 1882 size_of_pkt = SCTP_GET_IPV4_LENGTH(iph); 1883 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1884 /* its IPv6 */ 1885 struct ip6_hdr *ip6; 1886 struct sockaddr_in6 *sin6; 1887 1888 sin6 = (struct sockaddr_in6 *)(localep_sa); 1889 memset(sin6, 0, sizeof(*sin6)); 1890 sin6->sin6_family = AF_INET6; 1891 sin6->sin6_len = sizeof(struct sockaddr_in6); 1892 ip6 = mtod(m, struct ip6_hdr *); 1893 sin6->sin6_port = sh->dest_port; 1894 sin6->sin6_addr = ip6->ip6_dst; 1895 size_of_pkt = SCTP_GET_IPV6_LENGTH(ip6) + iphlen; 1896 } else { 1897 return (NULL); 1898 } 1899 1900 cookie = &cp->cookie; 1901 cookie_offset = offset + sizeof(struct sctp_chunkhdr); 1902 cookie_len = ntohs(cp->ch.chunk_length); 1903 1904 if ((cookie->peerport != sh->src_port) && 1905 (cookie->myport != sh->dest_port) && 1906 (cookie->my_vtag != sh->v_tag)) { 1907 /* 1908 * invalid ports or bad tag. Note that we always leave the 1909 * v_tag in the header in network order and when we stored 1910 * it in the my_vtag slot we also left it in network order. 1911 * This maintains the match even though it may be in the 1912 * opposite byte order of the machine :-> 1913 */ 1914 return (NULL); 1915 } 1916 if (cookie_len > size_of_pkt || 1917 cookie_len < sizeof(struct sctp_cookie_echo_chunk) + 1918 sizeof(struct sctp_init_chunk) + 1919 sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) { 1920 /* cookie too long! or too small */ 1921 return (NULL); 1922 } 1923 /* 1924 * split off the signature into its own mbuf (since it should not be 1925 * calculated in the sctp_hmac_m() call). 1926 */ 1927 sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE; 1928 if (sig_offset > size_of_pkt) { 1929 /* packet not correct size! */ 1930 /* XXX this may already be accounted for earlier... */ 1931 return (NULL); 1932 } 1933 m_sig = m_split(m, sig_offset, M_DONTWAIT); 1934 if (m_sig == NULL) { 1935 /* out of memory or ?? */ 1936 return (NULL); 1937 } 1938 /* 1939 * compute the signature/digest for the cookie 1940 */ 1941 ep = &(*inp_p)->sctp_ep; 1942 l_inp = *inp_p; 1943 if (l_stcb) { 1944 SCTP_TCB_UNLOCK(l_stcb); 1945 } 1946 SCTP_INP_RLOCK(l_inp); 1947 if (l_stcb) { 1948 SCTP_TCB_LOCK(l_stcb); 1949 } 1950 /* which cookie is it? */ 1951 if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) && 1952 (ep->current_secret_number != ep->last_secret_number)) { 1953 /* it's the old cookie */ 1954 (void)sctp_hmac_m(SCTP_HMAC, 1955 (uint8_t *) ep->secret_key[(int)ep->last_secret_number], 1956 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1957 } else { 1958 /* it's the current cookie */ 1959 (void)sctp_hmac_m(SCTP_HMAC, 1960 (uint8_t *) ep->secret_key[(int)ep->current_secret_number], 1961 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1962 } 1963 /* get the signature */ 1964 SCTP_INP_RUNLOCK(l_inp); 1965 sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig); 1966 if (sig == NULL) { 1967 /* couldn't find signature */ 1968 sctp_m_freem(m_sig); 1969 return (NULL); 1970 } 1971 /* compare the received digest with the computed digest */ 1972 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) { 1973 /* try the old cookie? */ 1974 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) && 1975 (ep->current_secret_number != ep->last_secret_number)) { 1976 /* compute digest with old */ 1977 (void)sctp_hmac_m(SCTP_HMAC, 1978 (uint8_t *) ep->secret_key[(int)ep->last_secret_number], 1979 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1980 /* compare */ 1981 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0) 1982 cookie_ok = 1; 1983 } 1984 } else { 1985 cookie_ok = 1; 1986 } 1987 1988 /* 1989 * Now before we continue we must reconstruct our mbuf so that 1990 * normal processing of any other chunks will work. 1991 */ 1992 { 1993 struct mbuf *m_at; 1994 1995 m_at = m; 1996 while (SCTP_BUF_NEXT(m_at) != NULL) { 1997 m_at = SCTP_BUF_NEXT(m_at); 1998 } 1999 SCTP_BUF_NEXT(m_at) = m_sig; 2000 } 2001 2002 if (cookie_ok == 0) { 2003#ifdef SCTP_DEBUG 2004 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2005 printf("handle_cookie_echo: cookie signature validation failed!\n"); 2006 printf("offset = %u, cookie_offset = %u, sig_offset = %u\n", 2007 (uint32_t) offset, cookie_offset, sig_offset); 2008 } 2009#endif 2010 return (NULL); 2011 } 2012 /* 2013 * check the cookie timestamps to be sure it's not stale 2014 */ 2015 (void)SCTP_GETTIME_TIMEVAL(&now); 2016 /* Expire time is in Ticks, so we convert to seconds */ 2017 time_expires.tv_sec = cookie->time_entered.tv_sec + cookie->cookie_life; 2018 time_expires.tv_usec = cookie->time_entered.tv_usec; 2019 if (timevalcmp(&now, &time_expires, >)) { 2020 /* cookie is stale! */ 2021 struct mbuf *op_err; 2022 struct sctp_stale_cookie_msg *scm; 2023 uint32_t tim; 2024 2025 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg), 2026 0, M_DONTWAIT, 1, MT_DATA); 2027 if (op_err == NULL) { 2028 /* FOOBAR */ 2029 return (NULL); 2030 } 2031 /* pre-reserve some space */ 2032 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 2033 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 2034 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 2035 2036 /* Set the len */ 2037 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg); 2038 scm = mtod(op_err, struct sctp_stale_cookie_msg *); 2039 scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE); 2040 scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) + 2041 (sizeof(uint32_t)))); 2042 /* seconds to usec */ 2043 tim = (now.tv_sec - time_expires.tv_sec) * 1000000; 2044 /* add in usec */ 2045 if (tim == 0) 2046 tim = now.tv_usec - cookie->time_entered.tv_usec; 2047 scm->time_usec = htonl(tim); 2048 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag, 2049 vrf_id, table_id); 2050 return (NULL); 2051 } 2052 /* 2053 * Now we must see with the lookup address if we have an existing 2054 * asoc. This will only happen if we were in the COOKIE-WAIT state 2055 * and a INIT collided with us and somewhere the peer sent the 2056 * cookie on another address besides the single address our assoc 2057 * had for him. In this case we will have one of the tie-tags set at 2058 * least AND the address field in the cookie can be used to look it 2059 * up. 2060 */ 2061 to = NULL; 2062 if (cookie->addr_type == SCTP_IPV6_ADDRESS) { 2063 memset(&sin6, 0, sizeof(sin6)); 2064 sin6.sin6_family = AF_INET6; 2065 sin6.sin6_len = sizeof(sin6); 2066 sin6.sin6_port = sh->src_port; 2067 sin6.sin6_scope_id = cookie->scope_id; 2068 memcpy(&sin6.sin6_addr.s6_addr, cookie->address, 2069 sizeof(sin6.sin6_addr.s6_addr)); 2070 to = (struct sockaddr *)&sin6; 2071 } else if (cookie->addr_type == SCTP_IPV4_ADDRESS) { 2072 memset(&sin, 0, sizeof(sin)); 2073 sin.sin_family = AF_INET; 2074 sin.sin_len = sizeof(sin); 2075 sin.sin_port = sh->src_port; 2076 sin.sin_addr.s_addr = cookie->address[0]; 2077 to = (struct sockaddr *)&sin; 2078 } 2079 if ((*stcb == NULL) && to) { 2080 /* Yep, lets check */ 2081 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL); 2082 if (*stcb == NULL) { 2083 /* 2084 * We should have only got back the same inp. If we 2085 * got back a different ep we have a problem. The 2086 * original findep got back l_inp and now 2087 */ 2088 if (l_inp != *inp_p) { 2089 printf("Bad problem find_ep got a diff inp then special_locate?\n"); 2090 } 2091 } else { 2092 if (*locked_tcb == NULL) { 2093 /* 2094 * In this case we found the assoc only 2095 * after we locked the create lock. This 2096 * means we are in a colliding case and we 2097 * must make sure that we unlock the tcb if 2098 * its one of the cases where we throw away 2099 * the incoming packets. 2100 */ 2101 *locked_tcb = *stcb; 2102 2103 /* 2104 * We must also increment the inp ref count 2105 * since the ref_count flags was set when we 2106 * did not find the TCB, now we found it 2107 * which reduces the refcount.. we must 2108 * raise it back out to balance it all :-) 2109 */ 2110 SCTP_INP_INCR_REF((*stcb)->sctp_ep); 2111 if ((*stcb)->sctp_ep != l_inp) { 2112 printf("Huh? ep:%p diff then l_inp:%p?\n", 2113 (*stcb)->sctp_ep, l_inp); 2114 } 2115 } 2116 } 2117 } 2118 cookie_len -= SCTP_SIGNATURE_SIZE; 2119 if (*stcb == NULL) { 2120 /* this is the "normal" case... get a new TCB */ 2121 *stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie, 2122 cookie_len, *inp_p, netp, to, ¬ification, 2123 auth_skipped, auth_offset, auth_len, vrf_id, table_id); 2124 } else { 2125 /* this is abnormal... cookie-echo on existing TCB */ 2126 had_a_existing_tcb = 1; 2127 *stcb = sctp_process_cookie_existing(m, iphlen, offset, sh, 2128 cookie, cookie_len, *inp_p, *stcb, *netp, to, ¬ification, 2129 &sac_restart_id, vrf_id, table_id); 2130 } 2131 2132 if (*stcb == NULL) { 2133 /* still no TCB... must be bad cookie-echo */ 2134 return (NULL); 2135 } 2136 /* 2137 * Ok, we built an association so confirm the address we sent the 2138 * INIT-ACK to. 2139 */ 2140 netl = sctp_findnet(*stcb, to); 2141 /* 2142 * This code should in theory NOT run but 2143 */ 2144 if (netl == NULL) { 2145 /* TSNH! Huh, why do I need to add this address here? */ 2146 int ret; 2147 2148 ret = sctp_add_remote_addr(*stcb, to, SCTP_DONOT_SETSCOPE, 2149 SCTP_IN_COOKIE_PROC); 2150 netl = sctp_findnet(*stcb, to); 2151 } 2152 if (netl) { 2153 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) { 2154 netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2155 sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL, 2156 netl); 2157 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 2158 (*stcb), 0, (void *)netl); 2159 } 2160 } 2161 if (*stcb) { 2162 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, *inp_p, 2163 *stcb, NULL); 2164 } 2165 if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 2166 if (!had_a_existing_tcb || 2167 (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) { 2168 /* 2169 * If we have a NEW cookie or the connect never 2170 * reached the connected state during collision we 2171 * must do the TCP accept thing. 2172 */ 2173 struct socket *so, *oso; 2174 struct sctp_inpcb *inp; 2175 2176 if (notification == SCTP_NOTIFY_ASSOC_RESTART) { 2177 /* 2178 * For a restart we will keep the same 2179 * socket, no need to do anything. I THINK!! 2180 */ 2181 sctp_ulp_notify(notification, *stcb, 0, (void *)&sac_restart_id); 2182 return (m); 2183 } 2184 oso = (*inp_p)->sctp_socket; 2185 /* 2186 * We do this to keep the sockets side happy durin 2187 * the sonewcon ONLY. 2188 */ 2189 NET_LOCK_GIANT(); 2190 SCTP_TCB_UNLOCK((*stcb)); 2191 so = sonewconn(oso, 0 2192 ); 2193 NET_UNLOCK_GIANT(); 2194 SCTP_INP_WLOCK((*stcb)->sctp_ep); 2195 SCTP_TCB_LOCK((*stcb)); 2196 SCTP_INP_WUNLOCK((*stcb)->sctp_ep); 2197 if (so == NULL) { 2198 struct mbuf *op_err; 2199 2200 /* Too many sockets */ 2201#ifdef SCTP_DEBUG 2202 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 2203 printf("process_cookie_new: no room for another socket!\n"); 2204 } 2205#endif /* SCTP_DEBUG */ 2206 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 2207 sctp_abort_association(*inp_p, NULL, m, iphlen, 2208 sh, op_err, vrf_id, 2209 table_id); 2210 sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20); 2211 return (NULL); 2212 } 2213 inp = (struct sctp_inpcb *)so->so_pcb; 2214 SCTP_INP_INCR_REF(inp); 2215 /* 2216 * We add the unbound flag here so that if we get an 2217 * soabort() before we get the move_pcb done, we 2218 * will properly cleanup. 2219 */ 2220 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 2221 SCTP_PCB_FLAGS_CONNECTED | 2222 SCTP_PCB_FLAGS_IN_TCPPOOL | 2223 SCTP_PCB_FLAGS_UNBOUND | 2224 (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) | 2225 SCTP_PCB_FLAGS_DONT_WAKE); 2226 inp->sctp_features = (*inp_p)->sctp_features; 2227 inp->sctp_socket = so; 2228 inp->sctp_frag_point = (*inp_p)->sctp_frag_point; 2229 inp->partial_delivery_point = (*inp_p)->partial_delivery_point; 2230 inp->sctp_context = (*inp_p)->sctp_context; 2231 inp->inp_starting_point_for_iterator = NULL; 2232 /* 2233 * copy in the authentication parameters from the 2234 * original endpoint 2235 */ 2236 if (inp->sctp_ep.local_hmacs) 2237 sctp_free_hmaclist(inp->sctp_ep.local_hmacs); 2238 inp->sctp_ep.local_hmacs = 2239 sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs); 2240 if (inp->sctp_ep.local_auth_chunks) 2241 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks); 2242 inp->sctp_ep.local_auth_chunks = 2243 sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks); 2244 (void)sctp_copy_skeylist(&(*inp_p)->sctp_ep.shared_keys, 2245 &inp->sctp_ep.shared_keys); 2246 2247 /* 2248 * Now we must move it from one hash table to 2249 * another and get the tcb in the right place. 2250 */ 2251 sctp_move_pcb_and_assoc(*inp_p, inp, *stcb); 2252 sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb, M_NOWAIT); 2253 2254 /* 2255 * now we must check to see if we were aborted while 2256 * the move was going on and the lock/unlock 2257 * happened. 2258 */ 2259 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 2260 /* 2261 * yep it was, we leave the assoc attached 2262 * to the socket since the sctp_inpcb_free() 2263 * call will send an abort for us. 2264 */ 2265 SCTP_INP_DECR_REF(inp); 2266 return (NULL); 2267 } 2268 SCTP_INP_DECR_REF(inp); 2269 /* Switch over to the new guy */ 2270 *inp_p = inp; 2271 sctp_ulp_notify(notification, *stcb, 0, NULL); 2272 2273 /* 2274 * Pull it from the incomplete queue and wake the 2275 * guy 2276 */ 2277 soisconnected(so); 2278 return (m); 2279 } 2280 } 2281 if ((notification) && ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) { 2282 sctp_ulp_notify(notification, *stcb, 0, NULL); 2283 } 2284 return (m); 2285} 2286 2287static void 2288sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp, 2289 struct sctp_tcb *stcb, struct sctp_nets *net) 2290{ 2291 /* cp must not be used, others call this without a c-ack :-) */ 2292 struct sctp_association *asoc; 2293 2294#ifdef SCTP_DEBUG 2295 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2296 printf("sctp_handle_cookie_ack: handling COOKIE-ACK\n"); 2297 } 2298#endif 2299 if (stcb == NULL) 2300 return; 2301 2302 asoc = &stcb->asoc; 2303 2304 sctp_stop_all_cookie_timers(stcb); 2305 /* process according to association state */ 2306 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 2307 /* state change only needed when I am in right state */ 2308#ifdef SCTP_DEBUG 2309 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2310 printf("moving to OPEN state\n"); 2311 } 2312#endif 2313 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 2314 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 2315 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 2316 stcb->sctp_ep, stcb, asoc->primary_destination); 2317 2318 } else { 2319 asoc->state = SCTP_STATE_OPEN; 2320 } 2321 /* update RTO */ 2322 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 2323 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 2324 if (asoc->overall_error_count == 0) { 2325 net->RTO = sctp_calculate_rto(stcb, asoc, net, 2326 &asoc->time_entered); 2327 } 2328 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 2329 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL); 2330 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 2331 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 2332 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 2333 soisconnected(stcb->sctp_ep->sctp_socket); 2334 } 2335 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, 2336 stcb, net); 2337 /* 2338 * since we did not send a HB make sure we don't double 2339 * things 2340 */ 2341 net->hb_responded = 1; 2342 2343 if (stcb->asoc.sctp_autoclose_ticks && 2344 sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) { 2345 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 2346 stcb->sctp_ep, stcb, NULL); 2347 } 2348 /* 2349 * set ASCONF timer if ASCONFs are pending and allowed (eg. 2350 * addresses changed when init/cookie echo in flight) 2351 */ 2352 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) && 2353 (stcb->asoc.peer_supports_asconf) && 2354 (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) { 2355 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, 2356 stcb->sctp_ep, stcb, 2357 stcb->asoc.primary_destination); 2358 } 2359 } 2360 /* Toss the cookie if I can */ 2361 sctp_toss_old_cookies(stcb, asoc); 2362 if (!TAILQ_EMPTY(&asoc->sent_queue)) { 2363 /* Restart the timer if we have pending data */ 2364 struct sctp_tmit_chunk *chk; 2365 2366 chk = TAILQ_FIRST(&asoc->sent_queue); 2367 if (chk) { 2368 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2369 stcb, chk->whoTo); 2370 } 2371 } 2372} 2373 2374static void 2375sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp, 2376 struct sctp_tcb *stcb) 2377{ 2378 struct sctp_nets *net; 2379 struct sctp_tmit_chunk *lchk; 2380 uint32_t tsn; 2381 2382 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_ecne_chunk)) { 2383 return; 2384 } 2385 SCTP_STAT_INCR(sctps_recvecne); 2386 tsn = ntohl(cp->tsn); 2387 /* ECN Nonce stuff: need a resync and disable the nonce sum check */ 2388 /* Also we make sure we disable the nonce_wait */ 2389 lchk = TAILQ_FIRST(&stcb->asoc.send_queue); 2390 if (lchk == NULL) { 2391 stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq; 2392 } else { 2393 stcb->asoc.nonce_resync_tsn = lchk->rec.data.TSN_seq; 2394 } 2395 stcb->asoc.nonce_wait_for_ecne = 0; 2396 stcb->asoc.nonce_sum_check = 0; 2397 2398 /* Find where it was sent, if possible */ 2399 net = NULL; 2400 lchk = TAILQ_FIRST(&stcb->asoc.sent_queue); 2401 while (lchk) { 2402 if (lchk->rec.data.TSN_seq == tsn) { 2403 net = lchk->whoTo; 2404 break; 2405 } 2406 if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ)) 2407 break; 2408 lchk = TAILQ_NEXT(lchk, sctp_next); 2409 } 2410 if (net == NULL) 2411 /* default is we use the primary */ 2412 net = stcb->asoc.primary_destination; 2413 2414 if (compare_with_wrap(tsn, stcb->asoc.last_cwr_tsn, MAX_TSN)) { 2415#ifdef SCTP_CWND_MONITOR 2416 int old_cwnd; 2417 2418 old_cwnd = net->cwnd; 2419#endif 2420 SCTP_STAT_INCR(sctps_ecnereducedcwnd); 2421 net->ssthresh = net->cwnd / 2; 2422 if (net->ssthresh < net->mtu) { 2423 net->ssthresh = net->mtu; 2424 /* here back off the timer as well, to slow us down */ 2425 net->RTO <<= 2; 2426 } 2427 net->cwnd = net->ssthresh; 2428#ifdef SCTP_CWND_MONITOR 2429 sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_SAT); 2430#endif 2431 /* 2432 * we reduce once every RTT. So we will only lower cwnd at 2433 * the next sending seq i.e. the resync_tsn. 2434 */ 2435 stcb->asoc.last_cwr_tsn = stcb->asoc.nonce_resync_tsn; 2436 } 2437 /* 2438 * We always send a CWR this way if our previous one was lost our 2439 * peer will get an update, or if it is not time again to reduce we 2440 * still get the cwr to the peer. 2441 */ 2442 sctp_send_cwr(stcb, net, tsn); 2443} 2444 2445static void 2446sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb) 2447{ 2448 /* 2449 * Here we get a CWR from the peer. We must look in the outqueue and 2450 * make sure that we have a covered ECNE in teh control chunk part. 2451 * If so remove it. 2452 */ 2453 struct sctp_tmit_chunk *chk; 2454 struct sctp_ecne_chunk *ecne; 2455 2456 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 2457 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) { 2458 continue; 2459 } 2460 /* 2461 * Look for and remove if it is the right TSN. Since there 2462 * is only ONE ECNE on the control queue at any one time we 2463 * don't need to worry about more than one! 2464 */ 2465 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 2466 if (compare_with_wrap(ntohl(cp->tsn), ntohl(ecne->tsn), 2467 MAX_TSN) || (cp->tsn == ecne->tsn)) { 2468 /* this covers this ECNE, we can remove it */ 2469 stcb->asoc.ecn_echo_cnt_onq--; 2470 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, 2471 sctp_next); 2472 if (chk->data) { 2473 sctp_m_freem(chk->data); 2474 chk->data = NULL; 2475 } 2476 stcb->asoc.ctrl_queue_cnt--; 2477 sctp_free_remote_addr(chk->whoTo); 2478 sctp_free_a_chunk(stcb, chk); 2479 break; 2480 } 2481 } 2482} 2483 2484static void 2485sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp, 2486 struct sctp_tcb *stcb, struct sctp_nets *net) 2487{ 2488 struct sctp_association *asoc; 2489 2490#ifdef SCTP_DEBUG 2491 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2492 printf("sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n"); 2493 } 2494#endif 2495 if (stcb == NULL) 2496 return; 2497 2498 asoc = &stcb->asoc; 2499 /* process according to association state */ 2500 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) { 2501 /* unexpected SHUTDOWN-COMPLETE... so ignore... */ 2502 SCTP_TCB_UNLOCK(stcb); 2503 return; 2504 } 2505 /* notify upper layer protocol */ 2506 if (stcb->sctp_socket) { 2507 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 2508 /* are the queues empty? they should be */ 2509 if (!TAILQ_EMPTY(&asoc->send_queue) || 2510 !TAILQ_EMPTY(&asoc->sent_queue) || 2511 !TAILQ_EMPTY(&asoc->out_wheel)) { 2512 sctp_report_all_outbound(stcb, 0); 2513 } 2514 } 2515 /* stop the timer */ 2516 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_21); 2517 SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 2518 /* free the TCB */ 2519 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22); 2520 return; 2521} 2522 2523static int 2524process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc, 2525 struct sctp_nets *net, uint8_t flg) 2526{ 2527 switch (desc->chunk_type) { 2528 case SCTP_DATA: 2529 /* find the tsn to resend (possibly */ 2530 { 2531 uint32_t tsn; 2532 struct sctp_tmit_chunk *tp1; 2533 2534 tsn = ntohl(desc->tsn_ifany); 2535 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2536 while (tp1) { 2537 if (tp1->rec.data.TSN_seq == tsn) { 2538 /* found it */ 2539 break; 2540 } 2541 if (compare_with_wrap(tp1->rec.data.TSN_seq, tsn, 2542 MAX_TSN)) { 2543 /* not found */ 2544 tp1 = NULL; 2545 break; 2546 } 2547 tp1 = TAILQ_NEXT(tp1, sctp_next); 2548 } 2549 if (tp1 == NULL) { 2550 /* 2551 * Do it the other way , aka without paying 2552 * attention to queue seq order. 2553 */ 2554 SCTP_STAT_INCR(sctps_pdrpdnfnd); 2555 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2556 while (tp1) { 2557 if (tp1->rec.data.TSN_seq == tsn) { 2558 /* found it */ 2559 break; 2560 } 2561 tp1 = TAILQ_NEXT(tp1, sctp_next); 2562 } 2563 } 2564 if (tp1 == NULL) { 2565 SCTP_STAT_INCR(sctps_pdrptsnnf); 2566 } 2567 if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) { 2568 uint8_t *ddp; 2569 2570 if ((stcb->asoc.peers_rwnd == 0) && 2571 ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) { 2572 SCTP_STAT_INCR(sctps_pdrpdiwnp); 2573 return (0); 2574 } 2575 if (stcb->asoc.peers_rwnd == 0 && 2576 (flg & SCTP_FROM_MIDDLE_BOX)) { 2577 SCTP_STAT_INCR(sctps_pdrpdizrw); 2578 return (0); 2579 } 2580 ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+ 2581 sizeof(struct sctp_data_chunk)); 2582 { 2583 unsigned int iii; 2584 2585 for (iii = 0; iii < sizeof(desc->data_bytes); 2586 iii++) { 2587 if (ddp[iii] != desc->data_bytes[iii]) { 2588 SCTP_STAT_INCR(sctps_pdrpbadd); 2589 return (-1); 2590 } 2591 } 2592 } 2593 /* 2594 * We zero out the nonce so resync not 2595 * needed 2596 */ 2597 tp1->rec.data.ect_nonce = 0; 2598 2599 if (tp1->do_rtt) { 2600 /* 2601 * this guy had a RTO calculation 2602 * pending on it, cancel it 2603 */ 2604 tp1->do_rtt = 0; 2605 } 2606 SCTP_STAT_INCR(sctps_pdrpmark); 2607 if (tp1->sent != SCTP_DATAGRAM_RESEND) 2608 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2609 tp1->sent = SCTP_DATAGRAM_RESEND; 2610 /* 2611 * mark it as if we were doing a FR, since 2612 * we will be getting gap ack reports behind 2613 * the info from the router. 2614 */ 2615 tp1->rec.data.doing_fast_retransmit = 1; 2616 /* 2617 * mark the tsn with what sequences can 2618 * cause a new FR. 2619 */ 2620 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) { 2621 tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq; 2622 } else { 2623 tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq; 2624 } 2625 2626 /* restart the timer */ 2627 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2628 stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23); 2629 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2630 stcb, tp1->whoTo); 2631 2632 /* fix counts and things */ 2633#ifdef SCTP_FLIGHT_LOGGING 2634 sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP, 2635 tp1->whoTo->flight_size, 2636 tp1->book_size, 2637 (uintptr_t) stcb, 2638 tp1->rec.data.TSN_seq); 2639#endif 2640 sctp_flight_size_decrease(tp1); 2641 sctp_total_flight_decrease(stcb, tp1); 2642 } { 2643 /* audit code */ 2644 unsigned int audit; 2645 2646 audit = 0; 2647 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) { 2648 if (tp1->sent == SCTP_DATAGRAM_RESEND) 2649 audit++; 2650 } 2651 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue, 2652 sctp_next) { 2653 if (tp1->sent == SCTP_DATAGRAM_RESEND) 2654 audit++; 2655 } 2656 if (audit != stcb->asoc.sent_queue_retran_cnt) { 2657 printf("**Local Audit finds cnt:%d asoc cnt:%d\n", 2658 audit, stcb->asoc.sent_queue_retran_cnt); 2659#ifndef SCTP_AUDITING_ENABLED 2660 stcb->asoc.sent_queue_retran_cnt = audit; 2661#endif 2662 } 2663 } 2664 } 2665 break; 2666 case SCTP_ASCONF: 2667 { 2668 struct sctp_tmit_chunk *asconf; 2669 2670 TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue, 2671 sctp_next) { 2672 if (asconf->rec.chunk_id.id == SCTP_ASCONF) { 2673 break; 2674 } 2675 } 2676 if (asconf) { 2677 if (asconf->sent != SCTP_DATAGRAM_RESEND) 2678 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2679 asconf->sent = SCTP_DATAGRAM_RESEND; 2680 asconf->snd_count--; 2681 } 2682 } 2683 break; 2684 case SCTP_INITIATION: 2685 /* resend the INIT */ 2686 stcb->asoc.dropped_special_cnt++; 2687 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) { 2688 /* 2689 * If we can get it in, in a few attempts we do 2690 * this, otherwise we let the timer fire. 2691 */ 2692 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, 2693 stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24); 2694 sctp_send_initiate(stcb->sctp_ep, stcb); 2695 } 2696 break; 2697 case SCTP_SELECTIVE_ACK: 2698 /* resend the sack */ 2699 sctp_send_sack(stcb); 2700 break; 2701 case SCTP_HEARTBEAT_REQUEST: 2702 /* resend a demand HB */ 2703 (void)sctp_send_hb(stcb, 1, net); 2704 break; 2705 case SCTP_SHUTDOWN: 2706 sctp_send_shutdown(stcb, net); 2707 break; 2708 case SCTP_SHUTDOWN_ACK: 2709 sctp_send_shutdown_ack(stcb, net); 2710 break; 2711 case SCTP_COOKIE_ECHO: 2712 { 2713 struct sctp_tmit_chunk *cookie; 2714 2715 cookie = NULL; 2716 TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue, 2717 sctp_next) { 2718 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 2719 break; 2720 } 2721 } 2722 if (cookie) { 2723 if (cookie->sent != SCTP_DATAGRAM_RESEND) 2724 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2725 cookie->sent = SCTP_DATAGRAM_RESEND; 2726 sctp_stop_all_cookie_timers(stcb); 2727 } 2728 } 2729 break; 2730 case SCTP_COOKIE_ACK: 2731 sctp_send_cookie_ack(stcb); 2732 break; 2733 case SCTP_ASCONF_ACK: 2734 /* resend last asconf ack */ 2735 sctp_send_asconf_ack(stcb, 1); 2736 break; 2737 case SCTP_FORWARD_CUM_TSN: 2738 send_forward_tsn(stcb, &stcb->asoc); 2739 break; 2740 /* can't do anything with these */ 2741 case SCTP_PACKET_DROPPED: 2742 case SCTP_INITIATION_ACK: /* this should not happen */ 2743 case SCTP_HEARTBEAT_ACK: 2744 case SCTP_ABORT_ASSOCIATION: 2745 case SCTP_OPERATION_ERROR: 2746 case SCTP_SHUTDOWN_COMPLETE: 2747 case SCTP_ECN_ECHO: 2748 case SCTP_ECN_CWR: 2749 default: 2750 break; 2751 } 2752 return (0); 2753} 2754 2755void 2756sctp_reset_in_stream(struct sctp_tcb *stcb, int number_entries, uint16_t * list) 2757{ 2758 int i; 2759 uint16_t temp; 2760 2761 /* 2762 * We set things to 0xffff since this is the last delivered sequence 2763 * and we will be sending in 0 after the reset. 2764 */ 2765 2766 if (number_entries) { 2767 for (i = 0; i < number_entries; i++) { 2768 temp = ntohs(list[i]); 2769 if (temp >= stcb->asoc.streamincnt) { 2770 continue; 2771 } 2772 stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff; 2773 } 2774 } else { 2775 list = NULL; 2776 for (i = 0; i < stcb->asoc.streamincnt; i++) { 2777 stcb->asoc.strmin[i].last_sequence_delivered = 0xffff; 2778 } 2779 } 2780 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list); 2781} 2782 2783static void 2784sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list) 2785{ 2786 int i; 2787 2788 if (number_entries == 0) { 2789 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 2790 stcb->asoc.strmout[i].next_sequence_sent = 0; 2791 } 2792 } else if (number_entries) { 2793 for (i = 0; i < number_entries; i++) { 2794 uint16_t temp; 2795 2796 temp = ntohs(list[i]); 2797 if (temp >= stcb->asoc.streamoutcnt) { 2798 /* no such stream */ 2799 continue; 2800 } 2801 stcb->asoc.strmout[temp].next_sequence_sent = 0; 2802 } 2803 } 2804 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list); 2805} 2806 2807 2808struct sctp_stream_reset_out_request * 2809sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk) 2810{ 2811 struct sctp_association *asoc; 2812 struct sctp_stream_reset_out_req *req; 2813 struct sctp_stream_reset_out_request *r; 2814 struct sctp_tmit_chunk *chk; 2815 int len, clen; 2816 2817 asoc = &stcb->asoc; 2818 if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 2819 asoc->stream_reset_outstanding = 0; 2820 return (NULL); 2821 } 2822 if (stcb->asoc.str_reset == NULL) { 2823 asoc->stream_reset_outstanding = 0; 2824 return (NULL); 2825 } 2826 chk = stcb->asoc.str_reset; 2827 if (chk->data == NULL) { 2828 return (NULL); 2829 } 2830 if (bchk) { 2831 /* he wants a copy of the chk pointer */ 2832 *bchk = chk; 2833 } 2834 clen = chk->send_size; 2835 req = mtod(chk->data, struct sctp_stream_reset_out_req *); 2836 r = &req->sr_req; 2837 if (ntohl(r->request_seq) == seq) { 2838 /* found it */ 2839 return (r); 2840 } 2841 len = SCTP_SIZE32(ntohs(r->ph.param_length)); 2842 if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) { 2843 /* move to the next one, there can only be a max of two */ 2844 r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len); 2845 if (ntohl(r->request_seq) == seq) { 2846 return (r); 2847 } 2848 } 2849 /* that seq is not here */ 2850 return (NULL); 2851} 2852 2853static void 2854sctp_clean_up_stream_reset(struct sctp_tcb *stcb) 2855{ 2856 struct sctp_association *asoc; 2857 struct sctp_tmit_chunk *chk = stcb->asoc.str_reset; 2858 2859 if (stcb->asoc.str_reset == NULL) { 2860 return; 2861 } 2862 asoc = &stcb->asoc; 2863 2864 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25); 2865 TAILQ_REMOVE(&asoc->control_send_queue, 2866 chk, 2867 sctp_next); 2868 if (chk->data) { 2869 sctp_m_freem(chk->data); 2870 chk->data = NULL; 2871 } 2872 asoc->ctrl_queue_cnt--; 2873 sctp_free_remote_addr(chk->whoTo); 2874 2875 sctp_free_a_chunk(stcb, chk); 2876 stcb->asoc.str_reset = NULL; 2877} 2878 2879 2880static int 2881sctp_handle_stream_reset_response(struct sctp_tcb *stcb, 2882 uint32_t seq, uint32_t action, 2883 struct sctp_stream_reset_response *respin) 2884{ 2885 uint16_t type; 2886 int lparm_len; 2887 struct sctp_association *asoc = &stcb->asoc; 2888 struct sctp_tmit_chunk *chk; 2889 struct sctp_stream_reset_out_request *srparam; 2890 int number_entries; 2891 2892 if (asoc->stream_reset_outstanding == 0) { 2893 /* duplicate */ 2894 return (0); 2895 } 2896 if (seq == stcb->asoc.str_reset_seq_out) { 2897 srparam = sctp_find_stream_reset(stcb, seq, &chk); 2898 if (srparam) { 2899 stcb->asoc.str_reset_seq_out++; 2900 type = ntohs(srparam->ph.param_type); 2901 lparm_len = ntohs(srparam->ph.param_length); 2902 if (type == SCTP_STR_RESET_OUT_REQUEST) { 2903 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t); 2904 asoc->stream_reset_out_is_outstanding = 0; 2905 if (asoc->stream_reset_outstanding) 2906 asoc->stream_reset_outstanding--; 2907 if (action == SCTP_STREAM_RESET_PERFORMED) { 2908 /* do it */ 2909 sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams); 2910 } else { 2911 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams); 2912 } 2913 } else if (type == SCTP_STR_RESET_IN_REQUEST) { 2914 /* Answered my request */ 2915 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t); 2916 if (asoc->stream_reset_outstanding) 2917 asoc->stream_reset_outstanding--; 2918 if (action != SCTP_STREAM_RESET_PERFORMED) { 2919 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, number_entries, srparam->list_of_streams); 2920 } 2921 } else if (type == SCTP_STR_RESET_TSN_REQUEST) { 2922 /** 2923 * a) Adopt the new in tsn. 2924 * b) reset the map 2925 * c) Adopt the new out-tsn 2926 */ 2927 struct sctp_stream_reset_response_tsn *resp; 2928 struct sctp_forward_tsn_chunk fwdtsn; 2929 int abort_flag = 0; 2930 2931 if (respin == NULL) { 2932 /* huh ? */ 2933 return (0); 2934 } 2935 if (action == SCTP_STREAM_RESET_PERFORMED) { 2936 resp = (struct sctp_stream_reset_response_tsn *)respin; 2937 asoc->stream_reset_outstanding--; 2938 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 2939 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 2940 fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1); 2941 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag); 2942 if (abort_flag) { 2943 return (1); 2944 } 2945 stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1); 2946 stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 2947 stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn); 2948 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 2949 stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn); 2950 stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn; 2951 2952 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL); 2953 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL); 2954 2955 } 2956 } 2957 /* get rid of the request and get the request flags */ 2958 if (asoc->stream_reset_outstanding == 0) { 2959 sctp_clean_up_stream_reset(stcb); 2960 } 2961 } 2962 } 2963 return (0); 2964} 2965 2966static void 2967sctp_handle_str_reset_request_in(struct sctp_tcb *stcb, 2968 struct sctp_tmit_chunk *chk, 2969 struct sctp_stream_reset_in_request *req) 2970{ 2971 uint32_t seq; 2972 int len, i; 2973 int number_entries; 2974 uint16_t temp; 2975 2976 /* 2977 * peer wants me to send a str-reset to him for my outgoing seq's if 2978 * seq_in is right. 2979 */ 2980 struct sctp_association *asoc = &stcb->asoc; 2981 2982 seq = ntohl(req->request_seq); 2983 if (asoc->str_reset_seq_in == seq) { 2984 if (stcb->asoc.stream_reset_out_is_outstanding == 0) { 2985 len = ntohs(req->ph.param_length); 2986 number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t)); 2987 for (i = 0; i < number_entries; i++) { 2988 temp = ntohs(req->list_of_streams[i]); 2989 req->list_of_streams[i] = temp; 2990 } 2991 /* move the reset action back one */ 2992 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 2993 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 2994 sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams, 2995 asoc->str_reset_seq_out, 2996 seq, (asoc->sending_seq - 1)); 2997 asoc->stream_reset_out_is_outstanding = 1; 2998 asoc->str_reset = chk; 2999 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 3000 stcb->asoc.stream_reset_outstanding++; 3001 } else { 3002 /* Can't do it, since we have sent one out */ 3003 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 3004 asoc->last_reset_action[0] = SCTP_STREAM_RESET_TRY_LATER; 3005 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3006 } 3007 asoc->str_reset_seq_in++; 3008 } else if (asoc->str_reset_seq_in - 1 == seq) { 3009 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3010 } else if (asoc->str_reset_seq_in - 2 == seq) { 3011 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 3012 } else { 3013 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 3014 } 3015} 3016 3017static int 3018sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb, 3019 struct sctp_tmit_chunk *chk, 3020 struct sctp_stream_reset_tsn_request *req) 3021{ 3022 /* reset all in and out and update the tsn */ 3023 /* 3024 * A) reset my str-seq's on in and out. B) Select a receive next, 3025 * and set cum-ack to it. Also process this selected number as a 3026 * fwd-tsn as well. C) set in the response my next sending seq. 3027 */ 3028 struct sctp_forward_tsn_chunk fwdtsn; 3029 struct sctp_association *asoc = &stcb->asoc; 3030 int abort_flag = 0; 3031 uint32_t seq; 3032 3033 seq = ntohl(req->request_seq); 3034 if (asoc->str_reset_seq_in == seq) { 3035 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 3036 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 3037 fwdtsn.ch.chunk_flags = 0; 3038 fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1); 3039 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag); 3040 if (abort_flag) { 3041 return (1); 3042 } 3043 stcb->asoc.highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA; 3044 stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 3045 stcb->asoc.mapping_array_base_tsn = stcb->asoc.highest_tsn_inside_map + 1; 3046 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 3047 atomic_add_int(&stcb->asoc.sending_seq, 1); 3048 /* save off historical data for retrans */ 3049 stcb->asoc.last_sending_seq[1] = stcb->asoc.last_sending_seq[0]; 3050 stcb->asoc.last_sending_seq[0] = stcb->asoc.sending_seq; 3051 stcb->asoc.last_base_tsnsent[1] = stcb->asoc.last_base_tsnsent[0]; 3052 stcb->asoc.last_base_tsnsent[0] = stcb->asoc.mapping_array_base_tsn; 3053 3054 sctp_add_stream_reset_result_tsn(chk, 3055 ntohl(req->request_seq), 3056 SCTP_STREAM_RESET_PERFORMED, 3057 stcb->asoc.sending_seq, 3058 stcb->asoc.mapping_array_base_tsn); 3059 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL); 3060 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL); 3061 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0]; 3062 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3063 3064 asoc->str_reset_seq_in++; 3065 } else if (asoc->str_reset_seq_in - 1 == seq) { 3066 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0], 3067 stcb->asoc.last_sending_seq[0], 3068 stcb->asoc.last_base_tsnsent[0] 3069 ); 3070 } else if (asoc->str_reset_seq_in - 2 == seq) { 3071 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1], 3072 stcb->asoc.last_sending_seq[1], 3073 stcb->asoc.last_base_tsnsent[1] 3074 ); 3075 } else { 3076 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 3077 } 3078 return (0); 3079} 3080 3081static void 3082sctp_handle_str_reset_request_out(struct sctp_tcb *stcb, 3083 struct sctp_tmit_chunk *chk, 3084 struct sctp_stream_reset_out_request *req) 3085{ 3086 uint32_t seq, tsn; 3087 int number_entries, len; 3088 struct sctp_association *asoc = &stcb->asoc; 3089 3090 seq = ntohl(req->request_seq); 3091 3092 /* now if its not a duplicate we process it */ 3093 if (asoc->str_reset_seq_in == seq) { 3094 len = ntohs(req->ph.param_length); 3095 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t)); 3096 /* 3097 * the sender is resetting, handle the list issue.. we must 3098 * a) verify if we can do the reset, if so no problem b) If 3099 * we can't do the reset we must copy the request. c) queue 3100 * it, and setup the data in processor to trigger it off 3101 * when needed and dequeue all the queued data. 3102 */ 3103 tsn = ntohl(req->send_reset_at_tsn); 3104 3105 /* move the reset action back one */ 3106 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 3107 if ((tsn == asoc->cumulative_tsn) || 3108 (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN))) { 3109 /* we can do it now */ 3110 sctp_reset_in_stream(stcb, number_entries, req->list_of_streams); 3111 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED); 3112 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3113 } else { 3114 /* 3115 * we must queue it up and thus wait for the TSN's 3116 * to arrive that are at or before tsn 3117 */ 3118 struct sctp_stream_reset_list *liste; 3119 int siz; 3120 3121 siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t)); 3122 SCTP_MALLOC(liste, struct sctp_stream_reset_list *, 3123 siz, "StrRstList"); 3124 if (liste == NULL) { 3125 /* gak out of memory */ 3126 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED); 3127 asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED; 3128 return; 3129 } 3130 liste->tsn = tsn; 3131 liste->number_entries = number_entries; 3132 memcpy(&liste->req, req, 3133 (sizeof(struct sctp_stream_reset_out_request) + (number_entries * sizeof(uint16_t)))); 3134 TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp); 3135 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED); 3136 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3137 } 3138 asoc->str_reset_seq_in++; 3139 } else if ((asoc->str_reset_seq_in - 1) == seq) { 3140 /* 3141 * one seq back, just echo back last action since my 3142 * response was lost. 3143 */ 3144 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3145 } else if ((asoc->str_reset_seq_in - 2) == seq) { 3146 /* 3147 * two seq back, just echo back last action since my 3148 * response was lost. 3149 */ 3150 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 3151 } else { 3152 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 3153 } 3154} 3155 3156static int 3157sctp_handle_stream_reset(struct sctp_tcb *stcb, struct sctp_stream_reset_out_req *sr_req) 3158{ 3159 int chk_length, param_len, ptype; 3160 uint32_t seq; 3161 int num_req = 0; 3162 struct sctp_tmit_chunk *chk; 3163 struct sctp_chunkhdr *ch; 3164 struct sctp_paramhdr *ph; 3165 int ret_code = 0; 3166 int num_param = 0; 3167 3168 /* now it may be a reset or a reset-response */ 3169 chk_length = ntohs(sr_req->ch.chunk_length); 3170 3171 /* setup for adding the response */ 3172 sctp_alloc_a_chunk(stcb, chk); 3173 if (chk == NULL) { 3174 return (ret_code); 3175 } 3176 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 3177 chk->rec.chunk_id.can_take_data = 0; 3178 chk->asoc = &stcb->asoc; 3179 chk->no_fr_allowed = 0; 3180 chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr); 3181 chk->book_size_scale = 0; 3182 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 3183 if (chk->data == NULL) { 3184strres_nochunk: 3185 if (chk->data) { 3186 sctp_m_freem(chk->data); 3187 chk->data = NULL; 3188 } 3189 sctp_free_a_chunk(stcb, chk); 3190 return (ret_code); 3191 } 3192 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 3193 3194 /* setup chunk parameters */ 3195 chk->sent = SCTP_DATAGRAM_UNSENT; 3196 chk->snd_count = 0; 3197 chk->whoTo = stcb->asoc.primary_destination; 3198 atomic_add_int(&chk->whoTo->ref_count, 1); 3199 3200 ch = mtod(chk->data, struct sctp_chunkhdr *); 3201 ch->chunk_type = SCTP_STREAM_RESET; 3202 ch->chunk_flags = 0; 3203 ch->chunk_length = htons(chk->send_size); 3204 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 3205 ph = (struct sctp_paramhdr *)&sr_req->sr_req; 3206 while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) { 3207 param_len = ntohs(ph->param_length); 3208 if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) { 3209 /* bad param */ 3210 break; 3211 } 3212 ptype = ntohs(ph->param_type); 3213 num_param++; 3214 if (num_param > SCTP_MAX_RESET_PARAMS) { 3215 /* hit the max of parameters already sorry.. */ 3216 break; 3217 } 3218 if (ptype == SCTP_STR_RESET_OUT_REQUEST) { 3219 struct sctp_stream_reset_out_request *req_out; 3220 3221 req_out = (struct sctp_stream_reset_out_request *)ph; 3222 num_req++; 3223 if (stcb->asoc.stream_reset_outstanding) { 3224 seq = ntohl(req_out->response_seq); 3225 if (seq == stcb->asoc.str_reset_seq_out) { 3226 /* implicit ack */ 3227 sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_PERFORMED, NULL); 3228 } 3229 } 3230 sctp_handle_str_reset_request_out(stcb, chk, req_out); 3231 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) { 3232 struct sctp_stream_reset_in_request *req_in; 3233 3234 num_req++; 3235 req_in = (struct sctp_stream_reset_in_request *)ph; 3236 sctp_handle_str_reset_request_in(stcb, chk, req_in); 3237 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) { 3238 struct sctp_stream_reset_tsn_request *req_tsn; 3239 3240 num_req++; 3241 req_tsn = (struct sctp_stream_reset_tsn_request *)ph; 3242 if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) { 3243 ret_code = 1; 3244 goto strres_nochunk; 3245 } 3246 /* no more */ 3247 break; 3248 } else if (ptype == SCTP_STR_RESET_RESPONSE) { 3249 struct sctp_stream_reset_response *resp; 3250 uint32_t result; 3251 3252 resp = (struct sctp_stream_reset_response *)ph; 3253 seq = ntohl(resp->response_seq); 3254 result = ntohl(resp->result); 3255 if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) { 3256 ret_code = 1; 3257 goto strres_nochunk; 3258 } 3259 } else { 3260 break; 3261 } 3262 3263 ph = (struct sctp_paramhdr *)((caddr_t)ph + SCTP_SIZE32(param_len)); 3264 chk_length -= SCTP_SIZE32(param_len); 3265 } 3266 if (num_req == 0) { 3267 /* we have no response free the stuff */ 3268 goto strres_nochunk; 3269 } 3270 /* ok we have a chunk to link in */ 3271 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, 3272 chk, 3273 sctp_next); 3274 stcb->asoc.ctrl_queue_cnt++; 3275 return (ret_code); 3276} 3277 3278/* 3279 * Handle a router or endpoints report of a packet loss, there are two ways 3280 * to handle this, either we get the whole packet and must disect it 3281 * ourselves (possibly with truncation and or corruption) or it is a summary 3282 * from a middle box that did the disectting for us. 3283 */ 3284static void 3285sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp, 3286 struct sctp_tcb *stcb, struct sctp_nets *net) 3287{ 3288 uint32_t bottle_bw, on_queue; 3289 uint16_t trunc_len; 3290 unsigned int chlen; 3291 unsigned int at; 3292 struct sctp_chunk_desc desc; 3293 struct sctp_chunkhdr *ch; 3294 3295 chlen = ntohs(cp->ch.chunk_length); 3296 chlen -= sizeof(struct sctp_pktdrop_chunk); 3297 /* XXX possible chlen underflow */ 3298 if (chlen == 0) { 3299 ch = NULL; 3300 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) 3301 SCTP_STAT_INCR(sctps_pdrpbwrpt); 3302 } else { 3303 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr)); 3304 chlen -= sizeof(struct sctphdr); 3305 /* XXX possible chlen underflow */ 3306 memset(&desc, 0, sizeof(desc)); 3307 } 3308 trunc_len = (uint16_t) ntohs(cp->trunc_len); 3309 /* now the chunks themselves */ 3310 while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) { 3311 desc.chunk_type = ch->chunk_type; 3312 /* get amount we need to move */ 3313 at = ntohs(ch->chunk_length); 3314 if (at < sizeof(struct sctp_chunkhdr)) { 3315 /* corrupt chunk, maybe at the end? */ 3316 SCTP_STAT_INCR(sctps_pdrpcrupt); 3317 break; 3318 } 3319 if (trunc_len == 0) { 3320 /* we are supposed to have all of it */ 3321 if (at > chlen) { 3322 /* corrupt skip it */ 3323 SCTP_STAT_INCR(sctps_pdrpcrupt); 3324 break; 3325 } 3326 } else { 3327 /* is there enough of it left ? */ 3328 if (desc.chunk_type == SCTP_DATA) { 3329 if (chlen < (sizeof(struct sctp_data_chunk) + 3330 sizeof(desc.data_bytes))) { 3331 break; 3332 } 3333 } else { 3334 if (chlen < sizeof(struct sctp_chunkhdr)) { 3335 break; 3336 } 3337 } 3338 } 3339 if (desc.chunk_type == SCTP_DATA) { 3340 /* can we get out the tsn? */ 3341 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 3342 SCTP_STAT_INCR(sctps_pdrpmbda); 3343 3344 if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) { 3345 /* yep */ 3346 struct sctp_data_chunk *dcp; 3347 uint8_t *ddp; 3348 unsigned int iii; 3349 3350 dcp = (struct sctp_data_chunk *)ch; 3351 ddp = (uint8_t *) (dcp + 1); 3352 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) { 3353 desc.data_bytes[iii] = ddp[iii]; 3354 } 3355 desc.tsn_ifany = dcp->dp.tsn; 3356 } else { 3357 /* nope we are done. */ 3358 SCTP_STAT_INCR(sctps_pdrpnedat); 3359 break; 3360 } 3361 } else { 3362 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 3363 SCTP_STAT_INCR(sctps_pdrpmbct); 3364 } 3365 3366 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) { 3367 SCTP_STAT_INCR(sctps_pdrppdbrk); 3368 break; 3369 } 3370 if (SCTP_SIZE32(at) > chlen) { 3371 break; 3372 } 3373 chlen -= SCTP_SIZE32(at); 3374 if (chlen < sizeof(struct sctp_chunkhdr)) { 3375 /* done, none left */ 3376 break; 3377 } 3378 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at)); 3379 } 3380 /* Now update any rwnd --- possibly */ 3381 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) { 3382 /* From a peer, we get a rwnd report */ 3383 uint32_t a_rwnd; 3384 3385 SCTP_STAT_INCR(sctps_pdrpfehos); 3386 3387 bottle_bw = ntohl(cp->bottle_bw); 3388 on_queue = ntohl(cp->current_onq); 3389 if (bottle_bw && on_queue) { 3390 /* a rwnd report is in here */ 3391 if (bottle_bw > on_queue) 3392 a_rwnd = bottle_bw - on_queue; 3393 else 3394 a_rwnd = 0; 3395 3396 if (a_rwnd == 0) 3397 stcb->asoc.peers_rwnd = 0; 3398 else { 3399 if (a_rwnd > stcb->asoc.total_flight) { 3400 stcb->asoc.peers_rwnd = 3401 a_rwnd - stcb->asoc.total_flight; 3402 } else { 3403 stcb->asoc.peers_rwnd = 0; 3404 } 3405 if (stcb->asoc.peers_rwnd < 3406 stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 3407 /* SWS sender side engages */ 3408 stcb->asoc.peers_rwnd = 0; 3409 } 3410 } 3411 } 3412 } else { 3413 SCTP_STAT_INCR(sctps_pdrpfmbox); 3414 } 3415 3416 /* now middle boxes in sat networks get a cwnd bump */ 3417 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) && 3418 (stcb->asoc.sat_t3_loss_recovery == 0) && 3419 (stcb->asoc.sat_network)) { 3420 /* 3421 * This is debateable but for sat networks it makes sense 3422 * Note if a T3 timer has went off, we will prohibit any 3423 * changes to cwnd until we exit the t3 loss recovery. 3424 */ 3425 uint32_t bw_avail; 3426 int rtt, incr; 3427 3428#ifdef SCTP_CWND_MONITOR 3429 int old_cwnd = net->cwnd; 3430 3431#endif 3432 /* need real RTT for this calc */ 3433 rtt = ((net->lastsa >> 2) + net->lastsv) >> 1; 3434 /* get bottle neck bw */ 3435 bottle_bw = ntohl(cp->bottle_bw); 3436 /* and whats on queue */ 3437 on_queue = ntohl(cp->current_onq); 3438 /* 3439 * adjust the on-queue if our flight is more it could be 3440 * that the router has not yet gotten data "in-flight" to it 3441 */ 3442 if (on_queue < net->flight_size) 3443 on_queue = net->flight_size; 3444 3445 /* calculate the available space */ 3446 bw_avail = (bottle_bw * rtt) / 1000; 3447 if (bw_avail > bottle_bw) { 3448 /* 3449 * Cap the growth to no more than the bottle neck. 3450 * This can happen as RTT slides up due to queues. 3451 * It also means if you have more than a 1 second 3452 * RTT with a empty queue you will be limited to the 3453 * bottle_bw per second no matter if other points 3454 * have 1/2 the RTT and you could get more out... 3455 */ 3456 bw_avail = bottle_bw; 3457 } 3458 if (on_queue > bw_avail) { 3459 /* 3460 * No room for anything else don't allow anything 3461 * else to be "added to the fire". 3462 */ 3463 int seg_inflight, seg_onqueue, my_portion; 3464 3465 net->partial_bytes_acked = 0; 3466 3467 /* how much are we over queue size? */ 3468 incr = on_queue - bw_avail; 3469 if (stcb->asoc.seen_a_sack_this_pkt) { 3470 /* 3471 * undo any cwnd adjustment that the sack 3472 * might have made 3473 */ 3474 net->cwnd = net->prev_cwnd; 3475 } 3476 /* Now how much of that is mine? */ 3477 seg_inflight = net->flight_size / net->mtu; 3478 seg_onqueue = on_queue / net->mtu; 3479 my_portion = (incr * seg_inflight) / seg_onqueue; 3480 3481 /* Have I made an adjustment already */ 3482 if (net->cwnd > net->flight_size) { 3483 /* 3484 * for this flight I made an adjustment we 3485 * need to decrease the portion by a share 3486 * our previous adjustment. 3487 */ 3488 int diff_adj; 3489 3490 diff_adj = net->cwnd - net->flight_size; 3491 if (diff_adj > my_portion) 3492 my_portion = 0; 3493 else 3494 my_portion -= diff_adj; 3495 } 3496 /* 3497 * back down to the previous cwnd (assume we have 3498 * had a sack before this packet). minus what ever 3499 * portion of the overage is my fault. 3500 */ 3501 net->cwnd -= my_portion; 3502 3503 /* we will NOT back down more than 1 MTU */ 3504 if (net->cwnd <= net->mtu) { 3505 net->cwnd = net->mtu; 3506 } 3507 /* force into CA */ 3508 net->ssthresh = net->cwnd - 1; 3509 } else { 3510 /* 3511 * Take 1/4 of the space left or max burst up .. 3512 * whichever is less. 3513 */ 3514 incr = min((bw_avail - on_queue) >> 2, 3515 (int)stcb->asoc.max_burst * (int)net->mtu); 3516 net->cwnd += incr; 3517 } 3518 if (net->cwnd > bw_avail) { 3519 /* We can't exceed the pipe size */ 3520 net->cwnd = bw_avail; 3521 } 3522 if (net->cwnd < net->mtu) { 3523 /* We always have 1 MTU */ 3524 net->cwnd = net->mtu; 3525 } 3526#ifdef SCTP_CWND_MONITOR 3527 if (net->cwnd - old_cwnd != 0) { 3528 /* log only changes */ 3529 sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), 3530 SCTP_CWND_LOG_FROM_SAT); 3531 } 3532#endif 3533 } 3534} 3535 3536/* 3537 * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to 3538 * still contain IP/SCTP header - stcb: is the tcb found for this packet - 3539 * offset: offset into the mbuf chain to first chunkhdr - length: is the 3540 * length of the complete packet outputs: - length: modified to remaining 3541 * length after control processing - netp: modified to new sctp_nets after 3542 * cookie-echo processing - return NULL to discard the packet (ie. no asoc, 3543 * bad packet,...) otherwise return the tcb for this packet 3544 */ 3545static struct sctp_tcb * 3546sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length, 3547 struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp, 3548 struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen, 3549 uint32_t vrf_id, uint32_t table_id) 3550{ 3551 struct sctp_association *asoc; 3552 uint32_t vtag_in; 3553 int num_chunks = 0; /* number of control chunks processed */ 3554 int chk_length; 3555 int ret; 3556 int abort_no_unlock = 0; 3557 3558 /* 3559 * How big should this be, and should it be alloc'd? Lets try the 3560 * d-mtu-ceiling for now (2k) and that should hopefully work ... 3561 * until we get into jumbo grams and such.. 3562 */ 3563 uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE]; 3564 struct sctp_tcb *locked_tcb = stcb; 3565 int got_auth = 0; 3566 uint32_t auth_offset = 0, auth_len = 0; 3567 int auth_skipped = 0; 3568 3569#ifdef SCTP_DEBUG 3570 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 3571 printf("sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n", 3572 iphlen, *offset, length, stcb); 3573 } 3574#endif /* SCTP_DEBUG */ 3575 3576 /* validate chunk header length... */ 3577 if (ntohs(ch->chunk_length) < sizeof(*ch)) { 3578 return (NULL); 3579 } 3580 /* 3581 * validate the verification tag 3582 */ 3583 vtag_in = ntohl(sh->v_tag); 3584 3585 if (locked_tcb) { 3586 SCTP_TCB_LOCK_ASSERT(locked_tcb); 3587 } 3588 if (ch->chunk_type == SCTP_INITIATION) { 3589 if (vtag_in != 0) { 3590 /* protocol error- silently discard... */ 3591 SCTP_STAT_INCR(sctps_badvtag); 3592 if (locked_tcb) { 3593 SCTP_TCB_UNLOCK(locked_tcb); 3594 } 3595 return (NULL); 3596 } 3597 } else if (ch->chunk_type != SCTP_COOKIE_ECHO) { 3598 /* 3599 * If there is no stcb, skip the AUTH chunk and process 3600 * later after a stcb is found (to validate the lookup was 3601 * valid. 3602 */ 3603 if ((ch->chunk_type == SCTP_AUTHENTICATION) && 3604 (stcb == NULL) && !sctp_auth_disable) { 3605 /* save this chunk for later processing */ 3606 auth_skipped = 1; 3607 auth_offset = *offset; 3608 auth_len = ntohs(ch->chunk_length); 3609 3610 /* (temporarily) move past this chunk */ 3611 *offset += SCTP_SIZE32(auth_len); 3612 if (*offset >= length) { 3613 /* no more data left in the mbuf chain */ 3614 *offset = length; 3615 return (NULL); 3616 } 3617 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3618 sizeof(struct sctp_chunkhdr), chunk_buf); 3619 } 3620 if (ch->chunk_type == SCTP_COOKIE_ECHO) { 3621 goto process_control_chunks; 3622 } 3623 /* 3624 * first check if it's an ASCONF with an unknown src addr we 3625 * need to look inside to find the association 3626 */ 3627 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) { 3628 /* inp's refcount may be reduced */ 3629 SCTP_INP_INCR_REF(inp); 3630 3631 stcb = sctp_findassociation_ep_asconf(m, iphlen, 3632 *offset, sh, &inp, netp); 3633 if (stcb == NULL) { 3634 /* 3635 * reduce inp's refcount if not reduced in 3636 * sctp_findassociation_ep_asconf(). 3637 */ 3638 SCTP_INP_DECR_REF(inp); 3639 } 3640 /* now go back and verify any auth chunk to be sure */ 3641 if (auth_skipped && (stcb != NULL)) { 3642 struct sctp_auth_chunk *auth; 3643 3644 auth = (struct sctp_auth_chunk *) 3645 sctp_m_getptr(m, auth_offset, 3646 auth_len, chunk_buf); 3647 got_auth = 1; 3648 auth_skipped = 0; 3649 if (sctp_handle_auth(stcb, auth, m, 3650 auth_offset)) { 3651 /* auth HMAC failed so dump it */ 3652 *offset = length; 3653 return (NULL); 3654 } else { 3655 /* remaining chunks are HMAC checked */ 3656 stcb->asoc.authenticated = 1; 3657 } 3658 } 3659 } 3660 if (stcb == NULL) { 3661 /* no association, so it's out of the blue... */ 3662 sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL, 3663 vrf_id, table_id); 3664 *offset = length; 3665 if (locked_tcb) { 3666 SCTP_TCB_UNLOCK(locked_tcb); 3667 } 3668 return (NULL); 3669 } 3670 asoc = &stcb->asoc; 3671 /* ABORT and SHUTDOWN can use either v_tag... */ 3672 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) || 3673 (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) || 3674 (ch->chunk_type == SCTP_PACKET_DROPPED)) { 3675 if ((vtag_in == asoc->my_vtag) || 3676 ((ch->chunk_flags & SCTP_HAD_NO_TCB) && 3677 (vtag_in == asoc->peer_vtag))) { 3678 /* this is valid */ 3679 } else { 3680 /* drop this packet... */ 3681 SCTP_STAT_INCR(sctps_badvtag); 3682 if (locked_tcb) { 3683 SCTP_TCB_UNLOCK(locked_tcb); 3684 } 3685 return (NULL); 3686 } 3687 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 3688 if (vtag_in != asoc->my_vtag) { 3689 /* 3690 * this could be a stale SHUTDOWN-ACK or the 3691 * peer never got the SHUTDOWN-COMPLETE and 3692 * is still hung; we have started a new asoc 3693 * but it won't complete until the shutdown 3694 * is completed 3695 */ 3696 if (locked_tcb) { 3697 SCTP_TCB_UNLOCK(locked_tcb); 3698 } 3699 sctp_handle_ootb(m, iphlen, *offset, sh, inp, 3700 NULL, vrf_id, table_id); 3701 return (NULL); 3702 } 3703 } else { 3704 /* for all other chunks, vtag must match */ 3705 if (vtag_in != asoc->my_vtag) { 3706 /* invalid vtag... */ 3707#ifdef SCTP_DEBUG 3708 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3709 printf("invalid vtag: %xh, expect %xh\n", vtag_in, asoc->my_vtag); 3710 } 3711#endif /* SCTP_DEBUG */ 3712 SCTP_STAT_INCR(sctps_badvtag); 3713 if (locked_tcb) { 3714 SCTP_TCB_UNLOCK(locked_tcb); 3715 } 3716 *offset = length; 3717 return (NULL); 3718 } 3719 } 3720 } /* end if !SCTP_COOKIE_ECHO */ 3721 /* 3722 * process all control chunks... 3723 */ 3724 if (((ch->chunk_type == SCTP_SELECTIVE_ACK) || 3725 (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) && 3726 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 3727 /* implied cookie-ack.. we must have lost the ack */ 3728 stcb->asoc.overall_error_count = 0; 3729 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, 3730 *netp); 3731 } 3732process_control_chunks: 3733 while (IS_SCTP_CONTROL(ch)) { 3734 /* validate chunk length */ 3735 chk_length = ntohs(ch->chunk_length); 3736#ifdef SCTP_DEBUG 3737 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 3738 printf("sctp_process_control: processing a chunk type=%u, len=%u\n", 3739 ch->chunk_type, chk_length); 3740 } 3741#endif /* SCTP_DEBUG */ 3742 if ((size_t)chk_length < sizeof(*ch) || 3743 (*offset + chk_length) > length) { 3744 *offset = length; 3745 if (locked_tcb) { 3746 SCTP_TCB_UNLOCK(locked_tcb); 3747 } 3748 return (NULL); 3749 } 3750 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks); 3751 /* 3752 * INIT-ACK only gets the init ack "header" portion only 3753 * because we don't have to process the peer's COOKIE. All 3754 * others get a complete chunk. 3755 */ 3756 if ((ch->chunk_type == SCTP_INITIATION_ACK) || 3757 (ch->chunk_type == SCTP_INITIATION)) { 3758 /* get an init-ack chunk */ 3759 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3760 sizeof(struct sctp_init_ack_chunk), chunk_buf); 3761 if (ch == NULL) { 3762 *offset = length; 3763 if (locked_tcb) { 3764 SCTP_TCB_UNLOCK(locked_tcb); 3765 } 3766 return (NULL); 3767 } 3768 } else if (ch->chunk_type == SCTP_COOKIE_ECHO) { 3769 if (chk_length > sizeof(chunk_buf)) { 3770 /* 3771 * use just the size of the chunk buffer so 3772 * the front part of our cookie is intact. 3773 * The rest of cookie processing should use 3774 * the sctp_m_getptr() function to access 3775 * the other parts. 3776 */ 3777 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3778 (sizeof(chunk_buf) - 4), 3779 chunk_buf); 3780 if (ch == NULL) { 3781 *offset = length; 3782 if (locked_tcb) { 3783 SCTP_TCB_UNLOCK(locked_tcb); 3784 } 3785 return (NULL); 3786 } 3787 } else { 3788 /* We can fit it all */ 3789 goto all_fits; 3790 } 3791 } else { 3792 /* get a complete chunk... */ 3793 if ((size_t)chk_length > sizeof(chunk_buf)) { 3794 struct mbuf *oper; 3795 struct sctp_paramhdr *phdr; 3796 3797 oper = NULL; 3798 if (stcb) { 3799 oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 3800 0, M_DONTWAIT, 1, MT_DATA); 3801 3802 if (oper) { 3803 /* pre-reserve some space */ 3804 SCTP_BUF_RESV_UF(oper, sizeof(struct sctp_chunkhdr)); 3805 SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr); 3806 phdr = mtod(oper, struct sctp_paramhdr *); 3807 phdr->param_type = htons(SCTP_CAUSE_OUT_OF_RESC); 3808 phdr->param_length = htons(sizeof(struct sctp_paramhdr)); 3809 sctp_queue_op_err(stcb, oper); 3810 } 3811 } 3812 if (locked_tcb) { 3813 SCTP_TCB_UNLOCK(locked_tcb); 3814 } 3815 return (NULL); 3816 } 3817 all_fits: 3818 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3819 chk_length, chunk_buf); 3820 if (ch == NULL) { 3821 printf("sctp_process_control: Can't get the all data....\n"); 3822 *offset = length; 3823 if (locked_tcb) { 3824 SCTP_TCB_UNLOCK(locked_tcb); 3825 } 3826 return (NULL); 3827 } 3828 } 3829 num_chunks++; 3830 /* Save off the last place we got a control from */ 3831 if (stcb != NULL) { 3832 if ((*netp != NULL) || (ch->chunk_type == SCTP_ASCONF)) { 3833 /* 3834 * allow last_control to be NULL if 3835 * ASCONF... ASCONF processing will find the 3836 * right net later 3837 */ 3838 stcb->asoc.last_control_chunk_from = *netp; 3839 } 3840 } 3841#ifdef SCTP_AUDITING_ENABLED 3842 sctp_audit_log(0xB0, ch->chunk_type); 3843#endif 3844 3845 /* check to see if this chunk required auth, but isn't */ 3846 if ((stcb != NULL) && !sctp_auth_disable && 3847 sctp_auth_is_required_chunk(ch->chunk_type, 3848 stcb->asoc.local_auth_chunks) && 3849 !stcb->asoc.authenticated) { 3850 /* "silently" ignore */ 3851 SCTP_STAT_INCR(sctps_recvauthmissing); 3852 goto next_chunk; 3853 } 3854 switch (ch->chunk_type) { 3855 case SCTP_INITIATION: 3856 /* must be first and only chunk */ 3857#ifdef SCTP_DEBUG 3858 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3859 printf("SCTP_INIT\n"); 3860 } 3861#endif /* SCTP_DEBUG */ 3862 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3863 /* We are not interested anymore? */ 3864 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3865 /* 3866 * collision case where we are 3867 * sending to them too 3868 */ 3869 ; 3870 } else { 3871 if (locked_tcb) { 3872 SCTP_TCB_UNLOCK(locked_tcb); 3873 } 3874 *offset = length; 3875 return (NULL); 3876 } 3877 } 3878 if ((num_chunks > 1) || 3879 (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3880 *offset = length; 3881 if (locked_tcb) { 3882 SCTP_TCB_UNLOCK(locked_tcb); 3883 } 3884 return (NULL); 3885 } 3886 if ((stcb != NULL) && 3887 (SCTP_GET_STATE(&stcb->asoc) == 3888 SCTP_STATE_SHUTDOWN_ACK_SENT)) { 3889 sctp_send_shutdown_ack(stcb, 3890 stcb->asoc.primary_destination); 3891 *offset = length; 3892 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 3893 if (locked_tcb) { 3894 SCTP_TCB_UNLOCK(locked_tcb); 3895 } 3896 return (NULL); 3897 } 3898 sctp_handle_init(m, iphlen, *offset, sh, 3899 (struct sctp_init_chunk *)ch, inp, stcb, *netp, &abort_no_unlock, vrf_id, table_id); 3900 if (abort_no_unlock) 3901 return (NULL); 3902 3903 *offset = length; 3904 if (locked_tcb) { 3905 SCTP_TCB_UNLOCK(locked_tcb); 3906 } 3907 return (NULL); 3908 break; 3909 case SCTP_INITIATION_ACK: 3910 /* must be first and only chunk */ 3911#ifdef SCTP_DEBUG 3912 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3913 printf("SCTP_INIT-ACK\n"); 3914 } 3915#endif /* SCTP_DEBUG */ 3916 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3917 /* We are not interested anymore */ 3918 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3919 ; 3920 } else { 3921 if (locked_tcb) { 3922 SCTP_TCB_UNLOCK(locked_tcb); 3923 } 3924 *offset = length; 3925 if (stcb) { 3926 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26); 3927 } 3928 return (NULL); 3929 } 3930 } 3931 if ((num_chunks > 1) || 3932 (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3933 *offset = length; 3934 if (locked_tcb) { 3935 SCTP_TCB_UNLOCK(locked_tcb); 3936 } 3937 return (NULL); 3938 } 3939 ret = sctp_handle_init_ack(m, iphlen, *offset, sh, 3940 (struct sctp_init_ack_chunk *)ch, stcb, *netp, &abort_no_unlock, vrf_id, table_id); 3941 /* 3942 * Special case, I must call the output routine to 3943 * get the cookie echoed 3944 */ 3945 if (abort_no_unlock) 3946 return (NULL); 3947 3948 if ((stcb) && ret == 0) 3949 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 3950 *offset = length; 3951 if (locked_tcb) { 3952 SCTP_TCB_UNLOCK(locked_tcb); 3953 } 3954 return (NULL); 3955 break; 3956 case SCTP_SELECTIVE_ACK: 3957#ifdef SCTP_DEBUG 3958 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3959 printf("SCTP_SACK\n"); 3960 } 3961#endif /* SCTP_DEBUG */ 3962 SCTP_STAT_INCR(sctps_recvsacks); 3963 { 3964 struct sctp_sack_chunk *sack; 3965 int abort_now = 0; 3966 uint32_t a_rwnd, cum_ack; 3967 uint16_t num_seg; 3968 int nonce_sum_flag; 3969 3970 if (chk_length < sizeof(struct sctp_sack_chunk)) { 3971#ifdef SCTP_DEBUG 3972 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 3973 printf("Bad size on sack chunk .. to small\n"); 3974 } 3975#endif 3976 *offset = length; 3977 if (locked_tcb) { 3978 SCTP_TCB_UNLOCK(locked_tcb); 3979 } 3980 return (NULL); 3981 } 3982 sack = (struct sctp_sack_chunk *)ch; 3983 nonce_sum_flag = ch->chunk_flags & SCTP_SACK_NONCE_SUM; 3984 cum_ack = ntohl(sack->sack.cum_tsn_ack); 3985 num_seg = ntohs(sack->sack.num_gap_ack_blks); 3986 a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd); 3987 stcb->asoc.seen_a_sack_this_pkt = 1; 3988 if ((stcb->asoc.pr_sctp_cnt == 0) && 3989 (num_seg == 0) && 3990 ((compare_with_wrap(cum_ack, stcb->asoc.last_acked_seq, MAX_TSN)) || 3991 (cum_ack == stcb->asoc.last_acked_seq)) && 3992 (stcb->asoc.saw_sack_with_frags == 0) && 3993 (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) 3994 ) { 3995 /* 3996 * We have a SIMPLE sack having no 3997 * prior segments and data on sent 3998 * queue to be acked.. Use the 3999 * faster path sack processing. We 4000 * also allow window update sacks 4001 * with no missing segments to go 4002 * this way too. 4003 */ 4004 sctp_express_handle_sack(stcb, cum_ack, a_rwnd, nonce_sum_flag, 4005 &abort_now); 4006 } else { 4007 sctp_handle_sack(sack, stcb, *netp, &abort_now, chk_length, a_rwnd); 4008 } 4009 if (abort_now) { 4010 /* ABORT signal from sack processing */ 4011 *offset = length; 4012 return (NULL); 4013 } 4014 } 4015 break; 4016 case SCTP_HEARTBEAT_REQUEST: 4017#ifdef SCTP_DEBUG 4018 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4019 printf("SCTP_HEARTBEAT\n"); 4020 } 4021#endif /* SCTP_DEBUG */ 4022 SCTP_STAT_INCR(sctps_recvheartbeat); 4023 sctp_send_heartbeat_ack(stcb, m, *offset, chk_length, 4024 *netp); 4025 4026 /* He's alive so give him credit */ 4027 stcb->asoc.overall_error_count = 0; 4028 break; 4029 case SCTP_HEARTBEAT_ACK: 4030#ifdef SCTP_DEBUG 4031 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4032 printf("SCTP_HEARTBEAT-ACK\n"); 4033 } 4034#endif /* SCTP_DEBUG */ 4035 if (chk_length != sizeof(struct sctp_heartbeat_chunk)) { 4036 /* Its not ours */ 4037 *offset = length; 4038 if (locked_tcb) { 4039 SCTP_TCB_UNLOCK(locked_tcb); 4040 } 4041 return (NULL); 4042 } 4043 /* He's alive so give him credit */ 4044 stcb->asoc.overall_error_count = 0; 4045 SCTP_STAT_INCR(sctps_recvheartbeatack); 4046 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch, 4047 stcb, *netp); 4048 break; 4049 case SCTP_ABORT_ASSOCIATION: 4050#ifdef SCTP_DEBUG 4051 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4052 printf("SCTP_ABORT\n"); 4053 } 4054#endif /* SCTP_DEBUG */ 4055 sctp_handle_abort((struct sctp_abort_chunk *)ch, 4056 stcb, *netp); 4057 *offset = length; 4058 return (NULL); 4059 break; 4060 case SCTP_SHUTDOWN: 4061#ifdef SCTP_DEBUG 4062 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4063 printf("SCTP_SHUTDOWN\n"); 4064 } 4065#endif /* SCTP_DEBUG */ 4066 if (chk_length != sizeof(struct sctp_shutdown_chunk)) { 4067 *offset = length; 4068 if (locked_tcb) { 4069 SCTP_TCB_UNLOCK(locked_tcb); 4070 } 4071 return (NULL); 4072 4073 } { 4074 int abort_flag = 0; 4075 4076 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch, 4077 stcb, *netp, &abort_flag); 4078 if (abort_flag) { 4079 *offset = length; 4080 return (NULL); 4081 } 4082 } 4083 break; 4084 case SCTP_SHUTDOWN_ACK: 4085#ifdef SCTP_DEBUG 4086 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4087 printf("SCTP_SHUTDOWN-ACK\n"); 4088 } 4089#endif /* SCTP_DEBUG */ 4090 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp); 4091 *offset = length; 4092 return (NULL); 4093 break; 4094 case SCTP_OPERATION_ERROR: 4095#ifdef SCTP_DEBUG 4096 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4097 printf("SCTP_OP-ERR\n"); 4098 } 4099#endif /* SCTP_DEBUG */ 4100 if ((stcb) && sctp_handle_error(ch, stcb, *netp) < 0) { 4101 *offset = length; 4102 return (NULL); 4103 } 4104 break; 4105 case SCTP_COOKIE_ECHO: 4106#ifdef SCTP_DEBUG 4107 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4108 printf("SCTP_COOKIE-ECHO stcb is %p\n", stcb); 4109 } 4110#endif /* SCTP_DEBUG */ 4111 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 4112 ; 4113 } else { 4114 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) && 4115 (stcb == NULL)) { 4116 /* We are not interested anymore */ 4117 *offset = length; 4118 return (NULL); 4119 } 4120 } 4121 /* 4122 * First are we accepting? We do this again here 4123 * since it is possible that a previous endpoint WAS 4124 * listening responded to a INIT-ACK and then 4125 * closed. We opened and bound.. and are now no 4126 * longer listening. 4127 */ 4128 if (inp->sctp_socket->so_qlimit == 0) { 4129 if ((stcb) && (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 4130 /* 4131 * special case, is this a retran'd 4132 * COOKIE-ECHO or a restarting assoc 4133 * that is a peeled off or 4134 * one-to-one style socket. 4135 */ 4136 goto process_cookie_anyway; 4137 } 4138 sctp_abort_association(inp, stcb, m, iphlen, 4139 sh, NULL, vrf_id, 4140 table_id); 4141 *offset = length; 4142 return (NULL); 4143 } else if (inp->sctp_socket->so_qlimit) { 4144 /* we are accepting so check limits like TCP */ 4145 if (inp->sctp_socket->so_qlen > 4146 inp->sctp_socket->so_qlimit) { 4147 /* no space */ 4148 struct mbuf *oper; 4149 struct sctp_paramhdr *phdr; 4150 4151 if (sctp_abort_if_one_2_one_hits_limit) { 4152 oper = NULL; 4153 oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 4154 0, M_DONTWAIT, 1, MT_DATA); 4155 if (oper) { 4156 SCTP_BUF_LEN(oper) = 4157 sizeof(struct sctp_paramhdr); 4158 phdr = mtod(oper, 4159 struct sctp_paramhdr *); 4160 phdr->param_type = 4161 htons(SCTP_CAUSE_OUT_OF_RESC); 4162 phdr->param_length = 4163 htons(sizeof(struct sctp_paramhdr)); 4164 } 4165 sctp_abort_association(inp, stcb, m, 4166 iphlen, sh, oper, vrf_id, table_id); 4167 } 4168 *offset = length; 4169 return (NULL); 4170 } 4171 } 4172 process_cookie_anyway: 4173 { 4174 struct mbuf *ret_buf; 4175 struct sctp_inpcb *linp; 4176 4177 if (stcb) 4178 linp = NULL; 4179 else 4180 linp = inp; 4181 4182 if (linp) 4183 SCTP_ASOC_CREATE_LOCK(linp); 4184 ret_buf = 4185 sctp_handle_cookie_echo(m, iphlen, 4186 *offset, sh, 4187 (struct sctp_cookie_echo_chunk *)ch, 4188 &inp, &stcb, netp, 4189 auth_skipped, 4190 auth_offset, 4191 auth_len, 4192 &locked_tcb, 4193 vrf_id, 4194 table_id); 4195 if (linp) 4196 SCTP_ASOC_CREATE_UNLOCK(linp); 4197 if (ret_buf == NULL) { 4198 if (locked_tcb) { 4199 SCTP_TCB_UNLOCK(locked_tcb); 4200 } 4201#ifdef SCTP_DEBUG 4202 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4203 printf("GAK, null buffer\n"); 4204 } 4205#endif /* SCTP_DEBUG */ 4206 auth_skipped = 0; 4207 *offset = length; 4208 return (NULL); 4209 } 4210 /* if AUTH skipped, see if it verified... */ 4211 if (auth_skipped) { 4212 got_auth = 1; 4213 auth_skipped = 0; 4214 } 4215 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) { 4216 /* 4217 * Restart the timer if we have 4218 * pending data 4219 */ 4220 struct sctp_tmit_chunk *chk; 4221 4222 chk = TAILQ_FIRST(&stcb->asoc.sent_queue); 4223 if (chk) { 4224 sctp_timer_start(SCTP_TIMER_TYPE_SEND, 4225 stcb->sctp_ep, stcb, 4226 chk->whoTo); 4227 } 4228 } 4229 } 4230 break; 4231 case SCTP_COOKIE_ACK: 4232#ifdef SCTP_DEBUG 4233 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4234 printf("SCTP_COOKIE-ACK\n"); 4235 } 4236#endif /* SCTP_DEBUG */ 4237 if (chk_length != sizeof(struct sctp_cookie_ack_chunk)) { 4238 if (locked_tcb) { 4239 SCTP_TCB_UNLOCK(locked_tcb); 4240 } 4241 return (NULL); 4242 } 4243 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4244 /* We are not interested anymore */ 4245 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 4246 ; 4247 } else { 4248 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27); 4249 *offset = length; 4250 return (NULL); 4251 } 4252 } 4253 /* He's alive so give him credit */ 4254 if (stcb) { 4255 stcb->asoc.overall_error_count = 0; 4256 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp); 4257 } 4258 break; 4259 case SCTP_ECN_ECHO: 4260#ifdef SCTP_DEBUG 4261 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4262 printf("SCTP_ECN-ECHO\n"); 4263 } 4264#endif /* SCTP_DEBUG */ 4265 /* He's alive so give him credit */ 4266 if (chk_length != sizeof(struct sctp_ecne_chunk)) { 4267 /* Its not ours */ 4268 if (locked_tcb) { 4269 SCTP_TCB_UNLOCK(locked_tcb); 4270 } 4271 *offset = length; 4272 return (NULL); 4273 } 4274 if (stcb) { 4275 stcb->asoc.overall_error_count = 0; 4276 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, 4277 stcb); 4278 } 4279 break; 4280 case SCTP_ECN_CWR: 4281#ifdef SCTP_DEBUG 4282 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4283 printf("SCTP_ECN-CWR\n"); 4284 } 4285#endif /* SCTP_DEBUG */ 4286 /* He's alive so give him credit */ 4287 if (chk_length != sizeof(struct sctp_cwr_chunk)) { 4288 /* Its not ours */ 4289 if (locked_tcb) { 4290 SCTP_TCB_UNLOCK(locked_tcb); 4291 } 4292 *offset = length; 4293 return (NULL); 4294 } 4295 if (stcb) { 4296 stcb->asoc.overall_error_count = 0; 4297 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb); 4298 } 4299 break; 4300 case SCTP_SHUTDOWN_COMPLETE: 4301#ifdef SCTP_DEBUG 4302 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4303 printf("SCTP_SHUTDOWN-COMPLETE\n"); 4304 } 4305#endif /* SCTP_DEBUG */ 4306 /* must be first and only chunk */ 4307 if ((num_chunks > 1) || 4308 (length - *offset > SCTP_SIZE32(chk_length))) { 4309 *offset = length; 4310 if (locked_tcb) { 4311 SCTP_TCB_UNLOCK(locked_tcb); 4312 } 4313 return (NULL); 4314 } 4315 if (stcb) { 4316 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch, 4317 stcb, *netp); 4318 } 4319 *offset = length; 4320 return (NULL); 4321 break; 4322 case SCTP_ASCONF: 4323#ifdef SCTP_DEBUG 4324 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4325 printf("SCTP_ASCONF\n"); 4326 } 4327#endif /* SCTP_DEBUG */ 4328 /* He's alive so give him credit */ 4329 if (stcb) { 4330 stcb->asoc.overall_error_count = 0; 4331 sctp_handle_asconf(m, *offset, 4332 (struct sctp_asconf_chunk *)ch, stcb); 4333 } 4334 break; 4335 case SCTP_ASCONF_ACK: 4336#ifdef SCTP_DEBUG 4337 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4338 printf("SCTP_ASCONF-ACK\n"); 4339 } 4340#endif /* SCTP_DEBUG */ 4341 if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) { 4342 /* Its not ours */ 4343 if (locked_tcb) { 4344 SCTP_TCB_UNLOCK(locked_tcb); 4345 } 4346 *offset = length; 4347 return (NULL); 4348 } 4349 if (stcb) { 4350 /* He's alive so give him credit */ 4351 stcb->asoc.overall_error_count = 0; 4352 sctp_handle_asconf_ack(m, *offset, 4353 (struct sctp_asconf_ack_chunk *)ch, stcb, *netp); 4354 } 4355 break; 4356 case SCTP_FORWARD_CUM_TSN: 4357#ifdef SCTP_DEBUG 4358 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4359 printf("SCTP_FWD-TSN\n"); 4360 } 4361#endif /* SCTP_DEBUG */ 4362 if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) { 4363 /* Its not ours */ 4364 if (locked_tcb) { 4365 SCTP_TCB_UNLOCK(locked_tcb); 4366 } 4367 *offset = length; 4368 return (NULL); 4369 } 4370 /* He's alive so give him credit */ 4371 if (stcb) { 4372 int abort_flag = 0; 4373 4374 stcb->asoc.overall_error_count = 0; 4375 *fwd_tsn_seen = 1; 4376 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4377 /* We are not interested anymore */ 4378 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28); 4379 *offset = length; 4380 return (NULL); 4381 } 4382 sctp_handle_forward_tsn(stcb, 4383 (struct sctp_forward_tsn_chunk *)ch, &abort_flag); 4384 if (abort_flag) { 4385 *offset = length; 4386 return (NULL); 4387 } else { 4388 stcb->asoc.overall_error_count = 0; 4389 } 4390 4391 } 4392 break; 4393 case SCTP_STREAM_RESET: 4394#ifdef SCTP_DEBUG 4395 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4396 printf("SCTP_STREAM_RESET\n"); 4397 } 4398#endif /* SCTP_DEBUG */ 4399 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4400 chk_length, chunk_buf); 4401 if (chk_length < sizeof(struct sctp_stream_reset_tsn_req)) { 4402 /* Its not ours */ 4403 if (locked_tcb) { 4404 SCTP_TCB_UNLOCK(locked_tcb); 4405 } 4406 *offset = length; 4407 return (NULL); 4408 } 4409 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4410 /* We are not interested anymore */ 4411 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29); 4412 *offset = length; 4413 return (NULL); 4414 } 4415 if (stcb) { 4416 if (stcb->asoc.peer_supports_strreset == 0) { 4417 /* 4418 * hmm, peer should have announced 4419 * this, but we will turn it on 4420 * since he is sending us a stream 4421 * reset. 4422 */ 4423 stcb->asoc.peer_supports_strreset = 1; 4424 } 4425 if (sctp_handle_stream_reset(stcb, (struct sctp_stream_reset_out_req *)ch)) { 4426 /* stop processing */ 4427 *offset = length; 4428 return (NULL); 4429 } 4430 } 4431 break; 4432 case SCTP_PACKET_DROPPED: 4433#ifdef SCTP_DEBUG 4434 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4435 printf("SCTP_PACKET_DROPPED\n"); 4436 } 4437#endif /* SCTP_DEBUG */ 4438 /* re-get it all please */ 4439 if (chk_length < sizeof(struct sctp_pktdrop_chunk)) { 4440 /* Its not ours */ 4441 if (locked_tcb) { 4442 SCTP_TCB_UNLOCK(locked_tcb); 4443 } 4444 *offset = length; 4445 return (NULL); 4446 } 4447 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4448 chk_length, chunk_buf); 4449 4450 if ((stcb) && (*netp)) { 4451 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch, 4452 stcb, *netp); 4453 } 4454 break; 4455 4456 case SCTP_AUTHENTICATION: 4457#ifdef SCTP_DEBUG 4458 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4459 printf("SCTP_AUTHENTICATION\n"); 4460 } 4461#endif /* SCTP_DEBUG */ 4462 if (sctp_auth_disable) 4463 goto unknown_chunk; 4464 4465 if (stcb == NULL) { 4466 /* save the first AUTH for later processing */ 4467 if (auth_skipped == 0) { 4468 auth_offset = *offset; 4469 auth_len = chk_length; 4470 auth_skipped = 1; 4471 } 4472 /* skip this chunk (temporarily) */ 4473 goto next_chunk; 4474 } 4475 if ((chk_length < (sizeof(struct sctp_auth_chunk))) || 4476 (chk_length > (sizeof(struct sctp_auth_chunk) + SCTP_AUTH_DIGEST_LEN_MAX))) { 4477 /* Its not ours */ 4478 if (locked_tcb) { 4479 SCTP_TCB_UNLOCK(locked_tcb); 4480 } 4481 *offset = length; 4482 return (NULL); 4483 } 4484 if (got_auth == 1) { 4485 /* skip this chunk... it's already auth'd */ 4486 goto next_chunk; 4487 } 4488 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4489 chk_length, chunk_buf); 4490 got_auth = 1; 4491 if (sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch, 4492 m, *offset)) { 4493 /* auth HMAC failed so dump the packet */ 4494 *offset = length; 4495 return (stcb); 4496 } else { 4497 /* remaining chunks are HMAC checked */ 4498 stcb->asoc.authenticated = 1; 4499 } 4500 break; 4501 4502 default: 4503 unknown_chunk: 4504 /* it's an unknown chunk! */ 4505 if ((ch->chunk_type & 0x40) && (stcb != NULL)) { 4506 struct mbuf *mm; 4507 struct sctp_paramhdr *phd; 4508 4509 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 4510 0, M_DONTWAIT, 1, MT_DATA); 4511 if (mm) { 4512 phd = mtod(mm, struct sctp_paramhdr *); 4513 /* 4514 * We cheat and use param type since 4515 * we did not bother to define a 4516 * error cause struct. They are the 4517 * same basic format with different 4518 * names. 4519 */ 4520 phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK); 4521 phd->param_length = htons(chk_length + sizeof(*phd)); 4522 SCTP_BUF_LEN(mm) = sizeof(*phd); 4523 SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, SCTP_SIZE32(chk_length), 4524 M_DONTWAIT); 4525 if (SCTP_BUF_NEXT(mm)) { 4526 sctp_queue_op_err(stcb, mm); 4527 } else { 4528 sctp_m_freem(mm); 4529 } 4530 } 4531 } 4532 if ((ch->chunk_type & 0x80) == 0) { 4533 /* discard this packet */ 4534 *offset = length; 4535 return (stcb); 4536 } /* else skip this bad chunk and continue... */ 4537 break; 4538 } /* switch (ch->chunk_type) */ 4539 4540 4541next_chunk: 4542 /* get the next chunk */ 4543 *offset += SCTP_SIZE32(chk_length); 4544 if (*offset >= length) { 4545 /* no more data left in the mbuf chain */ 4546 break; 4547 } 4548 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4549 sizeof(struct sctp_chunkhdr), chunk_buf); 4550 if (ch == NULL) { 4551 if (locked_tcb) { 4552 SCTP_TCB_UNLOCK(locked_tcb); 4553 } 4554 *offset = length; 4555 return (NULL); 4556 } 4557 } /* while */ 4558 return (stcb); 4559} 4560 4561 4562/* 4563 * Process the ECN bits we have something set so we must look to see if it is 4564 * ECN(0) or ECN(1) or CE 4565 */ 4566static __inline void 4567sctp_process_ecn_marked_a(struct sctp_tcb *stcb, struct sctp_nets *net, 4568 uint8_t ecn_bits) 4569{ 4570 if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 4571 ; 4572 } else if ((ecn_bits & SCTP_ECT1_BIT) == SCTP_ECT1_BIT) { 4573 /* 4574 * we only add to the nonce sum for ECT1, ECT0 does not 4575 * change the NS bit (that we have yet to find a way to send 4576 * it yet). 4577 */ 4578 4579 /* ECN Nonce stuff */ 4580 stcb->asoc.receiver_nonce_sum++; 4581 stcb->asoc.receiver_nonce_sum &= SCTP_SACK_NONCE_SUM; 4582 4583 /* 4584 * Drag up the last_echo point if cumack is larger since we 4585 * don't want the point falling way behind by more than 4586 * 2^^31 and then having it be incorrect. 4587 */ 4588 if (compare_with_wrap(stcb->asoc.cumulative_tsn, 4589 stcb->asoc.last_echo_tsn, MAX_TSN)) { 4590 stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 4591 } 4592 } else if ((ecn_bits & SCTP_ECT0_BIT) == SCTP_ECT0_BIT) { 4593 /* 4594 * Drag up the last_echo point if cumack is larger since we 4595 * don't want the point falling way behind by more than 4596 * 2^^31 and then having it be incorrect. 4597 */ 4598 if (compare_with_wrap(stcb->asoc.cumulative_tsn, 4599 stcb->asoc.last_echo_tsn, MAX_TSN)) { 4600 stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 4601 } 4602 } 4603} 4604 4605static __inline void 4606sctp_process_ecn_marked_b(struct sctp_tcb *stcb, struct sctp_nets *net, 4607 uint32_t high_tsn, uint8_t ecn_bits) 4608{ 4609 if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 4610 /* 4611 * we possibly must notify the sender that a congestion 4612 * window reduction is in order. We do this by adding a ECNE 4613 * chunk to the output chunk queue. The incoming CWR will 4614 * remove this chunk. 4615 */ 4616 if (compare_with_wrap(high_tsn, stcb->asoc.last_echo_tsn, 4617 MAX_TSN)) { 4618 /* Yep, we need to add a ECNE */ 4619 sctp_send_ecn_echo(stcb, net, high_tsn); 4620 stcb->asoc.last_echo_tsn = high_tsn; 4621 } 4622 } 4623} 4624 4625/* 4626 * common input chunk processing (v4 and v6) 4627 */ 4628void 4629sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, 4630 int length, struct sctphdr *sh, struct sctp_chunkhdr *ch, 4631 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 4632 uint8_t ecn_bits, uint32_t vrf_id, uint32_t table_id) 4633{ 4634 /* 4635 * Control chunk processing 4636 */ 4637 uint32_t high_tsn; 4638 int fwd_tsn_seen = 0, data_processed = 0; 4639 struct mbuf *m = *mm; 4640 int abort_flag = 0; 4641 int un_sent; 4642 4643 SCTP_STAT_INCR(sctps_recvdatagrams); 4644#ifdef SCTP_AUDITING_ENABLED 4645 sctp_audit_log(0xE0, 1); 4646 sctp_auditing(0, inp, stcb, net); 4647#endif 4648 4649#ifdef SCTP_DEBUG 4650 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4651 printf("Ok, Common input processing called, m:%p iphlen:%d offset:%d\n", 4652 m, iphlen, offset); 4653 } 4654#endif /* SCTP_DEBUG */ 4655 4656 if (stcb) { 4657 /* always clear this before beginning a packet */ 4658 stcb->asoc.authenticated = 0; 4659 stcb->asoc.seen_a_sack_this_pkt = 0; 4660 } 4661 if (IS_SCTP_CONTROL(ch)) { 4662 /* process the control portion of the SCTP packet */ 4663 stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch, 4664 inp, stcb, &net, &fwd_tsn_seen, vrf_id, table_id); 4665 if (stcb) { 4666 /* 4667 * This covers us if the cookie-echo was there and 4668 * it changes our INP. 4669 */ 4670 inp = stcb->sctp_ep; 4671 } 4672 } else { 4673 /* 4674 * no control chunks, so pre-process DATA chunks (these 4675 * checks are taken care of by control processing) 4676 */ 4677 4678 /* 4679 * if DATA only packet, and auth is required, then punt... 4680 * can't have authenticated without any AUTH (control) 4681 * chunks 4682 */ 4683 if ((stcb != NULL) && !sctp_auth_disable && 4684 sctp_auth_is_required_chunk(SCTP_DATA, 4685 stcb->asoc.local_auth_chunks)) { 4686 /* "silently" ignore */ 4687 SCTP_STAT_INCR(sctps_recvauthmissing); 4688 SCTP_TCB_UNLOCK(stcb); 4689 return; 4690 } 4691 if (stcb == NULL) { 4692 /* out of the blue DATA chunk */ 4693 sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL, 4694 vrf_id, table_id); 4695 return; 4696 } 4697 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) { 4698 /* v_tag mismatch! */ 4699 SCTP_STAT_INCR(sctps_badvtag); 4700 SCTP_TCB_UNLOCK(stcb); 4701 return; 4702 } 4703 } 4704 4705 if (stcb == NULL) { 4706 /* 4707 * no valid TCB for this packet, or we found it's a bad 4708 * packet while processing control, or we're done with this 4709 * packet (done or skip rest of data), so we drop it... 4710 */ 4711 return; 4712 } 4713 /* 4714 * DATA chunk processing 4715 */ 4716 /* plow through the data chunks while length > offset */ 4717 4718 /* 4719 * Rest should be DATA only. Check authentication state if AUTH for 4720 * DATA is required. 4721 */ 4722 if ((length > offset) && (stcb != NULL) && !sctp_auth_disable && 4723 sctp_auth_is_required_chunk(SCTP_DATA, 4724 stcb->asoc.local_auth_chunks) && 4725 !stcb->asoc.authenticated) { 4726 /* "silently" ignore */ 4727 SCTP_STAT_INCR(sctps_recvauthmissing); 4728#ifdef SCTP_DEBUG 4729 if (sctp_debug_on & SCTP_DEBUG_AUTH1) 4730 printf("Data chunk requires AUTH, skipped\n"); 4731#endif 4732 goto trigger_send; 4733 } 4734 if (length > offset) { 4735 int retval; 4736 4737 /* 4738 * First check to make sure our state is correct. We would 4739 * not get here unless we really did have a tag, so we don't 4740 * abort if this happens, just dump the chunk silently. 4741 */ 4742 switch (SCTP_GET_STATE(&stcb->asoc)) { 4743 case SCTP_STATE_COOKIE_ECHOED: 4744 /* 4745 * we consider data with valid tags in this state 4746 * shows us the cookie-ack was lost. Imply it was 4747 * there. 4748 */ 4749 stcb->asoc.overall_error_count = 0; 4750 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net); 4751 break; 4752 case SCTP_STATE_COOKIE_WAIT: 4753 /* 4754 * We consider OOTB any data sent during asoc setup. 4755 */ 4756 sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL, 4757 vrf_id, table_id); 4758 SCTP_TCB_UNLOCK(stcb); 4759 return; 4760 break; 4761 case SCTP_STATE_EMPTY: /* should not happen */ 4762 case SCTP_STATE_INUSE: /* should not happen */ 4763 case SCTP_STATE_SHUTDOWN_RECEIVED: /* This is a peer error */ 4764 case SCTP_STATE_SHUTDOWN_ACK_SENT: 4765 default: 4766 SCTP_TCB_UNLOCK(stcb); 4767 return; 4768 break; 4769 case SCTP_STATE_OPEN: 4770 case SCTP_STATE_SHUTDOWN_SENT: 4771 break; 4772 } 4773 /* take care of ECN, part 1. */ 4774 if (stcb->asoc.ecn_allowed && 4775 (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) { 4776 sctp_process_ecn_marked_a(stcb, net, ecn_bits); 4777 } 4778 /* plow through the data chunks while length > offset */ 4779 retval = sctp_process_data(mm, iphlen, &offset, length, sh, 4780 inp, stcb, net, &high_tsn); 4781 if (retval == 2) { 4782 /* 4783 * The association aborted, NO UNLOCK needed since 4784 * the association is destroyed. 4785 */ 4786 return; 4787 } 4788 data_processed = 1; 4789 if (retval == 0) { 4790 /* take care of ecn part 2. */ 4791 if (stcb->asoc.ecn_allowed && 4792 (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) { 4793 sctp_process_ecn_marked_b(stcb, net, high_tsn, 4794 ecn_bits); 4795 } 4796 } 4797 /* 4798 * Anything important needs to have been m_copy'ed in 4799 * process_data 4800 */ 4801 } 4802 if ((data_processed == 0) && (fwd_tsn_seen)) { 4803 int was_a_gap = 0; 4804 4805 if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map, 4806 stcb->asoc.cumulative_tsn, MAX_TSN)) { 4807 /* there was a gap before this data was processed */ 4808 was_a_gap = 1; 4809 } 4810 sctp_sack_check(stcb, 1, was_a_gap, &abort_flag); 4811 if (abort_flag) { 4812 /* Again, we aborted so NO UNLOCK needed */ 4813 return; 4814 } 4815 } 4816 /* trigger send of any chunks in queue... */ 4817trigger_send: 4818#ifdef SCTP_AUDITING_ENABLED 4819 sctp_audit_log(0xE0, 2); 4820 sctp_auditing(1, inp, stcb, net); 4821#endif 4822#ifdef SCTP_DEBUG 4823 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4824 printf("Check for chunk output prw:%d tqe:%d tf=%d\n", 4825 stcb->asoc.peers_rwnd, 4826 TAILQ_EMPTY(&stcb->asoc.control_send_queue), 4827 stcb->asoc.total_flight); 4828 } 4829#endif 4830 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 4831 4832 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue) || 4833 ((un_sent) && 4834 (stcb->asoc.peers_rwnd > 0 || 4835 (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) { 4836#ifdef SCTP_DEBUG 4837 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4838 printf("Calling chunk OUTPUT\n"); 4839 } 4840#endif 4841 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 4842#ifdef SCTP_DEBUG 4843 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4844 printf("chunk OUTPUT returns\n"); 4845 } 4846#endif 4847 } 4848#ifdef SCTP_AUDITING_ENABLED 4849 sctp_audit_log(0xE0, 3); 4850 sctp_auditing(2, inp, stcb, net); 4851#endif 4852 SCTP_TCB_UNLOCK(stcb); 4853 return; 4854} 4855 4856 4857 4858void 4859sctp_input(i_pak, off) 4860 struct mbuf *i_pak; 4861 int off; 4862 4863{ 4864#ifdef SCTP_MBUF_LOGGING 4865 struct mbuf *mat; 4866 4867#endif 4868 struct mbuf *m; 4869 int iphlen; 4870 uint32_t vrf_id = 0, table_id = 0; 4871 uint8_t ecn_bits; 4872 struct ip *ip; 4873 struct sctphdr *sh; 4874 struct sctp_inpcb *inp = NULL; 4875 4876 uint32_t check, calc_check; 4877 struct sctp_nets *net; 4878 struct sctp_tcb *stcb = NULL; 4879 struct sctp_chunkhdr *ch; 4880 int refcount_up = 0; 4881 int length, mlen, offset; 4882 4883 4884 if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) { 4885 SCTP_RELEASE_PKT(i_pak); 4886 return; 4887 } 4888 if (SCTP_GET_PKT_TABLEID(i_pak, table_id)) { 4889 SCTP_RELEASE_PKT(i_pak); 4890 return; 4891 } 4892 mlen = SCTP_HEADER_LEN(i_pak); 4893 iphlen = off; 4894 m = SCTP_HEADER_TO_CHAIN(i_pak); 4895 net = NULL; 4896 SCTP_STAT_INCR(sctps_recvpackets); 4897 SCTP_STAT_INCR_COUNTER64(sctps_inpackets); 4898 4899#ifdef SCTP_MBUF_LOGGING 4900 /* Log in any input mbufs */ 4901 mat = m; 4902 while (mat) { 4903 if (SCTP_BUF_IS_EXTENDED(mat)) { 4904 sctp_log_mb(mat, SCTP_MBUF_INPUT); 4905 } 4906 mat = SCTP_BUF_NEXT(mat); 4907 } 4908#endif 4909 4910 /* 4911 * Get IP, SCTP, and first chunk header together in first mbuf. 4912 */ 4913 ip = mtod(m, struct ip *); 4914 offset = iphlen + sizeof(*sh) + sizeof(*ch); 4915 if (SCTP_BUF_LEN(m) < offset) { 4916 if ((m = m_pullup(m, offset)) == 0) { 4917 SCTP_STAT_INCR(sctps_hdrops); 4918 return; 4919 } 4920 ip = mtod(m, struct ip *); 4921 } 4922 sh = (struct sctphdr *)((caddr_t)ip + iphlen); 4923 ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh)); 4924 4925 /* SCTP does not allow broadcasts or multicasts */ 4926 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { 4927 goto bad; 4928 } 4929 if (SCTP_IS_IT_BROADCAST(ip->ip_dst, m)) { 4930 /* 4931 * We only look at broadcast if its a front state, All 4932 * others we will not have a tcb for anyway. 4933 */ 4934 goto bad; 4935 } 4936 /* validate SCTP checksum */ 4937 if ((sctp_no_csum_on_loopback == 0) || !SCTP_IS_IT_LOOPBACK(m)) { 4938 /* 4939 * we do NOT validate things from the loopback if the sysctl 4940 * is set to 1. 4941 */ 4942 check = sh->checksum; /* save incoming checksum */ 4943 if ((check == 0) && (sctp_no_csum_on_loopback)) { 4944 /* 4945 * special hook for where we got a local address 4946 * somehow routed across a non IFT_LOOP type 4947 * interface 4948 */ 4949 if (ip->ip_src.s_addr == ip->ip_dst.s_addr) 4950 goto sctp_skip_csum_4; 4951 } 4952 sh->checksum = 0; /* prepare for calc */ 4953 calc_check = sctp_calculate_sum(m, &mlen, iphlen); 4954 if (calc_check != check) { 4955#ifdef SCTP_DEBUG 4956 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4957 printf("Bad CSUM on SCTP packet calc_check:%x check:%x m:%p mlen:%d iphlen:%d\n", 4958 calc_check, check, m, mlen, iphlen); 4959 } 4960#endif 4961 4962 stcb = sctp_findassociation_addr(m, iphlen, 4963 offset - sizeof(*ch), 4964 sh, ch, &inp, &net, vrf_id); 4965 if ((inp) && (stcb)) { 4966 sctp_send_packet_dropped(stcb, net, m, iphlen, 1); 4967 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR); 4968 } else if ((inp != NULL) && (stcb == NULL)) { 4969 refcount_up = 1; 4970 } 4971 SCTP_STAT_INCR(sctps_badsum); 4972 SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors); 4973 goto bad; 4974 } 4975 sh->checksum = calc_check; 4976 } 4977sctp_skip_csum_4: 4978 /* destination port of 0 is illegal, based on RFC2960. */ 4979 if (sh->dest_port == 0) { 4980 SCTP_STAT_INCR(sctps_hdrops); 4981 goto bad; 4982 } 4983 /* validate mbuf chain length with IP payload length */ 4984 if (mlen < (ip->ip_len - iphlen)) { 4985 SCTP_STAT_INCR(sctps_hdrops); 4986 goto bad; 4987 } 4988 /* 4989 * Locate pcb and tcb for datagram sctp_findassociation_addr() wants 4990 * IP/SCTP/first chunk header... 4991 */ 4992 stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch), 4993 sh, ch, &inp, &net, vrf_id); 4994 /* inp's ref-count increased && stcb locked */ 4995 if (inp == NULL) { 4996 struct sctp_init_chunk *init_chk, chunk_buf; 4997 4998 SCTP_STAT_INCR(sctps_noport); 4999#ifdef ICMP_BANDLIM 5000 /* 5001 * we use the bandwidth limiting to protect against sending 5002 * too many ABORTS all at once. In this case these count the 5003 * same as an ICMP message. 5004 */ 5005 if (badport_bandlim(0) < 0) 5006 goto bad; 5007#endif /* ICMP_BANDLIM */ 5008#ifdef SCTP_DEBUG 5009 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 5010 printf("Sending a ABORT from packet entry!\n"); 5011 } 5012#endif 5013 if (ch->chunk_type == SCTP_INITIATION) { 5014 /* 5015 * we do a trick here to get the INIT tag, dig in 5016 * and get the tag from the INIT and put it in the 5017 * common header. 5018 */ 5019 init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m, 5020 iphlen + sizeof(*sh), sizeof(*init_chk), 5021 (uint8_t *) & chunk_buf); 5022 if (init_chk != NULL) 5023 sh->v_tag = init_chk->init.initiate_tag; 5024 } 5025 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 5026 sctp_send_shutdown_complete2(m, iphlen, sh, vrf_id, 5027 table_id); 5028 goto bad; 5029 } 5030 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) { 5031 goto bad; 5032 } 5033 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) 5034 sctp_send_abort(m, iphlen, sh, 0, NULL, vrf_id, 5035 table_id); 5036 goto bad; 5037 } else if (stcb == NULL) { 5038 refcount_up = 1; 5039 } 5040#ifdef IPSEC 5041 /* 5042 * I very much doubt any of the IPSEC stuff will work but I have no 5043 * idea, so I will leave it in place. 5044 */ 5045 5046 if (inp && ipsec4_in_reject(m, &inp->ip_inp.inp)) { 5047 ipsecstat.in_polvio++; 5048 SCTP_STAT_INCR(sctps_hdrops); 5049 goto bad; 5050 } 5051#endif /* IPSEC */ 5052 5053 /* 5054 * common chunk processing 5055 */ 5056 length = ip->ip_len + iphlen; 5057 offset -= sizeof(struct sctp_chunkhdr); 5058 5059 ecn_bits = ip->ip_tos; 5060 5061 sctp_common_input_processing(&m, iphlen, offset, length, sh, ch, 5062 inp, stcb, net, ecn_bits, vrf_id, 5063 table_id); 5064 /* inp's ref-count reduced && stcb unlocked */ 5065 if (m) { 5066 sctp_m_freem(m); 5067 } 5068 if ((inp) && (refcount_up)) { 5069 /* reduce ref-count */ 5070 SCTP_INP_WLOCK(inp); 5071 SCTP_INP_DECR_REF(inp); 5072 SCTP_INP_WUNLOCK(inp); 5073 } 5074 return; 5075bad: 5076 if (stcb) 5077 SCTP_TCB_UNLOCK(stcb); 5078 5079 if ((inp) && (refcount_up)) { 5080 /* reduce ref-count */ 5081 SCTP_INP_WLOCK(inp); 5082 SCTP_INP_DECR_REF(inp); 5083 SCTP_INP_WUNLOCK(inp); 5084 } 5085 if (m) { 5086 sctp_m_freem(m); 5087 } 5088 /* For BSD/MAC this does nothing */ 5089 SCTP_DETACH_HEADER_FROM_CHAIN(i_pak); 5090 SCTP_RELEASE_HEADER(i_pak); 5091 return; 5092} 5093