sctp_input.c revision 165647
1/*- 2 * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * a) Redistributions of source code must retain the above copyright notice, 8 * this list of conditions and the following disclaimer. 9 * 10 * b) Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the distribution. 13 * 14 * c) Neither the name of Cisco Systems, Inc. nor the names of its 15 * contributors may be used to endorse or promote products derived 16 * from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 20 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 28 * THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31/* $KAME: sctp_input.c,v 1.27 2005/03/06 16:04:17 itojun Exp $ */ 32 33#include <sys/cdefs.h> 34__FBSDID("$FreeBSD: head/sys/netinet/sctp_input.c 165647 2006-12-29 20:21:42Z rrs $"); 35 36#include "opt_ipsec.h" 37#include "opt_compat.h" 38#include "opt_inet6.h" 39#include "opt_inet.h" 40#include "opt_sctp.h" 41 42#include <sys/param.h> 43#include <sys/systm.h> 44#include <sys/malloc.h> 45#include <sys/mbuf.h> 46#include <sys/socket.h> 47#include <sys/socketvar.h> 48#include <sys/sysctl.h> 49#include <sys/domain.h> 50#include <sys/protosw.h> 51#include <sys/kernel.h> 52#include <sys/errno.h> 53#include <sys/syslog.h> 54 55#include <sys/limits.h> 56#include <machine/cpu.h> 57 58#include <net/if.h> 59#include <net/route.h> 60#include <net/if_types.h> 61 62#include <netinet/in.h> 63#include <netinet/in_systm.h> 64#include <netinet/ip.h> 65#include <netinet/in_pcb.h> 66#include <netinet/in_var.h> 67#include <netinet/ip_var.h> 68 69#ifdef INET6 70#include <netinet/ip6.h> 71#include <netinet6/ip6_var.h> 72#endif /* INET6 */ 73 74#include <netinet/ip_icmp.h> 75#include <netinet/icmp_var.h> 76 77#include <netinet/sctp_os.h> 78#include <netinet/sctp_var.h> 79#include <netinet/sctp_pcb.h> 80#include <netinet/sctp_header.h> 81#include <netinet/sctputil.h> 82#include <netinet/sctp_output.h> 83#include <netinet/sctp_input.h> 84#include <netinet/sctp_auth.h> 85#include <netinet/sctp_indata.h> 86#include <netinet/sctp_asconf.h> 87 88#include <netinet/ip_options.h> 89 90 91#ifdef IPSEC 92#include <netinet6/ipsec.h> 93#include <netkey/key.h> 94#endif /* IPSEC */ 95 96 97#ifdef SCTP_DEBUG 98extern uint32_t sctp_debug_on; 99 100#endif 101 102 103 104 105struct sctp_foo_stuff sctp_logoff[30000]; 106int sctp_logoff_stuff = 0; 107 108 109static void 110sctp_stop_all_cookie_timers(struct sctp_tcb *stcb) 111{ 112 struct sctp_nets *net; 113 114 /* 115 * This now not only stops all cookie timers it also stops any INIT 116 * timers as well. This will make sure that the timers are stopped 117 * in all collision cases. 118 */ 119 SCTP_TCB_LOCK_ASSERT(stcb); 120 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 121 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) { 122 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, 123 stcb->sctp_ep, 124 stcb, 125 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1); 126 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) { 127 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, 128 stcb->sctp_ep, 129 stcb, 130 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2); 131 } 132 } 133} 134 135/* INIT handler */ 136static void 137sctp_handle_init(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh, 138 struct sctp_init_chunk *cp, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 139 struct sctp_nets *net) 140{ 141 struct sctp_init *init; 142 struct mbuf *op_err; 143 uint32_t init_limit; 144 145#ifdef SCTP_DEBUG 146 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 147 printf("sctp_handle_init: handling INIT tcb:%p\n", stcb); 148 } 149#endif 150 op_err = NULL; 151 init = &cp->init; 152 /* First are we accepting? */ 153 if ((inp->sctp_socket->so_qlimit == 0) && (stcb == NULL)) { 154#ifdef SCTP_DEBUG 155 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 156 printf("sctp_handle_init: Abort, so_qlimit:%d\n", inp->sctp_socket->so_qlimit); 157 } 158#endif 159 /* 160 * FIX ME ?? What about TCP model and we have a 161 * match/restart case? 162 */ 163 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 164 return; 165 } 166 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) { 167 /* Invalid length */ 168 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 169 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 170 return; 171 } 172 /* validate parameters */ 173 if (init->initiate_tag == 0) { 174 /* protocol error... send abort */ 175 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 176 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 177 return; 178 } 179 if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) { 180 /* invalid parameter... send abort */ 181 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 182 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 183 return; 184 } 185 if (init->num_inbound_streams == 0) { 186 /* protocol error... send abort */ 187 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 188 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 189 return; 190 } 191 if (init->num_outbound_streams == 0) { 192 /* protocol error... send abort */ 193 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 194 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 195 return; 196 } 197 init_limit = offset + ntohs(cp->ch.chunk_length); 198 if (sctp_validate_init_auth_params(m, offset + sizeof(*cp), 199 init_limit)) { 200 /* auth parameter(s) error... send abort */ 201 sctp_abort_association(inp, stcb, m, iphlen, sh, NULL); 202 return; 203 } 204 /* send an INIT-ACK w/cookie */ 205#ifdef SCTP_DEBUG 206 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 207 printf("sctp_handle_init: sending INIT-ACK\n"); 208 } 209#endif 210 sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp); 211} 212 213/* 214 * process peer "INIT/INIT-ACK" chunk returns value < 0 on error 215 */ 216static int 217sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb, 218 struct sctp_nets *net) 219{ 220 struct sctp_init *init; 221 struct sctp_association *asoc; 222 struct sctp_nets *lnet; 223 unsigned int i; 224 225 init = &cp->init; 226 asoc = &stcb->asoc; 227 /* save off parameters */ 228 asoc->peer_vtag = ntohl(init->initiate_tag); 229 asoc->peers_rwnd = ntohl(init->a_rwnd); 230 if (TAILQ_FIRST(&asoc->nets)) { 231 /* update any ssthresh's that may have a default */ 232 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 233 lnet->ssthresh = asoc->peers_rwnd; 234 235#if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING) 236 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION); 237#endif 238 239 } 240 } 241 SCTP_TCB_SEND_LOCK(stcb); 242 if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) { 243 unsigned int newcnt; 244 struct sctp_stream_out *outs; 245 struct sctp_stream_queue_pending *sp; 246 247 /* cut back on number of streams */ 248 newcnt = ntohs(init->num_inbound_streams); 249 /* This if is probably not needed but I am cautious */ 250 if (asoc->strmout) { 251 /* First make sure no data chunks are trapped */ 252 for (i = newcnt; i < asoc->pre_open_streams; i++) { 253 outs = &asoc->strmout[i]; 254 sp = TAILQ_FIRST(&outs->outqueue); 255 while (sp) { 256 TAILQ_REMOVE(&outs->outqueue, sp, 257 next); 258 asoc->stream_queue_cnt--; 259 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, 260 stcb, SCTP_NOTIFY_DATAGRAM_UNSENT, 261 sp); 262 if (sp->data) { 263 sctp_m_freem(sp->data); 264 sp->data = NULL; 265 } 266 sctp_free_remote_addr(sp->net); 267 sp->net = NULL; 268 /* Free the chunk */ 269 printf("sp:%p tcb:%p weird free case\n", 270 sp, stcb); 271 272 sctp_free_a_strmoq(stcb, sp); 273 sp = TAILQ_FIRST(&outs->outqueue); 274 } 275 } 276 } 277 /* cut back the count and abandon the upper streams */ 278 asoc->pre_open_streams = newcnt; 279 } 280 SCTP_TCB_SEND_UNLOCK(stcb); 281 asoc->streamoutcnt = asoc->pre_open_streams; 282 /* init tsn's */ 283 asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1; 284#ifdef SCTP_MAP_LOGGING 285 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 286#endif 287 /* This is the next one we expect */ 288 asoc->str_reset_seq_in = asoc->asconf_seq_in + 1; 289 290 asoc->mapping_array_base_tsn = ntohl(init->initial_tsn); 291 asoc->cumulative_tsn = asoc->asconf_seq_in; 292 asoc->last_echo_tsn = asoc->asconf_seq_in; 293 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 294 /* open the requested streams */ 295 if (asoc->strmin != NULL) { 296 /* Free the old ones */ 297 struct sctp_queued_to_read *ctl; 298 299 for (i = 0; i < asoc->streamincnt; i++) { 300 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 301 while (ctl) { 302 TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next); 303 sctp_free_remote_addr(ctl->whoFrom); 304 sctp_m_freem(ctl->data); 305 ctl->data = NULL; 306 sctp_free_a_readq(stcb, ctl); 307 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue); 308 } 309 } 310 SCTP_FREE(asoc->strmin); 311 } 312 asoc->streamincnt = ntohs(init->num_outbound_streams); 313 if (asoc->streamincnt > MAX_SCTP_STREAMS) { 314 asoc->streamincnt = MAX_SCTP_STREAMS; 315 } 316 SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt * 317 sizeof(struct sctp_stream_in), "StreamsIn"); 318 if (asoc->strmin == NULL) { 319 /* we didn't get memory for the streams! */ 320#ifdef SCTP_DEBUG 321 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 322 printf("process_init: couldn't get memory for the streams!\n"); 323 } 324#endif 325 return (-1); 326 } 327 for (i = 0; i < asoc->streamincnt; i++) { 328 asoc->strmin[i].stream_no = i; 329 asoc->strmin[i].last_sequence_delivered = 0xffff; 330 /* 331 * U-stream ranges will be set when the cookie is unpacked. 332 * Or for the INIT sender they are un set (if pr-sctp not 333 * supported) when the INIT-ACK arrives. 334 */ 335 TAILQ_INIT(&asoc->strmin[i].inqueue); 336 /* 337 * we are not on any wheel, pr-sctp streams will go on the 338 * wheel when they have data waiting for reorder. 339 */ 340 asoc->strmin[i].next_spoke.tqe_next = 0; 341 asoc->strmin[i].next_spoke.tqe_prev = 0; 342 } 343 344 /* 345 * load_address_from_init will put the addresses into the 346 * association when the COOKIE is processed or the INIT-ACK is 347 * processed. Both types of COOKIE's existing and new call this 348 * routine. It will remove addresses that are no longer in the 349 * association (for the restarting case where addresses are 350 * removed). Up front when the INIT arrives we will discard it if it 351 * is a restart and new addresses have been added. 352 */ 353 return (0); 354} 355 356/* 357 * INIT-ACK message processing/consumption returns value < 0 on error 358 */ 359static int 360sctp_process_init_ack(struct mbuf *m, int iphlen, int offset, 361 struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 362 struct sctp_nets *net) 363{ 364 struct sctp_association *asoc; 365 struct mbuf *op_err; 366 int retval, abort_flag; 367 uint32_t initack_limit; 368 369 /* First verify that we have no illegal param's */ 370 abort_flag = 0; 371 op_err = NULL; 372 373 op_err = sctp_arethere_unrecognized_parameters(m, 374 (offset + sizeof(struct sctp_init_chunk)), 375 &abort_flag, (struct sctp_chunkhdr *)cp); 376 if (abort_flag) { 377 /* Send an abort and notify peer */ 378 if (op_err != NULL) { 379 sctp_send_operr_to(m, iphlen, op_err, cp->init.initiate_tag); 380 } else { 381 /* 382 * Just notify (abort_assoc does this if we send an 383 * abort). 384 */ 385 sctp_abort_notification(stcb, 0); 386 /* 387 * No sense in further INIT's since we will get the 388 * same param back 389 */ 390 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3); 391 } 392 return (-1); 393 } 394 asoc = &stcb->asoc; 395 /* process the peer's parameters in the INIT-ACK */ 396 retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net); 397 if (retval < 0) { 398 return (retval); 399 } 400 initack_limit = offset + ntohs(cp->ch.chunk_length); 401 /* load all addresses */ 402 if ((retval = sctp_load_addresses_from_init(stcb, m, iphlen, 403 (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh, 404 NULL))) { 405 /* Huh, we should abort */ 406#ifdef SCTP_DEBUG 407 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 408 printf("Load addresses from INIT causes an abort %d\n", retval); 409 } 410#endif 411 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 412 NULL); 413 return (-1); 414 } 415 stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs, 416 stcb->asoc.local_hmacs); 417 if (op_err) { 418 sctp_queue_op_err(stcb, op_err); 419 /* queuing will steal away the mbuf chain to the out queue */ 420 op_err = NULL; 421 } 422 /* extract the cookie and queue it to "echo" it back... */ 423 stcb->asoc.overall_error_count = 0; 424 net->error_count = 0; 425 426 /* 427 * Cancel the INIT timer, We do this first before queueing the 428 * cookie. We always cancel at the primary to assue that we are 429 * canceling the timer started by the INIT which always goes to the 430 * primary. 431 */ 432 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb, 433 asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4); 434 435 /* calculate the RTO */ 436 net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered); 437 438 retval = sctp_send_cookie_echo(m, offset, stcb, net); 439 if (retval < 0) { 440 /* 441 * No cookie, we probably should send a op error. But in any 442 * case if there is no cookie in the INIT-ACK, we can 443 * abandon the peer, its broke. 444 */ 445 if (retval == -3) { 446 /* We abort with an error of missing mandatory param */ 447 struct mbuf *op_err; 448 449 op_err = 450 sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM); 451 if (op_err) { 452 /* 453 * Expand beyond to include the mandatory 454 * param cookie 455 */ 456 struct sctp_inv_mandatory_param *mp; 457 458 SCTP_BUF_LEN(op_err) = 459 sizeof(struct sctp_inv_mandatory_param); 460 mp = mtod(op_err, 461 struct sctp_inv_mandatory_param *); 462 /* Subtract the reserved param */ 463 mp->length = 464 htons(sizeof(struct sctp_inv_mandatory_param) - 2); 465 mp->num_param = htonl(1); 466 mp->param = htons(SCTP_STATE_COOKIE); 467 mp->resv = 0; 468 } 469 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 470 sh, op_err); 471 } 472 return (retval); 473 } 474 return (0); 475} 476 477static void 478sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp, 479 struct sctp_tcb *stcb, struct sctp_nets *net) 480{ 481 struct sockaddr_storage store; 482 struct sockaddr_in *sin; 483 struct sockaddr_in6 *sin6; 484 struct sctp_nets *r_net; 485 struct timeval tv; 486 487 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) { 488 /* Invalid length */ 489 return; 490 } 491 sin = (struct sockaddr_in *)&store; 492 sin6 = (struct sockaddr_in6 *)&store; 493 494 memset(&store, 0, sizeof(store)); 495 if (cp->heartbeat.hb_info.addr_family == AF_INET && 496 cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) { 497 sin->sin_family = cp->heartbeat.hb_info.addr_family; 498 sin->sin_len = cp->heartbeat.hb_info.addr_len; 499 sin->sin_port = stcb->rport; 500 memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address, 501 sizeof(sin->sin_addr)); 502 } else if (cp->heartbeat.hb_info.addr_family == AF_INET6 && 503 cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) { 504 sin6->sin6_family = cp->heartbeat.hb_info.addr_family; 505 sin6->sin6_len = cp->heartbeat.hb_info.addr_len; 506 sin6->sin6_port = stcb->rport; 507 memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address, 508 sizeof(sin6->sin6_addr)); 509 } else { 510 return; 511 } 512 r_net = sctp_findnet(stcb, (struct sockaddr *)sin); 513 if (r_net == NULL) { 514#ifdef SCTP_DEBUG 515 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 516 printf("Huh? I can't find the address I sent it to, discard\n"); 517 } 518#endif 519 return; 520 } 521 if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) && 522 (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) && 523 (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) { 524 /* 525 * If the its a HB and it's random value is correct when can 526 * confirm the destination. 527 */ 528 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 529 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 530 stcb, 0, (void *)r_net); 531 } 532 r_net->error_count = 0; 533 r_net->hb_responded = 1; 534 tv.tv_sec = cp->heartbeat.hb_info.time_value_1; 535 tv.tv_usec = cp->heartbeat.hb_info.time_value_2; 536 if (r_net->dest_state & SCTP_ADDR_NOT_REACHABLE) { 537 r_net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE; 538 r_net->dest_state |= SCTP_ADDR_REACHABLE; 539 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb, 540 SCTP_HEARTBEAT_SUCCESS, (void *)r_net); 541 /* now was it the primary? if so restore */ 542 if (r_net->dest_state & SCTP_ADDR_WAS_PRIMARY) { 543 sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, r_net); 544 } 545 } 546 /* Now lets do a RTO with this */ 547 r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv); 548} 549 550static void 551sctp_handle_abort(struct sctp_abort_chunk *cp, 552 struct sctp_tcb *stcb, struct sctp_nets *net) 553{ 554 555#ifdef SCTP_DEBUG 556 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 557 printf("sctp_handle_abort: handling ABORT\n"); 558 } 559#endif 560 if (stcb == NULL) 561 return; 562 /* verify that the destination addr is in the association */ 563 /* ignore abort for addresses being deleted */ 564 565 /* stop any receive timers */ 566 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5); 567 /* notify user of the abort and clean up... */ 568 sctp_abort_notification(stcb, 0); 569 /* free the tcb */ 570 SCTP_STAT_INCR_COUNTER32(sctps_aborted); 571 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) || 572 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) { 573 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 574 } 575 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6); 576#ifdef SCTP_DEBUG 577 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 578 printf("sctp_handle_abort: finished\n"); 579 } 580#endif 581} 582 583static void 584sctp_handle_shutdown(struct sctp_shutdown_chunk *cp, 585 struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag) 586{ 587 struct sctp_association *asoc; 588 int some_on_streamwheel; 589 590#ifdef SCTP_DEBUG 591 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 592 printf("sctp_handle_shutdown: handling SHUTDOWN\n"); 593 } 594#endif 595 if (stcb == NULL) 596 return; 597 asoc = &stcb->asoc; 598 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 599 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 600 return; 601 } 602 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) { 603 /* Shutdown NOT the expected size */ 604 return; 605 } else { 606 sctp_update_acked(stcb, cp, net, abort_flag); 607 } 608 if (asoc->control_pdapi) { 609 /* 610 * With a normal shutdown we assume the end of last record. 611 */ 612 SCTP_INP_READ_LOCK(stcb->sctp_ep); 613 asoc->control_pdapi->end_added = 1; 614 asoc->control_pdapi->pdapi_aborted = 1; 615 asoc->control_pdapi = NULL; 616 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 617 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 618 } 619 /* goto SHUTDOWN_RECEIVED state to block new requests */ 620 if (stcb->sctp_socket) { 621 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 622 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 623 asoc->state = SCTP_STATE_SHUTDOWN_RECEIVED; 624 /* 625 * notify upper layer that peer has initiated a 626 * shutdown 627 */ 628 sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL); 629 630 /* reset time */ 631 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 632 } 633 } 634 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) { 635 /* 636 * stop the shutdown timer, since we WILL move to 637 * SHUTDOWN-ACK-SENT. 638 */ 639 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_7); 640 } 641 /* Now are we there yet? */ 642 some_on_streamwheel = 0; 643 if (!TAILQ_EMPTY(&asoc->out_wheel)) { 644 /* Check to see if some data queued */ 645 struct sctp_stream_out *outs; 646 647 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 648 if (!TAILQ_EMPTY(&outs->outqueue)) { 649 some_on_streamwheel = 1; 650 break; 651 } 652 } 653 } 654 if (!TAILQ_EMPTY(&asoc->send_queue) || 655 !TAILQ_EMPTY(&asoc->sent_queue) || 656 some_on_streamwheel) { 657 /* By returning we will push more data out */ 658 return; 659 } else { 660 /* no outstanding data to send, so move on... */ 661 /* send SHUTDOWN-ACK */ 662 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 663 /* move to SHUTDOWN-ACK-SENT state */ 664 if (asoc->state == SCTP_STATE_SHUTDOWN_RECEIVED) { 665 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 666 } 667 asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT; 668 669 /* start SHUTDOWN timer */ 670 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, 671 stcb, net); 672 } 673} 674 675static void 676sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp, 677 struct sctp_tcb *stcb, struct sctp_nets *net) 678{ 679 struct sctp_association *asoc; 680 681#ifdef SCTP_DEBUG 682 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 683 printf("sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n"); 684 } 685#endif 686 if (stcb == NULL) 687 return; 688 689 asoc = &stcb->asoc; 690 /* process according to association state */ 691 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 692 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 693 /* unexpected SHUTDOWN-ACK... so ignore... */ 694 SCTP_TCB_UNLOCK(stcb); 695 return; 696 } 697 if (asoc->control_pdapi) { 698 /* 699 * With a normal shutdown we assume the end of last record. 700 */ 701 SCTP_INP_READ_LOCK(stcb->sctp_ep); 702 asoc->control_pdapi->end_added = 1; 703 asoc->control_pdapi->pdapi_aborted = 1; 704 asoc->control_pdapi = NULL; 705 SCTP_INP_READ_UNLOCK(stcb->sctp_ep); 706 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 707 } 708 /* are the queues empty? */ 709 if (!TAILQ_EMPTY(&asoc->send_queue) || 710 !TAILQ_EMPTY(&asoc->sent_queue) || 711 !TAILQ_EMPTY(&asoc->out_wheel)) { 712 sctp_report_all_outbound(stcb, 0); 713 } 714 /* stop the timer */ 715 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8); 716 /* send SHUTDOWN-COMPLETE */ 717 sctp_send_shutdown_complete(stcb, net); 718 /* notify upper layer protocol */ 719 if (stcb->sctp_socket) { 720 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 721 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 722 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 723 /* Set the connected flag to disconnected */ 724 stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 725 } 726 } 727 SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 728 /* free the TCB but first save off the ep */ 729 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, 730 SCTP_FROM_SCTP_INPUT + SCTP_LOC_9); 731} 732 733/* 734 * Skip past the param header and then we will find the chunk that caused the 735 * problem. There are two possiblities ASCONF or FWD-TSN other than that and 736 * our peer must be broken. 737 */ 738static void 739sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr, 740 struct sctp_nets *net) 741{ 742 struct sctp_chunkhdr *chk; 743 744 chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr)); 745 switch (chk->chunk_type) { 746 case SCTP_ASCONF_ACK: 747 case SCTP_ASCONF: 748 sctp_asconf_cleanup(stcb, net); 749 break; 750 case SCTP_FORWARD_CUM_TSN: 751 stcb->asoc.peer_supports_prsctp = 0; 752 break; 753 default: 754#ifdef SCTP_DEBUG 755 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 756 printf("Peer does not support chunk type %d(%x)??\n", 757 chk->chunk_type, (uint32_t) chk->chunk_type); 758 } 759#endif 760 break; 761 } 762} 763 764/* 765 * Skip past the param header and then we will find the param that caused the 766 * problem. There are a number of param's in a ASCONF OR the prsctp param 767 * these will turn of specific features. 768 */ 769static void 770sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr) 771{ 772 struct sctp_paramhdr *pbad; 773 774 pbad = phdr + 1; 775 switch (ntohs(pbad->param_type)) { 776 /* pr-sctp draft */ 777 case SCTP_PRSCTP_SUPPORTED: 778 stcb->asoc.peer_supports_prsctp = 0; 779 break; 780 case SCTP_SUPPORTED_CHUNK_EXT: 781 break; 782 /* draft-ietf-tsvwg-addip-sctp */ 783 case SCTP_ECN_NONCE_SUPPORTED: 784 stcb->asoc.peer_supports_ecn_nonce = 0; 785 stcb->asoc.ecn_nonce_allowed = 0; 786 stcb->asoc.ecn_allowed = 0; 787 break; 788 case SCTP_ADD_IP_ADDRESS: 789 case SCTP_DEL_IP_ADDRESS: 790 case SCTP_SET_PRIM_ADDR: 791 stcb->asoc.peer_supports_asconf = 0; 792 break; 793 case SCTP_SUCCESS_REPORT: 794 case SCTP_ERROR_CAUSE_IND: 795#ifdef SCTP_DEBUG 796 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 797 printf("Huh, the peer does not support success? or error cause?\n"); 798 printf("Turning off ASCONF to this strange peer\n"); 799 } 800#endif 801 stcb->asoc.peer_supports_asconf = 0; 802 break; 803 default: 804#ifdef SCTP_DEBUG 805 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 806 printf("Peer does not support param type %d(%x)??\n", 807 pbad->param_type, (uint32_t) pbad->param_type); 808 } 809#endif 810 break; 811 } 812} 813 814static int 815sctp_handle_error(struct sctp_chunkhdr *ch, 816 struct sctp_tcb *stcb, struct sctp_nets *net) 817{ 818 int chklen; 819 struct sctp_paramhdr *phdr; 820 uint16_t error_type; 821 uint16_t error_len; 822 struct sctp_association *asoc; 823 824 int adjust; 825 826 /* parse through all of the errors and process */ 827 asoc = &stcb->asoc; 828 phdr = (struct sctp_paramhdr *)((caddr_t)ch + 829 sizeof(struct sctp_chunkhdr)); 830 chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr); 831 while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) { 832 /* Process an Error Cause */ 833 error_type = ntohs(phdr->param_type); 834 error_len = ntohs(phdr->param_length); 835 if ((error_len > chklen) || (error_len == 0)) { 836 /* invalid param length for this param */ 837#ifdef SCTP_DEBUG 838 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 839 printf("Bogus length in error param- chunk left:%d errorlen:%d\n", 840 chklen, error_len); 841 } 842#endif /* SCTP_DEBUG */ 843 return (0); 844 } 845 switch (error_type) { 846 case SCTP_CAUSE_INVALID_STREAM: 847 case SCTP_CAUSE_MISSING_PARAM: 848 case SCTP_CAUSE_INVALID_PARAM: 849 case SCTP_CAUSE_NO_USER_DATA: 850#ifdef SCTP_DEBUG 851 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 852 printf("Software error we got a %d back? We have a bug :/ (or do they?)\n", 853 error_type); 854 } 855#endif 856 break; 857 case SCTP_CAUSE_STALE_COOKIE: 858 /* 859 * We only act if we have echoed a cookie and are 860 * waiting. 861 */ 862 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 863 int *p; 864 865 p = (int *)((caddr_t)phdr + sizeof(*phdr)); 866 /* Save the time doubled */ 867 asoc->cookie_preserve_req = ntohl(*p) << 1; 868 asoc->stale_cookie_count++; 869 if (asoc->stale_cookie_count > 870 asoc->max_init_times) { 871 sctp_abort_notification(stcb, 0); 872 /* now free the asoc */ 873 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_10); 874 return (-1); 875 } 876 /* blast back to INIT state */ 877 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED; 878 asoc->state |= SCTP_STATE_COOKIE_WAIT; 879 880 sctp_stop_all_cookie_timers(stcb); 881 sctp_send_initiate(stcb->sctp_ep, stcb); 882 } 883 break; 884 case SCTP_CAUSE_UNRESOLVABLE_ADDR: 885 /* 886 * Nothing we can do here, we don't do hostname 887 * addresses so if the peer does not like my IPv6 888 * (or IPv4 for that matter) it does not matter. If 889 * they don't support that type of address, they can 890 * NOT possibly get that packet type... i.e. with no 891 * IPv6 you can't recieve a IPv6 packet. so we can 892 * safely ignore this one. If we ever added support 893 * for HOSTNAME Addresses, then we would need to do 894 * something here. 895 */ 896 break; 897 case SCTP_CAUSE_UNRECOG_CHUNK: 898 sctp_process_unrecog_chunk(stcb, phdr, net); 899 break; 900 case SCTP_CAUSE_UNRECOG_PARAM: 901 sctp_process_unrecog_param(stcb, phdr); 902 break; 903 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN: 904 /* 905 * We ignore this since the timer will drive out a 906 * new cookie anyway and there timer will drive us 907 * to send a SHUTDOWN_COMPLETE. We can't send one 908 * here since we don't have their tag. 909 */ 910 break; 911 case SCTP_CAUSE_DELETING_LAST_ADDR: 912 case SCTP_CAUSE_RESOURCE_SHORTAGE: 913 case SCTP_CAUSE_DELETING_SRC_ADDR: 914 /* 915 * We should NOT get these here, but in a 916 * ASCONF-ACK. n 917 */ 918#ifdef SCTP_DEBUG 919 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 920 printf("Peer sends ASCONF errors in a Operational Error?<%d>?\n", 921 error_type); 922 } 923#endif 924 break; 925 case SCTP_CAUSE_OUT_OF_RESC: 926 /* 927 * And what, pray tell do we do with the fact that 928 * the peer is out of resources? Not really sure we 929 * could do anything but abort. I suspect this n * 930 * should have came WITH an abort instead of in a 931 * OP-ERROR. 932 */ 933 break; 934 default: 935#ifdef SCTP_DEBUG 936 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 937 /* don't know what this error cause is... */ 938 printf("sctp_handle_error: unknown error type = 0x%xh\n", 939 error_type); 940 } 941#endif /* SCTP_DEBUG */ 942 break; 943 } 944 adjust = SCTP_SIZE32(error_len); 945 chklen -= adjust; 946 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust); 947 } 948 return (0); 949} 950 951static int 952sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh, 953 struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 954 struct sctp_nets *net) 955{ 956 struct sctp_init_ack *init_ack; 957 int *state; 958 struct mbuf *op_err; 959 960#ifdef SCTP_DEBUG 961 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 962 printf("sctp_handle_init_ack: handling INIT-ACK\n"); 963 } 964#endif 965 if (stcb == NULL) { 966#ifdef SCTP_DEBUG 967 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 968 printf("sctp_handle_init_ack: TCB is null\n"); 969 } 970#endif 971 return (-1); 972 } 973 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) { 974 /* Invalid length */ 975 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 976 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 977 op_err); 978 return (-1); 979 } 980 init_ack = &cp->init; 981 /* validate parameters */ 982 if (init_ack->initiate_tag == 0) { 983 /* protocol error... send an abort */ 984 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 985 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 986 op_err); 987 return (-1); 988 } 989 if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) { 990 /* protocol error... send an abort */ 991 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 992 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 993 op_err); 994 return (-1); 995 } 996 if (init_ack->num_inbound_streams == 0) { 997 /* protocol error... send an abort */ 998 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 999 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 1000 op_err); 1001 return (-1); 1002 } 1003 if (init_ack->num_outbound_streams == 0) { 1004 /* protocol error... send an abort */ 1005 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 1006 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 1007 op_err); 1008 return (-1); 1009 } 1010 /* process according to association state... */ 1011 state = &stcb->asoc.state; 1012 switch (*state & SCTP_STATE_MASK) { 1013 case SCTP_STATE_COOKIE_WAIT: 1014 /* this is the expected state for this chunk */ 1015 /* process the INIT-ACK parameters */ 1016 if (stcb->asoc.primary_destination->dest_state & 1017 SCTP_ADDR_UNCONFIRMED) { 1018 /* 1019 * The primary is where we sent the INIT, we can 1020 * always consider it confirmed when the INIT-ACK is 1021 * returned. Do this before we load addresses 1022 * though. 1023 */ 1024 stcb->asoc.primary_destination->dest_state &= 1025 ~SCTP_ADDR_UNCONFIRMED; 1026 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 1027 stcb, 0, (void *)stcb->asoc.primary_destination); 1028 } 1029 if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb, net 1030 ) < 0) { 1031 /* error in parsing parameters */ 1032 return (-1); 1033 } 1034 /* update our state */ 1035#ifdef SCTP_DEBUG 1036 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1037 printf("moving to COOKIE-ECHOED state\n"); 1038 } 1039#endif 1040 if (*state & SCTP_STATE_SHUTDOWN_PENDING) { 1041 *state = SCTP_STATE_COOKIE_ECHOED | 1042 SCTP_STATE_SHUTDOWN_PENDING; 1043 } else { 1044 *state = SCTP_STATE_COOKIE_ECHOED; 1045 } 1046 1047 /* reset the RTO calc */ 1048 stcb->asoc.overall_error_count = 0; 1049 SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered); 1050 /* 1051 * collapse the init timer back in case of a exponential 1052 * backoff 1053 */ 1054 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep, 1055 stcb, net); 1056 /* 1057 * the send at the end of the inbound data processing will 1058 * cause the cookie to be sent 1059 */ 1060 break; 1061 case SCTP_STATE_SHUTDOWN_SENT: 1062 /* incorrect state... discard */ 1063 break; 1064 case SCTP_STATE_COOKIE_ECHOED: 1065 /* incorrect state... discard */ 1066 break; 1067 case SCTP_STATE_OPEN: 1068 /* incorrect state... discard */ 1069 break; 1070 case SCTP_STATE_EMPTY: 1071 case SCTP_STATE_INUSE: 1072 default: 1073 /* incorrect state... discard */ 1074 return (-1); 1075 break; 1076 } /* end switch asoc state */ 1077#ifdef SCTP_DEBUG 1078 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1079 printf("Leaving handle-init-ack end\n"); 1080 } 1081#endif 1082 return (0); 1083} 1084 1085 1086/* 1087 * handle a state cookie for an existing association m: input packet mbuf 1088 * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a 1089 * "split" mbuf and the cookie signature does not exist offset: offset into 1090 * mbuf to the cookie-echo chunk 1091 */ 1092static struct sctp_tcb * 1093sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset, 1094 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1095 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 1096 struct sockaddr *init_src, int *notification, sctp_assoc_t * sac_assoc_id) 1097{ 1098 struct sctp_association *asoc; 1099 struct sctp_init_chunk *init_cp, init_buf; 1100 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1101 int chk_length; 1102 int init_offset, initack_offset, i; 1103 int retval; 1104 int spec_flag = 0; 1105 1106 /* I know that the TCB is non-NULL from the caller */ 1107 asoc = &stcb->asoc; 1108 1109 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) { 1110 /* SHUTDOWN came in after sending INIT-ACK */ 1111 struct mbuf *op_err; 1112 struct sctp_paramhdr *ph; 1113 1114 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 1115 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 1116 0, M_DONTWAIT, 1, MT_DATA); 1117 if (op_err == NULL) { 1118 /* FOOBAR */ 1119 return (NULL); 1120 } 1121 /* pre-reserve some space */ 1122 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 1123 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 1124 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 1125 /* Set the len */ 1126 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr); 1127 ph = mtod(op_err, struct sctp_paramhdr *); 1128 ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN); 1129 ph->param_length = htons(sizeof(struct sctp_paramhdr)); 1130 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag); 1131 return (NULL); 1132 } 1133 /* 1134 * find and validate the INIT chunk in the cookie (peer's info) the 1135 * INIT should start after the cookie-echo header struct (chunk 1136 * header, state cookie header struct) 1137 */ 1138 init_offset = offset += sizeof(struct sctp_cookie_echo_chunk); 1139 1140 init_cp = (struct sctp_init_chunk *) 1141 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1142 (uint8_t *) & init_buf); 1143 if (init_cp == NULL) { 1144 /* could not pull a INIT chunk in cookie */ 1145 return (NULL); 1146 } 1147 chk_length = ntohs(init_cp->ch.chunk_length); 1148 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1149 return (NULL); 1150 } 1151 /* 1152 * find and validate the INIT-ACK chunk in the cookie (my info) the 1153 * INIT-ACK follows the INIT chunk 1154 */ 1155 initack_offset = init_offset + SCTP_SIZE32(chk_length); 1156 initack_cp = (struct sctp_init_ack_chunk *) 1157 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1158 (uint8_t *) & initack_buf); 1159 if (initack_cp == NULL) { 1160 /* could not pull INIT-ACK chunk in cookie */ 1161 return (NULL); 1162 } 1163 chk_length = ntohs(initack_cp->ch.chunk_length); 1164 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1165 return (NULL); 1166 } 1167 if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) && 1168 (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) { 1169 /* 1170 * case D in Section 5.2.4 Table 2: MMAA process accordingly 1171 * to get into the OPEN state 1172 */ 1173 switch SCTP_GET_STATE 1174 (asoc) { 1175 case SCTP_STATE_COOKIE_WAIT: 1176 /* 1177 * INIT was sent, but got got a COOKIE_ECHO with the 1178 * correct tags... just accept it... 1179 */ 1180 /* First we must process the INIT !! */ 1181 retval = sctp_process_init(init_cp, stcb, net); 1182 if (retval < 0) { 1183 return (NULL); 1184 } 1185 /* intentional fall through to below... */ 1186 1187 case SCTP_STATE_COOKIE_ECHOED: 1188 /* Duplicate INIT case */ 1189 /* we have already processed the INIT so no problem */ 1190 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, 1191 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_11); 1192 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12); 1193 /* update current state */ 1194 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1195 asoc->state = SCTP_STATE_OPEN | 1196 SCTP_STATE_SHUTDOWN_PENDING; 1197 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1198 stcb->sctp_ep, stcb, asoc->primary_destination); 1199 1200 } else if ((asoc->state & SCTP_STATE_SHUTDOWN_SENT) == 0) { 1201 /* if ok, move to OPEN state */ 1202 asoc->state = SCTP_STATE_OPEN; 1203 } 1204 sctp_stop_all_cookie_timers(stcb); 1205 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1206 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1207 (inp->sctp_socket->so_qlimit == 0) 1208 ) { 1209 /* 1210 * Here is where collision would go if we 1211 * did a connect() and instead got a 1212 * init/init-ack/cookie done before the 1213 * init-ack came back.. 1214 */ 1215 stcb->sctp_ep->sctp_flags |= 1216 SCTP_PCB_FLAGS_CONNECTED; 1217 soisconnected(stcb->sctp_ep->sctp_socket); 1218 } 1219 /* notify upper layer */ 1220 *notification = SCTP_NOTIFY_ASSOC_UP; 1221 /* 1222 * since we did not send a HB make sure we don't 1223 * double things 1224 */ 1225 net->hb_responded = 1; 1226 1227 if (stcb->asoc.sctp_autoclose_ticks && 1228 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) { 1229 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 1230 inp, stcb, NULL); 1231 } 1232 break; 1233 default: 1234 /* 1235 * we're in the OPEN state (or beyond), so peer must 1236 * have simply lost the COOKIE-ACK 1237 */ 1238 break; 1239 } /* end switch */ 1240 sctp_stop_all_cookie_timers(stcb); 1241 /* 1242 * We ignore the return code here.. not sure if we should 1243 * somehow abort.. but we do have an existing asoc. This 1244 * really should not fail. 1245 */ 1246 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1247 init_offset + sizeof(struct sctp_init_chunk), 1248 initack_offset, sh, init_src)) { 1249 return (NULL); 1250 } 1251 /* respond with a COOKIE-ACK */ 1252 sctp_toss_old_cookies(stcb, asoc); 1253 sctp_send_cookie_ack(stcb); 1254 return (stcb); 1255 } /* end if */ 1256 if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1257 ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag && 1258 cookie->tie_tag_my_vtag == 0 && 1259 cookie->tie_tag_peer_vtag == 0) { 1260 /* 1261 * case C in Section 5.2.4 Table 2: XMOO silently discard 1262 */ 1263 return (NULL); 1264 } 1265 if (ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag && 1266 (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag || 1267 init_cp->init.initiate_tag == 0)) { 1268 /* 1269 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info 1270 * should be ok, re-accept peer info 1271 */ 1272 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13); 1273 sctp_stop_all_cookie_timers(stcb); 1274 /* 1275 * since we did not send a HB make sure we don't double 1276 * things 1277 */ 1278 net->hb_responded = 1; 1279 if (stcb->asoc.sctp_autoclose_ticks && 1280 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1281 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, 1282 NULL); 1283 } 1284 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1285 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1286 1287 /* Note last_cwr_tsn? where is this used? */ 1288 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1289 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) { 1290 /* 1291 * Ok the peer probably discarded our data (if we 1292 * echoed a cookie+data). So anything on the 1293 * sent_queue should be marked for retransmit, we 1294 * may not get something to kick us so it COULD 1295 * still take a timeout to move these.. but it can't 1296 * hurt to mark them. 1297 */ 1298 struct sctp_tmit_chunk *chk; 1299 1300 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) { 1301 if (chk->sent < SCTP_DATAGRAM_RESEND) { 1302 chk->sent = SCTP_DATAGRAM_RESEND; 1303 stcb->asoc.sent_queue_retran_cnt++; 1304 spec_flag++; 1305 } 1306 } 1307 1308 } 1309 /* process the INIT info (peer's info) */ 1310 retval = sctp_process_init(init_cp, stcb, net); 1311 if (retval < 0) { 1312 return (NULL); 1313 } 1314 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1315 init_offset + sizeof(struct sctp_init_chunk), 1316 initack_offset, sh, init_src)) { 1317 return (NULL); 1318 } 1319 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) || 1320 (asoc->state & SCTP_STATE_COOKIE_ECHOED)) { 1321 *notification = SCTP_NOTIFY_ASSOC_UP; 1322 1323 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1324 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1325 (inp->sctp_socket->so_qlimit == 0)) { 1326 stcb->sctp_ep->sctp_flags |= 1327 SCTP_PCB_FLAGS_CONNECTED; 1328 soisconnected(stcb->sctp_ep->sctp_socket); 1329 } 1330 } 1331 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1332 asoc->state = SCTP_STATE_OPEN | 1333 SCTP_STATE_SHUTDOWN_PENDING; 1334 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1335 stcb->sctp_ep, stcb, asoc->primary_destination); 1336 1337 } else { 1338 asoc->state = SCTP_STATE_OPEN; 1339 } 1340 sctp_stop_all_cookie_timers(stcb); 1341 sctp_toss_old_cookies(stcb, asoc); 1342 sctp_send_cookie_ack(stcb); 1343 if (spec_flag) { 1344 /* 1345 * only if we have retrans set do we do this. What 1346 * this call does is get only the COOKIE-ACK out and 1347 * then when we return the normal call to 1348 * sctp_chunk_output will get the retrans out behind 1349 * this. 1350 */ 1351 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK); 1352 } 1353 return (stcb); 1354 } 1355 if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1356 ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) && 1357 cookie->tie_tag_my_vtag == asoc->my_vtag_nonce && 1358 cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce && 1359 cookie->tie_tag_peer_vtag != 0) { 1360 struct sctpasochead *head; 1361 1362 /* 1363 * case A in Section 5.2.4 Table 2: XXMM (peer restarted) 1364 */ 1365 /* temp code */ 1366 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14); 1367 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15); 1368 1369 *sac_assoc_id = sctp_get_associd(stcb); 1370 /* notify upper layer */ 1371 *notification = SCTP_NOTIFY_ASSOC_RESTART; 1372 atomic_add_int(&stcb->asoc.refcnt, 1); 1373 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1374 asoc->state = SCTP_STATE_OPEN | 1375 SCTP_STATE_SHUTDOWN_PENDING; 1376 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1377 stcb->sctp_ep, stcb, asoc->primary_destination); 1378 1379 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) { 1380 /* move to OPEN state, if not in SHUTDOWN_SENT */ 1381 asoc->state = SCTP_STATE_OPEN; 1382 } 1383 asoc->pre_open_streams = 1384 ntohs(initack_cp->init.num_outbound_streams); 1385 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1386 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1387 1388 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1389 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1390 1391 asoc->str_reset_seq_in = asoc->init_seq_number; 1392 1393 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1394 if (asoc->mapping_array) 1395 memset(asoc->mapping_array, 0, 1396 asoc->mapping_array_size); 1397 SCTP_TCB_UNLOCK(stcb); 1398 SCTP_INP_INFO_WLOCK(); 1399 SCTP_INP_WLOCK(stcb->sctp_ep); 1400 SCTP_TCB_LOCK(stcb); 1401 atomic_add_int(&stcb->asoc.refcnt, -1); 1402 /* send up all the data */ 1403 SCTP_TCB_SEND_LOCK(stcb); 1404 1405 sctp_report_all_outbound(stcb, 1); 1406 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 1407 stcb->asoc.strmout[i].stream_no = i; 1408 stcb->asoc.strmout[i].next_sequence_sent = 0; 1409 stcb->asoc.strmout[i].last_msg_incomplete = 0; 1410 } 1411 /* process the INIT-ACK info (my info) */ 1412 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1413 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1414 1415 /* pull from vtag hash */ 1416 LIST_REMOVE(stcb, sctp_asocs); 1417 /* re-insert to new vtag position */ 1418 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, 1419 sctppcbinfo.hashasocmark)]; 1420 /* 1421 * put it in the bucket in the vtag hash of assoc's for the 1422 * system 1423 */ 1424 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 1425 1426 /* Is this the first restart? */ 1427 if (stcb->asoc.in_restart_hash == 0) { 1428 /* Ok add it to assoc_id vtag hash */ 1429 head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id, 1430 sctppcbinfo.hashrestartmark)]; 1431 LIST_INSERT_HEAD(head, stcb, sctp_tcbrestarhash); 1432 stcb->asoc.in_restart_hash = 1; 1433 } 1434 /* process the INIT info (peer's info) */ 1435 SCTP_TCB_SEND_UNLOCK(stcb); 1436 SCTP_INP_WUNLOCK(stcb->sctp_ep); 1437 SCTP_INP_INFO_WUNLOCK(); 1438 1439 retval = sctp_process_init(init_cp, stcb, net); 1440 if (retval < 0) { 1441 return (NULL); 1442 } 1443 /* 1444 * since we did not send a HB make sure we don't double 1445 * things 1446 */ 1447 net->hb_responded = 1; 1448 1449 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1450 init_offset + sizeof(struct sctp_init_chunk), 1451 initack_offset, sh, init_src)) { 1452 return (NULL); 1453 } 1454 /* respond with a COOKIE-ACK */ 1455 sctp_stop_all_cookie_timers(stcb); 1456 sctp_toss_old_cookies(stcb, asoc); 1457 sctp_send_cookie_ack(stcb); 1458 1459 return (stcb); 1460 } 1461 /* if we are not a restart we need the assoc_id field pop'd */ 1462 asoc->assoc_id = ntohl(initack_cp->init.initiate_tag); 1463 1464 /* all other cases... */ 1465 return (NULL); 1466} 1467 1468/* 1469 * handle a state cookie for a new association m: input packet mbuf chain-- 1470 * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf 1471 * and the cookie signature does not exist offset: offset into mbuf to the 1472 * cookie-echo chunk length: length of the cookie chunk to: where the init 1473 * was from returns a new TCB 1474 */ 1475static struct sctp_tcb * 1476sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset, 1477 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1478 struct sctp_inpcb *inp, struct sctp_nets **netp, 1479 struct sockaddr *init_src, int *notification, 1480 int auth_skipped, uint32_t auth_offset, uint32_t auth_len) 1481{ 1482 struct sctp_tcb *stcb; 1483 struct sctp_init_chunk *init_cp, init_buf; 1484 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1485 struct sockaddr_storage sa_store; 1486 struct sockaddr *initack_src = (struct sockaddr *)&sa_store; 1487 struct sockaddr_in *sin; 1488 struct sockaddr_in6 *sin6; 1489 struct sctp_association *asoc; 1490 int chk_length; 1491 int init_offset, initack_offset, initack_limit; 1492 int retval; 1493 int error = 0; 1494 uint32_t old_tag; 1495 uint8_t chunk_buf[DEFAULT_CHUNK_BUFFER]; 1496 1497 /* 1498 * find and validate the INIT chunk in the cookie (peer's info) the 1499 * INIT should start after the cookie-echo header struct (chunk 1500 * header, state cookie header struct) 1501 */ 1502 init_offset = offset + sizeof(struct sctp_cookie_echo_chunk); 1503 init_cp = (struct sctp_init_chunk *) 1504 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1505 (uint8_t *) & init_buf); 1506 if (init_cp == NULL) { 1507 /* could not pull a INIT chunk in cookie */ 1508#ifdef SCTP_DEBUG 1509 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1510 printf("process_cookie_new: could not pull INIT chunk hdr\n"); 1511 } 1512#endif /* SCTP_DEBUG */ 1513 return (NULL); 1514 } 1515 chk_length = ntohs(init_cp->ch.chunk_length); 1516 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1517#ifdef SCTP_DEBUG 1518 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1519 printf("HUH? process_cookie_new: could not find INIT chunk!\n"); 1520 } 1521#endif /* SCTP_DEBUG */ 1522 return (NULL); 1523 } 1524 initack_offset = init_offset + SCTP_SIZE32(chk_length); 1525 /* 1526 * find and validate the INIT-ACK chunk in the cookie (my info) the 1527 * INIT-ACK follows the INIT chunk 1528 */ 1529 initack_cp = (struct sctp_init_ack_chunk *) 1530 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1531 (uint8_t *) & initack_buf); 1532 if (initack_cp == NULL) { 1533 /* could not pull INIT-ACK chunk in cookie */ 1534#ifdef SCTP_DEBUG 1535 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1536 printf("process_cookie_new: could not pull INIT-ACK chunk hdr\n"); 1537 } 1538#endif /* SCTP_DEBUG */ 1539 return (NULL); 1540 } 1541 chk_length = ntohs(initack_cp->ch.chunk_length); 1542 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1543 return (NULL); 1544 } 1545 /* 1546 * NOTE: We can't use the INIT_ACK's chk_length to determine the 1547 * "initack_limit" value. This is because the chk_length field 1548 * includes the length of the cookie, but the cookie is omitted when 1549 * the INIT and INIT_ACK are tacked onto the cookie... 1550 */ 1551 initack_limit = offset + cookie_len; 1552 1553 /* 1554 * now that we know the INIT/INIT-ACK are in place, create a new TCB 1555 * and popluate 1556 */ 1557 stcb = sctp_aloc_assoc(inp, init_src, 0, &error, 1558 ntohl(initack_cp->init.initiate_tag)); 1559 if (stcb == NULL) { 1560 struct mbuf *op_err; 1561 1562 /* memory problem? */ 1563#ifdef SCTP_DEBUG 1564 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1565 printf("process_cookie_new: no room for another TCB!\n"); 1566 } 1567#endif /* SCTP_DEBUG */ 1568 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1569 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 1570 sh, op_err); 1571 return (NULL); 1572 } 1573 /* get the correct sctp_nets */ 1574 *netp = sctp_findnet(stcb, init_src); 1575 asoc = &stcb->asoc; 1576 /* get scope variables out of cookie */ 1577 asoc->ipv4_local_scope = cookie->ipv4_scope; 1578 asoc->site_scope = cookie->site_scope; 1579 asoc->local_scope = cookie->local_scope; 1580 asoc->loopback_scope = cookie->loopback_scope; 1581 1582 if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) || 1583 (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) { 1584 struct mbuf *op_err; 1585 1586 /* 1587 * Houston we have a problem. The EP changed while the 1588 * cookie was in flight. Only recourse is to abort the 1589 * association. 1590 */ 1591 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1592 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 1593 sh, op_err); 1594 return (NULL); 1595 } 1596 /* process the INIT-ACK info (my info) */ 1597 old_tag = asoc->my_vtag; 1598 asoc->assoc_id = asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1599 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1600 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1601 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1602 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1603 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1604 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1605 asoc->str_reset_seq_in = asoc->init_seq_number; 1606 1607 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1608 1609 /* process the INIT info (peer's info) */ 1610 retval = sctp_process_init(init_cp, stcb, *netp); 1611 if (retval < 0) { 1612 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16); 1613 return (NULL); 1614 } 1615 /* load all addresses */ 1616 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1617 init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh, 1618 init_src)) { 1619 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17); 1620 return (NULL); 1621 } 1622 /* 1623 * verify any preceding AUTH chunk that was skipped 1624 */ 1625 /* pull the local authentication parameters from the cookie/init-ack */ 1626 sctp_auth_get_cookie_params(stcb, m, 1627 initack_offset + sizeof(struct sctp_init_ack_chunk), 1628 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk))); 1629 if (auth_skipped) { 1630 struct sctp_auth_chunk *auth; 1631 1632 auth = (struct sctp_auth_chunk *) 1633 sctp_m_getptr(m, auth_offset, auth_len, chunk_buf); 1634 if (sctp_handle_auth(stcb, auth, m, auth_offset)) { 1635 /* auth HMAC failed, dump the assoc and packet */ 1636#ifdef SCTP_DEBUG 1637 if (sctp_debug_on & SCTP_DEBUG_AUTH1) 1638 printf("COOKIE-ECHO: AUTH failed\n"); 1639#endif /* SCTP_DEBUG */ 1640 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18); 1641 return (NULL); 1642 } else { 1643 /* remaining chunks checked... good to go */ 1644 stcb->asoc.authenticated = 1; 1645 } 1646 } 1647 /* update current state */ 1648#ifdef SCTP_DEBUG 1649 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1650 printf("moving to OPEN state\n"); 1651 } 1652#endif 1653 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1654 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1655 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 1656 stcb->sctp_ep, stcb, asoc->primary_destination); 1657 } else { 1658 asoc->state = SCTP_STATE_OPEN; 1659 } 1660 sctp_stop_all_cookie_timers(stcb); 1661 SCTP_STAT_INCR_COUNTER32(sctps_passiveestab); 1662 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 1663 1664 /* 1665 * if we're doing ASCONFs, check to see if we have any new local 1666 * addresses that need to get added to the peer (eg. addresses 1667 * changed while cookie echo in flight). This needs to be done 1668 * after we go to the OPEN state to do the correct asconf 1669 * processing. else, make sure we have the correct addresses in our 1670 * lists 1671 */ 1672 1673 /* warning, we re-use sin, sin6, sa_store here! */ 1674 /* pull in local_address (our "from" address) */ 1675 if (cookie->laddr_type == SCTP_IPV4_ADDRESS) { 1676 /* source addr is IPv4 */ 1677 sin = (struct sockaddr_in *)initack_src; 1678 memset(sin, 0, sizeof(*sin)); 1679 sin->sin_family = AF_INET; 1680 sin->sin_len = sizeof(struct sockaddr_in); 1681 sin->sin_addr.s_addr = cookie->laddress[0]; 1682 } else if (cookie->laddr_type == SCTP_IPV6_ADDRESS) { 1683 /* source addr is IPv6 */ 1684 sin6 = (struct sockaddr_in6 *)initack_src; 1685 memset(sin6, 0, sizeof(*sin6)); 1686 sin6->sin6_family = AF_INET6; 1687 sin6->sin6_len = sizeof(struct sockaddr_in6); 1688 sin6->sin6_scope_id = cookie->scope_id; 1689 memcpy(&sin6->sin6_addr, cookie->laddress, 1690 sizeof(sin6->sin6_addr)); 1691 } else { 1692 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19); 1693 return (NULL); 1694 } 1695 1696 sctp_check_address_list(stcb, m, 1697 initack_offset + sizeof(struct sctp_init_ack_chunk), 1698 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)), 1699 initack_src, cookie->local_scope, cookie->site_scope, 1700 cookie->ipv4_scope, cookie->loopback_scope); 1701 1702 1703 /* set up to notify upper layer */ 1704 *notification = SCTP_NOTIFY_ASSOC_UP; 1705 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1706 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1707 (inp->sctp_socket->so_qlimit == 0)) { 1708 /* 1709 * This is an endpoint that called connect() how it got a 1710 * cookie that is NEW is a bit of a mystery. It must be that 1711 * the INIT was sent, but before it got there.. a complete 1712 * INIT/INIT-ACK/COOKIE arrived. But of course then it 1713 * should have went to the other code.. not here.. oh well.. 1714 * a bit of protection is worth having.. 1715 */ 1716 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 1717 soisconnected(stcb->sctp_ep->sctp_socket); 1718 } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 1719 (inp->sctp_socket->so_qlimit)) { 1720 /* 1721 * We don't want to do anything with this one. Since it is 1722 * the listening guy. The timer will get started for 1723 * accepted connections in the caller. 1724 */ 1725 ; 1726 } 1727 /* since we did not send a HB make sure we don't double things */ 1728 (*netp)->hb_responded = 1; 1729 1730 if (stcb->asoc.sctp_autoclose_ticks && 1731 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) { 1732 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL); 1733 } 1734 /* respond with a COOKIE-ACK */ 1735 /* calculate the RTT */ 1736 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp, 1737 &cookie->time_entered); 1738 sctp_send_cookie_ack(stcb); 1739 return (stcb); 1740} 1741 1742 1743/* 1744 * handles a COOKIE-ECHO message stcb: modified to either a new or left as 1745 * existing (non-NULL) TCB 1746 */ 1747static struct mbuf * 1748sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset, 1749 struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp, 1750 struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp, 1751 int auth_skipped, uint32_t auth_offset, uint32_t auth_len, struct sctp_tcb **locked_tcb) 1752{ 1753 struct sctp_state_cookie *cookie; 1754 struct sockaddr_in6 sin6; 1755 struct sockaddr_in sin; 1756 struct sctp_tcb *l_stcb = *stcb; 1757 struct sctp_inpcb *l_inp; 1758 struct sockaddr *to; 1759 sctp_assoc_t sac_restart_id; 1760 struct sctp_pcb *ep; 1761 struct mbuf *m_sig; 1762 uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE]; 1763 uint8_t *sig; 1764 uint8_t cookie_ok = 0; 1765 unsigned int size_of_pkt, sig_offset, cookie_offset; 1766 unsigned int cookie_len; 1767 struct timeval now; 1768 struct timeval time_expires; 1769 struct sockaddr_storage dest_store; 1770 struct sockaddr *localep_sa = (struct sockaddr *)&dest_store; 1771 struct ip *iph; 1772 int notification = 0; 1773 struct sctp_nets *netl; 1774 int had_a_existing_tcb = 0; 1775 1776#ifdef SCTP_DEBUG 1777 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1778 printf("sctp_handle_cookie: handling COOKIE-ECHO\n"); 1779 } 1780#endif 1781 1782 if (inp_p == NULL) { 1783 return (NULL); 1784 } 1785 /* First get the destination address setup too. */ 1786 iph = mtod(m, struct ip *); 1787 if (iph->ip_v == IPVERSION) { 1788 /* its IPv4 */ 1789 struct sockaddr_in *sin; 1790 1791 sin = (struct sockaddr_in *)(localep_sa); 1792 memset(sin, 0, sizeof(*sin)); 1793 sin->sin_family = AF_INET; 1794 sin->sin_len = sizeof(*sin); 1795 sin->sin_port = sh->dest_port; 1796 sin->sin_addr.s_addr = iph->ip_dst.s_addr; 1797 size_of_pkt = SCTP_GET_IPV4_LENGTH(iph); 1798 1799 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1800 /* its IPv6 */ 1801 struct ip6_hdr *ip6; 1802 struct sockaddr_in6 *sin6; 1803 1804 sin6 = (struct sockaddr_in6 *)(localep_sa); 1805 memset(sin6, 0, sizeof(*sin6)); 1806 sin6->sin6_family = AF_INET6; 1807 sin6->sin6_len = sizeof(struct sockaddr_in6); 1808 ip6 = mtod(m, struct ip6_hdr *); 1809 sin6->sin6_port = sh->dest_port; 1810 sin6->sin6_addr = ip6->ip6_dst; 1811 size_of_pkt = SCTP_GET_IPV6_LENGTH(ip6); 1812 } else { 1813 return (NULL); 1814 } 1815 1816 cookie = &cp->cookie; 1817 cookie_offset = offset + sizeof(struct sctp_chunkhdr); 1818 cookie_len = ntohs(cp->ch.chunk_length); 1819 1820 if ((cookie->peerport != sh->src_port) && 1821 (cookie->myport != sh->dest_port) && 1822 (cookie->my_vtag != sh->v_tag)) { 1823 /* 1824 * invalid ports or bad tag. Note that we always leave the 1825 * v_tag in the header in network order and when we stored 1826 * it in the my_vtag slot we also left it in network order. 1827 * This maintians the match even though it may be in the 1828 * opposite byte order of the machine :-> 1829 */ 1830 return (NULL); 1831 } 1832 if (cookie_len > size_of_pkt || 1833 cookie_len < sizeof(struct sctp_cookie_echo_chunk) + 1834 sizeof(struct sctp_init_chunk) + 1835 sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) { 1836 /* cookie too long! or too small */ 1837 return (NULL); 1838 } 1839 /* 1840 * split off the signature into its own mbuf (since it should not be 1841 * calculated in the sctp_hmac_m() call). 1842 */ 1843 sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE; 1844 if (sig_offset > size_of_pkt) { 1845 /* packet not correct size! */ 1846 /* XXX this may already be accounted for earlier... */ 1847 return (NULL); 1848 } 1849 m_sig = m_split(m, sig_offset, M_DONTWAIT); 1850 if (m_sig == NULL) { 1851 /* out of memory or ?? */ 1852 return (NULL); 1853 } 1854 /* 1855 * compute the signature/digest for the cookie 1856 */ 1857 ep = &(*inp_p)->sctp_ep; 1858 l_inp = *inp_p; 1859 if (l_stcb) { 1860 SCTP_TCB_UNLOCK(l_stcb); 1861 } 1862 SCTP_INP_RLOCK(l_inp); 1863 if (l_stcb) { 1864 SCTP_TCB_LOCK(l_stcb); 1865 } 1866 /* which cookie is it? */ 1867 if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) && 1868 (ep->current_secret_number != ep->last_secret_number)) { 1869 /* it's the old cookie */ 1870 sctp_hmac_m(SCTP_HMAC, 1871 (uint8_t *) ep->secret_key[(int)ep->last_secret_number], 1872 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1873 } else { 1874 /* it's the current cookie */ 1875 sctp_hmac_m(SCTP_HMAC, 1876 (uint8_t *) ep->secret_key[(int)ep->current_secret_number], 1877 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1878 } 1879 /* get the signature */ 1880 SCTP_INP_RUNLOCK(l_inp); 1881 sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig); 1882 if (sig == NULL) { 1883 /* couldn't find signature */ 1884 sctp_m_freem(m_sig); 1885 return (NULL); 1886 } 1887 /* compare the received digest with the computed digest */ 1888 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) { 1889 /* try the old cookie? */ 1890 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) && 1891 (ep->current_secret_number != ep->last_secret_number)) { 1892 /* compute digest with old */ 1893 sctp_hmac_m(SCTP_HMAC, 1894 (uint8_t *) ep->secret_key[(int)ep->last_secret_number], 1895 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1896 /* compare */ 1897 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0) 1898 cookie_ok = 1; 1899 } 1900 } else { 1901 cookie_ok = 1; 1902 } 1903 1904 /* 1905 * Now before we continue we must reconstruct our mbuf so that 1906 * normal processing of any other chunks will work. 1907 */ 1908 { 1909 struct mbuf *m_at; 1910 1911 m_at = m; 1912 while (SCTP_BUF_NEXT(m_at) != NULL) { 1913 m_at = SCTP_BUF_NEXT(m_at); 1914 } 1915 SCTP_BUF_NEXT(m_at) = m_sig; 1916 } 1917 1918 if (cookie_ok == 0) { 1919#ifdef SCTP_DEBUG 1920 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1921 printf("handle_cookie_echo: cookie signature validation failed!\n"); 1922 printf("offset = %u, cookie_offset = %u, sig_offset = %u\n", 1923 (uint32_t) offset, cookie_offset, sig_offset); 1924 } 1925#endif 1926 return (NULL); 1927 } 1928 /* 1929 * check the cookie timestamps to be sure it's not stale 1930 */ 1931 SCTP_GETTIME_TIMEVAL(&now); 1932 /* Expire time is in Ticks, so we convert to seconds */ 1933 time_expires.tv_sec = cookie->time_entered.tv_sec + cookie->cookie_life; 1934 time_expires.tv_usec = cookie->time_entered.tv_usec; 1935 if (timevalcmp(&now, &time_expires, >)) { 1936 /* cookie is stale! */ 1937 struct mbuf *op_err; 1938 struct sctp_stale_cookie_msg *scm; 1939 uint32_t tim; 1940 1941 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg), 1942 0, M_DONTWAIT, 1, MT_DATA); 1943 if (op_err == NULL) { 1944 /* FOOBAR */ 1945 return (NULL); 1946 } 1947 /* pre-reserve some space */ 1948 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 1949 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 1950 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 1951 1952 /* Set the len */ 1953 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg); 1954 scm = mtod(op_err, struct sctp_stale_cookie_msg *); 1955 scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE); 1956 scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) + 1957 (sizeof(uint32_t)))); 1958 /* seconds to usec */ 1959 tim = (now.tv_sec - time_expires.tv_sec) * 1000000; 1960 /* add in usec */ 1961 if (tim == 0) 1962 tim = now.tv_usec - cookie->time_entered.tv_usec; 1963 scm->time_usec = htonl(tim); 1964 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag); 1965 return (NULL); 1966 } 1967 /* 1968 * Now we must see with the lookup address if we have an existing 1969 * asoc. This will only happen if we were in the COOKIE-WAIT state 1970 * and a INIT collided with us and somewhere the peer sent the 1971 * cookie on another address besides the single address our assoc 1972 * had for him. In this case we will have one of the tie-tags set at 1973 * least AND the address field in the cookie can be used to look it 1974 * up. 1975 */ 1976 to = NULL; 1977 if (cookie->addr_type == SCTP_IPV6_ADDRESS) { 1978 memset(&sin6, 0, sizeof(sin6)); 1979 sin6.sin6_family = AF_INET6; 1980 sin6.sin6_len = sizeof(sin6); 1981 sin6.sin6_port = sh->src_port; 1982 sin6.sin6_scope_id = cookie->scope_id; 1983 memcpy(&sin6.sin6_addr.s6_addr, cookie->address, 1984 sizeof(sin6.sin6_addr.s6_addr)); 1985 to = (struct sockaddr *)&sin6; 1986 } else if (cookie->addr_type == SCTP_IPV4_ADDRESS) { 1987 memset(&sin, 0, sizeof(sin)); 1988 sin.sin_family = AF_INET; 1989 sin.sin_len = sizeof(sin); 1990 sin.sin_port = sh->src_port; 1991 sin.sin_addr.s_addr = cookie->address[0]; 1992 to = (struct sockaddr *)&sin; 1993 } 1994 if ((*stcb == NULL) && to) { 1995 /* Yep, lets check */ 1996 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL); 1997 if (*stcb == NULL) { 1998 /* 1999 * We should have only got back the same inp. If we 2000 * got back a different ep we have a problem. The 2001 * original findep got back l_inp and now 2002 */ 2003 if (l_inp != *inp_p) { 2004 printf("Bad problem find_ep got a diff inp then special_locate?\n"); 2005 } 2006 } else { 2007 if (*locked_tcb == NULL) { 2008 /* 2009 * In this case we found the assoc only 2010 * after we locked the create lock. This 2011 * means we are in a colliding case and we 2012 * must make sure that we unlock the tcb if 2013 * its one of the cases where we throw away 2014 * the incoming packets. 2015 */ 2016 *locked_tcb = *stcb; 2017 2018 /* 2019 * We must also increment the inp ref count 2020 * since the ref_count flags was set when we 2021 * did not find the TCB, now we found it 2022 * which reduces the refcount.. we must 2023 * raise it back out to balance it all :-) 2024 */ 2025 SCTP_INP_INCR_REF((*stcb)->sctp_ep); 2026 if ((*stcb)->sctp_ep != l_inp) { 2027 printf("Huh? ep:%p diff then l_inp:%p?\n", 2028 (*stcb)->sctp_ep, l_inp); 2029 } 2030 } 2031 } 2032 } 2033 cookie_len -= SCTP_SIGNATURE_SIZE; 2034 if (*stcb == NULL) { 2035 /* this is the "normal" case... get a new TCB */ 2036 *stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie, 2037 cookie_len, *inp_p, netp, to, ¬ification, 2038 auth_skipped, auth_offset, auth_len); 2039 } else { 2040 /* this is abnormal... cookie-echo on existing TCB */ 2041 had_a_existing_tcb = 1; 2042 *stcb = sctp_process_cookie_existing(m, iphlen, offset, sh, 2043 cookie, cookie_len, *inp_p, *stcb, *netp, to, ¬ification, 2044 &sac_restart_id); 2045 } 2046 2047 if (*stcb == NULL) { 2048 /* still no TCB... must be bad cookie-echo */ 2049 return (NULL); 2050 } 2051 /* 2052 * Ok, we built an association so confirm the address we sent the 2053 * INIT-ACK to. 2054 */ 2055 netl = sctp_findnet(*stcb, to); 2056 /* 2057 * This code should in theory NOT run but 2058 */ 2059 if (netl == NULL) { 2060 /* TSNH! Huh, why do I need to add this address here? */ 2061 int ret; 2062 2063 ret = sctp_add_remote_addr(*stcb, to, SCTP_DONOT_SETSCOPE, 2064 SCTP_IN_COOKIE_PROC); 2065 netl = sctp_findnet(*stcb, to); 2066 } 2067 if (netl) { 2068 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) { 2069 netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2070 sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL, 2071 netl); 2072 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 2073 (*stcb), 0, (void *)netl); 2074 } 2075 } 2076 if (*stcb) { 2077 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, *inp_p, 2078 *stcb, NULL); 2079 } 2080 if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 2081 if (!had_a_existing_tcb || 2082 (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) { 2083 /* 2084 * If we have a NEW cookie or the connect never 2085 * reached the connected state during collision we 2086 * must do the TCP accept thing. 2087 */ 2088 struct socket *so, *oso; 2089 struct sctp_inpcb *inp; 2090 2091 if (notification == SCTP_NOTIFY_ASSOC_RESTART) { 2092 /* 2093 * For a restart we will keep the same 2094 * socket, no need to do anything. I THINK!! 2095 */ 2096 sctp_ulp_notify(notification, *stcb, 0, (void *)&sac_restart_id); 2097 return (m); 2098 } 2099 oso = (*inp_p)->sctp_socket; 2100 /* 2101 * We do this to keep the sockets side happy durin 2102 * the sonewcon ONLY. 2103 */ 2104 NET_LOCK_GIANT(); 2105 SCTP_TCB_UNLOCK((*stcb)); 2106 so = sonewconn(oso, SS_ISCONNECTED 2107 ); 2108 NET_UNLOCK_GIANT(); 2109 SCTP_INP_WLOCK((*stcb)->sctp_ep); 2110 SCTP_TCB_LOCK((*stcb)); 2111 SCTP_INP_WUNLOCK((*stcb)->sctp_ep); 2112 if (so == NULL) { 2113 struct mbuf *op_err; 2114 2115 /* Too many sockets */ 2116#ifdef SCTP_DEBUG 2117 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 2118 printf("process_cookie_new: no room for another socket!\n"); 2119 } 2120#endif /* SCTP_DEBUG */ 2121 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 2122 sctp_abort_association(*inp_p, NULL, m, iphlen, 2123 sh, op_err); 2124 sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20); 2125 return (NULL); 2126 } 2127 inp = (struct sctp_inpcb *)so->so_pcb; 2128 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 2129 SCTP_PCB_FLAGS_CONNECTED | 2130 SCTP_PCB_FLAGS_IN_TCPPOOL | 2131 (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) | 2132 SCTP_PCB_FLAGS_DONT_WAKE); 2133 inp->sctp_features = (*inp_p)->sctp_features; 2134 inp->sctp_socket = so; 2135 inp->sctp_frag_point = (*inp_p)->sctp_frag_point; 2136 inp->partial_delivery_point = (*inp_p)->partial_delivery_point; 2137 inp->sctp_context = (*inp_p)->sctp_context; 2138 inp->inp_starting_point_for_iterator = NULL; 2139 /* 2140 * copy in the authentication parameters from the 2141 * original endpoint 2142 */ 2143 if (inp->sctp_ep.local_hmacs) 2144 sctp_free_hmaclist(inp->sctp_ep.local_hmacs); 2145 inp->sctp_ep.local_hmacs = 2146 sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs); 2147 if (inp->sctp_ep.local_auth_chunks) 2148 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks); 2149 inp->sctp_ep.local_auth_chunks = 2150 sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks); 2151 (void)sctp_copy_skeylist(&(*inp_p)->sctp_ep.shared_keys, 2152 &inp->sctp_ep.shared_keys); 2153 2154 /* 2155 * Now we must move it from one hash table to 2156 * another and get the tcb in the right place. 2157 */ 2158 sctp_move_pcb_and_assoc(*inp_p, inp, *stcb); 2159 2160 sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb); 2161 2162 /* Switch over to the new guy */ 2163 *inp_p = inp; 2164 2165 sctp_ulp_notify(notification, *stcb, 0, NULL); 2166 return (m); 2167 } 2168 } 2169 if ((notification) && ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) { 2170 sctp_ulp_notify(notification, *stcb, 0, NULL); 2171 } 2172 return (m); 2173} 2174 2175static void 2176sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp, 2177 struct sctp_tcb *stcb, struct sctp_nets *net) 2178{ 2179 /* cp must not be used, others call this without a c-ack :-) */ 2180 struct sctp_association *asoc; 2181 2182#ifdef SCTP_DEBUG 2183 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2184 printf("sctp_handle_cookie_ack: handling COOKIE-ACK\n"); 2185 } 2186#endif 2187 if (stcb == NULL) 2188 return; 2189 2190 asoc = &stcb->asoc; 2191 2192 sctp_stop_all_cookie_timers(stcb); 2193 /* process according to association state */ 2194 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 2195 /* state change only needed when I am in right state */ 2196#ifdef SCTP_DEBUG 2197 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2198 printf("moving to OPEN state\n"); 2199 } 2200#endif 2201 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 2202 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 2203 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 2204 stcb->sctp_ep, stcb, asoc->primary_destination); 2205 2206 } else { 2207 asoc->state = SCTP_STATE_OPEN; 2208 } 2209 /* update RTO */ 2210 SCTP_STAT_INCR_COUNTER32(sctps_activeestab); 2211 SCTP_STAT_INCR_GAUGE32(sctps_currestab); 2212 if (asoc->overall_error_count == 0) { 2213 net->RTO = sctp_calculate_rto(stcb, asoc, net, 2214 &asoc->time_entered); 2215 } 2216 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 2217 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL); 2218 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 2219 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 2220 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 2221 soisconnected(stcb->sctp_ep->sctp_socket); 2222 } 2223 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, 2224 stcb, net); 2225 /* 2226 * since we did not send a HB make sure we don't double 2227 * things 2228 */ 2229 net->hb_responded = 1; 2230 2231 if (stcb->asoc.sctp_autoclose_ticks && 2232 sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) { 2233 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 2234 stcb->sctp_ep, stcb, NULL); 2235 } 2236 /* 2237 * set ASCONF timer if ASCONFs are pending and allowed (eg. 2238 * addresses changed when init/cookie echo in flight) 2239 */ 2240 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) && 2241 (stcb->asoc.peer_supports_asconf) && 2242 (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) { 2243 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, 2244 stcb->sctp_ep, stcb, 2245 stcb->asoc.primary_destination); 2246 } 2247 } 2248 /* Toss the cookie if I can */ 2249 sctp_toss_old_cookies(stcb, asoc); 2250 if (!TAILQ_EMPTY(&asoc->sent_queue)) { 2251 /* Restart the timer if we have pending data */ 2252 struct sctp_tmit_chunk *chk; 2253 2254 chk = TAILQ_FIRST(&asoc->sent_queue); 2255 if (chk) { 2256 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2257 stcb, chk->whoTo); 2258 } 2259 } 2260} 2261 2262static void 2263sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp, 2264 struct sctp_tcb *stcb) 2265{ 2266 struct sctp_nets *net; 2267 struct sctp_tmit_chunk *lchk; 2268 uint32_t tsn; 2269 2270 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_ecne_chunk)) { 2271 return; 2272 } 2273 SCTP_STAT_INCR(sctps_recvecne); 2274 tsn = ntohl(cp->tsn); 2275 /* ECN Nonce stuff: need a resync and disable the nonce sum check */ 2276 /* Also we make sure we disable the nonce_wait */ 2277 lchk = TAILQ_FIRST(&stcb->asoc.send_queue); 2278 if (lchk == NULL) { 2279 stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq; 2280 } else { 2281 stcb->asoc.nonce_resync_tsn = lchk->rec.data.TSN_seq; 2282 } 2283 stcb->asoc.nonce_wait_for_ecne = 0; 2284 stcb->asoc.nonce_sum_check = 0; 2285 2286 /* Find where it was sent, if possible */ 2287 net = NULL; 2288 lchk = TAILQ_FIRST(&stcb->asoc.sent_queue); 2289 while (lchk) { 2290 if (lchk->rec.data.TSN_seq == tsn) { 2291 net = lchk->whoTo; 2292 break; 2293 } 2294 if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ)) 2295 break; 2296 lchk = TAILQ_NEXT(lchk, sctp_next); 2297 } 2298 if (net == NULL) 2299 /* default is we use the primary */ 2300 net = stcb->asoc.primary_destination; 2301 2302 if (compare_with_wrap(tsn, stcb->asoc.last_cwr_tsn, MAX_TSN)) { 2303#ifdef SCTP_CWND_MONITOR 2304 int old_cwnd; 2305 2306 old_cwnd = net->cwnd; 2307#endif 2308 SCTP_STAT_INCR(sctps_ecnereducedcwnd); 2309 net->ssthresh = net->cwnd / 2; 2310 if (net->ssthresh < net->mtu) { 2311 net->ssthresh = net->mtu; 2312 /* here back off the timer as well, to slow us down */ 2313 net->RTO <<= 2; 2314 } 2315 net->cwnd = net->ssthresh; 2316#ifdef SCTP_CWND_MONITOR 2317 sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_SAT); 2318#endif 2319 /* 2320 * we reduce once every RTT. So we will only lower cwnd at 2321 * the next sending seq i.e. the resync_tsn. 2322 */ 2323 stcb->asoc.last_cwr_tsn = stcb->asoc.nonce_resync_tsn; 2324 } 2325 /* 2326 * We always send a CWR this way if our previous one was lost our 2327 * peer will get an update, or if it is not time again to reduce we 2328 * still get the cwr to the peer. 2329 */ 2330 sctp_send_cwr(stcb, net, tsn); 2331} 2332 2333static void 2334sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb) 2335{ 2336 /* 2337 * Here we get a CWR from the peer. We must look in the outqueue and 2338 * make sure that we have a covered ECNE in teh control chunk part. 2339 * If so remove it. 2340 */ 2341 struct sctp_tmit_chunk *chk; 2342 struct sctp_ecne_chunk *ecne; 2343 2344 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 2345 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) { 2346 continue; 2347 } 2348 /* 2349 * Look for and remove if it is the right TSN. Since there 2350 * is only ONE ECNE on the control queue at any one time we 2351 * don't need to worry about more than one! 2352 */ 2353 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 2354 if (compare_with_wrap(ntohl(cp->tsn), ntohl(ecne->tsn), 2355 MAX_TSN) || (cp->tsn == ecne->tsn)) { 2356 /* this covers this ECNE, we can remove it */ 2357 stcb->asoc.ecn_echo_cnt_onq--; 2358 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, 2359 sctp_next); 2360 if (chk->data) { 2361 sctp_m_freem(chk->data); 2362 chk->data = NULL; 2363 } 2364 stcb->asoc.ctrl_queue_cnt--; 2365 sctp_free_remote_addr(chk->whoTo); 2366 sctp_free_a_chunk(stcb, chk); 2367 break; 2368 } 2369 } 2370} 2371 2372static void 2373sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp, 2374 struct sctp_tcb *stcb, struct sctp_nets *net) 2375{ 2376 struct sctp_association *asoc; 2377 2378#ifdef SCTP_DEBUG 2379 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2380 printf("sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n"); 2381 } 2382#endif 2383 if (stcb == NULL) 2384 return; 2385 2386 asoc = &stcb->asoc; 2387 /* process according to association state */ 2388 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) { 2389 /* unexpected SHUTDOWN-COMPLETE... so ignore... */ 2390 SCTP_TCB_UNLOCK(stcb); 2391 return; 2392 } 2393 /* notify upper layer protocol */ 2394 if (stcb->sctp_socket) { 2395 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 2396 /* are the queues empty? they should be */ 2397 if (!TAILQ_EMPTY(&asoc->send_queue) || 2398 !TAILQ_EMPTY(&asoc->sent_queue) || 2399 !TAILQ_EMPTY(&asoc->out_wheel)) { 2400 sctp_report_all_outbound(stcb, 0); 2401 } 2402 } 2403 /* stop the timer */ 2404 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_21); 2405 SCTP_STAT_INCR_COUNTER32(sctps_shutdown); 2406 /* free the TCB */ 2407 sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22); 2408 return; 2409} 2410 2411static int 2412process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc, 2413 struct sctp_nets *net, uint8_t flg) 2414{ 2415 switch (desc->chunk_type) { 2416 case SCTP_DATA: 2417 /* find the tsn to resend (possibly */ 2418 { 2419 uint32_t tsn; 2420 struct sctp_tmit_chunk *tp1; 2421 2422 tsn = ntohl(desc->tsn_ifany); 2423 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2424 while (tp1) { 2425 if (tp1->rec.data.TSN_seq == tsn) { 2426 /* found it */ 2427 break; 2428 } 2429 if (compare_with_wrap(tp1->rec.data.TSN_seq, tsn, 2430 MAX_TSN)) { 2431 /* not found */ 2432 tp1 = NULL; 2433 break; 2434 } 2435 tp1 = TAILQ_NEXT(tp1, sctp_next); 2436 } 2437 if (tp1 == NULL) { 2438 /* 2439 * Do it the other way , aka without paying 2440 * attention to queue seq order. 2441 */ 2442 SCTP_STAT_INCR(sctps_pdrpdnfnd); 2443 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2444 while (tp1) { 2445 if (tp1->rec.data.TSN_seq == tsn) { 2446 /* found it */ 2447 break; 2448 } 2449 tp1 = TAILQ_NEXT(tp1, sctp_next); 2450 } 2451 } 2452 if (tp1 == NULL) { 2453 SCTP_STAT_INCR(sctps_pdrptsnnf); 2454 } 2455 if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) { 2456 uint8_t *ddp; 2457 2458 if ((stcb->asoc.peers_rwnd == 0) && 2459 ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) { 2460 SCTP_STAT_INCR(sctps_pdrpdiwnp); 2461 return (0); 2462 } 2463 if (stcb->asoc.peers_rwnd == 0 && 2464 (flg & SCTP_FROM_MIDDLE_BOX)) { 2465 SCTP_STAT_INCR(sctps_pdrpdizrw); 2466 return (0); 2467 } 2468 ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+ 2469 sizeof(struct sctp_data_chunk)); 2470 { 2471 unsigned int iii; 2472 2473 for (iii = 0; iii < sizeof(desc->data_bytes); 2474 iii++) { 2475 if (ddp[iii] != desc->data_bytes[iii]) { 2476 SCTP_STAT_INCR(sctps_pdrpbadd); 2477 return (-1); 2478 } 2479 } 2480 } 2481 /* 2482 * We zero out the nonce so resync not 2483 * needed 2484 */ 2485 tp1->rec.data.ect_nonce = 0; 2486 2487 if (tp1->do_rtt) { 2488 /* 2489 * this guy had a RTO calculation 2490 * pending on it, cancel it 2491 */ 2492 tp1->whoTo->rto_pending = 0; 2493 tp1->do_rtt = 0; 2494 } 2495 SCTP_STAT_INCR(sctps_pdrpmark); 2496 if (tp1->sent != SCTP_DATAGRAM_RESEND) 2497 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2498 tp1->sent = SCTP_DATAGRAM_RESEND; 2499 /* 2500 * mark it as if we were doing a FR, since 2501 * we will be getting gap ack reports behind 2502 * the info from the router. 2503 */ 2504 tp1->rec.data.doing_fast_retransmit = 1; 2505 /* 2506 * mark the tsn with what sequences can 2507 * cause a new FR. 2508 */ 2509 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) { 2510 tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq; 2511 } else { 2512 tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq; 2513 } 2514 2515 /* restart the timer */ 2516 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2517 stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23); 2518 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2519 stcb, tp1->whoTo); 2520 2521 /* fix counts and things */ 2522#ifdef SCTP_FLIGHT_LOGGING 2523 sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN, 2524 tp1->whoTo->flight_size, 2525 tp1->book_size, 2526 (uintptr_t) stcb, 2527 tp1->rec.data.TSN_seq); 2528#endif 2529 if (tp1->whoTo->flight_size >= tp1->book_size) 2530 tp1->whoTo->flight_size -= tp1->book_size; 2531 else 2532 tp1->whoTo->flight_size = 0; 2533 2534 if (stcb->asoc.total_flight >= tp1->book_size) { 2535 stcb->asoc.total_flight -= tp1->book_size; 2536 if (stcb->asoc.total_flight_count > 0) 2537 stcb->asoc.total_flight_count--; 2538 } else { 2539 stcb->asoc.total_flight = 0; 2540 stcb->asoc.total_flight_count = 0; 2541 } 2542 tp1->snd_count--; 2543 } { 2544 /* audit code */ 2545 unsigned int audit; 2546 2547 audit = 0; 2548 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) { 2549 if (tp1->sent == SCTP_DATAGRAM_RESEND) 2550 audit++; 2551 } 2552 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue, 2553 sctp_next) { 2554 if (tp1->sent == SCTP_DATAGRAM_RESEND) 2555 audit++; 2556 } 2557 if (audit != stcb->asoc.sent_queue_retran_cnt) { 2558 printf("**Local Audit finds cnt:%d asoc cnt:%d\n", 2559 audit, stcb->asoc.sent_queue_retran_cnt); 2560#ifndef SCTP_AUDITING_ENABLED 2561 stcb->asoc.sent_queue_retran_cnt = audit; 2562#endif 2563 } 2564 } 2565 } 2566 break; 2567 case SCTP_ASCONF: 2568 { 2569 struct sctp_tmit_chunk *asconf; 2570 2571 TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue, 2572 sctp_next) { 2573 if (asconf->rec.chunk_id.id == SCTP_ASCONF) { 2574 break; 2575 } 2576 } 2577 if (asconf) { 2578 if (asconf->sent != SCTP_DATAGRAM_RESEND) 2579 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2580 asconf->sent = SCTP_DATAGRAM_RESEND; 2581 asconf->snd_count--; 2582 } 2583 } 2584 break; 2585 case SCTP_INITIATION: 2586 /* resend the INIT */ 2587 stcb->asoc.dropped_special_cnt++; 2588 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) { 2589 /* 2590 * If we can get it in, in a few attempts we do 2591 * this, otherwise we let the timer fire. 2592 */ 2593 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, 2594 stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24); 2595 sctp_send_initiate(stcb->sctp_ep, stcb); 2596 } 2597 break; 2598 case SCTP_SELECTIVE_ACK: 2599 /* resend the sack */ 2600 sctp_send_sack(stcb); 2601 break; 2602 case SCTP_HEARTBEAT_REQUEST: 2603 /* resend a demand HB */ 2604 sctp_send_hb(stcb, 1, net); 2605 break; 2606 case SCTP_SHUTDOWN: 2607 sctp_send_shutdown(stcb, net); 2608 break; 2609 case SCTP_SHUTDOWN_ACK: 2610 sctp_send_shutdown_ack(stcb, net); 2611 break; 2612 case SCTP_COOKIE_ECHO: 2613 { 2614 struct sctp_tmit_chunk *cookie; 2615 2616 cookie = NULL; 2617 TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue, 2618 sctp_next) { 2619 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 2620 break; 2621 } 2622 } 2623 if (cookie) { 2624 if (cookie->sent != SCTP_DATAGRAM_RESEND) 2625 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt); 2626 cookie->sent = SCTP_DATAGRAM_RESEND; 2627 sctp_stop_all_cookie_timers(stcb); 2628 } 2629 } 2630 break; 2631 case SCTP_COOKIE_ACK: 2632 sctp_send_cookie_ack(stcb); 2633 break; 2634 case SCTP_ASCONF_ACK: 2635 /* resend last asconf ack */ 2636 sctp_send_asconf_ack(stcb, 1); 2637 break; 2638 case SCTP_FORWARD_CUM_TSN: 2639 send_forward_tsn(stcb, &stcb->asoc); 2640 break; 2641 /* can't do anything with these */ 2642 case SCTP_PACKET_DROPPED: 2643 case SCTP_INITIATION_ACK: /* this should not happen */ 2644 case SCTP_HEARTBEAT_ACK: 2645 case SCTP_ABORT_ASSOCIATION: 2646 case SCTP_OPERATION_ERROR: 2647 case SCTP_SHUTDOWN_COMPLETE: 2648 case SCTP_ECN_ECHO: 2649 case SCTP_ECN_CWR: 2650 default: 2651 break; 2652 } 2653 return (0); 2654} 2655 2656void 2657sctp_reset_in_stream(struct sctp_tcb *stcb, int number_entries, uint16_t * list) 2658{ 2659 int i; 2660 uint16_t temp; 2661 2662 /* 2663 * We set things to 0xffff since this is the last delivered sequence 2664 * and we will be sending in 0 after the reset. 2665 */ 2666 2667 if (number_entries) { 2668 for (i = 0; i < number_entries; i++) { 2669 temp = ntohs(list[i]); 2670 if (temp >= stcb->asoc.streamincnt) { 2671 continue; 2672 } 2673 stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff; 2674 } 2675 } else { 2676 list = NULL; 2677 for (i = 0; i < stcb->asoc.streamincnt; i++) { 2678 stcb->asoc.strmin[i].last_sequence_delivered = 0xffff; 2679 } 2680 } 2681 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list); 2682} 2683 2684static void 2685sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list) 2686{ 2687 int i; 2688 2689 if (number_entries == 0) { 2690 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 2691 stcb->asoc.strmout[i].next_sequence_sent = 0; 2692 } 2693 } else if (number_entries) { 2694 for (i = 0; i < number_entries; i++) { 2695 uint16_t temp; 2696 2697 temp = ntohs(list[i]); 2698 if (temp >= stcb->asoc.streamoutcnt) { 2699 /* no such stream */ 2700 continue; 2701 } 2702 stcb->asoc.strmout[temp].next_sequence_sent = 0; 2703 } 2704 } 2705 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list); 2706} 2707 2708 2709struct sctp_stream_reset_out_request * 2710sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk) 2711{ 2712 struct sctp_association *asoc; 2713 struct sctp_stream_reset_out_req *req; 2714 struct sctp_stream_reset_out_request *r; 2715 struct sctp_tmit_chunk *chk; 2716 int len, clen; 2717 2718 asoc = &stcb->asoc; 2719 if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 2720 return (NULL); 2721 } 2722 if (stcb->asoc.str_reset == NULL) { 2723 return (NULL); 2724 } 2725 chk = stcb->asoc.str_reset; 2726 if (chk->data == NULL) { 2727 return (NULL); 2728 } 2729 if (bchk) { 2730 /* he wants a copy of the chk pointer */ 2731 *bchk = chk; 2732 } 2733 clen = chk->send_size; 2734 req = mtod(chk->data, struct sctp_stream_reset_out_req *); 2735 r = &req->sr_req; 2736 if (ntohl(r->request_seq) == seq) { 2737 /* found it */ 2738 return (r); 2739 } 2740 len = SCTP_SIZE32(ntohs(r->ph.param_length)); 2741 if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) { 2742 /* move to the next one, there can only be a max of two */ 2743 r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len); 2744 if (ntohl(r->request_seq) == seq) { 2745 return (r); 2746 } 2747 } 2748 /* that seq is not here */ 2749 return (NULL); 2750} 2751 2752static void 2753sctp_clean_up_stream_reset(struct sctp_tcb *stcb) 2754{ 2755 struct sctp_association *asoc; 2756 2757 asoc = &stcb->asoc; 2758 struct sctp_tmit_chunk *chk = stcb->asoc.str_reset; 2759 2760 if (stcb->asoc.str_reset == NULL) { 2761 return; 2762 } 2763 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25); 2764 TAILQ_REMOVE(&asoc->control_send_queue, 2765 chk, 2766 sctp_next); 2767 if (chk->data) { 2768 sctp_m_freem(chk->data); 2769 chk->data = NULL; 2770 } 2771 asoc->ctrl_queue_cnt--; 2772 sctp_free_remote_addr(chk->whoTo); 2773 2774 sctp_free_a_chunk(stcb, chk); 2775 stcb->asoc.str_reset = NULL; 2776} 2777 2778 2779static int 2780sctp_handle_stream_reset_response(struct sctp_tcb *stcb, 2781 uint32_t seq, uint32_t action, 2782 struct sctp_stream_reset_response *respin) 2783{ 2784 uint16_t type; 2785 int lparm_len; 2786 struct sctp_association *asoc = &stcb->asoc; 2787 struct sctp_tmit_chunk *chk; 2788 struct sctp_stream_reset_out_request *srparam; 2789 int number_entries; 2790 2791 if (asoc->stream_reset_outstanding == 0) { 2792 /* duplicate */ 2793 return (0); 2794 } 2795 if (seq == stcb->asoc.str_reset_seq_out) { 2796 srparam = sctp_find_stream_reset(stcb, seq, &chk); 2797 if (srparam) { 2798 stcb->asoc.str_reset_seq_out++; 2799 type = ntohs(srparam->ph.param_type); 2800 lparm_len = ntohs(srparam->ph.param_length); 2801 if (type == SCTP_STR_RESET_OUT_REQUEST) { 2802 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t); 2803 asoc->stream_reset_out_is_outstanding = 0; 2804 if (asoc->stream_reset_outstanding) 2805 asoc->stream_reset_outstanding--; 2806 if (action == SCTP_STREAM_RESET_PERFORMED) { 2807 /* do it */ 2808 sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams); 2809 } else { 2810 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams); 2811 } 2812 } else if (type == SCTP_STR_RESET_IN_REQUEST) { 2813 /* Answered my request */ 2814 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t); 2815 if (asoc->stream_reset_outstanding) 2816 asoc->stream_reset_outstanding--; 2817 if (action != SCTP_STREAM_RESET_PERFORMED) { 2818 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, number_entries, srparam->list_of_streams); 2819 } 2820 } else if (type == SCTP_STR_RESET_TSN_REQUEST) { 2821 /** 2822 * a) Adopt the new in tsn. 2823 * b) reset the map 2824 * c) Adopt the new out-tsn 2825 */ 2826 struct sctp_stream_reset_response_tsn *resp; 2827 struct sctp_forward_tsn_chunk fwdtsn; 2828 int abort_flag = 0; 2829 2830 if (respin == NULL) { 2831 /* huh ? */ 2832 return (0); 2833 } 2834 if (action == SCTP_STREAM_RESET_PERFORMED) { 2835 resp = (struct sctp_stream_reset_response_tsn *)respin; 2836 asoc->stream_reset_outstanding--; 2837 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 2838 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 2839 fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1); 2840 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag); 2841 if (abort_flag) { 2842 return (1); 2843 } 2844 stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1); 2845 stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 2846 stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn); 2847 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 2848 stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn); 2849 stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn; 2850 2851 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL); 2852 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL); 2853 2854 } 2855 } 2856 /* get rid of the request and get the request flags */ 2857 if (asoc->stream_reset_outstanding == 0) { 2858 sctp_clean_up_stream_reset(stcb); 2859 } 2860 } 2861 } 2862 return (0); 2863} 2864 2865static void 2866sctp_handle_str_reset_request_in(struct sctp_tcb *stcb, 2867 struct sctp_tmit_chunk *chk, 2868 struct sctp_stream_reset_in_request *req) 2869{ 2870 uint32_t seq; 2871 int len, i; 2872 int number_entries; 2873 uint16_t temp; 2874 2875 /* 2876 * peer wants me to send a str-reset to him for my outgoing seq's if 2877 * seq_in is right. 2878 */ 2879 struct sctp_association *asoc = &stcb->asoc; 2880 2881 seq = ntohl(req->request_seq); 2882 if (asoc->str_reset_seq_in == seq) { 2883 if (stcb->asoc.stream_reset_out_is_outstanding == 0) { 2884 len = ntohs(req->ph.param_length); 2885 number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t)); 2886 for (i = 0; i < number_entries; i++) { 2887 temp = ntohs(req->list_of_streams[i]); 2888 req->list_of_streams[i] = temp; 2889 } 2890 /* move the reset action back one */ 2891 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 2892 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 2893 sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams, 2894 asoc->str_reset_seq_out, 2895 seq, (asoc->sending_seq - 1)); 2896 asoc->stream_reset_out_is_outstanding = 1; 2897 asoc->str_reset = chk; 2898 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 2899 stcb->asoc.stream_reset_outstanding++; 2900 } else { 2901 /* Can't do it, since we have sent one out */ 2902 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 2903 asoc->last_reset_action[0] = SCTP_STREAM_RESET_TRY_LATER; 2904 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 2905 } 2906 asoc->str_reset_seq_in++; 2907 } else if (asoc->str_reset_seq_in - 1 == seq) { 2908 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 2909 } else if (asoc->str_reset_seq_in - 2 == seq) { 2910 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 2911 } else { 2912 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 2913 } 2914} 2915 2916static int 2917sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb, 2918 struct sctp_tmit_chunk *chk, 2919 struct sctp_stream_reset_tsn_request *req) 2920{ 2921 /* reset all in and out and update the tsn */ 2922 /* 2923 * A) reset my str-seq's on in and out. B) Select a receive next, 2924 * and set cum-ack to it. Also process this selected number as a 2925 * fwd-tsn as well. C) set in the response my next sending seq. 2926 */ 2927 struct sctp_forward_tsn_chunk fwdtsn; 2928 struct sctp_association *asoc = &stcb->asoc; 2929 int abort_flag = 0; 2930 uint32_t seq; 2931 2932 seq = ntohl(req->request_seq); 2933 if (asoc->str_reset_seq_in == seq) { 2934 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk)); 2935 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN; 2936 fwdtsn.ch.chunk_flags = 0; 2937 fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1); 2938 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag); 2939 if (abort_flag) { 2940 return (1); 2941 } 2942 stcb->asoc.highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA; 2943 stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map; 2944 stcb->asoc.mapping_array_base_tsn = stcb->asoc.highest_tsn_inside_map + 1; 2945 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size); 2946 atomic_add_int(&stcb->asoc.sending_seq, 1); 2947 /* save off historical data for retrans */ 2948 stcb->asoc.last_sending_seq[1] = stcb->asoc.last_sending_seq[0]; 2949 stcb->asoc.last_sending_seq[0] = stcb->asoc.sending_seq; 2950 stcb->asoc.last_base_tsnsent[1] = stcb->asoc.last_base_tsnsent[0]; 2951 stcb->asoc.last_base_tsnsent[0] = stcb->asoc.mapping_array_base_tsn; 2952 2953 sctp_add_stream_reset_result_tsn(chk, 2954 ntohl(req->request_seq), 2955 SCTP_STREAM_RESET_PERFORMED, 2956 stcb->asoc.sending_seq, 2957 stcb->asoc.mapping_array_base_tsn); 2958 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL); 2959 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL); 2960 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0]; 2961 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 2962 2963 asoc->str_reset_seq_in++; 2964 } else if (asoc->str_reset_seq_in - 1 == seq) { 2965 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0], 2966 stcb->asoc.last_sending_seq[0], 2967 stcb->asoc.last_base_tsnsent[0] 2968 ); 2969 } else if (asoc->str_reset_seq_in - 2 == seq) { 2970 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1], 2971 stcb->asoc.last_sending_seq[1], 2972 stcb->asoc.last_base_tsnsent[1] 2973 ); 2974 } else { 2975 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 2976 } 2977 return (0); 2978} 2979 2980static void 2981sctp_handle_str_reset_request_out(struct sctp_tcb *stcb, 2982 struct sctp_tmit_chunk *chk, 2983 struct sctp_stream_reset_out_request *req) 2984{ 2985 uint32_t seq, tsn; 2986 int number_entries, len; 2987 struct sctp_association *asoc = &stcb->asoc; 2988 2989 seq = ntohl(req->request_seq); 2990 2991 /* now if its not a duplicate we process it */ 2992 if (asoc->str_reset_seq_in == seq) { 2993 len = ntohs(req->ph.param_length); 2994 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t)); 2995 /* 2996 * the sender is resetting, handle the list issue.. we must 2997 * a) verify if we can do the reset, if so no problem b) If 2998 * we can't do the reset we must copy the request. c) queue 2999 * it, and setup the data in processor to trigger it off 3000 * when needed and dequeue all the queued data. 3001 */ 3002 tsn = ntohl(req->send_reset_at_tsn); 3003 3004 /* move the reset action back one */ 3005 asoc->last_reset_action[1] = asoc->last_reset_action[0]; 3006 if ((tsn == asoc->cumulative_tsn) || 3007 (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN))) { 3008 /* we can do it now */ 3009 sctp_reset_in_stream(stcb, number_entries, req->list_of_streams); 3010 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED); 3011 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3012 } else { 3013 /* 3014 * we must queue it up and thus wait for the TSN's 3015 * to arrive that are at or before tsn 3016 */ 3017 struct sctp_stream_reset_list *liste; 3018 int siz; 3019 3020 siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t)); 3021 SCTP_MALLOC(liste, struct sctp_stream_reset_list *, 3022 siz, "StrRstList"); 3023 if (liste == NULL) { 3024 /* gak out of memory */ 3025 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED); 3026 asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED; 3027 return; 3028 } 3029 liste->tsn = tsn; 3030 liste->number_entries = number_entries; 3031 memcpy(&liste->req, req, 3032 (sizeof(struct sctp_stream_reset_out_request) + (number_entries * sizeof(uint16_t)))); 3033 TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp); 3034 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED); 3035 asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED; 3036 } 3037 asoc->str_reset_seq_in++; 3038 } else if ((asoc->str_reset_seq_in - 1) == seq) { 3039 /* 3040 * one seq back, just echo back last action since my 3041 * response was lost. 3042 */ 3043 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]); 3044 } else if ((asoc->str_reset_seq_in - 2) == seq) { 3045 /* 3046 * two seq back, just echo back last action since my 3047 * response was lost. 3048 */ 3049 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]); 3050 } else { 3051 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO); 3052 } 3053} 3054 3055static int 3056sctp_handle_stream_reset(struct sctp_tcb *stcb, struct sctp_stream_reset_out_req *sr_req) 3057{ 3058 int chk_length, param_len, ptype; 3059 uint32_t seq; 3060 int num_req = 0; 3061 struct sctp_tmit_chunk *chk; 3062 struct sctp_chunkhdr *ch; 3063 struct sctp_paramhdr *ph; 3064 3065 /* now it may be a reset or a reset-response */ 3066 chk_length = ntohs(sr_req->ch.chunk_length); 3067 int ret_code = 0; 3068 int num_param = 0; 3069 3070 /* setup for adding the response */ 3071 sctp_alloc_a_chunk(stcb, chk); 3072 if (chk == NULL) { 3073 return (ret_code); 3074 } 3075 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 3076 chk->asoc = &stcb->asoc; 3077 chk->no_fr_allowed = 0; 3078 chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr); 3079 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 3080 if (chk->data == NULL) { 3081strres_nochunk: 3082 if (chk->data) { 3083 sctp_m_freem(chk->data); 3084 chk->data = NULL; 3085 } 3086 sctp_free_a_chunk(stcb, chk); 3087 return (ret_code); 3088 } 3089 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 3090 3091 /* setup chunk parameters */ 3092 chk->sent = SCTP_DATAGRAM_UNSENT; 3093 chk->snd_count = 0; 3094 chk->whoTo = stcb->asoc.primary_destination; 3095 atomic_add_int(&chk->whoTo->ref_count, 1); 3096 3097 ch = mtod(chk->data, struct sctp_chunkhdr *); 3098 ch->chunk_type = SCTP_STREAM_RESET; 3099 ch->chunk_flags = 0; 3100 ch->chunk_length = htons(chk->send_size); 3101 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 3102 3103 3104 ph = (struct sctp_paramhdr *)&sr_req->sr_req; 3105 while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) { 3106 param_len = ntohs(ph->param_length); 3107 if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) { 3108 /* bad param */ 3109 break; 3110 } 3111 ptype = ntohs(ph->param_type); 3112 num_param++; 3113 if (num_param > SCTP_MAX_RESET_PARAMS) { 3114 /* hit the max of parameters already sorry.. */ 3115 break; 3116 } 3117 if (ptype == SCTP_STR_RESET_OUT_REQUEST) { 3118 struct sctp_stream_reset_out_request *req_out; 3119 3120 req_out = (struct sctp_stream_reset_out_request *)ph; 3121 num_req++; 3122 if (stcb->asoc.stream_reset_outstanding) { 3123 seq = ntohl(req_out->response_seq); 3124 if (seq == stcb->asoc.str_reset_seq_out) { 3125 /* implicit ack */ 3126 sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_PERFORMED, NULL); 3127 } 3128 } 3129 sctp_handle_str_reset_request_out(stcb, chk, req_out); 3130 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) { 3131 struct sctp_stream_reset_in_request *req_in; 3132 3133 num_req++; 3134 req_in = (struct sctp_stream_reset_in_request *)ph; 3135 sctp_handle_str_reset_request_in(stcb, chk, req_in); 3136 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) { 3137 struct sctp_stream_reset_tsn_request *req_tsn; 3138 3139 num_req++; 3140 req_tsn = (struct sctp_stream_reset_tsn_request *)ph; 3141 if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) { 3142 ret_code = 1; 3143 goto strres_nochunk; 3144 } 3145 /* no more */ 3146 break; 3147 } else if (ptype == SCTP_STR_RESET_RESPONSE) { 3148 struct sctp_stream_reset_response *resp; 3149 uint32_t result; 3150 3151 resp = (struct sctp_stream_reset_response *)ph; 3152 seq = ntohl(resp->response_seq); 3153 result = ntohl(resp->result); 3154 if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) { 3155 ret_code = 1; 3156 goto strres_nochunk; 3157 } 3158 } else { 3159 break; 3160 } 3161 3162 ph = (struct sctp_paramhdr *)((caddr_t)ph + SCTP_SIZE32(param_len)); 3163 chk_length -= SCTP_SIZE32(param_len); 3164 } 3165 if (num_req == 0) { 3166 /* we have no response free the stuff */ 3167 goto strres_nochunk; 3168 } 3169 /* ok we have a chunk to link in */ 3170 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, 3171 chk, 3172 sctp_next); 3173 stcb->asoc.ctrl_queue_cnt++; 3174 return (ret_code); 3175} 3176 3177/* 3178 * Handle a router or endpoints report of a packet loss, there are two ways 3179 * to handle this, either we get the whole packet and must disect it 3180 * ourselves (possibly with truncation and or corruption) or it is a summary 3181 * from a middle box that did the disectting for us. 3182 */ 3183static void 3184sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp, 3185 struct sctp_tcb *stcb, struct sctp_nets *net) 3186{ 3187 uint32_t bottle_bw, on_queue; 3188 uint16_t trunc_len; 3189 unsigned int chlen; 3190 unsigned int at; 3191 struct sctp_chunk_desc desc; 3192 struct sctp_chunkhdr *ch; 3193 3194 chlen = ntohs(cp->ch.chunk_length); 3195 chlen -= sizeof(struct sctp_pktdrop_chunk); 3196 /* XXX possible chlen underflow */ 3197 if (chlen == 0) { 3198 ch = NULL; 3199 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) 3200 SCTP_STAT_INCR(sctps_pdrpbwrpt); 3201 } else { 3202 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr)); 3203 chlen -= sizeof(struct sctphdr); 3204 /* XXX possible chlen underflow */ 3205 memset(&desc, 0, sizeof(desc)); 3206 } 3207 trunc_len = (uint16_t) ntohs(cp->trunc_len); 3208 /* now the chunks themselves */ 3209 while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) { 3210 desc.chunk_type = ch->chunk_type; 3211 /* get amount we need to move */ 3212 at = ntohs(ch->chunk_length); 3213 if (at < sizeof(struct sctp_chunkhdr)) { 3214 /* corrupt chunk, maybe at the end? */ 3215 SCTP_STAT_INCR(sctps_pdrpcrupt); 3216 break; 3217 } 3218 if (trunc_len == 0) { 3219 /* we are supposed to have all of it */ 3220 if (at > chlen) { 3221 /* corrupt skip it */ 3222 SCTP_STAT_INCR(sctps_pdrpcrupt); 3223 break; 3224 } 3225 } else { 3226 /* is there enough of it left ? */ 3227 if (desc.chunk_type == SCTP_DATA) { 3228 if (chlen < (sizeof(struct sctp_data_chunk) + 3229 sizeof(desc.data_bytes))) { 3230 break; 3231 } 3232 } else { 3233 if (chlen < sizeof(struct sctp_chunkhdr)) { 3234 break; 3235 } 3236 } 3237 } 3238 if (desc.chunk_type == SCTP_DATA) { 3239 /* can we get out the tsn? */ 3240 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 3241 SCTP_STAT_INCR(sctps_pdrpmbda); 3242 3243 if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) { 3244 /* yep */ 3245 struct sctp_data_chunk *dcp; 3246 uint8_t *ddp; 3247 unsigned int iii; 3248 3249 dcp = (struct sctp_data_chunk *)ch; 3250 ddp = (uint8_t *) (dcp + 1); 3251 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) { 3252 desc.data_bytes[iii] = ddp[iii]; 3253 } 3254 desc.tsn_ifany = dcp->dp.tsn; 3255 } else { 3256 /* nope we are done. */ 3257 SCTP_STAT_INCR(sctps_pdrpnedat); 3258 break; 3259 } 3260 } else { 3261 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 3262 SCTP_STAT_INCR(sctps_pdrpmbct); 3263 } 3264 3265 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) { 3266 SCTP_STAT_INCR(sctps_pdrppdbrk); 3267 break; 3268 } 3269 if (SCTP_SIZE32(at) > chlen) { 3270 break; 3271 } 3272 chlen -= SCTP_SIZE32(at); 3273 if (chlen < sizeof(struct sctp_chunkhdr)) { 3274 /* done, none left */ 3275 break; 3276 } 3277 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at)); 3278 } 3279 /* Now update any rwnd --- possibly */ 3280 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) { 3281 /* From a peer, we get a rwnd report */ 3282 uint32_t a_rwnd; 3283 3284 SCTP_STAT_INCR(sctps_pdrpfehos); 3285 3286 bottle_bw = ntohl(cp->bottle_bw); 3287 on_queue = ntohl(cp->current_onq); 3288 if (bottle_bw && on_queue) { 3289 /* a rwnd report is in here */ 3290 if (bottle_bw > on_queue) 3291 a_rwnd = bottle_bw - on_queue; 3292 else 3293 a_rwnd = 0; 3294 3295 if (a_rwnd == 0) 3296 stcb->asoc.peers_rwnd = 0; 3297 else { 3298 if (a_rwnd > stcb->asoc.total_flight) { 3299 stcb->asoc.peers_rwnd = 3300 a_rwnd - stcb->asoc.total_flight; 3301 } else { 3302 stcb->asoc.peers_rwnd = 0; 3303 } 3304 if (stcb->asoc.peers_rwnd < 3305 stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 3306 /* SWS sender side engages */ 3307 stcb->asoc.peers_rwnd = 0; 3308 } 3309 } 3310 } 3311 } else { 3312 SCTP_STAT_INCR(sctps_pdrpfmbox); 3313 } 3314 3315 /* now middle boxes in sat networks get a cwnd bump */ 3316 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) && 3317 (stcb->asoc.sat_t3_loss_recovery == 0) && 3318 (stcb->asoc.sat_network)) { 3319 /* 3320 * This is debateable but for sat networks it makes sense 3321 * Note if a T3 timer has went off, we will prohibit any 3322 * changes to cwnd until we exit the t3 loss recovery. 3323 */ 3324 uint32_t bw_avail; 3325 int rtt, incr; 3326 3327#ifdef SCTP_CWND_MONITOR 3328 int old_cwnd = net->cwnd; 3329 3330#endif 3331 /* need real RTT for this calc */ 3332 rtt = ((net->lastsa >> 2) + net->lastsv) >> 1; 3333 /* get bottle neck bw */ 3334 bottle_bw = ntohl(cp->bottle_bw); 3335 /* and whats on queue */ 3336 on_queue = ntohl(cp->current_onq); 3337 /* 3338 * adjust the on-queue if our flight is more it could be 3339 * that the router has not yet gotten data "in-flight" to it 3340 */ 3341 if (on_queue < net->flight_size) 3342 on_queue = net->flight_size; 3343 3344 /* calculate the available space */ 3345 bw_avail = (bottle_bw * rtt) / 1000; 3346 if (bw_avail > bottle_bw) { 3347 /* 3348 * Cap the growth to no more than the bottle neck. 3349 * This can happen as RTT slides up due to queues. 3350 * It also means if you have more than a 1 second 3351 * RTT with a empty queue you will be limited to the 3352 * bottle_bw per second no matter if other points 3353 * have 1/2 the RTT and you could get more out... 3354 */ 3355 bw_avail = bottle_bw; 3356 } 3357 if (on_queue > bw_avail) { 3358 /* 3359 * No room for anything else don't allow anything 3360 * else to be "added to the fire". 3361 */ 3362 int seg_inflight, seg_onqueue, my_portion; 3363 3364 net->partial_bytes_acked = 0; 3365 3366 /* how much are we over queue size? */ 3367 incr = on_queue - bw_avail; 3368 if (stcb->asoc.seen_a_sack_this_pkt) { 3369 /* 3370 * undo any cwnd adjustment that the sack 3371 * might have made 3372 */ 3373 net->cwnd = net->prev_cwnd; 3374 } 3375 /* Now how much of that is mine? */ 3376 seg_inflight = net->flight_size / net->mtu; 3377 seg_onqueue = on_queue / net->mtu; 3378 my_portion = (incr * seg_inflight) / seg_onqueue; 3379 3380 /* Have I made an adjustment already */ 3381 if (net->cwnd > net->flight_size) { 3382 /* 3383 * for this flight I made an adjustment we 3384 * need to decrease the portion by a share 3385 * our previous adjustment. 3386 */ 3387 int diff_adj; 3388 3389 diff_adj = net->cwnd - net->flight_size; 3390 if (diff_adj > my_portion) 3391 my_portion = 0; 3392 else 3393 my_portion -= diff_adj; 3394 } 3395 /* 3396 * back down to the previous cwnd (assume we have 3397 * had a sack before this packet). minus what ever 3398 * portion of the overage is my fault. 3399 */ 3400 net->cwnd -= my_portion; 3401 3402 /* we will NOT back down more than 1 MTU */ 3403 if (net->cwnd <= net->mtu) { 3404 net->cwnd = net->mtu; 3405 } 3406 /* force into CA */ 3407 net->ssthresh = net->cwnd - 1; 3408 } else { 3409 /* 3410 * Take 1/4 of the space left or max burst up .. 3411 * whichever is less. 3412 */ 3413 incr = min((bw_avail - on_queue) >> 2, 3414 (int)stcb->asoc.max_burst * (int)net->mtu); 3415 net->cwnd += incr; 3416 } 3417 if (net->cwnd > bw_avail) { 3418 /* We can't exceed the pipe size */ 3419 net->cwnd = bw_avail; 3420 } 3421 if (net->cwnd < net->mtu) { 3422 /* We always have 1 MTU */ 3423 net->cwnd = net->mtu; 3424 } 3425#ifdef SCTP_CWND_MONITOR 3426 if (net->cwnd - old_cwnd != 0) { 3427 /* log only changes */ 3428 sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), 3429 SCTP_CWND_LOG_FROM_SAT); 3430 } 3431#endif 3432 } 3433} 3434 3435extern int sctp_strict_init; 3436extern int sctp_abort_if_one_2_one_hits_limit; 3437 3438/* 3439 * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to 3440 * still contain IP/SCTP header - stcb: is the tcb found for this packet - 3441 * offset: offset into the mbuf chain to first chunkhdr - length: is the 3442 * length of the complete packet outputs: - length: modified to remaining 3443 * length after control processing - netp: modified to new sctp_nets after 3444 * cookie-echo processing - return NULL to discard the packet (ie. no asoc, 3445 * bad packet,...) otherwise return the tcb for this packet 3446 */ 3447static struct sctp_tcb * 3448sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length, 3449 struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp, 3450 struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen) 3451{ 3452 struct sctp_association *asoc; 3453 uint32_t vtag_in; 3454 int num_chunks = 0; /* number of control chunks processed */ 3455 int chk_length; 3456 int ret; 3457 3458 /* 3459 * How big should this be, and should it be alloc'd? Lets try the 3460 * d-mtu-ceiling for now (2k) and that should hopefully work ... 3461 * until we get into jumbo grams and such.. 3462 */ 3463 uint8_t chunk_buf[DEFAULT_CHUNK_BUFFER]; 3464 struct sctp_tcb *locked_tcb = stcb; 3465 int got_auth = 0; 3466 uint32_t auth_offset = 0, auth_len = 0; 3467 int auth_skipped = 0; 3468 3469#ifdef SCTP_DEBUG 3470 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 3471 printf("sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n", 3472 iphlen, *offset, length, stcb); 3473 } 3474#endif /* SCTP_DEBUG */ 3475 3476 /* validate chunk header length... */ 3477 if (ntohs(ch->chunk_length) < sizeof(*ch)) { 3478 return (NULL); 3479 } 3480 /* 3481 * validate the verification tag 3482 */ 3483 vtag_in = ntohl(sh->v_tag); 3484 3485 if (locked_tcb) { 3486 SCTP_TCB_LOCK_ASSERT(locked_tcb); 3487 } 3488 if (ch->chunk_type == SCTP_INITIATION) { 3489 if (vtag_in != 0) { 3490 /* protocol error- silently discard... */ 3491 SCTP_STAT_INCR(sctps_badvtag); 3492 if (locked_tcb) 3493 SCTP_TCB_UNLOCK(locked_tcb); 3494 return (NULL); 3495 } 3496 } else if (ch->chunk_type != SCTP_COOKIE_ECHO) { 3497 /* 3498 * If there is no stcb, skip the AUTH chunk and process 3499 * later after a stcb is found (to validate the lookup was 3500 * valid. 3501 */ 3502 if ((ch->chunk_type == SCTP_AUTHENTICATION) && 3503 (stcb == NULL) && !sctp_auth_disable) { 3504 /* save this chunk for later processing */ 3505 auth_skipped = 1; 3506 auth_offset = *offset; 3507 auth_len = ntohs(ch->chunk_length); 3508 3509 /* (temporarily) move past this chunk */ 3510 *offset += SCTP_SIZE32(auth_len); 3511 if (*offset >= length) { 3512 /* no more data left in the mbuf chain */ 3513 *offset = length; 3514 return (NULL); 3515 } 3516 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3517 sizeof(struct sctp_chunkhdr), chunk_buf); 3518 } 3519 if (ch->chunk_type == SCTP_COOKIE_ECHO) { 3520 goto process_control_chunks; 3521 } 3522 /* 3523 * first check if it's an ASCONF with an unknown src addr we 3524 * need to look inside to find the association 3525 */ 3526 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) { 3527 /* inp's refcount may be reduced */ 3528 SCTP_INP_INCR_REF(inp); 3529 3530 stcb = sctp_findassociation_ep_asconf(m, iphlen, 3531 *offset, sh, &inp, netp); 3532 if (stcb == NULL) { 3533 /* 3534 * reduce inp's refcount if not reduced in 3535 * sctp_findassociation_ep_asconf(). 3536 */ 3537 SCTP_INP_DECR_REF(inp); 3538 } 3539 /* now go back and verify any auth chunk to be sure */ 3540 if (auth_skipped && (stcb != NULL)) { 3541 struct sctp_auth_chunk *auth; 3542 3543 auth = (struct sctp_auth_chunk *) 3544 sctp_m_getptr(m, auth_offset, 3545 auth_len, chunk_buf); 3546 got_auth = 1; 3547 auth_skipped = 0; 3548 if (sctp_handle_auth(stcb, auth, m, 3549 auth_offset)) { 3550 /* auth HMAC failed so dump it */ 3551 *offset = length; 3552 return (NULL); 3553 } else { 3554 /* remaining chunks are HMAC checked */ 3555 stcb->asoc.authenticated = 1; 3556 } 3557 } 3558 } 3559 if (stcb == NULL) { 3560 /* no association, so it's out of the blue... */ 3561 sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL); 3562 *offset = length; 3563 if (locked_tcb) 3564 SCTP_TCB_UNLOCK(locked_tcb); 3565 return (NULL); 3566 } 3567 asoc = &stcb->asoc; 3568 /* ABORT and SHUTDOWN can use either v_tag... */ 3569 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) || 3570 (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) || 3571 (ch->chunk_type == SCTP_PACKET_DROPPED)) { 3572 if ((vtag_in == asoc->my_vtag) || 3573 ((ch->chunk_flags & SCTP_HAD_NO_TCB) && 3574 (vtag_in == asoc->peer_vtag))) { 3575 /* this is valid */ 3576 } else { 3577 /* drop this packet... */ 3578 SCTP_STAT_INCR(sctps_badvtag); 3579 if (locked_tcb) 3580 SCTP_TCB_UNLOCK(locked_tcb); 3581 return (NULL); 3582 } 3583 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 3584 if (vtag_in != asoc->my_vtag) { 3585 /* 3586 * this could be a stale SHUTDOWN-ACK or the 3587 * peer never got the SHUTDOWN-COMPLETE and 3588 * is still hung; we have started a new asoc 3589 * but it won't complete until the shutdown 3590 * is completed 3591 */ 3592 if (locked_tcb) 3593 SCTP_TCB_UNLOCK(locked_tcb); 3594 sctp_handle_ootb(m, iphlen, *offset, sh, inp, 3595 NULL); 3596 return (NULL); 3597 } 3598 } else { 3599 /* for all other chunks, vtag must match */ 3600 if (vtag_in != asoc->my_vtag) { 3601 /* invalid vtag... */ 3602#ifdef SCTP_DEBUG 3603 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3604 printf("invalid vtag: %xh, expect %xh\n", vtag_in, asoc->my_vtag); 3605 } 3606#endif /* SCTP_DEBUG */ 3607 SCTP_STAT_INCR(sctps_badvtag); 3608 if (locked_tcb) 3609 SCTP_TCB_UNLOCK(locked_tcb); 3610 *offset = length; 3611 return (NULL); 3612 } 3613 } 3614 } /* end if !SCTP_COOKIE_ECHO */ 3615 /* 3616 * process all control chunks... 3617 */ 3618 if (((ch->chunk_type == SCTP_SELECTIVE_ACK) || 3619 (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) && 3620 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 3621 /* implied cookie-ack.. we must have lost the ack */ 3622 stcb->asoc.overall_error_count = 0; 3623 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, 3624 *netp); 3625 } 3626process_control_chunks: 3627 3628 while (IS_SCTP_CONTROL(ch)) { 3629 /* validate chunk length */ 3630 chk_length = ntohs(ch->chunk_length); 3631#ifdef SCTP_DEBUG 3632 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 3633 printf("sctp_process_control: processing a chunk type=%u, len=%u\n", 3634 ch->chunk_type, chk_length); 3635 } 3636#endif /* SCTP_DEBUG */ 3637 if ((size_t)chk_length < sizeof(*ch) || 3638 (*offset + chk_length) > length) { 3639 *offset = length; 3640 if (locked_tcb) 3641 SCTP_TCB_UNLOCK(locked_tcb); 3642 return (NULL); 3643 } 3644 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks); 3645 /* 3646 * INIT-ACK only gets the init ack "header" portion only 3647 * because we don't have to process the peer's COOKIE. All 3648 * others get a complete chunk. 3649 */ 3650 if (ch->chunk_type == SCTP_INITIATION_ACK) { 3651 /* get an init-ack chunk */ 3652 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3653 sizeof(struct sctp_init_ack_chunk), chunk_buf); 3654 if (ch == NULL) { 3655 *offset = length; 3656 if (locked_tcb) 3657 SCTP_TCB_UNLOCK(locked_tcb); 3658 return (NULL); 3659 } 3660 } else { 3661 /* get a complete chunk... */ 3662 if ((size_t)chk_length > sizeof(chunk_buf)) { 3663 struct mbuf *oper; 3664 struct sctp_paramhdr *phdr; 3665 3666 oper = NULL; 3667 oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 3668 0, M_DONTWAIT, 1, MT_DATA); 3669 if (oper) { 3670 /* pre-reserve some space */ 3671 SCTP_BUF_RESV_UF(oper, sizeof(struct sctp_chunkhdr)); 3672 SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr); 3673 phdr = mtod(oper, struct sctp_paramhdr *); 3674 phdr->param_type = htons(SCTP_CAUSE_OUT_OF_RESC); 3675 phdr->param_length = htons(sizeof(struct sctp_paramhdr)); 3676 sctp_queue_op_err(stcb, oper); 3677 } 3678 if (locked_tcb) 3679 SCTP_TCB_UNLOCK(locked_tcb); 3680 return (NULL); 3681 } 3682 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3683 chk_length, chunk_buf); 3684 if (ch == NULL) { 3685 printf("sctp_process_control: Can't get the all data....\n"); 3686 *offset = length; 3687 if (locked_tcb) 3688 SCTP_TCB_UNLOCK(locked_tcb); 3689 return (NULL); 3690 } 3691 } 3692 num_chunks++; 3693 /* Save off the last place we got a control from */ 3694 if (stcb != NULL) { 3695 if ((*netp != NULL) || (ch->chunk_type == SCTP_ASCONF)) { 3696 /* 3697 * allow last_control to be NULL if 3698 * ASCONF... ASCONF processing will find the 3699 * right net later 3700 */ 3701 stcb->asoc.last_control_chunk_from = *netp; 3702 } 3703 } 3704#ifdef SCTP_AUDITING_ENABLED 3705 sctp_audit_log(0xB0, ch->chunk_type); 3706#endif 3707 3708 /* check to see if this chunk required auth, but isn't */ 3709 if ((stcb != NULL) && !sctp_auth_disable && 3710 sctp_auth_is_required_chunk(ch->chunk_type, 3711 stcb->asoc.local_auth_chunks) && 3712 !stcb->asoc.authenticated) { 3713 /* "silently" ignore */ 3714 SCTP_STAT_INCR(sctps_recvauthmissing); 3715 goto next_chunk; 3716 } 3717 switch (ch->chunk_type) { 3718 case SCTP_INITIATION: 3719 /* must be first and only chunk */ 3720#ifdef SCTP_DEBUG 3721 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3722 printf("SCTP_INIT\n"); 3723 } 3724#endif /* SCTP_DEBUG */ 3725 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3726 /* We are not interested anymore? */ 3727 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3728 /* 3729 * collision case where we are 3730 * sending to them too 3731 */ 3732 ; 3733 } else { 3734 if (locked_tcb) 3735 SCTP_TCB_UNLOCK(locked_tcb); 3736 *offset = length; 3737 return (NULL); 3738 } 3739 } 3740 if ((num_chunks > 1) || 3741 (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3742 *offset = length; 3743 if (locked_tcb) 3744 SCTP_TCB_UNLOCK(locked_tcb); 3745 return (NULL); 3746 } 3747 if ((stcb != NULL) && 3748 (SCTP_GET_STATE(&stcb->asoc) == 3749 SCTP_STATE_SHUTDOWN_ACK_SENT)) { 3750 sctp_send_shutdown_ack(stcb, 3751 stcb->asoc.primary_destination); 3752 *offset = length; 3753 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 3754 if (locked_tcb) 3755 SCTP_TCB_UNLOCK(locked_tcb); 3756 return (NULL); 3757 } 3758 sctp_handle_init(m, iphlen, *offset, sh, 3759 (struct sctp_init_chunk *)ch, inp, stcb, *netp); 3760 *offset = length; 3761 if (locked_tcb) 3762 SCTP_TCB_UNLOCK(locked_tcb); 3763 return (NULL); 3764 break; 3765 case SCTP_INITIATION_ACK: 3766 /* must be first and only chunk */ 3767#ifdef SCTP_DEBUG 3768 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3769 printf("SCTP_INIT-ACK\n"); 3770 } 3771#endif /* SCTP_DEBUG */ 3772 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3773 /* We are not interested anymore */ 3774 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3775 ; 3776 } else { 3777 if (locked_tcb) 3778 SCTP_TCB_UNLOCK(locked_tcb); 3779 *offset = length; 3780 if (stcb) { 3781 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26); 3782 } 3783 return (NULL); 3784 } 3785 } 3786 if ((num_chunks > 1) || 3787 (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3788 *offset = length; 3789 if (locked_tcb) 3790 SCTP_TCB_UNLOCK(locked_tcb); 3791 return (NULL); 3792 } 3793 ret = sctp_handle_init_ack(m, iphlen, *offset, sh, 3794 (struct sctp_init_ack_chunk *)ch, stcb, *netp); 3795 /* 3796 * Special case, I must call the output routine to 3797 * get the cookie echoed 3798 */ 3799 if ((stcb) && ret == 0) 3800 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 3801 *offset = length; 3802 if (locked_tcb) 3803 SCTP_TCB_UNLOCK(locked_tcb); 3804 return (NULL); 3805 break; 3806 case SCTP_SELECTIVE_ACK: 3807#ifdef SCTP_DEBUG 3808 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3809 printf("SCTP_SACK\n"); 3810 } 3811#endif /* SCTP_DEBUG */ 3812 SCTP_STAT_INCR(sctps_recvsacks); 3813 { 3814 struct sctp_sack_chunk *sack; 3815 int abort_now = 0; 3816 uint32_t a_rwnd, cum_ack; 3817 uint16_t num_seg; 3818 int nonce_sum_flag; 3819 3820 sack = (struct sctp_sack_chunk *)ch; 3821 3822 nonce_sum_flag = ch->chunk_flags & SCTP_SACK_NONCE_SUM; 3823 cum_ack = ntohl(sack->sack.cum_tsn_ack); 3824 num_seg = ntohs(sack->sack.num_gap_ack_blks); 3825 a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd); 3826 stcb->asoc.seen_a_sack_this_pkt = 1; 3827 if ((stcb->asoc.pr_sctp_cnt == 0) && 3828 (num_seg == 0) && 3829 ((compare_with_wrap(cum_ack, stcb->asoc.last_acked_seq, MAX_TSN)) || 3830 (cum_ack == stcb->asoc.last_acked_seq)) && 3831 (stcb->asoc.saw_sack_with_frags == 0) && 3832 (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) 3833 ) { 3834 /* 3835 * We have a SIMPLE sack having no 3836 * prior segments and data on sent 3837 * queue to be acked.. Use the 3838 * faster path sack processing. We 3839 * also allow window update sacks 3840 * with no missing segments to go 3841 * this way too. 3842 */ 3843 sctp_express_handle_sack(stcb, cum_ack, a_rwnd, nonce_sum_flag, &abort_now); 3844 } else { 3845 sctp_handle_sack(sack, stcb, *netp, &abort_now); 3846 } 3847 if (abort_now) { 3848 /* ABORT signal from sack processing */ 3849 *offset = length; 3850 return (NULL); 3851 } 3852 } 3853 break; 3854 case SCTP_HEARTBEAT_REQUEST: 3855#ifdef SCTP_DEBUG 3856 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3857 printf("SCTP_HEARTBEAT\n"); 3858 } 3859#endif /* SCTP_DEBUG */ 3860 SCTP_STAT_INCR(sctps_recvheartbeat); 3861 sctp_send_heartbeat_ack(stcb, m, *offset, chk_length, 3862 *netp); 3863 3864 /* He's alive so give him credit */ 3865 stcb->asoc.overall_error_count = 0; 3866 break; 3867 case SCTP_HEARTBEAT_ACK: 3868#ifdef SCTP_DEBUG 3869 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3870 printf("SCTP_HEARTBEAT-ACK\n"); 3871 } 3872#endif /* SCTP_DEBUG */ 3873 3874 /* He's alive so give him credit */ 3875 stcb->asoc.overall_error_count = 0; 3876 SCTP_STAT_INCR(sctps_recvheartbeatack); 3877 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch, 3878 stcb, *netp); 3879 break; 3880 case SCTP_ABORT_ASSOCIATION: 3881#ifdef SCTP_DEBUG 3882 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3883 printf("SCTP_ABORT\n"); 3884 } 3885#endif /* SCTP_DEBUG */ 3886 sctp_handle_abort((struct sctp_abort_chunk *)ch, 3887 stcb, *netp); 3888 *offset = length; 3889 return (NULL); 3890 break; 3891 case SCTP_SHUTDOWN: 3892#ifdef SCTP_DEBUG 3893 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3894 printf("SCTP_SHUTDOWN\n"); 3895 } 3896#endif /* SCTP_DEBUG */ 3897 { 3898 int abort_flag = 0; 3899 3900 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch, 3901 stcb, *netp, &abort_flag); 3902 if (abort_flag) { 3903 *offset = length; 3904 return (NULL); 3905 } 3906 } 3907 break; 3908 case SCTP_SHUTDOWN_ACK: 3909#ifdef SCTP_DEBUG 3910 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3911 printf("SCTP_SHUTDOWN-ACK\n"); 3912 } 3913#endif /* SCTP_DEBUG */ 3914 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp); 3915 *offset = length; 3916 return (NULL); 3917 break; 3918 case SCTP_OPERATION_ERROR: 3919#ifdef SCTP_DEBUG 3920 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3921 printf("SCTP_OP-ERR\n"); 3922 } 3923#endif /* SCTP_DEBUG */ 3924 if (sctp_handle_error(ch, stcb, *netp) < 0) { 3925 *offset = length; 3926 return (NULL); 3927 } 3928 break; 3929 case SCTP_COOKIE_ECHO: 3930#ifdef SCTP_DEBUG 3931 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3932 printf("SCTP_COOKIE-ECHO stcb is %p\n", stcb); 3933 } 3934#endif /* SCTP_DEBUG */ 3935 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 3936 ; 3937 } else { 3938 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) && 3939 (stcb == NULL)) { 3940 /* We are not interested anymore */ 3941 *offset = length; 3942 return (NULL); 3943 } 3944 } 3945 /* 3946 * First are we accepting? We do this again here 3947 * since it is possible that a previous endpoint WAS 3948 * listening responded to a INIT-ACK and then 3949 * closed. We opened and bound.. and are now no 3950 * longer listening. 3951 */ 3952 if (inp->sctp_socket->so_qlimit == 0) { 3953 if ((stcb) && (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 3954 /* 3955 * special case, is this a retran'd 3956 * COOKIE-ECHO or a restarting assoc 3957 * that is a peeled off or 3958 * one-to-one style socket. 3959 */ 3960 goto process_cookie_anyway; 3961 } 3962 sctp_abort_association(inp, stcb, m, iphlen, sh, 3963 NULL); 3964 *offset = length; 3965 return (NULL); 3966 } else if (inp->sctp_socket->so_qlimit) { 3967 /* we are accepting so check limits like TCP */ 3968 if (inp->sctp_socket->so_qlen > 3969 inp->sctp_socket->so_qlimit) { 3970 /* no space */ 3971 struct mbuf *oper; 3972 struct sctp_paramhdr *phdr; 3973 3974 if (sctp_abort_if_one_2_one_hits_limit) { 3975 oper = NULL; 3976 oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 3977 0, M_DONTWAIT, 1, MT_DATA); 3978 if (oper) { 3979 SCTP_BUF_LEN(oper) = 3980 sizeof(struct sctp_paramhdr); 3981 phdr = mtod(oper, 3982 struct sctp_paramhdr *); 3983 phdr->param_type = 3984 htons(SCTP_CAUSE_OUT_OF_RESC); 3985 phdr->param_length = 3986 htons(sizeof(struct sctp_paramhdr)); 3987 } 3988 sctp_abort_association(inp, stcb, m, 3989 iphlen, sh, oper); 3990 } 3991 *offset = length; 3992 return (NULL); 3993 } 3994 } 3995 process_cookie_anyway: 3996 { 3997 struct mbuf *ret_buf; 3998 struct sctp_inpcb *linp; 3999 4000 if (stcb) 4001 linp = NULL; 4002 else 4003 linp = inp; 4004 4005 if (linp) 4006 SCTP_ASOC_CREATE_LOCK(linp); 4007 ret_buf = 4008 sctp_handle_cookie_echo(m, iphlen, 4009 *offset, sh, 4010 (struct sctp_cookie_echo_chunk *)ch, 4011 &inp, &stcb, netp, 4012 auth_skipped, 4013 auth_offset, 4014 auth_len, 4015 &locked_tcb); 4016 if (linp) 4017 SCTP_ASOC_CREATE_UNLOCK(linp); 4018 if (ret_buf == NULL) { 4019 if (locked_tcb) { 4020 SCTP_TCB_UNLOCK(locked_tcb); 4021 } 4022#ifdef SCTP_DEBUG 4023 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4024 printf("GAK, null buffer\n"); 4025 } 4026#endif /* SCTP_DEBUG */ 4027 auth_skipped = 0; 4028 *offset = length; 4029 return (NULL); 4030 } 4031 /* if AUTH skipped, see if it verified... */ 4032 if (auth_skipped) { 4033 got_auth = 1; 4034 auth_skipped = 0; 4035 } 4036 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) { 4037 /* 4038 * Restart the timer if we have 4039 * pending data 4040 */ 4041 struct sctp_tmit_chunk *chk; 4042 4043 chk = TAILQ_FIRST(&stcb->asoc.sent_queue); 4044 if (chk) { 4045 sctp_timer_start(SCTP_TIMER_TYPE_SEND, 4046 stcb->sctp_ep, stcb, 4047 chk->whoTo); 4048 } 4049 } 4050 } 4051 break; 4052 case SCTP_COOKIE_ACK: 4053#ifdef SCTP_DEBUG 4054 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4055 printf("SCTP_COOKIE-ACK\n"); 4056 } 4057#endif /* SCTP_DEBUG */ 4058 4059 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4060 /* We are not interested anymore */ 4061 if ((stcb) && (stcb->asoc.total_output_queue_size)) { 4062 ; 4063 } else { 4064 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27); 4065 *offset = length; 4066 return (NULL); 4067 } 4068 } 4069 /* He's alive so give him credit */ 4070 stcb->asoc.overall_error_count = 0; 4071 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp); 4072 break; 4073 case SCTP_ECN_ECHO: 4074#ifdef SCTP_DEBUG 4075 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4076 printf("SCTP_ECN-ECHO\n"); 4077 } 4078#endif /* SCTP_DEBUG */ 4079 /* He's alive so give him credit */ 4080 stcb->asoc.overall_error_count = 0; 4081 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, 4082 stcb); 4083 break; 4084 case SCTP_ECN_CWR: 4085#ifdef SCTP_DEBUG 4086 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4087 printf("SCTP_ECN-CWR\n"); 4088 } 4089#endif /* SCTP_DEBUG */ 4090 /* He's alive so give him credit */ 4091 stcb->asoc.overall_error_count = 0; 4092 4093 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb); 4094 break; 4095 case SCTP_SHUTDOWN_COMPLETE: 4096#ifdef SCTP_DEBUG 4097 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4098 printf("SCTP_SHUTDOWN-COMPLETE\n"); 4099 } 4100#endif /* SCTP_DEBUG */ 4101 /* must be first and only chunk */ 4102 if ((num_chunks > 1) || 4103 (length - *offset > SCTP_SIZE32(chk_length))) { 4104 *offset = length; 4105 if (locked_tcb) 4106 SCTP_TCB_UNLOCK(locked_tcb); 4107 4108 return (NULL); 4109 } 4110 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch, 4111 stcb, *netp); 4112 *offset = length; 4113 return (NULL); 4114 break; 4115 case SCTP_ASCONF: 4116#ifdef SCTP_DEBUG 4117 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4118 printf("SCTP_ASCONF\n"); 4119 } 4120#endif /* SCTP_DEBUG */ 4121 /* He's alive so give him credit */ 4122 stcb->asoc.overall_error_count = 0; 4123 4124 sctp_handle_asconf(m, *offset, 4125 (struct sctp_asconf_chunk *)ch, stcb); 4126 break; 4127 case SCTP_ASCONF_ACK: 4128#ifdef SCTP_DEBUG 4129 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4130 printf("SCTP_ASCONF-ACK\n"); 4131 } 4132#endif /* SCTP_DEBUG */ 4133 /* He's alive so give him credit */ 4134 stcb->asoc.overall_error_count = 0; 4135 4136 sctp_handle_asconf_ack(m, *offset, 4137 (struct sctp_asconf_ack_chunk *)ch, stcb, *netp); 4138 break; 4139 case SCTP_FORWARD_CUM_TSN: 4140#ifdef SCTP_DEBUG 4141 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4142 printf("SCTP_FWD-TSN\n"); 4143 } 4144#endif /* SCTP_DEBUG */ 4145 /* He's alive so give him credit */ 4146 { 4147 int abort_flag = 0; 4148 4149 stcb->asoc.overall_error_count = 0; 4150 *fwd_tsn_seen = 1; 4151 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4152 /* We are not interested anymore */ 4153 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28); 4154 *offset = length; 4155 return (NULL); 4156 } 4157 sctp_handle_forward_tsn(stcb, 4158 (struct sctp_forward_tsn_chunk *)ch, &abort_flag); 4159 if (abort_flag) { 4160 *offset = length; 4161 return (NULL); 4162 } else { 4163 stcb->asoc.overall_error_count = 0; 4164 } 4165 4166 } 4167 break; 4168 case SCTP_STREAM_RESET: 4169#ifdef SCTP_DEBUG 4170 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4171 printf("SCTP_STREAM_RESET\n"); 4172 } 4173#endif /* SCTP_DEBUG */ 4174 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4175 chk_length, chunk_buf); 4176 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 4177 /* We are not interested anymore */ 4178 sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29); 4179 *offset = length; 4180 return (NULL); 4181 } 4182 if (stcb->asoc.peer_supports_strreset == 0) { 4183 /* 4184 * hmm, peer should have announced this, but 4185 * we will turn it on since he is sending us 4186 * a stream reset. 4187 */ 4188 stcb->asoc.peer_supports_strreset = 1; 4189 } 4190 if (sctp_handle_stream_reset(stcb, (struct sctp_stream_reset_out_req *)ch)) { 4191 /* stop processing */ 4192 *offset = length; 4193 return (NULL); 4194 } 4195 break; 4196 case SCTP_PACKET_DROPPED: 4197#ifdef SCTP_DEBUG 4198 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4199 printf("SCTP_PACKET_DROPPED\n"); 4200 } 4201#endif /* SCTP_DEBUG */ 4202 /* re-get it all please */ 4203 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4204 chk_length, chunk_buf); 4205 4206 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch, 4207 stcb, *netp); 4208 4209 break; 4210 4211 case SCTP_AUTHENTICATION: 4212#ifdef SCTP_DEBUG 4213 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4214 printf("SCTP_AUTHENTICATION\n"); 4215 } 4216#endif /* SCTP_DEBUG */ 4217 if (sctp_auth_disable) 4218 goto unknown_chunk; 4219 4220 if (stcb == NULL) { 4221 /* save the first AUTH for later processing */ 4222 if (auth_skipped == 0) { 4223 auth_offset = *offset; 4224 auth_len = chk_length; 4225 auth_skipped = 1; 4226 } 4227 /* skip this chunk (temporarily) */ 4228 goto next_chunk; 4229 } 4230 if (got_auth == 1) { 4231 /* skip this chunk... it's already auth'd */ 4232 goto next_chunk; 4233 } 4234 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4235 chk_length, chunk_buf); 4236 got_auth = 1; 4237 if (sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch, 4238 m, *offset)) { 4239 /* auth HMAC failed so dump the packet */ 4240 *offset = length; 4241 return (stcb); 4242 } else { 4243 /* remaining chunks are HMAC checked */ 4244 stcb->asoc.authenticated = 1; 4245 } 4246 break; 4247 4248 default: 4249 unknown_chunk: 4250 /* it's an unknown chunk! */ 4251 if ((ch->chunk_type & 0x40) && (stcb != NULL)) { 4252 struct mbuf *mm; 4253 struct sctp_paramhdr *phd; 4254 4255 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 4256 0, M_DONTWAIT, 1, MT_DATA); 4257 if (mm) { 4258 phd = mtod(mm, struct sctp_paramhdr *); 4259 /* 4260 * We cheat and use param type since 4261 * we did not bother to define a 4262 * error cause struct. They are the 4263 * same basic format with different 4264 * names. 4265 */ 4266 phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK); 4267 phd->param_length = htons(chk_length + sizeof(*phd)); 4268 SCTP_BUF_LEN(mm) = sizeof(*phd); 4269 SCTP_BUF_NEXT(mm) = sctp_m_copym(m, *offset, SCTP_SIZE32(chk_length), 4270 M_DONTWAIT); 4271 if (SCTP_BUF_NEXT(mm)) { 4272 sctp_queue_op_err(stcb, mm); 4273 } else { 4274 sctp_m_freem(mm); 4275 } 4276 } 4277 } 4278 if ((ch->chunk_type & 0x80) == 0) { 4279 /* discard this packet */ 4280 *offset = length; 4281 return (stcb); 4282 } /* else skip this bad chunk and continue... */ 4283 break; 4284 } /* switch (ch->chunk_type) */ 4285 4286 4287next_chunk: 4288 /* get the next chunk */ 4289 *offset += SCTP_SIZE32(chk_length); 4290 if (*offset >= length) { 4291 /* no more data left in the mbuf chain */ 4292 break; 4293 } 4294 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 4295 sizeof(struct sctp_chunkhdr), chunk_buf); 4296 if (ch == NULL) { 4297 if (locked_tcb) 4298 SCTP_TCB_UNLOCK(locked_tcb); 4299 *offset = length; 4300 return (NULL); 4301 } 4302 } /* while */ 4303 return (stcb); 4304} 4305 4306 4307/* 4308 * Process the ECN bits we have something set so we must look to see if it is 4309 * ECN(0) or ECN(1) or CE 4310 */ 4311static __inline void 4312sctp_process_ecn_marked_a(struct sctp_tcb *stcb, struct sctp_nets *net, 4313 uint8_t ecn_bits) 4314{ 4315 if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 4316 ; 4317 } else if ((ecn_bits & SCTP_ECT1_BIT) == SCTP_ECT1_BIT) { 4318 /* 4319 * we only add to the nonce sum for ECT1, ECT0 does not 4320 * change the NS bit (that we have yet to find a way to send 4321 * it yet). 4322 */ 4323 4324 /* ECN Nonce stuff */ 4325 stcb->asoc.receiver_nonce_sum++; 4326 stcb->asoc.receiver_nonce_sum &= SCTP_SACK_NONCE_SUM; 4327 4328 /* 4329 * Drag up the last_echo point if cumack is larger since we 4330 * don't want the point falling way behind by more than 4331 * 2^^31 and then having it be incorrect. 4332 */ 4333 if (compare_with_wrap(stcb->asoc.cumulative_tsn, 4334 stcb->asoc.last_echo_tsn, MAX_TSN)) { 4335 stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 4336 } 4337 } else if ((ecn_bits & SCTP_ECT0_BIT) == SCTP_ECT0_BIT) { 4338 /* 4339 * Drag up the last_echo point if cumack is larger since we 4340 * don't want the point falling way behind by more than 4341 * 2^^31 and then having it be incorrect. 4342 */ 4343 if (compare_with_wrap(stcb->asoc.cumulative_tsn, 4344 stcb->asoc.last_echo_tsn, MAX_TSN)) { 4345 stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 4346 } 4347 } 4348} 4349 4350static __inline void 4351sctp_process_ecn_marked_b(struct sctp_tcb *stcb, struct sctp_nets *net, 4352 uint32_t high_tsn, uint8_t ecn_bits) 4353{ 4354 if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 4355 /* 4356 * we possibly must notify the sender that a congestion 4357 * window reduction is in order. We do this by adding a ECNE 4358 * chunk to the output chunk queue. The incoming CWR will 4359 * remove this chunk. 4360 */ 4361 if (compare_with_wrap(high_tsn, stcb->asoc.last_echo_tsn, 4362 MAX_TSN)) { 4363 /* Yep, we need to add a ECNE */ 4364 sctp_send_ecn_echo(stcb, net, high_tsn); 4365 stcb->asoc.last_echo_tsn = high_tsn; 4366 } 4367 } 4368} 4369 4370/* 4371 * common input chunk processing (v4 and v6) 4372 */ 4373int 4374sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, 4375 int length, struct sctphdr *sh, struct sctp_chunkhdr *ch, 4376 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 4377 uint8_t ecn_bits) 4378{ 4379 /* 4380 * Control chunk processing 4381 */ 4382 uint32_t high_tsn; 4383 int fwd_tsn_seen = 0, data_processed = 0; 4384 struct mbuf *m = *mm; 4385 int abort_flag = 0; 4386 int un_sent; 4387 4388 SCTP_STAT_INCR(sctps_recvdatagrams); 4389#ifdef SCTP_AUDITING_ENABLED 4390 sctp_audit_log(0xE0, 1); 4391 sctp_auditing(0, inp, stcb, net); 4392#endif 4393 4394#ifdef SCTP_DEBUG 4395 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4396 printf("Ok, Common input processing called, m:%p iphlen:%d offset:%d\n", 4397 m, iphlen, offset); 4398 } 4399#endif /* SCTP_DEBUG */ 4400 4401 if (stcb) { 4402 /* always clear this before beginning a packet */ 4403 stcb->asoc.authenticated = 0; 4404 stcb->asoc.seen_a_sack_this_pkt = 0; 4405 } 4406 if (IS_SCTP_CONTROL(ch)) { 4407 /* process the control portion of the SCTP packet */ 4408 stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch, 4409 inp, stcb, &net, &fwd_tsn_seen); 4410 if (stcb) { 4411 /* 4412 * This covers us if the cookie-echo was there and 4413 * it changes our INP. 4414 */ 4415 inp = stcb->sctp_ep; 4416 } 4417 } else { 4418 /* 4419 * no control chunks, so pre-process DATA chunks (these 4420 * checks are taken care of by control processing) 4421 */ 4422 4423 /* 4424 * if DATA only packet, and auth is required, then punt... 4425 * can't have authenticated without any AUTH (control) 4426 * chunks 4427 */ 4428 if ((stcb != NULL) && !sctp_auth_disable && 4429 sctp_auth_is_required_chunk(SCTP_DATA, 4430 stcb->asoc.local_auth_chunks)) { 4431 /* "silently" ignore */ 4432 SCTP_STAT_INCR(sctps_recvauthmissing); 4433 SCTP_TCB_UNLOCK(stcb); 4434 return (1); 4435 } 4436 if (stcb == NULL) { 4437 /* out of the blue DATA chunk */ 4438 sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL); 4439 return (1); 4440 } 4441 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) { 4442 /* v_tag mismatch! */ 4443 SCTP_STAT_INCR(sctps_badvtag); 4444 SCTP_TCB_UNLOCK(stcb); 4445 return (1); 4446 } 4447 } 4448 4449 if (stcb == NULL) { 4450 /* 4451 * no valid TCB for this packet, or we found it's a bad 4452 * packet while processing control, or we're done with this 4453 * packet (done or skip rest of data), so we drop it... 4454 */ 4455 return (1); 4456 } 4457 /* 4458 * DATA chunk processing 4459 */ 4460 /* plow through the data chunks while length > offset */ 4461 4462 /* 4463 * Rest should be DATA only. Check authentication state if AUTH for 4464 * DATA is required. 4465 */ 4466 if ((length > offset) && (stcb != NULL) && !sctp_auth_disable && 4467 sctp_auth_is_required_chunk(SCTP_DATA, 4468 stcb->asoc.local_auth_chunks) && 4469 !stcb->asoc.authenticated) { 4470 /* "silently" ignore */ 4471 SCTP_STAT_INCR(sctps_recvauthmissing); 4472#ifdef SCTP_DEBUG 4473 if (sctp_debug_on & SCTP_DEBUG_AUTH1) 4474 printf("Data chunk requires AUTH, skipped\n"); 4475#endif 4476 goto trigger_send; 4477 } 4478 if (length > offset) { 4479 int retval; 4480 4481 /* 4482 * First check to make sure our state is correct. We would 4483 * not get here unless we really did have a tag, so we don't 4484 * abort if this happens, just dump the chunk silently. 4485 */ 4486 switch (SCTP_GET_STATE(&stcb->asoc)) { 4487 case SCTP_STATE_COOKIE_ECHOED: 4488 /* 4489 * we consider data with valid tags in this state 4490 * shows us the cookie-ack was lost. Imply it was 4491 * there. 4492 */ 4493 stcb->asoc.overall_error_count = 0; 4494 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net); 4495 break; 4496 case SCTP_STATE_COOKIE_WAIT: 4497 /* 4498 * We consider OOTB any data sent during asoc setup. 4499 */ 4500 sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL); 4501 SCTP_TCB_UNLOCK(stcb); 4502 return (1); 4503 break; 4504 case SCTP_STATE_EMPTY: /* should not happen */ 4505 case SCTP_STATE_INUSE: /* should not happen */ 4506 case SCTP_STATE_SHUTDOWN_RECEIVED: /* This is a peer error */ 4507 case SCTP_STATE_SHUTDOWN_ACK_SENT: 4508 default: 4509 SCTP_TCB_UNLOCK(stcb); 4510 return (1); 4511 break; 4512 case SCTP_STATE_OPEN: 4513 case SCTP_STATE_SHUTDOWN_SENT: 4514 break; 4515 } 4516 /* take care of ECN, part 1. */ 4517 if (stcb->asoc.ecn_allowed && 4518 (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) { 4519 sctp_process_ecn_marked_a(stcb, net, ecn_bits); 4520 } 4521 /* plow through the data chunks while length > offset */ 4522 retval = sctp_process_data(mm, iphlen, &offset, length, sh, 4523 inp, stcb, net, &high_tsn); 4524 if (retval == 2) { 4525 /* 4526 * The association aborted, NO UNLOCK needed since 4527 * the association is destroyed. 4528 */ 4529 return (0); 4530 } 4531 data_processed = 1; 4532 if (retval == 0) { 4533 /* take care of ecn part 2. */ 4534 if (stcb->asoc.ecn_allowed && 4535 (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) { 4536 sctp_process_ecn_marked_b(stcb, net, high_tsn, 4537 ecn_bits); 4538 } 4539 } 4540 /* 4541 * Anything important needs to have been m_copy'ed in 4542 * process_data 4543 */ 4544 } 4545 if ((data_processed == 0) && (fwd_tsn_seen)) { 4546 int was_a_gap = 0; 4547 4548 if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map, 4549 stcb->asoc.cumulative_tsn, MAX_TSN)) { 4550 /* there was a gap before this data was processed */ 4551 was_a_gap = 1; 4552 } 4553 sctp_sack_check(stcb, 1, was_a_gap, &abort_flag); 4554 if (abort_flag) { 4555 /* Again, we aborted so NO UNLOCK needed */ 4556 return (0); 4557 } 4558 } 4559 /* trigger send of any chunks in queue... */ 4560trigger_send: 4561#ifdef SCTP_AUDITING_ENABLED 4562 sctp_audit_log(0xE0, 2); 4563 sctp_auditing(1, inp, stcb, net); 4564#endif 4565#ifdef SCTP_DEBUG 4566 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4567 printf("Check for chunk output prw:%d tqe:%d tf=%d\n", 4568 stcb->asoc.peers_rwnd, 4569 TAILQ_EMPTY(&stcb->asoc.control_send_queue), 4570 stcb->asoc.total_flight); 4571 } 4572#endif 4573 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 4574 4575 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue) || 4576 ((un_sent) && 4577 (stcb->asoc.peers_rwnd > 0 || 4578 (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) { 4579#ifdef SCTP_DEBUG 4580 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4581 printf("Calling chunk OUTPUT\n"); 4582 } 4583#endif 4584 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC); 4585#ifdef SCTP_DEBUG 4586 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4587 printf("chunk OUTPUT returns\n"); 4588 } 4589#endif 4590 } 4591#ifdef SCTP_AUDITING_ENABLED 4592 sctp_audit_log(0xE0, 3); 4593 sctp_auditing(2, inp, stcb, net); 4594#endif 4595 SCTP_TCB_UNLOCK(stcb); 4596 return (0); 4597} 4598 4599extern int sctp_no_csum_on_loopback; 4600 4601 4602int sctp_buf_index = 0; 4603uint8_t sctp_list_of_chunks[30000]; 4604 4605 4606void 4607sctp_input(i_pak, off) 4608 struct mbuf *i_pak; 4609 int off; 4610 4611{ 4612#ifdef SCTP_MBUF_LOGGING 4613 struct mbuf *mat; 4614 4615#endif 4616 struct mbuf *m; 4617 int iphlen; 4618 int s; 4619 uint8_t ecn_bits; 4620 struct ip *ip; 4621 struct sctphdr *sh; 4622 struct sctp_inpcb *inp = NULL; 4623 4624 uint32_t check, calc_check; 4625 struct sctp_nets *net; 4626 struct sctp_tcb *stcb = NULL; 4627 struct sctp_chunkhdr *ch; 4628 int refcount_up = 0; 4629 int length, mlen, offset; 4630 4631 4632 iphlen = off; 4633 m = SCTP_HEADER_TO_CHAIN(i_pak); 4634 net = NULL; 4635 SCTP_STAT_INCR(sctps_recvpackets); 4636 SCTP_STAT_INCR_COUNTER64(sctps_inpackets); 4637 4638 /* 4639 * Strip IP options, we don't allow any in or out. 4640 */ 4641#ifdef SCTP_MBUF_LOGGING 4642 /* Log in any input mbufs */ 4643 mat = m; 4644 while (mat) { 4645 if (SCTP_BUF_IS_EXTENDED(mat)) { 4646 sctp_log_mb(mat, SCTP_MBUF_INPUT); 4647 } 4648 mat = SCTP_BUF_NEXT(mat); 4649 } 4650#endif 4651 if ((size_t)iphlen > sizeof(struct ip)) { 4652 ip_stripoptions(m, (struct mbuf *)0); 4653 iphlen = sizeof(struct ip); 4654 } 4655 /* 4656 * Get IP, SCTP, and first chunk header together in first mbuf. 4657 */ 4658 ip = mtod(m, struct ip *); 4659 offset = iphlen + sizeof(*sh) + sizeof(*ch); 4660 if (SCTP_BUF_LEN(m) < offset) { 4661 if ((m = m_pullup(m, offset)) == 0) { 4662 SCTP_STAT_INCR(sctps_hdrops); 4663 return; 4664 } 4665 ip = mtod(m, struct ip *); 4666 } 4667 sh = (struct sctphdr *)((caddr_t)ip + iphlen); 4668 ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh)); 4669 4670 /* SCTP does not allow broadcasts or multicasts */ 4671 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { 4672 goto bad; 4673 } 4674 if (((ch->chunk_type == SCTP_INITIATION) || 4675 (ch->chunk_type == SCTP_INITIATION_ACK) || 4676 (ch->chunk_type == SCTP_COOKIE_ECHO)) && 4677 (SCTP_IS_IT_BROADCAST(ip->ip_dst, i_pak))) { 4678 /* 4679 * We only look at broadcast if its a front state, All 4680 * others we will not have a tcb for anyway. 4681 */ 4682 goto bad; 4683 } 4684 /* destination port of 0 is illegal, based on RFC2960. */ 4685 if (sh->dest_port == 0) { 4686 SCTP_STAT_INCR(sctps_hdrops); 4687 goto bad; 4688 } 4689 /* validate SCTP checksum */ 4690 if ((sctp_no_csum_on_loopback == 0) || 4691 SCTP_IS_IT_LOOPBACK(i_pak)) { 4692 /* 4693 * we do NOT validate things from the loopback if the sysctl 4694 * is set to 1. 4695 */ 4696 check = sh->checksum; /* save incoming checksum */ 4697 if ((check == 0) && (sctp_no_csum_on_loopback)) { 4698 /* 4699 * special hook for where we got a local address 4700 * somehow routed across a non IFT_LOOP type 4701 * interface 4702 */ 4703 if (ip->ip_src.s_addr == ip->ip_dst.s_addr) 4704 goto sctp_skip_csum_4; 4705 } 4706 sh->checksum = 0; /* prepare for calc */ 4707 calc_check = sctp_calculate_sum(m, &mlen, iphlen); 4708 if (calc_check != check) { 4709#ifdef SCTP_DEBUG 4710 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4711 printf("Bad CSUM on SCTP packet calc_check:%x check:%x m:%p mlen:%d iphlen:%d\n", 4712 calc_check, check, m, mlen, iphlen); 4713 } 4714#endif 4715 4716 stcb = sctp_findassociation_addr(m, iphlen, 4717 offset - sizeof(*ch), 4718 sh, ch, &inp, &net); 4719 if ((inp) && (stcb)) { 4720 sctp_send_packet_dropped(stcb, net, m, iphlen, 1); 4721 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR); 4722 } else if ((inp != NULL) && (stcb == NULL)) { 4723 refcount_up = 1; 4724 } 4725 SCTP_STAT_INCR(sctps_badsum); 4726 SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors); 4727 goto bad; 4728 } 4729 sh->checksum = calc_check; 4730 } else { 4731sctp_skip_csum_4: 4732 mlen = SCTP_HEADER_LEN(i_pak); 4733 } 4734 /* validate mbuf chain length with IP payload length */ 4735 if (mlen < (ip->ip_len - iphlen)) { 4736 SCTP_STAT_INCR(sctps_hdrops); 4737 goto bad; 4738 } { 4739 /* TEMP log the first chunk */ 4740 int x; 4741 4742 x = atomic_fetchadd_int(&sctp_buf_index, 1); 4743 if (x > 30000) { 4744 sctp_buf_index = 1; 4745 x = 0;; 4746 } 4747 sctp_list_of_chunks[x] = ch->chunk_type; 4748 } 4749 /* 4750 * Locate pcb and tcb for datagram sctp_findassociation_addr() wants 4751 * IP/SCTP/first chunk header... 4752 */ 4753 stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch), 4754 sh, ch, &inp, &net); 4755 /* inp's ref-count increased && stcb locked */ 4756 if (inp == NULL) { 4757 struct sctp_init_chunk *init_chk, chunk_buf; 4758 4759 SCTP_STAT_INCR(sctps_noport); 4760#ifdef ICMP_BANDLIM 4761 /* 4762 * we use the bandwidth limiting to protect against sending 4763 * too many ABORTS all at once. In this case these count the 4764 * same as an ICMP message. 4765 */ 4766 if (badport_bandlim(0) < 0) 4767 goto bad; 4768#endif /* ICMP_BANDLIM */ 4769#ifdef SCTP_DEBUG 4770 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4771 printf("Sending a ABORT from packet entry!\n"); 4772 } 4773#endif 4774 if (ch->chunk_type == SCTP_INITIATION) { 4775 /* 4776 * we do a trick here to get the INIT tag, dig in 4777 * and get the tag from the INIT and put it in the 4778 * common header. 4779 */ 4780 init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m, 4781 iphlen + sizeof(*sh), sizeof(*init_chk), 4782 (uint8_t *) & chunk_buf); 4783 if (init_chk != NULL) 4784 sh->v_tag = init_chk->init.initiate_tag; 4785 } 4786 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 4787 sctp_send_shutdown_complete2(m, iphlen, sh); 4788 goto bad; 4789 } 4790 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) { 4791 goto bad; 4792 } 4793 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) 4794 sctp_send_abort(m, iphlen, sh, 0, NULL); 4795 goto bad; 4796 } else if (stcb == NULL) { 4797 refcount_up = 1; 4798 } 4799#ifdef IPSEC 4800 /* 4801 * I very much doubt any of the IPSEC stuff will work but I have no 4802 * idea, so I will leave it in place. 4803 */ 4804 4805 if (inp && ipsec4_in_reject(m, &inp->ip_inp.inp)) { 4806 ipsecstat.in_polvio++; 4807 SCTP_STAT_INCR(sctps_hdrops); 4808 goto bad; 4809 } 4810#endif /* IPSEC */ 4811 4812 4813 4814 /* 4815 * common chunk processing 4816 */ 4817 length = ip->ip_len + iphlen; 4818 offset -= sizeof(struct sctp_chunkhdr); 4819 4820 ecn_bits = ip->ip_tos; 4821 s = splnet(); 4822 4823 sctp_common_input_processing(&m, iphlen, offset, length, sh, ch, 4824 inp, stcb, net, ecn_bits); 4825 /* inp's ref-count reduced && stcb unlocked */ 4826 splx(s); 4827 if (m) { 4828 sctp_m_freem(m); 4829 } 4830 if ((inp) && (refcount_up)) { 4831 /* reduce ref-count */ 4832 SCTP_INP_WLOCK(inp); 4833 SCTP_INP_DECR_REF(inp); 4834 SCTP_INP_WUNLOCK(inp); 4835 } 4836 return; 4837bad: 4838 if (stcb) 4839 SCTP_TCB_UNLOCK(stcb); 4840 4841 if ((inp) && (refcount_up)) { 4842 /* reduce ref-count */ 4843 SCTP_INP_WLOCK(inp); 4844 SCTP_INP_DECR_REF(inp); 4845 SCTP_INP_WUNLOCK(inp); 4846 } 4847 if (m) { 4848 sctp_m_freem(m); 4849 } 4850 return; 4851} 4852