sctp_output.c revision 267799
1/*- 2 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 3 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 4 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions are met: 8 * 9 * a) Redistributions of source code must retain the above copyright notice, 10 * this list of conditions and the following disclaimer. 11 * 12 * b) Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the distribution. 15 * 16 * c) Neither the name of Cisco Systems, Inc. nor the names of its 17 * contributors may be used to endorse or promote products derived 18 * from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 24 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 30 * THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33#include <sys/cdefs.h> 34__FBSDID("$FreeBSD: releng/9.3/sys/netinet/sctp_output.c 267799 2014-06-23 15:04:32Z tuexen $"); 35 36#include <netinet/sctp_os.h> 37#include <sys/proc.h> 38#include <netinet/sctp_var.h> 39#include <netinet/sctp_sysctl.h> 40#include <netinet/sctp_header.h> 41#include <netinet/sctp_pcb.h> 42#include <netinet/sctputil.h> 43#include <netinet/sctp_output.h> 44#include <netinet/sctp_uio.h> 45#include <netinet/sctputil.h> 46#include <netinet/sctp_auth.h> 47#include <netinet/sctp_timer.h> 48#include <netinet/sctp_asconf.h> 49#include <netinet/sctp_indata.h> 50#include <netinet/sctp_bsd_addr.h> 51#include <netinet/sctp_input.h> 52#include <netinet/sctp_crc32.h> 53#include <netinet/udp.h> 54#include <netinet/udp_var.h> 55#include <machine/in_cksum.h> 56 57 58 59#define SCTP_MAX_GAPS_INARRAY 4 60struct sack_track { 61 uint8_t right_edge; /* mergable on the right edge */ 62 uint8_t left_edge; /* mergable on the left edge */ 63 uint8_t num_entries; 64 uint8_t spare; 65 struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY]; 66}; 67 68struct sack_track sack_array[256] = { 69 {0, 0, 0, 0, /* 0x00 */ 70 {{0, 0}, 71 {0, 0}, 72 {0, 0}, 73 {0, 0} 74 } 75 }, 76 {1, 0, 1, 0, /* 0x01 */ 77 {{0, 0}, 78 {0, 0}, 79 {0, 0}, 80 {0, 0} 81 } 82 }, 83 {0, 0, 1, 0, /* 0x02 */ 84 {{1, 1}, 85 {0, 0}, 86 {0, 0}, 87 {0, 0} 88 } 89 }, 90 {1, 0, 1, 0, /* 0x03 */ 91 {{0, 1}, 92 {0, 0}, 93 {0, 0}, 94 {0, 0} 95 } 96 }, 97 {0, 0, 1, 0, /* 0x04 */ 98 {{2, 2}, 99 {0, 0}, 100 {0, 0}, 101 {0, 0} 102 } 103 }, 104 {1, 0, 2, 0, /* 0x05 */ 105 {{0, 0}, 106 {2, 2}, 107 {0, 0}, 108 {0, 0} 109 } 110 }, 111 {0, 0, 1, 0, /* 0x06 */ 112 {{1, 2}, 113 {0, 0}, 114 {0, 0}, 115 {0, 0} 116 } 117 }, 118 {1, 0, 1, 0, /* 0x07 */ 119 {{0, 2}, 120 {0, 0}, 121 {0, 0}, 122 {0, 0} 123 } 124 }, 125 {0, 0, 1, 0, /* 0x08 */ 126 {{3, 3}, 127 {0, 0}, 128 {0, 0}, 129 {0, 0} 130 } 131 }, 132 {1, 0, 2, 0, /* 0x09 */ 133 {{0, 0}, 134 {3, 3}, 135 {0, 0}, 136 {0, 0} 137 } 138 }, 139 {0, 0, 2, 0, /* 0x0a */ 140 {{1, 1}, 141 {3, 3}, 142 {0, 0}, 143 {0, 0} 144 } 145 }, 146 {1, 0, 2, 0, /* 0x0b */ 147 {{0, 1}, 148 {3, 3}, 149 {0, 0}, 150 {0, 0} 151 } 152 }, 153 {0, 0, 1, 0, /* 0x0c */ 154 {{2, 3}, 155 {0, 0}, 156 {0, 0}, 157 {0, 0} 158 } 159 }, 160 {1, 0, 2, 0, /* 0x0d */ 161 {{0, 0}, 162 {2, 3}, 163 {0, 0}, 164 {0, 0} 165 } 166 }, 167 {0, 0, 1, 0, /* 0x0e */ 168 {{1, 3}, 169 {0, 0}, 170 {0, 0}, 171 {0, 0} 172 } 173 }, 174 {1, 0, 1, 0, /* 0x0f */ 175 {{0, 3}, 176 {0, 0}, 177 {0, 0}, 178 {0, 0} 179 } 180 }, 181 {0, 0, 1, 0, /* 0x10 */ 182 {{4, 4}, 183 {0, 0}, 184 {0, 0}, 185 {0, 0} 186 } 187 }, 188 {1, 0, 2, 0, /* 0x11 */ 189 {{0, 0}, 190 {4, 4}, 191 {0, 0}, 192 {0, 0} 193 } 194 }, 195 {0, 0, 2, 0, /* 0x12 */ 196 {{1, 1}, 197 {4, 4}, 198 {0, 0}, 199 {0, 0} 200 } 201 }, 202 {1, 0, 2, 0, /* 0x13 */ 203 {{0, 1}, 204 {4, 4}, 205 {0, 0}, 206 {0, 0} 207 } 208 }, 209 {0, 0, 2, 0, /* 0x14 */ 210 {{2, 2}, 211 {4, 4}, 212 {0, 0}, 213 {0, 0} 214 } 215 }, 216 {1, 0, 3, 0, /* 0x15 */ 217 {{0, 0}, 218 {2, 2}, 219 {4, 4}, 220 {0, 0} 221 } 222 }, 223 {0, 0, 2, 0, /* 0x16 */ 224 {{1, 2}, 225 {4, 4}, 226 {0, 0}, 227 {0, 0} 228 } 229 }, 230 {1, 0, 2, 0, /* 0x17 */ 231 {{0, 2}, 232 {4, 4}, 233 {0, 0}, 234 {0, 0} 235 } 236 }, 237 {0, 0, 1, 0, /* 0x18 */ 238 {{3, 4}, 239 {0, 0}, 240 {0, 0}, 241 {0, 0} 242 } 243 }, 244 {1, 0, 2, 0, /* 0x19 */ 245 {{0, 0}, 246 {3, 4}, 247 {0, 0}, 248 {0, 0} 249 } 250 }, 251 {0, 0, 2, 0, /* 0x1a */ 252 {{1, 1}, 253 {3, 4}, 254 {0, 0}, 255 {0, 0} 256 } 257 }, 258 {1, 0, 2, 0, /* 0x1b */ 259 {{0, 1}, 260 {3, 4}, 261 {0, 0}, 262 {0, 0} 263 } 264 }, 265 {0, 0, 1, 0, /* 0x1c */ 266 {{2, 4}, 267 {0, 0}, 268 {0, 0}, 269 {0, 0} 270 } 271 }, 272 {1, 0, 2, 0, /* 0x1d */ 273 {{0, 0}, 274 {2, 4}, 275 {0, 0}, 276 {0, 0} 277 } 278 }, 279 {0, 0, 1, 0, /* 0x1e */ 280 {{1, 4}, 281 {0, 0}, 282 {0, 0}, 283 {0, 0} 284 } 285 }, 286 {1, 0, 1, 0, /* 0x1f */ 287 {{0, 4}, 288 {0, 0}, 289 {0, 0}, 290 {0, 0} 291 } 292 }, 293 {0, 0, 1, 0, /* 0x20 */ 294 {{5, 5}, 295 {0, 0}, 296 {0, 0}, 297 {0, 0} 298 } 299 }, 300 {1, 0, 2, 0, /* 0x21 */ 301 {{0, 0}, 302 {5, 5}, 303 {0, 0}, 304 {0, 0} 305 } 306 }, 307 {0, 0, 2, 0, /* 0x22 */ 308 {{1, 1}, 309 {5, 5}, 310 {0, 0}, 311 {0, 0} 312 } 313 }, 314 {1, 0, 2, 0, /* 0x23 */ 315 {{0, 1}, 316 {5, 5}, 317 {0, 0}, 318 {0, 0} 319 } 320 }, 321 {0, 0, 2, 0, /* 0x24 */ 322 {{2, 2}, 323 {5, 5}, 324 {0, 0}, 325 {0, 0} 326 } 327 }, 328 {1, 0, 3, 0, /* 0x25 */ 329 {{0, 0}, 330 {2, 2}, 331 {5, 5}, 332 {0, 0} 333 } 334 }, 335 {0, 0, 2, 0, /* 0x26 */ 336 {{1, 2}, 337 {5, 5}, 338 {0, 0}, 339 {0, 0} 340 } 341 }, 342 {1, 0, 2, 0, /* 0x27 */ 343 {{0, 2}, 344 {5, 5}, 345 {0, 0}, 346 {0, 0} 347 } 348 }, 349 {0, 0, 2, 0, /* 0x28 */ 350 {{3, 3}, 351 {5, 5}, 352 {0, 0}, 353 {0, 0} 354 } 355 }, 356 {1, 0, 3, 0, /* 0x29 */ 357 {{0, 0}, 358 {3, 3}, 359 {5, 5}, 360 {0, 0} 361 } 362 }, 363 {0, 0, 3, 0, /* 0x2a */ 364 {{1, 1}, 365 {3, 3}, 366 {5, 5}, 367 {0, 0} 368 } 369 }, 370 {1, 0, 3, 0, /* 0x2b */ 371 {{0, 1}, 372 {3, 3}, 373 {5, 5}, 374 {0, 0} 375 } 376 }, 377 {0, 0, 2, 0, /* 0x2c */ 378 {{2, 3}, 379 {5, 5}, 380 {0, 0}, 381 {0, 0} 382 } 383 }, 384 {1, 0, 3, 0, /* 0x2d */ 385 {{0, 0}, 386 {2, 3}, 387 {5, 5}, 388 {0, 0} 389 } 390 }, 391 {0, 0, 2, 0, /* 0x2e */ 392 {{1, 3}, 393 {5, 5}, 394 {0, 0}, 395 {0, 0} 396 } 397 }, 398 {1, 0, 2, 0, /* 0x2f */ 399 {{0, 3}, 400 {5, 5}, 401 {0, 0}, 402 {0, 0} 403 } 404 }, 405 {0, 0, 1, 0, /* 0x30 */ 406 {{4, 5}, 407 {0, 0}, 408 {0, 0}, 409 {0, 0} 410 } 411 }, 412 {1, 0, 2, 0, /* 0x31 */ 413 {{0, 0}, 414 {4, 5}, 415 {0, 0}, 416 {0, 0} 417 } 418 }, 419 {0, 0, 2, 0, /* 0x32 */ 420 {{1, 1}, 421 {4, 5}, 422 {0, 0}, 423 {0, 0} 424 } 425 }, 426 {1, 0, 2, 0, /* 0x33 */ 427 {{0, 1}, 428 {4, 5}, 429 {0, 0}, 430 {0, 0} 431 } 432 }, 433 {0, 0, 2, 0, /* 0x34 */ 434 {{2, 2}, 435 {4, 5}, 436 {0, 0}, 437 {0, 0} 438 } 439 }, 440 {1, 0, 3, 0, /* 0x35 */ 441 {{0, 0}, 442 {2, 2}, 443 {4, 5}, 444 {0, 0} 445 } 446 }, 447 {0, 0, 2, 0, /* 0x36 */ 448 {{1, 2}, 449 {4, 5}, 450 {0, 0}, 451 {0, 0} 452 } 453 }, 454 {1, 0, 2, 0, /* 0x37 */ 455 {{0, 2}, 456 {4, 5}, 457 {0, 0}, 458 {0, 0} 459 } 460 }, 461 {0, 0, 1, 0, /* 0x38 */ 462 {{3, 5}, 463 {0, 0}, 464 {0, 0}, 465 {0, 0} 466 } 467 }, 468 {1, 0, 2, 0, /* 0x39 */ 469 {{0, 0}, 470 {3, 5}, 471 {0, 0}, 472 {0, 0} 473 } 474 }, 475 {0, 0, 2, 0, /* 0x3a */ 476 {{1, 1}, 477 {3, 5}, 478 {0, 0}, 479 {0, 0} 480 } 481 }, 482 {1, 0, 2, 0, /* 0x3b */ 483 {{0, 1}, 484 {3, 5}, 485 {0, 0}, 486 {0, 0} 487 } 488 }, 489 {0, 0, 1, 0, /* 0x3c */ 490 {{2, 5}, 491 {0, 0}, 492 {0, 0}, 493 {0, 0} 494 } 495 }, 496 {1, 0, 2, 0, /* 0x3d */ 497 {{0, 0}, 498 {2, 5}, 499 {0, 0}, 500 {0, 0} 501 } 502 }, 503 {0, 0, 1, 0, /* 0x3e */ 504 {{1, 5}, 505 {0, 0}, 506 {0, 0}, 507 {0, 0} 508 } 509 }, 510 {1, 0, 1, 0, /* 0x3f */ 511 {{0, 5}, 512 {0, 0}, 513 {0, 0}, 514 {0, 0} 515 } 516 }, 517 {0, 0, 1, 0, /* 0x40 */ 518 {{6, 6}, 519 {0, 0}, 520 {0, 0}, 521 {0, 0} 522 } 523 }, 524 {1, 0, 2, 0, /* 0x41 */ 525 {{0, 0}, 526 {6, 6}, 527 {0, 0}, 528 {0, 0} 529 } 530 }, 531 {0, 0, 2, 0, /* 0x42 */ 532 {{1, 1}, 533 {6, 6}, 534 {0, 0}, 535 {0, 0} 536 } 537 }, 538 {1, 0, 2, 0, /* 0x43 */ 539 {{0, 1}, 540 {6, 6}, 541 {0, 0}, 542 {0, 0} 543 } 544 }, 545 {0, 0, 2, 0, /* 0x44 */ 546 {{2, 2}, 547 {6, 6}, 548 {0, 0}, 549 {0, 0} 550 } 551 }, 552 {1, 0, 3, 0, /* 0x45 */ 553 {{0, 0}, 554 {2, 2}, 555 {6, 6}, 556 {0, 0} 557 } 558 }, 559 {0, 0, 2, 0, /* 0x46 */ 560 {{1, 2}, 561 {6, 6}, 562 {0, 0}, 563 {0, 0} 564 } 565 }, 566 {1, 0, 2, 0, /* 0x47 */ 567 {{0, 2}, 568 {6, 6}, 569 {0, 0}, 570 {0, 0} 571 } 572 }, 573 {0, 0, 2, 0, /* 0x48 */ 574 {{3, 3}, 575 {6, 6}, 576 {0, 0}, 577 {0, 0} 578 } 579 }, 580 {1, 0, 3, 0, /* 0x49 */ 581 {{0, 0}, 582 {3, 3}, 583 {6, 6}, 584 {0, 0} 585 } 586 }, 587 {0, 0, 3, 0, /* 0x4a */ 588 {{1, 1}, 589 {3, 3}, 590 {6, 6}, 591 {0, 0} 592 } 593 }, 594 {1, 0, 3, 0, /* 0x4b */ 595 {{0, 1}, 596 {3, 3}, 597 {6, 6}, 598 {0, 0} 599 } 600 }, 601 {0, 0, 2, 0, /* 0x4c */ 602 {{2, 3}, 603 {6, 6}, 604 {0, 0}, 605 {0, 0} 606 } 607 }, 608 {1, 0, 3, 0, /* 0x4d */ 609 {{0, 0}, 610 {2, 3}, 611 {6, 6}, 612 {0, 0} 613 } 614 }, 615 {0, 0, 2, 0, /* 0x4e */ 616 {{1, 3}, 617 {6, 6}, 618 {0, 0}, 619 {0, 0} 620 } 621 }, 622 {1, 0, 2, 0, /* 0x4f */ 623 {{0, 3}, 624 {6, 6}, 625 {0, 0}, 626 {0, 0} 627 } 628 }, 629 {0, 0, 2, 0, /* 0x50 */ 630 {{4, 4}, 631 {6, 6}, 632 {0, 0}, 633 {0, 0} 634 } 635 }, 636 {1, 0, 3, 0, /* 0x51 */ 637 {{0, 0}, 638 {4, 4}, 639 {6, 6}, 640 {0, 0} 641 } 642 }, 643 {0, 0, 3, 0, /* 0x52 */ 644 {{1, 1}, 645 {4, 4}, 646 {6, 6}, 647 {0, 0} 648 } 649 }, 650 {1, 0, 3, 0, /* 0x53 */ 651 {{0, 1}, 652 {4, 4}, 653 {6, 6}, 654 {0, 0} 655 } 656 }, 657 {0, 0, 3, 0, /* 0x54 */ 658 {{2, 2}, 659 {4, 4}, 660 {6, 6}, 661 {0, 0} 662 } 663 }, 664 {1, 0, 4, 0, /* 0x55 */ 665 {{0, 0}, 666 {2, 2}, 667 {4, 4}, 668 {6, 6} 669 } 670 }, 671 {0, 0, 3, 0, /* 0x56 */ 672 {{1, 2}, 673 {4, 4}, 674 {6, 6}, 675 {0, 0} 676 } 677 }, 678 {1, 0, 3, 0, /* 0x57 */ 679 {{0, 2}, 680 {4, 4}, 681 {6, 6}, 682 {0, 0} 683 } 684 }, 685 {0, 0, 2, 0, /* 0x58 */ 686 {{3, 4}, 687 {6, 6}, 688 {0, 0}, 689 {0, 0} 690 } 691 }, 692 {1, 0, 3, 0, /* 0x59 */ 693 {{0, 0}, 694 {3, 4}, 695 {6, 6}, 696 {0, 0} 697 } 698 }, 699 {0, 0, 3, 0, /* 0x5a */ 700 {{1, 1}, 701 {3, 4}, 702 {6, 6}, 703 {0, 0} 704 } 705 }, 706 {1, 0, 3, 0, /* 0x5b */ 707 {{0, 1}, 708 {3, 4}, 709 {6, 6}, 710 {0, 0} 711 } 712 }, 713 {0, 0, 2, 0, /* 0x5c */ 714 {{2, 4}, 715 {6, 6}, 716 {0, 0}, 717 {0, 0} 718 } 719 }, 720 {1, 0, 3, 0, /* 0x5d */ 721 {{0, 0}, 722 {2, 4}, 723 {6, 6}, 724 {0, 0} 725 } 726 }, 727 {0, 0, 2, 0, /* 0x5e */ 728 {{1, 4}, 729 {6, 6}, 730 {0, 0}, 731 {0, 0} 732 } 733 }, 734 {1, 0, 2, 0, /* 0x5f */ 735 {{0, 4}, 736 {6, 6}, 737 {0, 0}, 738 {0, 0} 739 } 740 }, 741 {0, 0, 1, 0, /* 0x60 */ 742 {{5, 6}, 743 {0, 0}, 744 {0, 0}, 745 {0, 0} 746 } 747 }, 748 {1, 0, 2, 0, /* 0x61 */ 749 {{0, 0}, 750 {5, 6}, 751 {0, 0}, 752 {0, 0} 753 } 754 }, 755 {0, 0, 2, 0, /* 0x62 */ 756 {{1, 1}, 757 {5, 6}, 758 {0, 0}, 759 {0, 0} 760 } 761 }, 762 {1, 0, 2, 0, /* 0x63 */ 763 {{0, 1}, 764 {5, 6}, 765 {0, 0}, 766 {0, 0} 767 } 768 }, 769 {0, 0, 2, 0, /* 0x64 */ 770 {{2, 2}, 771 {5, 6}, 772 {0, 0}, 773 {0, 0} 774 } 775 }, 776 {1, 0, 3, 0, /* 0x65 */ 777 {{0, 0}, 778 {2, 2}, 779 {5, 6}, 780 {0, 0} 781 } 782 }, 783 {0, 0, 2, 0, /* 0x66 */ 784 {{1, 2}, 785 {5, 6}, 786 {0, 0}, 787 {0, 0} 788 } 789 }, 790 {1, 0, 2, 0, /* 0x67 */ 791 {{0, 2}, 792 {5, 6}, 793 {0, 0}, 794 {0, 0} 795 } 796 }, 797 {0, 0, 2, 0, /* 0x68 */ 798 {{3, 3}, 799 {5, 6}, 800 {0, 0}, 801 {0, 0} 802 } 803 }, 804 {1, 0, 3, 0, /* 0x69 */ 805 {{0, 0}, 806 {3, 3}, 807 {5, 6}, 808 {0, 0} 809 } 810 }, 811 {0, 0, 3, 0, /* 0x6a */ 812 {{1, 1}, 813 {3, 3}, 814 {5, 6}, 815 {0, 0} 816 } 817 }, 818 {1, 0, 3, 0, /* 0x6b */ 819 {{0, 1}, 820 {3, 3}, 821 {5, 6}, 822 {0, 0} 823 } 824 }, 825 {0, 0, 2, 0, /* 0x6c */ 826 {{2, 3}, 827 {5, 6}, 828 {0, 0}, 829 {0, 0} 830 } 831 }, 832 {1, 0, 3, 0, /* 0x6d */ 833 {{0, 0}, 834 {2, 3}, 835 {5, 6}, 836 {0, 0} 837 } 838 }, 839 {0, 0, 2, 0, /* 0x6e */ 840 {{1, 3}, 841 {5, 6}, 842 {0, 0}, 843 {0, 0} 844 } 845 }, 846 {1, 0, 2, 0, /* 0x6f */ 847 {{0, 3}, 848 {5, 6}, 849 {0, 0}, 850 {0, 0} 851 } 852 }, 853 {0, 0, 1, 0, /* 0x70 */ 854 {{4, 6}, 855 {0, 0}, 856 {0, 0}, 857 {0, 0} 858 } 859 }, 860 {1, 0, 2, 0, /* 0x71 */ 861 {{0, 0}, 862 {4, 6}, 863 {0, 0}, 864 {0, 0} 865 } 866 }, 867 {0, 0, 2, 0, /* 0x72 */ 868 {{1, 1}, 869 {4, 6}, 870 {0, 0}, 871 {0, 0} 872 } 873 }, 874 {1, 0, 2, 0, /* 0x73 */ 875 {{0, 1}, 876 {4, 6}, 877 {0, 0}, 878 {0, 0} 879 } 880 }, 881 {0, 0, 2, 0, /* 0x74 */ 882 {{2, 2}, 883 {4, 6}, 884 {0, 0}, 885 {0, 0} 886 } 887 }, 888 {1, 0, 3, 0, /* 0x75 */ 889 {{0, 0}, 890 {2, 2}, 891 {4, 6}, 892 {0, 0} 893 } 894 }, 895 {0, 0, 2, 0, /* 0x76 */ 896 {{1, 2}, 897 {4, 6}, 898 {0, 0}, 899 {0, 0} 900 } 901 }, 902 {1, 0, 2, 0, /* 0x77 */ 903 {{0, 2}, 904 {4, 6}, 905 {0, 0}, 906 {0, 0} 907 } 908 }, 909 {0, 0, 1, 0, /* 0x78 */ 910 {{3, 6}, 911 {0, 0}, 912 {0, 0}, 913 {0, 0} 914 } 915 }, 916 {1, 0, 2, 0, /* 0x79 */ 917 {{0, 0}, 918 {3, 6}, 919 {0, 0}, 920 {0, 0} 921 } 922 }, 923 {0, 0, 2, 0, /* 0x7a */ 924 {{1, 1}, 925 {3, 6}, 926 {0, 0}, 927 {0, 0} 928 } 929 }, 930 {1, 0, 2, 0, /* 0x7b */ 931 {{0, 1}, 932 {3, 6}, 933 {0, 0}, 934 {0, 0} 935 } 936 }, 937 {0, 0, 1, 0, /* 0x7c */ 938 {{2, 6}, 939 {0, 0}, 940 {0, 0}, 941 {0, 0} 942 } 943 }, 944 {1, 0, 2, 0, /* 0x7d */ 945 {{0, 0}, 946 {2, 6}, 947 {0, 0}, 948 {0, 0} 949 } 950 }, 951 {0, 0, 1, 0, /* 0x7e */ 952 {{1, 6}, 953 {0, 0}, 954 {0, 0}, 955 {0, 0} 956 } 957 }, 958 {1, 0, 1, 0, /* 0x7f */ 959 {{0, 6}, 960 {0, 0}, 961 {0, 0}, 962 {0, 0} 963 } 964 }, 965 {0, 1, 1, 0, /* 0x80 */ 966 {{7, 7}, 967 {0, 0}, 968 {0, 0}, 969 {0, 0} 970 } 971 }, 972 {1, 1, 2, 0, /* 0x81 */ 973 {{0, 0}, 974 {7, 7}, 975 {0, 0}, 976 {0, 0} 977 } 978 }, 979 {0, 1, 2, 0, /* 0x82 */ 980 {{1, 1}, 981 {7, 7}, 982 {0, 0}, 983 {0, 0} 984 } 985 }, 986 {1, 1, 2, 0, /* 0x83 */ 987 {{0, 1}, 988 {7, 7}, 989 {0, 0}, 990 {0, 0} 991 } 992 }, 993 {0, 1, 2, 0, /* 0x84 */ 994 {{2, 2}, 995 {7, 7}, 996 {0, 0}, 997 {0, 0} 998 } 999 }, 1000 {1, 1, 3, 0, /* 0x85 */ 1001 {{0, 0}, 1002 {2, 2}, 1003 {7, 7}, 1004 {0, 0} 1005 } 1006 }, 1007 {0, 1, 2, 0, /* 0x86 */ 1008 {{1, 2}, 1009 {7, 7}, 1010 {0, 0}, 1011 {0, 0} 1012 } 1013 }, 1014 {1, 1, 2, 0, /* 0x87 */ 1015 {{0, 2}, 1016 {7, 7}, 1017 {0, 0}, 1018 {0, 0} 1019 } 1020 }, 1021 {0, 1, 2, 0, /* 0x88 */ 1022 {{3, 3}, 1023 {7, 7}, 1024 {0, 0}, 1025 {0, 0} 1026 } 1027 }, 1028 {1, 1, 3, 0, /* 0x89 */ 1029 {{0, 0}, 1030 {3, 3}, 1031 {7, 7}, 1032 {0, 0} 1033 } 1034 }, 1035 {0, 1, 3, 0, /* 0x8a */ 1036 {{1, 1}, 1037 {3, 3}, 1038 {7, 7}, 1039 {0, 0} 1040 } 1041 }, 1042 {1, 1, 3, 0, /* 0x8b */ 1043 {{0, 1}, 1044 {3, 3}, 1045 {7, 7}, 1046 {0, 0} 1047 } 1048 }, 1049 {0, 1, 2, 0, /* 0x8c */ 1050 {{2, 3}, 1051 {7, 7}, 1052 {0, 0}, 1053 {0, 0} 1054 } 1055 }, 1056 {1, 1, 3, 0, /* 0x8d */ 1057 {{0, 0}, 1058 {2, 3}, 1059 {7, 7}, 1060 {0, 0} 1061 } 1062 }, 1063 {0, 1, 2, 0, /* 0x8e */ 1064 {{1, 3}, 1065 {7, 7}, 1066 {0, 0}, 1067 {0, 0} 1068 } 1069 }, 1070 {1, 1, 2, 0, /* 0x8f */ 1071 {{0, 3}, 1072 {7, 7}, 1073 {0, 0}, 1074 {0, 0} 1075 } 1076 }, 1077 {0, 1, 2, 0, /* 0x90 */ 1078 {{4, 4}, 1079 {7, 7}, 1080 {0, 0}, 1081 {0, 0} 1082 } 1083 }, 1084 {1, 1, 3, 0, /* 0x91 */ 1085 {{0, 0}, 1086 {4, 4}, 1087 {7, 7}, 1088 {0, 0} 1089 } 1090 }, 1091 {0, 1, 3, 0, /* 0x92 */ 1092 {{1, 1}, 1093 {4, 4}, 1094 {7, 7}, 1095 {0, 0} 1096 } 1097 }, 1098 {1, 1, 3, 0, /* 0x93 */ 1099 {{0, 1}, 1100 {4, 4}, 1101 {7, 7}, 1102 {0, 0} 1103 } 1104 }, 1105 {0, 1, 3, 0, /* 0x94 */ 1106 {{2, 2}, 1107 {4, 4}, 1108 {7, 7}, 1109 {0, 0} 1110 } 1111 }, 1112 {1, 1, 4, 0, /* 0x95 */ 1113 {{0, 0}, 1114 {2, 2}, 1115 {4, 4}, 1116 {7, 7} 1117 } 1118 }, 1119 {0, 1, 3, 0, /* 0x96 */ 1120 {{1, 2}, 1121 {4, 4}, 1122 {7, 7}, 1123 {0, 0} 1124 } 1125 }, 1126 {1, 1, 3, 0, /* 0x97 */ 1127 {{0, 2}, 1128 {4, 4}, 1129 {7, 7}, 1130 {0, 0} 1131 } 1132 }, 1133 {0, 1, 2, 0, /* 0x98 */ 1134 {{3, 4}, 1135 {7, 7}, 1136 {0, 0}, 1137 {0, 0} 1138 } 1139 }, 1140 {1, 1, 3, 0, /* 0x99 */ 1141 {{0, 0}, 1142 {3, 4}, 1143 {7, 7}, 1144 {0, 0} 1145 } 1146 }, 1147 {0, 1, 3, 0, /* 0x9a */ 1148 {{1, 1}, 1149 {3, 4}, 1150 {7, 7}, 1151 {0, 0} 1152 } 1153 }, 1154 {1, 1, 3, 0, /* 0x9b */ 1155 {{0, 1}, 1156 {3, 4}, 1157 {7, 7}, 1158 {0, 0} 1159 } 1160 }, 1161 {0, 1, 2, 0, /* 0x9c */ 1162 {{2, 4}, 1163 {7, 7}, 1164 {0, 0}, 1165 {0, 0} 1166 } 1167 }, 1168 {1, 1, 3, 0, /* 0x9d */ 1169 {{0, 0}, 1170 {2, 4}, 1171 {7, 7}, 1172 {0, 0} 1173 } 1174 }, 1175 {0, 1, 2, 0, /* 0x9e */ 1176 {{1, 4}, 1177 {7, 7}, 1178 {0, 0}, 1179 {0, 0} 1180 } 1181 }, 1182 {1, 1, 2, 0, /* 0x9f */ 1183 {{0, 4}, 1184 {7, 7}, 1185 {0, 0}, 1186 {0, 0} 1187 } 1188 }, 1189 {0, 1, 2, 0, /* 0xa0 */ 1190 {{5, 5}, 1191 {7, 7}, 1192 {0, 0}, 1193 {0, 0} 1194 } 1195 }, 1196 {1, 1, 3, 0, /* 0xa1 */ 1197 {{0, 0}, 1198 {5, 5}, 1199 {7, 7}, 1200 {0, 0} 1201 } 1202 }, 1203 {0, 1, 3, 0, /* 0xa2 */ 1204 {{1, 1}, 1205 {5, 5}, 1206 {7, 7}, 1207 {0, 0} 1208 } 1209 }, 1210 {1, 1, 3, 0, /* 0xa3 */ 1211 {{0, 1}, 1212 {5, 5}, 1213 {7, 7}, 1214 {0, 0} 1215 } 1216 }, 1217 {0, 1, 3, 0, /* 0xa4 */ 1218 {{2, 2}, 1219 {5, 5}, 1220 {7, 7}, 1221 {0, 0} 1222 } 1223 }, 1224 {1, 1, 4, 0, /* 0xa5 */ 1225 {{0, 0}, 1226 {2, 2}, 1227 {5, 5}, 1228 {7, 7} 1229 } 1230 }, 1231 {0, 1, 3, 0, /* 0xa6 */ 1232 {{1, 2}, 1233 {5, 5}, 1234 {7, 7}, 1235 {0, 0} 1236 } 1237 }, 1238 {1, 1, 3, 0, /* 0xa7 */ 1239 {{0, 2}, 1240 {5, 5}, 1241 {7, 7}, 1242 {0, 0} 1243 } 1244 }, 1245 {0, 1, 3, 0, /* 0xa8 */ 1246 {{3, 3}, 1247 {5, 5}, 1248 {7, 7}, 1249 {0, 0} 1250 } 1251 }, 1252 {1, 1, 4, 0, /* 0xa9 */ 1253 {{0, 0}, 1254 {3, 3}, 1255 {5, 5}, 1256 {7, 7} 1257 } 1258 }, 1259 {0, 1, 4, 0, /* 0xaa */ 1260 {{1, 1}, 1261 {3, 3}, 1262 {5, 5}, 1263 {7, 7} 1264 } 1265 }, 1266 {1, 1, 4, 0, /* 0xab */ 1267 {{0, 1}, 1268 {3, 3}, 1269 {5, 5}, 1270 {7, 7} 1271 } 1272 }, 1273 {0, 1, 3, 0, /* 0xac */ 1274 {{2, 3}, 1275 {5, 5}, 1276 {7, 7}, 1277 {0, 0} 1278 } 1279 }, 1280 {1, 1, 4, 0, /* 0xad */ 1281 {{0, 0}, 1282 {2, 3}, 1283 {5, 5}, 1284 {7, 7} 1285 } 1286 }, 1287 {0, 1, 3, 0, /* 0xae */ 1288 {{1, 3}, 1289 {5, 5}, 1290 {7, 7}, 1291 {0, 0} 1292 } 1293 }, 1294 {1, 1, 3, 0, /* 0xaf */ 1295 {{0, 3}, 1296 {5, 5}, 1297 {7, 7}, 1298 {0, 0} 1299 } 1300 }, 1301 {0, 1, 2, 0, /* 0xb0 */ 1302 {{4, 5}, 1303 {7, 7}, 1304 {0, 0}, 1305 {0, 0} 1306 } 1307 }, 1308 {1, 1, 3, 0, /* 0xb1 */ 1309 {{0, 0}, 1310 {4, 5}, 1311 {7, 7}, 1312 {0, 0} 1313 } 1314 }, 1315 {0, 1, 3, 0, /* 0xb2 */ 1316 {{1, 1}, 1317 {4, 5}, 1318 {7, 7}, 1319 {0, 0} 1320 } 1321 }, 1322 {1, 1, 3, 0, /* 0xb3 */ 1323 {{0, 1}, 1324 {4, 5}, 1325 {7, 7}, 1326 {0, 0} 1327 } 1328 }, 1329 {0, 1, 3, 0, /* 0xb4 */ 1330 {{2, 2}, 1331 {4, 5}, 1332 {7, 7}, 1333 {0, 0} 1334 } 1335 }, 1336 {1, 1, 4, 0, /* 0xb5 */ 1337 {{0, 0}, 1338 {2, 2}, 1339 {4, 5}, 1340 {7, 7} 1341 } 1342 }, 1343 {0, 1, 3, 0, /* 0xb6 */ 1344 {{1, 2}, 1345 {4, 5}, 1346 {7, 7}, 1347 {0, 0} 1348 } 1349 }, 1350 {1, 1, 3, 0, /* 0xb7 */ 1351 {{0, 2}, 1352 {4, 5}, 1353 {7, 7}, 1354 {0, 0} 1355 } 1356 }, 1357 {0, 1, 2, 0, /* 0xb8 */ 1358 {{3, 5}, 1359 {7, 7}, 1360 {0, 0}, 1361 {0, 0} 1362 } 1363 }, 1364 {1, 1, 3, 0, /* 0xb9 */ 1365 {{0, 0}, 1366 {3, 5}, 1367 {7, 7}, 1368 {0, 0} 1369 } 1370 }, 1371 {0, 1, 3, 0, /* 0xba */ 1372 {{1, 1}, 1373 {3, 5}, 1374 {7, 7}, 1375 {0, 0} 1376 } 1377 }, 1378 {1, 1, 3, 0, /* 0xbb */ 1379 {{0, 1}, 1380 {3, 5}, 1381 {7, 7}, 1382 {0, 0} 1383 } 1384 }, 1385 {0, 1, 2, 0, /* 0xbc */ 1386 {{2, 5}, 1387 {7, 7}, 1388 {0, 0}, 1389 {0, 0} 1390 } 1391 }, 1392 {1, 1, 3, 0, /* 0xbd */ 1393 {{0, 0}, 1394 {2, 5}, 1395 {7, 7}, 1396 {0, 0} 1397 } 1398 }, 1399 {0, 1, 2, 0, /* 0xbe */ 1400 {{1, 5}, 1401 {7, 7}, 1402 {0, 0}, 1403 {0, 0} 1404 } 1405 }, 1406 {1, 1, 2, 0, /* 0xbf */ 1407 {{0, 5}, 1408 {7, 7}, 1409 {0, 0}, 1410 {0, 0} 1411 } 1412 }, 1413 {0, 1, 1, 0, /* 0xc0 */ 1414 {{6, 7}, 1415 {0, 0}, 1416 {0, 0}, 1417 {0, 0} 1418 } 1419 }, 1420 {1, 1, 2, 0, /* 0xc1 */ 1421 {{0, 0}, 1422 {6, 7}, 1423 {0, 0}, 1424 {0, 0} 1425 } 1426 }, 1427 {0, 1, 2, 0, /* 0xc2 */ 1428 {{1, 1}, 1429 {6, 7}, 1430 {0, 0}, 1431 {0, 0} 1432 } 1433 }, 1434 {1, 1, 2, 0, /* 0xc3 */ 1435 {{0, 1}, 1436 {6, 7}, 1437 {0, 0}, 1438 {0, 0} 1439 } 1440 }, 1441 {0, 1, 2, 0, /* 0xc4 */ 1442 {{2, 2}, 1443 {6, 7}, 1444 {0, 0}, 1445 {0, 0} 1446 } 1447 }, 1448 {1, 1, 3, 0, /* 0xc5 */ 1449 {{0, 0}, 1450 {2, 2}, 1451 {6, 7}, 1452 {0, 0} 1453 } 1454 }, 1455 {0, 1, 2, 0, /* 0xc6 */ 1456 {{1, 2}, 1457 {6, 7}, 1458 {0, 0}, 1459 {0, 0} 1460 } 1461 }, 1462 {1, 1, 2, 0, /* 0xc7 */ 1463 {{0, 2}, 1464 {6, 7}, 1465 {0, 0}, 1466 {0, 0} 1467 } 1468 }, 1469 {0, 1, 2, 0, /* 0xc8 */ 1470 {{3, 3}, 1471 {6, 7}, 1472 {0, 0}, 1473 {0, 0} 1474 } 1475 }, 1476 {1, 1, 3, 0, /* 0xc9 */ 1477 {{0, 0}, 1478 {3, 3}, 1479 {6, 7}, 1480 {0, 0} 1481 } 1482 }, 1483 {0, 1, 3, 0, /* 0xca */ 1484 {{1, 1}, 1485 {3, 3}, 1486 {6, 7}, 1487 {0, 0} 1488 } 1489 }, 1490 {1, 1, 3, 0, /* 0xcb */ 1491 {{0, 1}, 1492 {3, 3}, 1493 {6, 7}, 1494 {0, 0} 1495 } 1496 }, 1497 {0, 1, 2, 0, /* 0xcc */ 1498 {{2, 3}, 1499 {6, 7}, 1500 {0, 0}, 1501 {0, 0} 1502 } 1503 }, 1504 {1, 1, 3, 0, /* 0xcd */ 1505 {{0, 0}, 1506 {2, 3}, 1507 {6, 7}, 1508 {0, 0} 1509 } 1510 }, 1511 {0, 1, 2, 0, /* 0xce */ 1512 {{1, 3}, 1513 {6, 7}, 1514 {0, 0}, 1515 {0, 0} 1516 } 1517 }, 1518 {1, 1, 2, 0, /* 0xcf */ 1519 {{0, 3}, 1520 {6, 7}, 1521 {0, 0}, 1522 {0, 0} 1523 } 1524 }, 1525 {0, 1, 2, 0, /* 0xd0 */ 1526 {{4, 4}, 1527 {6, 7}, 1528 {0, 0}, 1529 {0, 0} 1530 } 1531 }, 1532 {1, 1, 3, 0, /* 0xd1 */ 1533 {{0, 0}, 1534 {4, 4}, 1535 {6, 7}, 1536 {0, 0} 1537 } 1538 }, 1539 {0, 1, 3, 0, /* 0xd2 */ 1540 {{1, 1}, 1541 {4, 4}, 1542 {6, 7}, 1543 {0, 0} 1544 } 1545 }, 1546 {1, 1, 3, 0, /* 0xd3 */ 1547 {{0, 1}, 1548 {4, 4}, 1549 {6, 7}, 1550 {0, 0} 1551 } 1552 }, 1553 {0, 1, 3, 0, /* 0xd4 */ 1554 {{2, 2}, 1555 {4, 4}, 1556 {6, 7}, 1557 {0, 0} 1558 } 1559 }, 1560 {1, 1, 4, 0, /* 0xd5 */ 1561 {{0, 0}, 1562 {2, 2}, 1563 {4, 4}, 1564 {6, 7} 1565 } 1566 }, 1567 {0, 1, 3, 0, /* 0xd6 */ 1568 {{1, 2}, 1569 {4, 4}, 1570 {6, 7}, 1571 {0, 0} 1572 } 1573 }, 1574 {1, 1, 3, 0, /* 0xd7 */ 1575 {{0, 2}, 1576 {4, 4}, 1577 {6, 7}, 1578 {0, 0} 1579 } 1580 }, 1581 {0, 1, 2, 0, /* 0xd8 */ 1582 {{3, 4}, 1583 {6, 7}, 1584 {0, 0}, 1585 {0, 0} 1586 } 1587 }, 1588 {1, 1, 3, 0, /* 0xd9 */ 1589 {{0, 0}, 1590 {3, 4}, 1591 {6, 7}, 1592 {0, 0} 1593 } 1594 }, 1595 {0, 1, 3, 0, /* 0xda */ 1596 {{1, 1}, 1597 {3, 4}, 1598 {6, 7}, 1599 {0, 0} 1600 } 1601 }, 1602 {1, 1, 3, 0, /* 0xdb */ 1603 {{0, 1}, 1604 {3, 4}, 1605 {6, 7}, 1606 {0, 0} 1607 } 1608 }, 1609 {0, 1, 2, 0, /* 0xdc */ 1610 {{2, 4}, 1611 {6, 7}, 1612 {0, 0}, 1613 {0, 0} 1614 } 1615 }, 1616 {1, 1, 3, 0, /* 0xdd */ 1617 {{0, 0}, 1618 {2, 4}, 1619 {6, 7}, 1620 {0, 0} 1621 } 1622 }, 1623 {0, 1, 2, 0, /* 0xde */ 1624 {{1, 4}, 1625 {6, 7}, 1626 {0, 0}, 1627 {0, 0} 1628 } 1629 }, 1630 {1, 1, 2, 0, /* 0xdf */ 1631 {{0, 4}, 1632 {6, 7}, 1633 {0, 0}, 1634 {0, 0} 1635 } 1636 }, 1637 {0, 1, 1, 0, /* 0xe0 */ 1638 {{5, 7}, 1639 {0, 0}, 1640 {0, 0}, 1641 {0, 0} 1642 } 1643 }, 1644 {1, 1, 2, 0, /* 0xe1 */ 1645 {{0, 0}, 1646 {5, 7}, 1647 {0, 0}, 1648 {0, 0} 1649 } 1650 }, 1651 {0, 1, 2, 0, /* 0xe2 */ 1652 {{1, 1}, 1653 {5, 7}, 1654 {0, 0}, 1655 {0, 0} 1656 } 1657 }, 1658 {1, 1, 2, 0, /* 0xe3 */ 1659 {{0, 1}, 1660 {5, 7}, 1661 {0, 0}, 1662 {0, 0} 1663 } 1664 }, 1665 {0, 1, 2, 0, /* 0xe4 */ 1666 {{2, 2}, 1667 {5, 7}, 1668 {0, 0}, 1669 {0, 0} 1670 } 1671 }, 1672 {1, 1, 3, 0, /* 0xe5 */ 1673 {{0, 0}, 1674 {2, 2}, 1675 {5, 7}, 1676 {0, 0} 1677 } 1678 }, 1679 {0, 1, 2, 0, /* 0xe6 */ 1680 {{1, 2}, 1681 {5, 7}, 1682 {0, 0}, 1683 {0, 0} 1684 } 1685 }, 1686 {1, 1, 2, 0, /* 0xe7 */ 1687 {{0, 2}, 1688 {5, 7}, 1689 {0, 0}, 1690 {0, 0} 1691 } 1692 }, 1693 {0, 1, 2, 0, /* 0xe8 */ 1694 {{3, 3}, 1695 {5, 7}, 1696 {0, 0}, 1697 {0, 0} 1698 } 1699 }, 1700 {1, 1, 3, 0, /* 0xe9 */ 1701 {{0, 0}, 1702 {3, 3}, 1703 {5, 7}, 1704 {0, 0} 1705 } 1706 }, 1707 {0, 1, 3, 0, /* 0xea */ 1708 {{1, 1}, 1709 {3, 3}, 1710 {5, 7}, 1711 {0, 0} 1712 } 1713 }, 1714 {1, 1, 3, 0, /* 0xeb */ 1715 {{0, 1}, 1716 {3, 3}, 1717 {5, 7}, 1718 {0, 0} 1719 } 1720 }, 1721 {0, 1, 2, 0, /* 0xec */ 1722 {{2, 3}, 1723 {5, 7}, 1724 {0, 0}, 1725 {0, 0} 1726 } 1727 }, 1728 {1, 1, 3, 0, /* 0xed */ 1729 {{0, 0}, 1730 {2, 3}, 1731 {5, 7}, 1732 {0, 0} 1733 } 1734 }, 1735 {0, 1, 2, 0, /* 0xee */ 1736 {{1, 3}, 1737 {5, 7}, 1738 {0, 0}, 1739 {0, 0} 1740 } 1741 }, 1742 {1, 1, 2, 0, /* 0xef */ 1743 {{0, 3}, 1744 {5, 7}, 1745 {0, 0}, 1746 {0, 0} 1747 } 1748 }, 1749 {0, 1, 1, 0, /* 0xf0 */ 1750 {{4, 7}, 1751 {0, 0}, 1752 {0, 0}, 1753 {0, 0} 1754 } 1755 }, 1756 {1, 1, 2, 0, /* 0xf1 */ 1757 {{0, 0}, 1758 {4, 7}, 1759 {0, 0}, 1760 {0, 0} 1761 } 1762 }, 1763 {0, 1, 2, 0, /* 0xf2 */ 1764 {{1, 1}, 1765 {4, 7}, 1766 {0, 0}, 1767 {0, 0} 1768 } 1769 }, 1770 {1, 1, 2, 0, /* 0xf3 */ 1771 {{0, 1}, 1772 {4, 7}, 1773 {0, 0}, 1774 {0, 0} 1775 } 1776 }, 1777 {0, 1, 2, 0, /* 0xf4 */ 1778 {{2, 2}, 1779 {4, 7}, 1780 {0, 0}, 1781 {0, 0} 1782 } 1783 }, 1784 {1, 1, 3, 0, /* 0xf5 */ 1785 {{0, 0}, 1786 {2, 2}, 1787 {4, 7}, 1788 {0, 0} 1789 } 1790 }, 1791 {0, 1, 2, 0, /* 0xf6 */ 1792 {{1, 2}, 1793 {4, 7}, 1794 {0, 0}, 1795 {0, 0} 1796 } 1797 }, 1798 {1, 1, 2, 0, /* 0xf7 */ 1799 {{0, 2}, 1800 {4, 7}, 1801 {0, 0}, 1802 {0, 0} 1803 } 1804 }, 1805 {0, 1, 1, 0, /* 0xf8 */ 1806 {{3, 7}, 1807 {0, 0}, 1808 {0, 0}, 1809 {0, 0} 1810 } 1811 }, 1812 {1, 1, 2, 0, /* 0xf9 */ 1813 {{0, 0}, 1814 {3, 7}, 1815 {0, 0}, 1816 {0, 0} 1817 } 1818 }, 1819 {0, 1, 2, 0, /* 0xfa */ 1820 {{1, 1}, 1821 {3, 7}, 1822 {0, 0}, 1823 {0, 0} 1824 } 1825 }, 1826 {1, 1, 2, 0, /* 0xfb */ 1827 {{0, 1}, 1828 {3, 7}, 1829 {0, 0}, 1830 {0, 0} 1831 } 1832 }, 1833 {0, 1, 1, 0, /* 0xfc */ 1834 {{2, 7}, 1835 {0, 0}, 1836 {0, 0}, 1837 {0, 0} 1838 } 1839 }, 1840 {1, 1, 2, 0, /* 0xfd */ 1841 {{0, 0}, 1842 {2, 7}, 1843 {0, 0}, 1844 {0, 0} 1845 } 1846 }, 1847 {0, 1, 1, 0, /* 0xfe */ 1848 {{1, 7}, 1849 {0, 0}, 1850 {0, 0}, 1851 {0, 0} 1852 } 1853 }, 1854 {1, 1, 1, 0, /* 0xff */ 1855 {{0, 7}, 1856 {0, 0}, 1857 {0, 0}, 1858 {0, 0} 1859 } 1860 } 1861}; 1862 1863 1864int 1865sctp_is_address_in_scope(struct sctp_ifa *ifa, 1866 struct sctp_scoping *scope, 1867 int do_update) 1868{ 1869 if ((scope->loopback_scope == 0) && 1870 (ifa->ifn_p) && SCTP_IFN_IS_IFT_LOOP(ifa->ifn_p)) { 1871 /* 1872 * skip loopback if not in scope * 1873 */ 1874 return (0); 1875 } 1876 switch (ifa->address.sa.sa_family) { 1877#ifdef INET 1878 case AF_INET: 1879 if (scope->ipv4_addr_legal) { 1880 struct sockaddr_in *sin; 1881 1882 sin = (struct sockaddr_in *)&ifa->address.sin; 1883 if (sin->sin_addr.s_addr == 0) { 1884 /* not in scope , unspecified */ 1885 return (0); 1886 } 1887 if ((scope->ipv4_local_scope == 0) && 1888 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 1889 /* private address not in scope */ 1890 return (0); 1891 } 1892 } else { 1893 return (0); 1894 } 1895 break; 1896#endif 1897#ifdef INET6 1898 case AF_INET6: 1899 if (scope->ipv6_addr_legal) { 1900 struct sockaddr_in6 *sin6; 1901 1902 /* 1903 * Must update the flags, bummer, which means any 1904 * IFA locks must now be applied HERE <-> 1905 */ 1906 if (do_update) { 1907 sctp_gather_internal_ifa_flags(ifa); 1908 } 1909 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 1910 return (0); 1911 } 1912 /* ok to use deprecated addresses? */ 1913 sin6 = (struct sockaddr_in6 *)&ifa->address.sin6; 1914 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1915 /* skip unspecifed addresses */ 1916 return (0); 1917 } 1918 if ( /* (local_scope == 0) && */ 1919 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) { 1920 return (0); 1921 } 1922 if ((scope->site_scope == 0) && 1923 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 1924 return (0); 1925 } 1926 } else { 1927 return (0); 1928 } 1929 break; 1930#endif 1931 default: 1932 return (0); 1933 } 1934 return (1); 1935} 1936 1937static struct mbuf * 1938sctp_add_addr_to_mbuf(struct mbuf *m, struct sctp_ifa *ifa, uint16_t * len) 1939{ 1940#if defined(INET) || defined(INET6) 1941 struct sctp_paramhdr *parmh; 1942 struct mbuf *mret; 1943 uint16_t plen; 1944 1945#endif 1946 1947 switch (ifa->address.sa.sa_family) { 1948#ifdef INET 1949 case AF_INET: 1950 plen = (uint16_t) sizeof(struct sctp_ipv4addr_param); 1951 break; 1952#endif 1953#ifdef INET6 1954 case AF_INET6: 1955 plen = (uint16_t) sizeof(struct sctp_ipv6addr_param); 1956 break; 1957#endif 1958 default: 1959 return (m); 1960 } 1961#if defined(INET) || defined(INET6) 1962 if (M_TRAILINGSPACE(m) >= plen) { 1963 /* easy side we just drop it on the end */ 1964 parmh = (struct sctp_paramhdr *)(SCTP_BUF_AT(m, SCTP_BUF_LEN(m))); 1965 mret = m; 1966 } else { 1967 /* Need more space */ 1968 mret = m; 1969 while (SCTP_BUF_NEXT(mret) != NULL) { 1970 mret = SCTP_BUF_NEXT(mret); 1971 } 1972 SCTP_BUF_NEXT(mret) = sctp_get_mbuf_for_msg(plen, 0, M_DONTWAIT, 1, MT_DATA); 1973 if (SCTP_BUF_NEXT(mret) == NULL) { 1974 /* We are hosed, can't add more addresses */ 1975 return (m); 1976 } 1977 mret = SCTP_BUF_NEXT(mret); 1978 parmh = mtod(mret, struct sctp_paramhdr *); 1979 } 1980 /* now add the parameter */ 1981 switch (ifa->address.sa.sa_family) { 1982#ifdef INET 1983 case AF_INET: 1984 { 1985 struct sctp_ipv4addr_param *ipv4p; 1986 struct sockaddr_in *sin; 1987 1988 sin = (struct sockaddr_in *)&ifa->address.sin; 1989 ipv4p = (struct sctp_ipv4addr_param *)parmh; 1990 parmh->param_type = htons(SCTP_IPV4_ADDRESS); 1991 parmh->param_length = htons(plen); 1992 ipv4p->addr = sin->sin_addr.s_addr; 1993 SCTP_BUF_LEN(mret) += plen; 1994 break; 1995 } 1996#endif 1997#ifdef INET6 1998 case AF_INET6: 1999 { 2000 struct sctp_ipv6addr_param *ipv6p; 2001 struct sockaddr_in6 *sin6; 2002 2003 sin6 = (struct sockaddr_in6 *)&ifa->address.sin6; 2004 ipv6p = (struct sctp_ipv6addr_param *)parmh; 2005 parmh->param_type = htons(SCTP_IPV6_ADDRESS); 2006 parmh->param_length = htons(plen); 2007 memcpy(ipv6p->addr, &sin6->sin6_addr, 2008 sizeof(ipv6p->addr)); 2009 /* clear embedded scope in the address */ 2010 in6_clearscope((struct in6_addr *)ipv6p->addr); 2011 SCTP_BUF_LEN(mret) += plen; 2012 break; 2013 } 2014#endif 2015 default: 2016 return (m); 2017 } 2018 if (len != NULL) { 2019 *len += plen; 2020 } 2021 return (mret); 2022#endif 2023} 2024 2025 2026struct mbuf * 2027sctp_add_addresses_to_i_ia(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2028 struct sctp_scoping *scope, 2029 struct mbuf *m_at, int cnt_inits_to, 2030 uint16_t * padding_len, uint16_t * chunk_len) 2031{ 2032 struct sctp_vrf *vrf = NULL; 2033 int cnt, limit_out = 0, total_count; 2034 uint32_t vrf_id; 2035 2036 vrf_id = inp->def_vrf_id; 2037 SCTP_IPI_ADDR_RLOCK(); 2038 vrf = sctp_find_vrf(vrf_id); 2039 if (vrf == NULL) { 2040 SCTP_IPI_ADDR_RUNLOCK(); 2041 return (m_at); 2042 } 2043 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 2044 struct sctp_ifa *sctp_ifap; 2045 struct sctp_ifn *sctp_ifnp; 2046 2047 cnt = cnt_inits_to; 2048 if (vrf->total_ifa_count > SCTP_COUNT_LIMIT) { 2049 limit_out = 1; 2050 cnt = SCTP_ADDRESS_LIMIT; 2051 goto skip_count; 2052 } 2053 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2054 if ((scope->loopback_scope == 0) && 2055 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2056 /* 2057 * Skip loopback devices if loopback_scope 2058 * not set 2059 */ 2060 continue; 2061 } 2062 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2063#ifdef INET 2064 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2065 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2066 &sctp_ifap->address.sin.sin_addr) != 0)) { 2067 continue; 2068 } 2069#endif 2070#ifdef INET6 2071 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2072 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2073 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2074 continue; 2075 } 2076#endif 2077 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2078 continue; 2079 } 2080 if (sctp_is_address_in_scope(sctp_ifap, scope, 1) == 0) { 2081 continue; 2082 } 2083 cnt++; 2084 if (cnt > SCTP_ADDRESS_LIMIT) { 2085 break; 2086 } 2087 } 2088 if (cnt > SCTP_ADDRESS_LIMIT) { 2089 break; 2090 } 2091 } 2092skip_count: 2093 if (cnt > 1) { 2094 total_count = 0; 2095 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2096 cnt = 0; 2097 if ((scope->loopback_scope == 0) && 2098 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2099 /* 2100 * Skip loopback devices if 2101 * loopback_scope not set 2102 */ 2103 continue; 2104 } 2105 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2106#ifdef INET 2107 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2108 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2109 &sctp_ifap->address.sin.sin_addr) != 0)) { 2110 continue; 2111 } 2112#endif 2113#ifdef INET6 2114 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2115 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2116 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2117 continue; 2118 } 2119#endif 2120 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2121 continue; 2122 } 2123 if (sctp_is_address_in_scope(sctp_ifap, 2124 scope, 0) == 0) { 2125 continue; 2126 } 2127 if ((chunk_len != NULL) && 2128 (padding_len != NULL) && 2129 (*padding_len > 0)) { 2130 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2131 SCTP_BUF_LEN(m_at) += *padding_len; 2132 *chunk_len += *padding_len; 2133 *padding_len = 0; 2134 } 2135 m_at = sctp_add_addr_to_mbuf(m_at, sctp_ifap, chunk_len); 2136 if (limit_out) { 2137 cnt++; 2138 total_count++; 2139 if (cnt >= 2) { 2140 /* 2141 * two from each 2142 * address 2143 */ 2144 break; 2145 } 2146 if (total_count > SCTP_ADDRESS_LIMIT) { 2147 /* No more addresses */ 2148 break; 2149 } 2150 } 2151 } 2152 } 2153 } 2154 } else { 2155 struct sctp_laddr *laddr; 2156 2157 cnt = cnt_inits_to; 2158 /* First, how many ? */ 2159 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2160 if (laddr->ifa == NULL) { 2161 continue; 2162 } 2163 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) 2164 /* 2165 * Address being deleted by the system, dont 2166 * list. 2167 */ 2168 continue; 2169 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2170 /* 2171 * Address being deleted on this ep don't 2172 * list. 2173 */ 2174 continue; 2175 } 2176 if (sctp_is_address_in_scope(laddr->ifa, 2177 scope, 1) == 0) { 2178 continue; 2179 } 2180 cnt++; 2181 } 2182 /* 2183 * To get through a NAT we only list addresses if we have 2184 * more than one. That way if you just bind a single address 2185 * we let the source of the init dictate our address. 2186 */ 2187 if (cnt > 1) { 2188 cnt = cnt_inits_to; 2189 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2190 if (laddr->ifa == NULL) { 2191 continue; 2192 } 2193 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) { 2194 continue; 2195 } 2196 if (sctp_is_address_in_scope(laddr->ifa, 2197 scope, 0) == 0) { 2198 continue; 2199 } 2200 if ((chunk_len != NULL) && 2201 (padding_len != NULL) && 2202 (*padding_len > 0)) { 2203 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2204 SCTP_BUF_LEN(m_at) += *padding_len; 2205 *chunk_len += *padding_len; 2206 *padding_len = 0; 2207 } 2208 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa, chunk_len); 2209 cnt++; 2210 if (cnt >= SCTP_ADDRESS_LIMIT) { 2211 break; 2212 } 2213 } 2214 } 2215 } 2216 SCTP_IPI_ADDR_RUNLOCK(); 2217 return (m_at); 2218} 2219 2220static struct sctp_ifa * 2221sctp_is_ifa_addr_preferred(struct sctp_ifa *ifa, 2222 uint8_t dest_is_loop, 2223 uint8_t dest_is_priv, 2224 sa_family_t fam) 2225{ 2226 uint8_t dest_is_global = 0; 2227 2228 /* dest_is_priv is true if destination is a private address */ 2229 /* dest_is_loop is true if destination is a loopback addresses */ 2230 2231 /** 2232 * Here we determine if its a preferred address. A preferred address 2233 * means it is the same scope or higher scope then the destination. 2234 * L = loopback, P = private, G = global 2235 * ----------------------------------------- 2236 * src | dest | result 2237 * ---------------------------------------- 2238 * L | L | yes 2239 * ----------------------------------------- 2240 * P | L | yes-v4 no-v6 2241 * ----------------------------------------- 2242 * G | L | yes-v4 no-v6 2243 * ----------------------------------------- 2244 * L | P | no 2245 * ----------------------------------------- 2246 * P | P | yes 2247 * ----------------------------------------- 2248 * G | P | no 2249 * ----------------------------------------- 2250 * L | G | no 2251 * ----------------------------------------- 2252 * P | G | no 2253 * ----------------------------------------- 2254 * G | G | yes 2255 * ----------------------------------------- 2256 */ 2257 2258 if (ifa->address.sa.sa_family != fam) { 2259 /* forget mis-matched family */ 2260 return (NULL); 2261 } 2262 if ((dest_is_priv == 0) && (dest_is_loop == 0)) { 2263 dest_is_global = 1; 2264 } 2265 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Is destination preferred:"); 2266 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ifa->address.sa); 2267 /* Ok the address may be ok */ 2268#ifdef INET6 2269 if (fam == AF_INET6) { 2270 /* ok to use deprecated addresses? no lets not! */ 2271 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2272 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:1\n"); 2273 return (NULL); 2274 } 2275 if (ifa->src_is_priv && !ifa->src_is_loop) { 2276 if (dest_is_loop) { 2277 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:2\n"); 2278 return (NULL); 2279 } 2280 } 2281 if (ifa->src_is_glob) { 2282 if (dest_is_loop) { 2283 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:3\n"); 2284 return (NULL); 2285 } 2286 } 2287 } 2288#endif 2289 /* 2290 * Now that we know what is what, implement or table this could in 2291 * theory be done slicker (it used to be), but this is 2292 * straightforward and easier to validate :-) 2293 */ 2294 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src_loop:%d src_priv:%d src_glob:%d\n", 2295 ifa->src_is_loop, ifa->src_is_priv, ifa->src_is_glob); 2296 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dest_loop:%d dest_priv:%d dest_glob:%d\n", 2297 dest_is_loop, dest_is_priv, dest_is_global); 2298 2299 if ((ifa->src_is_loop) && (dest_is_priv)) { 2300 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:4\n"); 2301 return (NULL); 2302 } 2303 if ((ifa->src_is_glob) && (dest_is_priv)) { 2304 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:5\n"); 2305 return (NULL); 2306 } 2307 if ((ifa->src_is_loop) && (dest_is_global)) { 2308 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:6\n"); 2309 return (NULL); 2310 } 2311 if ((ifa->src_is_priv) && (dest_is_global)) { 2312 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:7\n"); 2313 return (NULL); 2314 } 2315 SCTPDBG(SCTP_DEBUG_OUTPUT3, "YES\n"); 2316 /* its a preferred address */ 2317 return (ifa); 2318} 2319 2320static struct sctp_ifa * 2321sctp_is_ifa_addr_acceptable(struct sctp_ifa *ifa, 2322 uint8_t dest_is_loop, 2323 uint8_t dest_is_priv, 2324 sa_family_t fam) 2325{ 2326 uint8_t dest_is_global = 0; 2327 2328 /** 2329 * Here we determine if its a acceptable address. A acceptable 2330 * address means it is the same scope or higher scope but we can 2331 * allow for NAT which means its ok to have a global dest and a 2332 * private src. 2333 * 2334 * L = loopback, P = private, G = global 2335 * ----------------------------------------- 2336 * src | dest | result 2337 * ----------------------------------------- 2338 * L | L | yes 2339 * ----------------------------------------- 2340 * P | L | yes-v4 no-v6 2341 * ----------------------------------------- 2342 * G | L | yes 2343 * ----------------------------------------- 2344 * L | P | no 2345 * ----------------------------------------- 2346 * P | P | yes 2347 * ----------------------------------------- 2348 * G | P | yes - May not work 2349 * ----------------------------------------- 2350 * L | G | no 2351 * ----------------------------------------- 2352 * P | G | yes - May not work 2353 * ----------------------------------------- 2354 * G | G | yes 2355 * ----------------------------------------- 2356 */ 2357 2358 if (ifa->address.sa.sa_family != fam) { 2359 /* forget non matching family */ 2360 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa_fam:%d fam:%d\n", 2361 ifa->address.sa.sa_family, fam); 2362 return (NULL); 2363 } 2364 /* Ok the address may be ok */ 2365 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, &ifa->address.sa); 2366 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst_is_loop:%d dest_is_priv:%d\n", 2367 dest_is_loop, dest_is_priv); 2368 if ((dest_is_loop == 0) && (dest_is_priv == 0)) { 2369 dest_is_global = 1; 2370 } 2371#ifdef INET6 2372 if (fam == AF_INET6) { 2373 /* ok to use deprecated addresses? */ 2374 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2375 return (NULL); 2376 } 2377 if (ifa->src_is_priv) { 2378 /* Special case, linklocal to loop */ 2379 if (dest_is_loop) 2380 return (NULL); 2381 } 2382 } 2383#endif 2384 /* 2385 * Now that we know what is what, implement our table. This could in 2386 * theory be done slicker (it used to be), but this is 2387 * straightforward and easier to validate :-) 2388 */ 2389 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_priv:%d\n", 2390 ifa->src_is_loop, 2391 dest_is_priv); 2392 if ((ifa->src_is_loop == 1) && (dest_is_priv)) { 2393 return (NULL); 2394 } 2395 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_glob:%d\n", 2396 ifa->src_is_loop, 2397 dest_is_global); 2398 if ((ifa->src_is_loop == 1) && (dest_is_global)) { 2399 return (NULL); 2400 } 2401 SCTPDBG(SCTP_DEBUG_OUTPUT3, "address is acceptable\n"); 2402 /* its an acceptable address */ 2403 return (ifa); 2404} 2405 2406int 2407sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa) 2408{ 2409 struct sctp_laddr *laddr; 2410 2411 if (stcb == NULL) { 2412 /* There are no restrictions, no TCB :-) */ 2413 return (0); 2414 } 2415 LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) { 2416 if (laddr->ifa == NULL) { 2417 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2418 __FUNCTION__); 2419 continue; 2420 } 2421 if (laddr->ifa == ifa) { 2422 /* Yes it is on the list */ 2423 return (1); 2424 } 2425 } 2426 return (0); 2427} 2428 2429 2430int 2431sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa) 2432{ 2433 struct sctp_laddr *laddr; 2434 2435 if (ifa == NULL) 2436 return (0); 2437 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2438 if (laddr->ifa == NULL) { 2439 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2440 __FUNCTION__); 2441 continue; 2442 } 2443 if ((laddr->ifa == ifa) && laddr->action == 0) 2444 /* same pointer */ 2445 return (1); 2446 } 2447 return (0); 2448} 2449 2450 2451 2452static struct sctp_ifa * 2453sctp_choose_boundspecific_inp(struct sctp_inpcb *inp, 2454 sctp_route_t * ro, 2455 uint32_t vrf_id, 2456 int non_asoc_addr_ok, 2457 uint8_t dest_is_priv, 2458 uint8_t dest_is_loop, 2459 sa_family_t fam) 2460{ 2461 struct sctp_laddr *laddr, *starting_point; 2462 void *ifn; 2463 int resettotop = 0; 2464 struct sctp_ifn *sctp_ifn; 2465 struct sctp_ifa *sctp_ifa, *sifa; 2466 struct sctp_vrf *vrf; 2467 uint32_t ifn_index; 2468 2469 vrf = sctp_find_vrf(vrf_id); 2470 if (vrf == NULL) 2471 return (NULL); 2472 2473 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2474 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2475 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2476 /* 2477 * first question, is the ifn we will emit on in our list, if so, we 2478 * want such an address. Note that we first looked for a preferred 2479 * address. 2480 */ 2481 if (sctp_ifn) { 2482 /* is a preferred one on the interface we route out? */ 2483 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2484#ifdef INET 2485 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2486 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2487 &sctp_ifa->address.sin.sin_addr) != 0)) { 2488 continue; 2489 } 2490#endif 2491#ifdef INET6 2492 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2493 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2494 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2495 continue; 2496 } 2497#endif 2498 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2499 (non_asoc_addr_ok == 0)) 2500 continue; 2501 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, 2502 dest_is_loop, 2503 dest_is_priv, fam); 2504 if (sifa == NULL) 2505 continue; 2506 if (sctp_is_addr_in_ep(inp, sifa)) { 2507 atomic_add_int(&sifa->refcount, 1); 2508 return (sifa); 2509 } 2510 } 2511 } 2512 /* 2513 * ok, now we now need to find one on the list of the addresses. We 2514 * can't get one on the emitting interface so let's find first a 2515 * preferred one. If not that an acceptable one otherwise... we 2516 * return NULL. 2517 */ 2518 starting_point = inp->next_addr_touse; 2519once_again: 2520 if (inp->next_addr_touse == NULL) { 2521 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2522 resettotop = 1; 2523 } 2524 for (laddr = inp->next_addr_touse; laddr; 2525 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2526 if (laddr->ifa == NULL) { 2527 /* address has been removed */ 2528 continue; 2529 } 2530 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2531 /* address is being deleted */ 2532 continue; 2533 } 2534 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, 2535 dest_is_priv, fam); 2536 if (sifa == NULL) 2537 continue; 2538 atomic_add_int(&sifa->refcount, 1); 2539 return (sifa); 2540 } 2541 if (resettotop == 0) { 2542 inp->next_addr_touse = NULL; 2543 goto once_again; 2544 } 2545 inp->next_addr_touse = starting_point; 2546 resettotop = 0; 2547once_again_too: 2548 if (inp->next_addr_touse == NULL) { 2549 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2550 resettotop = 1; 2551 } 2552 /* ok, what about an acceptable address in the inp */ 2553 for (laddr = inp->next_addr_touse; laddr; 2554 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2555 if (laddr->ifa == NULL) { 2556 /* address has been removed */ 2557 continue; 2558 } 2559 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2560 /* address is being deleted */ 2561 continue; 2562 } 2563 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2564 dest_is_priv, fam); 2565 if (sifa == NULL) 2566 continue; 2567 atomic_add_int(&sifa->refcount, 1); 2568 return (sifa); 2569 } 2570 if (resettotop == 0) { 2571 inp->next_addr_touse = NULL; 2572 goto once_again_too; 2573 } 2574 /* 2575 * no address bound can be a source for the destination we are in 2576 * trouble 2577 */ 2578 return (NULL); 2579} 2580 2581 2582 2583static struct sctp_ifa * 2584sctp_choose_boundspecific_stcb(struct sctp_inpcb *inp, 2585 struct sctp_tcb *stcb, 2586 sctp_route_t * ro, 2587 uint32_t vrf_id, 2588 uint8_t dest_is_priv, 2589 uint8_t dest_is_loop, 2590 int non_asoc_addr_ok, 2591 sa_family_t fam) 2592{ 2593 struct sctp_laddr *laddr, *starting_point; 2594 void *ifn; 2595 struct sctp_ifn *sctp_ifn; 2596 struct sctp_ifa *sctp_ifa, *sifa; 2597 uint8_t start_at_beginning = 0; 2598 struct sctp_vrf *vrf; 2599 uint32_t ifn_index; 2600 2601 /* 2602 * first question, is the ifn we will emit on in our list, if so, we 2603 * want that one. 2604 */ 2605 vrf = sctp_find_vrf(vrf_id); 2606 if (vrf == NULL) 2607 return (NULL); 2608 2609 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2610 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2611 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2612 2613 /* 2614 * first question, is the ifn we will emit on in our list? If so, 2615 * we want that one. First we look for a preferred. Second, we go 2616 * for an acceptable. 2617 */ 2618 if (sctp_ifn) { 2619 /* first try for a preferred address on the ep */ 2620 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2621#ifdef INET 2622 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2623 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2624 &sctp_ifa->address.sin.sin_addr) != 0)) { 2625 continue; 2626 } 2627#endif 2628#ifdef INET6 2629 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2630 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2631 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2632 continue; 2633 } 2634#endif 2635 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2636 continue; 2637 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2638 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2639 if (sifa == NULL) 2640 continue; 2641 if (((non_asoc_addr_ok == 0) && 2642 (sctp_is_addr_restricted(stcb, sifa))) || 2643 (non_asoc_addr_ok && 2644 (sctp_is_addr_restricted(stcb, sifa)) && 2645 (!sctp_is_addr_pending(stcb, sifa)))) { 2646 /* on the no-no list */ 2647 continue; 2648 } 2649 atomic_add_int(&sifa->refcount, 1); 2650 return (sifa); 2651 } 2652 } 2653 /* next try for an acceptable address on the ep */ 2654 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2655#ifdef INET 2656 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2657 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2658 &sctp_ifa->address.sin.sin_addr) != 0)) { 2659 continue; 2660 } 2661#endif 2662#ifdef INET6 2663 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2664 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2665 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2666 continue; 2667 } 2668#endif 2669 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2670 continue; 2671 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2672 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2673 if (sifa == NULL) 2674 continue; 2675 if (((non_asoc_addr_ok == 0) && 2676 (sctp_is_addr_restricted(stcb, sifa))) || 2677 (non_asoc_addr_ok && 2678 (sctp_is_addr_restricted(stcb, sifa)) && 2679 (!sctp_is_addr_pending(stcb, sifa)))) { 2680 /* on the no-no list */ 2681 continue; 2682 } 2683 atomic_add_int(&sifa->refcount, 1); 2684 return (sifa); 2685 } 2686 } 2687 2688 } 2689 /* 2690 * if we can't find one like that then we must look at all addresses 2691 * bound to pick one at first preferable then secondly acceptable. 2692 */ 2693 starting_point = stcb->asoc.last_used_address; 2694sctp_from_the_top: 2695 if (stcb->asoc.last_used_address == NULL) { 2696 start_at_beginning = 1; 2697 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2698 } 2699 /* search beginning with the last used address */ 2700 for (laddr = stcb->asoc.last_used_address; laddr; 2701 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2702 if (laddr->ifa == NULL) { 2703 /* address has been removed */ 2704 continue; 2705 } 2706 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2707 /* address is being deleted */ 2708 continue; 2709 } 2710 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, dest_is_priv, fam); 2711 if (sifa == NULL) 2712 continue; 2713 if (((non_asoc_addr_ok == 0) && 2714 (sctp_is_addr_restricted(stcb, sifa))) || 2715 (non_asoc_addr_ok && 2716 (sctp_is_addr_restricted(stcb, sifa)) && 2717 (!sctp_is_addr_pending(stcb, sifa)))) { 2718 /* on the no-no list */ 2719 continue; 2720 } 2721 stcb->asoc.last_used_address = laddr; 2722 atomic_add_int(&sifa->refcount, 1); 2723 return (sifa); 2724 } 2725 if (start_at_beginning == 0) { 2726 stcb->asoc.last_used_address = NULL; 2727 goto sctp_from_the_top; 2728 } 2729 /* now try for any higher scope than the destination */ 2730 stcb->asoc.last_used_address = starting_point; 2731 start_at_beginning = 0; 2732sctp_from_the_top2: 2733 if (stcb->asoc.last_used_address == NULL) { 2734 start_at_beginning = 1; 2735 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2736 } 2737 /* search beginning with the last used address */ 2738 for (laddr = stcb->asoc.last_used_address; laddr; 2739 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2740 if (laddr->ifa == NULL) { 2741 /* address has been removed */ 2742 continue; 2743 } 2744 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2745 /* address is being deleted */ 2746 continue; 2747 } 2748 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2749 dest_is_priv, fam); 2750 if (sifa == NULL) 2751 continue; 2752 if (((non_asoc_addr_ok == 0) && 2753 (sctp_is_addr_restricted(stcb, sifa))) || 2754 (non_asoc_addr_ok && 2755 (sctp_is_addr_restricted(stcb, sifa)) && 2756 (!sctp_is_addr_pending(stcb, sifa)))) { 2757 /* on the no-no list */ 2758 continue; 2759 } 2760 stcb->asoc.last_used_address = laddr; 2761 atomic_add_int(&sifa->refcount, 1); 2762 return (sifa); 2763 } 2764 if (start_at_beginning == 0) { 2765 stcb->asoc.last_used_address = NULL; 2766 goto sctp_from_the_top2; 2767 } 2768 return (NULL); 2769} 2770 2771static struct sctp_ifa * 2772sctp_select_nth_preferred_addr_from_ifn_boundall(struct sctp_ifn *ifn, 2773 struct sctp_inpcb *inp, 2774 struct sctp_tcb *stcb, 2775 int non_asoc_addr_ok, 2776 uint8_t dest_is_loop, 2777 uint8_t dest_is_priv, 2778 int addr_wanted, 2779 sa_family_t fam, 2780 sctp_route_t * ro 2781) 2782{ 2783 struct sctp_ifa *ifa, *sifa; 2784 int num_eligible_addr = 0; 2785 2786#ifdef INET6 2787 struct sockaddr_in6 sin6, lsa6; 2788 2789 if (fam == AF_INET6) { 2790 memcpy(&sin6, &ro->ro_dst, sizeof(struct sockaddr_in6)); 2791 (void)sa6_recoverscope(&sin6); 2792 } 2793#endif /* INET6 */ 2794 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2795#ifdef INET 2796 if ((ifa->address.sa.sa_family == AF_INET) && 2797 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2798 &ifa->address.sin.sin_addr) != 0)) { 2799 continue; 2800 } 2801#endif 2802#ifdef INET6 2803 if ((ifa->address.sa.sa_family == AF_INET6) && 2804 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2805 &ifa->address.sin6.sin6_addr) != 0)) { 2806 continue; 2807 } 2808#endif 2809 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2810 (non_asoc_addr_ok == 0)) 2811 continue; 2812 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2813 dest_is_priv, fam); 2814 if (sifa == NULL) 2815 continue; 2816#ifdef INET6 2817 if (fam == AF_INET6 && 2818 dest_is_loop && 2819 sifa->src_is_loop && sifa->src_is_priv) { 2820 /* 2821 * don't allow fe80::1 to be a src on loop ::1, we 2822 * don't list it to the peer so we will get an 2823 * abort. 2824 */ 2825 continue; 2826 } 2827 if (fam == AF_INET6 && 2828 IN6_IS_ADDR_LINKLOCAL(&sifa->address.sin6.sin6_addr) && 2829 IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) { 2830 /* 2831 * link-local <-> link-local must belong to the same 2832 * scope. 2833 */ 2834 memcpy(&lsa6, &sifa->address.sin6, sizeof(struct sockaddr_in6)); 2835 (void)sa6_recoverscope(&lsa6); 2836 if (sin6.sin6_scope_id != lsa6.sin6_scope_id) { 2837 continue; 2838 } 2839 } 2840#endif /* INET6 */ 2841 2842 /* 2843 * Check if the IPv6 address matches to next-hop. In the 2844 * mobile case, old IPv6 address may be not deleted from the 2845 * interface. Then, the interface has previous and new 2846 * addresses. We should use one corresponding to the 2847 * next-hop. (by micchie) 2848 */ 2849#ifdef INET6 2850 if (stcb && fam == AF_INET6 && 2851 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2852 if (sctp_v6src_match_nexthop(&sifa->address.sin6, ro) 2853 == 0) { 2854 continue; 2855 } 2856 } 2857#endif 2858#ifdef INET 2859 /* Avoid topologically incorrect IPv4 address */ 2860 if (stcb && fam == AF_INET && 2861 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2862 if (sctp_v4src_match_nexthop(sifa, ro) == 0) { 2863 continue; 2864 } 2865 } 2866#endif 2867 if (stcb) { 2868 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2869 continue; 2870 } 2871 if (((non_asoc_addr_ok == 0) && 2872 (sctp_is_addr_restricted(stcb, sifa))) || 2873 (non_asoc_addr_ok && 2874 (sctp_is_addr_restricted(stcb, sifa)) && 2875 (!sctp_is_addr_pending(stcb, sifa)))) { 2876 /* 2877 * It is restricted for some reason.. 2878 * probably not yet added. 2879 */ 2880 continue; 2881 } 2882 } 2883 if (num_eligible_addr >= addr_wanted) { 2884 return (sifa); 2885 } 2886 num_eligible_addr++; 2887 } 2888 return (NULL); 2889} 2890 2891 2892static int 2893sctp_count_num_preferred_boundall(struct sctp_ifn *ifn, 2894 struct sctp_inpcb *inp, 2895 struct sctp_tcb *stcb, 2896 int non_asoc_addr_ok, 2897 uint8_t dest_is_loop, 2898 uint8_t dest_is_priv, 2899 sa_family_t fam) 2900{ 2901 struct sctp_ifa *ifa, *sifa; 2902 int num_eligible_addr = 0; 2903 2904 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2905#ifdef INET 2906 if ((ifa->address.sa.sa_family == AF_INET) && 2907 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2908 &ifa->address.sin.sin_addr) != 0)) { 2909 continue; 2910 } 2911#endif 2912#ifdef INET6 2913 if ((ifa->address.sa.sa_family == AF_INET6) && 2914 (stcb != NULL) && 2915 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2916 &ifa->address.sin6.sin6_addr) != 0)) { 2917 continue; 2918 } 2919#endif 2920 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2921 (non_asoc_addr_ok == 0)) { 2922 continue; 2923 } 2924 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2925 dest_is_priv, fam); 2926 if (sifa == NULL) { 2927 continue; 2928 } 2929 if (stcb) { 2930 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2931 continue; 2932 } 2933 if (((non_asoc_addr_ok == 0) && 2934 (sctp_is_addr_restricted(stcb, sifa))) || 2935 (non_asoc_addr_ok && 2936 (sctp_is_addr_restricted(stcb, sifa)) && 2937 (!sctp_is_addr_pending(stcb, sifa)))) { 2938 /* 2939 * It is restricted for some reason.. 2940 * probably not yet added. 2941 */ 2942 continue; 2943 } 2944 } 2945 num_eligible_addr++; 2946 } 2947 return (num_eligible_addr); 2948} 2949 2950static struct sctp_ifa * 2951sctp_choose_boundall(struct sctp_inpcb *inp, 2952 struct sctp_tcb *stcb, 2953 struct sctp_nets *net, 2954 sctp_route_t * ro, 2955 uint32_t vrf_id, 2956 uint8_t dest_is_priv, 2957 uint8_t dest_is_loop, 2958 int non_asoc_addr_ok, 2959 sa_family_t fam) 2960{ 2961 int cur_addr_num = 0, num_preferred = 0; 2962 void *ifn; 2963 struct sctp_ifn *sctp_ifn, *looked_at = NULL, *emit_ifn; 2964 struct sctp_ifa *sctp_ifa, *sifa; 2965 uint32_t ifn_index; 2966 struct sctp_vrf *vrf; 2967 2968#ifdef INET 2969 int retried = 0; 2970 2971#endif 2972 2973 /*- 2974 * For boundall we can use any address in the association. 2975 * If non_asoc_addr_ok is set we can use any address (at least in 2976 * theory). So we look for preferred addresses first. If we find one, 2977 * we use it. Otherwise we next try to get an address on the 2978 * interface, which we should be able to do (unless non_asoc_addr_ok 2979 * is false and we are routed out that way). In these cases where we 2980 * can't use the address of the interface we go through all the 2981 * ifn's looking for an address we can use and fill that in. Punting 2982 * means we send back address 0, which will probably cause problems 2983 * actually since then IP will fill in the address of the route ifn, 2984 * which means we probably already rejected it.. i.e. here comes an 2985 * abort :-<. 2986 */ 2987 vrf = sctp_find_vrf(vrf_id); 2988 if (vrf == NULL) 2989 return (NULL); 2990 2991 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2992 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2993 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn from route:%p ifn_index:%d\n", ifn, ifn_index); 2994 emit_ifn = looked_at = sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2995 if (sctp_ifn == NULL) { 2996 /* ?? We don't have this guy ?? */ 2997 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No ifn emit interface?\n"); 2998 goto bound_all_plan_b; 2999 } 3000 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn_index:%d name:%s is emit interface\n", 3001 ifn_index, sctp_ifn->ifn_name); 3002 3003 if (net) { 3004 cur_addr_num = net->indx_of_eligible_next_to_use; 3005 } 3006 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, 3007 inp, stcb, 3008 non_asoc_addr_ok, 3009 dest_is_loop, 3010 dest_is_priv, fam); 3011 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Found %d preferred source addresses for intf:%s\n", 3012 num_preferred, sctp_ifn->ifn_name); 3013 if (num_preferred == 0) { 3014 /* 3015 * no eligible addresses, we must use some other interface 3016 * address if we can find one. 3017 */ 3018 goto bound_all_plan_b; 3019 } 3020 /* 3021 * Ok we have num_eligible_addr set with how many we can use, this 3022 * may vary from call to call due to addresses being deprecated 3023 * etc.. 3024 */ 3025 if (cur_addr_num >= num_preferred) { 3026 cur_addr_num = 0; 3027 } 3028 /* 3029 * select the nth address from the list (where cur_addr_num is the 3030 * nth) and 0 is the first one, 1 is the second one etc... 3031 */ 3032 SCTPDBG(SCTP_DEBUG_OUTPUT2, "cur_addr_num:%d\n", cur_addr_num); 3033 3034 sctp_ifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3035 dest_is_priv, cur_addr_num, fam, ro); 3036 3037 /* if sctp_ifa is NULL something changed??, fall to plan b. */ 3038 if (sctp_ifa) { 3039 atomic_add_int(&sctp_ifa->refcount, 1); 3040 if (net) { 3041 /* save off where the next one we will want */ 3042 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3043 } 3044 return (sctp_ifa); 3045 } 3046 /* 3047 * plan_b: Look at all interfaces and find a preferred address. If 3048 * no preferred fall through to plan_c. 3049 */ 3050bound_all_plan_b: 3051 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan B\n"); 3052 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3053 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Examine interface %s\n", 3054 sctp_ifn->ifn_name); 3055 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3056 /* wrong base scope */ 3057 SCTPDBG(SCTP_DEBUG_OUTPUT2, "skip\n"); 3058 continue; 3059 } 3060 if ((sctp_ifn == looked_at) && looked_at) { 3061 /* already looked at this guy */ 3062 SCTPDBG(SCTP_DEBUG_OUTPUT2, "already seen\n"); 3063 continue; 3064 } 3065 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, 3066 dest_is_loop, dest_is_priv, fam); 3067 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3068 "Found ifn:%p %d preferred source addresses\n", 3069 ifn, num_preferred); 3070 if (num_preferred == 0) { 3071 /* None on this interface. */ 3072 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefered -- skipping to next\n"); 3073 continue; 3074 } 3075 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3076 "num preferred:%d on interface:%p cur_addr_num:%d\n", 3077 num_preferred, (void *)sctp_ifn, cur_addr_num); 3078 3079 /* 3080 * Ok we have num_eligible_addr set with how many we can 3081 * use, this may vary from call to call due to addresses 3082 * being deprecated etc.. 3083 */ 3084 if (cur_addr_num >= num_preferred) { 3085 cur_addr_num = 0; 3086 } 3087 sifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3088 dest_is_priv, cur_addr_num, fam, ro); 3089 if (sifa == NULL) 3090 continue; 3091 if (net) { 3092 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3093 SCTPDBG(SCTP_DEBUG_OUTPUT2, "we selected %d\n", 3094 cur_addr_num); 3095 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Source:"); 3096 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 3097 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Dest:"); 3098 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &net->ro._l_addr.sa); 3099 } 3100 atomic_add_int(&sifa->refcount, 1); 3101 return (sifa); 3102 } 3103#ifdef INET 3104again_with_private_addresses_allowed: 3105#endif 3106 /* plan_c: do we have an acceptable address on the emit interface */ 3107 sifa = NULL; 3108 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan C: find acceptable on interface\n"); 3109 if (emit_ifn == NULL) { 3110 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jump to Plan D - no emit_ifn\n"); 3111 goto plan_d; 3112 } 3113 LIST_FOREACH(sctp_ifa, &emit_ifn->ifalist, next_ifa) { 3114 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifa:%p\n", (void *)sctp_ifa); 3115#ifdef INET 3116 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3117 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3118 &sctp_ifa->address.sin.sin_addr) != 0)) { 3119 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3120 continue; 3121 } 3122#endif 3123#ifdef INET6 3124 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3125 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3126 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3127 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3128 continue; 3129 } 3130#endif 3131 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3132 (non_asoc_addr_ok == 0)) { 3133 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Defer\n"); 3134 continue; 3135 } 3136 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, 3137 dest_is_priv, fam); 3138 if (sifa == NULL) { 3139 SCTPDBG(SCTP_DEBUG_OUTPUT2, "IFA not acceptable\n"); 3140 continue; 3141 } 3142 if (stcb) { 3143 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3144 SCTPDBG(SCTP_DEBUG_OUTPUT2, "NOT in scope\n"); 3145 sifa = NULL; 3146 continue; 3147 } 3148 if (((non_asoc_addr_ok == 0) && 3149 (sctp_is_addr_restricted(stcb, sifa))) || 3150 (non_asoc_addr_ok && 3151 (sctp_is_addr_restricted(stcb, sifa)) && 3152 (!sctp_is_addr_pending(stcb, sifa)))) { 3153 /* 3154 * It is restricted for some reason.. 3155 * probably not yet added. 3156 */ 3157 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Its resticted\n"); 3158 sifa = NULL; 3159 continue; 3160 } 3161 } else { 3162 SCTP_PRINTF("Stcb is null - no print\n"); 3163 } 3164 atomic_add_int(&sifa->refcount, 1); 3165 goto out; 3166 } 3167plan_d: 3168 /* 3169 * plan_d: We are in trouble. No preferred address on the emit 3170 * interface. And not even a preferred address on all interfaces. Go 3171 * out and see if we can find an acceptable address somewhere 3172 * amongst all interfaces. 3173 */ 3174 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan D looked_at is %p\n", (void *)looked_at); 3175 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3176 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3177 /* wrong base scope */ 3178 continue; 3179 } 3180 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3181#ifdef INET 3182 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3183 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3184 &sctp_ifa->address.sin.sin_addr) != 0)) { 3185 continue; 3186 } 3187#endif 3188#ifdef INET6 3189 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3190 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3191 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3192 continue; 3193 } 3194#endif 3195 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3196 (non_asoc_addr_ok == 0)) 3197 continue; 3198 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3199 dest_is_loop, 3200 dest_is_priv, fam); 3201 if (sifa == NULL) 3202 continue; 3203 if (stcb) { 3204 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3205 sifa = NULL; 3206 continue; 3207 } 3208 if (((non_asoc_addr_ok == 0) && 3209 (sctp_is_addr_restricted(stcb, sifa))) || 3210 (non_asoc_addr_ok && 3211 (sctp_is_addr_restricted(stcb, sifa)) && 3212 (!sctp_is_addr_pending(stcb, sifa)))) { 3213 /* 3214 * It is restricted for some 3215 * reason.. probably not yet added. 3216 */ 3217 sifa = NULL; 3218 continue; 3219 } 3220 } 3221 goto out; 3222 } 3223 } 3224#ifdef INET 3225 if ((retried == 0) && (stcb->asoc.scope.ipv4_local_scope == 0)) { 3226 stcb->asoc.scope.ipv4_local_scope = 1; 3227 retried = 1; 3228 goto again_with_private_addresses_allowed; 3229 } else if (retried == 1) { 3230 stcb->asoc.scope.ipv4_local_scope = 0; 3231 } 3232#endif 3233out: 3234#ifdef INET 3235 if (sifa) { 3236 if (retried == 1) { 3237 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3238 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3239 /* wrong base scope */ 3240 continue; 3241 } 3242 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3243 struct sctp_ifa *tmp_sifa; 3244 3245#ifdef INET 3246 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3247 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3248 &sctp_ifa->address.sin.sin_addr) != 0)) { 3249 continue; 3250 } 3251#endif 3252#ifdef INET6 3253 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3254 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3255 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3256 continue; 3257 } 3258#endif 3259 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3260 (non_asoc_addr_ok == 0)) 3261 continue; 3262 tmp_sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3263 dest_is_loop, 3264 dest_is_priv, fam); 3265 if (tmp_sifa == NULL) { 3266 continue; 3267 } 3268 if (tmp_sifa == sifa) { 3269 continue; 3270 } 3271 if (stcb) { 3272 if (sctp_is_address_in_scope(tmp_sifa, 3273 &stcb->asoc.scope, 0) == 0) { 3274 continue; 3275 } 3276 if (((non_asoc_addr_ok == 0) && 3277 (sctp_is_addr_restricted(stcb, tmp_sifa))) || 3278 (non_asoc_addr_ok && 3279 (sctp_is_addr_restricted(stcb, tmp_sifa)) && 3280 (!sctp_is_addr_pending(stcb, tmp_sifa)))) { 3281 /* 3282 * It is restricted 3283 * for some reason.. 3284 * probably not yet 3285 * added. 3286 */ 3287 continue; 3288 } 3289 } 3290 if ((tmp_sifa->address.sin.sin_family == AF_INET) && 3291 (IN4_ISPRIVATE_ADDRESS(&(tmp_sifa->address.sin.sin_addr)))) { 3292 sctp_add_local_addr_restricted(stcb, tmp_sifa); 3293 } 3294 } 3295 } 3296 } 3297 atomic_add_int(&sifa->refcount, 1); 3298 } 3299#endif 3300 return (sifa); 3301} 3302 3303 3304 3305/* tcb may be NULL */ 3306struct sctp_ifa * 3307sctp_source_address_selection(struct sctp_inpcb *inp, 3308 struct sctp_tcb *stcb, 3309 sctp_route_t * ro, 3310 struct sctp_nets *net, 3311 int non_asoc_addr_ok, uint32_t vrf_id) 3312{ 3313 struct sctp_ifa *answer; 3314 uint8_t dest_is_priv, dest_is_loop; 3315 sa_family_t fam; 3316 3317#ifdef INET 3318 struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst; 3319 3320#endif 3321#ifdef INET6 3322 struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&ro->ro_dst; 3323 3324#endif 3325 3326 /** 3327 * Rules: - Find the route if needed, cache if I can. - Look at 3328 * interface address in route, Is it in the bound list. If so we 3329 * have the best source. - If not we must rotate amongst the 3330 * addresses. 3331 * 3332 * Cavets and issues 3333 * 3334 * Do we need to pay attention to scope. We can have a private address 3335 * or a global address we are sourcing or sending to. So if we draw 3336 * it out 3337 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3338 * For V4 3339 * ------------------------------------------ 3340 * source * dest * result 3341 * ----------------------------------------- 3342 * <a> Private * Global * NAT 3343 * ----------------------------------------- 3344 * <b> Private * Private * No problem 3345 * ----------------------------------------- 3346 * <c> Global * Private * Huh, How will this work? 3347 * ----------------------------------------- 3348 * <d> Global * Global * No Problem 3349 *------------------------------------------ 3350 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3351 * For V6 3352 *------------------------------------------ 3353 * source * dest * result 3354 * ----------------------------------------- 3355 * <a> Linklocal * Global * 3356 * ----------------------------------------- 3357 * <b> Linklocal * Linklocal * No problem 3358 * ----------------------------------------- 3359 * <c> Global * Linklocal * Huh, How will this work? 3360 * ----------------------------------------- 3361 * <d> Global * Global * No Problem 3362 *------------------------------------------ 3363 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3364 * 3365 * And then we add to that what happens if there are multiple addresses 3366 * assigned to an interface. Remember the ifa on a ifn is a linked 3367 * list of addresses. So one interface can have more than one IP 3368 * address. What happens if we have both a private and a global 3369 * address? Do we then use context of destination to sort out which 3370 * one is best? And what about NAT's sending P->G may get you a NAT 3371 * translation, or should you select the G thats on the interface in 3372 * preference. 3373 * 3374 * Decisions: 3375 * 3376 * - count the number of addresses on the interface. 3377 * - if it is one, no problem except case <c>. 3378 * For <a> we will assume a NAT out there. 3379 * - if there are more than one, then we need to worry about scope P 3380 * or G. We should prefer G -> G and P -> P if possible. 3381 * Then as a secondary fall back to mixed types G->P being a last 3382 * ditch one. 3383 * - The above all works for bound all, but bound specific we need to 3384 * use the same concept but instead only consider the bound 3385 * addresses. If the bound set is NOT assigned to the interface then 3386 * we must use rotation amongst the bound addresses.. 3387 */ 3388 if (ro->ro_rt == NULL) { 3389 /* 3390 * Need a route to cache. 3391 */ 3392 SCTP_RTALLOC(ro, vrf_id); 3393 } 3394 if (ro->ro_rt == NULL) { 3395 return (NULL); 3396 } 3397 fam = ro->ro_dst.sa_family; 3398 dest_is_priv = dest_is_loop = 0; 3399 /* Setup our scopes for the destination */ 3400 switch (fam) { 3401#ifdef INET 3402 case AF_INET: 3403 /* Scope based on outbound address */ 3404 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) { 3405 dest_is_loop = 1; 3406 if (net != NULL) { 3407 /* mark it as local */ 3408 net->addr_is_local = 1; 3409 } 3410 } else if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) { 3411 dest_is_priv = 1; 3412 } 3413 break; 3414#endif 3415#ifdef INET6 3416 case AF_INET6: 3417 /* Scope based on outbound address */ 3418 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr) || 3419 SCTP_ROUTE_IS_REAL_LOOP(ro)) { 3420 /* 3421 * If the address is a loopback address, which 3422 * consists of "::1" OR "fe80::1%lo0", we are 3423 * loopback scope. But we don't use dest_is_priv 3424 * (link local addresses). 3425 */ 3426 dest_is_loop = 1; 3427 if (net != NULL) { 3428 /* mark it as local */ 3429 net->addr_is_local = 1; 3430 } 3431 } else if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) { 3432 dest_is_priv = 1; 3433 } 3434 break; 3435#endif 3436 } 3437 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Select source addr for:"); 3438 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&ro->ro_dst); 3439 SCTP_IPI_ADDR_RLOCK(); 3440 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3441 /* 3442 * Bound all case 3443 */ 3444 answer = sctp_choose_boundall(inp, stcb, net, ro, vrf_id, 3445 dest_is_priv, dest_is_loop, 3446 non_asoc_addr_ok, fam); 3447 SCTP_IPI_ADDR_RUNLOCK(); 3448 return (answer); 3449 } 3450 /* 3451 * Subset bound case 3452 */ 3453 if (stcb) { 3454 answer = sctp_choose_boundspecific_stcb(inp, stcb, ro, 3455 vrf_id, dest_is_priv, 3456 dest_is_loop, 3457 non_asoc_addr_ok, fam); 3458 } else { 3459 answer = sctp_choose_boundspecific_inp(inp, ro, vrf_id, 3460 non_asoc_addr_ok, 3461 dest_is_priv, 3462 dest_is_loop, fam); 3463 } 3464 SCTP_IPI_ADDR_RUNLOCK(); 3465 return (answer); 3466} 3467 3468static int 3469sctp_find_cmsg(int c_type, void *data, struct mbuf *control, size_t cpsize) 3470{ 3471 struct cmsghdr cmh; 3472 int tlen, at, found; 3473 struct sctp_sndinfo sndinfo; 3474 struct sctp_prinfo prinfo; 3475 struct sctp_authinfo authinfo; 3476 3477 tlen = SCTP_BUF_LEN(control); 3478 at = 0; 3479 found = 0; 3480 /* 3481 * Independent of how many mbufs, find the c_type inside the control 3482 * structure and copy out the data. 3483 */ 3484 while (at < tlen) { 3485 if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) { 3486 /* There is not enough room for one more. */ 3487 return (found); 3488 } 3489 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh); 3490 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3491 /* We dont't have a complete CMSG header. */ 3492 return (found); 3493 } 3494 if (((int)cmh.cmsg_len + at) > tlen) { 3495 /* We don't have the complete CMSG. */ 3496 return (found); 3497 } 3498 if ((cmh.cmsg_level == IPPROTO_SCTP) && 3499 ((c_type == cmh.cmsg_type) || 3500 ((c_type == SCTP_SNDRCV) && 3501 ((cmh.cmsg_type == SCTP_SNDINFO) || 3502 (cmh.cmsg_type == SCTP_PRINFO) || 3503 (cmh.cmsg_type == SCTP_AUTHINFO))))) { 3504 if (c_type == cmh.cmsg_type) { 3505 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < cpsize) { 3506 return (found); 3507 } 3508 /* It is exactly what we want. Copy it out. */ 3509 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), cpsize, (caddr_t)data); 3510 return (1); 3511 } else { 3512 struct sctp_sndrcvinfo *sndrcvinfo; 3513 3514 sndrcvinfo = (struct sctp_sndrcvinfo *)data; 3515 if (found == 0) { 3516 if (cpsize < sizeof(struct sctp_sndrcvinfo)) { 3517 return (found); 3518 } 3519 memset(sndrcvinfo, 0, sizeof(struct sctp_sndrcvinfo)); 3520 } 3521 switch (cmh.cmsg_type) { 3522 case SCTP_SNDINFO: 3523 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_sndinfo)) { 3524 return (found); 3525 } 3526 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_sndinfo), (caddr_t)&sndinfo); 3527 sndrcvinfo->sinfo_stream = sndinfo.snd_sid; 3528 sndrcvinfo->sinfo_flags = sndinfo.snd_flags; 3529 sndrcvinfo->sinfo_ppid = sndinfo.snd_ppid; 3530 sndrcvinfo->sinfo_context = sndinfo.snd_context; 3531 sndrcvinfo->sinfo_assoc_id = sndinfo.snd_assoc_id; 3532 break; 3533 case SCTP_PRINFO: 3534 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_prinfo)) { 3535 return (found); 3536 } 3537 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_prinfo), (caddr_t)&prinfo); 3538 if (prinfo.pr_policy != SCTP_PR_SCTP_NONE) { 3539 sndrcvinfo->sinfo_timetolive = prinfo.pr_value; 3540 } else { 3541 sndrcvinfo->sinfo_timetolive = 0; 3542 } 3543 sndrcvinfo->sinfo_flags |= prinfo.pr_policy; 3544 break; 3545 case SCTP_AUTHINFO: 3546 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_authinfo)) { 3547 return (found); 3548 } 3549 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_authinfo), (caddr_t)&authinfo); 3550 sndrcvinfo->sinfo_keynumber_valid = 1; 3551 sndrcvinfo->sinfo_keynumber = authinfo.auth_keynumber; 3552 break; 3553 default: 3554 return (found); 3555 } 3556 found = 1; 3557 } 3558 } 3559 at += CMSG_ALIGN(cmh.cmsg_len); 3560 } 3561 return (found); 3562} 3563 3564static int 3565sctp_process_cmsgs_for_init(struct sctp_tcb *stcb, struct mbuf *control, int *error) 3566{ 3567 struct cmsghdr cmh; 3568 int tlen, at; 3569 struct sctp_initmsg initmsg; 3570 3571#ifdef INET 3572 struct sockaddr_in sin; 3573 3574#endif 3575#ifdef INET6 3576 struct sockaddr_in6 sin6; 3577 3578#endif 3579 3580 tlen = SCTP_BUF_LEN(control); 3581 at = 0; 3582 while (at < tlen) { 3583 if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) { 3584 /* There is not enough room for one more. */ 3585 *error = EINVAL; 3586 return (1); 3587 } 3588 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh); 3589 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3590 /* We dont't have a complete CMSG header. */ 3591 *error = EINVAL; 3592 return (1); 3593 } 3594 if (((int)cmh.cmsg_len + at) > tlen) { 3595 /* We don't have the complete CMSG. */ 3596 *error = EINVAL; 3597 return (1); 3598 } 3599 if (cmh.cmsg_level == IPPROTO_SCTP) { 3600 switch (cmh.cmsg_type) { 3601 case SCTP_INIT: 3602 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_initmsg)) { 3603 *error = EINVAL; 3604 return (1); 3605 } 3606 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_initmsg), (caddr_t)&initmsg); 3607 if (initmsg.sinit_max_attempts) 3608 stcb->asoc.max_init_times = initmsg.sinit_max_attempts; 3609 if (initmsg.sinit_num_ostreams) 3610 stcb->asoc.pre_open_streams = initmsg.sinit_num_ostreams; 3611 if (initmsg.sinit_max_instreams) 3612 stcb->asoc.max_inbound_streams = initmsg.sinit_max_instreams; 3613 if (initmsg.sinit_max_init_timeo) 3614 stcb->asoc.initial_init_rto_max = initmsg.sinit_max_init_timeo; 3615 if (stcb->asoc.streamoutcnt < stcb->asoc.pre_open_streams) { 3616 struct sctp_stream_out *tmp_str; 3617 unsigned int i; 3618 3619 /* Default is NOT correct */ 3620 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, default:%d pre_open:%d\n", 3621 stcb->asoc.streamoutcnt, stcb->asoc.pre_open_streams); 3622 SCTP_TCB_UNLOCK(stcb); 3623 SCTP_MALLOC(tmp_str, 3624 struct sctp_stream_out *, 3625 (stcb->asoc.pre_open_streams * sizeof(struct sctp_stream_out)), 3626 SCTP_M_STRMO); 3627 SCTP_TCB_LOCK(stcb); 3628 if (tmp_str != NULL) { 3629 SCTP_FREE(stcb->asoc.strmout, SCTP_M_STRMO); 3630 stcb->asoc.strmout = tmp_str; 3631 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt = stcb->asoc.pre_open_streams; 3632 } else { 3633 stcb->asoc.pre_open_streams = stcb->asoc.streamoutcnt; 3634 } 3635 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3636 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 3637 stcb->asoc.strmout[i].chunks_on_queues = 0; 3638 stcb->asoc.strmout[i].next_sequence_send = 0; 3639 stcb->asoc.strmout[i].stream_no = i; 3640 stcb->asoc.strmout[i].last_msg_incomplete = 0; 3641 stcb->asoc.ss_functions.sctp_ss_init_stream(&stcb->asoc.strmout[i], NULL); 3642 } 3643 } 3644 break; 3645#ifdef INET 3646 case SCTP_DSTADDRV4: 3647 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in_addr)) { 3648 *error = EINVAL; 3649 return (1); 3650 } 3651 memset(&sin, 0, sizeof(struct sockaddr_in)); 3652 sin.sin_family = AF_INET; 3653 sin.sin_len = sizeof(struct sockaddr_in); 3654 sin.sin_port = stcb->rport; 3655 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3656 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3657 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3658 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3659 *error = EINVAL; 3660 return (1); 3661 } 3662 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, 3663 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3664 *error = ENOBUFS; 3665 return (1); 3666 } 3667 break; 3668#endif 3669#ifdef INET6 3670 case SCTP_DSTADDRV6: 3671 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in6_addr)) { 3672 *error = EINVAL; 3673 return (1); 3674 } 3675 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3676 sin6.sin6_family = AF_INET6; 3677 sin6.sin6_len = sizeof(struct sockaddr_in6); 3678 sin6.sin6_port = stcb->rport; 3679 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3680 if (IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr) || 3681 IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) { 3682 *error = EINVAL; 3683 return (1); 3684 } 3685#ifdef INET 3686 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3687 in6_sin6_2_sin(&sin, &sin6); 3688 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3689 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3690 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3691 *error = EINVAL; 3692 return (1); 3693 } 3694 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, 3695 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3696 *error = ENOBUFS; 3697 return (1); 3698 } 3699 } else 3700#endif 3701 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin6, NULL, 3702 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3703 *error = ENOBUFS; 3704 return (1); 3705 } 3706 break; 3707#endif 3708 default: 3709 break; 3710 } 3711 } 3712 at += CMSG_ALIGN(cmh.cmsg_len); 3713 } 3714 return (0); 3715} 3716 3717static struct sctp_tcb * 3718sctp_findassociation_cmsgs(struct sctp_inpcb **inp_p, 3719 uint16_t port, 3720 struct mbuf *control, 3721 struct sctp_nets **net_p, 3722 int *error) 3723{ 3724 struct cmsghdr cmh; 3725 int tlen, at; 3726 struct sctp_tcb *stcb; 3727 struct sockaddr *addr; 3728 3729#ifdef INET 3730 struct sockaddr_in sin; 3731 3732#endif 3733#ifdef INET6 3734 struct sockaddr_in6 sin6; 3735 3736#endif 3737 3738 tlen = SCTP_BUF_LEN(control); 3739 at = 0; 3740 while (at < tlen) { 3741 if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) { 3742 /* There is not enough room for one more. */ 3743 *error = EINVAL; 3744 return (NULL); 3745 } 3746 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh); 3747 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3748 /* We dont't have a complete CMSG header. */ 3749 *error = EINVAL; 3750 return (NULL); 3751 } 3752 if (((int)cmh.cmsg_len + at) > tlen) { 3753 /* We don't have the complete CMSG. */ 3754 *error = EINVAL; 3755 return (NULL); 3756 } 3757 if (cmh.cmsg_level == IPPROTO_SCTP) { 3758 switch (cmh.cmsg_type) { 3759#ifdef INET 3760 case SCTP_DSTADDRV4: 3761 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in_addr)) { 3762 *error = EINVAL; 3763 return (NULL); 3764 } 3765 memset(&sin, 0, sizeof(struct sockaddr_in)); 3766 sin.sin_family = AF_INET; 3767 sin.sin_len = sizeof(struct sockaddr_in); 3768 sin.sin_port = port; 3769 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3770 addr = (struct sockaddr *)&sin; 3771 break; 3772#endif 3773#ifdef INET6 3774 case SCTP_DSTADDRV6: 3775 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in6_addr)) { 3776 *error = EINVAL; 3777 return (NULL); 3778 } 3779 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3780 sin6.sin6_family = AF_INET6; 3781 sin6.sin6_len = sizeof(struct sockaddr_in6); 3782 sin6.sin6_port = port; 3783 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3784#ifdef INET 3785 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3786 in6_sin6_2_sin(&sin, &sin6); 3787 addr = (struct sockaddr *)&sin; 3788 } else 3789#endif 3790 addr = (struct sockaddr *)&sin6; 3791 break; 3792#endif 3793 default: 3794 addr = NULL; 3795 break; 3796 } 3797 if (addr) { 3798 stcb = sctp_findassociation_ep_addr(inp_p, addr, net_p, NULL, NULL); 3799 if (stcb != NULL) { 3800 return (stcb); 3801 } 3802 } 3803 } 3804 at += CMSG_ALIGN(cmh.cmsg_len); 3805 } 3806 return (NULL); 3807} 3808 3809static struct mbuf * 3810sctp_add_cookie(struct mbuf *init, int init_offset, 3811 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in, uint8_t ** signature) 3812{ 3813 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 3814 struct sctp_state_cookie *stc; 3815 struct sctp_paramhdr *ph; 3816 uint8_t *foo; 3817 int sig_offset; 3818 uint16_t cookie_sz; 3819 3820 mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) + 3821 sizeof(struct sctp_paramhdr)), 0, 3822 M_DONTWAIT, 1, MT_DATA); 3823 if (mret == NULL) { 3824 return (NULL); 3825 } 3826 copy_init = SCTP_M_COPYM(init, init_offset, M_COPYALL, M_DONTWAIT); 3827 if (copy_init == NULL) { 3828 sctp_m_freem(mret); 3829 return (NULL); 3830 } 3831#ifdef SCTP_MBUF_LOGGING 3832 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3833 struct mbuf *mat; 3834 3835 for (mat = copy_init; mat; mat = SCTP_BUF_NEXT(mat)) { 3836 if (SCTP_BUF_IS_EXTENDED(mat)) { 3837 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 3838 } 3839 } 3840 } 3841#endif 3842 copy_initack = SCTP_M_COPYM(initack, initack_offset, M_COPYALL, 3843 M_DONTWAIT); 3844 if (copy_initack == NULL) { 3845 sctp_m_freem(mret); 3846 sctp_m_freem(copy_init); 3847 return (NULL); 3848 } 3849#ifdef SCTP_MBUF_LOGGING 3850 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3851 struct mbuf *mat; 3852 3853 for (mat = copy_initack; mat; mat = SCTP_BUF_NEXT(mat)) { 3854 if (SCTP_BUF_IS_EXTENDED(mat)) { 3855 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 3856 } 3857 } 3858 } 3859#endif 3860 /* easy side we just drop it on the end */ 3861 ph = mtod(mret, struct sctp_paramhdr *); 3862 SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) + 3863 sizeof(struct sctp_paramhdr); 3864 stc = (struct sctp_state_cookie *)((caddr_t)ph + 3865 sizeof(struct sctp_paramhdr)); 3866 ph->param_type = htons(SCTP_STATE_COOKIE); 3867 ph->param_length = 0; /* fill in at the end */ 3868 /* Fill in the stc cookie data */ 3869 memcpy(stc, stc_in, sizeof(struct sctp_state_cookie)); 3870 3871 /* tack the INIT and then the INIT-ACK onto the chain */ 3872 cookie_sz = 0; 3873 for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3874 cookie_sz += SCTP_BUF_LEN(m_at); 3875 if (SCTP_BUF_NEXT(m_at) == NULL) { 3876 SCTP_BUF_NEXT(m_at) = copy_init; 3877 break; 3878 } 3879 } 3880 for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3881 cookie_sz += SCTP_BUF_LEN(m_at); 3882 if (SCTP_BUF_NEXT(m_at) == NULL) { 3883 SCTP_BUF_NEXT(m_at) = copy_initack; 3884 break; 3885 } 3886 } 3887 for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3888 cookie_sz += SCTP_BUF_LEN(m_at); 3889 if (SCTP_BUF_NEXT(m_at) == NULL) { 3890 break; 3891 } 3892 } 3893 sig = sctp_get_mbuf_for_msg(SCTP_SECRET_SIZE, 0, M_DONTWAIT, 1, MT_DATA); 3894 if (sig == NULL) { 3895 /* no space, so free the entire chain */ 3896 sctp_m_freem(mret); 3897 return (NULL); 3898 } 3899 SCTP_BUF_LEN(sig) = 0; 3900 SCTP_BUF_NEXT(m_at) = sig; 3901 sig_offset = 0; 3902 foo = (uint8_t *) (mtod(sig, caddr_t)+sig_offset); 3903 memset(foo, 0, SCTP_SIGNATURE_SIZE); 3904 *signature = foo; 3905 SCTP_BUF_LEN(sig) += SCTP_SIGNATURE_SIZE; 3906 cookie_sz += SCTP_SIGNATURE_SIZE; 3907 ph->param_length = htons(cookie_sz); 3908 return (mret); 3909} 3910 3911 3912static uint8_t 3913sctp_get_ect(struct sctp_tcb *stcb) 3914{ 3915 if ((stcb != NULL) && (stcb->asoc.ecn_allowed == 1)) { 3916 return (SCTP_ECT0_BIT); 3917 } else { 3918 return (0); 3919 } 3920} 3921 3922#if defined(INET) || defined(INET6) 3923static void 3924sctp_handle_no_route(struct sctp_tcb *stcb, 3925 struct sctp_nets *net, 3926 int so_locked) 3927{ 3928 SCTPDBG(SCTP_DEBUG_OUTPUT1, "dropped packet - no valid source addr\n"); 3929 3930 if (net) { 3931 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Destination was "); 3932 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT1, &net->ro._l_addr.sa); 3933 if (net->dest_state & SCTP_ADDR_CONFIRMED) { 3934 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) { 3935 SCTPDBG(SCTP_DEBUG_OUTPUT1, "no route takes interface %p down\n", (void *)net); 3936 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 3937 stcb, 0, 3938 (void *)net, 3939 so_locked); 3940 net->dest_state &= ~SCTP_ADDR_REACHABLE; 3941 net->dest_state &= ~SCTP_ADDR_PF; 3942 } 3943 } 3944 if (stcb) { 3945 if (net == stcb->asoc.primary_destination) { 3946 /* need a new primary */ 3947 struct sctp_nets *alt; 3948 3949 alt = sctp_find_alternate_net(stcb, net, 0); 3950 if (alt != net) { 3951 if (stcb->asoc.alternate) { 3952 sctp_free_remote_addr(stcb->asoc.alternate); 3953 } 3954 stcb->asoc.alternate = alt; 3955 atomic_add_int(&stcb->asoc.alternate->ref_count, 1); 3956 if (net->ro._s_addr) { 3957 sctp_free_ifa(net->ro._s_addr); 3958 net->ro._s_addr = NULL; 3959 } 3960 net->src_addr_selected = 0; 3961 } 3962 } 3963 } 3964 } 3965} 3966 3967#endif 3968 3969static int 3970sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 3971 struct sctp_tcb *stcb, /* may be NULL */ 3972 struct sctp_nets *net, 3973 struct sockaddr *to, 3974 struct mbuf *m, 3975 uint32_t auth_offset, 3976 struct sctp_auth_chunk *auth, 3977 uint16_t auth_keyid, 3978 int nofragment_flag, 3979 int ecn_ok, 3980 int out_of_asoc_ok, 3981 uint16_t src_port, 3982 uint16_t dest_port, 3983 uint32_t v_tag, 3984 uint16_t port, 3985 union sctp_sockstore *over_addr, 3986 uint8_t use_mflowid, uint32_t mflowid, 3987#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 3988 int so_locked SCTP_UNUSED 3989#else 3990 int so_locked 3991#endif 3992) 3993/* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 3994{ 3995 /** 3996 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet header 3997 * WITH an SCTPHDR but no IP header, endpoint inp and sa structure: 3998 * - fill in the HMAC digest of any AUTH chunk in the packet. 3999 * - calculate and fill in the SCTP checksum. 4000 * - prepend an IP address header. 4001 * - if boundall use INADDR_ANY. 4002 * - if boundspecific do source address selection. 4003 * - set fragmentation option for ipV4. 4004 * - On return from IP output, check/adjust mtu size of output 4005 * interface and smallest_mtu size as well. 4006 */ 4007 /* Will need ifdefs around this */ 4008 struct mbuf *newm; 4009 struct sctphdr *sctphdr; 4010 int packet_length; 4011 int ret; 4012 4013#if defined(INET) || defined(INET6) 4014 uint32_t vrf_id; 4015 4016#endif 4017#if defined(INET) || defined(INET6) 4018 struct mbuf *o_pak; 4019 sctp_route_t *ro = NULL; 4020 struct udphdr *udp = NULL; 4021 4022#endif 4023 uint8_t tos_value; 4024 4025#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4026 struct socket *so = NULL; 4027 4028#endif 4029 4030 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 4031 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4032 sctp_m_freem(m); 4033 return (EFAULT); 4034 } 4035#if defined(INET) || defined(INET6) 4036 if (stcb) { 4037 vrf_id = stcb->asoc.vrf_id; 4038 } else { 4039 vrf_id = inp->def_vrf_id; 4040 } 4041#endif 4042 /* fill in the HMAC digest for any AUTH chunk in the packet */ 4043 if ((auth != NULL) && (stcb != NULL)) { 4044 sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb, auth_keyid); 4045 } 4046 if (net) { 4047 tos_value = net->dscp; 4048 } else if (stcb) { 4049 tos_value = stcb->asoc.default_dscp; 4050 } else { 4051 tos_value = inp->sctp_ep.default_dscp; 4052 } 4053 4054 switch (to->sa_family) { 4055#ifdef INET 4056 case AF_INET: 4057 { 4058 struct ip *ip = NULL; 4059 sctp_route_t iproute; 4060 int len; 4061 4062 len = sizeof(struct ip) + sizeof(struct sctphdr); 4063 if (port) { 4064 len += sizeof(struct udphdr); 4065 } 4066 newm = sctp_get_mbuf_for_msg(len, 1, M_DONTWAIT, 1, MT_DATA); 4067 if (newm == NULL) { 4068 sctp_m_freem(m); 4069 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4070 return (ENOMEM); 4071 } 4072 SCTP_ALIGN_TO_END(newm, len); 4073 SCTP_BUF_LEN(newm) = len; 4074 SCTP_BUF_NEXT(newm) = m; 4075 m = newm; 4076 if (net != NULL) { 4077#ifdef INVARIANTS 4078 if (net->flowidset == 0) { 4079 panic("Flow ID not set"); 4080 } 4081#endif 4082 m->m_pkthdr.flowid = net->flowid; 4083 m->m_flags |= M_FLOWID; 4084 } else { 4085 if (use_mflowid != 0) { 4086 m->m_pkthdr.flowid = mflowid; 4087 m->m_flags |= M_FLOWID; 4088 } 4089 } 4090 packet_length = sctp_calculate_len(m); 4091 ip = mtod(m, struct ip *); 4092 ip->ip_v = IPVERSION; 4093 ip->ip_hl = (sizeof(struct ip) >> 2); 4094 if (tos_value == 0) { 4095 /* 4096 * This means especially, that it is not set 4097 * at the SCTP layer. So use the value from 4098 * the IP layer. 4099 */ 4100 tos_value = inp->ip_inp.inp.inp_ip_tos; 4101 } 4102 tos_value &= 0xfc; 4103 if (ecn_ok) { 4104 tos_value |= sctp_get_ect(stcb); 4105 } 4106 if ((nofragment_flag) && (port == 0)) { 4107 ip->ip_off = IP_DF; 4108 } else { 4109 ip->ip_off = 0; 4110 } 4111 /* FreeBSD has a function for ip_id's */ 4112 ip->ip_id = ip_newid(); 4113 4114 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl; 4115 ip->ip_len = packet_length; 4116 ip->ip_tos = tos_value; 4117 if (port) { 4118 ip->ip_p = IPPROTO_UDP; 4119 } else { 4120 ip->ip_p = IPPROTO_SCTP; 4121 } 4122 ip->ip_sum = 0; 4123 if (net == NULL) { 4124 ro = &iproute; 4125 memset(&iproute, 0, sizeof(iproute)); 4126 memcpy(&ro->ro_dst, to, to->sa_len); 4127 } else { 4128 ro = (sctp_route_t *) & net->ro; 4129 } 4130 /* Now the address selection part */ 4131 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr; 4132 4133 /* call the routine to select the src address */ 4134 if (net && out_of_asoc_ok == 0) { 4135 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4136 sctp_free_ifa(net->ro._s_addr); 4137 net->ro._s_addr = NULL; 4138 net->src_addr_selected = 0; 4139 if (ro->ro_rt) { 4140 RTFREE(ro->ro_rt); 4141 ro->ro_rt = NULL; 4142 } 4143 } 4144 if (net->src_addr_selected == 0) { 4145 /* Cache the source address */ 4146 net->ro._s_addr = sctp_source_address_selection(inp, stcb, 4147 ro, net, 0, 4148 vrf_id); 4149 net->src_addr_selected = 1; 4150 } 4151 if (net->ro._s_addr == NULL) { 4152 /* No route to host */ 4153 net->src_addr_selected = 0; 4154 sctp_handle_no_route(stcb, net, so_locked); 4155 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4156 sctp_m_freem(m); 4157 return (EHOSTUNREACH); 4158 } 4159 ip->ip_src = net->ro._s_addr->address.sin.sin_addr; 4160 } else { 4161 if (over_addr == NULL) { 4162 struct sctp_ifa *_lsrc; 4163 4164 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4165 net, 4166 out_of_asoc_ok, 4167 vrf_id); 4168 if (_lsrc == NULL) { 4169 sctp_handle_no_route(stcb, net, so_locked); 4170 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4171 sctp_m_freem(m); 4172 return (EHOSTUNREACH); 4173 } 4174 ip->ip_src = _lsrc->address.sin.sin_addr; 4175 sctp_free_ifa(_lsrc); 4176 } else { 4177 ip->ip_src = over_addr->sin.sin_addr; 4178 SCTP_RTALLOC(ro, vrf_id); 4179 } 4180 } 4181 if (port) { 4182 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4183 sctp_handle_no_route(stcb, net, so_locked); 4184 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4185 sctp_m_freem(m); 4186 return (EHOSTUNREACH); 4187 } 4188 udp = (struct udphdr *)((caddr_t)ip + sizeof(struct ip)); 4189 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4190 udp->uh_dport = port; 4191 udp->uh_ulen = htons(packet_length - sizeof(struct ip)); 4192 if (V_udp_cksum) { 4193 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 4194 } else { 4195 udp->uh_sum = 0; 4196 } 4197 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4198 } else { 4199 sctphdr = (struct sctphdr *)((caddr_t)ip + sizeof(struct ip)); 4200 } 4201 4202 sctphdr->src_port = src_port; 4203 sctphdr->dest_port = dest_port; 4204 sctphdr->v_tag = v_tag; 4205 sctphdr->checksum = 0; 4206 4207 /* 4208 * If source address selection fails and we find no 4209 * route then the ip_output should fail as well with 4210 * a NO_ROUTE_TO_HOST type error. We probably should 4211 * catch that somewhere and abort the association 4212 * right away (assuming this is an INIT being sent). 4213 */ 4214 if (ro->ro_rt == NULL) { 4215 /* 4216 * src addr selection failed to find a route 4217 * (or valid source addr), so we can't get 4218 * there from here (yet)! 4219 */ 4220 sctp_handle_no_route(stcb, net, so_locked); 4221 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4222 sctp_m_freem(m); 4223 return (EHOSTUNREACH); 4224 } 4225 if (ro != &iproute) { 4226 memcpy(&iproute, ro, sizeof(*ro)); 4227 } 4228 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv4 output routine from low level src addr:%x\n", 4229 (uint32_t) (ntohl(ip->ip_src.s_addr))); 4230 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Destination is %x\n", 4231 (uint32_t) (ntohl(ip->ip_dst.s_addr))); 4232 SCTPDBG(SCTP_DEBUG_OUTPUT3, "RTP route is %p through\n", 4233 (void *)ro->ro_rt); 4234 4235 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4236 /* failed to prepend data, give up */ 4237 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4238 sctp_m_freem(m); 4239 return (ENOMEM); 4240 } 4241 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4242 if (port) { 4243#if defined(SCTP_WITH_NO_CSUM) 4244 SCTP_STAT_INCR(sctps_sendnocrc); 4245#else 4246 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip) + sizeof(struct udphdr)); 4247 SCTP_STAT_INCR(sctps_sendswcrc); 4248#endif 4249 if (V_udp_cksum) { 4250 SCTP_ENABLE_UDP_CSUM(o_pak); 4251 } 4252 } else { 4253#if defined(SCTP_WITH_NO_CSUM) 4254 SCTP_STAT_INCR(sctps_sendnocrc); 4255#else 4256 m->m_pkthdr.csum_flags = CSUM_SCTP; 4257 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4258 SCTP_STAT_INCR(sctps_sendhwcrc); 4259#endif 4260 } 4261#ifdef SCTP_PACKET_LOGGING 4262 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4263 sctp_packet_log(o_pak); 4264#endif 4265 /* send it out. table id is taken from stcb */ 4266#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4267 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4268 so = SCTP_INP_SO(inp); 4269 SCTP_SOCKET_UNLOCK(so, 0); 4270 } 4271#endif 4272 SCTP_IP_OUTPUT(ret, o_pak, ro, stcb, vrf_id); 4273#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4274 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4275 atomic_add_int(&stcb->asoc.refcnt, 1); 4276 SCTP_TCB_UNLOCK(stcb); 4277 SCTP_SOCKET_LOCK(so, 0); 4278 SCTP_TCB_LOCK(stcb); 4279 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4280 } 4281#endif 4282 SCTP_STAT_INCR(sctps_sendpackets); 4283 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4284 if (ret) 4285 SCTP_STAT_INCR(sctps_senderrors); 4286 4287 SCTPDBG(SCTP_DEBUG_OUTPUT3, "IP output returns %d\n", ret); 4288 if (net == NULL) { 4289 /* free tempy routes */ 4290 RO_RTFREE(ro); 4291 } else { 4292 /* 4293 * PMTU check versus smallest asoc MTU goes 4294 * here 4295 */ 4296 if ((ro->ro_rt != NULL) && 4297 (net->ro._s_addr)) { 4298 uint32_t mtu; 4299 4300 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt); 4301 if (net->port) { 4302 mtu -= sizeof(struct udphdr); 4303 } 4304 if (mtu && (stcb->asoc.smallest_mtu > mtu)) { 4305 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4306 net->mtu = mtu; 4307 } 4308 } else if (ro->ro_rt == NULL) { 4309 /* route was freed */ 4310 if (net->ro._s_addr && 4311 net->src_addr_selected) { 4312 sctp_free_ifa(net->ro._s_addr); 4313 net->ro._s_addr = NULL; 4314 } 4315 net->src_addr_selected = 0; 4316 } 4317 } 4318 return (ret); 4319 } 4320#endif 4321#ifdef INET6 4322 case AF_INET6: 4323 { 4324 uint32_t flowlabel, flowinfo; 4325 struct ip6_hdr *ip6h; 4326 struct route_in6 ip6route; 4327 struct ifnet *ifp; 4328 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 4329 int prev_scope = 0; 4330 struct sockaddr_in6 lsa6_storage; 4331 int error; 4332 u_short prev_port = 0; 4333 int len; 4334 4335 if (net) { 4336 flowlabel = net->flowlabel; 4337 } else if (stcb) { 4338 flowlabel = stcb->asoc.default_flowlabel; 4339 } else { 4340 flowlabel = inp->sctp_ep.default_flowlabel; 4341 } 4342 if (flowlabel == 0) { 4343 /* 4344 * This means especially, that it is not set 4345 * at the SCTP layer. So use the value from 4346 * the IP layer. 4347 */ 4348 flowlabel = ntohl(((struct in6pcb *)inp)->in6p_flowinfo); 4349 } 4350 flowlabel &= 0x000fffff; 4351 len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr); 4352 if (port) { 4353 len += sizeof(struct udphdr); 4354 } 4355 newm = sctp_get_mbuf_for_msg(len, 1, M_DONTWAIT, 1, MT_DATA); 4356 if (newm == NULL) { 4357 sctp_m_freem(m); 4358 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4359 return (ENOMEM); 4360 } 4361 SCTP_ALIGN_TO_END(newm, len); 4362 SCTP_BUF_LEN(newm) = len; 4363 SCTP_BUF_NEXT(newm) = m; 4364 m = newm; 4365 if (net != NULL) { 4366#ifdef INVARIANTS 4367 if (net->flowidset == 0) { 4368 panic("Flow ID not set"); 4369 } 4370#endif 4371 m->m_pkthdr.flowid = net->flowid; 4372 m->m_flags |= M_FLOWID; 4373 } else { 4374 if (use_mflowid != 0) { 4375 m->m_pkthdr.flowid = mflowid; 4376 m->m_flags |= M_FLOWID; 4377 } 4378 } 4379 packet_length = sctp_calculate_len(m); 4380 4381 ip6h = mtod(m, struct ip6_hdr *); 4382 /* protect *sin6 from overwrite */ 4383 sin6 = (struct sockaddr_in6 *)to; 4384 tmp = *sin6; 4385 sin6 = &tmp; 4386 4387 /* KAME hack: embed scopeid */ 4388 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4389 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4390 return (EINVAL); 4391 } 4392 if (net == NULL) { 4393 memset(&ip6route, 0, sizeof(ip6route)); 4394 ro = (sctp_route_t *) & ip6route; 4395 memcpy(&ro->ro_dst, sin6, sin6->sin6_len); 4396 } else { 4397 ro = (sctp_route_t *) & net->ro; 4398 } 4399 /* 4400 * We assume here that inp_flow is in host byte 4401 * order within the TCB! 4402 */ 4403 if (tos_value == 0) { 4404 /* 4405 * This means especially, that it is not set 4406 * at the SCTP layer. So use the value from 4407 * the IP layer. 4408 */ 4409 tos_value = (ntohl(((struct in6pcb *)inp)->in6p_flowinfo) >> 20) & 0xff; 4410 } 4411 tos_value &= 0xfc; 4412 if (ecn_ok) { 4413 tos_value |= sctp_get_ect(stcb); 4414 } 4415 flowinfo = 0x06; 4416 flowinfo <<= 8; 4417 flowinfo |= tos_value; 4418 flowinfo <<= 20; 4419 flowinfo |= flowlabel; 4420 ip6h->ip6_flow = htonl(flowinfo); 4421 if (port) { 4422 ip6h->ip6_nxt = IPPROTO_UDP; 4423 } else { 4424 ip6h->ip6_nxt = IPPROTO_SCTP; 4425 } 4426 ip6h->ip6_plen = (packet_length - sizeof(struct ip6_hdr)); 4427 ip6h->ip6_dst = sin6->sin6_addr; 4428 4429 /* 4430 * Add SRC address selection here: we can only reuse 4431 * to a limited degree the kame src-addr-sel, since 4432 * we can try their selection but it may not be 4433 * bound. 4434 */ 4435 bzero(&lsa6_tmp, sizeof(lsa6_tmp)); 4436 lsa6_tmp.sin6_family = AF_INET6; 4437 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 4438 lsa6 = &lsa6_tmp; 4439 if (net && out_of_asoc_ok == 0) { 4440 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4441 sctp_free_ifa(net->ro._s_addr); 4442 net->ro._s_addr = NULL; 4443 net->src_addr_selected = 0; 4444 if (ro->ro_rt) { 4445 RTFREE(ro->ro_rt); 4446 ro->ro_rt = NULL; 4447 } 4448 } 4449 if (net->src_addr_selected == 0) { 4450 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4451 /* KAME hack: embed scopeid */ 4452 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4453 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4454 return (EINVAL); 4455 } 4456 /* Cache the source address */ 4457 net->ro._s_addr = sctp_source_address_selection(inp, 4458 stcb, 4459 ro, 4460 net, 4461 0, 4462 vrf_id); 4463 (void)sa6_recoverscope(sin6); 4464 net->src_addr_selected = 1; 4465 } 4466 if (net->ro._s_addr == NULL) { 4467 SCTPDBG(SCTP_DEBUG_OUTPUT3, "V6:No route to host\n"); 4468 net->src_addr_selected = 0; 4469 sctp_handle_no_route(stcb, net, so_locked); 4470 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4471 sctp_m_freem(m); 4472 return (EHOSTUNREACH); 4473 } 4474 lsa6->sin6_addr = net->ro._s_addr->address.sin6.sin6_addr; 4475 } else { 4476 sin6 = (struct sockaddr_in6 *)&ro->ro_dst; 4477 /* KAME hack: embed scopeid */ 4478 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4479 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4480 return (EINVAL); 4481 } 4482 if (over_addr == NULL) { 4483 struct sctp_ifa *_lsrc; 4484 4485 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4486 net, 4487 out_of_asoc_ok, 4488 vrf_id); 4489 if (_lsrc == NULL) { 4490 sctp_handle_no_route(stcb, net, so_locked); 4491 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4492 sctp_m_freem(m); 4493 return (EHOSTUNREACH); 4494 } 4495 lsa6->sin6_addr = _lsrc->address.sin6.sin6_addr; 4496 sctp_free_ifa(_lsrc); 4497 } else { 4498 lsa6->sin6_addr = over_addr->sin6.sin6_addr; 4499 SCTP_RTALLOC(ro, vrf_id); 4500 } 4501 (void)sa6_recoverscope(sin6); 4502 } 4503 lsa6->sin6_port = inp->sctp_lport; 4504 4505 if (ro->ro_rt == NULL) { 4506 /* 4507 * src addr selection failed to find a route 4508 * (or valid source addr), so we can't get 4509 * there from here! 4510 */ 4511 sctp_handle_no_route(stcb, net, so_locked); 4512 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4513 sctp_m_freem(m); 4514 return (EHOSTUNREACH); 4515 } 4516 /* 4517 * XXX: sa6 may not have a valid sin6_scope_id in 4518 * the non-SCOPEDROUTING case. 4519 */ 4520 bzero(&lsa6_storage, sizeof(lsa6_storage)); 4521 lsa6_storage.sin6_family = AF_INET6; 4522 lsa6_storage.sin6_len = sizeof(lsa6_storage); 4523 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4524 if ((error = sa6_recoverscope(&lsa6_storage)) != 0) { 4525 SCTPDBG(SCTP_DEBUG_OUTPUT3, "recover scope fails error %d\n", error); 4526 sctp_m_freem(m); 4527 return (error); 4528 } 4529 /* XXX */ 4530 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4531 lsa6_storage.sin6_port = inp->sctp_lport; 4532 lsa6 = &lsa6_storage; 4533 ip6h->ip6_src = lsa6->sin6_addr; 4534 4535 if (port) { 4536 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4537 sctp_handle_no_route(stcb, net, so_locked); 4538 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4539 sctp_m_freem(m); 4540 return (EHOSTUNREACH); 4541 } 4542 udp = (struct udphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4543 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4544 udp->uh_dport = port; 4545 udp->uh_ulen = htons(packet_length - sizeof(struct ip6_hdr)); 4546 udp->uh_sum = 0; 4547 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4548 } else { 4549 sctphdr = (struct sctphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4550 } 4551 4552 sctphdr->src_port = src_port; 4553 sctphdr->dest_port = dest_port; 4554 sctphdr->v_tag = v_tag; 4555 sctphdr->checksum = 0; 4556 4557 /* 4558 * We set the hop limit now since there is a good 4559 * chance that our ro pointer is now filled 4560 */ 4561 ip6h->ip6_hlim = SCTP_GET_HLIM(inp, ro); 4562 ifp = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 4563 4564#ifdef SCTP_DEBUG 4565 /* Copy to be sure something bad is not happening */ 4566 sin6->sin6_addr = ip6h->ip6_dst; 4567 lsa6->sin6_addr = ip6h->ip6_src; 4568#endif 4569 4570 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv6 output routine from low level\n"); 4571 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src: "); 4572 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)lsa6); 4573 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst: "); 4574 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)sin6); 4575 if (net) { 4576 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4577 /* 4578 * preserve the port and scope for link 4579 * local send 4580 */ 4581 prev_scope = sin6->sin6_scope_id; 4582 prev_port = sin6->sin6_port; 4583 } 4584 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4585 /* failed to prepend data, give up */ 4586 sctp_m_freem(m); 4587 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4588 return (ENOMEM); 4589 } 4590 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4591 if (port) { 4592#if defined(SCTP_WITH_NO_CSUM) 4593 SCTP_STAT_INCR(sctps_sendnocrc); 4594#else 4595 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 4596 SCTP_STAT_INCR(sctps_sendswcrc); 4597#endif 4598 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), packet_length - sizeof(struct ip6_hdr))) == 0) { 4599 udp->uh_sum = 0xffff; 4600 } 4601 } else { 4602#if defined(SCTP_WITH_NO_CSUM) 4603 SCTP_STAT_INCR(sctps_sendnocrc); 4604#else 4605 m->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 4606 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4607 SCTP_STAT_INCR(sctps_sendhwcrc); 4608#endif 4609 } 4610 /* send it out. table id is taken from stcb */ 4611#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4612 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4613 so = SCTP_INP_SO(inp); 4614 SCTP_SOCKET_UNLOCK(so, 0); 4615 } 4616#endif 4617#ifdef SCTP_PACKET_LOGGING 4618 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4619 sctp_packet_log(o_pak); 4620#endif 4621 SCTP_IP6_OUTPUT(ret, o_pak, (struct route_in6 *)ro, &ifp, stcb, vrf_id); 4622#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4623 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4624 atomic_add_int(&stcb->asoc.refcnt, 1); 4625 SCTP_TCB_UNLOCK(stcb); 4626 SCTP_SOCKET_LOCK(so, 0); 4627 SCTP_TCB_LOCK(stcb); 4628 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4629 } 4630#endif 4631 if (net) { 4632 /* for link local this must be done */ 4633 sin6->sin6_scope_id = prev_scope; 4634 sin6->sin6_port = prev_port; 4635 } 4636 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 4637 SCTP_STAT_INCR(sctps_sendpackets); 4638 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4639 if (ret) { 4640 SCTP_STAT_INCR(sctps_senderrors); 4641 } 4642 if (net == NULL) { 4643 /* Now if we had a temp route free it */ 4644 RO_RTFREE(ro); 4645 } else { 4646 /* 4647 * PMTU check versus smallest asoc MTU goes 4648 * here 4649 */ 4650 if (ro->ro_rt == NULL) { 4651 /* Route was freed */ 4652 if (net->ro._s_addr && 4653 net->src_addr_selected) { 4654 sctp_free_ifa(net->ro._s_addr); 4655 net->ro._s_addr = NULL; 4656 } 4657 net->src_addr_selected = 0; 4658 } 4659 if ((ro->ro_rt != NULL) && 4660 (net->ro._s_addr)) { 4661 uint32_t mtu; 4662 4663 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt); 4664 if (mtu && 4665 (stcb->asoc.smallest_mtu > mtu)) { 4666 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4667 net->mtu = mtu; 4668 if (net->port) { 4669 net->mtu -= sizeof(struct udphdr); 4670 } 4671 } 4672 } else if (ifp) { 4673 if (ND_IFINFO(ifp)->linkmtu && 4674 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) { 4675 sctp_mtu_size_reset(inp, 4676 &stcb->asoc, 4677 ND_IFINFO(ifp)->linkmtu); 4678 } 4679 } 4680 } 4681 return (ret); 4682 } 4683#endif 4684 default: 4685 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 4686 ((struct sockaddr *)to)->sa_family); 4687 sctp_m_freem(m); 4688 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4689 return (EFAULT); 4690 } 4691} 4692 4693 4694void 4695sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int so_locked 4696#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 4697 SCTP_UNUSED 4698#endif 4699) 4700{ 4701 struct mbuf *m; 4702 struct sctp_nets *net; 4703 struct sctp_init_chunk *init; 4704 struct sctp_supported_addr_param *sup_addr; 4705 struct sctp_adaptation_layer_indication *ali; 4706 struct sctp_supported_chunk_types_param *pr_supported; 4707 struct sctp_paramhdr *ph; 4708 int cnt_inits_to = 0; 4709 int ret; 4710 uint16_t num_ext, chunk_len, padding_len, parameter_len; 4711 4712 /* INIT's always go to the primary (and usually ONLY address) */ 4713 net = stcb->asoc.primary_destination; 4714 if (net == NULL) { 4715 net = TAILQ_FIRST(&stcb->asoc.nets); 4716 if (net == NULL) { 4717 /* TSNH */ 4718 return; 4719 } 4720 /* we confirm any address we send an INIT to */ 4721 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4722 (void)sctp_set_primary_addr(stcb, NULL, net); 4723 } else { 4724 /* we confirm any address we send an INIT to */ 4725 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4726 } 4727 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT\n"); 4728#ifdef INET6 4729 if (net->ro._l_addr.sa.sa_family == AF_INET6) { 4730 /* 4731 * special hook, if we are sending to link local it will not 4732 * show up in our private address count. 4733 */ 4734 if (IN6_IS_ADDR_LINKLOCAL(&net->ro._l_addr.sin6.sin6_addr)) 4735 cnt_inits_to = 1; 4736 } 4737#endif 4738 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 4739 /* This case should not happen */ 4740 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - failed timer?\n"); 4741 return; 4742 } 4743 /* start the INIT timer */ 4744 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 4745 4746 m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_DONTWAIT, 1, MT_DATA); 4747 if (m == NULL) { 4748 /* No memory, INIT timer will re-attempt. */ 4749 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - mbuf?\n"); 4750 return; 4751 } 4752 chunk_len = (uint16_t) sizeof(struct sctp_init_chunk); 4753 padding_len = 0; 4754 /* 4755 * assume peer supports asconf in order to be able to queue local 4756 * address changes while an INIT is in flight and before the assoc 4757 * is established. 4758 */ 4759 stcb->asoc.peer_supports_asconf = 1; 4760 /* Now lets put the chunk header in place */ 4761 init = mtod(m, struct sctp_init_chunk *); 4762 /* now the chunk header */ 4763 init->ch.chunk_type = SCTP_INITIATION; 4764 init->ch.chunk_flags = 0; 4765 /* fill in later from mbuf we build */ 4766 init->ch.chunk_length = 0; 4767 /* place in my tag */ 4768 init->init.initiate_tag = htonl(stcb->asoc.my_vtag); 4769 /* set up some of the credits. */ 4770 init->init.a_rwnd = htonl(max(inp->sctp_socket ? SCTP_SB_LIMIT_RCV(inp->sctp_socket) : 0, 4771 SCTP_MINIMAL_RWND)); 4772 init->init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 4773 init->init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 4774 init->init.initial_tsn = htonl(stcb->asoc.init_seq_number); 4775 4776 if (stcb->asoc.scope.ipv4_addr_legal || stcb->asoc.scope.ipv6_addr_legal) { 4777 uint8_t i; 4778 4779 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 4780 if (stcb->asoc.scope.ipv4_addr_legal) { 4781 parameter_len += (uint16_t) sizeof(uint16_t); 4782 } 4783 if (stcb->asoc.scope.ipv6_addr_legal) { 4784 parameter_len += (uint16_t) sizeof(uint16_t); 4785 } 4786 sup_addr = (struct sctp_supported_addr_param *)(mtod(m, caddr_t)+chunk_len); 4787 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 4788 sup_addr->ph.param_length = htons(parameter_len); 4789 i = 0; 4790 if (stcb->asoc.scope.ipv4_addr_legal) { 4791 sup_addr->addr_type[i++] = htons(SCTP_IPV4_ADDRESS); 4792 } 4793 if (stcb->asoc.scope.ipv6_addr_legal) { 4794 sup_addr->addr_type[i++] = htons(SCTP_IPV6_ADDRESS); 4795 } 4796 padding_len = 4 - 2 * i; 4797 chunk_len += parameter_len; 4798 } 4799 /* Adaptation layer indication parameter */ 4800 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 4801 if (padding_len > 0) { 4802 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4803 chunk_len += padding_len; 4804 padding_len = 0; 4805 } 4806 parameter_len = (uint16_t) sizeof(struct sctp_adaptation_layer_indication); 4807 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 4808 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 4809 ali->ph.param_length = htons(parameter_len); 4810 ali->indication = ntohl(inp->sctp_ep.adaptation_layer_indicator); 4811 chunk_len += parameter_len; 4812 } 4813 if (SCTP_BASE_SYSCTL(sctp_inits_include_nat_friendly)) { 4814 /* Add NAT friendly parameter. */ 4815 if (padding_len > 0) { 4816 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4817 chunk_len += padding_len; 4818 padding_len = 0; 4819 } 4820 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 4821 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4822 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 4823 ph->param_length = htons(parameter_len); 4824 chunk_len += parameter_len; 4825 } 4826 /* now any cookie time extensions */ 4827 if (stcb->asoc.cookie_preserve_req) { 4828 struct sctp_cookie_perserve_param *cookie_preserve; 4829 4830 if (padding_len > 0) { 4831 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4832 chunk_len += padding_len; 4833 padding_len = 0; 4834 } 4835 parameter_len = (uint16_t) sizeof(struct sctp_cookie_perserve_param); 4836 cookie_preserve = (struct sctp_cookie_perserve_param *)(mtod(m, caddr_t)+chunk_len); 4837 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 4838 cookie_preserve->ph.param_length = htons(parameter_len); 4839 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 4840 stcb->asoc.cookie_preserve_req = 0; 4841 chunk_len += parameter_len; 4842 } 4843 /* ECN parameter */ 4844 if (stcb->asoc.ecn_allowed == 1) { 4845 if (padding_len > 0) { 4846 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4847 chunk_len += padding_len; 4848 padding_len = 0; 4849 } 4850 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 4851 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4852 ph->param_type = htons(SCTP_ECN_CAPABLE); 4853 ph->param_length = htons(parameter_len); 4854 chunk_len += parameter_len; 4855 } 4856 /* And now tell the peer we do support PR-SCTP. */ 4857 if (padding_len > 0) { 4858 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4859 chunk_len += padding_len; 4860 padding_len = 0; 4861 } 4862 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 4863 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4864 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 4865 ph->param_length = htons(parameter_len); 4866 chunk_len += parameter_len; 4867 4868 /* And now tell the peer we do all the extensions */ 4869 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 4870 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 4871 num_ext = 0; 4872 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 4873 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 4874 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 4875 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 4876 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 4877 if (!SCTP_BASE_SYSCTL(sctp_auth_disable)) { 4878 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 4879 } 4880 if (stcb->asoc.sctp_nr_sack_on_off == 1) { 4881 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 4882 } 4883 parameter_len = (uint16_t) sizeof(struct sctp_supported_chunk_types_param) + num_ext; 4884 pr_supported->ph.param_length = htons(parameter_len); 4885 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4886 chunk_len += parameter_len; 4887 4888 /* add authentication parameters */ 4889 if (!SCTP_BASE_SYSCTL(sctp_auth_disable)) { 4890 /* attach RANDOM parameter, if available */ 4891 if (stcb->asoc.authinfo.random != NULL) { 4892 struct sctp_auth_random *randp; 4893 4894 if (padding_len > 0) { 4895 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4896 chunk_len += padding_len; 4897 padding_len = 0; 4898 } 4899 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 4900 parameter_len = (uint16_t) sizeof(struct sctp_auth_random) + stcb->asoc.authinfo.random_len; 4901 /* random key already contains the header */ 4902 memcpy(randp, stcb->asoc.authinfo.random->key, parameter_len); 4903 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4904 chunk_len += parameter_len; 4905 } 4906 /* add HMAC_ALGO parameter */ 4907 if ((stcb->asoc.local_hmacs != NULL) && 4908 (stcb->asoc.local_hmacs->num_algo > 0)) { 4909 struct sctp_auth_hmac_algo *hmacs; 4910 4911 if (padding_len > 0) { 4912 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4913 chunk_len += padding_len; 4914 padding_len = 0; 4915 } 4916 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 4917 parameter_len = (uint16_t) (sizeof(struct sctp_auth_hmac_algo) + 4918 stcb->asoc.local_hmacs->num_algo * sizeof(uint16_t)); 4919 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 4920 hmacs->ph.param_length = htons(parameter_len); 4921 sctp_serialize_hmaclist(stcb->asoc.local_hmacs, (uint8_t *) hmacs->hmac_ids); 4922 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4923 chunk_len += parameter_len; 4924 } 4925 /* add CHUNKS parameter */ 4926 if (sctp_auth_get_chklist_size(stcb->asoc.local_auth_chunks) > 0) { 4927 struct sctp_auth_chunk_list *chunks; 4928 4929 if (padding_len > 0) { 4930 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4931 chunk_len += padding_len; 4932 padding_len = 0; 4933 } 4934 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 4935 parameter_len = (uint16_t) (sizeof(struct sctp_auth_chunk_list) + 4936 sctp_auth_get_chklist_size(stcb->asoc.local_auth_chunks)); 4937 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 4938 chunks->ph.param_length = htons(parameter_len); 4939 sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks, chunks->chunk_types); 4940 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4941 chunk_len += parameter_len; 4942 } 4943 } 4944 SCTP_BUF_LEN(m) = chunk_len; 4945 4946 /* now the addresses */ 4947 /* 4948 * To optimize this we could put the scoping stuff into a structure 4949 * and remove the individual uint8's from the assoc structure. Then 4950 * we could just sifa in the address within the stcb. But for now 4951 * this is a quick hack to get the address stuff teased apart. 4952 */ 4953 sctp_add_addresses_to_i_ia(inp, stcb, &stcb->asoc.scope, m, cnt_inits_to, &padding_len, &chunk_len); 4954 4955 init->ch.chunk_length = htons(chunk_len); 4956 if (padding_len > 0) { 4957 struct mbuf *m_at, *mp_last; 4958 4959 mp_last = NULL; 4960 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 4961 if (SCTP_BUF_NEXT(m_at) == NULL) 4962 mp_last = m_at; 4963 } 4964 if ((mp_last == NULL) || sctp_add_pad_tombuf(mp_last, padding_len)) { 4965 sctp_m_freem(m); 4966 return; 4967 } 4968 } 4969 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - calls lowlevel_output\n"); 4970 ret = sctp_lowlevel_chunk_output(inp, stcb, net, 4971 (struct sockaddr *)&net->ro._l_addr, 4972 m, 0, NULL, 0, 0, 0, 0, 4973 inp->sctp_lport, stcb->rport, htonl(0), 4974 net->port, NULL, 4975 0, 0, 4976 so_locked); 4977 SCTPDBG(SCTP_DEBUG_OUTPUT4, "lowlevel_output - %d\n", ret); 4978 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 4979 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 4980} 4981 4982struct mbuf * 4983sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 4984 int param_offset, int *abort_processing, struct sctp_chunkhdr *cp, int *nat_friendly) 4985{ 4986 /* 4987 * Given a mbuf containing an INIT or INIT-ACK with the param_offset 4988 * being equal to the beginning of the params i.e. (iphlen + 4989 * sizeof(struct sctp_init_msg) parse through the parameters to the 4990 * end of the mbuf verifying that all parameters are known. 4991 * 4992 * For unknown parameters build and return a mbuf with 4993 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop 4994 * processing this chunk stop, and set *abort_processing to 1. 4995 * 4996 * By having param_offset be pre-set to where parameters begin it is 4997 * hoped that this routine may be reused in the future by new 4998 * features. 4999 */ 5000 struct sctp_paramhdr *phdr, params; 5001 5002 struct mbuf *mat, *op_err; 5003 char tempbuf[SCTP_PARAM_BUFFER_SIZE]; 5004 int at, limit, pad_needed; 5005 uint16_t ptype, plen, padded_size; 5006 int err_at; 5007 5008 *abort_processing = 0; 5009 mat = in_initpkt; 5010 err_at = 0; 5011 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 5012 at = param_offset; 5013 op_err = NULL; 5014 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Check for unrecognized param's\n"); 5015 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5016 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 5017 ptype = ntohs(phdr->param_type); 5018 plen = ntohs(phdr->param_length); 5019 if ((plen > limit) || (plen < sizeof(struct sctp_paramhdr))) { 5020 /* wacked parameter */ 5021 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error %d\n", plen); 5022 goto invalid_size; 5023 } 5024 limit -= SCTP_SIZE32(plen); 5025 /*- 5026 * All parameters for all chunks that we know/understand are 5027 * listed here. We process them other places and make 5028 * appropriate stop actions per the upper bits. However this 5029 * is the generic routine processor's can call to get back 5030 * an operr.. to either incorporate (init-ack) or send. 5031 */ 5032 padded_size = SCTP_SIZE32(plen); 5033 switch (ptype) { 5034 /* Param's with variable size */ 5035 case SCTP_HEARTBEAT_INFO: 5036 case SCTP_STATE_COOKIE: 5037 case SCTP_UNRECOG_PARAM: 5038 case SCTP_ERROR_CAUSE_IND: 5039 /* ok skip fwd */ 5040 at += padded_size; 5041 break; 5042 /* Param's with variable size within a range */ 5043 case SCTP_CHUNK_LIST: 5044 case SCTP_SUPPORTED_CHUNK_EXT: 5045 if (padded_size > (sizeof(struct sctp_supported_chunk_types_param) + (sizeof(uint8_t) * SCTP_MAX_SUPPORTED_EXT))) { 5046 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error chklist %d\n", plen); 5047 goto invalid_size; 5048 } 5049 at += padded_size; 5050 break; 5051 case SCTP_SUPPORTED_ADDRTYPE: 5052 if (padded_size > SCTP_MAX_ADDR_PARAMS_SIZE) { 5053 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error supaddrtype %d\n", plen); 5054 goto invalid_size; 5055 } 5056 at += padded_size; 5057 break; 5058 case SCTP_RANDOM: 5059 if (padded_size > (sizeof(struct sctp_auth_random) + SCTP_RANDOM_MAX_SIZE)) { 5060 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error random %d\n", plen); 5061 goto invalid_size; 5062 } 5063 at += padded_size; 5064 break; 5065 case SCTP_SET_PRIM_ADDR: 5066 case SCTP_DEL_IP_ADDRESS: 5067 case SCTP_ADD_IP_ADDRESS: 5068 if ((padded_size != sizeof(struct sctp_asconf_addrv4_param)) && 5069 (padded_size != sizeof(struct sctp_asconf_addr_param))) { 5070 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error setprim %d\n", plen); 5071 goto invalid_size; 5072 } 5073 at += padded_size; 5074 break; 5075 /* Param's with a fixed size */ 5076 case SCTP_IPV4_ADDRESS: 5077 if (padded_size != sizeof(struct sctp_ipv4addr_param)) { 5078 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv4 addr %d\n", plen); 5079 goto invalid_size; 5080 } 5081 at += padded_size; 5082 break; 5083 case SCTP_IPV6_ADDRESS: 5084 if (padded_size != sizeof(struct sctp_ipv6addr_param)) { 5085 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv6 addr %d\n", plen); 5086 goto invalid_size; 5087 } 5088 at += padded_size; 5089 break; 5090 case SCTP_COOKIE_PRESERVE: 5091 if (padded_size != sizeof(struct sctp_cookie_perserve_param)) { 5092 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error cookie-preserve %d\n", plen); 5093 goto invalid_size; 5094 } 5095 at += padded_size; 5096 break; 5097 case SCTP_HAS_NAT_SUPPORT: 5098 *nat_friendly = 1; 5099 /* fall through */ 5100 case SCTP_PRSCTP_SUPPORTED: 5101 5102 if (padded_size != sizeof(struct sctp_paramhdr)) { 5103 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error prsctp/nat support %d\n", plen); 5104 goto invalid_size; 5105 } 5106 at += padded_size; 5107 break; 5108 case SCTP_ECN_CAPABLE: 5109 if (padded_size != sizeof(struct sctp_ecn_supported_param)) { 5110 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecn %d\n", plen); 5111 goto invalid_size; 5112 } 5113 at += padded_size; 5114 break; 5115 case SCTP_ULP_ADAPTATION: 5116 if (padded_size != sizeof(struct sctp_adaptation_layer_indication)) { 5117 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error adapatation %d\n", plen); 5118 goto invalid_size; 5119 } 5120 at += padded_size; 5121 break; 5122 case SCTP_SUCCESS_REPORT: 5123 if (padded_size != sizeof(struct sctp_asconf_paramhdr)) { 5124 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error success %d\n", plen); 5125 goto invalid_size; 5126 } 5127 at += padded_size; 5128 break; 5129 case SCTP_HOSTNAME_ADDRESS: 5130 { 5131 /* We can NOT handle HOST NAME addresses!! */ 5132 int l_len; 5133 5134 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Can't handle hostname addresses.. abort processing\n"); 5135 *abort_processing = 1; 5136 if (op_err == NULL) { 5137 /* Ok need to try to get a mbuf */ 5138#ifdef INET6 5139 l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5140#else 5141 l_len = sizeof(struct ip) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5142#endif 5143 l_len += plen; 5144 l_len += sizeof(struct sctp_paramhdr); 5145 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA); 5146 if (op_err) { 5147 SCTP_BUF_LEN(op_err) = 0; 5148 /* 5149 * pre-reserve space for ip 5150 * and sctp header and 5151 * chunk hdr 5152 */ 5153#ifdef INET6 5154 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5155#else 5156 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5157#endif 5158 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5159 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5160 } 5161 } 5162 if (op_err) { 5163 /* If we have space */ 5164 struct sctp_paramhdr s; 5165 5166 if (err_at % 4) { 5167 uint32_t cpthis = 0; 5168 5169 pad_needed = 4 - (err_at % 4); 5170 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 5171 err_at += pad_needed; 5172 } 5173 s.param_type = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR); 5174 s.param_length = htons(sizeof(s) + plen); 5175 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 5176 err_at += sizeof(s); 5177 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, min(sizeof(tempbuf), plen)); 5178 if (phdr == NULL) { 5179 sctp_m_freem(op_err); 5180 /* 5181 * we are out of memory but 5182 * we still need to have a 5183 * look at what to do (the 5184 * system is in trouble 5185 * though). 5186 */ 5187 return (NULL); 5188 } 5189 m_copyback(op_err, err_at, plen, (caddr_t)phdr); 5190 } 5191 return (op_err); 5192 break; 5193 } 5194 default: 5195 /* 5196 * we do not recognize the parameter figure out what 5197 * we do. 5198 */ 5199 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Hit default param %x\n", ptype); 5200 if ((ptype & 0x4000) == 0x4000) { 5201 /* Report bit is set?? */ 5202 SCTPDBG(SCTP_DEBUG_OUTPUT1, "report op err\n"); 5203 if (op_err == NULL) { 5204 int l_len; 5205 5206 /* Ok need to try to get an mbuf */ 5207#ifdef INET6 5208 l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5209#else 5210 l_len = sizeof(struct ip) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5211#endif 5212 l_len += plen; 5213 l_len += sizeof(struct sctp_paramhdr); 5214 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA); 5215 if (op_err) { 5216 SCTP_BUF_LEN(op_err) = 0; 5217#ifdef INET6 5218 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5219#else 5220 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5221#endif 5222 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5223 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5224 } 5225 } 5226 if (op_err) { 5227 /* If we have space */ 5228 struct sctp_paramhdr s; 5229 5230 if (err_at % 4) { 5231 uint32_t cpthis = 0; 5232 5233 pad_needed = 4 - (err_at % 4); 5234 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 5235 err_at += pad_needed; 5236 } 5237 s.param_type = htons(SCTP_UNRECOG_PARAM); 5238 s.param_length = htons(sizeof(s) + plen); 5239 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 5240 err_at += sizeof(s); 5241 if (plen > sizeof(tempbuf)) { 5242 plen = sizeof(tempbuf); 5243 } 5244 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, min(sizeof(tempbuf), plen)); 5245 if (phdr == NULL) { 5246 sctp_m_freem(op_err); 5247 /* 5248 * we are out of memory but 5249 * we still need to have a 5250 * look at what to do (the 5251 * system is in trouble 5252 * though). 5253 */ 5254 op_err = NULL; 5255 goto more_processing; 5256 } 5257 m_copyback(op_err, err_at, plen, (caddr_t)phdr); 5258 err_at += plen; 5259 } 5260 } 5261 more_processing: 5262 if ((ptype & 0x8000) == 0x0000) { 5263 SCTPDBG(SCTP_DEBUG_OUTPUT1, "stop proc\n"); 5264 return (op_err); 5265 } else { 5266 /* skip this chunk and continue processing */ 5267 SCTPDBG(SCTP_DEBUG_OUTPUT1, "move on\n"); 5268 at += SCTP_SIZE32(plen); 5269 } 5270 break; 5271 5272 } 5273 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5274 } 5275 return (op_err); 5276invalid_size: 5277 SCTPDBG(SCTP_DEBUG_OUTPUT1, "abort flag set\n"); 5278 *abort_processing = 1; 5279 if ((op_err == NULL) && phdr) { 5280 int l_len; 5281 5282#ifdef INET6 5283 l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5284#else 5285 l_len = sizeof(struct ip) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5286#endif 5287 l_len += (2 * sizeof(struct sctp_paramhdr)); 5288 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA); 5289 if (op_err) { 5290 SCTP_BUF_LEN(op_err) = 0; 5291#ifdef INET6 5292 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5293#else 5294 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5295#endif 5296 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5297 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5298 } 5299 } 5300 if ((op_err) && phdr) { 5301 struct sctp_paramhdr s; 5302 5303 if (err_at % 4) { 5304 uint32_t cpthis = 0; 5305 5306 pad_needed = 4 - (err_at % 4); 5307 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 5308 err_at += pad_needed; 5309 } 5310 s.param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 5311 s.param_length = htons(sizeof(s) + sizeof(struct sctp_paramhdr)); 5312 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 5313 err_at += sizeof(s); 5314 /* Only copy back the p-hdr that caused the issue */ 5315 m_copyback(op_err, err_at, sizeof(struct sctp_paramhdr), (caddr_t)phdr); 5316 } 5317 return (op_err); 5318} 5319 5320static int 5321sctp_are_there_new_addresses(struct sctp_association *asoc, 5322 struct mbuf *in_initpkt, int offset, struct sockaddr *src) 5323{ 5324 /* 5325 * Given a INIT packet, look through the packet to verify that there 5326 * are NO new addresses. As we go through the parameters add reports 5327 * of any un-understood parameters that require an error. Also we 5328 * must return (1) to drop the packet if we see a un-understood 5329 * parameter that tells us to drop the chunk. 5330 */ 5331 struct sockaddr *sa_touse; 5332 struct sockaddr *sa; 5333 struct sctp_paramhdr *phdr, params; 5334 uint16_t ptype, plen; 5335 uint8_t fnd; 5336 struct sctp_nets *net; 5337 5338#ifdef INET 5339 struct sockaddr_in sin4, *sa4; 5340 5341#endif 5342#ifdef INET6 5343 struct sockaddr_in6 sin6, *sa6; 5344 5345#endif 5346 5347#ifdef INET 5348 memset(&sin4, 0, sizeof(sin4)); 5349 sin4.sin_family = AF_INET; 5350 sin4.sin_len = sizeof(sin4); 5351#endif 5352#ifdef INET6 5353 memset(&sin6, 0, sizeof(sin6)); 5354 sin6.sin6_family = AF_INET6; 5355 sin6.sin6_len = sizeof(sin6); 5356#endif 5357 /* First what about the src address of the pkt ? */ 5358 fnd = 0; 5359 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5360 sa = (struct sockaddr *)&net->ro._l_addr; 5361 if (sa->sa_family == src->sa_family) { 5362#ifdef INET 5363 if (sa->sa_family == AF_INET) { 5364 struct sockaddr_in *src4; 5365 5366 sa4 = (struct sockaddr_in *)sa; 5367 src4 = (struct sockaddr_in *)src; 5368 if (sa4->sin_addr.s_addr == src4->sin_addr.s_addr) { 5369 fnd = 1; 5370 break; 5371 } 5372 } 5373#endif 5374#ifdef INET6 5375 if (sa->sa_family == AF_INET6) { 5376 struct sockaddr_in6 *src6; 5377 5378 sa6 = (struct sockaddr_in6 *)sa; 5379 src6 = (struct sockaddr_in6 *)src; 5380 if (SCTP6_ARE_ADDR_EQUAL(sa6, src6)) { 5381 fnd = 1; 5382 break; 5383 } 5384 } 5385#endif 5386 } 5387 } 5388 if (fnd == 0) { 5389 /* New address added! no need to look futher. */ 5390 return (1); 5391 } 5392 /* Ok so far lets munge through the rest of the packet */ 5393 offset += sizeof(struct sctp_init_chunk); 5394 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5395 while (phdr) { 5396 sa_touse = NULL; 5397 ptype = ntohs(phdr->param_type); 5398 plen = ntohs(phdr->param_length); 5399 switch (ptype) { 5400#ifdef INET 5401 case SCTP_IPV4_ADDRESS: 5402 { 5403 struct sctp_ipv4addr_param *p4, p4_buf; 5404 5405 phdr = sctp_get_next_param(in_initpkt, offset, 5406 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 5407 if (plen != sizeof(struct sctp_ipv4addr_param) || 5408 phdr == NULL) { 5409 return (1); 5410 } 5411 p4 = (struct sctp_ipv4addr_param *)phdr; 5412 sin4.sin_addr.s_addr = p4->addr; 5413 sa_touse = (struct sockaddr *)&sin4; 5414 break; 5415 } 5416#endif 5417#ifdef INET6 5418 case SCTP_IPV6_ADDRESS: 5419 { 5420 struct sctp_ipv6addr_param *p6, p6_buf; 5421 5422 phdr = sctp_get_next_param(in_initpkt, offset, 5423 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 5424 if (plen != sizeof(struct sctp_ipv6addr_param) || 5425 phdr == NULL) { 5426 return (1); 5427 } 5428 p6 = (struct sctp_ipv6addr_param *)phdr; 5429 memcpy((caddr_t)&sin6.sin6_addr, p6->addr, 5430 sizeof(p6->addr)); 5431 sa_touse = (struct sockaddr *)&sin6; 5432 break; 5433 } 5434#endif 5435 default: 5436 sa_touse = NULL; 5437 break; 5438 } 5439 if (sa_touse) { 5440 /* ok, sa_touse points to one to check */ 5441 fnd = 0; 5442 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5443 sa = (struct sockaddr *)&net->ro._l_addr; 5444 if (sa->sa_family != sa_touse->sa_family) { 5445 continue; 5446 } 5447#ifdef INET 5448 if (sa->sa_family == AF_INET) { 5449 sa4 = (struct sockaddr_in *)sa; 5450 if (sa4->sin_addr.s_addr == 5451 sin4.sin_addr.s_addr) { 5452 fnd = 1; 5453 break; 5454 } 5455 } 5456#endif 5457#ifdef INET6 5458 if (sa->sa_family == AF_INET6) { 5459 sa6 = (struct sockaddr_in6 *)sa; 5460 if (SCTP6_ARE_ADDR_EQUAL( 5461 sa6, &sin6)) { 5462 fnd = 1; 5463 break; 5464 } 5465 } 5466#endif 5467 } 5468 if (!fnd) { 5469 /* New addr added! no need to look further */ 5470 return (1); 5471 } 5472 } 5473 offset += SCTP_SIZE32(plen); 5474 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5475 } 5476 return (0); 5477} 5478 5479/* 5480 * Given a MBUF chain that was sent into us containing an INIT. Build a 5481 * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done 5482 * a pullup to include IPv6/4header, SCTP header and initial part of INIT 5483 * message (i.e. the struct sctp_init_msg). 5484 */ 5485void 5486sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 5487 struct mbuf *init_pkt, int iphlen, int offset, 5488 struct sockaddr *src, struct sockaddr *dst, 5489 struct sctphdr *sh, struct sctp_init_chunk *init_chk, 5490 uint8_t use_mflowid, uint32_t mflowid, 5491 uint32_t vrf_id, uint16_t port, int hold_inp_lock) 5492{ 5493 struct sctp_association *asoc; 5494 struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *mp_last; 5495 struct sctp_init_ack_chunk *initack; 5496 struct sctp_adaptation_layer_indication *ali; 5497 struct sctp_ecn_supported_param *ecn; 5498 struct sctp_prsctp_supported_param *prsctp; 5499 struct sctp_supported_chunk_types_param *pr_supported; 5500 union sctp_sockstore *over_addr; 5501 5502#ifdef INET 5503 struct sockaddr_in *dst4 = (struct sockaddr_in *)dst; 5504 struct sockaddr_in *src4 = (struct sockaddr_in *)src; 5505 struct sockaddr_in *sin; 5506 5507#endif 5508#ifdef INET6 5509 struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst; 5510 struct sockaddr_in6 *src6 = (struct sockaddr_in6 *)src; 5511 struct sockaddr_in6 *sin6; 5512 5513#endif 5514 struct sockaddr *to; 5515 struct sctp_state_cookie stc; 5516 struct sctp_nets *net = NULL; 5517 uint8_t *signature = NULL; 5518 int cnt_inits_to = 0; 5519 uint16_t his_limit, i_want; 5520 int abort_flag, padval; 5521 int num_ext; 5522 int p_len; 5523 int nat_friendly = 0; 5524 struct socket *so; 5525 5526 if (stcb) { 5527 asoc = &stcb->asoc; 5528 } else { 5529 asoc = NULL; 5530 } 5531 mp_last = NULL; 5532 if ((asoc != NULL) && 5533 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) && 5534 (sctp_are_there_new_addresses(asoc, init_pkt, offset, src))) { 5535 /* new addresses, out of here in non-cookie-wait states */ 5536 /* 5537 * Send a ABORT, we don't add the new address error clause 5538 * though we even set the T bit and copy in the 0 tag.. this 5539 * looks no different than if no listener was present. 5540 */ 5541 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5542 "Address added"); 5543 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5544 use_mflowid, mflowid, 5545 vrf_id, port); 5546 return; 5547 } 5548 abort_flag = 0; 5549 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 5550 (offset + sizeof(struct sctp_init_chunk)), 5551 &abort_flag, (struct sctp_chunkhdr *)init_chk, &nat_friendly); 5552 if (abort_flag) { 5553do_a_abort: 5554 if (op_err == NULL) { 5555 char msg[SCTP_DIAG_INFO_LEN]; 5556 5557 snprintf(msg, sizeof(msg), "%s:%d at %s\n", __FILE__, __LINE__, __FUNCTION__); 5558 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5559 msg); 5560 } 5561 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 5562 init_chk->init.initiate_tag, op_err, 5563 use_mflowid, mflowid, 5564 vrf_id, port); 5565 return; 5566 } 5567 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 5568 if (m == NULL) { 5569 /* No memory, INIT timer will re-attempt. */ 5570 if (op_err) 5571 sctp_m_freem(op_err); 5572 return; 5573 } 5574 SCTP_BUF_LEN(m) = sizeof(struct sctp_init_chunk); 5575 5576 /* 5577 * We might not overwrite the identification[] completely and on 5578 * some platforms time_entered will contain some padding. Therefore 5579 * zero out the cookie to avoid putting uninitialized memory on the 5580 * wire. 5581 */ 5582 memset(&stc, 0, sizeof(struct sctp_state_cookie)); 5583 5584 /* the time I built cookie */ 5585 (void)SCTP_GETTIME_TIMEVAL(&stc.time_entered); 5586 5587 /* populate any tie tags */ 5588 if (asoc != NULL) { 5589 /* unlock before tag selections */ 5590 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 5591 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 5592 stc.cookie_life = asoc->cookie_life; 5593 net = asoc->primary_destination; 5594 } else { 5595 stc.tie_tag_my_vtag = 0; 5596 stc.tie_tag_peer_vtag = 0; 5597 /* life I will award this cookie */ 5598 stc.cookie_life = inp->sctp_ep.def_cookie_life; 5599 } 5600 5601 /* copy in the ports for later check */ 5602 stc.myport = sh->dest_port; 5603 stc.peerport = sh->src_port; 5604 5605 /* 5606 * If we wanted to honor cookie life extentions, we would add to 5607 * stc.cookie_life. For now we should NOT honor any extension 5608 */ 5609 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 5610 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5611 stc.ipv6_addr_legal = 1; 5612 if (SCTP_IPV6_V6ONLY(inp)) { 5613 stc.ipv4_addr_legal = 0; 5614 } else { 5615 stc.ipv4_addr_legal = 1; 5616 } 5617 } else { 5618 stc.ipv6_addr_legal = 0; 5619 stc.ipv4_addr_legal = 1; 5620 } 5621#ifdef SCTP_DONT_DO_PRIVADDR_SCOPE 5622 stc.ipv4_scope = 1; 5623#else 5624 stc.ipv4_scope = 0; 5625#endif 5626 if (net == NULL) { 5627 to = src; 5628 switch (dst->sa_family) { 5629#ifdef INET 5630 case AF_INET: 5631 { 5632 /* lookup address */ 5633 stc.address[0] = src4->sin_addr.s_addr; 5634 stc.address[1] = 0; 5635 stc.address[2] = 0; 5636 stc.address[3] = 0; 5637 stc.addr_type = SCTP_IPV4_ADDRESS; 5638 /* local from address */ 5639 stc.laddress[0] = dst4->sin_addr.s_addr; 5640 stc.laddress[1] = 0; 5641 stc.laddress[2] = 0; 5642 stc.laddress[3] = 0; 5643 stc.laddr_type = SCTP_IPV4_ADDRESS; 5644 /* scope_id is only for v6 */ 5645 stc.scope_id = 0; 5646#ifndef SCTP_DONT_DO_PRIVADDR_SCOPE 5647 if (IN4_ISPRIVATE_ADDRESS(&src4->sin_addr)) { 5648 stc.ipv4_scope = 1; 5649 } 5650#else 5651 stc.ipv4_scope = 1; 5652#endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */ 5653 /* Must use the address in this case */ 5654 if (sctp_is_address_on_local_host(src, vrf_id)) { 5655 stc.loopback_scope = 1; 5656 stc.ipv4_scope = 1; 5657 stc.site_scope = 1; 5658 stc.local_scope = 0; 5659 } 5660 break; 5661 } 5662#endif 5663#ifdef INET6 5664 case AF_INET6: 5665 { 5666 stc.addr_type = SCTP_IPV6_ADDRESS; 5667 memcpy(&stc.address, &src6->sin6_addr, sizeof(struct in6_addr)); 5668 stc.scope_id = in6_getscope(&src6->sin6_addr); 5669 if (sctp_is_address_on_local_host(src, vrf_id)) { 5670 stc.loopback_scope = 1; 5671 stc.local_scope = 0; 5672 stc.site_scope = 1; 5673 stc.ipv4_scope = 1; 5674 } else if (IN6_IS_ADDR_LINKLOCAL(&src6->sin6_addr)) { 5675 /* 5676 * If the new destination is a 5677 * LINK_LOCAL we must have common 5678 * both site and local scope. Don't 5679 * set local scope though since we 5680 * must depend on the source to be 5681 * added implicitly. We cannot 5682 * assure just because we share one 5683 * link that all links are common. 5684 */ 5685 stc.local_scope = 0; 5686 stc.site_scope = 1; 5687 stc.ipv4_scope = 1; 5688 /* 5689 * we start counting for the private 5690 * address stuff at 1. since the 5691 * link local we source from won't 5692 * show up in our scoped count. 5693 */ 5694 cnt_inits_to = 1; 5695 /* 5696 * pull out the scope_id from 5697 * incoming pkt 5698 */ 5699 } else if (IN6_IS_ADDR_SITELOCAL(&src6->sin6_addr)) { 5700 /* 5701 * If the new destination is 5702 * SITE_LOCAL then we must have site 5703 * scope in common. 5704 */ 5705 stc.site_scope = 1; 5706 } 5707 memcpy(&stc.laddress, &dst6->sin6_addr, sizeof(struct in6_addr)); 5708 stc.laddr_type = SCTP_IPV6_ADDRESS; 5709 break; 5710 } 5711#endif 5712 default: 5713 /* TSNH */ 5714 goto do_a_abort; 5715 break; 5716 } 5717 } else { 5718 /* set the scope per the existing tcb */ 5719 5720#ifdef INET6 5721 struct sctp_nets *lnet; 5722 5723#endif 5724 5725 stc.loopback_scope = asoc->scope.loopback_scope; 5726 stc.ipv4_scope = asoc->scope.ipv4_local_scope; 5727 stc.site_scope = asoc->scope.site_scope; 5728 stc.local_scope = asoc->scope.local_scope; 5729#ifdef INET6 5730 /* Why do we not consider IPv4 LL addresses? */ 5731 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 5732 if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) { 5733 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) { 5734 /* 5735 * if we have a LL address, start 5736 * counting at 1. 5737 */ 5738 cnt_inits_to = 1; 5739 } 5740 } 5741 } 5742#endif 5743 /* use the net pointer */ 5744 to = (struct sockaddr *)&net->ro._l_addr; 5745 switch (to->sa_family) { 5746#ifdef INET 5747 case AF_INET: 5748 sin = (struct sockaddr_in *)to; 5749 stc.address[0] = sin->sin_addr.s_addr; 5750 stc.address[1] = 0; 5751 stc.address[2] = 0; 5752 stc.address[3] = 0; 5753 stc.addr_type = SCTP_IPV4_ADDRESS; 5754 if (net->src_addr_selected == 0) { 5755 /* 5756 * strange case here, the INIT should have 5757 * did the selection. 5758 */ 5759 net->ro._s_addr = sctp_source_address_selection(inp, 5760 stcb, (sctp_route_t *) & net->ro, 5761 net, 0, vrf_id); 5762 if (net->ro._s_addr == NULL) 5763 return; 5764 5765 net->src_addr_selected = 1; 5766 5767 } 5768 stc.laddress[0] = net->ro._s_addr->address.sin.sin_addr.s_addr; 5769 stc.laddress[1] = 0; 5770 stc.laddress[2] = 0; 5771 stc.laddress[3] = 0; 5772 stc.laddr_type = SCTP_IPV4_ADDRESS; 5773 /* scope_id is only for v6 */ 5774 stc.scope_id = 0; 5775 break; 5776#endif 5777#ifdef INET6 5778 case AF_INET6: 5779 sin6 = (struct sockaddr_in6 *)to; 5780 memcpy(&stc.address, &sin6->sin6_addr, 5781 sizeof(struct in6_addr)); 5782 stc.addr_type = SCTP_IPV6_ADDRESS; 5783 stc.scope_id = sin6->sin6_scope_id; 5784 if (net->src_addr_selected == 0) { 5785 /* 5786 * strange case here, the INIT should have 5787 * done the selection. 5788 */ 5789 net->ro._s_addr = sctp_source_address_selection(inp, 5790 stcb, (sctp_route_t *) & net->ro, 5791 net, 0, vrf_id); 5792 if (net->ro._s_addr == NULL) 5793 return; 5794 5795 net->src_addr_selected = 1; 5796 } 5797 memcpy(&stc.laddress, &net->ro._s_addr->address.sin6.sin6_addr, 5798 sizeof(struct in6_addr)); 5799 stc.laddr_type = SCTP_IPV6_ADDRESS; 5800 break; 5801#endif 5802 } 5803 } 5804 /* Now lets put the SCTP header in place */ 5805 initack = mtod(m, struct sctp_init_ack_chunk *); 5806 /* Save it off for quick ref */ 5807 stc.peers_vtag = init_chk->init.initiate_tag; 5808 /* who are we */ 5809 memcpy(stc.identification, SCTP_VERSION_STRING, 5810 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 5811 memset(stc.reserved, 0, SCTP_RESERVE_SPACE); 5812 /* now the chunk header */ 5813 initack->ch.chunk_type = SCTP_INITIATION_ACK; 5814 initack->ch.chunk_flags = 0; 5815 /* fill in later from mbuf we build */ 5816 initack->ch.chunk_length = 0; 5817 /* place in my tag */ 5818 if ((asoc != NULL) && 5819 ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 5820 (SCTP_GET_STATE(asoc) == SCTP_STATE_INUSE) || 5821 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) { 5822 /* re-use the v-tags and init-seq here */ 5823 initack->init.initiate_tag = htonl(asoc->my_vtag); 5824 initack->init.initial_tsn = htonl(asoc->init_seq_number); 5825 } else { 5826 uint32_t vtag, itsn; 5827 5828 if (hold_inp_lock) { 5829 SCTP_INP_INCR_REF(inp); 5830 SCTP_INP_RUNLOCK(inp); 5831 } 5832 if (asoc) { 5833 atomic_add_int(&asoc->refcnt, 1); 5834 SCTP_TCB_UNLOCK(stcb); 5835 new_tag: 5836 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5837 if ((asoc->peer_supports_nat) && (vtag == asoc->my_vtag)) { 5838 /* 5839 * Got a duplicate vtag on some guy behind a 5840 * nat make sure we don't use it. 5841 */ 5842 goto new_tag; 5843 } 5844 initack->init.initiate_tag = htonl(vtag); 5845 /* get a TSN to use too */ 5846 itsn = sctp_select_initial_TSN(&inp->sctp_ep); 5847 initack->init.initial_tsn = htonl(itsn); 5848 SCTP_TCB_LOCK(stcb); 5849 atomic_add_int(&asoc->refcnt, -1); 5850 } else { 5851 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5852 initack->init.initiate_tag = htonl(vtag); 5853 /* get a TSN to use too */ 5854 initack->init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 5855 } 5856 if (hold_inp_lock) { 5857 SCTP_INP_RLOCK(inp); 5858 SCTP_INP_DECR_REF(inp); 5859 } 5860 } 5861 /* save away my tag to */ 5862 stc.my_vtag = initack->init.initiate_tag; 5863 5864 /* set up some of the credits. */ 5865 so = inp->sctp_socket; 5866 if (so == NULL) { 5867 /* memory problem */ 5868 sctp_m_freem(m); 5869 return; 5870 } else { 5871 initack->init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(so), SCTP_MINIMAL_RWND)); 5872 } 5873 /* set what I want */ 5874 his_limit = ntohs(init_chk->init.num_inbound_streams); 5875 /* choose what I want */ 5876 if (asoc != NULL) { 5877 if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) { 5878 i_want = asoc->streamoutcnt; 5879 } else { 5880 i_want = inp->sctp_ep.pre_open_stream_count; 5881 } 5882 } else { 5883 i_want = inp->sctp_ep.pre_open_stream_count; 5884 } 5885 if (his_limit < i_want) { 5886 /* I Want more :< */ 5887 initack->init.num_outbound_streams = init_chk->init.num_inbound_streams; 5888 } else { 5889 /* I can have what I want :> */ 5890 initack->init.num_outbound_streams = htons(i_want); 5891 } 5892 /* tell him his limit. */ 5893 initack->init.num_inbound_streams = 5894 htons(inp->sctp_ep.max_open_streams_intome); 5895 5896 /* adaptation layer indication parameter */ 5897 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 5898 ali = (struct sctp_adaptation_layer_indication *)((caddr_t)initack + sizeof(*initack)); 5899 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 5900 ali->ph.param_length = htons(sizeof(*ali)); 5901 ali->indication = ntohl(inp->sctp_ep.adaptation_layer_indicator); 5902 SCTP_BUF_LEN(m) += sizeof(*ali); 5903 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali + sizeof(*ali)); 5904 } else { 5905 ecn = (struct sctp_ecn_supported_param *)((caddr_t)initack + sizeof(*initack)); 5906 } 5907 5908 /* ECN parameter */ 5909 if (((asoc != NULL) && (asoc->ecn_allowed == 1)) || 5910 (inp->sctp_ecn_enable == 1)) { 5911 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE); 5912 ecn->ph.param_length = htons(sizeof(*ecn)); 5913 SCTP_BUF_LEN(m) += sizeof(*ecn); 5914 5915 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn + 5916 sizeof(*ecn)); 5917 } else { 5918 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn); 5919 } 5920 /* And now tell the peer we do pr-sctp */ 5921 prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED); 5922 prsctp->ph.param_length = htons(sizeof(*prsctp)); 5923 SCTP_BUF_LEN(m) += sizeof(*prsctp); 5924 if (nat_friendly) { 5925 /* Add NAT friendly parameter */ 5926 struct sctp_paramhdr *ph; 5927 5928 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 5929 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 5930 ph->param_length = htons(sizeof(struct sctp_paramhdr)); 5931 SCTP_BUF_LEN(m) += sizeof(struct sctp_paramhdr); 5932 } 5933 /* And now tell the peer we do all the extensions */ 5934 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 5935 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 5936 num_ext = 0; 5937 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 5938 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 5939 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 5940 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 5941 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 5942 if (!SCTP_BASE_SYSCTL(sctp_auth_disable)) 5943 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 5944 if (SCTP_BASE_SYSCTL(sctp_nr_sack_on_off)) 5945 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 5946 p_len = sizeof(*pr_supported) + num_ext; 5947 pr_supported->ph.param_length = htons(p_len); 5948 bzero((caddr_t)pr_supported + p_len, SCTP_SIZE32(p_len) - p_len); 5949 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 5950 5951 /* add authentication parameters */ 5952 if (!SCTP_BASE_SYSCTL(sctp_auth_disable)) { 5953 struct sctp_auth_random *randp; 5954 struct sctp_auth_hmac_algo *hmacs; 5955 struct sctp_auth_chunk_list *chunks; 5956 uint16_t random_len; 5957 5958 /* generate and add RANDOM parameter */ 5959 random_len = SCTP_AUTH_RANDOM_SIZE_DEFAULT; 5960 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 5961 randp->ph.param_type = htons(SCTP_RANDOM); 5962 p_len = sizeof(*randp) + random_len; 5963 randp->ph.param_length = htons(p_len); 5964 SCTP_READ_RANDOM(randp->random_data, random_len); 5965 /* zero out any padding required */ 5966 bzero((caddr_t)randp + p_len, SCTP_SIZE32(p_len) - p_len); 5967 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 5968 5969 /* add HMAC_ALGO parameter */ 5970 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 5971 p_len = sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs, 5972 (uint8_t *) hmacs->hmac_ids); 5973 if (p_len > 0) { 5974 p_len += sizeof(*hmacs); 5975 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 5976 hmacs->ph.param_length = htons(p_len); 5977 /* zero out any padding required */ 5978 bzero((caddr_t)hmacs + p_len, SCTP_SIZE32(p_len) - p_len); 5979 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 5980 } 5981 /* add CHUNKS parameter */ 5982 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m)); 5983 p_len = sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks, 5984 chunks->chunk_types); 5985 if (p_len > 0) { 5986 p_len += sizeof(*chunks); 5987 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 5988 chunks->ph.param_length = htons(p_len); 5989 /* zero out any padding required */ 5990 bzero((caddr_t)chunks + p_len, SCTP_SIZE32(p_len) - p_len); 5991 SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len); 5992 } 5993 } 5994 m_at = m; 5995 /* now the addresses */ 5996 { 5997 struct sctp_scoping scp; 5998 5999 /* 6000 * To optimize this we could put the scoping stuff into a 6001 * structure and remove the individual uint8's from the stc 6002 * structure. Then we could just sifa in the address within 6003 * the stc.. but for now this is a quick hack to get the 6004 * address stuff teased apart. 6005 */ 6006 scp.ipv4_addr_legal = stc.ipv4_addr_legal; 6007 scp.ipv6_addr_legal = stc.ipv6_addr_legal; 6008 scp.loopback_scope = stc.loopback_scope; 6009 scp.ipv4_local_scope = stc.ipv4_scope; 6010 scp.local_scope = stc.local_scope; 6011 scp.site_scope = stc.site_scope; 6012 m_at = sctp_add_addresses_to_i_ia(inp, stcb, &scp, m_at, cnt_inits_to, NULL, NULL); 6013 } 6014 6015 /* tack on the operational error if present */ 6016 if (op_err) { 6017 struct mbuf *ol; 6018 int llen; 6019 6020 llen = 0; 6021 ol = op_err; 6022 6023 while (ol) { 6024 llen += SCTP_BUF_LEN(ol); 6025 ol = SCTP_BUF_NEXT(ol); 6026 } 6027 if (llen % 4) { 6028 /* must add a pad to the param */ 6029 uint32_t cpthis = 0; 6030 int padlen; 6031 6032 padlen = 4 - (llen % 4); 6033 m_copyback(op_err, llen, padlen, (caddr_t)&cpthis); 6034 } 6035 while (SCTP_BUF_NEXT(m_at) != NULL) { 6036 m_at = SCTP_BUF_NEXT(m_at); 6037 } 6038 SCTP_BUF_NEXT(m_at) = op_err; 6039 while (SCTP_BUF_NEXT(m_at) != NULL) { 6040 m_at = SCTP_BUF_NEXT(m_at); 6041 } 6042 } 6043 /* pre-calulate the size and update pkt header and chunk header */ 6044 p_len = 0; 6045 for (m_tmp = m; m_tmp; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6046 p_len += SCTP_BUF_LEN(m_tmp); 6047 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 6048 /* m_tmp should now point to last one */ 6049 break; 6050 } 6051 } 6052 6053 /* Now we must build a cookie */ 6054 m_cookie = sctp_add_cookie(init_pkt, offset, m, 0, &stc, &signature); 6055 if (m_cookie == NULL) { 6056 /* memory problem */ 6057 sctp_m_freem(m); 6058 return; 6059 } 6060 /* Now append the cookie to the end and update the space/size */ 6061 SCTP_BUF_NEXT(m_tmp) = m_cookie; 6062 6063 for (m_tmp = m_cookie; m_tmp; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6064 p_len += SCTP_BUF_LEN(m_tmp); 6065 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 6066 /* m_tmp should now point to last one */ 6067 mp_last = m_tmp; 6068 break; 6069 } 6070 } 6071 /* 6072 * Place in the size, but we don't include the last pad (if any) in 6073 * the INIT-ACK. 6074 */ 6075 initack->ch.chunk_length = htons(p_len); 6076 6077 /* 6078 * Time to sign the cookie, we don't sign over the cookie signature 6079 * though thus we set trailer. 6080 */ 6081 (void)sctp_hmac_m(SCTP_HMAC, 6082 (uint8_t *) inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)], 6083 SCTP_SECRET_SIZE, m_cookie, sizeof(struct sctp_paramhdr), 6084 (uint8_t *) signature, SCTP_SIGNATURE_SIZE); 6085 /* 6086 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return 6087 * here since the timer will drive a retranmission. 6088 */ 6089 padval = p_len % 4; 6090 if ((padval) && (mp_last)) { 6091 /* see my previous comments on mp_last */ 6092 if (sctp_add_pad_tombuf(mp_last, (4 - padval))) { 6093 /* Houston we have a problem, no space */ 6094 sctp_m_freem(m); 6095 return; 6096 } 6097 } 6098 if (stc.loopback_scope) { 6099 over_addr = (union sctp_sockstore *)dst; 6100 } else { 6101 over_addr = NULL; 6102 } 6103 6104 (void)sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0, 6105 0, 0, 6106 inp->sctp_lport, sh->src_port, init_chk->init.initiate_tag, 6107 port, over_addr, 6108 use_mflowid, mflowid, 6109 SCTP_SO_NOT_LOCKED); 6110 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 6111} 6112 6113 6114static void 6115sctp_prune_prsctp(struct sctp_tcb *stcb, 6116 struct sctp_association *asoc, 6117 struct sctp_sndrcvinfo *srcv, 6118 int dataout) 6119{ 6120 int freed_spc = 0; 6121 struct sctp_tmit_chunk *chk, *nchk; 6122 6123 SCTP_TCB_LOCK_ASSERT(stcb); 6124 if ((asoc->peer_supports_prsctp) && 6125 (asoc->sent_queue_cnt_removeable > 0)) { 6126 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6127 /* 6128 * Look for chunks marked with the PR_SCTP flag AND 6129 * the buffer space flag. If the one being sent is 6130 * equal or greater priority then purge the old one 6131 * and free some space. 6132 */ 6133 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6134 /* 6135 * This one is PR-SCTP AND buffer space 6136 * limited type 6137 */ 6138 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 6139 /* 6140 * Lower numbers equates to higher 6141 * priority so if the one we are 6142 * looking at has a larger or equal 6143 * priority we want to drop the data 6144 * and NOT retransmit it. 6145 */ 6146 if (chk->data) { 6147 /* 6148 * We release the book_size 6149 * if the mbuf is here 6150 */ 6151 int ret_spc; 6152 uint8_t sent; 6153 6154 if (chk->sent > SCTP_DATAGRAM_UNSENT) 6155 sent = 1; 6156 else 6157 sent = 0; 6158 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6159 sent, 6160 SCTP_SO_LOCKED); 6161 freed_spc += ret_spc; 6162 if (freed_spc >= dataout) { 6163 return; 6164 } 6165 } /* if chunk was present */ 6166 } /* if of sufficent priority */ 6167 } /* if chunk has enabled */ 6168 } /* tailqforeach */ 6169 6170 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 6171 /* Here we must move to the sent queue and mark */ 6172 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6173 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 6174 if (chk->data) { 6175 /* 6176 * We release the book_size 6177 * if the mbuf is here 6178 */ 6179 int ret_spc; 6180 6181 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6182 0, SCTP_SO_LOCKED); 6183 6184 freed_spc += ret_spc; 6185 if (freed_spc >= dataout) { 6186 return; 6187 } 6188 } /* end if chk->data */ 6189 } /* end if right class */ 6190 } /* end if chk pr-sctp */ 6191 } /* tailqforeachsafe (chk) */ 6192 } /* if enabled in asoc */ 6193} 6194 6195int 6196sctp_get_frag_point(struct sctp_tcb *stcb, 6197 struct sctp_association *asoc) 6198{ 6199 int siz, ovh; 6200 6201 /* 6202 * For endpoints that have both v6 and v4 addresses we must reserve 6203 * room for the ipv6 header, for those that are only dealing with V4 6204 * we use a larger frag point. 6205 */ 6206 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6207 ovh = SCTP_MED_OVERHEAD; 6208 } else { 6209 ovh = SCTP_MED_V4_OVERHEAD; 6210 } 6211 6212 if (stcb->asoc.sctp_frag_point > asoc->smallest_mtu) 6213 siz = asoc->smallest_mtu - ovh; 6214 else 6215 siz = (stcb->asoc.sctp_frag_point - ovh); 6216 /* 6217 * if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { 6218 */ 6219 /* A data chunk MUST fit in a cluster */ 6220 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk)); */ 6221 /* } */ 6222 6223 /* adjust for an AUTH chunk if DATA requires auth */ 6224 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) 6225 siz -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 6226 6227 if (siz % 4) { 6228 /* make it an even word boundary please */ 6229 siz -= (siz % 4); 6230 } 6231 return (siz); 6232} 6233 6234static void 6235sctp_set_prsctp_policy(struct sctp_stream_queue_pending *sp) 6236{ 6237 /* 6238 * We assume that the user wants PR_SCTP_TTL if the user provides a 6239 * positive lifetime but does not specify any PR_SCTP policy. 6240 */ 6241 if (PR_SCTP_ENABLED(sp->sinfo_flags)) { 6242 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6243 } else if (sp->timetolive > 0) { 6244 sp->sinfo_flags |= SCTP_PR_SCTP_TTL; 6245 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6246 } else { 6247 return; 6248 } 6249 switch (PR_SCTP_POLICY(sp->sinfo_flags)) { 6250 case CHUNK_FLAGS_PR_SCTP_BUF: 6251 /* 6252 * Time to live is a priority stored in tv_sec when doing 6253 * the buffer drop thing. 6254 */ 6255 sp->ts.tv_sec = sp->timetolive; 6256 sp->ts.tv_usec = 0; 6257 break; 6258 case CHUNK_FLAGS_PR_SCTP_TTL: 6259 { 6260 struct timeval tv; 6261 6262 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6263 tv.tv_sec = sp->timetolive / 1000; 6264 tv.tv_usec = (sp->timetolive * 1000) % 1000000; 6265 /* 6266 * TODO sctp_constants.h needs alternative time 6267 * macros when _KERNEL is undefined. 6268 */ 6269 timevaladd(&sp->ts, &tv); 6270 } 6271 break; 6272 case CHUNK_FLAGS_PR_SCTP_RTX: 6273 /* 6274 * Time to live is a the number or retransmissions stored in 6275 * tv_sec. 6276 */ 6277 sp->ts.tv_sec = sp->timetolive; 6278 sp->ts.tv_usec = 0; 6279 break; 6280 default: 6281 SCTPDBG(SCTP_DEBUG_USRREQ1, 6282 "Unknown PR_SCTP policy %u.\n", 6283 PR_SCTP_POLICY(sp->sinfo_flags)); 6284 break; 6285 } 6286} 6287 6288static int 6289sctp_msg_append(struct sctp_tcb *stcb, 6290 struct sctp_nets *net, 6291 struct mbuf *m, 6292 struct sctp_sndrcvinfo *srcv, int hold_stcb_lock) 6293{ 6294 int error = 0; 6295 struct mbuf *at; 6296 struct sctp_stream_queue_pending *sp = NULL; 6297 struct sctp_stream_out *strm; 6298 6299 /* 6300 * Given an mbuf chain, put it into the association send queue and 6301 * place it on the wheel 6302 */ 6303 if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) { 6304 /* Invalid stream number */ 6305 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6306 error = EINVAL; 6307 goto out_now; 6308 } 6309 if ((stcb->asoc.stream_locked) && 6310 (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) { 6311 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6312 error = EINVAL; 6313 goto out_now; 6314 } 6315 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 6316 /* Now can we send this? */ 6317 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_SENT) || 6318 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 6319 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 6320 (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) { 6321 /* got data while shutting down */ 6322 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 6323 error = ECONNRESET; 6324 goto out_now; 6325 } 6326 sctp_alloc_a_strmoq(stcb, sp); 6327 if (sp == NULL) { 6328 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6329 error = ENOMEM; 6330 goto out_now; 6331 } 6332 sp->sinfo_flags = srcv->sinfo_flags; 6333 sp->timetolive = srcv->sinfo_timetolive; 6334 sp->ppid = srcv->sinfo_ppid; 6335 sp->context = srcv->sinfo_context; 6336 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 6337 sp->net = net; 6338 atomic_add_int(&sp->net->ref_count, 1); 6339 } else { 6340 sp->net = NULL; 6341 } 6342 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6343 sp->stream = srcv->sinfo_stream; 6344 sp->msg_is_complete = 1; 6345 sp->sender_all_done = 1; 6346 sp->some_taken = 0; 6347 sp->data = m; 6348 sp->tail_mbuf = NULL; 6349 sctp_set_prsctp_policy(sp); 6350 /* 6351 * We could in theory (for sendall) sifa the length in, but we would 6352 * still have to hunt through the chain since we need to setup the 6353 * tail_mbuf 6354 */ 6355 sp->length = 0; 6356 for (at = m; at; at = SCTP_BUF_NEXT(at)) { 6357 if (SCTP_BUF_NEXT(at) == NULL) 6358 sp->tail_mbuf = at; 6359 sp->length += SCTP_BUF_LEN(at); 6360 } 6361 if (srcv->sinfo_keynumber_valid) { 6362 sp->auth_keyid = srcv->sinfo_keynumber; 6363 } else { 6364 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 6365 } 6366 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 6367 sctp_auth_key_acquire(stcb, sp->auth_keyid); 6368 sp->holds_key_ref = 1; 6369 } 6370 if (hold_stcb_lock == 0) { 6371 SCTP_TCB_SEND_LOCK(stcb); 6372 } 6373 sctp_snd_sb_alloc(stcb, sp->length); 6374 atomic_add_int(&stcb->asoc.stream_queue_cnt, 1); 6375 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 6376 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, &stcb->asoc, strm, sp, 1); 6377 m = NULL; 6378 if (hold_stcb_lock == 0) { 6379 SCTP_TCB_SEND_UNLOCK(stcb); 6380 } 6381out_now: 6382 if (m) { 6383 sctp_m_freem(m); 6384 } 6385 return (error); 6386} 6387 6388 6389static struct mbuf * 6390sctp_copy_mbufchain(struct mbuf *clonechain, 6391 struct mbuf *outchain, 6392 struct mbuf **endofchain, 6393 int can_take_mbuf, 6394 int sizeofcpy, 6395 uint8_t copy_by_ref) 6396{ 6397 struct mbuf *m; 6398 struct mbuf *appendchain; 6399 caddr_t cp; 6400 int len; 6401 6402 if (endofchain == NULL) { 6403 /* error */ 6404error_out: 6405 if (outchain) 6406 sctp_m_freem(outchain); 6407 return (NULL); 6408 } 6409 if (can_take_mbuf) { 6410 appendchain = clonechain; 6411 } else { 6412 if (!copy_by_ref && 6413 (sizeofcpy <= (int)((((SCTP_BASE_SYSCTL(sctp_mbuf_threshold_count) - 1) * MLEN) + MHLEN))) 6414 ) { 6415 /* Its not in a cluster */ 6416 if (*endofchain == NULL) { 6417 /* lets get a mbuf cluster */ 6418 if (outchain == NULL) { 6419 /* This is the general case */ 6420 new_mbuf: 6421 outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_HEADER); 6422 if (outchain == NULL) { 6423 goto error_out; 6424 } 6425 SCTP_BUF_LEN(outchain) = 0; 6426 *endofchain = outchain; 6427 /* get the prepend space */ 6428 SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4)); 6429 } else { 6430 /* 6431 * We really should not get a NULL 6432 * in endofchain 6433 */ 6434 /* find end */ 6435 m = outchain; 6436 while (m) { 6437 if (SCTP_BUF_NEXT(m) == NULL) { 6438 *endofchain = m; 6439 break; 6440 } 6441 m = SCTP_BUF_NEXT(m); 6442 } 6443 /* sanity */ 6444 if (*endofchain == NULL) { 6445 /* 6446 * huh, TSNH XXX maybe we 6447 * should panic 6448 */ 6449 sctp_m_freem(outchain); 6450 goto new_mbuf; 6451 } 6452 } 6453 /* get the new end of length */ 6454 len = M_TRAILINGSPACE(*endofchain); 6455 } else { 6456 /* how much is left at the end? */ 6457 len = M_TRAILINGSPACE(*endofchain); 6458 } 6459 /* Find the end of the data, for appending */ 6460 cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain))); 6461 6462 /* Now lets copy it out */ 6463 if (len >= sizeofcpy) { 6464 /* It all fits, copy it in */ 6465 m_copydata(clonechain, 0, sizeofcpy, cp); 6466 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6467 } else { 6468 /* fill up the end of the chain */ 6469 if (len > 0) { 6470 m_copydata(clonechain, 0, len, cp); 6471 SCTP_BUF_LEN((*endofchain)) += len; 6472 /* now we need another one */ 6473 sizeofcpy -= len; 6474 } 6475 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_HEADER); 6476 if (m == NULL) { 6477 /* We failed */ 6478 goto error_out; 6479 } 6480 SCTP_BUF_NEXT((*endofchain)) = m; 6481 *endofchain = m; 6482 cp = mtod((*endofchain), caddr_t); 6483 m_copydata(clonechain, len, sizeofcpy, cp); 6484 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6485 } 6486 return (outchain); 6487 } else { 6488 /* copy the old fashion way */ 6489 appendchain = SCTP_M_COPYM(clonechain, 0, M_COPYALL, M_DONTWAIT); 6490#ifdef SCTP_MBUF_LOGGING 6491 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6492 struct mbuf *mat; 6493 6494 for (mat = appendchain; mat; mat = SCTP_BUF_NEXT(mat)) { 6495 if (SCTP_BUF_IS_EXTENDED(mat)) { 6496 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 6497 } 6498 } 6499 } 6500#endif 6501 } 6502 } 6503 if (appendchain == NULL) { 6504 /* error */ 6505 if (outchain) 6506 sctp_m_freem(outchain); 6507 return (NULL); 6508 } 6509 if (outchain) { 6510 /* tack on to the end */ 6511 if (*endofchain != NULL) { 6512 SCTP_BUF_NEXT(((*endofchain))) = appendchain; 6513 } else { 6514 m = outchain; 6515 while (m) { 6516 if (SCTP_BUF_NEXT(m) == NULL) { 6517 SCTP_BUF_NEXT(m) = appendchain; 6518 break; 6519 } 6520 m = SCTP_BUF_NEXT(m); 6521 } 6522 } 6523 /* 6524 * save off the end and update the end-chain postion 6525 */ 6526 m = appendchain; 6527 while (m) { 6528 if (SCTP_BUF_NEXT(m) == NULL) { 6529 *endofchain = m; 6530 break; 6531 } 6532 m = SCTP_BUF_NEXT(m); 6533 } 6534 return (outchain); 6535 } else { 6536 /* save off the end and update the end-chain postion */ 6537 m = appendchain; 6538 while (m) { 6539 if (SCTP_BUF_NEXT(m) == NULL) { 6540 *endofchain = m; 6541 break; 6542 } 6543 m = SCTP_BUF_NEXT(m); 6544 } 6545 return (appendchain); 6546 } 6547} 6548 6549static int 6550sctp_med_chunk_output(struct sctp_inpcb *inp, 6551 struct sctp_tcb *stcb, 6552 struct sctp_association *asoc, 6553 int *num_out, 6554 int *reason_code, 6555 int control_only, int from_where, 6556 struct timeval *now, int *now_filled, int frag_point, int so_locked 6557#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 6558 SCTP_UNUSED 6559#endif 6560); 6561 6562static void 6563sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, 6564 uint32_t val SCTP_UNUSED) 6565{ 6566 struct sctp_copy_all *ca; 6567 struct mbuf *m; 6568 int ret = 0; 6569 int added_control = 0; 6570 int un_sent, do_chunk_output = 1; 6571 struct sctp_association *asoc; 6572 struct sctp_nets *net; 6573 6574 ca = (struct sctp_copy_all *)ptr; 6575 if (ca->m == NULL) { 6576 return; 6577 } 6578 if (ca->inp != inp) { 6579 /* TSNH */ 6580 return; 6581 } 6582 if (ca->sndlen > 0) { 6583 m = SCTP_M_COPYM(ca->m, 0, M_COPYALL, M_DONTWAIT); 6584 if (m == NULL) { 6585 /* can't copy so we are done */ 6586 ca->cnt_failed++; 6587 return; 6588 } 6589#ifdef SCTP_MBUF_LOGGING 6590 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6591 struct mbuf *mat; 6592 6593 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 6594 if (SCTP_BUF_IS_EXTENDED(mat)) { 6595 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 6596 } 6597 } 6598 } 6599#endif 6600 } else { 6601 m = NULL; 6602 } 6603 SCTP_TCB_LOCK_ASSERT(stcb); 6604 if (stcb->asoc.alternate) { 6605 net = stcb->asoc.alternate; 6606 } else { 6607 net = stcb->asoc.primary_destination; 6608 } 6609 if (ca->sndrcv.sinfo_flags & SCTP_ABORT) { 6610 /* Abort this assoc with m as the user defined reason */ 6611 if (m != NULL) { 6612 SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_NOWAIT); 6613 } else { 6614 m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 6615 0, M_NOWAIT, 1, MT_DATA); 6616 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr); 6617 } 6618 if (m != NULL) { 6619 struct sctp_paramhdr *ph; 6620 6621 ph = mtod(m, struct sctp_paramhdr *); 6622 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 6623 ph->param_length = htons(sizeof(struct sctp_paramhdr) + ca->sndlen); 6624 } 6625 /* 6626 * We add one here to keep the assoc from dis-appearing on 6627 * us. 6628 */ 6629 atomic_add_int(&stcb->asoc.refcnt, 1); 6630 sctp_abort_an_association(inp, stcb, m, SCTP_SO_NOT_LOCKED); 6631 /* 6632 * sctp_abort_an_association calls sctp_free_asoc() free 6633 * association will NOT free it since we incremented the 6634 * refcnt .. we do this to prevent it being freed and things 6635 * getting tricky since we could end up (from free_asoc) 6636 * calling inpcb_free which would get a recursive lock call 6637 * to the iterator lock.. But as a consequence of that the 6638 * stcb will return to us un-locked.. since free_asoc 6639 * returns with either no TCB or the TCB unlocked, we must 6640 * relock.. to unlock in the iterator timer :-0 6641 */ 6642 SCTP_TCB_LOCK(stcb); 6643 atomic_add_int(&stcb->asoc.refcnt, -1); 6644 goto no_chunk_output; 6645 } else { 6646 if (m) { 6647 ret = sctp_msg_append(stcb, net, m, 6648 &ca->sndrcv, 1); 6649 } 6650 asoc = &stcb->asoc; 6651 if (ca->sndrcv.sinfo_flags & SCTP_EOF) { 6652 /* shutdown this assoc */ 6653 int cnt; 6654 6655 cnt = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED); 6656 6657 if (TAILQ_EMPTY(&asoc->send_queue) && 6658 TAILQ_EMPTY(&asoc->sent_queue) && 6659 (cnt == 0)) { 6660 if (asoc->locked_on_sending) { 6661 goto abort_anyway; 6662 } 6663 /* 6664 * there is nothing queued to send, so I'm 6665 * done... 6666 */ 6667 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 6668 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6669 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6670 /* 6671 * only send SHUTDOWN the first time 6672 * through 6673 */ 6674 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 6675 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 6676 } 6677 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT); 6678 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING); 6679 sctp_stop_timers_for_shutdown(stcb); 6680 sctp_send_shutdown(stcb, net); 6681 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 6682 net); 6683 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6684 asoc->primary_destination); 6685 added_control = 1; 6686 do_chunk_output = 0; 6687 } 6688 } else { 6689 /* 6690 * we still got (or just got) data to send, 6691 * so set SHUTDOWN_PENDING 6692 */ 6693 /* 6694 * XXX sockets draft says that SCTP_EOF 6695 * should be sent with no data. currently, 6696 * we will allow user data to be sent first 6697 * and move to SHUTDOWN-PENDING 6698 */ 6699 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 6700 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6701 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6702 if (asoc->locked_on_sending) { 6703 /* 6704 * Locked to send out the 6705 * data 6706 */ 6707 struct sctp_stream_queue_pending *sp; 6708 6709 sp = TAILQ_LAST(&asoc->locked_on_sending->outqueue, sctp_streamhead); 6710 if (sp) { 6711 if ((sp->length == 0) && (sp->msg_is_complete == 0)) 6712 asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT; 6713 } 6714 } 6715 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 6716 if (TAILQ_EMPTY(&asoc->send_queue) && 6717 TAILQ_EMPTY(&asoc->sent_queue) && 6718 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 6719 abort_anyway: 6720 atomic_add_int(&stcb->asoc.refcnt, 1); 6721 sctp_abort_an_association(stcb->sctp_ep, stcb, 6722 NULL, SCTP_SO_NOT_LOCKED); 6723 atomic_add_int(&stcb->asoc.refcnt, -1); 6724 goto no_chunk_output; 6725 } 6726 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6727 asoc->primary_destination); 6728 } 6729 } 6730 6731 } 6732 } 6733 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 6734 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 6735 6736 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 6737 (stcb->asoc.total_flight > 0) && 6738 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 6739 do_chunk_output = 0; 6740 } 6741 if (do_chunk_output) 6742 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_NOT_LOCKED); 6743 else if (added_control) { 6744 int num_out = 0, reason = 0, now_filled = 0; 6745 struct timeval now; 6746 int frag_point; 6747 6748 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 6749 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 6750 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_NOT_LOCKED); 6751 } 6752no_chunk_output: 6753 if (ret) { 6754 ca->cnt_failed++; 6755 } else { 6756 ca->cnt_sent++; 6757 } 6758} 6759 6760static void 6761sctp_sendall_completes(void *ptr, uint32_t val SCTP_UNUSED) 6762{ 6763 struct sctp_copy_all *ca; 6764 6765 ca = (struct sctp_copy_all *)ptr; 6766 /* 6767 * Do a notify here? Kacheong suggests that the notify be done at 6768 * the send time.. so you would push up a notification if any send 6769 * failed. Don't know if this is feasable since the only failures we 6770 * have is "memory" related and if you cannot get an mbuf to send 6771 * the data you surely can't get an mbuf to send up to notify the 6772 * user you can't send the data :-> 6773 */ 6774 6775 /* now free everything */ 6776 sctp_m_freem(ca->m); 6777 SCTP_FREE(ca, SCTP_M_COPYAL); 6778} 6779 6780 6781#define MC_ALIGN(m, len) do { \ 6782 SCTP_BUF_RESV_UF(m, ((MCLBYTES - (len)) & ~(sizeof(long) - 1)); \ 6783} while (0) 6784 6785 6786 6787static struct mbuf * 6788sctp_copy_out_all(struct uio *uio, int len) 6789{ 6790 struct mbuf *ret, *at; 6791 int left, willcpy, cancpy, error; 6792 6793 ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAIT, 1, MT_DATA); 6794 if (ret == NULL) { 6795 /* TSNH */ 6796 return (NULL); 6797 } 6798 left = len; 6799 SCTP_BUF_LEN(ret) = 0; 6800 /* save space for the data chunk header */ 6801 cancpy = M_TRAILINGSPACE(ret); 6802 willcpy = min(cancpy, left); 6803 at = ret; 6804 while (left > 0) { 6805 /* Align data to the end */ 6806 error = uiomove(mtod(at, caddr_t), willcpy, uio); 6807 if (error) { 6808 err_out_now: 6809 sctp_m_freem(at); 6810 return (NULL); 6811 } 6812 SCTP_BUF_LEN(at) = willcpy; 6813 SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0; 6814 left -= willcpy; 6815 if (left > 0) { 6816 SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg(left, 0, M_WAIT, 1, MT_DATA); 6817 if (SCTP_BUF_NEXT(at) == NULL) { 6818 goto err_out_now; 6819 } 6820 at = SCTP_BUF_NEXT(at); 6821 SCTP_BUF_LEN(at) = 0; 6822 cancpy = M_TRAILINGSPACE(at); 6823 willcpy = min(cancpy, left); 6824 } 6825 } 6826 return (ret); 6827} 6828 6829static int 6830sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, 6831 struct sctp_sndrcvinfo *srcv) 6832{ 6833 int ret; 6834 struct sctp_copy_all *ca; 6835 6836 SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all), 6837 SCTP_M_COPYAL); 6838 if (ca == NULL) { 6839 sctp_m_freem(m); 6840 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6841 return (ENOMEM); 6842 } 6843 memset(ca, 0, sizeof(struct sctp_copy_all)); 6844 6845 ca->inp = inp; 6846 if (srcv) { 6847 memcpy(&ca->sndrcv, srcv, sizeof(struct sctp_nonpad_sndrcvinfo)); 6848 } 6849 /* 6850 * take off the sendall flag, it would be bad if we failed to do 6851 * this :-0 6852 */ 6853 ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL; 6854 /* get length and mbuf chain */ 6855 if (uio) { 6856 ca->sndlen = uio->uio_resid; 6857 ca->m = sctp_copy_out_all(uio, ca->sndlen); 6858 if (ca->m == NULL) { 6859 SCTP_FREE(ca, SCTP_M_COPYAL); 6860 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6861 return (ENOMEM); 6862 } 6863 } else { 6864 /* Gather the length of the send */ 6865 struct mbuf *mat; 6866 6867 ca->sndlen = 0; 6868 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 6869 ca->sndlen += SCTP_BUF_LEN(mat); 6870 } 6871 } 6872 ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, NULL, 6873 SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES, 6874 SCTP_ASOC_ANY_STATE, 6875 (void *)ca, 0, 6876 sctp_sendall_completes, inp, 1); 6877 if (ret) { 6878 SCTP_PRINTF("Failed to initiate iterator for sendall\n"); 6879 SCTP_FREE(ca, SCTP_M_COPYAL); 6880 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 6881 return (EFAULT); 6882 } 6883 return (0); 6884} 6885 6886 6887void 6888sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc) 6889{ 6890 struct sctp_tmit_chunk *chk, *nchk; 6891 6892 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 6893 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 6894 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 6895 if (chk->data) { 6896 sctp_m_freem(chk->data); 6897 chk->data = NULL; 6898 } 6899 asoc->ctrl_queue_cnt--; 6900 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6901 } 6902 } 6903} 6904 6905void 6906sctp_toss_old_asconf(struct sctp_tcb *stcb) 6907{ 6908 struct sctp_association *asoc; 6909 struct sctp_tmit_chunk *chk, *nchk; 6910 struct sctp_asconf_chunk *acp; 6911 6912 asoc = &stcb->asoc; 6913 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 6914 /* find SCTP_ASCONF chunk in queue */ 6915 if (chk->rec.chunk_id.id == SCTP_ASCONF) { 6916 if (chk->data) { 6917 acp = mtod(chk->data, struct sctp_asconf_chunk *); 6918 if (SCTP_TSN_GT(ntohl(acp->serial_number), asoc->asconf_seq_out_acked)) { 6919 /* Not Acked yet */ 6920 break; 6921 } 6922 } 6923 TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next); 6924 if (chk->data) { 6925 sctp_m_freem(chk->data); 6926 chk->data = NULL; 6927 } 6928 asoc->ctrl_queue_cnt--; 6929 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6930 } 6931 } 6932} 6933 6934 6935static void 6936sctp_clean_up_datalist(struct sctp_tcb *stcb, 6937 struct sctp_association *asoc, 6938 struct sctp_tmit_chunk **data_list, 6939 int bundle_at, 6940 struct sctp_nets *net) 6941{ 6942 int i; 6943 struct sctp_tmit_chunk *tp1; 6944 6945 for (i = 0; i < bundle_at; i++) { 6946 /* off of the send queue */ 6947 TAILQ_REMOVE(&asoc->send_queue, data_list[i], sctp_next); 6948 asoc->send_queue_cnt--; 6949 if (i > 0) { 6950 /* 6951 * Any chunk NOT 0 you zap the time chunk 0 gets 6952 * zapped or set based on if a RTO measurment is 6953 * needed. 6954 */ 6955 data_list[i]->do_rtt = 0; 6956 } 6957 /* record time */ 6958 data_list[i]->sent_rcv_time = net->last_sent_time; 6959 data_list[i]->rec.data.cwnd_at_send = net->cwnd; 6960 data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.TSN_seq; 6961 if (data_list[i]->whoTo == NULL) { 6962 data_list[i]->whoTo = net; 6963 atomic_add_int(&net->ref_count, 1); 6964 } 6965 /* on to the sent queue */ 6966 tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead); 6967 if ((tp1) && SCTP_TSN_GT(tp1->rec.data.TSN_seq, data_list[i]->rec.data.TSN_seq)) { 6968 struct sctp_tmit_chunk *tpp; 6969 6970 /* need to move back */ 6971 back_up_more: 6972 tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next); 6973 if (tpp == NULL) { 6974 TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next); 6975 goto all_done; 6976 } 6977 tp1 = tpp; 6978 if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, data_list[i]->rec.data.TSN_seq)) { 6979 goto back_up_more; 6980 } 6981 TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next); 6982 } else { 6983 TAILQ_INSERT_TAIL(&asoc->sent_queue, 6984 data_list[i], 6985 sctp_next); 6986 } 6987all_done: 6988 /* This does not lower until the cum-ack passes it */ 6989 asoc->sent_queue_cnt++; 6990 if ((asoc->peers_rwnd <= 0) && 6991 (asoc->total_flight == 0) && 6992 (bundle_at == 1)) { 6993 /* Mark the chunk as being a window probe */ 6994 SCTP_STAT_INCR(sctps_windowprobed); 6995 } 6996#ifdef SCTP_AUDITING_ENABLED 6997 sctp_audit_log(0xC2, 3); 6998#endif 6999 data_list[i]->sent = SCTP_DATAGRAM_SENT; 7000 data_list[i]->snd_count = 1; 7001 data_list[i]->rec.data.chunk_was_revoked = 0; 7002 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 7003 sctp_misc_ints(SCTP_FLIGHT_LOG_UP, 7004 data_list[i]->whoTo->flight_size, 7005 data_list[i]->book_size, 7006 (uintptr_t) data_list[i]->whoTo, 7007 data_list[i]->rec.data.TSN_seq); 7008 } 7009 sctp_flight_size_increase(data_list[i]); 7010 sctp_total_flight_increase(stcb, data_list[i]); 7011 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 7012 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 7013 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 7014 } 7015 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 7016 (uint32_t) (data_list[i]->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 7017 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 7018 /* SWS sender side engages */ 7019 asoc->peers_rwnd = 0; 7020 } 7021 } 7022 if (asoc->cc_functions.sctp_cwnd_update_packet_transmitted) { 7023 (*asoc->cc_functions.sctp_cwnd_update_packet_transmitted) (stcb, net); 7024 } 7025} 7026 7027static void 7028sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc, int so_locked 7029#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7030 SCTP_UNUSED 7031#endif 7032) 7033{ 7034 struct sctp_tmit_chunk *chk, *nchk; 7035 7036 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 7037 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7038 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 7039 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 7040 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 7041 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) || 7042 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 7043 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 7044 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 7045 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 7046 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 7047 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 7048 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 7049 /* Stray chunks must be cleaned up */ 7050 clean_up_anyway: 7051 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7052 if (chk->data) { 7053 sctp_m_freem(chk->data); 7054 chk->data = NULL; 7055 } 7056 asoc->ctrl_queue_cnt--; 7057 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) 7058 asoc->fwd_tsn_cnt--; 7059 sctp_free_a_chunk(stcb, chk, so_locked); 7060 } else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 7061 /* special handling, we must look into the param */ 7062 if (chk != asoc->str_reset) { 7063 goto clean_up_anyway; 7064 } 7065 } 7066 } 7067} 7068 7069 7070static int 7071sctp_can_we_split_this(struct sctp_tcb *stcb, 7072 uint32_t length, 7073 uint32_t goal_mtu, uint32_t frag_point, int eeor_on) 7074{ 7075 /* 7076 * Make a decision on if I should split a msg into multiple parts. 7077 * This is only asked of incomplete messages. 7078 */ 7079 if (eeor_on) { 7080 /* 7081 * If we are doing EEOR we need to always send it if its the 7082 * entire thing, since it might be all the guy is putting in 7083 * the hopper. 7084 */ 7085 if (goal_mtu >= length) { 7086 /*- 7087 * If we have data outstanding, 7088 * we get another chance when the sack 7089 * arrives to transmit - wait for more data 7090 */ 7091 if (stcb->asoc.total_flight == 0) { 7092 /* 7093 * If nothing is in flight, we zero the 7094 * packet counter. 7095 */ 7096 return (length); 7097 } 7098 return (0); 7099 7100 } else { 7101 /* You can fill the rest */ 7102 return (goal_mtu); 7103 } 7104 } 7105 /*- 7106 * For those strange folk that make the send buffer 7107 * smaller than our fragmentation point, we can't 7108 * get a full msg in so we have to allow splitting. 7109 */ 7110 if (SCTP_SB_LIMIT_SND(stcb->sctp_socket) < frag_point) { 7111 return (length); 7112 } 7113 if ((length <= goal_mtu) || 7114 ((length - goal_mtu) < SCTP_BASE_SYSCTL(sctp_min_residual))) { 7115 /* Sub-optimial residual don't split in non-eeor mode. */ 7116 return (0); 7117 } 7118 /* 7119 * If we reach here length is larger than the goal_mtu. Do we wish 7120 * to split it for the sake of packet putting together? 7121 */ 7122 if (goal_mtu >= min(SCTP_BASE_SYSCTL(sctp_min_split_point), frag_point)) { 7123 /* Its ok to split it */ 7124 return (min(goal_mtu, frag_point)); 7125 } 7126 /* Nope, can't split */ 7127 return (0); 7128 7129} 7130 7131static uint32_t 7132sctp_move_to_outqueue(struct sctp_tcb *stcb, 7133 struct sctp_stream_out *strq, 7134 uint32_t goal_mtu, 7135 uint32_t frag_point, 7136 int *locked, 7137 int *giveup, 7138 int eeor_mode, 7139 int *bail, 7140 int so_locked 7141#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7142 SCTP_UNUSED 7143#endif 7144) 7145{ 7146 /* Move from the stream to the send_queue keeping track of the total */ 7147 struct sctp_association *asoc; 7148 struct sctp_stream_queue_pending *sp; 7149 struct sctp_tmit_chunk *chk; 7150 struct sctp_data_chunk *dchkh; 7151 uint32_t to_move, length; 7152 uint8_t rcv_flags = 0; 7153 uint8_t some_taken; 7154 uint8_t send_lock_up = 0; 7155 7156 SCTP_TCB_LOCK_ASSERT(stcb); 7157 asoc = &stcb->asoc; 7158one_more_time: 7159 /* sa_ignore FREED_MEMORY */ 7160 sp = TAILQ_FIRST(&strq->outqueue); 7161 if (sp == NULL) { 7162 *locked = 0; 7163 if (send_lock_up == 0) { 7164 SCTP_TCB_SEND_LOCK(stcb); 7165 send_lock_up = 1; 7166 } 7167 sp = TAILQ_FIRST(&strq->outqueue); 7168 if (sp) { 7169 goto one_more_time; 7170 } 7171 if (strq->last_msg_incomplete) { 7172 SCTP_PRINTF("Huh? Stream:%d lm_in_c=%d but queue is NULL\n", 7173 strq->stream_no, 7174 strq->last_msg_incomplete); 7175 strq->last_msg_incomplete = 0; 7176 } 7177 to_move = 0; 7178 if (send_lock_up) { 7179 SCTP_TCB_SEND_UNLOCK(stcb); 7180 send_lock_up = 0; 7181 } 7182 goto out_of; 7183 } 7184 if ((sp->msg_is_complete) && (sp->length == 0)) { 7185 if (sp->sender_all_done) { 7186 /* 7187 * We are doing differed cleanup. Last time through 7188 * when we took all the data the sender_all_done was 7189 * not set. 7190 */ 7191 if ((sp->put_last_out == 0) && (sp->discard_rest == 0)) { 7192 SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n"); 7193 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7194 sp->sender_all_done, 7195 sp->length, 7196 sp->msg_is_complete, 7197 sp->put_last_out, 7198 send_lock_up); 7199 } 7200 if ((TAILQ_NEXT(sp, next) == NULL) && (send_lock_up == 0)) { 7201 SCTP_TCB_SEND_LOCK(stcb); 7202 send_lock_up = 1; 7203 } 7204 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7205 TAILQ_REMOVE(&strq->outqueue, sp, next); 7206 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7207 if (sp->net) { 7208 sctp_free_remote_addr(sp->net); 7209 sp->net = NULL; 7210 } 7211 if (sp->data) { 7212 sctp_m_freem(sp->data); 7213 sp->data = NULL; 7214 } 7215 sctp_free_a_strmoq(stcb, sp, so_locked); 7216 /* we can't be locked to it */ 7217 *locked = 0; 7218 stcb->asoc.locked_on_sending = NULL; 7219 if (send_lock_up) { 7220 SCTP_TCB_SEND_UNLOCK(stcb); 7221 send_lock_up = 0; 7222 } 7223 /* back to get the next msg */ 7224 goto one_more_time; 7225 } else { 7226 /* 7227 * sender just finished this but still holds a 7228 * reference 7229 */ 7230 *locked = 1; 7231 *giveup = 1; 7232 to_move = 0; 7233 goto out_of; 7234 } 7235 } else { 7236 /* is there some to get */ 7237 if (sp->length == 0) { 7238 /* no */ 7239 *locked = 1; 7240 *giveup = 1; 7241 to_move = 0; 7242 goto out_of; 7243 } else if (sp->discard_rest) { 7244 if (send_lock_up == 0) { 7245 SCTP_TCB_SEND_LOCK(stcb); 7246 send_lock_up = 1; 7247 } 7248 /* Whack down the size */ 7249 atomic_subtract_int(&stcb->asoc.total_output_queue_size, sp->length); 7250 if ((stcb->sctp_socket != NULL) && \ 7251 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 7252 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 7253 atomic_subtract_int(&stcb->sctp_socket->so_snd.sb_cc, sp->length); 7254 } 7255 if (sp->data) { 7256 sctp_m_freem(sp->data); 7257 sp->data = NULL; 7258 sp->tail_mbuf = NULL; 7259 } 7260 sp->length = 0; 7261 sp->some_taken = 1; 7262 *locked = 1; 7263 *giveup = 1; 7264 to_move = 0; 7265 goto out_of; 7266 } 7267 } 7268 some_taken = sp->some_taken; 7269 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 7270 sp->msg_is_complete = 1; 7271 } 7272re_look: 7273 length = sp->length; 7274 if (sp->msg_is_complete) { 7275 /* The message is complete */ 7276 to_move = min(length, frag_point); 7277 if (to_move == length) { 7278 /* All of it fits in the MTU */ 7279 if (sp->some_taken) { 7280 rcv_flags |= SCTP_DATA_LAST_FRAG; 7281 sp->put_last_out = 1; 7282 } else { 7283 rcv_flags |= SCTP_DATA_NOT_FRAG; 7284 sp->put_last_out = 1; 7285 } 7286 } else { 7287 /* Not all of it fits, we fragment */ 7288 if (sp->some_taken == 0) { 7289 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7290 } 7291 sp->some_taken = 1; 7292 } 7293 } else { 7294 to_move = sctp_can_we_split_this(stcb, length, goal_mtu, frag_point, eeor_mode); 7295 if (to_move) { 7296 /*- 7297 * We use a snapshot of length in case it 7298 * is expanding during the compare. 7299 */ 7300 uint32_t llen; 7301 7302 llen = length; 7303 if (to_move >= llen) { 7304 to_move = llen; 7305 if (send_lock_up == 0) { 7306 /*- 7307 * We are taking all of an incomplete msg 7308 * thus we need a send lock. 7309 */ 7310 SCTP_TCB_SEND_LOCK(stcb); 7311 send_lock_up = 1; 7312 if (sp->msg_is_complete) { 7313 /* 7314 * the sender finished the 7315 * msg 7316 */ 7317 goto re_look; 7318 } 7319 } 7320 } 7321 if (sp->some_taken == 0) { 7322 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7323 sp->some_taken = 1; 7324 } 7325 } else { 7326 /* Nothing to take. */ 7327 if (sp->some_taken) { 7328 *locked = 1; 7329 } 7330 *giveup = 1; 7331 to_move = 0; 7332 goto out_of; 7333 } 7334 } 7335 7336 /* If we reach here, we can copy out a chunk */ 7337 sctp_alloc_a_chunk(stcb, chk); 7338 if (chk == NULL) { 7339 /* No chunk memory */ 7340 *giveup = 1; 7341 to_move = 0; 7342 goto out_of; 7343 } 7344 /* 7345 * Setup for unordered if needed by looking at the user sent info 7346 * flags. 7347 */ 7348 if (sp->sinfo_flags & SCTP_UNORDERED) { 7349 rcv_flags |= SCTP_DATA_UNORDERED; 7350 } 7351 if ((SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && ((sp->sinfo_flags & SCTP_EOF) == SCTP_EOF)) || 7352 ((sp->sinfo_flags & SCTP_SACK_IMMEDIATELY) == SCTP_SACK_IMMEDIATELY)) { 7353 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7354 } 7355 /* clear out the chunk before setting up */ 7356 memset(chk, 0, sizeof(*chk)); 7357 chk->rec.data.rcv_flags = rcv_flags; 7358 7359 if (to_move >= length) { 7360 /* we think we can steal the whole thing */ 7361 if ((sp->sender_all_done == 0) && (send_lock_up == 0)) { 7362 SCTP_TCB_SEND_LOCK(stcb); 7363 send_lock_up = 1; 7364 } 7365 if (to_move < sp->length) { 7366 /* bail, it changed */ 7367 goto dont_do_it; 7368 } 7369 chk->data = sp->data; 7370 chk->last_mbuf = sp->tail_mbuf; 7371 /* register the stealing */ 7372 sp->data = sp->tail_mbuf = NULL; 7373 } else { 7374 struct mbuf *m; 7375 7376dont_do_it: 7377 chk->data = SCTP_M_COPYM(sp->data, 0, to_move, M_DONTWAIT); 7378 chk->last_mbuf = NULL; 7379 if (chk->data == NULL) { 7380 sp->some_taken = some_taken; 7381 sctp_free_a_chunk(stcb, chk, so_locked); 7382 *bail = 1; 7383 to_move = 0; 7384 goto out_of; 7385 } 7386#ifdef SCTP_MBUF_LOGGING 7387 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 7388 struct mbuf *mat; 7389 7390 for (mat = chk->data; mat; mat = SCTP_BUF_NEXT(mat)) { 7391 if (SCTP_BUF_IS_EXTENDED(mat)) { 7392 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 7393 } 7394 } 7395 } 7396#endif 7397 /* Pull off the data */ 7398 m_adj(sp->data, to_move); 7399 /* Now lets work our way down and compact it */ 7400 m = sp->data; 7401 while (m && (SCTP_BUF_LEN(m) == 0)) { 7402 sp->data = SCTP_BUF_NEXT(m); 7403 SCTP_BUF_NEXT(m) = NULL; 7404 if (sp->tail_mbuf == m) { 7405 /*- 7406 * Freeing tail? TSNH since 7407 * we supposedly were taking less 7408 * than the sp->length. 7409 */ 7410#ifdef INVARIANTS 7411 panic("Huh, freing tail? - TSNH"); 7412#else 7413 SCTP_PRINTF("Huh, freeing tail? - TSNH\n"); 7414 sp->tail_mbuf = sp->data = NULL; 7415 sp->length = 0; 7416#endif 7417 7418 } 7419 sctp_m_free(m); 7420 m = sp->data; 7421 } 7422 } 7423 if (SCTP_BUF_IS_EXTENDED(chk->data)) { 7424 chk->copy_by_ref = 1; 7425 } else { 7426 chk->copy_by_ref = 0; 7427 } 7428 /* 7429 * get last_mbuf and counts of mb useage This is ugly but hopefully 7430 * its only one mbuf. 7431 */ 7432 if (chk->last_mbuf == NULL) { 7433 chk->last_mbuf = chk->data; 7434 while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) { 7435 chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf); 7436 } 7437 } 7438 if (to_move > length) { 7439 /*- This should not happen either 7440 * since we always lower to_move to the size 7441 * of sp->length if its larger. 7442 */ 7443#ifdef INVARIANTS 7444 panic("Huh, how can to_move be larger?"); 7445#else 7446 SCTP_PRINTF("Huh, how can to_move be larger?\n"); 7447 sp->length = 0; 7448#endif 7449 } else { 7450 atomic_subtract_int(&sp->length, to_move); 7451 } 7452 if (M_LEADINGSPACE(chk->data) < (int)sizeof(struct sctp_data_chunk)) { 7453 /* Not enough room for a chunk header, get some */ 7454 struct mbuf *m; 7455 7456 m = sctp_get_mbuf_for_msg(1, 0, M_DONTWAIT, 0, MT_DATA); 7457 if (m == NULL) { 7458 /* 7459 * we're in trouble here. _PREPEND below will free 7460 * all the data if there is no leading space, so we 7461 * must put the data back and restore. 7462 */ 7463 if (send_lock_up == 0) { 7464 SCTP_TCB_SEND_LOCK(stcb); 7465 send_lock_up = 1; 7466 } 7467 if (chk->data == NULL) { 7468 /* unsteal the data */ 7469 sp->data = chk->data; 7470 sp->tail_mbuf = chk->last_mbuf; 7471 } else { 7472 struct mbuf *m_tmp; 7473 7474 /* reassemble the data */ 7475 m_tmp = sp->data; 7476 sp->data = chk->data; 7477 SCTP_BUF_NEXT(chk->last_mbuf) = m_tmp; 7478 } 7479 sp->some_taken = some_taken; 7480 atomic_add_int(&sp->length, to_move); 7481 chk->data = NULL; 7482 *bail = 1; 7483 sctp_free_a_chunk(stcb, chk, so_locked); 7484 to_move = 0; 7485 goto out_of; 7486 } else { 7487 SCTP_BUF_LEN(m) = 0; 7488 SCTP_BUF_NEXT(m) = chk->data; 7489 chk->data = m; 7490 M_ALIGN(chk->data, 4); 7491 } 7492 } 7493 SCTP_BUF_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_DONTWAIT); 7494 if (chk->data == NULL) { 7495 /* HELP, TSNH since we assured it would not above? */ 7496#ifdef INVARIANTS 7497 panic("prepend failes HELP?"); 7498#else 7499 SCTP_PRINTF("prepend fails HELP?\n"); 7500 sctp_free_a_chunk(stcb, chk, so_locked); 7501#endif 7502 *bail = 1; 7503 to_move = 0; 7504 goto out_of; 7505 } 7506 sctp_snd_sb_alloc(stcb, sizeof(struct sctp_data_chunk)); 7507 chk->book_size = chk->send_size = (to_move + sizeof(struct sctp_data_chunk)); 7508 chk->book_size_scale = 0; 7509 chk->sent = SCTP_DATAGRAM_UNSENT; 7510 7511 chk->flags = 0; 7512 chk->asoc = &stcb->asoc; 7513 chk->pad_inplace = 0; 7514 chk->no_fr_allowed = 0; 7515 chk->rec.data.stream_seq = strq->next_sequence_send; 7516 if ((rcv_flags & SCTP_DATA_LAST_FRAG) && 7517 !(rcv_flags & SCTP_DATA_UNORDERED)) { 7518 strq->next_sequence_send++; 7519 } 7520 chk->rec.data.stream_number = sp->stream; 7521 chk->rec.data.payloadtype = sp->ppid; 7522 chk->rec.data.context = sp->context; 7523 chk->rec.data.doing_fast_retransmit = 0; 7524 7525 chk->rec.data.timetodrop = sp->ts; 7526 chk->flags = sp->act_flags; 7527 7528 if (sp->net) { 7529 chk->whoTo = sp->net; 7530 atomic_add_int(&chk->whoTo->ref_count, 1); 7531 } else 7532 chk->whoTo = NULL; 7533 7534 if (sp->holds_key_ref) { 7535 chk->auth_keyid = sp->auth_keyid; 7536 sctp_auth_key_acquire(stcb, chk->auth_keyid); 7537 chk->holds_key_ref = 1; 7538 } 7539 chk->rec.data.TSN_seq = atomic_fetchadd_int(&asoc->sending_seq, 1); 7540 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) { 7541 sctp_misc_ints(SCTP_STRMOUT_LOG_SEND, 7542 (uintptr_t) stcb, sp->length, 7543 (uint32_t) ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq), 7544 chk->rec.data.TSN_seq); 7545 } 7546 dchkh = mtod(chk->data, struct sctp_data_chunk *); 7547 /* 7548 * Put the rest of the things in place now. Size was done earlier in 7549 * previous loop prior to padding. 7550 */ 7551 7552#ifdef SCTP_ASOCLOG_OF_TSNS 7553 SCTP_TCB_LOCK_ASSERT(stcb); 7554 if (asoc->tsn_out_at >= SCTP_TSN_LOG_SIZE) { 7555 asoc->tsn_out_at = 0; 7556 asoc->tsn_out_wrapped = 1; 7557 } 7558 asoc->out_tsnlog[asoc->tsn_out_at].tsn = chk->rec.data.TSN_seq; 7559 asoc->out_tsnlog[asoc->tsn_out_at].strm = chk->rec.data.stream_number; 7560 asoc->out_tsnlog[asoc->tsn_out_at].seq = chk->rec.data.stream_seq; 7561 asoc->out_tsnlog[asoc->tsn_out_at].sz = chk->send_size; 7562 asoc->out_tsnlog[asoc->tsn_out_at].flgs = chk->rec.data.rcv_flags; 7563 asoc->out_tsnlog[asoc->tsn_out_at].stcb = (void *)stcb; 7564 asoc->out_tsnlog[asoc->tsn_out_at].in_pos = asoc->tsn_out_at; 7565 asoc->out_tsnlog[asoc->tsn_out_at].in_out = 2; 7566 asoc->tsn_out_at++; 7567#endif 7568 7569 dchkh->ch.chunk_type = SCTP_DATA; 7570 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7571 dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq); 7572 dchkh->dp.stream_id = htons(strq->stream_no); 7573 dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq); 7574 dchkh->dp.protocol_id = chk->rec.data.payloadtype; 7575 dchkh->ch.chunk_length = htons(chk->send_size); 7576 /* Now advance the chk->send_size by the actual pad needed. */ 7577 if (chk->send_size < SCTP_SIZE32(chk->book_size)) { 7578 /* need a pad */ 7579 struct mbuf *lm; 7580 int pads; 7581 7582 pads = SCTP_SIZE32(chk->book_size) - chk->send_size; 7583 if (sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf) == 0) { 7584 chk->pad_inplace = 1; 7585 } 7586 if ((lm = SCTP_BUF_NEXT(chk->last_mbuf)) != NULL) { 7587 /* pad added an mbuf */ 7588 chk->last_mbuf = lm; 7589 } 7590 chk->send_size += pads; 7591 } 7592 if (PR_SCTP_ENABLED(chk->flags)) { 7593 asoc->pr_sctp_cnt++; 7594 } 7595 if (sp->msg_is_complete && (sp->length == 0) && (sp->sender_all_done)) { 7596 /* All done pull and kill the message */ 7597 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7598 if (sp->put_last_out == 0) { 7599 SCTP_PRINTF("Gak, put out entire msg with NO end!-2\n"); 7600 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7601 sp->sender_all_done, 7602 sp->length, 7603 sp->msg_is_complete, 7604 sp->put_last_out, 7605 send_lock_up); 7606 } 7607 if ((send_lock_up == 0) && (TAILQ_NEXT(sp, next) == NULL)) { 7608 SCTP_TCB_SEND_LOCK(stcb); 7609 send_lock_up = 1; 7610 } 7611 TAILQ_REMOVE(&strq->outqueue, sp, next); 7612 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7613 if (sp->net) { 7614 sctp_free_remote_addr(sp->net); 7615 sp->net = NULL; 7616 } 7617 if (sp->data) { 7618 sctp_m_freem(sp->data); 7619 sp->data = NULL; 7620 } 7621 sctp_free_a_strmoq(stcb, sp, so_locked); 7622 7623 /* we can't be locked to it */ 7624 *locked = 0; 7625 stcb->asoc.locked_on_sending = NULL; 7626 } else { 7627 /* more to go, we are locked */ 7628 *locked = 1; 7629 } 7630 asoc->chunks_on_out_queue++; 7631 strq->chunks_on_queues++; 7632 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 7633 asoc->send_queue_cnt++; 7634out_of: 7635 if (send_lock_up) { 7636 SCTP_TCB_SEND_UNLOCK(stcb); 7637 } 7638 return (to_move); 7639} 7640 7641 7642static void 7643sctp_fill_outqueue(struct sctp_tcb *stcb, 7644 struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked 7645#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7646 SCTP_UNUSED 7647#endif 7648) 7649{ 7650 struct sctp_association *asoc; 7651 struct sctp_stream_out *strq; 7652 int goal_mtu, moved_how_much, total_moved = 0, bail = 0; 7653 int locked, giveup; 7654 7655 SCTP_TCB_LOCK_ASSERT(stcb); 7656 asoc = &stcb->asoc; 7657 switch (net->ro._l_addr.sa.sa_family) { 7658#ifdef INET 7659 case AF_INET: 7660 goal_mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 7661 break; 7662#endif 7663#ifdef INET6 7664 case AF_INET6: 7665 goal_mtu = net->mtu - SCTP_MIN_OVERHEAD; 7666 break; 7667#endif 7668 default: 7669 /* TSNH */ 7670 goal_mtu = net->mtu; 7671 break; 7672 } 7673 /* Need an allowance for the data chunk header too */ 7674 goal_mtu -= sizeof(struct sctp_data_chunk); 7675 7676 /* must make even word boundary */ 7677 goal_mtu &= 0xfffffffc; 7678 if (asoc->locked_on_sending) { 7679 /* We are stuck on one stream until the message completes. */ 7680 strq = asoc->locked_on_sending; 7681 locked = 1; 7682 } else { 7683 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7684 locked = 0; 7685 } 7686 while ((goal_mtu > 0) && strq) { 7687 giveup = 0; 7688 bail = 0; 7689 moved_how_much = sctp_move_to_outqueue(stcb, strq, goal_mtu, frag_point, &locked, 7690 &giveup, eeor_mode, &bail, so_locked); 7691 if (moved_how_much) 7692 stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved_how_much); 7693 7694 if (locked) { 7695 asoc->locked_on_sending = strq; 7696 if ((moved_how_much == 0) || (giveup) || bail) 7697 /* no more to move for now */ 7698 break; 7699 } else { 7700 asoc->locked_on_sending = NULL; 7701 if ((giveup) || bail) { 7702 break; 7703 } 7704 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7705 if (strq == NULL) { 7706 break; 7707 } 7708 } 7709 total_moved += moved_how_much; 7710 goal_mtu -= (moved_how_much + sizeof(struct sctp_data_chunk)); 7711 goal_mtu &= 0xfffffffc; 7712 } 7713 if (bail) 7714 *quit_now = 1; 7715 7716 stcb->asoc.ss_functions.sctp_ss_packet_done(stcb, net, asoc); 7717 7718 if (total_moved == 0) { 7719 if ((stcb->asoc.sctp_cmt_on_off == 0) && 7720 (net == stcb->asoc.primary_destination)) { 7721 /* ran dry for primary network net */ 7722 SCTP_STAT_INCR(sctps_primary_randry); 7723 } else if (stcb->asoc.sctp_cmt_on_off > 0) { 7724 /* ran dry with CMT on */ 7725 SCTP_STAT_INCR(sctps_cmt_randry); 7726 } 7727 } 7728} 7729 7730void 7731sctp_fix_ecn_echo(struct sctp_association *asoc) 7732{ 7733 struct sctp_tmit_chunk *chk; 7734 7735 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7736 if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 7737 chk->sent = SCTP_DATAGRAM_UNSENT; 7738 } 7739 } 7740} 7741 7742void 7743sctp_move_chunks_from_net(struct sctp_tcb *stcb, struct sctp_nets *net) 7744{ 7745 struct sctp_association *asoc; 7746 struct sctp_tmit_chunk *chk; 7747 struct sctp_stream_queue_pending *sp; 7748 unsigned int i; 7749 7750 if (net == NULL) { 7751 return; 7752 } 7753 asoc = &stcb->asoc; 7754 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 7755 TAILQ_FOREACH(sp, &stcb->asoc.strmout[i].outqueue, next) { 7756 if (sp->net == net) { 7757 sctp_free_remote_addr(sp->net); 7758 sp->net = NULL; 7759 } 7760 } 7761 } 7762 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7763 if (chk->whoTo == net) { 7764 sctp_free_remote_addr(chk->whoTo); 7765 chk->whoTo = NULL; 7766 } 7767 } 7768} 7769 7770int 7771sctp_med_chunk_output(struct sctp_inpcb *inp, 7772 struct sctp_tcb *stcb, 7773 struct sctp_association *asoc, 7774 int *num_out, 7775 int *reason_code, 7776 int control_only, int from_where, 7777 struct timeval *now, int *now_filled, int frag_point, int so_locked 7778#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7779 SCTP_UNUSED 7780#endif 7781) 7782{ 7783 /** 7784 * Ok this is the generic chunk service queue. we must do the 7785 * following: - Service the stream queue that is next, moving any 7786 * message (note I must get a complete message i.e. FIRST/MIDDLE and 7787 * LAST to the out queue in one pass) and assigning TSN's - Check to 7788 * see if the cwnd/rwnd allows any output, if so we go ahead and 7789 * fomulate and send the low level chunks. Making sure to combine 7790 * any control in the control chunk queue also. 7791 */ 7792 struct sctp_nets *net, *start_at, *sack_goes_to = NULL, *old_start_at = NULL; 7793 struct mbuf *outchain, *endoutchain; 7794 struct sctp_tmit_chunk *chk, *nchk; 7795 7796 /* temp arrays for unlinking */ 7797 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 7798 int no_fragmentflg, error; 7799 unsigned int max_rwnd_per_dest, max_send_per_dest; 7800 int one_chunk, hbflag, skip_data_for_this_net; 7801 int asconf, cookie, no_out_cnt; 7802 int bundle_at, ctl_cnt, no_data_chunks, eeor_mode; 7803 unsigned int mtu, r_mtu, omtu, mx_mtu, to_out; 7804 int tsns_sent = 0; 7805 uint32_t auth_offset = 0; 7806 struct sctp_auth_chunk *auth = NULL; 7807 uint16_t auth_keyid; 7808 int override_ok = 1; 7809 int skip_fill_up = 0; 7810 int data_auth_reqd = 0; 7811 7812 /* 7813 * JRS 5/14/07 - Add flag for whether a heartbeat is sent to the 7814 * destination. 7815 */ 7816 int quit_now = 0; 7817 7818 *num_out = 0; 7819 auth_keyid = stcb->asoc.authinfo.active_keyid; 7820 7821 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) || 7822 (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED) || 7823 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 7824 eeor_mode = 1; 7825 } else { 7826 eeor_mode = 0; 7827 } 7828 ctl_cnt = no_out_cnt = asconf = cookie = 0; 7829 /* 7830 * First lets prime the pump. For each destination, if there is room 7831 * in the flight size, attempt to pull an MTU's worth out of the 7832 * stream queues into the general send_queue 7833 */ 7834#ifdef SCTP_AUDITING_ENABLED 7835 sctp_audit_log(0xC2, 2); 7836#endif 7837 SCTP_TCB_LOCK_ASSERT(stcb); 7838 hbflag = 0; 7839 if ((control_only) || (asoc->stream_reset_outstanding)) 7840 no_data_chunks = 1; 7841 else 7842 no_data_chunks = 0; 7843 7844 /* Nothing to possible to send? */ 7845 if ((TAILQ_EMPTY(&asoc->control_send_queue) || 7846 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) && 7847 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7848 TAILQ_EMPTY(&asoc->send_queue) && 7849 stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) { 7850nothing_to_send: 7851 *reason_code = 9; 7852 return (0); 7853 } 7854 if (asoc->peers_rwnd == 0) { 7855 /* No room in peers rwnd */ 7856 *reason_code = 1; 7857 if (asoc->total_flight > 0) { 7858 /* we are allowed one chunk in flight */ 7859 no_data_chunks = 1; 7860 } 7861 } 7862 if (stcb->asoc.ecn_echo_cnt_onq) { 7863 /* Record where a sack goes, if any */ 7864 if (no_data_chunks && 7865 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) { 7866 /* Nothing but ECNe to send - we don't do that */ 7867 goto nothing_to_send; 7868 } 7869 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7870 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7871 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 7872 sack_goes_to = chk->whoTo; 7873 break; 7874 } 7875 } 7876 } 7877 max_rwnd_per_dest = ((asoc->peers_rwnd + asoc->total_flight) / asoc->numnets); 7878 if (stcb->sctp_socket) 7879 max_send_per_dest = SCTP_SB_LIMIT_SND(stcb->sctp_socket) / asoc->numnets; 7880 else 7881 max_send_per_dest = 0; 7882 if (no_data_chunks == 0) { 7883 /* How many non-directed chunks are there? */ 7884 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7885 if (chk->whoTo == NULL) { 7886 /* 7887 * We already have non-directed chunks on 7888 * the queue, no need to do a fill-up. 7889 */ 7890 skip_fill_up = 1; 7891 break; 7892 } 7893 } 7894 7895 } 7896 if ((no_data_chunks == 0) && 7897 (skip_fill_up == 0) && 7898 (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc))) { 7899 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 7900 /* 7901 * This for loop we are in takes in each net, if 7902 * its's got space in cwnd and has data sent to it 7903 * (when CMT is off) then it calls 7904 * sctp_fill_outqueue for the net. This gets data on 7905 * the send queue for that network. 7906 * 7907 * In sctp_fill_outqueue TSN's are assigned and data is 7908 * copied out of the stream buffers. Note mostly 7909 * copy by reference (we hope). 7910 */ 7911 net->window_probe = 0; 7912 if ((net != stcb->asoc.alternate) && 7913 ((net->dest_state & SCTP_ADDR_PF) || 7914 (!(net->dest_state & SCTP_ADDR_REACHABLE)) || 7915 (net->dest_state & SCTP_ADDR_UNCONFIRMED))) { 7916 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7917 sctp_log_cwnd(stcb, net, 1, 7918 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7919 } 7920 continue; 7921 } 7922 if ((stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) && 7923 (net->flight_size == 0)) { 7924 (*stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) (stcb, net); 7925 } 7926 if (net->flight_size >= net->cwnd) { 7927 /* skip this network, no room - can't fill */ 7928 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7929 sctp_log_cwnd(stcb, net, 3, 7930 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7931 } 7932 continue; 7933 } 7934 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7935 sctp_log_cwnd(stcb, net, 4, SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7936 } 7937 sctp_fill_outqueue(stcb, net, frag_point, eeor_mode, &quit_now, so_locked); 7938 if (quit_now) { 7939 /* memory alloc failure */ 7940 no_data_chunks = 1; 7941 break; 7942 } 7943 } 7944 } 7945 /* now service each destination and send out what we can for it */ 7946 /* Nothing to send? */ 7947 if (TAILQ_EMPTY(&asoc->control_send_queue) && 7948 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7949 TAILQ_EMPTY(&asoc->send_queue)) { 7950 *reason_code = 8; 7951 return (0); 7952 } 7953 if (asoc->sctp_cmt_on_off > 0) { 7954 /* get the last start point */ 7955 start_at = asoc->last_net_cmt_send_started; 7956 if (start_at == NULL) { 7957 /* null so to beginning */ 7958 start_at = TAILQ_FIRST(&asoc->nets); 7959 } else { 7960 start_at = TAILQ_NEXT(asoc->last_net_cmt_send_started, sctp_next); 7961 if (start_at == NULL) { 7962 start_at = TAILQ_FIRST(&asoc->nets); 7963 } 7964 } 7965 asoc->last_net_cmt_send_started = start_at; 7966 } else { 7967 start_at = TAILQ_FIRST(&asoc->nets); 7968 } 7969 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7970 if (chk->whoTo == NULL) { 7971 if (asoc->alternate) { 7972 chk->whoTo = asoc->alternate; 7973 } else { 7974 chk->whoTo = asoc->primary_destination; 7975 } 7976 atomic_add_int(&chk->whoTo->ref_count, 1); 7977 } 7978 } 7979 old_start_at = NULL; 7980again_one_more_time: 7981 for (net = start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) { 7982 /* how much can we send? */ 7983 /* SCTPDBG("Examine for sending net:%x\n", (uint32_t)net); */ 7984 if (old_start_at && (old_start_at == net)) { 7985 /* through list ocmpletely. */ 7986 break; 7987 } 7988 tsns_sent = 0xa; 7989 if (TAILQ_EMPTY(&asoc->control_send_queue) && 7990 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7991 (net->flight_size >= net->cwnd)) { 7992 /* 7993 * Nothing on control or asconf and flight is full, 7994 * we can skip even in the CMT case. 7995 */ 7996 continue; 7997 } 7998 bundle_at = 0; 7999 endoutchain = outchain = NULL; 8000 no_fragmentflg = 1; 8001 one_chunk = 0; 8002 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 8003 skip_data_for_this_net = 1; 8004 } else { 8005 skip_data_for_this_net = 0; 8006 } 8007 if ((net->ro.ro_rt) && (net->ro.ro_rt->rt_ifp)) { 8008 /* 8009 * if we have a route and an ifp check to see if we 8010 * have room to send to this guy 8011 */ 8012 struct ifnet *ifp; 8013 8014 ifp = net->ro.ro_rt->rt_ifp; 8015 if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) { 8016 SCTP_STAT_INCR(sctps_ifnomemqueued); 8017 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 8018 sctp_log_maxburst(stcb, net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED); 8019 } 8020 continue; 8021 } 8022 } 8023 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8024#ifdef INET 8025 case AF_INET: 8026 mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr)); 8027 break; 8028#endif 8029#ifdef INET6 8030 case AF_INET6: 8031 mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)); 8032 break; 8033#endif 8034 default: 8035 /* TSNH */ 8036 mtu = net->mtu; 8037 break; 8038 } 8039 mx_mtu = mtu; 8040 to_out = 0; 8041 if (mtu > asoc->peers_rwnd) { 8042 if (asoc->total_flight > 0) { 8043 /* We have a packet in flight somewhere */ 8044 r_mtu = asoc->peers_rwnd; 8045 } else { 8046 /* We are always allowed to send one MTU out */ 8047 one_chunk = 1; 8048 r_mtu = mtu; 8049 } 8050 } else { 8051 r_mtu = mtu; 8052 } 8053 /************************/ 8054 /* ASCONF transmission */ 8055 /************************/ 8056 /* Now first lets go through the asconf queue */ 8057 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 8058 if (chk->rec.chunk_id.id != SCTP_ASCONF) { 8059 continue; 8060 } 8061 if (chk->whoTo == NULL) { 8062 if (asoc->alternate == NULL) { 8063 if (asoc->primary_destination != net) { 8064 break; 8065 } 8066 } else { 8067 if (asoc->alternate != net) { 8068 break; 8069 } 8070 } 8071 } else { 8072 if (chk->whoTo != net) { 8073 break; 8074 } 8075 } 8076 if (chk->data == NULL) { 8077 break; 8078 } 8079 if (chk->sent != SCTP_DATAGRAM_UNSENT && 8080 chk->sent != SCTP_DATAGRAM_RESEND) { 8081 break; 8082 } 8083 /* 8084 * if no AUTH is yet included and this chunk 8085 * requires it, make sure to account for it. We 8086 * don't apply the size until the AUTH chunk is 8087 * actually added below in case there is no room for 8088 * this chunk. NOTE: we overload the use of "omtu" 8089 * here 8090 */ 8091 if ((auth == NULL) && 8092 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8093 stcb->asoc.peer_auth_chunks)) { 8094 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8095 } else 8096 omtu = 0; 8097 /* Here we do NOT factor the r_mtu */ 8098 if ((chk->send_size < (int)(mtu - omtu)) || 8099 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8100 /* 8101 * We probably should glom the mbuf chain 8102 * from the chk->data for control but the 8103 * problem is it becomes yet one more level 8104 * of tracking to do if for some reason 8105 * output fails. Then I have got to 8106 * reconstruct the merged control chain.. el 8107 * yucko.. for now we take the easy way and 8108 * do the copy 8109 */ 8110 /* 8111 * Add an AUTH chunk, if chunk requires it 8112 * save the offset into the chain for AUTH 8113 */ 8114 if ((auth == NULL) && 8115 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8116 stcb->asoc.peer_auth_chunks))) { 8117 outchain = sctp_add_auth_chunk(outchain, 8118 &endoutchain, 8119 &auth, 8120 &auth_offset, 8121 stcb, 8122 chk->rec.chunk_id.id); 8123 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8124 } 8125 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8126 (int)chk->rec.chunk_id.can_take_data, 8127 chk->send_size, chk->copy_by_ref); 8128 if (outchain == NULL) { 8129 *reason_code = 8; 8130 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8131 return (ENOMEM); 8132 } 8133 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8134 /* update our MTU size */ 8135 if (mtu > (chk->send_size + omtu)) 8136 mtu -= (chk->send_size + omtu); 8137 else 8138 mtu = 0; 8139 to_out += (chk->send_size + omtu); 8140 /* Do clear IP_DF ? */ 8141 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8142 no_fragmentflg = 0; 8143 } 8144 if (chk->rec.chunk_id.can_take_data) 8145 chk->data = NULL; 8146 /* 8147 * set hb flag since we can use these for 8148 * RTO 8149 */ 8150 hbflag = 1; 8151 asconf = 1; 8152 /* 8153 * should sysctl this: don't bundle data 8154 * with ASCONF since it requires AUTH 8155 */ 8156 no_data_chunks = 1; 8157 chk->sent = SCTP_DATAGRAM_SENT; 8158 if (chk->whoTo == NULL) { 8159 chk->whoTo = net; 8160 atomic_add_int(&net->ref_count, 1); 8161 } 8162 chk->snd_count++; 8163 if (mtu == 0) { 8164 /* 8165 * Ok we are out of room but we can 8166 * output without effecting the 8167 * flight size since this little guy 8168 * is a control only packet. 8169 */ 8170 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8171 /* 8172 * do NOT clear the asconf flag as 8173 * it is used to do appropriate 8174 * source address selection. 8175 */ 8176 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8177 (struct sockaddr *)&net->ro._l_addr, 8178 outchain, auth_offset, auth, 8179 stcb->asoc.authinfo.active_keyid, 8180 no_fragmentflg, 0, asconf, 8181 inp->sctp_lport, stcb->rport, 8182 htonl(stcb->asoc.peer_vtag), 8183 net->port, NULL, 8184 0, 0, 8185 so_locked))) { 8186 if (error == ENOBUFS) { 8187 asoc->ifp_had_enobuf = 1; 8188 SCTP_STAT_INCR(sctps_lowlevelerr); 8189 } 8190 if (from_where == 0) { 8191 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8192 } 8193 if (*now_filled == 0) { 8194 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8195 *now_filled = 1; 8196 *now = net->last_sent_time; 8197 } else { 8198 net->last_sent_time = *now; 8199 } 8200 hbflag = 0; 8201 /* error, could not output */ 8202 if (error == EHOSTUNREACH) { 8203 /* 8204 * Destination went 8205 * unreachable 8206 * during this send 8207 */ 8208 sctp_move_chunks_from_net(stcb, net); 8209 } 8210 *reason_code = 7; 8211 continue; 8212 } else 8213 asoc->ifp_had_enobuf = 0; 8214 if (*now_filled == 0) { 8215 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8216 *now_filled = 1; 8217 *now = net->last_sent_time; 8218 } else { 8219 net->last_sent_time = *now; 8220 } 8221 hbflag = 0; 8222 /* 8223 * increase the number we sent, if a 8224 * cookie is sent we don't tell them 8225 * any was sent out. 8226 */ 8227 outchain = endoutchain = NULL; 8228 auth = NULL; 8229 auth_offset = 0; 8230 if (!no_out_cnt) 8231 *num_out += ctl_cnt; 8232 /* recalc a clean slate and setup */ 8233 switch (net->ro._l_addr.sa.sa_family) { 8234#ifdef INET 8235 case AF_INET: 8236 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8237 break; 8238#endif 8239#ifdef INET6 8240 case AF_INET6: 8241 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8242 break; 8243#endif 8244 default: 8245 /* TSNH */ 8246 mtu = net->mtu; 8247 break; 8248 } 8249 to_out = 0; 8250 no_fragmentflg = 1; 8251 } 8252 } 8253 } 8254 /************************/ 8255 /* Control transmission */ 8256 /************************/ 8257 /* Now first lets go through the control queue */ 8258 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 8259 if ((sack_goes_to) && 8260 (chk->rec.chunk_id.id == SCTP_ECN_ECHO) && 8261 (chk->whoTo != sack_goes_to)) { 8262 /* 8263 * if we have a sack in queue, and we are 8264 * looking at an ecn echo that is NOT queued 8265 * to where the sack is going.. 8266 */ 8267 if (chk->whoTo == net) { 8268 /* 8269 * Don't transmit it to where its 8270 * going (current net) 8271 */ 8272 continue; 8273 } else if (sack_goes_to == net) { 8274 /* 8275 * But do transmit it to this 8276 * address 8277 */ 8278 goto skip_net_check; 8279 } 8280 } 8281 if (chk->whoTo == NULL) { 8282 if (asoc->alternate == NULL) { 8283 if (asoc->primary_destination != net) { 8284 continue; 8285 } 8286 } else { 8287 if (asoc->alternate != net) { 8288 continue; 8289 } 8290 } 8291 } else { 8292 if (chk->whoTo != net) { 8293 continue; 8294 } 8295 } 8296 skip_net_check: 8297 if (chk->data == NULL) { 8298 continue; 8299 } 8300 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 8301 /* 8302 * It must be unsent. Cookies and ASCONF's 8303 * hang around but there timers will force 8304 * when marked for resend. 8305 */ 8306 continue; 8307 } 8308 /* 8309 * if no AUTH is yet included and this chunk 8310 * requires it, make sure to account for it. We 8311 * don't apply the size until the AUTH chunk is 8312 * actually added below in case there is no room for 8313 * this chunk. NOTE: we overload the use of "omtu" 8314 * here 8315 */ 8316 if ((auth == NULL) && 8317 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8318 stcb->asoc.peer_auth_chunks)) { 8319 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8320 } else 8321 omtu = 0; 8322 /* Here we do NOT factor the r_mtu */ 8323 if ((chk->send_size <= (int)(mtu - omtu)) || 8324 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8325 /* 8326 * We probably should glom the mbuf chain 8327 * from the chk->data for control but the 8328 * problem is it becomes yet one more level 8329 * of tracking to do if for some reason 8330 * output fails. Then I have got to 8331 * reconstruct the merged control chain.. el 8332 * yucko.. for now we take the easy way and 8333 * do the copy 8334 */ 8335 /* 8336 * Add an AUTH chunk, if chunk requires it 8337 * save the offset into the chain for AUTH 8338 */ 8339 if ((auth == NULL) && 8340 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8341 stcb->asoc.peer_auth_chunks))) { 8342 outchain = sctp_add_auth_chunk(outchain, 8343 &endoutchain, 8344 &auth, 8345 &auth_offset, 8346 stcb, 8347 chk->rec.chunk_id.id); 8348 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8349 } 8350 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8351 (int)chk->rec.chunk_id.can_take_data, 8352 chk->send_size, chk->copy_by_ref); 8353 if (outchain == NULL) { 8354 *reason_code = 8; 8355 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8356 return (ENOMEM); 8357 } 8358 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8359 /* update our MTU size */ 8360 if (mtu > (chk->send_size + omtu)) 8361 mtu -= (chk->send_size + omtu); 8362 else 8363 mtu = 0; 8364 to_out += (chk->send_size + omtu); 8365 /* Do clear IP_DF ? */ 8366 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8367 no_fragmentflg = 0; 8368 } 8369 if (chk->rec.chunk_id.can_take_data) 8370 chk->data = NULL; 8371 /* Mark things to be removed, if needed */ 8372 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8373 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 8374 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 8375 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 8376 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 8377 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 8378 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 8379 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 8380 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 8381 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 8382 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 8383 if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) { 8384 hbflag = 1; 8385 } 8386 /* remove these chunks at the end */ 8387 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8388 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 8389 /* turn off the timer */ 8390 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 8391 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 8392 inp, stcb, net, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1); 8393 } 8394 } 8395 ctl_cnt++; 8396 } else { 8397 /* 8398 * Other chunks, since they have 8399 * timers running (i.e. COOKIE) we 8400 * just "trust" that it gets sent or 8401 * retransmitted. 8402 */ 8403 ctl_cnt++; 8404 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 8405 cookie = 1; 8406 no_out_cnt = 1; 8407 } else if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 8408 /* 8409 * Increment ecne send count 8410 * here this means we may be 8411 * over-zealous in our 8412 * counting if the send 8413 * fails, but its the best 8414 * place to do it (we used 8415 * to do it in the queue of 8416 * the chunk, but that did 8417 * not tell how many times 8418 * it was sent. 8419 */ 8420 SCTP_STAT_INCR(sctps_sendecne); 8421 } 8422 chk->sent = SCTP_DATAGRAM_SENT; 8423 if (chk->whoTo == NULL) { 8424 chk->whoTo = net; 8425 atomic_add_int(&net->ref_count, 1); 8426 } 8427 chk->snd_count++; 8428 } 8429 if (mtu == 0) { 8430 /* 8431 * Ok we are out of room but we can 8432 * output without effecting the 8433 * flight size since this little guy 8434 * is a control only packet. 8435 */ 8436 if (asconf) { 8437 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8438 /* 8439 * do NOT clear the asconf 8440 * flag as it is used to do 8441 * appropriate source 8442 * address selection. 8443 */ 8444 } 8445 if (cookie) { 8446 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8447 cookie = 0; 8448 } 8449 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8450 (struct sockaddr *)&net->ro._l_addr, 8451 outchain, 8452 auth_offset, auth, 8453 stcb->asoc.authinfo.active_keyid, 8454 no_fragmentflg, 0, asconf, 8455 inp->sctp_lport, stcb->rport, 8456 htonl(stcb->asoc.peer_vtag), 8457 net->port, NULL, 8458 0, 0, 8459 so_locked))) { 8460 if (error == ENOBUFS) { 8461 asoc->ifp_had_enobuf = 1; 8462 SCTP_STAT_INCR(sctps_lowlevelerr); 8463 } 8464 if (from_where == 0) { 8465 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8466 } 8467 /* error, could not output */ 8468 if (hbflag) { 8469 if (*now_filled == 0) { 8470 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8471 *now_filled = 1; 8472 *now = net->last_sent_time; 8473 } else { 8474 net->last_sent_time = *now; 8475 } 8476 hbflag = 0; 8477 } 8478 if (error == EHOSTUNREACH) { 8479 /* 8480 * Destination went 8481 * unreachable 8482 * during this send 8483 */ 8484 sctp_move_chunks_from_net(stcb, net); 8485 } 8486 *reason_code = 7; 8487 continue; 8488 } else 8489 asoc->ifp_had_enobuf = 0; 8490 /* Only HB or ASCONF advances time */ 8491 if (hbflag) { 8492 if (*now_filled == 0) { 8493 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8494 *now_filled = 1; 8495 *now = net->last_sent_time; 8496 } else { 8497 net->last_sent_time = *now; 8498 } 8499 hbflag = 0; 8500 } 8501 /* 8502 * increase the number we sent, if a 8503 * cookie is sent we don't tell them 8504 * any was sent out. 8505 */ 8506 outchain = endoutchain = NULL; 8507 auth = NULL; 8508 auth_offset = 0; 8509 if (!no_out_cnt) 8510 *num_out += ctl_cnt; 8511 /* recalc a clean slate and setup */ 8512 switch (net->ro._l_addr.sa.sa_family) { 8513#ifdef INET 8514 case AF_INET: 8515 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8516 break; 8517#endif 8518#ifdef INET6 8519 case AF_INET6: 8520 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8521 break; 8522#endif 8523 default: 8524 /* TSNH */ 8525 mtu = net->mtu; 8526 break; 8527 } 8528 to_out = 0; 8529 no_fragmentflg = 1; 8530 } 8531 } 8532 } 8533 /* JRI: if dest is in PF state, do not send data to it */ 8534 if ((asoc->sctp_cmt_on_off > 0) && 8535 (net != stcb->asoc.alternate) && 8536 (net->dest_state & SCTP_ADDR_PF)) { 8537 goto no_data_fill; 8538 } 8539 if (net->flight_size >= net->cwnd) { 8540 goto no_data_fill; 8541 } 8542 if ((asoc->sctp_cmt_on_off > 0) && 8543 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_RECV_BUFFER_SPLITTING) && 8544 (net->flight_size > max_rwnd_per_dest)) { 8545 goto no_data_fill; 8546 } 8547 /* 8548 * We need a specific accounting for the usage of the send 8549 * buffer. We also need to check the number of messages per 8550 * net. For now, this is better than nothing and it disabled 8551 * by default... 8552 */ 8553 if ((asoc->sctp_cmt_on_off > 0) && 8554 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_SEND_BUFFER_SPLITTING) && 8555 (max_send_per_dest > 0) && 8556 (net->flight_size > max_send_per_dest)) { 8557 goto no_data_fill; 8558 } 8559 /*********************/ 8560 /* Data transmission */ 8561 /*********************/ 8562 /* 8563 * if AUTH for DATA is required and no AUTH has been added 8564 * yet, account for this in the mtu now... if no data can be 8565 * bundled, this adjustment won't matter anyways since the 8566 * packet will be going out... 8567 */ 8568 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, 8569 stcb->asoc.peer_auth_chunks); 8570 if (data_auth_reqd && (auth == NULL)) { 8571 mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8572 } 8573 /* now lets add any data within the MTU constraints */ 8574 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8575#ifdef INET 8576 case AF_INET: 8577 if (net->mtu > (sizeof(struct ip) + sizeof(struct sctphdr))) 8578 omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr)); 8579 else 8580 omtu = 0; 8581 break; 8582#endif 8583#ifdef INET6 8584 case AF_INET6: 8585 if (net->mtu > (sizeof(struct ip6_hdr) + sizeof(struct sctphdr))) 8586 omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)); 8587 else 8588 omtu = 0; 8589 break; 8590#endif 8591 default: 8592 /* TSNH */ 8593 omtu = 0; 8594 break; 8595 } 8596 if ((((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) && 8597 (skip_data_for_this_net == 0)) || 8598 (cookie)) { 8599 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 8600 if (no_data_chunks) { 8601 /* let only control go out */ 8602 *reason_code = 1; 8603 break; 8604 } 8605 if (net->flight_size >= net->cwnd) { 8606 /* skip this net, no room for data */ 8607 *reason_code = 2; 8608 break; 8609 } 8610 if ((chk->whoTo != NULL) && 8611 (chk->whoTo != net)) { 8612 /* Don't send the chunk on this net */ 8613 continue; 8614 } 8615 if (asoc->sctp_cmt_on_off == 0) { 8616 if ((asoc->alternate) && 8617 (asoc->alternate != net) && 8618 (chk->whoTo == NULL)) { 8619 continue; 8620 } else if ((net != asoc->primary_destination) && 8621 (asoc->alternate == NULL) && 8622 (chk->whoTo == NULL)) { 8623 continue; 8624 } 8625 } 8626 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 8627 /*- 8628 * strange, we have a chunk that is 8629 * to big for its destination and 8630 * yet no fragment ok flag. 8631 * Something went wrong when the 8632 * PMTU changed...we did not mark 8633 * this chunk for some reason?? I 8634 * will fix it here by letting IP 8635 * fragment it for now and printing 8636 * a warning. This really should not 8637 * happen ... 8638 */ 8639 SCTP_PRINTF("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 8640 chk->send_size, mtu); 8641 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 8642 } 8643 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 8644 ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) == SCTP_STATE_SHUTDOWN_PENDING)) { 8645 struct sctp_data_chunk *dchkh; 8646 8647 dchkh = mtod(chk->data, struct sctp_data_chunk *); 8648 dchkh->ch.chunk_flags |= SCTP_DATA_SACK_IMMEDIATELY; 8649 } 8650 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 8651 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 8652 /* ok we will add this one */ 8653 8654 /* 8655 * Add an AUTH chunk, if chunk 8656 * requires it, save the offset into 8657 * the chain for AUTH 8658 */ 8659 if (data_auth_reqd) { 8660 if (auth == NULL) { 8661 outchain = sctp_add_auth_chunk(outchain, 8662 &endoutchain, 8663 &auth, 8664 &auth_offset, 8665 stcb, 8666 SCTP_DATA); 8667 auth_keyid = chk->auth_keyid; 8668 override_ok = 0; 8669 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8670 } else if (override_ok) { 8671 /* 8672 * use this data's 8673 * keyid 8674 */ 8675 auth_keyid = chk->auth_keyid; 8676 override_ok = 0; 8677 } else if (auth_keyid != chk->auth_keyid) { 8678 /* 8679 * different keyid, 8680 * so done bundling 8681 */ 8682 break; 8683 } 8684 } 8685 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0, 8686 chk->send_size, chk->copy_by_ref); 8687 if (outchain == NULL) { 8688 SCTPDBG(SCTP_DEBUG_OUTPUT3, "No memory?\n"); 8689 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 8690 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8691 } 8692 *reason_code = 3; 8693 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8694 return (ENOMEM); 8695 } 8696 /* upate our MTU size */ 8697 /* Do clear IP_DF ? */ 8698 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8699 no_fragmentflg = 0; 8700 } 8701 /* unsigned subtraction of mtu */ 8702 if (mtu > chk->send_size) 8703 mtu -= chk->send_size; 8704 else 8705 mtu = 0; 8706 /* unsigned subtraction of r_mtu */ 8707 if (r_mtu > chk->send_size) 8708 r_mtu -= chk->send_size; 8709 else 8710 r_mtu = 0; 8711 8712 to_out += chk->send_size; 8713 if ((to_out > mx_mtu) && no_fragmentflg) { 8714#ifdef INVARIANTS 8715 panic("Exceeding mtu of %d out size is %d", mx_mtu, to_out); 8716#else 8717 SCTP_PRINTF("Exceeding mtu of %d out size is %d\n", 8718 mx_mtu, to_out); 8719#endif 8720 } 8721 chk->window_probe = 0; 8722 data_list[bundle_at++] = chk; 8723 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 8724 break; 8725 } 8726 if (chk->sent == SCTP_DATAGRAM_UNSENT) { 8727 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 8728 SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks); 8729 } else { 8730 SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks); 8731 } 8732 if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) && 8733 ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0)) 8734 /* 8735 * Count number of 8736 * user msg's that 8737 * were fragmented 8738 * we do this by 8739 * counting when we 8740 * see a LAST 8741 * fragment only. 8742 */ 8743 SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs); 8744 } 8745 if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) { 8746 if ((one_chunk) && (stcb->asoc.total_flight == 0)) { 8747 data_list[0]->window_probe = 1; 8748 net->window_probe = 1; 8749 } 8750 break; 8751 } 8752 } else { 8753 /* 8754 * Must be sent in order of the 8755 * TSN's (on a network) 8756 */ 8757 break; 8758 } 8759 } /* for (chunk gather loop for this net) */ 8760 } /* if asoc.state OPEN */ 8761no_data_fill: 8762 /* Is there something to send for this destination? */ 8763 if (outchain) { 8764 /* We may need to start a control timer or two */ 8765 if (asconf) { 8766 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, 8767 stcb, net); 8768 /* 8769 * do NOT clear the asconf flag as it is 8770 * used to do appropriate source address 8771 * selection. 8772 */ 8773 } 8774 if (cookie) { 8775 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8776 cookie = 0; 8777 } 8778 /* must start a send timer if data is being sent */ 8779 if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) { 8780 /* 8781 * no timer running on this destination 8782 * restart it. 8783 */ 8784 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8785 } 8786 /* Now send it, if there is anything to send :> */ 8787 if ((error = sctp_lowlevel_chunk_output(inp, 8788 stcb, 8789 net, 8790 (struct sockaddr *)&net->ro._l_addr, 8791 outchain, 8792 auth_offset, 8793 auth, 8794 auth_keyid, 8795 no_fragmentflg, 8796 bundle_at, 8797 asconf, 8798 inp->sctp_lport, stcb->rport, 8799 htonl(stcb->asoc.peer_vtag), 8800 net->port, NULL, 8801 0, 0, 8802 so_locked))) { 8803 /* error, we could not output */ 8804 if (error == ENOBUFS) { 8805 SCTP_STAT_INCR(sctps_lowlevelerr); 8806 asoc->ifp_had_enobuf = 1; 8807 } 8808 if (from_where == 0) { 8809 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8810 } 8811 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8812 if (hbflag) { 8813 if (*now_filled == 0) { 8814 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8815 *now_filled = 1; 8816 *now = net->last_sent_time; 8817 } else { 8818 net->last_sent_time = *now; 8819 } 8820 hbflag = 0; 8821 } 8822 if (error == EHOSTUNREACH) { 8823 /* 8824 * Destination went unreachable 8825 * during this send 8826 */ 8827 sctp_move_chunks_from_net(stcb, net); 8828 } 8829 *reason_code = 6; 8830 /*- 8831 * I add this line to be paranoid. As far as 8832 * I can tell the continue, takes us back to 8833 * the top of the for, but just to make sure 8834 * I will reset these again here. 8835 */ 8836 ctl_cnt = bundle_at = 0; 8837 continue; /* This takes us back to the 8838 * for() for the nets. */ 8839 } else { 8840 asoc->ifp_had_enobuf = 0; 8841 } 8842 endoutchain = NULL; 8843 auth = NULL; 8844 auth_offset = 0; 8845 if (bundle_at || hbflag) { 8846 /* For data/asconf and hb set time */ 8847 if (*now_filled == 0) { 8848 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8849 *now_filled = 1; 8850 *now = net->last_sent_time; 8851 } else { 8852 net->last_sent_time = *now; 8853 } 8854 } 8855 if (!no_out_cnt) { 8856 *num_out += (ctl_cnt + bundle_at); 8857 } 8858 if (bundle_at) { 8859 /* setup for a RTO measurement */ 8860 tsns_sent = data_list[0]->rec.data.TSN_seq; 8861 /* fill time if not already filled */ 8862 if (*now_filled == 0) { 8863 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 8864 *now_filled = 1; 8865 *now = asoc->time_last_sent; 8866 } else { 8867 asoc->time_last_sent = *now; 8868 } 8869 if (net->rto_needed) { 8870 data_list[0]->do_rtt = 1; 8871 net->rto_needed = 0; 8872 } 8873 SCTP_STAT_INCR_BY(sctps_senddata, bundle_at); 8874 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 8875 } 8876 if (one_chunk) { 8877 break; 8878 } 8879 } 8880 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8881 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND); 8882 } 8883 } 8884 if (old_start_at == NULL) { 8885 old_start_at = start_at; 8886 start_at = TAILQ_FIRST(&asoc->nets); 8887 if (old_start_at) 8888 goto again_one_more_time; 8889 } 8890 /* 8891 * At the end there should be no NON timed chunks hanging on this 8892 * queue. 8893 */ 8894 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8895 sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND); 8896 } 8897 if ((*num_out == 0) && (*reason_code == 0)) { 8898 *reason_code = 4; 8899 } else { 8900 *reason_code = 5; 8901 } 8902 sctp_clean_up_ctl(stcb, asoc, so_locked); 8903 return (0); 8904} 8905 8906void 8907sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 8908{ 8909 /*- 8910 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of 8911 * the control chunk queue. 8912 */ 8913 struct sctp_chunkhdr *hdr; 8914 struct sctp_tmit_chunk *chk; 8915 struct mbuf *mat; 8916 8917 SCTP_TCB_LOCK_ASSERT(stcb); 8918 sctp_alloc_a_chunk(stcb, chk); 8919 if (chk == NULL) { 8920 /* no memory */ 8921 sctp_m_freem(op_err); 8922 return; 8923 } 8924 chk->copy_by_ref = 0; 8925 SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_DONTWAIT); 8926 if (op_err == NULL) { 8927 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 8928 return; 8929 } 8930 chk->send_size = 0; 8931 mat = op_err; 8932 while (mat != NULL) { 8933 chk->send_size += SCTP_BUF_LEN(mat); 8934 mat = SCTP_BUF_NEXT(mat); 8935 } 8936 chk->rec.chunk_id.id = SCTP_OPERATION_ERROR; 8937 chk->rec.chunk_id.can_take_data = 1; 8938 chk->sent = SCTP_DATAGRAM_UNSENT; 8939 chk->snd_count = 0; 8940 chk->flags = 0; 8941 chk->asoc = &stcb->asoc; 8942 chk->data = op_err; 8943 chk->whoTo = NULL; 8944 hdr = mtod(op_err, struct sctp_chunkhdr *); 8945 hdr->chunk_type = SCTP_OPERATION_ERROR; 8946 hdr->chunk_flags = 0; 8947 hdr->chunk_length = htons(chk->send_size); 8948 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, 8949 chk, 8950 sctp_next); 8951 chk->asoc->ctrl_queue_cnt++; 8952} 8953 8954int 8955sctp_send_cookie_echo(struct mbuf *m, 8956 int offset, 8957 struct sctp_tcb *stcb, 8958 struct sctp_nets *net) 8959{ 8960 /*- 8961 * pull out the cookie and put it at the front of the control chunk 8962 * queue. 8963 */ 8964 int at; 8965 struct mbuf *cookie; 8966 struct sctp_paramhdr parm, *phdr; 8967 struct sctp_chunkhdr *hdr; 8968 struct sctp_tmit_chunk *chk; 8969 uint16_t ptype, plen; 8970 8971 /* First find the cookie in the param area */ 8972 cookie = NULL; 8973 at = offset + sizeof(struct sctp_init_chunk); 8974 8975 SCTP_TCB_LOCK_ASSERT(stcb); 8976 do { 8977 phdr = sctp_get_next_param(m, at, &parm, sizeof(parm)); 8978 if (phdr == NULL) { 8979 return (-3); 8980 } 8981 ptype = ntohs(phdr->param_type); 8982 plen = ntohs(phdr->param_length); 8983 if (ptype == SCTP_STATE_COOKIE) { 8984 int pad; 8985 8986 /* found the cookie */ 8987 if ((pad = (plen % 4))) { 8988 plen += 4 - pad; 8989 } 8990 cookie = SCTP_M_COPYM(m, at, plen, M_DONTWAIT); 8991 if (cookie == NULL) { 8992 /* No memory */ 8993 return (-2); 8994 } 8995#ifdef SCTP_MBUF_LOGGING 8996 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 8997 struct mbuf *mat; 8998 8999 for (mat = cookie; mat; mat = SCTP_BUF_NEXT(mat)) { 9000 if (SCTP_BUF_IS_EXTENDED(mat)) { 9001 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 9002 } 9003 } 9004 } 9005#endif 9006 break; 9007 } 9008 at += SCTP_SIZE32(plen); 9009 } while (phdr); 9010 if (cookie == NULL) { 9011 /* Did not find the cookie */ 9012 return (-3); 9013 } 9014 /* ok, we got the cookie lets change it into a cookie echo chunk */ 9015 9016 /* first the change from param to cookie */ 9017 hdr = mtod(cookie, struct sctp_chunkhdr *); 9018 hdr->chunk_type = SCTP_COOKIE_ECHO; 9019 hdr->chunk_flags = 0; 9020 /* get the chunk stuff now and place it in the FRONT of the queue */ 9021 sctp_alloc_a_chunk(stcb, chk); 9022 if (chk == NULL) { 9023 /* no memory */ 9024 sctp_m_freem(cookie); 9025 return (-5); 9026 } 9027 chk->copy_by_ref = 0; 9028 chk->send_size = plen; 9029 chk->rec.chunk_id.id = SCTP_COOKIE_ECHO; 9030 chk->rec.chunk_id.can_take_data = 0; 9031 chk->sent = SCTP_DATAGRAM_UNSENT; 9032 chk->snd_count = 0; 9033 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9034 chk->asoc = &stcb->asoc; 9035 chk->data = cookie; 9036 chk->whoTo = net; 9037 atomic_add_int(&chk->whoTo->ref_count, 1); 9038 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 9039 chk->asoc->ctrl_queue_cnt++; 9040 return (0); 9041} 9042 9043void 9044sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 9045 struct mbuf *m, 9046 int offset, 9047 int chk_length, 9048 struct sctp_nets *net) 9049{ 9050 /* 9051 * take a HB request and make it into a HB ack and send it. 9052 */ 9053 struct mbuf *outchain; 9054 struct sctp_chunkhdr *chdr; 9055 struct sctp_tmit_chunk *chk; 9056 9057 9058 if (net == NULL) 9059 /* must have a net pointer */ 9060 return; 9061 9062 outchain = SCTP_M_COPYM(m, offset, chk_length, M_DONTWAIT); 9063 if (outchain == NULL) { 9064 /* gak out of memory */ 9065 return; 9066 } 9067#ifdef SCTP_MBUF_LOGGING 9068 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9069 struct mbuf *mat; 9070 9071 for (mat = outchain; mat; mat = SCTP_BUF_NEXT(mat)) { 9072 if (SCTP_BUF_IS_EXTENDED(mat)) { 9073 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 9074 } 9075 } 9076 } 9077#endif 9078 chdr = mtod(outchain, struct sctp_chunkhdr *); 9079 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 9080 chdr->chunk_flags = 0; 9081 if (chk_length % 4) { 9082 /* need pad */ 9083 uint32_t cpthis = 0; 9084 int padlen; 9085 9086 padlen = 4 - (chk_length % 4); 9087 m_copyback(outchain, chk_length, padlen, (caddr_t)&cpthis); 9088 } 9089 sctp_alloc_a_chunk(stcb, chk); 9090 if (chk == NULL) { 9091 /* no memory */ 9092 sctp_m_freem(outchain); 9093 return; 9094 } 9095 chk->copy_by_ref = 0; 9096 chk->send_size = chk_length; 9097 chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK; 9098 chk->rec.chunk_id.can_take_data = 1; 9099 chk->sent = SCTP_DATAGRAM_UNSENT; 9100 chk->snd_count = 0; 9101 chk->flags = 0; 9102 chk->asoc = &stcb->asoc; 9103 chk->data = outchain; 9104 chk->whoTo = net; 9105 atomic_add_int(&chk->whoTo->ref_count, 1); 9106 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9107 chk->asoc->ctrl_queue_cnt++; 9108} 9109 9110void 9111sctp_send_cookie_ack(struct sctp_tcb *stcb) 9112{ 9113 /* formulate and queue a cookie-ack back to sender */ 9114 struct mbuf *cookie_ack; 9115 struct sctp_chunkhdr *hdr; 9116 struct sctp_tmit_chunk *chk; 9117 9118 SCTP_TCB_LOCK_ASSERT(stcb); 9119 9120 cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_DONTWAIT, 1, MT_HEADER); 9121 if (cookie_ack == NULL) { 9122 /* no mbuf's */ 9123 return; 9124 } 9125 SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD); 9126 sctp_alloc_a_chunk(stcb, chk); 9127 if (chk == NULL) { 9128 /* no memory */ 9129 sctp_m_freem(cookie_ack); 9130 return; 9131 } 9132 chk->copy_by_ref = 0; 9133 chk->send_size = sizeof(struct sctp_chunkhdr); 9134 chk->rec.chunk_id.id = SCTP_COOKIE_ACK; 9135 chk->rec.chunk_id.can_take_data = 1; 9136 chk->sent = SCTP_DATAGRAM_UNSENT; 9137 chk->snd_count = 0; 9138 chk->flags = 0; 9139 chk->asoc = &stcb->asoc; 9140 chk->data = cookie_ack; 9141 if (chk->asoc->last_control_chunk_from != NULL) { 9142 chk->whoTo = chk->asoc->last_control_chunk_from; 9143 atomic_add_int(&chk->whoTo->ref_count, 1); 9144 } else { 9145 chk->whoTo = NULL; 9146 } 9147 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 9148 hdr->chunk_type = SCTP_COOKIE_ACK; 9149 hdr->chunk_flags = 0; 9150 hdr->chunk_length = htons(chk->send_size); 9151 SCTP_BUF_LEN(cookie_ack) = chk->send_size; 9152 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9153 chk->asoc->ctrl_queue_cnt++; 9154 return; 9155} 9156 9157 9158void 9159sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 9160{ 9161 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 9162 struct mbuf *m_shutdown_ack; 9163 struct sctp_shutdown_ack_chunk *ack_cp; 9164 struct sctp_tmit_chunk *chk; 9165 9166 m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_DONTWAIT, 1, MT_HEADER); 9167 if (m_shutdown_ack == NULL) { 9168 /* no mbuf's */ 9169 return; 9170 } 9171 SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD); 9172 sctp_alloc_a_chunk(stcb, chk); 9173 if (chk == NULL) { 9174 /* no memory */ 9175 sctp_m_freem(m_shutdown_ack); 9176 return; 9177 } 9178 chk->copy_by_ref = 0; 9179 chk->send_size = sizeof(struct sctp_chunkhdr); 9180 chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK; 9181 chk->rec.chunk_id.can_take_data = 1; 9182 chk->sent = SCTP_DATAGRAM_UNSENT; 9183 chk->snd_count = 0; 9184 chk->flags = 0; 9185 chk->asoc = &stcb->asoc; 9186 chk->data = m_shutdown_ack; 9187 chk->whoTo = net; 9188 if (chk->whoTo) { 9189 atomic_add_int(&chk->whoTo->ref_count, 1); 9190 } 9191 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 9192 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 9193 ack_cp->ch.chunk_flags = 0; 9194 ack_cp->ch.chunk_length = htons(chk->send_size); 9195 SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size; 9196 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9197 chk->asoc->ctrl_queue_cnt++; 9198 return; 9199} 9200 9201void 9202sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 9203{ 9204 /* formulate and queue a SHUTDOWN to the sender */ 9205 struct mbuf *m_shutdown; 9206 struct sctp_shutdown_chunk *shutdown_cp; 9207 struct sctp_tmit_chunk *chk; 9208 9209 m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_DONTWAIT, 1, MT_HEADER); 9210 if (m_shutdown == NULL) { 9211 /* no mbuf's */ 9212 return; 9213 } 9214 SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD); 9215 sctp_alloc_a_chunk(stcb, chk); 9216 if (chk == NULL) { 9217 /* no memory */ 9218 sctp_m_freem(m_shutdown); 9219 return; 9220 } 9221 chk->copy_by_ref = 0; 9222 chk->send_size = sizeof(struct sctp_shutdown_chunk); 9223 chk->rec.chunk_id.id = SCTP_SHUTDOWN; 9224 chk->rec.chunk_id.can_take_data = 1; 9225 chk->sent = SCTP_DATAGRAM_UNSENT; 9226 chk->snd_count = 0; 9227 chk->flags = 0; 9228 chk->asoc = &stcb->asoc; 9229 chk->data = m_shutdown; 9230 chk->whoTo = net; 9231 if (chk->whoTo) { 9232 atomic_add_int(&chk->whoTo->ref_count, 1); 9233 } 9234 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 9235 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 9236 shutdown_cp->ch.chunk_flags = 0; 9237 shutdown_cp->ch.chunk_length = htons(chk->send_size); 9238 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9239 SCTP_BUF_LEN(m_shutdown) = chk->send_size; 9240 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9241 chk->asoc->ctrl_queue_cnt++; 9242 return; 9243} 9244 9245void 9246sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked) 9247{ 9248 /* 9249 * formulate and queue an ASCONF to the peer. ASCONF parameters 9250 * should be queued on the assoc queue. 9251 */ 9252 struct sctp_tmit_chunk *chk; 9253 struct mbuf *m_asconf; 9254 int len; 9255 9256 SCTP_TCB_LOCK_ASSERT(stcb); 9257 9258 if ((!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) && 9259 (!sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS))) { 9260 /* can't send a new one if there is one in flight already */ 9261 return; 9262 } 9263 /* compose an ASCONF chunk, maximum length is PMTU */ 9264 m_asconf = sctp_compose_asconf(stcb, &len, addr_locked); 9265 if (m_asconf == NULL) { 9266 return; 9267 } 9268 sctp_alloc_a_chunk(stcb, chk); 9269 if (chk == NULL) { 9270 /* no memory */ 9271 sctp_m_freem(m_asconf); 9272 return; 9273 } 9274 chk->copy_by_ref = 0; 9275 chk->data = m_asconf; 9276 chk->send_size = len; 9277 chk->rec.chunk_id.id = SCTP_ASCONF; 9278 chk->rec.chunk_id.can_take_data = 0; 9279 chk->sent = SCTP_DATAGRAM_UNSENT; 9280 chk->snd_count = 0; 9281 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9282 chk->asoc = &stcb->asoc; 9283 chk->whoTo = net; 9284 if (chk->whoTo) { 9285 atomic_add_int(&chk->whoTo->ref_count, 1); 9286 } 9287 TAILQ_INSERT_TAIL(&chk->asoc->asconf_send_queue, chk, sctp_next); 9288 chk->asoc->ctrl_queue_cnt++; 9289 return; 9290} 9291 9292void 9293sctp_send_asconf_ack(struct sctp_tcb *stcb) 9294{ 9295 /* 9296 * formulate and queue a asconf-ack back to sender. the asconf-ack 9297 * must be stored in the tcb. 9298 */ 9299 struct sctp_tmit_chunk *chk; 9300 struct sctp_asconf_ack *ack, *latest_ack; 9301 struct mbuf *m_ack; 9302 struct sctp_nets *net = NULL; 9303 9304 SCTP_TCB_LOCK_ASSERT(stcb); 9305 /* Get the latest ASCONF-ACK */ 9306 latest_ack = TAILQ_LAST(&stcb->asoc.asconf_ack_sent, sctp_asconf_ackhead); 9307 if (latest_ack == NULL) { 9308 return; 9309 } 9310 if (latest_ack->last_sent_to != NULL && 9311 latest_ack->last_sent_to == stcb->asoc.last_control_chunk_from) { 9312 /* we're doing a retransmission */ 9313 net = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0); 9314 if (net == NULL) { 9315 /* no alternate */ 9316 if (stcb->asoc.last_control_chunk_from == NULL) { 9317 if (stcb->asoc.alternate) { 9318 net = stcb->asoc.alternate; 9319 } else { 9320 net = stcb->asoc.primary_destination; 9321 } 9322 } else { 9323 net = stcb->asoc.last_control_chunk_from; 9324 } 9325 } 9326 } else { 9327 /* normal case */ 9328 if (stcb->asoc.last_control_chunk_from == NULL) { 9329 if (stcb->asoc.alternate) { 9330 net = stcb->asoc.alternate; 9331 } else { 9332 net = stcb->asoc.primary_destination; 9333 } 9334 } else { 9335 net = stcb->asoc.last_control_chunk_from; 9336 } 9337 } 9338 latest_ack->last_sent_to = net; 9339 9340 TAILQ_FOREACH(ack, &stcb->asoc.asconf_ack_sent, next) { 9341 if (ack->data == NULL) { 9342 continue; 9343 } 9344 /* copy the asconf_ack */ 9345 m_ack = SCTP_M_COPYM(ack->data, 0, M_COPYALL, M_DONTWAIT); 9346 if (m_ack == NULL) { 9347 /* couldn't copy it */ 9348 return; 9349 } 9350#ifdef SCTP_MBUF_LOGGING 9351 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9352 struct mbuf *mat; 9353 9354 for (mat = m_ack; mat; mat = SCTP_BUF_NEXT(mat)) { 9355 if (SCTP_BUF_IS_EXTENDED(mat)) { 9356 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 9357 } 9358 } 9359 } 9360#endif 9361 9362 sctp_alloc_a_chunk(stcb, chk); 9363 if (chk == NULL) { 9364 /* no memory */ 9365 if (m_ack) 9366 sctp_m_freem(m_ack); 9367 return; 9368 } 9369 chk->copy_by_ref = 0; 9370 9371 chk->whoTo = net; 9372 if (chk->whoTo) { 9373 atomic_add_int(&chk->whoTo->ref_count, 1); 9374 } 9375 chk->data = m_ack; 9376 chk->send_size = 0; 9377 /* Get size */ 9378 chk->send_size = ack->len; 9379 chk->rec.chunk_id.id = SCTP_ASCONF_ACK; 9380 chk->rec.chunk_id.can_take_data = 1; 9381 chk->sent = SCTP_DATAGRAM_UNSENT; 9382 chk->snd_count = 0; 9383 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; /* XXX */ 9384 chk->asoc = &stcb->asoc; 9385 9386 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9387 chk->asoc->ctrl_queue_cnt++; 9388 } 9389 return; 9390} 9391 9392 9393static int 9394sctp_chunk_retransmission(struct sctp_inpcb *inp, 9395 struct sctp_tcb *stcb, 9396 struct sctp_association *asoc, 9397 int *cnt_out, struct timeval *now, int *now_filled, int *fr_done, int so_locked 9398#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 9399 SCTP_UNUSED 9400#endif 9401) 9402{ 9403 /*- 9404 * send out one MTU of retransmission. If fast_retransmit is 9405 * happening we ignore the cwnd. Otherwise we obey the cwnd and 9406 * rwnd. For a Cookie or Asconf in the control chunk queue we 9407 * retransmit them by themselves. 9408 * 9409 * For data chunks we will pick out the lowest TSN's in the sent_queue 9410 * marked for resend and bundle them all together (up to a MTU of 9411 * destination). The address to send to should have been 9412 * selected/changed where the retransmission was marked (i.e. in FR 9413 * or t3-timeout routines). 9414 */ 9415 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 9416 struct sctp_tmit_chunk *chk, *fwd; 9417 struct mbuf *m, *endofchain; 9418 struct sctp_nets *net = NULL; 9419 uint32_t tsns_sent = 0; 9420 int no_fragmentflg, bundle_at, cnt_thru; 9421 unsigned int mtu; 9422 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 9423 struct sctp_auth_chunk *auth = NULL; 9424 uint32_t auth_offset = 0; 9425 uint16_t auth_keyid; 9426 int override_ok = 1; 9427 int data_auth_reqd = 0; 9428 uint32_t dmtu = 0; 9429 9430 SCTP_TCB_LOCK_ASSERT(stcb); 9431 tmr_started = ctl_cnt = bundle_at = error = 0; 9432 no_fragmentflg = 1; 9433 fwd_tsn = 0; 9434 *cnt_out = 0; 9435 fwd = NULL; 9436 endofchain = m = NULL; 9437 auth_keyid = stcb->asoc.authinfo.active_keyid; 9438#ifdef SCTP_AUDITING_ENABLED 9439 sctp_audit_log(0xC3, 1); 9440#endif 9441 if ((TAILQ_EMPTY(&asoc->sent_queue)) && 9442 (TAILQ_EMPTY(&asoc->control_send_queue))) { 9443 SCTPDBG(SCTP_DEBUG_OUTPUT1, "SCTP hits empty queue with cnt set to %d?\n", 9444 asoc->sent_queue_retran_cnt); 9445 asoc->sent_queue_cnt = 0; 9446 asoc->sent_queue_cnt_removeable = 0; 9447 /* send back 0/0 so we enter normal transmission */ 9448 *cnt_out = 0; 9449 return (0); 9450 } 9451 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 9452 if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) || 9453 (chk->rec.chunk_id.id == SCTP_STREAM_RESET) || 9454 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) { 9455 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9456 continue; 9457 } 9458 if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 9459 if (chk != asoc->str_reset) { 9460 /* 9461 * not eligible for retran if its 9462 * not ours 9463 */ 9464 continue; 9465 } 9466 } 9467 ctl_cnt++; 9468 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 9469 fwd_tsn = 1; 9470 } 9471 /* 9472 * Add an AUTH chunk, if chunk requires it save the 9473 * offset into the chain for AUTH 9474 */ 9475 if ((auth == NULL) && 9476 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 9477 stcb->asoc.peer_auth_chunks))) { 9478 m = sctp_add_auth_chunk(m, &endofchain, 9479 &auth, &auth_offset, 9480 stcb, 9481 chk->rec.chunk_id.id); 9482 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9483 } 9484 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9485 break; 9486 } 9487 } 9488 one_chunk = 0; 9489 cnt_thru = 0; 9490 /* do we have control chunks to retransmit? */ 9491 if (m != NULL) { 9492 /* Start a timer no matter if we suceed or fail */ 9493 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 9494 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 9495 } else if (chk->rec.chunk_id.id == SCTP_ASCONF) 9496 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 9497 chk->snd_count++; /* update our count */ 9498 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 9499 (struct sockaddr *)&chk->whoTo->ro._l_addr, m, 9500 auth_offset, auth, stcb->asoc.authinfo.active_keyid, 9501 no_fragmentflg, 0, 0, 9502 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9503 chk->whoTo->port, NULL, 9504 0, 0, 9505 so_locked))) { 9506 SCTP_STAT_INCR(sctps_lowlevelerr); 9507 return (error); 9508 } 9509 endofchain = NULL; 9510 auth = NULL; 9511 auth_offset = 0; 9512 /* 9513 * We don't want to mark the net->sent time here since this 9514 * we use this for HB and retrans cannot measure RTT 9515 */ 9516 /* (void)SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */ 9517 *cnt_out += 1; 9518 chk->sent = SCTP_DATAGRAM_SENT; 9519 sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt); 9520 if (fwd_tsn == 0) { 9521 return (0); 9522 } else { 9523 /* Clean up the fwd-tsn list */ 9524 sctp_clean_up_ctl(stcb, asoc, so_locked); 9525 return (0); 9526 } 9527 } 9528 /* 9529 * Ok, it is just data retransmission we need to do or that and a 9530 * fwd-tsn with it all. 9531 */ 9532 if (TAILQ_EMPTY(&asoc->sent_queue)) { 9533 return (SCTP_RETRAN_DONE); 9534 } 9535 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) || 9536 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) { 9537 /* not yet open, resend the cookie and that is it */ 9538 return (1); 9539 } 9540#ifdef SCTP_AUDITING_ENABLED 9541 sctp_auditing(20, inp, stcb, NULL); 9542#endif 9543 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks); 9544 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 9545 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9546 /* No, not sent to this net or not ready for rtx */ 9547 continue; 9548 } 9549 if (chk->data == NULL) { 9550 SCTP_PRINTF("TSN:%x chk->snd_count:%d chk->sent:%d can't retran - no data\n", 9551 chk->rec.data.TSN_seq, chk->snd_count, chk->sent); 9552 continue; 9553 } 9554 if ((SCTP_BASE_SYSCTL(sctp_max_retran_chunk)) && 9555 (chk->snd_count >= SCTP_BASE_SYSCTL(sctp_max_retran_chunk))) { 9556 /* Gak, we have exceeded max unlucky retran, abort! */ 9557 SCTP_PRINTF("Gak, chk->snd_count:%d >= max:%d - send abort\n", 9558 chk->snd_count, 9559 SCTP_BASE_SYSCTL(sctp_max_retran_chunk)); 9560 atomic_add_int(&stcb->asoc.refcnt, 1); 9561 sctp_abort_an_association(stcb->sctp_ep, stcb, NULL, so_locked); 9562 SCTP_TCB_LOCK(stcb); 9563 atomic_subtract_int(&stcb->asoc.refcnt, 1); 9564 return (SCTP_RETRAN_EXIT); 9565 } 9566 /* pick up the net */ 9567 net = chk->whoTo; 9568 switch (net->ro._l_addr.sa.sa_family) { 9569#ifdef INET 9570 case AF_INET: 9571 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 9572 break; 9573#endif 9574#ifdef INET6 9575 case AF_INET6: 9576 mtu = net->mtu - SCTP_MIN_OVERHEAD; 9577 break; 9578#endif 9579 default: 9580 /* TSNH */ 9581 mtu = net->mtu; 9582 break; 9583 } 9584 9585 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 9586 /* No room in peers rwnd */ 9587 uint32_t tsn; 9588 9589 tsn = asoc->last_acked_seq + 1; 9590 if (tsn == chk->rec.data.TSN_seq) { 9591 /* 9592 * we make a special exception for this 9593 * case. The peer has no rwnd but is missing 9594 * the lowest chunk.. which is probably what 9595 * is holding up the rwnd. 9596 */ 9597 goto one_chunk_around; 9598 } 9599 return (1); 9600 } 9601one_chunk_around: 9602 if (asoc->peers_rwnd < mtu) { 9603 one_chunk = 1; 9604 if ((asoc->peers_rwnd == 0) && 9605 (asoc->total_flight == 0)) { 9606 chk->window_probe = 1; 9607 chk->whoTo->window_probe = 1; 9608 } 9609 } 9610#ifdef SCTP_AUDITING_ENABLED 9611 sctp_audit_log(0xC3, 2); 9612#endif 9613 bundle_at = 0; 9614 m = NULL; 9615 net->fast_retran_ip = 0; 9616 if (chk->rec.data.doing_fast_retransmit == 0) { 9617 /* 9618 * if no FR in progress skip destination that have 9619 * flight_size > cwnd. 9620 */ 9621 if (net->flight_size >= net->cwnd) { 9622 continue; 9623 } 9624 } else { 9625 /* 9626 * Mark the destination net to have FR recovery 9627 * limits put on it. 9628 */ 9629 *fr_done = 1; 9630 net->fast_retran_ip = 1; 9631 } 9632 9633 /* 9634 * if no AUTH is yet included and this chunk requires it, 9635 * make sure to account for it. We don't apply the size 9636 * until the AUTH chunk is actually added below in case 9637 * there is no room for this chunk. 9638 */ 9639 if (data_auth_reqd && (auth == NULL)) { 9640 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9641 } else 9642 dmtu = 0; 9643 9644 if ((chk->send_size <= (mtu - dmtu)) || 9645 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 9646 /* ok we will add this one */ 9647 if (data_auth_reqd) { 9648 if (auth == NULL) { 9649 m = sctp_add_auth_chunk(m, 9650 &endofchain, 9651 &auth, 9652 &auth_offset, 9653 stcb, 9654 SCTP_DATA); 9655 auth_keyid = chk->auth_keyid; 9656 override_ok = 0; 9657 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9658 } else if (override_ok) { 9659 auth_keyid = chk->auth_keyid; 9660 override_ok = 0; 9661 } else if (chk->auth_keyid != auth_keyid) { 9662 /* different keyid, so done bundling */ 9663 break; 9664 } 9665 } 9666 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9667 if (m == NULL) { 9668 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9669 return (ENOMEM); 9670 } 9671 /* Do clear IP_DF ? */ 9672 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9673 no_fragmentflg = 0; 9674 } 9675 /* upate our MTU size */ 9676 if (mtu > (chk->send_size + dmtu)) 9677 mtu -= (chk->send_size + dmtu); 9678 else 9679 mtu = 0; 9680 data_list[bundle_at++] = chk; 9681 if (one_chunk && (asoc->total_flight <= 0)) { 9682 SCTP_STAT_INCR(sctps_windowprobed); 9683 } 9684 } 9685 if (one_chunk == 0) { 9686 /* 9687 * now are there anymore forward from chk to pick 9688 * up? 9689 */ 9690 for (fwd = TAILQ_NEXT(chk, sctp_next); fwd != NULL; fwd = TAILQ_NEXT(fwd, sctp_next)) { 9691 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 9692 /* Nope, not for retran */ 9693 continue; 9694 } 9695 if (fwd->whoTo != net) { 9696 /* Nope, not the net in question */ 9697 continue; 9698 } 9699 if (data_auth_reqd && (auth == NULL)) { 9700 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9701 } else 9702 dmtu = 0; 9703 if (fwd->send_size <= (mtu - dmtu)) { 9704 if (data_auth_reqd) { 9705 if (auth == NULL) { 9706 m = sctp_add_auth_chunk(m, 9707 &endofchain, 9708 &auth, 9709 &auth_offset, 9710 stcb, 9711 SCTP_DATA); 9712 auth_keyid = fwd->auth_keyid; 9713 override_ok = 0; 9714 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9715 } else if (override_ok) { 9716 auth_keyid = fwd->auth_keyid; 9717 override_ok = 0; 9718 } else if (fwd->auth_keyid != auth_keyid) { 9719 /* 9720 * different keyid, 9721 * so done bundling 9722 */ 9723 break; 9724 } 9725 } 9726 m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref); 9727 if (m == NULL) { 9728 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9729 return (ENOMEM); 9730 } 9731 /* Do clear IP_DF ? */ 9732 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9733 no_fragmentflg = 0; 9734 } 9735 /* upate our MTU size */ 9736 if (mtu > (fwd->send_size + dmtu)) 9737 mtu -= (fwd->send_size + dmtu); 9738 else 9739 mtu = 0; 9740 data_list[bundle_at++] = fwd; 9741 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 9742 break; 9743 } 9744 } else { 9745 /* can't fit so we are done */ 9746 break; 9747 } 9748 } 9749 } 9750 /* Is there something to send for this destination? */ 9751 if (m) { 9752 /* 9753 * No matter if we fail/or suceed we should start a 9754 * timer. A failure is like a lost IP packet :-) 9755 */ 9756 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9757 /* 9758 * no timer running on this destination 9759 * restart it. 9760 */ 9761 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9762 tmr_started = 1; 9763 } 9764 /* Now lets send it, if there is anything to send :> */ 9765 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 9766 (struct sockaddr *)&net->ro._l_addr, m, 9767 auth_offset, auth, auth_keyid, 9768 no_fragmentflg, 0, 0, 9769 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9770 net->port, NULL, 9771 0, 0, 9772 so_locked))) { 9773 /* error, we could not output */ 9774 SCTP_STAT_INCR(sctps_lowlevelerr); 9775 return (error); 9776 } 9777 endofchain = NULL; 9778 auth = NULL; 9779 auth_offset = 0; 9780 /* For HB's */ 9781 /* 9782 * We don't want to mark the net->sent time here 9783 * since this we use this for HB and retrans cannot 9784 * measure RTT 9785 */ 9786 /* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */ 9787 9788 /* For auto-close */ 9789 cnt_thru++; 9790 if (*now_filled == 0) { 9791 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 9792 *now = asoc->time_last_sent; 9793 *now_filled = 1; 9794 } else { 9795 asoc->time_last_sent = *now; 9796 } 9797 *cnt_out += bundle_at; 9798#ifdef SCTP_AUDITING_ENABLED 9799 sctp_audit_log(0xC4, bundle_at); 9800#endif 9801 if (bundle_at) { 9802 tsns_sent = data_list[0]->rec.data.TSN_seq; 9803 } 9804 for (i = 0; i < bundle_at; i++) { 9805 SCTP_STAT_INCR(sctps_sendretransdata); 9806 data_list[i]->sent = SCTP_DATAGRAM_SENT; 9807 /* 9808 * When we have a revoked data, and we 9809 * retransmit it, then we clear the revoked 9810 * flag since this flag dictates if we 9811 * subtracted from the fs 9812 */ 9813 if (data_list[i]->rec.data.chunk_was_revoked) { 9814 /* Deflate the cwnd */ 9815 data_list[i]->whoTo->cwnd -= data_list[i]->book_size; 9816 data_list[i]->rec.data.chunk_was_revoked = 0; 9817 } 9818 data_list[i]->snd_count++; 9819 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 9820 /* record the time */ 9821 data_list[i]->sent_rcv_time = asoc->time_last_sent; 9822 if (data_list[i]->book_size_scale) { 9823 /* 9824 * need to double the book size on 9825 * this one 9826 */ 9827 data_list[i]->book_size_scale = 0; 9828 /* 9829 * Since we double the booksize, we 9830 * must also double the output queue 9831 * size, since this get shrunk when 9832 * we free by this amount. 9833 */ 9834 atomic_add_int(&((asoc)->total_output_queue_size), data_list[i]->book_size); 9835 data_list[i]->book_size *= 2; 9836 9837 9838 } else { 9839 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 9840 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 9841 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 9842 } 9843 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 9844 (uint32_t) (data_list[i]->send_size + 9845 SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 9846 } 9847 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 9848 sctp_misc_ints(SCTP_FLIGHT_LOG_UP_RSND, 9849 data_list[i]->whoTo->flight_size, 9850 data_list[i]->book_size, 9851 (uintptr_t) data_list[i]->whoTo, 9852 data_list[i]->rec.data.TSN_seq); 9853 } 9854 sctp_flight_size_increase(data_list[i]); 9855 sctp_total_flight_increase(stcb, data_list[i]); 9856 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 9857 /* SWS sender side engages */ 9858 asoc->peers_rwnd = 0; 9859 } 9860 if ((i == 0) && 9861 (data_list[i]->rec.data.doing_fast_retransmit)) { 9862 SCTP_STAT_INCR(sctps_sendfastretrans); 9863 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 9864 (tmr_started == 0)) { 9865 /*- 9866 * ok we just fast-retrans'd 9867 * the lowest TSN, i.e the 9868 * first on the list. In 9869 * this case we want to give 9870 * some more time to get a 9871 * SACK back without a 9872 * t3-expiring. 9873 */ 9874 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 9875 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4); 9876 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9877 } 9878 } 9879 } 9880 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 9881 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND); 9882 } 9883#ifdef SCTP_AUDITING_ENABLED 9884 sctp_auditing(21, inp, stcb, NULL); 9885#endif 9886 } else { 9887 /* None will fit */ 9888 return (1); 9889 } 9890 if (asoc->sent_queue_retran_cnt <= 0) { 9891 /* all done we have no more to retran */ 9892 asoc->sent_queue_retran_cnt = 0; 9893 break; 9894 } 9895 if (one_chunk) { 9896 /* No more room in rwnd */ 9897 return (1); 9898 } 9899 /* stop the for loop here. we sent out a packet */ 9900 break; 9901 } 9902 return (0); 9903} 9904 9905static void 9906sctp_timer_validation(struct sctp_inpcb *inp, 9907 struct sctp_tcb *stcb, 9908 struct sctp_association *asoc) 9909{ 9910 struct sctp_nets *net; 9911 9912 /* Validate that a timer is running somewhere */ 9913 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 9914 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9915 /* Here is a timer */ 9916 return; 9917 } 9918 } 9919 SCTP_TCB_LOCK_ASSERT(stcb); 9920 /* Gak, we did not have a timer somewhere */ 9921 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Deadlock avoided starting timer on a dest at retran\n"); 9922 if (asoc->alternate) { 9923 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->alternate); 9924 } else { 9925 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 9926 } 9927 return; 9928} 9929 9930void 9931sctp_chunk_output(struct sctp_inpcb *inp, 9932 struct sctp_tcb *stcb, 9933 int from_where, 9934 int so_locked 9935#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 9936 SCTP_UNUSED 9937#endif 9938) 9939{ 9940 /*- 9941 * Ok this is the generic chunk service queue. we must do the 9942 * following: 9943 * - See if there are retransmits pending, if so we must 9944 * do these first. 9945 * - Service the stream queue that is next, moving any 9946 * message (note I must get a complete message i.e. 9947 * FIRST/MIDDLE and LAST to the out queue in one pass) and assigning 9948 * TSN's 9949 * - Check to see if the cwnd/rwnd allows any output, if so we 9950 * go ahead and fomulate and send the low level chunks. Making sure 9951 * to combine any control in the control chunk queue also. 9952 */ 9953 struct sctp_association *asoc; 9954 struct sctp_nets *net; 9955 int error = 0, num_out = 0, tot_out = 0, ret = 0, reason_code = 0; 9956 unsigned int burst_cnt = 0; 9957 struct timeval now; 9958 int now_filled = 0; 9959 int nagle_on; 9960 int frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 9961 int un_sent = 0; 9962 int fr_done; 9963 unsigned int tot_frs = 0; 9964 9965 asoc = &stcb->asoc; 9966 /* The Nagle algorithm is only applied when handling a send call. */ 9967 if (from_where == SCTP_OUTPUT_FROM_USR_SEND) { 9968 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) { 9969 nagle_on = 0; 9970 } else { 9971 nagle_on = 1; 9972 } 9973 } else { 9974 nagle_on = 0; 9975 } 9976 SCTP_TCB_LOCK_ASSERT(stcb); 9977 9978 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 9979 9980 if ((un_sent <= 0) && 9981 (TAILQ_EMPTY(&asoc->control_send_queue)) && 9982 (TAILQ_EMPTY(&asoc->asconf_send_queue)) && 9983 (asoc->sent_queue_retran_cnt == 0)) { 9984 /* Nothing to do unless there is something to be sent left */ 9985 return; 9986 } 9987 /* 9988 * Do we have something to send, data or control AND a sack timer 9989 * running, if so piggy-back the sack. 9990 */ 9991 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 9992 sctp_send_sack(stcb, so_locked); 9993 (void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer); 9994 } 9995 while (asoc->sent_queue_retran_cnt) { 9996 /*- 9997 * Ok, it is retransmission time only, we send out only ONE 9998 * packet with a single call off to the retran code. 9999 */ 10000 if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) { 10001 /*- 10002 * Special hook for handling cookiess discarded 10003 * by peer that carried data. Send cookie-ack only 10004 * and then the next call with get the retran's. 10005 */ 10006 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10007 from_where, 10008 &now, &now_filled, frag_point, so_locked); 10009 return; 10010 } else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) { 10011 /* if its not from a HB then do it */ 10012 fr_done = 0; 10013 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled, &fr_done, so_locked); 10014 if (fr_done) { 10015 tot_frs++; 10016 } 10017 } else { 10018 /* 10019 * its from any other place, we don't allow retran 10020 * output (only control) 10021 */ 10022 ret = 1; 10023 } 10024 if (ret > 0) { 10025 /* Can't send anymore */ 10026 /*- 10027 * now lets push out control by calling med-level 10028 * output once. this assures that we WILL send HB's 10029 * if queued too. 10030 */ 10031 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10032 from_where, 10033 &now, &now_filled, frag_point, so_locked); 10034#ifdef SCTP_AUDITING_ENABLED 10035 sctp_auditing(8, inp, stcb, NULL); 10036#endif 10037 sctp_timer_validation(inp, stcb, asoc); 10038 return; 10039 } 10040 if (ret < 0) { 10041 /*- 10042 * The count was off.. retran is not happening so do 10043 * the normal retransmission. 10044 */ 10045#ifdef SCTP_AUDITING_ENABLED 10046 sctp_auditing(9, inp, stcb, NULL); 10047#endif 10048 if (ret == SCTP_RETRAN_EXIT) { 10049 return; 10050 } 10051 break; 10052 } 10053 if (from_where == SCTP_OUTPUT_FROM_T3) { 10054 /* Only one transmission allowed out of a timeout */ 10055#ifdef SCTP_AUDITING_ENABLED 10056 sctp_auditing(10, inp, stcb, NULL); 10057#endif 10058 /* Push out any control */ 10059 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, from_where, 10060 &now, &now_filled, frag_point, so_locked); 10061 return; 10062 } 10063 if ((asoc->fr_max_burst > 0) && (tot_frs >= asoc->fr_max_burst)) { 10064 /* Hit FR burst limit */ 10065 return; 10066 } 10067 if ((num_out == 0) && (ret == 0)) { 10068 /* No more retrans to send */ 10069 break; 10070 } 10071 } 10072#ifdef SCTP_AUDITING_ENABLED 10073 sctp_auditing(12, inp, stcb, NULL); 10074#endif 10075 /* Check for bad destinations, if they exist move chunks around. */ 10076 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 10077 if (!(net->dest_state & SCTP_ADDR_REACHABLE)) { 10078 /*- 10079 * if possible move things off of this address we 10080 * still may send below due to the dormant state but 10081 * we try to find an alternate address to send to 10082 * and if we have one we move all queued data on the 10083 * out wheel to this alternate address. 10084 */ 10085 if (net->ref_count > 1) 10086 sctp_move_chunks_from_net(stcb, net); 10087 } else { 10088 /*- 10089 * if ((asoc->sat_network) || (net->addr_is_local)) 10090 * { burst_limit = asoc->max_burst * 10091 * SCTP_SAT_NETWORK_BURST_INCR; } 10092 */ 10093 if (asoc->max_burst > 0) { 10094 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst)) { 10095 if ((net->flight_size + (asoc->max_burst * net->mtu)) < net->cwnd) { 10096 /* 10097 * JRS - Use the congestion 10098 * control given in the 10099 * congestion control module 10100 */ 10101 asoc->cc_functions.sctp_cwnd_update_after_output(stcb, net, asoc->max_burst); 10102 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10103 sctp_log_maxburst(stcb, net, 0, asoc->max_burst, SCTP_MAX_BURST_APPLIED); 10104 } 10105 SCTP_STAT_INCR(sctps_maxburstqueued); 10106 } 10107 net->fast_retran_ip = 0; 10108 } else { 10109 if (net->flight_size == 0) { 10110 /* 10111 * Should be decaying the 10112 * cwnd here 10113 */ 10114 ; 10115 } 10116 } 10117 } 10118 } 10119 10120 } 10121 burst_cnt = 0; 10122 do { 10123 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 10124 &reason_code, 0, from_where, 10125 &now, &now_filled, frag_point, so_locked); 10126 if (error) { 10127 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Error %d was returned from med-c-op\n", error); 10128 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10129 sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 10130 } 10131 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10132 sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES); 10133 sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES); 10134 } 10135 break; 10136 } 10137 SCTPDBG(SCTP_DEBUG_OUTPUT3, "m-c-o put out %d\n", num_out); 10138 10139 tot_out += num_out; 10140 burst_cnt++; 10141 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10142 sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES); 10143 if (num_out == 0) { 10144 sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES); 10145 } 10146 } 10147 if (nagle_on) { 10148 /* 10149 * When the Nagle algorithm is used, look at how 10150 * much is unsent, then if its smaller than an MTU 10151 * and we have data in flight we stop, except if we 10152 * are handling a fragmented user message. 10153 */ 10154 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 10155 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 10156 if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) && 10157 (stcb->asoc.total_flight > 0) && 10158 ((stcb->asoc.locked_on_sending == NULL) || 10159 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 10160 break; 10161 } 10162 } 10163 if (TAILQ_EMPTY(&asoc->control_send_queue) && 10164 TAILQ_EMPTY(&asoc->send_queue) && 10165 stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) { 10166 /* Nothing left to send */ 10167 break; 10168 } 10169 if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) { 10170 /* Nothing left to send */ 10171 break; 10172 } 10173 } while (num_out && 10174 ((asoc->max_burst == 0) || 10175 SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) || 10176 (burst_cnt < asoc->max_burst))); 10177 10178 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) == 0) { 10179 if ((asoc->max_burst > 0) && (burst_cnt >= asoc->max_burst)) { 10180 SCTP_STAT_INCR(sctps_maxburstqueued); 10181 asoc->burst_limit_applied = 1; 10182 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10183 sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED); 10184 } 10185 } else { 10186 asoc->burst_limit_applied = 0; 10187 } 10188 } 10189 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10190 sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES); 10191 } 10192 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, we have put out %d chunks\n", 10193 tot_out); 10194 10195 /*- 10196 * Now we need to clean up the control chunk chain if a ECNE is on 10197 * it. It must be marked as UNSENT again so next call will continue 10198 * to send it until such time that we get a CWR, to remove it. 10199 */ 10200 if (stcb->asoc.ecn_echo_cnt_onq) 10201 sctp_fix_ecn_echo(asoc); 10202 return; 10203} 10204 10205 10206int 10207sctp_output( 10208 struct sctp_inpcb *inp, 10209 struct mbuf *m, 10210 struct sockaddr *addr, 10211 struct mbuf *control, 10212 struct thread *p, 10213 int flags) 10214{ 10215 if (inp == NULL) { 10216 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10217 return (EINVAL); 10218 } 10219 if (inp->sctp_socket == NULL) { 10220 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10221 return (EINVAL); 10222 } 10223 return (sctp_sosend(inp->sctp_socket, 10224 addr, 10225 (struct uio *)NULL, 10226 m, 10227 control, 10228 flags, p 10229 )); 10230} 10231 10232void 10233send_forward_tsn(struct sctp_tcb *stcb, 10234 struct sctp_association *asoc) 10235{ 10236 struct sctp_tmit_chunk *chk; 10237 struct sctp_forward_tsn_chunk *fwdtsn; 10238 uint32_t advance_peer_ack_point; 10239 10240 SCTP_TCB_LOCK_ASSERT(stcb); 10241 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10242 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 10243 /* mark it to unsent */ 10244 chk->sent = SCTP_DATAGRAM_UNSENT; 10245 chk->snd_count = 0; 10246 /* Do we correct its output location? */ 10247 if (chk->whoTo) { 10248 sctp_free_remote_addr(chk->whoTo); 10249 chk->whoTo = NULL; 10250 } 10251 goto sctp_fill_in_rest; 10252 } 10253 } 10254 /* Ok if we reach here we must build one */ 10255 sctp_alloc_a_chunk(stcb, chk); 10256 if (chk == NULL) { 10257 return; 10258 } 10259 asoc->fwd_tsn_cnt++; 10260 chk->copy_by_ref = 0; 10261 chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN; 10262 chk->rec.chunk_id.can_take_data = 0; 10263 chk->asoc = asoc; 10264 chk->whoTo = NULL; 10265 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 10266 if (chk->data == NULL) { 10267 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 10268 return; 10269 } 10270 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 10271 chk->sent = SCTP_DATAGRAM_UNSENT; 10272 chk->snd_count = 0; 10273 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 10274 asoc->ctrl_queue_cnt++; 10275sctp_fill_in_rest: 10276 /*- 10277 * Here we go through and fill out the part that deals with 10278 * stream/seq of the ones we skip. 10279 */ 10280 SCTP_BUF_LEN(chk->data) = 0; 10281 { 10282 struct sctp_tmit_chunk *at, *tp1, *last; 10283 struct sctp_strseq *strseq; 10284 unsigned int cnt_of_space, i, ovh; 10285 unsigned int space_needed; 10286 unsigned int cnt_of_skipped = 0; 10287 10288 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10289 if ((at->sent != SCTP_FORWARD_TSN_SKIP) && 10290 (at->sent != SCTP_DATAGRAM_NR_ACKED)) { 10291 /* no more to look at */ 10292 break; 10293 } 10294 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 10295 /* We don't report these */ 10296 continue; 10297 } 10298 cnt_of_skipped++; 10299 } 10300 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10301 (cnt_of_skipped * sizeof(struct sctp_strseq))); 10302 10303 cnt_of_space = M_TRAILINGSPACE(chk->data); 10304 10305 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 10306 ovh = SCTP_MIN_OVERHEAD; 10307 } else { 10308 ovh = SCTP_MIN_V4_OVERHEAD; 10309 } 10310 if (cnt_of_space > (asoc->smallest_mtu - ovh)) { 10311 /* trim to a mtu size */ 10312 cnt_of_space = asoc->smallest_mtu - ovh; 10313 } 10314 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10315 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10316 0xff, 0, cnt_of_skipped, 10317 asoc->advanced_peer_ack_point); 10318 10319 } 10320 advance_peer_ack_point = asoc->advanced_peer_ack_point; 10321 if (cnt_of_space < space_needed) { 10322 /*- 10323 * ok we must trim down the chunk by lowering the 10324 * advance peer ack point. 10325 */ 10326 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10327 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10328 0xff, 0xff, cnt_of_space, 10329 space_needed); 10330 } 10331 cnt_of_skipped = cnt_of_space - sizeof(struct sctp_forward_tsn_chunk); 10332 cnt_of_skipped /= sizeof(struct sctp_strseq); 10333 /*- 10334 * Go through and find the TSN that will be the one 10335 * we report. 10336 */ 10337 at = TAILQ_FIRST(&asoc->sent_queue); 10338 if (at != NULL) { 10339 for (i = 0; i < cnt_of_skipped; i++) { 10340 tp1 = TAILQ_NEXT(at, sctp_next); 10341 if (tp1 == NULL) { 10342 break; 10343 } 10344 at = tp1; 10345 } 10346 } 10347 if (at && SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10348 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10349 0xff, cnt_of_skipped, at->rec.data.TSN_seq, 10350 asoc->advanced_peer_ack_point); 10351 } 10352 last = at; 10353 /*- 10354 * last now points to last one I can report, update 10355 * peer ack point 10356 */ 10357 if (last) 10358 advance_peer_ack_point = last->rec.data.TSN_seq; 10359 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10360 cnt_of_skipped * sizeof(struct sctp_strseq); 10361 } 10362 chk->send_size = space_needed; 10363 /* Setup the chunk */ 10364 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 10365 fwdtsn->ch.chunk_length = htons(chk->send_size); 10366 fwdtsn->ch.chunk_flags = 0; 10367 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 10368 fwdtsn->new_cumulative_tsn = htonl(advance_peer_ack_point); 10369 SCTP_BUF_LEN(chk->data) = chk->send_size; 10370 fwdtsn++; 10371 /*- 10372 * Move pointer to after the fwdtsn and transfer to the 10373 * strseq pointer. 10374 */ 10375 strseq = (struct sctp_strseq *)fwdtsn; 10376 /*- 10377 * Now populate the strseq list. This is done blindly 10378 * without pulling out duplicate stream info. This is 10379 * inefficent but won't harm the process since the peer will 10380 * look at these in sequence and will thus release anything. 10381 * It could mean we exceed the PMTU and chop off some that 10382 * we could have included.. but this is unlikely (aka 1432/4 10383 * would mean 300+ stream seq's would have to be reported in 10384 * one FWD-TSN. With a bit of work we can later FIX this to 10385 * optimize and pull out duplcates.. but it does add more 10386 * overhead. So for now... not! 10387 */ 10388 at = TAILQ_FIRST(&asoc->sent_queue); 10389 for (i = 0; i < cnt_of_skipped; i++) { 10390 tp1 = TAILQ_NEXT(at, sctp_next); 10391 if (tp1 == NULL) 10392 break; 10393 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 10394 /* We don't report these */ 10395 i--; 10396 at = tp1; 10397 continue; 10398 } 10399 if (at->rec.data.TSN_seq == advance_peer_ack_point) { 10400 at->rec.data.fwd_tsn_cnt = 0; 10401 } 10402 strseq->stream = ntohs(at->rec.data.stream_number); 10403 strseq->sequence = ntohs(at->rec.data.stream_seq); 10404 strseq++; 10405 at = tp1; 10406 } 10407 } 10408 return; 10409} 10410 10411void 10412sctp_send_sack(struct sctp_tcb *stcb, int so_locked 10413#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10414 SCTP_UNUSED 10415#endif 10416) 10417{ 10418 /*- 10419 * Queue up a SACK or NR-SACK in the control queue. 10420 * We must first check to see if a SACK or NR-SACK is 10421 * somehow on the control queue. 10422 * If so, we will take and and remove the old one. 10423 */ 10424 struct sctp_association *asoc; 10425 struct sctp_tmit_chunk *chk, *a_chk; 10426 struct sctp_sack_chunk *sack; 10427 struct sctp_nr_sack_chunk *nr_sack; 10428 struct sctp_gap_ack_block *gap_descriptor; 10429 struct sack_track *selector; 10430 int mergeable = 0; 10431 int offset; 10432 caddr_t limit; 10433 uint32_t *dup; 10434 int limit_reached = 0; 10435 unsigned int i, siz, j; 10436 unsigned int num_gap_blocks = 0, num_nr_gap_blocks = 0, space; 10437 int num_dups = 0; 10438 int space_req; 10439 uint32_t highest_tsn; 10440 uint8_t flags; 10441 uint8_t type; 10442 uint8_t tsn_map; 10443 10444 if ((stcb->asoc.sctp_nr_sack_on_off == 1) && 10445 (stcb->asoc.peer_supports_nr_sack == 1)) { 10446 type = SCTP_NR_SELECTIVE_ACK; 10447 } else { 10448 type = SCTP_SELECTIVE_ACK; 10449 } 10450 a_chk = NULL; 10451 asoc = &stcb->asoc; 10452 SCTP_TCB_LOCK_ASSERT(stcb); 10453 if (asoc->last_data_chunk_from == NULL) { 10454 /* Hmm we never received anything */ 10455 return; 10456 } 10457 sctp_slide_mapping_arrays(stcb); 10458 sctp_set_rwnd(stcb, asoc); 10459 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10460 if (chk->rec.chunk_id.id == type) { 10461 /* Hmm, found a sack already on queue, remove it */ 10462 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 10463 asoc->ctrl_queue_cnt--; 10464 a_chk = chk; 10465 if (a_chk->data) { 10466 sctp_m_freem(a_chk->data); 10467 a_chk->data = NULL; 10468 } 10469 if (a_chk->whoTo) { 10470 sctp_free_remote_addr(a_chk->whoTo); 10471 a_chk->whoTo = NULL; 10472 } 10473 break; 10474 } 10475 } 10476 if (a_chk == NULL) { 10477 sctp_alloc_a_chunk(stcb, a_chk); 10478 if (a_chk == NULL) { 10479 /* No memory so we drop the idea, and set a timer */ 10480 if (stcb->asoc.delayed_ack) { 10481 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10482 stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5); 10483 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10484 stcb->sctp_ep, stcb, NULL); 10485 } else { 10486 stcb->asoc.send_sack = 1; 10487 } 10488 return; 10489 } 10490 a_chk->copy_by_ref = 0; 10491 a_chk->rec.chunk_id.id = type; 10492 a_chk->rec.chunk_id.can_take_data = 1; 10493 } 10494 /* Clear our pkt counts */ 10495 asoc->data_pkts_seen = 0; 10496 10497 a_chk->asoc = asoc; 10498 a_chk->snd_count = 0; 10499 a_chk->send_size = 0; /* fill in later */ 10500 a_chk->sent = SCTP_DATAGRAM_UNSENT; 10501 a_chk->whoTo = NULL; 10502 10503 if ((asoc->numduptsns) || 10504 (!(asoc->last_data_chunk_from->dest_state & SCTP_ADDR_REACHABLE))) { 10505 /*- 10506 * Ok, we have some duplicates or the destination for the 10507 * sack is unreachable, lets see if we can select an 10508 * alternate than asoc->last_data_chunk_from 10509 */ 10510 if ((asoc->last_data_chunk_from->dest_state & SCTP_ADDR_REACHABLE) && 10511 (asoc->used_alt_onsack > asoc->numnets)) { 10512 /* We used an alt last time, don't this time */ 10513 a_chk->whoTo = NULL; 10514 } else { 10515 asoc->used_alt_onsack++; 10516 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0); 10517 } 10518 if (a_chk->whoTo == NULL) { 10519 /* Nope, no alternate */ 10520 a_chk->whoTo = asoc->last_data_chunk_from; 10521 asoc->used_alt_onsack = 0; 10522 } 10523 } else { 10524 /* 10525 * No duplicates so we use the last place we received data 10526 * from. 10527 */ 10528 asoc->used_alt_onsack = 0; 10529 a_chk->whoTo = asoc->last_data_chunk_from; 10530 } 10531 if (a_chk->whoTo) { 10532 atomic_add_int(&a_chk->whoTo->ref_count, 1); 10533 } 10534 if (SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->highest_tsn_inside_nr_map)) { 10535 highest_tsn = asoc->highest_tsn_inside_map; 10536 } else { 10537 highest_tsn = asoc->highest_tsn_inside_nr_map; 10538 } 10539 if (highest_tsn == asoc->cumulative_tsn) { 10540 /* no gaps */ 10541 if (type == SCTP_SELECTIVE_ACK) { 10542 space_req = sizeof(struct sctp_sack_chunk); 10543 } else { 10544 space_req = sizeof(struct sctp_nr_sack_chunk); 10545 } 10546 } else { 10547 /* gaps get a cluster */ 10548 space_req = MCLBYTES; 10549 } 10550 /* Ok now lets formulate a MBUF with our sack */ 10551 a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_DONTWAIT, 1, MT_DATA); 10552 if ((a_chk->data == NULL) || 10553 (a_chk->whoTo == NULL)) { 10554 /* rats, no mbuf memory */ 10555 if (a_chk->data) { 10556 /* was a problem with the destination */ 10557 sctp_m_freem(a_chk->data); 10558 a_chk->data = NULL; 10559 } 10560 sctp_free_a_chunk(stcb, a_chk, so_locked); 10561 /* sa_ignore NO_NULL_CHK */ 10562 if (stcb->asoc.delayed_ack) { 10563 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10564 stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_6); 10565 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10566 stcb->sctp_ep, stcb, NULL); 10567 } else { 10568 stcb->asoc.send_sack = 1; 10569 } 10570 return; 10571 } 10572 /* ok, lets go through and fill it in */ 10573 SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD); 10574 space = M_TRAILINGSPACE(a_chk->data); 10575 if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) { 10576 space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD); 10577 } 10578 limit = mtod(a_chk->data, caddr_t); 10579 limit += space; 10580 10581 flags = 0; 10582 10583 if ((asoc->sctp_cmt_on_off > 0) && 10584 SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) { 10585 /*- 10586 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been 10587 * received, then set high bit to 1, else 0. Reset 10588 * pkts_rcvd. 10589 */ 10590 flags |= (asoc->cmt_dac_pkts_rcvd << 6); 10591 asoc->cmt_dac_pkts_rcvd = 0; 10592 } 10593#ifdef SCTP_ASOCLOG_OF_TSNS 10594 stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn; 10595 stcb->asoc.cumack_log_atsnt++; 10596 if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) { 10597 stcb->asoc.cumack_log_atsnt = 0; 10598 } 10599#endif 10600 /* reset the readers interpretation */ 10601 stcb->freed_by_sorcv_sincelast = 0; 10602 10603 if (type == SCTP_SELECTIVE_ACK) { 10604 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 10605 nr_sack = NULL; 10606 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk)); 10607 if (highest_tsn > asoc->mapping_array_base_tsn) { 10608 siz = (((highest_tsn - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10609 } else { 10610 siz = (((MAX_TSN - highest_tsn) + 1) + highest_tsn + 7) / 8; 10611 } 10612 } else { 10613 sack = NULL; 10614 nr_sack = mtod(a_chk->data, struct sctp_nr_sack_chunk *); 10615 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)nr_sack + sizeof(struct sctp_nr_sack_chunk)); 10616 if (asoc->highest_tsn_inside_map > asoc->mapping_array_base_tsn) { 10617 siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10618 } else { 10619 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_map + 7) / 8; 10620 } 10621 } 10622 10623 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10624 offset = 1; 10625 } else { 10626 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10627 } 10628 if (((type == SCTP_SELECTIVE_ACK) && 10629 SCTP_TSN_GT(highest_tsn, asoc->cumulative_tsn)) || 10630 ((type == SCTP_NR_SELECTIVE_ACK) && 10631 SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->cumulative_tsn))) { 10632 /* we have a gap .. maybe */ 10633 for (i = 0; i < siz; i++) { 10634 tsn_map = asoc->mapping_array[i]; 10635 if (type == SCTP_SELECTIVE_ACK) { 10636 tsn_map |= asoc->nr_mapping_array[i]; 10637 } 10638 if (i == 0) { 10639 /* 10640 * Clear all bits corresponding to TSNs 10641 * smaller or equal to the cumulative TSN. 10642 */ 10643 tsn_map &= (~0 << (1 - offset)); 10644 } 10645 selector = &sack_array[tsn_map]; 10646 if (mergeable && selector->right_edge) { 10647 /* 10648 * Backup, left and right edges were ok to 10649 * merge. 10650 */ 10651 num_gap_blocks--; 10652 gap_descriptor--; 10653 } 10654 if (selector->num_entries == 0) 10655 mergeable = 0; 10656 else { 10657 for (j = 0; j < selector->num_entries; j++) { 10658 if (mergeable && selector->right_edge) { 10659 /* 10660 * do a merge by NOT setting 10661 * the left side 10662 */ 10663 mergeable = 0; 10664 } else { 10665 /* 10666 * no merge, set the left 10667 * side 10668 */ 10669 mergeable = 0; 10670 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10671 } 10672 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10673 num_gap_blocks++; 10674 gap_descriptor++; 10675 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10676 /* no more room */ 10677 limit_reached = 1; 10678 break; 10679 } 10680 } 10681 if (selector->left_edge) { 10682 mergeable = 1; 10683 } 10684 } 10685 if (limit_reached) { 10686 /* Reached the limit stop */ 10687 break; 10688 } 10689 offset += 8; 10690 } 10691 } 10692 if ((type == SCTP_NR_SELECTIVE_ACK) && 10693 (limit_reached == 0)) { 10694 10695 mergeable = 0; 10696 10697 if (asoc->highest_tsn_inside_nr_map > asoc->mapping_array_base_tsn) { 10698 siz = (((asoc->highest_tsn_inside_nr_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10699 } else { 10700 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_nr_map + 7) / 8; 10701 } 10702 10703 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10704 offset = 1; 10705 } else { 10706 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10707 } 10708 if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->cumulative_tsn)) { 10709 /* we have a gap .. maybe */ 10710 for (i = 0; i < siz; i++) { 10711 tsn_map = asoc->nr_mapping_array[i]; 10712 if (i == 0) { 10713 /* 10714 * Clear all bits corresponding to 10715 * TSNs smaller or equal to the 10716 * cumulative TSN. 10717 */ 10718 tsn_map &= (~0 << (1 - offset)); 10719 } 10720 selector = &sack_array[tsn_map]; 10721 if (mergeable && selector->right_edge) { 10722 /* 10723 * Backup, left and right edges were 10724 * ok to merge. 10725 */ 10726 num_nr_gap_blocks--; 10727 gap_descriptor--; 10728 } 10729 if (selector->num_entries == 0) 10730 mergeable = 0; 10731 else { 10732 for (j = 0; j < selector->num_entries; j++) { 10733 if (mergeable && selector->right_edge) { 10734 /* 10735 * do a merge by NOT 10736 * setting the left 10737 * side 10738 */ 10739 mergeable = 0; 10740 } else { 10741 /* 10742 * no merge, set the 10743 * left side 10744 */ 10745 mergeable = 0; 10746 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10747 } 10748 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10749 num_nr_gap_blocks++; 10750 gap_descriptor++; 10751 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10752 /* no more room */ 10753 limit_reached = 1; 10754 break; 10755 } 10756 } 10757 if (selector->left_edge) { 10758 mergeable = 1; 10759 } 10760 } 10761 if (limit_reached) { 10762 /* Reached the limit stop */ 10763 break; 10764 } 10765 offset += 8; 10766 } 10767 } 10768 } 10769 /* now we must add any dups we are going to report. */ 10770 if ((limit_reached == 0) && (asoc->numduptsns)) { 10771 dup = (uint32_t *) gap_descriptor; 10772 for (i = 0; i < asoc->numduptsns; i++) { 10773 *dup = htonl(asoc->dup_tsns[i]); 10774 dup++; 10775 num_dups++; 10776 if (((caddr_t)dup + sizeof(uint32_t)) > limit) { 10777 /* no more room */ 10778 break; 10779 } 10780 } 10781 asoc->numduptsns = 0; 10782 } 10783 /* 10784 * now that the chunk is prepared queue it to the control chunk 10785 * queue. 10786 */ 10787 if (type == SCTP_SELECTIVE_ACK) { 10788 a_chk->send_size = sizeof(struct sctp_sack_chunk) + 10789 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10790 num_dups * sizeof(int32_t); 10791 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10792 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10793 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 10794 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 10795 sack->sack.num_dup_tsns = htons(num_dups); 10796 sack->ch.chunk_type = type; 10797 sack->ch.chunk_flags = flags; 10798 sack->ch.chunk_length = htons(a_chk->send_size); 10799 } else { 10800 a_chk->send_size = sizeof(struct sctp_nr_sack_chunk) + 10801 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10802 num_dups * sizeof(int32_t); 10803 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10804 nr_sack->nr_sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10805 nr_sack->nr_sack.a_rwnd = htonl(asoc->my_rwnd); 10806 nr_sack->nr_sack.num_gap_ack_blks = htons(num_gap_blocks); 10807 nr_sack->nr_sack.num_nr_gap_ack_blks = htons(num_nr_gap_blocks); 10808 nr_sack->nr_sack.num_dup_tsns = htons(num_dups); 10809 nr_sack->nr_sack.reserved = 0; 10810 nr_sack->ch.chunk_type = type; 10811 nr_sack->ch.chunk_flags = flags; 10812 nr_sack->ch.chunk_length = htons(a_chk->send_size); 10813 } 10814 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 10815 asoc->my_last_reported_rwnd = asoc->my_rwnd; 10816 asoc->ctrl_queue_cnt++; 10817 asoc->send_sack = 0; 10818 SCTP_STAT_INCR(sctps_sendsacks); 10819 return; 10820} 10821 10822void 10823sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr, int so_locked 10824#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10825 SCTP_UNUSED 10826#endif 10827) 10828{ 10829 struct mbuf *m_abort, *m, *m_last; 10830 struct mbuf *m_out, *m_end = NULL; 10831 struct sctp_abort_chunk *abort; 10832 struct sctp_auth_chunk *auth = NULL; 10833 struct sctp_nets *net; 10834 uint32_t vtag; 10835 uint32_t auth_offset = 0; 10836 uint16_t cause_len, chunk_len, padding_len; 10837 10838 SCTP_TCB_LOCK_ASSERT(stcb); 10839 /*- 10840 * Add an AUTH chunk, if chunk requires it and save the offset into 10841 * the chain for AUTH 10842 */ 10843 if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION, 10844 stcb->asoc.peer_auth_chunks)) { 10845 m_out = sctp_add_auth_chunk(NULL, &m_end, &auth, &auth_offset, 10846 stcb, SCTP_ABORT_ASSOCIATION); 10847 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10848 } else { 10849 m_out = NULL; 10850 } 10851 m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_DONTWAIT, 1, MT_HEADER); 10852 if (m_abort == NULL) { 10853 if (m_out) { 10854 sctp_m_freem(m_out); 10855 } 10856 if (operr) { 10857 sctp_m_freem(operr); 10858 } 10859 return; 10860 } 10861 /* link in any error */ 10862 SCTP_BUF_NEXT(m_abort) = operr; 10863 cause_len = 0; 10864 m_last = NULL; 10865 for (m = operr; m; m = SCTP_BUF_NEXT(m)) { 10866 cause_len += (uint16_t) SCTP_BUF_LEN(m); 10867 if (SCTP_BUF_NEXT(m) == NULL) { 10868 m_last = m; 10869 } 10870 } 10871 SCTP_BUF_LEN(m_abort) = sizeof(struct sctp_abort_chunk); 10872 chunk_len = (uint16_t) sizeof(struct sctp_abort_chunk) + cause_len; 10873 padding_len = SCTP_SIZE32(chunk_len) - chunk_len; 10874 if (m_out == NULL) { 10875 /* NO Auth chunk prepended, so reserve space in front */ 10876 SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD); 10877 m_out = m_abort; 10878 } else { 10879 /* Put AUTH chunk at the front of the chain */ 10880 SCTP_BUF_NEXT(m_end) = m_abort; 10881 } 10882 if (stcb->asoc.alternate) { 10883 net = stcb->asoc.alternate; 10884 } else { 10885 net = stcb->asoc.primary_destination; 10886 } 10887 /* Fill in the ABORT chunk header. */ 10888 abort = mtod(m_abort, struct sctp_abort_chunk *); 10889 abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION; 10890 if (stcb->asoc.peer_vtag == 0) { 10891 /* This happens iff the assoc is in COOKIE-WAIT state. */ 10892 vtag = stcb->asoc.my_vtag; 10893 abort->ch.chunk_flags = SCTP_HAD_NO_TCB; 10894 } else { 10895 vtag = stcb->asoc.peer_vtag; 10896 abort->ch.chunk_flags = 0; 10897 } 10898 abort->ch.chunk_length = htons(chunk_len); 10899 /* Add padding, if necessary. */ 10900 if (padding_len > 0) { 10901 if ((m_last == NULL) || sctp_add_pad_tombuf(m_last, padding_len)) { 10902 sctp_m_freem(m_out); 10903 return; 10904 } 10905 } 10906 (void)sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10907 (struct sockaddr *)&net->ro._l_addr, 10908 m_out, auth_offset, auth, stcb->asoc.authinfo.active_keyid, 1, 0, 0, 10909 stcb->sctp_ep->sctp_lport, stcb->rport, htonl(vtag), 10910 stcb->asoc.primary_destination->port, NULL, 10911 0, 0, 10912 so_locked); 10913 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10914} 10915 10916void 10917sctp_send_shutdown_complete(struct sctp_tcb *stcb, 10918 struct sctp_nets *net, 10919 int reflect_vtag) 10920{ 10921 /* formulate and SEND a SHUTDOWN-COMPLETE */ 10922 struct mbuf *m_shutdown_comp; 10923 struct sctp_shutdown_complete_chunk *shutdown_complete; 10924 uint32_t vtag; 10925 uint8_t flags; 10926 10927 m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_DONTWAIT, 1, MT_HEADER); 10928 if (m_shutdown_comp == NULL) { 10929 /* no mbuf's */ 10930 return; 10931 } 10932 if (reflect_vtag) { 10933 flags = SCTP_HAD_NO_TCB; 10934 vtag = stcb->asoc.my_vtag; 10935 } else { 10936 flags = 0; 10937 vtag = stcb->asoc.peer_vtag; 10938 } 10939 shutdown_complete = mtod(m_shutdown_comp, struct sctp_shutdown_complete_chunk *); 10940 shutdown_complete->ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 10941 shutdown_complete->ch.chunk_flags = flags; 10942 shutdown_complete->ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 10943 SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_chunk); 10944 (void)sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10945 (struct sockaddr *)&net->ro._l_addr, 10946 m_shutdown_comp, 0, NULL, 0, 1, 0, 0, 10947 stcb->sctp_ep->sctp_lport, stcb->rport, 10948 htonl(vtag), 10949 net->port, NULL, 10950 0, 0, 10951 SCTP_SO_NOT_LOCKED); 10952 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10953 return; 10954} 10955 10956static void 10957sctp_send_resp_msg(struct sockaddr *src, struct sockaddr *dst, 10958 struct sctphdr *sh, uint32_t vtag, 10959 uint8_t type, struct mbuf *cause, 10960 uint8_t use_mflowid, uint32_t mflowid, 10961 uint32_t vrf_id, uint16_t port) 10962{ 10963 struct mbuf *o_pak; 10964 struct mbuf *mout; 10965 struct sctphdr *shout; 10966 struct sctp_chunkhdr *ch; 10967 struct udphdr *udp; 10968 int len, cause_len, padding_len; 10969 10970#if defined(INET) || defined(INET6) 10971 int ret; 10972 10973#endif 10974#ifdef INET 10975 struct sockaddr_in *src_sin, *dst_sin; 10976 struct ip *ip; 10977 10978#endif 10979#ifdef INET6 10980 struct sockaddr_in6 *src_sin6, *dst_sin6; 10981 struct ip6_hdr *ip6; 10982 10983#endif 10984 10985 /* Compute the length of the cause and add final padding. */ 10986 cause_len = 0; 10987 if (cause != NULL) { 10988 struct mbuf *m_at, *m_last = NULL; 10989 10990 for (m_at = cause; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 10991 if (SCTP_BUF_NEXT(m_at) == NULL) 10992 m_last = m_at; 10993 cause_len += SCTP_BUF_LEN(m_at); 10994 } 10995 padding_len = cause_len % 4; 10996 if (padding_len != 0) { 10997 padding_len = 4 - padding_len; 10998 } 10999 if (padding_len != 0) { 11000 if (sctp_add_pad_tombuf(m_last, padding_len)) { 11001 sctp_m_freem(cause); 11002 return; 11003 } 11004 } 11005 } else { 11006 padding_len = 0; 11007 } 11008 /* Get an mbuf for the header. */ 11009 len = sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 11010 switch (dst->sa_family) { 11011#ifdef INET 11012 case AF_INET: 11013 len += sizeof(struct ip); 11014 break; 11015#endif 11016#ifdef INET6 11017 case AF_INET6: 11018 len += sizeof(struct ip6_hdr); 11019 break; 11020#endif 11021 default: 11022 break; 11023 } 11024 if (port) { 11025 len += sizeof(struct udphdr); 11026 } 11027 mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_DONTWAIT, 1, MT_DATA); 11028 if (mout == NULL) { 11029 if (cause) { 11030 sctp_m_freem(cause); 11031 } 11032 return; 11033 } 11034 SCTP_BUF_RESV_UF(mout, max_linkhdr); 11035 SCTP_BUF_LEN(mout) = len; 11036 SCTP_BUF_NEXT(mout) = cause; 11037 if (use_mflowid != 0) { 11038 mout->m_pkthdr.flowid = mflowid; 11039 mout->m_flags |= M_FLOWID; 11040 } 11041#ifdef INET 11042 ip = NULL; 11043#endif 11044#ifdef INET6 11045 ip6 = NULL; 11046#endif 11047 switch (dst->sa_family) { 11048#ifdef INET 11049 case AF_INET: 11050 src_sin = (struct sockaddr_in *)src; 11051 dst_sin = (struct sockaddr_in *)dst; 11052 ip = mtod(mout, struct ip *); 11053 ip->ip_v = IPVERSION; 11054 ip->ip_hl = (sizeof(struct ip) >> 2); 11055 ip->ip_tos = 0; 11056 ip->ip_id = ip_newid(); 11057 ip->ip_off = 0; 11058 ip->ip_ttl = MODULE_GLOBAL(ip_defttl); 11059 if (port) { 11060 ip->ip_p = IPPROTO_UDP; 11061 } else { 11062 ip->ip_p = IPPROTO_SCTP; 11063 } 11064 ip->ip_src.s_addr = dst_sin->sin_addr.s_addr; 11065 ip->ip_dst.s_addr = src_sin->sin_addr.s_addr; 11066 ip->ip_sum = 0; 11067 len = sizeof(struct ip); 11068 shout = (struct sctphdr *)((caddr_t)ip + len); 11069 break; 11070#endif 11071#ifdef INET6 11072 case AF_INET6: 11073 src_sin6 = (struct sockaddr_in6 *)src; 11074 dst_sin6 = (struct sockaddr_in6 *)dst; 11075 ip6 = mtod(mout, struct ip6_hdr *); 11076 ip6->ip6_flow = htonl(0x60000000); 11077 if (V_ip6_auto_flowlabel) { 11078 ip6->ip6_flow |= (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK); 11079 } 11080 ip6->ip6_hlim = MODULE_GLOBAL(ip6_defhlim); 11081 if (port) { 11082 ip6->ip6_nxt = IPPROTO_UDP; 11083 } else { 11084 ip6->ip6_nxt = IPPROTO_SCTP; 11085 } 11086 ip6->ip6_src = dst_sin6->sin6_addr; 11087 ip6->ip6_dst = src_sin6->sin6_addr; 11088 len = sizeof(struct ip6_hdr); 11089 shout = (struct sctphdr *)((caddr_t)ip6 + len); 11090 break; 11091#endif 11092 default: 11093 len = 0; 11094 shout = mtod(mout, struct sctphdr *); 11095 break; 11096 } 11097 if (port) { 11098 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 11099 sctp_m_freem(mout); 11100 return; 11101 } 11102 udp = (struct udphdr *)shout; 11103 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 11104 udp->uh_dport = port; 11105 udp->uh_sum = 0; 11106 udp->uh_ulen = htons(sizeof(struct udphdr) + 11107 sizeof(struct sctphdr) + 11108 sizeof(struct sctp_chunkhdr) + 11109 cause_len + padding_len); 11110 len += sizeof(struct udphdr); 11111 shout = (struct sctphdr *)((caddr_t)shout + sizeof(struct udphdr)); 11112 } else { 11113 udp = NULL; 11114 } 11115 shout->src_port = sh->dest_port; 11116 shout->dest_port = sh->src_port; 11117 shout->checksum = 0; 11118 if (vtag) { 11119 shout->v_tag = htonl(vtag); 11120 } else { 11121 shout->v_tag = sh->v_tag; 11122 } 11123 len += sizeof(struct sctphdr); 11124 ch = (struct sctp_chunkhdr *)((caddr_t)shout + sizeof(struct sctphdr)); 11125 ch->chunk_type = type; 11126 if (vtag) { 11127 ch->chunk_flags = 0; 11128 } else { 11129 ch->chunk_flags = SCTP_HAD_NO_TCB; 11130 } 11131 ch->chunk_length = htons(sizeof(struct sctp_chunkhdr) + cause_len); 11132 len += sizeof(struct sctp_chunkhdr); 11133 len += cause_len + padding_len; 11134 11135 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 11136 sctp_m_freem(mout); 11137 return; 11138 } 11139 SCTP_ATTACH_CHAIN(o_pak, mout, len); 11140 switch (dst->sa_family) { 11141#ifdef INET 11142 case AF_INET: 11143 if (port) { 11144 if (V_udp_cksum) { 11145 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 11146 } else { 11147 udp->uh_sum = 0; 11148 } 11149 } 11150 ip->ip_len = len; 11151 if (port) { 11152#if defined(SCTP_WITH_NO_CSUM) 11153 SCTP_STAT_INCR(sctps_sendnocrc); 11154#else 11155 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip) + sizeof(struct udphdr)); 11156 SCTP_STAT_INCR(sctps_sendswcrc); 11157#endif 11158 if (V_udp_cksum) { 11159 SCTP_ENABLE_UDP_CSUM(o_pak); 11160 } 11161 } else { 11162#if defined(SCTP_WITH_NO_CSUM) 11163 SCTP_STAT_INCR(sctps_sendnocrc); 11164#else 11165 mout->m_pkthdr.csum_flags = CSUM_SCTP; 11166 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11167 SCTP_STAT_INCR(sctps_sendhwcrc); 11168#endif 11169 } 11170#ifdef SCTP_PACKET_LOGGING 11171 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11172 sctp_packet_log(o_pak); 11173 } 11174#endif 11175 SCTP_IP_OUTPUT(ret, o_pak, NULL, NULL, vrf_id); 11176 break; 11177#endif 11178#ifdef INET6 11179 case AF_INET6: 11180 ip6->ip6_plen = len - sizeof(struct ip6_hdr); 11181 if (port) { 11182#if defined(SCTP_WITH_NO_CSUM) 11183 SCTP_STAT_INCR(sctps_sendnocrc); 11184#else 11185 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 11186 SCTP_STAT_INCR(sctps_sendswcrc); 11187#endif 11188 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), len - sizeof(struct ip6_hdr))) == 0) { 11189 udp->uh_sum = 0xffff; 11190 } 11191 } else { 11192#if defined(SCTP_WITH_NO_CSUM) 11193 SCTP_STAT_INCR(sctps_sendnocrc); 11194#else 11195 mout->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 11196 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11197 SCTP_STAT_INCR(sctps_sendhwcrc); 11198#endif 11199 } 11200#ifdef SCTP_PACKET_LOGGING 11201 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11202 sctp_packet_log(o_pak); 11203 } 11204#endif 11205 SCTP_IP6_OUTPUT(ret, o_pak, NULL, NULL, NULL, vrf_id); 11206 break; 11207#endif 11208 default: 11209 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 11210 dst->sa_family); 11211 sctp_m_freem(mout); 11212 SCTP_LTRACE_ERR_RET_PKT(mout, NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 11213 return; 11214 } 11215 SCTP_STAT_INCR(sctps_sendpackets); 11216 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 11217 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11218 return; 11219} 11220 11221void 11222sctp_send_shutdown_complete2(struct sockaddr *src, struct sockaddr *dst, 11223 struct sctphdr *sh, 11224 uint8_t use_mflowid, uint32_t mflowid, 11225 uint32_t vrf_id, uint16_t port) 11226{ 11227 sctp_send_resp_msg(src, dst, sh, 0, SCTP_SHUTDOWN_COMPLETE, NULL, 11228 use_mflowid, mflowid, 11229 vrf_id, port); 11230} 11231 11232void 11233sctp_send_hb(struct sctp_tcb *stcb, struct sctp_nets *net, int so_locked 11234#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 11235 SCTP_UNUSED 11236#endif 11237) 11238{ 11239 struct sctp_tmit_chunk *chk; 11240 struct sctp_heartbeat_chunk *hb; 11241 struct timeval now; 11242 11243 SCTP_TCB_LOCK_ASSERT(stcb); 11244 if (net == NULL) { 11245 return; 11246 } 11247 (void)SCTP_GETTIME_TIMEVAL(&now); 11248 switch (net->ro._l_addr.sa.sa_family) { 11249#ifdef INET 11250 case AF_INET: 11251 break; 11252#endif 11253#ifdef INET6 11254 case AF_INET6: 11255 break; 11256#endif 11257 default: 11258 return; 11259 } 11260 sctp_alloc_a_chunk(stcb, chk); 11261 if (chk == NULL) { 11262 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak, can't get a chunk for hb\n"); 11263 return; 11264 } 11265 chk->copy_by_ref = 0; 11266 chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST; 11267 chk->rec.chunk_id.can_take_data = 1; 11268 chk->asoc = &stcb->asoc; 11269 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 11270 11271 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER); 11272 if (chk->data == NULL) { 11273 sctp_free_a_chunk(stcb, chk, so_locked); 11274 return; 11275 } 11276 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11277 SCTP_BUF_LEN(chk->data) = chk->send_size; 11278 chk->sent = SCTP_DATAGRAM_UNSENT; 11279 chk->snd_count = 0; 11280 chk->whoTo = net; 11281 atomic_add_int(&chk->whoTo->ref_count, 1); 11282 /* Now we have a mbuf that we can fill in with the details */ 11283 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 11284 memset(hb, 0, sizeof(struct sctp_heartbeat_chunk)); 11285 /* fill out chunk header */ 11286 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 11287 hb->ch.chunk_flags = 0; 11288 hb->ch.chunk_length = htons(chk->send_size); 11289 /* Fill out hb parameter */ 11290 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 11291 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 11292 hb->heartbeat.hb_info.time_value_1 = now.tv_sec; 11293 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 11294 /* Did our user request this one, put it in */ 11295 hb->heartbeat.hb_info.addr_family = net->ro._l_addr.sa.sa_family; 11296 hb->heartbeat.hb_info.addr_len = net->ro._l_addr.sa.sa_len; 11297 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 11298 /* 11299 * we only take from the entropy pool if the address is not 11300 * confirmed. 11301 */ 11302 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11303 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11304 } else { 11305 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 11306 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 11307 } 11308 switch (net->ro._l_addr.sa.sa_family) { 11309#ifdef INET 11310 case AF_INET: 11311 memcpy(hb->heartbeat.hb_info.address, 11312 &net->ro._l_addr.sin.sin_addr, 11313 sizeof(net->ro._l_addr.sin.sin_addr)); 11314 break; 11315#endif 11316#ifdef INET6 11317 case AF_INET6: 11318 memcpy(hb->heartbeat.hb_info.address, 11319 &net->ro._l_addr.sin6.sin6_addr, 11320 sizeof(net->ro._l_addr.sin6.sin6_addr)); 11321 break; 11322#endif 11323 default: 11324 return; 11325 break; 11326 } 11327 net->hb_responded = 0; 11328 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11329 stcb->asoc.ctrl_queue_cnt++; 11330 SCTP_STAT_INCR(sctps_sendheartbeat); 11331 return; 11332} 11333 11334void 11335sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 11336 uint32_t high_tsn) 11337{ 11338 struct sctp_association *asoc; 11339 struct sctp_ecne_chunk *ecne; 11340 struct sctp_tmit_chunk *chk; 11341 11342 if (net == NULL) { 11343 return; 11344 } 11345 asoc = &stcb->asoc; 11346 SCTP_TCB_LOCK_ASSERT(stcb); 11347 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11348 if ((chk->rec.chunk_id.id == SCTP_ECN_ECHO) && (net == chk->whoTo)) { 11349 /* found a previous ECN_ECHO update it if needed */ 11350 uint32_t cnt, ctsn; 11351 11352 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11353 ctsn = ntohl(ecne->tsn); 11354 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11355 ecne->tsn = htonl(high_tsn); 11356 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11357 } 11358 cnt = ntohl(ecne->num_pkts_since_cwr); 11359 cnt++; 11360 ecne->num_pkts_since_cwr = htonl(cnt); 11361 return; 11362 } 11363 } 11364 /* nope could not find one to update so we must build one */ 11365 sctp_alloc_a_chunk(stcb, chk); 11366 if (chk == NULL) { 11367 return; 11368 } 11369 chk->copy_by_ref = 0; 11370 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11371 chk->rec.chunk_id.id = SCTP_ECN_ECHO; 11372 chk->rec.chunk_id.can_take_data = 0; 11373 chk->asoc = &stcb->asoc; 11374 chk->send_size = sizeof(struct sctp_ecne_chunk); 11375 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER); 11376 if (chk->data == NULL) { 11377 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11378 return; 11379 } 11380 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11381 SCTP_BUF_LEN(chk->data) = chk->send_size; 11382 chk->sent = SCTP_DATAGRAM_UNSENT; 11383 chk->snd_count = 0; 11384 chk->whoTo = net; 11385 atomic_add_int(&chk->whoTo->ref_count, 1); 11386 11387 stcb->asoc.ecn_echo_cnt_onq++; 11388 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11389 ecne->ch.chunk_type = SCTP_ECN_ECHO; 11390 ecne->ch.chunk_flags = 0; 11391 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 11392 ecne->tsn = htonl(high_tsn); 11393 ecne->num_pkts_since_cwr = htonl(1); 11394 TAILQ_INSERT_HEAD(&stcb->asoc.control_send_queue, chk, sctp_next); 11395 asoc->ctrl_queue_cnt++; 11396} 11397 11398void 11399sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 11400 struct mbuf *m, int len, int iphlen, int bad_crc) 11401{ 11402 struct sctp_association *asoc; 11403 struct sctp_pktdrop_chunk *drp; 11404 struct sctp_tmit_chunk *chk; 11405 uint8_t *datap; 11406 int was_trunc = 0; 11407 int fullsz = 0; 11408 long spc; 11409 int offset; 11410 struct sctp_chunkhdr *ch, chunk_buf; 11411 unsigned int chk_length; 11412 11413 if (!stcb) { 11414 return; 11415 } 11416 asoc = &stcb->asoc; 11417 SCTP_TCB_LOCK_ASSERT(stcb); 11418 if (asoc->peer_supports_pktdrop == 0) { 11419 /*- 11420 * peer must declare support before I send one. 11421 */ 11422 return; 11423 } 11424 if (stcb->sctp_socket == NULL) { 11425 return; 11426 } 11427 sctp_alloc_a_chunk(stcb, chk); 11428 if (chk == NULL) { 11429 return; 11430 } 11431 chk->copy_by_ref = 0; 11432 len -= iphlen; 11433 chk->send_size = len; 11434 /* Validate that we do not have an ABORT in here. */ 11435 offset = iphlen + sizeof(struct sctphdr); 11436 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11437 sizeof(*ch), (uint8_t *) & chunk_buf); 11438 while (ch != NULL) { 11439 chk_length = ntohs(ch->chunk_length); 11440 if (chk_length < sizeof(*ch)) { 11441 /* break to abort land */ 11442 break; 11443 } 11444 switch (ch->chunk_type) { 11445 case SCTP_PACKET_DROPPED: 11446 case SCTP_ABORT_ASSOCIATION: 11447 case SCTP_INITIATION_ACK: 11448 /** 11449 * We don't respond with an PKT-DROP to an ABORT 11450 * or PKT-DROP. We also do not respond to an 11451 * INIT-ACK, because we can't know if the initiation 11452 * tag is correct or not. 11453 */ 11454 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11455 return; 11456 default: 11457 break; 11458 } 11459 offset += SCTP_SIZE32(chk_length); 11460 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11461 sizeof(*ch), (uint8_t *) & chunk_buf); 11462 } 11463 11464 if ((len + SCTP_MAX_OVERHEAD + sizeof(struct sctp_pktdrop_chunk)) > 11465 min(stcb->asoc.smallest_mtu, MCLBYTES)) { 11466 /* 11467 * only send 1 mtu worth, trim off the excess on the end. 11468 */ 11469 fullsz = len; 11470 len = min(stcb->asoc.smallest_mtu, MCLBYTES) - SCTP_MAX_OVERHEAD; 11471 was_trunc = 1; 11472 } 11473 chk->asoc = &stcb->asoc; 11474 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 11475 if (chk->data == NULL) { 11476jump_out: 11477 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11478 return; 11479 } 11480 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11481 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 11482 if (drp == NULL) { 11483 sctp_m_freem(chk->data); 11484 chk->data = NULL; 11485 goto jump_out; 11486 } 11487 chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 11488 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD)); 11489 chk->book_size_scale = 0; 11490 if (was_trunc) { 11491 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 11492 drp->trunc_len = htons(fullsz); 11493 /* 11494 * Len is already adjusted to size minus overhead above take 11495 * out the pkt_drop chunk itself from it. 11496 */ 11497 chk->send_size = len - sizeof(struct sctp_pktdrop_chunk); 11498 len = chk->send_size; 11499 } else { 11500 /* no truncation needed */ 11501 drp->ch.chunk_flags = 0; 11502 drp->trunc_len = htons(0); 11503 } 11504 if (bad_crc) { 11505 drp->ch.chunk_flags |= SCTP_BADCRC; 11506 } 11507 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 11508 SCTP_BUF_LEN(chk->data) = chk->send_size; 11509 chk->sent = SCTP_DATAGRAM_UNSENT; 11510 chk->snd_count = 0; 11511 if (net) { 11512 /* we should hit here */ 11513 chk->whoTo = net; 11514 atomic_add_int(&chk->whoTo->ref_count, 1); 11515 } else { 11516 chk->whoTo = NULL; 11517 } 11518 chk->rec.chunk_id.id = SCTP_PACKET_DROPPED; 11519 chk->rec.chunk_id.can_take_data = 1; 11520 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 11521 drp->ch.chunk_length = htons(chk->send_size); 11522 spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket); 11523 if (spc < 0) { 11524 spc = 0; 11525 } 11526 drp->bottle_bw = htonl(spc); 11527 if (asoc->my_rwnd) { 11528 drp->current_onq = htonl(asoc->size_on_reasm_queue + 11529 asoc->size_on_all_streams + 11530 asoc->my_rwnd_control_len + 11531 stcb->sctp_socket->so_rcv.sb_cc); 11532 } else { 11533 /*- 11534 * If my rwnd is 0, possibly from mbuf depletion as well as 11535 * space used, tell the peer there is NO space aka onq == bw 11536 */ 11537 drp->current_onq = htonl(spc); 11538 } 11539 drp->reserved = 0; 11540 datap = drp->data; 11541 m_copydata(m, iphlen, len, (caddr_t)datap); 11542 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11543 asoc->ctrl_queue_cnt++; 11544} 11545 11546void 11547sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn, uint8_t override) 11548{ 11549 struct sctp_association *asoc; 11550 struct sctp_cwr_chunk *cwr; 11551 struct sctp_tmit_chunk *chk; 11552 11553 SCTP_TCB_LOCK_ASSERT(stcb); 11554 if (net == NULL) { 11555 return; 11556 } 11557 asoc = &stcb->asoc; 11558 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11559 if ((chk->rec.chunk_id.id == SCTP_ECN_CWR) && (net == chk->whoTo)) { 11560 /* 11561 * found a previous CWR queued to same destination 11562 * update it if needed 11563 */ 11564 uint32_t ctsn; 11565 11566 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11567 ctsn = ntohl(cwr->tsn); 11568 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11569 cwr->tsn = htonl(high_tsn); 11570 } 11571 if (override & SCTP_CWR_REDUCE_OVERRIDE) { 11572 /* Make sure override is carried */ 11573 cwr->ch.chunk_flags |= SCTP_CWR_REDUCE_OVERRIDE; 11574 } 11575 return; 11576 } 11577 } 11578 sctp_alloc_a_chunk(stcb, chk); 11579 if (chk == NULL) { 11580 return; 11581 } 11582 chk->copy_by_ref = 0; 11583 chk->rec.chunk_id.id = SCTP_ECN_CWR; 11584 chk->rec.chunk_id.can_take_data = 1; 11585 chk->asoc = &stcb->asoc; 11586 chk->send_size = sizeof(struct sctp_cwr_chunk); 11587 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER); 11588 if (chk->data == NULL) { 11589 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11590 return; 11591 } 11592 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11593 SCTP_BUF_LEN(chk->data) = chk->send_size; 11594 chk->sent = SCTP_DATAGRAM_UNSENT; 11595 chk->snd_count = 0; 11596 chk->whoTo = net; 11597 atomic_add_int(&chk->whoTo->ref_count, 1); 11598 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11599 cwr->ch.chunk_type = SCTP_ECN_CWR; 11600 cwr->ch.chunk_flags = override; 11601 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 11602 cwr->tsn = htonl(high_tsn); 11603 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11604 asoc->ctrl_queue_cnt++; 11605} 11606 11607void 11608sctp_add_stream_reset_out(struct sctp_tmit_chunk *chk, 11609 int number_entries, uint16_t * list, 11610 uint32_t seq, uint32_t resp_seq, uint32_t last_sent) 11611{ 11612 uint16_t len, old_len, i; 11613 struct sctp_stream_reset_out_request *req_out; 11614 struct sctp_chunkhdr *ch; 11615 11616 ch = mtod(chk->data, struct sctp_chunkhdr *); 11617 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11618 11619 /* get to new offset for the param. */ 11620 req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len); 11621 /* now how long will this param be? */ 11622 len = (sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries)); 11623 req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST); 11624 req_out->ph.param_length = htons(len); 11625 req_out->request_seq = htonl(seq); 11626 req_out->response_seq = htonl(resp_seq); 11627 req_out->send_reset_at_tsn = htonl(last_sent); 11628 if (number_entries) { 11629 for (i = 0; i < number_entries; i++) { 11630 req_out->list_of_streams[i] = htons(list[i]); 11631 } 11632 } 11633 if (SCTP_SIZE32(len) > len) { 11634 /*- 11635 * Need to worry about the pad we may end up adding to the 11636 * end. This is easy since the struct is either aligned to 4 11637 * bytes or 2 bytes off. 11638 */ 11639 req_out->list_of_streams[number_entries] = 0; 11640 } 11641 /* now fix the chunk length */ 11642 ch->chunk_length = htons(len + old_len); 11643 chk->book_size = len + old_len; 11644 chk->book_size_scale = 0; 11645 chk->send_size = SCTP_SIZE32(chk->book_size); 11646 SCTP_BUF_LEN(chk->data) = chk->send_size; 11647 return; 11648} 11649 11650static void 11651sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk, 11652 int number_entries, uint16_t * list, 11653 uint32_t seq) 11654{ 11655 uint16_t len, old_len, i; 11656 struct sctp_stream_reset_in_request *req_in; 11657 struct sctp_chunkhdr *ch; 11658 11659 ch = mtod(chk->data, struct sctp_chunkhdr *); 11660 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11661 11662 /* get to new offset for the param. */ 11663 req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len); 11664 /* now how long will this param be? */ 11665 len = (sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries)); 11666 req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST); 11667 req_in->ph.param_length = htons(len); 11668 req_in->request_seq = htonl(seq); 11669 if (number_entries) { 11670 for (i = 0; i < number_entries; i++) { 11671 req_in->list_of_streams[i] = htons(list[i]); 11672 } 11673 } 11674 if (SCTP_SIZE32(len) > len) { 11675 /*- 11676 * Need to worry about the pad we may end up adding to the 11677 * end. This is easy since the struct is either aligned to 4 11678 * bytes or 2 bytes off. 11679 */ 11680 req_in->list_of_streams[number_entries] = 0; 11681 } 11682 /* now fix the chunk length */ 11683 ch->chunk_length = htons(len + old_len); 11684 chk->book_size = len + old_len; 11685 chk->book_size_scale = 0; 11686 chk->send_size = SCTP_SIZE32(chk->book_size); 11687 SCTP_BUF_LEN(chk->data) = chk->send_size; 11688 return; 11689} 11690 11691static void 11692sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk, 11693 uint32_t seq) 11694{ 11695 uint16_t len, old_len; 11696 struct sctp_stream_reset_tsn_request *req_tsn; 11697 struct sctp_chunkhdr *ch; 11698 11699 ch = mtod(chk->data, struct sctp_chunkhdr *); 11700 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11701 11702 /* get to new offset for the param. */ 11703 req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len); 11704 /* now how long will this param be? */ 11705 len = sizeof(struct sctp_stream_reset_tsn_request); 11706 req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST); 11707 req_tsn->ph.param_length = htons(len); 11708 req_tsn->request_seq = htonl(seq); 11709 11710 /* now fix the chunk length */ 11711 ch->chunk_length = htons(len + old_len); 11712 chk->send_size = len + old_len; 11713 chk->book_size = SCTP_SIZE32(chk->send_size); 11714 chk->book_size_scale = 0; 11715 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11716 return; 11717} 11718 11719void 11720sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk, 11721 uint32_t resp_seq, uint32_t result) 11722{ 11723 uint16_t len, old_len; 11724 struct sctp_stream_reset_response *resp; 11725 struct sctp_chunkhdr *ch; 11726 11727 ch = mtod(chk->data, struct sctp_chunkhdr *); 11728 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11729 11730 /* get to new offset for the param. */ 11731 resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len); 11732 /* now how long will this param be? */ 11733 len = sizeof(struct sctp_stream_reset_response); 11734 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11735 resp->ph.param_length = htons(len); 11736 resp->response_seq = htonl(resp_seq); 11737 resp->result = ntohl(result); 11738 11739 /* now fix the chunk length */ 11740 ch->chunk_length = htons(len + old_len); 11741 chk->book_size = len + old_len; 11742 chk->book_size_scale = 0; 11743 chk->send_size = SCTP_SIZE32(chk->book_size); 11744 SCTP_BUF_LEN(chk->data) = chk->send_size; 11745 return; 11746} 11747 11748void 11749sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk, 11750 uint32_t resp_seq, uint32_t result, 11751 uint32_t send_una, uint32_t recv_next) 11752{ 11753 uint16_t len, old_len; 11754 struct sctp_stream_reset_response_tsn *resp; 11755 struct sctp_chunkhdr *ch; 11756 11757 ch = mtod(chk->data, struct sctp_chunkhdr *); 11758 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11759 11760 /* get to new offset for the param. */ 11761 resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len); 11762 /* now how long will this param be? */ 11763 len = sizeof(struct sctp_stream_reset_response_tsn); 11764 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11765 resp->ph.param_length = htons(len); 11766 resp->response_seq = htonl(resp_seq); 11767 resp->result = htonl(result); 11768 resp->senders_next_tsn = htonl(send_una); 11769 resp->receivers_next_tsn = htonl(recv_next); 11770 11771 /* now fix the chunk length */ 11772 ch->chunk_length = htons(len + old_len); 11773 chk->book_size = len + old_len; 11774 chk->send_size = SCTP_SIZE32(chk->book_size); 11775 chk->book_size_scale = 0; 11776 SCTP_BUF_LEN(chk->data) = chk->send_size; 11777 return; 11778} 11779 11780static void 11781sctp_add_an_out_stream(struct sctp_tmit_chunk *chk, 11782 uint32_t seq, 11783 uint16_t adding) 11784{ 11785 uint16_t len, old_len; 11786 struct sctp_chunkhdr *ch; 11787 struct sctp_stream_reset_add_strm *addstr; 11788 11789 ch = mtod(chk->data, struct sctp_chunkhdr *); 11790 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11791 11792 /* get to new offset for the param. */ 11793 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11794 /* now how long will this param be? */ 11795 len = sizeof(struct sctp_stream_reset_add_strm); 11796 11797 /* Fill it out. */ 11798 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_OUT_STREAMS); 11799 addstr->ph.param_length = htons(len); 11800 addstr->request_seq = htonl(seq); 11801 addstr->number_of_streams = htons(adding); 11802 addstr->reserved = 0; 11803 11804 /* now fix the chunk length */ 11805 ch->chunk_length = htons(len + old_len); 11806 chk->send_size = len + old_len; 11807 chk->book_size = SCTP_SIZE32(chk->send_size); 11808 chk->book_size_scale = 0; 11809 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11810 return; 11811} 11812 11813static void 11814sctp_add_an_in_stream(struct sctp_tmit_chunk *chk, 11815 uint32_t seq, 11816 uint16_t adding) 11817{ 11818 uint16_t len, old_len; 11819 struct sctp_chunkhdr *ch; 11820 struct sctp_stream_reset_add_strm *addstr; 11821 11822 ch = mtod(chk->data, struct sctp_chunkhdr *); 11823 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11824 11825 /* get to new offset for the param. */ 11826 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11827 /* now how long will this param be? */ 11828 len = sizeof(struct sctp_stream_reset_add_strm); 11829 /* Fill it out. */ 11830 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_IN_STREAMS); 11831 addstr->ph.param_length = htons(len); 11832 addstr->request_seq = htonl(seq); 11833 addstr->number_of_streams = htons(adding); 11834 addstr->reserved = 0; 11835 11836 /* now fix the chunk length */ 11837 ch->chunk_length = htons(len + old_len); 11838 chk->send_size = len + old_len; 11839 chk->book_size = SCTP_SIZE32(chk->send_size); 11840 chk->book_size_scale = 0; 11841 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11842 return; 11843} 11844 11845int 11846sctp_send_str_reset_req(struct sctp_tcb *stcb, 11847 int number_entries, uint16_t * list, 11848 uint8_t send_out_req, 11849 uint8_t send_in_req, 11850 uint8_t send_tsn_req, 11851 uint8_t add_stream, 11852 uint16_t adding_o, 11853 uint16_t adding_i, uint8_t peer_asked) 11854{ 11855 11856 struct sctp_association *asoc; 11857 struct sctp_tmit_chunk *chk; 11858 struct sctp_chunkhdr *ch; 11859 uint32_t seq; 11860 11861 asoc = &stcb->asoc; 11862 if (asoc->stream_reset_outstanding) { 11863 /*- 11864 * Already one pending, must get ACK back to clear the flag. 11865 */ 11866 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EBUSY); 11867 return (EBUSY); 11868 } 11869 if ((send_out_req == 0) && (send_in_req == 0) && (send_tsn_req == 0) && 11870 (add_stream == 0)) { 11871 /* nothing to do */ 11872 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 11873 return (EINVAL); 11874 } 11875 if (send_tsn_req && (send_out_req || send_in_req)) { 11876 /* error, can't do that */ 11877 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 11878 return (EINVAL); 11879 } 11880 sctp_alloc_a_chunk(stcb, chk); 11881 if (chk == NULL) { 11882 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11883 return (ENOMEM); 11884 } 11885 chk->copy_by_ref = 0; 11886 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 11887 chk->rec.chunk_id.can_take_data = 0; 11888 chk->asoc = &stcb->asoc; 11889 chk->book_size = sizeof(struct sctp_chunkhdr); 11890 chk->send_size = SCTP_SIZE32(chk->book_size); 11891 chk->book_size_scale = 0; 11892 11893 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); 11894 if (chk->data == NULL) { 11895 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 11896 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11897 return (ENOMEM); 11898 } 11899 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11900 11901 /* setup chunk parameters */ 11902 chk->sent = SCTP_DATAGRAM_UNSENT; 11903 chk->snd_count = 0; 11904 if (stcb->asoc.alternate) { 11905 chk->whoTo = stcb->asoc.alternate; 11906 } else { 11907 chk->whoTo = stcb->asoc.primary_destination; 11908 } 11909 atomic_add_int(&chk->whoTo->ref_count, 1); 11910 ch = mtod(chk->data, struct sctp_chunkhdr *); 11911 ch->chunk_type = SCTP_STREAM_RESET; 11912 ch->chunk_flags = 0; 11913 ch->chunk_length = htons(chk->book_size); 11914 SCTP_BUF_LEN(chk->data) = chk->send_size; 11915 11916 seq = stcb->asoc.str_reset_seq_out; 11917 if (send_out_req) { 11918 sctp_add_stream_reset_out(chk, number_entries, list, 11919 seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1)); 11920 asoc->stream_reset_out_is_outstanding = 1; 11921 seq++; 11922 asoc->stream_reset_outstanding++; 11923 } 11924 if ((add_stream & 1) && 11925 ((stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt) < adding_o)) { 11926 /* Need to allocate more */ 11927 struct sctp_stream_out *oldstream; 11928 struct sctp_stream_queue_pending *sp, *nsp; 11929 int i; 11930 11931 oldstream = stcb->asoc.strmout; 11932 /* get some more */ 11933 SCTP_MALLOC(stcb->asoc.strmout, struct sctp_stream_out *, 11934 ((stcb->asoc.streamoutcnt + adding_o) * sizeof(struct sctp_stream_out)), 11935 SCTP_M_STRMO); 11936 if (stcb->asoc.strmout == NULL) { 11937 uint8_t x; 11938 11939 stcb->asoc.strmout = oldstream; 11940 /* Turn off the bit */ 11941 x = add_stream & 0xfe; 11942 add_stream = x; 11943 goto skip_stuff; 11944 } 11945 /* 11946 * Ok now we proceed with copying the old out stuff and 11947 * initializing the new stuff. 11948 */ 11949 SCTP_TCB_SEND_LOCK(stcb); 11950 stcb->asoc.ss_functions.sctp_ss_clear(stcb, &stcb->asoc, 0, 1); 11951 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11952 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 11953 stcb->asoc.strmout[i].chunks_on_queues = oldstream[i].chunks_on_queues; 11954 stcb->asoc.strmout[i].next_sequence_send = oldstream[i].next_sequence_send; 11955 stcb->asoc.strmout[i].last_msg_incomplete = oldstream[i].last_msg_incomplete; 11956 stcb->asoc.strmout[i].stream_no = i; 11957 stcb->asoc.ss_functions.sctp_ss_init_stream(&stcb->asoc.strmout[i], &oldstream[i]); 11958 /* now anything on those queues? */ 11959 TAILQ_FOREACH_SAFE(sp, &oldstream[i].outqueue, next, nsp) { 11960 TAILQ_REMOVE(&oldstream[i].outqueue, sp, next); 11961 TAILQ_INSERT_TAIL(&stcb->asoc.strmout[i].outqueue, sp, next); 11962 } 11963 /* Now move assoc pointers too */ 11964 if (stcb->asoc.last_out_stream == &oldstream[i]) { 11965 stcb->asoc.last_out_stream = &stcb->asoc.strmout[i]; 11966 } 11967 if (stcb->asoc.locked_on_sending == &oldstream[i]) { 11968 stcb->asoc.locked_on_sending = &stcb->asoc.strmout[i]; 11969 } 11970 } 11971 /* now the new streams */ 11972 stcb->asoc.ss_functions.sctp_ss_init(stcb, &stcb->asoc, 1); 11973 for (i = stcb->asoc.streamoutcnt; i < (stcb->asoc.streamoutcnt + adding_o); i++) { 11974 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 11975 stcb->asoc.strmout[i].chunks_on_queues = 0; 11976 stcb->asoc.strmout[i].next_sequence_send = 0x0; 11977 stcb->asoc.strmout[i].stream_no = i; 11978 stcb->asoc.strmout[i].last_msg_incomplete = 0; 11979 stcb->asoc.ss_functions.sctp_ss_init_stream(&stcb->asoc.strmout[i], NULL); 11980 } 11981 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt + adding_o; 11982 SCTP_FREE(oldstream, SCTP_M_STRMO); 11983 SCTP_TCB_SEND_UNLOCK(stcb); 11984 } 11985skip_stuff: 11986 if ((add_stream & 1) && (adding_o > 0)) { 11987 asoc->strm_pending_add_size = adding_o; 11988 asoc->peer_req_out = peer_asked; 11989 sctp_add_an_out_stream(chk, seq, adding_o); 11990 seq++; 11991 asoc->stream_reset_outstanding++; 11992 } 11993 if ((add_stream & 2) && (adding_i > 0)) { 11994 sctp_add_an_in_stream(chk, seq, adding_i); 11995 seq++; 11996 asoc->stream_reset_outstanding++; 11997 } 11998 if (send_in_req) { 11999 sctp_add_stream_reset_in(chk, number_entries, list, seq); 12000 seq++; 12001 asoc->stream_reset_outstanding++; 12002 } 12003 if (send_tsn_req) { 12004 sctp_add_stream_reset_tsn(chk, seq); 12005 asoc->stream_reset_outstanding++; 12006 } 12007 asoc->str_reset = chk; 12008 /* insert the chunk for sending */ 12009 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12010 chk, 12011 sctp_next); 12012 asoc->ctrl_queue_cnt++; 12013 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12014 return (0); 12015} 12016 12017void 12018sctp_send_abort(struct mbuf *m, int iphlen, struct sockaddr *src, struct sockaddr *dst, 12019 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12020 uint8_t use_mflowid, uint32_t mflowid, 12021 uint32_t vrf_id, uint16_t port) 12022{ 12023 /* Don't respond to an ABORT with an ABORT. */ 12024 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 12025 if (cause) 12026 sctp_m_freem(cause); 12027 return; 12028 } 12029 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_ABORT_ASSOCIATION, cause, 12030 use_mflowid, mflowid, 12031 vrf_id, port); 12032 return; 12033} 12034 12035void 12036sctp_send_operr_to(struct sockaddr *src, struct sockaddr *dst, 12037 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12038 uint8_t use_mflowid, uint32_t mflowid, 12039 uint32_t vrf_id, uint16_t port) 12040{ 12041 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_OPERATION_ERROR, cause, 12042 use_mflowid, mflowid, 12043 vrf_id, port); 12044 return; 12045} 12046 12047static struct mbuf * 12048sctp_copy_resume(struct uio *uio, 12049 int max_send_len, 12050 int user_marks_eor, 12051 int *error, 12052 uint32_t * sndout, 12053 struct mbuf **new_tail) 12054{ 12055 struct mbuf *m; 12056 12057 m = m_uiotombuf(uio, M_WAITOK, max_send_len, 0, 12058 (M_PKTHDR | (user_marks_eor ? M_EOR : 0))); 12059 if (m == NULL) { 12060 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12061 *error = ENOMEM; 12062 } else { 12063 *sndout = m_length(m, NULL); 12064 *new_tail = m_last(m); 12065 } 12066 return (m); 12067} 12068 12069static int 12070sctp_copy_one(struct sctp_stream_queue_pending *sp, 12071 struct uio *uio, 12072 int resv_upfront) 12073{ 12074 int left; 12075 12076 left = sp->length; 12077 sp->data = m_uiotombuf(uio, M_WAITOK, sp->length, 12078 resv_upfront, 0); 12079 if (sp->data == NULL) { 12080 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12081 return (ENOMEM); 12082 } 12083 sp->tail_mbuf = m_last(sp->data); 12084 return (0); 12085} 12086 12087 12088 12089static struct sctp_stream_queue_pending * 12090sctp_copy_it_in(struct sctp_tcb *stcb, 12091 struct sctp_association *asoc, 12092 struct sctp_sndrcvinfo *srcv, 12093 struct uio *uio, 12094 struct sctp_nets *net, 12095 int max_send_len, 12096 int user_marks_eor, 12097 int *error) 12098{ 12099 /*- 12100 * This routine must be very careful in its work. Protocol 12101 * processing is up and running so care must be taken to spl...() 12102 * when you need to do something that may effect the stcb/asoc. The 12103 * sb is locked however. When data is copied the protocol processing 12104 * should be enabled since this is a slower operation... 12105 */ 12106 struct sctp_stream_queue_pending *sp = NULL; 12107 int resv_in_first; 12108 12109 *error = 0; 12110 /* Now can we send this? */ 12111 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 12112 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12113 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12114 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12115 /* got data while shutting down */ 12116 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12117 *error = ECONNRESET; 12118 goto out_now; 12119 } 12120 sctp_alloc_a_strmoq(stcb, sp); 12121 if (sp == NULL) { 12122 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12123 *error = ENOMEM; 12124 goto out_now; 12125 } 12126 sp->act_flags = 0; 12127 sp->sender_all_done = 0; 12128 sp->sinfo_flags = srcv->sinfo_flags; 12129 sp->timetolive = srcv->sinfo_timetolive; 12130 sp->ppid = srcv->sinfo_ppid; 12131 sp->context = srcv->sinfo_context; 12132 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 12133 12134 sp->stream = srcv->sinfo_stream; 12135 sp->length = min(uio->uio_resid, max_send_len); 12136 if ((sp->length == (uint32_t) uio->uio_resid) && 12137 ((user_marks_eor == 0) || 12138 (srcv->sinfo_flags & SCTP_EOF) || 12139 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 12140 sp->msg_is_complete = 1; 12141 } else { 12142 sp->msg_is_complete = 0; 12143 } 12144 sp->sender_all_done = 0; 12145 sp->some_taken = 0; 12146 sp->put_last_out = 0; 12147 resv_in_first = sizeof(struct sctp_data_chunk); 12148 sp->data = sp->tail_mbuf = NULL; 12149 if (sp->length == 0) { 12150 *error = 0; 12151 goto skip_copy; 12152 } 12153 if (srcv->sinfo_keynumber_valid) { 12154 sp->auth_keyid = srcv->sinfo_keynumber; 12155 } else { 12156 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 12157 } 12158 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 12159 sctp_auth_key_acquire(stcb, sp->auth_keyid); 12160 sp->holds_key_ref = 1; 12161 } 12162 *error = sctp_copy_one(sp, uio, resv_in_first); 12163skip_copy: 12164 if (*error) { 12165 sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); 12166 sp = NULL; 12167 } else { 12168 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 12169 sp->net = net; 12170 atomic_add_int(&sp->net->ref_count, 1); 12171 } else { 12172 sp->net = NULL; 12173 } 12174 sctp_set_prsctp_policy(sp); 12175 } 12176out_now: 12177 return (sp); 12178} 12179 12180 12181int 12182sctp_sosend(struct socket *so, 12183 struct sockaddr *addr, 12184 struct uio *uio, 12185 struct mbuf *top, 12186 struct mbuf *control, 12187 int flags, 12188 struct thread *p 12189) 12190{ 12191 int error, use_sndinfo = 0; 12192 struct sctp_sndrcvinfo sndrcvninfo; 12193 struct sockaddr *addr_to_use; 12194 12195#if defined(INET) && defined(INET6) 12196 struct sockaddr_in sin; 12197 12198#endif 12199 12200 if (control) { 12201 /* process cmsg snd/rcv info (maybe a assoc-id) */ 12202 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&sndrcvninfo, control, 12203 sizeof(sndrcvninfo))) { 12204 /* got one */ 12205 use_sndinfo = 1; 12206 } 12207 } 12208 addr_to_use = addr; 12209#if defined(INET) && defined(INET6) 12210 if ((addr) && (addr->sa_family == AF_INET6)) { 12211 struct sockaddr_in6 *sin6; 12212 12213 sin6 = (struct sockaddr_in6 *)addr; 12214 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 12215 in6_sin6_2_sin(&sin, sin6); 12216 addr_to_use = (struct sockaddr *)&sin; 12217 } 12218 } 12219#endif 12220 error = sctp_lower_sosend(so, addr_to_use, uio, top, 12221 control, 12222 flags, 12223 use_sndinfo ? &sndrcvninfo : NULL 12224 ,p 12225 ); 12226 return (error); 12227} 12228 12229 12230int 12231sctp_lower_sosend(struct socket *so, 12232 struct sockaddr *addr, 12233 struct uio *uio, 12234 struct mbuf *i_pak, 12235 struct mbuf *control, 12236 int flags, 12237 struct sctp_sndrcvinfo *srcv 12238 , 12239 struct thread *p 12240) 12241{ 12242 unsigned int sndlen = 0, max_len; 12243 int error, len; 12244 struct mbuf *top = NULL; 12245 int queue_only = 0, queue_only_for_init = 0; 12246 int free_cnt_applied = 0; 12247 int un_sent; 12248 int now_filled = 0; 12249 unsigned int inqueue_bytes = 0; 12250 struct sctp_block_entry be; 12251 struct sctp_inpcb *inp; 12252 struct sctp_tcb *stcb = NULL; 12253 struct timeval now; 12254 struct sctp_nets *net; 12255 struct sctp_association *asoc; 12256 struct sctp_inpcb *t_inp; 12257 int user_marks_eor; 12258 int create_lock_applied = 0; 12259 int nagle_applies = 0; 12260 int some_on_control = 0; 12261 int got_all_of_the_send = 0; 12262 int hold_tcblock = 0; 12263 int non_blocking = 0; 12264 uint32_t local_add_more, local_soresv = 0; 12265 uint16_t port; 12266 uint16_t sinfo_flags; 12267 sctp_assoc_t sinfo_assoc_id; 12268 12269 error = 0; 12270 net = NULL; 12271 stcb = NULL; 12272 asoc = NULL; 12273 12274 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 12275 if (inp == NULL) { 12276 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12277 error = EINVAL; 12278 if (i_pak) { 12279 SCTP_RELEASE_PKT(i_pak); 12280 } 12281 return (error); 12282 } 12283 if ((uio == NULL) && (i_pak == NULL)) { 12284 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12285 return (EINVAL); 12286 } 12287 user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 12288 atomic_add_int(&inp->total_sends, 1); 12289 if (uio) { 12290 if (uio->uio_resid < 0) { 12291 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12292 return (EINVAL); 12293 } 12294 sndlen = uio->uio_resid; 12295 } else { 12296 top = SCTP_HEADER_TO_CHAIN(i_pak); 12297 sndlen = SCTP_HEADER_LEN(i_pak); 12298 } 12299 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %d\n", 12300 (void *)addr, 12301 sndlen); 12302 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 12303 (inp->sctp_socket->so_qlimit)) { 12304 /* The listener can NOT send */ 12305 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12306 error = ENOTCONN; 12307 goto out_unlocked; 12308 } 12309 /** 12310 * Pre-screen address, if one is given the sin-len 12311 * must be set correctly! 12312 */ 12313 if (addr) { 12314 union sctp_sockstore *raddr = (union sctp_sockstore *)addr; 12315 12316 switch (raddr->sa.sa_family) { 12317#ifdef INET 12318 case AF_INET: 12319 if (raddr->sin.sin_len != sizeof(struct sockaddr_in)) { 12320 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12321 error = EINVAL; 12322 goto out_unlocked; 12323 } 12324 port = raddr->sin.sin_port; 12325 break; 12326#endif 12327#ifdef INET6 12328 case AF_INET6: 12329 if (raddr->sin6.sin6_len != sizeof(struct sockaddr_in6)) { 12330 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12331 error = EINVAL; 12332 goto out_unlocked; 12333 } 12334 port = raddr->sin6.sin6_port; 12335 break; 12336#endif 12337 default: 12338 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAFNOSUPPORT); 12339 error = EAFNOSUPPORT; 12340 goto out_unlocked; 12341 } 12342 } else 12343 port = 0; 12344 12345 if (srcv) { 12346 sinfo_flags = srcv->sinfo_flags; 12347 sinfo_assoc_id = srcv->sinfo_assoc_id; 12348 if (INVALID_SINFO_FLAG(sinfo_flags) || 12349 PR_SCTP_INVALID_POLICY(sinfo_flags)) { 12350 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12351 error = EINVAL; 12352 goto out_unlocked; 12353 } 12354 if (srcv->sinfo_flags) 12355 SCTP_STAT_INCR(sctps_sends_with_flags); 12356 } else { 12357 sinfo_flags = inp->def_send.sinfo_flags; 12358 sinfo_assoc_id = inp->def_send.sinfo_assoc_id; 12359 } 12360 if (sinfo_flags & SCTP_SENDALL) { 12361 /* its a sendall */ 12362 error = sctp_sendall(inp, uio, top, srcv); 12363 top = NULL; 12364 goto out_unlocked; 12365 } 12366 if ((sinfo_flags & SCTP_ADDR_OVER) && (addr == NULL)) { 12367 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12368 error = EINVAL; 12369 goto out_unlocked; 12370 } 12371 /* now we must find the assoc */ 12372 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) || 12373 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 12374 SCTP_INP_RLOCK(inp); 12375 stcb = LIST_FIRST(&inp->sctp_asoc_list); 12376 if (stcb) { 12377 SCTP_TCB_LOCK(stcb); 12378 hold_tcblock = 1; 12379 } 12380 SCTP_INP_RUNLOCK(inp); 12381 } else if (sinfo_assoc_id) { 12382 stcb = sctp_findassociation_ep_asocid(inp, sinfo_assoc_id, 0); 12383 } else if (addr) { 12384 /*- 12385 * Since we did not use findep we must 12386 * increment it, and if we don't find a tcb 12387 * decrement it. 12388 */ 12389 SCTP_INP_WLOCK(inp); 12390 SCTP_INP_INCR_REF(inp); 12391 SCTP_INP_WUNLOCK(inp); 12392 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12393 if (stcb == NULL) { 12394 SCTP_INP_WLOCK(inp); 12395 SCTP_INP_DECR_REF(inp); 12396 SCTP_INP_WUNLOCK(inp); 12397 } else { 12398 hold_tcblock = 1; 12399 } 12400 } 12401 if ((stcb == NULL) && (addr)) { 12402 /* Possible implicit send? */ 12403 SCTP_ASOC_CREATE_LOCK(inp); 12404 create_lock_applied = 1; 12405 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 12406 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 12407 /* Should I really unlock ? */ 12408 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12409 error = EINVAL; 12410 goto out_unlocked; 12411 12412 } 12413 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 12414 (addr->sa_family == AF_INET6)) { 12415 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12416 error = EINVAL; 12417 goto out_unlocked; 12418 } 12419 SCTP_INP_WLOCK(inp); 12420 SCTP_INP_INCR_REF(inp); 12421 SCTP_INP_WUNLOCK(inp); 12422 /* With the lock applied look again */ 12423 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12424 if ((stcb == NULL) && (control != NULL) && (port > 0)) { 12425 stcb = sctp_findassociation_cmsgs(&t_inp, port, control, &net, &error); 12426 } 12427 if (stcb == NULL) { 12428 SCTP_INP_WLOCK(inp); 12429 SCTP_INP_DECR_REF(inp); 12430 SCTP_INP_WUNLOCK(inp); 12431 } else { 12432 hold_tcblock = 1; 12433 } 12434 if (error) { 12435 goto out_unlocked; 12436 } 12437 if (t_inp != inp) { 12438 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12439 error = ENOTCONN; 12440 goto out_unlocked; 12441 } 12442 } 12443 if (stcb == NULL) { 12444 if (addr == NULL) { 12445 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12446 error = ENOENT; 12447 goto out_unlocked; 12448 } else { 12449 /* We must go ahead and start the INIT process */ 12450 uint32_t vrf_id; 12451 12452 if ((sinfo_flags & SCTP_ABORT) || 12453 ((sinfo_flags & SCTP_EOF) && (sndlen == 0))) { 12454 /*- 12455 * User asks to abort a non-existant assoc, 12456 * or EOF a non-existant assoc with no data 12457 */ 12458 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12459 error = ENOENT; 12460 goto out_unlocked; 12461 } 12462 /* get an asoc/stcb struct */ 12463 vrf_id = inp->def_vrf_id; 12464#ifdef INVARIANTS 12465 if (create_lock_applied == 0) { 12466 panic("Error, should hold create lock and I don't?"); 12467 } 12468#endif 12469 stcb = sctp_aloc_assoc(inp, addr, &error, 0, vrf_id, 12470 p 12471 ); 12472 if (stcb == NULL) { 12473 /* Error is setup for us in the call */ 12474 goto out_unlocked; 12475 } 12476 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 12477 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 12478 /* 12479 * Set the connected flag so we can queue 12480 * data 12481 */ 12482 soisconnecting(so); 12483 } 12484 hold_tcblock = 1; 12485 if (create_lock_applied) { 12486 SCTP_ASOC_CREATE_UNLOCK(inp); 12487 create_lock_applied = 0; 12488 } else { 12489 SCTP_PRINTF("Huh-3? create lock should have been on??\n"); 12490 } 12491 /* 12492 * Turn on queue only flag to prevent data from 12493 * being sent 12494 */ 12495 queue_only = 1; 12496 asoc = &stcb->asoc; 12497 SCTP_SET_STATE(asoc, SCTP_STATE_COOKIE_WAIT); 12498 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 12499 12500 /* initialize authentication params for the assoc */ 12501 sctp_initialize_auth_params(inp, stcb); 12502 12503 if (control) { 12504 if (sctp_process_cmsgs_for_init(stcb, control, &error)) { 12505 sctp_free_assoc(inp, stcb, SCTP_PCBFREE_FORCE, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_7); 12506 hold_tcblock = 0; 12507 stcb = NULL; 12508 goto out_unlocked; 12509 } 12510 } 12511 /* out with the INIT */ 12512 queue_only_for_init = 1; 12513 /*- 12514 * we may want to dig in after this call and adjust the MTU 12515 * value. It defaulted to 1500 (constant) but the ro 12516 * structure may now have an update and thus we may need to 12517 * change it BEFORE we append the message. 12518 */ 12519 } 12520 } else 12521 asoc = &stcb->asoc; 12522 if (srcv == NULL) 12523 srcv = (struct sctp_sndrcvinfo *)&asoc->def_send; 12524 if (srcv->sinfo_flags & SCTP_ADDR_OVER) { 12525 if (addr) 12526 net = sctp_findnet(stcb, addr); 12527 else 12528 net = NULL; 12529 if ((net == NULL) || 12530 ((port != 0) && (port != stcb->rport))) { 12531 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12532 error = EINVAL; 12533 goto out_unlocked; 12534 } 12535 } else { 12536 if (stcb->asoc.alternate) { 12537 net = stcb->asoc.alternate; 12538 } else { 12539 net = stcb->asoc.primary_destination; 12540 } 12541 } 12542 atomic_add_int(&stcb->total_sends, 1); 12543 /* Keep the stcb from being freed under our feet */ 12544 atomic_add_int(&asoc->refcnt, 1); 12545 free_cnt_applied = 1; 12546 12547 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NO_FRAGMENT)) { 12548 if (sndlen > asoc->smallest_mtu) { 12549 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12550 error = EMSGSIZE; 12551 goto out_unlocked; 12552 } 12553 } 12554 if (SCTP_SO_IS_NBIO(so) 12555 || (flags & MSG_NBIO) 12556 ) { 12557 non_blocking = 1; 12558 } 12559 /* would we block? */ 12560 if (non_blocking) { 12561 if (hold_tcblock == 0) { 12562 SCTP_TCB_LOCK(stcb); 12563 hold_tcblock = 1; 12564 } 12565 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12566 if ((SCTP_SB_LIMIT_SND(so) < (sndlen + inqueue_bytes + stcb->asoc.sb_send_resv)) || 12567 (stcb->asoc.chunks_on_out_queue >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12568 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EWOULDBLOCK); 12569 if (sndlen > SCTP_SB_LIMIT_SND(so)) 12570 error = EMSGSIZE; 12571 else 12572 error = EWOULDBLOCK; 12573 goto out_unlocked; 12574 } 12575 stcb->asoc.sb_send_resv += sndlen; 12576 SCTP_TCB_UNLOCK(stcb); 12577 hold_tcblock = 0; 12578 } else { 12579 atomic_add_int(&stcb->asoc.sb_send_resv, sndlen); 12580 } 12581 local_soresv = sndlen; 12582 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12583 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12584 error = ECONNRESET; 12585 goto out_unlocked; 12586 } 12587 if (create_lock_applied) { 12588 SCTP_ASOC_CREATE_UNLOCK(inp); 12589 create_lock_applied = 0; 12590 } 12591 if (asoc->stream_reset_outstanding) { 12592 /* 12593 * Can't queue any data while stream reset is underway. 12594 */ 12595 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAGAIN); 12596 error = EAGAIN; 12597 goto out_unlocked; 12598 } 12599 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 12600 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 12601 queue_only = 1; 12602 } 12603 /* we are now done with all control */ 12604 if (control) { 12605 sctp_m_freem(control); 12606 control = NULL; 12607 } 12608 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 12609 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12610 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12611 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12612 if (srcv->sinfo_flags & SCTP_ABORT) { 12613 ; 12614 } else { 12615 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12616 error = ECONNRESET; 12617 goto out_unlocked; 12618 } 12619 } 12620 /* Ok, we will attempt a msgsnd :> */ 12621 if (p) { 12622 p->td_ru.ru_msgsnd++; 12623 } 12624 /* Are we aborting? */ 12625 if (srcv->sinfo_flags & SCTP_ABORT) { 12626 struct mbuf *mm; 12627 int tot_demand, tot_out = 0, max_out; 12628 12629 SCTP_STAT_INCR(sctps_sends_with_abort); 12630 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 12631 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 12632 /* It has to be up before we abort */ 12633 /* how big is the user initiated abort? */ 12634 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12635 error = EINVAL; 12636 goto out; 12637 } 12638 if (hold_tcblock) { 12639 SCTP_TCB_UNLOCK(stcb); 12640 hold_tcblock = 0; 12641 } 12642 if (top) { 12643 struct mbuf *cntm = NULL; 12644 12645 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_WAIT, 1, MT_DATA); 12646 if (sndlen != 0) { 12647 for (cntm = top; cntm; cntm = SCTP_BUF_NEXT(cntm)) { 12648 tot_out += SCTP_BUF_LEN(cntm); 12649 } 12650 } 12651 } else { 12652 /* Must fit in a MTU */ 12653 tot_out = sndlen; 12654 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 12655 if (tot_demand > SCTP_DEFAULT_ADD_MORE) { 12656 /* To big */ 12657 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12658 error = EMSGSIZE; 12659 goto out; 12660 } 12661 mm = sctp_get_mbuf_for_msg(tot_demand, 0, M_WAIT, 1, MT_DATA); 12662 } 12663 if (mm == NULL) { 12664 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12665 error = ENOMEM; 12666 goto out; 12667 } 12668 max_out = asoc->smallest_mtu - sizeof(struct sctp_paramhdr); 12669 max_out -= sizeof(struct sctp_abort_msg); 12670 if (tot_out > max_out) { 12671 tot_out = max_out; 12672 } 12673 if (mm) { 12674 struct sctp_paramhdr *ph; 12675 12676 /* now move forward the data pointer */ 12677 ph = mtod(mm, struct sctp_paramhdr *); 12678 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 12679 ph->param_length = htons(sizeof(struct sctp_paramhdr) + tot_out); 12680 ph++; 12681 SCTP_BUF_LEN(mm) = tot_out + sizeof(struct sctp_paramhdr); 12682 if (top == NULL) { 12683 error = uiomove((caddr_t)ph, (int)tot_out, uio); 12684 if (error) { 12685 /*- 12686 * Here if we can't get his data we 12687 * still abort we just don't get to 12688 * send the users note :-0 12689 */ 12690 sctp_m_freem(mm); 12691 mm = NULL; 12692 } 12693 } else { 12694 if (sndlen != 0) { 12695 SCTP_BUF_NEXT(mm) = top; 12696 } 12697 } 12698 } 12699 if (hold_tcblock == 0) { 12700 SCTP_TCB_LOCK(stcb); 12701 } 12702 atomic_add_int(&stcb->asoc.refcnt, -1); 12703 free_cnt_applied = 0; 12704 /* release this lock, otherwise we hang on ourselves */ 12705 sctp_abort_an_association(stcb->sctp_ep, stcb, mm, SCTP_SO_LOCKED); 12706 /* now relock the stcb so everything is sane */ 12707 hold_tcblock = 0; 12708 stcb = NULL; 12709 /* 12710 * In this case top is already chained to mm avoid double 12711 * free, since we free it below if top != NULL and driver 12712 * would free it after sending the packet out 12713 */ 12714 if (sndlen != 0) { 12715 top = NULL; 12716 } 12717 goto out_unlocked; 12718 } 12719 /* Calculate the maximum we can send */ 12720 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12721 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 12722 if (non_blocking) { 12723 /* we already checked for non-blocking above. */ 12724 max_len = sndlen; 12725 } else { 12726 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 12727 } 12728 } else { 12729 max_len = 0; 12730 } 12731 if (hold_tcblock) { 12732 SCTP_TCB_UNLOCK(stcb); 12733 hold_tcblock = 0; 12734 } 12735 /* Is the stream no. valid? */ 12736 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 12737 /* Invalid stream number */ 12738 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12739 error = EINVAL; 12740 goto out_unlocked; 12741 } 12742 if (asoc->strmout == NULL) { 12743 /* huh? software error */ 12744 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 12745 error = EFAULT; 12746 goto out_unlocked; 12747 } 12748 /* Unless E_EOR mode is on, we must make a send FIT in one call. */ 12749 if ((user_marks_eor == 0) && 12750 (sndlen > SCTP_SB_LIMIT_SND(stcb->sctp_socket))) { 12751 /* It will NEVER fit */ 12752 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12753 error = EMSGSIZE; 12754 goto out_unlocked; 12755 } 12756 if ((uio == NULL) && user_marks_eor) { 12757 /*- 12758 * We do not support eeor mode for 12759 * sending with mbuf chains (like sendfile). 12760 */ 12761 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12762 error = EINVAL; 12763 goto out_unlocked; 12764 } 12765 if (user_marks_eor) { 12766 local_add_more = min(SCTP_SB_LIMIT_SND(so), SCTP_BASE_SYSCTL(sctp_add_more_threshold)); 12767 } else { 12768 /*- 12769 * For non-eeor the whole message must fit in 12770 * the socket send buffer. 12771 */ 12772 local_add_more = sndlen; 12773 } 12774 len = 0; 12775 if (non_blocking) { 12776 goto skip_preblock; 12777 } 12778 if (((max_len <= local_add_more) && 12779 (SCTP_SB_LIMIT_SND(so) >= local_add_more)) || 12780 (max_len == 0) || 12781 ((stcb->asoc.chunks_on_out_queue + stcb->asoc.stream_queue_cnt) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12782 /* No room right now ! */ 12783 SOCKBUF_LOCK(&so->so_snd); 12784 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12785 while ((SCTP_SB_LIMIT_SND(so) < (inqueue_bytes + local_add_more)) || 12786 ((stcb->asoc.stream_queue_cnt + stcb->asoc.chunks_on_out_queue) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12787 SCTPDBG(SCTP_DEBUG_OUTPUT1, "pre_block limit:%u <(inq:%d + %d) || (%d+%d > %d)\n", 12788 (unsigned int)SCTP_SB_LIMIT_SND(so), 12789 inqueue_bytes, 12790 local_add_more, 12791 stcb->asoc.stream_queue_cnt, 12792 stcb->asoc.chunks_on_out_queue, 12793 SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)); 12794 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 12795 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA, asoc, sndlen); 12796 } 12797 be.error = 0; 12798 stcb->block_entry = &be; 12799 error = sbwait(&so->so_snd); 12800 stcb->block_entry = NULL; 12801 if (error || so->so_error || be.error) { 12802 if (error == 0) { 12803 if (so->so_error) 12804 error = so->so_error; 12805 if (be.error) { 12806 error = be.error; 12807 } 12808 } 12809 SOCKBUF_UNLOCK(&so->so_snd); 12810 goto out_unlocked; 12811 } 12812 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 12813 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 12814 asoc, stcb->asoc.total_output_queue_size); 12815 } 12816 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12817 goto out_unlocked; 12818 } 12819 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12820 } 12821 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 12822 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 12823 } else { 12824 max_len = 0; 12825 } 12826 SOCKBUF_UNLOCK(&so->so_snd); 12827 } 12828skip_preblock: 12829 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12830 goto out_unlocked; 12831 } 12832 /* 12833 * sndlen covers for mbuf case uio_resid covers for the non-mbuf 12834 * case NOTE: uio will be null when top/mbuf is passed 12835 */ 12836 if (sndlen == 0) { 12837 if (srcv->sinfo_flags & SCTP_EOF) { 12838 got_all_of_the_send = 1; 12839 goto dataless_eof; 12840 } else { 12841 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12842 error = EINVAL; 12843 goto out; 12844 } 12845 } 12846 if (top == NULL) { 12847 struct sctp_stream_queue_pending *sp; 12848 struct sctp_stream_out *strm; 12849 uint32_t sndout; 12850 12851 SCTP_TCB_SEND_LOCK(stcb); 12852 if ((asoc->stream_locked) && 12853 (asoc->stream_locked_on != srcv->sinfo_stream)) { 12854 SCTP_TCB_SEND_UNLOCK(stcb); 12855 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12856 error = EINVAL; 12857 goto out; 12858 } 12859 SCTP_TCB_SEND_UNLOCK(stcb); 12860 12861 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 12862 if (strm->last_msg_incomplete == 0) { 12863 do_a_copy_in: 12864 sp = sctp_copy_it_in(stcb, asoc, srcv, uio, net, max_len, user_marks_eor, &error); 12865 if ((sp == NULL) || (error)) { 12866 goto out; 12867 } 12868 SCTP_TCB_SEND_LOCK(stcb); 12869 if (sp->msg_is_complete) { 12870 strm->last_msg_incomplete = 0; 12871 asoc->stream_locked = 0; 12872 } else { 12873 /* 12874 * Just got locked to this guy in case of an 12875 * interrupt. 12876 */ 12877 strm->last_msg_incomplete = 1; 12878 asoc->stream_locked = 1; 12879 asoc->stream_locked_on = srcv->sinfo_stream; 12880 sp->sender_all_done = 0; 12881 } 12882 sctp_snd_sb_alloc(stcb, sp->length); 12883 atomic_add_int(&asoc->stream_queue_cnt, 1); 12884 if (srcv->sinfo_flags & SCTP_UNORDERED) { 12885 SCTP_STAT_INCR(sctps_sends_with_unord); 12886 } 12887 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 12888 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, asoc, strm, sp, 1); 12889 SCTP_TCB_SEND_UNLOCK(stcb); 12890 } else { 12891 SCTP_TCB_SEND_LOCK(stcb); 12892 sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead); 12893 SCTP_TCB_SEND_UNLOCK(stcb); 12894 if (sp == NULL) { 12895 /* ???? Huh ??? last msg is gone */ 12896#ifdef INVARIANTS 12897 panic("Warning: Last msg marked incomplete, yet nothing left?"); 12898#else 12899 SCTP_PRINTF("Warning: Last msg marked incomplete, yet nothing left?\n"); 12900 strm->last_msg_incomplete = 0; 12901#endif 12902 goto do_a_copy_in; 12903 12904 } 12905 } 12906 while (uio->uio_resid > 0) { 12907 /* How much room do we have? */ 12908 struct mbuf *new_tail, *mm; 12909 12910 if (SCTP_SB_LIMIT_SND(so) > stcb->asoc.total_output_queue_size) 12911 max_len = SCTP_SB_LIMIT_SND(so) - stcb->asoc.total_output_queue_size; 12912 else 12913 max_len = 0; 12914 12915 if ((max_len > SCTP_BASE_SYSCTL(sctp_add_more_threshold)) || 12916 (max_len && (SCTP_SB_LIMIT_SND(so) < SCTP_BASE_SYSCTL(sctp_add_more_threshold))) || 12917 (uio->uio_resid && (uio->uio_resid <= (int)max_len))) { 12918 sndout = 0; 12919 new_tail = NULL; 12920 if (hold_tcblock) { 12921 SCTP_TCB_UNLOCK(stcb); 12922 hold_tcblock = 0; 12923 } 12924 mm = sctp_copy_resume(uio, max_len, user_marks_eor, &error, &sndout, &new_tail); 12925 if ((mm == NULL) || error) { 12926 if (mm) { 12927 sctp_m_freem(mm); 12928 } 12929 goto out; 12930 } 12931 /* Update the mbuf and count */ 12932 SCTP_TCB_SEND_LOCK(stcb); 12933 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12934 /* 12935 * we need to get out. Peer probably 12936 * aborted. 12937 */ 12938 sctp_m_freem(mm); 12939 if (stcb->asoc.state & SCTP_PCB_FLAGS_WAS_ABORTED) { 12940 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12941 error = ECONNRESET; 12942 } 12943 SCTP_TCB_SEND_UNLOCK(stcb); 12944 goto out; 12945 } 12946 if (sp->tail_mbuf) { 12947 /* tack it to the end */ 12948 SCTP_BUF_NEXT(sp->tail_mbuf) = mm; 12949 sp->tail_mbuf = new_tail; 12950 } else { 12951 /* A stolen mbuf */ 12952 sp->data = mm; 12953 sp->tail_mbuf = new_tail; 12954 } 12955 sctp_snd_sb_alloc(stcb, sndout); 12956 atomic_add_int(&sp->length, sndout); 12957 len += sndout; 12958 12959 /* Did we reach EOR? */ 12960 if ((uio->uio_resid == 0) && 12961 ((user_marks_eor == 0) || 12962 (srcv->sinfo_flags & SCTP_EOF) || 12963 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 12964 sp->msg_is_complete = 1; 12965 } else { 12966 sp->msg_is_complete = 0; 12967 } 12968 SCTP_TCB_SEND_UNLOCK(stcb); 12969 } 12970 if (uio->uio_resid == 0) { 12971 /* got it all? */ 12972 continue; 12973 } 12974 /* PR-SCTP? */ 12975 if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) { 12976 /* 12977 * This is ugly but we must assure locking 12978 * order 12979 */ 12980 if (hold_tcblock == 0) { 12981 SCTP_TCB_LOCK(stcb); 12982 hold_tcblock = 1; 12983 } 12984 sctp_prune_prsctp(stcb, asoc, srcv, sndlen); 12985 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12986 if (SCTP_SB_LIMIT_SND(so) > stcb->asoc.total_output_queue_size) 12987 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 12988 else 12989 max_len = 0; 12990 if (max_len > 0) { 12991 continue; 12992 } 12993 SCTP_TCB_UNLOCK(stcb); 12994 hold_tcblock = 0; 12995 } 12996 /* wait for space now */ 12997 if (non_blocking) { 12998 /* Non-blocking io in place out */ 12999 goto skip_out_eof; 13000 } 13001 /* What about the INIT, send it maybe */ 13002 if (queue_only_for_init) { 13003 if (hold_tcblock == 0) { 13004 SCTP_TCB_LOCK(stcb); 13005 hold_tcblock = 1; 13006 } 13007 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) { 13008 /* a collision took us forward? */ 13009 queue_only = 0; 13010 } else { 13011 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13012 SCTP_SET_STATE(asoc, SCTP_STATE_COOKIE_WAIT); 13013 queue_only = 1; 13014 } 13015 } 13016 if ((net->flight_size > net->cwnd) && 13017 (asoc->sctp_cmt_on_off == 0)) { 13018 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13019 queue_only = 1; 13020 } else if (asoc->ifp_had_enobuf) { 13021 SCTP_STAT_INCR(sctps_ifnomemqueued); 13022 if (net->flight_size > (2 * net->mtu)) { 13023 queue_only = 1; 13024 } 13025 asoc->ifp_had_enobuf = 0; 13026 } 13027 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 13028 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 13029 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13030 (stcb->asoc.total_flight > 0) && 13031 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13032 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13033 13034 /*- 13035 * Ok, Nagle is set on and we have data outstanding. 13036 * Don't send anything and let SACKs drive out the 13037 * data unless wen have a "full" segment to send. 13038 */ 13039 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13040 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13041 } 13042 SCTP_STAT_INCR(sctps_naglequeued); 13043 nagle_applies = 1; 13044 } else { 13045 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13046 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13047 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13048 } 13049 SCTP_STAT_INCR(sctps_naglesent); 13050 nagle_applies = 0; 13051 } 13052 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13053 13054 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13055 nagle_applies, un_sent); 13056 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13057 stcb->asoc.total_flight, 13058 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13059 } 13060 if (queue_only_for_init) 13061 queue_only_for_init = 0; 13062 if ((queue_only == 0) && (nagle_applies == 0)) { 13063 /*- 13064 * need to start chunk output 13065 * before blocking.. note that if 13066 * a lock is already applied, then 13067 * the input via the net is happening 13068 * and I don't need to start output :-D 13069 */ 13070 if (hold_tcblock == 0) { 13071 if (SCTP_TCB_TRYLOCK(stcb)) { 13072 hold_tcblock = 1; 13073 sctp_chunk_output(inp, 13074 stcb, 13075 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13076 } 13077 } else { 13078 sctp_chunk_output(inp, 13079 stcb, 13080 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13081 } 13082 if (hold_tcblock == 1) { 13083 SCTP_TCB_UNLOCK(stcb); 13084 hold_tcblock = 0; 13085 } 13086 } 13087 SOCKBUF_LOCK(&so->so_snd); 13088 /*- 13089 * This is a bit strange, but I think it will 13090 * work. The total_output_queue_size is locked and 13091 * protected by the TCB_LOCK, which we just released. 13092 * There is a race that can occur between releasing it 13093 * above, and me getting the socket lock, where sacks 13094 * come in but we have not put the SB_WAIT on the 13095 * so_snd buffer to get the wakeup. After the LOCK 13096 * is applied the sack_processing will also need to 13097 * LOCK the so->so_snd to do the actual sowwakeup(). So 13098 * once we have the socket buffer lock if we recheck the 13099 * size we KNOW we will get to sleep safely with the 13100 * wakeup flag in place. 13101 */ 13102 if (SCTP_SB_LIMIT_SND(so) <= (stcb->asoc.total_output_queue_size + 13103 min(SCTP_BASE_SYSCTL(sctp_add_more_threshold), SCTP_SB_LIMIT_SND(so)))) { 13104 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13105 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 13106 asoc, uio->uio_resid); 13107 } 13108 be.error = 0; 13109 stcb->block_entry = &be; 13110 error = sbwait(&so->so_snd); 13111 stcb->block_entry = NULL; 13112 13113 if (error || so->so_error || be.error) { 13114 if (error == 0) { 13115 if (so->so_error) 13116 error = so->so_error; 13117 if (be.error) { 13118 error = be.error; 13119 } 13120 } 13121 SOCKBUF_UNLOCK(&so->so_snd); 13122 goto out_unlocked; 13123 } 13124 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13125 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13126 asoc, stcb->asoc.total_output_queue_size); 13127 } 13128 } 13129 SOCKBUF_UNLOCK(&so->so_snd); 13130 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13131 goto out_unlocked; 13132 } 13133 } 13134 SCTP_TCB_SEND_LOCK(stcb); 13135 if (sp) { 13136 if (sp->msg_is_complete == 0) { 13137 strm->last_msg_incomplete = 1; 13138 asoc->stream_locked = 1; 13139 asoc->stream_locked_on = srcv->sinfo_stream; 13140 } else { 13141 sp->sender_all_done = 1; 13142 strm->last_msg_incomplete = 0; 13143 asoc->stream_locked = 0; 13144 } 13145 } else { 13146 SCTP_PRINTF("Huh no sp TSNH?\n"); 13147 strm->last_msg_incomplete = 0; 13148 asoc->stream_locked = 0; 13149 } 13150 SCTP_TCB_SEND_UNLOCK(stcb); 13151 if (uio->uio_resid == 0) { 13152 got_all_of_the_send = 1; 13153 } 13154 } else { 13155 /* We send in a 0, since we do NOT have any locks */ 13156 error = sctp_msg_append(stcb, net, top, srcv, 0); 13157 top = NULL; 13158 if (srcv->sinfo_flags & SCTP_EOF) { 13159 /* 13160 * This should only happen for Panda for the mbuf 13161 * send case, which does NOT yet support EEOR mode. 13162 * Thus, we can just set this flag to do the proper 13163 * EOF handling. 13164 */ 13165 got_all_of_the_send = 1; 13166 } 13167 } 13168 if (error) { 13169 goto out; 13170 } 13171dataless_eof: 13172 /* EOF thing ? */ 13173 if ((srcv->sinfo_flags & SCTP_EOF) && 13174 (got_all_of_the_send == 1)) { 13175 int cnt; 13176 13177 SCTP_STAT_INCR(sctps_sends_with_eof); 13178 error = 0; 13179 if (hold_tcblock == 0) { 13180 SCTP_TCB_LOCK(stcb); 13181 hold_tcblock = 1; 13182 } 13183 cnt = sctp_is_there_unsent_data(stcb, SCTP_SO_LOCKED); 13184 if (TAILQ_EMPTY(&asoc->send_queue) && 13185 TAILQ_EMPTY(&asoc->sent_queue) && 13186 (cnt == 0)) { 13187 if (asoc->locked_on_sending) { 13188 goto abort_anyway; 13189 } 13190 /* there is nothing queued to send, so I'm done... */ 13191 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 13192 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13193 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13194 struct sctp_nets *netp; 13195 13196 /* only send SHUTDOWN the first time through */ 13197 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 13198 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 13199 } 13200 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT); 13201 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING); 13202 sctp_stop_timers_for_shutdown(stcb); 13203 if (stcb->asoc.alternate) { 13204 netp = stcb->asoc.alternate; 13205 } else { 13206 netp = stcb->asoc.primary_destination; 13207 } 13208 sctp_send_shutdown(stcb, netp); 13209 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 13210 netp); 13211 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13212 asoc->primary_destination); 13213 } 13214 } else { 13215 /*- 13216 * we still got (or just got) data to send, so set 13217 * SHUTDOWN_PENDING 13218 */ 13219 /*- 13220 * XXX sockets draft says that SCTP_EOF should be 13221 * sent with no data. currently, we will allow user 13222 * data to be sent first and move to 13223 * SHUTDOWN-PENDING 13224 */ 13225 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 13226 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13227 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13228 if (hold_tcblock == 0) { 13229 SCTP_TCB_LOCK(stcb); 13230 hold_tcblock = 1; 13231 } 13232 if (asoc->locked_on_sending) { 13233 /* Locked to send out the data */ 13234 struct sctp_stream_queue_pending *sp; 13235 13236 sp = TAILQ_LAST(&asoc->locked_on_sending->outqueue, sctp_streamhead); 13237 if (sp) { 13238 if ((sp->length == 0) && (sp->msg_is_complete == 0)) 13239 asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT; 13240 } 13241 } 13242 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 13243 if (TAILQ_EMPTY(&asoc->send_queue) && 13244 TAILQ_EMPTY(&asoc->sent_queue) && 13245 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 13246 abort_anyway: 13247 if (free_cnt_applied) { 13248 atomic_add_int(&stcb->asoc.refcnt, -1); 13249 free_cnt_applied = 0; 13250 } 13251 sctp_abort_an_association(stcb->sctp_ep, stcb, 13252 NULL, SCTP_SO_LOCKED); 13253 /* 13254 * now relock the stcb so everything 13255 * is sane 13256 */ 13257 hold_tcblock = 0; 13258 stcb = NULL; 13259 goto out; 13260 } 13261 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13262 asoc->primary_destination); 13263 sctp_feature_off(inp, SCTP_PCB_FLAGS_NODELAY); 13264 } 13265 } 13266 } 13267skip_out_eof: 13268 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 13269 some_on_control = 1; 13270 } 13271 if (queue_only_for_init) { 13272 if (hold_tcblock == 0) { 13273 SCTP_TCB_LOCK(stcb); 13274 hold_tcblock = 1; 13275 } 13276 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) { 13277 /* a collision took us forward? */ 13278 queue_only = 0; 13279 } else { 13280 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13281 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_WAIT); 13282 queue_only = 1; 13283 } 13284 } 13285 if ((net->flight_size > net->cwnd) && 13286 (stcb->asoc.sctp_cmt_on_off == 0)) { 13287 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13288 queue_only = 1; 13289 } else if (asoc->ifp_had_enobuf) { 13290 SCTP_STAT_INCR(sctps_ifnomemqueued); 13291 if (net->flight_size > (2 * net->mtu)) { 13292 queue_only = 1; 13293 } 13294 asoc->ifp_had_enobuf = 0; 13295 } 13296 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 13297 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 13298 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13299 (stcb->asoc.total_flight > 0) && 13300 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13301 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13302 /*- 13303 * Ok, Nagle is set on and we have data outstanding. 13304 * Don't send anything and let SACKs drive out the 13305 * data unless wen have a "full" segment to send. 13306 */ 13307 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13308 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13309 } 13310 SCTP_STAT_INCR(sctps_naglequeued); 13311 nagle_applies = 1; 13312 } else { 13313 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13314 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13315 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13316 } 13317 SCTP_STAT_INCR(sctps_naglesent); 13318 nagle_applies = 0; 13319 } 13320 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13321 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13322 nagle_applies, un_sent); 13323 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13324 stcb->asoc.total_flight, 13325 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13326 } 13327 if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) { 13328 /* we can attempt to send too. */ 13329 if (hold_tcblock == 0) { 13330 /* 13331 * If there is activity recv'ing sacks no need to 13332 * send 13333 */ 13334 if (SCTP_TCB_TRYLOCK(stcb)) { 13335 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13336 hold_tcblock = 1; 13337 } 13338 } else { 13339 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13340 } 13341 } else if ((queue_only == 0) && 13342 (stcb->asoc.peers_rwnd == 0) && 13343 (stcb->asoc.total_flight == 0)) { 13344 /* We get to have a probe outstanding */ 13345 if (hold_tcblock == 0) { 13346 hold_tcblock = 1; 13347 SCTP_TCB_LOCK(stcb); 13348 } 13349 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13350 } else if (some_on_control) { 13351 int num_out, reason, frag_point; 13352 13353 /* Here we do control only */ 13354 if (hold_tcblock == 0) { 13355 hold_tcblock = 1; 13356 SCTP_TCB_LOCK(stcb); 13357 } 13358 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 13359 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 13360 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_LOCKED); 13361 } 13362 SCTPDBG(SCTP_DEBUG_OUTPUT1, "USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d err:%d\n", 13363 queue_only, stcb->asoc.peers_rwnd, un_sent, 13364 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue, 13365 stcb->asoc.total_output_queue_size, error); 13366 13367out: 13368out_unlocked: 13369 13370 if (local_soresv && stcb) { 13371 atomic_subtract_int(&stcb->asoc.sb_send_resv, sndlen); 13372 } 13373 if (create_lock_applied) { 13374 SCTP_ASOC_CREATE_UNLOCK(inp); 13375 } 13376 if ((stcb) && hold_tcblock) { 13377 SCTP_TCB_UNLOCK(stcb); 13378 } 13379 if (stcb && free_cnt_applied) { 13380 atomic_add_int(&stcb->asoc.refcnt, -1); 13381 } 13382#ifdef INVARIANTS 13383 if (stcb) { 13384 if (mtx_owned(&stcb->tcb_mtx)) { 13385 panic("Leaving with tcb mtx owned?"); 13386 } 13387 if (mtx_owned(&stcb->tcb_send_mtx)) { 13388 panic("Leaving with tcb send mtx owned?"); 13389 } 13390 } 13391#endif 13392#ifdef INVARIANTS 13393 if (inp) { 13394 sctp_validate_no_locks(inp); 13395 } else { 13396 SCTP_PRINTF("Warning - inp is NULL so cant validate locks\n"); 13397 } 13398#endif 13399 if (top) { 13400 sctp_m_freem(top); 13401 } 13402 if (control) { 13403 sctp_m_freem(control); 13404 } 13405 return (error); 13406} 13407 13408 13409/* 13410 * generate an AUTHentication chunk, if required 13411 */ 13412struct mbuf * 13413sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end, 13414 struct sctp_auth_chunk **auth_ret, uint32_t * offset, 13415 struct sctp_tcb *stcb, uint8_t chunk) 13416{ 13417 struct mbuf *m_auth; 13418 struct sctp_auth_chunk *auth; 13419 int chunk_len; 13420 struct mbuf *cn; 13421 13422 if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) || 13423 (stcb == NULL)) 13424 return (m); 13425 13426 /* sysctl disabled auth? */ 13427 if (SCTP_BASE_SYSCTL(sctp_auth_disable)) 13428 return (m); 13429 13430 /* peer doesn't do auth... */ 13431 if (!stcb->asoc.peer_supports_auth) { 13432 return (m); 13433 } 13434 /* does the requested chunk require auth? */ 13435 if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) { 13436 return (m); 13437 } 13438 m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_DONTWAIT, 1, MT_HEADER); 13439 if (m_auth == NULL) { 13440 /* no mbuf's */ 13441 return (m); 13442 } 13443 /* reserve some space if this will be the first mbuf */ 13444 if (m == NULL) 13445 SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD); 13446 /* fill in the AUTH chunk details */ 13447 auth = mtod(m_auth, struct sctp_auth_chunk *); 13448 bzero(auth, sizeof(*auth)); 13449 auth->ch.chunk_type = SCTP_AUTHENTICATION; 13450 auth->ch.chunk_flags = 0; 13451 chunk_len = sizeof(*auth) + 13452 sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id); 13453 auth->ch.chunk_length = htons(chunk_len); 13454 auth->hmac_id = htons(stcb->asoc.peer_hmac_id); 13455 /* key id and hmac digest will be computed and filled in upon send */ 13456 13457 /* save the offset where the auth was inserted into the chain */ 13458 *offset = 0; 13459 for (cn = m; cn; cn = SCTP_BUF_NEXT(cn)) { 13460 *offset += SCTP_BUF_LEN(cn); 13461 } 13462 13463 /* update length and return pointer to the auth chunk */ 13464 SCTP_BUF_LEN(m_auth) = chunk_len; 13465 m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0); 13466 if (auth_ret != NULL) 13467 *auth_ret = auth; 13468 13469 return (m); 13470} 13471 13472#ifdef INET6 13473int 13474sctp_v6src_match_nexthop(struct sockaddr_in6 *src6, sctp_route_t * ro) 13475{ 13476 struct nd_prefix *pfx = NULL; 13477 struct nd_pfxrouter *pfxrtr = NULL; 13478 struct sockaddr_in6 gw6; 13479 13480 if (ro == NULL || ro->ro_rt == NULL || src6->sin6_family != AF_INET6) 13481 return (0); 13482 13483 /* get prefix entry of address */ 13484 LIST_FOREACH(pfx, &MODULE_GLOBAL(nd_prefix), ndpr_entry) { 13485 if (pfx->ndpr_stateflags & NDPRF_DETACHED) 13486 continue; 13487 if (IN6_ARE_MASKED_ADDR_EQUAL(&pfx->ndpr_prefix.sin6_addr, 13488 &src6->sin6_addr, &pfx->ndpr_mask)) 13489 break; 13490 } 13491 /* no prefix entry in the prefix list */ 13492 if (pfx == NULL) { 13493 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefix entry for "); 13494 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13495 return (0); 13496 } 13497 SCTPDBG(SCTP_DEBUG_OUTPUT2, "v6src_match_nexthop(), Prefix entry is "); 13498 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13499 13500 /* search installed gateway from prefix entry */ 13501 LIST_FOREACH(pfxrtr, &pfx->ndpr_advrtrs, pfr_entry) { 13502 memset(&gw6, 0, sizeof(struct sockaddr_in6)); 13503 gw6.sin6_family = AF_INET6; 13504 gw6.sin6_len = sizeof(struct sockaddr_in6); 13505 memcpy(&gw6.sin6_addr, &pfxrtr->router->rtaddr, 13506 sizeof(struct in6_addr)); 13507 SCTPDBG(SCTP_DEBUG_OUTPUT2, "prefix router is "); 13508 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&gw6); 13509 SCTPDBG(SCTP_DEBUG_OUTPUT2, "installed router is "); 13510 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway); 13511 if (sctp_cmpaddr((struct sockaddr *)&gw6, 13512 ro->ro_rt->rt_gateway)) { 13513 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is installed\n"); 13514 return (1); 13515 } 13516 } 13517 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is not installed\n"); 13518 return (0); 13519} 13520 13521#endif 13522 13523int 13524sctp_v4src_match_nexthop(struct sctp_ifa *sifa, sctp_route_t * ro) 13525{ 13526#ifdef INET 13527 struct sockaddr_in *sin, *mask; 13528 struct ifaddr *ifa; 13529 struct in_addr srcnetaddr, gwnetaddr; 13530 13531 if (ro == NULL || ro->ro_rt == NULL || 13532 sifa->address.sa.sa_family != AF_INET) { 13533 return (0); 13534 } 13535 ifa = (struct ifaddr *)sifa->ifa; 13536 mask = (struct sockaddr_in *)(ifa->ifa_netmask); 13537 sin = (struct sockaddr_in *)&sifa->address.sin; 13538 srcnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13539 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: src address is "); 13540 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 13541 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", srcnetaddr.s_addr); 13542 13543 sin = (struct sockaddr_in *)ro->ro_rt->rt_gateway; 13544 gwnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13545 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: nexthop is "); 13546 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway); 13547 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", gwnetaddr.s_addr); 13548 if (srcnetaddr.s_addr == gwnetaddr.s_addr) { 13549 return (1); 13550 } 13551#endif 13552 return (0); 13553} 13554