sctp_output.c revision 281955
1/*- 2 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 3 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 4 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions are met: 8 * 9 * a) Redistributions of source code must retain the above copyright notice, 10 * this list of conditions and the following disclaimer. 11 * 12 * b) Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the distribution. 15 * 16 * c) Neither the name of Cisco Systems, Inc. nor the names of its 17 * contributors may be used to endorse or promote products derived 18 * from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 24 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 30 * THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33#include <sys/cdefs.h> 34__FBSDID("$FreeBSD: stable/10/sys/netinet/sctp_output.c 281955 2015-04-24 23:26:44Z hiren $"); 35 36#include <netinet/sctp_os.h> 37#include <sys/proc.h> 38#include <netinet/sctp_var.h> 39#include <netinet/sctp_sysctl.h> 40#include <netinet/sctp_header.h> 41#include <netinet/sctp_pcb.h> 42#include <netinet/sctputil.h> 43#include <netinet/sctp_output.h> 44#include <netinet/sctp_uio.h> 45#include <netinet/sctputil.h> 46#include <netinet/sctp_auth.h> 47#include <netinet/sctp_timer.h> 48#include <netinet/sctp_asconf.h> 49#include <netinet/sctp_indata.h> 50#include <netinet/sctp_bsd_addr.h> 51#include <netinet/sctp_input.h> 52#include <netinet/sctp_crc32.h> 53#if defined(INET) || defined(INET6) 54#include <netinet/udp.h> 55#endif 56#include <netinet/udp_var.h> 57#include <machine/in_cksum.h> 58 59 60 61#define SCTP_MAX_GAPS_INARRAY 4 62struct sack_track { 63 uint8_t right_edge; /* mergable on the right edge */ 64 uint8_t left_edge; /* mergable on the left edge */ 65 uint8_t num_entries; 66 uint8_t spare; 67 struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY]; 68}; 69 70struct sack_track sack_array[256] = { 71 {0, 0, 0, 0, /* 0x00 */ 72 {{0, 0}, 73 {0, 0}, 74 {0, 0}, 75 {0, 0} 76 } 77 }, 78 {1, 0, 1, 0, /* 0x01 */ 79 {{0, 0}, 80 {0, 0}, 81 {0, 0}, 82 {0, 0} 83 } 84 }, 85 {0, 0, 1, 0, /* 0x02 */ 86 {{1, 1}, 87 {0, 0}, 88 {0, 0}, 89 {0, 0} 90 } 91 }, 92 {1, 0, 1, 0, /* 0x03 */ 93 {{0, 1}, 94 {0, 0}, 95 {0, 0}, 96 {0, 0} 97 } 98 }, 99 {0, 0, 1, 0, /* 0x04 */ 100 {{2, 2}, 101 {0, 0}, 102 {0, 0}, 103 {0, 0} 104 } 105 }, 106 {1, 0, 2, 0, /* 0x05 */ 107 {{0, 0}, 108 {2, 2}, 109 {0, 0}, 110 {0, 0} 111 } 112 }, 113 {0, 0, 1, 0, /* 0x06 */ 114 {{1, 2}, 115 {0, 0}, 116 {0, 0}, 117 {0, 0} 118 } 119 }, 120 {1, 0, 1, 0, /* 0x07 */ 121 {{0, 2}, 122 {0, 0}, 123 {0, 0}, 124 {0, 0} 125 } 126 }, 127 {0, 0, 1, 0, /* 0x08 */ 128 {{3, 3}, 129 {0, 0}, 130 {0, 0}, 131 {0, 0} 132 } 133 }, 134 {1, 0, 2, 0, /* 0x09 */ 135 {{0, 0}, 136 {3, 3}, 137 {0, 0}, 138 {0, 0} 139 } 140 }, 141 {0, 0, 2, 0, /* 0x0a */ 142 {{1, 1}, 143 {3, 3}, 144 {0, 0}, 145 {0, 0} 146 } 147 }, 148 {1, 0, 2, 0, /* 0x0b */ 149 {{0, 1}, 150 {3, 3}, 151 {0, 0}, 152 {0, 0} 153 } 154 }, 155 {0, 0, 1, 0, /* 0x0c */ 156 {{2, 3}, 157 {0, 0}, 158 {0, 0}, 159 {0, 0} 160 } 161 }, 162 {1, 0, 2, 0, /* 0x0d */ 163 {{0, 0}, 164 {2, 3}, 165 {0, 0}, 166 {0, 0} 167 } 168 }, 169 {0, 0, 1, 0, /* 0x0e */ 170 {{1, 3}, 171 {0, 0}, 172 {0, 0}, 173 {0, 0} 174 } 175 }, 176 {1, 0, 1, 0, /* 0x0f */ 177 {{0, 3}, 178 {0, 0}, 179 {0, 0}, 180 {0, 0} 181 } 182 }, 183 {0, 0, 1, 0, /* 0x10 */ 184 {{4, 4}, 185 {0, 0}, 186 {0, 0}, 187 {0, 0} 188 } 189 }, 190 {1, 0, 2, 0, /* 0x11 */ 191 {{0, 0}, 192 {4, 4}, 193 {0, 0}, 194 {0, 0} 195 } 196 }, 197 {0, 0, 2, 0, /* 0x12 */ 198 {{1, 1}, 199 {4, 4}, 200 {0, 0}, 201 {0, 0} 202 } 203 }, 204 {1, 0, 2, 0, /* 0x13 */ 205 {{0, 1}, 206 {4, 4}, 207 {0, 0}, 208 {0, 0} 209 } 210 }, 211 {0, 0, 2, 0, /* 0x14 */ 212 {{2, 2}, 213 {4, 4}, 214 {0, 0}, 215 {0, 0} 216 } 217 }, 218 {1, 0, 3, 0, /* 0x15 */ 219 {{0, 0}, 220 {2, 2}, 221 {4, 4}, 222 {0, 0} 223 } 224 }, 225 {0, 0, 2, 0, /* 0x16 */ 226 {{1, 2}, 227 {4, 4}, 228 {0, 0}, 229 {0, 0} 230 } 231 }, 232 {1, 0, 2, 0, /* 0x17 */ 233 {{0, 2}, 234 {4, 4}, 235 {0, 0}, 236 {0, 0} 237 } 238 }, 239 {0, 0, 1, 0, /* 0x18 */ 240 {{3, 4}, 241 {0, 0}, 242 {0, 0}, 243 {0, 0} 244 } 245 }, 246 {1, 0, 2, 0, /* 0x19 */ 247 {{0, 0}, 248 {3, 4}, 249 {0, 0}, 250 {0, 0} 251 } 252 }, 253 {0, 0, 2, 0, /* 0x1a */ 254 {{1, 1}, 255 {3, 4}, 256 {0, 0}, 257 {0, 0} 258 } 259 }, 260 {1, 0, 2, 0, /* 0x1b */ 261 {{0, 1}, 262 {3, 4}, 263 {0, 0}, 264 {0, 0} 265 } 266 }, 267 {0, 0, 1, 0, /* 0x1c */ 268 {{2, 4}, 269 {0, 0}, 270 {0, 0}, 271 {0, 0} 272 } 273 }, 274 {1, 0, 2, 0, /* 0x1d */ 275 {{0, 0}, 276 {2, 4}, 277 {0, 0}, 278 {0, 0} 279 } 280 }, 281 {0, 0, 1, 0, /* 0x1e */ 282 {{1, 4}, 283 {0, 0}, 284 {0, 0}, 285 {0, 0} 286 } 287 }, 288 {1, 0, 1, 0, /* 0x1f */ 289 {{0, 4}, 290 {0, 0}, 291 {0, 0}, 292 {0, 0} 293 } 294 }, 295 {0, 0, 1, 0, /* 0x20 */ 296 {{5, 5}, 297 {0, 0}, 298 {0, 0}, 299 {0, 0} 300 } 301 }, 302 {1, 0, 2, 0, /* 0x21 */ 303 {{0, 0}, 304 {5, 5}, 305 {0, 0}, 306 {0, 0} 307 } 308 }, 309 {0, 0, 2, 0, /* 0x22 */ 310 {{1, 1}, 311 {5, 5}, 312 {0, 0}, 313 {0, 0} 314 } 315 }, 316 {1, 0, 2, 0, /* 0x23 */ 317 {{0, 1}, 318 {5, 5}, 319 {0, 0}, 320 {0, 0} 321 } 322 }, 323 {0, 0, 2, 0, /* 0x24 */ 324 {{2, 2}, 325 {5, 5}, 326 {0, 0}, 327 {0, 0} 328 } 329 }, 330 {1, 0, 3, 0, /* 0x25 */ 331 {{0, 0}, 332 {2, 2}, 333 {5, 5}, 334 {0, 0} 335 } 336 }, 337 {0, 0, 2, 0, /* 0x26 */ 338 {{1, 2}, 339 {5, 5}, 340 {0, 0}, 341 {0, 0} 342 } 343 }, 344 {1, 0, 2, 0, /* 0x27 */ 345 {{0, 2}, 346 {5, 5}, 347 {0, 0}, 348 {0, 0} 349 } 350 }, 351 {0, 0, 2, 0, /* 0x28 */ 352 {{3, 3}, 353 {5, 5}, 354 {0, 0}, 355 {0, 0} 356 } 357 }, 358 {1, 0, 3, 0, /* 0x29 */ 359 {{0, 0}, 360 {3, 3}, 361 {5, 5}, 362 {0, 0} 363 } 364 }, 365 {0, 0, 3, 0, /* 0x2a */ 366 {{1, 1}, 367 {3, 3}, 368 {5, 5}, 369 {0, 0} 370 } 371 }, 372 {1, 0, 3, 0, /* 0x2b */ 373 {{0, 1}, 374 {3, 3}, 375 {5, 5}, 376 {0, 0} 377 } 378 }, 379 {0, 0, 2, 0, /* 0x2c */ 380 {{2, 3}, 381 {5, 5}, 382 {0, 0}, 383 {0, 0} 384 } 385 }, 386 {1, 0, 3, 0, /* 0x2d */ 387 {{0, 0}, 388 {2, 3}, 389 {5, 5}, 390 {0, 0} 391 } 392 }, 393 {0, 0, 2, 0, /* 0x2e */ 394 {{1, 3}, 395 {5, 5}, 396 {0, 0}, 397 {0, 0} 398 } 399 }, 400 {1, 0, 2, 0, /* 0x2f */ 401 {{0, 3}, 402 {5, 5}, 403 {0, 0}, 404 {0, 0} 405 } 406 }, 407 {0, 0, 1, 0, /* 0x30 */ 408 {{4, 5}, 409 {0, 0}, 410 {0, 0}, 411 {0, 0} 412 } 413 }, 414 {1, 0, 2, 0, /* 0x31 */ 415 {{0, 0}, 416 {4, 5}, 417 {0, 0}, 418 {0, 0} 419 } 420 }, 421 {0, 0, 2, 0, /* 0x32 */ 422 {{1, 1}, 423 {4, 5}, 424 {0, 0}, 425 {0, 0} 426 } 427 }, 428 {1, 0, 2, 0, /* 0x33 */ 429 {{0, 1}, 430 {4, 5}, 431 {0, 0}, 432 {0, 0} 433 } 434 }, 435 {0, 0, 2, 0, /* 0x34 */ 436 {{2, 2}, 437 {4, 5}, 438 {0, 0}, 439 {0, 0} 440 } 441 }, 442 {1, 0, 3, 0, /* 0x35 */ 443 {{0, 0}, 444 {2, 2}, 445 {4, 5}, 446 {0, 0} 447 } 448 }, 449 {0, 0, 2, 0, /* 0x36 */ 450 {{1, 2}, 451 {4, 5}, 452 {0, 0}, 453 {0, 0} 454 } 455 }, 456 {1, 0, 2, 0, /* 0x37 */ 457 {{0, 2}, 458 {4, 5}, 459 {0, 0}, 460 {0, 0} 461 } 462 }, 463 {0, 0, 1, 0, /* 0x38 */ 464 {{3, 5}, 465 {0, 0}, 466 {0, 0}, 467 {0, 0} 468 } 469 }, 470 {1, 0, 2, 0, /* 0x39 */ 471 {{0, 0}, 472 {3, 5}, 473 {0, 0}, 474 {0, 0} 475 } 476 }, 477 {0, 0, 2, 0, /* 0x3a */ 478 {{1, 1}, 479 {3, 5}, 480 {0, 0}, 481 {0, 0} 482 } 483 }, 484 {1, 0, 2, 0, /* 0x3b */ 485 {{0, 1}, 486 {3, 5}, 487 {0, 0}, 488 {0, 0} 489 } 490 }, 491 {0, 0, 1, 0, /* 0x3c */ 492 {{2, 5}, 493 {0, 0}, 494 {0, 0}, 495 {0, 0} 496 } 497 }, 498 {1, 0, 2, 0, /* 0x3d */ 499 {{0, 0}, 500 {2, 5}, 501 {0, 0}, 502 {0, 0} 503 } 504 }, 505 {0, 0, 1, 0, /* 0x3e */ 506 {{1, 5}, 507 {0, 0}, 508 {0, 0}, 509 {0, 0} 510 } 511 }, 512 {1, 0, 1, 0, /* 0x3f */ 513 {{0, 5}, 514 {0, 0}, 515 {0, 0}, 516 {0, 0} 517 } 518 }, 519 {0, 0, 1, 0, /* 0x40 */ 520 {{6, 6}, 521 {0, 0}, 522 {0, 0}, 523 {0, 0} 524 } 525 }, 526 {1, 0, 2, 0, /* 0x41 */ 527 {{0, 0}, 528 {6, 6}, 529 {0, 0}, 530 {0, 0} 531 } 532 }, 533 {0, 0, 2, 0, /* 0x42 */ 534 {{1, 1}, 535 {6, 6}, 536 {0, 0}, 537 {0, 0} 538 } 539 }, 540 {1, 0, 2, 0, /* 0x43 */ 541 {{0, 1}, 542 {6, 6}, 543 {0, 0}, 544 {0, 0} 545 } 546 }, 547 {0, 0, 2, 0, /* 0x44 */ 548 {{2, 2}, 549 {6, 6}, 550 {0, 0}, 551 {0, 0} 552 } 553 }, 554 {1, 0, 3, 0, /* 0x45 */ 555 {{0, 0}, 556 {2, 2}, 557 {6, 6}, 558 {0, 0} 559 } 560 }, 561 {0, 0, 2, 0, /* 0x46 */ 562 {{1, 2}, 563 {6, 6}, 564 {0, 0}, 565 {0, 0} 566 } 567 }, 568 {1, 0, 2, 0, /* 0x47 */ 569 {{0, 2}, 570 {6, 6}, 571 {0, 0}, 572 {0, 0} 573 } 574 }, 575 {0, 0, 2, 0, /* 0x48 */ 576 {{3, 3}, 577 {6, 6}, 578 {0, 0}, 579 {0, 0} 580 } 581 }, 582 {1, 0, 3, 0, /* 0x49 */ 583 {{0, 0}, 584 {3, 3}, 585 {6, 6}, 586 {0, 0} 587 } 588 }, 589 {0, 0, 3, 0, /* 0x4a */ 590 {{1, 1}, 591 {3, 3}, 592 {6, 6}, 593 {0, 0} 594 } 595 }, 596 {1, 0, 3, 0, /* 0x4b */ 597 {{0, 1}, 598 {3, 3}, 599 {6, 6}, 600 {0, 0} 601 } 602 }, 603 {0, 0, 2, 0, /* 0x4c */ 604 {{2, 3}, 605 {6, 6}, 606 {0, 0}, 607 {0, 0} 608 } 609 }, 610 {1, 0, 3, 0, /* 0x4d */ 611 {{0, 0}, 612 {2, 3}, 613 {6, 6}, 614 {0, 0} 615 } 616 }, 617 {0, 0, 2, 0, /* 0x4e */ 618 {{1, 3}, 619 {6, 6}, 620 {0, 0}, 621 {0, 0} 622 } 623 }, 624 {1, 0, 2, 0, /* 0x4f */ 625 {{0, 3}, 626 {6, 6}, 627 {0, 0}, 628 {0, 0} 629 } 630 }, 631 {0, 0, 2, 0, /* 0x50 */ 632 {{4, 4}, 633 {6, 6}, 634 {0, 0}, 635 {0, 0} 636 } 637 }, 638 {1, 0, 3, 0, /* 0x51 */ 639 {{0, 0}, 640 {4, 4}, 641 {6, 6}, 642 {0, 0} 643 } 644 }, 645 {0, 0, 3, 0, /* 0x52 */ 646 {{1, 1}, 647 {4, 4}, 648 {6, 6}, 649 {0, 0} 650 } 651 }, 652 {1, 0, 3, 0, /* 0x53 */ 653 {{0, 1}, 654 {4, 4}, 655 {6, 6}, 656 {0, 0} 657 } 658 }, 659 {0, 0, 3, 0, /* 0x54 */ 660 {{2, 2}, 661 {4, 4}, 662 {6, 6}, 663 {0, 0} 664 } 665 }, 666 {1, 0, 4, 0, /* 0x55 */ 667 {{0, 0}, 668 {2, 2}, 669 {4, 4}, 670 {6, 6} 671 } 672 }, 673 {0, 0, 3, 0, /* 0x56 */ 674 {{1, 2}, 675 {4, 4}, 676 {6, 6}, 677 {0, 0} 678 } 679 }, 680 {1, 0, 3, 0, /* 0x57 */ 681 {{0, 2}, 682 {4, 4}, 683 {6, 6}, 684 {0, 0} 685 } 686 }, 687 {0, 0, 2, 0, /* 0x58 */ 688 {{3, 4}, 689 {6, 6}, 690 {0, 0}, 691 {0, 0} 692 } 693 }, 694 {1, 0, 3, 0, /* 0x59 */ 695 {{0, 0}, 696 {3, 4}, 697 {6, 6}, 698 {0, 0} 699 } 700 }, 701 {0, 0, 3, 0, /* 0x5a */ 702 {{1, 1}, 703 {3, 4}, 704 {6, 6}, 705 {0, 0} 706 } 707 }, 708 {1, 0, 3, 0, /* 0x5b */ 709 {{0, 1}, 710 {3, 4}, 711 {6, 6}, 712 {0, 0} 713 } 714 }, 715 {0, 0, 2, 0, /* 0x5c */ 716 {{2, 4}, 717 {6, 6}, 718 {0, 0}, 719 {0, 0} 720 } 721 }, 722 {1, 0, 3, 0, /* 0x5d */ 723 {{0, 0}, 724 {2, 4}, 725 {6, 6}, 726 {0, 0} 727 } 728 }, 729 {0, 0, 2, 0, /* 0x5e */ 730 {{1, 4}, 731 {6, 6}, 732 {0, 0}, 733 {0, 0} 734 } 735 }, 736 {1, 0, 2, 0, /* 0x5f */ 737 {{0, 4}, 738 {6, 6}, 739 {0, 0}, 740 {0, 0} 741 } 742 }, 743 {0, 0, 1, 0, /* 0x60 */ 744 {{5, 6}, 745 {0, 0}, 746 {0, 0}, 747 {0, 0} 748 } 749 }, 750 {1, 0, 2, 0, /* 0x61 */ 751 {{0, 0}, 752 {5, 6}, 753 {0, 0}, 754 {0, 0} 755 } 756 }, 757 {0, 0, 2, 0, /* 0x62 */ 758 {{1, 1}, 759 {5, 6}, 760 {0, 0}, 761 {0, 0} 762 } 763 }, 764 {1, 0, 2, 0, /* 0x63 */ 765 {{0, 1}, 766 {5, 6}, 767 {0, 0}, 768 {0, 0} 769 } 770 }, 771 {0, 0, 2, 0, /* 0x64 */ 772 {{2, 2}, 773 {5, 6}, 774 {0, 0}, 775 {0, 0} 776 } 777 }, 778 {1, 0, 3, 0, /* 0x65 */ 779 {{0, 0}, 780 {2, 2}, 781 {5, 6}, 782 {0, 0} 783 } 784 }, 785 {0, 0, 2, 0, /* 0x66 */ 786 {{1, 2}, 787 {5, 6}, 788 {0, 0}, 789 {0, 0} 790 } 791 }, 792 {1, 0, 2, 0, /* 0x67 */ 793 {{0, 2}, 794 {5, 6}, 795 {0, 0}, 796 {0, 0} 797 } 798 }, 799 {0, 0, 2, 0, /* 0x68 */ 800 {{3, 3}, 801 {5, 6}, 802 {0, 0}, 803 {0, 0} 804 } 805 }, 806 {1, 0, 3, 0, /* 0x69 */ 807 {{0, 0}, 808 {3, 3}, 809 {5, 6}, 810 {0, 0} 811 } 812 }, 813 {0, 0, 3, 0, /* 0x6a */ 814 {{1, 1}, 815 {3, 3}, 816 {5, 6}, 817 {0, 0} 818 } 819 }, 820 {1, 0, 3, 0, /* 0x6b */ 821 {{0, 1}, 822 {3, 3}, 823 {5, 6}, 824 {0, 0} 825 } 826 }, 827 {0, 0, 2, 0, /* 0x6c */ 828 {{2, 3}, 829 {5, 6}, 830 {0, 0}, 831 {0, 0} 832 } 833 }, 834 {1, 0, 3, 0, /* 0x6d */ 835 {{0, 0}, 836 {2, 3}, 837 {5, 6}, 838 {0, 0} 839 } 840 }, 841 {0, 0, 2, 0, /* 0x6e */ 842 {{1, 3}, 843 {5, 6}, 844 {0, 0}, 845 {0, 0} 846 } 847 }, 848 {1, 0, 2, 0, /* 0x6f */ 849 {{0, 3}, 850 {5, 6}, 851 {0, 0}, 852 {0, 0} 853 } 854 }, 855 {0, 0, 1, 0, /* 0x70 */ 856 {{4, 6}, 857 {0, 0}, 858 {0, 0}, 859 {0, 0} 860 } 861 }, 862 {1, 0, 2, 0, /* 0x71 */ 863 {{0, 0}, 864 {4, 6}, 865 {0, 0}, 866 {0, 0} 867 } 868 }, 869 {0, 0, 2, 0, /* 0x72 */ 870 {{1, 1}, 871 {4, 6}, 872 {0, 0}, 873 {0, 0} 874 } 875 }, 876 {1, 0, 2, 0, /* 0x73 */ 877 {{0, 1}, 878 {4, 6}, 879 {0, 0}, 880 {0, 0} 881 } 882 }, 883 {0, 0, 2, 0, /* 0x74 */ 884 {{2, 2}, 885 {4, 6}, 886 {0, 0}, 887 {0, 0} 888 } 889 }, 890 {1, 0, 3, 0, /* 0x75 */ 891 {{0, 0}, 892 {2, 2}, 893 {4, 6}, 894 {0, 0} 895 } 896 }, 897 {0, 0, 2, 0, /* 0x76 */ 898 {{1, 2}, 899 {4, 6}, 900 {0, 0}, 901 {0, 0} 902 } 903 }, 904 {1, 0, 2, 0, /* 0x77 */ 905 {{0, 2}, 906 {4, 6}, 907 {0, 0}, 908 {0, 0} 909 } 910 }, 911 {0, 0, 1, 0, /* 0x78 */ 912 {{3, 6}, 913 {0, 0}, 914 {0, 0}, 915 {0, 0} 916 } 917 }, 918 {1, 0, 2, 0, /* 0x79 */ 919 {{0, 0}, 920 {3, 6}, 921 {0, 0}, 922 {0, 0} 923 } 924 }, 925 {0, 0, 2, 0, /* 0x7a */ 926 {{1, 1}, 927 {3, 6}, 928 {0, 0}, 929 {0, 0} 930 } 931 }, 932 {1, 0, 2, 0, /* 0x7b */ 933 {{0, 1}, 934 {3, 6}, 935 {0, 0}, 936 {0, 0} 937 } 938 }, 939 {0, 0, 1, 0, /* 0x7c */ 940 {{2, 6}, 941 {0, 0}, 942 {0, 0}, 943 {0, 0} 944 } 945 }, 946 {1, 0, 2, 0, /* 0x7d */ 947 {{0, 0}, 948 {2, 6}, 949 {0, 0}, 950 {0, 0} 951 } 952 }, 953 {0, 0, 1, 0, /* 0x7e */ 954 {{1, 6}, 955 {0, 0}, 956 {0, 0}, 957 {0, 0} 958 } 959 }, 960 {1, 0, 1, 0, /* 0x7f */ 961 {{0, 6}, 962 {0, 0}, 963 {0, 0}, 964 {0, 0} 965 } 966 }, 967 {0, 1, 1, 0, /* 0x80 */ 968 {{7, 7}, 969 {0, 0}, 970 {0, 0}, 971 {0, 0} 972 } 973 }, 974 {1, 1, 2, 0, /* 0x81 */ 975 {{0, 0}, 976 {7, 7}, 977 {0, 0}, 978 {0, 0} 979 } 980 }, 981 {0, 1, 2, 0, /* 0x82 */ 982 {{1, 1}, 983 {7, 7}, 984 {0, 0}, 985 {0, 0} 986 } 987 }, 988 {1, 1, 2, 0, /* 0x83 */ 989 {{0, 1}, 990 {7, 7}, 991 {0, 0}, 992 {0, 0} 993 } 994 }, 995 {0, 1, 2, 0, /* 0x84 */ 996 {{2, 2}, 997 {7, 7}, 998 {0, 0}, 999 {0, 0} 1000 } 1001 }, 1002 {1, 1, 3, 0, /* 0x85 */ 1003 {{0, 0}, 1004 {2, 2}, 1005 {7, 7}, 1006 {0, 0} 1007 } 1008 }, 1009 {0, 1, 2, 0, /* 0x86 */ 1010 {{1, 2}, 1011 {7, 7}, 1012 {0, 0}, 1013 {0, 0} 1014 } 1015 }, 1016 {1, 1, 2, 0, /* 0x87 */ 1017 {{0, 2}, 1018 {7, 7}, 1019 {0, 0}, 1020 {0, 0} 1021 } 1022 }, 1023 {0, 1, 2, 0, /* 0x88 */ 1024 {{3, 3}, 1025 {7, 7}, 1026 {0, 0}, 1027 {0, 0} 1028 } 1029 }, 1030 {1, 1, 3, 0, /* 0x89 */ 1031 {{0, 0}, 1032 {3, 3}, 1033 {7, 7}, 1034 {0, 0} 1035 } 1036 }, 1037 {0, 1, 3, 0, /* 0x8a */ 1038 {{1, 1}, 1039 {3, 3}, 1040 {7, 7}, 1041 {0, 0} 1042 } 1043 }, 1044 {1, 1, 3, 0, /* 0x8b */ 1045 {{0, 1}, 1046 {3, 3}, 1047 {7, 7}, 1048 {0, 0} 1049 } 1050 }, 1051 {0, 1, 2, 0, /* 0x8c */ 1052 {{2, 3}, 1053 {7, 7}, 1054 {0, 0}, 1055 {0, 0} 1056 } 1057 }, 1058 {1, 1, 3, 0, /* 0x8d */ 1059 {{0, 0}, 1060 {2, 3}, 1061 {7, 7}, 1062 {0, 0} 1063 } 1064 }, 1065 {0, 1, 2, 0, /* 0x8e */ 1066 {{1, 3}, 1067 {7, 7}, 1068 {0, 0}, 1069 {0, 0} 1070 } 1071 }, 1072 {1, 1, 2, 0, /* 0x8f */ 1073 {{0, 3}, 1074 {7, 7}, 1075 {0, 0}, 1076 {0, 0} 1077 } 1078 }, 1079 {0, 1, 2, 0, /* 0x90 */ 1080 {{4, 4}, 1081 {7, 7}, 1082 {0, 0}, 1083 {0, 0} 1084 } 1085 }, 1086 {1, 1, 3, 0, /* 0x91 */ 1087 {{0, 0}, 1088 {4, 4}, 1089 {7, 7}, 1090 {0, 0} 1091 } 1092 }, 1093 {0, 1, 3, 0, /* 0x92 */ 1094 {{1, 1}, 1095 {4, 4}, 1096 {7, 7}, 1097 {0, 0} 1098 } 1099 }, 1100 {1, 1, 3, 0, /* 0x93 */ 1101 {{0, 1}, 1102 {4, 4}, 1103 {7, 7}, 1104 {0, 0} 1105 } 1106 }, 1107 {0, 1, 3, 0, /* 0x94 */ 1108 {{2, 2}, 1109 {4, 4}, 1110 {7, 7}, 1111 {0, 0} 1112 } 1113 }, 1114 {1, 1, 4, 0, /* 0x95 */ 1115 {{0, 0}, 1116 {2, 2}, 1117 {4, 4}, 1118 {7, 7} 1119 } 1120 }, 1121 {0, 1, 3, 0, /* 0x96 */ 1122 {{1, 2}, 1123 {4, 4}, 1124 {7, 7}, 1125 {0, 0} 1126 } 1127 }, 1128 {1, 1, 3, 0, /* 0x97 */ 1129 {{0, 2}, 1130 {4, 4}, 1131 {7, 7}, 1132 {0, 0} 1133 } 1134 }, 1135 {0, 1, 2, 0, /* 0x98 */ 1136 {{3, 4}, 1137 {7, 7}, 1138 {0, 0}, 1139 {0, 0} 1140 } 1141 }, 1142 {1, 1, 3, 0, /* 0x99 */ 1143 {{0, 0}, 1144 {3, 4}, 1145 {7, 7}, 1146 {0, 0} 1147 } 1148 }, 1149 {0, 1, 3, 0, /* 0x9a */ 1150 {{1, 1}, 1151 {3, 4}, 1152 {7, 7}, 1153 {0, 0} 1154 } 1155 }, 1156 {1, 1, 3, 0, /* 0x9b */ 1157 {{0, 1}, 1158 {3, 4}, 1159 {7, 7}, 1160 {0, 0} 1161 } 1162 }, 1163 {0, 1, 2, 0, /* 0x9c */ 1164 {{2, 4}, 1165 {7, 7}, 1166 {0, 0}, 1167 {0, 0} 1168 } 1169 }, 1170 {1, 1, 3, 0, /* 0x9d */ 1171 {{0, 0}, 1172 {2, 4}, 1173 {7, 7}, 1174 {0, 0} 1175 } 1176 }, 1177 {0, 1, 2, 0, /* 0x9e */ 1178 {{1, 4}, 1179 {7, 7}, 1180 {0, 0}, 1181 {0, 0} 1182 } 1183 }, 1184 {1, 1, 2, 0, /* 0x9f */ 1185 {{0, 4}, 1186 {7, 7}, 1187 {0, 0}, 1188 {0, 0} 1189 } 1190 }, 1191 {0, 1, 2, 0, /* 0xa0 */ 1192 {{5, 5}, 1193 {7, 7}, 1194 {0, 0}, 1195 {0, 0} 1196 } 1197 }, 1198 {1, 1, 3, 0, /* 0xa1 */ 1199 {{0, 0}, 1200 {5, 5}, 1201 {7, 7}, 1202 {0, 0} 1203 } 1204 }, 1205 {0, 1, 3, 0, /* 0xa2 */ 1206 {{1, 1}, 1207 {5, 5}, 1208 {7, 7}, 1209 {0, 0} 1210 } 1211 }, 1212 {1, 1, 3, 0, /* 0xa3 */ 1213 {{0, 1}, 1214 {5, 5}, 1215 {7, 7}, 1216 {0, 0} 1217 } 1218 }, 1219 {0, 1, 3, 0, /* 0xa4 */ 1220 {{2, 2}, 1221 {5, 5}, 1222 {7, 7}, 1223 {0, 0} 1224 } 1225 }, 1226 {1, 1, 4, 0, /* 0xa5 */ 1227 {{0, 0}, 1228 {2, 2}, 1229 {5, 5}, 1230 {7, 7} 1231 } 1232 }, 1233 {0, 1, 3, 0, /* 0xa6 */ 1234 {{1, 2}, 1235 {5, 5}, 1236 {7, 7}, 1237 {0, 0} 1238 } 1239 }, 1240 {1, 1, 3, 0, /* 0xa7 */ 1241 {{0, 2}, 1242 {5, 5}, 1243 {7, 7}, 1244 {0, 0} 1245 } 1246 }, 1247 {0, 1, 3, 0, /* 0xa8 */ 1248 {{3, 3}, 1249 {5, 5}, 1250 {7, 7}, 1251 {0, 0} 1252 } 1253 }, 1254 {1, 1, 4, 0, /* 0xa9 */ 1255 {{0, 0}, 1256 {3, 3}, 1257 {5, 5}, 1258 {7, 7} 1259 } 1260 }, 1261 {0, 1, 4, 0, /* 0xaa */ 1262 {{1, 1}, 1263 {3, 3}, 1264 {5, 5}, 1265 {7, 7} 1266 } 1267 }, 1268 {1, 1, 4, 0, /* 0xab */ 1269 {{0, 1}, 1270 {3, 3}, 1271 {5, 5}, 1272 {7, 7} 1273 } 1274 }, 1275 {0, 1, 3, 0, /* 0xac */ 1276 {{2, 3}, 1277 {5, 5}, 1278 {7, 7}, 1279 {0, 0} 1280 } 1281 }, 1282 {1, 1, 4, 0, /* 0xad */ 1283 {{0, 0}, 1284 {2, 3}, 1285 {5, 5}, 1286 {7, 7} 1287 } 1288 }, 1289 {0, 1, 3, 0, /* 0xae */ 1290 {{1, 3}, 1291 {5, 5}, 1292 {7, 7}, 1293 {0, 0} 1294 } 1295 }, 1296 {1, 1, 3, 0, /* 0xaf */ 1297 {{0, 3}, 1298 {5, 5}, 1299 {7, 7}, 1300 {0, 0} 1301 } 1302 }, 1303 {0, 1, 2, 0, /* 0xb0 */ 1304 {{4, 5}, 1305 {7, 7}, 1306 {0, 0}, 1307 {0, 0} 1308 } 1309 }, 1310 {1, 1, 3, 0, /* 0xb1 */ 1311 {{0, 0}, 1312 {4, 5}, 1313 {7, 7}, 1314 {0, 0} 1315 } 1316 }, 1317 {0, 1, 3, 0, /* 0xb2 */ 1318 {{1, 1}, 1319 {4, 5}, 1320 {7, 7}, 1321 {0, 0} 1322 } 1323 }, 1324 {1, 1, 3, 0, /* 0xb3 */ 1325 {{0, 1}, 1326 {4, 5}, 1327 {7, 7}, 1328 {0, 0} 1329 } 1330 }, 1331 {0, 1, 3, 0, /* 0xb4 */ 1332 {{2, 2}, 1333 {4, 5}, 1334 {7, 7}, 1335 {0, 0} 1336 } 1337 }, 1338 {1, 1, 4, 0, /* 0xb5 */ 1339 {{0, 0}, 1340 {2, 2}, 1341 {4, 5}, 1342 {7, 7} 1343 } 1344 }, 1345 {0, 1, 3, 0, /* 0xb6 */ 1346 {{1, 2}, 1347 {4, 5}, 1348 {7, 7}, 1349 {0, 0} 1350 } 1351 }, 1352 {1, 1, 3, 0, /* 0xb7 */ 1353 {{0, 2}, 1354 {4, 5}, 1355 {7, 7}, 1356 {0, 0} 1357 } 1358 }, 1359 {0, 1, 2, 0, /* 0xb8 */ 1360 {{3, 5}, 1361 {7, 7}, 1362 {0, 0}, 1363 {0, 0} 1364 } 1365 }, 1366 {1, 1, 3, 0, /* 0xb9 */ 1367 {{0, 0}, 1368 {3, 5}, 1369 {7, 7}, 1370 {0, 0} 1371 } 1372 }, 1373 {0, 1, 3, 0, /* 0xba */ 1374 {{1, 1}, 1375 {3, 5}, 1376 {7, 7}, 1377 {0, 0} 1378 } 1379 }, 1380 {1, 1, 3, 0, /* 0xbb */ 1381 {{0, 1}, 1382 {3, 5}, 1383 {7, 7}, 1384 {0, 0} 1385 } 1386 }, 1387 {0, 1, 2, 0, /* 0xbc */ 1388 {{2, 5}, 1389 {7, 7}, 1390 {0, 0}, 1391 {0, 0} 1392 } 1393 }, 1394 {1, 1, 3, 0, /* 0xbd */ 1395 {{0, 0}, 1396 {2, 5}, 1397 {7, 7}, 1398 {0, 0} 1399 } 1400 }, 1401 {0, 1, 2, 0, /* 0xbe */ 1402 {{1, 5}, 1403 {7, 7}, 1404 {0, 0}, 1405 {0, 0} 1406 } 1407 }, 1408 {1, 1, 2, 0, /* 0xbf */ 1409 {{0, 5}, 1410 {7, 7}, 1411 {0, 0}, 1412 {0, 0} 1413 } 1414 }, 1415 {0, 1, 1, 0, /* 0xc0 */ 1416 {{6, 7}, 1417 {0, 0}, 1418 {0, 0}, 1419 {0, 0} 1420 } 1421 }, 1422 {1, 1, 2, 0, /* 0xc1 */ 1423 {{0, 0}, 1424 {6, 7}, 1425 {0, 0}, 1426 {0, 0} 1427 } 1428 }, 1429 {0, 1, 2, 0, /* 0xc2 */ 1430 {{1, 1}, 1431 {6, 7}, 1432 {0, 0}, 1433 {0, 0} 1434 } 1435 }, 1436 {1, 1, 2, 0, /* 0xc3 */ 1437 {{0, 1}, 1438 {6, 7}, 1439 {0, 0}, 1440 {0, 0} 1441 } 1442 }, 1443 {0, 1, 2, 0, /* 0xc4 */ 1444 {{2, 2}, 1445 {6, 7}, 1446 {0, 0}, 1447 {0, 0} 1448 } 1449 }, 1450 {1, 1, 3, 0, /* 0xc5 */ 1451 {{0, 0}, 1452 {2, 2}, 1453 {6, 7}, 1454 {0, 0} 1455 } 1456 }, 1457 {0, 1, 2, 0, /* 0xc6 */ 1458 {{1, 2}, 1459 {6, 7}, 1460 {0, 0}, 1461 {0, 0} 1462 } 1463 }, 1464 {1, 1, 2, 0, /* 0xc7 */ 1465 {{0, 2}, 1466 {6, 7}, 1467 {0, 0}, 1468 {0, 0} 1469 } 1470 }, 1471 {0, 1, 2, 0, /* 0xc8 */ 1472 {{3, 3}, 1473 {6, 7}, 1474 {0, 0}, 1475 {0, 0} 1476 } 1477 }, 1478 {1, 1, 3, 0, /* 0xc9 */ 1479 {{0, 0}, 1480 {3, 3}, 1481 {6, 7}, 1482 {0, 0} 1483 } 1484 }, 1485 {0, 1, 3, 0, /* 0xca */ 1486 {{1, 1}, 1487 {3, 3}, 1488 {6, 7}, 1489 {0, 0} 1490 } 1491 }, 1492 {1, 1, 3, 0, /* 0xcb */ 1493 {{0, 1}, 1494 {3, 3}, 1495 {6, 7}, 1496 {0, 0} 1497 } 1498 }, 1499 {0, 1, 2, 0, /* 0xcc */ 1500 {{2, 3}, 1501 {6, 7}, 1502 {0, 0}, 1503 {0, 0} 1504 } 1505 }, 1506 {1, 1, 3, 0, /* 0xcd */ 1507 {{0, 0}, 1508 {2, 3}, 1509 {6, 7}, 1510 {0, 0} 1511 } 1512 }, 1513 {0, 1, 2, 0, /* 0xce */ 1514 {{1, 3}, 1515 {6, 7}, 1516 {0, 0}, 1517 {0, 0} 1518 } 1519 }, 1520 {1, 1, 2, 0, /* 0xcf */ 1521 {{0, 3}, 1522 {6, 7}, 1523 {0, 0}, 1524 {0, 0} 1525 } 1526 }, 1527 {0, 1, 2, 0, /* 0xd0 */ 1528 {{4, 4}, 1529 {6, 7}, 1530 {0, 0}, 1531 {0, 0} 1532 } 1533 }, 1534 {1, 1, 3, 0, /* 0xd1 */ 1535 {{0, 0}, 1536 {4, 4}, 1537 {6, 7}, 1538 {0, 0} 1539 } 1540 }, 1541 {0, 1, 3, 0, /* 0xd2 */ 1542 {{1, 1}, 1543 {4, 4}, 1544 {6, 7}, 1545 {0, 0} 1546 } 1547 }, 1548 {1, 1, 3, 0, /* 0xd3 */ 1549 {{0, 1}, 1550 {4, 4}, 1551 {6, 7}, 1552 {0, 0} 1553 } 1554 }, 1555 {0, 1, 3, 0, /* 0xd4 */ 1556 {{2, 2}, 1557 {4, 4}, 1558 {6, 7}, 1559 {0, 0} 1560 } 1561 }, 1562 {1, 1, 4, 0, /* 0xd5 */ 1563 {{0, 0}, 1564 {2, 2}, 1565 {4, 4}, 1566 {6, 7} 1567 } 1568 }, 1569 {0, 1, 3, 0, /* 0xd6 */ 1570 {{1, 2}, 1571 {4, 4}, 1572 {6, 7}, 1573 {0, 0} 1574 } 1575 }, 1576 {1, 1, 3, 0, /* 0xd7 */ 1577 {{0, 2}, 1578 {4, 4}, 1579 {6, 7}, 1580 {0, 0} 1581 } 1582 }, 1583 {0, 1, 2, 0, /* 0xd8 */ 1584 {{3, 4}, 1585 {6, 7}, 1586 {0, 0}, 1587 {0, 0} 1588 } 1589 }, 1590 {1, 1, 3, 0, /* 0xd9 */ 1591 {{0, 0}, 1592 {3, 4}, 1593 {6, 7}, 1594 {0, 0} 1595 } 1596 }, 1597 {0, 1, 3, 0, /* 0xda */ 1598 {{1, 1}, 1599 {3, 4}, 1600 {6, 7}, 1601 {0, 0} 1602 } 1603 }, 1604 {1, 1, 3, 0, /* 0xdb */ 1605 {{0, 1}, 1606 {3, 4}, 1607 {6, 7}, 1608 {0, 0} 1609 } 1610 }, 1611 {0, 1, 2, 0, /* 0xdc */ 1612 {{2, 4}, 1613 {6, 7}, 1614 {0, 0}, 1615 {0, 0} 1616 } 1617 }, 1618 {1, 1, 3, 0, /* 0xdd */ 1619 {{0, 0}, 1620 {2, 4}, 1621 {6, 7}, 1622 {0, 0} 1623 } 1624 }, 1625 {0, 1, 2, 0, /* 0xde */ 1626 {{1, 4}, 1627 {6, 7}, 1628 {0, 0}, 1629 {0, 0} 1630 } 1631 }, 1632 {1, 1, 2, 0, /* 0xdf */ 1633 {{0, 4}, 1634 {6, 7}, 1635 {0, 0}, 1636 {0, 0} 1637 } 1638 }, 1639 {0, 1, 1, 0, /* 0xe0 */ 1640 {{5, 7}, 1641 {0, 0}, 1642 {0, 0}, 1643 {0, 0} 1644 } 1645 }, 1646 {1, 1, 2, 0, /* 0xe1 */ 1647 {{0, 0}, 1648 {5, 7}, 1649 {0, 0}, 1650 {0, 0} 1651 } 1652 }, 1653 {0, 1, 2, 0, /* 0xe2 */ 1654 {{1, 1}, 1655 {5, 7}, 1656 {0, 0}, 1657 {0, 0} 1658 } 1659 }, 1660 {1, 1, 2, 0, /* 0xe3 */ 1661 {{0, 1}, 1662 {5, 7}, 1663 {0, 0}, 1664 {0, 0} 1665 } 1666 }, 1667 {0, 1, 2, 0, /* 0xe4 */ 1668 {{2, 2}, 1669 {5, 7}, 1670 {0, 0}, 1671 {0, 0} 1672 } 1673 }, 1674 {1, 1, 3, 0, /* 0xe5 */ 1675 {{0, 0}, 1676 {2, 2}, 1677 {5, 7}, 1678 {0, 0} 1679 } 1680 }, 1681 {0, 1, 2, 0, /* 0xe6 */ 1682 {{1, 2}, 1683 {5, 7}, 1684 {0, 0}, 1685 {0, 0} 1686 } 1687 }, 1688 {1, 1, 2, 0, /* 0xe7 */ 1689 {{0, 2}, 1690 {5, 7}, 1691 {0, 0}, 1692 {0, 0} 1693 } 1694 }, 1695 {0, 1, 2, 0, /* 0xe8 */ 1696 {{3, 3}, 1697 {5, 7}, 1698 {0, 0}, 1699 {0, 0} 1700 } 1701 }, 1702 {1, 1, 3, 0, /* 0xe9 */ 1703 {{0, 0}, 1704 {3, 3}, 1705 {5, 7}, 1706 {0, 0} 1707 } 1708 }, 1709 {0, 1, 3, 0, /* 0xea */ 1710 {{1, 1}, 1711 {3, 3}, 1712 {5, 7}, 1713 {0, 0} 1714 } 1715 }, 1716 {1, 1, 3, 0, /* 0xeb */ 1717 {{0, 1}, 1718 {3, 3}, 1719 {5, 7}, 1720 {0, 0} 1721 } 1722 }, 1723 {0, 1, 2, 0, /* 0xec */ 1724 {{2, 3}, 1725 {5, 7}, 1726 {0, 0}, 1727 {0, 0} 1728 } 1729 }, 1730 {1, 1, 3, 0, /* 0xed */ 1731 {{0, 0}, 1732 {2, 3}, 1733 {5, 7}, 1734 {0, 0} 1735 } 1736 }, 1737 {0, 1, 2, 0, /* 0xee */ 1738 {{1, 3}, 1739 {5, 7}, 1740 {0, 0}, 1741 {0, 0} 1742 } 1743 }, 1744 {1, 1, 2, 0, /* 0xef */ 1745 {{0, 3}, 1746 {5, 7}, 1747 {0, 0}, 1748 {0, 0} 1749 } 1750 }, 1751 {0, 1, 1, 0, /* 0xf0 */ 1752 {{4, 7}, 1753 {0, 0}, 1754 {0, 0}, 1755 {0, 0} 1756 } 1757 }, 1758 {1, 1, 2, 0, /* 0xf1 */ 1759 {{0, 0}, 1760 {4, 7}, 1761 {0, 0}, 1762 {0, 0} 1763 } 1764 }, 1765 {0, 1, 2, 0, /* 0xf2 */ 1766 {{1, 1}, 1767 {4, 7}, 1768 {0, 0}, 1769 {0, 0} 1770 } 1771 }, 1772 {1, 1, 2, 0, /* 0xf3 */ 1773 {{0, 1}, 1774 {4, 7}, 1775 {0, 0}, 1776 {0, 0} 1777 } 1778 }, 1779 {0, 1, 2, 0, /* 0xf4 */ 1780 {{2, 2}, 1781 {4, 7}, 1782 {0, 0}, 1783 {0, 0} 1784 } 1785 }, 1786 {1, 1, 3, 0, /* 0xf5 */ 1787 {{0, 0}, 1788 {2, 2}, 1789 {4, 7}, 1790 {0, 0} 1791 } 1792 }, 1793 {0, 1, 2, 0, /* 0xf6 */ 1794 {{1, 2}, 1795 {4, 7}, 1796 {0, 0}, 1797 {0, 0} 1798 } 1799 }, 1800 {1, 1, 2, 0, /* 0xf7 */ 1801 {{0, 2}, 1802 {4, 7}, 1803 {0, 0}, 1804 {0, 0} 1805 } 1806 }, 1807 {0, 1, 1, 0, /* 0xf8 */ 1808 {{3, 7}, 1809 {0, 0}, 1810 {0, 0}, 1811 {0, 0} 1812 } 1813 }, 1814 {1, 1, 2, 0, /* 0xf9 */ 1815 {{0, 0}, 1816 {3, 7}, 1817 {0, 0}, 1818 {0, 0} 1819 } 1820 }, 1821 {0, 1, 2, 0, /* 0xfa */ 1822 {{1, 1}, 1823 {3, 7}, 1824 {0, 0}, 1825 {0, 0} 1826 } 1827 }, 1828 {1, 1, 2, 0, /* 0xfb */ 1829 {{0, 1}, 1830 {3, 7}, 1831 {0, 0}, 1832 {0, 0} 1833 } 1834 }, 1835 {0, 1, 1, 0, /* 0xfc */ 1836 {{2, 7}, 1837 {0, 0}, 1838 {0, 0}, 1839 {0, 0} 1840 } 1841 }, 1842 {1, 1, 2, 0, /* 0xfd */ 1843 {{0, 0}, 1844 {2, 7}, 1845 {0, 0}, 1846 {0, 0} 1847 } 1848 }, 1849 {0, 1, 1, 0, /* 0xfe */ 1850 {{1, 7}, 1851 {0, 0}, 1852 {0, 0}, 1853 {0, 0} 1854 } 1855 }, 1856 {1, 1, 1, 0, /* 0xff */ 1857 {{0, 7}, 1858 {0, 0}, 1859 {0, 0}, 1860 {0, 0} 1861 } 1862 } 1863}; 1864 1865 1866int 1867sctp_is_address_in_scope(struct sctp_ifa *ifa, 1868 struct sctp_scoping *scope, 1869 int do_update) 1870{ 1871 if ((scope->loopback_scope == 0) && 1872 (ifa->ifn_p) && SCTP_IFN_IS_IFT_LOOP(ifa->ifn_p)) { 1873 /* 1874 * skip loopback if not in scope * 1875 */ 1876 return (0); 1877 } 1878 switch (ifa->address.sa.sa_family) { 1879#ifdef INET 1880 case AF_INET: 1881 if (scope->ipv4_addr_legal) { 1882 struct sockaddr_in *sin; 1883 1884 sin = &ifa->address.sin; 1885 if (sin->sin_addr.s_addr == 0) { 1886 /* not in scope , unspecified */ 1887 return (0); 1888 } 1889 if ((scope->ipv4_local_scope == 0) && 1890 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 1891 /* private address not in scope */ 1892 return (0); 1893 } 1894 } else { 1895 return (0); 1896 } 1897 break; 1898#endif 1899#ifdef INET6 1900 case AF_INET6: 1901 if (scope->ipv6_addr_legal) { 1902 struct sockaddr_in6 *sin6; 1903 1904 /* 1905 * Must update the flags, bummer, which means any 1906 * IFA locks must now be applied HERE <-> 1907 */ 1908 if (do_update) { 1909 sctp_gather_internal_ifa_flags(ifa); 1910 } 1911 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 1912 return (0); 1913 } 1914 /* ok to use deprecated addresses? */ 1915 sin6 = &ifa->address.sin6; 1916 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1917 /* skip unspecifed addresses */ 1918 return (0); 1919 } 1920 if ( /* (local_scope == 0) && */ 1921 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) { 1922 return (0); 1923 } 1924 if ((scope->site_scope == 0) && 1925 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 1926 return (0); 1927 } 1928 } else { 1929 return (0); 1930 } 1931 break; 1932#endif 1933 default: 1934 return (0); 1935 } 1936 return (1); 1937} 1938 1939static struct mbuf * 1940sctp_add_addr_to_mbuf(struct mbuf *m, struct sctp_ifa *ifa, uint16_t * len) 1941{ 1942#if defined(INET) || defined(INET6) 1943 struct sctp_paramhdr *parmh; 1944 struct mbuf *mret; 1945 uint16_t plen; 1946 1947#endif 1948 1949 switch (ifa->address.sa.sa_family) { 1950#ifdef INET 1951 case AF_INET: 1952 plen = (uint16_t) sizeof(struct sctp_ipv4addr_param); 1953 break; 1954#endif 1955#ifdef INET6 1956 case AF_INET6: 1957 plen = (uint16_t) sizeof(struct sctp_ipv6addr_param); 1958 break; 1959#endif 1960 default: 1961 return (m); 1962 } 1963#if defined(INET) || defined(INET6) 1964 if (M_TRAILINGSPACE(m) >= plen) { 1965 /* easy side we just drop it on the end */ 1966 parmh = (struct sctp_paramhdr *)(SCTP_BUF_AT(m, SCTP_BUF_LEN(m))); 1967 mret = m; 1968 } else { 1969 /* Need more space */ 1970 mret = m; 1971 while (SCTP_BUF_NEXT(mret) != NULL) { 1972 mret = SCTP_BUF_NEXT(mret); 1973 } 1974 SCTP_BUF_NEXT(mret) = sctp_get_mbuf_for_msg(plen, 0, M_NOWAIT, 1, MT_DATA); 1975 if (SCTP_BUF_NEXT(mret) == NULL) { 1976 /* We are hosed, can't add more addresses */ 1977 return (m); 1978 } 1979 mret = SCTP_BUF_NEXT(mret); 1980 parmh = mtod(mret, struct sctp_paramhdr *); 1981 } 1982 /* now add the parameter */ 1983 switch (ifa->address.sa.sa_family) { 1984#ifdef INET 1985 case AF_INET: 1986 { 1987 struct sctp_ipv4addr_param *ipv4p; 1988 struct sockaddr_in *sin; 1989 1990 sin = &ifa->address.sin; 1991 ipv4p = (struct sctp_ipv4addr_param *)parmh; 1992 parmh->param_type = htons(SCTP_IPV4_ADDRESS); 1993 parmh->param_length = htons(plen); 1994 ipv4p->addr = sin->sin_addr.s_addr; 1995 SCTP_BUF_LEN(mret) += plen; 1996 break; 1997 } 1998#endif 1999#ifdef INET6 2000 case AF_INET6: 2001 { 2002 struct sctp_ipv6addr_param *ipv6p; 2003 struct sockaddr_in6 *sin6; 2004 2005 sin6 = &ifa->address.sin6; 2006 ipv6p = (struct sctp_ipv6addr_param *)parmh; 2007 parmh->param_type = htons(SCTP_IPV6_ADDRESS); 2008 parmh->param_length = htons(plen); 2009 memcpy(ipv6p->addr, &sin6->sin6_addr, 2010 sizeof(ipv6p->addr)); 2011 /* clear embedded scope in the address */ 2012 in6_clearscope((struct in6_addr *)ipv6p->addr); 2013 SCTP_BUF_LEN(mret) += plen; 2014 break; 2015 } 2016#endif 2017 default: 2018 return (m); 2019 } 2020 if (len != NULL) { 2021 *len += plen; 2022 } 2023 return (mret); 2024#endif 2025} 2026 2027 2028struct mbuf * 2029sctp_add_addresses_to_i_ia(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2030 struct sctp_scoping *scope, 2031 struct mbuf *m_at, int cnt_inits_to, 2032 uint16_t * padding_len, uint16_t * chunk_len) 2033{ 2034 struct sctp_vrf *vrf = NULL; 2035 int cnt, limit_out = 0, total_count; 2036 uint32_t vrf_id; 2037 2038 vrf_id = inp->def_vrf_id; 2039 SCTP_IPI_ADDR_RLOCK(); 2040 vrf = sctp_find_vrf(vrf_id); 2041 if (vrf == NULL) { 2042 SCTP_IPI_ADDR_RUNLOCK(); 2043 return (m_at); 2044 } 2045 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 2046 struct sctp_ifa *sctp_ifap; 2047 struct sctp_ifn *sctp_ifnp; 2048 2049 cnt = cnt_inits_to; 2050 if (vrf->total_ifa_count > SCTP_COUNT_LIMIT) { 2051 limit_out = 1; 2052 cnt = SCTP_ADDRESS_LIMIT; 2053 goto skip_count; 2054 } 2055 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2056 if ((scope->loopback_scope == 0) && 2057 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2058 /* 2059 * Skip loopback devices if loopback_scope 2060 * not set 2061 */ 2062 continue; 2063 } 2064 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2065#ifdef INET 2066 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2067 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2068 &sctp_ifap->address.sin.sin_addr) != 0)) { 2069 continue; 2070 } 2071#endif 2072#ifdef INET6 2073 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2074 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2075 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2076 continue; 2077 } 2078#endif 2079 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2080 continue; 2081 } 2082 if (sctp_is_address_in_scope(sctp_ifap, scope, 1) == 0) { 2083 continue; 2084 } 2085 cnt++; 2086 if (cnt > SCTP_ADDRESS_LIMIT) { 2087 break; 2088 } 2089 } 2090 if (cnt > SCTP_ADDRESS_LIMIT) { 2091 break; 2092 } 2093 } 2094skip_count: 2095 if (cnt > 1) { 2096 total_count = 0; 2097 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2098 cnt = 0; 2099 if ((scope->loopback_scope == 0) && 2100 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2101 /* 2102 * Skip loopback devices if 2103 * loopback_scope not set 2104 */ 2105 continue; 2106 } 2107 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2108#ifdef INET 2109 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2110 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2111 &sctp_ifap->address.sin.sin_addr) != 0)) { 2112 continue; 2113 } 2114#endif 2115#ifdef INET6 2116 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2117 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2118 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2119 continue; 2120 } 2121#endif 2122 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2123 continue; 2124 } 2125 if (sctp_is_address_in_scope(sctp_ifap, 2126 scope, 0) == 0) { 2127 continue; 2128 } 2129 if ((chunk_len != NULL) && 2130 (padding_len != NULL) && 2131 (*padding_len > 0)) { 2132 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2133 SCTP_BUF_LEN(m_at) += *padding_len; 2134 *chunk_len += *padding_len; 2135 *padding_len = 0; 2136 } 2137 m_at = sctp_add_addr_to_mbuf(m_at, sctp_ifap, chunk_len); 2138 if (limit_out) { 2139 cnt++; 2140 total_count++; 2141 if (cnt >= 2) { 2142 /* 2143 * two from each 2144 * address 2145 */ 2146 break; 2147 } 2148 if (total_count > SCTP_ADDRESS_LIMIT) { 2149 /* No more addresses */ 2150 break; 2151 } 2152 } 2153 } 2154 } 2155 } 2156 } else { 2157 struct sctp_laddr *laddr; 2158 2159 cnt = cnt_inits_to; 2160 /* First, how many ? */ 2161 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2162 if (laddr->ifa == NULL) { 2163 continue; 2164 } 2165 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) 2166 /* 2167 * Address being deleted by the system, dont 2168 * list. 2169 */ 2170 continue; 2171 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2172 /* 2173 * Address being deleted on this ep don't 2174 * list. 2175 */ 2176 continue; 2177 } 2178 if (sctp_is_address_in_scope(laddr->ifa, 2179 scope, 1) == 0) { 2180 continue; 2181 } 2182 cnt++; 2183 } 2184 /* 2185 * To get through a NAT we only list addresses if we have 2186 * more than one. That way if you just bind a single address 2187 * we let the source of the init dictate our address. 2188 */ 2189 if (cnt > 1) { 2190 cnt = cnt_inits_to; 2191 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2192 if (laddr->ifa == NULL) { 2193 continue; 2194 } 2195 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) { 2196 continue; 2197 } 2198 if (sctp_is_address_in_scope(laddr->ifa, 2199 scope, 0) == 0) { 2200 continue; 2201 } 2202 if ((chunk_len != NULL) && 2203 (padding_len != NULL) && 2204 (*padding_len > 0)) { 2205 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2206 SCTP_BUF_LEN(m_at) += *padding_len; 2207 *chunk_len += *padding_len; 2208 *padding_len = 0; 2209 } 2210 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa, chunk_len); 2211 cnt++; 2212 if (cnt >= SCTP_ADDRESS_LIMIT) { 2213 break; 2214 } 2215 } 2216 } 2217 } 2218 SCTP_IPI_ADDR_RUNLOCK(); 2219 return (m_at); 2220} 2221 2222static struct sctp_ifa * 2223sctp_is_ifa_addr_preferred(struct sctp_ifa *ifa, 2224 uint8_t dest_is_loop, 2225 uint8_t dest_is_priv, 2226 sa_family_t fam) 2227{ 2228 uint8_t dest_is_global = 0; 2229 2230 /* dest_is_priv is true if destination is a private address */ 2231 /* dest_is_loop is true if destination is a loopback addresses */ 2232 2233 /** 2234 * Here we determine if its a preferred address. A preferred address 2235 * means it is the same scope or higher scope then the destination. 2236 * L = loopback, P = private, G = global 2237 * ----------------------------------------- 2238 * src | dest | result 2239 * ---------------------------------------- 2240 * L | L | yes 2241 * ----------------------------------------- 2242 * P | L | yes-v4 no-v6 2243 * ----------------------------------------- 2244 * G | L | yes-v4 no-v6 2245 * ----------------------------------------- 2246 * L | P | no 2247 * ----------------------------------------- 2248 * P | P | yes 2249 * ----------------------------------------- 2250 * G | P | no 2251 * ----------------------------------------- 2252 * L | G | no 2253 * ----------------------------------------- 2254 * P | G | no 2255 * ----------------------------------------- 2256 * G | G | yes 2257 * ----------------------------------------- 2258 */ 2259 2260 if (ifa->address.sa.sa_family != fam) { 2261 /* forget mis-matched family */ 2262 return (NULL); 2263 } 2264 if ((dest_is_priv == 0) && (dest_is_loop == 0)) { 2265 dest_is_global = 1; 2266 } 2267 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Is destination preferred:"); 2268 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ifa->address.sa); 2269 /* Ok the address may be ok */ 2270#ifdef INET6 2271 if (fam == AF_INET6) { 2272 /* ok to use deprecated addresses? no lets not! */ 2273 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2274 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:1\n"); 2275 return (NULL); 2276 } 2277 if (ifa->src_is_priv && !ifa->src_is_loop) { 2278 if (dest_is_loop) { 2279 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:2\n"); 2280 return (NULL); 2281 } 2282 } 2283 if (ifa->src_is_glob) { 2284 if (dest_is_loop) { 2285 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:3\n"); 2286 return (NULL); 2287 } 2288 } 2289 } 2290#endif 2291 /* 2292 * Now that we know what is what, implement or table this could in 2293 * theory be done slicker (it used to be), but this is 2294 * straightforward and easier to validate :-) 2295 */ 2296 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src_loop:%d src_priv:%d src_glob:%d\n", 2297 ifa->src_is_loop, ifa->src_is_priv, ifa->src_is_glob); 2298 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dest_loop:%d dest_priv:%d dest_glob:%d\n", 2299 dest_is_loop, dest_is_priv, dest_is_global); 2300 2301 if ((ifa->src_is_loop) && (dest_is_priv)) { 2302 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:4\n"); 2303 return (NULL); 2304 } 2305 if ((ifa->src_is_glob) && (dest_is_priv)) { 2306 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:5\n"); 2307 return (NULL); 2308 } 2309 if ((ifa->src_is_loop) && (dest_is_global)) { 2310 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:6\n"); 2311 return (NULL); 2312 } 2313 if ((ifa->src_is_priv) && (dest_is_global)) { 2314 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:7\n"); 2315 return (NULL); 2316 } 2317 SCTPDBG(SCTP_DEBUG_OUTPUT3, "YES\n"); 2318 /* its a preferred address */ 2319 return (ifa); 2320} 2321 2322static struct sctp_ifa * 2323sctp_is_ifa_addr_acceptable(struct sctp_ifa *ifa, 2324 uint8_t dest_is_loop, 2325 uint8_t dest_is_priv, 2326 sa_family_t fam) 2327{ 2328 uint8_t dest_is_global = 0; 2329 2330 /** 2331 * Here we determine if its a acceptable address. A acceptable 2332 * address means it is the same scope or higher scope but we can 2333 * allow for NAT which means its ok to have a global dest and a 2334 * private src. 2335 * 2336 * L = loopback, P = private, G = global 2337 * ----------------------------------------- 2338 * src | dest | result 2339 * ----------------------------------------- 2340 * L | L | yes 2341 * ----------------------------------------- 2342 * P | L | yes-v4 no-v6 2343 * ----------------------------------------- 2344 * G | L | yes 2345 * ----------------------------------------- 2346 * L | P | no 2347 * ----------------------------------------- 2348 * P | P | yes 2349 * ----------------------------------------- 2350 * G | P | yes - May not work 2351 * ----------------------------------------- 2352 * L | G | no 2353 * ----------------------------------------- 2354 * P | G | yes - May not work 2355 * ----------------------------------------- 2356 * G | G | yes 2357 * ----------------------------------------- 2358 */ 2359 2360 if (ifa->address.sa.sa_family != fam) { 2361 /* forget non matching family */ 2362 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa_fam:%d fam:%d\n", 2363 ifa->address.sa.sa_family, fam); 2364 return (NULL); 2365 } 2366 /* Ok the address may be ok */ 2367 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, &ifa->address.sa); 2368 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst_is_loop:%d dest_is_priv:%d\n", 2369 dest_is_loop, dest_is_priv); 2370 if ((dest_is_loop == 0) && (dest_is_priv == 0)) { 2371 dest_is_global = 1; 2372 } 2373#ifdef INET6 2374 if (fam == AF_INET6) { 2375 /* ok to use deprecated addresses? */ 2376 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2377 return (NULL); 2378 } 2379 if (ifa->src_is_priv) { 2380 /* Special case, linklocal to loop */ 2381 if (dest_is_loop) 2382 return (NULL); 2383 } 2384 } 2385#endif 2386 /* 2387 * Now that we know what is what, implement our table. This could in 2388 * theory be done slicker (it used to be), but this is 2389 * straightforward and easier to validate :-) 2390 */ 2391 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_priv:%d\n", 2392 ifa->src_is_loop, 2393 dest_is_priv); 2394 if ((ifa->src_is_loop == 1) && (dest_is_priv)) { 2395 return (NULL); 2396 } 2397 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_glob:%d\n", 2398 ifa->src_is_loop, 2399 dest_is_global); 2400 if ((ifa->src_is_loop == 1) && (dest_is_global)) { 2401 return (NULL); 2402 } 2403 SCTPDBG(SCTP_DEBUG_OUTPUT3, "address is acceptable\n"); 2404 /* its an acceptable address */ 2405 return (ifa); 2406} 2407 2408int 2409sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa) 2410{ 2411 struct sctp_laddr *laddr; 2412 2413 if (stcb == NULL) { 2414 /* There are no restrictions, no TCB :-) */ 2415 return (0); 2416 } 2417 LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) { 2418 if (laddr->ifa == NULL) { 2419 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2420 __FUNCTION__); 2421 continue; 2422 } 2423 if (laddr->ifa == ifa) { 2424 /* Yes it is on the list */ 2425 return (1); 2426 } 2427 } 2428 return (0); 2429} 2430 2431 2432int 2433sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa) 2434{ 2435 struct sctp_laddr *laddr; 2436 2437 if (ifa == NULL) 2438 return (0); 2439 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2440 if (laddr->ifa == NULL) { 2441 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2442 __FUNCTION__); 2443 continue; 2444 } 2445 if ((laddr->ifa == ifa) && laddr->action == 0) 2446 /* same pointer */ 2447 return (1); 2448 } 2449 return (0); 2450} 2451 2452 2453 2454static struct sctp_ifa * 2455sctp_choose_boundspecific_inp(struct sctp_inpcb *inp, 2456 sctp_route_t * ro, 2457 uint32_t vrf_id, 2458 int non_asoc_addr_ok, 2459 uint8_t dest_is_priv, 2460 uint8_t dest_is_loop, 2461 sa_family_t fam) 2462{ 2463 struct sctp_laddr *laddr, *starting_point; 2464 void *ifn; 2465 int resettotop = 0; 2466 struct sctp_ifn *sctp_ifn; 2467 struct sctp_ifa *sctp_ifa, *sifa; 2468 struct sctp_vrf *vrf; 2469 uint32_t ifn_index; 2470 2471 vrf = sctp_find_vrf(vrf_id); 2472 if (vrf == NULL) 2473 return (NULL); 2474 2475 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2476 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2477 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2478 /* 2479 * first question, is the ifn we will emit on in our list, if so, we 2480 * want such an address. Note that we first looked for a preferred 2481 * address. 2482 */ 2483 if (sctp_ifn) { 2484 /* is a preferred one on the interface we route out? */ 2485 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2486#ifdef INET 2487 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2488 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2489 &sctp_ifa->address.sin.sin_addr) != 0)) { 2490 continue; 2491 } 2492#endif 2493#ifdef INET6 2494 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2495 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2496 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2497 continue; 2498 } 2499#endif 2500 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2501 (non_asoc_addr_ok == 0)) 2502 continue; 2503 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, 2504 dest_is_loop, 2505 dest_is_priv, fam); 2506 if (sifa == NULL) 2507 continue; 2508 if (sctp_is_addr_in_ep(inp, sifa)) { 2509 atomic_add_int(&sifa->refcount, 1); 2510 return (sifa); 2511 } 2512 } 2513 } 2514 /* 2515 * ok, now we now need to find one on the list of the addresses. We 2516 * can't get one on the emitting interface so let's find first a 2517 * preferred one. If not that an acceptable one otherwise... we 2518 * return NULL. 2519 */ 2520 starting_point = inp->next_addr_touse; 2521once_again: 2522 if (inp->next_addr_touse == NULL) { 2523 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2524 resettotop = 1; 2525 } 2526 for (laddr = inp->next_addr_touse; laddr; 2527 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2528 if (laddr->ifa == NULL) { 2529 /* address has been removed */ 2530 continue; 2531 } 2532 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2533 /* address is being deleted */ 2534 continue; 2535 } 2536 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, 2537 dest_is_priv, fam); 2538 if (sifa == NULL) 2539 continue; 2540 atomic_add_int(&sifa->refcount, 1); 2541 return (sifa); 2542 } 2543 if (resettotop == 0) { 2544 inp->next_addr_touse = NULL; 2545 goto once_again; 2546 } 2547 inp->next_addr_touse = starting_point; 2548 resettotop = 0; 2549once_again_too: 2550 if (inp->next_addr_touse == NULL) { 2551 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2552 resettotop = 1; 2553 } 2554 /* ok, what about an acceptable address in the inp */ 2555 for (laddr = inp->next_addr_touse; laddr; 2556 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2557 if (laddr->ifa == NULL) { 2558 /* address has been removed */ 2559 continue; 2560 } 2561 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2562 /* address is being deleted */ 2563 continue; 2564 } 2565 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2566 dest_is_priv, fam); 2567 if (sifa == NULL) 2568 continue; 2569 atomic_add_int(&sifa->refcount, 1); 2570 return (sifa); 2571 } 2572 if (resettotop == 0) { 2573 inp->next_addr_touse = NULL; 2574 goto once_again_too; 2575 } 2576 /* 2577 * no address bound can be a source for the destination we are in 2578 * trouble 2579 */ 2580 return (NULL); 2581} 2582 2583 2584 2585static struct sctp_ifa * 2586sctp_choose_boundspecific_stcb(struct sctp_inpcb *inp, 2587 struct sctp_tcb *stcb, 2588 sctp_route_t * ro, 2589 uint32_t vrf_id, 2590 uint8_t dest_is_priv, 2591 uint8_t dest_is_loop, 2592 int non_asoc_addr_ok, 2593 sa_family_t fam) 2594{ 2595 struct sctp_laddr *laddr, *starting_point; 2596 void *ifn; 2597 struct sctp_ifn *sctp_ifn; 2598 struct sctp_ifa *sctp_ifa, *sifa; 2599 uint8_t start_at_beginning = 0; 2600 struct sctp_vrf *vrf; 2601 uint32_t ifn_index; 2602 2603 /* 2604 * first question, is the ifn we will emit on in our list, if so, we 2605 * want that one. 2606 */ 2607 vrf = sctp_find_vrf(vrf_id); 2608 if (vrf == NULL) 2609 return (NULL); 2610 2611 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2612 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2613 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2614 2615 /* 2616 * first question, is the ifn we will emit on in our list? If so, 2617 * we want that one. First we look for a preferred. Second, we go 2618 * for an acceptable. 2619 */ 2620 if (sctp_ifn) { 2621 /* first try for a preferred address on the ep */ 2622 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2623#ifdef INET 2624 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2625 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2626 &sctp_ifa->address.sin.sin_addr) != 0)) { 2627 continue; 2628 } 2629#endif 2630#ifdef INET6 2631 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2632 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2633 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2634 continue; 2635 } 2636#endif 2637 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2638 continue; 2639 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2640 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2641 if (sifa == NULL) 2642 continue; 2643 if (((non_asoc_addr_ok == 0) && 2644 (sctp_is_addr_restricted(stcb, sifa))) || 2645 (non_asoc_addr_ok && 2646 (sctp_is_addr_restricted(stcb, sifa)) && 2647 (!sctp_is_addr_pending(stcb, sifa)))) { 2648 /* on the no-no list */ 2649 continue; 2650 } 2651 atomic_add_int(&sifa->refcount, 1); 2652 return (sifa); 2653 } 2654 } 2655 /* next try for an acceptable address on the ep */ 2656 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2657#ifdef INET 2658 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2659 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2660 &sctp_ifa->address.sin.sin_addr) != 0)) { 2661 continue; 2662 } 2663#endif 2664#ifdef INET6 2665 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2666 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2667 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2668 continue; 2669 } 2670#endif 2671 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2672 continue; 2673 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2674 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2675 if (sifa == NULL) 2676 continue; 2677 if (((non_asoc_addr_ok == 0) && 2678 (sctp_is_addr_restricted(stcb, sifa))) || 2679 (non_asoc_addr_ok && 2680 (sctp_is_addr_restricted(stcb, sifa)) && 2681 (!sctp_is_addr_pending(stcb, sifa)))) { 2682 /* on the no-no list */ 2683 continue; 2684 } 2685 atomic_add_int(&sifa->refcount, 1); 2686 return (sifa); 2687 } 2688 } 2689 2690 } 2691 /* 2692 * if we can't find one like that then we must look at all addresses 2693 * bound to pick one at first preferable then secondly acceptable. 2694 */ 2695 starting_point = stcb->asoc.last_used_address; 2696sctp_from_the_top: 2697 if (stcb->asoc.last_used_address == NULL) { 2698 start_at_beginning = 1; 2699 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2700 } 2701 /* search beginning with the last used address */ 2702 for (laddr = stcb->asoc.last_used_address; laddr; 2703 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2704 if (laddr->ifa == NULL) { 2705 /* address has been removed */ 2706 continue; 2707 } 2708 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2709 /* address is being deleted */ 2710 continue; 2711 } 2712 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, dest_is_priv, fam); 2713 if (sifa == NULL) 2714 continue; 2715 if (((non_asoc_addr_ok == 0) && 2716 (sctp_is_addr_restricted(stcb, sifa))) || 2717 (non_asoc_addr_ok && 2718 (sctp_is_addr_restricted(stcb, sifa)) && 2719 (!sctp_is_addr_pending(stcb, sifa)))) { 2720 /* on the no-no list */ 2721 continue; 2722 } 2723 stcb->asoc.last_used_address = laddr; 2724 atomic_add_int(&sifa->refcount, 1); 2725 return (sifa); 2726 } 2727 if (start_at_beginning == 0) { 2728 stcb->asoc.last_used_address = NULL; 2729 goto sctp_from_the_top; 2730 } 2731 /* now try for any higher scope than the destination */ 2732 stcb->asoc.last_used_address = starting_point; 2733 start_at_beginning = 0; 2734sctp_from_the_top2: 2735 if (stcb->asoc.last_used_address == NULL) { 2736 start_at_beginning = 1; 2737 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2738 } 2739 /* search beginning with the last used address */ 2740 for (laddr = stcb->asoc.last_used_address; laddr; 2741 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2742 if (laddr->ifa == NULL) { 2743 /* address has been removed */ 2744 continue; 2745 } 2746 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2747 /* address is being deleted */ 2748 continue; 2749 } 2750 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2751 dest_is_priv, fam); 2752 if (sifa == NULL) 2753 continue; 2754 if (((non_asoc_addr_ok == 0) && 2755 (sctp_is_addr_restricted(stcb, sifa))) || 2756 (non_asoc_addr_ok && 2757 (sctp_is_addr_restricted(stcb, sifa)) && 2758 (!sctp_is_addr_pending(stcb, sifa)))) { 2759 /* on the no-no list */ 2760 continue; 2761 } 2762 stcb->asoc.last_used_address = laddr; 2763 atomic_add_int(&sifa->refcount, 1); 2764 return (sifa); 2765 } 2766 if (start_at_beginning == 0) { 2767 stcb->asoc.last_used_address = NULL; 2768 goto sctp_from_the_top2; 2769 } 2770 return (NULL); 2771} 2772 2773static struct sctp_ifa * 2774sctp_select_nth_preferred_addr_from_ifn_boundall(struct sctp_ifn *ifn, 2775 struct sctp_inpcb *inp, 2776 struct sctp_tcb *stcb, 2777 int non_asoc_addr_ok, 2778 uint8_t dest_is_loop, 2779 uint8_t dest_is_priv, 2780 int addr_wanted, 2781 sa_family_t fam, 2782 sctp_route_t * ro 2783) 2784{ 2785 struct sctp_ifa *ifa, *sifa; 2786 int num_eligible_addr = 0; 2787 2788#ifdef INET6 2789 struct sockaddr_in6 sin6, lsa6; 2790 2791 if (fam == AF_INET6) { 2792 memcpy(&sin6, &ro->ro_dst, sizeof(struct sockaddr_in6)); 2793 (void)sa6_recoverscope(&sin6); 2794 } 2795#endif /* INET6 */ 2796 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2797#ifdef INET 2798 if ((ifa->address.sa.sa_family == AF_INET) && 2799 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2800 &ifa->address.sin.sin_addr) != 0)) { 2801 continue; 2802 } 2803#endif 2804#ifdef INET6 2805 if ((ifa->address.sa.sa_family == AF_INET6) && 2806 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2807 &ifa->address.sin6.sin6_addr) != 0)) { 2808 continue; 2809 } 2810#endif 2811 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2812 (non_asoc_addr_ok == 0)) 2813 continue; 2814 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2815 dest_is_priv, fam); 2816 if (sifa == NULL) 2817 continue; 2818#ifdef INET6 2819 if (fam == AF_INET6 && 2820 dest_is_loop && 2821 sifa->src_is_loop && sifa->src_is_priv) { 2822 /* 2823 * don't allow fe80::1 to be a src on loop ::1, we 2824 * don't list it to the peer so we will get an 2825 * abort. 2826 */ 2827 continue; 2828 } 2829 if (fam == AF_INET6 && 2830 IN6_IS_ADDR_LINKLOCAL(&sifa->address.sin6.sin6_addr) && 2831 IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) { 2832 /* 2833 * link-local <-> link-local must belong to the same 2834 * scope. 2835 */ 2836 memcpy(&lsa6, &sifa->address.sin6, sizeof(struct sockaddr_in6)); 2837 (void)sa6_recoverscope(&lsa6); 2838 if (sin6.sin6_scope_id != lsa6.sin6_scope_id) { 2839 continue; 2840 } 2841 } 2842#endif /* INET6 */ 2843 2844 /* 2845 * Check if the IPv6 address matches to next-hop. In the 2846 * mobile case, old IPv6 address may be not deleted from the 2847 * interface. Then, the interface has previous and new 2848 * addresses. We should use one corresponding to the 2849 * next-hop. (by micchie) 2850 */ 2851#ifdef INET6 2852 if (stcb && fam == AF_INET6 && 2853 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2854 if (sctp_v6src_match_nexthop(&sifa->address.sin6, ro) 2855 == 0) { 2856 continue; 2857 } 2858 } 2859#endif 2860#ifdef INET 2861 /* Avoid topologically incorrect IPv4 address */ 2862 if (stcb && fam == AF_INET && 2863 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2864 if (sctp_v4src_match_nexthop(sifa, ro) == 0) { 2865 continue; 2866 } 2867 } 2868#endif 2869 if (stcb) { 2870 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2871 continue; 2872 } 2873 if (((non_asoc_addr_ok == 0) && 2874 (sctp_is_addr_restricted(stcb, sifa))) || 2875 (non_asoc_addr_ok && 2876 (sctp_is_addr_restricted(stcb, sifa)) && 2877 (!sctp_is_addr_pending(stcb, sifa)))) { 2878 /* 2879 * It is restricted for some reason.. 2880 * probably not yet added. 2881 */ 2882 continue; 2883 } 2884 } 2885 if (num_eligible_addr >= addr_wanted) { 2886 return (sifa); 2887 } 2888 num_eligible_addr++; 2889 } 2890 return (NULL); 2891} 2892 2893 2894static int 2895sctp_count_num_preferred_boundall(struct sctp_ifn *ifn, 2896 struct sctp_inpcb *inp, 2897 struct sctp_tcb *stcb, 2898 int non_asoc_addr_ok, 2899 uint8_t dest_is_loop, 2900 uint8_t dest_is_priv, 2901 sa_family_t fam) 2902{ 2903 struct sctp_ifa *ifa, *sifa; 2904 int num_eligible_addr = 0; 2905 2906 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2907#ifdef INET 2908 if ((ifa->address.sa.sa_family == AF_INET) && 2909 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2910 &ifa->address.sin.sin_addr) != 0)) { 2911 continue; 2912 } 2913#endif 2914#ifdef INET6 2915 if ((ifa->address.sa.sa_family == AF_INET6) && 2916 (stcb != NULL) && 2917 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2918 &ifa->address.sin6.sin6_addr) != 0)) { 2919 continue; 2920 } 2921#endif 2922 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2923 (non_asoc_addr_ok == 0)) { 2924 continue; 2925 } 2926 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2927 dest_is_priv, fam); 2928 if (sifa == NULL) { 2929 continue; 2930 } 2931 if (stcb) { 2932 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2933 continue; 2934 } 2935 if (((non_asoc_addr_ok == 0) && 2936 (sctp_is_addr_restricted(stcb, sifa))) || 2937 (non_asoc_addr_ok && 2938 (sctp_is_addr_restricted(stcb, sifa)) && 2939 (!sctp_is_addr_pending(stcb, sifa)))) { 2940 /* 2941 * It is restricted for some reason.. 2942 * probably not yet added. 2943 */ 2944 continue; 2945 } 2946 } 2947 num_eligible_addr++; 2948 } 2949 return (num_eligible_addr); 2950} 2951 2952static struct sctp_ifa * 2953sctp_choose_boundall(struct sctp_inpcb *inp, 2954 struct sctp_tcb *stcb, 2955 struct sctp_nets *net, 2956 sctp_route_t * ro, 2957 uint32_t vrf_id, 2958 uint8_t dest_is_priv, 2959 uint8_t dest_is_loop, 2960 int non_asoc_addr_ok, 2961 sa_family_t fam) 2962{ 2963 int cur_addr_num = 0, num_preferred = 0; 2964 void *ifn; 2965 struct sctp_ifn *sctp_ifn, *looked_at = NULL, *emit_ifn; 2966 struct sctp_ifa *sctp_ifa, *sifa; 2967 uint32_t ifn_index; 2968 struct sctp_vrf *vrf; 2969 2970#ifdef INET 2971 int retried = 0; 2972 2973#endif 2974 2975 /*- 2976 * For boundall we can use any address in the association. 2977 * If non_asoc_addr_ok is set we can use any address (at least in 2978 * theory). So we look for preferred addresses first. If we find one, 2979 * we use it. Otherwise we next try to get an address on the 2980 * interface, which we should be able to do (unless non_asoc_addr_ok 2981 * is false and we are routed out that way). In these cases where we 2982 * can't use the address of the interface we go through all the 2983 * ifn's looking for an address we can use and fill that in. Punting 2984 * means we send back address 0, which will probably cause problems 2985 * actually since then IP will fill in the address of the route ifn, 2986 * which means we probably already rejected it.. i.e. here comes an 2987 * abort :-<. 2988 */ 2989 vrf = sctp_find_vrf(vrf_id); 2990 if (vrf == NULL) 2991 return (NULL); 2992 2993 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2994 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2995 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn from route:%p ifn_index:%d\n", ifn, ifn_index); 2996 emit_ifn = looked_at = sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2997 if (sctp_ifn == NULL) { 2998 /* ?? We don't have this guy ?? */ 2999 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No ifn emit interface?\n"); 3000 goto bound_all_plan_b; 3001 } 3002 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn_index:%d name:%s is emit interface\n", 3003 ifn_index, sctp_ifn->ifn_name); 3004 3005 if (net) { 3006 cur_addr_num = net->indx_of_eligible_next_to_use; 3007 } 3008 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, 3009 inp, stcb, 3010 non_asoc_addr_ok, 3011 dest_is_loop, 3012 dest_is_priv, fam); 3013 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Found %d preferred source addresses for intf:%s\n", 3014 num_preferred, sctp_ifn->ifn_name); 3015 if (num_preferred == 0) { 3016 /* 3017 * no eligible addresses, we must use some other interface 3018 * address if we can find one. 3019 */ 3020 goto bound_all_plan_b; 3021 } 3022 /* 3023 * Ok we have num_eligible_addr set with how many we can use, this 3024 * may vary from call to call due to addresses being deprecated 3025 * etc.. 3026 */ 3027 if (cur_addr_num >= num_preferred) { 3028 cur_addr_num = 0; 3029 } 3030 /* 3031 * select the nth address from the list (where cur_addr_num is the 3032 * nth) and 0 is the first one, 1 is the second one etc... 3033 */ 3034 SCTPDBG(SCTP_DEBUG_OUTPUT2, "cur_addr_num:%d\n", cur_addr_num); 3035 3036 sctp_ifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3037 dest_is_priv, cur_addr_num, fam, ro); 3038 3039 /* if sctp_ifa is NULL something changed??, fall to plan b. */ 3040 if (sctp_ifa) { 3041 atomic_add_int(&sctp_ifa->refcount, 1); 3042 if (net) { 3043 /* save off where the next one we will want */ 3044 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3045 } 3046 return (sctp_ifa); 3047 } 3048 /* 3049 * plan_b: Look at all interfaces and find a preferred address. If 3050 * no preferred fall through to plan_c. 3051 */ 3052bound_all_plan_b: 3053 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan B\n"); 3054 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3055 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Examine interface %s\n", 3056 sctp_ifn->ifn_name); 3057 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3058 /* wrong base scope */ 3059 SCTPDBG(SCTP_DEBUG_OUTPUT2, "skip\n"); 3060 continue; 3061 } 3062 if ((sctp_ifn == looked_at) && looked_at) { 3063 /* already looked at this guy */ 3064 SCTPDBG(SCTP_DEBUG_OUTPUT2, "already seen\n"); 3065 continue; 3066 } 3067 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, 3068 dest_is_loop, dest_is_priv, fam); 3069 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3070 "Found ifn:%p %d preferred source addresses\n", 3071 ifn, num_preferred); 3072 if (num_preferred == 0) { 3073 /* None on this interface. */ 3074 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefered -- skipping to next\n"); 3075 continue; 3076 } 3077 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3078 "num preferred:%d on interface:%p cur_addr_num:%d\n", 3079 num_preferred, (void *)sctp_ifn, cur_addr_num); 3080 3081 /* 3082 * Ok we have num_eligible_addr set with how many we can 3083 * use, this may vary from call to call due to addresses 3084 * being deprecated etc.. 3085 */ 3086 if (cur_addr_num >= num_preferred) { 3087 cur_addr_num = 0; 3088 } 3089 sifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3090 dest_is_priv, cur_addr_num, fam, ro); 3091 if (sifa == NULL) 3092 continue; 3093 if (net) { 3094 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3095 SCTPDBG(SCTP_DEBUG_OUTPUT2, "we selected %d\n", 3096 cur_addr_num); 3097 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Source:"); 3098 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 3099 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Dest:"); 3100 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &net->ro._l_addr.sa); 3101 } 3102 atomic_add_int(&sifa->refcount, 1); 3103 return (sifa); 3104 } 3105#ifdef INET 3106again_with_private_addresses_allowed: 3107#endif 3108 /* plan_c: do we have an acceptable address on the emit interface */ 3109 sifa = NULL; 3110 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan C: find acceptable on interface\n"); 3111 if (emit_ifn == NULL) { 3112 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jump to Plan D - no emit_ifn\n"); 3113 goto plan_d; 3114 } 3115 LIST_FOREACH(sctp_ifa, &emit_ifn->ifalist, next_ifa) { 3116 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifa:%p\n", (void *)sctp_ifa); 3117#ifdef INET 3118 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3119 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3120 &sctp_ifa->address.sin.sin_addr) != 0)) { 3121 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3122 continue; 3123 } 3124#endif 3125#ifdef INET6 3126 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3127 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3128 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3129 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3130 continue; 3131 } 3132#endif 3133 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3134 (non_asoc_addr_ok == 0)) { 3135 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Defer\n"); 3136 continue; 3137 } 3138 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, 3139 dest_is_priv, fam); 3140 if (sifa == NULL) { 3141 SCTPDBG(SCTP_DEBUG_OUTPUT2, "IFA not acceptable\n"); 3142 continue; 3143 } 3144 if (stcb) { 3145 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3146 SCTPDBG(SCTP_DEBUG_OUTPUT2, "NOT in scope\n"); 3147 sifa = NULL; 3148 continue; 3149 } 3150 if (((non_asoc_addr_ok == 0) && 3151 (sctp_is_addr_restricted(stcb, sifa))) || 3152 (non_asoc_addr_ok && 3153 (sctp_is_addr_restricted(stcb, sifa)) && 3154 (!sctp_is_addr_pending(stcb, sifa)))) { 3155 /* 3156 * It is restricted for some reason.. 3157 * probably not yet added. 3158 */ 3159 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Its resticted\n"); 3160 sifa = NULL; 3161 continue; 3162 } 3163 } else { 3164 SCTP_PRINTF("Stcb is null - no print\n"); 3165 } 3166 atomic_add_int(&sifa->refcount, 1); 3167 goto out; 3168 } 3169plan_d: 3170 /* 3171 * plan_d: We are in trouble. No preferred address on the emit 3172 * interface. And not even a preferred address on all interfaces. Go 3173 * out and see if we can find an acceptable address somewhere 3174 * amongst all interfaces. 3175 */ 3176 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan D looked_at is %p\n", (void *)looked_at); 3177 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3178 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3179 /* wrong base scope */ 3180 continue; 3181 } 3182 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3183#ifdef INET 3184 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3185 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3186 &sctp_ifa->address.sin.sin_addr) != 0)) { 3187 continue; 3188 } 3189#endif 3190#ifdef INET6 3191 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3192 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3193 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3194 continue; 3195 } 3196#endif 3197 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3198 (non_asoc_addr_ok == 0)) 3199 continue; 3200 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3201 dest_is_loop, 3202 dest_is_priv, fam); 3203 if (sifa == NULL) 3204 continue; 3205 if (stcb) { 3206 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3207 sifa = NULL; 3208 continue; 3209 } 3210 if (((non_asoc_addr_ok == 0) && 3211 (sctp_is_addr_restricted(stcb, sifa))) || 3212 (non_asoc_addr_ok && 3213 (sctp_is_addr_restricted(stcb, sifa)) && 3214 (!sctp_is_addr_pending(stcb, sifa)))) { 3215 /* 3216 * It is restricted for some 3217 * reason.. probably not yet added. 3218 */ 3219 sifa = NULL; 3220 continue; 3221 } 3222 } 3223 goto out; 3224 } 3225 } 3226#ifdef INET 3227 if ((retried == 0) && (stcb->asoc.scope.ipv4_local_scope == 0)) { 3228 stcb->asoc.scope.ipv4_local_scope = 1; 3229 retried = 1; 3230 goto again_with_private_addresses_allowed; 3231 } else if (retried == 1) { 3232 stcb->asoc.scope.ipv4_local_scope = 0; 3233 } 3234#endif 3235out: 3236#ifdef INET 3237 if (sifa) { 3238 if (retried == 1) { 3239 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3240 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3241 /* wrong base scope */ 3242 continue; 3243 } 3244 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3245 struct sctp_ifa *tmp_sifa; 3246 3247#ifdef INET 3248 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3249 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3250 &sctp_ifa->address.sin.sin_addr) != 0)) { 3251 continue; 3252 } 3253#endif 3254#ifdef INET6 3255 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3256 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3257 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3258 continue; 3259 } 3260#endif 3261 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3262 (non_asoc_addr_ok == 0)) 3263 continue; 3264 tmp_sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3265 dest_is_loop, 3266 dest_is_priv, fam); 3267 if (tmp_sifa == NULL) { 3268 continue; 3269 } 3270 if (tmp_sifa == sifa) { 3271 continue; 3272 } 3273 if (stcb) { 3274 if (sctp_is_address_in_scope(tmp_sifa, 3275 &stcb->asoc.scope, 0) == 0) { 3276 continue; 3277 } 3278 if (((non_asoc_addr_ok == 0) && 3279 (sctp_is_addr_restricted(stcb, tmp_sifa))) || 3280 (non_asoc_addr_ok && 3281 (sctp_is_addr_restricted(stcb, tmp_sifa)) && 3282 (!sctp_is_addr_pending(stcb, tmp_sifa)))) { 3283 /* 3284 * It is restricted 3285 * for some reason.. 3286 * probably not yet 3287 * added. 3288 */ 3289 continue; 3290 } 3291 } 3292 if ((tmp_sifa->address.sin.sin_family == AF_INET) && 3293 (IN4_ISPRIVATE_ADDRESS(&(tmp_sifa->address.sin.sin_addr)))) { 3294 sctp_add_local_addr_restricted(stcb, tmp_sifa); 3295 } 3296 } 3297 } 3298 } 3299 atomic_add_int(&sifa->refcount, 1); 3300 } 3301#endif 3302 return (sifa); 3303} 3304 3305 3306 3307/* tcb may be NULL */ 3308struct sctp_ifa * 3309sctp_source_address_selection(struct sctp_inpcb *inp, 3310 struct sctp_tcb *stcb, 3311 sctp_route_t * ro, 3312 struct sctp_nets *net, 3313 int non_asoc_addr_ok, uint32_t vrf_id) 3314{ 3315 struct sctp_ifa *answer; 3316 uint8_t dest_is_priv, dest_is_loop; 3317 sa_family_t fam; 3318 3319#ifdef INET 3320 struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst; 3321 3322#endif 3323#ifdef INET6 3324 struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&ro->ro_dst; 3325 3326#endif 3327 3328 /** 3329 * Rules: - Find the route if needed, cache if I can. - Look at 3330 * interface address in route, Is it in the bound list. If so we 3331 * have the best source. - If not we must rotate amongst the 3332 * addresses. 3333 * 3334 * Cavets and issues 3335 * 3336 * Do we need to pay attention to scope. We can have a private address 3337 * or a global address we are sourcing or sending to. So if we draw 3338 * it out 3339 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3340 * For V4 3341 * ------------------------------------------ 3342 * source * dest * result 3343 * ----------------------------------------- 3344 * <a> Private * Global * NAT 3345 * ----------------------------------------- 3346 * <b> Private * Private * No problem 3347 * ----------------------------------------- 3348 * <c> Global * Private * Huh, How will this work? 3349 * ----------------------------------------- 3350 * <d> Global * Global * No Problem 3351 *------------------------------------------ 3352 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3353 * For V6 3354 *------------------------------------------ 3355 * source * dest * result 3356 * ----------------------------------------- 3357 * <a> Linklocal * Global * 3358 * ----------------------------------------- 3359 * <b> Linklocal * Linklocal * No problem 3360 * ----------------------------------------- 3361 * <c> Global * Linklocal * Huh, How will this work? 3362 * ----------------------------------------- 3363 * <d> Global * Global * No Problem 3364 *------------------------------------------ 3365 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3366 * 3367 * And then we add to that what happens if there are multiple addresses 3368 * assigned to an interface. Remember the ifa on a ifn is a linked 3369 * list of addresses. So one interface can have more than one IP 3370 * address. What happens if we have both a private and a global 3371 * address? Do we then use context of destination to sort out which 3372 * one is best? And what about NAT's sending P->G may get you a NAT 3373 * translation, or should you select the G thats on the interface in 3374 * preference. 3375 * 3376 * Decisions: 3377 * 3378 * - count the number of addresses on the interface. 3379 * - if it is one, no problem except case <c>. 3380 * For <a> we will assume a NAT out there. 3381 * - if there are more than one, then we need to worry about scope P 3382 * or G. We should prefer G -> G and P -> P if possible. 3383 * Then as a secondary fall back to mixed types G->P being a last 3384 * ditch one. 3385 * - The above all works for bound all, but bound specific we need to 3386 * use the same concept but instead only consider the bound 3387 * addresses. If the bound set is NOT assigned to the interface then 3388 * we must use rotation amongst the bound addresses.. 3389 */ 3390 if (ro->ro_rt == NULL) { 3391 /* 3392 * Need a route to cache. 3393 */ 3394 SCTP_RTALLOC(ro, vrf_id); 3395 } 3396 if (ro->ro_rt == NULL) { 3397 return (NULL); 3398 } 3399 fam = ro->ro_dst.sa_family; 3400 dest_is_priv = dest_is_loop = 0; 3401 /* Setup our scopes for the destination */ 3402 switch (fam) { 3403#ifdef INET 3404 case AF_INET: 3405 /* Scope based on outbound address */ 3406 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) { 3407 dest_is_loop = 1; 3408 if (net != NULL) { 3409 /* mark it as local */ 3410 net->addr_is_local = 1; 3411 } 3412 } else if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) { 3413 dest_is_priv = 1; 3414 } 3415 break; 3416#endif 3417#ifdef INET6 3418 case AF_INET6: 3419 /* Scope based on outbound address */ 3420 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr) || 3421 SCTP_ROUTE_IS_REAL_LOOP(ro)) { 3422 /* 3423 * If the address is a loopback address, which 3424 * consists of "::1" OR "fe80::1%lo0", we are 3425 * loopback scope. But we don't use dest_is_priv 3426 * (link local addresses). 3427 */ 3428 dest_is_loop = 1; 3429 if (net != NULL) { 3430 /* mark it as local */ 3431 net->addr_is_local = 1; 3432 } 3433 } else if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) { 3434 dest_is_priv = 1; 3435 } 3436 break; 3437#endif 3438 } 3439 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Select source addr for:"); 3440 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&ro->ro_dst); 3441 SCTP_IPI_ADDR_RLOCK(); 3442 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3443 /* 3444 * Bound all case 3445 */ 3446 answer = sctp_choose_boundall(inp, stcb, net, ro, vrf_id, 3447 dest_is_priv, dest_is_loop, 3448 non_asoc_addr_ok, fam); 3449 SCTP_IPI_ADDR_RUNLOCK(); 3450 return (answer); 3451 } 3452 /* 3453 * Subset bound case 3454 */ 3455 if (stcb) { 3456 answer = sctp_choose_boundspecific_stcb(inp, stcb, ro, 3457 vrf_id, dest_is_priv, 3458 dest_is_loop, 3459 non_asoc_addr_ok, fam); 3460 } else { 3461 answer = sctp_choose_boundspecific_inp(inp, ro, vrf_id, 3462 non_asoc_addr_ok, 3463 dest_is_priv, 3464 dest_is_loop, fam); 3465 } 3466 SCTP_IPI_ADDR_RUNLOCK(); 3467 return (answer); 3468} 3469 3470static int 3471sctp_find_cmsg(int c_type, void *data, struct mbuf *control, size_t cpsize) 3472{ 3473 struct cmsghdr cmh; 3474 int tlen, at, found; 3475 struct sctp_sndinfo sndinfo; 3476 struct sctp_prinfo prinfo; 3477 struct sctp_authinfo authinfo; 3478 3479 tlen = SCTP_BUF_LEN(control); 3480 at = 0; 3481 found = 0; 3482 /* 3483 * Independent of how many mbufs, find the c_type inside the control 3484 * structure and copy out the data. 3485 */ 3486 while (at < tlen) { 3487 if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) { 3488 /* There is not enough room for one more. */ 3489 return (found); 3490 } 3491 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh); 3492 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3493 /* We dont't have a complete CMSG header. */ 3494 return (found); 3495 } 3496 if (((int)cmh.cmsg_len + at) > tlen) { 3497 /* We don't have the complete CMSG. */ 3498 return (found); 3499 } 3500 if ((cmh.cmsg_level == IPPROTO_SCTP) && 3501 ((c_type == cmh.cmsg_type) || 3502 ((c_type == SCTP_SNDRCV) && 3503 ((cmh.cmsg_type == SCTP_SNDINFO) || 3504 (cmh.cmsg_type == SCTP_PRINFO) || 3505 (cmh.cmsg_type == SCTP_AUTHINFO))))) { 3506 if (c_type == cmh.cmsg_type) { 3507 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < cpsize) { 3508 return (found); 3509 } 3510 /* It is exactly what we want. Copy it out. */ 3511 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), cpsize, (caddr_t)data); 3512 return (1); 3513 } else { 3514 struct sctp_sndrcvinfo *sndrcvinfo; 3515 3516 sndrcvinfo = (struct sctp_sndrcvinfo *)data; 3517 if (found == 0) { 3518 if (cpsize < sizeof(struct sctp_sndrcvinfo)) { 3519 return (found); 3520 } 3521 memset(sndrcvinfo, 0, sizeof(struct sctp_sndrcvinfo)); 3522 } 3523 switch (cmh.cmsg_type) { 3524 case SCTP_SNDINFO: 3525 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_sndinfo)) { 3526 return (found); 3527 } 3528 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_sndinfo), (caddr_t)&sndinfo); 3529 sndrcvinfo->sinfo_stream = sndinfo.snd_sid; 3530 sndrcvinfo->sinfo_flags = sndinfo.snd_flags; 3531 sndrcvinfo->sinfo_ppid = sndinfo.snd_ppid; 3532 sndrcvinfo->sinfo_context = sndinfo.snd_context; 3533 sndrcvinfo->sinfo_assoc_id = sndinfo.snd_assoc_id; 3534 break; 3535 case SCTP_PRINFO: 3536 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_prinfo)) { 3537 return (found); 3538 } 3539 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_prinfo), (caddr_t)&prinfo); 3540 if (prinfo.pr_policy != SCTP_PR_SCTP_NONE) { 3541 sndrcvinfo->sinfo_timetolive = prinfo.pr_value; 3542 } else { 3543 sndrcvinfo->sinfo_timetolive = 0; 3544 } 3545 sndrcvinfo->sinfo_flags |= prinfo.pr_policy; 3546 break; 3547 case SCTP_AUTHINFO: 3548 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_authinfo)) { 3549 return (found); 3550 } 3551 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_authinfo), (caddr_t)&authinfo); 3552 sndrcvinfo->sinfo_keynumber_valid = 1; 3553 sndrcvinfo->sinfo_keynumber = authinfo.auth_keynumber; 3554 break; 3555 default: 3556 return (found); 3557 } 3558 found = 1; 3559 } 3560 } 3561 at += CMSG_ALIGN(cmh.cmsg_len); 3562 } 3563 return (found); 3564} 3565 3566static int 3567sctp_process_cmsgs_for_init(struct sctp_tcb *stcb, struct mbuf *control, int *error) 3568{ 3569 struct cmsghdr cmh; 3570 int tlen, at; 3571 struct sctp_initmsg initmsg; 3572 3573#ifdef INET 3574 struct sockaddr_in sin; 3575 3576#endif 3577#ifdef INET6 3578 struct sockaddr_in6 sin6; 3579 3580#endif 3581 3582 tlen = SCTP_BUF_LEN(control); 3583 at = 0; 3584 while (at < tlen) { 3585 if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) { 3586 /* There is not enough room for one more. */ 3587 *error = EINVAL; 3588 return (1); 3589 } 3590 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh); 3591 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3592 /* We dont't have a complete CMSG header. */ 3593 *error = EINVAL; 3594 return (1); 3595 } 3596 if (((int)cmh.cmsg_len + at) > tlen) { 3597 /* We don't have the complete CMSG. */ 3598 *error = EINVAL; 3599 return (1); 3600 } 3601 if (cmh.cmsg_level == IPPROTO_SCTP) { 3602 switch (cmh.cmsg_type) { 3603 case SCTP_INIT: 3604 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_initmsg)) { 3605 *error = EINVAL; 3606 return (1); 3607 } 3608 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_initmsg), (caddr_t)&initmsg); 3609 if (initmsg.sinit_max_attempts) 3610 stcb->asoc.max_init_times = initmsg.sinit_max_attempts; 3611 if (initmsg.sinit_num_ostreams) 3612 stcb->asoc.pre_open_streams = initmsg.sinit_num_ostreams; 3613 if (initmsg.sinit_max_instreams) 3614 stcb->asoc.max_inbound_streams = initmsg.sinit_max_instreams; 3615 if (initmsg.sinit_max_init_timeo) 3616 stcb->asoc.initial_init_rto_max = initmsg.sinit_max_init_timeo; 3617 if (stcb->asoc.streamoutcnt < stcb->asoc.pre_open_streams) { 3618 struct sctp_stream_out *tmp_str; 3619 unsigned int i; 3620 3621#if defined(SCTP_DETAILED_STR_STATS) 3622 int j; 3623 3624#endif 3625 3626 /* Default is NOT correct */ 3627 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, default:%d pre_open:%d\n", 3628 stcb->asoc.streamoutcnt, stcb->asoc.pre_open_streams); 3629 SCTP_TCB_UNLOCK(stcb); 3630 SCTP_MALLOC(tmp_str, 3631 struct sctp_stream_out *, 3632 (stcb->asoc.pre_open_streams * sizeof(struct sctp_stream_out)), 3633 SCTP_M_STRMO); 3634 SCTP_TCB_LOCK(stcb); 3635 if (tmp_str != NULL) { 3636 SCTP_FREE(stcb->asoc.strmout, SCTP_M_STRMO); 3637 stcb->asoc.strmout = tmp_str; 3638 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt = stcb->asoc.pre_open_streams; 3639 } else { 3640 stcb->asoc.pre_open_streams = stcb->asoc.streamoutcnt; 3641 } 3642 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3643 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 3644 stcb->asoc.strmout[i].chunks_on_queues = 0; 3645 stcb->asoc.strmout[i].next_sequence_send = 0; 3646#if defined(SCTP_DETAILED_STR_STATS) 3647 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 3648 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 3649 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 3650 } 3651#else 3652 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 3653 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 3654#endif 3655 stcb->asoc.strmout[i].stream_no = i; 3656 stcb->asoc.strmout[i].last_msg_incomplete = 0; 3657 stcb->asoc.ss_functions.sctp_ss_init_stream(&stcb->asoc.strmout[i], NULL); 3658 } 3659 } 3660 break; 3661#ifdef INET 3662 case SCTP_DSTADDRV4: 3663 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in_addr)) { 3664 *error = EINVAL; 3665 return (1); 3666 } 3667 memset(&sin, 0, sizeof(struct sockaddr_in)); 3668 sin.sin_family = AF_INET; 3669 sin.sin_len = sizeof(struct sockaddr_in); 3670 sin.sin_port = stcb->rport; 3671 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3672 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3673 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3674 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3675 *error = EINVAL; 3676 return (1); 3677 } 3678 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, 3679 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3680 *error = ENOBUFS; 3681 return (1); 3682 } 3683 break; 3684#endif 3685#ifdef INET6 3686 case SCTP_DSTADDRV6: 3687 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in6_addr)) { 3688 *error = EINVAL; 3689 return (1); 3690 } 3691 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3692 sin6.sin6_family = AF_INET6; 3693 sin6.sin6_len = sizeof(struct sockaddr_in6); 3694 sin6.sin6_port = stcb->rport; 3695 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3696 if (IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr) || 3697 IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) { 3698 *error = EINVAL; 3699 return (1); 3700 } 3701#ifdef INET 3702 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3703 in6_sin6_2_sin(&sin, &sin6); 3704 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3705 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3706 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3707 *error = EINVAL; 3708 return (1); 3709 } 3710 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, 3711 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3712 *error = ENOBUFS; 3713 return (1); 3714 } 3715 } else 3716#endif 3717 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin6, NULL, 3718 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3719 *error = ENOBUFS; 3720 return (1); 3721 } 3722 break; 3723#endif 3724 default: 3725 break; 3726 } 3727 } 3728 at += CMSG_ALIGN(cmh.cmsg_len); 3729 } 3730 return (0); 3731} 3732 3733static struct sctp_tcb * 3734sctp_findassociation_cmsgs(struct sctp_inpcb **inp_p, 3735 uint16_t port, 3736 struct mbuf *control, 3737 struct sctp_nets **net_p, 3738 int *error) 3739{ 3740 struct cmsghdr cmh; 3741 int tlen, at; 3742 struct sctp_tcb *stcb; 3743 struct sockaddr *addr; 3744 3745#ifdef INET 3746 struct sockaddr_in sin; 3747 3748#endif 3749#ifdef INET6 3750 struct sockaddr_in6 sin6; 3751 3752#endif 3753 3754 tlen = SCTP_BUF_LEN(control); 3755 at = 0; 3756 while (at < tlen) { 3757 if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) { 3758 /* There is not enough room for one more. */ 3759 *error = EINVAL; 3760 return (NULL); 3761 } 3762 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh); 3763 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3764 /* We dont't have a complete CMSG header. */ 3765 *error = EINVAL; 3766 return (NULL); 3767 } 3768 if (((int)cmh.cmsg_len + at) > tlen) { 3769 /* We don't have the complete CMSG. */ 3770 *error = EINVAL; 3771 return (NULL); 3772 } 3773 if (cmh.cmsg_level == IPPROTO_SCTP) { 3774 switch (cmh.cmsg_type) { 3775#ifdef INET 3776 case SCTP_DSTADDRV4: 3777 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in_addr)) { 3778 *error = EINVAL; 3779 return (NULL); 3780 } 3781 memset(&sin, 0, sizeof(struct sockaddr_in)); 3782 sin.sin_family = AF_INET; 3783 sin.sin_len = sizeof(struct sockaddr_in); 3784 sin.sin_port = port; 3785 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3786 addr = (struct sockaddr *)&sin; 3787 break; 3788#endif 3789#ifdef INET6 3790 case SCTP_DSTADDRV6: 3791 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in6_addr)) { 3792 *error = EINVAL; 3793 return (NULL); 3794 } 3795 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3796 sin6.sin6_family = AF_INET6; 3797 sin6.sin6_len = sizeof(struct sockaddr_in6); 3798 sin6.sin6_port = port; 3799 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3800#ifdef INET 3801 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3802 in6_sin6_2_sin(&sin, &sin6); 3803 addr = (struct sockaddr *)&sin; 3804 } else 3805#endif 3806 addr = (struct sockaddr *)&sin6; 3807 break; 3808#endif 3809 default: 3810 addr = NULL; 3811 break; 3812 } 3813 if (addr) { 3814 stcb = sctp_findassociation_ep_addr(inp_p, addr, net_p, NULL, NULL); 3815 if (stcb != NULL) { 3816 return (stcb); 3817 } 3818 } 3819 } 3820 at += CMSG_ALIGN(cmh.cmsg_len); 3821 } 3822 return (NULL); 3823} 3824 3825static struct mbuf * 3826sctp_add_cookie(struct mbuf *init, int init_offset, 3827 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in, uint8_t ** signature) 3828{ 3829 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 3830 struct sctp_state_cookie *stc; 3831 struct sctp_paramhdr *ph; 3832 uint8_t *foo; 3833 int sig_offset; 3834 uint16_t cookie_sz; 3835 3836 mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) + 3837 sizeof(struct sctp_paramhdr)), 0, 3838 M_NOWAIT, 1, MT_DATA); 3839 if (mret == NULL) { 3840 return (NULL); 3841 } 3842 copy_init = SCTP_M_COPYM(init, init_offset, M_COPYALL, M_NOWAIT); 3843 if (copy_init == NULL) { 3844 sctp_m_freem(mret); 3845 return (NULL); 3846 } 3847#ifdef SCTP_MBUF_LOGGING 3848 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3849 struct mbuf *mat; 3850 3851 for (mat = copy_init; mat; mat = SCTP_BUF_NEXT(mat)) { 3852 if (SCTP_BUF_IS_EXTENDED(mat)) { 3853 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 3854 } 3855 } 3856 } 3857#endif 3858 copy_initack = SCTP_M_COPYM(initack, initack_offset, M_COPYALL, 3859 M_NOWAIT); 3860 if (copy_initack == NULL) { 3861 sctp_m_freem(mret); 3862 sctp_m_freem(copy_init); 3863 return (NULL); 3864 } 3865#ifdef SCTP_MBUF_LOGGING 3866 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3867 struct mbuf *mat; 3868 3869 for (mat = copy_initack; mat; mat = SCTP_BUF_NEXT(mat)) { 3870 if (SCTP_BUF_IS_EXTENDED(mat)) { 3871 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 3872 } 3873 } 3874 } 3875#endif 3876 /* easy side we just drop it on the end */ 3877 ph = mtod(mret, struct sctp_paramhdr *); 3878 SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) + 3879 sizeof(struct sctp_paramhdr); 3880 stc = (struct sctp_state_cookie *)((caddr_t)ph + 3881 sizeof(struct sctp_paramhdr)); 3882 ph->param_type = htons(SCTP_STATE_COOKIE); 3883 ph->param_length = 0; /* fill in at the end */ 3884 /* Fill in the stc cookie data */ 3885 memcpy(stc, stc_in, sizeof(struct sctp_state_cookie)); 3886 3887 /* tack the INIT and then the INIT-ACK onto the chain */ 3888 cookie_sz = 0; 3889 for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3890 cookie_sz += SCTP_BUF_LEN(m_at); 3891 if (SCTP_BUF_NEXT(m_at) == NULL) { 3892 SCTP_BUF_NEXT(m_at) = copy_init; 3893 break; 3894 } 3895 } 3896 for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3897 cookie_sz += SCTP_BUF_LEN(m_at); 3898 if (SCTP_BUF_NEXT(m_at) == NULL) { 3899 SCTP_BUF_NEXT(m_at) = copy_initack; 3900 break; 3901 } 3902 } 3903 for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3904 cookie_sz += SCTP_BUF_LEN(m_at); 3905 if (SCTP_BUF_NEXT(m_at) == NULL) { 3906 break; 3907 } 3908 } 3909 sig = sctp_get_mbuf_for_msg(SCTP_SECRET_SIZE, 0, M_NOWAIT, 1, MT_DATA); 3910 if (sig == NULL) { 3911 /* no space, so free the entire chain */ 3912 sctp_m_freem(mret); 3913 return (NULL); 3914 } 3915 SCTP_BUF_LEN(sig) = 0; 3916 SCTP_BUF_NEXT(m_at) = sig; 3917 sig_offset = 0; 3918 foo = (uint8_t *) (mtod(sig, caddr_t)+sig_offset); 3919 memset(foo, 0, SCTP_SIGNATURE_SIZE); 3920 *signature = foo; 3921 SCTP_BUF_LEN(sig) += SCTP_SIGNATURE_SIZE; 3922 cookie_sz += SCTP_SIGNATURE_SIZE; 3923 ph->param_length = htons(cookie_sz); 3924 return (mret); 3925} 3926 3927 3928static uint8_t 3929sctp_get_ect(struct sctp_tcb *stcb) 3930{ 3931 if ((stcb != NULL) && (stcb->asoc.ecn_supported == 1)) { 3932 return (SCTP_ECT0_BIT); 3933 } else { 3934 return (0); 3935 } 3936} 3937 3938#if defined(INET) || defined(INET6) 3939static void 3940sctp_handle_no_route(struct sctp_tcb *stcb, 3941 struct sctp_nets *net, 3942 int so_locked) 3943{ 3944 SCTPDBG(SCTP_DEBUG_OUTPUT1, "dropped packet - no valid source addr\n"); 3945 3946 if (net) { 3947 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Destination was "); 3948 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT1, &net->ro._l_addr.sa); 3949 if (net->dest_state & SCTP_ADDR_CONFIRMED) { 3950 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) { 3951 SCTPDBG(SCTP_DEBUG_OUTPUT1, "no route takes interface %p down\n", (void *)net); 3952 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 3953 stcb, 0, 3954 (void *)net, 3955 so_locked); 3956 net->dest_state &= ~SCTP_ADDR_REACHABLE; 3957 net->dest_state &= ~SCTP_ADDR_PF; 3958 } 3959 } 3960 if (stcb) { 3961 if (net == stcb->asoc.primary_destination) { 3962 /* need a new primary */ 3963 struct sctp_nets *alt; 3964 3965 alt = sctp_find_alternate_net(stcb, net, 0); 3966 if (alt != net) { 3967 if (stcb->asoc.alternate) { 3968 sctp_free_remote_addr(stcb->asoc.alternate); 3969 } 3970 stcb->asoc.alternate = alt; 3971 atomic_add_int(&stcb->asoc.alternate->ref_count, 1); 3972 if (net->ro._s_addr) { 3973 sctp_free_ifa(net->ro._s_addr); 3974 net->ro._s_addr = NULL; 3975 } 3976 net->src_addr_selected = 0; 3977 } 3978 } 3979 } 3980 } 3981} 3982 3983#endif 3984 3985static int 3986sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 3987 struct sctp_tcb *stcb, /* may be NULL */ 3988 struct sctp_nets *net, 3989 struct sockaddr *to, 3990 struct mbuf *m, 3991 uint32_t auth_offset, 3992 struct sctp_auth_chunk *auth, 3993 uint16_t auth_keyid, 3994 int nofragment_flag, 3995 int ecn_ok, 3996 int out_of_asoc_ok, 3997 uint16_t src_port, 3998 uint16_t dest_port, 3999 uint32_t v_tag, 4000 uint16_t port, 4001 union sctp_sockstore *over_addr, 4002 uint8_t mflowtype, uint32_t mflowid, 4003#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 4004 int so_locked SCTP_UNUSED 4005#else 4006 int so_locked 4007#endif 4008) 4009/* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 4010{ 4011 /** 4012 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet header 4013 * WITH an SCTPHDR but no IP header, endpoint inp and sa structure: 4014 * - fill in the HMAC digest of any AUTH chunk in the packet. 4015 * - calculate and fill in the SCTP checksum. 4016 * - prepend an IP address header. 4017 * - if boundall use INADDR_ANY. 4018 * - if boundspecific do source address selection. 4019 * - set fragmentation option for ipV4. 4020 * - On return from IP output, check/adjust mtu size of output 4021 * interface and smallest_mtu size as well. 4022 */ 4023 /* Will need ifdefs around this */ 4024 struct mbuf *newm; 4025 struct sctphdr *sctphdr; 4026 int packet_length; 4027 int ret; 4028 4029#if defined(INET) || defined(INET6) 4030 uint32_t vrf_id; 4031 4032#endif 4033#if defined(INET) || defined(INET6) 4034 struct mbuf *o_pak; 4035 sctp_route_t *ro = NULL; 4036 struct udphdr *udp = NULL; 4037 4038#endif 4039 uint8_t tos_value; 4040 4041#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4042 struct socket *so = NULL; 4043 4044#endif 4045 4046 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 4047 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4048 sctp_m_freem(m); 4049 return (EFAULT); 4050 } 4051#if defined(INET) || defined(INET6) 4052 if (stcb) { 4053 vrf_id = stcb->asoc.vrf_id; 4054 } else { 4055 vrf_id = inp->def_vrf_id; 4056 } 4057#endif 4058 /* fill in the HMAC digest for any AUTH chunk in the packet */ 4059 if ((auth != NULL) && (stcb != NULL)) { 4060 sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb, auth_keyid); 4061 } 4062 if (net) { 4063 tos_value = net->dscp; 4064 } else if (stcb) { 4065 tos_value = stcb->asoc.default_dscp; 4066 } else { 4067 tos_value = inp->sctp_ep.default_dscp; 4068 } 4069 4070 switch (to->sa_family) { 4071#ifdef INET 4072 case AF_INET: 4073 { 4074 struct ip *ip = NULL; 4075 sctp_route_t iproute; 4076 int len; 4077 4078 len = sizeof(struct ip) + sizeof(struct sctphdr); 4079 if (port) { 4080 len += sizeof(struct udphdr); 4081 } 4082 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4083 if (newm == NULL) { 4084 sctp_m_freem(m); 4085 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4086 return (ENOMEM); 4087 } 4088 SCTP_ALIGN_TO_END(newm, len); 4089 SCTP_BUF_LEN(newm) = len; 4090 SCTP_BUF_NEXT(newm) = m; 4091 m = newm; 4092 if (net != NULL) { 4093 m->m_pkthdr.flowid = net->flowid; 4094 M_HASHTYPE_SET(m, net->flowtype); 4095 } else { 4096 m->m_pkthdr.flowid = mflowid; 4097 M_HASHTYPE_SET(m, mflowtype); 4098 } 4099 packet_length = sctp_calculate_len(m); 4100 ip = mtod(m, struct ip *); 4101 ip->ip_v = IPVERSION; 4102 ip->ip_hl = (sizeof(struct ip) >> 2); 4103 if (tos_value == 0) { 4104 /* 4105 * This means especially, that it is not set 4106 * at the SCTP layer. So use the value from 4107 * the IP layer. 4108 */ 4109 tos_value = inp->ip_inp.inp.inp_ip_tos; 4110 } 4111 tos_value &= 0xfc; 4112 if (ecn_ok) { 4113 tos_value |= sctp_get_ect(stcb); 4114 } 4115 if ((nofragment_flag) && (port == 0)) { 4116 ip->ip_off = htons(IP_DF); 4117 } else { 4118 ip->ip_off = htons(0); 4119 } 4120 /* FreeBSD has a function for ip_id's */ 4121 ip->ip_id = ip_newid(); 4122 4123 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl; 4124 ip->ip_len = htons(packet_length); 4125 ip->ip_tos = tos_value; 4126 if (port) { 4127 ip->ip_p = IPPROTO_UDP; 4128 } else { 4129 ip->ip_p = IPPROTO_SCTP; 4130 } 4131 ip->ip_sum = 0; 4132 if (net == NULL) { 4133 ro = &iproute; 4134 memset(&iproute, 0, sizeof(iproute)); 4135 memcpy(&ro->ro_dst, to, to->sa_len); 4136 } else { 4137 ro = (sctp_route_t *) & net->ro; 4138 } 4139 /* Now the address selection part */ 4140 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr; 4141 4142 /* call the routine to select the src address */ 4143 if (net && out_of_asoc_ok == 0) { 4144 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4145 sctp_free_ifa(net->ro._s_addr); 4146 net->ro._s_addr = NULL; 4147 net->src_addr_selected = 0; 4148 if (ro->ro_rt) { 4149 RTFREE(ro->ro_rt); 4150 ro->ro_rt = NULL; 4151 } 4152 } 4153 if (net->src_addr_selected == 0) { 4154 /* Cache the source address */ 4155 net->ro._s_addr = sctp_source_address_selection(inp, stcb, 4156 ro, net, 0, 4157 vrf_id); 4158 net->src_addr_selected = 1; 4159 } 4160 if (net->ro._s_addr == NULL) { 4161 /* No route to host */ 4162 net->src_addr_selected = 0; 4163 sctp_handle_no_route(stcb, net, so_locked); 4164 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4165 sctp_m_freem(m); 4166 return (EHOSTUNREACH); 4167 } 4168 ip->ip_src = net->ro._s_addr->address.sin.sin_addr; 4169 } else { 4170 if (over_addr == NULL) { 4171 struct sctp_ifa *_lsrc; 4172 4173 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4174 net, 4175 out_of_asoc_ok, 4176 vrf_id); 4177 if (_lsrc == NULL) { 4178 sctp_handle_no_route(stcb, net, so_locked); 4179 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4180 sctp_m_freem(m); 4181 return (EHOSTUNREACH); 4182 } 4183 ip->ip_src = _lsrc->address.sin.sin_addr; 4184 sctp_free_ifa(_lsrc); 4185 } else { 4186 ip->ip_src = over_addr->sin.sin_addr; 4187 SCTP_RTALLOC(ro, vrf_id); 4188 } 4189 } 4190 if (port) { 4191 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4192 sctp_handle_no_route(stcb, net, so_locked); 4193 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4194 sctp_m_freem(m); 4195 return (EHOSTUNREACH); 4196 } 4197 udp = (struct udphdr *)((caddr_t)ip + sizeof(struct ip)); 4198 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4199 udp->uh_dport = port; 4200 udp->uh_ulen = htons(packet_length - sizeof(struct ip)); 4201 if (V_udp_cksum) { 4202 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 4203 } else { 4204 udp->uh_sum = 0; 4205 } 4206 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4207 } else { 4208 sctphdr = (struct sctphdr *)((caddr_t)ip + sizeof(struct ip)); 4209 } 4210 4211 sctphdr->src_port = src_port; 4212 sctphdr->dest_port = dest_port; 4213 sctphdr->v_tag = v_tag; 4214 sctphdr->checksum = 0; 4215 4216 /* 4217 * If source address selection fails and we find no 4218 * route then the ip_output should fail as well with 4219 * a NO_ROUTE_TO_HOST type error. We probably should 4220 * catch that somewhere and abort the association 4221 * right away (assuming this is an INIT being sent). 4222 */ 4223 if (ro->ro_rt == NULL) { 4224 /* 4225 * src addr selection failed to find a route 4226 * (or valid source addr), so we can't get 4227 * there from here (yet)! 4228 */ 4229 sctp_handle_no_route(stcb, net, so_locked); 4230 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4231 sctp_m_freem(m); 4232 return (EHOSTUNREACH); 4233 } 4234 if (ro != &iproute) { 4235 memcpy(&iproute, ro, sizeof(*ro)); 4236 } 4237 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv4 output routine from low level src addr:%x\n", 4238 (uint32_t) (ntohl(ip->ip_src.s_addr))); 4239 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Destination is %x\n", 4240 (uint32_t) (ntohl(ip->ip_dst.s_addr))); 4241 SCTPDBG(SCTP_DEBUG_OUTPUT3, "RTP route is %p through\n", 4242 (void *)ro->ro_rt); 4243 4244 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4245 /* failed to prepend data, give up */ 4246 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4247 sctp_m_freem(m); 4248 return (ENOMEM); 4249 } 4250 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4251 if (port) { 4252#if defined(SCTP_WITH_NO_CSUM) 4253 SCTP_STAT_INCR(sctps_sendnocrc); 4254#else 4255 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip) + sizeof(struct udphdr)); 4256 SCTP_STAT_INCR(sctps_sendswcrc); 4257#endif 4258 if (V_udp_cksum) { 4259 SCTP_ENABLE_UDP_CSUM(o_pak); 4260 } 4261 } else { 4262#if defined(SCTP_WITH_NO_CSUM) 4263 SCTP_STAT_INCR(sctps_sendnocrc); 4264#else 4265 m->m_pkthdr.csum_flags = CSUM_SCTP; 4266 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4267 SCTP_STAT_INCR(sctps_sendhwcrc); 4268#endif 4269 } 4270#ifdef SCTP_PACKET_LOGGING 4271 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4272 sctp_packet_log(o_pak); 4273#endif 4274 /* send it out. table id is taken from stcb */ 4275#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4276 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4277 so = SCTP_INP_SO(inp); 4278 SCTP_SOCKET_UNLOCK(so, 0); 4279 } 4280#endif 4281 SCTP_IP_OUTPUT(ret, o_pak, ro, stcb, vrf_id); 4282#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4283 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4284 atomic_add_int(&stcb->asoc.refcnt, 1); 4285 SCTP_TCB_UNLOCK(stcb); 4286 SCTP_SOCKET_LOCK(so, 0); 4287 SCTP_TCB_LOCK(stcb); 4288 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4289 } 4290#endif 4291 SCTP_STAT_INCR(sctps_sendpackets); 4292 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4293 if (ret) 4294 SCTP_STAT_INCR(sctps_senderrors); 4295 4296 SCTPDBG(SCTP_DEBUG_OUTPUT3, "IP output returns %d\n", ret); 4297 if (net == NULL) { 4298 /* free tempy routes */ 4299 RO_RTFREE(ro); 4300 } else { 4301 /* 4302 * PMTU check versus smallest asoc MTU goes 4303 * here 4304 */ 4305 if ((ro->ro_rt != NULL) && 4306 (net->ro._s_addr)) { 4307 uint32_t mtu; 4308 4309 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt); 4310 if (net->port) { 4311 mtu -= sizeof(struct udphdr); 4312 } 4313 if (mtu && (stcb->asoc.smallest_mtu > mtu)) { 4314 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4315 net->mtu = mtu; 4316 } 4317 } else if (ro->ro_rt == NULL) { 4318 /* route was freed */ 4319 if (net->ro._s_addr && 4320 net->src_addr_selected) { 4321 sctp_free_ifa(net->ro._s_addr); 4322 net->ro._s_addr = NULL; 4323 } 4324 net->src_addr_selected = 0; 4325 } 4326 } 4327 return (ret); 4328 } 4329#endif 4330#ifdef INET6 4331 case AF_INET6: 4332 { 4333 uint32_t flowlabel, flowinfo; 4334 struct ip6_hdr *ip6h; 4335 struct route_in6 ip6route; 4336 struct ifnet *ifp; 4337 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 4338 int prev_scope = 0; 4339 struct sockaddr_in6 lsa6_storage; 4340 int error; 4341 u_short prev_port = 0; 4342 int len; 4343 4344 if (net) { 4345 flowlabel = net->flowlabel; 4346 } else if (stcb) { 4347 flowlabel = stcb->asoc.default_flowlabel; 4348 } else { 4349 flowlabel = inp->sctp_ep.default_flowlabel; 4350 } 4351 if (flowlabel == 0) { 4352 /* 4353 * This means especially, that it is not set 4354 * at the SCTP layer. So use the value from 4355 * the IP layer. 4356 */ 4357 flowlabel = ntohl(((struct in6pcb *)inp)->in6p_flowinfo); 4358 } 4359 flowlabel &= 0x000fffff; 4360 len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr); 4361 if (port) { 4362 len += sizeof(struct udphdr); 4363 } 4364 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4365 if (newm == NULL) { 4366 sctp_m_freem(m); 4367 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4368 return (ENOMEM); 4369 } 4370 SCTP_ALIGN_TO_END(newm, len); 4371 SCTP_BUF_LEN(newm) = len; 4372 SCTP_BUF_NEXT(newm) = m; 4373 m = newm; 4374 if (net != NULL) { 4375 m->m_pkthdr.flowid = net->flowid; 4376 M_HASHTYPE_SET(m, net->flowtype); 4377 } else { 4378 m->m_pkthdr.flowid = mflowid; 4379 M_HASHTYPE_SET(m, mflowtype); 4380 } 4381 packet_length = sctp_calculate_len(m); 4382 4383 ip6h = mtod(m, struct ip6_hdr *); 4384 /* protect *sin6 from overwrite */ 4385 sin6 = (struct sockaddr_in6 *)to; 4386 tmp = *sin6; 4387 sin6 = &tmp; 4388 4389 /* KAME hack: embed scopeid */ 4390 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4391 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4392 return (EINVAL); 4393 } 4394 if (net == NULL) { 4395 memset(&ip6route, 0, sizeof(ip6route)); 4396 ro = (sctp_route_t *) & ip6route; 4397 memcpy(&ro->ro_dst, sin6, sin6->sin6_len); 4398 } else { 4399 ro = (sctp_route_t *) & net->ro; 4400 } 4401 /* 4402 * We assume here that inp_flow is in host byte 4403 * order within the TCB! 4404 */ 4405 if (tos_value == 0) { 4406 /* 4407 * This means especially, that it is not set 4408 * at the SCTP layer. So use the value from 4409 * the IP layer. 4410 */ 4411 tos_value = (ntohl(((struct in6pcb *)inp)->in6p_flowinfo) >> 20) & 0xff; 4412 } 4413 tos_value &= 0xfc; 4414 if (ecn_ok) { 4415 tos_value |= sctp_get_ect(stcb); 4416 } 4417 flowinfo = 0x06; 4418 flowinfo <<= 8; 4419 flowinfo |= tos_value; 4420 flowinfo <<= 20; 4421 flowinfo |= flowlabel; 4422 ip6h->ip6_flow = htonl(flowinfo); 4423 if (port) { 4424 ip6h->ip6_nxt = IPPROTO_UDP; 4425 } else { 4426 ip6h->ip6_nxt = IPPROTO_SCTP; 4427 } 4428 ip6h->ip6_plen = (packet_length - sizeof(struct ip6_hdr)); 4429 ip6h->ip6_dst = sin6->sin6_addr; 4430 4431 /* 4432 * Add SRC address selection here: we can only reuse 4433 * to a limited degree the kame src-addr-sel, since 4434 * we can try their selection but it may not be 4435 * bound. 4436 */ 4437 bzero(&lsa6_tmp, sizeof(lsa6_tmp)); 4438 lsa6_tmp.sin6_family = AF_INET6; 4439 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 4440 lsa6 = &lsa6_tmp; 4441 if (net && out_of_asoc_ok == 0) { 4442 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4443 sctp_free_ifa(net->ro._s_addr); 4444 net->ro._s_addr = NULL; 4445 net->src_addr_selected = 0; 4446 if (ro->ro_rt) { 4447 RTFREE(ro->ro_rt); 4448 ro->ro_rt = NULL; 4449 } 4450 } 4451 if (net->src_addr_selected == 0) { 4452 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4453 /* KAME hack: embed scopeid */ 4454 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4455 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4456 return (EINVAL); 4457 } 4458 /* Cache the source address */ 4459 net->ro._s_addr = sctp_source_address_selection(inp, 4460 stcb, 4461 ro, 4462 net, 4463 0, 4464 vrf_id); 4465 (void)sa6_recoverscope(sin6); 4466 net->src_addr_selected = 1; 4467 } 4468 if (net->ro._s_addr == NULL) { 4469 SCTPDBG(SCTP_DEBUG_OUTPUT3, "V6:No route to host\n"); 4470 net->src_addr_selected = 0; 4471 sctp_handle_no_route(stcb, net, so_locked); 4472 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4473 sctp_m_freem(m); 4474 return (EHOSTUNREACH); 4475 } 4476 lsa6->sin6_addr = net->ro._s_addr->address.sin6.sin6_addr; 4477 } else { 4478 sin6 = (struct sockaddr_in6 *)&ro->ro_dst; 4479 /* KAME hack: embed scopeid */ 4480 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4481 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4482 return (EINVAL); 4483 } 4484 if (over_addr == NULL) { 4485 struct sctp_ifa *_lsrc; 4486 4487 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4488 net, 4489 out_of_asoc_ok, 4490 vrf_id); 4491 if (_lsrc == NULL) { 4492 sctp_handle_no_route(stcb, net, so_locked); 4493 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4494 sctp_m_freem(m); 4495 return (EHOSTUNREACH); 4496 } 4497 lsa6->sin6_addr = _lsrc->address.sin6.sin6_addr; 4498 sctp_free_ifa(_lsrc); 4499 } else { 4500 lsa6->sin6_addr = over_addr->sin6.sin6_addr; 4501 SCTP_RTALLOC(ro, vrf_id); 4502 } 4503 (void)sa6_recoverscope(sin6); 4504 } 4505 lsa6->sin6_port = inp->sctp_lport; 4506 4507 if (ro->ro_rt == NULL) { 4508 /* 4509 * src addr selection failed to find a route 4510 * (or valid source addr), so we can't get 4511 * there from here! 4512 */ 4513 sctp_handle_no_route(stcb, net, so_locked); 4514 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4515 sctp_m_freem(m); 4516 return (EHOSTUNREACH); 4517 } 4518 /* 4519 * XXX: sa6 may not have a valid sin6_scope_id in 4520 * the non-SCOPEDROUTING case. 4521 */ 4522 bzero(&lsa6_storage, sizeof(lsa6_storage)); 4523 lsa6_storage.sin6_family = AF_INET6; 4524 lsa6_storage.sin6_len = sizeof(lsa6_storage); 4525 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4526 if ((error = sa6_recoverscope(&lsa6_storage)) != 0) { 4527 SCTPDBG(SCTP_DEBUG_OUTPUT3, "recover scope fails error %d\n", error); 4528 sctp_m_freem(m); 4529 return (error); 4530 } 4531 /* XXX */ 4532 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4533 lsa6_storage.sin6_port = inp->sctp_lport; 4534 lsa6 = &lsa6_storage; 4535 ip6h->ip6_src = lsa6->sin6_addr; 4536 4537 if (port) { 4538 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4539 sctp_handle_no_route(stcb, net, so_locked); 4540 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4541 sctp_m_freem(m); 4542 return (EHOSTUNREACH); 4543 } 4544 udp = (struct udphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4545 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4546 udp->uh_dport = port; 4547 udp->uh_ulen = htons(packet_length - sizeof(struct ip6_hdr)); 4548 udp->uh_sum = 0; 4549 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4550 } else { 4551 sctphdr = (struct sctphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4552 } 4553 4554 sctphdr->src_port = src_port; 4555 sctphdr->dest_port = dest_port; 4556 sctphdr->v_tag = v_tag; 4557 sctphdr->checksum = 0; 4558 4559 /* 4560 * We set the hop limit now since there is a good 4561 * chance that our ro pointer is now filled 4562 */ 4563 ip6h->ip6_hlim = SCTP_GET_HLIM(inp, ro); 4564 ifp = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 4565 4566#ifdef SCTP_DEBUG 4567 /* Copy to be sure something bad is not happening */ 4568 sin6->sin6_addr = ip6h->ip6_dst; 4569 lsa6->sin6_addr = ip6h->ip6_src; 4570#endif 4571 4572 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv6 output routine from low level\n"); 4573 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src: "); 4574 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)lsa6); 4575 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst: "); 4576 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)sin6); 4577 if (net) { 4578 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4579 /* 4580 * preserve the port and scope for link 4581 * local send 4582 */ 4583 prev_scope = sin6->sin6_scope_id; 4584 prev_port = sin6->sin6_port; 4585 } 4586 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4587 /* failed to prepend data, give up */ 4588 sctp_m_freem(m); 4589 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4590 return (ENOMEM); 4591 } 4592 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4593 if (port) { 4594#if defined(SCTP_WITH_NO_CSUM) 4595 SCTP_STAT_INCR(sctps_sendnocrc); 4596#else 4597 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 4598 SCTP_STAT_INCR(sctps_sendswcrc); 4599#endif 4600 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), packet_length - sizeof(struct ip6_hdr))) == 0) { 4601 udp->uh_sum = 0xffff; 4602 } 4603 } else { 4604#if defined(SCTP_WITH_NO_CSUM) 4605 SCTP_STAT_INCR(sctps_sendnocrc); 4606#else 4607 m->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 4608 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4609 SCTP_STAT_INCR(sctps_sendhwcrc); 4610#endif 4611 } 4612 /* send it out. table id is taken from stcb */ 4613#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4614 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4615 so = SCTP_INP_SO(inp); 4616 SCTP_SOCKET_UNLOCK(so, 0); 4617 } 4618#endif 4619#ifdef SCTP_PACKET_LOGGING 4620 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4621 sctp_packet_log(o_pak); 4622#endif 4623 SCTP_IP6_OUTPUT(ret, o_pak, (struct route_in6 *)ro, &ifp, stcb, vrf_id); 4624#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4625 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4626 atomic_add_int(&stcb->asoc.refcnt, 1); 4627 SCTP_TCB_UNLOCK(stcb); 4628 SCTP_SOCKET_LOCK(so, 0); 4629 SCTP_TCB_LOCK(stcb); 4630 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4631 } 4632#endif 4633 if (net) { 4634 /* for link local this must be done */ 4635 sin6->sin6_scope_id = prev_scope; 4636 sin6->sin6_port = prev_port; 4637 } 4638 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 4639 SCTP_STAT_INCR(sctps_sendpackets); 4640 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4641 if (ret) { 4642 SCTP_STAT_INCR(sctps_senderrors); 4643 } 4644 if (net == NULL) { 4645 /* Now if we had a temp route free it */ 4646 RO_RTFREE(ro); 4647 } else { 4648 /* 4649 * PMTU check versus smallest asoc MTU goes 4650 * here 4651 */ 4652 if (ro->ro_rt == NULL) { 4653 /* Route was freed */ 4654 if (net->ro._s_addr && 4655 net->src_addr_selected) { 4656 sctp_free_ifa(net->ro._s_addr); 4657 net->ro._s_addr = NULL; 4658 } 4659 net->src_addr_selected = 0; 4660 } 4661 if ((ro->ro_rt != NULL) && 4662 (net->ro._s_addr)) { 4663 uint32_t mtu; 4664 4665 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt); 4666 if (mtu && 4667 (stcb->asoc.smallest_mtu > mtu)) { 4668 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4669 net->mtu = mtu; 4670 if (net->port) { 4671 net->mtu -= sizeof(struct udphdr); 4672 } 4673 } 4674 } else if (ifp) { 4675 if (ND_IFINFO(ifp)->linkmtu && 4676 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) { 4677 sctp_mtu_size_reset(inp, 4678 &stcb->asoc, 4679 ND_IFINFO(ifp)->linkmtu); 4680 } 4681 } 4682 } 4683 return (ret); 4684 } 4685#endif 4686 default: 4687 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 4688 ((struct sockaddr *)to)->sa_family); 4689 sctp_m_freem(m); 4690 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4691 return (EFAULT); 4692 } 4693} 4694 4695 4696void 4697sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int so_locked 4698#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 4699 SCTP_UNUSED 4700#endif 4701) 4702{ 4703 struct mbuf *m, *m_last; 4704 struct sctp_nets *net; 4705 struct sctp_init_chunk *init; 4706 struct sctp_supported_addr_param *sup_addr; 4707 struct sctp_adaptation_layer_indication *ali; 4708 struct sctp_supported_chunk_types_param *pr_supported; 4709 struct sctp_paramhdr *ph; 4710 int cnt_inits_to = 0; 4711 int ret; 4712 uint16_t num_ext, chunk_len, padding_len, parameter_len; 4713 4714 /* INIT's always go to the primary (and usually ONLY address) */ 4715 net = stcb->asoc.primary_destination; 4716 if (net == NULL) { 4717 net = TAILQ_FIRST(&stcb->asoc.nets); 4718 if (net == NULL) { 4719 /* TSNH */ 4720 return; 4721 } 4722 /* we confirm any address we send an INIT to */ 4723 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4724 (void)sctp_set_primary_addr(stcb, NULL, net); 4725 } else { 4726 /* we confirm any address we send an INIT to */ 4727 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4728 } 4729 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT\n"); 4730#ifdef INET6 4731 if (net->ro._l_addr.sa.sa_family == AF_INET6) { 4732 /* 4733 * special hook, if we are sending to link local it will not 4734 * show up in our private address count. 4735 */ 4736 if (IN6_IS_ADDR_LINKLOCAL(&net->ro._l_addr.sin6.sin6_addr)) 4737 cnt_inits_to = 1; 4738 } 4739#endif 4740 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 4741 /* This case should not happen */ 4742 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - failed timer?\n"); 4743 return; 4744 } 4745 /* start the INIT timer */ 4746 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 4747 4748 m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_NOWAIT, 1, MT_DATA); 4749 if (m == NULL) { 4750 /* No memory, INIT timer will re-attempt. */ 4751 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - mbuf?\n"); 4752 return; 4753 } 4754 chunk_len = (uint16_t) sizeof(struct sctp_init_chunk); 4755 padding_len = 0; 4756 /* Now lets put the chunk header in place */ 4757 init = mtod(m, struct sctp_init_chunk *); 4758 /* now the chunk header */ 4759 init->ch.chunk_type = SCTP_INITIATION; 4760 init->ch.chunk_flags = 0; 4761 /* fill in later from mbuf we build */ 4762 init->ch.chunk_length = 0; 4763 /* place in my tag */ 4764 init->init.initiate_tag = htonl(stcb->asoc.my_vtag); 4765 /* set up some of the credits. */ 4766 init->init.a_rwnd = htonl(max(inp->sctp_socket ? SCTP_SB_LIMIT_RCV(inp->sctp_socket) : 0, 4767 SCTP_MINIMAL_RWND)); 4768 init->init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 4769 init->init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 4770 init->init.initial_tsn = htonl(stcb->asoc.init_seq_number); 4771 4772 /* Adaptation layer indication parameter */ 4773 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 4774 parameter_len = (uint16_t) sizeof(struct sctp_adaptation_layer_indication); 4775 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 4776 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 4777 ali->ph.param_length = htons(parameter_len); 4778 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 4779 chunk_len += parameter_len; 4780 } 4781 /* ECN parameter */ 4782 if (stcb->asoc.ecn_supported == 1) { 4783 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 4784 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4785 ph->param_type = htons(SCTP_ECN_CAPABLE); 4786 ph->param_length = htons(parameter_len); 4787 chunk_len += parameter_len; 4788 } 4789 /* PR-SCTP supported parameter */ 4790 if (stcb->asoc.prsctp_supported == 1) { 4791 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 4792 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4793 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 4794 ph->param_length = htons(parameter_len); 4795 chunk_len += parameter_len; 4796 } 4797 /* Add NAT friendly parameter. */ 4798 if (SCTP_BASE_SYSCTL(sctp_inits_include_nat_friendly)) { 4799 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 4800 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4801 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 4802 ph->param_length = htons(parameter_len); 4803 chunk_len += parameter_len; 4804 } 4805 /* And now tell the peer which extensions we support */ 4806 num_ext = 0; 4807 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 4808 if (stcb->asoc.prsctp_supported == 1) { 4809 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 4810 } 4811 if (stcb->asoc.auth_supported == 1) { 4812 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 4813 } 4814 if (stcb->asoc.asconf_supported == 1) { 4815 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 4816 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 4817 } 4818 if (stcb->asoc.reconfig_supported == 1) { 4819 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 4820 } 4821 if (stcb->asoc.nrsack_supported == 1) { 4822 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 4823 } 4824 if (stcb->asoc.pktdrop_supported == 1) { 4825 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 4826 } 4827 if (num_ext > 0) { 4828 parameter_len = (uint16_t) sizeof(struct sctp_supported_chunk_types_param) + num_ext; 4829 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 4830 pr_supported->ph.param_length = htons(parameter_len); 4831 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4832 chunk_len += parameter_len; 4833 } 4834 /* add authentication parameters */ 4835 if (stcb->asoc.auth_supported) { 4836 /* attach RANDOM parameter, if available */ 4837 if (stcb->asoc.authinfo.random != NULL) { 4838 struct sctp_auth_random *randp; 4839 4840 if (padding_len > 0) { 4841 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4842 chunk_len += padding_len; 4843 padding_len = 0; 4844 } 4845 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 4846 parameter_len = (uint16_t) sizeof(struct sctp_auth_random) + stcb->asoc.authinfo.random_len; 4847 /* random key already contains the header */ 4848 memcpy(randp, stcb->asoc.authinfo.random->key, parameter_len); 4849 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4850 chunk_len += parameter_len; 4851 } 4852 /* add HMAC_ALGO parameter */ 4853 if (stcb->asoc.local_hmacs != NULL) { 4854 struct sctp_auth_hmac_algo *hmacs; 4855 4856 if (padding_len > 0) { 4857 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4858 chunk_len += padding_len; 4859 padding_len = 0; 4860 } 4861 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 4862 parameter_len = (uint16_t) (sizeof(struct sctp_auth_hmac_algo) + 4863 stcb->asoc.local_hmacs->num_algo * sizeof(uint16_t)); 4864 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 4865 hmacs->ph.param_length = htons(parameter_len); 4866 sctp_serialize_hmaclist(stcb->asoc.local_hmacs, (uint8_t *) hmacs->hmac_ids); 4867 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4868 chunk_len += parameter_len; 4869 } 4870 /* add CHUNKS parameter */ 4871 if (stcb->asoc.local_auth_chunks != NULL) { 4872 struct sctp_auth_chunk_list *chunks; 4873 4874 if (padding_len > 0) { 4875 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4876 chunk_len += padding_len; 4877 padding_len = 0; 4878 } 4879 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 4880 parameter_len = (uint16_t) (sizeof(struct sctp_auth_chunk_list) + 4881 sctp_auth_get_chklist_size(stcb->asoc.local_auth_chunks)); 4882 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 4883 chunks->ph.param_length = htons(parameter_len); 4884 sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks, chunks->chunk_types); 4885 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4886 chunk_len += parameter_len; 4887 } 4888 } 4889 /* now any cookie time extensions */ 4890 if (stcb->asoc.cookie_preserve_req) { 4891 struct sctp_cookie_perserve_param *cookie_preserve; 4892 4893 if (padding_len > 0) { 4894 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4895 chunk_len += padding_len; 4896 padding_len = 0; 4897 } 4898 parameter_len = (uint16_t) sizeof(struct sctp_cookie_perserve_param); 4899 cookie_preserve = (struct sctp_cookie_perserve_param *)(mtod(m, caddr_t)+chunk_len); 4900 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 4901 cookie_preserve->ph.param_length = htons(parameter_len); 4902 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 4903 stcb->asoc.cookie_preserve_req = 0; 4904 chunk_len += parameter_len; 4905 } 4906 if (stcb->asoc.scope.ipv4_addr_legal || stcb->asoc.scope.ipv6_addr_legal) { 4907 uint8_t i; 4908 4909 if (padding_len > 0) { 4910 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4911 chunk_len += padding_len; 4912 padding_len = 0; 4913 } 4914 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 4915 if (stcb->asoc.scope.ipv4_addr_legal) { 4916 parameter_len += (uint16_t) sizeof(uint16_t); 4917 } 4918 if (stcb->asoc.scope.ipv6_addr_legal) { 4919 parameter_len += (uint16_t) sizeof(uint16_t); 4920 } 4921 sup_addr = (struct sctp_supported_addr_param *)(mtod(m, caddr_t)+chunk_len); 4922 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 4923 sup_addr->ph.param_length = htons(parameter_len); 4924 i = 0; 4925 if (stcb->asoc.scope.ipv4_addr_legal) { 4926 sup_addr->addr_type[i++] = htons(SCTP_IPV4_ADDRESS); 4927 } 4928 if (stcb->asoc.scope.ipv6_addr_legal) { 4929 sup_addr->addr_type[i++] = htons(SCTP_IPV6_ADDRESS); 4930 } 4931 padding_len = 4 - 2 * i; 4932 chunk_len += parameter_len; 4933 } 4934 SCTP_BUF_LEN(m) = chunk_len; 4935 /* now the addresses */ 4936 /* 4937 * To optimize this we could put the scoping stuff into a structure 4938 * and remove the individual uint8's from the assoc structure. Then 4939 * we could just sifa in the address within the stcb. But for now 4940 * this is a quick hack to get the address stuff teased apart. 4941 */ 4942 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &stcb->asoc.scope, 4943 m, cnt_inits_to, 4944 &padding_len, &chunk_len); 4945 4946 init->ch.chunk_length = htons(chunk_len); 4947 if (padding_len > 0) { 4948 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 4949 sctp_m_freem(m); 4950 return; 4951 } 4952 } 4953 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - calls lowlevel_output\n"); 4954 ret = sctp_lowlevel_chunk_output(inp, stcb, net, 4955 (struct sockaddr *)&net->ro._l_addr, 4956 m, 0, NULL, 0, 0, 0, 0, 4957 inp->sctp_lport, stcb->rport, htonl(0), 4958 net->port, NULL, 4959 0, 0, 4960 so_locked); 4961 SCTPDBG(SCTP_DEBUG_OUTPUT4, "lowlevel_output - %d\n", ret); 4962 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 4963 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 4964} 4965 4966struct mbuf * 4967sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 4968 int param_offset, int *abort_processing, struct sctp_chunkhdr *cp, int *nat_friendly) 4969{ 4970 /* 4971 * Given a mbuf containing an INIT or INIT-ACK with the param_offset 4972 * being equal to the beginning of the params i.e. (iphlen + 4973 * sizeof(struct sctp_init_msg) parse through the parameters to the 4974 * end of the mbuf verifying that all parameters are known. 4975 * 4976 * For unknown parameters build and return a mbuf with 4977 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop 4978 * processing this chunk stop, and set *abort_processing to 1. 4979 * 4980 * By having param_offset be pre-set to where parameters begin it is 4981 * hoped that this routine may be reused in the future by new 4982 * features. 4983 */ 4984 struct sctp_paramhdr *phdr, params; 4985 4986 struct mbuf *mat, *op_err; 4987 char tempbuf[SCTP_PARAM_BUFFER_SIZE]; 4988 int at, limit, pad_needed; 4989 uint16_t ptype, plen, padded_size; 4990 int err_at; 4991 4992 *abort_processing = 0; 4993 mat = in_initpkt; 4994 err_at = 0; 4995 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 4996 at = param_offset; 4997 op_err = NULL; 4998 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Check for unrecognized param's\n"); 4999 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5000 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 5001 ptype = ntohs(phdr->param_type); 5002 plen = ntohs(phdr->param_length); 5003 if ((plen > limit) || (plen < sizeof(struct sctp_paramhdr))) { 5004 /* wacked parameter */ 5005 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error %d\n", plen); 5006 goto invalid_size; 5007 } 5008 limit -= SCTP_SIZE32(plen); 5009 /*- 5010 * All parameters for all chunks that we know/understand are 5011 * listed here. We process them other places and make 5012 * appropriate stop actions per the upper bits. However this 5013 * is the generic routine processor's can call to get back 5014 * an operr.. to either incorporate (init-ack) or send. 5015 */ 5016 padded_size = SCTP_SIZE32(plen); 5017 switch (ptype) { 5018 /* Param's with variable size */ 5019 case SCTP_HEARTBEAT_INFO: 5020 case SCTP_STATE_COOKIE: 5021 case SCTP_UNRECOG_PARAM: 5022 case SCTP_ERROR_CAUSE_IND: 5023 /* ok skip fwd */ 5024 at += padded_size; 5025 break; 5026 /* Param's with variable size within a range */ 5027 case SCTP_CHUNK_LIST: 5028 case SCTP_SUPPORTED_CHUNK_EXT: 5029 if (padded_size > (sizeof(struct sctp_supported_chunk_types_param) + (sizeof(uint8_t) * SCTP_MAX_SUPPORTED_EXT))) { 5030 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error chklist %d\n", plen); 5031 goto invalid_size; 5032 } 5033 at += padded_size; 5034 break; 5035 case SCTP_SUPPORTED_ADDRTYPE: 5036 if (padded_size > SCTP_MAX_ADDR_PARAMS_SIZE) { 5037 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error supaddrtype %d\n", plen); 5038 goto invalid_size; 5039 } 5040 at += padded_size; 5041 break; 5042 case SCTP_RANDOM: 5043 if (padded_size > (sizeof(struct sctp_auth_random) + SCTP_RANDOM_MAX_SIZE)) { 5044 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error random %d\n", plen); 5045 goto invalid_size; 5046 } 5047 at += padded_size; 5048 break; 5049 case SCTP_SET_PRIM_ADDR: 5050 case SCTP_DEL_IP_ADDRESS: 5051 case SCTP_ADD_IP_ADDRESS: 5052 if ((padded_size != sizeof(struct sctp_asconf_addrv4_param)) && 5053 (padded_size != sizeof(struct sctp_asconf_addr_param))) { 5054 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error setprim %d\n", plen); 5055 goto invalid_size; 5056 } 5057 at += padded_size; 5058 break; 5059 /* Param's with a fixed size */ 5060 case SCTP_IPV4_ADDRESS: 5061 if (padded_size != sizeof(struct sctp_ipv4addr_param)) { 5062 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv4 addr %d\n", plen); 5063 goto invalid_size; 5064 } 5065 at += padded_size; 5066 break; 5067 case SCTP_IPV6_ADDRESS: 5068 if (padded_size != sizeof(struct sctp_ipv6addr_param)) { 5069 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv6 addr %d\n", plen); 5070 goto invalid_size; 5071 } 5072 at += padded_size; 5073 break; 5074 case SCTP_COOKIE_PRESERVE: 5075 if (padded_size != sizeof(struct sctp_cookie_perserve_param)) { 5076 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error cookie-preserve %d\n", plen); 5077 goto invalid_size; 5078 } 5079 at += padded_size; 5080 break; 5081 case SCTP_HAS_NAT_SUPPORT: 5082 *nat_friendly = 1; 5083 /* fall through */ 5084 case SCTP_PRSCTP_SUPPORTED: 5085 if (padded_size != sizeof(struct sctp_paramhdr)) { 5086 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error prsctp/nat support %d\n", plen); 5087 goto invalid_size; 5088 } 5089 at += padded_size; 5090 break; 5091 case SCTP_ECN_CAPABLE: 5092 if (padded_size != sizeof(struct sctp_paramhdr)) { 5093 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecn %d\n", plen); 5094 goto invalid_size; 5095 } 5096 at += padded_size; 5097 break; 5098 case SCTP_ULP_ADAPTATION: 5099 if (padded_size != sizeof(struct sctp_adaptation_layer_indication)) { 5100 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error adapatation %d\n", plen); 5101 goto invalid_size; 5102 } 5103 at += padded_size; 5104 break; 5105 case SCTP_SUCCESS_REPORT: 5106 if (padded_size != sizeof(struct sctp_asconf_paramhdr)) { 5107 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error success %d\n", plen); 5108 goto invalid_size; 5109 } 5110 at += padded_size; 5111 break; 5112 case SCTP_HOSTNAME_ADDRESS: 5113 { 5114 /* We can NOT handle HOST NAME addresses!! */ 5115 int l_len; 5116 5117 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Can't handle hostname addresses.. abort processing\n"); 5118 *abort_processing = 1; 5119 if (op_err == NULL) { 5120 /* Ok need to try to get a mbuf */ 5121#ifdef INET6 5122 l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5123#else 5124 l_len = sizeof(struct ip) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5125#endif 5126 l_len += plen; 5127 l_len += sizeof(struct sctp_paramhdr); 5128 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5129 if (op_err) { 5130 SCTP_BUF_LEN(op_err) = 0; 5131 /* 5132 * pre-reserve space for ip 5133 * and sctp header and 5134 * chunk hdr 5135 */ 5136#ifdef INET6 5137 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5138#else 5139 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5140#endif 5141 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5142 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5143 } 5144 } 5145 if (op_err) { 5146 /* If we have space */ 5147 struct sctp_paramhdr s; 5148 5149 if (err_at % 4) { 5150 uint32_t cpthis = 0; 5151 5152 pad_needed = 4 - (err_at % 4); 5153 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 5154 err_at += pad_needed; 5155 } 5156 s.param_type = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR); 5157 s.param_length = htons(sizeof(s) + plen); 5158 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 5159 err_at += sizeof(s); 5160 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, min(sizeof(tempbuf), plen)); 5161 if (phdr == NULL) { 5162 sctp_m_freem(op_err); 5163 /* 5164 * we are out of memory but 5165 * we still need to have a 5166 * look at what to do (the 5167 * system is in trouble 5168 * though). 5169 */ 5170 return (NULL); 5171 } 5172 m_copyback(op_err, err_at, plen, (caddr_t)phdr); 5173 } 5174 return (op_err); 5175 break; 5176 } 5177 default: 5178 /* 5179 * we do not recognize the parameter figure out what 5180 * we do. 5181 */ 5182 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Hit default param %x\n", ptype); 5183 if ((ptype & 0x4000) == 0x4000) { 5184 /* Report bit is set?? */ 5185 SCTPDBG(SCTP_DEBUG_OUTPUT1, "report op err\n"); 5186 if (op_err == NULL) { 5187 int l_len; 5188 5189 /* Ok need to try to get an mbuf */ 5190#ifdef INET6 5191 l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5192#else 5193 l_len = sizeof(struct ip) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5194#endif 5195 l_len += plen; 5196 l_len += sizeof(struct sctp_paramhdr); 5197 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5198 if (op_err) { 5199 SCTP_BUF_LEN(op_err) = 0; 5200#ifdef INET6 5201 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5202#else 5203 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5204#endif 5205 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5206 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5207 } 5208 } 5209 if (op_err) { 5210 /* If we have space */ 5211 struct sctp_paramhdr s; 5212 5213 if (err_at % 4) { 5214 uint32_t cpthis = 0; 5215 5216 pad_needed = 4 - (err_at % 4); 5217 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 5218 err_at += pad_needed; 5219 } 5220 s.param_type = htons(SCTP_UNRECOG_PARAM); 5221 s.param_length = htons(sizeof(s) + plen); 5222 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 5223 err_at += sizeof(s); 5224 if (plen > sizeof(tempbuf)) { 5225 plen = sizeof(tempbuf); 5226 } 5227 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, min(sizeof(tempbuf), plen)); 5228 if (phdr == NULL) { 5229 sctp_m_freem(op_err); 5230 /* 5231 * we are out of memory but 5232 * we still need to have a 5233 * look at what to do (the 5234 * system is in trouble 5235 * though). 5236 */ 5237 op_err = NULL; 5238 goto more_processing; 5239 } 5240 m_copyback(op_err, err_at, plen, (caddr_t)phdr); 5241 err_at += plen; 5242 } 5243 } 5244 more_processing: 5245 if ((ptype & 0x8000) == 0x0000) { 5246 SCTPDBG(SCTP_DEBUG_OUTPUT1, "stop proc\n"); 5247 return (op_err); 5248 } else { 5249 /* skip this chunk and continue processing */ 5250 SCTPDBG(SCTP_DEBUG_OUTPUT1, "move on\n"); 5251 at += SCTP_SIZE32(plen); 5252 } 5253 break; 5254 5255 } 5256 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5257 } 5258 return (op_err); 5259invalid_size: 5260 SCTPDBG(SCTP_DEBUG_OUTPUT1, "abort flag set\n"); 5261 *abort_processing = 1; 5262 if ((op_err == NULL) && phdr) { 5263 int l_len; 5264 5265#ifdef INET6 5266 l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5267#else 5268 l_len = sizeof(struct ip) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 5269#endif 5270 l_len += (2 * sizeof(struct sctp_paramhdr)); 5271 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5272 if (op_err) { 5273 SCTP_BUF_LEN(op_err) = 0; 5274#ifdef INET6 5275 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5276#else 5277 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5278#endif 5279 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5280 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5281 } 5282 } 5283 if ((op_err) && phdr) { 5284 struct sctp_paramhdr s; 5285 5286 if (err_at % 4) { 5287 uint32_t cpthis = 0; 5288 5289 pad_needed = 4 - (err_at % 4); 5290 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 5291 err_at += pad_needed; 5292 } 5293 s.param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 5294 s.param_length = htons(sizeof(s) + sizeof(struct sctp_paramhdr)); 5295 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 5296 err_at += sizeof(s); 5297 /* Only copy back the p-hdr that caused the issue */ 5298 m_copyback(op_err, err_at, sizeof(struct sctp_paramhdr), (caddr_t)phdr); 5299 } 5300 return (op_err); 5301} 5302 5303static int 5304sctp_are_there_new_addresses(struct sctp_association *asoc, 5305 struct mbuf *in_initpkt, int offset, struct sockaddr *src) 5306{ 5307 /* 5308 * Given a INIT packet, look through the packet to verify that there 5309 * are NO new addresses. As we go through the parameters add reports 5310 * of any un-understood parameters that require an error. Also we 5311 * must return (1) to drop the packet if we see a un-understood 5312 * parameter that tells us to drop the chunk. 5313 */ 5314 struct sockaddr *sa_touse; 5315 struct sockaddr *sa; 5316 struct sctp_paramhdr *phdr, params; 5317 uint16_t ptype, plen; 5318 uint8_t fnd; 5319 struct sctp_nets *net; 5320 5321#ifdef INET 5322 struct sockaddr_in sin4, *sa4; 5323 5324#endif 5325#ifdef INET6 5326 struct sockaddr_in6 sin6, *sa6; 5327 5328#endif 5329 5330#ifdef INET 5331 memset(&sin4, 0, sizeof(sin4)); 5332 sin4.sin_family = AF_INET; 5333 sin4.sin_len = sizeof(sin4); 5334#endif 5335#ifdef INET6 5336 memset(&sin6, 0, sizeof(sin6)); 5337 sin6.sin6_family = AF_INET6; 5338 sin6.sin6_len = sizeof(sin6); 5339#endif 5340 /* First what about the src address of the pkt ? */ 5341 fnd = 0; 5342 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5343 sa = (struct sockaddr *)&net->ro._l_addr; 5344 if (sa->sa_family == src->sa_family) { 5345#ifdef INET 5346 if (sa->sa_family == AF_INET) { 5347 struct sockaddr_in *src4; 5348 5349 sa4 = (struct sockaddr_in *)sa; 5350 src4 = (struct sockaddr_in *)src; 5351 if (sa4->sin_addr.s_addr == src4->sin_addr.s_addr) { 5352 fnd = 1; 5353 break; 5354 } 5355 } 5356#endif 5357#ifdef INET6 5358 if (sa->sa_family == AF_INET6) { 5359 struct sockaddr_in6 *src6; 5360 5361 sa6 = (struct sockaddr_in6 *)sa; 5362 src6 = (struct sockaddr_in6 *)src; 5363 if (SCTP6_ARE_ADDR_EQUAL(sa6, src6)) { 5364 fnd = 1; 5365 break; 5366 } 5367 } 5368#endif 5369 } 5370 } 5371 if (fnd == 0) { 5372 /* New address added! no need to look futher. */ 5373 return (1); 5374 } 5375 /* Ok so far lets munge through the rest of the packet */ 5376 offset += sizeof(struct sctp_init_chunk); 5377 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5378 while (phdr) { 5379 sa_touse = NULL; 5380 ptype = ntohs(phdr->param_type); 5381 plen = ntohs(phdr->param_length); 5382 switch (ptype) { 5383#ifdef INET 5384 case SCTP_IPV4_ADDRESS: 5385 { 5386 struct sctp_ipv4addr_param *p4, p4_buf; 5387 5388 phdr = sctp_get_next_param(in_initpkt, offset, 5389 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 5390 if (plen != sizeof(struct sctp_ipv4addr_param) || 5391 phdr == NULL) { 5392 return (1); 5393 } 5394 p4 = (struct sctp_ipv4addr_param *)phdr; 5395 sin4.sin_addr.s_addr = p4->addr; 5396 sa_touse = (struct sockaddr *)&sin4; 5397 break; 5398 } 5399#endif 5400#ifdef INET6 5401 case SCTP_IPV6_ADDRESS: 5402 { 5403 struct sctp_ipv6addr_param *p6, p6_buf; 5404 5405 phdr = sctp_get_next_param(in_initpkt, offset, 5406 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 5407 if (plen != sizeof(struct sctp_ipv6addr_param) || 5408 phdr == NULL) { 5409 return (1); 5410 } 5411 p6 = (struct sctp_ipv6addr_param *)phdr; 5412 memcpy((caddr_t)&sin6.sin6_addr, p6->addr, 5413 sizeof(p6->addr)); 5414 sa_touse = (struct sockaddr *)&sin6; 5415 break; 5416 } 5417#endif 5418 default: 5419 sa_touse = NULL; 5420 break; 5421 } 5422 if (sa_touse) { 5423 /* ok, sa_touse points to one to check */ 5424 fnd = 0; 5425 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5426 sa = (struct sockaddr *)&net->ro._l_addr; 5427 if (sa->sa_family != sa_touse->sa_family) { 5428 continue; 5429 } 5430#ifdef INET 5431 if (sa->sa_family == AF_INET) { 5432 sa4 = (struct sockaddr_in *)sa; 5433 if (sa4->sin_addr.s_addr == 5434 sin4.sin_addr.s_addr) { 5435 fnd = 1; 5436 break; 5437 } 5438 } 5439#endif 5440#ifdef INET6 5441 if (sa->sa_family == AF_INET6) { 5442 sa6 = (struct sockaddr_in6 *)sa; 5443 if (SCTP6_ARE_ADDR_EQUAL( 5444 sa6, &sin6)) { 5445 fnd = 1; 5446 break; 5447 } 5448 } 5449#endif 5450 } 5451 if (!fnd) { 5452 /* New addr added! no need to look further */ 5453 return (1); 5454 } 5455 } 5456 offset += SCTP_SIZE32(plen); 5457 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5458 } 5459 return (0); 5460} 5461 5462/* 5463 * Given a MBUF chain that was sent into us containing an INIT. Build a 5464 * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done 5465 * a pullup to include IPv6/4header, SCTP header and initial part of INIT 5466 * message (i.e. the struct sctp_init_msg). 5467 */ 5468void 5469sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 5470 struct mbuf *init_pkt, int iphlen, int offset, 5471 struct sockaddr *src, struct sockaddr *dst, 5472 struct sctphdr *sh, struct sctp_init_chunk *init_chk, 5473 uint8_t mflowtype, uint32_t mflowid, 5474 uint32_t vrf_id, uint16_t port, int hold_inp_lock) 5475{ 5476 struct sctp_association *asoc; 5477 struct mbuf *m, *m_tmp, *m_last, *m_cookie, *op_err; 5478 struct sctp_init_ack_chunk *initack; 5479 struct sctp_adaptation_layer_indication *ali; 5480 struct sctp_supported_chunk_types_param *pr_supported; 5481 struct sctp_paramhdr *ph; 5482 union sctp_sockstore *over_addr; 5483 struct sctp_scoping scp; 5484 5485#ifdef INET 5486 struct sockaddr_in *dst4 = (struct sockaddr_in *)dst; 5487 struct sockaddr_in *src4 = (struct sockaddr_in *)src; 5488 struct sockaddr_in *sin; 5489 5490#endif 5491#ifdef INET6 5492 struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst; 5493 struct sockaddr_in6 *src6 = (struct sockaddr_in6 *)src; 5494 struct sockaddr_in6 *sin6; 5495 5496#endif 5497 struct sockaddr *to; 5498 struct sctp_state_cookie stc; 5499 struct sctp_nets *net = NULL; 5500 uint8_t *signature = NULL; 5501 int cnt_inits_to = 0; 5502 uint16_t his_limit, i_want; 5503 int abort_flag; 5504 int nat_friendly = 0; 5505 struct socket *so; 5506 uint16_t num_ext, chunk_len, padding_len, parameter_len; 5507 5508 if (stcb) { 5509 asoc = &stcb->asoc; 5510 } else { 5511 asoc = NULL; 5512 } 5513 if ((asoc != NULL) && 5514 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) && 5515 (sctp_are_there_new_addresses(asoc, init_pkt, offset, src))) { 5516 /* new addresses, out of here in non-cookie-wait states */ 5517 /* 5518 * Send a ABORT, we don't add the new address error clause 5519 * though we even set the T bit and copy in the 0 tag.. this 5520 * looks no different than if no listener was present. 5521 */ 5522 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5523 "Address added"); 5524 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5525 mflowtype, mflowid, 5526 vrf_id, port); 5527 return; 5528 } 5529 abort_flag = 0; 5530 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 5531 (offset + sizeof(struct sctp_init_chunk)), 5532 &abort_flag, (struct sctp_chunkhdr *)init_chk, &nat_friendly); 5533 if (abort_flag) { 5534do_a_abort: 5535 if (op_err == NULL) { 5536 char msg[SCTP_DIAG_INFO_LEN]; 5537 5538 snprintf(msg, sizeof(msg), "%s:%d at %s\n", __FILE__, __LINE__, __FUNCTION__); 5539 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5540 msg); 5541 } 5542 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 5543 init_chk->init.initiate_tag, op_err, 5544 mflowtype, mflowid, 5545 vrf_id, port); 5546 return; 5547 } 5548 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 5549 if (m == NULL) { 5550 /* No memory, INIT timer will re-attempt. */ 5551 if (op_err) 5552 sctp_m_freem(op_err); 5553 return; 5554 } 5555 chunk_len = (uint16_t) sizeof(struct sctp_init_ack_chunk); 5556 padding_len = 0; 5557 5558 /* 5559 * We might not overwrite the identification[] completely and on 5560 * some platforms time_entered will contain some padding. Therefore 5561 * zero out the cookie to avoid putting uninitialized memory on the 5562 * wire. 5563 */ 5564 memset(&stc, 0, sizeof(struct sctp_state_cookie)); 5565 5566 /* the time I built cookie */ 5567 (void)SCTP_GETTIME_TIMEVAL(&stc.time_entered); 5568 5569 /* populate any tie tags */ 5570 if (asoc != NULL) { 5571 /* unlock before tag selections */ 5572 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 5573 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 5574 stc.cookie_life = asoc->cookie_life; 5575 net = asoc->primary_destination; 5576 } else { 5577 stc.tie_tag_my_vtag = 0; 5578 stc.tie_tag_peer_vtag = 0; 5579 /* life I will award this cookie */ 5580 stc.cookie_life = inp->sctp_ep.def_cookie_life; 5581 } 5582 5583 /* copy in the ports for later check */ 5584 stc.myport = sh->dest_port; 5585 stc.peerport = sh->src_port; 5586 5587 /* 5588 * If we wanted to honor cookie life extentions, we would add to 5589 * stc.cookie_life. For now we should NOT honor any extension 5590 */ 5591 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 5592 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5593 stc.ipv6_addr_legal = 1; 5594 if (SCTP_IPV6_V6ONLY(inp)) { 5595 stc.ipv4_addr_legal = 0; 5596 } else { 5597 stc.ipv4_addr_legal = 1; 5598 } 5599 } else { 5600 stc.ipv6_addr_legal = 0; 5601 stc.ipv4_addr_legal = 1; 5602 } 5603#ifdef SCTP_DONT_DO_PRIVADDR_SCOPE 5604 stc.ipv4_scope = 1; 5605#else 5606 stc.ipv4_scope = 0; 5607#endif 5608 if (net == NULL) { 5609 to = src; 5610 switch (dst->sa_family) { 5611#ifdef INET 5612 case AF_INET: 5613 { 5614 /* lookup address */ 5615 stc.address[0] = src4->sin_addr.s_addr; 5616 stc.address[1] = 0; 5617 stc.address[2] = 0; 5618 stc.address[3] = 0; 5619 stc.addr_type = SCTP_IPV4_ADDRESS; 5620 /* local from address */ 5621 stc.laddress[0] = dst4->sin_addr.s_addr; 5622 stc.laddress[1] = 0; 5623 stc.laddress[2] = 0; 5624 stc.laddress[3] = 0; 5625 stc.laddr_type = SCTP_IPV4_ADDRESS; 5626 /* scope_id is only for v6 */ 5627 stc.scope_id = 0; 5628#ifndef SCTP_DONT_DO_PRIVADDR_SCOPE 5629 if (IN4_ISPRIVATE_ADDRESS(&src4->sin_addr)) { 5630 stc.ipv4_scope = 1; 5631 } 5632#else 5633 stc.ipv4_scope = 1; 5634#endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */ 5635 /* Must use the address in this case */ 5636 if (sctp_is_address_on_local_host(src, vrf_id)) { 5637 stc.loopback_scope = 1; 5638 stc.ipv4_scope = 1; 5639 stc.site_scope = 1; 5640 stc.local_scope = 0; 5641 } 5642 break; 5643 } 5644#endif 5645#ifdef INET6 5646 case AF_INET6: 5647 { 5648 stc.addr_type = SCTP_IPV6_ADDRESS; 5649 memcpy(&stc.address, &src6->sin6_addr, sizeof(struct in6_addr)); 5650 stc.scope_id = in6_getscope(&src6->sin6_addr); 5651 if (sctp_is_address_on_local_host(src, vrf_id)) { 5652 stc.loopback_scope = 1; 5653 stc.local_scope = 0; 5654 stc.site_scope = 1; 5655 stc.ipv4_scope = 1; 5656 } else if (IN6_IS_ADDR_LINKLOCAL(&src6->sin6_addr)) { 5657 /* 5658 * If the new destination is a 5659 * LINK_LOCAL we must have common 5660 * both site and local scope. Don't 5661 * set local scope though since we 5662 * must depend on the source to be 5663 * added implicitly. We cannot 5664 * assure just because we share one 5665 * link that all links are common. 5666 */ 5667 stc.local_scope = 0; 5668 stc.site_scope = 1; 5669 stc.ipv4_scope = 1; 5670 /* 5671 * we start counting for the private 5672 * address stuff at 1. since the 5673 * link local we source from won't 5674 * show up in our scoped count. 5675 */ 5676 cnt_inits_to = 1; 5677 /* 5678 * pull out the scope_id from 5679 * incoming pkt 5680 */ 5681 } else if (IN6_IS_ADDR_SITELOCAL(&src6->sin6_addr)) { 5682 /* 5683 * If the new destination is 5684 * SITE_LOCAL then we must have site 5685 * scope in common. 5686 */ 5687 stc.site_scope = 1; 5688 } 5689 memcpy(&stc.laddress, &dst6->sin6_addr, sizeof(struct in6_addr)); 5690 stc.laddr_type = SCTP_IPV6_ADDRESS; 5691 break; 5692 } 5693#endif 5694 default: 5695 /* TSNH */ 5696 goto do_a_abort; 5697 break; 5698 } 5699 } else { 5700 /* set the scope per the existing tcb */ 5701 5702#ifdef INET6 5703 struct sctp_nets *lnet; 5704 5705#endif 5706 5707 stc.loopback_scope = asoc->scope.loopback_scope; 5708 stc.ipv4_scope = asoc->scope.ipv4_local_scope; 5709 stc.site_scope = asoc->scope.site_scope; 5710 stc.local_scope = asoc->scope.local_scope; 5711#ifdef INET6 5712 /* Why do we not consider IPv4 LL addresses? */ 5713 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 5714 if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) { 5715 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) { 5716 /* 5717 * if we have a LL address, start 5718 * counting at 1. 5719 */ 5720 cnt_inits_to = 1; 5721 } 5722 } 5723 } 5724#endif 5725 /* use the net pointer */ 5726 to = (struct sockaddr *)&net->ro._l_addr; 5727 switch (to->sa_family) { 5728#ifdef INET 5729 case AF_INET: 5730 sin = (struct sockaddr_in *)to; 5731 stc.address[0] = sin->sin_addr.s_addr; 5732 stc.address[1] = 0; 5733 stc.address[2] = 0; 5734 stc.address[3] = 0; 5735 stc.addr_type = SCTP_IPV4_ADDRESS; 5736 if (net->src_addr_selected == 0) { 5737 /* 5738 * strange case here, the INIT should have 5739 * did the selection. 5740 */ 5741 net->ro._s_addr = sctp_source_address_selection(inp, 5742 stcb, (sctp_route_t *) & net->ro, 5743 net, 0, vrf_id); 5744 if (net->ro._s_addr == NULL) 5745 return; 5746 5747 net->src_addr_selected = 1; 5748 5749 } 5750 stc.laddress[0] = net->ro._s_addr->address.sin.sin_addr.s_addr; 5751 stc.laddress[1] = 0; 5752 stc.laddress[2] = 0; 5753 stc.laddress[3] = 0; 5754 stc.laddr_type = SCTP_IPV4_ADDRESS; 5755 /* scope_id is only for v6 */ 5756 stc.scope_id = 0; 5757 break; 5758#endif 5759#ifdef INET6 5760 case AF_INET6: 5761 sin6 = (struct sockaddr_in6 *)to; 5762 memcpy(&stc.address, &sin6->sin6_addr, 5763 sizeof(struct in6_addr)); 5764 stc.addr_type = SCTP_IPV6_ADDRESS; 5765 stc.scope_id = sin6->sin6_scope_id; 5766 if (net->src_addr_selected == 0) { 5767 /* 5768 * strange case here, the INIT should have 5769 * done the selection. 5770 */ 5771 net->ro._s_addr = sctp_source_address_selection(inp, 5772 stcb, (sctp_route_t *) & net->ro, 5773 net, 0, vrf_id); 5774 if (net->ro._s_addr == NULL) 5775 return; 5776 5777 net->src_addr_selected = 1; 5778 } 5779 memcpy(&stc.laddress, &net->ro._s_addr->address.sin6.sin6_addr, 5780 sizeof(struct in6_addr)); 5781 stc.laddr_type = SCTP_IPV6_ADDRESS; 5782 break; 5783#endif 5784 } 5785 } 5786 /* Now lets put the SCTP header in place */ 5787 initack = mtod(m, struct sctp_init_ack_chunk *); 5788 /* Save it off for quick ref */ 5789 stc.peers_vtag = init_chk->init.initiate_tag; 5790 /* who are we */ 5791 memcpy(stc.identification, SCTP_VERSION_STRING, 5792 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 5793 memset(stc.reserved, 0, SCTP_RESERVE_SPACE); 5794 /* now the chunk header */ 5795 initack->ch.chunk_type = SCTP_INITIATION_ACK; 5796 initack->ch.chunk_flags = 0; 5797 /* fill in later from mbuf we build */ 5798 initack->ch.chunk_length = 0; 5799 /* place in my tag */ 5800 if ((asoc != NULL) && 5801 ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 5802 (SCTP_GET_STATE(asoc) == SCTP_STATE_INUSE) || 5803 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) { 5804 /* re-use the v-tags and init-seq here */ 5805 initack->init.initiate_tag = htonl(asoc->my_vtag); 5806 initack->init.initial_tsn = htonl(asoc->init_seq_number); 5807 } else { 5808 uint32_t vtag, itsn; 5809 5810 if (hold_inp_lock) { 5811 SCTP_INP_INCR_REF(inp); 5812 SCTP_INP_RUNLOCK(inp); 5813 } 5814 if (asoc) { 5815 atomic_add_int(&asoc->refcnt, 1); 5816 SCTP_TCB_UNLOCK(stcb); 5817 new_tag: 5818 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5819 if ((asoc->peer_supports_nat) && (vtag == asoc->my_vtag)) { 5820 /* 5821 * Got a duplicate vtag on some guy behind a 5822 * nat make sure we don't use it. 5823 */ 5824 goto new_tag; 5825 } 5826 initack->init.initiate_tag = htonl(vtag); 5827 /* get a TSN to use too */ 5828 itsn = sctp_select_initial_TSN(&inp->sctp_ep); 5829 initack->init.initial_tsn = htonl(itsn); 5830 SCTP_TCB_LOCK(stcb); 5831 atomic_add_int(&asoc->refcnt, -1); 5832 } else { 5833 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5834 initack->init.initiate_tag = htonl(vtag); 5835 /* get a TSN to use too */ 5836 initack->init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 5837 } 5838 if (hold_inp_lock) { 5839 SCTP_INP_RLOCK(inp); 5840 SCTP_INP_DECR_REF(inp); 5841 } 5842 } 5843 /* save away my tag to */ 5844 stc.my_vtag = initack->init.initiate_tag; 5845 5846 /* set up some of the credits. */ 5847 so = inp->sctp_socket; 5848 if (so == NULL) { 5849 /* memory problem */ 5850 sctp_m_freem(m); 5851 return; 5852 } else { 5853 initack->init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(so), SCTP_MINIMAL_RWND)); 5854 } 5855 /* set what I want */ 5856 his_limit = ntohs(init_chk->init.num_inbound_streams); 5857 /* choose what I want */ 5858 if (asoc != NULL) { 5859 if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) { 5860 i_want = asoc->streamoutcnt; 5861 } else { 5862 i_want = inp->sctp_ep.pre_open_stream_count; 5863 } 5864 } else { 5865 i_want = inp->sctp_ep.pre_open_stream_count; 5866 } 5867 if (his_limit < i_want) { 5868 /* I Want more :< */ 5869 initack->init.num_outbound_streams = init_chk->init.num_inbound_streams; 5870 } else { 5871 /* I can have what I want :> */ 5872 initack->init.num_outbound_streams = htons(i_want); 5873 } 5874 /* tell him his limit. */ 5875 initack->init.num_inbound_streams = 5876 htons(inp->sctp_ep.max_open_streams_intome); 5877 5878 /* adaptation layer indication parameter */ 5879 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 5880 parameter_len = (uint16_t) sizeof(struct sctp_adaptation_layer_indication); 5881 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 5882 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 5883 ali->ph.param_length = htons(parameter_len); 5884 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 5885 chunk_len += parameter_len; 5886 } 5887 /* ECN parameter */ 5888 if (((asoc != NULL) && (asoc->ecn_supported == 1)) || 5889 ((asoc == NULL) && (inp->ecn_supported == 1))) { 5890 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 5891 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5892 ph->param_type = htons(SCTP_ECN_CAPABLE); 5893 ph->param_length = htons(parameter_len); 5894 chunk_len += parameter_len; 5895 } 5896 /* PR-SCTP supported parameter */ 5897 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5898 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5899 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 5900 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5901 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 5902 ph->param_length = htons(parameter_len); 5903 chunk_len += parameter_len; 5904 } 5905 /* Add NAT friendly parameter */ 5906 if (nat_friendly) { 5907 parameter_len = (uint16_t) sizeof(struct sctp_paramhdr); 5908 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5909 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 5910 ph->param_length = htons(parameter_len); 5911 chunk_len += parameter_len; 5912 } 5913 /* And now tell the peer which extensions we support */ 5914 num_ext = 0; 5915 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 5916 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5917 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5918 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 5919 } 5920 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5921 ((asoc == NULL) && (inp->auth_supported == 1))) { 5922 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 5923 } 5924 if (((asoc != NULL) && (asoc->asconf_supported == 1)) || 5925 ((asoc == NULL) && (inp->asconf_supported == 1))) { 5926 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 5927 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 5928 } 5929 if (((asoc != NULL) && (asoc->reconfig_supported == 1)) || 5930 ((asoc == NULL) && (inp->reconfig_supported == 1))) { 5931 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 5932 } 5933 if (((asoc != NULL) && (asoc->nrsack_supported == 1)) || 5934 ((asoc == NULL) && (inp->nrsack_supported == 1))) { 5935 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 5936 } 5937 if (((asoc != NULL) && (asoc->pktdrop_supported == 1)) || 5938 ((asoc == NULL) && (inp->pktdrop_supported == 1))) { 5939 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 5940 } 5941 if (num_ext > 0) { 5942 parameter_len = (uint16_t) sizeof(struct sctp_supported_chunk_types_param) + num_ext; 5943 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 5944 pr_supported->ph.param_length = htons(parameter_len); 5945 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5946 chunk_len += parameter_len; 5947 } 5948 /* add authentication parameters */ 5949 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5950 ((asoc == NULL) && (inp->auth_supported == 1))) { 5951 struct sctp_auth_random *randp; 5952 struct sctp_auth_hmac_algo *hmacs; 5953 struct sctp_auth_chunk_list *chunks; 5954 5955 if (padding_len > 0) { 5956 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 5957 chunk_len += padding_len; 5958 padding_len = 0; 5959 } 5960 /* generate and add RANDOM parameter */ 5961 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 5962 parameter_len = (uint16_t) sizeof(struct sctp_auth_random) + 5963 SCTP_AUTH_RANDOM_SIZE_DEFAULT; 5964 randp->ph.param_type = htons(SCTP_RANDOM); 5965 randp->ph.param_length = htons(parameter_len); 5966 SCTP_READ_RANDOM(randp->random_data, SCTP_AUTH_RANDOM_SIZE_DEFAULT); 5967 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5968 chunk_len += parameter_len; 5969 5970 if (padding_len > 0) { 5971 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 5972 chunk_len += padding_len; 5973 padding_len = 0; 5974 } 5975 /* add HMAC_ALGO parameter */ 5976 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 5977 parameter_len = (uint16_t) sizeof(struct sctp_auth_hmac_algo) + 5978 sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs, 5979 (uint8_t *) hmacs->hmac_ids); 5980 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 5981 hmacs->ph.param_length = htons(parameter_len); 5982 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5983 chunk_len += parameter_len; 5984 5985 if (padding_len > 0) { 5986 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 5987 chunk_len += padding_len; 5988 padding_len = 0; 5989 } 5990 /* add CHUNKS parameter */ 5991 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 5992 parameter_len = (uint16_t) sizeof(struct sctp_auth_chunk_list) + 5993 sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks, 5994 chunks->chunk_types); 5995 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 5996 chunks->ph.param_length = htons(parameter_len); 5997 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5998 chunk_len += parameter_len; 5999 } 6000 SCTP_BUF_LEN(m) = chunk_len; 6001 m_last = m; 6002 /* now the addresses */ 6003 /* 6004 * To optimize this we could put the scoping stuff into a structure 6005 * and remove the individual uint8's from the stc structure. Then we 6006 * could just sifa in the address within the stc.. but for now this 6007 * is a quick hack to get the address stuff teased apart. 6008 */ 6009 scp.ipv4_addr_legal = stc.ipv4_addr_legal; 6010 scp.ipv6_addr_legal = stc.ipv6_addr_legal; 6011 scp.loopback_scope = stc.loopback_scope; 6012 scp.ipv4_local_scope = stc.ipv4_scope; 6013 scp.local_scope = stc.local_scope; 6014 scp.site_scope = stc.site_scope; 6015 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &scp, m_last, 6016 cnt_inits_to, 6017 &padding_len, &chunk_len); 6018 /* padding_len can only be positive, if no addresses have been added */ 6019 if (padding_len > 0) { 6020 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6021 chunk_len += padding_len; 6022 SCTP_BUF_LEN(m) += padding_len; 6023 padding_len = 0; 6024 } 6025 /* tack on the operational error if present */ 6026 if (op_err) { 6027 parameter_len = 0; 6028 for (m_tmp = op_err; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6029 parameter_len += SCTP_BUF_LEN(m_tmp); 6030 } 6031 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6032 SCTP_BUF_NEXT(m_last) = op_err; 6033 while (SCTP_BUF_NEXT(m_last) != NULL) { 6034 m_last = SCTP_BUF_NEXT(m_last); 6035 } 6036 chunk_len += parameter_len; 6037 } 6038 if (padding_len > 0) { 6039 m_last = sctp_add_pad_tombuf(m_last, padding_len); 6040 if (m_last == NULL) { 6041 /* Houston we have a problem, no space */ 6042 sctp_m_freem(m); 6043 return; 6044 } 6045 chunk_len += padding_len; 6046 padding_len = 0; 6047 } 6048 /* Now we must build a cookie */ 6049 m_cookie = sctp_add_cookie(init_pkt, offset, m, 0, &stc, &signature); 6050 if (m_cookie == NULL) { 6051 /* memory problem */ 6052 sctp_m_freem(m); 6053 return; 6054 } 6055 /* Now append the cookie to the end and update the space/size */ 6056 SCTP_BUF_NEXT(m_last) = m_cookie; 6057 parameter_len = 0; 6058 for (m_tmp = m_cookie; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6059 parameter_len += SCTP_BUF_LEN(m_tmp); 6060 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 6061 m_last = m_tmp; 6062 } 6063 } 6064 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6065 chunk_len += parameter_len; 6066 6067 /* 6068 * Place in the size, but we don't include the last pad (if any) in 6069 * the INIT-ACK. 6070 */ 6071 initack->ch.chunk_length = htons(chunk_len); 6072 6073 /* 6074 * Time to sign the cookie, we don't sign over the cookie signature 6075 * though thus we set trailer. 6076 */ 6077 (void)sctp_hmac_m(SCTP_HMAC, 6078 (uint8_t *) inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)], 6079 SCTP_SECRET_SIZE, m_cookie, sizeof(struct sctp_paramhdr), 6080 (uint8_t *) signature, SCTP_SIGNATURE_SIZE); 6081 /* 6082 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return 6083 * here since the timer will drive a retranmission. 6084 */ 6085 if (padding_len > 0) { 6086 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 6087 sctp_m_freem(m); 6088 return; 6089 } 6090 } 6091 if (stc.loopback_scope) { 6092 over_addr = (union sctp_sockstore *)dst; 6093 } else { 6094 over_addr = NULL; 6095 } 6096 6097 (void)sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0, 6098 0, 0, 6099 inp->sctp_lport, sh->src_port, init_chk->init.initiate_tag, 6100 port, over_addr, 6101 mflowtype, mflowid, 6102 SCTP_SO_NOT_LOCKED); 6103 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 6104} 6105 6106 6107static void 6108sctp_prune_prsctp(struct sctp_tcb *stcb, 6109 struct sctp_association *asoc, 6110 struct sctp_sndrcvinfo *srcv, 6111 int dataout) 6112{ 6113 int freed_spc = 0; 6114 struct sctp_tmit_chunk *chk, *nchk; 6115 6116 SCTP_TCB_LOCK_ASSERT(stcb); 6117 if ((asoc->prsctp_supported) && 6118 (asoc->sent_queue_cnt_removeable > 0)) { 6119 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6120 /* 6121 * Look for chunks marked with the PR_SCTP flag AND 6122 * the buffer space flag. If the one being sent is 6123 * equal or greater priority then purge the old one 6124 * and free some space. 6125 */ 6126 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6127 /* 6128 * This one is PR-SCTP AND buffer space 6129 * limited type 6130 */ 6131 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 6132 /* 6133 * Lower numbers equates to higher 6134 * priority so if the one we are 6135 * looking at has a larger or equal 6136 * priority we want to drop the data 6137 * and NOT retransmit it. 6138 */ 6139 if (chk->data) { 6140 /* 6141 * We release the book_size 6142 * if the mbuf is here 6143 */ 6144 int ret_spc; 6145 uint8_t sent; 6146 6147 if (chk->sent > SCTP_DATAGRAM_UNSENT) 6148 sent = 1; 6149 else 6150 sent = 0; 6151 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6152 sent, 6153 SCTP_SO_LOCKED); 6154 freed_spc += ret_spc; 6155 if (freed_spc >= dataout) { 6156 return; 6157 } 6158 } /* if chunk was present */ 6159 } /* if of sufficent priority */ 6160 } /* if chunk has enabled */ 6161 } /* tailqforeach */ 6162 6163 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 6164 /* Here we must move to the sent queue and mark */ 6165 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6166 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 6167 if (chk->data) { 6168 /* 6169 * We release the book_size 6170 * if the mbuf is here 6171 */ 6172 int ret_spc; 6173 6174 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6175 0, SCTP_SO_LOCKED); 6176 6177 freed_spc += ret_spc; 6178 if (freed_spc >= dataout) { 6179 return; 6180 } 6181 } /* end if chk->data */ 6182 } /* end if right class */ 6183 } /* end if chk pr-sctp */ 6184 } /* tailqforeachsafe (chk) */ 6185 } /* if enabled in asoc */ 6186} 6187 6188int 6189sctp_get_frag_point(struct sctp_tcb *stcb, 6190 struct sctp_association *asoc) 6191{ 6192 int siz, ovh; 6193 6194 /* 6195 * For endpoints that have both v6 and v4 addresses we must reserve 6196 * room for the ipv6 header, for those that are only dealing with V4 6197 * we use a larger frag point. 6198 */ 6199 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6200 ovh = SCTP_MED_OVERHEAD; 6201 } else { 6202 ovh = SCTP_MED_V4_OVERHEAD; 6203 } 6204 6205 if (stcb->asoc.sctp_frag_point > asoc->smallest_mtu) 6206 siz = asoc->smallest_mtu - ovh; 6207 else 6208 siz = (stcb->asoc.sctp_frag_point - ovh); 6209 /* 6210 * if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { 6211 */ 6212 /* A data chunk MUST fit in a cluster */ 6213 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk)); */ 6214 /* } */ 6215 6216 /* adjust for an AUTH chunk if DATA requires auth */ 6217 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) 6218 siz -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 6219 6220 if (siz % 4) { 6221 /* make it an even word boundary please */ 6222 siz -= (siz % 4); 6223 } 6224 return (siz); 6225} 6226 6227static void 6228sctp_set_prsctp_policy(struct sctp_stream_queue_pending *sp) 6229{ 6230 /* 6231 * We assume that the user wants PR_SCTP_TTL if the user provides a 6232 * positive lifetime but does not specify any PR_SCTP policy. 6233 */ 6234 if (PR_SCTP_ENABLED(sp->sinfo_flags)) { 6235 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6236 } else if (sp->timetolive > 0) { 6237 sp->sinfo_flags |= SCTP_PR_SCTP_TTL; 6238 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6239 } else { 6240 return; 6241 } 6242 switch (PR_SCTP_POLICY(sp->sinfo_flags)) { 6243 case CHUNK_FLAGS_PR_SCTP_BUF: 6244 /* 6245 * Time to live is a priority stored in tv_sec when doing 6246 * the buffer drop thing. 6247 */ 6248 sp->ts.tv_sec = sp->timetolive; 6249 sp->ts.tv_usec = 0; 6250 break; 6251 case CHUNK_FLAGS_PR_SCTP_TTL: 6252 { 6253 struct timeval tv; 6254 6255 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6256 tv.tv_sec = sp->timetolive / 1000; 6257 tv.tv_usec = (sp->timetolive * 1000) % 1000000; 6258 /* 6259 * TODO sctp_constants.h needs alternative time 6260 * macros when _KERNEL is undefined. 6261 */ 6262 timevaladd(&sp->ts, &tv); 6263 } 6264 break; 6265 case CHUNK_FLAGS_PR_SCTP_RTX: 6266 /* 6267 * Time to live is a the number or retransmissions stored in 6268 * tv_sec. 6269 */ 6270 sp->ts.tv_sec = sp->timetolive; 6271 sp->ts.tv_usec = 0; 6272 break; 6273 default: 6274 SCTPDBG(SCTP_DEBUG_USRREQ1, 6275 "Unknown PR_SCTP policy %u.\n", 6276 PR_SCTP_POLICY(sp->sinfo_flags)); 6277 break; 6278 } 6279} 6280 6281static int 6282sctp_msg_append(struct sctp_tcb *stcb, 6283 struct sctp_nets *net, 6284 struct mbuf *m, 6285 struct sctp_sndrcvinfo *srcv, int hold_stcb_lock) 6286{ 6287 int error = 0; 6288 struct mbuf *at; 6289 struct sctp_stream_queue_pending *sp = NULL; 6290 struct sctp_stream_out *strm; 6291 6292 /* 6293 * Given an mbuf chain, put it into the association send queue and 6294 * place it on the wheel 6295 */ 6296 if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) { 6297 /* Invalid stream number */ 6298 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6299 error = EINVAL; 6300 goto out_now; 6301 } 6302 if ((stcb->asoc.stream_locked) && 6303 (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) { 6304 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6305 error = EINVAL; 6306 goto out_now; 6307 } 6308 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 6309 /* Now can we send this? */ 6310 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_SENT) || 6311 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 6312 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 6313 (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) { 6314 /* got data while shutting down */ 6315 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 6316 error = ECONNRESET; 6317 goto out_now; 6318 } 6319 sctp_alloc_a_strmoq(stcb, sp); 6320 if (sp == NULL) { 6321 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6322 error = ENOMEM; 6323 goto out_now; 6324 } 6325 sp->sinfo_flags = srcv->sinfo_flags; 6326 sp->timetolive = srcv->sinfo_timetolive; 6327 sp->ppid = srcv->sinfo_ppid; 6328 sp->context = srcv->sinfo_context; 6329 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 6330 sp->net = net; 6331 atomic_add_int(&sp->net->ref_count, 1); 6332 } else { 6333 sp->net = NULL; 6334 } 6335 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6336 sp->stream = srcv->sinfo_stream; 6337 sp->msg_is_complete = 1; 6338 sp->sender_all_done = 1; 6339 sp->some_taken = 0; 6340 sp->data = m; 6341 sp->tail_mbuf = NULL; 6342 sctp_set_prsctp_policy(sp); 6343 /* 6344 * We could in theory (for sendall) sifa the length in, but we would 6345 * still have to hunt through the chain since we need to setup the 6346 * tail_mbuf 6347 */ 6348 sp->length = 0; 6349 for (at = m; at; at = SCTP_BUF_NEXT(at)) { 6350 if (SCTP_BUF_NEXT(at) == NULL) 6351 sp->tail_mbuf = at; 6352 sp->length += SCTP_BUF_LEN(at); 6353 } 6354 if (srcv->sinfo_keynumber_valid) { 6355 sp->auth_keyid = srcv->sinfo_keynumber; 6356 } else { 6357 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 6358 } 6359 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 6360 sctp_auth_key_acquire(stcb, sp->auth_keyid); 6361 sp->holds_key_ref = 1; 6362 } 6363 if (hold_stcb_lock == 0) { 6364 SCTP_TCB_SEND_LOCK(stcb); 6365 } 6366 sctp_snd_sb_alloc(stcb, sp->length); 6367 atomic_add_int(&stcb->asoc.stream_queue_cnt, 1); 6368 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 6369 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, &stcb->asoc, strm, sp, 1); 6370 m = NULL; 6371 if (hold_stcb_lock == 0) { 6372 SCTP_TCB_SEND_UNLOCK(stcb); 6373 } 6374out_now: 6375 if (m) { 6376 sctp_m_freem(m); 6377 } 6378 return (error); 6379} 6380 6381 6382static struct mbuf * 6383sctp_copy_mbufchain(struct mbuf *clonechain, 6384 struct mbuf *outchain, 6385 struct mbuf **endofchain, 6386 int can_take_mbuf, 6387 int sizeofcpy, 6388 uint8_t copy_by_ref) 6389{ 6390 struct mbuf *m; 6391 struct mbuf *appendchain; 6392 caddr_t cp; 6393 int len; 6394 6395 if (endofchain == NULL) { 6396 /* error */ 6397error_out: 6398 if (outchain) 6399 sctp_m_freem(outchain); 6400 return (NULL); 6401 } 6402 if (can_take_mbuf) { 6403 appendchain = clonechain; 6404 } else { 6405 if (!copy_by_ref && 6406 (sizeofcpy <= (int)((((SCTP_BASE_SYSCTL(sctp_mbuf_threshold_count) - 1) * MLEN) + MHLEN))) 6407 ) { 6408 /* Its not in a cluster */ 6409 if (*endofchain == NULL) { 6410 /* lets get a mbuf cluster */ 6411 if (outchain == NULL) { 6412 /* This is the general case */ 6413 new_mbuf: 6414 outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6415 if (outchain == NULL) { 6416 goto error_out; 6417 } 6418 SCTP_BUF_LEN(outchain) = 0; 6419 *endofchain = outchain; 6420 /* get the prepend space */ 6421 SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4)); 6422 } else { 6423 /* 6424 * We really should not get a NULL 6425 * in endofchain 6426 */ 6427 /* find end */ 6428 m = outchain; 6429 while (m) { 6430 if (SCTP_BUF_NEXT(m) == NULL) { 6431 *endofchain = m; 6432 break; 6433 } 6434 m = SCTP_BUF_NEXT(m); 6435 } 6436 /* sanity */ 6437 if (*endofchain == NULL) { 6438 /* 6439 * huh, TSNH XXX maybe we 6440 * should panic 6441 */ 6442 sctp_m_freem(outchain); 6443 goto new_mbuf; 6444 } 6445 } 6446 /* get the new end of length */ 6447 len = M_TRAILINGSPACE(*endofchain); 6448 } else { 6449 /* how much is left at the end? */ 6450 len = M_TRAILINGSPACE(*endofchain); 6451 } 6452 /* Find the end of the data, for appending */ 6453 cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain))); 6454 6455 /* Now lets copy it out */ 6456 if (len >= sizeofcpy) { 6457 /* It all fits, copy it in */ 6458 m_copydata(clonechain, 0, sizeofcpy, cp); 6459 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6460 } else { 6461 /* fill up the end of the chain */ 6462 if (len > 0) { 6463 m_copydata(clonechain, 0, len, cp); 6464 SCTP_BUF_LEN((*endofchain)) += len; 6465 /* now we need another one */ 6466 sizeofcpy -= len; 6467 } 6468 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6469 if (m == NULL) { 6470 /* We failed */ 6471 goto error_out; 6472 } 6473 SCTP_BUF_NEXT((*endofchain)) = m; 6474 *endofchain = m; 6475 cp = mtod((*endofchain), caddr_t); 6476 m_copydata(clonechain, len, sizeofcpy, cp); 6477 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6478 } 6479 return (outchain); 6480 } else { 6481 /* copy the old fashion way */ 6482 appendchain = SCTP_M_COPYM(clonechain, 0, M_COPYALL, M_NOWAIT); 6483#ifdef SCTP_MBUF_LOGGING 6484 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6485 struct mbuf *mat; 6486 6487 for (mat = appendchain; mat; mat = SCTP_BUF_NEXT(mat)) { 6488 if (SCTP_BUF_IS_EXTENDED(mat)) { 6489 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 6490 } 6491 } 6492 } 6493#endif 6494 } 6495 } 6496 if (appendchain == NULL) { 6497 /* error */ 6498 if (outchain) 6499 sctp_m_freem(outchain); 6500 return (NULL); 6501 } 6502 if (outchain) { 6503 /* tack on to the end */ 6504 if (*endofchain != NULL) { 6505 SCTP_BUF_NEXT(((*endofchain))) = appendchain; 6506 } else { 6507 m = outchain; 6508 while (m) { 6509 if (SCTP_BUF_NEXT(m) == NULL) { 6510 SCTP_BUF_NEXT(m) = appendchain; 6511 break; 6512 } 6513 m = SCTP_BUF_NEXT(m); 6514 } 6515 } 6516 /* 6517 * save off the end and update the end-chain postion 6518 */ 6519 m = appendchain; 6520 while (m) { 6521 if (SCTP_BUF_NEXT(m) == NULL) { 6522 *endofchain = m; 6523 break; 6524 } 6525 m = SCTP_BUF_NEXT(m); 6526 } 6527 return (outchain); 6528 } else { 6529 /* save off the end and update the end-chain postion */ 6530 m = appendchain; 6531 while (m) { 6532 if (SCTP_BUF_NEXT(m) == NULL) { 6533 *endofchain = m; 6534 break; 6535 } 6536 m = SCTP_BUF_NEXT(m); 6537 } 6538 return (appendchain); 6539 } 6540} 6541 6542static int 6543sctp_med_chunk_output(struct sctp_inpcb *inp, 6544 struct sctp_tcb *stcb, 6545 struct sctp_association *asoc, 6546 int *num_out, 6547 int *reason_code, 6548 int control_only, int from_where, 6549 struct timeval *now, int *now_filled, int frag_point, int so_locked 6550#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 6551 SCTP_UNUSED 6552#endif 6553); 6554 6555static void 6556sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, 6557 uint32_t val SCTP_UNUSED) 6558{ 6559 struct sctp_copy_all *ca; 6560 struct mbuf *m; 6561 int ret = 0; 6562 int added_control = 0; 6563 int un_sent, do_chunk_output = 1; 6564 struct sctp_association *asoc; 6565 struct sctp_nets *net; 6566 6567 ca = (struct sctp_copy_all *)ptr; 6568 if (ca->m == NULL) { 6569 return; 6570 } 6571 if (ca->inp != inp) { 6572 /* TSNH */ 6573 return; 6574 } 6575 if (ca->sndlen > 0) { 6576 m = SCTP_M_COPYM(ca->m, 0, M_COPYALL, M_NOWAIT); 6577 if (m == NULL) { 6578 /* can't copy so we are done */ 6579 ca->cnt_failed++; 6580 return; 6581 } 6582#ifdef SCTP_MBUF_LOGGING 6583 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6584 struct mbuf *mat; 6585 6586 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 6587 if (SCTP_BUF_IS_EXTENDED(mat)) { 6588 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 6589 } 6590 } 6591 } 6592#endif 6593 } else { 6594 m = NULL; 6595 } 6596 SCTP_TCB_LOCK_ASSERT(stcb); 6597 if (stcb->asoc.alternate) { 6598 net = stcb->asoc.alternate; 6599 } else { 6600 net = stcb->asoc.primary_destination; 6601 } 6602 if (ca->sndrcv.sinfo_flags & SCTP_ABORT) { 6603 /* Abort this assoc with m as the user defined reason */ 6604 if (m != NULL) { 6605 SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_NOWAIT); 6606 } else { 6607 m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 6608 0, M_NOWAIT, 1, MT_DATA); 6609 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr); 6610 } 6611 if (m != NULL) { 6612 struct sctp_paramhdr *ph; 6613 6614 ph = mtod(m, struct sctp_paramhdr *); 6615 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 6616 ph->param_length = htons(sizeof(struct sctp_paramhdr) + ca->sndlen); 6617 } 6618 /* 6619 * We add one here to keep the assoc from dis-appearing on 6620 * us. 6621 */ 6622 atomic_add_int(&stcb->asoc.refcnt, 1); 6623 sctp_abort_an_association(inp, stcb, m, SCTP_SO_NOT_LOCKED); 6624 /* 6625 * sctp_abort_an_association calls sctp_free_asoc() free 6626 * association will NOT free it since we incremented the 6627 * refcnt .. we do this to prevent it being freed and things 6628 * getting tricky since we could end up (from free_asoc) 6629 * calling inpcb_free which would get a recursive lock call 6630 * to the iterator lock.. But as a consequence of that the 6631 * stcb will return to us un-locked.. since free_asoc 6632 * returns with either no TCB or the TCB unlocked, we must 6633 * relock.. to unlock in the iterator timer :-0 6634 */ 6635 SCTP_TCB_LOCK(stcb); 6636 atomic_add_int(&stcb->asoc.refcnt, -1); 6637 goto no_chunk_output; 6638 } else { 6639 if (m) { 6640 ret = sctp_msg_append(stcb, net, m, 6641 &ca->sndrcv, 1); 6642 } 6643 asoc = &stcb->asoc; 6644 if (ca->sndrcv.sinfo_flags & SCTP_EOF) { 6645 /* shutdown this assoc */ 6646 int cnt; 6647 6648 cnt = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED); 6649 6650 if (TAILQ_EMPTY(&asoc->send_queue) && 6651 TAILQ_EMPTY(&asoc->sent_queue) && 6652 (cnt == 0)) { 6653 if (asoc->locked_on_sending) { 6654 goto abort_anyway; 6655 } 6656 /* 6657 * there is nothing queued to send, so I'm 6658 * done... 6659 */ 6660 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 6661 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6662 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6663 /* 6664 * only send SHUTDOWN the first time 6665 * through 6666 */ 6667 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 6668 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 6669 } 6670 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT); 6671 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING); 6672 sctp_stop_timers_for_shutdown(stcb); 6673 sctp_send_shutdown(stcb, net); 6674 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 6675 net); 6676 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6677 asoc->primary_destination); 6678 added_control = 1; 6679 do_chunk_output = 0; 6680 } 6681 } else { 6682 /* 6683 * we still got (or just got) data to send, 6684 * so set SHUTDOWN_PENDING 6685 */ 6686 /* 6687 * XXX sockets draft says that SCTP_EOF 6688 * should be sent with no data. currently, 6689 * we will allow user data to be sent first 6690 * and move to SHUTDOWN-PENDING 6691 */ 6692 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 6693 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6694 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6695 if (asoc->locked_on_sending) { 6696 /* 6697 * Locked to send out the 6698 * data 6699 */ 6700 struct sctp_stream_queue_pending *sp; 6701 6702 sp = TAILQ_LAST(&asoc->locked_on_sending->outqueue, sctp_streamhead); 6703 if (sp) { 6704 if ((sp->length == 0) && (sp->msg_is_complete == 0)) 6705 asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT; 6706 } 6707 } 6708 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 6709 if (TAILQ_EMPTY(&asoc->send_queue) && 6710 TAILQ_EMPTY(&asoc->sent_queue) && 6711 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 6712 abort_anyway: 6713 atomic_add_int(&stcb->asoc.refcnt, 1); 6714 sctp_abort_an_association(stcb->sctp_ep, stcb, 6715 NULL, SCTP_SO_NOT_LOCKED); 6716 atomic_add_int(&stcb->asoc.refcnt, -1); 6717 goto no_chunk_output; 6718 } 6719 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6720 asoc->primary_destination); 6721 } 6722 } 6723 6724 } 6725 } 6726 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 6727 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 6728 6729 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 6730 (stcb->asoc.total_flight > 0) && 6731 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 6732 do_chunk_output = 0; 6733 } 6734 if (do_chunk_output) 6735 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_NOT_LOCKED); 6736 else if (added_control) { 6737 int num_out = 0, reason = 0, now_filled = 0; 6738 struct timeval now; 6739 int frag_point; 6740 6741 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 6742 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 6743 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_NOT_LOCKED); 6744 } 6745no_chunk_output: 6746 if (ret) { 6747 ca->cnt_failed++; 6748 } else { 6749 ca->cnt_sent++; 6750 } 6751} 6752 6753static void 6754sctp_sendall_completes(void *ptr, uint32_t val SCTP_UNUSED) 6755{ 6756 struct sctp_copy_all *ca; 6757 6758 ca = (struct sctp_copy_all *)ptr; 6759 /* 6760 * Do a notify here? Kacheong suggests that the notify be done at 6761 * the send time.. so you would push up a notification if any send 6762 * failed. Don't know if this is feasable since the only failures we 6763 * have is "memory" related and if you cannot get an mbuf to send 6764 * the data you surely can't get an mbuf to send up to notify the 6765 * user you can't send the data :-> 6766 */ 6767 6768 /* now free everything */ 6769 sctp_m_freem(ca->m); 6770 SCTP_FREE(ca, SCTP_M_COPYAL); 6771} 6772 6773static struct mbuf * 6774sctp_copy_out_all(struct uio *uio, int len) 6775{ 6776 struct mbuf *ret, *at; 6777 int left, willcpy, cancpy, error; 6778 6779 ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAITOK, 1, MT_DATA); 6780 if (ret == NULL) { 6781 /* TSNH */ 6782 return (NULL); 6783 } 6784 left = len; 6785 SCTP_BUF_LEN(ret) = 0; 6786 /* save space for the data chunk header */ 6787 cancpy = M_TRAILINGSPACE(ret); 6788 willcpy = min(cancpy, left); 6789 at = ret; 6790 while (left > 0) { 6791 /* Align data to the end */ 6792 error = uiomove(mtod(at, caddr_t), willcpy, uio); 6793 if (error) { 6794 err_out_now: 6795 sctp_m_freem(at); 6796 return (NULL); 6797 } 6798 SCTP_BUF_LEN(at) = willcpy; 6799 SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0; 6800 left -= willcpy; 6801 if (left > 0) { 6802 SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg(left, 0, M_WAITOK, 1, MT_DATA); 6803 if (SCTP_BUF_NEXT(at) == NULL) { 6804 goto err_out_now; 6805 } 6806 at = SCTP_BUF_NEXT(at); 6807 SCTP_BUF_LEN(at) = 0; 6808 cancpy = M_TRAILINGSPACE(at); 6809 willcpy = min(cancpy, left); 6810 } 6811 } 6812 return (ret); 6813} 6814 6815static int 6816sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, 6817 struct sctp_sndrcvinfo *srcv) 6818{ 6819 int ret; 6820 struct sctp_copy_all *ca; 6821 6822 SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all), 6823 SCTP_M_COPYAL); 6824 if (ca == NULL) { 6825 sctp_m_freem(m); 6826 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6827 return (ENOMEM); 6828 } 6829 memset(ca, 0, sizeof(struct sctp_copy_all)); 6830 6831 ca->inp = inp; 6832 if (srcv) { 6833 memcpy(&ca->sndrcv, srcv, sizeof(struct sctp_nonpad_sndrcvinfo)); 6834 } 6835 /* 6836 * take off the sendall flag, it would be bad if we failed to do 6837 * this :-0 6838 */ 6839 ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL; 6840 /* get length and mbuf chain */ 6841 if (uio) { 6842 ca->sndlen = uio->uio_resid; 6843 ca->m = sctp_copy_out_all(uio, ca->sndlen); 6844 if (ca->m == NULL) { 6845 SCTP_FREE(ca, SCTP_M_COPYAL); 6846 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6847 return (ENOMEM); 6848 } 6849 } else { 6850 /* Gather the length of the send */ 6851 struct mbuf *mat; 6852 6853 ca->sndlen = 0; 6854 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 6855 ca->sndlen += SCTP_BUF_LEN(mat); 6856 } 6857 } 6858 ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, NULL, 6859 SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES, 6860 SCTP_ASOC_ANY_STATE, 6861 (void *)ca, 0, 6862 sctp_sendall_completes, inp, 1); 6863 if (ret) { 6864 SCTP_PRINTF("Failed to initiate iterator for sendall\n"); 6865 SCTP_FREE(ca, SCTP_M_COPYAL); 6866 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 6867 return (EFAULT); 6868 } 6869 return (0); 6870} 6871 6872 6873void 6874sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc) 6875{ 6876 struct sctp_tmit_chunk *chk, *nchk; 6877 6878 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 6879 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 6880 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 6881 if (chk->data) { 6882 sctp_m_freem(chk->data); 6883 chk->data = NULL; 6884 } 6885 asoc->ctrl_queue_cnt--; 6886 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6887 } 6888 } 6889} 6890 6891void 6892sctp_toss_old_asconf(struct sctp_tcb *stcb) 6893{ 6894 struct sctp_association *asoc; 6895 struct sctp_tmit_chunk *chk, *nchk; 6896 struct sctp_asconf_chunk *acp; 6897 6898 asoc = &stcb->asoc; 6899 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 6900 /* find SCTP_ASCONF chunk in queue */ 6901 if (chk->rec.chunk_id.id == SCTP_ASCONF) { 6902 if (chk->data) { 6903 acp = mtod(chk->data, struct sctp_asconf_chunk *); 6904 if (SCTP_TSN_GT(ntohl(acp->serial_number), asoc->asconf_seq_out_acked)) { 6905 /* Not Acked yet */ 6906 break; 6907 } 6908 } 6909 TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next); 6910 if (chk->data) { 6911 sctp_m_freem(chk->data); 6912 chk->data = NULL; 6913 } 6914 asoc->ctrl_queue_cnt--; 6915 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6916 } 6917 } 6918} 6919 6920 6921static void 6922sctp_clean_up_datalist(struct sctp_tcb *stcb, 6923 struct sctp_association *asoc, 6924 struct sctp_tmit_chunk **data_list, 6925 int bundle_at, 6926 struct sctp_nets *net) 6927{ 6928 int i; 6929 struct sctp_tmit_chunk *tp1; 6930 6931 for (i = 0; i < bundle_at; i++) { 6932 /* off of the send queue */ 6933 TAILQ_REMOVE(&asoc->send_queue, data_list[i], sctp_next); 6934 asoc->send_queue_cnt--; 6935 if (i > 0) { 6936 /* 6937 * Any chunk NOT 0 you zap the time chunk 0 gets 6938 * zapped or set based on if a RTO measurment is 6939 * needed. 6940 */ 6941 data_list[i]->do_rtt = 0; 6942 } 6943 /* record time */ 6944 data_list[i]->sent_rcv_time = net->last_sent_time; 6945 data_list[i]->rec.data.cwnd_at_send = net->cwnd; 6946 data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.TSN_seq; 6947 if (data_list[i]->whoTo == NULL) { 6948 data_list[i]->whoTo = net; 6949 atomic_add_int(&net->ref_count, 1); 6950 } 6951 /* on to the sent queue */ 6952 tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead); 6953 if ((tp1) && SCTP_TSN_GT(tp1->rec.data.TSN_seq, data_list[i]->rec.data.TSN_seq)) { 6954 struct sctp_tmit_chunk *tpp; 6955 6956 /* need to move back */ 6957 back_up_more: 6958 tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next); 6959 if (tpp == NULL) { 6960 TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next); 6961 goto all_done; 6962 } 6963 tp1 = tpp; 6964 if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, data_list[i]->rec.data.TSN_seq)) { 6965 goto back_up_more; 6966 } 6967 TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next); 6968 } else { 6969 TAILQ_INSERT_TAIL(&asoc->sent_queue, 6970 data_list[i], 6971 sctp_next); 6972 } 6973all_done: 6974 /* This does not lower until the cum-ack passes it */ 6975 asoc->sent_queue_cnt++; 6976 if ((asoc->peers_rwnd <= 0) && 6977 (asoc->total_flight == 0) && 6978 (bundle_at == 1)) { 6979 /* Mark the chunk as being a window probe */ 6980 SCTP_STAT_INCR(sctps_windowprobed); 6981 } 6982#ifdef SCTP_AUDITING_ENABLED 6983 sctp_audit_log(0xC2, 3); 6984#endif 6985 data_list[i]->sent = SCTP_DATAGRAM_SENT; 6986 data_list[i]->snd_count = 1; 6987 data_list[i]->rec.data.chunk_was_revoked = 0; 6988 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 6989 sctp_misc_ints(SCTP_FLIGHT_LOG_UP, 6990 data_list[i]->whoTo->flight_size, 6991 data_list[i]->book_size, 6992 (uintptr_t) data_list[i]->whoTo, 6993 data_list[i]->rec.data.TSN_seq); 6994 } 6995 sctp_flight_size_increase(data_list[i]); 6996 sctp_total_flight_increase(stcb, data_list[i]); 6997 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 6998 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 6999 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 7000 } 7001 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 7002 (uint32_t) (data_list[i]->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 7003 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 7004 /* SWS sender side engages */ 7005 asoc->peers_rwnd = 0; 7006 } 7007 } 7008 if (asoc->cc_functions.sctp_cwnd_update_packet_transmitted) { 7009 (*asoc->cc_functions.sctp_cwnd_update_packet_transmitted) (stcb, net); 7010 } 7011} 7012 7013static void 7014sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc, int so_locked 7015#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7016 SCTP_UNUSED 7017#endif 7018) 7019{ 7020 struct sctp_tmit_chunk *chk, *nchk; 7021 7022 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 7023 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7024 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 7025 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 7026 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 7027 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) || 7028 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 7029 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 7030 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 7031 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 7032 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 7033 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 7034 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 7035 /* Stray chunks must be cleaned up */ 7036 clean_up_anyway: 7037 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7038 if (chk->data) { 7039 sctp_m_freem(chk->data); 7040 chk->data = NULL; 7041 } 7042 asoc->ctrl_queue_cnt--; 7043 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) 7044 asoc->fwd_tsn_cnt--; 7045 sctp_free_a_chunk(stcb, chk, so_locked); 7046 } else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 7047 /* special handling, we must look into the param */ 7048 if (chk != asoc->str_reset) { 7049 goto clean_up_anyway; 7050 } 7051 } 7052 } 7053} 7054 7055 7056static int 7057sctp_can_we_split_this(struct sctp_tcb *stcb, 7058 uint32_t length, 7059 uint32_t goal_mtu, uint32_t frag_point, int eeor_on) 7060{ 7061 /* 7062 * Make a decision on if I should split a msg into multiple parts. 7063 * This is only asked of incomplete messages. 7064 */ 7065 if (eeor_on) { 7066 /* 7067 * If we are doing EEOR we need to always send it if its the 7068 * entire thing, since it might be all the guy is putting in 7069 * the hopper. 7070 */ 7071 if (goal_mtu >= length) { 7072 /*- 7073 * If we have data outstanding, 7074 * we get another chance when the sack 7075 * arrives to transmit - wait for more data 7076 */ 7077 if (stcb->asoc.total_flight == 0) { 7078 /* 7079 * If nothing is in flight, we zero the 7080 * packet counter. 7081 */ 7082 return (length); 7083 } 7084 return (0); 7085 7086 } else { 7087 /* You can fill the rest */ 7088 return (goal_mtu); 7089 } 7090 } 7091 /*- 7092 * For those strange folk that make the send buffer 7093 * smaller than our fragmentation point, we can't 7094 * get a full msg in so we have to allow splitting. 7095 */ 7096 if (SCTP_SB_LIMIT_SND(stcb->sctp_socket) < frag_point) { 7097 return (length); 7098 } 7099 if ((length <= goal_mtu) || 7100 ((length - goal_mtu) < SCTP_BASE_SYSCTL(sctp_min_residual))) { 7101 /* Sub-optimial residual don't split in non-eeor mode. */ 7102 return (0); 7103 } 7104 /* 7105 * If we reach here length is larger than the goal_mtu. Do we wish 7106 * to split it for the sake of packet putting together? 7107 */ 7108 if (goal_mtu >= min(SCTP_BASE_SYSCTL(sctp_min_split_point), frag_point)) { 7109 /* Its ok to split it */ 7110 return (min(goal_mtu, frag_point)); 7111 } 7112 /* Nope, can't split */ 7113 return (0); 7114 7115} 7116 7117static uint32_t 7118sctp_move_to_outqueue(struct sctp_tcb *stcb, 7119 struct sctp_stream_out *strq, 7120 uint32_t goal_mtu, 7121 uint32_t frag_point, 7122 int *locked, 7123 int *giveup, 7124 int eeor_mode, 7125 int *bail, 7126 int so_locked 7127#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7128 SCTP_UNUSED 7129#endif 7130) 7131{ 7132 /* Move from the stream to the send_queue keeping track of the total */ 7133 struct sctp_association *asoc; 7134 struct sctp_stream_queue_pending *sp; 7135 struct sctp_tmit_chunk *chk; 7136 struct sctp_data_chunk *dchkh; 7137 uint32_t to_move, length; 7138 uint8_t rcv_flags = 0; 7139 uint8_t some_taken; 7140 uint8_t send_lock_up = 0; 7141 7142 SCTP_TCB_LOCK_ASSERT(stcb); 7143 asoc = &stcb->asoc; 7144one_more_time: 7145 /* sa_ignore FREED_MEMORY */ 7146 sp = TAILQ_FIRST(&strq->outqueue); 7147 if (sp == NULL) { 7148 *locked = 0; 7149 if (send_lock_up == 0) { 7150 SCTP_TCB_SEND_LOCK(stcb); 7151 send_lock_up = 1; 7152 } 7153 sp = TAILQ_FIRST(&strq->outqueue); 7154 if (sp) { 7155 goto one_more_time; 7156 } 7157 if (strq->last_msg_incomplete) { 7158 SCTP_PRINTF("Huh? Stream:%d lm_in_c=%d but queue is NULL\n", 7159 strq->stream_no, 7160 strq->last_msg_incomplete); 7161 strq->last_msg_incomplete = 0; 7162 } 7163 to_move = 0; 7164 if (send_lock_up) { 7165 SCTP_TCB_SEND_UNLOCK(stcb); 7166 send_lock_up = 0; 7167 } 7168 goto out_of; 7169 } 7170 if ((sp->msg_is_complete) && (sp->length == 0)) { 7171 if (sp->sender_all_done) { 7172 /* 7173 * We are doing differed cleanup. Last time through 7174 * when we took all the data the sender_all_done was 7175 * not set. 7176 */ 7177 if ((sp->put_last_out == 0) && (sp->discard_rest == 0)) { 7178 SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n"); 7179 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7180 sp->sender_all_done, 7181 sp->length, 7182 sp->msg_is_complete, 7183 sp->put_last_out, 7184 send_lock_up); 7185 } 7186 if ((TAILQ_NEXT(sp, next) == NULL) && (send_lock_up == 0)) { 7187 SCTP_TCB_SEND_LOCK(stcb); 7188 send_lock_up = 1; 7189 } 7190 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7191 TAILQ_REMOVE(&strq->outqueue, sp, next); 7192 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7193 if (sp->net) { 7194 sctp_free_remote_addr(sp->net); 7195 sp->net = NULL; 7196 } 7197 if (sp->data) { 7198 sctp_m_freem(sp->data); 7199 sp->data = NULL; 7200 } 7201 sctp_free_a_strmoq(stcb, sp, so_locked); 7202 /* we can't be locked to it */ 7203 *locked = 0; 7204 stcb->asoc.locked_on_sending = NULL; 7205 if (send_lock_up) { 7206 SCTP_TCB_SEND_UNLOCK(stcb); 7207 send_lock_up = 0; 7208 } 7209 /* back to get the next msg */ 7210 goto one_more_time; 7211 } else { 7212 /* 7213 * sender just finished this but still holds a 7214 * reference 7215 */ 7216 *locked = 1; 7217 *giveup = 1; 7218 to_move = 0; 7219 goto out_of; 7220 } 7221 } else { 7222 /* is there some to get */ 7223 if (sp->length == 0) { 7224 /* no */ 7225 *locked = 1; 7226 *giveup = 1; 7227 to_move = 0; 7228 goto out_of; 7229 } else if (sp->discard_rest) { 7230 if (send_lock_up == 0) { 7231 SCTP_TCB_SEND_LOCK(stcb); 7232 send_lock_up = 1; 7233 } 7234 /* Whack down the size */ 7235 atomic_subtract_int(&stcb->asoc.total_output_queue_size, sp->length); 7236 if ((stcb->sctp_socket != NULL) && \ 7237 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 7238 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 7239 atomic_subtract_int(&stcb->sctp_socket->so_snd.sb_cc, sp->length); 7240 } 7241 if (sp->data) { 7242 sctp_m_freem(sp->data); 7243 sp->data = NULL; 7244 sp->tail_mbuf = NULL; 7245 } 7246 sp->length = 0; 7247 sp->some_taken = 1; 7248 *locked = 1; 7249 *giveup = 1; 7250 to_move = 0; 7251 goto out_of; 7252 } 7253 } 7254 some_taken = sp->some_taken; 7255 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) { 7256 sp->msg_is_complete = 1; 7257 } 7258re_look: 7259 length = sp->length; 7260 if (sp->msg_is_complete) { 7261 /* The message is complete */ 7262 to_move = min(length, frag_point); 7263 if (to_move == length) { 7264 /* All of it fits in the MTU */ 7265 if (sp->some_taken) { 7266 rcv_flags |= SCTP_DATA_LAST_FRAG; 7267 sp->put_last_out = 1; 7268 } else { 7269 rcv_flags |= SCTP_DATA_NOT_FRAG; 7270 sp->put_last_out = 1; 7271 } 7272 } else { 7273 /* Not all of it fits, we fragment */ 7274 if (sp->some_taken == 0) { 7275 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7276 } 7277 sp->some_taken = 1; 7278 } 7279 } else { 7280 to_move = sctp_can_we_split_this(stcb, length, goal_mtu, frag_point, eeor_mode); 7281 if (to_move) { 7282 /*- 7283 * We use a snapshot of length in case it 7284 * is expanding during the compare. 7285 */ 7286 uint32_t llen; 7287 7288 llen = length; 7289 if (to_move >= llen) { 7290 to_move = llen; 7291 if (send_lock_up == 0) { 7292 /*- 7293 * We are taking all of an incomplete msg 7294 * thus we need a send lock. 7295 */ 7296 SCTP_TCB_SEND_LOCK(stcb); 7297 send_lock_up = 1; 7298 if (sp->msg_is_complete) { 7299 /* 7300 * the sender finished the 7301 * msg 7302 */ 7303 goto re_look; 7304 } 7305 } 7306 } 7307 if (sp->some_taken == 0) { 7308 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7309 sp->some_taken = 1; 7310 } 7311 } else { 7312 /* Nothing to take. */ 7313 if (sp->some_taken) { 7314 *locked = 1; 7315 } 7316 *giveup = 1; 7317 to_move = 0; 7318 goto out_of; 7319 } 7320 } 7321 7322 /* If we reach here, we can copy out a chunk */ 7323 sctp_alloc_a_chunk(stcb, chk); 7324 if (chk == NULL) { 7325 /* No chunk memory */ 7326 *giveup = 1; 7327 to_move = 0; 7328 goto out_of; 7329 } 7330 /* 7331 * Setup for unordered if needed by looking at the user sent info 7332 * flags. 7333 */ 7334 if (sp->sinfo_flags & SCTP_UNORDERED) { 7335 rcv_flags |= SCTP_DATA_UNORDERED; 7336 } 7337 if ((SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && ((sp->sinfo_flags & SCTP_EOF) == SCTP_EOF)) || 7338 ((sp->sinfo_flags & SCTP_SACK_IMMEDIATELY) == SCTP_SACK_IMMEDIATELY)) { 7339 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7340 } 7341 /* clear out the chunk before setting up */ 7342 memset(chk, 0, sizeof(*chk)); 7343 chk->rec.data.rcv_flags = rcv_flags; 7344 7345 if (to_move >= length) { 7346 /* we think we can steal the whole thing */ 7347 if ((sp->sender_all_done == 0) && (send_lock_up == 0)) { 7348 SCTP_TCB_SEND_LOCK(stcb); 7349 send_lock_up = 1; 7350 } 7351 if (to_move < sp->length) { 7352 /* bail, it changed */ 7353 goto dont_do_it; 7354 } 7355 chk->data = sp->data; 7356 chk->last_mbuf = sp->tail_mbuf; 7357 /* register the stealing */ 7358 sp->data = sp->tail_mbuf = NULL; 7359 } else { 7360 struct mbuf *m; 7361 7362dont_do_it: 7363 chk->data = SCTP_M_COPYM(sp->data, 0, to_move, M_NOWAIT); 7364 chk->last_mbuf = NULL; 7365 if (chk->data == NULL) { 7366 sp->some_taken = some_taken; 7367 sctp_free_a_chunk(stcb, chk, so_locked); 7368 *bail = 1; 7369 to_move = 0; 7370 goto out_of; 7371 } 7372#ifdef SCTP_MBUF_LOGGING 7373 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 7374 struct mbuf *mat; 7375 7376 for (mat = chk->data; mat; mat = SCTP_BUF_NEXT(mat)) { 7377 if (SCTP_BUF_IS_EXTENDED(mat)) { 7378 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 7379 } 7380 } 7381 } 7382#endif 7383 /* Pull off the data */ 7384 m_adj(sp->data, to_move); 7385 /* Now lets work our way down and compact it */ 7386 m = sp->data; 7387 while (m && (SCTP_BUF_LEN(m) == 0)) { 7388 sp->data = SCTP_BUF_NEXT(m); 7389 SCTP_BUF_NEXT(m) = NULL; 7390 if (sp->tail_mbuf == m) { 7391 /*- 7392 * Freeing tail? TSNH since 7393 * we supposedly were taking less 7394 * than the sp->length. 7395 */ 7396#ifdef INVARIANTS 7397 panic("Huh, freing tail? - TSNH"); 7398#else 7399 SCTP_PRINTF("Huh, freeing tail? - TSNH\n"); 7400 sp->tail_mbuf = sp->data = NULL; 7401 sp->length = 0; 7402#endif 7403 7404 } 7405 sctp_m_free(m); 7406 m = sp->data; 7407 } 7408 } 7409 if (SCTP_BUF_IS_EXTENDED(chk->data)) { 7410 chk->copy_by_ref = 1; 7411 } else { 7412 chk->copy_by_ref = 0; 7413 } 7414 /* 7415 * get last_mbuf and counts of mb useage This is ugly but hopefully 7416 * its only one mbuf. 7417 */ 7418 if (chk->last_mbuf == NULL) { 7419 chk->last_mbuf = chk->data; 7420 while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) { 7421 chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf); 7422 } 7423 } 7424 if (to_move > length) { 7425 /*- This should not happen either 7426 * since we always lower to_move to the size 7427 * of sp->length if its larger. 7428 */ 7429#ifdef INVARIANTS 7430 panic("Huh, how can to_move be larger?"); 7431#else 7432 SCTP_PRINTF("Huh, how can to_move be larger?\n"); 7433 sp->length = 0; 7434#endif 7435 } else { 7436 atomic_subtract_int(&sp->length, to_move); 7437 } 7438 if (M_LEADINGSPACE(chk->data) < (int)sizeof(struct sctp_data_chunk)) { 7439 /* Not enough room for a chunk header, get some */ 7440 struct mbuf *m; 7441 7442 m = sctp_get_mbuf_for_msg(1, 0, M_NOWAIT, 0, MT_DATA); 7443 if (m == NULL) { 7444 /* 7445 * we're in trouble here. _PREPEND below will free 7446 * all the data if there is no leading space, so we 7447 * must put the data back and restore. 7448 */ 7449 if (send_lock_up == 0) { 7450 SCTP_TCB_SEND_LOCK(stcb); 7451 send_lock_up = 1; 7452 } 7453 if (chk->data == NULL) { 7454 /* unsteal the data */ 7455 sp->data = chk->data; 7456 sp->tail_mbuf = chk->last_mbuf; 7457 } else { 7458 struct mbuf *m_tmp; 7459 7460 /* reassemble the data */ 7461 m_tmp = sp->data; 7462 sp->data = chk->data; 7463 SCTP_BUF_NEXT(chk->last_mbuf) = m_tmp; 7464 } 7465 sp->some_taken = some_taken; 7466 atomic_add_int(&sp->length, to_move); 7467 chk->data = NULL; 7468 *bail = 1; 7469 sctp_free_a_chunk(stcb, chk, so_locked); 7470 to_move = 0; 7471 goto out_of; 7472 } else { 7473 SCTP_BUF_LEN(m) = 0; 7474 SCTP_BUF_NEXT(m) = chk->data; 7475 chk->data = m; 7476 M_ALIGN(chk->data, 4); 7477 } 7478 } 7479 SCTP_BUF_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_NOWAIT); 7480 if (chk->data == NULL) { 7481 /* HELP, TSNH since we assured it would not above? */ 7482#ifdef INVARIANTS 7483 panic("prepend failes HELP?"); 7484#else 7485 SCTP_PRINTF("prepend fails HELP?\n"); 7486 sctp_free_a_chunk(stcb, chk, so_locked); 7487#endif 7488 *bail = 1; 7489 to_move = 0; 7490 goto out_of; 7491 } 7492 sctp_snd_sb_alloc(stcb, sizeof(struct sctp_data_chunk)); 7493 chk->book_size = chk->send_size = (to_move + sizeof(struct sctp_data_chunk)); 7494 chk->book_size_scale = 0; 7495 chk->sent = SCTP_DATAGRAM_UNSENT; 7496 7497 chk->flags = 0; 7498 chk->asoc = &stcb->asoc; 7499 chk->pad_inplace = 0; 7500 chk->no_fr_allowed = 0; 7501 chk->rec.data.stream_seq = strq->next_sequence_send; 7502 if ((rcv_flags & SCTP_DATA_LAST_FRAG) && 7503 !(rcv_flags & SCTP_DATA_UNORDERED)) { 7504 strq->next_sequence_send++; 7505 } 7506 chk->rec.data.stream_number = sp->stream; 7507 chk->rec.data.payloadtype = sp->ppid; 7508 chk->rec.data.context = sp->context; 7509 chk->rec.data.doing_fast_retransmit = 0; 7510 7511 chk->rec.data.timetodrop = sp->ts; 7512 chk->flags = sp->act_flags; 7513 7514 if (sp->net) { 7515 chk->whoTo = sp->net; 7516 atomic_add_int(&chk->whoTo->ref_count, 1); 7517 } else 7518 chk->whoTo = NULL; 7519 7520 if (sp->holds_key_ref) { 7521 chk->auth_keyid = sp->auth_keyid; 7522 sctp_auth_key_acquire(stcb, chk->auth_keyid); 7523 chk->holds_key_ref = 1; 7524 } 7525 chk->rec.data.TSN_seq = atomic_fetchadd_int(&asoc->sending_seq, 1); 7526 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) { 7527 sctp_misc_ints(SCTP_STRMOUT_LOG_SEND, 7528 (uintptr_t) stcb, sp->length, 7529 (uint32_t) ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq), 7530 chk->rec.data.TSN_seq); 7531 } 7532 dchkh = mtod(chk->data, struct sctp_data_chunk *); 7533 /* 7534 * Put the rest of the things in place now. Size was done earlier in 7535 * previous loop prior to padding. 7536 */ 7537 7538#ifdef SCTP_ASOCLOG_OF_TSNS 7539 SCTP_TCB_LOCK_ASSERT(stcb); 7540 if (asoc->tsn_out_at >= SCTP_TSN_LOG_SIZE) { 7541 asoc->tsn_out_at = 0; 7542 asoc->tsn_out_wrapped = 1; 7543 } 7544 asoc->out_tsnlog[asoc->tsn_out_at].tsn = chk->rec.data.TSN_seq; 7545 asoc->out_tsnlog[asoc->tsn_out_at].strm = chk->rec.data.stream_number; 7546 asoc->out_tsnlog[asoc->tsn_out_at].seq = chk->rec.data.stream_seq; 7547 asoc->out_tsnlog[asoc->tsn_out_at].sz = chk->send_size; 7548 asoc->out_tsnlog[asoc->tsn_out_at].flgs = chk->rec.data.rcv_flags; 7549 asoc->out_tsnlog[asoc->tsn_out_at].stcb = (void *)stcb; 7550 asoc->out_tsnlog[asoc->tsn_out_at].in_pos = asoc->tsn_out_at; 7551 asoc->out_tsnlog[asoc->tsn_out_at].in_out = 2; 7552 asoc->tsn_out_at++; 7553#endif 7554 7555 dchkh->ch.chunk_type = SCTP_DATA; 7556 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7557 dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq); 7558 dchkh->dp.stream_id = htons(strq->stream_no); 7559 dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq); 7560 dchkh->dp.protocol_id = chk->rec.data.payloadtype; 7561 dchkh->ch.chunk_length = htons(chk->send_size); 7562 /* Now advance the chk->send_size by the actual pad needed. */ 7563 if (chk->send_size < SCTP_SIZE32(chk->book_size)) { 7564 /* need a pad */ 7565 struct mbuf *lm; 7566 int pads; 7567 7568 pads = SCTP_SIZE32(chk->book_size) - chk->send_size; 7569 lm = sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf); 7570 if (lm != NULL) { 7571 chk->last_mbuf = lm; 7572 chk->pad_inplace = 1; 7573 } 7574 chk->send_size += pads; 7575 } 7576 if (PR_SCTP_ENABLED(chk->flags)) { 7577 asoc->pr_sctp_cnt++; 7578 } 7579 if (sp->msg_is_complete && (sp->length == 0) && (sp->sender_all_done)) { 7580 /* All done pull and kill the message */ 7581 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7582 if (sp->put_last_out == 0) { 7583 SCTP_PRINTF("Gak, put out entire msg with NO end!-2\n"); 7584 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7585 sp->sender_all_done, 7586 sp->length, 7587 sp->msg_is_complete, 7588 sp->put_last_out, 7589 send_lock_up); 7590 } 7591 if ((send_lock_up == 0) && (TAILQ_NEXT(sp, next) == NULL)) { 7592 SCTP_TCB_SEND_LOCK(stcb); 7593 send_lock_up = 1; 7594 } 7595 TAILQ_REMOVE(&strq->outqueue, sp, next); 7596 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7597 if (sp->net) { 7598 sctp_free_remote_addr(sp->net); 7599 sp->net = NULL; 7600 } 7601 if (sp->data) { 7602 sctp_m_freem(sp->data); 7603 sp->data = NULL; 7604 } 7605 sctp_free_a_strmoq(stcb, sp, so_locked); 7606 7607 /* we can't be locked to it */ 7608 *locked = 0; 7609 stcb->asoc.locked_on_sending = NULL; 7610 } else { 7611 /* more to go, we are locked */ 7612 *locked = 1; 7613 } 7614 asoc->chunks_on_out_queue++; 7615 strq->chunks_on_queues++; 7616 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 7617 asoc->send_queue_cnt++; 7618out_of: 7619 if (send_lock_up) { 7620 SCTP_TCB_SEND_UNLOCK(stcb); 7621 } 7622 return (to_move); 7623} 7624 7625 7626static void 7627sctp_fill_outqueue(struct sctp_tcb *stcb, 7628 struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked 7629#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7630 SCTP_UNUSED 7631#endif 7632) 7633{ 7634 struct sctp_association *asoc; 7635 struct sctp_stream_out *strq; 7636 int goal_mtu, moved_how_much, total_moved = 0, bail = 0; 7637 int locked, giveup; 7638 7639 SCTP_TCB_LOCK_ASSERT(stcb); 7640 asoc = &stcb->asoc; 7641 switch (net->ro._l_addr.sa.sa_family) { 7642#ifdef INET 7643 case AF_INET: 7644 goal_mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 7645 break; 7646#endif 7647#ifdef INET6 7648 case AF_INET6: 7649 goal_mtu = net->mtu - SCTP_MIN_OVERHEAD; 7650 break; 7651#endif 7652 default: 7653 /* TSNH */ 7654 goal_mtu = net->mtu; 7655 break; 7656 } 7657 /* Need an allowance for the data chunk header too */ 7658 goal_mtu -= sizeof(struct sctp_data_chunk); 7659 7660 /* must make even word boundary */ 7661 goal_mtu &= 0xfffffffc; 7662 if (asoc->locked_on_sending) { 7663 /* We are stuck on one stream until the message completes. */ 7664 strq = asoc->locked_on_sending; 7665 locked = 1; 7666 } else { 7667 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7668 locked = 0; 7669 } 7670 while ((goal_mtu > 0) && strq) { 7671 giveup = 0; 7672 bail = 0; 7673 moved_how_much = sctp_move_to_outqueue(stcb, strq, goal_mtu, frag_point, &locked, 7674 &giveup, eeor_mode, &bail, so_locked); 7675 if (moved_how_much) 7676 stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved_how_much); 7677 7678 if (locked) { 7679 asoc->locked_on_sending = strq; 7680 if ((moved_how_much == 0) || (giveup) || bail) 7681 /* no more to move for now */ 7682 break; 7683 } else { 7684 asoc->locked_on_sending = NULL; 7685 if ((giveup) || bail) { 7686 break; 7687 } 7688 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7689 if (strq == NULL) { 7690 break; 7691 } 7692 } 7693 total_moved += moved_how_much; 7694 goal_mtu -= (moved_how_much + sizeof(struct sctp_data_chunk)); 7695 goal_mtu &= 0xfffffffc; 7696 } 7697 if (bail) 7698 *quit_now = 1; 7699 7700 stcb->asoc.ss_functions.sctp_ss_packet_done(stcb, net, asoc); 7701 7702 if (total_moved == 0) { 7703 if ((stcb->asoc.sctp_cmt_on_off == 0) && 7704 (net == stcb->asoc.primary_destination)) { 7705 /* ran dry for primary network net */ 7706 SCTP_STAT_INCR(sctps_primary_randry); 7707 } else if (stcb->asoc.sctp_cmt_on_off > 0) { 7708 /* ran dry with CMT on */ 7709 SCTP_STAT_INCR(sctps_cmt_randry); 7710 } 7711 } 7712} 7713 7714void 7715sctp_fix_ecn_echo(struct sctp_association *asoc) 7716{ 7717 struct sctp_tmit_chunk *chk; 7718 7719 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7720 if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 7721 chk->sent = SCTP_DATAGRAM_UNSENT; 7722 } 7723 } 7724} 7725 7726void 7727sctp_move_chunks_from_net(struct sctp_tcb *stcb, struct sctp_nets *net) 7728{ 7729 struct sctp_association *asoc; 7730 struct sctp_tmit_chunk *chk; 7731 struct sctp_stream_queue_pending *sp; 7732 unsigned int i; 7733 7734 if (net == NULL) { 7735 return; 7736 } 7737 asoc = &stcb->asoc; 7738 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 7739 TAILQ_FOREACH(sp, &stcb->asoc.strmout[i].outqueue, next) { 7740 if (sp->net == net) { 7741 sctp_free_remote_addr(sp->net); 7742 sp->net = NULL; 7743 } 7744 } 7745 } 7746 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7747 if (chk->whoTo == net) { 7748 sctp_free_remote_addr(chk->whoTo); 7749 chk->whoTo = NULL; 7750 } 7751 } 7752} 7753 7754int 7755sctp_med_chunk_output(struct sctp_inpcb *inp, 7756 struct sctp_tcb *stcb, 7757 struct sctp_association *asoc, 7758 int *num_out, 7759 int *reason_code, 7760 int control_only, int from_where, 7761 struct timeval *now, int *now_filled, int frag_point, int so_locked 7762#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7763 SCTP_UNUSED 7764#endif 7765) 7766{ 7767 /** 7768 * Ok this is the generic chunk service queue. we must do the 7769 * following: - Service the stream queue that is next, moving any 7770 * message (note I must get a complete message i.e. FIRST/MIDDLE and 7771 * LAST to the out queue in one pass) and assigning TSN's - Check to 7772 * see if the cwnd/rwnd allows any output, if so we go ahead and 7773 * fomulate and send the low level chunks. Making sure to combine 7774 * any control in the control chunk queue also. 7775 */ 7776 struct sctp_nets *net, *start_at, *sack_goes_to = NULL, *old_start_at = NULL; 7777 struct mbuf *outchain, *endoutchain; 7778 struct sctp_tmit_chunk *chk, *nchk; 7779 7780 /* temp arrays for unlinking */ 7781 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 7782 int no_fragmentflg, error; 7783 unsigned int max_rwnd_per_dest, max_send_per_dest; 7784 int one_chunk, hbflag, skip_data_for_this_net; 7785 int asconf, cookie, no_out_cnt; 7786 int bundle_at, ctl_cnt, no_data_chunks, eeor_mode; 7787 unsigned int mtu, r_mtu, omtu, mx_mtu, to_out; 7788 int tsns_sent = 0; 7789 uint32_t auth_offset = 0; 7790 struct sctp_auth_chunk *auth = NULL; 7791 uint16_t auth_keyid; 7792 int override_ok = 1; 7793 int skip_fill_up = 0; 7794 int data_auth_reqd = 0; 7795 7796 /* 7797 * JRS 5/14/07 - Add flag for whether a heartbeat is sent to the 7798 * destination. 7799 */ 7800 int quit_now = 0; 7801 7802 *num_out = 0; 7803 auth_keyid = stcb->asoc.authinfo.active_keyid; 7804 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) || 7805 (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED) || 7806 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 7807 eeor_mode = 1; 7808 } else { 7809 eeor_mode = 0; 7810 } 7811 ctl_cnt = no_out_cnt = asconf = cookie = 0; 7812 /* 7813 * First lets prime the pump. For each destination, if there is room 7814 * in the flight size, attempt to pull an MTU's worth out of the 7815 * stream queues into the general send_queue 7816 */ 7817#ifdef SCTP_AUDITING_ENABLED 7818 sctp_audit_log(0xC2, 2); 7819#endif 7820 SCTP_TCB_LOCK_ASSERT(stcb); 7821 hbflag = 0; 7822 if ((control_only) || (asoc->stream_reset_outstanding)) 7823 no_data_chunks = 1; 7824 else 7825 no_data_chunks = 0; 7826 7827 /* Nothing to possible to send? */ 7828 if ((TAILQ_EMPTY(&asoc->control_send_queue) || 7829 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) && 7830 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7831 TAILQ_EMPTY(&asoc->send_queue) && 7832 stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) { 7833nothing_to_send: 7834 *reason_code = 9; 7835 return (0); 7836 } 7837 if (asoc->peers_rwnd == 0) { 7838 /* No room in peers rwnd */ 7839 *reason_code = 1; 7840 if (asoc->total_flight > 0) { 7841 /* we are allowed one chunk in flight */ 7842 no_data_chunks = 1; 7843 } 7844 } 7845 if (stcb->asoc.ecn_echo_cnt_onq) { 7846 /* Record where a sack goes, if any */ 7847 if (no_data_chunks && 7848 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) { 7849 /* Nothing but ECNe to send - we don't do that */ 7850 goto nothing_to_send; 7851 } 7852 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7853 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7854 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 7855 sack_goes_to = chk->whoTo; 7856 break; 7857 } 7858 } 7859 } 7860 max_rwnd_per_dest = ((asoc->peers_rwnd + asoc->total_flight) / asoc->numnets); 7861 if (stcb->sctp_socket) 7862 max_send_per_dest = SCTP_SB_LIMIT_SND(stcb->sctp_socket) / asoc->numnets; 7863 else 7864 max_send_per_dest = 0; 7865 if (no_data_chunks == 0) { 7866 /* How many non-directed chunks are there? */ 7867 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7868 if (chk->whoTo == NULL) { 7869 /* 7870 * We already have non-directed chunks on 7871 * the queue, no need to do a fill-up. 7872 */ 7873 skip_fill_up = 1; 7874 break; 7875 } 7876 } 7877 7878 } 7879 if ((no_data_chunks == 0) && 7880 (skip_fill_up == 0) && 7881 (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc))) { 7882 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 7883 /* 7884 * This for loop we are in takes in each net, if 7885 * its's got space in cwnd and has data sent to it 7886 * (when CMT is off) then it calls 7887 * sctp_fill_outqueue for the net. This gets data on 7888 * the send queue for that network. 7889 * 7890 * In sctp_fill_outqueue TSN's are assigned and data is 7891 * copied out of the stream buffers. Note mostly 7892 * copy by reference (we hope). 7893 */ 7894 net->window_probe = 0; 7895 if ((net != stcb->asoc.alternate) && 7896 ((net->dest_state & SCTP_ADDR_PF) || 7897 (!(net->dest_state & SCTP_ADDR_REACHABLE)) || 7898 (net->dest_state & SCTP_ADDR_UNCONFIRMED))) { 7899 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7900 sctp_log_cwnd(stcb, net, 1, 7901 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7902 } 7903 continue; 7904 } 7905 if ((stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) && 7906 (net->flight_size == 0)) { 7907 (*stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) (stcb, net); 7908 } 7909 if (net->flight_size >= net->cwnd) { 7910 /* skip this network, no room - can't fill */ 7911 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7912 sctp_log_cwnd(stcb, net, 3, 7913 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7914 } 7915 continue; 7916 } 7917 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7918 sctp_log_cwnd(stcb, net, 4, SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7919 } 7920 sctp_fill_outqueue(stcb, net, frag_point, eeor_mode, &quit_now, so_locked); 7921 if (quit_now) { 7922 /* memory alloc failure */ 7923 no_data_chunks = 1; 7924 break; 7925 } 7926 } 7927 } 7928 /* now service each destination and send out what we can for it */ 7929 /* Nothing to send? */ 7930 if (TAILQ_EMPTY(&asoc->control_send_queue) && 7931 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7932 TAILQ_EMPTY(&asoc->send_queue)) { 7933 *reason_code = 8; 7934 return (0); 7935 } 7936 if (asoc->sctp_cmt_on_off > 0) { 7937 /* get the last start point */ 7938 start_at = asoc->last_net_cmt_send_started; 7939 if (start_at == NULL) { 7940 /* null so to beginning */ 7941 start_at = TAILQ_FIRST(&asoc->nets); 7942 } else { 7943 start_at = TAILQ_NEXT(asoc->last_net_cmt_send_started, sctp_next); 7944 if (start_at == NULL) { 7945 start_at = TAILQ_FIRST(&asoc->nets); 7946 } 7947 } 7948 asoc->last_net_cmt_send_started = start_at; 7949 } else { 7950 start_at = TAILQ_FIRST(&asoc->nets); 7951 } 7952 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7953 if (chk->whoTo == NULL) { 7954 if (asoc->alternate) { 7955 chk->whoTo = asoc->alternate; 7956 } else { 7957 chk->whoTo = asoc->primary_destination; 7958 } 7959 atomic_add_int(&chk->whoTo->ref_count, 1); 7960 } 7961 } 7962 old_start_at = NULL; 7963again_one_more_time: 7964 for (net = start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) { 7965 /* how much can we send? */ 7966 /* SCTPDBG("Examine for sending net:%x\n", (uint32_t)net); */ 7967 if (old_start_at && (old_start_at == net)) { 7968 /* through list ocmpletely. */ 7969 break; 7970 } 7971 tsns_sent = 0xa; 7972 if (TAILQ_EMPTY(&asoc->control_send_queue) && 7973 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7974 (net->flight_size >= net->cwnd)) { 7975 /* 7976 * Nothing on control or asconf and flight is full, 7977 * we can skip even in the CMT case. 7978 */ 7979 continue; 7980 } 7981 bundle_at = 0; 7982 endoutchain = outchain = NULL; 7983 no_fragmentflg = 1; 7984 one_chunk = 0; 7985 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 7986 skip_data_for_this_net = 1; 7987 } else { 7988 skip_data_for_this_net = 0; 7989 } 7990 if ((net->ro.ro_rt) && (net->ro.ro_rt->rt_ifp)) { 7991 /* 7992 * if we have a route and an ifp check to see if we 7993 * have room to send to this guy 7994 */ 7995 struct ifnet *ifp; 7996 7997 ifp = net->ro.ro_rt->rt_ifp; 7998 if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) { 7999 SCTP_STAT_INCR(sctps_ifnomemqueued); 8000 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 8001 sctp_log_maxburst(stcb, net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED); 8002 } 8003 continue; 8004 } 8005 } 8006 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8007#ifdef INET 8008 case AF_INET: 8009 mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr)); 8010 break; 8011#endif 8012#ifdef INET6 8013 case AF_INET6: 8014 mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)); 8015 break; 8016#endif 8017 default: 8018 /* TSNH */ 8019 mtu = net->mtu; 8020 break; 8021 } 8022 mx_mtu = mtu; 8023 to_out = 0; 8024 if (mtu > asoc->peers_rwnd) { 8025 if (asoc->total_flight > 0) { 8026 /* We have a packet in flight somewhere */ 8027 r_mtu = asoc->peers_rwnd; 8028 } else { 8029 /* We are always allowed to send one MTU out */ 8030 one_chunk = 1; 8031 r_mtu = mtu; 8032 } 8033 } else { 8034 r_mtu = mtu; 8035 } 8036 /************************/ 8037 /* ASCONF transmission */ 8038 /************************/ 8039 /* Now first lets go through the asconf queue */ 8040 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 8041 if (chk->rec.chunk_id.id != SCTP_ASCONF) { 8042 continue; 8043 } 8044 if (chk->whoTo == NULL) { 8045 if (asoc->alternate == NULL) { 8046 if (asoc->primary_destination != net) { 8047 break; 8048 } 8049 } else { 8050 if (asoc->alternate != net) { 8051 break; 8052 } 8053 } 8054 } else { 8055 if (chk->whoTo != net) { 8056 break; 8057 } 8058 } 8059 if (chk->data == NULL) { 8060 break; 8061 } 8062 if (chk->sent != SCTP_DATAGRAM_UNSENT && 8063 chk->sent != SCTP_DATAGRAM_RESEND) { 8064 break; 8065 } 8066 /* 8067 * if no AUTH is yet included and this chunk 8068 * requires it, make sure to account for it. We 8069 * don't apply the size until the AUTH chunk is 8070 * actually added below in case there is no room for 8071 * this chunk. NOTE: we overload the use of "omtu" 8072 * here 8073 */ 8074 if ((auth == NULL) && 8075 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8076 stcb->asoc.peer_auth_chunks)) { 8077 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8078 } else 8079 omtu = 0; 8080 /* Here we do NOT factor the r_mtu */ 8081 if ((chk->send_size < (int)(mtu - omtu)) || 8082 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8083 /* 8084 * We probably should glom the mbuf chain 8085 * from the chk->data for control but the 8086 * problem is it becomes yet one more level 8087 * of tracking to do if for some reason 8088 * output fails. Then I have got to 8089 * reconstruct the merged control chain.. el 8090 * yucko.. for now we take the easy way and 8091 * do the copy 8092 */ 8093 /* 8094 * Add an AUTH chunk, if chunk requires it 8095 * save the offset into the chain for AUTH 8096 */ 8097 if ((auth == NULL) && 8098 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8099 stcb->asoc.peer_auth_chunks))) { 8100 outchain = sctp_add_auth_chunk(outchain, 8101 &endoutchain, 8102 &auth, 8103 &auth_offset, 8104 stcb, 8105 chk->rec.chunk_id.id); 8106 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8107 } 8108 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8109 (int)chk->rec.chunk_id.can_take_data, 8110 chk->send_size, chk->copy_by_ref); 8111 if (outchain == NULL) { 8112 *reason_code = 8; 8113 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8114 return (ENOMEM); 8115 } 8116 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8117 /* update our MTU size */ 8118 if (mtu > (chk->send_size + omtu)) 8119 mtu -= (chk->send_size + omtu); 8120 else 8121 mtu = 0; 8122 to_out += (chk->send_size + omtu); 8123 /* Do clear IP_DF ? */ 8124 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8125 no_fragmentflg = 0; 8126 } 8127 if (chk->rec.chunk_id.can_take_data) 8128 chk->data = NULL; 8129 /* 8130 * set hb flag since we can use these for 8131 * RTO 8132 */ 8133 hbflag = 1; 8134 asconf = 1; 8135 /* 8136 * should sysctl this: don't bundle data 8137 * with ASCONF since it requires AUTH 8138 */ 8139 no_data_chunks = 1; 8140 chk->sent = SCTP_DATAGRAM_SENT; 8141 if (chk->whoTo == NULL) { 8142 chk->whoTo = net; 8143 atomic_add_int(&net->ref_count, 1); 8144 } 8145 chk->snd_count++; 8146 if (mtu == 0) { 8147 /* 8148 * Ok we are out of room but we can 8149 * output without effecting the 8150 * flight size since this little guy 8151 * is a control only packet. 8152 */ 8153 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8154 /* 8155 * do NOT clear the asconf flag as 8156 * it is used to do appropriate 8157 * source address selection. 8158 */ 8159 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8160 (struct sockaddr *)&net->ro._l_addr, 8161 outchain, auth_offset, auth, 8162 stcb->asoc.authinfo.active_keyid, 8163 no_fragmentflg, 0, asconf, 8164 inp->sctp_lport, stcb->rport, 8165 htonl(stcb->asoc.peer_vtag), 8166 net->port, NULL, 8167 0, 0, 8168 so_locked))) { 8169 if (error == ENOBUFS) { 8170 asoc->ifp_had_enobuf = 1; 8171 SCTP_STAT_INCR(sctps_lowlevelerr); 8172 } 8173 if (from_where == 0) { 8174 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8175 } 8176 if (*now_filled == 0) { 8177 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8178 *now_filled = 1; 8179 *now = net->last_sent_time; 8180 } else { 8181 net->last_sent_time = *now; 8182 } 8183 hbflag = 0; 8184 /* error, could not output */ 8185 if (error == EHOSTUNREACH) { 8186 /* 8187 * Destination went 8188 * unreachable 8189 * during this send 8190 */ 8191 sctp_move_chunks_from_net(stcb, net); 8192 } 8193 *reason_code = 7; 8194 continue; 8195 } else 8196 asoc->ifp_had_enobuf = 0; 8197 if (*now_filled == 0) { 8198 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8199 *now_filled = 1; 8200 *now = net->last_sent_time; 8201 } else { 8202 net->last_sent_time = *now; 8203 } 8204 hbflag = 0; 8205 /* 8206 * increase the number we sent, if a 8207 * cookie is sent we don't tell them 8208 * any was sent out. 8209 */ 8210 outchain = endoutchain = NULL; 8211 auth = NULL; 8212 auth_offset = 0; 8213 if (!no_out_cnt) 8214 *num_out += ctl_cnt; 8215 /* recalc a clean slate and setup */ 8216 switch (net->ro._l_addr.sa.sa_family) { 8217#ifdef INET 8218 case AF_INET: 8219 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8220 break; 8221#endif 8222#ifdef INET6 8223 case AF_INET6: 8224 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8225 break; 8226#endif 8227 default: 8228 /* TSNH */ 8229 mtu = net->mtu; 8230 break; 8231 } 8232 to_out = 0; 8233 no_fragmentflg = 1; 8234 } 8235 } 8236 } 8237 /************************/ 8238 /* Control transmission */ 8239 /************************/ 8240 /* Now first lets go through the control queue */ 8241 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 8242 if ((sack_goes_to) && 8243 (chk->rec.chunk_id.id == SCTP_ECN_ECHO) && 8244 (chk->whoTo != sack_goes_to)) { 8245 /* 8246 * if we have a sack in queue, and we are 8247 * looking at an ecn echo that is NOT queued 8248 * to where the sack is going.. 8249 */ 8250 if (chk->whoTo == net) { 8251 /* 8252 * Don't transmit it to where its 8253 * going (current net) 8254 */ 8255 continue; 8256 } else if (sack_goes_to == net) { 8257 /* 8258 * But do transmit it to this 8259 * address 8260 */ 8261 goto skip_net_check; 8262 } 8263 } 8264 if (chk->whoTo == NULL) { 8265 if (asoc->alternate == NULL) { 8266 if (asoc->primary_destination != net) { 8267 continue; 8268 } 8269 } else { 8270 if (asoc->alternate != net) { 8271 continue; 8272 } 8273 } 8274 } else { 8275 if (chk->whoTo != net) { 8276 continue; 8277 } 8278 } 8279 skip_net_check: 8280 if (chk->data == NULL) { 8281 continue; 8282 } 8283 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 8284 /* 8285 * It must be unsent. Cookies and ASCONF's 8286 * hang around but there timers will force 8287 * when marked for resend. 8288 */ 8289 continue; 8290 } 8291 /* 8292 * if no AUTH is yet included and this chunk 8293 * requires it, make sure to account for it. We 8294 * don't apply the size until the AUTH chunk is 8295 * actually added below in case there is no room for 8296 * this chunk. NOTE: we overload the use of "omtu" 8297 * here 8298 */ 8299 if ((auth == NULL) && 8300 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8301 stcb->asoc.peer_auth_chunks)) { 8302 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8303 } else 8304 omtu = 0; 8305 /* Here we do NOT factor the r_mtu */ 8306 if ((chk->send_size <= (int)(mtu - omtu)) || 8307 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8308 /* 8309 * We probably should glom the mbuf chain 8310 * from the chk->data for control but the 8311 * problem is it becomes yet one more level 8312 * of tracking to do if for some reason 8313 * output fails. Then I have got to 8314 * reconstruct the merged control chain.. el 8315 * yucko.. for now we take the easy way and 8316 * do the copy 8317 */ 8318 /* 8319 * Add an AUTH chunk, if chunk requires it 8320 * save the offset into the chain for AUTH 8321 */ 8322 if ((auth == NULL) && 8323 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8324 stcb->asoc.peer_auth_chunks))) { 8325 outchain = sctp_add_auth_chunk(outchain, 8326 &endoutchain, 8327 &auth, 8328 &auth_offset, 8329 stcb, 8330 chk->rec.chunk_id.id); 8331 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8332 } 8333 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8334 (int)chk->rec.chunk_id.can_take_data, 8335 chk->send_size, chk->copy_by_ref); 8336 if (outchain == NULL) { 8337 *reason_code = 8; 8338 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8339 return (ENOMEM); 8340 } 8341 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8342 /* update our MTU size */ 8343 if (mtu > (chk->send_size + omtu)) 8344 mtu -= (chk->send_size + omtu); 8345 else 8346 mtu = 0; 8347 to_out += (chk->send_size + omtu); 8348 /* Do clear IP_DF ? */ 8349 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8350 no_fragmentflg = 0; 8351 } 8352 if (chk->rec.chunk_id.can_take_data) 8353 chk->data = NULL; 8354 /* Mark things to be removed, if needed */ 8355 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8356 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 8357 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 8358 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 8359 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 8360 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 8361 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 8362 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 8363 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 8364 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 8365 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 8366 if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) { 8367 hbflag = 1; 8368 } 8369 /* remove these chunks at the end */ 8370 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8371 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 8372 /* turn off the timer */ 8373 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 8374 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 8375 inp, stcb, net, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1); 8376 } 8377 } 8378 ctl_cnt++; 8379 } else { 8380 /* 8381 * Other chunks, since they have 8382 * timers running (i.e. COOKIE) we 8383 * just "trust" that it gets sent or 8384 * retransmitted. 8385 */ 8386 ctl_cnt++; 8387 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 8388 cookie = 1; 8389 no_out_cnt = 1; 8390 } else if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 8391 /* 8392 * Increment ecne send count 8393 * here this means we may be 8394 * over-zealous in our 8395 * counting if the send 8396 * fails, but its the best 8397 * place to do it (we used 8398 * to do it in the queue of 8399 * the chunk, but that did 8400 * not tell how many times 8401 * it was sent. 8402 */ 8403 SCTP_STAT_INCR(sctps_sendecne); 8404 } 8405 chk->sent = SCTP_DATAGRAM_SENT; 8406 if (chk->whoTo == NULL) { 8407 chk->whoTo = net; 8408 atomic_add_int(&net->ref_count, 1); 8409 } 8410 chk->snd_count++; 8411 } 8412 if (mtu == 0) { 8413 /* 8414 * Ok we are out of room but we can 8415 * output without effecting the 8416 * flight size since this little guy 8417 * is a control only packet. 8418 */ 8419 if (asconf) { 8420 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8421 /* 8422 * do NOT clear the asconf 8423 * flag as it is used to do 8424 * appropriate source 8425 * address selection. 8426 */ 8427 } 8428 if (cookie) { 8429 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8430 cookie = 0; 8431 } 8432 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8433 (struct sockaddr *)&net->ro._l_addr, 8434 outchain, 8435 auth_offset, auth, 8436 stcb->asoc.authinfo.active_keyid, 8437 no_fragmentflg, 0, asconf, 8438 inp->sctp_lport, stcb->rport, 8439 htonl(stcb->asoc.peer_vtag), 8440 net->port, NULL, 8441 0, 0, 8442 so_locked))) { 8443 if (error == ENOBUFS) { 8444 asoc->ifp_had_enobuf = 1; 8445 SCTP_STAT_INCR(sctps_lowlevelerr); 8446 } 8447 if (from_where == 0) { 8448 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8449 } 8450 /* error, could not output */ 8451 if (hbflag) { 8452 if (*now_filled == 0) { 8453 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8454 *now_filled = 1; 8455 *now = net->last_sent_time; 8456 } else { 8457 net->last_sent_time = *now; 8458 } 8459 hbflag = 0; 8460 } 8461 if (error == EHOSTUNREACH) { 8462 /* 8463 * Destination went 8464 * unreachable 8465 * during this send 8466 */ 8467 sctp_move_chunks_from_net(stcb, net); 8468 } 8469 *reason_code = 7; 8470 continue; 8471 } else 8472 asoc->ifp_had_enobuf = 0; 8473 /* Only HB or ASCONF advances time */ 8474 if (hbflag) { 8475 if (*now_filled == 0) { 8476 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8477 *now_filled = 1; 8478 *now = net->last_sent_time; 8479 } else { 8480 net->last_sent_time = *now; 8481 } 8482 hbflag = 0; 8483 } 8484 /* 8485 * increase the number we sent, if a 8486 * cookie is sent we don't tell them 8487 * any was sent out. 8488 */ 8489 outchain = endoutchain = NULL; 8490 auth = NULL; 8491 auth_offset = 0; 8492 if (!no_out_cnt) 8493 *num_out += ctl_cnt; 8494 /* recalc a clean slate and setup */ 8495 switch (net->ro._l_addr.sa.sa_family) { 8496#ifdef INET 8497 case AF_INET: 8498 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8499 break; 8500#endif 8501#ifdef INET6 8502 case AF_INET6: 8503 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8504 break; 8505#endif 8506 default: 8507 /* TSNH */ 8508 mtu = net->mtu; 8509 break; 8510 } 8511 to_out = 0; 8512 no_fragmentflg = 1; 8513 } 8514 } 8515 } 8516 /* JRI: if dest is in PF state, do not send data to it */ 8517 if ((asoc->sctp_cmt_on_off > 0) && 8518 (net != stcb->asoc.alternate) && 8519 (net->dest_state & SCTP_ADDR_PF)) { 8520 goto no_data_fill; 8521 } 8522 if (net->flight_size >= net->cwnd) { 8523 goto no_data_fill; 8524 } 8525 if ((asoc->sctp_cmt_on_off > 0) && 8526 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_RECV_BUFFER_SPLITTING) && 8527 (net->flight_size > max_rwnd_per_dest)) { 8528 goto no_data_fill; 8529 } 8530 /* 8531 * We need a specific accounting for the usage of the send 8532 * buffer. We also need to check the number of messages per 8533 * net. For now, this is better than nothing and it disabled 8534 * by default... 8535 */ 8536 if ((asoc->sctp_cmt_on_off > 0) && 8537 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_SEND_BUFFER_SPLITTING) && 8538 (max_send_per_dest > 0) && 8539 (net->flight_size > max_send_per_dest)) { 8540 goto no_data_fill; 8541 } 8542 /*********************/ 8543 /* Data transmission */ 8544 /*********************/ 8545 /* 8546 * if AUTH for DATA is required and no AUTH has been added 8547 * yet, account for this in the mtu now... if no data can be 8548 * bundled, this adjustment won't matter anyways since the 8549 * packet will be going out... 8550 */ 8551 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, 8552 stcb->asoc.peer_auth_chunks); 8553 if (data_auth_reqd && (auth == NULL)) { 8554 mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8555 } 8556 /* now lets add any data within the MTU constraints */ 8557 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8558#ifdef INET 8559 case AF_INET: 8560 if (net->mtu > (sizeof(struct ip) + sizeof(struct sctphdr))) 8561 omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr)); 8562 else 8563 omtu = 0; 8564 break; 8565#endif 8566#ifdef INET6 8567 case AF_INET6: 8568 if (net->mtu > (sizeof(struct ip6_hdr) + sizeof(struct sctphdr))) 8569 omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)); 8570 else 8571 omtu = 0; 8572 break; 8573#endif 8574 default: 8575 /* TSNH */ 8576 omtu = 0; 8577 break; 8578 } 8579 if ((((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) && 8580 (skip_data_for_this_net == 0)) || 8581 (cookie)) { 8582 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 8583 if (no_data_chunks) { 8584 /* let only control go out */ 8585 *reason_code = 1; 8586 break; 8587 } 8588 if (net->flight_size >= net->cwnd) { 8589 /* skip this net, no room for data */ 8590 *reason_code = 2; 8591 break; 8592 } 8593 if ((chk->whoTo != NULL) && 8594 (chk->whoTo != net)) { 8595 /* Don't send the chunk on this net */ 8596 continue; 8597 } 8598 if (asoc->sctp_cmt_on_off == 0) { 8599 if ((asoc->alternate) && 8600 (asoc->alternate != net) && 8601 (chk->whoTo == NULL)) { 8602 continue; 8603 } else if ((net != asoc->primary_destination) && 8604 (asoc->alternate == NULL) && 8605 (chk->whoTo == NULL)) { 8606 continue; 8607 } 8608 } 8609 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 8610 /*- 8611 * strange, we have a chunk that is 8612 * to big for its destination and 8613 * yet no fragment ok flag. 8614 * Something went wrong when the 8615 * PMTU changed...we did not mark 8616 * this chunk for some reason?? I 8617 * will fix it here by letting IP 8618 * fragment it for now and printing 8619 * a warning. This really should not 8620 * happen ... 8621 */ 8622 SCTP_PRINTF("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 8623 chk->send_size, mtu); 8624 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 8625 } 8626 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 8627 ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) == SCTP_STATE_SHUTDOWN_PENDING)) { 8628 struct sctp_data_chunk *dchkh; 8629 8630 dchkh = mtod(chk->data, struct sctp_data_chunk *); 8631 dchkh->ch.chunk_flags |= SCTP_DATA_SACK_IMMEDIATELY; 8632 } 8633 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 8634 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 8635 /* ok we will add this one */ 8636 8637 /* 8638 * Add an AUTH chunk, if chunk 8639 * requires it, save the offset into 8640 * the chain for AUTH 8641 */ 8642 if (data_auth_reqd) { 8643 if (auth == NULL) { 8644 outchain = sctp_add_auth_chunk(outchain, 8645 &endoutchain, 8646 &auth, 8647 &auth_offset, 8648 stcb, 8649 SCTP_DATA); 8650 auth_keyid = chk->auth_keyid; 8651 override_ok = 0; 8652 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8653 } else if (override_ok) { 8654 /* 8655 * use this data's 8656 * keyid 8657 */ 8658 auth_keyid = chk->auth_keyid; 8659 override_ok = 0; 8660 } else if (auth_keyid != chk->auth_keyid) { 8661 /* 8662 * different keyid, 8663 * so done bundling 8664 */ 8665 break; 8666 } 8667 } 8668 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0, 8669 chk->send_size, chk->copy_by_ref); 8670 if (outchain == NULL) { 8671 SCTPDBG(SCTP_DEBUG_OUTPUT3, "No memory?\n"); 8672 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 8673 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8674 } 8675 *reason_code = 3; 8676 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8677 return (ENOMEM); 8678 } 8679 /* upate our MTU size */ 8680 /* Do clear IP_DF ? */ 8681 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8682 no_fragmentflg = 0; 8683 } 8684 /* unsigned subtraction of mtu */ 8685 if (mtu > chk->send_size) 8686 mtu -= chk->send_size; 8687 else 8688 mtu = 0; 8689 /* unsigned subtraction of r_mtu */ 8690 if (r_mtu > chk->send_size) 8691 r_mtu -= chk->send_size; 8692 else 8693 r_mtu = 0; 8694 8695 to_out += chk->send_size; 8696 if ((to_out > mx_mtu) && no_fragmentflg) { 8697#ifdef INVARIANTS 8698 panic("Exceeding mtu of %d out size is %d", mx_mtu, to_out); 8699#else 8700 SCTP_PRINTF("Exceeding mtu of %d out size is %d\n", 8701 mx_mtu, to_out); 8702#endif 8703 } 8704 chk->window_probe = 0; 8705 data_list[bundle_at++] = chk; 8706 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 8707 break; 8708 } 8709 if (chk->sent == SCTP_DATAGRAM_UNSENT) { 8710 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 8711 SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks); 8712 } else { 8713 SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks); 8714 } 8715 if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) && 8716 ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0)) 8717 /* 8718 * Count number of 8719 * user msg's that 8720 * were fragmented 8721 * we do this by 8722 * counting when we 8723 * see a LAST 8724 * fragment only. 8725 */ 8726 SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs); 8727 } 8728 if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) { 8729 if ((one_chunk) && (stcb->asoc.total_flight == 0)) { 8730 data_list[0]->window_probe = 1; 8731 net->window_probe = 1; 8732 } 8733 break; 8734 } 8735 } else { 8736 /* 8737 * Must be sent in order of the 8738 * TSN's (on a network) 8739 */ 8740 break; 8741 } 8742 } /* for (chunk gather loop for this net) */ 8743 } /* if asoc.state OPEN */ 8744no_data_fill: 8745 /* Is there something to send for this destination? */ 8746 if (outchain) { 8747 /* We may need to start a control timer or two */ 8748 if (asconf) { 8749 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, 8750 stcb, net); 8751 /* 8752 * do NOT clear the asconf flag as it is 8753 * used to do appropriate source address 8754 * selection. 8755 */ 8756 } 8757 if (cookie) { 8758 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8759 cookie = 0; 8760 } 8761 /* must start a send timer if data is being sent */ 8762 if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) { 8763 /* 8764 * no timer running on this destination 8765 * restart it. 8766 */ 8767 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8768 } 8769 /* Now send it, if there is anything to send :> */ 8770 if ((error = sctp_lowlevel_chunk_output(inp, 8771 stcb, 8772 net, 8773 (struct sockaddr *)&net->ro._l_addr, 8774 outchain, 8775 auth_offset, 8776 auth, 8777 auth_keyid, 8778 no_fragmentflg, 8779 bundle_at, 8780 asconf, 8781 inp->sctp_lport, stcb->rport, 8782 htonl(stcb->asoc.peer_vtag), 8783 net->port, NULL, 8784 0, 0, 8785 so_locked))) { 8786 /* error, we could not output */ 8787 if (error == ENOBUFS) { 8788 SCTP_STAT_INCR(sctps_lowlevelerr); 8789 asoc->ifp_had_enobuf = 1; 8790 } 8791 if (from_where == 0) { 8792 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8793 } 8794 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8795 if (hbflag) { 8796 if (*now_filled == 0) { 8797 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8798 *now_filled = 1; 8799 *now = net->last_sent_time; 8800 } else { 8801 net->last_sent_time = *now; 8802 } 8803 hbflag = 0; 8804 } 8805 if (error == EHOSTUNREACH) { 8806 /* 8807 * Destination went unreachable 8808 * during this send 8809 */ 8810 sctp_move_chunks_from_net(stcb, net); 8811 } 8812 *reason_code = 6; 8813 /*- 8814 * I add this line to be paranoid. As far as 8815 * I can tell the continue, takes us back to 8816 * the top of the for, but just to make sure 8817 * I will reset these again here. 8818 */ 8819 ctl_cnt = bundle_at = 0; 8820 continue; /* This takes us back to the 8821 * for() for the nets. */ 8822 } else { 8823 asoc->ifp_had_enobuf = 0; 8824 } 8825 endoutchain = NULL; 8826 auth = NULL; 8827 auth_offset = 0; 8828 if (bundle_at || hbflag) { 8829 /* For data/asconf and hb set time */ 8830 if (*now_filled == 0) { 8831 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 8832 *now_filled = 1; 8833 *now = net->last_sent_time; 8834 } else { 8835 net->last_sent_time = *now; 8836 } 8837 } 8838 if (!no_out_cnt) { 8839 *num_out += (ctl_cnt + bundle_at); 8840 } 8841 if (bundle_at) { 8842 /* setup for a RTO measurement */ 8843 tsns_sent = data_list[0]->rec.data.TSN_seq; 8844 /* fill time if not already filled */ 8845 if (*now_filled == 0) { 8846 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 8847 *now_filled = 1; 8848 *now = asoc->time_last_sent; 8849 } else { 8850 asoc->time_last_sent = *now; 8851 } 8852 if (net->rto_needed) { 8853 data_list[0]->do_rtt = 1; 8854 net->rto_needed = 0; 8855 } 8856 SCTP_STAT_INCR_BY(sctps_senddata, bundle_at); 8857 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 8858 } 8859 if (one_chunk) { 8860 break; 8861 } 8862 } 8863 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8864 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND); 8865 } 8866 } 8867 if (old_start_at == NULL) { 8868 old_start_at = start_at; 8869 start_at = TAILQ_FIRST(&asoc->nets); 8870 if (old_start_at) 8871 goto again_one_more_time; 8872 } 8873 /* 8874 * At the end there should be no NON timed chunks hanging on this 8875 * queue. 8876 */ 8877 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8878 sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND); 8879 } 8880 if ((*num_out == 0) && (*reason_code == 0)) { 8881 *reason_code = 4; 8882 } else { 8883 *reason_code = 5; 8884 } 8885 sctp_clean_up_ctl(stcb, asoc, so_locked); 8886 return (0); 8887} 8888 8889void 8890sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 8891{ 8892 /*- 8893 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of 8894 * the control chunk queue. 8895 */ 8896 struct sctp_chunkhdr *hdr; 8897 struct sctp_tmit_chunk *chk; 8898 struct mbuf *mat; 8899 8900 SCTP_TCB_LOCK_ASSERT(stcb); 8901 sctp_alloc_a_chunk(stcb, chk); 8902 if (chk == NULL) { 8903 /* no memory */ 8904 sctp_m_freem(op_err); 8905 return; 8906 } 8907 chk->copy_by_ref = 0; 8908 SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_NOWAIT); 8909 if (op_err == NULL) { 8910 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 8911 return; 8912 } 8913 chk->send_size = 0; 8914 for (mat = op_err; mat != NULL; mat = SCTP_BUF_NEXT(mat)) { 8915 chk->send_size += SCTP_BUF_LEN(mat); 8916 } 8917 chk->sent = SCTP_DATAGRAM_UNSENT; 8918 chk->snd_count = 0; 8919 chk->asoc = &stcb->asoc; 8920 chk->data = op_err; 8921 chk->whoTo = NULL; 8922 hdr = mtod(op_err, struct sctp_chunkhdr *); 8923 hdr->chunk_type = SCTP_OPERATION_ERROR; 8924 hdr->chunk_flags = 0; 8925 hdr->chunk_length = htons(chk->send_size); 8926 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, 8927 chk, 8928 sctp_next); 8929 chk->asoc->ctrl_queue_cnt++; 8930} 8931 8932int 8933sctp_send_cookie_echo(struct mbuf *m, 8934 int offset, 8935 struct sctp_tcb *stcb, 8936 struct sctp_nets *net) 8937{ 8938 /*- 8939 * pull out the cookie and put it at the front of the control chunk 8940 * queue. 8941 */ 8942 int at; 8943 struct mbuf *cookie; 8944 struct sctp_paramhdr parm, *phdr; 8945 struct sctp_chunkhdr *hdr; 8946 struct sctp_tmit_chunk *chk; 8947 uint16_t ptype, plen; 8948 8949 /* First find the cookie in the param area */ 8950 cookie = NULL; 8951 at = offset + sizeof(struct sctp_init_chunk); 8952 8953 SCTP_TCB_LOCK_ASSERT(stcb); 8954 do { 8955 phdr = sctp_get_next_param(m, at, &parm, sizeof(parm)); 8956 if (phdr == NULL) { 8957 return (-3); 8958 } 8959 ptype = ntohs(phdr->param_type); 8960 plen = ntohs(phdr->param_length); 8961 if (ptype == SCTP_STATE_COOKIE) { 8962 int pad; 8963 8964 /* found the cookie */ 8965 if ((pad = (plen % 4))) { 8966 plen += 4 - pad; 8967 } 8968 cookie = SCTP_M_COPYM(m, at, plen, M_NOWAIT); 8969 if (cookie == NULL) { 8970 /* No memory */ 8971 return (-2); 8972 } 8973#ifdef SCTP_MBUF_LOGGING 8974 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 8975 struct mbuf *mat; 8976 8977 for (mat = cookie; mat; mat = SCTP_BUF_NEXT(mat)) { 8978 if (SCTP_BUF_IS_EXTENDED(mat)) { 8979 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 8980 } 8981 } 8982 } 8983#endif 8984 break; 8985 } 8986 at += SCTP_SIZE32(plen); 8987 } while (phdr); 8988 if (cookie == NULL) { 8989 /* Did not find the cookie */ 8990 return (-3); 8991 } 8992 /* ok, we got the cookie lets change it into a cookie echo chunk */ 8993 8994 /* first the change from param to cookie */ 8995 hdr = mtod(cookie, struct sctp_chunkhdr *); 8996 hdr->chunk_type = SCTP_COOKIE_ECHO; 8997 hdr->chunk_flags = 0; 8998 /* get the chunk stuff now and place it in the FRONT of the queue */ 8999 sctp_alloc_a_chunk(stcb, chk); 9000 if (chk == NULL) { 9001 /* no memory */ 9002 sctp_m_freem(cookie); 9003 return (-5); 9004 } 9005 chk->copy_by_ref = 0; 9006 chk->rec.chunk_id.id = SCTP_COOKIE_ECHO; 9007 chk->rec.chunk_id.can_take_data = 0; 9008 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9009 chk->send_size = plen; 9010 chk->sent = SCTP_DATAGRAM_UNSENT; 9011 chk->snd_count = 0; 9012 chk->asoc = &stcb->asoc; 9013 chk->data = cookie; 9014 chk->whoTo = net; 9015 atomic_add_int(&chk->whoTo->ref_count, 1); 9016 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 9017 chk->asoc->ctrl_queue_cnt++; 9018 return (0); 9019} 9020 9021void 9022sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 9023 struct mbuf *m, 9024 int offset, 9025 int chk_length, 9026 struct sctp_nets *net) 9027{ 9028 /* 9029 * take a HB request and make it into a HB ack and send it. 9030 */ 9031 struct mbuf *outchain; 9032 struct sctp_chunkhdr *chdr; 9033 struct sctp_tmit_chunk *chk; 9034 9035 9036 if (net == NULL) 9037 /* must have a net pointer */ 9038 return; 9039 9040 outchain = SCTP_M_COPYM(m, offset, chk_length, M_NOWAIT); 9041 if (outchain == NULL) { 9042 /* gak out of memory */ 9043 return; 9044 } 9045#ifdef SCTP_MBUF_LOGGING 9046 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9047 struct mbuf *mat; 9048 9049 for (mat = outchain; mat; mat = SCTP_BUF_NEXT(mat)) { 9050 if (SCTP_BUF_IS_EXTENDED(mat)) { 9051 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 9052 } 9053 } 9054 } 9055#endif 9056 chdr = mtod(outchain, struct sctp_chunkhdr *); 9057 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 9058 chdr->chunk_flags = 0; 9059 if (chk_length % 4) { 9060 /* need pad */ 9061 uint32_t cpthis = 0; 9062 int padlen; 9063 9064 padlen = 4 - (chk_length % 4); 9065 m_copyback(outchain, chk_length, padlen, (caddr_t)&cpthis); 9066 } 9067 sctp_alloc_a_chunk(stcb, chk); 9068 if (chk == NULL) { 9069 /* no memory */ 9070 sctp_m_freem(outchain); 9071 return; 9072 } 9073 chk->copy_by_ref = 0; 9074 chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK; 9075 chk->rec.chunk_id.can_take_data = 1; 9076 chk->flags = 0; 9077 chk->send_size = chk_length; 9078 chk->sent = SCTP_DATAGRAM_UNSENT; 9079 chk->snd_count = 0; 9080 chk->asoc = &stcb->asoc; 9081 chk->data = outchain; 9082 chk->whoTo = net; 9083 atomic_add_int(&chk->whoTo->ref_count, 1); 9084 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9085 chk->asoc->ctrl_queue_cnt++; 9086} 9087 9088void 9089sctp_send_cookie_ack(struct sctp_tcb *stcb) 9090{ 9091 /* formulate and queue a cookie-ack back to sender */ 9092 struct mbuf *cookie_ack; 9093 struct sctp_chunkhdr *hdr; 9094 struct sctp_tmit_chunk *chk; 9095 9096 SCTP_TCB_LOCK_ASSERT(stcb); 9097 9098 cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 9099 if (cookie_ack == NULL) { 9100 /* no mbuf's */ 9101 return; 9102 } 9103 SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD); 9104 sctp_alloc_a_chunk(stcb, chk); 9105 if (chk == NULL) { 9106 /* no memory */ 9107 sctp_m_freem(cookie_ack); 9108 return; 9109 } 9110 chk->copy_by_ref = 0; 9111 chk->rec.chunk_id.id = SCTP_COOKIE_ACK; 9112 chk->rec.chunk_id.can_take_data = 1; 9113 chk->flags = 0; 9114 chk->send_size = sizeof(struct sctp_chunkhdr); 9115 chk->sent = SCTP_DATAGRAM_UNSENT; 9116 chk->snd_count = 0; 9117 chk->asoc = &stcb->asoc; 9118 chk->data = cookie_ack; 9119 if (chk->asoc->last_control_chunk_from != NULL) { 9120 chk->whoTo = chk->asoc->last_control_chunk_from; 9121 atomic_add_int(&chk->whoTo->ref_count, 1); 9122 } else { 9123 chk->whoTo = NULL; 9124 } 9125 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 9126 hdr->chunk_type = SCTP_COOKIE_ACK; 9127 hdr->chunk_flags = 0; 9128 hdr->chunk_length = htons(chk->send_size); 9129 SCTP_BUF_LEN(cookie_ack) = chk->send_size; 9130 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9131 chk->asoc->ctrl_queue_cnt++; 9132 return; 9133} 9134 9135 9136void 9137sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 9138{ 9139 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 9140 struct mbuf *m_shutdown_ack; 9141 struct sctp_shutdown_ack_chunk *ack_cp; 9142 struct sctp_tmit_chunk *chk; 9143 9144 m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9145 if (m_shutdown_ack == NULL) { 9146 /* no mbuf's */ 9147 return; 9148 } 9149 SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD); 9150 sctp_alloc_a_chunk(stcb, chk); 9151 if (chk == NULL) { 9152 /* no memory */ 9153 sctp_m_freem(m_shutdown_ack); 9154 return; 9155 } 9156 chk->copy_by_ref = 0; 9157 chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK; 9158 chk->rec.chunk_id.can_take_data = 1; 9159 chk->flags = 0; 9160 chk->send_size = sizeof(struct sctp_chunkhdr); 9161 chk->sent = SCTP_DATAGRAM_UNSENT; 9162 chk->snd_count = 0; 9163 chk->flags = 0; 9164 chk->asoc = &stcb->asoc; 9165 chk->data = m_shutdown_ack; 9166 chk->whoTo = net; 9167 if (chk->whoTo) { 9168 atomic_add_int(&chk->whoTo->ref_count, 1); 9169 } 9170 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 9171 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 9172 ack_cp->ch.chunk_flags = 0; 9173 ack_cp->ch.chunk_length = htons(chk->send_size); 9174 SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size; 9175 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9176 chk->asoc->ctrl_queue_cnt++; 9177 return; 9178} 9179 9180void 9181sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 9182{ 9183 /* formulate and queue a SHUTDOWN to the sender */ 9184 struct mbuf *m_shutdown; 9185 struct sctp_shutdown_chunk *shutdown_cp; 9186 struct sctp_tmit_chunk *chk; 9187 9188 m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9189 if (m_shutdown == NULL) { 9190 /* no mbuf's */ 9191 return; 9192 } 9193 SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD); 9194 sctp_alloc_a_chunk(stcb, chk); 9195 if (chk == NULL) { 9196 /* no memory */ 9197 sctp_m_freem(m_shutdown); 9198 return; 9199 } 9200 chk->copy_by_ref = 0; 9201 chk->rec.chunk_id.id = SCTP_SHUTDOWN; 9202 chk->rec.chunk_id.can_take_data = 1; 9203 chk->flags = 0; 9204 chk->send_size = sizeof(struct sctp_shutdown_chunk); 9205 chk->sent = SCTP_DATAGRAM_UNSENT; 9206 chk->snd_count = 0; 9207 chk->flags = 0; 9208 chk->asoc = &stcb->asoc; 9209 chk->data = m_shutdown; 9210 chk->whoTo = net; 9211 if (chk->whoTo) { 9212 atomic_add_int(&chk->whoTo->ref_count, 1); 9213 } 9214 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 9215 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 9216 shutdown_cp->ch.chunk_flags = 0; 9217 shutdown_cp->ch.chunk_length = htons(chk->send_size); 9218 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9219 SCTP_BUF_LEN(m_shutdown) = chk->send_size; 9220 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9221 chk->asoc->ctrl_queue_cnt++; 9222 return; 9223} 9224 9225void 9226sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked) 9227{ 9228 /* 9229 * formulate and queue an ASCONF to the peer. ASCONF parameters 9230 * should be queued on the assoc queue. 9231 */ 9232 struct sctp_tmit_chunk *chk; 9233 struct mbuf *m_asconf; 9234 int len; 9235 9236 SCTP_TCB_LOCK_ASSERT(stcb); 9237 9238 if ((!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) && 9239 (!sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS))) { 9240 /* can't send a new one if there is one in flight already */ 9241 return; 9242 } 9243 /* compose an ASCONF chunk, maximum length is PMTU */ 9244 m_asconf = sctp_compose_asconf(stcb, &len, addr_locked); 9245 if (m_asconf == NULL) { 9246 return; 9247 } 9248 sctp_alloc_a_chunk(stcb, chk); 9249 if (chk == NULL) { 9250 /* no memory */ 9251 sctp_m_freem(m_asconf); 9252 return; 9253 } 9254 chk->copy_by_ref = 0; 9255 chk->rec.chunk_id.id = SCTP_ASCONF; 9256 chk->rec.chunk_id.can_take_data = 0; 9257 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9258 chk->data = m_asconf; 9259 chk->send_size = len; 9260 chk->sent = SCTP_DATAGRAM_UNSENT; 9261 chk->snd_count = 0; 9262 chk->asoc = &stcb->asoc; 9263 chk->whoTo = net; 9264 if (chk->whoTo) { 9265 atomic_add_int(&chk->whoTo->ref_count, 1); 9266 } 9267 TAILQ_INSERT_TAIL(&chk->asoc->asconf_send_queue, chk, sctp_next); 9268 chk->asoc->ctrl_queue_cnt++; 9269 return; 9270} 9271 9272void 9273sctp_send_asconf_ack(struct sctp_tcb *stcb) 9274{ 9275 /* 9276 * formulate and queue a asconf-ack back to sender. the asconf-ack 9277 * must be stored in the tcb. 9278 */ 9279 struct sctp_tmit_chunk *chk; 9280 struct sctp_asconf_ack *ack, *latest_ack; 9281 struct mbuf *m_ack; 9282 struct sctp_nets *net = NULL; 9283 9284 SCTP_TCB_LOCK_ASSERT(stcb); 9285 /* Get the latest ASCONF-ACK */ 9286 latest_ack = TAILQ_LAST(&stcb->asoc.asconf_ack_sent, sctp_asconf_ackhead); 9287 if (latest_ack == NULL) { 9288 return; 9289 } 9290 if (latest_ack->last_sent_to != NULL && 9291 latest_ack->last_sent_to == stcb->asoc.last_control_chunk_from) { 9292 /* we're doing a retransmission */ 9293 net = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0); 9294 if (net == NULL) { 9295 /* no alternate */ 9296 if (stcb->asoc.last_control_chunk_from == NULL) { 9297 if (stcb->asoc.alternate) { 9298 net = stcb->asoc.alternate; 9299 } else { 9300 net = stcb->asoc.primary_destination; 9301 } 9302 } else { 9303 net = stcb->asoc.last_control_chunk_from; 9304 } 9305 } 9306 } else { 9307 /* normal case */ 9308 if (stcb->asoc.last_control_chunk_from == NULL) { 9309 if (stcb->asoc.alternate) { 9310 net = stcb->asoc.alternate; 9311 } else { 9312 net = stcb->asoc.primary_destination; 9313 } 9314 } else { 9315 net = stcb->asoc.last_control_chunk_from; 9316 } 9317 } 9318 latest_ack->last_sent_to = net; 9319 9320 TAILQ_FOREACH(ack, &stcb->asoc.asconf_ack_sent, next) { 9321 if (ack->data == NULL) { 9322 continue; 9323 } 9324 /* copy the asconf_ack */ 9325 m_ack = SCTP_M_COPYM(ack->data, 0, M_COPYALL, M_NOWAIT); 9326 if (m_ack == NULL) { 9327 /* couldn't copy it */ 9328 return; 9329 } 9330#ifdef SCTP_MBUF_LOGGING 9331 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9332 struct mbuf *mat; 9333 9334 for (mat = m_ack; mat; mat = SCTP_BUF_NEXT(mat)) { 9335 if (SCTP_BUF_IS_EXTENDED(mat)) { 9336 sctp_log_mb(mat, SCTP_MBUF_ICOPY); 9337 } 9338 } 9339 } 9340#endif 9341 9342 sctp_alloc_a_chunk(stcb, chk); 9343 if (chk == NULL) { 9344 /* no memory */ 9345 if (m_ack) 9346 sctp_m_freem(m_ack); 9347 return; 9348 } 9349 chk->copy_by_ref = 0; 9350 chk->rec.chunk_id.id = SCTP_ASCONF_ACK; 9351 chk->rec.chunk_id.can_take_data = 1; 9352 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9353 chk->whoTo = net; 9354 if (chk->whoTo) { 9355 atomic_add_int(&chk->whoTo->ref_count, 1); 9356 } 9357 chk->data = m_ack; 9358 chk->send_size = 0; 9359 /* Get size */ 9360 chk->send_size = ack->len; 9361 chk->sent = SCTP_DATAGRAM_UNSENT; 9362 chk->snd_count = 0; 9363 chk->asoc = &stcb->asoc; 9364 9365 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9366 chk->asoc->ctrl_queue_cnt++; 9367 } 9368 return; 9369} 9370 9371 9372static int 9373sctp_chunk_retransmission(struct sctp_inpcb *inp, 9374 struct sctp_tcb *stcb, 9375 struct sctp_association *asoc, 9376 int *cnt_out, struct timeval *now, int *now_filled, int *fr_done, int so_locked 9377#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 9378 SCTP_UNUSED 9379#endif 9380) 9381{ 9382 /*- 9383 * send out one MTU of retransmission. If fast_retransmit is 9384 * happening we ignore the cwnd. Otherwise we obey the cwnd and 9385 * rwnd. For a Cookie or Asconf in the control chunk queue we 9386 * retransmit them by themselves. 9387 * 9388 * For data chunks we will pick out the lowest TSN's in the sent_queue 9389 * marked for resend and bundle them all together (up to a MTU of 9390 * destination). The address to send to should have been 9391 * selected/changed where the retransmission was marked (i.e. in FR 9392 * or t3-timeout routines). 9393 */ 9394 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 9395 struct sctp_tmit_chunk *chk, *fwd; 9396 struct mbuf *m, *endofchain; 9397 struct sctp_nets *net = NULL; 9398 uint32_t tsns_sent = 0; 9399 int no_fragmentflg, bundle_at, cnt_thru; 9400 unsigned int mtu; 9401 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 9402 struct sctp_auth_chunk *auth = NULL; 9403 uint32_t auth_offset = 0; 9404 uint16_t auth_keyid; 9405 int override_ok = 1; 9406 int data_auth_reqd = 0; 9407 uint32_t dmtu = 0; 9408 9409 SCTP_TCB_LOCK_ASSERT(stcb); 9410 tmr_started = ctl_cnt = bundle_at = error = 0; 9411 no_fragmentflg = 1; 9412 fwd_tsn = 0; 9413 *cnt_out = 0; 9414 fwd = NULL; 9415 endofchain = m = NULL; 9416 auth_keyid = stcb->asoc.authinfo.active_keyid; 9417#ifdef SCTP_AUDITING_ENABLED 9418 sctp_audit_log(0xC3, 1); 9419#endif 9420 if ((TAILQ_EMPTY(&asoc->sent_queue)) && 9421 (TAILQ_EMPTY(&asoc->control_send_queue))) { 9422 SCTPDBG(SCTP_DEBUG_OUTPUT1, "SCTP hits empty queue with cnt set to %d?\n", 9423 asoc->sent_queue_retran_cnt); 9424 asoc->sent_queue_cnt = 0; 9425 asoc->sent_queue_cnt_removeable = 0; 9426 /* send back 0/0 so we enter normal transmission */ 9427 *cnt_out = 0; 9428 return (0); 9429 } 9430 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 9431 if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) || 9432 (chk->rec.chunk_id.id == SCTP_STREAM_RESET) || 9433 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) { 9434 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9435 continue; 9436 } 9437 if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 9438 if (chk != asoc->str_reset) { 9439 /* 9440 * not eligible for retran if its 9441 * not ours 9442 */ 9443 continue; 9444 } 9445 } 9446 ctl_cnt++; 9447 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 9448 fwd_tsn = 1; 9449 } 9450 /* 9451 * Add an AUTH chunk, if chunk requires it save the 9452 * offset into the chain for AUTH 9453 */ 9454 if ((auth == NULL) && 9455 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 9456 stcb->asoc.peer_auth_chunks))) { 9457 m = sctp_add_auth_chunk(m, &endofchain, 9458 &auth, &auth_offset, 9459 stcb, 9460 chk->rec.chunk_id.id); 9461 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9462 } 9463 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9464 break; 9465 } 9466 } 9467 one_chunk = 0; 9468 cnt_thru = 0; 9469 /* do we have control chunks to retransmit? */ 9470 if (m != NULL) { 9471 /* Start a timer no matter if we suceed or fail */ 9472 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 9473 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 9474 } else if (chk->rec.chunk_id.id == SCTP_ASCONF) 9475 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 9476 chk->snd_count++; /* update our count */ 9477 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 9478 (struct sockaddr *)&chk->whoTo->ro._l_addr, m, 9479 auth_offset, auth, stcb->asoc.authinfo.active_keyid, 9480 no_fragmentflg, 0, 0, 9481 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9482 chk->whoTo->port, NULL, 9483 0, 0, 9484 so_locked))) { 9485 SCTP_STAT_INCR(sctps_lowlevelerr); 9486 return (error); 9487 } 9488 endofchain = NULL; 9489 auth = NULL; 9490 auth_offset = 0; 9491 /* 9492 * We don't want to mark the net->sent time here since this 9493 * we use this for HB and retrans cannot measure RTT 9494 */ 9495 /* (void)SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */ 9496 *cnt_out += 1; 9497 chk->sent = SCTP_DATAGRAM_SENT; 9498 sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt); 9499 if (fwd_tsn == 0) { 9500 return (0); 9501 } else { 9502 /* Clean up the fwd-tsn list */ 9503 sctp_clean_up_ctl(stcb, asoc, so_locked); 9504 return (0); 9505 } 9506 } 9507 /* 9508 * Ok, it is just data retransmission we need to do or that and a 9509 * fwd-tsn with it all. 9510 */ 9511 if (TAILQ_EMPTY(&asoc->sent_queue)) { 9512 return (SCTP_RETRAN_DONE); 9513 } 9514 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) || 9515 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) { 9516 /* not yet open, resend the cookie and that is it */ 9517 return (1); 9518 } 9519#ifdef SCTP_AUDITING_ENABLED 9520 sctp_auditing(20, inp, stcb, NULL); 9521#endif 9522 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks); 9523 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 9524 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9525 /* No, not sent to this net or not ready for rtx */ 9526 continue; 9527 } 9528 if (chk->data == NULL) { 9529 SCTP_PRINTF("TSN:%x chk->snd_count:%d chk->sent:%d can't retran - no data\n", 9530 chk->rec.data.TSN_seq, chk->snd_count, chk->sent); 9531 continue; 9532 } 9533 if ((SCTP_BASE_SYSCTL(sctp_max_retran_chunk)) && 9534 (chk->snd_count >= SCTP_BASE_SYSCTL(sctp_max_retran_chunk))) { 9535 /* Gak, we have exceeded max unlucky retran, abort! */ 9536 SCTP_PRINTF("Gak, chk->snd_count:%d >= max:%d - send abort\n", 9537 chk->snd_count, 9538 SCTP_BASE_SYSCTL(sctp_max_retran_chunk)); 9539 atomic_add_int(&stcb->asoc.refcnt, 1); 9540 sctp_abort_an_association(stcb->sctp_ep, stcb, NULL, so_locked); 9541 SCTP_TCB_LOCK(stcb); 9542 atomic_subtract_int(&stcb->asoc.refcnt, 1); 9543 return (SCTP_RETRAN_EXIT); 9544 } 9545 /* pick up the net */ 9546 net = chk->whoTo; 9547 switch (net->ro._l_addr.sa.sa_family) { 9548#ifdef INET 9549 case AF_INET: 9550 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 9551 break; 9552#endif 9553#ifdef INET6 9554 case AF_INET6: 9555 mtu = net->mtu - SCTP_MIN_OVERHEAD; 9556 break; 9557#endif 9558 default: 9559 /* TSNH */ 9560 mtu = net->mtu; 9561 break; 9562 } 9563 9564 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 9565 /* No room in peers rwnd */ 9566 uint32_t tsn; 9567 9568 tsn = asoc->last_acked_seq + 1; 9569 if (tsn == chk->rec.data.TSN_seq) { 9570 /* 9571 * we make a special exception for this 9572 * case. The peer has no rwnd but is missing 9573 * the lowest chunk.. which is probably what 9574 * is holding up the rwnd. 9575 */ 9576 goto one_chunk_around; 9577 } 9578 return (1); 9579 } 9580one_chunk_around: 9581 if (asoc->peers_rwnd < mtu) { 9582 one_chunk = 1; 9583 if ((asoc->peers_rwnd == 0) && 9584 (asoc->total_flight == 0)) { 9585 chk->window_probe = 1; 9586 chk->whoTo->window_probe = 1; 9587 } 9588 } 9589#ifdef SCTP_AUDITING_ENABLED 9590 sctp_audit_log(0xC3, 2); 9591#endif 9592 bundle_at = 0; 9593 m = NULL; 9594 net->fast_retran_ip = 0; 9595 if (chk->rec.data.doing_fast_retransmit == 0) { 9596 /* 9597 * if no FR in progress skip destination that have 9598 * flight_size > cwnd. 9599 */ 9600 if (net->flight_size >= net->cwnd) { 9601 continue; 9602 } 9603 } else { 9604 /* 9605 * Mark the destination net to have FR recovery 9606 * limits put on it. 9607 */ 9608 *fr_done = 1; 9609 net->fast_retran_ip = 1; 9610 } 9611 9612 /* 9613 * if no AUTH is yet included and this chunk requires it, 9614 * make sure to account for it. We don't apply the size 9615 * until the AUTH chunk is actually added below in case 9616 * there is no room for this chunk. 9617 */ 9618 if (data_auth_reqd && (auth == NULL)) { 9619 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9620 } else 9621 dmtu = 0; 9622 9623 if ((chk->send_size <= (mtu - dmtu)) || 9624 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 9625 /* ok we will add this one */ 9626 if (data_auth_reqd) { 9627 if (auth == NULL) { 9628 m = sctp_add_auth_chunk(m, 9629 &endofchain, 9630 &auth, 9631 &auth_offset, 9632 stcb, 9633 SCTP_DATA); 9634 auth_keyid = chk->auth_keyid; 9635 override_ok = 0; 9636 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9637 } else if (override_ok) { 9638 auth_keyid = chk->auth_keyid; 9639 override_ok = 0; 9640 } else if (chk->auth_keyid != auth_keyid) { 9641 /* different keyid, so done bundling */ 9642 break; 9643 } 9644 } 9645 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9646 if (m == NULL) { 9647 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9648 return (ENOMEM); 9649 } 9650 /* Do clear IP_DF ? */ 9651 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9652 no_fragmentflg = 0; 9653 } 9654 /* upate our MTU size */ 9655 if (mtu > (chk->send_size + dmtu)) 9656 mtu -= (chk->send_size + dmtu); 9657 else 9658 mtu = 0; 9659 data_list[bundle_at++] = chk; 9660 if (one_chunk && (asoc->total_flight <= 0)) { 9661 SCTP_STAT_INCR(sctps_windowprobed); 9662 } 9663 } 9664 if (one_chunk == 0) { 9665 /* 9666 * now are there anymore forward from chk to pick 9667 * up? 9668 */ 9669 for (fwd = TAILQ_NEXT(chk, sctp_next); fwd != NULL; fwd = TAILQ_NEXT(fwd, sctp_next)) { 9670 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 9671 /* Nope, not for retran */ 9672 continue; 9673 } 9674 if (fwd->whoTo != net) { 9675 /* Nope, not the net in question */ 9676 continue; 9677 } 9678 if (data_auth_reqd && (auth == NULL)) { 9679 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9680 } else 9681 dmtu = 0; 9682 if (fwd->send_size <= (mtu - dmtu)) { 9683 if (data_auth_reqd) { 9684 if (auth == NULL) { 9685 m = sctp_add_auth_chunk(m, 9686 &endofchain, 9687 &auth, 9688 &auth_offset, 9689 stcb, 9690 SCTP_DATA); 9691 auth_keyid = fwd->auth_keyid; 9692 override_ok = 0; 9693 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9694 } else if (override_ok) { 9695 auth_keyid = fwd->auth_keyid; 9696 override_ok = 0; 9697 } else if (fwd->auth_keyid != auth_keyid) { 9698 /* 9699 * different keyid, 9700 * so done bundling 9701 */ 9702 break; 9703 } 9704 } 9705 m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref); 9706 if (m == NULL) { 9707 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9708 return (ENOMEM); 9709 } 9710 /* Do clear IP_DF ? */ 9711 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9712 no_fragmentflg = 0; 9713 } 9714 /* upate our MTU size */ 9715 if (mtu > (fwd->send_size + dmtu)) 9716 mtu -= (fwd->send_size + dmtu); 9717 else 9718 mtu = 0; 9719 data_list[bundle_at++] = fwd; 9720 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 9721 break; 9722 } 9723 } else { 9724 /* can't fit so we are done */ 9725 break; 9726 } 9727 } 9728 } 9729 /* Is there something to send for this destination? */ 9730 if (m) { 9731 /* 9732 * No matter if we fail/or suceed we should start a 9733 * timer. A failure is like a lost IP packet :-) 9734 */ 9735 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9736 /* 9737 * no timer running on this destination 9738 * restart it. 9739 */ 9740 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9741 tmr_started = 1; 9742 } 9743 /* Now lets send it, if there is anything to send :> */ 9744 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 9745 (struct sockaddr *)&net->ro._l_addr, m, 9746 auth_offset, auth, auth_keyid, 9747 no_fragmentflg, 0, 0, 9748 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9749 net->port, NULL, 9750 0, 0, 9751 so_locked))) { 9752 /* error, we could not output */ 9753 SCTP_STAT_INCR(sctps_lowlevelerr); 9754 return (error); 9755 } 9756 endofchain = NULL; 9757 auth = NULL; 9758 auth_offset = 0; 9759 /* For HB's */ 9760 /* 9761 * We don't want to mark the net->sent time here 9762 * since this we use this for HB and retrans cannot 9763 * measure RTT 9764 */ 9765 /* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */ 9766 9767 /* For auto-close */ 9768 cnt_thru++; 9769 if (*now_filled == 0) { 9770 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 9771 *now = asoc->time_last_sent; 9772 *now_filled = 1; 9773 } else { 9774 asoc->time_last_sent = *now; 9775 } 9776 *cnt_out += bundle_at; 9777#ifdef SCTP_AUDITING_ENABLED 9778 sctp_audit_log(0xC4, bundle_at); 9779#endif 9780 if (bundle_at) { 9781 tsns_sent = data_list[0]->rec.data.TSN_seq; 9782 } 9783 for (i = 0; i < bundle_at; i++) { 9784 SCTP_STAT_INCR(sctps_sendretransdata); 9785 data_list[i]->sent = SCTP_DATAGRAM_SENT; 9786 /* 9787 * When we have a revoked data, and we 9788 * retransmit it, then we clear the revoked 9789 * flag since this flag dictates if we 9790 * subtracted from the fs 9791 */ 9792 if (data_list[i]->rec.data.chunk_was_revoked) { 9793 /* Deflate the cwnd */ 9794 data_list[i]->whoTo->cwnd -= data_list[i]->book_size; 9795 data_list[i]->rec.data.chunk_was_revoked = 0; 9796 } 9797 data_list[i]->snd_count++; 9798 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 9799 /* record the time */ 9800 data_list[i]->sent_rcv_time = asoc->time_last_sent; 9801 if (data_list[i]->book_size_scale) { 9802 /* 9803 * need to double the book size on 9804 * this one 9805 */ 9806 data_list[i]->book_size_scale = 0; 9807 /* 9808 * Since we double the booksize, we 9809 * must also double the output queue 9810 * size, since this get shrunk when 9811 * we free by this amount. 9812 */ 9813 atomic_add_int(&((asoc)->total_output_queue_size), data_list[i]->book_size); 9814 data_list[i]->book_size *= 2; 9815 9816 9817 } else { 9818 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 9819 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 9820 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 9821 } 9822 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 9823 (uint32_t) (data_list[i]->send_size + 9824 SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 9825 } 9826 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 9827 sctp_misc_ints(SCTP_FLIGHT_LOG_UP_RSND, 9828 data_list[i]->whoTo->flight_size, 9829 data_list[i]->book_size, 9830 (uintptr_t) data_list[i]->whoTo, 9831 data_list[i]->rec.data.TSN_seq); 9832 } 9833 sctp_flight_size_increase(data_list[i]); 9834 sctp_total_flight_increase(stcb, data_list[i]); 9835 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 9836 /* SWS sender side engages */ 9837 asoc->peers_rwnd = 0; 9838 } 9839 if ((i == 0) && 9840 (data_list[i]->rec.data.doing_fast_retransmit)) { 9841 SCTP_STAT_INCR(sctps_sendfastretrans); 9842 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 9843 (tmr_started == 0)) { 9844 /*- 9845 * ok we just fast-retrans'd 9846 * the lowest TSN, i.e the 9847 * first on the list. In 9848 * this case we want to give 9849 * some more time to get a 9850 * SACK back without a 9851 * t3-expiring. 9852 */ 9853 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 9854 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4); 9855 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9856 } 9857 } 9858 } 9859 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 9860 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND); 9861 } 9862#ifdef SCTP_AUDITING_ENABLED 9863 sctp_auditing(21, inp, stcb, NULL); 9864#endif 9865 } else { 9866 /* None will fit */ 9867 return (1); 9868 } 9869 if (asoc->sent_queue_retran_cnt <= 0) { 9870 /* all done we have no more to retran */ 9871 asoc->sent_queue_retran_cnt = 0; 9872 break; 9873 } 9874 if (one_chunk) { 9875 /* No more room in rwnd */ 9876 return (1); 9877 } 9878 /* stop the for loop here. we sent out a packet */ 9879 break; 9880 } 9881 return (0); 9882} 9883 9884static void 9885sctp_timer_validation(struct sctp_inpcb *inp, 9886 struct sctp_tcb *stcb, 9887 struct sctp_association *asoc) 9888{ 9889 struct sctp_nets *net; 9890 9891 /* Validate that a timer is running somewhere */ 9892 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 9893 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9894 /* Here is a timer */ 9895 return; 9896 } 9897 } 9898 SCTP_TCB_LOCK_ASSERT(stcb); 9899 /* Gak, we did not have a timer somewhere */ 9900 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Deadlock avoided starting timer on a dest at retran\n"); 9901 if (asoc->alternate) { 9902 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->alternate); 9903 } else { 9904 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 9905 } 9906 return; 9907} 9908 9909void 9910sctp_chunk_output(struct sctp_inpcb *inp, 9911 struct sctp_tcb *stcb, 9912 int from_where, 9913 int so_locked 9914#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 9915 SCTP_UNUSED 9916#endif 9917) 9918{ 9919 /*- 9920 * Ok this is the generic chunk service queue. we must do the 9921 * following: 9922 * - See if there are retransmits pending, if so we must 9923 * do these first. 9924 * - Service the stream queue that is next, moving any 9925 * message (note I must get a complete message i.e. 9926 * FIRST/MIDDLE and LAST to the out queue in one pass) and assigning 9927 * TSN's 9928 * - Check to see if the cwnd/rwnd allows any output, if so we 9929 * go ahead and fomulate and send the low level chunks. Making sure 9930 * to combine any control in the control chunk queue also. 9931 */ 9932 struct sctp_association *asoc; 9933 struct sctp_nets *net; 9934 int error = 0, num_out = 0, tot_out = 0, ret = 0, reason_code = 0; 9935 unsigned int burst_cnt = 0; 9936 struct timeval now; 9937 int now_filled = 0; 9938 int nagle_on; 9939 int frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 9940 int un_sent = 0; 9941 int fr_done; 9942 unsigned int tot_frs = 0; 9943 9944 asoc = &stcb->asoc; 9945 /* The Nagle algorithm is only applied when handling a send call. */ 9946 if (from_where == SCTP_OUTPUT_FROM_USR_SEND) { 9947 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) { 9948 nagle_on = 0; 9949 } else { 9950 nagle_on = 1; 9951 } 9952 } else { 9953 nagle_on = 0; 9954 } 9955 SCTP_TCB_LOCK_ASSERT(stcb); 9956 9957 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 9958 9959 if ((un_sent <= 0) && 9960 (TAILQ_EMPTY(&asoc->control_send_queue)) && 9961 (TAILQ_EMPTY(&asoc->asconf_send_queue)) && 9962 (asoc->sent_queue_retran_cnt == 0)) { 9963 /* Nothing to do unless there is something to be sent left */ 9964 return; 9965 } 9966 /* 9967 * Do we have something to send, data or control AND a sack timer 9968 * running, if so piggy-back the sack. 9969 */ 9970 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 9971 sctp_send_sack(stcb, so_locked); 9972 (void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer); 9973 } 9974 while (asoc->sent_queue_retran_cnt) { 9975 /*- 9976 * Ok, it is retransmission time only, we send out only ONE 9977 * packet with a single call off to the retran code. 9978 */ 9979 if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) { 9980 /*- 9981 * Special hook for handling cookiess discarded 9982 * by peer that carried data. Send cookie-ack only 9983 * and then the next call with get the retran's. 9984 */ 9985 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 9986 from_where, 9987 &now, &now_filled, frag_point, so_locked); 9988 return; 9989 } else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) { 9990 /* if its not from a HB then do it */ 9991 fr_done = 0; 9992 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled, &fr_done, so_locked); 9993 if (fr_done) { 9994 tot_frs++; 9995 } 9996 } else { 9997 /* 9998 * its from any other place, we don't allow retran 9999 * output (only control) 10000 */ 10001 ret = 1; 10002 } 10003 if (ret > 0) { 10004 /* Can't send anymore */ 10005 /*- 10006 * now lets push out control by calling med-level 10007 * output once. this assures that we WILL send HB's 10008 * if queued too. 10009 */ 10010 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10011 from_where, 10012 &now, &now_filled, frag_point, so_locked); 10013#ifdef SCTP_AUDITING_ENABLED 10014 sctp_auditing(8, inp, stcb, NULL); 10015#endif 10016 sctp_timer_validation(inp, stcb, asoc); 10017 return; 10018 } 10019 if (ret < 0) { 10020 /*- 10021 * The count was off.. retran is not happening so do 10022 * the normal retransmission. 10023 */ 10024#ifdef SCTP_AUDITING_ENABLED 10025 sctp_auditing(9, inp, stcb, NULL); 10026#endif 10027 if (ret == SCTP_RETRAN_EXIT) { 10028 return; 10029 } 10030 break; 10031 } 10032 if (from_where == SCTP_OUTPUT_FROM_T3) { 10033 /* Only one transmission allowed out of a timeout */ 10034#ifdef SCTP_AUDITING_ENABLED 10035 sctp_auditing(10, inp, stcb, NULL); 10036#endif 10037 /* Push out any control */ 10038 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, from_where, 10039 &now, &now_filled, frag_point, so_locked); 10040 return; 10041 } 10042 if ((asoc->fr_max_burst > 0) && (tot_frs >= asoc->fr_max_burst)) { 10043 /* Hit FR burst limit */ 10044 return; 10045 } 10046 if ((num_out == 0) && (ret == 0)) { 10047 /* No more retrans to send */ 10048 break; 10049 } 10050 } 10051#ifdef SCTP_AUDITING_ENABLED 10052 sctp_auditing(12, inp, stcb, NULL); 10053#endif 10054 /* Check for bad destinations, if they exist move chunks around. */ 10055 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 10056 if (!(net->dest_state & SCTP_ADDR_REACHABLE)) { 10057 /*- 10058 * if possible move things off of this address we 10059 * still may send below due to the dormant state but 10060 * we try to find an alternate address to send to 10061 * and if we have one we move all queued data on the 10062 * out wheel to this alternate address. 10063 */ 10064 if (net->ref_count > 1) 10065 sctp_move_chunks_from_net(stcb, net); 10066 } else { 10067 /*- 10068 * if ((asoc->sat_network) || (net->addr_is_local)) 10069 * { burst_limit = asoc->max_burst * 10070 * SCTP_SAT_NETWORK_BURST_INCR; } 10071 */ 10072 if (asoc->max_burst > 0) { 10073 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst)) { 10074 if ((net->flight_size + (asoc->max_burst * net->mtu)) < net->cwnd) { 10075 /* 10076 * JRS - Use the congestion 10077 * control given in the 10078 * congestion control module 10079 */ 10080 asoc->cc_functions.sctp_cwnd_update_after_output(stcb, net, asoc->max_burst); 10081 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10082 sctp_log_maxburst(stcb, net, 0, asoc->max_burst, SCTP_MAX_BURST_APPLIED); 10083 } 10084 SCTP_STAT_INCR(sctps_maxburstqueued); 10085 } 10086 net->fast_retran_ip = 0; 10087 } else { 10088 if (net->flight_size == 0) { 10089 /* 10090 * Should be decaying the 10091 * cwnd here 10092 */ 10093 ; 10094 } 10095 } 10096 } 10097 } 10098 10099 } 10100 burst_cnt = 0; 10101 do { 10102 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 10103 &reason_code, 0, from_where, 10104 &now, &now_filled, frag_point, so_locked); 10105 if (error) { 10106 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Error %d was returned from med-c-op\n", error); 10107 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10108 sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 10109 } 10110 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10111 sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES); 10112 sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES); 10113 } 10114 break; 10115 } 10116 SCTPDBG(SCTP_DEBUG_OUTPUT3, "m-c-o put out %d\n", num_out); 10117 10118 tot_out += num_out; 10119 burst_cnt++; 10120 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10121 sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES); 10122 if (num_out == 0) { 10123 sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES); 10124 } 10125 } 10126 if (nagle_on) { 10127 /* 10128 * When the Nagle algorithm is used, look at how 10129 * much is unsent, then if its smaller than an MTU 10130 * and we have data in flight we stop, except if we 10131 * are handling a fragmented user message. 10132 */ 10133 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 10134 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 10135 if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) && 10136 (stcb->asoc.total_flight > 0) && 10137 ((stcb->asoc.locked_on_sending == NULL) || 10138 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 10139 break; 10140 } 10141 } 10142 if (TAILQ_EMPTY(&asoc->control_send_queue) && 10143 TAILQ_EMPTY(&asoc->send_queue) && 10144 stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) { 10145 /* Nothing left to send */ 10146 break; 10147 } 10148 if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) { 10149 /* Nothing left to send */ 10150 break; 10151 } 10152 } while (num_out && 10153 ((asoc->max_burst == 0) || 10154 SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) || 10155 (burst_cnt < asoc->max_burst))); 10156 10157 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) == 0) { 10158 if ((asoc->max_burst > 0) && (burst_cnt >= asoc->max_burst)) { 10159 SCTP_STAT_INCR(sctps_maxburstqueued); 10160 asoc->burst_limit_applied = 1; 10161 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10162 sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED); 10163 } 10164 } else { 10165 asoc->burst_limit_applied = 0; 10166 } 10167 } 10168 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10169 sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES); 10170 } 10171 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, we have put out %d chunks\n", 10172 tot_out); 10173 10174 /*- 10175 * Now we need to clean up the control chunk chain if a ECNE is on 10176 * it. It must be marked as UNSENT again so next call will continue 10177 * to send it until such time that we get a CWR, to remove it. 10178 */ 10179 if (stcb->asoc.ecn_echo_cnt_onq) 10180 sctp_fix_ecn_echo(asoc); 10181 return; 10182} 10183 10184 10185int 10186sctp_output( 10187 struct sctp_inpcb *inp, 10188 struct mbuf *m, 10189 struct sockaddr *addr, 10190 struct mbuf *control, 10191 struct thread *p, 10192 int flags) 10193{ 10194 if (inp == NULL) { 10195 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10196 return (EINVAL); 10197 } 10198 if (inp->sctp_socket == NULL) { 10199 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10200 return (EINVAL); 10201 } 10202 return (sctp_sosend(inp->sctp_socket, 10203 addr, 10204 (struct uio *)NULL, 10205 m, 10206 control, 10207 flags, p 10208 )); 10209} 10210 10211void 10212send_forward_tsn(struct sctp_tcb *stcb, 10213 struct sctp_association *asoc) 10214{ 10215 struct sctp_tmit_chunk *chk; 10216 struct sctp_forward_tsn_chunk *fwdtsn; 10217 uint32_t advance_peer_ack_point; 10218 10219 SCTP_TCB_LOCK_ASSERT(stcb); 10220 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10221 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 10222 /* mark it to unsent */ 10223 chk->sent = SCTP_DATAGRAM_UNSENT; 10224 chk->snd_count = 0; 10225 /* Do we correct its output location? */ 10226 if (chk->whoTo) { 10227 sctp_free_remote_addr(chk->whoTo); 10228 chk->whoTo = NULL; 10229 } 10230 goto sctp_fill_in_rest; 10231 } 10232 } 10233 /* Ok if we reach here we must build one */ 10234 sctp_alloc_a_chunk(stcb, chk); 10235 if (chk == NULL) { 10236 return; 10237 } 10238 asoc->fwd_tsn_cnt++; 10239 chk->copy_by_ref = 0; 10240 chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN; 10241 chk->rec.chunk_id.can_take_data = 0; 10242 chk->flags = 0; 10243 chk->asoc = asoc; 10244 chk->whoTo = NULL; 10245 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 10246 if (chk->data == NULL) { 10247 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 10248 return; 10249 } 10250 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 10251 chk->sent = SCTP_DATAGRAM_UNSENT; 10252 chk->snd_count = 0; 10253 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 10254 asoc->ctrl_queue_cnt++; 10255sctp_fill_in_rest: 10256 /*- 10257 * Here we go through and fill out the part that deals with 10258 * stream/seq of the ones we skip. 10259 */ 10260 SCTP_BUF_LEN(chk->data) = 0; 10261 { 10262 struct sctp_tmit_chunk *at, *tp1, *last; 10263 struct sctp_strseq *strseq; 10264 unsigned int cnt_of_space, i, ovh; 10265 unsigned int space_needed; 10266 unsigned int cnt_of_skipped = 0; 10267 10268 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10269 if ((at->sent != SCTP_FORWARD_TSN_SKIP) && 10270 (at->sent != SCTP_DATAGRAM_NR_ACKED)) { 10271 /* no more to look at */ 10272 break; 10273 } 10274 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 10275 /* We don't report these */ 10276 continue; 10277 } 10278 cnt_of_skipped++; 10279 } 10280 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10281 (cnt_of_skipped * sizeof(struct sctp_strseq))); 10282 10283 cnt_of_space = M_TRAILINGSPACE(chk->data); 10284 10285 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 10286 ovh = SCTP_MIN_OVERHEAD; 10287 } else { 10288 ovh = SCTP_MIN_V4_OVERHEAD; 10289 } 10290 if (cnt_of_space > (asoc->smallest_mtu - ovh)) { 10291 /* trim to a mtu size */ 10292 cnt_of_space = asoc->smallest_mtu - ovh; 10293 } 10294 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10295 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10296 0xff, 0, cnt_of_skipped, 10297 asoc->advanced_peer_ack_point); 10298 10299 } 10300 advance_peer_ack_point = asoc->advanced_peer_ack_point; 10301 if (cnt_of_space < space_needed) { 10302 /*- 10303 * ok we must trim down the chunk by lowering the 10304 * advance peer ack point. 10305 */ 10306 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10307 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10308 0xff, 0xff, cnt_of_space, 10309 space_needed); 10310 } 10311 cnt_of_skipped = cnt_of_space - sizeof(struct sctp_forward_tsn_chunk); 10312 cnt_of_skipped /= sizeof(struct sctp_strseq); 10313 /*- 10314 * Go through and find the TSN that will be the one 10315 * we report. 10316 */ 10317 at = TAILQ_FIRST(&asoc->sent_queue); 10318 if (at != NULL) { 10319 for (i = 0; i < cnt_of_skipped; i++) { 10320 tp1 = TAILQ_NEXT(at, sctp_next); 10321 if (tp1 == NULL) { 10322 break; 10323 } 10324 at = tp1; 10325 } 10326 } 10327 if (at && SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10328 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10329 0xff, cnt_of_skipped, at->rec.data.TSN_seq, 10330 asoc->advanced_peer_ack_point); 10331 } 10332 last = at; 10333 /*- 10334 * last now points to last one I can report, update 10335 * peer ack point 10336 */ 10337 if (last) 10338 advance_peer_ack_point = last->rec.data.TSN_seq; 10339 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10340 cnt_of_skipped * sizeof(struct sctp_strseq); 10341 } 10342 chk->send_size = space_needed; 10343 /* Setup the chunk */ 10344 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 10345 fwdtsn->ch.chunk_length = htons(chk->send_size); 10346 fwdtsn->ch.chunk_flags = 0; 10347 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 10348 fwdtsn->new_cumulative_tsn = htonl(advance_peer_ack_point); 10349 SCTP_BUF_LEN(chk->data) = chk->send_size; 10350 fwdtsn++; 10351 /*- 10352 * Move pointer to after the fwdtsn and transfer to the 10353 * strseq pointer. 10354 */ 10355 strseq = (struct sctp_strseq *)fwdtsn; 10356 /*- 10357 * Now populate the strseq list. This is done blindly 10358 * without pulling out duplicate stream info. This is 10359 * inefficent but won't harm the process since the peer will 10360 * look at these in sequence and will thus release anything. 10361 * It could mean we exceed the PMTU and chop off some that 10362 * we could have included.. but this is unlikely (aka 1432/4 10363 * would mean 300+ stream seq's would have to be reported in 10364 * one FWD-TSN. With a bit of work we can later FIX this to 10365 * optimize and pull out duplcates.. but it does add more 10366 * overhead. So for now... not! 10367 */ 10368 at = TAILQ_FIRST(&asoc->sent_queue); 10369 for (i = 0; i < cnt_of_skipped; i++) { 10370 tp1 = TAILQ_NEXT(at, sctp_next); 10371 if (tp1 == NULL) 10372 break; 10373 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 10374 /* We don't report these */ 10375 i--; 10376 at = tp1; 10377 continue; 10378 } 10379 if (at->rec.data.TSN_seq == advance_peer_ack_point) { 10380 at->rec.data.fwd_tsn_cnt = 0; 10381 } 10382 strseq->stream = ntohs(at->rec.data.stream_number); 10383 strseq->sequence = ntohs(at->rec.data.stream_seq); 10384 strseq++; 10385 at = tp1; 10386 } 10387 } 10388 return; 10389} 10390 10391void 10392sctp_send_sack(struct sctp_tcb *stcb, int so_locked 10393#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10394 SCTP_UNUSED 10395#endif 10396) 10397{ 10398 /*- 10399 * Queue up a SACK or NR-SACK in the control queue. 10400 * We must first check to see if a SACK or NR-SACK is 10401 * somehow on the control queue. 10402 * If so, we will take and and remove the old one. 10403 */ 10404 struct sctp_association *asoc; 10405 struct sctp_tmit_chunk *chk, *a_chk; 10406 struct sctp_sack_chunk *sack; 10407 struct sctp_nr_sack_chunk *nr_sack; 10408 struct sctp_gap_ack_block *gap_descriptor; 10409 struct sack_track *selector; 10410 int mergeable = 0; 10411 int offset; 10412 caddr_t limit; 10413 uint32_t *dup; 10414 int limit_reached = 0; 10415 unsigned int i, siz, j; 10416 unsigned int num_gap_blocks = 0, num_nr_gap_blocks = 0, space; 10417 int num_dups = 0; 10418 int space_req; 10419 uint32_t highest_tsn; 10420 uint8_t flags; 10421 uint8_t type; 10422 uint8_t tsn_map; 10423 10424 if (stcb->asoc.nrsack_supported == 1) { 10425 type = SCTP_NR_SELECTIVE_ACK; 10426 } else { 10427 type = SCTP_SELECTIVE_ACK; 10428 } 10429 a_chk = NULL; 10430 asoc = &stcb->asoc; 10431 SCTP_TCB_LOCK_ASSERT(stcb); 10432 if (asoc->last_data_chunk_from == NULL) { 10433 /* Hmm we never received anything */ 10434 return; 10435 } 10436 sctp_slide_mapping_arrays(stcb); 10437 sctp_set_rwnd(stcb, asoc); 10438 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10439 if (chk->rec.chunk_id.id == type) { 10440 /* Hmm, found a sack already on queue, remove it */ 10441 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 10442 asoc->ctrl_queue_cnt--; 10443 a_chk = chk; 10444 if (a_chk->data) { 10445 sctp_m_freem(a_chk->data); 10446 a_chk->data = NULL; 10447 } 10448 if (a_chk->whoTo) { 10449 sctp_free_remote_addr(a_chk->whoTo); 10450 a_chk->whoTo = NULL; 10451 } 10452 break; 10453 } 10454 } 10455 if (a_chk == NULL) { 10456 sctp_alloc_a_chunk(stcb, a_chk); 10457 if (a_chk == NULL) { 10458 /* No memory so we drop the idea, and set a timer */ 10459 if (stcb->asoc.delayed_ack) { 10460 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10461 stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5); 10462 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10463 stcb->sctp_ep, stcb, NULL); 10464 } else { 10465 stcb->asoc.send_sack = 1; 10466 } 10467 return; 10468 } 10469 a_chk->copy_by_ref = 0; 10470 a_chk->rec.chunk_id.id = type; 10471 a_chk->rec.chunk_id.can_take_data = 1; 10472 } 10473 /* Clear our pkt counts */ 10474 asoc->data_pkts_seen = 0; 10475 10476 a_chk->flags = 0; 10477 a_chk->asoc = asoc; 10478 a_chk->snd_count = 0; 10479 a_chk->send_size = 0; /* fill in later */ 10480 a_chk->sent = SCTP_DATAGRAM_UNSENT; 10481 a_chk->whoTo = NULL; 10482 10483 if ((asoc->numduptsns) || 10484 (!(asoc->last_data_chunk_from->dest_state & SCTP_ADDR_REACHABLE))) { 10485 /*- 10486 * Ok, we have some duplicates or the destination for the 10487 * sack is unreachable, lets see if we can select an 10488 * alternate than asoc->last_data_chunk_from 10489 */ 10490 if ((asoc->last_data_chunk_from->dest_state & SCTP_ADDR_REACHABLE) && 10491 (asoc->used_alt_onsack > asoc->numnets)) { 10492 /* We used an alt last time, don't this time */ 10493 a_chk->whoTo = NULL; 10494 } else { 10495 asoc->used_alt_onsack++; 10496 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0); 10497 } 10498 if (a_chk->whoTo == NULL) { 10499 /* Nope, no alternate */ 10500 a_chk->whoTo = asoc->last_data_chunk_from; 10501 asoc->used_alt_onsack = 0; 10502 } 10503 } else { 10504 /* 10505 * No duplicates so we use the last place we received data 10506 * from. 10507 */ 10508 asoc->used_alt_onsack = 0; 10509 a_chk->whoTo = asoc->last_data_chunk_from; 10510 } 10511 if (a_chk->whoTo) { 10512 atomic_add_int(&a_chk->whoTo->ref_count, 1); 10513 } 10514 if (SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->highest_tsn_inside_nr_map)) { 10515 highest_tsn = asoc->highest_tsn_inside_map; 10516 } else { 10517 highest_tsn = asoc->highest_tsn_inside_nr_map; 10518 } 10519 if (highest_tsn == asoc->cumulative_tsn) { 10520 /* no gaps */ 10521 if (type == SCTP_SELECTIVE_ACK) { 10522 space_req = sizeof(struct sctp_sack_chunk); 10523 } else { 10524 space_req = sizeof(struct sctp_nr_sack_chunk); 10525 } 10526 } else { 10527 /* gaps get a cluster */ 10528 space_req = MCLBYTES; 10529 } 10530 /* Ok now lets formulate a MBUF with our sack */ 10531 a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_NOWAIT, 1, MT_DATA); 10532 if ((a_chk->data == NULL) || 10533 (a_chk->whoTo == NULL)) { 10534 /* rats, no mbuf memory */ 10535 if (a_chk->data) { 10536 /* was a problem with the destination */ 10537 sctp_m_freem(a_chk->data); 10538 a_chk->data = NULL; 10539 } 10540 sctp_free_a_chunk(stcb, a_chk, so_locked); 10541 /* sa_ignore NO_NULL_CHK */ 10542 if (stcb->asoc.delayed_ack) { 10543 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10544 stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_6); 10545 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10546 stcb->sctp_ep, stcb, NULL); 10547 } else { 10548 stcb->asoc.send_sack = 1; 10549 } 10550 return; 10551 } 10552 /* ok, lets go through and fill it in */ 10553 SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD); 10554 space = M_TRAILINGSPACE(a_chk->data); 10555 if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) { 10556 space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD); 10557 } 10558 limit = mtod(a_chk->data, caddr_t); 10559 limit += space; 10560 10561 flags = 0; 10562 10563 if ((asoc->sctp_cmt_on_off > 0) && 10564 SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) { 10565 /*- 10566 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been 10567 * received, then set high bit to 1, else 0. Reset 10568 * pkts_rcvd. 10569 */ 10570 flags |= (asoc->cmt_dac_pkts_rcvd << 6); 10571 asoc->cmt_dac_pkts_rcvd = 0; 10572 } 10573#ifdef SCTP_ASOCLOG_OF_TSNS 10574 stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn; 10575 stcb->asoc.cumack_log_atsnt++; 10576 if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) { 10577 stcb->asoc.cumack_log_atsnt = 0; 10578 } 10579#endif 10580 /* reset the readers interpretation */ 10581 stcb->freed_by_sorcv_sincelast = 0; 10582 10583 if (type == SCTP_SELECTIVE_ACK) { 10584 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 10585 nr_sack = NULL; 10586 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk)); 10587 if (highest_tsn > asoc->mapping_array_base_tsn) { 10588 siz = (((highest_tsn - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10589 } else { 10590 siz = (((MAX_TSN - highest_tsn) + 1) + highest_tsn + 7) / 8; 10591 } 10592 } else { 10593 sack = NULL; 10594 nr_sack = mtod(a_chk->data, struct sctp_nr_sack_chunk *); 10595 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)nr_sack + sizeof(struct sctp_nr_sack_chunk)); 10596 if (asoc->highest_tsn_inside_map > asoc->mapping_array_base_tsn) { 10597 siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10598 } else { 10599 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_map + 7) / 8; 10600 } 10601 } 10602 10603 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10604 offset = 1; 10605 } else { 10606 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10607 } 10608 if (((type == SCTP_SELECTIVE_ACK) && 10609 SCTP_TSN_GT(highest_tsn, asoc->cumulative_tsn)) || 10610 ((type == SCTP_NR_SELECTIVE_ACK) && 10611 SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->cumulative_tsn))) { 10612 /* we have a gap .. maybe */ 10613 for (i = 0; i < siz; i++) { 10614 tsn_map = asoc->mapping_array[i]; 10615 if (type == SCTP_SELECTIVE_ACK) { 10616 tsn_map |= asoc->nr_mapping_array[i]; 10617 } 10618 if (i == 0) { 10619 /* 10620 * Clear all bits corresponding to TSNs 10621 * smaller or equal to the cumulative TSN. 10622 */ 10623 tsn_map &= (~0 << (1 - offset)); 10624 } 10625 selector = &sack_array[tsn_map]; 10626 if (mergeable && selector->right_edge) { 10627 /* 10628 * Backup, left and right edges were ok to 10629 * merge. 10630 */ 10631 num_gap_blocks--; 10632 gap_descriptor--; 10633 } 10634 if (selector->num_entries == 0) 10635 mergeable = 0; 10636 else { 10637 for (j = 0; j < selector->num_entries; j++) { 10638 if (mergeable && selector->right_edge) { 10639 /* 10640 * do a merge by NOT setting 10641 * the left side 10642 */ 10643 mergeable = 0; 10644 } else { 10645 /* 10646 * no merge, set the left 10647 * side 10648 */ 10649 mergeable = 0; 10650 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10651 } 10652 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10653 num_gap_blocks++; 10654 gap_descriptor++; 10655 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10656 /* no more room */ 10657 limit_reached = 1; 10658 break; 10659 } 10660 } 10661 if (selector->left_edge) { 10662 mergeable = 1; 10663 } 10664 } 10665 if (limit_reached) { 10666 /* Reached the limit stop */ 10667 break; 10668 } 10669 offset += 8; 10670 } 10671 } 10672 if ((type == SCTP_NR_SELECTIVE_ACK) && 10673 (limit_reached == 0)) { 10674 10675 mergeable = 0; 10676 10677 if (asoc->highest_tsn_inside_nr_map > asoc->mapping_array_base_tsn) { 10678 siz = (((asoc->highest_tsn_inside_nr_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10679 } else { 10680 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_nr_map + 7) / 8; 10681 } 10682 10683 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10684 offset = 1; 10685 } else { 10686 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10687 } 10688 if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->cumulative_tsn)) { 10689 /* we have a gap .. maybe */ 10690 for (i = 0; i < siz; i++) { 10691 tsn_map = asoc->nr_mapping_array[i]; 10692 if (i == 0) { 10693 /* 10694 * Clear all bits corresponding to 10695 * TSNs smaller or equal to the 10696 * cumulative TSN. 10697 */ 10698 tsn_map &= (~0 << (1 - offset)); 10699 } 10700 selector = &sack_array[tsn_map]; 10701 if (mergeable && selector->right_edge) { 10702 /* 10703 * Backup, left and right edges were 10704 * ok to merge. 10705 */ 10706 num_nr_gap_blocks--; 10707 gap_descriptor--; 10708 } 10709 if (selector->num_entries == 0) 10710 mergeable = 0; 10711 else { 10712 for (j = 0; j < selector->num_entries; j++) { 10713 if (mergeable && selector->right_edge) { 10714 /* 10715 * do a merge by NOT 10716 * setting the left 10717 * side 10718 */ 10719 mergeable = 0; 10720 } else { 10721 /* 10722 * no merge, set the 10723 * left side 10724 */ 10725 mergeable = 0; 10726 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10727 } 10728 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10729 num_nr_gap_blocks++; 10730 gap_descriptor++; 10731 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10732 /* no more room */ 10733 limit_reached = 1; 10734 break; 10735 } 10736 } 10737 if (selector->left_edge) { 10738 mergeable = 1; 10739 } 10740 } 10741 if (limit_reached) { 10742 /* Reached the limit stop */ 10743 break; 10744 } 10745 offset += 8; 10746 } 10747 } 10748 } 10749 /* now we must add any dups we are going to report. */ 10750 if ((limit_reached == 0) && (asoc->numduptsns)) { 10751 dup = (uint32_t *) gap_descriptor; 10752 for (i = 0; i < asoc->numduptsns; i++) { 10753 *dup = htonl(asoc->dup_tsns[i]); 10754 dup++; 10755 num_dups++; 10756 if (((caddr_t)dup + sizeof(uint32_t)) > limit) { 10757 /* no more room */ 10758 break; 10759 } 10760 } 10761 asoc->numduptsns = 0; 10762 } 10763 /* 10764 * now that the chunk is prepared queue it to the control chunk 10765 * queue. 10766 */ 10767 if (type == SCTP_SELECTIVE_ACK) { 10768 a_chk->send_size = sizeof(struct sctp_sack_chunk) + 10769 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10770 num_dups * sizeof(int32_t); 10771 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10772 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10773 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 10774 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 10775 sack->sack.num_dup_tsns = htons(num_dups); 10776 sack->ch.chunk_type = type; 10777 sack->ch.chunk_flags = flags; 10778 sack->ch.chunk_length = htons(a_chk->send_size); 10779 } else { 10780 a_chk->send_size = sizeof(struct sctp_nr_sack_chunk) + 10781 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10782 num_dups * sizeof(int32_t); 10783 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10784 nr_sack->nr_sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10785 nr_sack->nr_sack.a_rwnd = htonl(asoc->my_rwnd); 10786 nr_sack->nr_sack.num_gap_ack_blks = htons(num_gap_blocks); 10787 nr_sack->nr_sack.num_nr_gap_ack_blks = htons(num_nr_gap_blocks); 10788 nr_sack->nr_sack.num_dup_tsns = htons(num_dups); 10789 nr_sack->nr_sack.reserved = 0; 10790 nr_sack->ch.chunk_type = type; 10791 nr_sack->ch.chunk_flags = flags; 10792 nr_sack->ch.chunk_length = htons(a_chk->send_size); 10793 } 10794 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 10795 asoc->my_last_reported_rwnd = asoc->my_rwnd; 10796 asoc->ctrl_queue_cnt++; 10797 asoc->send_sack = 0; 10798 SCTP_STAT_INCR(sctps_sendsacks); 10799 return; 10800} 10801 10802void 10803sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr, int so_locked 10804#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10805 SCTP_UNUSED 10806#endif 10807) 10808{ 10809 struct mbuf *m_abort, *m, *m_last; 10810 struct mbuf *m_out, *m_end = NULL; 10811 struct sctp_abort_chunk *abort; 10812 struct sctp_auth_chunk *auth = NULL; 10813 struct sctp_nets *net; 10814 uint32_t vtag; 10815 uint32_t auth_offset = 0; 10816 uint16_t cause_len, chunk_len, padding_len; 10817 10818 SCTP_TCB_LOCK_ASSERT(stcb); 10819 /*- 10820 * Add an AUTH chunk, if chunk requires it and save the offset into 10821 * the chain for AUTH 10822 */ 10823 if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION, 10824 stcb->asoc.peer_auth_chunks)) { 10825 m_out = sctp_add_auth_chunk(NULL, &m_end, &auth, &auth_offset, 10826 stcb, SCTP_ABORT_ASSOCIATION); 10827 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10828 } else { 10829 m_out = NULL; 10830 } 10831 m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_NOWAIT, 1, MT_HEADER); 10832 if (m_abort == NULL) { 10833 if (m_out) { 10834 sctp_m_freem(m_out); 10835 } 10836 if (operr) { 10837 sctp_m_freem(operr); 10838 } 10839 return; 10840 } 10841 /* link in any error */ 10842 SCTP_BUF_NEXT(m_abort) = operr; 10843 cause_len = 0; 10844 m_last = NULL; 10845 for (m = operr; m; m = SCTP_BUF_NEXT(m)) { 10846 cause_len += (uint16_t) SCTP_BUF_LEN(m); 10847 if (SCTP_BUF_NEXT(m) == NULL) { 10848 m_last = m; 10849 } 10850 } 10851 SCTP_BUF_LEN(m_abort) = sizeof(struct sctp_abort_chunk); 10852 chunk_len = (uint16_t) sizeof(struct sctp_abort_chunk) + cause_len; 10853 padding_len = SCTP_SIZE32(chunk_len) - chunk_len; 10854 if (m_out == NULL) { 10855 /* NO Auth chunk prepended, so reserve space in front */ 10856 SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD); 10857 m_out = m_abort; 10858 } else { 10859 /* Put AUTH chunk at the front of the chain */ 10860 SCTP_BUF_NEXT(m_end) = m_abort; 10861 } 10862 if (stcb->asoc.alternate) { 10863 net = stcb->asoc.alternate; 10864 } else { 10865 net = stcb->asoc.primary_destination; 10866 } 10867 /* Fill in the ABORT chunk header. */ 10868 abort = mtod(m_abort, struct sctp_abort_chunk *); 10869 abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION; 10870 if (stcb->asoc.peer_vtag == 0) { 10871 /* This happens iff the assoc is in COOKIE-WAIT state. */ 10872 vtag = stcb->asoc.my_vtag; 10873 abort->ch.chunk_flags = SCTP_HAD_NO_TCB; 10874 } else { 10875 vtag = stcb->asoc.peer_vtag; 10876 abort->ch.chunk_flags = 0; 10877 } 10878 abort->ch.chunk_length = htons(chunk_len); 10879 /* Add padding, if necessary. */ 10880 if (padding_len > 0) { 10881 if ((m_last == NULL) || 10882 (sctp_add_pad_tombuf(m_last, padding_len) == NULL)) { 10883 sctp_m_freem(m_out); 10884 return; 10885 } 10886 } 10887 (void)sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10888 (struct sockaddr *)&net->ro._l_addr, 10889 m_out, auth_offset, auth, stcb->asoc.authinfo.active_keyid, 1, 0, 0, 10890 stcb->sctp_ep->sctp_lport, stcb->rport, htonl(vtag), 10891 stcb->asoc.primary_destination->port, NULL, 10892 0, 0, 10893 so_locked); 10894 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10895} 10896 10897void 10898sctp_send_shutdown_complete(struct sctp_tcb *stcb, 10899 struct sctp_nets *net, 10900 int reflect_vtag) 10901{ 10902 /* formulate and SEND a SHUTDOWN-COMPLETE */ 10903 struct mbuf *m_shutdown_comp; 10904 struct sctp_shutdown_complete_chunk *shutdown_complete; 10905 uint32_t vtag; 10906 uint8_t flags; 10907 10908 m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 10909 if (m_shutdown_comp == NULL) { 10910 /* no mbuf's */ 10911 return; 10912 } 10913 if (reflect_vtag) { 10914 flags = SCTP_HAD_NO_TCB; 10915 vtag = stcb->asoc.my_vtag; 10916 } else { 10917 flags = 0; 10918 vtag = stcb->asoc.peer_vtag; 10919 } 10920 shutdown_complete = mtod(m_shutdown_comp, struct sctp_shutdown_complete_chunk *); 10921 shutdown_complete->ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 10922 shutdown_complete->ch.chunk_flags = flags; 10923 shutdown_complete->ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 10924 SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_chunk); 10925 (void)sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10926 (struct sockaddr *)&net->ro._l_addr, 10927 m_shutdown_comp, 0, NULL, 0, 1, 0, 0, 10928 stcb->sctp_ep->sctp_lport, stcb->rport, 10929 htonl(vtag), 10930 net->port, NULL, 10931 0, 0, 10932 SCTP_SO_NOT_LOCKED); 10933 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10934 return; 10935} 10936 10937static void 10938sctp_send_resp_msg(struct sockaddr *src, struct sockaddr *dst, 10939 struct sctphdr *sh, uint32_t vtag, 10940 uint8_t type, struct mbuf *cause, 10941 uint8_t mflowtype, uint32_t mflowid, 10942 uint32_t vrf_id, uint16_t port) 10943{ 10944 struct mbuf *o_pak; 10945 struct mbuf *mout; 10946 struct sctphdr *shout; 10947 struct sctp_chunkhdr *ch; 10948 10949#if defined(INET) || defined(INET6) 10950 struct udphdr *udp; 10951 int ret; 10952 10953#endif 10954 int len, cause_len, padding_len; 10955 10956#ifdef INET 10957 struct sockaddr_in *src_sin, *dst_sin; 10958 struct ip *ip; 10959 10960#endif 10961#ifdef INET6 10962 struct sockaddr_in6 *src_sin6, *dst_sin6; 10963 struct ip6_hdr *ip6; 10964 10965#endif 10966 10967 /* Compute the length of the cause and add final padding. */ 10968 cause_len = 0; 10969 if (cause != NULL) { 10970 struct mbuf *m_at, *m_last = NULL; 10971 10972 for (m_at = cause; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 10973 if (SCTP_BUF_NEXT(m_at) == NULL) 10974 m_last = m_at; 10975 cause_len += SCTP_BUF_LEN(m_at); 10976 } 10977 padding_len = cause_len % 4; 10978 if (padding_len != 0) { 10979 padding_len = 4 - padding_len; 10980 } 10981 if (padding_len != 0) { 10982 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 10983 sctp_m_freem(cause); 10984 return; 10985 } 10986 } 10987 } else { 10988 padding_len = 0; 10989 } 10990 /* Get an mbuf for the header. */ 10991 len = sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 10992 switch (dst->sa_family) { 10993#ifdef INET 10994 case AF_INET: 10995 len += sizeof(struct ip); 10996 break; 10997#endif 10998#ifdef INET6 10999 case AF_INET6: 11000 len += sizeof(struct ip6_hdr); 11001 break; 11002#endif 11003 default: 11004 break; 11005 } 11006#if defined(INET) || defined(INET6) 11007 if (port) { 11008 len += sizeof(struct udphdr); 11009 } 11010#endif 11011 mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_NOWAIT, 1, MT_DATA); 11012 if (mout == NULL) { 11013 if (cause) { 11014 sctp_m_freem(cause); 11015 } 11016 return; 11017 } 11018 SCTP_BUF_RESV_UF(mout, max_linkhdr); 11019 SCTP_BUF_LEN(mout) = len; 11020 SCTP_BUF_NEXT(mout) = cause; 11021 mout->m_pkthdr.flowid = mflowid; 11022 M_HASHTYPE_SET(mout, mflowtype); 11023#ifdef INET 11024 ip = NULL; 11025#endif 11026#ifdef INET6 11027 ip6 = NULL; 11028#endif 11029 switch (dst->sa_family) { 11030#ifdef INET 11031 case AF_INET: 11032 src_sin = (struct sockaddr_in *)src; 11033 dst_sin = (struct sockaddr_in *)dst; 11034 ip = mtod(mout, struct ip *); 11035 ip->ip_v = IPVERSION; 11036 ip->ip_hl = (sizeof(struct ip) >> 2); 11037 ip->ip_tos = 0; 11038 ip->ip_id = ip_newid(); 11039 ip->ip_off = 0; 11040 ip->ip_ttl = MODULE_GLOBAL(ip_defttl); 11041 if (port) { 11042 ip->ip_p = IPPROTO_UDP; 11043 } else { 11044 ip->ip_p = IPPROTO_SCTP; 11045 } 11046 ip->ip_src.s_addr = dst_sin->sin_addr.s_addr; 11047 ip->ip_dst.s_addr = src_sin->sin_addr.s_addr; 11048 ip->ip_sum = 0; 11049 len = sizeof(struct ip); 11050 shout = (struct sctphdr *)((caddr_t)ip + len); 11051 break; 11052#endif 11053#ifdef INET6 11054 case AF_INET6: 11055 src_sin6 = (struct sockaddr_in6 *)src; 11056 dst_sin6 = (struct sockaddr_in6 *)dst; 11057 ip6 = mtod(mout, struct ip6_hdr *); 11058 ip6->ip6_flow = htonl(0x60000000); 11059 if (V_ip6_auto_flowlabel) { 11060 ip6->ip6_flow |= (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK); 11061 } 11062 ip6->ip6_hlim = MODULE_GLOBAL(ip6_defhlim); 11063 if (port) { 11064 ip6->ip6_nxt = IPPROTO_UDP; 11065 } else { 11066 ip6->ip6_nxt = IPPROTO_SCTP; 11067 } 11068 ip6->ip6_src = dst_sin6->sin6_addr; 11069 ip6->ip6_dst = src_sin6->sin6_addr; 11070 len = sizeof(struct ip6_hdr); 11071 shout = (struct sctphdr *)((caddr_t)ip6 + len); 11072 break; 11073#endif 11074 default: 11075 len = 0; 11076 shout = mtod(mout, struct sctphdr *); 11077 break; 11078 } 11079#if defined(INET) || defined(INET6) 11080 if (port) { 11081 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 11082 sctp_m_freem(mout); 11083 return; 11084 } 11085 udp = (struct udphdr *)shout; 11086 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 11087 udp->uh_dport = port; 11088 udp->uh_sum = 0; 11089 udp->uh_ulen = htons(sizeof(struct udphdr) + 11090 sizeof(struct sctphdr) + 11091 sizeof(struct sctp_chunkhdr) + 11092 cause_len + padding_len); 11093 len += sizeof(struct udphdr); 11094 shout = (struct sctphdr *)((caddr_t)shout + sizeof(struct udphdr)); 11095 } else { 11096 udp = NULL; 11097 } 11098#endif 11099 shout->src_port = sh->dest_port; 11100 shout->dest_port = sh->src_port; 11101 shout->checksum = 0; 11102 if (vtag) { 11103 shout->v_tag = htonl(vtag); 11104 } else { 11105 shout->v_tag = sh->v_tag; 11106 } 11107 len += sizeof(struct sctphdr); 11108 ch = (struct sctp_chunkhdr *)((caddr_t)shout + sizeof(struct sctphdr)); 11109 ch->chunk_type = type; 11110 if (vtag) { 11111 ch->chunk_flags = 0; 11112 } else { 11113 ch->chunk_flags = SCTP_HAD_NO_TCB; 11114 } 11115 ch->chunk_length = htons(sizeof(struct sctp_chunkhdr) + cause_len); 11116 len += sizeof(struct sctp_chunkhdr); 11117 len += cause_len + padding_len; 11118 11119 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 11120 sctp_m_freem(mout); 11121 return; 11122 } 11123 SCTP_ATTACH_CHAIN(o_pak, mout, len); 11124 switch (dst->sa_family) { 11125#ifdef INET 11126 case AF_INET: 11127 if (port) { 11128 if (V_udp_cksum) { 11129 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 11130 } else { 11131 udp->uh_sum = 0; 11132 } 11133 } 11134 ip->ip_len = htons(len); 11135 if (port) { 11136#if defined(SCTP_WITH_NO_CSUM) 11137 SCTP_STAT_INCR(sctps_sendnocrc); 11138#else 11139 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip) + sizeof(struct udphdr)); 11140 SCTP_STAT_INCR(sctps_sendswcrc); 11141#endif 11142 if (V_udp_cksum) { 11143 SCTP_ENABLE_UDP_CSUM(o_pak); 11144 } 11145 } else { 11146#if defined(SCTP_WITH_NO_CSUM) 11147 SCTP_STAT_INCR(sctps_sendnocrc); 11148#else 11149 mout->m_pkthdr.csum_flags = CSUM_SCTP; 11150 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11151 SCTP_STAT_INCR(sctps_sendhwcrc); 11152#endif 11153 } 11154#ifdef SCTP_PACKET_LOGGING 11155 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11156 sctp_packet_log(o_pak); 11157 } 11158#endif 11159 SCTP_IP_OUTPUT(ret, o_pak, NULL, NULL, vrf_id); 11160 break; 11161#endif 11162#ifdef INET6 11163 case AF_INET6: 11164 ip6->ip6_plen = len - sizeof(struct ip6_hdr); 11165 if (port) { 11166#if defined(SCTP_WITH_NO_CSUM) 11167 SCTP_STAT_INCR(sctps_sendnocrc); 11168#else 11169 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 11170 SCTP_STAT_INCR(sctps_sendswcrc); 11171#endif 11172 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), len - sizeof(struct ip6_hdr))) == 0) { 11173 udp->uh_sum = 0xffff; 11174 } 11175 } else { 11176#if defined(SCTP_WITH_NO_CSUM) 11177 SCTP_STAT_INCR(sctps_sendnocrc); 11178#else 11179 mout->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 11180 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11181 SCTP_STAT_INCR(sctps_sendhwcrc); 11182#endif 11183 } 11184#ifdef SCTP_PACKET_LOGGING 11185 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11186 sctp_packet_log(o_pak); 11187 } 11188#endif 11189 SCTP_IP6_OUTPUT(ret, o_pak, NULL, NULL, NULL, vrf_id); 11190 break; 11191#endif 11192 default: 11193 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 11194 dst->sa_family); 11195 sctp_m_freem(mout); 11196 SCTP_LTRACE_ERR_RET_PKT(mout, NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 11197 return; 11198 } 11199 SCTP_STAT_INCR(sctps_sendpackets); 11200 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 11201 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11202 return; 11203} 11204 11205void 11206sctp_send_shutdown_complete2(struct sockaddr *src, struct sockaddr *dst, 11207 struct sctphdr *sh, 11208 uint8_t mflowtype, uint32_t mflowid, 11209 uint32_t vrf_id, uint16_t port) 11210{ 11211 sctp_send_resp_msg(src, dst, sh, 0, SCTP_SHUTDOWN_COMPLETE, NULL, 11212 mflowtype, mflowid, 11213 vrf_id, port); 11214} 11215 11216void 11217sctp_send_hb(struct sctp_tcb *stcb, struct sctp_nets *net, int so_locked 11218#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 11219 SCTP_UNUSED 11220#endif 11221) 11222{ 11223 struct sctp_tmit_chunk *chk; 11224 struct sctp_heartbeat_chunk *hb; 11225 struct timeval now; 11226 11227 SCTP_TCB_LOCK_ASSERT(stcb); 11228 if (net == NULL) { 11229 return; 11230 } 11231 (void)SCTP_GETTIME_TIMEVAL(&now); 11232 switch (net->ro._l_addr.sa.sa_family) { 11233#ifdef INET 11234 case AF_INET: 11235 break; 11236#endif 11237#ifdef INET6 11238 case AF_INET6: 11239 break; 11240#endif 11241 default: 11242 return; 11243 } 11244 sctp_alloc_a_chunk(stcb, chk); 11245 if (chk == NULL) { 11246 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak, can't get a chunk for hb\n"); 11247 return; 11248 } 11249 chk->copy_by_ref = 0; 11250 chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST; 11251 chk->rec.chunk_id.can_take_data = 1; 11252 chk->flags = 0; 11253 chk->asoc = &stcb->asoc; 11254 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 11255 11256 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11257 if (chk->data == NULL) { 11258 sctp_free_a_chunk(stcb, chk, so_locked); 11259 return; 11260 } 11261 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11262 SCTP_BUF_LEN(chk->data) = chk->send_size; 11263 chk->sent = SCTP_DATAGRAM_UNSENT; 11264 chk->snd_count = 0; 11265 chk->whoTo = net; 11266 atomic_add_int(&chk->whoTo->ref_count, 1); 11267 /* Now we have a mbuf that we can fill in with the details */ 11268 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 11269 memset(hb, 0, sizeof(struct sctp_heartbeat_chunk)); 11270 /* fill out chunk header */ 11271 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 11272 hb->ch.chunk_flags = 0; 11273 hb->ch.chunk_length = htons(chk->send_size); 11274 /* Fill out hb parameter */ 11275 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 11276 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 11277 hb->heartbeat.hb_info.time_value_1 = now.tv_sec; 11278 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 11279 /* Did our user request this one, put it in */ 11280 hb->heartbeat.hb_info.addr_family = (uint8_t) net->ro._l_addr.sa.sa_family; 11281 hb->heartbeat.hb_info.addr_len = net->ro._l_addr.sa.sa_len; 11282 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 11283 /* 11284 * we only take from the entropy pool if the address is not 11285 * confirmed. 11286 */ 11287 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11288 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11289 } else { 11290 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 11291 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 11292 } 11293 switch (net->ro._l_addr.sa.sa_family) { 11294#ifdef INET 11295 case AF_INET: 11296 memcpy(hb->heartbeat.hb_info.address, 11297 &net->ro._l_addr.sin.sin_addr, 11298 sizeof(net->ro._l_addr.sin.sin_addr)); 11299 break; 11300#endif 11301#ifdef INET6 11302 case AF_INET6: 11303 memcpy(hb->heartbeat.hb_info.address, 11304 &net->ro._l_addr.sin6.sin6_addr, 11305 sizeof(net->ro._l_addr.sin6.sin6_addr)); 11306 break; 11307#endif 11308 default: 11309 return; 11310 break; 11311 } 11312 net->hb_responded = 0; 11313 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11314 stcb->asoc.ctrl_queue_cnt++; 11315 SCTP_STAT_INCR(sctps_sendheartbeat); 11316 return; 11317} 11318 11319void 11320sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 11321 uint32_t high_tsn) 11322{ 11323 struct sctp_association *asoc; 11324 struct sctp_ecne_chunk *ecne; 11325 struct sctp_tmit_chunk *chk; 11326 11327 if (net == NULL) { 11328 return; 11329 } 11330 asoc = &stcb->asoc; 11331 SCTP_TCB_LOCK_ASSERT(stcb); 11332 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11333 if ((chk->rec.chunk_id.id == SCTP_ECN_ECHO) && (net == chk->whoTo)) { 11334 /* found a previous ECN_ECHO update it if needed */ 11335 uint32_t cnt, ctsn; 11336 11337 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11338 ctsn = ntohl(ecne->tsn); 11339 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11340 ecne->tsn = htonl(high_tsn); 11341 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11342 } 11343 cnt = ntohl(ecne->num_pkts_since_cwr); 11344 cnt++; 11345 ecne->num_pkts_since_cwr = htonl(cnt); 11346 return; 11347 } 11348 } 11349 /* nope could not find one to update so we must build one */ 11350 sctp_alloc_a_chunk(stcb, chk); 11351 if (chk == NULL) { 11352 return; 11353 } 11354 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11355 chk->copy_by_ref = 0; 11356 chk->rec.chunk_id.id = SCTP_ECN_ECHO; 11357 chk->rec.chunk_id.can_take_data = 0; 11358 chk->flags = 0; 11359 chk->asoc = &stcb->asoc; 11360 chk->send_size = sizeof(struct sctp_ecne_chunk); 11361 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11362 if (chk->data == NULL) { 11363 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11364 return; 11365 } 11366 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11367 SCTP_BUF_LEN(chk->data) = chk->send_size; 11368 chk->sent = SCTP_DATAGRAM_UNSENT; 11369 chk->snd_count = 0; 11370 chk->whoTo = net; 11371 atomic_add_int(&chk->whoTo->ref_count, 1); 11372 11373 stcb->asoc.ecn_echo_cnt_onq++; 11374 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11375 ecne->ch.chunk_type = SCTP_ECN_ECHO; 11376 ecne->ch.chunk_flags = 0; 11377 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 11378 ecne->tsn = htonl(high_tsn); 11379 ecne->num_pkts_since_cwr = htonl(1); 11380 TAILQ_INSERT_HEAD(&stcb->asoc.control_send_queue, chk, sctp_next); 11381 asoc->ctrl_queue_cnt++; 11382} 11383 11384void 11385sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 11386 struct mbuf *m, int len, int iphlen, int bad_crc) 11387{ 11388 struct sctp_association *asoc; 11389 struct sctp_pktdrop_chunk *drp; 11390 struct sctp_tmit_chunk *chk; 11391 uint8_t *datap; 11392 int was_trunc = 0; 11393 int fullsz = 0; 11394 long spc; 11395 int offset; 11396 struct sctp_chunkhdr *ch, chunk_buf; 11397 unsigned int chk_length; 11398 11399 if (!stcb) { 11400 return; 11401 } 11402 asoc = &stcb->asoc; 11403 SCTP_TCB_LOCK_ASSERT(stcb); 11404 if (asoc->pktdrop_supported == 0) { 11405 /*- 11406 * peer must declare support before I send one. 11407 */ 11408 return; 11409 } 11410 if (stcb->sctp_socket == NULL) { 11411 return; 11412 } 11413 sctp_alloc_a_chunk(stcb, chk); 11414 if (chk == NULL) { 11415 return; 11416 } 11417 chk->copy_by_ref = 0; 11418 chk->rec.chunk_id.id = SCTP_PACKET_DROPPED; 11419 chk->rec.chunk_id.can_take_data = 1; 11420 chk->flags = 0; 11421 len -= iphlen; 11422 chk->send_size = len; 11423 /* Validate that we do not have an ABORT in here. */ 11424 offset = iphlen + sizeof(struct sctphdr); 11425 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11426 sizeof(*ch), (uint8_t *) & chunk_buf); 11427 while (ch != NULL) { 11428 chk_length = ntohs(ch->chunk_length); 11429 if (chk_length < sizeof(*ch)) { 11430 /* break to abort land */ 11431 break; 11432 } 11433 switch (ch->chunk_type) { 11434 case SCTP_PACKET_DROPPED: 11435 case SCTP_ABORT_ASSOCIATION: 11436 case SCTP_INITIATION_ACK: 11437 /** 11438 * We don't respond with an PKT-DROP to an ABORT 11439 * or PKT-DROP. We also do not respond to an 11440 * INIT-ACK, because we can't know if the initiation 11441 * tag is correct or not. 11442 */ 11443 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11444 return; 11445 default: 11446 break; 11447 } 11448 offset += SCTP_SIZE32(chk_length); 11449 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11450 sizeof(*ch), (uint8_t *) & chunk_buf); 11451 } 11452 11453 if ((len + SCTP_MAX_OVERHEAD + sizeof(struct sctp_pktdrop_chunk)) > 11454 min(stcb->asoc.smallest_mtu, MCLBYTES)) { 11455 /* 11456 * only send 1 mtu worth, trim off the excess on the end. 11457 */ 11458 fullsz = len; 11459 len = min(stcb->asoc.smallest_mtu, MCLBYTES) - SCTP_MAX_OVERHEAD; 11460 was_trunc = 1; 11461 } 11462 chk->asoc = &stcb->asoc; 11463 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11464 if (chk->data == NULL) { 11465jump_out: 11466 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11467 return; 11468 } 11469 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11470 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 11471 if (drp == NULL) { 11472 sctp_m_freem(chk->data); 11473 chk->data = NULL; 11474 goto jump_out; 11475 } 11476 chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 11477 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD)); 11478 chk->book_size_scale = 0; 11479 if (was_trunc) { 11480 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 11481 drp->trunc_len = htons(fullsz); 11482 /* 11483 * Len is already adjusted to size minus overhead above take 11484 * out the pkt_drop chunk itself from it. 11485 */ 11486 chk->send_size = len - sizeof(struct sctp_pktdrop_chunk); 11487 len = chk->send_size; 11488 } else { 11489 /* no truncation needed */ 11490 drp->ch.chunk_flags = 0; 11491 drp->trunc_len = htons(0); 11492 } 11493 if (bad_crc) { 11494 drp->ch.chunk_flags |= SCTP_BADCRC; 11495 } 11496 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 11497 SCTP_BUF_LEN(chk->data) = chk->send_size; 11498 chk->sent = SCTP_DATAGRAM_UNSENT; 11499 chk->snd_count = 0; 11500 if (net) { 11501 /* we should hit here */ 11502 chk->whoTo = net; 11503 atomic_add_int(&chk->whoTo->ref_count, 1); 11504 } else { 11505 chk->whoTo = NULL; 11506 } 11507 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 11508 drp->ch.chunk_length = htons(chk->send_size); 11509 spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket); 11510 if (spc < 0) { 11511 spc = 0; 11512 } 11513 drp->bottle_bw = htonl(spc); 11514 if (asoc->my_rwnd) { 11515 drp->current_onq = htonl(asoc->size_on_reasm_queue + 11516 asoc->size_on_all_streams + 11517 asoc->my_rwnd_control_len + 11518 stcb->sctp_socket->so_rcv.sb_cc); 11519 } else { 11520 /*- 11521 * If my rwnd is 0, possibly from mbuf depletion as well as 11522 * space used, tell the peer there is NO space aka onq == bw 11523 */ 11524 drp->current_onq = htonl(spc); 11525 } 11526 drp->reserved = 0; 11527 datap = drp->data; 11528 m_copydata(m, iphlen, len, (caddr_t)datap); 11529 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11530 asoc->ctrl_queue_cnt++; 11531} 11532 11533void 11534sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn, uint8_t override) 11535{ 11536 struct sctp_association *asoc; 11537 struct sctp_cwr_chunk *cwr; 11538 struct sctp_tmit_chunk *chk; 11539 11540 SCTP_TCB_LOCK_ASSERT(stcb); 11541 if (net == NULL) { 11542 return; 11543 } 11544 asoc = &stcb->asoc; 11545 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11546 if ((chk->rec.chunk_id.id == SCTP_ECN_CWR) && (net == chk->whoTo)) { 11547 /* 11548 * found a previous CWR queued to same destination 11549 * update it if needed 11550 */ 11551 uint32_t ctsn; 11552 11553 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11554 ctsn = ntohl(cwr->tsn); 11555 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11556 cwr->tsn = htonl(high_tsn); 11557 } 11558 if (override & SCTP_CWR_REDUCE_OVERRIDE) { 11559 /* Make sure override is carried */ 11560 cwr->ch.chunk_flags |= SCTP_CWR_REDUCE_OVERRIDE; 11561 } 11562 return; 11563 } 11564 } 11565 sctp_alloc_a_chunk(stcb, chk); 11566 if (chk == NULL) { 11567 return; 11568 } 11569 chk->copy_by_ref = 0; 11570 chk->rec.chunk_id.id = SCTP_ECN_CWR; 11571 chk->rec.chunk_id.can_take_data = 1; 11572 chk->flags = 0; 11573 chk->asoc = &stcb->asoc; 11574 chk->send_size = sizeof(struct sctp_cwr_chunk); 11575 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11576 if (chk->data == NULL) { 11577 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11578 return; 11579 } 11580 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11581 SCTP_BUF_LEN(chk->data) = chk->send_size; 11582 chk->sent = SCTP_DATAGRAM_UNSENT; 11583 chk->snd_count = 0; 11584 chk->whoTo = net; 11585 atomic_add_int(&chk->whoTo->ref_count, 1); 11586 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11587 cwr->ch.chunk_type = SCTP_ECN_CWR; 11588 cwr->ch.chunk_flags = override; 11589 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 11590 cwr->tsn = htonl(high_tsn); 11591 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11592 asoc->ctrl_queue_cnt++; 11593} 11594 11595void 11596sctp_add_stream_reset_out(struct sctp_tmit_chunk *chk, 11597 int number_entries, uint16_t * list, 11598 uint32_t seq, uint32_t resp_seq, uint32_t last_sent) 11599{ 11600 uint16_t len, old_len, i; 11601 struct sctp_stream_reset_out_request *req_out; 11602 struct sctp_chunkhdr *ch; 11603 11604 ch = mtod(chk->data, struct sctp_chunkhdr *); 11605 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11606 11607 /* get to new offset for the param. */ 11608 req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len); 11609 /* now how long will this param be? */ 11610 len = (sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries)); 11611 req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST); 11612 req_out->ph.param_length = htons(len); 11613 req_out->request_seq = htonl(seq); 11614 req_out->response_seq = htonl(resp_seq); 11615 req_out->send_reset_at_tsn = htonl(last_sent); 11616 if (number_entries) { 11617 for (i = 0; i < number_entries; i++) { 11618 req_out->list_of_streams[i] = htons(list[i]); 11619 } 11620 } 11621 if (SCTP_SIZE32(len) > len) { 11622 /*- 11623 * Need to worry about the pad we may end up adding to the 11624 * end. This is easy since the struct is either aligned to 4 11625 * bytes or 2 bytes off. 11626 */ 11627 req_out->list_of_streams[number_entries] = 0; 11628 } 11629 /* now fix the chunk length */ 11630 ch->chunk_length = htons(len + old_len); 11631 chk->book_size = len + old_len; 11632 chk->book_size_scale = 0; 11633 chk->send_size = SCTP_SIZE32(chk->book_size); 11634 SCTP_BUF_LEN(chk->data) = chk->send_size; 11635 return; 11636} 11637 11638static void 11639sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk, 11640 int number_entries, uint16_t * list, 11641 uint32_t seq) 11642{ 11643 uint16_t len, old_len, i; 11644 struct sctp_stream_reset_in_request *req_in; 11645 struct sctp_chunkhdr *ch; 11646 11647 ch = mtod(chk->data, struct sctp_chunkhdr *); 11648 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11649 11650 /* get to new offset for the param. */ 11651 req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len); 11652 /* now how long will this param be? */ 11653 len = (sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries)); 11654 req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST); 11655 req_in->ph.param_length = htons(len); 11656 req_in->request_seq = htonl(seq); 11657 if (number_entries) { 11658 for (i = 0; i < number_entries; i++) { 11659 req_in->list_of_streams[i] = htons(list[i]); 11660 } 11661 } 11662 if (SCTP_SIZE32(len) > len) { 11663 /*- 11664 * Need to worry about the pad we may end up adding to the 11665 * end. This is easy since the struct is either aligned to 4 11666 * bytes or 2 bytes off. 11667 */ 11668 req_in->list_of_streams[number_entries] = 0; 11669 } 11670 /* now fix the chunk length */ 11671 ch->chunk_length = htons(len + old_len); 11672 chk->book_size = len + old_len; 11673 chk->book_size_scale = 0; 11674 chk->send_size = SCTP_SIZE32(chk->book_size); 11675 SCTP_BUF_LEN(chk->data) = chk->send_size; 11676 return; 11677} 11678 11679static void 11680sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk, 11681 uint32_t seq) 11682{ 11683 uint16_t len, old_len; 11684 struct sctp_stream_reset_tsn_request *req_tsn; 11685 struct sctp_chunkhdr *ch; 11686 11687 ch = mtod(chk->data, struct sctp_chunkhdr *); 11688 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11689 11690 /* get to new offset for the param. */ 11691 req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len); 11692 /* now how long will this param be? */ 11693 len = sizeof(struct sctp_stream_reset_tsn_request); 11694 req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST); 11695 req_tsn->ph.param_length = htons(len); 11696 req_tsn->request_seq = htonl(seq); 11697 11698 /* now fix the chunk length */ 11699 ch->chunk_length = htons(len + old_len); 11700 chk->send_size = len + old_len; 11701 chk->book_size = SCTP_SIZE32(chk->send_size); 11702 chk->book_size_scale = 0; 11703 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11704 return; 11705} 11706 11707void 11708sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk, 11709 uint32_t resp_seq, uint32_t result) 11710{ 11711 uint16_t len, old_len; 11712 struct sctp_stream_reset_response *resp; 11713 struct sctp_chunkhdr *ch; 11714 11715 ch = mtod(chk->data, struct sctp_chunkhdr *); 11716 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11717 11718 /* get to new offset for the param. */ 11719 resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len); 11720 /* now how long will this param be? */ 11721 len = sizeof(struct sctp_stream_reset_response); 11722 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11723 resp->ph.param_length = htons(len); 11724 resp->response_seq = htonl(resp_seq); 11725 resp->result = ntohl(result); 11726 11727 /* now fix the chunk length */ 11728 ch->chunk_length = htons(len + old_len); 11729 chk->book_size = len + old_len; 11730 chk->book_size_scale = 0; 11731 chk->send_size = SCTP_SIZE32(chk->book_size); 11732 SCTP_BUF_LEN(chk->data) = chk->send_size; 11733 return; 11734} 11735 11736void 11737sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk, 11738 uint32_t resp_seq, uint32_t result, 11739 uint32_t send_una, uint32_t recv_next) 11740{ 11741 uint16_t len, old_len; 11742 struct sctp_stream_reset_response_tsn *resp; 11743 struct sctp_chunkhdr *ch; 11744 11745 ch = mtod(chk->data, struct sctp_chunkhdr *); 11746 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11747 11748 /* get to new offset for the param. */ 11749 resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len); 11750 /* now how long will this param be? */ 11751 len = sizeof(struct sctp_stream_reset_response_tsn); 11752 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11753 resp->ph.param_length = htons(len); 11754 resp->response_seq = htonl(resp_seq); 11755 resp->result = htonl(result); 11756 resp->senders_next_tsn = htonl(send_una); 11757 resp->receivers_next_tsn = htonl(recv_next); 11758 11759 /* now fix the chunk length */ 11760 ch->chunk_length = htons(len + old_len); 11761 chk->book_size = len + old_len; 11762 chk->send_size = SCTP_SIZE32(chk->book_size); 11763 chk->book_size_scale = 0; 11764 SCTP_BUF_LEN(chk->data) = chk->send_size; 11765 return; 11766} 11767 11768static void 11769sctp_add_an_out_stream(struct sctp_tmit_chunk *chk, 11770 uint32_t seq, 11771 uint16_t adding) 11772{ 11773 uint16_t len, old_len; 11774 struct sctp_chunkhdr *ch; 11775 struct sctp_stream_reset_add_strm *addstr; 11776 11777 ch = mtod(chk->data, struct sctp_chunkhdr *); 11778 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11779 11780 /* get to new offset for the param. */ 11781 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11782 /* now how long will this param be? */ 11783 len = sizeof(struct sctp_stream_reset_add_strm); 11784 11785 /* Fill it out. */ 11786 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_OUT_STREAMS); 11787 addstr->ph.param_length = htons(len); 11788 addstr->request_seq = htonl(seq); 11789 addstr->number_of_streams = htons(adding); 11790 addstr->reserved = 0; 11791 11792 /* now fix the chunk length */ 11793 ch->chunk_length = htons(len + old_len); 11794 chk->send_size = len + old_len; 11795 chk->book_size = SCTP_SIZE32(chk->send_size); 11796 chk->book_size_scale = 0; 11797 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11798 return; 11799} 11800 11801static void 11802sctp_add_an_in_stream(struct sctp_tmit_chunk *chk, 11803 uint32_t seq, 11804 uint16_t adding) 11805{ 11806 uint16_t len, old_len; 11807 struct sctp_chunkhdr *ch; 11808 struct sctp_stream_reset_add_strm *addstr; 11809 11810 ch = mtod(chk->data, struct sctp_chunkhdr *); 11811 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11812 11813 /* get to new offset for the param. */ 11814 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11815 /* now how long will this param be? */ 11816 len = sizeof(struct sctp_stream_reset_add_strm); 11817 /* Fill it out. */ 11818 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_IN_STREAMS); 11819 addstr->ph.param_length = htons(len); 11820 addstr->request_seq = htonl(seq); 11821 addstr->number_of_streams = htons(adding); 11822 addstr->reserved = 0; 11823 11824 /* now fix the chunk length */ 11825 ch->chunk_length = htons(len + old_len); 11826 chk->send_size = len + old_len; 11827 chk->book_size = SCTP_SIZE32(chk->send_size); 11828 chk->book_size_scale = 0; 11829 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11830 return; 11831} 11832 11833int 11834sctp_send_str_reset_req(struct sctp_tcb *stcb, 11835 uint16_t number_entries, uint16_t * list, 11836 uint8_t send_out_req, 11837 uint8_t send_in_req, 11838 uint8_t send_tsn_req, 11839 uint8_t add_stream, 11840 uint16_t adding_o, 11841 uint16_t adding_i, uint8_t peer_asked) 11842{ 11843 11844 struct sctp_association *asoc; 11845 struct sctp_tmit_chunk *chk; 11846 struct sctp_chunkhdr *ch; 11847 uint32_t seq; 11848 11849 asoc = &stcb->asoc; 11850 if (asoc->stream_reset_outstanding) { 11851 /*- 11852 * Already one pending, must get ACK back to clear the flag. 11853 */ 11854 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EBUSY); 11855 return (EBUSY); 11856 } 11857 if ((send_out_req == 0) && (send_in_req == 0) && (send_tsn_req == 0) && 11858 (add_stream == 0)) { 11859 /* nothing to do */ 11860 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 11861 return (EINVAL); 11862 } 11863 if (send_tsn_req && (send_out_req || send_in_req)) { 11864 /* error, can't do that */ 11865 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 11866 return (EINVAL); 11867 } 11868 if (number_entries > (MCLBYTES - 11869 SCTP_MIN_OVERHEAD - 11870 sizeof(struct sctp_chunkhdr) - 11871 sizeof(struct sctp_stream_reset_out_request)) / 11872 sizeof(uint16_t)) { 11873 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11874 return (ENOMEM); 11875 } 11876 sctp_alloc_a_chunk(stcb, chk); 11877 if (chk == NULL) { 11878 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11879 return (ENOMEM); 11880 } 11881 chk->copy_by_ref = 0; 11882 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 11883 chk->rec.chunk_id.can_take_data = 0; 11884 chk->flags = 0; 11885 chk->asoc = &stcb->asoc; 11886 chk->book_size = sizeof(struct sctp_chunkhdr); 11887 chk->send_size = SCTP_SIZE32(chk->book_size); 11888 chk->book_size_scale = 0; 11889 11890 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11891 if (chk->data == NULL) { 11892 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 11893 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11894 return (ENOMEM); 11895 } 11896 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11897 11898 /* setup chunk parameters */ 11899 chk->sent = SCTP_DATAGRAM_UNSENT; 11900 chk->snd_count = 0; 11901 if (stcb->asoc.alternate) { 11902 chk->whoTo = stcb->asoc.alternate; 11903 } else { 11904 chk->whoTo = stcb->asoc.primary_destination; 11905 } 11906 atomic_add_int(&chk->whoTo->ref_count, 1); 11907 ch = mtod(chk->data, struct sctp_chunkhdr *); 11908 ch->chunk_type = SCTP_STREAM_RESET; 11909 ch->chunk_flags = 0; 11910 ch->chunk_length = htons(chk->book_size); 11911 SCTP_BUF_LEN(chk->data) = chk->send_size; 11912 11913 seq = stcb->asoc.str_reset_seq_out; 11914 if (send_out_req) { 11915 sctp_add_stream_reset_out(chk, number_entries, list, 11916 seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1)); 11917 asoc->stream_reset_out_is_outstanding = 1; 11918 seq++; 11919 asoc->stream_reset_outstanding++; 11920 } 11921 if ((add_stream & 1) && 11922 ((stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt) < adding_o)) { 11923 /* Need to allocate more */ 11924 struct sctp_stream_out *oldstream; 11925 struct sctp_stream_queue_pending *sp, *nsp; 11926 int i; 11927 11928#if defined(SCTP_DETAILED_STR_STATS) 11929 int j; 11930 11931#endif 11932 11933 oldstream = stcb->asoc.strmout; 11934 /* get some more */ 11935 SCTP_MALLOC(stcb->asoc.strmout, struct sctp_stream_out *, 11936 ((stcb->asoc.streamoutcnt + adding_o) * sizeof(struct sctp_stream_out)), 11937 SCTP_M_STRMO); 11938 if (stcb->asoc.strmout == NULL) { 11939 uint8_t x; 11940 11941 stcb->asoc.strmout = oldstream; 11942 /* Turn off the bit */ 11943 x = add_stream & 0xfe; 11944 add_stream = x; 11945 goto skip_stuff; 11946 } 11947 /* 11948 * Ok now we proceed with copying the old out stuff and 11949 * initializing the new stuff. 11950 */ 11951 SCTP_TCB_SEND_LOCK(stcb); 11952 stcb->asoc.ss_functions.sctp_ss_clear(stcb, &stcb->asoc, 0, 1); 11953 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11954 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 11955 stcb->asoc.strmout[i].chunks_on_queues = oldstream[i].chunks_on_queues; 11956 stcb->asoc.strmout[i].next_sequence_send = oldstream[i].next_sequence_send; 11957 stcb->asoc.strmout[i].last_msg_incomplete = oldstream[i].last_msg_incomplete; 11958 stcb->asoc.strmout[i].stream_no = i; 11959 stcb->asoc.ss_functions.sctp_ss_init_stream(&stcb->asoc.strmout[i], &oldstream[i]); 11960 /* now anything on those queues? */ 11961 TAILQ_FOREACH_SAFE(sp, &oldstream[i].outqueue, next, nsp) { 11962 TAILQ_REMOVE(&oldstream[i].outqueue, sp, next); 11963 TAILQ_INSERT_TAIL(&stcb->asoc.strmout[i].outqueue, sp, next); 11964 } 11965 /* Now move assoc pointers too */ 11966 if (stcb->asoc.last_out_stream == &oldstream[i]) { 11967 stcb->asoc.last_out_stream = &stcb->asoc.strmout[i]; 11968 } 11969 if (stcb->asoc.locked_on_sending == &oldstream[i]) { 11970 stcb->asoc.locked_on_sending = &stcb->asoc.strmout[i]; 11971 } 11972 } 11973 /* now the new streams */ 11974 stcb->asoc.ss_functions.sctp_ss_init(stcb, &stcb->asoc, 1); 11975 for (i = stcb->asoc.streamoutcnt; i < (stcb->asoc.streamoutcnt + adding_o); i++) { 11976 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 11977 stcb->asoc.strmout[i].chunks_on_queues = 0; 11978#if defined(SCTP_DETAILED_STR_STATS) 11979 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 11980 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 11981 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 11982 } 11983#else 11984 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 11985 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 11986#endif 11987 stcb->asoc.strmout[i].next_sequence_send = 0x0; 11988 stcb->asoc.strmout[i].stream_no = i; 11989 stcb->asoc.strmout[i].last_msg_incomplete = 0; 11990 stcb->asoc.ss_functions.sctp_ss_init_stream(&stcb->asoc.strmout[i], NULL); 11991 } 11992 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt + adding_o; 11993 SCTP_FREE(oldstream, SCTP_M_STRMO); 11994 SCTP_TCB_SEND_UNLOCK(stcb); 11995 } 11996skip_stuff: 11997 if ((add_stream & 1) && (adding_o > 0)) { 11998 asoc->strm_pending_add_size = adding_o; 11999 asoc->peer_req_out = peer_asked; 12000 sctp_add_an_out_stream(chk, seq, adding_o); 12001 seq++; 12002 asoc->stream_reset_outstanding++; 12003 } 12004 if ((add_stream & 2) && (adding_i > 0)) { 12005 sctp_add_an_in_stream(chk, seq, adding_i); 12006 seq++; 12007 asoc->stream_reset_outstanding++; 12008 } 12009 if (send_in_req) { 12010 sctp_add_stream_reset_in(chk, number_entries, list, seq); 12011 seq++; 12012 asoc->stream_reset_outstanding++; 12013 } 12014 if (send_tsn_req) { 12015 sctp_add_stream_reset_tsn(chk, seq); 12016 asoc->stream_reset_outstanding++; 12017 } 12018 asoc->str_reset = chk; 12019 /* insert the chunk for sending */ 12020 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12021 chk, 12022 sctp_next); 12023 asoc->ctrl_queue_cnt++; 12024 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12025 return (0); 12026} 12027 12028void 12029sctp_send_abort(struct mbuf *m, int iphlen, struct sockaddr *src, struct sockaddr *dst, 12030 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12031 uint8_t mflowtype, uint32_t mflowid, 12032 uint32_t vrf_id, uint16_t port) 12033{ 12034 /* Don't respond to an ABORT with an ABORT. */ 12035 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 12036 if (cause) 12037 sctp_m_freem(cause); 12038 return; 12039 } 12040 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_ABORT_ASSOCIATION, cause, 12041 mflowtype, mflowid, 12042 vrf_id, port); 12043 return; 12044} 12045 12046void 12047sctp_send_operr_to(struct sockaddr *src, struct sockaddr *dst, 12048 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12049 uint8_t mflowtype, uint32_t mflowid, 12050 uint32_t vrf_id, uint16_t port) 12051{ 12052 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_OPERATION_ERROR, cause, 12053 mflowtype, mflowid, 12054 vrf_id, port); 12055 return; 12056} 12057 12058static struct mbuf * 12059sctp_copy_resume(struct uio *uio, 12060 int max_send_len, 12061 int user_marks_eor, 12062 int *error, 12063 uint32_t * sndout, 12064 struct mbuf **new_tail) 12065{ 12066 struct mbuf *m; 12067 12068 m = m_uiotombuf(uio, M_WAITOK, max_send_len, 0, 12069 (M_PKTHDR | (user_marks_eor ? M_EOR : 0))); 12070 if (m == NULL) { 12071 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12072 *error = ENOBUFS; 12073 } else { 12074 *sndout = m_length(m, NULL); 12075 *new_tail = m_last(m); 12076 } 12077 return (m); 12078} 12079 12080static int 12081sctp_copy_one(struct sctp_stream_queue_pending *sp, 12082 struct uio *uio, 12083 int resv_upfront) 12084{ 12085 int left; 12086 12087 left = sp->length; 12088 sp->data = m_uiotombuf(uio, M_WAITOK, sp->length, 12089 resv_upfront, 0); 12090 if (sp->data == NULL) { 12091 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12092 return (ENOBUFS); 12093 } 12094 sp->tail_mbuf = m_last(sp->data); 12095 return (0); 12096} 12097 12098 12099 12100static struct sctp_stream_queue_pending * 12101sctp_copy_it_in(struct sctp_tcb *stcb, 12102 struct sctp_association *asoc, 12103 struct sctp_sndrcvinfo *srcv, 12104 struct uio *uio, 12105 struct sctp_nets *net, 12106 int max_send_len, 12107 int user_marks_eor, 12108 int *error) 12109{ 12110 /*- 12111 * This routine must be very careful in its work. Protocol 12112 * processing is up and running so care must be taken to spl...() 12113 * when you need to do something that may effect the stcb/asoc. The 12114 * sb is locked however. When data is copied the protocol processing 12115 * should be enabled since this is a slower operation... 12116 */ 12117 struct sctp_stream_queue_pending *sp = NULL; 12118 int resv_in_first; 12119 12120 *error = 0; 12121 /* Now can we send this? */ 12122 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 12123 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12124 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12125 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12126 /* got data while shutting down */ 12127 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12128 *error = ECONNRESET; 12129 goto out_now; 12130 } 12131 sctp_alloc_a_strmoq(stcb, sp); 12132 if (sp == NULL) { 12133 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12134 *error = ENOMEM; 12135 goto out_now; 12136 } 12137 sp->act_flags = 0; 12138 sp->sender_all_done = 0; 12139 sp->sinfo_flags = srcv->sinfo_flags; 12140 sp->timetolive = srcv->sinfo_timetolive; 12141 sp->ppid = srcv->sinfo_ppid; 12142 sp->context = srcv->sinfo_context; 12143 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 12144 12145 sp->stream = srcv->sinfo_stream; 12146 sp->length = min(uio->uio_resid, max_send_len); 12147 if ((sp->length == (uint32_t) uio->uio_resid) && 12148 ((user_marks_eor == 0) || 12149 (srcv->sinfo_flags & SCTP_EOF) || 12150 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 12151 sp->msg_is_complete = 1; 12152 } else { 12153 sp->msg_is_complete = 0; 12154 } 12155 sp->sender_all_done = 0; 12156 sp->some_taken = 0; 12157 sp->put_last_out = 0; 12158 resv_in_first = sizeof(struct sctp_data_chunk); 12159 sp->data = sp->tail_mbuf = NULL; 12160 if (sp->length == 0) { 12161 *error = 0; 12162 goto skip_copy; 12163 } 12164 if (srcv->sinfo_keynumber_valid) { 12165 sp->auth_keyid = srcv->sinfo_keynumber; 12166 } else { 12167 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 12168 } 12169 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 12170 sctp_auth_key_acquire(stcb, sp->auth_keyid); 12171 sp->holds_key_ref = 1; 12172 } 12173 *error = sctp_copy_one(sp, uio, resv_in_first); 12174skip_copy: 12175 if (*error) { 12176 sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); 12177 sp = NULL; 12178 } else { 12179 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 12180 sp->net = net; 12181 atomic_add_int(&sp->net->ref_count, 1); 12182 } else { 12183 sp->net = NULL; 12184 } 12185 sctp_set_prsctp_policy(sp); 12186 } 12187out_now: 12188 return (sp); 12189} 12190 12191 12192int 12193sctp_sosend(struct socket *so, 12194 struct sockaddr *addr, 12195 struct uio *uio, 12196 struct mbuf *top, 12197 struct mbuf *control, 12198 int flags, 12199 struct thread *p 12200) 12201{ 12202 int error, use_sndinfo = 0; 12203 struct sctp_sndrcvinfo sndrcvninfo; 12204 struct sockaddr *addr_to_use; 12205 12206#if defined(INET) && defined(INET6) 12207 struct sockaddr_in sin; 12208 12209#endif 12210 12211 if (control) { 12212 /* process cmsg snd/rcv info (maybe a assoc-id) */ 12213 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&sndrcvninfo, control, 12214 sizeof(sndrcvninfo))) { 12215 /* got one */ 12216 use_sndinfo = 1; 12217 } 12218 } 12219 addr_to_use = addr; 12220#if defined(INET) && defined(INET6) 12221 if ((addr) && (addr->sa_family == AF_INET6)) { 12222 struct sockaddr_in6 *sin6; 12223 12224 sin6 = (struct sockaddr_in6 *)addr; 12225 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 12226 in6_sin6_2_sin(&sin, sin6); 12227 addr_to_use = (struct sockaddr *)&sin; 12228 } 12229 } 12230#endif 12231 error = sctp_lower_sosend(so, addr_to_use, uio, top, 12232 control, 12233 flags, 12234 use_sndinfo ? &sndrcvninfo : NULL 12235 ,p 12236 ); 12237 return (error); 12238} 12239 12240 12241int 12242sctp_lower_sosend(struct socket *so, 12243 struct sockaddr *addr, 12244 struct uio *uio, 12245 struct mbuf *i_pak, 12246 struct mbuf *control, 12247 int flags, 12248 struct sctp_sndrcvinfo *srcv 12249 , 12250 struct thread *p 12251) 12252{ 12253 unsigned int sndlen = 0, max_len; 12254 int error, len; 12255 struct mbuf *top = NULL; 12256 int queue_only = 0, queue_only_for_init = 0; 12257 int free_cnt_applied = 0; 12258 int un_sent; 12259 int now_filled = 0; 12260 unsigned int inqueue_bytes = 0; 12261 struct sctp_block_entry be; 12262 struct sctp_inpcb *inp; 12263 struct sctp_tcb *stcb = NULL; 12264 struct timeval now; 12265 struct sctp_nets *net; 12266 struct sctp_association *asoc; 12267 struct sctp_inpcb *t_inp; 12268 int user_marks_eor; 12269 int create_lock_applied = 0; 12270 int nagle_applies = 0; 12271 int some_on_control = 0; 12272 int got_all_of_the_send = 0; 12273 int hold_tcblock = 0; 12274 int non_blocking = 0; 12275 uint32_t local_add_more, local_soresv = 0; 12276 uint16_t port; 12277 uint16_t sinfo_flags; 12278 sctp_assoc_t sinfo_assoc_id; 12279 12280 error = 0; 12281 net = NULL; 12282 stcb = NULL; 12283 asoc = NULL; 12284 12285 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 12286 if (inp == NULL) { 12287 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12288 error = EINVAL; 12289 if (i_pak) { 12290 SCTP_RELEASE_PKT(i_pak); 12291 } 12292 return (error); 12293 } 12294 if ((uio == NULL) && (i_pak == NULL)) { 12295 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12296 return (EINVAL); 12297 } 12298 user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 12299 atomic_add_int(&inp->total_sends, 1); 12300 if (uio) { 12301 if (uio->uio_resid < 0) { 12302 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12303 return (EINVAL); 12304 } 12305 sndlen = uio->uio_resid; 12306 } else { 12307 top = SCTP_HEADER_TO_CHAIN(i_pak); 12308 sndlen = SCTP_HEADER_LEN(i_pak); 12309 } 12310 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %d\n", 12311 (void *)addr, 12312 sndlen); 12313 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 12314 (inp->sctp_socket->so_qlimit)) { 12315 /* The listener can NOT send */ 12316 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12317 error = ENOTCONN; 12318 goto out_unlocked; 12319 } 12320 /** 12321 * Pre-screen address, if one is given the sin-len 12322 * must be set correctly! 12323 */ 12324 if (addr) { 12325 union sctp_sockstore *raddr = (union sctp_sockstore *)addr; 12326 12327 switch (raddr->sa.sa_family) { 12328#ifdef INET 12329 case AF_INET: 12330 if (raddr->sin.sin_len != sizeof(struct sockaddr_in)) { 12331 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12332 error = EINVAL; 12333 goto out_unlocked; 12334 } 12335 port = raddr->sin.sin_port; 12336 break; 12337#endif 12338#ifdef INET6 12339 case AF_INET6: 12340 if (raddr->sin6.sin6_len != sizeof(struct sockaddr_in6)) { 12341 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12342 error = EINVAL; 12343 goto out_unlocked; 12344 } 12345 port = raddr->sin6.sin6_port; 12346 break; 12347#endif 12348 default: 12349 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAFNOSUPPORT); 12350 error = EAFNOSUPPORT; 12351 goto out_unlocked; 12352 } 12353 } else 12354 port = 0; 12355 12356 if (srcv) { 12357 sinfo_flags = srcv->sinfo_flags; 12358 sinfo_assoc_id = srcv->sinfo_assoc_id; 12359 if (INVALID_SINFO_FLAG(sinfo_flags) || 12360 PR_SCTP_INVALID_POLICY(sinfo_flags)) { 12361 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12362 error = EINVAL; 12363 goto out_unlocked; 12364 } 12365 if (srcv->sinfo_flags) 12366 SCTP_STAT_INCR(sctps_sends_with_flags); 12367 } else { 12368 sinfo_flags = inp->def_send.sinfo_flags; 12369 sinfo_assoc_id = inp->def_send.sinfo_assoc_id; 12370 } 12371 if (sinfo_flags & SCTP_SENDALL) { 12372 /* its a sendall */ 12373 error = sctp_sendall(inp, uio, top, srcv); 12374 top = NULL; 12375 goto out_unlocked; 12376 } 12377 if ((sinfo_flags & SCTP_ADDR_OVER) && (addr == NULL)) { 12378 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12379 error = EINVAL; 12380 goto out_unlocked; 12381 } 12382 /* now we must find the assoc */ 12383 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) || 12384 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 12385 SCTP_INP_RLOCK(inp); 12386 stcb = LIST_FIRST(&inp->sctp_asoc_list); 12387 if (stcb) { 12388 SCTP_TCB_LOCK(stcb); 12389 hold_tcblock = 1; 12390 } 12391 SCTP_INP_RUNLOCK(inp); 12392 } else if (sinfo_assoc_id) { 12393 stcb = sctp_findassociation_ep_asocid(inp, sinfo_assoc_id, 0); 12394 } else if (addr) { 12395 /*- 12396 * Since we did not use findep we must 12397 * increment it, and if we don't find a tcb 12398 * decrement it. 12399 */ 12400 SCTP_INP_WLOCK(inp); 12401 SCTP_INP_INCR_REF(inp); 12402 SCTP_INP_WUNLOCK(inp); 12403 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12404 if (stcb == NULL) { 12405 SCTP_INP_WLOCK(inp); 12406 SCTP_INP_DECR_REF(inp); 12407 SCTP_INP_WUNLOCK(inp); 12408 } else { 12409 hold_tcblock = 1; 12410 } 12411 } 12412 if ((stcb == NULL) && (addr)) { 12413 /* Possible implicit send? */ 12414 SCTP_ASOC_CREATE_LOCK(inp); 12415 create_lock_applied = 1; 12416 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 12417 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 12418 /* Should I really unlock ? */ 12419 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12420 error = EINVAL; 12421 goto out_unlocked; 12422 12423 } 12424 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 12425 (addr->sa_family == AF_INET6)) { 12426 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12427 error = EINVAL; 12428 goto out_unlocked; 12429 } 12430 SCTP_INP_WLOCK(inp); 12431 SCTP_INP_INCR_REF(inp); 12432 SCTP_INP_WUNLOCK(inp); 12433 /* With the lock applied look again */ 12434 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12435 if ((stcb == NULL) && (control != NULL) && (port > 0)) { 12436 stcb = sctp_findassociation_cmsgs(&t_inp, port, control, &net, &error); 12437 } 12438 if (stcb == NULL) { 12439 SCTP_INP_WLOCK(inp); 12440 SCTP_INP_DECR_REF(inp); 12441 SCTP_INP_WUNLOCK(inp); 12442 } else { 12443 hold_tcblock = 1; 12444 } 12445 if (error) { 12446 goto out_unlocked; 12447 } 12448 if (t_inp != inp) { 12449 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12450 error = ENOTCONN; 12451 goto out_unlocked; 12452 } 12453 } 12454 if (stcb == NULL) { 12455 if (addr == NULL) { 12456 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12457 error = ENOENT; 12458 goto out_unlocked; 12459 } else { 12460 /* We must go ahead and start the INIT process */ 12461 uint32_t vrf_id; 12462 12463 if ((sinfo_flags & SCTP_ABORT) || 12464 ((sinfo_flags & SCTP_EOF) && (sndlen == 0))) { 12465 /*- 12466 * User asks to abort a non-existant assoc, 12467 * or EOF a non-existant assoc with no data 12468 */ 12469 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12470 error = ENOENT; 12471 goto out_unlocked; 12472 } 12473 /* get an asoc/stcb struct */ 12474 vrf_id = inp->def_vrf_id; 12475#ifdef INVARIANTS 12476 if (create_lock_applied == 0) { 12477 panic("Error, should hold create lock and I don't?"); 12478 } 12479#endif 12480 stcb = sctp_aloc_assoc(inp, addr, &error, 0, vrf_id, 12481 p 12482 ); 12483 if (stcb == NULL) { 12484 /* Error is setup for us in the call */ 12485 goto out_unlocked; 12486 } 12487 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 12488 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 12489 /* 12490 * Set the connected flag so we can queue 12491 * data 12492 */ 12493 soisconnecting(so); 12494 } 12495 hold_tcblock = 1; 12496 if (create_lock_applied) { 12497 SCTP_ASOC_CREATE_UNLOCK(inp); 12498 create_lock_applied = 0; 12499 } else { 12500 SCTP_PRINTF("Huh-3? create lock should have been on??\n"); 12501 } 12502 /* 12503 * Turn on queue only flag to prevent data from 12504 * being sent 12505 */ 12506 queue_only = 1; 12507 asoc = &stcb->asoc; 12508 SCTP_SET_STATE(asoc, SCTP_STATE_COOKIE_WAIT); 12509 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 12510 12511 /* initialize authentication params for the assoc */ 12512 sctp_initialize_auth_params(inp, stcb); 12513 12514 if (control) { 12515 if (sctp_process_cmsgs_for_init(stcb, control, &error)) { 12516 sctp_free_assoc(inp, stcb, SCTP_PCBFREE_FORCE, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_7); 12517 hold_tcblock = 0; 12518 stcb = NULL; 12519 goto out_unlocked; 12520 } 12521 } 12522 /* out with the INIT */ 12523 queue_only_for_init = 1; 12524 /*- 12525 * we may want to dig in after this call and adjust the MTU 12526 * value. It defaulted to 1500 (constant) but the ro 12527 * structure may now have an update and thus we may need to 12528 * change it BEFORE we append the message. 12529 */ 12530 } 12531 } else 12532 asoc = &stcb->asoc; 12533 if (srcv == NULL) 12534 srcv = (struct sctp_sndrcvinfo *)&asoc->def_send; 12535 if (srcv->sinfo_flags & SCTP_ADDR_OVER) { 12536 if (addr) 12537 net = sctp_findnet(stcb, addr); 12538 else 12539 net = NULL; 12540 if ((net == NULL) || 12541 ((port != 0) && (port != stcb->rport))) { 12542 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12543 error = EINVAL; 12544 goto out_unlocked; 12545 } 12546 } else { 12547 if (stcb->asoc.alternate) { 12548 net = stcb->asoc.alternate; 12549 } else { 12550 net = stcb->asoc.primary_destination; 12551 } 12552 } 12553 atomic_add_int(&stcb->total_sends, 1); 12554 /* Keep the stcb from being freed under our feet */ 12555 atomic_add_int(&asoc->refcnt, 1); 12556 free_cnt_applied = 1; 12557 12558 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NO_FRAGMENT)) { 12559 if (sndlen > asoc->smallest_mtu) { 12560 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12561 error = EMSGSIZE; 12562 goto out_unlocked; 12563 } 12564 } 12565 if (SCTP_SO_IS_NBIO(so) 12566 || (flags & MSG_NBIO) 12567 ) { 12568 non_blocking = 1; 12569 } 12570 /* would we block? */ 12571 if (non_blocking) { 12572 if (hold_tcblock == 0) { 12573 SCTP_TCB_LOCK(stcb); 12574 hold_tcblock = 1; 12575 } 12576 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12577 if ((SCTP_SB_LIMIT_SND(so) < (sndlen + inqueue_bytes + stcb->asoc.sb_send_resv)) || 12578 (stcb->asoc.chunks_on_out_queue >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12579 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EWOULDBLOCK); 12580 if (sndlen > SCTP_SB_LIMIT_SND(so)) 12581 error = EMSGSIZE; 12582 else 12583 error = EWOULDBLOCK; 12584 goto out_unlocked; 12585 } 12586 stcb->asoc.sb_send_resv += sndlen; 12587 SCTP_TCB_UNLOCK(stcb); 12588 hold_tcblock = 0; 12589 } else { 12590 atomic_add_int(&stcb->asoc.sb_send_resv, sndlen); 12591 } 12592 local_soresv = sndlen; 12593 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12594 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12595 error = ECONNRESET; 12596 goto out_unlocked; 12597 } 12598 if (create_lock_applied) { 12599 SCTP_ASOC_CREATE_UNLOCK(inp); 12600 create_lock_applied = 0; 12601 } 12602 if (asoc->stream_reset_outstanding) { 12603 /* 12604 * Can't queue any data while stream reset is underway. 12605 */ 12606 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAGAIN); 12607 error = EAGAIN; 12608 goto out_unlocked; 12609 } 12610 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 12611 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 12612 queue_only = 1; 12613 } 12614 /* we are now done with all control */ 12615 if (control) { 12616 sctp_m_freem(control); 12617 control = NULL; 12618 } 12619 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 12620 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12621 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12622 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12623 if (srcv->sinfo_flags & SCTP_ABORT) { 12624 ; 12625 } else { 12626 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12627 error = ECONNRESET; 12628 goto out_unlocked; 12629 } 12630 } 12631 /* Ok, we will attempt a msgsnd :> */ 12632 if (p) { 12633 p->td_ru.ru_msgsnd++; 12634 } 12635 /* Are we aborting? */ 12636 if (srcv->sinfo_flags & SCTP_ABORT) { 12637 struct mbuf *mm; 12638 int tot_demand, tot_out = 0, max_out; 12639 12640 SCTP_STAT_INCR(sctps_sends_with_abort); 12641 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 12642 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 12643 /* It has to be up before we abort */ 12644 /* how big is the user initiated abort? */ 12645 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12646 error = EINVAL; 12647 goto out; 12648 } 12649 if (hold_tcblock) { 12650 SCTP_TCB_UNLOCK(stcb); 12651 hold_tcblock = 0; 12652 } 12653 if (top) { 12654 struct mbuf *cntm = NULL; 12655 12656 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_WAITOK, 1, MT_DATA); 12657 if (sndlen != 0) { 12658 for (cntm = top; cntm; cntm = SCTP_BUF_NEXT(cntm)) { 12659 tot_out += SCTP_BUF_LEN(cntm); 12660 } 12661 } 12662 } else { 12663 /* Must fit in a MTU */ 12664 tot_out = sndlen; 12665 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 12666 if (tot_demand > SCTP_DEFAULT_ADD_MORE) { 12667 /* To big */ 12668 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12669 error = EMSGSIZE; 12670 goto out; 12671 } 12672 mm = sctp_get_mbuf_for_msg(tot_demand, 0, M_WAITOK, 1, MT_DATA); 12673 } 12674 if (mm == NULL) { 12675 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12676 error = ENOMEM; 12677 goto out; 12678 } 12679 max_out = asoc->smallest_mtu - sizeof(struct sctp_paramhdr); 12680 max_out -= sizeof(struct sctp_abort_msg); 12681 if (tot_out > max_out) { 12682 tot_out = max_out; 12683 } 12684 if (mm) { 12685 struct sctp_paramhdr *ph; 12686 12687 /* now move forward the data pointer */ 12688 ph = mtod(mm, struct sctp_paramhdr *); 12689 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 12690 ph->param_length = htons(sizeof(struct sctp_paramhdr) + tot_out); 12691 ph++; 12692 SCTP_BUF_LEN(mm) = tot_out + sizeof(struct sctp_paramhdr); 12693 if (top == NULL) { 12694 error = uiomove((caddr_t)ph, (int)tot_out, uio); 12695 if (error) { 12696 /*- 12697 * Here if we can't get his data we 12698 * still abort we just don't get to 12699 * send the users note :-0 12700 */ 12701 sctp_m_freem(mm); 12702 mm = NULL; 12703 } 12704 } else { 12705 if (sndlen != 0) { 12706 SCTP_BUF_NEXT(mm) = top; 12707 } 12708 } 12709 } 12710 if (hold_tcblock == 0) { 12711 SCTP_TCB_LOCK(stcb); 12712 } 12713 atomic_add_int(&stcb->asoc.refcnt, -1); 12714 free_cnt_applied = 0; 12715 /* release this lock, otherwise we hang on ourselves */ 12716 sctp_abort_an_association(stcb->sctp_ep, stcb, mm, SCTP_SO_LOCKED); 12717 /* now relock the stcb so everything is sane */ 12718 hold_tcblock = 0; 12719 stcb = NULL; 12720 /* 12721 * In this case top is already chained to mm avoid double 12722 * free, since we free it below if top != NULL and driver 12723 * would free it after sending the packet out 12724 */ 12725 if (sndlen != 0) { 12726 top = NULL; 12727 } 12728 goto out_unlocked; 12729 } 12730 /* Calculate the maximum we can send */ 12731 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12732 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 12733 if (non_blocking) { 12734 /* we already checked for non-blocking above. */ 12735 max_len = sndlen; 12736 } else { 12737 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 12738 } 12739 } else { 12740 max_len = 0; 12741 } 12742 if (hold_tcblock) { 12743 SCTP_TCB_UNLOCK(stcb); 12744 hold_tcblock = 0; 12745 } 12746 /* Is the stream no. valid? */ 12747 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 12748 /* Invalid stream number */ 12749 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12750 error = EINVAL; 12751 goto out_unlocked; 12752 } 12753 if (asoc->strmout == NULL) { 12754 /* huh? software error */ 12755 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 12756 error = EFAULT; 12757 goto out_unlocked; 12758 } 12759 /* Unless E_EOR mode is on, we must make a send FIT in one call. */ 12760 if ((user_marks_eor == 0) && 12761 (sndlen > SCTP_SB_LIMIT_SND(stcb->sctp_socket))) { 12762 /* It will NEVER fit */ 12763 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12764 error = EMSGSIZE; 12765 goto out_unlocked; 12766 } 12767 if ((uio == NULL) && user_marks_eor) { 12768 /*- 12769 * We do not support eeor mode for 12770 * sending with mbuf chains (like sendfile). 12771 */ 12772 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12773 error = EINVAL; 12774 goto out_unlocked; 12775 } 12776 if (user_marks_eor) { 12777 local_add_more = min(SCTP_SB_LIMIT_SND(so), SCTP_BASE_SYSCTL(sctp_add_more_threshold)); 12778 } else { 12779 /*- 12780 * For non-eeor the whole message must fit in 12781 * the socket send buffer. 12782 */ 12783 local_add_more = sndlen; 12784 } 12785 len = 0; 12786 if (non_blocking) { 12787 goto skip_preblock; 12788 } 12789 if (((max_len <= local_add_more) && 12790 (SCTP_SB_LIMIT_SND(so) >= local_add_more)) || 12791 (max_len == 0) || 12792 ((stcb->asoc.chunks_on_out_queue + stcb->asoc.stream_queue_cnt) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12793 /* No room right now ! */ 12794 SOCKBUF_LOCK(&so->so_snd); 12795 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12796 while ((SCTP_SB_LIMIT_SND(so) < (inqueue_bytes + local_add_more)) || 12797 ((stcb->asoc.stream_queue_cnt + stcb->asoc.chunks_on_out_queue) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12798 SCTPDBG(SCTP_DEBUG_OUTPUT1, "pre_block limit:%u <(inq:%d + %d) || (%d+%d > %d)\n", 12799 (unsigned int)SCTP_SB_LIMIT_SND(so), 12800 inqueue_bytes, 12801 local_add_more, 12802 stcb->asoc.stream_queue_cnt, 12803 stcb->asoc.chunks_on_out_queue, 12804 SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)); 12805 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 12806 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA, asoc, sndlen); 12807 } 12808 be.error = 0; 12809 stcb->block_entry = &be; 12810 error = sbwait(&so->so_snd); 12811 stcb->block_entry = NULL; 12812 if (error || so->so_error || be.error) { 12813 if (error == 0) { 12814 if (so->so_error) 12815 error = so->so_error; 12816 if (be.error) { 12817 error = be.error; 12818 } 12819 } 12820 SOCKBUF_UNLOCK(&so->so_snd); 12821 goto out_unlocked; 12822 } 12823 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 12824 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 12825 asoc, stcb->asoc.total_output_queue_size); 12826 } 12827 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12828 goto out_unlocked; 12829 } 12830 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12831 } 12832 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 12833 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 12834 } else { 12835 max_len = 0; 12836 } 12837 SOCKBUF_UNLOCK(&so->so_snd); 12838 } 12839skip_preblock: 12840 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12841 goto out_unlocked; 12842 } 12843 /* 12844 * sndlen covers for mbuf case uio_resid covers for the non-mbuf 12845 * case NOTE: uio will be null when top/mbuf is passed 12846 */ 12847 if (sndlen == 0) { 12848 if (srcv->sinfo_flags & SCTP_EOF) { 12849 got_all_of_the_send = 1; 12850 goto dataless_eof; 12851 } else { 12852 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12853 error = EINVAL; 12854 goto out; 12855 } 12856 } 12857 if (top == NULL) { 12858 struct sctp_stream_queue_pending *sp; 12859 struct sctp_stream_out *strm; 12860 uint32_t sndout; 12861 12862 SCTP_TCB_SEND_LOCK(stcb); 12863 if ((asoc->stream_locked) && 12864 (asoc->stream_locked_on != srcv->sinfo_stream)) { 12865 SCTP_TCB_SEND_UNLOCK(stcb); 12866 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12867 error = EINVAL; 12868 goto out; 12869 } 12870 SCTP_TCB_SEND_UNLOCK(stcb); 12871 12872 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 12873 if (strm->last_msg_incomplete == 0) { 12874 do_a_copy_in: 12875 sp = sctp_copy_it_in(stcb, asoc, srcv, uio, net, max_len, user_marks_eor, &error); 12876 if ((sp == NULL) || (error)) { 12877 goto out; 12878 } 12879 SCTP_TCB_SEND_LOCK(stcb); 12880 if (sp->msg_is_complete) { 12881 strm->last_msg_incomplete = 0; 12882 asoc->stream_locked = 0; 12883 } else { 12884 /* 12885 * Just got locked to this guy in case of an 12886 * interrupt. 12887 */ 12888 strm->last_msg_incomplete = 1; 12889 asoc->stream_locked = 1; 12890 asoc->stream_locked_on = srcv->sinfo_stream; 12891 sp->sender_all_done = 0; 12892 } 12893 sctp_snd_sb_alloc(stcb, sp->length); 12894 atomic_add_int(&asoc->stream_queue_cnt, 1); 12895 if (srcv->sinfo_flags & SCTP_UNORDERED) { 12896 SCTP_STAT_INCR(sctps_sends_with_unord); 12897 } 12898 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 12899 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, asoc, strm, sp, 1); 12900 SCTP_TCB_SEND_UNLOCK(stcb); 12901 } else { 12902 SCTP_TCB_SEND_LOCK(stcb); 12903 sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead); 12904 SCTP_TCB_SEND_UNLOCK(stcb); 12905 if (sp == NULL) { 12906 /* ???? Huh ??? last msg is gone */ 12907#ifdef INVARIANTS 12908 panic("Warning: Last msg marked incomplete, yet nothing left?"); 12909#else 12910 SCTP_PRINTF("Warning: Last msg marked incomplete, yet nothing left?\n"); 12911 strm->last_msg_incomplete = 0; 12912#endif 12913 goto do_a_copy_in; 12914 12915 } 12916 } 12917 while (uio->uio_resid > 0) { 12918 /* How much room do we have? */ 12919 struct mbuf *new_tail, *mm; 12920 12921 if (SCTP_SB_LIMIT_SND(so) > stcb->asoc.total_output_queue_size) 12922 max_len = SCTP_SB_LIMIT_SND(so) - stcb->asoc.total_output_queue_size; 12923 else 12924 max_len = 0; 12925 12926 if ((max_len > SCTP_BASE_SYSCTL(sctp_add_more_threshold)) || 12927 (max_len && (SCTP_SB_LIMIT_SND(so) < SCTP_BASE_SYSCTL(sctp_add_more_threshold))) || 12928 (uio->uio_resid && (uio->uio_resid <= (int)max_len))) { 12929 sndout = 0; 12930 new_tail = NULL; 12931 if (hold_tcblock) { 12932 SCTP_TCB_UNLOCK(stcb); 12933 hold_tcblock = 0; 12934 } 12935 mm = sctp_copy_resume(uio, max_len, user_marks_eor, &error, &sndout, &new_tail); 12936 if ((mm == NULL) || error) { 12937 if (mm) { 12938 sctp_m_freem(mm); 12939 } 12940 goto out; 12941 } 12942 /* Update the mbuf and count */ 12943 SCTP_TCB_SEND_LOCK(stcb); 12944 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12945 /* 12946 * we need to get out. Peer probably 12947 * aborted. 12948 */ 12949 sctp_m_freem(mm); 12950 if (stcb->asoc.state & SCTP_PCB_FLAGS_WAS_ABORTED) { 12951 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12952 error = ECONNRESET; 12953 } 12954 SCTP_TCB_SEND_UNLOCK(stcb); 12955 goto out; 12956 } 12957 if (sp->tail_mbuf) { 12958 /* tack it to the end */ 12959 SCTP_BUF_NEXT(sp->tail_mbuf) = mm; 12960 sp->tail_mbuf = new_tail; 12961 } else { 12962 /* A stolen mbuf */ 12963 sp->data = mm; 12964 sp->tail_mbuf = new_tail; 12965 } 12966 sctp_snd_sb_alloc(stcb, sndout); 12967 atomic_add_int(&sp->length, sndout); 12968 len += sndout; 12969 12970 /* Did we reach EOR? */ 12971 if ((uio->uio_resid == 0) && 12972 ((user_marks_eor == 0) || 12973 (srcv->sinfo_flags & SCTP_EOF) || 12974 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 12975 sp->msg_is_complete = 1; 12976 } else { 12977 sp->msg_is_complete = 0; 12978 } 12979 SCTP_TCB_SEND_UNLOCK(stcb); 12980 } 12981 if (uio->uio_resid == 0) { 12982 /* got it all? */ 12983 continue; 12984 } 12985 /* PR-SCTP? */ 12986 if ((asoc->prsctp_supported) && (asoc->sent_queue_cnt_removeable > 0)) { 12987 /* 12988 * This is ugly but we must assure locking 12989 * order 12990 */ 12991 if (hold_tcblock == 0) { 12992 SCTP_TCB_LOCK(stcb); 12993 hold_tcblock = 1; 12994 } 12995 sctp_prune_prsctp(stcb, asoc, srcv, sndlen); 12996 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12997 if (SCTP_SB_LIMIT_SND(so) > stcb->asoc.total_output_queue_size) 12998 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 12999 else 13000 max_len = 0; 13001 if (max_len > 0) { 13002 continue; 13003 } 13004 SCTP_TCB_UNLOCK(stcb); 13005 hold_tcblock = 0; 13006 } 13007 /* wait for space now */ 13008 if (non_blocking) { 13009 /* Non-blocking io in place out */ 13010 goto skip_out_eof; 13011 } 13012 /* What about the INIT, send it maybe */ 13013 if (queue_only_for_init) { 13014 if (hold_tcblock == 0) { 13015 SCTP_TCB_LOCK(stcb); 13016 hold_tcblock = 1; 13017 } 13018 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) { 13019 /* a collision took us forward? */ 13020 queue_only = 0; 13021 } else { 13022 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13023 SCTP_SET_STATE(asoc, SCTP_STATE_COOKIE_WAIT); 13024 queue_only = 1; 13025 } 13026 } 13027 if ((net->flight_size > net->cwnd) && 13028 (asoc->sctp_cmt_on_off == 0)) { 13029 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13030 queue_only = 1; 13031 } else if (asoc->ifp_had_enobuf) { 13032 SCTP_STAT_INCR(sctps_ifnomemqueued); 13033 if (net->flight_size > (2 * net->mtu)) { 13034 queue_only = 1; 13035 } 13036 asoc->ifp_had_enobuf = 0; 13037 } 13038 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 13039 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 13040 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13041 (stcb->asoc.total_flight > 0) && 13042 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13043 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13044 13045 /*- 13046 * Ok, Nagle is set on and we have data outstanding. 13047 * Don't send anything and let SACKs drive out the 13048 * data unless wen have a "full" segment to send. 13049 */ 13050 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13051 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13052 } 13053 SCTP_STAT_INCR(sctps_naglequeued); 13054 nagle_applies = 1; 13055 } else { 13056 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13057 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13058 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13059 } 13060 SCTP_STAT_INCR(sctps_naglesent); 13061 nagle_applies = 0; 13062 } 13063 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13064 13065 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13066 nagle_applies, un_sent); 13067 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13068 stcb->asoc.total_flight, 13069 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13070 } 13071 if (queue_only_for_init) 13072 queue_only_for_init = 0; 13073 if ((queue_only == 0) && (nagle_applies == 0)) { 13074 /*- 13075 * need to start chunk output 13076 * before blocking.. note that if 13077 * a lock is already applied, then 13078 * the input via the net is happening 13079 * and I don't need to start output :-D 13080 */ 13081 if (hold_tcblock == 0) { 13082 if (SCTP_TCB_TRYLOCK(stcb)) { 13083 hold_tcblock = 1; 13084 sctp_chunk_output(inp, 13085 stcb, 13086 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13087 } 13088 } else { 13089 sctp_chunk_output(inp, 13090 stcb, 13091 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13092 } 13093 if (hold_tcblock == 1) { 13094 SCTP_TCB_UNLOCK(stcb); 13095 hold_tcblock = 0; 13096 } 13097 } 13098 SOCKBUF_LOCK(&so->so_snd); 13099 /*- 13100 * This is a bit strange, but I think it will 13101 * work. The total_output_queue_size is locked and 13102 * protected by the TCB_LOCK, which we just released. 13103 * There is a race that can occur between releasing it 13104 * above, and me getting the socket lock, where sacks 13105 * come in but we have not put the SB_WAIT on the 13106 * so_snd buffer to get the wakeup. After the LOCK 13107 * is applied the sack_processing will also need to 13108 * LOCK the so->so_snd to do the actual sowwakeup(). So 13109 * once we have the socket buffer lock if we recheck the 13110 * size we KNOW we will get to sleep safely with the 13111 * wakeup flag in place. 13112 */ 13113 if (SCTP_SB_LIMIT_SND(so) <= (stcb->asoc.total_output_queue_size + 13114 min(SCTP_BASE_SYSCTL(sctp_add_more_threshold), SCTP_SB_LIMIT_SND(so)))) { 13115 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13116 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 13117 asoc, uio->uio_resid); 13118 } 13119 be.error = 0; 13120 stcb->block_entry = &be; 13121 error = sbwait(&so->so_snd); 13122 stcb->block_entry = NULL; 13123 13124 if (error || so->so_error || be.error) { 13125 if (error == 0) { 13126 if (so->so_error) 13127 error = so->so_error; 13128 if (be.error) { 13129 error = be.error; 13130 } 13131 } 13132 SOCKBUF_UNLOCK(&so->so_snd); 13133 goto out_unlocked; 13134 } 13135 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13136 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13137 asoc, stcb->asoc.total_output_queue_size); 13138 } 13139 } 13140 SOCKBUF_UNLOCK(&so->so_snd); 13141 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13142 goto out_unlocked; 13143 } 13144 } 13145 SCTP_TCB_SEND_LOCK(stcb); 13146 if (sp) { 13147 if (sp->msg_is_complete == 0) { 13148 strm->last_msg_incomplete = 1; 13149 asoc->stream_locked = 1; 13150 asoc->stream_locked_on = srcv->sinfo_stream; 13151 } else { 13152 sp->sender_all_done = 1; 13153 strm->last_msg_incomplete = 0; 13154 asoc->stream_locked = 0; 13155 } 13156 } else { 13157 SCTP_PRINTF("Huh no sp TSNH?\n"); 13158 strm->last_msg_incomplete = 0; 13159 asoc->stream_locked = 0; 13160 } 13161 SCTP_TCB_SEND_UNLOCK(stcb); 13162 if (uio->uio_resid == 0) { 13163 got_all_of_the_send = 1; 13164 } 13165 } else { 13166 /* We send in a 0, since we do NOT have any locks */ 13167 error = sctp_msg_append(stcb, net, top, srcv, 0); 13168 top = NULL; 13169 if (srcv->sinfo_flags & SCTP_EOF) { 13170 /* 13171 * This should only happen for Panda for the mbuf 13172 * send case, which does NOT yet support EEOR mode. 13173 * Thus, we can just set this flag to do the proper 13174 * EOF handling. 13175 */ 13176 got_all_of_the_send = 1; 13177 } 13178 } 13179 if (error) { 13180 goto out; 13181 } 13182dataless_eof: 13183 /* EOF thing ? */ 13184 if ((srcv->sinfo_flags & SCTP_EOF) && 13185 (got_all_of_the_send == 1)) { 13186 int cnt; 13187 13188 SCTP_STAT_INCR(sctps_sends_with_eof); 13189 error = 0; 13190 if (hold_tcblock == 0) { 13191 SCTP_TCB_LOCK(stcb); 13192 hold_tcblock = 1; 13193 } 13194 cnt = sctp_is_there_unsent_data(stcb, SCTP_SO_LOCKED); 13195 if (TAILQ_EMPTY(&asoc->send_queue) && 13196 TAILQ_EMPTY(&asoc->sent_queue) && 13197 (cnt == 0)) { 13198 if (asoc->locked_on_sending) { 13199 goto abort_anyway; 13200 } 13201 /* there is nothing queued to send, so I'm done... */ 13202 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 13203 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13204 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13205 struct sctp_nets *netp; 13206 13207 /* only send SHUTDOWN the first time through */ 13208 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 13209 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 13210 } 13211 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT); 13212 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING); 13213 sctp_stop_timers_for_shutdown(stcb); 13214 if (stcb->asoc.alternate) { 13215 netp = stcb->asoc.alternate; 13216 } else { 13217 netp = stcb->asoc.primary_destination; 13218 } 13219 sctp_send_shutdown(stcb, netp); 13220 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 13221 netp); 13222 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13223 asoc->primary_destination); 13224 } 13225 } else { 13226 /*- 13227 * we still got (or just got) data to send, so set 13228 * SHUTDOWN_PENDING 13229 */ 13230 /*- 13231 * XXX sockets draft says that SCTP_EOF should be 13232 * sent with no data. currently, we will allow user 13233 * data to be sent first and move to 13234 * SHUTDOWN-PENDING 13235 */ 13236 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 13237 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13238 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13239 if (hold_tcblock == 0) { 13240 SCTP_TCB_LOCK(stcb); 13241 hold_tcblock = 1; 13242 } 13243 if (asoc->locked_on_sending) { 13244 /* Locked to send out the data */ 13245 struct sctp_stream_queue_pending *sp; 13246 13247 sp = TAILQ_LAST(&asoc->locked_on_sending->outqueue, sctp_streamhead); 13248 if (sp) { 13249 if ((sp->length == 0) && (sp->msg_is_complete == 0)) 13250 asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT; 13251 } 13252 } 13253 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 13254 if (TAILQ_EMPTY(&asoc->send_queue) && 13255 TAILQ_EMPTY(&asoc->sent_queue) && 13256 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 13257 abort_anyway: 13258 if (free_cnt_applied) { 13259 atomic_add_int(&stcb->asoc.refcnt, -1); 13260 free_cnt_applied = 0; 13261 } 13262 sctp_abort_an_association(stcb->sctp_ep, stcb, 13263 NULL, SCTP_SO_LOCKED); 13264 /* 13265 * now relock the stcb so everything 13266 * is sane 13267 */ 13268 hold_tcblock = 0; 13269 stcb = NULL; 13270 goto out; 13271 } 13272 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13273 asoc->primary_destination); 13274 sctp_feature_off(inp, SCTP_PCB_FLAGS_NODELAY); 13275 } 13276 } 13277 } 13278skip_out_eof: 13279 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 13280 some_on_control = 1; 13281 } 13282 if (queue_only_for_init) { 13283 if (hold_tcblock == 0) { 13284 SCTP_TCB_LOCK(stcb); 13285 hold_tcblock = 1; 13286 } 13287 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) { 13288 /* a collision took us forward? */ 13289 queue_only = 0; 13290 } else { 13291 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13292 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_WAIT); 13293 queue_only = 1; 13294 } 13295 } 13296 if ((net->flight_size > net->cwnd) && 13297 (stcb->asoc.sctp_cmt_on_off == 0)) { 13298 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13299 queue_only = 1; 13300 } else if (asoc->ifp_had_enobuf) { 13301 SCTP_STAT_INCR(sctps_ifnomemqueued); 13302 if (net->flight_size > (2 * net->mtu)) { 13303 queue_only = 1; 13304 } 13305 asoc->ifp_had_enobuf = 0; 13306 } 13307 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 13308 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 13309 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13310 (stcb->asoc.total_flight > 0) && 13311 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13312 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13313 /*- 13314 * Ok, Nagle is set on and we have data outstanding. 13315 * Don't send anything and let SACKs drive out the 13316 * data unless wen have a "full" segment to send. 13317 */ 13318 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13319 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13320 } 13321 SCTP_STAT_INCR(sctps_naglequeued); 13322 nagle_applies = 1; 13323 } else { 13324 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13325 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13326 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13327 } 13328 SCTP_STAT_INCR(sctps_naglesent); 13329 nagle_applies = 0; 13330 } 13331 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13332 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13333 nagle_applies, un_sent); 13334 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13335 stcb->asoc.total_flight, 13336 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13337 } 13338 if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) { 13339 /* we can attempt to send too. */ 13340 if (hold_tcblock == 0) { 13341 /* 13342 * If there is activity recv'ing sacks no need to 13343 * send 13344 */ 13345 if (SCTP_TCB_TRYLOCK(stcb)) { 13346 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13347 hold_tcblock = 1; 13348 } 13349 } else { 13350 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13351 } 13352 } else if ((queue_only == 0) && 13353 (stcb->asoc.peers_rwnd == 0) && 13354 (stcb->asoc.total_flight == 0)) { 13355 /* We get to have a probe outstanding */ 13356 if (hold_tcblock == 0) { 13357 hold_tcblock = 1; 13358 SCTP_TCB_LOCK(stcb); 13359 } 13360 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13361 } else if (some_on_control) { 13362 int num_out, reason, frag_point; 13363 13364 /* Here we do control only */ 13365 if (hold_tcblock == 0) { 13366 hold_tcblock = 1; 13367 SCTP_TCB_LOCK(stcb); 13368 } 13369 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 13370 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 13371 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_LOCKED); 13372 } 13373 SCTPDBG(SCTP_DEBUG_OUTPUT1, "USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d err:%d\n", 13374 queue_only, stcb->asoc.peers_rwnd, un_sent, 13375 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue, 13376 stcb->asoc.total_output_queue_size, error); 13377 13378out: 13379out_unlocked: 13380 13381 if (local_soresv && stcb) { 13382 atomic_subtract_int(&stcb->asoc.sb_send_resv, sndlen); 13383 } 13384 if (create_lock_applied) { 13385 SCTP_ASOC_CREATE_UNLOCK(inp); 13386 } 13387 if ((stcb) && hold_tcblock) { 13388 SCTP_TCB_UNLOCK(stcb); 13389 } 13390 if (stcb && free_cnt_applied) { 13391 atomic_add_int(&stcb->asoc.refcnt, -1); 13392 } 13393#ifdef INVARIANTS 13394 if (stcb) { 13395 if (mtx_owned(&stcb->tcb_mtx)) { 13396 panic("Leaving with tcb mtx owned?"); 13397 } 13398 if (mtx_owned(&stcb->tcb_send_mtx)) { 13399 panic("Leaving with tcb send mtx owned?"); 13400 } 13401 } 13402#endif 13403#ifdef INVARIANTS 13404 if (inp) { 13405 sctp_validate_no_locks(inp); 13406 } else { 13407 SCTP_PRINTF("Warning - inp is NULL so cant validate locks\n"); 13408 } 13409#endif 13410 if (top) { 13411 sctp_m_freem(top); 13412 } 13413 if (control) { 13414 sctp_m_freem(control); 13415 } 13416 return (error); 13417} 13418 13419 13420/* 13421 * generate an AUTHentication chunk, if required 13422 */ 13423struct mbuf * 13424sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end, 13425 struct sctp_auth_chunk **auth_ret, uint32_t * offset, 13426 struct sctp_tcb *stcb, uint8_t chunk) 13427{ 13428 struct mbuf *m_auth; 13429 struct sctp_auth_chunk *auth; 13430 int chunk_len; 13431 struct mbuf *cn; 13432 13433 if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) || 13434 (stcb == NULL)) 13435 return (m); 13436 13437 if (stcb->asoc.auth_supported == 0) { 13438 return (m); 13439 } 13440 /* does the requested chunk require auth? */ 13441 if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) { 13442 return (m); 13443 } 13444 m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_NOWAIT, 1, MT_HEADER); 13445 if (m_auth == NULL) { 13446 /* no mbuf's */ 13447 return (m); 13448 } 13449 /* reserve some space if this will be the first mbuf */ 13450 if (m == NULL) 13451 SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD); 13452 /* fill in the AUTH chunk details */ 13453 auth = mtod(m_auth, struct sctp_auth_chunk *); 13454 bzero(auth, sizeof(*auth)); 13455 auth->ch.chunk_type = SCTP_AUTHENTICATION; 13456 auth->ch.chunk_flags = 0; 13457 chunk_len = sizeof(*auth) + 13458 sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id); 13459 auth->ch.chunk_length = htons(chunk_len); 13460 auth->hmac_id = htons(stcb->asoc.peer_hmac_id); 13461 /* key id and hmac digest will be computed and filled in upon send */ 13462 13463 /* save the offset where the auth was inserted into the chain */ 13464 *offset = 0; 13465 for (cn = m; cn; cn = SCTP_BUF_NEXT(cn)) { 13466 *offset += SCTP_BUF_LEN(cn); 13467 } 13468 13469 /* update length and return pointer to the auth chunk */ 13470 SCTP_BUF_LEN(m_auth) = chunk_len; 13471 m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0); 13472 if (auth_ret != NULL) 13473 *auth_ret = auth; 13474 13475 return (m); 13476} 13477 13478#ifdef INET6 13479int 13480sctp_v6src_match_nexthop(struct sockaddr_in6 *src6, sctp_route_t * ro) 13481{ 13482 struct nd_prefix *pfx = NULL; 13483 struct nd_pfxrouter *pfxrtr = NULL; 13484 struct sockaddr_in6 gw6; 13485 13486 if (ro == NULL || ro->ro_rt == NULL || src6->sin6_family != AF_INET6) 13487 return (0); 13488 13489 /* get prefix entry of address */ 13490 LIST_FOREACH(pfx, &MODULE_GLOBAL(nd_prefix), ndpr_entry) { 13491 if (pfx->ndpr_stateflags & NDPRF_DETACHED) 13492 continue; 13493 if (IN6_ARE_MASKED_ADDR_EQUAL(&pfx->ndpr_prefix.sin6_addr, 13494 &src6->sin6_addr, &pfx->ndpr_mask)) 13495 break; 13496 } 13497 /* no prefix entry in the prefix list */ 13498 if (pfx == NULL) { 13499 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefix entry for "); 13500 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13501 return (0); 13502 } 13503 SCTPDBG(SCTP_DEBUG_OUTPUT2, "v6src_match_nexthop(), Prefix entry is "); 13504 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13505 13506 /* search installed gateway from prefix entry */ 13507 LIST_FOREACH(pfxrtr, &pfx->ndpr_advrtrs, pfr_entry) { 13508 memset(&gw6, 0, sizeof(struct sockaddr_in6)); 13509 gw6.sin6_family = AF_INET6; 13510 gw6.sin6_len = sizeof(struct sockaddr_in6); 13511 memcpy(&gw6.sin6_addr, &pfxrtr->router->rtaddr, 13512 sizeof(struct in6_addr)); 13513 SCTPDBG(SCTP_DEBUG_OUTPUT2, "prefix router is "); 13514 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&gw6); 13515 SCTPDBG(SCTP_DEBUG_OUTPUT2, "installed router is "); 13516 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway); 13517 if (sctp_cmpaddr((struct sockaddr *)&gw6, 13518 ro->ro_rt->rt_gateway)) { 13519 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is installed\n"); 13520 return (1); 13521 } 13522 } 13523 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is not installed\n"); 13524 return (0); 13525} 13526 13527#endif 13528 13529int 13530sctp_v4src_match_nexthop(struct sctp_ifa *sifa, sctp_route_t * ro) 13531{ 13532#ifdef INET 13533 struct sockaddr_in *sin, *mask; 13534 struct ifaddr *ifa; 13535 struct in_addr srcnetaddr, gwnetaddr; 13536 13537 if (ro == NULL || ro->ro_rt == NULL || 13538 sifa->address.sa.sa_family != AF_INET) { 13539 return (0); 13540 } 13541 ifa = (struct ifaddr *)sifa->ifa; 13542 mask = (struct sockaddr_in *)(ifa->ifa_netmask); 13543 sin = &sifa->address.sin; 13544 srcnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13545 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: src address is "); 13546 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 13547 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", srcnetaddr.s_addr); 13548 13549 sin = (struct sockaddr_in *)ro->ro_rt->rt_gateway; 13550 gwnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13551 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: nexthop is "); 13552 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway); 13553 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", gwnetaddr.s_addr); 13554 if (srcnetaddr.s_addr == gwnetaddr.s_addr) { 13555 return (1); 13556 } 13557#endif 13558 return (0); 13559} 13560