1/*- 2 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 3 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 4 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions are met: 8 * 9 * a) Redistributions of source code must retain the above copyright notice, 10 * this list of conditions and the following disclaimer. 11 * 12 * b) Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the distribution. 15 * 16 * c) Neither the name of Cisco Systems, Inc. nor the names of its 17 * contributors may be used to endorse or promote products derived 18 * from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 24 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 30 * THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33#include <sys/cdefs.h> 34__FBSDID("$FreeBSD: stable/11/sys/netinet/sctp_output.c 364948 2020-08-29 06:55:10Z tuexen $"); 35 36#include <netinet/sctp_os.h> 37#include <sys/proc.h> 38#include <netinet/sctp_var.h> 39#include <netinet/sctp_sysctl.h> 40#include <netinet/sctp_header.h> 41#include <netinet/sctp_pcb.h> 42#include <netinet/sctputil.h> 43#include <netinet/sctp_output.h> 44#include <netinet/sctp_uio.h> 45#include <netinet/sctputil.h> 46#include <netinet/sctp_auth.h> 47#include <netinet/sctp_timer.h> 48#include <netinet/sctp_asconf.h> 49#include <netinet/sctp_indata.h> 50#include <netinet/sctp_bsd_addr.h> 51#include <netinet/sctp_input.h> 52#include <netinet/sctp_crc32.h> 53#if defined(INET) || defined(INET6) 54#include <netinet/udp.h> 55#endif 56#include <netinet/udp_var.h> 57#include <machine/in_cksum.h> 58 59 60 61#define SCTP_MAX_GAPS_INARRAY 4 62struct sack_track { 63 uint8_t right_edge; /* mergable on the right edge */ 64 uint8_t left_edge; /* mergable on the left edge */ 65 uint8_t num_entries; 66 uint8_t spare; 67 struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY]; 68}; 69 70const struct sack_track sack_array[256] = { 71 {0, 0, 0, 0, /* 0x00 */ 72 {{0, 0}, 73 {0, 0}, 74 {0, 0}, 75 {0, 0} 76 } 77 }, 78 {1, 0, 1, 0, /* 0x01 */ 79 {{0, 0}, 80 {0, 0}, 81 {0, 0}, 82 {0, 0} 83 } 84 }, 85 {0, 0, 1, 0, /* 0x02 */ 86 {{1, 1}, 87 {0, 0}, 88 {0, 0}, 89 {0, 0} 90 } 91 }, 92 {1, 0, 1, 0, /* 0x03 */ 93 {{0, 1}, 94 {0, 0}, 95 {0, 0}, 96 {0, 0} 97 } 98 }, 99 {0, 0, 1, 0, /* 0x04 */ 100 {{2, 2}, 101 {0, 0}, 102 {0, 0}, 103 {0, 0} 104 } 105 }, 106 {1, 0, 2, 0, /* 0x05 */ 107 {{0, 0}, 108 {2, 2}, 109 {0, 0}, 110 {0, 0} 111 } 112 }, 113 {0, 0, 1, 0, /* 0x06 */ 114 {{1, 2}, 115 {0, 0}, 116 {0, 0}, 117 {0, 0} 118 } 119 }, 120 {1, 0, 1, 0, /* 0x07 */ 121 {{0, 2}, 122 {0, 0}, 123 {0, 0}, 124 {0, 0} 125 } 126 }, 127 {0, 0, 1, 0, /* 0x08 */ 128 {{3, 3}, 129 {0, 0}, 130 {0, 0}, 131 {0, 0} 132 } 133 }, 134 {1, 0, 2, 0, /* 0x09 */ 135 {{0, 0}, 136 {3, 3}, 137 {0, 0}, 138 {0, 0} 139 } 140 }, 141 {0, 0, 2, 0, /* 0x0a */ 142 {{1, 1}, 143 {3, 3}, 144 {0, 0}, 145 {0, 0} 146 } 147 }, 148 {1, 0, 2, 0, /* 0x0b */ 149 {{0, 1}, 150 {3, 3}, 151 {0, 0}, 152 {0, 0} 153 } 154 }, 155 {0, 0, 1, 0, /* 0x0c */ 156 {{2, 3}, 157 {0, 0}, 158 {0, 0}, 159 {0, 0} 160 } 161 }, 162 {1, 0, 2, 0, /* 0x0d */ 163 {{0, 0}, 164 {2, 3}, 165 {0, 0}, 166 {0, 0} 167 } 168 }, 169 {0, 0, 1, 0, /* 0x0e */ 170 {{1, 3}, 171 {0, 0}, 172 {0, 0}, 173 {0, 0} 174 } 175 }, 176 {1, 0, 1, 0, /* 0x0f */ 177 {{0, 3}, 178 {0, 0}, 179 {0, 0}, 180 {0, 0} 181 } 182 }, 183 {0, 0, 1, 0, /* 0x10 */ 184 {{4, 4}, 185 {0, 0}, 186 {0, 0}, 187 {0, 0} 188 } 189 }, 190 {1, 0, 2, 0, /* 0x11 */ 191 {{0, 0}, 192 {4, 4}, 193 {0, 0}, 194 {0, 0} 195 } 196 }, 197 {0, 0, 2, 0, /* 0x12 */ 198 {{1, 1}, 199 {4, 4}, 200 {0, 0}, 201 {0, 0} 202 } 203 }, 204 {1, 0, 2, 0, /* 0x13 */ 205 {{0, 1}, 206 {4, 4}, 207 {0, 0}, 208 {0, 0} 209 } 210 }, 211 {0, 0, 2, 0, /* 0x14 */ 212 {{2, 2}, 213 {4, 4}, 214 {0, 0}, 215 {0, 0} 216 } 217 }, 218 {1, 0, 3, 0, /* 0x15 */ 219 {{0, 0}, 220 {2, 2}, 221 {4, 4}, 222 {0, 0} 223 } 224 }, 225 {0, 0, 2, 0, /* 0x16 */ 226 {{1, 2}, 227 {4, 4}, 228 {0, 0}, 229 {0, 0} 230 } 231 }, 232 {1, 0, 2, 0, /* 0x17 */ 233 {{0, 2}, 234 {4, 4}, 235 {0, 0}, 236 {0, 0} 237 } 238 }, 239 {0, 0, 1, 0, /* 0x18 */ 240 {{3, 4}, 241 {0, 0}, 242 {0, 0}, 243 {0, 0} 244 } 245 }, 246 {1, 0, 2, 0, /* 0x19 */ 247 {{0, 0}, 248 {3, 4}, 249 {0, 0}, 250 {0, 0} 251 } 252 }, 253 {0, 0, 2, 0, /* 0x1a */ 254 {{1, 1}, 255 {3, 4}, 256 {0, 0}, 257 {0, 0} 258 } 259 }, 260 {1, 0, 2, 0, /* 0x1b */ 261 {{0, 1}, 262 {3, 4}, 263 {0, 0}, 264 {0, 0} 265 } 266 }, 267 {0, 0, 1, 0, /* 0x1c */ 268 {{2, 4}, 269 {0, 0}, 270 {0, 0}, 271 {0, 0} 272 } 273 }, 274 {1, 0, 2, 0, /* 0x1d */ 275 {{0, 0}, 276 {2, 4}, 277 {0, 0}, 278 {0, 0} 279 } 280 }, 281 {0, 0, 1, 0, /* 0x1e */ 282 {{1, 4}, 283 {0, 0}, 284 {0, 0}, 285 {0, 0} 286 } 287 }, 288 {1, 0, 1, 0, /* 0x1f */ 289 {{0, 4}, 290 {0, 0}, 291 {0, 0}, 292 {0, 0} 293 } 294 }, 295 {0, 0, 1, 0, /* 0x20 */ 296 {{5, 5}, 297 {0, 0}, 298 {0, 0}, 299 {0, 0} 300 } 301 }, 302 {1, 0, 2, 0, /* 0x21 */ 303 {{0, 0}, 304 {5, 5}, 305 {0, 0}, 306 {0, 0} 307 } 308 }, 309 {0, 0, 2, 0, /* 0x22 */ 310 {{1, 1}, 311 {5, 5}, 312 {0, 0}, 313 {0, 0} 314 } 315 }, 316 {1, 0, 2, 0, /* 0x23 */ 317 {{0, 1}, 318 {5, 5}, 319 {0, 0}, 320 {0, 0} 321 } 322 }, 323 {0, 0, 2, 0, /* 0x24 */ 324 {{2, 2}, 325 {5, 5}, 326 {0, 0}, 327 {0, 0} 328 } 329 }, 330 {1, 0, 3, 0, /* 0x25 */ 331 {{0, 0}, 332 {2, 2}, 333 {5, 5}, 334 {0, 0} 335 } 336 }, 337 {0, 0, 2, 0, /* 0x26 */ 338 {{1, 2}, 339 {5, 5}, 340 {0, 0}, 341 {0, 0} 342 } 343 }, 344 {1, 0, 2, 0, /* 0x27 */ 345 {{0, 2}, 346 {5, 5}, 347 {0, 0}, 348 {0, 0} 349 } 350 }, 351 {0, 0, 2, 0, /* 0x28 */ 352 {{3, 3}, 353 {5, 5}, 354 {0, 0}, 355 {0, 0} 356 } 357 }, 358 {1, 0, 3, 0, /* 0x29 */ 359 {{0, 0}, 360 {3, 3}, 361 {5, 5}, 362 {0, 0} 363 } 364 }, 365 {0, 0, 3, 0, /* 0x2a */ 366 {{1, 1}, 367 {3, 3}, 368 {5, 5}, 369 {0, 0} 370 } 371 }, 372 {1, 0, 3, 0, /* 0x2b */ 373 {{0, 1}, 374 {3, 3}, 375 {5, 5}, 376 {0, 0} 377 } 378 }, 379 {0, 0, 2, 0, /* 0x2c */ 380 {{2, 3}, 381 {5, 5}, 382 {0, 0}, 383 {0, 0} 384 } 385 }, 386 {1, 0, 3, 0, /* 0x2d */ 387 {{0, 0}, 388 {2, 3}, 389 {5, 5}, 390 {0, 0} 391 } 392 }, 393 {0, 0, 2, 0, /* 0x2e */ 394 {{1, 3}, 395 {5, 5}, 396 {0, 0}, 397 {0, 0} 398 } 399 }, 400 {1, 0, 2, 0, /* 0x2f */ 401 {{0, 3}, 402 {5, 5}, 403 {0, 0}, 404 {0, 0} 405 } 406 }, 407 {0, 0, 1, 0, /* 0x30 */ 408 {{4, 5}, 409 {0, 0}, 410 {0, 0}, 411 {0, 0} 412 } 413 }, 414 {1, 0, 2, 0, /* 0x31 */ 415 {{0, 0}, 416 {4, 5}, 417 {0, 0}, 418 {0, 0} 419 } 420 }, 421 {0, 0, 2, 0, /* 0x32 */ 422 {{1, 1}, 423 {4, 5}, 424 {0, 0}, 425 {0, 0} 426 } 427 }, 428 {1, 0, 2, 0, /* 0x33 */ 429 {{0, 1}, 430 {4, 5}, 431 {0, 0}, 432 {0, 0} 433 } 434 }, 435 {0, 0, 2, 0, /* 0x34 */ 436 {{2, 2}, 437 {4, 5}, 438 {0, 0}, 439 {0, 0} 440 } 441 }, 442 {1, 0, 3, 0, /* 0x35 */ 443 {{0, 0}, 444 {2, 2}, 445 {4, 5}, 446 {0, 0} 447 } 448 }, 449 {0, 0, 2, 0, /* 0x36 */ 450 {{1, 2}, 451 {4, 5}, 452 {0, 0}, 453 {0, 0} 454 } 455 }, 456 {1, 0, 2, 0, /* 0x37 */ 457 {{0, 2}, 458 {4, 5}, 459 {0, 0}, 460 {0, 0} 461 } 462 }, 463 {0, 0, 1, 0, /* 0x38 */ 464 {{3, 5}, 465 {0, 0}, 466 {0, 0}, 467 {0, 0} 468 } 469 }, 470 {1, 0, 2, 0, /* 0x39 */ 471 {{0, 0}, 472 {3, 5}, 473 {0, 0}, 474 {0, 0} 475 } 476 }, 477 {0, 0, 2, 0, /* 0x3a */ 478 {{1, 1}, 479 {3, 5}, 480 {0, 0}, 481 {0, 0} 482 } 483 }, 484 {1, 0, 2, 0, /* 0x3b */ 485 {{0, 1}, 486 {3, 5}, 487 {0, 0}, 488 {0, 0} 489 } 490 }, 491 {0, 0, 1, 0, /* 0x3c */ 492 {{2, 5}, 493 {0, 0}, 494 {0, 0}, 495 {0, 0} 496 } 497 }, 498 {1, 0, 2, 0, /* 0x3d */ 499 {{0, 0}, 500 {2, 5}, 501 {0, 0}, 502 {0, 0} 503 } 504 }, 505 {0, 0, 1, 0, /* 0x3e */ 506 {{1, 5}, 507 {0, 0}, 508 {0, 0}, 509 {0, 0} 510 } 511 }, 512 {1, 0, 1, 0, /* 0x3f */ 513 {{0, 5}, 514 {0, 0}, 515 {0, 0}, 516 {0, 0} 517 } 518 }, 519 {0, 0, 1, 0, /* 0x40 */ 520 {{6, 6}, 521 {0, 0}, 522 {0, 0}, 523 {0, 0} 524 } 525 }, 526 {1, 0, 2, 0, /* 0x41 */ 527 {{0, 0}, 528 {6, 6}, 529 {0, 0}, 530 {0, 0} 531 } 532 }, 533 {0, 0, 2, 0, /* 0x42 */ 534 {{1, 1}, 535 {6, 6}, 536 {0, 0}, 537 {0, 0} 538 } 539 }, 540 {1, 0, 2, 0, /* 0x43 */ 541 {{0, 1}, 542 {6, 6}, 543 {0, 0}, 544 {0, 0} 545 } 546 }, 547 {0, 0, 2, 0, /* 0x44 */ 548 {{2, 2}, 549 {6, 6}, 550 {0, 0}, 551 {0, 0} 552 } 553 }, 554 {1, 0, 3, 0, /* 0x45 */ 555 {{0, 0}, 556 {2, 2}, 557 {6, 6}, 558 {0, 0} 559 } 560 }, 561 {0, 0, 2, 0, /* 0x46 */ 562 {{1, 2}, 563 {6, 6}, 564 {0, 0}, 565 {0, 0} 566 } 567 }, 568 {1, 0, 2, 0, /* 0x47 */ 569 {{0, 2}, 570 {6, 6}, 571 {0, 0}, 572 {0, 0} 573 } 574 }, 575 {0, 0, 2, 0, /* 0x48 */ 576 {{3, 3}, 577 {6, 6}, 578 {0, 0}, 579 {0, 0} 580 } 581 }, 582 {1, 0, 3, 0, /* 0x49 */ 583 {{0, 0}, 584 {3, 3}, 585 {6, 6}, 586 {0, 0} 587 } 588 }, 589 {0, 0, 3, 0, /* 0x4a */ 590 {{1, 1}, 591 {3, 3}, 592 {6, 6}, 593 {0, 0} 594 } 595 }, 596 {1, 0, 3, 0, /* 0x4b */ 597 {{0, 1}, 598 {3, 3}, 599 {6, 6}, 600 {0, 0} 601 } 602 }, 603 {0, 0, 2, 0, /* 0x4c */ 604 {{2, 3}, 605 {6, 6}, 606 {0, 0}, 607 {0, 0} 608 } 609 }, 610 {1, 0, 3, 0, /* 0x4d */ 611 {{0, 0}, 612 {2, 3}, 613 {6, 6}, 614 {0, 0} 615 } 616 }, 617 {0, 0, 2, 0, /* 0x4e */ 618 {{1, 3}, 619 {6, 6}, 620 {0, 0}, 621 {0, 0} 622 } 623 }, 624 {1, 0, 2, 0, /* 0x4f */ 625 {{0, 3}, 626 {6, 6}, 627 {0, 0}, 628 {0, 0} 629 } 630 }, 631 {0, 0, 2, 0, /* 0x50 */ 632 {{4, 4}, 633 {6, 6}, 634 {0, 0}, 635 {0, 0} 636 } 637 }, 638 {1, 0, 3, 0, /* 0x51 */ 639 {{0, 0}, 640 {4, 4}, 641 {6, 6}, 642 {0, 0} 643 } 644 }, 645 {0, 0, 3, 0, /* 0x52 */ 646 {{1, 1}, 647 {4, 4}, 648 {6, 6}, 649 {0, 0} 650 } 651 }, 652 {1, 0, 3, 0, /* 0x53 */ 653 {{0, 1}, 654 {4, 4}, 655 {6, 6}, 656 {0, 0} 657 } 658 }, 659 {0, 0, 3, 0, /* 0x54 */ 660 {{2, 2}, 661 {4, 4}, 662 {6, 6}, 663 {0, 0} 664 } 665 }, 666 {1, 0, 4, 0, /* 0x55 */ 667 {{0, 0}, 668 {2, 2}, 669 {4, 4}, 670 {6, 6} 671 } 672 }, 673 {0, 0, 3, 0, /* 0x56 */ 674 {{1, 2}, 675 {4, 4}, 676 {6, 6}, 677 {0, 0} 678 } 679 }, 680 {1, 0, 3, 0, /* 0x57 */ 681 {{0, 2}, 682 {4, 4}, 683 {6, 6}, 684 {0, 0} 685 } 686 }, 687 {0, 0, 2, 0, /* 0x58 */ 688 {{3, 4}, 689 {6, 6}, 690 {0, 0}, 691 {0, 0} 692 } 693 }, 694 {1, 0, 3, 0, /* 0x59 */ 695 {{0, 0}, 696 {3, 4}, 697 {6, 6}, 698 {0, 0} 699 } 700 }, 701 {0, 0, 3, 0, /* 0x5a */ 702 {{1, 1}, 703 {3, 4}, 704 {6, 6}, 705 {0, 0} 706 } 707 }, 708 {1, 0, 3, 0, /* 0x5b */ 709 {{0, 1}, 710 {3, 4}, 711 {6, 6}, 712 {0, 0} 713 } 714 }, 715 {0, 0, 2, 0, /* 0x5c */ 716 {{2, 4}, 717 {6, 6}, 718 {0, 0}, 719 {0, 0} 720 } 721 }, 722 {1, 0, 3, 0, /* 0x5d */ 723 {{0, 0}, 724 {2, 4}, 725 {6, 6}, 726 {0, 0} 727 } 728 }, 729 {0, 0, 2, 0, /* 0x5e */ 730 {{1, 4}, 731 {6, 6}, 732 {0, 0}, 733 {0, 0} 734 } 735 }, 736 {1, 0, 2, 0, /* 0x5f */ 737 {{0, 4}, 738 {6, 6}, 739 {0, 0}, 740 {0, 0} 741 } 742 }, 743 {0, 0, 1, 0, /* 0x60 */ 744 {{5, 6}, 745 {0, 0}, 746 {0, 0}, 747 {0, 0} 748 } 749 }, 750 {1, 0, 2, 0, /* 0x61 */ 751 {{0, 0}, 752 {5, 6}, 753 {0, 0}, 754 {0, 0} 755 } 756 }, 757 {0, 0, 2, 0, /* 0x62 */ 758 {{1, 1}, 759 {5, 6}, 760 {0, 0}, 761 {0, 0} 762 } 763 }, 764 {1, 0, 2, 0, /* 0x63 */ 765 {{0, 1}, 766 {5, 6}, 767 {0, 0}, 768 {0, 0} 769 } 770 }, 771 {0, 0, 2, 0, /* 0x64 */ 772 {{2, 2}, 773 {5, 6}, 774 {0, 0}, 775 {0, 0} 776 } 777 }, 778 {1, 0, 3, 0, /* 0x65 */ 779 {{0, 0}, 780 {2, 2}, 781 {5, 6}, 782 {0, 0} 783 } 784 }, 785 {0, 0, 2, 0, /* 0x66 */ 786 {{1, 2}, 787 {5, 6}, 788 {0, 0}, 789 {0, 0} 790 } 791 }, 792 {1, 0, 2, 0, /* 0x67 */ 793 {{0, 2}, 794 {5, 6}, 795 {0, 0}, 796 {0, 0} 797 } 798 }, 799 {0, 0, 2, 0, /* 0x68 */ 800 {{3, 3}, 801 {5, 6}, 802 {0, 0}, 803 {0, 0} 804 } 805 }, 806 {1, 0, 3, 0, /* 0x69 */ 807 {{0, 0}, 808 {3, 3}, 809 {5, 6}, 810 {0, 0} 811 } 812 }, 813 {0, 0, 3, 0, /* 0x6a */ 814 {{1, 1}, 815 {3, 3}, 816 {5, 6}, 817 {0, 0} 818 } 819 }, 820 {1, 0, 3, 0, /* 0x6b */ 821 {{0, 1}, 822 {3, 3}, 823 {5, 6}, 824 {0, 0} 825 } 826 }, 827 {0, 0, 2, 0, /* 0x6c */ 828 {{2, 3}, 829 {5, 6}, 830 {0, 0}, 831 {0, 0} 832 } 833 }, 834 {1, 0, 3, 0, /* 0x6d */ 835 {{0, 0}, 836 {2, 3}, 837 {5, 6}, 838 {0, 0} 839 } 840 }, 841 {0, 0, 2, 0, /* 0x6e */ 842 {{1, 3}, 843 {5, 6}, 844 {0, 0}, 845 {0, 0} 846 } 847 }, 848 {1, 0, 2, 0, /* 0x6f */ 849 {{0, 3}, 850 {5, 6}, 851 {0, 0}, 852 {0, 0} 853 } 854 }, 855 {0, 0, 1, 0, /* 0x70 */ 856 {{4, 6}, 857 {0, 0}, 858 {0, 0}, 859 {0, 0} 860 } 861 }, 862 {1, 0, 2, 0, /* 0x71 */ 863 {{0, 0}, 864 {4, 6}, 865 {0, 0}, 866 {0, 0} 867 } 868 }, 869 {0, 0, 2, 0, /* 0x72 */ 870 {{1, 1}, 871 {4, 6}, 872 {0, 0}, 873 {0, 0} 874 } 875 }, 876 {1, 0, 2, 0, /* 0x73 */ 877 {{0, 1}, 878 {4, 6}, 879 {0, 0}, 880 {0, 0} 881 } 882 }, 883 {0, 0, 2, 0, /* 0x74 */ 884 {{2, 2}, 885 {4, 6}, 886 {0, 0}, 887 {0, 0} 888 } 889 }, 890 {1, 0, 3, 0, /* 0x75 */ 891 {{0, 0}, 892 {2, 2}, 893 {4, 6}, 894 {0, 0} 895 } 896 }, 897 {0, 0, 2, 0, /* 0x76 */ 898 {{1, 2}, 899 {4, 6}, 900 {0, 0}, 901 {0, 0} 902 } 903 }, 904 {1, 0, 2, 0, /* 0x77 */ 905 {{0, 2}, 906 {4, 6}, 907 {0, 0}, 908 {0, 0} 909 } 910 }, 911 {0, 0, 1, 0, /* 0x78 */ 912 {{3, 6}, 913 {0, 0}, 914 {0, 0}, 915 {0, 0} 916 } 917 }, 918 {1, 0, 2, 0, /* 0x79 */ 919 {{0, 0}, 920 {3, 6}, 921 {0, 0}, 922 {0, 0} 923 } 924 }, 925 {0, 0, 2, 0, /* 0x7a */ 926 {{1, 1}, 927 {3, 6}, 928 {0, 0}, 929 {0, 0} 930 } 931 }, 932 {1, 0, 2, 0, /* 0x7b */ 933 {{0, 1}, 934 {3, 6}, 935 {0, 0}, 936 {0, 0} 937 } 938 }, 939 {0, 0, 1, 0, /* 0x7c */ 940 {{2, 6}, 941 {0, 0}, 942 {0, 0}, 943 {0, 0} 944 } 945 }, 946 {1, 0, 2, 0, /* 0x7d */ 947 {{0, 0}, 948 {2, 6}, 949 {0, 0}, 950 {0, 0} 951 } 952 }, 953 {0, 0, 1, 0, /* 0x7e */ 954 {{1, 6}, 955 {0, 0}, 956 {0, 0}, 957 {0, 0} 958 } 959 }, 960 {1, 0, 1, 0, /* 0x7f */ 961 {{0, 6}, 962 {0, 0}, 963 {0, 0}, 964 {0, 0} 965 } 966 }, 967 {0, 1, 1, 0, /* 0x80 */ 968 {{7, 7}, 969 {0, 0}, 970 {0, 0}, 971 {0, 0} 972 } 973 }, 974 {1, 1, 2, 0, /* 0x81 */ 975 {{0, 0}, 976 {7, 7}, 977 {0, 0}, 978 {0, 0} 979 } 980 }, 981 {0, 1, 2, 0, /* 0x82 */ 982 {{1, 1}, 983 {7, 7}, 984 {0, 0}, 985 {0, 0} 986 } 987 }, 988 {1, 1, 2, 0, /* 0x83 */ 989 {{0, 1}, 990 {7, 7}, 991 {0, 0}, 992 {0, 0} 993 } 994 }, 995 {0, 1, 2, 0, /* 0x84 */ 996 {{2, 2}, 997 {7, 7}, 998 {0, 0}, 999 {0, 0} 1000 } 1001 }, 1002 {1, 1, 3, 0, /* 0x85 */ 1003 {{0, 0}, 1004 {2, 2}, 1005 {7, 7}, 1006 {0, 0} 1007 } 1008 }, 1009 {0, 1, 2, 0, /* 0x86 */ 1010 {{1, 2}, 1011 {7, 7}, 1012 {0, 0}, 1013 {0, 0} 1014 } 1015 }, 1016 {1, 1, 2, 0, /* 0x87 */ 1017 {{0, 2}, 1018 {7, 7}, 1019 {0, 0}, 1020 {0, 0} 1021 } 1022 }, 1023 {0, 1, 2, 0, /* 0x88 */ 1024 {{3, 3}, 1025 {7, 7}, 1026 {0, 0}, 1027 {0, 0} 1028 } 1029 }, 1030 {1, 1, 3, 0, /* 0x89 */ 1031 {{0, 0}, 1032 {3, 3}, 1033 {7, 7}, 1034 {0, 0} 1035 } 1036 }, 1037 {0, 1, 3, 0, /* 0x8a */ 1038 {{1, 1}, 1039 {3, 3}, 1040 {7, 7}, 1041 {0, 0} 1042 } 1043 }, 1044 {1, 1, 3, 0, /* 0x8b */ 1045 {{0, 1}, 1046 {3, 3}, 1047 {7, 7}, 1048 {0, 0} 1049 } 1050 }, 1051 {0, 1, 2, 0, /* 0x8c */ 1052 {{2, 3}, 1053 {7, 7}, 1054 {0, 0}, 1055 {0, 0} 1056 } 1057 }, 1058 {1, 1, 3, 0, /* 0x8d */ 1059 {{0, 0}, 1060 {2, 3}, 1061 {7, 7}, 1062 {0, 0} 1063 } 1064 }, 1065 {0, 1, 2, 0, /* 0x8e */ 1066 {{1, 3}, 1067 {7, 7}, 1068 {0, 0}, 1069 {0, 0} 1070 } 1071 }, 1072 {1, 1, 2, 0, /* 0x8f */ 1073 {{0, 3}, 1074 {7, 7}, 1075 {0, 0}, 1076 {0, 0} 1077 } 1078 }, 1079 {0, 1, 2, 0, /* 0x90 */ 1080 {{4, 4}, 1081 {7, 7}, 1082 {0, 0}, 1083 {0, 0} 1084 } 1085 }, 1086 {1, 1, 3, 0, /* 0x91 */ 1087 {{0, 0}, 1088 {4, 4}, 1089 {7, 7}, 1090 {0, 0} 1091 } 1092 }, 1093 {0, 1, 3, 0, /* 0x92 */ 1094 {{1, 1}, 1095 {4, 4}, 1096 {7, 7}, 1097 {0, 0} 1098 } 1099 }, 1100 {1, 1, 3, 0, /* 0x93 */ 1101 {{0, 1}, 1102 {4, 4}, 1103 {7, 7}, 1104 {0, 0} 1105 } 1106 }, 1107 {0, 1, 3, 0, /* 0x94 */ 1108 {{2, 2}, 1109 {4, 4}, 1110 {7, 7}, 1111 {0, 0} 1112 } 1113 }, 1114 {1, 1, 4, 0, /* 0x95 */ 1115 {{0, 0}, 1116 {2, 2}, 1117 {4, 4}, 1118 {7, 7} 1119 } 1120 }, 1121 {0, 1, 3, 0, /* 0x96 */ 1122 {{1, 2}, 1123 {4, 4}, 1124 {7, 7}, 1125 {0, 0} 1126 } 1127 }, 1128 {1, 1, 3, 0, /* 0x97 */ 1129 {{0, 2}, 1130 {4, 4}, 1131 {7, 7}, 1132 {0, 0} 1133 } 1134 }, 1135 {0, 1, 2, 0, /* 0x98 */ 1136 {{3, 4}, 1137 {7, 7}, 1138 {0, 0}, 1139 {0, 0} 1140 } 1141 }, 1142 {1, 1, 3, 0, /* 0x99 */ 1143 {{0, 0}, 1144 {3, 4}, 1145 {7, 7}, 1146 {0, 0} 1147 } 1148 }, 1149 {0, 1, 3, 0, /* 0x9a */ 1150 {{1, 1}, 1151 {3, 4}, 1152 {7, 7}, 1153 {0, 0} 1154 } 1155 }, 1156 {1, 1, 3, 0, /* 0x9b */ 1157 {{0, 1}, 1158 {3, 4}, 1159 {7, 7}, 1160 {0, 0} 1161 } 1162 }, 1163 {0, 1, 2, 0, /* 0x9c */ 1164 {{2, 4}, 1165 {7, 7}, 1166 {0, 0}, 1167 {0, 0} 1168 } 1169 }, 1170 {1, 1, 3, 0, /* 0x9d */ 1171 {{0, 0}, 1172 {2, 4}, 1173 {7, 7}, 1174 {0, 0} 1175 } 1176 }, 1177 {0, 1, 2, 0, /* 0x9e */ 1178 {{1, 4}, 1179 {7, 7}, 1180 {0, 0}, 1181 {0, 0} 1182 } 1183 }, 1184 {1, 1, 2, 0, /* 0x9f */ 1185 {{0, 4}, 1186 {7, 7}, 1187 {0, 0}, 1188 {0, 0} 1189 } 1190 }, 1191 {0, 1, 2, 0, /* 0xa0 */ 1192 {{5, 5}, 1193 {7, 7}, 1194 {0, 0}, 1195 {0, 0} 1196 } 1197 }, 1198 {1, 1, 3, 0, /* 0xa1 */ 1199 {{0, 0}, 1200 {5, 5}, 1201 {7, 7}, 1202 {0, 0} 1203 } 1204 }, 1205 {0, 1, 3, 0, /* 0xa2 */ 1206 {{1, 1}, 1207 {5, 5}, 1208 {7, 7}, 1209 {0, 0} 1210 } 1211 }, 1212 {1, 1, 3, 0, /* 0xa3 */ 1213 {{0, 1}, 1214 {5, 5}, 1215 {7, 7}, 1216 {0, 0} 1217 } 1218 }, 1219 {0, 1, 3, 0, /* 0xa4 */ 1220 {{2, 2}, 1221 {5, 5}, 1222 {7, 7}, 1223 {0, 0} 1224 } 1225 }, 1226 {1, 1, 4, 0, /* 0xa5 */ 1227 {{0, 0}, 1228 {2, 2}, 1229 {5, 5}, 1230 {7, 7} 1231 } 1232 }, 1233 {0, 1, 3, 0, /* 0xa6 */ 1234 {{1, 2}, 1235 {5, 5}, 1236 {7, 7}, 1237 {0, 0} 1238 } 1239 }, 1240 {1, 1, 3, 0, /* 0xa7 */ 1241 {{0, 2}, 1242 {5, 5}, 1243 {7, 7}, 1244 {0, 0} 1245 } 1246 }, 1247 {0, 1, 3, 0, /* 0xa8 */ 1248 {{3, 3}, 1249 {5, 5}, 1250 {7, 7}, 1251 {0, 0} 1252 } 1253 }, 1254 {1, 1, 4, 0, /* 0xa9 */ 1255 {{0, 0}, 1256 {3, 3}, 1257 {5, 5}, 1258 {7, 7} 1259 } 1260 }, 1261 {0, 1, 4, 0, /* 0xaa */ 1262 {{1, 1}, 1263 {3, 3}, 1264 {5, 5}, 1265 {7, 7} 1266 } 1267 }, 1268 {1, 1, 4, 0, /* 0xab */ 1269 {{0, 1}, 1270 {3, 3}, 1271 {5, 5}, 1272 {7, 7} 1273 } 1274 }, 1275 {0, 1, 3, 0, /* 0xac */ 1276 {{2, 3}, 1277 {5, 5}, 1278 {7, 7}, 1279 {0, 0} 1280 } 1281 }, 1282 {1, 1, 4, 0, /* 0xad */ 1283 {{0, 0}, 1284 {2, 3}, 1285 {5, 5}, 1286 {7, 7} 1287 } 1288 }, 1289 {0, 1, 3, 0, /* 0xae */ 1290 {{1, 3}, 1291 {5, 5}, 1292 {7, 7}, 1293 {0, 0} 1294 } 1295 }, 1296 {1, 1, 3, 0, /* 0xaf */ 1297 {{0, 3}, 1298 {5, 5}, 1299 {7, 7}, 1300 {0, 0} 1301 } 1302 }, 1303 {0, 1, 2, 0, /* 0xb0 */ 1304 {{4, 5}, 1305 {7, 7}, 1306 {0, 0}, 1307 {0, 0} 1308 } 1309 }, 1310 {1, 1, 3, 0, /* 0xb1 */ 1311 {{0, 0}, 1312 {4, 5}, 1313 {7, 7}, 1314 {0, 0} 1315 } 1316 }, 1317 {0, 1, 3, 0, /* 0xb2 */ 1318 {{1, 1}, 1319 {4, 5}, 1320 {7, 7}, 1321 {0, 0} 1322 } 1323 }, 1324 {1, 1, 3, 0, /* 0xb3 */ 1325 {{0, 1}, 1326 {4, 5}, 1327 {7, 7}, 1328 {0, 0} 1329 } 1330 }, 1331 {0, 1, 3, 0, /* 0xb4 */ 1332 {{2, 2}, 1333 {4, 5}, 1334 {7, 7}, 1335 {0, 0} 1336 } 1337 }, 1338 {1, 1, 4, 0, /* 0xb5 */ 1339 {{0, 0}, 1340 {2, 2}, 1341 {4, 5}, 1342 {7, 7} 1343 } 1344 }, 1345 {0, 1, 3, 0, /* 0xb6 */ 1346 {{1, 2}, 1347 {4, 5}, 1348 {7, 7}, 1349 {0, 0} 1350 } 1351 }, 1352 {1, 1, 3, 0, /* 0xb7 */ 1353 {{0, 2}, 1354 {4, 5}, 1355 {7, 7}, 1356 {0, 0} 1357 } 1358 }, 1359 {0, 1, 2, 0, /* 0xb8 */ 1360 {{3, 5}, 1361 {7, 7}, 1362 {0, 0}, 1363 {0, 0} 1364 } 1365 }, 1366 {1, 1, 3, 0, /* 0xb9 */ 1367 {{0, 0}, 1368 {3, 5}, 1369 {7, 7}, 1370 {0, 0} 1371 } 1372 }, 1373 {0, 1, 3, 0, /* 0xba */ 1374 {{1, 1}, 1375 {3, 5}, 1376 {7, 7}, 1377 {0, 0} 1378 } 1379 }, 1380 {1, 1, 3, 0, /* 0xbb */ 1381 {{0, 1}, 1382 {3, 5}, 1383 {7, 7}, 1384 {0, 0} 1385 } 1386 }, 1387 {0, 1, 2, 0, /* 0xbc */ 1388 {{2, 5}, 1389 {7, 7}, 1390 {0, 0}, 1391 {0, 0} 1392 } 1393 }, 1394 {1, 1, 3, 0, /* 0xbd */ 1395 {{0, 0}, 1396 {2, 5}, 1397 {7, 7}, 1398 {0, 0} 1399 } 1400 }, 1401 {0, 1, 2, 0, /* 0xbe */ 1402 {{1, 5}, 1403 {7, 7}, 1404 {0, 0}, 1405 {0, 0} 1406 } 1407 }, 1408 {1, 1, 2, 0, /* 0xbf */ 1409 {{0, 5}, 1410 {7, 7}, 1411 {0, 0}, 1412 {0, 0} 1413 } 1414 }, 1415 {0, 1, 1, 0, /* 0xc0 */ 1416 {{6, 7}, 1417 {0, 0}, 1418 {0, 0}, 1419 {0, 0} 1420 } 1421 }, 1422 {1, 1, 2, 0, /* 0xc1 */ 1423 {{0, 0}, 1424 {6, 7}, 1425 {0, 0}, 1426 {0, 0} 1427 } 1428 }, 1429 {0, 1, 2, 0, /* 0xc2 */ 1430 {{1, 1}, 1431 {6, 7}, 1432 {0, 0}, 1433 {0, 0} 1434 } 1435 }, 1436 {1, 1, 2, 0, /* 0xc3 */ 1437 {{0, 1}, 1438 {6, 7}, 1439 {0, 0}, 1440 {0, 0} 1441 } 1442 }, 1443 {0, 1, 2, 0, /* 0xc4 */ 1444 {{2, 2}, 1445 {6, 7}, 1446 {0, 0}, 1447 {0, 0} 1448 } 1449 }, 1450 {1, 1, 3, 0, /* 0xc5 */ 1451 {{0, 0}, 1452 {2, 2}, 1453 {6, 7}, 1454 {0, 0} 1455 } 1456 }, 1457 {0, 1, 2, 0, /* 0xc6 */ 1458 {{1, 2}, 1459 {6, 7}, 1460 {0, 0}, 1461 {0, 0} 1462 } 1463 }, 1464 {1, 1, 2, 0, /* 0xc7 */ 1465 {{0, 2}, 1466 {6, 7}, 1467 {0, 0}, 1468 {0, 0} 1469 } 1470 }, 1471 {0, 1, 2, 0, /* 0xc8 */ 1472 {{3, 3}, 1473 {6, 7}, 1474 {0, 0}, 1475 {0, 0} 1476 } 1477 }, 1478 {1, 1, 3, 0, /* 0xc9 */ 1479 {{0, 0}, 1480 {3, 3}, 1481 {6, 7}, 1482 {0, 0} 1483 } 1484 }, 1485 {0, 1, 3, 0, /* 0xca */ 1486 {{1, 1}, 1487 {3, 3}, 1488 {6, 7}, 1489 {0, 0} 1490 } 1491 }, 1492 {1, 1, 3, 0, /* 0xcb */ 1493 {{0, 1}, 1494 {3, 3}, 1495 {6, 7}, 1496 {0, 0} 1497 } 1498 }, 1499 {0, 1, 2, 0, /* 0xcc */ 1500 {{2, 3}, 1501 {6, 7}, 1502 {0, 0}, 1503 {0, 0} 1504 } 1505 }, 1506 {1, 1, 3, 0, /* 0xcd */ 1507 {{0, 0}, 1508 {2, 3}, 1509 {6, 7}, 1510 {0, 0} 1511 } 1512 }, 1513 {0, 1, 2, 0, /* 0xce */ 1514 {{1, 3}, 1515 {6, 7}, 1516 {0, 0}, 1517 {0, 0} 1518 } 1519 }, 1520 {1, 1, 2, 0, /* 0xcf */ 1521 {{0, 3}, 1522 {6, 7}, 1523 {0, 0}, 1524 {0, 0} 1525 } 1526 }, 1527 {0, 1, 2, 0, /* 0xd0 */ 1528 {{4, 4}, 1529 {6, 7}, 1530 {0, 0}, 1531 {0, 0} 1532 } 1533 }, 1534 {1, 1, 3, 0, /* 0xd1 */ 1535 {{0, 0}, 1536 {4, 4}, 1537 {6, 7}, 1538 {0, 0} 1539 } 1540 }, 1541 {0, 1, 3, 0, /* 0xd2 */ 1542 {{1, 1}, 1543 {4, 4}, 1544 {6, 7}, 1545 {0, 0} 1546 } 1547 }, 1548 {1, 1, 3, 0, /* 0xd3 */ 1549 {{0, 1}, 1550 {4, 4}, 1551 {6, 7}, 1552 {0, 0} 1553 } 1554 }, 1555 {0, 1, 3, 0, /* 0xd4 */ 1556 {{2, 2}, 1557 {4, 4}, 1558 {6, 7}, 1559 {0, 0} 1560 } 1561 }, 1562 {1, 1, 4, 0, /* 0xd5 */ 1563 {{0, 0}, 1564 {2, 2}, 1565 {4, 4}, 1566 {6, 7} 1567 } 1568 }, 1569 {0, 1, 3, 0, /* 0xd6 */ 1570 {{1, 2}, 1571 {4, 4}, 1572 {6, 7}, 1573 {0, 0} 1574 } 1575 }, 1576 {1, 1, 3, 0, /* 0xd7 */ 1577 {{0, 2}, 1578 {4, 4}, 1579 {6, 7}, 1580 {0, 0} 1581 } 1582 }, 1583 {0, 1, 2, 0, /* 0xd8 */ 1584 {{3, 4}, 1585 {6, 7}, 1586 {0, 0}, 1587 {0, 0} 1588 } 1589 }, 1590 {1, 1, 3, 0, /* 0xd9 */ 1591 {{0, 0}, 1592 {3, 4}, 1593 {6, 7}, 1594 {0, 0} 1595 } 1596 }, 1597 {0, 1, 3, 0, /* 0xda */ 1598 {{1, 1}, 1599 {3, 4}, 1600 {6, 7}, 1601 {0, 0} 1602 } 1603 }, 1604 {1, 1, 3, 0, /* 0xdb */ 1605 {{0, 1}, 1606 {3, 4}, 1607 {6, 7}, 1608 {0, 0} 1609 } 1610 }, 1611 {0, 1, 2, 0, /* 0xdc */ 1612 {{2, 4}, 1613 {6, 7}, 1614 {0, 0}, 1615 {0, 0} 1616 } 1617 }, 1618 {1, 1, 3, 0, /* 0xdd */ 1619 {{0, 0}, 1620 {2, 4}, 1621 {6, 7}, 1622 {0, 0} 1623 } 1624 }, 1625 {0, 1, 2, 0, /* 0xde */ 1626 {{1, 4}, 1627 {6, 7}, 1628 {0, 0}, 1629 {0, 0} 1630 } 1631 }, 1632 {1, 1, 2, 0, /* 0xdf */ 1633 {{0, 4}, 1634 {6, 7}, 1635 {0, 0}, 1636 {0, 0} 1637 } 1638 }, 1639 {0, 1, 1, 0, /* 0xe0 */ 1640 {{5, 7}, 1641 {0, 0}, 1642 {0, 0}, 1643 {0, 0} 1644 } 1645 }, 1646 {1, 1, 2, 0, /* 0xe1 */ 1647 {{0, 0}, 1648 {5, 7}, 1649 {0, 0}, 1650 {0, 0} 1651 } 1652 }, 1653 {0, 1, 2, 0, /* 0xe2 */ 1654 {{1, 1}, 1655 {5, 7}, 1656 {0, 0}, 1657 {0, 0} 1658 } 1659 }, 1660 {1, 1, 2, 0, /* 0xe3 */ 1661 {{0, 1}, 1662 {5, 7}, 1663 {0, 0}, 1664 {0, 0} 1665 } 1666 }, 1667 {0, 1, 2, 0, /* 0xe4 */ 1668 {{2, 2}, 1669 {5, 7}, 1670 {0, 0}, 1671 {0, 0} 1672 } 1673 }, 1674 {1, 1, 3, 0, /* 0xe5 */ 1675 {{0, 0}, 1676 {2, 2}, 1677 {5, 7}, 1678 {0, 0} 1679 } 1680 }, 1681 {0, 1, 2, 0, /* 0xe6 */ 1682 {{1, 2}, 1683 {5, 7}, 1684 {0, 0}, 1685 {0, 0} 1686 } 1687 }, 1688 {1, 1, 2, 0, /* 0xe7 */ 1689 {{0, 2}, 1690 {5, 7}, 1691 {0, 0}, 1692 {0, 0} 1693 } 1694 }, 1695 {0, 1, 2, 0, /* 0xe8 */ 1696 {{3, 3}, 1697 {5, 7}, 1698 {0, 0}, 1699 {0, 0} 1700 } 1701 }, 1702 {1, 1, 3, 0, /* 0xe9 */ 1703 {{0, 0}, 1704 {3, 3}, 1705 {5, 7}, 1706 {0, 0} 1707 } 1708 }, 1709 {0, 1, 3, 0, /* 0xea */ 1710 {{1, 1}, 1711 {3, 3}, 1712 {5, 7}, 1713 {0, 0} 1714 } 1715 }, 1716 {1, 1, 3, 0, /* 0xeb */ 1717 {{0, 1}, 1718 {3, 3}, 1719 {5, 7}, 1720 {0, 0} 1721 } 1722 }, 1723 {0, 1, 2, 0, /* 0xec */ 1724 {{2, 3}, 1725 {5, 7}, 1726 {0, 0}, 1727 {0, 0} 1728 } 1729 }, 1730 {1, 1, 3, 0, /* 0xed */ 1731 {{0, 0}, 1732 {2, 3}, 1733 {5, 7}, 1734 {0, 0} 1735 } 1736 }, 1737 {0, 1, 2, 0, /* 0xee */ 1738 {{1, 3}, 1739 {5, 7}, 1740 {0, 0}, 1741 {0, 0} 1742 } 1743 }, 1744 {1, 1, 2, 0, /* 0xef */ 1745 {{0, 3}, 1746 {5, 7}, 1747 {0, 0}, 1748 {0, 0} 1749 } 1750 }, 1751 {0, 1, 1, 0, /* 0xf0 */ 1752 {{4, 7}, 1753 {0, 0}, 1754 {0, 0}, 1755 {0, 0} 1756 } 1757 }, 1758 {1, 1, 2, 0, /* 0xf1 */ 1759 {{0, 0}, 1760 {4, 7}, 1761 {0, 0}, 1762 {0, 0} 1763 } 1764 }, 1765 {0, 1, 2, 0, /* 0xf2 */ 1766 {{1, 1}, 1767 {4, 7}, 1768 {0, 0}, 1769 {0, 0} 1770 } 1771 }, 1772 {1, 1, 2, 0, /* 0xf3 */ 1773 {{0, 1}, 1774 {4, 7}, 1775 {0, 0}, 1776 {0, 0} 1777 } 1778 }, 1779 {0, 1, 2, 0, /* 0xf4 */ 1780 {{2, 2}, 1781 {4, 7}, 1782 {0, 0}, 1783 {0, 0} 1784 } 1785 }, 1786 {1, 1, 3, 0, /* 0xf5 */ 1787 {{0, 0}, 1788 {2, 2}, 1789 {4, 7}, 1790 {0, 0} 1791 } 1792 }, 1793 {0, 1, 2, 0, /* 0xf6 */ 1794 {{1, 2}, 1795 {4, 7}, 1796 {0, 0}, 1797 {0, 0} 1798 } 1799 }, 1800 {1, 1, 2, 0, /* 0xf7 */ 1801 {{0, 2}, 1802 {4, 7}, 1803 {0, 0}, 1804 {0, 0} 1805 } 1806 }, 1807 {0, 1, 1, 0, /* 0xf8 */ 1808 {{3, 7}, 1809 {0, 0}, 1810 {0, 0}, 1811 {0, 0} 1812 } 1813 }, 1814 {1, 1, 2, 0, /* 0xf9 */ 1815 {{0, 0}, 1816 {3, 7}, 1817 {0, 0}, 1818 {0, 0} 1819 } 1820 }, 1821 {0, 1, 2, 0, /* 0xfa */ 1822 {{1, 1}, 1823 {3, 7}, 1824 {0, 0}, 1825 {0, 0} 1826 } 1827 }, 1828 {1, 1, 2, 0, /* 0xfb */ 1829 {{0, 1}, 1830 {3, 7}, 1831 {0, 0}, 1832 {0, 0} 1833 } 1834 }, 1835 {0, 1, 1, 0, /* 0xfc */ 1836 {{2, 7}, 1837 {0, 0}, 1838 {0, 0}, 1839 {0, 0} 1840 } 1841 }, 1842 {1, 1, 2, 0, /* 0xfd */ 1843 {{0, 0}, 1844 {2, 7}, 1845 {0, 0}, 1846 {0, 0} 1847 } 1848 }, 1849 {0, 1, 1, 0, /* 0xfe */ 1850 {{1, 7}, 1851 {0, 0}, 1852 {0, 0}, 1853 {0, 0} 1854 } 1855 }, 1856 {1, 1, 1, 0, /* 0xff */ 1857 {{0, 7}, 1858 {0, 0}, 1859 {0, 0}, 1860 {0, 0} 1861 } 1862 } 1863}; 1864 1865 1866int 1867sctp_is_address_in_scope(struct sctp_ifa *ifa, 1868 struct sctp_scoping *scope, 1869 int do_update) 1870{ 1871 if ((scope->loopback_scope == 0) && 1872 (ifa->ifn_p) && SCTP_IFN_IS_IFT_LOOP(ifa->ifn_p)) { 1873 /* 1874 * skip loopback if not in scope * 1875 */ 1876 return (0); 1877 } 1878 switch (ifa->address.sa.sa_family) { 1879#ifdef INET 1880 case AF_INET: 1881 if (scope->ipv4_addr_legal) { 1882 struct sockaddr_in *sin; 1883 1884 sin = &ifa->address.sin; 1885 if (sin->sin_addr.s_addr == 0) { 1886 /* not in scope , unspecified */ 1887 return (0); 1888 } 1889 if ((scope->ipv4_local_scope == 0) && 1890 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 1891 /* private address not in scope */ 1892 return (0); 1893 } 1894 } else { 1895 return (0); 1896 } 1897 break; 1898#endif 1899#ifdef INET6 1900 case AF_INET6: 1901 if (scope->ipv6_addr_legal) { 1902 struct sockaddr_in6 *sin6; 1903 1904 /* 1905 * Must update the flags, bummer, which means any 1906 * IFA locks must now be applied HERE <-> 1907 */ 1908 if (do_update) { 1909 sctp_gather_internal_ifa_flags(ifa); 1910 } 1911 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 1912 return (0); 1913 } 1914 /* ok to use deprecated addresses? */ 1915 sin6 = &ifa->address.sin6; 1916 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1917 /* skip unspecifed addresses */ 1918 return (0); 1919 } 1920 if ( /* (local_scope == 0) && */ 1921 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) { 1922 return (0); 1923 } 1924 if ((scope->site_scope == 0) && 1925 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 1926 return (0); 1927 } 1928 } else { 1929 return (0); 1930 } 1931 break; 1932#endif 1933 default: 1934 return (0); 1935 } 1936 return (1); 1937} 1938 1939static struct mbuf * 1940sctp_add_addr_to_mbuf(struct mbuf *m, struct sctp_ifa *ifa, uint16_t *len) 1941{ 1942#if defined(INET) || defined(INET6) 1943 struct sctp_paramhdr *paramh; 1944 struct mbuf *mret; 1945 uint16_t plen; 1946#endif 1947 1948 switch (ifa->address.sa.sa_family) { 1949#ifdef INET 1950 case AF_INET: 1951 plen = (uint16_t)sizeof(struct sctp_ipv4addr_param); 1952 break; 1953#endif 1954#ifdef INET6 1955 case AF_INET6: 1956 plen = (uint16_t)sizeof(struct sctp_ipv6addr_param); 1957 break; 1958#endif 1959 default: 1960 return (m); 1961 } 1962#if defined(INET) || defined(INET6) 1963 if (M_TRAILINGSPACE(m) >= plen) { 1964 /* easy side we just drop it on the end */ 1965 paramh = (struct sctp_paramhdr *)(SCTP_BUF_AT(m, SCTP_BUF_LEN(m))); 1966 mret = m; 1967 } else { 1968 /* Need more space */ 1969 mret = m; 1970 while (SCTP_BUF_NEXT(mret) != NULL) { 1971 mret = SCTP_BUF_NEXT(mret); 1972 } 1973 SCTP_BUF_NEXT(mret) = sctp_get_mbuf_for_msg(plen, 0, M_NOWAIT, 1, MT_DATA); 1974 if (SCTP_BUF_NEXT(mret) == NULL) { 1975 /* We are hosed, can't add more addresses */ 1976 return (m); 1977 } 1978 mret = SCTP_BUF_NEXT(mret); 1979 paramh = mtod(mret, struct sctp_paramhdr *); 1980 } 1981 /* now add the parameter */ 1982 switch (ifa->address.sa.sa_family) { 1983#ifdef INET 1984 case AF_INET: 1985 { 1986 struct sctp_ipv4addr_param *ipv4p; 1987 struct sockaddr_in *sin; 1988 1989 sin = &ifa->address.sin; 1990 ipv4p = (struct sctp_ipv4addr_param *)paramh; 1991 paramh->param_type = htons(SCTP_IPV4_ADDRESS); 1992 paramh->param_length = htons(plen); 1993 ipv4p->addr = sin->sin_addr.s_addr; 1994 SCTP_BUF_LEN(mret) += plen; 1995 break; 1996 } 1997#endif 1998#ifdef INET6 1999 case AF_INET6: 2000 { 2001 struct sctp_ipv6addr_param *ipv6p; 2002 struct sockaddr_in6 *sin6; 2003 2004 sin6 = &ifa->address.sin6; 2005 ipv6p = (struct sctp_ipv6addr_param *)paramh; 2006 paramh->param_type = htons(SCTP_IPV6_ADDRESS); 2007 paramh->param_length = htons(plen); 2008 memcpy(ipv6p->addr, &sin6->sin6_addr, 2009 sizeof(ipv6p->addr)); 2010 /* clear embedded scope in the address */ 2011 in6_clearscope((struct in6_addr *)ipv6p->addr); 2012 SCTP_BUF_LEN(mret) += plen; 2013 break; 2014 } 2015#endif 2016 default: 2017 return (m); 2018 } 2019 if (len != NULL) { 2020 *len += plen; 2021 } 2022 return (mret); 2023#endif 2024} 2025 2026 2027struct mbuf * 2028sctp_add_addresses_to_i_ia(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2029 struct sctp_scoping *scope, 2030 struct mbuf *m_at, int cnt_inits_to, 2031 uint16_t *padding_len, uint16_t *chunk_len) 2032{ 2033 struct sctp_vrf *vrf = NULL; 2034 int cnt, limit_out = 0, total_count; 2035 uint32_t vrf_id; 2036 2037 vrf_id = inp->def_vrf_id; 2038 SCTP_IPI_ADDR_RLOCK(); 2039 vrf = sctp_find_vrf(vrf_id); 2040 if (vrf == NULL) { 2041 SCTP_IPI_ADDR_RUNLOCK(); 2042 return (m_at); 2043 } 2044 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 2045 struct sctp_ifa *sctp_ifap; 2046 struct sctp_ifn *sctp_ifnp; 2047 2048 cnt = cnt_inits_to; 2049 if (vrf->total_ifa_count > SCTP_COUNT_LIMIT) { 2050 limit_out = 1; 2051 cnt = SCTP_ADDRESS_LIMIT; 2052 goto skip_count; 2053 } 2054 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2055 if ((scope->loopback_scope == 0) && 2056 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2057 /* 2058 * Skip loopback devices if loopback_scope 2059 * not set 2060 */ 2061 continue; 2062 } 2063 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2064#ifdef INET 2065 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2066 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2067 &sctp_ifap->address.sin.sin_addr) != 0)) { 2068 continue; 2069 } 2070#endif 2071#ifdef INET6 2072 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2073 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2074 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2075 continue; 2076 } 2077#endif 2078 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2079 continue; 2080 } 2081 if (sctp_is_address_in_scope(sctp_ifap, scope, 1) == 0) { 2082 continue; 2083 } 2084 cnt++; 2085 if (cnt > SCTP_ADDRESS_LIMIT) { 2086 break; 2087 } 2088 } 2089 if (cnt > SCTP_ADDRESS_LIMIT) { 2090 break; 2091 } 2092 } 2093skip_count: 2094 if (cnt > 1) { 2095 total_count = 0; 2096 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2097 cnt = 0; 2098 if ((scope->loopback_scope == 0) && 2099 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2100 /* 2101 * Skip loopback devices if 2102 * loopback_scope not set 2103 */ 2104 continue; 2105 } 2106 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2107#ifdef INET 2108 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2109 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2110 &sctp_ifap->address.sin.sin_addr) != 0)) { 2111 continue; 2112 } 2113#endif 2114#ifdef INET6 2115 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2116 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2117 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2118 continue; 2119 } 2120#endif 2121 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2122 continue; 2123 } 2124 if (sctp_is_address_in_scope(sctp_ifap, 2125 scope, 0) == 0) { 2126 continue; 2127 } 2128 if ((chunk_len != NULL) && 2129 (padding_len != NULL) && 2130 (*padding_len > 0)) { 2131 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2132 SCTP_BUF_LEN(m_at) += *padding_len; 2133 *chunk_len += *padding_len; 2134 *padding_len = 0; 2135 } 2136 m_at = sctp_add_addr_to_mbuf(m_at, sctp_ifap, chunk_len); 2137 if (limit_out) { 2138 cnt++; 2139 total_count++; 2140 if (cnt >= 2) { 2141 /* 2142 * two from each 2143 * address 2144 */ 2145 break; 2146 } 2147 if (total_count > SCTP_ADDRESS_LIMIT) { 2148 /* No more addresses */ 2149 break; 2150 } 2151 } 2152 } 2153 } 2154 } 2155 } else { 2156 struct sctp_laddr *laddr; 2157 2158 cnt = cnt_inits_to; 2159 /* First, how many ? */ 2160 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2161 if (laddr->ifa == NULL) { 2162 continue; 2163 } 2164 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) 2165 /* 2166 * Address being deleted by the system, dont 2167 * list. 2168 */ 2169 continue; 2170 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2171 /* 2172 * Address being deleted on this ep don't 2173 * list. 2174 */ 2175 continue; 2176 } 2177 if (sctp_is_address_in_scope(laddr->ifa, 2178 scope, 1) == 0) { 2179 continue; 2180 } 2181 cnt++; 2182 } 2183 /* 2184 * To get through a NAT we only list addresses if we have 2185 * more than one. That way if you just bind a single address 2186 * we let the source of the init dictate our address. 2187 */ 2188 if (cnt > 1) { 2189 cnt = cnt_inits_to; 2190 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2191 if (laddr->ifa == NULL) { 2192 continue; 2193 } 2194 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) { 2195 continue; 2196 } 2197 if (sctp_is_address_in_scope(laddr->ifa, 2198 scope, 0) == 0) { 2199 continue; 2200 } 2201 if ((chunk_len != NULL) && 2202 (padding_len != NULL) && 2203 (*padding_len > 0)) { 2204 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2205 SCTP_BUF_LEN(m_at) += *padding_len; 2206 *chunk_len += *padding_len; 2207 *padding_len = 0; 2208 } 2209 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa, chunk_len); 2210 cnt++; 2211 if (cnt >= SCTP_ADDRESS_LIMIT) { 2212 break; 2213 } 2214 } 2215 } 2216 } 2217 SCTP_IPI_ADDR_RUNLOCK(); 2218 return (m_at); 2219} 2220 2221static struct sctp_ifa * 2222sctp_is_ifa_addr_preferred(struct sctp_ifa *ifa, 2223 uint8_t dest_is_loop, 2224 uint8_t dest_is_priv, 2225 sa_family_t fam) 2226{ 2227 uint8_t dest_is_global = 0; 2228 2229 /* dest_is_priv is true if destination is a private address */ 2230 /* dest_is_loop is true if destination is a loopback addresses */ 2231 2232 /** 2233 * Here we determine if its a preferred address. A preferred address 2234 * means it is the same scope or higher scope then the destination. 2235 * L = loopback, P = private, G = global 2236 * ----------------------------------------- 2237 * src | dest | result 2238 * ---------------------------------------- 2239 * L | L | yes 2240 * ----------------------------------------- 2241 * P | L | yes-v4 no-v6 2242 * ----------------------------------------- 2243 * G | L | yes-v4 no-v6 2244 * ----------------------------------------- 2245 * L | P | no 2246 * ----------------------------------------- 2247 * P | P | yes 2248 * ----------------------------------------- 2249 * G | P | no 2250 * ----------------------------------------- 2251 * L | G | no 2252 * ----------------------------------------- 2253 * P | G | no 2254 * ----------------------------------------- 2255 * G | G | yes 2256 * ----------------------------------------- 2257 */ 2258 2259 if (ifa->address.sa.sa_family != fam) { 2260 /* forget mis-matched family */ 2261 return (NULL); 2262 } 2263 if ((dest_is_priv == 0) && (dest_is_loop == 0)) { 2264 dest_is_global = 1; 2265 } 2266 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Is destination preferred:"); 2267 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ifa->address.sa); 2268 /* Ok the address may be ok */ 2269#ifdef INET6 2270 if (fam == AF_INET6) { 2271 /* ok to use deprecated addresses? no lets not! */ 2272 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2273 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:1\n"); 2274 return (NULL); 2275 } 2276 if (ifa->src_is_priv && !ifa->src_is_loop) { 2277 if (dest_is_loop) { 2278 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:2\n"); 2279 return (NULL); 2280 } 2281 } 2282 if (ifa->src_is_glob) { 2283 if (dest_is_loop) { 2284 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:3\n"); 2285 return (NULL); 2286 } 2287 } 2288 } 2289#endif 2290 /* 2291 * Now that we know what is what, implement or table this could in 2292 * theory be done slicker (it used to be), but this is 2293 * straightforward and easier to validate :-) 2294 */ 2295 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src_loop:%d src_priv:%d src_glob:%d\n", 2296 ifa->src_is_loop, ifa->src_is_priv, ifa->src_is_glob); 2297 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dest_loop:%d dest_priv:%d dest_glob:%d\n", 2298 dest_is_loop, dest_is_priv, dest_is_global); 2299 2300 if ((ifa->src_is_loop) && (dest_is_priv)) { 2301 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:4\n"); 2302 return (NULL); 2303 } 2304 if ((ifa->src_is_glob) && (dest_is_priv)) { 2305 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:5\n"); 2306 return (NULL); 2307 } 2308 if ((ifa->src_is_loop) && (dest_is_global)) { 2309 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:6\n"); 2310 return (NULL); 2311 } 2312 if ((ifa->src_is_priv) && (dest_is_global)) { 2313 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:7\n"); 2314 return (NULL); 2315 } 2316 SCTPDBG(SCTP_DEBUG_OUTPUT3, "YES\n"); 2317 /* its a preferred address */ 2318 return (ifa); 2319} 2320 2321static struct sctp_ifa * 2322sctp_is_ifa_addr_acceptable(struct sctp_ifa *ifa, 2323 uint8_t dest_is_loop, 2324 uint8_t dest_is_priv, 2325 sa_family_t fam) 2326{ 2327 uint8_t dest_is_global = 0; 2328 2329 /** 2330 * Here we determine if its a acceptable address. A acceptable 2331 * address means it is the same scope or higher scope but we can 2332 * allow for NAT which means its ok to have a global dest and a 2333 * private src. 2334 * 2335 * L = loopback, P = private, G = global 2336 * ----------------------------------------- 2337 * src | dest | result 2338 * ----------------------------------------- 2339 * L | L | yes 2340 * ----------------------------------------- 2341 * P | L | yes-v4 no-v6 2342 * ----------------------------------------- 2343 * G | L | yes 2344 * ----------------------------------------- 2345 * L | P | no 2346 * ----------------------------------------- 2347 * P | P | yes 2348 * ----------------------------------------- 2349 * G | P | yes - May not work 2350 * ----------------------------------------- 2351 * L | G | no 2352 * ----------------------------------------- 2353 * P | G | yes - May not work 2354 * ----------------------------------------- 2355 * G | G | yes 2356 * ----------------------------------------- 2357 */ 2358 2359 if (ifa->address.sa.sa_family != fam) { 2360 /* forget non matching family */ 2361 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa_fam:%d fam:%d\n", 2362 ifa->address.sa.sa_family, fam); 2363 return (NULL); 2364 } 2365 /* Ok the address may be ok */ 2366 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, &ifa->address.sa); 2367 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst_is_loop:%d dest_is_priv:%d\n", 2368 dest_is_loop, dest_is_priv); 2369 if ((dest_is_loop == 0) && (dest_is_priv == 0)) { 2370 dest_is_global = 1; 2371 } 2372#ifdef INET6 2373 if (fam == AF_INET6) { 2374 /* ok to use deprecated addresses? */ 2375 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2376 return (NULL); 2377 } 2378 if (ifa->src_is_priv) { 2379 /* Special case, linklocal to loop */ 2380 if (dest_is_loop) 2381 return (NULL); 2382 } 2383 } 2384#endif 2385 /* 2386 * Now that we know what is what, implement our table. This could in 2387 * theory be done slicker (it used to be), but this is 2388 * straightforward and easier to validate :-) 2389 */ 2390 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_priv:%d\n", 2391 ifa->src_is_loop, 2392 dest_is_priv); 2393 if ((ifa->src_is_loop == 1) && (dest_is_priv)) { 2394 return (NULL); 2395 } 2396 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_glob:%d\n", 2397 ifa->src_is_loop, 2398 dest_is_global); 2399 if ((ifa->src_is_loop == 1) && (dest_is_global)) { 2400 return (NULL); 2401 } 2402 SCTPDBG(SCTP_DEBUG_OUTPUT3, "address is acceptable\n"); 2403 /* its an acceptable address */ 2404 return (ifa); 2405} 2406 2407int 2408sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa) 2409{ 2410 struct sctp_laddr *laddr; 2411 2412 if (stcb == NULL) { 2413 /* There are no restrictions, no TCB :-) */ 2414 return (0); 2415 } 2416 LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) { 2417 if (laddr->ifa == NULL) { 2418 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2419 __func__); 2420 continue; 2421 } 2422 if (laddr->ifa == ifa) { 2423 /* Yes it is on the list */ 2424 return (1); 2425 } 2426 } 2427 return (0); 2428} 2429 2430 2431int 2432sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa) 2433{ 2434 struct sctp_laddr *laddr; 2435 2436 if (ifa == NULL) 2437 return (0); 2438 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2439 if (laddr->ifa == NULL) { 2440 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2441 __func__); 2442 continue; 2443 } 2444 if ((laddr->ifa == ifa) && laddr->action == 0) 2445 /* same pointer */ 2446 return (1); 2447 } 2448 return (0); 2449} 2450 2451 2452 2453static struct sctp_ifa * 2454sctp_choose_boundspecific_inp(struct sctp_inpcb *inp, 2455 sctp_route_t *ro, 2456 uint32_t vrf_id, 2457 int non_asoc_addr_ok, 2458 uint8_t dest_is_priv, 2459 uint8_t dest_is_loop, 2460 sa_family_t fam) 2461{ 2462 struct sctp_laddr *laddr, *starting_point; 2463 void *ifn; 2464 int resettotop = 0; 2465 struct sctp_ifn *sctp_ifn; 2466 struct sctp_ifa *sctp_ifa, *sifa; 2467 struct sctp_vrf *vrf; 2468 uint32_t ifn_index; 2469 2470 vrf = sctp_find_vrf(vrf_id); 2471 if (vrf == NULL) 2472 return (NULL); 2473 2474 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2475 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2476 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2477 /* 2478 * first question, is the ifn we will emit on in our list, if so, we 2479 * want such an address. Note that we first looked for a preferred 2480 * address. 2481 */ 2482 if (sctp_ifn) { 2483 /* is a preferred one on the interface we route out? */ 2484 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2485#ifdef INET 2486 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2487 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2488 &sctp_ifa->address.sin.sin_addr) != 0)) { 2489 continue; 2490 } 2491#endif 2492#ifdef INET6 2493 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2494 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2495 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2496 continue; 2497 } 2498#endif 2499 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2500 (non_asoc_addr_ok == 0)) 2501 continue; 2502 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, 2503 dest_is_loop, 2504 dest_is_priv, fam); 2505 if (sifa == NULL) 2506 continue; 2507 if (sctp_is_addr_in_ep(inp, sifa)) { 2508 atomic_add_int(&sifa->refcount, 1); 2509 return (sifa); 2510 } 2511 } 2512 } 2513 /* 2514 * ok, now we now need to find one on the list of the addresses. We 2515 * can't get one on the emitting interface so let's find first a 2516 * preferred one. If not that an acceptable one otherwise... we 2517 * return NULL. 2518 */ 2519 starting_point = inp->next_addr_touse; 2520once_again: 2521 if (inp->next_addr_touse == NULL) { 2522 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2523 resettotop = 1; 2524 } 2525 for (laddr = inp->next_addr_touse; laddr; 2526 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2527 if (laddr->ifa == NULL) { 2528 /* address has been removed */ 2529 continue; 2530 } 2531 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2532 /* address is being deleted */ 2533 continue; 2534 } 2535 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, 2536 dest_is_priv, fam); 2537 if (sifa == NULL) 2538 continue; 2539 atomic_add_int(&sifa->refcount, 1); 2540 return (sifa); 2541 } 2542 if (resettotop == 0) { 2543 inp->next_addr_touse = NULL; 2544 goto once_again; 2545 } 2546 2547 inp->next_addr_touse = starting_point; 2548 resettotop = 0; 2549once_again_too: 2550 if (inp->next_addr_touse == NULL) { 2551 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2552 resettotop = 1; 2553 } 2554 2555 /* ok, what about an acceptable address in the inp */ 2556 for (laddr = inp->next_addr_touse; laddr; 2557 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2558 if (laddr->ifa == NULL) { 2559 /* address has been removed */ 2560 continue; 2561 } 2562 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2563 /* address is being deleted */ 2564 continue; 2565 } 2566 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2567 dest_is_priv, fam); 2568 if (sifa == NULL) 2569 continue; 2570 atomic_add_int(&sifa->refcount, 1); 2571 return (sifa); 2572 } 2573 if (resettotop == 0) { 2574 inp->next_addr_touse = NULL; 2575 goto once_again_too; 2576 } 2577 2578 /* 2579 * no address bound can be a source for the destination we are in 2580 * trouble 2581 */ 2582 return (NULL); 2583} 2584 2585 2586 2587static struct sctp_ifa * 2588sctp_choose_boundspecific_stcb(struct sctp_inpcb *inp, 2589 struct sctp_tcb *stcb, 2590 sctp_route_t *ro, 2591 uint32_t vrf_id, 2592 uint8_t dest_is_priv, 2593 uint8_t dest_is_loop, 2594 int non_asoc_addr_ok, 2595 sa_family_t fam) 2596{ 2597 struct sctp_laddr *laddr, *starting_point; 2598 void *ifn; 2599 struct sctp_ifn *sctp_ifn; 2600 struct sctp_ifa *sctp_ifa, *sifa; 2601 uint8_t start_at_beginning = 0; 2602 struct sctp_vrf *vrf; 2603 uint32_t ifn_index; 2604 2605 /* 2606 * first question, is the ifn we will emit on in our list, if so, we 2607 * want that one. 2608 */ 2609 vrf = sctp_find_vrf(vrf_id); 2610 if (vrf == NULL) 2611 return (NULL); 2612 2613 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2614 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2615 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2616 2617 /* 2618 * first question, is the ifn we will emit on in our list? If so, 2619 * we want that one. First we look for a preferred. Second, we go 2620 * for an acceptable. 2621 */ 2622 if (sctp_ifn) { 2623 /* first try for a preferred address on the ep */ 2624 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2625#ifdef INET 2626 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2627 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2628 &sctp_ifa->address.sin.sin_addr) != 0)) { 2629 continue; 2630 } 2631#endif 2632#ifdef INET6 2633 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2634 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2635 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2636 continue; 2637 } 2638#endif 2639 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2640 continue; 2641 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2642 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2643 if (sifa == NULL) 2644 continue; 2645 if (((non_asoc_addr_ok == 0) && 2646 (sctp_is_addr_restricted(stcb, sifa))) || 2647 (non_asoc_addr_ok && 2648 (sctp_is_addr_restricted(stcb, sifa)) && 2649 (!sctp_is_addr_pending(stcb, sifa)))) { 2650 /* on the no-no list */ 2651 continue; 2652 } 2653 atomic_add_int(&sifa->refcount, 1); 2654 return (sifa); 2655 } 2656 } 2657 /* next try for an acceptable address on the ep */ 2658 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2659#ifdef INET 2660 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2661 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2662 &sctp_ifa->address.sin.sin_addr) != 0)) { 2663 continue; 2664 } 2665#endif 2666#ifdef INET6 2667 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2668 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2669 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2670 continue; 2671 } 2672#endif 2673 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2674 continue; 2675 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2676 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2677 if (sifa == NULL) 2678 continue; 2679 if (((non_asoc_addr_ok == 0) && 2680 (sctp_is_addr_restricted(stcb, sifa))) || 2681 (non_asoc_addr_ok && 2682 (sctp_is_addr_restricted(stcb, sifa)) && 2683 (!sctp_is_addr_pending(stcb, sifa)))) { 2684 /* on the no-no list */ 2685 continue; 2686 } 2687 atomic_add_int(&sifa->refcount, 1); 2688 return (sifa); 2689 } 2690 } 2691 2692 } 2693 /* 2694 * if we can't find one like that then we must look at all addresses 2695 * bound to pick one at first preferable then secondly acceptable. 2696 */ 2697 starting_point = stcb->asoc.last_used_address; 2698sctp_from_the_top: 2699 if (stcb->asoc.last_used_address == NULL) { 2700 start_at_beginning = 1; 2701 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2702 } 2703 /* search beginning with the last used address */ 2704 for (laddr = stcb->asoc.last_used_address; laddr; 2705 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2706 if (laddr->ifa == NULL) { 2707 /* address has been removed */ 2708 continue; 2709 } 2710 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2711 /* address is being deleted */ 2712 continue; 2713 } 2714 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, dest_is_priv, fam); 2715 if (sifa == NULL) 2716 continue; 2717 if (((non_asoc_addr_ok == 0) && 2718 (sctp_is_addr_restricted(stcb, sifa))) || 2719 (non_asoc_addr_ok && 2720 (sctp_is_addr_restricted(stcb, sifa)) && 2721 (!sctp_is_addr_pending(stcb, sifa)))) { 2722 /* on the no-no list */ 2723 continue; 2724 } 2725 stcb->asoc.last_used_address = laddr; 2726 atomic_add_int(&sifa->refcount, 1); 2727 return (sifa); 2728 } 2729 if (start_at_beginning == 0) { 2730 stcb->asoc.last_used_address = NULL; 2731 goto sctp_from_the_top; 2732 } 2733 /* now try for any higher scope than the destination */ 2734 stcb->asoc.last_used_address = starting_point; 2735 start_at_beginning = 0; 2736sctp_from_the_top2: 2737 if (stcb->asoc.last_used_address == NULL) { 2738 start_at_beginning = 1; 2739 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2740 } 2741 /* search beginning with the last used address */ 2742 for (laddr = stcb->asoc.last_used_address; laddr; 2743 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2744 if (laddr->ifa == NULL) { 2745 /* address has been removed */ 2746 continue; 2747 } 2748 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2749 /* address is being deleted */ 2750 continue; 2751 } 2752 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2753 dest_is_priv, fam); 2754 if (sifa == NULL) 2755 continue; 2756 if (((non_asoc_addr_ok == 0) && 2757 (sctp_is_addr_restricted(stcb, sifa))) || 2758 (non_asoc_addr_ok && 2759 (sctp_is_addr_restricted(stcb, sifa)) && 2760 (!sctp_is_addr_pending(stcb, sifa)))) { 2761 /* on the no-no list */ 2762 continue; 2763 } 2764 stcb->asoc.last_used_address = laddr; 2765 atomic_add_int(&sifa->refcount, 1); 2766 return (sifa); 2767 } 2768 if (start_at_beginning == 0) { 2769 stcb->asoc.last_used_address = NULL; 2770 goto sctp_from_the_top2; 2771 } 2772 return (NULL); 2773} 2774 2775static struct sctp_ifa * 2776sctp_select_nth_preferred_addr_from_ifn_boundall(struct sctp_ifn *ifn, 2777 struct sctp_inpcb *inp, 2778 struct sctp_tcb *stcb, 2779 int non_asoc_addr_ok, 2780 uint8_t dest_is_loop, 2781 uint8_t dest_is_priv, 2782 int addr_wanted, 2783 sa_family_t fam, 2784 sctp_route_t *ro 2785) 2786{ 2787 struct sctp_ifa *ifa, *sifa; 2788 int num_eligible_addr = 0; 2789#ifdef INET6 2790 struct sockaddr_in6 sin6, lsa6; 2791 2792 if (fam == AF_INET6) { 2793 memcpy(&sin6, &ro->ro_dst, sizeof(struct sockaddr_in6)); 2794 (void)sa6_recoverscope(&sin6); 2795 } 2796#endif /* INET6 */ 2797 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2798#ifdef INET 2799 if ((ifa->address.sa.sa_family == AF_INET) && 2800 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2801 &ifa->address.sin.sin_addr) != 0)) { 2802 continue; 2803 } 2804#endif 2805#ifdef INET6 2806 if ((ifa->address.sa.sa_family == AF_INET6) && 2807 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2808 &ifa->address.sin6.sin6_addr) != 0)) { 2809 continue; 2810 } 2811#endif 2812 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2813 (non_asoc_addr_ok == 0)) 2814 continue; 2815 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2816 dest_is_priv, fam); 2817 if (sifa == NULL) 2818 continue; 2819#ifdef INET6 2820 if (fam == AF_INET6 && 2821 dest_is_loop && 2822 sifa->src_is_loop && sifa->src_is_priv) { 2823 /* 2824 * don't allow fe80::1 to be a src on loop ::1, we 2825 * don't list it to the peer so we will get an 2826 * abort. 2827 */ 2828 continue; 2829 } 2830 if (fam == AF_INET6 && 2831 IN6_IS_ADDR_LINKLOCAL(&sifa->address.sin6.sin6_addr) && 2832 IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) { 2833 /* 2834 * link-local <-> link-local must belong to the same 2835 * scope. 2836 */ 2837 memcpy(&lsa6, &sifa->address.sin6, sizeof(struct sockaddr_in6)); 2838 (void)sa6_recoverscope(&lsa6); 2839 if (sin6.sin6_scope_id != lsa6.sin6_scope_id) { 2840 continue; 2841 } 2842 } 2843#endif /* INET6 */ 2844 2845 /* 2846 * Check if the IPv6 address matches to next-hop. In the 2847 * mobile case, old IPv6 address may be not deleted from the 2848 * interface. Then, the interface has previous and new 2849 * addresses. We should use one corresponding to the 2850 * next-hop. (by micchie) 2851 */ 2852#ifdef INET6 2853 if (stcb && fam == AF_INET6 && 2854 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2855 if (sctp_v6src_match_nexthop(&sifa->address.sin6, ro) 2856 == 0) { 2857 continue; 2858 } 2859 } 2860#endif 2861#ifdef INET 2862 /* Avoid topologically incorrect IPv4 address */ 2863 if (stcb && fam == AF_INET && 2864 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2865 if (sctp_v4src_match_nexthop(sifa, ro) == 0) { 2866 continue; 2867 } 2868 } 2869#endif 2870 if (stcb) { 2871 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2872 continue; 2873 } 2874 if (((non_asoc_addr_ok == 0) && 2875 (sctp_is_addr_restricted(stcb, sifa))) || 2876 (non_asoc_addr_ok && 2877 (sctp_is_addr_restricted(stcb, sifa)) && 2878 (!sctp_is_addr_pending(stcb, sifa)))) { 2879 /* 2880 * It is restricted for some reason.. 2881 * probably not yet added. 2882 */ 2883 continue; 2884 } 2885 } 2886 if (num_eligible_addr >= addr_wanted) { 2887 return (sifa); 2888 } 2889 num_eligible_addr++; 2890 } 2891 return (NULL); 2892} 2893 2894 2895static int 2896sctp_count_num_preferred_boundall(struct sctp_ifn *ifn, 2897 struct sctp_inpcb *inp, 2898 struct sctp_tcb *stcb, 2899 int non_asoc_addr_ok, 2900 uint8_t dest_is_loop, 2901 uint8_t dest_is_priv, 2902 sa_family_t fam) 2903{ 2904 struct sctp_ifa *ifa, *sifa; 2905 int num_eligible_addr = 0; 2906 2907 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2908#ifdef INET 2909 if ((ifa->address.sa.sa_family == AF_INET) && 2910 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2911 &ifa->address.sin.sin_addr) != 0)) { 2912 continue; 2913 } 2914#endif 2915#ifdef INET6 2916 if ((ifa->address.sa.sa_family == AF_INET6) && 2917 (stcb != NULL) && 2918 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2919 &ifa->address.sin6.sin6_addr) != 0)) { 2920 continue; 2921 } 2922#endif 2923 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2924 (non_asoc_addr_ok == 0)) { 2925 continue; 2926 } 2927 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2928 dest_is_priv, fam); 2929 if (sifa == NULL) { 2930 continue; 2931 } 2932 if (stcb) { 2933 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2934 continue; 2935 } 2936 if (((non_asoc_addr_ok == 0) && 2937 (sctp_is_addr_restricted(stcb, sifa))) || 2938 (non_asoc_addr_ok && 2939 (sctp_is_addr_restricted(stcb, sifa)) && 2940 (!sctp_is_addr_pending(stcb, sifa)))) { 2941 /* 2942 * It is restricted for some reason.. 2943 * probably not yet added. 2944 */ 2945 continue; 2946 } 2947 } 2948 num_eligible_addr++; 2949 } 2950 return (num_eligible_addr); 2951} 2952 2953static struct sctp_ifa * 2954sctp_choose_boundall(struct sctp_inpcb *inp, 2955 struct sctp_tcb *stcb, 2956 struct sctp_nets *net, 2957 sctp_route_t *ro, 2958 uint32_t vrf_id, 2959 uint8_t dest_is_priv, 2960 uint8_t dest_is_loop, 2961 int non_asoc_addr_ok, 2962 sa_family_t fam) 2963{ 2964 int cur_addr_num = 0, num_preferred = 0; 2965 void *ifn; 2966 struct sctp_ifn *sctp_ifn, *looked_at = NULL, *emit_ifn; 2967 struct sctp_ifa *sctp_ifa, *sifa; 2968 uint32_t ifn_index; 2969 struct sctp_vrf *vrf; 2970#ifdef INET 2971 int retried = 0; 2972#endif 2973 2974 /*- 2975 * For boundall we can use any address in the association. 2976 * If non_asoc_addr_ok is set we can use any address (at least in 2977 * theory). So we look for preferred addresses first. If we find one, 2978 * we use it. Otherwise we next try to get an address on the 2979 * interface, which we should be able to do (unless non_asoc_addr_ok 2980 * is false and we are routed out that way). In these cases where we 2981 * can't use the address of the interface we go through all the 2982 * ifn's looking for an address we can use and fill that in. Punting 2983 * means we send back address 0, which will probably cause problems 2984 * actually since then IP will fill in the address of the route ifn, 2985 * which means we probably already rejected it.. i.e. here comes an 2986 * abort :-<. 2987 */ 2988 vrf = sctp_find_vrf(vrf_id); 2989 if (vrf == NULL) 2990 return (NULL); 2991 2992 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2993 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2994 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn from route:%p ifn_index:%d\n", ifn, ifn_index); 2995 emit_ifn = looked_at = sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2996 if (sctp_ifn == NULL) { 2997 /* ?? We don't have this guy ?? */ 2998 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No ifn emit interface?\n"); 2999 goto bound_all_plan_b; 3000 } 3001 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn_index:%d name:%s is emit interface\n", 3002 ifn_index, sctp_ifn->ifn_name); 3003 3004 if (net) { 3005 cur_addr_num = net->indx_of_eligible_next_to_use; 3006 } 3007 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, 3008 inp, stcb, 3009 non_asoc_addr_ok, 3010 dest_is_loop, 3011 dest_is_priv, fam); 3012 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Found %d preferred source addresses for intf:%s\n", 3013 num_preferred, sctp_ifn->ifn_name); 3014 if (num_preferred == 0) { 3015 /* 3016 * no eligible addresses, we must use some other interface 3017 * address if we can find one. 3018 */ 3019 goto bound_all_plan_b; 3020 } 3021 /* 3022 * Ok we have num_eligible_addr set with how many we can use, this 3023 * may vary from call to call due to addresses being deprecated 3024 * etc.. 3025 */ 3026 if (cur_addr_num >= num_preferred) { 3027 cur_addr_num = 0; 3028 } 3029 /* 3030 * select the nth address from the list (where cur_addr_num is the 3031 * nth) and 0 is the first one, 1 is the second one etc... 3032 */ 3033 SCTPDBG(SCTP_DEBUG_OUTPUT2, "cur_addr_num:%d\n", cur_addr_num); 3034 3035 sctp_ifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3036 dest_is_priv, cur_addr_num, fam, ro); 3037 3038 /* if sctp_ifa is NULL something changed??, fall to plan b. */ 3039 if (sctp_ifa) { 3040 atomic_add_int(&sctp_ifa->refcount, 1); 3041 if (net) { 3042 /* save off where the next one we will want */ 3043 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3044 } 3045 return (sctp_ifa); 3046 } 3047 /* 3048 * plan_b: Look at all interfaces and find a preferred address. If 3049 * no preferred fall through to plan_c. 3050 */ 3051bound_all_plan_b: 3052 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan B\n"); 3053 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3054 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Examine interface %s\n", 3055 sctp_ifn->ifn_name); 3056 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3057 /* wrong base scope */ 3058 SCTPDBG(SCTP_DEBUG_OUTPUT2, "skip\n"); 3059 continue; 3060 } 3061 if ((sctp_ifn == looked_at) && looked_at) { 3062 /* already looked at this guy */ 3063 SCTPDBG(SCTP_DEBUG_OUTPUT2, "already seen\n"); 3064 continue; 3065 } 3066 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, 3067 dest_is_loop, dest_is_priv, fam); 3068 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3069 "Found ifn:%p %d preferred source addresses\n", 3070 ifn, num_preferred); 3071 if (num_preferred == 0) { 3072 /* None on this interface. */ 3073 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No preferred -- skipping to next\n"); 3074 continue; 3075 } 3076 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3077 "num preferred:%d on interface:%p cur_addr_num:%d\n", 3078 num_preferred, (void *)sctp_ifn, cur_addr_num); 3079 3080 /* 3081 * Ok we have num_eligible_addr set with how many we can 3082 * use, this may vary from call to call due to addresses 3083 * being deprecated etc.. 3084 */ 3085 if (cur_addr_num >= num_preferred) { 3086 cur_addr_num = 0; 3087 } 3088 sifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3089 dest_is_priv, cur_addr_num, fam, ro); 3090 if (sifa == NULL) 3091 continue; 3092 if (net) { 3093 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3094 SCTPDBG(SCTP_DEBUG_OUTPUT2, "we selected %d\n", 3095 cur_addr_num); 3096 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Source:"); 3097 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 3098 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Dest:"); 3099 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &net->ro._l_addr.sa); 3100 } 3101 atomic_add_int(&sifa->refcount, 1); 3102 return (sifa); 3103 } 3104#ifdef INET 3105again_with_private_addresses_allowed: 3106#endif 3107 /* plan_c: do we have an acceptable address on the emit interface */ 3108 sifa = NULL; 3109 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan C: find acceptable on interface\n"); 3110 if (emit_ifn == NULL) { 3111 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jump to Plan D - no emit_ifn\n"); 3112 goto plan_d; 3113 } 3114 LIST_FOREACH(sctp_ifa, &emit_ifn->ifalist, next_ifa) { 3115 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifa:%p\n", (void *)sctp_ifa); 3116#ifdef INET 3117 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3118 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3119 &sctp_ifa->address.sin.sin_addr) != 0)) { 3120 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3121 continue; 3122 } 3123#endif 3124#ifdef INET6 3125 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3126 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3127 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3128 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3129 continue; 3130 } 3131#endif 3132 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3133 (non_asoc_addr_ok == 0)) { 3134 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Defer\n"); 3135 continue; 3136 } 3137 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, 3138 dest_is_priv, fam); 3139 if (sifa == NULL) { 3140 SCTPDBG(SCTP_DEBUG_OUTPUT2, "IFA not acceptable\n"); 3141 continue; 3142 } 3143 if (stcb) { 3144 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3145 SCTPDBG(SCTP_DEBUG_OUTPUT2, "NOT in scope\n"); 3146 sifa = NULL; 3147 continue; 3148 } 3149 if (((non_asoc_addr_ok == 0) && 3150 (sctp_is_addr_restricted(stcb, sifa))) || 3151 (non_asoc_addr_ok && 3152 (sctp_is_addr_restricted(stcb, sifa)) && 3153 (!sctp_is_addr_pending(stcb, sifa)))) { 3154 /* 3155 * It is restricted for some reason.. 3156 * probably not yet added. 3157 */ 3158 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Its restricted\n"); 3159 sifa = NULL; 3160 continue; 3161 } 3162 } 3163 atomic_add_int(&sifa->refcount, 1); 3164 goto out; 3165 } 3166plan_d: 3167 /* 3168 * plan_d: We are in trouble. No preferred address on the emit 3169 * interface. And not even a preferred address on all interfaces. Go 3170 * out and see if we can find an acceptable address somewhere 3171 * amongst all interfaces. 3172 */ 3173 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan D looked_at is %p\n", (void *)looked_at); 3174 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3175 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3176 /* wrong base scope */ 3177 continue; 3178 } 3179 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3180#ifdef INET 3181 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3182 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3183 &sctp_ifa->address.sin.sin_addr) != 0)) { 3184 continue; 3185 } 3186#endif 3187#ifdef INET6 3188 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3189 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3190 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3191 continue; 3192 } 3193#endif 3194 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3195 (non_asoc_addr_ok == 0)) 3196 continue; 3197 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3198 dest_is_loop, 3199 dest_is_priv, fam); 3200 if (sifa == NULL) 3201 continue; 3202 if (stcb) { 3203 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3204 sifa = NULL; 3205 continue; 3206 } 3207 if (((non_asoc_addr_ok == 0) && 3208 (sctp_is_addr_restricted(stcb, sifa))) || 3209 (non_asoc_addr_ok && 3210 (sctp_is_addr_restricted(stcb, sifa)) && 3211 (!sctp_is_addr_pending(stcb, sifa)))) { 3212 /* 3213 * It is restricted for some 3214 * reason.. probably not yet added. 3215 */ 3216 sifa = NULL; 3217 continue; 3218 } 3219 } 3220 goto out; 3221 } 3222 } 3223#ifdef INET 3224 if (stcb) { 3225 if ((retried == 0) && (stcb->asoc.scope.ipv4_local_scope == 0)) { 3226 stcb->asoc.scope.ipv4_local_scope = 1; 3227 retried = 1; 3228 goto again_with_private_addresses_allowed; 3229 } else if (retried == 1) { 3230 stcb->asoc.scope.ipv4_local_scope = 0; 3231 } 3232 } 3233#endif 3234out: 3235#ifdef INET 3236 if (sifa) { 3237 if (retried == 1) { 3238 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3239 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3240 /* wrong base scope */ 3241 continue; 3242 } 3243 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3244 struct sctp_ifa *tmp_sifa; 3245 3246#ifdef INET 3247 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3248 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3249 &sctp_ifa->address.sin.sin_addr) != 0)) { 3250 continue; 3251 } 3252#endif 3253#ifdef INET6 3254 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3255 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3256 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3257 continue; 3258 } 3259#endif 3260 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3261 (non_asoc_addr_ok == 0)) 3262 continue; 3263 tmp_sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3264 dest_is_loop, 3265 dest_is_priv, fam); 3266 if (tmp_sifa == NULL) { 3267 continue; 3268 } 3269 if (tmp_sifa == sifa) { 3270 continue; 3271 } 3272 if (stcb) { 3273 if (sctp_is_address_in_scope(tmp_sifa, 3274 &stcb->asoc.scope, 0) == 0) { 3275 continue; 3276 } 3277 if (((non_asoc_addr_ok == 0) && 3278 (sctp_is_addr_restricted(stcb, tmp_sifa))) || 3279 (non_asoc_addr_ok && 3280 (sctp_is_addr_restricted(stcb, tmp_sifa)) && 3281 (!sctp_is_addr_pending(stcb, tmp_sifa)))) { 3282 /* 3283 * It is restricted 3284 * for some reason.. 3285 * probably not yet 3286 * added. 3287 */ 3288 continue; 3289 } 3290 } 3291 if ((tmp_sifa->address.sin.sin_family == AF_INET) && 3292 (IN4_ISPRIVATE_ADDRESS(&(tmp_sifa->address.sin.sin_addr)))) { 3293 sctp_add_local_addr_restricted(stcb, tmp_sifa); 3294 } 3295 } 3296 } 3297 } 3298 atomic_add_int(&sifa->refcount, 1); 3299 } 3300#endif 3301 return (sifa); 3302} 3303 3304 3305 3306/* tcb may be NULL */ 3307struct sctp_ifa * 3308sctp_source_address_selection(struct sctp_inpcb *inp, 3309 struct sctp_tcb *stcb, 3310 sctp_route_t *ro, 3311 struct sctp_nets *net, 3312 int non_asoc_addr_ok, uint32_t vrf_id) 3313{ 3314 struct sctp_ifa *answer; 3315 uint8_t dest_is_priv, dest_is_loop; 3316 sa_family_t fam; 3317#ifdef INET 3318 struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst; 3319#endif 3320#ifdef INET6 3321 struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&ro->ro_dst; 3322#endif 3323 3324 /** 3325 * Rules: 3326 * - Find the route if needed, cache if I can. 3327 * - Look at interface address in route, Is it in the bound list. If so we 3328 * have the best source. 3329 * - If not we must rotate amongst the addresses. 3330 * 3331 * Cavets and issues 3332 * 3333 * Do we need to pay attention to scope. We can have a private address 3334 * or a global address we are sourcing or sending to. So if we draw 3335 * it out 3336 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3337 * For V4 3338 * ------------------------------------------ 3339 * source * dest * result 3340 * ----------------------------------------- 3341 * <a> Private * Global * NAT 3342 * ----------------------------------------- 3343 * <b> Private * Private * No problem 3344 * ----------------------------------------- 3345 * <c> Global * Private * Huh, How will this work? 3346 * ----------------------------------------- 3347 * <d> Global * Global * No Problem 3348 *------------------------------------------ 3349 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3350 * For V6 3351 *------------------------------------------ 3352 * source * dest * result 3353 * ----------------------------------------- 3354 * <a> Linklocal * Global * 3355 * ----------------------------------------- 3356 * <b> Linklocal * Linklocal * No problem 3357 * ----------------------------------------- 3358 * <c> Global * Linklocal * Huh, How will this work? 3359 * ----------------------------------------- 3360 * <d> Global * Global * No Problem 3361 *------------------------------------------ 3362 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3363 * 3364 * And then we add to that what happens if there are multiple addresses 3365 * assigned to an interface. Remember the ifa on a ifn is a linked 3366 * list of addresses. So one interface can have more than one IP 3367 * address. What happens if we have both a private and a global 3368 * address? Do we then use context of destination to sort out which 3369 * one is best? And what about NAT's sending P->G may get you a NAT 3370 * translation, or should you select the G thats on the interface in 3371 * preference. 3372 * 3373 * Decisions: 3374 * 3375 * - count the number of addresses on the interface. 3376 * - if it is one, no problem except case <c>. 3377 * For <a> we will assume a NAT out there. 3378 * - if there are more than one, then we need to worry about scope P 3379 * or G. We should prefer G -> G and P -> P if possible. 3380 * Then as a secondary fall back to mixed types G->P being a last 3381 * ditch one. 3382 * - The above all works for bound all, but bound specific we need to 3383 * use the same concept but instead only consider the bound 3384 * addresses. If the bound set is NOT assigned to the interface then 3385 * we must use rotation amongst the bound addresses.. 3386 */ 3387 if (ro->ro_rt == NULL) { 3388 /* 3389 * Need a route to cache. 3390 */ 3391 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 3392 } 3393 if (ro->ro_rt == NULL) { 3394 return (NULL); 3395 } 3396 fam = ro->ro_dst.sa_family; 3397 dest_is_priv = dest_is_loop = 0; 3398 /* Setup our scopes for the destination */ 3399 switch (fam) { 3400#ifdef INET 3401 case AF_INET: 3402 /* Scope based on outbound address */ 3403 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) { 3404 dest_is_loop = 1; 3405 if (net != NULL) { 3406 /* mark it as local */ 3407 net->addr_is_local = 1; 3408 } 3409 } else if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) { 3410 dest_is_priv = 1; 3411 } 3412 break; 3413#endif 3414#ifdef INET6 3415 case AF_INET6: 3416 /* Scope based on outbound address */ 3417 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr) || 3418 SCTP_ROUTE_IS_REAL_LOOP(ro)) { 3419 /* 3420 * If the address is a loopback address, which 3421 * consists of "::1" OR "fe80::1%lo0", we are 3422 * loopback scope. But we don't use dest_is_priv 3423 * (link local addresses). 3424 */ 3425 dest_is_loop = 1; 3426 if (net != NULL) { 3427 /* mark it as local */ 3428 net->addr_is_local = 1; 3429 } 3430 } else if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) { 3431 dest_is_priv = 1; 3432 } 3433 break; 3434#endif 3435 } 3436 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Select source addr for:"); 3437 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&ro->ro_dst); 3438 SCTP_IPI_ADDR_RLOCK(); 3439 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3440 /* 3441 * Bound all case 3442 */ 3443 answer = sctp_choose_boundall(inp, stcb, net, ro, vrf_id, 3444 dest_is_priv, dest_is_loop, 3445 non_asoc_addr_ok, fam); 3446 SCTP_IPI_ADDR_RUNLOCK(); 3447 return (answer); 3448 } 3449 /* 3450 * Subset bound case 3451 */ 3452 if (stcb) { 3453 answer = sctp_choose_boundspecific_stcb(inp, stcb, ro, 3454 vrf_id, dest_is_priv, 3455 dest_is_loop, 3456 non_asoc_addr_ok, fam); 3457 } else { 3458 answer = sctp_choose_boundspecific_inp(inp, ro, vrf_id, 3459 non_asoc_addr_ok, 3460 dest_is_priv, 3461 dest_is_loop, fam); 3462 } 3463 SCTP_IPI_ADDR_RUNLOCK(); 3464 return (answer); 3465} 3466 3467static int 3468sctp_find_cmsg(int c_type, void *data, struct mbuf *control, size_t cpsize) 3469{ 3470 struct cmsghdr cmh; 3471 struct sctp_sndinfo sndinfo; 3472 struct sctp_prinfo prinfo; 3473 struct sctp_authinfo authinfo; 3474 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3475 int found; 3476 3477 /* 3478 * Independent of how many mbufs, find the c_type inside the control 3479 * structure and copy out the data. 3480 */ 3481 found = 0; 3482 tot_len = SCTP_BUF_LEN(control); 3483 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3484 rem_len = tot_len - off; 3485 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3486 /* There is not enough room for one more. */ 3487 return (found); 3488 } 3489 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3490 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3491 /* We dont't have a complete CMSG header. */ 3492 return (found); 3493 } 3494 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3495 /* We don't have the complete CMSG. */ 3496 return (found); 3497 } 3498 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3499 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3500 if ((cmh.cmsg_level == IPPROTO_SCTP) && 3501 ((c_type == cmh.cmsg_type) || 3502 ((c_type == SCTP_SNDRCV) && 3503 ((cmh.cmsg_type == SCTP_SNDINFO) || 3504 (cmh.cmsg_type == SCTP_PRINFO) || 3505 (cmh.cmsg_type == SCTP_AUTHINFO))))) { 3506 if (c_type == cmh.cmsg_type) { 3507 if (cpsize > INT_MAX) { 3508 return (found); 3509 } 3510 if (cmsg_data_len < (int)cpsize) { 3511 return (found); 3512 } 3513 /* It is exactly what we want. Copy it out. */ 3514 m_copydata(control, cmsg_data_off, (int)cpsize, (caddr_t)data); 3515 return (1); 3516 } else { 3517 struct sctp_sndrcvinfo *sndrcvinfo; 3518 3519 sndrcvinfo = (struct sctp_sndrcvinfo *)data; 3520 if (found == 0) { 3521 if (cpsize < sizeof(struct sctp_sndrcvinfo)) { 3522 return (found); 3523 } 3524 memset(sndrcvinfo, 0, sizeof(struct sctp_sndrcvinfo)); 3525 } 3526 switch (cmh.cmsg_type) { 3527 case SCTP_SNDINFO: 3528 if (cmsg_data_len < (int)sizeof(struct sctp_sndinfo)) { 3529 return (found); 3530 } 3531 m_copydata(control, cmsg_data_off, sizeof(struct sctp_sndinfo), (caddr_t)&sndinfo); 3532 sndrcvinfo->sinfo_stream = sndinfo.snd_sid; 3533 sndrcvinfo->sinfo_flags = sndinfo.snd_flags; 3534 sndrcvinfo->sinfo_ppid = sndinfo.snd_ppid; 3535 sndrcvinfo->sinfo_context = sndinfo.snd_context; 3536 sndrcvinfo->sinfo_assoc_id = sndinfo.snd_assoc_id; 3537 break; 3538 case SCTP_PRINFO: 3539 if (cmsg_data_len < (int)sizeof(struct sctp_prinfo)) { 3540 return (found); 3541 } 3542 m_copydata(control, cmsg_data_off, sizeof(struct sctp_prinfo), (caddr_t)&prinfo); 3543 if (prinfo.pr_policy != SCTP_PR_SCTP_NONE) { 3544 sndrcvinfo->sinfo_timetolive = prinfo.pr_value; 3545 } else { 3546 sndrcvinfo->sinfo_timetolive = 0; 3547 } 3548 sndrcvinfo->sinfo_flags |= prinfo.pr_policy; 3549 break; 3550 case SCTP_AUTHINFO: 3551 if (cmsg_data_len < (int)sizeof(struct sctp_authinfo)) { 3552 return (found); 3553 } 3554 m_copydata(control, cmsg_data_off, sizeof(struct sctp_authinfo), (caddr_t)&authinfo); 3555 sndrcvinfo->sinfo_keynumber_valid = 1; 3556 sndrcvinfo->sinfo_keynumber = authinfo.auth_keynumber; 3557 break; 3558 default: 3559 return (found); 3560 } 3561 found = 1; 3562 } 3563 } 3564 } 3565 return (found); 3566} 3567 3568static int 3569sctp_process_cmsgs_for_init(struct sctp_tcb *stcb, struct mbuf *control, int *error) 3570{ 3571 struct cmsghdr cmh; 3572 struct sctp_initmsg initmsg; 3573#ifdef INET 3574 struct sockaddr_in sin; 3575#endif 3576#ifdef INET6 3577 struct sockaddr_in6 sin6; 3578#endif 3579 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3580 3581 tot_len = SCTP_BUF_LEN(control); 3582 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3583 rem_len = tot_len - off; 3584 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3585 /* There is not enough room for one more. */ 3586 *error = EINVAL; 3587 return (1); 3588 } 3589 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3590 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3591 /* We dont't have a complete CMSG header. */ 3592 *error = EINVAL; 3593 return (1); 3594 } 3595 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3596 /* We don't have the complete CMSG. */ 3597 *error = EINVAL; 3598 return (1); 3599 } 3600 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3601 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3602 if (cmh.cmsg_level == IPPROTO_SCTP) { 3603 switch (cmh.cmsg_type) { 3604 case SCTP_INIT: 3605 if (cmsg_data_len < (int)sizeof(struct sctp_initmsg)) { 3606 *error = EINVAL; 3607 return (1); 3608 } 3609 m_copydata(control, cmsg_data_off, sizeof(struct sctp_initmsg), (caddr_t)&initmsg); 3610 if (initmsg.sinit_max_attempts) 3611 stcb->asoc.max_init_times = initmsg.sinit_max_attempts; 3612 if (initmsg.sinit_num_ostreams) 3613 stcb->asoc.pre_open_streams = initmsg.sinit_num_ostreams; 3614 if (initmsg.sinit_max_instreams) 3615 stcb->asoc.max_inbound_streams = initmsg.sinit_max_instreams; 3616 if (initmsg.sinit_max_init_timeo) 3617 stcb->asoc.initial_init_rto_max = initmsg.sinit_max_init_timeo; 3618 if (stcb->asoc.streamoutcnt < stcb->asoc.pre_open_streams) { 3619 struct sctp_stream_out *tmp_str; 3620 unsigned int i; 3621#if defined(SCTP_DETAILED_STR_STATS) 3622 int j; 3623#endif 3624 3625 /* Default is NOT correct */ 3626 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, default:%d pre_open:%d\n", 3627 stcb->asoc.streamoutcnt, stcb->asoc.pre_open_streams); 3628 SCTP_TCB_UNLOCK(stcb); 3629 SCTP_MALLOC(tmp_str, 3630 struct sctp_stream_out *, 3631 (stcb->asoc.pre_open_streams * sizeof(struct sctp_stream_out)), 3632 SCTP_M_STRMO); 3633 SCTP_TCB_LOCK(stcb); 3634 if (tmp_str != NULL) { 3635 SCTP_FREE(stcb->asoc.strmout, SCTP_M_STRMO); 3636 stcb->asoc.strmout = tmp_str; 3637 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt = stcb->asoc.pre_open_streams; 3638 } else { 3639 stcb->asoc.pre_open_streams = stcb->asoc.streamoutcnt; 3640 } 3641 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3642 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 3643 stcb->asoc.strmout[i].chunks_on_queues = 0; 3644 stcb->asoc.strmout[i].next_mid_ordered = 0; 3645 stcb->asoc.strmout[i].next_mid_unordered = 0; 3646#if defined(SCTP_DETAILED_STR_STATS) 3647 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 3648 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 3649 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 3650 } 3651#else 3652 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 3653 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 3654#endif 3655 stcb->asoc.strmout[i].sid = i; 3656 stcb->asoc.strmout[i].last_msg_incomplete = 0; 3657 stcb->asoc.strmout[i].state = SCTP_STREAM_OPENING; 3658 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 3659 } 3660 } 3661 break; 3662#ifdef INET 3663 case SCTP_DSTADDRV4: 3664 if (cmsg_data_len < (int)sizeof(struct in_addr)) { 3665 *error = EINVAL; 3666 return (1); 3667 } 3668 memset(&sin, 0, sizeof(struct sockaddr_in)); 3669 sin.sin_family = AF_INET; 3670 sin.sin_len = sizeof(struct sockaddr_in); 3671 sin.sin_port = stcb->rport; 3672 m_copydata(control, cmsg_data_off, sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3673 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3674 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3675 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3676 *error = EINVAL; 3677 return (1); 3678 } 3679 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3680 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3681 *error = ENOBUFS; 3682 return (1); 3683 } 3684 break; 3685#endif 3686#ifdef INET6 3687 case SCTP_DSTADDRV6: 3688 if (cmsg_data_len < (int)sizeof(struct in6_addr)) { 3689 *error = EINVAL; 3690 return (1); 3691 } 3692 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3693 sin6.sin6_family = AF_INET6; 3694 sin6.sin6_len = sizeof(struct sockaddr_in6); 3695 sin6.sin6_port = stcb->rport; 3696 m_copydata(control, cmsg_data_off, sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3697 if (IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr) || 3698 IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) { 3699 *error = EINVAL; 3700 return (1); 3701 } 3702#ifdef INET 3703 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3704 in6_sin6_2_sin(&sin, &sin6); 3705 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3706 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3707 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3708 *error = EINVAL; 3709 return (1); 3710 } 3711 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3712 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3713 *error = ENOBUFS; 3714 return (1); 3715 } 3716 } else 3717#endif 3718 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin6, NULL, stcb->asoc.port, 3719 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3720 *error = ENOBUFS; 3721 return (1); 3722 } 3723 break; 3724#endif 3725 default: 3726 break; 3727 } 3728 } 3729 } 3730 return (0); 3731} 3732 3733static struct sctp_tcb * 3734sctp_findassociation_cmsgs(struct sctp_inpcb **inp_p, 3735 uint16_t port, 3736 struct mbuf *control, 3737 struct sctp_nets **net_p, 3738 int *error) 3739{ 3740 struct cmsghdr cmh; 3741 struct sctp_tcb *stcb; 3742 struct sockaddr *addr; 3743#ifdef INET 3744 struct sockaddr_in sin; 3745#endif 3746#ifdef INET6 3747 struct sockaddr_in6 sin6; 3748#endif 3749 int tot_len, rem_len, cmsg_data_len, cmsg_data_off, off; 3750 3751 tot_len = SCTP_BUF_LEN(control); 3752 for (off = 0; off < tot_len; off += CMSG_ALIGN(cmh.cmsg_len)) { 3753 rem_len = tot_len - off; 3754 if (rem_len < (int)CMSG_ALIGN(sizeof(cmh))) { 3755 /* There is not enough room for one more. */ 3756 *error = EINVAL; 3757 return (NULL); 3758 } 3759 m_copydata(control, off, sizeof(cmh), (caddr_t)&cmh); 3760 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3761 /* We dont't have a complete CMSG header. */ 3762 *error = EINVAL; 3763 return (NULL); 3764 } 3765 if ((cmh.cmsg_len > INT_MAX) || ((int)cmh.cmsg_len > rem_len)) { 3766 /* We don't have the complete CMSG. */ 3767 *error = EINVAL; 3768 return (NULL); 3769 } 3770 cmsg_data_len = (int)cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh)); 3771 cmsg_data_off = off + CMSG_ALIGN(sizeof(cmh)); 3772 if (cmh.cmsg_level == IPPROTO_SCTP) { 3773 switch (cmh.cmsg_type) { 3774#ifdef INET 3775 case SCTP_DSTADDRV4: 3776 if (cmsg_data_len < (int)sizeof(struct in_addr)) { 3777 *error = EINVAL; 3778 return (NULL); 3779 } 3780 memset(&sin, 0, sizeof(struct sockaddr_in)); 3781 sin.sin_family = AF_INET; 3782 sin.sin_len = sizeof(struct sockaddr_in); 3783 sin.sin_port = port; 3784 m_copydata(control, cmsg_data_off, sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3785 addr = (struct sockaddr *)&sin; 3786 break; 3787#endif 3788#ifdef INET6 3789 case SCTP_DSTADDRV6: 3790 if (cmsg_data_len < (int)sizeof(struct in6_addr)) { 3791 *error = EINVAL; 3792 return (NULL); 3793 } 3794 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3795 sin6.sin6_family = AF_INET6; 3796 sin6.sin6_len = sizeof(struct sockaddr_in6); 3797 sin6.sin6_port = port; 3798 m_copydata(control, cmsg_data_off, sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3799#ifdef INET 3800 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3801 in6_sin6_2_sin(&sin, &sin6); 3802 addr = (struct sockaddr *)&sin; 3803 } else 3804#endif 3805 addr = (struct sockaddr *)&sin6; 3806 break; 3807#endif 3808 default: 3809 addr = NULL; 3810 break; 3811 } 3812 if (addr) { 3813 stcb = sctp_findassociation_ep_addr(inp_p, addr, net_p, NULL, NULL); 3814 if (stcb != NULL) { 3815 return (stcb); 3816 } 3817 } 3818 } 3819 } 3820 return (NULL); 3821} 3822 3823static struct mbuf * 3824sctp_add_cookie(struct mbuf *init, int init_offset, 3825 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in, uint8_t **signature) 3826{ 3827 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 3828 struct sctp_state_cookie *stc; 3829 struct sctp_paramhdr *ph; 3830 uint8_t *foo; 3831 int sig_offset; 3832 uint16_t cookie_sz; 3833 3834 mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) + 3835 sizeof(struct sctp_paramhdr)), 0, 3836 M_NOWAIT, 1, MT_DATA); 3837 if (mret == NULL) { 3838 return (NULL); 3839 } 3840 copy_init = SCTP_M_COPYM(init, init_offset, M_COPYALL, M_NOWAIT); 3841 if (copy_init == NULL) { 3842 sctp_m_freem(mret); 3843 return (NULL); 3844 } 3845#ifdef SCTP_MBUF_LOGGING 3846 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3847 sctp_log_mbc(copy_init, SCTP_MBUF_ICOPY); 3848 } 3849#endif 3850 copy_initack = SCTP_M_COPYM(initack, initack_offset, M_COPYALL, 3851 M_NOWAIT); 3852 if (copy_initack == NULL) { 3853 sctp_m_freem(mret); 3854 sctp_m_freem(copy_init); 3855 return (NULL); 3856 } 3857#ifdef SCTP_MBUF_LOGGING 3858 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3859 sctp_log_mbc(copy_initack, SCTP_MBUF_ICOPY); 3860 } 3861#endif 3862 /* easy side we just drop it on the end */ 3863 ph = mtod(mret, struct sctp_paramhdr *); 3864 SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) + 3865 sizeof(struct sctp_paramhdr); 3866 stc = (struct sctp_state_cookie *)((caddr_t)ph + 3867 sizeof(struct sctp_paramhdr)); 3868 ph->param_type = htons(SCTP_STATE_COOKIE); 3869 ph->param_length = 0; /* fill in at the end */ 3870 /* Fill in the stc cookie data */ 3871 memcpy(stc, stc_in, sizeof(struct sctp_state_cookie)); 3872 3873 /* tack the INIT and then the INIT-ACK onto the chain */ 3874 cookie_sz = 0; 3875 for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3876 cookie_sz += SCTP_BUF_LEN(m_at); 3877 if (SCTP_BUF_NEXT(m_at) == NULL) { 3878 SCTP_BUF_NEXT(m_at) = copy_init; 3879 break; 3880 } 3881 } 3882 for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3883 cookie_sz += SCTP_BUF_LEN(m_at); 3884 if (SCTP_BUF_NEXT(m_at) == NULL) { 3885 SCTP_BUF_NEXT(m_at) = copy_initack; 3886 break; 3887 } 3888 } 3889 for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3890 cookie_sz += SCTP_BUF_LEN(m_at); 3891 if (SCTP_BUF_NEXT(m_at) == NULL) { 3892 break; 3893 } 3894 } 3895 sig = sctp_get_mbuf_for_msg(SCTP_SECRET_SIZE, 0, M_NOWAIT, 1, MT_DATA); 3896 if (sig == NULL) { 3897 /* no space, so free the entire chain */ 3898 sctp_m_freem(mret); 3899 return (NULL); 3900 } 3901 SCTP_BUF_LEN(sig) = 0; 3902 SCTP_BUF_NEXT(m_at) = sig; 3903 sig_offset = 0; 3904 foo = (uint8_t *)(mtod(sig, caddr_t)+sig_offset); 3905 memset(foo, 0, SCTP_SIGNATURE_SIZE); 3906 *signature = foo; 3907 SCTP_BUF_LEN(sig) += SCTP_SIGNATURE_SIZE; 3908 cookie_sz += SCTP_SIGNATURE_SIZE; 3909 ph->param_length = htons(cookie_sz); 3910 return (mret); 3911} 3912 3913 3914static uint8_t 3915sctp_get_ect(struct sctp_tcb *stcb) 3916{ 3917 if ((stcb != NULL) && (stcb->asoc.ecn_supported == 1)) { 3918 return (SCTP_ECT0_BIT); 3919 } else { 3920 return (0); 3921 } 3922} 3923 3924#if defined(INET) || defined(INET6) 3925static void 3926sctp_handle_no_route(struct sctp_tcb *stcb, 3927 struct sctp_nets *net, 3928 int so_locked) 3929{ 3930 SCTPDBG(SCTP_DEBUG_OUTPUT1, "dropped packet - no valid source addr\n"); 3931 3932 if (net) { 3933 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Destination was "); 3934 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT1, &net->ro._l_addr.sa); 3935 if (net->dest_state & SCTP_ADDR_CONFIRMED) { 3936 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) { 3937 SCTPDBG(SCTP_DEBUG_OUTPUT1, "no route takes interface %p down\n", (void *)net); 3938 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 3939 stcb, 0, 3940 (void *)net, 3941 so_locked); 3942 net->dest_state &= ~SCTP_ADDR_REACHABLE; 3943 net->dest_state &= ~SCTP_ADDR_PF; 3944 } 3945 } 3946 if (stcb) { 3947 if (net == stcb->asoc.primary_destination) { 3948 /* need a new primary */ 3949 struct sctp_nets *alt; 3950 3951 alt = sctp_find_alternate_net(stcb, net, 0); 3952 if (alt != net) { 3953 if (stcb->asoc.alternate) { 3954 sctp_free_remote_addr(stcb->asoc.alternate); 3955 } 3956 stcb->asoc.alternate = alt; 3957 atomic_add_int(&stcb->asoc.alternate->ref_count, 1); 3958 if (net->ro._s_addr) { 3959 sctp_free_ifa(net->ro._s_addr); 3960 net->ro._s_addr = NULL; 3961 } 3962 net->src_addr_selected = 0; 3963 } 3964 } 3965 } 3966 } 3967} 3968#endif 3969 3970static int 3971sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 3972 struct sctp_tcb *stcb, /* may be NULL */ 3973 struct sctp_nets *net, 3974 struct sockaddr *to, 3975 struct mbuf *m, 3976 uint32_t auth_offset, 3977 struct sctp_auth_chunk *auth, 3978 uint16_t auth_keyid, 3979 int nofragment_flag, 3980 int ecn_ok, 3981 int out_of_asoc_ok, 3982 uint16_t src_port, 3983 uint16_t dest_port, 3984 uint32_t v_tag, 3985 uint16_t port, 3986 union sctp_sockstore *over_addr, 3987 uint8_t mflowtype, uint32_t mflowid, 3988#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 3989 int so_locked SCTP_UNUSED 3990#else 3991 int so_locked 3992#endif 3993) 3994{ 3995/* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 3996 /** 3997 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet header 3998 * WITH an SCTPHDR but no IP header, endpoint inp and sa structure: 3999 * - fill in the HMAC digest of any AUTH chunk in the packet. 4000 * - calculate and fill in the SCTP checksum. 4001 * - prepend an IP address header. 4002 * - if boundall use INADDR_ANY. 4003 * - if boundspecific do source address selection. 4004 * - set fragmentation option for ipV4. 4005 * - On return from IP output, check/adjust mtu size of output 4006 * interface and smallest_mtu size as well. 4007 */ 4008 /* Will need ifdefs around this */ 4009 struct mbuf *newm; 4010 struct sctphdr *sctphdr; 4011 int packet_length; 4012 int ret; 4013#if defined(INET) || defined(INET6) 4014 uint32_t vrf_id; 4015#endif 4016#if defined(INET) || defined(INET6) 4017 struct mbuf *o_pak; 4018 sctp_route_t *ro = NULL; 4019 struct udphdr *udp = NULL; 4020#endif 4021 uint8_t tos_value; 4022#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4023 struct socket *so = NULL; 4024#endif 4025 4026 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 4027 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4028 sctp_m_freem(m); 4029 return (EFAULT); 4030 } 4031#if defined(INET) || defined(INET6) 4032 if (stcb) { 4033 vrf_id = stcb->asoc.vrf_id; 4034 } else { 4035 vrf_id = inp->def_vrf_id; 4036 } 4037#endif 4038 /* fill in the HMAC digest for any AUTH chunk in the packet */ 4039 if ((auth != NULL) && (stcb != NULL)) { 4040 sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb, auth_keyid); 4041 } 4042 4043 if (net) { 4044 tos_value = net->dscp; 4045 } else if (stcb) { 4046 tos_value = stcb->asoc.default_dscp; 4047 } else { 4048 tos_value = inp->sctp_ep.default_dscp; 4049 } 4050 4051 switch (to->sa_family) { 4052#ifdef INET 4053 case AF_INET: 4054 { 4055 struct ip *ip = NULL; 4056 sctp_route_t iproute; 4057 int len; 4058 4059 len = SCTP_MIN_V4_OVERHEAD; 4060 if (port) { 4061 len += sizeof(struct udphdr); 4062 } 4063 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4064 if (newm == NULL) { 4065 sctp_m_freem(m); 4066 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4067 return (ENOMEM); 4068 } 4069 SCTP_ALIGN_TO_END(newm, len); 4070 SCTP_BUF_LEN(newm) = len; 4071 SCTP_BUF_NEXT(newm) = m; 4072 m = newm; 4073 if (net != NULL) { 4074 m->m_pkthdr.flowid = net->flowid; 4075 M_HASHTYPE_SET(m, net->flowtype); 4076 } else { 4077 m->m_pkthdr.flowid = mflowid; 4078 M_HASHTYPE_SET(m, mflowtype); 4079 } 4080 packet_length = sctp_calculate_len(m); 4081 ip = mtod(m, struct ip *); 4082 ip->ip_v = IPVERSION; 4083 ip->ip_hl = (sizeof(struct ip) >> 2); 4084 if (tos_value == 0) { 4085 /* 4086 * This means especially, that it is not set 4087 * at the SCTP layer. So use the value from 4088 * the IP layer. 4089 */ 4090 tos_value = inp->ip_inp.inp.inp_ip_tos; 4091 } 4092 tos_value &= 0xfc; 4093 if (ecn_ok) { 4094 tos_value |= sctp_get_ect(stcb); 4095 } 4096 if ((nofragment_flag) && (port == 0)) { 4097 ip->ip_off = htons(IP_DF); 4098 } else { 4099 ip->ip_off = htons(0); 4100 } 4101 /* FreeBSD has a function for ip_id's */ 4102 ip_fillid(ip); 4103 4104 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl; 4105 ip->ip_len = htons(packet_length); 4106 ip->ip_tos = tos_value; 4107 if (port) { 4108 ip->ip_p = IPPROTO_UDP; 4109 } else { 4110 ip->ip_p = IPPROTO_SCTP; 4111 } 4112 ip->ip_sum = 0; 4113 if (net == NULL) { 4114 ro = &iproute; 4115 memset(&iproute, 0, sizeof(iproute)); 4116 memcpy(&ro->ro_dst, to, to->sa_len); 4117 } else { 4118 ro = (sctp_route_t *)&net->ro; 4119 } 4120 /* Now the address selection part */ 4121 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr; 4122 4123 /* call the routine to select the src address */ 4124 if (net && out_of_asoc_ok == 0) { 4125 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4126 sctp_free_ifa(net->ro._s_addr); 4127 net->ro._s_addr = NULL; 4128 net->src_addr_selected = 0; 4129 if (ro->ro_rt) { 4130 RTFREE(ro->ro_rt); 4131 ro->ro_rt = NULL; 4132 } 4133 } 4134 if (net->src_addr_selected == 0) { 4135 /* Cache the source address */ 4136 net->ro._s_addr = sctp_source_address_selection(inp, stcb, 4137 ro, net, 0, 4138 vrf_id); 4139 net->src_addr_selected = 1; 4140 } 4141 if (net->ro._s_addr == NULL) { 4142 /* No route to host */ 4143 net->src_addr_selected = 0; 4144 sctp_handle_no_route(stcb, net, so_locked); 4145 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4146 sctp_m_freem(m); 4147 return (EHOSTUNREACH); 4148 } 4149 ip->ip_src = net->ro._s_addr->address.sin.sin_addr; 4150 } else { 4151 if (over_addr == NULL) { 4152 struct sctp_ifa *_lsrc; 4153 4154 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4155 net, 4156 out_of_asoc_ok, 4157 vrf_id); 4158 if (_lsrc == NULL) { 4159 sctp_handle_no_route(stcb, net, so_locked); 4160 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4161 sctp_m_freem(m); 4162 return (EHOSTUNREACH); 4163 } 4164 ip->ip_src = _lsrc->address.sin.sin_addr; 4165 sctp_free_ifa(_lsrc); 4166 } else { 4167 ip->ip_src = over_addr->sin.sin_addr; 4168 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4169 } 4170 } 4171 if (port) { 4172 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4173 sctp_handle_no_route(stcb, net, so_locked); 4174 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4175 sctp_m_freem(m); 4176 return (EHOSTUNREACH); 4177 } 4178 udp = (struct udphdr *)((caddr_t)ip + sizeof(struct ip)); 4179 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4180 udp->uh_dport = port; 4181 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip))); 4182 if (V_udp_cksum) { 4183 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 4184 } else { 4185 udp->uh_sum = 0; 4186 } 4187 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4188 } else { 4189 sctphdr = (struct sctphdr *)((caddr_t)ip + sizeof(struct ip)); 4190 } 4191 4192 sctphdr->src_port = src_port; 4193 sctphdr->dest_port = dest_port; 4194 sctphdr->v_tag = v_tag; 4195 sctphdr->checksum = 0; 4196 4197 /* 4198 * If source address selection fails and we find no 4199 * route then the ip_output should fail as well with 4200 * a NO_ROUTE_TO_HOST type error. We probably should 4201 * catch that somewhere and abort the association 4202 * right away (assuming this is an INIT being sent). 4203 */ 4204 if (ro->ro_rt == NULL) { 4205 /* 4206 * src addr selection failed to find a route 4207 * (or valid source addr), so we can't get 4208 * there from here (yet)! 4209 */ 4210 sctp_handle_no_route(stcb, net, so_locked); 4211 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4212 sctp_m_freem(m); 4213 return (EHOSTUNREACH); 4214 } 4215 if (ro != &iproute) { 4216 memcpy(&iproute, ro, sizeof(*ro)); 4217 } 4218 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv4 output routine from low level src addr:%x\n", 4219 (uint32_t)(ntohl(ip->ip_src.s_addr))); 4220 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Destination is %x\n", 4221 (uint32_t)(ntohl(ip->ip_dst.s_addr))); 4222 SCTPDBG(SCTP_DEBUG_OUTPUT3, "RTP route is %p through\n", 4223 (void *)ro->ro_rt); 4224 4225 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4226 /* failed to prepend data, give up */ 4227 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4228 sctp_m_freem(m); 4229 return (ENOMEM); 4230 } 4231 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4232 if (port) { 4233 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip) + sizeof(struct udphdr)); 4234 SCTP_STAT_INCR(sctps_sendswcrc); 4235 if (V_udp_cksum) { 4236 SCTP_ENABLE_UDP_CSUM(o_pak); 4237 } 4238 } else { 4239 m->m_pkthdr.csum_flags = CSUM_SCTP; 4240 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4241 SCTP_STAT_INCR(sctps_sendhwcrc); 4242 } 4243#ifdef SCTP_PACKET_LOGGING 4244 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4245 sctp_packet_log(o_pak); 4246#endif 4247 /* send it out. table id is taken from stcb */ 4248#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4249 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4250 so = SCTP_INP_SO(inp); 4251 SCTP_SOCKET_UNLOCK(so, 0); 4252 } 4253#endif 4254 SCTP_IP_OUTPUT(ret, o_pak, ro, stcb, vrf_id); 4255#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4256 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4257 atomic_add_int(&stcb->asoc.refcnt, 1); 4258 SCTP_TCB_UNLOCK(stcb); 4259 SCTP_SOCKET_LOCK(so, 0); 4260 SCTP_TCB_LOCK(stcb); 4261 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4262 } 4263#endif 4264 if (port) { 4265 UDPSTAT_INC(udps_opackets); 4266 } 4267 SCTP_STAT_INCR(sctps_sendpackets); 4268 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4269 if (ret) 4270 SCTP_STAT_INCR(sctps_senderrors); 4271 4272 SCTPDBG(SCTP_DEBUG_OUTPUT3, "IP output returns %d\n", ret); 4273 if (net == NULL) { 4274 /* free tempy routes */ 4275 RO_RTFREE(ro); 4276 } else { 4277 if ((ro->ro_rt != NULL) && (net->ro._s_addr) && 4278 ((net->dest_state & SCTP_ADDR_NO_PMTUD) == 0)) { 4279 uint32_t mtu; 4280 4281 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt); 4282 if (mtu > 0) { 4283 if (net->port) { 4284 mtu -= sizeof(struct udphdr); 4285 } 4286 if (mtu < net->mtu) { 4287 if ((stcb != NULL) && (stcb->asoc.smallest_mtu > mtu)) { 4288 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4289 } 4290 net->mtu = mtu; 4291 } 4292 } 4293 } else if (ro->ro_rt == NULL) { 4294 /* route was freed */ 4295 if (net->ro._s_addr && 4296 net->src_addr_selected) { 4297 sctp_free_ifa(net->ro._s_addr); 4298 net->ro._s_addr = NULL; 4299 } 4300 net->src_addr_selected = 0; 4301 } 4302 } 4303 return (ret); 4304 } 4305#endif 4306#ifdef INET6 4307 case AF_INET6: 4308 { 4309 uint32_t flowlabel, flowinfo; 4310 struct ip6_hdr *ip6h; 4311 struct route_in6 ip6route; 4312 struct ifnet *ifp; 4313 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 4314 int prev_scope = 0; 4315 struct sockaddr_in6 lsa6_storage; 4316 int error; 4317 u_short prev_port = 0; 4318 int len; 4319 4320 if (net) { 4321 flowlabel = net->flowlabel; 4322 } else if (stcb) { 4323 flowlabel = stcb->asoc.default_flowlabel; 4324 } else { 4325 flowlabel = inp->sctp_ep.default_flowlabel; 4326 } 4327 if (flowlabel == 0) { 4328 /* 4329 * This means especially, that it is not set 4330 * at the SCTP layer. So use the value from 4331 * the IP layer. 4332 */ 4333 flowlabel = ntohl(((struct in6pcb *)inp)->in6p_flowinfo); 4334 } 4335 flowlabel &= 0x000fffff; 4336 len = SCTP_MIN_OVERHEAD; 4337 if (port) { 4338 len += sizeof(struct udphdr); 4339 } 4340 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4341 if (newm == NULL) { 4342 sctp_m_freem(m); 4343 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4344 return (ENOMEM); 4345 } 4346 SCTP_ALIGN_TO_END(newm, len); 4347 SCTP_BUF_LEN(newm) = len; 4348 SCTP_BUF_NEXT(newm) = m; 4349 m = newm; 4350 if (net != NULL) { 4351 m->m_pkthdr.flowid = net->flowid; 4352 M_HASHTYPE_SET(m, net->flowtype); 4353 } else { 4354 m->m_pkthdr.flowid = mflowid; 4355 M_HASHTYPE_SET(m, mflowtype); 4356 } 4357 packet_length = sctp_calculate_len(m); 4358 4359 ip6h = mtod(m, struct ip6_hdr *); 4360 /* protect *sin6 from overwrite */ 4361 sin6 = (struct sockaddr_in6 *)to; 4362 tmp = *sin6; 4363 sin6 = &tmp; 4364 4365 /* KAME hack: embed scopeid */ 4366 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4367 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4368 sctp_m_freem(m); 4369 return (EINVAL); 4370 } 4371 if (net == NULL) { 4372 memset(&ip6route, 0, sizeof(ip6route)); 4373 ro = (sctp_route_t *)&ip6route; 4374 memcpy(&ro->ro_dst, sin6, sin6->sin6_len); 4375 } else { 4376 ro = (sctp_route_t *)&net->ro; 4377 } 4378 /* 4379 * We assume here that inp_flow is in host byte 4380 * order within the TCB! 4381 */ 4382 if (tos_value == 0) { 4383 /* 4384 * This means especially, that it is not set 4385 * at the SCTP layer. So use the value from 4386 * the IP layer. 4387 */ 4388 tos_value = (ntohl(((struct in6pcb *)inp)->in6p_flowinfo) >> 20) & 0xff; 4389 } 4390 tos_value &= 0xfc; 4391 if (ecn_ok) { 4392 tos_value |= sctp_get_ect(stcb); 4393 } 4394 flowinfo = 0x06; 4395 flowinfo <<= 8; 4396 flowinfo |= tos_value; 4397 flowinfo <<= 20; 4398 flowinfo |= flowlabel; 4399 ip6h->ip6_flow = htonl(flowinfo); 4400 if (port) { 4401 ip6h->ip6_nxt = IPPROTO_UDP; 4402 } else { 4403 ip6h->ip6_nxt = IPPROTO_SCTP; 4404 } 4405 ip6h->ip6_plen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4406 ip6h->ip6_dst = sin6->sin6_addr; 4407 4408 /* 4409 * Add SRC address selection here: we can only reuse 4410 * to a limited degree the kame src-addr-sel, since 4411 * we can try their selection but it may not be 4412 * bound. 4413 */ 4414 memset(&lsa6_tmp, 0, sizeof(lsa6_tmp)); 4415 lsa6_tmp.sin6_family = AF_INET6; 4416 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 4417 lsa6 = &lsa6_tmp; 4418 if (net && out_of_asoc_ok == 0) { 4419 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4420 sctp_free_ifa(net->ro._s_addr); 4421 net->ro._s_addr = NULL; 4422 net->src_addr_selected = 0; 4423 if (ro->ro_rt) { 4424 RTFREE(ro->ro_rt); 4425 ro->ro_rt = NULL; 4426 } 4427 } 4428 if (net->src_addr_selected == 0) { 4429 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4430 /* KAME hack: embed scopeid */ 4431 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4432 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4433 sctp_m_freem(m); 4434 return (EINVAL); 4435 } 4436 /* Cache the source address */ 4437 net->ro._s_addr = sctp_source_address_selection(inp, 4438 stcb, 4439 ro, 4440 net, 4441 0, 4442 vrf_id); 4443 (void)sa6_recoverscope(sin6); 4444 net->src_addr_selected = 1; 4445 } 4446 if (net->ro._s_addr == NULL) { 4447 SCTPDBG(SCTP_DEBUG_OUTPUT3, "V6:No route to host\n"); 4448 net->src_addr_selected = 0; 4449 sctp_handle_no_route(stcb, net, so_locked); 4450 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4451 sctp_m_freem(m); 4452 return (EHOSTUNREACH); 4453 } 4454 lsa6->sin6_addr = net->ro._s_addr->address.sin6.sin6_addr; 4455 } else { 4456 sin6 = (struct sockaddr_in6 *)&ro->ro_dst; 4457 /* KAME hack: embed scopeid */ 4458 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4459 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4460 sctp_m_freem(m); 4461 return (EINVAL); 4462 } 4463 if (over_addr == NULL) { 4464 struct sctp_ifa *_lsrc; 4465 4466 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4467 net, 4468 out_of_asoc_ok, 4469 vrf_id); 4470 if (_lsrc == NULL) { 4471 sctp_handle_no_route(stcb, net, so_locked); 4472 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4473 sctp_m_freem(m); 4474 return (EHOSTUNREACH); 4475 } 4476 lsa6->sin6_addr = _lsrc->address.sin6.sin6_addr; 4477 sctp_free_ifa(_lsrc); 4478 } else { 4479 lsa6->sin6_addr = over_addr->sin6.sin6_addr; 4480 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4481 } 4482 (void)sa6_recoverscope(sin6); 4483 } 4484 lsa6->sin6_port = inp->sctp_lport; 4485 4486 if (ro->ro_rt == NULL) { 4487 /* 4488 * src addr selection failed to find a route 4489 * (or valid source addr), so we can't get 4490 * there from here! 4491 */ 4492 sctp_handle_no_route(stcb, net, so_locked); 4493 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4494 sctp_m_freem(m); 4495 return (EHOSTUNREACH); 4496 } 4497 /* 4498 * XXX: sa6 may not have a valid sin6_scope_id in 4499 * the non-SCOPEDROUTING case. 4500 */ 4501 memset(&lsa6_storage, 0, sizeof(lsa6_storage)); 4502 lsa6_storage.sin6_family = AF_INET6; 4503 lsa6_storage.sin6_len = sizeof(lsa6_storage); 4504 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4505 if ((error = sa6_recoverscope(&lsa6_storage)) != 0) { 4506 SCTPDBG(SCTP_DEBUG_OUTPUT3, "recover scope fails error %d\n", error); 4507 sctp_m_freem(m); 4508 return (error); 4509 } 4510 /* XXX */ 4511 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4512 lsa6_storage.sin6_port = inp->sctp_lport; 4513 lsa6 = &lsa6_storage; 4514 ip6h->ip6_src = lsa6->sin6_addr; 4515 4516 if (port) { 4517 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4518 sctp_handle_no_route(stcb, net, so_locked); 4519 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4520 sctp_m_freem(m); 4521 return (EHOSTUNREACH); 4522 } 4523 udp = (struct udphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4524 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4525 udp->uh_dport = port; 4526 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4527 udp->uh_sum = 0; 4528 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4529 } else { 4530 sctphdr = (struct sctphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4531 } 4532 4533 sctphdr->src_port = src_port; 4534 sctphdr->dest_port = dest_port; 4535 sctphdr->v_tag = v_tag; 4536 sctphdr->checksum = 0; 4537 4538 /* 4539 * We set the hop limit now since there is a good 4540 * chance that our ro pointer is now filled 4541 */ 4542 ip6h->ip6_hlim = SCTP_GET_HLIM(inp, ro); 4543 ifp = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 4544 4545#ifdef SCTP_DEBUG 4546 /* Copy to be sure something bad is not happening */ 4547 sin6->sin6_addr = ip6h->ip6_dst; 4548 lsa6->sin6_addr = ip6h->ip6_src; 4549#endif 4550 4551 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv6 output routine from low level\n"); 4552 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src: "); 4553 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)lsa6); 4554 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst: "); 4555 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)sin6); 4556 if (net) { 4557 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4558 /* 4559 * preserve the port and scope for link 4560 * local send 4561 */ 4562 prev_scope = sin6->sin6_scope_id; 4563 prev_port = sin6->sin6_port; 4564 } 4565 4566 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4567 /* failed to prepend data, give up */ 4568 sctp_m_freem(m); 4569 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4570 return (ENOMEM); 4571 } 4572 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4573 if (port) { 4574 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 4575 SCTP_STAT_INCR(sctps_sendswcrc); 4576 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), packet_length - sizeof(struct ip6_hdr))) == 0) { 4577 udp->uh_sum = 0xffff; 4578 } 4579 } else { 4580 m->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 4581 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4582 SCTP_STAT_INCR(sctps_sendhwcrc); 4583 } 4584 /* send it out. table id is taken from stcb */ 4585#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4586 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4587 so = SCTP_INP_SO(inp); 4588 SCTP_SOCKET_UNLOCK(so, 0); 4589 } 4590#endif 4591#ifdef SCTP_PACKET_LOGGING 4592 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4593 sctp_packet_log(o_pak); 4594#endif 4595 SCTP_IP6_OUTPUT(ret, o_pak, (struct route_in6 *)ro, &ifp, stcb, vrf_id); 4596#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4597 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4598 atomic_add_int(&stcb->asoc.refcnt, 1); 4599 SCTP_TCB_UNLOCK(stcb); 4600 SCTP_SOCKET_LOCK(so, 0); 4601 SCTP_TCB_LOCK(stcb); 4602 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4603 } 4604#endif 4605 if (net) { 4606 /* for link local this must be done */ 4607 sin6->sin6_scope_id = prev_scope; 4608 sin6->sin6_port = prev_port; 4609 } 4610 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 4611 if (port) { 4612 UDPSTAT_INC(udps_opackets); 4613 } 4614 SCTP_STAT_INCR(sctps_sendpackets); 4615 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4616 if (ret) { 4617 SCTP_STAT_INCR(sctps_senderrors); 4618 } 4619 if (net == NULL) { 4620 /* Now if we had a temp route free it */ 4621 RO_RTFREE(ro); 4622 } else { 4623 /* 4624 * PMTU check versus smallest asoc MTU goes 4625 * here 4626 */ 4627 if (ro->ro_rt == NULL) { 4628 /* Route was freed */ 4629 if (net->ro._s_addr && 4630 net->src_addr_selected) { 4631 sctp_free_ifa(net->ro._s_addr); 4632 net->ro._s_addr = NULL; 4633 } 4634 net->src_addr_selected = 0; 4635 } 4636 if ((ro->ro_rt != NULL) && (net->ro._s_addr) && 4637 ((net->dest_state & SCTP_ADDR_NO_PMTUD) == 0)) { 4638 uint32_t mtu; 4639 4640 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt); 4641 if (mtu > 0) { 4642 if (net->port) { 4643 mtu -= sizeof(struct udphdr); 4644 } 4645 if (mtu < net->mtu) { 4646 if ((stcb != NULL) && (stcb->asoc.smallest_mtu > mtu)) { 4647 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4648 } 4649 net->mtu = mtu; 4650 } 4651 } 4652 } else if (ifp) { 4653 if (ND_IFINFO(ifp)->linkmtu && 4654 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) { 4655 sctp_mtu_size_reset(inp, 4656 &stcb->asoc, 4657 ND_IFINFO(ifp)->linkmtu); 4658 } 4659 } 4660 } 4661 return (ret); 4662 } 4663#endif 4664 default: 4665 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 4666 ((struct sockaddr *)to)->sa_family); 4667 sctp_m_freem(m); 4668 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4669 return (EFAULT); 4670 } 4671} 4672 4673 4674void 4675sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int so_locked 4676#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 4677 SCTP_UNUSED 4678#endif 4679) 4680{ 4681 struct mbuf *m, *m_last; 4682 struct sctp_nets *net; 4683 struct sctp_init_chunk *init; 4684 struct sctp_supported_addr_param *sup_addr; 4685 struct sctp_adaptation_layer_indication *ali; 4686 struct sctp_supported_chunk_types_param *pr_supported; 4687 struct sctp_paramhdr *ph; 4688 int cnt_inits_to = 0; 4689 int error; 4690 uint16_t num_ext, chunk_len, padding_len, parameter_len; 4691 4692 /* INIT's always go to the primary (and usually ONLY address) */ 4693 net = stcb->asoc.primary_destination; 4694 if (net == NULL) { 4695 net = TAILQ_FIRST(&stcb->asoc.nets); 4696 if (net == NULL) { 4697 /* TSNH */ 4698 return; 4699 } 4700 /* we confirm any address we send an INIT to */ 4701 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4702 (void)sctp_set_primary_addr(stcb, NULL, net); 4703 } else { 4704 /* we confirm any address we send an INIT to */ 4705 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4706 } 4707 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT\n"); 4708#ifdef INET6 4709 if (net->ro._l_addr.sa.sa_family == AF_INET6) { 4710 /* 4711 * special hook, if we are sending to link local it will not 4712 * show up in our private address count. 4713 */ 4714 if (IN6_IS_ADDR_LINKLOCAL(&net->ro._l_addr.sin6.sin6_addr)) 4715 cnt_inits_to = 1; 4716 } 4717#endif 4718 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 4719 /* This case should not happen */ 4720 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - failed timer?\n"); 4721 return; 4722 } 4723 /* start the INIT timer */ 4724 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 4725 4726 m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_NOWAIT, 1, MT_DATA); 4727 if (m == NULL) { 4728 /* No memory, INIT timer will re-attempt. */ 4729 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - mbuf?\n"); 4730 return; 4731 } 4732 chunk_len = (uint16_t)sizeof(struct sctp_init_chunk); 4733 padding_len = 0; 4734 /* Now lets put the chunk header in place */ 4735 init = mtod(m, struct sctp_init_chunk *); 4736 /* now the chunk header */ 4737 init->ch.chunk_type = SCTP_INITIATION; 4738 init->ch.chunk_flags = 0; 4739 /* fill in later from mbuf we build */ 4740 init->ch.chunk_length = 0; 4741 /* place in my tag */ 4742 init->init.initiate_tag = htonl(stcb->asoc.my_vtag); 4743 /* set up some of the credits. */ 4744 init->init.a_rwnd = htonl(max(inp->sctp_socket ? SCTP_SB_LIMIT_RCV(inp->sctp_socket) : 0, 4745 SCTP_MINIMAL_RWND)); 4746 init->init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 4747 init->init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 4748 init->init.initial_tsn = htonl(stcb->asoc.init_seq_number); 4749 4750 /* Adaptation layer indication parameter */ 4751 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 4752 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 4753 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 4754 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 4755 ali->ph.param_length = htons(parameter_len); 4756 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 4757 chunk_len += parameter_len; 4758 } 4759 4760 /* ECN parameter */ 4761 if (stcb->asoc.ecn_supported == 1) { 4762 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4763 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4764 ph->param_type = htons(SCTP_ECN_CAPABLE); 4765 ph->param_length = htons(parameter_len); 4766 chunk_len += parameter_len; 4767 } 4768 4769 /* PR-SCTP supported parameter */ 4770 if (stcb->asoc.prsctp_supported == 1) { 4771 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4772 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4773 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 4774 ph->param_length = htons(parameter_len); 4775 chunk_len += parameter_len; 4776 } 4777 4778 /* Add NAT friendly parameter. */ 4779 if (SCTP_BASE_SYSCTL(sctp_inits_include_nat_friendly)) { 4780 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4781 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4782 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 4783 ph->param_length = htons(parameter_len); 4784 chunk_len += parameter_len; 4785 } 4786 4787 /* And now tell the peer which extensions we support */ 4788 num_ext = 0; 4789 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 4790 if (stcb->asoc.prsctp_supported == 1) { 4791 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 4792 if (stcb->asoc.idata_supported) { 4793 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 4794 } 4795 } 4796 if (stcb->asoc.auth_supported == 1) { 4797 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 4798 } 4799 if (stcb->asoc.asconf_supported == 1) { 4800 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 4801 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 4802 } 4803 if (stcb->asoc.reconfig_supported == 1) { 4804 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 4805 } 4806 if (stcb->asoc.idata_supported) { 4807 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 4808 } 4809 if (stcb->asoc.nrsack_supported == 1) { 4810 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 4811 } 4812 if (stcb->asoc.pktdrop_supported == 1) { 4813 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 4814 } 4815 if (num_ext > 0) { 4816 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 4817 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 4818 pr_supported->ph.param_length = htons(parameter_len); 4819 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4820 chunk_len += parameter_len; 4821 } 4822 /* add authentication parameters */ 4823 if (stcb->asoc.auth_supported) { 4824 /* attach RANDOM parameter, if available */ 4825 if (stcb->asoc.authinfo.random != NULL) { 4826 struct sctp_auth_random *randp; 4827 4828 if (padding_len > 0) { 4829 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4830 chunk_len += padding_len; 4831 padding_len = 0; 4832 } 4833 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 4834 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + stcb->asoc.authinfo.random_len; 4835 /* random key already contains the header */ 4836 memcpy(randp, stcb->asoc.authinfo.random->key, parameter_len); 4837 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4838 chunk_len += parameter_len; 4839 } 4840 /* add HMAC_ALGO parameter */ 4841 if (stcb->asoc.local_hmacs != NULL) { 4842 struct sctp_auth_hmac_algo *hmacs; 4843 4844 if (padding_len > 0) { 4845 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4846 chunk_len += padding_len; 4847 padding_len = 0; 4848 } 4849 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 4850 parameter_len = (uint16_t)(sizeof(struct sctp_auth_hmac_algo) + 4851 stcb->asoc.local_hmacs->num_algo * sizeof(uint16_t)); 4852 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 4853 hmacs->ph.param_length = htons(parameter_len); 4854 sctp_serialize_hmaclist(stcb->asoc.local_hmacs, (uint8_t *)hmacs->hmac_ids); 4855 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4856 chunk_len += parameter_len; 4857 } 4858 /* add CHUNKS parameter */ 4859 if (stcb->asoc.local_auth_chunks != NULL) { 4860 struct sctp_auth_chunk_list *chunks; 4861 4862 if (padding_len > 0) { 4863 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4864 chunk_len += padding_len; 4865 padding_len = 0; 4866 } 4867 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 4868 parameter_len = (uint16_t)(sizeof(struct sctp_auth_chunk_list) + 4869 sctp_auth_get_chklist_size(stcb->asoc.local_auth_chunks)); 4870 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 4871 chunks->ph.param_length = htons(parameter_len); 4872 sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks, chunks->chunk_types); 4873 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4874 chunk_len += parameter_len; 4875 } 4876 } 4877 4878 /* now any cookie time extensions */ 4879 if (stcb->asoc.cookie_preserve_req) { 4880 struct sctp_cookie_perserve_param *cookie_preserve; 4881 4882 if (padding_len > 0) { 4883 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4884 chunk_len += padding_len; 4885 padding_len = 0; 4886 } 4887 parameter_len = (uint16_t)sizeof(struct sctp_cookie_perserve_param); 4888 cookie_preserve = (struct sctp_cookie_perserve_param *)(mtod(m, caddr_t)+chunk_len); 4889 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 4890 cookie_preserve->ph.param_length = htons(parameter_len); 4891 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 4892 stcb->asoc.cookie_preserve_req = 0; 4893 chunk_len += parameter_len; 4894 } 4895 4896 if (stcb->asoc.scope.ipv4_addr_legal || stcb->asoc.scope.ipv6_addr_legal) { 4897 uint8_t i; 4898 4899 if (padding_len > 0) { 4900 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4901 chunk_len += padding_len; 4902 padding_len = 0; 4903 } 4904 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4905 if (stcb->asoc.scope.ipv4_addr_legal) { 4906 parameter_len += (uint16_t)sizeof(uint16_t); 4907 } 4908 if (stcb->asoc.scope.ipv6_addr_legal) { 4909 parameter_len += (uint16_t)sizeof(uint16_t); 4910 } 4911 sup_addr = (struct sctp_supported_addr_param *)(mtod(m, caddr_t)+chunk_len); 4912 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 4913 sup_addr->ph.param_length = htons(parameter_len); 4914 i = 0; 4915 if (stcb->asoc.scope.ipv4_addr_legal) { 4916 sup_addr->addr_type[i++] = htons(SCTP_IPV4_ADDRESS); 4917 } 4918 if (stcb->asoc.scope.ipv6_addr_legal) { 4919 sup_addr->addr_type[i++] = htons(SCTP_IPV6_ADDRESS); 4920 } 4921 padding_len = 4 - 2 * i; 4922 chunk_len += parameter_len; 4923 } 4924 4925 SCTP_BUF_LEN(m) = chunk_len; 4926 /* now the addresses */ 4927 /* 4928 * To optimize this we could put the scoping stuff into a structure 4929 * and remove the individual uint8's from the assoc structure. Then 4930 * we could just sifa in the address within the stcb. But for now 4931 * this is a quick hack to get the address stuff teased apart. 4932 */ 4933 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &stcb->asoc.scope, 4934 m, cnt_inits_to, 4935 &padding_len, &chunk_len); 4936 4937 init->ch.chunk_length = htons(chunk_len); 4938 if (padding_len > 0) { 4939 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 4940 sctp_m_freem(m); 4941 return; 4942 } 4943 } 4944 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - calls lowlevel_output\n"); 4945 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 4946 (struct sockaddr *)&net->ro._l_addr, 4947 m, 0, NULL, 0, 0, 0, 0, 4948 inp->sctp_lport, stcb->rport, htonl(0), 4949 net->port, NULL, 4950 0, 0, 4951 so_locked))) { 4952 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 4953 if (error == ENOBUFS) { 4954 stcb->asoc.ifp_had_enobuf = 1; 4955 SCTP_STAT_INCR(sctps_lowlevelerr); 4956 } 4957 } else { 4958 stcb->asoc.ifp_had_enobuf = 0; 4959 } 4960 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 4961 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 4962} 4963 4964struct mbuf * 4965sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 4966 int param_offset, int *abort_processing, 4967 struct sctp_chunkhdr *cp, 4968 int *nat_friendly, 4969 int *cookie_found) 4970{ 4971 /* 4972 * Given a mbuf containing an INIT or INIT-ACK with the param_offset 4973 * being equal to the beginning of the params i.e. (iphlen + 4974 * sizeof(struct sctp_init_msg) parse through the parameters to the 4975 * end of the mbuf verifying that all parameters are known. 4976 * 4977 * For unknown parameters build and return a mbuf with 4978 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop 4979 * processing this chunk stop, and set *abort_processing to 1. 4980 * 4981 * By having param_offset be pre-set to where parameters begin it is 4982 * hoped that this routine may be reused in the future by new 4983 * features. 4984 */ 4985 struct sctp_paramhdr *phdr, params; 4986 4987 struct mbuf *mat, *m_tmp, *op_err, *op_err_last; 4988 int at, limit, pad_needed; 4989 uint16_t ptype, plen, padded_size; 4990 4991 *abort_processing = 0; 4992 if (cookie_found != NULL) { 4993 *cookie_found = 0; 4994 } 4995 mat = in_initpkt; 4996 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 4997 at = param_offset; 4998 op_err = NULL; 4999 op_err_last = NULL; 5000 pad_needed = 0; 5001 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Check for unrecognized param's\n"); 5002 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5003 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 5004 ptype = ntohs(phdr->param_type); 5005 plen = ntohs(phdr->param_length); 5006 if ((plen > limit) || (plen < sizeof(struct sctp_paramhdr))) { 5007 /* wacked parameter */ 5008 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error %d\n", plen); 5009 goto invalid_size; 5010 } 5011 limit -= SCTP_SIZE32(plen); 5012 /*- 5013 * All parameters for all chunks that we know/understand are 5014 * listed here. We process them other places and make 5015 * appropriate stop actions per the upper bits. However this 5016 * is the generic routine processor's can call to get back 5017 * an operr.. to either incorporate (init-ack) or send. 5018 */ 5019 padded_size = SCTP_SIZE32(plen); 5020 switch (ptype) { 5021 /* Param's with variable size */ 5022 case SCTP_HEARTBEAT_INFO: 5023 case SCTP_UNRECOG_PARAM: 5024 case SCTP_ERROR_CAUSE_IND: 5025 /* ok skip fwd */ 5026 at += padded_size; 5027 break; 5028 case SCTP_STATE_COOKIE: 5029 if (cookie_found != NULL) { 5030 *cookie_found = 1; 5031 } 5032 at += padded_size; 5033 break; 5034 /* Param's with variable size within a range */ 5035 case SCTP_CHUNK_LIST: 5036 case SCTP_SUPPORTED_CHUNK_EXT: 5037 if (padded_size > (sizeof(struct sctp_supported_chunk_types_param) + (sizeof(uint8_t) * SCTP_MAX_SUPPORTED_EXT))) { 5038 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error chklist %d\n", plen); 5039 goto invalid_size; 5040 } 5041 at += padded_size; 5042 break; 5043 case SCTP_SUPPORTED_ADDRTYPE: 5044 if (padded_size > SCTP_MAX_ADDR_PARAMS_SIZE) { 5045 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error supaddrtype %d\n", plen); 5046 goto invalid_size; 5047 } 5048 at += padded_size; 5049 break; 5050 case SCTP_RANDOM: 5051 if (padded_size > (sizeof(struct sctp_auth_random) + SCTP_RANDOM_MAX_SIZE)) { 5052 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error random %d\n", plen); 5053 goto invalid_size; 5054 } 5055 at += padded_size; 5056 break; 5057 case SCTP_SET_PRIM_ADDR: 5058 case SCTP_DEL_IP_ADDRESS: 5059 case SCTP_ADD_IP_ADDRESS: 5060 if ((padded_size != sizeof(struct sctp_asconf_addrv4_param)) && 5061 (padded_size != sizeof(struct sctp_asconf_addr_param))) { 5062 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error setprim %d\n", plen); 5063 goto invalid_size; 5064 } 5065 at += padded_size; 5066 break; 5067 /* Param's with a fixed size */ 5068 case SCTP_IPV4_ADDRESS: 5069 if (padded_size != sizeof(struct sctp_ipv4addr_param)) { 5070 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv4 addr %d\n", plen); 5071 goto invalid_size; 5072 } 5073 at += padded_size; 5074 break; 5075 case SCTP_IPV6_ADDRESS: 5076 if (padded_size != sizeof(struct sctp_ipv6addr_param)) { 5077 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv6 addr %d\n", plen); 5078 goto invalid_size; 5079 } 5080 at += padded_size; 5081 break; 5082 case SCTP_COOKIE_PRESERVE: 5083 if (padded_size != sizeof(struct sctp_cookie_perserve_param)) { 5084 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error cookie-preserve %d\n", plen); 5085 goto invalid_size; 5086 } 5087 at += padded_size; 5088 break; 5089 case SCTP_HAS_NAT_SUPPORT: 5090 *nat_friendly = 1; 5091 /* fall through */ 5092 case SCTP_PRSCTP_SUPPORTED: 5093 if (padded_size != sizeof(struct sctp_paramhdr)) { 5094 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error prsctp/nat support %d\n", plen); 5095 goto invalid_size; 5096 } 5097 at += padded_size; 5098 break; 5099 case SCTP_ECN_CAPABLE: 5100 if (padded_size != sizeof(struct sctp_paramhdr)) { 5101 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecn %d\n", plen); 5102 goto invalid_size; 5103 } 5104 at += padded_size; 5105 break; 5106 case SCTP_ULP_ADAPTATION: 5107 if (padded_size != sizeof(struct sctp_adaptation_layer_indication)) { 5108 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error adapatation %d\n", plen); 5109 goto invalid_size; 5110 } 5111 at += padded_size; 5112 break; 5113 case SCTP_SUCCESS_REPORT: 5114 if (padded_size != sizeof(struct sctp_asconf_paramhdr)) { 5115 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error success %d\n", plen); 5116 goto invalid_size; 5117 } 5118 at += padded_size; 5119 break; 5120 case SCTP_HOSTNAME_ADDRESS: 5121 { 5122 /* Hostname parameters are deprecated. */ 5123 struct sctp_gen_error_cause *cause; 5124 int l_len; 5125 5126 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Can't handle hostname addresses.. abort processing\n"); 5127 *abort_processing = 1; 5128 sctp_m_freem(op_err); 5129 op_err = NULL; 5130 op_err_last = NULL; 5131#ifdef INET6 5132 l_len = SCTP_MIN_OVERHEAD; 5133#else 5134 l_len = SCTP_MIN_V4_OVERHEAD; 5135#endif 5136 l_len += sizeof(struct sctp_chunkhdr); 5137 l_len += sizeof(struct sctp_gen_error_cause); 5138 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5139 if (op_err != NULL) { 5140 /* 5141 * Pre-reserve space for IP, SCTP, 5142 * and chunk header. 5143 */ 5144#ifdef INET6 5145 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5146#else 5147 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5148#endif 5149 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5150 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5151 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause); 5152 cause = mtod(op_err, struct sctp_gen_error_cause *); 5153 cause->code = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR); 5154 cause->length = htons((uint16_t)(sizeof(struct sctp_gen_error_cause) + plen)); 5155 SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(mat, at, plen, M_NOWAIT); 5156 if (SCTP_BUF_NEXT(op_err) == NULL) { 5157 sctp_m_freem(op_err); 5158 op_err = NULL; 5159 op_err_last = NULL; 5160 } 5161 } 5162 return (op_err); 5163 break; 5164 } 5165 default: 5166 /* 5167 * we do not recognize the parameter figure out what 5168 * we do. 5169 */ 5170 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Hit default param %x\n", ptype); 5171 if ((ptype & 0x4000) == 0x4000) { 5172 /* Report bit is set?? */ 5173 SCTPDBG(SCTP_DEBUG_OUTPUT1, "report op err\n"); 5174 if (op_err == NULL) { 5175 int l_len; 5176 5177 /* Ok need to try to get an mbuf */ 5178#ifdef INET6 5179 l_len = SCTP_MIN_OVERHEAD; 5180#else 5181 l_len = SCTP_MIN_V4_OVERHEAD; 5182#endif 5183 l_len += sizeof(struct sctp_chunkhdr); 5184 l_len += sizeof(struct sctp_paramhdr); 5185 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5186 if (op_err) { 5187 SCTP_BUF_LEN(op_err) = 0; 5188#ifdef INET6 5189 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5190#else 5191 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5192#endif 5193 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5194 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5195 op_err_last = op_err; 5196 } 5197 } 5198 if (op_err != NULL) { 5199 /* If we have space */ 5200 struct sctp_paramhdr *param; 5201 5202 if (pad_needed > 0) { 5203 op_err_last = sctp_add_pad_tombuf(op_err_last, pad_needed); 5204 } 5205 if (op_err_last == NULL) { 5206 sctp_m_freem(op_err); 5207 op_err = NULL; 5208 op_err_last = NULL; 5209 goto more_processing; 5210 } 5211 if (M_TRAILINGSPACE(op_err_last) < (int)sizeof(struct sctp_paramhdr)) { 5212 m_tmp = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_NOWAIT, 1, MT_DATA); 5213 if (m_tmp == NULL) { 5214 sctp_m_freem(op_err); 5215 op_err = NULL; 5216 op_err_last = NULL; 5217 goto more_processing; 5218 } 5219 SCTP_BUF_LEN(m_tmp) = 0; 5220 SCTP_BUF_NEXT(m_tmp) = NULL; 5221 SCTP_BUF_NEXT(op_err_last) = m_tmp; 5222 op_err_last = m_tmp; 5223 } 5224 param = (struct sctp_paramhdr *)(mtod(op_err_last, caddr_t)+SCTP_BUF_LEN(op_err_last)); 5225 param->param_type = htons(SCTP_UNRECOG_PARAM); 5226 param->param_length = htons((uint16_t)sizeof(struct sctp_paramhdr) + plen); 5227 SCTP_BUF_LEN(op_err_last) += sizeof(struct sctp_paramhdr); 5228 SCTP_BUF_NEXT(op_err_last) = SCTP_M_COPYM(mat, at, plen, M_NOWAIT); 5229 if (SCTP_BUF_NEXT(op_err_last) == NULL) { 5230 sctp_m_freem(op_err); 5231 op_err = NULL; 5232 op_err_last = NULL; 5233 goto more_processing; 5234 } else { 5235 while (SCTP_BUF_NEXT(op_err_last) != NULL) { 5236 op_err_last = SCTP_BUF_NEXT(op_err_last); 5237 } 5238 } 5239 if (plen % 4 != 0) { 5240 pad_needed = 4 - (plen % 4); 5241 } else { 5242 pad_needed = 0; 5243 } 5244 } 5245 } 5246 more_processing: 5247 if ((ptype & 0x8000) == 0x0000) { 5248 SCTPDBG(SCTP_DEBUG_OUTPUT1, "stop proc\n"); 5249 return (op_err); 5250 } else { 5251 /* skip this chunk and continue processing */ 5252 SCTPDBG(SCTP_DEBUG_OUTPUT1, "move on\n"); 5253 at += SCTP_SIZE32(plen); 5254 } 5255 break; 5256 5257 } 5258 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5259 } 5260 return (op_err); 5261invalid_size: 5262 SCTPDBG(SCTP_DEBUG_OUTPUT1, "abort flag set\n"); 5263 *abort_processing = 1; 5264 sctp_m_freem(op_err); 5265 op_err = NULL; 5266 op_err_last = NULL; 5267 if (phdr != NULL) { 5268 struct sctp_paramhdr *param; 5269 int l_len; 5270#ifdef INET6 5271 l_len = SCTP_MIN_OVERHEAD; 5272#else 5273 l_len = SCTP_MIN_V4_OVERHEAD; 5274#endif 5275 l_len += sizeof(struct sctp_chunkhdr); 5276 l_len += (2 * sizeof(struct sctp_paramhdr)); 5277 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5278 if (op_err) { 5279 SCTP_BUF_LEN(op_err) = 0; 5280#ifdef INET6 5281 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5282#else 5283 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5284#endif 5285 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5286 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5287 SCTP_BUF_LEN(op_err) = 2 * sizeof(struct sctp_paramhdr); 5288 param = mtod(op_err, struct sctp_paramhdr *); 5289 param->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 5290 param->param_length = htons(2 * sizeof(struct sctp_paramhdr)); 5291 param++; 5292 param->param_type = htons(ptype); 5293 param->param_length = htons(plen); 5294 } 5295 } 5296 return (op_err); 5297} 5298 5299static int 5300sctp_are_there_new_addresses(struct sctp_association *asoc, 5301 struct mbuf *in_initpkt, int offset, struct sockaddr *src) 5302{ 5303 /* 5304 * Given a INIT packet, look through the packet to verify that there 5305 * are NO new addresses. As we go through the parameters add reports 5306 * of any un-understood parameters that require an error. Also we 5307 * must return (1) to drop the packet if we see a un-understood 5308 * parameter that tells us to drop the chunk. 5309 */ 5310 struct sockaddr *sa_touse; 5311 struct sockaddr *sa; 5312 struct sctp_paramhdr *phdr, params; 5313 uint16_t ptype, plen; 5314 uint8_t fnd; 5315 struct sctp_nets *net; 5316 int check_src; 5317#ifdef INET 5318 struct sockaddr_in sin4, *sa4; 5319#endif 5320#ifdef INET6 5321 struct sockaddr_in6 sin6, *sa6; 5322#endif 5323 5324#ifdef INET 5325 memset(&sin4, 0, sizeof(sin4)); 5326 sin4.sin_family = AF_INET; 5327 sin4.sin_len = sizeof(sin4); 5328#endif 5329#ifdef INET6 5330 memset(&sin6, 0, sizeof(sin6)); 5331 sin6.sin6_family = AF_INET6; 5332 sin6.sin6_len = sizeof(sin6); 5333#endif 5334 /* First what about the src address of the pkt ? */ 5335 check_src = 0; 5336 switch (src->sa_family) { 5337#ifdef INET 5338 case AF_INET: 5339 if (asoc->scope.ipv4_addr_legal) { 5340 check_src = 1; 5341 } 5342 break; 5343#endif 5344#ifdef INET6 5345 case AF_INET6: 5346 if (asoc->scope.ipv6_addr_legal) { 5347 check_src = 1; 5348 } 5349 break; 5350#endif 5351 default: 5352 /* TSNH */ 5353 break; 5354 } 5355 if (check_src) { 5356 fnd = 0; 5357 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5358 sa = (struct sockaddr *)&net->ro._l_addr; 5359 if (sa->sa_family == src->sa_family) { 5360#ifdef INET 5361 if (sa->sa_family == AF_INET) { 5362 struct sockaddr_in *src4; 5363 5364 sa4 = (struct sockaddr_in *)sa; 5365 src4 = (struct sockaddr_in *)src; 5366 if (sa4->sin_addr.s_addr == src4->sin_addr.s_addr) { 5367 fnd = 1; 5368 break; 5369 } 5370 } 5371#endif 5372#ifdef INET6 5373 if (sa->sa_family == AF_INET6) { 5374 struct sockaddr_in6 *src6; 5375 5376 sa6 = (struct sockaddr_in6 *)sa; 5377 src6 = (struct sockaddr_in6 *)src; 5378 if (SCTP6_ARE_ADDR_EQUAL(sa6, src6)) { 5379 fnd = 1; 5380 break; 5381 } 5382 } 5383#endif 5384 } 5385 } 5386 if (fnd == 0) { 5387 /* New address added! no need to look further. */ 5388 return (1); 5389 } 5390 } 5391 /* Ok so far lets munge through the rest of the packet */ 5392 offset += sizeof(struct sctp_init_chunk); 5393 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5394 while (phdr) { 5395 sa_touse = NULL; 5396 ptype = ntohs(phdr->param_type); 5397 plen = ntohs(phdr->param_length); 5398 switch (ptype) { 5399#ifdef INET 5400 case SCTP_IPV4_ADDRESS: 5401 { 5402 struct sctp_ipv4addr_param *p4, p4_buf; 5403 5404 if (plen != sizeof(struct sctp_ipv4addr_param)) { 5405 return (1); 5406 } 5407 phdr = sctp_get_next_param(in_initpkt, offset, 5408 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 5409 if (phdr == NULL) { 5410 return (1); 5411 } 5412 if (asoc->scope.ipv4_addr_legal) { 5413 p4 = (struct sctp_ipv4addr_param *)phdr; 5414 sin4.sin_addr.s_addr = p4->addr; 5415 sa_touse = (struct sockaddr *)&sin4; 5416 } 5417 break; 5418 } 5419#endif 5420#ifdef INET6 5421 case SCTP_IPV6_ADDRESS: 5422 { 5423 struct sctp_ipv6addr_param *p6, p6_buf; 5424 5425 if (plen != sizeof(struct sctp_ipv6addr_param)) { 5426 return (1); 5427 } 5428 phdr = sctp_get_next_param(in_initpkt, offset, 5429 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 5430 if (phdr == NULL) { 5431 return (1); 5432 } 5433 if (asoc->scope.ipv6_addr_legal) { 5434 p6 = (struct sctp_ipv6addr_param *)phdr; 5435 memcpy((caddr_t)&sin6.sin6_addr, p6->addr, 5436 sizeof(p6->addr)); 5437 sa_touse = (struct sockaddr *)&sin6; 5438 } 5439 break; 5440 } 5441#endif 5442 default: 5443 sa_touse = NULL; 5444 break; 5445 } 5446 if (sa_touse) { 5447 /* ok, sa_touse points to one to check */ 5448 fnd = 0; 5449 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5450 sa = (struct sockaddr *)&net->ro._l_addr; 5451 if (sa->sa_family != sa_touse->sa_family) { 5452 continue; 5453 } 5454#ifdef INET 5455 if (sa->sa_family == AF_INET) { 5456 sa4 = (struct sockaddr_in *)sa; 5457 if (sa4->sin_addr.s_addr == 5458 sin4.sin_addr.s_addr) { 5459 fnd = 1; 5460 break; 5461 } 5462 } 5463#endif 5464#ifdef INET6 5465 if (sa->sa_family == AF_INET6) { 5466 sa6 = (struct sockaddr_in6 *)sa; 5467 if (SCTP6_ARE_ADDR_EQUAL( 5468 sa6, &sin6)) { 5469 fnd = 1; 5470 break; 5471 } 5472 } 5473#endif 5474 } 5475 if (!fnd) { 5476 /* New addr added! no need to look further */ 5477 return (1); 5478 } 5479 } 5480 offset += SCTP_SIZE32(plen); 5481 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5482 } 5483 return (0); 5484} 5485 5486/* 5487 * Given a MBUF chain that was sent into us containing an INIT. Build a 5488 * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done 5489 * a pullup to include IPv6/4header, SCTP header and initial part of INIT 5490 * message (i.e. the struct sctp_init_msg). 5491 */ 5492void 5493sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 5494 struct sctp_nets *src_net, struct mbuf *init_pkt, 5495 int iphlen, int offset, 5496 struct sockaddr *src, struct sockaddr *dst, 5497 struct sctphdr *sh, struct sctp_init_chunk *init_chk, 5498 uint8_t mflowtype, uint32_t mflowid, 5499 uint32_t vrf_id, uint16_t port) 5500{ 5501 struct sctp_association *asoc; 5502 struct mbuf *m, *m_tmp, *m_last, *m_cookie, *op_err; 5503 struct sctp_init_ack_chunk *initack; 5504 struct sctp_adaptation_layer_indication *ali; 5505 struct sctp_supported_chunk_types_param *pr_supported; 5506 struct sctp_paramhdr *ph; 5507 union sctp_sockstore *over_addr; 5508 struct sctp_scoping scp; 5509 struct timeval now; 5510#ifdef INET 5511 struct sockaddr_in *dst4 = (struct sockaddr_in *)dst; 5512 struct sockaddr_in *src4 = (struct sockaddr_in *)src; 5513 struct sockaddr_in *sin; 5514#endif 5515#ifdef INET6 5516 struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst; 5517 struct sockaddr_in6 *src6 = (struct sockaddr_in6 *)src; 5518 struct sockaddr_in6 *sin6; 5519#endif 5520 struct sockaddr *to; 5521 struct sctp_state_cookie stc; 5522 struct sctp_nets *net = NULL; 5523 uint8_t *signature = NULL; 5524 int cnt_inits_to = 0; 5525 uint16_t his_limit, i_want; 5526 int abort_flag; 5527 int nat_friendly = 0; 5528 int error; 5529 struct socket *so; 5530 uint16_t num_ext, chunk_len, padding_len, parameter_len; 5531 5532 if (stcb) { 5533 asoc = &stcb->asoc; 5534 } else { 5535 asoc = NULL; 5536 } 5537 if ((asoc != NULL) && 5538 (SCTP_GET_STATE(stcb) != SCTP_STATE_COOKIE_WAIT)) { 5539 if (sctp_are_there_new_addresses(asoc, init_pkt, offset, src)) { 5540 /* 5541 * new addresses, out of here in non-cookie-wait 5542 * states 5543 * 5544 * Send an ABORT, without the new address error 5545 * cause. This looks no different than if no 5546 * listener was present. 5547 */ 5548 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5549 "Address added"); 5550 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5551 mflowtype, mflowid, inp->fibnum, 5552 vrf_id, port); 5553 return; 5554 } 5555 if (src_net != NULL && (src_net->port != port)) { 5556 /* 5557 * change of remote encapsulation port, out of here 5558 * in non-cookie-wait states 5559 * 5560 * Send an ABORT, without an specific error cause. 5561 * This looks no different than if no listener was 5562 * present. 5563 */ 5564 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5565 "Remote encapsulation port changed"); 5566 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5567 mflowtype, mflowid, inp->fibnum, 5568 vrf_id, port); 5569 return; 5570 } 5571 } 5572 abort_flag = 0; 5573 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 5574 (offset + sizeof(struct sctp_init_chunk)), 5575 &abort_flag, 5576 (struct sctp_chunkhdr *)init_chk, 5577 &nat_friendly, NULL); 5578 if (abort_flag) { 5579do_a_abort: 5580 if (op_err == NULL) { 5581 char msg[SCTP_DIAG_INFO_LEN]; 5582 5583 snprintf(msg, sizeof(msg), "%s:%d at %s", __FILE__, __LINE__, __func__); 5584 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5585 msg); 5586 } 5587 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 5588 init_chk->init.initiate_tag, op_err, 5589 mflowtype, mflowid, inp->fibnum, 5590 vrf_id, port); 5591 return; 5592 } 5593 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 5594 if (m == NULL) { 5595 /* No memory, INIT timer will re-attempt. */ 5596 sctp_m_freem(op_err); 5597 return; 5598 } 5599 chunk_len = (uint16_t)sizeof(struct sctp_init_ack_chunk); 5600 padding_len = 0; 5601 5602 /* 5603 * We might not overwrite the identification[] completely and on 5604 * some platforms time_entered will contain some padding. Therefore 5605 * zero out the cookie to avoid putting uninitialized memory on the 5606 * wire. 5607 */ 5608 memset(&stc, 0, sizeof(struct sctp_state_cookie)); 5609 5610 /* the time I built cookie */ 5611 (void)SCTP_GETTIME_TIMEVAL(&now); 5612 stc.time_entered.tv_sec = now.tv_sec; 5613 stc.time_entered.tv_usec = now.tv_usec; 5614 5615 /* populate any tie tags */ 5616 if (asoc != NULL) { 5617 /* unlock before tag selections */ 5618 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 5619 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 5620 stc.cookie_life = asoc->cookie_life; 5621 net = asoc->primary_destination; 5622 } else { 5623 stc.tie_tag_my_vtag = 0; 5624 stc.tie_tag_peer_vtag = 0; 5625 /* life I will award this cookie */ 5626 stc.cookie_life = inp->sctp_ep.def_cookie_life; 5627 } 5628 5629 /* copy in the ports for later check */ 5630 stc.myport = sh->dest_port; 5631 stc.peerport = sh->src_port; 5632 5633 /* 5634 * If we wanted to honor cookie life extensions, we would add to 5635 * stc.cookie_life. For now we should NOT honor any extension 5636 */ 5637 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 5638 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5639 stc.ipv6_addr_legal = 1; 5640 if (SCTP_IPV6_V6ONLY(inp)) { 5641 stc.ipv4_addr_legal = 0; 5642 } else { 5643 stc.ipv4_addr_legal = 1; 5644 } 5645 } else { 5646 stc.ipv6_addr_legal = 0; 5647 stc.ipv4_addr_legal = 1; 5648 } 5649 stc.ipv4_scope = 0; 5650 if (net == NULL) { 5651 to = src; 5652 switch (dst->sa_family) { 5653#ifdef INET 5654 case AF_INET: 5655 { 5656 /* lookup address */ 5657 stc.address[0] = src4->sin_addr.s_addr; 5658 stc.address[1] = 0; 5659 stc.address[2] = 0; 5660 stc.address[3] = 0; 5661 stc.addr_type = SCTP_IPV4_ADDRESS; 5662 /* local from address */ 5663 stc.laddress[0] = dst4->sin_addr.s_addr; 5664 stc.laddress[1] = 0; 5665 stc.laddress[2] = 0; 5666 stc.laddress[3] = 0; 5667 stc.laddr_type = SCTP_IPV4_ADDRESS; 5668 /* scope_id is only for v6 */ 5669 stc.scope_id = 0; 5670 if ((IN4_ISPRIVATE_ADDRESS(&src4->sin_addr)) || 5671 (IN4_ISPRIVATE_ADDRESS(&dst4->sin_addr))) { 5672 stc.ipv4_scope = 1; 5673 } 5674 /* Must use the address in this case */ 5675 if (sctp_is_address_on_local_host(src, vrf_id)) { 5676 stc.loopback_scope = 1; 5677 stc.ipv4_scope = 1; 5678 stc.site_scope = 1; 5679 stc.local_scope = 0; 5680 } 5681 break; 5682 } 5683#endif 5684#ifdef INET6 5685 case AF_INET6: 5686 { 5687 stc.addr_type = SCTP_IPV6_ADDRESS; 5688 memcpy(&stc.address, &src6->sin6_addr, sizeof(struct in6_addr)); 5689 stc.scope_id = ntohs(in6_getscope(&src6->sin6_addr)); 5690 if (sctp_is_address_on_local_host(src, vrf_id)) { 5691 stc.loopback_scope = 1; 5692 stc.local_scope = 0; 5693 stc.site_scope = 1; 5694 stc.ipv4_scope = 1; 5695 } else if (IN6_IS_ADDR_LINKLOCAL(&src6->sin6_addr) || 5696 IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr)) { 5697 /* 5698 * If the new destination or source 5699 * is a LINK_LOCAL we must have 5700 * common both site and local scope. 5701 * Don't set local scope though 5702 * since we must depend on the 5703 * source to be added implicitly. We 5704 * cannot assure just because we 5705 * share one link that all links are 5706 * common. 5707 */ 5708 stc.local_scope = 0; 5709 stc.site_scope = 1; 5710 stc.ipv4_scope = 1; 5711 /* 5712 * we start counting for the private 5713 * address stuff at 1. since the 5714 * link local we source from won't 5715 * show up in our scoped count. 5716 */ 5717 cnt_inits_to = 1; 5718 /* 5719 * pull out the scope_id from 5720 * incoming pkt 5721 */ 5722 } else if (IN6_IS_ADDR_SITELOCAL(&src6->sin6_addr) || 5723 IN6_IS_ADDR_SITELOCAL(&dst6->sin6_addr)) { 5724 /* 5725 * If the new destination or source 5726 * is SITE_LOCAL then we must have 5727 * site scope in common. 5728 */ 5729 stc.site_scope = 1; 5730 } 5731 memcpy(&stc.laddress, &dst6->sin6_addr, sizeof(struct in6_addr)); 5732 stc.laddr_type = SCTP_IPV6_ADDRESS; 5733 break; 5734 } 5735#endif 5736 default: 5737 /* TSNH */ 5738 goto do_a_abort; 5739 break; 5740 } 5741 } else { 5742 /* set the scope per the existing tcb */ 5743 5744#ifdef INET6 5745 struct sctp_nets *lnet; 5746#endif 5747 5748 stc.loopback_scope = asoc->scope.loopback_scope; 5749 stc.ipv4_scope = asoc->scope.ipv4_local_scope; 5750 stc.site_scope = asoc->scope.site_scope; 5751 stc.local_scope = asoc->scope.local_scope; 5752#ifdef INET6 5753 /* Why do we not consider IPv4 LL addresses? */ 5754 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 5755 if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) { 5756 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) { 5757 /* 5758 * if we have a LL address, start 5759 * counting at 1. 5760 */ 5761 cnt_inits_to = 1; 5762 } 5763 } 5764 } 5765#endif 5766 /* use the net pointer */ 5767 to = (struct sockaddr *)&net->ro._l_addr; 5768 switch (to->sa_family) { 5769#ifdef INET 5770 case AF_INET: 5771 sin = (struct sockaddr_in *)to; 5772 stc.address[0] = sin->sin_addr.s_addr; 5773 stc.address[1] = 0; 5774 stc.address[2] = 0; 5775 stc.address[3] = 0; 5776 stc.addr_type = SCTP_IPV4_ADDRESS; 5777 if (net->src_addr_selected == 0) { 5778 /* 5779 * strange case here, the INIT should have 5780 * did the selection. 5781 */ 5782 net->ro._s_addr = sctp_source_address_selection(inp, 5783 stcb, (sctp_route_t *)&net->ro, 5784 net, 0, vrf_id); 5785 if (net->ro._s_addr == NULL) { 5786 sctp_m_freem(op_err); 5787 sctp_m_freem(m); 5788 return; 5789 } 5790 5791 net->src_addr_selected = 1; 5792 5793 } 5794 stc.laddress[0] = net->ro._s_addr->address.sin.sin_addr.s_addr; 5795 stc.laddress[1] = 0; 5796 stc.laddress[2] = 0; 5797 stc.laddress[3] = 0; 5798 stc.laddr_type = SCTP_IPV4_ADDRESS; 5799 /* scope_id is only for v6 */ 5800 stc.scope_id = 0; 5801 break; 5802#endif 5803#ifdef INET6 5804 case AF_INET6: 5805 sin6 = (struct sockaddr_in6 *)to; 5806 memcpy(&stc.address, &sin6->sin6_addr, 5807 sizeof(struct in6_addr)); 5808 stc.addr_type = SCTP_IPV6_ADDRESS; 5809 stc.scope_id = sin6->sin6_scope_id; 5810 if (net->src_addr_selected == 0) { 5811 /* 5812 * strange case here, the INIT should have 5813 * done the selection. 5814 */ 5815 net->ro._s_addr = sctp_source_address_selection(inp, 5816 stcb, (sctp_route_t *)&net->ro, 5817 net, 0, vrf_id); 5818 if (net->ro._s_addr == NULL) { 5819 sctp_m_freem(op_err); 5820 sctp_m_freem(m); 5821 return; 5822 } 5823 5824 net->src_addr_selected = 1; 5825 } 5826 memcpy(&stc.laddress, &net->ro._s_addr->address.sin6.sin6_addr, 5827 sizeof(struct in6_addr)); 5828 stc.laddr_type = SCTP_IPV6_ADDRESS; 5829 break; 5830#endif 5831 } 5832 } 5833 /* Now lets put the SCTP header in place */ 5834 initack = mtod(m, struct sctp_init_ack_chunk *); 5835 /* Save it off for quick ref */ 5836 stc.peers_vtag = ntohl(init_chk->init.initiate_tag); 5837 /* who are we */ 5838 memcpy(stc.identification, SCTP_VERSION_STRING, 5839 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 5840 memset(stc.reserved, 0, SCTP_RESERVE_SPACE); 5841 /* now the chunk header */ 5842 initack->ch.chunk_type = SCTP_INITIATION_ACK; 5843 initack->ch.chunk_flags = 0; 5844 /* fill in later from mbuf we build */ 5845 initack->ch.chunk_length = 0; 5846 /* place in my tag */ 5847 if ((asoc != NULL) && 5848 ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 5849 (SCTP_GET_STATE(stcb) == SCTP_STATE_INUSE) || 5850 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED))) { 5851 /* re-use the v-tags and init-seq here */ 5852 initack->init.initiate_tag = htonl(asoc->my_vtag); 5853 initack->init.initial_tsn = htonl(asoc->init_seq_number); 5854 } else { 5855 uint32_t vtag, itsn; 5856 5857 if (asoc) { 5858 atomic_add_int(&asoc->refcnt, 1); 5859 SCTP_TCB_UNLOCK(stcb); 5860 new_tag: 5861 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5862 if ((asoc->peer_supports_nat) && (vtag == asoc->my_vtag)) { 5863 /* 5864 * Got a duplicate vtag on some guy behind a 5865 * nat make sure we don't use it. 5866 */ 5867 goto new_tag; 5868 } 5869 initack->init.initiate_tag = htonl(vtag); 5870 /* get a TSN to use too */ 5871 itsn = sctp_select_initial_TSN(&inp->sctp_ep); 5872 initack->init.initial_tsn = htonl(itsn); 5873 SCTP_TCB_LOCK(stcb); 5874 atomic_add_int(&asoc->refcnt, -1); 5875 } else { 5876 SCTP_INP_INCR_REF(inp); 5877 SCTP_INP_RUNLOCK(inp); 5878 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5879 initack->init.initiate_tag = htonl(vtag); 5880 /* get a TSN to use too */ 5881 initack->init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 5882 SCTP_INP_RLOCK(inp); 5883 SCTP_INP_DECR_REF(inp); 5884 } 5885 } 5886 /* save away my tag to */ 5887 stc.my_vtag = initack->init.initiate_tag; 5888 5889 /* set up some of the credits. */ 5890 so = inp->sctp_socket; 5891 if (so == NULL) { 5892 /* memory problem */ 5893 sctp_m_freem(op_err); 5894 sctp_m_freem(m); 5895 return; 5896 } else { 5897 initack->init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(so), SCTP_MINIMAL_RWND)); 5898 } 5899 /* set what I want */ 5900 his_limit = ntohs(init_chk->init.num_inbound_streams); 5901 /* choose what I want */ 5902 if (asoc != NULL) { 5903 if (asoc->streamoutcnt > asoc->pre_open_streams) { 5904 i_want = asoc->streamoutcnt; 5905 } else { 5906 i_want = asoc->pre_open_streams; 5907 } 5908 } else { 5909 i_want = inp->sctp_ep.pre_open_stream_count; 5910 } 5911 if (his_limit < i_want) { 5912 /* I Want more :< */ 5913 initack->init.num_outbound_streams = init_chk->init.num_inbound_streams; 5914 } else { 5915 /* I can have what I want :> */ 5916 initack->init.num_outbound_streams = htons(i_want); 5917 } 5918 /* tell him his limit. */ 5919 initack->init.num_inbound_streams = 5920 htons(inp->sctp_ep.max_open_streams_intome); 5921 5922 /* adaptation layer indication parameter */ 5923 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 5924 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 5925 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 5926 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 5927 ali->ph.param_length = htons(parameter_len); 5928 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 5929 chunk_len += parameter_len; 5930 } 5931 5932 /* ECN parameter */ 5933 if (((asoc != NULL) && (asoc->ecn_supported == 1)) || 5934 ((asoc == NULL) && (inp->ecn_supported == 1))) { 5935 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5936 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5937 ph->param_type = htons(SCTP_ECN_CAPABLE); 5938 ph->param_length = htons(parameter_len); 5939 chunk_len += parameter_len; 5940 } 5941 5942 /* PR-SCTP supported parameter */ 5943 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5944 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5945 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5946 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5947 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 5948 ph->param_length = htons(parameter_len); 5949 chunk_len += parameter_len; 5950 } 5951 5952 /* Add NAT friendly parameter */ 5953 if (nat_friendly) { 5954 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5955 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5956 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 5957 ph->param_length = htons(parameter_len); 5958 chunk_len += parameter_len; 5959 } 5960 5961 /* And now tell the peer which extensions we support */ 5962 num_ext = 0; 5963 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 5964 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5965 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5966 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 5967 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5968 ((asoc == NULL) && (inp->idata_supported == 1))) { 5969 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 5970 } 5971 } 5972 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5973 ((asoc == NULL) && (inp->auth_supported == 1))) { 5974 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 5975 } 5976 if (((asoc != NULL) && (asoc->asconf_supported == 1)) || 5977 ((asoc == NULL) && (inp->asconf_supported == 1))) { 5978 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 5979 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 5980 } 5981 if (((asoc != NULL) && (asoc->reconfig_supported == 1)) || 5982 ((asoc == NULL) && (inp->reconfig_supported == 1))) { 5983 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 5984 } 5985 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5986 ((asoc == NULL) && (inp->idata_supported == 1))) { 5987 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 5988 } 5989 if (((asoc != NULL) && (asoc->nrsack_supported == 1)) || 5990 ((asoc == NULL) && (inp->nrsack_supported == 1))) { 5991 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 5992 } 5993 if (((asoc != NULL) && (asoc->pktdrop_supported == 1)) || 5994 ((asoc == NULL) && (inp->pktdrop_supported == 1))) { 5995 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 5996 } 5997 if (num_ext > 0) { 5998 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 5999 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 6000 pr_supported->ph.param_length = htons(parameter_len); 6001 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6002 chunk_len += parameter_len; 6003 } 6004 6005 /* add authentication parameters */ 6006 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 6007 ((asoc == NULL) && (inp->auth_supported == 1))) { 6008 struct sctp_auth_random *randp; 6009 struct sctp_auth_hmac_algo *hmacs; 6010 struct sctp_auth_chunk_list *chunks; 6011 6012 if (padding_len > 0) { 6013 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6014 chunk_len += padding_len; 6015 padding_len = 0; 6016 } 6017 /* generate and add RANDOM parameter */ 6018 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 6019 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + 6020 SCTP_AUTH_RANDOM_SIZE_DEFAULT; 6021 randp->ph.param_type = htons(SCTP_RANDOM); 6022 randp->ph.param_length = htons(parameter_len); 6023 SCTP_READ_RANDOM(randp->random_data, SCTP_AUTH_RANDOM_SIZE_DEFAULT); 6024 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6025 chunk_len += parameter_len; 6026 6027 if (padding_len > 0) { 6028 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6029 chunk_len += padding_len; 6030 padding_len = 0; 6031 } 6032 /* add HMAC_ALGO parameter */ 6033 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 6034 parameter_len = (uint16_t)sizeof(struct sctp_auth_hmac_algo) + 6035 sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs, 6036 (uint8_t *)hmacs->hmac_ids); 6037 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 6038 hmacs->ph.param_length = htons(parameter_len); 6039 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6040 chunk_len += parameter_len; 6041 6042 if (padding_len > 0) { 6043 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6044 chunk_len += padding_len; 6045 padding_len = 0; 6046 } 6047 /* add CHUNKS parameter */ 6048 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 6049 parameter_len = (uint16_t)sizeof(struct sctp_auth_chunk_list) + 6050 sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks, 6051 chunks->chunk_types); 6052 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 6053 chunks->ph.param_length = htons(parameter_len); 6054 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6055 chunk_len += parameter_len; 6056 } 6057 SCTP_BUF_LEN(m) = chunk_len; 6058 m_last = m; 6059 /* now the addresses */ 6060 /* 6061 * To optimize this we could put the scoping stuff into a structure 6062 * and remove the individual uint8's from the stc structure. Then we 6063 * could just sifa in the address within the stc.. but for now this 6064 * is a quick hack to get the address stuff teased apart. 6065 */ 6066 scp.ipv4_addr_legal = stc.ipv4_addr_legal; 6067 scp.ipv6_addr_legal = stc.ipv6_addr_legal; 6068 scp.loopback_scope = stc.loopback_scope; 6069 scp.ipv4_local_scope = stc.ipv4_scope; 6070 scp.local_scope = stc.local_scope; 6071 scp.site_scope = stc.site_scope; 6072 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &scp, m_last, 6073 cnt_inits_to, 6074 &padding_len, &chunk_len); 6075 /* padding_len can only be positive, if no addresses have been added */ 6076 if (padding_len > 0) { 6077 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6078 chunk_len += padding_len; 6079 SCTP_BUF_LEN(m) += padding_len; 6080 padding_len = 0; 6081 } 6082 6083 /* tack on the operational error if present */ 6084 if (op_err) { 6085 parameter_len = 0; 6086 for (m_tmp = op_err; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6087 parameter_len += SCTP_BUF_LEN(m_tmp); 6088 } 6089 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6090 SCTP_BUF_NEXT(m_last) = op_err; 6091 while (SCTP_BUF_NEXT(m_last) != NULL) { 6092 m_last = SCTP_BUF_NEXT(m_last); 6093 } 6094 chunk_len += parameter_len; 6095 } 6096 if (padding_len > 0) { 6097 m_last = sctp_add_pad_tombuf(m_last, padding_len); 6098 if (m_last == NULL) { 6099 /* Houston we have a problem, no space */ 6100 sctp_m_freem(m); 6101 return; 6102 } 6103 chunk_len += padding_len; 6104 padding_len = 0; 6105 } 6106 /* Now we must build a cookie */ 6107 m_cookie = sctp_add_cookie(init_pkt, offset, m, 0, &stc, &signature); 6108 if (m_cookie == NULL) { 6109 /* memory problem */ 6110 sctp_m_freem(m); 6111 return; 6112 } 6113 /* Now append the cookie to the end and update the space/size */ 6114 SCTP_BUF_NEXT(m_last) = m_cookie; 6115 parameter_len = 0; 6116 for (m_tmp = m_cookie; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6117 parameter_len += SCTP_BUF_LEN(m_tmp); 6118 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 6119 m_last = m_tmp; 6120 } 6121 } 6122 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6123 chunk_len += parameter_len; 6124 6125 /* 6126 * Place in the size, but we don't include the last pad (if any) in 6127 * the INIT-ACK. 6128 */ 6129 initack->ch.chunk_length = htons(chunk_len); 6130 6131 /* 6132 * Time to sign the cookie, we don't sign over the cookie signature 6133 * though thus we set trailer. 6134 */ 6135 (void)sctp_hmac_m(SCTP_HMAC, 6136 (uint8_t *)inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)], 6137 SCTP_SECRET_SIZE, m_cookie, sizeof(struct sctp_paramhdr), 6138 (uint8_t *)signature, SCTP_SIGNATURE_SIZE); 6139 /* 6140 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return 6141 * here since the timer will drive a retranmission. 6142 */ 6143 if (padding_len > 0) { 6144 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 6145 sctp_m_freem(m); 6146 return; 6147 } 6148 } 6149 if (stc.loopback_scope) { 6150 over_addr = (union sctp_sockstore *)dst; 6151 } else { 6152 over_addr = NULL; 6153 } 6154 6155 if ((error = sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0, 6156 0, 0, 6157 inp->sctp_lport, sh->src_port, init_chk->init.initiate_tag, 6158 port, over_addr, 6159 mflowtype, mflowid, 6160 SCTP_SO_NOT_LOCKED))) { 6161 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 6162 if (error == ENOBUFS) { 6163 if (asoc != NULL) { 6164 asoc->ifp_had_enobuf = 1; 6165 } 6166 SCTP_STAT_INCR(sctps_lowlevelerr); 6167 } 6168 } else { 6169 if (asoc != NULL) { 6170 asoc->ifp_had_enobuf = 0; 6171 } 6172 } 6173 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 6174} 6175 6176 6177static void 6178sctp_prune_prsctp(struct sctp_tcb *stcb, 6179 struct sctp_association *asoc, 6180 struct sctp_sndrcvinfo *srcv, 6181 int dataout) 6182{ 6183 int freed_spc = 0; 6184 struct sctp_tmit_chunk *chk, *nchk; 6185 6186 SCTP_TCB_LOCK_ASSERT(stcb); 6187 if ((asoc->prsctp_supported) && 6188 (asoc->sent_queue_cnt_removeable > 0)) { 6189 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6190 /* 6191 * Look for chunks marked with the PR_SCTP flag AND 6192 * the buffer space flag. If the one being sent is 6193 * equal or greater priority then purge the old one 6194 * and free some space. 6195 */ 6196 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6197 /* 6198 * This one is PR-SCTP AND buffer space 6199 * limited type 6200 */ 6201 if (chk->rec.data.timetodrop.tv_sec > (long)srcv->sinfo_timetolive) { 6202 /* 6203 * Lower numbers equates to higher 6204 * priority so if the one we are 6205 * looking at has a larger 6206 * priority we want to drop the data 6207 * and NOT retransmit it. 6208 */ 6209 if (chk->data) { 6210 /* 6211 * We release the book_size 6212 * if the mbuf is here 6213 */ 6214 int ret_spc; 6215 uint8_t sent; 6216 6217 if (chk->sent > SCTP_DATAGRAM_UNSENT) 6218 sent = 1; 6219 else 6220 sent = 0; 6221 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6222 sent, 6223 SCTP_SO_LOCKED); 6224 freed_spc += ret_spc; 6225 if (freed_spc >= dataout) { 6226 return; 6227 } 6228 } /* if chunk was present */ 6229 } /* if of sufficient priority */ 6230 } /* if chunk has enabled */ 6231 } /* tailqforeach */ 6232 6233 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 6234 /* Here we must move to the sent queue and mark */ 6235 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6236 if (chk->rec.data.timetodrop.tv_sec > (long)srcv->sinfo_timetolive) { 6237 if (chk->data) { 6238 /* 6239 * We release the book_size 6240 * if the mbuf is here 6241 */ 6242 int ret_spc; 6243 6244 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6245 0, SCTP_SO_LOCKED); 6246 6247 freed_spc += ret_spc; 6248 if (freed_spc >= dataout) { 6249 return; 6250 } 6251 } /* end if chk->data */ 6252 } /* end if right class */ 6253 } /* end if chk pr-sctp */ 6254 } /* tailqforeachsafe (chk) */ 6255 } /* if enabled in asoc */ 6256} 6257 6258int 6259sctp_get_frag_point(struct sctp_tcb *stcb, 6260 struct sctp_association *asoc) 6261{ 6262 int siz, ovh; 6263 6264 /* 6265 * For endpoints that have both v6 and v4 addresses we must reserve 6266 * room for the ipv6 header, for those that are only dealing with V4 6267 * we use a larger frag point. 6268 */ 6269 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6270 ovh = SCTP_MIN_OVERHEAD; 6271 } else { 6272 ovh = SCTP_MIN_V4_OVERHEAD; 6273 } 6274 ovh += SCTP_DATA_CHUNK_OVERHEAD(stcb); 6275 if (stcb->asoc.sctp_frag_point > asoc->smallest_mtu) 6276 siz = asoc->smallest_mtu - ovh; 6277 else 6278 siz = (stcb->asoc.sctp_frag_point - ovh); 6279 /* 6280 * if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { 6281 */ 6282 /* A data chunk MUST fit in a cluster */ 6283 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk)); */ 6284 /* } */ 6285 6286 /* adjust for an AUTH chunk if DATA requires auth */ 6287 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) 6288 siz -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 6289 6290 if (siz % 4) { 6291 /* make it an even word boundary please */ 6292 siz -= (siz % 4); 6293 } 6294 return (siz); 6295} 6296 6297static void 6298sctp_set_prsctp_policy(struct sctp_stream_queue_pending *sp) 6299{ 6300 /* 6301 * We assume that the user wants PR_SCTP_TTL if the user provides a 6302 * positive lifetime but does not specify any PR_SCTP policy. 6303 */ 6304 if (PR_SCTP_ENABLED(sp->sinfo_flags)) { 6305 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6306 } else if (sp->timetolive > 0) { 6307 sp->sinfo_flags |= SCTP_PR_SCTP_TTL; 6308 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6309 } else { 6310 return; 6311 } 6312 switch (PR_SCTP_POLICY(sp->sinfo_flags)) { 6313 case CHUNK_FLAGS_PR_SCTP_BUF: 6314 /* 6315 * Time to live is a priority stored in tv_sec when doing 6316 * the buffer drop thing. 6317 */ 6318 sp->ts.tv_sec = sp->timetolive; 6319 sp->ts.tv_usec = 0; 6320 break; 6321 case CHUNK_FLAGS_PR_SCTP_TTL: 6322 { 6323 struct timeval tv; 6324 6325 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6326 tv.tv_sec = sp->timetolive / 1000; 6327 tv.tv_usec = (sp->timetolive * 1000) % 1000000; 6328 /* 6329 * TODO sctp_constants.h needs alternative time 6330 * macros when _KERNEL is undefined. 6331 */ 6332 timevaladd(&sp->ts, &tv); 6333 } 6334 break; 6335 case CHUNK_FLAGS_PR_SCTP_RTX: 6336 /* 6337 * Time to live is a the number or retransmissions stored in 6338 * tv_sec. 6339 */ 6340 sp->ts.tv_sec = sp->timetolive; 6341 sp->ts.tv_usec = 0; 6342 break; 6343 default: 6344 SCTPDBG(SCTP_DEBUG_USRREQ1, 6345 "Unknown PR_SCTP policy %u.\n", 6346 PR_SCTP_POLICY(sp->sinfo_flags)); 6347 break; 6348 } 6349} 6350 6351static int 6352sctp_msg_append(struct sctp_tcb *stcb, 6353 struct sctp_nets *net, 6354 struct mbuf *m, 6355 struct sctp_sndrcvinfo *srcv, int hold_stcb_lock) 6356{ 6357 int error = 0; 6358 struct mbuf *at; 6359 struct sctp_stream_queue_pending *sp = NULL; 6360 struct sctp_stream_out *strm; 6361 6362 /* 6363 * Given an mbuf chain, put it into the association send queue and 6364 * place it on the wheel 6365 */ 6366 if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) { 6367 /* Invalid stream number */ 6368 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6369 error = EINVAL; 6370 goto out_now; 6371 } 6372 if ((stcb->asoc.stream_locked) && 6373 (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) { 6374 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6375 error = EINVAL; 6376 goto out_now; 6377 } 6378 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 6379 /* Now can we send this? */ 6380 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 6381 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 6382 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 6383 (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) { 6384 /* got data while shutting down */ 6385 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 6386 error = ECONNRESET; 6387 goto out_now; 6388 } 6389 sctp_alloc_a_strmoq(stcb, sp); 6390 if (sp == NULL) { 6391 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6392 error = ENOMEM; 6393 goto out_now; 6394 } 6395 sp->sinfo_flags = srcv->sinfo_flags; 6396 sp->timetolive = srcv->sinfo_timetolive; 6397 sp->ppid = srcv->sinfo_ppid; 6398 sp->context = srcv->sinfo_context; 6399 sp->fsn = 0; 6400 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 6401 sp->net = net; 6402 atomic_add_int(&sp->net->ref_count, 1); 6403 } else { 6404 sp->net = NULL; 6405 } 6406 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6407 sp->sid = srcv->sinfo_stream; 6408 sp->msg_is_complete = 1; 6409 sp->sender_all_done = 1; 6410 sp->some_taken = 0; 6411 sp->data = m; 6412 sp->tail_mbuf = NULL; 6413 sctp_set_prsctp_policy(sp); 6414 /* 6415 * We could in theory (for sendall) sifa the length in, but we would 6416 * still have to hunt through the chain since we need to setup the 6417 * tail_mbuf 6418 */ 6419 sp->length = 0; 6420 for (at = m; at; at = SCTP_BUF_NEXT(at)) { 6421 if (SCTP_BUF_NEXT(at) == NULL) 6422 sp->tail_mbuf = at; 6423 sp->length += SCTP_BUF_LEN(at); 6424 } 6425 if (srcv->sinfo_keynumber_valid) { 6426 sp->auth_keyid = srcv->sinfo_keynumber; 6427 } else { 6428 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 6429 } 6430 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 6431 sctp_auth_key_acquire(stcb, sp->auth_keyid); 6432 sp->holds_key_ref = 1; 6433 } 6434 if (hold_stcb_lock == 0) { 6435 SCTP_TCB_SEND_LOCK(stcb); 6436 } 6437 sctp_snd_sb_alloc(stcb, sp->length); 6438 atomic_add_int(&stcb->asoc.stream_queue_cnt, 1); 6439 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 6440 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, &stcb->asoc, strm, sp, 1); 6441 m = NULL; 6442 if (hold_stcb_lock == 0) { 6443 SCTP_TCB_SEND_UNLOCK(stcb); 6444 } 6445out_now: 6446 if (m) { 6447 sctp_m_freem(m); 6448 } 6449 return (error); 6450} 6451 6452 6453static struct mbuf * 6454sctp_copy_mbufchain(struct mbuf *clonechain, 6455 struct mbuf *outchain, 6456 struct mbuf **endofchain, 6457 int can_take_mbuf, 6458 int sizeofcpy, 6459 uint8_t copy_by_ref) 6460{ 6461 struct mbuf *m; 6462 struct mbuf *appendchain; 6463 caddr_t cp; 6464 int len; 6465 6466 if (endofchain == NULL) { 6467 /* error */ 6468error_out: 6469 if (outchain) 6470 sctp_m_freem(outchain); 6471 return (NULL); 6472 } 6473 if (can_take_mbuf) { 6474 appendchain = clonechain; 6475 } else { 6476 if (!copy_by_ref && 6477 (sizeofcpy <= (int)((((SCTP_BASE_SYSCTL(sctp_mbuf_threshold_count) - 1) * MLEN) + MHLEN))) 6478 ) { 6479 /* Its not in a cluster */ 6480 if (*endofchain == NULL) { 6481 /* lets get a mbuf cluster */ 6482 if (outchain == NULL) { 6483 /* This is the general case */ 6484 new_mbuf: 6485 outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6486 if (outchain == NULL) { 6487 goto error_out; 6488 } 6489 SCTP_BUF_LEN(outchain) = 0; 6490 *endofchain = outchain; 6491 /* get the prepend space */ 6492 SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4)); 6493 } else { 6494 /* 6495 * We really should not get a NULL 6496 * in endofchain 6497 */ 6498 /* find end */ 6499 m = outchain; 6500 while (m) { 6501 if (SCTP_BUF_NEXT(m) == NULL) { 6502 *endofchain = m; 6503 break; 6504 } 6505 m = SCTP_BUF_NEXT(m); 6506 } 6507 /* sanity */ 6508 if (*endofchain == NULL) { 6509 /* 6510 * huh, TSNH XXX maybe we 6511 * should panic 6512 */ 6513 sctp_m_freem(outchain); 6514 goto new_mbuf; 6515 } 6516 } 6517 /* get the new end of length */ 6518 len = (int)M_TRAILINGSPACE(*endofchain); 6519 } else { 6520 /* how much is left at the end? */ 6521 len = (int)M_TRAILINGSPACE(*endofchain); 6522 } 6523 /* Find the end of the data, for appending */ 6524 cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain))); 6525 6526 /* Now lets copy it out */ 6527 if (len >= sizeofcpy) { 6528 /* It all fits, copy it in */ 6529 m_copydata(clonechain, 0, sizeofcpy, cp); 6530 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6531 } else { 6532 /* fill up the end of the chain */ 6533 if (len > 0) { 6534 m_copydata(clonechain, 0, len, cp); 6535 SCTP_BUF_LEN((*endofchain)) += len; 6536 /* now we need another one */ 6537 sizeofcpy -= len; 6538 } 6539 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6540 if (m == NULL) { 6541 /* We failed */ 6542 goto error_out; 6543 } 6544 SCTP_BUF_NEXT((*endofchain)) = m; 6545 *endofchain = m; 6546 cp = mtod((*endofchain), caddr_t); 6547 m_copydata(clonechain, len, sizeofcpy, cp); 6548 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6549 } 6550 return (outchain); 6551 } else { 6552 /* copy the old fashion way */ 6553 appendchain = SCTP_M_COPYM(clonechain, 0, M_COPYALL, M_NOWAIT); 6554#ifdef SCTP_MBUF_LOGGING 6555 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6556 sctp_log_mbc(appendchain, SCTP_MBUF_ICOPY); 6557 } 6558#endif 6559 } 6560 } 6561 if (appendchain == NULL) { 6562 /* error */ 6563 if (outchain) 6564 sctp_m_freem(outchain); 6565 return (NULL); 6566 } 6567 if (outchain) { 6568 /* tack on to the end */ 6569 if (*endofchain != NULL) { 6570 SCTP_BUF_NEXT(((*endofchain))) = appendchain; 6571 } else { 6572 m = outchain; 6573 while (m) { 6574 if (SCTP_BUF_NEXT(m) == NULL) { 6575 SCTP_BUF_NEXT(m) = appendchain; 6576 break; 6577 } 6578 m = SCTP_BUF_NEXT(m); 6579 } 6580 } 6581 /* 6582 * save off the end and update the end-chain position 6583 */ 6584 m = appendchain; 6585 while (m) { 6586 if (SCTP_BUF_NEXT(m) == NULL) { 6587 *endofchain = m; 6588 break; 6589 } 6590 m = SCTP_BUF_NEXT(m); 6591 } 6592 return (outchain); 6593 } else { 6594 /* save off the end and update the end-chain position */ 6595 m = appendchain; 6596 while (m) { 6597 if (SCTP_BUF_NEXT(m) == NULL) { 6598 *endofchain = m; 6599 break; 6600 } 6601 m = SCTP_BUF_NEXT(m); 6602 } 6603 return (appendchain); 6604 } 6605} 6606 6607static int 6608sctp_med_chunk_output(struct sctp_inpcb *inp, 6609 struct sctp_tcb *stcb, 6610 struct sctp_association *asoc, 6611 int *num_out, 6612 int *reason_code, 6613 int control_only, int from_where, 6614 struct timeval *now, int *now_filled, int frag_point, int so_locked 6615#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 6616 SCTP_UNUSED 6617#endif 6618); 6619 6620static void 6621sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, 6622 uint32_t val SCTP_UNUSED) 6623{ 6624 struct sctp_copy_all *ca; 6625 struct mbuf *m; 6626 int ret = 0; 6627 int added_control = 0; 6628 int un_sent, do_chunk_output = 1; 6629 struct sctp_association *asoc; 6630 struct sctp_nets *net; 6631 6632 ca = (struct sctp_copy_all *)ptr; 6633 if (ca->m == NULL) { 6634 return; 6635 } 6636 if (ca->inp != inp) { 6637 /* TSNH */ 6638 return; 6639 } 6640 if (ca->sndlen > 0) { 6641 m = SCTP_M_COPYM(ca->m, 0, M_COPYALL, M_NOWAIT); 6642 if (m == NULL) { 6643 /* can't copy so we are done */ 6644 ca->cnt_failed++; 6645 return; 6646 } 6647#ifdef SCTP_MBUF_LOGGING 6648 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6649 sctp_log_mbc(m, SCTP_MBUF_ICOPY); 6650 } 6651#endif 6652 } else { 6653 m = NULL; 6654 } 6655 SCTP_TCB_LOCK_ASSERT(stcb); 6656 if (stcb->asoc.alternate) { 6657 net = stcb->asoc.alternate; 6658 } else { 6659 net = stcb->asoc.primary_destination; 6660 } 6661 if (ca->sndrcv.sinfo_flags & SCTP_ABORT) { 6662 /* Abort this assoc with m as the user defined reason */ 6663 if (m != NULL) { 6664 SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_NOWAIT); 6665 } else { 6666 m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 6667 0, M_NOWAIT, 1, MT_DATA); 6668 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr); 6669 } 6670 if (m != NULL) { 6671 struct sctp_paramhdr *ph; 6672 6673 ph = mtod(m, struct sctp_paramhdr *); 6674 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 6675 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + ca->sndlen)); 6676 } 6677 /* 6678 * We add one here to keep the assoc from dis-appearing on 6679 * us. 6680 */ 6681 atomic_add_int(&stcb->asoc.refcnt, 1); 6682 sctp_abort_an_association(inp, stcb, m, SCTP_SO_NOT_LOCKED); 6683 /* 6684 * sctp_abort_an_association calls sctp_free_asoc() free 6685 * association will NOT free it since we incremented the 6686 * refcnt .. we do this to prevent it being freed and things 6687 * getting tricky since we could end up (from free_asoc) 6688 * calling inpcb_free which would get a recursive lock call 6689 * to the iterator lock.. But as a consequence of that the 6690 * stcb will return to us un-locked.. since free_asoc 6691 * returns with either no TCB or the TCB unlocked, we must 6692 * relock.. to unlock in the iterator timer :-0 6693 */ 6694 SCTP_TCB_LOCK(stcb); 6695 atomic_add_int(&stcb->asoc.refcnt, -1); 6696 goto no_chunk_output; 6697 } else { 6698 if (m) { 6699 ret = sctp_msg_append(stcb, net, m, 6700 &ca->sndrcv, 1); 6701 } 6702 asoc = &stcb->asoc; 6703 if (ca->sndrcv.sinfo_flags & SCTP_EOF) { 6704 /* shutdown this assoc */ 6705 if (TAILQ_EMPTY(&asoc->send_queue) && 6706 TAILQ_EMPTY(&asoc->sent_queue) && 6707 sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED) == 0) { 6708 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6709 goto abort_anyway; 6710 } 6711 /* 6712 * there is nothing queued to send, so I'm 6713 * done... 6714 */ 6715 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 6716 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6717 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6718 /* 6719 * only send SHUTDOWN the first time 6720 * through 6721 */ 6722 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 6723 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 6724 } 6725 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT); 6726 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 6727 sctp_stop_timers_for_shutdown(stcb); 6728 sctp_send_shutdown(stcb, net); 6729 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 6730 net); 6731 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6732 asoc->primary_destination); 6733 added_control = 1; 6734 do_chunk_output = 0; 6735 } 6736 } else { 6737 /* 6738 * we still got (or just got) data to send, 6739 * so set SHUTDOWN_PENDING 6740 */ 6741 /* 6742 * XXX sockets draft says that SCTP_EOF 6743 * should be sent with no data. currently, 6744 * we will allow user data to be sent first 6745 * and move to SHUTDOWN-PENDING 6746 */ 6747 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 6748 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6749 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6750 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6751 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT); 6752 } 6753 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 6754 if (TAILQ_EMPTY(&asoc->send_queue) && 6755 TAILQ_EMPTY(&asoc->sent_queue) && 6756 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 6757 struct mbuf *op_err; 6758 char msg[SCTP_DIAG_INFO_LEN]; 6759 6760 abort_anyway: 6761 snprintf(msg, sizeof(msg), 6762 "%s:%d at %s", __FILE__, __LINE__, __func__); 6763 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 6764 msg); 6765 atomic_add_int(&stcb->asoc.refcnt, 1); 6766 sctp_abort_an_association(stcb->sctp_ep, stcb, 6767 op_err, SCTP_SO_NOT_LOCKED); 6768 atomic_add_int(&stcb->asoc.refcnt, -1); 6769 goto no_chunk_output; 6770 } 6771 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6772 asoc->primary_destination); 6773 } 6774 } 6775 6776 } 6777 } 6778 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 6779 (stcb->asoc.stream_queue_cnt * SCTP_DATA_CHUNK_OVERHEAD(stcb))); 6780 6781 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 6782 (stcb->asoc.total_flight > 0) && 6783 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 6784 do_chunk_output = 0; 6785 } 6786 if (do_chunk_output) 6787 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_NOT_LOCKED); 6788 else if (added_control) { 6789 int num_out, reason, now_filled = 0; 6790 struct timeval now; 6791 int frag_point; 6792 6793 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 6794 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 6795 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_NOT_LOCKED); 6796 } 6797no_chunk_output: 6798 if (ret) { 6799 ca->cnt_failed++; 6800 } else { 6801 ca->cnt_sent++; 6802 } 6803} 6804 6805static void 6806sctp_sendall_completes(void *ptr, uint32_t val SCTP_UNUSED) 6807{ 6808 struct sctp_copy_all *ca; 6809 6810 ca = (struct sctp_copy_all *)ptr; 6811 /* 6812 * Do a notify here? Kacheong suggests that the notify be done at 6813 * the send time.. so you would push up a notification if any send 6814 * failed. Don't know if this is feasible since the only failures we 6815 * have is "memory" related and if you cannot get an mbuf to send 6816 * the data you surely can't get an mbuf to send up to notify the 6817 * user you can't send the data :-> 6818 */ 6819 6820 /* now free everything */ 6821 if (ca->inp) { 6822 /* Lets clear the flag to allow others to run. */ 6823 ca->inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6824 } 6825 sctp_m_freem(ca->m); 6826 SCTP_FREE(ca, SCTP_M_COPYAL); 6827} 6828 6829static struct mbuf * 6830sctp_copy_out_all(struct uio *uio, ssize_t len) 6831{ 6832 struct mbuf *ret, *at; 6833 ssize_t left, willcpy, cancpy, error; 6834 6835 ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAITOK, 1, MT_DATA); 6836 if (ret == NULL) { 6837 /* TSNH */ 6838 return (NULL); 6839 } 6840 left = len; 6841 SCTP_BUF_LEN(ret) = 0; 6842 /* save space for the data chunk header */ 6843 cancpy = (int)M_TRAILINGSPACE(ret); 6844 willcpy = min(cancpy, left); 6845 at = ret; 6846 while (left > 0) { 6847 /* Align data to the end */ 6848 error = uiomove(mtod(at, caddr_t), (int)willcpy, uio); 6849 if (error) { 6850 err_out_now: 6851 sctp_m_freem(at); 6852 return (NULL); 6853 } 6854 SCTP_BUF_LEN(at) = (int)willcpy; 6855 SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0; 6856 left -= willcpy; 6857 if (left > 0) { 6858 SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg((unsigned int)left, 0, M_WAITOK, 1, MT_DATA); 6859 if (SCTP_BUF_NEXT(at) == NULL) { 6860 goto err_out_now; 6861 } 6862 at = SCTP_BUF_NEXT(at); 6863 SCTP_BUF_LEN(at) = 0; 6864 cancpy = (int)M_TRAILINGSPACE(at); 6865 willcpy = min(cancpy, left); 6866 } 6867 } 6868 return (ret); 6869} 6870 6871static int 6872sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, 6873 struct sctp_sndrcvinfo *srcv) 6874{ 6875 int ret; 6876 struct sctp_copy_all *ca; 6877 6878 if (inp->sctp_flags & SCTP_PCB_FLAGS_SND_ITERATOR_UP) { 6879 /* There is another. */ 6880 return (EBUSY); 6881 } 6882 if (uio->uio_resid > SCTP_MAX_SENDALL_LIMIT) { 6883 /* You must be less than the max! */ 6884 return (EMSGSIZE); 6885 } 6886 SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all), 6887 SCTP_M_COPYAL); 6888 if (ca == NULL) { 6889 sctp_m_freem(m); 6890 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6891 return (ENOMEM); 6892 } 6893 memset(ca, 0, sizeof(struct sctp_copy_all)); 6894 6895 ca->inp = inp; 6896 if (srcv) { 6897 memcpy(&ca->sndrcv, srcv, sizeof(struct sctp_nonpad_sndrcvinfo)); 6898 } 6899 /* 6900 * take off the sendall flag, it would be bad if we failed to do 6901 * this :-0 6902 */ 6903 ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL; 6904 /* get length and mbuf chain */ 6905 if (uio) { 6906 ca->sndlen = uio->uio_resid; 6907 ca->m = sctp_copy_out_all(uio, ca->sndlen); 6908 if (ca->m == NULL) { 6909 SCTP_FREE(ca, SCTP_M_COPYAL); 6910 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6911 return (ENOMEM); 6912 } 6913 } else { 6914 /* Gather the length of the send */ 6915 struct mbuf *mat; 6916 6917 ca->sndlen = 0; 6918 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 6919 ca->sndlen += SCTP_BUF_LEN(mat); 6920 } 6921 } 6922 inp->sctp_flags |= SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6923 ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, NULL, 6924 SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES, 6925 SCTP_ASOC_ANY_STATE, 6926 (void *)ca, 0, 6927 sctp_sendall_completes, inp, 1); 6928 if (ret) { 6929 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SND_ITERATOR_UP; 6930 SCTP_FREE(ca, SCTP_M_COPYAL); 6931 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 6932 return (EFAULT); 6933 } 6934 return (0); 6935} 6936 6937 6938void 6939sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc) 6940{ 6941 struct sctp_tmit_chunk *chk, *nchk; 6942 6943 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 6944 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 6945 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 6946 asoc->ctrl_queue_cnt--; 6947 if (chk->data) { 6948 sctp_m_freem(chk->data); 6949 chk->data = NULL; 6950 } 6951 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6952 } 6953 } 6954} 6955 6956void 6957sctp_toss_old_asconf(struct sctp_tcb *stcb) 6958{ 6959 struct sctp_association *asoc; 6960 struct sctp_tmit_chunk *chk, *nchk; 6961 struct sctp_asconf_chunk *acp; 6962 6963 asoc = &stcb->asoc; 6964 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 6965 /* find SCTP_ASCONF chunk in queue */ 6966 if (chk->rec.chunk_id.id == SCTP_ASCONF) { 6967 if (chk->data) { 6968 acp = mtod(chk->data, struct sctp_asconf_chunk *); 6969 if (SCTP_TSN_GT(ntohl(acp->serial_number), asoc->asconf_seq_out_acked)) { 6970 /* Not Acked yet */ 6971 break; 6972 } 6973 } 6974 TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next); 6975 asoc->ctrl_queue_cnt--; 6976 if (chk->data) { 6977 sctp_m_freem(chk->data); 6978 chk->data = NULL; 6979 } 6980 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6981 } 6982 } 6983} 6984 6985 6986static void 6987sctp_clean_up_datalist(struct sctp_tcb *stcb, 6988 struct sctp_association *asoc, 6989 struct sctp_tmit_chunk **data_list, 6990 int bundle_at, 6991 struct sctp_nets *net) 6992{ 6993 int i; 6994 struct sctp_tmit_chunk *tp1; 6995 6996 for (i = 0; i < bundle_at; i++) { 6997 /* off of the send queue */ 6998 TAILQ_REMOVE(&asoc->send_queue, data_list[i], sctp_next); 6999 asoc->send_queue_cnt--; 7000 if (i > 0) { 7001 /* 7002 * Any chunk NOT 0 you zap the time chunk 0 gets 7003 * zapped or set based on if a RTO measurment is 7004 * needed. 7005 */ 7006 data_list[i]->do_rtt = 0; 7007 } 7008 /* record time */ 7009 data_list[i]->sent_rcv_time = net->last_sent_time; 7010 data_list[i]->rec.data.cwnd_at_send = net->cwnd; 7011 data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.tsn; 7012 if (data_list[i]->whoTo == NULL) { 7013 data_list[i]->whoTo = net; 7014 atomic_add_int(&net->ref_count, 1); 7015 } 7016 /* on to the sent queue */ 7017 tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead); 7018 if ((tp1) && SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 7019 struct sctp_tmit_chunk *tpp; 7020 7021 /* need to move back */ 7022 back_up_more: 7023 tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next); 7024 if (tpp == NULL) { 7025 TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next); 7026 goto all_done; 7027 } 7028 tp1 = tpp; 7029 if (SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 7030 goto back_up_more; 7031 } 7032 TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next); 7033 } else { 7034 TAILQ_INSERT_TAIL(&asoc->sent_queue, 7035 data_list[i], 7036 sctp_next); 7037 } 7038all_done: 7039 /* This does not lower until the cum-ack passes it */ 7040 asoc->sent_queue_cnt++; 7041 if ((asoc->peers_rwnd <= 0) && 7042 (asoc->total_flight == 0) && 7043 (bundle_at == 1)) { 7044 /* Mark the chunk as being a window probe */ 7045 SCTP_STAT_INCR(sctps_windowprobed); 7046 } 7047#ifdef SCTP_AUDITING_ENABLED 7048 sctp_audit_log(0xC2, 3); 7049#endif 7050 data_list[i]->sent = SCTP_DATAGRAM_SENT; 7051 data_list[i]->snd_count = 1; 7052 data_list[i]->rec.data.chunk_was_revoked = 0; 7053 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 7054 sctp_misc_ints(SCTP_FLIGHT_LOG_UP, 7055 data_list[i]->whoTo->flight_size, 7056 data_list[i]->book_size, 7057 (uint32_t)(uintptr_t)data_list[i]->whoTo, 7058 data_list[i]->rec.data.tsn); 7059 } 7060 sctp_flight_size_increase(data_list[i]); 7061 sctp_total_flight_increase(stcb, data_list[i]); 7062 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 7063 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 7064 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 7065 } 7066 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 7067 (uint32_t)(data_list[i]->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 7068 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 7069 /* SWS sender side engages */ 7070 asoc->peers_rwnd = 0; 7071 } 7072 } 7073 if (asoc->cc_functions.sctp_cwnd_update_packet_transmitted) { 7074 (*asoc->cc_functions.sctp_cwnd_update_packet_transmitted) (stcb, net); 7075 } 7076} 7077 7078static void 7079sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc, int so_locked 7080#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7081 SCTP_UNUSED 7082#endif 7083) 7084{ 7085 struct sctp_tmit_chunk *chk, *nchk; 7086 7087 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 7088 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7089 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 7090 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 7091 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 7092 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) || 7093 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 7094 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 7095 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 7096 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 7097 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 7098 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 7099 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 7100 /* Stray chunks must be cleaned up */ 7101 clean_up_anyway: 7102 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7103 asoc->ctrl_queue_cnt--; 7104 if (chk->data) { 7105 sctp_m_freem(chk->data); 7106 chk->data = NULL; 7107 } 7108 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 7109 asoc->fwd_tsn_cnt--; 7110 } 7111 sctp_free_a_chunk(stcb, chk, so_locked); 7112 } else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 7113 /* special handling, we must look into the param */ 7114 if (chk != asoc->str_reset) { 7115 goto clean_up_anyway; 7116 } 7117 } 7118 } 7119} 7120 7121static uint32_t 7122sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length, 7123 uint32_t space_left, uint32_t frag_point, int eeor_on) 7124{ 7125 /* 7126 * Make a decision on if I should split a msg into multiple parts. 7127 * This is only asked of incomplete messages. 7128 */ 7129 if (eeor_on) { 7130 /* 7131 * If we are doing EEOR we need to always send it if its the 7132 * entire thing, since it might be all the guy is putting in 7133 * the hopper. 7134 */ 7135 if (space_left >= length) { 7136 /*- 7137 * If we have data outstanding, 7138 * we get another chance when the sack 7139 * arrives to transmit - wait for more data 7140 */ 7141 if (stcb->asoc.total_flight == 0) { 7142 /* 7143 * If nothing is in flight, we zero the 7144 * packet counter. 7145 */ 7146 return (length); 7147 } 7148 return (0); 7149 7150 } else { 7151 /* You can fill the rest */ 7152 return (space_left); 7153 } 7154 } 7155 /*- 7156 * For those strange folk that make the send buffer 7157 * smaller than our fragmentation point, we can't 7158 * get a full msg in so we have to allow splitting. 7159 */ 7160 if (SCTP_SB_LIMIT_SND(stcb->sctp_socket) < frag_point) { 7161 return (length); 7162 } 7163 if ((length <= space_left) || 7164 ((length - space_left) < SCTP_BASE_SYSCTL(sctp_min_residual))) { 7165 /* Sub-optimial residual don't split in non-eeor mode. */ 7166 return (0); 7167 } 7168 /* 7169 * If we reach here length is larger than the space_left. Do we wish 7170 * to split it for the sake of packet putting together? 7171 */ 7172 if (space_left >= min(SCTP_BASE_SYSCTL(sctp_min_split_point), frag_point)) { 7173 /* Its ok to split it */ 7174 return (min(space_left, frag_point)); 7175 } 7176 /* Nope, can't split */ 7177 return (0); 7178} 7179 7180static uint32_t 7181sctp_move_to_outqueue(struct sctp_tcb *stcb, 7182 struct sctp_stream_out *strq, 7183 uint32_t space_left, 7184 uint32_t frag_point, 7185 int *giveup, 7186 int eeor_mode, 7187 int *bail, 7188 int so_locked 7189#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7190 SCTP_UNUSED 7191#endif 7192) 7193{ 7194 /* Move from the stream to the send_queue keeping track of the total */ 7195 struct sctp_association *asoc; 7196 struct sctp_stream_queue_pending *sp; 7197 struct sctp_tmit_chunk *chk; 7198 struct sctp_data_chunk *dchkh = NULL; 7199 struct sctp_idata_chunk *ndchkh = NULL; 7200 uint32_t to_move, length; 7201 int leading; 7202 uint8_t rcv_flags = 0; 7203 uint8_t some_taken; 7204 uint8_t send_lock_up = 0; 7205 7206 SCTP_TCB_LOCK_ASSERT(stcb); 7207 asoc = &stcb->asoc; 7208one_more_time: 7209 /* sa_ignore FREED_MEMORY */ 7210 sp = TAILQ_FIRST(&strq->outqueue); 7211 if (sp == NULL) { 7212 if (send_lock_up == 0) { 7213 SCTP_TCB_SEND_LOCK(stcb); 7214 send_lock_up = 1; 7215 } 7216 sp = TAILQ_FIRST(&strq->outqueue); 7217 if (sp) { 7218 goto one_more_time; 7219 } 7220 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_EXPLICIT_EOR) == 0) && 7221 (stcb->asoc.idata_supported == 0) && 7222 (strq->last_msg_incomplete)) { 7223 SCTP_PRINTF("Huh? Stream:%d lm_in_c=%d but queue is NULL\n", 7224 strq->sid, 7225 strq->last_msg_incomplete); 7226 strq->last_msg_incomplete = 0; 7227 } 7228 to_move = 0; 7229 if (send_lock_up) { 7230 SCTP_TCB_SEND_UNLOCK(stcb); 7231 send_lock_up = 0; 7232 } 7233 goto out_of; 7234 } 7235 if ((sp->msg_is_complete) && (sp->length == 0)) { 7236 if (sp->sender_all_done) { 7237 /* 7238 * We are doing differed cleanup. Last time through 7239 * when we took all the data the sender_all_done was 7240 * not set. 7241 */ 7242 if ((sp->put_last_out == 0) && (sp->discard_rest == 0)) { 7243 SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n"); 7244 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7245 sp->sender_all_done, 7246 sp->length, 7247 sp->msg_is_complete, 7248 sp->put_last_out, 7249 send_lock_up); 7250 } 7251 if ((TAILQ_NEXT(sp, next) == NULL) && (send_lock_up == 0)) { 7252 SCTP_TCB_SEND_LOCK(stcb); 7253 send_lock_up = 1; 7254 } 7255 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7256 TAILQ_REMOVE(&strq->outqueue, sp, next); 7257 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7258 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7259 (strq->chunks_on_queues == 0) && 7260 TAILQ_EMPTY(&strq->outqueue)) { 7261 stcb->asoc.trigger_reset = 1; 7262 } 7263 if (sp->net) { 7264 sctp_free_remote_addr(sp->net); 7265 sp->net = NULL; 7266 } 7267 if (sp->data) { 7268 sctp_m_freem(sp->data); 7269 sp->data = NULL; 7270 } 7271 sctp_free_a_strmoq(stcb, sp, so_locked); 7272 /* we can't be locked to it */ 7273 if (send_lock_up) { 7274 SCTP_TCB_SEND_UNLOCK(stcb); 7275 send_lock_up = 0; 7276 } 7277 /* back to get the next msg */ 7278 goto one_more_time; 7279 } else { 7280 /* 7281 * sender just finished this but still holds a 7282 * reference 7283 */ 7284 *giveup = 1; 7285 to_move = 0; 7286 goto out_of; 7287 } 7288 } else { 7289 /* is there some to get */ 7290 if (sp->length == 0) { 7291 /* no */ 7292 *giveup = 1; 7293 to_move = 0; 7294 goto out_of; 7295 } else if (sp->discard_rest) { 7296 if (send_lock_up == 0) { 7297 SCTP_TCB_SEND_LOCK(stcb); 7298 send_lock_up = 1; 7299 } 7300 /* Whack down the size */ 7301 atomic_subtract_int(&stcb->asoc.total_output_queue_size, sp->length); 7302 if ((stcb->sctp_socket != NULL) && 7303 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 7304 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 7305 atomic_subtract_int(&stcb->sctp_socket->so_snd.sb_cc, sp->length); 7306 } 7307 if (sp->data) { 7308 sctp_m_freem(sp->data); 7309 sp->data = NULL; 7310 sp->tail_mbuf = NULL; 7311 } 7312 sp->length = 0; 7313 sp->some_taken = 1; 7314 *giveup = 1; 7315 to_move = 0; 7316 goto out_of; 7317 } 7318 } 7319 some_taken = sp->some_taken; 7320re_look: 7321 length = sp->length; 7322 if (sp->msg_is_complete) { 7323 /* The message is complete */ 7324 to_move = min(length, frag_point); 7325 if (to_move == length) { 7326 /* All of it fits in the MTU */ 7327 if (sp->some_taken) { 7328 rcv_flags |= SCTP_DATA_LAST_FRAG; 7329 } else { 7330 rcv_flags |= SCTP_DATA_NOT_FRAG; 7331 } 7332 sp->put_last_out = 1; 7333 if (sp->sinfo_flags & SCTP_SACK_IMMEDIATELY) { 7334 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7335 } 7336 } else { 7337 /* Not all of it fits, we fragment */ 7338 if (sp->some_taken == 0) { 7339 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7340 } 7341 sp->some_taken = 1; 7342 } 7343 } else { 7344 to_move = sctp_can_we_split_this(stcb, length, space_left, frag_point, eeor_mode); 7345 if (to_move) { 7346 /*- 7347 * We use a snapshot of length in case it 7348 * is expanding during the compare. 7349 */ 7350 uint32_t llen; 7351 7352 llen = length; 7353 if (to_move >= llen) { 7354 to_move = llen; 7355 if (send_lock_up == 0) { 7356 /*- 7357 * We are taking all of an incomplete msg 7358 * thus we need a send lock. 7359 */ 7360 SCTP_TCB_SEND_LOCK(stcb); 7361 send_lock_up = 1; 7362 if (sp->msg_is_complete) { 7363 /* 7364 * the sender finished the 7365 * msg 7366 */ 7367 goto re_look; 7368 } 7369 } 7370 } 7371 if (sp->some_taken == 0) { 7372 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7373 sp->some_taken = 1; 7374 } 7375 } else { 7376 /* Nothing to take. */ 7377 *giveup = 1; 7378 to_move = 0; 7379 goto out_of; 7380 } 7381 } 7382 7383 /* If we reach here, we can copy out a chunk */ 7384 sctp_alloc_a_chunk(stcb, chk); 7385 if (chk == NULL) { 7386 /* No chunk memory */ 7387 *giveup = 1; 7388 to_move = 0; 7389 goto out_of; 7390 } 7391 /* 7392 * Setup for unordered if needed by looking at the user sent info 7393 * flags. 7394 */ 7395 if (sp->sinfo_flags & SCTP_UNORDERED) { 7396 rcv_flags |= SCTP_DATA_UNORDERED; 7397 } 7398 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 7399 (sp->sinfo_flags & SCTP_EOF) == SCTP_EOF) { 7400 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7401 } 7402 /* clear out the chunk before setting up */ 7403 memset(chk, 0, sizeof(*chk)); 7404 chk->rec.data.rcv_flags = rcv_flags; 7405 7406 if (to_move >= length) { 7407 /* we think we can steal the whole thing */ 7408 if ((sp->sender_all_done == 0) && (send_lock_up == 0)) { 7409 SCTP_TCB_SEND_LOCK(stcb); 7410 send_lock_up = 1; 7411 } 7412 if (to_move < sp->length) { 7413 /* bail, it changed */ 7414 goto dont_do_it; 7415 } 7416 chk->data = sp->data; 7417 chk->last_mbuf = sp->tail_mbuf; 7418 /* register the stealing */ 7419 sp->data = sp->tail_mbuf = NULL; 7420 } else { 7421 struct mbuf *m; 7422 7423dont_do_it: 7424 chk->data = SCTP_M_COPYM(sp->data, 0, to_move, M_NOWAIT); 7425 chk->last_mbuf = NULL; 7426 if (chk->data == NULL) { 7427 sp->some_taken = some_taken; 7428 sctp_free_a_chunk(stcb, chk, so_locked); 7429 *bail = 1; 7430 to_move = 0; 7431 goto out_of; 7432 } 7433#ifdef SCTP_MBUF_LOGGING 7434 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 7435 sctp_log_mbc(chk->data, SCTP_MBUF_ICOPY); 7436 } 7437#endif 7438 /* Pull off the data */ 7439 m_adj(sp->data, to_move); 7440 /* Now lets work our way down and compact it */ 7441 m = sp->data; 7442 while (m && (SCTP_BUF_LEN(m) == 0)) { 7443 sp->data = SCTP_BUF_NEXT(m); 7444 SCTP_BUF_NEXT(m) = NULL; 7445 if (sp->tail_mbuf == m) { 7446 /*- 7447 * Freeing tail? TSNH since 7448 * we supposedly were taking less 7449 * than the sp->length. 7450 */ 7451#ifdef INVARIANTS 7452 panic("Huh, freing tail? - TSNH"); 7453#else 7454 SCTP_PRINTF("Huh, freeing tail? - TSNH\n"); 7455 sp->tail_mbuf = sp->data = NULL; 7456 sp->length = 0; 7457#endif 7458 7459 } 7460 sctp_m_free(m); 7461 m = sp->data; 7462 } 7463 } 7464 if (SCTP_BUF_IS_EXTENDED(chk->data)) { 7465 chk->copy_by_ref = 1; 7466 } else { 7467 chk->copy_by_ref = 0; 7468 } 7469 /* 7470 * get last_mbuf and counts of mb usage This is ugly but hopefully 7471 * its only one mbuf. 7472 */ 7473 if (chk->last_mbuf == NULL) { 7474 chk->last_mbuf = chk->data; 7475 while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) { 7476 chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf); 7477 } 7478 } 7479 7480 if (to_move > length) { 7481 /*- This should not happen either 7482 * since we always lower to_move to the size 7483 * of sp->length if its larger. 7484 */ 7485#ifdef INVARIANTS 7486 panic("Huh, how can to_move be larger?"); 7487#else 7488 SCTP_PRINTF("Huh, how can to_move be larger?\n"); 7489 sp->length = 0; 7490#endif 7491 } else { 7492 atomic_subtract_int(&sp->length, to_move); 7493 } 7494 leading = SCTP_DATA_CHUNK_OVERHEAD(stcb); 7495 if (M_LEADINGSPACE(chk->data) < leading) { 7496 /* Not enough room for a chunk header, get some */ 7497 struct mbuf *m; 7498 7499 m = sctp_get_mbuf_for_msg(1, 0, M_NOWAIT, 1, MT_DATA); 7500 if (m == NULL) { 7501 /* 7502 * we're in trouble here. _PREPEND below will free 7503 * all the data if there is no leading space, so we 7504 * must put the data back and restore. 7505 */ 7506 if (send_lock_up == 0) { 7507 SCTP_TCB_SEND_LOCK(stcb); 7508 send_lock_up = 1; 7509 } 7510 if (sp->data == NULL) { 7511 /* unsteal the data */ 7512 sp->data = chk->data; 7513 sp->tail_mbuf = chk->last_mbuf; 7514 } else { 7515 struct mbuf *m_tmp; 7516 7517 /* reassemble the data */ 7518 m_tmp = sp->data; 7519 sp->data = chk->data; 7520 SCTP_BUF_NEXT(chk->last_mbuf) = m_tmp; 7521 } 7522 sp->some_taken = some_taken; 7523 atomic_add_int(&sp->length, to_move); 7524 chk->data = NULL; 7525 *bail = 1; 7526 sctp_free_a_chunk(stcb, chk, so_locked); 7527 to_move = 0; 7528 goto out_of; 7529 } else { 7530 SCTP_BUF_LEN(m) = 0; 7531 SCTP_BUF_NEXT(m) = chk->data; 7532 chk->data = m; 7533 M_ALIGN(chk->data, 4); 7534 } 7535 } 7536 SCTP_BUF_PREPEND(chk->data, SCTP_DATA_CHUNK_OVERHEAD(stcb), M_NOWAIT); 7537 if (chk->data == NULL) { 7538 /* HELP, TSNH since we assured it would not above? */ 7539#ifdef INVARIANTS 7540 panic("prepend failes HELP?"); 7541#else 7542 SCTP_PRINTF("prepend fails HELP?\n"); 7543 sctp_free_a_chunk(stcb, chk, so_locked); 7544#endif 7545 *bail = 1; 7546 to_move = 0; 7547 goto out_of; 7548 } 7549 sctp_snd_sb_alloc(stcb, SCTP_DATA_CHUNK_OVERHEAD(stcb)); 7550 chk->book_size = chk->send_size = (uint16_t)(to_move + SCTP_DATA_CHUNK_OVERHEAD(stcb)); 7551 chk->book_size_scale = 0; 7552 chk->sent = SCTP_DATAGRAM_UNSENT; 7553 7554 chk->flags = 0; 7555 chk->asoc = &stcb->asoc; 7556 chk->pad_inplace = 0; 7557 chk->no_fr_allowed = 0; 7558 if (stcb->asoc.idata_supported == 0) { 7559 if (rcv_flags & SCTP_DATA_UNORDERED) { 7560 /* Just use 0. The receiver ignores the values. */ 7561 chk->rec.data.mid = 0; 7562 } else { 7563 chk->rec.data.mid = strq->next_mid_ordered; 7564 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7565 strq->next_mid_ordered++; 7566 } 7567 } 7568 } else { 7569 if (rcv_flags & SCTP_DATA_UNORDERED) { 7570 chk->rec.data.mid = strq->next_mid_unordered; 7571 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7572 strq->next_mid_unordered++; 7573 } 7574 } else { 7575 chk->rec.data.mid = strq->next_mid_ordered; 7576 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7577 strq->next_mid_ordered++; 7578 } 7579 } 7580 } 7581 chk->rec.data.sid = sp->sid; 7582 chk->rec.data.ppid = sp->ppid; 7583 chk->rec.data.context = sp->context; 7584 chk->rec.data.doing_fast_retransmit = 0; 7585 7586 chk->rec.data.timetodrop = sp->ts; 7587 chk->flags = sp->act_flags; 7588 7589 if (sp->net) { 7590 chk->whoTo = sp->net; 7591 atomic_add_int(&chk->whoTo->ref_count, 1); 7592 } else 7593 chk->whoTo = NULL; 7594 7595 if (sp->holds_key_ref) { 7596 chk->auth_keyid = sp->auth_keyid; 7597 sctp_auth_key_acquire(stcb, chk->auth_keyid); 7598 chk->holds_key_ref = 1; 7599 } 7600 chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1); 7601 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) { 7602 sctp_misc_ints(SCTP_STRMOUT_LOG_SEND, 7603 (uint32_t)(uintptr_t)stcb, sp->length, 7604 (uint32_t)((chk->rec.data.sid << 16) | (0x0000ffff & chk->rec.data.mid)), 7605 chk->rec.data.tsn); 7606 } 7607 if (stcb->asoc.idata_supported == 0) { 7608 dchkh = mtod(chk->data, struct sctp_data_chunk *); 7609 } else { 7610 ndchkh = mtod(chk->data, struct sctp_idata_chunk *); 7611 } 7612 /* 7613 * Put the rest of the things in place now. Size was done earlier in 7614 * previous loop prior to padding. 7615 */ 7616 7617#ifdef SCTP_ASOCLOG_OF_TSNS 7618 SCTP_TCB_LOCK_ASSERT(stcb); 7619 if (asoc->tsn_out_at >= SCTP_TSN_LOG_SIZE) { 7620 asoc->tsn_out_at = 0; 7621 asoc->tsn_out_wrapped = 1; 7622 } 7623 asoc->out_tsnlog[asoc->tsn_out_at].tsn = chk->rec.data.tsn; 7624 asoc->out_tsnlog[asoc->tsn_out_at].strm = chk->rec.data.sid; 7625 asoc->out_tsnlog[asoc->tsn_out_at].seq = chk->rec.data.mid; 7626 asoc->out_tsnlog[asoc->tsn_out_at].sz = chk->send_size; 7627 asoc->out_tsnlog[asoc->tsn_out_at].flgs = chk->rec.data.rcv_flags; 7628 asoc->out_tsnlog[asoc->tsn_out_at].stcb = (void *)stcb; 7629 asoc->out_tsnlog[asoc->tsn_out_at].in_pos = asoc->tsn_out_at; 7630 asoc->out_tsnlog[asoc->tsn_out_at].in_out = 2; 7631 asoc->tsn_out_at++; 7632#endif 7633 if (stcb->asoc.idata_supported == 0) { 7634 dchkh->ch.chunk_type = SCTP_DATA; 7635 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7636 dchkh->dp.tsn = htonl(chk->rec.data.tsn); 7637 dchkh->dp.sid = htons(strq->sid); 7638 dchkh->dp.ssn = htons((uint16_t)chk->rec.data.mid); 7639 dchkh->dp.ppid = chk->rec.data.ppid; 7640 dchkh->ch.chunk_length = htons(chk->send_size); 7641 } else { 7642 ndchkh->ch.chunk_type = SCTP_IDATA; 7643 ndchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7644 ndchkh->dp.tsn = htonl(chk->rec.data.tsn); 7645 ndchkh->dp.sid = htons(strq->sid); 7646 ndchkh->dp.reserved = htons(0); 7647 ndchkh->dp.mid = htonl(chk->rec.data.mid); 7648 if (sp->fsn == 0) 7649 ndchkh->dp.ppid_fsn.ppid = chk->rec.data.ppid; 7650 else 7651 ndchkh->dp.ppid_fsn.fsn = htonl(sp->fsn); 7652 sp->fsn++; 7653 ndchkh->ch.chunk_length = htons(chk->send_size); 7654 } 7655 /* Now advance the chk->send_size by the actual pad needed. */ 7656 if (chk->send_size < SCTP_SIZE32(chk->book_size)) { 7657 /* need a pad */ 7658 struct mbuf *lm; 7659 int pads; 7660 7661 pads = SCTP_SIZE32(chk->book_size) - chk->send_size; 7662 lm = sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf); 7663 if (lm != NULL) { 7664 chk->last_mbuf = lm; 7665 chk->pad_inplace = 1; 7666 } 7667 chk->send_size += pads; 7668 } 7669 if (PR_SCTP_ENABLED(chk->flags)) { 7670 asoc->pr_sctp_cnt++; 7671 } 7672 if (sp->msg_is_complete && (sp->length == 0) && (sp->sender_all_done)) { 7673 /* All done pull and kill the message */ 7674 if (sp->put_last_out == 0) { 7675 SCTP_PRINTF("Gak, put out entire msg with NO end!-2\n"); 7676 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7677 sp->sender_all_done, 7678 sp->length, 7679 sp->msg_is_complete, 7680 sp->put_last_out, 7681 send_lock_up); 7682 } 7683 if ((send_lock_up == 0) && (TAILQ_NEXT(sp, next) == NULL)) { 7684 SCTP_TCB_SEND_LOCK(stcb); 7685 send_lock_up = 1; 7686 } 7687 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7688 TAILQ_REMOVE(&strq->outqueue, sp, next); 7689 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7690 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7691 (strq->chunks_on_queues == 0) && 7692 TAILQ_EMPTY(&strq->outqueue)) { 7693 stcb->asoc.trigger_reset = 1; 7694 } 7695 if (sp->net) { 7696 sctp_free_remote_addr(sp->net); 7697 sp->net = NULL; 7698 } 7699 if (sp->data) { 7700 sctp_m_freem(sp->data); 7701 sp->data = NULL; 7702 } 7703 sctp_free_a_strmoq(stcb, sp, so_locked); 7704 } 7705 asoc->chunks_on_out_queue++; 7706 strq->chunks_on_queues++; 7707 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 7708 asoc->send_queue_cnt++; 7709out_of: 7710 if (send_lock_up) { 7711 SCTP_TCB_SEND_UNLOCK(stcb); 7712 } 7713 return (to_move); 7714} 7715 7716 7717static void 7718sctp_fill_outqueue(struct sctp_tcb *stcb, 7719 struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked 7720#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7721 SCTP_UNUSED 7722#endif 7723) 7724{ 7725 struct sctp_association *asoc; 7726 struct sctp_stream_out *strq; 7727 uint32_t space_left, moved, total_moved; 7728 int bail, giveup; 7729 7730 SCTP_TCB_LOCK_ASSERT(stcb); 7731 asoc = &stcb->asoc; 7732 total_moved = 0; 7733 switch (net->ro._l_addr.sa.sa_family) { 7734#ifdef INET 7735 case AF_INET: 7736 space_left = net->mtu - SCTP_MIN_V4_OVERHEAD; 7737 break; 7738#endif 7739#ifdef INET6 7740 case AF_INET6: 7741 space_left = net->mtu - SCTP_MIN_OVERHEAD; 7742 break; 7743#endif 7744 default: 7745 /* TSNH */ 7746 space_left = net->mtu; 7747 break; 7748 } 7749 /* Need an allowance for the data chunk header too */ 7750 space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb); 7751 7752 /* must make even word boundary */ 7753 space_left &= 0xfffffffc; 7754 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7755 giveup = 0; 7756 bail = 0; 7757 while ((space_left > 0) && (strq != NULL)) { 7758 moved = sctp_move_to_outqueue(stcb, strq, space_left, frag_point, 7759 &giveup, eeor_mode, &bail, so_locked); 7760 stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved); 7761 if ((giveup != 0) || (bail != 0)) { 7762 break; 7763 } 7764 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7765 total_moved += moved; 7766 if (space_left >= moved) { 7767 space_left -= moved; 7768 } else { 7769 space_left = 0; 7770 } 7771 if (space_left >= SCTP_DATA_CHUNK_OVERHEAD(stcb)) { 7772 space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb); 7773 } else { 7774 space_left = 0; 7775 } 7776 space_left &= 0xfffffffc; 7777 } 7778 if (bail != 0) 7779 *quit_now = 1; 7780 7781 stcb->asoc.ss_functions.sctp_ss_packet_done(stcb, net, asoc); 7782 7783 if (total_moved == 0) { 7784 if ((stcb->asoc.sctp_cmt_on_off == 0) && 7785 (net == stcb->asoc.primary_destination)) { 7786 /* ran dry for primary network net */ 7787 SCTP_STAT_INCR(sctps_primary_randry); 7788 } else if (stcb->asoc.sctp_cmt_on_off > 0) { 7789 /* ran dry with CMT on */ 7790 SCTP_STAT_INCR(sctps_cmt_randry); 7791 } 7792 } 7793} 7794 7795void 7796sctp_fix_ecn_echo(struct sctp_association *asoc) 7797{ 7798 struct sctp_tmit_chunk *chk; 7799 7800 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7801 if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 7802 chk->sent = SCTP_DATAGRAM_UNSENT; 7803 } 7804 } 7805} 7806 7807void 7808sctp_move_chunks_from_net(struct sctp_tcb *stcb, struct sctp_nets *net) 7809{ 7810 struct sctp_association *asoc; 7811 struct sctp_tmit_chunk *chk; 7812 struct sctp_stream_queue_pending *sp; 7813 unsigned int i; 7814 7815 if (net == NULL) { 7816 return; 7817 } 7818 asoc = &stcb->asoc; 7819 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 7820 TAILQ_FOREACH(sp, &stcb->asoc.strmout[i].outqueue, next) { 7821 if (sp->net == net) { 7822 sctp_free_remote_addr(sp->net); 7823 sp->net = NULL; 7824 } 7825 } 7826 } 7827 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7828 if (chk->whoTo == net) { 7829 sctp_free_remote_addr(chk->whoTo); 7830 chk->whoTo = NULL; 7831 } 7832 } 7833} 7834 7835int 7836sctp_med_chunk_output(struct sctp_inpcb *inp, 7837 struct sctp_tcb *stcb, 7838 struct sctp_association *asoc, 7839 int *num_out, 7840 int *reason_code, 7841 int control_only, int from_where, 7842 struct timeval *now, int *now_filled, int frag_point, int so_locked 7843#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7844 SCTP_UNUSED 7845#endif 7846) 7847{ 7848 /** 7849 * Ok this is the generic chunk service queue. we must do the 7850 * following: 7851 * - Service the stream queue that is next, moving any 7852 * message (note I must get a complete message i.e. FIRST/MIDDLE and 7853 * LAST to the out queue in one pass) and assigning TSN's. This 7854 * only applys though if the peer does not support NDATA. For NDATA 7855 * chunks its ok to not send the entire message ;-) 7856 * - Check to see if the cwnd/rwnd allows any output, if so we go ahead and 7857 * fomulate and send the low level chunks. Making sure to combine 7858 * any control in the control chunk queue also. 7859 */ 7860 struct sctp_nets *net, *start_at, *sack_goes_to = NULL, *old_start_at = NULL; 7861 struct mbuf *outchain, *endoutchain; 7862 struct sctp_tmit_chunk *chk, *nchk; 7863 7864 /* temp arrays for unlinking */ 7865 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 7866 int no_fragmentflg, error; 7867 unsigned int max_rwnd_per_dest, max_send_per_dest; 7868 int one_chunk, hbflag, skip_data_for_this_net; 7869 int asconf, cookie, no_out_cnt; 7870 int bundle_at, ctl_cnt, no_data_chunks, eeor_mode; 7871 unsigned int mtu, r_mtu, omtu, mx_mtu, to_out; 7872 int tsns_sent = 0; 7873 uint32_t auth_offset; 7874 struct sctp_auth_chunk *auth; 7875 uint16_t auth_keyid; 7876 int override_ok = 1; 7877 int skip_fill_up = 0; 7878 int data_auth_reqd = 0; 7879 7880 /* 7881 * JRS 5/14/07 - Add flag for whether a heartbeat is sent to the 7882 * destination. 7883 */ 7884 int quit_now = 0; 7885 7886 *num_out = 0; 7887 *reason_code = 0; 7888 auth_keyid = stcb->asoc.authinfo.active_keyid; 7889 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) || 7890 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 7891 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 7892 eeor_mode = 1; 7893 } else { 7894 eeor_mode = 0; 7895 } 7896 ctl_cnt = no_out_cnt = asconf = cookie = 0; 7897 /* 7898 * First lets prime the pump. For each destination, if there is room 7899 * in the flight size, attempt to pull an MTU's worth out of the 7900 * stream queues into the general send_queue 7901 */ 7902#ifdef SCTP_AUDITING_ENABLED 7903 sctp_audit_log(0xC2, 2); 7904#endif 7905 SCTP_TCB_LOCK_ASSERT(stcb); 7906 hbflag = 0; 7907 if (control_only) 7908 no_data_chunks = 1; 7909 else 7910 no_data_chunks = 0; 7911 7912 /* Nothing to possible to send? */ 7913 if ((TAILQ_EMPTY(&asoc->control_send_queue) || 7914 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) && 7915 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7916 TAILQ_EMPTY(&asoc->send_queue) && 7917 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 7918nothing_to_send: 7919 *reason_code = 9; 7920 return (0); 7921 } 7922 if (asoc->peers_rwnd == 0) { 7923 /* No room in peers rwnd */ 7924 *reason_code = 1; 7925 if (asoc->total_flight > 0) { 7926 /* we are allowed one chunk in flight */ 7927 no_data_chunks = 1; 7928 } 7929 } 7930 if (stcb->asoc.ecn_echo_cnt_onq) { 7931 /* Record where a sack goes, if any */ 7932 if (no_data_chunks && 7933 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) { 7934 /* Nothing but ECNe to send - we don't do that */ 7935 goto nothing_to_send; 7936 } 7937 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7938 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7939 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 7940 sack_goes_to = chk->whoTo; 7941 break; 7942 } 7943 } 7944 } 7945 max_rwnd_per_dest = ((asoc->peers_rwnd + asoc->total_flight) / asoc->numnets); 7946 if (stcb->sctp_socket) 7947 max_send_per_dest = SCTP_SB_LIMIT_SND(stcb->sctp_socket) / asoc->numnets; 7948 else 7949 max_send_per_dest = 0; 7950 if (no_data_chunks == 0) { 7951 /* How many non-directed chunks are there? */ 7952 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7953 if (chk->whoTo == NULL) { 7954 /* 7955 * We already have non-directed chunks on 7956 * the queue, no need to do a fill-up. 7957 */ 7958 skip_fill_up = 1; 7959 break; 7960 } 7961 } 7962 7963 } 7964 if ((no_data_chunks == 0) && 7965 (skip_fill_up == 0) && 7966 (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc))) { 7967 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 7968 /* 7969 * This for loop we are in takes in each net, if 7970 * its's got space in cwnd and has data sent to it 7971 * (when CMT is off) then it calls 7972 * sctp_fill_outqueue for the net. This gets data on 7973 * the send queue for that network. 7974 * 7975 * In sctp_fill_outqueue TSN's are assigned and data 7976 * is copied out of the stream buffers. Note mostly 7977 * copy by reference (we hope). 7978 */ 7979 net->window_probe = 0; 7980 if ((net != stcb->asoc.alternate) && 7981 ((net->dest_state & SCTP_ADDR_PF) || 7982 (!(net->dest_state & SCTP_ADDR_REACHABLE)) || 7983 (net->dest_state & SCTP_ADDR_UNCONFIRMED))) { 7984 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7985 sctp_log_cwnd(stcb, net, 1, 7986 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7987 } 7988 continue; 7989 } 7990 if ((stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) && 7991 (net->flight_size == 0)) { 7992 (*stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) (stcb, net); 7993 } 7994 if (net->flight_size >= net->cwnd) { 7995 /* skip this network, no room - can't fill */ 7996 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7997 sctp_log_cwnd(stcb, net, 3, 7998 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7999 } 8000 continue; 8001 } 8002 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8003 sctp_log_cwnd(stcb, net, 4, SCTP_CWND_LOG_FILL_OUTQ_CALLED); 8004 } 8005 sctp_fill_outqueue(stcb, net, frag_point, eeor_mode, &quit_now, so_locked); 8006 if (quit_now) { 8007 /* memory alloc failure */ 8008 no_data_chunks = 1; 8009 break; 8010 } 8011 } 8012 } 8013 /* now service each destination and send out what we can for it */ 8014 /* Nothing to send? */ 8015 if (TAILQ_EMPTY(&asoc->control_send_queue) && 8016 TAILQ_EMPTY(&asoc->asconf_send_queue) && 8017 TAILQ_EMPTY(&asoc->send_queue)) { 8018 *reason_code = 8; 8019 return (0); 8020 } 8021 8022 if (asoc->sctp_cmt_on_off > 0) { 8023 /* get the last start point */ 8024 start_at = asoc->last_net_cmt_send_started; 8025 if (start_at == NULL) { 8026 /* null so to beginning */ 8027 start_at = TAILQ_FIRST(&asoc->nets); 8028 } else { 8029 start_at = TAILQ_NEXT(asoc->last_net_cmt_send_started, sctp_next); 8030 if (start_at == NULL) { 8031 start_at = TAILQ_FIRST(&asoc->nets); 8032 } 8033 } 8034 asoc->last_net_cmt_send_started = start_at; 8035 } else { 8036 start_at = TAILQ_FIRST(&asoc->nets); 8037 } 8038 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 8039 if (chk->whoTo == NULL) { 8040 if (asoc->alternate) { 8041 chk->whoTo = asoc->alternate; 8042 } else { 8043 chk->whoTo = asoc->primary_destination; 8044 } 8045 atomic_add_int(&chk->whoTo->ref_count, 1); 8046 } 8047 } 8048 old_start_at = NULL; 8049again_one_more_time: 8050 for (net = start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) { 8051 /* how much can we send? */ 8052 /* SCTPDBG("Examine for sending net:%x\n", (uint32_t)net); */ 8053 if (old_start_at && (old_start_at == net)) { 8054 /* through list ocmpletely. */ 8055 break; 8056 } 8057 tsns_sent = 0xa; 8058 if (TAILQ_EMPTY(&asoc->control_send_queue) && 8059 TAILQ_EMPTY(&asoc->asconf_send_queue) && 8060 (net->flight_size >= net->cwnd)) { 8061 /* 8062 * Nothing on control or asconf and flight is full, 8063 * we can skip even in the CMT case. 8064 */ 8065 continue; 8066 } 8067 bundle_at = 0; 8068 endoutchain = outchain = NULL; 8069 auth = NULL; 8070 auth_offset = 0; 8071 no_fragmentflg = 1; 8072 one_chunk = 0; 8073 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 8074 skip_data_for_this_net = 1; 8075 } else { 8076 skip_data_for_this_net = 0; 8077 } 8078 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8079#ifdef INET 8080 case AF_INET: 8081 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8082 break; 8083#endif 8084#ifdef INET6 8085 case AF_INET6: 8086 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8087 break; 8088#endif 8089 default: 8090 /* TSNH */ 8091 mtu = net->mtu; 8092 break; 8093 } 8094 mx_mtu = mtu; 8095 to_out = 0; 8096 if (mtu > asoc->peers_rwnd) { 8097 if (asoc->total_flight > 0) { 8098 /* We have a packet in flight somewhere */ 8099 r_mtu = asoc->peers_rwnd; 8100 } else { 8101 /* We are always allowed to send one MTU out */ 8102 one_chunk = 1; 8103 r_mtu = mtu; 8104 } 8105 } else { 8106 r_mtu = mtu; 8107 } 8108 error = 0; 8109 /************************/ 8110 /* ASCONF transmission */ 8111 /************************/ 8112 /* Now first lets go through the asconf queue */ 8113 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 8114 if (chk->rec.chunk_id.id != SCTP_ASCONF) { 8115 continue; 8116 } 8117 if (chk->whoTo == NULL) { 8118 if (asoc->alternate == NULL) { 8119 if (asoc->primary_destination != net) { 8120 break; 8121 } 8122 } else { 8123 if (asoc->alternate != net) { 8124 break; 8125 } 8126 } 8127 } else { 8128 if (chk->whoTo != net) { 8129 break; 8130 } 8131 } 8132 if (chk->data == NULL) { 8133 break; 8134 } 8135 if (chk->sent != SCTP_DATAGRAM_UNSENT && 8136 chk->sent != SCTP_DATAGRAM_RESEND) { 8137 break; 8138 } 8139 /* 8140 * if no AUTH is yet included and this chunk 8141 * requires it, make sure to account for it. We 8142 * don't apply the size until the AUTH chunk is 8143 * actually added below in case there is no room for 8144 * this chunk. NOTE: we overload the use of "omtu" 8145 * here 8146 */ 8147 if ((auth == NULL) && 8148 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8149 stcb->asoc.peer_auth_chunks)) { 8150 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8151 } else 8152 omtu = 0; 8153 /* Here we do NOT factor the r_mtu */ 8154 if ((chk->send_size < (int)(mtu - omtu)) || 8155 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8156 /* 8157 * We probably should glom the mbuf chain 8158 * from the chk->data for control but the 8159 * problem is it becomes yet one more level 8160 * of tracking to do if for some reason 8161 * output fails. Then I have got to 8162 * reconstruct the merged control chain.. el 8163 * yucko.. for now we take the easy way and 8164 * do the copy 8165 */ 8166 /* 8167 * Add an AUTH chunk, if chunk requires it 8168 * save the offset into the chain for AUTH 8169 */ 8170 if ((auth == NULL) && 8171 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8172 stcb->asoc.peer_auth_chunks))) { 8173 outchain = sctp_add_auth_chunk(outchain, 8174 &endoutchain, 8175 &auth, 8176 &auth_offset, 8177 stcb, 8178 chk->rec.chunk_id.id); 8179 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8180 } 8181 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8182 (int)chk->rec.chunk_id.can_take_data, 8183 chk->send_size, chk->copy_by_ref); 8184 if (outchain == NULL) { 8185 *reason_code = 8; 8186 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8187 return (ENOMEM); 8188 } 8189 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8190 /* update our MTU size */ 8191 if (mtu > (chk->send_size + omtu)) 8192 mtu -= (chk->send_size + omtu); 8193 else 8194 mtu = 0; 8195 to_out += (chk->send_size + omtu); 8196 /* Do clear IP_DF ? */ 8197 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8198 no_fragmentflg = 0; 8199 } 8200 if (chk->rec.chunk_id.can_take_data) 8201 chk->data = NULL; 8202 /* 8203 * set hb flag since we can use these for 8204 * RTO 8205 */ 8206 hbflag = 1; 8207 asconf = 1; 8208 /* 8209 * should sysctl this: don't bundle data 8210 * with ASCONF since it requires AUTH 8211 */ 8212 no_data_chunks = 1; 8213 chk->sent = SCTP_DATAGRAM_SENT; 8214 if (chk->whoTo == NULL) { 8215 chk->whoTo = net; 8216 atomic_add_int(&net->ref_count, 1); 8217 } 8218 chk->snd_count++; 8219 if (mtu == 0) { 8220 /* 8221 * Ok we are out of room but we can 8222 * output without effecting the 8223 * flight size since this little guy 8224 * is a control only packet. 8225 */ 8226 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8227 /* 8228 * do NOT clear the asconf flag as 8229 * it is used to do appropriate 8230 * source address selection. 8231 */ 8232 if (*now_filled == 0) { 8233 (void)SCTP_GETTIME_TIMEVAL(now); 8234 *now_filled = 1; 8235 } 8236 net->last_sent_time = *now; 8237 hbflag = 0; 8238 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8239 (struct sockaddr *)&net->ro._l_addr, 8240 outchain, auth_offset, auth, 8241 stcb->asoc.authinfo.active_keyid, 8242 no_fragmentflg, 0, asconf, 8243 inp->sctp_lport, stcb->rport, 8244 htonl(stcb->asoc.peer_vtag), 8245 net->port, NULL, 8246 0, 0, 8247 so_locked))) { 8248 /* 8249 * error, we could not 8250 * output 8251 */ 8252 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8253 if (from_where == 0) { 8254 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8255 } 8256 if (error == ENOBUFS) { 8257 asoc->ifp_had_enobuf = 1; 8258 SCTP_STAT_INCR(sctps_lowlevelerr); 8259 } 8260 /* error, could not output */ 8261 if (error == EHOSTUNREACH) { 8262 /* 8263 * Destination went 8264 * unreachable 8265 * during this send 8266 */ 8267 sctp_move_chunks_from_net(stcb, net); 8268 } 8269 *reason_code = 7; 8270 break; 8271 } else { 8272 asoc->ifp_had_enobuf = 0; 8273 } 8274 /* 8275 * increase the number we sent, if a 8276 * cookie is sent we don't tell them 8277 * any was sent out. 8278 */ 8279 outchain = endoutchain = NULL; 8280 auth = NULL; 8281 auth_offset = 0; 8282 if (!no_out_cnt) 8283 *num_out += ctl_cnt; 8284 /* recalc a clean slate and setup */ 8285 switch (net->ro._l_addr.sa.sa_family) { 8286#ifdef INET 8287 case AF_INET: 8288 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8289 break; 8290#endif 8291#ifdef INET6 8292 case AF_INET6: 8293 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8294 break; 8295#endif 8296 default: 8297 /* TSNH */ 8298 mtu = net->mtu; 8299 break; 8300 } 8301 to_out = 0; 8302 no_fragmentflg = 1; 8303 } 8304 } 8305 } 8306 if (error != 0) { 8307 /* try next net */ 8308 continue; 8309 } 8310 /************************/ 8311 /* Control transmission */ 8312 /************************/ 8313 /* Now first lets go through the control queue */ 8314 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 8315 if ((sack_goes_to) && 8316 (chk->rec.chunk_id.id == SCTP_ECN_ECHO) && 8317 (chk->whoTo != sack_goes_to)) { 8318 /* 8319 * if we have a sack in queue, and we are 8320 * looking at an ecn echo that is NOT queued 8321 * to where the sack is going.. 8322 */ 8323 if (chk->whoTo == net) { 8324 /* 8325 * Don't transmit it to where its 8326 * going (current net) 8327 */ 8328 continue; 8329 } else if (sack_goes_to == net) { 8330 /* 8331 * But do transmit it to this 8332 * address 8333 */ 8334 goto skip_net_check; 8335 } 8336 } 8337 if (chk->whoTo == NULL) { 8338 if (asoc->alternate == NULL) { 8339 if (asoc->primary_destination != net) { 8340 continue; 8341 } 8342 } else { 8343 if (asoc->alternate != net) { 8344 continue; 8345 } 8346 } 8347 } else { 8348 if (chk->whoTo != net) { 8349 continue; 8350 } 8351 } 8352 skip_net_check: 8353 if (chk->data == NULL) { 8354 continue; 8355 } 8356 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 8357 /* 8358 * It must be unsent. Cookies and ASCONF's 8359 * hang around but there timers will force 8360 * when marked for resend. 8361 */ 8362 continue; 8363 } 8364 /* 8365 * if no AUTH is yet included and this chunk 8366 * requires it, make sure to account for it. We 8367 * don't apply the size until the AUTH chunk is 8368 * actually added below in case there is no room for 8369 * this chunk. NOTE: we overload the use of "omtu" 8370 * here 8371 */ 8372 if ((auth == NULL) && 8373 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8374 stcb->asoc.peer_auth_chunks)) { 8375 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8376 } else 8377 omtu = 0; 8378 /* Here we do NOT factor the r_mtu */ 8379 if ((chk->send_size <= (int)(mtu - omtu)) || 8380 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8381 /* 8382 * We probably should glom the mbuf chain 8383 * from the chk->data for control but the 8384 * problem is it becomes yet one more level 8385 * of tracking to do if for some reason 8386 * output fails. Then I have got to 8387 * reconstruct the merged control chain.. el 8388 * yucko.. for now we take the easy way and 8389 * do the copy 8390 */ 8391 /* 8392 * Add an AUTH chunk, if chunk requires it 8393 * save the offset into the chain for AUTH 8394 */ 8395 if ((auth == NULL) && 8396 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8397 stcb->asoc.peer_auth_chunks))) { 8398 outchain = sctp_add_auth_chunk(outchain, 8399 &endoutchain, 8400 &auth, 8401 &auth_offset, 8402 stcb, 8403 chk->rec.chunk_id.id); 8404 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8405 } 8406 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8407 (int)chk->rec.chunk_id.can_take_data, 8408 chk->send_size, chk->copy_by_ref); 8409 if (outchain == NULL) { 8410 *reason_code = 8; 8411 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8412 return (ENOMEM); 8413 } 8414 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8415 /* update our MTU size */ 8416 if (mtu > (chk->send_size + omtu)) 8417 mtu -= (chk->send_size + omtu); 8418 else 8419 mtu = 0; 8420 to_out += (chk->send_size + omtu); 8421 /* Do clear IP_DF ? */ 8422 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8423 no_fragmentflg = 0; 8424 } 8425 if (chk->rec.chunk_id.can_take_data) 8426 chk->data = NULL; 8427 /* Mark things to be removed, if needed */ 8428 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8429 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 8430 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 8431 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 8432 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 8433 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 8434 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 8435 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 8436 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 8437 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 8438 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 8439 if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) { 8440 hbflag = 1; 8441 } 8442 /* remove these chunks at the end */ 8443 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8444 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 8445 /* turn off the timer */ 8446 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 8447 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 8448 inp, stcb, net, 8449 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1); 8450 } 8451 } 8452 ctl_cnt++; 8453 } else { 8454 /* 8455 * Other chunks, since they have 8456 * timers running (i.e. COOKIE) we 8457 * just "trust" that it gets sent or 8458 * retransmitted. 8459 */ 8460 ctl_cnt++; 8461 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 8462 cookie = 1; 8463 no_out_cnt = 1; 8464 } else if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 8465 /* 8466 * Increment ecne send count 8467 * here this means we may be 8468 * over-zealous in our 8469 * counting if the send 8470 * fails, but its the best 8471 * place to do it (we used 8472 * to do it in the queue of 8473 * the chunk, but that did 8474 * not tell how many times 8475 * it was sent. 8476 */ 8477 SCTP_STAT_INCR(sctps_sendecne); 8478 } 8479 chk->sent = SCTP_DATAGRAM_SENT; 8480 if (chk->whoTo == NULL) { 8481 chk->whoTo = net; 8482 atomic_add_int(&net->ref_count, 1); 8483 } 8484 chk->snd_count++; 8485 } 8486 if (mtu == 0) { 8487 /* 8488 * Ok we are out of room but we can 8489 * output without effecting the 8490 * flight size since this little guy 8491 * is a control only packet. 8492 */ 8493 if (asconf) { 8494 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8495 /* 8496 * do NOT clear the asconf 8497 * flag as it is used to do 8498 * appropriate source 8499 * address selection. 8500 */ 8501 } 8502 if (cookie) { 8503 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8504 cookie = 0; 8505 } 8506 /* Only HB or ASCONF advances time */ 8507 if (hbflag) { 8508 if (*now_filled == 0) { 8509 (void)SCTP_GETTIME_TIMEVAL(now); 8510 *now_filled = 1; 8511 } 8512 net->last_sent_time = *now; 8513 hbflag = 0; 8514 } 8515 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8516 (struct sockaddr *)&net->ro._l_addr, 8517 outchain, 8518 auth_offset, auth, 8519 stcb->asoc.authinfo.active_keyid, 8520 no_fragmentflg, 0, asconf, 8521 inp->sctp_lport, stcb->rport, 8522 htonl(stcb->asoc.peer_vtag), 8523 net->port, NULL, 8524 0, 0, 8525 so_locked))) { 8526 /* 8527 * error, we could not 8528 * output 8529 */ 8530 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8531 if (from_where == 0) { 8532 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8533 } 8534 if (error == ENOBUFS) { 8535 asoc->ifp_had_enobuf = 1; 8536 SCTP_STAT_INCR(sctps_lowlevelerr); 8537 } 8538 if (error == EHOSTUNREACH) { 8539 /* 8540 * Destination went 8541 * unreachable 8542 * during this send 8543 */ 8544 sctp_move_chunks_from_net(stcb, net); 8545 } 8546 *reason_code = 7; 8547 break; 8548 } else { 8549 asoc->ifp_had_enobuf = 0; 8550 } 8551 /* 8552 * increase the number we sent, if a 8553 * cookie is sent we don't tell them 8554 * any was sent out. 8555 */ 8556 outchain = endoutchain = NULL; 8557 auth = NULL; 8558 auth_offset = 0; 8559 if (!no_out_cnt) 8560 *num_out += ctl_cnt; 8561 /* recalc a clean slate and setup */ 8562 switch (net->ro._l_addr.sa.sa_family) { 8563#ifdef INET 8564 case AF_INET: 8565 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8566 break; 8567#endif 8568#ifdef INET6 8569 case AF_INET6: 8570 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8571 break; 8572#endif 8573 default: 8574 /* TSNH */ 8575 mtu = net->mtu; 8576 break; 8577 } 8578 to_out = 0; 8579 no_fragmentflg = 1; 8580 } 8581 } 8582 } 8583 if (error != 0) { 8584 /* try next net */ 8585 continue; 8586 } 8587 /* JRI: if dest is in PF state, do not send data to it */ 8588 if ((asoc->sctp_cmt_on_off > 0) && 8589 (net != stcb->asoc.alternate) && 8590 (net->dest_state & SCTP_ADDR_PF)) { 8591 goto no_data_fill; 8592 } 8593 if (net->flight_size >= net->cwnd) { 8594 goto no_data_fill; 8595 } 8596 if ((asoc->sctp_cmt_on_off > 0) && 8597 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_RECV_BUFFER_SPLITTING) && 8598 (net->flight_size > max_rwnd_per_dest)) { 8599 goto no_data_fill; 8600 } 8601 /* 8602 * We need a specific accounting for the usage of the send 8603 * buffer. We also need to check the number of messages per 8604 * net. For now, this is better than nothing and it disabled 8605 * by default... 8606 */ 8607 if ((asoc->sctp_cmt_on_off > 0) && 8608 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_SEND_BUFFER_SPLITTING) && 8609 (max_send_per_dest > 0) && 8610 (net->flight_size > max_send_per_dest)) { 8611 goto no_data_fill; 8612 } 8613 /*********************/ 8614 /* Data transmission */ 8615 /*********************/ 8616 /* 8617 * if AUTH for DATA is required and no AUTH has been added 8618 * yet, account for this in the mtu now... if no data can be 8619 * bundled, this adjustment won't matter anyways since the 8620 * packet will be going out... 8621 */ 8622 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, 8623 stcb->asoc.peer_auth_chunks); 8624 if (data_auth_reqd && (auth == NULL)) { 8625 mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8626 } 8627 /* now lets add any data within the MTU constraints */ 8628 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8629#ifdef INET 8630 case AF_INET: 8631 if (net->mtu > SCTP_MIN_V4_OVERHEAD) 8632 omtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8633 else 8634 omtu = 0; 8635 break; 8636#endif 8637#ifdef INET6 8638 case AF_INET6: 8639 if (net->mtu > SCTP_MIN_OVERHEAD) 8640 omtu = net->mtu - SCTP_MIN_OVERHEAD; 8641 else 8642 omtu = 0; 8643 break; 8644#endif 8645 default: 8646 /* TSNH */ 8647 omtu = 0; 8648 break; 8649 } 8650 if ((((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) || 8651 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) && 8652 (skip_data_for_this_net == 0)) || 8653 (cookie)) { 8654 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 8655 if (no_data_chunks) { 8656 /* let only control go out */ 8657 *reason_code = 1; 8658 break; 8659 } 8660 if (net->flight_size >= net->cwnd) { 8661 /* skip this net, no room for data */ 8662 *reason_code = 2; 8663 break; 8664 } 8665 if ((chk->whoTo != NULL) && 8666 (chk->whoTo != net)) { 8667 /* Don't send the chunk on this net */ 8668 continue; 8669 } 8670 8671 if (asoc->sctp_cmt_on_off == 0) { 8672 if ((asoc->alternate) && 8673 (asoc->alternate != net) && 8674 (chk->whoTo == NULL)) { 8675 continue; 8676 } else if ((net != asoc->primary_destination) && 8677 (asoc->alternate == NULL) && 8678 (chk->whoTo == NULL)) { 8679 continue; 8680 } 8681 } 8682 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 8683 /*- 8684 * strange, we have a chunk that is 8685 * to big for its destination and 8686 * yet no fragment ok flag. 8687 * Something went wrong when the 8688 * PMTU changed...we did not mark 8689 * this chunk for some reason?? I 8690 * will fix it here by letting IP 8691 * fragment it for now and printing 8692 * a warning. This really should not 8693 * happen ... 8694 */ 8695 SCTP_PRINTF("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 8696 chk->send_size, mtu); 8697 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 8698 } 8699 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 8700 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 8701 struct sctp_data_chunk *dchkh; 8702 8703 dchkh = mtod(chk->data, struct sctp_data_chunk *); 8704 dchkh->ch.chunk_flags |= SCTP_DATA_SACK_IMMEDIATELY; 8705 } 8706 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 8707 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 8708 /* ok we will add this one */ 8709 8710 /* 8711 * Add an AUTH chunk, if chunk 8712 * requires it, save the offset into 8713 * the chain for AUTH 8714 */ 8715 if (data_auth_reqd) { 8716 if (auth == NULL) { 8717 outchain = sctp_add_auth_chunk(outchain, 8718 &endoutchain, 8719 &auth, 8720 &auth_offset, 8721 stcb, 8722 SCTP_DATA); 8723 auth_keyid = chk->auth_keyid; 8724 override_ok = 0; 8725 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8726 } else if (override_ok) { 8727 /* 8728 * use this data's 8729 * keyid 8730 */ 8731 auth_keyid = chk->auth_keyid; 8732 override_ok = 0; 8733 } else if (auth_keyid != chk->auth_keyid) { 8734 /* 8735 * different keyid, 8736 * so done bundling 8737 */ 8738 break; 8739 } 8740 } 8741 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0, 8742 chk->send_size, chk->copy_by_ref); 8743 if (outchain == NULL) { 8744 SCTPDBG(SCTP_DEBUG_OUTPUT3, "No memory?\n"); 8745 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 8746 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8747 } 8748 *reason_code = 3; 8749 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8750 return (ENOMEM); 8751 } 8752 /* upate our MTU size */ 8753 /* Do clear IP_DF ? */ 8754 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8755 no_fragmentflg = 0; 8756 } 8757 /* unsigned subtraction of mtu */ 8758 if (mtu > chk->send_size) 8759 mtu -= chk->send_size; 8760 else 8761 mtu = 0; 8762 /* unsigned subtraction of r_mtu */ 8763 if (r_mtu > chk->send_size) 8764 r_mtu -= chk->send_size; 8765 else 8766 r_mtu = 0; 8767 8768 to_out += chk->send_size; 8769 if ((to_out > mx_mtu) && no_fragmentflg) { 8770#ifdef INVARIANTS 8771 panic("Exceeding mtu of %d out size is %d", mx_mtu, to_out); 8772#else 8773 SCTP_PRINTF("Exceeding mtu of %d out size is %d\n", 8774 mx_mtu, to_out); 8775#endif 8776 } 8777 chk->window_probe = 0; 8778 data_list[bundle_at++] = chk; 8779 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 8780 break; 8781 } 8782 if (chk->sent == SCTP_DATAGRAM_UNSENT) { 8783 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 8784 SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks); 8785 } else { 8786 SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks); 8787 } 8788 if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) && 8789 ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0)) 8790 /* 8791 * Count number of 8792 * user msg's that 8793 * were fragmented 8794 * we do this by 8795 * counting when we 8796 * see a LAST 8797 * fragment only. 8798 */ 8799 SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs); 8800 } 8801 if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) { 8802 if ((one_chunk) && (stcb->asoc.total_flight == 0)) { 8803 data_list[0]->window_probe = 1; 8804 net->window_probe = 1; 8805 } 8806 break; 8807 } 8808 } else { 8809 /* 8810 * Must be sent in order of the 8811 * TSN's (on a network) 8812 */ 8813 break; 8814 } 8815 } /* for (chunk gather loop for this net) */ 8816 } /* if asoc.state OPEN */ 8817no_data_fill: 8818 /* Is there something to send for this destination? */ 8819 if (outchain) { 8820 /* We may need to start a control timer or two */ 8821 if (asconf) { 8822 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, 8823 stcb, net); 8824 /* 8825 * do NOT clear the asconf flag as it is 8826 * used to do appropriate source address 8827 * selection. 8828 */ 8829 } 8830 if (cookie) { 8831 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8832 cookie = 0; 8833 } 8834 /* must start a send timer if data is being sent */ 8835 if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) { 8836 /* 8837 * no timer running on this destination 8838 * restart it. 8839 */ 8840 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8841 } 8842 if (bundle_at || hbflag) { 8843 /* For data/asconf and hb set time */ 8844 if (*now_filled == 0) { 8845 (void)SCTP_GETTIME_TIMEVAL(now); 8846 *now_filled = 1; 8847 } 8848 net->last_sent_time = *now; 8849 } 8850 /* Now send it, if there is anything to send :> */ 8851 if ((error = sctp_lowlevel_chunk_output(inp, 8852 stcb, 8853 net, 8854 (struct sockaddr *)&net->ro._l_addr, 8855 outchain, 8856 auth_offset, 8857 auth, 8858 auth_keyid, 8859 no_fragmentflg, 8860 bundle_at, 8861 asconf, 8862 inp->sctp_lport, stcb->rport, 8863 htonl(stcb->asoc.peer_vtag), 8864 net->port, NULL, 8865 0, 0, 8866 so_locked))) { 8867 /* error, we could not output */ 8868 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8869 if (from_where == 0) { 8870 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8871 } 8872 if (error == ENOBUFS) { 8873 asoc->ifp_had_enobuf = 1; 8874 SCTP_STAT_INCR(sctps_lowlevelerr); 8875 } 8876 if (error == EHOSTUNREACH) { 8877 /* 8878 * Destination went unreachable 8879 * during this send 8880 */ 8881 sctp_move_chunks_from_net(stcb, net); 8882 } 8883 *reason_code = 6; 8884 /*- 8885 * I add this line to be paranoid. As far as 8886 * I can tell the continue, takes us back to 8887 * the top of the for, but just to make sure 8888 * I will reset these again here. 8889 */ 8890 ctl_cnt = bundle_at = 0; 8891 continue; /* This takes us back to the 8892 * for() for the nets. */ 8893 } else { 8894 asoc->ifp_had_enobuf = 0; 8895 } 8896 endoutchain = NULL; 8897 auth = NULL; 8898 auth_offset = 0; 8899 if (!no_out_cnt) { 8900 *num_out += (ctl_cnt + bundle_at); 8901 } 8902 if (bundle_at) { 8903 /* setup for a RTO measurement */ 8904 tsns_sent = data_list[0]->rec.data.tsn; 8905 /* fill time if not already filled */ 8906 if (*now_filled == 0) { 8907 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 8908 *now_filled = 1; 8909 *now = asoc->time_last_sent; 8910 } else { 8911 asoc->time_last_sent = *now; 8912 } 8913 if (net->rto_needed) { 8914 data_list[0]->do_rtt = 1; 8915 net->rto_needed = 0; 8916 } 8917 SCTP_STAT_INCR_BY(sctps_senddata, bundle_at); 8918 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 8919 } 8920 if (one_chunk) { 8921 break; 8922 } 8923 } 8924 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8925 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND); 8926 } 8927 } 8928 if (old_start_at == NULL) { 8929 old_start_at = start_at; 8930 start_at = TAILQ_FIRST(&asoc->nets); 8931 if (old_start_at) 8932 goto again_one_more_time; 8933 } 8934 8935 /* 8936 * At the end there should be no NON timed chunks hanging on this 8937 * queue. 8938 */ 8939 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8940 sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND); 8941 } 8942 if ((*num_out == 0) && (*reason_code == 0)) { 8943 *reason_code = 4; 8944 } else { 8945 *reason_code = 5; 8946 } 8947 sctp_clean_up_ctl(stcb, asoc, so_locked); 8948 return (0); 8949} 8950 8951void 8952sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 8953{ 8954 /*- 8955 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of 8956 * the control chunk queue. 8957 */ 8958 struct sctp_chunkhdr *hdr; 8959 struct sctp_tmit_chunk *chk; 8960 struct mbuf *mat, *last_mbuf; 8961 uint32_t chunk_length; 8962 uint16_t padding_length; 8963 8964 SCTP_TCB_LOCK_ASSERT(stcb); 8965 SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_NOWAIT); 8966 if (op_err == NULL) { 8967 return; 8968 } 8969 last_mbuf = NULL; 8970 chunk_length = 0; 8971 for (mat = op_err; mat != NULL; mat = SCTP_BUF_NEXT(mat)) { 8972 chunk_length += SCTP_BUF_LEN(mat); 8973 if (SCTP_BUF_NEXT(mat) == NULL) { 8974 last_mbuf = mat; 8975 } 8976 } 8977 if (chunk_length > SCTP_MAX_CHUNK_LENGTH) { 8978 sctp_m_freem(op_err); 8979 return; 8980 } 8981 padding_length = chunk_length % 4; 8982 if (padding_length != 0) { 8983 padding_length = 4 - padding_length; 8984 } 8985 if (padding_length != 0) { 8986 if (sctp_add_pad_tombuf(last_mbuf, padding_length) == NULL) { 8987 sctp_m_freem(op_err); 8988 return; 8989 } 8990 } 8991 sctp_alloc_a_chunk(stcb, chk); 8992 if (chk == NULL) { 8993 /* no memory */ 8994 sctp_m_freem(op_err); 8995 return; 8996 } 8997 chk->copy_by_ref = 0; 8998 chk->rec.chunk_id.id = SCTP_OPERATION_ERROR; 8999 chk->rec.chunk_id.can_take_data = 0; 9000 chk->flags = 0; 9001 chk->send_size = (uint16_t)chunk_length; 9002 chk->sent = SCTP_DATAGRAM_UNSENT; 9003 chk->snd_count = 0; 9004 chk->asoc = &stcb->asoc; 9005 chk->data = op_err; 9006 chk->whoTo = NULL; 9007 hdr = mtod(op_err, struct sctp_chunkhdr *); 9008 hdr->chunk_type = SCTP_OPERATION_ERROR; 9009 hdr->chunk_flags = 0; 9010 hdr->chunk_length = htons(chk->send_size); 9011 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9012 chk->asoc->ctrl_queue_cnt++; 9013} 9014 9015int 9016sctp_send_cookie_echo(struct mbuf *m, 9017 int offset, int limit, 9018 struct sctp_tcb *stcb, 9019 struct sctp_nets *net) 9020{ 9021 /*- 9022 * pull out the cookie and put it at the front of the control chunk 9023 * queue. 9024 */ 9025 int at; 9026 struct mbuf *cookie; 9027 struct sctp_paramhdr param, *phdr; 9028 struct sctp_chunkhdr *hdr; 9029 struct sctp_tmit_chunk *chk; 9030 uint16_t ptype, plen; 9031 9032 SCTP_TCB_LOCK_ASSERT(stcb); 9033 /* First find the cookie in the param area */ 9034 cookie = NULL; 9035 at = offset + sizeof(struct sctp_init_chunk); 9036 for (;;) { 9037 phdr = sctp_get_next_param(m, at, ¶m, sizeof(param)); 9038 if (phdr == NULL) { 9039 return (-3); 9040 } 9041 ptype = ntohs(phdr->param_type); 9042 plen = ntohs(phdr->param_length); 9043 if (plen < sizeof(struct sctp_paramhdr)) { 9044 return (-6); 9045 } 9046 if (ptype == SCTP_STATE_COOKIE) { 9047 int pad; 9048 9049 /* found the cookie */ 9050 if (at + plen > limit) { 9051 return (-7); 9052 } 9053 cookie = SCTP_M_COPYM(m, at, plen, M_NOWAIT); 9054 if (cookie == NULL) { 9055 /* No memory */ 9056 return (-2); 9057 } 9058 if ((pad = (plen % 4)) > 0) { 9059 pad = 4 - pad; 9060 } 9061 if (pad > 0) { 9062 if (sctp_pad_lastmbuf(cookie, pad, NULL) == NULL) { 9063 return (-8); 9064 } 9065 } 9066#ifdef SCTP_MBUF_LOGGING 9067 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9068 sctp_log_mbc(cookie, SCTP_MBUF_ICOPY); 9069 } 9070#endif 9071 break; 9072 } 9073 at += SCTP_SIZE32(plen); 9074 } 9075 /* ok, we got the cookie lets change it into a cookie echo chunk */ 9076 /* first the change from param to cookie */ 9077 hdr = mtod(cookie, struct sctp_chunkhdr *); 9078 hdr->chunk_type = SCTP_COOKIE_ECHO; 9079 hdr->chunk_flags = 0; 9080 /* get the chunk stuff now and place it in the FRONT of the queue */ 9081 sctp_alloc_a_chunk(stcb, chk); 9082 if (chk == NULL) { 9083 /* no memory */ 9084 sctp_m_freem(cookie); 9085 return (-5); 9086 } 9087 chk->copy_by_ref = 0; 9088 chk->rec.chunk_id.id = SCTP_COOKIE_ECHO; 9089 chk->rec.chunk_id.can_take_data = 0; 9090 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9091 chk->send_size = SCTP_SIZE32(plen); 9092 chk->sent = SCTP_DATAGRAM_UNSENT; 9093 chk->snd_count = 0; 9094 chk->asoc = &stcb->asoc; 9095 chk->data = cookie; 9096 chk->whoTo = net; 9097 atomic_add_int(&chk->whoTo->ref_count, 1); 9098 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 9099 chk->asoc->ctrl_queue_cnt++; 9100 return (0); 9101} 9102 9103void 9104sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 9105 struct mbuf *m, 9106 int offset, 9107 int chk_length, 9108 struct sctp_nets *net) 9109{ 9110 /* 9111 * take a HB request and make it into a HB ack and send it. 9112 */ 9113 struct mbuf *outchain; 9114 struct sctp_chunkhdr *chdr; 9115 struct sctp_tmit_chunk *chk; 9116 9117 if (net == NULL) 9118 /* must have a net pointer */ 9119 return; 9120 9121 outchain = SCTP_M_COPYM(m, offset, chk_length, M_NOWAIT); 9122 if (outchain == NULL) { 9123 /* gak out of memory */ 9124 return; 9125 } 9126#ifdef SCTP_MBUF_LOGGING 9127 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9128 sctp_log_mbc(outchain, SCTP_MBUF_ICOPY); 9129 } 9130#endif 9131 chdr = mtod(outchain, struct sctp_chunkhdr *); 9132 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 9133 chdr->chunk_flags = 0; 9134 if (chk_length % 4 != 0) { 9135 sctp_pad_lastmbuf(outchain, 4 - (chk_length % 4), NULL); 9136 } 9137 sctp_alloc_a_chunk(stcb, chk); 9138 if (chk == NULL) { 9139 /* no memory */ 9140 sctp_m_freem(outchain); 9141 return; 9142 } 9143 chk->copy_by_ref = 0; 9144 chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK; 9145 chk->rec.chunk_id.can_take_data = 1; 9146 chk->flags = 0; 9147 chk->send_size = chk_length; 9148 chk->sent = SCTP_DATAGRAM_UNSENT; 9149 chk->snd_count = 0; 9150 chk->asoc = &stcb->asoc; 9151 chk->data = outchain; 9152 chk->whoTo = net; 9153 atomic_add_int(&chk->whoTo->ref_count, 1); 9154 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9155 chk->asoc->ctrl_queue_cnt++; 9156} 9157 9158void 9159sctp_send_cookie_ack(struct sctp_tcb *stcb) 9160{ 9161 /* formulate and queue a cookie-ack back to sender */ 9162 struct mbuf *cookie_ack; 9163 struct sctp_chunkhdr *hdr; 9164 struct sctp_tmit_chunk *chk; 9165 9166 SCTP_TCB_LOCK_ASSERT(stcb); 9167 9168 cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 9169 if (cookie_ack == NULL) { 9170 /* no mbuf's */ 9171 return; 9172 } 9173 SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD); 9174 sctp_alloc_a_chunk(stcb, chk); 9175 if (chk == NULL) { 9176 /* no memory */ 9177 sctp_m_freem(cookie_ack); 9178 return; 9179 } 9180 chk->copy_by_ref = 0; 9181 chk->rec.chunk_id.id = SCTP_COOKIE_ACK; 9182 chk->rec.chunk_id.can_take_data = 1; 9183 chk->flags = 0; 9184 chk->send_size = sizeof(struct sctp_chunkhdr); 9185 chk->sent = SCTP_DATAGRAM_UNSENT; 9186 chk->snd_count = 0; 9187 chk->asoc = &stcb->asoc; 9188 chk->data = cookie_ack; 9189 if (chk->asoc->last_control_chunk_from != NULL) { 9190 chk->whoTo = chk->asoc->last_control_chunk_from; 9191 atomic_add_int(&chk->whoTo->ref_count, 1); 9192 } else { 9193 chk->whoTo = NULL; 9194 } 9195 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 9196 hdr->chunk_type = SCTP_COOKIE_ACK; 9197 hdr->chunk_flags = 0; 9198 hdr->chunk_length = htons(chk->send_size); 9199 SCTP_BUF_LEN(cookie_ack) = chk->send_size; 9200 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9201 chk->asoc->ctrl_queue_cnt++; 9202 return; 9203} 9204 9205 9206void 9207sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 9208{ 9209 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 9210 struct mbuf *m_shutdown_ack; 9211 struct sctp_shutdown_ack_chunk *ack_cp; 9212 struct sctp_tmit_chunk *chk; 9213 9214 m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9215 if (m_shutdown_ack == NULL) { 9216 /* no mbuf's */ 9217 return; 9218 } 9219 SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD); 9220 sctp_alloc_a_chunk(stcb, chk); 9221 if (chk == NULL) { 9222 /* no memory */ 9223 sctp_m_freem(m_shutdown_ack); 9224 return; 9225 } 9226 chk->copy_by_ref = 0; 9227 chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK; 9228 chk->rec.chunk_id.can_take_data = 1; 9229 chk->flags = 0; 9230 chk->send_size = sizeof(struct sctp_chunkhdr); 9231 chk->sent = SCTP_DATAGRAM_UNSENT; 9232 chk->snd_count = 0; 9233 chk->asoc = &stcb->asoc; 9234 chk->data = m_shutdown_ack; 9235 chk->whoTo = net; 9236 if (chk->whoTo) { 9237 atomic_add_int(&chk->whoTo->ref_count, 1); 9238 } 9239 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 9240 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 9241 ack_cp->ch.chunk_flags = 0; 9242 ack_cp->ch.chunk_length = htons(chk->send_size); 9243 SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size; 9244 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9245 chk->asoc->ctrl_queue_cnt++; 9246 return; 9247} 9248 9249void 9250sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 9251{ 9252 /* formulate and queue a SHUTDOWN to the sender */ 9253 struct mbuf *m_shutdown; 9254 struct sctp_shutdown_chunk *shutdown_cp; 9255 struct sctp_tmit_chunk *chk; 9256 9257 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 9258 if (chk->rec.chunk_id.id == SCTP_SHUTDOWN) { 9259 /* We already have a SHUTDOWN queued. Reuse it. */ 9260 if (chk->whoTo) { 9261 sctp_free_remote_addr(chk->whoTo); 9262 chk->whoTo = NULL; 9263 } 9264 break; 9265 } 9266 } 9267 if (chk == NULL) { 9268 m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9269 if (m_shutdown == NULL) { 9270 /* no mbuf's */ 9271 return; 9272 } 9273 SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD); 9274 sctp_alloc_a_chunk(stcb, chk); 9275 if (chk == NULL) { 9276 /* no memory */ 9277 sctp_m_freem(m_shutdown); 9278 return; 9279 } 9280 chk->copy_by_ref = 0; 9281 chk->rec.chunk_id.id = SCTP_SHUTDOWN; 9282 chk->rec.chunk_id.can_take_data = 1; 9283 chk->flags = 0; 9284 chk->send_size = sizeof(struct sctp_shutdown_chunk); 9285 chk->sent = SCTP_DATAGRAM_UNSENT; 9286 chk->snd_count = 0; 9287 chk->asoc = &stcb->asoc; 9288 chk->data = m_shutdown; 9289 chk->whoTo = net; 9290 if (chk->whoTo) { 9291 atomic_add_int(&chk->whoTo->ref_count, 1); 9292 } 9293 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 9294 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 9295 shutdown_cp->ch.chunk_flags = 0; 9296 shutdown_cp->ch.chunk_length = htons(chk->send_size); 9297 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9298 SCTP_BUF_LEN(m_shutdown) = chk->send_size; 9299 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9300 chk->asoc->ctrl_queue_cnt++; 9301 } else { 9302 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, sctp_next); 9303 chk->whoTo = net; 9304 if (chk->whoTo) { 9305 atomic_add_int(&chk->whoTo->ref_count, 1); 9306 } 9307 shutdown_cp = mtod(chk->data, struct sctp_shutdown_chunk *); 9308 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9309 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 9310 } 9311 return; 9312} 9313 9314void 9315sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked) 9316{ 9317 /* 9318 * formulate and queue an ASCONF to the peer. ASCONF parameters 9319 * should be queued on the assoc queue. 9320 */ 9321 struct sctp_tmit_chunk *chk; 9322 struct mbuf *m_asconf; 9323 int len; 9324 9325 SCTP_TCB_LOCK_ASSERT(stcb); 9326 9327 if ((!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) && 9328 (!sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS))) { 9329 /* can't send a new one if there is one in flight already */ 9330 return; 9331 } 9332 9333 /* compose an ASCONF chunk, maximum length is PMTU */ 9334 m_asconf = sctp_compose_asconf(stcb, &len, addr_locked); 9335 if (m_asconf == NULL) { 9336 return; 9337 } 9338 9339 sctp_alloc_a_chunk(stcb, chk); 9340 if (chk == NULL) { 9341 /* no memory */ 9342 sctp_m_freem(m_asconf); 9343 return; 9344 } 9345 9346 chk->copy_by_ref = 0; 9347 chk->rec.chunk_id.id = SCTP_ASCONF; 9348 chk->rec.chunk_id.can_take_data = 0; 9349 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9350 chk->data = m_asconf; 9351 chk->send_size = len; 9352 chk->sent = SCTP_DATAGRAM_UNSENT; 9353 chk->snd_count = 0; 9354 chk->asoc = &stcb->asoc; 9355 chk->whoTo = net; 9356 if (chk->whoTo) { 9357 atomic_add_int(&chk->whoTo->ref_count, 1); 9358 } 9359 TAILQ_INSERT_TAIL(&chk->asoc->asconf_send_queue, chk, sctp_next); 9360 chk->asoc->ctrl_queue_cnt++; 9361 return; 9362} 9363 9364void 9365sctp_send_asconf_ack(struct sctp_tcb *stcb) 9366{ 9367 /* 9368 * formulate and queue a asconf-ack back to sender. the asconf-ack 9369 * must be stored in the tcb. 9370 */ 9371 struct sctp_tmit_chunk *chk; 9372 struct sctp_asconf_ack *ack, *latest_ack; 9373 struct mbuf *m_ack; 9374 struct sctp_nets *net = NULL; 9375 9376 SCTP_TCB_LOCK_ASSERT(stcb); 9377 /* Get the latest ASCONF-ACK */ 9378 latest_ack = TAILQ_LAST(&stcb->asoc.asconf_ack_sent, sctp_asconf_ackhead); 9379 if (latest_ack == NULL) { 9380 return; 9381 } 9382 if (latest_ack->last_sent_to != NULL && 9383 latest_ack->last_sent_to == stcb->asoc.last_control_chunk_from) { 9384 /* we're doing a retransmission */ 9385 net = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0); 9386 if (net == NULL) { 9387 /* no alternate */ 9388 if (stcb->asoc.last_control_chunk_from == NULL) { 9389 if (stcb->asoc.alternate) { 9390 net = stcb->asoc.alternate; 9391 } else { 9392 net = stcb->asoc.primary_destination; 9393 } 9394 } else { 9395 net = stcb->asoc.last_control_chunk_from; 9396 } 9397 } 9398 } else { 9399 /* normal case */ 9400 if (stcb->asoc.last_control_chunk_from == NULL) { 9401 if (stcb->asoc.alternate) { 9402 net = stcb->asoc.alternate; 9403 } else { 9404 net = stcb->asoc.primary_destination; 9405 } 9406 } else { 9407 net = stcb->asoc.last_control_chunk_from; 9408 } 9409 } 9410 latest_ack->last_sent_to = net; 9411 9412 TAILQ_FOREACH(ack, &stcb->asoc.asconf_ack_sent, next) { 9413 if (ack->data == NULL) { 9414 continue; 9415 } 9416 9417 /* copy the asconf_ack */ 9418 m_ack = SCTP_M_COPYM(ack->data, 0, M_COPYALL, M_NOWAIT); 9419 if (m_ack == NULL) { 9420 /* couldn't copy it */ 9421 return; 9422 } 9423#ifdef SCTP_MBUF_LOGGING 9424 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9425 sctp_log_mbc(m_ack, SCTP_MBUF_ICOPY); 9426 } 9427#endif 9428 9429 sctp_alloc_a_chunk(stcb, chk); 9430 if (chk == NULL) { 9431 /* no memory */ 9432 if (m_ack) 9433 sctp_m_freem(m_ack); 9434 return; 9435 } 9436 chk->copy_by_ref = 0; 9437 chk->rec.chunk_id.id = SCTP_ASCONF_ACK; 9438 chk->rec.chunk_id.can_take_data = 1; 9439 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9440 chk->whoTo = net; 9441 if (chk->whoTo) { 9442 atomic_add_int(&chk->whoTo->ref_count, 1); 9443 } 9444 chk->data = m_ack; 9445 chk->send_size = ack->len; 9446 chk->sent = SCTP_DATAGRAM_UNSENT; 9447 chk->snd_count = 0; 9448 chk->asoc = &stcb->asoc; 9449 9450 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9451 chk->asoc->ctrl_queue_cnt++; 9452 } 9453 return; 9454} 9455 9456 9457static int 9458sctp_chunk_retransmission(struct sctp_inpcb *inp, 9459 struct sctp_tcb *stcb, 9460 struct sctp_association *asoc, 9461 int *cnt_out, struct timeval *now, int *now_filled, int *fr_done, int so_locked 9462#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 9463 SCTP_UNUSED 9464#endif 9465) 9466{ 9467 /*- 9468 * send out one MTU of retransmission. If fast_retransmit is 9469 * happening we ignore the cwnd. Otherwise we obey the cwnd and 9470 * rwnd. For a Cookie or Asconf in the control chunk queue we 9471 * retransmit them by themselves. 9472 * 9473 * For data chunks we will pick out the lowest TSN's in the sent_queue 9474 * marked for resend and bundle them all together (up to a MTU of 9475 * destination). The address to send to should have been 9476 * selected/changed where the retransmission was marked (i.e. in FR 9477 * or t3-timeout routines). 9478 */ 9479 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 9480 struct sctp_tmit_chunk *chk, *fwd; 9481 struct mbuf *m, *endofchain; 9482 struct sctp_nets *net = NULL; 9483 uint32_t tsns_sent = 0; 9484 int no_fragmentflg, bundle_at, cnt_thru; 9485 unsigned int mtu; 9486 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 9487 struct sctp_auth_chunk *auth = NULL; 9488 uint32_t auth_offset = 0; 9489 uint16_t auth_keyid; 9490 int override_ok = 1; 9491 int data_auth_reqd = 0; 9492 uint32_t dmtu = 0; 9493 9494 SCTP_TCB_LOCK_ASSERT(stcb); 9495 tmr_started = ctl_cnt = bundle_at = error = 0; 9496 no_fragmentflg = 1; 9497 fwd_tsn = 0; 9498 *cnt_out = 0; 9499 fwd = NULL; 9500 endofchain = m = NULL; 9501 auth_keyid = stcb->asoc.authinfo.active_keyid; 9502#ifdef SCTP_AUDITING_ENABLED 9503 sctp_audit_log(0xC3, 1); 9504#endif 9505 if ((TAILQ_EMPTY(&asoc->sent_queue)) && 9506 (TAILQ_EMPTY(&asoc->control_send_queue))) { 9507 SCTPDBG(SCTP_DEBUG_OUTPUT1, "SCTP hits empty queue with cnt set to %d?\n", 9508 asoc->sent_queue_retran_cnt); 9509 asoc->sent_queue_cnt = 0; 9510 asoc->sent_queue_cnt_removeable = 0; 9511 /* send back 0/0 so we enter normal transmission */ 9512 *cnt_out = 0; 9513 return (0); 9514 } 9515 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 9516 if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) || 9517 (chk->rec.chunk_id.id == SCTP_STREAM_RESET) || 9518 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) { 9519 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9520 continue; 9521 } 9522 if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 9523 if (chk != asoc->str_reset) { 9524 /* 9525 * not eligible for retran if its 9526 * not ours 9527 */ 9528 continue; 9529 } 9530 } 9531 ctl_cnt++; 9532 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 9533 fwd_tsn = 1; 9534 } 9535 /* 9536 * Add an AUTH chunk, if chunk requires it save the 9537 * offset into the chain for AUTH 9538 */ 9539 if ((auth == NULL) && 9540 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 9541 stcb->asoc.peer_auth_chunks))) { 9542 m = sctp_add_auth_chunk(m, &endofchain, 9543 &auth, &auth_offset, 9544 stcb, 9545 chk->rec.chunk_id.id); 9546 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9547 } 9548 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9549 break; 9550 } 9551 } 9552 one_chunk = 0; 9553 cnt_thru = 0; 9554 /* do we have control chunks to retransmit? */ 9555 if (m != NULL) { 9556 /* Start a timer no matter if we succeed or fail */ 9557 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 9558 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 9559 } else if (chk->rec.chunk_id.id == SCTP_ASCONF) 9560 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 9561 chk->snd_count++; /* update our count */ 9562 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 9563 (struct sockaddr *)&chk->whoTo->ro._l_addr, m, 9564 auth_offset, auth, stcb->asoc.authinfo.active_keyid, 9565 no_fragmentflg, 0, 0, 9566 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9567 chk->whoTo->port, NULL, 9568 0, 0, 9569 so_locked))) { 9570 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9571 if (error == ENOBUFS) { 9572 asoc->ifp_had_enobuf = 1; 9573 SCTP_STAT_INCR(sctps_lowlevelerr); 9574 } 9575 return (error); 9576 } else { 9577 asoc->ifp_had_enobuf = 0; 9578 } 9579 endofchain = NULL; 9580 auth = NULL; 9581 auth_offset = 0; 9582 /* 9583 * We don't want to mark the net->sent time here since this 9584 * we use this for HB and retrans cannot measure RTT 9585 */ 9586 /* (void)SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */ 9587 *cnt_out += 1; 9588 chk->sent = SCTP_DATAGRAM_SENT; 9589 sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt); 9590 if (fwd_tsn == 0) { 9591 return (0); 9592 } else { 9593 /* Clean up the fwd-tsn list */ 9594 sctp_clean_up_ctl(stcb, asoc, so_locked); 9595 return (0); 9596 } 9597 } 9598 /* 9599 * Ok, it is just data retransmission we need to do or that and a 9600 * fwd-tsn with it all. 9601 */ 9602 if (TAILQ_EMPTY(&asoc->sent_queue)) { 9603 return (SCTP_RETRAN_DONE); 9604 } 9605 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED) || 9606 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT)) { 9607 /* not yet open, resend the cookie and that is it */ 9608 return (1); 9609 } 9610#ifdef SCTP_AUDITING_ENABLED 9611 sctp_auditing(20, inp, stcb, NULL); 9612#endif 9613 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks); 9614 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 9615 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9616 /* No, not sent to this net or not ready for rtx */ 9617 continue; 9618 } 9619 if (chk->data == NULL) { 9620 SCTP_PRINTF("TSN:%x chk->snd_count:%d chk->sent:%d can't retran - no data\n", 9621 chk->rec.data.tsn, chk->snd_count, chk->sent); 9622 continue; 9623 } 9624 if ((SCTP_BASE_SYSCTL(sctp_max_retran_chunk)) && 9625 (chk->snd_count >= SCTP_BASE_SYSCTL(sctp_max_retran_chunk))) { 9626 struct mbuf *op_err; 9627 char msg[SCTP_DIAG_INFO_LEN]; 9628 9629 snprintf(msg, sizeof(msg), "TSN %8.8x retransmitted %d times, giving up", 9630 chk->rec.data.tsn, chk->snd_count); 9631 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 9632 msg); 9633 atomic_add_int(&stcb->asoc.refcnt, 1); 9634 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, 9635 so_locked); 9636 SCTP_TCB_LOCK(stcb); 9637 atomic_subtract_int(&stcb->asoc.refcnt, 1); 9638 return (SCTP_RETRAN_EXIT); 9639 } 9640 /* pick up the net */ 9641 net = chk->whoTo; 9642 switch (net->ro._l_addr.sa.sa_family) { 9643#ifdef INET 9644 case AF_INET: 9645 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 9646 break; 9647#endif 9648#ifdef INET6 9649 case AF_INET6: 9650 mtu = net->mtu - SCTP_MIN_OVERHEAD; 9651 break; 9652#endif 9653 default: 9654 /* TSNH */ 9655 mtu = net->mtu; 9656 break; 9657 } 9658 9659 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 9660 /* No room in peers rwnd */ 9661 uint32_t tsn; 9662 9663 tsn = asoc->last_acked_seq + 1; 9664 if (tsn == chk->rec.data.tsn) { 9665 /* 9666 * we make a special exception for this 9667 * case. The peer has no rwnd but is missing 9668 * the lowest chunk.. which is probably what 9669 * is holding up the rwnd. 9670 */ 9671 goto one_chunk_around; 9672 } 9673 return (1); 9674 } 9675one_chunk_around: 9676 if (asoc->peers_rwnd < mtu) { 9677 one_chunk = 1; 9678 if ((asoc->peers_rwnd == 0) && 9679 (asoc->total_flight == 0)) { 9680 chk->window_probe = 1; 9681 chk->whoTo->window_probe = 1; 9682 } 9683 } 9684#ifdef SCTP_AUDITING_ENABLED 9685 sctp_audit_log(0xC3, 2); 9686#endif 9687 bundle_at = 0; 9688 m = NULL; 9689 net->fast_retran_ip = 0; 9690 if (chk->rec.data.doing_fast_retransmit == 0) { 9691 /* 9692 * if no FR in progress skip destination that have 9693 * flight_size > cwnd. 9694 */ 9695 if (net->flight_size >= net->cwnd) { 9696 continue; 9697 } 9698 } else { 9699 /* 9700 * Mark the destination net to have FR recovery 9701 * limits put on it. 9702 */ 9703 *fr_done = 1; 9704 net->fast_retran_ip = 1; 9705 } 9706 9707 /* 9708 * if no AUTH is yet included and this chunk requires it, 9709 * make sure to account for it. We don't apply the size 9710 * until the AUTH chunk is actually added below in case 9711 * there is no room for this chunk. 9712 */ 9713 if (data_auth_reqd && (auth == NULL)) { 9714 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9715 } else 9716 dmtu = 0; 9717 9718 if ((chk->send_size <= (mtu - dmtu)) || 9719 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 9720 /* ok we will add this one */ 9721 if (data_auth_reqd) { 9722 if (auth == NULL) { 9723 m = sctp_add_auth_chunk(m, 9724 &endofchain, 9725 &auth, 9726 &auth_offset, 9727 stcb, 9728 SCTP_DATA); 9729 auth_keyid = chk->auth_keyid; 9730 override_ok = 0; 9731 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9732 } else if (override_ok) { 9733 auth_keyid = chk->auth_keyid; 9734 override_ok = 0; 9735 } else if (chk->auth_keyid != auth_keyid) { 9736 /* different keyid, so done bundling */ 9737 break; 9738 } 9739 } 9740 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9741 if (m == NULL) { 9742 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9743 return (ENOMEM); 9744 } 9745 /* Do clear IP_DF ? */ 9746 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9747 no_fragmentflg = 0; 9748 } 9749 /* upate our MTU size */ 9750 if (mtu > (chk->send_size + dmtu)) 9751 mtu -= (chk->send_size + dmtu); 9752 else 9753 mtu = 0; 9754 data_list[bundle_at++] = chk; 9755 if (one_chunk && (asoc->total_flight <= 0)) { 9756 SCTP_STAT_INCR(sctps_windowprobed); 9757 } 9758 } 9759 if (one_chunk == 0) { 9760 /* 9761 * now are there anymore forward from chk to pick 9762 * up? 9763 */ 9764 for (fwd = TAILQ_NEXT(chk, sctp_next); fwd != NULL; fwd = TAILQ_NEXT(fwd, sctp_next)) { 9765 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 9766 /* Nope, not for retran */ 9767 continue; 9768 } 9769 if (fwd->whoTo != net) { 9770 /* Nope, not the net in question */ 9771 continue; 9772 } 9773 if (data_auth_reqd && (auth == NULL)) { 9774 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9775 } else 9776 dmtu = 0; 9777 if (fwd->send_size <= (mtu - dmtu)) { 9778 if (data_auth_reqd) { 9779 if (auth == NULL) { 9780 m = sctp_add_auth_chunk(m, 9781 &endofchain, 9782 &auth, 9783 &auth_offset, 9784 stcb, 9785 SCTP_DATA); 9786 auth_keyid = fwd->auth_keyid; 9787 override_ok = 0; 9788 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9789 } else if (override_ok) { 9790 auth_keyid = fwd->auth_keyid; 9791 override_ok = 0; 9792 } else if (fwd->auth_keyid != auth_keyid) { 9793 /* 9794 * different keyid, 9795 * so done bundling 9796 */ 9797 break; 9798 } 9799 } 9800 m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref); 9801 if (m == NULL) { 9802 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9803 return (ENOMEM); 9804 } 9805 /* Do clear IP_DF ? */ 9806 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9807 no_fragmentflg = 0; 9808 } 9809 /* upate our MTU size */ 9810 if (mtu > (fwd->send_size + dmtu)) 9811 mtu -= (fwd->send_size + dmtu); 9812 else 9813 mtu = 0; 9814 data_list[bundle_at++] = fwd; 9815 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 9816 break; 9817 } 9818 } else { 9819 /* can't fit so we are done */ 9820 break; 9821 } 9822 } 9823 } 9824 /* Is there something to send for this destination? */ 9825 if (m) { 9826 /* 9827 * No matter if we fail/or succeed we should start a 9828 * timer. A failure is like a lost IP packet :-) 9829 */ 9830 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9831 /* 9832 * no timer running on this destination 9833 * restart it. 9834 */ 9835 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9836 tmr_started = 1; 9837 } 9838 /* Now lets send it, if there is anything to send :> */ 9839 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 9840 (struct sockaddr *)&net->ro._l_addr, m, 9841 auth_offset, auth, auth_keyid, 9842 no_fragmentflg, 0, 0, 9843 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9844 net->port, NULL, 9845 0, 0, 9846 so_locked))) { 9847 /* error, we could not output */ 9848 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9849 if (error == ENOBUFS) { 9850 asoc->ifp_had_enobuf = 1; 9851 SCTP_STAT_INCR(sctps_lowlevelerr); 9852 } 9853 return (error); 9854 } else { 9855 asoc->ifp_had_enobuf = 0; 9856 } 9857 endofchain = NULL; 9858 auth = NULL; 9859 auth_offset = 0; 9860 /* For HB's */ 9861 /* 9862 * We don't want to mark the net->sent time here 9863 * since this we use this for HB and retrans cannot 9864 * measure RTT 9865 */ 9866 /* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */ 9867 9868 /* For auto-close */ 9869 cnt_thru++; 9870 if (*now_filled == 0) { 9871 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 9872 *now = asoc->time_last_sent; 9873 *now_filled = 1; 9874 } else { 9875 asoc->time_last_sent = *now; 9876 } 9877 *cnt_out += bundle_at; 9878#ifdef SCTP_AUDITING_ENABLED 9879 sctp_audit_log(0xC4, bundle_at); 9880#endif 9881 if (bundle_at) { 9882 tsns_sent = data_list[0]->rec.data.tsn; 9883 } 9884 for (i = 0; i < bundle_at; i++) { 9885 SCTP_STAT_INCR(sctps_sendretransdata); 9886 data_list[i]->sent = SCTP_DATAGRAM_SENT; 9887 /* 9888 * When we have a revoked data, and we 9889 * retransmit it, then we clear the revoked 9890 * flag since this flag dictates if we 9891 * subtracted from the fs 9892 */ 9893 if (data_list[i]->rec.data.chunk_was_revoked) { 9894 /* Deflate the cwnd */ 9895 data_list[i]->whoTo->cwnd -= data_list[i]->book_size; 9896 data_list[i]->rec.data.chunk_was_revoked = 0; 9897 } 9898 data_list[i]->snd_count++; 9899 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 9900 /* record the time */ 9901 data_list[i]->sent_rcv_time = asoc->time_last_sent; 9902 if (data_list[i]->book_size_scale) { 9903 /* 9904 * need to double the book size on 9905 * this one 9906 */ 9907 data_list[i]->book_size_scale = 0; 9908 /* 9909 * Since we double the booksize, we 9910 * must also double the output queue 9911 * size, since this get shrunk when 9912 * we free by this amount. 9913 */ 9914 atomic_add_int(&((asoc)->total_output_queue_size), data_list[i]->book_size); 9915 data_list[i]->book_size *= 2; 9916 9917 9918 } else { 9919 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 9920 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 9921 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 9922 } 9923 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 9924 (uint32_t)(data_list[i]->send_size + 9925 SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 9926 } 9927 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 9928 sctp_misc_ints(SCTP_FLIGHT_LOG_UP_RSND, 9929 data_list[i]->whoTo->flight_size, 9930 data_list[i]->book_size, 9931 (uint32_t)(uintptr_t)data_list[i]->whoTo, 9932 data_list[i]->rec.data.tsn); 9933 } 9934 sctp_flight_size_increase(data_list[i]); 9935 sctp_total_flight_increase(stcb, data_list[i]); 9936 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 9937 /* SWS sender side engages */ 9938 asoc->peers_rwnd = 0; 9939 } 9940 if ((i == 0) && 9941 (data_list[i]->rec.data.doing_fast_retransmit)) { 9942 SCTP_STAT_INCR(sctps_sendfastretrans); 9943 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 9944 (tmr_started == 0)) { 9945 /*- 9946 * ok we just fast-retrans'd 9947 * the lowest TSN, i.e the 9948 * first on the list. In 9949 * this case we want to give 9950 * some more time to get a 9951 * SACK back without a 9952 * t3-expiring. 9953 */ 9954 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 9955 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_2); 9956 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9957 } 9958 } 9959 } 9960 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 9961 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND); 9962 } 9963#ifdef SCTP_AUDITING_ENABLED 9964 sctp_auditing(21, inp, stcb, NULL); 9965#endif 9966 } else { 9967 /* None will fit */ 9968 return (1); 9969 } 9970 if (asoc->sent_queue_retran_cnt <= 0) { 9971 /* all done we have no more to retran */ 9972 asoc->sent_queue_retran_cnt = 0; 9973 break; 9974 } 9975 if (one_chunk) { 9976 /* No more room in rwnd */ 9977 return (1); 9978 } 9979 /* stop the for loop here. we sent out a packet */ 9980 break; 9981 } 9982 return (0); 9983} 9984 9985static void 9986sctp_timer_validation(struct sctp_inpcb *inp, 9987 struct sctp_tcb *stcb, 9988 struct sctp_association *asoc) 9989{ 9990 struct sctp_nets *net; 9991 9992 /* Validate that a timer is running somewhere */ 9993 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 9994 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9995 /* Here is a timer */ 9996 return; 9997 } 9998 } 9999 SCTP_TCB_LOCK_ASSERT(stcb); 10000 /* Gak, we did not have a timer somewhere */ 10001 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Deadlock avoided starting timer on a dest at retran\n"); 10002 if (asoc->alternate) { 10003 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->alternate); 10004 } else { 10005 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 10006 } 10007 return; 10008} 10009 10010void 10011sctp_chunk_output(struct sctp_inpcb *inp, 10012 struct sctp_tcb *stcb, 10013 int from_where, 10014 int so_locked 10015#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10016 SCTP_UNUSED 10017#endif 10018) 10019{ 10020 /*- 10021 * Ok this is the generic chunk service queue. we must do the 10022 * following: 10023 * - See if there are retransmits pending, if so we must 10024 * do these first. 10025 * - Service the stream queue that is next, moving any 10026 * message (note I must get a complete message i.e. 10027 * FIRST/MIDDLE and LAST to the out queue in one pass) and assigning 10028 * TSN's 10029 * - Check to see if the cwnd/rwnd allows any output, if so we 10030 * go ahead and fomulate and send the low level chunks. Making sure 10031 * to combine any control in the control chunk queue also. 10032 */ 10033 struct sctp_association *asoc; 10034 struct sctp_nets *net; 10035 int error = 0, num_out, tot_out = 0, ret = 0, reason_code; 10036 unsigned int burst_cnt = 0; 10037 struct timeval now; 10038 int now_filled = 0; 10039 int nagle_on; 10040 int frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 10041 int un_sent = 0; 10042 int fr_done; 10043 unsigned int tot_frs = 0; 10044 10045 asoc = &stcb->asoc; 10046do_it_again: 10047 /* The Nagle algorithm is only applied when handling a send call. */ 10048 if (from_where == SCTP_OUTPUT_FROM_USR_SEND) { 10049 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) { 10050 nagle_on = 0; 10051 } else { 10052 nagle_on = 1; 10053 } 10054 } else { 10055 nagle_on = 0; 10056 } 10057 SCTP_TCB_LOCK_ASSERT(stcb); 10058 10059 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 10060 10061 if ((un_sent <= 0) && 10062 (TAILQ_EMPTY(&asoc->control_send_queue)) && 10063 (TAILQ_EMPTY(&asoc->asconf_send_queue)) && 10064 (asoc->sent_queue_retran_cnt == 0) && 10065 (asoc->trigger_reset == 0)) { 10066 /* Nothing to do unless there is something to be sent left */ 10067 return; 10068 } 10069 /* 10070 * Do we have something to send, data or control AND a sack timer 10071 * running, if so piggy-back the sack. 10072 */ 10073 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 10074 sctp_send_sack(stcb, so_locked); 10075 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, 10076 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_3); 10077 } 10078 while (asoc->sent_queue_retran_cnt) { 10079 /*- 10080 * Ok, it is retransmission time only, we send out only ONE 10081 * packet with a single call off to the retran code. 10082 */ 10083 if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) { 10084 /*- 10085 * Special hook for handling cookiess discarded 10086 * by peer that carried data. Send cookie-ack only 10087 * and then the next call with get the retran's. 10088 */ 10089 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10090 from_where, 10091 &now, &now_filled, frag_point, so_locked); 10092 return; 10093 } else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) { 10094 /* if its not from a HB then do it */ 10095 fr_done = 0; 10096 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled, &fr_done, so_locked); 10097 if (fr_done) { 10098 tot_frs++; 10099 } 10100 } else { 10101 /* 10102 * its from any other place, we don't allow retran 10103 * output (only control) 10104 */ 10105 ret = 1; 10106 } 10107 if (ret > 0) { 10108 /* Can't send anymore */ 10109 /*- 10110 * now lets push out control by calling med-level 10111 * output once. this assures that we WILL send HB's 10112 * if queued too. 10113 */ 10114 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10115 from_where, 10116 &now, &now_filled, frag_point, so_locked); 10117#ifdef SCTP_AUDITING_ENABLED 10118 sctp_auditing(8, inp, stcb, NULL); 10119#endif 10120 sctp_timer_validation(inp, stcb, asoc); 10121 return; 10122 } 10123 if (ret < 0) { 10124 /*- 10125 * The count was off.. retran is not happening so do 10126 * the normal retransmission. 10127 */ 10128#ifdef SCTP_AUDITING_ENABLED 10129 sctp_auditing(9, inp, stcb, NULL); 10130#endif 10131 if (ret == SCTP_RETRAN_EXIT) { 10132 return; 10133 } 10134 break; 10135 } 10136 if (from_where == SCTP_OUTPUT_FROM_T3) { 10137 /* Only one transmission allowed out of a timeout */ 10138#ifdef SCTP_AUDITING_ENABLED 10139 sctp_auditing(10, inp, stcb, NULL); 10140#endif 10141 /* Push out any control */ 10142 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, from_where, 10143 &now, &now_filled, frag_point, so_locked); 10144 return; 10145 } 10146 if ((asoc->fr_max_burst > 0) && (tot_frs >= asoc->fr_max_burst)) { 10147 /* Hit FR burst limit */ 10148 return; 10149 } 10150 if ((num_out == 0) && (ret == 0)) { 10151 /* No more retrans to send */ 10152 break; 10153 } 10154 } 10155#ifdef SCTP_AUDITING_ENABLED 10156 sctp_auditing(12, inp, stcb, NULL); 10157#endif 10158 /* Check for bad destinations, if they exist move chunks around. */ 10159 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 10160 if (!(net->dest_state & SCTP_ADDR_REACHABLE)) { 10161 /*- 10162 * if possible move things off of this address we 10163 * still may send below due to the dormant state but 10164 * we try to find an alternate address to send to 10165 * and if we have one we move all queued data on the 10166 * out wheel to this alternate address. 10167 */ 10168 if (net->ref_count > 1) 10169 sctp_move_chunks_from_net(stcb, net); 10170 } else { 10171 /*- 10172 * if ((asoc->sat_network) || (net->addr_is_local)) 10173 * { burst_limit = asoc->max_burst * 10174 * SCTP_SAT_NETWORK_BURST_INCR; } 10175 */ 10176 if (asoc->max_burst > 0) { 10177 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst)) { 10178 if ((net->flight_size + (asoc->max_burst * net->mtu)) < net->cwnd) { 10179 /* 10180 * JRS - Use the congestion 10181 * control given in the 10182 * congestion control module 10183 */ 10184 asoc->cc_functions.sctp_cwnd_update_after_output(stcb, net, asoc->max_burst); 10185 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10186 sctp_log_maxburst(stcb, net, 0, asoc->max_burst, SCTP_MAX_BURST_APPLIED); 10187 } 10188 SCTP_STAT_INCR(sctps_maxburstqueued); 10189 } 10190 net->fast_retran_ip = 0; 10191 } else { 10192 if (net->flight_size == 0) { 10193 /* 10194 * Should be decaying the 10195 * cwnd here 10196 */ 10197 ; 10198 } 10199 } 10200 } 10201 } 10202 10203 } 10204 burst_cnt = 0; 10205 do { 10206 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 10207 &reason_code, 0, from_where, 10208 &now, &now_filled, frag_point, so_locked); 10209 if (error) { 10210 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Error %d was returned from med-c-op\n", error); 10211 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10212 sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 10213 } 10214 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10215 sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES); 10216 sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES); 10217 } 10218 break; 10219 } 10220 SCTPDBG(SCTP_DEBUG_OUTPUT3, "m-c-o put out %d\n", num_out); 10221 10222 tot_out += num_out; 10223 burst_cnt++; 10224 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10225 sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES); 10226 if (num_out == 0) { 10227 sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES); 10228 } 10229 } 10230 if (nagle_on) { 10231 /* 10232 * When the Nagle algorithm is used, look at how 10233 * much is unsent, then if its smaller than an MTU 10234 * and we have data in flight we stop, except if we 10235 * are handling a fragmented user message. 10236 */ 10237 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 10238 if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) && 10239 (stcb->asoc.total_flight > 0)) { 10240/* && sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) {*/ 10241 break; 10242 } 10243 } 10244 if (TAILQ_EMPTY(&asoc->control_send_queue) && 10245 TAILQ_EMPTY(&asoc->send_queue) && 10246 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 10247 /* Nothing left to send */ 10248 break; 10249 } 10250 if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) { 10251 /* Nothing left to send */ 10252 break; 10253 } 10254 } while (num_out && 10255 ((asoc->max_burst == 0) || 10256 SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) || 10257 (burst_cnt < asoc->max_burst))); 10258 10259 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) == 0) { 10260 if ((asoc->max_burst > 0) && (burst_cnt >= asoc->max_burst)) { 10261 SCTP_STAT_INCR(sctps_maxburstqueued); 10262 asoc->burst_limit_applied = 1; 10263 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10264 sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED); 10265 } 10266 } else { 10267 asoc->burst_limit_applied = 0; 10268 } 10269 } 10270 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10271 sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES); 10272 } 10273 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, we have put out %d chunks\n", 10274 tot_out); 10275 10276 /*- 10277 * Now we need to clean up the control chunk chain if a ECNE is on 10278 * it. It must be marked as UNSENT again so next call will continue 10279 * to send it until such time that we get a CWR, to remove it. 10280 */ 10281 if (stcb->asoc.ecn_echo_cnt_onq) 10282 sctp_fix_ecn_echo(asoc); 10283 10284 if (stcb->asoc.trigger_reset) { 10285 if (sctp_send_stream_reset_out_if_possible(stcb, so_locked) == 0) { 10286 goto do_it_again; 10287 } 10288 } 10289 return; 10290} 10291 10292 10293int 10294sctp_output( 10295 struct sctp_inpcb *inp, 10296 struct mbuf *m, 10297 struct sockaddr *addr, 10298 struct mbuf *control, 10299 struct thread *p, 10300 int flags) 10301{ 10302 if (inp == NULL) { 10303 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10304 return (EINVAL); 10305 } 10306 10307 if (inp->sctp_socket == NULL) { 10308 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10309 return (EINVAL); 10310 } 10311 return (sctp_sosend(inp->sctp_socket, 10312 addr, 10313 (struct uio *)NULL, 10314 m, 10315 control, 10316 flags, p 10317 )); 10318} 10319 10320void 10321send_forward_tsn(struct sctp_tcb *stcb, 10322 struct sctp_association *asoc) 10323{ 10324 struct sctp_tmit_chunk *chk, *at, *tp1, *last; 10325 struct sctp_forward_tsn_chunk *fwdtsn; 10326 struct sctp_strseq *strseq; 10327 struct sctp_strseq_mid *strseq_m; 10328 uint32_t advance_peer_ack_point; 10329 unsigned int cnt_of_space, i, ovh; 10330 unsigned int space_needed; 10331 unsigned int cnt_of_skipped = 0; 10332 10333 SCTP_TCB_LOCK_ASSERT(stcb); 10334 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10335 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 10336 /* mark it to unsent */ 10337 chk->sent = SCTP_DATAGRAM_UNSENT; 10338 chk->snd_count = 0; 10339 /* Do we correct its output location? */ 10340 if (chk->whoTo) { 10341 sctp_free_remote_addr(chk->whoTo); 10342 chk->whoTo = NULL; 10343 } 10344 goto sctp_fill_in_rest; 10345 } 10346 } 10347 /* Ok if we reach here we must build one */ 10348 sctp_alloc_a_chunk(stcb, chk); 10349 if (chk == NULL) { 10350 return; 10351 } 10352 asoc->fwd_tsn_cnt++; 10353 chk->copy_by_ref = 0; 10354 /* 10355 * We don't do the old thing here since this is used not for on-wire 10356 * but to tell if we are sending a fwd-tsn by the stack during 10357 * output. And if its a IFORWARD or a FORWARD it is a fwd-tsn. 10358 */ 10359 chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN; 10360 chk->rec.chunk_id.can_take_data = 0; 10361 chk->flags = 0; 10362 chk->asoc = asoc; 10363 chk->whoTo = NULL; 10364 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 10365 if (chk->data == NULL) { 10366 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 10367 return; 10368 } 10369 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 10370 chk->sent = SCTP_DATAGRAM_UNSENT; 10371 chk->snd_count = 0; 10372 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 10373 asoc->ctrl_queue_cnt++; 10374sctp_fill_in_rest: 10375 /*- 10376 * Here we go through and fill out the part that deals with 10377 * stream/seq of the ones we skip. 10378 */ 10379 SCTP_BUF_LEN(chk->data) = 0; 10380 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10381 if ((at->sent != SCTP_FORWARD_TSN_SKIP) && 10382 (at->sent != SCTP_DATAGRAM_NR_ACKED)) { 10383 /* no more to look at */ 10384 break; 10385 } 10386 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10387 /* We don't report these */ 10388 continue; 10389 } 10390 cnt_of_skipped++; 10391 } 10392 if (asoc->idata_supported) { 10393 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10394 (cnt_of_skipped * sizeof(struct sctp_strseq_mid))); 10395 } else { 10396 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10397 (cnt_of_skipped * sizeof(struct sctp_strseq))); 10398 } 10399 cnt_of_space = (unsigned int)M_TRAILINGSPACE(chk->data); 10400 10401 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 10402 ovh = SCTP_MIN_OVERHEAD; 10403 } else { 10404 ovh = SCTP_MIN_V4_OVERHEAD; 10405 } 10406 if (cnt_of_space > (asoc->smallest_mtu - ovh)) { 10407 /* trim to a mtu size */ 10408 cnt_of_space = asoc->smallest_mtu - ovh; 10409 } 10410 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10411 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10412 0xff, 0, cnt_of_skipped, 10413 asoc->advanced_peer_ack_point); 10414 } 10415 advance_peer_ack_point = asoc->advanced_peer_ack_point; 10416 if (cnt_of_space < space_needed) { 10417 /*- 10418 * ok we must trim down the chunk by lowering the 10419 * advance peer ack point. 10420 */ 10421 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10422 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10423 0xff, 0xff, cnt_of_space, 10424 space_needed); 10425 } 10426 cnt_of_skipped = cnt_of_space - sizeof(struct sctp_forward_tsn_chunk); 10427 if (asoc->idata_supported) { 10428 cnt_of_skipped /= sizeof(struct sctp_strseq_mid); 10429 } else { 10430 cnt_of_skipped /= sizeof(struct sctp_strseq); 10431 } 10432 /*- 10433 * Go through and find the TSN that will be the one 10434 * we report. 10435 */ 10436 at = TAILQ_FIRST(&asoc->sent_queue); 10437 if (at != NULL) { 10438 for (i = 0; i < cnt_of_skipped; i++) { 10439 tp1 = TAILQ_NEXT(at, sctp_next); 10440 if (tp1 == NULL) { 10441 break; 10442 } 10443 at = tp1; 10444 } 10445 } 10446 if (at && SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10447 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10448 0xff, cnt_of_skipped, at->rec.data.tsn, 10449 asoc->advanced_peer_ack_point); 10450 } 10451 last = at; 10452 /*- 10453 * last now points to last one I can report, update 10454 * peer ack point 10455 */ 10456 if (last) { 10457 advance_peer_ack_point = last->rec.data.tsn; 10458 } 10459 if (asoc->idata_supported) { 10460 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10461 cnt_of_skipped * sizeof(struct sctp_strseq_mid); 10462 } else { 10463 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10464 cnt_of_skipped * sizeof(struct sctp_strseq); 10465 } 10466 } 10467 chk->send_size = space_needed; 10468 /* Setup the chunk */ 10469 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 10470 fwdtsn->ch.chunk_length = htons(chk->send_size); 10471 fwdtsn->ch.chunk_flags = 0; 10472 if (asoc->idata_supported) { 10473 fwdtsn->ch.chunk_type = SCTP_IFORWARD_CUM_TSN; 10474 } else { 10475 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 10476 } 10477 fwdtsn->new_cumulative_tsn = htonl(advance_peer_ack_point); 10478 SCTP_BUF_LEN(chk->data) = chk->send_size; 10479 fwdtsn++; 10480 /*- 10481 * Move pointer to after the fwdtsn and transfer to the 10482 * strseq pointer. 10483 */ 10484 if (asoc->idata_supported) { 10485 strseq_m = (struct sctp_strseq_mid *)fwdtsn; 10486 strseq = NULL; 10487 } else { 10488 strseq = (struct sctp_strseq *)fwdtsn; 10489 strseq_m = NULL; 10490 } 10491 /*- 10492 * Now populate the strseq list. This is done blindly 10493 * without pulling out duplicate stream info. This is 10494 * inefficent but won't harm the process since the peer will 10495 * look at these in sequence and will thus release anything. 10496 * It could mean we exceed the PMTU and chop off some that 10497 * we could have included.. but this is unlikely (aka 1432/4 10498 * would mean 300+ stream seq's would have to be reported in 10499 * one FWD-TSN. With a bit of work we can later FIX this to 10500 * optimize and pull out duplicates.. but it does add more 10501 * overhead. So for now... not! 10502 */ 10503 i = 0; 10504 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10505 if (i >= cnt_of_skipped) { 10506 break; 10507 } 10508 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10509 /* We don't report these */ 10510 continue; 10511 } 10512 if (at->rec.data.tsn == advance_peer_ack_point) { 10513 at->rec.data.fwd_tsn_cnt = 0; 10514 } 10515 if (asoc->idata_supported) { 10516 strseq_m->sid = htons(at->rec.data.sid); 10517 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 10518 strseq_m->flags = htons(PR_SCTP_UNORDERED_FLAG); 10519 } else { 10520 strseq_m->flags = 0; 10521 } 10522 strseq_m->mid = htonl(at->rec.data.mid); 10523 strseq_m++; 10524 } else { 10525 strseq->sid = htons(at->rec.data.sid); 10526 strseq->ssn = htons((uint16_t)at->rec.data.mid); 10527 strseq++; 10528 } 10529 i++; 10530 } 10531 return; 10532} 10533 10534void 10535sctp_send_sack(struct sctp_tcb *stcb, int so_locked 10536#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10537 SCTP_UNUSED 10538#endif 10539) 10540{ 10541 /*- 10542 * Queue up a SACK or NR-SACK in the control queue. 10543 * We must first check to see if a SACK or NR-SACK is 10544 * somehow on the control queue. 10545 * If so, we will take and and remove the old one. 10546 */ 10547 struct sctp_association *asoc; 10548 struct sctp_tmit_chunk *chk, *a_chk; 10549 struct sctp_sack_chunk *sack; 10550 struct sctp_nr_sack_chunk *nr_sack; 10551 struct sctp_gap_ack_block *gap_descriptor; 10552 const struct sack_track *selector; 10553 int mergeable = 0; 10554 int offset; 10555 caddr_t limit; 10556 uint32_t *dup; 10557 int limit_reached = 0; 10558 unsigned int i, siz, j; 10559 unsigned int num_gap_blocks = 0, num_nr_gap_blocks = 0, space; 10560 int num_dups = 0; 10561 int space_req; 10562 uint32_t highest_tsn; 10563 uint8_t flags; 10564 uint8_t type; 10565 uint8_t tsn_map; 10566 10567 if (stcb->asoc.nrsack_supported == 1) { 10568 type = SCTP_NR_SELECTIVE_ACK; 10569 } else { 10570 type = SCTP_SELECTIVE_ACK; 10571 } 10572 a_chk = NULL; 10573 asoc = &stcb->asoc; 10574 SCTP_TCB_LOCK_ASSERT(stcb); 10575 if (asoc->last_data_chunk_from == NULL) { 10576 /* Hmm we never received anything */ 10577 return; 10578 } 10579 sctp_slide_mapping_arrays(stcb); 10580 sctp_set_rwnd(stcb, asoc); 10581 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10582 if (chk->rec.chunk_id.id == type) { 10583 /* Hmm, found a sack already on queue, remove it */ 10584 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 10585 asoc->ctrl_queue_cnt--; 10586 a_chk = chk; 10587 if (a_chk->data) { 10588 sctp_m_freem(a_chk->data); 10589 a_chk->data = NULL; 10590 } 10591 if (a_chk->whoTo) { 10592 sctp_free_remote_addr(a_chk->whoTo); 10593 a_chk->whoTo = NULL; 10594 } 10595 break; 10596 } 10597 } 10598 if (a_chk == NULL) { 10599 sctp_alloc_a_chunk(stcb, a_chk); 10600 if (a_chk == NULL) { 10601 /* No memory so we drop the idea, and set a timer */ 10602 if (stcb->asoc.delayed_ack) { 10603 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10604 stcb->sctp_ep, stcb, NULL, 10605 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4); 10606 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10607 stcb->sctp_ep, stcb, NULL); 10608 } else { 10609 stcb->asoc.send_sack = 1; 10610 } 10611 return; 10612 } 10613 a_chk->copy_by_ref = 0; 10614 a_chk->rec.chunk_id.id = type; 10615 a_chk->rec.chunk_id.can_take_data = 1; 10616 } 10617 /* Clear our pkt counts */ 10618 asoc->data_pkts_seen = 0; 10619 10620 a_chk->flags = 0; 10621 a_chk->asoc = asoc; 10622 a_chk->snd_count = 0; 10623 a_chk->send_size = 0; /* fill in later */ 10624 a_chk->sent = SCTP_DATAGRAM_UNSENT; 10625 a_chk->whoTo = NULL; 10626 10627 if (!(asoc->last_data_chunk_from->dest_state & SCTP_ADDR_REACHABLE)) { 10628 /*- 10629 * Ok, the destination for the SACK is unreachable, lets see if 10630 * we can select an alternate to asoc->last_data_chunk_from 10631 */ 10632 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0); 10633 if (a_chk->whoTo == NULL) { 10634 /* Nope, no alternate */ 10635 a_chk->whoTo = asoc->last_data_chunk_from; 10636 } 10637 } else { 10638 a_chk->whoTo = asoc->last_data_chunk_from; 10639 } 10640 if (a_chk->whoTo) { 10641 atomic_add_int(&a_chk->whoTo->ref_count, 1); 10642 } 10643 if (SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->highest_tsn_inside_nr_map)) { 10644 highest_tsn = asoc->highest_tsn_inside_map; 10645 } else { 10646 highest_tsn = asoc->highest_tsn_inside_nr_map; 10647 } 10648 if (highest_tsn == asoc->cumulative_tsn) { 10649 /* no gaps */ 10650 if (type == SCTP_SELECTIVE_ACK) { 10651 space_req = sizeof(struct sctp_sack_chunk); 10652 } else { 10653 space_req = sizeof(struct sctp_nr_sack_chunk); 10654 } 10655 } else { 10656 /* gaps get a cluster */ 10657 space_req = MCLBYTES; 10658 } 10659 /* Ok now lets formulate a MBUF with our sack */ 10660 a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_NOWAIT, 1, MT_DATA); 10661 if ((a_chk->data == NULL) || 10662 (a_chk->whoTo == NULL)) { 10663 /* rats, no mbuf memory */ 10664 if (a_chk->data) { 10665 /* was a problem with the destination */ 10666 sctp_m_freem(a_chk->data); 10667 a_chk->data = NULL; 10668 } 10669 sctp_free_a_chunk(stcb, a_chk, so_locked); 10670 /* sa_ignore NO_NULL_CHK */ 10671 if (stcb->asoc.delayed_ack) { 10672 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10673 stcb->sctp_ep, stcb, NULL, 10674 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5); 10675 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10676 stcb->sctp_ep, stcb, NULL); 10677 } else { 10678 stcb->asoc.send_sack = 1; 10679 } 10680 return; 10681 } 10682 /* ok, lets go through and fill it in */ 10683 SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD); 10684 space = (unsigned int)M_TRAILINGSPACE(a_chk->data); 10685 if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) { 10686 space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD); 10687 } 10688 limit = mtod(a_chk->data, caddr_t); 10689 limit += space; 10690 10691 flags = 0; 10692 10693 if ((asoc->sctp_cmt_on_off > 0) && 10694 SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) { 10695 /*- 10696 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been 10697 * received, then set high bit to 1, else 0. Reset 10698 * pkts_rcvd. 10699 */ 10700 flags |= (asoc->cmt_dac_pkts_rcvd << 6); 10701 asoc->cmt_dac_pkts_rcvd = 0; 10702 } 10703#ifdef SCTP_ASOCLOG_OF_TSNS 10704 stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn; 10705 stcb->asoc.cumack_log_atsnt++; 10706 if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) { 10707 stcb->asoc.cumack_log_atsnt = 0; 10708 } 10709#endif 10710 /* reset the readers interpretation */ 10711 stcb->freed_by_sorcv_sincelast = 0; 10712 10713 if (type == SCTP_SELECTIVE_ACK) { 10714 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 10715 nr_sack = NULL; 10716 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk)); 10717 if (highest_tsn > asoc->mapping_array_base_tsn) { 10718 siz = (((highest_tsn - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10719 } else { 10720 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + highest_tsn + 7) / 8; 10721 } 10722 } else { 10723 sack = NULL; 10724 nr_sack = mtod(a_chk->data, struct sctp_nr_sack_chunk *); 10725 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)nr_sack + sizeof(struct sctp_nr_sack_chunk)); 10726 if (asoc->highest_tsn_inside_map > asoc->mapping_array_base_tsn) { 10727 siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10728 } else { 10729 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_map + 7) / 8; 10730 } 10731 } 10732 10733 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10734 offset = 1; 10735 } else { 10736 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10737 } 10738 if (((type == SCTP_SELECTIVE_ACK) && 10739 SCTP_TSN_GT(highest_tsn, asoc->cumulative_tsn)) || 10740 ((type == SCTP_NR_SELECTIVE_ACK) && 10741 SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->cumulative_tsn))) { 10742 /* we have a gap .. maybe */ 10743 for (i = 0; i < siz; i++) { 10744 tsn_map = asoc->mapping_array[i]; 10745 if (type == SCTP_SELECTIVE_ACK) { 10746 tsn_map |= asoc->nr_mapping_array[i]; 10747 } 10748 if (i == 0) { 10749 /* 10750 * Clear all bits corresponding to TSNs 10751 * smaller or equal to the cumulative TSN. 10752 */ 10753 tsn_map &= (~0U << (1 - offset)); 10754 } 10755 selector = &sack_array[tsn_map]; 10756 if (mergeable && selector->right_edge) { 10757 /* 10758 * Backup, left and right edges were ok to 10759 * merge. 10760 */ 10761 num_gap_blocks--; 10762 gap_descriptor--; 10763 } 10764 if (selector->num_entries == 0) 10765 mergeable = 0; 10766 else { 10767 for (j = 0; j < selector->num_entries; j++) { 10768 if (mergeable && selector->right_edge) { 10769 /* 10770 * do a merge by NOT setting 10771 * the left side 10772 */ 10773 mergeable = 0; 10774 } else { 10775 /* 10776 * no merge, set the left 10777 * side 10778 */ 10779 mergeable = 0; 10780 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10781 } 10782 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10783 num_gap_blocks++; 10784 gap_descriptor++; 10785 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10786 /* no more room */ 10787 limit_reached = 1; 10788 break; 10789 } 10790 } 10791 if (selector->left_edge) { 10792 mergeable = 1; 10793 } 10794 } 10795 if (limit_reached) { 10796 /* Reached the limit stop */ 10797 break; 10798 } 10799 offset += 8; 10800 } 10801 } 10802 if ((type == SCTP_NR_SELECTIVE_ACK) && 10803 (limit_reached == 0)) { 10804 10805 mergeable = 0; 10806 10807 if (asoc->highest_tsn_inside_nr_map > asoc->mapping_array_base_tsn) { 10808 siz = (((asoc->highest_tsn_inside_nr_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10809 } else { 10810 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_nr_map + 7) / 8; 10811 } 10812 10813 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10814 offset = 1; 10815 } else { 10816 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10817 } 10818 if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->cumulative_tsn)) { 10819 /* we have a gap .. maybe */ 10820 for (i = 0; i < siz; i++) { 10821 tsn_map = asoc->nr_mapping_array[i]; 10822 if (i == 0) { 10823 /* 10824 * Clear all bits corresponding to 10825 * TSNs smaller or equal to the 10826 * cumulative TSN. 10827 */ 10828 tsn_map &= (~0U << (1 - offset)); 10829 } 10830 selector = &sack_array[tsn_map]; 10831 if (mergeable && selector->right_edge) { 10832 /* 10833 * Backup, left and right edges were 10834 * ok to merge. 10835 */ 10836 num_nr_gap_blocks--; 10837 gap_descriptor--; 10838 } 10839 if (selector->num_entries == 0) 10840 mergeable = 0; 10841 else { 10842 for (j = 0; j < selector->num_entries; j++) { 10843 if (mergeable && selector->right_edge) { 10844 /* 10845 * do a merge by NOT 10846 * setting the left 10847 * side 10848 */ 10849 mergeable = 0; 10850 } else { 10851 /* 10852 * no merge, set the 10853 * left side 10854 */ 10855 mergeable = 0; 10856 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10857 } 10858 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10859 num_nr_gap_blocks++; 10860 gap_descriptor++; 10861 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10862 /* no more room */ 10863 limit_reached = 1; 10864 break; 10865 } 10866 } 10867 if (selector->left_edge) { 10868 mergeable = 1; 10869 } 10870 } 10871 if (limit_reached) { 10872 /* Reached the limit stop */ 10873 break; 10874 } 10875 offset += 8; 10876 } 10877 } 10878 } 10879 /* now we must add any dups we are going to report. */ 10880 if ((limit_reached == 0) && (asoc->numduptsns)) { 10881 dup = (uint32_t *)gap_descriptor; 10882 for (i = 0; i < asoc->numduptsns; i++) { 10883 *dup = htonl(asoc->dup_tsns[i]); 10884 dup++; 10885 num_dups++; 10886 if (((caddr_t)dup + sizeof(uint32_t)) > limit) { 10887 /* no more room */ 10888 break; 10889 } 10890 } 10891 asoc->numduptsns = 0; 10892 } 10893 /* 10894 * now that the chunk is prepared queue it to the control chunk 10895 * queue. 10896 */ 10897 if (type == SCTP_SELECTIVE_ACK) { 10898 a_chk->send_size = (uint16_t)(sizeof(struct sctp_sack_chunk) + 10899 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10900 num_dups * sizeof(int32_t)); 10901 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10902 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10903 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 10904 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 10905 sack->sack.num_dup_tsns = htons(num_dups); 10906 sack->ch.chunk_type = type; 10907 sack->ch.chunk_flags = flags; 10908 sack->ch.chunk_length = htons(a_chk->send_size); 10909 } else { 10910 a_chk->send_size = (uint16_t)(sizeof(struct sctp_nr_sack_chunk) + 10911 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10912 num_dups * sizeof(int32_t)); 10913 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10914 nr_sack->nr_sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10915 nr_sack->nr_sack.a_rwnd = htonl(asoc->my_rwnd); 10916 nr_sack->nr_sack.num_gap_ack_blks = htons(num_gap_blocks); 10917 nr_sack->nr_sack.num_nr_gap_ack_blks = htons(num_nr_gap_blocks); 10918 nr_sack->nr_sack.num_dup_tsns = htons(num_dups); 10919 nr_sack->nr_sack.reserved = 0; 10920 nr_sack->ch.chunk_type = type; 10921 nr_sack->ch.chunk_flags = flags; 10922 nr_sack->ch.chunk_length = htons(a_chk->send_size); 10923 } 10924 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 10925 asoc->my_last_reported_rwnd = asoc->my_rwnd; 10926 asoc->ctrl_queue_cnt++; 10927 asoc->send_sack = 0; 10928 SCTP_STAT_INCR(sctps_sendsacks); 10929 return; 10930} 10931 10932void 10933sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr, int so_locked 10934#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10935 SCTP_UNUSED 10936#endif 10937) 10938{ 10939 struct mbuf *m_abort, *m, *m_last; 10940 struct mbuf *m_out, *m_end = NULL; 10941 struct sctp_abort_chunk *abort; 10942 struct sctp_auth_chunk *auth = NULL; 10943 struct sctp_nets *net; 10944 uint32_t vtag; 10945 uint32_t auth_offset = 0; 10946 int error; 10947 uint16_t cause_len, chunk_len, padding_len; 10948 10949 SCTP_TCB_LOCK_ASSERT(stcb); 10950 /*- 10951 * Add an AUTH chunk, if chunk requires it and save the offset into 10952 * the chain for AUTH 10953 */ 10954 if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION, 10955 stcb->asoc.peer_auth_chunks)) { 10956 m_out = sctp_add_auth_chunk(NULL, &m_end, &auth, &auth_offset, 10957 stcb, SCTP_ABORT_ASSOCIATION); 10958 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10959 } else { 10960 m_out = NULL; 10961 } 10962 m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_NOWAIT, 1, MT_HEADER); 10963 if (m_abort == NULL) { 10964 if (m_out) { 10965 sctp_m_freem(m_out); 10966 } 10967 if (operr) { 10968 sctp_m_freem(operr); 10969 } 10970 return; 10971 } 10972 /* link in any error */ 10973 SCTP_BUF_NEXT(m_abort) = operr; 10974 cause_len = 0; 10975 m_last = NULL; 10976 for (m = operr; m; m = SCTP_BUF_NEXT(m)) { 10977 cause_len += (uint16_t)SCTP_BUF_LEN(m); 10978 if (SCTP_BUF_NEXT(m) == NULL) { 10979 m_last = m; 10980 } 10981 } 10982 SCTP_BUF_LEN(m_abort) = sizeof(struct sctp_abort_chunk); 10983 chunk_len = (uint16_t)sizeof(struct sctp_abort_chunk) + cause_len; 10984 padding_len = SCTP_SIZE32(chunk_len) - chunk_len; 10985 if (m_out == NULL) { 10986 /* NO Auth chunk prepended, so reserve space in front */ 10987 SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD); 10988 m_out = m_abort; 10989 } else { 10990 /* Put AUTH chunk at the front of the chain */ 10991 SCTP_BUF_NEXT(m_end) = m_abort; 10992 } 10993 if (stcb->asoc.alternate) { 10994 net = stcb->asoc.alternate; 10995 } else { 10996 net = stcb->asoc.primary_destination; 10997 } 10998 /* Fill in the ABORT chunk header. */ 10999 abort = mtod(m_abort, struct sctp_abort_chunk *); 11000 abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION; 11001 if (stcb->asoc.peer_vtag == 0) { 11002 /* This happens iff the assoc is in COOKIE-WAIT state. */ 11003 vtag = stcb->asoc.my_vtag; 11004 abort->ch.chunk_flags = SCTP_HAD_NO_TCB; 11005 } else { 11006 vtag = stcb->asoc.peer_vtag; 11007 abort->ch.chunk_flags = 0; 11008 } 11009 abort->ch.chunk_length = htons(chunk_len); 11010 /* Add padding, if necessary. */ 11011 if (padding_len > 0) { 11012 if ((m_last == NULL) || 11013 (sctp_add_pad_tombuf(m_last, padding_len) == NULL)) { 11014 sctp_m_freem(m_out); 11015 return; 11016 } 11017 } 11018 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 11019 (struct sockaddr *)&net->ro._l_addr, 11020 m_out, auth_offset, auth, stcb->asoc.authinfo.active_keyid, 1, 0, 0, 11021 stcb->sctp_ep->sctp_lport, stcb->rport, htonl(vtag), 11022 stcb->asoc.primary_destination->port, NULL, 11023 0, 0, 11024 so_locked))) { 11025 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 11026 if (error == ENOBUFS) { 11027 stcb->asoc.ifp_had_enobuf = 1; 11028 SCTP_STAT_INCR(sctps_lowlevelerr); 11029 } 11030 } else { 11031 stcb->asoc.ifp_had_enobuf = 0; 11032 } 11033 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11034} 11035 11036void 11037sctp_send_shutdown_complete(struct sctp_tcb *stcb, 11038 struct sctp_nets *net, 11039 int reflect_vtag) 11040{ 11041 /* formulate and SEND a SHUTDOWN-COMPLETE */ 11042 struct mbuf *m_shutdown_comp; 11043 struct sctp_shutdown_complete_chunk *shutdown_complete; 11044 uint32_t vtag; 11045 int error; 11046 uint8_t flags; 11047 11048 m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 11049 if (m_shutdown_comp == NULL) { 11050 /* no mbuf's */ 11051 return; 11052 } 11053 if (reflect_vtag) { 11054 flags = SCTP_HAD_NO_TCB; 11055 vtag = stcb->asoc.my_vtag; 11056 } else { 11057 flags = 0; 11058 vtag = stcb->asoc.peer_vtag; 11059 } 11060 shutdown_complete = mtod(m_shutdown_comp, struct sctp_shutdown_complete_chunk *); 11061 shutdown_complete->ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 11062 shutdown_complete->ch.chunk_flags = flags; 11063 shutdown_complete->ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 11064 SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_chunk); 11065 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 11066 (struct sockaddr *)&net->ro._l_addr, 11067 m_shutdown_comp, 0, NULL, 0, 1, 0, 0, 11068 stcb->sctp_ep->sctp_lport, stcb->rport, 11069 htonl(vtag), 11070 net->port, NULL, 11071 0, 0, 11072 SCTP_SO_NOT_LOCKED))) { 11073 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 11074 if (error == ENOBUFS) { 11075 stcb->asoc.ifp_had_enobuf = 1; 11076 SCTP_STAT_INCR(sctps_lowlevelerr); 11077 } 11078 } else { 11079 stcb->asoc.ifp_had_enobuf = 0; 11080 } 11081 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11082 return; 11083} 11084 11085static void 11086sctp_send_resp_msg(struct sockaddr *src, struct sockaddr *dst, 11087 struct sctphdr *sh, uint32_t vtag, 11088 uint8_t type, struct mbuf *cause, 11089 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11090 uint32_t vrf_id, uint16_t port) 11091{ 11092 struct mbuf *o_pak; 11093 struct mbuf *mout; 11094 struct sctphdr *shout; 11095 struct sctp_chunkhdr *ch; 11096#if defined(INET) || defined(INET6) 11097 struct udphdr *udp; 11098#endif 11099 int ret, len, cause_len, padding_len; 11100#ifdef INET 11101 struct sockaddr_in *src_sin, *dst_sin; 11102 struct ip *ip; 11103#endif 11104#ifdef INET6 11105 struct sockaddr_in6 *src_sin6, *dst_sin6; 11106 struct ip6_hdr *ip6; 11107#endif 11108 11109 /* Compute the length of the cause and add final padding. */ 11110 cause_len = 0; 11111 if (cause != NULL) { 11112 struct mbuf *m_at, *m_last = NULL; 11113 11114 for (m_at = cause; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 11115 if (SCTP_BUF_NEXT(m_at) == NULL) 11116 m_last = m_at; 11117 cause_len += SCTP_BUF_LEN(m_at); 11118 } 11119 padding_len = cause_len % 4; 11120 if (padding_len != 0) { 11121 padding_len = 4 - padding_len; 11122 } 11123 if (padding_len != 0) { 11124 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 11125 sctp_m_freem(cause); 11126 return; 11127 } 11128 } 11129 } else { 11130 padding_len = 0; 11131 } 11132 /* Get an mbuf for the header. */ 11133 len = sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 11134 switch (dst->sa_family) { 11135#ifdef INET 11136 case AF_INET: 11137 len += sizeof(struct ip); 11138 break; 11139#endif 11140#ifdef INET6 11141 case AF_INET6: 11142 len += sizeof(struct ip6_hdr); 11143 break; 11144#endif 11145 default: 11146 break; 11147 } 11148#if defined(INET) || defined(INET6) 11149 if (port) { 11150 len += sizeof(struct udphdr); 11151 } 11152#endif 11153 mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_NOWAIT, 1, MT_DATA); 11154 if (mout == NULL) { 11155 if (cause) { 11156 sctp_m_freem(cause); 11157 } 11158 return; 11159 } 11160 SCTP_BUF_RESV_UF(mout, max_linkhdr); 11161 SCTP_BUF_LEN(mout) = len; 11162 SCTP_BUF_NEXT(mout) = cause; 11163 M_SETFIB(mout, fibnum); 11164 mout->m_pkthdr.flowid = mflowid; 11165 M_HASHTYPE_SET(mout, mflowtype); 11166#ifdef INET 11167 ip = NULL; 11168#endif 11169#ifdef INET6 11170 ip6 = NULL; 11171#endif 11172 switch (dst->sa_family) { 11173#ifdef INET 11174 case AF_INET: 11175 src_sin = (struct sockaddr_in *)src; 11176 dst_sin = (struct sockaddr_in *)dst; 11177 ip = mtod(mout, struct ip *); 11178 ip->ip_v = IPVERSION; 11179 ip->ip_hl = (sizeof(struct ip) >> 2); 11180 ip->ip_tos = 0; 11181 ip->ip_off = htons(IP_DF); 11182 ip_fillid(ip); 11183 ip->ip_ttl = MODULE_GLOBAL(ip_defttl); 11184 if (port) { 11185 ip->ip_p = IPPROTO_UDP; 11186 } else { 11187 ip->ip_p = IPPROTO_SCTP; 11188 } 11189 ip->ip_src.s_addr = dst_sin->sin_addr.s_addr; 11190 ip->ip_dst.s_addr = src_sin->sin_addr.s_addr; 11191 ip->ip_sum = 0; 11192 len = sizeof(struct ip); 11193 shout = (struct sctphdr *)((caddr_t)ip + len); 11194 break; 11195#endif 11196#ifdef INET6 11197 case AF_INET6: 11198 src_sin6 = (struct sockaddr_in6 *)src; 11199 dst_sin6 = (struct sockaddr_in6 *)dst; 11200 ip6 = mtod(mout, struct ip6_hdr *); 11201 ip6->ip6_flow = htonl(0x60000000); 11202 if (V_ip6_auto_flowlabel) { 11203 ip6->ip6_flow |= (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK); 11204 } 11205 ip6->ip6_hlim = MODULE_GLOBAL(ip6_defhlim); 11206 if (port) { 11207 ip6->ip6_nxt = IPPROTO_UDP; 11208 } else { 11209 ip6->ip6_nxt = IPPROTO_SCTP; 11210 } 11211 ip6->ip6_src = dst_sin6->sin6_addr; 11212 ip6->ip6_dst = src_sin6->sin6_addr; 11213 len = sizeof(struct ip6_hdr); 11214 shout = (struct sctphdr *)((caddr_t)ip6 + len); 11215 break; 11216#endif 11217 default: 11218 len = 0; 11219 shout = mtod(mout, struct sctphdr *); 11220 break; 11221 } 11222#if defined(INET) || defined(INET6) 11223 if (port) { 11224 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 11225 sctp_m_freem(mout); 11226 return; 11227 } 11228 udp = (struct udphdr *)shout; 11229 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 11230 udp->uh_dport = port; 11231 udp->uh_sum = 0; 11232 udp->uh_ulen = htons((uint16_t)(sizeof(struct udphdr) + 11233 sizeof(struct sctphdr) + 11234 sizeof(struct sctp_chunkhdr) + 11235 cause_len + padding_len)); 11236 len += sizeof(struct udphdr); 11237 shout = (struct sctphdr *)((caddr_t)shout + sizeof(struct udphdr)); 11238 } else { 11239 udp = NULL; 11240 } 11241#endif 11242 shout->src_port = sh->dest_port; 11243 shout->dest_port = sh->src_port; 11244 shout->checksum = 0; 11245 if (vtag) { 11246 shout->v_tag = htonl(vtag); 11247 } else { 11248 shout->v_tag = sh->v_tag; 11249 } 11250 len += sizeof(struct sctphdr); 11251 ch = (struct sctp_chunkhdr *)((caddr_t)shout + sizeof(struct sctphdr)); 11252 ch->chunk_type = type; 11253 if (vtag) { 11254 ch->chunk_flags = 0; 11255 } else { 11256 ch->chunk_flags = SCTP_HAD_NO_TCB; 11257 } 11258 ch->chunk_length = htons((uint16_t)(sizeof(struct sctp_chunkhdr) + cause_len)); 11259 len += sizeof(struct sctp_chunkhdr); 11260 len += cause_len + padding_len; 11261 11262 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 11263 sctp_m_freem(mout); 11264 return; 11265 } 11266 SCTP_ATTACH_CHAIN(o_pak, mout, len); 11267 switch (dst->sa_family) { 11268#ifdef INET 11269 case AF_INET: 11270 if (port) { 11271 if (V_udp_cksum) { 11272 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 11273 } else { 11274 udp->uh_sum = 0; 11275 } 11276 } 11277 ip->ip_len = htons(len); 11278 if (port) { 11279 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip) + sizeof(struct udphdr)); 11280 SCTP_STAT_INCR(sctps_sendswcrc); 11281 if (V_udp_cksum) { 11282 SCTP_ENABLE_UDP_CSUM(o_pak); 11283 } 11284 } else { 11285 mout->m_pkthdr.csum_flags = CSUM_SCTP; 11286 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11287 SCTP_STAT_INCR(sctps_sendhwcrc); 11288 } 11289#ifdef SCTP_PACKET_LOGGING 11290 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11291 sctp_packet_log(o_pak); 11292 } 11293#endif 11294 SCTP_IP_OUTPUT(ret, o_pak, NULL, NULL, vrf_id); 11295 break; 11296#endif 11297#ifdef INET6 11298 case AF_INET6: 11299 ip6->ip6_plen = htons((uint16_t)(len - sizeof(struct ip6_hdr))); 11300 if (port) { 11301 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 11302 SCTP_STAT_INCR(sctps_sendswcrc); 11303 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), len - sizeof(struct ip6_hdr))) == 0) { 11304 udp->uh_sum = 0xffff; 11305 } 11306 } else { 11307 mout->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 11308 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11309 SCTP_STAT_INCR(sctps_sendhwcrc); 11310 } 11311#ifdef SCTP_PACKET_LOGGING 11312 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11313 sctp_packet_log(o_pak); 11314 } 11315#endif 11316 SCTP_IP6_OUTPUT(ret, o_pak, NULL, NULL, NULL, vrf_id); 11317 break; 11318#endif 11319 default: 11320 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 11321 dst->sa_family); 11322 sctp_m_freem(mout); 11323 SCTP_LTRACE_ERR_RET_PKT(mout, NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 11324 return; 11325 } 11326 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 11327 if (port) { 11328 UDPSTAT_INC(udps_opackets); 11329 } 11330 SCTP_STAT_INCR(sctps_sendpackets); 11331 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 11332 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11333 if (ret) { 11334 SCTP_STAT_INCR(sctps_senderrors); 11335 } 11336 return; 11337} 11338 11339void 11340sctp_send_shutdown_complete2(struct sockaddr *src, struct sockaddr *dst, 11341 struct sctphdr *sh, 11342 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11343 uint32_t vrf_id, uint16_t port) 11344{ 11345 sctp_send_resp_msg(src, dst, sh, 0, SCTP_SHUTDOWN_COMPLETE, NULL, 11346 mflowtype, mflowid, fibnum, 11347 vrf_id, port); 11348} 11349 11350void 11351sctp_send_hb(struct sctp_tcb *stcb, struct sctp_nets *net, int so_locked 11352#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 11353 SCTP_UNUSED 11354#endif 11355) 11356{ 11357 struct sctp_tmit_chunk *chk; 11358 struct sctp_heartbeat_chunk *hb; 11359 struct timeval now; 11360 11361 SCTP_TCB_LOCK_ASSERT(stcb); 11362 if (net == NULL) { 11363 return; 11364 } 11365 (void)SCTP_GETTIME_TIMEVAL(&now); 11366 switch (net->ro._l_addr.sa.sa_family) { 11367#ifdef INET 11368 case AF_INET: 11369 break; 11370#endif 11371#ifdef INET6 11372 case AF_INET6: 11373 break; 11374#endif 11375 default: 11376 return; 11377 } 11378 sctp_alloc_a_chunk(stcb, chk); 11379 if (chk == NULL) { 11380 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak, can't get a chunk for hb\n"); 11381 return; 11382 } 11383 11384 chk->copy_by_ref = 0; 11385 chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST; 11386 chk->rec.chunk_id.can_take_data = 1; 11387 chk->flags = 0; 11388 chk->asoc = &stcb->asoc; 11389 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 11390 11391 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11392 if (chk->data == NULL) { 11393 sctp_free_a_chunk(stcb, chk, so_locked); 11394 return; 11395 } 11396 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11397 SCTP_BUF_LEN(chk->data) = chk->send_size; 11398 chk->sent = SCTP_DATAGRAM_UNSENT; 11399 chk->snd_count = 0; 11400 chk->whoTo = net; 11401 atomic_add_int(&chk->whoTo->ref_count, 1); 11402 /* Now we have a mbuf that we can fill in with the details */ 11403 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 11404 memset(hb, 0, sizeof(struct sctp_heartbeat_chunk)); 11405 /* fill out chunk header */ 11406 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 11407 hb->ch.chunk_flags = 0; 11408 hb->ch.chunk_length = htons(chk->send_size); 11409 /* Fill out hb parameter */ 11410 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 11411 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 11412 hb->heartbeat.hb_info.time_value_1 = now.tv_sec; 11413 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 11414 /* Did our user request this one, put it in */ 11415 hb->heartbeat.hb_info.addr_family = (uint8_t)net->ro._l_addr.sa.sa_family; 11416 hb->heartbeat.hb_info.addr_len = net->ro._l_addr.sa.sa_len; 11417 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 11418 /* 11419 * we only take from the entropy pool if the address is not 11420 * confirmed. 11421 */ 11422 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11423 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11424 } else { 11425 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 11426 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 11427 } 11428 switch (net->ro._l_addr.sa.sa_family) { 11429#ifdef INET 11430 case AF_INET: 11431 memcpy(hb->heartbeat.hb_info.address, 11432 &net->ro._l_addr.sin.sin_addr, 11433 sizeof(net->ro._l_addr.sin.sin_addr)); 11434 break; 11435#endif 11436#ifdef INET6 11437 case AF_INET6: 11438 memcpy(hb->heartbeat.hb_info.address, 11439 &net->ro._l_addr.sin6.sin6_addr, 11440 sizeof(net->ro._l_addr.sin6.sin6_addr)); 11441 break; 11442#endif 11443 default: 11444 if (chk->data) { 11445 sctp_m_freem(chk->data); 11446 chk->data = NULL; 11447 } 11448 sctp_free_a_chunk(stcb, chk, so_locked); 11449 return; 11450 break; 11451 } 11452 net->hb_responded = 0; 11453 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11454 stcb->asoc.ctrl_queue_cnt++; 11455 SCTP_STAT_INCR(sctps_sendheartbeat); 11456 return; 11457} 11458 11459void 11460sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 11461 uint32_t high_tsn) 11462{ 11463 struct sctp_association *asoc; 11464 struct sctp_ecne_chunk *ecne; 11465 struct sctp_tmit_chunk *chk; 11466 11467 if (net == NULL) { 11468 return; 11469 } 11470 asoc = &stcb->asoc; 11471 SCTP_TCB_LOCK_ASSERT(stcb); 11472 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11473 if ((chk->rec.chunk_id.id == SCTP_ECN_ECHO) && (net == chk->whoTo)) { 11474 /* found a previous ECN_ECHO update it if needed */ 11475 uint32_t cnt, ctsn; 11476 11477 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11478 ctsn = ntohl(ecne->tsn); 11479 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11480 ecne->tsn = htonl(high_tsn); 11481 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11482 } 11483 cnt = ntohl(ecne->num_pkts_since_cwr); 11484 cnt++; 11485 ecne->num_pkts_since_cwr = htonl(cnt); 11486 return; 11487 } 11488 } 11489 /* nope could not find one to update so we must build one */ 11490 sctp_alloc_a_chunk(stcb, chk); 11491 if (chk == NULL) { 11492 return; 11493 } 11494 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11495 chk->copy_by_ref = 0; 11496 chk->rec.chunk_id.id = SCTP_ECN_ECHO; 11497 chk->rec.chunk_id.can_take_data = 0; 11498 chk->flags = 0; 11499 chk->asoc = &stcb->asoc; 11500 chk->send_size = sizeof(struct sctp_ecne_chunk); 11501 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11502 if (chk->data == NULL) { 11503 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11504 return; 11505 } 11506 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11507 SCTP_BUF_LEN(chk->data) = chk->send_size; 11508 chk->sent = SCTP_DATAGRAM_UNSENT; 11509 chk->snd_count = 0; 11510 chk->whoTo = net; 11511 atomic_add_int(&chk->whoTo->ref_count, 1); 11512 11513 stcb->asoc.ecn_echo_cnt_onq++; 11514 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11515 ecne->ch.chunk_type = SCTP_ECN_ECHO; 11516 ecne->ch.chunk_flags = 0; 11517 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 11518 ecne->tsn = htonl(high_tsn); 11519 ecne->num_pkts_since_cwr = htonl(1); 11520 TAILQ_INSERT_HEAD(&stcb->asoc.control_send_queue, chk, sctp_next); 11521 asoc->ctrl_queue_cnt++; 11522} 11523 11524void 11525sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 11526 struct mbuf *m, int len, int iphlen, int bad_crc) 11527{ 11528 struct sctp_association *asoc; 11529 struct sctp_pktdrop_chunk *drp; 11530 struct sctp_tmit_chunk *chk; 11531 uint8_t *datap; 11532 int was_trunc = 0; 11533 int fullsz = 0; 11534 long spc; 11535 int offset; 11536 struct sctp_chunkhdr *ch, chunk_buf; 11537 unsigned int chk_length; 11538 11539 if (!stcb) { 11540 return; 11541 } 11542 asoc = &stcb->asoc; 11543 SCTP_TCB_LOCK_ASSERT(stcb); 11544 if (asoc->pktdrop_supported == 0) { 11545 /*- 11546 * peer must declare support before I send one. 11547 */ 11548 return; 11549 } 11550 if (stcb->sctp_socket == NULL) { 11551 return; 11552 } 11553 sctp_alloc_a_chunk(stcb, chk); 11554 if (chk == NULL) { 11555 return; 11556 } 11557 chk->copy_by_ref = 0; 11558 chk->rec.chunk_id.id = SCTP_PACKET_DROPPED; 11559 chk->rec.chunk_id.can_take_data = 1; 11560 chk->flags = 0; 11561 len -= iphlen; 11562 chk->send_size = len; 11563 /* Validate that we do not have an ABORT in here. */ 11564 offset = iphlen + sizeof(struct sctphdr); 11565 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11566 sizeof(*ch), (uint8_t *)&chunk_buf); 11567 while (ch != NULL) { 11568 chk_length = ntohs(ch->chunk_length); 11569 if (chk_length < sizeof(*ch)) { 11570 /* break to abort land */ 11571 break; 11572 } 11573 switch (ch->chunk_type) { 11574 case SCTP_PACKET_DROPPED: 11575 case SCTP_ABORT_ASSOCIATION: 11576 case SCTP_INITIATION_ACK: 11577 /** 11578 * We don't respond with an PKT-DROP to an ABORT 11579 * or PKT-DROP. We also do not respond to an 11580 * INIT-ACK, because we can't know if the initiation 11581 * tag is correct or not. 11582 */ 11583 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11584 return; 11585 default: 11586 break; 11587 } 11588 offset += SCTP_SIZE32(chk_length); 11589 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11590 sizeof(*ch), (uint8_t *)&chunk_buf); 11591 } 11592 11593 if ((len + SCTP_MAX_OVERHEAD + sizeof(struct sctp_pktdrop_chunk)) > 11594 min(stcb->asoc.smallest_mtu, MCLBYTES)) { 11595 /* 11596 * only send 1 mtu worth, trim off the excess on the end. 11597 */ 11598 fullsz = len; 11599 len = min(stcb->asoc.smallest_mtu, MCLBYTES) - SCTP_MAX_OVERHEAD; 11600 was_trunc = 1; 11601 } 11602 chk->asoc = &stcb->asoc; 11603 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11604 if (chk->data == NULL) { 11605jump_out: 11606 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11607 return; 11608 } 11609 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11610 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 11611 if (drp == NULL) { 11612 sctp_m_freem(chk->data); 11613 chk->data = NULL; 11614 goto jump_out; 11615 } 11616 chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 11617 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD)); 11618 chk->book_size_scale = 0; 11619 if (was_trunc) { 11620 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 11621 drp->trunc_len = htons(fullsz); 11622 /* 11623 * Len is already adjusted to size minus overhead above take 11624 * out the pkt_drop chunk itself from it. 11625 */ 11626 chk->send_size = (uint16_t)(len - sizeof(struct sctp_pktdrop_chunk)); 11627 len = chk->send_size; 11628 } else { 11629 /* no truncation needed */ 11630 drp->ch.chunk_flags = 0; 11631 drp->trunc_len = htons(0); 11632 } 11633 if (bad_crc) { 11634 drp->ch.chunk_flags |= SCTP_BADCRC; 11635 } 11636 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 11637 SCTP_BUF_LEN(chk->data) = chk->send_size; 11638 chk->sent = SCTP_DATAGRAM_UNSENT; 11639 chk->snd_count = 0; 11640 if (net) { 11641 /* we should hit here */ 11642 chk->whoTo = net; 11643 atomic_add_int(&chk->whoTo->ref_count, 1); 11644 } else { 11645 chk->whoTo = NULL; 11646 } 11647 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 11648 drp->ch.chunk_length = htons(chk->send_size); 11649 spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket); 11650 if (spc < 0) { 11651 spc = 0; 11652 } 11653 drp->bottle_bw = htonl(spc); 11654 if (asoc->my_rwnd) { 11655 drp->current_onq = htonl(asoc->size_on_reasm_queue + 11656 asoc->size_on_all_streams + 11657 asoc->my_rwnd_control_len + 11658 stcb->sctp_socket->so_rcv.sb_cc); 11659 } else { 11660 /*- 11661 * If my rwnd is 0, possibly from mbuf depletion as well as 11662 * space used, tell the peer there is NO space aka onq == bw 11663 */ 11664 drp->current_onq = htonl(spc); 11665 } 11666 drp->reserved = 0; 11667 datap = drp->data; 11668 m_copydata(m, iphlen, len, (caddr_t)datap); 11669 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11670 asoc->ctrl_queue_cnt++; 11671} 11672 11673void 11674sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn, uint8_t override) 11675{ 11676 struct sctp_association *asoc; 11677 struct sctp_cwr_chunk *cwr; 11678 struct sctp_tmit_chunk *chk; 11679 11680 SCTP_TCB_LOCK_ASSERT(stcb); 11681 if (net == NULL) { 11682 return; 11683 } 11684 asoc = &stcb->asoc; 11685 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11686 if ((chk->rec.chunk_id.id == SCTP_ECN_CWR) && (net == chk->whoTo)) { 11687 /* 11688 * found a previous CWR queued to same destination 11689 * update it if needed 11690 */ 11691 uint32_t ctsn; 11692 11693 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11694 ctsn = ntohl(cwr->tsn); 11695 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11696 cwr->tsn = htonl(high_tsn); 11697 } 11698 if (override & SCTP_CWR_REDUCE_OVERRIDE) { 11699 /* Make sure override is carried */ 11700 cwr->ch.chunk_flags |= SCTP_CWR_REDUCE_OVERRIDE; 11701 } 11702 return; 11703 } 11704 } 11705 sctp_alloc_a_chunk(stcb, chk); 11706 if (chk == NULL) { 11707 return; 11708 } 11709 chk->copy_by_ref = 0; 11710 chk->rec.chunk_id.id = SCTP_ECN_CWR; 11711 chk->rec.chunk_id.can_take_data = 1; 11712 chk->flags = 0; 11713 chk->asoc = &stcb->asoc; 11714 chk->send_size = sizeof(struct sctp_cwr_chunk); 11715 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11716 if (chk->data == NULL) { 11717 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11718 return; 11719 } 11720 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11721 SCTP_BUF_LEN(chk->data) = chk->send_size; 11722 chk->sent = SCTP_DATAGRAM_UNSENT; 11723 chk->snd_count = 0; 11724 chk->whoTo = net; 11725 atomic_add_int(&chk->whoTo->ref_count, 1); 11726 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11727 cwr->ch.chunk_type = SCTP_ECN_CWR; 11728 cwr->ch.chunk_flags = override; 11729 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 11730 cwr->tsn = htonl(high_tsn); 11731 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11732 asoc->ctrl_queue_cnt++; 11733} 11734 11735static int 11736sctp_add_stream_reset_out(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk, 11737 uint32_t seq, uint32_t resp_seq, uint32_t last_sent) 11738{ 11739 uint16_t len, old_len, i; 11740 struct sctp_stream_reset_out_request *req_out; 11741 struct sctp_chunkhdr *ch; 11742 int at; 11743 int number_entries = 0; 11744 11745 ch = mtod(chk->data, struct sctp_chunkhdr *); 11746 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11747 /* get to new offset for the param. */ 11748 req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len); 11749 /* now how long will this param be? */ 11750 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11751 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11752 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11753 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11754 number_entries++; 11755 } 11756 } 11757 if (number_entries == 0) { 11758 return (0); 11759 } 11760 if (number_entries == stcb->asoc.streamoutcnt) { 11761 number_entries = 0; 11762 } 11763 if (number_entries > SCTP_MAX_STREAMS_AT_ONCE_RESET) { 11764 number_entries = SCTP_MAX_STREAMS_AT_ONCE_RESET; 11765 } 11766 len = (uint16_t)(sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries)); 11767 req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST); 11768 req_out->ph.param_length = htons(len); 11769 req_out->request_seq = htonl(seq); 11770 req_out->response_seq = htonl(resp_seq); 11771 req_out->send_reset_at_tsn = htonl(last_sent); 11772 at = 0; 11773 if (number_entries) { 11774 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11775 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11776 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11777 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11778 req_out->list_of_streams[at] = htons(i); 11779 at++; 11780 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11781 if (at >= number_entries) { 11782 break; 11783 } 11784 } 11785 } 11786 } else { 11787 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11788 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11789 } 11790 } 11791 if (SCTP_SIZE32(len) > len) { 11792 /*- 11793 * Need to worry about the pad we may end up adding to the 11794 * end. This is easy since the struct is either aligned to 4 11795 * bytes or 2 bytes off. 11796 */ 11797 req_out->list_of_streams[number_entries] = 0; 11798 } 11799 /* now fix the chunk length */ 11800 ch->chunk_length = htons(len + old_len); 11801 chk->book_size = len + old_len; 11802 chk->book_size_scale = 0; 11803 chk->send_size = SCTP_SIZE32(chk->book_size); 11804 SCTP_BUF_LEN(chk->data) = chk->send_size; 11805 return (1); 11806} 11807 11808static void 11809sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk, 11810 int number_entries, uint16_t *list, 11811 uint32_t seq) 11812{ 11813 uint16_t len, old_len, i; 11814 struct sctp_stream_reset_in_request *req_in; 11815 struct sctp_chunkhdr *ch; 11816 11817 ch = mtod(chk->data, struct sctp_chunkhdr *); 11818 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11819 11820 /* get to new offset for the param. */ 11821 req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len); 11822 /* now how long will this param be? */ 11823 len = (uint16_t)(sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries)); 11824 req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST); 11825 req_in->ph.param_length = htons(len); 11826 req_in->request_seq = htonl(seq); 11827 if (number_entries) { 11828 for (i = 0; i < number_entries; i++) { 11829 req_in->list_of_streams[i] = htons(list[i]); 11830 } 11831 } 11832 if (SCTP_SIZE32(len) > len) { 11833 /*- 11834 * Need to worry about the pad we may end up adding to the 11835 * end. This is easy since the struct is either aligned to 4 11836 * bytes or 2 bytes off. 11837 */ 11838 req_in->list_of_streams[number_entries] = 0; 11839 } 11840 /* now fix the chunk length */ 11841 ch->chunk_length = htons(len + old_len); 11842 chk->book_size = len + old_len; 11843 chk->book_size_scale = 0; 11844 chk->send_size = SCTP_SIZE32(chk->book_size); 11845 SCTP_BUF_LEN(chk->data) = chk->send_size; 11846 return; 11847} 11848 11849static void 11850sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk, 11851 uint32_t seq) 11852{ 11853 uint16_t len, old_len; 11854 struct sctp_stream_reset_tsn_request *req_tsn; 11855 struct sctp_chunkhdr *ch; 11856 11857 ch = mtod(chk->data, struct sctp_chunkhdr *); 11858 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11859 11860 /* get to new offset for the param. */ 11861 req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len); 11862 /* now how long will this param be? */ 11863 len = sizeof(struct sctp_stream_reset_tsn_request); 11864 req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST); 11865 req_tsn->ph.param_length = htons(len); 11866 req_tsn->request_seq = htonl(seq); 11867 11868 /* now fix the chunk length */ 11869 ch->chunk_length = htons(len + old_len); 11870 chk->send_size = len + old_len; 11871 chk->book_size = SCTP_SIZE32(chk->send_size); 11872 chk->book_size_scale = 0; 11873 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11874 return; 11875} 11876 11877void 11878sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk, 11879 uint32_t resp_seq, uint32_t result) 11880{ 11881 uint16_t len, old_len; 11882 struct sctp_stream_reset_response *resp; 11883 struct sctp_chunkhdr *ch; 11884 11885 ch = mtod(chk->data, struct sctp_chunkhdr *); 11886 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11887 11888 /* get to new offset for the param. */ 11889 resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len); 11890 /* now how long will this param be? */ 11891 len = sizeof(struct sctp_stream_reset_response); 11892 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11893 resp->ph.param_length = htons(len); 11894 resp->response_seq = htonl(resp_seq); 11895 resp->result = ntohl(result); 11896 11897 /* now fix the chunk length */ 11898 ch->chunk_length = htons(len + old_len); 11899 chk->book_size = len + old_len; 11900 chk->book_size_scale = 0; 11901 chk->send_size = SCTP_SIZE32(chk->book_size); 11902 SCTP_BUF_LEN(chk->data) = chk->send_size; 11903 return; 11904} 11905 11906void 11907sctp_send_deferred_reset_response(struct sctp_tcb *stcb, 11908 struct sctp_stream_reset_list *ent, 11909 int response) 11910{ 11911 struct sctp_association *asoc; 11912 struct sctp_tmit_chunk *chk; 11913 struct sctp_chunkhdr *ch; 11914 11915 asoc = &stcb->asoc; 11916 11917 /* 11918 * Reset our last reset action to the new one IP -> response 11919 * (PERFORMED probably). This assures that if we fail to send, a 11920 * retran from the peer will get the new response. 11921 */ 11922 asoc->last_reset_action[0] = response; 11923 if (asoc->stream_reset_outstanding) { 11924 return; 11925 } 11926 sctp_alloc_a_chunk(stcb, chk); 11927 if (chk == NULL) { 11928 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11929 return; 11930 } 11931 chk->copy_by_ref = 0; 11932 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 11933 chk->rec.chunk_id.can_take_data = 0; 11934 chk->flags = 0; 11935 chk->asoc = &stcb->asoc; 11936 chk->book_size = sizeof(struct sctp_chunkhdr); 11937 chk->send_size = SCTP_SIZE32(chk->book_size); 11938 chk->book_size_scale = 0; 11939 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11940 if (chk->data == NULL) { 11941 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 11942 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11943 return; 11944 } 11945 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11946 /* setup chunk parameters */ 11947 chk->sent = SCTP_DATAGRAM_UNSENT; 11948 chk->snd_count = 0; 11949 if (stcb->asoc.alternate) { 11950 chk->whoTo = stcb->asoc.alternate; 11951 } else { 11952 chk->whoTo = stcb->asoc.primary_destination; 11953 } 11954 ch = mtod(chk->data, struct sctp_chunkhdr *); 11955 ch->chunk_type = SCTP_STREAM_RESET; 11956 ch->chunk_flags = 0; 11957 ch->chunk_length = htons(chk->book_size); 11958 atomic_add_int(&chk->whoTo->ref_count, 1); 11959 SCTP_BUF_LEN(chk->data) = chk->send_size; 11960 sctp_add_stream_reset_result(chk, ent->seq, response); 11961 /* insert the chunk for sending */ 11962 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 11963 chk, 11964 sctp_next); 11965 asoc->ctrl_queue_cnt++; 11966} 11967 11968void 11969sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk, 11970 uint32_t resp_seq, uint32_t result, 11971 uint32_t send_una, uint32_t recv_next) 11972{ 11973 uint16_t len, old_len; 11974 struct sctp_stream_reset_response_tsn *resp; 11975 struct sctp_chunkhdr *ch; 11976 11977 ch = mtod(chk->data, struct sctp_chunkhdr *); 11978 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11979 11980 /* get to new offset for the param. */ 11981 resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len); 11982 /* now how long will this param be? */ 11983 len = sizeof(struct sctp_stream_reset_response_tsn); 11984 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11985 resp->ph.param_length = htons(len); 11986 resp->response_seq = htonl(resp_seq); 11987 resp->result = htonl(result); 11988 resp->senders_next_tsn = htonl(send_una); 11989 resp->receivers_next_tsn = htonl(recv_next); 11990 11991 /* now fix the chunk length */ 11992 ch->chunk_length = htons(len + old_len); 11993 chk->book_size = len + old_len; 11994 chk->send_size = SCTP_SIZE32(chk->book_size); 11995 chk->book_size_scale = 0; 11996 SCTP_BUF_LEN(chk->data) = chk->send_size; 11997 return; 11998} 11999 12000static void 12001sctp_add_an_out_stream(struct sctp_tmit_chunk *chk, 12002 uint32_t seq, 12003 uint16_t adding) 12004{ 12005 uint16_t len, old_len; 12006 struct sctp_chunkhdr *ch; 12007 struct sctp_stream_reset_add_strm *addstr; 12008 12009 ch = mtod(chk->data, struct sctp_chunkhdr *); 12010 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 12011 12012 /* get to new offset for the param. */ 12013 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 12014 /* now how long will this param be? */ 12015 len = sizeof(struct sctp_stream_reset_add_strm); 12016 12017 /* Fill it out. */ 12018 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_OUT_STREAMS); 12019 addstr->ph.param_length = htons(len); 12020 addstr->request_seq = htonl(seq); 12021 addstr->number_of_streams = htons(adding); 12022 addstr->reserved = 0; 12023 12024 /* now fix the chunk length */ 12025 ch->chunk_length = htons(len + old_len); 12026 chk->send_size = len + old_len; 12027 chk->book_size = SCTP_SIZE32(chk->send_size); 12028 chk->book_size_scale = 0; 12029 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 12030 return; 12031} 12032 12033static void 12034sctp_add_an_in_stream(struct sctp_tmit_chunk *chk, 12035 uint32_t seq, 12036 uint16_t adding) 12037{ 12038 uint16_t len, old_len; 12039 struct sctp_chunkhdr *ch; 12040 struct sctp_stream_reset_add_strm *addstr; 12041 12042 ch = mtod(chk->data, struct sctp_chunkhdr *); 12043 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 12044 12045 /* get to new offset for the param. */ 12046 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 12047 /* now how long will this param be? */ 12048 len = sizeof(struct sctp_stream_reset_add_strm); 12049 /* Fill it out. */ 12050 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_IN_STREAMS); 12051 addstr->ph.param_length = htons(len); 12052 addstr->request_seq = htonl(seq); 12053 addstr->number_of_streams = htons(adding); 12054 addstr->reserved = 0; 12055 12056 /* now fix the chunk length */ 12057 ch->chunk_length = htons(len + old_len); 12058 chk->send_size = len + old_len; 12059 chk->book_size = SCTP_SIZE32(chk->send_size); 12060 chk->book_size_scale = 0; 12061 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 12062 return; 12063} 12064 12065int 12066sctp_send_stream_reset_out_if_possible(struct sctp_tcb *stcb, int so_locked) 12067{ 12068 struct sctp_association *asoc; 12069 struct sctp_tmit_chunk *chk; 12070 struct sctp_chunkhdr *ch; 12071 uint32_t seq; 12072 12073 asoc = &stcb->asoc; 12074 asoc->trigger_reset = 0; 12075 if (asoc->stream_reset_outstanding) { 12076 return (EALREADY); 12077 } 12078 sctp_alloc_a_chunk(stcb, chk); 12079 if (chk == NULL) { 12080 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12081 return (ENOMEM); 12082 } 12083 chk->copy_by_ref = 0; 12084 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12085 chk->rec.chunk_id.can_take_data = 0; 12086 chk->flags = 0; 12087 chk->asoc = &stcb->asoc; 12088 chk->book_size = sizeof(struct sctp_chunkhdr); 12089 chk->send_size = SCTP_SIZE32(chk->book_size); 12090 chk->book_size_scale = 0; 12091 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12092 if (chk->data == NULL) { 12093 sctp_free_a_chunk(stcb, chk, so_locked); 12094 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12095 return (ENOMEM); 12096 } 12097 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12098 12099 /* setup chunk parameters */ 12100 chk->sent = SCTP_DATAGRAM_UNSENT; 12101 chk->snd_count = 0; 12102 if (stcb->asoc.alternate) { 12103 chk->whoTo = stcb->asoc.alternate; 12104 } else { 12105 chk->whoTo = stcb->asoc.primary_destination; 12106 } 12107 ch = mtod(chk->data, struct sctp_chunkhdr *); 12108 ch->chunk_type = SCTP_STREAM_RESET; 12109 ch->chunk_flags = 0; 12110 ch->chunk_length = htons(chk->book_size); 12111 atomic_add_int(&chk->whoTo->ref_count, 1); 12112 SCTP_BUF_LEN(chk->data) = chk->send_size; 12113 seq = stcb->asoc.str_reset_seq_out; 12114 if (sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1))) { 12115 seq++; 12116 asoc->stream_reset_outstanding++; 12117 } else { 12118 m_freem(chk->data); 12119 chk->data = NULL; 12120 sctp_free_a_chunk(stcb, chk, so_locked); 12121 return (ENOENT); 12122 } 12123 asoc->str_reset = chk; 12124 /* insert the chunk for sending */ 12125 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12126 chk, 12127 sctp_next); 12128 asoc->ctrl_queue_cnt++; 12129 12130 if (stcb->asoc.send_sack) { 12131 sctp_send_sack(stcb, so_locked); 12132 } 12133 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12134 return (0); 12135} 12136 12137int 12138sctp_send_str_reset_req(struct sctp_tcb *stcb, 12139 uint16_t number_entries, uint16_t *list, 12140 uint8_t send_in_req, 12141 uint8_t send_tsn_req, 12142 uint8_t add_stream, 12143 uint16_t adding_o, 12144 uint16_t adding_i, uint8_t peer_asked) 12145{ 12146 struct sctp_association *asoc; 12147 struct sctp_tmit_chunk *chk; 12148 struct sctp_chunkhdr *ch; 12149 int can_send_out_req = 0; 12150 uint32_t seq; 12151 12152 asoc = &stcb->asoc; 12153 if (asoc->stream_reset_outstanding) { 12154 /*- 12155 * Already one pending, must get ACK back to clear the flag. 12156 */ 12157 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EBUSY); 12158 return (EBUSY); 12159 } 12160 if ((send_in_req == 0) && (send_tsn_req == 0) && 12161 (add_stream == 0)) { 12162 /* nothing to do */ 12163 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12164 return (EINVAL); 12165 } 12166 if (send_tsn_req && send_in_req) { 12167 /* error, can't do that */ 12168 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12169 return (EINVAL); 12170 } else if (send_in_req) { 12171 can_send_out_req = 1; 12172 } 12173 if (number_entries > (MCLBYTES - 12174 SCTP_MIN_OVERHEAD - 12175 sizeof(struct sctp_chunkhdr) - 12176 sizeof(struct sctp_stream_reset_out_request)) / 12177 sizeof(uint16_t)) { 12178 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12179 return (ENOMEM); 12180 } 12181 sctp_alloc_a_chunk(stcb, chk); 12182 if (chk == NULL) { 12183 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12184 return (ENOMEM); 12185 } 12186 chk->copy_by_ref = 0; 12187 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12188 chk->rec.chunk_id.can_take_data = 0; 12189 chk->flags = 0; 12190 chk->asoc = &stcb->asoc; 12191 chk->book_size = sizeof(struct sctp_chunkhdr); 12192 chk->send_size = SCTP_SIZE32(chk->book_size); 12193 chk->book_size_scale = 0; 12194 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12195 if (chk->data == NULL) { 12196 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 12197 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12198 return (ENOMEM); 12199 } 12200 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12201 12202 /* setup chunk parameters */ 12203 chk->sent = SCTP_DATAGRAM_UNSENT; 12204 chk->snd_count = 0; 12205 if (stcb->asoc.alternate) { 12206 chk->whoTo = stcb->asoc.alternate; 12207 } else { 12208 chk->whoTo = stcb->asoc.primary_destination; 12209 } 12210 atomic_add_int(&chk->whoTo->ref_count, 1); 12211 ch = mtod(chk->data, struct sctp_chunkhdr *); 12212 ch->chunk_type = SCTP_STREAM_RESET; 12213 ch->chunk_flags = 0; 12214 ch->chunk_length = htons(chk->book_size); 12215 SCTP_BUF_LEN(chk->data) = chk->send_size; 12216 12217 seq = stcb->asoc.str_reset_seq_out; 12218 if (can_send_out_req) { 12219 int ret; 12220 12221 ret = sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1)); 12222 if (ret) { 12223 seq++; 12224 asoc->stream_reset_outstanding++; 12225 } 12226 } 12227 if ((add_stream & 1) && 12228 ((stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt) < adding_o)) { 12229 /* Need to allocate more */ 12230 struct sctp_stream_out *oldstream; 12231 struct sctp_stream_queue_pending *sp, *nsp; 12232 int i; 12233#if defined(SCTP_DETAILED_STR_STATS) 12234 int j; 12235#endif 12236 12237 oldstream = stcb->asoc.strmout; 12238 /* get some more */ 12239 SCTP_MALLOC(stcb->asoc.strmout, struct sctp_stream_out *, 12240 (stcb->asoc.streamoutcnt + adding_o) * sizeof(struct sctp_stream_out), 12241 SCTP_M_STRMO); 12242 if (stcb->asoc.strmout == NULL) { 12243 uint8_t x; 12244 12245 stcb->asoc.strmout = oldstream; 12246 /* Turn off the bit */ 12247 x = add_stream & 0xfe; 12248 add_stream = x; 12249 goto skip_stuff; 12250 } 12251 /* 12252 * Ok now we proceed with copying the old out stuff and 12253 * initializing the new stuff. 12254 */ 12255 SCTP_TCB_SEND_LOCK(stcb); 12256 stcb->asoc.ss_functions.sctp_ss_clear(stcb, &stcb->asoc, 0, 1); 12257 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 12258 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12259 stcb->asoc.strmout[i].chunks_on_queues = oldstream[i].chunks_on_queues; 12260 stcb->asoc.strmout[i].next_mid_ordered = oldstream[i].next_mid_ordered; 12261 stcb->asoc.strmout[i].next_mid_unordered = oldstream[i].next_mid_unordered; 12262 stcb->asoc.strmout[i].last_msg_incomplete = oldstream[i].last_msg_incomplete; 12263 stcb->asoc.strmout[i].sid = i; 12264 stcb->asoc.strmout[i].state = oldstream[i].state; 12265 /* FIX ME FIX ME */ 12266 /* 12267 * This should be a SS_COPY operation FIX ME STREAM 12268 * SCHEDULER EXPERT 12269 */ 12270 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], &oldstream[i]); 12271 /* now anything on those queues? */ 12272 TAILQ_FOREACH_SAFE(sp, &oldstream[i].outqueue, next, nsp) { 12273 TAILQ_REMOVE(&oldstream[i].outqueue, sp, next); 12274 TAILQ_INSERT_TAIL(&stcb->asoc.strmout[i].outqueue, sp, next); 12275 } 12276 12277 } 12278 /* now the new streams */ 12279 stcb->asoc.ss_functions.sctp_ss_init(stcb, &stcb->asoc, 1); 12280 for (i = stcb->asoc.streamoutcnt; i < (stcb->asoc.streamoutcnt + adding_o); i++) { 12281 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12282 stcb->asoc.strmout[i].chunks_on_queues = 0; 12283#if defined(SCTP_DETAILED_STR_STATS) 12284 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 12285 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 12286 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 12287 } 12288#else 12289 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 12290 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 12291#endif 12292 stcb->asoc.strmout[i].next_mid_ordered = 0; 12293 stcb->asoc.strmout[i].next_mid_unordered = 0; 12294 stcb->asoc.strmout[i].sid = i; 12295 stcb->asoc.strmout[i].last_msg_incomplete = 0; 12296 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 12297 stcb->asoc.strmout[i].state = SCTP_STREAM_CLOSED; 12298 } 12299 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt + adding_o; 12300 SCTP_FREE(oldstream, SCTP_M_STRMO); 12301 SCTP_TCB_SEND_UNLOCK(stcb); 12302 } 12303skip_stuff: 12304 if ((add_stream & 1) && (adding_o > 0)) { 12305 asoc->strm_pending_add_size = adding_o; 12306 asoc->peer_req_out = peer_asked; 12307 sctp_add_an_out_stream(chk, seq, adding_o); 12308 seq++; 12309 asoc->stream_reset_outstanding++; 12310 } 12311 if ((add_stream & 2) && (adding_i > 0)) { 12312 sctp_add_an_in_stream(chk, seq, adding_i); 12313 seq++; 12314 asoc->stream_reset_outstanding++; 12315 } 12316 if (send_in_req) { 12317 sctp_add_stream_reset_in(chk, number_entries, list, seq); 12318 seq++; 12319 asoc->stream_reset_outstanding++; 12320 } 12321 if (send_tsn_req) { 12322 sctp_add_stream_reset_tsn(chk, seq); 12323 asoc->stream_reset_outstanding++; 12324 } 12325 asoc->str_reset = chk; 12326 /* insert the chunk for sending */ 12327 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12328 chk, 12329 sctp_next); 12330 asoc->ctrl_queue_cnt++; 12331 if (stcb->asoc.send_sack) { 12332 sctp_send_sack(stcb, SCTP_SO_LOCKED); 12333 } 12334 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12335 return (0); 12336} 12337 12338void 12339sctp_send_abort(struct mbuf *m, int iphlen, struct sockaddr *src, struct sockaddr *dst, 12340 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12341 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12342 uint32_t vrf_id, uint16_t port) 12343{ 12344 /* Don't respond to an ABORT with an ABORT. */ 12345 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 12346 if (cause) 12347 sctp_m_freem(cause); 12348 return; 12349 } 12350 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_ABORT_ASSOCIATION, cause, 12351 mflowtype, mflowid, fibnum, 12352 vrf_id, port); 12353 return; 12354} 12355 12356void 12357sctp_send_operr_to(struct sockaddr *src, struct sockaddr *dst, 12358 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12359 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12360 uint32_t vrf_id, uint16_t port) 12361{ 12362 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_OPERATION_ERROR, cause, 12363 mflowtype, mflowid, fibnum, 12364 vrf_id, port); 12365 return; 12366} 12367 12368static struct mbuf * 12369sctp_copy_resume(struct uio *uio, 12370 int max_send_len, 12371 int user_marks_eor, 12372 int *error, 12373 uint32_t *sndout, 12374 struct mbuf **new_tail) 12375{ 12376 struct mbuf *m; 12377 12378 m = m_uiotombuf(uio, M_WAITOK, max_send_len, 0, 12379 (M_PKTHDR | (user_marks_eor ? M_EOR : 0))); 12380 if (m == NULL) { 12381 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12382 *error = ENOBUFS; 12383 } else { 12384 *sndout = m_length(m, NULL); 12385 *new_tail = m_last(m); 12386 } 12387 return (m); 12388} 12389 12390static int 12391sctp_copy_one(struct sctp_stream_queue_pending *sp, 12392 struct uio *uio, 12393 int resv_upfront) 12394{ 12395 sp->data = m_uiotombuf(uio, M_WAITOK, sp->length, 12396 resv_upfront, 0); 12397 if (sp->data == NULL) { 12398 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12399 return (ENOBUFS); 12400 } 12401 12402 sp->tail_mbuf = m_last(sp->data); 12403 return (0); 12404} 12405 12406 12407 12408static struct sctp_stream_queue_pending * 12409sctp_copy_it_in(struct sctp_tcb *stcb, 12410 struct sctp_association *asoc, 12411 struct sctp_sndrcvinfo *srcv, 12412 struct uio *uio, 12413 struct sctp_nets *net, 12414 ssize_t max_send_len, 12415 int user_marks_eor, 12416 int *error) 12417{ 12418 12419 /*- 12420 * This routine must be very careful in its work. Protocol 12421 * processing is up and running so care must be taken to spl...() 12422 * when you need to do something that may effect the stcb/asoc. The 12423 * sb is locked however. When data is copied the protocol processing 12424 * should be enabled since this is a slower operation... 12425 */ 12426 struct sctp_stream_queue_pending *sp = NULL; 12427 int resv_in_first; 12428 12429 *error = 0; 12430 /* Now can we send this? */ 12431 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 12432 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12433 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12434 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12435 /* got data while shutting down */ 12436 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12437 *error = ECONNRESET; 12438 goto out_now; 12439 } 12440 sctp_alloc_a_strmoq(stcb, sp); 12441 if (sp == NULL) { 12442 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12443 *error = ENOMEM; 12444 goto out_now; 12445 } 12446 sp->act_flags = 0; 12447 sp->sender_all_done = 0; 12448 sp->sinfo_flags = srcv->sinfo_flags; 12449 sp->timetolive = srcv->sinfo_timetolive; 12450 sp->ppid = srcv->sinfo_ppid; 12451 sp->context = srcv->sinfo_context; 12452 sp->fsn = 0; 12453 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 12454 12455 sp->sid = srcv->sinfo_stream; 12456 sp->length = (uint32_t)min(uio->uio_resid, max_send_len); 12457 if ((sp->length == (uint32_t)uio->uio_resid) && 12458 ((user_marks_eor == 0) || 12459 (srcv->sinfo_flags & SCTP_EOF) || 12460 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 12461 sp->msg_is_complete = 1; 12462 } else { 12463 sp->msg_is_complete = 0; 12464 } 12465 sp->sender_all_done = 0; 12466 sp->some_taken = 0; 12467 sp->put_last_out = 0; 12468 resv_in_first = SCTP_DATA_CHUNK_OVERHEAD(stcb); 12469 sp->data = sp->tail_mbuf = NULL; 12470 if (sp->length == 0) { 12471 goto skip_copy; 12472 } 12473 if (srcv->sinfo_keynumber_valid) { 12474 sp->auth_keyid = srcv->sinfo_keynumber; 12475 } else { 12476 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 12477 } 12478 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 12479 sctp_auth_key_acquire(stcb, sp->auth_keyid); 12480 sp->holds_key_ref = 1; 12481 } 12482 *error = sctp_copy_one(sp, uio, resv_in_first); 12483skip_copy: 12484 if (*error) { 12485 sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); 12486 sp = NULL; 12487 } else { 12488 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 12489 sp->net = net; 12490 atomic_add_int(&sp->net->ref_count, 1); 12491 } else { 12492 sp->net = NULL; 12493 } 12494 sctp_set_prsctp_policy(sp); 12495 } 12496out_now: 12497 return (sp); 12498} 12499 12500 12501int 12502sctp_sosend(struct socket *so, 12503 struct sockaddr *addr, 12504 struct uio *uio, 12505 struct mbuf *top, 12506 struct mbuf *control, 12507 int flags, 12508 struct thread *p 12509) 12510{ 12511 int error, use_sndinfo = 0; 12512 struct sctp_sndrcvinfo sndrcvninfo; 12513 struct sockaddr *addr_to_use; 12514#if defined(INET) && defined(INET6) 12515 struct sockaddr_in sin; 12516#endif 12517 12518 if (control) { 12519 /* process cmsg snd/rcv info (maybe a assoc-id) */ 12520 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&sndrcvninfo, control, 12521 sizeof(sndrcvninfo))) { 12522 /* got one */ 12523 use_sndinfo = 1; 12524 } 12525 } 12526 addr_to_use = addr; 12527#if defined(INET) && defined(INET6) 12528 if ((addr) && (addr->sa_family == AF_INET6)) { 12529 struct sockaddr_in6 *sin6; 12530 12531 sin6 = (struct sockaddr_in6 *)addr; 12532 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 12533 in6_sin6_2_sin(&sin, sin6); 12534 addr_to_use = (struct sockaddr *)&sin; 12535 } 12536 } 12537#endif 12538 error = sctp_lower_sosend(so, addr_to_use, uio, top, 12539 control, 12540 flags, 12541 use_sndinfo ? &sndrcvninfo : NULL 12542 ,p 12543 ); 12544 return (error); 12545} 12546 12547 12548int 12549sctp_lower_sosend(struct socket *so, 12550 struct sockaddr *addr, 12551 struct uio *uio, 12552 struct mbuf *i_pak, 12553 struct mbuf *control, 12554 int flags, 12555 struct sctp_sndrcvinfo *srcv 12556 , 12557 struct thread *p 12558) 12559{ 12560 ssize_t sndlen = 0, max_len, local_add_more; 12561 int error, len; 12562 struct mbuf *top = NULL; 12563 int queue_only = 0, queue_only_for_init = 0; 12564 int free_cnt_applied = 0; 12565 int un_sent; 12566 int now_filled = 0; 12567 unsigned int inqueue_bytes = 0; 12568 struct sctp_block_entry be; 12569 struct sctp_inpcb *inp; 12570 struct sctp_tcb *stcb = NULL; 12571 struct timeval now; 12572 struct sctp_nets *net; 12573 struct sctp_association *asoc; 12574 struct sctp_inpcb *t_inp; 12575 int user_marks_eor; 12576 int create_lock_applied = 0; 12577 int nagle_applies = 0; 12578 int some_on_control = 0; 12579 int got_all_of_the_send = 0; 12580 int hold_tcblock = 0; 12581 int non_blocking = 0; 12582 ssize_t local_soresv = 0; 12583 uint16_t port; 12584 uint16_t sinfo_flags; 12585 sctp_assoc_t sinfo_assoc_id; 12586 12587 error = 0; 12588 net = NULL; 12589 stcb = NULL; 12590 asoc = NULL; 12591 12592 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 12593 if (inp == NULL) { 12594 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12595 error = EINVAL; 12596 if (i_pak) { 12597 SCTP_RELEASE_PKT(i_pak); 12598 } 12599 return (error); 12600 } 12601 if ((uio == NULL) && (i_pak == NULL)) { 12602 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12603 return (EINVAL); 12604 } 12605 user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 12606 atomic_add_int(&inp->total_sends, 1); 12607 if (uio) { 12608 if (uio->uio_resid < 0) { 12609 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12610 return (EINVAL); 12611 } 12612 sndlen = uio->uio_resid; 12613 } else { 12614 top = SCTP_HEADER_TO_CHAIN(i_pak); 12615 sndlen = SCTP_HEADER_LEN(i_pak); 12616 } 12617 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %zd\n", 12618 (void *)addr, 12619 sndlen); 12620 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 12621 (inp->sctp_socket->so_qlimit)) { 12622 /* The listener can NOT send */ 12623 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12624 error = ENOTCONN; 12625 goto out_unlocked; 12626 } 12627 /** 12628 * Pre-screen address, if one is given the sin-len 12629 * must be set correctly! 12630 */ 12631 if (addr) { 12632 union sctp_sockstore *raddr = (union sctp_sockstore *)addr; 12633 12634 switch (raddr->sa.sa_family) { 12635#ifdef INET 12636 case AF_INET: 12637 if (raddr->sin.sin_len != sizeof(struct sockaddr_in)) { 12638 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12639 error = EINVAL; 12640 goto out_unlocked; 12641 } 12642 port = raddr->sin.sin_port; 12643 break; 12644#endif 12645#ifdef INET6 12646 case AF_INET6: 12647 if (raddr->sin6.sin6_len != sizeof(struct sockaddr_in6)) { 12648 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12649 error = EINVAL; 12650 goto out_unlocked; 12651 } 12652 port = raddr->sin6.sin6_port; 12653 break; 12654#endif 12655 default: 12656 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAFNOSUPPORT); 12657 error = EAFNOSUPPORT; 12658 goto out_unlocked; 12659 } 12660 } else 12661 port = 0; 12662 12663 if (srcv) { 12664 sinfo_flags = srcv->sinfo_flags; 12665 sinfo_assoc_id = srcv->sinfo_assoc_id; 12666 if (INVALID_SINFO_FLAG(sinfo_flags) || 12667 PR_SCTP_INVALID_POLICY(sinfo_flags)) { 12668 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12669 error = EINVAL; 12670 goto out_unlocked; 12671 } 12672 if (srcv->sinfo_flags) 12673 SCTP_STAT_INCR(sctps_sends_with_flags); 12674 } else { 12675 sinfo_flags = inp->def_send.sinfo_flags; 12676 sinfo_assoc_id = inp->def_send.sinfo_assoc_id; 12677 } 12678 if (flags & MSG_EOR) { 12679 sinfo_flags |= SCTP_EOR; 12680 } 12681 if (flags & MSG_EOF) { 12682 sinfo_flags |= SCTP_EOF; 12683 } 12684 if (sinfo_flags & SCTP_SENDALL) { 12685 /* its a sendall */ 12686 error = sctp_sendall(inp, uio, top, srcv); 12687 top = NULL; 12688 goto out_unlocked; 12689 } 12690 if ((sinfo_flags & SCTP_ADDR_OVER) && (addr == NULL)) { 12691 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12692 error = EINVAL; 12693 goto out_unlocked; 12694 } 12695 /* now we must find the assoc */ 12696 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) || 12697 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 12698 SCTP_INP_RLOCK(inp); 12699 stcb = LIST_FIRST(&inp->sctp_asoc_list); 12700 if (stcb) { 12701 SCTP_TCB_LOCK(stcb); 12702 hold_tcblock = 1; 12703 } 12704 SCTP_INP_RUNLOCK(inp); 12705 } else if (sinfo_assoc_id) { 12706 stcb = sctp_findassociation_ep_asocid(inp, sinfo_assoc_id, 1); 12707 if (stcb != NULL) { 12708 hold_tcblock = 1; 12709 } 12710 } else if (addr) { 12711 /*- 12712 * Since we did not use findep we must 12713 * increment it, and if we don't find a tcb 12714 * decrement it. 12715 */ 12716 SCTP_INP_WLOCK(inp); 12717 SCTP_INP_INCR_REF(inp); 12718 SCTP_INP_WUNLOCK(inp); 12719 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12720 if (stcb == NULL) { 12721 SCTP_INP_WLOCK(inp); 12722 SCTP_INP_DECR_REF(inp); 12723 SCTP_INP_WUNLOCK(inp); 12724 } else { 12725 hold_tcblock = 1; 12726 } 12727 } 12728 if ((stcb == NULL) && (addr)) { 12729 /* Possible implicit send? */ 12730 SCTP_ASOC_CREATE_LOCK(inp); 12731 create_lock_applied = 1; 12732 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 12733 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 12734 /* Should I really unlock ? */ 12735 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12736 error = EINVAL; 12737 goto out_unlocked; 12738 12739 } 12740 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 12741 (addr->sa_family == AF_INET6)) { 12742 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12743 error = EINVAL; 12744 goto out_unlocked; 12745 } 12746 SCTP_INP_WLOCK(inp); 12747 SCTP_INP_INCR_REF(inp); 12748 SCTP_INP_WUNLOCK(inp); 12749 /* With the lock applied look again */ 12750 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12751 if ((stcb == NULL) && (control != NULL) && (port > 0)) { 12752 stcb = sctp_findassociation_cmsgs(&t_inp, port, control, &net, &error); 12753 } 12754 if (stcb == NULL) { 12755 SCTP_INP_WLOCK(inp); 12756 SCTP_INP_DECR_REF(inp); 12757 SCTP_INP_WUNLOCK(inp); 12758 } else { 12759 hold_tcblock = 1; 12760 } 12761 if (error) { 12762 goto out_unlocked; 12763 } 12764 if (t_inp != inp) { 12765 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12766 error = ENOTCONN; 12767 goto out_unlocked; 12768 } 12769 } 12770 if (stcb == NULL) { 12771 if (addr == NULL) { 12772 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12773 error = ENOENT; 12774 goto out_unlocked; 12775 } else { 12776 /* We must go ahead and start the INIT process */ 12777 uint32_t vrf_id; 12778 12779 if ((sinfo_flags & SCTP_ABORT) || 12780 ((sinfo_flags & SCTP_EOF) && (sndlen == 0))) { 12781 /*- 12782 * User asks to abort a non-existant assoc, 12783 * or EOF a non-existant assoc with no data 12784 */ 12785 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12786 error = ENOENT; 12787 goto out_unlocked; 12788 } 12789 /* get an asoc/stcb struct */ 12790 vrf_id = inp->def_vrf_id; 12791#ifdef INVARIANTS 12792 if (create_lock_applied == 0) { 12793 panic("Error, should hold create lock and I don't?"); 12794 } 12795#endif 12796 stcb = sctp_aloc_assoc(inp, addr, &error, 0, vrf_id, 12797 inp->sctp_ep.pre_open_stream_count, 12798 inp->sctp_ep.port, 12799 p, 12800 SCTP_INITIALIZE_AUTH_PARAMS); 12801 if (stcb == NULL) { 12802 /* Error is setup for us in the call */ 12803 goto out_unlocked; 12804 } 12805 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 12806 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 12807 /* 12808 * Set the connected flag so we can queue 12809 * data 12810 */ 12811 soisconnecting(so); 12812 } 12813 hold_tcblock = 1; 12814 if (create_lock_applied) { 12815 SCTP_ASOC_CREATE_UNLOCK(inp); 12816 create_lock_applied = 0; 12817 } else { 12818 SCTP_PRINTF("Huh-3? create lock should have been on??\n"); 12819 } 12820 /* 12821 * Turn on queue only flag to prevent data from 12822 * being sent 12823 */ 12824 queue_only = 1; 12825 asoc = &stcb->asoc; 12826 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 12827 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 12828 12829 if (control) { 12830 if (sctp_process_cmsgs_for_init(stcb, control, &error)) { 12831 sctp_free_assoc(inp, stcb, SCTP_PCBFREE_FORCE, 12832 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_6); 12833 hold_tcblock = 0; 12834 stcb = NULL; 12835 goto out_unlocked; 12836 } 12837 } 12838 /* out with the INIT */ 12839 queue_only_for_init = 1; 12840 /*- 12841 * we may want to dig in after this call and adjust the MTU 12842 * value. It defaulted to 1500 (constant) but the ro 12843 * structure may now have an update and thus we may need to 12844 * change it BEFORE we append the message. 12845 */ 12846 } 12847 } else 12848 asoc = &stcb->asoc; 12849 if (srcv == NULL) { 12850 srcv = (struct sctp_sndrcvinfo *)&asoc->def_send; 12851 sinfo_flags = srcv->sinfo_flags; 12852 if (flags & MSG_EOR) { 12853 sinfo_flags |= SCTP_EOR; 12854 } 12855 if (flags & MSG_EOF) { 12856 sinfo_flags |= SCTP_EOF; 12857 } 12858 } 12859 if (sinfo_flags & SCTP_ADDR_OVER) { 12860 if (addr) 12861 net = sctp_findnet(stcb, addr); 12862 else 12863 net = NULL; 12864 if ((net == NULL) || 12865 ((port != 0) && (port != stcb->rport))) { 12866 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12867 error = EINVAL; 12868 goto out_unlocked; 12869 } 12870 } else { 12871 if (stcb->asoc.alternate) { 12872 net = stcb->asoc.alternate; 12873 } else { 12874 net = stcb->asoc.primary_destination; 12875 } 12876 } 12877 atomic_add_int(&stcb->total_sends, 1); 12878 /* Keep the stcb from being freed under our feet */ 12879 atomic_add_int(&asoc->refcnt, 1); 12880 free_cnt_applied = 1; 12881 12882 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NO_FRAGMENT)) { 12883 if (sndlen > (ssize_t)asoc->smallest_mtu) { 12884 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12885 error = EMSGSIZE; 12886 goto out_unlocked; 12887 } 12888 } 12889 if (SCTP_SO_IS_NBIO(so) 12890 || (flags & MSG_NBIO) 12891 ) { 12892 non_blocking = 1; 12893 } 12894 /* would we block? */ 12895 if (non_blocking) { 12896 ssize_t amount; 12897 12898 if (hold_tcblock == 0) { 12899 SCTP_TCB_LOCK(stcb); 12900 hold_tcblock = 1; 12901 } 12902 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 12903 if (user_marks_eor == 0) { 12904 amount = sndlen; 12905 } else { 12906 amount = 1; 12907 } 12908 if ((SCTP_SB_LIMIT_SND(so) < (amount + inqueue_bytes + stcb->asoc.sb_send_resv)) || 12909 (stcb->asoc.chunks_on_out_queue >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12910 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EWOULDBLOCK); 12911 if (sndlen > (ssize_t)SCTP_SB_LIMIT_SND(so)) 12912 error = EMSGSIZE; 12913 else 12914 error = EWOULDBLOCK; 12915 goto out_unlocked; 12916 } 12917 stcb->asoc.sb_send_resv += (uint32_t)sndlen; 12918 SCTP_TCB_UNLOCK(stcb); 12919 hold_tcblock = 0; 12920 } else { 12921 atomic_add_int(&stcb->asoc.sb_send_resv, sndlen); 12922 } 12923 local_soresv = sndlen; 12924 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12925 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12926 error = ECONNRESET; 12927 goto out_unlocked; 12928 } 12929 if (create_lock_applied) { 12930 SCTP_ASOC_CREATE_UNLOCK(inp); 12931 create_lock_applied = 0; 12932 } 12933 /* Is the stream no. valid? */ 12934 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 12935 /* Invalid stream number */ 12936 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12937 error = EINVAL; 12938 goto out_unlocked; 12939 } 12940 if ((asoc->strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPEN) && 12941 (asoc->strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPENING)) { 12942 /* 12943 * Can't queue any data while stream reset is underway. 12944 */ 12945 if (asoc->strmout[srcv->sinfo_stream].state > SCTP_STREAM_OPEN) { 12946 error = EAGAIN; 12947 } else { 12948 error = EINVAL; 12949 } 12950 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, error); 12951 goto out_unlocked; 12952 } 12953 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 12954 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 12955 queue_only = 1; 12956 } 12957 /* we are now done with all control */ 12958 if (control) { 12959 sctp_m_freem(control); 12960 control = NULL; 12961 } 12962 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) || 12963 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12964 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12965 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12966 if (sinfo_flags & SCTP_ABORT) { 12967 ; 12968 } else { 12969 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12970 error = ECONNRESET; 12971 goto out_unlocked; 12972 } 12973 } 12974 /* Ok, we will attempt a msgsnd :> */ 12975 if (p) { 12976 p->td_ru.ru_msgsnd++; 12977 } 12978 /* Are we aborting? */ 12979 if (sinfo_flags & SCTP_ABORT) { 12980 struct mbuf *mm; 12981 ssize_t tot_demand, tot_out = 0, max_out; 12982 12983 SCTP_STAT_INCR(sctps_sends_with_abort); 12984 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) || 12985 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) { 12986 /* It has to be up before we abort */ 12987 /* how big is the user initiated abort? */ 12988 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12989 error = EINVAL; 12990 goto out; 12991 } 12992 if (hold_tcblock) { 12993 SCTP_TCB_UNLOCK(stcb); 12994 hold_tcblock = 0; 12995 } 12996 if (top) { 12997 struct mbuf *cntm = NULL; 12998 12999 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_WAITOK, 1, MT_DATA); 13000 if (sndlen != 0) { 13001 for (cntm = top; cntm; cntm = SCTP_BUF_NEXT(cntm)) { 13002 tot_out += SCTP_BUF_LEN(cntm); 13003 } 13004 } 13005 } else { 13006 /* Must fit in a MTU */ 13007 tot_out = sndlen; 13008 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 13009 if (tot_demand > SCTP_DEFAULT_ADD_MORE) { 13010 /* To big */ 13011 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 13012 error = EMSGSIZE; 13013 goto out; 13014 } 13015 mm = sctp_get_mbuf_for_msg((unsigned int)tot_demand, 0, M_WAITOK, 1, MT_DATA); 13016 } 13017 if (mm == NULL) { 13018 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 13019 error = ENOMEM; 13020 goto out; 13021 } 13022 max_out = asoc->smallest_mtu - sizeof(struct sctp_paramhdr); 13023 max_out -= sizeof(struct sctp_abort_msg); 13024 if (tot_out > max_out) { 13025 tot_out = max_out; 13026 } 13027 if (mm) { 13028 struct sctp_paramhdr *ph; 13029 13030 /* now move forward the data pointer */ 13031 ph = mtod(mm, struct sctp_paramhdr *); 13032 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 13033 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + tot_out)); 13034 ph++; 13035 SCTP_BUF_LEN(mm) = (int)(tot_out + sizeof(struct sctp_paramhdr)); 13036 if (top == NULL) { 13037 error = uiomove((caddr_t)ph, (int)tot_out, uio); 13038 if (error) { 13039 /*- 13040 * Here if we can't get his data we 13041 * still abort we just don't get to 13042 * send the users note :-0 13043 */ 13044 sctp_m_freem(mm); 13045 mm = NULL; 13046 } 13047 } else { 13048 if (sndlen != 0) { 13049 SCTP_BUF_NEXT(mm) = top; 13050 } 13051 } 13052 } 13053 if (hold_tcblock == 0) { 13054 SCTP_TCB_LOCK(stcb); 13055 } 13056 atomic_add_int(&stcb->asoc.refcnt, -1); 13057 free_cnt_applied = 0; 13058 /* release this lock, otherwise we hang on ourselves */ 13059 sctp_abort_an_association(stcb->sctp_ep, stcb, mm, SCTP_SO_LOCKED); 13060 /* now relock the stcb so everything is sane */ 13061 hold_tcblock = 0; 13062 stcb = NULL; 13063 /* 13064 * In this case top is already chained to mm avoid double 13065 * free, since we free it below if top != NULL and driver 13066 * would free it after sending the packet out 13067 */ 13068 if (sndlen != 0) { 13069 top = NULL; 13070 } 13071 goto out_unlocked; 13072 } 13073 /* Calculate the maximum we can send */ 13074 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13075 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13076 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13077 } else { 13078 max_len = 0; 13079 } 13080 if (hold_tcblock) { 13081 SCTP_TCB_UNLOCK(stcb); 13082 hold_tcblock = 0; 13083 } 13084 if (asoc->strmout == NULL) { 13085 /* huh? software error */ 13086 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 13087 error = EFAULT; 13088 goto out_unlocked; 13089 } 13090 13091 /* Unless E_EOR mode is on, we must make a send FIT in one call. */ 13092 if ((user_marks_eor == 0) && 13093 (sndlen > (ssize_t)SCTP_SB_LIMIT_SND(stcb->sctp_socket))) { 13094 /* It will NEVER fit */ 13095 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 13096 error = EMSGSIZE; 13097 goto out_unlocked; 13098 } 13099 if ((uio == NULL) && user_marks_eor) { 13100 /*- 13101 * We do not support eeor mode for 13102 * sending with mbuf chains (like sendfile). 13103 */ 13104 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13105 error = EINVAL; 13106 goto out_unlocked; 13107 } 13108 13109 if (user_marks_eor) { 13110 local_add_more = (ssize_t)min(SCTP_SB_LIMIT_SND(so), SCTP_BASE_SYSCTL(sctp_add_more_threshold)); 13111 } else { 13112 /*- 13113 * For non-eeor the whole message must fit in 13114 * the socket send buffer. 13115 */ 13116 local_add_more = sndlen; 13117 } 13118 len = 0; 13119 if (non_blocking) { 13120 goto skip_preblock; 13121 } 13122 if (((max_len <= local_add_more) && 13123 ((ssize_t)SCTP_SB_LIMIT_SND(so) >= local_add_more)) || 13124 (max_len == 0) || 13125 ((stcb->asoc.chunks_on_out_queue + stcb->asoc.stream_queue_cnt) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13126 /* No room right now ! */ 13127 SOCKBUF_LOCK(&so->so_snd); 13128 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13129 while ((SCTP_SB_LIMIT_SND(so) < (inqueue_bytes + local_add_more)) || 13130 ((stcb->asoc.stream_queue_cnt + stcb->asoc.chunks_on_out_queue) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13131 SCTPDBG(SCTP_DEBUG_OUTPUT1, "pre_block limit:%u <(inq:%d + %zd) || (%d+%d > %d)\n", 13132 (unsigned int)SCTP_SB_LIMIT_SND(so), 13133 inqueue_bytes, 13134 local_add_more, 13135 stcb->asoc.stream_queue_cnt, 13136 stcb->asoc.chunks_on_out_queue, 13137 SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)); 13138 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13139 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA, asoc, sndlen); 13140 } 13141 be.error = 0; 13142 stcb->block_entry = &be; 13143 error = sbwait(&so->so_snd); 13144 stcb->block_entry = NULL; 13145 if (error || so->so_error || be.error) { 13146 if (error == 0) { 13147 if (so->so_error) 13148 error = so->so_error; 13149 if (be.error) { 13150 error = be.error; 13151 } 13152 } 13153 SOCKBUF_UNLOCK(&so->so_snd); 13154 goto out_unlocked; 13155 } 13156 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13157 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13158 asoc, stcb->asoc.total_output_queue_size); 13159 } 13160 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13161 SOCKBUF_UNLOCK(&so->so_snd); 13162 goto out_unlocked; 13163 } 13164 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13165 } 13166 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13167 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13168 } else { 13169 max_len = 0; 13170 } 13171 SOCKBUF_UNLOCK(&so->so_snd); 13172 } 13173 13174skip_preblock: 13175 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13176 goto out_unlocked; 13177 } 13178 /* 13179 * sndlen covers for mbuf case uio_resid covers for the non-mbuf 13180 * case NOTE: uio will be null when top/mbuf is passed 13181 */ 13182 if (sndlen == 0) { 13183 if (sinfo_flags & SCTP_EOF) { 13184 got_all_of_the_send = 1; 13185 goto dataless_eof; 13186 } else { 13187 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13188 error = EINVAL; 13189 goto out; 13190 } 13191 } 13192 if (top == NULL) { 13193 struct sctp_stream_queue_pending *sp; 13194 struct sctp_stream_out *strm; 13195 uint32_t sndout; 13196 13197 SCTP_TCB_SEND_LOCK(stcb); 13198 if ((asoc->stream_locked) && 13199 (asoc->stream_locked_on != srcv->sinfo_stream)) { 13200 SCTP_TCB_SEND_UNLOCK(stcb); 13201 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13202 error = EINVAL; 13203 goto out; 13204 } 13205 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 13206 if (strm->last_msg_incomplete == 0) { 13207 do_a_copy_in: 13208 SCTP_TCB_SEND_UNLOCK(stcb); 13209 sp = sctp_copy_it_in(stcb, asoc, srcv, uio, net, max_len, user_marks_eor, &error); 13210 if (error) { 13211 goto out; 13212 } 13213 SCTP_TCB_SEND_LOCK(stcb); 13214 if (sp->msg_is_complete) { 13215 strm->last_msg_incomplete = 0; 13216 asoc->stream_locked = 0; 13217 } else { 13218 /* 13219 * Just got locked to this guy in case of an 13220 * interrupt. 13221 */ 13222 strm->last_msg_incomplete = 1; 13223 if (stcb->asoc.idata_supported == 0) { 13224 asoc->stream_locked = 1; 13225 asoc->stream_locked_on = srcv->sinfo_stream; 13226 } 13227 sp->sender_all_done = 0; 13228 } 13229 sctp_snd_sb_alloc(stcb, sp->length); 13230 atomic_add_int(&asoc->stream_queue_cnt, 1); 13231 if (sinfo_flags & SCTP_UNORDERED) { 13232 SCTP_STAT_INCR(sctps_sends_with_unord); 13233 } 13234 sp->processing = 1; 13235 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 13236 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, asoc, strm, sp, 1); 13237 } else { 13238 sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead); 13239 if (sp == NULL) { 13240 /* ???? Huh ??? last msg is gone */ 13241#ifdef INVARIANTS 13242 panic("Warning: Last msg marked incomplete, yet nothing left?"); 13243#else 13244 SCTP_PRINTF("Warning: Last msg marked incomplete, yet nothing left?\n"); 13245 strm->last_msg_incomplete = 0; 13246#endif 13247 goto do_a_copy_in; 13248 13249 } 13250 if (sp->processing) { 13251 SCTP_TCB_SEND_UNLOCK(stcb); 13252 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13253 error = EINVAL; 13254 goto out; 13255 } else { 13256 sp->processing = 1; 13257 } 13258 } 13259 SCTP_TCB_SEND_UNLOCK(stcb); 13260 while (uio->uio_resid > 0) { 13261 /* How much room do we have? */ 13262 struct mbuf *new_tail, *mm; 13263 13264 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13265 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) 13266 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13267 else 13268 max_len = 0; 13269 13270 if ((max_len > (ssize_t)SCTP_BASE_SYSCTL(sctp_add_more_threshold)) || 13271 (max_len && (SCTP_SB_LIMIT_SND(so) < SCTP_BASE_SYSCTL(sctp_add_more_threshold))) || 13272 (uio->uio_resid && (uio->uio_resid <= max_len))) { 13273 sndout = 0; 13274 new_tail = NULL; 13275 if (hold_tcblock) { 13276 SCTP_TCB_UNLOCK(stcb); 13277 hold_tcblock = 0; 13278 } 13279 mm = sctp_copy_resume(uio, (int)max_len, user_marks_eor, &error, &sndout, &new_tail); 13280 if ((mm == NULL) || error) { 13281 if (mm) { 13282 sctp_m_freem(mm); 13283 } 13284 SCTP_TCB_SEND_LOCK(stcb); 13285 if (sp != NULL) { 13286 sp->processing = 0; 13287 } 13288 SCTP_TCB_SEND_UNLOCK(stcb); 13289 goto out; 13290 } 13291 /* Update the mbuf and count */ 13292 SCTP_TCB_SEND_LOCK(stcb); 13293 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13294 (stcb->asoc.state & SCTP_STATE_WAS_ABORTED)) { 13295 /* 13296 * we need to get out. Peer probably 13297 * aborted. 13298 */ 13299 sctp_m_freem(mm); 13300 if (stcb->asoc.state & SCTP_STATE_WAS_ABORTED) { 13301 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 13302 error = ECONNRESET; 13303 } 13304 if (sp != NULL) { 13305 sp->processing = 0; 13306 } 13307 SCTP_TCB_SEND_UNLOCK(stcb); 13308 goto out; 13309 } 13310 if (sp->tail_mbuf) { 13311 /* tack it to the end */ 13312 SCTP_BUF_NEXT(sp->tail_mbuf) = mm; 13313 sp->tail_mbuf = new_tail; 13314 } else { 13315 /* A stolen mbuf */ 13316 sp->data = mm; 13317 sp->tail_mbuf = new_tail; 13318 } 13319 sctp_snd_sb_alloc(stcb, sndout); 13320 atomic_add_int(&sp->length, sndout); 13321 len += sndout; 13322 if (sinfo_flags & SCTP_SACK_IMMEDIATELY) { 13323 sp->sinfo_flags |= SCTP_SACK_IMMEDIATELY; 13324 } 13325 13326 /* Did we reach EOR? */ 13327 if ((uio->uio_resid == 0) && 13328 ((user_marks_eor == 0) || 13329 (sinfo_flags & SCTP_EOF) || 13330 (user_marks_eor && (sinfo_flags & SCTP_EOR)))) { 13331 sp->msg_is_complete = 1; 13332 } else { 13333 sp->msg_is_complete = 0; 13334 } 13335 SCTP_TCB_SEND_UNLOCK(stcb); 13336 } 13337 if (uio->uio_resid == 0) { 13338 /* got it all? */ 13339 continue; 13340 } 13341 /* PR-SCTP? */ 13342 if ((asoc->prsctp_supported) && (asoc->sent_queue_cnt_removeable > 0)) { 13343 /* 13344 * This is ugly but we must assure locking 13345 * order 13346 */ 13347 if (hold_tcblock == 0) { 13348 SCTP_TCB_LOCK(stcb); 13349 hold_tcblock = 1; 13350 } 13351 sctp_prune_prsctp(stcb, asoc, srcv, (int)sndlen); 13352 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13353 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) 13354 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13355 else 13356 max_len = 0; 13357 if (max_len > 0) { 13358 continue; 13359 } 13360 SCTP_TCB_UNLOCK(stcb); 13361 hold_tcblock = 0; 13362 } 13363 /* wait for space now */ 13364 if (non_blocking) { 13365 /* Non-blocking io in place out */ 13366 SCTP_TCB_SEND_LOCK(stcb); 13367 if (sp != NULL) { 13368 sp->processing = 0; 13369 } 13370 SCTP_TCB_SEND_UNLOCK(stcb); 13371 goto skip_out_eof; 13372 } 13373 /* What about the INIT, send it maybe */ 13374 if (queue_only_for_init) { 13375 if (hold_tcblock == 0) { 13376 SCTP_TCB_LOCK(stcb); 13377 hold_tcblock = 1; 13378 } 13379 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13380 /* a collision took us forward? */ 13381 queue_only = 0; 13382 } else { 13383 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13384 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 13385 queue_only = 1; 13386 } 13387 } 13388 if ((net->flight_size > net->cwnd) && 13389 (asoc->sctp_cmt_on_off == 0)) { 13390 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13391 queue_only = 1; 13392 } else if (asoc->ifp_had_enobuf) { 13393 SCTP_STAT_INCR(sctps_ifnomemqueued); 13394 if (net->flight_size > (2 * net->mtu)) { 13395 queue_only = 1; 13396 } 13397 asoc->ifp_had_enobuf = 0; 13398 } 13399 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 13400 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13401 (stcb->asoc.total_flight > 0) && 13402 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13403 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13404 13405 /*- 13406 * Ok, Nagle is set on and we have data outstanding. 13407 * Don't send anything and let SACKs drive out the 13408 * data unless we have a "full" segment to send. 13409 */ 13410 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13411 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13412 } 13413 SCTP_STAT_INCR(sctps_naglequeued); 13414 nagle_applies = 1; 13415 } else { 13416 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13417 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13418 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13419 } 13420 SCTP_STAT_INCR(sctps_naglesent); 13421 nagle_applies = 0; 13422 } 13423 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13424 13425 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13426 nagle_applies, un_sent); 13427 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13428 stcb->asoc.total_flight, 13429 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13430 } 13431 if (queue_only_for_init) 13432 queue_only_for_init = 0; 13433 if ((queue_only == 0) && (nagle_applies == 0)) { 13434 /*- 13435 * need to start chunk output 13436 * before blocking.. note that if 13437 * a lock is already applied, then 13438 * the input via the net is happening 13439 * and I don't need to start output :-D 13440 */ 13441 if (hold_tcblock == 0) { 13442 if (SCTP_TCB_TRYLOCK(stcb)) { 13443 hold_tcblock = 1; 13444 sctp_chunk_output(inp, 13445 stcb, 13446 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13447 } 13448 } else { 13449 sctp_chunk_output(inp, 13450 stcb, 13451 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13452 } 13453 } 13454 if (hold_tcblock == 1) { 13455 SCTP_TCB_UNLOCK(stcb); 13456 hold_tcblock = 0; 13457 } 13458 SOCKBUF_LOCK(&so->so_snd); 13459 /*- 13460 * This is a bit strange, but I think it will 13461 * work. The total_output_queue_size is locked and 13462 * protected by the TCB_LOCK, which we just released. 13463 * There is a race that can occur between releasing it 13464 * above, and me getting the socket lock, where sacks 13465 * come in but we have not put the SB_WAIT on the 13466 * so_snd buffer to get the wakeup. After the LOCK 13467 * is applied the sack_processing will also need to 13468 * LOCK the so->so_snd to do the actual sowwakeup(). So 13469 * once we have the socket buffer lock if we recheck the 13470 * size we KNOW we will get to sleep safely with the 13471 * wakeup flag in place. 13472 */ 13473 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * SCTP_DATA_CHUNK_OVERHEAD(stcb)); 13474 if (SCTP_SB_LIMIT_SND(so) <= (inqueue_bytes + 13475 min(SCTP_BASE_SYSCTL(sctp_add_more_threshold), SCTP_SB_LIMIT_SND(so)))) { 13476 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13477 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 13478 asoc, uio->uio_resid); 13479 } 13480 be.error = 0; 13481 stcb->block_entry = &be; 13482 error = sbwait(&so->so_snd); 13483 stcb->block_entry = NULL; 13484 13485 if (error || so->so_error || be.error) { 13486 if (error == 0) { 13487 if (so->so_error) 13488 error = so->so_error; 13489 if (be.error) { 13490 error = be.error; 13491 } 13492 } 13493 SOCKBUF_UNLOCK(&so->so_snd); 13494 SCTP_TCB_SEND_LOCK(stcb); 13495 if (sp != NULL) { 13496 sp->processing = 0; 13497 } 13498 SCTP_TCB_SEND_UNLOCK(stcb); 13499 goto out_unlocked; 13500 } 13501 13502 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13503 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13504 asoc, stcb->asoc.total_output_queue_size); 13505 } 13506 } 13507 SOCKBUF_UNLOCK(&so->so_snd); 13508 SCTP_TCB_SEND_LOCK(stcb); 13509 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13510 if (sp != NULL) { 13511 sp->processing = 0; 13512 } 13513 SCTP_TCB_SEND_UNLOCK(stcb); 13514 goto out_unlocked; 13515 } 13516 SCTP_TCB_SEND_UNLOCK(stcb); 13517 } 13518 SCTP_TCB_SEND_LOCK(stcb); 13519 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) || 13520 (stcb->asoc.state & SCTP_STATE_WAS_ABORTED)) { 13521 SCTP_TCB_SEND_UNLOCK(stcb); 13522 goto out_unlocked; 13523 } 13524 if (sp) { 13525 if (sp->msg_is_complete == 0) { 13526 strm->last_msg_incomplete = 1; 13527 if (stcb->asoc.idata_supported == 0) { 13528 asoc->stream_locked = 1; 13529 asoc->stream_locked_on = srcv->sinfo_stream; 13530 } 13531 } else { 13532 sp->sender_all_done = 1; 13533 strm->last_msg_incomplete = 0; 13534 asoc->stream_locked = 0; 13535 } 13536 sp->processing = 0; 13537 } else { 13538 SCTP_PRINTF("Huh no sp TSNH?\n"); 13539 strm->last_msg_incomplete = 0; 13540 asoc->stream_locked = 0; 13541 } 13542 SCTP_TCB_SEND_UNLOCK(stcb); 13543 if (uio->uio_resid == 0) { 13544 got_all_of_the_send = 1; 13545 } 13546 } else { 13547 /* We send in a 0, since we do NOT have any locks */ 13548 error = sctp_msg_append(stcb, net, top, srcv, 0); 13549 top = NULL; 13550 if (sinfo_flags & SCTP_EOF) { 13551 /* 13552 * This should only happen for Panda for the mbuf 13553 * send case, which does NOT yet support EEOR mode. 13554 * Thus, we can just set this flag to do the proper 13555 * EOF handling. 13556 */ 13557 got_all_of_the_send = 1; 13558 } 13559 } 13560 if (error) { 13561 goto out; 13562 } 13563dataless_eof: 13564 /* EOF thing ? */ 13565 if ((sinfo_flags & SCTP_EOF) && 13566 (got_all_of_the_send == 1)) { 13567 SCTP_STAT_INCR(sctps_sends_with_eof); 13568 error = 0; 13569 if (hold_tcblock == 0) { 13570 SCTP_TCB_LOCK(stcb); 13571 hold_tcblock = 1; 13572 } 13573 if (TAILQ_EMPTY(&asoc->send_queue) && 13574 TAILQ_EMPTY(&asoc->sent_queue) && 13575 sctp_is_there_unsent_data(stcb, SCTP_SO_LOCKED) == 0) { 13576 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13577 goto abort_anyway; 13578 } 13579 /* there is nothing queued to send, so I'm done... */ 13580 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 13581 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13582 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13583 struct sctp_nets *netp; 13584 13585 /* only send SHUTDOWN the first time through */ 13586 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13587 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 13588 } 13589 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT); 13590 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 13591 sctp_stop_timers_for_shutdown(stcb); 13592 if (stcb->asoc.alternate) { 13593 netp = stcb->asoc.alternate; 13594 } else { 13595 netp = stcb->asoc.primary_destination; 13596 } 13597 sctp_send_shutdown(stcb, netp); 13598 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 13599 netp); 13600 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13601 asoc->primary_destination); 13602 } 13603 } else { 13604 /*- 13605 * we still got (or just got) data to send, so set 13606 * SHUTDOWN_PENDING 13607 */ 13608 /*- 13609 * XXX sockets draft says that SCTP_EOF should be 13610 * sent with no data. currently, we will allow user 13611 * data to be sent first and move to 13612 * SHUTDOWN-PENDING 13613 */ 13614 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) && 13615 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13616 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13617 if (hold_tcblock == 0) { 13618 SCTP_TCB_LOCK(stcb); 13619 hold_tcblock = 1; 13620 } 13621 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13622 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT); 13623 } 13624 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING); 13625 if (TAILQ_EMPTY(&asoc->send_queue) && 13626 TAILQ_EMPTY(&asoc->sent_queue) && 13627 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 13628 struct mbuf *op_err; 13629 char msg[SCTP_DIAG_INFO_LEN]; 13630 13631 abort_anyway: 13632 if (free_cnt_applied) { 13633 atomic_add_int(&stcb->asoc.refcnt, -1); 13634 free_cnt_applied = 0; 13635 } 13636 snprintf(msg, sizeof(msg), 13637 "%s:%d at %s", __FILE__, __LINE__, __func__); 13638 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 13639 msg); 13640 sctp_abort_an_association(stcb->sctp_ep, stcb, 13641 op_err, SCTP_SO_LOCKED); 13642 /* 13643 * now relock the stcb so everything 13644 * is sane 13645 */ 13646 hold_tcblock = 0; 13647 stcb = NULL; 13648 goto out; 13649 } 13650 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13651 asoc->primary_destination); 13652 sctp_feature_off(inp, SCTP_PCB_FLAGS_NODELAY); 13653 } 13654 } 13655 } 13656skip_out_eof: 13657 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 13658 some_on_control = 1; 13659 } 13660 if (queue_only_for_init) { 13661 if (hold_tcblock == 0) { 13662 SCTP_TCB_LOCK(stcb); 13663 hold_tcblock = 1; 13664 } 13665 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) { 13666 /* a collision took us forward? */ 13667 queue_only = 0; 13668 } else { 13669 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13670 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT); 13671 queue_only = 1; 13672 } 13673 } 13674 if ((net->flight_size > net->cwnd) && 13675 (stcb->asoc.sctp_cmt_on_off == 0)) { 13676 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13677 queue_only = 1; 13678 } else if (asoc->ifp_had_enobuf) { 13679 SCTP_STAT_INCR(sctps_ifnomemqueued); 13680 if (net->flight_size > (2 * net->mtu)) { 13681 queue_only = 1; 13682 } 13683 asoc->ifp_had_enobuf = 0; 13684 } 13685 un_sent = stcb->asoc.total_output_queue_size - stcb->asoc.total_flight; 13686 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13687 (stcb->asoc.total_flight > 0) && 13688 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13689 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13690 /*- 13691 * Ok, Nagle is set on and we have data outstanding. 13692 * Don't send anything and let SACKs drive out the 13693 * data unless wen have a "full" segment to send. 13694 */ 13695 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13696 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13697 } 13698 SCTP_STAT_INCR(sctps_naglequeued); 13699 nagle_applies = 1; 13700 } else { 13701 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13702 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13703 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13704 } 13705 SCTP_STAT_INCR(sctps_naglesent); 13706 nagle_applies = 0; 13707 } 13708 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13709 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13710 nagle_applies, un_sent); 13711 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13712 stcb->asoc.total_flight, 13713 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13714 } 13715 if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) { 13716 /* we can attempt to send too. */ 13717 if (hold_tcblock == 0) { 13718 /* 13719 * If there is activity recv'ing sacks no need to 13720 * send 13721 */ 13722 if (SCTP_TCB_TRYLOCK(stcb)) { 13723 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13724 hold_tcblock = 1; 13725 } 13726 } else { 13727 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13728 } 13729 } else if ((queue_only == 0) && 13730 (stcb->asoc.peers_rwnd == 0) && 13731 (stcb->asoc.total_flight == 0)) { 13732 /* We get to have a probe outstanding */ 13733 if (hold_tcblock == 0) { 13734 hold_tcblock = 1; 13735 SCTP_TCB_LOCK(stcb); 13736 } 13737 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13738 } else if (some_on_control) { 13739 int num_out, reason, frag_point; 13740 13741 /* Here we do control only */ 13742 if (hold_tcblock == 0) { 13743 hold_tcblock = 1; 13744 SCTP_TCB_LOCK(stcb); 13745 } 13746 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 13747 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 13748 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_LOCKED); 13749 } 13750 SCTPDBG(SCTP_DEBUG_OUTPUT1, "USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d err:%d\n", 13751 queue_only, stcb->asoc.peers_rwnd, un_sent, 13752 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue, 13753 stcb->asoc.total_output_queue_size, error); 13754 13755out: 13756out_unlocked: 13757 13758 if (local_soresv && stcb) { 13759 atomic_subtract_int(&stcb->asoc.sb_send_resv, sndlen); 13760 } 13761 if (create_lock_applied) { 13762 SCTP_ASOC_CREATE_UNLOCK(inp); 13763 } 13764 if ((stcb) && hold_tcblock) { 13765 SCTP_TCB_UNLOCK(stcb); 13766 } 13767 if (stcb && free_cnt_applied) { 13768 atomic_add_int(&stcb->asoc.refcnt, -1); 13769 } 13770#ifdef INVARIANTS 13771 if (stcb) { 13772 if (mtx_owned(&stcb->tcb_mtx)) { 13773 panic("Leaving with tcb mtx owned?"); 13774 } 13775 if (mtx_owned(&stcb->tcb_send_mtx)) { 13776 panic("Leaving with tcb send mtx owned?"); 13777 } 13778 } 13779#endif 13780 if (top) { 13781 sctp_m_freem(top); 13782 } 13783 if (control) { 13784 sctp_m_freem(control); 13785 } 13786 return (error); 13787} 13788 13789 13790/* 13791 * generate an AUTHentication chunk, if required 13792 */ 13793struct mbuf * 13794sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end, 13795 struct sctp_auth_chunk **auth_ret, uint32_t *offset, 13796 struct sctp_tcb *stcb, uint8_t chunk) 13797{ 13798 struct mbuf *m_auth; 13799 struct sctp_auth_chunk *auth; 13800 int chunk_len; 13801 struct mbuf *cn; 13802 13803 if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) || 13804 (stcb == NULL)) 13805 return (m); 13806 13807 if (stcb->asoc.auth_supported == 0) { 13808 return (m); 13809 } 13810 /* does the requested chunk require auth? */ 13811 if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) { 13812 return (m); 13813 } 13814 m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_NOWAIT, 1, MT_HEADER); 13815 if (m_auth == NULL) { 13816 /* no mbuf's */ 13817 return (m); 13818 } 13819 /* reserve some space if this will be the first mbuf */ 13820 if (m == NULL) 13821 SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD); 13822 /* fill in the AUTH chunk details */ 13823 auth = mtod(m_auth, struct sctp_auth_chunk *); 13824 memset(auth, 0, sizeof(*auth)); 13825 auth->ch.chunk_type = SCTP_AUTHENTICATION; 13826 auth->ch.chunk_flags = 0; 13827 chunk_len = sizeof(*auth) + 13828 sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id); 13829 auth->ch.chunk_length = htons(chunk_len); 13830 auth->hmac_id = htons(stcb->asoc.peer_hmac_id); 13831 /* key id and hmac digest will be computed and filled in upon send */ 13832 13833 /* save the offset where the auth was inserted into the chain */ 13834 *offset = 0; 13835 for (cn = m; cn; cn = SCTP_BUF_NEXT(cn)) { 13836 *offset += SCTP_BUF_LEN(cn); 13837 } 13838 13839 /* update length and return pointer to the auth chunk */ 13840 SCTP_BUF_LEN(m_auth) = chunk_len; 13841 m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0); 13842 if (auth_ret != NULL) 13843 *auth_ret = auth; 13844 13845 return (m); 13846} 13847 13848#ifdef INET6 13849int 13850sctp_v6src_match_nexthop(struct sockaddr_in6 *src6, sctp_route_t *ro) 13851{ 13852 struct nd_prefix *pfx = NULL; 13853 struct nd_pfxrouter *pfxrtr = NULL; 13854 struct sockaddr_in6 gw6; 13855 13856 if (ro == NULL || ro->ro_rt == NULL || src6->sin6_family != AF_INET6) 13857 return (0); 13858 13859 /* get prefix entry of address */ 13860 ND6_RLOCK(); 13861 LIST_FOREACH(pfx, &MODULE_GLOBAL(nd_prefix), ndpr_entry) { 13862 if (pfx->ndpr_stateflags & NDPRF_DETACHED) 13863 continue; 13864 if (IN6_ARE_MASKED_ADDR_EQUAL(&pfx->ndpr_prefix.sin6_addr, 13865 &src6->sin6_addr, &pfx->ndpr_mask)) 13866 break; 13867 } 13868 /* no prefix entry in the prefix list */ 13869 if (pfx == NULL) { 13870 ND6_RUNLOCK(); 13871 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefix entry for "); 13872 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13873 return (0); 13874 } 13875 13876 SCTPDBG(SCTP_DEBUG_OUTPUT2, "v6src_match_nexthop(), Prefix entry is "); 13877 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13878 13879 /* search installed gateway from prefix entry */ 13880 LIST_FOREACH(pfxrtr, &pfx->ndpr_advrtrs, pfr_entry) { 13881 memset(&gw6, 0, sizeof(struct sockaddr_in6)); 13882 gw6.sin6_family = AF_INET6; 13883 gw6.sin6_len = sizeof(struct sockaddr_in6); 13884 memcpy(&gw6.sin6_addr, &pfxrtr->router->rtaddr, 13885 sizeof(struct in6_addr)); 13886 SCTPDBG(SCTP_DEBUG_OUTPUT2, "prefix router is "); 13887 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&gw6); 13888 SCTPDBG(SCTP_DEBUG_OUTPUT2, "installed router is "); 13889 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway); 13890 if (sctp_cmpaddr((struct sockaddr *)&gw6, ro->ro_rt->rt_gateway)) { 13891 ND6_RUNLOCK(); 13892 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is installed\n"); 13893 ND6_RUNLOCK(); 13894 return (1); 13895 } 13896 } 13897 ND6_RUNLOCK(); 13898 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is not installed\n"); 13899 return (0); 13900} 13901#endif 13902 13903int 13904sctp_v4src_match_nexthop(struct sctp_ifa *sifa, sctp_route_t *ro) 13905{ 13906#ifdef INET 13907 struct sockaddr_in *sin, *mask; 13908 struct ifaddr *ifa; 13909 struct in_addr srcnetaddr, gwnetaddr; 13910 13911 if (ro == NULL || ro->ro_rt == NULL || 13912 sifa->address.sa.sa_family != AF_INET) { 13913 return (0); 13914 } 13915 ifa = (struct ifaddr *)sifa->ifa; 13916 mask = (struct sockaddr_in *)(ifa->ifa_netmask); 13917 sin = &sifa->address.sin; 13918 srcnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13919 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: src address is "); 13920 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 13921 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", srcnetaddr.s_addr); 13922 13923 sin = (struct sockaddr_in *)ro->ro_rt->rt_gateway; 13924 gwnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13925 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: nexthop is "); 13926 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway); 13927 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", gwnetaddr.s_addr); 13928 if (srcnetaddr.s_addr == gwnetaddr.s_addr) { 13929 return (1); 13930 } 13931#endif 13932 return (0); 13933} 13934