sctp_output.c revision 331722
1/*- 2 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved. 3 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved. 4 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions are met: 8 * 9 * a) Redistributions of source code must retain the above copyright notice, 10 * this list of conditions and the following disclaimer. 11 * 12 * b) Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the distribution. 15 * 16 * c) Neither the name of Cisco Systems, Inc. nor the names of its 17 * contributors may be used to endorse or promote products derived 18 * from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 24 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 30 * THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33#include <sys/cdefs.h> 34__FBSDID("$FreeBSD: stable/11/sys/netinet/sctp_output.c 331722 2018-03-29 02:50:57Z eadler $"); 35 36#include <netinet/sctp_os.h> 37#include <sys/proc.h> 38#include <netinet/sctp_var.h> 39#include <netinet/sctp_sysctl.h> 40#include <netinet/sctp_header.h> 41#include <netinet/sctp_pcb.h> 42#include <netinet/sctputil.h> 43#include <netinet/sctp_output.h> 44#include <netinet/sctp_uio.h> 45#include <netinet/sctputil.h> 46#include <netinet/sctp_auth.h> 47#include <netinet/sctp_timer.h> 48#include <netinet/sctp_asconf.h> 49#include <netinet/sctp_indata.h> 50#include <netinet/sctp_bsd_addr.h> 51#include <netinet/sctp_input.h> 52#include <netinet/sctp_crc32.h> 53#if defined(INET) || defined(INET6) 54#include <netinet/udp.h> 55#endif 56#include <netinet/udp_var.h> 57#include <machine/in_cksum.h> 58 59 60 61#define SCTP_MAX_GAPS_INARRAY 4 62struct sack_track { 63 uint8_t right_edge; /* mergable on the right edge */ 64 uint8_t left_edge; /* mergable on the left edge */ 65 uint8_t num_entries; 66 uint8_t spare; 67 struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY]; 68}; 69 70const struct sack_track sack_array[256] = { 71 {0, 0, 0, 0, /* 0x00 */ 72 {{0, 0}, 73 {0, 0}, 74 {0, 0}, 75 {0, 0} 76 } 77 }, 78 {1, 0, 1, 0, /* 0x01 */ 79 {{0, 0}, 80 {0, 0}, 81 {0, 0}, 82 {0, 0} 83 } 84 }, 85 {0, 0, 1, 0, /* 0x02 */ 86 {{1, 1}, 87 {0, 0}, 88 {0, 0}, 89 {0, 0} 90 } 91 }, 92 {1, 0, 1, 0, /* 0x03 */ 93 {{0, 1}, 94 {0, 0}, 95 {0, 0}, 96 {0, 0} 97 } 98 }, 99 {0, 0, 1, 0, /* 0x04 */ 100 {{2, 2}, 101 {0, 0}, 102 {0, 0}, 103 {0, 0} 104 } 105 }, 106 {1, 0, 2, 0, /* 0x05 */ 107 {{0, 0}, 108 {2, 2}, 109 {0, 0}, 110 {0, 0} 111 } 112 }, 113 {0, 0, 1, 0, /* 0x06 */ 114 {{1, 2}, 115 {0, 0}, 116 {0, 0}, 117 {0, 0} 118 } 119 }, 120 {1, 0, 1, 0, /* 0x07 */ 121 {{0, 2}, 122 {0, 0}, 123 {0, 0}, 124 {0, 0} 125 } 126 }, 127 {0, 0, 1, 0, /* 0x08 */ 128 {{3, 3}, 129 {0, 0}, 130 {0, 0}, 131 {0, 0} 132 } 133 }, 134 {1, 0, 2, 0, /* 0x09 */ 135 {{0, 0}, 136 {3, 3}, 137 {0, 0}, 138 {0, 0} 139 } 140 }, 141 {0, 0, 2, 0, /* 0x0a */ 142 {{1, 1}, 143 {3, 3}, 144 {0, 0}, 145 {0, 0} 146 } 147 }, 148 {1, 0, 2, 0, /* 0x0b */ 149 {{0, 1}, 150 {3, 3}, 151 {0, 0}, 152 {0, 0} 153 } 154 }, 155 {0, 0, 1, 0, /* 0x0c */ 156 {{2, 3}, 157 {0, 0}, 158 {0, 0}, 159 {0, 0} 160 } 161 }, 162 {1, 0, 2, 0, /* 0x0d */ 163 {{0, 0}, 164 {2, 3}, 165 {0, 0}, 166 {0, 0} 167 } 168 }, 169 {0, 0, 1, 0, /* 0x0e */ 170 {{1, 3}, 171 {0, 0}, 172 {0, 0}, 173 {0, 0} 174 } 175 }, 176 {1, 0, 1, 0, /* 0x0f */ 177 {{0, 3}, 178 {0, 0}, 179 {0, 0}, 180 {0, 0} 181 } 182 }, 183 {0, 0, 1, 0, /* 0x10 */ 184 {{4, 4}, 185 {0, 0}, 186 {0, 0}, 187 {0, 0} 188 } 189 }, 190 {1, 0, 2, 0, /* 0x11 */ 191 {{0, 0}, 192 {4, 4}, 193 {0, 0}, 194 {0, 0} 195 } 196 }, 197 {0, 0, 2, 0, /* 0x12 */ 198 {{1, 1}, 199 {4, 4}, 200 {0, 0}, 201 {0, 0} 202 } 203 }, 204 {1, 0, 2, 0, /* 0x13 */ 205 {{0, 1}, 206 {4, 4}, 207 {0, 0}, 208 {0, 0} 209 } 210 }, 211 {0, 0, 2, 0, /* 0x14 */ 212 {{2, 2}, 213 {4, 4}, 214 {0, 0}, 215 {0, 0} 216 } 217 }, 218 {1, 0, 3, 0, /* 0x15 */ 219 {{0, 0}, 220 {2, 2}, 221 {4, 4}, 222 {0, 0} 223 } 224 }, 225 {0, 0, 2, 0, /* 0x16 */ 226 {{1, 2}, 227 {4, 4}, 228 {0, 0}, 229 {0, 0} 230 } 231 }, 232 {1, 0, 2, 0, /* 0x17 */ 233 {{0, 2}, 234 {4, 4}, 235 {0, 0}, 236 {0, 0} 237 } 238 }, 239 {0, 0, 1, 0, /* 0x18 */ 240 {{3, 4}, 241 {0, 0}, 242 {0, 0}, 243 {0, 0} 244 } 245 }, 246 {1, 0, 2, 0, /* 0x19 */ 247 {{0, 0}, 248 {3, 4}, 249 {0, 0}, 250 {0, 0} 251 } 252 }, 253 {0, 0, 2, 0, /* 0x1a */ 254 {{1, 1}, 255 {3, 4}, 256 {0, 0}, 257 {0, 0} 258 } 259 }, 260 {1, 0, 2, 0, /* 0x1b */ 261 {{0, 1}, 262 {3, 4}, 263 {0, 0}, 264 {0, 0} 265 } 266 }, 267 {0, 0, 1, 0, /* 0x1c */ 268 {{2, 4}, 269 {0, 0}, 270 {0, 0}, 271 {0, 0} 272 } 273 }, 274 {1, 0, 2, 0, /* 0x1d */ 275 {{0, 0}, 276 {2, 4}, 277 {0, 0}, 278 {0, 0} 279 } 280 }, 281 {0, 0, 1, 0, /* 0x1e */ 282 {{1, 4}, 283 {0, 0}, 284 {0, 0}, 285 {0, 0} 286 } 287 }, 288 {1, 0, 1, 0, /* 0x1f */ 289 {{0, 4}, 290 {0, 0}, 291 {0, 0}, 292 {0, 0} 293 } 294 }, 295 {0, 0, 1, 0, /* 0x20 */ 296 {{5, 5}, 297 {0, 0}, 298 {0, 0}, 299 {0, 0} 300 } 301 }, 302 {1, 0, 2, 0, /* 0x21 */ 303 {{0, 0}, 304 {5, 5}, 305 {0, 0}, 306 {0, 0} 307 } 308 }, 309 {0, 0, 2, 0, /* 0x22 */ 310 {{1, 1}, 311 {5, 5}, 312 {0, 0}, 313 {0, 0} 314 } 315 }, 316 {1, 0, 2, 0, /* 0x23 */ 317 {{0, 1}, 318 {5, 5}, 319 {0, 0}, 320 {0, 0} 321 } 322 }, 323 {0, 0, 2, 0, /* 0x24 */ 324 {{2, 2}, 325 {5, 5}, 326 {0, 0}, 327 {0, 0} 328 } 329 }, 330 {1, 0, 3, 0, /* 0x25 */ 331 {{0, 0}, 332 {2, 2}, 333 {5, 5}, 334 {0, 0} 335 } 336 }, 337 {0, 0, 2, 0, /* 0x26 */ 338 {{1, 2}, 339 {5, 5}, 340 {0, 0}, 341 {0, 0} 342 } 343 }, 344 {1, 0, 2, 0, /* 0x27 */ 345 {{0, 2}, 346 {5, 5}, 347 {0, 0}, 348 {0, 0} 349 } 350 }, 351 {0, 0, 2, 0, /* 0x28 */ 352 {{3, 3}, 353 {5, 5}, 354 {0, 0}, 355 {0, 0} 356 } 357 }, 358 {1, 0, 3, 0, /* 0x29 */ 359 {{0, 0}, 360 {3, 3}, 361 {5, 5}, 362 {0, 0} 363 } 364 }, 365 {0, 0, 3, 0, /* 0x2a */ 366 {{1, 1}, 367 {3, 3}, 368 {5, 5}, 369 {0, 0} 370 } 371 }, 372 {1, 0, 3, 0, /* 0x2b */ 373 {{0, 1}, 374 {3, 3}, 375 {5, 5}, 376 {0, 0} 377 } 378 }, 379 {0, 0, 2, 0, /* 0x2c */ 380 {{2, 3}, 381 {5, 5}, 382 {0, 0}, 383 {0, 0} 384 } 385 }, 386 {1, 0, 3, 0, /* 0x2d */ 387 {{0, 0}, 388 {2, 3}, 389 {5, 5}, 390 {0, 0} 391 } 392 }, 393 {0, 0, 2, 0, /* 0x2e */ 394 {{1, 3}, 395 {5, 5}, 396 {0, 0}, 397 {0, 0} 398 } 399 }, 400 {1, 0, 2, 0, /* 0x2f */ 401 {{0, 3}, 402 {5, 5}, 403 {0, 0}, 404 {0, 0} 405 } 406 }, 407 {0, 0, 1, 0, /* 0x30 */ 408 {{4, 5}, 409 {0, 0}, 410 {0, 0}, 411 {0, 0} 412 } 413 }, 414 {1, 0, 2, 0, /* 0x31 */ 415 {{0, 0}, 416 {4, 5}, 417 {0, 0}, 418 {0, 0} 419 } 420 }, 421 {0, 0, 2, 0, /* 0x32 */ 422 {{1, 1}, 423 {4, 5}, 424 {0, 0}, 425 {0, 0} 426 } 427 }, 428 {1, 0, 2, 0, /* 0x33 */ 429 {{0, 1}, 430 {4, 5}, 431 {0, 0}, 432 {0, 0} 433 } 434 }, 435 {0, 0, 2, 0, /* 0x34 */ 436 {{2, 2}, 437 {4, 5}, 438 {0, 0}, 439 {0, 0} 440 } 441 }, 442 {1, 0, 3, 0, /* 0x35 */ 443 {{0, 0}, 444 {2, 2}, 445 {4, 5}, 446 {0, 0} 447 } 448 }, 449 {0, 0, 2, 0, /* 0x36 */ 450 {{1, 2}, 451 {4, 5}, 452 {0, 0}, 453 {0, 0} 454 } 455 }, 456 {1, 0, 2, 0, /* 0x37 */ 457 {{0, 2}, 458 {4, 5}, 459 {0, 0}, 460 {0, 0} 461 } 462 }, 463 {0, 0, 1, 0, /* 0x38 */ 464 {{3, 5}, 465 {0, 0}, 466 {0, 0}, 467 {0, 0} 468 } 469 }, 470 {1, 0, 2, 0, /* 0x39 */ 471 {{0, 0}, 472 {3, 5}, 473 {0, 0}, 474 {0, 0} 475 } 476 }, 477 {0, 0, 2, 0, /* 0x3a */ 478 {{1, 1}, 479 {3, 5}, 480 {0, 0}, 481 {0, 0} 482 } 483 }, 484 {1, 0, 2, 0, /* 0x3b */ 485 {{0, 1}, 486 {3, 5}, 487 {0, 0}, 488 {0, 0} 489 } 490 }, 491 {0, 0, 1, 0, /* 0x3c */ 492 {{2, 5}, 493 {0, 0}, 494 {0, 0}, 495 {0, 0} 496 } 497 }, 498 {1, 0, 2, 0, /* 0x3d */ 499 {{0, 0}, 500 {2, 5}, 501 {0, 0}, 502 {0, 0} 503 } 504 }, 505 {0, 0, 1, 0, /* 0x3e */ 506 {{1, 5}, 507 {0, 0}, 508 {0, 0}, 509 {0, 0} 510 } 511 }, 512 {1, 0, 1, 0, /* 0x3f */ 513 {{0, 5}, 514 {0, 0}, 515 {0, 0}, 516 {0, 0} 517 } 518 }, 519 {0, 0, 1, 0, /* 0x40 */ 520 {{6, 6}, 521 {0, 0}, 522 {0, 0}, 523 {0, 0} 524 } 525 }, 526 {1, 0, 2, 0, /* 0x41 */ 527 {{0, 0}, 528 {6, 6}, 529 {0, 0}, 530 {0, 0} 531 } 532 }, 533 {0, 0, 2, 0, /* 0x42 */ 534 {{1, 1}, 535 {6, 6}, 536 {0, 0}, 537 {0, 0} 538 } 539 }, 540 {1, 0, 2, 0, /* 0x43 */ 541 {{0, 1}, 542 {6, 6}, 543 {0, 0}, 544 {0, 0} 545 } 546 }, 547 {0, 0, 2, 0, /* 0x44 */ 548 {{2, 2}, 549 {6, 6}, 550 {0, 0}, 551 {0, 0} 552 } 553 }, 554 {1, 0, 3, 0, /* 0x45 */ 555 {{0, 0}, 556 {2, 2}, 557 {6, 6}, 558 {0, 0} 559 } 560 }, 561 {0, 0, 2, 0, /* 0x46 */ 562 {{1, 2}, 563 {6, 6}, 564 {0, 0}, 565 {0, 0} 566 } 567 }, 568 {1, 0, 2, 0, /* 0x47 */ 569 {{0, 2}, 570 {6, 6}, 571 {0, 0}, 572 {0, 0} 573 } 574 }, 575 {0, 0, 2, 0, /* 0x48 */ 576 {{3, 3}, 577 {6, 6}, 578 {0, 0}, 579 {0, 0} 580 } 581 }, 582 {1, 0, 3, 0, /* 0x49 */ 583 {{0, 0}, 584 {3, 3}, 585 {6, 6}, 586 {0, 0} 587 } 588 }, 589 {0, 0, 3, 0, /* 0x4a */ 590 {{1, 1}, 591 {3, 3}, 592 {6, 6}, 593 {0, 0} 594 } 595 }, 596 {1, 0, 3, 0, /* 0x4b */ 597 {{0, 1}, 598 {3, 3}, 599 {6, 6}, 600 {0, 0} 601 } 602 }, 603 {0, 0, 2, 0, /* 0x4c */ 604 {{2, 3}, 605 {6, 6}, 606 {0, 0}, 607 {0, 0} 608 } 609 }, 610 {1, 0, 3, 0, /* 0x4d */ 611 {{0, 0}, 612 {2, 3}, 613 {6, 6}, 614 {0, 0} 615 } 616 }, 617 {0, 0, 2, 0, /* 0x4e */ 618 {{1, 3}, 619 {6, 6}, 620 {0, 0}, 621 {0, 0} 622 } 623 }, 624 {1, 0, 2, 0, /* 0x4f */ 625 {{0, 3}, 626 {6, 6}, 627 {0, 0}, 628 {0, 0} 629 } 630 }, 631 {0, 0, 2, 0, /* 0x50 */ 632 {{4, 4}, 633 {6, 6}, 634 {0, 0}, 635 {0, 0} 636 } 637 }, 638 {1, 0, 3, 0, /* 0x51 */ 639 {{0, 0}, 640 {4, 4}, 641 {6, 6}, 642 {0, 0} 643 } 644 }, 645 {0, 0, 3, 0, /* 0x52 */ 646 {{1, 1}, 647 {4, 4}, 648 {6, 6}, 649 {0, 0} 650 } 651 }, 652 {1, 0, 3, 0, /* 0x53 */ 653 {{0, 1}, 654 {4, 4}, 655 {6, 6}, 656 {0, 0} 657 } 658 }, 659 {0, 0, 3, 0, /* 0x54 */ 660 {{2, 2}, 661 {4, 4}, 662 {6, 6}, 663 {0, 0} 664 } 665 }, 666 {1, 0, 4, 0, /* 0x55 */ 667 {{0, 0}, 668 {2, 2}, 669 {4, 4}, 670 {6, 6} 671 } 672 }, 673 {0, 0, 3, 0, /* 0x56 */ 674 {{1, 2}, 675 {4, 4}, 676 {6, 6}, 677 {0, 0} 678 } 679 }, 680 {1, 0, 3, 0, /* 0x57 */ 681 {{0, 2}, 682 {4, 4}, 683 {6, 6}, 684 {0, 0} 685 } 686 }, 687 {0, 0, 2, 0, /* 0x58 */ 688 {{3, 4}, 689 {6, 6}, 690 {0, 0}, 691 {0, 0} 692 } 693 }, 694 {1, 0, 3, 0, /* 0x59 */ 695 {{0, 0}, 696 {3, 4}, 697 {6, 6}, 698 {0, 0} 699 } 700 }, 701 {0, 0, 3, 0, /* 0x5a */ 702 {{1, 1}, 703 {3, 4}, 704 {6, 6}, 705 {0, 0} 706 } 707 }, 708 {1, 0, 3, 0, /* 0x5b */ 709 {{0, 1}, 710 {3, 4}, 711 {6, 6}, 712 {0, 0} 713 } 714 }, 715 {0, 0, 2, 0, /* 0x5c */ 716 {{2, 4}, 717 {6, 6}, 718 {0, 0}, 719 {0, 0} 720 } 721 }, 722 {1, 0, 3, 0, /* 0x5d */ 723 {{0, 0}, 724 {2, 4}, 725 {6, 6}, 726 {0, 0} 727 } 728 }, 729 {0, 0, 2, 0, /* 0x5e */ 730 {{1, 4}, 731 {6, 6}, 732 {0, 0}, 733 {0, 0} 734 } 735 }, 736 {1, 0, 2, 0, /* 0x5f */ 737 {{0, 4}, 738 {6, 6}, 739 {0, 0}, 740 {0, 0} 741 } 742 }, 743 {0, 0, 1, 0, /* 0x60 */ 744 {{5, 6}, 745 {0, 0}, 746 {0, 0}, 747 {0, 0} 748 } 749 }, 750 {1, 0, 2, 0, /* 0x61 */ 751 {{0, 0}, 752 {5, 6}, 753 {0, 0}, 754 {0, 0} 755 } 756 }, 757 {0, 0, 2, 0, /* 0x62 */ 758 {{1, 1}, 759 {5, 6}, 760 {0, 0}, 761 {0, 0} 762 } 763 }, 764 {1, 0, 2, 0, /* 0x63 */ 765 {{0, 1}, 766 {5, 6}, 767 {0, 0}, 768 {0, 0} 769 } 770 }, 771 {0, 0, 2, 0, /* 0x64 */ 772 {{2, 2}, 773 {5, 6}, 774 {0, 0}, 775 {0, 0} 776 } 777 }, 778 {1, 0, 3, 0, /* 0x65 */ 779 {{0, 0}, 780 {2, 2}, 781 {5, 6}, 782 {0, 0} 783 } 784 }, 785 {0, 0, 2, 0, /* 0x66 */ 786 {{1, 2}, 787 {5, 6}, 788 {0, 0}, 789 {0, 0} 790 } 791 }, 792 {1, 0, 2, 0, /* 0x67 */ 793 {{0, 2}, 794 {5, 6}, 795 {0, 0}, 796 {0, 0} 797 } 798 }, 799 {0, 0, 2, 0, /* 0x68 */ 800 {{3, 3}, 801 {5, 6}, 802 {0, 0}, 803 {0, 0} 804 } 805 }, 806 {1, 0, 3, 0, /* 0x69 */ 807 {{0, 0}, 808 {3, 3}, 809 {5, 6}, 810 {0, 0} 811 } 812 }, 813 {0, 0, 3, 0, /* 0x6a */ 814 {{1, 1}, 815 {3, 3}, 816 {5, 6}, 817 {0, 0} 818 } 819 }, 820 {1, 0, 3, 0, /* 0x6b */ 821 {{0, 1}, 822 {3, 3}, 823 {5, 6}, 824 {0, 0} 825 } 826 }, 827 {0, 0, 2, 0, /* 0x6c */ 828 {{2, 3}, 829 {5, 6}, 830 {0, 0}, 831 {0, 0} 832 } 833 }, 834 {1, 0, 3, 0, /* 0x6d */ 835 {{0, 0}, 836 {2, 3}, 837 {5, 6}, 838 {0, 0} 839 } 840 }, 841 {0, 0, 2, 0, /* 0x6e */ 842 {{1, 3}, 843 {5, 6}, 844 {0, 0}, 845 {0, 0} 846 } 847 }, 848 {1, 0, 2, 0, /* 0x6f */ 849 {{0, 3}, 850 {5, 6}, 851 {0, 0}, 852 {0, 0} 853 } 854 }, 855 {0, 0, 1, 0, /* 0x70 */ 856 {{4, 6}, 857 {0, 0}, 858 {0, 0}, 859 {0, 0} 860 } 861 }, 862 {1, 0, 2, 0, /* 0x71 */ 863 {{0, 0}, 864 {4, 6}, 865 {0, 0}, 866 {0, 0} 867 } 868 }, 869 {0, 0, 2, 0, /* 0x72 */ 870 {{1, 1}, 871 {4, 6}, 872 {0, 0}, 873 {0, 0} 874 } 875 }, 876 {1, 0, 2, 0, /* 0x73 */ 877 {{0, 1}, 878 {4, 6}, 879 {0, 0}, 880 {0, 0} 881 } 882 }, 883 {0, 0, 2, 0, /* 0x74 */ 884 {{2, 2}, 885 {4, 6}, 886 {0, 0}, 887 {0, 0} 888 } 889 }, 890 {1, 0, 3, 0, /* 0x75 */ 891 {{0, 0}, 892 {2, 2}, 893 {4, 6}, 894 {0, 0} 895 } 896 }, 897 {0, 0, 2, 0, /* 0x76 */ 898 {{1, 2}, 899 {4, 6}, 900 {0, 0}, 901 {0, 0} 902 } 903 }, 904 {1, 0, 2, 0, /* 0x77 */ 905 {{0, 2}, 906 {4, 6}, 907 {0, 0}, 908 {0, 0} 909 } 910 }, 911 {0, 0, 1, 0, /* 0x78 */ 912 {{3, 6}, 913 {0, 0}, 914 {0, 0}, 915 {0, 0} 916 } 917 }, 918 {1, 0, 2, 0, /* 0x79 */ 919 {{0, 0}, 920 {3, 6}, 921 {0, 0}, 922 {0, 0} 923 } 924 }, 925 {0, 0, 2, 0, /* 0x7a */ 926 {{1, 1}, 927 {3, 6}, 928 {0, 0}, 929 {0, 0} 930 } 931 }, 932 {1, 0, 2, 0, /* 0x7b */ 933 {{0, 1}, 934 {3, 6}, 935 {0, 0}, 936 {0, 0} 937 } 938 }, 939 {0, 0, 1, 0, /* 0x7c */ 940 {{2, 6}, 941 {0, 0}, 942 {0, 0}, 943 {0, 0} 944 } 945 }, 946 {1, 0, 2, 0, /* 0x7d */ 947 {{0, 0}, 948 {2, 6}, 949 {0, 0}, 950 {0, 0} 951 } 952 }, 953 {0, 0, 1, 0, /* 0x7e */ 954 {{1, 6}, 955 {0, 0}, 956 {0, 0}, 957 {0, 0} 958 } 959 }, 960 {1, 0, 1, 0, /* 0x7f */ 961 {{0, 6}, 962 {0, 0}, 963 {0, 0}, 964 {0, 0} 965 } 966 }, 967 {0, 1, 1, 0, /* 0x80 */ 968 {{7, 7}, 969 {0, 0}, 970 {0, 0}, 971 {0, 0} 972 } 973 }, 974 {1, 1, 2, 0, /* 0x81 */ 975 {{0, 0}, 976 {7, 7}, 977 {0, 0}, 978 {0, 0} 979 } 980 }, 981 {0, 1, 2, 0, /* 0x82 */ 982 {{1, 1}, 983 {7, 7}, 984 {0, 0}, 985 {0, 0} 986 } 987 }, 988 {1, 1, 2, 0, /* 0x83 */ 989 {{0, 1}, 990 {7, 7}, 991 {0, 0}, 992 {0, 0} 993 } 994 }, 995 {0, 1, 2, 0, /* 0x84 */ 996 {{2, 2}, 997 {7, 7}, 998 {0, 0}, 999 {0, 0} 1000 } 1001 }, 1002 {1, 1, 3, 0, /* 0x85 */ 1003 {{0, 0}, 1004 {2, 2}, 1005 {7, 7}, 1006 {0, 0} 1007 } 1008 }, 1009 {0, 1, 2, 0, /* 0x86 */ 1010 {{1, 2}, 1011 {7, 7}, 1012 {0, 0}, 1013 {0, 0} 1014 } 1015 }, 1016 {1, 1, 2, 0, /* 0x87 */ 1017 {{0, 2}, 1018 {7, 7}, 1019 {0, 0}, 1020 {0, 0} 1021 } 1022 }, 1023 {0, 1, 2, 0, /* 0x88 */ 1024 {{3, 3}, 1025 {7, 7}, 1026 {0, 0}, 1027 {0, 0} 1028 } 1029 }, 1030 {1, 1, 3, 0, /* 0x89 */ 1031 {{0, 0}, 1032 {3, 3}, 1033 {7, 7}, 1034 {0, 0} 1035 } 1036 }, 1037 {0, 1, 3, 0, /* 0x8a */ 1038 {{1, 1}, 1039 {3, 3}, 1040 {7, 7}, 1041 {0, 0} 1042 } 1043 }, 1044 {1, 1, 3, 0, /* 0x8b */ 1045 {{0, 1}, 1046 {3, 3}, 1047 {7, 7}, 1048 {0, 0} 1049 } 1050 }, 1051 {0, 1, 2, 0, /* 0x8c */ 1052 {{2, 3}, 1053 {7, 7}, 1054 {0, 0}, 1055 {0, 0} 1056 } 1057 }, 1058 {1, 1, 3, 0, /* 0x8d */ 1059 {{0, 0}, 1060 {2, 3}, 1061 {7, 7}, 1062 {0, 0} 1063 } 1064 }, 1065 {0, 1, 2, 0, /* 0x8e */ 1066 {{1, 3}, 1067 {7, 7}, 1068 {0, 0}, 1069 {0, 0} 1070 } 1071 }, 1072 {1, 1, 2, 0, /* 0x8f */ 1073 {{0, 3}, 1074 {7, 7}, 1075 {0, 0}, 1076 {0, 0} 1077 } 1078 }, 1079 {0, 1, 2, 0, /* 0x90 */ 1080 {{4, 4}, 1081 {7, 7}, 1082 {0, 0}, 1083 {0, 0} 1084 } 1085 }, 1086 {1, 1, 3, 0, /* 0x91 */ 1087 {{0, 0}, 1088 {4, 4}, 1089 {7, 7}, 1090 {0, 0} 1091 } 1092 }, 1093 {0, 1, 3, 0, /* 0x92 */ 1094 {{1, 1}, 1095 {4, 4}, 1096 {7, 7}, 1097 {0, 0} 1098 } 1099 }, 1100 {1, 1, 3, 0, /* 0x93 */ 1101 {{0, 1}, 1102 {4, 4}, 1103 {7, 7}, 1104 {0, 0} 1105 } 1106 }, 1107 {0, 1, 3, 0, /* 0x94 */ 1108 {{2, 2}, 1109 {4, 4}, 1110 {7, 7}, 1111 {0, 0} 1112 } 1113 }, 1114 {1, 1, 4, 0, /* 0x95 */ 1115 {{0, 0}, 1116 {2, 2}, 1117 {4, 4}, 1118 {7, 7} 1119 } 1120 }, 1121 {0, 1, 3, 0, /* 0x96 */ 1122 {{1, 2}, 1123 {4, 4}, 1124 {7, 7}, 1125 {0, 0} 1126 } 1127 }, 1128 {1, 1, 3, 0, /* 0x97 */ 1129 {{0, 2}, 1130 {4, 4}, 1131 {7, 7}, 1132 {0, 0} 1133 } 1134 }, 1135 {0, 1, 2, 0, /* 0x98 */ 1136 {{3, 4}, 1137 {7, 7}, 1138 {0, 0}, 1139 {0, 0} 1140 } 1141 }, 1142 {1, 1, 3, 0, /* 0x99 */ 1143 {{0, 0}, 1144 {3, 4}, 1145 {7, 7}, 1146 {0, 0} 1147 } 1148 }, 1149 {0, 1, 3, 0, /* 0x9a */ 1150 {{1, 1}, 1151 {3, 4}, 1152 {7, 7}, 1153 {0, 0} 1154 } 1155 }, 1156 {1, 1, 3, 0, /* 0x9b */ 1157 {{0, 1}, 1158 {3, 4}, 1159 {7, 7}, 1160 {0, 0} 1161 } 1162 }, 1163 {0, 1, 2, 0, /* 0x9c */ 1164 {{2, 4}, 1165 {7, 7}, 1166 {0, 0}, 1167 {0, 0} 1168 } 1169 }, 1170 {1, 1, 3, 0, /* 0x9d */ 1171 {{0, 0}, 1172 {2, 4}, 1173 {7, 7}, 1174 {0, 0} 1175 } 1176 }, 1177 {0, 1, 2, 0, /* 0x9e */ 1178 {{1, 4}, 1179 {7, 7}, 1180 {0, 0}, 1181 {0, 0} 1182 } 1183 }, 1184 {1, 1, 2, 0, /* 0x9f */ 1185 {{0, 4}, 1186 {7, 7}, 1187 {0, 0}, 1188 {0, 0} 1189 } 1190 }, 1191 {0, 1, 2, 0, /* 0xa0 */ 1192 {{5, 5}, 1193 {7, 7}, 1194 {0, 0}, 1195 {0, 0} 1196 } 1197 }, 1198 {1, 1, 3, 0, /* 0xa1 */ 1199 {{0, 0}, 1200 {5, 5}, 1201 {7, 7}, 1202 {0, 0} 1203 } 1204 }, 1205 {0, 1, 3, 0, /* 0xa2 */ 1206 {{1, 1}, 1207 {5, 5}, 1208 {7, 7}, 1209 {0, 0} 1210 } 1211 }, 1212 {1, 1, 3, 0, /* 0xa3 */ 1213 {{0, 1}, 1214 {5, 5}, 1215 {7, 7}, 1216 {0, 0} 1217 } 1218 }, 1219 {0, 1, 3, 0, /* 0xa4 */ 1220 {{2, 2}, 1221 {5, 5}, 1222 {7, 7}, 1223 {0, 0} 1224 } 1225 }, 1226 {1, 1, 4, 0, /* 0xa5 */ 1227 {{0, 0}, 1228 {2, 2}, 1229 {5, 5}, 1230 {7, 7} 1231 } 1232 }, 1233 {0, 1, 3, 0, /* 0xa6 */ 1234 {{1, 2}, 1235 {5, 5}, 1236 {7, 7}, 1237 {0, 0} 1238 } 1239 }, 1240 {1, 1, 3, 0, /* 0xa7 */ 1241 {{0, 2}, 1242 {5, 5}, 1243 {7, 7}, 1244 {0, 0} 1245 } 1246 }, 1247 {0, 1, 3, 0, /* 0xa8 */ 1248 {{3, 3}, 1249 {5, 5}, 1250 {7, 7}, 1251 {0, 0} 1252 } 1253 }, 1254 {1, 1, 4, 0, /* 0xa9 */ 1255 {{0, 0}, 1256 {3, 3}, 1257 {5, 5}, 1258 {7, 7} 1259 } 1260 }, 1261 {0, 1, 4, 0, /* 0xaa */ 1262 {{1, 1}, 1263 {3, 3}, 1264 {5, 5}, 1265 {7, 7} 1266 } 1267 }, 1268 {1, 1, 4, 0, /* 0xab */ 1269 {{0, 1}, 1270 {3, 3}, 1271 {5, 5}, 1272 {7, 7} 1273 } 1274 }, 1275 {0, 1, 3, 0, /* 0xac */ 1276 {{2, 3}, 1277 {5, 5}, 1278 {7, 7}, 1279 {0, 0} 1280 } 1281 }, 1282 {1, 1, 4, 0, /* 0xad */ 1283 {{0, 0}, 1284 {2, 3}, 1285 {5, 5}, 1286 {7, 7} 1287 } 1288 }, 1289 {0, 1, 3, 0, /* 0xae */ 1290 {{1, 3}, 1291 {5, 5}, 1292 {7, 7}, 1293 {0, 0} 1294 } 1295 }, 1296 {1, 1, 3, 0, /* 0xaf */ 1297 {{0, 3}, 1298 {5, 5}, 1299 {7, 7}, 1300 {0, 0} 1301 } 1302 }, 1303 {0, 1, 2, 0, /* 0xb0 */ 1304 {{4, 5}, 1305 {7, 7}, 1306 {0, 0}, 1307 {0, 0} 1308 } 1309 }, 1310 {1, 1, 3, 0, /* 0xb1 */ 1311 {{0, 0}, 1312 {4, 5}, 1313 {7, 7}, 1314 {0, 0} 1315 } 1316 }, 1317 {0, 1, 3, 0, /* 0xb2 */ 1318 {{1, 1}, 1319 {4, 5}, 1320 {7, 7}, 1321 {0, 0} 1322 } 1323 }, 1324 {1, 1, 3, 0, /* 0xb3 */ 1325 {{0, 1}, 1326 {4, 5}, 1327 {7, 7}, 1328 {0, 0} 1329 } 1330 }, 1331 {0, 1, 3, 0, /* 0xb4 */ 1332 {{2, 2}, 1333 {4, 5}, 1334 {7, 7}, 1335 {0, 0} 1336 } 1337 }, 1338 {1, 1, 4, 0, /* 0xb5 */ 1339 {{0, 0}, 1340 {2, 2}, 1341 {4, 5}, 1342 {7, 7} 1343 } 1344 }, 1345 {0, 1, 3, 0, /* 0xb6 */ 1346 {{1, 2}, 1347 {4, 5}, 1348 {7, 7}, 1349 {0, 0} 1350 } 1351 }, 1352 {1, 1, 3, 0, /* 0xb7 */ 1353 {{0, 2}, 1354 {4, 5}, 1355 {7, 7}, 1356 {0, 0} 1357 } 1358 }, 1359 {0, 1, 2, 0, /* 0xb8 */ 1360 {{3, 5}, 1361 {7, 7}, 1362 {0, 0}, 1363 {0, 0} 1364 } 1365 }, 1366 {1, 1, 3, 0, /* 0xb9 */ 1367 {{0, 0}, 1368 {3, 5}, 1369 {7, 7}, 1370 {0, 0} 1371 } 1372 }, 1373 {0, 1, 3, 0, /* 0xba */ 1374 {{1, 1}, 1375 {3, 5}, 1376 {7, 7}, 1377 {0, 0} 1378 } 1379 }, 1380 {1, 1, 3, 0, /* 0xbb */ 1381 {{0, 1}, 1382 {3, 5}, 1383 {7, 7}, 1384 {0, 0} 1385 } 1386 }, 1387 {0, 1, 2, 0, /* 0xbc */ 1388 {{2, 5}, 1389 {7, 7}, 1390 {0, 0}, 1391 {0, 0} 1392 } 1393 }, 1394 {1, 1, 3, 0, /* 0xbd */ 1395 {{0, 0}, 1396 {2, 5}, 1397 {7, 7}, 1398 {0, 0} 1399 } 1400 }, 1401 {0, 1, 2, 0, /* 0xbe */ 1402 {{1, 5}, 1403 {7, 7}, 1404 {0, 0}, 1405 {0, 0} 1406 } 1407 }, 1408 {1, 1, 2, 0, /* 0xbf */ 1409 {{0, 5}, 1410 {7, 7}, 1411 {0, 0}, 1412 {0, 0} 1413 } 1414 }, 1415 {0, 1, 1, 0, /* 0xc0 */ 1416 {{6, 7}, 1417 {0, 0}, 1418 {0, 0}, 1419 {0, 0} 1420 } 1421 }, 1422 {1, 1, 2, 0, /* 0xc1 */ 1423 {{0, 0}, 1424 {6, 7}, 1425 {0, 0}, 1426 {0, 0} 1427 } 1428 }, 1429 {0, 1, 2, 0, /* 0xc2 */ 1430 {{1, 1}, 1431 {6, 7}, 1432 {0, 0}, 1433 {0, 0} 1434 } 1435 }, 1436 {1, 1, 2, 0, /* 0xc3 */ 1437 {{0, 1}, 1438 {6, 7}, 1439 {0, 0}, 1440 {0, 0} 1441 } 1442 }, 1443 {0, 1, 2, 0, /* 0xc4 */ 1444 {{2, 2}, 1445 {6, 7}, 1446 {0, 0}, 1447 {0, 0} 1448 } 1449 }, 1450 {1, 1, 3, 0, /* 0xc5 */ 1451 {{0, 0}, 1452 {2, 2}, 1453 {6, 7}, 1454 {0, 0} 1455 } 1456 }, 1457 {0, 1, 2, 0, /* 0xc6 */ 1458 {{1, 2}, 1459 {6, 7}, 1460 {0, 0}, 1461 {0, 0} 1462 } 1463 }, 1464 {1, 1, 2, 0, /* 0xc7 */ 1465 {{0, 2}, 1466 {6, 7}, 1467 {0, 0}, 1468 {0, 0} 1469 } 1470 }, 1471 {0, 1, 2, 0, /* 0xc8 */ 1472 {{3, 3}, 1473 {6, 7}, 1474 {0, 0}, 1475 {0, 0} 1476 } 1477 }, 1478 {1, 1, 3, 0, /* 0xc9 */ 1479 {{0, 0}, 1480 {3, 3}, 1481 {6, 7}, 1482 {0, 0} 1483 } 1484 }, 1485 {0, 1, 3, 0, /* 0xca */ 1486 {{1, 1}, 1487 {3, 3}, 1488 {6, 7}, 1489 {0, 0} 1490 } 1491 }, 1492 {1, 1, 3, 0, /* 0xcb */ 1493 {{0, 1}, 1494 {3, 3}, 1495 {6, 7}, 1496 {0, 0} 1497 } 1498 }, 1499 {0, 1, 2, 0, /* 0xcc */ 1500 {{2, 3}, 1501 {6, 7}, 1502 {0, 0}, 1503 {0, 0} 1504 } 1505 }, 1506 {1, 1, 3, 0, /* 0xcd */ 1507 {{0, 0}, 1508 {2, 3}, 1509 {6, 7}, 1510 {0, 0} 1511 } 1512 }, 1513 {0, 1, 2, 0, /* 0xce */ 1514 {{1, 3}, 1515 {6, 7}, 1516 {0, 0}, 1517 {0, 0} 1518 } 1519 }, 1520 {1, 1, 2, 0, /* 0xcf */ 1521 {{0, 3}, 1522 {6, 7}, 1523 {0, 0}, 1524 {0, 0} 1525 } 1526 }, 1527 {0, 1, 2, 0, /* 0xd0 */ 1528 {{4, 4}, 1529 {6, 7}, 1530 {0, 0}, 1531 {0, 0} 1532 } 1533 }, 1534 {1, 1, 3, 0, /* 0xd1 */ 1535 {{0, 0}, 1536 {4, 4}, 1537 {6, 7}, 1538 {0, 0} 1539 } 1540 }, 1541 {0, 1, 3, 0, /* 0xd2 */ 1542 {{1, 1}, 1543 {4, 4}, 1544 {6, 7}, 1545 {0, 0} 1546 } 1547 }, 1548 {1, 1, 3, 0, /* 0xd3 */ 1549 {{0, 1}, 1550 {4, 4}, 1551 {6, 7}, 1552 {0, 0} 1553 } 1554 }, 1555 {0, 1, 3, 0, /* 0xd4 */ 1556 {{2, 2}, 1557 {4, 4}, 1558 {6, 7}, 1559 {0, 0} 1560 } 1561 }, 1562 {1, 1, 4, 0, /* 0xd5 */ 1563 {{0, 0}, 1564 {2, 2}, 1565 {4, 4}, 1566 {6, 7} 1567 } 1568 }, 1569 {0, 1, 3, 0, /* 0xd6 */ 1570 {{1, 2}, 1571 {4, 4}, 1572 {6, 7}, 1573 {0, 0} 1574 } 1575 }, 1576 {1, 1, 3, 0, /* 0xd7 */ 1577 {{0, 2}, 1578 {4, 4}, 1579 {6, 7}, 1580 {0, 0} 1581 } 1582 }, 1583 {0, 1, 2, 0, /* 0xd8 */ 1584 {{3, 4}, 1585 {6, 7}, 1586 {0, 0}, 1587 {0, 0} 1588 } 1589 }, 1590 {1, 1, 3, 0, /* 0xd9 */ 1591 {{0, 0}, 1592 {3, 4}, 1593 {6, 7}, 1594 {0, 0} 1595 } 1596 }, 1597 {0, 1, 3, 0, /* 0xda */ 1598 {{1, 1}, 1599 {3, 4}, 1600 {6, 7}, 1601 {0, 0} 1602 } 1603 }, 1604 {1, 1, 3, 0, /* 0xdb */ 1605 {{0, 1}, 1606 {3, 4}, 1607 {6, 7}, 1608 {0, 0} 1609 } 1610 }, 1611 {0, 1, 2, 0, /* 0xdc */ 1612 {{2, 4}, 1613 {6, 7}, 1614 {0, 0}, 1615 {0, 0} 1616 } 1617 }, 1618 {1, 1, 3, 0, /* 0xdd */ 1619 {{0, 0}, 1620 {2, 4}, 1621 {6, 7}, 1622 {0, 0} 1623 } 1624 }, 1625 {0, 1, 2, 0, /* 0xde */ 1626 {{1, 4}, 1627 {6, 7}, 1628 {0, 0}, 1629 {0, 0} 1630 } 1631 }, 1632 {1, 1, 2, 0, /* 0xdf */ 1633 {{0, 4}, 1634 {6, 7}, 1635 {0, 0}, 1636 {0, 0} 1637 } 1638 }, 1639 {0, 1, 1, 0, /* 0xe0 */ 1640 {{5, 7}, 1641 {0, 0}, 1642 {0, 0}, 1643 {0, 0} 1644 } 1645 }, 1646 {1, 1, 2, 0, /* 0xe1 */ 1647 {{0, 0}, 1648 {5, 7}, 1649 {0, 0}, 1650 {0, 0} 1651 } 1652 }, 1653 {0, 1, 2, 0, /* 0xe2 */ 1654 {{1, 1}, 1655 {5, 7}, 1656 {0, 0}, 1657 {0, 0} 1658 } 1659 }, 1660 {1, 1, 2, 0, /* 0xe3 */ 1661 {{0, 1}, 1662 {5, 7}, 1663 {0, 0}, 1664 {0, 0} 1665 } 1666 }, 1667 {0, 1, 2, 0, /* 0xe4 */ 1668 {{2, 2}, 1669 {5, 7}, 1670 {0, 0}, 1671 {0, 0} 1672 } 1673 }, 1674 {1, 1, 3, 0, /* 0xe5 */ 1675 {{0, 0}, 1676 {2, 2}, 1677 {5, 7}, 1678 {0, 0} 1679 } 1680 }, 1681 {0, 1, 2, 0, /* 0xe6 */ 1682 {{1, 2}, 1683 {5, 7}, 1684 {0, 0}, 1685 {0, 0} 1686 } 1687 }, 1688 {1, 1, 2, 0, /* 0xe7 */ 1689 {{0, 2}, 1690 {5, 7}, 1691 {0, 0}, 1692 {0, 0} 1693 } 1694 }, 1695 {0, 1, 2, 0, /* 0xe8 */ 1696 {{3, 3}, 1697 {5, 7}, 1698 {0, 0}, 1699 {0, 0} 1700 } 1701 }, 1702 {1, 1, 3, 0, /* 0xe9 */ 1703 {{0, 0}, 1704 {3, 3}, 1705 {5, 7}, 1706 {0, 0} 1707 } 1708 }, 1709 {0, 1, 3, 0, /* 0xea */ 1710 {{1, 1}, 1711 {3, 3}, 1712 {5, 7}, 1713 {0, 0} 1714 } 1715 }, 1716 {1, 1, 3, 0, /* 0xeb */ 1717 {{0, 1}, 1718 {3, 3}, 1719 {5, 7}, 1720 {0, 0} 1721 } 1722 }, 1723 {0, 1, 2, 0, /* 0xec */ 1724 {{2, 3}, 1725 {5, 7}, 1726 {0, 0}, 1727 {0, 0} 1728 } 1729 }, 1730 {1, 1, 3, 0, /* 0xed */ 1731 {{0, 0}, 1732 {2, 3}, 1733 {5, 7}, 1734 {0, 0} 1735 } 1736 }, 1737 {0, 1, 2, 0, /* 0xee */ 1738 {{1, 3}, 1739 {5, 7}, 1740 {0, 0}, 1741 {0, 0} 1742 } 1743 }, 1744 {1, 1, 2, 0, /* 0xef */ 1745 {{0, 3}, 1746 {5, 7}, 1747 {0, 0}, 1748 {0, 0} 1749 } 1750 }, 1751 {0, 1, 1, 0, /* 0xf0 */ 1752 {{4, 7}, 1753 {0, 0}, 1754 {0, 0}, 1755 {0, 0} 1756 } 1757 }, 1758 {1, 1, 2, 0, /* 0xf1 */ 1759 {{0, 0}, 1760 {4, 7}, 1761 {0, 0}, 1762 {0, 0} 1763 } 1764 }, 1765 {0, 1, 2, 0, /* 0xf2 */ 1766 {{1, 1}, 1767 {4, 7}, 1768 {0, 0}, 1769 {0, 0} 1770 } 1771 }, 1772 {1, 1, 2, 0, /* 0xf3 */ 1773 {{0, 1}, 1774 {4, 7}, 1775 {0, 0}, 1776 {0, 0} 1777 } 1778 }, 1779 {0, 1, 2, 0, /* 0xf4 */ 1780 {{2, 2}, 1781 {4, 7}, 1782 {0, 0}, 1783 {0, 0} 1784 } 1785 }, 1786 {1, 1, 3, 0, /* 0xf5 */ 1787 {{0, 0}, 1788 {2, 2}, 1789 {4, 7}, 1790 {0, 0} 1791 } 1792 }, 1793 {0, 1, 2, 0, /* 0xf6 */ 1794 {{1, 2}, 1795 {4, 7}, 1796 {0, 0}, 1797 {0, 0} 1798 } 1799 }, 1800 {1, 1, 2, 0, /* 0xf7 */ 1801 {{0, 2}, 1802 {4, 7}, 1803 {0, 0}, 1804 {0, 0} 1805 } 1806 }, 1807 {0, 1, 1, 0, /* 0xf8 */ 1808 {{3, 7}, 1809 {0, 0}, 1810 {0, 0}, 1811 {0, 0} 1812 } 1813 }, 1814 {1, 1, 2, 0, /* 0xf9 */ 1815 {{0, 0}, 1816 {3, 7}, 1817 {0, 0}, 1818 {0, 0} 1819 } 1820 }, 1821 {0, 1, 2, 0, /* 0xfa */ 1822 {{1, 1}, 1823 {3, 7}, 1824 {0, 0}, 1825 {0, 0} 1826 } 1827 }, 1828 {1, 1, 2, 0, /* 0xfb */ 1829 {{0, 1}, 1830 {3, 7}, 1831 {0, 0}, 1832 {0, 0} 1833 } 1834 }, 1835 {0, 1, 1, 0, /* 0xfc */ 1836 {{2, 7}, 1837 {0, 0}, 1838 {0, 0}, 1839 {0, 0} 1840 } 1841 }, 1842 {1, 1, 2, 0, /* 0xfd */ 1843 {{0, 0}, 1844 {2, 7}, 1845 {0, 0}, 1846 {0, 0} 1847 } 1848 }, 1849 {0, 1, 1, 0, /* 0xfe */ 1850 {{1, 7}, 1851 {0, 0}, 1852 {0, 0}, 1853 {0, 0} 1854 } 1855 }, 1856 {1, 1, 1, 0, /* 0xff */ 1857 {{0, 7}, 1858 {0, 0}, 1859 {0, 0}, 1860 {0, 0} 1861 } 1862 } 1863}; 1864 1865 1866int 1867sctp_is_address_in_scope(struct sctp_ifa *ifa, 1868 struct sctp_scoping *scope, 1869 int do_update) 1870{ 1871 if ((scope->loopback_scope == 0) && 1872 (ifa->ifn_p) && SCTP_IFN_IS_IFT_LOOP(ifa->ifn_p)) { 1873 /* 1874 * skip loopback if not in scope * 1875 */ 1876 return (0); 1877 } 1878 switch (ifa->address.sa.sa_family) { 1879#ifdef INET 1880 case AF_INET: 1881 if (scope->ipv4_addr_legal) { 1882 struct sockaddr_in *sin; 1883 1884 sin = &ifa->address.sin; 1885 if (sin->sin_addr.s_addr == 0) { 1886 /* not in scope , unspecified */ 1887 return (0); 1888 } 1889 if ((scope->ipv4_local_scope == 0) && 1890 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 1891 /* private address not in scope */ 1892 return (0); 1893 } 1894 } else { 1895 return (0); 1896 } 1897 break; 1898#endif 1899#ifdef INET6 1900 case AF_INET6: 1901 if (scope->ipv6_addr_legal) { 1902 struct sockaddr_in6 *sin6; 1903 1904 /* 1905 * Must update the flags, bummer, which means any 1906 * IFA locks must now be applied HERE <-> 1907 */ 1908 if (do_update) { 1909 sctp_gather_internal_ifa_flags(ifa); 1910 } 1911 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 1912 return (0); 1913 } 1914 /* ok to use deprecated addresses? */ 1915 sin6 = &ifa->address.sin6; 1916 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1917 /* skip unspecifed addresses */ 1918 return (0); 1919 } 1920 if ( /* (local_scope == 0) && */ 1921 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) { 1922 return (0); 1923 } 1924 if ((scope->site_scope == 0) && 1925 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 1926 return (0); 1927 } 1928 } else { 1929 return (0); 1930 } 1931 break; 1932#endif 1933 default: 1934 return (0); 1935 } 1936 return (1); 1937} 1938 1939static struct mbuf * 1940sctp_add_addr_to_mbuf(struct mbuf *m, struct sctp_ifa *ifa, uint16_t *len) 1941{ 1942#if defined(INET) || defined(INET6) 1943 struct sctp_paramhdr *paramh; 1944 struct mbuf *mret; 1945 uint16_t plen; 1946#endif 1947 1948 switch (ifa->address.sa.sa_family) { 1949#ifdef INET 1950 case AF_INET: 1951 plen = (uint16_t)sizeof(struct sctp_ipv4addr_param); 1952 break; 1953#endif 1954#ifdef INET6 1955 case AF_INET6: 1956 plen = (uint16_t)sizeof(struct sctp_ipv6addr_param); 1957 break; 1958#endif 1959 default: 1960 return (m); 1961 } 1962#if defined(INET) || defined(INET6) 1963 if (M_TRAILINGSPACE(m) >= plen) { 1964 /* easy side we just drop it on the end */ 1965 paramh = (struct sctp_paramhdr *)(SCTP_BUF_AT(m, SCTP_BUF_LEN(m))); 1966 mret = m; 1967 } else { 1968 /* Need more space */ 1969 mret = m; 1970 while (SCTP_BUF_NEXT(mret) != NULL) { 1971 mret = SCTP_BUF_NEXT(mret); 1972 } 1973 SCTP_BUF_NEXT(mret) = sctp_get_mbuf_for_msg(plen, 0, M_NOWAIT, 1, MT_DATA); 1974 if (SCTP_BUF_NEXT(mret) == NULL) { 1975 /* We are hosed, can't add more addresses */ 1976 return (m); 1977 } 1978 mret = SCTP_BUF_NEXT(mret); 1979 paramh = mtod(mret, struct sctp_paramhdr *); 1980 } 1981 /* now add the parameter */ 1982 switch (ifa->address.sa.sa_family) { 1983#ifdef INET 1984 case AF_INET: 1985 { 1986 struct sctp_ipv4addr_param *ipv4p; 1987 struct sockaddr_in *sin; 1988 1989 sin = &ifa->address.sin; 1990 ipv4p = (struct sctp_ipv4addr_param *)paramh; 1991 paramh->param_type = htons(SCTP_IPV4_ADDRESS); 1992 paramh->param_length = htons(plen); 1993 ipv4p->addr = sin->sin_addr.s_addr; 1994 SCTP_BUF_LEN(mret) += plen; 1995 break; 1996 } 1997#endif 1998#ifdef INET6 1999 case AF_INET6: 2000 { 2001 struct sctp_ipv6addr_param *ipv6p; 2002 struct sockaddr_in6 *sin6; 2003 2004 sin6 = &ifa->address.sin6; 2005 ipv6p = (struct sctp_ipv6addr_param *)paramh; 2006 paramh->param_type = htons(SCTP_IPV6_ADDRESS); 2007 paramh->param_length = htons(plen); 2008 memcpy(ipv6p->addr, &sin6->sin6_addr, 2009 sizeof(ipv6p->addr)); 2010 /* clear embedded scope in the address */ 2011 in6_clearscope((struct in6_addr *)ipv6p->addr); 2012 SCTP_BUF_LEN(mret) += plen; 2013 break; 2014 } 2015#endif 2016 default: 2017 return (m); 2018 } 2019 if (len != NULL) { 2020 *len += plen; 2021 } 2022 return (mret); 2023#endif 2024} 2025 2026 2027struct mbuf * 2028sctp_add_addresses_to_i_ia(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2029 struct sctp_scoping *scope, 2030 struct mbuf *m_at, int cnt_inits_to, 2031 uint16_t *padding_len, uint16_t *chunk_len) 2032{ 2033 struct sctp_vrf *vrf = NULL; 2034 int cnt, limit_out = 0, total_count; 2035 uint32_t vrf_id; 2036 2037 vrf_id = inp->def_vrf_id; 2038 SCTP_IPI_ADDR_RLOCK(); 2039 vrf = sctp_find_vrf(vrf_id); 2040 if (vrf == NULL) { 2041 SCTP_IPI_ADDR_RUNLOCK(); 2042 return (m_at); 2043 } 2044 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 2045 struct sctp_ifa *sctp_ifap; 2046 struct sctp_ifn *sctp_ifnp; 2047 2048 cnt = cnt_inits_to; 2049 if (vrf->total_ifa_count > SCTP_COUNT_LIMIT) { 2050 limit_out = 1; 2051 cnt = SCTP_ADDRESS_LIMIT; 2052 goto skip_count; 2053 } 2054 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2055 if ((scope->loopback_scope == 0) && 2056 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2057 /* 2058 * Skip loopback devices if loopback_scope 2059 * not set 2060 */ 2061 continue; 2062 } 2063 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2064#ifdef INET 2065 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2066 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2067 &sctp_ifap->address.sin.sin_addr) != 0)) { 2068 continue; 2069 } 2070#endif 2071#ifdef INET6 2072 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2073 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2074 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2075 continue; 2076 } 2077#endif 2078 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2079 continue; 2080 } 2081 if (sctp_is_address_in_scope(sctp_ifap, scope, 1) == 0) { 2082 continue; 2083 } 2084 cnt++; 2085 if (cnt > SCTP_ADDRESS_LIMIT) { 2086 break; 2087 } 2088 } 2089 if (cnt > SCTP_ADDRESS_LIMIT) { 2090 break; 2091 } 2092 } 2093skip_count: 2094 if (cnt > 1) { 2095 total_count = 0; 2096 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) { 2097 cnt = 0; 2098 if ((scope->loopback_scope == 0) && 2099 SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) { 2100 /* 2101 * Skip loopback devices if 2102 * loopback_scope not set 2103 */ 2104 continue; 2105 } 2106 LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) { 2107#ifdef INET 2108 if ((sctp_ifap->address.sa.sa_family == AF_INET) && 2109 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2110 &sctp_ifap->address.sin.sin_addr) != 0)) { 2111 continue; 2112 } 2113#endif 2114#ifdef INET6 2115 if ((sctp_ifap->address.sa.sa_family == AF_INET6) && 2116 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2117 &sctp_ifap->address.sin6.sin6_addr) != 0)) { 2118 continue; 2119 } 2120#endif 2121 if (sctp_is_addr_restricted(stcb, sctp_ifap)) { 2122 continue; 2123 } 2124 if (sctp_is_address_in_scope(sctp_ifap, 2125 scope, 0) == 0) { 2126 continue; 2127 } 2128 if ((chunk_len != NULL) && 2129 (padding_len != NULL) && 2130 (*padding_len > 0)) { 2131 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2132 SCTP_BUF_LEN(m_at) += *padding_len; 2133 *chunk_len += *padding_len; 2134 *padding_len = 0; 2135 } 2136 m_at = sctp_add_addr_to_mbuf(m_at, sctp_ifap, chunk_len); 2137 if (limit_out) { 2138 cnt++; 2139 total_count++; 2140 if (cnt >= 2) { 2141 /* 2142 * two from each 2143 * address 2144 */ 2145 break; 2146 } 2147 if (total_count > SCTP_ADDRESS_LIMIT) { 2148 /* No more addresses */ 2149 break; 2150 } 2151 } 2152 } 2153 } 2154 } 2155 } else { 2156 struct sctp_laddr *laddr; 2157 2158 cnt = cnt_inits_to; 2159 /* First, how many ? */ 2160 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2161 if (laddr->ifa == NULL) { 2162 continue; 2163 } 2164 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) 2165 /* 2166 * Address being deleted by the system, dont 2167 * list. 2168 */ 2169 continue; 2170 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2171 /* 2172 * Address being deleted on this ep don't 2173 * list. 2174 */ 2175 continue; 2176 } 2177 if (sctp_is_address_in_scope(laddr->ifa, 2178 scope, 1) == 0) { 2179 continue; 2180 } 2181 cnt++; 2182 } 2183 /* 2184 * To get through a NAT we only list addresses if we have 2185 * more than one. That way if you just bind a single address 2186 * we let the source of the init dictate our address. 2187 */ 2188 if (cnt > 1) { 2189 cnt = cnt_inits_to; 2190 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2191 if (laddr->ifa == NULL) { 2192 continue; 2193 } 2194 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) { 2195 continue; 2196 } 2197 if (sctp_is_address_in_scope(laddr->ifa, 2198 scope, 0) == 0) { 2199 continue; 2200 } 2201 if ((chunk_len != NULL) && 2202 (padding_len != NULL) && 2203 (*padding_len > 0)) { 2204 memset(mtod(m_at, caddr_t)+*chunk_len, 0, *padding_len); 2205 SCTP_BUF_LEN(m_at) += *padding_len; 2206 *chunk_len += *padding_len; 2207 *padding_len = 0; 2208 } 2209 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa, chunk_len); 2210 cnt++; 2211 if (cnt >= SCTP_ADDRESS_LIMIT) { 2212 break; 2213 } 2214 } 2215 } 2216 } 2217 SCTP_IPI_ADDR_RUNLOCK(); 2218 return (m_at); 2219} 2220 2221static struct sctp_ifa * 2222sctp_is_ifa_addr_preferred(struct sctp_ifa *ifa, 2223 uint8_t dest_is_loop, 2224 uint8_t dest_is_priv, 2225 sa_family_t fam) 2226{ 2227 uint8_t dest_is_global = 0; 2228 2229 /* dest_is_priv is true if destination is a private address */ 2230 /* dest_is_loop is true if destination is a loopback addresses */ 2231 2232 /** 2233 * Here we determine if its a preferred address. A preferred address 2234 * means it is the same scope or higher scope then the destination. 2235 * L = loopback, P = private, G = global 2236 * ----------------------------------------- 2237 * src | dest | result 2238 * ---------------------------------------- 2239 * L | L | yes 2240 * ----------------------------------------- 2241 * P | L | yes-v4 no-v6 2242 * ----------------------------------------- 2243 * G | L | yes-v4 no-v6 2244 * ----------------------------------------- 2245 * L | P | no 2246 * ----------------------------------------- 2247 * P | P | yes 2248 * ----------------------------------------- 2249 * G | P | no 2250 * ----------------------------------------- 2251 * L | G | no 2252 * ----------------------------------------- 2253 * P | G | no 2254 * ----------------------------------------- 2255 * G | G | yes 2256 * ----------------------------------------- 2257 */ 2258 2259 if (ifa->address.sa.sa_family != fam) { 2260 /* forget mis-matched family */ 2261 return (NULL); 2262 } 2263 if ((dest_is_priv == 0) && (dest_is_loop == 0)) { 2264 dest_is_global = 1; 2265 } 2266 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Is destination preferred:"); 2267 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ifa->address.sa); 2268 /* Ok the address may be ok */ 2269#ifdef INET6 2270 if (fam == AF_INET6) { 2271 /* ok to use deprecated addresses? no lets not! */ 2272 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2273 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:1\n"); 2274 return (NULL); 2275 } 2276 if (ifa->src_is_priv && !ifa->src_is_loop) { 2277 if (dest_is_loop) { 2278 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:2\n"); 2279 return (NULL); 2280 } 2281 } 2282 if (ifa->src_is_glob) { 2283 if (dest_is_loop) { 2284 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:3\n"); 2285 return (NULL); 2286 } 2287 } 2288 } 2289#endif 2290 /* 2291 * Now that we know what is what, implement or table this could in 2292 * theory be done slicker (it used to be), but this is 2293 * straightforward and easier to validate :-) 2294 */ 2295 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src_loop:%d src_priv:%d src_glob:%d\n", 2296 ifa->src_is_loop, ifa->src_is_priv, ifa->src_is_glob); 2297 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dest_loop:%d dest_priv:%d dest_glob:%d\n", 2298 dest_is_loop, dest_is_priv, dest_is_global); 2299 2300 if ((ifa->src_is_loop) && (dest_is_priv)) { 2301 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:4\n"); 2302 return (NULL); 2303 } 2304 if ((ifa->src_is_glob) && (dest_is_priv)) { 2305 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:5\n"); 2306 return (NULL); 2307 } 2308 if ((ifa->src_is_loop) && (dest_is_global)) { 2309 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:6\n"); 2310 return (NULL); 2311 } 2312 if ((ifa->src_is_priv) && (dest_is_global)) { 2313 SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:7\n"); 2314 return (NULL); 2315 } 2316 SCTPDBG(SCTP_DEBUG_OUTPUT3, "YES\n"); 2317 /* its a preferred address */ 2318 return (ifa); 2319} 2320 2321static struct sctp_ifa * 2322sctp_is_ifa_addr_acceptable(struct sctp_ifa *ifa, 2323 uint8_t dest_is_loop, 2324 uint8_t dest_is_priv, 2325 sa_family_t fam) 2326{ 2327 uint8_t dest_is_global = 0; 2328 2329 /** 2330 * Here we determine if its a acceptable address. A acceptable 2331 * address means it is the same scope or higher scope but we can 2332 * allow for NAT which means its ok to have a global dest and a 2333 * private src. 2334 * 2335 * L = loopback, P = private, G = global 2336 * ----------------------------------------- 2337 * src | dest | result 2338 * ----------------------------------------- 2339 * L | L | yes 2340 * ----------------------------------------- 2341 * P | L | yes-v4 no-v6 2342 * ----------------------------------------- 2343 * G | L | yes 2344 * ----------------------------------------- 2345 * L | P | no 2346 * ----------------------------------------- 2347 * P | P | yes 2348 * ----------------------------------------- 2349 * G | P | yes - May not work 2350 * ----------------------------------------- 2351 * L | G | no 2352 * ----------------------------------------- 2353 * P | G | yes - May not work 2354 * ----------------------------------------- 2355 * G | G | yes 2356 * ----------------------------------------- 2357 */ 2358 2359 if (ifa->address.sa.sa_family != fam) { 2360 /* forget non matching family */ 2361 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa_fam:%d fam:%d\n", 2362 ifa->address.sa.sa_family, fam); 2363 return (NULL); 2364 } 2365 /* Ok the address may be ok */ 2366 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, &ifa->address.sa); 2367 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst_is_loop:%d dest_is_priv:%d\n", 2368 dest_is_loop, dest_is_priv); 2369 if ((dest_is_loop == 0) && (dest_is_priv == 0)) { 2370 dest_is_global = 1; 2371 } 2372#ifdef INET6 2373 if (fam == AF_INET6) { 2374 /* ok to use deprecated addresses? */ 2375 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) { 2376 return (NULL); 2377 } 2378 if (ifa->src_is_priv) { 2379 /* Special case, linklocal to loop */ 2380 if (dest_is_loop) 2381 return (NULL); 2382 } 2383 } 2384#endif 2385 /* 2386 * Now that we know what is what, implement our table. This could in 2387 * theory be done slicker (it used to be), but this is 2388 * straightforward and easier to validate :-) 2389 */ 2390 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_priv:%d\n", 2391 ifa->src_is_loop, 2392 dest_is_priv); 2393 if ((ifa->src_is_loop == 1) && (dest_is_priv)) { 2394 return (NULL); 2395 } 2396 SCTPDBG(SCTP_DEBUG_OUTPUT3, "ifa->src_is_loop:%d dest_is_glob:%d\n", 2397 ifa->src_is_loop, 2398 dest_is_global); 2399 if ((ifa->src_is_loop == 1) && (dest_is_global)) { 2400 return (NULL); 2401 } 2402 SCTPDBG(SCTP_DEBUG_OUTPUT3, "address is acceptable\n"); 2403 /* its an acceptable address */ 2404 return (ifa); 2405} 2406 2407int 2408sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa) 2409{ 2410 struct sctp_laddr *laddr; 2411 2412 if (stcb == NULL) { 2413 /* There are no restrictions, no TCB :-) */ 2414 return (0); 2415 } 2416 LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) { 2417 if (laddr->ifa == NULL) { 2418 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2419 __func__); 2420 continue; 2421 } 2422 if (laddr->ifa == ifa) { 2423 /* Yes it is on the list */ 2424 return (1); 2425 } 2426 } 2427 return (0); 2428} 2429 2430 2431int 2432sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa) 2433{ 2434 struct sctp_laddr *laddr; 2435 2436 if (ifa == NULL) 2437 return (0); 2438 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2439 if (laddr->ifa == NULL) { 2440 SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n", 2441 __func__); 2442 continue; 2443 } 2444 if ((laddr->ifa == ifa) && laddr->action == 0) 2445 /* same pointer */ 2446 return (1); 2447 } 2448 return (0); 2449} 2450 2451 2452 2453static struct sctp_ifa * 2454sctp_choose_boundspecific_inp(struct sctp_inpcb *inp, 2455 sctp_route_t *ro, 2456 uint32_t vrf_id, 2457 int non_asoc_addr_ok, 2458 uint8_t dest_is_priv, 2459 uint8_t dest_is_loop, 2460 sa_family_t fam) 2461{ 2462 struct sctp_laddr *laddr, *starting_point; 2463 void *ifn; 2464 int resettotop = 0; 2465 struct sctp_ifn *sctp_ifn; 2466 struct sctp_ifa *sctp_ifa, *sifa; 2467 struct sctp_vrf *vrf; 2468 uint32_t ifn_index; 2469 2470 vrf = sctp_find_vrf(vrf_id); 2471 if (vrf == NULL) 2472 return (NULL); 2473 2474 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2475 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2476 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2477 /* 2478 * first question, is the ifn we will emit on in our list, if so, we 2479 * want such an address. Note that we first looked for a preferred 2480 * address. 2481 */ 2482 if (sctp_ifn) { 2483 /* is a preferred one on the interface we route out? */ 2484 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2485#ifdef INET 2486 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2487 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2488 &sctp_ifa->address.sin.sin_addr) != 0)) { 2489 continue; 2490 } 2491#endif 2492#ifdef INET6 2493 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2494 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2495 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2496 continue; 2497 } 2498#endif 2499 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2500 (non_asoc_addr_ok == 0)) 2501 continue; 2502 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, 2503 dest_is_loop, 2504 dest_is_priv, fam); 2505 if (sifa == NULL) 2506 continue; 2507 if (sctp_is_addr_in_ep(inp, sifa)) { 2508 atomic_add_int(&sifa->refcount, 1); 2509 return (sifa); 2510 } 2511 } 2512 } 2513 /* 2514 * ok, now we now need to find one on the list of the addresses. We 2515 * can't get one on the emitting interface so let's find first a 2516 * preferred one. If not that an acceptable one otherwise... we 2517 * return NULL. 2518 */ 2519 starting_point = inp->next_addr_touse; 2520once_again: 2521 if (inp->next_addr_touse == NULL) { 2522 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2523 resettotop = 1; 2524 } 2525 for (laddr = inp->next_addr_touse; laddr; 2526 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2527 if (laddr->ifa == NULL) { 2528 /* address has been removed */ 2529 continue; 2530 } 2531 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2532 /* address is being deleted */ 2533 continue; 2534 } 2535 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, 2536 dest_is_priv, fam); 2537 if (sifa == NULL) 2538 continue; 2539 atomic_add_int(&sifa->refcount, 1); 2540 return (sifa); 2541 } 2542 if (resettotop == 0) { 2543 inp->next_addr_touse = NULL; 2544 goto once_again; 2545 } 2546 inp->next_addr_touse = starting_point; 2547 resettotop = 0; 2548once_again_too: 2549 if (inp->next_addr_touse == NULL) { 2550 inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list); 2551 resettotop = 1; 2552 } 2553 /* ok, what about an acceptable address in the inp */ 2554 for (laddr = inp->next_addr_touse; laddr; 2555 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2556 if (laddr->ifa == NULL) { 2557 /* address has been removed */ 2558 continue; 2559 } 2560 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2561 /* address is being deleted */ 2562 continue; 2563 } 2564 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2565 dest_is_priv, fam); 2566 if (sifa == NULL) 2567 continue; 2568 atomic_add_int(&sifa->refcount, 1); 2569 return (sifa); 2570 } 2571 if (resettotop == 0) { 2572 inp->next_addr_touse = NULL; 2573 goto once_again_too; 2574 } 2575 /* 2576 * no address bound can be a source for the destination we are in 2577 * trouble 2578 */ 2579 return (NULL); 2580} 2581 2582 2583 2584static struct sctp_ifa * 2585sctp_choose_boundspecific_stcb(struct sctp_inpcb *inp, 2586 struct sctp_tcb *stcb, 2587 sctp_route_t *ro, 2588 uint32_t vrf_id, 2589 uint8_t dest_is_priv, 2590 uint8_t dest_is_loop, 2591 int non_asoc_addr_ok, 2592 sa_family_t fam) 2593{ 2594 struct sctp_laddr *laddr, *starting_point; 2595 void *ifn; 2596 struct sctp_ifn *sctp_ifn; 2597 struct sctp_ifa *sctp_ifa, *sifa; 2598 uint8_t start_at_beginning = 0; 2599 struct sctp_vrf *vrf; 2600 uint32_t ifn_index; 2601 2602 /* 2603 * first question, is the ifn we will emit on in our list, if so, we 2604 * want that one. 2605 */ 2606 vrf = sctp_find_vrf(vrf_id); 2607 if (vrf == NULL) 2608 return (NULL); 2609 2610 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2611 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2612 sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2613 2614 /* 2615 * first question, is the ifn we will emit on in our list? If so, 2616 * we want that one. First we look for a preferred. Second, we go 2617 * for an acceptable. 2618 */ 2619 if (sctp_ifn) { 2620 /* first try for a preferred address on the ep */ 2621 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2622#ifdef INET 2623 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2624 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2625 &sctp_ifa->address.sin.sin_addr) != 0)) { 2626 continue; 2627 } 2628#endif 2629#ifdef INET6 2630 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2631 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2632 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2633 continue; 2634 } 2635#endif 2636 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2637 continue; 2638 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2639 sifa = sctp_is_ifa_addr_preferred(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2640 if (sifa == NULL) 2641 continue; 2642 if (((non_asoc_addr_ok == 0) && 2643 (sctp_is_addr_restricted(stcb, sifa))) || 2644 (non_asoc_addr_ok && 2645 (sctp_is_addr_restricted(stcb, sifa)) && 2646 (!sctp_is_addr_pending(stcb, sifa)))) { 2647 /* on the no-no list */ 2648 continue; 2649 } 2650 atomic_add_int(&sifa->refcount, 1); 2651 return (sifa); 2652 } 2653 } 2654 /* next try for an acceptable address on the ep */ 2655 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 2656#ifdef INET 2657 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 2658 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2659 &sctp_ifa->address.sin.sin_addr) != 0)) { 2660 continue; 2661 } 2662#endif 2663#ifdef INET6 2664 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 2665 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2666 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 2667 continue; 2668 } 2669#endif 2670 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0)) 2671 continue; 2672 if (sctp_is_addr_in_ep(inp, sctp_ifa)) { 2673 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, dest_is_priv, fam); 2674 if (sifa == NULL) 2675 continue; 2676 if (((non_asoc_addr_ok == 0) && 2677 (sctp_is_addr_restricted(stcb, sifa))) || 2678 (non_asoc_addr_ok && 2679 (sctp_is_addr_restricted(stcb, sifa)) && 2680 (!sctp_is_addr_pending(stcb, sifa)))) { 2681 /* on the no-no list */ 2682 continue; 2683 } 2684 atomic_add_int(&sifa->refcount, 1); 2685 return (sifa); 2686 } 2687 } 2688 2689 } 2690 /* 2691 * if we can't find one like that then we must look at all addresses 2692 * bound to pick one at first preferable then secondly acceptable. 2693 */ 2694 starting_point = stcb->asoc.last_used_address; 2695sctp_from_the_top: 2696 if (stcb->asoc.last_used_address == NULL) { 2697 start_at_beginning = 1; 2698 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2699 } 2700 /* search beginning with the last used address */ 2701 for (laddr = stcb->asoc.last_used_address; laddr; 2702 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2703 if (laddr->ifa == NULL) { 2704 /* address has been removed */ 2705 continue; 2706 } 2707 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2708 /* address is being deleted */ 2709 continue; 2710 } 2711 sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, dest_is_priv, fam); 2712 if (sifa == NULL) 2713 continue; 2714 if (((non_asoc_addr_ok == 0) && 2715 (sctp_is_addr_restricted(stcb, sifa))) || 2716 (non_asoc_addr_ok && 2717 (sctp_is_addr_restricted(stcb, sifa)) && 2718 (!sctp_is_addr_pending(stcb, sifa)))) { 2719 /* on the no-no list */ 2720 continue; 2721 } 2722 stcb->asoc.last_used_address = laddr; 2723 atomic_add_int(&sifa->refcount, 1); 2724 return (sifa); 2725 } 2726 if (start_at_beginning == 0) { 2727 stcb->asoc.last_used_address = NULL; 2728 goto sctp_from_the_top; 2729 } 2730 /* now try for any higher scope than the destination */ 2731 stcb->asoc.last_used_address = starting_point; 2732 start_at_beginning = 0; 2733sctp_from_the_top2: 2734 if (stcb->asoc.last_used_address == NULL) { 2735 start_at_beginning = 1; 2736 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 2737 } 2738 /* search beginning with the last used address */ 2739 for (laddr = stcb->asoc.last_used_address; laddr; 2740 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 2741 if (laddr->ifa == NULL) { 2742 /* address has been removed */ 2743 continue; 2744 } 2745 if (laddr->action == SCTP_DEL_IP_ADDRESS) { 2746 /* address is being deleted */ 2747 continue; 2748 } 2749 sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop, 2750 dest_is_priv, fam); 2751 if (sifa == NULL) 2752 continue; 2753 if (((non_asoc_addr_ok == 0) && 2754 (sctp_is_addr_restricted(stcb, sifa))) || 2755 (non_asoc_addr_ok && 2756 (sctp_is_addr_restricted(stcb, sifa)) && 2757 (!sctp_is_addr_pending(stcb, sifa)))) { 2758 /* on the no-no list */ 2759 continue; 2760 } 2761 stcb->asoc.last_used_address = laddr; 2762 atomic_add_int(&sifa->refcount, 1); 2763 return (sifa); 2764 } 2765 if (start_at_beginning == 0) { 2766 stcb->asoc.last_used_address = NULL; 2767 goto sctp_from_the_top2; 2768 } 2769 return (NULL); 2770} 2771 2772static struct sctp_ifa * 2773sctp_select_nth_preferred_addr_from_ifn_boundall(struct sctp_ifn *ifn, 2774 struct sctp_inpcb *inp, 2775 struct sctp_tcb *stcb, 2776 int non_asoc_addr_ok, 2777 uint8_t dest_is_loop, 2778 uint8_t dest_is_priv, 2779 int addr_wanted, 2780 sa_family_t fam, 2781 sctp_route_t *ro 2782) 2783{ 2784 struct sctp_ifa *ifa, *sifa; 2785 int num_eligible_addr = 0; 2786#ifdef INET6 2787 struct sockaddr_in6 sin6, lsa6; 2788 2789 if (fam == AF_INET6) { 2790 memcpy(&sin6, &ro->ro_dst, sizeof(struct sockaddr_in6)); 2791 (void)sa6_recoverscope(&sin6); 2792 } 2793#endif /* INET6 */ 2794 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2795#ifdef INET 2796 if ((ifa->address.sa.sa_family == AF_INET) && 2797 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2798 &ifa->address.sin.sin_addr) != 0)) { 2799 continue; 2800 } 2801#endif 2802#ifdef INET6 2803 if ((ifa->address.sa.sa_family == AF_INET6) && 2804 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2805 &ifa->address.sin6.sin6_addr) != 0)) { 2806 continue; 2807 } 2808#endif 2809 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2810 (non_asoc_addr_ok == 0)) 2811 continue; 2812 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2813 dest_is_priv, fam); 2814 if (sifa == NULL) 2815 continue; 2816#ifdef INET6 2817 if (fam == AF_INET6 && 2818 dest_is_loop && 2819 sifa->src_is_loop && sifa->src_is_priv) { 2820 /* 2821 * don't allow fe80::1 to be a src on loop ::1, we 2822 * don't list it to the peer so we will get an 2823 * abort. 2824 */ 2825 continue; 2826 } 2827 if (fam == AF_INET6 && 2828 IN6_IS_ADDR_LINKLOCAL(&sifa->address.sin6.sin6_addr) && 2829 IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) { 2830 /* 2831 * link-local <-> link-local must belong to the same 2832 * scope. 2833 */ 2834 memcpy(&lsa6, &sifa->address.sin6, sizeof(struct sockaddr_in6)); 2835 (void)sa6_recoverscope(&lsa6); 2836 if (sin6.sin6_scope_id != lsa6.sin6_scope_id) { 2837 continue; 2838 } 2839 } 2840#endif /* INET6 */ 2841 2842 /* 2843 * Check if the IPv6 address matches to next-hop. In the 2844 * mobile case, old IPv6 address may be not deleted from the 2845 * interface. Then, the interface has previous and new 2846 * addresses. We should use one corresponding to the 2847 * next-hop. (by micchie) 2848 */ 2849#ifdef INET6 2850 if (stcb && fam == AF_INET6 && 2851 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2852 if (sctp_v6src_match_nexthop(&sifa->address.sin6, ro) 2853 == 0) { 2854 continue; 2855 } 2856 } 2857#endif 2858#ifdef INET 2859 /* Avoid topologically incorrect IPv4 address */ 2860 if (stcb && fam == AF_INET && 2861 sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) { 2862 if (sctp_v4src_match_nexthop(sifa, ro) == 0) { 2863 continue; 2864 } 2865 } 2866#endif 2867 if (stcb) { 2868 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2869 continue; 2870 } 2871 if (((non_asoc_addr_ok == 0) && 2872 (sctp_is_addr_restricted(stcb, sifa))) || 2873 (non_asoc_addr_ok && 2874 (sctp_is_addr_restricted(stcb, sifa)) && 2875 (!sctp_is_addr_pending(stcb, sifa)))) { 2876 /* 2877 * It is restricted for some reason.. 2878 * probably not yet added. 2879 */ 2880 continue; 2881 } 2882 } 2883 if (num_eligible_addr >= addr_wanted) { 2884 return (sifa); 2885 } 2886 num_eligible_addr++; 2887 } 2888 return (NULL); 2889} 2890 2891 2892static int 2893sctp_count_num_preferred_boundall(struct sctp_ifn *ifn, 2894 struct sctp_inpcb *inp, 2895 struct sctp_tcb *stcb, 2896 int non_asoc_addr_ok, 2897 uint8_t dest_is_loop, 2898 uint8_t dest_is_priv, 2899 sa_family_t fam) 2900{ 2901 struct sctp_ifa *ifa, *sifa; 2902 int num_eligible_addr = 0; 2903 2904 LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) { 2905#ifdef INET 2906 if ((ifa->address.sa.sa_family == AF_INET) && 2907 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 2908 &ifa->address.sin.sin_addr) != 0)) { 2909 continue; 2910 } 2911#endif 2912#ifdef INET6 2913 if ((ifa->address.sa.sa_family == AF_INET6) && 2914 (stcb != NULL) && 2915 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 2916 &ifa->address.sin6.sin6_addr) != 0)) { 2917 continue; 2918 } 2919#endif 2920 if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 2921 (non_asoc_addr_ok == 0)) { 2922 continue; 2923 } 2924 sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop, 2925 dest_is_priv, fam); 2926 if (sifa == NULL) { 2927 continue; 2928 } 2929 if (stcb) { 2930 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) { 2931 continue; 2932 } 2933 if (((non_asoc_addr_ok == 0) && 2934 (sctp_is_addr_restricted(stcb, sifa))) || 2935 (non_asoc_addr_ok && 2936 (sctp_is_addr_restricted(stcb, sifa)) && 2937 (!sctp_is_addr_pending(stcb, sifa)))) { 2938 /* 2939 * It is restricted for some reason.. 2940 * probably not yet added. 2941 */ 2942 continue; 2943 } 2944 } 2945 num_eligible_addr++; 2946 } 2947 return (num_eligible_addr); 2948} 2949 2950static struct sctp_ifa * 2951sctp_choose_boundall(struct sctp_inpcb *inp, 2952 struct sctp_tcb *stcb, 2953 struct sctp_nets *net, 2954 sctp_route_t *ro, 2955 uint32_t vrf_id, 2956 uint8_t dest_is_priv, 2957 uint8_t dest_is_loop, 2958 int non_asoc_addr_ok, 2959 sa_family_t fam) 2960{ 2961 int cur_addr_num = 0, num_preferred = 0; 2962 void *ifn; 2963 struct sctp_ifn *sctp_ifn, *looked_at = NULL, *emit_ifn; 2964 struct sctp_ifa *sctp_ifa, *sifa; 2965 uint32_t ifn_index; 2966 struct sctp_vrf *vrf; 2967#ifdef INET 2968 int retried = 0; 2969#endif 2970 2971 /*- 2972 * For boundall we can use any address in the association. 2973 * If non_asoc_addr_ok is set we can use any address (at least in 2974 * theory). So we look for preferred addresses first. If we find one, 2975 * we use it. Otherwise we next try to get an address on the 2976 * interface, which we should be able to do (unless non_asoc_addr_ok 2977 * is false and we are routed out that way). In these cases where we 2978 * can't use the address of the interface we go through all the 2979 * ifn's looking for an address we can use and fill that in. Punting 2980 * means we send back address 0, which will probably cause problems 2981 * actually since then IP will fill in the address of the route ifn, 2982 * which means we probably already rejected it.. i.e. here comes an 2983 * abort :-<. 2984 */ 2985 vrf = sctp_find_vrf(vrf_id); 2986 if (vrf == NULL) 2987 return (NULL); 2988 2989 ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 2990 ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro); 2991 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn from route:%p ifn_index:%d\n", ifn, ifn_index); 2992 emit_ifn = looked_at = sctp_ifn = sctp_find_ifn(ifn, ifn_index); 2993 if (sctp_ifn == NULL) { 2994 /* ?? We don't have this guy ?? */ 2995 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No ifn emit interface?\n"); 2996 goto bound_all_plan_b; 2997 } 2998 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn_index:%d name:%s is emit interface\n", 2999 ifn_index, sctp_ifn->ifn_name); 3000 3001 if (net) { 3002 cur_addr_num = net->indx_of_eligible_next_to_use; 3003 } 3004 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, 3005 inp, stcb, 3006 non_asoc_addr_ok, 3007 dest_is_loop, 3008 dest_is_priv, fam); 3009 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Found %d preferred source addresses for intf:%s\n", 3010 num_preferred, sctp_ifn->ifn_name); 3011 if (num_preferred == 0) { 3012 /* 3013 * no eligible addresses, we must use some other interface 3014 * address if we can find one. 3015 */ 3016 goto bound_all_plan_b; 3017 } 3018 /* 3019 * Ok we have num_eligible_addr set with how many we can use, this 3020 * may vary from call to call due to addresses being deprecated 3021 * etc.. 3022 */ 3023 if (cur_addr_num >= num_preferred) { 3024 cur_addr_num = 0; 3025 } 3026 /* 3027 * select the nth address from the list (where cur_addr_num is the 3028 * nth) and 0 is the first one, 1 is the second one etc... 3029 */ 3030 SCTPDBG(SCTP_DEBUG_OUTPUT2, "cur_addr_num:%d\n", cur_addr_num); 3031 3032 sctp_ifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3033 dest_is_priv, cur_addr_num, fam, ro); 3034 3035 /* if sctp_ifa is NULL something changed??, fall to plan b. */ 3036 if (sctp_ifa) { 3037 atomic_add_int(&sctp_ifa->refcount, 1); 3038 if (net) { 3039 /* save off where the next one we will want */ 3040 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3041 } 3042 return (sctp_ifa); 3043 } 3044 /* 3045 * plan_b: Look at all interfaces and find a preferred address. If 3046 * no preferred fall through to plan_c. 3047 */ 3048bound_all_plan_b: 3049 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan B\n"); 3050 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3051 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Examine interface %s\n", 3052 sctp_ifn->ifn_name); 3053 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3054 /* wrong base scope */ 3055 SCTPDBG(SCTP_DEBUG_OUTPUT2, "skip\n"); 3056 continue; 3057 } 3058 if ((sctp_ifn == looked_at) && looked_at) { 3059 /* already looked at this guy */ 3060 SCTPDBG(SCTP_DEBUG_OUTPUT2, "already seen\n"); 3061 continue; 3062 } 3063 num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, 3064 dest_is_loop, dest_is_priv, fam); 3065 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3066 "Found ifn:%p %d preferred source addresses\n", 3067 ifn, num_preferred); 3068 if (num_preferred == 0) { 3069 /* None on this interface. */ 3070 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No preferred -- skipping to next\n"); 3071 continue; 3072 } 3073 SCTPDBG(SCTP_DEBUG_OUTPUT2, 3074 "num preferred:%d on interface:%p cur_addr_num:%d\n", 3075 num_preferred, (void *)sctp_ifn, cur_addr_num); 3076 3077 /* 3078 * Ok we have num_eligible_addr set with how many we can 3079 * use, this may vary from call to call due to addresses 3080 * being deprecated etc.. 3081 */ 3082 if (cur_addr_num >= num_preferred) { 3083 cur_addr_num = 0; 3084 } 3085 sifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, inp, stcb, non_asoc_addr_ok, dest_is_loop, 3086 dest_is_priv, cur_addr_num, fam, ro); 3087 if (sifa == NULL) 3088 continue; 3089 if (net) { 3090 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 3091 SCTPDBG(SCTP_DEBUG_OUTPUT2, "we selected %d\n", 3092 cur_addr_num); 3093 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Source:"); 3094 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 3095 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Dest:"); 3096 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &net->ro._l_addr.sa); 3097 } 3098 atomic_add_int(&sifa->refcount, 1); 3099 return (sifa); 3100 } 3101#ifdef INET 3102again_with_private_addresses_allowed: 3103#endif 3104 /* plan_c: do we have an acceptable address on the emit interface */ 3105 sifa = NULL; 3106 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan C: find acceptable on interface\n"); 3107 if (emit_ifn == NULL) { 3108 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jump to Plan D - no emit_ifn\n"); 3109 goto plan_d; 3110 } 3111 LIST_FOREACH(sctp_ifa, &emit_ifn->ifalist, next_ifa) { 3112 SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifa:%p\n", (void *)sctp_ifa); 3113#ifdef INET 3114 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3115 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3116 &sctp_ifa->address.sin.sin_addr) != 0)) { 3117 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3118 continue; 3119 } 3120#endif 3121#ifdef INET6 3122 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3123 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3124 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3125 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Jailed\n"); 3126 continue; 3127 } 3128#endif 3129 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3130 (non_asoc_addr_ok == 0)) { 3131 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Defer\n"); 3132 continue; 3133 } 3134 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, 3135 dest_is_priv, fam); 3136 if (sifa == NULL) { 3137 SCTPDBG(SCTP_DEBUG_OUTPUT2, "IFA not acceptable\n"); 3138 continue; 3139 } 3140 if (stcb) { 3141 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3142 SCTPDBG(SCTP_DEBUG_OUTPUT2, "NOT in scope\n"); 3143 sifa = NULL; 3144 continue; 3145 } 3146 if (((non_asoc_addr_ok == 0) && 3147 (sctp_is_addr_restricted(stcb, sifa))) || 3148 (non_asoc_addr_ok && 3149 (sctp_is_addr_restricted(stcb, sifa)) && 3150 (!sctp_is_addr_pending(stcb, sifa)))) { 3151 /* 3152 * It is restricted for some reason.. 3153 * probably not yet added. 3154 */ 3155 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Its restricted\n"); 3156 sifa = NULL; 3157 continue; 3158 } 3159 } 3160 atomic_add_int(&sifa->refcount, 1); 3161 goto out; 3162 } 3163plan_d: 3164 /* 3165 * plan_d: We are in trouble. No preferred address on the emit 3166 * interface. And not even a preferred address on all interfaces. Go 3167 * out and see if we can find an acceptable address somewhere 3168 * amongst all interfaces. 3169 */ 3170 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan D looked_at is %p\n", (void *)looked_at); 3171 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3172 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3173 /* wrong base scope */ 3174 continue; 3175 } 3176 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3177#ifdef INET 3178 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3179 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3180 &sctp_ifa->address.sin.sin_addr) != 0)) { 3181 continue; 3182 } 3183#endif 3184#ifdef INET6 3185 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3186 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3187 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3188 continue; 3189 } 3190#endif 3191 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3192 (non_asoc_addr_ok == 0)) 3193 continue; 3194 sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3195 dest_is_loop, 3196 dest_is_priv, fam); 3197 if (sifa == NULL) 3198 continue; 3199 if (stcb) { 3200 if (sctp_is_address_in_scope(sifa, &stcb->asoc.scope, 0) == 0) { 3201 sifa = NULL; 3202 continue; 3203 } 3204 if (((non_asoc_addr_ok == 0) && 3205 (sctp_is_addr_restricted(stcb, sifa))) || 3206 (non_asoc_addr_ok && 3207 (sctp_is_addr_restricted(stcb, sifa)) && 3208 (!sctp_is_addr_pending(stcb, sifa)))) { 3209 /* 3210 * It is restricted for some 3211 * reason.. probably not yet added. 3212 */ 3213 sifa = NULL; 3214 continue; 3215 } 3216 } 3217 goto out; 3218 } 3219 } 3220#ifdef INET 3221 if (stcb) { 3222 if ((retried == 0) && (stcb->asoc.scope.ipv4_local_scope == 0)) { 3223 stcb->asoc.scope.ipv4_local_scope = 1; 3224 retried = 1; 3225 goto again_with_private_addresses_allowed; 3226 } else if (retried == 1) { 3227 stcb->asoc.scope.ipv4_local_scope = 0; 3228 } 3229 } 3230#endif 3231out: 3232#ifdef INET 3233 if (sifa) { 3234 if (retried == 1) { 3235 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) { 3236 if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) { 3237 /* wrong base scope */ 3238 continue; 3239 } 3240 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) { 3241 struct sctp_ifa *tmp_sifa; 3242 3243#ifdef INET 3244 if ((sctp_ifa->address.sa.sa_family == AF_INET) && 3245 (prison_check_ip4(inp->ip_inp.inp.inp_cred, 3246 &sctp_ifa->address.sin.sin_addr) != 0)) { 3247 continue; 3248 } 3249#endif 3250#ifdef INET6 3251 if ((sctp_ifa->address.sa.sa_family == AF_INET6) && 3252 (prison_check_ip6(inp->ip_inp.inp.inp_cred, 3253 &sctp_ifa->address.sin6.sin6_addr) != 0)) { 3254 continue; 3255 } 3256#endif 3257 if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && 3258 (non_asoc_addr_ok == 0)) 3259 continue; 3260 tmp_sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, 3261 dest_is_loop, 3262 dest_is_priv, fam); 3263 if (tmp_sifa == NULL) { 3264 continue; 3265 } 3266 if (tmp_sifa == sifa) { 3267 continue; 3268 } 3269 if (stcb) { 3270 if (sctp_is_address_in_scope(tmp_sifa, 3271 &stcb->asoc.scope, 0) == 0) { 3272 continue; 3273 } 3274 if (((non_asoc_addr_ok == 0) && 3275 (sctp_is_addr_restricted(stcb, tmp_sifa))) || 3276 (non_asoc_addr_ok && 3277 (sctp_is_addr_restricted(stcb, tmp_sifa)) && 3278 (!sctp_is_addr_pending(stcb, tmp_sifa)))) { 3279 /* 3280 * It is restricted 3281 * for some reason.. 3282 * probably not yet 3283 * added. 3284 */ 3285 continue; 3286 } 3287 } 3288 if ((tmp_sifa->address.sin.sin_family == AF_INET) && 3289 (IN4_ISPRIVATE_ADDRESS(&(tmp_sifa->address.sin.sin_addr)))) { 3290 sctp_add_local_addr_restricted(stcb, tmp_sifa); 3291 } 3292 } 3293 } 3294 } 3295 atomic_add_int(&sifa->refcount, 1); 3296 } 3297#endif 3298 return (sifa); 3299} 3300 3301 3302 3303/* tcb may be NULL */ 3304struct sctp_ifa * 3305sctp_source_address_selection(struct sctp_inpcb *inp, 3306 struct sctp_tcb *stcb, 3307 sctp_route_t *ro, 3308 struct sctp_nets *net, 3309 int non_asoc_addr_ok, uint32_t vrf_id) 3310{ 3311 struct sctp_ifa *answer; 3312 uint8_t dest_is_priv, dest_is_loop; 3313 sa_family_t fam; 3314#ifdef INET 3315 struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst; 3316#endif 3317#ifdef INET6 3318 struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&ro->ro_dst; 3319#endif 3320 3321 /** 3322 * Rules: 3323 * - Find the route if needed, cache if I can. 3324 * - Look at interface address in route, Is it in the bound list. If so we 3325 * have the best source. 3326 * - If not we must rotate amongst the addresses. 3327 * 3328 * Cavets and issues 3329 * 3330 * Do we need to pay attention to scope. We can have a private address 3331 * or a global address we are sourcing or sending to. So if we draw 3332 * it out 3333 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3334 * For V4 3335 * ------------------------------------------ 3336 * source * dest * result 3337 * ----------------------------------------- 3338 * <a> Private * Global * NAT 3339 * ----------------------------------------- 3340 * <b> Private * Private * No problem 3341 * ----------------------------------------- 3342 * <c> Global * Private * Huh, How will this work? 3343 * ----------------------------------------- 3344 * <d> Global * Global * No Problem 3345 *------------------------------------------ 3346 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3347 * For V6 3348 *------------------------------------------ 3349 * source * dest * result 3350 * ----------------------------------------- 3351 * <a> Linklocal * Global * 3352 * ----------------------------------------- 3353 * <b> Linklocal * Linklocal * No problem 3354 * ----------------------------------------- 3355 * <c> Global * Linklocal * Huh, How will this work? 3356 * ----------------------------------------- 3357 * <d> Global * Global * No Problem 3358 *------------------------------------------ 3359 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz 3360 * 3361 * And then we add to that what happens if there are multiple addresses 3362 * assigned to an interface. Remember the ifa on a ifn is a linked 3363 * list of addresses. So one interface can have more than one IP 3364 * address. What happens if we have both a private and a global 3365 * address? Do we then use context of destination to sort out which 3366 * one is best? And what about NAT's sending P->G may get you a NAT 3367 * translation, or should you select the G thats on the interface in 3368 * preference. 3369 * 3370 * Decisions: 3371 * 3372 * - count the number of addresses on the interface. 3373 * - if it is one, no problem except case <c>. 3374 * For <a> we will assume a NAT out there. 3375 * - if there are more than one, then we need to worry about scope P 3376 * or G. We should prefer G -> G and P -> P if possible. 3377 * Then as a secondary fall back to mixed types G->P being a last 3378 * ditch one. 3379 * - The above all works for bound all, but bound specific we need to 3380 * use the same concept but instead only consider the bound 3381 * addresses. If the bound set is NOT assigned to the interface then 3382 * we must use rotation amongst the bound addresses.. 3383 */ 3384 if (ro->ro_rt == NULL) { 3385 /* 3386 * Need a route to cache. 3387 */ 3388 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 3389 } 3390 if (ro->ro_rt == NULL) { 3391 return (NULL); 3392 } 3393 fam = ro->ro_dst.sa_family; 3394 dest_is_priv = dest_is_loop = 0; 3395 /* Setup our scopes for the destination */ 3396 switch (fam) { 3397#ifdef INET 3398 case AF_INET: 3399 /* Scope based on outbound address */ 3400 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) { 3401 dest_is_loop = 1; 3402 if (net != NULL) { 3403 /* mark it as local */ 3404 net->addr_is_local = 1; 3405 } 3406 } else if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) { 3407 dest_is_priv = 1; 3408 } 3409 break; 3410#endif 3411#ifdef INET6 3412 case AF_INET6: 3413 /* Scope based on outbound address */ 3414 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr) || 3415 SCTP_ROUTE_IS_REAL_LOOP(ro)) { 3416 /* 3417 * If the address is a loopback address, which 3418 * consists of "::1" OR "fe80::1%lo0", we are 3419 * loopback scope. But we don't use dest_is_priv 3420 * (link local addresses). 3421 */ 3422 dest_is_loop = 1; 3423 if (net != NULL) { 3424 /* mark it as local */ 3425 net->addr_is_local = 1; 3426 } 3427 } else if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) { 3428 dest_is_priv = 1; 3429 } 3430 break; 3431#endif 3432 } 3433 SCTPDBG(SCTP_DEBUG_OUTPUT2, "Select source addr for:"); 3434 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&ro->ro_dst); 3435 SCTP_IPI_ADDR_RLOCK(); 3436 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3437 /* 3438 * Bound all case 3439 */ 3440 answer = sctp_choose_boundall(inp, stcb, net, ro, vrf_id, 3441 dest_is_priv, dest_is_loop, 3442 non_asoc_addr_ok, fam); 3443 SCTP_IPI_ADDR_RUNLOCK(); 3444 return (answer); 3445 } 3446 /* 3447 * Subset bound case 3448 */ 3449 if (stcb) { 3450 answer = sctp_choose_boundspecific_stcb(inp, stcb, ro, 3451 vrf_id, dest_is_priv, 3452 dest_is_loop, 3453 non_asoc_addr_ok, fam); 3454 } else { 3455 answer = sctp_choose_boundspecific_inp(inp, ro, vrf_id, 3456 non_asoc_addr_ok, 3457 dest_is_priv, 3458 dest_is_loop, fam); 3459 } 3460 SCTP_IPI_ADDR_RUNLOCK(); 3461 return (answer); 3462} 3463 3464static int 3465sctp_find_cmsg(int c_type, void *data, struct mbuf *control, size_t cpsize) 3466{ 3467 struct cmsghdr cmh; 3468 int tlen, at, found; 3469 struct sctp_sndinfo sndinfo; 3470 struct sctp_prinfo prinfo; 3471 struct sctp_authinfo authinfo; 3472 3473 tlen = SCTP_BUF_LEN(control); 3474 at = 0; 3475 found = 0; 3476 /* 3477 * Independent of how many mbufs, find the c_type inside the control 3478 * structure and copy out the data. 3479 */ 3480 while (at < tlen) { 3481 if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) { 3482 /* There is not enough room for one more. */ 3483 return (found); 3484 } 3485 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh); 3486 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3487 /* We dont't have a complete CMSG header. */ 3488 return (found); 3489 } 3490 if (((int)cmh.cmsg_len + at) > tlen) { 3491 /* We don't have the complete CMSG. */ 3492 return (found); 3493 } 3494 if ((cmh.cmsg_level == IPPROTO_SCTP) && 3495 ((c_type == cmh.cmsg_type) || 3496 ((c_type == SCTP_SNDRCV) && 3497 ((cmh.cmsg_type == SCTP_SNDINFO) || 3498 (cmh.cmsg_type == SCTP_PRINFO) || 3499 (cmh.cmsg_type == SCTP_AUTHINFO))))) { 3500 if (c_type == cmh.cmsg_type) { 3501 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < cpsize) { 3502 return (found); 3503 } 3504 /* It is exactly what we want. Copy it out. */ 3505 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), (int)cpsize, (caddr_t)data); 3506 return (1); 3507 } else { 3508 struct sctp_sndrcvinfo *sndrcvinfo; 3509 3510 sndrcvinfo = (struct sctp_sndrcvinfo *)data; 3511 if (found == 0) { 3512 if (cpsize < sizeof(struct sctp_sndrcvinfo)) { 3513 return (found); 3514 } 3515 memset(sndrcvinfo, 0, sizeof(struct sctp_sndrcvinfo)); 3516 } 3517 switch (cmh.cmsg_type) { 3518 case SCTP_SNDINFO: 3519 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_sndinfo)) { 3520 return (found); 3521 } 3522 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_sndinfo), (caddr_t)&sndinfo); 3523 sndrcvinfo->sinfo_stream = sndinfo.snd_sid; 3524 sndrcvinfo->sinfo_flags = sndinfo.snd_flags; 3525 sndrcvinfo->sinfo_ppid = sndinfo.snd_ppid; 3526 sndrcvinfo->sinfo_context = sndinfo.snd_context; 3527 sndrcvinfo->sinfo_assoc_id = sndinfo.snd_assoc_id; 3528 break; 3529 case SCTP_PRINFO: 3530 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_prinfo)) { 3531 return (found); 3532 } 3533 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_prinfo), (caddr_t)&prinfo); 3534 if (prinfo.pr_policy != SCTP_PR_SCTP_NONE) { 3535 sndrcvinfo->sinfo_timetolive = prinfo.pr_value; 3536 } else { 3537 sndrcvinfo->sinfo_timetolive = 0; 3538 } 3539 sndrcvinfo->sinfo_flags |= prinfo.pr_policy; 3540 break; 3541 case SCTP_AUTHINFO: 3542 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_authinfo)) { 3543 return (found); 3544 } 3545 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_authinfo), (caddr_t)&authinfo); 3546 sndrcvinfo->sinfo_keynumber_valid = 1; 3547 sndrcvinfo->sinfo_keynumber = authinfo.auth_keynumber; 3548 break; 3549 default: 3550 return (found); 3551 } 3552 found = 1; 3553 } 3554 } 3555 at += CMSG_ALIGN(cmh.cmsg_len); 3556 } 3557 return (found); 3558} 3559 3560static int 3561sctp_process_cmsgs_for_init(struct sctp_tcb *stcb, struct mbuf *control, int *error) 3562{ 3563 struct cmsghdr cmh; 3564 int tlen, at; 3565 struct sctp_initmsg initmsg; 3566#ifdef INET 3567 struct sockaddr_in sin; 3568#endif 3569#ifdef INET6 3570 struct sockaddr_in6 sin6; 3571#endif 3572 3573 tlen = SCTP_BUF_LEN(control); 3574 at = 0; 3575 while (at < tlen) { 3576 if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) { 3577 /* There is not enough room for one more. */ 3578 *error = EINVAL; 3579 return (1); 3580 } 3581 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh); 3582 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3583 /* We dont't have a complete CMSG header. */ 3584 *error = EINVAL; 3585 return (1); 3586 } 3587 if (((int)cmh.cmsg_len + at) > tlen) { 3588 /* We don't have the complete CMSG. */ 3589 *error = EINVAL; 3590 return (1); 3591 } 3592 if (cmh.cmsg_level == IPPROTO_SCTP) { 3593 switch (cmh.cmsg_type) { 3594 case SCTP_INIT: 3595 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct sctp_initmsg)) { 3596 *error = EINVAL; 3597 return (1); 3598 } 3599 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct sctp_initmsg), (caddr_t)&initmsg); 3600 if (initmsg.sinit_max_attempts) 3601 stcb->asoc.max_init_times = initmsg.sinit_max_attempts; 3602 if (initmsg.sinit_num_ostreams) 3603 stcb->asoc.pre_open_streams = initmsg.sinit_num_ostreams; 3604 if (initmsg.sinit_max_instreams) 3605 stcb->asoc.max_inbound_streams = initmsg.sinit_max_instreams; 3606 if (initmsg.sinit_max_init_timeo) 3607 stcb->asoc.initial_init_rto_max = initmsg.sinit_max_init_timeo; 3608 if (stcb->asoc.streamoutcnt < stcb->asoc.pre_open_streams) { 3609 struct sctp_stream_out *tmp_str; 3610 unsigned int i; 3611#if defined(SCTP_DETAILED_STR_STATS) 3612 int j; 3613#endif 3614 3615 /* Default is NOT correct */ 3616 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, default:%d pre_open:%d\n", 3617 stcb->asoc.streamoutcnt, stcb->asoc.pre_open_streams); 3618 SCTP_TCB_UNLOCK(stcb); 3619 SCTP_MALLOC(tmp_str, 3620 struct sctp_stream_out *, 3621 (stcb->asoc.pre_open_streams * sizeof(struct sctp_stream_out)), 3622 SCTP_M_STRMO); 3623 SCTP_TCB_LOCK(stcb); 3624 if (tmp_str != NULL) { 3625 SCTP_FREE(stcb->asoc.strmout, SCTP_M_STRMO); 3626 stcb->asoc.strmout = tmp_str; 3627 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt = stcb->asoc.pre_open_streams; 3628 } else { 3629 stcb->asoc.pre_open_streams = stcb->asoc.streamoutcnt; 3630 } 3631 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 3632 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 3633 stcb->asoc.strmout[i].chunks_on_queues = 0; 3634 stcb->asoc.strmout[i].next_mid_ordered = 0; 3635 stcb->asoc.strmout[i].next_mid_unordered = 0; 3636#if defined(SCTP_DETAILED_STR_STATS) 3637 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 3638 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 3639 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 3640 } 3641#else 3642 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 3643 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 3644#endif 3645 stcb->asoc.strmout[i].sid = i; 3646 stcb->asoc.strmout[i].last_msg_incomplete = 0; 3647 stcb->asoc.strmout[i].state = SCTP_STREAM_OPENING; 3648 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 3649 } 3650 } 3651 break; 3652#ifdef INET 3653 case SCTP_DSTADDRV4: 3654 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in_addr)) { 3655 *error = EINVAL; 3656 return (1); 3657 } 3658 memset(&sin, 0, sizeof(struct sockaddr_in)); 3659 sin.sin_family = AF_INET; 3660 sin.sin_len = sizeof(struct sockaddr_in); 3661 sin.sin_port = stcb->rport; 3662 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3663 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3664 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3665 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3666 *error = EINVAL; 3667 return (1); 3668 } 3669 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3670 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3671 *error = ENOBUFS; 3672 return (1); 3673 } 3674 break; 3675#endif 3676#ifdef INET6 3677 case SCTP_DSTADDRV6: 3678 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in6_addr)) { 3679 *error = EINVAL; 3680 return (1); 3681 } 3682 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3683 sin6.sin6_family = AF_INET6; 3684 sin6.sin6_len = sizeof(struct sockaddr_in6); 3685 sin6.sin6_port = stcb->rport; 3686 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3687 if (IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr) || 3688 IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) { 3689 *error = EINVAL; 3690 return (1); 3691 } 3692#ifdef INET 3693 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3694 in6_sin6_2_sin(&sin, &sin6); 3695 if ((sin.sin_addr.s_addr == INADDR_ANY) || 3696 (sin.sin_addr.s_addr == INADDR_BROADCAST) || 3697 IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) { 3698 *error = EINVAL; 3699 return (1); 3700 } 3701 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin, NULL, stcb->asoc.port, 3702 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3703 *error = ENOBUFS; 3704 return (1); 3705 } 3706 } else 3707#endif 3708 if (sctp_add_remote_addr(stcb, (struct sockaddr *)&sin6, NULL, stcb->asoc.port, 3709 SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) { 3710 *error = ENOBUFS; 3711 return (1); 3712 } 3713 break; 3714#endif 3715 default: 3716 break; 3717 } 3718 } 3719 at += CMSG_ALIGN(cmh.cmsg_len); 3720 } 3721 return (0); 3722} 3723 3724static struct sctp_tcb * 3725sctp_findassociation_cmsgs(struct sctp_inpcb **inp_p, 3726 uint16_t port, 3727 struct mbuf *control, 3728 struct sctp_nets **net_p, 3729 int *error) 3730{ 3731 struct cmsghdr cmh; 3732 int tlen, at; 3733 struct sctp_tcb *stcb; 3734 struct sockaddr *addr; 3735#ifdef INET 3736 struct sockaddr_in sin; 3737#endif 3738#ifdef INET6 3739 struct sockaddr_in6 sin6; 3740#endif 3741 3742 tlen = SCTP_BUF_LEN(control); 3743 at = 0; 3744 while (at < tlen) { 3745 if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) { 3746 /* There is not enough room for one more. */ 3747 *error = EINVAL; 3748 return (NULL); 3749 } 3750 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh); 3751 if (cmh.cmsg_len < CMSG_ALIGN(sizeof(cmh))) { 3752 /* We dont't have a complete CMSG header. */ 3753 *error = EINVAL; 3754 return (NULL); 3755 } 3756 if (((int)cmh.cmsg_len + at) > tlen) { 3757 /* We don't have the complete CMSG. */ 3758 *error = EINVAL; 3759 return (NULL); 3760 } 3761 if (cmh.cmsg_level == IPPROTO_SCTP) { 3762 switch (cmh.cmsg_type) { 3763#ifdef INET 3764 case SCTP_DSTADDRV4: 3765 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in_addr)) { 3766 *error = EINVAL; 3767 return (NULL); 3768 } 3769 memset(&sin, 0, sizeof(struct sockaddr_in)); 3770 sin.sin_family = AF_INET; 3771 sin.sin_len = sizeof(struct sockaddr_in); 3772 sin.sin_port = port; 3773 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in_addr), (caddr_t)&sin.sin_addr); 3774 addr = (struct sockaddr *)&sin; 3775 break; 3776#endif 3777#ifdef INET6 3778 case SCTP_DSTADDRV6: 3779 if ((size_t)(cmh.cmsg_len - CMSG_ALIGN(sizeof(cmh))) < sizeof(struct in6_addr)) { 3780 *error = EINVAL; 3781 return (NULL); 3782 } 3783 memset(&sin6, 0, sizeof(struct sockaddr_in6)); 3784 sin6.sin6_family = AF_INET6; 3785 sin6.sin6_len = sizeof(struct sockaddr_in6); 3786 sin6.sin6_port = port; 3787 m_copydata(control, at + CMSG_ALIGN(sizeof(cmh)), sizeof(struct in6_addr), (caddr_t)&sin6.sin6_addr); 3788#ifdef INET 3789 if (IN6_IS_ADDR_V4MAPPED(&sin6.sin6_addr)) { 3790 in6_sin6_2_sin(&sin, &sin6); 3791 addr = (struct sockaddr *)&sin; 3792 } else 3793#endif 3794 addr = (struct sockaddr *)&sin6; 3795 break; 3796#endif 3797 default: 3798 addr = NULL; 3799 break; 3800 } 3801 if (addr) { 3802 stcb = sctp_findassociation_ep_addr(inp_p, addr, net_p, NULL, NULL); 3803 if (stcb != NULL) { 3804 return (stcb); 3805 } 3806 } 3807 } 3808 at += CMSG_ALIGN(cmh.cmsg_len); 3809 } 3810 return (NULL); 3811} 3812 3813static struct mbuf * 3814sctp_add_cookie(struct mbuf *init, int init_offset, 3815 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in, uint8_t **signature) 3816{ 3817 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 3818 struct sctp_state_cookie *stc; 3819 struct sctp_paramhdr *ph; 3820 uint8_t *foo; 3821 int sig_offset; 3822 uint16_t cookie_sz; 3823 3824 mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) + 3825 sizeof(struct sctp_paramhdr)), 0, 3826 M_NOWAIT, 1, MT_DATA); 3827 if (mret == NULL) { 3828 return (NULL); 3829 } 3830 copy_init = SCTP_M_COPYM(init, init_offset, M_COPYALL, M_NOWAIT); 3831 if (copy_init == NULL) { 3832 sctp_m_freem(mret); 3833 return (NULL); 3834 } 3835#ifdef SCTP_MBUF_LOGGING 3836 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3837 sctp_log_mbc(copy_init, SCTP_MBUF_ICOPY); 3838 } 3839#endif 3840 copy_initack = SCTP_M_COPYM(initack, initack_offset, M_COPYALL, 3841 M_NOWAIT); 3842 if (copy_initack == NULL) { 3843 sctp_m_freem(mret); 3844 sctp_m_freem(copy_init); 3845 return (NULL); 3846 } 3847#ifdef SCTP_MBUF_LOGGING 3848 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 3849 sctp_log_mbc(copy_initack, SCTP_MBUF_ICOPY); 3850 } 3851#endif 3852 /* easy side we just drop it on the end */ 3853 ph = mtod(mret, struct sctp_paramhdr *); 3854 SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) + 3855 sizeof(struct sctp_paramhdr); 3856 stc = (struct sctp_state_cookie *)((caddr_t)ph + 3857 sizeof(struct sctp_paramhdr)); 3858 ph->param_type = htons(SCTP_STATE_COOKIE); 3859 ph->param_length = 0; /* fill in at the end */ 3860 /* Fill in the stc cookie data */ 3861 memcpy(stc, stc_in, sizeof(struct sctp_state_cookie)); 3862 3863 /* tack the INIT and then the INIT-ACK onto the chain */ 3864 cookie_sz = 0; 3865 for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3866 cookie_sz += SCTP_BUF_LEN(m_at); 3867 if (SCTP_BUF_NEXT(m_at) == NULL) { 3868 SCTP_BUF_NEXT(m_at) = copy_init; 3869 break; 3870 } 3871 } 3872 for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3873 cookie_sz += SCTP_BUF_LEN(m_at); 3874 if (SCTP_BUF_NEXT(m_at) == NULL) { 3875 SCTP_BUF_NEXT(m_at) = copy_initack; 3876 break; 3877 } 3878 } 3879 for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 3880 cookie_sz += SCTP_BUF_LEN(m_at); 3881 if (SCTP_BUF_NEXT(m_at) == NULL) { 3882 break; 3883 } 3884 } 3885 sig = sctp_get_mbuf_for_msg(SCTP_SECRET_SIZE, 0, M_NOWAIT, 1, MT_DATA); 3886 if (sig == NULL) { 3887 /* no space, so free the entire chain */ 3888 sctp_m_freem(mret); 3889 return (NULL); 3890 } 3891 SCTP_BUF_LEN(sig) = 0; 3892 SCTP_BUF_NEXT(m_at) = sig; 3893 sig_offset = 0; 3894 foo = (uint8_t *)(mtod(sig, caddr_t)+sig_offset); 3895 memset(foo, 0, SCTP_SIGNATURE_SIZE); 3896 *signature = foo; 3897 SCTP_BUF_LEN(sig) += SCTP_SIGNATURE_SIZE; 3898 cookie_sz += SCTP_SIGNATURE_SIZE; 3899 ph->param_length = htons(cookie_sz); 3900 return (mret); 3901} 3902 3903 3904static uint8_t 3905sctp_get_ect(struct sctp_tcb *stcb) 3906{ 3907 if ((stcb != NULL) && (stcb->asoc.ecn_supported == 1)) { 3908 return (SCTP_ECT0_BIT); 3909 } else { 3910 return (0); 3911 } 3912} 3913 3914#if defined(INET) || defined(INET6) 3915static void 3916sctp_handle_no_route(struct sctp_tcb *stcb, 3917 struct sctp_nets *net, 3918 int so_locked) 3919{ 3920 SCTPDBG(SCTP_DEBUG_OUTPUT1, "dropped packet - no valid source addr\n"); 3921 3922 if (net) { 3923 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Destination was "); 3924 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT1, &net->ro._l_addr.sa); 3925 if (net->dest_state & SCTP_ADDR_CONFIRMED) { 3926 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) { 3927 SCTPDBG(SCTP_DEBUG_OUTPUT1, "no route takes interface %p down\n", (void *)net); 3928 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 3929 stcb, 0, 3930 (void *)net, 3931 so_locked); 3932 net->dest_state &= ~SCTP_ADDR_REACHABLE; 3933 net->dest_state &= ~SCTP_ADDR_PF; 3934 } 3935 } 3936 if (stcb) { 3937 if (net == stcb->asoc.primary_destination) { 3938 /* need a new primary */ 3939 struct sctp_nets *alt; 3940 3941 alt = sctp_find_alternate_net(stcb, net, 0); 3942 if (alt != net) { 3943 if (stcb->asoc.alternate) { 3944 sctp_free_remote_addr(stcb->asoc.alternate); 3945 } 3946 stcb->asoc.alternate = alt; 3947 atomic_add_int(&stcb->asoc.alternate->ref_count, 1); 3948 if (net->ro._s_addr) { 3949 sctp_free_ifa(net->ro._s_addr); 3950 net->ro._s_addr = NULL; 3951 } 3952 net->src_addr_selected = 0; 3953 } 3954 } 3955 } 3956 } 3957} 3958#endif 3959 3960static int 3961sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 3962 struct sctp_tcb *stcb, /* may be NULL */ 3963 struct sctp_nets *net, 3964 struct sockaddr *to, 3965 struct mbuf *m, 3966 uint32_t auth_offset, 3967 struct sctp_auth_chunk *auth, 3968 uint16_t auth_keyid, 3969 int nofragment_flag, 3970 int ecn_ok, 3971 int out_of_asoc_ok, 3972 uint16_t src_port, 3973 uint16_t dest_port, 3974 uint32_t v_tag, 3975 uint16_t port, 3976 union sctp_sockstore *over_addr, 3977 uint8_t mflowtype, uint32_t mflowid, 3978#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 3979 int so_locked SCTP_UNUSED 3980#else 3981 int so_locked 3982#endif 3983) 3984/* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 3985{ 3986 /** 3987 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet header 3988 * WITH an SCTPHDR but no IP header, endpoint inp and sa structure: 3989 * - fill in the HMAC digest of any AUTH chunk in the packet. 3990 * - calculate and fill in the SCTP checksum. 3991 * - prepend an IP address header. 3992 * - if boundall use INADDR_ANY. 3993 * - if boundspecific do source address selection. 3994 * - set fragmentation option for ipV4. 3995 * - On return from IP output, check/adjust mtu size of output 3996 * interface and smallest_mtu size as well. 3997 */ 3998 /* Will need ifdefs around this */ 3999 struct mbuf *newm; 4000 struct sctphdr *sctphdr; 4001 int packet_length; 4002 int ret; 4003#if defined(INET) || defined(INET6) 4004 uint32_t vrf_id; 4005#endif 4006#if defined(INET) || defined(INET6) 4007 struct mbuf *o_pak; 4008 sctp_route_t *ro = NULL; 4009 struct udphdr *udp = NULL; 4010#endif 4011 uint8_t tos_value; 4012#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4013 struct socket *so = NULL; 4014#endif 4015 4016 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 4017 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4018 sctp_m_freem(m); 4019 return (EFAULT); 4020 } 4021#if defined(INET) || defined(INET6) 4022 if (stcb) { 4023 vrf_id = stcb->asoc.vrf_id; 4024 } else { 4025 vrf_id = inp->def_vrf_id; 4026 } 4027#endif 4028 /* fill in the HMAC digest for any AUTH chunk in the packet */ 4029 if ((auth != NULL) && (stcb != NULL)) { 4030 sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb, auth_keyid); 4031 } 4032 if (net) { 4033 tos_value = net->dscp; 4034 } else if (stcb) { 4035 tos_value = stcb->asoc.default_dscp; 4036 } else { 4037 tos_value = inp->sctp_ep.default_dscp; 4038 } 4039 4040 switch (to->sa_family) { 4041#ifdef INET 4042 case AF_INET: 4043 { 4044 struct ip *ip = NULL; 4045 sctp_route_t iproute; 4046 int len; 4047 4048 len = SCTP_MIN_V4_OVERHEAD; 4049 if (port) { 4050 len += sizeof(struct udphdr); 4051 } 4052 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4053 if (newm == NULL) { 4054 sctp_m_freem(m); 4055 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4056 return (ENOMEM); 4057 } 4058 SCTP_ALIGN_TO_END(newm, len); 4059 SCTP_BUF_LEN(newm) = len; 4060 SCTP_BUF_NEXT(newm) = m; 4061 m = newm; 4062 if (net != NULL) { 4063 m->m_pkthdr.flowid = net->flowid; 4064 M_HASHTYPE_SET(m, net->flowtype); 4065 } else { 4066 m->m_pkthdr.flowid = mflowid; 4067 M_HASHTYPE_SET(m, mflowtype); 4068 } 4069 packet_length = sctp_calculate_len(m); 4070 ip = mtod(m, struct ip *); 4071 ip->ip_v = IPVERSION; 4072 ip->ip_hl = (sizeof(struct ip) >> 2); 4073 if (tos_value == 0) { 4074 /* 4075 * This means especially, that it is not set 4076 * at the SCTP layer. So use the value from 4077 * the IP layer. 4078 */ 4079 tos_value = inp->ip_inp.inp.inp_ip_tos; 4080 } 4081 tos_value &= 0xfc; 4082 if (ecn_ok) { 4083 tos_value |= sctp_get_ect(stcb); 4084 } 4085 if ((nofragment_flag) && (port == 0)) { 4086 ip->ip_off = htons(IP_DF); 4087 } else { 4088 ip->ip_off = htons(0); 4089 } 4090 /* FreeBSD has a function for ip_id's */ 4091 ip_fillid(ip); 4092 4093 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl; 4094 ip->ip_len = htons(packet_length); 4095 ip->ip_tos = tos_value; 4096 if (port) { 4097 ip->ip_p = IPPROTO_UDP; 4098 } else { 4099 ip->ip_p = IPPROTO_SCTP; 4100 } 4101 ip->ip_sum = 0; 4102 if (net == NULL) { 4103 ro = &iproute; 4104 memset(&iproute, 0, sizeof(iproute)); 4105 memcpy(&ro->ro_dst, to, to->sa_len); 4106 } else { 4107 ro = (sctp_route_t *)&net->ro; 4108 } 4109 /* Now the address selection part */ 4110 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr; 4111 4112 /* call the routine to select the src address */ 4113 if (net && out_of_asoc_ok == 0) { 4114 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4115 sctp_free_ifa(net->ro._s_addr); 4116 net->ro._s_addr = NULL; 4117 net->src_addr_selected = 0; 4118 if (ro->ro_rt) { 4119 RTFREE(ro->ro_rt); 4120 ro->ro_rt = NULL; 4121 } 4122 } 4123 if (net->src_addr_selected == 0) { 4124 /* Cache the source address */ 4125 net->ro._s_addr = sctp_source_address_selection(inp, stcb, 4126 ro, net, 0, 4127 vrf_id); 4128 net->src_addr_selected = 1; 4129 } 4130 if (net->ro._s_addr == NULL) { 4131 /* No route to host */ 4132 net->src_addr_selected = 0; 4133 sctp_handle_no_route(stcb, net, so_locked); 4134 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4135 sctp_m_freem(m); 4136 return (EHOSTUNREACH); 4137 } 4138 ip->ip_src = net->ro._s_addr->address.sin.sin_addr; 4139 } else { 4140 if (over_addr == NULL) { 4141 struct sctp_ifa *_lsrc; 4142 4143 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4144 net, 4145 out_of_asoc_ok, 4146 vrf_id); 4147 if (_lsrc == NULL) { 4148 sctp_handle_no_route(stcb, net, so_locked); 4149 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4150 sctp_m_freem(m); 4151 return (EHOSTUNREACH); 4152 } 4153 ip->ip_src = _lsrc->address.sin.sin_addr; 4154 sctp_free_ifa(_lsrc); 4155 } else { 4156 ip->ip_src = over_addr->sin.sin_addr; 4157 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4158 } 4159 } 4160 if (port) { 4161 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4162 sctp_handle_no_route(stcb, net, so_locked); 4163 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4164 sctp_m_freem(m); 4165 return (EHOSTUNREACH); 4166 } 4167 udp = (struct udphdr *)((caddr_t)ip + sizeof(struct ip)); 4168 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4169 udp->uh_dport = port; 4170 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip))); 4171 if (V_udp_cksum) { 4172 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 4173 } else { 4174 udp->uh_sum = 0; 4175 } 4176 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4177 } else { 4178 sctphdr = (struct sctphdr *)((caddr_t)ip + sizeof(struct ip)); 4179 } 4180 4181 sctphdr->src_port = src_port; 4182 sctphdr->dest_port = dest_port; 4183 sctphdr->v_tag = v_tag; 4184 sctphdr->checksum = 0; 4185 4186 /* 4187 * If source address selection fails and we find no 4188 * route then the ip_output should fail as well with 4189 * a NO_ROUTE_TO_HOST type error. We probably should 4190 * catch that somewhere and abort the association 4191 * right away (assuming this is an INIT being sent). 4192 */ 4193 if (ro->ro_rt == NULL) { 4194 /* 4195 * src addr selection failed to find a route 4196 * (or valid source addr), so we can't get 4197 * there from here (yet)! 4198 */ 4199 sctp_handle_no_route(stcb, net, so_locked); 4200 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4201 sctp_m_freem(m); 4202 return (EHOSTUNREACH); 4203 } 4204 if (ro != &iproute) { 4205 memcpy(&iproute, ro, sizeof(*ro)); 4206 } 4207 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv4 output routine from low level src addr:%x\n", 4208 (uint32_t)(ntohl(ip->ip_src.s_addr))); 4209 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Destination is %x\n", 4210 (uint32_t)(ntohl(ip->ip_dst.s_addr))); 4211 SCTPDBG(SCTP_DEBUG_OUTPUT3, "RTP route is %p through\n", 4212 (void *)ro->ro_rt); 4213 4214 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4215 /* failed to prepend data, give up */ 4216 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4217 sctp_m_freem(m); 4218 return (ENOMEM); 4219 } 4220 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4221 if (port) { 4222#if defined(SCTP_WITH_NO_CSUM) 4223 SCTP_STAT_INCR(sctps_sendnocrc); 4224#else 4225 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip) + sizeof(struct udphdr)); 4226 SCTP_STAT_INCR(sctps_sendswcrc); 4227#endif 4228 if (V_udp_cksum) { 4229 SCTP_ENABLE_UDP_CSUM(o_pak); 4230 } 4231 } else { 4232#if defined(SCTP_WITH_NO_CSUM) 4233 SCTP_STAT_INCR(sctps_sendnocrc); 4234#else 4235 m->m_pkthdr.csum_flags = CSUM_SCTP; 4236 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4237 SCTP_STAT_INCR(sctps_sendhwcrc); 4238#endif 4239 } 4240#ifdef SCTP_PACKET_LOGGING 4241 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4242 sctp_packet_log(o_pak); 4243#endif 4244 /* send it out. table id is taken from stcb */ 4245#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4246 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4247 so = SCTP_INP_SO(inp); 4248 SCTP_SOCKET_UNLOCK(so, 0); 4249 } 4250#endif 4251 SCTP_IP_OUTPUT(ret, o_pak, ro, stcb, vrf_id); 4252#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4253 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4254 atomic_add_int(&stcb->asoc.refcnt, 1); 4255 SCTP_TCB_UNLOCK(stcb); 4256 SCTP_SOCKET_LOCK(so, 0); 4257 SCTP_TCB_LOCK(stcb); 4258 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4259 } 4260#endif 4261 SCTP_STAT_INCR(sctps_sendpackets); 4262 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4263 if (ret) 4264 SCTP_STAT_INCR(sctps_senderrors); 4265 4266 SCTPDBG(SCTP_DEBUG_OUTPUT3, "IP output returns %d\n", ret); 4267 if (net == NULL) { 4268 /* free tempy routes */ 4269 RO_RTFREE(ro); 4270 } else { 4271 /* 4272 * PMTU check versus smallest asoc MTU goes 4273 * here 4274 */ 4275 if ((ro->ro_rt != NULL) && 4276 (net->ro._s_addr)) { 4277 uint32_t mtu; 4278 4279 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt); 4280 if (net->port) { 4281 mtu -= sizeof(struct udphdr); 4282 } 4283 if (mtu && (stcb->asoc.smallest_mtu > mtu)) { 4284 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4285 net->mtu = mtu; 4286 } 4287 } else if (ro->ro_rt == NULL) { 4288 /* route was freed */ 4289 if (net->ro._s_addr && 4290 net->src_addr_selected) { 4291 sctp_free_ifa(net->ro._s_addr); 4292 net->ro._s_addr = NULL; 4293 } 4294 net->src_addr_selected = 0; 4295 } 4296 } 4297 return (ret); 4298 } 4299#endif 4300#ifdef INET6 4301 case AF_INET6: 4302 { 4303 uint32_t flowlabel, flowinfo; 4304 struct ip6_hdr *ip6h; 4305 struct route_in6 ip6route; 4306 struct ifnet *ifp; 4307 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 4308 int prev_scope = 0; 4309 struct sockaddr_in6 lsa6_storage; 4310 int error; 4311 u_short prev_port = 0; 4312 int len; 4313 4314 if (net) { 4315 flowlabel = net->flowlabel; 4316 } else if (stcb) { 4317 flowlabel = stcb->asoc.default_flowlabel; 4318 } else { 4319 flowlabel = inp->sctp_ep.default_flowlabel; 4320 } 4321 if (flowlabel == 0) { 4322 /* 4323 * This means especially, that it is not set 4324 * at the SCTP layer. So use the value from 4325 * the IP layer. 4326 */ 4327 flowlabel = ntohl(((struct in6pcb *)inp)->in6p_flowinfo); 4328 } 4329 flowlabel &= 0x000fffff; 4330 len = SCTP_MIN_OVERHEAD; 4331 if (port) { 4332 len += sizeof(struct udphdr); 4333 } 4334 newm = sctp_get_mbuf_for_msg(len, 1, M_NOWAIT, 1, MT_DATA); 4335 if (newm == NULL) { 4336 sctp_m_freem(m); 4337 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4338 return (ENOMEM); 4339 } 4340 SCTP_ALIGN_TO_END(newm, len); 4341 SCTP_BUF_LEN(newm) = len; 4342 SCTP_BUF_NEXT(newm) = m; 4343 m = newm; 4344 if (net != NULL) { 4345 m->m_pkthdr.flowid = net->flowid; 4346 M_HASHTYPE_SET(m, net->flowtype); 4347 } else { 4348 m->m_pkthdr.flowid = mflowid; 4349 M_HASHTYPE_SET(m, mflowtype); 4350 } 4351 packet_length = sctp_calculate_len(m); 4352 4353 ip6h = mtod(m, struct ip6_hdr *); 4354 /* protect *sin6 from overwrite */ 4355 sin6 = (struct sockaddr_in6 *)to; 4356 tmp = *sin6; 4357 sin6 = &tmp; 4358 4359 /* KAME hack: embed scopeid */ 4360 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4361 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4362 return (EINVAL); 4363 } 4364 if (net == NULL) { 4365 memset(&ip6route, 0, sizeof(ip6route)); 4366 ro = (sctp_route_t *)&ip6route; 4367 memcpy(&ro->ro_dst, sin6, sin6->sin6_len); 4368 } else { 4369 ro = (sctp_route_t *)&net->ro; 4370 } 4371 /* 4372 * We assume here that inp_flow is in host byte 4373 * order within the TCB! 4374 */ 4375 if (tos_value == 0) { 4376 /* 4377 * This means especially, that it is not set 4378 * at the SCTP layer. So use the value from 4379 * the IP layer. 4380 */ 4381 tos_value = (ntohl(((struct in6pcb *)inp)->in6p_flowinfo) >> 20) & 0xff; 4382 } 4383 tos_value &= 0xfc; 4384 if (ecn_ok) { 4385 tos_value |= sctp_get_ect(stcb); 4386 } 4387 flowinfo = 0x06; 4388 flowinfo <<= 8; 4389 flowinfo |= tos_value; 4390 flowinfo <<= 20; 4391 flowinfo |= flowlabel; 4392 ip6h->ip6_flow = htonl(flowinfo); 4393 if (port) { 4394 ip6h->ip6_nxt = IPPROTO_UDP; 4395 } else { 4396 ip6h->ip6_nxt = IPPROTO_SCTP; 4397 } 4398 ip6h->ip6_plen = (uint16_t)(packet_length - sizeof(struct ip6_hdr)); 4399 ip6h->ip6_dst = sin6->sin6_addr; 4400 4401 /* 4402 * Add SRC address selection here: we can only reuse 4403 * to a limited degree the kame src-addr-sel, since 4404 * we can try their selection but it may not be 4405 * bound. 4406 */ 4407 bzero(&lsa6_tmp, sizeof(lsa6_tmp)); 4408 lsa6_tmp.sin6_family = AF_INET6; 4409 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 4410 lsa6 = &lsa6_tmp; 4411 if (net && out_of_asoc_ok == 0) { 4412 if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) { 4413 sctp_free_ifa(net->ro._s_addr); 4414 net->ro._s_addr = NULL; 4415 net->src_addr_selected = 0; 4416 if (ro->ro_rt) { 4417 RTFREE(ro->ro_rt); 4418 ro->ro_rt = NULL; 4419 } 4420 } 4421 if (net->src_addr_selected == 0) { 4422 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4423 /* KAME hack: embed scopeid */ 4424 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4425 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4426 return (EINVAL); 4427 } 4428 /* Cache the source address */ 4429 net->ro._s_addr = sctp_source_address_selection(inp, 4430 stcb, 4431 ro, 4432 net, 4433 0, 4434 vrf_id); 4435 (void)sa6_recoverscope(sin6); 4436 net->src_addr_selected = 1; 4437 } 4438 if (net->ro._s_addr == NULL) { 4439 SCTPDBG(SCTP_DEBUG_OUTPUT3, "V6:No route to host\n"); 4440 net->src_addr_selected = 0; 4441 sctp_handle_no_route(stcb, net, so_locked); 4442 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4443 sctp_m_freem(m); 4444 return (EHOSTUNREACH); 4445 } 4446 lsa6->sin6_addr = net->ro._s_addr->address.sin6.sin6_addr; 4447 } else { 4448 sin6 = (struct sockaddr_in6 *)&ro->ro_dst; 4449 /* KAME hack: embed scopeid */ 4450 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) { 4451 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 4452 return (EINVAL); 4453 } 4454 if (over_addr == NULL) { 4455 struct sctp_ifa *_lsrc; 4456 4457 _lsrc = sctp_source_address_selection(inp, stcb, ro, 4458 net, 4459 out_of_asoc_ok, 4460 vrf_id); 4461 if (_lsrc == NULL) { 4462 sctp_handle_no_route(stcb, net, so_locked); 4463 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4464 sctp_m_freem(m); 4465 return (EHOSTUNREACH); 4466 } 4467 lsa6->sin6_addr = _lsrc->address.sin6.sin6_addr; 4468 sctp_free_ifa(_lsrc); 4469 } else { 4470 lsa6->sin6_addr = over_addr->sin6.sin6_addr; 4471 SCTP_RTALLOC(ro, vrf_id, inp->fibnum); 4472 } 4473 (void)sa6_recoverscope(sin6); 4474 } 4475 lsa6->sin6_port = inp->sctp_lport; 4476 4477 if (ro->ro_rt == NULL) { 4478 /* 4479 * src addr selection failed to find a route 4480 * (or valid source addr), so we can't get 4481 * there from here! 4482 */ 4483 sctp_handle_no_route(stcb, net, so_locked); 4484 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4485 sctp_m_freem(m); 4486 return (EHOSTUNREACH); 4487 } 4488 /* 4489 * XXX: sa6 may not have a valid sin6_scope_id in 4490 * the non-SCOPEDROUTING case. 4491 */ 4492 bzero(&lsa6_storage, sizeof(lsa6_storage)); 4493 lsa6_storage.sin6_family = AF_INET6; 4494 lsa6_storage.sin6_len = sizeof(lsa6_storage); 4495 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4496 if ((error = sa6_recoverscope(&lsa6_storage)) != 0) { 4497 SCTPDBG(SCTP_DEBUG_OUTPUT3, "recover scope fails error %d\n", error); 4498 sctp_m_freem(m); 4499 return (error); 4500 } 4501 /* XXX */ 4502 lsa6_storage.sin6_addr = lsa6->sin6_addr; 4503 lsa6_storage.sin6_port = inp->sctp_lport; 4504 lsa6 = &lsa6_storage; 4505 ip6h->ip6_src = lsa6->sin6_addr; 4506 4507 if (port) { 4508 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 4509 sctp_handle_no_route(stcb, net, so_locked); 4510 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH); 4511 sctp_m_freem(m); 4512 return (EHOSTUNREACH); 4513 } 4514 udp = (struct udphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4515 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 4516 udp->uh_dport = port; 4517 udp->uh_ulen = htons((uint16_t)(packet_length - sizeof(struct ip6_hdr))); 4518 udp->uh_sum = 0; 4519 sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr)); 4520 } else { 4521 sctphdr = (struct sctphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr)); 4522 } 4523 4524 sctphdr->src_port = src_port; 4525 sctphdr->dest_port = dest_port; 4526 sctphdr->v_tag = v_tag; 4527 sctphdr->checksum = 0; 4528 4529 /* 4530 * We set the hop limit now since there is a good 4531 * chance that our ro pointer is now filled 4532 */ 4533 ip6h->ip6_hlim = SCTP_GET_HLIM(inp, ro); 4534 ifp = SCTP_GET_IFN_VOID_FROM_ROUTE(ro); 4535 4536#ifdef SCTP_DEBUG 4537 /* Copy to be sure something bad is not happening */ 4538 sin6->sin6_addr = ip6h->ip6_dst; 4539 lsa6->sin6_addr = ip6h->ip6_src; 4540#endif 4541 4542 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv6 output routine from low level\n"); 4543 SCTPDBG(SCTP_DEBUG_OUTPUT3, "src: "); 4544 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)lsa6); 4545 SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst: "); 4546 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)sin6); 4547 if (net) { 4548 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr; 4549 /* 4550 * preserve the port and scope for link 4551 * local send 4552 */ 4553 prev_scope = sin6->sin6_scope_id; 4554 prev_port = sin6->sin6_port; 4555 } 4556 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 4557 /* failed to prepend data, give up */ 4558 sctp_m_freem(m); 4559 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 4560 return (ENOMEM); 4561 } 4562 SCTP_ATTACH_CHAIN(o_pak, m, packet_length); 4563 if (port) { 4564#if defined(SCTP_WITH_NO_CSUM) 4565 SCTP_STAT_INCR(sctps_sendnocrc); 4566#else 4567 sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 4568 SCTP_STAT_INCR(sctps_sendswcrc); 4569#endif 4570 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), packet_length - sizeof(struct ip6_hdr))) == 0) { 4571 udp->uh_sum = 0xffff; 4572 } 4573 } else { 4574#if defined(SCTP_WITH_NO_CSUM) 4575 SCTP_STAT_INCR(sctps_sendnocrc); 4576#else 4577 m->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 4578 m->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 4579 SCTP_STAT_INCR(sctps_sendhwcrc); 4580#endif 4581 } 4582 /* send it out. table id is taken from stcb */ 4583#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4584 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4585 so = SCTP_INP_SO(inp); 4586 SCTP_SOCKET_UNLOCK(so, 0); 4587 } 4588#endif 4589#ifdef SCTP_PACKET_LOGGING 4590 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) 4591 sctp_packet_log(o_pak); 4592#endif 4593 SCTP_IP6_OUTPUT(ret, o_pak, (struct route_in6 *)ro, &ifp, stcb, vrf_id); 4594#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING) 4595 if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) { 4596 atomic_add_int(&stcb->asoc.refcnt, 1); 4597 SCTP_TCB_UNLOCK(stcb); 4598 SCTP_SOCKET_LOCK(so, 0); 4599 SCTP_TCB_LOCK(stcb); 4600 atomic_subtract_int(&stcb->asoc.refcnt, 1); 4601 } 4602#endif 4603 if (net) { 4604 /* for link local this must be done */ 4605 sin6->sin6_scope_id = prev_scope; 4606 sin6->sin6_port = prev_port; 4607 } 4608 SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret); 4609 SCTP_STAT_INCR(sctps_sendpackets); 4610 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 4611 if (ret) { 4612 SCTP_STAT_INCR(sctps_senderrors); 4613 } 4614 if (net == NULL) { 4615 /* Now if we had a temp route free it */ 4616 RO_RTFREE(ro); 4617 } else { 4618 /* 4619 * PMTU check versus smallest asoc MTU goes 4620 * here 4621 */ 4622 if (ro->ro_rt == NULL) { 4623 /* Route was freed */ 4624 if (net->ro._s_addr && 4625 net->src_addr_selected) { 4626 sctp_free_ifa(net->ro._s_addr); 4627 net->ro._s_addr = NULL; 4628 } 4629 net->src_addr_selected = 0; 4630 } 4631 if ((ro->ro_rt != NULL) && 4632 (net->ro._s_addr)) { 4633 uint32_t mtu; 4634 4635 mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt); 4636 if (mtu && 4637 (stcb->asoc.smallest_mtu > mtu)) { 4638 sctp_mtu_size_reset(inp, &stcb->asoc, mtu); 4639 net->mtu = mtu; 4640 if (net->port) { 4641 net->mtu -= sizeof(struct udphdr); 4642 } 4643 } 4644 } else if (ifp) { 4645 if (ND_IFINFO(ifp)->linkmtu && 4646 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) { 4647 sctp_mtu_size_reset(inp, 4648 &stcb->asoc, 4649 ND_IFINFO(ifp)->linkmtu); 4650 } 4651 } 4652 } 4653 return (ret); 4654 } 4655#endif 4656 default: 4657 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 4658 ((struct sockaddr *)to)->sa_family); 4659 sctp_m_freem(m); 4660 SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 4661 return (EFAULT); 4662 } 4663} 4664 4665 4666void 4667sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int so_locked 4668#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 4669 SCTP_UNUSED 4670#endif 4671) 4672{ 4673 struct mbuf *m, *m_last; 4674 struct sctp_nets *net; 4675 struct sctp_init_chunk *init; 4676 struct sctp_supported_addr_param *sup_addr; 4677 struct sctp_adaptation_layer_indication *ali; 4678 struct sctp_supported_chunk_types_param *pr_supported; 4679 struct sctp_paramhdr *ph; 4680 int cnt_inits_to = 0; 4681 int error; 4682 uint16_t num_ext, chunk_len, padding_len, parameter_len; 4683 4684 /* INIT's always go to the primary (and usually ONLY address) */ 4685 net = stcb->asoc.primary_destination; 4686 if (net == NULL) { 4687 net = TAILQ_FIRST(&stcb->asoc.nets); 4688 if (net == NULL) { 4689 /* TSNH */ 4690 return; 4691 } 4692 /* we confirm any address we send an INIT to */ 4693 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4694 (void)sctp_set_primary_addr(stcb, NULL, net); 4695 } else { 4696 /* we confirm any address we send an INIT to */ 4697 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 4698 } 4699 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT\n"); 4700#ifdef INET6 4701 if (net->ro._l_addr.sa.sa_family == AF_INET6) { 4702 /* 4703 * special hook, if we are sending to link local it will not 4704 * show up in our private address count. 4705 */ 4706 if (IN6_IS_ADDR_LINKLOCAL(&net->ro._l_addr.sin6.sin6_addr)) 4707 cnt_inits_to = 1; 4708 } 4709#endif 4710 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 4711 /* This case should not happen */ 4712 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - failed timer?\n"); 4713 return; 4714 } 4715 /* start the INIT timer */ 4716 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 4717 4718 m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_NOWAIT, 1, MT_DATA); 4719 if (m == NULL) { 4720 /* No memory, INIT timer will re-attempt. */ 4721 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - mbuf?\n"); 4722 return; 4723 } 4724 chunk_len = (uint16_t)sizeof(struct sctp_init_chunk); 4725 padding_len = 0; 4726 /* Now lets put the chunk header in place */ 4727 init = mtod(m, struct sctp_init_chunk *); 4728 /* now the chunk header */ 4729 init->ch.chunk_type = SCTP_INITIATION; 4730 init->ch.chunk_flags = 0; 4731 /* fill in later from mbuf we build */ 4732 init->ch.chunk_length = 0; 4733 /* place in my tag */ 4734 init->init.initiate_tag = htonl(stcb->asoc.my_vtag); 4735 /* set up some of the credits. */ 4736 init->init.a_rwnd = htonl(max(inp->sctp_socket ? SCTP_SB_LIMIT_RCV(inp->sctp_socket) : 0, 4737 SCTP_MINIMAL_RWND)); 4738 init->init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 4739 init->init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 4740 init->init.initial_tsn = htonl(stcb->asoc.init_seq_number); 4741 4742 /* Adaptation layer indication parameter */ 4743 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 4744 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 4745 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 4746 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 4747 ali->ph.param_length = htons(parameter_len); 4748 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 4749 chunk_len += parameter_len; 4750 } 4751 /* ECN parameter */ 4752 if (stcb->asoc.ecn_supported == 1) { 4753 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4754 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4755 ph->param_type = htons(SCTP_ECN_CAPABLE); 4756 ph->param_length = htons(parameter_len); 4757 chunk_len += parameter_len; 4758 } 4759 /* PR-SCTP supported parameter */ 4760 if (stcb->asoc.prsctp_supported == 1) { 4761 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4762 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4763 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 4764 ph->param_length = htons(parameter_len); 4765 chunk_len += parameter_len; 4766 } 4767 /* Add NAT friendly parameter. */ 4768 if (SCTP_BASE_SYSCTL(sctp_inits_include_nat_friendly)) { 4769 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4770 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 4771 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 4772 ph->param_length = htons(parameter_len); 4773 chunk_len += parameter_len; 4774 } 4775 /* And now tell the peer which extensions we support */ 4776 num_ext = 0; 4777 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 4778 if (stcb->asoc.prsctp_supported == 1) { 4779 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 4780 if (stcb->asoc.idata_supported) { 4781 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 4782 } 4783 } 4784 if (stcb->asoc.auth_supported == 1) { 4785 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 4786 } 4787 if (stcb->asoc.asconf_supported == 1) { 4788 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 4789 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 4790 } 4791 if (stcb->asoc.reconfig_supported == 1) { 4792 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 4793 } 4794 if (stcb->asoc.idata_supported) { 4795 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 4796 } 4797 if (stcb->asoc.nrsack_supported == 1) { 4798 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 4799 } 4800 if (stcb->asoc.pktdrop_supported == 1) { 4801 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 4802 } 4803 if (num_ext > 0) { 4804 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 4805 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 4806 pr_supported->ph.param_length = htons(parameter_len); 4807 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4808 chunk_len += parameter_len; 4809 } 4810 /* add authentication parameters */ 4811 if (stcb->asoc.auth_supported) { 4812 /* attach RANDOM parameter, if available */ 4813 if (stcb->asoc.authinfo.random != NULL) { 4814 struct sctp_auth_random *randp; 4815 4816 if (padding_len > 0) { 4817 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4818 chunk_len += padding_len; 4819 padding_len = 0; 4820 } 4821 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 4822 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + stcb->asoc.authinfo.random_len; 4823 /* random key already contains the header */ 4824 memcpy(randp, stcb->asoc.authinfo.random->key, parameter_len); 4825 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4826 chunk_len += parameter_len; 4827 } 4828 /* add HMAC_ALGO parameter */ 4829 if (stcb->asoc.local_hmacs != NULL) { 4830 struct sctp_auth_hmac_algo *hmacs; 4831 4832 if (padding_len > 0) { 4833 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4834 chunk_len += padding_len; 4835 padding_len = 0; 4836 } 4837 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 4838 parameter_len = (uint16_t)(sizeof(struct sctp_auth_hmac_algo) + 4839 stcb->asoc.local_hmacs->num_algo * sizeof(uint16_t)); 4840 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 4841 hmacs->ph.param_length = htons(parameter_len); 4842 sctp_serialize_hmaclist(stcb->asoc.local_hmacs, (uint8_t *)hmacs->hmac_ids); 4843 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4844 chunk_len += parameter_len; 4845 } 4846 /* add CHUNKS parameter */ 4847 if (stcb->asoc.local_auth_chunks != NULL) { 4848 struct sctp_auth_chunk_list *chunks; 4849 4850 if (padding_len > 0) { 4851 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4852 chunk_len += padding_len; 4853 padding_len = 0; 4854 } 4855 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 4856 parameter_len = (uint16_t)(sizeof(struct sctp_auth_chunk_list) + 4857 sctp_auth_get_chklist_size(stcb->asoc.local_auth_chunks)); 4858 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 4859 chunks->ph.param_length = htons(parameter_len); 4860 sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks, chunks->chunk_types); 4861 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 4862 chunk_len += parameter_len; 4863 } 4864 } 4865 /* now any cookie time extensions */ 4866 if (stcb->asoc.cookie_preserve_req) { 4867 struct sctp_cookie_perserve_param *cookie_preserve; 4868 4869 if (padding_len > 0) { 4870 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4871 chunk_len += padding_len; 4872 padding_len = 0; 4873 } 4874 parameter_len = (uint16_t)sizeof(struct sctp_cookie_perserve_param); 4875 cookie_preserve = (struct sctp_cookie_perserve_param *)(mtod(m, caddr_t)+chunk_len); 4876 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 4877 cookie_preserve->ph.param_length = htons(parameter_len); 4878 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 4879 stcb->asoc.cookie_preserve_req = 0; 4880 chunk_len += parameter_len; 4881 } 4882 if (stcb->asoc.scope.ipv4_addr_legal || stcb->asoc.scope.ipv6_addr_legal) { 4883 uint8_t i; 4884 4885 if (padding_len > 0) { 4886 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 4887 chunk_len += padding_len; 4888 padding_len = 0; 4889 } 4890 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 4891 if (stcb->asoc.scope.ipv4_addr_legal) { 4892 parameter_len += (uint16_t)sizeof(uint16_t); 4893 } 4894 if (stcb->asoc.scope.ipv6_addr_legal) { 4895 parameter_len += (uint16_t)sizeof(uint16_t); 4896 } 4897 sup_addr = (struct sctp_supported_addr_param *)(mtod(m, caddr_t)+chunk_len); 4898 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 4899 sup_addr->ph.param_length = htons(parameter_len); 4900 i = 0; 4901 if (stcb->asoc.scope.ipv4_addr_legal) { 4902 sup_addr->addr_type[i++] = htons(SCTP_IPV4_ADDRESS); 4903 } 4904 if (stcb->asoc.scope.ipv6_addr_legal) { 4905 sup_addr->addr_type[i++] = htons(SCTP_IPV6_ADDRESS); 4906 } 4907 padding_len = 4 - 2 * i; 4908 chunk_len += parameter_len; 4909 } 4910 SCTP_BUF_LEN(m) = chunk_len; 4911 /* now the addresses */ 4912 /* 4913 * To optimize this we could put the scoping stuff into a structure 4914 * and remove the individual uint8's from the assoc structure. Then 4915 * we could just sifa in the address within the stcb. But for now 4916 * this is a quick hack to get the address stuff teased apart. 4917 */ 4918 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &stcb->asoc.scope, 4919 m, cnt_inits_to, 4920 &padding_len, &chunk_len); 4921 4922 init->ch.chunk_length = htons(chunk_len); 4923 if (padding_len > 0) { 4924 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 4925 sctp_m_freem(m); 4926 return; 4927 } 4928 } 4929 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - calls lowlevel_output\n"); 4930 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 4931 (struct sockaddr *)&net->ro._l_addr, 4932 m, 0, NULL, 0, 0, 0, 0, 4933 inp->sctp_lport, stcb->rport, htonl(0), 4934 net->port, NULL, 4935 0, 0, 4936 so_locked))) { 4937 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 4938 if (error == ENOBUFS) { 4939 stcb->asoc.ifp_had_enobuf = 1; 4940 SCTP_STAT_INCR(sctps_lowlevelerr); 4941 } 4942 } else { 4943 stcb->asoc.ifp_had_enobuf = 0; 4944 } 4945 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 4946 (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 4947} 4948 4949struct mbuf * 4950sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 4951 int param_offset, int *abort_processing, struct sctp_chunkhdr *cp, int *nat_friendly) 4952{ 4953 /* 4954 * Given a mbuf containing an INIT or INIT-ACK with the param_offset 4955 * being equal to the beginning of the params i.e. (iphlen + 4956 * sizeof(struct sctp_init_msg) parse through the parameters to the 4957 * end of the mbuf verifying that all parameters are known. 4958 * 4959 * For unknown parameters build and return a mbuf with 4960 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop 4961 * processing this chunk stop, and set *abort_processing to 1. 4962 * 4963 * By having param_offset be pre-set to where parameters begin it is 4964 * hoped that this routine may be reused in the future by new 4965 * features. 4966 */ 4967 struct sctp_paramhdr *phdr, params; 4968 4969 struct mbuf *mat, *op_err; 4970 char tempbuf[SCTP_PARAM_BUFFER_SIZE]; 4971 int at, limit, pad_needed; 4972 uint16_t ptype, plen, padded_size; 4973 int err_at; 4974 4975 *abort_processing = 0; 4976 mat = in_initpkt; 4977 err_at = 0; 4978 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 4979 at = param_offset; 4980 op_err = NULL; 4981 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Check for unrecognized param's\n"); 4982 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 4983 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 4984 ptype = ntohs(phdr->param_type); 4985 plen = ntohs(phdr->param_length); 4986 if ((plen > limit) || (plen < sizeof(struct sctp_paramhdr))) { 4987 /* wacked parameter */ 4988 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error %d\n", plen); 4989 goto invalid_size; 4990 } 4991 limit -= SCTP_SIZE32(plen); 4992 /*- 4993 * All parameters for all chunks that we know/understand are 4994 * listed here. We process them other places and make 4995 * appropriate stop actions per the upper bits. However this 4996 * is the generic routine processor's can call to get back 4997 * an operr.. to either incorporate (init-ack) or send. 4998 */ 4999 padded_size = SCTP_SIZE32(plen); 5000 switch (ptype) { 5001 /* Param's with variable size */ 5002 case SCTP_HEARTBEAT_INFO: 5003 case SCTP_STATE_COOKIE: 5004 case SCTP_UNRECOG_PARAM: 5005 case SCTP_ERROR_CAUSE_IND: 5006 /* ok skip fwd */ 5007 at += padded_size; 5008 break; 5009 /* Param's with variable size within a range */ 5010 case SCTP_CHUNK_LIST: 5011 case SCTP_SUPPORTED_CHUNK_EXT: 5012 if (padded_size > (sizeof(struct sctp_supported_chunk_types_param) + (sizeof(uint8_t) * SCTP_MAX_SUPPORTED_EXT))) { 5013 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error chklist %d\n", plen); 5014 goto invalid_size; 5015 } 5016 at += padded_size; 5017 break; 5018 case SCTP_SUPPORTED_ADDRTYPE: 5019 if (padded_size > SCTP_MAX_ADDR_PARAMS_SIZE) { 5020 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error supaddrtype %d\n", plen); 5021 goto invalid_size; 5022 } 5023 at += padded_size; 5024 break; 5025 case SCTP_RANDOM: 5026 if (padded_size > (sizeof(struct sctp_auth_random) + SCTP_RANDOM_MAX_SIZE)) { 5027 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error random %d\n", plen); 5028 goto invalid_size; 5029 } 5030 at += padded_size; 5031 break; 5032 case SCTP_SET_PRIM_ADDR: 5033 case SCTP_DEL_IP_ADDRESS: 5034 case SCTP_ADD_IP_ADDRESS: 5035 if ((padded_size != sizeof(struct sctp_asconf_addrv4_param)) && 5036 (padded_size != sizeof(struct sctp_asconf_addr_param))) { 5037 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error setprim %d\n", plen); 5038 goto invalid_size; 5039 } 5040 at += padded_size; 5041 break; 5042 /* Param's with a fixed size */ 5043 case SCTP_IPV4_ADDRESS: 5044 if (padded_size != sizeof(struct sctp_ipv4addr_param)) { 5045 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv4 addr %d\n", plen); 5046 goto invalid_size; 5047 } 5048 at += padded_size; 5049 break; 5050 case SCTP_IPV6_ADDRESS: 5051 if (padded_size != sizeof(struct sctp_ipv6addr_param)) { 5052 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv6 addr %d\n", plen); 5053 goto invalid_size; 5054 } 5055 at += padded_size; 5056 break; 5057 case SCTP_COOKIE_PRESERVE: 5058 if (padded_size != sizeof(struct sctp_cookie_perserve_param)) { 5059 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error cookie-preserve %d\n", plen); 5060 goto invalid_size; 5061 } 5062 at += padded_size; 5063 break; 5064 case SCTP_HAS_NAT_SUPPORT: 5065 *nat_friendly = 1; 5066 /* fall through */ 5067 case SCTP_PRSCTP_SUPPORTED: 5068 if (padded_size != sizeof(struct sctp_paramhdr)) { 5069 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error prsctp/nat support %d\n", plen); 5070 goto invalid_size; 5071 } 5072 at += padded_size; 5073 break; 5074 case SCTP_ECN_CAPABLE: 5075 if (padded_size != sizeof(struct sctp_paramhdr)) { 5076 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecn %d\n", plen); 5077 goto invalid_size; 5078 } 5079 at += padded_size; 5080 break; 5081 case SCTP_ULP_ADAPTATION: 5082 if (padded_size != sizeof(struct sctp_adaptation_layer_indication)) { 5083 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error adapatation %d\n", plen); 5084 goto invalid_size; 5085 } 5086 at += padded_size; 5087 break; 5088 case SCTP_SUCCESS_REPORT: 5089 if (padded_size != sizeof(struct sctp_asconf_paramhdr)) { 5090 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error success %d\n", plen); 5091 goto invalid_size; 5092 } 5093 at += padded_size; 5094 break; 5095 case SCTP_HOSTNAME_ADDRESS: 5096 { 5097 /* We can NOT handle HOST NAME addresses!! */ 5098 int l_len; 5099 5100 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Can't handle hostname addresses.. abort processing\n"); 5101 *abort_processing = 1; 5102 if (op_err == NULL) { 5103 /* Ok need to try to get a mbuf */ 5104#ifdef INET6 5105 l_len = SCTP_MIN_OVERHEAD; 5106#else 5107 l_len = SCTP_MIN_V4_OVERHEAD; 5108#endif 5109 l_len += sizeof(struct sctp_chunkhdr); 5110 l_len += plen; 5111 l_len += sizeof(struct sctp_paramhdr); 5112 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5113 if (op_err) { 5114 SCTP_BUF_LEN(op_err) = 0; 5115 /* 5116 * pre-reserve space for ip 5117 * and sctp header and 5118 * chunk hdr 5119 */ 5120#ifdef INET6 5121 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5122#else 5123 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5124#endif 5125 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5126 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5127 } 5128 } 5129 if (op_err) { 5130 /* If we have space */ 5131 struct sctp_paramhdr s; 5132 5133 if (err_at % 4) { 5134 uint32_t cpthis = 0; 5135 5136 pad_needed = 4 - (err_at % 4); 5137 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 5138 err_at += pad_needed; 5139 } 5140 s.param_type = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR); 5141 s.param_length = htons(sizeof(s) + plen); 5142 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 5143 err_at += sizeof(s); 5144 if (plen > sizeof(tempbuf)) { 5145 plen = sizeof(tempbuf); 5146 } 5147 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen); 5148 if (phdr == NULL) { 5149 sctp_m_freem(op_err); 5150 /* 5151 * we are out of memory but 5152 * we still need to have a 5153 * look at what to do (the 5154 * system is in trouble 5155 * though). 5156 */ 5157 return (NULL); 5158 } 5159 m_copyback(op_err, err_at, plen, (caddr_t)phdr); 5160 } 5161 return (op_err); 5162 break; 5163 } 5164 default: 5165 /* 5166 * we do not recognize the parameter figure out what 5167 * we do. 5168 */ 5169 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Hit default param %x\n", ptype); 5170 if ((ptype & 0x4000) == 0x4000) { 5171 /* Report bit is set?? */ 5172 SCTPDBG(SCTP_DEBUG_OUTPUT1, "report op err\n"); 5173 if (op_err == NULL) { 5174 int l_len; 5175 5176 /* Ok need to try to get an mbuf */ 5177#ifdef INET6 5178 l_len = SCTP_MIN_OVERHEAD; 5179#else 5180 l_len = SCTP_MIN_V4_OVERHEAD; 5181#endif 5182 l_len += sizeof(struct sctp_chunkhdr); 5183 l_len += plen; 5184 l_len += sizeof(struct sctp_paramhdr); 5185 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5186 if (op_err) { 5187 SCTP_BUF_LEN(op_err) = 0; 5188#ifdef INET6 5189 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5190#else 5191 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5192#endif 5193 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5194 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5195 } 5196 } 5197 if (op_err) { 5198 /* If we have space */ 5199 struct sctp_paramhdr s; 5200 5201 if (err_at % 4) { 5202 uint32_t cpthis = 0; 5203 5204 pad_needed = 4 - (err_at % 4); 5205 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 5206 err_at += pad_needed; 5207 } 5208 s.param_type = htons(SCTP_UNRECOG_PARAM); 5209 s.param_length = htons(sizeof(s) + plen); 5210 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 5211 err_at += sizeof(s); 5212 if (plen > sizeof(tempbuf)) { 5213 plen = sizeof(tempbuf); 5214 } 5215 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen); 5216 if (phdr == NULL) { 5217 sctp_m_freem(op_err); 5218 /* 5219 * we are out of memory but 5220 * we still need to have a 5221 * look at what to do (the 5222 * system is in trouble 5223 * though). 5224 */ 5225 op_err = NULL; 5226 goto more_processing; 5227 } 5228 m_copyback(op_err, err_at, plen, (caddr_t)phdr); 5229 err_at += plen; 5230 } 5231 } 5232 more_processing: 5233 if ((ptype & 0x8000) == 0x0000) { 5234 SCTPDBG(SCTP_DEBUG_OUTPUT1, "stop proc\n"); 5235 return (op_err); 5236 } else { 5237 /* skip this chunk and continue processing */ 5238 SCTPDBG(SCTP_DEBUG_OUTPUT1, "move on\n"); 5239 at += SCTP_SIZE32(plen); 5240 } 5241 break; 5242 5243 } 5244 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 5245 } 5246 return (op_err); 5247invalid_size: 5248 SCTPDBG(SCTP_DEBUG_OUTPUT1, "abort flag set\n"); 5249 *abort_processing = 1; 5250 if ((op_err == NULL) && phdr) { 5251 int l_len; 5252#ifdef INET6 5253 l_len = SCTP_MIN_OVERHEAD; 5254#else 5255 l_len = SCTP_MIN_V4_OVERHEAD; 5256#endif 5257 l_len += sizeof(struct sctp_chunkhdr); 5258 l_len += (2 * sizeof(struct sctp_paramhdr)); 5259 op_err = sctp_get_mbuf_for_msg(l_len, 0, M_NOWAIT, 1, MT_DATA); 5260 if (op_err) { 5261 SCTP_BUF_LEN(op_err) = 0; 5262#ifdef INET6 5263 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr)); 5264#else 5265 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip)); 5266#endif 5267 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr)); 5268 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr)); 5269 } 5270 } 5271 if ((op_err) && phdr) { 5272 struct sctp_paramhdr s; 5273 5274 if (err_at % 4) { 5275 uint32_t cpthis = 0; 5276 5277 pad_needed = 4 - (err_at % 4); 5278 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis); 5279 err_at += pad_needed; 5280 } 5281 s.param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 5282 s.param_length = htons(sizeof(s) + sizeof(struct sctp_paramhdr)); 5283 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s); 5284 err_at += sizeof(s); 5285 /* Only copy back the p-hdr that caused the issue */ 5286 m_copyback(op_err, err_at, sizeof(struct sctp_paramhdr), (caddr_t)phdr); 5287 } 5288 return (op_err); 5289} 5290 5291static int 5292sctp_are_there_new_addresses(struct sctp_association *asoc, 5293 struct mbuf *in_initpkt, int offset, struct sockaddr *src) 5294{ 5295 /* 5296 * Given a INIT packet, look through the packet to verify that there 5297 * are NO new addresses. As we go through the parameters add reports 5298 * of any un-understood parameters that require an error. Also we 5299 * must return (1) to drop the packet if we see a un-understood 5300 * parameter that tells us to drop the chunk. 5301 */ 5302 struct sockaddr *sa_touse; 5303 struct sockaddr *sa; 5304 struct sctp_paramhdr *phdr, params; 5305 uint16_t ptype, plen; 5306 uint8_t fnd; 5307 struct sctp_nets *net; 5308 int check_src; 5309#ifdef INET 5310 struct sockaddr_in sin4, *sa4; 5311#endif 5312#ifdef INET6 5313 struct sockaddr_in6 sin6, *sa6; 5314#endif 5315 5316#ifdef INET 5317 memset(&sin4, 0, sizeof(sin4)); 5318 sin4.sin_family = AF_INET; 5319 sin4.sin_len = sizeof(sin4); 5320#endif 5321#ifdef INET6 5322 memset(&sin6, 0, sizeof(sin6)); 5323 sin6.sin6_family = AF_INET6; 5324 sin6.sin6_len = sizeof(sin6); 5325#endif 5326 /* First what about the src address of the pkt ? */ 5327 check_src = 0; 5328 switch (src->sa_family) { 5329#ifdef INET 5330 case AF_INET: 5331 if (asoc->scope.ipv4_addr_legal) { 5332 check_src = 1; 5333 } 5334 break; 5335#endif 5336#ifdef INET6 5337 case AF_INET6: 5338 if (asoc->scope.ipv6_addr_legal) { 5339 check_src = 1; 5340 } 5341 break; 5342#endif 5343 default: 5344 /* TSNH */ 5345 break; 5346 } 5347 if (check_src) { 5348 fnd = 0; 5349 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5350 sa = (struct sockaddr *)&net->ro._l_addr; 5351 if (sa->sa_family == src->sa_family) { 5352#ifdef INET 5353 if (sa->sa_family == AF_INET) { 5354 struct sockaddr_in *src4; 5355 5356 sa4 = (struct sockaddr_in *)sa; 5357 src4 = (struct sockaddr_in *)src; 5358 if (sa4->sin_addr.s_addr == src4->sin_addr.s_addr) { 5359 fnd = 1; 5360 break; 5361 } 5362 } 5363#endif 5364#ifdef INET6 5365 if (sa->sa_family == AF_INET6) { 5366 struct sockaddr_in6 *src6; 5367 5368 sa6 = (struct sockaddr_in6 *)sa; 5369 src6 = (struct sockaddr_in6 *)src; 5370 if (SCTP6_ARE_ADDR_EQUAL(sa6, src6)) { 5371 fnd = 1; 5372 break; 5373 } 5374 } 5375#endif 5376 } 5377 } 5378 if (fnd == 0) { 5379 /* New address added! no need to look further. */ 5380 return (1); 5381 } 5382 } 5383 /* Ok so far lets munge through the rest of the packet */ 5384 offset += sizeof(struct sctp_init_chunk); 5385 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5386 while (phdr) { 5387 sa_touse = NULL; 5388 ptype = ntohs(phdr->param_type); 5389 plen = ntohs(phdr->param_length); 5390 switch (ptype) { 5391#ifdef INET 5392 case SCTP_IPV4_ADDRESS: 5393 { 5394 struct sctp_ipv4addr_param *p4, p4_buf; 5395 5396 if (plen != sizeof(struct sctp_ipv4addr_param)) { 5397 return (1); 5398 } 5399 phdr = sctp_get_next_param(in_initpkt, offset, 5400 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 5401 if (phdr == NULL) { 5402 return (1); 5403 } 5404 if (asoc->scope.ipv4_addr_legal) { 5405 p4 = (struct sctp_ipv4addr_param *)phdr; 5406 sin4.sin_addr.s_addr = p4->addr; 5407 sa_touse = (struct sockaddr *)&sin4; 5408 } 5409 break; 5410 } 5411#endif 5412#ifdef INET6 5413 case SCTP_IPV6_ADDRESS: 5414 { 5415 struct sctp_ipv6addr_param *p6, p6_buf; 5416 5417 if (plen != sizeof(struct sctp_ipv6addr_param)) { 5418 return (1); 5419 } 5420 phdr = sctp_get_next_param(in_initpkt, offset, 5421 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 5422 if (phdr == NULL) { 5423 return (1); 5424 } 5425 if (asoc->scope.ipv6_addr_legal) { 5426 p6 = (struct sctp_ipv6addr_param *)phdr; 5427 memcpy((caddr_t)&sin6.sin6_addr, p6->addr, 5428 sizeof(p6->addr)); 5429 sa_touse = (struct sockaddr *)&sin6; 5430 } 5431 break; 5432 } 5433#endif 5434 default: 5435 sa_touse = NULL; 5436 break; 5437 } 5438 if (sa_touse) { 5439 /* ok, sa_touse points to one to check */ 5440 fnd = 0; 5441 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5442 sa = (struct sockaddr *)&net->ro._l_addr; 5443 if (sa->sa_family != sa_touse->sa_family) { 5444 continue; 5445 } 5446#ifdef INET 5447 if (sa->sa_family == AF_INET) { 5448 sa4 = (struct sockaddr_in *)sa; 5449 if (sa4->sin_addr.s_addr == 5450 sin4.sin_addr.s_addr) { 5451 fnd = 1; 5452 break; 5453 } 5454 } 5455#endif 5456#ifdef INET6 5457 if (sa->sa_family == AF_INET6) { 5458 sa6 = (struct sockaddr_in6 *)sa; 5459 if (SCTP6_ARE_ADDR_EQUAL( 5460 sa6, &sin6)) { 5461 fnd = 1; 5462 break; 5463 } 5464 } 5465#endif 5466 } 5467 if (!fnd) { 5468 /* New addr added! no need to look further */ 5469 return (1); 5470 } 5471 } 5472 offset += SCTP_SIZE32(plen); 5473 phdr = sctp_get_next_param(in_initpkt, offset, ¶ms, sizeof(params)); 5474 } 5475 return (0); 5476} 5477 5478/* 5479 * Given a MBUF chain that was sent into us containing an INIT. Build a 5480 * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done 5481 * a pullup to include IPv6/4header, SCTP header and initial part of INIT 5482 * message (i.e. the struct sctp_init_msg). 5483 */ 5484void 5485sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 5486 struct sctp_nets *src_net, struct mbuf *init_pkt, 5487 int iphlen, int offset, 5488 struct sockaddr *src, struct sockaddr *dst, 5489 struct sctphdr *sh, struct sctp_init_chunk *init_chk, 5490 uint8_t mflowtype, uint32_t mflowid, 5491 uint32_t vrf_id, uint16_t port, int hold_inp_lock) 5492{ 5493 struct sctp_association *asoc; 5494 struct mbuf *m, *m_tmp, *m_last, *m_cookie, *op_err; 5495 struct sctp_init_ack_chunk *initack; 5496 struct sctp_adaptation_layer_indication *ali; 5497 struct sctp_supported_chunk_types_param *pr_supported; 5498 struct sctp_paramhdr *ph; 5499 union sctp_sockstore *over_addr; 5500 struct sctp_scoping scp; 5501#ifdef INET 5502 struct sockaddr_in *dst4 = (struct sockaddr_in *)dst; 5503 struct sockaddr_in *src4 = (struct sockaddr_in *)src; 5504 struct sockaddr_in *sin; 5505#endif 5506#ifdef INET6 5507 struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst; 5508 struct sockaddr_in6 *src6 = (struct sockaddr_in6 *)src; 5509 struct sockaddr_in6 *sin6; 5510#endif 5511 struct sockaddr *to; 5512 struct sctp_state_cookie stc; 5513 struct sctp_nets *net = NULL; 5514 uint8_t *signature = NULL; 5515 int cnt_inits_to = 0; 5516 uint16_t his_limit, i_want; 5517 int abort_flag; 5518 int nat_friendly = 0; 5519 int error; 5520 struct socket *so; 5521 uint16_t num_ext, chunk_len, padding_len, parameter_len; 5522 5523 if (stcb) { 5524 asoc = &stcb->asoc; 5525 } else { 5526 asoc = NULL; 5527 } 5528 if ((asoc != NULL) && 5529 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT)) { 5530 if (sctp_are_there_new_addresses(asoc, init_pkt, offset, src)) { 5531 /* 5532 * new addresses, out of here in non-cookie-wait 5533 * states 5534 * 5535 * Send an ABORT, without the new address error 5536 * cause. This looks no different than if no 5537 * listener was present. 5538 */ 5539 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5540 "Address added"); 5541 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5542 mflowtype, mflowid, inp->fibnum, 5543 vrf_id, port); 5544 return; 5545 } 5546 if (src_net != NULL && (src_net->port != port)) { 5547 /* 5548 * change of remote encapsulation port, out of here 5549 * in non-cookie-wait states 5550 * 5551 * Send an ABORT, without an specific error cause. 5552 * This looks no different than if no listener was 5553 * present. 5554 */ 5555 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5556 "Remote encapsulation port changed"); 5557 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 0, op_err, 5558 mflowtype, mflowid, inp->fibnum, 5559 vrf_id, port); 5560 return; 5561 } 5562 } 5563 abort_flag = 0; 5564 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 5565 (offset + sizeof(struct sctp_init_chunk)), 5566 &abort_flag, (struct sctp_chunkhdr *)init_chk, &nat_friendly); 5567 if (abort_flag) { 5568do_a_abort: 5569 if (op_err == NULL) { 5570 char msg[SCTP_DIAG_INFO_LEN]; 5571 5572 snprintf(msg, sizeof(msg), "%s:%d at %s", __FILE__, __LINE__, __func__); 5573 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 5574 msg); 5575 } 5576 sctp_send_abort(init_pkt, iphlen, src, dst, sh, 5577 init_chk->init.initiate_tag, op_err, 5578 mflowtype, mflowid, inp->fibnum, 5579 vrf_id, port); 5580 return; 5581 } 5582 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 5583 if (m == NULL) { 5584 /* No memory, INIT timer will re-attempt. */ 5585 if (op_err) 5586 sctp_m_freem(op_err); 5587 return; 5588 } 5589 chunk_len = (uint16_t)sizeof(struct sctp_init_ack_chunk); 5590 padding_len = 0; 5591 5592 /* 5593 * We might not overwrite the identification[] completely and on 5594 * some platforms time_entered will contain some padding. Therefore 5595 * zero out the cookie to avoid putting uninitialized memory on the 5596 * wire. 5597 */ 5598 memset(&stc, 0, sizeof(struct sctp_state_cookie)); 5599 5600 /* the time I built cookie */ 5601 (void)SCTP_GETTIME_TIMEVAL(&stc.time_entered); 5602 5603 /* populate any tie tags */ 5604 if (asoc != NULL) { 5605 /* unlock before tag selections */ 5606 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 5607 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 5608 stc.cookie_life = asoc->cookie_life; 5609 net = asoc->primary_destination; 5610 } else { 5611 stc.tie_tag_my_vtag = 0; 5612 stc.tie_tag_peer_vtag = 0; 5613 /* life I will award this cookie */ 5614 stc.cookie_life = inp->sctp_ep.def_cookie_life; 5615 } 5616 5617 /* copy in the ports for later check */ 5618 stc.myport = sh->dest_port; 5619 stc.peerport = sh->src_port; 5620 5621 /* 5622 * If we wanted to honor cookie life extensions, we would add to 5623 * stc.cookie_life. For now we should NOT honor any extension 5624 */ 5625 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 5626 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5627 stc.ipv6_addr_legal = 1; 5628 if (SCTP_IPV6_V6ONLY(inp)) { 5629 stc.ipv4_addr_legal = 0; 5630 } else { 5631 stc.ipv4_addr_legal = 1; 5632 } 5633 } else { 5634 stc.ipv6_addr_legal = 0; 5635 stc.ipv4_addr_legal = 1; 5636 } 5637 stc.ipv4_scope = 0; 5638 if (net == NULL) { 5639 to = src; 5640 switch (dst->sa_family) { 5641#ifdef INET 5642 case AF_INET: 5643 { 5644 /* lookup address */ 5645 stc.address[0] = src4->sin_addr.s_addr; 5646 stc.address[1] = 0; 5647 stc.address[2] = 0; 5648 stc.address[3] = 0; 5649 stc.addr_type = SCTP_IPV4_ADDRESS; 5650 /* local from address */ 5651 stc.laddress[0] = dst4->sin_addr.s_addr; 5652 stc.laddress[1] = 0; 5653 stc.laddress[2] = 0; 5654 stc.laddress[3] = 0; 5655 stc.laddr_type = SCTP_IPV4_ADDRESS; 5656 /* scope_id is only for v6 */ 5657 stc.scope_id = 0; 5658 if ((IN4_ISPRIVATE_ADDRESS(&src4->sin_addr)) || 5659 (IN4_ISPRIVATE_ADDRESS(&dst4->sin_addr))) { 5660 stc.ipv4_scope = 1; 5661 } 5662 /* Must use the address in this case */ 5663 if (sctp_is_address_on_local_host(src, vrf_id)) { 5664 stc.loopback_scope = 1; 5665 stc.ipv4_scope = 1; 5666 stc.site_scope = 1; 5667 stc.local_scope = 0; 5668 } 5669 break; 5670 } 5671#endif 5672#ifdef INET6 5673 case AF_INET6: 5674 { 5675 stc.addr_type = SCTP_IPV6_ADDRESS; 5676 memcpy(&stc.address, &src6->sin6_addr, sizeof(struct in6_addr)); 5677 stc.scope_id = ntohs(in6_getscope(&src6->sin6_addr)); 5678 if (sctp_is_address_on_local_host(src, vrf_id)) { 5679 stc.loopback_scope = 1; 5680 stc.local_scope = 0; 5681 stc.site_scope = 1; 5682 stc.ipv4_scope = 1; 5683 } else if (IN6_IS_ADDR_LINKLOCAL(&src6->sin6_addr) || 5684 IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr)) { 5685 /* 5686 * If the new destination or source 5687 * is a LINK_LOCAL we must have 5688 * common both site and local scope. 5689 * Don't set local scope though 5690 * since we must depend on the 5691 * source to be added implicitly. We 5692 * cannot assure just because we 5693 * share one link that all links are 5694 * common. 5695 */ 5696 stc.local_scope = 0; 5697 stc.site_scope = 1; 5698 stc.ipv4_scope = 1; 5699 /* 5700 * we start counting for the private 5701 * address stuff at 1. since the 5702 * link local we source from won't 5703 * show up in our scoped count. 5704 */ 5705 cnt_inits_to = 1; 5706 /* 5707 * pull out the scope_id from 5708 * incoming pkt 5709 */ 5710 } else if (IN6_IS_ADDR_SITELOCAL(&src6->sin6_addr) || 5711 IN6_IS_ADDR_SITELOCAL(&dst6->sin6_addr)) { 5712 /* 5713 * If the new destination or source 5714 * is SITE_LOCAL then we must have 5715 * site scope in common. 5716 */ 5717 stc.site_scope = 1; 5718 } 5719 memcpy(&stc.laddress, &dst6->sin6_addr, sizeof(struct in6_addr)); 5720 stc.laddr_type = SCTP_IPV6_ADDRESS; 5721 break; 5722 } 5723#endif 5724 default: 5725 /* TSNH */ 5726 goto do_a_abort; 5727 break; 5728 } 5729 } else { 5730 /* set the scope per the existing tcb */ 5731 5732#ifdef INET6 5733 struct sctp_nets *lnet; 5734#endif 5735 5736 stc.loopback_scope = asoc->scope.loopback_scope; 5737 stc.ipv4_scope = asoc->scope.ipv4_local_scope; 5738 stc.site_scope = asoc->scope.site_scope; 5739 stc.local_scope = asoc->scope.local_scope; 5740#ifdef INET6 5741 /* Why do we not consider IPv4 LL addresses? */ 5742 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 5743 if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) { 5744 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) { 5745 /* 5746 * if we have a LL address, start 5747 * counting at 1. 5748 */ 5749 cnt_inits_to = 1; 5750 } 5751 } 5752 } 5753#endif 5754 /* use the net pointer */ 5755 to = (struct sockaddr *)&net->ro._l_addr; 5756 switch (to->sa_family) { 5757#ifdef INET 5758 case AF_INET: 5759 sin = (struct sockaddr_in *)to; 5760 stc.address[0] = sin->sin_addr.s_addr; 5761 stc.address[1] = 0; 5762 stc.address[2] = 0; 5763 stc.address[3] = 0; 5764 stc.addr_type = SCTP_IPV4_ADDRESS; 5765 if (net->src_addr_selected == 0) { 5766 /* 5767 * strange case here, the INIT should have 5768 * did the selection. 5769 */ 5770 net->ro._s_addr = sctp_source_address_selection(inp, 5771 stcb, (sctp_route_t *)&net->ro, 5772 net, 0, vrf_id); 5773 if (net->ro._s_addr == NULL) 5774 return; 5775 5776 net->src_addr_selected = 1; 5777 5778 } 5779 stc.laddress[0] = net->ro._s_addr->address.sin.sin_addr.s_addr; 5780 stc.laddress[1] = 0; 5781 stc.laddress[2] = 0; 5782 stc.laddress[3] = 0; 5783 stc.laddr_type = SCTP_IPV4_ADDRESS; 5784 /* scope_id is only for v6 */ 5785 stc.scope_id = 0; 5786 break; 5787#endif 5788#ifdef INET6 5789 case AF_INET6: 5790 sin6 = (struct sockaddr_in6 *)to; 5791 memcpy(&stc.address, &sin6->sin6_addr, 5792 sizeof(struct in6_addr)); 5793 stc.addr_type = SCTP_IPV6_ADDRESS; 5794 stc.scope_id = sin6->sin6_scope_id; 5795 if (net->src_addr_selected == 0) { 5796 /* 5797 * strange case here, the INIT should have 5798 * done the selection. 5799 */ 5800 net->ro._s_addr = sctp_source_address_selection(inp, 5801 stcb, (sctp_route_t *)&net->ro, 5802 net, 0, vrf_id); 5803 if (net->ro._s_addr == NULL) 5804 return; 5805 5806 net->src_addr_selected = 1; 5807 } 5808 memcpy(&stc.laddress, &net->ro._s_addr->address.sin6.sin6_addr, 5809 sizeof(struct in6_addr)); 5810 stc.laddr_type = SCTP_IPV6_ADDRESS; 5811 break; 5812#endif 5813 } 5814 } 5815 /* Now lets put the SCTP header in place */ 5816 initack = mtod(m, struct sctp_init_ack_chunk *); 5817 /* Save it off for quick ref */ 5818 stc.peers_vtag = ntohl(init_chk->init.initiate_tag); 5819 /* who are we */ 5820 memcpy(stc.identification, SCTP_VERSION_STRING, 5821 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 5822 memset(stc.reserved, 0, SCTP_RESERVE_SPACE); 5823 /* now the chunk header */ 5824 initack->ch.chunk_type = SCTP_INITIATION_ACK; 5825 initack->ch.chunk_flags = 0; 5826 /* fill in later from mbuf we build */ 5827 initack->ch.chunk_length = 0; 5828 /* place in my tag */ 5829 if ((asoc != NULL) && 5830 ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 5831 (SCTP_GET_STATE(asoc) == SCTP_STATE_INUSE) || 5832 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) { 5833 /* re-use the v-tags and init-seq here */ 5834 initack->init.initiate_tag = htonl(asoc->my_vtag); 5835 initack->init.initial_tsn = htonl(asoc->init_seq_number); 5836 } else { 5837 uint32_t vtag, itsn; 5838 5839 if (hold_inp_lock) { 5840 SCTP_INP_INCR_REF(inp); 5841 SCTP_INP_RUNLOCK(inp); 5842 } 5843 if (asoc) { 5844 atomic_add_int(&asoc->refcnt, 1); 5845 SCTP_TCB_UNLOCK(stcb); 5846 new_tag: 5847 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5848 if ((asoc->peer_supports_nat) && (vtag == asoc->my_vtag)) { 5849 /* 5850 * Got a duplicate vtag on some guy behind a 5851 * nat make sure we don't use it. 5852 */ 5853 goto new_tag; 5854 } 5855 initack->init.initiate_tag = htonl(vtag); 5856 /* get a TSN to use too */ 5857 itsn = sctp_select_initial_TSN(&inp->sctp_ep); 5858 initack->init.initial_tsn = htonl(itsn); 5859 SCTP_TCB_LOCK(stcb); 5860 atomic_add_int(&asoc->refcnt, -1); 5861 } else { 5862 vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1); 5863 initack->init.initiate_tag = htonl(vtag); 5864 /* get a TSN to use too */ 5865 initack->init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 5866 } 5867 if (hold_inp_lock) { 5868 SCTP_INP_RLOCK(inp); 5869 SCTP_INP_DECR_REF(inp); 5870 } 5871 } 5872 /* save away my tag to */ 5873 stc.my_vtag = initack->init.initiate_tag; 5874 5875 /* set up some of the credits. */ 5876 so = inp->sctp_socket; 5877 if (so == NULL) { 5878 /* memory problem */ 5879 sctp_m_freem(m); 5880 return; 5881 } else { 5882 initack->init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(so), SCTP_MINIMAL_RWND)); 5883 } 5884 /* set what I want */ 5885 his_limit = ntohs(init_chk->init.num_inbound_streams); 5886 /* choose what I want */ 5887 if (asoc != NULL) { 5888 if (asoc->streamoutcnt > asoc->pre_open_streams) { 5889 i_want = asoc->streamoutcnt; 5890 } else { 5891 i_want = asoc->pre_open_streams; 5892 } 5893 } else { 5894 i_want = inp->sctp_ep.pre_open_stream_count; 5895 } 5896 if (his_limit < i_want) { 5897 /* I Want more :< */ 5898 initack->init.num_outbound_streams = init_chk->init.num_inbound_streams; 5899 } else { 5900 /* I can have what I want :> */ 5901 initack->init.num_outbound_streams = htons(i_want); 5902 } 5903 /* tell him his limit. */ 5904 initack->init.num_inbound_streams = 5905 htons(inp->sctp_ep.max_open_streams_intome); 5906 5907 /* adaptation layer indication parameter */ 5908 if (inp->sctp_ep.adaptation_layer_indicator_provided) { 5909 parameter_len = (uint16_t)sizeof(struct sctp_adaptation_layer_indication); 5910 ali = (struct sctp_adaptation_layer_indication *)(mtod(m, caddr_t)+chunk_len); 5911 ali->ph.param_type = htons(SCTP_ULP_ADAPTATION); 5912 ali->ph.param_length = htons(parameter_len); 5913 ali->indication = htonl(inp->sctp_ep.adaptation_layer_indicator); 5914 chunk_len += parameter_len; 5915 } 5916 /* ECN parameter */ 5917 if (((asoc != NULL) && (asoc->ecn_supported == 1)) || 5918 ((asoc == NULL) && (inp->ecn_supported == 1))) { 5919 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5920 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5921 ph->param_type = htons(SCTP_ECN_CAPABLE); 5922 ph->param_length = htons(parameter_len); 5923 chunk_len += parameter_len; 5924 } 5925 /* PR-SCTP supported parameter */ 5926 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5927 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5928 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5929 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5930 ph->param_type = htons(SCTP_PRSCTP_SUPPORTED); 5931 ph->param_length = htons(parameter_len); 5932 chunk_len += parameter_len; 5933 } 5934 /* Add NAT friendly parameter */ 5935 if (nat_friendly) { 5936 parameter_len = (uint16_t)sizeof(struct sctp_paramhdr); 5937 ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+chunk_len); 5938 ph->param_type = htons(SCTP_HAS_NAT_SUPPORT); 5939 ph->param_length = htons(parameter_len); 5940 chunk_len += parameter_len; 5941 } 5942 /* And now tell the peer which extensions we support */ 5943 num_ext = 0; 5944 pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+chunk_len); 5945 if (((asoc != NULL) && (asoc->prsctp_supported == 1)) || 5946 ((asoc == NULL) && (inp->prsctp_supported == 1))) { 5947 pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN; 5948 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5949 ((asoc == NULL) && (inp->idata_supported == 1))) { 5950 pr_supported->chunk_types[num_ext++] = SCTP_IFORWARD_CUM_TSN; 5951 } 5952 } 5953 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5954 ((asoc == NULL) && (inp->auth_supported == 1))) { 5955 pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION; 5956 } 5957 if (((asoc != NULL) && (asoc->asconf_supported == 1)) || 5958 ((asoc == NULL) && (inp->asconf_supported == 1))) { 5959 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF; 5960 pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK; 5961 } 5962 if (((asoc != NULL) && (asoc->reconfig_supported == 1)) || 5963 ((asoc == NULL) && (inp->reconfig_supported == 1))) { 5964 pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET; 5965 } 5966 if (((asoc != NULL) && (asoc->idata_supported == 1)) || 5967 ((asoc == NULL) && (inp->idata_supported == 1))) { 5968 pr_supported->chunk_types[num_ext++] = SCTP_IDATA; 5969 } 5970 if (((asoc != NULL) && (asoc->nrsack_supported == 1)) || 5971 ((asoc == NULL) && (inp->nrsack_supported == 1))) { 5972 pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK; 5973 } 5974 if (((asoc != NULL) && (asoc->pktdrop_supported == 1)) || 5975 ((asoc == NULL) && (inp->pktdrop_supported == 1))) { 5976 pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED; 5977 } 5978 if (num_ext > 0) { 5979 parameter_len = (uint16_t)sizeof(struct sctp_supported_chunk_types_param) + num_ext; 5980 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 5981 pr_supported->ph.param_length = htons(parameter_len); 5982 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 5983 chunk_len += parameter_len; 5984 } 5985 /* add authentication parameters */ 5986 if (((asoc != NULL) && (asoc->auth_supported == 1)) || 5987 ((asoc == NULL) && (inp->auth_supported == 1))) { 5988 struct sctp_auth_random *randp; 5989 struct sctp_auth_hmac_algo *hmacs; 5990 struct sctp_auth_chunk_list *chunks; 5991 5992 if (padding_len > 0) { 5993 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 5994 chunk_len += padding_len; 5995 padding_len = 0; 5996 } 5997 /* generate and add RANDOM parameter */ 5998 randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+chunk_len); 5999 parameter_len = (uint16_t)sizeof(struct sctp_auth_random) + 6000 SCTP_AUTH_RANDOM_SIZE_DEFAULT; 6001 randp->ph.param_type = htons(SCTP_RANDOM); 6002 randp->ph.param_length = htons(parameter_len); 6003 SCTP_READ_RANDOM(randp->random_data, SCTP_AUTH_RANDOM_SIZE_DEFAULT); 6004 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6005 chunk_len += parameter_len; 6006 6007 if (padding_len > 0) { 6008 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6009 chunk_len += padding_len; 6010 padding_len = 0; 6011 } 6012 /* add HMAC_ALGO parameter */ 6013 hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+chunk_len); 6014 parameter_len = (uint16_t)sizeof(struct sctp_auth_hmac_algo) + 6015 sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs, 6016 (uint8_t *)hmacs->hmac_ids); 6017 hmacs->ph.param_type = htons(SCTP_HMAC_LIST); 6018 hmacs->ph.param_length = htons(parameter_len); 6019 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6020 chunk_len += parameter_len; 6021 6022 if (padding_len > 0) { 6023 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6024 chunk_len += padding_len; 6025 padding_len = 0; 6026 } 6027 /* add CHUNKS parameter */ 6028 chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+chunk_len); 6029 parameter_len = (uint16_t)sizeof(struct sctp_auth_chunk_list) + 6030 sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks, 6031 chunks->chunk_types); 6032 chunks->ph.param_type = htons(SCTP_CHUNK_LIST); 6033 chunks->ph.param_length = htons(parameter_len); 6034 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6035 chunk_len += parameter_len; 6036 } 6037 SCTP_BUF_LEN(m) = chunk_len; 6038 m_last = m; 6039 /* now the addresses */ 6040 /* 6041 * To optimize this we could put the scoping stuff into a structure 6042 * and remove the individual uint8's from the stc structure. Then we 6043 * could just sifa in the address within the stc.. but for now this 6044 * is a quick hack to get the address stuff teased apart. 6045 */ 6046 scp.ipv4_addr_legal = stc.ipv4_addr_legal; 6047 scp.ipv6_addr_legal = stc.ipv6_addr_legal; 6048 scp.loopback_scope = stc.loopback_scope; 6049 scp.ipv4_local_scope = stc.ipv4_scope; 6050 scp.local_scope = stc.local_scope; 6051 scp.site_scope = stc.site_scope; 6052 m_last = sctp_add_addresses_to_i_ia(inp, stcb, &scp, m_last, 6053 cnt_inits_to, 6054 &padding_len, &chunk_len); 6055 /* padding_len can only be positive, if no addresses have been added */ 6056 if (padding_len > 0) { 6057 memset(mtod(m, caddr_t)+chunk_len, 0, padding_len); 6058 chunk_len += padding_len; 6059 SCTP_BUF_LEN(m) += padding_len; 6060 padding_len = 0; 6061 } 6062 /* tack on the operational error if present */ 6063 if (op_err) { 6064 parameter_len = 0; 6065 for (m_tmp = op_err; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6066 parameter_len += SCTP_BUF_LEN(m_tmp); 6067 } 6068 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6069 SCTP_BUF_NEXT(m_last) = op_err; 6070 while (SCTP_BUF_NEXT(m_last) != NULL) { 6071 m_last = SCTP_BUF_NEXT(m_last); 6072 } 6073 chunk_len += parameter_len; 6074 } 6075 if (padding_len > 0) { 6076 m_last = sctp_add_pad_tombuf(m_last, padding_len); 6077 if (m_last == NULL) { 6078 /* Houston we have a problem, no space */ 6079 sctp_m_freem(m); 6080 return; 6081 } 6082 chunk_len += padding_len; 6083 padding_len = 0; 6084 } 6085 /* Now we must build a cookie */ 6086 m_cookie = sctp_add_cookie(init_pkt, offset, m, 0, &stc, &signature); 6087 if (m_cookie == NULL) { 6088 /* memory problem */ 6089 sctp_m_freem(m); 6090 return; 6091 } 6092 /* Now append the cookie to the end and update the space/size */ 6093 SCTP_BUF_NEXT(m_last) = m_cookie; 6094 parameter_len = 0; 6095 for (m_tmp = m_cookie; m_tmp != NULL; m_tmp = SCTP_BUF_NEXT(m_tmp)) { 6096 parameter_len += SCTP_BUF_LEN(m_tmp); 6097 if (SCTP_BUF_NEXT(m_tmp) == NULL) { 6098 m_last = m_tmp; 6099 } 6100 } 6101 padding_len = SCTP_SIZE32(parameter_len) - parameter_len; 6102 chunk_len += parameter_len; 6103 6104 /* 6105 * Place in the size, but we don't include the last pad (if any) in 6106 * the INIT-ACK. 6107 */ 6108 initack->ch.chunk_length = htons(chunk_len); 6109 6110 /* 6111 * Time to sign the cookie, we don't sign over the cookie signature 6112 * though thus we set trailer. 6113 */ 6114 (void)sctp_hmac_m(SCTP_HMAC, 6115 (uint8_t *)inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)], 6116 SCTP_SECRET_SIZE, m_cookie, sizeof(struct sctp_paramhdr), 6117 (uint8_t *)signature, SCTP_SIGNATURE_SIZE); 6118 /* 6119 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return 6120 * here since the timer will drive a retranmission. 6121 */ 6122 if (padding_len > 0) { 6123 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 6124 sctp_m_freem(m); 6125 return; 6126 } 6127 } 6128 if (stc.loopback_scope) { 6129 over_addr = (union sctp_sockstore *)dst; 6130 } else { 6131 over_addr = NULL; 6132 } 6133 6134 if ((error = sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0, 6135 0, 0, 6136 inp->sctp_lport, sh->src_port, init_chk->init.initiate_tag, 6137 port, over_addr, 6138 mflowtype, mflowid, 6139 SCTP_SO_NOT_LOCKED))) { 6140 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak send error %d\n", error); 6141 if (error == ENOBUFS) { 6142 if (asoc != NULL) { 6143 asoc->ifp_had_enobuf = 1; 6144 } 6145 SCTP_STAT_INCR(sctps_lowlevelerr); 6146 } 6147 } else { 6148 if (asoc != NULL) { 6149 asoc->ifp_had_enobuf = 0; 6150 } 6151 } 6152 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 6153} 6154 6155 6156static void 6157sctp_prune_prsctp(struct sctp_tcb *stcb, 6158 struct sctp_association *asoc, 6159 struct sctp_sndrcvinfo *srcv, 6160 int dataout) 6161{ 6162 int freed_spc = 0; 6163 struct sctp_tmit_chunk *chk, *nchk; 6164 6165 SCTP_TCB_LOCK_ASSERT(stcb); 6166 if ((asoc->prsctp_supported) && 6167 (asoc->sent_queue_cnt_removeable > 0)) { 6168 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6169 /* 6170 * Look for chunks marked with the PR_SCTP flag AND 6171 * the buffer space flag. If the one being sent is 6172 * equal or greater priority then purge the old one 6173 * and free some space. 6174 */ 6175 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6176 /* 6177 * This one is PR-SCTP AND buffer space 6178 * limited type 6179 */ 6180 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 6181 /* 6182 * Lower numbers equates to higher 6183 * priority so if the one we are 6184 * looking at has a larger or equal 6185 * priority we want to drop the data 6186 * and NOT retransmit it. 6187 */ 6188 if (chk->data) { 6189 /* 6190 * We release the book_size 6191 * if the mbuf is here 6192 */ 6193 int ret_spc; 6194 uint8_t sent; 6195 6196 if (chk->sent > SCTP_DATAGRAM_UNSENT) 6197 sent = 1; 6198 else 6199 sent = 0; 6200 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6201 sent, 6202 SCTP_SO_LOCKED); 6203 freed_spc += ret_spc; 6204 if (freed_spc >= dataout) { 6205 return; 6206 } 6207 } /* if chunk was present */ 6208 } /* if of sufficient priority */ 6209 } /* if chunk has enabled */ 6210 } /* tailqforeach */ 6211 6212 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 6213 /* Here we must move to the sent queue and mark */ 6214 if (PR_SCTP_BUF_ENABLED(chk->flags)) { 6215 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 6216 if (chk->data) { 6217 /* 6218 * We release the book_size 6219 * if the mbuf is here 6220 */ 6221 int ret_spc; 6222 6223 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 6224 0, SCTP_SO_LOCKED); 6225 6226 freed_spc += ret_spc; 6227 if (freed_spc >= dataout) { 6228 return; 6229 } 6230 } /* end if chk->data */ 6231 } /* end if right class */ 6232 } /* end if chk pr-sctp */ 6233 } /* tailqforeachsafe (chk) */ 6234 } /* if enabled in asoc */ 6235} 6236 6237int 6238sctp_get_frag_point(struct sctp_tcb *stcb, 6239 struct sctp_association *asoc) 6240{ 6241 int siz, ovh; 6242 6243 /* 6244 * For endpoints that have both v6 and v4 addresses we must reserve 6245 * room for the ipv6 header, for those that are only dealing with V4 6246 * we use a larger frag point. 6247 */ 6248 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6249 ovh = SCTP_MIN_OVERHEAD; 6250 } else { 6251 ovh = SCTP_MIN_V4_OVERHEAD; 6252 } 6253 if (stcb->asoc.idata_supported) { 6254 ovh += sizeof(struct sctp_idata_chunk); 6255 } else { 6256 ovh += sizeof(struct sctp_data_chunk); 6257 } 6258 if (stcb->asoc.sctp_frag_point > asoc->smallest_mtu) 6259 siz = asoc->smallest_mtu - ovh; 6260 else 6261 siz = (stcb->asoc.sctp_frag_point - ovh); 6262 /* 6263 * if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { 6264 */ 6265 /* A data chunk MUST fit in a cluster */ 6266 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk)); */ 6267 /* } */ 6268 6269 /* adjust for an AUTH chunk if DATA requires auth */ 6270 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) 6271 siz -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 6272 6273 if (siz % 4) { 6274 /* make it an even word boundary please */ 6275 siz -= (siz % 4); 6276 } 6277 return (siz); 6278} 6279 6280static void 6281sctp_set_prsctp_policy(struct sctp_stream_queue_pending *sp) 6282{ 6283 /* 6284 * We assume that the user wants PR_SCTP_TTL if the user provides a 6285 * positive lifetime but does not specify any PR_SCTP policy. 6286 */ 6287 if (PR_SCTP_ENABLED(sp->sinfo_flags)) { 6288 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6289 } else if (sp->timetolive > 0) { 6290 sp->sinfo_flags |= SCTP_PR_SCTP_TTL; 6291 sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags); 6292 } else { 6293 return; 6294 } 6295 switch (PR_SCTP_POLICY(sp->sinfo_flags)) { 6296 case CHUNK_FLAGS_PR_SCTP_BUF: 6297 /* 6298 * Time to live is a priority stored in tv_sec when doing 6299 * the buffer drop thing. 6300 */ 6301 sp->ts.tv_sec = sp->timetolive; 6302 sp->ts.tv_usec = 0; 6303 break; 6304 case CHUNK_FLAGS_PR_SCTP_TTL: 6305 { 6306 struct timeval tv; 6307 6308 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6309 tv.tv_sec = sp->timetolive / 1000; 6310 tv.tv_usec = (sp->timetolive * 1000) % 1000000; 6311 /* 6312 * TODO sctp_constants.h needs alternative time 6313 * macros when _KERNEL is undefined. 6314 */ 6315 timevaladd(&sp->ts, &tv); 6316 } 6317 break; 6318 case CHUNK_FLAGS_PR_SCTP_RTX: 6319 /* 6320 * Time to live is a the number or retransmissions stored in 6321 * tv_sec. 6322 */ 6323 sp->ts.tv_sec = sp->timetolive; 6324 sp->ts.tv_usec = 0; 6325 break; 6326 default: 6327 SCTPDBG(SCTP_DEBUG_USRREQ1, 6328 "Unknown PR_SCTP policy %u.\n", 6329 PR_SCTP_POLICY(sp->sinfo_flags)); 6330 break; 6331 } 6332} 6333 6334static int 6335sctp_msg_append(struct sctp_tcb *stcb, 6336 struct sctp_nets *net, 6337 struct mbuf *m, 6338 struct sctp_sndrcvinfo *srcv, int hold_stcb_lock) 6339{ 6340 int error = 0; 6341 struct mbuf *at; 6342 struct sctp_stream_queue_pending *sp = NULL; 6343 struct sctp_stream_out *strm; 6344 6345 /* 6346 * Given an mbuf chain, put it into the association send queue and 6347 * place it on the wheel 6348 */ 6349 if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) { 6350 /* Invalid stream number */ 6351 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6352 error = EINVAL; 6353 goto out_now; 6354 } 6355 if ((stcb->asoc.stream_locked) && 6356 (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) { 6357 SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 6358 error = EINVAL; 6359 goto out_now; 6360 } 6361 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 6362 /* Now can we send this? */ 6363 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_SENT) || 6364 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 6365 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 6366 (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) { 6367 /* got data while shutting down */ 6368 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 6369 error = ECONNRESET; 6370 goto out_now; 6371 } 6372 sctp_alloc_a_strmoq(stcb, sp); 6373 if (sp == NULL) { 6374 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6375 error = ENOMEM; 6376 goto out_now; 6377 } 6378 sp->sinfo_flags = srcv->sinfo_flags; 6379 sp->timetolive = srcv->sinfo_timetolive; 6380 sp->ppid = srcv->sinfo_ppid; 6381 sp->context = srcv->sinfo_context; 6382 sp->fsn = 0; 6383 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 6384 sp->net = net; 6385 atomic_add_int(&sp->net->ref_count, 1); 6386 } else { 6387 sp->net = NULL; 6388 } 6389 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 6390 sp->sid = srcv->sinfo_stream; 6391 sp->msg_is_complete = 1; 6392 sp->sender_all_done = 1; 6393 sp->some_taken = 0; 6394 sp->data = m; 6395 sp->tail_mbuf = NULL; 6396 sctp_set_prsctp_policy(sp); 6397 /* 6398 * We could in theory (for sendall) sifa the length in, but we would 6399 * still have to hunt through the chain since we need to setup the 6400 * tail_mbuf 6401 */ 6402 sp->length = 0; 6403 for (at = m; at; at = SCTP_BUF_NEXT(at)) { 6404 if (SCTP_BUF_NEXT(at) == NULL) 6405 sp->tail_mbuf = at; 6406 sp->length += SCTP_BUF_LEN(at); 6407 } 6408 if (srcv->sinfo_keynumber_valid) { 6409 sp->auth_keyid = srcv->sinfo_keynumber; 6410 } else { 6411 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 6412 } 6413 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 6414 sctp_auth_key_acquire(stcb, sp->auth_keyid); 6415 sp->holds_key_ref = 1; 6416 } 6417 if (hold_stcb_lock == 0) { 6418 SCTP_TCB_SEND_LOCK(stcb); 6419 } 6420 sctp_snd_sb_alloc(stcb, sp->length); 6421 atomic_add_int(&stcb->asoc.stream_queue_cnt, 1); 6422 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 6423 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, &stcb->asoc, strm, sp, 1); 6424 m = NULL; 6425 if (hold_stcb_lock == 0) { 6426 SCTP_TCB_SEND_UNLOCK(stcb); 6427 } 6428out_now: 6429 if (m) { 6430 sctp_m_freem(m); 6431 } 6432 return (error); 6433} 6434 6435 6436static struct mbuf * 6437sctp_copy_mbufchain(struct mbuf *clonechain, 6438 struct mbuf *outchain, 6439 struct mbuf **endofchain, 6440 int can_take_mbuf, 6441 int sizeofcpy, 6442 uint8_t copy_by_ref) 6443{ 6444 struct mbuf *m; 6445 struct mbuf *appendchain; 6446 caddr_t cp; 6447 int len; 6448 6449 if (endofchain == NULL) { 6450 /* error */ 6451error_out: 6452 if (outchain) 6453 sctp_m_freem(outchain); 6454 return (NULL); 6455 } 6456 if (can_take_mbuf) { 6457 appendchain = clonechain; 6458 } else { 6459 if (!copy_by_ref && 6460 (sizeofcpy <= (int)((((SCTP_BASE_SYSCTL(sctp_mbuf_threshold_count) - 1) * MLEN) + MHLEN))) 6461 ) { 6462 /* Its not in a cluster */ 6463 if (*endofchain == NULL) { 6464 /* lets get a mbuf cluster */ 6465 if (outchain == NULL) { 6466 /* This is the general case */ 6467 new_mbuf: 6468 outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6469 if (outchain == NULL) { 6470 goto error_out; 6471 } 6472 SCTP_BUF_LEN(outchain) = 0; 6473 *endofchain = outchain; 6474 /* get the prepend space */ 6475 SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4)); 6476 } else { 6477 /* 6478 * We really should not get a NULL 6479 * in endofchain 6480 */ 6481 /* find end */ 6482 m = outchain; 6483 while (m) { 6484 if (SCTP_BUF_NEXT(m) == NULL) { 6485 *endofchain = m; 6486 break; 6487 } 6488 m = SCTP_BUF_NEXT(m); 6489 } 6490 /* sanity */ 6491 if (*endofchain == NULL) { 6492 /* 6493 * huh, TSNH XXX maybe we 6494 * should panic 6495 */ 6496 sctp_m_freem(outchain); 6497 goto new_mbuf; 6498 } 6499 } 6500 /* get the new end of length */ 6501 len = (int)M_TRAILINGSPACE(*endofchain); 6502 } else { 6503 /* how much is left at the end? */ 6504 len = (int)M_TRAILINGSPACE(*endofchain); 6505 } 6506 /* Find the end of the data, for appending */ 6507 cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain))); 6508 6509 /* Now lets copy it out */ 6510 if (len >= sizeofcpy) { 6511 /* It all fits, copy it in */ 6512 m_copydata(clonechain, 0, sizeofcpy, cp); 6513 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6514 } else { 6515 /* fill up the end of the chain */ 6516 if (len > 0) { 6517 m_copydata(clonechain, 0, len, cp); 6518 SCTP_BUF_LEN((*endofchain)) += len; 6519 /* now we need another one */ 6520 sizeofcpy -= len; 6521 } 6522 m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_HEADER); 6523 if (m == NULL) { 6524 /* We failed */ 6525 goto error_out; 6526 } 6527 SCTP_BUF_NEXT((*endofchain)) = m; 6528 *endofchain = m; 6529 cp = mtod((*endofchain), caddr_t); 6530 m_copydata(clonechain, len, sizeofcpy, cp); 6531 SCTP_BUF_LEN((*endofchain)) += sizeofcpy; 6532 } 6533 return (outchain); 6534 } else { 6535 /* copy the old fashion way */ 6536 appendchain = SCTP_M_COPYM(clonechain, 0, M_COPYALL, M_NOWAIT); 6537#ifdef SCTP_MBUF_LOGGING 6538 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6539 sctp_log_mbc(appendchain, SCTP_MBUF_ICOPY); 6540 } 6541#endif 6542 } 6543 } 6544 if (appendchain == NULL) { 6545 /* error */ 6546 if (outchain) 6547 sctp_m_freem(outchain); 6548 return (NULL); 6549 } 6550 if (outchain) { 6551 /* tack on to the end */ 6552 if (*endofchain != NULL) { 6553 SCTP_BUF_NEXT(((*endofchain))) = appendchain; 6554 } else { 6555 m = outchain; 6556 while (m) { 6557 if (SCTP_BUF_NEXT(m) == NULL) { 6558 SCTP_BUF_NEXT(m) = appendchain; 6559 break; 6560 } 6561 m = SCTP_BUF_NEXT(m); 6562 } 6563 } 6564 /* 6565 * save off the end and update the end-chain position 6566 */ 6567 m = appendchain; 6568 while (m) { 6569 if (SCTP_BUF_NEXT(m) == NULL) { 6570 *endofchain = m; 6571 break; 6572 } 6573 m = SCTP_BUF_NEXT(m); 6574 } 6575 return (outchain); 6576 } else { 6577 /* save off the end and update the end-chain position */ 6578 m = appendchain; 6579 while (m) { 6580 if (SCTP_BUF_NEXT(m) == NULL) { 6581 *endofchain = m; 6582 break; 6583 } 6584 m = SCTP_BUF_NEXT(m); 6585 } 6586 return (appendchain); 6587 } 6588} 6589 6590static int 6591sctp_med_chunk_output(struct sctp_inpcb *inp, 6592 struct sctp_tcb *stcb, 6593 struct sctp_association *asoc, 6594 int *num_out, 6595 int *reason_code, 6596 int control_only, int from_where, 6597 struct timeval *now, int *now_filled, int frag_point, int so_locked 6598#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 6599 SCTP_UNUSED 6600#endif 6601); 6602 6603static void 6604sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, 6605 uint32_t val SCTP_UNUSED) 6606{ 6607 struct sctp_copy_all *ca; 6608 struct mbuf *m; 6609 int ret = 0; 6610 int added_control = 0; 6611 int un_sent, do_chunk_output = 1; 6612 struct sctp_association *asoc; 6613 struct sctp_nets *net; 6614 6615 ca = (struct sctp_copy_all *)ptr; 6616 if (ca->m == NULL) { 6617 return; 6618 } 6619 if (ca->inp != inp) { 6620 /* TSNH */ 6621 return; 6622 } 6623 if (ca->sndlen > 0) { 6624 m = SCTP_M_COPYM(ca->m, 0, M_COPYALL, M_NOWAIT); 6625 if (m == NULL) { 6626 /* can't copy so we are done */ 6627 ca->cnt_failed++; 6628 return; 6629 } 6630#ifdef SCTP_MBUF_LOGGING 6631 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 6632 sctp_log_mbc(m, SCTP_MBUF_ICOPY); 6633 } 6634#endif 6635 } else { 6636 m = NULL; 6637 } 6638 SCTP_TCB_LOCK_ASSERT(stcb); 6639 if (stcb->asoc.alternate) { 6640 net = stcb->asoc.alternate; 6641 } else { 6642 net = stcb->asoc.primary_destination; 6643 } 6644 if (ca->sndrcv.sinfo_flags & SCTP_ABORT) { 6645 /* Abort this assoc with m as the user defined reason */ 6646 if (m != NULL) { 6647 SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_NOWAIT); 6648 } else { 6649 m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 6650 0, M_NOWAIT, 1, MT_DATA); 6651 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr); 6652 } 6653 if (m != NULL) { 6654 struct sctp_paramhdr *ph; 6655 6656 ph = mtod(m, struct sctp_paramhdr *); 6657 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 6658 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + ca->sndlen)); 6659 } 6660 /* 6661 * We add one here to keep the assoc from dis-appearing on 6662 * us. 6663 */ 6664 atomic_add_int(&stcb->asoc.refcnt, 1); 6665 sctp_abort_an_association(inp, stcb, m, SCTP_SO_NOT_LOCKED); 6666 /* 6667 * sctp_abort_an_association calls sctp_free_asoc() free 6668 * association will NOT free it since we incremented the 6669 * refcnt .. we do this to prevent it being freed and things 6670 * getting tricky since we could end up (from free_asoc) 6671 * calling inpcb_free which would get a recursive lock call 6672 * to the iterator lock.. But as a consequence of that the 6673 * stcb will return to us un-locked.. since free_asoc 6674 * returns with either no TCB or the TCB unlocked, we must 6675 * relock.. to unlock in the iterator timer :-0 6676 */ 6677 SCTP_TCB_LOCK(stcb); 6678 atomic_add_int(&stcb->asoc.refcnt, -1); 6679 goto no_chunk_output; 6680 } else { 6681 if (m) { 6682 ret = sctp_msg_append(stcb, net, m, 6683 &ca->sndrcv, 1); 6684 } 6685 asoc = &stcb->asoc; 6686 if (ca->sndrcv.sinfo_flags & SCTP_EOF) { 6687 /* shutdown this assoc */ 6688 if (TAILQ_EMPTY(&asoc->send_queue) && 6689 TAILQ_EMPTY(&asoc->sent_queue) && 6690 sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED) == 0) { 6691 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6692 goto abort_anyway; 6693 } 6694 /* 6695 * there is nothing queued to send, so I'm 6696 * done... 6697 */ 6698 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 6699 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6700 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6701 /* 6702 * only send SHUTDOWN the first time 6703 * through 6704 */ 6705 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 6706 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 6707 } 6708 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT); 6709 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING); 6710 sctp_stop_timers_for_shutdown(stcb); 6711 sctp_send_shutdown(stcb, net); 6712 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 6713 net); 6714 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6715 asoc->primary_destination); 6716 added_control = 1; 6717 do_chunk_output = 0; 6718 } 6719 } else { 6720 /* 6721 * we still got (or just got) data to send, 6722 * so set SHUTDOWN_PENDING 6723 */ 6724 /* 6725 * XXX sockets draft says that SCTP_EOF 6726 * should be sent with no data. currently, 6727 * we will allow user data to be sent first 6728 * and move to SHUTDOWN-PENDING 6729 */ 6730 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 6731 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 6732 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 6733 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 6734 asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT; 6735 } 6736 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 6737 if (TAILQ_EMPTY(&asoc->send_queue) && 6738 TAILQ_EMPTY(&asoc->sent_queue) && 6739 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 6740 struct mbuf *op_err; 6741 char msg[SCTP_DIAG_INFO_LEN]; 6742 6743 abort_anyway: 6744 snprintf(msg, sizeof(msg), 6745 "%s:%d at %s", __FILE__, __LINE__, __func__); 6746 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 6747 msg); 6748 atomic_add_int(&stcb->asoc.refcnt, 1); 6749 sctp_abort_an_association(stcb->sctp_ep, stcb, 6750 op_err, SCTP_SO_NOT_LOCKED); 6751 atomic_add_int(&stcb->asoc.refcnt, -1); 6752 goto no_chunk_output; 6753 } 6754 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 6755 asoc->primary_destination); 6756 } 6757 } 6758 6759 } 6760 } 6761 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 6762 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 6763 6764 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 6765 (stcb->asoc.total_flight > 0) && 6766 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 6767 do_chunk_output = 0; 6768 } 6769 if (do_chunk_output) 6770 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_NOT_LOCKED); 6771 else if (added_control) { 6772 int num_out, reason, now_filled = 0; 6773 struct timeval now; 6774 int frag_point; 6775 6776 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 6777 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 6778 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_NOT_LOCKED); 6779 } 6780no_chunk_output: 6781 if (ret) { 6782 ca->cnt_failed++; 6783 } else { 6784 ca->cnt_sent++; 6785 } 6786} 6787 6788static void 6789sctp_sendall_completes(void *ptr, uint32_t val SCTP_UNUSED) 6790{ 6791 struct sctp_copy_all *ca; 6792 6793 ca = (struct sctp_copy_all *)ptr; 6794 /* 6795 * Do a notify here? Kacheong suggests that the notify be done at 6796 * the send time.. so you would push up a notification if any send 6797 * failed. Don't know if this is feasible since the only failures we 6798 * have is "memory" related and if you cannot get an mbuf to send 6799 * the data you surely can't get an mbuf to send up to notify the 6800 * user you can't send the data :-> 6801 */ 6802 6803 /* now free everything */ 6804 sctp_m_freem(ca->m); 6805 SCTP_FREE(ca, SCTP_M_COPYAL); 6806} 6807 6808static struct mbuf * 6809sctp_copy_out_all(struct uio *uio, int len) 6810{ 6811 struct mbuf *ret, *at; 6812 int left, willcpy, cancpy, error; 6813 6814 ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAITOK, 1, MT_DATA); 6815 if (ret == NULL) { 6816 /* TSNH */ 6817 return (NULL); 6818 } 6819 left = len; 6820 SCTP_BUF_LEN(ret) = 0; 6821 /* save space for the data chunk header */ 6822 cancpy = (int)M_TRAILINGSPACE(ret); 6823 willcpy = min(cancpy, left); 6824 at = ret; 6825 while (left > 0) { 6826 /* Align data to the end */ 6827 error = uiomove(mtod(at, caddr_t), willcpy, uio); 6828 if (error) { 6829 err_out_now: 6830 sctp_m_freem(at); 6831 return (NULL); 6832 } 6833 SCTP_BUF_LEN(at) = willcpy; 6834 SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0; 6835 left -= willcpy; 6836 if (left > 0) { 6837 SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg(left, 0, M_WAITOK, 1, MT_DATA); 6838 if (SCTP_BUF_NEXT(at) == NULL) { 6839 goto err_out_now; 6840 } 6841 at = SCTP_BUF_NEXT(at); 6842 SCTP_BUF_LEN(at) = 0; 6843 cancpy = (int)M_TRAILINGSPACE(at); 6844 willcpy = min(cancpy, left); 6845 } 6846 } 6847 return (ret); 6848} 6849 6850static int 6851sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, 6852 struct sctp_sndrcvinfo *srcv) 6853{ 6854 int ret; 6855 struct sctp_copy_all *ca; 6856 6857 SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all), 6858 SCTP_M_COPYAL); 6859 if (ca == NULL) { 6860 sctp_m_freem(m); 6861 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6862 return (ENOMEM); 6863 } 6864 memset(ca, 0, sizeof(struct sctp_copy_all)); 6865 6866 ca->inp = inp; 6867 if (srcv) { 6868 memcpy(&ca->sndrcv, srcv, sizeof(struct sctp_nonpad_sndrcvinfo)); 6869 } 6870 /* 6871 * take off the sendall flag, it would be bad if we failed to do 6872 * this :-0 6873 */ 6874 ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL; 6875 /* get length and mbuf chain */ 6876 if (uio) { 6877 ca->sndlen = (int)uio->uio_resid; 6878 ca->m = sctp_copy_out_all(uio, ca->sndlen); 6879 if (ca->m == NULL) { 6880 SCTP_FREE(ca, SCTP_M_COPYAL); 6881 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 6882 return (ENOMEM); 6883 } 6884 } else { 6885 /* Gather the length of the send */ 6886 struct mbuf *mat; 6887 6888 ca->sndlen = 0; 6889 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) { 6890 ca->sndlen += SCTP_BUF_LEN(mat); 6891 } 6892 } 6893 ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, NULL, 6894 SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES, 6895 SCTP_ASOC_ANY_STATE, 6896 (void *)ca, 0, 6897 sctp_sendall_completes, inp, 1); 6898 if (ret) { 6899 SCTP_PRINTF("Failed to initiate iterator for sendall\n"); 6900 SCTP_FREE(ca, SCTP_M_COPYAL); 6901 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 6902 return (EFAULT); 6903 } 6904 return (0); 6905} 6906 6907 6908void 6909sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc) 6910{ 6911 struct sctp_tmit_chunk *chk, *nchk; 6912 6913 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 6914 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 6915 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 6916 if (chk->data) { 6917 sctp_m_freem(chk->data); 6918 chk->data = NULL; 6919 } 6920 asoc->ctrl_queue_cnt--; 6921 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6922 } 6923 } 6924} 6925 6926void 6927sctp_toss_old_asconf(struct sctp_tcb *stcb) 6928{ 6929 struct sctp_association *asoc; 6930 struct sctp_tmit_chunk *chk, *nchk; 6931 struct sctp_asconf_chunk *acp; 6932 6933 asoc = &stcb->asoc; 6934 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 6935 /* find SCTP_ASCONF chunk in queue */ 6936 if (chk->rec.chunk_id.id == SCTP_ASCONF) { 6937 if (chk->data) { 6938 acp = mtod(chk->data, struct sctp_asconf_chunk *); 6939 if (SCTP_TSN_GT(ntohl(acp->serial_number), asoc->asconf_seq_out_acked)) { 6940 /* Not Acked yet */ 6941 break; 6942 } 6943 } 6944 TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next); 6945 if (chk->data) { 6946 sctp_m_freem(chk->data); 6947 chk->data = NULL; 6948 } 6949 asoc->ctrl_queue_cnt--; 6950 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 6951 } 6952 } 6953} 6954 6955 6956static void 6957sctp_clean_up_datalist(struct sctp_tcb *stcb, 6958 struct sctp_association *asoc, 6959 struct sctp_tmit_chunk **data_list, 6960 int bundle_at, 6961 struct sctp_nets *net) 6962{ 6963 int i; 6964 struct sctp_tmit_chunk *tp1; 6965 6966 for (i = 0; i < bundle_at; i++) { 6967 /* off of the send queue */ 6968 TAILQ_REMOVE(&asoc->send_queue, data_list[i], sctp_next); 6969 asoc->send_queue_cnt--; 6970 if (i > 0) { 6971 /* 6972 * Any chunk NOT 0 you zap the time chunk 0 gets 6973 * zapped or set based on if a RTO measurment is 6974 * needed. 6975 */ 6976 data_list[i]->do_rtt = 0; 6977 } 6978 /* record time */ 6979 data_list[i]->sent_rcv_time = net->last_sent_time; 6980 data_list[i]->rec.data.cwnd_at_send = net->cwnd; 6981 data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.tsn; 6982 if (data_list[i]->whoTo == NULL) { 6983 data_list[i]->whoTo = net; 6984 atomic_add_int(&net->ref_count, 1); 6985 } 6986 /* on to the sent queue */ 6987 tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead); 6988 if ((tp1) && SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 6989 struct sctp_tmit_chunk *tpp; 6990 6991 /* need to move back */ 6992 back_up_more: 6993 tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next); 6994 if (tpp == NULL) { 6995 TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next); 6996 goto all_done; 6997 } 6998 tp1 = tpp; 6999 if (SCTP_TSN_GT(tp1->rec.data.tsn, data_list[i]->rec.data.tsn)) { 7000 goto back_up_more; 7001 } 7002 TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next); 7003 } else { 7004 TAILQ_INSERT_TAIL(&asoc->sent_queue, 7005 data_list[i], 7006 sctp_next); 7007 } 7008all_done: 7009 /* This does not lower until the cum-ack passes it */ 7010 asoc->sent_queue_cnt++; 7011 if ((asoc->peers_rwnd <= 0) && 7012 (asoc->total_flight == 0) && 7013 (bundle_at == 1)) { 7014 /* Mark the chunk as being a window probe */ 7015 SCTP_STAT_INCR(sctps_windowprobed); 7016 } 7017#ifdef SCTP_AUDITING_ENABLED 7018 sctp_audit_log(0xC2, 3); 7019#endif 7020 data_list[i]->sent = SCTP_DATAGRAM_SENT; 7021 data_list[i]->snd_count = 1; 7022 data_list[i]->rec.data.chunk_was_revoked = 0; 7023 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 7024 sctp_misc_ints(SCTP_FLIGHT_LOG_UP, 7025 data_list[i]->whoTo->flight_size, 7026 data_list[i]->book_size, 7027 (uint32_t)(uintptr_t)data_list[i]->whoTo, 7028 data_list[i]->rec.data.tsn); 7029 } 7030 sctp_flight_size_increase(data_list[i]); 7031 sctp_total_flight_increase(stcb, data_list[i]); 7032 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 7033 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 7034 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 7035 } 7036 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 7037 (uint32_t)(data_list[i]->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 7038 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 7039 /* SWS sender side engages */ 7040 asoc->peers_rwnd = 0; 7041 } 7042 } 7043 if (asoc->cc_functions.sctp_cwnd_update_packet_transmitted) { 7044 (*asoc->cc_functions.sctp_cwnd_update_packet_transmitted) (stcb, net); 7045 } 7046} 7047 7048static void 7049sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc, int so_locked 7050#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7051 SCTP_UNUSED 7052#endif 7053) 7054{ 7055 struct sctp_tmit_chunk *chk, *nchk; 7056 7057 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 7058 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7059 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 7060 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 7061 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 7062 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) || 7063 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 7064 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 7065 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 7066 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 7067 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 7068 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 7069 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 7070 /* Stray chunks must be cleaned up */ 7071 clean_up_anyway: 7072 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7073 if (chk->data) { 7074 sctp_m_freem(chk->data); 7075 chk->data = NULL; 7076 } 7077 asoc->ctrl_queue_cnt--; 7078 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) 7079 asoc->fwd_tsn_cnt--; 7080 sctp_free_a_chunk(stcb, chk, so_locked); 7081 } else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 7082 /* special handling, we must look into the param */ 7083 if (chk != asoc->str_reset) { 7084 goto clean_up_anyway; 7085 } 7086 } 7087 } 7088} 7089 7090static uint32_t 7091sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length, 7092 uint32_t space_left, uint32_t frag_point, int eeor_on) 7093{ 7094 /* 7095 * Make a decision on if I should split a msg into multiple parts. 7096 * This is only asked of incomplete messages. 7097 */ 7098 if (eeor_on) { 7099 /* 7100 * If we are doing EEOR we need to always send it if its the 7101 * entire thing, since it might be all the guy is putting in 7102 * the hopper. 7103 */ 7104 if (space_left >= length) { 7105 /*- 7106 * If we have data outstanding, 7107 * we get another chance when the sack 7108 * arrives to transmit - wait for more data 7109 */ 7110 if (stcb->asoc.total_flight == 0) { 7111 /* 7112 * If nothing is in flight, we zero the 7113 * packet counter. 7114 */ 7115 return (length); 7116 } 7117 return (0); 7118 7119 } else { 7120 /* You can fill the rest */ 7121 return (space_left); 7122 } 7123 } 7124 /*- 7125 * For those strange folk that make the send buffer 7126 * smaller than our fragmentation point, we can't 7127 * get a full msg in so we have to allow splitting. 7128 */ 7129 if (SCTP_SB_LIMIT_SND(stcb->sctp_socket) < frag_point) { 7130 return (length); 7131 } 7132 if ((length <= space_left) || 7133 ((length - space_left) < SCTP_BASE_SYSCTL(sctp_min_residual))) { 7134 /* Sub-optimial residual don't split in non-eeor mode. */ 7135 return (0); 7136 } 7137 /* 7138 * If we reach here length is larger than the space_left. Do we wish 7139 * to split it for the sake of packet putting together? 7140 */ 7141 if (space_left >= min(SCTP_BASE_SYSCTL(sctp_min_split_point), frag_point)) { 7142 /* Its ok to split it */ 7143 return (min(space_left, frag_point)); 7144 } 7145 /* Nope, can't split */ 7146 return (0); 7147} 7148 7149static uint32_t 7150sctp_move_to_outqueue(struct sctp_tcb *stcb, 7151 struct sctp_stream_out *strq, 7152 uint32_t space_left, 7153 uint32_t frag_point, 7154 int *giveup, 7155 int eeor_mode, 7156 int *bail, 7157 int so_locked 7158#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7159 SCTP_UNUSED 7160#endif 7161) 7162{ 7163 /* Move from the stream to the send_queue keeping track of the total */ 7164 struct sctp_association *asoc; 7165 struct sctp_stream_queue_pending *sp; 7166 struct sctp_tmit_chunk *chk; 7167 struct sctp_data_chunk *dchkh = NULL; 7168 struct sctp_idata_chunk *ndchkh = NULL; 7169 uint32_t to_move, length; 7170 int leading; 7171 uint8_t rcv_flags = 0; 7172 uint8_t some_taken; 7173 uint8_t send_lock_up = 0; 7174 7175 SCTP_TCB_LOCK_ASSERT(stcb); 7176 asoc = &stcb->asoc; 7177one_more_time: 7178 /* sa_ignore FREED_MEMORY */ 7179 sp = TAILQ_FIRST(&strq->outqueue); 7180 if (sp == NULL) { 7181 if (send_lock_up == 0) { 7182 SCTP_TCB_SEND_LOCK(stcb); 7183 send_lock_up = 1; 7184 } 7185 sp = TAILQ_FIRST(&strq->outqueue); 7186 if (sp) { 7187 goto one_more_time; 7188 } 7189 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_EXPLICIT_EOR) == 0) && 7190 (stcb->asoc.idata_supported == 0) && 7191 (strq->last_msg_incomplete)) { 7192 SCTP_PRINTF("Huh? Stream:%d lm_in_c=%d but queue is NULL\n", 7193 strq->sid, 7194 strq->last_msg_incomplete); 7195 strq->last_msg_incomplete = 0; 7196 } 7197 to_move = 0; 7198 if (send_lock_up) { 7199 SCTP_TCB_SEND_UNLOCK(stcb); 7200 send_lock_up = 0; 7201 } 7202 goto out_of; 7203 } 7204 if ((sp->msg_is_complete) && (sp->length == 0)) { 7205 if (sp->sender_all_done) { 7206 /* 7207 * We are doing differed cleanup. Last time through 7208 * when we took all the data the sender_all_done was 7209 * not set. 7210 */ 7211 if ((sp->put_last_out == 0) && (sp->discard_rest == 0)) { 7212 SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n"); 7213 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7214 sp->sender_all_done, 7215 sp->length, 7216 sp->msg_is_complete, 7217 sp->put_last_out, 7218 send_lock_up); 7219 } 7220 if ((TAILQ_NEXT(sp, next) == NULL) && (send_lock_up == 0)) { 7221 SCTP_TCB_SEND_LOCK(stcb); 7222 send_lock_up = 1; 7223 } 7224 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7225 TAILQ_REMOVE(&strq->outqueue, sp, next); 7226 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7227 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7228 (strq->chunks_on_queues == 0) && 7229 TAILQ_EMPTY(&strq->outqueue)) { 7230 stcb->asoc.trigger_reset = 1; 7231 } 7232 if (sp->net) { 7233 sctp_free_remote_addr(sp->net); 7234 sp->net = NULL; 7235 } 7236 if (sp->data) { 7237 sctp_m_freem(sp->data); 7238 sp->data = NULL; 7239 } 7240 sctp_free_a_strmoq(stcb, sp, so_locked); 7241 /* we can't be locked to it */ 7242 if (send_lock_up) { 7243 SCTP_TCB_SEND_UNLOCK(stcb); 7244 send_lock_up = 0; 7245 } 7246 /* back to get the next msg */ 7247 goto one_more_time; 7248 } else { 7249 /* 7250 * sender just finished this but still holds a 7251 * reference 7252 */ 7253 *giveup = 1; 7254 to_move = 0; 7255 goto out_of; 7256 } 7257 } else { 7258 /* is there some to get */ 7259 if (sp->length == 0) { 7260 /* no */ 7261 *giveup = 1; 7262 to_move = 0; 7263 goto out_of; 7264 } else if (sp->discard_rest) { 7265 if (send_lock_up == 0) { 7266 SCTP_TCB_SEND_LOCK(stcb); 7267 send_lock_up = 1; 7268 } 7269 /* Whack down the size */ 7270 atomic_subtract_int(&stcb->asoc.total_output_queue_size, sp->length); 7271 if ((stcb->sctp_socket != NULL) && 7272 ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 7273 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) { 7274 atomic_subtract_int(&stcb->sctp_socket->so_snd.sb_cc, sp->length); 7275 } 7276 if (sp->data) { 7277 sctp_m_freem(sp->data); 7278 sp->data = NULL; 7279 sp->tail_mbuf = NULL; 7280 } 7281 sp->length = 0; 7282 sp->some_taken = 1; 7283 *giveup = 1; 7284 to_move = 0; 7285 goto out_of; 7286 } 7287 } 7288 some_taken = sp->some_taken; 7289re_look: 7290 length = sp->length; 7291 if (sp->msg_is_complete) { 7292 /* The message is complete */ 7293 to_move = min(length, frag_point); 7294 if (to_move == length) { 7295 /* All of it fits in the MTU */ 7296 if (sp->some_taken) { 7297 rcv_flags |= SCTP_DATA_LAST_FRAG; 7298 } else { 7299 rcv_flags |= SCTP_DATA_NOT_FRAG; 7300 } 7301 sp->put_last_out = 1; 7302 if (sp->sinfo_flags & SCTP_SACK_IMMEDIATELY) { 7303 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7304 } 7305 } else { 7306 /* Not all of it fits, we fragment */ 7307 if (sp->some_taken == 0) { 7308 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7309 } 7310 sp->some_taken = 1; 7311 } 7312 } else { 7313 to_move = sctp_can_we_split_this(stcb, length, space_left, frag_point, eeor_mode); 7314 if (to_move) { 7315 /*- 7316 * We use a snapshot of length in case it 7317 * is expanding during the compare. 7318 */ 7319 uint32_t llen; 7320 7321 llen = length; 7322 if (to_move >= llen) { 7323 to_move = llen; 7324 if (send_lock_up == 0) { 7325 /*- 7326 * We are taking all of an incomplete msg 7327 * thus we need a send lock. 7328 */ 7329 SCTP_TCB_SEND_LOCK(stcb); 7330 send_lock_up = 1; 7331 if (sp->msg_is_complete) { 7332 /* 7333 * the sender finished the 7334 * msg 7335 */ 7336 goto re_look; 7337 } 7338 } 7339 } 7340 if (sp->some_taken == 0) { 7341 rcv_flags |= SCTP_DATA_FIRST_FRAG; 7342 sp->some_taken = 1; 7343 } 7344 } else { 7345 /* Nothing to take. */ 7346 *giveup = 1; 7347 to_move = 0; 7348 goto out_of; 7349 } 7350 } 7351 7352 /* If we reach here, we can copy out a chunk */ 7353 sctp_alloc_a_chunk(stcb, chk); 7354 if (chk == NULL) { 7355 /* No chunk memory */ 7356 *giveup = 1; 7357 to_move = 0; 7358 goto out_of; 7359 } 7360 /* 7361 * Setup for unordered if needed by looking at the user sent info 7362 * flags. 7363 */ 7364 if (sp->sinfo_flags & SCTP_UNORDERED) { 7365 rcv_flags |= SCTP_DATA_UNORDERED; 7366 } 7367 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 7368 (sp->sinfo_flags & SCTP_EOF) == SCTP_EOF) { 7369 rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY; 7370 } 7371 /* clear out the chunk before setting up */ 7372 memset(chk, 0, sizeof(*chk)); 7373 chk->rec.data.rcv_flags = rcv_flags; 7374 7375 if (to_move >= length) { 7376 /* we think we can steal the whole thing */ 7377 if ((sp->sender_all_done == 0) && (send_lock_up == 0)) { 7378 SCTP_TCB_SEND_LOCK(stcb); 7379 send_lock_up = 1; 7380 } 7381 if (to_move < sp->length) { 7382 /* bail, it changed */ 7383 goto dont_do_it; 7384 } 7385 chk->data = sp->data; 7386 chk->last_mbuf = sp->tail_mbuf; 7387 /* register the stealing */ 7388 sp->data = sp->tail_mbuf = NULL; 7389 } else { 7390 struct mbuf *m; 7391 7392dont_do_it: 7393 chk->data = SCTP_M_COPYM(sp->data, 0, to_move, M_NOWAIT); 7394 chk->last_mbuf = NULL; 7395 if (chk->data == NULL) { 7396 sp->some_taken = some_taken; 7397 sctp_free_a_chunk(stcb, chk, so_locked); 7398 *bail = 1; 7399 to_move = 0; 7400 goto out_of; 7401 } 7402#ifdef SCTP_MBUF_LOGGING 7403 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 7404 sctp_log_mbc(chk->data, SCTP_MBUF_ICOPY); 7405 } 7406#endif 7407 /* Pull off the data */ 7408 m_adj(sp->data, to_move); 7409 /* Now lets work our way down and compact it */ 7410 m = sp->data; 7411 while (m && (SCTP_BUF_LEN(m) == 0)) { 7412 sp->data = SCTP_BUF_NEXT(m); 7413 SCTP_BUF_NEXT(m) = NULL; 7414 if (sp->tail_mbuf == m) { 7415 /*- 7416 * Freeing tail? TSNH since 7417 * we supposedly were taking less 7418 * than the sp->length. 7419 */ 7420#ifdef INVARIANTS 7421 panic("Huh, freing tail? - TSNH"); 7422#else 7423 SCTP_PRINTF("Huh, freeing tail? - TSNH\n"); 7424 sp->tail_mbuf = sp->data = NULL; 7425 sp->length = 0; 7426#endif 7427 7428 } 7429 sctp_m_free(m); 7430 m = sp->data; 7431 } 7432 } 7433 if (SCTP_BUF_IS_EXTENDED(chk->data)) { 7434 chk->copy_by_ref = 1; 7435 } else { 7436 chk->copy_by_ref = 0; 7437 } 7438 /* 7439 * get last_mbuf and counts of mb usage This is ugly but hopefully 7440 * its only one mbuf. 7441 */ 7442 if (chk->last_mbuf == NULL) { 7443 chk->last_mbuf = chk->data; 7444 while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) { 7445 chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf); 7446 } 7447 } 7448 if (to_move > length) { 7449 /*- This should not happen either 7450 * since we always lower to_move to the size 7451 * of sp->length if its larger. 7452 */ 7453#ifdef INVARIANTS 7454 panic("Huh, how can to_move be larger?"); 7455#else 7456 SCTP_PRINTF("Huh, how can to_move be larger?\n"); 7457 sp->length = 0; 7458#endif 7459 } else { 7460 atomic_subtract_int(&sp->length, to_move); 7461 } 7462 if (stcb->asoc.idata_supported == 0) { 7463 leading = sizeof(struct sctp_data_chunk); 7464 } else { 7465 leading = sizeof(struct sctp_idata_chunk); 7466 } 7467 if (M_LEADINGSPACE(chk->data) < leading) { 7468 /* Not enough room for a chunk header, get some */ 7469 struct mbuf *m; 7470 7471 m = sctp_get_mbuf_for_msg(1, 0, M_NOWAIT, 0, MT_DATA); 7472 if (m == NULL) { 7473 /* 7474 * we're in trouble here. _PREPEND below will free 7475 * all the data if there is no leading space, so we 7476 * must put the data back and restore. 7477 */ 7478 if (send_lock_up == 0) { 7479 SCTP_TCB_SEND_LOCK(stcb); 7480 send_lock_up = 1; 7481 } 7482 if (sp->data == NULL) { 7483 /* unsteal the data */ 7484 sp->data = chk->data; 7485 sp->tail_mbuf = chk->last_mbuf; 7486 } else { 7487 struct mbuf *m_tmp; 7488 7489 /* reassemble the data */ 7490 m_tmp = sp->data; 7491 sp->data = chk->data; 7492 SCTP_BUF_NEXT(chk->last_mbuf) = m_tmp; 7493 } 7494 sp->some_taken = some_taken; 7495 atomic_add_int(&sp->length, to_move); 7496 chk->data = NULL; 7497 *bail = 1; 7498 sctp_free_a_chunk(stcb, chk, so_locked); 7499 to_move = 0; 7500 goto out_of; 7501 } else { 7502 SCTP_BUF_LEN(m) = 0; 7503 SCTP_BUF_NEXT(m) = chk->data; 7504 chk->data = m; 7505 M_ALIGN(chk->data, 4); 7506 } 7507 } 7508 if (stcb->asoc.idata_supported == 0) { 7509 SCTP_BUF_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_NOWAIT); 7510 } else { 7511 SCTP_BUF_PREPEND(chk->data, sizeof(struct sctp_idata_chunk), M_NOWAIT); 7512 } 7513 if (chk->data == NULL) { 7514 /* HELP, TSNH since we assured it would not above? */ 7515#ifdef INVARIANTS 7516 panic("prepend failes HELP?"); 7517#else 7518 SCTP_PRINTF("prepend fails HELP?\n"); 7519 sctp_free_a_chunk(stcb, chk, so_locked); 7520#endif 7521 *bail = 1; 7522 to_move = 0; 7523 goto out_of; 7524 } 7525 if (stcb->asoc.idata_supported == 0) { 7526 sctp_snd_sb_alloc(stcb, sizeof(struct sctp_data_chunk)); 7527 chk->book_size = chk->send_size = (uint16_t)(to_move + sizeof(struct sctp_data_chunk)); 7528 } else { 7529 sctp_snd_sb_alloc(stcb, sizeof(struct sctp_idata_chunk)); 7530 chk->book_size = chk->send_size = (uint16_t)(to_move + sizeof(struct sctp_idata_chunk)); 7531 } 7532 chk->book_size_scale = 0; 7533 chk->sent = SCTP_DATAGRAM_UNSENT; 7534 7535 chk->flags = 0; 7536 chk->asoc = &stcb->asoc; 7537 chk->pad_inplace = 0; 7538 chk->no_fr_allowed = 0; 7539 if (stcb->asoc.idata_supported == 0) { 7540 if (rcv_flags & SCTP_DATA_UNORDERED) { 7541 /* Just use 0. The receiver ignores the values. */ 7542 chk->rec.data.mid = 0; 7543 } else { 7544 chk->rec.data.mid = strq->next_mid_ordered; 7545 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7546 strq->next_mid_ordered++; 7547 } 7548 } 7549 } else { 7550 if (rcv_flags & SCTP_DATA_UNORDERED) { 7551 chk->rec.data.mid = strq->next_mid_unordered; 7552 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7553 strq->next_mid_unordered++; 7554 } 7555 } else { 7556 chk->rec.data.mid = strq->next_mid_ordered; 7557 if (rcv_flags & SCTP_DATA_LAST_FRAG) { 7558 strq->next_mid_ordered++; 7559 } 7560 } 7561 } 7562 chk->rec.data.sid = sp->sid; 7563 chk->rec.data.ppid = sp->ppid; 7564 chk->rec.data.context = sp->context; 7565 chk->rec.data.doing_fast_retransmit = 0; 7566 7567 chk->rec.data.timetodrop = sp->ts; 7568 chk->flags = sp->act_flags; 7569 7570 if (sp->net) { 7571 chk->whoTo = sp->net; 7572 atomic_add_int(&chk->whoTo->ref_count, 1); 7573 } else 7574 chk->whoTo = NULL; 7575 7576 if (sp->holds_key_ref) { 7577 chk->auth_keyid = sp->auth_keyid; 7578 sctp_auth_key_acquire(stcb, chk->auth_keyid); 7579 chk->holds_key_ref = 1; 7580 } 7581 chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1); 7582 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) { 7583 sctp_misc_ints(SCTP_STRMOUT_LOG_SEND, 7584 (uint32_t)(uintptr_t)stcb, sp->length, 7585 (uint32_t)((chk->rec.data.sid << 16) | (0x0000ffff & chk->rec.data.mid)), 7586 chk->rec.data.tsn); 7587 } 7588 if (stcb->asoc.idata_supported == 0) { 7589 dchkh = mtod(chk->data, struct sctp_data_chunk *); 7590 } else { 7591 ndchkh = mtod(chk->data, struct sctp_idata_chunk *); 7592 } 7593 /* 7594 * Put the rest of the things in place now. Size was done earlier in 7595 * previous loop prior to padding. 7596 */ 7597 7598#ifdef SCTP_ASOCLOG_OF_TSNS 7599 SCTP_TCB_LOCK_ASSERT(stcb); 7600 if (asoc->tsn_out_at >= SCTP_TSN_LOG_SIZE) { 7601 asoc->tsn_out_at = 0; 7602 asoc->tsn_out_wrapped = 1; 7603 } 7604 asoc->out_tsnlog[asoc->tsn_out_at].tsn = chk->rec.data.tsn; 7605 asoc->out_tsnlog[asoc->tsn_out_at].strm = chk->rec.data.sid; 7606 asoc->out_tsnlog[asoc->tsn_out_at].seq = chk->rec.data.mid; 7607 asoc->out_tsnlog[asoc->tsn_out_at].sz = chk->send_size; 7608 asoc->out_tsnlog[asoc->tsn_out_at].flgs = chk->rec.data.rcv_flags; 7609 asoc->out_tsnlog[asoc->tsn_out_at].stcb = (void *)stcb; 7610 asoc->out_tsnlog[asoc->tsn_out_at].in_pos = asoc->tsn_out_at; 7611 asoc->out_tsnlog[asoc->tsn_out_at].in_out = 2; 7612 asoc->tsn_out_at++; 7613#endif 7614 if (stcb->asoc.idata_supported == 0) { 7615 dchkh->ch.chunk_type = SCTP_DATA; 7616 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7617 dchkh->dp.tsn = htonl(chk->rec.data.tsn); 7618 dchkh->dp.sid = htons(strq->sid); 7619 dchkh->dp.ssn = htons((uint16_t)chk->rec.data.mid); 7620 dchkh->dp.ppid = chk->rec.data.ppid; 7621 dchkh->ch.chunk_length = htons(chk->send_size); 7622 } else { 7623 ndchkh->ch.chunk_type = SCTP_IDATA; 7624 ndchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 7625 ndchkh->dp.tsn = htonl(chk->rec.data.tsn); 7626 ndchkh->dp.sid = htons(strq->sid); 7627 ndchkh->dp.reserved = htons(0); 7628 ndchkh->dp.mid = htonl(chk->rec.data.mid); 7629 if (sp->fsn == 0) 7630 ndchkh->dp.ppid_fsn.ppid = chk->rec.data.ppid; 7631 else 7632 ndchkh->dp.ppid_fsn.fsn = htonl(sp->fsn); 7633 sp->fsn++; 7634 ndchkh->ch.chunk_length = htons(chk->send_size); 7635 } 7636 /* Now advance the chk->send_size by the actual pad needed. */ 7637 if (chk->send_size < SCTP_SIZE32(chk->book_size)) { 7638 /* need a pad */ 7639 struct mbuf *lm; 7640 int pads; 7641 7642 pads = SCTP_SIZE32(chk->book_size) - chk->send_size; 7643 lm = sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf); 7644 if (lm != NULL) { 7645 chk->last_mbuf = lm; 7646 chk->pad_inplace = 1; 7647 } 7648 chk->send_size += pads; 7649 } 7650 if (PR_SCTP_ENABLED(chk->flags)) { 7651 asoc->pr_sctp_cnt++; 7652 } 7653 if (sp->msg_is_complete && (sp->length == 0) && (sp->sender_all_done)) { 7654 /* All done pull and kill the message */ 7655 if (sp->put_last_out == 0) { 7656 SCTP_PRINTF("Gak, put out entire msg with NO end!-2\n"); 7657 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n", 7658 sp->sender_all_done, 7659 sp->length, 7660 sp->msg_is_complete, 7661 sp->put_last_out, 7662 send_lock_up); 7663 } 7664 if ((send_lock_up == 0) && (TAILQ_NEXT(sp, next) == NULL)) { 7665 SCTP_TCB_SEND_LOCK(stcb); 7666 send_lock_up = 1; 7667 } 7668 atomic_subtract_int(&asoc->stream_queue_cnt, 1); 7669 TAILQ_REMOVE(&strq->outqueue, sp, next); 7670 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, strq, sp, send_lock_up); 7671 if ((strq->state == SCTP_STREAM_RESET_PENDING) && 7672 (strq->chunks_on_queues == 0) && 7673 TAILQ_EMPTY(&strq->outqueue)) { 7674 stcb->asoc.trigger_reset = 1; 7675 } 7676 if (sp->net) { 7677 sctp_free_remote_addr(sp->net); 7678 sp->net = NULL; 7679 } 7680 if (sp->data) { 7681 sctp_m_freem(sp->data); 7682 sp->data = NULL; 7683 } 7684 sctp_free_a_strmoq(stcb, sp, so_locked); 7685 } 7686 asoc->chunks_on_out_queue++; 7687 strq->chunks_on_queues++; 7688 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 7689 asoc->send_queue_cnt++; 7690out_of: 7691 if (send_lock_up) { 7692 SCTP_TCB_SEND_UNLOCK(stcb); 7693 } 7694 return (to_move); 7695} 7696 7697 7698static void 7699sctp_fill_outqueue(struct sctp_tcb *stcb, 7700 struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked 7701#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7702 SCTP_UNUSED 7703#endif 7704) 7705{ 7706 struct sctp_association *asoc; 7707 struct sctp_stream_out *strq; 7708 uint32_t space_left, moved, total_moved; 7709 int bail, giveup; 7710 7711 SCTP_TCB_LOCK_ASSERT(stcb); 7712 asoc = &stcb->asoc; 7713 total_moved = 0; 7714 switch (net->ro._l_addr.sa.sa_family) { 7715#ifdef INET 7716 case AF_INET: 7717 space_left = net->mtu - SCTP_MIN_V4_OVERHEAD; 7718 break; 7719#endif 7720#ifdef INET6 7721 case AF_INET6: 7722 space_left = net->mtu - SCTP_MIN_OVERHEAD; 7723 break; 7724#endif 7725 default: 7726 /* TSNH */ 7727 space_left = net->mtu; 7728 break; 7729 } 7730 /* Need an allowance for the data chunk header too */ 7731 if (stcb->asoc.idata_supported == 0) { 7732 space_left -= sizeof(struct sctp_data_chunk); 7733 } else { 7734 space_left -= sizeof(struct sctp_idata_chunk); 7735 } 7736 7737 /* must make even word boundary */ 7738 space_left &= 0xfffffffc; 7739 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7740 giveup = 0; 7741 bail = 0; 7742 while ((space_left > 0) && (strq != NULL)) { 7743 moved = sctp_move_to_outqueue(stcb, strq, space_left, frag_point, 7744 &giveup, eeor_mode, &bail, so_locked); 7745 stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved); 7746 if ((giveup != 0) || (bail != 0)) { 7747 break; 7748 } 7749 strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc); 7750 total_moved += moved; 7751 space_left -= moved; 7752 if (stcb->asoc.idata_supported == 0) { 7753 if (space_left >= sizeof(struct sctp_data_chunk)) { 7754 space_left -= sizeof(struct sctp_data_chunk); 7755 } else { 7756 space_left = 0; 7757 } 7758 } else { 7759 if (space_left >= sizeof(struct sctp_idata_chunk)) { 7760 space_left -= sizeof(struct sctp_idata_chunk); 7761 } else { 7762 space_left = 0; 7763 } 7764 } 7765 space_left &= 0xfffffffc; 7766 } 7767 if (bail != 0) 7768 *quit_now = 1; 7769 7770 stcb->asoc.ss_functions.sctp_ss_packet_done(stcb, net, asoc); 7771 7772 if (total_moved == 0) { 7773 if ((stcb->asoc.sctp_cmt_on_off == 0) && 7774 (net == stcb->asoc.primary_destination)) { 7775 /* ran dry for primary network net */ 7776 SCTP_STAT_INCR(sctps_primary_randry); 7777 } else if (stcb->asoc.sctp_cmt_on_off > 0) { 7778 /* ran dry with CMT on */ 7779 SCTP_STAT_INCR(sctps_cmt_randry); 7780 } 7781 } 7782} 7783 7784void 7785sctp_fix_ecn_echo(struct sctp_association *asoc) 7786{ 7787 struct sctp_tmit_chunk *chk; 7788 7789 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7790 if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 7791 chk->sent = SCTP_DATAGRAM_UNSENT; 7792 } 7793 } 7794} 7795 7796void 7797sctp_move_chunks_from_net(struct sctp_tcb *stcb, struct sctp_nets *net) 7798{ 7799 struct sctp_association *asoc; 7800 struct sctp_tmit_chunk *chk; 7801 struct sctp_stream_queue_pending *sp; 7802 unsigned int i; 7803 7804 if (net == NULL) { 7805 return; 7806 } 7807 asoc = &stcb->asoc; 7808 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 7809 TAILQ_FOREACH(sp, &stcb->asoc.strmout[i].outqueue, next) { 7810 if (sp->net == net) { 7811 sctp_free_remote_addr(sp->net); 7812 sp->net = NULL; 7813 } 7814 } 7815 } 7816 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7817 if (chk->whoTo == net) { 7818 sctp_free_remote_addr(chk->whoTo); 7819 chk->whoTo = NULL; 7820 } 7821 } 7822} 7823 7824int 7825sctp_med_chunk_output(struct sctp_inpcb *inp, 7826 struct sctp_tcb *stcb, 7827 struct sctp_association *asoc, 7828 int *num_out, 7829 int *reason_code, 7830 int control_only, int from_where, 7831 struct timeval *now, int *now_filled, int frag_point, int so_locked 7832#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 7833 SCTP_UNUSED 7834#endif 7835) 7836{ 7837 /** 7838 * Ok this is the generic chunk service queue. we must do the 7839 * following: 7840 * - Service the stream queue that is next, moving any 7841 * message (note I must get a complete message i.e. FIRST/MIDDLE and 7842 * LAST to the out queue in one pass) and assigning TSN's. This 7843 * only applys though if the peer does not support NDATA. For NDATA 7844 * chunks its ok to not send the entire message ;-) 7845 * - Check to see if the cwnd/rwnd allows any output, if so we go ahead and 7846 * fomulate and send the low level chunks. Making sure to combine 7847 * any control in the control chunk queue also. 7848 */ 7849 struct sctp_nets *net, *start_at, *sack_goes_to = NULL, *old_start_at = NULL; 7850 struct mbuf *outchain, *endoutchain; 7851 struct sctp_tmit_chunk *chk, *nchk; 7852 7853 /* temp arrays for unlinking */ 7854 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 7855 int no_fragmentflg, error; 7856 unsigned int max_rwnd_per_dest, max_send_per_dest; 7857 int one_chunk, hbflag, skip_data_for_this_net; 7858 int asconf, cookie, no_out_cnt; 7859 int bundle_at, ctl_cnt, no_data_chunks, eeor_mode; 7860 unsigned int mtu, r_mtu, omtu, mx_mtu, to_out; 7861 int tsns_sent = 0; 7862 uint32_t auth_offset = 0; 7863 struct sctp_auth_chunk *auth = NULL; 7864 uint16_t auth_keyid; 7865 int override_ok = 1; 7866 int skip_fill_up = 0; 7867 int data_auth_reqd = 0; 7868 7869 /* 7870 * JRS 5/14/07 - Add flag for whether a heartbeat is sent to the 7871 * destination. 7872 */ 7873 int quit_now = 0; 7874 7875 *num_out = 0; 7876 *reason_code = 0; 7877 auth_keyid = stcb->asoc.authinfo.active_keyid; 7878 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) || 7879 (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED) || 7880 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) { 7881 eeor_mode = 1; 7882 } else { 7883 eeor_mode = 0; 7884 } 7885 ctl_cnt = no_out_cnt = asconf = cookie = 0; 7886 /* 7887 * First lets prime the pump. For each destination, if there is room 7888 * in the flight size, attempt to pull an MTU's worth out of the 7889 * stream queues into the general send_queue 7890 */ 7891#ifdef SCTP_AUDITING_ENABLED 7892 sctp_audit_log(0xC2, 2); 7893#endif 7894 SCTP_TCB_LOCK_ASSERT(stcb); 7895 hbflag = 0; 7896 if (control_only) 7897 no_data_chunks = 1; 7898 else 7899 no_data_chunks = 0; 7900 7901 /* Nothing to possible to send? */ 7902 if ((TAILQ_EMPTY(&asoc->control_send_queue) || 7903 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) && 7904 TAILQ_EMPTY(&asoc->asconf_send_queue) && 7905 TAILQ_EMPTY(&asoc->send_queue) && 7906 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 7907nothing_to_send: 7908 *reason_code = 9; 7909 return (0); 7910 } 7911 if (asoc->peers_rwnd == 0) { 7912 /* No room in peers rwnd */ 7913 *reason_code = 1; 7914 if (asoc->total_flight > 0) { 7915 /* we are allowed one chunk in flight */ 7916 no_data_chunks = 1; 7917 } 7918 } 7919 if (stcb->asoc.ecn_echo_cnt_onq) { 7920 /* Record where a sack goes, if any */ 7921 if (no_data_chunks && 7922 (asoc->ctrl_queue_cnt == stcb->asoc.ecn_echo_cnt_onq)) { 7923 /* Nothing but ECNe to send - we don't do that */ 7924 goto nothing_to_send; 7925 } 7926 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7927 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 7928 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 7929 sack_goes_to = chk->whoTo; 7930 break; 7931 } 7932 } 7933 } 7934 max_rwnd_per_dest = ((asoc->peers_rwnd + asoc->total_flight) / asoc->numnets); 7935 if (stcb->sctp_socket) 7936 max_send_per_dest = SCTP_SB_LIMIT_SND(stcb->sctp_socket) / asoc->numnets; 7937 else 7938 max_send_per_dest = 0; 7939 if (no_data_chunks == 0) { 7940 /* How many non-directed chunks are there? */ 7941 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 7942 if (chk->whoTo == NULL) { 7943 /* 7944 * We already have non-directed chunks on 7945 * the queue, no need to do a fill-up. 7946 */ 7947 skip_fill_up = 1; 7948 break; 7949 } 7950 } 7951 7952 } 7953 if ((no_data_chunks == 0) && 7954 (skip_fill_up == 0) && 7955 (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc))) { 7956 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 7957 /* 7958 * This for loop we are in takes in each net, if 7959 * its's got space in cwnd and has data sent to it 7960 * (when CMT is off) then it calls 7961 * sctp_fill_outqueue for the net. This gets data on 7962 * the send queue for that network. 7963 * 7964 * In sctp_fill_outqueue TSN's are assigned and data 7965 * is copied out of the stream buffers. Note mostly 7966 * copy by reference (we hope). 7967 */ 7968 net->window_probe = 0; 7969 if ((net != stcb->asoc.alternate) && 7970 ((net->dest_state & SCTP_ADDR_PF) || 7971 (!(net->dest_state & SCTP_ADDR_REACHABLE)) || 7972 (net->dest_state & SCTP_ADDR_UNCONFIRMED))) { 7973 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7974 sctp_log_cwnd(stcb, net, 1, 7975 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7976 } 7977 continue; 7978 } 7979 if ((stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) && 7980 (net->flight_size == 0)) { 7981 (*stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) (stcb, net); 7982 } 7983 if (net->flight_size >= net->cwnd) { 7984 /* skip this network, no room - can't fill */ 7985 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7986 sctp_log_cwnd(stcb, net, 3, 7987 SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7988 } 7989 continue; 7990 } 7991 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 7992 sctp_log_cwnd(stcb, net, 4, SCTP_CWND_LOG_FILL_OUTQ_CALLED); 7993 } 7994 sctp_fill_outqueue(stcb, net, frag_point, eeor_mode, &quit_now, so_locked); 7995 if (quit_now) { 7996 /* memory alloc failure */ 7997 no_data_chunks = 1; 7998 break; 7999 } 8000 } 8001 } 8002 /* now service each destination and send out what we can for it */ 8003 /* Nothing to send? */ 8004 if (TAILQ_EMPTY(&asoc->control_send_queue) && 8005 TAILQ_EMPTY(&asoc->asconf_send_queue) && 8006 TAILQ_EMPTY(&asoc->send_queue)) { 8007 *reason_code = 8; 8008 return (0); 8009 } 8010 if (asoc->sctp_cmt_on_off > 0) { 8011 /* get the last start point */ 8012 start_at = asoc->last_net_cmt_send_started; 8013 if (start_at == NULL) { 8014 /* null so to beginning */ 8015 start_at = TAILQ_FIRST(&asoc->nets); 8016 } else { 8017 start_at = TAILQ_NEXT(asoc->last_net_cmt_send_started, sctp_next); 8018 if (start_at == NULL) { 8019 start_at = TAILQ_FIRST(&asoc->nets); 8020 } 8021 } 8022 asoc->last_net_cmt_send_started = start_at; 8023 } else { 8024 start_at = TAILQ_FIRST(&asoc->nets); 8025 } 8026 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 8027 if (chk->whoTo == NULL) { 8028 if (asoc->alternate) { 8029 chk->whoTo = asoc->alternate; 8030 } else { 8031 chk->whoTo = asoc->primary_destination; 8032 } 8033 atomic_add_int(&chk->whoTo->ref_count, 1); 8034 } 8035 } 8036 old_start_at = NULL; 8037again_one_more_time: 8038 for (net = start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) { 8039 /* how much can we send? */ 8040 /* SCTPDBG("Examine for sending net:%x\n", (uint32_t)net); */ 8041 if (old_start_at && (old_start_at == net)) { 8042 /* through list ocmpletely. */ 8043 break; 8044 } 8045 tsns_sent = 0xa; 8046 if (TAILQ_EMPTY(&asoc->control_send_queue) && 8047 TAILQ_EMPTY(&asoc->asconf_send_queue) && 8048 (net->flight_size >= net->cwnd)) { 8049 /* 8050 * Nothing on control or asconf and flight is full, 8051 * we can skip even in the CMT case. 8052 */ 8053 continue; 8054 } 8055 bundle_at = 0; 8056 endoutchain = outchain = NULL; 8057 no_fragmentflg = 1; 8058 one_chunk = 0; 8059 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 8060 skip_data_for_this_net = 1; 8061 } else { 8062 skip_data_for_this_net = 0; 8063 } 8064 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8065#ifdef INET 8066 case AF_INET: 8067 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8068 break; 8069#endif 8070#ifdef INET6 8071 case AF_INET6: 8072 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8073 break; 8074#endif 8075 default: 8076 /* TSNH */ 8077 mtu = net->mtu; 8078 break; 8079 } 8080 mx_mtu = mtu; 8081 to_out = 0; 8082 if (mtu > asoc->peers_rwnd) { 8083 if (asoc->total_flight > 0) { 8084 /* We have a packet in flight somewhere */ 8085 r_mtu = asoc->peers_rwnd; 8086 } else { 8087 /* We are always allowed to send one MTU out */ 8088 one_chunk = 1; 8089 r_mtu = mtu; 8090 } 8091 } else { 8092 r_mtu = mtu; 8093 } 8094 error = 0; 8095 /************************/ 8096 /* ASCONF transmission */ 8097 /************************/ 8098 /* Now first lets go through the asconf queue */ 8099 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) { 8100 if (chk->rec.chunk_id.id != SCTP_ASCONF) { 8101 continue; 8102 } 8103 if (chk->whoTo == NULL) { 8104 if (asoc->alternate == NULL) { 8105 if (asoc->primary_destination != net) { 8106 break; 8107 } 8108 } else { 8109 if (asoc->alternate != net) { 8110 break; 8111 } 8112 } 8113 } else { 8114 if (chk->whoTo != net) { 8115 break; 8116 } 8117 } 8118 if (chk->data == NULL) { 8119 break; 8120 } 8121 if (chk->sent != SCTP_DATAGRAM_UNSENT && 8122 chk->sent != SCTP_DATAGRAM_RESEND) { 8123 break; 8124 } 8125 /* 8126 * if no AUTH is yet included and this chunk 8127 * requires it, make sure to account for it. We 8128 * don't apply the size until the AUTH chunk is 8129 * actually added below in case there is no room for 8130 * this chunk. NOTE: we overload the use of "omtu" 8131 * here 8132 */ 8133 if ((auth == NULL) && 8134 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8135 stcb->asoc.peer_auth_chunks)) { 8136 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8137 } else 8138 omtu = 0; 8139 /* Here we do NOT factor the r_mtu */ 8140 if ((chk->send_size < (int)(mtu - omtu)) || 8141 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8142 /* 8143 * We probably should glom the mbuf chain 8144 * from the chk->data for control but the 8145 * problem is it becomes yet one more level 8146 * of tracking to do if for some reason 8147 * output fails. Then I have got to 8148 * reconstruct the merged control chain.. el 8149 * yucko.. for now we take the easy way and 8150 * do the copy 8151 */ 8152 /* 8153 * Add an AUTH chunk, if chunk requires it 8154 * save the offset into the chain for AUTH 8155 */ 8156 if ((auth == NULL) && 8157 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8158 stcb->asoc.peer_auth_chunks))) { 8159 outchain = sctp_add_auth_chunk(outchain, 8160 &endoutchain, 8161 &auth, 8162 &auth_offset, 8163 stcb, 8164 chk->rec.chunk_id.id); 8165 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8166 } 8167 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8168 (int)chk->rec.chunk_id.can_take_data, 8169 chk->send_size, chk->copy_by_ref); 8170 if (outchain == NULL) { 8171 *reason_code = 8; 8172 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8173 return (ENOMEM); 8174 } 8175 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8176 /* update our MTU size */ 8177 if (mtu > (chk->send_size + omtu)) 8178 mtu -= (chk->send_size + omtu); 8179 else 8180 mtu = 0; 8181 to_out += (chk->send_size + omtu); 8182 /* Do clear IP_DF ? */ 8183 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8184 no_fragmentflg = 0; 8185 } 8186 if (chk->rec.chunk_id.can_take_data) 8187 chk->data = NULL; 8188 /* 8189 * set hb flag since we can use these for 8190 * RTO 8191 */ 8192 hbflag = 1; 8193 asconf = 1; 8194 /* 8195 * should sysctl this: don't bundle data 8196 * with ASCONF since it requires AUTH 8197 */ 8198 no_data_chunks = 1; 8199 chk->sent = SCTP_DATAGRAM_SENT; 8200 if (chk->whoTo == NULL) { 8201 chk->whoTo = net; 8202 atomic_add_int(&net->ref_count, 1); 8203 } 8204 chk->snd_count++; 8205 if (mtu == 0) { 8206 /* 8207 * Ok we are out of room but we can 8208 * output without effecting the 8209 * flight size since this little guy 8210 * is a control only packet. 8211 */ 8212 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8213 /* 8214 * do NOT clear the asconf flag as 8215 * it is used to do appropriate 8216 * source address selection. 8217 */ 8218 if (*now_filled == 0) { 8219 (void)SCTP_GETTIME_TIMEVAL(now); 8220 *now_filled = 1; 8221 } 8222 net->last_sent_time = *now; 8223 hbflag = 0; 8224 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8225 (struct sockaddr *)&net->ro._l_addr, 8226 outchain, auth_offset, auth, 8227 stcb->asoc.authinfo.active_keyid, 8228 no_fragmentflg, 0, asconf, 8229 inp->sctp_lport, stcb->rport, 8230 htonl(stcb->asoc.peer_vtag), 8231 net->port, NULL, 8232 0, 0, 8233 so_locked))) { 8234 /* 8235 * error, we could not 8236 * output 8237 */ 8238 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8239 if (from_where == 0) { 8240 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8241 } 8242 if (error == ENOBUFS) { 8243 asoc->ifp_had_enobuf = 1; 8244 SCTP_STAT_INCR(sctps_lowlevelerr); 8245 } 8246 /* error, could not output */ 8247 if (error == EHOSTUNREACH) { 8248 /* 8249 * Destination went 8250 * unreachable 8251 * during this send 8252 */ 8253 sctp_move_chunks_from_net(stcb, net); 8254 } 8255 *reason_code = 7; 8256 break; 8257 } else { 8258 asoc->ifp_had_enobuf = 0; 8259 } 8260 /* 8261 * increase the number we sent, if a 8262 * cookie is sent we don't tell them 8263 * any was sent out. 8264 */ 8265 outchain = endoutchain = NULL; 8266 auth = NULL; 8267 auth_offset = 0; 8268 if (!no_out_cnt) 8269 *num_out += ctl_cnt; 8270 /* recalc a clean slate and setup */ 8271 switch (net->ro._l_addr.sa.sa_family) { 8272#ifdef INET 8273 case AF_INET: 8274 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8275 break; 8276#endif 8277#ifdef INET6 8278 case AF_INET6: 8279 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8280 break; 8281#endif 8282 default: 8283 /* TSNH */ 8284 mtu = net->mtu; 8285 break; 8286 } 8287 to_out = 0; 8288 no_fragmentflg = 1; 8289 } 8290 } 8291 } 8292 if (error != 0) { 8293 /* try next net */ 8294 continue; 8295 } 8296 /************************/ 8297 /* Control transmission */ 8298 /************************/ 8299 /* Now first lets go through the control queue */ 8300 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) { 8301 if ((sack_goes_to) && 8302 (chk->rec.chunk_id.id == SCTP_ECN_ECHO) && 8303 (chk->whoTo != sack_goes_to)) { 8304 /* 8305 * if we have a sack in queue, and we are 8306 * looking at an ecn echo that is NOT queued 8307 * to where the sack is going.. 8308 */ 8309 if (chk->whoTo == net) { 8310 /* 8311 * Don't transmit it to where its 8312 * going (current net) 8313 */ 8314 continue; 8315 } else if (sack_goes_to == net) { 8316 /* 8317 * But do transmit it to this 8318 * address 8319 */ 8320 goto skip_net_check; 8321 } 8322 } 8323 if (chk->whoTo == NULL) { 8324 if (asoc->alternate == NULL) { 8325 if (asoc->primary_destination != net) { 8326 continue; 8327 } 8328 } else { 8329 if (asoc->alternate != net) { 8330 continue; 8331 } 8332 } 8333 } else { 8334 if (chk->whoTo != net) { 8335 continue; 8336 } 8337 } 8338 skip_net_check: 8339 if (chk->data == NULL) { 8340 continue; 8341 } 8342 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 8343 /* 8344 * It must be unsent. Cookies and ASCONF's 8345 * hang around but there timers will force 8346 * when marked for resend. 8347 */ 8348 continue; 8349 } 8350 /* 8351 * if no AUTH is yet included and this chunk 8352 * requires it, make sure to account for it. We 8353 * don't apply the size until the AUTH chunk is 8354 * actually added below in case there is no room for 8355 * this chunk. NOTE: we overload the use of "omtu" 8356 * here 8357 */ 8358 if ((auth == NULL) && 8359 sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8360 stcb->asoc.peer_auth_chunks)) { 8361 omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8362 } else 8363 omtu = 0; 8364 /* Here we do NOT factor the r_mtu */ 8365 if ((chk->send_size <= (int)(mtu - omtu)) || 8366 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 8367 /* 8368 * We probably should glom the mbuf chain 8369 * from the chk->data for control but the 8370 * problem is it becomes yet one more level 8371 * of tracking to do if for some reason 8372 * output fails. Then I have got to 8373 * reconstruct the merged control chain.. el 8374 * yucko.. for now we take the easy way and 8375 * do the copy 8376 */ 8377 /* 8378 * Add an AUTH chunk, if chunk requires it 8379 * save the offset into the chain for AUTH 8380 */ 8381 if ((auth == NULL) && 8382 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 8383 stcb->asoc.peer_auth_chunks))) { 8384 outchain = sctp_add_auth_chunk(outchain, 8385 &endoutchain, 8386 &auth, 8387 &auth_offset, 8388 stcb, 8389 chk->rec.chunk_id.id); 8390 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8391 } 8392 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 8393 (int)chk->rec.chunk_id.can_take_data, 8394 chk->send_size, chk->copy_by_ref); 8395 if (outchain == NULL) { 8396 *reason_code = 8; 8397 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8398 return (ENOMEM); 8399 } 8400 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8401 /* update our MTU size */ 8402 if (mtu > (chk->send_size + omtu)) 8403 mtu -= (chk->send_size + omtu); 8404 else 8405 mtu = 0; 8406 to_out += (chk->send_size + omtu); 8407 /* Do clear IP_DF ? */ 8408 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8409 no_fragmentflg = 0; 8410 } 8411 if (chk->rec.chunk_id.can_take_data) 8412 chk->data = NULL; 8413 /* Mark things to be removed, if needed */ 8414 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8415 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) || /* EY */ 8416 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) || 8417 (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) || 8418 (chk->rec.chunk_id.id == SCTP_SHUTDOWN) || 8419 (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) || 8420 (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) || 8421 (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) || 8422 (chk->rec.chunk_id.id == SCTP_ECN_CWR) || 8423 (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) || 8424 (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) { 8425 if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) { 8426 hbflag = 1; 8427 } 8428 /* remove these chunks at the end */ 8429 if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) || 8430 (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) { 8431 /* turn off the timer */ 8432 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 8433 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 8434 inp, stcb, net, 8435 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1); 8436 } 8437 } 8438 ctl_cnt++; 8439 } else { 8440 /* 8441 * Other chunks, since they have 8442 * timers running (i.e. COOKIE) we 8443 * just "trust" that it gets sent or 8444 * retransmitted. 8445 */ 8446 ctl_cnt++; 8447 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 8448 cookie = 1; 8449 no_out_cnt = 1; 8450 } else if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) { 8451 /* 8452 * Increment ecne send count 8453 * here this means we may be 8454 * over-zealous in our 8455 * counting if the send 8456 * fails, but its the best 8457 * place to do it (we used 8458 * to do it in the queue of 8459 * the chunk, but that did 8460 * not tell how many times 8461 * it was sent. 8462 */ 8463 SCTP_STAT_INCR(sctps_sendecne); 8464 } 8465 chk->sent = SCTP_DATAGRAM_SENT; 8466 if (chk->whoTo == NULL) { 8467 chk->whoTo = net; 8468 atomic_add_int(&net->ref_count, 1); 8469 } 8470 chk->snd_count++; 8471 } 8472 if (mtu == 0) { 8473 /* 8474 * Ok we are out of room but we can 8475 * output without effecting the 8476 * flight size since this little guy 8477 * is a control only packet. 8478 */ 8479 if (asconf) { 8480 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 8481 /* 8482 * do NOT clear the asconf 8483 * flag as it is used to do 8484 * appropriate source 8485 * address selection. 8486 */ 8487 } 8488 if (cookie) { 8489 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8490 cookie = 0; 8491 } 8492 /* Only HB or ASCONF advances time */ 8493 if (hbflag) { 8494 if (*now_filled == 0) { 8495 (void)SCTP_GETTIME_TIMEVAL(now); 8496 *now_filled = 1; 8497 } 8498 net->last_sent_time = *now; 8499 hbflag = 0; 8500 } 8501 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 8502 (struct sockaddr *)&net->ro._l_addr, 8503 outchain, 8504 auth_offset, auth, 8505 stcb->asoc.authinfo.active_keyid, 8506 no_fragmentflg, 0, asconf, 8507 inp->sctp_lport, stcb->rport, 8508 htonl(stcb->asoc.peer_vtag), 8509 net->port, NULL, 8510 0, 0, 8511 so_locked))) { 8512 /* 8513 * error, we could not 8514 * output 8515 */ 8516 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8517 if (from_where == 0) { 8518 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8519 } 8520 if (error == ENOBUFS) { 8521 asoc->ifp_had_enobuf = 1; 8522 SCTP_STAT_INCR(sctps_lowlevelerr); 8523 } 8524 if (error == EHOSTUNREACH) { 8525 /* 8526 * Destination went 8527 * unreachable 8528 * during this send 8529 */ 8530 sctp_move_chunks_from_net(stcb, net); 8531 } 8532 *reason_code = 7; 8533 break; 8534 } else { 8535 asoc->ifp_had_enobuf = 0; 8536 } 8537 /* 8538 * increase the number we sent, if a 8539 * cookie is sent we don't tell them 8540 * any was sent out. 8541 */ 8542 outchain = endoutchain = NULL; 8543 auth = NULL; 8544 auth_offset = 0; 8545 if (!no_out_cnt) 8546 *num_out += ctl_cnt; 8547 /* recalc a clean slate and setup */ 8548 switch (net->ro._l_addr.sa.sa_family) { 8549#ifdef INET 8550 case AF_INET: 8551 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8552 break; 8553#endif 8554#ifdef INET6 8555 case AF_INET6: 8556 mtu = net->mtu - SCTP_MIN_OVERHEAD; 8557 break; 8558#endif 8559 default: 8560 /* TSNH */ 8561 mtu = net->mtu; 8562 break; 8563 } 8564 to_out = 0; 8565 no_fragmentflg = 1; 8566 } 8567 } 8568 } 8569 if (error != 0) { 8570 /* try next net */ 8571 continue; 8572 } 8573 /* JRI: if dest is in PF state, do not send data to it */ 8574 if ((asoc->sctp_cmt_on_off > 0) && 8575 (net != stcb->asoc.alternate) && 8576 (net->dest_state & SCTP_ADDR_PF)) { 8577 goto no_data_fill; 8578 } 8579 if (net->flight_size >= net->cwnd) { 8580 goto no_data_fill; 8581 } 8582 if ((asoc->sctp_cmt_on_off > 0) && 8583 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_RECV_BUFFER_SPLITTING) && 8584 (net->flight_size > max_rwnd_per_dest)) { 8585 goto no_data_fill; 8586 } 8587 /* 8588 * We need a specific accounting for the usage of the send 8589 * buffer. We also need to check the number of messages per 8590 * net. For now, this is better than nothing and it disabled 8591 * by default... 8592 */ 8593 if ((asoc->sctp_cmt_on_off > 0) && 8594 (SCTP_BASE_SYSCTL(sctp_buffer_splitting) & SCTP_SEND_BUFFER_SPLITTING) && 8595 (max_send_per_dest > 0) && 8596 (net->flight_size > max_send_per_dest)) { 8597 goto no_data_fill; 8598 } 8599 /*********************/ 8600 /* Data transmission */ 8601 /*********************/ 8602 /* 8603 * if AUTH for DATA is required and no AUTH has been added 8604 * yet, account for this in the mtu now... if no data can be 8605 * bundled, this adjustment won't matter anyways since the 8606 * packet will be going out... 8607 */ 8608 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, 8609 stcb->asoc.peer_auth_chunks); 8610 if (data_auth_reqd && (auth == NULL)) { 8611 mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 8612 } 8613 /* now lets add any data within the MTU constraints */ 8614 switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) { 8615#ifdef INET 8616 case AF_INET: 8617 if (net->mtu > SCTP_MIN_V4_OVERHEAD) 8618 omtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 8619 else 8620 omtu = 0; 8621 break; 8622#endif 8623#ifdef INET6 8624 case AF_INET6: 8625 if (net->mtu > SCTP_MIN_OVERHEAD) 8626 omtu = net->mtu - SCTP_MIN_OVERHEAD; 8627 else 8628 omtu = 0; 8629 break; 8630#endif 8631 default: 8632 /* TSNH */ 8633 omtu = 0; 8634 break; 8635 } 8636 if ((((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) || 8637 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) && 8638 (skip_data_for_this_net == 0)) || 8639 (cookie)) { 8640 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) { 8641 if (no_data_chunks) { 8642 /* let only control go out */ 8643 *reason_code = 1; 8644 break; 8645 } 8646 if (net->flight_size >= net->cwnd) { 8647 /* skip this net, no room for data */ 8648 *reason_code = 2; 8649 break; 8650 } 8651 if ((chk->whoTo != NULL) && 8652 (chk->whoTo != net)) { 8653 /* Don't send the chunk on this net */ 8654 continue; 8655 } 8656 if (asoc->sctp_cmt_on_off == 0) { 8657 if ((asoc->alternate) && 8658 (asoc->alternate != net) && 8659 (chk->whoTo == NULL)) { 8660 continue; 8661 } else if ((net != asoc->primary_destination) && 8662 (asoc->alternate == NULL) && 8663 (chk->whoTo == NULL)) { 8664 continue; 8665 } 8666 } 8667 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 8668 /*- 8669 * strange, we have a chunk that is 8670 * to big for its destination and 8671 * yet no fragment ok flag. 8672 * Something went wrong when the 8673 * PMTU changed...we did not mark 8674 * this chunk for some reason?? I 8675 * will fix it here by letting IP 8676 * fragment it for now and printing 8677 * a warning. This really should not 8678 * happen ... 8679 */ 8680 SCTP_PRINTF("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 8681 chk->send_size, mtu); 8682 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 8683 } 8684 if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && 8685 ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) == SCTP_STATE_SHUTDOWN_PENDING)) { 8686 struct sctp_data_chunk *dchkh; 8687 8688 dchkh = mtod(chk->data, struct sctp_data_chunk *); 8689 dchkh->ch.chunk_flags |= SCTP_DATA_SACK_IMMEDIATELY; 8690 } 8691 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 8692 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 8693 /* ok we will add this one */ 8694 8695 /* 8696 * Add an AUTH chunk, if chunk 8697 * requires it, save the offset into 8698 * the chain for AUTH 8699 */ 8700 if (data_auth_reqd) { 8701 if (auth == NULL) { 8702 outchain = sctp_add_auth_chunk(outchain, 8703 &endoutchain, 8704 &auth, 8705 &auth_offset, 8706 stcb, 8707 SCTP_DATA); 8708 auth_keyid = chk->auth_keyid; 8709 override_ok = 0; 8710 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 8711 } else if (override_ok) { 8712 /* 8713 * use this data's 8714 * keyid 8715 */ 8716 auth_keyid = chk->auth_keyid; 8717 override_ok = 0; 8718 } else if (auth_keyid != chk->auth_keyid) { 8719 /* 8720 * different keyid, 8721 * so done bundling 8722 */ 8723 break; 8724 } 8725 } 8726 outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0, 8727 chk->send_size, chk->copy_by_ref); 8728 if (outchain == NULL) { 8729 SCTPDBG(SCTP_DEBUG_OUTPUT3, "No memory?\n"); 8730 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 8731 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8732 } 8733 *reason_code = 3; 8734 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 8735 return (ENOMEM); 8736 } 8737 /* upate our MTU size */ 8738 /* Do clear IP_DF ? */ 8739 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 8740 no_fragmentflg = 0; 8741 } 8742 /* unsigned subtraction of mtu */ 8743 if (mtu > chk->send_size) 8744 mtu -= chk->send_size; 8745 else 8746 mtu = 0; 8747 /* unsigned subtraction of r_mtu */ 8748 if (r_mtu > chk->send_size) 8749 r_mtu -= chk->send_size; 8750 else 8751 r_mtu = 0; 8752 8753 to_out += chk->send_size; 8754 if ((to_out > mx_mtu) && no_fragmentflg) { 8755#ifdef INVARIANTS 8756 panic("Exceeding mtu of %d out size is %d", mx_mtu, to_out); 8757#else 8758 SCTP_PRINTF("Exceeding mtu of %d out size is %d\n", 8759 mx_mtu, to_out); 8760#endif 8761 } 8762 chk->window_probe = 0; 8763 data_list[bundle_at++] = chk; 8764 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 8765 break; 8766 } 8767 if (chk->sent == SCTP_DATAGRAM_UNSENT) { 8768 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 8769 SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks); 8770 } else { 8771 SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks); 8772 } 8773 if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) && 8774 ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0)) 8775 /* 8776 * Count number of 8777 * user msg's that 8778 * were fragmented 8779 * we do this by 8780 * counting when we 8781 * see a LAST 8782 * fragment only. 8783 */ 8784 SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs); 8785 } 8786 if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) { 8787 if ((one_chunk) && (stcb->asoc.total_flight == 0)) { 8788 data_list[0]->window_probe = 1; 8789 net->window_probe = 1; 8790 } 8791 break; 8792 } 8793 } else { 8794 /* 8795 * Must be sent in order of the 8796 * TSN's (on a network) 8797 */ 8798 break; 8799 } 8800 } /* for (chunk gather loop for this net) */ 8801 } /* if asoc.state OPEN */ 8802no_data_fill: 8803 /* Is there something to send for this destination? */ 8804 if (outchain) { 8805 /* We may need to start a control timer or two */ 8806 if (asconf) { 8807 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, 8808 stcb, net); 8809 /* 8810 * do NOT clear the asconf flag as it is 8811 * used to do appropriate source address 8812 * selection. 8813 */ 8814 } 8815 if (cookie) { 8816 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 8817 cookie = 0; 8818 } 8819 /* must start a send timer if data is being sent */ 8820 if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) { 8821 /* 8822 * no timer running on this destination 8823 * restart it. 8824 */ 8825 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 8826 } 8827 if (bundle_at || hbflag) { 8828 /* For data/asconf and hb set time */ 8829 if (*now_filled == 0) { 8830 (void)SCTP_GETTIME_TIMEVAL(now); 8831 *now_filled = 1; 8832 } 8833 net->last_sent_time = *now; 8834 } 8835 /* Now send it, if there is anything to send :> */ 8836 if ((error = sctp_lowlevel_chunk_output(inp, 8837 stcb, 8838 net, 8839 (struct sockaddr *)&net->ro._l_addr, 8840 outchain, 8841 auth_offset, 8842 auth, 8843 auth_keyid, 8844 no_fragmentflg, 8845 bundle_at, 8846 asconf, 8847 inp->sctp_lport, stcb->rport, 8848 htonl(stcb->asoc.peer_vtag), 8849 net->port, NULL, 8850 0, 0, 8851 so_locked))) { 8852 /* error, we could not output */ 8853 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 8854 if (from_where == 0) { 8855 SCTP_STAT_INCR(sctps_lowlevelerrusr); 8856 } 8857 if (error == ENOBUFS) { 8858 asoc->ifp_had_enobuf = 1; 8859 SCTP_STAT_INCR(sctps_lowlevelerr); 8860 } 8861 if (error == EHOSTUNREACH) { 8862 /* 8863 * Destination went unreachable 8864 * during this send 8865 */ 8866 sctp_move_chunks_from_net(stcb, net); 8867 } 8868 *reason_code = 6; 8869 /*- 8870 * I add this line to be paranoid. As far as 8871 * I can tell the continue, takes us back to 8872 * the top of the for, but just to make sure 8873 * I will reset these again here. 8874 */ 8875 ctl_cnt = bundle_at = 0; 8876 continue; /* This takes us back to the 8877 * for() for the nets. */ 8878 } else { 8879 asoc->ifp_had_enobuf = 0; 8880 } 8881 endoutchain = NULL; 8882 auth = NULL; 8883 auth_offset = 0; 8884 if (!no_out_cnt) { 8885 *num_out += (ctl_cnt + bundle_at); 8886 } 8887 if (bundle_at) { 8888 /* setup for a RTO measurement */ 8889 tsns_sent = data_list[0]->rec.data.tsn; 8890 /* fill time if not already filled */ 8891 if (*now_filled == 0) { 8892 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 8893 *now_filled = 1; 8894 *now = asoc->time_last_sent; 8895 } else { 8896 asoc->time_last_sent = *now; 8897 } 8898 if (net->rto_needed) { 8899 data_list[0]->do_rtt = 1; 8900 net->rto_needed = 0; 8901 } 8902 SCTP_STAT_INCR_BY(sctps_senddata, bundle_at); 8903 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 8904 } 8905 if (one_chunk) { 8906 break; 8907 } 8908 } 8909 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8910 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND); 8911 } 8912 } 8913 if (old_start_at == NULL) { 8914 old_start_at = start_at; 8915 start_at = TAILQ_FIRST(&asoc->nets); 8916 if (old_start_at) 8917 goto again_one_more_time; 8918 } 8919 /* 8920 * At the end there should be no NON timed chunks hanging on this 8921 * queue. 8922 */ 8923 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 8924 sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND); 8925 } 8926 if ((*num_out == 0) && (*reason_code == 0)) { 8927 *reason_code = 4; 8928 } else { 8929 *reason_code = 5; 8930 } 8931 sctp_clean_up_ctl(stcb, asoc, so_locked); 8932 return (0); 8933} 8934 8935void 8936sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 8937{ 8938 /*- 8939 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of 8940 * the control chunk queue. 8941 */ 8942 struct sctp_chunkhdr *hdr; 8943 struct sctp_tmit_chunk *chk; 8944 struct mbuf *mat, *last_mbuf; 8945 uint32_t chunk_length; 8946 uint16_t padding_length; 8947 8948 SCTP_TCB_LOCK_ASSERT(stcb); 8949 SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_NOWAIT); 8950 if (op_err == NULL) { 8951 return; 8952 } 8953 last_mbuf = NULL; 8954 chunk_length = 0; 8955 for (mat = op_err; mat != NULL; mat = SCTP_BUF_NEXT(mat)) { 8956 chunk_length += SCTP_BUF_LEN(mat); 8957 if (SCTP_BUF_NEXT(mat) == NULL) { 8958 last_mbuf = mat; 8959 } 8960 } 8961 if (chunk_length > SCTP_MAX_CHUNK_LENGTH) { 8962 sctp_m_freem(op_err); 8963 return; 8964 } 8965 padding_length = chunk_length % 4; 8966 if (padding_length != 0) { 8967 padding_length = 4 - padding_length; 8968 } 8969 if (padding_length != 0) { 8970 if (sctp_add_pad_tombuf(last_mbuf, padding_length) == NULL) { 8971 sctp_m_freem(op_err); 8972 return; 8973 } 8974 } 8975 sctp_alloc_a_chunk(stcb, chk); 8976 if (chk == NULL) { 8977 /* no memory */ 8978 sctp_m_freem(op_err); 8979 return; 8980 } 8981 chk->copy_by_ref = 0; 8982 chk->send_size = (uint16_t)chunk_length; 8983 chk->sent = SCTP_DATAGRAM_UNSENT; 8984 chk->snd_count = 0; 8985 chk->asoc = &stcb->asoc; 8986 chk->data = op_err; 8987 chk->whoTo = NULL; 8988 chk->rec.chunk_id.id = SCTP_OPERATION_ERROR; 8989 chk->rec.chunk_id.can_take_data = 0; 8990 hdr = mtod(op_err, struct sctp_chunkhdr *); 8991 hdr->chunk_type = SCTP_OPERATION_ERROR; 8992 hdr->chunk_flags = 0; 8993 hdr->chunk_length = htons(chk->send_size); 8994 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 8995 chk->asoc->ctrl_queue_cnt++; 8996} 8997 8998int 8999sctp_send_cookie_echo(struct mbuf *m, 9000 int offset, 9001 struct sctp_tcb *stcb, 9002 struct sctp_nets *net) 9003{ 9004 /*- 9005 * pull out the cookie and put it at the front of the control chunk 9006 * queue. 9007 */ 9008 int at; 9009 struct mbuf *cookie; 9010 struct sctp_paramhdr param, *phdr; 9011 struct sctp_chunkhdr *hdr; 9012 struct sctp_tmit_chunk *chk; 9013 uint16_t ptype, plen; 9014 9015 SCTP_TCB_LOCK_ASSERT(stcb); 9016 /* First find the cookie in the param area */ 9017 cookie = NULL; 9018 at = offset + sizeof(struct sctp_init_chunk); 9019 for (;;) { 9020 phdr = sctp_get_next_param(m, at, ¶m, sizeof(param)); 9021 if (phdr == NULL) { 9022 return (-3); 9023 } 9024 ptype = ntohs(phdr->param_type); 9025 plen = ntohs(phdr->param_length); 9026 if (ptype == SCTP_STATE_COOKIE) { 9027 int pad; 9028 9029 /* found the cookie */ 9030 if ((pad = (plen % 4))) { 9031 plen += 4 - pad; 9032 } 9033 cookie = SCTP_M_COPYM(m, at, plen, M_NOWAIT); 9034 if (cookie == NULL) { 9035 /* No memory */ 9036 return (-2); 9037 } 9038#ifdef SCTP_MBUF_LOGGING 9039 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9040 sctp_log_mbc(cookie, SCTP_MBUF_ICOPY); 9041 } 9042#endif 9043 break; 9044 } 9045 at += SCTP_SIZE32(plen); 9046 } 9047 /* ok, we got the cookie lets change it into a cookie echo chunk */ 9048 /* first the change from param to cookie */ 9049 hdr = mtod(cookie, struct sctp_chunkhdr *); 9050 hdr->chunk_type = SCTP_COOKIE_ECHO; 9051 hdr->chunk_flags = 0; 9052 /* get the chunk stuff now and place it in the FRONT of the queue */ 9053 sctp_alloc_a_chunk(stcb, chk); 9054 if (chk == NULL) { 9055 /* no memory */ 9056 sctp_m_freem(cookie); 9057 return (-5); 9058 } 9059 chk->copy_by_ref = 0; 9060 chk->rec.chunk_id.id = SCTP_COOKIE_ECHO; 9061 chk->rec.chunk_id.can_take_data = 0; 9062 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9063 chk->send_size = plen; 9064 chk->sent = SCTP_DATAGRAM_UNSENT; 9065 chk->snd_count = 0; 9066 chk->asoc = &stcb->asoc; 9067 chk->data = cookie; 9068 chk->whoTo = net; 9069 atomic_add_int(&chk->whoTo->ref_count, 1); 9070 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 9071 chk->asoc->ctrl_queue_cnt++; 9072 return (0); 9073} 9074 9075void 9076sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 9077 struct mbuf *m, 9078 int offset, 9079 int chk_length, 9080 struct sctp_nets *net) 9081{ 9082 /* 9083 * take a HB request and make it into a HB ack and send it. 9084 */ 9085 struct mbuf *outchain; 9086 struct sctp_chunkhdr *chdr; 9087 struct sctp_tmit_chunk *chk; 9088 9089 9090 if (net == NULL) 9091 /* must have a net pointer */ 9092 return; 9093 9094 outchain = SCTP_M_COPYM(m, offset, chk_length, M_NOWAIT); 9095 if (outchain == NULL) { 9096 /* gak out of memory */ 9097 return; 9098 } 9099#ifdef SCTP_MBUF_LOGGING 9100 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9101 sctp_log_mbc(outchain, SCTP_MBUF_ICOPY); 9102 } 9103#endif 9104 chdr = mtod(outchain, struct sctp_chunkhdr *); 9105 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 9106 chdr->chunk_flags = 0; 9107 if (chk_length % 4) { 9108 /* need pad */ 9109 uint32_t cpthis = 0; 9110 int padlen; 9111 9112 padlen = 4 - (chk_length % 4); 9113 m_copyback(outchain, chk_length, padlen, (caddr_t)&cpthis); 9114 } 9115 sctp_alloc_a_chunk(stcb, chk); 9116 if (chk == NULL) { 9117 /* no memory */ 9118 sctp_m_freem(outchain); 9119 return; 9120 } 9121 chk->copy_by_ref = 0; 9122 chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK; 9123 chk->rec.chunk_id.can_take_data = 1; 9124 chk->flags = 0; 9125 chk->send_size = chk_length; 9126 chk->sent = SCTP_DATAGRAM_UNSENT; 9127 chk->snd_count = 0; 9128 chk->asoc = &stcb->asoc; 9129 chk->data = outchain; 9130 chk->whoTo = net; 9131 atomic_add_int(&chk->whoTo->ref_count, 1); 9132 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9133 chk->asoc->ctrl_queue_cnt++; 9134} 9135 9136void 9137sctp_send_cookie_ack(struct sctp_tcb *stcb) 9138{ 9139 /* formulate and queue a cookie-ack back to sender */ 9140 struct mbuf *cookie_ack; 9141 struct sctp_chunkhdr *hdr; 9142 struct sctp_tmit_chunk *chk; 9143 9144 SCTP_TCB_LOCK_ASSERT(stcb); 9145 9146 cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 9147 if (cookie_ack == NULL) { 9148 /* no mbuf's */ 9149 return; 9150 } 9151 SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD); 9152 sctp_alloc_a_chunk(stcb, chk); 9153 if (chk == NULL) { 9154 /* no memory */ 9155 sctp_m_freem(cookie_ack); 9156 return; 9157 } 9158 chk->copy_by_ref = 0; 9159 chk->rec.chunk_id.id = SCTP_COOKIE_ACK; 9160 chk->rec.chunk_id.can_take_data = 1; 9161 chk->flags = 0; 9162 chk->send_size = sizeof(struct sctp_chunkhdr); 9163 chk->sent = SCTP_DATAGRAM_UNSENT; 9164 chk->snd_count = 0; 9165 chk->asoc = &stcb->asoc; 9166 chk->data = cookie_ack; 9167 if (chk->asoc->last_control_chunk_from != NULL) { 9168 chk->whoTo = chk->asoc->last_control_chunk_from; 9169 atomic_add_int(&chk->whoTo->ref_count, 1); 9170 } else { 9171 chk->whoTo = NULL; 9172 } 9173 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 9174 hdr->chunk_type = SCTP_COOKIE_ACK; 9175 hdr->chunk_flags = 0; 9176 hdr->chunk_length = htons(chk->send_size); 9177 SCTP_BUF_LEN(cookie_ack) = chk->send_size; 9178 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9179 chk->asoc->ctrl_queue_cnt++; 9180 return; 9181} 9182 9183 9184void 9185sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 9186{ 9187 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 9188 struct mbuf *m_shutdown_ack; 9189 struct sctp_shutdown_ack_chunk *ack_cp; 9190 struct sctp_tmit_chunk *chk; 9191 9192 m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9193 if (m_shutdown_ack == NULL) { 9194 /* no mbuf's */ 9195 return; 9196 } 9197 SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD); 9198 sctp_alloc_a_chunk(stcb, chk); 9199 if (chk == NULL) { 9200 /* no memory */ 9201 sctp_m_freem(m_shutdown_ack); 9202 return; 9203 } 9204 chk->copy_by_ref = 0; 9205 chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK; 9206 chk->rec.chunk_id.can_take_data = 1; 9207 chk->flags = 0; 9208 chk->send_size = sizeof(struct sctp_chunkhdr); 9209 chk->sent = SCTP_DATAGRAM_UNSENT; 9210 chk->snd_count = 0; 9211 chk->flags = 0; 9212 chk->asoc = &stcb->asoc; 9213 chk->data = m_shutdown_ack; 9214 chk->whoTo = net; 9215 if (chk->whoTo) { 9216 atomic_add_int(&chk->whoTo->ref_count, 1); 9217 } 9218 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 9219 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 9220 ack_cp->ch.chunk_flags = 0; 9221 ack_cp->ch.chunk_length = htons(chk->send_size); 9222 SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size; 9223 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9224 chk->asoc->ctrl_queue_cnt++; 9225 return; 9226} 9227 9228void 9229sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 9230{ 9231 /* formulate and queue a SHUTDOWN to the sender */ 9232 struct mbuf *m_shutdown; 9233 struct sctp_shutdown_chunk *shutdown_cp; 9234 struct sctp_tmit_chunk *chk; 9235 9236 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 9237 if (chk->rec.chunk_id.id == SCTP_SHUTDOWN) { 9238 /* We already have a SHUTDOWN queued. Reuse it. */ 9239 if (chk->whoTo) { 9240 sctp_free_remote_addr(chk->whoTo); 9241 chk->whoTo = NULL; 9242 } 9243 break; 9244 } 9245 } 9246 if (chk == NULL) { 9247 m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_NOWAIT, 1, MT_HEADER); 9248 if (m_shutdown == NULL) { 9249 /* no mbuf's */ 9250 return; 9251 } 9252 SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD); 9253 sctp_alloc_a_chunk(stcb, chk); 9254 if (chk == NULL) { 9255 /* no memory */ 9256 sctp_m_freem(m_shutdown); 9257 return; 9258 } 9259 chk->copy_by_ref = 0; 9260 chk->rec.chunk_id.id = SCTP_SHUTDOWN; 9261 chk->rec.chunk_id.can_take_data = 1; 9262 chk->flags = 0; 9263 chk->send_size = sizeof(struct sctp_shutdown_chunk); 9264 chk->sent = SCTP_DATAGRAM_UNSENT; 9265 chk->snd_count = 0; 9266 chk->flags = 0; 9267 chk->asoc = &stcb->asoc; 9268 chk->data = m_shutdown; 9269 chk->whoTo = net; 9270 if (chk->whoTo) { 9271 atomic_add_int(&chk->whoTo->ref_count, 1); 9272 } 9273 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 9274 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 9275 shutdown_cp->ch.chunk_flags = 0; 9276 shutdown_cp->ch.chunk_length = htons(chk->send_size); 9277 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9278 SCTP_BUF_LEN(m_shutdown) = chk->send_size; 9279 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9280 chk->asoc->ctrl_queue_cnt++; 9281 } else { 9282 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, sctp_next); 9283 chk->whoTo = net; 9284 if (chk->whoTo) { 9285 atomic_add_int(&chk->whoTo->ref_count, 1); 9286 } 9287 shutdown_cp = mtod(chk->data, struct sctp_shutdown_chunk *); 9288 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 9289 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 9290 } 9291 return; 9292} 9293 9294void 9295sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked) 9296{ 9297 /* 9298 * formulate and queue an ASCONF to the peer. ASCONF parameters 9299 * should be queued on the assoc queue. 9300 */ 9301 struct sctp_tmit_chunk *chk; 9302 struct mbuf *m_asconf; 9303 int len; 9304 9305 SCTP_TCB_LOCK_ASSERT(stcb); 9306 9307 if ((!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) && 9308 (!sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS))) { 9309 /* can't send a new one if there is one in flight already */ 9310 return; 9311 } 9312 /* compose an ASCONF chunk, maximum length is PMTU */ 9313 m_asconf = sctp_compose_asconf(stcb, &len, addr_locked); 9314 if (m_asconf == NULL) { 9315 return; 9316 } 9317 sctp_alloc_a_chunk(stcb, chk); 9318 if (chk == NULL) { 9319 /* no memory */ 9320 sctp_m_freem(m_asconf); 9321 return; 9322 } 9323 chk->copy_by_ref = 0; 9324 chk->rec.chunk_id.id = SCTP_ASCONF; 9325 chk->rec.chunk_id.can_take_data = 0; 9326 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9327 chk->data = m_asconf; 9328 chk->send_size = len; 9329 chk->sent = SCTP_DATAGRAM_UNSENT; 9330 chk->snd_count = 0; 9331 chk->asoc = &stcb->asoc; 9332 chk->whoTo = net; 9333 if (chk->whoTo) { 9334 atomic_add_int(&chk->whoTo->ref_count, 1); 9335 } 9336 TAILQ_INSERT_TAIL(&chk->asoc->asconf_send_queue, chk, sctp_next); 9337 chk->asoc->ctrl_queue_cnt++; 9338 return; 9339} 9340 9341void 9342sctp_send_asconf_ack(struct sctp_tcb *stcb) 9343{ 9344 /* 9345 * formulate and queue a asconf-ack back to sender. the asconf-ack 9346 * must be stored in the tcb. 9347 */ 9348 struct sctp_tmit_chunk *chk; 9349 struct sctp_asconf_ack *ack, *latest_ack; 9350 struct mbuf *m_ack; 9351 struct sctp_nets *net = NULL; 9352 9353 SCTP_TCB_LOCK_ASSERT(stcb); 9354 /* Get the latest ASCONF-ACK */ 9355 latest_ack = TAILQ_LAST(&stcb->asoc.asconf_ack_sent, sctp_asconf_ackhead); 9356 if (latest_ack == NULL) { 9357 return; 9358 } 9359 if (latest_ack->last_sent_to != NULL && 9360 latest_ack->last_sent_to == stcb->asoc.last_control_chunk_from) { 9361 /* we're doing a retransmission */ 9362 net = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0); 9363 if (net == NULL) { 9364 /* no alternate */ 9365 if (stcb->asoc.last_control_chunk_from == NULL) { 9366 if (stcb->asoc.alternate) { 9367 net = stcb->asoc.alternate; 9368 } else { 9369 net = stcb->asoc.primary_destination; 9370 } 9371 } else { 9372 net = stcb->asoc.last_control_chunk_from; 9373 } 9374 } 9375 } else { 9376 /* normal case */ 9377 if (stcb->asoc.last_control_chunk_from == NULL) { 9378 if (stcb->asoc.alternate) { 9379 net = stcb->asoc.alternate; 9380 } else { 9381 net = stcb->asoc.primary_destination; 9382 } 9383 } else { 9384 net = stcb->asoc.last_control_chunk_from; 9385 } 9386 } 9387 latest_ack->last_sent_to = net; 9388 9389 TAILQ_FOREACH(ack, &stcb->asoc.asconf_ack_sent, next) { 9390 if (ack->data == NULL) { 9391 continue; 9392 } 9393 /* copy the asconf_ack */ 9394 m_ack = SCTP_M_COPYM(ack->data, 0, M_COPYALL, M_NOWAIT); 9395 if (m_ack == NULL) { 9396 /* couldn't copy it */ 9397 return; 9398 } 9399#ifdef SCTP_MBUF_LOGGING 9400 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) { 9401 sctp_log_mbc(m_ack, SCTP_MBUF_ICOPY); 9402 } 9403#endif 9404 9405 sctp_alloc_a_chunk(stcb, chk); 9406 if (chk == NULL) { 9407 /* no memory */ 9408 if (m_ack) 9409 sctp_m_freem(m_ack); 9410 return; 9411 } 9412 chk->copy_by_ref = 0; 9413 chk->rec.chunk_id.id = SCTP_ASCONF_ACK; 9414 chk->rec.chunk_id.can_take_data = 1; 9415 chk->flags = CHUNK_FLAGS_FRAGMENT_OK; 9416 chk->whoTo = net; 9417 if (chk->whoTo) { 9418 atomic_add_int(&chk->whoTo->ref_count, 1); 9419 } 9420 chk->data = m_ack; 9421 chk->send_size = ack->len; 9422 chk->sent = SCTP_DATAGRAM_UNSENT; 9423 chk->snd_count = 0; 9424 chk->asoc = &stcb->asoc; 9425 9426 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 9427 chk->asoc->ctrl_queue_cnt++; 9428 } 9429 return; 9430} 9431 9432 9433static int 9434sctp_chunk_retransmission(struct sctp_inpcb *inp, 9435 struct sctp_tcb *stcb, 9436 struct sctp_association *asoc, 9437 int *cnt_out, struct timeval *now, int *now_filled, int *fr_done, int so_locked 9438#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 9439 SCTP_UNUSED 9440#endif 9441) 9442{ 9443 /*- 9444 * send out one MTU of retransmission. If fast_retransmit is 9445 * happening we ignore the cwnd. Otherwise we obey the cwnd and 9446 * rwnd. For a Cookie or Asconf in the control chunk queue we 9447 * retransmit them by themselves. 9448 * 9449 * For data chunks we will pick out the lowest TSN's in the sent_queue 9450 * marked for resend and bundle them all together (up to a MTU of 9451 * destination). The address to send to should have been 9452 * selected/changed where the retransmission was marked (i.e. in FR 9453 * or t3-timeout routines). 9454 */ 9455 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 9456 struct sctp_tmit_chunk *chk, *fwd; 9457 struct mbuf *m, *endofchain; 9458 struct sctp_nets *net = NULL; 9459 uint32_t tsns_sent = 0; 9460 int no_fragmentflg, bundle_at, cnt_thru; 9461 unsigned int mtu; 9462 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 9463 struct sctp_auth_chunk *auth = NULL; 9464 uint32_t auth_offset = 0; 9465 uint16_t auth_keyid; 9466 int override_ok = 1; 9467 int data_auth_reqd = 0; 9468 uint32_t dmtu = 0; 9469 9470 SCTP_TCB_LOCK_ASSERT(stcb); 9471 tmr_started = ctl_cnt = bundle_at = error = 0; 9472 no_fragmentflg = 1; 9473 fwd_tsn = 0; 9474 *cnt_out = 0; 9475 fwd = NULL; 9476 endofchain = m = NULL; 9477 auth_keyid = stcb->asoc.authinfo.active_keyid; 9478#ifdef SCTP_AUDITING_ENABLED 9479 sctp_audit_log(0xC3, 1); 9480#endif 9481 if ((TAILQ_EMPTY(&asoc->sent_queue)) && 9482 (TAILQ_EMPTY(&asoc->control_send_queue))) { 9483 SCTPDBG(SCTP_DEBUG_OUTPUT1, "SCTP hits empty queue with cnt set to %d?\n", 9484 asoc->sent_queue_retran_cnt); 9485 asoc->sent_queue_cnt = 0; 9486 asoc->sent_queue_cnt_removeable = 0; 9487 /* send back 0/0 so we enter normal transmission */ 9488 *cnt_out = 0; 9489 return (0); 9490 } 9491 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 9492 if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) || 9493 (chk->rec.chunk_id.id == SCTP_STREAM_RESET) || 9494 (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) { 9495 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9496 continue; 9497 } 9498 if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) { 9499 if (chk != asoc->str_reset) { 9500 /* 9501 * not eligible for retran if its 9502 * not ours 9503 */ 9504 continue; 9505 } 9506 } 9507 ctl_cnt++; 9508 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 9509 fwd_tsn = 1; 9510 } 9511 /* 9512 * Add an AUTH chunk, if chunk requires it save the 9513 * offset into the chain for AUTH 9514 */ 9515 if ((auth == NULL) && 9516 (sctp_auth_is_required_chunk(chk->rec.chunk_id.id, 9517 stcb->asoc.peer_auth_chunks))) { 9518 m = sctp_add_auth_chunk(m, &endofchain, 9519 &auth, &auth_offset, 9520 stcb, 9521 chk->rec.chunk_id.id); 9522 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9523 } 9524 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9525 break; 9526 } 9527 } 9528 one_chunk = 0; 9529 cnt_thru = 0; 9530 /* do we have control chunks to retransmit? */ 9531 if (m != NULL) { 9532 /* Start a timer no matter if we succeed or fail */ 9533 if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) { 9534 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 9535 } else if (chk->rec.chunk_id.id == SCTP_ASCONF) 9536 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 9537 chk->snd_count++; /* update our count */ 9538 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 9539 (struct sockaddr *)&chk->whoTo->ro._l_addr, m, 9540 auth_offset, auth, stcb->asoc.authinfo.active_keyid, 9541 no_fragmentflg, 0, 0, 9542 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9543 chk->whoTo->port, NULL, 9544 0, 0, 9545 so_locked))) { 9546 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9547 if (error == ENOBUFS) { 9548 asoc->ifp_had_enobuf = 1; 9549 SCTP_STAT_INCR(sctps_lowlevelerr); 9550 } 9551 return (error); 9552 } else { 9553 asoc->ifp_had_enobuf = 0; 9554 } 9555 endofchain = NULL; 9556 auth = NULL; 9557 auth_offset = 0; 9558 /* 9559 * We don't want to mark the net->sent time here since this 9560 * we use this for HB and retrans cannot measure RTT 9561 */ 9562 /* (void)SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */ 9563 *cnt_out += 1; 9564 chk->sent = SCTP_DATAGRAM_SENT; 9565 sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt); 9566 if (fwd_tsn == 0) { 9567 return (0); 9568 } else { 9569 /* Clean up the fwd-tsn list */ 9570 sctp_clean_up_ctl(stcb, asoc, so_locked); 9571 return (0); 9572 } 9573 } 9574 /* 9575 * Ok, it is just data retransmission we need to do or that and a 9576 * fwd-tsn with it all. 9577 */ 9578 if (TAILQ_EMPTY(&asoc->sent_queue)) { 9579 return (SCTP_RETRAN_DONE); 9580 } 9581 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) || 9582 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) { 9583 /* not yet open, resend the cookie and that is it */ 9584 return (1); 9585 } 9586#ifdef SCTP_AUDITING_ENABLED 9587 sctp_auditing(20, inp, stcb, NULL); 9588#endif 9589 data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks); 9590 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 9591 if (chk->sent != SCTP_DATAGRAM_RESEND) { 9592 /* No, not sent to this net or not ready for rtx */ 9593 continue; 9594 } 9595 if (chk->data == NULL) { 9596 SCTP_PRINTF("TSN:%x chk->snd_count:%d chk->sent:%d can't retran - no data\n", 9597 chk->rec.data.tsn, chk->snd_count, chk->sent); 9598 continue; 9599 } 9600 if ((SCTP_BASE_SYSCTL(sctp_max_retran_chunk)) && 9601 (chk->snd_count >= SCTP_BASE_SYSCTL(sctp_max_retran_chunk))) { 9602 struct mbuf *op_err; 9603 char msg[SCTP_DIAG_INFO_LEN]; 9604 9605 snprintf(msg, sizeof(msg), "TSN %8.8x retransmitted %d times, giving up", 9606 chk->rec.data.tsn, chk->snd_count); 9607 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 9608 msg); 9609 atomic_add_int(&stcb->asoc.refcnt, 1); 9610 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, 9611 so_locked); 9612 SCTP_TCB_LOCK(stcb); 9613 atomic_subtract_int(&stcb->asoc.refcnt, 1); 9614 return (SCTP_RETRAN_EXIT); 9615 } 9616 /* pick up the net */ 9617 net = chk->whoTo; 9618 switch (net->ro._l_addr.sa.sa_family) { 9619#ifdef INET 9620 case AF_INET: 9621 mtu = net->mtu - SCTP_MIN_V4_OVERHEAD; 9622 break; 9623#endif 9624#ifdef INET6 9625 case AF_INET6: 9626 mtu = net->mtu - SCTP_MIN_OVERHEAD; 9627 break; 9628#endif 9629 default: 9630 /* TSNH */ 9631 mtu = net->mtu; 9632 break; 9633 } 9634 9635 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 9636 /* No room in peers rwnd */ 9637 uint32_t tsn; 9638 9639 tsn = asoc->last_acked_seq + 1; 9640 if (tsn == chk->rec.data.tsn) { 9641 /* 9642 * we make a special exception for this 9643 * case. The peer has no rwnd but is missing 9644 * the lowest chunk.. which is probably what 9645 * is holding up the rwnd. 9646 */ 9647 goto one_chunk_around; 9648 } 9649 return (1); 9650 } 9651one_chunk_around: 9652 if (asoc->peers_rwnd < mtu) { 9653 one_chunk = 1; 9654 if ((asoc->peers_rwnd == 0) && 9655 (asoc->total_flight == 0)) { 9656 chk->window_probe = 1; 9657 chk->whoTo->window_probe = 1; 9658 } 9659 } 9660#ifdef SCTP_AUDITING_ENABLED 9661 sctp_audit_log(0xC3, 2); 9662#endif 9663 bundle_at = 0; 9664 m = NULL; 9665 net->fast_retran_ip = 0; 9666 if (chk->rec.data.doing_fast_retransmit == 0) { 9667 /* 9668 * if no FR in progress skip destination that have 9669 * flight_size > cwnd. 9670 */ 9671 if (net->flight_size >= net->cwnd) { 9672 continue; 9673 } 9674 } else { 9675 /* 9676 * Mark the destination net to have FR recovery 9677 * limits put on it. 9678 */ 9679 *fr_done = 1; 9680 net->fast_retran_ip = 1; 9681 } 9682 9683 /* 9684 * if no AUTH is yet included and this chunk requires it, 9685 * make sure to account for it. We don't apply the size 9686 * until the AUTH chunk is actually added below in case 9687 * there is no room for this chunk. 9688 */ 9689 if (data_auth_reqd && (auth == NULL)) { 9690 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9691 } else 9692 dmtu = 0; 9693 9694 if ((chk->send_size <= (mtu - dmtu)) || 9695 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 9696 /* ok we will add this one */ 9697 if (data_auth_reqd) { 9698 if (auth == NULL) { 9699 m = sctp_add_auth_chunk(m, 9700 &endofchain, 9701 &auth, 9702 &auth_offset, 9703 stcb, 9704 SCTP_DATA); 9705 auth_keyid = chk->auth_keyid; 9706 override_ok = 0; 9707 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9708 } else if (override_ok) { 9709 auth_keyid = chk->auth_keyid; 9710 override_ok = 0; 9711 } else if (chk->auth_keyid != auth_keyid) { 9712 /* different keyid, so done bundling */ 9713 break; 9714 } 9715 } 9716 m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref); 9717 if (m == NULL) { 9718 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9719 return (ENOMEM); 9720 } 9721 /* Do clear IP_DF ? */ 9722 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9723 no_fragmentflg = 0; 9724 } 9725 /* upate our MTU size */ 9726 if (mtu > (chk->send_size + dmtu)) 9727 mtu -= (chk->send_size + dmtu); 9728 else 9729 mtu = 0; 9730 data_list[bundle_at++] = chk; 9731 if (one_chunk && (asoc->total_flight <= 0)) { 9732 SCTP_STAT_INCR(sctps_windowprobed); 9733 } 9734 } 9735 if (one_chunk == 0) { 9736 /* 9737 * now are there anymore forward from chk to pick 9738 * up? 9739 */ 9740 for (fwd = TAILQ_NEXT(chk, sctp_next); fwd != NULL; fwd = TAILQ_NEXT(fwd, sctp_next)) { 9741 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 9742 /* Nope, not for retran */ 9743 continue; 9744 } 9745 if (fwd->whoTo != net) { 9746 /* Nope, not the net in question */ 9747 continue; 9748 } 9749 if (data_auth_reqd && (auth == NULL)) { 9750 dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id); 9751 } else 9752 dmtu = 0; 9753 if (fwd->send_size <= (mtu - dmtu)) { 9754 if (data_auth_reqd) { 9755 if (auth == NULL) { 9756 m = sctp_add_auth_chunk(m, 9757 &endofchain, 9758 &auth, 9759 &auth_offset, 9760 stcb, 9761 SCTP_DATA); 9762 auth_keyid = fwd->auth_keyid; 9763 override_ok = 0; 9764 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 9765 } else if (override_ok) { 9766 auth_keyid = fwd->auth_keyid; 9767 override_ok = 0; 9768 } else if (fwd->auth_keyid != auth_keyid) { 9769 /* 9770 * different keyid, 9771 * so done bundling 9772 */ 9773 break; 9774 } 9775 } 9776 m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref); 9777 if (m == NULL) { 9778 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 9779 return (ENOMEM); 9780 } 9781 /* Do clear IP_DF ? */ 9782 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 9783 no_fragmentflg = 0; 9784 } 9785 /* upate our MTU size */ 9786 if (mtu > (fwd->send_size + dmtu)) 9787 mtu -= (fwd->send_size + dmtu); 9788 else 9789 mtu = 0; 9790 data_list[bundle_at++] = fwd; 9791 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 9792 break; 9793 } 9794 } else { 9795 /* can't fit so we are done */ 9796 break; 9797 } 9798 } 9799 } 9800 /* Is there something to send for this destination? */ 9801 if (m) { 9802 /* 9803 * No matter if we fail/or succeed we should start a 9804 * timer. A failure is like a lost IP packet :-) 9805 */ 9806 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9807 /* 9808 * no timer running on this destination 9809 * restart it. 9810 */ 9811 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9812 tmr_started = 1; 9813 } 9814 /* Now lets send it, if there is anything to send :> */ 9815 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 9816 (struct sockaddr *)&net->ro._l_addr, m, 9817 auth_offset, auth, auth_keyid, 9818 no_fragmentflg, 0, 0, 9819 inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag), 9820 net->port, NULL, 9821 0, 0, 9822 so_locked))) { 9823 /* error, we could not output */ 9824 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 9825 if (error == ENOBUFS) { 9826 asoc->ifp_had_enobuf = 1; 9827 SCTP_STAT_INCR(sctps_lowlevelerr); 9828 } 9829 return (error); 9830 } else { 9831 asoc->ifp_had_enobuf = 0; 9832 } 9833 endofchain = NULL; 9834 auth = NULL; 9835 auth_offset = 0; 9836 /* For HB's */ 9837 /* 9838 * We don't want to mark the net->sent time here 9839 * since this we use this for HB and retrans cannot 9840 * measure RTT 9841 */ 9842 /* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */ 9843 9844 /* For auto-close */ 9845 cnt_thru++; 9846 if (*now_filled == 0) { 9847 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 9848 *now = asoc->time_last_sent; 9849 *now_filled = 1; 9850 } else { 9851 asoc->time_last_sent = *now; 9852 } 9853 *cnt_out += bundle_at; 9854#ifdef SCTP_AUDITING_ENABLED 9855 sctp_audit_log(0xC4, bundle_at); 9856#endif 9857 if (bundle_at) { 9858 tsns_sent = data_list[0]->rec.data.tsn; 9859 } 9860 for (i = 0; i < bundle_at; i++) { 9861 SCTP_STAT_INCR(sctps_sendretransdata); 9862 data_list[i]->sent = SCTP_DATAGRAM_SENT; 9863 /* 9864 * When we have a revoked data, and we 9865 * retransmit it, then we clear the revoked 9866 * flag since this flag dictates if we 9867 * subtracted from the fs 9868 */ 9869 if (data_list[i]->rec.data.chunk_was_revoked) { 9870 /* Deflate the cwnd */ 9871 data_list[i]->whoTo->cwnd -= data_list[i]->book_size; 9872 data_list[i]->rec.data.chunk_was_revoked = 0; 9873 } 9874 data_list[i]->snd_count++; 9875 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 9876 /* record the time */ 9877 data_list[i]->sent_rcv_time = asoc->time_last_sent; 9878 if (data_list[i]->book_size_scale) { 9879 /* 9880 * need to double the book size on 9881 * this one 9882 */ 9883 data_list[i]->book_size_scale = 0; 9884 /* 9885 * Since we double the booksize, we 9886 * must also double the output queue 9887 * size, since this get shrunk when 9888 * we free by this amount. 9889 */ 9890 atomic_add_int(&((asoc)->total_output_queue_size), data_list[i]->book_size); 9891 data_list[i]->book_size *= 2; 9892 9893 9894 } else { 9895 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) { 9896 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 9897 asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)); 9898 } 9899 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 9900 (uint32_t)(data_list[i]->send_size + 9901 SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))); 9902 } 9903 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) { 9904 sctp_misc_ints(SCTP_FLIGHT_LOG_UP_RSND, 9905 data_list[i]->whoTo->flight_size, 9906 data_list[i]->book_size, 9907 (uint32_t)(uintptr_t)data_list[i]->whoTo, 9908 data_list[i]->rec.data.tsn); 9909 } 9910 sctp_flight_size_increase(data_list[i]); 9911 sctp_total_flight_increase(stcb, data_list[i]); 9912 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 9913 /* SWS sender side engages */ 9914 asoc->peers_rwnd = 0; 9915 } 9916 if ((i == 0) && 9917 (data_list[i]->rec.data.doing_fast_retransmit)) { 9918 SCTP_STAT_INCR(sctps_sendfastretrans); 9919 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 9920 (tmr_started == 0)) { 9921 /*- 9922 * ok we just fast-retrans'd 9923 * the lowest TSN, i.e the 9924 * first on the list. In 9925 * this case we want to give 9926 * some more time to get a 9927 * SACK back without a 9928 * t3-expiring. 9929 */ 9930 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net, 9931 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_2); 9932 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 9933 } 9934 } 9935 } 9936 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 9937 sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND); 9938 } 9939#ifdef SCTP_AUDITING_ENABLED 9940 sctp_auditing(21, inp, stcb, NULL); 9941#endif 9942 } else { 9943 /* None will fit */ 9944 return (1); 9945 } 9946 if (asoc->sent_queue_retran_cnt <= 0) { 9947 /* all done we have no more to retran */ 9948 asoc->sent_queue_retran_cnt = 0; 9949 break; 9950 } 9951 if (one_chunk) { 9952 /* No more room in rwnd */ 9953 return (1); 9954 } 9955 /* stop the for loop here. we sent out a packet */ 9956 break; 9957 } 9958 return (0); 9959} 9960 9961static void 9962sctp_timer_validation(struct sctp_inpcb *inp, 9963 struct sctp_tcb *stcb, 9964 struct sctp_association *asoc) 9965{ 9966 struct sctp_nets *net; 9967 9968 /* Validate that a timer is running somewhere */ 9969 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 9970 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) { 9971 /* Here is a timer */ 9972 return; 9973 } 9974 } 9975 SCTP_TCB_LOCK_ASSERT(stcb); 9976 /* Gak, we did not have a timer somewhere */ 9977 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Deadlock avoided starting timer on a dest at retran\n"); 9978 if (asoc->alternate) { 9979 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->alternate); 9980 } else { 9981 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 9982 } 9983 return; 9984} 9985 9986void 9987sctp_chunk_output(struct sctp_inpcb *inp, 9988 struct sctp_tcb *stcb, 9989 int from_where, 9990 int so_locked 9991#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 9992 SCTP_UNUSED 9993#endif 9994) 9995{ 9996 /*- 9997 * Ok this is the generic chunk service queue. we must do the 9998 * following: 9999 * - See if there are retransmits pending, if so we must 10000 * do these first. 10001 * - Service the stream queue that is next, moving any 10002 * message (note I must get a complete message i.e. 10003 * FIRST/MIDDLE and LAST to the out queue in one pass) and assigning 10004 * TSN's 10005 * - Check to see if the cwnd/rwnd allows any output, if so we 10006 * go ahead and fomulate and send the low level chunks. Making sure 10007 * to combine any control in the control chunk queue also. 10008 */ 10009 struct sctp_association *asoc; 10010 struct sctp_nets *net; 10011 int error = 0, num_out, tot_out = 0, ret = 0, reason_code; 10012 unsigned int burst_cnt = 0; 10013 struct timeval now; 10014 int now_filled = 0; 10015 int nagle_on; 10016 int frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 10017 int un_sent = 0; 10018 int fr_done; 10019 unsigned int tot_frs = 0; 10020 10021 asoc = &stcb->asoc; 10022do_it_again: 10023 /* The Nagle algorithm is only applied when handling a send call. */ 10024 if (from_where == SCTP_OUTPUT_FROM_USR_SEND) { 10025 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) { 10026 nagle_on = 0; 10027 } else { 10028 nagle_on = 1; 10029 } 10030 } else { 10031 nagle_on = 0; 10032 } 10033 SCTP_TCB_LOCK_ASSERT(stcb); 10034 10035 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight); 10036 10037 if ((un_sent <= 0) && 10038 (TAILQ_EMPTY(&asoc->control_send_queue)) && 10039 (TAILQ_EMPTY(&asoc->asconf_send_queue)) && 10040 (asoc->sent_queue_retran_cnt == 0) && 10041 (asoc->trigger_reset == 0)) { 10042 /* Nothing to do unless there is something to be sent left */ 10043 return; 10044 } 10045 /* 10046 * Do we have something to send, data or control AND a sack timer 10047 * running, if so piggy-back the sack. 10048 */ 10049 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) { 10050 sctp_send_sack(stcb, so_locked); 10051 (void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer); 10052 } 10053 while (asoc->sent_queue_retran_cnt) { 10054 /*- 10055 * Ok, it is retransmission time only, we send out only ONE 10056 * packet with a single call off to the retran code. 10057 */ 10058 if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) { 10059 /*- 10060 * Special hook for handling cookiess discarded 10061 * by peer that carried data. Send cookie-ack only 10062 * and then the next call with get the retran's. 10063 */ 10064 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10065 from_where, 10066 &now, &now_filled, frag_point, so_locked); 10067 return; 10068 } else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) { 10069 /* if its not from a HB then do it */ 10070 fr_done = 0; 10071 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled, &fr_done, so_locked); 10072 if (fr_done) { 10073 tot_frs++; 10074 } 10075 } else { 10076 /* 10077 * its from any other place, we don't allow retran 10078 * output (only control) 10079 */ 10080 ret = 1; 10081 } 10082 if (ret > 0) { 10083 /* Can't send anymore */ 10084 /*- 10085 * now lets push out control by calling med-level 10086 * output once. this assures that we WILL send HB's 10087 * if queued too. 10088 */ 10089 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 10090 from_where, 10091 &now, &now_filled, frag_point, so_locked); 10092#ifdef SCTP_AUDITING_ENABLED 10093 sctp_auditing(8, inp, stcb, NULL); 10094#endif 10095 sctp_timer_validation(inp, stcb, asoc); 10096 return; 10097 } 10098 if (ret < 0) { 10099 /*- 10100 * The count was off.. retran is not happening so do 10101 * the normal retransmission. 10102 */ 10103#ifdef SCTP_AUDITING_ENABLED 10104 sctp_auditing(9, inp, stcb, NULL); 10105#endif 10106 if (ret == SCTP_RETRAN_EXIT) { 10107 return; 10108 } 10109 break; 10110 } 10111 if (from_where == SCTP_OUTPUT_FROM_T3) { 10112 /* Only one transmission allowed out of a timeout */ 10113#ifdef SCTP_AUDITING_ENABLED 10114 sctp_auditing(10, inp, stcb, NULL); 10115#endif 10116 /* Push out any control */ 10117 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, from_where, 10118 &now, &now_filled, frag_point, so_locked); 10119 return; 10120 } 10121 if ((asoc->fr_max_burst > 0) && (tot_frs >= asoc->fr_max_burst)) { 10122 /* Hit FR burst limit */ 10123 return; 10124 } 10125 if ((num_out == 0) && (ret == 0)) { 10126 /* No more retrans to send */ 10127 break; 10128 } 10129 } 10130#ifdef SCTP_AUDITING_ENABLED 10131 sctp_auditing(12, inp, stcb, NULL); 10132#endif 10133 /* Check for bad destinations, if they exist move chunks around. */ 10134 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 10135 if (!(net->dest_state & SCTP_ADDR_REACHABLE)) { 10136 /*- 10137 * if possible move things off of this address we 10138 * still may send below due to the dormant state but 10139 * we try to find an alternate address to send to 10140 * and if we have one we move all queued data on the 10141 * out wheel to this alternate address. 10142 */ 10143 if (net->ref_count > 1) 10144 sctp_move_chunks_from_net(stcb, net); 10145 } else { 10146 /*- 10147 * if ((asoc->sat_network) || (net->addr_is_local)) 10148 * { burst_limit = asoc->max_burst * 10149 * SCTP_SAT_NETWORK_BURST_INCR; } 10150 */ 10151 if (asoc->max_burst > 0) { 10152 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst)) { 10153 if ((net->flight_size + (asoc->max_burst * net->mtu)) < net->cwnd) { 10154 /* 10155 * JRS - Use the congestion 10156 * control given in the 10157 * congestion control module 10158 */ 10159 asoc->cc_functions.sctp_cwnd_update_after_output(stcb, net, asoc->max_burst); 10160 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10161 sctp_log_maxburst(stcb, net, 0, asoc->max_burst, SCTP_MAX_BURST_APPLIED); 10162 } 10163 SCTP_STAT_INCR(sctps_maxburstqueued); 10164 } 10165 net->fast_retran_ip = 0; 10166 } else { 10167 if (net->flight_size == 0) { 10168 /* 10169 * Should be decaying the 10170 * cwnd here 10171 */ 10172 ; 10173 } 10174 } 10175 } 10176 } 10177 10178 } 10179 burst_cnt = 0; 10180 do { 10181 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 10182 &reason_code, 0, from_where, 10183 &now, &now_filled, frag_point, so_locked); 10184 if (error) { 10185 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Error %d was returned from med-c-op\n", error); 10186 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10187 sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 10188 } 10189 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10190 sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES); 10191 sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES); 10192 } 10193 break; 10194 } 10195 SCTPDBG(SCTP_DEBUG_OUTPUT3, "m-c-o put out %d\n", num_out); 10196 10197 tot_out += num_out; 10198 burst_cnt++; 10199 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10200 sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES); 10201 if (num_out == 0) { 10202 sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES); 10203 } 10204 } 10205 if (nagle_on) { 10206 /* 10207 * When the Nagle algorithm is used, look at how 10208 * much is unsent, then if its smaller than an MTU 10209 * and we have data in flight we stop, except if we 10210 * are handling a fragmented user message. 10211 */ 10212 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 10213 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 10214 if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) && 10215 (stcb->asoc.total_flight > 0)) { 10216/* && sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) {*/ 10217 break; 10218 } 10219 } 10220 if (TAILQ_EMPTY(&asoc->control_send_queue) && 10221 TAILQ_EMPTY(&asoc->send_queue) && 10222 sctp_is_there_unsent_data(stcb, so_locked) == 0) { 10223 /* Nothing left to send */ 10224 break; 10225 } 10226 if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) { 10227 /* Nothing left to send */ 10228 break; 10229 } 10230 } while (num_out && 10231 ((asoc->max_burst == 0) || 10232 SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) || 10233 (burst_cnt < asoc->max_burst))); 10234 10235 if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) == 0) { 10236 if ((asoc->max_burst > 0) && (burst_cnt >= asoc->max_burst)) { 10237 SCTP_STAT_INCR(sctps_maxburstqueued); 10238 asoc->burst_limit_applied = 1; 10239 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) { 10240 sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED); 10241 } 10242 } else { 10243 asoc->burst_limit_applied = 0; 10244 } 10245 } 10246 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) { 10247 sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES); 10248 } 10249 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, we have put out %d chunks\n", 10250 tot_out); 10251 10252 /*- 10253 * Now we need to clean up the control chunk chain if a ECNE is on 10254 * it. It must be marked as UNSENT again so next call will continue 10255 * to send it until such time that we get a CWR, to remove it. 10256 */ 10257 if (stcb->asoc.ecn_echo_cnt_onq) 10258 sctp_fix_ecn_echo(asoc); 10259 10260 if (stcb->asoc.trigger_reset) { 10261 if (sctp_send_stream_reset_out_if_possible(stcb, so_locked) == 0) { 10262 goto do_it_again; 10263 } 10264 } 10265 return; 10266} 10267 10268 10269int 10270sctp_output( 10271 struct sctp_inpcb *inp, 10272 struct mbuf *m, 10273 struct sockaddr *addr, 10274 struct mbuf *control, 10275 struct thread *p, 10276 int flags) 10277{ 10278 if (inp == NULL) { 10279 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10280 return (EINVAL); 10281 } 10282 if (inp->sctp_socket == NULL) { 10283 SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 10284 return (EINVAL); 10285 } 10286 return (sctp_sosend(inp->sctp_socket, 10287 addr, 10288 (struct uio *)NULL, 10289 m, 10290 control, 10291 flags, p 10292 )); 10293} 10294 10295void 10296send_forward_tsn(struct sctp_tcb *stcb, 10297 struct sctp_association *asoc) 10298{ 10299 struct sctp_tmit_chunk *chk, *at, *tp1, *last; 10300 struct sctp_forward_tsn_chunk *fwdtsn; 10301 struct sctp_strseq *strseq; 10302 struct sctp_strseq_mid *strseq_m; 10303 uint32_t advance_peer_ack_point; 10304 unsigned int cnt_of_space, i, ovh; 10305 unsigned int space_needed; 10306 unsigned int cnt_of_skipped = 0; 10307 10308 SCTP_TCB_LOCK_ASSERT(stcb); 10309 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10310 if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) { 10311 /* mark it to unsent */ 10312 chk->sent = SCTP_DATAGRAM_UNSENT; 10313 chk->snd_count = 0; 10314 /* Do we correct its output location? */ 10315 if (chk->whoTo) { 10316 sctp_free_remote_addr(chk->whoTo); 10317 chk->whoTo = NULL; 10318 } 10319 goto sctp_fill_in_rest; 10320 } 10321 } 10322 /* Ok if we reach here we must build one */ 10323 sctp_alloc_a_chunk(stcb, chk); 10324 if (chk == NULL) { 10325 return; 10326 } 10327 asoc->fwd_tsn_cnt++; 10328 chk->copy_by_ref = 0; 10329 /* 10330 * We don't do the old thing here since this is used not for on-wire 10331 * but to tell if we are sending a fwd-tsn by the stack during 10332 * output. And if its a IFORWARD or a FORWARD it is a fwd-tsn. 10333 */ 10334 chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN; 10335 chk->rec.chunk_id.can_take_data = 0; 10336 chk->flags = 0; 10337 chk->asoc = asoc; 10338 chk->whoTo = NULL; 10339 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 10340 if (chk->data == NULL) { 10341 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 10342 return; 10343 } 10344 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 10345 chk->sent = SCTP_DATAGRAM_UNSENT; 10346 chk->snd_count = 0; 10347 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 10348 asoc->ctrl_queue_cnt++; 10349sctp_fill_in_rest: 10350 /*- 10351 * Here we go through and fill out the part that deals with 10352 * stream/seq of the ones we skip. 10353 */ 10354 SCTP_BUF_LEN(chk->data) = 0; 10355 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10356 if ((at->sent != SCTP_FORWARD_TSN_SKIP) && 10357 (at->sent != SCTP_DATAGRAM_NR_ACKED)) { 10358 /* no more to look at */ 10359 break; 10360 } 10361 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10362 /* We don't report these */ 10363 continue; 10364 } 10365 cnt_of_skipped++; 10366 } 10367 if (asoc->idata_supported) { 10368 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10369 (cnt_of_skipped * sizeof(struct sctp_strseq_mid))); 10370 } else { 10371 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 10372 (cnt_of_skipped * sizeof(struct sctp_strseq))); 10373 } 10374 cnt_of_space = (unsigned int)M_TRAILINGSPACE(chk->data); 10375 10376 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 10377 ovh = SCTP_MIN_OVERHEAD; 10378 } else { 10379 ovh = SCTP_MIN_V4_OVERHEAD; 10380 } 10381 if (cnt_of_space > (asoc->smallest_mtu - ovh)) { 10382 /* trim to a mtu size */ 10383 cnt_of_space = asoc->smallest_mtu - ovh; 10384 } 10385 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10386 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10387 0xff, 0, cnt_of_skipped, 10388 asoc->advanced_peer_ack_point); 10389 } 10390 advance_peer_ack_point = asoc->advanced_peer_ack_point; 10391 if (cnt_of_space < space_needed) { 10392 /*- 10393 * ok we must trim down the chunk by lowering the 10394 * advance peer ack point. 10395 */ 10396 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10397 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10398 0xff, 0xff, cnt_of_space, 10399 space_needed); 10400 } 10401 cnt_of_skipped = cnt_of_space - sizeof(struct sctp_forward_tsn_chunk); 10402 if (asoc->idata_supported) { 10403 cnt_of_skipped /= sizeof(struct sctp_strseq_mid); 10404 } else { 10405 cnt_of_skipped /= sizeof(struct sctp_strseq); 10406 } 10407 /*- 10408 * Go through and find the TSN that will be the one 10409 * we report. 10410 */ 10411 at = TAILQ_FIRST(&asoc->sent_queue); 10412 if (at != NULL) { 10413 for (i = 0; i < cnt_of_skipped; i++) { 10414 tp1 = TAILQ_NEXT(at, sctp_next); 10415 if (tp1 == NULL) { 10416 break; 10417 } 10418 at = tp1; 10419 } 10420 } 10421 if (at && SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) { 10422 sctp_misc_ints(SCTP_FWD_TSN_CHECK, 10423 0xff, cnt_of_skipped, at->rec.data.tsn, 10424 asoc->advanced_peer_ack_point); 10425 } 10426 last = at; 10427 /*- 10428 * last now points to last one I can report, update 10429 * peer ack point 10430 */ 10431 if (last) { 10432 advance_peer_ack_point = last->rec.data.tsn; 10433 } 10434 if (asoc->idata_supported) { 10435 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10436 cnt_of_skipped * sizeof(struct sctp_strseq_mid); 10437 } else { 10438 space_needed = sizeof(struct sctp_forward_tsn_chunk) + 10439 cnt_of_skipped * sizeof(struct sctp_strseq); 10440 } 10441 } 10442 chk->send_size = space_needed; 10443 /* Setup the chunk */ 10444 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 10445 fwdtsn->ch.chunk_length = htons(chk->send_size); 10446 fwdtsn->ch.chunk_flags = 0; 10447 if (asoc->idata_supported) { 10448 fwdtsn->ch.chunk_type = SCTP_IFORWARD_CUM_TSN; 10449 } else { 10450 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 10451 } 10452 fwdtsn->new_cumulative_tsn = htonl(advance_peer_ack_point); 10453 SCTP_BUF_LEN(chk->data) = chk->send_size; 10454 fwdtsn++; 10455 /*- 10456 * Move pointer to after the fwdtsn and transfer to the 10457 * strseq pointer. 10458 */ 10459 if (asoc->idata_supported) { 10460 strseq_m = (struct sctp_strseq_mid *)fwdtsn; 10461 strseq = NULL; 10462 } else { 10463 strseq = (struct sctp_strseq *)fwdtsn; 10464 strseq_m = NULL; 10465 } 10466 /*- 10467 * Now populate the strseq list. This is done blindly 10468 * without pulling out duplicate stream info. This is 10469 * inefficent but won't harm the process since the peer will 10470 * look at these in sequence and will thus release anything. 10471 * It could mean we exceed the PMTU and chop off some that 10472 * we could have included.. but this is unlikely (aka 1432/4 10473 * would mean 300+ stream seq's would have to be reported in 10474 * one FWD-TSN. With a bit of work we can later FIX this to 10475 * optimize and pull out duplicates.. but it does add more 10476 * overhead. So for now... not! 10477 */ 10478 i = 0; 10479 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 10480 if (i >= cnt_of_skipped) { 10481 break; 10482 } 10483 if (!asoc->idata_supported && (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) { 10484 /* We don't report these */ 10485 continue; 10486 } 10487 if (at->rec.data.tsn == advance_peer_ack_point) { 10488 at->rec.data.fwd_tsn_cnt = 0; 10489 } 10490 if (asoc->idata_supported) { 10491 strseq_m->sid = htons(at->rec.data.sid); 10492 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 10493 strseq_m->flags = htons(PR_SCTP_UNORDERED_FLAG); 10494 } else { 10495 strseq_m->flags = 0; 10496 } 10497 strseq_m->mid = htonl(at->rec.data.mid); 10498 strseq_m++; 10499 } else { 10500 strseq->sid = htons(at->rec.data.sid); 10501 strseq->ssn = htons((uint16_t)at->rec.data.mid); 10502 strseq++; 10503 } 10504 i++; 10505 } 10506 return; 10507} 10508 10509void 10510sctp_send_sack(struct sctp_tcb *stcb, int so_locked 10511#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10512 SCTP_UNUSED 10513#endif 10514) 10515{ 10516 /*- 10517 * Queue up a SACK or NR-SACK in the control queue. 10518 * We must first check to see if a SACK or NR-SACK is 10519 * somehow on the control queue. 10520 * If so, we will take and and remove the old one. 10521 */ 10522 struct sctp_association *asoc; 10523 struct sctp_tmit_chunk *chk, *a_chk; 10524 struct sctp_sack_chunk *sack; 10525 struct sctp_nr_sack_chunk *nr_sack; 10526 struct sctp_gap_ack_block *gap_descriptor; 10527 const struct sack_track *selector; 10528 int mergeable = 0; 10529 int offset; 10530 caddr_t limit; 10531 uint32_t *dup; 10532 int limit_reached = 0; 10533 unsigned int i, siz, j; 10534 unsigned int num_gap_blocks = 0, num_nr_gap_blocks = 0, space; 10535 int num_dups = 0; 10536 int space_req; 10537 uint32_t highest_tsn; 10538 uint8_t flags; 10539 uint8_t type; 10540 uint8_t tsn_map; 10541 10542 if (stcb->asoc.nrsack_supported == 1) { 10543 type = SCTP_NR_SELECTIVE_ACK; 10544 } else { 10545 type = SCTP_SELECTIVE_ACK; 10546 } 10547 a_chk = NULL; 10548 asoc = &stcb->asoc; 10549 SCTP_TCB_LOCK_ASSERT(stcb); 10550 if (asoc->last_data_chunk_from == NULL) { 10551 /* Hmm we never received anything */ 10552 return; 10553 } 10554 sctp_slide_mapping_arrays(stcb); 10555 sctp_set_rwnd(stcb, asoc); 10556 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 10557 if (chk->rec.chunk_id.id == type) { 10558 /* Hmm, found a sack already on queue, remove it */ 10559 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 10560 asoc->ctrl_queue_cnt--; 10561 a_chk = chk; 10562 if (a_chk->data) { 10563 sctp_m_freem(a_chk->data); 10564 a_chk->data = NULL; 10565 } 10566 if (a_chk->whoTo) { 10567 sctp_free_remote_addr(a_chk->whoTo); 10568 a_chk->whoTo = NULL; 10569 } 10570 break; 10571 } 10572 } 10573 if (a_chk == NULL) { 10574 sctp_alloc_a_chunk(stcb, a_chk); 10575 if (a_chk == NULL) { 10576 /* No memory so we drop the idea, and set a timer */ 10577 if (stcb->asoc.delayed_ack) { 10578 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10579 stcb->sctp_ep, stcb, NULL, 10580 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_3); 10581 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10582 stcb->sctp_ep, stcb, NULL); 10583 } else { 10584 stcb->asoc.send_sack = 1; 10585 } 10586 return; 10587 } 10588 a_chk->copy_by_ref = 0; 10589 a_chk->rec.chunk_id.id = type; 10590 a_chk->rec.chunk_id.can_take_data = 1; 10591 } 10592 /* Clear our pkt counts */ 10593 asoc->data_pkts_seen = 0; 10594 10595 a_chk->flags = 0; 10596 a_chk->asoc = asoc; 10597 a_chk->snd_count = 0; 10598 a_chk->send_size = 0; /* fill in later */ 10599 a_chk->sent = SCTP_DATAGRAM_UNSENT; 10600 a_chk->whoTo = NULL; 10601 10602 if (!(asoc->last_data_chunk_from->dest_state & SCTP_ADDR_REACHABLE)) { 10603 /*- 10604 * Ok, the destination for the SACK is unreachable, lets see if 10605 * we can select an alternate to asoc->last_data_chunk_from 10606 */ 10607 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0); 10608 if (a_chk->whoTo == NULL) { 10609 /* Nope, no alternate */ 10610 a_chk->whoTo = asoc->last_data_chunk_from; 10611 } 10612 } else { 10613 a_chk->whoTo = asoc->last_data_chunk_from; 10614 } 10615 if (a_chk->whoTo) { 10616 atomic_add_int(&a_chk->whoTo->ref_count, 1); 10617 } 10618 if (SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->highest_tsn_inside_nr_map)) { 10619 highest_tsn = asoc->highest_tsn_inside_map; 10620 } else { 10621 highest_tsn = asoc->highest_tsn_inside_nr_map; 10622 } 10623 if (highest_tsn == asoc->cumulative_tsn) { 10624 /* no gaps */ 10625 if (type == SCTP_SELECTIVE_ACK) { 10626 space_req = sizeof(struct sctp_sack_chunk); 10627 } else { 10628 space_req = sizeof(struct sctp_nr_sack_chunk); 10629 } 10630 } else { 10631 /* gaps get a cluster */ 10632 space_req = MCLBYTES; 10633 } 10634 /* Ok now lets formulate a MBUF with our sack */ 10635 a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_NOWAIT, 1, MT_DATA); 10636 if ((a_chk->data == NULL) || 10637 (a_chk->whoTo == NULL)) { 10638 /* rats, no mbuf memory */ 10639 if (a_chk->data) { 10640 /* was a problem with the destination */ 10641 sctp_m_freem(a_chk->data); 10642 a_chk->data = NULL; 10643 } 10644 sctp_free_a_chunk(stcb, a_chk, so_locked); 10645 /* sa_ignore NO_NULL_CHK */ 10646 if (stcb->asoc.delayed_ack) { 10647 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 10648 stcb->sctp_ep, stcb, NULL, 10649 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4); 10650 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 10651 stcb->sctp_ep, stcb, NULL); 10652 } else { 10653 stcb->asoc.send_sack = 1; 10654 } 10655 return; 10656 } 10657 /* ok, lets go through and fill it in */ 10658 SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD); 10659 space = (unsigned int)M_TRAILINGSPACE(a_chk->data); 10660 if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) { 10661 space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD); 10662 } 10663 limit = mtod(a_chk->data, caddr_t); 10664 limit += space; 10665 10666 flags = 0; 10667 10668 if ((asoc->sctp_cmt_on_off > 0) && 10669 SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) { 10670 /*- 10671 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been 10672 * received, then set high bit to 1, else 0. Reset 10673 * pkts_rcvd. 10674 */ 10675 flags |= (asoc->cmt_dac_pkts_rcvd << 6); 10676 asoc->cmt_dac_pkts_rcvd = 0; 10677 } 10678#ifdef SCTP_ASOCLOG_OF_TSNS 10679 stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn; 10680 stcb->asoc.cumack_log_atsnt++; 10681 if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) { 10682 stcb->asoc.cumack_log_atsnt = 0; 10683 } 10684#endif 10685 /* reset the readers interpretation */ 10686 stcb->freed_by_sorcv_sincelast = 0; 10687 10688 if (type == SCTP_SELECTIVE_ACK) { 10689 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 10690 nr_sack = NULL; 10691 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk)); 10692 if (highest_tsn > asoc->mapping_array_base_tsn) { 10693 siz = (((highest_tsn - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10694 } else { 10695 siz = (((MAX_TSN - highest_tsn) + 1) + highest_tsn + 7) / 8; 10696 } 10697 } else { 10698 sack = NULL; 10699 nr_sack = mtod(a_chk->data, struct sctp_nr_sack_chunk *); 10700 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)nr_sack + sizeof(struct sctp_nr_sack_chunk)); 10701 if (asoc->highest_tsn_inside_map > asoc->mapping_array_base_tsn) { 10702 siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10703 } else { 10704 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_map + 7) / 8; 10705 } 10706 } 10707 10708 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10709 offset = 1; 10710 } else { 10711 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10712 } 10713 if (((type == SCTP_SELECTIVE_ACK) && 10714 SCTP_TSN_GT(highest_tsn, asoc->cumulative_tsn)) || 10715 ((type == SCTP_NR_SELECTIVE_ACK) && 10716 SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->cumulative_tsn))) { 10717 /* we have a gap .. maybe */ 10718 for (i = 0; i < siz; i++) { 10719 tsn_map = asoc->mapping_array[i]; 10720 if (type == SCTP_SELECTIVE_ACK) { 10721 tsn_map |= asoc->nr_mapping_array[i]; 10722 } 10723 if (i == 0) { 10724 /* 10725 * Clear all bits corresponding to TSNs 10726 * smaller or equal to the cumulative TSN. 10727 */ 10728 tsn_map &= (~0U << (1 - offset)); 10729 } 10730 selector = &sack_array[tsn_map]; 10731 if (mergeable && selector->right_edge) { 10732 /* 10733 * Backup, left and right edges were ok to 10734 * merge. 10735 */ 10736 num_gap_blocks--; 10737 gap_descriptor--; 10738 } 10739 if (selector->num_entries == 0) 10740 mergeable = 0; 10741 else { 10742 for (j = 0; j < selector->num_entries; j++) { 10743 if (mergeable && selector->right_edge) { 10744 /* 10745 * do a merge by NOT setting 10746 * the left side 10747 */ 10748 mergeable = 0; 10749 } else { 10750 /* 10751 * no merge, set the left 10752 * side 10753 */ 10754 mergeable = 0; 10755 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10756 } 10757 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10758 num_gap_blocks++; 10759 gap_descriptor++; 10760 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10761 /* no more room */ 10762 limit_reached = 1; 10763 break; 10764 } 10765 } 10766 if (selector->left_edge) { 10767 mergeable = 1; 10768 } 10769 } 10770 if (limit_reached) { 10771 /* Reached the limit stop */ 10772 break; 10773 } 10774 offset += 8; 10775 } 10776 } 10777 if ((type == SCTP_NR_SELECTIVE_ACK) && 10778 (limit_reached == 0)) { 10779 10780 mergeable = 0; 10781 10782 if (asoc->highest_tsn_inside_nr_map > asoc->mapping_array_base_tsn) { 10783 siz = (((asoc->highest_tsn_inside_nr_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8; 10784 } else { 10785 siz = (((MAX_TSN - asoc->mapping_array_base_tsn) + 1) + asoc->highest_tsn_inside_nr_map + 7) / 8; 10786 } 10787 10788 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn, asoc->cumulative_tsn)) { 10789 offset = 1; 10790 } else { 10791 offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn; 10792 } 10793 if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->cumulative_tsn)) { 10794 /* we have a gap .. maybe */ 10795 for (i = 0; i < siz; i++) { 10796 tsn_map = asoc->nr_mapping_array[i]; 10797 if (i == 0) { 10798 /* 10799 * Clear all bits corresponding to 10800 * TSNs smaller or equal to the 10801 * cumulative TSN. 10802 */ 10803 tsn_map &= (~0U << (1 - offset)); 10804 } 10805 selector = &sack_array[tsn_map]; 10806 if (mergeable && selector->right_edge) { 10807 /* 10808 * Backup, left and right edges were 10809 * ok to merge. 10810 */ 10811 num_nr_gap_blocks--; 10812 gap_descriptor--; 10813 } 10814 if (selector->num_entries == 0) 10815 mergeable = 0; 10816 else { 10817 for (j = 0; j < selector->num_entries; j++) { 10818 if (mergeable && selector->right_edge) { 10819 /* 10820 * do a merge by NOT 10821 * setting the left 10822 * side 10823 */ 10824 mergeable = 0; 10825 } else { 10826 /* 10827 * no merge, set the 10828 * left side 10829 */ 10830 mergeable = 0; 10831 gap_descriptor->start = htons((selector->gaps[j].start + offset)); 10832 } 10833 gap_descriptor->end = htons((selector->gaps[j].end + offset)); 10834 num_nr_gap_blocks++; 10835 gap_descriptor++; 10836 if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) { 10837 /* no more room */ 10838 limit_reached = 1; 10839 break; 10840 } 10841 } 10842 if (selector->left_edge) { 10843 mergeable = 1; 10844 } 10845 } 10846 if (limit_reached) { 10847 /* Reached the limit stop */ 10848 break; 10849 } 10850 offset += 8; 10851 } 10852 } 10853 } 10854 /* now we must add any dups we are going to report. */ 10855 if ((limit_reached == 0) && (asoc->numduptsns)) { 10856 dup = (uint32_t *)gap_descriptor; 10857 for (i = 0; i < asoc->numduptsns; i++) { 10858 *dup = htonl(asoc->dup_tsns[i]); 10859 dup++; 10860 num_dups++; 10861 if (((caddr_t)dup + sizeof(uint32_t)) > limit) { 10862 /* no more room */ 10863 break; 10864 } 10865 } 10866 asoc->numduptsns = 0; 10867 } 10868 /* 10869 * now that the chunk is prepared queue it to the control chunk 10870 * queue. 10871 */ 10872 if (type == SCTP_SELECTIVE_ACK) { 10873 a_chk->send_size = (uint16_t)(sizeof(struct sctp_sack_chunk) + 10874 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10875 num_dups * sizeof(int32_t)); 10876 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10877 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10878 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 10879 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 10880 sack->sack.num_dup_tsns = htons(num_dups); 10881 sack->ch.chunk_type = type; 10882 sack->ch.chunk_flags = flags; 10883 sack->ch.chunk_length = htons(a_chk->send_size); 10884 } else { 10885 a_chk->send_size = (uint16_t)(sizeof(struct sctp_nr_sack_chunk) + 10886 (num_gap_blocks + num_nr_gap_blocks) * sizeof(struct sctp_gap_ack_block) + 10887 num_dups * sizeof(int32_t)); 10888 SCTP_BUF_LEN(a_chk->data) = a_chk->send_size; 10889 nr_sack->nr_sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 10890 nr_sack->nr_sack.a_rwnd = htonl(asoc->my_rwnd); 10891 nr_sack->nr_sack.num_gap_ack_blks = htons(num_gap_blocks); 10892 nr_sack->nr_sack.num_nr_gap_ack_blks = htons(num_nr_gap_blocks); 10893 nr_sack->nr_sack.num_dup_tsns = htons(num_dups); 10894 nr_sack->nr_sack.reserved = 0; 10895 nr_sack->ch.chunk_type = type; 10896 nr_sack->ch.chunk_flags = flags; 10897 nr_sack->ch.chunk_length = htons(a_chk->send_size); 10898 } 10899 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 10900 asoc->my_last_reported_rwnd = asoc->my_rwnd; 10901 asoc->ctrl_queue_cnt++; 10902 asoc->send_sack = 0; 10903 SCTP_STAT_INCR(sctps_sendsacks); 10904 return; 10905} 10906 10907void 10908sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr, int so_locked 10909#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 10910 SCTP_UNUSED 10911#endif 10912) 10913{ 10914 struct mbuf *m_abort, *m, *m_last; 10915 struct mbuf *m_out, *m_end = NULL; 10916 struct sctp_abort_chunk *abort; 10917 struct sctp_auth_chunk *auth = NULL; 10918 struct sctp_nets *net; 10919 uint32_t vtag; 10920 uint32_t auth_offset = 0; 10921 int error; 10922 uint16_t cause_len, chunk_len, padding_len; 10923 10924 SCTP_TCB_LOCK_ASSERT(stcb); 10925 /*- 10926 * Add an AUTH chunk, if chunk requires it and save the offset into 10927 * the chain for AUTH 10928 */ 10929 if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION, 10930 stcb->asoc.peer_auth_chunks)) { 10931 m_out = sctp_add_auth_chunk(NULL, &m_end, &auth, &auth_offset, 10932 stcb, SCTP_ABORT_ASSOCIATION); 10933 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 10934 } else { 10935 m_out = NULL; 10936 } 10937 m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_NOWAIT, 1, MT_HEADER); 10938 if (m_abort == NULL) { 10939 if (m_out) { 10940 sctp_m_freem(m_out); 10941 } 10942 if (operr) { 10943 sctp_m_freem(operr); 10944 } 10945 return; 10946 } 10947 /* link in any error */ 10948 SCTP_BUF_NEXT(m_abort) = operr; 10949 cause_len = 0; 10950 m_last = NULL; 10951 for (m = operr; m; m = SCTP_BUF_NEXT(m)) { 10952 cause_len += (uint16_t)SCTP_BUF_LEN(m); 10953 if (SCTP_BUF_NEXT(m) == NULL) { 10954 m_last = m; 10955 } 10956 } 10957 SCTP_BUF_LEN(m_abort) = sizeof(struct sctp_abort_chunk); 10958 chunk_len = (uint16_t)sizeof(struct sctp_abort_chunk) + cause_len; 10959 padding_len = SCTP_SIZE32(chunk_len) - chunk_len; 10960 if (m_out == NULL) { 10961 /* NO Auth chunk prepended, so reserve space in front */ 10962 SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD); 10963 m_out = m_abort; 10964 } else { 10965 /* Put AUTH chunk at the front of the chain */ 10966 SCTP_BUF_NEXT(m_end) = m_abort; 10967 } 10968 if (stcb->asoc.alternate) { 10969 net = stcb->asoc.alternate; 10970 } else { 10971 net = stcb->asoc.primary_destination; 10972 } 10973 /* Fill in the ABORT chunk header. */ 10974 abort = mtod(m_abort, struct sctp_abort_chunk *); 10975 abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION; 10976 if (stcb->asoc.peer_vtag == 0) { 10977 /* This happens iff the assoc is in COOKIE-WAIT state. */ 10978 vtag = stcb->asoc.my_vtag; 10979 abort->ch.chunk_flags = SCTP_HAD_NO_TCB; 10980 } else { 10981 vtag = stcb->asoc.peer_vtag; 10982 abort->ch.chunk_flags = 0; 10983 } 10984 abort->ch.chunk_length = htons(chunk_len); 10985 /* Add padding, if necessary. */ 10986 if (padding_len > 0) { 10987 if ((m_last == NULL) || 10988 (sctp_add_pad_tombuf(m_last, padding_len) == NULL)) { 10989 sctp_m_freem(m_out); 10990 return; 10991 } 10992 } 10993 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 10994 (struct sockaddr *)&net->ro._l_addr, 10995 m_out, auth_offset, auth, stcb->asoc.authinfo.active_keyid, 1, 0, 0, 10996 stcb->sctp_ep->sctp_lport, stcb->rport, htonl(vtag), 10997 stcb->asoc.primary_destination->port, NULL, 10998 0, 0, 10999 so_locked))) { 11000 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 11001 if (error == ENOBUFS) { 11002 stcb->asoc.ifp_had_enobuf = 1; 11003 SCTP_STAT_INCR(sctps_lowlevelerr); 11004 } 11005 } else { 11006 stcb->asoc.ifp_had_enobuf = 0; 11007 } 11008 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11009} 11010 11011void 11012sctp_send_shutdown_complete(struct sctp_tcb *stcb, 11013 struct sctp_nets *net, 11014 int reflect_vtag) 11015{ 11016 /* formulate and SEND a SHUTDOWN-COMPLETE */ 11017 struct mbuf *m_shutdown_comp; 11018 struct sctp_shutdown_complete_chunk *shutdown_complete; 11019 uint32_t vtag; 11020 int error; 11021 uint8_t flags; 11022 11023 m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_NOWAIT, 1, MT_HEADER); 11024 if (m_shutdown_comp == NULL) { 11025 /* no mbuf's */ 11026 return; 11027 } 11028 if (reflect_vtag) { 11029 flags = SCTP_HAD_NO_TCB; 11030 vtag = stcb->asoc.my_vtag; 11031 } else { 11032 flags = 0; 11033 vtag = stcb->asoc.peer_vtag; 11034 } 11035 shutdown_complete = mtod(m_shutdown_comp, struct sctp_shutdown_complete_chunk *); 11036 shutdown_complete->ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 11037 shutdown_complete->ch.chunk_flags = flags; 11038 shutdown_complete->ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 11039 SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_chunk); 11040 if ((error = sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 11041 (struct sockaddr *)&net->ro._l_addr, 11042 m_shutdown_comp, 0, NULL, 0, 1, 0, 0, 11043 stcb->sctp_ep->sctp_lport, stcb->rport, 11044 htonl(vtag), 11045 net->port, NULL, 11046 0, 0, 11047 SCTP_SO_NOT_LOCKED))) { 11048 SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error); 11049 if (error == ENOBUFS) { 11050 stcb->asoc.ifp_had_enobuf = 1; 11051 SCTP_STAT_INCR(sctps_lowlevelerr); 11052 } 11053 } else { 11054 stcb->asoc.ifp_had_enobuf = 0; 11055 } 11056 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11057 return; 11058} 11059 11060static void 11061sctp_send_resp_msg(struct sockaddr *src, struct sockaddr *dst, 11062 struct sctphdr *sh, uint32_t vtag, 11063 uint8_t type, struct mbuf *cause, 11064 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11065 uint32_t vrf_id, uint16_t port) 11066{ 11067 struct mbuf *o_pak; 11068 struct mbuf *mout; 11069 struct sctphdr *shout; 11070 struct sctp_chunkhdr *ch; 11071#if defined(INET) || defined(INET6) 11072 struct udphdr *udp; 11073 int ret; 11074#endif 11075 int len, cause_len, padding_len; 11076#ifdef INET 11077 struct sockaddr_in *src_sin, *dst_sin; 11078 struct ip *ip; 11079#endif 11080#ifdef INET6 11081 struct sockaddr_in6 *src_sin6, *dst_sin6; 11082 struct ip6_hdr *ip6; 11083#endif 11084 11085 /* Compute the length of the cause and add final padding. */ 11086 cause_len = 0; 11087 if (cause != NULL) { 11088 struct mbuf *m_at, *m_last = NULL; 11089 11090 for (m_at = cause; m_at; m_at = SCTP_BUF_NEXT(m_at)) { 11091 if (SCTP_BUF_NEXT(m_at) == NULL) 11092 m_last = m_at; 11093 cause_len += SCTP_BUF_LEN(m_at); 11094 } 11095 padding_len = cause_len % 4; 11096 if (padding_len != 0) { 11097 padding_len = 4 - padding_len; 11098 } 11099 if (padding_len != 0) { 11100 if (sctp_add_pad_tombuf(m_last, padding_len) == NULL) { 11101 sctp_m_freem(cause); 11102 return; 11103 } 11104 } 11105 } else { 11106 padding_len = 0; 11107 } 11108 /* Get an mbuf for the header. */ 11109 len = sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr); 11110 switch (dst->sa_family) { 11111#ifdef INET 11112 case AF_INET: 11113 len += sizeof(struct ip); 11114 break; 11115#endif 11116#ifdef INET6 11117 case AF_INET6: 11118 len += sizeof(struct ip6_hdr); 11119 break; 11120#endif 11121 default: 11122 break; 11123 } 11124#if defined(INET) || defined(INET6) 11125 if (port) { 11126 len += sizeof(struct udphdr); 11127 } 11128#endif 11129 mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_NOWAIT, 1, MT_DATA); 11130 if (mout == NULL) { 11131 if (cause) { 11132 sctp_m_freem(cause); 11133 } 11134 return; 11135 } 11136 SCTP_BUF_RESV_UF(mout, max_linkhdr); 11137 SCTP_BUF_LEN(mout) = len; 11138 SCTP_BUF_NEXT(mout) = cause; 11139 M_SETFIB(mout, fibnum); 11140 mout->m_pkthdr.flowid = mflowid; 11141 M_HASHTYPE_SET(mout, mflowtype); 11142#ifdef INET 11143 ip = NULL; 11144#endif 11145#ifdef INET6 11146 ip6 = NULL; 11147#endif 11148 switch (dst->sa_family) { 11149#ifdef INET 11150 case AF_INET: 11151 src_sin = (struct sockaddr_in *)src; 11152 dst_sin = (struct sockaddr_in *)dst; 11153 ip = mtod(mout, struct ip *); 11154 ip->ip_v = IPVERSION; 11155 ip->ip_hl = (sizeof(struct ip) >> 2); 11156 ip->ip_tos = 0; 11157 ip->ip_off = htons(IP_DF); 11158 ip_fillid(ip); 11159 ip->ip_ttl = MODULE_GLOBAL(ip_defttl); 11160 if (port) { 11161 ip->ip_p = IPPROTO_UDP; 11162 } else { 11163 ip->ip_p = IPPROTO_SCTP; 11164 } 11165 ip->ip_src.s_addr = dst_sin->sin_addr.s_addr; 11166 ip->ip_dst.s_addr = src_sin->sin_addr.s_addr; 11167 ip->ip_sum = 0; 11168 len = sizeof(struct ip); 11169 shout = (struct sctphdr *)((caddr_t)ip + len); 11170 break; 11171#endif 11172#ifdef INET6 11173 case AF_INET6: 11174 src_sin6 = (struct sockaddr_in6 *)src; 11175 dst_sin6 = (struct sockaddr_in6 *)dst; 11176 ip6 = mtod(mout, struct ip6_hdr *); 11177 ip6->ip6_flow = htonl(0x60000000); 11178 if (V_ip6_auto_flowlabel) { 11179 ip6->ip6_flow |= (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK); 11180 } 11181 ip6->ip6_hlim = MODULE_GLOBAL(ip6_defhlim); 11182 if (port) { 11183 ip6->ip6_nxt = IPPROTO_UDP; 11184 } else { 11185 ip6->ip6_nxt = IPPROTO_SCTP; 11186 } 11187 ip6->ip6_src = dst_sin6->sin6_addr; 11188 ip6->ip6_dst = src_sin6->sin6_addr; 11189 len = sizeof(struct ip6_hdr); 11190 shout = (struct sctphdr *)((caddr_t)ip6 + len); 11191 break; 11192#endif 11193 default: 11194 len = 0; 11195 shout = mtod(mout, struct sctphdr *); 11196 break; 11197 } 11198#if defined(INET) || defined(INET6) 11199 if (port) { 11200 if (htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)) == 0) { 11201 sctp_m_freem(mout); 11202 return; 11203 } 11204 udp = (struct udphdr *)shout; 11205 udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)); 11206 udp->uh_dport = port; 11207 udp->uh_sum = 0; 11208 udp->uh_ulen = htons((uint16_t)(sizeof(struct udphdr) + 11209 sizeof(struct sctphdr) + 11210 sizeof(struct sctp_chunkhdr) + 11211 cause_len + padding_len)); 11212 len += sizeof(struct udphdr); 11213 shout = (struct sctphdr *)((caddr_t)shout + sizeof(struct udphdr)); 11214 } else { 11215 udp = NULL; 11216 } 11217#endif 11218 shout->src_port = sh->dest_port; 11219 shout->dest_port = sh->src_port; 11220 shout->checksum = 0; 11221 if (vtag) { 11222 shout->v_tag = htonl(vtag); 11223 } else { 11224 shout->v_tag = sh->v_tag; 11225 } 11226 len += sizeof(struct sctphdr); 11227 ch = (struct sctp_chunkhdr *)((caddr_t)shout + sizeof(struct sctphdr)); 11228 ch->chunk_type = type; 11229 if (vtag) { 11230 ch->chunk_flags = 0; 11231 } else { 11232 ch->chunk_flags = SCTP_HAD_NO_TCB; 11233 } 11234 ch->chunk_length = htons((uint16_t)(sizeof(struct sctp_chunkhdr) + cause_len)); 11235 len += sizeof(struct sctp_chunkhdr); 11236 len += cause_len + padding_len; 11237 11238 if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) { 11239 sctp_m_freem(mout); 11240 return; 11241 } 11242 SCTP_ATTACH_CHAIN(o_pak, mout, len); 11243 switch (dst->sa_family) { 11244#ifdef INET 11245 case AF_INET: 11246 if (port) { 11247 if (V_udp_cksum) { 11248 udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP)); 11249 } else { 11250 udp->uh_sum = 0; 11251 } 11252 } 11253 ip->ip_len = htons(len); 11254 if (port) { 11255#if defined(SCTP_WITH_NO_CSUM) 11256 SCTP_STAT_INCR(sctps_sendnocrc); 11257#else 11258 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip) + sizeof(struct udphdr)); 11259 SCTP_STAT_INCR(sctps_sendswcrc); 11260#endif 11261 if (V_udp_cksum) { 11262 SCTP_ENABLE_UDP_CSUM(o_pak); 11263 } 11264 } else { 11265#if defined(SCTP_WITH_NO_CSUM) 11266 SCTP_STAT_INCR(sctps_sendnocrc); 11267#else 11268 mout->m_pkthdr.csum_flags = CSUM_SCTP; 11269 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11270 SCTP_STAT_INCR(sctps_sendhwcrc); 11271#endif 11272 } 11273#ifdef SCTP_PACKET_LOGGING 11274 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11275 sctp_packet_log(o_pak); 11276 } 11277#endif 11278 SCTP_IP_OUTPUT(ret, o_pak, NULL, NULL, vrf_id); 11279 break; 11280#endif 11281#ifdef INET6 11282 case AF_INET6: 11283 ip6->ip6_plen = (uint16_t)(len - sizeof(struct ip6_hdr)); 11284 if (port) { 11285#if defined(SCTP_WITH_NO_CSUM) 11286 SCTP_STAT_INCR(sctps_sendnocrc); 11287#else 11288 shout->checksum = sctp_calculate_cksum(mout, sizeof(struct ip6_hdr) + sizeof(struct udphdr)); 11289 SCTP_STAT_INCR(sctps_sendswcrc); 11290#endif 11291 if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), len - sizeof(struct ip6_hdr))) == 0) { 11292 udp->uh_sum = 0xffff; 11293 } 11294 } else { 11295#if defined(SCTP_WITH_NO_CSUM) 11296 SCTP_STAT_INCR(sctps_sendnocrc); 11297#else 11298 mout->m_pkthdr.csum_flags = CSUM_SCTP_IPV6; 11299 mout->m_pkthdr.csum_data = offsetof(struct sctphdr, checksum); 11300 SCTP_STAT_INCR(sctps_sendhwcrc); 11301#endif 11302 } 11303#ifdef SCTP_PACKET_LOGGING 11304 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) { 11305 sctp_packet_log(o_pak); 11306 } 11307#endif 11308 SCTP_IP6_OUTPUT(ret, o_pak, NULL, NULL, NULL, vrf_id); 11309 break; 11310#endif 11311 default: 11312 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n", 11313 dst->sa_family); 11314 sctp_m_freem(mout); 11315 SCTP_LTRACE_ERR_RET_PKT(mout, NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT); 11316 return; 11317 } 11318 SCTP_STAT_INCR(sctps_sendpackets); 11319 SCTP_STAT_INCR_COUNTER64(sctps_outpackets); 11320 SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks); 11321 return; 11322} 11323 11324void 11325sctp_send_shutdown_complete2(struct sockaddr *src, struct sockaddr *dst, 11326 struct sctphdr *sh, 11327 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 11328 uint32_t vrf_id, uint16_t port) 11329{ 11330 sctp_send_resp_msg(src, dst, sh, 0, SCTP_SHUTDOWN_COMPLETE, NULL, 11331 mflowtype, mflowid, fibnum, 11332 vrf_id, port); 11333} 11334 11335void 11336sctp_send_hb(struct sctp_tcb *stcb, struct sctp_nets *net, int so_locked 11337#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING) 11338 SCTP_UNUSED 11339#endif 11340) 11341{ 11342 struct sctp_tmit_chunk *chk; 11343 struct sctp_heartbeat_chunk *hb; 11344 struct timeval now; 11345 11346 SCTP_TCB_LOCK_ASSERT(stcb); 11347 if (net == NULL) { 11348 return; 11349 } 11350 (void)SCTP_GETTIME_TIMEVAL(&now); 11351 switch (net->ro._l_addr.sa.sa_family) { 11352#ifdef INET 11353 case AF_INET: 11354 break; 11355#endif 11356#ifdef INET6 11357 case AF_INET6: 11358 break; 11359#endif 11360 default: 11361 return; 11362 } 11363 sctp_alloc_a_chunk(stcb, chk); 11364 if (chk == NULL) { 11365 SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak, can't get a chunk for hb\n"); 11366 return; 11367 } 11368 chk->copy_by_ref = 0; 11369 chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST; 11370 chk->rec.chunk_id.can_take_data = 1; 11371 chk->flags = 0; 11372 chk->asoc = &stcb->asoc; 11373 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 11374 11375 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11376 if (chk->data == NULL) { 11377 sctp_free_a_chunk(stcb, chk, so_locked); 11378 return; 11379 } 11380 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11381 SCTP_BUF_LEN(chk->data) = chk->send_size; 11382 chk->sent = SCTP_DATAGRAM_UNSENT; 11383 chk->snd_count = 0; 11384 chk->whoTo = net; 11385 atomic_add_int(&chk->whoTo->ref_count, 1); 11386 /* Now we have a mbuf that we can fill in with the details */ 11387 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 11388 memset(hb, 0, sizeof(struct sctp_heartbeat_chunk)); 11389 /* fill out chunk header */ 11390 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 11391 hb->ch.chunk_flags = 0; 11392 hb->ch.chunk_length = htons(chk->send_size); 11393 /* Fill out hb parameter */ 11394 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 11395 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 11396 hb->heartbeat.hb_info.time_value_1 = now.tv_sec; 11397 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 11398 /* Did our user request this one, put it in */ 11399 hb->heartbeat.hb_info.addr_family = (uint8_t)net->ro._l_addr.sa.sa_family; 11400 hb->heartbeat.hb_info.addr_len = net->ro._l_addr.sa.sa_len; 11401 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 11402 /* 11403 * we only take from the entropy pool if the address is not 11404 * confirmed. 11405 */ 11406 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11407 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 11408 } else { 11409 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 11410 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 11411 } 11412 switch (net->ro._l_addr.sa.sa_family) { 11413#ifdef INET 11414 case AF_INET: 11415 memcpy(hb->heartbeat.hb_info.address, 11416 &net->ro._l_addr.sin.sin_addr, 11417 sizeof(net->ro._l_addr.sin.sin_addr)); 11418 break; 11419#endif 11420#ifdef INET6 11421 case AF_INET6: 11422 memcpy(hb->heartbeat.hb_info.address, 11423 &net->ro._l_addr.sin6.sin6_addr, 11424 sizeof(net->ro._l_addr.sin6.sin6_addr)); 11425 break; 11426#endif 11427 default: 11428 if (chk->data) { 11429 sctp_m_freem(chk->data); 11430 chk->data = NULL; 11431 } 11432 sctp_free_a_chunk(stcb, chk, so_locked); 11433 return; 11434 break; 11435 } 11436 net->hb_responded = 0; 11437 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11438 stcb->asoc.ctrl_queue_cnt++; 11439 SCTP_STAT_INCR(sctps_sendheartbeat); 11440 return; 11441} 11442 11443void 11444sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 11445 uint32_t high_tsn) 11446{ 11447 struct sctp_association *asoc; 11448 struct sctp_ecne_chunk *ecne; 11449 struct sctp_tmit_chunk *chk; 11450 11451 if (net == NULL) { 11452 return; 11453 } 11454 asoc = &stcb->asoc; 11455 SCTP_TCB_LOCK_ASSERT(stcb); 11456 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11457 if ((chk->rec.chunk_id.id == SCTP_ECN_ECHO) && (net == chk->whoTo)) { 11458 /* found a previous ECN_ECHO update it if needed */ 11459 uint32_t cnt, ctsn; 11460 11461 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11462 ctsn = ntohl(ecne->tsn); 11463 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11464 ecne->tsn = htonl(high_tsn); 11465 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11466 } 11467 cnt = ntohl(ecne->num_pkts_since_cwr); 11468 cnt++; 11469 ecne->num_pkts_since_cwr = htonl(cnt); 11470 return; 11471 } 11472 } 11473 /* nope could not find one to update so we must build one */ 11474 sctp_alloc_a_chunk(stcb, chk); 11475 if (chk == NULL) { 11476 return; 11477 } 11478 SCTP_STAT_INCR(sctps_queue_upd_ecne); 11479 chk->copy_by_ref = 0; 11480 chk->rec.chunk_id.id = SCTP_ECN_ECHO; 11481 chk->rec.chunk_id.can_take_data = 0; 11482 chk->flags = 0; 11483 chk->asoc = &stcb->asoc; 11484 chk->send_size = sizeof(struct sctp_ecne_chunk); 11485 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11486 if (chk->data == NULL) { 11487 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11488 return; 11489 } 11490 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11491 SCTP_BUF_LEN(chk->data) = chk->send_size; 11492 chk->sent = SCTP_DATAGRAM_UNSENT; 11493 chk->snd_count = 0; 11494 chk->whoTo = net; 11495 atomic_add_int(&chk->whoTo->ref_count, 1); 11496 11497 stcb->asoc.ecn_echo_cnt_onq++; 11498 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 11499 ecne->ch.chunk_type = SCTP_ECN_ECHO; 11500 ecne->ch.chunk_flags = 0; 11501 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 11502 ecne->tsn = htonl(high_tsn); 11503 ecne->num_pkts_since_cwr = htonl(1); 11504 TAILQ_INSERT_HEAD(&stcb->asoc.control_send_queue, chk, sctp_next); 11505 asoc->ctrl_queue_cnt++; 11506} 11507 11508void 11509sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 11510 struct mbuf *m, int len, int iphlen, int bad_crc) 11511{ 11512 struct sctp_association *asoc; 11513 struct sctp_pktdrop_chunk *drp; 11514 struct sctp_tmit_chunk *chk; 11515 uint8_t *datap; 11516 int was_trunc = 0; 11517 int fullsz = 0; 11518 long spc; 11519 int offset; 11520 struct sctp_chunkhdr *ch, chunk_buf; 11521 unsigned int chk_length; 11522 11523 if (!stcb) { 11524 return; 11525 } 11526 asoc = &stcb->asoc; 11527 SCTP_TCB_LOCK_ASSERT(stcb); 11528 if (asoc->pktdrop_supported == 0) { 11529 /*- 11530 * peer must declare support before I send one. 11531 */ 11532 return; 11533 } 11534 if (stcb->sctp_socket == NULL) { 11535 return; 11536 } 11537 sctp_alloc_a_chunk(stcb, chk); 11538 if (chk == NULL) { 11539 return; 11540 } 11541 chk->copy_by_ref = 0; 11542 chk->rec.chunk_id.id = SCTP_PACKET_DROPPED; 11543 chk->rec.chunk_id.can_take_data = 1; 11544 chk->flags = 0; 11545 len -= iphlen; 11546 chk->send_size = len; 11547 /* Validate that we do not have an ABORT in here. */ 11548 offset = iphlen + sizeof(struct sctphdr); 11549 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11550 sizeof(*ch), (uint8_t *)&chunk_buf); 11551 while (ch != NULL) { 11552 chk_length = ntohs(ch->chunk_length); 11553 if (chk_length < sizeof(*ch)) { 11554 /* break to abort land */ 11555 break; 11556 } 11557 switch (ch->chunk_type) { 11558 case SCTP_PACKET_DROPPED: 11559 case SCTP_ABORT_ASSOCIATION: 11560 case SCTP_INITIATION_ACK: 11561 /** 11562 * We don't respond with an PKT-DROP to an ABORT 11563 * or PKT-DROP. We also do not respond to an 11564 * INIT-ACK, because we can't know if the initiation 11565 * tag is correct or not. 11566 */ 11567 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11568 return; 11569 default: 11570 break; 11571 } 11572 offset += SCTP_SIZE32(chk_length); 11573 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, 11574 sizeof(*ch), (uint8_t *)&chunk_buf); 11575 } 11576 11577 if ((len + SCTP_MAX_OVERHEAD + sizeof(struct sctp_pktdrop_chunk)) > 11578 min(stcb->asoc.smallest_mtu, MCLBYTES)) { 11579 /* 11580 * only send 1 mtu worth, trim off the excess on the end. 11581 */ 11582 fullsz = len; 11583 len = min(stcb->asoc.smallest_mtu, MCLBYTES) - SCTP_MAX_OVERHEAD; 11584 was_trunc = 1; 11585 } 11586 chk->asoc = &stcb->asoc; 11587 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11588 if (chk->data == NULL) { 11589jump_out: 11590 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11591 return; 11592 } 11593 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11594 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 11595 if (drp == NULL) { 11596 sctp_m_freem(chk->data); 11597 chk->data = NULL; 11598 goto jump_out; 11599 } 11600 chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 11601 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD)); 11602 chk->book_size_scale = 0; 11603 if (was_trunc) { 11604 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 11605 drp->trunc_len = htons(fullsz); 11606 /* 11607 * Len is already adjusted to size minus overhead above take 11608 * out the pkt_drop chunk itself from it. 11609 */ 11610 chk->send_size = (uint16_t)(len - sizeof(struct sctp_pktdrop_chunk)); 11611 len = chk->send_size; 11612 } else { 11613 /* no truncation needed */ 11614 drp->ch.chunk_flags = 0; 11615 drp->trunc_len = htons(0); 11616 } 11617 if (bad_crc) { 11618 drp->ch.chunk_flags |= SCTP_BADCRC; 11619 } 11620 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 11621 SCTP_BUF_LEN(chk->data) = chk->send_size; 11622 chk->sent = SCTP_DATAGRAM_UNSENT; 11623 chk->snd_count = 0; 11624 if (net) { 11625 /* we should hit here */ 11626 chk->whoTo = net; 11627 atomic_add_int(&chk->whoTo->ref_count, 1); 11628 } else { 11629 chk->whoTo = NULL; 11630 } 11631 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 11632 drp->ch.chunk_length = htons(chk->send_size); 11633 spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket); 11634 if (spc < 0) { 11635 spc = 0; 11636 } 11637 drp->bottle_bw = htonl(spc); 11638 if (asoc->my_rwnd) { 11639 drp->current_onq = htonl(asoc->size_on_reasm_queue + 11640 asoc->size_on_all_streams + 11641 asoc->my_rwnd_control_len + 11642 stcb->sctp_socket->so_rcv.sb_cc); 11643 } else { 11644 /*- 11645 * If my rwnd is 0, possibly from mbuf depletion as well as 11646 * space used, tell the peer there is NO space aka onq == bw 11647 */ 11648 drp->current_onq = htonl(spc); 11649 } 11650 drp->reserved = 0; 11651 datap = drp->data; 11652 m_copydata(m, iphlen, len, (caddr_t)datap); 11653 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11654 asoc->ctrl_queue_cnt++; 11655} 11656 11657void 11658sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn, uint8_t override) 11659{ 11660 struct sctp_association *asoc; 11661 struct sctp_cwr_chunk *cwr; 11662 struct sctp_tmit_chunk *chk; 11663 11664 SCTP_TCB_LOCK_ASSERT(stcb); 11665 if (net == NULL) { 11666 return; 11667 } 11668 asoc = &stcb->asoc; 11669 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 11670 if ((chk->rec.chunk_id.id == SCTP_ECN_CWR) && (net == chk->whoTo)) { 11671 /* 11672 * found a previous CWR queued to same destination 11673 * update it if needed 11674 */ 11675 uint32_t ctsn; 11676 11677 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11678 ctsn = ntohl(cwr->tsn); 11679 if (SCTP_TSN_GT(high_tsn, ctsn)) { 11680 cwr->tsn = htonl(high_tsn); 11681 } 11682 if (override & SCTP_CWR_REDUCE_OVERRIDE) { 11683 /* Make sure override is carried */ 11684 cwr->ch.chunk_flags |= SCTP_CWR_REDUCE_OVERRIDE; 11685 } 11686 return; 11687 } 11688 } 11689 sctp_alloc_a_chunk(stcb, chk); 11690 if (chk == NULL) { 11691 return; 11692 } 11693 chk->copy_by_ref = 0; 11694 chk->rec.chunk_id.id = SCTP_ECN_CWR; 11695 chk->rec.chunk_id.can_take_data = 1; 11696 chk->flags = 0; 11697 chk->asoc = &stcb->asoc; 11698 chk->send_size = sizeof(struct sctp_cwr_chunk); 11699 chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); 11700 if (chk->data == NULL) { 11701 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED); 11702 return; 11703 } 11704 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11705 SCTP_BUF_LEN(chk->data) = chk->send_size; 11706 chk->sent = SCTP_DATAGRAM_UNSENT; 11707 chk->snd_count = 0; 11708 chk->whoTo = net; 11709 atomic_add_int(&chk->whoTo->ref_count, 1); 11710 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 11711 cwr->ch.chunk_type = SCTP_ECN_CWR; 11712 cwr->ch.chunk_flags = override; 11713 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 11714 cwr->tsn = htonl(high_tsn); 11715 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 11716 asoc->ctrl_queue_cnt++; 11717} 11718 11719static int 11720sctp_add_stream_reset_out(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk, 11721 uint32_t seq, uint32_t resp_seq, uint32_t last_sent) 11722{ 11723 uint16_t len, old_len, i; 11724 struct sctp_stream_reset_out_request *req_out; 11725 struct sctp_chunkhdr *ch; 11726 int at; 11727 int number_entries = 0; 11728 11729 ch = mtod(chk->data, struct sctp_chunkhdr *); 11730 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11731 /* get to new offset for the param. */ 11732 req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len); 11733 /* now how long will this param be? */ 11734 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11735 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11736 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11737 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11738 number_entries++; 11739 } 11740 } 11741 if (number_entries == 0) { 11742 return (0); 11743 } 11744 if (number_entries == stcb->asoc.streamoutcnt) { 11745 number_entries = 0; 11746 } 11747 if (number_entries > SCTP_MAX_STREAMS_AT_ONCE_RESET) { 11748 number_entries = SCTP_MAX_STREAMS_AT_ONCE_RESET; 11749 } 11750 len = (uint16_t)(sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries)); 11751 req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST); 11752 req_out->ph.param_length = htons(len); 11753 req_out->request_seq = htonl(seq); 11754 req_out->response_seq = htonl(resp_seq); 11755 req_out->send_reset_at_tsn = htonl(last_sent); 11756 at = 0; 11757 if (number_entries) { 11758 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11759 if ((stcb->asoc.strmout[i].state == SCTP_STREAM_RESET_PENDING) && 11760 (stcb->asoc.strmout[i].chunks_on_queues == 0) && 11761 TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) { 11762 req_out->list_of_streams[at] = htons(i); 11763 at++; 11764 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11765 if (at >= number_entries) { 11766 break; 11767 } 11768 } 11769 } 11770 } else { 11771 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 11772 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_IN_FLIGHT; 11773 } 11774 } 11775 if (SCTP_SIZE32(len) > len) { 11776 /*- 11777 * Need to worry about the pad we may end up adding to the 11778 * end. This is easy since the struct is either aligned to 4 11779 * bytes or 2 bytes off. 11780 */ 11781 req_out->list_of_streams[number_entries] = 0; 11782 } 11783 /* now fix the chunk length */ 11784 ch->chunk_length = htons(len + old_len); 11785 chk->book_size = len + old_len; 11786 chk->book_size_scale = 0; 11787 chk->send_size = SCTP_SIZE32(chk->book_size); 11788 SCTP_BUF_LEN(chk->data) = chk->send_size; 11789 return (1); 11790} 11791 11792static void 11793sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk, 11794 int number_entries, uint16_t *list, 11795 uint32_t seq) 11796{ 11797 uint16_t len, old_len, i; 11798 struct sctp_stream_reset_in_request *req_in; 11799 struct sctp_chunkhdr *ch; 11800 11801 ch = mtod(chk->data, struct sctp_chunkhdr *); 11802 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11803 11804 /* get to new offset for the param. */ 11805 req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len); 11806 /* now how long will this param be? */ 11807 len = (uint16_t)(sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries)); 11808 req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST); 11809 req_in->ph.param_length = htons(len); 11810 req_in->request_seq = htonl(seq); 11811 if (number_entries) { 11812 for (i = 0; i < number_entries; i++) { 11813 req_in->list_of_streams[i] = htons(list[i]); 11814 } 11815 } 11816 if (SCTP_SIZE32(len) > len) { 11817 /*- 11818 * Need to worry about the pad we may end up adding to the 11819 * end. This is easy since the struct is either aligned to 4 11820 * bytes or 2 bytes off. 11821 */ 11822 req_in->list_of_streams[number_entries] = 0; 11823 } 11824 /* now fix the chunk length */ 11825 ch->chunk_length = htons(len + old_len); 11826 chk->book_size = len + old_len; 11827 chk->book_size_scale = 0; 11828 chk->send_size = SCTP_SIZE32(chk->book_size); 11829 SCTP_BUF_LEN(chk->data) = chk->send_size; 11830 return; 11831} 11832 11833static void 11834sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk, 11835 uint32_t seq) 11836{ 11837 uint16_t len, old_len; 11838 struct sctp_stream_reset_tsn_request *req_tsn; 11839 struct sctp_chunkhdr *ch; 11840 11841 ch = mtod(chk->data, struct sctp_chunkhdr *); 11842 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11843 11844 /* get to new offset for the param. */ 11845 req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len); 11846 /* now how long will this param be? */ 11847 len = sizeof(struct sctp_stream_reset_tsn_request); 11848 req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST); 11849 req_tsn->ph.param_length = htons(len); 11850 req_tsn->request_seq = htonl(seq); 11851 11852 /* now fix the chunk length */ 11853 ch->chunk_length = htons(len + old_len); 11854 chk->send_size = len + old_len; 11855 chk->book_size = SCTP_SIZE32(chk->send_size); 11856 chk->book_size_scale = 0; 11857 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 11858 return; 11859} 11860 11861void 11862sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk, 11863 uint32_t resp_seq, uint32_t result) 11864{ 11865 uint16_t len, old_len; 11866 struct sctp_stream_reset_response *resp; 11867 struct sctp_chunkhdr *ch; 11868 11869 ch = mtod(chk->data, struct sctp_chunkhdr *); 11870 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11871 11872 /* get to new offset for the param. */ 11873 resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len); 11874 /* now how long will this param be? */ 11875 len = sizeof(struct sctp_stream_reset_response); 11876 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11877 resp->ph.param_length = htons(len); 11878 resp->response_seq = htonl(resp_seq); 11879 resp->result = ntohl(result); 11880 11881 /* now fix the chunk length */ 11882 ch->chunk_length = htons(len + old_len); 11883 chk->book_size = len + old_len; 11884 chk->book_size_scale = 0; 11885 chk->send_size = SCTP_SIZE32(chk->book_size); 11886 SCTP_BUF_LEN(chk->data) = chk->send_size; 11887 return; 11888} 11889 11890void 11891sctp_send_deferred_reset_response(struct sctp_tcb *stcb, 11892 struct sctp_stream_reset_list *ent, 11893 int response) 11894{ 11895 struct sctp_association *asoc; 11896 struct sctp_tmit_chunk *chk; 11897 struct sctp_chunkhdr *ch; 11898 11899 asoc = &stcb->asoc; 11900 11901 /* 11902 * Reset our last reset action to the new one IP -> response 11903 * (PERFORMED probably). This assures that if we fail to send, a 11904 * retran from the peer will get the new response. 11905 */ 11906 asoc->last_reset_action[0] = response; 11907 if (asoc->stream_reset_outstanding) { 11908 return; 11909 } 11910 sctp_alloc_a_chunk(stcb, chk); 11911 if (chk == NULL) { 11912 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11913 return; 11914 } 11915 chk->copy_by_ref = 0; 11916 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 11917 chk->rec.chunk_id.can_take_data = 0; 11918 chk->flags = 0; 11919 chk->asoc = &stcb->asoc; 11920 chk->book_size = sizeof(struct sctp_chunkhdr); 11921 chk->send_size = SCTP_SIZE32(chk->book_size); 11922 chk->book_size_scale = 0; 11923 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 11924 if (chk->data == NULL) { 11925 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 11926 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 11927 return; 11928 } 11929 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 11930 /* setup chunk parameters */ 11931 chk->sent = SCTP_DATAGRAM_UNSENT; 11932 chk->snd_count = 0; 11933 if (stcb->asoc.alternate) { 11934 chk->whoTo = stcb->asoc.alternate; 11935 } else { 11936 chk->whoTo = stcb->asoc.primary_destination; 11937 } 11938 ch = mtod(chk->data, struct sctp_chunkhdr *); 11939 ch->chunk_type = SCTP_STREAM_RESET; 11940 ch->chunk_flags = 0; 11941 ch->chunk_length = htons(chk->book_size); 11942 atomic_add_int(&chk->whoTo->ref_count, 1); 11943 SCTP_BUF_LEN(chk->data) = chk->send_size; 11944 sctp_add_stream_reset_result(chk, ent->seq, response); 11945 /* insert the chunk for sending */ 11946 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 11947 chk, 11948 sctp_next); 11949 asoc->ctrl_queue_cnt++; 11950} 11951 11952void 11953sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk, 11954 uint32_t resp_seq, uint32_t result, 11955 uint32_t send_una, uint32_t recv_next) 11956{ 11957 uint16_t len, old_len; 11958 struct sctp_stream_reset_response_tsn *resp; 11959 struct sctp_chunkhdr *ch; 11960 11961 ch = mtod(chk->data, struct sctp_chunkhdr *); 11962 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11963 11964 /* get to new offset for the param. */ 11965 resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len); 11966 /* now how long will this param be? */ 11967 len = sizeof(struct sctp_stream_reset_response_tsn); 11968 resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE); 11969 resp->ph.param_length = htons(len); 11970 resp->response_seq = htonl(resp_seq); 11971 resp->result = htonl(result); 11972 resp->senders_next_tsn = htonl(send_una); 11973 resp->receivers_next_tsn = htonl(recv_next); 11974 11975 /* now fix the chunk length */ 11976 ch->chunk_length = htons(len + old_len); 11977 chk->book_size = len + old_len; 11978 chk->send_size = SCTP_SIZE32(chk->book_size); 11979 chk->book_size_scale = 0; 11980 SCTP_BUF_LEN(chk->data) = chk->send_size; 11981 return; 11982} 11983 11984static void 11985sctp_add_an_out_stream(struct sctp_tmit_chunk *chk, 11986 uint32_t seq, 11987 uint16_t adding) 11988{ 11989 uint16_t len, old_len; 11990 struct sctp_chunkhdr *ch; 11991 struct sctp_stream_reset_add_strm *addstr; 11992 11993 ch = mtod(chk->data, struct sctp_chunkhdr *); 11994 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 11995 11996 /* get to new offset for the param. */ 11997 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 11998 /* now how long will this param be? */ 11999 len = sizeof(struct sctp_stream_reset_add_strm); 12000 12001 /* Fill it out. */ 12002 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_OUT_STREAMS); 12003 addstr->ph.param_length = htons(len); 12004 addstr->request_seq = htonl(seq); 12005 addstr->number_of_streams = htons(adding); 12006 addstr->reserved = 0; 12007 12008 /* now fix the chunk length */ 12009 ch->chunk_length = htons(len + old_len); 12010 chk->send_size = len + old_len; 12011 chk->book_size = SCTP_SIZE32(chk->send_size); 12012 chk->book_size_scale = 0; 12013 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 12014 return; 12015} 12016 12017static void 12018sctp_add_an_in_stream(struct sctp_tmit_chunk *chk, 12019 uint32_t seq, 12020 uint16_t adding) 12021{ 12022 uint16_t len, old_len; 12023 struct sctp_chunkhdr *ch; 12024 struct sctp_stream_reset_add_strm *addstr; 12025 12026 ch = mtod(chk->data, struct sctp_chunkhdr *); 12027 old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length)); 12028 12029 /* get to new offset for the param. */ 12030 addstr = (struct sctp_stream_reset_add_strm *)((caddr_t)ch + len); 12031 /* now how long will this param be? */ 12032 len = sizeof(struct sctp_stream_reset_add_strm); 12033 /* Fill it out. */ 12034 addstr->ph.param_type = htons(SCTP_STR_RESET_ADD_IN_STREAMS); 12035 addstr->ph.param_length = htons(len); 12036 addstr->request_seq = htonl(seq); 12037 addstr->number_of_streams = htons(adding); 12038 addstr->reserved = 0; 12039 12040 /* now fix the chunk length */ 12041 ch->chunk_length = htons(len + old_len); 12042 chk->send_size = len + old_len; 12043 chk->book_size = SCTP_SIZE32(chk->send_size); 12044 chk->book_size_scale = 0; 12045 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size); 12046 return; 12047} 12048 12049int 12050sctp_send_stream_reset_out_if_possible(struct sctp_tcb *stcb, int so_locked) 12051{ 12052 struct sctp_association *asoc; 12053 struct sctp_tmit_chunk *chk; 12054 struct sctp_chunkhdr *ch; 12055 uint32_t seq; 12056 12057 asoc = &stcb->asoc; 12058 asoc->trigger_reset = 0; 12059 if (asoc->stream_reset_outstanding) { 12060 return (EALREADY); 12061 } 12062 sctp_alloc_a_chunk(stcb, chk); 12063 if (chk == NULL) { 12064 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12065 return (ENOMEM); 12066 } 12067 chk->copy_by_ref = 0; 12068 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12069 chk->rec.chunk_id.can_take_data = 0; 12070 chk->flags = 0; 12071 chk->asoc = &stcb->asoc; 12072 chk->book_size = sizeof(struct sctp_chunkhdr); 12073 chk->send_size = SCTP_SIZE32(chk->book_size); 12074 chk->book_size_scale = 0; 12075 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12076 if (chk->data == NULL) { 12077 sctp_free_a_chunk(stcb, chk, so_locked); 12078 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12079 return (ENOMEM); 12080 } 12081 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12082 12083 /* setup chunk parameters */ 12084 chk->sent = SCTP_DATAGRAM_UNSENT; 12085 chk->snd_count = 0; 12086 if (stcb->asoc.alternate) { 12087 chk->whoTo = stcb->asoc.alternate; 12088 } else { 12089 chk->whoTo = stcb->asoc.primary_destination; 12090 } 12091 ch = mtod(chk->data, struct sctp_chunkhdr *); 12092 ch->chunk_type = SCTP_STREAM_RESET; 12093 ch->chunk_flags = 0; 12094 ch->chunk_length = htons(chk->book_size); 12095 atomic_add_int(&chk->whoTo->ref_count, 1); 12096 SCTP_BUF_LEN(chk->data) = chk->send_size; 12097 seq = stcb->asoc.str_reset_seq_out; 12098 if (sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1))) { 12099 seq++; 12100 asoc->stream_reset_outstanding++; 12101 } else { 12102 m_freem(chk->data); 12103 chk->data = NULL; 12104 sctp_free_a_chunk(stcb, chk, so_locked); 12105 return (ENOENT); 12106 } 12107 asoc->str_reset = chk; 12108 /* insert the chunk for sending */ 12109 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12110 chk, 12111 sctp_next); 12112 asoc->ctrl_queue_cnt++; 12113 12114 if (stcb->asoc.send_sack) { 12115 sctp_send_sack(stcb, so_locked); 12116 } 12117 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12118 return (0); 12119} 12120 12121int 12122sctp_send_str_reset_req(struct sctp_tcb *stcb, 12123 uint16_t number_entries, uint16_t *list, 12124 uint8_t send_in_req, 12125 uint8_t send_tsn_req, 12126 uint8_t add_stream, 12127 uint16_t adding_o, 12128 uint16_t adding_i, uint8_t peer_asked) 12129{ 12130 struct sctp_association *asoc; 12131 struct sctp_tmit_chunk *chk; 12132 struct sctp_chunkhdr *ch; 12133 int can_send_out_req = 0; 12134 uint32_t seq; 12135 12136 asoc = &stcb->asoc; 12137 if (asoc->stream_reset_outstanding) { 12138 /*- 12139 * Already one pending, must get ACK back to clear the flag. 12140 */ 12141 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EBUSY); 12142 return (EBUSY); 12143 } 12144 if ((send_in_req == 0) && (send_tsn_req == 0) && 12145 (add_stream == 0)) { 12146 /* nothing to do */ 12147 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12148 return (EINVAL); 12149 } 12150 if (send_tsn_req && send_in_req) { 12151 /* error, can't do that */ 12152 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12153 return (EINVAL); 12154 } else if (send_in_req) { 12155 can_send_out_req = 1; 12156 } 12157 if (number_entries > (MCLBYTES - 12158 SCTP_MIN_OVERHEAD - 12159 sizeof(struct sctp_chunkhdr) - 12160 sizeof(struct sctp_stream_reset_out_request)) / 12161 sizeof(uint16_t)) { 12162 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12163 return (ENOMEM); 12164 } 12165 sctp_alloc_a_chunk(stcb, chk); 12166 if (chk == NULL) { 12167 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12168 return (ENOMEM); 12169 } 12170 chk->copy_by_ref = 0; 12171 chk->rec.chunk_id.id = SCTP_STREAM_RESET; 12172 chk->rec.chunk_id.can_take_data = 0; 12173 chk->flags = 0; 12174 chk->asoc = &stcb->asoc; 12175 chk->book_size = sizeof(struct sctp_chunkhdr); 12176 chk->send_size = SCTP_SIZE32(chk->book_size); 12177 chk->book_size_scale = 0; 12178 12179 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); 12180 if (chk->data == NULL) { 12181 sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED); 12182 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12183 return (ENOMEM); 12184 } 12185 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD); 12186 12187 /* setup chunk parameters */ 12188 chk->sent = SCTP_DATAGRAM_UNSENT; 12189 chk->snd_count = 0; 12190 if (stcb->asoc.alternate) { 12191 chk->whoTo = stcb->asoc.alternate; 12192 } else { 12193 chk->whoTo = stcb->asoc.primary_destination; 12194 } 12195 atomic_add_int(&chk->whoTo->ref_count, 1); 12196 ch = mtod(chk->data, struct sctp_chunkhdr *); 12197 ch->chunk_type = SCTP_STREAM_RESET; 12198 ch->chunk_flags = 0; 12199 ch->chunk_length = htons(chk->book_size); 12200 SCTP_BUF_LEN(chk->data) = chk->send_size; 12201 12202 seq = stcb->asoc.str_reset_seq_out; 12203 if (can_send_out_req) { 12204 int ret; 12205 12206 ret = sctp_add_stream_reset_out(stcb, chk, seq, (stcb->asoc.str_reset_seq_in - 1), (stcb->asoc.sending_seq - 1)); 12207 if (ret) { 12208 seq++; 12209 asoc->stream_reset_outstanding++; 12210 } 12211 } 12212 if ((add_stream & 1) && 12213 ((stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt) < adding_o)) { 12214 /* Need to allocate more */ 12215 struct sctp_stream_out *oldstream; 12216 struct sctp_stream_queue_pending *sp, *nsp; 12217 int i; 12218#if defined(SCTP_DETAILED_STR_STATS) 12219 int j; 12220#endif 12221 12222 oldstream = stcb->asoc.strmout; 12223 /* get some more */ 12224 SCTP_MALLOC(stcb->asoc.strmout, struct sctp_stream_out *, 12225 (stcb->asoc.streamoutcnt + adding_o) * sizeof(struct sctp_stream_out), 12226 SCTP_M_STRMO); 12227 if (stcb->asoc.strmout == NULL) { 12228 uint8_t x; 12229 12230 stcb->asoc.strmout = oldstream; 12231 /* Turn off the bit */ 12232 x = add_stream & 0xfe; 12233 add_stream = x; 12234 goto skip_stuff; 12235 } 12236 /* 12237 * Ok now we proceed with copying the old out stuff and 12238 * initializing the new stuff. 12239 */ 12240 SCTP_TCB_SEND_LOCK(stcb); 12241 stcb->asoc.ss_functions.sctp_ss_clear(stcb, &stcb->asoc, 0, 1); 12242 for (i = 0; i < stcb->asoc.streamoutcnt; i++) { 12243 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12244 stcb->asoc.strmout[i].chunks_on_queues = oldstream[i].chunks_on_queues; 12245 stcb->asoc.strmout[i].next_mid_ordered = oldstream[i].next_mid_ordered; 12246 stcb->asoc.strmout[i].next_mid_unordered = oldstream[i].next_mid_unordered; 12247 stcb->asoc.strmout[i].last_msg_incomplete = oldstream[i].last_msg_incomplete; 12248 stcb->asoc.strmout[i].sid = i; 12249 stcb->asoc.strmout[i].state = oldstream[i].state; 12250 /* FIX ME FIX ME */ 12251 /* 12252 * This should be a SS_COPY operation FIX ME STREAM 12253 * SCHEDULER EXPERT 12254 */ 12255 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], &oldstream[i]); 12256 /* now anything on those queues? */ 12257 TAILQ_FOREACH_SAFE(sp, &oldstream[i].outqueue, next, nsp) { 12258 TAILQ_REMOVE(&oldstream[i].outqueue, sp, next); 12259 TAILQ_INSERT_TAIL(&stcb->asoc.strmout[i].outqueue, sp, next); 12260 } 12261 12262 } 12263 /* now the new streams */ 12264 stcb->asoc.ss_functions.sctp_ss_init(stcb, &stcb->asoc, 1); 12265 for (i = stcb->asoc.streamoutcnt; i < (stcb->asoc.streamoutcnt + adding_o); i++) { 12266 TAILQ_INIT(&stcb->asoc.strmout[i].outqueue); 12267 stcb->asoc.strmout[i].chunks_on_queues = 0; 12268#if defined(SCTP_DETAILED_STR_STATS) 12269 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) { 12270 stcb->asoc.strmout[i].abandoned_sent[j] = 0; 12271 stcb->asoc.strmout[i].abandoned_unsent[j] = 0; 12272 } 12273#else 12274 stcb->asoc.strmout[i].abandoned_sent[0] = 0; 12275 stcb->asoc.strmout[i].abandoned_unsent[0] = 0; 12276#endif 12277 stcb->asoc.strmout[i].next_mid_ordered = 0; 12278 stcb->asoc.strmout[i].next_mid_unordered = 0; 12279 stcb->asoc.strmout[i].sid = i; 12280 stcb->asoc.strmout[i].last_msg_incomplete = 0; 12281 stcb->asoc.ss_functions.sctp_ss_init_stream(stcb, &stcb->asoc.strmout[i], NULL); 12282 stcb->asoc.strmout[i].state = SCTP_STREAM_CLOSED; 12283 } 12284 stcb->asoc.strm_realoutsize = stcb->asoc.streamoutcnt + adding_o; 12285 SCTP_FREE(oldstream, SCTP_M_STRMO); 12286 SCTP_TCB_SEND_UNLOCK(stcb); 12287 } 12288skip_stuff: 12289 if ((add_stream & 1) && (adding_o > 0)) { 12290 asoc->strm_pending_add_size = adding_o; 12291 asoc->peer_req_out = peer_asked; 12292 sctp_add_an_out_stream(chk, seq, adding_o); 12293 seq++; 12294 asoc->stream_reset_outstanding++; 12295 } 12296 if ((add_stream & 2) && (adding_i > 0)) { 12297 sctp_add_an_in_stream(chk, seq, adding_i); 12298 seq++; 12299 asoc->stream_reset_outstanding++; 12300 } 12301 if (send_in_req) { 12302 sctp_add_stream_reset_in(chk, number_entries, list, seq); 12303 seq++; 12304 asoc->stream_reset_outstanding++; 12305 } 12306 if (send_tsn_req) { 12307 sctp_add_stream_reset_tsn(chk, seq); 12308 asoc->stream_reset_outstanding++; 12309 } 12310 asoc->str_reset = chk; 12311 /* insert the chunk for sending */ 12312 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 12313 chk, 12314 sctp_next); 12315 asoc->ctrl_queue_cnt++; 12316 if (stcb->asoc.send_sack) { 12317 sctp_send_sack(stcb, SCTP_SO_LOCKED); 12318 } 12319 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 12320 return (0); 12321} 12322 12323void 12324sctp_send_abort(struct mbuf *m, int iphlen, struct sockaddr *src, struct sockaddr *dst, 12325 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12326 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12327 uint32_t vrf_id, uint16_t port) 12328{ 12329 /* Don't respond to an ABORT with an ABORT. */ 12330 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 12331 if (cause) 12332 sctp_m_freem(cause); 12333 return; 12334 } 12335 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_ABORT_ASSOCIATION, cause, 12336 mflowtype, mflowid, fibnum, 12337 vrf_id, port); 12338 return; 12339} 12340 12341void 12342sctp_send_operr_to(struct sockaddr *src, struct sockaddr *dst, 12343 struct sctphdr *sh, uint32_t vtag, struct mbuf *cause, 12344 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum, 12345 uint32_t vrf_id, uint16_t port) 12346{ 12347 sctp_send_resp_msg(src, dst, sh, vtag, SCTP_OPERATION_ERROR, cause, 12348 mflowtype, mflowid, fibnum, 12349 vrf_id, port); 12350 return; 12351} 12352 12353static struct mbuf * 12354sctp_copy_resume(struct uio *uio, 12355 int max_send_len, 12356 int user_marks_eor, 12357 int *error, 12358 uint32_t *sndout, 12359 struct mbuf **new_tail) 12360{ 12361 struct mbuf *m; 12362 12363 m = m_uiotombuf(uio, M_WAITOK, max_send_len, 0, 12364 (M_PKTHDR | (user_marks_eor ? M_EOR : 0))); 12365 if (m == NULL) { 12366 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12367 *error = ENOBUFS; 12368 } else { 12369 *sndout = m_length(m, NULL); 12370 *new_tail = m_last(m); 12371 } 12372 return (m); 12373} 12374 12375static int 12376sctp_copy_one(struct sctp_stream_queue_pending *sp, 12377 struct uio *uio, 12378 int resv_upfront) 12379{ 12380 sp->data = m_uiotombuf(uio, M_WAITOK, sp->length, 12381 resv_upfront, 0); 12382 if (sp->data == NULL) { 12383 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOBUFS); 12384 return (ENOBUFS); 12385 } 12386 sp->tail_mbuf = m_last(sp->data); 12387 return (0); 12388} 12389 12390 12391 12392static struct sctp_stream_queue_pending * 12393sctp_copy_it_in(struct sctp_tcb *stcb, 12394 struct sctp_association *asoc, 12395 struct sctp_sndrcvinfo *srcv, 12396 struct uio *uio, 12397 struct sctp_nets *net, 12398 int max_send_len, 12399 int user_marks_eor, 12400 int *error) 12401{ 12402 /*- 12403 * This routine must be very careful in its work. Protocol 12404 * processing is up and running so care must be taken to spl...() 12405 * when you need to do something that may effect the stcb/asoc. The 12406 * sb is locked however. When data is copied the protocol processing 12407 * should be enabled since this is a slower operation... 12408 */ 12409 struct sctp_stream_queue_pending *sp = NULL; 12410 int resv_in_first; 12411 12412 *error = 0; 12413 /* Now can we send this? */ 12414 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 12415 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12416 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12417 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12418 /* got data while shutting down */ 12419 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12420 *error = ECONNRESET; 12421 goto out_now; 12422 } 12423 sctp_alloc_a_strmoq(stcb, sp); 12424 if (sp == NULL) { 12425 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12426 *error = ENOMEM; 12427 goto out_now; 12428 } 12429 sp->act_flags = 0; 12430 sp->sender_all_done = 0; 12431 sp->sinfo_flags = srcv->sinfo_flags; 12432 sp->timetolive = srcv->sinfo_timetolive; 12433 sp->ppid = srcv->sinfo_ppid; 12434 sp->context = srcv->sinfo_context; 12435 sp->fsn = 0; 12436 (void)SCTP_GETTIME_TIMEVAL(&sp->ts); 12437 12438 sp->sid = srcv->sinfo_stream; 12439 sp->length = (uint32_t)min(uio->uio_resid, max_send_len); 12440 if ((sp->length == (uint32_t)uio->uio_resid) && 12441 ((user_marks_eor == 0) || 12442 (srcv->sinfo_flags & SCTP_EOF) || 12443 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 12444 sp->msg_is_complete = 1; 12445 } else { 12446 sp->msg_is_complete = 0; 12447 } 12448 sp->sender_all_done = 0; 12449 sp->some_taken = 0; 12450 sp->put_last_out = 0; 12451 resv_in_first = sizeof(struct sctp_data_chunk); 12452 sp->data = sp->tail_mbuf = NULL; 12453 if (sp->length == 0) { 12454 *error = 0; 12455 goto skip_copy; 12456 } 12457 if (srcv->sinfo_keynumber_valid) { 12458 sp->auth_keyid = srcv->sinfo_keynumber; 12459 } else { 12460 sp->auth_keyid = stcb->asoc.authinfo.active_keyid; 12461 } 12462 if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) { 12463 sctp_auth_key_acquire(stcb, sp->auth_keyid); 12464 sp->holds_key_ref = 1; 12465 } 12466 *error = sctp_copy_one(sp, uio, resv_in_first); 12467skip_copy: 12468 if (*error) { 12469 sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); 12470 sp = NULL; 12471 } else { 12472 if (sp->sinfo_flags & SCTP_ADDR_OVER) { 12473 sp->net = net; 12474 atomic_add_int(&sp->net->ref_count, 1); 12475 } else { 12476 sp->net = NULL; 12477 } 12478 sctp_set_prsctp_policy(sp); 12479 } 12480out_now: 12481 return (sp); 12482} 12483 12484 12485int 12486sctp_sosend(struct socket *so, 12487 struct sockaddr *addr, 12488 struct uio *uio, 12489 struct mbuf *top, 12490 struct mbuf *control, 12491 int flags, 12492 struct thread *p 12493) 12494{ 12495 int error, use_sndinfo = 0; 12496 struct sctp_sndrcvinfo sndrcvninfo; 12497 struct sockaddr *addr_to_use; 12498#if defined(INET) && defined(INET6) 12499 struct sockaddr_in sin; 12500#endif 12501 12502 if (control) { 12503 /* process cmsg snd/rcv info (maybe a assoc-id) */ 12504 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&sndrcvninfo, control, 12505 sizeof(sndrcvninfo))) { 12506 /* got one */ 12507 use_sndinfo = 1; 12508 } 12509 } 12510 addr_to_use = addr; 12511#if defined(INET) && defined(INET6) 12512 if ((addr) && (addr->sa_family == AF_INET6)) { 12513 struct sockaddr_in6 *sin6; 12514 12515 sin6 = (struct sockaddr_in6 *)addr; 12516 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 12517 in6_sin6_2_sin(&sin, sin6); 12518 addr_to_use = (struct sockaddr *)&sin; 12519 } 12520 } 12521#endif 12522 error = sctp_lower_sosend(so, addr_to_use, uio, top, 12523 control, 12524 flags, 12525 use_sndinfo ? &sndrcvninfo : NULL 12526 ,p 12527 ); 12528 return (error); 12529} 12530 12531 12532int 12533sctp_lower_sosend(struct socket *so, 12534 struct sockaddr *addr, 12535 struct uio *uio, 12536 struct mbuf *i_pak, 12537 struct mbuf *control, 12538 int flags, 12539 struct sctp_sndrcvinfo *srcv 12540 , 12541 struct thread *p 12542) 12543{ 12544 unsigned int sndlen = 0, max_len; 12545 int error, len; 12546 struct mbuf *top = NULL; 12547 int queue_only = 0, queue_only_for_init = 0; 12548 int free_cnt_applied = 0; 12549 int un_sent; 12550 int now_filled = 0; 12551 unsigned int inqueue_bytes = 0; 12552 struct sctp_block_entry be; 12553 struct sctp_inpcb *inp; 12554 struct sctp_tcb *stcb = NULL; 12555 struct timeval now; 12556 struct sctp_nets *net; 12557 struct sctp_association *asoc; 12558 struct sctp_inpcb *t_inp; 12559 int user_marks_eor; 12560 int create_lock_applied = 0; 12561 int nagle_applies = 0; 12562 int some_on_control = 0; 12563 int got_all_of_the_send = 0; 12564 int hold_tcblock = 0; 12565 int non_blocking = 0; 12566 uint32_t local_add_more, local_soresv = 0; 12567 uint16_t port; 12568 uint16_t sinfo_flags; 12569 sctp_assoc_t sinfo_assoc_id; 12570 12571 error = 0; 12572 net = NULL; 12573 stcb = NULL; 12574 asoc = NULL; 12575 12576 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 12577 if (inp == NULL) { 12578 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12579 error = EINVAL; 12580 if (i_pak) { 12581 SCTP_RELEASE_PKT(i_pak); 12582 } 12583 return (error); 12584 } 12585 if ((uio == NULL) && (i_pak == NULL)) { 12586 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12587 return (EINVAL); 12588 } 12589 user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR); 12590 atomic_add_int(&inp->total_sends, 1); 12591 if (uio) { 12592 if (uio->uio_resid < 0) { 12593 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12594 return (EINVAL); 12595 } 12596 sndlen = (unsigned int)uio->uio_resid; 12597 } else { 12598 top = SCTP_HEADER_TO_CHAIN(i_pak); 12599 sndlen = SCTP_HEADER_LEN(i_pak); 12600 } 12601 SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %d\n", 12602 (void *)addr, 12603 sndlen); 12604 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 12605 (inp->sctp_socket->so_qlimit)) { 12606 /* The listener can NOT send */ 12607 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12608 error = ENOTCONN; 12609 goto out_unlocked; 12610 } 12611 /** 12612 * Pre-screen address, if one is given the sin-len 12613 * must be set correctly! 12614 */ 12615 if (addr) { 12616 union sctp_sockstore *raddr = (union sctp_sockstore *)addr; 12617 12618 switch (raddr->sa.sa_family) { 12619#ifdef INET 12620 case AF_INET: 12621 if (raddr->sin.sin_len != sizeof(struct sockaddr_in)) { 12622 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12623 error = EINVAL; 12624 goto out_unlocked; 12625 } 12626 port = raddr->sin.sin_port; 12627 break; 12628#endif 12629#ifdef INET6 12630 case AF_INET6: 12631 if (raddr->sin6.sin6_len != sizeof(struct sockaddr_in6)) { 12632 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12633 error = EINVAL; 12634 goto out_unlocked; 12635 } 12636 port = raddr->sin6.sin6_port; 12637 break; 12638#endif 12639 default: 12640 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAFNOSUPPORT); 12641 error = EAFNOSUPPORT; 12642 goto out_unlocked; 12643 } 12644 } else 12645 port = 0; 12646 12647 if (srcv) { 12648 sinfo_flags = srcv->sinfo_flags; 12649 sinfo_assoc_id = srcv->sinfo_assoc_id; 12650 if (INVALID_SINFO_FLAG(sinfo_flags) || 12651 PR_SCTP_INVALID_POLICY(sinfo_flags)) { 12652 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12653 error = EINVAL; 12654 goto out_unlocked; 12655 } 12656 if (srcv->sinfo_flags) 12657 SCTP_STAT_INCR(sctps_sends_with_flags); 12658 } else { 12659 sinfo_flags = inp->def_send.sinfo_flags; 12660 sinfo_assoc_id = inp->def_send.sinfo_assoc_id; 12661 } 12662 if (sinfo_flags & SCTP_SENDALL) { 12663 /* its a sendall */ 12664 error = sctp_sendall(inp, uio, top, srcv); 12665 top = NULL; 12666 goto out_unlocked; 12667 } 12668 if ((sinfo_flags & SCTP_ADDR_OVER) && (addr == NULL)) { 12669 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12670 error = EINVAL; 12671 goto out_unlocked; 12672 } 12673 /* now we must find the assoc */ 12674 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) || 12675 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 12676 SCTP_INP_RLOCK(inp); 12677 stcb = LIST_FIRST(&inp->sctp_asoc_list); 12678 if (stcb) { 12679 SCTP_TCB_LOCK(stcb); 12680 hold_tcblock = 1; 12681 } 12682 SCTP_INP_RUNLOCK(inp); 12683 } else if (sinfo_assoc_id) { 12684 stcb = sctp_findassociation_ep_asocid(inp, sinfo_assoc_id, 1); 12685 if (stcb != NULL) { 12686 hold_tcblock = 1; 12687 } 12688 } else if (addr) { 12689 /*- 12690 * Since we did not use findep we must 12691 * increment it, and if we don't find a tcb 12692 * decrement it. 12693 */ 12694 SCTP_INP_WLOCK(inp); 12695 SCTP_INP_INCR_REF(inp); 12696 SCTP_INP_WUNLOCK(inp); 12697 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12698 if (stcb == NULL) { 12699 SCTP_INP_WLOCK(inp); 12700 SCTP_INP_DECR_REF(inp); 12701 SCTP_INP_WUNLOCK(inp); 12702 } else { 12703 hold_tcblock = 1; 12704 } 12705 } 12706 if ((stcb == NULL) && (addr)) { 12707 /* Possible implicit send? */ 12708 SCTP_ASOC_CREATE_LOCK(inp); 12709 create_lock_applied = 1; 12710 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 12711 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 12712 /* Should I really unlock ? */ 12713 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12714 error = EINVAL; 12715 goto out_unlocked; 12716 12717 } 12718 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 12719 (addr->sa_family == AF_INET6)) { 12720 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12721 error = EINVAL; 12722 goto out_unlocked; 12723 } 12724 SCTP_INP_WLOCK(inp); 12725 SCTP_INP_INCR_REF(inp); 12726 SCTP_INP_WUNLOCK(inp); 12727 /* With the lock applied look again */ 12728 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 12729 if ((stcb == NULL) && (control != NULL) && (port > 0)) { 12730 stcb = sctp_findassociation_cmsgs(&t_inp, port, control, &net, &error); 12731 } 12732 if (stcb == NULL) { 12733 SCTP_INP_WLOCK(inp); 12734 SCTP_INP_DECR_REF(inp); 12735 SCTP_INP_WUNLOCK(inp); 12736 } else { 12737 hold_tcblock = 1; 12738 } 12739 if (error) { 12740 goto out_unlocked; 12741 } 12742 if (t_inp != inp) { 12743 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN); 12744 error = ENOTCONN; 12745 goto out_unlocked; 12746 } 12747 } 12748 if (stcb == NULL) { 12749 if (addr == NULL) { 12750 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12751 error = ENOENT; 12752 goto out_unlocked; 12753 } else { 12754 /* We must go ahead and start the INIT process */ 12755 uint32_t vrf_id; 12756 12757 if ((sinfo_flags & SCTP_ABORT) || 12758 ((sinfo_flags & SCTP_EOF) && (sndlen == 0))) { 12759 /*- 12760 * User asks to abort a non-existant assoc, 12761 * or EOF a non-existant assoc with no data 12762 */ 12763 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT); 12764 error = ENOENT; 12765 goto out_unlocked; 12766 } 12767 /* get an asoc/stcb struct */ 12768 vrf_id = inp->def_vrf_id; 12769#ifdef INVARIANTS 12770 if (create_lock_applied == 0) { 12771 panic("Error, should hold create lock and I don't?"); 12772 } 12773#endif 12774 stcb = sctp_aloc_assoc(inp, addr, &error, 0, vrf_id, 12775 inp->sctp_ep.pre_open_stream_count, 12776 inp->sctp_ep.port, 12777 p); 12778 if (stcb == NULL) { 12779 /* Error is setup for us in the call */ 12780 goto out_unlocked; 12781 } 12782 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 12783 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 12784 /* 12785 * Set the connected flag so we can queue 12786 * data 12787 */ 12788 soisconnecting(so); 12789 } 12790 hold_tcblock = 1; 12791 if (create_lock_applied) { 12792 SCTP_ASOC_CREATE_UNLOCK(inp); 12793 create_lock_applied = 0; 12794 } else { 12795 SCTP_PRINTF("Huh-3? create lock should have been on??\n"); 12796 } 12797 /* 12798 * Turn on queue only flag to prevent data from 12799 * being sent 12800 */ 12801 queue_only = 1; 12802 asoc = &stcb->asoc; 12803 SCTP_SET_STATE(asoc, SCTP_STATE_COOKIE_WAIT); 12804 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 12805 12806 /* initialize authentication params for the assoc */ 12807 sctp_initialize_auth_params(inp, stcb); 12808 12809 if (control) { 12810 if (sctp_process_cmsgs_for_init(stcb, control, &error)) { 12811 sctp_free_assoc(inp, stcb, SCTP_PCBFREE_FORCE, 12812 SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5); 12813 hold_tcblock = 0; 12814 stcb = NULL; 12815 goto out_unlocked; 12816 } 12817 } 12818 /* out with the INIT */ 12819 queue_only_for_init = 1; 12820 /*- 12821 * we may want to dig in after this call and adjust the MTU 12822 * value. It defaulted to 1500 (constant) but the ro 12823 * structure may now have an update and thus we may need to 12824 * change it BEFORE we append the message. 12825 */ 12826 } 12827 } else 12828 asoc = &stcb->asoc; 12829 if (srcv == NULL) 12830 srcv = (struct sctp_sndrcvinfo *)&asoc->def_send; 12831 if (srcv->sinfo_flags & SCTP_ADDR_OVER) { 12832 if (addr) 12833 net = sctp_findnet(stcb, addr); 12834 else 12835 net = NULL; 12836 if ((net == NULL) || 12837 ((port != 0) && (port != stcb->rport))) { 12838 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12839 error = EINVAL; 12840 goto out_unlocked; 12841 } 12842 } else { 12843 if (stcb->asoc.alternate) { 12844 net = stcb->asoc.alternate; 12845 } else { 12846 net = stcb->asoc.primary_destination; 12847 } 12848 } 12849 atomic_add_int(&stcb->total_sends, 1); 12850 /* Keep the stcb from being freed under our feet */ 12851 atomic_add_int(&asoc->refcnt, 1); 12852 free_cnt_applied = 1; 12853 12854 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NO_FRAGMENT)) { 12855 if (sndlen > asoc->smallest_mtu) { 12856 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12857 error = EMSGSIZE; 12858 goto out_unlocked; 12859 } 12860 } 12861 if (SCTP_SO_IS_NBIO(so) 12862 || (flags & MSG_NBIO) 12863 ) { 12864 non_blocking = 1; 12865 } 12866 /* would we block? */ 12867 if (non_blocking) { 12868 if (hold_tcblock == 0) { 12869 SCTP_TCB_LOCK(stcb); 12870 hold_tcblock = 1; 12871 } 12872 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 12873 if ((SCTP_SB_LIMIT_SND(so) < (sndlen + inqueue_bytes + stcb->asoc.sb_send_resv)) || 12874 (stcb->asoc.chunks_on_out_queue >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 12875 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EWOULDBLOCK); 12876 if (sndlen > SCTP_SB_LIMIT_SND(so)) 12877 error = EMSGSIZE; 12878 else 12879 error = EWOULDBLOCK; 12880 goto out_unlocked; 12881 } 12882 stcb->asoc.sb_send_resv += sndlen; 12883 SCTP_TCB_UNLOCK(stcb); 12884 hold_tcblock = 0; 12885 } else { 12886 atomic_add_int(&stcb->asoc.sb_send_resv, sndlen); 12887 } 12888 local_soresv = sndlen; 12889 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 12890 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12891 error = ECONNRESET; 12892 goto out_unlocked; 12893 } 12894 if (create_lock_applied) { 12895 SCTP_ASOC_CREATE_UNLOCK(inp); 12896 create_lock_applied = 0; 12897 } 12898 /* Is the stream no. valid? */ 12899 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 12900 /* Invalid stream number */ 12901 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12902 error = EINVAL; 12903 goto out_unlocked; 12904 } 12905 if ((asoc->strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPEN) && 12906 (asoc->strmout[srcv->sinfo_stream].state != SCTP_STREAM_OPENING)) { 12907 /* 12908 * Can't queue any data while stream reset is underway. 12909 */ 12910 if (asoc->strmout[srcv->sinfo_stream].state > SCTP_STREAM_OPEN) { 12911 error = EAGAIN; 12912 } else { 12913 error = EINVAL; 12914 } 12915 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, error); 12916 goto out_unlocked; 12917 } 12918 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 12919 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 12920 queue_only = 1; 12921 } 12922 /* we are now done with all control */ 12923 if (control) { 12924 sctp_m_freem(control); 12925 control = NULL; 12926 } 12927 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 12928 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 12929 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 12930 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 12931 if (srcv->sinfo_flags & SCTP_ABORT) { 12932 ; 12933 } else { 12934 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 12935 error = ECONNRESET; 12936 goto out_unlocked; 12937 } 12938 } 12939 /* Ok, we will attempt a msgsnd :> */ 12940 if (p) { 12941 p->td_ru.ru_msgsnd++; 12942 } 12943 /* Are we aborting? */ 12944 if (srcv->sinfo_flags & SCTP_ABORT) { 12945 struct mbuf *mm; 12946 int tot_demand, tot_out = 0, max_out; 12947 12948 SCTP_STAT_INCR(sctps_sends_with_abort); 12949 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 12950 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 12951 /* It has to be up before we abort */ 12952 /* how big is the user initiated abort? */ 12953 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 12954 error = EINVAL; 12955 goto out; 12956 } 12957 if (hold_tcblock) { 12958 SCTP_TCB_UNLOCK(stcb); 12959 hold_tcblock = 0; 12960 } 12961 if (top) { 12962 struct mbuf *cntm = NULL; 12963 12964 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_WAITOK, 1, MT_DATA); 12965 if (sndlen != 0) { 12966 for (cntm = top; cntm; cntm = SCTP_BUF_NEXT(cntm)) { 12967 tot_out += SCTP_BUF_LEN(cntm); 12968 } 12969 } 12970 } else { 12971 /* Must fit in a MTU */ 12972 tot_out = sndlen; 12973 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 12974 if (tot_demand > SCTP_DEFAULT_ADD_MORE) { 12975 /* To big */ 12976 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 12977 error = EMSGSIZE; 12978 goto out; 12979 } 12980 mm = sctp_get_mbuf_for_msg(tot_demand, 0, M_WAITOK, 1, MT_DATA); 12981 } 12982 if (mm == NULL) { 12983 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM); 12984 error = ENOMEM; 12985 goto out; 12986 } 12987 max_out = asoc->smallest_mtu - sizeof(struct sctp_paramhdr); 12988 max_out -= sizeof(struct sctp_abort_msg); 12989 if (tot_out > max_out) { 12990 tot_out = max_out; 12991 } 12992 if (mm) { 12993 struct sctp_paramhdr *ph; 12994 12995 /* now move forward the data pointer */ 12996 ph = mtod(mm, struct sctp_paramhdr *); 12997 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 12998 ph->param_length = htons((uint16_t)(sizeof(struct sctp_paramhdr) + tot_out)); 12999 ph++; 13000 SCTP_BUF_LEN(mm) = tot_out + sizeof(struct sctp_paramhdr); 13001 if (top == NULL) { 13002 error = uiomove((caddr_t)ph, (int)tot_out, uio); 13003 if (error) { 13004 /*- 13005 * Here if we can't get his data we 13006 * still abort we just don't get to 13007 * send the users note :-0 13008 */ 13009 sctp_m_freem(mm); 13010 mm = NULL; 13011 } 13012 } else { 13013 if (sndlen != 0) { 13014 SCTP_BUF_NEXT(mm) = top; 13015 } 13016 } 13017 } 13018 if (hold_tcblock == 0) { 13019 SCTP_TCB_LOCK(stcb); 13020 } 13021 atomic_add_int(&stcb->asoc.refcnt, -1); 13022 free_cnt_applied = 0; 13023 /* release this lock, otherwise we hang on ourselves */ 13024 sctp_abort_an_association(stcb->sctp_ep, stcb, mm, SCTP_SO_LOCKED); 13025 /* now relock the stcb so everything is sane */ 13026 hold_tcblock = 0; 13027 stcb = NULL; 13028 /* 13029 * In this case top is already chained to mm avoid double 13030 * free, since we free it below if top != NULL and driver 13031 * would free it after sending the packet out 13032 */ 13033 if (sndlen != 0) { 13034 top = NULL; 13035 } 13036 goto out_unlocked; 13037 } 13038 /* Calculate the maximum we can send */ 13039 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 13040 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13041 if (non_blocking) { 13042 /* we already checked for non-blocking above. */ 13043 max_len = sndlen; 13044 } else { 13045 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13046 } 13047 } else { 13048 max_len = 0; 13049 } 13050 if (hold_tcblock) { 13051 SCTP_TCB_UNLOCK(stcb); 13052 hold_tcblock = 0; 13053 } 13054 if (asoc->strmout == NULL) { 13055 /* huh? software error */ 13056 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT); 13057 error = EFAULT; 13058 goto out_unlocked; 13059 } 13060 /* Unless E_EOR mode is on, we must make a send FIT in one call. */ 13061 if ((user_marks_eor == 0) && 13062 (sndlen > SCTP_SB_LIMIT_SND(stcb->sctp_socket))) { 13063 /* It will NEVER fit */ 13064 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE); 13065 error = EMSGSIZE; 13066 goto out_unlocked; 13067 } 13068 if ((uio == NULL) && user_marks_eor) { 13069 /*- 13070 * We do not support eeor mode for 13071 * sending with mbuf chains (like sendfile). 13072 */ 13073 SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13074 error = EINVAL; 13075 goto out_unlocked; 13076 } 13077 if (user_marks_eor) { 13078 local_add_more = min(SCTP_SB_LIMIT_SND(so), SCTP_BASE_SYSCTL(sctp_add_more_threshold)); 13079 } else { 13080 /*- 13081 * For non-eeor the whole message must fit in 13082 * the socket send buffer. 13083 */ 13084 local_add_more = sndlen; 13085 } 13086 len = 0; 13087 if (non_blocking) { 13088 goto skip_preblock; 13089 } 13090 if (((max_len <= local_add_more) && 13091 (SCTP_SB_LIMIT_SND(so) >= local_add_more)) || 13092 (max_len == 0) || 13093 ((stcb->asoc.chunks_on_out_queue + stcb->asoc.stream_queue_cnt) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13094 /* No room right now ! */ 13095 SOCKBUF_LOCK(&so->so_snd); 13096 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 13097 while ((SCTP_SB_LIMIT_SND(so) < (inqueue_bytes + local_add_more)) || 13098 ((stcb->asoc.stream_queue_cnt + stcb->asoc.chunks_on_out_queue) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) { 13099 SCTPDBG(SCTP_DEBUG_OUTPUT1, "pre_block limit:%u <(inq:%d + %d) || (%d+%d > %d)\n", 13100 (unsigned int)SCTP_SB_LIMIT_SND(so), 13101 inqueue_bytes, 13102 local_add_more, 13103 stcb->asoc.stream_queue_cnt, 13104 stcb->asoc.chunks_on_out_queue, 13105 SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)); 13106 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13107 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA, asoc, sndlen); 13108 } 13109 be.error = 0; 13110 stcb->block_entry = &be; 13111 error = sbwait(&so->so_snd); 13112 stcb->block_entry = NULL; 13113 if (error || so->so_error || be.error) { 13114 if (error == 0) { 13115 if (so->so_error) 13116 error = so->so_error; 13117 if (be.error) { 13118 error = be.error; 13119 } 13120 } 13121 SOCKBUF_UNLOCK(&so->so_snd); 13122 goto out_unlocked; 13123 } 13124 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13125 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13126 asoc, stcb->asoc.total_output_queue_size); 13127 } 13128 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13129 SOCKBUF_UNLOCK(&so->so_snd); 13130 goto out_unlocked; 13131 } 13132 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 13133 } 13134 if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) { 13135 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13136 } else { 13137 max_len = 0; 13138 } 13139 SOCKBUF_UNLOCK(&so->so_snd); 13140 } 13141skip_preblock: 13142 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13143 goto out_unlocked; 13144 } 13145 /* 13146 * sndlen covers for mbuf case uio_resid covers for the non-mbuf 13147 * case NOTE: uio will be null when top/mbuf is passed 13148 */ 13149 if (sndlen == 0) { 13150 if (srcv->sinfo_flags & SCTP_EOF) { 13151 got_all_of_the_send = 1; 13152 goto dataless_eof; 13153 } else { 13154 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13155 error = EINVAL; 13156 goto out; 13157 } 13158 } 13159 if (top == NULL) { 13160 struct sctp_stream_queue_pending *sp; 13161 struct sctp_stream_out *strm; 13162 uint32_t sndout; 13163 13164 SCTP_TCB_SEND_LOCK(stcb); 13165 if ((asoc->stream_locked) && 13166 (asoc->stream_locked_on != srcv->sinfo_stream)) { 13167 SCTP_TCB_SEND_UNLOCK(stcb); 13168 SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL); 13169 error = EINVAL; 13170 goto out; 13171 } 13172 SCTP_TCB_SEND_UNLOCK(stcb); 13173 13174 strm = &stcb->asoc.strmout[srcv->sinfo_stream]; 13175 if (strm->last_msg_incomplete == 0) { 13176 do_a_copy_in: 13177 sp = sctp_copy_it_in(stcb, asoc, srcv, uio, net, max_len, user_marks_eor, &error); 13178 if ((sp == NULL) || (error)) { 13179 goto out; 13180 } 13181 SCTP_TCB_SEND_LOCK(stcb); 13182 if (sp->msg_is_complete) { 13183 strm->last_msg_incomplete = 0; 13184 asoc->stream_locked = 0; 13185 } else { 13186 /* 13187 * Just got locked to this guy in case of an 13188 * interrupt. 13189 */ 13190 strm->last_msg_incomplete = 1; 13191 if (stcb->asoc.idata_supported == 0) { 13192 asoc->stream_locked = 1; 13193 asoc->stream_locked_on = srcv->sinfo_stream; 13194 } 13195 sp->sender_all_done = 0; 13196 } 13197 sctp_snd_sb_alloc(stcb, sp->length); 13198 atomic_add_int(&asoc->stream_queue_cnt, 1); 13199 if (srcv->sinfo_flags & SCTP_UNORDERED) { 13200 SCTP_STAT_INCR(sctps_sends_with_unord); 13201 } 13202 TAILQ_INSERT_TAIL(&strm->outqueue, sp, next); 13203 stcb->asoc.ss_functions.sctp_ss_add_to_stream(stcb, asoc, strm, sp, 1); 13204 SCTP_TCB_SEND_UNLOCK(stcb); 13205 } else { 13206 SCTP_TCB_SEND_LOCK(stcb); 13207 sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead); 13208 SCTP_TCB_SEND_UNLOCK(stcb); 13209 if (sp == NULL) { 13210 /* ???? Huh ??? last msg is gone */ 13211#ifdef INVARIANTS 13212 panic("Warning: Last msg marked incomplete, yet nothing left?"); 13213#else 13214 SCTP_PRINTF("Warning: Last msg marked incomplete, yet nothing left?\n"); 13215 strm->last_msg_incomplete = 0; 13216#endif 13217 goto do_a_copy_in; 13218 13219 } 13220 } 13221 while (uio->uio_resid > 0) { 13222 /* How much room do we have? */ 13223 struct mbuf *new_tail, *mm; 13224 13225 if (SCTP_SB_LIMIT_SND(so) > stcb->asoc.total_output_queue_size) 13226 max_len = SCTP_SB_LIMIT_SND(so) - stcb->asoc.total_output_queue_size; 13227 else 13228 max_len = 0; 13229 13230 if ((max_len > SCTP_BASE_SYSCTL(sctp_add_more_threshold)) || 13231 (max_len && (SCTP_SB_LIMIT_SND(so) < SCTP_BASE_SYSCTL(sctp_add_more_threshold))) || 13232 (uio->uio_resid && (uio->uio_resid <= (int)max_len))) { 13233 sndout = 0; 13234 new_tail = NULL; 13235 if (hold_tcblock) { 13236 SCTP_TCB_UNLOCK(stcb); 13237 hold_tcblock = 0; 13238 } 13239 mm = sctp_copy_resume(uio, max_len, user_marks_eor, &error, &sndout, &new_tail); 13240 if ((mm == NULL) || error) { 13241 if (mm) { 13242 sctp_m_freem(mm); 13243 } 13244 goto out; 13245 } 13246 /* Update the mbuf and count */ 13247 SCTP_TCB_SEND_LOCK(stcb); 13248 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13249 /* 13250 * we need to get out. Peer probably 13251 * aborted. 13252 */ 13253 sctp_m_freem(mm); 13254 if (stcb->asoc.state & SCTP_PCB_FLAGS_WAS_ABORTED) { 13255 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET); 13256 error = ECONNRESET; 13257 } 13258 SCTP_TCB_SEND_UNLOCK(stcb); 13259 goto out; 13260 } 13261 if (sp->tail_mbuf) { 13262 /* tack it to the end */ 13263 SCTP_BUF_NEXT(sp->tail_mbuf) = mm; 13264 sp->tail_mbuf = new_tail; 13265 } else { 13266 /* A stolen mbuf */ 13267 sp->data = mm; 13268 sp->tail_mbuf = new_tail; 13269 } 13270 sctp_snd_sb_alloc(stcb, sndout); 13271 atomic_add_int(&sp->length, sndout); 13272 len += sndout; 13273 if (srcv->sinfo_flags & SCTP_SACK_IMMEDIATELY) { 13274 sp->sinfo_flags |= SCTP_SACK_IMMEDIATELY; 13275 } 13276 /* Did we reach EOR? */ 13277 if ((uio->uio_resid == 0) && 13278 ((user_marks_eor == 0) || 13279 (srcv->sinfo_flags & SCTP_EOF) || 13280 (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) { 13281 sp->msg_is_complete = 1; 13282 } else { 13283 sp->msg_is_complete = 0; 13284 } 13285 SCTP_TCB_SEND_UNLOCK(stcb); 13286 } 13287 if (uio->uio_resid == 0) { 13288 /* got it all? */ 13289 continue; 13290 } 13291 /* PR-SCTP? */ 13292 if ((asoc->prsctp_supported) && (asoc->sent_queue_cnt_removeable > 0)) { 13293 /* 13294 * This is ugly but we must assure locking 13295 * order 13296 */ 13297 if (hold_tcblock == 0) { 13298 SCTP_TCB_LOCK(stcb); 13299 hold_tcblock = 1; 13300 } 13301 sctp_prune_prsctp(stcb, asoc, srcv, sndlen); 13302 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk)); 13303 if (SCTP_SB_LIMIT_SND(so) > stcb->asoc.total_output_queue_size) 13304 max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes; 13305 else 13306 max_len = 0; 13307 if (max_len > 0) { 13308 continue; 13309 } 13310 SCTP_TCB_UNLOCK(stcb); 13311 hold_tcblock = 0; 13312 } 13313 /* wait for space now */ 13314 if (non_blocking) { 13315 /* Non-blocking io in place out */ 13316 goto skip_out_eof; 13317 } 13318 /* What about the INIT, send it maybe */ 13319 if (queue_only_for_init) { 13320 if (hold_tcblock == 0) { 13321 SCTP_TCB_LOCK(stcb); 13322 hold_tcblock = 1; 13323 } 13324 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) { 13325 /* a collision took us forward? */ 13326 queue_only = 0; 13327 } else { 13328 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13329 SCTP_SET_STATE(asoc, SCTP_STATE_COOKIE_WAIT); 13330 queue_only = 1; 13331 } 13332 } 13333 if ((net->flight_size > net->cwnd) && 13334 (asoc->sctp_cmt_on_off == 0)) { 13335 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13336 queue_only = 1; 13337 } else if (asoc->ifp_had_enobuf) { 13338 SCTP_STAT_INCR(sctps_ifnomemqueued); 13339 if (net->flight_size > (2 * net->mtu)) { 13340 queue_only = 1; 13341 } 13342 asoc->ifp_had_enobuf = 0; 13343 } 13344 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 13345 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 13346 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13347 (stcb->asoc.total_flight > 0) && 13348 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13349 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13350 13351 /*- 13352 * Ok, Nagle is set on and we have data outstanding. 13353 * Don't send anything and let SACKs drive out the 13354 * data unless we have a "full" segment to send. 13355 */ 13356 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13357 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13358 } 13359 SCTP_STAT_INCR(sctps_naglequeued); 13360 nagle_applies = 1; 13361 } else { 13362 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13363 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13364 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13365 } 13366 SCTP_STAT_INCR(sctps_naglesent); 13367 nagle_applies = 0; 13368 } 13369 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13370 13371 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13372 nagle_applies, un_sent); 13373 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13374 stcb->asoc.total_flight, 13375 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13376 } 13377 if (queue_only_for_init) 13378 queue_only_for_init = 0; 13379 if ((queue_only == 0) && (nagle_applies == 0)) { 13380 /*- 13381 * need to start chunk output 13382 * before blocking.. note that if 13383 * a lock is already applied, then 13384 * the input via the net is happening 13385 * and I don't need to start output :-D 13386 */ 13387 if (hold_tcblock == 0) { 13388 if (SCTP_TCB_TRYLOCK(stcb)) { 13389 hold_tcblock = 1; 13390 sctp_chunk_output(inp, 13391 stcb, 13392 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13393 } 13394 } else { 13395 sctp_chunk_output(inp, 13396 stcb, 13397 SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13398 } 13399 if (hold_tcblock == 1) { 13400 SCTP_TCB_UNLOCK(stcb); 13401 hold_tcblock = 0; 13402 } 13403 } 13404 SOCKBUF_LOCK(&so->so_snd); 13405 /*- 13406 * This is a bit strange, but I think it will 13407 * work. The total_output_queue_size is locked and 13408 * protected by the TCB_LOCK, which we just released. 13409 * There is a race that can occur between releasing it 13410 * above, and me getting the socket lock, where sacks 13411 * come in but we have not put the SB_WAIT on the 13412 * so_snd buffer to get the wakeup. After the LOCK 13413 * is applied the sack_processing will also need to 13414 * LOCK the so->so_snd to do the actual sowwakeup(). So 13415 * once we have the socket buffer lock if we recheck the 13416 * size we KNOW we will get to sleep safely with the 13417 * wakeup flag in place. 13418 */ 13419 if (SCTP_SB_LIMIT_SND(so) <= (stcb->asoc.total_output_queue_size + 13420 min(SCTP_BASE_SYSCTL(sctp_add_more_threshold), SCTP_SB_LIMIT_SND(so)))) { 13421 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13422 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 13423 asoc, (size_t)uio->uio_resid); 13424 } 13425 be.error = 0; 13426 stcb->block_entry = &be; 13427 error = sbwait(&so->so_snd); 13428 stcb->block_entry = NULL; 13429 13430 if (error || so->so_error || be.error) { 13431 if (error == 0) { 13432 if (so->so_error) 13433 error = so->so_error; 13434 if (be.error) { 13435 error = be.error; 13436 } 13437 } 13438 SOCKBUF_UNLOCK(&so->so_snd); 13439 goto out_unlocked; 13440 } 13441 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13442 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 13443 asoc, stcb->asoc.total_output_queue_size); 13444 } 13445 } 13446 SOCKBUF_UNLOCK(&so->so_snd); 13447 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13448 goto out_unlocked; 13449 } 13450 } 13451 SCTP_TCB_SEND_LOCK(stcb); 13452 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { 13453 SCTP_TCB_SEND_UNLOCK(stcb); 13454 goto out_unlocked; 13455 } 13456 if (sp) { 13457 if (sp->msg_is_complete == 0) { 13458 strm->last_msg_incomplete = 1; 13459 if (stcb->asoc.idata_supported == 0) { 13460 asoc->stream_locked = 1; 13461 asoc->stream_locked_on = srcv->sinfo_stream; 13462 } 13463 } else { 13464 sp->sender_all_done = 1; 13465 strm->last_msg_incomplete = 0; 13466 asoc->stream_locked = 0; 13467 } 13468 } else { 13469 SCTP_PRINTF("Huh no sp TSNH?\n"); 13470 strm->last_msg_incomplete = 0; 13471 asoc->stream_locked = 0; 13472 } 13473 SCTP_TCB_SEND_UNLOCK(stcb); 13474 if (uio->uio_resid == 0) { 13475 got_all_of_the_send = 1; 13476 } 13477 } else { 13478 /* We send in a 0, since we do NOT have any locks */ 13479 error = sctp_msg_append(stcb, net, top, srcv, 0); 13480 top = NULL; 13481 if (srcv->sinfo_flags & SCTP_EOF) { 13482 /* 13483 * This should only happen for Panda for the mbuf 13484 * send case, which does NOT yet support EEOR mode. 13485 * Thus, we can just set this flag to do the proper 13486 * EOF handling. 13487 */ 13488 got_all_of_the_send = 1; 13489 } 13490 } 13491 if (error) { 13492 goto out; 13493 } 13494dataless_eof: 13495 /* EOF thing ? */ 13496 if ((srcv->sinfo_flags & SCTP_EOF) && 13497 (got_all_of_the_send == 1)) { 13498 SCTP_STAT_INCR(sctps_sends_with_eof); 13499 error = 0; 13500 if (hold_tcblock == 0) { 13501 SCTP_TCB_LOCK(stcb); 13502 hold_tcblock = 1; 13503 } 13504 if (TAILQ_EMPTY(&asoc->send_queue) && 13505 TAILQ_EMPTY(&asoc->sent_queue) && 13506 sctp_is_there_unsent_data(stcb, SCTP_SO_LOCKED) == 0) { 13507 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13508 goto abort_anyway; 13509 } 13510 /* there is nothing queued to send, so I'm done... */ 13511 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 13512 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13513 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13514 struct sctp_nets *netp; 13515 13516 /* only send SHUTDOWN the first time through */ 13517 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) { 13518 SCTP_STAT_DECR_GAUGE32(sctps_currestab); 13519 } 13520 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT); 13521 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING); 13522 sctp_stop_timers_for_shutdown(stcb); 13523 if (stcb->asoc.alternate) { 13524 netp = stcb->asoc.alternate; 13525 } else { 13526 netp = stcb->asoc.primary_destination; 13527 } 13528 sctp_send_shutdown(stcb, netp); 13529 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 13530 netp); 13531 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13532 asoc->primary_destination); 13533 } 13534 } else { 13535 /*- 13536 * we still got (or just got) data to send, so set 13537 * SHUTDOWN_PENDING 13538 */ 13539 /*- 13540 * XXX sockets draft says that SCTP_EOF should be 13541 * sent with no data. currently, we will allow user 13542 * data to be sent first and move to 13543 * SHUTDOWN-PENDING 13544 */ 13545 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 13546 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 13547 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 13548 if (hold_tcblock == 0) { 13549 SCTP_TCB_LOCK(stcb); 13550 hold_tcblock = 1; 13551 } 13552 if ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc)) { 13553 asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT; 13554 } 13555 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 13556 if (TAILQ_EMPTY(&asoc->send_queue) && 13557 TAILQ_EMPTY(&asoc->sent_queue) && 13558 (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) { 13559 struct mbuf *op_err; 13560 char msg[SCTP_DIAG_INFO_LEN]; 13561 13562 abort_anyway: 13563 if (free_cnt_applied) { 13564 atomic_add_int(&stcb->asoc.refcnt, -1); 13565 free_cnt_applied = 0; 13566 } 13567 snprintf(msg, sizeof(msg), 13568 "%s:%d at %s", __FILE__, __LINE__, __func__); 13569 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code), 13570 msg); 13571 sctp_abort_an_association(stcb->sctp_ep, stcb, 13572 op_err, SCTP_SO_LOCKED); 13573 /* 13574 * now relock the stcb so everything 13575 * is sane 13576 */ 13577 hold_tcblock = 0; 13578 stcb = NULL; 13579 goto out; 13580 } 13581 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 13582 asoc->primary_destination); 13583 sctp_feature_off(inp, SCTP_PCB_FLAGS_NODELAY); 13584 } 13585 } 13586 } 13587skip_out_eof: 13588 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 13589 some_on_control = 1; 13590 } 13591 if (queue_only_for_init) { 13592 if (hold_tcblock == 0) { 13593 SCTP_TCB_LOCK(stcb); 13594 hold_tcblock = 1; 13595 } 13596 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) { 13597 /* a collision took us forward? */ 13598 queue_only = 0; 13599 } else { 13600 sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED); 13601 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_WAIT); 13602 queue_only = 1; 13603 } 13604 } 13605 if ((net->flight_size > net->cwnd) && 13606 (stcb->asoc.sctp_cmt_on_off == 0)) { 13607 SCTP_STAT_INCR(sctps_send_cwnd_avoid); 13608 queue_only = 1; 13609 } else if (asoc->ifp_had_enobuf) { 13610 SCTP_STAT_INCR(sctps_ifnomemqueued); 13611 if (net->flight_size > (2 * net->mtu)) { 13612 queue_only = 1; 13613 } 13614 asoc->ifp_had_enobuf = 0; 13615 } 13616 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 13617 (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk))); 13618 if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) && 13619 (stcb->asoc.total_flight > 0) && 13620 (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) && 13621 (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) { 13622 /*- 13623 * Ok, Nagle is set on and we have data outstanding. 13624 * Don't send anything and let SACKs drive out the 13625 * data unless wen have a "full" segment to send. 13626 */ 13627 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13628 sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED); 13629 } 13630 SCTP_STAT_INCR(sctps_naglequeued); 13631 nagle_applies = 1; 13632 } else { 13633 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) { 13634 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) 13635 sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED); 13636 } 13637 SCTP_STAT_INCR(sctps_naglesent); 13638 nagle_applies = 0; 13639 } 13640 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { 13641 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only, 13642 nagle_applies, un_sent); 13643 sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size, 13644 stcb->asoc.total_flight, 13645 stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count); 13646 } 13647 if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) { 13648 /* we can attempt to send too. */ 13649 if (hold_tcblock == 0) { 13650 /* 13651 * If there is activity recv'ing sacks no need to 13652 * send 13653 */ 13654 if (SCTP_TCB_TRYLOCK(stcb)) { 13655 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13656 hold_tcblock = 1; 13657 } 13658 } else { 13659 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13660 } 13661 } else if ((queue_only == 0) && 13662 (stcb->asoc.peers_rwnd == 0) && 13663 (stcb->asoc.total_flight == 0)) { 13664 /* We get to have a probe outstanding */ 13665 if (hold_tcblock == 0) { 13666 hold_tcblock = 1; 13667 SCTP_TCB_LOCK(stcb); 13668 } 13669 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED); 13670 } else if (some_on_control) { 13671 int num_out, reason, frag_point; 13672 13673 /* Here we do control only */ 13674 if (hold_tcblock == 0) { 13675 hold_tcblock = 1; 13676 SCTP_TCB_LOCK(stcb); 13677 } 13678 frag_point = sctp_get_frag_point(stcb, &stcb->asoc); 13679 (void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 13680 &reason, 1, 1, &now, &now_filled, frag_point, SCTP_SO_LOCKED); 13681 } 13682 SCTPDBG(SCTP_DEBUG_OUTPUT1, "USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d err:%d\n", 13683 queue_only, stcb->asoc.peers_rwnd, un_sent, 13684 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue, 13685 stcb->asoc.total_output_queue_size, error); 13686 13687out: 13688out_unlocked: 13689 13690 if (local_soresv && stcb) { 13691 atomic_subtract_int(&stcb->asoc.sb_send_resv, sndlen); 13692 } 13693 if (create_lock_applied) { 13694 SCTP_ASOC_CREATE_UNLOCK(inp); 13695 } 13696 if ((stcb) && hold_tcblock) { 13697 SCTP_TCB_UNLOCK(stcb); 13698 } 13699 if (stcb && free_cnt_applied) { 13700 atomic_add_int(&stcb->asoc.refcnt, -1); 13701 } 13702#ifdef INVARIANTS 13703 if (stcb) { 13704 if (mtx_owned(&stcb->tcb_mtx)) { 13705 panic("Leaving with tcb mtx owned?"); 13706 } 13707 if (mtx_owned(&stcb->tcb_send_mtx)) { 13708 panic("Leaving with tcb send mtx owned?"); 13709 } 13710 } 13711#endif 13712 if (top) { 13713 sctp_m_freem(top); 13714 } 13715 if (control) { 13716 sctp_m_freem(control); 13717 } 13718 return (error); 13719} 13720 13721 13722/* 13723 * generate an AUTHentication chunk, if required 13724 */ 13725struct mbuf * 13726sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end, 13727 struct sctp_auth_chunk **auth_ret, uint32_t *offset, 13728 struct sctp_tcb *stcb, uint8_t chunk) 13729{ 13730 struct mbuf *m_auth; 13731 struct sctp_auth_chunk *auth; 13732 int chunk_len; 13733 struct mbuf *cn; 13734 13735 if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) || 13736 (stcb == NULL)) 13737 return (m); 13738 13739 if (stcb->asoc.auth_supported == 0) { 13740 return (m); 13741 } 13742 /* does the requested chunk require auth? */ 13743 if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) { 13744 return (m); 13745 } 13746 m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_NOWAIT, 1, MT_HEADER); 13747 if (m_auth == NULL) { 13748 /* no mbuf's */ 13749 return (m); 13750 } 13751 /* reserve some space if this will be the first mbuf */ 13752 if (m == NULL) 13753 SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD); 13754 /* fill in the AUTH chunk details */ 13755 auth = mtod(m_auth, struct sctp_auth_chunk *); 13756 bzero(auth, sizeof(*auth)); 13757 auth->ch.chunk_type = SCTP_AUTHENTICATION; 13758 auth->ch.chunk_flags = 0; 13759 chunk_len = sizeof(*auth) + 13760 sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id); 13761 auth->ch.chunk_length = htons(chunk_len); 13762 auth->hmac_id = htons(stcb->asoc.peer_hmac_id); 13763 /* key id and hmac digest will be computed and filled in upon send */ 13764 13765 /* save the offset where the auth was inserted into the chain */ 13766 *offset = 0; 13767 for (cn = m; cn; cn = SCTP_BUF_NEXT(cn)) { 13768 *offset += SCTP_BUF_LEN(cn); 13769 } 13770 13771 /* update length and return pointer to the auth chunk */ 13772 SCTP_BUF_LEN(m_auth) = chunk_len; 13773 m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0); 13774 if (auth_ret != NULL) 13775 *auth_ret = auth; 13776 13777 return (m); 13778} 13779 13780#ifdef INET6 13781int 13782sctp_v6src_match_nexthop(struct sockaddr_in6 *src6, sctp_route_t *ro) 13783{ 13784 struct nd_prefix *pfx = NULL; 13785 struct nd_pfxrouter *pfxrtr = NULL; 13786 struct sockaddr_in6 gw6; 13787 13788 if (ro == NULL || ro->ro_rt == NULL || src6->sin6_family != AF_INET6) 13789 return (0); 13790 13791 /* get prefix entry of address */ 13792 ND6_RLOCK(); 13793 LIST_FOREACH(pfx, &MODULE_GLOBAL(nd_prefix), ndpr_entry) { 13794 if (pfx->ndpr_stateflags & NDPRF_DETACHED) 13795 continue; 13796 if (IN6_ARE_MASKED_ADDR_EQUAL(&pfx->ndpr_prefix.sin6_addr, 13797 &src6->sin6_addr, &pfx->ndpr_mask)) 13798 break; 13799 } 13800 /* no prefix entry in the prefix list */ 13801 if (pfx == NULL) { 13802 ND6_RUNLOCK(); 13803 SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefix entry for "); 13804 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13805 return (0); 13806 } 13807 SCTPDBG(SCTP_DEBUG_OUTPUT2, "v6src_match_nexthop(), Prefix entry is "); 13808 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6); 13809 13810 /* search installed gateway from prefix entry */ 13811 LIST_FOREACH(pfxrtr, &pfx->ndpr_advrtrs, pfr_entry) { 13812 memset(&gw6, 0, sizeof(struct sockaddr_in6)); 13813 gw6.sin6_family = AF_INET6; 13814 gw6.sin6_len = sizeof(struct sockaddr_in6); 13815 memcpy(&gw6.sin6_addr, &pfxrtr->router->rtaddr, 13816 sizeof(struct in6_addr)); 13817 SCTPDBG(SCTP_DEBUG_OUTPUT2, "prefix router is "); 13818 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&gw6); 13819 SCTPDBG(SCTP_DEBUG_OUTPUT2, "installed router is "); 13820 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway); 13821 if (sctp_cmpaddr((struct sockaddr *)&gw6, ro->ro_rt->rt_gateway)) { 13822 ND6_RUNLOCK(); 13823 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is installed\n"); 13824 ND6_RUNLOCK(); 13825 return (1); 13826 } 13827 } 13828 ND6_RUNLOCK(); 13829 SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is not installed\n"); 13830 return (0); 13831} 13832#endif 13833 13834int 13835sctp_v4src_match_nexthop(struct sctp_ifa *sifa, sctp_route_t *ro) 13836{ 13837#ifdef INET 13838 struct sockaddr_in *sin, *mask; 13839 struct ifaddr *ifa; 13840 struct in_addr srcnetaddr, gwnetaddr; 13841 13842 if (ro == NULL || ro->ro_rt == NULL || 13843 sifa->address.sa.sa_family != AF_INET) { 13844 return (0); 13845 } 13846 ifa = (struct ifaddr *)sifa->ifa; 13847 mask = (struct sockaddr_in *)(ifa->ifa_netmask); 13848 sin = &sifa->address.sin; 13849 srcnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13850 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: src address is "); 13851 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa); 13852 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", srcnetaddr.s_addr); 13853 13854 sin = (struct sockaddr_in *)ro->ro_rt->rt_gateway; 13855 gwnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr); 13856 SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: nexthop is "); 13857 SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway); 13858 SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", gwnetaddr.s_addr); 13859 if (srcnetaddr.s_addr == gwnetaddr.s_addr) { 13860 return (1); 13861 } 13862#endif 13863 return (0); 13864} 13865