1 /* $KAME: sctp_input.c,v 1.28 2005/04/21 18:36:21 nishida Exp $ */ 2 /* $NetBSD: sctp_input.c,v 1.18 2024/07/05 04:31:54 rin Exp $ */ 3 4 /* 5 * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc, 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: sctp_input.c,v 1.18 2024/07/05 04:31:54 rin Exp $"); 35 36 #ifdef _KERNEL_OPT 37 #include "opt_ipsec.h" 38 #include "opt_inet.h" 39 #include "opt_sctp.h" 40 #endif /* _KERNEL_OPT */ 41 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/malloc.h> 45 #include <sys/mbuf.h> 46 #include <sys/socket.h> 47 #include <sys/socketvar.h> 48 #include <sys/sysctl.h> 49 #include <sys/domain.h> 50 #include <sys/protosw.h> 51 #include <sys/kernel.h> 52 #include <sys/errno.h> 53 #include <sys/syslog.h> 54 55 #include <machine/limits.h> 56 #include <machine/cpu.h> 57 58 #include <net/if.h> 59 #include <net/route.h> 60 #include <net/if_types.h> 61 62 #include <netinet/in.h> 63 #include <netinet/in_systm.h> 64 #include <netinet/ip.h> 65 #include <netinet/in_pcb.h> 66 #include <netinet/in_var.h> 67 #include <netinet/ip_var.h> 68 69 #ifdef INET6 70 #include <netinet/ip6.h> 71 #include <netinet6/ip6_var.h> 72 #endif /* INET6 */ 73 74 #include <netinet/ip_icmp.h> 75 #include <netinet/icmp_var.h> 76 #include <netinet/sctp_var.h> 77 #include <netinet/sctp_pcb.h> 78 #include <netinet/sctp_header.h> 79 #include <netinet/sctputil.h> 80 #include <netinet/sctp_output.h> 81 #include <netinet/sctp_input.h> 82 #include <netinet/sctp_hashdriver.h> 83 #include <netinet/sctp_indata.h> 84 #include <netinet/sctp_asconf.h> 85 86 #ifdef IPSEC 87 #include <netipsec/ipsec.h> 88 #include <netipsec/key.h> 89 #endif /*IPSEC*/ 90 91 #ifdef SCTP_DEBUG 92 extern u_int32_t sctp_debug_on; 93 #endif 94 95 /* INIT handler */ 96 static void 97 sctp_handle_init(struct mbuf *m, int iphlen, int offset, 98 struct sctphdr *sh, struct sctp_init_chunk *cp, struct sctp_inpcb *inp, 99 struct sctp_tcb *stcb, struct sctp_nets *net) 100 { 101 struct sctp_init *init; 102 struct mbuf *op_err; 103 #ifdef SCTP_DEBUG 104 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 105 printf("sctp_handle_init: handling INIT tcb:%p\n", stcb); 106 } 107 #endif 108 op_err = NULL; 109 init = &cp->init; 110 /* First are we accepting? */ 111 if (((inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING) == 0) || 112 (inp->sctp_socket->so_qlimit == 0)) { 113 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 114 return; 115 } 116 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) { 117 /* Invalid length */ 118 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 119 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 120 return; 121 } 122 /* validate parameters */ 123 if (init->initiate_tag == 0) { 124 /* protocol error... send abort */ 125 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 126 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 127 return; 128 } 129 if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) { 130 /* invalid parameter... send abort */ 131 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 132 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 133 return; 134 } 135 if (init->num_inbound_streams == 0) { 136 /* protocol error... send abort */ 137 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 138 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 139 return; 140 } 141 if (init->num_outbound_streams == 0) { 142 /* protocol error... send abort */ 143 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 144 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err); 145 return; 146 } 147 148 /* send an INIT-ACK w/cookie */ 149 #ifdef SCTP_DEBUG 150 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 151 printf("sctp_handle_init: sending INIT-ACK\n"); 152 } 153 #endif 154 155 sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp); 156 } 157 158 /* 159 * process peer "INIT/INIT-ACK" chunk 160 * returns value < 0 on error 161 */ 162 163 static int 164 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb, 165 struct sctp_nets *net) 166 { 167 struct sctp_init *init; 168 struct sctp_association *asoc; 169 struct sctp_nets *lnet; 170 unsigned int i; 171 172 init = &cp->init; 173 asoc = &stcb->asoc; 174 /* save off parameters */ 175 asoc->peer_vtag = ntohl(init->initiate_tag); 176 asoc->peers_rwnd = ntohl(init->a_rwnd); 177 178 if (TAILQ_FIRST(&asoc->nets)) { 179 /* update any ssthresh's that may have a default */ 180 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 181 lnet->ssthresh = asoc->peers_rwnd; 182 } 183 } 184 if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) { 185 unsigned int newcnt; 186 struct sctp_stream_out *outs; 187 struct sctp_tmit_chunk *chk; 188 189 /* cut back on number of streams */ 190 newcnt = ntohs(init->num_inbound_streams); 191 /* This if is probably not needed but I am cautious */ 192 if (asoc->strmout) { 193 /* First make sure no data chunks are trapped */ 194 for (i=newcnt; i < asoc->pre_open_streams; i++) { 195 outs = &asoc->strmout[i]; 196 chk = TAILQ_FIRST(&outs->outqueue); 197 while (chk) { 198 TAILQ_REMOVE(&outs->outqueue, chk, 199 sctp_next); 200 asoc->stream_queue_cnt--; 201 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, 202 stcb, SCTP_NOTIFY_DATAGRAM_UNSENT, 203 chk); 204 sctp_m_freem(chk->data); 205 chk->data = NULL; 206 sctp_free_remote_addr(chk->whoTo); 207 chk->whoTo = NULL; 208 chk->asoc = NULL; 209 /* Free the chunk */ 210 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 211 sctppcbinfo.ipi_count_chunk--; 212 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 213 panic("Chunk count is negative"); 214 } 215 sctppcbinfo.ipi_gencnt_chunk++; 216 chk = TAILQ_FIRST(&outs->outqueue); 217 } 218 } 219 } 220 /* cut back the count and abandon the upper streams */ 221 asoc->pre_open_streams = newcnt; 222 } 223 asoc->streamincnt = ntohs(init->num_outbound_streams); 224 if (asoc->streamincnt > MAX_SCTP_STREAMS) { 225 asoc->streamincnt = MAX_SCTP_STREAMS; 226 } 227 228 asoc->streamoutcnt = asoc->pre_open_streams; 229 /* init tsn's */ 230 asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1; 231 #ifdef SCTP_MAP_LOGGING 232 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 233 #endif 234 /* This is the next one we expect */ 235 asoc->str_reset_seq_in = asoc->asconf_seq_in + 1; 236 237 asoc->mapping_array_base_tsn = ntohl(init->initial_tsn); 238 asoc->cumulative_tsn = asoc->asconf_seq_in; 239 asoc->last_echo_tsn = asoc->asconf_seq_in; 240 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 241 /* open the requested streams */ 242 if (asoc->strmin != NULL) { 243 /* Free the old ones */ 244 free(asoc->strmin, M_PCB); 245 } 246 asoc->strmin = malloc(asoc->streamincnt * sizeof(struct sctp_stream_in), 247 M_PCB, M_NOWAIT); 248 if (asoc->strmin == NULL) { 249 /* we didn't get memory for the streams! */ 250 #ifdef SCTP_DEBUG 251 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 252 printf("process_init: couldn't get memory for the streams!\n"); 253 } 254 #endif 255 return (-1); 256 } 257 for (i = 0; i < asoc->streamincnt; i++) { 258 asoc->strmin[i].stream_no = i; 259 asoc->strmin[i].last_sequence_delivered = 0xffff; 260 /* 261 * U-stream ranges will be set when the cookie 262 * is unpacked. Or for the INIT sender they 263 * are un set (if pr-sctp not supported) when the 264 * INIT-ACK arrives. 265 */ 266 TAILQ_INIT(&asoc->strmin[i].inqueue); 267 /* 268 * we are not on any wheel, pr-sctp streams 269 * will go on the wheel when they have data waiting 270 * for reorder. 271 */ 272 asoc->strmin[i].next_spoke.tqe_next = 0; 273 asoc->strmin[i].next_spoke.tqe_prev = 0; 274 } 275 276 /* 277 * load_address_from_init will put the addresses into the 278 * association when the COOKIE is processed or the INIT-ACK 279 * is processed. Both types of COOKIE's existing and new 280 * call this routine. It will remove addresses that 281 * are no longer in the association (for the restarting 282 * case where addresses are removed). Up front when the 283 * INIT arrives we will discard it if it is a restart 284 * and new addresses have been added. 285 */ 286 return (0); 287 } 288 289 /* 290 * INIT-ACK message processing/consumption 291 * returns value < 0 on error 292 */ 293 static int 294 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset, 295 struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 296 struct sctp_nets *net) 297 { 298 struct sctp_association *asoc; 299 struct mbuf *op_err; 300 int retval, abort_flag; 301 uint32_t initack_limit; 302 /* First verify that we have no illegal param's */ 303 abort_flag = 0; 304 op_err = NULL; 305 306 op_err = sctp_arethere_unrecognized_parameters(m, 307 (offset+sizeof(struct sctp_init_chunk)) , 308 &abort_flag, (struct sctp_chunkhdr *)cp); 309 if (abort_flag) { 310 /* Send an abort and notify peer */ 311 if (op_err != NULL) { 312 sctp_send_operr_to(m, iphlen, op_err, cp->init.initiate_tag); 313 } else { 314 /* 315 * Just notify (abort_assoc does this if 316 * we send an abort). 317 */ 318 sctp_abort_notification(stcb, 0); 319 /* 320 * No sense in further INIT's since 321 * we will get the same param back 322 */ 323 sctp_free_assoc(stcb->sctp_ep, stcb); 324 } 325 return (-1); 326 } 327 asoc = &stcb->asoc; 328 /* process the peer's parameters in the INIT-ACK */ 329 retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net); 330 if (retval < 0) { 331 return (retval); 332 } 333 334 initack_limit = offset + ntohs(cp->ch.chunk_length); 335 /* load all addresses */ 336 if (sctp_load_addresses_from_init(stcb, m, iphlen, 337 (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh, 338 NULL)) { 339 /* Huh, we should abort */ 340 sctp_abort_notification(stcb, 0); 341 sctp_free_assoc(stcb->sctp_ep, stcb); 342 return (-1); 343 } 344 if (op_err) { 345 sctp_queue_op_err(stcb, op_err); 346 /* queuing will steal away the mbuf chain to the out queue */ 347 op_err = NULL; 348 } 349 /* extract the cookie and queue it to "echo" it back... */ 350 stcb->asoc.overall_error_count = 0; 351 net->error_count = 0; 352 retval = sctp_send_cookie_echo(m, offset, stcb, net); 353 if (retval < 0) { 354 /* 355 * No cookie, we probably should send a op error. 356 * But in any case if there is no cookie in the INIT-ACK, 357 * we can abandon the peer, its broke. 358 */ 359 if (retval == -3) { 360 /* We abort with an error of missing mandatory param */ 361 op_err = 362 sctp_generate_invmanparam(SCTP_CAUSE_MISS_PARAM); 363 if (op_err) { 364 /* 365 * Expand beyond to include the mandatory 366 * param cookie 367 */ 368 struct sctp_inv_mandatory_param *mp; 369 op_err->m_len = 370 sizeof(struct sctp_inv_mandatory_param); 371 mp = mtod(op_err, 372 struct sctp_inv_mandatory_param *); 373 /* Subtract the reserved param */ 374 mp->length = 375 htons(sizeof(struct sctp_inv_mandatory_param) - 2); 376 mp->num_param = htonl(1); 377 mp->param = htons(SCTP_STATE_COOKIE); 378 mp->resv = 0; 379 } 380 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, 381 sh, op_err); 382 } 383 return (retval); 384 } 385 386 /* 387 * Cancel the INIT timer, We do this first before queueing 388 * the cookie. We always cancel at the primary to assume that 389 * we are cancelling the timer started by the INIT which always 390 * goes to the primary. 391 */ 392 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb, 393 asoc->primary_destination); 394 395 /* calculate the RTO */ 396 net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered); 397 398 return (0); 399 } 400 401 static void 402 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp, 403 struct sctp_tcb *stcb, struct sctp_nets *net) 404 { 405 struct sockaddr_storage store; 406 struct sockaddr_in *sin; 407 struct sockaddr_in6 *sin6; 408 struct sctp_nets *r_net; 409 struct timeval tv; 410 411 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) { 412 /* Invalid length */ 413 return; 414 } 415 416 sin = (struct sockaddr_in *)&store; 417 sin6 = (struct sockaddr_in6 *)&store; 418 419 memset(&store, 0, sizeof(store)); 420 if (cp->heartbeat.hb_info.addr_family == AF_INET && 421 cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) { 422 sin->sin_family = cp->heartbeat.hb_info.addr_family; 423 sin->sin_len = cp->heartbeat.hb_info.addr_len; 424 sin->sin_port = stcb->rport; 425 memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address, 426 sizeof(sin->sin_addr)); 427 } else if (cp->heartbeat.hb_info.addr_family == AF_INET6 && 428 cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) { 429 sin6->sin6_family = cp->heartbeat.hb_info.addr_family; 430 sin6->sin6_len = cp->heartbeat.hb_info.addr_len; 431 sin6->sin6_port = stcb->rport; 432 memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address, 433 sizeof(sin6->sin6_addr)); 434 } else { 435 #ifdef SCTP_DEBUG 436 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 437 printf("unsupported address family"); 438 } 439 #endif 440 return; 441 } 442 r_net = sctp_findnet(stcb, (struct sockaddr *)sin); 443 if (r_net == NULL) { 444 #ifdef SCTP_DEBUG 445 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 446 printf("Huh? I can't find the address I sent it to, discard\n"); 447 } 448 #endif 449 return; 450 } 451 if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) && 452 (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) && 453 (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) { 454 /* 455 * If the its a HB and it's random value is correct when 456 * can confirm the destination. 457 */ 458 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 459 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 460 stcb, 0, (void *)r_net); 461 } 462 r_net->error_count = 0; 463 r_net->hb_responded = 1; 464 tv.tv_sec = cp->heartbeat.hb_info.time_value_1; 465 tv.tv_usec = cp->heartbeat.hb_info.time_value_2; 466 if (r_net->dest_state & SCTP_ADDR_NOT_REACHABLE) { 467 r_net->dest_state = SCTP_ADDR_REACHABLE; 468 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb, 469 SCTP_HEARTBEAT_SUCCESS, (void *)r_net); 470 471 /* now was it the primary? if so restore */ 472 if (r_net->dest_state & SCTP_ADDR_WAS_PRIMARY) { 473 sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, r_net); 474 } 475 } 476 /* Now lets do a RTO with this */ 477 r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv); 478 } 479 480 static void 481 sctp_handle_abort(struct sctp_abort_chunk *cp, 482 struct sctp_tcb *stcb, struct sctp_nets *net) 483 { 484 485 #ifdef SCTP_DEBUG 486 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 487 printf("sctp_handle_abort: handling ABORT\n"); 488 } 489 #endif 490 if (stcb == NULL) 491 return; 492 /* verify that the destination addr is in the association */ 493 /* ignore abort for addresses being deleted */ 494 495 /* stop any receive timers */ 496 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net); 497 /* notify user of the abort and clean up... */ 498 sctp_abort_notification(stcb, 0); 499 /* free the tcb */ 500 sctp_free_assoc(stcb->sctp_ep, stcb); 501 #ifdef SCTP_DEBUG 502 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 503 printf("sctp_handle_abort: finished\n"); 504 } 505 #endif 506 } 507 508 static void 509 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp, 510 struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag) 511 { 512 struct sctp_association *asoc; 513 int some_on_streamwheel; 514 515 #ifdef SCTP_DEBUG 516 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 517 printf("sctp_handle_shutdown: handling SHUTDOWN\n"); 518 } 519 #endif 520 if (stcb == NULL) 521 return; 522 523 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) || 524 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 525 return; 526 } 527 528 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) { 529 /* update current data status */ 530 #ifdef SCTP_DEBUG 531 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 532 printf("Warning Shutdown NOT the expected size.. skipping (%d:%d)\n", 533 ntohs(cp->ch.chunk_length), 534 (int)sizeof(struct sctp_shutdown_chunk)); 535 } 536 #endif 537 return; 538 } else { 539 sctp_update_acked(stcb, cp, net, abort_flag); 540 } 541 asoc = &stcb->asoc; 542 /* goto SHUTDOWN_RECEIVED state to block new requests */ 543 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) && 544 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) { 545 asoc->state = SCTP_STATE_SHUTDOWN_RECEIVED; 546 #ifdef SCTP_DEBUG 547 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 548 printf("Moving to SHUTDOWN-RECEIVED state\n"); 549 } 550 #endif 551 /* notify upper layer that peer has initiated a shutdown */ 552 sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL); 553 554 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 555 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 556 557 /* Set the flag so we cannot send more, we 558 * would call the function but we don't want to 559 * wake up the ulp necessarily. 560 */ 561 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115 562 stcb->sctp_ep->sctp_socket->so_rcv.sb_state |= SBS_CANTSENDMORE; 563 #else 564 stcb->sctp_ep->sctp_socket->so_state |= SS_CANTSENDMORE; 565 #endif 566 } 567 /* reset time */ 568 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 569 } 570 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) { 571 /* 572 * stop the shutdown timer, since we WILL move 573 * to SHUTDOWN-ACK-SENT. 574 */ 575 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net); 576 } 577 /* Now are we there yet? */ 578 some_on_streamwheel = 0; 579 if (!TAILQ_EMPTY(&asoc->out_wheel)) { 580 /* Check to see if some data queued */ 581 struct sctp_stream_out *outs; 582 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 583 if (!TAILQ_EMPTY(&outs->outqueue)) { 584 some_on_streamwheel = 1; 585 break; 586 } 587 } 588 } 589 #ifdef SCTP_DEBUG 590 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 591 printf("some_on_streamwheel:%d send_q_empty:%d sent_q_empty:%d\n", 592 some_on_streamwheel, 593 !TAILQ_EMPTY(&asoc->send_queue), 594 !TAILQ_EMPTY(&asoc->sent_queue)); 595 } 596 #endif 597 if (!TAILQ_EMPTY(&asoc->send_queue) || 598 !TAILQ_EMPTY(&asoc->sent_queue) || 599 some_on_streamwheel) { 600 /* By returning we will push more data out */ 601 return; 602 } else { 603 /* no outstanding data to send, so move on... */ 604 /* send SHUTDOWN-ACK */ 605 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 606 /* move to SHUTDOWN-ACK-SENT state */ 607 asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT; 608 #ifdef SCTP_DEBUG 609 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 610 printf("moving to SHUTDOWN_ACK state\n"); 611 } 612 #endif 613 /* start SHUTDOWN timer */ 614 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, 615 stcb, net); 616 } 617 } 618 619 static void 620 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp, 621 struct sctp_tcb *stcb, struct sctp_nets *net) 622 { 623 struct sctp_association *asoc; 624 625 #ifdef SCTP_DEBUG 626 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 627 printf("sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n"); 628 } 629 #endif 630 if (stcb == NULL) 631 return; 632 633 asoc = &stcb->asoc; 634 /* process according to association state */ 635 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 636 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 637 /* unexpected SHUTDOWN-ACK... so ignore... */ 638 return; 639 } 640 /* are the queues empty? */ 641 if (!TAILQ_EMPTY(&asoc->send_queue) || 642 !TAILQ_EMPTY(&asoc->sent_queue) || 643 !TAILQ_EMPTY(&asoc->out_wheel)) { 644 sctp_report_all_outbound(stcb); 645 } 646 /* stop the timer */ 647 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net); 648 /* send SHUTDOWN-COMPLETE */ 649 sctp_send_shutdown_complete(stcb, net); 650 /* notify upper layer protocol */ 651 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 652 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 653 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 654 stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED; 655 /* Set the connected flag to disconnected */ 656 stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 657 stcb->sctp_ep->sctp_socket->so_snd.sb_mbcnt = 0; 658 soisdisconnected(stcb->sctp_ep->sctp_socket); 659 } 660 /* free the TCB but first save off the ep */ 661 sctp_free_assoc(stcb->sctp_ep, stcb); 662 } 663 664 /* 665 * Skip past the param header and then we will find the chunk that 666 * caused the problem. There are two possiblities ASCONF or FWD-TSN 667 * other than that and our peer must be broken. 668 */ 669 static void 670 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr, 671 struct sctp_nets *net) 672 { 673 struct sctp_chunkhdr *chk; 674 675 chk = (struct sctp_chunkhdr *)((vaddr_t)phdr + sizeof(*phdr)); 676 switch (chk->chunk_type) { 677 case SCTP_ASCONF_ACK: 678 #ifdef SCTP_DEBUG 679 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 680 printf("Strange peer, snds ASCONF but does not recongnize asconf-ack?\n"); 681 } 682 #endif 683 /* FALLTHROUGH */ 684 case SCTP_ASCONF: 685 #ifdef SCTP_DEBUG 686 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 687 printf("Peer does not support ASCONF/ASCONF-ACK chunks\n"); 688 } 689 #endif /* SCTP_DEBUG */ 690 sctp_asconf_cleanup(stcb, net); 691 break; 692 case SCTP_FORWARD_CUM_TSN: 693 stcb->asoc.peer_supports_prsctp = 0; 694 break; 695 default: 696 #ifdef SCTP_DEBUG 697 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 698 printf("Peer does not support chunk type %d(%x)??\n", 699 chk->chunk_type, (u_int)chk->chunk_type); 700 } 701 #endif 702 break; 703 } 704 } 705 706 /* 707 * Skip past the param header and then we will find the param that 708 * caused the problem. There are a number of param's in a ASCONF 709 * OR the prsctp param these will turn of specific features. 710 */ 711 static void 712 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr) 713 { 714 struct sctp_paramhdr *pbad; 715 716 pbad = phdr + 1; 717 switch (ntohs(pbad->param_type)) { 718 /* pr-sctp draft */ 719 case SCTP_PRSCTP_SUPPORTED: 720 stcb->asoc.peer_supports_prsctp = 0; 721 break; 722 case SCTP_SUPPORTED_CHUNK_EXT: 723 break; 724 /* draft-ietf-tsvwg-addip-sctp */ 725 case SCTP_ECN_NONCE_SUPPORTED: 726 stcb->asoc.peer_supports_ecn_nonce = 0; 727 stcb->asoc.ecn_nonce_allowed = 0; 728 stcb->asoc.ecn_allowed = 0; 729 break; 730 case SCTP_ADD_IP_ADDRESS: 731 case SCTP_DEL_IP_ADDRESS: 732 stcb->asoc.peer_supports_asconf = 0; 733 break; 734 case SCTP_SET_PRIM_ADDR: 735 stcb->asoc.peer_supports_asconf_setprim = 0; 736 break; 737 case SCTP_SUCCESS_REPORT: 738 case SCTP_ERROR_CAUSE_IND: 739 #ifdef SCTP_DEBUG 740 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 741 printf("Huh, the peer does not support success? or error cause?\n"); 742 printf("Turning off ASCONF to this strange peer\n"); 743 } 744 #endif 745 stcb->asoc.peer_supports_asconf = 0; 746 stcb->asoc.peer_supports_asconf_setprim = 0; 747 break; 748 default: 749 #ifdef SCTP_DEBUG 750 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 751 printf("Peer does not support base param type %d(%x)??\n", 752 pbad->param_type, (u_int)pbad->param_type); 753 } 754 #endif 755 break; 756 } 757 } 758 759 static int 760 sctp_handle_error(struct sctp_chunkhdr *ch, 761 struct sctp_tcb *stcb, struct sctp_nets *net) 762 { 763 int chklen; 764 struct sctp_paramhdr *phdr; 765 uint16_t error_type; 766 uint16_t error_len; 767 struct sctp_association *asoc; 768 769 int adjust; 770 /* parse through all of the errors and process */ 771 asoc = &stcb->asoc; 772 phdr = (struct sctp_paramhdr *)((vaddr_t)ch + 773 sizeof(struct sctp_chunkhdr)); 774 chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr); 775 while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) { 776 /* Process an Error Cause */ 777 error_type = ntohs(phdr->param_type); 778 error_len = ntohs(phdr->param_length); 779 if ((error_len > chklen) || (error_len == 0)) { 780 /* invalid param length for this param */ 781 #ifdef SCTP_DEBUG 782 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 783 printf("Bogus length in error param- chunk left:%d errorlen:%d\n", 784 chklen, error_len); 785 } 786 #endif /* SCTP_DEBUG */ 787 return (0); 788 } 789 switch (error_type) { 790 case SCTP_CAUSE_INV_STRM: 791 case SCTP_CAUSE_MISS_PARAM: 792 case SCTP_CAUSE_INVALID_PARAM: 793 case SCTP_CAUSE_NOUSER_DATA: 794 #ifdef SCTP_DEBUG 795 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 796 printf("Software error we got a %d back? We have a bug :/ (or do they?)\n", 797 error_type); 798 } 799 #endif 800 break; 801 case SCTP_CAUSE_STALE_COOKIE: 802 /* We only act if we have echoed a cookie and are waiting. */ 803 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 804 int *p; 805 p = (int *)((vaddr_t)phdr + sizeof(*phdr)); 806 /* Save the time doubled */ 807 asoc->cookie_preserve_req = ntohl(*p) << 1; 808 asoc->stale_cookie_count++; 809 if (asoc->stale_cookie_count > 810 asoc->max_init_times) { 811 sctp_abort_notification(stcb, 0); 812 /* now free the asoc */ 813 sctp_free_assoc(stcb->sctp_ep, stcb); 814 return (-1); 815 } 816 /* blast back to INIT state */ 817 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED; 818 asoc->state |= SCTP_STATE_COOKIE_WAIT; 819 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, 820 stcb->sctp_ep, stcb, net); 821 sctp_send_initiate(stcb->sctp_ep, stcb); 822 } 823 break; 824 case SCTP_CAUSE_UNRESOLV_ADDR: 825 /* 826 * Nothing we can do here, we don't do hostname 827 * addresses so if the peer does not like my IPv6 (or 828 * IPv4 for that matter) it does not matter. If they 829 * don't support that type of address, they can NOT 830 * possibly get that packet type... i.e. with no IPv6 831 * you can't receive a IPv6 packet. so we can safely 832 * ignore this one. If we ever added support for 833 * HOSTNAME Addresses, then we would need to do 834 * something here. 835 */ 836 break; 837 case SCTP_CAUSE_UNRECOG_CHUNK: 838 sctp_process_unrecog_chunk(stcb, phdr, net); 839 break; 840 case SCTP_CAUSE_UNRECOG_PARAM: 841 sctp_process_unrecog_param(stcb, phdr); 842 break; 843 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN: 844 /* 845 * We ignore this since the timer will drive out a new 846 * cookie anyway and there timer will drive us to send 847 * a SHUTDOWN_COMPLETE. We can't send one here since 848 * we don't have their tag. 849 */ 850 break; 851 case SCTP_CAUSE_DELETEING_LAST_ADDR: 852 case SCTP_CAUSE_OPERATION_REFUSED: 853 case SCTP_CAUSE_DELETING_SRC_ADDR: 854 /* We should NOT get these here, but in a ASCONF-ACK. */ 855 #ifdef SCTP_DEBUG 856 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 857 printf("Peer sends ASCONF errors in a Operational Error?<%d>?\n", 858 error_type); 859 } 860 #endif 861 break; 862 case SCTP_CAUSE_OUT_OF_RESC: 863 /* 864 * And what, pray tell do we do with the fact 865 * that the peer is out of resources? Not 866 * really sure we could do anything but abort. 867 * I suspect this should have came WITH an 868 * abort instead of in a OP-ERROR. 869 */ 870 break; 871 default: 872 #ifdef SCTP_DEBUG 873 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 874 /* don't know what this error cause is... */ 875 printf("sctp_handle_error: unknown error type = 0x%xh\n", 876 error_type); 877 } 878 #endif /* SCTP_DEBUG */ 879 break; 880 } 881 adjust = SCTP_SIZE32(error_len); 882 chklen -= adjust; 883 phdr = (struct sctp_paramhdr *)((vaddr_t)phdr + adjust); 884 } 885 return (0); 886 } 887 888 static int 889 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh, 890 struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb, 891 struct sctp_nets *net) 892 { 893 struct sctp_init_ack *init_ack; 894 int *state; 895 struct mbuf *op_err; 896 897 #ifdef SCTP_DEBUG 898 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 899 printf("sctp_handle_init_ack: handling INIT-ACK\n"); 900 } 901 #endif 902 if (stcb == NULL) { 903 #ifdef SCTP_DEBUG 904 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 905 printf("sctp_handle_init_ack: TCB is null\n"); 906 } 907 #endif 908 return (-1); 909 } 910 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) { 911 /* Invalid length */ 912 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 913 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 914 op_err); 915 return (-1); 916 } 917 init_ack = &cp->init; 918 /* validate parameters */ 919 if (init_ack->initiate_tag == 0) { 920 /* protocol error... send an abort */ 921 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 922 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 923 op_err); 924 return (-1); 925 } 926 if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) { 927 /* protocol error... send an abort */ 928 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 929 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 930 op_err); 931 return (-1); 932 } 933 if (init_ack->num_inbound_streams == 0) { 934 /* protocol error... send an abort */ 935 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 936 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 937 op_err); 938 return (-1); 939 } 940 if (init_ack->num_outbound_streams == 0) { 941 /* protocol error... send an abort */ 942 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM); 943 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh, 944 op_err); 945 return (-1); 946 } 947 948 /* process according to association state... */ 949 state = &stcb->asoc.state; 950 switch (*state & SCTP_STATE_MASK) { 951 case SCTP_STATE_COOKIE_WAIT: 952 /* this is the expected state for this chunk */ 953 /* process the INIT-ACK parameters */ 954 if (stcb->asoc.primary_destination->dest_state & 955 SCTP_ADDR_UNCONFIRMED) { 956 /* 957 * The primary is where we sent the INIT, we can 958 * always consider it confirmed when the INIT-ACK 959 * is returned. Do this before we load addresses 960 * though. 961 */ 962 stcb->asoc.primary_destination->dest_state &= 963 ~SCTP_ADDR_UNCONFIRMED; 964 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 965 stcb, 0, (void *)stcb->asoc.primary_destination); 966 } 967 if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb, net 968 ) < 0) { 969 /* error in parsing parameters */ 970 #ifdef SCTP_DEBUG 971 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 972 printf("sctp_process_init_ack: error in msg, discarding\n"); 973 } 974 #endif 975 return (-1); 976 } 977 /* update our state */ 978 #ifdef SCTP_DEBUG 979 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 980 printf("moving to COOKIE-ECHOED state\n"); 981 } 982 #endif 983 if (*state & SCTP_STATE_SHUTDOWN_PENDING) { 984 *state = SCTP_STATE_COOKIE_ECHOED | 985 SCTP_STATE_SHUTDOWN_PENDING; 986 } else { 987 *state = SCTP_STATE_COOKIE_ECHOED; 988 } 989 990 /* reset the RTO calc */ 991 stcb->asoc.overall_error_count = 0; 992 SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered); 993 /* 994 * collapse the init timer back in case of a exponential backoff 995 */ 996 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep, 997 stcb, net); 998 /* 999 * the send at the end of the inbound data processing will 1000 * cause the cookie to be sent 1001 */ 1002 break; 1003 case SCTP_STATE_SHUTDOWN_SENT: 1004 /* incorrect state... discard */ 1005 break; 1006 case SCTP_STATE_COOKIE_ECHOED: 1007 /* incorrect state... discard */ 1008 break; 1009 case SCTP_STATE_OPEN: 1010 /* incorrect state... discard */ 1011 break; 1012 case SCTP_STATE_EMPTY: 1013 case SCTP_STATE_INUSE: 1014 default: 1015 /* incorrect state... discard */ 1016 #ifdef SCTP_DEBUG 1017 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1018 printf("Leaving handle-init-ack default\n"); 1019 } 1020 #endif 1021 return (-1); 1022 break; 1023 } /* end switch asoc state */ 1024 #ifdef SCTP_DEBUG 1025 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1026 printf("Leaving handle-init-ack end\n"); 1027 } 1028 #endif 1029 return (0); 1030 } 1031 1032 1033 /* 1034 * handle a state cookie for an existing association 1035 * m: input packet mbuf chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk 1036 * note: this is a "split" mbuf and the cookie signature does not exist 1037 * offset: offset into mbuf to the cookie-echo chunk 1038 */ 1039 static struct sctp_tcb * 1040 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset, 1041 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1042 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 1043 struct sockaddr *init_src, int *notification) 1044 { 1045 struct sctp_association *asoc; 1046 struct sctp_init_chunk *init_cp, init_buf; 1047 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1048 int chk_length; 1049 int init_offset, initack_offset; 1050 int retval; 1051 1052 /* I know that the TCB is non-NULL from the caller */ 1053 asoc = &stcb->asoc; 1054 1055 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) { 1056 /* SHUTDOWN came in after sending INIT-ACK */ 1057 struct mbuf *op_err; 1058 struct sctp_paramhdr *ph; 1059 1060 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination); 1061 #ifdef SCTP_DEBUG 1062 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1063 printf("sctp_handle_cookie: got a cookie, while shutting down!\n"); 1064 } 1065 #endif 1066 MGETHDR(op_err, M_DONTWAIT, MT_HEADER); 1067 if (op_err == NULL) { 1068 /* FOOBAR */ 1069 return (NULL); 1070 } 1071 /* pre-reserve some space */ 1072 op_err->m_data += sizeof(struct ip6_hdr); 1073 op_err->m_data += sizeof(struct sctphdr); 1074 op_err->m_data += sizeof(struct sctp_chunkhdr); 1075 /* Set the len */ 1076 op_err->m_len = op_err->m_pkthdr.len = sizeof(struct sctp_paramhdr); 1077 ph = mtod(op_err, struct sctp_paramhdr *); 1078 ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN); 1079 ph->param_length = htons(sizeof(struct sctp_paramhdr)); 1080 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag); 1081 return (NULL); 1082 } 1083 /* 1084 * find and validate the INIT chunk in the cookie (peer's info) 1085 * the INIT should start after the cookie-echo header struct 1086 * (chunk header, state cookie header struct) 1087 */ 1088 init_offset = offset += sizeof(struct sctp_cookie_echo_chunk); 1089 1090 init_cp = (struct sctp_init_chunk *) 1091 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1092 (u_int8_t *)&init_buf); 1093 if (init_cp == NULL) { 1094 /* could not pull a INIT chunk in cookie */ 1095 #ifdef SCTP_DEBUG 1096 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1097 printf("process_cookie_existing: could not pull INIT chunk hdr\n"); 1098 } 1099 #endif /* SCTP_DEBUG */ 1100 return (NULL); 1101 } 1102 chk_length = ntohs(init_cp->ch.chunk_length); 1103 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1104 #ifdef SCTP_DEBUG 1105 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1106 printf("process_cookie_existing: could not find INIT chunk!\n"); 1107 } 1108 #endif /* SCTP_DEBUG */ 1109 return (NULL); 1110 } 1111 1112 /* 1113 * find and validate the INIT-ACK chunk in the cookie (my info) 1114 * the INIT-ACK follows the INIT chunk 1115 */ 1116 initack_offset = init_offset + SCTP_SIZE32(chk_length); 1117 initack_cp = (struct sctp_init_ack_chunk *) 1118 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1119 (u_int8_t *)&initack_buf); 1120 if (initack_cp == NULL) { 1121 /* could not pull INIT-ACK chunk in cookie */ 1122 #ifdef SCTP_DEBUG 1123 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1124 printf("process_cookie_existing: could not pull INIT-ACK chunk hdr\n"); 1125 } 1126 #endif /* SCTP_DEBUG */ 1127 return (NULL); 1128 } 1129 chk_length = ntohs(initack_cp->ch.chunk_length); 1130 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1131 #ifdef SCTP_DEBUG 1132 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1133 printf("process_cookie_existing: could not find INIT-ACK chunk!\n"); 1134 } 1135 #endif /* SCTP_DEBUG */ 1136 return (NULL); 1137 } 1138 if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) && 1139 (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) { 1140 /* 1141 * case D in Section 5.2.4 Table 2: MMAA 1142 * process accordingly to get into the OPEN state 1143 */ 1144 switch SCTP_GET_STATE(asoc) { 1145 case SCTP_STATE_COOKIE_WAIT: 1146 /* 1147 * INIT was sent, but got got a COOKIE_ECHO with 1148 * the correct tags... just accept it... 1149 */ 1150 /* First we must process the INIT !! */ 1151 retval = sctp_process_init(init_cp, stcb, net); 1152 if (retval < 0) { 1153 #ifdef SCTP_DEBUG 1154 printf("process_cookie_existing: INIT processing failed\n"); 1155 #endif 1156 return (NULL); 1157 } 1158 /* FALLTHROUGH */ 1159 /* intentional fall through to below... */ 1160 1161 case SCTP_STATE_COOKIE_ECHOED: 1162 /* Duplicate INIT case */ 1163 /* we have already processed the INIT so no problem */ 1164 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, 1165 net); 1166 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 1167 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, inp, stcb, 1168 net); 1169 /* update current state */ 1170 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1171 asoc->state = SCTP_STATE_OPEN | 1172 SCTP_STATE_SHUTDOWN_PENDING; 1173 } else if ((asoc->state & SCTP_STATE_SHUTDOWN_SENT) == 0) { 1174 /* if ok, move to OPEN state */ 1175 asoc->state = SCTP_STATE_OPEN; 1176 } 1177 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1178 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1179 (!(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING))) { 1180 /* 1181 * Here is where collision would go if we did a 1182 * connect() and instead got a 1183 * init/init-ack/cookie done before the 1184 * init-ack came back.. 1185 */ 1186 stcb->sctp_ep->sctp_flags |= 1187 SCTP_PCB_FLAGS_CONNECTED; 1188 soisconnected(stcb->sctp_ep->sctp_socket); 1189 } 1190 /* notify upper layer */ 1191 *notification = SCTP_NOTIFY_ASSOC_UP; 1192 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, 1193 net); 1194 /* 1195 * since we did not send a HB make sure we don't double 1196 * things 1197 */ 1198 net->hb_responded = 1; 1199 1200 if (stcb->asoc.sctp_autoclose_ticks && 1201 (inp->sctp_flags & SCTP_PCB_FLAGS_AUTOCLOSE)) { 1202 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 1203 inp, stcb, NULL); 1204 } 1205 break; 1206 default: 1207 /* 1208 * we're in the OPEN state (or beyond), so peer 1209 * must have simply lost the COOKIE-ACK 1210 */ 1211 break; 1212 } /* end switch */ 1213 1214 /* 1215 * We ignore the return code here.. not sure if we should 1216 * somehow abort.. but we do have an existing asoc. This 1217 * really should not fail. 1218 */ 1219 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1220 init_offset + sizeof(struct sctp_init_chunk), 1221 initack_offset, sh, init_src)) { 1222 #ifdef SCTP_DEBUG 1223 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1224 printf("Weird cookie load_address failure on cookie existing - 1\n"); 1225 } 1226 #endif 1227 return (NULL); 1228 } 1229 1230 /* respond with a COOKIE-ACK */ 1231 sctp_send_cookie_ack(stcb); 1232 return (stcb); 1233 } /* end if */ 1234 if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1235 ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag && 1236 cookie->tie_tag_my_vtag == 0 && 1237 cookie->tie_tag_peer_vtag == 0) { 1238 /* 1239 * case C in Section 5.2.4 Table 2: XMOO 1240 * silently discard 1241 */ 1242 return (NULL); 1243 } 1244 if (ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag && 1245 (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag || 1246 init_cp->init.initiate_tag == 0)) { 1247 /* 1248 * case B in Section 5.2.4 Table 2: MXAA or MOAA 1249 * my info should be ok, re-accept peer info 1250 */ 1251 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net); 1252 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 1253 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 1254 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net); 1255 /* 1256 * since we did not send a HB make sure we don't double things 1257 */ 1258 net->hb_responded = 1; 1259 if (stcb->asoc.sctp_autoclose_ticks && 1260 (inp->sctp_flags & SCTP_PCB_FLAGS_AUTOCLOSE)) { 1261 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, 1262 NULL); 1263 } 1264 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1265 asoc->pre_open_streams = 1266 ntohs(initack_cp->init.num_outbound_streams); 1267 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1268 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = 1269 asoc->init_seq_number; 1270 asoc->t3timeout_highest_marked = asoc->asconf_seq_out; 1271 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1272 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1273 asoc->str_reset_seq_in = asoc->init_seq_number; 1274 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1275 1276 /* process the INIT info (peer's info) */ 1277 retval = sctp_process_init(init_cp, stcb, net); 1278 if (retval < 0) { 1279 #ifdef SCTP_DEBUG 1280 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1281 printf("process_cookie_existing: INIT processing failed\n"); 1282 } 1283 #endif 1284 return (NULL); 1285 } 1286 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1287 init_offset + sizeof(struct sctp_init_chunk), 1288 initack_offset, sh, init_src)) { 1289 #ifdef SCTP_DEBUG 1290 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1291 printf("Weird cookie load_address failure on cookie existing - 2\n"); 1292 } 1293 #endif 1294 return (NULL); 1295 } 1296 1297 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) || 1298 (asoc->state & SCTP_STATE_COOKIE_ECHOED)) { 1299 *notification = SCTP_NOTIFY_ASSOC_UP; 1300 1301 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1302 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1303 !(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) { 1304 stcb->sctp_ep->sctp_flags |= 1305 SCTP_PCB_FLAGS_CONNECTED; 1306 soisconnected(stcb->sctp_ep->sctp_socket); 1307 } 1308 } 1309 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1310 asoc->state = SCTP_STATE_OPEN | 1311 SCTP_STATE_SHUTDOWN_PENDING; 1312 } else { 1313 asoc->state = SCTP_STATE_OPEN; 1314 } 1315 sctp_send_cookie_ack(stcb); 1316 return (stcb); 1317 } 1318 1319 if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag && 1320 ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) && 1321 cookie->tie_tag_my_vtag == asoc->my_vtag_nonce && 1322 cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce && 1323 cookie->tie_tag_peer_vtag != 0) { 1324 /* 1325 * case A in Section 5.2.4 Table 2: XXMM (peer restarted) 1326 */ 1327 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 1328 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 1329 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net); 1330 1331 /* notify upper layer */ 1332 *notification = SCTP_NOTIFY_ASSOC_RESTART; 1333 1334 /* send up all the data */ 1335 sctp_report_all_outbound(stcb); 1336 1337 /* process the INIT-ACK info (my info) */ 1338 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1339 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1340 asoc->pre_open_streams = 1341 ntohs(initack_cp->init.num_outbound_streams); 1342 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1343 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = 1344 asoc->init_seq_number; 1345 asoc->t3timeout_highest_marked = asoc->asconf_seq_out; 1346 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1347 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1348 asoc->str_reset_seq_in = asoc->init_seq_number; 1349 1350 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1351 if (asoc->mapping_array) 1352 memset(asoc->mapping_array, 0, 1353 asoc->mapping_array_size); 1354 /* process the INIT info (peer's info) */ 1355 retval = sctp_process_init(init_cp, stcb, net); 1356 if (retval < 0) { 1357 #ifdef SCTP_DEBUG 1358 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1359 printf("process_cookie_existing: INIT processing failed\n"); 1360 } 1361 #endif 1362 return (NULL); 1363 } 1364 1365 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net); 1366 /* 1367 * since we did not send a HB make sure we don't double things 1368 */ 1369 net->hb_responded = 1; 1370 1371 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1372 init_offset + sizeof(struct sctp_init_chunk), 1373 initack_offset, sh, init_src)) { 1374 #ifdef SCTP_DEBUG 1375 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1376 printf("Weird cookie load_address failure on cookie existing - 3\n"); 1377 } 1378 #endif 1379 return (NULL); 1380 } 1381 1382 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1383 asoc->state = SCTP_STATE_OPEN | 1384 SCTP_STATE_SHUTDOWN_PENDING; 1385 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) { 1386 /* move to OPEN state, if not in SHUTDOWN_SENT */ 1387 asoc->state = SCTP_STATE_OPEN; 1388 } 1389 /* respond with a COOKIE-ACK */ 1390 sctp_send_cookie_ack(stcb); 1391 1392 return (stcb); 1393 } 1394 /* all other cases... */ 1395 return (NULL); 1396 } 1397 1398 /* 1399 * handle a state cookie for a new association 1400 * m: input packet mbuf chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk 1401 * note: this is a "split" mbuf and the cookie signature does not exist 1402 * offset: offset into mbuf to the cookie-echo chunk 1403 * length: length of the cookie chunk 1404 * to: where the init was from 1405 * returns a new TCB 1406 */ 1407 static struct sctp_tcb * 1408 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset, 1409 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len, 1410 struct sctp_inpcb *inp, struct sctp_nets **netp, 1411 struct sockaddr *init_src, int *notification) 1412 { 1413 struct sctp_tcb *stcb; 1414 struct sctp_init_chunk *init_cp, init_buf; 1415 struct sctp_init_ack_chunk *initack_cp, initack_buf; 1416 struct sockaddr_storage sa_store; 1417 struct sockaddr *initack_src = (struct sockaddr *)&sa_store; 1418 struct sockaddr_in *sin; 1419 struct sockaddr_in6 *sin6; 1420 struct sctp_association *asoc; 1421 int chk_length; 1422 int init_offset, initack_offset, initack_limit; 1423 int retval; 1424 int error = 0; 1425 /* 1426 * find and validate the INIT chunk in the cookie (peer's info) 1427 * the INIT should start after the cookie-echo header struct 1428 * (chunk header, state cookie header struct) 1429 */ 1430 init_offset = offset + sizeof(struct sctp_cookie_echo_chunk); 1431 init_cp = (struct sctp_init_chunk *) 1432 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk), 1433 (u_int8_t *)&init_buf); 1434 if (init_cp == NULL) { 1435 /* could not pull a INIT chunk in cookie */ 1436 #ifdef SCTP_DEBUG 1437 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1438 printf("process_cookie_new: could not pull INIT chunk hdr\n"); 1439 } 1440 #endif /* SCTP_DEBUG */ 1441 return (NULL); 1442 } 1443 chk_length = ntohs(init_cp->ch.chunk_length); 1444 if (init_cp->ch.chunk_type != SCTP_INITIATION) { 1445 #ifdef SCTP_DEBUG 1446 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1447 printf("HUH? process_cookie_new: could not find INIT chunk!\n"); 1448 } 1449 #endif /* SCTP_DEBUG */ 1450 return (NULL); 1451 } 1452 1453 initack_offset = init_offset + SCTP_SIZE32(chk_length); 1454 /* 1455 * find and validate the INIT-ACK chunk in the cookie (my info) 1456 * the INIT-ACK follows the INIT chunk 1457 */ 1458 initack_cp = (struct sctp_init_ack_chunk *) 1459 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk), 1460 (u_int8_t *)&initack_buf); 1461 if (initack_cp == NULL) { 1462 /* could not pull INIT-ACK chunk in cookie */ 1463 #ifdef SCTP_DEBUG 1464 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1465 printf("process_cookie_new: could not pull INIT-ACK chunk hdr\n"); 1466 } 1467 #endif /* SCTP_DEBUG */ 1468 return (NULL); 1469 } 1470 chk_length = ntohs(initack_cp->ch.chunk_length); 1471 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) { 1472 #ifdef SCTP_DEBUG 1473 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1474 u_int8_t *pp; 1475 pp = (u_int8_t *)initack_cp; 1476 printf("process_cookie_new: could not find INIT-ACK chunk!\n"); 1477 printf("Found bytes %x %x %x %x at position %d\n", 1478 (u_int)pp[0], (u_int)pp[1], (u_int)pp[2], 1479 (u_int)pp[3], initack_offset); 1480 } 1481 #endif /* SCTP_DEBUG */ 1482 return (NULL); 1483 } 1484 initack_limit = initack_offset + SCTP_SIZE32(chk_length); 1485 1486 /* 1487 * now that we know the INIT/INIT-ACK are in place, 1488 * create a new TCB and popluate 1489 */ 1490 stcb = sctp_aloc_assoc(inp, init_src, 0, &error, ntohl(initack_cp->init.initiate_tag)); 1491 if (stcb == NULL) { 1492 struct mbuf *op_err; 1493 /* memory problem? */ 1494 #ifdef SCTP_DEBUG 1495 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1496 printf("process_cookie_new: no room for another TCB!\n"); 1497 } 1498 #endif /* SCTP_DEBUG */ 1499 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1500 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 1501 sh, op_err); 1502 return (NULL); 1503 } 1504 1505 /* get the correct sctp_nets */ 1506 *netp = sctp_findnet(stcb, init_src); 1507 asoc = &stcb->asoc; 1508 /* get scope variables out of cookie */ 1509 asoc->ipv4_local_scope = cookie->ipv4_scope; 1510 asoc->site_scope = cookie->site_scope; 1511 asoc->local_scope = cookie->local_scope; 1512 asoc->loopback_scope = cookie->loopback_scope; 1513 1514 if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) || 1515 (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) { 1516 struct mbuf *op_err; 1517 /* 1518 * Houston we have a problem. The EP changed while the cookie 1519 * was in flight. Only recourse is to abort the association. 1520 */ 1521 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1522 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen, 1523 sh, op_err); 1524 return (NULL); 1525 } 1526 1527 /* process the INIT-ACK info (my info) */ 1528 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag); 1529 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd); 1530 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams); 1531 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn); 1532 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number; 1533 asoc->t3timeout_highest_marked = asoc->asconf_seq_out; 1534 asoc->last_cwr_tsn = asoc->init_seq_number - 1; 1535 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1; 1536 asoc->str_reset_seq_in = asoc->init_seq_number; 1537 1538 asoc->advanced_peer_ack_point = asoc->last_acked_seq; 1539 1540 /* process the INIT info (peer's info) */ 1541 retval = sctp_process_init(init_cp, stcb, *netp); 1542 if (retval < 0) { 1543 #ifdef SCTP_DEBUG 1544 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1545 printf("process_cookie_new: INIT processing failed\n"); 1546 } 1547 #endif 1548 sctp_free_assoc(inp, stcb); 1549 return (NULL); 1550 } 1551 /* load all addresses */ 1552 if (sctp_load_addresses_from_init(stcb, m, iphlen, 1553 init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh, 1554 init_src)) { 1555 sctp_free_assoc(inp, stcb); 1556 return (NULL); 1557 } 1558 1559 /* update current state */ 1560 #ifdef SCTP_DEBUG 1561 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1562 printf("moving to OPEN state\n"); 1563 } 1564 #endif 1565 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 1566 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 1567 } else { 1568 asoc->state = SCTP_STATE_OPEN; 1569 } 1570 /* calculate the RTT */ 1571 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp, 1572 &cookie->time_entered); 1573 1574 /* 1575 * if we're doing ASCONFs, check to see if we have any new 1576 * local addresses that need to get added to the peer (eg. 1577 * addresses changed while cookie echo in flight). This needs 1578 * to be done after we go to the OPEN state to do the correct 1579 * asconf processing. 1580 * else, make sure we have the correct addresses in our lists 1581 */ 1582 1583 /* warning, we re-use sin, sin6, sa_store here! */ 1584 /* pull in local_address (our "from" address) */ 1585 if (cookie->laddr_type == SCTP_IPV4_ADDRESS) { 1586 /* source addr is IPv4 */ 1587 sin = (struct sockaddr_in *)initack_src; 1588 memset(sin, 0, sizeof(*sin)); 1589 sin->sin_family = AF_INET; 1590 sin->sin_len = sizeof(struct sockaddr_in); 1591 sin->sin_addr.s_addr = cookie->laddress[0]; 1592 } else if (cookie->laddr_type == SCTP_IPV6_ADDRESS) { 1593 /* source addr is IPv6 */ 1594 sin6 = (struct sockaddr_in6 *)initack_src; 1595 memset(sin6, 0, sizeof(*sin6)); 1596 sin6->sin6_family = AF_INET6; 1597 sin6->sin6_len = sizeof(struct sockaddr_in6); 1598 sin6->sin6_scope_id = cookie->scope_id; 1599 memcpy(&sin6->sin6_addr, cookie->laddress, 1600 sizeof(sin6->sin6_addr)); 1601 } else { 1602 sctp_free_assoc(inp, stcb); 1603 return (NULL); 1604 } 1605 1606 sctp_check_address_list(stcb, m, initack_offset + 1607 sizeof(struct sctp_init_ack_chunk), initack_limit, 1608 initack_src, cookie->local_scope, cookie->site_scope, 1609 cookie->ipv4_scope, cookie->loopback_scope); 1610 1611 1612 /* set up to notify upper layer */ 1613 *notification = SCTP_NOTIFY_ASSOC_UP; 1614 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 1615 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) && 1616 !(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) { 1617 /* 1618 * This is an endpoint that called connect() 1619 * how it got a cookie that is NEW is a bit of 1620 * a mystery. It must be that the INIT was sent, but 1621 * before it got there.. a complete INIT/INIT-ACK/COOKIE 1622 * arrived. But of course then it should have went to 1623 * the other code.. not here.. oh well.. a bit of protection 1624 * is worth having.. 1625 */ 1626 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 1627 soisconnected(stcb->sctp_ep->sctp_socket); 1628 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, *netp); 1629 } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 1630 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) { 1631 /* 1632 * We don't want to do anything with this 1633 * one. Since it is the listening guy. The timer will 1634 * get started for accepted connections in the caller. 1635 */ 1636 ; 1637 } else { 1638 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, *netp); 1639 } 1640 /* since we did not send a HB make sure we don't double things */ 1641 (*netp)->hb_responded = 1; 1642 1643 if (stcb->asoc.sctp_autoclose_ticks && 1644 (inp->sctp_flags & SCTP_PCB_FLAGS_AUTOCLOSE)) { 1645 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL); 1646 } 1647 1648 /* respond with a COOKIE-ACK */ 1649 sctp_send_cookie_ack(stcb); 1650 1651 return (stcb); 1652 } 1653 1654 1655 /* 1656 * handles a COOKIE-ECHO message 1657 * stcb: modified to either a new or left as existing (non-NULL) TCB 1658 */ 1659 static struct mbuf * 1660 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset, 1661 struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp, 1662 struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp) 1663 { 1664 struct sctp_state_cookie *cookie; 1665 struct sockaddr_in6 sin6; 1666 struct sockaddr_in sin; 1667 struct sctp_tcb *l_stcb=*stcb; 1668 struct sctp_inpcb *l_inp; 1669 struct sockaddr *to; 1670 struct sctp_pcb *ep; 1671 struct mbuf *m_sig; 1672 uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE]; 1673 uint8_t *sig; 1674 uint8_t cookie_ok = 0; 1675 unsigned int size_of_pkt, sig_offset, cookie_offset; 1676 unsigned int cookie_len; 1677 struct timeval now; 1678 struct timeval time_expires; 1679 struct sockaddr_storage dest_store; 1680 struct sockaddr *localep_sa = (struct sockaddr *)&dest_store; 1681 struct ip *iph; 1682 int notification = 0; 1683 struct sctp_nets *netl; 1684 int had_a_existing_tcb = 0; 1685 1686 #ifdef SCTP_DEBUG 1687 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1688 printf("sctp_handle_cookie: handling COOKIE-ECHO\n"); 1689 } 1690 #endif 1691 1692 if (inp_p == NULL) { 1693 #ifdef SCTP_DEBUG 1694 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1695 printf("sctp_handle_cookie: null inp_p!\n"); 1696 } 1697 #endif 1698 return (NULL); 1699 } 1700 /* First get the destination address setup too. */ 1701 iph = mtod(m, struct ip *); 1702 if (iph->ip_v == IPVERSION) { 1703 /* its IPv4 */ 1704 struct sockaddr_in *sin_d; 1705 sin_d = (struct sockaddr_in *)(localep_sa); 1706 memset(sin_d, 0, sizeof(*sin_d)); 1707 sin_d->sin_family = AF_INET; 1708 sin_d->sin_len = sizeof(*sin_d); 1709 sin_d->sin_port = sh->dest_port; 1710 sin_d->sin_addr.s_addr = iph->ip_dst.s_addr ; 1711 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1712 /* its IPv6 */ 1713 struct ip6_hdr *ip6; 1714 struct sockaddr_in6 *sin6_d; 1715 sin6_d = (struct sockaddr_in6 *)(localep_sa); 1716 memset(sin6_d, 0, sizeof(*sin6_d)); 1717 sin6_d->sin6_family = AF_INET6; 1718 sin6_d->sin6_len = sizeof(struct sockaddr_in6); 1719 ip6 = mtod(m, struct ip6_hdr *); 1720 sin6_d->sin6_port = sh->dest_port; 1721 sin6_d->sin6_addr = ip6->ip6_dst; 1722 } else { 1723 return (NULL); 1724 } 1725 1726 cookie = &cp->cookie; 1727 cookie_offset = offset + sizeof(struct sctp_chunkhdr); 1728 cookie_len = ntohs(cp->ch.chunk_length); 1729 1730 /* compute size of packet */ 1731 if (m->m_flags & M_PKTHDR) { 1732 size_of_pkt = m->m_pkthdr.len; 1733 } else { 1734 /* Should have a pkt hdr really */ 1735 struct mbuf *mat; 1736 mat = m; 1737 size_of_pkt = 0; 1738 while (mat != NULL) { 1739 size_of_pkt += mat->m_len; 1740 mat = mat->m_next; 1741 } 1742 } 1743 if (cookie_len > size_of_pkt || 1744 cookie_len < sizeof(struct sctp_cookie_echo_chunk) + 1745 sizeof(struct sctp_init_chunk) + 1746 sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) { 1747 /* cookie too long! or too small */ 1748 #ifdef SCTP_DEBUG 1749 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1750 printf("sctp_handle_cookie: cookie_len=%u, pkt size=%u\n", cookie_len, size_of_pkt); 1751 } 1752 #endif /* SCTP_DEBUG */ 1753 return (NULL); 1754 } 1755 1756 if ((cookie->peerport != sh->src_port) && 1757 (cookie->myport != sh->dest_port) && 1758 (cookie->my_vtag != sh->v_tag)) { 1759 /* 1760 * invalid ports or bad tag. Note that we always leave 1761 * the v_tag in the header in network order and when we 1762 * stored it in the my_vtag slot we also left it in network 1763 * order. This maintians the match even though it may be in 1764 * the opposite byte order of the machine :-> 1765 */ 1766 return (NULL); 1767 } 1768 1769 /* 1770 * split off the signature into its own mbuf (since it 1771 * should not be calculated in the sctp_hash_digest_m() call). 1772 */ 1773 sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE; 1774 if (sig_offset > size_of_pkt) { 1775 /* packet not correct size! */ 1776 /* XXX this may already be accounted for earlier... */ 1777 #ifdef SCTP_DEBUG 1778 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1779 printf("sctp_handle_cookie: sig offset=%u, pkt size=%u\n", sig_offset, size_of_pkt); 1780 } 1781 #endif 1782 return (NULL); 1783 } 1784 1785 m_sig = m_split(m, sig_offset, M_DONTWAIT); 1786 if (m_sig == NULL) { 1787 /* out of memory or ?? */ 1788 #ifdef SCTP_DEBUG 1789 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1790 printf("sctp_handle_cookie: couldn't m_split the signature\n"); 1791 } 1792 #endif 1793 return (NULL); 1794 } 1795 /* 1796 * compute the signature/digest for the cookie 1797 */ 1798 ep = &(*inp_p)->sctp_ep; 1799 l_inp = *inp_p; 1800 if (l_stcb) { 1801 SCTP_TCB_UNLOCK(l_stcb); 1802 } 1803 SCTP_INP_RLOCK(l_inp); 1804 if (l_stcb) { 1805 SCTP_TCB_LOCK(l_stcb); 1806 } 1807 /* which cookie is it? */ 1808 if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) && 1809 (ep->current_secret_number != ep->last_secret_number)) { 1810 /* it's the old cookie */ 1811 #ifdef SCTP_DEBUG 1812 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1813 printf("sctp_handle_cookie: old cookie sig\n"); 1814 } 1815 #endif 1816 sctp_hash_digest_m((char *)ep->secret_key[(int)ep->last_secret_number], 1817 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1818 } else { 1819 /* it's the current cookie */ 1820 #ifdef SCTP_DEBUG 1821 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1822 printf("sctp_handle_cookie: current cookie sig\n"); 1823 } 1824 #endif 1825 sctp_hash_digest_m((char *)ep->secret_key[(int)ep->current_secret_number], 1826 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1827 } 1828 /* get the signature */ 1829 SCTP_INP_RUNLOCK(l_inp); 1830 sig = (u_int8_t *)sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (u_int8_t *)&tmp_sig); 1831 if (sig == NULL) { 1832 /* couldn't find signature */ 1833 #ifdef SCTP_DEBUG 1834 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 1835 printf("sctp_handle_cookie: couldn't pull the signature\n"); 1836 } 1837 #endif 1838 return (NULL); 1839 } 1840 /* compare the received digest with the computed digest */ 1841 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) { 1842 /* try the old cookie? */ 1843 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) && 1844 (ep->current_secret_number != ep->last_secret_number)) { 1845 /* compute digest with old */ 1846 #ifdef SCTP_DEBUG 1847 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1848 printf("sctp_handle_cookie: old cookie sig\n"); 1849 } 1850 #endif 1851 sctp_hash_digest_m((char *)ep->secret_key[(int)ep->last_secret_number], 1852 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig); 1853 /* compare */ 1854 if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0) 1855 cookie_ok = 1; 1856 } 1857 } else { 1858 cookie_ok = 1; 1859 } 1860 1861 /* 1862 * Now before we continue we must reconstruct our mbuf so 1863 * that normal processing of any other chunks will work. 1864 */ 1865 { 1866 struct mbuf *m_at; 1867 m_at = m; 1868 while (m_at->m_next != NULL) { 1869 m_at = m_at->m_next; 1870 } 1871 m_at->m_next = m_sig; 1872 if (m->m_flags & M_PKTHDR) { 1873 /* 1874 * We should only do this if and only if the front 1875 * mbuf has a m_pkthdr... it should in theory. 1876 */ 1877 if (m_sig->m_flags & M_PKTHDR) { 1878 /* Add back to the pkt hdr of main m chain */ 1879 m->m_pkthdr.len += m_sig->m_len; 1880 } else { 1881 /* 1882 * Got a problem, no pkthdr in split chain. 1883 * TSNH but we will handle it just in case 1884 */ 1885 int mmlen = 0; 1886 struct mbuf *lat; 1887 printf("Warning: Hitting m_split join TSNH code - fixed\n"); 1888 lat = m_sig; 1889 while (lat) { 1890 mmlen += lat->m_len; 1891 lat = lat->m_next; 1892 } 1893 m->m_pkthdr.len += mmlen; 1894 } 1895 } 1896 } 1897 1898 if (cookie_ok == 0) { 1899 #ifdef SCTP_DEBUG 1900 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1901 printf("handle_cookie_echo: cookie signature validation failed!\n"); 1902 printf("offset = %u, cookie_offset = %u, sig_offset = %u\n", 1903 (u_int32_t)offset, cookie_offset, sig_offset); 1904 } 1905 #endif 1906 return (NULL); 1907 } 1908 #ifdef SCTP_DEBUG 1909 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 1910 printf("handle_cookie_echo: cookie signature validation passed\n"); 1911 } 1912 #endif 1913 1914 /* 1915 * check the cookie timestamps to be sure it's not stale 1916 */ 1917 SCTP_GETTIME_TIMEVAL(&now); 1918 /* Expire time is in Ticks, so we convert to seconds */ 1919 time_expires.tv_sec = cookie->time_entered.tv_sec + cookie->cookie_life; 1920 time_expires.tv_usec = cookie->time_entered.tv_usec; 1921 #ifndef __FreeBSD__ 1922 if (timercmp(&now, &time_expires, >)) 1923 #else 1924 if (timevalcmp(&now, &time_expires, >)) 1925 #endif 1926 { 1927 /* cookie is stale! */ 1928 struct mbuf *op_err; 1929 struct sctp_stale_cookie_msg *scm; 1930 u_int32_t tim; 1931 #ifdef SCTP_DEBUG 1932 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 1933 printf("sctp_handle_cookie: got a STALE cookie!\n"); 1934 } 1935 #endif 1936 MGETHDR(op_err, M_DONTWAIT, MT_HEADER); 1937 if (op_err == NULL) { 1938 /* FOOBAR */ 1939 return (NULL); 1940 } 1941 /* pre-reserve some space */ 1942 op_err->m_data += sizeof(struct ip6_hdr); 1943 op_err->m_data += sizeof(struct sctphdr); 1944 op_err->m_data += sizeof(struct sctp_chunkhdr); 1945 1946 /* Set the len */ 1947 op_err->m_len = op_err->m_pkthdr.len = sizeof(struct sctp_stale_cookie_msg); 1948 scm = mtod(op_err, struct sctp_stale_cookie_msg *); 1949 scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE); 1950 scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) + 1951 (sizeof(u_int32_t)))); 1952 /* seconds to usec */ 1953 tim = (now.tv_sec - time_expires.tv_sec) * 1000000; 1954 /* add in usec */ 1955 if (tim == 0) 1956 tim = now.tv_usec - cookie->time_entered.tv_usec; 1957 scm->time_usec = htonl(tim); 1958 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag); 1959 return (NULL); 1960 } 1961 /* 1962 * Now we must see with the lookup address if we have an existing 1963 * asoc. This will only happen if we were in the COOKIE-WAIT state 1964 * and a INIT collided with us and somewhere the peer sent the 1965 * cookie on another address besides the single address our assoc 1966 * had for him. In this case we will have one of the tie-tags set 1967 * at least AND the address field in the cookie can be used to 1968 * look it up. 1969 */ 1970 to = NULL; 1971 if (cookie->addr_type == SCTP_IPV6_ADDRESS) { 1972 memset(&sin6, 0, sizeof(sin6)); 1973 sin6.sin6_family = AF_INET6; 1974 sin6.sin6_len = sizeof(sin6); 1975 sin6.sin6_port = sh->src_port; 1976 sin6.sin6_scope_id = cookie->scope_id; 1977 memcpy(&sin6.sin6_addr.s6_addr, cookie->address, 1978 sizeof(sin6.sin6_addr.s6_addr)); 1979 to = (struct sockaddr *)&sin6; 1980 } else if (cookie->addr_type == SCTP_IPV4_ADDRESS) { 1981 memset(&sin, 0, sizeof(sin)); 1982 sin.sin_family = AF_INET; 1983 sin.sin_len = sizeof(sin); 1984 sin.sin_port = sh->src_port; 1985 sin.sin_addr.s_addr = cookie->address[0]; 1986 to = (struct sockaddr *)&sin; 1987 } 1988 1989 if ((*stcb == NULL) && to) { 1990 /* Yep, lets check */ 1991 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL); 1992 if (*stcb == NULL) { 1993 /* We should have only got back the same inp. If we 1994 * got back a different ep we have a problem. The original 1995 * findep got back l_inp and now 1996 */ 1997 if (l_inp != *inp_p) { 1998 printf("Bad problem find_ep got a diff inp then special_locate?\n"); 1999 } 2000 } 2001 } 2002 2003 cookie_len -= SCTP_SIGNATURE_SIZE; 2004 if (*stcb == NULL) { 2005 /* this is the "normal" case... get a new TCB */ 2006 #ifdef SCTP_DEBUG 2007 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2008 printf("sctp_handle_cookie: processing NEW cookie\n"); 2009 } 2010 #endif 2011 *stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie, 2012 cookie_len, *inp_p, netp, to, ¬ification); 2013 /* now always decrement, since this is the normal 2014 * case.. we had no tcb when we entered. 2015 */ 2016 } else { 2017 /* this is abnormal... cookie-echo on existing TCB */ 2018 #ifdef SCTP_DEBUG 2019 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2020 printf("sctp_handle_cookie: processing EXISTING cookie\n"); 2021 } 2022 #endif 2023 had_a_existing_tcb = 1; 2024 *stcb = sctp_process_cookie_existing(m, iphlen, offset, sh, 2025 cookie, cookie_len, *inp_p, *stcb, *netp, to, ¬ification); 2026 } 2027 2028 if (*stcb == NULL) { 2029 /* still no TCB... must be bad cookie-echo */ 2030 #ifdef SCTP_DEBUG 2031 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2032 printf("handle_cookie_echo: ACK! don't have a TCB!\n"); 2033 } 2034 #endif /* SCTP_DEBUG */ 2035 return (NULL); 2036 } 2037 2038 /* 2039 * Ok, we built an association so confirm the address 2040 * we sent the INIT-ACK to. 2041 */ 2042 netl = sctp_findnet(*stcb, to); 2043 /* This code should in theory NOT run but 2044 */ 2045 if (netl == NULL) { 2046 #ifdef SCTP_DEBUG 2047 printf("TSNH! Huh, why do I need to add this address here?\n"); 2048 #endif 2049 sctp_add_remote_addr(*stcb, to, 0, 100); 2050 netl = sctp_findnet(*stcb, to); 2051 } 2052 if (netl) { 2053 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) { 2054 netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2055 sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL, 2056 netl); 2057 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED, 2058 (*stcb), 0, (void *)netl); 2059 } 2060 } 2061 #ifdef SCTP_DEBUG 2062 else { 2063 printf("Could not add source address for some reason\n"); 2064 } 2065 #endif 2066 2067 if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 2068 if (!had_a_existing_tcb || 2069 (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) { 2070 /* 2071 * If we have a NEW cookie or the connect never reached 2072 * the connected state during collision we must do the 2073 * TCP accept thing. 2074 */ 2075 struct socket *so, *oso; 2076 struct sctp_inpcb *inp; 2077 if (notification == SCTP_NOTIFY_ASSOC_RESTART) { 2078 /* 2079 * For a restart we will keep the same socket, 2080 * no need to do anything. I THINK!! 2081 */ 2082 sctp_ulp_notify(notification, *stcb, 0, NULL); 2083 return (m); 2084 } 2085 oso = (*inp_p)->sctp_socket; 2086 SCTP_TCB_UNLOCK((*stcb)); 2087 so = sonewconn(oso, SS_ISCONNECTED); 2088 SCTP_INP_WLOCK((*stcb)->sctp_ep); 2089 SCTP_TCB_LOCK((*stcb)); 2090 SCTP_INP_WUNLOCK((*stcb)->sctp_ep); 2091 if (so == NULL) { 2092 struct mbuf *op_err; 2093 /* Too many sockets */ 2094 #ifdef SCTP_DEBUG 2095 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 2096 printf("process_cookie_new: no room for another socket!\n"); 2097 } 2098 #endif /* SCTP_DEBUG */ 2099 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 2100 sctp_abort_association(*inp_p, NULL, m, iphlen, 2101 sh, op_err); 2102 sctp_free_assoc(*inp_p, *stcb); 2103 return (NULL); 2104 } 2105 inp = (struct sctp_inpcb *)so->so_pcb; 2106 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 2107 SCTP_PCB_FLAGS_CONNECTED | 2108 SCTP_PCB_FLAGS_IN_TCPPOOL | 2109 (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) | 2110 SCTP_PCB_FLAGS_DONT_WAKE); 2111 inp->sctp_socket = so; 2112 2113 /* 2114 * Now we must move it from one hash table to another 2115 * and get the tcb in the right place. 2116 */ 2117 sctp_move_pcb_and_assoc(*inp_p, inp, *stcb); 2118 2119 /* Switch over to the new guy */ 2120 *inp_p = inp; 2121 2122 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, 2123 *stcb, *netp); 2124 2125 sctp_ulp_notify(notification, *stcb, 0, NULL); 2126 return (m); 2127 } 2128 } 2129 if ((notification) && ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) { 2130 sctp_ulp_notify(notification, *stcb, 0, NULL); 2131 } 2132 return (m); 2133 } 2134 2135 static void 2136 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp, 2137 struct sctp_tcb *stcb, struct sctp_nets *net) 2138 { 2139 /* cp must not be used, others call this without a c-ack :-) */ 2140 struct sctp_association *asoc; 2141 2142 #ifdef SCTP_DEBUG 2143 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2144 printf("sctp_handle_cookie_ack: handling COOKIE-ACK\n"); 2145 } 2146 #endif 2147 if (stcb == NULL) 2148 return; 2149 2150 asoc = &stcb->asoc; 2151 2152 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep, stcb, net); 2153 2154 /* process according to association state */ 2155 if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) { 2156 /* state change only needed when I am in right state */ 2157 #ifdef SCTP_DEBUG 2158 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2159 printf("moving to OPEN state\n"); 2160 } 2161 #endif 2162 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 2163 asoc->state = SCTP_STATE_OPEN | SCTP_STATE_SHUTDOWN_PENDING; 2164 } else { 2165 asoc->state = SCTP_STATE_OPEN; 2166 } 2167 2168 /* update RTO */ 2169 if (asoc->overall_error_count == 0) { 2170 net->RTO = sctp_calculate_rto(stcb, asoc, net, 2171 &asoc->time_entered); 2172 } 2173 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 2174 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL); 2175 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 2176 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 2177 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED; 2178 soisconnected(stcb->sctp_ep->sctp_socket); 2179 } 2180 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, 2181 stcb, net); 2182 /* since we did not send a HB make sure we don't double things */ 2183 net->hb_responded = 1; 2184 2185 if (stcb->asoc.sctp_autoclose_ticks && 2186 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_AUTOCLOSE)) { 2187 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, 2188 stcb->sctp_ep, stcb, NULL); 2189 } 2190 2191 /* 2192 * set ASCONF timer if ASCONFs are pending and allowed 2193 * (eg. addresses changed when init/cookie echo in flight) 2194 */ 2195 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) && 2196 (stcb->asoc.peer_supports_asconf) && 2197 (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) { 2198 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, 2199 stcb->sctp_ep, stcb, 2200 stcb->asoc.primary_destination); 2201 } 2202 2203 } 2204 /* Toss the cookie if I can */ 2205 sctp_toss_old_cookies(asoc); 2206 if (!TAILQ_EMPTY(&asoc->sent_queue)) { 2207 /* Restart the timer if we have pending data */ 2208 struct sctp_tmit_chunk *chk; 2209 chk = TAILQ_FIRST(&asoc->sent_queue); 2210 if (chk) { 2211 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2212 stcb, chk->whoTo); 2213 } 2214 } 2215 2216 } 2217 2218 static void 2219 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp, 2220 struct sctp_tcb *stcb) 2221 { 2222 struct sctp_nets *net; 2223 struct sctp_tmit_chunk *lchk; 2224 u_int32_t tsn; 2225 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_ecne_chunk)) { 2226 return; 2227 } 2228 sctp_pegs[SCTP_ECNE_RCVD]++; 2229 tsn = ntohl(cp->tsn); 2230 /* ECN Nonce stuff: need a resync and disable the nonce sum check */ 2231 /* Also we make sure we disable the nonce_wait */ 2232 lchk = TAILQ_FIRST(&stcb->asoc.send_queue); 2233 if (lchk == NULL) { 2234 stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq; 2235 } else { 2236 stcb->asoc.nonce_resync_tsn = lchk->rec.data.TSN_seq; 2237 } 2238 stcb->asoc.nonce_wait_for_ecne = 0; 2239 stcb->asoc.nonce_sum_check = 0; 2240 2241 /* Find where it was sent, if possible */ 2242 net = NULL; 2243 lchk = TAILQ_FIRST(&stcb->asoc.sent_queue); 2244 while (lchk) { 2245 if (lchk->rec.data.TSN_seq == tsn) { 2246 net = lchk->whoTo; 2247 break; 2248 } 2249 if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ)) 2250 break; 2251 lchk = TAILQ_NEXT(lchk, sctp_next); 2252 } 2253 if (net == NULL) 2254 /* default is we use the primary */ 2255 net = stcb->asoc.primary_destination; 2256 2257 if (compare_with_wrap(tsn, stcb->asoc.last_cwr_tsn, MAX_TSN)) { 2258 #ifdef SCTP_CWND_LOGGING 2259 int old_cwnd; 2260 #endif 2261 #ifdef SCTP_CWND_LOGGING 2262 old_cwnd = net->cwnd; 2263 #endif 2264 sctp_pegs[SCTP_CWR_PERFO]++; 2265 net->ssthresh = net->cwnd / 2; 2266 if (net->ssthresh < net->mtu) { 2267 net->ssthresh = net->mtu; 2268 /* here back off the timer as well, to slow us down */ 2269 net->RTO <<= 2; 2270 } 2271 net->cwnd = net->ssthresh; 2272 #ifdef SCTP_CWND_LOGGING 2273 sctp_log_cwnd(net, (net->cwnd-old_cwnd), SCTP_CWND_LOG_FROM_SAT); 2274 #endif 2275 /* we reduce once every RTT. So we will only lower 2276 * cwnd at the next sending seq i.e. the resync_tsn. 2277 */ 2278 stcb->asoc.last_cwr_tsn = stcb->asoc.nonce_resync_tsn; 2279 } 2280 /* 2281 * We always send a CWR this way if our previous one was lost 2282 * our peer will get an update, or if it is not time again 2283 * to reduce we still get the cwr to the peer. 2284 */ 2285 sctp_send_cwr(stcb, net, tsn); 2286 } 2287 2288 static void 2289 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb) 2290 { 2291 /* Here we get a CWR from the peer. We must look in 2292 * the outqueue and make sure that we have a covered 2293 * ECNE in teh control chunk part. If so remove it. 2294 */ 2295 struct sctp_tmit_chunk *chk; 2296 struct sctp_ecne_chunk *ecne; 2297 2298 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { 2299 if (chk->rec.chunk_id != SCTP_ECN_ECHO) { 2300 continue; 2301 } 2302 /* Look for and remove if it is the right TSN. Since 2303 * there is only ONE ECNE on the control queue at 2304 * any one time we don't need to worry about more than 2305 * one! 2306 */ 2307 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 2308 if (compare_with_wrap(ntohl(cp->tsn), ntohl(ecne->tsn), 2309 MAX_TSN) || (cp->tsn == ecne->tsn)) { 2310 /* this covers this ECNE, we can remove it */ 2311 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk, 2312 sctp_next); 2313 sctp_m_freem(chk->data); 2314 chk->data = NULL; 2315 stcb->asoc.ctrl_queue_cnt--; 2316 sctp_free_remote_addr(chk->whoTo); 2317 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 2318 sctppcbinfo.ipi_count_chunk--; 2319 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 2320 panic("Chunk count is negative"); 2321 } 2322 sctppcbinfo.ipi_gencnt_chunk++; 2323 break; 2324 } 2325 } 2326 } 2327 2328 static void 2329 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp, 2330 struct sctp_tcb *stcb, struct sctp_nets *net) 2331 { 2332 struct sctp_association *asoc; 2333 2334 #ifdef SCTP_DEBUG 2335 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 2336 printf("sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n"); 2337 } 2338 #endif 2339 if (stcb == NULL) 2340 return; 2341 2342 asoc = &stcb->asoc; 2343 /* process according to association state */ 2344 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) { 2345 /* unexpected SHUTDOWN-COMPLETE... so ignore... */ 2346 return; 2347 } 2348 /* notify upper layer protocol */ 2349 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL); 2350 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 2351 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 2352 stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED; 2353 stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 2354 stcb->sctp_ep->sctp_socket->so_snd.sb_mbcnt = 0; 2355 soisdisconnected(stcb->sctp_ep->sctp_socket); 2356 } 2357 /* are the queues empty? they should be */ 2358 if (!TAILQ_EMPTY(&asoc->send_queue) || 2359 !TAILQ_EMPTY(&asoc->sent_queue) || 2360 !TAILQ_EMPTY(&asoc->out_wheel)) { 2361 sctp_report_all_outbound(stcb); 2362 } 2363 /* stop the timer */ 2364 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net); 2365 /* free the TCB */ 2366 sctp_free_assoc(stcb->sctp_ep, stcb); 2367 return; 2368 } 2369 2370 static int 2371 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc, 2372 struct sctp_nets *net, u_int8_t flg) 2373 { 2374 switch (desc->chunk_type) { 2375 case SCTP_DATA: 2376 /* find the tsn to resend (possibly */ 2377 { 2378 u_int32_t tsn; 2379 struct sctp_tmit_chunk *tp1; 2380 tsn = ntohl(desc->tsn_ifany); 2381 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2382 while (tp1) { 2383 if (tp1->rec.data.TSN_seq == tsn) { 2384 /* found it */ 2385 break; 2386 } 2387 if (compare_with_wrap(tp1->rec.data.TSN_seq, tsn, 2388 MAX_TSN)) { 2389 /* not found */ 2390 tp1 = NULL; 2391 break; 2392 } 2393 tp1 = TAILQ_NEXT(tp1, sctp_next); 2394 } 2395 if (tp1 == NULL) { 2396 /* Do it the other way */ 2397 sctp_pegs[SCTP_PDRP_DNFND]++; 2398 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue); 2399 while (tp1) { 2400 if (tp1->rec.data.TSN_seq == tsn) { 2401 /* found it */ 2402 break; 2403 } 2404 tp1 = TAILQ_NEXT(tp1, sctp_next); 2405 } 2406 } 2407 if (tp1 == NULL) { 2408 sctp_pegs[SCTP_PDRP_TSNNF]++; 2409 } 2410 if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) { 2411 u_int8_t *ddp; 2412 if (((tp1->rec.data.state_flags & SCTP_WINDOW_PROBE) == SCTP_WINDOW_PROBE) && 2413 ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) { 2414 sctp_pegs[SCTP_PDRP_DIWNP]++; 2415 return (0); 2416 } 2417 if (stcb->asoc.peers_rwnd == 0 && 2418 (flg & SCTP_FROM_MIDDLE_BOX)) { 2419 sctp_pegs[SCTP_PDRP_DIZRW]++; 2420 return (0); 2421 } 2422 ddp = (u_int8_t *)(mtod(tp1->data, vaddr_t) + 2423 sizeof(struct sctp_data_chunk)); 2424 { 2425 unsigned int iii; 2426 for (iii = 0; iii < sizeof(desc->data_bytes); 2427 iii++) { 2428 if (ddp[iii] != desc->data_bytes[iii]) { 2429 sctp_pegs[SCTP_PDRP_BADD]++; 2430 return (-1); 2431 } 2432 } 2433 } 2434 if (tp1->sent != SCTP_DATAGRAM_RESEND) { 2435 stcb->asoc.sent_queue_retran_cnt++; 2436 } 2437 /* We zero out the nonce so resync not needed */ 2438 tp1->rec.data.ect_nonce = 0; 2439 2440 if (tp1->do_rtt) { 2441 /* 2442 * this guy had a RTO calculation pending on it, 2443 * cancel it 2444 */ 2445 tp1->whoTo->rto_pending = 0; 2446 tp1->do_rtt = 0; 2447 } 2448 sctp_pegs[SCTP_PDRP_MARK]++; 2449 tp1->sent = SCTP_DATAGRAM_RESEND; 2450 /* 2451 * mark it as if we were doing a FR, since we 2452 * will be getting gap ack reports behind the 2453 * info from the router. 2454 */ 2455 tp1->rec.data.doing_fast_retransmit = 1; 2456 /* 2457 * mark the tsn with what sequences can cause a new FR. 2458 */ 2459 if (TAILQ_EMPTY(&stcb->asoc.send_queue) ) { 2460 tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq; 2461 } else { 2462 tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq; 2463 } 2464 2465 /* restart the timer */ 2466 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2467 stcb, tp1->whoTo); 2468 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 2469 stcb, tp1->whoTo); 2470 2471 /* fix counts and things */ 2472 sctp_flight_size_decrease(tp1); 2473 sctp_total_flight_decrease(stcb, tp1); 2474 tp1->snd_count--; 2475 } 2476 { 2477 /* audit code */ 2478 unsigned int audit; 2479 audit = 0; 2480 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) { 2481 if (tp1->sent == SCTP_DATAGRAM_RESEND) 2482 audit++; 2483 } 2484 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue, 2485 sctp_next) { 2486 if (tp1->sent == SCTP_DATAGRAM_RESEND) 2487 audit++; 2488 } 2489 if (audit != stcb->asoc.sent_queue_retran_cnt) { 2490 printf("**Local Audit finds cnt:%d asoc cnt:%d\n", 2491 audit, stcb->asoc.sent_queue_retran_cnt); 2492 #ifndef SCTP_AUDITING_ENABLED 2493 stcb->asoc.sent_queue_retran_cnt = audit; 2494 #endif 2495 } 2496 } 2497 } 2498 break; 2499 case SCTP_ASCONF: 2500 { 2501 struct sctp_tmit_chunk *asconf; 2502 TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue, 2503 sctp_next) { 2504 if (asconf->rec.chunk_id == SCTP_ASCONF) { 2505 break; 2506 } 2507 } 2508 if (asconf) { 2509 if (asconf->sent != SCTP_DATAGRAM_RESEND) 2510 stcb->asoc.sent_queue_retran_cnt++; 2511 asconf->sent = SCTP_DATAGRAM_RESEND; 2512 asconf->snd_count--; 2513 } 2514 } 2515 break; 2516 case SCTP_INITIATION: 2517 /* resend the INIT */ 2518 stcb->asoc.dropped_special_cnt++; 2519 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) { 2520 /* 2521 * If we can get it in, in a few attempts we do this, 2522 * otherwise we let the timer fire. 2523 */ 2524 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, 2525 stcb, net); 2526 sctp_send_initiate(stcb->sctp_ep, stcb); 2527 } 2528 break; 2529 case SCTP_SELECTIVE_ACK: 2530 /* resend the sack */ 2531 sctp_send_sack(stcb); 2532 break; 2533 case SCTP_HEARTBEAT_REQUEST: 2534 /* resend a demand HB */ 2535 sctp_send_hb(stcb, 1, net); 2536 break; 2537 case SCTP_SHUTDOWN: 2538 #ifdef SCTP_DEBUG 2539 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2540 printf("%s:%d sends a shutdown\n", 2541 __FILE__, 2542 __LINE__ 2543 ); 2544 } 2545 #endif 2546 sctp_send_shutdown(stcb, net); 2547 break; 2548 case SCTP_SHUTDOWN_ACK: 2549 sctp_send_shutdown_ack(stcb, net); 2550 break; 2551 case SCTP_COOKIE_ECHO: 2552 { 2553 struct sctp_tmit_chunk *cookie; 2554 cookie = NULL; 2555 TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue, 2556 sctp_next) { 2557 if (cookie->rec.chunk_id == SCTP_COOKIE_ECHO) { 2558 break; 2559 } 2560 } 2561 if (cookie) { 2562 if (cookie->sent != SCTP_DATAGRAM_RESEND) 2563 stcb->asoc.sent_queue_retran_cnt++; 2564 cookie->sent = SCTP_DATAGRAM_RESEND; 2565 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep, stcb, net); 2566 } 2567 } 2568 break; 2569 case SCTP_COOKIE_ACK: 2570 sctp_send_cookie_ack(stcb); 2571 break; 2572 case SCTP_ASCONF_ACK: 2573 /* resend last asconf ack */ 2574 sctp_send_asconf_ack(stcb, 1); 2575 break; 2576 case SCTP_FORWARD_CUM_TSN: 2577 send_forward_tsn(stcb, &stcb->asoc); 2578 break; 2579 /* can't do anything with these */ 2580 case SCTP_PACKET_DROPPED: 2581 case SCTP_INITIATION_ACK: /* this should not happen */ 2582 case SCTP_HEARTBEAT_ACK: 2583 case SCTP_ABORT_ASSOCIATION: 2584 case SCTP_OPERATION_ERROR: 2585 case SCTP_SHUTDOWN_COMPLETE: 2586 case SCTP_ECN_ECHO: 2587 case SCTP_ECN_CWR: 2588 default: 2589 break; 2590 } 2591 return (0); 2592 } 2593 2594 static void 2595 sctp_reset_in_stream(struct sctp_tcb *stcb, 2596 struct sctp_stream_reset_response *resp, int number_entries) 2597 { 2598 int i; 2599 uint16_t *list, temp; 2600 2601 /* We set things to 0xffff since this is the last delivered 2602 * sequence and we will be sending in 0 after the reset. 2603 */ 2604 2605 if (resp->reset_flags & SCTP_RESET_PERFORMED) { 2606 if (number_entries) { 2607 list = resp->list_of_streams; 2608 for (i = 0; i < number_entries; i++) { 2609 temp = ntohs(list[i]); 2610 list[i] = temp; 2611 if (list[i] >= stcb->asoc.streamincnt) { 2612 printf("Invalid stream in-stream reset %d\n", list[i]); 2613 continue; 2614 } 2615 stcb->asoc.strmin[(list[i])].last_sequence_delivered = 0xffff; 2616 } 2617 } else { 2618 list = NULL; 2619 for (i = 0; i < stcb->asoc.streamincnt; i++) { 2620 stcb->asoc.strmin[i].last_sequence_delivered = 0xffff; 2621 } 2622 } 2623 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list); 2624 } 2625 } 2626 2627 static void 2628 sctp_clean_up_stream_reset(struct sctp_tcb *stcb) 2629 { 2630 struct sctp_tmit_chunk *chk, *nchk; 2631 struct sctp_association *asoc; 2632 2633 asoc = &stcb->asoc; 2634 2635 for (chk = TAILQ_FIRST(&asoc->control_send_queue); 2636 chk; chk = nchk) { 2637 nchk = TAILQ_NEXT(chk, sctp_next); 2638 if (chk->rec.chunk_id == SCTP_STREAM_RESET) { 2639 struct sctp_stream_reset_req *strreq; 2640 strreq = mtod(chk->data, struct sctp_stream_reset_req *); 2641 if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) { 2642 /* we only clean up the request */ 2643 continue; 2644 } else if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) { 2645 printf("TSNH, an unknown stream reset request is in queue %x\n", 2646 (u_int)ntohs(strreq->sr_req.ph.param_type)); 2647 continue; 2648 } 2649 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 2650 TAILQ_REMOVE(&asoc->control_send_queue, 2651 chk, 2652 sctp_next); 2653 sctp_m_freem(chk->data); 2654 chk->data = NULL; 2655 asoc->ctrl_queue_cnt--; 2656 sctp_free_remote_addr(chk->whoTo); 2657 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 2658 sctppcbinfo.ipi_count_chunk--; 2659 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 2660 panic("Chunk count is negative"); 2661 } 2662 sctppcbinfo.ipi_gencnt_chunk++; 2663 /* we can only have one of these so we break */ 2664 break; 2665 } 2666 } 2667 } 2668 2669 2670 void 2671 sctp_handle_stream_reset_response(struct sctp_tcb *stcb, 2672 struct sctp_stream_reset_response *resp) 2673 { 2674 uint32_t seq, tsn; 2675 int number_entries, param_length; 2676 2677 param_length = ntohs(resp->ph.param_length); 2678 seq = ntohl(resp->reset_req_seq_resp); 2679 if (seq == stcb->asoc.str_reset_seq_out) { 2680 sctp_clean_up_stream_reset(stcb); 2681 stcb->asoc.str_reset_seq_out++; 2682 stcb->asoc.stream_reset_outstanding = 0; 2683 tsn = ntohl(resp->reset_at_tsn); 2684 number_entries = (param_length - sizeof(struct sctp_stream_reset_response))/sizeof(uint16_t); 2685 tsn--; 2686 if ((tsn == stcb->asoc.cumulative_tsn) || 2687 (compare_with_wrap(stcb->asoc.cumulative_tsn, tsn, MAX_TSN))) { 2688 /* no problem we are good to go */ 2689 sctp_reset_in_stream(stcb, resp, number_entries); 2690 } else { 2691 /* So, we have a stream reset but there 2692 * is pending data. We need to copy 2693 * out the stream_reset and then queue 2694 * any data = or > resp->reset_at_tsn 2695 */ 2696 if (stcb->asoc.pending_reply != NULL) { 2697 /* FIX ME FIX ME 2698 * This IS WRONG. We need 2699 * to queue each of these up 2700 * and only release the chunks 2701 * for each reset that the cum-ack 2702 * goes by. This is a short cut. 2703 */ 2704 free(stcb->asoc.pending_reply, M_PCB); 2705 } 2706 stcb->asoc.pending_reply = malloc(param_length, 2707 M_PCB, M_NOWAIT); 2708 memcpy(stcb->asoc.pending_reply, resp, param_length); 2709 } 2710 2711 } else { 2712 /* duplicate */ 2713 #ifdef SCTP_DEBUG 2714 printf("Duplicate old stream reset resp next:%x this one:%x\n", 2715 stcb->asoc.str_reset_seq_out, seq); 2716 #endif 2717 } 2718 } 2719 2720 2721 static void 2722 sctp_handle_stream_reset(struct sctp_tcb *stcb, struct sctp_stream_reset_req *sr_req) 2723 { 2724 int chk_length, param_len; 2725 struct sctp_paramhdr *ph; 2726 /* now it may be a reset or a reset-response */ 2727 struct sctp_stream_reset_request *req; 2728 struct sctp_stream_reset_response *resp; 2729 chk_length = ntohs(sr_req->ch.chunk_length); 2730 2731 ph = (struct sctp_paramhdr *)&sr_req->sr_req; 2732 while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_request)) { 2733 param_len = ntohs(ph->param_length); 2734 if (ntohs(ph->param_type) == SCTP_STR_RESET_REQUEST) { 2735 /* this will send the ACK and do the reset if needed */ 2736 req = (struct sctp_stream_reset_request *)ph; 2737 sctp_send_str_reset_ack(stcb, req); 2738 } else if (ntohs(ph->param_type) == SCTP_STR_RESET_RESPONSE) { 2739 /* Now here is a tricky one. We reset our receive side 2740 * of the streams. But what happens if the peers 2741 * next sending TSN is NOT equal to 1 minus our cumack? 2742 * And if his cumack is not equal to our next one out - 1 2743 * we have another problem if this is receprical. 2744 */ 2745 resp = (struct sctp_stream_reset_response *)ph; 2746 sctp_handle_stream_reset_response(stcb, resp); 2747 } 2748 ph = (struct sctp_paramhdr *)((vaddr_t)ph + SCTP_SIZE32(param_len)); 2749 chk_length -= SCTP_SIZE32(param_len); 2750 } 2751 } 2752 2753 /* 2754 * Handle a router or endpoints report of a packet loss, there 2755 * are two ways to handle this, either we get the whole packet 2756 * and must disect it ourselves (possibly with truncation and 2757 * or corruption) or it is a summary from a middle box that did 2758 * the disectting for us. 2759 */ 2760 static void 2761 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp, 2762 struct sctp_tcb *stcb, struct sctp_nets *net) 2763 { 2764 u_int32_t bottle_bw, on_queue; 2765 u_int16_t trunc_len; 2766 unsigned int chlen; 2767 unsigned int at; 2768 struct sctp_chunk_desc desc; 2769 struct sctp_chunkhdr *ch; 2770 2771 chlen = ntohs(cp->ch.chunk_length); 2772 chlen -= sizeof(struct sctp_pktdrop_chunk); 2773 /* XXX possible chlen underflow */ 2774 if (chlen == 0) { 2775 ch = NULL; 2776 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) 2777 sctp_pegs[SCTP_PDRP_BWRPT]++; 2778 } else { 2779 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr)); 2780 chlen -= sizeof(struct sctphdr); 2781 /* XXX possible chlen underflow */ 2782 memset(&desc, 0, sizeof(desc)); 2783 } 2784 2785 /* first update a rwnd possibly */ 2786 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) { 2787 /* From a peer, we get a rwnd report */ 2788 u_int32_t a_rwnd; 2789 2790 sctp_pegs[SCTP_PDRP_FEHOS]++; 2791 2792 bottle_bw = ntohl(cp->bottle_bw); 2793 on_queue = ntohl(cp->current_onq); 2794 if (bottle_bw && on_queue) { 2795 /* a rwnd report is in here */ 2796 if (bottle_bw > on_queue) 2797 a_rwnd = bottle_bw - on_queue; 2798 else 2799 a_rwnd = 0; 2800 2801 if (a_rwnd <= 0) 2802 stcb->asoc.peers_rwnd = 0; 2803 else { 2804 if (a_rwnd > stcb->asoc.total_flight) { 2805 stcb->asoc.peers_rwnd = 2806 a_rwnd - stcb->asoc.total_flight; 2807 } else { 2808 stcb->asoc.peers_rwnd = 0; 2809 } 2810 if (stcb->asoc.peers_rwnd < 2811 stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 2812 /* SWS sender side engages */ 2813 stcb->asoc.peers_rwnd = 0; 2814 } 2815 } 2816 } 2817 } else { 2818 sctp_pegs[SCTP_PDRP_FMBOX]++; 2819 } 2820 trunc_len = (u_int16_t)ntohs(cp->trunc_len); 2821 /* now the chunks themselves */ 2822 while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) { 2823 desc.chunk_type = ch->chunk_type; 2824 /* get amount we need to move */ 2825 at = ntohs(ch->chunk_length); 2826 if (at < sizeof(struct sctp_chunkhdr)) { 2827 /* corrupt chunk, maybe at the end? */ 2828 sctp_pegs[SCTP_PDRP_CRUPT]++; 2829 break; 2830 } 2831 if (trunc_len == 0) { 2832 /* we are supposed to have all of it */ 2833 if (at > chlen) { 2834 /* corrupt skip it */ 2835 sctp_pegs[SCTP_PDRP_CRUPT]++; 2836 break; 2837 } 2838 } else { 2839 /* is there enough of it left ? */ 2840 if (desc.chunk_type == SCTP_DATA) { 2841 if (chlen < (sizeof(struct sctp_data_chunk) + 2842 sizeof(desc.data_bytes))) { 2843 break; 2844 } 2845 } else { 2846 if (chlen < sizeof(struct sctp_chunkhdr)) { 2847 break; 2848 } 2849 } 2850 } 2851 if (desc.chunk_type == SCTP_DATA) { 2852 /* can we get out the tsn? */ 2853 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 2854 sctp_pegs[SCTP_PDRP_MB_DA]++; 2855 2856 if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(u_int32_t)) ) { 2857 /* yep */ 2858 struct sctp_data_chunk *dcp; 2859 u_int8_t *ddp; 2860 unsigned int iii; 2861 dcp = (struct sctp_data_chunk *)ch; 2862 ddp = (u_int8_t *)(dcp + 1); 2863 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) { 2864 desc.data_bytes[iii] = ddp[iii]; 2865 } 2866 desc.tsn_ifany = dcp->dp.tsn; 2867 } else { 2868 /* nope we are done. */ 2869 sctp_pegs[SCTP_PDRP_NEDAT]++; 2870 break; 2871 } 2872 } else { 2873 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)) 2874 sctp_pegs[SCTP_PDRP_MB_CT]++; 2875 } 2876 2877 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) { 2878 sctp_pegs[SCTP_PDRP_PDBRK]++; 2879 break; 2880 } 2881 if (SCTP_SIZE32(at) > chlen) { 2882 break; 2883 } 2884 chlen -= SCTP_SIZE32(at); 2885 if (chlen < sizeof(struct sctp_chunkhdr)) { 2886 /* done, none left */ 2887 break; 2888 } 2889 ch = (struct sctp_chunkhdr *)((vaddr_t)ch + SCTP_SIZE32(at)); 2890 } 2891 2892 /* now middle boxes in sat networks get a cwnd bump */ 2893 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) && 2894 (stcb->asoc.sat_t3_loss_recovery == 0) && 2895 (stcb->asoc.sat_network)) { 2896 /* 2897 * This is debateable but for sat networks it makes sense 2898 * Note if a T3 timer has went off, we will prohibit any 2899 * changes to cwnd until we exit the t3 loss recovery. 2900 */ 2901 u_int32_t bw_avail; 2902 int rtt, incr; 2903 #ifdef SCTP_CWND_LOGGING 2904 int old_cwnd=net->cwnd; 2905 #endif 2906 /* need real RTT for this calc */ 2907 rtt = ((net->lastsa >> 2) + net->lastsv) >> 1; 2908 /* get bottle neck bw */ 2909 bottle_bw = ntohl(cp->bottle_bw); 2910 /* and whats on queue */ 2911 on_queue = ntohl(cp->current_onq); 2912 /* 2913 * adjust the on-queue if our flight is more it could be 2914 * that the router has not yet gotten data "in-flight" to it 2915 */ 2916 if (on_queue < net->flight_size) 2917 on_queue = net->flight_size; 2918 2919 /* calculate the available space */ 2920 bw_avail = (bottle_bw*rtt)/1000; 2921 if (bw_avail > bottle_bw) { 2922 /* 2923 * Cap the growth to no more than the bottle neck. 2924 * This can happen as RTT slides up due to queues. 2925 * It also means if you have more than a 1 second 2926 * RTT with a empty queue you will be limited to 2927 * the bottle_bw per second no matter if 2928 * other points have 1/2 the RTT and you could 2929 * get more out... 2930 */ 2931 bw_avail = bottle_bw; 2932 } 2933 2934 if (on_queue > bw_avail) { 2935 /* 2936 * No room for anything else don't allow anything 2937 * else to be "added to the fire". 2938 */ 2939 int seg_inflight, seg_onqueue, my_portion; 2940 net->partial_bytes_acked = 0; 2941 2942 /* how much are we over queue size? */ 2943 incr = on_queue - bw_avail; 2944 if (stcb->asoc.seen_a_sack_this_pkt) { 2945 /* undo any cwnd adjustment that 2946 * the sack might have made 2947 */ 2948 net->cwnd = net->prev_cwnd; 2949 } 2950 2951 /* Now how much of that is mine? */ 2952 seg_inflight = net->flight_size / net->mtu; 2953 seg_onqueue = on_queue / net->mtu; 2954 my_portion = (incr * seg_inflight)/seg_onqueue; 2955 2956 /* Have I made an adjustment already */ 2957 if (net->cwnd > net->flight_size) { 2958 /* for this flight I made an adjustment 2959 * we need to decrease the portion by a share 2960 * our previous adjustment. 2961 */ 2962 int diff_adj; 2963 diff_adj = net->cwnd - net->flight_size; 2964 if (diff_adj > my_portion) 2965 my_portion = 0; 2966 else 2967 my_portion -= diff_adj; 2968 } 2969 2970 /* back down to the previous cwnd (assume 2971 * we have had a sack before this packet). minus 2972 * what ever portion of the overage is my fault. 2973 */ 2974 net->cwnd -= my_portion; 2975 2976 /* we will NOT back down more than 1 MTU */ 2977 if (net->cwnd <= net->mtu) { 2978 net->cwnd = net->mtu; 2979 } 2980 /* force into CA */ 2981 net->ssthresh = net->cwnd - 1; 2982 } else { 2983 /* 2984 * Take 1/4 of the space left or 2985 * max burst up .. whichever is less. 2986 */ 2987 incr = uimin((bw_avail - on_queue) >> 2, 2988 (int)stcb->asoc.max_burst * (int)net->mtu); 2989 net->cwnd += incr; 2990 } 2991 if (net->cwnd > bw_avail) { 2992 /* We can't exceed the pipe size */ 2993 net->cwnd = bw_avail; 2994 } 2995 if (net->cwnd < net->mtu) { 2996 /* We always have 1 MTU */ 2997 net->cwnd = net->mtu; 2998 } 2999 #ifdef SCTP_CWND_LOGGING 3000 if (net->cwnd - old_cwnd != 0) { 3001 /* log only changes */ 3002 sctp_log_cwnd(net, (net->cwnd - old_cwnd), 3003 SCTP_CWND_LOG_FROM_SAT); 3004 } 3005 #endif 3006 } 3007 } 3008 3009 extern int sctp_strict_init; 3010 3011 /* 3012 * handles all control chunks in a packet 3013 * inputs: 3014 * - m: mbuf chain, assumed to still contain IP/SCTP header 3015 * - stcb: is the tcb found for this packet 3016 * - offset: offset into the mbuf chain to first chunkhdr 3017 * - length: is the length of the complete packet 3018 * outputs: 3019 * - length: modified to remaining length after control processing 3020 * - netp: modified to new sctp_nets after cookie-echo processing 3021 * - return NULL to discard the packet (ie. no asoc, bad packet,...) 3022 * otherwise return the tcb for this packet 3023 */ 3024 static struct sctp_tcb * 3025 sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length, 3026 struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp, 3027 struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen) 3028 { 3029 struct sctp_association *asoc; 3030 u_int32_t vtag_in; 3031 int num_chunks = 0; /* number of control chunks processed */ 3032 int chk_length; 3033 int ret; 3034 3035 /* 3036 * How big should this be, and should it be alloc'd? 3037 * Lets try the d-mtu-ceiling for now (2k) and that should 3038 * hopefully work ... until we get into jumbo grams and such.. 3039 */ 3040 u_int8_t chunk_buf[DEFAULT_CHUNK_BUFFER]; 3041 struct sctp_tcb *locked_tcb = stcb; 3042 3043 #ifdef SCTP_DEBUG 3044 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 3045 printf("sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n", 3046 iphlen, *offset, length, stcb); 3047 } 3048 #endif /* SCTP_DEBUG */ 3049 3050 /* validate chunk header length... */ 3051 if (ntohs(ch->chunk_length) < sizeof(*ch)) { 3052 return (NULL); 3053 } 3054 3055 /* 3056 * validate the verification tag 3057 */ 3058 #ifdef SCTP_DEBUG 3059 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3060 printf("sctp_process_control: validating vtags\n"); 3061 } 3062 #endif /* SCTP_DEBUG */ 3063 vtag_in = ntohl(sh->v_tag); 3064 if (ch->chunk_type == SCTP_INITIATION) { 3065 if (vtag_in != 0) { 3066 /* protocol error- silently discard... */ 3067 #ifdef SCTP_DEBUG 3068 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3069 printf("sctp_process_control: INIT with vtag != 0\n"); 3070 } 3071 #endif /* SCTP_DEBUG */ 3072 sctp_pegs[SCTP_BAD_VTAGS]++; 3073 if (locked_tcb) { 3074 SCTP_TCB_UNLOCK(locked_tcb); 3075 } 3076 return (NULL); 3077 } 3078 } else if (ch->chunk_type != SCTP_COOKIE_ECHO) { 3079 /* 3080 * first check if it's an ASCONF with an unknown src addr 3081 * we need to look inside to find the association 3082 */ 3083 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) { 3084 stcb = sctp_findassociation_ep_asconf(m, iphlen, 3085 *offset, sh, &inp, netp); 3086 } 3087 if (stcb == NULL) { 3088 /* no association, so it's out of the blue... */ 3089 sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL); 3090 #ifdef SCTP_DEBUG 3091 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3092 printf("sctp_process_control: handling OOTB packet, chunk type=%xh\n", 3093 ch->chunk_type); 3094 } 3095 #endif /* SCTP_DEBUG */ 3096 *offset = length; 3097 if (locked_tcb) { 3098 SCTP_TCB_UNLOCK(locked_tcb); 3099 } 3100 return (NULL); 3101 } 3102 asoc = &stcb->asoc; 3103 /* ABORT and SHUTDOWN can use either v_tag... */ 3104 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) || 3105 (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) || 3106 (ch->chunk_type == SCTP_PACKET_DROPPED)) { 3107 if ((vtag_in == asoc->my_vtag) || 3108 ((ch->chunk_flags & SCTP_HAD_NO_TCB) && 3109 (vtag_in == asoc->peer_vtag))) { 3110 /* this is valid */ 3111 } else { 3112 /* drop this packet... */ 3113 sctp_pegs[SCTP_BAD_VTAGS]++; 3114 if (locked_tcb) { 3115 SCTP_TCB_UNLOCK(locked_tcb); 3116 } 3117 return (NULL); 3118 } 3119 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) { 3120 if (vtag_in != asoc->my_vtag) { 3121 /* 3122 * this could be a stale SHUTDOWN-ACK or the 3123 * peer never got the SHUTDOWN-COMPLETE and 3124 * is still hung; we have started a new asoc 3125 * but it won't complete until the shutdown is 3126 * completed 3127 */ 3128 if (locked_tcb) { 3129 SCTP_TCB_UNLOCK(locked_tcb); 3130 } 3131 sctp_handle_ootb(m, iphlen, *offset, sh, inp, 3132 NULL); 3133 return (NULL); 3134 } 3135 } else { 3136 /* for all other chunks, vtag must match */ 3137 3138 if (vtag_in != asoc->my_vtag) { 3139 /* invalid vtag... */ 3140 #ifdef SCTP_DEBUG 3141 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3142 printf("invalid vtag: %xh, expect %xh\n", vtag_in, asoc->my_vtag); 3143 } 3144 #endif /* SCTP_DEBUG */ 3145 sctp_pegs[SCTP_BAD_VTAGS]++; 3146 if (locked_tcb) { 3147 SCTP_TCB_UNLOCK(locked_tcb); 3148 } 3149 *offset = length; 3150 return (NULL); 3151 } 3152 } 3153 } /* end if !SCTP_COOKIE_ECHO */ 3154 3155 #ifdef SCTP_DEBUG 3156 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3157 printf("sctp_process_control: vtags ok, processing ctrl chunks\n"); 3158 } 3159 #endif /* SCTP_DEBUG */ 3160 3161 /* 3162 * process all control chunks... 3163 */ 3164 if (((ch->chunk_type == SCTP_SELECTIVE_ACK) || 3165 (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) && 3166 (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 3167 /* implied cookie-ack.. we must have lost the ack */ 3168 stcb->asoc.overall_error_count = 0; 3169 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp); 3170 } 3171 3172 while (IS_SCTP_CONTROL(ch)) { 3173 /* validate chunk length */ 3174 chk_length = ntohs(ch->chunk_length); 3175 #ifdef SCTP_DEBUG 3176 if (sctp_debug_on & SCTP_DEBUG_INPUT2) { 3177 printf("sctp_process_control: processing a chunk type=%u, len=%u\n", ch->chunk_type, chk_length); 3178 } 3179 #endif /* SCTP_DEBUG */ 3180 if ((size_t)chk_length < sizeof(*ch) || 3181 (*offset + chk_length) > length) { 3182 #ifdef SCTP_DEBUG 3183 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3184 printf("sctp_process_control: chunk length invalid! *offset:%u, chk_length:%u > length:%u\n", 3185 *offset, chk_length, length); 3186 } 3187 #endif /* SCTP_DEBUG */ 3188 *offset = length; 3189 if (locked_tcb) { 3190 SCTP_TCB_UNLOCK(locked_tcb); 3191 } 3192 return (NULL); 3193 } 3194 3195 /* 3196 * INIT-ACK only gets the init ack "header" portion only 3197 * because we don't have to process the peer's COOKIE. 3198 * All others get a complete chunk. 3199 */ 3200 if (ch->chunk_type == SCTP_INITIATION_ACK) { 3201 /* get an init-ack chunk */ 3202 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3203 sizeof(struct sctp_init_ack), chunk_buf); 3204 if (ch == NULL) { 3205 *offset = length; 3206 if (locked_tcb) { 3207 SCTP_TCB_UNLOCK(locked_tcb); 3208 } 3209 return (NULL); 3210 } 3211 } else { 3212 /* get a complete chunk... */ 3213 if ((size_t)chk_length > sizeof(chunk_buf)) { 3214 struct mbuf *oper; 3215 struct sctp_paramhdr *phdr; 3216 oper = NULL; 3217 MGETHDR(oper, M_DONTWAIT, MT_HEADER); 3218 if (oper) { 3219 /* pre-reserve some space */ 3220 oper->m_data += 3221 sizeof(struct sctp_chunkhdr); 3222 phdr = 3223 mtod(oper, struct sctp_paramhdr *); 3224 phdr->param_type = 3225 htons(SCTP_CAUSE_OUT_OF_RESC); 3226 phdr->param_length = 3227 htons(sizeof(struct sctp_paramhdr)); 3228 sctp_queue_op_err(stcb, oper); 3229 } 3230 if (locked_tcb) { 3231 SCTP_TCB_UNLOCK(locked_tcb); 3232 } 3233 return (NULL); 3234 } 3235 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3236 chk_length, chunk_buf); 3237 if (ch == NULL) { 3238 printf("sctp_process_control: Can't get the all data....\n"); 3239 *offset = length; 3240 if (locked_tcb) { 3241 SCTP_TCB_UNLOCK(locked_tcb); 3242 } 3243 return (NULL); 3244 } 3245 3246 } 3247 num_chunks++; 3248 /* Save off the last place we got a control from */ 3249 if ((*netp) && stcb) { 3250 stcb->asoc.last_control_chunk_from = *netp; 3251 } 3252 #ifdef SCTP_AUDITING_ENABLED 3253 sctp_audit_log(0xB0, ch->chunk_type); 3254 #endif 3255 switch (ch->chunk_type) { 3256 case SCTP_INITIATION: 3257 /* must be first and only chunk */ 3258 #ifdef SCTP_DEBUG 3259 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3260 printf("SCTP_INIT\n"); 3261 } 3262 #endif /* SCTP_DEBUG */ 3263 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3264 /* We are not interested anymore */ 3265 if (locked_tcb) { 3266 SCTP_TCB_UNLOCK(locked_tcb); 3267 } 3268 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) { 3269 /* finish the job now */ 3270 sctp_inpcb_free(inp, 1); 3271 } 3272 *offset = length; 3273 return (NULL); 3274 } 3275 if ((num_chunks > 1) || 3276 (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3277 *offset = length; 3278 if (locked_tcb) { 3279 SCTP_TCB_UNLOCK(locked_tcb); 3280 } 3281 return (NULL); 3282 } 3283 if ((stcb != NULL) && 3284 (SCTP_GET_STATE(&stcb->asoc) == 3285 SCTP_STATE_SHUTDOWN_ACK_SENT)) { 3286 sctp_send_shutdown_ack(stcb, 3287 stcb->asoc.primary_destination); 3288 *offset = length; 3289 if (locked_tcb) { 3290 SCTP_TCB_UNLOCK(locked_tcb); 3291 } 3292 return (NULL); 3293 } 3294 sctp_handle_init(m, iphlen, *offset, sh, 3295 (struct sctp_init_chunk *)ch, inp, stcb, *netp); 3296 *offset = length; 3297 if (locked_tcb) { 3298 SCTP_TCB_UNLOCK(locked_tcb); 3299 } 3300 return (NULL); 3301 break; 3302 case SCTP_INITIATION_ACK: 3303 /* must be first and only chunk */ 3304 #ifdef SCTP_DEBUG 3305 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3306 printf("SCTP_INIT-ACK\n"); 3307 } 3308 #endif /* SCTP_DEBUG */ 3309 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3310 /* We are not interested anymore */ 3311 if (locked_tcb) { 3312 SCTP_TCB_UNLOCK(locked_tcb); 3313 } 3314 *offset = length; 3315 if (stcb) { 3316 sctp_free_assoc(inp, stcb); 3317 } else { 3318 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) { 3319 /* finish the job now */ 3320 sctp_inpcb_free(inp, 1); 3321 } 3322 } 3323 return (NULL); 3324 } 3325 if ((num_chunks > 1) || 3326 (sctp_strict_init && (length - *offset > SCTP_SIZE32(chk_length)))) { 3327 #ifdef SCTP_DEBUG 3328 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3329 printf("Length is %d rounded chk_length:%d .. dropping\n", 3330 length - *offset, 3331 SCTP_SIZE32(chk_length)); 3332 } 3333 #endif 3334 *offset = length; 3335 if (locked_tcb) { 3336 SCTP_TCB_UNLOCK(locked_tcb); 3337 } 3338 return (NULL); 3339 } 3340 ret = sctp_handle_init_ack(m, iphlen, *offset, sh, 3341 (struct sctp_init_ack_chunk *)ch, stcb, *netp); 3342 /* 3343 * Special case, I must call the output routine 3344 * to get the cookie echoed 3345 */ 3346 if ((stcb) && ret == 0) 3347 sctp_chunk_output(stcb->sctp_ep, stcb, 2); 3348 *offset = length; 3349 #ifdef SCTP_DEBUG 3350 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3351 printf("All done INIT-ACK processing\n"); 3352 } 3353 #endif 3354 if (locked_tcb) { 3355 SCTP_TCB_UNLOCK(locked_tcb); 3356 } 3357 return (NULL); 3358 break; 3359 case SCTP_SELECTIVE_ACK: 3360 #ifdef SCTP_DEBUG 3361 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3362 printf("SCTP_SACK\n"); 3363 } 3364 #endif /* SCTP_DEBUG */ 3365 sctp_pegs[SCTP_PEG_SACKS_SEEN]++; 3366 { 3367 int abort_now = 0; 3368 stcb->asoc.seen_a_sack_this_pkt = 1; 3369 sctp_handle_sack((struct sctp_sack_chunk *)ch, 3370 stcb, *netp, &abort_now); 3371 if (abort_now) { 3372 /* ABORT signal from sack processing */ 3373 *offset = length; 3374 return (NULL); 3375 } 3376 } 3377 break; 3378 case SCTP_HEARTBEAT_REQUEST: 3379 #ifdef SCTP_DEBUG 3380 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3381 printf("SCTP_HEARTBEAT\n"); 3382 } 3383 #endif /* SCTP_DEBUG */ 3384 sctp_pegs[SCTP_HB_RECV]++; 3385 sctp_send_heartbeat_ack(stcb, m, *offset, chk_length, 3386 *netp); 3387 3388 /* He's alive so give him credit */ 3389 stcb->asoc.overall_error_count = 0; 3390 break; 3391 case SCTP_HEARTBEAT_ACK: 3392 #ifdef SCTP_DEBUG 3393 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3394 printf("SCTP_HEARTBEAT-ACK\n"); 3395 } 3396 #endif /* SCTP_DEBUG */ 3397 3398 /* He's alive so give him credit */ 3399 stcb->asoc.overall_error_count = 0; 3400 3401 sctp_pegs[SCTP_HB_ACK_RECV]++; 3402 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch, 3403 stcb, *netp); 3404 break; 3405 case SCTP_ABORT_ASSOCIATION: 3406 #ifdef SCTP_DEBUG 3407 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3408 printf("SCTP_ABORT\n"); 3409 } 3410 #endif /* SCTP_DEBUG */ 3411 sctp_handle_abort((struct sctp_abort_chunk *)ch, 3412 stcb, *netp); 3413 *offset = length; 3414 return (NULL); 3415 break; 3416 case SCTP_SHUTDOWN: 3417 #ifdef SCTP_DEBUG 3418 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3419 printf("SCTP_SHUTDOWN\n"); 3420 } 3421 #endif /* SCTP_DEBUG */ 3422 { 3423 int abort_flag = 0; 3424 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch, 3425 stcb, *netp, &abort_flag); 3426 if (abort_flag) { 3427 *offset = length; 3428 return (NULL); 3429 } 3430 } 3431 break; 3432 case SCTP_SHUTDOWN_ACK: 3433 #ifdef SCTP_DEBUG 3434 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3435 printf("SCTP_SHUTDOWN-ACK\n"); 3436 } 3437 #endif /* SCTP_DEBUG */ 3438 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp); 3439 *offset = length; 3440 return (NULL); 3441 break; 3442 case SCTP_OPERATION_ERROR: 3443 #ifdef SCTP_DEBUG 3444 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3445 printf("SCTP_OP-ERR\n"); 3446 } 3447 #endif /* SCTP_DEBUG */ 3448 if (sctp_handle_error(ch, stcb, *netp) < 0) { 3449 *offset = length; 3450 return (NULL); 3451 } 3452 break; 3453 case SCTP_COOKIE_ECHO: 3454 #ifdef SCTP_DEBUG 3455 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3456 printf("SCTP_COOKIE-ECHO stcb is %p\n", stcb); 3457 } 3458 #endif /* SCTP_DEBUG */ 3459 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3460 /* We are not interested anymore */ 3461 *offset = length; 3462 if (stcb) { 3463 sctp_free_assoc(inp, stcb); 3464 } else { 3465 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) { 3466 /* finish the job now */ 3467 sctp_inpcb_free(inp, 1); 3468 } 3469 } 3470 return (NULL); 3471 } 3472 /* 3473 * First are we accepting? 3474 * We do this again here since it is possible 3475 * that a previous endpoint WAS listening responded to 3476 * a INIT-ACK and then closed. We opened and bound.. 3477 * and are now no longer listening. 3478 */ 3479 if (((inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING) == 0) || 3480 (inp->sctp_socket->so_qlimit == 0)) { 3481 sctp_abort_association(inp, stcb, m, iphlen, sh, 3482 NULL); 3483 *offset = length; 3484 return (NULL); 3485 } else if (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING) { 3486 /* we are accepting so check limits like TCP */ 3487 if (inp->sctp_socket->so_qlen > 3488 inp->sctp_socket->so_qlimit) { 3489 /* no space */ 3490 struct mbuf *oper; 3491 struct sctp_paramhdr *phdr; 3492 oper = NULL; 3493 MGETHDR(oper, M_DONTWAIT, MT_HEADER); 3494 if (oper) { 3495 oper->m_len = 3496 oper->m_pkthdr.len = 3497 sizeof(struct sctp_paramhdr); 3498 phdr = mtod(oper, 3499 struct sctp_paramhdr *); 3500 phdr->param_type = 3501 htons(SCTP_CAUSE_OUT_OF_RESC); 3502 phdr->param_length = 3503 htons(sizeof(struct sctp_paramhdr)); 3504 } 3505 sctp_abort_association(inp, stcb, m, 3506 iphlen, sh, oper); 3507 *offset = length; 3508 return (NULL); 3509 } 3510 } 3511 { 3512 struct mbuf *ret_buf; 3513 ret_buf = sctp_handle_cookie_echo(m, iphlen, 3514 *offset, sh, 3515 (struct sctp_cookie_echo_chunk *)ch, &inp, 3516 &stcb, netp); 3517 #ifdef SCTP_DEBUG 3518 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3519 printf("ret_buf:%p length:%d off:%d\n", 3520 ret_buf, length, *offset); 3521 } 3522 #endif /* SCTP_DEBUG */ 3523 3524 if (ret_buf == NULL) { 3525 if (locked_tcb) { 3526 SCTP_TCB_UNLOCK(locked_tcb); 3527 } 3528 #ifdef SCTP_DEBUG 3529 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3530 printf("GAK, null buffer\n"); 3531 } 3532 #endif /* SCTP_DEBUG */ 3533 *offset = length; 3534 return (NULL); 3535 } 3536 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) { 3537 /* 3538 * Restart the timer if we have pending 3539 * data 3540 */ 3541 struct sctp_tmit_chunk *chk; 3542 chk = TAILQ_FIRST(&stcb->asoc.sent_queue); 3543 if (chk) { 3544 sctp_timer_start(SCTP_TIMER_TYPE_SEND, 3545 stcb->sctp_ep, stcb, 3546 chk->whoTo); 3547 } 3548 } 3549 } 3550 break; 3551 case SCTP_COOKIE_ACK: 3552 #ifdef SCTP_DEBUG 3553 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3554 printf("SCTP_COOKIE-ACK\n"); 3555 } 3556 #endif /* SCTP_DEBUG */ 3557 3558 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3559 /* We are not interested anymore */ 3560 sctp_free_assoc(inp, stcb); 3561 *offset = length; 3562 return (NULL); 3563 } 3564 /* He's alive so give him credit */ 3565 stcb->asoc.overall_error_count = 0; 3566 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, 3567 stcb, *netp); 3568 break; 3569 case SCTP_ECN_ECHO: 3570 #ifdef SCTP_DEBUG 3571 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3572 printf("SCTP_ECN-ECHO\n"); 3573 } 3574 #endif /* SCTP_DEBUG */ 3575 /* He's alive so give him credit */ 3576 stcb->asoc.overall_error_count = 0; 3577 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, 3578 stcb); 3579 break; 3580 case SCTP_ECN_CWR: 3581 #ifdef SCTP_DEBUG 3582 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3583 printf("SCTP_ECN-CWR\n"); 3584 } 3585 #endif /* SCTP_DEBUG */ 3586 /* He's alive so give him credit */ 3587 stcb->asoc.overall_error_count = 0; 3588 3589 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb); 3590 break; 3591 case SCTP_SHUTDOWN_COMPLETE: 3592 #ifdef SCTP_DEBUG 3593 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3594 printf("SCTP_SHUTDOWN-COMPLETE\n"); 3595 } 3596 #endif /* SCTP_DEBUG */ 3597 /* must be first and only chunk */ 3598 if ((num_chunks > 1) || 3599 (length - *offset > SCTP_SIZE32(chk_length))) { 3600 *offset = length; 3601 if (locked_tcb) { 3602 SCTP_TCB_UNLOCK(locked_tcb); 3603 } 3604 return (NULL); 3605 } 3606 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch, 3607 stcb, *netp); 3608 *offset = length; 3609 return (NULL); 3610 break; 3611 case SCTP_ASCONF: 3612 #ifdef SCTP_DEBUG 3613 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3614 printf("SCTP_ASCONF\n"); 3615 } 3616 #endif /* SCTP_DEBUG */ 3617 /* He's alive so give him credit */ 3618 stcb->asoc.overall_error_count = 0; 3619 3620 sctp_handle_asconf(m, *offset, 3621 (struct sctp_asconf_chunk *)ch, stcb, *netp); 3622 break; 3623 case SCTP_ASCONF_ACK: 3624 #ifdef SCTP_DEBUG 3625 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3626 printf("SCTP_ASCONF-ACK\n"); 3627 } 3628 #endif /* SCTP_DEBUG */ 3629 /* He's alive so give him credit */ 3630 stcb->asoc.overall_error_count = 0; 3631 3632 sctp_handle_asconf_ack(m, *offset, 3633 (struct sctp_asconf_ack_chunk *)ch, stcb, *netp); 3634 break; 3635 case SCTP_FORWARD_CUM_TSN: 3636 #ifdef SCTP_DEBUG 3637 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3638 printf("SCTP_FWD-TSN\n"); 3639 } 3640 #endif /* SCTP_DEBUG */ 3641 /* He's alive so give him credit */ 3642 { 3643 int abort_flag = 0; 3644 stcb->asoc.overall_error_count = 0; 3645 *fwd_tsn_seen = 1; 3646 sctp_handle_forward_tsn(stcb, 3647 (struct sctp_forward_tsn_chunk *)ch, &abort_flag); 3648 if (abort_flag) { 3649 *offset = length; 3650 return (NULL); 3651 } else { 3652 stcb->asoc.overall_error_count = 0; 3653 } 3654 3655 } 3656 break; 3657 case SCTP_STREAM_RESET: 3658 #ifdef SCTP_DEBUG 3659 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3660 printf("SCTP_STREAM_RESET\n"); 3661 } 3662 #endif /* SCTP_DEBUG */ 3663 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3664 chk_length, chunk_buf); 3665 if (stcb->asoc.peer_supports_strreset == 0) { 3666 /* hmm, peer should have annonced this, but 3667 * we will turn it on since he is sending us 3668 * a stream reset. 3669 */ 3670 stcb->asoc.peer_supports_strreset = 1; 3671 } 3672 sctp_handle_stream_reset(stcb, (struct sctp_stream_reset_req *)ch); 3673 break; 3674 case SCTP_PACKET_DROPPED: 3675 #ifdef SCTP_DEBUG 3676 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3677 printf("SCTP_PACKET_DROPPED\n"); 3678 } 3679 #endif /* SCTP_DEBUG */ 3680 /* re-get it all please */ 3681 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3682 chk_length, chunk_buf); 3683 3684 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch, 3685 stcb, *netp); 3686 3687 3688 break; 3689 default: 3690 /* it's an unknown chunk! */ 3691 if ((ch->chunk_type & 0x40) && (stcb != NULL)) { 3692 struct mbuf *mm; 3693 struct sctp_paramhdr *phd; 3694 MGETHDR(mm, M_DONTWAIT, MT_HEADER); 3695 if (mm) { 3696 phd = mtod(mm, struct sctp_paramhdr *); 3697 /* We cheat and use param type since we 3698 * did not bother to define a error 3699 * cause struct. 3700 * They are the same basic format with 3701 * different names. 3702 */ 3703 phd->param_type = 3704 htons(SCTP_CAUSE_UNRECOG_CHUNK); 3705 phd->param_length = 3706 htons(chk_length + sizeof(*phd)); 3707 mm->m_len = sizeof(*phd); 3708 mm->m_next = sctp_m_copym(m, *offset, 3709 SCTP_SIZE32(chk_length), 3710 M_DONTWAIT); 3711 if (mm->m_next) { 3712 mm->m_pkthdr.len = 3713 SCTP_SIZE32(chk_length) + 3714 sizeof(*phd); 3715 sctp_queue_op_err(stcb, mm); 3716 } else { 3717 sctp_m_freem(mm); 3718 #ifdef SCTP_DEBUG 3719 if (sctp_debug_on & 3720 SCTP_DEBUG_INPUT1) { 3721 printf("Gak can't copy the chunk into operr %d bytes\n", 3722 chk_length); 3723 } 3724 #endif 3725 } 3726 } 3727 #ifdef SCTP_DEBUG 3728 else { 3729 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 3730 printf("Gak can't mgethdr for op-err of unrec chunk\n"); 3731 } 3732 } 3733 #endif 3734 } 3735 if ((ch->chunk_type & 0x80) == 0) { 3736 /* discard this packet */ 3737 *offset = length; 3738 return (stcb); 3739 } /* else skip this bad chunk and continue... */ 3740 break; 3741 } /* switch (ch->chunk_type) */ 3742 /* get the next chunk */ 3743 *offset += SCTP_SIZE32(chk_length); 3744 if (*offset >= length) { 3745 /* no more data left in the mbuf chain */ 3746 break; 3747 } 3748 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset, 3749 sizeof(struct sctp_chunkhdr), chunk_buf); 3750 if (ch == NULL) { 3751 if (locked_tcb) { 3752 SCTP_TCB_UNLOCK(locked_tcb); 3753 } 3754 *offset = length; 3755 return (NULL); 3756 } 3757 } /* while */ 3758 return (stcb); 3759 } 3760 3761 3762 /* 3763 * Process the ECN bits we have something set so 3764 * we must look to see if it is ECN(0) or ECN(1) or CE 3765 */ 3766 static void 3767 sctp_process_ecn_marked_a(struct sctp_tcb *stcb, struct sctp_nets *net, 3768 u_int8_t ecn_bits) 3769 { 3770 if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 3771 ; 3772 } else if ((ecn_bits & SCTP_ECT1_BIT) == SCTP_ECT1_BIT) { 3773 /* 3774 * we only add to the nonce sum for ECT1, ECT0 3775 * does not change the NS bit (that we have 3776 * yet to find a way to send it yet). 3777 */ 3778 3779 /* ECN Nonce stuff */ 3780 stcb->asoc.receiver_nonce_sum++; 3781 stcb->asoc.receiver_nonce_sum &= SCTP_SACK_NONCE_SUM; 3782 3783 /* 3784 * Drag up the last_echo point if cumack is larger since we 3785 * don't want the point falling way behind by more than 2^^31 3786 * and then having it be incorrect. 3787 */ 3788 if (compare_with_wrap(stcb->asoc.cumulative_tsn, 3789 stcb->asoc.last_echo_tsn, MAX_TSN)) { 3790 stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 3791 } 3792 } else if ((ecn_bits & SCTP_ECT0_BIT) == SCTP_ECT0_BIT) { 3793 /* 3794 * Drag up the last_echo point if cumack is larger since we 3795 * don't want the point falling way behind by more than 2^^31 3796 * and then having it be incorrect. 3797 */ 3798 if (compare_with_wrap(stcb->asoc.cumulative_tsn, 3799 stcb->asoc.last_echo_tsn, MAX_TSN)) { 3800 stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn; 3801 } 3802 } 3803 } 3804 3805 static void 3806 sctp_process_ecn_marked_b(struct sctp_tcb *stcb, struct sctp_nets *net, 3807 u_int32_t high_tsn, u_int8_t ecn_bits) 3808 { 3809 if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) { 3810 /* 3811 * we possibly must notify the sender that a congestion 3812 * window reduction is in order. We do this 3813 * by adding a ECNE chunk to the output chunk 3814 * queue. The incoming CWR will remove this chunk. 3815 */ 3816 if (compare_with_wrap(high_tsn, stcb->asoc.last_echo_tsn, 3817 MAX_TSN)) { 3818 /* Yep, we need to add a ECNE */ 3819 sctp_send_ecn_echo(stcb, net, high_tsn); 3820 stcb->asoc.last_echo_tsn = high_tsn; 3821 } 3822 } 3823 } 3824 3825 /* 3826 * common input chunk processing (v4 and v6) 3827 */ 3828 int 3829 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, 3830 int length, struct sctphdr *sh, struct sctp_chunkhdr *ch, 3831 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net, 3832 u_int8_t ecn_bits) 3833 { 3834 /* 3835 * Control chunk processing 3836 */ 3837 u_int32_t high_tsn; 3838 int fwd_tsn_seen = 0, data_processed = 0; 3839 struct mbuf *m = *mm; 3840 int abort_flag = 0; 3841 3842 sctp_pegs[SCTP_DATAGRAMS_RCVD]++; 3843 #ifdef SCTP_AUDITING_ENABLED 3844 sctp_audit_log(0xE0, 1); 3845 sctp_auditing(0, inp, stcb, net); 3846 #endif 3847 3848 #ifdef SCTP_DEBUG 3849 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 3850 printf("Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d\n", 3851 m, iphlen, offset, length); 3852 } 3853 #endif /* SCTP_DEBUG */ 3854 if (IS_SCTP_CONTROL(ch)) { 3855 /* process the control portion of the SCTP packet */ 3856 #ifdef SCTP_DEBUG 3857 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 3858 printf("Processing control\n"); 3859 } 3860 #endif /* SCTP_DEBUG */ 3861 3862 stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch, 3863 inp, stcb, &net, &fwd_tsn_seen); 3864 } else { 3865 /* 3866 * no control chunks, so pre-process DATA chunks 3867 * (these checks are taken care of by control processing) 3868 */ 3869 #ifdef SCTP_DEBUG 3870 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 3871 printf("No control present\n"); 3872 } 3873 #endif /* SCTP_DEBUG */ 3874 3875 if (stcb == NULL) { 3876 /* out of the blue DATA chunk */ 3877 sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL); 3878 return (1); 3879 } 3880 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) { 3881 /* v_tag mismatch! */ 3882 sctp_pegs[SCTP_BAD_VTAGS]++; 3883 SCTP_TCB_UNLOCK(stcb); 3884 return (1); 3885 } 3886 } 3887 if (stcb == NULL) { 3888 /* 3889 * no valid TCB for this packet, 3890 * or we found it's a bad packet while processing control, 3891 * or we're done with this packet (done or skip rest of data), 3892 * so we drop it... 3893 */ 3894 return (1); 3895 } 3896 #ifdef SCTP_DEBUG 3897 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 3898 printf("Ok, control finished time to look for data (%d) offset:%d\n", 3899 length, offset); 3900 } 3901 #endif /* SCTP_DEBUG */ 3902 /* 3903 * DATA chunk processing 3904 */ 3905 /* plow through the data chunks while length > offset */ 3906 stcb->asoc.seen_a_sack_this_pkt = 0; 3907 3908 if (length > offset) { 3909 int retval; 3910 /* 3911 * First check to make sure our state is correct. 3912 * We would not get here unless we really did have a 3913 * tag, so we don't abort if this happens, just 3914 * dump the chunk silently. 3915 */ 3916 switch (SCTP_GET_STATE(&stcb->asoc)) { 3917 case SCTP_STATE_COOKIE_ECHOED: 3918 /* 3919 * we consider data with valid tags in 3920 * this state shows us the cookie-ack was lost. 3921 * Imply it was there. 3922 */ 3923 stcb->asoc.overall_error_count = 0; 3924 sctp_handle_cookie_ack( 3925 (struct sctp_cookie_ack_chunk *)ch, stcb, net); 3926 break; 3927 case SCTP_STATE_COOKIE_WAIT: 3928 /* 3929 * We consider OOTB any data sent during asoc setup. 3930 */ 3931 sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL); 3932 SCTP_TCB_UNLOCK(stcb); 3933 return (1); 3934 break; 3935 case SCTP_STATE_EMPTY: /* should not happen */ 3936 case SCTP_STATE_INUSE: /* should not happen */ 3937 case SCTP_STATE_SHUTDOWN_RECEIVED: /* This is a peer error */ 3938 case SCTP_STATE_SHUTDOWN_ACK_SENT: 3939 default: 3940 #ifdef SCTP_DEBUG 3941 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 3942 printf("Got data in invalid state %d.. dropping\n", stcb->asoc.state); 3943 } 3944 #endif 3945 SCTP_TCB_UNLOCK(stcb); 3946 return (1); 3947 break; 3948 case SCTP_STATE_OPEN: 3949 case SCTP_STATE_SHUTDOWN_SENT: 3950 break; 3951 } 3952 /* take care of ECN, part 1. */ 3953 if (stcb->asoc.ecn_allowed && 3954 (ecn_bits & (SCTP_ECT0_BIT|SCTP_ECT1_BIT)) ) { 3955 sctp_process_ecn_marked_a(stcb, net, ecn_bits); 3956 } 3957 /* plow through the data chunks while length > offset */ 3958 retval = sctp_process_data(mm, iphlen, &offset, length, sh, 3959 inp, stcb, net, &high_tsn); 3960 if (retval == 2) { 3961 /* The association aborted, NO UNLOCK needed 3962 * since the association is destroyed. 3963 */ 3964 return (0); 3965 } 3966 3967 data_processed = 1; 3968 if (retval == 0) { 3969 /* take care of ecn part 2. */ 3970 if (stcb->asoc.ecn_allowed && (ecn_bits & (SCTP_ECT0_BIT|SCTP_ECT1_BIT)) ) { 3971 sctp_process_ecn_marked_b(stcb, net, high_tsn, ecn_bits); 3972 3973 } 3974 } 3975 3976 /* 3977 * Anything important needs to have been m_copy'ed in 3978 * process_data 3979 */ 3980 } 3981 if ((data_processed == 0) && (fwd_tsn_seen)) { 3982 int was_a_gap = 0; 3983 if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map, 3984 stcb->asoc.cumulative_tsn, MAX_TSN)) { 3985 /* there was a gap before this data was processed */ 3986 was_a_gap = 1; 3987 } 3988 sctp_sack_check(stcb, 1, was_a_gap, &abort_flag); 3989 if (abort_flag) { 3990 /* Again, we aborted so NO UNLOCK needed */ 3991 return (0); 3992 } 3993 } 3994 /* trigger send of any chunks in queue... */ 3995 #ifdef SCTP_AUDITING_ENABLED 3996 sctp_audit_log(0xE0, 2); 3997 sctp_auditing(1, inp, stcb, net); 3998 #endif 3999 #ifdef SCTP_DEBUG 4000 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4001 printf("Check for chunk output prw:%d tqe:%d tf=%d\n", 4002 stcb->asoc.peers_rwnd, 4003 TAILQ_EMPTY(&stcb->asoc.control_send_queue), 4004 stcb->asoc.total_flight); 4005 } 4006 #endif 4007 if (stcb->asoc.peers_rwnd > 0 || 4008 !TAILQ_EMPTY(&stcb->asoc.control_send_queue) || 4009 (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)) { 4010 #ifdef SCTP_DEBUG 4011 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4012 printf("Calling chunk OUTPUT\n"); 4013 } 4014 #endif 4015 sctp_chunk_output(inp, stcb, 3); 4016 #ifdef SCTP_DEBUG 4017 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 4018 printf("chunk OUTPUT returns\n"); 4019 } 4020 #endif 4021 } 4022 4023 #ifdef SCTP_AUDITING_ENABLED 4024 sctp_audit_log(0xE0, 3); 4025 sctp_auditing(2, inp, stcb, net); 4026 #endif 4027 SCTP_TCB_UNLOCK(stcb); 4028 return (0); 4029 } 4030 4031 #if defined(__OpenBSD__) 4032 static void 4033 sctp_saveopt(struct sctp_inpcb *inp, struct mbuf **mp, struct ip *ip, 4034 struct mbuf *m) 4035 { 4036 if (inp->ip_inp.inp.inp_flags & INP_RECVDSTADDR) { 4037 *mp = sbcreatecontrol((vaddr_t) &ip->ip_dst, 4038 sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP); 4039 if (*mp) 4040 mp = &(*mp)->m_next; 4041 } 4042 } 4043 #endif 4044 4045 extern int sctp_no_csum_on_loopback; 4046 4047 void 4048 sctp_input(struct mbuf *m, int off, int proto) 4049 { 4050 int iphlen; 4051 u_int8_t ecn_bits; 4052 struct ip *ip; 4053 struct sctphdr *sh; 4054 struct sctp_inpcb *inp = NULL; 4055 struct mbuf *opts = 0; 4056 /*#ifdef INET6*/ 4057 /* Don't think this is needed */ 4058 /* struct ip6_recvpktopts opts6;*/ 4059 /*#endif INET6 */ 4060 4061 u_int32_t check, calc_check; 4062 struct sctp_nets *net; 4063 struct sctp_tcb *stcb = NULL; 4064 struct sctp_chunkhdr *ch; 4065 int refcount_up = 0; 4066 int length, mlen, offset; 4067 4068 iphlen = off; 4069 4070 net = NULL; 4071 sctp_pegs[SCTP_INPKTS]++; 4072 #ifdef SCTP_DEBUG 4073 /*if (sctp_debug_on & SCTP_DEBUG_INPUT1) {*/ 4074 printf("V4 input gets a packet iphlen:%d pktlen:%d\n", iphlen, m->m_pkthdr.len); 4075 /*}*/ 4076 #endif 4077 /*#ifdef INET6*/ 4078 /* Don't think this is needed */ 4079 /* bzero(&opts6, sizeof(opts6));*/ 4080 /*#endif INET6 */ 4081 4082 /* 4083 * Strip IP options, we don't allow any in or out. 4084 */ 4085 if ((size_t)iphlen > sizeof(struct ip)) { 4086 printf("sctp_input: got options\n"); 4087 #if 0 /* XXX */ 4088 ip_stripoptions(m, (struct mbuf *)0); 4089 #endif 4090 iphlen = sizeof(struct ip); 4091 } 4092 4093 /* 4094 * Get IP, SCTP, and first chunk header together in first mbuf. 4095 */ 4096 ip = mtod(m, struct ip *); 4097 offset = iphlen + sizeof(*sh) + sizeof(*ch); 4098 if (m->m_len < offset) { 4099 if ((m = m_pullup(m, offset)) == 0) { 4100 sctp_pegs[SCTP_HDR_DROPS]++; 4101 return; 4102 } 4103 ip = mtod(m, struct ip *); 4104 } 4105 sh = (struct sctphdr *)((vaddr_t)ip + iphlen); 4106 ch = (struct sctp_chunkhdr *)((vaddr_t)sh + sizeof(*sh)); 4107 4108 /* SCTP does not allow broadcasts or multicasts */ 4109 if (IN_MULTICAST(ip->ip_dst.s_addr)) 4110 { 4111 sctp_pegs[SCTP_IN_MCAST]++; 4112 goto bad; 4113 } 4114 if (in_broadcast(ip->ip_dst, m_get_rcvif_NOMPSAFE(m))) { 4115 sctp_pegs[SCTP_IN_MCAST]++; 4116 goto bad; 4117 } 4118 4119 /* destination port of 0 is illegal, based on RFC2960. */ 4120 if (sh->dest_port == 0) { 4121 sctp_pegs[SCTP_HDR_DROPS]++; 4122 goto bad; 4123 } 4124 4125 /* validate SCTP checksum */ 4126 if ((sctp_no_csum_on_loopback == 0) || 4127 (m_get_rcvif_NOMPSAFE(m) == NULL) || 4128 (m_get_rcvif_NOMPSAFE(m)->if_type != IFT_LOOP)) { 4129 /* we do NOT validate things from the loopback if the 4130 * sysctl is set to 1. 4131 */ 4132 check = sh->checksum; /* save incoming checksum */ 4133 if ((check == 0) && (sctp_no_csum_on_loopback)) { 4134 /* special hook for where we got a local address 4135 * somehow routed across a non IFT_LOOP type interface 4136 */ 4137 if (ip->ip_src.s_addr == ip->ip_dst.s_addr) 4138 goto sctp_skip_csum_4; 4139 } 4140 sh->checksum = 0; /* prepare for calc */ 4141 calc_check = sctp_calculate_sum(m, &mlen, iphlen); 4142 if (calc_check != check) { 4143 #ifdef SCTP_DEBUG 4144 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4145 printf("Bad CSUM on SCTP packet calc_check:%x check:%x m:%p mlen:%d iphlen:%d\n", 4146 calc_check, check, m, mlen, iphlen); 4147 } 4148 #endif 4149 4150 stcb = sctp_findassociation_addr(m, iphlen, 4151 offset - sizeof(*ch), 4152 sh, ch, &inp, &net); 4153 if ((inp) && (stcb)) { 4154 sctp_send_packet_dropped(stcb, net, m, iphlen, 4155 1); 4156 sctp_chunk_output(inp, stcb, 2); 4157 } else if ((inp != NULL) && (stcb == NULL)) { 4158 refcount_up = 1; 4159 } 4160 sctp_pegs[SCTP_BAD_CSUM]++; 4161 goto bad; 4162 } 4163 sh->checksum = calc_check; 4164 } else { 4165 sctp_skip_csum_4: 4166 mlen = m->m_pkthdr.len; 4167 } 4168 /* validate mbuf chain length with IP payload length */ 4169 #if defined(__NetBSD__) || defined(__OpenBSD__) 4170 /* Open BSD gives us the len in network order, fix it */ 4171 NTOHS(ip->ip_len); 4172 #endif 4173 if (mlen < (ip->ip_len - iphlen)) { 4174 sctp_pegs[SCTP_HDR_DROPS]++; 4175 goto bad; 4176 } 4177 4178 /* 4179 * Locate pcb and tcb for datagram 4180 * sctp_findassociation_addr() wants IP/SCTP/first chunk header... 4181 */ 4182 #ifdef SCTP_DEBUG 4183 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4184 printf("V4 find association\n"); 4185 } 4186 #endif 4187 4188 stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch), 4189 sh, ch, &inp, &net); 4190 /* inp's ref-count increased && stcb locked */ 4191 if (inp == NULL) { 4192 struct sctp_init_chunk *init_chk, chunk_buf; 4193 4194 sctp_pegs[SCTP_NOPORTS]++; 4195 #ifdef ICMP_BANDLIM 4196 /* 4197 * we use the bandwidth limiting to protect against 4198 * sending too many ABORTS all at once. In this case 4199 * these count the same as an ICMP message. 4200 */ 4201 if (badport_bandlim(0) < 0) 4202 goto bad; 4203 #endif /* ICMP_BANDLIM */ 4204 #ifdef SCTP_DEBUG 4205 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 4206 printf("Sending a ABORT from packet entry!\n"); 4207 } 4208 #endif 4209 if (ch->chunk_type == SCTP_INITIATION) { 4210 /* we do a trick here to get the INIT tag, 4211 * dig in and get the tag from the INIT and 4212 * put it in the common header. 4213 */ 4214 init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m, 4215 iphlen + sizeof(*sh), sizeof(*init_chk), 4216 (u_int8_t *)&chunk_buf); 4217 if (init_chk != NULL) 4218 sh->v_tag = init_chk->init.initiate_tag; 4219 } 4220 sctp_send_abort(m, iphlen, sh, 0, NULL); 4221 goto bad; 4222 } else if (stcb == NULL) { 4223 refcount_up = 1; 4224 } 4225 #ifdef IPSEC 4226 /* 4227 * I very much doubt any of the IPSEC stuff will work but I have 4228 * no idea, so I will leave it in place. 4229 */ 4230 if (ipsec_used && ipsec_in_reject(m, (struct inpcb *)inp)) { 4231 #if 0 4232 ipsecstat.in_polvio++; 4233 #endif 4234 sctp_pegs[SCTP_HDR_DROPS]++; 4235 goto bad; 4236 } 4237 #endif /* IPSEC */ 4238 4239 /* 4240 * Construct sockaddr format source address. 4241 * Stuff source address and datagram in user buffer. 4242 */ 4243 if ((inp->ip_inp.inp.inp_flags & INP_CONTROLOPTS) 4244 || (inp->sctp_socket->so_options & SO_TIMESTAMP) 4245 ) { 4246 ip_savecontrol((struct inpcb *)inp, &opts, ip, m); 4247 } 4248 4249 /* 4250 * common chunk processing 4251 */ 4252 length = ip->ip_len - (ip->ip_hl << 2) + iphlen; 4253 offset -= sizeof(struct sctp_chunkhdr); 4254 4255 ecn_bits = ip->ip_tos; 4256 sctp_common_input_processing(&m, iphlen, offset, length, sh, ch, 4257 inp, stcb, net, ecn_bits); 4258 /* inp's ref-count reduced && stcb unlocked */ 4259 sctp_m_freem(m); 4260 sctp_m_freem(opts); 4261 4262 if ((inp) && (refcount_up)) { 4263 /* reduce ref-count */ 4264 SCTP_INP_WLOCK(inp); 4265 SCTP_INP_DECR_REF(inp); 4266 SCTP_INP_WUNLOCK(inp); 4267 } 4268 4269 return; 4270 bad: 4271 if (stcb) { 4272 SCTP_TCB_UNLOCK(stcb); 4273 } 4274 4275 if ((inp) && (refcount_up)) { 4276 /* reduce ref-count */ 4277 SCTP_INP_WLOCK(inp); 4278 SCTP_INP_DECR_REF(inp); 4279 SCTP_INP_WUNLOCK(inp); 4280 } 4281 4282 sctp_m_freem(m); 4283 sctp_m_freem(opts); 4284 return; 4285 } 4286