1 /* $NetBSD: sctp_output.c,v 1.28 2021/12/05 04:56:40 msaitoh Exp $ */ 2 /* $KAME: sctp_output.c,v 1.48 2005/06/16 18:29:24 jinmei Exp $ */ 3 4 /* 5 * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc, 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: sctp_output.c,v 1.28 2021/12/05 04:56:40 msaitoh Exp $"); 34 35 #ifdef _KERNEL_OPT 36 #include "opt_ipsec.h" 37 #include "opt_inet.h" 38 #include "opt_sctp.h" 39 #endif /* _KERNEL_OPT */ 40 41 #include <sys/param.h> 42 #include <sys/systm.h> 43 #include <sys/malloc.h> 44 #include <sys/mbuf.h> 45 #include <sys/domain.h> 46 #include <sys/protosw.h> 47 #include <sys/socket.h> 48 #include <sys/socketvar.h> 49 #include <sys/proc.h> 50 #include <sys/kernel.h> 51 #include <sys/sysctl.h> 52 #include <sys/resourcevar.h> 53 #include <sys/uio.h> 54 #ifdef INET6 55 #include <sys/domain.h> 56 #endif 57 58 #include <machine/limits.h> 59 #include <machine/cpu.h> 60 61 #include <net/if.h> 62 #include <net/if_types.h> 63 64 #include <net/route.h> 65 66 #include <netinet/in.h> 67 #include <netinet/in_systm.h> 68 #include <netinet/ip.h> 69 #include <netinet/in_pcb.h> 70 #include <netinet/in_var.h> 71 #include <netinet/ip_var.h> 72 73 #ifdef INET6 74 #include <netinet/ip6.h> 75 #include <netinet6/ip6_var.h> 76 #include <netinet6/scope6_var.h> 77 #include <netinet6/nd6.h> 78 79 #include <netinet6/in6_pcb.h> 80 81 #include <netinet/icmp6.h> 82 83 #endif /* INET6 */ 84 85 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__) 86 #ifndef in6pcb 87 #define in6pcb inpcb 88 #endif 89 #endif 90 91 #include <netinet/sctp_pcb.h> 92 93 #ifdef IPSEC 94 #include <netipsec/ipsec.h> 95 #include <netipsec/key.h> 96 #endif /* IPSEC */ 97 98 #include <netinet/sctp_var.h> 99 #include <netinet/sctp_header.h> 100 #include <netinet/sctputil.h> 101 #include <netinet/sctp_pcb.h> 102 #include <netinet/sctp_output.h> 103 #include <netinet/sctp_uio.h> 104 #include <netinet/sctputil.h> 105 #include <netinet/sctp_hashdriver.h> 106 #include <netinet/sctp_timer.h> 107 #include <netinet/sctp_asconf.h> 108 #include <netinet/sctp_indata.h> 109 110 #ifdef SCTP_DEBUG 111 extern uint32_t sctp_debug_on; 112 #endif 113 114 extern int sctp_peer_chunk_oh; 115 116 static int 117 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize) 118 { 119 struct cmsghdr cmh; 120 int tlen, at; 121 122 tlen = control->m_len; 123 at = 0; 124 /* 125 * Independent of how many mbufs, find the c_type inside the control 126 * structure and copy out the data. 127 */ 128 while (at < tlen) { 129 if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) { 130 /* not enough room for one more we are done. */ 131 return (0); 132 } 133 m_copydata(control, at, sizeof(cmh), (void *)&cmh); 134 if ((cmh.cmsg_len + at) > tlen) { 135 /* 136 * this is real messed up since there is not enough 137 * data here to cover the cmsg header. We are done. 138 */ 139 return (0); 140 } 141 if ((cmh.cmsg_level == IPPROTO_SCTP) && 142 (c_type == cmh.cmsg_type)) { 143 /* found the one we want, copy it out */ 144 at += CMSG_ALIGN(sizeof(struct cmsghdr)); 145 if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) { 146 /* 147 * space of cmsg_len after header not 148 * big enough 149 */ 150 return (0); 151 } 152 m_copydata(control, at, cpsize, data); 153 return (1); 154 } else { 155 at += CMSG_ALIGN(cmh.cmsg_len); 156 if (cmh.cmsg_len == 0) { 157 break; 158 } 159 } 160 } 161 /* not found */ 162 return (0); 163 } 164 165 static struct mbuf * 166 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa) 167 { 168 struct sctp_paramhdr *parmh; 169 struct mbuf *mret; 170 int len; 171 if (ifa->ifa_addr->sa_family == AF_INET) { 172 len = sizeof(struct sctp_ipv4addr_param); 173 } else if (ifa->ifa_addr->sa_family == AF_INET6) { 174 len = sizeof(struct sctp_ipv6addr_param); 175 } else { 176 /* unknown type */ 177 return (m); 178 } 179 180 if (M_TRAILINGSPACE(m) >= len) { 181 /* easy side we just drop it on the end */ 182 parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len); 183 mret = m; 184 } else { 185 /* Need more space */ 186 mret = m; 187 while (mret->m_next != NULL) { 188 mret = mret->m_next; 189 } 190 MGET(mret->m_next, M_DONTWAIT, MT_DATA); 191 if (mret->m_next == NULL) { 192 /* We are hosed, can't add more addresses */ 193 return (m); 194 } 195 mret = mret->m_next; 196 parmh = mtod(mret, struct sctp_paramhdr *); 197 } 198 /* now add the parameter */ 199 if (ifa->ifa_addr->sa_family == AF_INET) { 200 struct sctp_ipv4addr_param *ipv4p; 201 struct sockaddr_in *sin; 202 sin = (struct sockaddr_in *)ifa->ifa_addr; 203 ipv4p = (struct sctp_ipv4addr_param *)parmh; 204 parmh->param_type = htons(SCTP_IPV4_ADDRESS); 205 parmh->param_length = htons(len); 206 ipv4p->addr = sin->sin_addr.s_addr; 207 mret->m_len += len; 208 } else if (ifa->ifa_addr->sa_family == AF_INET6) { 209 struct sctp_ipv6addr_param *ipv6p; 210 struct sockaddr_in6 *sin6; 211 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 212 ipv6p = (struct sctp_ipv6addr_param *)parmh; 213 parmh->param_type = htons(SCTP_IPV6_ADDRESS); 214 parmh->param_length = htons(len); 215 memcpy(ipv6p->addr, &sin6->sin6_addr, 216 sizeof(ipv6p->addr)); 217 /* clear embedded scope in the address */ 218 in6_clearscope((struct in6_addr *)ipv6p->addr); 219 mret->m_len += len; 220 } else { 221 return (m); 222 } 223 return (mret); 224 } 225 226 227 228 static struct mbuf * 229 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset, 230 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in) 231 { 232 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 233 struct sctp_state_cookie *stc; 234 struct sctp_paramhdr *ph; 235 uint8_t *signature; 236 int sig_offset; 237 uint16_t cookie_sz; 238 239 mret = NULL; 240 241 MGET(mret, M_DONTWAIT, MT_DATA); 242 if (mret == NULL) { 243 return (NULL); 244 } 245 copy_init = sctp_m_copym(init, init_offset, M_COPYALL, M_DONTWAIT); 246 if (copy_init == NULL) { 247 sctp_m_freem(mret); 248 return (NULL); 249 } 250 copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL, 251 M_DONTWAIT); 252 if (copy_initack == NULL) { 253 sctp_m_freem(mret); 254 sctp_m_freem(copy_init); 255 return (NULL); 256 } 257 /* easy side we just drop it on the end */ 258 ph = mtod(mret, struct sctp_paramhdr *); 259 mret->m_len = sizeof(struct sctp_state_cookie) + 260 sizeof(struct sctp_paramhdr); 261 stc = (struct sctp_state_cookie *)((vaddr_t)ph + 262 sizeof(struct sctp_paramhdr)); 263 ph->param_type = htons(SCTP_STATE_COOKIE); 264 ph->param_length = 0; /* fill in at the end */ 265 /* Fill in the stc cookie data */ 266 *stc = *stc_in; 267 268 /* tack the INIT and then the INIT-ACK onto the chain */ 269 cookie_sz = 0; 270 m_at = mret; 271 for (m_at = mret; m_at; m_at = m_at->m_next) { 272 cookie_sz += m_at->m_len; 273 if (m_at->m_next == NULL) { 274 m_at->m_next = copy_init; 275 break; 276 } 277 } 278 279 for (m_at = copy_init; m_at; m_at = m_at->m_next) { 280 cookie_sz += m_at->m_len; 281 if (m_at->m_next == NULL) { 282 m_at->m_next = copy_initack; 283 break; 284 } 285 } 286 287 for (m_at = copy_initack; m_at; m_at = m_at->m_next) { 288 cookie_sz += m_at->m_len; 289 if (m_at->m_next == NULL) { 290 break; 291 } 292 } 293 MGET(sig, M_DONTWAIT, MT_DATA); 294 if (sig == NULL) { 295 /* no space */ 296 sctp_m_freem(mret); 297 sctp_m_freem(copy_init); 298 sctp_m_freem(copy_initack); 299 return (NULL); 300 } 301 sig->m_len = 0; 302 m_at->m_next = sig; 303 sig_offset = 0; 304 signature = (uint8_t *)(mtod(sig, vaddr_t) + sig_offset); 305 /* Time to sign the cookie */ 306 sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[ 307 (int)(inp->sctp_ep.current_secret_number)], 308 SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr), 309 (uint8_t *)signature); 310 sig->m_len += SCTP_SIGNATURE_SIZE; 311 cookie_sz += SCTP_SIGNATURE_SIZE; 312 313 ph->param_length = htons(cookie_sz); 314 return (mret); 315 } 316 317 318 static struct sockaddr_in * 319 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local) 320 { 321 struct sockaddr_in *sin; 322 /* 323 * Here we determine if its a prefered address. A 324 * prefered address means it is the same scope or 325 * higher scope then the destination. 326 * L = loopback, P = private, G = global 327 * ----------------------------------------- 328 * src | dest | result 329 *----------------------------------------- 330 * L | L | yes 331 *----------------------------------------- 332 * P | L | yes 333 *----------------------------------------- 334 * G | L | yes 335 *----------------------------------------- 336 * L | P | no 337 *----------------------------------------- 338 * P | P | yes 339 *----------------------------------------- 340 * G | P | no 341 *----------------------------------------- 342 * L | G | no 343 *----------------------------------------- 344 * P | G | no 345 *----------------------------------------- 346 * G | G | yes 347 *----------------------------------------- 348 */ 349 350 if (ifa->ifa_addr->sa_family != AF_INET) { 351 /* forget non-v4 */ 352 return (NULL); 353 } 354 /* Ok the address may be ok */ 355 sin = (struct sockaddr_in *)ifa->ifa_addr; 356 if (sin->sin_addr.s_addr == 0) { 357 return (NULL); 358 } 359 *sin_local = *sin_loop = 0; 360 if ((ifa->ifa_ifp->if_type == IFT_LOOP) || 361 (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) { 362 *sin_loop = 1; 363 *sin_local = 1; 364 } 365 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 366 *sin_local = 1; 367 } 368 if (!loopscope && *sin_loop) { 369 /* Its a loopback address and we don't have loop scope */ 370 return (NULL); 371 } 372 if (!ipv4_scope && *sin_local) { 373 /* Its a private address, and we don't have private address scope */ 374 return (NULL); 375 } 376 if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) { 377 /* its a global src and a private dest */ 378 return (NULL); 379 } 380 /* its a prefered address */ 381 return (sin); 382 } 383 384 static struct sockaddr_in * 385 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local) 386 { 387 struct sockaddr_in *sin; 388 /* 389 * Here we determine if its a acceptable address. A 390 * acceptable address means it is the same scope or 391 * higher scope but we can allow for NAT which means 392 * its ok to have a global dest and a private src. 393 * 394 * L = loopback, P = private, G = global 395 * ----------------------------------------- 396 * src | dest | result 397 *----------------------------------------- 398 * L | L | yes 399 *----------------------------------------- 400 * P | L | yes 401 *----------------------------------------- 402 * G | L | yes 403 *----------------------------------------- 404 * L | P | no 405 *----------------------------------------- 406 * P | P | yes 407 *----------------------------------------- 408 * G | P | yes - probably this won't work. 409 *----------------------------------------- 410 * L | G | no 411 *----------------------------------------- 412 * P | G | yes 413 *----------------------------------------- 414 * G | G | yes 415 *----------------------------------------- 416 */ 417 418 if (ifa->ifa_addr->sa_family != AF_INET) { 419 /* forget non-v4 */ 420 return (NULL); 421 } 422 /* Ok the address may be ok */ 423 sin = (struct sockaddr_in *)ifa->ifa_addr; 424 if (sin->sin_addr.s_addr == 0) { 425 return (NULL); 426 } 427 *sin_local = *sin_loop = 0; 428 if ((ifa->ifa_ifp->if_type == IFT_LOOP) || 429 (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) { 430 *sin_loop = 1; 431 *sin_local = 1; 432 } 433 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 434 *sin_local = 1; 435 } 436 if (!loopscope && *sin_loop) { 437 /* Its a loopback address and we don't have loop scope */ 438 return (NULL); 439 } 440 /* its an acceptable address */ 441 return (sin); 442 } 443 444 /* 445 * This treats the address list on the ep as a restricted list 446 * (negative list). If a the passed address is listed, then 447 * the address is NOT allowed on the association. 448 */ 449 int 450 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr) 451 { 452 struct sctp_laddr *laddr; 453 #ifdef SCTP_DEBUG 454 int cnt=0; 455 #endif 456 if (stcb == NULL) { 457 /* There are no restrictions, no TCB :-) */ 458 return (0); 459 } 460 #ifdef SCTP_DEBUG 461 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 462 cnt++; 463 } 464 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 465 printf("There are %d addresses on the restricted list\n", cnt); 466 } 467 cnt = 0; 468 #endif 469 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 470 if (laddr->ifa == NULL) { 471 #ifdef SCTP_DEBUG 472 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 473 printf("Help I have fallen and I can't get up!\n"); 474 } 475 #endif 476 continue; 477 } 478 #ifdef SCTP_DEBUG 479 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 480 cnt++; 481 printf("Restricted address[%d]:", cnt); 482 sctp_print_address(laddr->ifa->ifa_addr); 483 } 484 #endif 485 if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) { 486 /* Yes it is on the list */ 487 return (1); 488 } 489 } 490 return (0); 491 } 492 493 static int 494 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa) 495 { 496 struct sctp_laddr *laddr; 497 498 if (ifa == NULL) 499 return (0); 500 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 501 if (laddr->ifa == NULL) { 502 #ifdef SCTP_DEBUG 503 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 504 printf("Help I have fallen and I can't get up!\n"); 505 } 506 #endif 507 continue; 508 } 509 if (laddr->ifa->ifa_addr == NULL) 510 continue; 511 if (laddr->ifa == ifa) 512 /* same pointer */ 513 return (1); 514 if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) { 515 /* skip non compatible address comparison */ 516 continue; 517 } 518 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) { 519 /* Yes it is restricted */ 520 return (1); 521 } 522 } 523 return (0); 524 } 525 526 527 528 static struct in_addr 529 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp, 530 struct rtentry *rt, 531 uint8_t ipv4_scope, 532 uint8_t loopscope) 533 { 534 struct in_addr ans; 535 struct sctp_laddr *laddr; 536 struct sockaddr_in *sin; 537 struct ifnet *ifn; 538 struct ifaddr *ifa; 539 uint8_t sin_loop, sin_local; 540 541 /* first question, is the ifn we will emit on 542 * in our list, if so, we want that one. 543 */ 544 ifn = rt->rt_ifp; 545 if (ifn) { 546 /* is a prefered one on the interface we route out? */ 547 IFADDR_READER_FOREACH(ifa, ifn) { 548 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 549 if (sin == NULL) 550 continue; 551 if (sctp_is_addr_in_ep(inp, ifa)) { 552 return (sin->sin_addr); 553 } 554 } 555 /* is an acceptable one on the interface we route out? */ 556 IFADDR_READER_FOREACH(ifa, ifn) { 557 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 558 if (sin == NULL) 559 continue; 560 if (sctp_is_addr_in_ep(inp, ifa)) { 561 return (sin->sin_addr); 562 } 563 } 564 } 565 /* ok, what about a prefered address in the inp */ 566 for (laddr = LIST_FIRST(&inp->sctp_addr_list); 567 laddr && (laddr != inp->next_addr_touse); 568 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 569 if (laddr->ifa == NULL) { 570 /* address has been removed */ 571 continue; 572 } 573 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 574 if (sin == NULL) 575 continue; 576 return (sin->sin_addr); 577 578 } 579 /* ok, what about an acceptable address in the inp */ 580 for (laddr = LIST_FIRST(&inp->sctp_addr_list); 581 laddr && (laddr != inp->next_addr_touse); 582 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 583 if (laddr->ifa == NULL) { 584 /* address has been removed */ 585 continue; 586 } 587 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 588 if (sin == NULL) 589 continue; 590 return (sin->sin_addr); 591 592 } 593 594 /* no address bound can be a source for the destination we are in trouble */ 595 #ifdef SCTP_DEBUG 596 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 597 printf("Src address selection for EP, no acceptable src address found for address\n"); 598 } 599 #endif 600 memset(&ans, 0, sizeof(ans)); 601 return (ans); 602 } 603 604 605 606 static struct in_addr 607 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp, 608 struct sctp_tcb *stcb, 609 struct sctp_nets *net, 610 struct rtentry *rt, 611 uint8_t ipv4_scope, 612 uint8_t loopscope, 613 int non_asoc_addr_ok) 614 { 615 /* 616 * Here we have two cases, bound all asconf 617 * allowed. bound all asconf not allowed. 618 * 619 */ 620 struct sctp_laddr *laddr, *starting_point; 621 struct in_addr ans; 622 struct ifnet *ifn; 623 struct ifaddr *ifa; 624 uint8_t sin_loop, sin_local, start_at_beginning=0; 625 struct sockaddr_in *sin; 626 627 /* first question, is the ifn we will emit on 628 * in our list, if so, we want that one. 629 */ 630 ifn = rt->rt_ifp; 631 632 if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) { 633 /* 634 * Here we use the list of addresses on the endpoint. Then 635 * the addresses listed on the "restricted" list is just that, 636 * address that have not been added and can't be used (unless 637 * the non_asoc_addr_ok is set). 638 */ 639 #ifdef SCTP_DEBUG 640 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 641 printf("Have a STCB - asconf allowed, not bound all have a netgative list\n"); 642 } 643 #endif 644 /* first question, is the ifn we will emit on 645 * in our list, if so, we want that one. 646 */ 647 if (ifn) { 648 /* first try for an prefered address on the ep */ 649 IFADDR_READER_FOREACH(ifa, ifn) { 650 if (sctp_is_addr_in_ep(inp, ifa)) { 651 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 652 if (sin == NULL) 653 continue; 654 if ((non_asoc_addr_ok == 0) && 655 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) { 656 /* on the no-no list */ 657 continue; 658 } 659 return (sin->sin_addr); 660 } 661 } 662 /* next try for an acceptable address on the ep */ 663 IFADDR_READER_FOREACH(ifa, ifn) { 664 if (sctp_is_addr_in_ep(inp, ifa)) { 665 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 666 if (sin == NULL) 667 continue; 668 if ((non_asoc_addr_ok == 0) && 669 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) { 670 /* on the no-no list */ 671 continue; 672 } 673 return (sin->sin_addr); 674 } 675 } 676 677 } 678 /* if we can't find one like that then we must 679 * look at all addresses bound to pick one at 680 * first prefereable then secondly acceptable. 681 */ 682 starting_point = stcb->asoc.last_used_address; 683 sctpv4_from_the_top: 684 if (stcb->asoc.last_used_address == NULL) { 685 start_at_beginning=1; 686 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 687 } 688 /* search beginning with the last used address */ 689 for (laddr = stcb->asoc.last_used_address; laddr; 690 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 691 if (laddr->ifa == NULL) { 692 /* address has been removed */ 693 continue; 694 } 695 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 696 if (sin == NULL) 697 continue; 698 if ((non_asoc_addr_ok == 0) && 699 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) { 700 /* on the no-no list */ 701 continue; 702 } 703 return (sin->sin_addr); 704 705 } 706 if (start_at_beginning == 0) { 707 stcb->asoc.last_used_address = NULL; 708 goto sctpv4_from_the_top; 709 } 710 /* now try for any higher scope than the destination */ 711 stcb->asoc.last_used_address = starting_point; 712 start_at_beginning = 0; 713 sctpv4_from_the_top2: 714 if (stcb->asoc.last_used_address == NULL) { 715 start_at_beginning=1; 716 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 717 } 718 /* search beginning with the last used address */ 719 for (laddr = stcb->asoc.last_used_address; laddr; 720 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 721 if (laddr->ifa == NULL) { 722 /* address has been removed */ 723 continue; 724 } 725 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 726 if (sin == NULL) 727 continue; 728 if ((non_asoc_addr_ok == 0) && 729 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) { 730 /* on the no-no list */ 731 continue; 732 } 733 return (sin->sin_addr); 734 } 735 if (start_at_beginning == 0) { 736 stcb->asoc.last_used_address = NULL; 737 goto sctpv4_from_the_top2; 738 } 739 } else { 740 /* 741 * Here we have an address list on the association, thats the 742 * only valid source addresses that we can use. 743 */ 744 #ifdef SCTP_DEBUG 745 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 746 printf("Have a STCB - no asconf allowed, not bound all have a postive list\n"); 747 } 748 #endif 749 /* First look at all addresses for one that is on 750 * the interface we route out 751 */ 752 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 753 sctp_nxt_addr) { 754 if (laddr->ifa == NULL) { 755 /* address has been removed */ 756 continue; 757 } 758 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 759 if (sin == NULL) 760 continue; 761 /* first question, is laddr->ifa an address associated with the emit interface */ 762 if (ifn) { 763 IFADDR_READER_FOREACH(ifa, ifn) { 764 if (laddr->ifa == ifa) { 765 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr; 766 return (sin->sin_addr); 767 } 768 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) { 769 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr; 770 return (sin->sin_addr); 771 } 772 } 773 } 774 } 775 /* what about an acceptable one on the interface? */ 776 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 777 sctp_nxt_addr) { 778 if (laddr->ifa == NULL) { 779 /* address has been removed */ 780 continue; 781 } 782 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 783 if (sin == NULL) 784 continue; 785 /* first question, is laddr->ifa an address associated with the emit interface */ 786 if (ifn) { 787 IFADDR_READER_FOREACH(ifa, ifn) { 788 if (laddr->ifa == ifa) { 789 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr; 790 return (sin->sin_addr); 791 } 792 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) { 793 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr; 794 return (sin->sin_addr); 795 } 796 } 797 } 798 } 799 /* ok, next one that is preferable in general */ 800 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 801 sctp_nxt_addr) { 802 if (laddr->ifa == NULL) { 803 /* address has been removed */ 804 continue; 805 } 806 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 807 if (sin == NULL) 808 continue; 809 return (sin->sin_addr); 810 } 811 812 /* last, what about one that is acceptable */ 813 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 814 sctp_nxt_addr) { 815 if (laddr->ifa == NULL) { 816 /* address has been removed */ 817 continue; 818 } 819 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 820 if (sin == NULL) 821 continue; 822 return (sin->sin_addr); 823 } 824 } 825 memset(&ans, 0, sizeof(ans)); 826 return (ans); 827 } 828 829 static struct sockaddr_in * 830 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, 831 uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num) 832 { 833 struct ifaddr *ifa; 834 struct sockaddr_in *sin; 835 uint8_t sin_loop, sin_local; 836 int num_eligible_addr = 0; 837 IFADDR_READER_FOREACH(ifa, ifn) { 838 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 839 if (sin == NULL) 840 continue; 841 if (stcb) { 842 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) { 843 /* It is restricted for some reason.. probably 844 * not yet added. 845 */ 846 continue; 847 } 848 } 849 if (cur_addr_num == num_eligible_addr) { 850 return (sin); 851 } 852 } 853 return (NULL); 854 } 855 856 857 static int 858 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, 859 uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local) 860 { 861 struct ifaddr *ifa; 862 struct sockaddr_in *sin; 863 int num_eligible_addr = 0; 864 865 IFADDR_READER_FOREACH(ifa, ifn) { 866 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local); 867 if (sin == NULL) 868 continue; 869 if (stcb) { 870 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) { 871 /* It is restricted for some reason.. probably 872 * not yet added. 873 */ 874 continue; 875 } 876 } 877 num_eligible_addr++; 878 } 879 return (num_eligible_addr); 880 881 } 882 883 static struct in_addr 884 sctp_choose_v4_boundall(struct sctp_inpcb *inp, 885 struct sctp_tcb *stcb, 886 struct sctp_nets *net, 887 struct rtentry *rt, 888 uint8_t ipv4_scope, 889 uint8_t loopscope, 890 int non_asoc_addr_ok) 891 { 892 int cur_addr_num=0, num_prefered=0; 893 uint8_t sin_loop, sin_local; 894 struct ifnet *ifn; 895 struct sockaddr_in *sin; 896 struct in_addr ans; 897 struct ifaddr *ifa; 898 int s; 899 /* 900 * For v4 we can use (in boundall) any address in the association. If 901 * non_asoc_addr_ok is set we can use any address (at least in theory). 902 * So we look for prefered addresses first. If we find one, we use it. 903 * Otherwise we next try to get an address on the interface, which we 904 * should be able to do (unless non_asoc_addr_ok is false and we are 905 * routed out that way). In these cases where we can't use the address 906 * of the interface we go through all the ifn's looking for an address 907 * we can use and fill that in. Punting means we send back address 908 * 0, which will probably cause problems actually since then IP will 909 * fill in the address of the route ifn, which means we probably already 910 * rejected it.. i.e. here comes an abort :-<. 911 */ 912 ifn = rt->rt_ifp; 913 if (net) { 914 cur_addr_num = net->indx_of_eligible_next_to_use; 915 } 916 if (ifn == NULL) { 917 goto bound_all_v4_plan_c; 918 } 919 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local); 920 #ifdef SCTP_DEBUG 921 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 922 printf("Found %d prefered source addresses\n", num_prefered); 923 } 924 #endif 925 if (num_prefered == 0) { 926 /* no eligible addresses, we must use some other 927 * interface address if we can find one. 928 */ 929 goto bound_all_v4_plan_b; 930 } 931 /* Ok we have num_eligible_addr set with how many we can use, 932 * this may vary from call to call due to addresses being deprecated etc.. 933 */ 934 if (cur_addr_num >= num_prefered) { 935 cur_addr_num = 0; 936 } 937 /* select the nth address from the list (where cur_addr_num is the nth) and 938 * 0 is the first one, 1 is the second one etc... 939 */ 940 #ifdef SCTP_DEBUG 941 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 942 printf("cur_addr_num:%d\n", cur_addr_num); 943 } 944 #endif 945 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, 946 ipv4_scope, cur_addr_num); 947 948 /* if sin is NULL something changed??, plan_a now */ 949 if (sin) { 950 return (sin->sin_addr); 951 } 952 953 /* 954 * plan_b: Look at the interface that we emit on 955 * and see if we can find an acceptable address. 956 */ 957 bound_all_v4_plan_b: 958 IFADDR_READER_FOREACH(ifa, ifn) { 959 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 960 if (sin == NULL) 961 continue; 962 if (stcb) { 963 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) { 964 /* It is restricted for some reason.. probably 965 * not yet added. 966 */ 967 continue; 968 } 969 } 970 return (sin->sin_addr); 971 } 972 /* 973 * plan_c: Look at all interfaces and find a prefered 974 * address. If we reache here we are in trouble I think. 975 */ 976 bound_all_v4_plan_c: 977 s = pserialize_read_enter(); 978 IFNET_READER_FOREACH(ifn) { 979 if (ifn == inp->next_ifn_touse) 980 break; 981 if (loopscope == 0 && ifn->if_type == IFT_LOOP) { 982 /* wrong base scope */ 983 continue; 984 } 985 if (ifn == rt->rt_ifp) 986 /* already looked at this guy */ 987 continue; 988 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, 989 loopscope, ipv4_scope, &sin_loop, &sin_local); 990 #ifdef SCTP_DEBUG 991 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 992 printf("Found ifn:%p %d prefered source addresses\n", ifn, num_prefered); 993 } 994 #endif 995 if (num_prefered == 0) { 996 /* 997 * None on this interface. 998 */ 999 continue; 1000 } 1001 /* Ok we have num_eligible_addr set with how many we can use, 1002 * this may vary from call to call due to addresses being deprecated etc.. 1003 */ 1004 if (cur_addr_num >= num_prefered) { 1005 cur_addr_num = 0; 1006 } 1007 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, 1008 ipv4_scope, cur_addr_num); 1009 if (sin == NULL) 1010 continue; 1011 pserialize_read_exit(s); 1012 return (sin->sin_addr); 1013 1014 } 1015 pserialize_read_exit(s); 1016 1017 /* 1018 * plan_d: We are in deep trouble. No prefered address on 1019 * any interface. And the emit interface does not 1020 * even have an acceptable address. Take anything 1021 * we can get! If this does not work we are 1022 * probably going to emit a packet that will 1023 * illicit an ABORT, falling through. 1024 */ 1025 1026 s = pserialize_read_enter(); 1027 IFNET_READER_FOREACH(ifn) { 1028 if (ifn == inp->next_ifn_touse) 1029 break; 1030 if (loopscope == 0 && ifn->if_type == IFT_LOOP) { 1031 /* wrong base scope */ 1032 continue; 1033 } 1034 if (ifn == rt->rt_ifp) 1035 /* already looked at this guy */ 1036 continue; 1037 1038 IFADDR_READER_FOREACH(ifa, ifn) { 1039 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 1040 if (sin == NULL) 1041 continue; 1042 if (stcb) { 1043 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) { 1044 /* It is restricted for some reason.. probably 1045 * not yet added. 1046 */ 1047 continue; 1048 } 1049 } 1050 pserialize_read_exit(s); 1051 return (sin->sin_addr); 1052 } 1053 } 1054 pserialize_read_exit(s); 1055 /* 1056 * Ok we can find NO address to source from that is 1057 * not on our negative list. It is either the special 1058 * ASCONF case where we are sourceing from a intf that 1059 * has been ifconfig'd to a different address (i.e. 1060 * it holds a ADD/DEL/SET-PRIM and the proper lookup 1061 * address. OR we are hosed, and this baby is going 1062 * to abort the association. 1063 */ 1064 if (non_asoc_addr_ok) { 1065 return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr); 1066 } else { 1067 memset(&ans, 0, sizeof(ans)); 1068 return (ans); 1069 } 1070 } 1071 1072 1073 1074 /* tcb may be NULL */ 1075 struct in_addr 1076 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp, 1077 struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net, 1078 int non_asoc_addr_ok) 1079 { 1080 struct in_addr ans; 1081 const struct sockaddr_in *to; 1082 struct rtentry *rt; 1083 uint8_t ipv4_scope, loopscope; 1084 1085 /* 1086 * Rules: 1087 * - Find the route if needed, cache if I can. 1088 * - Look at interface address in route, Is it 1089 * in the bound list. If so we have the best source. 1090 * - If not we must rotate amongst the addresses. 1091 * 1092 * Cavets and issues 1093 * 1094 * Do we need to pay attention to scope. We can have 1095 * a private address or a global address we are sourcing 1096 * or sending to. So if we draw it out 1097 * source * dest * result 1098 * ------------------------------------------ 1099 * a Private * Global * NAT? 1100 * ------------------------------------------ 1101 * b Private * Private * No problem 1102 * ------------------------------------------ 1103 * c Global * Private * Huh, How will this work? 1104 * ------------------------------------------ 1105 * d Global * Global * No Problem 1106 * ------------------------------------------ 1107 * 1108 * And then we add to that what happens if there are multiple 1109 * addresses assigned to an interface. Remember the ifa on a 1110 * ifn is a linked list of addresses. So one interface can 1111 * have more than one IPv4 address. What happens if we 1112 * have both a private and a global address? Do we then 1113 * use context of destination to sort out which one is 1114 * best? And what about NAT's sending P->G may get you 1115 * a NAT translation, or should you select the G thats 1116 * on the interface in preference. 1117 * 1118 * Decisions: 1119 * 1120 * - count the number of addresses on the interface. 1121 * - if its one, no problem except case <c>. For <a> 1122 * we will assume a NAT out there. 1123 * - if there are more than one, then we need to worry 1124 * about scope P or G. We should prefer G -> G and 1125 * P -> P if possible. Then as a secondary fall back 1126 * to mixed types G->P being a last ditch one. 1127 * - The above all works for bound all, but bound 1128 * specific we need to use the same concept but instead 1129 * only consider the bound addresses. If the bound set 1130 * is NOT assigned to the interface then we must use 1131 * rotation amongst them. 1132 * 1133 * Notes: For v4, we can always punt and let ip_output 1134 * decide by sending back a source of 0.0.0.0 1135 */ 1136 1137 /* 1138 * Need a route to cache. 1139 * 1140 */ 1141 rt = rtcache_validate(ro); 1142 if (rt == NULL) { 1143 /* No route to host .. punt */ 1144 memset(&ans, 0, sizeof(ans)); 1145 return (ans); 1146 } else { 1147 to = satocsin(rtcache_getdst(ro)); 1148 } 1149 /* Setup our scopes */ 1150 if (stcb) { 1151 ipv4_scope = stcb->asoc.ipv4_local_scope; 1152 loopscope = stcb->asoc.loopback_scope; 1153 } else { 1154 /* Scope based on outbound address */ 1155 if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) { 1156 ipv4_scope = 1; 1157 loopscope = 0; 1158 } else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) { 1159 ipv4_scope = 1; 1160 loopscope = 1; 1161 } else { 1162 ipv4_scope = 0; 1163 loopscope = 0; 1164 } 1165 } 1166 #ifdef SCTP_DEBUG 1167 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1168 printf("Scope setup loop:%d ipv4_scope:%d\n", 1169 loopscope, ipv4_scope); 1170 } 1171 #endif 1172 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 1173 /* 1174 * When bound to all if the address list is set 1175 * it is a negative list. Addresses being added 1176 * by asconf. 1177 */ 1178 ans = sctp_choose_v4_boundall(inp, stcb, net, rt, 1179 ipv4_scope, loopscope, non_asoc_addr_ok); 1180 goto out; 1181 } 1182 /* 1183 * Three possiblities here: 1184 * 1185 * a) stcb is NULL, which means we operate only from 1186 * the list of addresses (ifa's) bound to the assoc and 1187 * we care not about the list. 1188 * b) stcb is NOT-NULL, which means we have an assoc structure and 1189 * auto-asconf is on. This means that the list of addresses is 1190 * a NOT list. We use the list from the inp, but any listed address 1191 * in our list is NOT yet added. However if the non_asoc_addr_ok is 1192 * set we CAN use an address NOT available (i.e. being added). Its 1193 * a negative list. 1194 * c) stcb is NOT-NULL, which means we have an assoc structure and 1195 * auto-asconf is off. This means that the list of addresses is 1196 * the ONLY addresses I can use.. its positive. 1197 * 1198 * Note we collapse b & c into the same function just like in 1199 * the v6 address selection. 1200 */ 1201 if (stcb) { 1202 ans = sctp_choose_v4_boundspecific_stcb(inp, stcb, net, 1203 rt, ipv4_scope, loopscope, non_asoc_addr_ok); 1204 goto out; 1205 } else { 1206 ans = sctp_choose_v4_boundspecific_inp(inp, rt, 1207 ipv4_scope, loopscope); 1208 goto out; 1209 } 1210 /* this should not be reached */ 1211 memset(&ans, 0, sizeof(ans)); 1212 out: 1213 rtcache_unref(rt, ro); 1214 return ans; 1215 } 1216 1217 1218 1219 static struct sockaddr_in6 * 1220 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local) 1221 { 1222 struct in6_ifaddr *ifa6; 1223 struct sockaddr_in6 *sin6; 1224 1225 if (ifa->ifa_addr->sa_family != AF_INET6) { 1226 /* forget non-v6 */ 1227 return (NULL); 1228 } 1229 ifa6 = (struct in6_ifaddr *)ifa; 1230 /* ok to use deprecated addresses? */ 1231 if (!ip6_use_deprecated) { 1232 if (IFA6_IS_DEPRECATED(ifa6)) { 1233 /* can't use this type */ 1234 return (NULL); 1235 } 1236 } 1237 /* are we ok, with the current state of this address? */ 1238 if (ifa6->ia6_flags & 1239 (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) { 1240 /* Can't use these types */ 1241 return (NULL); 1242 } 1243 /* Ok the address may be ok */ 1244 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 1245 *sin_local = *sin_loop = 0; 1246 if ((ifa->ifa_ifp->if_type == IFT_LOOP) || 1247 (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) { 1248 *sin_loop = 1; 1249 } 1250 if (!loopscope && *sin_loop) { 1251 /* Its a loopback address and we don't have loop scope */ 1252 return (NULL); 1253 } 1254 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1255 /* we skip unspecifed addresses */ 1256 return (NULL); 1257 } 1258 1259 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 1260 *sin_local = 1; 1261 } 1262 if (!loc_scope && *sin_local) { 1263 /* Its a link local address, and we don't have link local scope */ 1264 return (NULL); 1265 } 1266 return (sin6); 1267 } 1268 1269 1270 static struct sockaddr_in6 * 1271 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp, 1272 struct sctp_tcb *stcb, 1273 struct sctp_nets *net, 1274 struct rtentry *rt, 1275 uint8_t loc_scope, 1276 uint8_t loopscope, 1277 int non_asoc_addr_ok) 1278 { 1279 /* 1280 * Each endpoint has a list of local addresses associated 1281 * with it. The address list is either a "negative list" i.e. 1282 * those addresses that are NOT allowed to be used as a source OR 1283 * a "postive list" i.e. those addresses that CAN be used. 1284 * 1285 * Its a negative list if asconf is allowed. What we do 1286 * in this case is use the ep address list BUT we have 1287 * to cross check it against the negative list. 1288 * 1289 * In the case where NO asconf is allowed, we have just 1290 * a straight association level list that we must use to 1291 * find a source address. 1292 */ 1293 struct sctp_laddr *laddr, *starting_point; 1294 struct sockaddr_in6 *sin6; 1295 int sin_loop, sin_local; 1296 int start_at_beginning=0; 1297 struct ifnet *ifn; 1298 struct ifaddr *ifa; 1299 1300 ifn = rt->rt_ifp; 1301 if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) { 1302 #ifdef SCTP_DEBUG 1303 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1304 printf("Have a STCB - asconf allowed, not bound all have a netgative list\n"); 1305 } 1306 #endif 1307 /* first question, is the ifn we will emit on 1308 * in our list, if so, we want that one. 1309 */ 1310 if (ifn) { 1311 IFADDR_READER_FOREACH(ifa, ifn) { 1312 if (sctp_is_addr_in_ep(inp, ifa)) { 1313 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1314 if (sin6 == NULL) 1315 continue; 1316 if ((non_asoc_addr_ok == 0) && 1317 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) { 1318 /* on the no-no list */ 1319 continue; 1320 } 1321 return (sin6); 1322 } 1323 } 1324 } 1325 starting_point = stcb->asoc.last_used_address; 1326 /* First try for matching scope */ 1327 sctp_from_the_top: 1328 if (stcb->asoc.last_used_address == NULL) { 1329 start_at_beginning=1; 1330 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 1331 } 1332 /* search beginning with the last used address */ 1333 for (laddr = stcb->asoc.last_used_address; laddr; 1334 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 1335 if (laddr->ifa == NULL) { 1336 /* address has been removed */ 1337 continue; 1338 } 1339 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1340 if (sin6 == NULL) 1341 continue; 1342 if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) { 1343 /* on the no-no list */ 1344 continue; 1345 } 1346 /* is it of matching scope ? */ 1347 if ((loopscope == 0) && 1348 (loc_scope == 0) && 1349 (sin_loop == 0) && 1350 (sin_local == 0)) { 1351 /* all of global scope we are ok with it */ 1352 return (sin6); 1353 } 1354 if (loopscope && sin_loop) 1355 /* both on the loopback, thats ok */ 1356 return (sin6); 1357 if (loc_scope && sin_local) 1358 /* both local scope */ 1359 return (sin6); 1360 1361 } 1362 if (start_at_beginning == 0) { 1363 stcb->asoc.last_used_address = NULL; 1364 goto sctp_from_the_top; 1365 } 1366 /* now try for any higher scope than the destination */ 1367 stcb->asoc.last_used_address = starting_point; 1368 start_at_beginning = 0; 1369 sctp_from_the_top2: 1370 if (stcb->asoc.last_used_address == NULL) { 1371 start_at_beginning=1; 1372 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 1373 } 1374 /* search beginning with the last used address */ 1375 for (laddr = stcb->asoc.last_used_address; laddr; 1376 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 1377 if (laddr->ifa == NULL) { 1378 /* address has been removed */ 1379 continue; 1380 } 1381 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1382 if (sin6 == NULL) 1383 continue; 1384 if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) { 1385 /* on the no-no list */ 1386 continue; 1387 } 1388 return (sin6); 1389 } 1390 if (start_at_beginning == 0) { 1391 stcb->asoc.last_used_address = NULL; 1392 goto sctp_from_the_top2; 1393 } 1394 } else { 1395 #ifdef SCTP_DEBUG 1396 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1397 printf("Have a STCB - no asconf allowed, not bound all have a postive list\n"); 1398 } 1399 #endif 1400 /* First try for interface output match */ 1401 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 1402 sctp_nxt_addr) { 1403 if (laddr->ifa == NULL) { 1404 /* address has been removed */ 1405 continue; 1406 } 1407 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1408 if (sin6 == NULL) 1409 continue; 1410 /* first question, is laddr->ifa an address associated with the emit interface */ 1411 if (ifn) { 1412 IFADDR_READER_FOREACH(ifa, ifn) { 1413 if (laddr->ifa == ifa) { 1414 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr; 1415 return (sin6); 1416 } 1417 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) { 1418 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr; 1419 return (sin6); 1420 } 1421 } 1422 } 1423 } 1424 /* Next try for matching scope */ 1425 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 1426 sctp_nxt_addr) { 1427 if (laddr->ifa == NULL) { 1428 /* address has been removed */ 1429 continue; 1430 } 1431 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1432 if (sin6 == NULL) 1433 continue; 1434 1435 if ((loopscope == 0) && 1436 (loc_scope == 0) && 1437 (sin_loop == 0) && 1438 (sin_local == 0)) { 1439 /* all of global scope we are ok with it */ 1440 return (sin6); 1441 } 1442 if (loopscope && sin_loop) 1443 /* both on the loopback, thats ok */ 1444 return (sin6); 1445 if (loc_scope && sin_local) 1446 /* both local scope */ 1447 return (sin6); 1448 } 1449 /* ok, now try for a higher scope in the source address */ 1450 /* First try for matching scope */ 1451 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 1452 sctp_nxt_addr) { 1453 if (laddr->ifa == NULL) { 1454 /* address has been removed */ 1455 continue; 1456 } 1457 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1458 if (sin6 == NULL) 1459 continue; 1460 return (sin6); 1461 } 1462 } 1463 return (NULL); 1464 } 1465 1466 static struct sockaddr_in6 * 1467 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp, 1468 struct rtentry *rt, 1469 uint8_t loc_scope, 1470 uint8_t loopscope) 1471 { 1472 /* 1473 * Here we are bound specific and have only 1474 * an inp. We must find an address that is bound 1475 * that we can give out as a src address. We 1476 * prefer two addresses of same scope if we can 1477 * find them that way. 1478 */ 1479 struct sctp_laddr *laddr; 1480 struct sockaddr_in6 *sin6; 1481 struct ifnet *ifn; 1482 struct ifaddr *ifa; 1483 int sin_loop, sin_local; 1484 1485 /* first question, is the ifn we will emit on 1486 * in our list, if so, we want that one. 1487 */ 1488 1489 ifn = rt->rt_ifp; 1490 if (ifn) { 1491 IFADDR_READER_FOREACH(ifa, ifn) { 1492 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1493 if (sin6 == NULL) 1494 continue; 1495 if (sctp_is_addr_in_ep(inp, ifa)) { 1496 return (sin6); 1497 } 1498 } 1499 } 1500 for (laddr = LIST_FIRST(&inp->sctp_addr_list); 1501 laddr && (laddr != inp->next_addr_touse); 1502 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 1503 if (laddr->ifa == NULL) { 1504 /* address has been removed */ 1505 continue; 1506 } 1507 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1508 if (sin6 == NULL) 1509 continue; 1510 1511 if ((loopscope == 0) && 1512 (loc_scope == 0) && 1513 (sin_loop == 0) && 1514 (sin_local == 0)) { 1515 /* all of global scope we are ok with it */ 1516 return (sin6); 1517 } 1518 if (loopscope && sin_loop) 1519 /* both on the loopback, thats ok */ 1520 return (sin6); 1521 if (loc_scope && sin_local) 1522 /* both local scope */ 1523 return (sin6); 1524 1525 } 1526 /* if we reach here, we could not find two addresses 1527 * of the same scope to give out. Lets look for any higher level 1528 * scope for a source address. 1529 */ 1530 for (laddr = LIST_FIRST(&inp->sctp_addr_list); 1531 laddr && (laddr != inp->next_addr_touse); 1532 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 1533 if (laddr->ifa == NULL) { 1534 /* address has been removed */ 1535 continue; 1536 } 1537 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1538 if (sin6 == NULL) 1539 continue; 1540 return (sin6); 1541 } 1542 /* no address bound can be a source for the destination */ 1543 #ifdef SCTP_DEBUG 1544 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1545 printf("Src address selection for EP, no acceptable src address found for address\n"); 1546 } 1547 #endif 1548 return (NULL); 1549 } 1550 1551 1552 static struct sockaddr_in6 * 1553 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope, 1554 uint8_t loc_scope, int cur_addr_num, int match_scope) 1555 { 1556 struct ifaddr *ifa; 1557 struct sockaddr_in6 *sin6; 1558 int sin_loop, sin_local; 1559 int num_eligible_addr = 0; 1560 1561 IFADDR_READER_FOREACH(ifa, ifn) { 1562 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1563 if (sin6 == NULL) 1564 continue; 1565 if (stcb) { 1566 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) { 1567 /* It is restricted for some reason.. probably 1568 * not yet added. 1569 */ 1570 continue; 1571 } 1572 } 1573 if (match_scope) { 1574 /* Here we are asked to match scope if possible */ 1575 if (loopscope && sin_loop) 1576 /* src and destination are loopback scope */ 1577 return (sin6); 1578 if (loc_scope && sin_local) 1579 /* src and destination are local scope */ 1580 return (sin6); 1581 if ((loopscope == 0) && 1582 (loc_scope == 0) && 1583 (sin_loop == 0) && 1584 (sin_local == 0)) { 1585 /* src and destination are global scope */ 1586 return (sin6); 1587 } 1588 continue; 1589 } 1590 if (num_eligible_addr == cur_addr_num) { 1591 /* this is it */ 1592 return (sin6); 1593 } 1594 num_eligible_addr++; 1595 } 1596 return (NULL); 1597 } 1598 1599 1600 static int 1601 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, 1602 int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope) 1603 { 1604 struct ifaddr *ifa; 1605 struct sockaddr_in6 *sin6; 1606 int num_eligible_addr = 0; 1607 int sin_loop, sin_local; 1608 1609 IFADDR_READER_FOREACH(ifa, ifn) { 1610 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1611 if (sin6 == NULL) 1612 continue; 1613 if (stcb) { 1614 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) { 1615 /* It is restricted for some reason.. probably 1616 * not yet added. 1617 */ 1618 continue; 1619 } 1620 } 1621 num_eligible_addr++; 1622 } 1623 return (num_eligible_addr); 1624 } 1625 1626 1627 static struct sockaddr_in6 * 1628 sctp_choose_v6_boundall(struct sctp_inpcb *inp, 1629 struct sctp_tcb *stcb, 1630 struct sctp_nets *net, 1631 struct rtentry *rt, 1632 uint8_t loc_scope, 1633 uint8_t loopscope, 1634 int non_asoc_addr_ok) 1635 { 1636 /* Ok, we are bound all SO any address 1637 * is ok to use as long as it is NOT in the negative 1638 * list. 1639 */ 1640 int num_eligible_addr; 1641 int cur_addr_num=0; 1642 int started_at_beginning=0; 1643 int match_scope_prefered; 1644 /* first question is, how many eligible addresses are 1645 * there for the destination ifn that we are using that 1646 * are within the proper scope? 1647 */ 1648 struct ifnet *ifn; 1649 struct sockaddr_in6 *sin6; 1650 int s; 1651 1652 ifn = rt->rt_ifp; 1653 if (net) { 1654 cur_addr_num = net->indx_of_eligible_next_to_use; 1655 } 1656 if (cur_addr_num == 0) { 1657 match_scope_prefered = 1; 1658 } else { 1659 match_scope_prefered = 0; 1660 } 1661 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope); 1662 #ifdef SCTP_DEBUG 1663 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1664 printf("Found %d eligible source addresses\n", num_eligible_addr); 1665 } 1666 #endif 1667 if (num_eligible_addr == 0) { 1668 /* no eligible addresses, we must use some other 1669 * interface address if we can find one. 1670 */ 1671 goto bound_all_v6_plan_b; 1672 } 1673 /* Ok we have num_eligible_addr set with how many we can use, 1674 * this may vary from call to call due to addresses being deprecated etc.. 1675 */ 1676 if (cur_addr_num >= num_eligible_addr) { 1677 cur_addr_num = 0; 1678 } 1679 /* select the nth address from the list (where cur_addr_num is the nth) and 1680 * 0 is the first one, 1 is the second one etc... 1681 */ 1682 #ifdef SCTP_DEBUG 1683 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1684 printf("cur_addr_num:%d match_scope_prefered:%d select it\n", 1685 cur_addr_num, match_scope_prefered); 1686 } 1687 #endif 1688 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, 1689 loc_scope, cur_addr_num, match_scope_prefered); 1690 if (match_scope_prefered && (sin6 == NULL)) { 1691 /* retry without the preference for matching scope */ 1692 #ifdef SCTP_DEBUG 1693 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1694 printf("retry with no match_scope_prefered\n"); 1695 } 1696 #endif 1697 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, 1698 loc_scope, cur_addr_num, 0); 1699 } 1700 if (sin6) { 1701 #ifdef SCTP_DEBUG 1702 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1703 printf("Selected address %d ifn:%p for the route\n", cur_addr_num, ifn); 1704 } 1705 #endif 1706 if (net) { 1707 /* store so we get the next one */ 1708 if (cur_addr_num < 255) 1709 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 1710 else 1711 net->indx_of_eligible_next_to_use = 0; 1712 } 1713 return (sin6); 1714 } 1715 num_eligible_addr = 0; 1716 bound_all_v6_plan_b: 1717 /* ok, if we reach here we either fell through 1718 * due to something changing during an interrupt (unlikely) 1719 * or we have NO eligible source addresses for the ifn 1720 * of the route (most likely). We must look at all the other 1721 * interfaces EXCEPT rt->rt_ifp and do the same game. 1722 */ 1723 #ifdef SCTP_DEBUG 1724 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1725 printf("bound-all Plan B\n"); 1726 } 1727 #endif 1728 if (inp->next_ifn_touse == NULL) { 1729 started_at_beginning=1; 1730 inp->next_ifn_touse = IFNET_READER_FIRST(); 1731 #ifdef SCTP_DEBUG 1732 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1733 printf("Start at first IFN:%p\n", inp->next_ifn_touse); 1734 } 1735 #endif 1736 } else { 1737 inp->next_ifn_touse = IFNET_READER_NEXT(inp->next_ifn_touse); 1738 #ifdef SCTP_DEBUG 1739 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1740 printf("Resume at IFN:%p\n", inp->next_ifn_touse); 1741 } 1742 #endif 1743 if (inp->next_ifn_touse == NULL) { 1744 #ifdef SCTP_DEBUG 1745 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1746 printf("IFN Resets\n"); 1747 } 1748 #endif 1749 started_at_beginning=1; 1750 inp->next_ifn_touse = IFNET_READER_FIRST(); 1751 } 1752 } 1753 1754 s = pserialize_read_enter(); 1755 IFNET_READER_FOREACH(ifn) { 1756 if (loopscope == 0 && ifn->if_type == IFT_LOOP) { 1757 /* wrong base scope */ 1758 continue; 1759 } 1760 if (loc_scope && (ifn->if_index != loc_scope)) { 1761 /* by definition the scope (from to->sin6_scopeid) 1762 * must match that of the interface. If not then 1763 * we could pick a wrong scope for the address. 1764 * Usually we don't hit plan-b since the route 1765 * handles this. However we can hit plan-b when 1766 * we send to local-host so the route is the 1767 * loopback interface, but the destination is a 1768 * link local. 1769 */ 1770 continue; 1771 } 1772 if (ifn == rt->rt_ifp) { 1773 /* already looked at this guy */ 1774 continue; 1775 } 1776 /* Address rotation will only work when we are not 1777 * rotating sourced interfaces and are using the interface 1778 * of the route. We would need to have a per interface index 1779 * in order to do proper rotation. 1780 */ 1781 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope); 1782 #ifdef SCTP_DEBUG 1783 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1784 printf("IFN:%p has %d eligible\n", ifn, num_eligible_addr); 1785 } 1786 #endif 1787 if (num_eligible_addr == 0) { 1788 /* none we can use */ 1789 continue; 1790 } 1791 /* Ok we have num_eligible_addr set with how many we can use, 1792 * this may vary from call to call due to addresses being deprecated etc.. 1793 */ 1794 inp->next_ifn_touse = ifn; 1795 1796 /* select the first one we can find with perference for matching scope. 1797 */ 1798 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1); 1799 if (sin6 == NULL) { 1800 /* can't find one with matching scope how about a source with higher 1801 * scope 1802 */ 1803 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0); 1804 if (sin6 == NULL) 1805 /* Hmm, can't find one in the interface now */ 1806 continue; 1807 } 1808 #ifdef SCTP_DEBUG 1809 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1810 printf("Selected the %d'th address of ifn:%p\n", 1811 cur_addr_num, ifn); 1812 } 1813 #endif 1814 pserialize_read_exit(s); 1815 return (sin6); 1816 } 1817 pserialize_read_exit(s); 1818 1819 if (started_at_beginning == 0) { 1820 /* we have not been through all of them yet, force 1821 * us to go through them all. 1822 */ 1823 #ifdef SCTP_DEBUG 1824 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1825 printf("Force a recycle\n"); 1826 } 1827 #endif 1828 inp->next_ifn_touse = NULL; 1829 goto bound_all_v6_plan_b; 1830 } 1831 return (NULL); 1832 1833 } 1834 1835 /* stcb and net may be NULL */ 1836 struct in6_addr 1837 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp, 1838 struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net, 1839 int non_asoc_addr_ok) 1840 { 1841 struct in6_addr ans; 1842 struct sockaddr_in6 *rt_addr; 1843 uint8_t loc_scope, loopscope; 1844 struct sockaddr_in6 to; 1845 struct rtentry *rt; 1846 1847 /* 1848 * This routine is tricky standard v6 src address 1849 * selection cannot take into account what we have 1850 * bound etc, so we can't use it. 1851 * 1852 * Instead here is what we must do: 1853 * 1) Make sure we have a route, if we 1854 * don't have a route we can never reach the peer. 1855 * 2) Once we have a route, determine the scope of the 1856 * route. Link local, loopback or global. 1857 * 3) Next we divide into three types. Either we 1858 * are bound all.. which means we want to use 1859 * one of the addresses of the interface we are 1860 * going out. <or> 1861 * 4a) We have not stcb, which means we are using the 1862 * specific addresses bound on an inp, in this 1863 * case we are similar to the stcb case (4b below) 1864 * accept the list is always a positive list.<or> 1865 * 4b) We are bound specific with a stcb, which means we have a 1866 * list of bound addresses and we must see if the 1867 * ifn of the route is actually one of the bound addresses. 1868 * If not, then we must rotate addresses amongst properly 1869 * scoped bound addresses, if so we use the address 1870 * of the interface. 1871 * 5) Always, no matter which path we take through the above 1872 * we must be sure the source address we use is allowed to 1873 * be used. I.e. IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST 1874 * addresses cannot be used. 1875 * 6) Addresses that are deprecated MAY be used 1876 * if (!ip6_use_deprecated) { 1877 * if (IFA6_IS_DEPRECATED(ifa6)) { 1878 * skip the address 1879 * } 1880 * } 1881 */ 1882 1883 /*** 1> determine route, if not already done */ 1884 rt = rtcache_validate(ro); 1885 if (rt == NULL) { 1886 /* 1887 * Need a route to cache. 1888 */ 1889 int scope_save; 1890 1891 memcpy(&to, rtcache_getdst(ro), sizeof(struct sockaddr)); 1892 scope_save = to.sin6_scope_id; 1893 to.sin6_scope_id = 0; 1894 1895 rt = rtcache_lookup(ro, (struct sockaddr *)&to); 1896 to.sin6_scope_id = scope_save; 1897 } 1898 if (rt == NULL) { 1899 /* 1900 * no route to host. this packet is going no-where. 1901 * We probably should make sure we arrange to send back 1902 * an error. 1903 */ 1904 #ifdef SCTP_DEBUG 1905 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1906 printf("No route to host, this packet cannot be sent!\n"); 1907 } 1908 #endif 1909 memset(&ans, 0, sizeof(ans)); 1910 return (ans); 1911 } 1912 1913 /*** 2a> determine scope for outbound address/route */ 1914 loc_scope = loopscope = 0; 1915 /* 1916 * We base our scope on the outbound packet scope and route, 1917 * NOT the TCB (if there is one). This way in local scope we will only 1918 * use a local scope src address when we send to a local address. 1919 */ 1920 1921 if (IN6_IS_ADDR_LOOPBACK(&to.sin6_addr)) { 1922 /* If the route goes to the loopback address OR 1923 * the address is a loopback address, we are loopback 1924 * scope. 1925 */ 1926 #ifdef SCTP_DEBUG 1927 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1928 printf("Loopback scope is set\n"); 1929 } 1930 #endif 1931 loc_scope = 0; 1932 loopscope = 1; 1933 if (net != NULL) { 1934 /* mark it as local */ 1935 net->addr_is_local = 1; 1936 } 1937 1938 } else if (IN6_IS_ADDR_LINKLOCAL(&to.sin6_addr)) { 1939 #ifdef SCTP_DEBUG 1940 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1941 printf("Link local scope is set, id:%d\n", to.sin6_scope_id); 1942 } 1943 #endif 1944 if (to.sin6_scope_id) 1945 loc_scope = to.sin6_scope_id; 1946 else { 1947 loc_scope = 1; 1948 } 1949 loopscope = 0; 1950 } else { 1951 #ifdef SCTP_DEBUG 1952 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1953 printf("Global scope is set\n"); 1954 } 1955 #endif 1956 } 1957 1958 /* now, depending on which way we are bound we call the appropriate 1959 * routine to do steps 3-6 1960 */ 1961 #ifdef SCTP_DEBUG 1962 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1963 printf("Destination address:"); 1964 sctp_print_address((struct sockaddr *)&to); 1965 } 1966 #endif 1967 1968 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 1969 #ifdef SCTP_DEBUG 1970 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1971 printf("Calling bound-all src addr selection for v6\n"); 1972 } 1973 #endif 1974 rt_addr = sctp_choose_v6_boundall(inp, stcb, net, rt, loc_scope, loopscope, non_asoc_addr_ok); 1975 } else { 1976 #ifdef SCTP_DEBUG 1977 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1978 printf("Calling bound-specific src addr selection for v6\n"); 1979 } 1980 #endif 1981 if (stcb) 1982 rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, rt, loc_scope, loopscope, non_asoc_addr_ok); 1983 else 1984 /* we can't have a non-asoc address since we have no association */ 1985 rt_addr = sctp_choose_v6_boundspecific_inp(inp, rt, loc_scope, loopscope); 1986 } 1987 rtcache_unref(rt, ro); 1988 if (rt_addr == NULL) { 1989 /* no suitable address? */ 1990 struct in6_addr in6; 1991 #ifdef SCTP_DEBUG 1992 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1993 printf("V6 packet will reach dead-end no suitable src address\n"); 1994 } 1995 #endif 1996 memset(&in6, 0, sizeof(in6)); 1997 return (in6); 1998 } 1999 #ifdef SCTP_DEBUG 2000 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2001 printf("Source address selected is:"); 2002 sctp_print_address((struct sockaddr *)rt_addr); 2003 } 2004 #endif 2005 return (rt_addr->sin6_addr); 2006 } 2007 2008 static uint8_t 2009 sctp_get_ect(struct sctp_tcb *stcb, 2010 struct sctp_tmit_chunk *chk) 2011 { 2012 uint8_t this_random; 2013 2014 /* Huh? */ 2015 if (sctp_ecn == 0) 2016 return (0); 2017 2018 if (sctp_ecn_nonce == 0) 2019 /* no nonce, always return ECT0 */ 2020 return (SCTP_ECT0_BIT); 2021 2022 if (stcb->asoc.peer_supports_ecn_nonce == 0) { 2023 /* Peer does NOT support it, so we send a ECT0 only */ 2024 return (SCTP_ECT0_BIT); 2025 } 2026 2027 if (chk == NULL) 2028 return (SCTP_ECT0_BIT); 2029 2030 if (((stcb->asoc.hb_random_idx == 3) && 2031 (stcb->asoc.hb_ect_randombit > 7)) || 2032 (stcb->asoc.hb_random_idx > 3)) { 2033 uint32_t rndval; 2034 rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 2035 memcpy(stcb->asoc.hb_random_values, &rndval, 2036 sizeof(stcb->asoc.hb_random_values)); 2037 this_random = stcb->asoc.hb_random_values[0]; 2038 stcb->asoc.hb_random_idx = 0; 2039 stcb->asoc.hb_ect_randombit = 0; 2040 } else { 2041 if (stcb->asoc.hb_ect_randombit > 7) { 2042 stcb->asoc.hb_ect_randombit = 0; 2043 stcb->asoc.hb_random_idx++; 2044 } 2045 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx]; 2046 } 2047 if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) { 2048 if (chk != NULL) 2049 /* ECN Nonce stuff */ 2050 chk->rec.data.ect_nonce = SCTP_ECT1_BIT; 2051 stcb->asoc.hb_ect_randombit++; 2052 return (SCTP_ECT1_BIT); 2053 } else { 2054 stcb->asoc.hb_ect_randombit++; 2055 return (SCTP_ECT0_BIT); 2056 } 2057 } 2058 2059 extern int sctp_no_csum_on_loopback; 2060 2061 static int 2062 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 2063 struct sctp_tcb *stcb, /* may be NULL */ 2064 struct sctp_nets *net, 2065 const struct sockaddr *to, 2066 struct mbuf *m, 2067 int nofragment_flag, 2068 int ecn_ok, 2069 struct sctp_tmit_chunk *chk, 2070 int out_of_asoc_ok) 2071 /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 2072 { 2073 /* 2074 * Given a mbuf chain (via m_next) that holds a packet header 2075 * WITH a SCTPHDR but no IP header, endpoint inp and sa structure. 2076 * - calculate SCTP checksum and fill in 2077 * - prepend a IP address header 2078 * - if boundall use INADDR_ANY 2079 * - if boundspecific do source address selection 2080 * - set fragmentation option for ipV4 2081 * - On return from IP output, check/adjust mtu size 2082 * - of output interface and smallest_mtu size as well. 2083 */ 2084 struct sctphdr *sctphdr; 2085 int o_flgs; 2086 uint32_t csum; 2087 int ret; 2088 unsigned int have_mtu; 2089 struct route *ro; 2090 struct rtentry *rt; 2091 2092 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 2093 sctp_m_freem(m); 2094 return (EFAULT); 2095 } 2096 if ((m->m_flags & M_PKTHDR) == 0) { 2097 #ifdef SCTP_DEBUG 2098 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2099 printf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n"); 2100 } 2101 #endif 2102 sctp_m_freem(m); 2103 return (EFAULT); 2104 } 2105 /* Calculate the csum and fill in the length of the packet */ 2106 sctphdr = mtod(m, struct sctphdr *); 2107 have_mtu = 0; 2108 if (sctp_no_csum_on_loopback && 2109 (stcb) && 2110 (stcb->asoc.loopback_scope)) { 2111 sctphdr->checksum = 0; 2112 m->m_pkthdr.len = sctp_calculate_len(m); 2113 } else { 2114 sctphdr->checksum = 0; 2115 csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0); 2116 sctphdr->checksum = csum; 2117 } 2118 if (to->sa_family == AF_INET) { 2119 struct ip *ip; 2120 static struct route iproute; 2121 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 2122 if (m == NULL) { 2123 /* failed to prepend data, give up */ 2124 return (ENOMEM); 2125 } 2126 ip = mtod(m, struct ip *); 2127 ip->ip_v = IPVERSION; 2128 ip->ip_hl = (sizeof(struct ip) >> 2); 2129 if (nofragment_flag) { 2130 ip->ip_off = htons(IP_DF); 2131 } else 2132 ip->ip_off = 0; 2133 2134 ip->ip_id = htons(ip_newid(NULL)); 2135 ip->ip_ttl = inp->inp_ip_ttl; 2136 ip->ip_len = htons(m->m_pkthdr.len); 2137 if (stcb) { 2138 if ((stcb->asoc.ecn_allowed) && ecn_ok) { 2139 /* Enable ECN */ 2140 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) | 2141 sctp_get_ect(stcb, chk)); 2142 } else { 2143 /* No ECN */ 2144 ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos; 2145 } 2146 } else { 2147 /* no association at all */ 2148 ip->ip_tos = inp->inp_ip_tos; 2149 } 2150 ip->ip_p = IPPROTO_SCTP; 2151 ip->ip_sum = 0; 2152 #ifdef SCTP_DEBUG 2153 printf("chunk_output: net %p\n", net); 2154 #endif 2155 if (net == NULL) { 2156 ro = &iproute; 2157 memset(&iproute, 0, sizeof(iproute)); 2158 /* XXX */ 2159 rt = rtcache_lookup(ro, to); 2160 rtcache_unref(rt, ro); 2161 } else { 2162 ro = (struct route *)&net->ro; 2163 } 2164 /* Now the address selection part */ 2165 ip->ip_dst.s_addr = satocsin(to)->sin_addr.s_addr; 2166 2167 /* call the routine to select the src address */ 2168 if (net) { 2169 if (net->src_addr_selected == 0) { 2170 /* Cache the source address */ 2171 ((struct sockaddr_in *)&net->_s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp, 2172 stcb, 2173 ro, net, out_of_asoc_ok); 2174 rt = rtcache_validate(ro); 2175 if (rt != NULL) { 2176 net->src_addr_selected = 1; 2177 } 2178 rtcache_unref(rt, ro); 2179 } 2180 ip->ip_src = ((struct sockaddr_in *)&net->_s_addr)->sin_addr; 2181 } else { 2182 ip->ip_src = sctp_ipv4_source_address_selection(inp, 2183 stcb, ro, net, out_of_asoc_ok); 2184 } 2185 #ifdef SCTP_DEBUG 2186 printf("src addr %x\n", ip->ip_src.s_addr); 2187 #endif 2188 /* 2189 * If source address selection fails and we find no route then 2190 * the ip_output should fail as well with a NO_ROUTE_TO_HOST 2191 * type error. We probably should catch that somewhere and 2192 * abort the association right away (assuming this is an INIT 2193 * being sent). 2194 */ 2195 rt = rtcache_validate(ro); 2196 if (rt == NULL) { 2197 /* 2198 * src addr selection failed to find a route (or valid 2199 * source addr), so we can't get there from here! 2200 */ 2201 #ifdef SCTP_DEBUG 2202 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2203 printf("low_level_output: dropped v4 packet- no valid source addr\n"); 2204 printf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr))); 2205 } 2206 #endif /* SCTP_DEBUG */ 2207 if (net) { 2208 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) 2209 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 2210 stcb, 2211 SCTP_FAILED_THRESHOLD, 2212 (void *)net); 2213 net->dest_state &= ~SCTP_ADDR_REACHABLE; 2214 net->dest_state |= SCTP_ADDR_NOT_REACHABLE; 2215 if (stcb) { 2216 if (net == stcb->asoc.primary_destination) { 2217 /* need a new primary */ 2218 struct sctp_nets *alt; 2219 alt = sctp_find_alternate_net(stcb, net); 2220 if (alt != net) { 2221 if (sctp_set_primary_addr(stcb, 2222 (struct sockaddr *)NULL, 2223 alt) == 0) { 2224 net->dest_state |= SCTP_ADDR_WAS_PRIMARY; 2225 net->src_addr_selected = 0; 2226 } 2227 } 2228 } 2229 } 2230 } 2231 sctp_m_freem(m); 2232 return (EHOSTUNREACH); 2233 } else { 2234 have_mtu = rt->rt_ifp->if_mtu; 2235 } 2236 2237 o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST))); 2238 #ifdef SCTP_DEBUG 2239 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2240 printf("Calling ipv4 output routine from low level src addr:%x\n", 2241 (u_int)(ntohl(ip->ip_src.s_addr))); 2242 printf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr))); 2243 printf("RTP route is %p through\n", rt); 2244 printf("length %d\n", ntohs(ip->ip_len)); 2245 } 2246 #endif 2247 if ((have_mtu) && (net) && (have_mtu > net->mtu)) { 2248 rt->rt_ifp->if_mtu = net->mtu; 2249 } 2250 ret = ip_output(m, inp->ip_inp.inp.inp_options, 2251 ro, o_flgs, inp->ip_inp.inp.inp_moptions, 2252 &inp->ip_inp.inp); 2253 if ((rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) { 2254 rt->rt_ifp->if_mtu = have_mtu; 2255 } 2256 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 2257 #ifdef SCTP_DEBUG 2258 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2259 printf("Ip output returns %d\n", ret); 2260 } 2261 #endif 2262 if (net == NULL) { 2263 } else { 2264 /* PMTU check versus smallest asoc MTU goes here */ 2265 if (rt != NULL) { 2266 if (rt->rt_rmx.rmx_mtu && 2267 (stcb->asoc.smallest_mtu > rt->rt_rmx.rmx_mtu)) { 2268 sctp_mtu_size_reset(inp, &stcb->asoc, 2269 rt->rt_rmx.rmx_mtu); 2270 } 2271 } else { 2272 /* route was freed */ 2273 net->src_addr_selected = 0; 2274 } 2275 } 2276 rtcache_unref(rt, ro); 2277 return (ret); 2278 } 2279 #ifdef INET6 2280 else if (to->sa_family == AF_INET6) { 2281 struct ip6_hdr *ip6h; 2282 static struct route ip6route; 2283 struct ifnet *ifp; 2284 u_char flowTop; 2285 uint16_t flowBottom; 2286 u_char tosBottom, tosTop; 2287 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 2288 int prev_scope=0; 2289 u_short prev_port=0; 2290 2291 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT); 2292 if (m == NULL) { 2293 /* failed to prepend data, give up */ 2294 return (ENOMEM); 2295 } 2296 ip6h = mtod(m, struct ip6_hdr *); 2297 2298 /* 2299 * We assume here that inp_flow is in host byte order within 2300 * the TCB! 2301 */ 2302 flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff; 2303 flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16); 2304 2305 tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION); 2306 2307 /* protect *sin6 from overwrite */ 2308 memcpy(&tmp, to, sizeof(struct sockaddr_in6)); 2309 sin6 = &tmp; 2310 2311 /* KAME hack: embed scopeid */ 2312 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) 2313 if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0) 2314 #else 2315 /* 2316 * XXX: appropriate scope zone must be provided or otherwise 2317 * ip6_use_defzone must be 1. 2318 */ 2319 if (sa6_embedscope(sin6, ip6_use_defzone) != 0) 2320 #endif 2321 return (EINVAL); 2322 if (net == NULL) { 2323 memset(&ip6route, 0, sizeof(ip6route)); 2324 ro = (struct route *)&ip6route; 2325 /* XXX */ 2326 rt = rtcache_lookup(ro, (struct sockaddr *) sin6); 2327 rtcache_unref(rt, ro); 2328 } else { 2329 ro = (struct route *)&net->ro; 2330 } 2331 if (stcb != NULL) { 2332 if ((stcb->asoc.ecn_allowed) && ecn_ok) { 2333 /* Enable ECN */ 2334 tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4); 2335 } else { 2336 /* No ECN */ 2337 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4); 2338 } 2339 } else { 2340 /* we could get no asoc if it is a O-O-T-B packet */ 2341 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4); 2342 } 2343 ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom)); 2344 ip6h->ip6_nxt = IPPROTO_SCTP; 2345 ip6h->ip6_plen = m->m_pkthdr.len; 2346 ip6h->ip6_dst = sin6->sin6_addr; 2347 2348 /* 2349 * Add SRC address selection here: 2350 * we can only reuse to a limited degree the kame src-addr-sel, 2351 * since we can try their selection but it may not be bound. 2352 */ 2353 memset(&lsa6_tmp, 0, sizeof(lsa6_tmp)); 2354 lsa6_tmp.sin6_family = AF_INET6; 2355 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 2356 lsa6 = &lsa6_tmp; 2357 rt = rtcache_validate(ro); 2358 if (net) { 2359 if (net->src_addr_selected == 0) { 2360 /* Cache the source address */ 2361 ((struct sockaddr_in6 *)&net->_s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp, 2362 stcb, ro, net, out_of_asoc_ok); 2363 2364 if (rt != NULL) { 2365 net->src_addr_selected = 1; 2366 } 2367 } 2368 lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->_s_addr)->sin6_addr; 2369 } else { 2370 lsa6->sin6_addr = sctp_ipv6_source_address_selection( 2371 inp, stcb, ro, net, out_of_asoc_ok); 2372 } 2373 lsa6->sin6_port = inp->sctp_lport; 2374 2375 if (rt == NULL) { 2376 /* 2377 * src addr selection failed to find a route (or valid 2378 * source addr), so we can't get there from here! 2379 */ 2380 #ifdef SCTP_DEBUG 2381 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2382 printf("low_level_output: dropped v6 pkt- no valid source addr\n"); 2383 } 2384 #endif 2385 sctp_m_freem(m); 2386 if (net) { 2387 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) 2388 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 2389 stcb, 2390 SCTP_FAILED_THRESHOLD, 2391 (void *)net); 2392 net->dest_state &= ~SCTP_ADDR_REACHABLE; 2393 net->dest_state |= SCTP_ADDR_NOT_REACHABLE; 2394 if (stcb) { 2395 if (net == stcb->asoc.primary_destination) { 2396 /* need a new primary */ 2397 struct sctp_nets *alt; 2398 alt = sctp_find_alternate_net(stcb, net); 2399 if (alt != net) { 2400 if (sctp_set_primary_addr(stcb, 2401 (struct sockaddr *)NULL, 2402 alt) == 0) { 2403 net->dest_state |= SCTP_ADDR_WAS_PRIMARY; 2404 net->src_addr_selected = 0; 2405 } 2406 } 2407 } 2408 } 2409 } 2410 return (EHOSTUNREACH); 2411 } 2412 2413 ip6h->ip6_src = lsa6->sin6_addr; 2414 2415 /* 2416 * We set the hop limit now since there is a good chance that 2417 * our ro pointer is now filled 2418 */ 2419 ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp, 2420 (ro ? 2421 (rt ? (rt->rt_ifp) : (NULL)) : 2422 (NULL))); 2423 o_flgs = 0; 2424 ifp = rt->rt_ifp; 2425 #ifdef SCTP_DEBUG 2426 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2427 /* Copy to be sure something bad is not happening */ 2428 sin6->sin6_addr = ip6h->ip6_dst; 2429 lsa6->sin6_addr = ip6h->ip6_src; 2430 2431 printf("Calling ipv6 output routine from low level\n"); 2432 printf("src: "); 2433 sctp_print_address((struct sockaddr *)lsa6); 2434 printf("dst: "); 2435 sctp_print_address((struct sockaddr *)sin6); 2436 } 2437 #endif /* SCTP_DEBUG */ 2438 if (net) { 2439 sin6 = (struct sockaddr_in6 *)&net->ro.ro_sa; 2440 /* preserve the port and scope for link local send */ 2441 prev_scope = sin6->sin6_scope_id; 2442 prev_port = sin6->sin6_port; 2443 } 2444 /* XXX NOMPSAFE need to hold ifp here */ 2445 rtcache_unref(rt, ro); 2446 ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts, 2447 ro, 2448 o_flgs, 2449 ((struct in6pcb *)inp)->in6p_moptions, 2450 (struct in6pcb *)inp, 2451 &ifp); 2452 if (net) { 2453 /* for link local this must be done */ 2454 sin6->sin6_scope_id = prev_scope; 2455 sin6->sin6_port = prev_port; 2456 } 2457 #ifdef SCTP_DEBUG 2458 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2459 printf("return from send is %d\n", ret); 2460 } 2461 #endif /* SCTP_DEBUG_OUTPUT */ 2462 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 2463 if (net) { 2464 /* PMTU check versus smallest asoc MTU goes here */ 2465 rt = rtcache_validate(ro); 2466 if (rt == NULL) { 2467 /* Route was freed */ 2468 net->src_addr_selected = 0; 2469 } 2470 if (rt != NULL) { 2471 if (rt->rt_rmx.rmx_mtu && 2472 (stcb->asoc.smallest_mtu > rt->rt_rmx.rmx_mtu)) { 2473 sctp_mtu_size_reset(inp, 2474 &stcb->asoc, 2475 rt->rt_rmx.rmx_mtu); 2476 } 2477 rtcache_unref(rt, ro); 2478 } else if (ifp) { 2479 if (ifp->if_mtu && 2480 (stcb->asoc.smallest_mtu > ifp->if_mtu)) { 2481 sctp_mtu_size_reset(inp, 2482 &stcb->asoc, 2483 ifp->if_mtu); 2484 } 2485 } 2486 } 2487 return (ret); 2488 } 2489 #endif 2490 else { 2491 #ifdef SCTP_DEBUG 2492 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2493 printf("Unknown protocol (TSNH) type %d\n", ((const struct sockaddr *)to)->sa_family); 2494 } 2495 #endif 2496 sctp_m_freem(m); 2497 return (EFAULT); 2498 } 2499 } 2500 2501 static 2502 int sctp_is_address_in_scope(struct ifaddr *ifa, 2503 int ipv4_addr_legal, 2504 int ipv6_addr_legal, 2505 int loopback_scope, 2506 int ipv4_local_scope, 2507 int local_scope, 2508 int site_scope) 2509 { 2510 if ((loopback_scope == 0) && (ifa->ifa_ifp->if_type == IFT_LOOP)) { 2511 /* skip loopback if not in scope * 2512 */ 2513 return (0); 2514 } 2515 if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) { 2516 struct sockaddr_in *sin; 2517 sin = (struct sockaddr_in *)ifa->ifa_addr; 2518 if (sin->sin_addr.s_addr == 0) { 2519 /* not in scope , unspecified */ 2520 return (0); 2521 } 2522 if ((ipv4_local_scope == 0) && 2523 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 2524 /* private address not in scope */ 2525 return (0); 2526 } 2527 } else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) { 2528 struct sockaddr_in6 *sin6; 2529 struct in6_ifaddr *ifa6; 2530 2531 ifa6 = (struct in6_ifaddr *)ifa; 2532 /* ok to use deprecated addresses? */ 2533 if (!ip6_use_deprecated) { 2534 if (ifa6->ia6_flags & 2535 IN6_IFF_DEPRECATED) { 2536 return (0); 2537 } 2538 } 2539 if (ifa6->ia6_flags & 2540 (IN6_IFF_DETACHED | 2541 IN6_IFF_ANYCAST | 2542 IN6_IFF_NOTREADY)) { 2543 return (0); 2544 } 2545 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 2546 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 2547 /* skip unspecifed addresses */ 2548 return (0); 2549 } 2550 if (/*(local_scope == 0) && */ 2551 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) { 2552 return (0); 2553 } 2554 if ((site_scope == 0) && 2555 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 2556 return (0); 2557 } 2558 } else { 2559 return (0); 2560 } 2561 return (1); 2562 } 2563 2564 2565 void 2566 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 2567 { 2568 struct mbuf *m, *m_at, *m_last; 2569 struct sctp_nets *net; 2570 struct sctp_init_msg *initm; 2571 struct sctp_supported_addr_param *sup_addr; 2572 struct sctp_ecn_supported_param *ecn; 2573 struct sctp_prsctp_supported_param *prsctp; 2574 struct sctp_ecn_nonce_supported_param *ecn_nonce; 2575 struct sctp_supported_chunk_types_param *pr_supported; 2576 int cnt_inits_to=0; 2577 int padval, ret; 2578 2579 /* INIT's always go to the primary (and usually ONLY address) */ 2580 m_last = NULL; 2581 net = stcb->asoc.primary_destination; 2582 if (net == NULL) { 2583 net = TAILQ_FIRST(&stcb->asoc.nets); 2584 if (net == NULL) { 2585 /* TSNH */ 2586 return; 2587 } 2588 /* we confirm any address we send an INIT to */ 2589 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2590 sctp_set_primary_addr(stcb, NULL, net); 2591 } else { 2592 /* we confirm any address we send an INIT to */ 2593 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2594 } 2595 #ifdef SCTP_DEBUG 2596 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2597 printf("Sending INIT to "); 2598 sctp_print_address (rtcache_getdst(&net->ro)); 2599 } 2600 #endif 2601 if (rtcache_getdst(&net->ro)->sa_family == AF_INET6) { 2602 /* special hook, if we are sending to link local 2603 * it will not show up in our private address count. 2604 */ 2605 if (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr *) rtcache_getdst(&net->ro)->sa_data)) 2606 cnt_inits_to = 1; 2607 } 2608 if (callout_pending(&net->rxt_timer.timer)) { 2609 /* This case should not happen */ 2610 return; 2611 } 2612 /* start the INIT timer */ 2613 if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) { 2614 /* we are hosed since I can't start the INIT timer? */ 2615 return; 2616 } 2617 MGETHDR(m, M_DONTWAIT, MT_HEADER); 2618 if (m == NULL) { 2619 /* No memory, INIT timer will re-attempt. */ 2620 return; 2621 } 2622 /* make it into a M_EXT */ 2623 MCLGET(m, M_DONTWAIT); 2624 if ((m->m_flags & M_EXT) != M_EXT) { 2625 /* Failed to get cluster buffer */ 2626 sctp_m_freem(m); 2627 return; 2628 } 2629 m->m_data += SCTP_MIN_OVERHEAD; 2630 m->m_len = sizeof(struct sctp_init_msg); 2631 /* Now lets put the SCTP header in place */ 2632 initm = mtod(m, struct sctp_init_msg *); 2633 initm->sh.src_port = inp->sctp_lport; 2634 initm->sh.dest_port = stcb->rport; 2635 initm->sh.v_tag = 0; 2636 initm->sh.checksum = 0; /* calculate later */ 2637 /* now the chunk header */ 2638 initm->msg.ch.chunk_type = SCTP_INITIATION; 2639 initm->msg.ch.chunk_flags = 0; 2640 /* fill in later from mbuf we build */ 2641 initm->msg.ch.chunk_length = 0; 2642 /* place in my tag */ 2643 initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag); 2644 /* set up some of the credits. */ 2645 initm->msg.init.a_rwnd = htonl(uimax(inp->sctp_socket->so_rcv.sb_hiwat, 2646 SCTP_MINIMAL_RWND)); 2647 2648 initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 2649 initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 2650 initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number); 2651 /* now the address restriction */ 2652 sup_addr = (struct sctp_supported_addr_param *)((vaddr_t)initm + 2653 sizeof(*initm)); 2654 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 2655 /* we support 2 types IPv6/IPv4 */ 2656 sup_addr->ph.param_length = htons(sizeof(*sup_addr) + 2657 sizeof(uint16_t)); 2658 sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS); 2659 sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS); 2660 m->m_len += sizeof(*sup_addr) + sizeof(uint16_t); 2661 2662 /* if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/ 2663 if (inp->sctp_ep.adaption_layer_indicator) { 2664 struct sctp_adaption_layer_indication *ali; 2665 ali = (struct sctp_adaption_layer_indication *)( 2666 (vaddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t)); 2667 ali->ph.param_type = htons(SCTP_ULP_ADAPTION); 2668 ali->ph.param_length = htons(sizeof(*ali)); 2669 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator); 2670 m->m_len += sizeof(*ali); 2671 ecn = (struct sctp_ecn_supported_param *)((vaddr_t)ali + 2672 sizeof(*ali)); 2673 } else { 2674 ecn = (struct sctp_ecn_supported_param *)((vaddr_t)sup_addr + 2675 sizeof(*sup_addr) + sizeof(uint16_t)); 2676 } 2677 2678 /* now any cookie time extensions */ 2679 if (stcb->asoc.cookie_preserve_req) { 2680 struct sctp_cookie_perserve_param *cookie_preserve; 2681 cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn); 2682 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 2683 cookie_preserve->ph.param_length = htons( 2684 sizeof(*cookie_preserve)); 2685 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 2686 m->m_len += sizeof(*cookie_preserve); 2687 ecn = (struct sctp_ecn_supported_param *)( 2688 (vaddr_t)cookie_preserve + sizeof(*cookie_preserve)); 2689 stcb->asoc.cookie_preserve_req = 0; 2690 } 2691 2692 /* ECN parameter */ 2693 if (sctp_ecn == 1) { 2694 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE); 2695 ecn->ph.param_length = htons(sizeof(*ecn)); 2696 m->m_len += sizeof(*ecn); 2697 prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn + 2698 sizeof(*ecn)); 2699 } else { 2700 prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn); 2701 } 2702 /* And now tell the peer we do pr-sctp */ 2703 prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED); 2704 prsctp->ph.param_length = htons(sizeof(*prsctp)); 2705 m->m_len += sizeof(*prsctp); 2706 2707 2708 /* And now tell the peer we do all the extensions */ 2709 pr_supported = (struct sctp_supported_chunk_types_param *)((vaddr_t)prsctp + 2710 sizeof(*prsctp)); 2711 2712 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 2713 pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT); 2714 pr_supported->chunk_types[0] = SCTP_ASCONF; 2715 pr_supported->chunk_types[1] = SCTP_ASCONF_ACK; 2716 pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN; 2717 pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED; 2718 pr_supported->chunk_types[4] = SCTP_STREAM_RESET; 2719 pr_supported->chunk_types[5] = 0; /* pad */ 2720 pr_supported->chunk_types[6] = 0; /* pad */ 2721 pr_supported->chunk_types[7] = 0; /* pad */ 2722 2723 m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT); 2724 /* ECN nonce: And now tell the peer we support ECN nonce */ 2725 2726 if (sctp_ecn_nonce) { 2727 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((vaddr_t)pr_supported + 2728 sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT); 2729 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED); 2730 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce)); 2731 m->m_len += sizeof(*ecn_nonce); 2732 } 2733 2734 m_at = m; 2735 /* now the addresses */ 2736 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 2737 struct ifnet *ifn; 2738 struct ifaddr *ifa; 2739 int cnt; 2740 int s; 2741 2742 cnt = cnt_inits_to; 2743 s = pserialize_read_enter(); 2744 IFNET_READER_FOREACH(ifn) { 2745 if ((stcb->asoc.loopback_scope == 0) && 2746 (ifn->if_type == IFT_LOOP)) { 2747 /* 2748 * Skip loopback devices if loopback_scope 2749 * not set 2750 */ 2751 continue; 2752 } 2753 IFADDR_READER_FOREACH(ifa, ifn) { 2754 if (sctp_is_address_in_scope(ifa, 2755 stcb->asoc.ipv4_addr_legal, 2756 stcb->asoc.ipv6_addr_legal, 2757 stcb->asoc.loopback_scope, 2758 stcb->asoc.ipv4_local_scope, 2759 stcb->asoc.local_scope, 2760 stcb->asoc.site_scope) == 0) { 2761 continue; 2762 } 2763 cnt++; 2764 } 2765 } 2766 pserialize_read_exit(s); 2767 2768 if (cnt > 1) { 2769 s = pserialize_read_enter(); 2770 IFNET_READER_FOREACH(ifn) { 2771 if ((stcb->asoc.loopback_scope == 0) && 2772 (ifn->if_type == IFT_LOOP)) { 2773 /* 2774 * Skip loopback devices if loopback_scope 2775 * not set 2776 */ 2777 continue; 2778 } 2779 IFADDR_READER_FOREACH(ifa, ifn) { 2780 if (sctp_is_address_in_scope(ifa, 2781 stcb->asoc.ipv4_addr_legal, 2782 stcb->asoc.ipv6_addr_legal, 2783 stcb->asoc.loopback_scope, 2784 stcb->asoc.ipv4_local_scope, 2785 stcb->asoc.local_scope, 2786 stcb->asoc.site_scope) == 0) { 2787 continue; 2788 } 2789 m_at = sctp_add_addr_to_mbuf(m_at, ifa); 2790 } 2791 } 2792 pserialize_read_exit(s); 2793 } 2794 } else { 2795 struct sctp_laddr *laddr; 2796 int cnt; 2797 cnt = cnt_inits_to; 2798 /* First, how many ? */ 2799 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2800 if (laddr->ifa == NULL) { 2801 continue; 2802 } 2803 if (laddr->ifa->ifa_addr == NULL) 2804 continue; 2805 if (sctp_is_address_in_scope(laddr->ifa, 2806 stcb->asoc.ipv4_addr_legal, 2807 stcb->asoc.ipv6_addr_legal, 2808 stcb->asoc.loopback_scope, 2809 stcb->asoc.ipv4_local_scope, 2810 stcb->asoc.local_scope, 2811 stcb->asoc.site_scope) == 0) { 2812 continue; 2813 } 2814 cnt++; 2815 } 2816 /* To get through a NAT we only list addresses if 2817 * we have more than one. That way if you just 2818 * bind a single address we let the source of the init 2819 * dictate our address. 2820 */ 2821 if (cnt > 1) { 2822 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2823 if (laddr->ifa == NULL) { 2824 continue; 2825 } 2826 if (laddr->ifa->ifa_addr == NULL) { 2827 continue; 2828 } 2829 2830 if (sctp_is_address_in_scope(laddr->ifa, 2831 stcb->asoc.ipv4_addr_legal, 2832 stcb->asoc.ipv6_addr_legal, 2833 stcb->asoc.loopback_scope, 2834 stcb->asoc.ipv4_local_scope, 2835 stcb->asoc.local_scope, 2836 stcb->asoc.site_scope) == 0) { 2837 continue; 2838 } 2839 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa); 2840 } 2841 } 2842 } 2843 /* calulate the size and update pkt header and chunk header */ 2844 m->m_pkthdr.len = 0; 2845 for (m_at = m; m_at; m_at = m_at->m_next) { 2846 if (m_at->m_next == NULL) 2847 m_last = m_at; 2848 m->m_pkthdr.len += m_at->m_len; 2849 } 2850 initm->msg.ch.chunk_length = htons((m->m_pkthdr.len - 2851 sizeof(struct sctphdr))); 2852 #ifdef SCTP_DEBUG 2853 printf("chunk_length %d\n", ntohs(initm->msg.ch.chunk_length)); 2854 #endif 2855 /* We pass 0 here to NOT set IP_DF if its IPv4, we 2856 * ignore the return here since the timer will drive 2857 * a retranmission. 2858 */ 2859 2860 /* I don't expect this to execute but we will be safe here */ 2861 padval = m->m_pkthdr.len % 4; 2862 if ((padval) && (m_last)) { 2863 /* The compiler worries that m_last may not be 2864 * set even though I think it is impossible :-> 2865 * however we add m_last here just in case. 2866 */ 2867 ret = sctp_add_pad_tombuf(m_last, (4-padval)); 2868 if (ret) { 2869 /* Houston we have a problem, no space */ 2870 sctp_m_freem(m); 2871 return; 2872 } 2873 m->m_pkthdr.len += padval; 2874 } 2875 #ifdef SCTP_DEBUG 2876 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2877 printf("Calling lowlevel output stcb:%p net:%p\n", 2878 stcb, net); 2879 } 2880 #endif 2881 ret = sctp_lowlevel_chunk_output(inp, stcb, net, 2882 rtcache_getdst(&net->ro), m, 0, 0, NULL, 0); 2883 #ifdef SCTP_DEBUG 2884 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2885 printf("Low level output returns %d\n", ret); 2886 } 2887 #endif 2888 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 2889 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 2890 } 2891 2892 struct mbuf * 2893 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 2894 int param_offset, int *abort_processing, struct sctp_chunkhdr *cp) 2895 { 2896 /* Given a mbuf containing an INIT or INIT-ACK 2897 * with the param_offset being equal to the 2898 * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg) 2899 * parse through the parameters to the end of the mbuf verifying 2900 * that all parameters are known. 2901 * 2902 * For unknown parameters build and return a mbuf with 2903 * UNRECOGNIZED_PARAMETER errors. If the flags indicate 2904 * to stop processing this chunk stop, and set *abort_processing 2905 * to 1. 2906 * 2907 * By having param_offset be pre-set to where parameters begin 2908 * it is hoped that this routine may be reused in the future 2909 * by new features. 2910 */ 2911 struct sctp_paramhdr *phdr, params; 2912 2913 struct mbuf *mat, *op_err; 2914 char tempbuf[2048]; 2915 int at, limit, pad_needed; 2916 uint16_t ptype, plen; 2917 int err_at; 2918 2919 *abort_processing = 0; 2920 mat = in_initpkt; 2921 err_at = 0; 2922 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 2923 #ifdef SCTP_DEBUG 2924 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2925 printf("Limit is %d bytes\n", limit); 2926 } 2927 #endif 2928 at = param_offset; 2929 op_err = NULL; 2930 2931 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 2932 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 2933 ptype = ntohs(phdr->param_type); 2934 plen = ntohs(phdr->param_length); 2935 limit -= SCTP_SIZE32(plen); 2936 if (plen < sizeof(struct sctp_paramhdr)) { 2937 #ifdef SCTP_DEBUG 2938 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2939 printf("sctp_output.c:Impossible length in parameter < %d\n", plen); 2940 } 2941 #endif 2942 *abort_processing = 1; 2943 break; 2944 } 2945 /* All parameters for all chunks that we 2946 * know/understand are listed here. We process 2947 * them other places and make appropriate 2948 * stop actions per the upper bits. However 2949 * this is the generic routine processor's can 2950 * call to get back an operr.. to either incorporate (init-ack) 2951 * or send. 2952 */ 2953 if ((ptype == SCTP_HEARTBEAT_INFO) || 2954 (ptype == SCTP_IPV4_ADDRESS) || 2955 (ptype == SCTP_IPV6_ADDRESS) || 2956 (ptype == SCTP_STATE_COOKIE) || 2957 (ptype == SCTP_UNRECOG_PARAM) || 2958 (ptype == SCTP_COOKIE_PRESERVE) || 2959 (ptype == SCTP_SUPPORTED_ADDRTYPE) || 2960 (ptype == SCTP_PRSCTP_SUPPORTED) || 2961 (ptype == SCTP_ADD_IP_ADDRESS) || 2962 (ptype == SCTP_DEL_IP_ADDRESS) || 2963 (ptype == SCTP_ECN_CAPABLE) || 2964 (ptype == SCTP_ULP_ADAPTION) || 2965 (ptype == SCTP_ERROR_CAUSE_IND) || 2966 (ptype == SCTP_SET_PRIM_ADDR) || 2967 (ptype == SCTP_SUCCESS_REPORT) || 2968 (ptype == SCTP_ULP_ADAPTION) || 2969 (ptype == SCTP_SUPPORTED_CHUNK_EXT) || 2970 (ptype == SCTP_ECN_NONCE_SUPPORTED) 2971 ) { 2972 /* no skip it */ 2973 at += SCTP_SIZE32(plen); 2974 } else if (ptype == SCTP_HOSTNAME_ADDRESS) { 2975 /* We can NOT handle HOST NAME addresses!! */ 2976 #ifdef SCTP_DEBUG 2977 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2978 printf("Can't handle hostname addresses.. abort processing\n"); 2979 } 2980 #endif 2981 *abort_processing = 1; 2982 if (op_err == NULL) { 2983 /* Ok need to try to get a mbuf */ 2984 MGETHDR(op_err, M_DONTWAIT, MT_DATA); 2985 if (op_err) { 2986 op_err->m_len = 0; 2987 op_err->m_pkthdr.len = 0; 2988 /* pre-reserve space for ip and sctp header and chunk hdr*/ 2989 op_err->m_data += sizeof(struct ip6_hdr); 2990 op_err->m_data += sizeof(struct sctphdr); 2991 op_err->m_data += sizeof(struct sctp_chunkhdr); 2992 } 2993 } 2994 if (op_err) { 2995 /* If we have space */ 2996 struct sctp_paramhdr s; 2997 if (err_at % 4) { 2998 u_int32_t cpthis=0; 2999 pad_needed = 4 - (err_at % 4); 3000 m_copyback(op_err, err_at, pad_needed, (void *)&cpthis); 3001 err_at += pad_needed; 3002 } 3003 s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR); 3004 s.param_length = htons(sizeof(s) + plen); 3005 m_copyback(op_err, err_at, sizeof(s), (void *)&s); 3006 err_at += sizeof(s); 3007 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen); 3008 if (phdr == NULL) { 3009 sctp_m_freem(op_err); 3010 /* we are out of memory but we 3011 * still need to have a look at what to 3012 * do (the system is in trouble though). 3013 */ 3014 return (NULL); 3015 } 3016 m_copyback(op_err, err_at, plen, (void *)phdr); 3017 err_at += plen; 3018 } 3019 return (op_err); 3020 } else { 3021 /* we do not recognize the parameter 3022 * figure out what we do. 3023 */ 3024 #ifdef SCTP_DEBUG 3025 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 3026 printf("Got parameter type %x - unknown\n", 3027 (u_int)ptype); 3028 } 3029 #endif 3030 if ((ptype & 0x4000) == 0x4000) { 3031 /* Report bit is set?? */ 3032 #ifdef SCTP_DEBUG 3033 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 3034 printf("Report bit is set\n"); 3035 } 3036 #endif 3037 if (op_err == NULL) { 3038 /* Ok need to try to get an mbuf */ 3039 MGETHDR(op_err, M_DONTWAIT, MT_DATA); 3040 if (op_err) { 3041 op_err->m_len = 0; 3042 op_err->m_pkthdr.len = 0; 3043 op_err->m_data += sizeof(struct ip6_hdr); 3044 op_err->m_data += sizeof(struct sctphdr); 3045 op_err->m_data += sizeof(struct sctp_chunkhdr); 3046 } 3047 } 3048 if (op_err) { 3049 /* If we have space */ 3050 struct sctp_paramhdr s; 3051 if (err_at % 4) { 3052 u_int32_t cpthis=0; 3053 pad_needed = 4 - (err_at % 4); 3054 m_copyback(op_err, err_at, pad_needed, (void *)&cpthis); 3055 err_at += pad_needed; 3056 } 3057 s.param_type = htons(SCTP_UNRECOG_PARAM); 3058 s.param_length = htons(sizeof(s) + plen); 3059 m_copyback(op_err, err_at, sizeof(s), (void *)&s); 3060 err_at += sizeof(s); 3061 if (plen > sizeof(tempbuf)) { 3062 plen = sizeof(tempbuf); 3063 } 3064 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen); 3065 if (phdr == NULL) { 3066 sctp_m_freem(op_err); 3067 /* we are out of memory but we 3068 * still need to have a look at what to 3069 * do (the system is in trouble though). 3070 */ 3071 goto more_processing; 3072 } 3073 m_copyback(op_err, err_at, plen, (void *)phdr); 3074 err_at += plen; 3075 } 3076 } 3077 more_processing: 3078 if ((ptype & 0x8000) == 0x0000) { 3079 #ifdef SCTP_DEBUG 3080 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 3081 printf("Abort bit is now setting1\n"); 3082 } 3083 #endif 3084 return (op_err); 3085 } else { 3086 /* skip this chunk and continue processing */ 3087 at += SCTP_SIZE32(plen); 3088 } 3089 3090 } 3091 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 3092 } 3093 return (op_err); 3094 } 3095 3096 static int 3097 sctp_are_there_new_addresses(struct sctp_association *asoc, 3098 struct mbuf *in_initpkt, int iphlen, int offset) 3099 { 3100 /* 3101 * Given a INIT packet, look through the packet to verify that 3102 * there are NO new addresses. As we go through the parameters 3103 * add reports of any un-understood parameters that require an 3104 * error. Also we must return (1) to drop the packet if we see 3105 * a un-understood parameter that tells us to drop the chunk. 3106 */ 3107 struct sockaddr_in sin4, *sa4; 3108 struct sockaddr_in6 sin6, *sa6; 3109 struct sockaddr *sa_touse; 3110 struct sockaddr *sa; 3111 struct sctp_paramhdr *phdr, params; 3112 struct ip *iph; 3113 struct mbuf *mat; 3114 uint16_t ptype, plen; 3115 uint8_t fnd; 3116 struct sctp_nets *net; 3117 3118 memset(&sin4, 0, sizeof(sin4)); 3119 memset(&sin6, 0, sizeof(sin6)); 3120 sin4.sin_family = AF_INET; 3121 sin4.sin_len = sizeof(sin4); 3122 sin6.sin6_family = AF_INET6; 3123 sin6.sin6_len = sizeof(sin6); 3124 3125 sa_touse = NULL; 3126 /* First what about the src address of the pkt ? */ 3127 iph = mtod(in_initpkt, struct ip *); 3128 if (iph->ip_v == IPVERSION) { 3129 /* source addr is IPv4 */ 3130 sin4.sin_addr = iph->ip_src; 3131 sa_touse = (struct sockaddr *)&sin4; 3132 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 3133 /* source addr is IPv6 */ 3134 struct ip6_hdr *ip6h; 3135 ip6h = mtod(in_initpkt, struct ip6_hdr *); 3136 sin6.sin6_addr = ip6h->ip6_src; 3137 sa_touse = (struct sockaddr *)&sin6; 3138 } else { 3139 return (1); 3140 } 3141 3142 fnd = 0; 3143 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3144 sa = (struct sockaddr *)&net->ro.ro_sa; 3145 if (sa->sa_family == sa_touse->sa_family) { 3146 if (sa->sa_family == AF_INET) { 3147 sa4 = (struct sockaddr_in *)sa; 3148 if (sa4->sin_addr.s_addr == 3149 sin4.sin_addr.s_addr) { 3150 fnd = 1; 3151 break; 3152 } 3153 } else if (sa->sa_family == AF_INET6) { 3154 sa6 = (struct sockaddr_in6 *)sa; 3155 if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr, 3156 &sin6.sin6_addr)) { 3157 fnd = 1; 3158 break; 3159 } 3160 } 3161 } 3162 } 3163 if (fnd == 0) { 3164 /* New address added! no need to look further. */ 3165 return (1); 3166 } 3167 /* Ok so far lets munge through the rest of the packet */ 3168 mat = in_initpkt; 3169 sa_touse = NULL; 3170 offset += sizeof(struct sctp_init_chunk); 3171 phdr = sctp_get_next_param(mat, offset, ¶ms, sizeof(params)); 3172 while (phdr) { 3173 ptype = ntohs(phdr->param_type); 3174 plen = ntohs(phdr->param_length); 3175 if (ptype == SCTP_IPV4_ADDRESS) { 3176 struct sctp_ipv4addr_param *p4, p4_buf; 3177 3178 phdr = sctp_get_next_param(mat, offset, 3179 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 3180 if (plen != sizeof(struct sctp_ipv4addr_param) || 3181 phdr == NULL) { 3182 return (1); 3183 } 3184 p4 = (struct sctp_ipv4addr_param *)phdr; 3185 sin4.sin_addr.s_addr = p4->addr; 3186 sa_touse = (struct sockaddr *)&sin4; 3187 } else if (ptype == SCTP_IPV6_ADDRESS) { 3188 struct sctp_ipv6addr_param *p6, p6_buf; 3189 3190 phdr = sctp_get_next_param(mat, offset, 3191 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 3192 if (plen != sizeof(struct sctp_ipv6addr_param) || 3193 phdr == NULL) { 3194 return (1); 3195 } 3196 p6 = (struct sctp_ipv6addr_param *)phdr; 3197 memcpy((void *)&sin6.sin6_addr, p6->addr, 3198 sizeof(p6->addr)); 3199 sa_touse = (struct sockaddr *)&sin4; 3200 } 3201 3202 if (sa_touse) { 3203 /* ok, sa_touse points to one to check */ 3204 fnd = 0; 3205 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3206 sa = (struct sockaddr *)&net->ro.ro_sa; 3207 if (sa->sa_family != sa_touse->sa_family) { 3208 continue; 3209 } 3210 if (sa->sa_family == AF_INET) { 3211 sa4 = (struct sockaddr_in *)sa; 3212 if (sa4->sin_addr.s_addr == 3213 sin4.sin_addr.s_addr) { 3214 fnd = 1; 3215 break; 3216 } 3217 } else if (sa->sa_family == AF_INET6) { 3218 sa6 = (struct sockaddr_in6 *)sa; 3219 if (SCTP6_ARE_ADDR_EQUAL( 3220 &sa6->sin6_addr, &sin6.sin6_addr)) { 3221 fnd = 1; 3222 break; 3223 } 3224 } 3225 } 3226 if (!fnd) { 3227 /* New addr added! no need to look further */ 3228 return (1); 3229 } 3230 } 3231 offset += SCTP_SIZE32(plen); 3232 phdr = sctp_get_next_param(mat, offset, ¶ms, sizeof(params)); 3233 } 3234 return (0); 3235 } 3236 3237 /* 3238 * Given a MBUF chain that was sent into us containing an 3239 * INIT. Build a INIT-ACK with COOKIE and send back. 3240 * We assume that the in_initpkt has done a pullup to 3241 * include IPv6/4header, SCTP header and initial part of 3242 * INIT message (i.e. the struct sctp_init_msg). 3243 */ 3244 void 3245 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 3246 struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh, 3247 struct sctp_init_chunk *init_chk) 3248 { 3249 struct sctp_association *asoc; 3250 struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last; 3251 struct sctp_init_msg *initackm_out; 3252 struct sctp_ecn_supported_param *ecn; 3253 struct sctp_prsctp_supported_param *prsctp; 3254 struct sctp_ecn_nonce_supported_param *ecn_nonce; 3255 struct sctp_supported_chunk_types_param *pr_supported; 3256 struct sockaddr_storage store; 3257 struct sockaddr_in *sin; 3258 struct sockaddr_in6 *sin6; 3259 struct route *ro; 3260 struct ip *iph; 3261 struct ip6_hdr *ip6; 3262 const struct sockaddr *to; 3263 struct sctp_state_cookie stc; 3264 struct sctp_nets *net=NULL; 3265 int cnt_inits_to=0; 3266 uint16_t his_limit, i_want; 3267 int abort_flag, padval, sz_of; 3268 struct rtentry *rt; 3269 3270 if (stcb) { 3271 asoc = &stcb->asoc; 3272 } else { 3273 asoc = NULL; 3274 } 3275 m_last = NULL; 3276 if ((asoc != NULL) && 3277 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) && 3278 (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) { 3279 /* new addresses, out of here in non-cookie-wait states */ 3280 /* 3281 * Send a ABORT, we don't add the new address error clause though 3282 * we even set the T bit and copy in the 0 tag.. this looks no 3283 * different than if no listner was present. 3284 */ 3285 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL); 3286 return; 3287 } 3288 abort_flag = 0; 3289 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 3290 (offset+sizeof(struct sctp_init_chunk)), 3291 &abort_flag, (struct sctp_chunkhdr *)init_chk); 3292 if (abort_flag) { 3293 sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err); 3294 return; 3295 } 3296 MGETHDR(m, M_DONTWAIT, MT_HEADER); 3297 if (m == NULL) { 3298 /* No memory, INIT timer will re-attempt. */ 3299 if (op_err) 3300 sctp_m_freem(op_err); 3301 return; 3302 } 3303 MCLGET(m, M_DONTWAIT); 3304 if ((m->m_flags & M_EXT) != M_EXT) { 3305 /* Failed to get cluster buffer */ 3306 if (op_err) 3307 sctp_m_freem(op_err); 3308 sctp_m_freem(m); 3309 return; 3310 } 3311 m->m_data += SCTP_MIN_OVERHEAD; 3312 m_reset_rcvif(m); 3313 m->m_len = sizeof(struct sctp_init_msg); 3314 3315 /* the time I built cookie */ 3316 SCTP_GETTIME_TIMEVAL(&stc.time_entered); 3317 3318 /* populate any tie tags */ 3319 if (asoc != NULL) { 3320 /* unlock before tag selections */ 3321 SCTP_TCB_UNLOCK(stcb); 3322 if (asoc->my_vtag_nonce == 0) 3323 asoc->my_vtag_nonce = sctp_select_a_tag(inp); 3324 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 3325 3326 if (asoc->peer_vtag_nonce == 0) 3327 asoc->peer_vtag_nonce = sctp_select_a_tag(inp); 3328 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 3329 3330 stc.cookie_life = asoc->cookie_life; 3331 net = asoc->primary_destination; 3332 /* now we must relock */ 3333 SCTP_INP_RLOCK(inp); 3334 /* we may be in trouble here if the inp got freed 3335 * most likely this set of tests will protect 3336 * us but there is a chance not. 3337 */ 3338 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 3339 if (op_err) 3340 sctp_m_freem(op_err); 3341 sctp_m_freem(m); 3342 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL); 3343 return; 3344 } 3345 SCTP_TCB_LOCK(stcb); 3346 SCTP_INP_RUNLOCK(stcb->sctp_ep); 3347 } else { 3348 stc.tie_tag_my_vtag = 0; 3349 stc.tie_tag_peer_vtag = 0; 3350 /* life I will award this cookie */ 3351 stc.cookie_life = inp->sctp_ep.def_cookie_life; 3352 } 3353 3354 /* copy in the ports for later check */ 3355 stc.myport = sh->dest_port; 3356 stc.peerport = sh->src_port; 3357 3358 /* 3359 * If we wanted to honor cookie life extensions, we would add 3360 * to stc.cookie_life. For now we should NOT honor any extension 3361 */ 3362 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 3363 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 3364 struct inpcb *in_inp; 3365 /* Its a V6 socket */ 3366 in_inp = (struct inpcb *)inp; 3367 stc.ipv6_addr_legal = 1; 3368 /* Now look at the binding flag to see if V4 will be legal */ 3369 if ( 3370 #if defined(__FreeBSD__) || defined(__APPLE__) 3371 (in_inp->inp_flags & IN6P_IPV6_V6ONLY) 3372 #elif defined(__OpenBSD__) 3373 (0) /* For openbsd we do dual bind only */ 3374 #else 3375 (((struct in6pcb *)in_inp)->in6p_flags & IN6P_IPV6_V6ONLY) 3376 #endif 3377 == 0) { 3378 stc.ipv4_addr_legal = 1; 3379 } else { 3380 /* V4 addresses are NOT legal on the association */ 3381 stc.ipv4_addr_legal = 0; 3382 } 3383 } else { 3384 /* Its a V4 socket, no - V6 */ 3385 stc.ipv4_addr_legal = 1; 3386 stc.ipv6_addr_legal = 0; 3387 } 3388 3389 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE 3390 stc.ipv4_scope = 1; 3391 #else 3392 stc.ipv4_scope = 0; 3393 #endif 3394 /* now for scope setup */ 3395 memset((void *)&store, 0, sizeof(store)); 3396 sin = (struct sockaddr_in *)&store; 3397 sin6 = (struct sockaddr_in6 *)&store; 3398 if (net == NULL) { 3399 to = (struct sockaddr *)&store; 3400 iph = mtod(init_pkt, struct ip *); 3401 if (iph->ip_v == IPVERSION) { 3402 struct in_addr addr; 3403 static struct route iproute; 3404 3405 sin->sin_family = AF_INET; 3406 sin->sin_len = sizeof(struct sockaddr_in); 3407 sin->sin_port = sh->src_port; 3408 sin->sin_addr = iph->ip_src; 3409 /* lookup address */ 3410 stc.address[0] = sin->sin_addr.s_addr; 3411 stc.address[1] = 0; 3412 stc.address[2] = 0; 3413 stc.address[3] = 0; 3414 stc.addr_type = SCTP_IPV4_ADDRESS; 3415 /* local from address */ 3416 memset(&iproute, 0, sizeof(iproute)); 3417 ro = &iproute; 3418 3419 /* XXX */ 3420 rt = rtcache_lookup(ro, (struct sockaddr *) sin); 3421 rtcache_unref(rt, ro); 3422 addr = sctp_ipv4_source_address_selection(inp, NULL, 3423 ro, NULL, 0); 3424 stc.laddress[0] = addr.s_addr; 3425 stc.laddress[1] = 0; 3426 stc.laddress[2] = 0; 3427 stc.laddress[3] = 0; 3428 stc.laddr_type = SCTP_IPV4_ADDRESS; 3429 /* scope_id is only for v6 */ 3430 stc.scope_id = 0; 3431 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE 3432 if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) { 3433 stc.ipv4_scope = 1; 3434 } 3435 #else 3436 stc.ipv4_scope = 1; 3437 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */ 3438 /* Must use the address in this case */ 3439 if (sctp_is_address_on_local_host((struct sockaddr *)sin)) { 3440 stc.loopback_scope = 1; 3441 stc.ipv4_scope = 1; 3442 stc.site_scope = 1; 3443 stc.local_scope = 1; 3444 } 3445 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 3446 struct in6_addr addr; 3447 static struct route iproute6; 3448 ip6 = mtod(init_pkt, struct ip6_hdr *); 3449 sin6->sin6_family = AF_INET6; 3450 sin6->sin6_len = sizeof(struct sockaddr_in6); 3451 sin6->sin6_port = sh->src_port; 3452 sin6->sin6_addr = ip6->ip6_src; 3453 /* lookup address */ 3454 memcpy(&stc.address, &sin6->sin6_addr, 3455 sizeof(struct in6_addr)); 3456 sin6->sin6_scope_id = 0; 3457 stc.addr_type = SCTP_IPV6_ADDRESS; 3458 stc.scope_id = 0; 3459 if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) { 3460 stc.loopback_scope = 1; 3461 stc.local_scope = 1; 3462 stc.site_scope = 1; 3463 stc.ipv4_scope = 1; 3464 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 3465 /* 3466 * If the new destination is a LINK_LOCAL 3467 * we must have common both site and local 3468 * scope. Don't set local scope though since 3469 * we must depend on the source to be added 3470 * implicitly. We cannot assure just because 3471 * we share one link that all links are common. 3472 * 3473 * XXX: never treat link-local case explicitly. 3474 * Use general routines defined in scope6.c. 3475 * (jinmei@kame) 3476 */ 3477 stc.local_scope = 0; 3478 stc.site_scope = 1; 3479 stc.ipv4_scope = 1; 3480 /* we start counting for the private 3481 * address stuff at 1. since the link 3482 * local we source from won't show 3483 * up in our scoped count. 3484 */ 3485 cnt_inits_to=1; 3486 /* pull out the scope_id from incoming pkt */ 3487 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) 3488 (void)in6_recoverscope(sin6, &in6_src, 3489 m_get_rcvif_NOMPSAFE(init_pkt)); 3490 in6_embedscope(&sin6->sin6_addr, sin6, NULL, 3491 NULL); 3492 #else 3493 (void)sa6_recoverscope(sin6); 3494 #endif 3495 stc.scope_id = sin6->sin6_scope_id; 3496 3497 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) { 3498 /* 3499 * If the new destination is SITE_LOCAL 3500 * then we must have site scope in common. 3501 */ 3502 stc.site_scope = 1; 3503 } 3504 /* local from address */ 3505 memset(&iproute6, 0, sizeof(iproute6)); 3506 ro = (struct route *)&iproute6; 3507 /* XXX */ 3508 rt = rtcache_lookup(ro, (struct sockaddr *) sin6); 3509 rtcache_unref(rt, ro); 3510 addr = sctp_ipv6_source_address_selection(inp, NULL, 3511 ro, NULL, 0); 3512 memcpy(&stc.laddress, &addr, sizeof(struct in6_addr)); 3513 stc.laddr_type = SCTP_IPV6_ADDRESS; 3514 } 3515 } else { 3516 /* set the scope per the existing tcb */ 3517 struct sctp_nets *lnet; 3518 3519 stc.loopback_scope = asoc->loopback_scope; 3520 stc.ipv4_scope = asoc->ipv4_local_scope; 3521 stc.site_scope = asoc->site_scope; 3522 stc.local_scope = asoc->local_scope; 3523 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 3524 if (rtcache_getdst(&lnet->ro)->sa_family == AF_INET6) { 3525 if (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr *) rtcache_getdst(&lnet->ro)->sa_data)) { 3526 /* if we have a LL address, start counting 3527 * at 1. 3528 */ 3529 cnt_inits_to = 1; 3530 } 3531 } 3532 } 3533 3534 /* use the net pointer */ 3535 to = rtcache_getdst(&net->ro); 3536 if (to->sa_family == AF_INET) { 3537 memcpy(&stc.address[0], to, sizeof(struct in_addr)); 3538 stc.address[1] = 0; 3539 stc.address[2] = 0; 3540 stc.address[3] = 0; 3541 stc.addr_type = SCTP_IPV4_ADDRESS; 3542 if (net->src_addr_selected == 0) { 3543 /* strange case here, the INIT 3544 * should have did the selection. 3545 */ 3546 net->_s_addr.sin.sin_addr = 3547 sctp_ipv4_source_address_selection(inp, 3548 stcb, &net->ro, net, 0); 3549 net->src_addr_selected = 1; 3550 3551 } 3552 3553 stc.laddress[0] = net->_s_addr.sin.sin_addr.s_addr; 3554 stc.laddress[1] = 0; 3555 stc.laddress[2] = 0; 3556 stc.laddress[3] = 0; 3557 stc.laddr_type = SCTP_IPV4_ADDRESS; 3558 } else if (to->sa_family == AF_INET6) { 3559 memcpy(&stc.address, &to->sa_data, 3560 sizeof(struct in6_addr)); 3561 stc.addr_type = SCTP_IPV6_ADDRESS; 3562 if (net->src_addr_selected == 0) { 3563 /* strange case here, the INIT 3564 * should have did the selection. 3565 */ 3566 net->_s_addr.sin6.sin6_addr = 3567 sctp_ipv6_source_address_selection(inp, 3568 stcb, &net->ro, net, 0); 3569 net->src_addr_selected = 1; 3570 } 3571 memcpy(&stc.laddress, &net->_s_addr.sin6.sin6_addr, 3572 sizeof(struct in6_addr)); 3573 stc.laddr_type = SCTP_IPV6_ADDRESS; 3574 } 3575 } 3576 /* Now lets put the SCTP header in place */ 3577 initackm_out = mtod(m, struct sctp_init_msg *); 3578 initackm_out->sh.src_port = inp->sctp_lport; 3579 initackm_out->sh.dest_port = sh->src_port; 3580 initackm_out->sh.v_tag = init_chk->init.initiate_tag; 3581 /* Save it off for quick ref */ 3582 stc.peers_vtag = init_chk->init.initiate_tag; 3583 initackm_out->sh.checksum = 0; /* calculate later */ 3584 /* who are we */ 3585 strncpy(stc.identification, SCTP_VERSION_STRING, 3586 uimin(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 3587 /* now the chunk header */ 3588 initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK; 3589 initackm_out->msg.ch.chunk_flags = 0; 3590 /* fill in later from mbuf we build */ 3591 initackm_out->msg.ch.chunk_length = 0; 3592 /* place in my tag */ 3593 if ((asoc != NULL) && 3594 ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 3595 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) { 3596 /* re-use the v-tags and init-seq here */ 3597 initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag); 3598 initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number); 3599 } else { 3600 initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp)); 3601 /* get a TSN to use too */ 3602 initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 3603 } 3604 /* save away my tag to */ 3605 stc.my_vtag = initackm_out->msg.init.initiate_tag; 3606 3607 /* set up some of the credits. */ 3608 initackm_out->msg.init.a_rwnd = htonl(uimax(inp->sctp_socket->so_rcv.sb_hiwat, SCTP_MINIMAL_RWND)); 3609 /* set what I want */ 3610 his_limit = ntohs(init_chk->init.num_inbound_streams); 3611 /* choose what I want */ 3612 if (asoc != NULL) { 3613 if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) { 3614 i_want = asoc->streamoutcnt; 3615 } else { 3616 i_want = inp->sctp_ep.pre_open_stream_count; 3617 } 3618 } else { 3619 i_want = inp->sctp_ep.pre_open_stream_count; 3620 } 3621 if (his_limit < i_want) { 3622 /* I Want more :< */ 3623 initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams; 3624 } else { 3625 /* I can have what I want :> */ 3626 initackm_out->msg.init.num_outbound_streams = htons(i_want); 3627 } 3628 /* tell him his limt. */ 3629 initackm_out->msg.init.num_inbound_streams = 3630 htons(inp->sctp_ep.max_open_streams_intome); 3631 /* setup the ECN pointer */ 3632 3633 /* if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/ 3634 if (inp->sctp_ep.adaption_layer_indicator) { 3635 struct sctp_adaption_layer_indication *ali; 3636 ali = (struct sctp_adaption_layer_indication *)( 3637 (vaddr_t)initackm_out + sizeof(*initackm_out)); 3638 ali->ph.param_type = htons(SCTP_ULP_ADAPTION); 3639 ali->ph.param_length = htons(sizeof(*ali)); 3640 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator); 3641 m->m_len += sizeof(*ali); 3642 ecn = (struct sctp_ecn_supported_param *)((vaddr_t)ali + 3643 sizeof(*ali)); 3644 } else { 3645 ecn = (struct sctp_ecn_supported_param*)( 3646 (vaddr_t)initackm_out + sizeof(*initackm_out)); 3647 } 3648 3649 /* ECN parameter */ 3650 if (sctp_ecn == 1) { 3651 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE); 3652 ecn->ph.param_length = htons(sizeof(*ecn)); 3653 m->m_len += sizeof(*ecn); 3654 3655 prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn + 3656 sizeof(*ecn)); 3657 } else { 3658 prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn); 3659 } 3660 /* And now tell the peer we do pr-sctp */ 3661 prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED); 3662 prsctp->ph.param_length = htons(sizeof(*prsctp)); 3663 m->m_len += sizeof(*prsctp); 3664 3665 3666 /* And now tell the peer we do all the extensions */ 3667 pr_supported = (struct sctp_supported_chunk_types_param *)((vaddr_t)prsctp + 3668 sizeof(*prsctp)); 3669 3670 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 3671 pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT); 3672 pr_supported->chunk_types[0] = SCTP_ASCONF; 3673 pr_supported->chunk_types[1] = SCTP_ASCONF_ACK; 3674 pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN; 3675 pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED; 3676 pr_supported->chunk_types[4] = SCTP_STREAM_RESET; 3677 pr_supported->chunk_types[5] = 0; /* pad */ 3678 pr_supported->chunk_types[6] = 0; /* pad */ 3679 pr_supported->chunk_types[7] = 0; /* pad */ 3680 3681 m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT); 3682 if (sctp_ecn_nonce) { 3683 /* ECN nonce: And now tell the peer we support ECN nonce */ 3684 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((vaddr_t)pr_supported + 3685 sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT); 3686 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED); 3687 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce)); 3688 m->m_len += sizeof(*ecn_nonce); 3689 } 3690 3691 m_at = m; 3692 /* now the addresses */ 3693 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3694 struct ifnet *ifn; 3695 struct ifaddr *ifa; 3696 int cnt = cnt_inits_to; 3697 int s; 3698 3699 s = pserialize_read_enter(); 3700 IFNET_READER_FOREACH(ifn) { 3701 if ((stc.loopback_scope == 0) && 3702 (ifn->if_type == IFT_LOOP)) { 3703 /* 3704 * Skip loopback devices if loopback_scope 3705 * not set 3706 */ 3707 continue; 3708 } 3709 IFADDR_READER_FOREACH(ifa, ifn) { 3710 if (sctp_is_address_in_scope(ifa, 3711 stc.ipv4_addr_legal, stc.ipv6_addr_legal, 3712 stc.loopback_scope, stc.ipv4_scope, 3713 stc.local_scope, stc.site_scope) == 0) { 3714 continue; 3715 } 3716 cnt++; 3717 } 3718 } 3719 pserialize_read_exit(s); 3720 3721 if (cnt > 1) { 3722 s = pserialize_read_enter(); 3723 IFNET_READER_FOREACH(ifn) { 3724 if ((stc.loopback_scope == 0) && 3725 (ifn->if_type == IFT_LOOP)) { 3726 /* 3727 * Skip loopback devices if 3728 * loopback_scope not set 3729 */ 3730 continue; 3731 } 3732 IFADDR_READER_FOREACH(ifa, ifn) { 3733 if (sctp_is_address_in_scope(ifa, 3734 stc.ipv4_addr_legal, 3735 stc.ipv6_addr_legal, 3736 stc.loopback_scope, stc.ipv4_scope, 3737 stc.local_scope, stc.site_scope) == 0) { 3738 continue; 3739 } 3740 m_at = sctp_add_addr_to_mbuf(m_at, ifa); 3741 } 3742 } 3743 pserialize_read_exit(s); 3744 } 3745 } else { 3746 struct sctp_laddr *laddr; 3747 int cnt; 3748 cnt = cnt_inits_to; 3749 /* First, how many ? */ 3750 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3751 if (laddr->ifa == NULL) { 3752 continue; 3753 } 3754 if (laddr->ifa->ifa_addr == NULL) 3755 continue; 3756 if (sctp_is_address_in_scope(laddr->ifa, 3757 stc.ipv4_addr_legal, stc.ipv6_addr_legal, 3758 stc.loopback_scope, stc.ipv4_scope, 3759 stc.local_scope, stc.site_scope) == 0) { 3760 continue; 3761 } 3762 cnt++; 3763 } 3764 /* If we bind a single address only we won't list 3765 * any. This way you can get through a NAT 3766 */ 3767 if (cnt > 1) { 3768 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3769 if (laddr->ifa == NULL) { 3770 #ifdef SCTP_DEBUG 3771 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 3772 printf("Help I have fallen and I can't get up!\n"); 3773 } 3774 #endif 3775 continue; 3776 } 3777 if (laddr->ifa->ifa_addr == NULL) 3778 continue; 3779 if (sctp_is_address_in_scope(laddr->ifa, 3780 stc.ipv4_addr_legal, stc.ipv6_addr_legal, 3781 stc.loopback_scope, stc.ipv4_scope, 3782 stc.local_scope, stc.site_scope) == 0) { 3783 continue; 3784 } 3785 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa); 3786 } 3787 } 3788 } 3789 3790 /* tack on the operational error if present */ 3791 if (op_err) { 3792 if (op_err->m_pkthdr.len % 4) { 3793 /* must add a pad to the param */ 3794 u_int32_t cpthis=0; 3795 int padlen; 3796 padlen = 4 - (op_err->m_pkthdr.len % 4); 3797 m_copyback(op_err, op_err->m_pkthdr.len, padlen, (void *)&cpthis); 3798 } 3799 while (m_at->m_next != NULL) { 3800 m_at = m_at->m_next; 3801 } 3802 m_at->m_next = op_err; 3803 while (m_at->m_next != NULL) { 3804 m_at = m_at->m_next; 3805 } 3806 } 3807 /* Get total size of init packet */ 3808 sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length)); 3809 /* pre-calulate the size and update pkt header and chunk header */ 3810 m->m_pkthdr.len = 0; 3811 for (m_tmp = m; m_tmp; m_tmp = m_tmp->m_next) { 3812 m->m_pkthdr.len += m_tmp->m_len; 3813 if (m_tmp->m_next == NULL) { 3814 /* m_tmp should now point to last one */ 3815 break; 3816 } 3817 } 3818 /* 3819 * Figure now the size of the cookie. We know the size of the 3820 * INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK, 3821 * COOKIE-STRUCTURE and SIGNATURE. 3822 */ 3823 3824 /* 3825 * take our earlier INIT calc and add in the sz we just calculated 3826 * minus the size of the sctphdr (its not included in chunk size 3827 */ 3828 3829 /* add once for the INIT-ACK */ 3830 sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr)); 3831 3832 /* add a second time for the INIT-ACK in the cookie */ 3833 sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr)); 3834 3835 /* Now add the cookie header and cookie message struct */ 3836 sz_of += sizeof(struct sctp_state_cookie_param); 3837 /* ...and add the size of our signature */ 3838 sz_of += SCTP_SIGNATURE_SIZE; 3839 initackm_out->msg.ch.chunk_length = htons(sz_of); 3840 3841 /* Now we must build a cookie */ 3842 m_cookie = sctp_add_cookie(inp, init_pkt, offset, m, 3843 sizeof(struct sctphdr), &stc); 3844 if (m_cookie == NULL) { 3845 /* memory problem */ 3846 sctp_m_freem(m); 3847 return; 3848 } 3849 /* Now append the cookie to the end and update the space/size */ 3850 m_tmp->m_next = m_cookie; 3851 3852 /* 3853 * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the 3854 * return here since the timer will drive a retranmission. 3855 */ 3856 padval = m->m_pkthdr.len % 4; 3857 if ((padval) && (m_last)) { 3858 /* see my previous comments on m_last */ 3859 int ret; 3860 ret = sctp_add_pad_tombuf(m_last, (4-padval)); 3861 if (ret) { 3862 /* Houston we have a problem, no space */ 3863 sctp_m_freem(m); 3864 return; 3865 } 3866 m->m_pkthdr.len += padval; 3867 } 3868 sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, 0, NULL, 0); 3869 } 3870 3871 3872 static void 3873 sctp_insert_on_wheel(struct sctp_association *asoc, 3874 struct sctp_stream_out *strq) 3875 { 3876 struct sctp_stream_out *stre, *strn; 3877 stre = TAILQ_FIRST(&asoc->out_wheel); 3878 if (stre == NULL) { 3879 /* only one on wheel */ 3880 TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke); 3881 return; 3882 } 3883 for (; stre; stre = strn) { 3884 strn = TAILQ_NEXT(stre, next_spoke); 3885 if (stre->stream_no > strq->stream_no) { 3886 TAILQ_INSERT_BEFORE(stre, strq, next_spoke); 3887 return; 3888 } else if (stre->stream_no == strq->stream_no) { 3889 /* huh, should not happen */ 3890 return; 3891 } else if (strn == NULL) { 3892 /* next one is null */ 3893 TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq, 3894 next_spoke); 3895 } 3896 } 3897 } 3898 3899 static void 3900 sctp_remove_from_wheel(struct sctp_association *asoc, 3901 struct sctp_stream_out *strq) 3902 { 3903 /* take off and then setup so we know it is not on the wheel */ 3904 TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke); 3905 strq->next_spoke.tqe_next = NULL; 3906 strq->next_spoke.tqe_prev = NULL; 3907 } 3908 3909 3910 static void 3911 sctp_prune_prsctp(struct sctp_tcb *stcb, 3912 struct sctp_association *asoc, 3913 struct sctp_sndrcvinfo *srcv, 3914 int dataout 3915 ) 3916 { 3917 int freed_spc=0; 3918 struct sctp_tmit_chunk *chk, *nchk; 3919 if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) { 3920 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 3921 /* 3922 * Look for chunks marked with the PR_SCTP 3923 * flag AND the buffer space flag. If the one 3924 * being sent is equal or greater priority then 3925 * purge the old one and free some space. 3926 */ 3927 if ((chk->flags & (SCTP_PR_SCTP_ENABLED | 3928 SCTP_PR_SCTP_BUFFER)) == 3929 (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) { 3930 /* 3931 * This one is PR-SCTP AND buffer space 3932 * limited type 3933 */ 3934 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 3935 /* Lower numbers equates to 3936 * higher priority so if the 3937 * one we are looking at has a 3938 * larger or equal priority we 3939 * want to drop the data and 3940 * NOT retransmit it. 3941 */ 3942 if (chk->data) { 3943 /* We release the 3944 * book_size if the 3945 * mbuf is here 3946 */ 3947 int ret_spc; 3948 int cause; 3949 if (chk->sent > SCTP_DATAGRAM_UNSENT) 3950 cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT; 3951 else 3952 cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT; 3953 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 3954 cause, 3955 &asoc->sent_queue); 3956 freed_spc += ret_spc; 3957 if (freed_spc >= dataout) { 3958 return; 3959 } 3960 } /* if chunk was present */ 3961 } /* if of sufficient priority */ 3962 } /* if chunk has enabled */ 3963 } /* tailqforeach */ 3964 3965 chk = TAILQ_FIRST(&asoc->send_queue); 3966 while (chk) { 3967 nchk = TAILQ_NEXT(chk, sctp_next); 3968 /* Here we must move to the sent queue and mark */ 3969 if ((chk->flags & (SCTP_PR_SCTP_ENABLED | 3970 SCTP_PR_SCTP_BUFFER)) == 3971 (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) { 3972 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 3973 if (chk->data) { 3974 /* We release the 3975 * book_size if the 3976 * mbuf is here 3977 */ 3978 int ret_spc; 3979 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 3980 SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT, 3981 &asoc->send_queue); 3982 3983 freed_spc += ret_spc; 3984 if (freed_spc >= dataout) { 3985 return; 3986 } 3987 } /* end if chk->data */ 3988 } /* end if right class */ 3989 } /* end if chk pr-sctp */ 3990 chk = nchk; 3991 } /* end while (chk) */ 3992 } /* if enabled in asoc */ 3993 } 3994 3995 static void 3996 sctp_prepare_chunk(struct sctp_tmit_chunk *template, 3997 struct sctp_tcb *stcb, 3998 struct sctp_sndrcvinfo *srcv, 3999 struct sctp_stream_out *strq, 4000 struct sctp_nets *net) 4001 { 4002 memset(template, 0, sizeof(struct sctp_tmit_chunk)); 4003 template->sent = SCTP_DATAGRAM_UNSENT; 4004 if ((stcb->asoc.peer_supports_prsctp) && 4005 (srcv->sinfo_flags & (SCTP_PR_SCTP_TTL|SCTP_PR_SCTP_BUF)) && 4006 (srcv->sinfo_timetolive > 0) 4007 ) { 4008 /* If: 4009 * Peer supports PR-SCTP 4010 * The flags is set against this send for PR-SCTP 4011 * And timetolive is a postive value, zero is reserved 4012 * to mean a reliable send for both buffer/time 4013 * related one. 4014 */ 4015 if (srcv->sinfo_flags & SCTP_PR_SCTP_BUF) { 4016 /* 4017 * Time to live is a priority stored in tv_sec 4018 * when doing the buffer drop thing. 4019 */ 4020 template->rec.data.timetodrop.tv_sec = srcv->sinfo_timetolive; 4021 } else { 4022 struct timeval tv; 4023 4024 SCTP_GETTIME_TIMEVAL(&template->rec.data.timetodrop); 4025 tv.tv_sec = srcv->sinfo_timetolive / 1000; 4026 tv.tv_usec = (srcv->sinfo_timetolive * 1000) % 1000000; 4027 #ifndef __FreeBSD__ 4028 timeradd(&template->rec.data.timetodrop, &tv, 4029 &template->rec.data.timetodrop); 4030 #else 4031 timevaladd(&template->rec.data.timetodrop, &tv); 4032 #endif 4033 } 4034 } 4035 if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) { 4036 template->rec.data.stream_seq = strq->next_sequence_sent; 4037 } else { 4038 template->rec.data.stream_seq = 0; 4039 } 4040 template->rec.data.TSN_seq = 0; /* not yet assigned */ 4041 4042 template->rec.data.stream_number = srcv->sinfo_stream; 4043 template->rec.data.payloadtype = srcv->sinfo_ppid; 4044 template->rec.data.context = srcv->sinfo_context; 4045 template->rec.data.doing_fast_retransmit = 0; 4046 template->rec.data.ect_nonce = 0; /* ECN Nonce */ 4047 4048 if (srcv->sinfo_flags & SCTP_ADDR_OVER) { 4049 template->whoTo = net; 4050 } else { 4051 if (stcb->asoc.primary_destination) 4052 template->whoTo = stcb->asoc.primary_destination; 4053 else { 4054 /* TSNH */ 4055 template->whoTo = net; 4056 } 4057 } 4058 /* the actual chunk flags */ 4059 if (srcv->sinfo_flags & SCTP_UNORDERED) { 4060 template->rec.data.rcv_flags = SCTP_DATA_UNORDERED; 4061 } else { 4062 template->rec.data.rcv_flags = 0; 4063 } 4064 /* no flags yet, FRAGMENT_OK goes here */ 4065 template->flags = 0; 4066 /* PR sctp flags */ 4067 if (stcb->asoc.peer_supports_prsctp) { 4068 if (srcv->sinfo_timetolive > 0) { 4069 /* 4070 * We only set the flag if timetolive (or 4071 * priority) was set to a positive number. 4072 * Zero is reserved specifically to be 4073 * EXCLUDED and sent reliable. 4074 */ 4075 if (srcv->sinfo_flags & SCTP_PR_SCTP_TTL) { 4076 template->flags |= SCTP_PR_SCTP_ENABLED; 4077 } 4078 if (srcv->sinfo_flags & SCTP_PR_SCTP_BUF) { 4079 template->flags |= SCTP_PR_SCTP_BUFFER; 4080 } 4081 } 4082 } 4083 template->asoc = &stcb->asoc; 4084 } 4085 4086 4087 int 4088 sctp_get_frag_point(struct sctp_tcb *stcb, 4089 struct sctp_association *asoc) 4090 { 4091 int siz, ovh; 4092 4093 /* For endpoints that have both 6 and 4 addresses 4094 * we must reserver room for the 6 ip header, for 4095 * those that are only dealing with V4 we use 4096 * a larger frag point. 4097 */ 4098 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 4099 ovh = SCTP_MED_OVERHEAD; 4100 } else { 4101 ovh = SCTP_MED_V4_OVERHEAD; 4102 } 4103 4104 if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu) 4105 siz = asoc->smallest_mtu - ovh; 4106 else 4107 siz = (stcb->sctp_ep->sctp_frag_point - ovh); 4108 /* 4109 if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { */ 4110 /* A data chunk MUST fit in a cluster */ 4111 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk));*/ 4112 /* }*/ 4113 4114 if (siz % 4) { 4115 /* make it an even word boundary please */ 4116 siz -= (siz % 4); 4117 } 4118 return (siz); 4119 } 4120 extern unsigned int sctp_max_chunks_on_queue; 4121 4122 #define SBLOCKWAIT(f) (((f)&MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK) 4123 4124 static int 4125 sctp_msg_append(struct sctp_tcb *stcb, 4126 struct sctp_nets *net, 4127 struct mbuf *m, 4128 struct sctp_sndrcvinfo *srcv, 4129 int flags) 4130 { 4131 struct socket *so; 4132 struct sctp_association *asoc; 4133 struct sctp_stream_out *strq; 4134 struct sctp_tmit_chunk *chk; 4135 struct sctpchunk_listhead tmp; 4136 struct sctp_tmit_chunk template; 4137 struct mbuf *n, *mnext; 4138 struct mbuf *mm; 4139 unsigned int dataout, siz; 4140 int mbcnt = 0; 4141 int mbcnt_e = 0; 4142 int error = 0; 4143 4144 if ((stcb == NULL) || (net == NULL) || (m == NULL) || (srcv == NULL)) { 4145 /* Software fault, you blew it on the call */ 4146 #ifdef SCTP_DEBUG 4147 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 4148 printf("software error in sctp_msg_append:1\n"); 4149 printf("stcb:%p net:%p m:%p srcv:%p\n", 4150 stcb, net, m, srcv); 4151 } 4152 #endif 4153 if (m) 4154 sctp_m_freem(m); 4155 return (EFAULT); 4156 } 4157 so = stcb->sctp_socket; 4158 asoc = &stcb->asoc; 4159 if (srcv->sinfo_flags & SCTP_ABORT) { 4160 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) && 4161 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) { 4162 /* It has to be up before we abort */ 4163 /* how big is the user initiated abort? */ 4164 if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) { 4165 dataout = m->m_pkthdr.len; 4166 } else { 4167 /* we must count */ 4168 dataout = 0; 4169 for (n = m; n; n = n->m_next) { 4170 dataout += n->m_len; 4171 } 4172 } 4173 M_PREPEND(m, sizeof(struct sctp_paramhdr), M_DONTWAIT); 4174 if (m) { 4175 struct sctp_paramhdr *ph; 4176 m->m_len = sizeof(struct sctp_paramhdr) + dataout; 4177 ph = mtod(m, struct sctp_paramhdr *); 4178 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 4179 ph->param_length = htons(m->m_len); 4180 } 4181 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, m); 4182 m = NULL; 4183 } else { 4184 /* Only free if we don't send an abort */ 4185 ; 4186 } 4187 goto out; 4188 } 4189 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 4190 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 4191 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 4192 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 4193 /* got data while shutting down */ 4194 error = ECONNRESET; 4195 goto out; 4196 } 4197 4198 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 4199 /* Invalid stream number */ 4200 error = EINVAL; 4201 goto out; 4202 } 4203 if (asoc->strmout == NULL) { 4204 /* huh? software error */ 4205 #ifdef SCTP_DEBUG 4206 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 4207 printf("software error in sctp_msg_append:2\n"); 4208 } 4209 #endif 4210 error = EFAULT; 4211 goto out; 4212 } 4213 strq = &asoc->strmout[srcv->sinfo_stream]; 4214 /* how big is it ? */ 4215 if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) { 4216 dataout = m->m_pkthdr.len; 4217 } else { 4218 /* we must count */ 4219 dataout = 0; 4220 for (n = m; n; n = n->m_next) { 4221 dataout += n->m_len; 4222 } 4223 } 4224 #ifdef SCTP_DEBUG 4225 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 4226 printf("Attempt to send out %d bytes\n", 4227 dataout); 4228 } 4229 #endif 4230 4231 /* lock the socket buf */ 4232 error = sblock(&so->so_snd, SBLOCKWAIT(flags)); 4233 if (error) 4234 goto out_locked; 4235 4236 if (dataout > so->so_snd.sb_hiwat) { 4237 /* It will NEVER fit */ 4238 error = EMSGSIZE; 4239 goto release; 4240 } 4241 if ((srcv->sinfo_flags & SCTP_EOF) && 4242 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) && 4243 (dataout == 0) 4244 ) { 4245 goto zap_by_it_all; 4246 } 4247 if ((so->so_snd.sb_hiwat < 4248 (dataout + asoc->total_output_queue_size)) || 4249 (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) || 4250 (asoc->total_output_mbuf_queue_size > 4251 so->so_snd.sb_mbmax) 4252 ) { 4253 /* XXX Buffer space hunt for data to skip */ 4254 if (asoc->peer_supports_prsctp) { 4255 sctp_prune_prsctp(stcb, asoc, srcv, dataout); 4256 } 4257 while ((so->so_snd.sb_hiwat < 4258 (dataout + asoc->total_output_queue_size)) || 4259 (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) || 4260 (asoc->total_output_mbuf_queue_size > 4261 so->so_snd.sb_mbmax)) { 4262 struct sctp_inpcb *inp; 4263 /* Now did we free up enough room? */ 4264 if (so->so_state & SS_NBIO) { 4265 /* Non-blocking io in place */ 4266 error = EWOULDBLOCK; 4267 goto release; 4268 } 4269 /* 4270 * We store off a pointer to the endpoint. 4271 * Since on return from this we must check to 4272 * see if an so_error is set. If so we may have 4273 * been reset and our stcb destroyed. Returning 4274 * an error will cause the correct error return 4275 * through and fix this all. 4276 */ 4277 inp = stcb->sctp_ep; 4278 /* 4279 * Not sure how else to do this since 4280 * the level we suspended at is not 4281 * known deep down where we are. I will 4282 * drop to spl0() so that others can 4283 * get in. 4284 */ 4285 4286 inp->sctp_tcb_at_block = (void *)stcb; 4287 inp->error_on_block = 0; 4288 sbunlock(&so->so_snd); 4289 error = sbwait(&so->so_snd); 4290 /* 4291 * XXX: This is ugly but I have 4292 * recreated most of what goes on to 4293 * block in the sb. UGHH 4294 * May want to add the bit about being 4295 * no longer connected.. but this then 4296 * further dooms the UDP model NOT to 4297 * allow this. 4298 */ 4299 inp->sctp_tcb_at_block = 0; 4300 if (inp->error_on_block) 4301 error = inp->error_on_block; 4302 if (so->so_error) 4303 error = so->so_error; 4304 if (error) { 4305 goto out_locked; 4306 } 4307 error = sblock(&so->so_snd, M_WAITOK); 4308 if (error) 4309 goto out_locked; 4310 /* Otherwise we cycle back and recheck 4311 * the space 4312 */ 4313 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115 4314 if (so->so_rcv.sb_state & SBS_CANTSENDMORE) { 4315 #else 4316 if (so->so_state & SS_CANTSENDMORE) { 4317 #endif 4318 error = EPIPE; 4319 goto release; 4320 } 4321 if (so->so_error) { 4322 error = so->so_error; 4323 goto release; 4324 } 4325 } 4326 } 4327 /* If we have a packet header fix it if it was broke */ 4328 if (m->m_flags & M_PKTHDR) { 4329 m->m_pkthdr.len = dataout; 4330 } 4331 /* use the smallest one, user set value or 4332 * smallest mtu of the asoc 4333 */ 4334 siz = sctp_get_frag_point(stcb, asoc); 4335 if ((dataout) && (dataout <= siz)) { 4336 /* Fast path */ 4337 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 4338 if (chk == NULL) { 4339 error = ENOMEM; 4340 goto release; 4341 } 4342 sctp_prepare_chunk(chk, stcb, srcv, strq, net); 4343 chk->whoTo->ref_count++; 4344 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG; 4345 4346 /* no flags yet, FRAGMENT_OK goes here */ 4347 sctppcbinfo.ipi_count_chunk++; 4348 sctppcbinfo.ipi_gencnt_chunk++; 4349 asoc->chunks_on_out_queue++; 4350 chk->data = m; 4351 m = NULL; 4352 /* Total in the MSIZE */ 4353 for (mm = chk->data; mm; mm = mm->m_next) { 4354 mbcnt += MSIZE; 4355 if (mm->m_flags & M_EXT) { 4356 mbcnt += chk->data->m_ext.ext_size; 4357 } 4358 } 4359 /* fix up the send_size if it is not present */ 4360 chk->send_size = dataout; 4361 chk->book_size = chk->send_size; 4362 chk->mbcnt = mbcnt; 4363 /* ok, we are committed */ 4364 if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) { 4365 /* bump the ssn if we are unordered. */ 4366 strq->next_sequence_sent++; 4367 } 4368 chk->data->m_nextpkt = 0; 4369 asoc->stream_queue_cnt++; 4370 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next); 4371 /* now check if this stream is on the wheel */ 4372 if ((strq->next_spoke.tqe_next == NULL) && 4373 (strq->next_spoke.tqe_prev == NULL)) { 4374 /* Insert it on the wheel since it is not 4375 * on it currently 4376 */ 4377 sctp_insert_on_wheel(asoc, strq); 4378 } 4379 } else if ((dataout) && (dataout > siz)) { 4380 /* Slow path */ 4381 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NO_FRAGMENT) && 4382 (dataout > siz)) { 4383 error = EMSGSIZE; 4384 goto release; 4385 } 4386 /* setup the template */ 4387 sctp_prepare_chunk(&template, stcb, srcv, strq, net); 4388 4389 n = m; 4390 while (dataout > siz) { 4391 /* 4392 * We can wait since this is called from the user 4393 * send side 4394 */ 4395 n->m_nextpkt = m_split(n, siz, M_WAIT); 4396 if (n->m_nextpkt == NULL) { 4397 error = EFAULT; 4398 goto release; 4399 } 4400 dataout -= siz; 4401 n = n->m_nextpkt; 4402 } 4403 /* 4404 * ok, now we have a chain on m where m->m_nextpkt points to 4405 * the next chunk and m/m->m_next chain is the piece to send. 4406 * We must go through the chains and thread them on to 4407 * sctp_tmit_chunk chains and place them all on the stream 4408 * queue, breaking the m->m_nextpkt pointers as we go. 4409 */ 4410 n = m; 4411 TAILQ_INIT(&tmp); 4412 while (n) { 4413 /* 4414 * first go through and allocate a sctp_tmit chunk 4415 * for each chunk piece 4416 */ 4417 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 4418 if (chk == NULL) { 4419 /* 4420 * ok we must spin through and dump anything 4421 * we have allocated and then jump to the 4422 * no_membad 4423 */ 4424 chk = TAILQ_FIRST(&tmp); 4425 while (chk) { 4426 TAILQ_REMOVE(&tmp, chk, sctp_next); 4427 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4428 sctppcbinfo.ipi_count_chunk--; 4429 asoc->chunks_on_out_queue--; 4430 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4431 panic("Chunk count is negative"); 4432 } 4433 sctppcbinfo.ipi_gencnt_chunk++; 4434 chk = TAILQ_FIRST(&tmp); 4435 } 4436 error = ENOMEM; 4437 goto release; 4438 } 4439 sctppcbinfo.ipi_count_chunk++; 4440 asoc->chunks_on_out_queue++; 4441 4442 sctppcbinfo.ipi_gencnt_chunk++; 4443 *chk = template; 4444 chk->whoTo->ref_count++; 4445 chk->data = n; 4446 /* Total in the MSIZE */ 4447 mbcnt_e = 0; 4448 for (mm = chk->data; mm; mm = mm->m_next) { 4449 mbcnt_e += MSIZE; 4450 if (mm->m_flags & M_EXT) { 4451 mbcnt_e += chk->data->m_ext.ext_size; 4452 } 4453 } 4454 /* now fix the chk->send_size */ 4455 if (chk->data->m_flags & M_PKTHDR) { 4456 chk->send_size = chk->data->m_pkthdr.len; 4457 } else { 4458 struct mbuf *nn; 4459 chk->send_size = 0; 4460 for (nn = chk->data; nn; nn = nn->m_next) { 4461 chk->send_size += nn->m_len; 4462 } 4463 } 4464 chk->book_size = chk->send_size; 4465 chk->mbcnt = mbcnt_e; 4466 mbcnt += mbcnt_e; 4467 if (chk->flags & SCTP_PR_SCTP_BUFFER) { 4468 asoc->sent_queue_cnt_removeable++; 4469 } 4470 n = n->m_nextpkt; 4471 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next); 4472 } 4473 m = NULL; 4474 /* now that we have enough space for all de-couple the 4475 * chain of mbufs by going through our temp array 4476 * and breaking the pointers. 4477 */ 4478 /* ok, we are committed */ 4479 if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) { 4480 /* bump the ssn if we are unordered. */ 4481 strq->next_sequence_sent++; 4482 } 4483 /* Mark the first/last flags. This will 4484 * result int a 3 for a single item on the list 4485 */ 4486 chk = TAILQ_FIRST(&tmp); 4487 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG; 4488 chk = TAILQ_LAST(&tmp, sctpchunk_listhead); 4489 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG; 4490 /* now break any chains on the queue and 4491 * move it to the streams actual queue. 4492 */ 4493 chk = TAILQ_FIRST(&tmp); 4494 while (chk) { 4495 chk->data->m_nextpkt = 0; 4496 TAILQ_REMOVE(&tmp, chk, sctp_next); 4497 asoc->stream_queue_cnt++; 4498 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next); 4499 chk = TAILQ_FIRST(&tmp); 4500 } 4501 /* now check if this stream is on the wheel */ 4502 if ((strq->next_spoke.tqe_next == NULL) && 4503 (strq->next_spoke.tqe_prev == NULL)) { 4504 /* Insert it on the wheel since it is not 4505 * on it currently 4506 */ 4507 sctp_insert_on_wheel(asoc, strq); 4508 } 4509 } 4510 /* has a SHUTDOWN been (also) requested by the user on this asoc? */ 4511 zap_by_it_all: 4512 4513 if ((srcv->sinfo_flags & SCTP_EOF) && 4514 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) { 4515 4516 int some_on_streamwheel = 0; 4517 4518 if (!TAILQ_EMPTY(&asoc->out_wheel)) { 4519 /* Check to see if some data queued */ 4520 struct sctp_stream_out *outs; 4521 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 4522 if (!TAILQ_EMPTY(&outs->outqueue)) { 4523 some_on_streamwheel = 1; 4524 break; 4525 } 4526 } 4527 } 4528 4529 if (TAILQ_EMPTY(&asoc->send_queue) && 4530 TAILQ_EMPTY(&asoc->sent_queue) && 4531 (some_on_streamwheel == 0)) { 4532 /* there is nothing queued to send, so I'm done... */ 4533 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 4534 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 4535 /* only send SHUTDOWN the first time through */ 4536 #ifdef SCTP_DEBUG 4537 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 4538 printf("%s:%d sends a shutdown\n", 4539 __FILE__, 4540 __LINE__ 4541 ); 4542 } 4543 #endif 4544 sctp_send_shutdown(stcb, stcb->asoc.primary_destination); 4545 asoc->state = SCTP_STATE_SHUTDOWN_SENT; 4546 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 4547 asoc->primary_destination); 4548 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 4549 asoc->primary_destination); 4550 } 4551 } else { 4552 /* 4553 * we still got (or just got) data to send, so set 4554 * SHUTDOWN_PENDING 4555 */ 4556 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 4557 } 4558 } 4559 #ifdef SCTP_MBCNT_LOGGING 4560 sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE, 4561 asoc->total_output_queue_size, 4562 dataout, 4563 asoc->total_output_mbuf_queue_size, 4564 mbcnt); 4565 #endif 4566 asoc->total_output_queue_size += dataout; 4567 asoc->total_output_mbuf_queue_size += mbcnt; 4568 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 4569 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 4570 so->so_snd.sb_cc += dataout; 4571 so->so_snd.sb_mbcnt += mbcnt; 4572 } 4573 4574 #ifdef SCTP_DEBUG 4575 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 4576 printf("++total out:%d total_mbuf_out:%d\n", 4577 (int)asoc->total_output_queue_size, 4578 (int)asoc->total_output_mbuf_queue_size); 4579 } 4580 #endif 4581 4582 release: 4583 sbunlock(&so->so_snd); 4584 out_locked: 4585 4586 out: 4587 if (m && m->m_nextpkt) { 4588 n = m; 4589 while (n) { 4590 mnext = n->m_nextpkt; 4591 n->m_nextpkt = NULL; 4592 sctp_m_freem(n); 4593 n = mnext; 4594 } 4595 } else if (m) 4596 sctp_m_freem(m); 4597 4598 return (error); 4599 } 4600 4601 static struct mbuf * 4602 sctp_copy_mbufchain(struct mbuf *clonechain, 4603 struct mbuf *outchain) 4604 { 4605 struct mbuf *appendchain; 4606 #if defined(__FreeBSD__) || defined(__NetBSD__) 4607 /* Supposedly m_copypacket is an optimization, use it if we can */ 4608 if (clonechain->m_flags & M_PKTHDR) { 4609 appendchain = m_copypacket(clonechain, M_DONTWAIT); 4610 sctp_pegs[SCTP_CACHED_SRC]++; 4611 } else 4612 appendchain = m_copym(clonechain, 0, M_COPYALL, M_DONTWAIT); 4613 #elif defined(__APPLE__) 4614 appendchain = sctp_m_copym(clonechain, 0, M_COPYALL, M_DONTWAIT); 4615 #else 4616 appendchain = m_copy(clonechain, 0, M_COPYALL); 4617 #endif 4618 4619 if (appendchain == NULL) { 4620 /* error */ 4621 if (outchain) 4622 sctp_m_freem(outchain); 4623 return (NULL); 4624 } 4625 if (outchain) { 4626 /* tack on to the end */ 4627 struct mbuf *m; 4628 m = outchain; 4629 while (m) { 4630 if (m->m_next == NULL) { 4631 m->m_next = appendchain; 4632 break; 4633 } 4634 m = m->m_next; 4635 } 4636 if (outchain->m_flags & M_PKTHDR) { 4637 int append_tot; 4638 struct mbuf *t; 4639 t = appendchain; 4640 append_tot = 0; 4641 while (t) { 4642 append_tot += t->m_len; 4643 t = t->m_next; 4644 } 4645 outchain->m_pkthdr.len += append_tot; 4646 } 4647 return (outchain); 4648 } else { 4649 return (appendchain); 4650 } 4651 } 4652 4653 static void 4654 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, u_int32_t val) 4655 { 4656 struct sctp_copy_all *ca; 4657 struct mbuf *m; 4658 int turned_on_nonblock=0, ret; 4659 4660 ca = (struct sctp_copy_all *)ptr; 4661 if (ca->m == NULL) { 4662 return; 4663 } 4664 if (ca->inp != inp) { 4665 /* TSNH */ 4666 return; 4667 } 4668 m = sctp_copy_mbufchain(ca->m, NULL); 4669 if (m == NULL) { 4670 /* can't copy so we are done */ 4671 ca->cnt_failed++; 4672 return; 4673 } 4674 if ((stcb->sctp_socket->so_state & SS_NBIO) == 0) { 4675 /* we have to do this non-blocking */ 4676 turned_on_nonblock = 1; 4677 stcb->sctp_socket->so_state |= SS_NBIO; 4678 } 4679 ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m, &ca->sndrcv, 0); 4680 if (turned_on_nonblock) { 4681 /* we turned on non-blocking so turn it off */ 4682 stcb->sctp_socket->so_state &= ~SS_NBIO; 4683 } 4684 if (ret) { 4685 ca->cnt_failed++; 4686 } else { 4687 ca->cnt_sent++; 4688 } 4689 } 4690 4691 static void 4692 sctp_sendall_completes(void *ptr, u_int32_t val) 4693 { 4694 struct sctp_copy_all *ca; 4695 ca = (struct sctp_copy_all *)ptr; 4696 /* Do a notify here? 4697 * Kacheong suggests that the notify 4698 * be done at the send time.. so you would 4699 * push up a notification if any send failed. 4700 * Don't know if this is feasable since the 4701 * only failures we have is "memory" related and 4702 * if you cannot get an mbuf to send the data 4703 * you surely can't get an mbuf to send up 4704 * to notify the user you can't send the data :-> 4705 */ 4706 4707 /* now free everything */ 4708 m_freem(ca->m); 4709 free(ca, M_PCB); 4710 } 4711 4712 4713 #define MC_ALIGN(m, len) do { \ 4714 (m)->m_data += (MCLBYTES - (len)) & ~(sizeof(long) - 1); \ 4715 } while (0) 4716 4717 4718 4719 static struct mbuf * 4720 sctp_copy_out_all(struct uio *uio, int len) 4721 { 4722 struct mbuf *ret, *at; 4723 int left, willcpy, cancpy, error; 4724 4725 MGETHDR(ret, M_WAIT, MT_HEADER); 4726 if (ret == NULL) { 4727 /* TSNH */ 4728 return (NULL); 4729 } 4730 left = len; 4731 ret->m_len = 0; 4732 ret->m_pkthdr.len = len; 4733 MCLGET(ret, M_WAIT); 4734 if (ret == NULL) { 4735 return (NULL); 4736 } 4737 if ((ret->m_flags & M_EXT) == 0) { 4738 m_freem (ret); 4739 return (NULL); 4740 } 4741 cancpy = M_TRAILINGSPACE(ret); 4742 willcpy = uimin(cancpy, left); 4743 at = ret; 4744 while (left > 0) { 4745 /* Align data to the end */ 4746 MC_ALIGN(at, willcpy); 4747 error = uiomove(mtod(at, void *), willcpy, uio); 4748 if (error) { 4749 err_out_now: 4750 m_freem(ret); 4751 return (NULL); 4752 } 4753 at->m_len = willcpy; 4754 at->m_nextpkt = at->m_next = 0; 4755 left -= willcpy; 4756 if (left > 0) { 4757 MGET(at->m_next, M_WAIT, MT_DATA); 4758 if (at->m_next == NULL) { 4759 goto err_out_now; 4760 } 4761 at = at->m_next; 4762 at->m_len = 0; 4763 MCLGET(at, M_WAIT); 4764 if (at == NULL) { 4765 goto err_out_now; 4766 } 4767 if ((at->m_flags & M_EXT) == 0) { 4768 goto err_out_now; 4769 } 4770 cancpy = M_TRAILINGSPACE(at); 4771 willcpy = uimin(cancpy, left); 4772 } 4773 } 4774 return (ret); 4775 } 4776 4777 static int 4778 sctp_sendall (struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, struct sctp_sndrcvinfo *srcv) 4779 { 4780 int ret; 4781 struct sctp_copy_all *ca; 4782 ca = malloc(sizeof(struct sctp_copy_all), M_PCB, M_WAIT); 4783 if (ca == NULL) { 4784 m_freem(m); 4785 return (ENOMEM); 4786 } 4787 memset (ca, 0, sizeof(struct sctp_copy_all)); 4788 4789 ca->inp = inp; 4790 ca->sndrcv = *srcv; 4791 /* take off the sendall flag, it would 4792 * be bad if we failed to do this :-0 4793 */ 4794 ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL; 4795 4796 /* get length and mbuf chain */ 4797 if (uio) { 4798 ca->sndlen = uio->uio_resid; 4799 ca->m = sctp_copy_out_all(uio, ca->sndlen); 4800 if (ca->m == NULL) { 4801 free(ca, M_PCB); 4802 return (ENOMEM); 4803 } 4804 } else { 4805 if ((m->m_flags & M_PKTHDR) == 0) { 4806 ca->sndlen = 0; 4807 while(m) { 4808 ca->sndlen += m->m_len; 4809 m = m->m_next; 4810 } 4811 } else { 4812 ca->sndlen = m->m_pkthdr.len; 4813 } 4814 ca->m = m; 4815 } 4816 4817 ret = sctp_initiate_iterator(sctp_sendall_iterator, SCTP_PCB_ANY_FLAGS, SCTP_ASOC_ANY_STATE, 4818 (void *)ca, 0, sctp_sendall_completes, inp); 4819 if (ret) { 4820 #ifdef SCTP_DEBUG 4821 printf("Failed to initate iterator to takeover associations\n"); 4822 #endif 4823 free(ca, M_PCB); 4824 return (EFAULT); 4825 4826 } 4827 return (0); 4828 } 4829 4830 4831 void 4832 sctp_toss_old_cookies(struct sctp_association *asoc) 4833 { 4834 struct sctp_tmit_chunk *chk, *nchk; 4835 chk = TAILQ_FIRST(&asoc->control_send_queue); 4836 while (chk) { 4837 nchk = TAILQ_NEXT(chk, sctp_next); 4838 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) { 4839 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 4840 if (chk->data) { 4841 sctp_m_freem(chk->data); 4842 chk->data = NULL; 4843 } 4844 asoc->ctrl_queue_cnt--; 4845 if (chk->whoTo) 4846 sctp_free_remote_addr(chk->whoTo); 4847 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4848 sctppcbinfo.ipi_count_chunk--; 4849 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4850 panic("Chunk count is negative"); 4851 } 4852 sctppcbinfo.ipi_gencnt_chunk++; 4853 } 4854 chk = nchk; 4855 } 4856 } 4857 4858 void 4859 sctp_toss_old_asconf(struct sctp_tcb *stcb) 4860 { 4861 struct sctp_association *asoc; 4862 struct sctp_tmit_chunk *chk, *chk_tmp; 4863 4864 asoc = &stcb->asoc; 4865 for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL; 4866 chk = chk_tmp) { 4867 /* get next chk */ 4868 chk_tmp = TAILQ_NEXT(chk, sctp_next); 4869 /* find SCTP_ASCONF chunk in queue (only one ever in queue) */ 4870 if (chk->rec.chunk_id == SCTP_ASCONF) { 4871 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 4872 if (chk->data) { 4873 sctp_m_freem(chk->data); 4874 chk->data = NULL; 4875 } 4876 asoc->ctrl_queue_cnt--; 4877 if (chk->whoTo) 4878 sctp_free_remote_addr(chk->whoTo); 4879 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4880 sctppcbinfo.ipi_count_chunk--; 4881 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4882 panic("Chunk count is negative"); 4883 } 4884 sctppcbinfo.ipi_gencnt_chunk++; 4885 } 4886 } 4887 } 4888 4889 4890 static void 4891 sctp_clean_up_datalist(struct sctp_tcb *stcb, 4892 struct sctp_association *asoc, 4893 struct sctp_tmit_chunk **data_list, 4894 int bundle_at, 4895 struct sctp_nets *net) 4896 { 4897 int i; 4898 for (i = 0; i < bundle_at; i++) { 4899 /* off of the send queue */ 4900 if (i) { 4901 /* Any chunk NOT 0 you zap the time 4902 * chunk 0 gets zapped or set based on 4903 * if a RTO measurement is needed. 4904 */ 4905 data_list[i]->do_rtt = 0; 4906 } 4907 /* record time */ 4908 data_list[i]->sent_rcv_time = net->last_sent_time; 4909 TAILQ_REMOVE(&asoc->send_queue, 4910 data_list[i], 4911 sctp_next); 4912 /* on to the sent queue */ 4913 TAILQ_INSERT_TAIL(&asoc->sent_queue, 4914 data_list[i], 4915 sctp_next); 4916 /* This does not lower until the cum-ack passes it */ 4917 asoc->sent_queue_cnt++; 4918 asoc->send_queue_cnt--; 4919 if ((asoc->peers_rwnd <= 0) && 4920 (asoc->total_flight == 0) && 4921 (bundle_at == 1)) { 4922 /* Mark the chunk as being a window probe */ 4923 #ifdef SCTP_DEBUG 4924 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 4925 printf("WINDOW PROBE SET\n"); 4926 } 4927 #endif 4928 sctp_pegs[SCTP_WINDOW_PROBES]++; 4929 data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE; 4930 } else { 4931 data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE; 4932 } 4933 #ifdef SCTP_AUDITING_ENABLED 4934 sctp_audit_log(0xC2, 3); 4935 #endif 4936 data_list[i]->sent = SCTP_DATAGRAM_SENT; 4937 data_list[i]->snd_count = 1; 4938 net->flight_size += data_list[i]->book_size; 4939 asoc->total_flight += data_list[i]->book_size; 4940 asoc->total_flight_count++; 4941 #ifdef SCTP_LOG_RWND 4942 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 4943 asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh); 4944 #endif 4945 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 4946 (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh)); 4947 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 4948 /* SWS sender side engages */ 4949 asoc->peers_rwnd = 0; 4950 } 4951 } 4952 } 4953 4954 static void 4955 sctp_clean_up_ctl(struct sctp_association *asoc) 4956 { 4957 struct sctp_tmit_chunk *chk, *nchk; 4958 for (chk = TAILQ_FIRST(&asoc->control_send_queue); 4959 chk; chk = nchk) { 4960 nchk = TAILQ_NEXT(chk, sctp_next); 4961 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) || 4962 (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) || 4963 (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) || 4964 (chk->rec.chunk_id == SCTP_SHUTDOWN) || 4965 (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) || 4966 (chk->rec.chunk_id == SCTP_OPERATION_ERROR) || 4967 (chk->rec.chunk_id == SCTP_PACKET_DROPPED) || 4968 (chk->rec.chunk_id == SCTP_COOKIE_ACK) || 4969 (chk->rec.chunk_id == SCTP_ECN_CWR) || 4970 (chk->rec.chunk_id == SCTP_ASCONF_ACK)) { 4971 /* Stray chunks must be cleaned up */ 4972 clean_up_anyway: 4973 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 4974 if (chk->data) { 4975 sctp_m_freem(chk->data); 4976 chk->data = NULL; 4977 } 4978 asoc->ctrl_queue_cnt--; 4979 sctp_free_remote_addr(chk->whoTo); 4980 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4981 sctppcbinfo.ipi_count_chunk--; 4982 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4983 panic("Chunk count is negative"); 4984 } 4985 sctppcbinfo.ipi_gencnt_chunk++; 4986 } else if (chk->rec.chunk_id == SCTP_STREAM_RESET) { 4987 struct sctp_stream_reset_req *strreq; 4988 /* special handling, we must look into the param */ 4989 strreq = mtod(chk->data, struct sctp_stream_reset_req *); 4990 if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) { 4991 goto clean_up_anyway; 4992 } 4993 } 4994 } 4995 } 4996 4997 static int 4998 sctp_move_to_outqueue(struct sctp_tcb *stcb, 4999 struct sctp_stream_out *strq) 5000 { 5001 /* Move from the stream to the send_queue keeping track of the total */ 5002 struct sctp_association *asoc; 5003 int tot_moved = 0; 5004 int failed = 0; 5005 int padval; 5006 struct sctp_tmit_chunk *chk, *nchk; 5007 struct sctp_data_chunk *dchkh; 5008 struct sctpchunk_listhead tmp; 5009 struct mbuf *orig; 5010 5011 asoc = &stcb->asoc; 5012 TAILQ_INIT(&tmp); 5013 chk = TAILQ_FIRST(&strq->outqueue); 5014 while (chk) { 5015 nchk = TAILQ_NEXT(chk, sctp_next); 5016 /* now put in the chunk header */ 5017 orig = chk->data; 5018 M_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_DONTWAIT); 5019 if (chk->data == NULL) { 5020 /* HELP */ 5021 failed++; 5022 break; 5023 } 5024 if (orig != chk->data) { 5025 /* A new mbuf was added, account for it */ 5026 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 5027 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 5028 stcb->sctp_socket->so_snd.sb_mbcnt += MSIZE; 5029 } 5030 #ifdef SCTP_MBCNT_LOGGING 5031 sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE, 5032 asoc->total_output_queue_size, 5033 0, 5034 asoc->total_output_mbuf_queue_size, 5035 MSIZE); 5036 #endif 5037 stcb->asoc.total_output_mbuf_queue_size += MSIZE; 5038 chk->mbcnt += MSIZE; 5039 } 5040 chk->send_size += sizeof(struct sctp_data_chunk); 5041 /* This should NOT have to do anything, but 5042 * I would rather be cautious 5043 */ 5044 if (!failed && ((size_t)chk->data->m_len < sizeof(struct sctp_data_chunk))) { 5045 m_pullup(chk->data, sizeof(struct sctp_data_chunk)); 5046 if (chk->data == NULL) { 5047 failed++; 5048 break; 5049 } 5050 } 5051 dchkh = mtod(chk->data, struct sctp_data_chunk *); 5052 dchkh->ch.chunk_length = htons(chk->send_size); 5053 /* Chunks must be padded to even word boundary */ 5054 padval = chk->send_size % 4; 5055 if (padval) { 5056 /* For fragmented messages this should not 5057 * run except possibly on the last chunk 5058 */ 5059 if (sctp_pad_lastmbuf(chk->data, (4 - padval))) { 5060 /* we are in big big trouble no mbufs :< */ 5061 failed++; 5062 break; 5063 } 5064 chk->send_size += (4 - padval); 5065 } 5066 /* pull from stream queue */ 5067 TAILQ_REMOVE(&strq->outqueue, chk, sctp_next); 5068 asoc->stream_queue_cnt--; 5069 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next); 5070 /* add it in to the size of moved chunks */ 5071 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 5072 /* we pull only one message */ 5073 break; 5074 } 5075 chk = nchk; 5076 } 5077 if (failed) { 5078 /* Gak, we just lost the user message */ 5079 chk = TAILQ_FIRST(&tmp); 5080 while (chk) { 5081 nchk = TAILQ_NEXT(chk, sctp_next); 5082 TAILQ_REMOVE(&tmp, chk, sctp_next); 5083 5084 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, 5085 (SCTP_NOTIFY_DATAGRAM_UNSENT|SCTP_INTERNAL_ERROR), 5086 chk); 5087 5088 if (chk->data) { 5089 sctp_m_freem(chk->data); 5090 chk->data = NULL; 5091 } 5092 if (chk->whoTo) { 5093 sctp_free_remote_addr(chk->whoTo); 5094 chk->whoTo = NULL; 5095 } 5096 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 5097 sctppcbinfo.ipi_count_chunk--; 5098 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 5099 panic("Chunk count is negative"); 5100 } 5101 sctppcbinfo.ipi_gencnt_chunk++; 5102 chk = nchk; 5103 } 5104 return (0); 5105 } 5106 /* now pull them off of temp wheel */ 5107 chk = TAILQ_FIRST(&tmp); 5108 while (chk) { 5109 nchk = TAILQ_NEXT(chk, sctp_next); 5110 /* insert on send_queue */ 5111 TAILQ_REMOVE(&tmp, chk, sctp_next); 5112 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 5113 asoc->send_queue_cnt++; 5114 /* assign TSN */ 5115 chk->rec.data.TSN_seq = asoc->sending_seq++; 5116 5117 dchkh = mtod(chk->data, struct sctp_data_chunk *); 5118 /* Put the rest of the things in place now. Size 5119 * was done earlier in previous loop prior to 5120 * padding. 5121 */ 5122 dchkh->ch.chunk_type = SCTP_DATA; 5123 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 5124 dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq); 5125 dchkh->dp.stream_id = htons(strq->stream_no); 5126 dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq); 5127 dchkh->dp.protocol_id = chk->rec.data.payloadtype; 5128 /* total count moved */ 5129 tot_moved += chk->send_size; 5130 chk = nchk; 5131 } 5132 return (tot_moved); 5133 } 5134 5135 static void 5136 sctp_fill_outqueue(struct sctp_tcb *stcb, 5137 struct sctp_nets *net) 5138 { 5139 struct sctp_association *asoc; 5140 struct sctp_tmit_chunk *chk; 5141 struct sctp_stream_out *strq, *strqn; 5142 int mtu_fromwheel, goal_mtu; 5143 unsigned int moved, seenend, cnt_mvd=0; 5144 5145 asoc = &stcb->asoc; 5146 /* Attempt to move at least 1 MTU's worth 5147 * onto the wheel for each destination address 5148 */ 5149 goal_mtu = net->cwnd - net->flight_size; 5150 if ((unsigned int)goal_mtu < net->mtu) { 5151 goal_mtu = net->mtu; 5152 } 5153 if (sctp_pegs[SCTP_MOVED_MTU] < (unsigned int)goal_mtu) { 5154 sctp_pegs[SCTP_MOVED_MTU] = goal_mtu; 5155 } 5156 seenend = moved = mtu_fromwheel = 0; 5157 if (asoc->last_out_stream == NULL) { 5158 strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel); 5159 if (asoc->last_out_stream == NULL) { 5160 /* huh nothing on the wheel, TSNH */ 5161 return; 5162 } 5163 goto done_it; 5164 } 5165 strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke); 5166 done_it: 5167 if (strq == NULL) { 5168 asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel); 5169 } 5170 while (mtu_fromwheel < goal_mtu) { 5171 if (strq == NULL) { 5172 if (seenend == 0) { 5173 seenend = 1; 5174 strq = TAILQ_FIRST(&asoc->out_wheel); 5175 } else if ((moved == 0) && (seenend)) { 5176 /* none left on the wheel */ 5177 sctp_pegs[SCTP_MOVED_NLEF]++; 5178 return; 5179 } else if (moved) { 5180 /* 5181 * clear the flags and rotate back through 5182 * again 5183 */ 5184 moved = 0; 5185 seenend = 0; 5186 strq = TAILQ_FIRST(&asoc->out_wheel); 5187 } 5188 if (strq == NULL) 5189 break; 5190 continue; 5191 } 5192 strqn = TAILQ_NEXT(strq, next_spoke); 5193 if ((chk = TAILQ_FIRST(&strq->outqueue)) == NULL) { 5194 /* none left on this queue, prune a spoke? */ 5195 sctp_remove_from_wheel(asoc, strq); 5196 if (strq == asoc->last_out_stream) { 5197 /* the last one we used went off the wheel */ 5198 asoc->last_out_stream = NULL; 5199 } 5200 strq = strqn; 5201 continue; 5202 } 5203 if (chk->whoTo != net) { 5204 /* Skip this stream, first one on stream 5205 * does not head to our current destination. 5206 */ 5207 strq = strqn; 5208 continue; 5209 } 5210 mtu_fromwheel += sctp_move_to_outqueue(stcb, strq); 5211 cnt_mvd++; 5212 moved++; 5213 asoc->last_out_stream = strq; 5214 strq = strqn; 5215 } 5216 sctp_pegs[SCTP_MOVED_MAX]++; 5217 #ifdef SCTP_DEBUG 5218 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5219 printf("Ok we moved %d chunks to send queue\n", 5220 moved); 5221 } 5222 #endif 5223 if (sctp_pegs[SCTP_MOVED_QMAX] < cnt_mvd) { 5224 sctp_pegs[SCTP_MOVED_QMAX] = cnt_mvd; 5225 } 5226 } 5227 5228 void 5229 sctp_fix_ecn_echo(struct sctp_association *asoc) 5230 { 5231 struct sctp_tmit_chunk *chk; 5232 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 5233 if (chk->rec.chunk_id == SCTP_ECN_ECHO) { 5234 chk->sent = SCTP_DATAGRAM_UNSENT; 5235 } 5236 } 5237 } 5238 5239 static void 5240 sctp_move_to_an_alt(struct sctp_tcb *stcb, 5241 struct sctp_association *asoc, 5242 struct sctp_nets *net) 5243 { 5244 struct sctp_tmit_chunk *chk; 5245 struct sctp_nets *a_net; 5246 a_net = sctp_find_alternate_net(stcb, net); 5247 if ((a_net != net) && 5248 ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) { 5249 /* 5250 * We only proceed if a valid alternate is found that is 5251 * not this one and is reachable. Here we must move all 5252 * chunks queued in the send queue off of the destination 5253 * address to our alternate. 5254 */ 5255 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 5256 if (chk->whoTo == net) { 5257 /* Move the chunk to our alternate */ 5258 sctp_free_remote_addr(chk->whoTo); 5259 chk->whoTo = a_net; 5260 a_net->ref_count++; 5261 } 5262 } 5263 } 5264 } 5265 5266 static int sctp_from_user_send=0; 5267 5268 static int 5269 sctp_med_chunk_output(struct sctp_inpcb *inp, 5270 struct sctp_tcb *stcb, 5271 struct sctp_association *asoc, 5272 int *num_out, 5273 int *reason_code, 5274 int control_only, int *cwnd_full, int from_where, 5275 struct timeval *now, int *now_filled) 5276 { 5277 /* 5278 * Ok this is the generic chunk service queue. 5279 * we must do the following: 5280 * - Service the stream queue that is next, moving any message 5281 * (note I must get a complete message i.e. FIRST/MIDDLE and 5282 * LAST to the out queue in one pass) and assigning TSN's 5283 * - Check to see if the cwnd/rwnd allows any output, if so we 5284 * go ahead and fomulate and send the low level chunks. Making 5285 * sure to combine any control in the control chunk queue also. 5286 */ 5287 struct sctp_nets *net; 5288 struct mbuf *outchain; 5289 struct sctp_tmit_chunk *chk, *nchk; 5290 struct sctphdr *shdr; 5291 /* temp arrays for unlinking */ 5292 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 5293 int no_fragmentflg, error; 5294 int one_chunk, hbflag; 5295 int asconf, cookie, no_out_cnt; 5296 int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind; 5297 unsigned int mtu, r_mtu, omtu; 5298 *num_out = 0; 5299 cwnd_full_ind = 0; 5300 ctl_cnt = no_out_cnt = asconf = cookie = 0; 5301 /* 5302 * First lets prime the pump. For each destination, if there 5303 * is room in the flight size, attempt to pull an MTU's worth 5304 * out of the stream queues into the general send_queue 5305 */ 5306 #ifdef SCTP_AUDITING_ENABLED 5307 sctp_audit_log(0xC2, 2); 5308 #endif 5309 #ifdef SCTP_DEBUG 5310 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5311 printf("***********************\n"); 5312 } 5313 #endif 5314 hbflag = 0; 5315 if (control_only) 5316 no_data_chunks = 1; 5317 else 5318 no_data_chunks = 0; 5319 5320 /* Nothing to possible to send? */ 5321 if (TAILQ_EMPTY(&asoc->control_send_queue) && 5322 TAILQ_EMPTY(&asoc->send_queue) && 5323 TAILQ_EMPTY(&asoc->out_wheel)) { 5324 #ifdef SCTP_DEBUG 5325 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5326 printf("All wheels empty\n"); 5327 } 5328 #endif 5329 return (0); 5330 } 5331 if (asoc->peers_rwnd <= 0) { 5332 /* No room in peers rwnd */ 5333 *cwnd_full = 1; 5334 *reason_code = 1; 5335 if (asoc->total_flight > 0) { 5336 /* we are allowed one chunk in flight */ 5337 no_data_chunks = 1; 5338 sctp_pegs[SCTP_RWND_BLOCKED]++; 5339 } 5340 } 5341 #ifdef SCTP_DEBUG 5342 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5343 printf("Ok we have done the fillup no_data_chunk=%d tf=%d prw:%d\n", 5344 (int)no_data_chunks, 5345 (int)asoc->total_flight, (int)asoc->peers_rwnd); 5346 } 5347 #endif 5348 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5349 #ifdef SCTP_DEBUG 5350 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5351 printf("net:%p fs:%d cwnd:%d\n", 5352 net, net->flight_size, net->cwnd); 5353 } 5354 #endif 5355 if (net->flight_size >= net->cwnd) { 5356 /* skip this network, no room */ 5357 cwnd_full_ind++; 5358 #ifdef SCTP_DEBUG 5359 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5360 printf("Ok skip fillup->fs:%d > cwnd:%d\n", 5361 net->flight_size, 5362 net->cwnd); 5363 } 5364 #endif 5365 sctp_pegs[SCTP_CWND_NOFILL]++; 5366 continue; 5367 } 5368 /* 5369 * spin through the stream queues moving one message and 5370 * assign TSN's as appropriate. 5371 */ 5372 sctp_fill_outqueue(stcb, net); 5373 } 5374 *cwnd_full = cwnd_full_ind; 5375 /* now service each destination and send out what we can for it */ 5376 #ifdef SCTP_DEBUG 5377 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5378 int chk_cnt = 0; 5379 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 5380 chk_cnt++; 5381 } 5382 printf("We have %d chunks on the send_queue\n", chk_cnt); 5383 chk_cnt = 0; 5384 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 5385 chk_cnt++; 5386 } 5387 printf("We have %d chunks on the sent_queue\n", chk_cnt); 5388 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 5389 chk_cnt++; 5390 } 5391 printf("We have %d chunks on the control_queue\n", chk_cnt); 5392 } 5393 #endif 5394 /* If we have data to send, and DSACK is running, stop it 5395 * and build a SACK to dump on to bundle with output. This 5396 * actually MAY make it so the bundling does not occur if 5397 * the SACK is big but I think this is ok because basic SACK 5398 * space is pre-reserved in our fragmentation size choice. 5399 */ 5400 if ((TAILQ_FIRST(&asoc->send_queue) != NULL) && 5401 (no_data_chunks == 0)) { 5402 /* We will be sending something */ 5403 if (callout_pending(&stcb->asoc.dack_timer.timer)) { 5404 /* Yep a callout is pending */ 5405 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 5406 stcb->sctp_ep, 5407 stcb, NULL); 5408 sctp_send_sack(stcb); 5409 } 5410 } 5411 /* Nothing to send? */ 5412 if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) && 5413 (TAILQ_FIRST(&asoc->send_queue) == NULL)) { 5414 return (0); 5415 } 5416 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5417 struct rtentry *rt; 5418 /* how much can we send? */ 5419 if (net->ref_count < 2) { 5420 /* Ref-count of 1 so we cannot have data or control 5421 * queued to this address. Skip it. 5422 */ 5423 continue; 5424 } 5425 ctl_cnt = bundle_at = 0; 5426 outchain = NULL; 5427 no_fragmentflg = 1; 5428 one_chunk = 0; 5429 5430 rt = rtcache_validate(&net->ro); 5431 if (rt != NULL) { 5432 /* if we have a route and an ifp 5433 * check to see if we have room to 5434 * send to this guy 5435 */ 5436 struct ifnet *ifp; 5437 ifp = net->ro._ro_rt->rt_ifp; 5438 if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) { 5439 sctp_pegs[SCTP_IFP_QUEUE_FULL]++; 5440 #ifdef SCTP_LOG_MAXBURST 5441 sctp_log_maxburst(net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED); 5442 #endif 5443 rtcache_unref(rt, &net->ro); 5444 continue; 5445 } 5446 rtcache_unref(rt, &net->ro); 5447 } 5448 if (((struct sockaddr *)&net->ro.ro_sa)->sa_family == AF_INET) { 5449 mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr)); 5450 } else { 5451 mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)); 5452 } 5453 if (mtu > asoc->peers_rwnd) { 5454 if (asoc->total_flight > 0) { 5455 /* We have a packet in flight somewhere */ 5456 r_mtu = asoc->peers_rwnd; 5457 } else { 5458 /* We are always allowed to send one MTU out */ 5459 one_chunk = 1; 5460 r_mtu = mtu; 5461 } 5462 } else { 5463 r_mtu = mtu; 5464 } 5465 #ifdef SCTP_DEBUG 5466 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5467 printf("Ok r_mtu is %d mtu is %d for this net:%p one_chunk:%d\n", 5468 r_mtu, mtu, net, one_chunk); 5469 } 5470 #endif 5471 /************************/ 5472 /* Control transmission */ 5473 /************************/ 5474 /* Now first lets go through the control queue */ 5475 for (chk = TAILQ_FIRST(&asoc->control_send_queue); 5476 chk; chk = nchk) { 5477 nchk = TAILQ_NEXT(chk, sctp_next); 5478 if (chk->whoTo != net) { 5479 /* 5480 * No, not sent to the network we are 5481 * looking at 5482 */ 5483 continue; 5484 } 5485 if (chk->data == NULL) { 5486 continue; 5487 } 5488 if ((chk->data->m_flags & M_PKTHDR) == 0) { 5489 /* 5490 * NOTE: the chk queue MUST have the PKTHDR 5491 * flag set on it with a total in the 5492 * m_pkthdr.len field!! else the chunk will 5493 * ALWAYS be skipped 5494 */ 5495 continue; 5496 } 5497 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 5498 /* 5499 * It must be unsent. Cookies and ASCONF's 5500 * hang around but there timers will force 5501 * when marked for resend. 5502 */ 5503 continue; 5504 } 5505 /* Here we do NOT factor the r_mtu */ 5506 if ((chk->data->m_pkthdr.len < (int)mtu) || 5507 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 5508 /* 5509 * We probably should glom the mbuf chain from 5510 * the chk->data for control but the problem 5511 * is it becomes yet one more level of 5512 * tracking to do if for some reason output 5513 * fails. Then I have got to reconstruct the 5514 * merged control chain.. el yucko.. for now 5515 * we take the easy way and do the copy 5516 */ 5517 outchain = sctp_copy_mbufchain(chk->data, 5518 outchain); 5519 if (outchain == NULL) { 5520 return (ENOMEM); 5521 } 5522 /* update our MTU size */ 5523 if (mtu > chk->data->m_pkthdr.len) 5524 mtu -= chk->data->m_pkthdr.len; 5525 else 5526 mtu = 0; 5527 /* Do clear IP_DF ? */ 5528 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 5529 no_fragmentflg = 0; 5530 } 5531 /* Mark things to be removed, if needed */ 5532 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) || 5533 (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) || 5534 (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) || 5535 (chk->rec.chunk_id == SCTP_SHUTDOWN) || 5536 (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) || 5537 (chk->rec.chunk_id == SCTP_OPERATION_ERROR) || 5538 (chk->rec.chunk_id == SCTP_COOKIE_ACK) || 5539 (chk->rec.chunk_id == SCTP_ECN_CWR) || 5540 (chk->rec.chunk_id == SCTP_PACKET_DROPPED) || 5541 (chk->rec.chunk_id == SCTP_ASCONF_ACK)) { 5542 5543 if (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) 5544 hbflag = 1; 5545 /* remove these chunks at the end */ 5546 if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) { 5547 /* turn off the timer */ 5548 if (callout_pending(&stcb->asoc.dack_timer.timer)) { 5549 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 5550 inp, stcb, net); 5551 } 5552 } 5553 ctl_cnt++; 5554 } else { 5555 /* 5556 * Other chunks, since they have 5557 * timers running (i.e. COOKIE or 5558 * ASCONF) we just "trust" that it 5559 * gets sent or retransmitted. 5560 */ 5561 ctl_cnt++; 5562 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) { 5563 cookie = 1; 5564 no_out_cnt = 1; 5565 } else if (chk->rec.chunk_id == SCTP_ASCONF) { 5566 /* 5567 * set hb flag since we can use 5568 * these for RTO 5569 */ 5570 hbflag = 1; 5571 asconf = 1; 5572 } 5573 chk->sent = SCTP_DATAGRAM_SENT; 5574 chk->snd_count++; 5575 } 5576 if (mtu == 0) { 5577 /* 5578 * Ok we are out of room but we can 5579 * output without effecting the flight 5580 * size since this little guy is a 5581 * control only packet. 5582 */ 5583 if (asconf) { 5584 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 5585 asconf = 0; 5586 } 5587 if (cookie) { 5588 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 5589 cookie = 0; 5590 } 5591 if (outchain->m_len == 0) { 5592 /* 5593 * Special case for when you 5594 * get a 0 len mbuf at the 5595 * head due to the lack of a 5596 * MHDR at the beginning. 5597 */ 5598 outchain->m_len = sizeof(struct sctphdr); 5599 } else { 5600 M_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT); 5601 if (outchain == NULL) { 5602 /* no memory */ 5603 error = ENOBUFS; 5604 goto error_out_again; 5605 } 5606 } 5607 shdr = mtod(outchain, struct sctphdr *); 5608 shdr->src_port = inp->sctp_lport; 5609 shdr->dest_port = stcb->rport; 5610 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 5611 shdr->checksum = 0; 5612 5613 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 5614 rtcache_getdst(&net->ro), 5615 outchain, 5616 no_fragmentflg, 0, NULL, asconf))) { 5617 if (error == ENOBUFS) { 5618 asoc->ifp_had_enobuf = 1; 5619 } 5620 sctp_pegs[SCTP_DATA_OUT_ERR]++; 5621 if (from_where == 0) { 5622 sctp_pegs[SCTP_ERROUT_FRM_USR]++; 5623 } 5624 error_out_again: 5625 #ifdef SCTP_DEBUG 5626 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 5627 printf("Gak got ctrl error %d\n", error); 5628 } 5629 #endif 5630 /* error, could not output */ 5631 if (hbflag) { 5632 #ifdef SCTP_DEBUG 5633 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5634 printf("Update HB anyway\n"); 5635 } 5636 #endif 5637 if (*now_filled == 0) { 5638 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 5639 *now_filled = 1; 5640 *now = net->last_sent_time; 5641 } else { 5642 net->last_sent_time = *now; 5643 } 5644 hbflag = 0; 5645 } 5646 if (error == EHOSTUNREACH) { 5647 /* 5648 * Destination went 5649 * unreachable during 5650 * this send 5651 */ 5652 #ifdef SCTP_DEBUG 5653 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5654 printf("Moving data to an alterante\n"); 5655 } 5656 #endif 5657 sctp_move_to_an_alt(stcb, asoc, net); 5658 } 5659 sctp_clean_up_ctl (asoc); 5660 return (error); 5661 } else 5662 asoc->ifp_had_enobuf = 0; 5663 /* Only HB or ASCONF advances time */ 5664 if (hbflag) { 5665 if (*now_filled == 0) { 5666 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 5667 *now_filled = 1; 5668 *now = net->last_sent_time; 5669 } else { 5670 net->last_sent_time = *now; 5671 } 5672 hbflag = 0; 5673 } 5674 /* 5675 * increase the number we sent, if a 5676 * cookie is sent we don't tell them 5677 * any was sent out. 5678 */ 5679 if (!no_out_cnt) 5680 *num_out += ctl_cnt; 5681 /* recalc a clean slate and setup */ 5682 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5683 mtu = (net->mtu - SCTP_MIN_OVERHEAD); 5684 } else { 5685 mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD); 5686 } 5687 no_fragmentflg = 1; 5688 } 5689 } 5690 } 5691 /*********************/ 5692 /* Data transmission */ 5693 /*********************/ 5694 /* now lets add any data within the MTU constraints */ 5695 if (((struct sockaddr *)&net->ro.ro_sa)->sa_family == AF_INET) { 5696 omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr)); 5697 } else { 5698 omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)); 5699 } 5700 5701 #ifdef SCTP_DEBUG 5702 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5703 printf("Now to data transmission\n"); 5704 } 5705 #endif 5706 5707 if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) || 5708 (cookie)) { 5709 for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) { 5710 if (no_data_chunks) { 5711 /* let only control go out */ 5712 #ifdef SCTP_DEBUG 5713 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5714 printf("Either nothing to send or we are full\n"); 5715 } 5716 #endif 5717 break; 5718 } 5719 if (net->flight_size >= net->cwnd) { 5720 /* skip this net, no room for data */ 5721 #ifdef SCTP_DEBUG 5722 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5723 printf("fs:%d > cwnd:%d\n", 5724 net->flight_size, net->cwnd); 5725 } 5726 #endif 5727 sctp_pegs[SCTP_CWND_BLOCKED]++; 5728 *reason_code = 2; 5729 break; 5730 } 5731 nchk = TAILQ_NEXT(chk, sctp_next); 5732 if (chk->whoTo != net) { 5733 /* No, not sent to this net */ 5734 #ifdef SCTP_DEBUG 5735 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5736 printf("chk->whoTo:%p not %p\n", 5737 chk->whoTo, net); 5738 5739 } 5740 #endif 5741 continue; 5742 } 5743 #ifdef SCTP_DEBUG 5744 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5745 printf("Can we pick up a chunk?\n"); 5746 } 5747 #endif 5748 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 5749 /* strange, we have a chunk that is to bit 5750 * for its destination and yet no fragment ok flag. 5751 * Something went wrong when the PMTU changed...we did 5752 * not mark this chunk for some reason?? I will 5753 * fix it here by letting IP fragment it for now and 5754 * printing a warning. This really should not happen ... 5755 */ 5756 /*#ifdef SCTP_DEBUG*/ 5757 printf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 5758 chk->send_size, mtu); 5759 /*#endif*/ 5760 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 5761 } 5762 5763 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 5764 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 5765 /* ok we will add this one */ 5766 #ifdef SCTP_DEBUG 5767 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5768 printf("Picking up the chunk\n"); 5769 } 5770 #endif 5771 outchain = sctp_copy_mbufchain(chk->data, outchain); 5772 if (outchain == NULL) { 5773 #ifdef SCTP_DEBUG 5774 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5775 printf("Gakk no memory\n"); 5776 } 5777 #endif 5778 if (!callout_pending(&net->rxt_timer.timer)) { 5779 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 5780 } 5781 return (ENOMEM); 5782 } 5783 /* update our MTU size */ 5784 /* Do clear IP_DF ? */ 5785 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 5786 no_fragmentflg = 0; 5787 } 5788 mtu -= chk->send_size; 5789 r_mtu -= chk->send_size; 5790 data_list[bundle_at++] = chk; 5791 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 5792 mtu = 0; 5793 break; 5794 } 5795 if (mtu <= 0) { 5796 mtu = 0; 5797 break; 5798 } 5799 if ((r_mtu <= 0) || one_chunk) { 5800 r_mtu = 0; 5801 break; 5802 } 5803 } else { 5804 /* 5805 * Must be sent in order of the TSN's 5806 * (on a network) 5807 */ 5808 #ifdef SCTP_DEBUG 5809 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5810 printf("ok no more chk:%d > mtu:%d || < r_mtu:%d\n", 5811 chk->send_size, mtu, r_mtu); 5812 } 5813 #endif 5814 5815 break; 5816 } 5817 }/* for () */ 5818 } /* if asoc.state OPEN */ 5819 /* Is there something to send for this destination? */ 5820 #ifdef SCTP_DEBUG 5821 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5822 printf("ok now is chain assembled? %p\n", 5823 outchain); 5824 } 5825 #endif 5826 5827 if (outchain) { 5828 /* We may need to start a control timer or two */ 5829 if (asconf) { 5830 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 5831 asconf = 0; 5832 } 5833 if (cookie) { 5834 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 5835 cookie = 0; 5836 } 5837 /* must start a send timer if data is being sent */ 5838 if (bundle_at && (!callout_pending(&net->rxt_timer.timer))) { 5839 /* no timer running on this destination 5840 * restart it. 5841 */ 5842 #ifdef SCTP_DEBUG 5843 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5844 printf("ok lets start a send timer .. we will transmit %p\n", 5845 outchain); 5846 } 5847 #endif 5848 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 5849 } 5850 /* Now send it, if there is anything to send :> */ 5851 if ((outchain->m_flags & M_PKTHDR) == 0) { 5852 struct mbuf *t; 5853 5854 MGETHDR(t, M_DONTWAIT, MT_HEADER); 5855 if (t == NULL) { 5856 sctp_m_freem(outchain); 5857 return (ENOMEM); 5858 } 5859 t->m_next = outchain; 5860 t->m_pkthdr.len = 0; 5861 m_reset_rcvif(t); 5862 t->m_len = 0; 5863 5864 outchain = t; 5865 while (t) { 5866 outchain->m_pkthdr.len += t->m_len; 5867 t = t->m_next; 5868 } 5869 } 5870 if (outchain->m_len == 0) { 5871 /* Special case for when you get a 0 len 5872 * mbuf at the head due to the lack 5873 * of a MHDR at the beginning. 5874 */ 5875 m_align(outchain, sizeof(struct sctphdr)); 5876 outchain->m_len = sizeof(struct sctphdr); 5877 } else { 5878 M_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT); 5879 if (outchain == NULL) { 5880 /* out of mbufs */ 5881 error = ENOBUFS; 5882 goto errored_send; 5883 } 5884 } 5885 shdr = mtod(outchain, struct sctphdr *); 5886 shdr->src_port = inp->sctp_lport; 5887 shdr->dest_port = stcb->rport; 5888 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 5889 shdr->checksum = 0; 5890 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 5891 rtcache_getdst(&net->ro), 5892 outchain, 5893 no_fragmentflg, bundle_at, data_list[0], asconf))) { 5894 /* error, we could not output */ 5895 if (error == ENOBUFS) { 5896 asoc->ifp_had_enobuf = 1; 5897 } 5898 sctp_pegs[SCTP_DATA_OUT_ERR]++; 5899 if (from_where == 0) { 5900 sctp_pegs[SCTP_ERROUT_FRM_USR]++; 5901 } 5902 5903 errored_send: 5904 #ifdef SCTP_DEBUG 5905 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5906 printf("Gak send error %d\n", error); 5907 } 5908 #endif 5909 if (hbflag) { 5910 #ifdef SCTP_DEBUG 5911 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5912 printf("Update HB time anyway\n"); 5913 } 5914 #endif 5915 if (*now_filled == 0) { 5916 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 5917 *now_filled = 1; 5918 *now = net->last_sent_time; 5919 } else { 5920 net->last_sent_time = *now; 5921 } 5922 hbflag = 0; 5923 } 5924 if (error == EHOSTUNREACH) { 5925 /* 5926 * Destination went unreachable during 5927 * this send 5928 */ 5929 #ifdef SCTP_DEBUG 5930 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5931 printf("Calling the movement routine\n"); 5932 } 5933 #endif 5934 sctp_move_to_an_alt(stcb, asoc, net); 5935 } 5936 sctp_clean_up_ctl (asoc); 5937 return (error); 5938 } else { 5939 asoc->ifp_had_enobuf = 0; 5940 } 5941 if (bundle_at || hbflag) { 5942 /* For data/asconf and hb set time */ 5943 if (*now_filled == 0) { 5944 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 5945 *now_filled = 1; 5946 *now = net->last_sent_time; 5947 } else { 5948 net->last_sent_time = *now; 5949 } 5950 } 5951 5952 if (!no_out_cnt) { 5953 *num_out += (ctl_cnt + bundle_at); 5954 } 5955 if (bundle_at) { 5956 if (!net->rto_pending) { 5957 /* setup for a RTO measurement */ 5958 net->rto_pending = 1; 5959 data_list[0]->do_rtt = 1; 5960 } else { 5961 data_list[0]->do_rtt = 0; 5962 } 5963 sctp_pegs[SCTP_PEG_TSNS_SENT] += bundle_at; 5964 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 5965 } 5966 if (one_chunk) { 5967 break; 5968 } 5969 } 5970 } 5971 /* At the end there should be no NON timed 5972 * chunks hanging on this queue. 5973 */ 5974 if ((*num_out == 0) && (*reason_code == 0)) { 5975 *reason_code = 3; 5976 } 5977 sctp_clean_up_ctl (asoc); 5978 return (0); 5979 } 5980 5981 void 5982 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 5983 { 5984 /* Prepend a OPERATIONAL_ERROR chunk header 5985 * and put on the end of the control chunk queue. 5986 */ 5987 /* Sender had better have gotten a MGETHDR or else 5988 * the control chunk will be forever skipped 5989 */ 5990 struct sctp_chunkhdr *hdr; 5991 struct sctp_tmit_chunk *chk; 5992 struct mbuf *mat; 5993 5994 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 5995 if (chk == NULL) { 5996 /* no memory */ 5997 sctp_m_freem(op_err); 5998 return; 5999 } 6000 sctppcbinfo.ipi_count_chunk++; 6001 sctppcbinfo.ipi_gencnt_chunk++; 6002 M_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_DONTWAIT); 6003 if (op_err == NULL) { 6004 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 6005 sctppcbinfo.ipi_count_chunk--; 6006 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 6007 panic("Chunk count is negative"); 6008 } 6009 sctppcbinfo.ipi_gencnt_chunk++; 6010 return; 6011 } 6012 chk->send_size = 0; 6013 mat = op_err; 6014 while (mat != NULL) { 6015 chk->send_size += mat->m_len; 6016 mat = mat->m_next; 6017 } 6018 chk->rec.chunk_id = SCTP_OPERATION_ERROR; 6019 chk->sent = SCTP_DATAGRAM_UNSENT; 6020 chk->snd_count = 0; 6021 chk->flags = 0; 6022 chk->asoc = &stcb->asoc; 6023 chk->data = op_err; 6024 chk->whoTo = chk->asoc->primary_destination; 6025 chk->whoTo->ref_count++; 6026 hdr = mtod(op_err, struct sctp_chunkhdr *); 6027 hdr->chunk_type = SCTP_OPERATION_ERROR; 6028 hdr->chunk_flags = 0; 6029 hdr->chunk_length = htons(chk->send_size); 6030 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, 6031 chk, 6032 sctp_next); 6033 chk->asoc->ctrl_queue_cnt++; 6034 } 6035 6036 int 6037 sctp_send_cookie_echo(struct mbuf *m, 6038 int offset, 6039 struct sctp_tcb *stcb, 6040 struct sctp_nets *net) 6041 { 6042 /* 6043 * pull out the cookie and put it at the front of the control 6044 * chunk queue. 6045 */ 6046 int at; 6047 struct mbuf *cookie, *mat; 6048 struct sctp_paramhdr parm, *phdr; 6049 struct sctp_chunkhdr *hdr; 6050 struct sctp_tmit_chunk *chk; 6051 uint16_t ptype, plen; 6052 /* First find the cookie in the param area */ 6053 cookie = NULL; 6054 at = offset + sizeof(struct sctp_init_chunk); 6055 6056 do { 6057 phdr = sctp_get_next_param(m, at, &parm, sizeof(parm)); 6058 if (phdr == NULL) { 6059 return (-3); 6060 } 6061 ptype = ntohs(phdr->param_type); 6062 plen = ntohs(phdr->param_length); 6063 if (ptype == SCTP_STATE_COOKIE) { 6064 int pad; 6065 /* found the cookie */ 6066 if ((pad = (plen % 4))) { 6067 plen += 4 - pad; 6068 } 6069 cookie = sctp_m_copym(m, at, plen, M_DONTWAIT); 6070 if (cookie == NULL) { 6071 /* No memory */ 6072 return (-2); 6073 } 6074 break; 6075 } 6076 at += SCTP_SIZE32(plen); 6077 } while (phdr); 6078 if (cookie == NULL) { 6079 /* Did not find the cookie */ 6080 return (-3); 6081 } 6082 /* ok, we got the cookie lets change it into a cookie echo chunk */ 6083 6084 /* first the change from param to cookie */ 6085 hdr = mtod(cookie, struct sctp_chunkhdr *); 6086 hdr->chunk_type = SCTP_COOKIE_ECHO; 6087 hdr->chunk_flags = 0; 6088 /* now we MUST have a PKTHDR on it */ 6089 if ((cookie->m_flags & M_PKTHDR) != M_PKTHDR) { 6090 /* we hope this happens rarely */ 6091 MGETHDR(mat, M_DONTWAIT, MT_HEADER); 6092 if (mat == NULL) { 6093 sctp_m_freem(cookie); 6094 return (-4); 6095 } 6096 mat->m_len = 0; 6097 m_reset_rcvif(mat); 6098 mat->m_next = cookie; 6099 cookie = mat; 6100 } 6101 cookie->m_pkthdr.len = plen; 6102 /* get the chunk stuff now and place it in the FRONT of the queue */ 6103 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6104 if (chk == NULL) { 6105 /* no memory */ 6106 sctp_m_freem(cookie); 6107 return (-5); 6108 } 6109 sctppcbinfo.ipi_count_chunk++; 6110 sctppcbinfo.ipi_gencnt_chunk++; 6111 chk->send_size = cookie->m_pkthdr.len; 6112 chk->rec.chunk_id = SCTP_COOKIE_ECHO; 6113 chk->sent = SCTP_DATAGRAM_UNSENT; 6114 chk->snd_count = 0; 6115 chk->flags = 0; 6116 chk->asoc = &stcb->asoc; 6117 chk->data = cookie; 6118 chk->whoTo = chk->asoc->primary_destination; 6119 chk->whoTo->ref_count++; 6120 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 6121 chk->asoc->ctrl_queue_cnt++; 6122 return (0); 6123 } 6124 6125 void 6126 sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 6127 struct mbuf *m, 6128 int offset, 6129 int chk_length, 6130 struct sctp_nets *net) 6131 { 6132 /* take a HB request and make it into a 6133 * HB ack and send it. 6134 */ 6135 struct mbuf *outchain; 6136 struct sctp_chunkhdr *chdr; 6137 struct sctp_tmit_chunk *chk; 6138 6139 6140 if (net == NULL) 6141 /* must have a net pointer */ 6142 return; 6143 6144 outchain = sctp_m_copym(m, offset, chk_length, M_DONTWAIT); 6145 if (outchain == NULL) { 6146 /* gak out of memory */ 6147 return; 6148 } 6149 chdr = mtod(outchain, struct sctp_chunkhdr *); 6150 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 6151 chdr->chunk_flags = 0; 6152 if ((outchain->m_flags & M_PKTHDR) != M_PKTHDR) { 6153 /* should not happen but we are cautious. */ 6154 struct mbuf *tmp; 6155 MGETHDR(tmp, M_DONTWAIT, MT_HEADER); 6156 if (tmp == NULL) { 6157 return; 6158 } 6159 tmp->m_len = 0; 6160 m_reset_rcvif(tmp); 6161 tmp->m_next = outchain; 6162 outchain = tmp; 6163 } 6164 outchain->m_pkthdr.len = chk_length; 6165 if (chk_length % 4) { 6166 /* need pad */ 6167 u_int32_t cpthis=0; 6168 int padlen; 6169 padlen = 4 - (outchain->m_pkthdr.len % 4); 6170 m_copyback(outchain, outchain->m_pkthdr.len, padlen, (void *)&cpthis); 6171 } 6172 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6173 if (chk == NULL) { 6174 /* no memory */ 6175 sctp_m_freem(outchain); 6176 return ; 6177 } 6178 sctppcbinfo.ipi_count_chunk++; 6179 sctppcbinfo.ipi_gencnt_chunk++; 6180 6181 chk->send_size = chk_length; 6182 chk->rec.chunk_id = SCTP_HEARTBEAT_ACK; 6183 chk->sent = SCTP_DATAGRAM_UNSENT; 6184 chk->snd_count = 0; 6185 chk->flags = 0; 6186 chk->asoc = &stcb->asoc; 6187 chk->data = outchain; 6188 chk->whoTo = net; 6189 chk->whoTo->ref_count++; 6190 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6191 chk->asoc->ctrl_queue_cnt++; 6192 } 6193 6194 int 6195 sctp_send_cookie_ack(struct sctp_tcb *stcb) { 6196 /* formulate and queue a cookie-ack back to sender */ 6197 struct mbuf *cookie_ack; 6198 struct sctp_chunkhdr *hdr; 6199 struct sctp_tmit_chunk *chk; 6200 6201 cookie_ack = NULL; 6202 MGETHDR(cookie_ack, M_DONTWAIT, MT_HEADER); 6203 if (cookie_ack == NULL) { 6204 /* no mbuf's */ 6205 return (-1); 6206 } 6207 cookie_ack->m_data += SCTP_MIN_OVERHEAD; 6208 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6209 if (chk == NULL) { 6210 /* no memory */ 6211 sctp_m_freem(cookie_ack); 6212 return (-1); 6213 } 6214 sctppcbinfo.ipi_count_chunk++; 6215 sctppcbinfo.ipi_gencnt_chunk++; 6216 6217 chk->send_size = sizeof(struct sctp_chunkhdr); 6218 chk->rec.chunk_id = SCTP_COOKIE_ACK; 6219 chk->sent = SCTP_DATAGRAM_UNSENT; 6220 chk->snd_count = 0; 6221 chk->flags = 0; 6222 chk->asoc = &stcb->asoc; 6223 chk->data = cookie_ack; 6224 if (chk->asoc->last_control_chunk_from != NULL) { 6225 chk->whoTo = chk->asoc->last_control_chunk_from; 6226 } else { 6227 chk->whoTo = chk->asoc->primary_destination; 6228 } 6229 chk->whoTo->ref_count++; 6230 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 6231 hdr->chunk_type = SCTP_COOKIE_ACK; 6232 hdr->chunk_flags = 0; 6233 hdr->chunk_length = htons(chk->send_size); 6234 cookie_ack->m_pkthdr.len = cookie_ack->m_len = chk->send_size; 6235 m_reset_rcvif(cookie_ack); 6236 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6237 chk->asoc->ctrl_queue_cnt++; 6238 return (0); 6239 } 6240 6241 6242 int 6243 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 6244 { 6245 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 6246 struct mbuf *m_shutdown_ack; 6247 struct sctp_shutdown_ack_chunk *ack_cp; 6248 struct sctp_tmit_chunk *chk; 6249 6250 m_shutdown_ack = NULL; 6251 MGETHDR(m_shutdown_ack, M_DONTWAIT, MT_HEADER); 6252 if (m_shutdown_ack == NULL) { 6253 /* no mbuf's */ 6254 return (-1); 6255 } 6256 m_shutdown_ack->m_data += SCTP_MIN_OVERHEAD; 6257 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6258 if (chk == NULL) { 6259 /* no memory */ 6260 sctp_m_freem(m_shutdown_ack); 6261 return (-1); 6262 } 6263 sctppcbinfo.ipi_count_chunk++; 6264 sctppcbinfo.ipi_gencnt_chunk++; 6265 6266 chk->send_size = sizeof(struct sctp_chunkhdr); 6267 chk->rec.chunk_id = SCTP_SHUTDOWN_ACK; 6268 chk->sent = SCTP_DATAGRAM_UNSENT; 6269 chk->snd_count = 0; 6270 chk->flags = 0; 6271 chk->asoc = &stcb->asoc; 6272 chk->data = m_shutdown_ack; 6273 chk->whoTo = net; 6274 net->ref_count++; 6275 6276 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 6277 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 6278 ack_cp->ch.chunk_flags = 0; 6279 ack_cp->ch.chunk_length = htons(chk->send_size); 6280 m_shutdown_ack->m_pkthdr.len = m_shutdown_ack->m_len = chk->send_size; 6281 m_reset_rcvif(m_shutdown_ack); 6282 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6283 chk->asoc->ctrl_queue_cnt++; 6284 return (0); 6285 } 6286 6287 int 6288 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 6289 { 6290 /* formulate and queue a SHUTDOWN to the sender */ 6291 struct mbuf *m_shutdown; 6292 struct sctp_shutdown_chunk *shutdown_cp; 6293 struct sctp_tmit_chunk *chk; 6294 6295 m_shutdown = NULL; 6296 MGETHDR(m_shutdown, M_DONTWAIT, MT_HEADER); 6297 if (m_shutdown == NULL) { 6298 /* no mbuf's */ 6299 return (-1); 6300 } 6301 m_shutdown->m_data += SCTP_MIN_OVERHEAD; 6302 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6303 if (chk == NULL) { 6304 /* no memory */ 6305 sctp_m_freem(m_shutdown); 6306 return (-1); 6307 } 6308 sctppcbinfo.ipi_count_chunk++; 6309 sctppcbinfo.ipi_gencnt_chunk++; 6310 6311 chk->send_size = sizeof(struct sctp_shutdown_chunk); 6312 chk->rec.chunk_id = SCTP_SHUTDOWN; 6313 chk->sent = SCTP_DATAGRAM_UNSENT; 6314 chk->snd_count = 0; 6315 chk->flags = 0; 6316 chk->asoc = &stcb->asoc; 6317 chk->data = m_shutdown; 6318 chk->whoTo = net; 6319 net->ref_count++; 6320 6321 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 6322 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 6323 shutdown_cp->ch.chunk_flags = 0; 6324 shutdown_cp->ch.chunk_length = htons(chk->send_size); 6325 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 6326 m_shutdown->m_pkthdr.len = m_shutdown->m_len = chk->send_size; 6327 m_reset_rcvif(m_shutdown); 6328 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6329 chk->asoc->ctrl_queue_cnt++; 6330 6331 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 6332 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 6333 stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 6334 soisdisconnecting(stcb->sctp_ep->sctp_socket); 6335 } 6336 return (0); 6337 } 6338 6339 int 6340 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net) 6341 { 6342 /* 6343 * formulate and queue an ASCONF to the peer 6344 * ASCONF parameters should be queued on the assoc queue 6345 */ 6346 struct sctp_tmit_chunk *chk; 6347 struct mbuf *m_asconf; 6348 6349 /* compose an ASCONF chunk, maximum length is PMTU */ 6350 m_asconf = sctp_compose_asconf(stcb); 6351 if (m_asconf == NULL) { 6352 return (-1); 6353 } 6354 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6355 if (chk == NULL) { 6356 /* no memory */ 6357 sctp_m_freem(m_asconf); 6358 return (-1); 6359 } 6360 sctppcbinfo.ipi_count_chunk++; 6361 sctppcbinfo.ipi_gencnt_chunk++; 6362 6363 chk->data = m_asconf; 6364 chk->send_size = m_asconf->m_pkthdr.len; 6365 chk->rec.chunk_id = SCTP_ASCONF; 6366 chk->sent = SCTP_DATAGRAM_UNSENT; 6367 chk->snd_count = 0; 6368 chk->flags = 0; 6369 chk->asoc = &stcb->asoc; 6370 chk->whoTo = chk->asoc->primary_destination; 6371 chk->whoTo->ref_count++; 6372 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6373 chk->asoc->ctrl_queue_cnt++; 6374 return (0); 6375 } 6376 6377 int 6378 sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans) 6379 { 6380 /* 6381 * formulate and queue a asconf-ack back to sender 6382 * the asconf-ack must be stored in the tcb 6383 */ 6384 struct sctp_tmit_chunk *chk; 6385 struct mbuf *m_ack; 6386 6387 /* is there a asconf-ack mbuf chain to send? */ 6388 if (stcb->asoc.last_asconf_ack_sent == NULL) { 6389 return (-1); 6390 } 6391 6392 /* copy the asconf_ack */ 6393 #if defined(__FreeBSD__) || defined(__NetBSD__) 6394 /* Supposedly the m_copypacket is a optimzation, 6395 * use it if we can. 6396 */ 6397 if (stcb->asoc.last_asconf_ack_sent->m_flags & M_PKTHDR) { 6398 m_ack = m_copypacket(stcb->asoc.last_asconf_ack_sent, M_DONTWAIT); 6399 sctp_pegs[SCTP_CACHED_SRC]++; 6400 } else 6401 m_ack = m_copym(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL, M_DONTWAIT); 6402 #else 6403 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL); 6404 #endif 6405 if (m_ack == NULL) { 6406 /* couldn't copy it */ 6407 6408 return (-1); 6409 } 6410 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6411 if (chk == NULL) { 6412 /* no memory */ 6413 if (m_ack) 6414 sctp_m_freem(m_ack); 6415 return (-1); 6416 } 6417 sctppcbinfo.ipi_count_chunk++; 6418 sctppcbinfo.ipi_gencnt_chunk++; 6419 6420 /* figure out where it goes to */ 6421 if (retrans) { 6422 /* we're doing a retransmission */ 6423 if (stcb->asoc.used_alt_asconfack > 2) { 6424 /* tried alternate nets already, go back */ 6425 chk->whoTo = NULL; 6426 } else { 6427 /* need to try and alternate net */ 6428 chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from); 6429 stcb->asoc.used_alt_asconfack++; 6430 } 6431 if (chk->whoTo == NULL) { 6432 /* no alternate */ 6433 if (stcb->asoc.last_control_chunk_from == NULL) 6434 chk->whoTo = stcb->asoc.primary_destination; 6435 else 6436 chk->whoTo = stcb->asoc.last_control_chunk_from; 6437 stcb->asoc.used_alt_asconfack = 0; 6438 } 6439 } else { 6440 /* normal case */ 6441 if (stcb->asoc.last_control_chunk_from == NULL) 6442 chk->whoTo = stcb->asoc.primary_destination; 6443 else 6444 chk->whoTo = stcb->asoc.last_control_chunk_from; 6445 stcb->asoc.used_alt_asconfack = 0; 6446 } 6447 chk->data = m_ack; 6448 chk->send_size = m_ack->m_pkthdr.len; 6449 chk->rec.chunk_id = SCTP_ASCONF_ACK; 6450 chk->sent = SCTP_DATAGRAM_UNSENT; 6451 chk->snd_count = 0; 6452 chk->flags = 0; 6453 chk->asoc = &stcb->asoc; 6454 chk->whoTo->ref_count++; 6455 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6456 chk->asoc->ctrl_queue_cnt++; 6457 return (0); 6458 } 6459 6460 6461 static int 6462 sctp_chunk_retransmission(struct sctp_inpcb *inp, 6463 struct sctp_tcb *stcb, 6464 struct sctp_association *asoc, 6465 int *cnt_out, struct timeval *now, int *now_filled) 6466 { 6467 /* 6468 * send out one MTU of retransmission. 6469 * If fast_retransmit is happening we ignore the cwnd. 6470 * Otherwise we obey the cwnd and rwnd. 6471 * For a Cookie or Asconf in the control chunk queue we retransmit 6472 * them by themselves. 6473 * 6474 * For data chunks we will pick out the lowest TSN's in the 6475 * sent_queue marked for resend and bundle them all together 6476 * (up to a MTU of destination). The address to send to should 6477 * have been selected/changed where the retransmission was 6478 * marked (i.e. in FR or t3-timeout routines). 6479 */ 6480 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 6481 struct sctp_tmit_chunk *chk, *fwd; 6482 struct mbuf *m; 6483 struct sctphdr *shdr; 6484 int asconf; 6485 struct sctp_nets *net; 6486 int no_fragmentflg, bundle_at, cnt_thru; 6487 unsigned int mtu; 6488 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 6489 6490 tmr_started = ctl_cnt = bundle_at = error = 0; 6491 no_fragmentflg = 1; 6492 asconf = 0; 6493 fwd_tsn = 0; 6494 *cnt_out = 0; 6495 fwd = NULL; 6496 m = NULL; 6497 #ifdef SCTP_AUDITING_ENABLED 6498 sctp_audit_log(0xC3, 1); 6499 #endif 6500 if (TAILQ_EMPTY(&asoc->sent_queue)) { 6501 #ifdef SCTP_DEBUG 6502 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6503 printf("SCTP hits empty queue with cnt set to %d?\n", 6504 asoc->sent_queue_retran_cnt); 6505 } 6506 #endif 6507 asoc->sent_queue_cnt = 0; 6508 asoc->sent_queue_cnt_removeable = 0; 6509 } 6510 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 6511 if (chk->sent != SCTP_DATAGRAM_RESEND) { 6512 /* we only worry about things marked for resend */ 6513 continue; 6514 } 6515 if ((chk->rec.chunk_id == SCTP_COOKIE_ECHO) || 6516 (chk->rec.chunk_id == SCTP_ASCONF) || 6517 (chk->rec.chunk_id == SCTP_STREAM_RESET) || 6518 (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN)) { 6519 if (chk->rec.chunk_id == SCTP_STREAM_RESET) { 6520 /* For stream reset we only retran the request 6521 * not the response. 6522 */ 6523 struct sctp_stream_reset_req *strreq; 6524 strreq = mtod(chk->data, struct sctp_stream_reset_req *); 6525 if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) { 6526 continue; 6527 } 6528 } 6529 ctl_cnt++; 6530 if (chk->rec.chunk_id == SCTP_ASCONF) { 6531 no_fragmentflg = 1; 6532 asconf = 1; 6533 } 6534 if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) { 6535 fwd_tsn = 1; 6536 fwd = chk; 6537 } 6538 m = sctp_copy_mbufchain(chk->data, m); 6539 break; 6540 } 6541 } 6542 one_chunk = 0; 6543 cnt_thru = 0; 6544 /* do we have control chunks to retransmit? */ 6545 if (m != NULL) { 6546 /* Start a timer no matter if we suceed or fail */ 6547 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) { 6548 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 6549 } else if (chk->rec.chunk_id == SCTP_ASCONF) 6550 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 6551 6552 if (m->m_len == 0) { 6553 /* Special case for when you get a 0 len 6554 * mbuf at the head due to the lack 6555 * of a MHDR at the beginning. 6556 */ 6557 m->m_len = sizeof(struct sctphdr); 6558 } else { 6559 M_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT); 6560 if (m == NULL) { 6561 return (ENOBUFS); 6562 } 6563 } 6564 shdr = mtod(m, struct sctphdr *); 6565 shdr->src_port = inp->sctp_lport; 6566 shdr->dest_port = stcb->rport; 6567 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 6568 shdr->checksum = 0; 6569 chk->snd_count++; /* update our count */ 6570 6571 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 6572 rtcache_getdst(&chk->whoTo->ro), m, 6573 no_fragmentflg, 0, NULL, asconf))) { 6574 sctp_pegs[SCTP_DATA_OUT_ERR]++; 6575 return (error); 6576 } 6577 /* 6578 *We don't want to mark the net->sent time here since this 6579 * we use this for HB and retrans cannot measure RTT 6580 */ 6581 /* SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time);*/ 6582 *cnt_out += 1; 6583 chk->sent = SCTP_DATAGRAM_SENT; 6584 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 6585 if (fwd_tsn == 0) { 6586 return (0); 6587 } else { 6588 /* Clean up the fwd-tsn list */ 6589 sctp_clean_up_ctl (asoc); 6590 return (0); 6591 } 6592 } 6593 /* Ok, it is just data retransmission we need to do or 6594 * that and a fwd-tsn with it all. 6595 */ 6596 if (TAILQ_EMPTY(&asoc->sent_queue)) { 6597 return (-1); 6598 } 6599 #ifdef SCTP_DEBUG 6600 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6601 printf("Normal chunk retransmission cnt:%d\n", 6602 asoc->sent_queue_retran_cnt); 6603 } 6604 #endif 6605 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) || 6606 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) { 6607 /* not yet open, resend the cookie and that is it */ 6608 return (1); 6609 } 6610 6611 6612 #ifdef SCTP_AUDITING_ENABLED 6613 sctp_auditing(20, inp, stcb, NULL); 6614 #endif 6615 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6616 if (chk->sent != SCTP_DATAGRAM_RESEND) { 6617 /* No, not sent to this net or not ready for rtx */ 6618 continue; 6619 6620 } 6621 /* pick up the net */ 6622 net = chk->whoTo; 6623 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6624 mtu = (net->mtu - SCTP_MIN_OVERHEAD); 6625 } else { 6626 mtu = net->mtu- SCTP_MIN_V4_OVERHEAD; 6627 } 6628 6629 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 6630 /* No room in peers rwnd */ 6631 uint32_t tsn; 6632 tsn = asoc->last_acked_seq + 1; 6633 if (tsn == chk->rec.data.TSN_seq) { 6634 /* we make a special exception for this case. 6635 * The peer has no rwnd but is missing the 6636 * lowest chunk.. which is probably what is 6637 * holding up the rwnd. 6638 */ 6639 goto one_chunk_around; 6640 } 6641 #ifdef SCTP_DEBUG 6642 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6643 printf("blocked-peers_rwnd:%d tf:%d\n", 6644 (int)asoc->peers_rwnd, 6645 (int)asoc->total_flight); 6646 } 6647 #endif 6648 sctp_pegs[SCTP_RWND_BLOCKED]++; 6649 return (1); 6650 } 6651 one_chunk_around: 6652 if (asoc->peers_rwnd < mtu) { 6653 one_chunk = 1; 6654 } 6655 #ifdef SCTP_AUDITING_ENABLED 6656 sctp_audit_log(0xC3, 2); 6657 #endif 6658 bundle_at = 0; 6659 m = NULL; 6660 net->fast_retran_ip = 0; 6661 if (chk->rec.data.doing_fast_retransmit == 0) { 6662 /* if no FR in progress skip destination that 6663 * have flight_size > cwnd. 6664 */ 6665 if (net->flight_size >= net->cwnd) { 6666 sctp_pegs[SCTP_CWND_BLOCKED]++; 6667 continue; 6668 } 6669 } else { 6670 /* Mark the destination net to have FR recovery 6671 * limits put on it. 6672 */ 6673 net->fast_retran_ip = 1; 6674 } 6675 6676 if ((chk->send_size <= mtu) || (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 6677 /* ok we will add this one */ 6678 m = sctp_copy_mbufchain(chk->data, m); 6679 if (m == NULL) { 6680 return (ENOMEM); 6681 } 6682 /* update our MTU size */ 6683 /* Do clear IP_DF ? */ 6684 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 6685 no_fragmentflg = 0; 6686 } 6687 mtu -= chk->send_size; 6688 data_list[bundle_at++] = chk; 6689 if (one_chunk && (asoc->total_flight <= 0)) { 6690 sctp_pegs[SCTP_WINDOW_PROBES]++; 6691 chk->rec.data.state_flags |= SCTP_WINDOW_PROBE; 6692 } 6693 } 6694 if (one_chunk == 0) { 6695 /* now are there anymore forward from chk to pick up?*/ 6696 fwd = TAILQ_NEXT(chk, sctp_next); 6697 while (fwd) { 6698 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 6699 /* Nope, not for retran */ 6700 fwd = TAILQ_NEXT(fwd, sctp_next); 6701 continue; 6702 } 6703 if (fwd->whoTo != net) { 6704 /* Nope, not the net in question */ 6705 fwd = TAILQ_NEXT(fwd, sctp_next); 6706 continue; 6707 } 6708 if (fwd->send_size <= mtu) { 6709 m = sctp_copy_mbufchain(fwd->data, m); 6710 if (m == NULL) { 6711 return (ENOMEM); 6712 } 6713 /* update our MTU size */ 6714 /* Do clear IP_DF ? */ 6715 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 6716 no_fragmentflg = 0; 6717 } 6718 mtu -= fwd->send_size; 6719 data_list[bundle_at++] = fwd; 6720 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 6721 break; 6722 } 6723 fwd = TAILQ_NEXT(fwd, sctp_next); 6724 } else { 6725 /* can't fit so we are done */ 6726 break; 6727 } 6728 } 6729 } 6730 /* Is there something to send for this destination? */ 6731 if (m) { 6732 /* No matter if we fail/or suceed we should 6733 * start a timer. A failure is like a lost 6734 * IP packet :-) 6735 */ 6736 if (!callout_pending(&net->rxt_timer.timer)) { 6737 /* no timer running on this destination 6738 * restart it. 6739 */ 6740 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 6741 tmr_started = 1; 6742 } 6743 if (m->m_len == 0) { 6744 /* Special case for when you get a 0 len 6745 * mbuf at the head due to the lack 6746 * of a MHDR at the beginning. 6747 */ 6748 m->m_len = sizeof(struct sctphdr); 6749 } else { 6750 M_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT); 6751 if (m == NULL) { 6752 return (ENOBUFS); 6753 } 6754 } 6755 shdr = mtod(m, struct sctphdr *); 6756 shdr->src_port = inp->sctp_lport; 6757 shdr->dest_port = stcb->rport; 6758 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 6759 shdr->checksum = 0; 6760 6761 /* Now lets send it, if there is anything to send :> */ 6762 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 6763 rtcache_getdst(&net->ro), 6764 m, 6765 no_fragmentflg, 0, NULL, asconf))) { 6766 /* error, we could not output */ 6767 sctp_pegs[SCTP_DATA_OUT_ERR]++; 6768 return (error); 6769 } 6770 /* For HB's */ 6771 /* 6772 * We don't want to mark the net->sent time here since 6773 * this we use this for HB and retrans cannot measure 6774 * RTT 6775 */ 6776 /* SCTP_GETTIME_TIMEVAL(&net->last_sent_time);*/ 6777 6778 /* For auto-close */ 6779 cnt_thru++; 6780 if (*now_filled == 0) { 6781 SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 6782 *now = asoc->time_last_sent; 6783 *now_filled = 1; 6784 } else { 6785 asoc->time_last_sent = *now; 6786 } 6787 *cnt_out += bundle_at; 6788 #ifdef SCTP_AUDITING_ENABLED 6789 sctp_audit_log(0xC4, bundle_at); 6790 #endif 6791 for (i = 0; i < bundle_at; i++) { 6792 sctp_pegs[SCTP_RETRANTSN_SENT]++; 6793 data_list[i]->sent = SCTP_DATAGRAM_SENT; 6794 data_list[i]->snd_count++; 6795 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 6796 /* record the time */ 6797 data_list[i]->sent_rcv_time = asoc->time_last_sent; 6798 net->flight_size += data_list[i]->book_size; 6799 asoc->total_flight += data_list[i]->book_size; 6800 asoc->total_flight_count++; 6801 6802 #ifdef SCTP_LOG_RWND 6803 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 6804 asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh); 6805 #endif 6806 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 6807 (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh)); 6808 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 6809 /* SWS sender side engages */ 6810 asoc->peers_rwnd = 0; 6811 } 6812 6813 if ((i == 0) && 6814 (data_list[i]->rec.data.doing_fast_retransmit)) { 6815 sctp_pegs[SCTP_FAST_RETRAN]++; 6816 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 6817 (tmr_started == 0)) { 6818 /* 6819 * ok we just fast-retrans'd 6820 * the lowest TSN, i.e the 6821 * first on the list. In this 6822 * case we want to give some 6823 * more time to get a SACK 6824 * back without a t3-expiring. 6825 */ 6826 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 6827 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 6828 } 6829 } 6830 } 6831 #ifdef SCTP_AUDITING_ENABLED 6832 sctp_auditing(21, inp, stcb, NULL); 6833 #endif 6834 } else { 6835 /* None will fit */ 6836 return (1); 6837 } 6838 if (asoc->sent_queue_retran_cnt <= 0) { 6839 /* all done we have no more to retran */ 6840 asoc->sent_queue_retran_cnt = 0; 6841 break; 6842 } 6843 if (one_chunk) { 6844 /* No more room in rwnd */ 6845 return (1); 6846 } 6847 /* stop the for loop here. we sent out a packet */ 6848 break; 6849 } 6850 return (0); 6851 } 6852 6853 6854 static int 6855 sctp_timer_validation(struct sctp_inpcb *inp, 6856 struct sctp_tcb *stcb, 6857 struct sctp_association *asoc, 6858 int ret) 6859 { 6860 struct sctp_nets *net; 6861 /* Validate that a timer is running somewhere */ 6862 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 6863 if (callout_pending(&net->rxt_timer.timer)) { 6864 /* Here is a timer */ 6865 return (ret); 6866 } 6867 } 6868 /* Gak, we did not have a timer somewhere */ 6869 #ifdef SCTP_DEBUG 6870 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 6871 printf("Deadlock avoided starting timer on a dest at retran\n"); 6872 } 6873 #endif 6874 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 6875 return (ret); 6876 } 6877 6878 int 6879 sctp_chunk_output(struct sctp_inpcb *inp, 6880 struct sctp_tcb *stcb, 6881 int from_where) 6882 { 6883 /* Ok this is the generic chunk service queue. 6884 * we must do the following: 6885 * - See if there are retransmits pending, if so we 6886 * must do these first and return. 6887 * - Service the stream queue that is next, 6888 * moving any message (note I must get a complete 6889 * message i.e. FIRST/MIDDLE and LAST to the out 6890 * queue in one pass) and assigning TSN's 6891 * - Check to see if the cwnd/rwnd allows any output, if 6892 * so we go ahead and fomulate and send the low level 6893 * chunks. Making sure to combine any control in the 6894 * control chunk queue also. 6895 */ 6896 struct sctp_association *asoc; 6897 struct sctp_nets *net; 6898 int error, num_out, tot_out, ret, reason_code, burst_cnt, burst_limit; 6899 struct timeval now; 6900 int now_filled=0; 6901 int cwnd_full=0; 6902 asoc = &stcb->asoc; 6903 tot_out = 0; 6904 num_out = 0; 6905 reason_code = 0; 6906 sctp_pegs[SCTP_CALLS_TO_CO]++; 6907 #ifdef SCTP_DEBUG 6908 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 6909 printf("in co - retran count:%d\n", asoc->sent_queue_retran_cnt); 6910 } 6911 #endif 6912 while (asoc->sent_queue_retran_cnt) { 6913 /* Ok, it is retransmission time only, we send out only ONE 6914 * packet with a single call off to the retran code. 6915 */ 6916 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled); 6917 if (ret > 0) { 6918 /* Can't send anymore */ 6919 #ifdef SCTP_DEBUG 6920 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6921 printf("retransmission ret:%d -- full\n", ret); 6922 } 6923 #endif 6924 /* 6925 * now lets push out control by calling med-level 6926 * output once. this assures that we WILL send HB's 6927 * if queued too. 6928 */ 6929 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 6930 &cwnd_full, from_where, 6931 &now, &now_filled); 6932 #ifdef SCTP_DEBUG 6933 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6934 printf("Control send outputs:%d@full\n", num_out); 6935 } 6936 #endif 6937 #ifdef SCTP_AUDITING_ENABLED 6938 sctp_auditing(8, inp, stcb, NULL); 6939 #endif 6940 return (sctp_timer_validation(inp, stcb, asoc, ret)); 6941 } 6942 if (ret < 0) { 6943 /* 6944 * The count was off.. retran is not happening so do 6945 * the normal retransmission. 6946 */ 6947 #ifdef SCTP_DEBUG 6948 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6949 printf("Done with retrans, none left fill up window\n"); 6950 } 6951 #endif 6952 #ifdef SCTP_AUDITING_ENABLED 6953 sctp_auditing(9, inp, stcb, NULL); 6954 #endif 6955 break; 6956 } 6957 if (from_where == 1) { 6958 /* Only one transmission allowed out of a timeout */ 6959 #ifdef SCTP_DEBUG 6960 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6961 printf("Only one packet allowed out\n"); 6962 } 6963 #endif 6964 #ifdef SCTP_AUDITING_ENABLED 6965 sctp_auditing(10, inp, stcb, NULL); 6966 #endif 6967 /* Push out any control */ 6968 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where, 6969 &now, &now_filled); 6970 return (ret); 6971 } 6972 if ((num_out == 0) && (ret == 0)) { 6973 /* No more retrans to send */ 6974 break; 6975 } 6976 } 6977 #ifdef SCTP_AUDITING_ENABLED 6978 sctp_auditing(12, inp, stcb, NULL); 6979 #endif 6980 /* Check for bad destinations, if they exist move chunks around. */ 6981 burst_limit = asoc->max_burst; 6982 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 6983 if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) == 6984 SCTP_ADDR_NOT_REACHABLE) { 6985 /* 6986 * if possible move things off of this address 6987 * we still may send below due to the dormant state 6988 * but we try to find an alternate address to send 6989 * to and if we have one we move all queued data on 6990 * the out wheel to this alternate address. 6991 */ 6992 sctp_move_to_an_alt(stcb, asoc, net); 6993 } else { 6994 /* 6995 if ((asoc->sat_network) || (net->addr_is_local)) { 6996 burst_limit = asoc->max_burst * SCTP_SAT_NETWORK_BURST_INCR; 6997 } 6998 */ 6999 #ifdef SCTP_DEBUG 7000 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 7001 printf("examined net:%p burst limit:%d\n", net, asoc->max_burst); 7002 } 7003 #endif 7004 7005 #ifdef SCTP_USE_ALLMAN_BURST 7006 if ((net->flight_size+(burst_limit*net->mtu)) < net->cwnd) { 7007 if (net->ssthresh < net->cwnd) 7008 net->ssthresh = net->cwnd; 7009 net->cwnd = (net->flight_size+(burst_limit*net->mtu)); 7010 #ifdef SCTP_LOG_MAXBURST 7011 sctp_log_maxburst(net, 0, burst_limit, SCTP_MAX_BURST_APPLIED); 7012 #endif 7013 sctp_pegs[SCTP_MAX_BURST_APL]++; 7014 } 7015 net->fast_retran_ip = 0; 7016 #endif 7017 } 7018 7019 } 7020 /* Fill up what we can to the destination */ 7021 burst_cnt = 0; 7022 cwnd_full = 0; 7023 do { 7024 #ifdef SCTP_DEBUG 7025 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 7026 printf("Burst count:%d - call m-c-o\n", burst_cnt); 7027 } 7028 #endif 7029 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 7030 &reason_code, 0, &cwnd_full, from_where, 7031 &now, &now_filled); 7032 if (error) { 7033 #ifdef SCTP_DEBUG 7034 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7035 printf("Error %d was returned from med-c-op\n", error); 7036 } 7037 #endif 7038 #ifdef SCTP_LOG_MAXBURST 7039 sctp_log_maxburst(asoc->primary_destination, error , burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 7040 #endif 7041 break; 7042 } 7043 #ifdef SCTP_DEBUG 7044 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 7045 printf("m-c-o put out %d\n", num_out); 7046 } 7047 #endif 7048 tot_out += num_out; 7049 burst_cnt++; 7050 } while (num_out 7051 #ifndef SCTP_USE_ALLMAN_BURST 7052 && (burst_cnt < burst_limit) 7053 #endif 7054 ); 7055 #ifndef SCTP_USE_ALLMAN_BURST 7056 if (burst_cnt >= burst_limit) { 7057 sctp_pegs[SCTP_MAX_BURST_APL]++; 7058 asoc->burst_limit_applied = 1; 7059 #ifdef SCTP_LOG_MAXBURST 7060 sctp_log_maxburst(asoc->primary_destination, 0 , burst_cnt, SCTP_MAX_BURST_APPLIED); 7061 #endif 7062 } else { 7063 asoc->burst_limit_applied = 0; 7064 } 7065 #endif 7066 7067 #ifdef SCTP_DEBUG 7068 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7069 printf("Ok, we have put out %d chunks\n", tot_out); 7070 } 7071 #endif 7072 if (tot_out == 0) { 7073 sctp_pegs[SCTP_CO_NODATASNT]++; 7074 if (asoc->stream_queue_cnt > 0) { 7075 sctp_pegs[SCTP_SOS_NOSNT]++; 7076 } else { 7077 sctp_pegs[SCTP_NOS_NOSNT]++; 7078 } 7079 if (asoc->send_queue_cnt > 0) { 7080 sctp_pegs[SCTP_SOSE_NOSNT]++; 7081 } else { 7082 sctp_pegs[SCTP_NOSE_NOSNT]++; 7083 } 7084 } 7085 /* Now we need to clean up the control chunk chain if 7086 * a ECNE is on it. It must be marked as UNSENT again 7087 * so next call will continue to send it until 7088 * such time that we get a CWR, to remove it. 7089 */ 7090 sctp_fix_ecn_echo(asoc); 7091 return (error); 7092 } 7093 7094 7095 int 7096 sctp_output(struct sctp_inpcb *inp, struct mbuf *m, 7097 struct sockaddr *addr, struct mbuf *control, struct lwp *l, int flags) 7098 { 7099 struct sctp_inpcb *t_inp; 7100 struct sctp_tcb *stcb; 7101 struct sctp_nets *net; 7102 struct sctp_association *asoc; 7103 int create_lock_applied = 0; 7104 int queue_only, error = 0; 7105 struct sctp_sndrcvinfo srcv; 7106 int un_sent = 0; 7107 int use_rcvinfo = 0; 7108 t_inp = inp; 7109 /* struct route ro;*/ 7110 7111 queue_only = 0; 7112 stcb = NULL; 7113 asoc = NULL; 7114 net = NULL; 7115 7116 #ifdef SCTP_DEBUG 7117 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7118 printf("USR Send BEGINS\n"); 7119 } 7120 #endif 7121 7122 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 7123 (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) { 7124 /* The listner can NOT send */ 7125 if (control) { 7126 sctppcbinfo.mbuf_track--; 7127 sctp_m_freem(control); 7128 control = NULL; 7129 } 7130 sctp_m_freem(m); 7131 return (EFAULT); 7132 } 7133 /* Can't allow a V6 address on a non-v6 socket */ 7134 if (addr) { 7135 SCTP_ASOC_CREATE_LOCK(inp); 7136 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 7137 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 7138 /* Should I really unlock ? */ 7139 SCTP_ASOC_CREATE_UNLOCK(inp); 7140 if (control) { 7141 sctppcbinfo.mbuf_track--; 7142 sctp_m_freem(control); 7143 control = NULL; 7144 } 7145 sctp_m_freem(m); 7146 return (EFAULT); 7147 } 7148 create_lock_applied = 1; 7149 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 7150 (addr->sa_family == AF_INET6)) { 7151 SCTP_ASOC_CREATE_UNLOCK(inp); 7152 if (control) { 7153 sctppcbinfo.mbuf_track--; 7154 sctp_m_freem(control); 7155 control = NULL; 7156 } 7157 sctp_m_freem(m); 7158 return (EINVAL); 7159 } 7160 } 7161 if (control) { 7162 sctppcbinfo.mbuf_track++; 7163 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control, 7164 sizeof(srcv))) { 7165 if (srcv.sinfo_flags & SCTP_SENDALL) { 7166 /* its a sendall */ 7167 sctppcbinfo.mbuf_track--; 7168 sctp_m_freem(control); 7169 if (create_lock_applied) { 7170 SCTP_ASOC_CREATE_UNLOCK(inp); 7171 create_lock_applied = 0; 7172 } 7173 return (sctp_sendall(inp, NULL, m, &srcv)); 7174 } 7175 if (srcv.sinfo_assoc_id) { 7176 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 7177 SCTP_INP_RLOCK(inp); 7178 stcb = LIST_FIRST(&inp->sctp_asoc_list); 7179 if (stcb) { 7180 SCTP_TCB_LOCK(stcb); 7181 } 7182 SCTP_INP_RUNLOCK(inp); 7183 7184 if (stcb == NULL) { 7185 if (create_lock_applied) { 7186 SCTP_ASOC_CREATE_UNLOCK(inp); 7187 create_lock_applied = 0; 7188 } 7189 sctppcbinfo.mbuf_track--; 7190 sctp_m_freem(control); 7191 sctp_m_freem(m); 7192 return (ENOTCONN); 7193 } 7194 net = stcb->asoc.primary_destination; 7195 } else { 7196 stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id); 7197 } 7198 /* 7199 * Question: Should I error here if the 7200 7201 * assoc_id is no longer valid? 7202 * i.e. I can't find it? 7203 */ 7204 if ((stcb) && 7205 (addr != NULL)) { 7206 /* Must locate the net structure */ 7207 if (addr) 7208 net = sctp_findnet(stcb, addr); 7209 } 7210 if (net == NULL) 7211 net = stcb->asoc.primary_destination; 7212 } 7213 use_rcvinfo = 1; 7214 } 7215 } 7216 if (stcb == NULL) { 7217 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 7218 SCTP_INP_RLOCK(inp); 7219 stcb = LIST_FIRST(&inp->sctp_asoc_list); 7220 if (stcb) { 7221 SCTP_TCB_LOCK(stcb); 7222 } 7223 SCTP_INP_RUNLOCK(inp); 7224 if (stcb == NULL) { 7225 if (create_lock_applied) { 7226 SCTP_ASOC_CREATE_UNLOCK(inp); 7227 create_lock_applied = 0; 7228 } 7229 if (control) { 7230 sctppcbinfo.mbuf_track--; 7231 sctp_m_freem(control); 7232 control = NULL; 7233 } 7234 sctp_m_freem(m); 7235 return (ENOTCONN); 7236 } 7237 if (addr == NULL) { 7238 net = stcb->asoc.primary_destination; 7239 } else { 7240 net = sctp_findnet(stcb, addr); 7241 if (net == NULL) { 7242 net = stcb->asoc.primary_destination; 7243 } 7244 } 7245 } else { 7246 if (addr != NULL) { 7247 SCTP_INP_WLOCK(inp); 7248 SCTP_INP_INCR_REF(inp); 7249 SCTP_INP_WUNLOCK(inp); 7250 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 7251 if (stcb == NULL) { 7252 SCTP_INP_WLOCK(inp); 7253 SCTP_INP_DECR_REF(inp); 7254 SCTP_INP_WUNLOCK(inp); 7255 } 7256 } 7257 } 7258 } 7259 if ((stcb == NULL) && 7260 (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) { 7261 if (control) { 7262 sctppcbinfo.mbuf_track--; 7263 sctp_m_freem(control); 7264 control = NULL; 7265 } 7266 if (create_lock_applied) { 7267 SCTP_ASOC_CREATE_UNLOCK(inp); 7268 create_lock_applied = 0; 7269 } 7270 sctp_m_freem(m); 7271 return (ENOTCONN); 7272 } else if ((stcb == NULL) && 7273 (addr == NULL)) { 7274 if (control) { 7275 sctppcbinfo.mbuf_track--; 7276 sctp_m_freem(control); 7277 control = NULL; 7278 } 7279 if (create_lock_applied) { 7280 SCTP_ASOC_CREATE_UNLOCK(inp); 7281 create_lock_applied = 0; 7282 } 7283 sctp_m_freem(m); 7284 return (ENOENT); 7285 } else if (stcb == NULL) { 7286 /* UDP mode, we must go ahead and start the INIT process */ 7287 if ((use_rcvinfo) && (srcv.sinfo_flags & SCTP_ABORT)) { 7288 /* Strange user to do this */ 7289 if (control) { 7290 sctppcbinfo.mbuf_track--; 7291 sctp_m_freem(control); 7292 control = NULL; 7293 } 7294 if (create_lock_applied) { 7295 SCTP_ASOC_CREATE_UNLOCK(inp); 7296 create_lock_applied = 0; 7297 } 7298 sctp_m_freem(m); 7299 return (ENOENT); 7300 } 7301 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0); 7302 if (stcb == NULL) { 7303 if (control) { 7304 sctppcbinfo.mbuf_track--; 7305 sctp_m_freem(control); 7306 control = NULL; 7307 } 7308 if (create_lock_applied) { 7309 SCTP_ASOC_CREATE_UNLOCK(inp); 7310 create_lock_applied = 0; 7311 } 7312 sctp_m_freem(m); 7313 return (error); 7314 } 7315 if (create_lock_applied) { 7316 SCTP_ASOC_CREATE_UNLOCK(inp); 7317 create_lock_applied = 0; 7318 } else { 7319 printf("Huh-1, create lock should have been applied!\n"); 7320 } 7321 queue_only = 1; 7322 asoc = &stcb->asoc; 7323 asoc->state = SCTP_STATE_COOKIE_WAIT; 7324 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 7325 if (control) { 7326 /* see if a init structure exists in cmsg headers */ 7327 struct sctp_initmsg initm; 7328 int i; 7329 if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, 7330 sizeof(initm))) { 7331 /* we have an INIT override of the default */ 7332 if (initm.sinit_max_attempts) 7333 asoc->max_init_times = initm.sinit_max_attempts; 7334 if (initm.sinit_num_ostreams) 7335 asoc->pre_open_streams = initm.sinit_num_ostreams; 7336 if (initm.sinit_max_instreams) 7337 asoc->max_inbound_streams = initm.sinit_max_instreams; 7338 if (initm.sinit_max_init_timeo) 7339 asoc->initial_init_rto_max = initm.sinit_max_init_timeo; 7340 } 7341 if (asoc->streamoutcnt < asoc->pre_open_streams) { 7342 /* Default is NOT correct */ 7343 #ifdef SCTP_DEBUG 7344 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7345 printf("Ok, defout:%d pre_open:%d\n", 7346 asoc->streamoutcnt, asoc->pre_open_streams); 7347 } 7348 #endif 7349 free(asoc->strmout, M_PCB); 7350 asoc->strmout = NULL; 7351 asoc->streamoutcnt = asoc->pre_open_streams; 7352 asoc->strmout = malloc(asoc->streamoutcnt * 7353 sizeof(struct sctp_stream_out), M_PCB, 7354 M_WAIT); 7355 for (i = 0; i < asoc->streamoutcnt; i++) { 7356 /* 7357 * inbound side must be set to 0xffff, 7358 * also NOTE when we get the INIT-ACK 7359 * back (for INIT sender) we MUST 7360 * reduce the count (streamoutcnt) but 7361 * first check if we sent to any of the 7362 * upper streams that were dropped (if 7363 * some were). Those that were dropped 7364 * must be notified to the upper layer 7365 * as failed to send. 7366 */ 7367 asoc->strmout[i].next_sequence_sent = 0x0; 7368 TAILQ_INIT(&asoc->strmout[i].outqueue); 7369 asoc->strmout[i].stream_no = i; 7370 asoc->strmout[i].next_spoke.tqe_next = 0; 7371 asoc->strmout[i].next_spoke.tqe_prev = 0; 7372 } 7373 } 7374 } 7375 sctp_send_initiate(inp, stcb); 7376 /* 7377 * we may want to dig in after this call and adjust the MTU 7378 * value. It defaulted to 1500 (constant) but the ro structure 7379 * may now have an update and thus we may need to change it 7380 * BEFORE we append the message. 7381 */ 7382 net = stcb->asoc.primary_destination; 7383 } else { 7384 if (create_lock_applied) { 7385 SCTP_ASOC_CREATE_UNLOCK(inp); 7386 create_lock_applied = 0; 7387 } 7388 asoc = &stcb->asoc; 7389 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 7390 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 7391 queue_only = 1; 7392 } 7393 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 7394 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 7395 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 7396 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 7397 if (control) { 7398 sctppcbinfo.mbuf_track--; 7399 sctp_m_freem(control); 7400 control = NULL; 7401 } 7402 if ((use_rcvinfo) && 7403 (srcv.sinfo_flags & SCTP_ABORT)) { 7404 sctp_msg_append(stcb, net, m, &srcv, flags); 7405 error = 0; 7406 } else { 7407 if (m) 7408 sctp_m_freem(m); 7409 error = ECONNRESET; 7410 } 7411 SCTP_TCB_UNLOCK(stcb); 7412 return (error); 7413 } 7414 } 7415 if (create_lock_applied) { 7416 /* we should never hit here with the create lock applied 7417 * 7418 */ 7419 SCTP_ASOC_CREATE_UNLOCK(inp); 7420 create_lock_applied = 0; 7421 } 7422 7423 7424 if (use_rcvinfo == 0) { 7425 srcv = stcb->asoc.def_send; 7426 } 7427 #ifdef SCTP_DEBUG 7428 else { 7429 if (sctp_debug_on & SCTP_DEBUG_OUTPUT5) { 7430 printf("stream:%d\n", srcv.sinfo_stream); 7431 printf("flags:%x\n", (u_int)srcv.sinfo_flags); 7432 printf("ppid:%d\n", srcv.sinfo_ppid); 7433 printf("context:%d\n", srcv.sinfo_context); 7434 } 7435 } 7436 #endif 7437 if (control) { 7438 sctppcbinfo.mbuf_track--; 7439 sctp_m_freem(control); 7440 control = NULL; 7441 } 7442 if (net && ((srcv.sinfo_flags & SCTP_ADDR_OVER))) { 7443 /* we take the override or the unconfirmed */ 7444 ; 7445 } else { 7446 net = stcb->asoc.primary_destination; 7447 } 7448 if ((error = sctp_msg_append(stcb, net, m, &srcv, flags))) { 7449 SCTP_TCB_UNLOCK(stcb); 7450 return (error); 7451 } 7452 if (net->flight_size > net->cwnd) { 7453 sctp_pegs[SCTP_SENDTO_FULL_CWND]++; 7454 queue_only = 1; 7455 } else if (asoc->ifp_had_enobuf) { 7456 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++; 7457 queue_only = 1; 7458 } else { 7459 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 7460 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) + 7461 SCTP_MED_OVERHEAD); 7462 7463 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) && 7464 (stcb->asoc.total_flight > 0) && 7465 (un_sent < (int)stcb->asoc.smallest_mtu) 7466 ) { 7467 7468 /* Ok, Nagle is set on and we have 7469 * data outstanding. Don't send anything 7470 * and let the SACK drive out the data. 7471 */ 7472 sctp_pegs[SCTP_NAGLE_NOQ]++; 7473 queue_only = 1; 7474 } else { 7475 sctp_pegs[SCTP_NAGLE_OFF]++; 7476 } 7477 } 7478 if ((queue_only == 0) && stcb->asoc.peers_rwnd) { 7479 /* we can attempt to send too.*/ 7480 #ifdef SCTP_DEBUG 7481 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7482 printf("USR Send calls sctp_chunk_output\n"); 7483 } 7484 #endif 7485 #ifdef SCTP_AUDITING_ENABLED 7486 sctp_audit_log(0xC0, 1); 7487 sctp_auditing(6, inp, stcb, net); 7488 #endif 7489 sctp_pegs[SCTP_OUTPUT_FRM_SND]++; 7490 sctp_chunk_output(inp, stcb, 0); 7491 #ifdef SCTP_AUDITING_ENABLED 7492 sctp_audit_log(0xC0, 2); 7493 sctp_auditing(7, inp, stcb, net); 7494 #endif 7495 7496 } 7497 #ifdef SCTP_DEBUG 7498 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7499 printf("USR Send complete qo:%d prw:%d\n", queue_only, stcb->asoc.peers_rwnd); 7500 } 7501 #endif 7502 SCTP_TCB_UNLOCK(stcb); 7503 return (0); 7504 } 7505 7506 void 7507 send_forward_tsn(struct sctp_tcb *stcb, 7508 struct sctp_association *asoc) 7509 { 7510 struct sctp_tmit_chunk *chk; 7511 struct sctp_forward_tsn_chunk *fwdtsn; 7512 7513 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7514 if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) { 7515 /* mark it to unsent */ 7516 chk->sent = SCTP_DATAGRAM_UNSENT; 7517 chk->snd_count = 0; 7518 /* Do we correct its output location? */ 7519 if (chk->whoTo != asoc->primary_destination) { 7520 sctp_free_remote_addr(chk->whoTo); 7521 chk->whoTo = asoc->primary_destination; 7522 chk->whoTo->ref_count++; 7523 } 7524 goto sctp_fill_in_rest; 7525 } 7526 } 7527 /* Ok if we reach here we must build one */ 7528 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 7529 if (chk == NULL) { 7530 return; 7531 } 7532 sctppcbinfo.ipi_count_chunk++; 7533 sctppcbinfo.ipi_gencnt_chunk++; 7534 chk->rec.chunk_id = SCTP_FORWARD_CUM_TSN; 7535 chk->asoc = asoc; 7536 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 7537 if (chk->data == NULL) { 7538 chk->whoTo->ref_count--; 7539 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 7540 sctppcbinfo.ipi_count_chunk--; 7541 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 7542 panic("Chunk count is negative"); 7543 } 7544 sctppcbinfo.ipi_gencnt_chunk++; 7545 return; 7546 } 7547 chk->data->m_data += SCTP_MIN_OVERHEAD; 7548 chk->sent = SCTP_DATAGRAM_UNSENT; 7549 chk->snd_count = 0; 7550 chk->whoTo = asoc->primary_destination; 7551 chk->whoTo->ref_count++; 7552 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 7553 asoc->ctrl_queue_cnt++; 7554 sctp_fill_in_rest: 7555 /* Here we go through and fill out the part that 7556 * deals with stream/seq of the ones we skip. 7557 */ 7558 chk->data->m_pkthdr.len = chk->data->m_len = 0; 7559 { 7560 struct sctp_tmit_chunk *at, *tp1, *last; 7561 struct sctp_strseq *strseq; 7562 unsigned int cnt_of_space, i, ovh; 7563 unsigned int space_needed; 7564 unsigned int cnt_of_skipped = 0; 7565 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 7566 if (at->sent != SCTP_FORWARD_TSN_SKIP) { 7567 /* no more to look at */ 7568 break; 7569 } 7570 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 7571 /* We don't report these */ 7572 continue; 7573 } 7574 cnt_of_skipped++; 7575 } 7576 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 7577 (cnt_of_skipped * sizeof(struct sctp_strseq))); 7578 if ((M_TRAILINGSPACE(chk->data) < (int)space_needed) && 7579 ((chk->data->m_flags & M_EXT) == 0)) { 7580 /* Need a M_EXT, get one and move 7581 * fwdtsn to data area. 7582 */ 7583 MCLGET(chk->data, M_DONTWAIT); 7584 } 7585 cnt_of_space = M_TRAILINGSPACE(chk->data); 7586 7587 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 7588 ovh = SCTP_MIN_OVERHEAD; 7589 } else { 7590 ovh = SCTP_MIN_V4_OVERHEAD; 7591 } 7592 if (cnt_of_space > (asoc->smallest_mtu-ovh)) { 7593 /* trim to a mtu size */ 7594 cnt_of_space = asoc->smallest_mtu - ovh; 7595 } 7596 if (cnt_of_space < space_needed) { 7597 /* ok we must trim down the chunk by lowering 7598 * the advance peer ack point. 7599 */ 7600 cnt_of_skipped = (cnt_of_space- 7601 ((sizeof(struct sctp_forward_tsn_chunk))/ 7602 sizeof(struct sctp_strseq))); 7603 /* Go through and find the TSN that 7604 * will be the one we report. 7605 */ 7606 at = TAILQ_FIRST(&asoc->sent_queue); 7607 for (i = 0; i < cnt_of_skipped; i++) { 7608 tp1 = TAILQ_NEXT(at, sctp_next); 7609 at = tp1; 7610 } 7611 last = at; 7612 /* last now points to last one I can report, update peer ack point */ 7613 asoc->advanced_peer_ack_point = last->rec.data.TSN_seq; 7614 space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq)); 7615 } 7616 chk->send_size = space_needed; 7617 /* Setup the chunk */ 7618 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 7619 fwdtsn->ch.chunk_length = htons(chk->send_size); 7620 fwdtsn->ch.chunk_flags = 0; 7621 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 7622 fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point); 7623 chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) + 7624 (cnt_of_skipped * sizeof(struct sctp_strseq))); 7625 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size; 7626 fwdtsn++; 7627 /* Move pointer to after the fwdtsn and transfer to 7628 * the strseq pointer. 7629 */ 7630 strseq = (struct sctp_strseq *)fwdtsn; 7631 /* 7632 * Now populate the strseq list. This is done blindly 7633 * without pulling out duplicate stream info. This is 7634 * inefficent but won't harm the process since the peer 7635 * will look at these in sequence and will thus release 7636 * anything. It could mean we exceed the PMTU and chop 7637 * off some that we could have included.. but this is 7638 * unlikely (aka 1432/4 would mean 300+ stream seq's would 7639 * have to be reported in one FWD-TSN. With a bit of work 7640 * we can later FIX this to optimize and pull out duplcates.. 7641 * but it does add more overhead. So for now... not! 7642 */ 7643 at = TAILQ_FIRST(&asoc->sent_queue); 7644 for (i = 0; i < cnt_of_skipped; i++) { 7645 tp1 = TAILQ_NEXT(at, sctp_next); 7646 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 7647 /* We don't report these */ 7648 i--; 7649 at = tp1; 7650 continue; 7651 } 7652 strseq->stream = ntohs(at->rec.data.stream_number); 7653 strseq->sequence = ntohs(at->rec.data.stream_seq); 7654 strseq++; 7655 at = tp1; 7656 } 7657 } 7658 return; 7659 7660 } 7661 7662 void 7663 sctp_send_sack(struct sctp_tcb *stcb) 7664 { 7665 /* 7666 * Queue up a SACK in the control queue. We must first check to 7667 * see if a SACK is somehow on the control queue. If so, we will 7668 * take and remove the old one. 7669 */ 7670 struct sctp_association *asoc; 7671 struct sctp_tmit_chunk *chk, *a_chk; 7672 struct sctp_sack_chunk *sack; 7673 struct sctp_gap_ack_block *gap_descriptor; 7674 uint32_t *dup; 7675 int start; 7676 unsigned int i, maxi, seeing_ones, m_size; 7677 unsigned int num_gap_blocks, space; 7678 7679 start = maxi = 0; 7680 seeing_ones = 1; 7681 a_chk = NULL; 7682 asoc = &stcb->asoc; 7683 if (asoc->last_data_chunk_from == NULL) { 7684 /* Hmm we never received anything */ 7685 return; 7686 } 7687 sctp_set_rwnd(stcb, asoc); 7688 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7689 if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) { 7690 /* Hmm, found a sack already on queue, remove it */ 7691 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7692 asoc->ctrl_queue_cnt++; 7693 a_chk = chk; 7694 if (a_chk->data) 7695 sctp_m_freem(a_chk->data); 7696 a_chk->data = NULL; 7697 sctp_free_remote_addr(a_chk->whoTo); 7698 a_chk->whoTo = NULL; 7699 break; 7700 } 7701 } 7702 if (a_chk == NULL) { 7703 a_chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 7704 if (a_chk == NULL) { 7705 /* No memory so we drop the idea, and set a timer */ 7706 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 7707 stcb->sctp_ep, stcb, NULL); 7708 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 7709 stcb->sctp_ep, stcb, NULL); 7710 return; 7711 } 7712 sctppcbinfo.ipi_count_chunk++; 7713 sctppcbinfo.ipi_gencnt_chunk++; 7714 a_chk->rec.chunk_id = SCTP_SELECTIVE_ACK; 7715 } 7716 a_chk->asoc = asoc; 7717 a_chk->snd_count = 0; 7718 a_chk->send_size = 0; /* fill in later */ 7719 a_chk->sent = SCTP_DATAGRAM_UNSENT; 7720 m_size = (asoc->mapping_array_size << 3); 7721 7722 if ((asoc->numduptsns) || 7723 (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE) 7724 ) { 7725 /* Ok, we have some duplicates or the destination for the 7726 * sack is unreachable, lets see if we can select an alternate 7727 * than asoc->last_data_chunk_from 7728 */ 7729 if ((!(asoc->last_data_chunk_from->dest_state & 7730 SCTP_ADDR_NOT_REACHABLE)) && 7731 (asoc->used_alt_onsack > 2)) { 7732 /* We used an alt last time, don't this time */ 7733 a_chk->whoTo = NULL; 7734 } else { 7735 asoc->used_alt_onsack++; 7736 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from); 7737 } 7738 if (a_chk->whoTo == NULL) { 7739 /* Nope, no alternate */ 7740 a_chk->whoTo = asoc->last_data_chunk_from; 7741 asoc->used_alt_onsack = 0; 7742 } 7743 } else { 7744 /* No duplicates so we use the last 7745 * place we received data from. 7746 */ 7747 #ifdef SCTP_DEBUG 7748 if (asoc->last_data_chunk_from == NULL) { 7749 printf("Huh, last_data_chunk_from is null when we want to sack??\n"); 7750 } 7751 #endif 7752 asoc->used_alt_onsack = 0; 7753 a_chk->whoTo = asoc->last_data_chunk_from; 7754 } 7755 if (a_chk->whoTo) 7756 a_chk->whoTo->ref_count++; 7757 7758 /* Ok now lets formulate a MBUF with our sack */ 7759 MGETHDR(a_chk->data, M_DONTWAIT, MT_DATA); 7760 if ((a_chk->data == NULL) || 7761 (a_chk->whoTo == NULL)) { 7762 /* rats, no mbuf memory */ 7763 if (a_chk->data) { 7764 /* was a problem with the destination */ 7765 sctp_m_freem(a_chk->data); 7766 a_chk->data = NULL; 7767 } 7768 a_chk->whoTo->ref_count--; 7769 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk); 7770 sctppcbinfo.ipi_count_chunk--; 7771 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 7772 panic("Chunk count is negative"); 7773 } 7774 sctppcbinfo.ipi_gencnt_chunk++; 7775 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 7776 stcb->sctp_ep, stcb, NULL); 7777 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 7778 stcb->sctp_ep, stcb, NULL); 7779 return; 7780 } 7781 /* First count the number of gap ack blocks we need */ 7782 if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) { 7783 /* We know if there are none above the cum-ack we 7784 * have everything with NO gaps 7785 */ 7786 num_gap_blocks = 0; 7787 } else { 7788 /* Ok we must count how many gaps we 7789 * have. 7790 */ 7791 num_gap_blocks = 0; 7792 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) { 7793 maxi = (asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn); 7794 } else { 7795 maxi = (asoc->highest_tsn_inside_map + (MAX_TSN - asoc->mapping_array_base_tsn) + 1); 7796 } 7797 if (maxi > m_size) { 7798 /* impossible but who knows, someone is playing with us :> */ 7799 #ifdef SCTP_DEBUG 7800 printf("GAK maxi:%d > m_size:%d came out higher than allowed htsn:%u base:%u cumack:%u\n", 7801 maxi, 7802 m_size, 7803 asoc->highest_tsn_inside_map, 7804 asoc->mapping_array_base_tsn, 7805 asoc->cumulative_tsn 7806 ); 7807 #endif 7808 num_gap_blocks = 0; 7809 goto no_gaps_now; 7810 } 7811 if (asoc->cumulative_tsn >= asoc->mapping_array_base_tsn) { 7812 start = (asoc->cumulative_tsn - asoc->mapping_array_base_tsn); 7813 } else { 7814 /* Set it so we start at 0 */ 7815 start = -1; 7816 } 7817 /* Ok move start up one to look at the NEXT past the cum-ack */ 7818 start++; 7819 for (i = start; i <= maxi; i++) { 7820 if (seeing_ones) { 7821 /* while seeing ones I must 7822 * transition back to 0 before 7823 * finding the next gap and 7824 * counting the segment. 7825 */ 7826 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) { 7827 seeing_ones = 0; 7828 } 7829 } else { 7830 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) { 7831 seeing_ones = 1; 7832 num_gap_blocks++; 7833 } 7834 } 7835 } 7836 no_gaps_now: 7837 if (num_gap_blocks == 0) { 7838 /* 7839 * Traveled all of the bits and NO one, 7840 * must have reneged 7841 */ 7842 if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN)) { 7843 asoc->highest_tsn_inside_map = asoc->cumulative_tsn; 7844 #ifdef SCTP_MAP_LOGGING 7845 sctp_log_map(0, 4, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 7846 #endif 7847 } 7848 } 7849 } 7850 7851 /* Now calculate the space needed */ 7852 space = (sizeof(struct sctp_sack_chunk) + 7853 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) + 7854 (asoc->numduptsns * sizeof(int32_t)) 7855 ); 7856 if (space > (asoc->smallest_mtu-SCTP_MAX_OVERHEAD)) { 7857 /* Reduce the size of the sack to fit */ 7858 int calc, fit; 7859 calc = (asoc->smallest_mtu - SCTP_MAX_OVERHEAD); 7860 calc -= sizeof(struct sctp_gap_ack_block); 7861 fit = calc/sizeof(struct sctp_gap_ack_block); 7862 if (fit > (int)num_gap_blocks) { 7863 /* discard some dups */ 7864 asoc->numduptsns = (fit - num_gap_blocks); 7865 } else { 7866 /* discard all dups and some gaps */ 7867 num_gap_blocks = fit; 7868 asoc->numduptsns = 0; 7869 } 7870 /* recalc space */ 7871 space = (sizeof(struct sctp_sack_chunk) + 7872 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) + 7873 (asoc->numduptsns * sizeof(int32_t)) 7874 ); 7875 7876 } 7877 7878 if ((space+SCTP_MIN_OVERHEAD) > MHLEN) { 7879 /* We need a cluster */ 7880 MCLGET(a_chk->data, M_DONTWAIT); 7881 if ((a_chk->data->m_flags & M_EXT) != M_EXT) { 7882 /* can't get a cluster 7883 * give up and try later. 7884 */ 7885 if (a_chk->data) 7886 sctp_m_freem(a_chk->data); 7887 a_chk->data = NULL; 7888 a_chk->whoTo->ref_count--; 7889 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk); 7890 sctppcbinfo.ipi_count_chunk--; 7891 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 7892 panic("Chunk count is negative"); 7893 } 7894 sctppcbinfo.ipi_gencnt_chunk++; 7895 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 7896 stcb->sctp_ep, stcb, NULL); 7897 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 7898 stcb->sctp_ep, stcb, NULL); 7899 return; 7900 } 7901 } 7902 7903 /* ok, lets go through and fill it in */ 7904 a_chk->data->m_data += SCTP_MIN_OVERHEAD; 7905 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 7906 sack->ch.chunk_type = SCTP_SELECTIVE_ACK; 7907 sack->ch.chunk_flags = asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM; 7908 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 7909 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 7910 asoc->my_last_reported_rwnd = asoc->my_rwnd; 7911 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 7912 sack->sack.num_dup_tsns = htons(asoc->numduptsns); 7913 7914 a_chk->send_size = (sizeof(struct sctp_sack_chunk) + 7915 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) + 7916 (asoc->numduptsns * sizeof(int32_t))); 7917 a_chk->data->m_pkthdr.len = a_chk->data->m_len = a_chk->send_size; 7918 sack->ch.chunk_length = htons(a_chk->send_size); 7919 7920 gap_descriptor = (struct sctp_gap_ack_block *)((vaddr_t)sack + sizeof(struct sctp_sack_chunk)); 7921 seeing_ones = 0; 7922 for (i = start; i <= maxi; i++) { 7923 if (num_gap_blocks == 0) { 7924 break; 7925 } 7926 if (seeing_ones) { 7927 /* while seeing Ones I must 7928 * transition back to 0 before 7929 * finding the next gap 7930 */ 7931 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) { 7932 gap_descriptor->end = htons(((uint16_t)(i-start))); 7933 gap_descriptor++; 7934 seeing_ones = 0; 7935 num_gap_blocks--; 7936 } 7937 } else { 7938 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) { 7939 gap_descriptor->start = htons(((uint16_t)(i+1-start))); 7940 /* advance struct to next pointer */ 7941 seeing_ones = 1; 7942 } 7943 } 7944 } 7945 if (num_gap_blocks) { 7946 /* special case where the array is all 1's 7947 * to the end of the array. 7948 */ 7949 gap_descriptor->end = htons(((uint16_t)((i-start)))); 7950 gap_descriptor++; 7951 } 7952 /* now we must add any dups we are going to report. */ 7953 if (asoc->numduptsns) { 7954 dup = (uint32_t *)gap_descriptor; 7955 for (i = 0; i < asoc->numduptsns; i++) { 7956 *dup = htonl(asoc->dup_tsns[i]); 7957 dup++; 7958 } 7959 asoc->numduptsns = 0; 7960 } 7961 /* now that the chunk is prepared queue it to the control 7962 * chunk queue. 7963 */ 7964 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 7965 asoc->ctrl_queue_cnt++; 7966 sctp_pegs[SCTP_PEG_SACKS_SENT]++; 7967 return; 7968 } 7969 7970 void 7971 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr) 7972 { 7973 struct mbuf *m_abort; 7974 struct sctp_abort_msg *abort_m; 7975 int sz; 7976 abort_m = NULL; 7977 MGETHDR(m_abort, M_DONTWAIT, MT_HEADER); 7978 if (m_abort == NULL) { 7979 /* no mbuf's */ 7980 return; 7981 } 7982 m_abort->m_data += SCTP_MIN_OVERHEAD; 7983 abort_m = mtod(m_abort, struct sctp_abort_msg *); 7984 m_abort->m_len = sizeof(struct sctp_abort_msg); 7985 m_abort->m_next = operr; 7986 sz = 0; 7987 if (operr) { 7988 struct mbuf *n; 7989 n = operr; 7990 while (n) { 7991 sz += n->m_len; 7992 n = n->m_next; 7993 } 7994 } 7995 abort_m->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION; 7996 abort_m->msg.ch.chunk_flags = 0; 7997 abort_m->msg.ch.chunk_length = htons(sizeof(struct sctp_abort_chunk) + 7998 sz); 7999 abort_m->sh.src_port = stcb->sctp_ep->sctp_lport; 8000 abort_m->sh.dest_port = stcb->rport; 8001 abort_m->sh.v_tag = htonl(stcb->asoc.peer_vtag); 8002 abort_m->sh.checksum = 0; 8003 m_abort->m_pkthdr.len = m_abort->m_len + sz; 8004 m_reset_rcvif(m_abort); 8005 sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, 8006 stcb->asoc.primary_destination, 8007 rtcache_getdst(&stcb->asoc.primary_destination->ro), 8008 m_abort, 1, 0, NULL, 0); 8009 } 8010 8011 int 8012 sctp_send_shutdown_complete(struct sctp_tcb *stcb, 8013 struct sctp_nets *net) 8014 8015 { 8016 /* formulate and SEND a SHUTDOWN-COMPLETE */ 8017 struct mbuf *m_shutdown_comp; 8018 struct sctp_shutdown_complete_msg *comp_cp; 8019 8020 m_shutdown_comp = NULL; 8021 MGETHDR(m_shutdown_comp, M_DONTWAIT, MT_HEADER); 8022 if (m_shutdown_comp == NULL) { 8023 /* no mbuf's */ 8024 return (-1); 8025 } 8026 m_shutdown_comp->m_data += sizeof(struct ip6_hdr); 8027 comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *); 8028 comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 8029 comp_cp->shut_cmp.ch.chunk_flags = 0; 8030 comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 8031 comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport; 8032 comp_cp->sh.dest_port = stcb->rport; 8033 comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag); 8034 comp_cp->sh.checksum = 0; 8035 8036 m_shutdown_comp->m_pkthdr.len = m_shutdown_comp->m_len = sizeof(struct sctp_shutdown_complete_msg); 8037 m_reset_rcvif(m_shutdown_comp); 8038 sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 8039 rtcache_getdst(&net->ro), m_shutdown_comp, 8040 1, 0, NULL, 0); 8041 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 8042 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 8043 stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED; 8044 stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 8045 soisdisconnected(stcb->sctp_ep->sctp_socket); 8046 } 8047 return (0); 8048 } 8049 8050 int 8051 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh) 8052 { 8053 /* formulate and SEND a SHUTDOWN-COMPLETE */ 8054 struct mbuf *mout; 8055 struct ip *iph, *iph_out; 8056 struct ip6_hdr *ip6, *ip6_out; 8057 int offset_out; 8058 struct sctp_shutdown_complete_msg *comp_cp; 8059 8060 MGETHDR(mout, M_DONTWAIT, MT_HEADER); 8061 if (mout == NULL) { 8062 /* no mbuf's */ 8063 return (-1); 8064 } 8065 iph = mtod(m, struct ip *); 8066 iph_out = NULL; 8067 ip6_out = NULL; 8068 offset_out = 0; 8069 if (iph->ip_v == IPVERSION) { 8070 mout->m_len = sizeof(struct ip) + 8071 sizeof(struct sctp_shutdown_complete_msg); 8072 mout->m_next = NULL; 8073 iph_out = mtod(mout, struct ip *); 8074 8075 /* Fill in the IP header for the ABORT */ 8076 iph_out->ip_v = IPVERSION; 8077 iph_out->ip_hl = (sizeof(struct ip)/4); 8078 iph_out->ip_tos = (u_char)0; 8079 iph_out->ip_id = 0; 8080 iph_out->ip_off = 0; 8081 iph_out->ip_ttl = MAXTTL; 8082 iph_out->ip_p = IPPROTO_SCTP; 8083 iph_out->ip_src.s_addr = iph->ip_dst.s_addr; 8084 iph_out->ip_dst.s_addr = iph->ip_src.s_addr; 8085 8086 /* let IP layer calculate this */ 8087 iph_out->ip_sum = 0; 8088 offset_out += sizeof(*iph_out); 8089 comp_cp = (struct sctp_shutdown_complete_msg *)( 8090 (vaddr_t)iph_out + offset_out); 8091 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 8092 ip6 = (struct ip6_hdr *)iph; 8093 mout->m_len = sizeof(struct ip6_hdr) + 8094 sizeof(struct sctp_shutdown_complete_msg); 8095 mout->m_next = NULL; 8096 ip6_out = mtod(mout, struct ip6_hdr *); 8097 8098 /* Fill in the IPv6 header for the ABORT */ 8099 ip6_out->ip6_flow = ip6->ip6_flow; 8100 ip6_out->ip6_hlim = ip6_defhlim; 8101 ip6_out->ip6_nxt = IPPROTO_SCTP; 8102 ip6_out->ip6_src = ip6->ip6_dst; 8103 ip6_out->ip6_dst = ip6->ip6_src; 8104 ip6_out->ip6_plen = mout->m_len; 8105 offset_out += sizeof(*ip6_out); 8106 comp_cp = (struct sctp_shutdown_complete_msg *)( 8107 (vaddr_t)ip6_out + offset_out); 8108 } else { 8109 /* Currently not supported. */ 8110 return (-1); 8111 } 8112 8113 /* Now copy in and fill in the ABORT tags etc. */ 8114 comp_cp->sh.src_port = sh->dest_port; 8115 comp_cp->sh.dest_port = sh->src_port; 8116 comp_cp->sh.checksum = 0; 8117 comp_cp->sh.v_tag = sh->v_tag; 8118 comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB; 8119 comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 8120 comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 8121 8122 mout->m_pkthdr.len = mout->m_len; 8123 /* add checksum */ 8124 if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL && 8125 m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) { 8126 comp_cp->sh.checksum = 0; 8127 } else { 8128 comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out); 8129 } 8130 8131 /* zap the rcvif, it should be null */ 8132 m_reset_rcvif(mout); 8133 /* zap the stack pointer to the route */ 8134 if (iph_out != NULL) { 8135 struct route ro; 8136 8137 memset(&ro, 0, sizeof ro); 8138 #ifdef SCTP_DEBUG 8139 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 8140 printf("sctp_shutdown_complete2 calling ip_output:\n"); 8141 sctp_print_address_pkt(iph_out, &comp_cp->sh); 8142 } 8143 #endif 8144 /* set IPv4 length */ 8145 iph_out->ip_len = htons(mout->m_pkthdr.len); 8146 /* out it goes */ 8147 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL, NULL); 8148 } else if (ip6_out != NULL) { 8149 struct route ro; 8150 8151 memset(&ro, 0, sizeof(ro)); 8152 #ifdef SCTP_DEBUG 8153 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 8154 printf("sctp_shutdown_complete2 calling ip6_output:\n"); 8155 sctp_print_address_pkt((struct ip *)ip6_out, 8156 &comp_cp->sh); 8157 } 8158 #endif 8159 ip6_output(mout, NULL, &ro, 0, NULL, NULL, NULL); 8160 } 8161 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 8162 return (0); 8163 } 8164 8165 static struct sctp_nets * 8166 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now) 8167 { 8168 struct sctp_nets *net, *hnet; 8169 int ms_goneby, highest_ms, state_override=0; 8170 8171 SCTP_GETTIME_TIMEVAL(now); 8172 highest_ms = 0; 8173 hnet = NULL; 8174 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 8175 if ( 8176 ((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) || 8177 (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE) 8178 ) { 8179 /* Skip this guy from consideration if HB is off AND its confirmed*/ 8180 #ifdef SCTP_DEBUG 8181 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8182 printf("Skipping net:%p state:%d nohb/out-of-scope\n", 8183 net, net->dest_state); 8184 } 8185 #endif 8186 continue; 8187 } 8188 if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro.ro_sa) == 0) { 8189 /* skip this dest net from consideration */ 8190 #ifdef SCTP_DEBUG 8191 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8192 printf("Skipping net:%p reachable NOT\n", 8193 net); 8194 } 8195 #endif 8196 continue; 8197 } 8198 if (net->last_sent_time.tv_sec) { 8199 /* Sent to so we subtract */ 8200 ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000; 8201 } else 8202 /* Never been sent to */ 8203 ms_goneby = 0x7fffffff; 8204 #ifdef SCTP_DEBUG 8205 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8206 printf("net:%p ms_goneby:%d\n", 8207 net, ms_goneby); 8208 } 8209 #endif 8210 /* When the address state is unconfirmed but still considered reachable, we 8211 * HB at a higher rate. Once it goes confirmed OR reaches the "unreachable" 8212 * state, then we cut it back to HB at a more normal pace. 8213 */ 8214 if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) { 8215 state_override = 1; 8216 } else { 8217 state_override = 0; 8218 } 8219 8220 if ((((unsigned int)ms_goneby >= net->RTO) || (state_override)) && 8221 (ms_goneby > highest_ms)) { 8222 highest_ms = ms_goneby; 8223 hnet = net; 8224 #ifdef SCTP_DEBUG 8225 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8226 printf("net:%p is the new high\n", 8227 net); 8228 } 8229 #endif 8230 } 8231 } 8232 if (hnet && 8233 ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) { 8234 state_override = 1; 8235 } else { 8236 state_override = 0; 8237 } 8238 8239 if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_override)) { 8240 /* Found the one with longest delay bounds 8241 * OR it is unconfirmed and still not marked 8242 * unreachable. 8243 */ 8244 #ifdef SCTP_DEBUG 8245 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8246 printf("net:%p is the hb winner -", 8247 hnet); 8248 if (hnet) 8249 sctp_print_address((struct sockaddr *)&hnet->ro.ro_sa); 8250 else 8251 printf(" none\n"); 8252 } 8253 #endif 8254 /* update the timer now */ 8255 hnet->last_sent_time = *now; 8256 return (hnet); 8257 } 8258 /* Nothing to HB */ 8259 return (NULL); 8260 } 8261 8262 int 8263 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net) 8264 { 8265 struct sctp_tmit_chunk *chk; 8266 struct sctp_nets *net; 8267 struct sctp_heartbeat_chunk *hb; 8268 struct timeval now; 8269 struct sockaddr_in *sin; 8270 struct sockaddr_in6 *sin6; 8271 8272 if (user_req == 0) { 8273 net = sctp_select_hb_destination(stcb, &now); 8274 if (net == NULL) { 8275 /* All our busy none to send to, just 8276 * start the timer again. 8277 */ 8278 if (stcb->asoc.state == 0) { 8279 return (0); 8280 } 8281 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, 8282 stcb->sctp_ep, 8283 stcb, 8284 net); 8285 return (0); 8286 } 8287 #ifndef SCTP_USE_ALLMAN_BURST 8288 else { 8289 /* found one idle.. decay cwnd on this one 8290 * by 1/2 if none outstanding. 8291 */ 8292 8293 if (net->flight_size == 0) { 8294 net->cwnd /= 2; 8295 if (net->addr_is_local) { 8296 if (net->cwnd < (net->mtu *4)) { 8297 net->cwnd = net->mtu * 4; 8298 } 8299 } else { 8300 if (net->cwnd < (net->mtu * 2)) { 8301 net->cwnd = net->mtu * 2; 8302 } 8303 } 8304 8305 } 8306 8307 } 8308 #endif 8309 } else { 8310 net = u_net; 8311 if (net == NULL) { 8312 return (0); 8313 } 8314 SCTP_GETTIME_TIMEVAL(&now); 8315 } 8316 sin = (struct sockaddr_in *)&net->ro.ro_sa; 8317 if (sin->sin_family != AF_INET) { 8318 if (sin->sin_family != AF_INET6) { 8319 /* huh */ 8320 return (0); 8321 } 8322 } 8323 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8324 if (chk == NULL) { 8325 #ifdef SCTP_DEBUG 8326 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8327 printf("Gak, can't get a chunk for hb\n"); 8328 } 8329 #endif 8330 return (0); 8331 } 8332 sctppcbinfo.ipi_gencnt_chunk++; 8333 sctppcbinfo.ipi_count_chunk++; 8334 chk->rec.chunk_id = SCTP_HEARTBEAT_REQUEST; 8335 chk->asoc = &stcb->asoc; 8336 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 8337 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8338 if (chk->data == NULL) { 8339 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8340 sctppcbinfo.ipi_count_chunk--; 8341 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8342 panic("Chunk count is negative"); 8343 } 8344 sctppcbinfo.ipi_gencnt_chunk++; 8345 return (0); 8346 } 8347 chk->data->m_data += SCTP_MIN_OVERHEAD; 8348 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size; 8349 chk->sent = SCTP_DATAGRAM_UNSENT; 8350 chk->snd_count = 0; 8351 chk->whoTo = net; 8352 chk->whoTo->ref_count++; 8353 /* Now we have a mbuf that we can fill in with the details */ 8354 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 8355 8356 /* fill out chunk header */ 8357 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 8358 hb->ch.chunk_flags = 0; 8359 hb->ch.chunk_length = htons(chk->send_size); 8360 /* Fill out hb parameter */ 8361 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 8362 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 8363 hb->heartbeat.hb_info.time_value_1 = now.tv_sec; 8364 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 8365 /* Did our user request this one, put it in */ 8366 hb->heartbeat.hb_info.user_req = user_req; 8367 hb->heartbeat.hb_info.addr_family = sin->sin_family; 8368 hb->heartbeat.hb_info.addr_len = sin->sin_len; 8369 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 8370 /* we only take from the entropy pool if the address is 8371 * not confirmed. 8372 */ 8373 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 8374 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 8375 } else { 8376 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 8377 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 8378 } 8379 if (sin->sin_family == AF_INET) { 8380 memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr)); 8381 } else if (sin->sin_family == AF_INET6) { 8382 /* We leave the scope the way it is in our lookup table. */ 8383 sin6 = (struct sockaddr_in6 *)&net->ro.ro_sa; 8384 memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr)); 8385 } else { 8386 /* huh compiler bug */ 8387 #ifdef SCTP_DEBUG 8388 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 8389 printf("Compiler bug bleeds a mbuf and a chunk\n"); 8390 } 8391 #endif 8392 return (0); 8393 } 8394 /* ok we have a destination that needs a beat */ 8395 /* lets do the theshold management Qiaobing style */ 8396 if (user_req == 0) { 8397 if (sctp_threshold_management(stcb->sctp_ep, stcb, net, 8398 stcb->asoc.max_send_times)) { 8399 /* we have lost the association, in a way this 8400 * is quite bad since we really are one less time 8401 * since we really did not send yet. This is the 8402 * down side to the Q's style as defined in the RFC 8403 * and not my alternate style defined in the RFC. 8404 */ 8405 if (chk->data != NULL) { 8406 sctp_m_freem(chk->data); 8407 chk->data = NULL; 8408 } 8409 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8410 sctppcbinfo.ipi_count_chunk--; 8411 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8412 panic("Chunk count is negative"); 8413 } 8414 sctppcbinfo.ipi_gencnt_chunk++; 8415 return (-1); 8416 } 8417 } 8418 net->hb_responded = 0; 8419 #ifdef SCTP_DEBUG 8420 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8421 printf("Inserting chunk for HB\n"); 8422 } 8423 #endif 8424 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8425 stcb->asoc.ctrl_queue_cnt++; 8426 sctp_pegs[SCTP_HB_SENT]++; 8427 /* 8428 * Call directly med level routine to put out the chunk. It will 8429 * always tumble out control chunks aka HB but it may even tumble 8430 * out data too. 8431 */ 8432 if (user_req == 0) { 8433 /* Ok now lets start the HB timer if it is NOT a user req */ 8434 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, 8435 stcb, net); 8436 } 8437 return (1); 8438 } 8439 8440 void 8441 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 8442 uint32_t high_tsn) 8443 { 8444 struct sctp_association *asoc; 8445 struct sctp_ecne_chunk *ecne; 8446 struct sctp_tmit_chunk *chk; 8447 asoc = &stcb->asoc; 8448 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 8449 if (chk->rec.chunk_id == SCTP_ECN_ECHO) { 8450 /* found a previous ECN_ECHO update it if needed */ 8451 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 8452 ecne->tsn = htonl(high_tsn); 8453 return; 8454 } 8455 } 8456 /* nope could not find one to update so we must build one */ 8457 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8458 if (chk == NULL) { 8459 return; 8460 } 8461 sctp_pegs[SCTP_ECNE_SENT]++; 8462 sctppcbinfo.ipi_count_chunk++; 8463 sctppcbinfo.ipi_gencnt_chunk++; 8464 chk->rec.chunk_id = SCTP_ECN_ECHO; 8465 chk->asoc = &stcb->asoc; 8466 chk->send_size = sizeof(struct sctp_ecne_chunk); 8467 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8468 if (chk->data == NULL) { 8469 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8470 sctppcbinfo.ipi_count_chunk--; 8471 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8472 panic("Chunk count is negative"); 8473 } 8474 sctppcbinfo.ipi_gencnt_chunk++; 8475 return; 8476 } 8477 chk->data->m_data += SCTP_MIN_OVERHEAD; 8478 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size; 8479 chk->sent = SCTP_DATAGRAM_UNSENT; 8480 chk->snd_count = 0; 8481 chk->whoTo = net; 8482 chk->whoTo->ref_count++; 8483 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 8484 ecne->ch.chunk_type = SCTP_ECN_ECHO; 8485 ecne->ch.chunk_flags = 0; 8486 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 8487 ecne->tsn = htonl(high_tsn); 8488 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8489 asoc->ctrl_queue_cnt++; 8490 } 8491 8492 void 8493 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 8494 struct mbuf *m, int iphlen, int bad_crc) 8495 { 8496 struct sctp_association *asoc; 8497 struct sctp_pktdrop_chunk *drp; 8498 struct sctp_tmit_chunk *chk; 8499 uint8_t *datap; 8500 int len; 8501 unsigned int small_one; 8502 struct ip *iph; 8503 8504 long spc; 8505 asoc = &stcb->asoc; 8506 if (asoc->peer_supports_pktdrop == 0) { 8507 /* peer must declare support before I 8508 * send one. 8509 */ 8510 return; 8511 } 8512 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8513 if (chk == NULL) { 8514 return; 8515 } 8516 sctppcbinfo.ipi_count_chunk++; 8517 sctppcbinfo.ipi_gencnt_chunk++; 8518 8519 iph = mtod(m, struct ip *); 8520 if (iph == NULL) { 8521 return; 8522 } 8523 if (iph->ip_v == IPVERSION) { 8524 /* IPv4 */ 8525 #if defined(__FreeBSD__) 8526 len = chk->send_size = iph->ip_len; 8527 #else 8528 len = chk->send_size = (iph->ip_len - iphlen); 8529 #endif 8530 } else { 8531 struct ip6_hdr *ip6h; 8532 /* IPv6 */ 8533 ip6h = mtod(m, struct ip6_hdr *); 8534 len = chk->send_size = htons(ip6h->ip6_plen); 8535 } 8536 if ((len+iphlen) > m->m_pkthdr.len) { 8537 /* huh */ 8538 chk->send_size = len = m->m_pkthdr.len - iphlen; 8539 } 8540 chk->asoc = &stcb->asoc; 8541 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8542 if (chk->data == NULL) { 8543 jump_out: 8544 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8545 sctppcbinfo.ipi_count_chunk--; 8546 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8547 panic("Chunk count is negative"); 8548 } 8549 sctppcbinfo.ipi_gencnt_chunk++; 8550 return; 8551 } 8552 if ((chk->send_size+sizeof(struct sctp_pktdrop_chunk)+SCTP_MIN_OVERHEAD) > MHLEN) { 8553 MCLGET(chk->data, M_DONTWAIT); 8554 if ((chk->data->m_flags & M_EXT) == 0) { 8555 /* Give up */ 8556 sctp_m_freem(chk->data); 8557 chk->data = NULL; 8558 goto jump_out; 8559 } 8560 } 8561 chk->data->m_data += SCTP_MIN_OVERHEAD; 8562 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 8563 if (drp == NULL) { 8564 sctp_m_freem(chk->data); 8565 chk->data = NULL; 8566 goto jump_out; 8567 } 8568 small_one = asoc->smallest_mtu; 8569 if (small_one > MCLBYTES) { 8570 /* Only one cluster worth of data MAX */ 8571 small_one = MCLBYTES; 8572 } 8573 chk->book_size = (chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 8574 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD); 8575 if (chk->book_size > small_one) { 8576 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 8577 drp->trunc_len = htons(chk->send_size); 8578 chk->send_size = small_one - (SCTP_MED_OVERHEAD + 8579 sizeof(struct sctp_pktdrop_chunk) + 8580 sizeof(struct sctphdr)); 8581 len = chk->send_size; 8582 } else { 8583 /* no truncation needed */ 8584 drp->ch.chunk_flags = 0; 8585 drp->trunc_len = htons(0); 8586 } 8587 if (bad_crc) { 8588 drp->ch.chunk_flags |= SCTP_BADCRC; 8589 } 8590 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 8591 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size; 8592 chk->sent = SCTP_DATAGRAM_UNSENT; 8593 chk->snd_count = 0; 8594 if (net) { 8595 /* we should hit here */ 8596 chk->whoTo = net; 8597 } else { 8598 chk->whoTo = asoc->primary_destination; 8599 } 8600 chk->whoTo->ref_count++; 8601 chk->rec.chunk_id = SCTP_PACKET_DROPPED; 8602 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 8603 drp->ch.chunk_length = htons(chk->send_size); 8604 spc = stcb->sctp_socket->so_rcv.sb_hiwat; 8605 if (spc < 0) { 8606 spc = 0; 8607 } 8608 drp->bottle_bw = htonl(spc); 8609 drp->current_onq = htonl(asoc->size_on_delivery_queue + 8610 asoc->size_on_reasm_queue + 8611 asoc->size_on_all_streams + 8612 asoc->my_rwnd_control_len + 8613 stcb->sctp_socket->so_rcv.sb_cc); 8614 drp->reserved = 0; 8615 datap = drp->data; 8616 m_copydata(m, iphlen, len, datap); 8617 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8618 asoc->ctrl_queue_cnt++; 8619 } 8620 8621 void 8622 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn) 8623 { 8624 struct sctp_association *asoc; 8625 struct sctp_cwr_chunk *cwr; 8626 struct sctp_tmit_chunk *chk; 8627 8628 asoc = &stcb->asoc; 8629 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 8630 if (chk->rec.chunk_id == SCTP_ECN_CWR) { 8631 /* found a previous ECN_CWR update it if needed */ 8632 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 8633 if (compare_with_wrap(high_tsn, ntohl(cwr->tsn), 8634 MAX_TSN)) { 8635 cwr->tsn = htonl(high_tsn); 8636 } 8637 return; 8638 } 8639 } 8640 /* nope could not find one to update so we must build one */ 8641 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8642 if (chk == NULL) { 8643 return; 8644 } 8645 sctppcbinfo.ipi_count_chunk++; 8646 sctppcbinfo.ipi_gencnt_chunk++; 8647 chk->rec.chunk_id = SCTP_ECN_CWR; 8648 chk->asoc = &stcb->asoc; 8649 chk->send_size = sizeof(struct sctp_cwr_chunk); 8650 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8651 if (chk->data == NULL) { 8652 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8653 sctppcbinfo.ipi_count_chunk--; 8654 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8655 panic("Chunk count is negative"); 8656 } 8657 sctppcbinfo.ipi_gencnt_chunk++; 8658 return; 8659 } 8660 chk->data->m_data += SCTP_MIN_OVERHEAD; 8661 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size; 8662 chk->sent = SCTP_DATAGRAM_UNSENT; 8663 chk->snd_count = 0; 8664 chk->whoTo = net; 8665 chk->whoTo->ref_count++; 8666 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 8667 cwr->ch.chunk_type = SCTP_ECN_CWR; 8668 cwr->ch.chunk_flags = 0; 8669 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 8670 cwr->tsn = htonl(high_tsn); 8671 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8672 asoc->ctrl_queue_cnt++; 8673 } 8674 static void 8675 sctp_reset_the_streams(struct sctp_tcb *stcb, 8676 struct sctp_stream_reset_request *req, int number_entries, uint16_t *list) 8677 { 8678 int i; 8679 8680 if (req->reset_flags & SCTP_RESET_ALL) { 8681 for (i=0; i<stcb->asoc.streamoutcnt; i++) { 8682 stcb->asoc.strmout[i].next_sequence_sent = 0; 8683 } 8684 } else if (number_entries) { 8685 for (i=0; i<number_entries; i++) { 8686 if (list[i] >= stcb->asoc.streamoutcnt) { 8687 /* no such stream */ 8688 continue; 8689 } 8690 stcb->asoc.strmout[(list[i])].next_sequence_sent = 0; 8691 } 8692 } 8693 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list); 8694 } 8695 8696 void 8697 sctp_send_str_reset_ack(struct sctp_tcb *stcb, 8698 struct sctp_stream_reset_request *req) 8699 { 8700 struct sctp_association *asoc; 8701 struct sctp_stream_reset_resp *strack; 8702 struct sctp_tmit_chunk *chk; 8703 uint32_t seq; 8704 int number_entries, i; 8705 uint8_t two_way=0, not_peer=0; 8706 uint16_t *list=NULL; 8707 8708 asoc = &stcb->asoc; 8709 if (req->reset_flags & SCTP_RESET_ALL) 8710 number_entries = 0; 8711 else 8712 number_entries = (ntohs(req->ph.param_length) - sizeof(struct sctp_stream_reset_request)) / sizeof(uint16_t); 8713 8714 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8715 if (chk == NULL) { 8716 return; 8717 } 8718 sctppcbinfo.ipi_count_chunk++; 8719 sctppcbinfo.ipi_gencnt_chunk++; 8720 chk->rec.chunk_id = SCTP_STREAM_RESET; 8721 chk->asoc = &stcb->asoc; 8722 chk->send_size = sizeof(struct sctp_stream_reset_resp) + (number_entries * sizeof(uint16_t)); 8723 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8724 if (chk->data == NULL) { 8725 strresp_jump_out: 8726 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8727 sctppcbinfo.ipi_count_chunk--; 8728 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8729 panic("Chunk count is negative"); 8730 } 8731 sctppcbinfo.ipi_gencnt_chunk++; 8732 return; 8733 } 8734 chk->data->m_data += SCTP_MIN_OVERHEAD; 8735 chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size); 8736 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) { 8737 MCLGET(chk->data, M_DONTWAIT); 8738 if ((chk->data->m_flags & M_EXT) == 0) { 8739 /* Give up */ 8740 sctp_m_freem(chk->data); 8741 chk->data = NULL; 8742 goto strresp_jump_out; 8743 } 8744 chk->data->m_data += SCTP_MIN_OVERHEAD; 8745 } 8746 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) { 8747 /* can't do it, no room */ 8748 /* Give up */ 8749 sctp_m_freem(chk->data); 8750 chk->data = NULL; 8751 goto strresp_jump_out; 8752 8753 } 8754 chk->sent = SCTP_DATAGRAM_UNSENT; 8755 chk->snd_count = 0; 8756 chk->whoTo = asoc->primary_destination; 8757 chk->whoTo->ref_count++; 8758 strack = mtod(chk->data, struct sctp_stream_reset_resp *); 8759 8760 strack->ch.chunk_type = SCTP_STREAM_RESET; 8761 strack->ch.chunk_flags = 0; 8762 strack->ch.chunk_length = htons(chk->send_size); 8763 8764 memset(strack->sr_resp.reset_pad, 0, sizeof(strack->sr_resp.reset_pad)); 8765 8766 strack->sr_resp.ph.param_type = ntohs(SCTP_STR_RESET_RESPONSE); 8767 strack->sr_resp.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr))); 8768 8769 8770 8771 if (chk->send_size % 4) { 8772 /* need a padding for the end */ 8773 int pad; 8774 uint8_t *end; 8775 end = (uint8_t *)((vaddr_t)strack + chk->send_size); 8776 pad = chk->send_size % 4; 8777 for (i = 0; i < pad; i++) { 8778 end[i] = 0; 8779 } 8780 chk->send_size += pad; 8781 } 8782 8783 /* actual response */ 8784 if (req->reset_flags & SCTP_RESET_YOUR) { 8785 strack->sr_resp.reset_flags = SCTP_RESET_PERFORMED; 8786 } else { 8787 strack->sr_resp.reset_flags = 0; 8788 } 8789 8790 /* copied from reset request */ 8791 strack->sr_resp.reset_req_seq_resp = req->reset_req_seq; 8792 seq = ntohl(req->reset_req_seq); 8793 8794 list = req->list_of_streams; 8795 /* copy the un-converted network byte order streams */ 8796 for (i=0; i<number_entries; i++) { 8797 strack->sr_resp.list_of_streams[i] = list[i]; 8798 } 8799 if (asoc->str_reset_seq_in == seq) { 8800 /* is it the next expected? */ 8801 asoc->str_reset_seq_in++; 8802 strack->sr_resp.reset_at_tsn = htonl(asoc->sending_seq); 8803 asoc->str_reset_sending_seq = asoc->sending_seq; 8804 if (number_entries) { 8805 uint16_t temp; 8806 /* convert them to host byte order */ 8807 for (i=0 ; i<number_entries; i++) { 8808 temp = ntohs(list[i]); 8809 list[i] = temp; 8810 } 8811 } 8812 if (req->reset_flags & SCTP_RESET_YOUR) { 8813 /* reset my outbound streams */ 8814 sctp_reset_the_streams(stcb, req , number_entries, list); 8815 } 8816 if (req->reset_flags & SCTP_RECIPRICAL) { 8817 /* reset peer too */ 8818 sctp_send_str_reset_req(stcb, number_entries, list, two_way, not_peer); 8819 } 8820 8821 } else { 8822 /* no its a retran so I must just ack and do nothing */ 8823 strack->sr_resp.reset_at_tsn = htonl(asoc->str_reset_sending_seq); 8824 } 8825 strack->sr_resp.cumulative_tsn = htonl(asoc->cumulative_tsn); 8826 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 8827 chk, 8828 sctp_next); 8829 asoc->ctrl_queue_cnt++; 8830 } 8831 8832 8833 void 8834 sctp_send_str_reset_req(struct sctp_tcb *stcb, 8835 int number_entrys, uint16_t *list, uint8_t two_way, uint8_t not_peer) 8836 { 8837 /* Send a stream reset request. The number_entrys may be 0 and list NULL 8838 * if the request is to reset all streams. If two_way is true then we 8839 * not only request a RESET of the received streams but we also 8840 * request the peer to send a reset req to us too. 8841 * Flag combinations in table: 8842 * 8843 * two_way | not_peer | = | Flags 8844 * ------------------------------ 8845 * 0 | 0 | = | SCTP_RESET_YOUR (just the peer) 8846 * 1 | 0 | = | SCTP_RESET_YOUR | SCTP_RECIPRICAL (both sides) 8847 * 0 | 1 | = | Not a Valid Request (not anyone) 8848 * 1 | 1 | = | SCTP_RESET_RECIPRICAL (Just local host) 8849 */ 8850 struct sctp_association *asoc; 8851 struct sctp_stream_reset_req *strreq; 8852 struct sctp_tmit_chunk *chk; 8853 8854 8855 asoc = &stcb->asoc; 8856 if (asoc->stream_reset_outstanding) { 8857 /* Already one pending, must get ACK back 8858 * to clear the flag. 8859 */ 8860 return; 8861 } 8862 8863 if ((two_way == 0) && (not_peer == 1)) { 8864 /* not a valid request */ 8865 return; 8866 } 8867 8868 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8869 if (chk == NULL) { 8870 return; 8871 } 8872 sctppcbinfo.ipi_count_chunk++; 8873 sctppcbinfo.ipi_gencnt_chunk++; 8874 chk->rec.chunk_id = SCTP_STREAM_RESET; 8875 chk->asoc = &stcb->asoc; 8876 chk->send_size = sizeof(struct sctp_stream_reset_req) + (number_entrys * sizeof(uint16_t)); 8877 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8878 if (chk->data == NULL) { 8879 strreq_jump_out: 8880 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8881 sctppcbinfo.ipi_count_chunk--; 8882 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8883 panic("Chunk count is negative"); 8884 } 8885 sctppcbinfo.ipi_gencnt_chunk++; 8886 return; 8887 } 8888 chk->data->m_data += SCTP_MIN_OVERHEAD; 8889 chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size); 8890 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) { 8891 MCLGET(chk->data, M_DONTWAIT); 8892 if ((chk->data->m_flags & M_EXT) == 0) { 8893 /* Give up */ 8894 sctp_m_freem(chk->data); 8895 chk->data = NULL; 8896 goto strreq_jump_out; 8897 } 8898 chk->data->m_data += SCTP_MIN_OVERHEAD; 8899 } 8900 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) { 8901 /* can't do it, no room */ 8902 /* Give up */ 8903 sctp_m_freem(chk->data); 8904 chk->data = NULL; 8905 goto strreq_jump_out; 8906 } 8907 chk->sent = SCTP_DATAGRAM_UNSENT; 8908 chk->snd_count = 0; 8909 chk->whoTo = asoc->primary_destination; 8910 chk->whoTo->ref_count++; 8911 8912 strreq = mtod(chk->data, struct sctp_stream_reset_req *); 8913 strreq->ch.chunk_type = SCTP_STREAM_RESET; 8914 strreq->ch.chunk_flags = 0; 8915 strreq->ch.chunk_length = htons(chk->send_size); 8916 8917 strreq->sr_req.ph.param_type = ntohs(SCTP_STR_RESET_REQUEST); 8918 strreq->sr_req.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr))); 8919 8920 if (chk->send_size % 4) { 8921 /* need a padding for the end */ 8922 int pad, i; 8923 uint8_t *end; 8924 end = (uint8_t *)((vaddr_t)strreq + chk->send_size); 8925 pad = chk->send_size % 4; 8926 for (i=0; i<pad; i++) { 8927 end[i] = 0; 8928 } 8929 chk->send_size += pad; 8930 } 8931 8932 strreq->sr_req.reset_flags = 0; 8933 if (number_entrys == 0) { 8934 strreq->sr_req.reset_flags |= SCTP_RESET_ALL; 8935 } 8936 if (two_way == 0) { 8937 strreq->sr_req.reset_flags |= SCTP_RESET_YOUR; 8938 } else { 8939 if (not_peer == 0) { 8940 strreq->sr_req.reset_flags |= SCTP_RECIPRICAL | SCTP_RESET_YOUR; 8941 } else { 8942 strreq->sr_req.reset_flags |= SCTP_RECIPRICAL; 8943 } 8944 } 8945 memset(strreq->sr_req.reset_pad, 0, sizeof(strreq->sr_req.reset_pad)); 8946 strreq->sr_req.reset_req_seq = htonl(asoc->str_reset_seq_out); 8947 if (number_entrys) { 8948 /* populate the specific entry's */ 8949 int i; 8950 for (i=0; i < number_entrys; i++) { 8951 strreq->sr_req.list_of_streams[i] = htons(list[i]); 8952 } 8953 } 8954 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 8955 chk, 8956 sctp_next); 8957 asoc->ctrl_queue_cnt++; 8958 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 8959 asoc->stream_reset_outstanding = 1; 8960 } 8961 8962 void 8963 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag, 8964 struct mbuf *err_cause) 8965 { 8966 /* 8967 * Formulate the abort message, and send it back down. 8968 */ 8969 struct mbuf *mout; 8970 struct sctp_abort_msg *abm; 8971 struct ip *iph, *iph_out; 8972 struct ip6_hdr *ip6, *ip6_out; 8973 int iphlen_out; 8974 8975 /* don't respond to ABORT with ABORT */ 8976 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 8977 if (err_cause) 8978 sctp_m_freem(err_cause); 8979 return; 8980 } 8981 MGETHDR(mout, M_DONTWAIT, MT_HEADER); 8982 if (mout == NULL) { 8983 if (err_cause) 8984 sctp_m_freem(err_cause); 8985 return; 8986 } 8987 iph = mtod(m, struct ip *); 8988 iph_out = NULL; 8989 ip6_out = NULL; 8990 if (iph->ip_v == IPVERSION) { 8991 iph_out = mtod(mout, struct ip *); 8992 mout->m_len = sizeof(*iph_out) + sizeof(*abm); 8993 mout->m_next = err_cause; 8994 8995 /* Fill in the IP header for the ABORT */ 8996 iph_out->ip_v = IPVERSION; 8997 iph_out->ip_hl = (sizeof(struct ip) / 4); 8998 iph_out->ip_tos = (u_char)0; 8999 iph_out->ip_id = 0; 9000 iph_out->ip_off = 0; 9001 iph_out->ip_ttl = MAXTTL; 9002 iph_out->ip_p = IPPROTO_SCTP; 9003 iph_out->ip_src.s_addr = iph->ip_dst.s_addr; 9004 iph_out->ip_dst.s_addr = iph->ip_src.s_addr; 9005 /* let IP layer calculate this */ 9006 iph_out->ip_sum = 0; 9007 9008 iphlen_out = sizeof(*iph_out); 9009 abm = (struct sctp_abort_msg *)((vaddr_t)iph_out + iphlen_out); 9010 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 9011 ip6 = (struct ip6_hdr *)iph; 9012 ip6_out = mtod(mout, struct ip6_hdr *); 9013 mout->m_len = sizeof(*ip6_out) + sizeof(*abm); 9014 mout->m_next = err_cause; 9015 9016 /* Fill in the IP6 header for the ABORT */ 9017 ip6_out->ip6_flow = ip6->ip6_flow; 9018 ip6_out->ip6_hlim = ip6_defhlim; 9019 ip6_out->ip6_nxt = IPPROTO_SCTP; 9020 ip6_out->ip6_src = ip6->ip6_dst; 9021 ip6_out->ip6_dst = ip6->ip6_src; 9022 9023 iphlen_out = sizeof(*ip6_out); 9024 abm = (struct sctp_abort_msg *)((vaddr_t)ip6_out + iphlen_out); 9025 } else { 9026 /* Currently not supported */ 9027 return; 9028 } 9029 9030 abm->sh.src_port = sh->dest_port; 9031 abm->sh.dest_port = sh->src_port; 9032 abm->sh.checksum = 0; 9033 if (vtag == 0) { 9034 abm->sh.v_tag = sh->v_tag; 9035 abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB; 9036 } else { 9037 abm->sh.v_tag = htonl(vtag); 9038 abm->msg.ch.chunk_flags = 0; 9039 } 9040 abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION; 9041 9042 if (err_cause) { 9043 struct mbuf *m_tmp = err_cause; 9044 int err_len = 0; 9045 /* get length of the err_cause chain */ 9046 while (m_tmp != NULL) { 9047 err_len += m_tmp->m_len; 9048 m_tmp = m_tmp->m_next; 9049 } 9050 mout->m_pkthdr.len = mout->m_len + err_len; 9051 if (err_len % 4) { 9052 /* need pad at end of chunk */ 9053 u_int32_t cpthis=0; 9054 int padlen; 9055 padlen = 4 - (mout->m_pkthdr.len % 4); 9056 m_copyback(mout, mout->m_pkthdr.len, padlen, (void *)&cpthis); 9057 } 9058 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len); 9059 } else { 9060 mout->m_pkthdr.len = mout->m_len; 9061 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch)); 9062 } 9063 9064 /* add checksum */ 9065 if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL && 9066 m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) { 9067 abm->sh.checksum = 0; 9068 } else { 9069 abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out); 9070 } 9071 9072 /* zap the rcvif, it should be null */ 9073 m_reset_rcvif(mout); 9074 if (iph_out != NULL) { 9075 struct route ro; 9076 9077 /* zap the stack pointer to the route */ 9078 memset(&ro, 0, sizeof ro); 9079 #ifdef SCTP_DEBUG 9080 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 9081 printf("sctp_send_abort calling ip_output:\n"); 9082 sctp_print_address_pkt(iph_out, &abm->sh); 9083 } 9084 #endif 9085 /* set IPv4 length */ 9086 iph_out->ip_len = htons(mout->m_pkthdr.len); 9087 /* out it goes */ 9088 (void)ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL, NULL); 9089 } else if (ip6_out != NULL) { 9090 struct route ro; 9091 9092 /* zap the stack pointer to the route */ 9093 memset(&ro, 0, sizeof(ro)); 9094 #ifdef SCTP_DEBUG 9095 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 9096 printf("sctp_send_abort calling ip6_output:\n"); 9097 sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh); 9098 } 9099 #endif 9100 ip6_output(mout, NULL, &ro, 0, NULL, NULL, NULL); 9101 } 9102 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 9103 } 9104 9105 void 9106 sctp_send_operr_to(struct mbuf *m, int iphlen, 9107 struct mbuf *scm, 9108 uint32_t vtag) 9109 { 9110 struct sctphdr *ihdr; 9111 struct sctphdr *ohdr; 9112 struct sctp_chunkhdr *ophdr; 9113 9114 struct ip *iph; 9115 #ifdef SCTP_DEBUG 9116 struct sockaddr_in6 lsa6, fsa6; 9117 #endif 9118 uint32_t val; 9119 iph = mtod(m, struct ip *); 9120 ihdr = (struct sctphdr *)((vaddr_t)iph + iphlen); 9121 if (!(scm->m_flags & M_PKTHDR)) { 9122 /* must be a pkthdr */ 9123 printf("Huh, not a packet header in send_operr\n"); 9124 m_freem(scm); 9125 return; 9126 } 9127 M_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), M_DONTWAIT); 9128 if (scm == NULL) { 9129 /* can't send because we can't add a mbuf */ 9130 return; 9131 } 9132 ohdr = mtod(scm, struct sctphdr *); 9133 ohdr->src_port = ihdr->dest_port; 9134 ohdr->dest_port = ihdr->src_port; 9135 ohdr->v_tag = vtag; 9136 ohdr->checksum = 0; 9137 ophdr = (struct sctp_chunkhdr *)(ohdr + 1); 9138 ophdr->chunk_type = SCTP_OPERATION_ERROR; 9139 ophdr->chunk_flags = 0; 9140 ophdr->chunk_length = htons(scm->m_pkthdr.len - sizeof(struct sctphdr)); 9141 if (scm->m_pkthdr.len % 4) { 9142 /* need padding */ 9143 u_int32_t cpthis=0; 9144 int padlen; 9145 padlen = 4 - (scm->m_pkthdr.len % 4); 9146 m_copyback(scm, scm->m_pkthdr.len, padlen, (void *)&cpthis); 9147 } 9148 if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL && 9149 m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) { 9150 val = 0; 9151 } else { 9152 val = sctp_calculate_sum(scm, NULL, 0); 9153 } 9154 ohdr->checksum = val; 9155 if (iph->ip_v == IPVERSION) { 9156 /* V4 */ 9157 struct ip *out; 9158 struct route ro; 9159 M_PREPEND(scm, sizeof(struct ip), M_DONTWAIT); 9160 if (scm == NULL) 9161 return; 9162 memset(&ro, 0, sizeof ro); 9163 out = mtod(scm, struct ip *); 9164 out->ip_v = iph->ip_v; 9165 out->ip_hl = (sizeof(struct ip)/4); 9166 out->ip_tos = iph->ip_tos; 9167 out->ip_id = iph->ip_id; 9168 out->ip_off = 0; 9169 out->ip_ttl = MAXTTL; 9170 out->ip_p = IPPROTO_SCTP; 9171 out->ip_sum = 0; 9172 out->ip_src = iph->ip_dst; 9173 out->ip_dst = iph->ip_src; 9174 out->ip_len = htons(scm->m_pkthdr.len); 9175 ip_output(scm, 0, &ro, IP_RAWOUTPUT, NULL, NULL); 9176 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 9177 } else { 9178 /* V6 */ 9179 struct route ro; 9180 struct ip6_hdr *out6, *in6; 9181 9182 M_PREPEND(scm, sizeof(struct ip6_hdr), M_DONTWAIT); 9183 if (scm == NULL) 9184 return; 9185 memset(&ro, 0, sizeof ro); 9186 in6 = mtod(m, struct ip6_hdr *); 9187 out6 = mtod(scm, struct ip6_hdr *); 9188 out6->ip6_flow = in6->ip6_flow; 9189 out6->ip6_hlim = ip6_defhlim; 9190 out6->ip6_nxt = IPPROTO_SCTP; 9191 out6->ip6_src = in6->ip6_dst; 9192 out6->ip6_dst = in6->ip6_src; 9193 9194 #ifdef SCTP_DEBUG 9195 memset(&lsa6, 0, sizeof(lsa6)); 9196 lsa6.sin6_len = sizeof(lsa6); 9197 lsa6.sin6_family = AF_INET6; 9198 lsa6.sin6_addr = out6->ip6_src; 9199 memset(&fsa6, 0, sizeof(fsa6)); 9200 fsa6.sin6_len = sizeof(fsa6); 9201 fsa6.sin6_family = AF_INET6; 9202 fsa6.sin6_addr = out6->ip6_dst; 9203 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 9204 printf("sctp_operr_to calling ipv6 output:\n"); 9205 printf("src: "); 9206 sctp_print_address((struct sockaddr *)&lsa6); 9207 printf("dst "); 9208 sctp_print_address((struct sockaddr *)&fsa6); 9209 } 9210 #endif /* SCTP_DEBUG */ 9211 ip6_output(scm, NULL, &ro, 0, NULL, NULL, NULL); 9212 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 9213 } 9214 } 9215 9216 static int 9217 sctp_copy_one(struct mbuf *m, struct uio *uio, int cpsz, int resv_upfront, int *mbcnt) 9218 { 9219 int left, cancpy, willcpy, error; 9220 left = cpsz; 9221 9222 if (m == NULL) { 9223 /* TSNH */ 9224 *mbcnt = 0; 9225 return (ENOMEM); 9226 } 9227 m->m_len = 0; 9228 if ((left+resv_upfront) > (int)MHLEN) { 9229 MCLGET(m, M_WAIT); 9230 if (m == NULL) { 9231 *mbcnt = 0; 9232 return (ENOMEM); 9233 } 9234 if ((m->m_flags & M_EXT) == 0) { 9235 *mbcnt = 0; 9236 return (ENOMEM); 9237 } 9238 *mbcnt += m->m_ext.ext_size; 9239 } 9240 *mbcnt += MSIZE; 9241 cancpy = M_TRAILINGSPACE(m); 9242 willcpy = uimin(cancpy, left); 9243 if ((willcpy + resv_upfront) > cancpy) { 9244 willcpy -= resv_upfront; 9245 } 9246 while (left > 0) { 9247 /* Align data to the end */ 9248 if ((m->m_flags & M_EXT) == 0) { 9249 m_align(m, willcpy); 9250 } else { 9251 MC_ALIGN(m, willcpy); 9252 } 9253 error = uiomove(mtod(m, void *), willcpy, uio); 9254 if (error) { 9255 return (error); 9256 } 9257 m->m_len = willcpy; 9258 m->m_nextpkt = 0; 9259 left -= willcpy; 9260 if (left > 0) { 9261 MGET(m->m_next, M_WAIT, MT_DATA); 9262 if (m->m_next == NULL) { 9263 *mbcnt = 0; 9264 return (ENOMEM); 9265 } 9266 m = m->m_next; 9267 m->m_len = 0; 9268 *mbcnt += MSIZE; 9269 if (left > (int)MHLEN) { 9270 MCLGET(m, M_WAIT); 9271 if (m == NULL) { 9272 *mbcnt = 0; 9273 return (ENOMEM); 9274 } 9275 if ((m->m_flags & M_EXT) == 0) { 9276 *mbcnt = 0; 9277 return (ENOMEM); 9278 } 9279 *mbcnt += m->m_ext.ext_size; 9280 } 9281 cancpy = M_TRAILINGSPACE(m); 9282 willcpy = uimin(cancpy, left); 9283 } 9284 } 9285 return (0); 9286 } 9287 9288 static int 9289 sctp_copy_it_in(struct sctp_inpcb *inp, 9290 struct sctp_tcb *stcb, 9291 struct sctp_association *asoc, 9292 struct sctp_nets *net, 9293 struct sctp_sndrcvinfo *srcv, 9294 struct uio *uio, 9295 int flags) 9296 { 9297 /* This routine must be very careful in 9298 * its work. Protocol processing is 9299 * up and running so care must be taken to 9300 * spl...() when you need to do something 9301 * that may effect the stcb/asoc. The sb is 9302 * locked however. When data is copied the 9303 * protocol processing should be enabled since 9304 * this is a slower operation... 9305 */ 9306 struct socket *so; 9307 int error = 0; 9308 int frag_size, mbcnt = 0, mbcnt_e = 0; 9309 unsigned int sndlen; 9310 unsigned int tot_demand; 9311 int tot_out, dataout; 9312 struct sctp_tmit_chunk *chk; 9313 struct mbuf *mm; 9314 struct sctp_stream_out *strq; 9315 uint32_t my_vtag; 9316 int resv_in_first; 9317 9318 so = stcb->sctp_socket; 9319 solock(so); 9320 chk = NULL; 9321 mm = NULL; 9322 9323 sndlen = uio->uio_resid; 9324 /* lock the socket buf */ 9325 error = sblock(&so->so_snd, SBLOCKWAIT(flags)); 9326 if (error) 9327 goto out_locked; 9328 9329 #ifdef SCTP_DEBUG 9330 printf("sctp_copy_it_in: %d\n", sndlen); 9331 #endif 9332 /* will it ever fit ? */ 9333 if (sndlen > so->so_snd.sb_hiwat) { 9334 /* It will NEVER fit */ 9335 error = EMSGSIZE; 9336 goto release; 9337 } 9338 /* Do I need to block? */ 9339 if ((so->so_snd.sb_hiwat < 9340 (sndlen + asoc->total_output_queue_size)) || 9341 (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) || 9342 (asoc->total_output_mbuf_queue_size > 9343 so->so_snd.sb_mbmax) 9344 ) { 9345 /* prune any prsctp bufs out */ 9346 if (asoc->peer_supports_prsctp) { 9347 sctp_prune_prsctp(stcb, asoc, srcv, sndlen); 9348 } 9349 /* 9350 * We store off a pointer to the endpoint. 9351 * Since on return from this we must check to 9352 * see if an so_error is set. If so we may have 9353 * been reset and our stcb destroyed. Returning 9354 * an error will flow back to the user... 9355 */ 9356 while ((so->so_snd.sb_hiwat < 9357 (sndlen + asoc->total_output_queue_size)) || 9358 (asoc->chunks_on_out_queue > 9359 sctp_max_chunks_on_queue) || 9360 (asoc->total_output_mbuf_queue_size > 9361 so->so_snd.sb_mbmax) 9362 ) { 9363 if ((so->so_state & SS_NBIO) 9364 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000 9365 || (flags & MSG_NBIO) 9366 #endif 9367 ) { 9368 /* Non-blocking io in place */ 9369 error = EWOULDBLOCK; 9370 goto release; 9371 } 9372 inp->sctp_tcb_at_block = (void *)stcb; 9373 inp->error_on_block = 0; 9374 #ifdef SCTP_BLK_LOGGING 9375 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 9376 so, asoc); 9377 #endif 9378 sbunlock(&so->so_snd); 9379 SCTP_TCB_UNLOCK(stcb); 9380 error = sbwait(&so->so_snd); 9381 SCTP_INP_RLOCK(inp); 9382 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 9383 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 9384 /* Should I really unlock ? */ 9385 SCTP_INP_RUNLOCK(inp); 9386 error = EFAULT; 9387 goto out_locked; 9388 } 9389 SCTP_TCB_LOCK(stcb); 9390 SCTP_INP_RUNLOCK(inp); 9391 9392 inp->sctp_tcb_at_block = 0; 9393 #ifdef SCTP_BLK_LOGGING 9394 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 9395 so, asoc); 9396 #endif 9397 if (inp->error_on_block) { 9398 /* 9399 * if our asoc was killed, the free code 9400 * (in sctp_pcb.c) will save a error in 9401 * here for us 9402 */ 9403 error = inp->error_on_block; 9404 goto out_locked; 9405 } 9406 if (error) { 9407 goto out_locked; 9408 } 9409 /* did we encounter a socket error? */ 9410 if (so->so_error) { 9411 error = so->so_error; 9412 goto out_locked; 9413 } 9414 error = sblock(&so->so_snd, M_WAITOK); 9415 if (error) { 9416 /* Can't acquire the lock */ 9417 goto out_locked; 9418 } 9419 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115 9420 if (so->so_rcv.sb_state & SBS_CANTSENDMORE) { 9421 #else 9422 if (so->so_state & SS_CANTSENDMORE) { 9423 #endif 9424 /* The socket is now set not to sendmore.. its gone */ 9425 error = EPIPE; 9426 goto release; 9427 } 9428 if (so->so_error) { 9429 error = so->so_error; 9430 goto release; 9431 } 9432 if (asoc->peer_supports_prsctp) { 9433 sctp_prune_prsctp(stcb, asoc, srcv, sndlen); 9434 } 9435 } 9436 } 9437 dataout = tot_out = uio->uio_resid; 9438 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 9439 resv_in_first = SCTP_MED_OVERHEAD; 9440 } else { 9441 resv_in_first = SCTP_MED_V4_OVERHEAD; 9442 } 9443 9444 /* Are we aborting? */ 9445 if (srcv->sinfo_flags & SCTP_ABORT) { 9446 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) && 9447 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) { 9448 /* It has to be up before we abort */ 9449 /* how big is the user initiated abort? */ 9450 9451 /* I wonder about doing a MGET without a splnet set. 9452 * it is done that way in the sosend code so I guess 9453 * it is ok :-0 9454 */ 9455 MGETHDR(mm, M_WAIT, MT_DATA); 9456 if (mm) { 9457 struct sctp_paramhdr *ph; 9458 9459 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 9460 if (tot_demand > MHLEN) { 9461 if (tot_demand > MCLBYTES) { 9462 /* truncate user data */ 9463 tot_demand = MCLBYTES; 9464 tot_out = tot_demand - sizeof(struct sctp_paramhdr); 9465 } 9466 MCLGET(mm, M_WAIT); 9467 if ((mm->m_flags & M_EXT) == 0) { 9468 /* truncate further */ 9469 tot_demand = MHLEN; 9470 tot_out = tot_demand - sizeof(struct sctp_paramhdr); 9471 } 9472 } 9473 /* now move forward the data pointer */ 9474 ph = mtod(mm, struct sctp_paramhdr *); 9475 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 9476 ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out)); 9477 ph++; 9478 mm->m_pkthdr.len = tot_out + sizeof(struct sctp_paramhdr); 9479 mm->m_len = mm->m_pkthdr.len; 9480 error = uiomove((void *)ph, (int)tot_out, uio); 9481 if (error) { 9482 /* 9483 * Here if we can't get his data we 9484 * still abort we just don't get to 9485 * send the users note :-0 9486 */ 9487 sctp_m_freem(mm); 9488 mm = NULL; 9489 } 9490 } 9491 sbunlock(&so->so_snd); 9492 sctp_abort_an_association(stcb->sctp_ep, stcb, 9493 SCTP_RESPONSE_TO_USER_REQ, 9494 mm); 9495 mm = NULL; 9496 goto out_locked; 9497 } 9498 goto release; 9499 } 9500 9501 /* Now can we send this? */ 9502 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 9503 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 9504 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 9505 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 9506 /* got data while shutting down */ 9507 error = ECONNRESET; 9508 goto release; 9509 } 9510 /* Is the stream no. valid? */ 9511 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 9512 /* Invalid stream number */ 9513 error = EINVAL; 9514 goto release; 9515 } 9516 if (asoc->strmout == NULL) { 9517 /* huh? software error */ 9518 #ifdef SCTP_DEBUG 9519 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 9520 printf("software error in sctp_copy_it_in\n"); 9521 } 9522 #endif 9523 error = EFAULT; 9524 goto release; 9525 } 9526 if ((srcv->sinfo_flags & SCTP_EOF) && 9527 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) && 9528 (tot_out == 0)) { 9529 sounlock(so); 9530 goto zap_by_it_now; 9531 } 9532 if (tot_out == 0) { 9533 /* not allowed */ 9534 error = EMSGSIZE; 9535 goto release; 9536 } 9537 /* save off the tag */ 9538 my_vtag = asoc->my_vtag; 9539 strq = &asoc->strmout[srcv->sinfo_stream]; 9540 /* First lets figure out the "chunking" point */ 9541 frag_size = sctp_get_frag_point(stcb, asoc); 9542 9543 /* two choices here, it all fits in one chunk or 9544 * we need multiple chunks. 9545 */ 9546 sounlock(so); 9547 if (tot_out <= frag_size) { 9548 /* no need to setup a template */ 9549 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 9550 if (chk == NULL) { 9551 error = ENOMEM; 9552 goto release; 9553 } 9554 sctppcbinfo.ipi_count_chunk++; 9555 sctppcbinfo.ipi_gencnt_chunk++; 9556 asoc->chunks_on_out_queue++; 9557 MGETHDR(mm, M_WAIT, MT_DATA); 9558 if (mm == NULL) { 9559 error = ENOMEM; 9560 goto clean_up; 9561 } 9562 error = sctp_copy_one(mm, uio, tot_out, resv_in_first, &mbcnt_e); 9563 if (error) 9564 goto clean_up; 9565 sctp_prepare_chunk(chk, stcb, srcv, strq, net); 9566 chk->mbcnt = mbcnt_e; 9567 mbcnt += mbcnt_e; 9568 mbcnt_e = 0; 9569 mm->m_pkthdr.len = tot_out; 9570 chk->data = mm; 9571 mm = NULL; 9572 9573 /* the actual chunk flags */ 9574 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG; 9575 chk->whoTo->ref_count++; 9576 9577 /* fix up the send_size if it is not present */ 9578 chk->send_size = tot_out; 9579 chk->book_size = chk->send_size; 9580 /* ok, we are committed */ 9581 if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) { 9582 /* bump the ssn if we are unordered. */ 9583 strq->next_sequence_sent++; 9584 } 9585 if (chk->flags & SCTP_PR_SCTP_BUFFER) { 9586 asoc->sent_queue_cnt_removeable++; 9587 } 9588 solock(so); 9589 if ((asoc->state == 0) || 9590 (my_vtag != asoc->my_vtag) || 9591 (so != inp->sctp_socket) || 9592 (inp->sctp_socket == 0)) { 9593 /* connection was aborted */ 9594 sounlock(so); 9595 error = ECONNRESET; 9596 goto clean_up; 9597 } 9598 asoc->stream_queue_cnt++; 9599 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next); 9600 /* now check if this stream is on the wheel */ 9601 if ((strq->next_spoke.tqe_next == NULL) && 9602 (strq->next_spoke.tqe_prev == NULL)) { 9603 /* Insert it on the wheel since it is not 9604 * on it currently 9605 */ 9606 sctp_insert_on_wheel(asoc, strq); 9607 } 9608 sounlock(so); 9609 clean_up: 9610 if (error) { 9611 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 9612 sctppcbinfo.ipi_count_chunk--; 9613 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 9614 panic("Chunk count is negative"); 9615 } 9616 goto release; 9617 } 9618 } else { 9619 /* we need to setup a template */ 9620 struct sctp_tmit_chunk template; 9621 struct sctpchunk_listhead tmp; 9622 9623 /* setup the template */ 9624 sctp_prepare_chunk(&template, stcb, srcv, strq, net); 9625 9626 /* Prepare the temp list */ 9627 TAILQ_INIT(&tmp); 9628 9629 /* Template is complete, now time for the work */ 9630 while (tot_out > 0) { 9631 /* Get a chunk */ 9632 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 9633 if (chk == NULL) { 9634 /* 9635 * ok we must spin through and dump anything 9636 * we have allocated and then jump to the 9637 * no_membad 9638 */ 9639 error = ENOMEM; 9640 } 9641 sctppcbinfo.ipi_count_chunk++; 9642 asoc->chunks_on_out_queue++; 9643 9644 sctppcbinfo.ipi_gencnt_chunk++; 9645 *chk = template; 9646 chk->whoTo->ref_count++; 9647 MGETHDR(chk->data, M_WAIT, MT_DATA); 9648 if (chk->data == NULL) { 9649 error = ENOMEM; 9650 goto temp_clean_up; 9651 } 9652 tot_demand = uimin(tot_out, frag_size); 9653 error = sctp_copy_one(chk->data, uio, tot_demand , resv_in_first, &mbcnt_e); 9654 if (error) 9655 goto temp_clean_up; 9656 /* now fix the chk->send_size */ 9657 chk->mbcnt = mbcnt_e; 9658 mbcnt += mbcnt_e; 9659 mbcnt_e = 0; 9660 chk->send_size = tot_demand; 9661 chk->data->m_pkthdr.len = tot_demand; 9662 chk->book_size = chk->send_size; 9663 if (chk->flags & SCTP_PR_SCTP_BUFFER) { 9664 asoc->sent_queue_cnt_removeable++; 9665 } 9666 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next); 9667 tot_out -= tot_demand; 9668 } 9669 /* Now the tmp list holds all chunks and data */ 9670 if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) { 9671 /* bump the ssn if we are unordered. */ 9672 strq->next_sequence_sent++; 9673 } 9674 /* Mark the first/last flags. This will 9675 * result int a 3 for a single item on the list 9676 */ 9677 chk = TAILQ_FIRST(&tmp); 9678 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG; 9679 chk = TAILQ_LAST(&tmp, sctpchunk_listhead); 9680 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG; 9681 9682 /* now move it to the streams actual queue */ 9683 /* first stop protocol processing */ 9684 mutex_enter(softnet_lock); 9685 if ((asoc->state == 0) || 9686 (my_vtag != asoc->my_vtag) || 9687 (so != inp->sctp_socket) || 9688 (inp->sctp_socket == 0)) { 9689 /* connection was aborted */ 9690 mutex_exit(softnet_lock); 9691 error = ECONNRESET; 9692 goto temp_clean_up; 9693 } 9694 chk = TAILQ_FIRST(&tmp); 9695 while (chk) { 9696 chk->data->m_nextpkt = 0; 9697 TAILQ_REMOVE(&tmp, chk, sctp_next); 9698 asoc->stream_queue_cnt++; 9699 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next); 9700 chk = TAILQ_FIRST(&tmp); 9701 } 9702 /* now check if this stream is on the wheel */ 9703 if ((strq->next_spoke.tqe_next == NULL) && 9704 (strq->next_spoke.tqe_prev == NULL)) { 9705 /* Insert it on the wheel since it is not 9706 * on it currently 9707 */ 9708 sctp_insert_on_wheel(asoc, strq); 9709 } 9710 /* Ok now we can allow pping */ 9711 mutex_exit(softnet_lock); 9712 temp_clean_up: 9713 if (error) { 9714 chk = TAILQ_FIRST(&tmp); 9715 while (chk) { 9716 if (chk->data) { 9717 sctp_m_freem(chk->data); 9718 chk->data = NULL; 9719 } 9720 TAILQ_REMOVE(&tmp, chk, sctp_next); 9721 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 9722 sctppcbinfo.ipi_count_chunk--; 9723 asoc->chunks_on_out_queue--; 9724 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 9725 panic("Chunk count is negative"); 9726 } 9727 sctppcbinfo.ipi_gencnt_chunk++; 9728 chk = TAILQ_FIRST(&tmp); 9729 } 9730 goto release; 9731 } 9732 } 9733 zap_by_it_now: 9734 #ifdef SCTP_MBCNT_LOGGING 9735 sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE, 9736 asoc->total_output_queue_size, 9737 dataout, 9738 asoc->total_output_mbuf_queue_size, 9739 mbcnt); 9740 #endif 9741 solock(so); 9742 asoc->total_output_queue_size += dataout; 9743 asoc->total_output_mbuf_queue_size += mbcnt; 9744 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 9745 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 9746 so->so_snd.sb_cc += dataout; 9747 so->so_snd.sb_mbcnt += mbcnt; 9748 } 9749 if ((srcv->sinfo_flags & SCTP_EOF) && 9750 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) 9751 ) { 9752 int some_on_streamwheel = 0; 9753 error = 0; 9754 if (!TAILQ_EMPTY(&asoc->out_wheel)) { 9755 /* Check to see if some data queued */ 9756 struct sctp_stream_out *outs; 9757 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 9758 if (!TAILQ_EMPTY(&outs->outqueue)) { 9759 some_on_streamwheel = 1; 9760 break; 9761 } 9762 } 9763 } 9764 if (TAILQ_EMPTY(&asoc->send_queue) && 9765 TAILQ_EMPTY(&asoc->sent_queue) && 9766 (some_on_streamwheel == 0)) { 9767 /* there is nothing queued to send, so I'm done... */ 9768 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 9769 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 9770 /* only send SHUTDOWN the first time through */ 9771 #ifdef SCTP_DEBUG 9772 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 9773 printf("%s:%d sends a shutdown\n", 9774 __FILE__, 9775 __LINE__ 9776 ); 9777 } 9778 #endif 9779 sctp_send_shutdown(stcb, stcb->asoc.primary_destination); 9780 asoc->state = SCTP_STATE_SHUTDOWN_SENT; 9781 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 9782 asoc->primary_destination); 9783 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 9784 asoc->primary_destination); 9785 } 9786 } else { 9787 /* 9788 * we still got (or just got) data to send, so set 9789 * SHUTDOWN_PENDING 9790 */ 9791 /* 9792 * XXX sockets draft says that SCTP_EOF should be sent 9793 * with no data. currently, we will allow user data 9794 * to be sent first and move to SHUTDOWN-PENDING 9795 */ 9796 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 9797 } 9798 } 9799 #ifdef SCTP_DEBUG 9800 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 9801 printf("++total out:%d total_mbuf_out:%d\n", 9802 (int)asoc->total_output_queue_size, 9803 (int)asoc->total_output_mbuf_queue_size); 9804 } 9805 #endif 9806 9807 release: 9808 sbunlock(&so->so_snd); 9809 out_locked: 9810 sounlock(so); 9811 9812 if (mm) 9813 sctp_m_freem(mm); 9814 return (error); 9815 } 9816 9817 9818 int 9819 sctp_sosend(struct socket *so, struct sockaddr *addr, struct uio *uio, 9820 struct mbuf *top, struct mbuf *control, int flags, struct lwp *p) 9821 { 9822 int error, use_rcvinfo; 9823 int queue_only = 0, queue_only_for_init=0; 9824 int un_sent = 0; 9825 int now_filled=0; 9826 struct sctp_inpcb *inp; 9827 struct sctp_tcb *stcb=NULL; 9828 struct sctp_sndrcvinfo srcv; 9829 struct timeval now; 9830 struct sctp_nets *net; 9831 struct sctp_association *asoc; 9832 struct sctp_inpcb *t_inp; 9833 int create_lock_applied = 0; 9834 9835 error = use_rcvinfo = 0; 9836 net = NULL; 9837 stcb = NULL; 9838 asoc = NULL; 9839 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 9840 9841 solock(so); 9842 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 9843 (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) { 9844 /* The listner can NOT send */ 9845 error = EFAULT; 9846 sounlock(so); 9847 goto out; 9848 } 9849 if (addr) { 9850 SCTP_ASOC_CREATE_LOCK(inp); 9851 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 9852 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 9853 /* Should I really unlock ? */ 9854 error = EFAULT; 9855 sounlock(so); 9856 goto out; 9857 9858 } 9859 create_lock_applied = 1; 9860 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 9861 (addr->sa_family == AF_INET6)) { 9862 error = EINVAL; 9863 sounlock(so); 9864 goto out; 9865 } 9866 } 9867 /* now we must find the assoc */ 9868 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 9869 SCTP_INP_RLOCK(inp); 9870 stcb = LIST_FIRST(&inp->sctp_asoc_list); 9871 if (stcb == NULL) { 9872 SCTP_INP_RUNLOCK(inp); 9873 error = ENOTCONN; 9874 sounlock(so); 9875 goto out; 9876 } 9877 SCTP_TCB_LOCK(stcb); 9878 SCTP_INP_RUNLOCK(inp); 9879 net = stcb->asoc.primary_destination; 9880 } 9881 #ifdef SCTP_DEBUG 9882 printf("sctp_sosend: get control\n"); 9883 #endif 9884 /* get control */ 9885 if (control) { 9886 /* process cmsg snd/rcv info (maybe a assoc-id) */ 9887 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control, 9888 sizeof(srcv))) { 9889 /* got one */ 9890 if (srcv.sinfo_flags & SCTP_SENDALL) { 9891 /* its a sendall */ 9892 sctppcbinfo.mbuf_track--; 9893 sctp_m_freem(control); 9894 9895 if (create_lock_applied) { 9896 SCTP_ASOC_CREATE_UNLOCK(inp); 9897 create_lock_applied = 0; 9898 } 9899 return (sctp_sendall(inp, uio, top, &srcv)); 9900 } 9901 use_rcvinfo = 1; 9902 } 9903 } 9904 #ifdef SCTP_DEBUG 9905 printf("sctp_sosend: doing lookup\n"); 9906 #endif 9907 if (stcb == NULL) { 9908 /* Need to do a lookup */ 9909 if (use_rcvinfo && srcv.sinfo_assoc_id) { 9910 stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id); 9911 /* 9912 * Question: Should I error here if the assoc_id is 9913 * no longer valid? i.e. I can't find it? 9914 */ 9915 if ((stcb) && 9916 (addr != NULL)) { 9917 /* Must locate the net structure */ 9918 net = sctp_findnet(stcb, addr); 9919 } 9920 } 9921 if (stcb == NULL) { 9922 if (addr != NULL) { 9923 /* Since we did not use findep we must 9924 * increment it, and if we don't find a 9925 * tcb decrement it. 9926 */ 9927 SCTP_INP_WLOCK(inp); 9928 SCTP_INP_INCR_REF(inp); 9929 SCTP_INP_WUNLOCK(inp); 9930 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 9931 if (stcb == NULL) { 9932 SCTP_INP_WLOCK(inp); 9933 SCTP_INP_DECR_REF(inp); 9934 SCTP_INP_WUNLOCK(inp); 9935 } 9936 } 9937 } 9938 } 9939 if ((stcb == NULL) && 9940 (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) { 9941 error = ENOTCONN; 9942 sounlock(so); 9943 goto out; 9944 } else if ((stcb == NULL) && (addr == NULL)) { 9945 error = ENOENT; 9946 sounlock(so); 9947 goto out; 9948 } else if (stcb == NULL) { 9949 /* UDP style, we must go ahead and start the INIT process */ 9950 if ((use_rcvinfo) && 9951 (srcv.sinfo_flags & SCTP_ABORT)) { 9952 /* User asks to abort a non-existent asoc */ 9953 error = ENOENT; 9954 sounlock(so); 9955 goto out; 9956 } 9957 /* get an asoc/stcb struct */ 9958 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0); 9959 if (stcb == NULL) { 9960 /* Error is setup for us in the call */ 9961 sounlock(so); 9962 goto out; 9963 } 9964 if (create_lock_applied) { 9965 SCTP_ASOC_CREATE_UNLOCK(inp); 9966 create_lock_applied = 0; 9967 } else { 9968 printf("Huh-3? create lock should have been on??\n"); 9969 } 9970 /* Turn on queue only flag to prevent data from being sent */ 9971 queue_only = 1; 9972 asoc = &stcb->asoc; 9973 asoc->state = SCTP_STATE_COOKIE_WAIT; 9974 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 9975 if (control) { 9976 /* see if a init structure exists in cmsg headers */ 9977 struct sctp_initmsg initm; 9978 int i; 9979 if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, sizeof(initm))) { 9980 /* we have an INIT override of the default */ 9981 if (initm.sinit_max_attempts) 9982 asoc->max_init_times = initm.sinit_max_attempts; 9983 if (initm.sinit_num_ostreams) 9984 asoc->pre_open_streams = initm.sinit_num_ostreams; 9985 if (initm.sinit_max_instreams) 9986 asoc->max_inbound_streams = initm.sinit_max_instreams; 9987 if (initm.sinit_max_init_timeo) 9988 asoc->initial_init_rto_max = initm.sinit_max_init_timeo; 9989 if (asoc->streamoutcnt < asoc->pre_open_streams) { 9990 /* Default is NOT correct */ 9991 #ifdef SCTP_DEBUG 9992 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 9993 printf("Ok, defout:%d pre_open:%d\n", 9994 asoc->streamoutcnt, asoc->pre_open_streams); 9995 } 9996 #endif 9997 free(asoc->strmout, M_PCB); 9998 asoc->strmout = NULL; 9999 asoc->streamoutcnt = asoc->pre_open_streams; 10000 10001 /* What happesn if this fails? .. we panic ...*/ 10002 asoc->strmout = malloc( 10003 asoc->streamoutcnt * 10004 sizeof(struct sctp_stream_out), 10005 M_PCB, M_WAIT); 10006 for (i = 0; i < asoc->streamoutcnt; i++) { 10007 /* 10008 * inbound side must be set to 0xffff, 10009 * also NOTE when we get the INIT-ACK 10010 * back (for INIT sender) we MUST 10011 * reduce the count (streamoutcnt) but 10012 * first check if we sent to any of the 10013 * upper streams that were dropped (if 10014 * some were). Those that were dropped 10015 * must be notified to the upper layer 10016 * as failed to send. 10017 */ 10018 asoc->strmout[i].next_sequence_sent = 0x0; 10019 TAILQ_INIT(&asoc->strmout[i].outqueue); 10020 asoc->strmout[i].stream_no = i; 10021 asoc->strmout[i].next_spoke.tqe_next = 0; 10022 asoc->strmout[i].next_spoke.tqe_prev = 0; 10023 } 10024 } 10025 } 10026 10027 } 10028 /* out with the INIT */ 10029 queue_only_for_init = 1; 10030 sctp_send_initiate(inp, stcb); 10031 /* 10032 * we may want to dig in after this call and adjust the MTU 10033 * value. It defaulted to 1500 (constant) but the ro structure 10034 * may now have an update and thus we may need to change it 10035 * BEFORE we append the message. 10036 */ 10037 net = stcb->asoc.primary_destination; 10038 asoc = &stcb->asoc; 10039 } else { 10040 asoc = &stcb->asoc; 10041 } 10042 if (create_lock_applied) { 10043 SCTP_ASOC_CREATE_UNLOCK(inp); 10044 create_lock_applied = 0; 10045 } 10046 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 10047 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 10048 queue_only = 1; 10049 } 10050 if (use_rcvinfo == 0) { 10051 /* Grab the default stuff from the asoc */ 10052 srcv = stcb->asoc.def_send; 10053 } 10054 /* we are now done with all control */ 10055 if (control) { 10056 sctp_m_freem(control); 10057 control = NULL; 10058 } 10059 10060 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 10061 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 10062 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 10063 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 10064 if ((use_rcvinfo) && 10065 (srcv.sinfo_flags & SCTP_ABORT)) { 10066 ; 10067 } else { 10068 error = ECONNRESET; 10069 sounlock(so); 10070 goto out; 10071 } 10072 } 10073 /* Ok, we will attempt a msgsnd :> */ 10074 #if 0 /* XXX */ 10075 if (p) 10076 p->p_stats->p_ru.ru_msgsnd++; 10077 #endif 10078 10079 if (stcb) { 10080 if (net && ((srcv.sinfo_flags & SCTP_ADDR_OVER))) { 10081 /* we take the override or the unconfirmed */ 10082 ; 10083 } else { 10084 net = stcb->asoc.primary_destination; 10085 } 10086 } 10087 10088 #ifdef SCTP_DEBUG 10089 printf("sctp_sosend: before copying in %p\n", top); 10090 #endif 10091 if (top == NULL) { 10092 /* Must copy it all in from user land. The 10093 * socket buf is locked but we don't suspend 10094 * protocol processing until we are ready to 10095 * send/queue it. 10096 */ 10097 sounlock(so); 10098 #ifdef SCTP_DEBUG 10099 printf("sctp_sosend: before cii\n"); 10100 #endif 10101 error = sctp_copy_it_in(inp, stcb, asoc, net, &srcv, uio, flags); 10102 #ifdef SCTP_DEBUG 10103 printf("sctp_sosend: after cii\n"); 10104 #endif 10105 if (error) 10106 goto out; 10107 } else { 10108 /* Here we must either pull in the user data to chunk 10109 * buffers, or use top to do a msg_append. 10110 */ 10111 error = sctp_msg_append(stcb, net, top, &srcv, flags); 10112 sounlock(so); 10113 if (error) 10114 goto out; 10115 /* zap the top since it is now being used */ 10116 top = 0; 10117 } 10118 #ifdef SCTP_DEBUG 10119 printf("sctp_sosend: after copying in\n"); 10120 #endif 10121 if (net->flight_size > net->cwnd) { 10122 sctp_pegs[SCTP_SENDTO_FULL_CWND]++; 10123 queue_only = 1; 10124 10125 } else if (asoc->ifp_had_enobuf) { 10126 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++; 10127 queue_only = 1; 10128 } else { 10129 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 10130 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) + 10131 SCTP_MED_OVERHEAD); 10132 10133 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) && 10134 (stcb->asoc.total_flight > 0) && 10135 (un_sent < (int)stcb->asoc.smallest_mtu)) { 10136 10137 /* Ok, Nagle is set on and we have data outstanding. Don't 10138 * send anything and let SACKs drive out the data unless we 10139 * have a "full" segment to send. 10140 */ 10141 sctp_pegs[SCTP_NAGLE_NOQ]++; 10142 queue_only = 1; 10143 } else { 10144 sctp_pegs[SCTP_NAGLE_OFF]++; 10145 } 10146 } 10147 if (queue_only_for_init) { 10148 /* It is possible to have a turn around of the 10149 * INIT/INIT-ACK/COOKIE before I have a chance to 10150 * copy in the data. In such a case I DO want to 10151 * send it out by reversing the queue only flag. 10152 */ 10153 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) || 10154 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) { 10155 /* yep, reverse it */ 10156 queue_only = 0; 10157 } 10158 } 10159 10160 #ifdef SCTP_DEBUG 10161 printf("sctp_sosend: before sending chunk\n"); 10162 #endif 10163 if ((queue_only == 0) && (stcb->asoc.peers_rwnd && un_sent)) { 10164 /* we can attempt to send too.*/ 10165 #ifdef SCTP_DEBUG 10166 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 10167 printf("USR Send calls sctp_chunk_output\n"); 10168 } 10169 #endif 10170 solock(so); 10171 sctp_pegs[SCTP_OUTPUT_FRM_SND]++; 10172 sctp_chunk_output(inp, stcb, 0); 10173 sounlock(so); 10174 } else if ((queue_only == 0) && 10175 (stcb->asoc.peers_rwnd == 0) && 10176 (stcb->asoc.total_flight == 0)) { 10177 /* We get to have a probe outstanding */ 10178 solock(so); 10179 sctp_from_user_send = 1; 10180 sctp_chunk_output(inp, stcb, 0); 10181 sctp_from_user_send = 0; 10182 sounlock(so); 10183 10184 } else if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 10185 int num_out, reason, cwnd_full; 10186 /* Here we do control only */ 10187 solock(so); 10188 sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 10189 &reason, 1, &cwnd_full, 1, &now, &now_filled); 10190 sounlock(so); 10191 } 10192 #ifdef SCTP_DEBUG 10193 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 10194 printf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n", 10195 queue_only, stcb->asoc.peers_rwnd, un_sent, 10196 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue, 10197 stcb->asoc.total_output_queue_size); 10198 } 10199 #endif 10200 out: 10201 if (create_lock_applied) { 10202 SCTP_ASOC_CREATE_UNLOCK(inp); 10203 create_lock_applied = 0; 10204 } 10205 if (stcb) { 10206 SCTP_TCB_UNLOCK(stcb); 10207 } 10208 if (top) 10209 sctp_m_freem(top); 10210 if (control) 10211 sctp_m_freem(control); 10212 return (error); 10213 } 10214