1 /* $NetBSD: sctp_output.c,v 1.9 2016/12/23 11:11:28 maya Exp $ */ 2 /* $KAME: sctp_output.c,v 1.48 2005/06/16 18:29:24 jinmei Exp $ */ 3 4 /* 5 * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc, 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: sctp_output.c,v 1.9 2016/12/23 11:11:28 maya Exp $"); 34 35 #ifdef _KERNEL_OPT 36 #include "opt_ipsec.h" 37 #include "opt_inet.h" 38 #include "opt_sctp.h" 39 #endif /* _KERNEL_OPT */ 40 41 #include <sys/param.h> 42 #include <sys/systm.h> 43 #include <sys/malloc.h> 44 #include <sys/mbuf.h> 45 #include <sys/domain.h> 46 #include <sys/protosw.h> 47 #include <sys/socket.h> 48 #include <sys/socketvar.h> 49 #include <sys/proc.h> 50 #include <sys/kernel.h> 51 #include <sys/sysctl.h> 52 #include <sys/resourcevar.h> 53 #include <sys/uio.h> 54 #ifdef INET6 55 #include <sys/domain.h> 56 #endif 57 58 #include <machine/limits.h> 59 #include <machine/cpu.h> 60 61 #include <net/if.h> 62 #include <net/if_types.h> 63 64 #include <net/route.h> 65 66 #include <netinet/in.h> 67 #include <netinet/in_systm.h> 68 #include <netinet/ip.h> 69 #include <netinet/in_pcb.h> 70 #include <netinet/in_var.h> 71 #include <netinet/ip_var.h> 72 73 #ifdef INET6 74 #include <netinet/ip6.h> 75 #include <netinet6/ip6_var.h> 76 #include <netinet6/scope6_var.h> 77 #include <netinet6/nd6.h> 78 79 #include <netinet6/in6_pcb.h> 80 81 #include <netinet/icmp6.h> 82 83 #endif /* INET6 */ 84 85 #include <net/net_osdep.h> 86 87 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__) 88 #ifndef in6pcb 89 #define in6pcb inpcb 90 #endif 91 #endif 92 93 #include <netinet/sctp_pcb.h> 94 95 #ifdef IPSEC 96 #include <netipsec/ipsec.h> 97 #include <netipsec/key.h> 98 #endif /* IPSEC */ 99 100 #include <netinet/sctp_var.h> 101 #include <netinet/sctp_header.h> 102 #include <netinet/sctputil.h> 103 #include <netinet/sctp_pcb.h> 104 #include <netinet/sctp_output.h> 105 #include <netinet/sctp_uio.h> 106 #include <netinet/sctputil.h> 107 #include <netinet/sctp_hashdriver.h> 108 #include <netinet/sctp_timer.h> 109 #include <netinet/sctp_asconf.h> 110 #include <netinet/sctp_indata.h> 111 112 #ifdef SCTP_DEBUG 113 extern uint32_t sctp_debug_on; 114 #endif 115 116 extern int sctp_peer_chunk_oh; 117 118 static int 119 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize) 120 { 121 struct cmsghdr cmh; 122 int tlen, at; 123 124 tlen = control->m_len; 125 at = 0; 126 /* 127 * Independent of how many mbufs, find the c_type inside the control 128 * structure and copy out the data. 129 */ 130 while (at < tlen) { 131 if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) { 132 /* not enough room for one more we are done. */ 133 return (0); 134 } 135 m_copydata(control, at, sizeof(cmh), (void *)&cmh); 136 if ((cmh.cmsg_len + at) > tlen) { 137 /* 138 * this is real messed up since there is not enough 139 * data here to cover the cmsg header. We are done. 140 */ 141 return (0); 142 } 143 if ((cmh.cmsg_level == IPPROTO_SCTP) && 144 (c_type == cmh.cmsg_type)) { 145 /* found the one we want, copy it out */ 146 at += CMSG_ALIGN(sizeof(struct cmsghdr)); 147 if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) { 148 /* 149 * space of cmsg_len after header not 150 * big enough 151 */ 152 return (0); 153 } 154 m_copydata(control, at, cpsize, data); 155 return (1); 156 } else { 157 at += CMSG_ALIGN(cmh.cmsg_len); 158 if (cmh.cmsg_len == 0) { 159 break; 160 } 161 } 162 } 163 /* not found */ 164 return (0); 165 } 166 167 static struct mbuf * 168 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa) 169 { 170 struct sctp_paramhdr *parmh; 171 struct mbuf *mret; 172 int len; 173 if (ifa->ifa_addr->sa_family == AF_INET) { 174 len = sizeof(struct sctp_ipv4addr_param); 175 } else if (ifa->ifa_addr->sa_family == AF_INET6) { 176 len = sizeof(struct sctp_ipv6addr_param); 177 } else { 178 /* unknown type */ 179 return (m); 180 } 181 182 if (M_TRAILINGSPACE(m) >= len) { 183 /* easy side we just drop it on the end */ 184 parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len); 185 mret = m; 186 } else { 187 /* Need more space */ 188 mret = m; 189 while (mret->m_next != NULL) { 190 mret = mret->m_next; 191 } 192 MGET(mret->m_next, M_DONTWAIT, MT_DATA); 193 if (mret->m_next == NULL) { 194 /* We are hosed, can't add more addresses */ 195 return (m); 196 } 197 mret = mret->m_next; 198 parmh = mtod(mret, struct sctp_paramhdr *); 199 } 200 /* now add the parameter */ 201 if (ifa->ifa_addr->sa_family == AF_INET) { 202 struct sctp_ipv4addr_param *ipv4p; 203 struct sockaddr_in *sin; 204 sin = (struct sockaddr_in *)ifa->ifa_addr; 205 ipv4p = (struct sctp_ipv4addr_param *)parmh; 206 parmh->param_type = htons(SCTP_IPV4_ADDRESS); 207 parmh->param_length = htons(len); 208 ipv4p->addr = sin->sin_addr.s_addr; 209 mret->m_len += len; 210 } else if (ifa->ifa_addr->sa_family == AF_INET6) { 211 struct sctp_ipv6addr_param *ipv6p; 212 struct sockaddr_in6 *sin6; 213 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 214 ipv6p = (struct sctp_ipv6addr_param *)parmh; 215 parmh->param_type = htons(SCTP_IPV6_ADDRESS); 216 parmh->param_length = htons(len); 217 memcpy(ipv6p->addr, &sin6->sin6_addr, 218 sizeof(ipv6p->addr)); 219 /* clear embedded scope in the address */ 220 in6_clearscope((struct in6_addr *)ipv6p->addr); 221 mret->m_len += len; 222 } else { 223 return (m); 224 } 225 return (mret); 226 } 227 228 229 230 static struct mbuf * 231 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset, 232 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in) 233 { 234 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret; 235 struct sctp_state_cookie *stc; 236 struct sctp_paramhdr *ph; 237 uint8_t *signature; 238 int sig_offset; 239 uint16_t cookie_sz; 240 241 mret = NULL; 242 243 MGET(mret, M_DONTWAIT, MT_DATA); 244 if (mret == NULL) { 245 return (NULL); 246 } 247 copy_init = sctp_m_copym(init, init_offset, M_COPYALL, M_DONTWAIT); 248 if (copy_init == NULL) { 249 sctp_m_freem(mret); 250 return (NULL); 251 } 252 copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL, 253 M_DONTWAIT); 254 if (copy_initack == NULL) { 255 sctp_m_freem(mret); 256 sctp_m_freem(copy_init); 257 return (NULL); 258 } 259 /* easy side we just drop it on the end */ 260 ph = mtod(mret, struct sctp_paramhdr *); 261 mret->m_len = sizeof(struct sctp_state_cookie) + 262 sizeof(struct sctp_paramhdr); 263 stc = (struct sctp_state_cookie *)((vaddr_t)ph + 264 sizeof(struct sctp_paramhdr)); 265 ph->param_type = htons(SCTP_STATE_COOKIE); 266 ph->param_length = 0; /* fill in at the end */ 267 /* Fill in the stc cookie data */ 268 *stc = *stc_in; 269 270 /* tack the INIT and then the INIT-ACK onto the chain */ 271 cookie_sz = 0; 272 m_at = mret; 273 for (m_at = mret; m_at; m_at = m_at->m_next) { 274 cookie_sz += m_at->m_len; 275 if (m_at->m_next == NULL) { 276 m_at->m_next = copy_init; 277 break; 278 } 279 } 280 281 for (m_at = copy_init; m_at; m_at = m_at->m_next) { 282 cookie_sz += m_at->m_len; 283 if (m_at->m_next == NULL) { 284 m_at->m_next = copy_initack; 285 break; 286 } 287 } 288 289 for (m_at = copy_initack; m_at; m_at = m_at->m_next) { 290 cookie_sz += m_at->m_len; 291 if (m_at->m_next == NULL) { 292 break; 293 } 294 } 295 MGET(sig, M_DONTWAIT, MT_DATA); 296 if (sig == NULL) { 297 /* no space */ 298 sctp_m_freem(mret); 299 sctp_m_freem(copy_init); 300 sctp_m_freem(copy_initack); 301 return (NULL); 302 } 303 sig->m_len = 0; 304 m_at->m_next = sig; 305 sig_offset = 0; 306 signature = (uint8_t *)(mtod(sig, vaddr_t) + sig_offset); 307 /* Time to sign the cookie */ 308 sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[ 309 (int)(inp->sctp_ep.current_secret_number)], 310 SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr), 311 (uint8_t *)signature); 312 sig->m_len += SCTP_SIGNATURE_SIZE; 313 cookie_sz += SCTP_SIGNATURE_SIZE; 314 315 ph->param_length = htons(cookie_sz); 316 return (mret); 317 } 318 319 320 static struct sockaddr_in * 321 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local) 322 { 323 struct sockaddr_in *sin; 324 /* 325 * Here we determine if its a prefered address. A 326 * prefered address means it is the same scope or 327 * higher scope then the destination. 328 * L = loopback, P = private, G = global 329 * ----------------------------------------- 330 * src | dest | result 331 *----------------------------------------- 332 * L | L | yes 333 *----------------------------------------- 334 * P | L | yes 335 *----------------------------------------- 336 * G | L | yes 337 *----------------------------------------- 338 * L | P | no 339 *----------------------------------------- 340 * P | P | yes 341 *----------------------------------------- 342 * G | P | no 343 *----------------------------------------- 344 * L | G | no 345 *----------------------------------------- 346 * P | G | no 347 *----------------------------------------- 348 * G | G | yes 349 *----------------------------------------- 350 */ 351 352 if (ifa->ifa_addr->sa_family != AF_INET) { 353 /* forget non-v4 */ 354 return (NULL); 355 } 356 /* Ok the address may be ok */ 357 sin = (struct sockaddr_in *)ifa->ifa_addr; 358 if (sin->sin_addr.s_addr == 0) { 359 return (NULL); 360 } 361 *sin_local = *sin_loop = 0; 362 if ((ifa->ifa_ifp->if_type == IFT_LOOP) || 363 (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) { 364 *sin_loop = 1; 365 *sin_local = 1; 366 } 367 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 368 *sin_local = 1; 369 } 370 if (!loopscope && *sin_loop) { 371 /* Its a loopback address and we don't have loop scope */ 372 return (NULL); 373 } 374 if (!ipv4_scope && *sin_local) { 375 /* Its a private address, and we don't have private address scope */ 376 return (NULL); 377 } 378 if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) { 379 /* its a global src and a private dest */ 380 return (NULL); 381 } 382 /* its a prefered address */ 383 return (sin); 384 } 385 386 static struct sockaddr_in * 387 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local) 388 { 389 struct sockaddr_in *sin; 390 /* 391 * Here we determine if its a acceptable address. A 392 * acceptable address means it is the same scope or 393 * higher scope but we can allow for NAT which means 394 * its ok to have a global dest and a private src. 395 * 396 * L = loopback, P = private, G = global 397 * ----------------------------------------- 398 * src | dest | result 399 *----------------------------------------- 400 * L | L | yes 401 *----------------------------------------- 402 * P | L | yes 403 *----------------------------------------- 404 * G | L | yes 405 *----------------------------------------- 406 * L | P | no 407 *----------------------------------------- 408 * P | P | yes 409 *----------------------------------------- 410 * G | P | yes - probably this won't work. 411 *----------------------------------------- 412 * L | G | no 413 *----------------------------------------- 414 * P | G | yes 415 *----------------------------------------- 416 * G | G | yes 417 *----------------------------------------- 418 */ 419 420 if (ifa->ifa_addr->sa_family != AF_INET) { 421 /* forget non-v4 */ 422 return (NULL); 423 } 424 /* Ok the address may be ok */ 425 sin = (struct sockaddr_in *)ifa->ifa_addr; 426 if (sin->sin_addr.s_addr == 0) { 427 return (NULL); 428 } 429 *sin_local = *sin_loop = 0; 430 if ((ifa->ifa_ifp->if_type == IFT_LOOP) || 431 (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) { 432 *sin_loop = 1; 433 *sin_local = 1; 434 } 435 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 436 *sin_local = 1; 437 } 438 if (!loopscope && *sin_loop) { 439 /* Its a loopback address and we don't have loop scope */ 440 return (NULL); 441 } 442 /* its an acceptable address */ 443 return (sin); 444 } 445 446 /* 447 * This treats the address list on the ep as a restricted list 448 * (negative list). If a the passed address is listed, then 449 * the address is NOT allowed on the association. 450 */ 451 int 452 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr) 453 { 454 struct sctp_laddr *laddr; 455 #ifdef SCTP_DEBUG 456 int cnt=0; 457 #endif 458 if (stcb == NULL) { 459 /* There are no restrictions, no TCB :-) */ 460 return (0); 461 } 462 #ifdef SCTP_DEBUG 463 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 464 cnt++; 465 } 466 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 467 printf("There are %d addresses on the restricted list\n", cnt); 468 } 469 cnt = 0; 470 #endif 471 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 472 if (laddr->ifa == NULL) { 473 #ifdef SCTP_DEBUG 474 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 475 printf("Help I have fallen and I can't get up!\n"); 476 } 477 #endif 478 continue; 479 } 480 #ifdef SCTP_DEBUG 481 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 482 cnt++; 483 printf("Restricted address[%d]:", cnt); 484 sctp_print_address(laddr->ifa->ifa_addr); 485 } 486 #endif 487 if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) { 488 /* Yes it is on the list */ 489 return (1); 490 } 491 } 492 return (0); 493 } 494 495 static int 496 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa) 497 { 498 struct sctp_laddr *laddr; 499 500 if (ifa == NULL) 501 return (0); 502 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 503 if (laddr->ifa == NULL) { 504 #ifdef SCTP_DEBUG 505 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 506 printf("Help I have fallen and I can't get up!\n"); 507 } 508 #endif 509 continue; 510 } 511 if (laddr->ifa->ifa_addr == NULL) 512 continue; 513 if (laddr->ifa == ifa) 514 /* same pointer */ 515 return (1); 516 if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) { 517 /* skip non compatible address comparison */ 518 continue; 519 } 520 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) { 521 /* Yes it is restricted */ 522 return (1); 523 } 524 } 525 return (0); 526 } 527 528 529 530 static struct in_addr 531 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp, 532 struct rtentry *rt, 533 uint8_t ipv4_scope, 534 uint8_t loopscope) 535 { 536 struct in_addr ans; 537 struct sctp_laddr *laddr; 538 struct sockaddr_in *sin; 539 struct ifnet *ifn; 540 struct ifaddr *ifa; 541 uint8_t sin_loop, sin_local; 542 543 /* first question, is the ifn we will emit on 544 * in our list, if so, we want that one. 545 */ 546 ifn = rt->rt_ifp; 547 if (ifn) { 548 /* is a prefered one on the interface we route out? */ 549 IFADDR_READER_FOREACH(ifa, ifn) { 550 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 551 if (sin == NULL) 552 continue; 553 if (sctp_is_addr_in_ep(inp, ifa)) { 554 return (sin->sin_addr); 555 } 556 } 557 /* is an acceptable one on the interface we route out? */ 558 IFADDR_READER_FOREACH(ifa, ifn) { 559 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 560 if (sin == NULL) 561 continue; 562 if (sctp_is_addr_in_ep(inp, ifa)) { 563 return (sin->sin_addr); 564 } 565 } 566 } 567 /* ok, what about a prefered address in the inp */ 568 for (laddr = LIST_FIRST(&inp->sctp_addr_list); 569 laddr && (laddr != inp->next_addr_touse); 570 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 571 if (laddr->ifa == NULL) { 572 /* address has been removed */ 573 continue; 574 } 575 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 576 if (sin == NULL) 577 continue; 578 return (sin->sin_addr); 579 580 } 581 /* ok, what about an acceptable address in the inp */ 582 for (laddr = LIST_FIRST(&inp->sctp_addr_list); 583 laddr && (laddr != inp->next_addr_touse); 584 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 585 if (laddr->ifa == NULL) { 586 /* address has been removed */ 587 continue; 588 } 589 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 590 if (sin == NULL) 591 continue; 592 return (sin->sin_addr); 593 594 } 595 596 /* no address bound can be a source for the destination we are in trouble */ 597 #ifdef SCTP_DEBUG 598 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 599 printf("Src address selection for EP, no acceptable src address found for address\n"); 600 } 601 #endif 602 memset(&ans, 0, sizeof(ans)); 603 return (ans); 604 } 605 606 607 608 static struct in_addr 609 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp, 610 struct sctp_tcb *stcb, 611 struct sctp_nets *net, 612 struct rtentry *rt, 613 uint8_t ipv4_scope, 614 uint8_t loopscope, 615 int non_asoc_addr_ok) 616 { 617 /* 618 * Here we have two cases, bound all asconf 619 * allowed. bound all asconf not allowed. 620 * 621 */ 622 struct sctp_laddr *laddr, *starting_point; 623 struct in_addr ans; 624 struct ifnet *ifn; 625 struct ifaddr *ifa; 626 uint8_t sin_loop, sin_local, start_at_beginning=0; 627 struct sockaddr_in *sin; 628 629 /* first question, is the ifn we will emit on 630 * in our list, if so, we want that one. 631 */ 632 ifn = rt->rt_ifp; 633 634 if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) { 635 /* 636 * Here we use the list of addresses on the endpoint. Then 637 * the addresses listed on the "restricted" list is just that, 638 * address that have not been added and can't be used (unless 639 * the non_asoc_addr_ok is set). 640 */ 641 #ifdef SCTP_DEBUG 642 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 643 printf("Have a STCB - asconf allowed, not bound all have a netgative list\n"); 644 } 645 #endif 646 /* first question, is the ifn we will emit on 647 * in our list, if so, we want that one. 648 */ 649 if (ifn) { 650 /* first try for an prefered address on the ep */ 651 IFADDR_READER_FOREACH(ifa, ifn) { 652 if (sctp_is_addr_in_ep(inp, ifa)) { 653 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 654 if (sin == NULL) 655 continue; 656 if ((non_asoc_addr_ok == 0) && 657 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) { 658 /* on the no-no list */ 659 continue; 660 } 661 return (sin->sin_addr); 662 } 663 } 664 /* next try for an acceptable address on the ep */ 665 IFADDR_READER_FOREACH(ifa, ifn) { 666 if (sctp_is_addr_in_ep(inp, ifa)) { 667 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 668 if (sin == NULL) 669 continue; 670 if ((non_asoc_addr_ok == 0) && 671 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) { 672 /* on the no-no list */ 673 continue; 674 } 675 return (sin->sin_addr); 676 } 677 } 678 679 } 680 /* if we can't find one like that then we must 681 * look at all addresses bound to pick one at 682 * first prefereable then secondly acceptable. 683 */ 684 starting_point = stcb->asoc.last_used_address; 685 sctpv4_from_the_top: 686 if (stcb->asoc.last_used_address == NULL) { 687 start_at_beginning=1; 688 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 689 } 690 /* search beginning with the last used address */ 691 for (laddr = stcb->asoc.last_used_address; laddr; 692 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 693 if (laddr->ifa == NULL) { 694 /* address has been removed */ 695 continue; 696 } 697 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 698 if (sin == NULL) 699 continue; 700 if ((non_asoc_addr_ok == 0) && 701 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) { 702 /* on the no-no list */ 703 continue; 704 } 705 return (sin->sin_addr); 706 707 } 708 if (start_at_beginning == 0) { 709 stcb->asoc.last_used_address = NULL; 710 goto sctpv4_from_the_top; 711 } 712 /* now try for any higher scope than the destination */ 713 stcb->asoc.last_used_address = starting_point; 714 start_at_beginning = 0; 715 sctpv4_from_the_top2: 716 if (stcb->asoc.last_used_address == NULL) { 717 start_at_beginning=1; 718 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 719 } 720 /* search beginning with the last used address */ 721 for (laddr = stcb->asoc.last_used_address; laddr; 722 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 723 if (laddr->ifa == NULL) { 724 /* address has been removed */ 725 continue; 726 } 727 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 728 if (sin == NULL) 729 continue; 730 if ((non_asoc_addr_ok == 0) && 731 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) { 732 /* on the no-no list */ 733 continue; 734 } 735 return (sin->sin_addr); 736 } 737 if (start_at_beginning == 0) { 738 stcb->asoc.last_used_address = NULL; 739 goto sctpv4_from_the_top2; 740 } 741 } else { 742 /* 743 * Here we have an address list on the association, thats the 744 * only valid source addresses that we can use. 745 */ 746 #ifdef SCTP_DEBUG 747 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 748 printf("Have a STCB - no asconf allowed, not bound all have a postive list\n"); 749 } 750 #endif 751 /* First look at all addresses for one that is on 752 * the interface we route out 753 */ 754 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 755 sctp_nxt_addr) { 756 if (laddr->ifa == NULL) { 757 /* address has been removed */ 758 continue; 759 } 760 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 761 if (sin == NULL) 762 continue; 763 /* first question, is laddr->ifa an address associated with the emit interface */ 764 if (ifn) { 765 IFADDR_READER_FOREACH(ifa, ifn) { 766 if (laddr->ifa == ifa) { 767 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr; 768 return (sin->sin_addr); 769 } 770 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) { 771 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr; 772 return (sin->sin_addr); 773 } 774 } 775 } 776 } 777 /* what about an acceptable one on the interface? */ 778 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 779 sctp_nxt_addr) { 780 if (laddr->ifa == NULL) { 781 /* address has been removed */ 782 continue; 783 } 784 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 785 if (sin == NULL) 786 continue; 787 /* first question, is laddr->ifa an address associated with the emit interface */ 788 if (ifn) { 789 IFADDR_READER_FOREACH(ifa, ifn) { 790 if (laddr->ifa == ifa) { 791 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr; 792 return (sin->sin_addr); 793 } 794 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) { 795 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr; 796 return (sin->sin_addr); 797 } 798 } 799 } 800 } 801 /* ok, next one that is preferable in general */ 802 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 803 sctp_nxt_addr) { 804 if (laddr->ifa == NULL) { 805 /* address has been removed */ 806 continue; 807 } 808 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 809 if (sin == NULL) 810 continue; 811 return (sin->sin_addr); 812 } 813 814 /* last, what about one that is acceptable */ 815 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 816 sctp_nxt_addr) { 817 if (laddr->ifa == NULL) { 818 /* address has been removed */ 819 continue; 820 } 821 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 822 if (sin == NULL) 823 continue; 824 return (sin->sin_addr); 825 } 826 } 827 memset(&ans, 0, sizeof(ans)); 828 return (ans); 829 } 830 831 static struct sockaddr_in * 832 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, 833 uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num) 834 { 835 struct ifaddr *ifa; 836 struct sockaddr_in *sin; 837 uint8_t sin_loop, sin_local; 838 int num_eligible_addr = 0; 839 IFADDR_READER_FOREACH(ifa, ifn) { 840 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 841 if (sin == NULL) 842 continue; 843 if (stcb) { 844 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) { 845 /* It is restricted for some reason.. probably 846 * not yet added. 847 */ 848 continue; 849 } 850 } 851 if (cur_addr_num == num_eligible_addr) { 852 return (sin); 853 } 854 } 855 return (NULL); 856 } 857 858 859 static int 860 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, 861 uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local) 862 { 863 struct ifaddr *ifa; 864 struct sockaddr_in *sin; 865 int num_eligible_addr = 0; 866 867 IFADDR_READER_FOREACH(ifa, ifn) { 868 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local); 869 if (sin == NULL) 870 continue; 871 if (stcb) { 872 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) { 873 /* It is restricted for some reason.. probably 874 * not yet added. 875 */ 876 continue; 877 } 878 } 879 num_eligible_addr++; 880 } 881 return (num_eligible_addr); 882 883 } 884 885 static struct in_addr 886 sctp_choose_v4_boundall(struct sctp_inpcb *inp, 887 struct sctp_tcb *stcb, 888 struct sctp_nets *net, 889 struct rtentry *rt, 890 uint8_t ipv4_scope, 891 uint8_t loopscope, 892 int non_asoc_addr_ok) 893 { 894 int cur_addr_num=0, num_prefered=0; 895 uint8_t sin_loop, sin_local; 896 struct ifnet *ifn; 897 struct sockaddr_in *sin; 898 struct in_addr ans; 899 struct ifaddr *ifa; 900 int s; 901 /* 902 * For v4 we can use (in boundall) any address in the association. If 903 * non_asoc_addr_ok is set we can use any address (at least in theory). 904 * So we look for prefered addresses first. If we find one, we use it. 905 * Otherwise we next try to get an address on the interface, which we 906 * should be able to do (unless non_asoc_addr_ok is false and we are 907 * routed out that way). In these cases where we can't use the address 908 * of the interface we go through all the ifn's looking for an address 909 * we can use and fill that in. Punting means we send back address 910 * 0, which will probably cause problems actually since then IP will 911 * fill in the address of the route ifn, which means we probably already 912 * rejected it.. i.e. here comes an abort :-<. 913 */ 914 ifn = rt->rt_ifp; 915 if (net) { 916 cur_addr_num = net->indx_of_eligible_next_to_use; 917 } 918 if (ifn == NULL) { 919 goto bound_all_v4_plan_c; 920 } 921 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local); 922 #ifdef SCTP_DEBUG 923 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 924 printf("Found %d prefered source addresses\n", num_prefered); 925 } 926 #endif 927 if (num_prefered == 0) { 928 /* no eligible addresses, we must use some other 929 * interface address if we can find one. 930 */ 931 goto bound_all_v4_plan_b; 932 } 933 /* Ok we have num_eligible_addr set with how many we can use, 934 * this may vary from call to call due to addresses being deprecated etc.. 935 */ 936 if (cur_addr_num >= num_prefered) { 937 cur_addr_num = 0; 938 } 939 /* select the nth address from the list (where cur_addr_num is the nth) and 940 * 0 is the first one, 1 is the second one etc... 941 */ 942 #ifdef SCTP_DEBUG 943 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 944 printf("cur_addr_num:%d\n", cur_addr_num); 945 } 946 #endif 947 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, 948 ipv4_scope, cur_addr_num); 949 950 /* if sin is NULL something changed??, plan_a now */ 951 if (sin) { 952 return (sin->sin_addr); 953 } 954 955 /* 956 * plan_b: Look at the interface that we emit on 957 * and see if we can find an acceptable address. 958 */ 959 bound_all_v4_plan_b: 960 IFADDR_READER_FOREACH(ifa, ifn) { 961 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 962 if (sin == NULL) 963 continue; 964 if (stcb) { 965 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) { 966 /* It is restricted for some reason.. probably 967 * not yet added. 968 */ 969 continue; 970 } 971 } 972 return (sin->sin_addr); 973 } 974 /* 975 * plan_c: Look at all interfaces and find a prefered 976 * address. If we reache here we are in trouble I think. 977 */ 978 bound_all_v4_plan_c: 979 s = pserialize_read_enter(); 980 IFNET_READER_FOREACH(ifn) { 981 if (ifn == inp->next_ifn_touse) 982 break; 983 if (loopscope == 0 && ifn->if_type == IFT_LOOP) { 984 /* wrong base scope */ 985 continue; 986 } 987 if (ifn == rt->rt_ifp) 988 /* already looked at this guy */ 989 continue; 990 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, 991 loopscope, ipv4_scope, &sin_loop, &sin_local); 992 #ifdef SCTP_DEBUG 993 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 994 printf("Found ifn:%p %d prefered source addresses\n", ifn, num_prefered); 995 } 996 #endif 997 if (num_prefered == 0) { 998 /* 999 * None on this interface. 1000 */ 1001 continue; 1002 } 1003 /* Ok we have num_eligible_addr set with how many we can use, 1004 * this may vary from call to call due to addresses being deprecated etc.. 1005 */ 1006 if (cur_addr_num >= num_prefered) { 1007 cur_addr_num = 0; 1008 } 1009 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, 1010 ipv4_scope, cur_addr_num); 1011 if (sin == NULL) 1012 continue; 1013 pserialize_read_exit(s); 1014 return (sin->sin_addr); 1015 1016 } 1017 pserialize_read_exit(s); 1018 1019 /* 1020 * plan_d: We are in deep trouble. No prefered address on 1021 * any interface. And the emit interface does not 1022 * even have an acceptable address. Take anything 1023 * we can get! If this does not work we are 1024 * probably going to emit a packet that will 1025 * illicit an ABORT, falling through. 1026 */ 1027 1028 s = pserialize_read_enter(); 1029 IFNET_READER_FOREACH(ifn) { 1030 if (ifn == inp->next_ifn_touse) 1031 break; 1032 if (loopscope == 0 && ifn->if_type == IFT_LOOP) { 1033 /* wrong base scope */ 1034 continue; 1035 } 1036 if (ifn == rt->rt_ifp) 1037 /* already looked at this guy */ 1038 continue; 1039 1040 IFADDR_READER_FOREACH(ifa, ifn) { 1041 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local); 1042 if (sin == NULL) 1043 continue; 1044 if (stcb) { 1045 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) { 1046 /* It is restricted for some reason.. probably 1047 * not yet added. 1048 */ 1049 continue; 1050 } 1051 } 1052 pserialize_read_exit(s); 1053 return (sin->sin_addr); 1054 } 1055 } 1056 pserialize_read_exit(s); 1057 /* 1058 * Ok we can find NO address to source from that is 1059 * not on our negative list. It is either the special 1060 * ASCONF case where we are sourceing from a intf that 1061 * has been ifconfig'd to a different address (i.e. 1062 * it holds a ADD/DEL/SET-PRIM and the proper lookup 1063 * address. OR we are hosed, and this baby is going 1064 * to abort the association. 1065 */ 1066 if (non_asoc_addr_ok) { 1067 return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr); 1068 } else { 1069 memset(&ans, 0, sizeof(ans)); 1070 return (ans); 1071 } 1072 } 1073 1074 1075 1076 /* tcb may be NULL */ 1077 struct in_addr 1078 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp, 1079 struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net, 1080 int non_asoc_addr_ok) 1081 { 1082 struct in_addr ans; 1083 const struct sockaddr_in *to; 1084 struct rtentry *rt; 1085 uint8_t ipv4_scope, loopscope; 1086 1087 /* 1088 * Rules: 1089 * - Find the route if needed, cache if I can. 1090 * - Look at interface address in route, Is it 1091 * in the bound list. If so we have the best source. 1092 * - If not we must rotate amongst the addresses. 1093 * 1094 * Cavets and issues 1095 * 1096 * Do we need to pay attention to scope. We can have 1097 * a private address or a global address we are sourcing 1098 * or sending to. So if we draw it out 1099 * source * dest * result 1100 * ------------------------------------------ 1101 * a Private * Global * NAT? 1102 * ------------------------------------------ 1103 * b Private * Private * No problem 1104 * ------------------------------------------ 1105 * c Global * Private * Huh, How will this work? 1106 * ------------------------------------------ 1107 * d Global * Global * No Problem 1108 * ------------------------------------------ 1109 * 1110 * And then we add to that what happens if there are multiple 1111 * addresses assigned to an interface. Remember the ifa on a 1112 * ifn is a linked list of addresses. So one interface can 1113 * have more than one IPv4 address. What happens if we 1114 * have both a private and a global address? Do we then 1115 * use context of destination to sort out which one is 1116 * best? And what about NAT's sending P->G may get you 1117 * a NAT translation, or should you select the G thats 1118 * on the interface in preference. 1119 * 1120 * Decisions: 1121 * 1122 * - count the number of addresses on the interface. 1123 * - if its one, no problem except case <c>. For <a> 1124 * we will assume a NAT out there. 1125 * - if there are more than one, then we need to worry 1126 * about scope P or G. We should prefer G -> G and 1127 * P -> P if possible. Then as a secondary fall back 1128 * to mixed types G->P being a last ditch one. 1129 * - The above all works for bound all, but bound 1130 * specific we need to use the same concept but instead 1131 * only consider the bound addresses. If the bound set 1132 * is NOT assigned to the interface then we must use 1133 * rotation amongst them. 1134 * 1135 * Notes: For v4, we can always punt and let ip_output 1136 * decide by sending back a source of 0.0.0.0 1137 */ 1138 1139 /* 1140 * Need a route to cache. 1141 * 1142 */ 1143 rt = rtcache_validate(ro); 1144 if (rt == NULL) { 1145 /* No route to host .. punt */ 1146 memset(&ans, 0, sizeof(ans)); 1147 return (ans); 1148 } else { 1149 to = satocsin(rtcache_getdst(ro)); 1150 } 1151 /* Setup our scopes */ 1152 if (stcb) { 1153 ipv4_scope = stcb->asoc.ipv4_local_scope; 1154 loopscope = stcb->asoc.loopback_scope; 1155 } else { 1156 /* Scope based on outbound address */ 1157 if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) { 1158 ipv4_scope = 1; 1159 loopscope = 0; 1160 } else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) { 1161 ipv4_scope = 1; 1162 loopscope = 1; 1163 } else { 1164 ipv4_scope = 0; 1165 loopscope = 0; 1166 } 1167 } 1168 #ifdef SCTP_DEBUG 1169 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1170 printf("Scope setup loop:%d ipv4_scope:%d\n", 1171 loopscope, ipv4_scope); 1172 } 1173 #endif 1174 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 1175 /* 1176 * When bound to all if the address list is set 1177 * it is a negative list. Addresses being added 1178 * by asconf. 1179 */ 1180 ans = sctp_choose_v4_boundall(inp, stcb, net, rt, 1181 ipv4_scope, loopscope, non_asoc_addr_ok); 1182 goto out; 1183 } 1184 /* 1185 * Three possiblities here: 1186 * 1187 * a) stcb is NULL, which means we operate only from 1188 * the list of addresses (ifa's) bound to the assoc and 1189 * we care not about the list. 1190 * b) stcb is NOT-NULL, which means we have an assoc structure and 1191 * auto-asconf is on. This means that the list of addresses is 1192 * a NOT list. We use the list from the inp, but any listed address 1193 * in our list is NOT yet added. However if the non_asoc_addr_ok is 1194 * set we CAN use an address NOT available (i.e. being added). Its 1195 * a negative list. 1196 * c) stcb is NOT-NULL, which means we have an assoc structure and 1197 * auto-asconf is off. This means that the list of addresses is 1198 * the ONLY addresses I can use.. its positive. 1199 * 1200 * Note we collapse b & c into the same function just like in 1201 * the v6 address selection. 1202 */ 1203 if (stcb) { 1204 ans = sctp_choose_v4_boundspecific_stcb(inp, stcb, net, 1205 rt, ipv4_scope, loopscope, non_asoc_addr_ok); 1206 goto out; 1207 } else { 1208 ans = sctp_choose_v4_boundspecific_inp(inp, rt, 1209 ipv4_scope, loopscope); 1210 goto out; 1211 } 1212 /* this should not be reached */ 1213 memset(&ans, 0, sizeof(ans)); 1214 out: 1215 rtcache_unref(rt, ro); 1216 return ans; 1217 } 1218 1219 1220 1221 static struct sockaddr_in6 * 1222 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local) 1223 { 1224 struct in6_ifaddr *ifa6; 1225 struct sockaddr_in6 *sin6; 1226 1227 if (ifa->ifa_addr->sa_family != AF_INET6) { 1228 /* forget non-v6 */ 1229 return (NULL); 1230 } 1231 ifa6 = (struct in6_ifaddr *)ifa; 1232 /* ok to use deprecated addresses? */ 1233 if (!ip6_use_deprecated) { 1234 if (IFA6_IS_DEPRECATED(ifa6)) { 1235 /* can't use this type */ 1236 return (NULL); 1237 } 1238 } 1239 /* are we ok, with the current state of this address? */ 1240 if (ifa6->ia6_flags & 1241 (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) { 1242 /* Can't use these types */ 1243 return (NULL); 1244 } 1245 /* Ok the address may be ok */ 1246 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 1247 *sin_local = *sin_loop = 0; 1248 if ((ifa->ifa_ifp->if_type == IFT_LOOP) || 1249 (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) { 1250 *sin_loop = 1; 1251 } 1252 if (!loopscope && *sin_loop) { 1253 /* Its a loopback address and we don't have loop scope */ 1254 return (NULL); 1255 } 1256 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1257 /* we skip unspecifed addresses */ 1258 return (NULL); 1259 } 1260 1261 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 1262 *sin_local = 1; 1263 } 1264 if (!loc_scope && *sin_local) { 1265 /* Its a link local address, and we don't have link local scope */ 1266 return (NULL); 1267 } 1268 return (sin6); 1269 } 1270 1271 1272 static struct sockaddr_in6 * 1273 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp, 1274 struct sctp_tcb *stcb, 1275 struct sctp_nets *net, 1276 struct rtentry *rt, 1277 uint8_t loc_scope, 1278 uint8_t loopscope, 1279 int non_asoc_addr_ok) 1280 { 1281 /* 1282 * Each endpoint has a list of local addresses associated 1283 * with it. The address list is either a "negative list" i.e. 1284 * those addresses that are NOT allowed to be used as a source OR 1285 * a "postive list" i.e. those addresses that CAN be used. 1286 * 1287 * Its a negative list if asconf is allowed. What we do 1288 * in this case is use the ep address list BUT we have 1289 * to cross check it against the negative list. 1290 * 1291 * In the case where NO asconf is allowed, we have just 1292 * a straight association level list that we must use to 1293 * find a source address. 1294 */ 1295 struct sctp_laddr *laddr, *starting_point; 1296 struct sockaddr_in6 *sin6; 1297 int sin_loop, sin_local; 1298 int start_at_beginning=0; 1299 struct ifnet *ifn; 1300 struct ifaddr *ifa; 1301 1302 ifn = rt->rt_ifp; 1303 if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) { 1304 #ifdef SCTP_DEBUG 1305 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1306 printf("Have a STCB - asconf allowed, not bound all have a netgative list\n"); 1307 } 1308 #endif 1309 /* first question, is the ifn we will emit on 1310 * in our list, if so, we want that one. 1311 */ 1312 if (ifn) { 1313 IFADDR_READER_FOREACH(ifa, ifn) { 1314 if (sctp_is_addr_in_ep(inp, ifa)) { 1315 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1316 if (sin6 == NULL) 1317 continue; 1318 if ((non_asoc_addr_ok == 0) && 1319 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) { 1320 /* on the no-no list */ 1321 continue; 1322 } 1323 return (sin6); 1324 } 1325 } 1326 } 1327 starting_point = stcb->asoc.last_used_address; 1328 /* First try for matching scope */ 1329 sctp_from_the_top: 1330 if (stcb->asoc.last_used_address == NULL) { 1331 start_at_beginning=1; 1332 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 1333 } 1334 /* search beginning with the last used address */ 1335 for (laddr = stcb->asoc.last_used_address; laddr; 1336 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 1337 if (laddr->ifa == NULL) { 1338 /* address has been removed */ 1339 continue; 1340 } 1341 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1342 if (sin6 == NULL) 1343 continue; 1344 if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) { 1345 /* on the no-no list */ 1346 continue; 1347 } 1348 /* is it of matching scope ? */ 1349 if ((loopscope == 0) && 1350 (loc_scope == 0) && 1351 (sin_loop == 0) && 1352 (sin_local == 0)) { 1353 /* all of global scope we are ok with it */ 1354 return (sin6); 1355 } 1356 if (loopscope && sin_loop) 1357 /* both on the loopback, thats ok */ 1358 return (sin6); 1359 if (loc_scope && sin_local) 1360 /* both local scope */ 1361 return (sin6); 1362 1363 } 1364 if (start_at_beginning == 0) { 1365 stcb->asoc.last_used_address = NULL; 1366 goto sctp_from_the_top; 1367 } 1368 /* now try for any higher scope than the destination */ 1369 stcb->asoc.last_used_address = starting_point; 1370 start_at_beginning = 0; 1371 sctp_from_the_top2: 1372 if (stcb->asoc.last_used_address == NULL) { 1373 start_at_beginning=1; 1374 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list); 1375 } 1376 /* search beginning with the last used address */ 1377 for (laddr = stcb->asoc.last_used_address; laddr; 1378 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 1379 if (laddr->ifa == NULL) { 1380 /* address has been removed */ 1381 continue; 1382 } 1383 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1384 if (sin6 == NULL) 1385 continue; 1386 if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) { 1387 /* on the no-no list */ 1388 continue; 1389 } 1390 return (sin6); 1391 } 1392 if (start_at_beginning == 0) { 1393 stcb->asoc.last_used_address = NULL; 1394 goto sctp_from_the_top2; 1395 } 1396 } else { 1397 #ifdef SCTP_DEBUG 1398 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1399 printf("Have a STCB - no asconf allowed, not bound all have a postive list\n"); 1400 } 1401 #endif 1402 /* First try for interface output match */ 1403 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 1404 sctp_nxt_addr) { 1405 if (laddr->ifa == NULL) { 1406 /* address has been removed */ 1407 continue; 1408 } 1409 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1410 if (sin6 == NULL) 1411 continue; 1412 /* first question, is laddr->ifa an address associated with the emit interface */ 1413 if (ifn) { 1414 IFADDR_READER_FOREACH(ifa, ifn) { 1415 if (laddr->ifa == ifa) { 1416 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr; 1417 return (sin6); 1418 } 1419 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) { 1420 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr; 1421 return (sin6); 1422 } 1423 } 1424 } 1425 } 1426 /* Next try for matching scope */ 1427 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 1428 sctp_nxt_addr) { 1429 if (laddr->ifa == NULL) { 1430 /* address has been removed */ 1431 continue; 1432 } 1433 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1434 if (sin6 == NULL) 1435 continue; 1436 1437 if ((loopscope == 0) && 1438 (loc_scope == 0) && 1439 (sin_loop == 0) && 1440 (sin_local == 0)) { 1441 /* all of global scope we are ok with it */ 1442 return (sin6); 1443 } 1444 if (loopscope && sin_loop) 1445 /* both on the loopback, thats ok */ 1446 return (sin6); 1447 if (loc_scope && sin_local) 1448 /* both local scope */ 1449 return (sin6); 1450 } 1451 /* ok, now try for a higher scope in the source address */ 1452 /* First try for matching scope */ 1453 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, 1454 sctp_nxt_addr) { 1455 if (laddr->ifa == NULL) { 1456 /* address has been removed */ 1457 continue; 1458 } 1459 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1460 if (sin6 == NULL) 1461 continue; 1462 return (sin6); 1463 } 1464 } 1465 return (NULL); 1466 } 1467 1468 static struct sockaddr_in6 * 1469 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp, 1470 struct rtentry *rt, 1471 uint8_t loc_scope, 1472 uint8_t loopscope) 1473 { 1474 /* 1475 * Here we are bound specific and have only 1476 * an inp. We must find an address that is bound 1477 * that we can give out as a src address. We 1478 * prefer two addresses of same scope if we can 1479 * find them that way. 1480 */ 1481 struct sctp_laddr *laddr; 1482 struct sockaddr_in6 *sin6; 1483 struct ifnet *ifn; 1484 struct ifaddr *ifa; 1485 int sin_loop, sin_local; 1486 1487 /* first question, is the ifn we will emit on 1488 * in our list, if so, we want that one. 1489 */ 1490 1491 ifn = rt->rt_ifp; 1492 if (ifn) { 1493 IFADDR_READER_FOREACH(ifa, ifn) { 1494 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1495 if (sin6 == NULL) 1496 continue; 1497 if (sctp_is_addr_in_ep(inp, ifa)) { 1498 return (sin6); 1499 } 1500 } 1501 } 1502 for (laddr = LIST_FIRST(&inp->sctp_addr_list); 1503 laddr && (laddr != inp->next_addr_touse); 1504 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 1505 if (laddr->ifa == NULL) { 1506 /* address has been removed */ 1507 continue; 1508 } 1509 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1510 if (sin6 == NULL) 1511 continue; 1512 1513 if ((loopscope == 0) && 1514 (loc_scope == 0) && 1515 (sin_loop == 0) && 1516 (sin_local == 0)) { 1517 /* all of global scope we are ok with it */ 1518 return (sin6); 1519 } 1520 if (loopscope && sin_loop) 1521 /* both on the loopback, thats ok */ 1522 return (sin6); 1523 if (loc_scope && sin_local) 1524 /* both local scope */ 1525 return (sin6); 1526 1527 } 1528 /* if we reach here, we could not find two addresses 1529 * of the same scope to give out. Lets look for any higher level 1530 * scope for a source address. 1531 */ 1532 for (laddr = LIST_FIRST(&inp->sctp_addr_list); 1533 laddr && (laddr != inp->next_addr_touse); 1534 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) { 1535 if (laddr->ifa == NULL) { 1536 /* address has been removed */ 1537 continue; 1538 } 1539 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1540 if (sin6 == NULL) 1541 continue; 1542 return (sin6); 1543 } 1544 /* no address bound can be a source for the destination */ 1545 #ifdef SCTP_DEBUG 1546 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1547 printf("Src address selection for EP, no acceptable src address found for address\n"); 1548 } 1549 #endif 1550 return (NULL); 1551 } 1552 1553 1554 static struct sockaddr_in6 * 1555 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope, 1556 uint8_t loc_scope, int cur_addr_num, int match_scope) 1557 { 1558 struct ifaddr *ifa; 1559 struct sockaddr_in6 *sin6; 1560 int sin_loop, sin_local; 1561 int num_eligible_addr = 0; 1562 1563 IFADDR_READER_FOREACH(ifa, ifn) { 1564 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1565 if (sin6 == NULL) 1566 continue; 1567 if (stcb) { 1568 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) { 1569 /* It is restricted for some reason.. probably 1570 * not yet added. 1571 */ 1572 continue; 1573 } 1574 } 1575 if (match_scope) { 1576 /* Here we are asked to match scope if possible */ 1577 if (loopscope && sin_loop) 1578 /* src and destination are loopback scope */ 1579 return (sin6); 1580 if (loc_scope && sin_local) 1581 /* src and destination are local scope */ 1582 return (sin6); 1583 if ((loopscope == 0) && 1584 (loc_scope == 0) && 1585 (sin_loop == 0) && 1586 (sin_local == 0)) { 1587 /* src and destination are global scope */ 1588 return (sin6); 1589 } 1590 continue; 1591 } 1592 if (num_eligible_addr == cur_addr_num) { 1593 /* this is it */ 1594 return (sin6); 1595 } 1596 num_eligible_addr++; 1597 } 1598 return (NULL); 1599 } 1600 1601 1602 static int 1603 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, 1604 int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope) 1605 { 1606 struct ifaddr *ifa; 1607 struct sockaddr_in6 *sin6; 1608 int num_eligible_addr = 0; 1609 int sin_loop, sin_local; 1610 1611 IFADDR_READER_FOREACH(ifa, ifn) { 1612 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local); 1613 if (sin6 == NULL) 1614 continue; 1615 if (stcb) { 1616 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) { 1617 /* It is restricted for some reason.. probably 1618 * not yet added. 1619 */ 1620 continue; 1621 } 1622 } 1623 num_eligible_addr++; 1624 } 1625 return (num_eligible_addr); 1626 } 1627 1628 1629 static struct sockaddr_in6 * 1630 sctp_choose_v6_boundall(struct sctp_inpcb *inp, 1631 struct sctp_tcb *stcb, 1632 struct sctp_nets *net, 1633 struct rtentry *rt, 1634 uint8_t loc_scope, 1635 uint8_t loopscope, 1636 int non_asoc_addr_ok) 1637 { 1638 /* Ok, we are bound all SO any address 1639 * is ok to use as long as it is NOT in the negative 1640 * list. 1641 */ 1642 int num_eligible_addr; 1643 int cur_addr_num=0; 1644 int started_at_beginning=0; 1645 int match_scope_prefered; 1646 /* first question is, how many eligible addresses are 1647 * there for the destination ifn that we are using that 1648 * are within the proper scope? 1649 */ 1650 struct ifnet *ifn; 1651 struct sockaddr_in6 *sin6; 1652 int s; 1653 1654 ifn = rt->rt_ifp; 1655 if (net) { 1656 cur_addr_num = net->indx_of_eligible_next_to_use; 1657 } 1658 if (cur_addr_num == 0) { 1659 match_scope_prefered = 1; 1660 } else { 1661 match_scope_prefered = 0; 1662 } 1663 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope); 1664 #ifdef SCTP_DEBUG 1665 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1666 printf("Found %d eligible source addresses\n", num_eligible_addr); 1667 } 1668 #endif 1669 if (num_eligible_addr == 0) { 1670 /* no eligible addresses, we must use some other 1671 * interface address if we can find one. 1672 */ 1673 goto bound_all_v6_plan_b; 1674 } 1675 /* Ok we have num_eligible_addr set with how many we can use, 1676 * this may vary from call to call due to addresses being deprecated etc.. 1677 */ 1678 if (cur_addr_num >= num_eligible_addr) { 1679 cur_addr_num = 0; 1680 } 1681 /* select the nth address from the list (where cur_addr_num is the nth) and 1682 * 0 is the first one, 1 is the second one etc... 1683 */ 1684 #ifdef SCTP_DEBUG 1685 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1686 printf("cur_addr_num:%d match_scope_prefered:%d select it\n", 1687 cur_addr_num, match_scope_prefered); 1688 } 1689 #endif 1690 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, 1691 loc_scope, cur_addr_num, match_scope_prefered); 1692 if (match_scope_prefered && (sin6 == NULL)) { 1693 /* retry without the preference for matching scope */ 1694 #ifdef SCTP_DEBUG 1695 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1696 printf("retry with no match_scope_prefered\n"); 1697 } 1698 #endif 1699 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, 1700 loc_scope, cur_addr_num, 0); 1701 } 1702 if (sin6) { 1703 #ifdef SCTP_DEBUG 1704 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1705 printf("Selected address %d ifn:%p for the route\n", cur_addr_num, ifn); 1706 } 1707 #endif 1708 if (net) { 1709 /* store so we get the next one */ 1710 if (cur_addr_num < 255) 1711 net->indx_of_eligible_next_to_use = cur_addr_num + 1; 1712 else 1713 net->indx_of_eligible_next_to_use = 0; 1714 } 1715 return (sin6); 1716 } 1717 num_eligible_addr = 0; 1718 bound_all_v6_plan_b: 1719 /* ok, if we reach here we either fell through 1720 * due to something changing during an interupt (unlikely) 1721 * or we have NO eligible source addresses for the ifn 1722 * of the route (most likely). We must look at all the other 1723 * interfaces EXCEPT rt->rt_ifp and do the same game. 1724 */ 1725 #ifdef SCTP_DEBUG 1726 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1727 printf("bound-all Plan B\n"); 1728 } 1729 #endif 1730 if (inp->next_ifn_touse == NULL) { 1731 started_at_beginning=1; 1732 inp->next_ifn_touse = IFNET_READER_FIRST(); 1733 #ifdef SCTP_DEBUG 1734 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1735 printf("Start at first IFN:%p\n", inp->next_ifn_touse); 1736 } 1737 #endif 1738 } else { 1739 inp->next_ifn_touse = IFNET_READER_NEXT(inp->next_ifn_touse); 1740 #ifdef SCTP_DEBUG 1741 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1742 printf("Resume at IFN:%p\n", inp->next_ifn_touse); 1743 } 1744 #endif 1745 if (inp->next_ifn_touse == NULL) { 1746 #ifdef SCTP_DEBUG 1747 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1748 printf("IFN Resets\n"); 1749 } 1750 #endif 1751 started_at_beginning=1; 1752 inp->next_ifn_touse = IFNET_READER_FIRST(); 1753 } 1754 } 1755 1756 s = pserialize_read_enter(); 1757 IFNET_READER_FOREACH(ifn) { 1758 if (loopscope == 0 && ifn->if_type == IFT_LOOP) { 1759 /* wrong base scope */ 1760 continue; 1761 } 1762 if (loc_scope && (ifn->if_index != loc_scope)) { 1763 /* by definition the scope (from to->sin6_scopeid) 1764 * must match that of the interface. If not then 1765 * we could pick a wrong scope for the address. 1766 * Ususally we don't hit plan-b since the route 1767 * handles this. However we can hit plan-b when 1768 * we send to local-host so the route is the 1769 * loopback interface, but the destination is a 1770 * link local. 1771 */ 1772 continue; 1773 } 1774 if (ifn == rt->rt_ifp) { 1775 /* already looked at this guy */ 1776 continue; 1777 } 1778 /* Address rotation will only work when we are not 1779 * rotating sourced interfaces and are using the interface 1780 * of the route. We would need to have a per interface index 1781 * in order to do proper rotation. 1782 */ 1783 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope); 1784 #ifdef SCTP_DEBUG 1785 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1786 printf("IFN:%p has %d eligible\n", ifn, num_eligible_addr); 1787 } 1788 #endif 1789 if (num_eligible_addr == 0) { 1790 /* none we can use */ 1791 continue; 1792 } 1793 /* Ok we have num_eligible_addr set with how many we can use, 1794 * this may vary from call to call due to addresses being deprecated etc.. 1795 */ 1796 inp->next_ifn_touse = ifn; 1797 1798 /* select the first one we can find with perference for matching scope. 1799 */ 1800 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1); 1801 if (sin6 == NULL) { 1802 /* can't find one with matching scope how about a source with higher 1803 * scope 1804 */ 1805 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0); 1806 if (sin6 == NULL) 1807 /* Hmm, can't find one in the interface now */ 1808 continue; 1809 } 1810 #ifdef SCTP_DEBUG 1811 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1812 printf("Selected the %d'th address of ifn:%p\n", 1813 cur_addr_num, ifn); 1814 } 1815 #endif 1816 pserialize_read_exit(s); 1817 return (sin6); 1818 } 1819 pserialize_read_exit(s); 1820 1821 if (started_at_beginning == 0) { 1822 /* we have not been through all of them yet, force 1823 * us to go through them all. 1824 */ 1825 #ifdef SCTP_DEBUG 1826 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1827 printf("Force a recycle\n"); 1828 } 1829 #endif 1830 inp->next_ifn_touse = NULL; 1831 goto bound_all_v6_plan_b; 1832 } 1833 return (NULL); 1834 1835 } 1836 1837 /* stcb and net may be NULL */ 1838 struct in6_addr 1839 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp, 1840 struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net, 1841 int non_asoc_addr_ok) 1842 { 1843 struct in6_addr ans; 1844 struct sockaddr_in6 *rt_addr; 1845 uint8_t loc_scope, loopscope; 1846 struct sockaddr_in6 to; 1847 struct rtentry *rt; 1848 1849 /* 1850 * This routine is tricky standard v6 src address 1851 * selection cannot take into account what we have 1852 * bound etc, so we can't use it. 1853 * 1854 * Instead here is what we must do: 1855 * 1) Make sure we have a route, if we 1856 * don't have a route we can never reach the peer. 1857 * 2) Once we have a route, determine the scope of the 1858 * route. Link local, loopback or global. 1859 * 3) Next we divide into three types. Either we 1860 * are bound all.. which means we want to use 1861 * one of the addresses of the interface we are 1862 * going out. <or> 1863 * 4a) We have not stcb, which means we are using the 1864 * specific addresses bound on an inp, in this 1865 * case we are similar to the stcb case (4b below) 1866 * accept the list is always a positive list.<or> 1867 * 4b) We are bound specific with a stcb, which means we have a 1868 * list of bound addresses and we must see if the 1869 * ifn of the route is actually one of the bound addresses. 1870 * If not, then we must rotate addresses amongst properly 1871 * scoped bound addresses, if so we use the address 1872 * of the interface. 1873 * 5) Always, no matter which path we take through the above 1874 * we must be sure the source address we use is allowed to 1875 * be used. I.e. IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST 1876 * addresses cannot be used. 1877 * 6) Addresses that are deprecated MAY be used 1878 * if (!ip6_use_deprecated) { 1879 * if (IFA6_IS_DEPRECATED(ifa6)) { 1880 * skip the address 1881 * } 1882 * } 1883 */ 1884 1885 /*** 1> determine route, if not already done */ 1886 rt = rtcache_validate(ro); 1887 if (rt == NULL) { 1888 /* 1889 * Need a route to cache. 1890 */ 1891 int scope_save; 1892 1893 memcpy(&to, rtcache_getdst(ro), sizeof(struct sockaddr)); 1894 scope_save = to.sin6_scope_id; 1895 to.sin6_scope_id = 0; 1896 1897 rt = rtcache_lookup(ro, (struct sockaddr *)&to); 1898 to.sin6_scope_id = scope_save; 1899 } 1900 if (rt == NULL) { 1901 /* 1902 * no route to host. this packet is going no-where. 1903 * We probably should make sure we arrange to send back 1904 * an error. 1905 */ 1906 #ifdef SCTP_DEBUG 1907 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1908 printf("No route to host, this packet cannot be sent!\n"); 1909 } 1910 #endif 1911 memset(&ans, 0, sizeof(ans)); 1912 return (ans); 1913 } 1914 1915 /*** 2a> determine scope for outbound address/route */ 1916 loc_scope = loopscope = 0; 1917 /* 1918 * We base our scope on the outbound packet scope and route, 1919 * NOT the TCB (if there is one). This way in local scope we will only 1920 * use a local scope src address when we send to a local address. 1921 */ 1922 1923 if (IN6_IS_ADDR_LOOPBACK(&to.sin6_addr)) { 1924 /* If the route goes to the loopback address OR 1925 * the address is a loopback address, we are loopback 1926 * scope. 1927 */ 1928 #ifdef SCTP_DEBUG 1929 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1930 printf("Loopback scope is set\n"); 1931 } 1932 #endif 1933 loc_scope = 0; 1934 loopscope = 1; 1935 if (net != NULL) { 1936 /* mark it as local */ 1937 net->addr_is_local = 1; 1938 } 1939 1940 } else if (IN6_IS_ADDR_LINKLOCAL(&to.sin6_addr)) { 1941 #ifdef SCTP_DEBUG 1942 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1943 printf("Link local scope is set, id:%d\n", to.sin6_scope_id); 1944 } 1945 #endif 1946 if (to.sin6_scope_id) 1947 loc_scope = to.sin6_scope_id; 1948 else { 1949 loc_scope = 1; 1950 } 1951 loopscope = 0; 1952 } else { 1953 #ifdef SCTP_DEBUG 1954 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1955 printf("Global scope is set\n"); 1956 } 1957 #endif 1958 } 1959 1960 /* now, depending on which way we are bound we call the appropriate 1961 * routine to do steps 3-6 1962 */ 1963 #ifdef SCTP_DEBUG 1964 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1965 printf("Destination address:"); 1966 sctp_print_address((struct sockaddr *)&to); 1967 } 1968 #endif 1969 1970 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 1971 #ifdef SCTP_DEBUG 1972 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1973 printf("Calling bound-all src addr selection for v6\n"); 1974 } 1975 #endif 1976 rt_addr = sctp_choose_v6_boundall(inp, stcb, net, rt, loc_scope, loopscope, non_asoc_addr_ok); 1977 } else { 1978 #ifdef SCTP_DEBUG 1979 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1980 printf("Calling bound-specific src addr selection for v6\n"); 1981 } 1982 #endif 1983 if (stcb) 1984 rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, rt, loc_scope, loopscope, non_asoc_addr_ok); 1985 else 1986 /* we can't have a non-asoc address since we have no association */ 1987 rt_addr = sctp_choose_v6_boundspecific_inp(inp, rt, loc_scope, loopscope); 1988 } 1989 rtcache_unref(rt, ro); 1990 if (rt_addr == NULL) { 1991 /* no suitable address? */ 1992 struct in6_addr in6; 1993 #ifdef SCTP_DEBUG 1994 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 1995 printf("V6 packet will reach dead-end no suitable src address\n"); 1996 } 1997 #endif 1998 memset(&in6, 0, sizeof(in6)); 1999 return (in6); 2000 } 2001 #ifdef SCTP_DEBUG 2002 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2003 printf("Source address selected is:"); 2004 sctp_print_address((struct sockaddr *)rt_addr); 2005 } 2006 #endif 2007 return (rt_addr->sin6_addr); 2008 } 2009 2010 static uint8_t 2011 sctp_get_ect(struct sctp_tcb *stcb, 2012 struct sctp_tmit_chunk *chk) 2013 { 2014 uint8_t this_random; 2015 2016 /* Huh? */ 2017 if (sctp_ecn == 0) 2018 return (0); 2019 2020 if (sctp_ecn_nonce == 0) 2021 /* no nonce, always return ECT0 */ 2022 return (SCTP_ECT0_BIT); 2023 2024 if (stcb->asoc.peer_supports_ecn_nonce == 0) { 2025 /* Peer does NOT support it, so we send a ECT0 only */ 2026 return (SCTP_ECT0_BIT); 2027 } 2028 2029 if (chk == NULL) 2030 return (SCTP_ECT0_BIT); 2031 2032 if (((stcb->asoc.hb_random_idx == 3) && 2033 (stcb->asoc.hb_ect_randombit > 7)) || 2034 (stcb->asoc.hb_random_idx > 3)) { 2035 uint32_t rndval; 2036 rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 2037 memcpy(stcb->asoc.hb_random_values, &rndval, 2038 sizeof(stcb->asoc.hb_random_values)); 2039 this_random = stcb->asoc.hb_random_values[0]; 2040 stcb->asoc.hb_random_idx = 0; 2041 stcb->asoc.hb_ect_randombit = 0; 2042 } else { 2043 if (stcb->asoc.hb_ect_randombit > 7) { 2044 stcb->asoc.hb_ect_randombit = 0; 2045 stcb->asoc.hb_random_idx++; 2046 } 2047 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx]; 2048 } 2049 if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) { 2050 if (chk != NULL) 2051 /* ECN Nonce stuff */ 2052 chk->rec.data.ect_nonce = SCTP_ECT1_BIT; 2053 stcb->asoc.hb_ect_randombit++; 2054 return (SCTP_ECT1_BIT); 2055 } else { 2056 stcb->asoc.hb_ect_randombit++; 2057 return (SCTP_ECT0_BIT); 2058 } 2059 } 2060 2061 extern int sctp_no_csum_on_loopback; 2062 2063 static int 2064 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp, 2065 struct sctp_tcb *stcb, /* may be NULL */ 2066 struct sctp_nets *net, 2067 const struct sockaddr *to, 2068 struct mbuf *m, 2069 int nofragment_flag, 2070 int ecn_ok, 2071 struct sctp_tmit_chunk *chk, 2072 int out_of_asoc_ok) 2073 /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */ 2074 { 2075 /* 2076 * Given a mbuf chain (via m_next) that holds a packet header 2077 * WITH a SCTPHDR but no IP header, endpoint inp and sa structure. 2078 * - calculate SCTP checksum and fill in 2079 * - prepend a IP address header 2080 * - if boundall use INADDR_ANY 2081 * - if boundspecific do source address selection 2082 * - set fragmentation option for ipV4 2083 * - On return from IP output, check/adjust mtu size 2084 * - of output interface and smallest_mtu size as well. 2085 */ 2086 struct sctphdr *sctphdr; 2087 int o_flgs; 2088 uint32_t csum; 2089 int ret; 2090 unsigned int have_mtu; 2091 struct route *ro; 2092 struct rtentry *rt; 2093 2094 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) { 2095 sctp_m_freem(m); 2096 return (EFAULT); 2097 } 2098 if ((m->m_flags & M_PKTHDR) == 0) { 2099 #ifdef SCTP_DEBUG 2100 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2101 printf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n"); 2102 } 2103 #endif 2104 sctp_m_freem(m); 2105 return (EFAULT); 2106 } 2107 /* Calculate the csum and fill in the length of the packet */ 2108 sctphdr = mtod(m, struct sctphdr *); 2109 have_mtu = 0; 2110 if (sctp_no_csum_on_loopback && 2111 (stcb) && 2112 (stcb->asoc.loopback_scope)) { 2113 sctphdr->checksum = 0; 2114 m->m_pkthdr.len = sctp_calculate_len(m); 2115 } else { 2116 sctphdr->checksum = 0; 2117 csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0); 2118 sctphdr->checksum = csum; 2119 } 2120 if (to->sa_family == AF_INET) { 2121 struct ip *ip; 2122 static struct route iproute; 2123 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 2124 if (m == NULL) { 2125 /* failed to prepend data, give up */ 2126 return (ENOMEM); 2127 } 2128 ip = mtod(m, struct ip *); 2129 ip->ip_v = IPVERSION; 2130 ip->ip_hl = (sizeof(struct ip) >> 2); 2131 if (nofragment_flag) { 2132 ip->ip_off = htons(IP_DF); 2133 } else 2134 ip->ip_off = 0; 2135 2136 ip->ip_id = htons(ip_newid(NULL)); 2137 ip->ip_ttl = inp->inp_ip_ttl; 2138 ip->ip_len = htons(m->m_pkthdr.len); 2139 if (stcb) { 2140 if ((stcb->asoc.ecn_allowed) && ecn_ok) { 2141 /* Enable ECN */ 2142 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) | 2143 sctp_get_ect(stcb, chk)); 2144 } else { 2145 /* No ECN */ 2146 ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos; 2147 } 2148 } else { 2149 /* no association at all */ 2150 ip->ip_tos = inp->inp_ip_tos; 2151 } 2152 ip->ip_p = IPPROTO_SCTP; 2153 ip->ip_sum = 0; 2154 #ifdef SCTP_DEBUG 2155 printf("chunk_output: net %p\n", net); 2156 #endif 2157 if (net == NULL) { 2158 ro = &iproute; 2159 memset(&iproute, 0, sizeof(iproute)); 2160 /* XXX */ 2161 rt = rtcache_lookup(ro, to); 2162 rtcache_unref(rt, ro); 2163 } else { 2164 ro = (struct route *)&net->ro; 2165 } 2166 /* Now the address selection part */ 2167 ip->ip_dst.s_addr = satocsin(to)->sin_addr.s_addr; 2168 2169 /* call the routine to select the src address */ 2170 if (net) { 2171 if (net->src_addr_selected == 0) { 2172 /* Cache the source address */ 2173 ((struct sockaddr_in *)&net->_s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp, 2174 stcb, 2175 ro, net, out_of_asoc_ok); 2176 rt = rtcache_validate(ro); 2177 if (rt != NULL) { 2178 net->src_addr_selected = 1; 2179 } 2180 rtcache_unref(rt, ro); 2181 } 2182 ip->ip_src = ((struct sockaddr_in *)&net->_s_addr)->sin_addr; 2183 } else { 2184 ip->ip_src = sctp_ipv4_source_address_selection(inp, 2185 stcb, ro, net, out_of_asoc_ok); 2186 } 2187 #ifdef SCTP_DEBUG 2188 printf("src addr %x\n", ip->ip_src.s_addr); 2189 #endif 2190 /* 2191 * If source address selection fails and we find no route then 2192 * the ip_ouput should fail as well with a NO_ROUTE_TO_HOST 2193 * type error. We probably should catch that somewhere and 2194 * abort the association right away (assuming this is an INIT 2195 * being sent). 2196 */ 2197 rt = rtcache_validate(ro); 2198 if (rt == NULL) { 2199 /* 2200 * src addr selection failed to find a route (or valid 2201 * source addr), so we can't get there from here! 2202 */ 2203 #ifdef SCTP_DEBUG 2204 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2205 printf("low_level_output: dropped v4 packet- no valid source addr\n"); 2206 printf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr))); 2207 } 2208 #endif /* SCTP_DEBUG */ 2209 if (net) { 2210 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) 2211 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 2212 stcb, 2213 SCTP_FAILED_THRESHOLD, 2214 (void *)net); 2215 net->dest_state &= ~SCTP_ADDR_REACHABLE; 2216 net->dest_state |= SCTP_ADDR_NOT_REACHABLE; 2217 if (stcb) { 2218 if (net == stcb->asoc.primary_destination) { 2219 /* need a new primary */ 2220 struct sctp_nets *alt; 2221 alt = sctp_find_alternate_net(stcb, net); 2222 if (alt != net) { 2223 if (sctp_set_primary_addr(stcb, 2224 (struct sockaddr *)NULL, 2225 alt) == 0) { 2226 net->dest_state |= SCTP_ADDR_WAS_PRIMARY; 2227 net->src_addr_selected = 0; 2228 } 2229 } 2230 } 2231 } 2232 } 2233 sctp_m_freem(m); 2234 return (EHOSTUNREACH); 2235 } else { 2236 have_mtu = rt->rt_ifp->if_mtu; 2237 } 2238 2239 o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST))); 2240 #ifdef SCTP_DEBUG 2241 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2242 printf("Calling ipv4 output routine from low level src addr:%x\n", 2243 (u_int)(ntohl(ip->ip_src.s_addr))); 2244 printf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr))); 2245 printf("RTP route is %p through\n", rt); 2246 printf("length %d\n", ip->ip_len); 2247 } 2248 #endif 2249 if ((have_mtu) && (net) && (have_mtu > net->mtu)) { 2250 rt->rt_ifp->if_mtu = net->mtu; 2251 } 2252 ret = ip_output(m, inp->ip_inp.inp.inp_options, 2253 ro, o_flgs, inp->ip_inp.inp.inp_moptions, 2254 (struct socket *)inp->sctp_socket); 2255 if ((rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) { 2256 rt->rt_ifp->if_mtu = have_mtu; 2257 } 2258 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 2259 #ifdef SCTP_DEBUG 2260 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2261 printf("Ip output returns %d\n", ret); 2262 } 2263 #endif 2264 if (net == NULL) { 2265 } else { 2266 /* PMTU check versus smallest asoc MTU goes here */ 2267 if (rt != NULL) { 2268 if (rt->rt_rmx.rmx_mtu && 2269 (stcb->asoc.smallest_mtu > rt->rt_rmx.rmx_mtu)) { 2270 sctp_mtu_size_reset(inp, &stcb->asoc, 2271 rt->rt_rmx.rmx_mtu); 2272 } 2273 } else { 2274 /* route was freed */ 2275 net->src_addr_selected = 0; 2276 } 2277 } 2278 rtcache_unref(rt, ro); 2279 return (ret); 2280 } 2281 #ifdef INET6 2282 else if (to->sa_family == AF_INET6) { 2283 struct ip6_hdr *ip6h; 2284 static struct route ip6route; 2285 struct ifnet *ifp; 2286 u_char flowTop; 2287 uint16_t flowBottom; 2288 u_char tosBottom, tosTop; 2289 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp; 2290 int prev_scope=0; 2291 u_short prev_port=0; 2292 2293 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT); 2294 if (m == NULL) { 2295 /* failed to prepend data, give up */ 2296 return (ENOMEM); 2297 } 2298 ip6h = mtod(m, struct ip6_hdr *); 2299 2300 /* 2301 * We assume here that inp_flow is in host byte order within 2302 * the TCB! 2303 */ 2304 flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff; 2305 flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16); 2306 2307 tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION); 2308 2309 /* protect *sin6 from overwrite */ 2310 memcpy(&tmp, to, sizeof(struct sockaddr_in6)); 2311 sin6 = &tmp; 2312 2313 /* KAME hack: embed scopeid */ 2314 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) 2315 if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0) 2316 #else 2317 /* 2318 * XXX: appropriate scope zone must be provided or otherwise 2319 * ip6_use_defzone must be 1. 2320 */ 2321 if (sa6_embedscope(sin6, ip6_use_defzone) != 0) 2322 #endif 2323 return (EINVAL); 2324 if (net == NULL) { 2325 memset(&ip6route, 0, sizeof(ip6route)); 2326 ro = (struct route *)&ip6route; 2327 /* XXX */ 2328 rt = rtcache_lookup(ro, (struct sockaddr *) sin6); 2329 rtcache_unref(rt, ro); 2330 } else { 2331 ro = (struct route *)&net->ro; 2332 } 2333 if (stcb != NULL) { 2334 if ((stcb->asoc.ecn_allowed) && ecn_ok) { 2335 /* Enable ECN */ 2336 tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4); 2337 } else { 2338 /* No ECN */ 2339 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4); 2340 } 2341 } else { 2342 /* we could get no asoc if it is a O-O-T-B packet */ 2343 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4); 2344 } 2345 ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom)); 2346 ip6h->ip6_nxt = IPPROTO_SCTP; 2347 ip6h->ip6_plen = m->m_pkthdr.len; 2348 ip6h->ip6_dst = sin6->sin6_addr; 2349 2350 /* 2351 * Add SRC address selection here: 2352 * we can only reuse to a limited degree the kame src-addr-sel, 2353 * since we can try their selection but it may not be bound. 2354 */ 2355 memset(&lsa6_tmp, 0, sizeof(lsa6_tmp)); 2356 lsa6_tmp.sin6_family = AF_INET6; 2357 lsa6_tmp.sin6_len = sizeof(lsa6_tmp); 2358 lsa6 = &lsa6_tmp; 2359 rt = rtcache_validate(ro); 2360 if (net) { 2361 if (net->src_addr_selected == 0) { 2362 /* Cache the source address */ 2363 ((struct sockaddr_in6 *)&net->_s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp, 2364 stcb, ro, net, out_of_asoc_ok); 2365 2366 if (rt != NULL) { 2367 net->src_addr_selected = 1; 2368 } 2369 } 2370 lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->_s_addr)->sin6_addr; 2371 } else { 2372 lsa6->sin6_addr = sctp_ipv6_source_address_selection( 2373 inp, stcb, ro, net, out_of_asoc_ok); 2374 } 2375 lsa6->sin6_port = inp->sctp_lport; 2376 2377 if (rt == NULL) { 2378 /* 2379 * src addr selection failed to find a route (or valid 2380 * source addr), so we can't get there from here! 2381 */ 2382 #ifdef SCTP_DEBUG 2383 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2384 printf("low_level_output: dropped v6 pkt- no valid source addr\n"); 2385 } 2386 #endif 2387 sctp_m_freem(m); 2388 if (net) { 2389 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) 2390 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN, 2391 stcb, 2392 SCTP_FAILED_THRESHOLD, 2393 (void *)net); 2394 net->dest_state &= ~SCTP_ADDR_REACHABLE; 2395 net->dest_state |= SCTP_ADDR_NOT_REACHABLE; 2396 if (stcb) { 2397 if (net == stcb->asoc.primary_destination) { 2398 /* need a new primary */ 2399 struct sctp_nets *alt; 2400 alt = sctp_find_alternate_net(stcb, net); 2401 if (alt != net) { 2402 if (sctp_set_primary_addr(stcb, 2403 (struct sockaddr *)NULL, 2404 alt) == 0) { 2405 net->dest_state |= SCTP_ADDR_WAS_PRIMARY; 2406 net->src_addr_selected = 0; 2407 } 2408 } 2409 } 2410 } 2411 } 2412 return (EHOSTUNREACH); 2413 } 2414 2415 ip6h->ip6_src = lsa6->sin6_addr; 2416 2417 /* 2418 * We set the hop limit now since there is a good chance that 2419 * our ro pointer is now filled 2420 */ 2421 ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp, 2422 (ro ? 2423 (rt ? (rt->rt_ifp) : (NULL)) : 2424 (NULL))); 2425 o_flgs = 0; 2426 ifp = rt->rt_ifp; 2427 #ifdef SCTP_DEBUG 2428 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2429 /* Copy to be sure something bad is not happening */ 2430 sin6->sin6_addr = ip6h->ip6_dst; 2431 lsa6->sin6_addr = ip6h->ip6_src; 2432 2433 printf("Calling ipv6 output routine from low level\n"); 2434 printf("src: "); 2435 sctp_print_address((struct sockaddr *)lsa6); 2436 printf("dst: "); 2437 sctp_print_address((struct sockaddr *)sin6); 2438 } 2439 #endif /* SCTP_DEBUG */ 2440 if (net) { 2441 sin6 = (struct sockaddr_in6 *)&net->ro.ro_sa; 2442 /* preserve the port and scope for link local send */ 2443 prev_scope = sin6->sin6_scope_id; 2444 prev_port = sin6->sin6_port; 2445 } 2446 /* XXX NOMPSAFE need to hold ifp here */ 2447 rtcache_unref(rt, ro); 2448 ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts, 2449 ro, 2450 o_flgs, 2451 ((struct in6pcb *)inp)->in6p_moptions, 2452 (struct socket *)inp->sctp_socket, 2453 &ifp); 2454 if (net) { 2455 /* for link local this must be done */ 2456 sin6->sin6_scope_id = prev_scope; 2457 sin6->sin6_port = prev_port; 2458 } 2459 #ifdef SCTP_DEBUG 2460 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 2461 printf("return from send is %d\n", ret); 2462 } 2463 #endif /* SCTP_DEBUG_OUTPUT */ 2464 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 2465 if (net) { 2466 /* PMTU check versus smallest asoc MTU goes here */ 2467 rt = rtcache_validate(ro); 2468 if (rt == NULL) { 2469 /* Route was freed */ 2470 net->src_addr_selected = 0; 2471 } 2472 if (rt != NULL) { 2473 if (rt->rt_rmx.rmx_mtu && 2474 (stcb->asoc.smallest_mtu > rt->rt_rmx.rmx_mtu)) { 2475 sctp_mtu_size_reset(inp, 2476 &stcb->asoc, 2477 rt->rt_rmx.rmx_mtu); 2478 } 2479 rtcache_unref(rt, ro); 2480 } else if (ifp) { 2481 if (ND_IFINFO(ifp)->linkmtu && 2482 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) { 2483 sctp_mtu_size_reset(inp, 2484 &stcb->asoc, 2485 ND_IFINFO(ifp)->linkmtu); 2486 } 2487 } 2488 } 2489 return (ret); 2490 } 2491 #endif 2492 else { 2493 #ifdef SCTP_DEBUG 2494 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 2495 printf("Unknown protocol (TSNH) type %d\n", ((const struct sockaddr *)to)->sa_family); 2496 } 2497 #endif 2498 sctp_m_freem(m); 2499 return (EFAULT); 2500 } 2501 } 2502 2503 static 2504 int sctp_is_address_in_scope(struct ifaddr *ifa, 2505 int ipv4_addr_legal, 2506 int ipv6_addr_legal, 2507 int loopback_scope, 2508 int ipv4_local_scope, 2509 int local_scope, 2510 int site_scope) 2511 { 2512 if ((loopback_scope == 0) && 2513 (ifa->ifa_ifp) && 2514 (ifa->ifa_ifp->if_type == IFT_LOOP)) { 2515 /* skip loopback if not in scope * 2516 */ 2517 return (0); 2518 } 2519 if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) { 2520 struct sockaddr_in *sin; 2521 sin = (struct sockaddr_in *)ifa->ifa_addr; 2522 if (sin->sin_addr.s_addr == 0) { 2523 /* not in scope , unspecified */ 2524 return (0); 2525 } 2526 if ((ipv4_local_scope == 0) && 2527 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) { 2528 /* private address not in scope */ 2529 return (0); 2530 } 2531 } else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) { 2532 struct sockaddr_in6 *sin6; 2533 struct in6_ifaddr *ifa6; 2534 2535 ifa6 = (struct in6_ifaddr *)ifa; 2536 /* ok to use deprecated addresses? */ 2537 if (!ip6_use_deprecated) { 2538 if (ifa6->ia6_flags & 2539 IN6_IFF_DEPRECATED) { 2540 return (0); 2541 } 2542 } 2543 if (ifa6->ia6_flags & 2544 (IN6_IFF_DETACHED | 2545 IN6_IFF_ANYCAST | 2546 IN6_IFF_NOTREADY)) { 2547 return (0); 2548 } 2549 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 2550 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 2551 /* skip unspecifed addresses */ 2552 return (0); 2553 } 2554 if (/*(local_scope == 0) && */ 2555 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) { 2556 return (0); 2557 } 2558 if ((site_scope == 0) && 2559 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) { 2560 return (0); 2561 } 2562 } else { 2563 return (0); 2564 } 2565 return (1); 2566 } 2567 2568 2569 void 2570 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 2571 { 2572 struct mbuf *m, *m_at, *m_last; 2573 struct sctp_nets *net; 2574 struct sctp_init_msg *initm; 2575 struct sctp_supported_addr_param *sup_addr; 2576 struct sctp_ecn_supported_param *ecn; 2577 struct sctp_prsctp_supported_param *prsctp; 2578 struct sctp_ecn_nonce_supported_param *ecn_nonce; 2579 struct sctp_supported_chunk_types_param *pr_supported; 2580 int cnt_inits_to=0; 2581 int padval, ret; 2582 2583 /* INIT's always go to the primary (and usually ONLY address) */ 2584 m_last = NULL; 2585 net = stcb->asoc.primary_destination; 2586 if (net == NULL) { 2587 net = TAILQ_FIRST(&stcb->asoc.nets); 2588 if (net == NULL) { 2589 /* TSNH */ 2590 return; 2591 } 2592 /* we confirm any address we send an INIT to */ 2593 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2594 sctp_set_primary_addr(stcb, NULL, net); 2595 } else { 2596 /* we confirm any address we send an INIT to */ 2597 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED; 2598 } 2599 #ifdef SCTP_DEBUG 2600 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2601 printf("Sending INIT to "); 2602 sctp_print_address (rtcache_getdst(&net->ro)); 2603 } 2604 #endif 2605 if (rtcache_getdst(&net->ro)->sa_family == AF_INET6) { 2606 /* special hook, if we are sending to link local 2607 * it will not show up in our private address count. 2608 */ 2609 if (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr *) rtcache_getdst(&net->ro)->sa_data)) 2610 cnt_inits_to = 1; 2611 } 2612 if (callout_pending(&net->rxt_timer.timer)) { 2613 /* This case should not happen */ 2614 return; 2615 } 2616 /* start the INIT timer */ 2617 if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) { 2618 /* we are hosed since I can't start the INIT timer? */ 2619 return; 2620 } 2621 MGETHDR(m, M_DONTWAIT, MT_HEADER); 2622 if (m == NULL) { 2623 /* No memory, INIT timer will re-attempt. */ 2624 return; 2625 } 2626 /* make it into a M_EXT */ 2627 MCLGET(m, M_DONTWAIT); 2628 if ((m->m_flags & M_EXT) != M_EXT) { 2629 /* Failed to get cluster buffer */ 2630 sctp_m_freem(m); 2631 return; 2632 } 2633 m->m_data += SCTP_MIN_OVERHEAD; 2634 m->m_len = sizeof(struct sctp_init_msg); 2635 /* Now lets put the SCTP header in place */ 2636 initm = mtod(m, struct sctp_init_msg *); 2637 initm->sh.src_port = inp->sctp_lport; 2638 initm->sh.dest_port = stcb->rport; 2639 initm->sh.v_tag = 0; 2640 initm->sh.checksum = 0; /* calculate later */ 2641 /* now the chunk header */ 2642 initm->msg.ch.chunk_type = SCTP_INITIATION; 2643 initm->msg.ch.chunk_flags = 0; 2644 /* fill in later from mbuf we build */ 2645 initm->msg.ch.chunk_length = 0; 2646 /* place in my tag */ 2647 initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag); 2648 /* set up some of the credits. */ 2649 initm->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.sb_hiwat, 2650 SCTP_MINIMAL_RWND)); 2651 2652 initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams); 2653 initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams); 2654 initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number); 2655 /* now the address restriction */ 2656 sup_addr = (struct sctp_supported_addr_param *)((vaddr_t)initm + 2657 sizeof(*initm)); 2658 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE); 2659 /* we support 2 types IPv6/IPv4 */ 2660 sup_addr->ph.param_length = htons(sizeof(*sup_addr) + 2661 sizeof(uint16_t)); 2662 sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS); 2663 sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS); 2664 m->m_len += sizeof(*sup_addr) + sizeof(uint16_t); 2665 2666 /* if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/ 2667 if (inp->sctp_ep.adaption_layer_indicator) { 2668 struct sctp_adaption_layer_indication *ali; 2669 ali = (struct sctp_adaption_layer_indication *)( 2670 (vaddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t)); 2671 ali->ph.param_type = htons(SCTP_ULP_ADAPTION); 2672 ali->ph.param_length = htons(sizeof(*ali)); 2673 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator); 2674 m->m_len += sizeof(*ali); 2675 ecn = (struct sctp_ecn_supported_param *)((vaddr_t)ali + 2676 sizeof(*ali)); 2677 } else { 2678 ecn = (struct sctp_ecn_supported_param *)((vaddr_t)sup_addr + 2679 sizeof(*sup_addr) + sizeof(uint16_t)); 2680 } 2681 2682 /* now any cookie time extensions */ 2683 if (stcb->asoc.cookie_preserve_req) { 2684 struct sctp_cookie_perserve_param *cookie_preserve; 2685 cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn); 2686 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE); 2687 cookie_preserve->ph.param_length = htons( 2688 sizeof(*cookie_preserve)); 2689 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req); 2690 m->m_len += sizeof(*cookie_preserve); 2691 ecn = (struct sctp_ecn_supported_param *)( 2692 (vaddr_t)cookie_preserve + sizeof(*cookie_preserve)); 2693 stcb->asoc.cookie_preserve_req = 0; 2694 } 2695 2696 /* ECN parameter */ 2697 if (sctp_ecn == 1) { 2698 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE); 2699 ecn->ph.param_length = htons(sizeof(*ecn)); 2700 m->m_len += sizeof(*ecn); 2701 prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn + 2702 sizeof(*ecn)); 2703 } else { 2704 prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn); 2705 } 2706 /* And now tell the peer we do pr-sctp */ 2707 prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED); 2708 prsctp->ph.param_length = htons(sizeof(*prsctp)); 2709 m->m_len += sizeof(*prsctp); 2710 2711 2712 /* And now tell the peer we do all the extensions */ 2713 pr_supported = (struct sctp_supported_chunk_types_param *)((vaddr_t)prsctp + 2714 sizeof(*prsctp)); 2715 2716 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 2717 pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT); 2718 pr_supported->chunk_types[0] = SCTP_ASCONF; 2719 pr_supported->chunk_types[1] = SCTP_ASCONF_ACK; 2720 pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN; 2721 pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED; 2722 pr_supported->chunk_types[4] = SCTP_STREAM_RESET; 2723 pr_supported->chunk_types[5] = 0; /* pad */ 2724 pr_supported->chunk_types[6] = 0; /* pad */ 2725 pr_supported->chunk_types[7] = 0; /* pad */ 2726 2727 m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT); 2728 /* ECN nonce: And now tell the peer we support ECN nonce */ 2729 2730 if (sctp_ecn_nonce) { 2731 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((vaddr_t)pr_supported + 2732 sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT); 2733 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED); 2734 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce)); 2735 m->m_len += sizeof(*ecn_nonce); 2736 } 2737 2738 m_at = m; 2739 /* now the addresses */ 2740 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 2741 struct ifnet *ifn; 2742 struct ifaddr *ifa; 2743 int cnt; 2744 int s; 2745 2746 cnt = cnt_inits_to; 2747 s = pserialize_read_enter(); 2748 IFNET_READER_FOREACH(ifn) { 2749 if ((stcb->asoc.loopback_scope == 0) && 2750 (ifn->if_type == IFT_LOOP)) { 2751 /* 2752 * Skip loopback devices if loopback_scope 2753 * not set 2754 */ 2755 continue; 2756 } 2757 IFADDR_READER_FOREACH(ifa, ifn) { 2758 if (sctp_is_address_in_scope(ifa, 2759 stcb->asoc.ipv4_addr_legal, 2760 stcb->asoc.ipv6_addr_legal, 2761 stcb->asoc.loopback_scope, 2762 stcb->asoc.ipv4_local_scope, 2763 stcb->asoc.local_scope, 2764 stcb->asoc.site_scope) == 0) { 2765 continue; 2766 } 2767 cnt++; 2768 } 2769 } 2770 pserialize_read_exit(s); 2771 2772 if (cnt > 1) { 2773 s = pserialize_read_enter(); 2774 IFNET_READER_FOREACH(ifn) { 2775 if ((stcb->asoc.loopback_scope == 0) && 2776 (ifn->if_type == IFT_LOOP)) { 2777 /* 2778 * Skip loopback devices if loopback_scope 2779 * not set 2780 */ 2781 continue; 2782 } 2783 IFADDR_READER_FOREACH(ifa, ifn) { 2784 if (sctp_is_address_in_scope(ifa, 2785 stcb->asoc.ipv4_addr_legal, 2786 stcb->asoc.ipv6_addr_legal, 2787 stcb->asoc.loopback_scope, 2788 stcb->asoc.ipv4_local_scope, 2789 stcb->asoc.local_scope, 2790 stcb->asoc.site_scope) == 0) { 2791 continue; 2792 } 2793 m_at = sctp_add_addr_to_mbuf(m_at, ifa); 2794 } 2795 } 2796 pserialize_read_exit(s); 2797 } 2798 } else { 2799 struct sctp_laddr *laddr; 2800 int cnt; 2801 cnt = cnt_inits_to; 2802 /* First, how many ? */ 2803 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2804 if (laddr->ifa == NULL) { 2805 continue; 2806 } 2807 if (laddr->ifa->ifa_addr == NULL) 2808 continue; 2809 if (sctp_is_address_in_scope(laddr->ifa, 2810 stcb->asoc.ipv4_addr_legal, 2811 stcb->asoc.ipv6_addr_legal, 2812 stcb->asoc.loopback_scope, 2813 stcb->asoc.ipv4_local_scope, 2814 stcb->asoc.local_scope, 2815 stcb->asoc.site_scope) == 0) { 2816 continue; 2817 } 2818 cnt++; 2819 } 2820 /* To get through a NAT we only list addresses if 2821 * we have more than one. That way if you just 2822 * bind a single address we let the source of the init 2823 * dictate our address. 2824 */ 2825 if (cnt > 1) { 2826 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 2827 if (laddr->ifa == NULL) { 2828 continue; 2829 } 2830 if (laddr->ifa->ifa_addr == NULL) { 2831 continue; 2832 } 2833 2834 if (sctp_is_address_in_scope(laddr->ifa, 2835 stcb->asoc.ipv4_addr_legal, 2836 stcb->asoc.ipv6_addr_legal, 2837 stcb->asoc.loopback_scope, 2838 stcb->asoc.ipv4_local_scope, 2839 stcb->asoc.local_scope, 2840 stcb->asoc.site_scope) == 0) { 2841 continue; 2842 } 2843 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa); 2844 } 2845 } 2846 } 2847 /* calulate the size and update pkt header and chunk header */ 2848 m->m_pkthdr.len = 0; 2849 for (m_at = m; m_at; m_at = m_at->m_next) { 2850 if (m_at->m_next == NULL) 2851 m_last = m_at; 2852 m->m_pkthdr.len += m_at->m_len; 2853 } 2854 initm->msg.ch.chunk_length = htons((m->m_pkthdr.len - 2855 sizeof(struct sctphdr))); 2856 #ifdef SCTP_DEBUG 2857 printf("chunk_length %d\n", ntohs(initm->msg.ch.chunk_length)); 2858 #endif 2859 /* We pass 0 here to NOT set IP_DF if its IPv4, we 2860 * ignore the return here since the timer will drive 2861 * a retranmission. 2862 */ 2863 2864 /* I don't expect this to execute but we will be safe here */ 2865 padval = m->m_pkthdr.len % 4; 2866 if ((padval) && (m_last)) { 2867 /* The compiler worries that m_last may not be 2868 * set even though I think it is impossible :-> 2869 * however we add m_last here just in case. 2870 */ 2871 ret = sctp_add_pad_tombuf(m_last, (4-padval)); 2872 if (ret) { 2873 /* Houston we have a problem, no space */ 2874 sctp_m_freem(m); 2875 return; 2876 } 2877 m->m_pkthdr.len += padval; 2878 } 2879 #ifdef SCTP_DEBUG 2880 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2881 printf("Calling lowlevel output stcb:%p net:%p\n", 2882 stcb, net); 2883 } 2884 #endif 2885 ret = sctp_lowlevel_chunk_output(inp, stcb, net, 2886 rtcache_getdst(&net->ro), m, 0, 0, NULL, 0); 2887 #ifdef SCTP_DEBUG 2888 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2889 printf("Low level output returns %d\n", ret); 2890 } 2891 #endif 2892 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net); 2893 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 2894 } 2895 2896 struct mbuf * 2897 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt, 2898 int param_offset, int *abort_processing, struct sctp_chunkhdr *cp) 2899 { 2900 /* Given a mbuf containing an INIT or INIT-ACK 2901 * with the param_offset being equal to the 2902 * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg) 2903 * parse through the parameters to the end of the mbuf verifying 2904 * that all parameters are known. 2905 * 2906 * For unknown parameters build and return a mbuf with 2907 * UNRECOGNIZED_PARAMETER errors. If the flags indicate 2908 * to stop processing this chunk stop, and set *abort_processing 2909 * to 1. 2910 * 2911 * By having param_offset be pre-set to where parameters begin 2912 * it is hoped that this routine may be reused in the future 2913 * by new features. 2914 */ 2915 struct sctp_paramhdr *phdr, params; 2916 2917 struct mbuf *mat, *op_err; 2918 char tempbuf[2048]; 2919 int at, limit, pad_needed; 2920 uint16_t ptype, plen; 2921 int err_at; 2922 2923 *abort_processing = 0; 2924 mat = in_initpkt; 2925 err_at = 0; 2926 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk); 2927 #ifdef SCTP_DEBUG 2928 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2929 printf("Limit is %d bytes\n", limit); 2930 } 2931 #endif 2932 at = param_offset; 2933 op_err = NULL; 2934 2935 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 2936 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) { 2937 ptype = ntohs(phdr->param_type); 2938 plen = ntohs(phdr->param_length); 2939 limit -= SCTP_SIZE32(plen); 2940 if (plen < sizeof(struct sctp_paramhdr)) { 2941 #ifdef SCTP_DEBUG 2942 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2943 printf("sctp_output.c:Impossible length in parameter < %d\n", plen); 2944 } 2945 #endif 2946 *abort_processing = 1; 2947 break; 2948 } 2949 /* All parameters for all chunks that we 2950 * know/understand are listed here. We process 2951 * them other places and make appropriate 2952 * stop actions per the upper bits. However 2953 * this is the generic routine processor's can 2954 * call to get back an operr.. to either incorporate (init-ack) 2955 * or send. 2956 */ 2957 if ((ptype == SCTP_HEARTBEAT_INFO) || 2958 (ptype == SCTP_IPV4_ADDRESS) || 2959 (ptype == SCTP_IPV6_ADDRESS) || 2960 (ptype == SCTP_STATE_COOKIE) || 2961 (ptype == SCTP_UNRECOG_PARAM) || 2962 (ptype == SCTP_COOKIE_PRESERVE) || 2963 (ptype == SCTP_SUPPORTED_ADDRTYPE) || 2964 (ptype == SCTP_PRSCTP_SUPPORTED) || 2965 (ptype == SCTP_ADD_IP_ADDRESS) || 2966 (ptype == SCTP_DEL_IP_ADDRESS) || 2967 (ptype == SCTP_ECN_CAPABLE) || 2968 (ptype == SCTP_ULP_ADAPTION) || 2969 (ptype == SCTP_ERROR_CAUSE_IND) || 2970 (ptype == SCTP_SET_PRIM_ADDR) || 2971 (ptype == SCTP_SUCCESS_REPORT) || 2972 (ptype == SCTP_ULP_ADAPTION) || 2973 (ptype == SCTP_SUPPORTED_CHUNK_EXT) || 2974 (ptype == SCTP_ECN_NONCE_SUPPORTED) 2975 ) { 2976 /* no skip it */ 2977 at += SCTP_SIZE32(plen); 2978 } else if (ptype == SCTP_HOSTNAME_ADDRESS) { 2979 /* We can NOT handle HOST NAME addresses!! */ 2980 #ifdef SCTP_DEBUG 2981 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2982 printf("Can't handle hostname addresses.. abort processing\n"); 2983 } 2984 #endif 2985 *abort_processing = 1; 2986 if (op_err == NULL) { 2987 /* Ok need to try to get a mbuf */ 2988 MGETHDR(op_err, M_DONTWAIT, MT_DATA); 2989 if (op_err) { 2990 op_err->m_len = 0; 2991 op_err->m_pkthdr.len = 0; 2992 /* pre-reserve space for ip and sctp header and chunk hdr*/ 2993 op_err->m_data += sizeof(struct ip6_hdr); 2994 op_err->m_data += sizeof(struct sctphdr); 2995 op_err->m_data += sizeof(struct sctp_chunkhdr); 2996 } 2997 } 2998 if (op_err) { 2999 /* If we have space */ 3000 struct sctp_paramhdr s; 3001 if (err_at % 4) { 3002 u_int32_t cpthis=0; 3003 pad_needed = 4 - (err_at % 4); 3004 m_copyback(op_err, err_at, pad_needed, (void *)&cpthis); 3005 err_at += pad_needed; 3006 } 3007 s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR); 3008 s.param_length = htons(sizeof(s) + plen); 3009 m_copyback(op_err, err_at, sizeof(s), (void *)&s); 3010 err_at += sizeof(s); 3011 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen); 3012 if (phdr == NULL) { 3013 sctp_m_freem(op_err); 3014 /* we are out of memory but we 3015 * still need to have a look at what to 3016 * do (the system is in trouble though). 3017 */ 3018 return (NULL); 3019 } 3020 m_copyback(op_err, err_at, plen, (void *)phdr); 3021 err_at += plen; 3022 } 3023 return (op_err); 3024 } else { 3025 /* we do not recognize the parameter 3026 * figure out what we do. 3027 */ 3028 #ifdef SCTP_DEBUG 3029 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 3030 printf("Got parameter type %x - unknown\n", 3031 (u_int)ptype); 3032 } 3033 #endif 3034 if ((ptype & 0x4000) == 0x4000) { 3035 /* Report bit is set?? */ 3036 #ifdef SCTP_DEBUG 3037 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 3038 printf("Report bit is set\n"); 3039 } 3040 #endif 3041 if (op_err == NULL) { 3042 /* Ok need to try to get an mbuf */ 3043 MGETHDR(op_err, M_DONTWAIT, MT_DATA); 3044 if (op_err) { 3045 op_err->m_len = 0; 3046 op_err->m_pkthdr.len = 0; 3047 op_err->m_data += sizeof(struct ip6_hdr); 3048 op_err->m_data += sizeof(struct sctphdr); 3049 op_err->m_data += sizeof(struct sctp_chunkhdr); 3050 } 3051 } 3052 if (op_err) { 3053 /* If we have space */ 3054 struct sctp_paramhdr s; 3055 if (err_at % 4) { 3056 u_int32_t cpthis=0; 3057 pad_needed = 4 - (err_at % 4); 3058 m_copyback(op_err, err_at, pad_needed, (void *)&cpthis); 3059 err_at += pad_needed; 3060 } 3061 s.param_type = htons(SCTP_UNRECOG_PARAM); 3062 s.param_length = htons(sizeof(s) + plen); 3063 m_copyback(op_err, err_at, sizeof(s), (void *)&s); 3064 err_at += sizeof(s); 3065 if (plen > sizeof(tempbuf)) { 3066 plen = sizeof(tempbuf); 3067 } 3068 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen); 3069 if (phdr == NULL) { 3070 sctp_m_freem(op_err); 3071 /* we are out of memory but we 3072 * still need to have a look at what to 3073 * do (the system is in trouble though). 3074 */ 3075 goto more_processing; 3076 } 3077 m_copyback(op_err, err_at, plen, (void *)phdr); 3078 err_at += plen; 3079 } 3080 } 3081 more_processing: 3082 if ((ptype & 0x8000) == 0x0000) { 3083 #ifdef SCTP_DEBUG 3084 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 3085 printf("Abort bit is now setting1\n"); 3086 } 3087 #endif 3088 return (op_err); 3089 } else { 3090 /* skip this chunk and continue processing */ 3091 at += SCTP_SIZE32(plen); 3092 } 3093 3094 } 3095 phdr = sctp_get_next_param(mat, at, ¶ms, sizeof(params)); 3096 } 3097 return (op_err); 3098 } 3099 3100 static int 3101 sctp_are_there_new_addresses(struct sctp_association *asoc, 3102 struct mbuf *in_initpkt, int iphlen, int offset) 3103 { 3104 /* 3105 * Given a INIT packet, look through the packet to verify that 3106 * there are NO new addresses. As we go through the parameters 3107 * add reports of any un-understood parameters that require an 3108 * error. Also we must return (1) to drop the packet if we see 3109 * a un-understood parameter that tells us to drop the chunk. 3110 */ 3111 struct sockaddr_in sin4, *sa4; 3112 struct sockaddr_in6 sin6, *sa6; 3113 struct sockaddr *sa_touse; 3114 struct sockaddr *sa; 3115 struct sctp_paramhdr *phdr, params; 3116 struct ip *iph; 3117 struct mbuf *mat; 3118 uint16_t ptype, plen; 3119 uint8_t fnd; 3120 struct sctp_nets *net; 3121 3122 memset(&sin4, 0, sizeof(sin4)); 3123 memset(&sin6, 0, sizeof(sin6)); 3124 sin4.sin_family = AF_INET; 3125 sin4.sin_len = sizeof(sin4); 3126 sin6.sin6_family = AF_INET6; 3127 sin6.sin6_len = sizeof(sin6); 3128 3129 sa_touse = NULL; 3130 /* First what about the src address of the pkt ? */ 3131 iph = mtod(in_initpkt, struct ip *); 3132 if (iph->ip_v == IPVERSION) { 3133 /* source addr is IPv4 */ 3134 sin4.sin_addr = iph->ip_src; 3135 sa_touse = (struct sockaddr *)&sin4; 3136 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 3137 /* source addr is IPv6 */ 3138 struct ip6_hdr *ip6h; 3139 ip6h = mtod(in_initpkt, struct ip6_hdr *); 3140 sin6.sin6_addr = ip6h->ip6_src; 3141 sa_touse = (struct sockaddr *)&sin6; 3142 } else { 3143 return (1); 3144 } 3145 3146 fnd = 0; 3147 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3148 sa = (struct sockaddr *)&net->ro.ro_sa; 3149 if (sa->sa_family == sa_touse->sa_family) { 3150 if (sa->sa_family == AF_INET) { 3151 sa4 = (struct sockaddr_in *)sa; 3152 if (sa4->sin_addr.s_addr == 3153 sin4.sin_addr.s_addr) { 3154 fnd = 1; 3155 break; 3156 } 3157 } else if (sa->sa_family == AF_INET6) { 3158 sa6 = (struct sockaddr_in6 *)sa; 3159 if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr, 3160 &sin6.sin6_addr)) { 3161 fnd = 1; 3162 break; 3163 } 3164 } 3165 } 3166 } 3167 if (fnd == 0) { 3168 /* New address added! no need to look futher. */ 3169 return (1); 3170 } 3171 /* Ok so far lets munge through the rest of the packet */ 3172 mat = in_initpkt; 3173 sa_touse = NULL; 3174 offset += sizeof(struct sctp_init_chunk); 3175 phdr = sctp_get_next_param(mat, offset, ¶ms, sizeof(params)); 3176 while (phdr) { 3177 ptype = ntohs(phdr->param_type); 3178 plen = ntohs(phdr->param_length); 3179 if (ptype == SCTP_IPV4_ADDRESS) { 3180 struct sctp_ipv4addr_param *p4, p4_buf; 3181 3182 phdr = sctp_get_next_param(mat, offset, 3183 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 3184 if (plen != sizeof(struct sctp_ipv4addr_param) || 3185 phdr == NULL) { 3186 return (1); 3187 } 3188 p4 = (struct sctp_ipv4addr_param *)phdr; 3189 sin4.sin_addr.s_addr = p4->addr; 3190 sa_touse = (struct sockaddr *)&sin4; 3191 } else if (ptype == SCTP_IPV6_ADDRESS) { 3192 struct sctp_ipv6addr_param *p6, p6_buf; 3193 3194 phdr = sctp_get_next_param(mat, offset, 3195 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 3196 if (plen != sizeof(struct sctp_ipv6addr_param) || 3197 phdr == NULL) { 3198 return (1); 3199 } 3200 p6 = (struct sctp_ipv6addr_param *)phdr; 3201 memcpy((void *)&sin6.sin6_addr, p6->addr, 3202 sizeof(p6->addr)); 3203 sa_touse = (struct sockaddr *)&sin4; 3204 } 3205 3206 if (sa_touse) { 3207 /* ok, sa_touse points to one to check */ 3208 fnd = 0; 3209 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3210 sa = (struct sockaddr *)&net->ro.ro_sa; 3211 if (sa->sa_family != sa_touse->sa_family) { 3212 continue; 3213 } 3214 if (sa->sa_family == AF_INET) { 3215 sa4 = (struct sockaddr_in *)sa; 3216 if (sa4->sin_addr.s_addr == 3217 sin4.sin_addr.s_addr) { 3218 fnd = 1; 3219 break; 3220 } 3221 } else if (sa->sa_family == AF_INET6) { 3222 sa6 = (struct sockaddr_in6 *)sa; 3223 if (SCTP6_ARE_ADDR_EQUAL( 3224 &sa6->sin6_addr, &sin6.sin6_addr)) { 3225 fnd = 1; 3226 break; 3227 } 3228 } 3229 } 3230 if (!fnd) { 3231 /* New addr added! no need to look further */ 3232 return (1); 3233 } 3234 } 3235 offset += SCTP_SIZE32(plen); 3236 phdr = sctp_get_next_param(mat, offset, ¶ms, sizeof(params)); 3237 } 3238 return (0); 3239 } 3240 3241 /* 3242 * Given a MBUF chain that was sent into us containing an 3243 * INIT. Build a INIT-ACK with COOKIE and send back. 3244 * We assume that the in_initpkt has done a pullup to 3245 * include IPv6/4header, SCTP header and initial part of 3246 * INIT message (i.e. the struct sctp_init_msg). 3247 */ 3248 void 3249 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb, 3250 struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh, 3251 struct sctp_init_chunk *init_chk) 3252 { 3253 struct sctp_association *asoc; 3254 struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last; 3255 struct sctp_init_msg *initackm_out; 3256 struct sctp_ecn_supported_param *ecn; 3257 struct sctp_prsctp_supported_param *prsctp; 3258 struct sctp_ecn_nonce_supported_param *ecn_nonce; 3259 struct sctp_supported_chunk_types_param *pr_supported; 3260 struct sockaddr_storage store; 3261 struct sockaddr_in *sin; 3262 struct sockaddr_in6 *sin6; 3263 struct route *ro; 3264 struct ip *iph; 3265 struct ip6_hdr *ip6; 3266 const struct sockaddr *to; 3267 struct sctp_state_cookie stc; 3268 struct sctp_nets *net=NULL; 3269 int cnt_inits_to=0; 3270 uint16_t his_limit, i_want; 3271 int abort_flag, padval, sz_of; 3272 struct rtentry *rt; 3273 3274 if (stcb) { 3275 asoc = &stcb->asoc; 3276 } else { 3277 asoc = NULL; 3278 } 3279 m_last = NULL; 3280 if ((asoc != NULL) && 3281 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) && 3282 (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) { 3283 /* new addresses, out of here in non-cookie-wait states */ 3284 /* 3285 * Send a ABORT, we don't add the new address error clause though 3286 * we even set the T bit and copy in the 0 tag.. this looks no 3287 * different than if no listner was present. 3288 */ 3289 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL); 3290 return; 3291 } 3292 abort_flag = 0; 3293 op_err = sctp_arethere_unrecognized_parameters(init_pkt, 3294 (offset+sizeof(struct sctp_init_chunk)), 3295 &abort_flag, (struct sctp_chunkhdr *)init_chk); 3296 if (abort_flag) { 3297 sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err); 3298 return; 3299 } 3300 MGETHDR(m, M_DONTWAIT, MT_HEADER); 3301 if (m == NULL) { 3302 /* No memory, INIT timer will re-attempt. */ 3303 if (op_err) 3304 sctp_m_freem(op_err); 3305 return; 3306 } 3307 MCLGET(m, M_DONTWAIT); 3308 if ((m->m_flags & M_EXT) != M_EXT) { 3309 /* Failed to get cluster buffer */ 3310 if (op_err) 3311 sctp_m_freem(op_err); 3312 sctp_m_freem(m); 3313 return; 3314 } 3315 m->m_data += SCTP_MIN_OVERHEAD; 3316 m_reset_rcvif(m); 3317 m->m_len = sizeof(struct sctp_init_msg); 3318 3319 /* the time I built cookie */ 3320 SCTP_GETTIME_TIMEVAL(&stc.time_entered); 3321 3322 /* populate any tie tags */ 3323 if (asoc != NULL) { 3324 /* unlock before tag selections */ 3325 SCTP_TCB_UNLOCK(stcb); 3326 if (asoc->my_vtag_nonce == 0) 3327 asoc->my_vtag_nonce = sctp_select_a_tag(inp); 3328 stc.tie_tag_my_vtag = asoc->my_vtag_nonce; 3329 3330 if (asoc->peer_vtag_nonce == 0) 3331 asoc->peer_vtag_nonce = sctp_select_a_tag(inp); 3332 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce; 3333 3334 stc.cookie_life = asoc->cookie_life; 3335 net = asoc->primary_destination; 3336 /* now we must relock */ 3337 SCTP_INP_RLOCK(inp); 3338 /* we may be in trouble here if the inp got freed 3339 * most likely this set of tests will protect 3340 * us but there is a chance not. 3341 */ 3342 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 3343 if (op_err) 3344 sctp_m_freem(op_err); 3345 sctp_m_freem(m); 3346 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL); 3347 return; 3348 } 3349 SCTP_TCB_LOCK(stcb); 3350 SCTP_INP_RUNLOCK(stcb->sctp_ep); 3351 } else { 3352 stc.tie_tag_my_vtag = 0; 3353 stc.tie_tag_peer_vtag = 0; 3354 /* life I will award this cookie */ 3355 stc.cookie_life = inp->sctp_ep.def_cookie_life; 3356 } 3357 3358 /* copy in the ports for later check */ 3359 stc.myport = sh->dest_port; 3360 stc.peerport = sh->src_port; 3361 3362 /* 3363 * If we wanted to honor cookie life extentions, we would add 3364 * to stc.cookie_life. For now we should NOT honor any extension 3365 */ 3366 stc.site_scope = stc.local_scope = stc.loopback_scope = 0; 3367 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 3368 struct inpcb *in_inp; 3369 /* Its a V6 socket */ 3370 in_inp = (struct inpcb *)inp; 3371 stc.ipv6_addr_legal = 1; 3372 /* Now look at the binding flag to see if V4 will be legal */ 3373 if ( 3374 #if defined(__FreeBSD__) || defined(__APPLE__) 3375 (in_inp->inp_flags & IN6P_IPV6_V6ONLY) 3376 #elif defined(__OpenBSD__) 3377 (0) /* For openbsd we do dual bind only */ 3378 #else 3379 (((struct in6pcb *)in_inp)->in6p_flags & IN6P_IPV6_V6ONLY) 3380 #endif 3381 == 0) { 3382 stc.ipv4_addr_legal = 1; 3383 } else { 3384 /* V4 addresses are NOT legal on the association */ 3385 stc.ipv4_addr_legal = 0; 3386 } 3387 } else { 3388 /* Its a V4 socket, no - V6 */ 3389 stc.ipv4_addr_legal = 1; 3390 stc.ipv6_addr_legal = 0; 3391 } 3392 3393 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE 3394 stc.ipv4_scope = 1; 3395 #else 3396 stc.ipv4_scope = 0; 3397 #endif 3398 /* now for scope setup */ 3399 memset((void *)&store, 0, sizeof(store)); 3400 sin = (struct sockaddr_in *)&store; 3401 sin6 = (struct sockaddr_in6 *)&store; 3402 if (net == NULL) { 3403 to = (struct sockaddr *)&store; 3404 iph = mtod(init_pkt, struct ip *); 3405 if (iph->ip_v == IPVERSION) { 3406 struct in_addr addr; 3407 static struct route iproute; 3408 3409 sin->sin_family = AF_INET; 3410 sin->sin_len = sizeof(struct sockaddr_in); 3411 sin->sin_port = sh->src_port; 3412 sin->sin_addr = iph->ip_src; 3413 /* lookup address */ 3414 stc.address[0] = sin->sin_addr.s_addr; 3415 stc.address[1] = 0; 3416 stc.address[2] = 0; 3417 stc.address[3] = 0; 3418 stc.addr_type = SCTP_IPV4_ADDRESS; 3419 /* local from address */ 3420 memset(&iproute, 0, sizeof(iproute)); 3421 ro = &iproute; 3422 3423 /* XXX */ 3424 rt = rtcache_lookup(ro, (struct sockaddr *) sin); 3425 rtcache_unref(rt, ro); 3426 addr = sctp_ipv4_source_address_selection(inp, NULL, 3427 ro, NULL, 0); 3428 stc.laddress[0] = addr.s_addr; 3429 stc.laddress[1] = 0; 3430 stc.laddress[2] = 0; 3431 stc.laddress[3] = 0; 3432 stc.laddr_type = SCTP_IPV4_ADDRESS; 3433 /* scope_id is only for v6 */ 3434 stc.scope_id = 0; 3435 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE 3436 if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) { 3437 stc.ipv4_scope = 1; 3438 } 3439 #else 3440 stc.ipv4_scope = 1; 3441 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */ 3442 /* Must use the address in this case */ 3443 if (sctp_is_address_on_local_host((struct sockaddr *)sin)) { 3444 stc.loopback_scope = 1; 3445 stc.ipv4_scope = 1; 3446 stc.site_scope = 1; 3447 stc.local_scope = 1; 3448 } 3449 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 3450 struct in6_addr addr; 3451 static struct route iproute6; 3452 ip6 = mtod(init_pkt, struct ip6_hdr *); 3453 sin6->sin6_family = AF_INET6; 3454 sin6->sin6_len = sizeof(struct sockaddr_in6); 3455 sin6->sin6_port = sh->src_port; 3456 sin6->sin6_addr = ip6->ip6_src; 3457 /* lookup address */ 3458 memcpy(&stc.address, &sin6->sin6_addr, 3459 sizeof(struct in6_addr)); 3460 sin6->sin6_scope_id = 0; 3461 stc.addr_type = SCTP_IPV6_ADDRESS; 3462 stc.scope_id = 0; 3463 if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) { 3464 stc.loopback_scope = 1; 3465 stc.local_scope = 1; 3466 stc.site_scope = 1; 3467 stc.ipv4_scope = 1; 3468 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 3469 /* 3470 * If the new destination is a LINK_LOCAL 3471 * we must have common both site and local 3472 * scope. Don't set local scope though since 3473 * we must depend on the source to be added 3474 * implicitly. We cannot assure just because 3475 * we share one link that all links are common. 3476 * 3477 * XXX: never treat link-local case explicitly. 3478 * Use general routines defined in scope6.c. 3479 * (jinmei@kame) 3480 */ 3481 stc.local_scope = 0; 3482 stc.site_scope = 1; 3483 stc.ipv4_scope = 1; 3484 /* we start counting for the private 3485 * address stuff at 1. since the link 3486 * local we source from won't show 3487 * up in our scoped count. 3488 */ 3489 cnt_inits_to=1; 3490 /* pull out the scope_id from incoming pkt */ 3491 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) 3492 (void)in6_recoverscope(sin6, &in6_src, 3493 m_get_rcvif_NOMPSAFE(init_pkt)); 3494 in6_embedscope(&sin6->sin6_addr, sin6, NULL, 3495 NULL); 3496 #else 3497 (void)sa6_recoverscope(sin6); 3498 #endif 3499 stc.scope_id = sin6->sin6_scope_id; 3500 3501 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) { 3502 /* 3503 * If the new destination is SITE_LOCAL 3504 * then we must have site scope in common. 3505 */ 3506 stc.site_scope = 1; 3507 } 3508 /* local from address */ 3509 memset(&iproute6, 0, sizeof(iproute6)); 3510 ro = (struct route *)&iproute6; 3511 /* XXX */ 3512 rt = rtcache_lookup(ro, (struct sockaddr *) sin6); 3513 rtcache_unref(rt, ro); 3514 addr = sctp_ipv6_source_address_selection(inp, NULL, 3515 ro, NULL, 0); 3516 memcpy(&stc.laddress, &addr, sizeof(struct in6_addr)); 3517 stc.laddr_type = SCTP_IPV6_ADDRESS; 3518 } 3519 } else { 3520 /* set the scope per the existing tcb */ 3521 struct sctp_nets *lnet; 3522 3523 stc.loopback_scope = asoc->loopback_scope; 3524 stc.ipv4_scope = asoc->ipv4_local_scope; 3525 stc.site_scope = asoc->site_scope; 3526 stc.local_scope = asoc->local_scope; 3527 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 3528 if (rtcache_getdst(&lnet->ro)->sa_family == AF_INET6) { 3529 if (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr *) rtcache_getdst(&lnet->ro)->sa_data)) { 3530 /* if we have a LL address, start counting 3531 * at 1. 3532 */ 3533 cnt_inits_to = 1; 3534 } 3535 } 3536 } 3537 3538 /* use the net pointer */ 3539 to = rtcache_getdst(&net->ro); 3540 if (to->sa_family == AF_INET) { 3541 memcpy(&stc.address[0], to, sizeof(struct in_addr)); 3542 stc.address[1] = 0; 3543 stc.address[2] = 0; 3544 stc.address[3] = 0; 3545 stc.addr_type = SCTP_IPV4_ADDRESS; 3546 if (net->src_addr_selected == 0) { 3547 /* strange case here, the INIT 3548 * should have did the selection. 3549 */ 3550 net->_s_addr.sin.sin_addr = 3551 sctp_ipv4_source_address_selection(inp, 3552 stcb, &net->ro, net, 0); 3553 net->src_addr_selected = 1; 3554 3555 } 3556 3557 stc.laddress[0] = net->_s_addr.sin.sin_addr.s_addr; 3558 stc.laddress[1] = 0; 3559 stc.laddress[2] = 0; 3560 stc.laddress[3] = 0; 3561 stc.laddr_type = SCTP_IPV4_ADDRESS; 3562 } else if (to->sa_family == AF_INET6) { 3563 memcpy(&stc.address, &to->sa_data, 3564 sizeof(struct in6_addr)); 3565 stc.addr_type = SCTP_IPV6_ADDRESS; 3566 if (net->src_addr_selected == 0) { 3567 /* strange case here, the INIT 3568 * should have did the selection. 3569 */ 3570 net->_s_addr.sin6.sin6_addr = 3571 sctp_ipv6_source_address_selection(inp, 3572 stcb, &net->ro, net, 0); 3573 net->src_addr_selected = 1; 3574 } 3575 memcpy(&stc.laddress, &net->_s_addr.sin6.sin6_addr, 3576 sizeof(struct in6_addr)); 3577 stc.laddr_type = SCTP_IPV6_ADDRESS; 3578 } 3579 } 3580 /* Now lets put the SCTP header in place */ 3581 initackm_out = mtod(m, struct sctp_init_msg *); 3582 initackm_out->sh.src_port = inp->sctp_lport; 3583 initackm_out->sh.dest_port = sh->src_port; 3584 initackm_out->sh.v_tag = init_chk->init.initiate_tag; 3585 /* Save it off for quick ref */ 3586 stc.peers_vtag = init_chk->init.initiate_tag; 3587 initackm_out->sh.checksum = 0; /* calculate later */ 3588 /* who are we */ 3589 strncpy(stc.identification, SCTP_VERSION_STRING, 3590 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification))); 3591 /* now the chunk header */ 3592 initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK; 3593 initackm_out->msg.ch.chunk_flags = 0; 3594 /* fill in later from mbuf we build */ 3595 initackm_out->msg.ch.chunk_length = 0; 3596 /* place in my tag */ 3597 if ((asoc != NULL) && 3598 ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 3599 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) { 3600 /* re-use the v-tags and init-seq here */ 3601 initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag); 3602 initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number); 3603 } else { 3604 initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp)); 3605 /* get a TSN to use too */ 3606 initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep)); 3607 } 3608 /* save away my tag to */ 3609 stc.my_vtag = initackm_out->msg.init.initiate_tag; 3610 3611 /* set up some of the credits. */ 3612 initackm_out->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.sb_hiwat, SCTP_MINIMAL_RWND)); 3613 /* set what I want */ 3614 his_limit = ntohs(init_chk->init.num_inbound_streams); 3615 /* choose what I want */ 3616 if (asoc != NULL) { 3617 if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) { 3618 i_want = asoc->streamoutcnt; 3619 } else { 3620 i_want = inp->sctp_ep.pre_open_stream_count; 3621 } 3622 } else { 3623 i_want = inp->sctp_ep.pre_open_stream_count; 3624 } 3625 if (his_limit < i_want) { 3626 /* I Want more :< */ 3627 initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams; 3628 } else { 3629 /* I can have what I want :> */ 3630 initackm_out->msg.init.num_outbound_streams = htons(i_want); 3631 } 3632 /* tell him his limt. */ 3633 initackm_out->msg.init.num_inbound_streams = 3634 htons(inp->sctp_ep.max_open_streams_intome); 3635 /* setup the ECN pointer */ 3636 3637 /* if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/ 3638 if (inp->sctp_ep.adaption_layer_indicator) { 3639 struct sctp_adaption_layer_indication *ali; 3640 ali = (struct sctp_adaption_layer_indication *)( 3641 (vaddr_t)initackm_out + sizeof(*initackm_out)); 3642 ali->ph.param_type = htons(SCTP_ULP_ADAPTION); 3643 ali->ph.param_length = htons(sizeof(*ali)); 3644 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator); 3645 m->m_len += sizeof(*ali); 3646 ecn = (struct sctp_ecn_supported_param *)((vaddr_t)ali + 3647 sizeof(*ali)); 3648 } else { 3649 ecn = (struct sctp_ecn_supported_param*)( 3650 (vaddr_t)initackm_out + sizeof(*initackm_out)); 3651 } 3652 3653 /* ECN parameter */ 3654 if (sctp_ecn == 1) { 3655 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE); 3656 ecn->ph.param_length = htons(sizeof(*ecn)); 3657 m->m_len += sizeof(*ecn); 3658 3659 prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn + 3660 sizeof(*ecn)); 3661 } else { 3662 prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn); 3663 } 3664 /* And now tell the peer we do pr-sctp */ 3665 prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED); 3666 prsctp->ph.param_length = htons(sizeof(*prsctp)); 3667 m->m_len += sizeof(*prsctp); 3668 3669 3670 /* And now tell the peer we do all the extensions */ 3671 pr_supported = (struct sctp_supported_chunk_types_param *)((vaddr_t)prsctp + 3672 sizeof(*prsctp)); 3673 3674 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT); 3675 pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT); 3676 pr_supported->chunk_types[0] = SCTP_ASCONF; 3677 pr_supported->chunk_types[1] = SCTP_ASCONF_ACK; 3678 pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN; 3679 pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED; 3680 pr_supported->chunk_types[4] = SCTP_STREAM_RESET; 3681 pr_supported->chunk_types[5] = 0; /* pad */ 3682 pr_supported->chunk_types[6] = 0; /* pad */ 3683 pr_supported->chunk_types[7] = 0; /* pad */ 3684 3685 m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT); 3686 if (sctp_ecn_nonce) { 3687 /* ECN nonce: And now tell the peer we support ECN nonce */ 3688 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((vaddr_t)pr_supported + 3689 sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT); 3690 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED); 3691 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce)); 3692 m->m_len += sizeof(*ecn_nonce); 3693 } 3694 3695 m_at = m; 3696 /* now the addresses */ 3697 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3698 struct ifnet *ifn; 3699 struct ifaddr *ifa; 3700 int cnt = cnt_inits_to; 3701 int s; 3702 3703 s = pserialize_read_enter(); 3704 IFNET_READER_FOREACH(ifn) { 3705 if ((stc.loopback_scope == 0) && 3706 (ifn->if_type == IFT_LOOP)) { 3707 /* 3708 * Skip loopback devices if loopback_scope 3709 * not set 3710 */ 3711 continue; 3712 } 3713 IFADDR_READER_FOREACH(ifa, ifn) { 3714 if (sctp_is_address_in_scope(ifa, 3715 stc.ipv4_addr_legal, stc.ipv6_addr_legal, 3716 stc.loopback_scope, stc.ipv4_scope, 3717 stc.local_scope, stc.site_scope) == 0) { 3718 continue; 3719 } 3720 cnt++; 3721 } 3722 } 3723 pserialize_read_exit(s); 3724 3725 if (cnt > 1) { 3726 s = pserialize_read_enter(); 3727 IFNET_READER_FOREACH(ifn) { 3728 if ((stc.loopback_scope == 0) && 3729 (ifn->if_type == IFT_LOOP)) { 3730 /* 3731 * Skip loopback devices if 3732 * loopback_scope not set 3733 */ 3734 continue; 3735 } 3736 IFADDR_READER_FOREACH(ifa, ifn) { 3737 if (sctp_is_address_in_scope(ifa, 3738 stc.ipv4_addr_legal, 3739 stc.ipv6_addr_legal, 3740 stc.loopback_scope, stc.ipv4_scope, 3741 stc.local_scope, stc.site_scope) == 0) { 3742 continue; 3743 } 3744 m_at = sctp_add_addr_to_mbuf(m_at, ifa); 3745 } 3746 } 3747 pserialize_read_exit(s); 3748 } 3749 } else { 3750 struct sctp_laddr *laddr; 3751 int cnt; 3752 cnt = cnt_inits_to; 3753 /* First, how many ? */ 3754 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3755 if (laddr->ifa == NULL) { 3756 continue; 3757 } 3758 if (laddr->ifa->ifa_addr == NULL) 3759 continue; 3760 if (sctp_is_address_in_scope(laddr->ifa, 3761 stc.ipv4_addr_legal, stc.ipv6_addr_legal, 3762 stc.loopback_scope, stc.ipv4_scope, 3763 stc.local_scope, stc.site_scope) == 0) { 3764 continue; 3765 } 3766 cnt++; 3767 } 3768 /* If we bind a single address only we won't list 3769 * any. This way you can get through a NAT 3770 */ 3771 if (cnt > 1) { 3772 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3773 if (laddr->ifa == NULL) { 3774 #ifdef SCTP_DEBUG 3775 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 3776 printf("Help I have fallen and I can't get up!\n"); 3777 } 3778 #endif 3779 continue; 3780 } 3781 if (laddr->ifa->ifa_addr == NULL) 3782 continue; 3783 if (sctp_is_address_in_scope(laddr->ifa, 3784 stc.ipv4_addr_legal, stc.ipv6_addr_legal, 3785 stc.loopback_scope, stc.ipv4_scope, 3786 stc.local_scope, stc.site_scope) == 0) { 3787 continue; 3788 } 3789 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa); 3790 } 3791 } 3792 } 3793 3794 /* tack on the operational error if present */ 3795 if (op_err) { 3796 if (op_err->m_pkthdr.len % 4) { 3797 /* must add a pad to the param */ 3798 u_int32_t cpthis=0; 3799 int padlen; 3800 padlen = 4 - (op_err->m_pkthdr.len % 4); 3801 m_copyback(op_err, op_err->m_pkthdr.len, padlen, (void *)&cpthis); 3802 } 3803 while (m_at->m_next != NULL) { 3804 m_at = m_at->m_next; 3805 } 3806 m_at->m_next = op_err; 3807 while (m_at->m_next != NULL) { 3808 m_at = m_at->m_next; 3809 } 3810 } 3811 /* Get total size of init packet */ 3812 sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length)); 3813 /* pre-calulate the size and update pkt header and chunk header */ 3814 m->m_pkthdr.len = 0; 3815 for (m_tmp = m; m_tmp; m_tmp = m_tmp->m_next) { 3816 m->m_pkthdr.len += m_tmp->m_len; 3817 if (m_tmp->m_next == NULL) { 3818 /* m_tmp should now point to last one */ 3819 break; 3820 } 3821 } 3822 /* 3823 * Figure now the size of the cookie. We know the size of the 3824 * INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK, 3825 * COOKIE-STRUCTURE and SIGNATURE. 3826 */ 3827 3828 /* 3829 * take our earlier INIT calc and add in the sz we just calculated 3830 * minus the size of the sctphdr (its not included in chunk size 3831 */ 3832 3833 /* add once for the INIT-ACK */ 3834 sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr)); 3835 3836 /* add a second time for the INIT-ACK in the cookie */ 3837 sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr)); 3838 3839 /* Now add the cookie header and cookie message struct */ 3840 sz_of += sizeof(struct sctp_state_cookie_param); 3841 /* ...and add the size of our signature */ 3842 sz_of += SCTP_SIGNATURE_SIZE; 3843 initackm_out->msg.ch.chunk_length = htons(sz_of); 3844 3845 /* Now we must build a cookie */ 3846 m_cookie = sctp_add_cookie(inp, init_pkt, offset, m, 3847 sizeof(struct sctphdr), &stc); 3848 if (m_cookie == NULL) { 3849 /* memory problem */ 3850 sctp_m_freem(m); 3851 return; 3852 } 3853 /* Now append the cookie to the end and update the space/size */ 3854 m_tmp->m_next = m_cookie; 3855 3856 /* 3857 * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the 3858 * return here since the timer will drive a retranmission. 3859 */ 3860 padval = m->m_pkthdr.len % 4; 3861 if ((padval) && (m_last)) { 3862 /* see my previous comments on m_last */ 3863 int ret; 3864 ret = sctp_add_pad_tombuf(m_last, (4-padval)); 3865 if (ret) { 3866 /* Houston we have a problem, no space */ 3867 sctp_m_freem(m); 3868 return; 3869 } 3870 m->m_pkthdr.len += padval; 3871 } 3872 sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, 0, NULL, 0); 3873 } 3874 3875 3876 static void 3877 sctp_insert_on_wheel(struct sctp_association *asoc, 3878 struct sctp_stream_out *strq) 3879 { 3880 struct sctp_stream_out *stre, *strn; 3881 stre = TAILQ_FIRST(&asoc->out_wheel); 3882 if (stre == NULL) { 3883 /* only one on wheel */ 3884 TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke); 3885 return; 3886 } 3887 for (; stre; stre = strn) { 3888 strn = TAILQ_NEXT(stre, next_spoke); 3889 if (stre->stream_no > strq->stream_no) { 3890 TAILQ_INSERT_BEFORE(stre, strq, next_spoke); 3891 return; 3892 } else if (stre->stream_no == strq->stream_no) { 3893 /* huh, should not happen */ 3894 return; 3895 } else if (strn == NULL) { 3896 /* next one is null */ 3897 TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq, 3898 next_spoke); 3899 } 3900 } 3901 } 3902 3903 static void 3904 sctp_remove_from_wheel(struct sctp_association *asoc, 3905 struct sctp_stream_out *strq) 3906 { 3907 /* take off and then setup so we know it is not on the wheel */ 3908 TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke); 3909 strq->next_spoke.tqe_next = NULL; 3910 strq->next_spoke.tqe_prev = NULL; 3911 } 3912 3913 3914 static void 3915 sctp_prune_prsctp(struct sctp_tcb *stcb, 3916 struct sctp_association *asoc, 3917 struct sctp_sndrcvinfo *srcv, 3918 int dataout 3919 ) 3920 { 3921 int freed_spc=0; 3922 struct sctp_tmit_chunk *chk, *nchk; 3923 if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) { 3924 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 3925 /* 3926 * Look for chunks marked with the PR_SCTP 3927 * flag AND the buffer space flag. If the one 3928 * being sent is equal or greater priority then 3929 * purge the old one and free some space. 3930 */ 3931 if ((chk->flags & (SCTP_PR_SCTP_ENABLED | 3932 SCTP_PR_SCTP_BUFFER)) == 3933 (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) { 3934 /* 3935 * This one is PR-SCTP AND buffer space 3936 * limited type 3937 */ 3938 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 3939 /* Lower numbers equates to 3940 * higher priority so if the 3941 * one we are looking at has a 3942 * larger or equal priority we 3943 * want to drop the data and 3944 * NOT retransmit it. 3945 */ 3946 if (chk->data) { 3947 /* We release the 3948 * book_size if the 3949 * mbuf is here 3950 */ 3951 int ret_spc; 3952 int cause; 3953 if (chk->sent > SCTP_DATAGRAM_UNSENT) 3954 cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT; 3955 else 3956 cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT; 3957 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 3958 cause, 3959 &asoc->sent_queue); 3960 freed_spc += ret_spc; 3961 if (freed_spc >= dataout) { 3962 return; 3963 } 3964 } /* if chunk was present */ 3965 } /* if of sufficent priority */ 3966 } /* if chunk has enabled */ 3967 } /* tailqforeach */ 3968 3969 chk = TAILQ_FIRST(&asoc->send_queue); 3970 while (chk) { 3971 nchk = TAILQ_NEXT(chk, sctp_next); 3972 /* Here we must move to the sent queue and mark */ 3973 if ((chk->flags & (SCTP_PR_SCTP_ENABLED | 3974 SCTP_PR_SCTP_BUFFER)) == 3975 (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) { 3976 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) { 3977 if (chk->data) { 3978 /* We release the 3979 * book_size if the 3980 * mbuf is here 3981 */ 3982 int ret_spc; 3983 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk, 3984 SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT, 3985 &asoc->send_queue); 3986 3987 freed_spc += ret_spc; 3988 if (freed_spc >= dataout) { 3989 return; 3990 } 3991 } /* end if chk->data */ 3992 } /* end if right class */ 3993 } /* end if chk pr-sctp */ 3994 chk = nchk; 3995 } /* end while (chk) */ 3996 } /* if enabled in asoc */ 3997 } 3998 3999 static void 4000 sctp_prepare_chunk(struct sctp_tmit_chunk *template, 4001 struct sctp_tcb *stcb, 4002 struct sctp_sndrcvinfo *srcv, 4003 struct sctp_stream_out *strq, 4004 struct sctp_nets *net) 4005 { 4006 memset(template, 0, sizeof(struct sctp_tmit_chunk)); 4007 template->sent = SCTP_DATAGRAM_UNSENT; 4008 if ((stcb->asoc.peer_supports_prsctp) && 4009 (srcv->sinfo_flags & (MSG_PR_SCTP_TTL|MSG_PR_SCTP_BUF)) && 4010 (srcv->sinfo_timetolive > 0) 4011 ) { 4012 /* If: 4013 * Peer supports PR-SCTP 4014 * The flags is set against this send for PR-SCTP 4015 * And timetolive is a postive value, zero is reserved 4016 * to mean a reliable send for both buffer/time 4017 * related one. 4018 */ 4019 if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) { 4020 /* 4021 * Time to live is a priority stored in tv_sec 4022 * when doing the buffer drop thing. 4023 */ 4024 template->rec.data.timetodrop.tv_sec = srcv->sinfo_timetolive; 4025 } else { 4026 struct timeval tv; 4027 4028 SCTP_GETTIME_TIMEVAL(&template->rec.data.timetodrop); 4029 tv.tv_sec = srcv->sinfo_timetolive / 1000; 4030 tv.tv_usec = (srcv->sinfo_timetolive * 1000) % 1000000; 4031 #ifndef __FreeBSD__ 4032 timeradd(&template->rec.data.timetodrop, &tv, 4033 &template->rec.data.timetodrop); 4034 #else 4035 timevaladd(&template->rec.data.timetodrop, &tv); 4036 #endif 4037 } 4038 } 4039 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) { 4040 template->rec.data.stream_seq = strq->next_sequence_sent; 4041 } else { 4042 template->rec.data.stream_seq = 0; 4043 } 4044 template->rec.data.TSN_seq = 0; /* not yet assigned */ 4045 4046 template->rec.data.stream_number = srcv->sinfo_stream; 4047 template->rec.data.payloadtype = srcv->sinfo_ppid; 4048 template->rec.data.context = srcv->sinfo_context; 4049 template->rec.data.doing_fast_retransmit = 0; 4050 template->rec.data.ect_nonce = 0; /* ECN Nonce */ 4051 4052 if (srcv->sinfo_flags & MSG_ADDR_OVER) { 4053 template->whoTo = net; 4054 } else { 4055 if (stcb->asoc.primary_destination) 4056 template->whoTo = stcb->asoc.primary_destination; 4057 else { 4058 /* TSNH */ 4059 template->whoTo = net; 4060 } 4061 } 4062 /* the actual chunk flags */ 4063 if (srcv->sinfo_flags & MSG_UNORDERED) { 4064 template->rec.data.rcv_flags = SCTP_DATA_UNORDERED; 4065 } else { 4066 template->rec.data.rcv_flags = 0; 4067 } 4068 /* no flags yet, FRAGMENT_OK goes here */ 4069 template->flags = 0; 4070 /* PR sctp flags */ 4071 if (stcb->asoc.peer_supports_prsctp) { 4072 if (srcv->sinfo_timetolive > 0) { 4073 /* 4074 * We only set the flag if timetolive (or 4075 * priority) was set to a positive number. 4076 * Zero is reserved specifically to be 4077 * EXCLUDED and sent reliable. 4078 */ 4079 if (srcv->sinfo_flags & MSG_PR_SCTP_TTL) { 4080 template->flags |= SCTP_PR_SCTP_ENABLED; 4081 } 4082 if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) { 4083 template->flags |= SCTP_PR_SCTP_BUFFER; 4084 } 4085 } 4086 } 4087 template->asoc = &stcb->asoc; 4088 } 4089 4090 4091 int 4092 sctp_get_frag_point(struct sctp_tcb *stcb, 4093 struct sctp_association *asoc) 4094 { 4095 int siz, ovh; 4096 4097 /* For endpoints that have both 6 and 4 addresses 4098 * we must reserver room for the 6 ip header, for 4099 * those that are only dealing with V4 we use 4100 * a larger frag point. 4101 */ 4102 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 4103 ovh = SCTP_MED_OVERHEAD; 4104 } else { 4105 ovh = SCTP_MED_V4_OVERHEAD; 4106 } 4107 4108 if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu) 4109 siz = asoc->smallest_mtu - ovh; 4110 else 4111 siz = (stcb->sctp_ep->sctp_frag_point - ovh); 4112 /* 4113 if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { */ 4114 /* A data chunk MUST fit in a cluster */ 4115 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk));*/ 4116 /* }*/ 4117 4118 if (siz % 4) { 4119 /* make it an even word boundary please */ 4120 siz -= (siz % 4); 4121 } 4122 return (siz); 4123 } 4124 extern unsigned int sctp_max_chunks_on_queue; 4125 4126 #define SBLOCKWAIT(f) (((f)&MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK) 4127 4128 static int 4129 sctp_msg_append(struct sctp_tcb *stcb, 4130 struct sctp_nets *net, 4131 struct mbuf *m, 4132 struct sctp_sndrcvinfo *srcv, 4133 int flags) 4134 { 4135 struct socket *so; 4136 struct sctp_association *asoc; 4137 struct sctp_stream_out *strq; 4138 struct sctp_tmit_chunk *chk; 4139 struct sctpchunk_listhead tmp; 4140 struct sctp_tmit_chunk template; 4141 struct mbuf *n, *mnext; 4142 struct mbuf *mm; 4143 unsigned int dataout, siz; 4144 int mbcnt = 0; 4145 int mbcnt_e = 0; 4146 int error = 0; 4147 4148 if ((stcb == NULL) || (net == NULL) || (m == NULL) || (srcv == NULL)) { 4149 /* Software fault, you blew it on the call */ 4150 #ifdef SCTP_DEBUG 4151 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 4152 printf("software error in sctp_msg_append:1\n"); 4153 printf("stcb:%p net:%p m:%p srcv:%p\n", 4154 stcb, net, m, srcv); 4155 } 4156 #endif 4157 if (m) 4158 sctp_m_freem(m); 4159 return (EFAULT); 4160 } 4161 so = stcb->sctp_socket; 4162 asoc = &stcb->asoc; 4163 if (srcv->sinfo_flags & MSG_ABORT) { 4164 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) && 4165 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) { 4166 /* It has to be up before we abort */ 4167 /* how big is the user initiated abort? */ 4168 if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) { 4169 dataout = m->m_pkthdr.len; 4170 } else { 4171 /* we must count */ 4172 dataout = 0; 4173 for (n = m; n; n = n->m_next) { 4174 dataout += n->m_len; 4175 } 4176 } 4177 M_PREPEND(m, sizeof(struct sctp_paramhdr), M_DONTWAIT); 4178 if (m) { 4179 struct sctp_paramhdr *ph; 4180 m->m_len = sizeof(struct sctp_paramhdr) + dataout; 4181 ph = mtod(m, struct sctp_paramhdr *); 4182 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 4183 ph->param_length = htons(m->m_len); 4184 } 4185 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, m); 4186 m = NULL; 4187 } else { 4188 /* Only free if we don't send an abort */ 4189 ; 4190 } 4191 goto out; 4192 } 4193 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 4194 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 4195 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 4196 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 4197 /* got data while shutting down */ 4198 error = ECONNRESET; 4199 goto out; 4200 } 4201 4202 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 4203 /* Invalid stream number */ 4204 error = EINVAL; 4205 goto out; 4206 } 4207 if (asoc->strmout == NULL) { 4208 /* huh? software error */ 4209 #ifdef SCTP_DEBUG 4210 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 4211 printf("software error in sctp_msg_append:2\n"); 4212 } 4213 #endif 4214 error = EFAULT; 4215 goto out; 4216 } 4217 strq = &asoc->strmout[srcv->sinfo_stream]; 4218 /* how big is it ? */ 4219 if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) { 4220 dataout = m->m_pkthdr.len; 4221 } else { 4222 /* we must count */ 4223 dataout = 0; 4224 for (n = m; n; n = n->m_next) { 4225 dataout += n->m_len; 4226 } 4227 } 4228 #ifdef SCTP_DEBUG 4229 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 4230 printf("Attempt to send out %d bytes\n", 4231 dataout); 4232 } 4233 #endif 4234 4235 /* lock the socket buf */ 4236 error = sblock(&so->so_snd, SBLOCKWAIT(flags)); 4237 if (error) 4238 goto out_locked; 4239 4240 if (dataout > so->so_snd.sb_hiwat) { 4241 /* It will NEVER fit */ 4242 error = EMSGSIZE; 4243 goto release; 4244 } 4245 if ((srcv->sinfo_flags & MSG_EOF) && 4246 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) && 4247 (dataout == 0) 4248 ) { 4249 goto zap_by_it_all; 4250 } 4251 if ((so->so_snd.sb_hiwat < 4252 (dataout + asoc->total_output_queue_size)) || 4253 (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) || 4254 (asoc->total_output_mbuf_queue_size > 4255 so->so_snd.sb_mbmax) 4256 ) { 4257 /* XXX Buffer space hunt for data to skip */ 4258 if (asoc->peer_supports_prsctp) { 4259 sctp_prune_prsctp(stcb, asoc, srcv, dataout); 4260 } 4261 while ((so->so_snd.sb_hiwat < 4262 (dataout + asoc->total_output_queue_size)) || 4263 (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) || 4264 (asoc->total_output_mbuf_queue_size > 4265 so->so_snd.sb_mbmax)) { 4266 struct sctp_inpcb *inp; 4267 /* Now did we free up enough room? */ 4268 if (so->so_state & SS_NBIO) { 4269 /* Non-blocking io in place */ 4270 error = EWOULDBLOCK; 4271 goto release; 4272 } 4273 /* 4274 * We store off a pointer to the endpoint. 4275 * Since on return from this we must check to 4276 * see if an so_error is set. If so we may have 4277 * been reset and our stcb destroyed. Returning 4278 * an error will cause the correct error return 4279 * through and fix this all. 4280 */ 4281 inp = stcb->sctp_ep; 4282 /* 4283 * Not sure how else to do this since 4284 * the level we suspended at is not 4285 * known deep down where we are. I will 4286 * drop to spl0() so that others can 4287 * get in. 4288 */ 4289 4290 inp->sctp_tcb_at_block = (void *)stcb; 4291 inp->error_on_block = 0; 4292 sbunlock(&so->so_snd); 4293 error = sbwait(&so->so_snd); 4294 /* 4295 * XXX: This is ugly but I have 4296 * recreated most of what goes on to 4297 * block in the sb. UGHH 4298 * May want to add the bit about being 4299 * no longer connected.. but this then 4300 * further dooms the UDP model NOT to 4301 * allow this. 4302 */ 4303 inp->sctp_tcb_at_block = 0; 4304 if (inp->error_on_block) 4305 error = inp->error_on_block; 4306 if (so->so_error) 4307 error = so->so_error; 4308 if (error) { 4309 goto out_locked; 4310 } 4311 error = sblock(&so->so_snd, M_WAITOK); 4312 if (error) 4313 goto out_locked; 4314 /* Otherwise we cycle back and recheck 4315 * the space 4316 */ 4317 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115 4318 if (so->so_rcv.sb_state & SBS_CANTSENDMORE) { 4319 #else 4320 if (so->so_state & SS_CANTSENDMORE) { 4321 #endif 4322 error = EPIPE; 4323 goto release; 4324 } 4325 if (so->so_error) { 4326 error = so->so_error; 4327 goto release; 4328 } 4329 } 4330 } 4331 /* If we have a packet header fix it if it was broke */ 4332 if (m->m_flags & M_PKTHDR) { 4333 m->m_pkthdr.len = dataout; 4334 } 4335 /* use the smallest one, user set value or 4336 * smallest mtu of the asoc 4337 */ 4338 siz = sctp_get_frag_point(stcb, asoc); 4339 if ((dataout) && (dataout <= siz)) { 4340 /* Fast path */ 4341 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 4342 if (chk == NULL) { 4343 error = ENOMEM; 4344 goto release; 4345 } 4346 sctp_prepare_chunk(chk, stcb, srcv, strq, net); 4347 chk->whoTo->ref_count++; 4348 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG; 4349 4350 /* no flags yet, FRAGMENT_OK goes here */ 4351 sctppcbinfo.ipi_count_chunk++; 4352 sctppcbinfo.ipi_gencnt_chunk++; 4353 asoc->chunks_on_out_queue++; 4354 chk->data = m; 4355 m = NULL; 4356 /* Total in the MSIZE */ 4357 for (mm = chk->data; mm; mm = mm->m_next) { 4358 mbcnt += MSIZE; 4359 if (mm->m_flags & M_EXT) { 4360 mbcnt += chk->data->m_ext.ext_size; 4361 } 4362 } 4363 /* fix up the send_size if it is not present */ 4364 chk->send_size = dataout; 4365 chk->book_size = chk->send_size; 4366 chk->mbcnt = mbcnt; 4367 /* ok, we are commited */ 4368 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) { 4369 /* bump the ssn if we are unordered. */ 4370 strq->next_sequence_sent++; 4371 } 4372 chk->data->m_nextpkt = 0; 4373 asoc->stream_queue_cnt++; 4374 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next); 4375 /* now check if this stream is on the wheel */ 4376 if ((strq->next_spoke.tqe_next == NULL) && 4377 (strq->next_spoke.tqe_prev == NULL)) { 4378 /* Insert it on the wheel since it is not 4379 * on it currently 4380 */ 4381 sctp_insert_on_wheel(asoc, strq); 4382 } 4383 } else if ((dataout) && (dataout > siz)) { 4384 /* Slow path */ 4385 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NO_FRAGMENT) && 4386 (dataout > siz)) { 4387 error = EMSGSIZE; 4388 goto release; 4389 } 4390 /* setup the template */ 4391 sctp_prepare_chunk(&template, stcb, srcv, strq, net); 4392 4393 n = m; 4394 while (dataout > siz) { 4395 /* 4396 * We can wait since this is called from the user 4397 * send side 4398 */ 4399 n->m_nextpkt = m_split(n, siz, M_WAIT); 4400 if (n->m_nextpkt == NULL) { 4401 error = EFAULT; 4402 goto release; 4403 } 4404 dataout -= siz; 4405 n = n->m_nextpkt; 4406 } 4407 /* 4408 * ok, now we have a chain on m where m->m_nextpkt points to 4409 * the next chunk and m/m->m_next chain is the piece to send. 4410 * We must go through the chains and thread them on to 4411 * sctp_tmit_chunk chains and place them all on the stream 4412 * queue, breaking the m->m_nextpkt pointers as we go. 4413 */ 4414 n = m; 4415 TAILQ_INIT(&tmp); 4416 while (n) { 4417 /* 4418 * first go through and allocate a sctp_tmit chunk 4419 * for each chunk piece 4420 */ 4421 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 4422 if (chk == NULL) { 4423 /* 4424 * ok we must spin through and dump anything 4425 * we have allocated and then jump to the 4426 * no_membad 4427 */ 4428 chk = TAILQ_FIRST(&tmp); 4429 while (chk) { 4430 TAILQ_REMOVE(&tmp, chk, sctp_next); 4431 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4432 sctppcbinfo.ipi_count_chunk--; 4433 asoc->chunks_on_out_queue--; 4434 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4435 panic("Chunk count is negative"); 4436 } 4437 sctppcbinfo.ipi_gencnt_chunk++; 4438 chk = TAILQ_FIRST(&tmp); 4439 } 4440 error = ENOMEM; 4441 goto release; 4442 } 4443 sctppcbinfo.ipi_count_chunk++; 4444 asoc->chunks_on_out_queue++; 4445 4446 sctppcbinfo.ipi_gencnt_chunk++; 4447 *chk = template; 4448 chk->whoTo->ref_count++; 4449 chk->data = n; 4450 /* Total in the MSIZE */ 4451 mbcnt_e = 0; 4452 for (mm = chk->data; mm; mm = mm->m_next) { 4453 mbcnt_e += MSIZE; 4454 if (mm->m_flags & M_EXT) { 4455 mbcnt_e += chk->data->m_ext.ext_size; 4456 } 4457 } 4458 /* now fix the chk->send_size */ 4459 if (chk->data->m_flags & M_PKTHDR) { 4460 chk->send_size = chk->data->m_pkthdr.len; 4461 } else { 4462 struct mbuf *nn; 4463 chk->send_size = 0; 4464 for (nn = chk->data; nn; nn = nn->m_next) { 4465 chk->send_size += nn->m_len; 4466 } 4467 } 4468 chk->book_size = chk->send_size; 4469 chk->mbcnt = mbcnt_e; 4470 mbcnt += mbcnt_e; 4471 if (chk->flags & SCTP_PR_SCTP_BUFFER) { 4472 asoc->sent_queue_cnt_removeable++; 4473 } 4474 n = n->m_nextpkt; 4475 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next); 4476 } 4477 m = NULL; 4478 /* now that we have enough space for all de-couple the 4479 * chain of mbufs by going through our temp array 4480 * and breaking the pointers. 4481 */ 4482 /* ok, we are commited */ 4483 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) { 4484 /* bump the ssn if we are unordered. */ 4485 strq->next_sequence_sent++; 4486 } 4487 /* Mark the first/last flags. This will 4488 * result int a 3 for a single item on the list 4489 */ 4490 chk = TAILQ_FIRST(&tmp); 4491 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG; 4492 chk = TAILQ_LAST(&tmp, sctpchunk_listhead); 4493 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG; 4494 /* now break any chains on the queue and 4495 * move it to the streams actual queue. 4496 */ 4497 chk = TAILQ_FIRST(&tmp); 4498 while (chk) { 4499 chk->data->m_nextpkt = 0; 4500 TAILQ_REMOVE(&tmp, chk, sctp_next); 4501 asoc->stream_queue_cnt++; 4502 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next); 4503 chk = TAILQ_FIRST(&tmp); 4504 } 4505 /* now check if this stream is on the wheel */ 4506 if ((strq->next_spoke.tqe_next == NULL) && 4507 (strq->next_spoke.tqe_prev == NULL)) { 4508 /* Insert it on the wheel since it is not 4509 * on it currently 4510 */ 4511 sctp_insert_on_wheel(asoc, strq); 4512 } 4513 } 4514 /* has a SHUTDOWN been (also) requested by the user on this asoc? */ 4515 zap_by_it_all: 4516 4517 if ((srcv->sinfo_flags & MSG_EOF) && 4518 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) { 4519 4520 int some_on_streamwheel = 0; 4521 4522 if (!TAILQ_EMPTY(&asoc->out_wheel)) { 4523 /* Check to see if some data queued */ 4524 struct sctp_stream_out *outs; 4525 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 4526 if (!TAILQ_EMPTY(&outs->outqueue)) { 4527 some_on_streamwheel = 1; 4528 break; 4529 } 4530 } 4531 } 4532 4533 if (TAILQ_EMPTY(&asoc->send_queue) && 4534 TAILQ_EMPTY(&asoc->sent_queue) && 4535 (some_on_streamwheel == 0)) { 4536 /* there is nothing queued to send, so I'm done... */ 4537 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 4538 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 4539 /* only send SHUTDOWN the first time through */ 4540 #ifdef SCTP_DEBUG 4541 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 4542 printf("%s:%d sends a shutdown\n", 4543 __FILE__, 4544 __LINE__ 4545 ); 4546 } 4547 #endif 4548 sctp_send_shutdown(stcb, stcb->asoc.primary_destination); 4549 asoc->state = SCTP_STATE_SHUTDOWN_SENT; 4550 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 4551 asoc->primary_destination); 4552 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 4553 asoc->primary_destination); 4554 } 4555 } else { 4556 /* 4557 * we still got (or just got) data to send, so set 4558 * SHUTDOWN_PENDING 4559 */ 4560 /* 4561 * XXX sockets draft says that MSG_EOF should be sent 4562 * with no data. currently, we will allow user data 4563 * to be sent first and move to SHUTDOWN-PENDING 4564 */ 4565 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 4566 } 4567 } 4568 #ifdef SCTP_MBCNT_LOGGING 4569 sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE, 4570 asoc->total_output_queue_size, 4571 dataout, 4572 asoc->total_output_mbuf_queue_size, 4573 mbcnt); 4574 #endif 4575 asoc->total_output_queue_size += dataout; 4576 asoc->total_output_mbuf_queue_size += mbcnt; 4577 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 4578 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 4579 so->so_snd.sb_cc += dataout; 4580 so->so_snd.sb_mbcnt += mbcnt; 4581 } 4582 4583 #ifdef SCTP_DEBUG 4584 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 4585 printf("++total out:%d total_mbuf_out:%d\n", 4586 (int)asoc->total_output_queue_size, 4587 (int)asoc->total_output_mbuf_queue_size); 4588 } 4589 #endif 4590 4591 release: 4592 sbunlock(&so->so_snd); 4593 out_locked: 4594 4595 out: 4596 if (m && m->m_nextpkt) { 4597 n = m; 4598 while (n) { 4599 mnext = n->m_nextpkt; 4600 n->m_nextpkt = NULL; 4601 sctp_m_freem(n); 4602 n = mnext; 4603 } 4604 } else if (m) 4605 sctp_m_freem(m); 4606 4607 return (error); 4608 } 4609 4610 static struct mbuf * 4611 sctp_copy_mbufchain(struct mbuf *clonechain, 4612 struct mbuf *outchain) 4613 { 4614 struct mbuf *appendchain; 4615 #if defined(__FreeBSD__) || defined(__NetBSD__) 4616 /* Supposedly m_copypacket is an optimization, use it if we can */ 4617 if (clonechain->m_flags & M_PKTHDR) { 4618 appendchain = m_copypacket(clonechain, M_DONTWAIT); 4619 sctp_pegs[SCTP_CACHED_SRC]++; 4620 } else 4621 appendchain = m_copy(clonechain, 0, M_COPYALL); 4622 #elif defined(__APPLE__) 4623 appendchain = sctp_m_copym(clonechain, 0, M_COPYALL, M_DONTWAIT); 4624 #else 4625 appendchain = m_copy(clonechain, 0, M_COPYALL); 4626 #endif 4627 4628 if (appendchain == NULL) { 4629 /* error */ 4630 if (outchain) 4631 sctp_m_freem(outchain); 4632 return (NULL); 4633 } 4634 if (outchain) { 4635 /* tack on to the end */ 4636 struct mbuf *m; 4637 m = outchain; 4638 while (m) { 4639 if (m->m_next == NULL) { 4640 m->m_next = appendchain; 4641 break; 4642 } 4643 m = m->m_next; 4644 } 4645 if (outchain->m_flags & M_PKTHDR) { 4646 int append_tot; 4647 struct mbuf *t; 4648 t = appendchain; 4649 append_tot = 0; 4650 while (t) { 4651 append_tot += t->m_len; 4652 t = t->m_next; 4653 } 4654 outchain->m_pkthdr.len += append_tot; 4655 } 4656 return (outchain); 4657 } else { 4658 return (appendchain); 4659 } 4660 } 4661 4662 static void 4663 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, u_int32_t val) 4664 { 4665 struct sctp_copy_all *ca; 4666 struct mbuf *m; 4667 int turned_on_nonblock=0, ret; 4668 4669 ca = (struct sctp_copy_all *)ptr; 4670 if (ca->m == NULL) { 4671 return; 4672 } 4673 if (ca->inp != inp) { 4674 /* TSNH */ 4675 return; 4676 } 4677 m = sctp_copy_mbufchain(ca->m, NULL); 4678 if (m == NULL) { 4679 /* can't copy so we are done */ 4680 ca->cnt_failed++; 4681 return; 4682 } 4683 if ((stcb->sctp_socket->so_state & SS_NBIO) == 0) { 4684 /* we have to do this non-blocking */ 4685 turned_on_nonblock = 1; 4686 stcb->sctp_socket->so_state |= SS_NBIO; 4687 } 4688 ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m, &ca->sndrcv, 0); 4689 if (turned_on_nonblock) { 4690 /* we turned on non-blocking so turn it off */ 4691 stcb->sctp_socket->so_state &= ~SS_NBIO; 4692 } 4693 if (ret) { 4694 ca->cnt_failed++; 4695 } else { 4696 ca->cnt_sent++; 4697 } 4698 } 4699 4700 static void 4701 sctp_sendall_completes(void *ptr, u_int32_t val) 4702 { 4703 struct sctp_copy_all *ca; 4704 ca = (struct sctp_copy_all *)ptr; 4705 /* Do a notify here? 4706 * Kacheong suggests that the notify 4707 * be done at the send time.. so you would 4708 * push up a notification if any send failed. 4709 * Don't know if this is feasable since the 4710 * only failures we have is "memory" related and 4711 * if you cannot get an mbuf to send the data 4712 * you surely can't get an mbuf to send up 4713 * to notify the user you can't send the data :-> 4714 */ 4715 4716 /* now free everything */ 4717 m_freem(ca->m); 4718 free(ca, M_PCB); 4719 } 4720 4721 4722 #define MC_ALIGN(m, len) do { \ 4723 (m)->m_data += (MCLBYTES - (len)) & ~(sizeof(long) - 1); \ 4724 } while (0) 4725 4726 4727 4728 static struct mbuf * 4729 sctp_copy_out_all(struct uio *uio, int len) 4730 { 4731 struct mbuf *ret, *at; 4732 int left, willcpy, cancpy, error; 4733 4734 MGETHDR(ret, M_WAIT, MT_HEADER); 4735 if (ret == NULL) { 4736 /* TSNH */ 4737 return (NULL); 4738 } 4739 left = len; 4740 ret->m_len = 0; 4741 ret->m_pkthdr.len = len; 4742 MCLGET(ret, M_WAIT); 4743 if (ret == NULL) { 4744 return (NULL); 4745 } 4746 if ((ret->m_flags & M_EXT) == 0) { 4747 m_freem (ret); 4748 return (NULL); 4749 } 4750 cancpy = M_TRAILINGSPACE(ret); 4751 willcpy = min(cancpy, left); 4752 at = ret; 4753 while (left > 0) { 4754 /* Align data to the end */ 4755 MC_ALIGN(at, willcpy); 4756 error = uiomove(mtod(at, void *), willcpy, uio); 4757 if (error) { 4758 err_out_now: 4759 m_freem(ret); 4760 return (NULL); 4761 } 4762 at->m_len = willcpy; 4763 at->m_nextpkt = at->m_next = 0; 4764 left -= willcpy; 4765 if (left > 0) { 4766 MGET(at->m_next, M_WAIT, MT_DATA); 4767 if (at->m_next == NULL) { 4768 goto err_out_now; 4769 } 4770 at = at->m_next; 4771 at->m_len = 0; 4772 MCLGET(at, M_WAIT); 4773 if (at == NULL) { 4774 goto err_out_now; 4775 } 4776 if ((at->m_flags & M_EXT) == 0) { 4777 goto err_out_now; 4778 } 4779 cancpy = M_TRAILINGSPACE(at); 4780 willcpy = min(cancpy, left); 4781 } 4782 } 4783 return (ret); 4784 } 4785 4786 static int 4787 sctp_sendall (struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, struct sctp_sndrcvinfo *srcv) 4788 { 4789 int ret; 4790 struct sctp_copy_all *ca; 4791 ca = malloc(sizeof(struct sctp_copy_all), M_PCB, M_WAIT); 4792 if (ca == NULL) { 4793 m_freem(m); 4794 return (ENOMEM); 4795 } 4796 memset (ca, 0, sizeof(struct sctp_copy_all)); 4797 4798 ca->inp = inp; 4799 ca->sndrcv = *srcv; 4800 /* take off the sendall flag, it would 4801 * be bad if we failed to do this :-0 4802 */ 4803 ca->sndrcv.sinfo_flags &= ~MSG_SENDALL; 4804 4805 /* get length and mbuf chain */ 4806 if (uio) { 4807 ca->sndlen = uio->uio_resid; 4808 ca->m = sctp_copy_out_all(uio, ca->sndlen); 4809 if (ca->m == NULL) { 4810 free(ca, M_PCB); 4811 return (ENOMEM); 4812 } 4813 } else { 4814 if ((m->m_flags & M_PKTHDR) == 0) { 4815 ca->sndlen = 0; 4816 while(m) { 4817 ca->sndlen += m->m_len; 4818 m = m->m_next; 4819 } 4820 } else { 4821 ca->sndlen = m->m_pkthdr.len; 4822 } 4823 ca->m = m; 4824 } 4825 4826 ret = sctp_initiate_iterator(sctp_sendall_iterator, SCTP_PCB_ANY_FLAGS, SCTP_ASOC_ANY_STATE, 4827 (void *)ca, 0, sctp_sendall_completes, inp); 4828 if (ret) { 4829 #ifdef SCTP_DEBUG 4830 printf("Failed to initate iterator to takeover associations\n"); 4831 #endif 4832 free(ca, M_PCB); 4833 return (EFAULT); 4834 4835 } 4836 return (0); 4837 } 4838 4839 4840 void 4841 sctp_toss_old_cookies(struct sctp_association *asoc) 4842 { 4843 struct sctp_tmit_chunk *chk, *nchk; 4844 chk = TAILQ_FIRST(&asoc->control_send_queue); 4845 while (chk) { 4846 nchk = TAILQ_NEXT(chk, sctp_next); 4847 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) { 4848 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 4849 if (chk->data) { 4850 sctp_m_freem(chk->data); 4851 chk->data = NULL; 4852 } 4853 asoc->ctrl_queue_cnt--; 4854 if (chk->whoTo) 4855 sctp_free_remote_addr(chk->whoTo); 4856 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4857 sctppcbinfo.ipi_count_chunk--; 4858 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4859 panic("Chunk count is negative"); 4860 } 4861 sctppcbinfo.ipi_gencnt_chunk++; 4862 } 4863 chk = nchk; 4864 } 4865 } 4866 4867 void 4868 sctp_toss_old_asconf(struct sctp_tcb *stcb) 4869 { 4870 struct sctp_association *asoc; 4871 struct sctp_tmit_chunk *chk, *chk_tmp; 4872 4873 asoc = &stcb->asoc; 4874 for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL; 4875 chk = chk_tmp) { 4876 /* get next chk */ 4877 chk_tmp = TAILQ_NEXT(chk, sctp_next); 4878 /* find SCTP_ASCONF chunk in queue (only one ever in queue) */ 4879 if (chk->rec.chunk_id == SCTP_ASCONF) { 4880 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 4881 if (chk->data) { 4882 sctp_m_freem(chk->data); 4883 chk->data = NULL; 4884 } 4885 asoc->ctrl_queue_cnt--; 4886 if (chk->whoTo) 4887 sctp_free_remote_addr(chk->whoTo); 4888 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4889 sctppcbinfo.ipi_count_chunk--; 4890 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4891 panic("Chunk count is negative"); 4892 } 4893 sctppcbinfo.ipi_gencnt_chunk++; 4894 } 4895 } 4896 } 4897 4898 4899 static void 4900 sctp_clean_up_datalist(struct sctp_tcb *stcb, 4901 struct sctp_association *asoc, 4902 struct sctp_tmit_chunk **data_list, 4903 int bundle_at, 4904 struct sctp_nets *net) 4905 { 4906 int i; 4907 for (i = 0; i < bundle_at; i++) { 4908 /* off of the send queue */ 4909 if (i) { 4910 /* Any chunk NOT 0 you zap the time 4911 * chunk 0 gets zapped or set based on 4912 * if a RTO measurment is needed. 4913 */ 4914 data_list[i]->do_rtt = 0; 4915 } 4916 /* record time */ 4917 data_list[i]->sent_rcv_time = net->last_sent_time; 4918 TAILQ_REMOVE(&asoc->send_queue, 4919 data_list[i], 4920 sctp_next); 4921 /* on to the sent queue */ 4922 TAILQ_INSERT_TAIL(&asoc->sent_queue, 4923 data_list[i], 4924 sctp_next); 4925 /* This does not lower until the cum-ack passes it */ 4926 asoc->sent_queue_cnt++; 4927 asoc->send_queue_cnt--; 4928 if ((asoc->peers_rwnd <= 0) && 4929 (asoc->total_flight == 0) && 4930 (bundle_at == 1)) { 4931 /* Mark the chunk as being a window probe */ 4932 #ifdef SCTP_DEBUG 4933 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 4934 printf("WINDOW PROBE SET\n"); 4935 } 4936 #endif 4937 sctp_pegs[SCTP_WINDOW_PROBES]++; 4938 data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE; 4939 } else { 4940 data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE; 4941 } 4942 #ifdef SCTP_AUDITING_ENABLED 4943 sctp_audit_log(0xC2, 3); 4944 #endif 4945 data_list[i]->sent = SCTP_DATAGRAM_SENT; 4946 data_list[i]->snd_count = 1; 4947 net->flight_size += data_list[i]->book_size; 4948 asoc->total_flight += data_list[i]->book_size; 4949 asoc->total_flight_count++; 4950 #ifdef SCTP_LOG_RWND 4951 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 4952 asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh); 4953 #endif 4954 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 4955 (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh)); 4956 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 4957 /* SWS sender side engages */ 4958 asoc->peers_rwnd = 0; 4959 } 4960 } 4961 } 4962 4963 static void 4964 sctp_clean_up_ctl(struct sctp_association *asoc) 4965 { 4966 struct sctp_tmit_chunk *chk, *nchk; 4967 for (chk = TAILQ_FIRST(&asoc->control_send_queue); 4968 chk; chk = nchk) { 4969 nchk = TAILQ_NEXT(chk, sctp_next); 4970 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) || 4971 (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) || 4972 (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) || 4973 (chk->rec.chunk_id == SCTP_SHUTDOWN) || 4974 (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) || 4975 (chk->rec.chunk_id == SCTP_OPERATION_ERROR) || 4976 (chk->rec.chunk_id == SCTP_PACKET_DROPPED) || 4977 (chk->rec.chunk_id == SCTP_COOKIE_ACK) || 4978 (chk->rec.chunk_id == SCTP_ECN_CWR) || 4979 (chk->rec.chunk_id == SCTP_ASCONF_ACK)) { 4980 /* Stray chunks must be cleaned up */ 4981 clean_up_anyway: 4982 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 4983 if (chk->data) { 4984 sctp_m_freem(chk->data); 4985 chk->data = NULL; 4986 } 4987 asoc->ctrl_queue_cnt--; 4988 sctp_free_remote_addr(chk->whoTo); 4989 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4990 sctppcbinfo.ipi_count_chunk--; 4991 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4992 panic("Chunk count is negative"); 4993 } 4994 sctppcbinfo.ipi_gencnt_chunk++; 4995 } else if (chk->rec.chunk_id == SCTP_STREAM_RESET) { 4996 struct sctp_stream_reset_req *strreq; 4997 /* special handling, we must look into the param */ 4998 strreq = mtod(chk->data, struct sctp_stream_reset_req *); 4999 if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) { 5000 goto clean_up_anyway; 5001 } 5002 } 5003 } 5004 } 5005 5006 static int 5007 sctp_move_to_outqueue(struct sctp_tcb *stcb, 5008 struct sctp_stream_out *strq) 5009 { 5010 /* Move from the stream to the send_queue keeping track of the total */ 5011 struct sctp_association *asoc; 5012 int tot_moved = 0; 5013 int failed = 0; 5014 int padval; 5015 struct sctp_tmit_chunk *chk, *nchk; 5016 struct sctp_data_chunk *dchkh; 5017 struct sctpchunk_listhead tmp; 5018 struct mbuf *orig; 5019 5020 asoc = &stcb->asoc; 5021 TAILQ_INIT(&tmp); 5022 chk = TAILQ_FIRST(&strq->outqueue); 5023 while (chk) { 5024 nchk = TAILQ_NEXT(chk, sctp_next); 5025 /* now put in the chunk header */ 5026 orig = chk->data; 5027 M_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_DONTWAIT); 5028 if (chk->data == NULL) { 5029 /* HELP */ 5030 failed++; 5031 break; 5032 } 5033 if (orig != chk->data) { 5034 /* A new mbuf was added, account for it */ 5035 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 5036 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 5037 stcb->sctp_socket->so_snd.sb_mbcnt += MSIZE; 5038 } 5039 #ifdef SCTP_MBCNT_LOGGING 5040 sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE, 5041 asoc->total_output_queue_size, 5042 0, 5043 asoc->total_output_mbuf_queue_size, 5044 MSIZE); 5045 #endif 5046 stcb->asoc.total_output_mbuf_queue_size += MSIZE; 5047 chk->mbcnt += MSIZE; 5048 } 5049 chk->send_size += sizeof(struct sctp_data_chunk); 5050 /* This should NOT have to do anything, but 5051 * I would rather be cautious 5052 */ 5053 if (!failed && ((size_t)chk->data->m_len < sizeof(struct sctp_data_chunk))) { 5054 m_pullup(chk->data, sizeof(struct sctp_data_chunk)); 5055 if (chk->data == NULL) { 5056 failed++; 5057 break; 5058 } 5059 } 5060 dchkh = mtod(chk->data, struct sctp_data_chunk *); 5061 dchkh->ch.chunk_length = htons(chk->send_size); 5062 /* Chunks must be padded to even word boundary */ 5063 padval = chk->send_size % 4; 5064 if (padval) { 5065 /* For fragmented messages this should not 5066 * run except possibly on the last chunk 5067 */ 5068 if (sctp_pad_lastmbuf(chk->data, (4 - padval))) { 5069 /* we are in big big trouble no mbufs :< */ 5070 failed++; 5071 break; 5072 } 5073 chk->send_size += (4 - padval); 5074 } 5075 /* pull from stream queue */ 5076 TAILQ_REMOVE(&strq->outqueue, chk, sctp_next); 5077 asoc->stream_queue_cnt--; 5078 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next); 5079 /* add it in to the size of moved chunks */ 5080 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 5081 /* we pull only one message */ 5082 break; 5083 } 5084 chk = nchk; 5085 } 5086 if (failed) { 5087 /* Gak, we just lost the user message */ 5088 chk = TAILQ_FIRST(&tmp); 5089 while (chk) { 5090 nchk = TAILQ_NEXT(chk, sctp_next); 5091 TAILQ_REMOVE(&tmp, chk, sctp_next); 5092 5093 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, 5094 (SCTP_NOTIFY_DATAGRAM_UNSENT|SCTP_INTERNAL_ERROR), 5095 chk); 5096 5097 if (chk->data) { 5098 sctp_m_freem(chk->data); 5099 chk->data = NULL; 5100 } 5101 if (chk->whoTo) { 5102 sctp_free_remote_addr(chk->whoTo); 5103 chk->whoTo = NULL; 5104 } 5105 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 5106 sctppcbinfo.ipi_count_chunk--; 5107 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 5108 panic("Chunk count is negative"); 5109 } 5110 sctppcbinfo.ipi_gencnt_chunk++; 5111 chk = nchk; 5112 } 5113 return (0); 5114 } 5115 /* now pull them off of temp wheel */ 5116 chk = TAILQ_FIRST(&tmp); 5117 while (chk) { 5118 nchk = TAILQ_NEXT(chk, sctp_next); 5119 /* insert on send_queue */ 5120 TAILQ_REMOVE(&tmp, chk, sctp_next); 5121 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next); 5122 asoc->send_queue_cnt++; 5123 /* assign TSN */ 5124 chk->rec.data.TSN_seq = asoc->sending_seq++; 5125 5126 dchkh = mtod(chk->data, struct sctp_data_chunk *); 5127 /* Put the rest of the things in place now. Size 5128 * was done earlier in previous loop prior to 5129 * padding. 5130 */ 5131 dchkh->ch.chunk_type = SCTP_DATA; 5132 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags; 5133 dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq); 5134 dchkh->dp.stream_id = htons(strq->stream_no); 5135 dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq); 5136 dchkh->dp.protocol_id = chk->rec.data.payloadtype; 5137 /* total count moved */ 5138 tot_moved += chk->send_size; 5139 chk = nchk; 5140 } 5141 return (tot_moved); 5142 } 5143 5144 static void 5145 sctp_fill_outqueue(struct sctp_tcb *stcb, 5146 struct sctp_nets *net) 5147 { 5148 struct sctp_association *asoc; 5149 struct sctp_tmit_chunk *chk; 5150 struct sctp_stream_out *strq, *strqn; 5151 int mtu_fromwheel, goal_mtu; 5152 unsigned int moved, seenend, cnt_mvd=0; 5153 5154 asoc = &stcb->asoc; 5155 /* Attempt to move at least 1 MTU's worth 5156 * onto the wheel for each destination address 5157 */ 5158 goal_mtu = net->cwnd - net->flight_size; 5159 if ((unsigned int)goal_mtu < net->mtu) { 5160 goal_mtu = net->mtu; 5161 } 5162 if (sctp_pegs[SCTP_MOVED_MTU] < (unsigned int)goal_mtu) { 5163 sctp_pegs[SCTP_MOVED_MTU] = goal_mtu; 5164 } 5165 seenend = moved = mtu_fromwheel = 0; 5166 if (asoc->last_out_stream == NULL) { 5167 strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel); 5168 if (asoc->last_out_stream == NULL) { 5169 /* huh nothing on the wheel, TSNH */ 5170 return; 5171 } 5172 goto done_it; 5173 } 5174 strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke); 5175 done_it: 5176 if (strq == NULL) { 5177 asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel); 5178 } 5179 while (mtu_fromwheel < goal_mtu) { 5180 if (strq == NULL) { 5181 if (seenend == 0) { 5182 seenend = 1; 5183 strq = TAILQ_FIRST(&asoc->out_wheel); 5184 } else if ((moved == 0) && (seenend)) { 5185 /* none left on the wheel */ 5186 sctp_pegs[SCTP_MOVED_NLEF]++; 5187 return; 5188 } else if (moved) { 5189 /* 5190 * clear the flags and rotate back through 5191 * again 5192 */ 5193 moved = 0; 5194 seenend = 0; 5195 strq = TAILQ_FIRST(&asoc->out_wheel); 5196 } 5197 if (strq == NULL) 5198 break; 5199 continue; 5200 } 5201 strqn = TAILQ_NEXT(strq, next_spoke); 5202 if ((chk = TAILQ_FIRST(&strq->outqueue)) == NULL) { 5203 /* none left on this queue, prune a spoke? */ 5204 sctp_remove_from_wheel(asoc, strq); 5205 if (strq == asoc->last_out_stream) { 5206 /* the last one we used went off the wheel */ 5207 asoc->last_out_stream = NULL; 5208 } 5209 strq = strqn; 5210 continue; 5211 } 5212 if (chk->whoTo != net) { 5213 /* Skip this stream, first one on stream 5214 * does not head to our current destination. 5215 */ 5216 strq = strqn; 5217 continue; 5218 } 5219 mtu_fromwheel += sctp_move_to_outqueue(stcb, strq); 5220 cnt_mvd++; 5221 moved++; 5222 asoc->last_out_stream = strq; 5223 strq = strqn; 5224 } 5225 sctp_pegs[SCTP_MOVED_MAX]++; 5226 #ifdef SCTP_DEBUG 5227 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5228 printf("Ok we moved %d chunks to send queue\n", 5229 moved); 5230 } 5231 #endif 5232 if (sctp_pegs[SCTP_MOVED_QMAX] < cnt_mvd) { 5233 sctp_pegs[SCTP_MOVED_QMAX] = cnt_mvd; 5234 } 5235 } 5236 5237 void 5238 sctp_fix_ecn_echo(struct sctp_association *asoc) 5239 { 5240 struct sctp_tmit_chunk *chk; 5241 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 5242 if (chk->rec.chunk_id == SCTP_ECN_ECHO) { 5243 chk->sent = SCTP_DATAGRAM_UNSENT; 5244 } 5245 } 5246 } 5247 5248 static void 5249 sctp_move_to_an_alt(struct sctp_tcb *stcb, 5250 struct sctp_association *asoc, 5251 struct sctp_nets *net) 5252 { 5253 struct sctp_tmit_chunk *chk; 5254 struct sctp_nets *a_net; 5255 a_net = sctp_find_alternate_net(stcb, net); 5256 if ((a_net != net) && 5257 ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) { 5258 /* 5259 * We only proceed if a valid alternate is found that is 5260 * not this one and is reachable. Here we must move all 5261 * chunks queued in the send queue off of the destination 5262 * address to our alternate. 5263 */ 5264 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 5265 if (chk->whoTo == net) { 5266 /* Move the chunk to our alternate */ 5267 sctp_free_remote_addr(chk->whoTo); 5268 chk->whoTo = a_net; 5269 a_net->ref_count++; 5270 } 5271 } 5272 } 5273 } 5274 5275 static int sctp_from_user_send=0; 5276 5277 static int 5278 sctp_med_chunk_output(struct sctp_inpcb *inp, 5279 struct sctp_tcb *stcb, 5280 struct sctp_association *asoc, 5281 int *num_out, 5282 int *reason_code, 5283 int control_only, int *cwnd_full, int from_where, 5284 struct timeval *now, int *now_filled) 5285 { 5286 /* 5287 * Ok this is the generic chunk service queue. 5288 * we must do the following: 5289 * - Service the stream queue that is next, moving any message 5290 * (note I must get a complete message i.e. FIRST/MIDDLE and 5291 * LAST to the out queue in one pass) and assigning TSN's 5292 * - Check to see if the cwnd/rwnd allows any output, if so we 5293 * go ahead and fomulate and send the low level chunks. Making 5294 * sure to combine any control in the control chunk queue also. 5295 */ 5296 struct sctp_nets *net; 5297 struct mbuf *outchain; 5298 struct sctp_tmit_chunk *chk, *nchk; 5299 struct sctphdr *shdr; 5300 /* temp arrays for unlinking */ 5301 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 5302 int no_fragmentflg, error; 5303 int one_chunk, hbflag; 5304 int asconf, cookie, no_out_cnt; 5305 int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind; 5306 unsigned int mtu, r_mtu, omtu; 5307 *num_out = 0; 5308 cwnd_full_ind = 0; 5309 ctl_cnt = no_out_cnt = asconf = cookie = 0; 5310 /* 5311 * First lets prime the pump. For each destination, if there 5312 * is room in the flight size, attempt to pull an MTU's worth 5313 * out of the stream queues into the general send_queue 5314 */ 5315 #ifdef SCTP_AUDITING_ENABLED 5316 sctp_audit_log(0xC2, 2); 5317 #endif 5318 #ifdef SCTP_DEBUG 5319 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5320 printf("***********************\n"); 5321 } 5322 #endif 5323 hbflag = 0; 5324 if (control_only) 5325 no_data_chunks = 1; 5326 else 5327 no_data_chunks = 0; 5328 5329 /* Nothing to possible to send? */ 5330 if (TAILQ_EMPTY(&asoc->control_send_queue) && 5331 TAILQ_EMPTY(&asoc->send_queue) && 5332 TAILQ_EMPTY(&asoc->out_wheel)) { 5333 #ifdef SCTP_DEBUG 5334 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5335 printf("All wheels empty\n"); 5336 } 5337 #endif 5338 return (0); 5339 } 5340 if (asoc->peers_rwnd <= 0) { 5341 /* No room in peers rwnd */ 5342 *cwnd_full = 1; 5343 *reason_code = 1; 5344 if (asoc->total_flight > 0) { 5345 /* we are allowed one chunk in flight */ 5346 no_data_chunks = 1; 5347 sctp_pegs[SCTP_RWND_BLOCKED]++; 5348 } 5349 } 5350 #ifdef SCTP_DEBUG 5351 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5352 printf("Ok we have done the fillup no_data_chunk=%d tf=%d prw:%d\n", 5353 (int)no_data_chunks, 5354 (int)asoc->total_flight, (int)asoc->peers_rwnd); 5355 } 5356 #endif 5357 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5358 #ifdef SCTP_DEBUG 5359 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5360 printf("net:%p fs:%d cwnd:%d\n", 5361 net, net->flight_size, net->cwnd); 5362 } 5363 #endif 5364 if (net->flight_size >= net->cwnd) { 5365 /* skip this network, no room */ 5366 cwnd_full_ind++; 5367 #ifdef SCTP_DEBUG 5368 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5369 printf("Ok skip fillup->fs:%d > cwnd:%d\n", 5370 net->flight_size, 5371 net->cwnd); 5372 } 5373 #endif 5374 sctp_pegs[SCTP_CWND_NOFILL]++; 5375 continue; 5376 } 5377 /* 5378 * spin through the stream queues moving one message and 5379 * assign TSN's as appropriate. 5380 */ 5381 sctp_fill_outqueue(stcb, net); 5382 } 5383 *cwnd_full = cwnd_full_ind; 5384 /* now service each destination and send out what we can for it */ 5385 #ifdef SCTP_DEBUG 5386 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5387 int chk_cnt = 0; 5388 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) { 5389 chk_cnt++; 5390 } 5391 printf("We have %d chunks on the send_queue\n", chk_cnt); 5392 chk_cnt = 0; 5393 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 5394 chk_cnt++; 5395 } 5396 printf("We have %d chunks on the sent_queue\n", chk_cnt); 5397 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 5398 chk_cnt++; 5399 } 5400 printf("We have %d chunks on the control_queue\n", chk_cnt); 5401 } 5402 #endif 5403 /* If we have data to send, and DSACK is running, stop it 5404 * and build a SACK to dump on to bundle with output. This 5405 * actually MAY make it so the bundling does not occur if 5406 * the SACK is big but I think this is ok because basic SACK 5407 * space is pre-reserved in our fragmentation size choice. 5408 */ 5409 if ((TAILQ_FIRST(&asoc->send_queue) != NULL) && 5410 (no_data_chunks == 0)) { 5411 /* We will be sending something */ 5412 if (callout_pending(&stcb->asoc.dack_timer.timer)) { 5413 /* Yep a callout is pending */ 5414 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 5415 stcb->sctp_ep, 5416 stcb, NULL); 5417 sctp_send_sack(stcb); 5418 } 5419 } 5420 /* Nothing to send? */ 5421 if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) && 5422 (TAILQ_FIRST(&asoc->send_queue) == NULL)) { 5423 return (0); 5424 } 5425 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 5426 struct rtentry *rt; 5427 /* how much can we send? */ 5428 if (net->ref_count < 2) { 5429 /* Ref-count of 1 so we cannot have data or control 5430 * queued to this address. Skip it. 5431 */ 5432 continue; 5433 } 5434 ctl_cnt = bundle_at = 0; 5435 outchain = NULL; 5436 no_fragmentflg = 1; 5437 one_chunk = 0; 5438 5439 rt = rtcache_validate(&net->ro); 5440 if (rt != NULL) { 5441 /* if we have a route and an ifp 5442 * check to see if we have room to 5443 * send to this guy 5444 */ 5445 struct ifnet *ifp; 5446 ifp = net->ro._ro_rt->rt_ifp; 5447 if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) { 5448 sctp_pegs[SCTP_IFP_QUEUE_FULL]++; 5449 #ifdef SCTP_LOG_MAXBURST 5450 sctp_log_maxburst(net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED); 5451 #endif 5452 rtcache_unref(rt, &net->ro); 5453 continue; 5454 } 5455 rtcache_unref(rt, &net->ro); 5456 } 5457 if (((struct sockaddr *)&net->ro.ro_sa)->sa_family == AF_INET) { 5458 mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr)); 5459 } else { 5460 mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)); 5461 } 5462 if (mtu > asoc->peers_rwnd) { 5463 if (asoc->total_flight > 0) { 5464 /* We have a packet in flight somewhere */ 5465 r_mtu = asoc->peers_rwnd; 5466 } else { 5467 /* We are always allowed to send one MTU out */ 5468 one_chunk = 1; 5469 r_mtu = mtu; 5470 } 5471 } else { 5472 r_mtu = mtu; 5473 } 5474 #ifdef SCTP_DEBUG 5475 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5476 printf("Ok r_mtu is %d mtu is %d for this net:%p one_chunk:%d\n", 5477 r_mtu, mtu, net, one_chunk); 5478 } 5479 #endif 5480 /************************/ 5481 /* Control transmission */ 5482 /************************/ 5483 /* Now first lets go through the control queue */ 5484 for (chk = TAILQ_FIRST(&asoc->control_send_queue); 5485 chk; chk = nchk) { 5486 nchk = TAILQ_NEXT(chk, sctp_next); 5487 if (chk->whoTo != net) { 5488 /* 5489 * No, not sent to the network we are 5490 * looking at 5491 */ 5492 continue; 5493 } 5494 if (chk->data == NULL) { 5495 continue; 5496 } 5497 if ((chk->data->m_flags & M_PKTHDR) == 0) { 5498 /* 5499 * NOTE: the chk queue MUST have the PKTHDR 5500 * flag set on it with a total in the 5501 * m_pkthdr.len field!! else the chunk will 5502 * ALWAYS be skipped 5503 */ 5504 continue; 5505 } 5506 if (chk->sent != SCTP_DATAGRAM_UNSENT) { 5507 /* 5508 * It must be unsent. Cookies and ASCONF's 5509 * hang around but there timers will force 5510 * when marked for resend. 5511 */ 5512 continue; 5513 } 5514 /* Here we do NOT factor the r_mtu */ 5515 if ((chk->data->m_pkthdr.len < (int)mtu) || 5516 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 5517 /* 5518 * We probably should glom the mbuf chain from 5519 * the chk->data for control but the problem 5520 * is it becomes yet one more level of 5521 * tracking to do if for some reason output 5522 * fails. Then I have got to reconstruct the 5523 * merged control chain.. el yucko.. for now 5524 * we take the easy way and do the copy 5525 */ 5526 outchain = sctp_copy_mbufchain(chk->data, 5527 outchain); 5528 if (outchain == NULL) { 5529 return (ENOMEM); 5530 } 5531 /* update our MTU size */ 5532 if (mtu > chk->data->m_pkthdr.len) 5533 mtu -= chk->data->m_pkthdr.len; 5534 else 5535 mtu = 0; 5536 /* Do clear IP_DF ? */ 5537 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 5538 no_fragmentflg = 0; 5539 } 5540 /* Mark things to be removed, if needed */ 5541 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) || 5542 (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) || 5543 (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) || 5544 (chk->rec.chunk_id == SCTP_SHUTDOWN) || 5545 (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) || 5546 (chk->rec.chunk_id == SCTP_OPERATION_ERROR) || 5547 (chk->rec.chunk_id == SCTP_COOKIE_ACK) || 5548 (chk->rec.chunk_id == SCTP_ECN_CWR) || 5549 (chk->rec.chunk_id == SCTP_PACKET_DROPPED) || 5550 (chk->rec.chunk_id == SCTP_ASCONF_ACK)) { 5551 5552 if (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) 5553 hbflag = 1; 5554 /* remove these chunks at the end */ 5555 if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) { 5556 /* turn off the timer */ 5557 if (callout_pending(&stcb->asoc.dack_timer.timer)) { 5558 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 5559 inp, stcb, net); 5560 } 5561 } 5562 ctl_cnt++; 5563 } else { 5564 /* 5565 * Other chunks, since they have 5566 * timers running (i.e. COOKIE or 5567 * ASCONF) we just "trust" that it 5568 * gets sent or retransmitted. 5569 */ 5570 ctl_cnt++; 5571 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) { 5572 cookie = 1; 5573 no_out_cnt = 1; 5574 } else if (chk->rec.chunk_id == SCTP_ASCONF) { 5575 /* 5576 * set hb flag since we can use 5577 * these for RTO 5578 */ 5579 hbflag = 1; 5580 asconf = 1; 5581 } 5582 chk->sent = SCTP_DATAGRAM_SENT; 5583 chk->snd_count++; 5584 } 5585 if (mtu == 0) { 5586 /* 5587 * Ok we are out of room but we can 5588 * output without effecting the flight 5589 * size since this little guy is a 5590 * control only packet. 5591 */ 5592 if (asconf) { 5593 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 5594 asconf = 0; 5595 } 5596 if (cookie) { 5597 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 5598 cookie = 0; 5599 } 5600 if (outchain->m_len == 0) { 5601 /* 5602 * Special case for when you 5603 * get a 0 len mbuf at the 5604 * head due to the lack of a 5605 * MHDR at the beginning. 5606 */ 5607 outchain->m_len = sizeof(struct sctphdr); 5608 } else { 5609 M_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT); 5610 if (outchain == NULL) { 5611 /* no memory */ 5612 error = ENOBUFS; 5613 goto error_out_again; 5614 } 5615 } 5616 shdr = mtod(outchain, struct sctphdr *); 5617 shdr->src_port = inp->sctp_lport; 5618 shdr->dest_port = stcb->rport; 5619 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 5620 shdr->checksum = 0; 5621 5622 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 5623 rtcache_getdst(&net->ro), 5624 outchain, 5625 no_fragmentflg, 0, NULL, asconf))) { 5626 if (error == ENOBUFS) { 5627 asoc->ifp_had_enobuf = 1; 5628 } 5629 sctp_pegs[SCTP_DATA_OUT_ERR]++; 5630 if (from_where == 0) { 5631 sctp_pegs[SCTP_ERROUT_FRM_USR]++; 5632 } 5633 error_out_again: 5634 #ifdef SCTP_DEBUG 5635 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 5636 printf("Gak got ctrl error %d\n", error); 5637 } 5638 #endif 5639 /* error, could not output */ 5640 if (hbflag) { 5641 #ifdef SCTP_DEBUG 5642 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5643 printf("Update HB anyway\n"); 5644 } 5645 #endif 5646 if (*now_filled == 0) { 5647 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 5648 *now_filled = 1; 5649 *now = net->last_sent_time; 5650 } else { 5651 net->last_sent_time = *now; 5652 } 5653 hbflag = 0; 5654 } 5655 if (error == EHOSTUNREACH) { 5656 /* 5657 * Destination went 5658 * unreachable during 5659 * this send 5660 */ 5661 #ifdef SCTP_DEBUG 5662 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5663 printf("Moving data to an alterante\n"); 5664 } 5665 #endif 5666 sctp_move_to_an_alt(stcb, asoc, net); 5667 } 5668 sctp_clean_up_ctl (asoc); 5669 return (error); 5670 } else 5671 asoc->ifp_had_enobuf = 0; 5672 /* Only HB or ASCONF advances time */ 5673 if (hbflag) { 5674 if (*now_filled == 0) { 5675 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 5676 *now_filled = 1; 5677 *now = net->last_sent_time; 5678 } else { 5679 net->last_sent_time = *now; 5680 } 5681 hbflag = 0; 5682 } 5683 /* 5684 * increase the number we sent, if a 5685 * cookie is sent we don't tell them 5686 * any was sent out. 5687 */ 5688 if (!no_out_cnt) 5689 *num_out += ctl_cnt; 5690 /* recalc a clean slate and setup */ 5691 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 5692 mtu = (net->mtu - SCTP_MIN_OVERHEAD); 5693 } else { 5694 mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD); 5695 } 5696 no_fragmentflg = 1; 5697 } 5698 } 5699 } 5700 /*********************/ 5701 /* Data transmission */ 5702 /*********************/ 5703 /* now lets add any data within the MTU constraints */ 5704 if (((struct sockaddr *)&net->ro.ro_sa)->sa_family == AF_INET) { 5705 omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr)); 5706 } else { 5707 omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)); 5708 } 5709 5710 #ifdef SCTP_DEBUG 5711 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5712 printf("Now to data transmission\n"); 5713 } 5714 #endif 5715 5716 if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) || 5717 (cookie)) { 5718 for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) { 5719 if (no_data_chunks) { 5720 /* let only control go out */ 5721 #ifdef SCTP_DEBUG 5722 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5723 printf("Either nothing to send or we are full\n"); 5724 } 5725 #endif 5726 break; 5727 } 5728 if (net->flight_size >= net->cwnd) { 5729 /* skip this net, no room for data */ 5730 #ifdef SCTP_DEBUG 5731 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5732 printf("fs:%d > cwnd:%d\n", 5733 net->flight_size, net->cwnd); 5734 } 5735 #endif 5736 sctp_pegs[SCTP_CWND_BLOCKED]++; 5737 *reason_code = 2; 5738 break; 5739 } 5740 nchk = TAILQ_NEXT(chk, sctp_next); 5741 if (chk->whoTo != net) { 5742 /* No, not sent to this net */ 5743 #ifdef SCTP_DEBUG 5744 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5745 printf("chk->whoTo:%p not %p\n", 5746 chk->whoTo, net); 5747 5748 } 5749 #endif 5750 continue; 5751 } 5752 #ifdef SCTP_DEBUG 5753 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5754 printf("Can we pick up a chunk?\n"); 5755 } 5756 #endif 5757 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) { 5758 /* strange, we have a chunk that is to bit 5759 * for its destination and yet no fragment ok flag. 5760 * Something went wrong when the PMTU changed...we did 5761 * not mark this chunk for some reason?? I will 5762 * fix it here by letting IP fragment it for now and 5763 * printing a warning. This really should not happen ... 5764 */ 5765 /*#ifdef SCTP_DEBUG*/ 5766 printf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n", 5767 chk->send_size, mtu); 5768 /*#endif*/ 5769 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; 5770 } 5771 5772 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) || 5773 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) { 5774 /* ok we will add this one */ 5775 #ifdef SCTP_DEBUG 5776 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5777 printf("Picking up the chunk\n"); 5778 } 5779 #endif 5780 outchain = sctp_copy_mbufchain(chk->data, outchain); 5781 if (outchain == NULL) { 5782 #ifdef SCTP_DEBUG 5783 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5784 printf("Gakk no memory\n"); 5785 } 5786 #endif 5787 if (!callout_pending(&net->rxt_timer.timer)) { 5788 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 5789 } 5790 return (ENOMEM); 5791 } 5792 /* upate our MTU size */ 5793 /* Do clear IP_DF ? */ 5794 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 5795 no_fragmentflg = 0; 5796 } 5797 mtu -= chk->send_size; 5798 r_mtu -= chk->send_size; 5799 data_list[bundle_at++] = chk; 5800 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 5801 mtu = 0; 5802 break; 5803 } 5804 if (mtu <= 0) { 5805 mtu = 0; 5806 break; 5807 } 5808 if ((r_mtu <= 0) || one_chunk) { 5809 r_mtu = 0; 5810 break; 5811 } 5812 } else { 5813 /* 5814 * Must be sent in order of the TSN's 5815 * (on a network) 5816 */ 5817 #ifdef SCTP_DEBUG 5818 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5819 printf("ok no more chk:%d > mtu:%d || < r_mtu:%d\n", 5820 chk->send_size, mtu, r_mtu); 5821 } 5822 #endif 5823 5824 break; 5825 } 5826 }/* for () */ 5827 } /* if asoc.state OPEN */ 5828 /* Is there something to send for this destination? */ 5829 #ifdef SCTP_DEBUG 5830 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5831 printf("ok now is chain assembled? %p\n", 5832 outchain); 5833 } 5834 #endif 5835 5836 if (outchain) { 5837 /* We may need to start a control timer or two */ 5838 if (asconf) { 5839 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net); 5840 asconf = 0; 5841 } 5842 if (cookie) { 5843 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net); 5844 cookie = 0; 5845 } 5846 /* must start a send timer if data is being sent */ 5847 if (bundle_at && (!callout_pending(&net->rxt_timer.timer))) { 5848 /* no timer running on this destination 5849 * restart it. 5850 */ 5851 #ifdef SCTP_DEBUG 5852 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5853 printf("ok lets start a send timer .. we will transmit %p\n", 5854 outchain); 5855 } 5856 #endif 5857 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 5858 } 5859 /* Now send it, if there is anything to send :> */ 5860 if ((outchain->m_flags & M_PKTHDR) == 0) { 5861 struct mbuf *t; 5862 5863 MGETHDR(t, M_DONTWAIT, MT_HEADER); 5864 if (t == NULL) { 5865 sctp_m_freem(outchain); 5866 return (ENOMEM); 5867 } 5868 t->m_next = outchain; 5869 t->m_pkthdr.len = 0; 5870 m_reset_rcvif(t); 5871 t->m_len = 0; 5872 5873 outchain = t; 5874 while (t) { 5875 outchain->m_pkthdr.len += t->m_len; 5876 t = t->m_next; 5877 } 5878 } 5879 if (outchain->m_len == 0) { 5880 /* Special case for when you get a 0 len 5881 * mbuf at the head due to the lack 5882 * of a MHDR at the beginning. 5883 */ 5884 MH_ALIGN(outchain, sizeof(struct sctphdr)); 5885 outchain->m_len = sizeof(struct sctphdr); 5886 } else { 5887 M_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT); 5888 if (outchain == NULL) { 5889 /* out of mbufs */ 5890 error = ENOBUFS; 5891 goto errored_send; 5892 } 5893 } 5894 shdr = mtod(outchain, struct sctphdr *); 5895 shdr->src_port = inp->sctp_lport; 5896 shdr->dest_port = stcb->rport; 5897 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 5898 shdr->checksum = 0; 5899 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 5900 rtcache_getdst(&net->ro), 5901 outchain, 5902 no_fragmentflg, bundle_at, data_list[0], asconf))) { 5903 /* error, we could not output */ 5904 if (error == ENOBUFS) { 5905 asoc->ifp_had_enobuf = 1; 5906 } 5907 sctp_pegs[SCTP_DATA_OUT_ERR]++; 5908 if (from_where == 0) { 5909 sctp_pegs[SCTP_ERROUT_FRM_USR]++; 5910 } 5911 5912 errored_send: 5913 #ifdef SCTP_DEBUG 5914 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5915 printf("Gak send error %d\n", error); 5916 } 5917 #endif 5918 if (hbflag) { 5919 #ifdef SCTP_DEBUG 5920 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5921 printf("Update HB time anyway\n"); 5922 } 5923 #endif 5924 if (*now_filled == 0) { 5925 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 5926 *now_filled = 1; 5927 *now = net->last_sent_time; 5928 } else { 5929 net->last_sent_time = *now; 5930 } 5931 hbflag = 0; 5932 } 5933 if (error == EHOSTUNREACH) { 5934 /* 5935 * Destination went unreachable during 5936 * this send 5937 */ 5938 #ifdef SCTP_DEBUG 5939 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 5940 printf("Calling the movement routine\n"); 5941 } 5942 #endif 5943 sctp_move_to_an_alt(stcb, asoc, net); 5944 } 5945 sctp_clean_up_ctl (asoc); 5946 return (error); 5947 } else { 5948 asoc->ifp_had_enobuf = 0; 5949 } 5950 if (bundle_at || hbflag) { 5951 /* For data/asconf and hb set time */ 5952 if (*now_filled == 0) { 5953 SCTP_GETTIME_TIMEVAL(&net->last_sent_time); 5954 *now_filled = 1; 5955 *now = net->last_sent_time; 5956 } else { 5957 net->last_sent_time = *now; 5958 } 5959 } 5960 5961 if (!no_out_cnt) { 5962 *num_out += (ctl_cnt + bundle_at); 5963 } 5964 if (bundle_at) { 5965 if (!net->rto_pending) { 5966 /* setup for a RTO measurement */ 5967 net->rto_pending = 1; 5968 data_list[0]->do_rtt = 1; 5969 } else { 5970 data_list[0]->do_rtt = 0; 5971 } 5972 sctp_pegs[SCTP_PEG_TSNS_SENT] += bundle_at; 5973 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net); 5974 } 5975 if (one_chunk) { 5976 break; 5977 } 5978 } 5979 } 5980 /* At the end there should be no NON timed 5981 * chunks hanging on this queue. 5982 */ 5983 if ((*num_out == 0) && (*reason_code == 0)) { 5984 *reason_code = 3; 5985 } 5986 sctp_clean_up_ctl (asoc); 5987 return (0); 5988 } 5989 5990 void 5991 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err) 5992 { 5993 /* Prepend a OPERATIONAL_ERROR chunk header 5994 * and put on the end of the control chunk queue. 5995 */ 5996 /* Sender had better have gotten a MGETHDR or else 5997 * the control chunk will be forever skipped 5998 */ 5999 struct sctp_chunkhdr *hdr; 6000 struct sctp_tmit_chunk *chk; 6001 struct mbuf *mat; 6002 6003 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6004 if (chk == NULL) { 6005 /* no memory */ 6006 sctp_m_freem(op_err); 6007 return; 6008 } 6009 sctppcbinfo.ipi_count_chunk++; 6010 sctppcbinfo.ipi_gencnt_chunk++; 6011 M_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_DONTWAIT); 6012 if (op_err == NULL) { 6013 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 6014 sctppcbinfo.ipi_count_chunk--; 6015 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 6016 panic("Chunk count is negative"); 6017 } 6018 sctppcbinfo.ipi_gencnt_chunk++; 6019 return; 6020 } 6021 chk->send_size = 0; 6022 mat = op_err; 6023 while (mat != NULL) { 6024 chk->send_size += mat->m_len; 6025 mat = mat->m_next; 6026 } 6027 chk->rec.chunk_id = SCTP_OPERATION_ERROR; 6028 chk->sent = SCTP_DATAGRAM_UNSENT; 6029 chk->snd_count = 0; 6030 chk->flags = 0; 6031 chk->asoc = &stcb->asoc; 6032 chk->data = op_err; 6033 chk->whoTo = chk->asoc->primary_destination; 6034 chk->whoTo->ref_count++; 6035 hdr = mtod(op_err, struct sctp_chunkhdr *); 6036 hdr->chunk_type = SCTP_OPERATION_ERROR; 6037 hdr->chunk_flags = 0; 6038 hdr->chunk_length = htons(chk->send_size); 6039 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, 6040 chk, 6041 sctp_next); 6042 chk->asoc->ctrl_queue_cnt++; 6043 } 6044 6045 int 6046 sctp_send_cookie_echo(struct mbuf *m, 6047 int offset, 6048 struct sctp_tcb *stcb, 6049 struct sctp_nets *net) 6050 { 6051 /* 6052 * pull out the cookie and put it at the front of the control 6053 * chunk queue. 6054 */ 6055 int at; 6056 struct mbuf *cookie, *mat; 6057 struct sctp_paramhdr parm, *phdr; 6058 struct sctp_chunkhdr *hdr; 6059 struct sctp_tmit_chunk *chk; 6060 uint16_t ptype, plen; 6061 /* First find the cookie in the param area */ 6062 cookie = NULL; 6063 at = offset + sizeof(struct sctp_init_chunk); 6064 6065 do { 6066 phdr = sctp_get_next_param(m, at, &parm, sizeof(parm)); 6067 if (phdr == NULL) { 6068 return (-3); 6069 } 6070 ptype = ntohs(phdr->param_type); 6071 plen = ntohs(phdr->param_length); 6072 if (ptype == SCTP_STATE_COOKIE) { 6073 int pad; 6074 /* found the cookie */ 6075 if ((pad = (plen % 4))) { 6076 plen += 4 - pad; 6077 } 6078 cookie = sctp_m_copym(m, at, plen, M_DONTWAIT); 6079 if (cookie == NULL) { 6080 /* No memory */ 6081 return (-2); 6082 } 6083 break; 6084 } 6085 at += SCTP_SIZE32(plen); 6086 } while (phdr); 6087 if (cookie == NULL) { 6088 /* Did not find the cookie */ 6089 return (-3); 6090 } 6091 /* ok, we got the cookie lets change it into a cookie echo chunk */ 6092 6093 /* first the change from param to cookie */ 6094 hdr = mtod(cookie, struct sctp_chunkhdr *); 6095 hdr->chunk_type = SCTP_COOKIE_ECHO; 6096 hdr->chunk_flags = 0; 6097 /* now we MUST have a PKTHDR on it */ 6098 if ((cookie->m_flags & M_PKTHDR) != M_PKTHDR) { 6099 /* we hope this happens rarely */ 6100 MGETHDR(mat, M_DONTWAIT, MT_HEADER); 6101 if (mat == NULL) { 6102 sctp_m_freem(cookie); 6103 return (-4); 6104 } 6105 mat->m_len = 0; 6106 m_reset_rcvif(mat); 6107 mat->m_next = cookie; 6108 cookie = mat; 6109 } 6110 cookie->m_pkthdr.len = plen; 6111 /* get the chunk stuff now and place it in the FRONT of the queue */ 6112 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6113 if (chk == NULL) { 6114 /* no memory */ 6115 sctp_m_freem(cookie); 6116 return (-5); 6117 } 6118 sctppcbinfo.ipi_count_chunk++; 6119 sctppcbinfo.ipi_gencnt_chunk++; 6120 chk->send_size = cookie->m_pkthdr.len; 6121 chk->rec.chunk_id = SCTP_COOKIE_ECHO; 6122 chk->sent = SCTP_DATAGRAM_UNSENT; 6123 chk->snd_count = 0; 6124 chk->flags = 0; 6125 chk->asoc = &stcb->asoc; 6126 chk->data = cookie; 6127 chk->whoTo = chk->asoc->primary_destination; 6128 chk->whoTo->ref_count++; 6129 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next); 6130 chk->asoc->ctrl_queue_cnt++; 6131 return (0); 6132 } 6133 6134 void 6135 sctp_send_heartbeat_ack(struct sctp_tcb *stcb, 6136 struct mbuf *m, 6137 int offset, 6138 int chk_length, 6139 struct sctp_nets *net) 6140 { 6141 /* take a HB request and make it into a 6142 * HB ack and send it. 6143 */ 6144 struct mbuf *outchain; 6145 struct sctp_chunkhdr *chdr; 6146 struct sctp_tmit_chunk *chk; 6147 6148 6149 if (net == NULL) 6150 /* must have a net pointer */ 6151 return; 6152 6153 outchain = sctp_m_copym(m, offset, chk_length, M_DONTWAIT); 6154 if (outchain == NULL) { 6155 /* gak out of memory */ 6156 return; 6157 } 6158 chdr = mtod(outchain, struct sctp_chunkhdr *); 6159 chdr->chunk_type = SCTP_HEARTBEAT_ACK; 6160 chdr->chunk_flags = 0; 6161 if ((outchain->m_flags & M_PKTHDR) != M_PKTHDR) { 6162 /* should not happen but we are cautious. */ 6163 struct mbuf *tmp; 6164 MGETHDR(tmp, M_DONTWAIT, MT_HEADER); 6165 if (tmp == NULL) { 6166 return; 6167 } 6168 tmp->m_len = 0; 6169 m_reset_rcvif(tmp); 6170 tmp->m_next = outchain; 6171 outchain = tmp; 6172 } 6173 outchain->m_pkthdr.len = chk_length; 6174 if (chk_length % 4) { 6175 /* need pad */ 6176 u_int32_t cpthis=0; 6177 int padlen; 6178 padlen = 4 - (outchain->m_pkthdr.len % 4); 6179 m_copyback(outchain, outchain->m_pkthdr.len, padlen, (void *)&cpthis); 6180 } 6181 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6182 if (chk == NULL) { 6183 /* no memory */ 6184 sctp_m_freem(outchain); 6185 return ; 6186 } 6187 sctppcbinfo.ipi_count_chunk++; 6188 sctppcbinfo.ipi_gencnt_chunk++; 6189 6190 chk->send_size = chk_length; 6191 chk->rec.chunk_id = SCTP_HEARTBEAT_ACK; 6192 chk->sent = SCTP_DATAGRAM_UNSENT; 6193 chk->snd_count = 0; 6194 chk->flags = 0; 6195 chk->asoc = &stcb->asoc; 6196 chk->data = outchain; 6197 chk->whoTo = net; 6198 chk->whoTo->ref_count++; 6199 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6200 chk->asoc->ctrl_queue_cnt++; 6201 } 6202 6203 int 6204 sctp_send_cookie_ack(struct sctp_tcb *stcb) { 6205 /* formulate and queue a cookie-ack back to sender */ 6206 struct mbuf *cookie_ack; 6207 struct sctp_chunkhdr *hdr; 6208 struct sctp_tmit_chunk *chk; 6209 6210 cookie_ack = NULL; 6211 MGETHDR(cookie_ack, M_DONTWAIT, MT_HEADER); 6212 if (cookie_ack == NULL) { 6213 /* no mbuf's */ 6214 return (-1); 6215 } 6216 cookie_ack->m_data += SCTP_MIN_OVERHEAD; 6217 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6218 if (chk == NULL) { 6219 /* no memory */ 6220 sctp_m_freem(cookie_ack); 6221 return (-1); 6222 } 6223 sctppcbinfo.ipi_count_chunk++; 6224 sctppcbinfo.ipi_gencnt_chunk++; 6225 6226 chk->send_size = sizeof(struct sctp_chunkhdr); 6227 chk->rec.chunk_id = SCTP_COOKIE_ACK; 6228 chk->sent = SCTP_DATAGRAM_UNSENT; 6229 chk->snd_count = 0; 6230 chk->flags = 0; 6231 chk->asoc = &stcb->asoc; 6232 chk->data = cookie_ack; 6233 if (chk->asoc->last_control_chunk_from != NULL) { 6234 chk->whoTo = chk->asoc->last_control_chunk_from; 6235 } else { 6236 chk->whoTo = chk->asoc->primary_destination; 6237 } 6238 chk->whoTo->ref_count++; 6239 hdr = mtod(cookie_ack, struct sctp_chunkhdr *); 6240 hdr->chunk_type = SCTP_COOKIE_ACK; 6241 hdr->chunk_flags = 0; 6242 hdr->chunk_length = htons(chk->send_size); 6243 cookie_ack->m_pkthdr.len = cookie_ack->m_len = chk->send_size; 6244 m_reset_rcvif(cookie_ack); 6245 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6246 chk->asoc->ctrl_queue_cnt++; 6247 return (0); 6248 } 6249 6250 6251 int 6252 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net) 6253 { 6254 /* formulate and queue a SHUTDOWN-ACK back to the sender */ 6255 struct mbuf *m_shutdown_ack; 6256 struct sctp_shutdown_ack_chunk *ack_cp; 6257 struct sctp_tmit_chunk *chk; 6258 6259 m_shutdown_ack = NULL; 6260 MGETHDR(m_shutdown_ack, M_DONTWAIT, MT_HEADER); 6261 if (m_shutdown_ack == NULL) { 6262 /* no mbuf's */ 6263 return (-1); 6264 } 6265 m_shutdown_ack->m_data += SCTP_MIN_OVERHEAD; 6266 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6267 if (chk == NULL) { 6268 /* no memory */ 6269 sctp_m_freem(m_shutdown_ack); 6270 return (-1); 6271 } 6272 sctppcbinfo.ipi_count_chunk++; 6273 sctppcbinfo.ipi_gencnt_chunk++; 6274 6275 chk->send_size = sizeof(struct sctp_chunkhdr); 6276 chk->rec.chunk_id = SCTP_SHUTDOWN_ACK; 6277 chk->sent = SCTP_DATAGRAM_UNSENT; 6278 chk->snd_count = 0; 6279 chk->flags = 0; 6280 chk->asoc = &stcb->asoc; 6281 chk->data = m_shutdown_ack; 6282 chk->whoTo = net; 6283 net->ref_count++; 6284 6285 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *); 6286 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK; 6287 ack_cp->ch.chunk_flags = 0; 6288 ack_cp->ch.chunk_length = htons(chk->send_size); 6289 m_shutdown_ack->m_pkthdr.len = m_shutdown_ack->m_len = chk->send_size; 6290 m_reset_rcvif(m_shutdown_ack); 6291 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6292 chk->asoc->ctrl_queue_cnt++; 6293 return (0); 6294 } 6295 6296 int 6297 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net) 6298 { 6299 /* formulate and queue a SHUTDOWN to the sender */ 6300 struct mbuf *m_shutdown; 6301 struct sctp_shutdown_chunk *shutdown_cp; 6302 struct sctp_tmit_chunk *chk; 6303 6304 m_shutdown = NULL; 6305 MGETHDR(m_shutdown, M_DONTWAIT, MT_HEADER); 6306 if (m_shutdown == NULL) { 6307 /* no mbuf's */ 6308 return (-1); 6309 } 6310 m_shutdown->m_data += SCTP_MIN_OVERHEAD; 6311 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6312 if (chk == NULL) { 6313 /* no memory */ 6314 sctp_m_freem(m_shutdown); 6315 return (-1); 6316 } 6317 sctppcbinfo.ipi_count_chunk++; 6318 sctppcbinfo.ipi_gencnt_chunk++; 6319 6320 chk->send_size = sizeof(struct sctp_shutdown_chunk); 6321 chk->rec.chunk_id = SCTP_SHUTDOWN; 6322 chk->sent = SCTP_DATAGRAM_UNSENT; 6323 chk->snd_count = 0; 6324 chk->flags = 0; 6325 chk->asoc = &stcb->asoc; 6326 chk->data = m_shutdown; 6327 chk->whoTo = net; 6328 net->ref_count++; 6329 6330 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *); 6331 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN; 6332 shutdown_cp->ch.chunk_flags = 0; 6333 shutdown_cp->ch.chunk_length = htons(chk->send_size); 6334 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn); 6335 m_shutdown->m_pkthdr.len = m_shutdown->m_len = chk->send_size; 6336 m_reset_rcvif(m_shutdown); 6337 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6338 chk->asoc->ctrl_queue_cnt++; 6339 6340 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 6341 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 6342 stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 6343 soisdisconnecting(stcb->sctp_ep->sctp_socket); 6344 } 6345 return (0); 6346 } 6347 6348 int 6349 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net) 6350 { 6351 /* 6352 * formulate and queue an ASCONF to the peer 6353 * ASCONF parameters should be queued on the assoc queue 6354 */ 6355 struct sctp_tmit_chunk *chk; 6356 struct mbuf *m_asconf; 6357 6358 /* compose an ASCONF chunk, maximum length is PMTU */ 6359 m_asconf = sctp_compose_asconf(stcb); 6360 if (m_asconf == NULL) { 6361 return (-1); 6362 } 6363 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6364 if (chk == NULL) { 6365 /* no memory */ 6366 sctp_m_freem(m_asconf); 6367 return (-1); 6368 } 6369 sctppcbinfo.ipi_count_chunk++; 6370 sctppcbinfo.ipi_gencnt_chunk++; 6371 6372 chk->data = m_asconf; 6373 chk->send_size = m_asconf->m_pkthdr.len; 6374 chk->rec.chunk_id = SCTP_ASCONF; 6375 chk->sent = SCTP_DATAGRAM_UNSENT; 6376 chk->snd_count = 0; 6377 chk->flags = 0; 6378 chk->asoc = &stcb->asoc; 6379 chk->whoTo = chk->asoc->primary_destination; 6380 chk->whoTo->ref_count++; 6381 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6382 chk->asoc->ctrl_queue_cnt++; 6383 return (0); 6384 } 6385 6386 int 6387 sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans) 6388 { 6389 /* 6390 * formulate and queue a asconf-ack back to sender 6391 * the asconf-ack must be stored in the tcb 6392 */ 6393 struct sctp_tmit_chunk *chk; 6394 struct mbuf *m_ack; 6395 6396 /* is there a asconf-ack mbuf chain to send? */ 6397 if (stcb->asoc.last_asconf_ack_sent == NULL) { 6398 return (-1); 6399 } 6400 6401 /* copy the asconf_ack */ 6402 #if defined(__FreeBSD__) || defined(__NetBSD__) 6403 /* Supposedly the m_copypacket is a optimzation, 6404 * use it if we can. 6405 */ 6406 if (stcb->asoc.last_asconf_ack_sent->m_flags & M_PKTHDR) { 6407 m_ack = m_copypacket(stcb->asoc.last_asconf_ack_sent, M_DONTWAIT); 6408 sctp_pegs[SCTP_CACHED_SRC]++; 6409 } else 6410 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL); 6411 #else 6412 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL); 6413 #endif 6414 if (m_ack == NULL) { 6415 /* couldn't copy it */ 6416 6417 return (-1); 6418 } 6419 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 6420 if (chk == NULL) { 6421 /* no memory */ 6422 if (m_ack) 6423 sctp_m_freem(m_ack); 6424 return (-1); 6425 } 6426 sctppcbinfo.ipi_count_chunk++; 6427 sctppcbinfo.ipi_gencnt_chunk++; 6428 6429 /* figure out where it goes to */ 6430 if (retrans) { 6431 /* we're doing a retransmission */ 6432 if (stcb->asoc.used_alt_asconfack > 2) { 6433 /* tried alternate nets already, go back */ 6434 chk->whoTo = NULL; 6435 } else { 6436 /* need to try and alternate net */ 6437 chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from); 6438 stcb->asoc.used_alt_asconfack++; 6439 } 6440 if (chk->whoTo == NULL) { 6441 /* no alternate */ 6442 if (stcb->asoc.last_control_chunk_from == NULL) 6443 chk->whoTo = stcb->asoc.primary_destination; 6444 else 6445 chk->whoTo = stcb->asoc.last_control_chunk_from; 6446 stcb->asoc.used_alt_asconfack = 0; 6447 } 6448 } else { 6449 /* normal case */ 6450 if (stcb->asoc.last_control_chunk_from == NULL) 6451 chk->whoTo = stcb->asoc.primary_destination; 6452 else 6453 chk->whoTo = stcb->asoc.last_control_chunk_from; 6454 stcb->asoc.used_alt_asconfack = 0; 6455 } 6456 chk->data = m_ack; 6457 chk->send_size = m_ack->m_pkthdr.len; 6458 chk->rec.chunk_id = SCTP_ASCONF_ACK; 6459 chk->sent = SCTP_DATAGRAM_UNSENT; 6460 chk->snd_count = 0; 6461 chk->flags = 0; 6462 chk->asoc = &stcb->asoc; 6463 chk->whoTo->ref_count++; 6464 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); 6465 chk->asoc->ctrl_queue_cnt++; 6466 return (0); 6467 } 6468 6469 6470 static int 6471 sctp_chunk_retransmission(struct sctp_inpcb *inp, 6472 struct sctp_tcb *stcb, 6473 struct sctp_association *asoc, 6474 int *cnt_out, struct timeval *now, int *now_filled) 6475 { 6476 /* 6477 * send out one MTU of retransmission. 6478 * If fast_retransmit is happening we ignore the cwnd. 6479 * Otherwise we obey the cwnd and rwnd. 6480 * For a Cookie or Asconf in the control chunk queue we retransmit 6481 * them by themselves. 6482 * 6483 * For data chunks we will pick out the lowest TSN's in the 6484 * sent_queue marked for resend and bundle them all together 6485 * (up to a MTU of destination). The address to send to should 6486 * have been selected/changed where the retransmission was 6487 * marked (i.e. in FR or t3-timeout routines). 6488 */ 6489 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING]; 6490 struct sctp_tmit_chunk *chk, *fwd; 6491 struct mbuf *m; 6492 struct sctphdr *shdr; 6493 int asconf; 6494 struct sctp_nets *net; 6495 int no_fragmentflg, bundle_at, cnt_thru; 6496 unsigned int mtu; 6497 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started; 6498 6499 tmr_started = ctl_cnt = bundle_at = error = 0; 6500 no_fragmentflg = 1; 6501 asconf = 0; 6502 fwd_tsn = 0; 6503 *cnt_out = 0; 6504 fwd = NULL; 6505 m = NULL; 6506 #ifdef SCTP_AUDITING_ENABLED 6507 sctp_audit_log(0xC3, 1); 6508 #endif 6509 if (TAILQ_EMPTY(&asoc->sent_queue)) { 6510 #ifdef SCTP_DEBUG 6511 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6512 printf("SCTP hits empty queue with cnt set to %d?\n", 6513 asoc->sent_queue_retran_cnt); 6514 } 6515 #endif 6516 asoc->sent_queue_cnt = 0; 6517 asoc->sent_queue_cnt_removeable = 0; 6518 } 6519 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 6520 if (chk->sent != SCTP_DATAGRAM_RESEND) { 6521 /* we only worry about things marked for resend */ 6522 continue; 6523 } 6524 if ((chk->rec.chunk_id == SCTP_COOKIE_ECHO) || 6525 (chk->rec.chunk_id == SCTP_ASCONF) || 6526 (chk->rec.chunk_id == SCTP_STREAM_RESET) || 6527 (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN)) { 6528 if (chk->rec.chunk_id == SCTP_STREAM_RESET) { 6529 /* For stream reset we only retran the request 6530 * not the response. 6531 */ 6532 struct sctp_stream_reset_req *strreq; 6533 strreq = mtod(chk->data, struct sctp_stream_reset_req *); 6534 if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) { 6535 continue; 6536 } 6537 } 6538 ctl_cnt++; 6539 if (chk->rec.chunk_id == SCTP_ASCONF) { 6540 no_fragmentflg = 1; 6541 asconf = 1; 6542 } 6543 if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) { 6544 fwd_tsn = 1; 6545 fwd = chk; 6546 } 6547 m = sctp_copy_mbufchain(chk->data, m); 6548 break; 6549 } 6550 } 6551 one_chunk = 0; 6552 cnt_thru = 0; 6553 /* do we have control chunks to retransmit? */ 6554 if (m != NULL) { 6555 /* Start a timer no matter if we suceed or fail */ 6556 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) { 6557 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo); 6558 } else if (chk->rec.chunk_id == SCTP_ASCONF) 6559 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo); 6560 6561 if (m->m_len == 0) { 6562 /* Special case for when you get a 0 len 6563 * mbuf at the head due to the lack 6564 * of a MHDR at the beginning. 6565 */ 6566 m->m_len = sizeof(struct sctphdr); 6567 } else { 6568 M_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT); 6569 if (m == NULL) { 6570 return (ENOBUFS); 6571 } 6572 } 6573 shdr = mtod(m, struct sctphdr *); 6574 shdr->src_port = inp->sctp_lport; 6575 shdr->dest_port = stcb->rport; 6576 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 6577 shdr->checksum = 0; 6578 chk->snd_count++; /* update our count */ 6579 6580 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo, 6581 rtcache_getdst(&chk->whoTo->ro), m, 6582 no_fragmentflg, 0, NULL, asconf))) { 6583 sctp_pegs[SCTP_DATA_OUT_ERR]++; 6584 return (error); 6585 } 6586 /* 6587 *We don't want to mark the net->sent time here since this 6588 * we use this for HB and retrans cannot measure RTT 6589 */ 6590 /* SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time);*/ 6591 *cnt_out += 1; 6592 chk->sent = SCTP_DATAGRAM_SENT; 6593 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 6594 if (fwd_tsn == 0) { 6595 return (0); 6596 } else { 6597 /* Clean up the fwd-tsn list */ 6598 sctp_clean_up_ctl (asoc); 6599 return (0); 6600 } 6601 } 6602 /* Ok, it is just data retransmission we need to do or 6603 * that and a fwd-tsn with it all. 6604 */ 6605 if (TAILQ_EMPTY(&asoc->sent_queue)) { 6606 return (-1); 6607 } 6608 #ifdef SCTP_DEBUG 6609 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6610 printf("Normal chunk retransmission cnt:%d\n", 6611 asoc->sent_queue_retran_cnt); 6612 } 6613 #endif 6614 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) || 6615 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) { 6616 /* not yet open, resend the cookie and that is it */ 6617 return (1); 6618 } 6619 6620 6621 #ifdef SCTP_AUDITING_ENABLED 6622 sctp_auditing(20, inp, stcb, NULL); 6623 #endif 6624 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 6625 if (chk->sent != SCTP_DATAGRAM_RESEND) { 6626 /* No, not sent to this net or not ready for rtx */ 6627 continue; 6628 6629 } 6630 /* pick up the net */ 6631 net = chk->whoTo; 6632 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 6633 mtu = (net->mtu - SCTP_MIN_OVERHEAD); 6634 } else { 6635 mtu = net->mtu- SCTP_MIN_V4_OVERHEAD; 6636 } 6637 6638 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) { 6639 /* No room in peers rwnd */ 6640 uint32_t tsn; 6641 tsn = asoc->last_acked_seq + 1; 6642 if (tsn == chk->rec.data.TSN_seq) { 6643 /* we make a special exception for this case. 6644 * The peer has no rwnd but is missing the 6645 * lowest chunk.. which is probably what is 6646 * holding up the rwnd. 6647 */ 6648 goto one_chunk_around; 6649 } 6650 #ifdef SCTP_DEBUG 6651 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6652 printf("blocked-peers_rwnd:%d tf:%d\n", 6653 (int)asoc->peers_rwnd, 6654 (int)asoc->total_flight); 6655 } 6656 #endif 6657 sctp_pegs[SCTP_RWND_BLOCKED]++; 6658 return (1); 6659 } 6660 one_chunk_around: 6661 if (asoc->peers_rwnd < mtu) { 6662 one_chunk = 1; 6663 } 6664 #ifdef SCTP_AUDITING_ENABLED 6665 sctp_audit_log(0xC3, 2); 6666 #endif 6667 bundle_at = 0; 6668 m = NULL; 6669 net->fast_retran_ip = 0; 6670 if (chk->rec.data.doing_fast_retransmit == 0) { 6671 /* if no FR in progress skip destination that 6672 * have flight_size > cwnd. 6673 */ 6674 if (net->flight_size >= net->cwnd) { 6675 sctp_pegs[SCTP_CWND_BLOCKED]++; 6676 continue; 6677 } 6678 } else { 6679 /* Mark the destination net to have FR recovery 6680 * limits put on it. 6681 */ 6682 net->fast_retran_ip = 1; 6683 } 6684 6685 if ((chk->send_size <= mtu) || (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) { 6686 /* ok we will add this one */ 6687 m = sctp_copy_mbufchain(chk->data, m); 6688 if (m == NULL) { 6689 return (ENOMEM); 6690 } 6691 /* upate our MTU size */ 6692 /* Do clear IP_DF ? */ 6693 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) { 6694 no_fragmentflg = 0; 6695 } 6696 mtu -= chk->send_size; 6697 data_list[bundle_at++] = chk; 6698 if (one_chunk && (asoc->total_flight <= 0)) { 6699 sctp_pegs[SCTP_WINDOW_PROBES]++; 6700 chk->rec.data.state_flags |= SCTP_WINDOW_PROBE; 6701 } 6702 } 6703 if (one_chunk == 0) { 6704 /* now are there anymore forward from chk to pick up?*/ 6705 fwd = TAILQ_NEXT(chk, sctp_next); 6706 while (fwd) { 6707 if (fwd->sent != SCTP_DATAGRAM_RESEND) { 6708 /* Nope, not for retran */ 6709 fwd = TAILQ_NEXT(fwd, sctp_next); 6710 continue; 6711 } 6712 if (fwd->whoTo != net) { 6713 /* Nope, not the net in question */ 6714 fwd = TAILQ_NEXT(fwd, sctp_next); 6715 continue; 6716 } 6717 if (fwd->send_size <= mtu) { 6718 m = sctp_copy_mbufchain(fwd->data, m); 6719 if (m == NULL) { 6720 return (ENOMEM); 6721 } 6722 /* upate our MTU size */ 6723 /* Do clear IP_DF ? */ 6724 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) { 6725 no_fragmentflg = 0; 6726 } 6727 mtu -= fwd->send_size; 6728 data_list[bundle_at++] = fwd; 6729 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) { 6730 break; 6731 } 6732 fwd = TAILQ_NEXT(fwd, sctp_next); 6733 } else { 6734 /* can't fit so we are done */ 6735 break; 6736 } 6737 } 6738 } 6739 /* Is there something to send for this destination? */ 6740 if (m) { 6741 /* No matter if we fail/or suceed we should 6742 * start a timer. A failure is like a lost 6743 * IP packet :-) 6744 */ 6745 if (!callout_pending(&net->rxt_timer.timer)) { 6746 /* no timer running on this destination 6747 * restart it. 6748 */ 6749 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 6750 tmr_started = 1; 6751 } 6752 if (m->m_len == 0) { 6753 /* Special case for when you get a 0 len 6754 * mbuf at the head due to the lack 6755 * of a MHDR at the beginning. 6756 */ 6757 m->m_len = sizeof(struct sctphdr); 6758 } else { 6759 M_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT); 6760 if (m == NULL) { 6761 return (ENOBUFS); 6762 } 6763 } 6764 shdr = mtod(m, struct sctphdr *); 6765 shdr->src_port = inp->sctp_lport; 6766 shdr->dest_port = stcb->rport; 6767 shdr->v_tag = htonl(stcb->asoc.peer_vtag); 6768 shdr->checksum = 0; 6769 6770 /* Now lets send it, if there is anything to send :> */ 6771 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net, 6772 rtcache_getdst(&net->ro), 6773 m, 6774 no_fragmentflg, 0, NULL, asconf))) { 6775 /* error, we could not output */ 6776 sctp_pegs[SCTP_DATA_OUT_ERR]++; 6777 return (error); 6778 } 6779 /* For HB's */ 6780 /* 6781 * We don't want to mark the net->sent time here since 6782 * this we use this for HB and retrans cannot measure 6783 * RTT 6784 */ 6785 /* SCTP_GETTIME_TIMEVAL(&net->last_sent_time);*/ 6786 6787 /* For auto-close */ 6788 cnt_thru++; 6789 if (*now_filled == 0) { 6790 SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent); 6791 *now = asoc->time_last_sent; 6792 *now_filled = 1; 6793 } else { 6794 asoc->time_last_sent = *now; 6795 } 6796 *cnt_out += bundle_at; 6797 #ifdef SCTP_AUDITING_ENABLED 6798 sctp_audit_log(0xC4, bundle_at); 6799 #endif 6800 for (i = 0; i < bundle_at; i++) { 6801 sctp_pegs[SCTP_RETRANTSN_SENT]++; 6802 data_list[i]->sent = SCTP_DATAGRAM_SENT; 6803 data_list[i]->snd_count++; 6804 sctp_ucount_decr(asoc->sent_queue_retran_cnt); 6805 /* record the time */ 6806 data_list[i]->sent_rcv_time = asoc->time_last_sent; 6807 net->flight_size += data_list[i]->book_size; 6808 asoc->total_flight += data_list[i]->book_size; 6809 asoc->total_flight_count++; 6810 6811 #ifdef SCTP_LOG_RWND 6812 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND, 6813 asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh); 6814 #endif 6815 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd, 6816 (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh)); 6817 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 6818 /* SWS sender side engages */ 6819 asoc->peers_rwnd = 0; 6820 } 6821 6822 if ((i == 0) && 6823 (data_list[i]->rec.data.doing_fast_retransmit)) { 6824 sctp_pegs[SCTP_FAST_RETRAN]++; 6825 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) && 6826 (tmr_started == 0)) { 6827 /* 6828 * ok we just fast-retrans'd 6829 * the lowest TSN, i.e the 6830 * first on the list. In this 6831 * case we want to give some 6832 * more time to get a SACK 6833 * back without a t3-expiring. 6834 */ 6835 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 6836 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net); 6837 } 6838 } 6839 } 6840 #ifdef SCTP_AUDITING_ENABLED 6841 sctp_auditing(21, inp, stcb, NULL); 6842 #endif 6843 } else { 6844 /* None will fit */ 6845 return (1); 6846 } 6847 if (asoc->sent_queue_retran_cnt <= 0) { 6848 /* all done we have no more to retran */ 6849 asoc->sent_queue_retran_cnt = 0; 6850 break; 6851 } 6852 if (one_chunk) { 6853 /* No more room in rwnd */ 6854 return (1); 6855 } 6856 /* stop the for loop here. we sent out a packet */ 6857 break; 6858 } 6859 return (0); 6860 } 6861 6862 6863 static int 6864 sctp_timer_validation(struct sctp_inpcb *inp, 6865 struct sctp_tcb *stcb, 6866 struct sctp_association *asoc, 6867 int ret) 6868 { 6869 struct sctp_nets *net; 6870 /* Validate that a timer is running somewhere */ 6871 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 6872 if (callout_pending(&net->rxt_timer.timer)) { 6873 /* Here is a timer */ 6874 return (ret); 6875 } 6876 } 6877 /* Gak, we did not have a timer somewhere */ 6878 #ifdef SCTP_DEBUG 6879 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 6880 printf("Deadlock avoided starting timer on a dest at retran\n"); 6881 } 6882 #endif 6883 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination); 6884 return (ret); 6885 } 6886 6887 int 6888 sctp_chunk_output(struct sctp_inpcb *inp, 6889 struct sctp_tcb *stcb, 6890 int from_where) 6891 { 6892 /* Ok this is the generic chunk service queue. 6893 * we must do the following: 6894 * - See if there are retransmits pending, if so we 6895 * must do these first and return. 6896 * - Service the stream queue that is next, 6897 * moving any message (note I must get a complete 6898 * message i.e. FIRST/MIDDLE and LAST to the out 6899 * queue in one pass) and assigning TSN's 6900 * - Check to see if the cwnd/rwnd allows any output, if 6901 * so we go ahead and fomulate and send the low level 6902 * chunks. Making sure to combine any control in the 6903 * control chunk queue also. 6904 */ 6905 struct sctp_association *asoc; 6906 struct sctp_nets *net; 6907 int error, num_out, tot_out, ret, reason_code, burst_cnt, burst_limit; 6908 struct timeval now; 6909 int now_filled=0; 6910 int cwnd_full=0; 6911 asoc = &stcb->asoc; 6912 tot_out = 0; 6913 num_out = 0; 6914 reason_code = 0; 6915 sctp_pegs[SCTP_CALLS_TO_CO]++; 6916 #ifdef SCTP_DEBUG 6917 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 6918 printf("in co - retran count:%d\n", asoc->sent_queue_retran_cnt); 6919 } 6920 #endif 6921 while (asoc->sent_queue_retran_cnt) { 6922 /* Ok, it is retransmission time only, we send out only ONE 6923 * packet with a single call off to the retran code. 6924 */ 6925 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled); 6926 if (ret > 0) { 6927 /* Can't send anymore */ 6928 #ifdef SCTP_DEBUG 6929 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6930 printf("retransmission ret:%d -- full\n", ret); 6931 } 6932 #endif 6933 /* 6934 * now lets push out control by calling med-level 6935 * output once. this assures that we WILL send HB's 6936 * if queued too. 6937 */ 6938 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, 6939 &cwnd_full, from_where, 6940 &now, &now_filled); 6941 #ifdef SCTP_DEBUG 6942 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6943 printf("Control send outputs:%d@full\n", num_out); 6944 } 6945 #endif 6946 #ifdef SCTP_AUDITING_ENABLED 6947 sctp_auditing(8, inp, stcb, NULL); 6948 #endif 6949 return (sctp_timer_validation(inp, stcb, asoc, ret)); 6950 } 6951 if (ret < 0) { 6952 /* 6953 * The count was off.. retran is not happening so do 6954 * the normal retransmission. 6955 */ 6956 #ifdef SCTP_DEBUG 6957 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6958 printf("Done with retrans, none left fill up window\n"); 6959 } 6960 #endif 6961 #ifdef SCTP_AUDITING_ENABLED 6962 sctp_auditing(9, inp, stcb, NULL); 6963 #endif 6964 break; 6965 } 6966 if (from_where == 1) { 6967 /* Only one transmission allowed out of a timeout */ 6968 #ifdef SCTP_DEBUG 6969 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 6970 printf("Only one packet allowed out\n"); 6971 } 6972 #endif 6973 #ifdef SCTP_AUDITING_ENABLED 6974 sctp_auditing(10, inp, stcb, NULL); 6975 #endif 6976 /* Push out any control */ 6977 (void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where, 6978 &now, &now_filled); 6979 return (ret); 6980 } 6981 if ((num_out == 0) && (ret == 0)) { 6982 /* No more retrans to send */ 6983 break; 6984 } 6985 } 6986 #ifdef SCTP_AUDITING_ENABLED 6987 sctp_auditing(12, inp, stcb, NULL); 6988 #endif 6989 /* Check for bad destinations, if they exist move chunks around. */ 6990 burst_limit = asoc->max_burst; 6991 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 6992 if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) == 6993 SCTP_ADDR_NOT_REACHABLE) { 6994 /* 6995 * if possible move things off of this address 6996 * we still may send below due to the dormant state 6997 * but we try to find an alternate address to send 6998 * to and if we have one we move all queued data on 6999 * the out wheel to this alternate address. 7000 */ 7001 sctp_move_to_an_alt(stcb, asoc, net); 7002 } else { 7003 /* 7004 if ((asoc->sat_network) || (net->addr_is_local)) { 7005 burst_limit = asoc->max_burst * SCTP_SAT_NETWORK_BURST_INCR; 7006 } 7007 */ 7008 #ifdef SCTP_DEBUG 7009 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 7010 printf("examined net:%p burst limit:%d\n", net, asoc->max_burst); 7011 } 7012 #endif 7013 7014 #ifdef SCTP_USE_ALLMAN_BURST 7015 if ((net->flight_size+(burst_limit*net->mtu)) < net->cwnd) { 7016 if (net->ssthresh < net->cwnd) 7017 net->ssthresh = net->cwnd; 7018 net->cwnd = (net->flight_size+(burst_limit*net->mtu)); 7019 #ifdef SCTP_LOG_MAXBURST 7020 sctp_log_maxburst(net, 0, burst_limit, SCTP_MAX_BURST_APPLIED); 7021 #endif 7022 sctp_pegs[SCTP_MAX_BURST_APL]++; 7023 } 7024 net->fast_retran_ip = 0; 7025 #endif 7026 } 7027 7028 } 7029 /* Fill up what we can to the destination */ 7030 burst_cnt = 0; 7031 cwnd_full = 0; 7032 do { 7033 #ifdef SCTP_DEBUG 7034 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 7035 printf("Burst count:%d - call m-c-o\n", burst_cnt); 7036 } 7037 #endif 7038 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out, 7039 &reason_code, 0, &cwnd_full, from_where, 7040 &now, &now_filled); 7041 if (error) { 7042 #ifdef SCTP_DEBUG 7043 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7044 printf("Error %d was returned from med-c-op\n", error); 7045 } 7046 #endif 7047 #ifdef SCTP_LOG_MAXBURST 7048 sctp_log_maxburst(asoc->primary_destination, error , burst_cnt, SCTP_MAX_BURST_ERROR_STOP); 7049 #endif 7050 break; 7051 } 7052 #ifdef SCTP_DEBUG 7053 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) { 7054 printf("m-c-o put out %d\n", num_out); 7055 } 7056 #endif 7057 tot_out += num_out; 7058 burst_cnt++; 7059 } while (num_out 7060 #ifndef SCTP_USE_ALLMAN_BURST 7061 && (burst_cnt < burst_limit) 7062 #endif 7063 ); 7064 #ifndef SCTP_USE_ALLMAN_BURST 7065 if (burst_cnt >= burst_limit) { 7066 sctp_pegs[SCTP_MAX_BURST_APL]++; 7067 asoc->burst_limit_applied = 1; 7068 #ifdef SCTP_LOG_MAXBURST 7069 sctp_log_maxburst(asoc->primary_destination, 0 , burst_cnt, SCTP_MAX_BURST_APPLIED); 7070 #endif 7071 } else { 7072 asoc->burst_limit_applied = 0; 7073 } 7074 #endif 7075 7076 #ifdef SCTP_DEBUG 7077 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7078 printf("Ok, we have put out %d chunks\n", tot_out); 7079 } 7080 #endif 7081 if (tot_out == 0) { 7082 sctp_pegs[SCTP_CO_NODATASNT]++; 7083 if (asoc->stream_queue_cnt > 0) { 7084 sctp_pegs[SCTP_SOS_NOSNT]++; 7085 } else { 7086 sctp_pegs[SCTP_NOS_NOSNT]++; 7087 } 7088 if (asoc->send_queue_cnt > 0) { 7089 sctp_pegs[SCTP_SOSE_NOSNT]++; 7090 } else { 7091 sctp_pegs[SCTP_NOSE_NOSNT]++; 7092 } 7093 } 7094 /* Now we need to clean up the control chunk chain if 7095 * a ECNE is on it. It must be marked as UNSENT again 7096 * so next call will continue to send it until 7097 * such time that we get a CWR, to remove it. 7098 */ 7099 sctp_fix_ecn_echo(asoc); 7100 return (error); 7101 } 7102 7103 7104 int 7105 sctp_output(struct sctp_inpcb *inp, struct mbuf *m, 7106 struct sockaddr *addr, struct mbuf *control, struct lwp *l, int flags) 7107 { 7108 struct sctp_inpcb *t_inp; 7109 struct sctp_tcb *stcb; 7110 struct sctp_nets *net; 7111 struct sctp_association *asoc; 7112 int create_lock_applied = 0; 7113 int queue_only, error = 0; 7114 struct sctp_sndrcvinfo srcv; 7115 int un_sent = 0; 7116 int use_rcvinfo = 0; 7117 t_inp = inp; 7118 /* struct route ro;*/ 7119 7120 queue_only = 0; 7121 stcb = NULL; 7122 asoc = NULL; 7123 net = NULL; 7124 7125 #ifdef SCTP_DEBUG 7126 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7127 printf("USR Send BEGINS\n"); 7128 } 7129 #endif 7130 7131 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 7132 (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) { 7133 /* The listner can NOT send */ 7134 if (control) { 7135 sctppcbinfo.mbuf_track--; 7136 sctp_m_freem(control); 7137 control = NULL; 7138 } 7139 sctp_m_freem(m); 7140 return (EFAULT); 7141 } 7142 /* Can't allow a V6 address on a non-v6 socket */ 7143 if (addr) { 7144 SCTP_ASOC_CREATE_LOCK(inp); 7145 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 7146 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 7147 /* Should I really unlock ? */ 7148 SCTP_ASOC_CREATE_UNLOCK(inp); 7149 if (control) { 7150 sctppcbinfo.mbuf_track--; 7151 sctp_m_freem(control); 7152 control = NULL; 7153 } 7154 sctp_m_freem(m); 7155 return (EFAULT); 7156 } 7157 create_lock_applied = 1; 7158 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 7159 (addr->sa_family == AF_INET6)) { 7160 SCTP_ASOC_CREATE_UNLOCK(inp); 7161 if (control) { 7162 sctppcbinfo.mbuf_track--; 7163 sctp_m_freem(control); 7164 control = NULL; 7165 } 7166 sctp_m_freem(m); 7167 return (EINVAL); 7168 } 7169 } 7170 if (control) { 7171 sctppcbinfo.mbuf_track++; 7172 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control, 7173 sizeof(srcv))) { 7174 if (srcv.sinfo_flags & MSG_SENDALL) { 7175 /* its a sendall */ 7176 sctppcbinfo.mbuf_track--; 7177 sctp_m_freem(control); 7178 if (create_lock_applied) { 7179 SCTP_ASOC_CREATE_UNLOCK(inp); 7180 create_lock_applied = 0; 7181 } 7182 return (sctp_sendall(inp, NULL, m, &srcv)); 7183 } 7184 if (srcv.sinfo_assoc_id) { 7185 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 7186 SCTP_INP_RLOCK(inp); 7187 stcb = LIST_FIRST(&inp->sctp_asoc_list); 7188 if (stcb) { 7189 SCTP_TCB_LOCK(stcb); 7190 } 7191 SCTP_INP_RUNLOCK(inp); 7192 7193 if (stcb == NULL) { 7194 if (create_lock_applied) { 7195 SCTP_ASOC_CREATE_UNLOCK(inp); 7196 create_lock_applied = 0; 7197 } 7198 sctppcbinfo.mbuf_track--; 7199 sctp_m_freem(control); 7200 sctp_m_freem(m); 7201 return (ENOTCONN); 7202 } 7203 net = stcb->asoc.primary_destination; 7204 } else { 7205 stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id); 7206 } 7207 /* 7208 * Question: Should I error here if the 7209 7210 * assoc_id is no longer valid? 7211 * i.e. I can't find it? 7212 */ 7213 if ((stcb) && 7214 (addr != NULL)) { 7215 /* Must locate the net structure */ 7216 if (addr) 7217 net = sctp_findnet(stcb, addr); 7218 } 7219 if (net == NULL) 7220 net = stcb->asoc.primary_destination; 7221 } 7222 use_rcvinfo = 1; 7223 } 7224 } 7225 if (stcb == NULL) { 7226 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 7227 SCTP_INP_RLOCK(inp); 7228 stcb = LIST_FIRST(&inp->sctp_asoc_list); 7229 if (stcb) { 7230 SCTP_TCB_LOCK(stcb); 7231 } 7232 SCTP_INP_RUNLOCK(inp); 7233 if (stcb == NULL) { 7234 if (create_lock_applied) { 7235 SCTP_ASOC_CREATE_UNLOCK(inp); 7236 create_lock_applied = 0; 7237 } 7238 if (control) { 7239 sctppcbinfo.mbuf_track--; 7240 sctp_m_freem(control); 7241 control = NULL; 7242 } 7243 sctp_m_freem(m); 7244 return (ENOTCONN); 7245 } 7246 if (addr == NULL) { 7247 net = stcb->asoc.primary_destination; 7248 } else { 7249 net = sctp_findnet(stcb, addr); 7250 if (net == NULL) { 7251 net = stcb->asoc.primary_destination; 7252 } 7253 } 7254 } else { 7255 if (addr != NULL) { 7256 SCTP_INP_WLOCK(inp); 7257 SCTP_INP_INCR_REF(inp); 7258 SCTP_INP_WUNLOCK(inp); 7259 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 7260 if (stcb == NULL) { 7261 SCTP_INP_WLOCK(inp); 7262 SCTP_INP_DECR_REF(inp); 7263 SCTP_INP_WUNLOCK(inp); 7264 } 7265 } 7266 } 7267 } 7268 if ((stcb == NULL) && 7269 (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) { 7270 if (control) { 7271 sctppcbinfo.mbuf_track--; 7272 sctp_m_freem(control); 7273 control = NULL; 7274 } 7275 if (create_lock_applied) { 7276 SCTP_ASOC_CREATE_UNLOCK(inp); 7277 create_lock_applied = 0; 7278 } 7279 sctp_m_freem(m); 7280 return (ENOTCONN); 7281 } else if ((stcb == NULL) && 7282 (addr == NULL)) { 7283 if (control) { 7284 sctppcbinfo.mbuf_track--; 7285 sctp_m_freem(control); 7286 control = NULL; 7287 } 7288 if (create_lock_applied) { 7289 SCTP_ASOC_CREATE_UNLOCK(inp); 7290 create_lock_applied = 0; 7291 } 7292 sctp_m_freem(m); 7293 return (ENOENT); 7294 } else if (stcb == NULL) { 7295 /* UDP mode, we must go ahead and start the INIT process */ 7296 if ((use_rcvinfo) && (srcv.sinfo_flags & MSG_ABORT)) { 7297 /* Strange user to do this */ 7298 if (control) { 7299 sctppcbinfo.mbuf_track--; 7300 sctp_m_freem(control); 7301 control = NULL; 7302 } 7303 if (create_lock_applied) { 7304 SCTP_ASOC_CREATE_UNLOCK(inp); 7305 create_lock_applied = 0; 7306 } 7307 sctp_m_freem(m); 7308 return (ENOENT); 7309 } 7310 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0); 7311 if (stcb == NULL) { 7312 if (control) { 7313 sctppcbinfo.mbuf_track--; 7314 sctp_m_freem(control); 7315 control = NULL; 7316 } 7317 if (create_lock_applied) { 7318 SCTP_ASOC_CREATE_UNLOCK(inp); 7319 create_lock_applied = 0; 7320 } 7321 sctp_m_freem(m); 7322 return (error); 7323 } 7324 if (create_lock_applied) { 7325 SCTP_ASOC_CREATE_UNLOCK(inp); 7326 create_lock_applied = 0; 7327 } else { 7328 printf("Huh-1, create lock should have been applied!\n"); 7329 } 7330 queue_only = 1; 7331 asoc = &stcb->asoc; 7332 asoc->state = SCTP_STATE_COOKIE_WAIT; 7333 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 7334 if (control) { 7335 /* see if a init structure exists in cmsg headers */ 7336 struct sctp_initmsg initm; 7337 int i; 7338 if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, 7339 sizeof(initm))) { 7340 /* we have an INIT override of the default */ 7341 if (initm.sinit_max_attempts) 7342 asoc->max_init_times = initm.sinit_max_attempts; 7343 if (initm.sinit_num_ostreams) 7344 asoc->pre_open_streams = initm.sinit_num_ostreams; 7345 if (initm.sinit_max_instreams) 7346 asoc->max_inbound_streams = initm.sinit_max_instreams; 7347 if (initm.sinit_max_init_timeo) 7348 asoc->initial_init_rto_max = initm.sinit_max_init_timeo; 7349 } 7350 if (asoc->streamoutcnt < asoc->pre_open_streams) { 7351 /* Default is NOT correct */ 7352 #ifdef SCTP_DEBUG 7353 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7354 printf("Ok, defout:%d pre_open:%d\n", 7355 asoc->streamoutcnt, asoc->pre_open_streams); 7356 } 7357 #endif 7358 free(asoc->strmout, M_PCB); 7359 asoc->strmout = NULL; 7360 asoc->streamoutcnt = asoc->pre_open_streams; 7361 asoc->strmout = malloc(asoc->streamoutcnt * 7362 sizeof(struct sctp_stream_out), M_PCB, 7363 M_WAIT); 7364 for (i = 0; i < asoc->streamoutcnt; i++) { 7365 /* 7366 * inbound side must be set to 0xffff, 7367 * also NOTE when we get the INIT-ACK 7368 * back (for INIT sender) we MUST 7369 * reduce the count (streamoutcnt) but 7370 * first check if we sent to any of the 7371 * upper streams that were dropped (if 7372 * some were). Those that were dropped 7373 * must be notified to the upper layer 7374 * as failed to send. 7375 */ 7376 asoc->strmout[i].next_sequence_sent = 0x0; 7377 TAILQ_INIT(&asoc->strmout[i].outqueue); 7378 asoc->strmout[i].stream_no = i; 7379 asoc->strmout[i].next_spoke.tqe_next = 0; 7380 asoc->strmout[i].next_spoke.tqe_prev = 0; 7381 } 7382 } 7383 } 7384 sctp_send_initiate(inp, stcb); 7385 /* 7386 * we may want to dig in after this call and adjust the MTU 7387 * value. It defaulted to 1500 (constant) but the ro structure 7388 * may now have an update and thus we may need to change it 7389 * BEFORE we append the message. 7390 */ 7391 net = stcb->asoc.primary_destination; 7392 } else { 7393 if (create_lock_applied) { 7394 SCTP_ASOC_CREATE_UNLOCK(inp); 7395 create_lock_applied = 0; 7396 } 7397 asoc = &stcb->asoc; 7398 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 7399 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 7400 queue_only = 1; 7401 } 7402 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 7403 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 7404 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 7405 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 7406 if (control) { 7407 sctppcbinfo.mbuf_track--; 7408 sctp_m_freem(control); 7409 control = NULL; 7410 } 7411 if ((use_rcvinfo) && 7412 (srcv.sinfo_flags & MSG_ABORT)) { 7413 sctp_msg_append(stcb, net, m, &srcv, flags); 7414 error = 0; 7415 } else { 7416 if (m) 7417 sctp_m_freem(m); 7418 error = ECONNRESET; 7419 } 7420 SCTP_TCB_UNLOCK(stcb); 7421 return (error); 7422 } 7423 } 7424 if (create_lock_applied) { 7425 /* we should never hit here with the create lock applied 7426 * 7427 */ 7428 SCTP_ASOC_CREATE_UNLOCK(inp); 7429 create_lock_applied = 0; 7430 } 7431 7432 7433 if (use_rcvinfo == 0) { 7434 srcv = stcb->asoc.def_send; 7435 } 7436 #ifdef SCTP_DEBUG 7437 else { 7438 if (sctp_debug_on & SCTP_DEBUG_OUTPUT5) { 7439 printf("stream:%d\n", srcv.sinfo_stream); 7440 printf("flags:%x\n", (u_int)srcv.sinfo_flags); 7441 printf("ppid:%d\n", srcv.sinfo_ppid); 7442 printf("context:%d\n", srcv.sinfo_context); 7443 } 7444 } 7445 #endif 7446 if (control) { 7447 sctppcbinfo.mbuf_track--; 7448 sctp_m_freem(control); 7449 control = NULL; 7450 } 7451 if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) { 7452 /* we take the override or the unconfirmed */ 7453 ; 7454 } else { 7455 net = stcb->asoc.primary_destination; 7456 } 7457 if ((error = sctp_msg_append(stcb, net, m, &srcv, flags))) { 7458 SCTP_TCB_UNLOCK(stcb); 7459 return (error); 7460 } 7461 if (net->flight_size > net->cwnd) { 7462 sctp_pegs[SCTP_SENDTO_FULL_CWND]++; 7463 queue_only = 1; 7464 } else if (asoc->ifp_had_enobuf) { 7465 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++; 7466 queue_only = 1; 7467 } else { 7468 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 7469 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) + 7470 SCTP_MED_OVERHEAD); 7471 7472 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) && 7473 (stcb->asoc.total_flight > 0) && 7474 (un_sent < (int)stcb->asoc.smallest_mtu) 7475 ) { 7476 7477 /* Ok, Nagle is set on and we have 7478 * data outstanding. Don't send anything 7479 * and let the SACK drive out the data. 7480 */ 7481 sctp_pegs[SCTP_NAGLE_NOQ]++; 7482 queue_only = 1; 7483 } else { 7484 sctp_pegs[SCTP_NAGLE_OFF]++; 7485 } 7486 } 7487 if ((queue_only == 0) && stcb->asoc.peers_rwnd) { 7488 /* we can attempt to send too.*/ 7489 #ifdef SCTP_DEBUG 7490 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7491 printf("USR Send calls sctp_chunk_output\n"); 7492 } 7493 #endif 7494 #ifdef SCTP_AUDITING_ENABLED 7495 sctp_audit_log(0xC0, 1); 7496 sctp_auditing(6, inp, stcb, net); 7497 #endif 7498 sctp_pegs[SCTP_OUTPUT_FRM_SND]++; 7499 sctp_chunk_output(inp, stcb, 0); 7500 #ifdef SCTP_AUDITING_ENABLED 7501 sctp_audit_log(0xC0, 2); 7502 sctp_auditing(7, inp, stcb, net); 7503 #endif 7504 7505 } 7506 #ifdef SCTP_DEBUG 7507 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 7508 printf("USR Send complete qo:%d prw:%d\n", queue_only, stcb->asoc.peers_rwnd); 7509 } 7510 #endif 7511 SCTP_TCB_UNLOCK(stcb); 7512 return (0); 7513 } 7514 7515 void 7516 send_forward_tsn(struct sctp_tcb *stcb, 7517 struct sctp_association *asoc) 7518 { 7519 struct sctp_tmit_chunk *chk; 7520 struct sctp_forward_tsn_chunk *fwdtsn; 7521 7522 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7523 if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) { 7524 /* mark it to unsent */ 7525 chk->sent = SCTP_DATAGRAM_UNSENT; 7526 chk->snd_count = 0; 7527 /* Do we correct its output location? */ 7528 if (chk->whoTo != asoc->primary_destination) { 7529 sctp_free_remote_addr(chk->whoTo); 7530 chk->whoTo = asoc->primary_destination; 7531 chk->whoTo->ref_count++; 7532 } 7533 goto sctp_fill_in_rest; 7534 } 7535 } 7536 /* Ok if we reach here we must build one */ 7537 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 7538 if (chk == NULL) { 7539 return; 7540 } 7541 sctppcbinfo.ipi_count_chunk++; 7542 sctppcbinfo.ipi_gencnt_chunk++; 7543 chk->rec.chunk_id = SCTP_FORWARD_CUM_TSN; 7544 chk->asoc = asoc; 7545 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 7546 if (chk->data == NULL) { 7547 chk->whoTo->ref_count--; 7548 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 7549 sctppcbinfo.ipi_count_chunk--; 7550 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 7551 panic("Chunk count is negative"); 7552 } 7553 sctppcbinfo.ipi_gencnt_chunk++; 7554 return; 7555 } 7556 chk->data->m_data += SCTP_MIN_OVERHEAD; 7557 chk->sent = SCTP_DATAGRAM_UNSENT; 7558 chk->snd_count = 0; 7559 chk->whoTo = asoc->primary_destination; 7560 chk->whoTo->ref_count++; 7561 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next); 7562 asoc->ctrl_queue_cnt++; 7563 sctp_fill_in_rest: 7564 /* Here we go through and fill out the part that 7565 * deals with stream/seq of the ones we skip. 7566 */ 7567 chk->data->m_pkthdr.len = chk->data->m_len = 0; 7568 { 7569 struct sctp_tmit_chunk *at, *tp1, *last; 7570 struct sctp_strseq *strseq; 7571 unsigned int cnt_of_space, i, ovh; 7572 unsigned int space_needed; 7573 unsigned int cnt_of_skipped = 0; 7574 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) { 7575 if (at->sent != SCTP_FORWARD_TSN_SKIP) { 7576 /* no more to look at */ 7577 break; 7578 } 7579 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 7580 /* We don't report these */ 7581 continue; 7582 } 7583 cnt_of_skipped++; 7584 } 7585 space_needed = (sizeof(struct sctp_forward_tsn_chunk) + 7586 (cnt_of_skipped * sizeof(struct sctp_strseq))); 7587 if ((M_TRAILINGSPACE(chk->data) < (int)space_needed) && 7588 ((chk->data->m_flags & M_EXT) == 0)) { 7589 /* Need a M_EXT, get one and move 7590 * fwdtsn to data area. 7591 */ 7592 MCLGET(chk->data, M_DONTWAIT); 7593 } 7594 cnt_of_space = M_TRAILINGSPACE(chk->data); 7595 7596 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 7597 ovh = SCTP_MIN_OVERHEAD; 7598 } else { 7599 ovh = SCTP_MIN_V4_OVERHEAD; 7600 } 7601 if (cnt_of_space > (asoc->smallest_mtu-ovh)) { 7602 /* trim to a mtu size */ 7603 cnt_of_space = asoc->smallest_mtu - ovh; 7604 } 7605 if (cnt_of_space < space_needed) { 7606 /* ok we must trim down the chunk by lowering 7607 * the advance peer ack point. 7608 */ 7609 cnt_of_skipped = (cnt_of_space- 7610 ((sizeof(struct sctp_forward_tsn_chunk))/ 7611 sizeof(struct sctp_strseq))); 7612 /* Go through and find the TSN that 7613 * will be the one we report. 7614 */ 7615 at = TAILQ_FIRST(&asoc->sent_queue); 7616 for (i = 0; i < cnt_of_skipped; i++) { 7617 tp1 = TAILQ_NEXT(at, sctp_next); 7618 at = tp1; 7619 } 7620 last = at; 7621 /* last now points to last one I can report, update peer ack point */ 7622 asoc->advanced_peer_ack_point = last->rec.data.TSN_seq; 7623 space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq)); 7624 } 7625 chk->send_size = space_needed; 7626 /* Setup the chunk */ 7627 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *); 7628 fwdtsn->ch.chunk_length = htons(chk->send_size); 7629 fwdtsn->ch.chunk_flags = 0; 7630 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN; 7631 fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point); 7632 chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) + 7633 (cnt_of_skipped * sizeof(struct sctp_strseq))); 7634 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size; 7635 fwdtsn++; 7636 /* Move pointer to after the fwdtsn and transfer to 7637 * the strseq pointer. 7638 */ 7639 strseq = (struct sctp_strseq *)fwdtsn; 7640 /* 7641 * Now populate the strseq list. This is done blindly 7642 * without pulling out duplicate stream info. This is 7643 * inefficent but won't harm the process since the peer 7644 * will look at these in sequence and will thus release 7645 * anything. It could mean we exceed the PMTU and chop 7646 * off some that we could have included.. but this is 7647 * unlikely (aka 1432/4 would mean 300+ stream seq's would 7648 * have to be reported in one FWD-TSN. With a bit of work 7649 * we can later FIX this to optimize and pull out duplcates.. 7650 * but it does add more overhead. So for now... not! 7651 */ 7652 at = TAILQ_FIRST(&asoc->sent_queue); 7653 for (i = 0; i < cnt_of_skipped; i++) { 7654 tp1 = TAILQ_NEXT(at, sctp_next); 7655 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 7656 /* We don't report these */ 7657 i--; 7658 at = tp1; 7659 continue; 7660 } 7661 strseq->stream = ntohs(at->rec.data.stream_number); 7662 strseq->sequence = ntohs(at->rec.data.stream_seq); 7663 strseq++; 7664 at = tp1; 7665 } 7666 } 7667 return; 7668 7669 } 7670 7671 void 7672 sctp_send_sack(struct sctp_tcb *stcb) 7673 { 7674 /* 7675 * Queue up a SACK in the control queue. We must first check to 7676 * see if a SACK is somehow on the control queue. If so, we will 7677 * take and and remove the old one. 7678 */ 7679 struct sctp_association *asoc; 7680 struct sctp_tmit_chunk *chk, *a_chk; 7681 struct sctp_sack_chunk *sack; 7682 struct sctp_gap_ack_block *gap_descriptor; 7683 uint32_t *dup; 7684 int start; 7685 unsigned int i, maxi, seeing_ones, m_size; 7686 unsigned int num_gap_blocks, space; 7687 7688 start = maxi = 0; 7689 seeing_ones = 1; 7690 a_chk = NULL; 7691 asoc = &stcb->asoc; 7692 if (asoc->last_data_chunk_from == NULL) { 7693 /* Hmm we never received anything */ 7694 return; 7695 } 7696 sctp_set_rwnd(stcb, asoc); 7697 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 7698 if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) { 7699 /* Hmm, found a sack already on queue, remove it */ 7700 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 7701 asoc->ctrl_queue_cnt++; 7702 a_chk = chk; 7703 if (a_chk->data) 7704 sctp_m_freem(a_chk->data); 7705 a_chk->data = NULL; 7706 sctp_free_remote_addr(a_chk->whoTo); 7707 a_chk->whoTo = NULL; 7708 break; 7709 } 7710 } 7711 if (a_chk == NULL) { 7712 a_chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 7713 if (a_chk == NULL) { 7714 /* No memory so we drop the idea, and set a timer */ 7715 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 7716 stcb->sctp_ep, stcb, NULL); 7717 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 7718 stcb->sctp_ep, stcb, NULL); 7719 return; 7720 } 7721 sctppcbinfo.ipi_count_chunk++; 7722 sctppcbinfo.ipi_gencnt_chunk++; 7723 a_chk->rec.chunk_id = SCTP_SELECTIVE_ACK; 7724 } 7725 a_chk->asoc = asoc; 7726 a_chk->snd_count = 0; 7727 a_chk->send_size = 0; /* fill in later */ 7728 a_chk->sent = SCTP_DATAGRAM_UNSENT; 7729 m_size = (asoc->mapping_array_size << 3); 7730 7731 if ((asoc->numduptsns) || 7732 (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE) 7733 ) { 7734 /* Ok, we have some duplicates or the destination for the 7735 * sack is unreachable, lets see if we can select an alternate 7736 * than asoc->last_data_chunk_from 7737 */ 7738 if ((!(asoc->last_data_chunk_from->dest_state & 7739 SCTP_ADDR_NOT_REACHABLE)) && 7740 (asoc->used_alt_onsack > 2)) { 7741 /* We used an alt last time, don't this time */ 7742 a_chk->whoTo = NULL; 7743 } else { 7744 asoc->used_alt_onsack++; 7745 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from); 7746 } 7747 if (a_chk->whoTo == NULL) { 7748 /* Nope, no alternate */ 7749 a_chk->whoTo = asoc->last_data_chunk_from; 7750 asoc->used_alt_onsack = 0; 7751 } 7752 } else { 7753 /* No duplicates so we use the last 7754 * place we received data from. 7755 */ 7756 #ifdef SCTP_DEBUG 7757 if (asoc->last_data_chunk_from == NULL) { 7758 printf("Huh, last_data_chunk_from is null when we want to sack??\n"); 7759 } 7760 #endif 7761 asoc->used_alt_onsack = 0; 7762 a_chk->whoTo = asoc->last_data_chunk_from; 7763 } 7764 if (a_chk->whoTo) 7765 a_chk->whoTo->ref_count++; 7766 7767 /* Ok now lets formulate a MBUF with our sack */ 7768 MGETHDR(a_chk->data, M_DONTWAIT, MT_DATA); 7769 if ((a_chk->data == NULL) || 7770 (a_chk->whoTo == NULL)) { 7771 /* rats, no mbuf memory */ 7772 if (a_chk->data) { 7773 /* was a problem with the destination */ 7774 sctp_m_freem(a_chk->data); 7775 a_chk->data = NULL; 7776 } 7777 a_chk->whoTo->ref_count--; 7778 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk); 7779 sctppcbinfo.ipi_count_chunk--; 7780 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 7781 panic("Chunk count is negative"); 7782 } 7783 sctppcbinfo.ipi_gencnt_chunk++; 7784 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 7785 stcb->sctp_ep, stcb, NULL); 7786 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 7787 stcb->sctp_ep, stcb, NULL); 7788 return; 7789 } 7790 /* First count the number of gap ack blocks we need */ 7791 if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) { 7792 /* We know if there are none above the cum-ack we 7793 * have everything with NO gaps 7794 */ 7795 num_gap_blocks = 0; 7796 } else { 7797 /* Ok we must count how many gaps we 7798 * have. 7799 */ 7800 num_gap_blocks = 0; 7801 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) { 7802 maxi = (asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn); 7803 } else { 7804 maxi = (asoc->highest_tsn_inside_map + (MAX_TSN - asoc->mapping_array_base_tsn) + 1); 7805 } 7806 if (maxi > m_size) { 7807 /* impossible but who knows, someone is playing with us :> */ 7808 #ifdef SCTP_DEBUG 7809 printf("GAK maxi:%d > m_size:%d came out higher than allowed htsn:%u base:%u cumack:%u\n", 7810 maxi, 7811 m_size, 7812 asoc->highest_tsn_inside_map, 7813 asoc->mapping_array_base_tsn, 7814 asoc->cumulative_tsn 7815 ); 7816 #endif 7817 num_gap_blocks = 0; 7818 goto no_gaps_now; 7819 } 7820 if (asoc->cumulative_tsn >= asoc->mapping_array_base_tsn) { 7821 start = (asoc->cumulative_tsn - asoc->mapping_array_base_tsn); 7822 } else { 7823 /* Set it so we start at 0 */ 7824 start = -1; 7825 } 7826 /* Ok move start up one to look at the NEXT past the cum-ack */ 7827 start++; 7828 for (i = start; i <= maxi; i++) { 7829 if (seeing_ones) { 7830 /* while seeing ones I must 7831 * transition back to 0 before 7832 * finding the next gap and 7833 * counting the segment. 7834 */ 7835 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) { 7836 seeing_ones = 0; 7837 } 7838 } else { 7839 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) { 7840 seeing_ones = 1; 7841 num_gap_blocks++; 7842 } 7843 } 7844 } 7845 no_gaps_now: 7846 if (num_gap_blocks == 0) { 7847 /* 7848 * Traveled all of the bits and NO one, 7849 * must have reneged 7850 */ 7851 if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN)) { 7852 asoc->highest_tsn_inside_map = asoc->cumulative_tsn; 7853 #ifdef SCTP_MAP_LOGGING 7854 sctp_log_map(0, 4, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 7855 #endif 7856 } 7857 } 7858 } 7859 7860 /* Now calculate the space needed */ 7861 space = (sizeof(struct sctp_sack_chunk) + 7862 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) + 7863 (asoc->numduptsns * sizeof(int32_t)) 7864 ); 7865 if (space > (asoc->smallest_mtu-SCTP_MAX_OVERHEAD)) { 7866 /* Reduce the size of the sack to fit */ 7867 int calc, fit; 7868 calc = (asoc->smallest_mtu - SCTP_MAX_OVERHEAD); 7869 calc -= sizeof(struct sctp_gap_ack_block); 7870 fit = calc/sizeof(struct sctp_gap_ack_block); 7871 if (fit > (int)num_gap_blocks) { 7872 /* discard some dups */ 7873 asoc->numduptsns = (fit - num_gap_blocks); 7874 } else { 7875 /* discard all dups and some gaps */ 7876 num_gap_blocks = fit; 7877 asoc->numduptsns = 0; 7878 } 7879 /* recalc space */ 7880 space = (sizeof(struct sctp_sack_chunk) + 7881 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) + 7882 (asoc->numduptsns * sizeof(int32_t)) 7883 ); 7884 7885 } 7886 7887 if ((space+SCTP_MIN_OVERHEAD) > MHLEN) { 7888 /* We need a cluster */ 7889 MCLGET(a_chk->data, M_DONTWAIT); 7890 if ((a_chk->data->m_flags & M_EXT) != M_EXT) { 7891 /* can't get a cluster 7892 * give up and try later. 7893 */ 7894 if (a_chk->data) 7895 sctp_m_freem(a_chk->data); 7896 a_chk->data = NULL; 7897 a_chk->whoTo->ref_count--; 7898 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk); 7899 sctppcbinfo.ipi_count_chunk--; 7900 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 7901 panic("Chunk count is negative"); 7902 } 7903 sctppcbinfo.ipi_gencnt_chunk++; 7904 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 7905 stcb->sctp_ep, stcb, NULL); 7906 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 7907 stcb->sctp_ep, stcb, NULL); 7908 return; 7909 } 7910 } 7911 7912 /* ok, lets go through and fill it in */ 7913 a_chk->data->m_data += SCTP_MIN_OVERHEAD; 7914 sack = mtod(a_chk->data, struct sctp_sack_chunk *); 7915 sack->ch.chunk_type = SCTP_SELECTIVE_ACK; 7916 sack->ch.chunk_flags = asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM; 7917 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn); 7918 sack->sack.a_rwnd = htonl(asoc->my_rwnd); 7919 asoc->my_last_reported_rwnd = asoc->my_rwnd; 7920 sack->sack.num_gap_ack_blks = htons(num_gap_blocks); 7921 sack->sack.num_dup_tsns = htons(asoc->numduptsns); 7922 7923 a_chk->send_size = (sizeof(struct sctp_sack_chunk) + 7924 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) + 7925 (asoc->numduptsns * sizeof(int32_t))); 7926 a_chk->data->m_pkthdr.len = a_chk->data->m_len = a_chk->send_size; 7927 sack->ch.chunk_length = htons(a_chk->send_size); 7928 7929 gap_descriptor = (struct sctp_gap_ack_block *)((vaddr_t)sack + sizeof(struct sctp_sack_chunk)); 7930 seeing_ones = 0; 7931 for (i = start; i <= maxi; i++) { 7932 if (num_gap_blocks == 0) { 7933 break; 7934 } 7935 if (seeing_ones) { 7936 /* while seeing Ones I must 7937 * transition back to 0 before 7938 * finding the next gap 7939 */ 7940 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) { 7941 gap_descriptor->end = htons(((uint16_t)(i-start))); 7942 gap_descriptor++; 7943 seeing_ones = 0; 7944 num_gap_blocks--; 7945 } 7946 } else { 7947 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) { 7948 gap_descriptor->start = htons(((uint16_t)(i+1-start))); 7949 /* advance struct to next pointer */ 7950 seeing_ones = 1; 7951 } 7952 } 7953 } 7954 if (num_gap_blocks) { 7955 /* special case where the array is all 1's 7956 * to the end of the array. 7957 */ 7958 gap_descriptor->end = htons(((uint16_t)((i-start)))); 7959 gap_descriptor++; 7960 } 7961 /* now we must add any dups we are going to report. */ 7962 if (asoc->numduptsns) { 7963 dup = (uint32_t *)gap_descriptor; 7964 for (i = 0; i < asoc->numduptsns; i++) { 7965 *dup = htonl(asoc->dup_tsns[i]); 7966 dup++; 7967 } 7968 asoc->numduptsns = 0; 7969 } 7970 /* now that the chunk is prepared queue it to the control 7971 * chunk queue. 7972 */ 7973 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next); 7974 asoc->ctrl_queue_cnt++; 7975 sctp_pegs[SCTP_PEG_SACKS_SENT]++; 7976 return; 7977 } 7978 7979 void 7980 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr) 7981 { 7982 struct mbuf *m_abort; 7983 struct sctp_abort_msg *abort_m; 7984 int sz; 7985 abort_m = NULL; 7986 MGETHDR(m_abort, M_DONTWAIT, MT_HEADER); 7987 if (m_abort == NULL) { 7988 /* no mbuf's */ 7989 return; 7990 } 7991 m_abort->m_data += SCTP_MIN_OVERHEAD; 7992 abort_m = mtod(m_abort, struct sctp_abort_msg *); 7993 m_abort->m_len = sizeof(struct sctp_abort_msg); 7994 m_abort->m_next = operr; 7995 sz = 0; 7996 if (operr) { 7997 struct mbuf *n; 7998 n = operr; 7999 while (n) { 8000 sz += n->m_len; 8001 n = n->m_next; 8002 } 8003 } 8004 abort_m->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION; 8005 abort_m->msg.ch.chunk_flags = 0; 8006 abort_m->msg.ch.chunk_length = htons(sizeof(struct sctp_abort_chunk) + 8007 sz); 8008 abort_m->sh.src_port = stcb->sctp_ep->sctp_lport; 8009 abort_m->sh.dest_port = stcb->rport; 8010 abort_m->sh.v_tag = htonl(stcb->asoc.peer_vtag); 8011 abort_m->sh.checksum = 0; 8012 m_abort->m_pkthdr.len = m_abort->m_len + sz; 8013 m_reset_rcvif(m_abort); 8014 sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, 8015 stcb->asoc.primary_destination, 8016 rtcache_getdst(&stcb->asoc.primary_destination->ro), 8017 m_abort, 1, 0, NULL, 0); 8018 } 8019 8020 int 8021 sctp_send_shutdown_complete(struct sctp_tcb *stcb, 8022 struct sctp_nets *net) 8023 8024 { 8025 /* formulate and SEND a SHUTDOWN-COMPLETE */ 8026 struct mbuf *m_shutdown_comp; 8027 struct sctp_shutdown_complete_msg *comp_cp; 8028 8029 m_shutdown_comp = NULL; 8030 MGETHDR(m_shutdown_comp, M_DONTWAIT, MT_HEADER); 8031 if (m_shutdown_comp == NULL) { 8032 /* no mbuf's */ 8033 return (-1); 8034 } 8035 m_shutdown_comp->m_data += sizeof(struct ip6_hdr); 8036 comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *); 8037 comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 8038 comp_cp->shut_cmp.ch.chunk_flags = 0; 8039 comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 8040 comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport; 8041 comp_cp->sh.dest_port = stcb->rport; 8042 comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag); 8043 comp_cp->sh.checksum = 0; 8044 8045 m_shutdown_comp->m_pkthdr.len = m_shutdown_comp->m_len = sizeof(struct sctp_shutdown_complete_msg); 8046 m_reset_rcvif(m_shutdown_comp); 8047 sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net, 8048 rtcache_getdst(&net->ro), m_shutdown_comp, 8049 1, 0, NULL, 0); 8050 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 8051 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 8052 stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED; 8053 stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0; 8054 soisdisconnected(stcb->sctp_ep->sctp_socket); 8055 } 8056 return (0); 8057 } 8058 8059 int 8060 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh) 8061 { 8062 /* formulate and SEND a SHUTDOWN-COMPLETE */ 8063 struct mbuf *mout; 8064 struct ip *iph, *iph_out; 8065 struct ip6_hdr *ip6, *ip6_out; 8066 int offset_out; 8067 struct sctp_shutdown_complete_msg *comp_cp; 8068 8069 MGETHDR(mout, M_DONTWAIT, MT_HEADER); 8070 if (mout == NULL) { 8071 /* no mbuf's */ 8072 return (-1); 8073 } 8074 iph = mtod(m, struct ip *); 8075 iph_out = NULL; 8076 ip6_out = NULL; 8077 offset_out = 0; 8078 if (iph->ip_v == IPVERSION) { 8079 mout->m_len = sizeof(struct ip) + 8080 sizeof(struct sctp_shutdown_complete_msg); 8081 mout->m_next = NULL; 8082 iph_out = mtod(mout, struct ip *); 8083 8084 /* Fill in the IP header for the ABORT */ 8085 iph_out->ip_v = IPVERSION; 8086 iph_out->ip_hl = (sizeof(struct ip)/4); 8087 iph_out->ip_tos = (u_char)0; 8088 iph_out->ip_id = 0; 8089 iph_out->ip_off = 0; 8090 iph_out->ip_ttl = MAXTTL; 8091 iph_out->ip_p = IPPROTO_SCTP; 8092 iph_out->ip_src.s_addr = iph->ip_dst.s_addr; 8093 iph_out->ip_dst.s_addr = iph->ip_src.s_addr; 8094 8095 /* let IP layer calculate this */ 8096 iph_out->ip_sum = 0; 8097 offset_out += sizeof(*iph_out); 8098 comp_cp = (struct sctp_shutdown_complete_msg *)( 8099 (vaddr_t)iph_out + offset_out); 8100 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 8101 ip6 = (struct ip6_hdr *)iph; 8102 mout->m_len = sizeof(struct ip6_hdr) + 8103 sizeof(struct sctp_shutdown_complete_msg); 8104 mout->m_next = NULL; 8105 ip6_out = mtod(mout, struct ip6_hdr *); 8106 8107 /* Fill in the IPv6 header for the ABORT */ 8108 ip6_out->ip6_flow = ip6->ip6_flow; 8109 ip6_out->ip6_hlim = ip6_defhlim; 8110 ip6_out->ip6_nxt = IPPROTO_SCTP; 8111 ip6_out->ip6_src = ip6->ip6_dst; 8112 ip6_out->ip6_dst = ip6->ip6_src; 8113 ip6_out->ip6_plen = mout->m_len; 8114 offset_out += sizeof(*ip6_out); 8115 comp_cp = (struct sctp_shutdown_complete_msg *)( 8116 (vaddr_t)ip6_out + offset_out); 8117 } else { 8118 /* Currently not supported. */ 8119 return (-1); 8120 } 8121 8122 /* Now copy in and fill in the ABORT tags etc. */ 8123 comp_cp->sh.src_port = sh->dest_port; 8124 comp_cp->sh.dest_port = sh->src_port; 8125 comp_cp->sh.checksum = 0; 8126 comp_cp->sh.v_tag = sh->v_tag; 8127 comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB; 8128 comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE; 8129 comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk)); 8130 8131 mout->m_pkthdr.len = mout->m_len; 8132 /* add checksum */ 8133 if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL && 8134 m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) { 8135 comp_cp->sh.checksum = 0; 8136 } else { 8137 comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out); 8138 } 8139 8140 /* zap the rcvif, it should be null */ 8141 m_reset_rcvif(mout); 8142 /* zap the stack pointer to the route */ 8143 if (iph_out != NULL) { 8144 struct route ro; 8145 8146 memset(&ro, 0, sizeof ro); 8147 #ifdef SCTP_DEBUG 8148 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 8149 printf("sctp_shutdown_complete2 calling ip_output:\n"); 8150 sctp_print_address_pkt(iph_out, &comp_cp->sh); 8151 } 8152 #endif 8153 /* set IPv4 length */ 8154 iph_out->ip_len = htons(mout->m_pkthdr.len); 8155 /* out it goes */ 8156 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL, NULL); 8157 } else if (ip6_out != NULL) { 8158 struct route ro; 8159 8160 memset(&ro, 0, sizeof(ro)); 8161 #ifdef SCTP_DEBUG 8162 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 8163 printf("sctp_shutdown_complete2 calling ip6_output:\n"); 8164 sctp_print_address_pkt((struct ip *)ip6_out, 8165 &comp_cp->sh); 8166 } 8167 #endif 8168 ip6_output(mout, NULL, &ro, 0, NULL, NULL, NULL); 8169 } 8170 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 8171 return (0); 8172 } 8173 8174 static struct sctp_nets * 8175 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now) 8176 { 8177 struct sctp_nets *net, *hnet; 8178 int ms_goneby, highest_ms, state_overide=0; 8179 8180 SCTP_GETTIME_TIMEVAL(now); 8181 highest_ms = 0; 8182 hnet = NULL; 8183 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 8184 if ( 8185 ((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) || 8186 (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE) 8187 ) { 8188 /* Skip this guy from consideration if HB is off AND its confirmed*/ 8189 #ifdef SCTP_DEBUG 8190 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8191 printf("Skipping net:%p state:%d nohb/out-of-scope\n", 8192 net, net->dest_state); 8193 } 8194 #endif 8195 continue; 8196 } 8197 if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro.ro_sa) == 0) { 8198 /* skip this dest net from consideration */ 8199 #ifdef SCTP_DEBUG 8200 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8201 printf("Skipping net:%p reachable NOT\n", 8202 net); 8203 } 8204 #endif 8205 continue; 8206 } 8207 if (net->last_sent_time.tv_sec) { 8208 /* Sent to so we subtract */ 8209 ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000; 8210 } else 8211 /* Never been sent to */ 8212 ms_goneby = 0x7fffffff; 8213 #ifdef SCTP_DEBUG 8214 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8215 printf("net:%p ms_goneby:%d\n", 8216 net, ms_goneby); 8217 } 8218 #endif 8219 /* When the address state is unconfirmed but still considered reachable, we 8220 * HB at a higher rate. Once it goes confirmed OR reaches the "unreachable" 8221 * state, thenw we cut it back to HB at a more normal pace. 8222 */ 8223 if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) { 8224 state_overide = 1; 8225 } else { 8226 state_overide = 0; 8227 } 8228 8229 if ((((unsigned int)ms_goneby >= net->RTO) || (state_overide)) && 8230 (ms_goneby > highest_ms)) { 8231 highest_ms = ms_goneby; 8232 hnet = net; 8233 #ifdef SCTP_DEBUG 8234 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8235 printf("net:%p is the new high\n", 8236 net); 8237 } 8238 #endif 8239 } 8240 } 8241 if (hnet && 8242 ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) { 8243 state_overide = 1; 8244 } else { 8245 state_overide = 0; 8246 } 8247 8248 if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_overide)) { 8249 /* Found the one with longest delay bounds 8250 * OR it is unconfirmed and still not marked 8251 * unreachable. 8252 */ 8253 #ifdef SCTP_DEBUG 8254 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8255 printf("net:%p is the hb winner -", 8256 hnet); 8257 if (hnet) 8258 sctp_print_address((struct sockaddr *)&hnet->ro.ro_sa); 8259 else 8260 printf(" none\n"); 8261 } 8262 #endif 8263 /* update the timer now */ 8264 hnet->last_sent_time = *now; 8265 return (hnet); 8266 } 8267 /* Nothing to HB */ 8268 return (NULL); 8269 } 8270 8271 int 8272 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net) 8273 { 8274 struct sctp_tmit_chunk *chk; 8275 struct sctp_nets *net; 8276 struct sctp_heartbeat_chunk *hb; 8277 struct timeval now; 8278 struct sockaddr_in *sin; 8279 struct sockaddr_in6 *sin6; 8280 8281 if (user_req == 0) { 8282 net = sctp_select_hb_destination(stcb, &now); 8283 if (net == NULL) { 8284 /* All our busy none to send to, just 8285 * start the timer again. 8286 */ 8287 if (stcb->asoc.state == 0) { 8288 return (0); 8289 } 8290 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, 8291 stcb->sctp_ep, 8292 stcb, 8293 net); 8294 return (0); 8295 } 8296 #ifndef SCTP_USE_ALLMAN_BURST 8297 else { 8298 /* found one idle.. decay cwnd on this one 8299 * by 1/2 if none outstanding. 8300 */ 8301 8302 if (net->flight_size == 0) { 8303 net->cwnd /= 2; 8304 if (net->addr_is_local) { 8305 if (net->cwnd < (net->mtu *4)) { 8306 net->cwnd = net->mtu * 4; 8307 } 8308 } else { 8309 if (net->cwnd < (net->mtu * 2)) { 8310 net->cwnd = net->mtu * 2; 8311 } 8312 } 8313 8314 } 8315 8316 } 8317 #endif 8318 } else { 8319 net = u_net; 8320 if (net == NULL) { 8321 return (0); 8322 } 8323 SCTP_GETTIME_TIMEVAL(&now); 8324 } 8325 sin = (struct sockaddr_in *)&net->ro.ro_sa; 8326 if (sin->sin_family != AF_INET) { 8327 if (sin->sin_family != AF_INET6) { 8328 /* huh */ 8329 return (0); 8330 } 8331 } 8332 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8333 if (chk == NULL) { 8334 #ifdef SCTP_DEBUG 8335 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8336 printf("Gak, can't get a chunk for hb\n"); 8337 } 8338 #endif 8339 return (0); 8340 } 8341 sctppcbinfo.ipi_gencnt_chunk++; 8342 sctppcbinfo.ipi_count_chunk++; 8343 chk->rec.chunk_id = SCTP_HEARTBEAT_REQUEST; 8344 chk->asoc = &stcb->asoc; 8345 chk->send_size = sizeof(struct sctp_heartbeat_chunk); 8346 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8347 if (chk->data == NULL) { 8348 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8349 sctppcbinfo.ipi_count_chunk--; 8350 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8351 panic("Chunk count is negative"); 8352 } 8353 sctppcbinfo.ipi_gencnt_chunk++; 8354 return (0); 8355 } 8356 chk->data->m_data += SCTP_MIN_OVERHEAD; 8357 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size; 8358 chk->sent = SCTP_DATAGRAM_UNSENT; 8359 chk->snd_count = 0; 8360 chk->whoTo = net; 8361 chk->whoTo->ref_count++; 8362 /* Now we have a mbuf that we can fill in with the details */ 8363 hb = mtod(chk->data, struct sctp_heartbeat_chunk *); 8364 8365 /* fill out chunk header */ 8366 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST; 8367 hb->ch.chunk_flags = 0; 8368 hb->ch.chunk_length = htons(chk->send_size); 8369 /* Fill out hb parameter */ 8370 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO); 8371 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param)); 8372 hb->heartbeat.hb_info.time_value_1 = now.tv_sec; 8373 hb->heartbeat.hb_info.time_value_2 = now.tv_usec; 8374 /* Did our user request this one, put it in */ 8375 hb->heartbeat.hb_info.user_req = user_req; 8376 hb->heartbeat.hb_info.addr_family = sin->sin_family; 8377 hb->heartbeat.hb_info.addr_len = sin->sin_len; 8378 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 8379 /* we only take from the entropy pool if the address is 8380 * not confirmed. 8381 */ 8382 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 8383 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep); 8384 } else { 8385 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0; 8386 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0; 8387 } 8388 if (sin->sin_family == AF_INET) { 8389 memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr)); 8390 } else if (sin->sin_family == AF_INET6) { 8391 /* We leave the scope the way it is in our lookup table. */ 8392 sin6 = (struct sockaddr_in6 *)&net->ro.ro_sa; 8393 memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr)); 8394 } else { 8395 /* huh compiler bug */ 8396 #ifdef SCTP_DEBUG 8397 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 8398 printf("Compiler bug bleeds a mbuf and a chunk\n"); 8399 } 8400 #endif 8401 return (0); 8402 } 8403 /* ok we have a destination that needs a beat */ 8404 /* lets do the theshold management Qiaobing style */ 8405 if (user_req == 0) { 8406 if (sctp_threshold_management(stcb->sctp_ep, stcb, net, 8407 stcb->asoc.max_send_times)) { 8408 /* we have lost the association, in a way this 8409 * is quite bad since we really are one less time 8410 * since we really did not send yet. This is the 8411 * down side to the Q's style as defined in the RFC 8412 * and not my alternate style defined in the RFC. 8413 */ 8414 if (chk->data != NULL) { 8415 sctp_m_freem(chk->data); 8416 chk->data = NULL; 8417 } 8418 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8419 sctppcbinfo.ipi_count_chunk--; 8420 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8421 panic("Chunk count is negative"); 8422 } 8423 sctppcbinfo.ipi_gencnt_chunk++; 8424 return (-1); 8425 } 8426 } 8427 net->hb_responded = 0; 8428 #ifdef SCTP_DEBUG 8429 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 8430 printf("Inserting chunk for HB\n"); 8431 } 8432 #endif 8433 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8434 stcb->asoc.ctrl_queue_cnt++; 8435 sctp_pegs[SCTP_HB_SENT]++; 8436 /* 8437 * Call directly med level routine to put out the chunk. It will 8438 * always tumble out control chunks aka HB but it may even tumble 8439 * out data too. 8440 */ 8441 if (user_req == 0) { 8442 /* Ok now lets start the HB timer if it is NOT a user req */ 8443 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, 8444 stcb, net); 8445 } 8446 return (1); 8447 } 8448 8449 void 8450 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net, 8451 uint32_t high_tsn) 8452 { 8453 struct sctp_association *asoc; 8454 struct sctp_ecne_chunk *ecne; 8455 struct sctp_tmit_chunk *chk; 8456 asoc = &stcb->asoc; 8457 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 8458 if (chk->rec.chunk_id == SCTP_ECN_ECHO) { 8459 /* found a previous ECN_ECHO update it if needed */ 8460 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 8461 ecne->tsn = htonl(high_tsn); 8462 return; 8463 } 8464 } 8465 /* nope could not find one to update so we must build one */ 8466 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8467 if (chk == NULL) { 8468 return; 8469 } 8470 sctp_pegs[SCTP_ECNE_SENT]++; 8471 sctppcbinfo.ipi_count_chunk++; 8472 sctppcbinfo.ipi_gencnt_chunk++; 8473 chk->rec.chunk_id = SCTP_ECN_ECHO; 8474 chk->asoc = &stcb->asoc; 8475 chk->send_size = sizeof(struct sctp_ecne_chunk); 8476 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8477 if (chk->data == NULL) { 8478 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8479 sctppcbinfo.ipi_count_chunk--; 8480 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8481 panic("Chunk count is negative"); 8482 } 8483 sctppcbinfo.ipi_gencnt_chunk++; 8484 return; 8485 } 8486 chk->data->m_data += SCTP_MIN_OVERHEAD; 8487 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size; 8488 chk->sent = SCTP_DATAGRAM_UNSENT; 8489 chk->snd_count = 0; 8490 chk->whoTo = net; 8491 chk->whoTo->ref_count++; 8492 ecne = mtod(chk->data, struct sctp_ecne_chunk *); 8493 ecne->ch.chunk_type = SCTP_ECN_ECHO; 8494 ecne->ch.chunk_flags = 0; 8495 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk)); 8496 ecne->tsn = htonl(high_tsn); 8497 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8498 asoc->ctrl_queue_cnt++; 8499 } 8500 8501 void 8502 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net, 8503 struct mbuf *m, int iphlen, int bad_crc) 8504 { 8505 struct sctp_association *asoc; 8506 struct sctp_pktdrop_chunk *drp; 8507 struct sctp_tmit_chunk *chk; 8508 uint8_t *datap; 8509 int len; 8510 unsigned int small_one; 8511 struct ip *iph; 8512 8513 long spc; 8514 asoc = &stcb->asoc; 8515 if (asoc->peer_supports_pktdrop == 0) { 8516 /* peer must declare support before I 8517 * send one. 8518 */ 8519 return; 8520 } 8521 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8522 if (chk == NULL) { 8523 return; 8524 } 8525 sctppcbinfo.ipi_count_chunk++; 8526 sctppcbinfo.ipi_gencnt_chunk++; 8527 8528 iph = mtod(m, struct ip *); 8529 if (iph == NULL) { 8530 return; 8531 } 8532 if (iph->ip_v == IPVERSION) { 8533 /* IPv4 */ 8534 #if defined(__FreeBSD__) 8535 len = chk->send_size = iph->ip_len; 8536 #else 8537 len = chk->send_size = (iph->ip_len - iphlen); 8538 #endif 8539 } else { 8540 struct ip6_hdr *ip6h; 8541 /* IPv6 */ 8542 ip6h = mtod(m, struct ip6_hdr *); 8543 len = chk->send_size = htons(ip6h->ip6_plen); 8544 } 8545 if ((len+iphlen) > m->m_pkthdr.len) { 8546 /* huh */ 8547 chk->send_size = len = m->m_pkthdr.len - iphlen; 8548 } 8549 chk->asoc = &stcb->asoc; 8550 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8551 if (chk->data == NULL) { 8552 jump_out: 8553 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8554 sctppcbinfo.ipi_count_chunk--; 8555 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8556 panic("Chunk count is negative"); 8557 } 8558 sctppcbinfo.ipi_gencnt_chunk++; 8559 return; 8560 } 8561 if ((chk->send_size+sizeof(struct sctp_pktdrop_chunk)+SCTP_MIN_OVERHEAD) > MHLEN) { 8562 MCLGET(chk->data, M_DONTWAIT); 8563 if ((chk->data->m_flags & M_EXT) == 0) { 8564 /* Give up */ 8565 sctp_m_freem(chk->data); 8566 chk->data = NULL; 8567 goto jump_out; 8568 } 8569 } 8570 chk->data->m_data += SCTP_MIN_OVERHEAD; 8571 drp = mtod(chk->data, struct sctp_pktdrop_chunk *); 8572 if (drp == NULL) { 8573 sctp_m_freem(chk->data); 8574 chk->data = NULL; 8575 goto jump_out; 8576 } 8577 small_one = asoc->smallest_mtu; 8578 if (small_one > MCLBYTES) { 8579 /* Only one cluster worth of data MAX */ 8580 small_one = MCLBYTES; 8581 } 8582 chk->book_size = (chk->send_size + sizeof(struct sctp_pktdrop_chunk) + 8583 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD); 8584 if (chk->book_size > small_one) { 8585 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED; 8586 drp->trunc_len = htons(chk->send_size); 8587 chk->send_size = small_one - (SCTP_MED_OVERHEAD + 8588 sizeof(struct sctp_pktdrop_chunk) + 8589 sizeof(struct sctphdr)); 8590 len = chk->send_size; 8591 } else { 8592 /* no truncation needed */ 8593 drp->ch.chunk_flags = 0; 8594 drp->trunc_len = htons(0); 8595 } 8596 if (bad_crc) { 8597 drp->ch.chunk_flags |= SCTP_BADCRC; 8598 } 8599 chk->send_size += sizeof(struct sctp_pktdrop_chunk); 8600 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size; 8601 chk->sent = SCTP_DATAGRAM_UNSENT; 8602 chk->snd_count = 0; 8603 if (net) { 8604 /* we should hit here */ 8605 chk->whoTo = net; 8606 } else { 8607 chk->whoTo = asoc->primary_destination; 8608 } 8609 chk->whoTo->ref_count++; 8610 chk->rec.chunk_id = SCTP_PACKET_DROPPED; 8611 drp->ch.chunk_type = SCTP_PACKET_DROPPED; 8612 drp->ch.chunk_length = htons(chk->send_size); 8613 spc = stcb->sctp_socket->so_rcv.sb_hiwat; 8614 if (spc < 0) { 8615 spc = 0; 8616 } 8617 drp->bottle_bw = htonl(spc); 8618 drp->current_onq = htonl(asoc->size_on_delivery_queue + 8619 asoc->size_on_reasm_queue + 8620 asoc->size_on_all_streams + 8621 asoc->my_rwnd_control_len + 8622 stcb->sctp_socket->so_rcv.sb_cc); 8623 drp->reserved = 0; 8624 datap = drp->data; 8625 m_copydata(m, iphlen, len, datap); 8626 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8627 asoc->ctrl_queue_cnt++; 8628 } 8629 8630 void 8631 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn) 8632 { 8633 struct sctp_association *asoc; 8634 struct sctp_cwr_chunk *cwr; 8635 struct sctp_tmit_chunk *chk; 8636 8637 asoc = &stcb->asoc; 8638 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) { 8639 if (chk->rec.chunk_id == SCTP_ECN_CWR) { 8640 /* found a previous ECN_CWR update it if needed */ 8641 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 8642 if (compare_with_wrap(high_tsn, ntohl(cwr->tsn), 8643 MAX_TSN)) { 8644 cwr->tsn = htonl(high_tsn); 8645 } 8646 return; 8647 } 8648 } 8649 /* nope could not find one to update so we must build one */ 8650 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8651 if (chk == NULL) { 8652 return; 8653 } 8654 sctppcbinfo.ipi_count_chunk++; 8655 sctppcbinfo.ipi_gencnt_chunk++; 8656 chk->rec.chunk_id = SCTP_ECN_CWR; 8657 chk->asoc = &stcb->asoc; 8658 chk->send_size = sizeof(struct sctp_cwr_chunk); 8659 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8660 if (chk->data == NULL) { 8661 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8662 sctppcbinfo.ipi_count_chunk--; 8663 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8664 panic("Chunk count is negative"); 8665 } 8666 sctppcbinfo.ipi_gencnt_chunk++; 8667 return; 8668 } 8669 chk->data->m_data += SCTP_MIN_OVERHEAD; 8670 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size; 8671 chk->sent = SCTP_DATAGRAM_UNSENT; 8672 chk->snd_count = 0; 8673 chk->whoTo = net; 8674 chk->whoTo->ref_count++; 8675 cwr = mtod(chk->data, struct sctp_cwr_chunk *); 8676 cwr->ch.chunk_type = SCTP_ECN_CWR; 8677 cwr->ch.chunk_flags = 0; 8678 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk)); 8679 cwr->tsn = htonl(high_tsn); 8680 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next); 8681 asoc->ctrl_queue_cnt++; 8682 } 8683 static void 8684 sctp_reset_the_streams(struct sctp_tcb *stcb, 8685 struct sctp_stream_reset_request *req, int number_entries, uint16_t *list) 8686 { 8687 int i; 8688 8689 if (req->reset_flags & SCTP_RESET_ALL) { 8690 for (i=0; i<stcb->asoc.streamoutcnt; i++) { 8691 stcb->asoc.strmout[i].next_sequence_sent = 0; 8692 } 8693 } else if (number_entries) { 8694 for (i=0; i<number_entries; i++) { 8695 if (list[i] >= stcb->asoc.streamoutcnt) { 8696 /* no such stream */ 8697 continue; 8698 } 8699 stcb->asoc.strmout[(list[i])].next_sequence_sent = 0; 8700 } 8701 } 8702 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list); 8703 } 8704 8705 void 8706 sctp_send_str_reset_ack(struct sctp_tcb *stcb, 8707 struct sctp_stream_reset_request *req) 8708 { 8709 struct sctp_association *asoc; 8710 struct sctp_stream_reset_resp *strack; 8711 struct sctp_tmit_chunk *chk; 8712 uint32_t seq; 8713 int number_entries, i; 8714 uint8_t two_way=0, not_peer=0; 8715 uint16_t *list=NULL; 8716 8717 asoc = &stcb->asoc; 8718 if (req->reset_flags & SCTP_RESET_ALL) 8719 number_entries = 0; 8720 else 8721 number_entries = (ntohs(req->ph.param_length) - sizeof(struct sctp_stream_reset_request)) / sizeof(uint16_t); 8722 8723 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8724 if (chk == NULL) { 8725 return; 8726 } 8727 sctppcbinfo.ipi_count_chunk++; 8728 sctppcbinfo.ipi_gencnt_chunk++; 8729 chk->rec.chunk_id = SCTP_STREAM_RESET; 8730 chk->asoc = &stcb->asoc; 8731 chk->send_size = sizeof(struct sctp_stream_reset_resp) + (number_entries * sizeof(uint16_t)); 8732 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8733 if (chk->data == NULL) { 8734 strresp_jump_out: 8735 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8736 sctppcbinfo.ipi_count_chunk--; 8737 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8738 panic("Chunk count is negative"); 8739 } 8740 sctppcbinfo.ipi_gencnt_chunk++; 8741 return; 8742 } 8743 chk->data->m_data += SCTP_MIN_OVERHEAD; 8744 chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size); 8745 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) { 8746 MCLGET(chk->data, M_DONTWAIT); 8747 if ((chk->data->m_flags & M_EXT) == 0) { 8748 /* Give up */ 8749 sctp_m_freem(chk->data); 8750 chk->data = NULL; 8751 goto strresp_jump_out; 8752 } 8753 chk->data->m_data += SCTP_MIN_OVERHEAD; 8754 } 8755 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) { 8756 /* can't do it, no room */ 8757 /* Give up */ 8758 sctp_m_freem(chk->data); 8759 chk->data = NULL; 8760 goto strresp_jump_out; 8761 8762 } 8763 chk->sent = SCTP_DATAGRAM_UNSENT; 8764 chk->snd_count = 0; 8765 chk->whoTo = asoc->primary_destination; 8766 chk->whoTo->ref_count++; 8767 strack = mtod(chk->data, struct sctp_stream_reset_resp *); 8768 8769 strack->ch.chunk_type = SCTP_STREAM_RESET; 8770 strack->ch.chunk_flags = 0; 8771 strack->ch.chunk_length = htons(chk->send_size); 8772 8773 memset(strack->sr_resp.reset_pad, 0, sizeof(strack->sr_resp.reset_pad)); 8774 8775 strack->sr_resp.ph.param_type = ntohs(SCTP_STR_RESET_RESPONSE); 8776 strack->sr_resp.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr))); 8777 8778 8779 8780 if (chk->send_size % 4) { 8781 /* need a padding for the end */ 8782 int pad; 8783 uint8_t *end; 8784 end = (uint8_t *)((vaddr_t)strack + chk->send_size); 8785 pad = chk->send_size % 4; 8786 for (i = 0; i < pad; i++) { 8787 end[i] = 0; 8788 } 8789 chk->send_size += pad; 8790 } 8791 8792 /* actual response */ 8793 if (req->reset_flags & SCTP_RESET_YOUR) { 8794 strack->sr_resp.reset_flags = SCTP_RESET_PERFORMED; 8795 } else { 8796 strack->sr_resp.reset_flags = 0; 8797 } 8798 8799 /* copied from reset request */ 8800 strack->sr_resp.reset_req_seq_resp = req->reset_req_seq; 8801 seq = ntohl(req->reset_req_seq); 8802 8803 list = req->list_of_streams; 8804 /* copy the un-converted network byte order streams */ 8805 for (i=0; i<number_entries; i++) { 8806 strack->sr_resp.list_of_streams[i] = list[i]; 8807 } 8808 if (asoc->str_reset_seq_in == seq) { 8809 /* is it the next expected? */ 8810 asoc->str_reset_seq_in++; 8811 strack->sr_resp.reset_at_tsn = htonl(asoc->sending_seq); 8812 asoc->str_reset_sending_seq = asoc->sending_seq; 8813 if (number_entries) { 8814 uint16_t temp; 8815 /* convert them to host byte order */ 8816 for (i=0 ; i<number_entries; i++) { 8817 temp = ntohs(list[i]); 8818 list[i] = temp; 8819 } 8820 } 8821 if (req->reset_flags & SCTP_RESET_YOUR) { 8822 /* reset my outbound streams */ 8823 sctp_reset_the_streams(stcb, req , number_entries, list); 8824 } 8825 if (req->reset_flags & SCTP_RECIPRICAL) { 8826 /* reset peer too */ 8827 sctp_send_str_reset_req(stcb, number_entries, list, two_way, not_peer); 8828 } 8829 8830 } else { 8831 /* no its a retran so I must just ack and do nothing */ 8832 strack->sr_resp.reset_at_tsn = htonl(asoc->str_reset_sending_seq); 8833 } 8834 strack->sr_resp.cumulative_tsn = htonl(asoc->cumulative_tsn); 8835 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 8836 chk, 8837 sctp_next); 8838 asoc->ctrl_queue_cnt++; 8839 } 8840 8841 8842 void 8843 sctp_send_str_reset_req(struct sctp_tcb *stcb, 8844 int number_entrys, uint16_t *list, uint8_t two_way, uint8_t not_peer) 8845 { 8846 /* Send a stream reset request. The number_entrys may be 0 and list NULL 8847 * if the request is to reset all streams. If two_way is true then we 8848 * not only request a RESET of the received streams but we also 8849 * request the peer to send a reset req to us too. 8850 * Flag combinations in table: 8851 * 8852 * two_way | not_peer | = | Flags 8853 * ------------------------------ 8854 * 0 | 0 | = | SCTP_RESET_YOUR (just the peer) 8855 * 1 | 0 | = | SCTP_RESET_YOUR | SCTP_RECIPRICAL (both sides) 8856 * 0 | 1 | = | Not a Valid Request (not anyone) 8857 * 1 | 1 | = | SCTP_RESET_RECIPRICAL (Just local host) 8858 */ 8859 struct sctp_association *asoc; 8860 struct sctp_stream_reset_req *strreq; 8861 struct sctp_tmit_chunk *chk; 8862 8863 8864 asoc = &stcb->asoc; 8865 if (asoc->stream_reset_outstanding) { 8866 /* Already one pending, must get ACK back 8867 * to clear the flag. 8868 */ 8869 return; 8870 } 8871 8872 if ((two_way == 0) && (not_peer == 1)) { 8873 /* not a valid request */ 8874 return; 8875 } 8876 8877 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 8878 if (chk == NULL) { 8879 return; 8880 } 8881 sctppcbinfo.ipi_count_chunk++; 8882 sctppcbinfo.ipi_gencnt_chunk++; 8883 chk->rec.chunk_id = SCTP_STREAM_RESET; 8884 chk->asoc = &stcb->asoc; 8885 chk->send_size = sizeof(struct sctp_stream_reset_req) + (number_entrys * sizeof(uint16_t)); 8886 MGETHDR(chk->data, M_DONTWAIT, MT_DATA); 8887 if (chk->data == NULL) { 8888 strreq_jump_out: 8889 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 8890 sctppcbinfo.ipi_count_chunk--; 8891 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 8892 panic("Chunk count is negative"); 8893 } 8894 sctppcbinfo.ipi_gencnt_chunk++; 8895 return; 8896 } 8897 chk->data->m_data += SCTP_MIN_OVERHEAD; 8898 chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size); 8899 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) { 8900 MCLGET(chk->data, M_DONTWAIT); 8901 if ((chk->data->m_flags & M_EXT) == 0) { 8902 /* Give up */ 8903 sctp_m_freem(chk->data); 8904 chk->data = NULL; 8905 goto strreq_jump_out; 8906 } 8907 chk->data->m_data += SCTP_MIN_OVERHEAD; 8908 } 8909 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) { 8910 /* can't do it, no room */ 8911 /* Give up */ 8912 sctp_m_freem(chk->data); 8913 chk->data = NULL; 8914 goto strreq_jump_out; 8915 } 8916 chk->sent = SCTP_DATAGRAM_UNSENT; 8917 chk->snd_count = 0; 8918 chk->whoTo = asoc->primary_destination; 8919 chk->whoTo->ref_count++; 8920 8921 strreq = mtod(chk->data, struct sctp_stream_reset_req *); 8922 strreq->ch.chunk_type = SCTP_STREAM_RESET; 8923 strreq->ch.chunk_flags = 0; 8924 strreq->ch.chunk_length = htons(chk->send_size); 8925 8926 strreq->sr_req.ph.param_type = ntohs(SCTP_STR_RESET_REQUEST); 8927 strreq->sr_req.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr))); 8928 8929 if (chk->send_size % 4) { 8930 /* need a padding for the end */ 8931 int pad, i; 8932 uint8_t *end; 8933 end = (uint8_t *)((vaddr_t)strreq + chk->send_size); 8934 pad = chk->send_size % 4; 8935 for (i=0; i<pad; i++) { 8936 end[i] = 0; 8937 } 8938 chk->send_size += pad; 8939 } 8940 8941 strreq->sr_req.reset_flags = 0; 8942 if (number_entrys == 0) { 8943 strreq->sr_req.reset_flags |= SCTP_RESET_ALL; 8944 } 8945 if (two_way == 0) { 8946 strreq->sr_req.reset_flags |= SCTP_RESET_YOUR; 8947 } else { 8948 if (not_peer == 0) { 8949 strreq->sr_req.reset_flags |= SCTP_RECIPRICAL | SCTP_RESET_YOUR; 8950 } else { 8951 strreq->sr_req.reset_flags |= SCTP_RECIPRICAL; 8952 } 8953 } 8954 memset(strreq->sr_req.reset_pad, 0, sizeof(strreq->sr_req.reset_pad)); 8955 strreq->sr_req.reset_req_seq = htonl(asoc->str_reset_seq_out); 8956 if (number_entrys) { 8957 /* populate the specific entry's */ 8958 int i; 8959 for (i=0; i < number_entrys; i++) { 8960 strreq->sr_req.list_of_streams[i] = htons(list[i]); 8961 } 8962 } 8963 TAILQ_INSERT_TAIL(&asoc->control_send_queue, 8964 chk, 8965 sctp_next); 8966 asoc->ctrl_queue_cnt++; 8967 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo); 8968 asoc->stream_reset_outstanding = 1; 8969 } 8970 8971 void 8972 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag, 8973 struct mbuf *err_cause) 8974 { 8975 /* 8976 * Formulate the abort message, and send it back down. 8977 */ 8978 struct mbuf *mout; 8979 struct sctp_abort_msg *abm; 8980 struct ip *iph, *iph_out; 8981 struct ip6_hdr *ip6, *ip6_out; 8982 int iphlen_out; 8983 8984 /* don't respond to ABORT with ABORT */ 8985 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) { 8986 if (err_cause) 8987 sctp_m_freem(err_cause); 8988 return; 8989 } 8990 MGETHDR(mout, M_DONTWAIT, MT_HEADER); 8991 if (mout == NULL) { 8992 if (err_cause) 8993 sctp_m_freem(err_cause); 8994 return; 8995 } 8996 iph = mtod(m, struct ip *); 8997 iph_out = NULL; 8998 ip6_out = NULL; 8999 if (iph->ip_v == IPVERSION) { 9000 iph_out = mtod(mout, struct ip *); 9001 mout->m_len = sizeof(*iph_out) + sizeof(*abm); 9002 mout->m_next = err_cause; 9003 9004 /* Fill in the IP header for the ABORT */ 9005 iph_out->ip_v = IPVERSION; 9006 iph_out->ip_hl = (sizeof(struct ip) / 4); 9007 iph_out->ip_tos = (u_char)0; 9008 iph_out->ip_id = 0; 9009 iph_out->ip_off = 0; 9010 iph_out->ip_ttl = MAXTTL; 9011 iph_out->ip_p = IPPROTO_SCTP; 9012 iph_out->ip_src.s_addr = iph->ip_dst.s_addr; 9013 iph_out->ip_dst.s_addr = iph->ip_src.s_addr; 9014 /* let IP layer calculate this */ 9015 iph_out->ip_sum = 0; 9016 9017 iphlen_out = sizeof(*iph_out); 9018 abm = (struct sctp_abort_msg *)((vaddr_t)iph_out + iphlen_out); 9019 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 9020 ip6 = (struct ip6_hdr *)iph; 9021 ip6_out = mtod(mout, struct ip6_hdr *); 9022 mout->m_len = sizeof(*ip6_out) + sizeof(*abm); 9023 mout->m_next = err_cause; 9024 9025 /* Fill in the IP6 header for the ABORT */ 9026 ip6_out->ip6_flow = ip6->ip6_flow; 9027 ip6_out->ip6_hlim = ip6_defhlim; 9028 ip6_out->ip6_nxt = IPPROTO_SCTP; 9029 ip6_out->ip6_src = ip6->ip6_dst; 9030 ip6_out->ip6_dst = ip6->ip6_src; 9031 9032 iphlen_out = sizeof(*ip6_out); 9033 abm = (struct sctp_abort_msg *)((vaddr_t)ip6_out + iphlen_out); 9034 } else { 9035 /* Currently not supported */ 9036 return; 9037 } 9038 9039 abm->sh.src_port = sh->dest_port; 9040 abm->sh.dest_port = sh->src_port; 9041 abm->sh.checksum = 0; 9042 if (vtag == 0) { 9043 abm->sh.v_tag = sh->v_tag; 9044 abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB; 9045 } else { 9046 abm->sh.v_tag = htonl(vtag); 9047 abm->msg.ch.chunk_flags = 0; 9048 } 9049 abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION; 9050 9051 if (err_cause) { 9052 struct mbuf *m_tmp = err_cause; 9053 int err_len = 0; 9054 /* get length of the err_cause chain */ 9055 while (m_tmp != NULL) { 9056 err_len += m_tmp->m_len; 9057 m_tmp = m_tmp->m_next; 9058 } 9059 mout->m_pkthdr.len = mout->m_len + err_len; 9060 if (err_len % 4) { 9061 /* need pad at end of chunk */ 9062 u_int32_t cpthis=0; 9063 int padlen; 9064 padlen = 4 - (mout->m_pkthdr.len % 4); 9065 m_copyback(mout, mout->m_pkthdr.len, padlen, (void *)&cpthis); 9066 } 9067 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len); 9068 } else { 9069 mout->m_pkthdr.len = mout->m_len; 9070 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch)); 9071 } 9072 9073 /* add checksum */ 9074 if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL && 9075 m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) { 9076 abm->sh.checksum = 0; 9077 } else { 9078 abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out); 9079 } 9080 9081 /* zap the rcvif, it should be null */ 9082 m_reset_rcvif(mout); 9083 if (iph_out != NULL) { 9084 struct route ro; 9085 9086 /* zap the stack pointer to the route */ 9087 memset(&ro, 0, sizeof ro); 9088 #ifdef SCTP_DEBUG 9089 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 9090 printf("sctp_send_abort calling ip_output:\n"); 9091 sctp_print_address_pkt(iph_out, &abm->sh); 9092 } 9093 #endif 9094 /* set IPv4 length */ 9095 iph_out->ip_len = htons(mout->m_pkthdr.len); 9096 /* out it goes */ 9097 (void)ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL, NULL); 9098 } else if (ip6_out != NULL) { 9099 struct route ro; 9100 9101 /* zap the stack pointer to the route */ 9102 memset(&ro, 0, sizeof(ro)); 9103 #ifdef SCTP_DEBUG 9104 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 9105 printf("sctp_send_abort calling ip6_output:\n"); 9106 sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh); 9107 } 9108 #endif 9109 ip6_output(mout, NULL, &ro, 0, NULL, NULL, NULL); 9110 } 9111 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 9112 } 9113 9114 void 9115 sctp_send_operr_to(struct mbuf *m, int iphlen, 9116 struct mbuf *scm, 9117 uint32_t vtag) 9118 { 9119 struct sctphdr *ihdr; 9120 struct sctphdr *ohdr; 9121 struct sctp_chunkhdr *ophdr; 9122 9123 struct ip *iph; 9124 #ifdef SCTP_DEBUG 9125 struct sockaddr_in6 lsa6, fsa6; 9126 #endif 9127 uint32_t val; 9128 iph = mtod(m, struct ip *); 9129 ihdr = (struct sctphdr *)((vaddr_t)iph + iphlen); 9130 if (!(scm->m_flags & M_PKTHDR)) { 9131 /* must be a pkthdr */ 9132 printf("Huh, not a packet header in send_operr\n"); 9133 m_freem(scm); 9134 return; 9135 } 9136 M_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), M_DONTWAIT); 9137 if (scm == NULL) { 9138 /* can't send because we can't add a mbuf */ 9139 return; 9140 } 9141 ohdr = mtod(scm, struct sctphdr *); 9142 ohdr->src_port = ihdr->dest_port; 9143 ohdr->dest_port = ihdr->src_port; 9144 ohdr->v_tag = vtag; 9145 ohdr->checksum = 0; 9146 ophdr = (struct sctp_chunkhdr *)(ohdr + 1); 9147 ophdr->chunk_type = SCTP_OPERATION_ERROR; 9148 ophdr->chunk_flags = 0; 9149 ophdr->chunk_length = htons(scm->m_pkthdr.len - sizeof(struct sctphdr)); 9150 if (scm->m_pkthdr.len % 4) { 9151 /* need padding */ 9152 u_int32_t cpthis=0; 9153 int padlen; 9154 padlen = 4 - (scm->m_pkthdr.len % 4); 9155 m_copyback(scm, scm->m_pkthdr.len, padlen, (void *)&cpthis); 9156 } 9157 if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL && 9158 m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) { 9159 val = 0; 9160 } else { 9161 val = sctp_calculate_sum(scm, NULL, 0); 9162 } 9163 ohdr->checksum = val; 9164 if (iph->ip_v == IPVERSION) { 9165 /* V4 */ 9166 struct ip *out; 9167 struct route ro; 9168 M_PREPEND(scm, sizeof(struct ip), M_DONTWAIT); 9169 if (scm == NULL) 9170 return; 9171 memset(&ro, 0, sizeof ro); 9172 out = mtod(scm, struct ip *); 9173 out->ip_v = iph->ip_v; 9174 out->ip_hl = (sizeof(struct ip)/4); 9175 out->ip_tos = iph->ip_tos; 9176 out->ip_id = iph->ip_id; 9177 out->ip_off = 0; 9178 out->ip_ttl = MAXTTL; 9179 out->ip_p = IPPROTO_SCTP; 9180 out->ip_sum = 0; 9181 out->ip_src = iph->ip_dst; 9182 out->ip_dst = iph->ip_src; 9183 out->ip_len = htons(scm->m_pkthdr.len); 9184 ip_output(scm, 0, &ro, IP_RAWOUTPUT, NULL, NULL); 9185 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 9186 } else { 9187 /* V6 */ 9188 struct route ro; 9189 struct ip6_hdr *out6, *in6; 9190 9191 M_PREPEND(scm, sizeof(struct ip6_hdr), M_DONTWAIT); 9192 if (scm == NULL) 9193 return; 9194 memset(&ro, 0, sizeof ro); 9195 in6 = mtod(m, struct ip6_hdr *); 9196 out6 = mtod(scm, struct ip6_hdr *); 9197 out6->ip6_flow = in6->ip6_flow; 9198 out6->ip6_hlim = ip6_defhlim; 9199 out6->ip6_nxt = IPPROTO_SCTP; 9200 out6->ip6_src = in6->ip6_dst; 9201 out6->ip6_dst = in6->ip6_src; 9202 9203 #ifdef SCTP_DEBUG 9204 memset(&lsa6, 0, sizeof(lsa6)); 9205 lsa6.sin6_len = sizeof(lsa6); 9206 lsa6.sin6_family = AF_INET6; 9207 lsa6.sin6_addr = out6->ip6_src; 9208 memset(&fsa6, 0, sizeof(fsa6)); 9209 fsa6.sin6_len = sizeof(fsa6); 9210 fsa6.sin6_family = AF_INET6; 9211 fsa6.sin6_addr = out6->ip6_dst; 9212 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 9213 printf("sctp_operr_to calling ipv6 output:\n"); 9214 printf("src: "); 9215 sctp_print_address((struct sockaddr *)&lsa6); 9216 printf("dst "); 9217 sctp_print_address((struct sockaddr *)&fsa6); 9218 } 9219 #endif /* SCTP_DEBUG */ 9220 ip6_output(scm, NULL, &ro, 0, NULL, NULL, NULL); 9221 sctp_pegs[SCTP_DATAGRAMS_SENT]++; 9222 } 9223 } 9224 9225 static int 9226 sctp_copy_one(struct mbuf *m, struct uio *uio, int cpsz, int resv_upfront, int *mbcnt) 9227 { 9228 int left, cancpy, willcpy, error; 9229 left = cpsz; 9230 9231 if (m == NULL) { 9232 /* TSNH */ 9233 *mbcnt = 0; 9234 return (ENOMEM); 9235 } 9236 m->m_len = 0; 9237 if ((left+resv_upfront) > (int)MHLEN) { 9238 MCLGET(m, M_WAIT); 9239 if (m == NULL) { 9240 *mbcnt = 0; 9241 return (ENOMEM); 9242 } 9243 if ((m->m_flags & M_EXT) == 0) { 9244 *mbcnt = 0; 9245 return (ENOMEM); 9246 } 9247 *mbcnt += m->m_ext.ext_size; 9248 } 9249 *mbcnt += MSIZE; 9250 cancpy = M_TRAILINGSPACE(m); 9251 willcpy = min(cancpy, left); 9252 if ((willcpy + resv_upfront) > cancpy) { 9253 willcpy -= resv_upfront; 9254 } 9255 while (left > 0) { 9256 /* Align data to the end */ 9257 if ((m->m_flags & M_EXT) == 0) { 9258 if (m->m_flags & M_PKTHDR) { 9259 MH_ALIGN(m, willcpy); 9260 } else { 9261 M_ALIGN(m, willcpy); 9262 } 9263 } else { 9264 MC_ALIGN(m, willcpy); 9265 } 9266 error = uiomove(mtod(m, void *), willcpy, uio); 9267 if (error) { 9268 return (error); 9269 } 9270 m->m_len = willcpy; 9271 m->m_nextpkt = 0; 9272 left -= willcpy; 9273 if (left > 0) { 9274 MGET(m->m_next, M_WAIT, MT_DATA); 9275 if (m->m_next == NULL) { 9276 *mbcnt = 0; 9277 return (ENOMEM); 9278 } 9279 m = m->m_next; 9280 m->m_len = 0; 9281 *mbcnt += MSIZE; 9282 if (left > (int)MHLEN) { 9283 MCLGET(m, M_WAIT); 9284 if (m == NULL) { 9285 *mbcnt = 0; 9286 return (ENOMEM); 9287 } 9288 if ((m->m_flags & M_EXT) == 0) { 9289 *mbcnt = 0; 9290 return (ENOMEM); 9291 } 9292 *mbcnt += m->m_ext.ext_size; 9293 } 9294 cancpy = M_TRAILINGSPACE(m); 9295 willcpy = min(cancpy, left); 9296 } 9297 } 9298 return (0); 9299 } 9300 9301 static int 9302 sctp_copy_it_in(struct sctp_inpcb *inp, 9303 struct sctp_tcb *stcb, 9304 struct sctp_association *asoc, 9305 struct sctp_nets *net, 9306 struct sctp_sndrcvinfo *srcv, 9307 struct uio *uio, 9308 int flags) 9309 { 9310 /* This routine must be very careful in 9311 * its work. Protocol processing is 9312 * up and running so care must be taken to 9313 * spl...() when you need to do something 9314 * that may effect the stcb/asoc. The sb is 9315 * locked however. When data is copied the 9316 * protocol processing should be enabled since 9317 * this is a slower operation... 9318 */ 9319 struct socket *so; 9320 int error = 0; 9321 int frag_size, mbcnt = 0, mbcnt_e = 0; 9322 unsigned int sndlen; 9323 unsigned int tot_demand; 9324 int tot_out, dataout; 9325 struct sctp_tmit_chunk *chk; 9326 struct mbuf *mm; 9327 struct sctp_stream_out *strq; 9328 uint32_t my_vtag; 9329 int resv_in_first; 9330 9331 so = stcb->sctp_socket; 9332 solock(so); 9333 chk = NULL; 9334 mm = NULL; 9335 9336 sndlen = uio->uio_resid; 9337 /* lock the socket buf */ 9338 error = sblock(&so->so_snd, SBLOCKWAIT(flags)); 9339 if (error) 9340 goto out_locked; 9341 9342 #ifdef SCTP_DEBUG 9343 printf("sctp_copy_it_in: %d\n", sndlen); 9344 #endif 9345 /* will it ever fit ? */ 9346 if (sndlen > so->so_snd.sb_hiwat) { 9347 /* It will NEVER fit */ 9348 error = EMSGSIZE; 9349 goto release; 9350 } 9351 /* Do I need to block? */ 9352 if ((so->so_snd.sb_hiwat < 9353 (sndlen + asoc->total_output_queue_size)) || 9354 (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) || 9355 (asoc->total_output_mbuf_queue_size > 9356 so->so_snd.sb_mbmax) 9357 ) { 9358 /* prune any prsctp bufs out */ 9359 if (asoc->peer_supports_prsctp) { 9360 sctp_prune_prsctp(stcb, asoc, srcv, sndlen); 9361 } 9362 /* 9363 * We store off a pointer to the endpoint. 9364 * Since on return from this we must check to 9365 * see if an so_error is set. If so we may have 9366 * been reset and our stcb destroyed. Returning 9367 * an error will flow back to the user... 9368 */ 9369 while ((so->so_snd.sb_hiwat < 9370 (sndlen + asoc->total_output_queue_size)) || 9371 (asoc->chunks_on_out_queue > 9372 sctp_max_chunks_on_queue) || 9373 (asoc->total_output_mbuf_queue_size > 9374 so->so_snd.sb_mbmax) 9375 ) { 9376 if ((so->so_state & SS_NBIO) 9377 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000 9378 || (flags & MSG_NBIO) 9379 #endif 9380 ) { 9381 /* Non-blocking io in place */ 9382 error = EWOULDBLOCK; 9383 goto release; 9384 } 9385 inp->sctp_tcb_at_block = (void *)stcb; 9386 inp->error_on_block = 0; 9387 #ifdef SCTP_BLK_LOGGING 9388 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK, 9389 so, asoc); 9390 #endif 9391 sbunlock(&so->so_snd); 9392 SCTP_TCB_UNLOCK(stcb); 9393 error = sbwait(&so->so_snd); 9394 SCTP_INP_RLOCK(inp); 9395 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 9396 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 9397 /* Should I really unlock ? */ 9398 SCTP_INP_RUNLOCK(inp); 9399 error = EFAULT; 9400 goto out_locked; 9401 } 9402 SCTP_TCB_LOCK(stcb); 9403 SCTP_INP_RUNLOCK(inp); 9404 9405 inp->sctp_tcb_at_block = 0; 9406 #ifdef SCTP_BLK_LOGGING 9407 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, 9408 so, asoc); 9409 #endif 9410 if (inp->error_on_block) { 9411 /* 9412 * if our asoc was killed, the free code 9413 * (in sctp_pcb.c) will save a error in 9414 * here for us 9415 */ 9416 error = inp->error_on_block; 9417 goto out_locked; 9418 } 9419 if (error) { 9420 goto out_locked; 9421 } 9422 /* did we encounter a socket error? */ 9423 if (so->so_error) { 9424 error = so->so_error; 9425 goto out_locked; 9426 } 9427 error = sblock(&so->so_snd, M_WAITOK); 9428 if (error) { 9429 /* Can't aquire the lock */ 9430 goto out_locked; 9431 } 9432 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115 9433 if (so->so_rcv.sb_state & SBS_CANTSENDMORE) { 9434 #else 9435 if (so->so_state & SS_CANTSENDMORE) { 9436 #endif 9437 /* The socket is now set not to sendmore.. its gone */ 9438 error = EPIPE; 9439 goto release; 9440 } 9441 if (so->so_error) { 9442 error = so->so_error; 9443 goto release; 9444 } 9445 if (asoc->peer_supports_prsctp) { 9446 sctp_prune_prsctp(stcb, asoc, srcv, sndlen); 9447 } 9448 } 9449 } 9450 dataout = tot_out = uio->uio_resid; 9451 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 9452 resv_in_first = SCTP_MED_OVERHEAD; 9453 } else { 9454 resv_in_first = SCTP_MED_V4_OVERHEAD; 9455 } 9456 9457 /* Are we aborting? */ 9458 if (srcv->sinfo_flags & MSG_ABORT) { 9459 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) && 9460 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) { 9461 /* It has to be up before we abort */ 9462 /* how big is the user initiated abort? */ 9463 9464 /* I wonder about doing a MGET without a splnet set. 9465 * it is done that way in the sosend code so I guess 9466 * it is ok :-0 9467 */ 9468 MGETHDR(mm, M_WAIT, MT_DATA); 9469 if (mm) { 9470 struct sctp_paramhdr *ph; 9471 9472 tot_demand = (tot_out + sizeof(struct sctp_paramhdr)); 9473 if (tot_demand > MHLEN) { 9474 if (tot_demand > MCLBYTES) { 9475 /* truncate user data */ 9476 tot_demand = MCLBYTES; 9477 tot_out = tot_demand - sizeof(struct sctp_paramhdr); 9478 } 9479 MCLGET(mm, M_WAIT); 9480 if ((mm->m_flags & M_EXT) == 0) { 9481 /* truncate further */ 9482 tot_demand = MHLEN; 9483 tot_out = tot_demand - sizeof(struct sctp_paramhdr); 9484 } 9485 } 9486 /* now move forward the data pointer */ 9487 ph = mtod(mm, struct sctp_paramhdr *); 9488 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT); 9489 ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out)); 9490 ph++; 9491 mm->m_pkthdr.len = tot_out + sizeof(struct sctp_paramhdr); 9492 mm->m_len = mm->m_pkthdr.len; 9493 error = uiomove((void *)ph, (int)tot_out, uio); 9494 if (error) { 9495 /* 9496 * Here if we can't get his data we 9497 * still abort we just don't get to 9498 * send the users note :-0 9499 */ 9500 sctp_m_freem(mm); 9501 mm = NULL; 9502 } 9503 } 9504 sbunlock(&so->so_snd); 9505 sctp_abort_an_association(stcb->sctp_ep, stcb, 9506 SCTP_RESPONSE_TO_USER_REQ, 9507 mm); 9508 mm = NULL; 9509 goto out_locked; 9510 } 9511 goto release; 9512 } 9513 9514 /* Now can we send this? */ 9515 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 9516 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 9517 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 9518 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 9519 /* got data while shutting down */ 9520 error = ECONNRESET; 9521 goto release; 9522 } 9523 /* Is the stream no. valid? */ 9524 if (srcv->sinfo_stream >= asoc->streamoutcnt) { 9525 /* Invalid stream number */ 9526 error = EINVAL; 9527 goto release; 9528 } 9529 if (asoc->strmout == NULL) { 9530 /* huh? software error */ 9531 #ifdef SCTP_DEBUG 9532 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 9533 printf("software error in sctp_copy_it_in\n"); 9534 } 9535 #endif 9536 error = EFAULT; 9537 goto release; 9538 } 9539 if ((srcv->sinfo_flags & MSG_EOF) && 9540 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) && 9541 (tot_out == 0)) { 9542 sounlock(so); 9543 goto zap_by_it_now; 9544 } 9545 if (tot_out == 0) { 9546 /* not allowed */ 9547 error = EMSGSIZE; 9548 goto release; 9549 } 9550 /* save off the tag */ 9551 my_vtag = asoc->my_vtag; 9552 strq = &asoc->strmout[srcv->sinfo_stream]; 9553 /* First lets figure out the "chunking" point */ 9554 frag_size = sctp_get_frag_point(stcb, asoc); 9555 9556 /* two choices here, it all fits in one chunk or 9557 * we need multiple chunks. 9558 */ 9559 sounlock(so); 9560 if (tot_out <= frag_size) { 9561 /* no need to setup a template */ 9562 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 9563 if (chk == NULL) { 9564 error = ENOMEM; 9565 goto release; 9566 } 9567 sctppcbinfo.ipi_count_chunk++; 9568 sctppcbinfo.ipi_gencnt_chunk++; 9569 asoc->chunks_on_out_queue++; 9570 MGETHDR(mm, M_WAIT, MT_DATA); 9571 if (mm == NULL) { 9572 error = ENOMEM; 9573 goto clean_up; 9574 } 9575 error = sctp_copy_one(mm, uio, tot_out, resv_in_first, &mbcnt_e); 9576 if (error) 9577 goto clean_up; 9578 sctp_prepare_chunk(chk, stcb, srcv, strq, net); 9579 chk->mbcnt = mbcnt_e; 9580 mbcnt += mbcnt_e; 9581 mbcnt_e = 0; 9582 mm->m_pkthdr.len = tot_out; 9583 chk->data = mm; 9584 mm = NULL; 9585 9586 /* the actual chunk flags */ 9587 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG; 9588 chk->whoTo->ref_count++; 9589 9590 /* fix up the send_size if it is not present */ 9591 chk->send_size = tot_out; 9592 chk->book_size = chk->send_size; 9593 /* ok, we are commited */ 9594 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) { 9595 /* bump the ssn if we are unordered. */ 9596 strq->next_sequence_sent++; 9597 } 9598 if (chk->flags & SCTP_PR_SCTP_BUFFER) { 9599 asoc->sent_queue_cnt_removeable++; 9600 } 9601 solock(so); 9602 if ((asoc->state == 0) || 9603 (my_vtag != asoc->my_vtag) || 9604 (so != inp->sctp_socket) || 9605 (inp->sctp_socket == 0)) { 9606 /* connection was aborted */ 9607 sounlock(so); 9608 error = ECONNRESET; 9609 goto clean_up; 9610 } 9611 asoc->stream_queue_cnt++; 9612 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next); 9613 /* now check if this stream is on the wheel */ 9614 if ((strq->next_spoke.tqe_next == NULL) && 9615 (strq->next_spoke.tqe_prev == NULL)) { 9616 /* Insert it on the wheel since it is not 9617 * on it currently 9618 */ 9619 sctp_insert_on_wheel(asoc, strq); 9620 } 9621 sounlock(so); 9622 clean_up: 9623 if (error) { 9624 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 9625 sctppcbinfo.ipi_count_chunk--; 9626 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 9627 panic("Chunk count is negative"); 9628 } 9629 goto release; 9630 } 9631 } else { 9632 /* we need to setup a template */ 9633 struct sctp_tmit_chunk template; 9634 struct sctpchunk_listhead tmp; 9635 9636 /* setup the template */ 9637 sctp_prepare_chunk(&template, stcb, srcv, strq, net); 9638 9639 /* Prepare the temp list */ 9640 TAILQ_INIT(&tmp); 9641 9642 /* Template is complete, now time for the work */ 9643 while (tot_out > 0) { 9644 /* Get a chunk */ 9645 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 9646 if (chk == NULL) { 9647 /* 9648 * ok we must spin through and dump anything 9649 * we have allocated and then jump to the 9650 * no_membad 9651 */ 9652 error = ENOMEM; 9653 } 9654 sctppcbinfo.ipi_count_chunk++; 9655 asoc->chunks_on_out_queue++; 9656 9657 sctppcbinfo.ipi_gencnt_chunk++; 9658 *chk = template; 9659 chk->whoTo->ref_count++; 9660 MGETHDR(chk->data, M_WAIT, MT_DATA); 9661 if (chk->data == NULL) { 9662 error = ENOMEM; 9663 goto temp_clean_up; 9664 } 9665 tot_demand = min(tot_out, frag_size); 9666 error = sctp_copy_one(chk->data, uio, tot_demand , resv_in_first, &mbcnt_e); 9667 if (error) 9668 goto temp_clean_up; 9669 /* now fix the chk->send_size */ 9670 chk->mbcnt = mbcnt_e; 9671 mbcnt += mbcnt_e; 9672 mbcnt_e = 0; 9673 chk->send_size = tot_demand; 9674 chk->data->m_pkthdr.len = tot_demand; 9675 chk->book_size = chk->send_size; 9676 if (chk->flags & SCTP_PR_SCTP_BUFFER) { 9677 asoc->sent_queue_cnt_removeable++; 9678 } 9679 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next); 9680 tot_out -= tot_demand; 9681 } 9682 /* Now the tmp list holds all chunks and data */ 9683 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) { 9684 /* bump the ssn if we are unordered. */ 9685 strq->next_sequence_sent++; 9686 } 9687 /* Mark the first/last flags. This will 9688 * result int a 3 for a single item on the list 9689 */ 9690 chk = TAILQ_FIRST(&tmp); 9691 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG; 9692 chk = TAILQ_LAST(&tmp, sctpchunk_listhead); 9693 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG; 9694 9695 /* now move it to the streams actual queue */ 9696 /* first stop protocol processing */ 9697 mutex_enter(softnet_lock); 9698 if ((asoc->state == 0) || 9699 (my_vtag != asoc->my_vtag) || 9700 (so != inp->sctp_socket) || 9701 (inp->sctp_socket == 0)) { 9702 /* connection was aborted */ 9703 mutex_exit(softnet_lock); 9704 error = ECONNRESET; 9705 goto temp_clean_up; 9706 } 9707 chk = TAILQ_FIRST(&tmp); 9708 while (chk) { 9709 chk->data->m_nextpkt = 0; 9710 TAILQ_REMOVE(&tmp, chk, sctp_next); 9711 asoc->stream_queue_cnt++; 9712 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next); 9713 chk = TAILQ_FIRST(&tmp); 9714 } 9715 /* now check if this stream is on the wheel */ 9716 if ((strq->next_spoke.tqe_next == NULL) && 9717 (strq->next_spoke.tqe_prev == NULL)) { 9718 /* Insert it on the wheel since it is not 9719 * on it currently 9720 */ 9721 sctp_insert_on_wheel(asoc, strq); 9722 } 9723 /* Ok now we can allow pping */ 9724 mutex_exit(softnet_lock); 9725 temp_clean_up: 9726 if (error) { 9727 chk = TAILQ_FIRST(&tmp); 9728 while (chk) { 9729 if (chk->data) { 9730 sctp_m_freem(chk->data); 9731 chk->data = NULL; 9732 } 9733 TAILQ_REMOVE(&tmp, chk, sctp_next); 9734 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 9735 sctppcbinfo.ipi_count_chunk--; 9736 asoc->chunks_on_out_queue--; 9737 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 9738 panic("Chunk count is negative"); 9739 } 9740 sctppcbinfo.ipi_gencnt_chunk++; 9741 chk = TAILQ_FIRST(&tmp); 9742 } 9743 goto release; 9744 } 9745 } 9746 zap_by_it_now: 9747 #ifdef SCTP_MBCNT_LOGGING 9748 sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE, 9749 asoc->total_output_queue_size, 9750 dataout, 9751 asoc->total_output_mbuf_queue_size, 9752 mbcnt); 9753 #endif 9754 solock(so); 9755 asoc->total_output_queue_size += dataout; 9756 asoc->total_output_mbuf_queue_size += mbcnt; 9757 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || 9758 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { 9759 so->so_snd.sb_cc += dataout; 9760 so->so_snd.sb_mbcnt += mbcnt; 9761 } 9762 if ((srcv->sinfo_flags & MSG_EOF) && 9763 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) 9764 ) { 9765 int some_on_streamwheel = 0; 9766 error = 0; 9767 if (!TAILQ_EMPTY(&asoc->out_wheel)) { 9768 /* Check to see if some data queued */ 9769 struct sctp_stream_out *outs; 9770 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 9771 if (!TAILQ_EMPTY(&outs->outqueue)) { 9772 some_on_streamwheel = 1; 9773 break; 9774 } 9775 } 9776 } 9777 if (TAILQ_EMPTY(&asoc->send_queue) && 9778 TAILQ_EMPTY(&asoc->sent_queue) && 9779 (some_on_streamwheel == 0)) { 9780 /* there is nothing queued to send, so I'm done... */ 9781 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) && 9782 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 9783 /* only send SHUTDOWN the first time through */ 9784 #ifdef SCTP_DEBUG 9785 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 9786 printf("%s:%d sends a shutdown\n", 9787 __FILE__, 9788 __LINE__ 9789 ); 9790 } 9791 #endif 9792 sctp_send_shutdown(stcb, stcb->asoc.primary_destination); 9793 asoc->state = SCTP_STATE_SHUTDOWN_SENT; 9794 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, 9795 asoc->primary_destination); 9796 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, 9797 asoc->primary_destination); 9798 } 9799 } else { 9800 /* 9801 * we still got (or just got) data to send, so set 9802 * SHUTDOWN_PENDING 9803 */ 9804 /* 9805 * XXX sockets draft says that MSG_EOF should be sent 9806 * with no data. currently, we will allow user data 9807 * to be sent first and move to SHUTDOWN-PENDING 9808 */ 9809 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING; 9810 } 9811 } 9812 #ifdef SCTP_DEBUG 9813 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 9814 printf("++total out:%d total_mbuf_out:%d\n", 9815 (int)asoc->total_output_queue_size, 9816 (int)asoc->total_output_mbuf_queue_size); 9817 } 9818 #endif 9819 9820 release: 9821 sbunlock(&so->so_snd); 9822 out_locked: 9823 sounlock(so); 9824 9825 if (mm) 9826 sctp_m_freem(mm); 9827 return (error); 9828 } 9829 9830 9831 int 9832 sctp_sosend(struct socket *so, struct sockaddr *addr, struct uio *uio, 9833 struct mbuf *top, struct mbuf *control, int flags, struct lwp *p) 9834 { 9835 int error, use_rcvinfo; 9836 int queue_only = 0, queue_only_for_init=0; 9837 int un_sent = 0; 9838 int now_filled=0; 9839 struct sctp_inpcb *inp; 9840 struct sctp_tcb *stcb=NULL; 9841 struct sctp_sndrcvinfo srcv; 9842 struct timeval now; 9843 struct sctp_nets *net; 9844 struct sctp_association *asoc; 9845 struct sctp_inpcb *t_inp; 9846 int create_lock_applied = 0; 9847 9848 error = use_rcvinfo = 0; 9849 net = NULL; 9850 stcb = NULL; 9851 asoc = NULL; 9852 t_inp = inp = (struct sctp_inpcb *)so->so_pcb; 9853 9854 solock(so); 9855 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) && 9856 (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) { 9857 /* The listner can NOT send */ 9858 error = EFAULT; 9859 sounlock(so); 9860 goto out; 9861 } 9862 if (addr) { 9863 SCTP_ASOC_CREATE_LOCK(inp); 9864 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) || 9865 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 9866 /* Should I really unlock ? */ 9867 error = EFAULT; 9868 sounlock(so); 9869 goto out; 9870 9871 } 9872 create_lock_applied = 1; 9873 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) && 9874 (addr->sa_family == AF_INET6)) { 9875 error = EINVAL; 9876 sounlock(so); 9877 goto out; 9878 } 9879 } 9880 /* now we must find the assoc */ 9881 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 9882 SCTP_INP_RLOCK(inp); 9883 stcb = LIST_FIRST(&inp->sctp_asoc_list); 9884 if (stcb == NULL) { 9885 SCTP_INP_RUNLOCK(inp); 9886 error = ENOTCONN; 9887 sounlock(so); 9888 goto out; 9889 } 9890 SCTP_TCB_LOCK(stcb); 9891 SCTP_INP_RUNLOCK(inp); 9892 net = stcb->asoc.primary_destination; 9893 } 9894 #ifdef SCTP_DEBUG 9895 printf("sctp_sosend: get control\n"); 9896 #endif 9897 /* get control */ 9898 if (control) { 9899 /* process cmsg snd/rcv info (maybe a assoc-id) */ 9900 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control, 9901 sizeof(srcv))) { 9902 /* got one */ 9903 if (srcv.sinfo_flags & MSG_SENDALL) { 9904 /* its a sendall */ 9905 sctppcbinfo.mbuf_track--; 9906 sctp_m_freem(control); 9907 9908 if (create_lock_applied) { 9909 SCTP_ASOC_CREATE_UNLOCK(inp); 9910 create_lock_applied = 0; 9911 } 9912 return (sctp_sendall(inp, uio, top, &srcv)); 9913 } 9914 use_rcvinfo = 1; 9915 } 9916 } 9917 #ifdef SCTP_DEBUG 9918 printf("sctp_sosend: doing lookup\n"); 9919 #endif 9920 if (stcb == NULL) { 9921 /* Need to do a lookup */ 9922 if (use_rcvinfo && srcv.sinfo_assoc_id) { 9923 stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id); 9924 /* 9925 * Question: Should I error here if the assoc_id is 9926 * no longer valid? i.e. I can't find it? 9927 */ 9928 if ((stcb) && 9929 (addr != NULL)) { 9930 /* Must locate the net structure */ 9931 net = sctp_findnet(stcb, addr); 9932 } 9933 } 9934 if (stcb == NULL) { 9935 if (addr != NULL) { 9936 /* Since we did not use findep we must 9937 * increment it, and if we don't find a 9938 * tcb decrement it. 9939 */ 9940 SCTP_INP_WLOCK(inp); 9941 SCTP_INP_INCR_REF(inp); 9942 SCTP_INP_WUNLOCK(inp); 9943 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL); 9944 if (stcb == NULL) { 9945 SCTP_INP_WLOCK(inp); 9946 SCTP_INP_DECR_REF(inp); 9947 SCTP_INP_WUNLOCK(inp); 9948 } 9949 } 9950 } 9951 } 9952 if ((stcb == NULL) && 9953 (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) { 9954 error = ENOTCONN; 9955 sounlock(so); 9956 goto out; 9957 } else if ((stcb == NULL) && (addr == NULL)) { 9958 error = ENOENT; 9959 sounlock(so); 9960 goto out; 9961 } else if (stcb == NULL) { 9962 /* UDP style, we must go ahead and start the INIT process */ 9963 if ((use_rcvinfo) && 9964 (srcv.sinfo_flags & MSG_ABORT)) { 9965 /* User asks to abort a non-existant asoc */ 9966 error = ENOENT; 9967 sounlock(so); 9968 goto out; 9969 } 9970 /* get an asoc/stcb struct */ 9971 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0); 9972 if (stcb == NULL) { 9973 /* Error is setup for us in the call */ 9974 sounlock(so); 9975 goto out; 9976 } 9977 if (create_lock_applied) { 9978 SCTP_ASOC_CREATE_UNLOCK(inp); 9979 create_lock_applied = 0; 9980 } else { 9981 printf("Huh-3? create lock should have been on??\n"); 9982 } 9983 /* Turn on queue only flag to prevent data from being sent */ 9984 queue_only = 1; 9985 asoc = &stcb->asoc; 9986 asoc->state = SCTP_STATE_COOKIE_WAIT; 9987 SCTP_GETTIME_TIMEVAL(&asoc->time_entered); 9988 if (control) { 9989 /* see if a init structure exists in cmsg headers */ 9990 struct sctp_initmsg initm; 9991 int i; 9992 if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, sizeof(initm))) { 9993 /* we have an INIT override of the default */ 9994 if (initm.sinit_max_attempts) 9995 asoc->max_init_times = initm.sinit_max_attempts; 9996 if (initm.sinit_num_ostreams) 9997 asoc->pre_open_streams = initm.sinit_num_ostreams; 9998 if (initm.sinit_max_instreams) 9999 asoc->max_inbound_streams = initm.sinit_max_instreams; 10000 if (initm.sinit_max_init_timeo) 10001 asoc->initial_init_rto_max = initm.sinit_max_init_timeo; 10002 if (asoc->streamoutcnt < asoc->pre_open_streams) { 10003 /* Default is NOT correct */ 10004 #ifdef SCTP_DEBUG 10005 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 10006 printf("Ok, defout:%d pre_open:%d\n", 10007 asoc->streamoutcnt, asoc->pre_open_streams); 10008 } 10009 #endif 10010 free(asoc->strmout, M_PCB); 10011 asoc->strmout = NULL; 10012 asoc->streamoutcnt = asoc->pre_open_streams; 10013 10014 /* What happesn if this fails? .. we panic ...*/ 10015 asoc->strmout = malloc( 10016 asoc->streamoutcnt * 10017 sizeof(struct sctp_stream_out), 10018 M_PCB, M_WAIT); 10019 for (i = 0; i < asoc->streamoutcnt; i++) { 10020 /* 10021 * inbound side must be set to 0xffff, 10022 * also NOTE when we get the INIT-ACK 10023 * back (for INIT sender) we MUST 10024 * reduce the count (streamoutcnt) but 10025 * first check if we sent to any of the 10026 * upper streams that were dropped (if 10027 * some were). Those that were dropped 10028 * must be notified to the upper layer 10029 * as failed to send. 10030 */ 10031 asoc->strmout[i].next_sequence_sent = 0x0; 10032 TAILQ_INIT(&asoc->strmout[i].outqueue); 10033 asoc->strmout[i].stream_no = i; 10034 asoc->strmout[i].next_spoke.tqe_next = 0; 10035 asoc->strmout[i].next_spoke.tqe_prev = 0; 10036 } 10037 } 10038 } 10039 10040 } 10041 /* out with the INIT */ 10042 queue_only_for_init = 1; 10043 sctp_send_initiate(inp, stcb); 10044 /* 10045 * we may want to dig in after this call and adjust the MTU 10046 * value. It defaulted to 1500 (constant) but the ro structure 10047 * may now have an update and thus we may need to change it 10048 * BEFORE we append the message. 10049 */ 10050 net = stcb->asoc.primary_destination; 10051 asoc = &stcb->asoc; 10052 } else { 10053 asoc = &stcb->asoc; 10054 } 10055 if (create_lock_applied) { 10056 SCTP_ASOC_CREATE_UNLOCK(inp); 10057 create_lock_applied = 0; 10058 } 10059 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) || 10060 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) { 10061 queue_only = 1; 10062 } 10063 if (use_rcvinfo == 0) { 10064 /* Grab the default stuff from the asoc */ 10065 srcv = stcb->asoc.def_send; 10066 } 10067 /* we are now done with all control */ 10068 if (control) { 10069 sctp_m_freem(control); 10070 control = NULL; 10071 } 10072 10073 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) || 10074 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) || 10075 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) || 10076 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) { 10077 if ((use_rcvinfo) && 10078 (srcv.sinfo_flags & MSG_ABORT)) { 10079 ; 10080 } else { 10081 error = ECONNRESET; 10082 sounlock(so); 10083 goto out; 10084 } 10085 } 10086 /* Ok, we will attempt a msgsnd :> */ 10087 #if 0 /* XXX */ 10088 if (p) 10089 p->p_stats->p_ru.ru_msgsnd++; 10090 #endif 10091 10092 if (stcb) { 10093 if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) { 10094 /* we take the override or the unconfirmed */ 10095 ; 10096 } else { 10097 net = stcb->asoc.primary_destination; 10098 } 10099 } 10100 10101 #ifdef SCTP_DEBUG 10102 printf("sctp_sosend: before copying in %p\n", top); 10103 #endif 10104 if (top == NULL) { 10105 /* Must copy it all in from user land. The 10106 * socket buf is locked but we don't suspend 10107 * protocol processing until we are ready to 10108 * send/queue it. 10109 */ 10110 sounlock(so); 10111 #ifdef SCTP_DEBUG 10112 printf("sctp_sosend: before cii\n"); 10113 #endif 10114 error = sctp_copy_it_in(inp, stcb, asoc, net, &srcv, uio, flags); 10115 #ifdef SCTP_DEBUG 10116 printf("sctp_sosend: after cii\n"); 10117 #endif 10118 if (error) 10119 goto out; 10120 } else { 10121 /* Here we must either pull in the user data to chunk 10122 * buffers, or use top to do a msg_append. 10123 */ 10124 error = sctp_msg_append(stcb, net, top, &srcv, flags); 10125 sounlock(so); 10126 if (error) 10127 goto out; 10128 /* zap the top since it is now being used */ 10129 top = 0; 10130 } 10131 #ifdef SCTP_DEBUG 10132 printf("sctp_sosend: after copying in\n"); 10133 #endif 10134 if (net->flight_size > net->cwnd) { 10135 sctp_pegs[SCTP_SENDTO_FULL_CWND]++; 10136 queue_only = 1; 10137 10138 } else if (asoc->ifp_had_enobuf) { 10139 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++; 10140 queue_only = 1; 10141 } else { 10142 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) + 10143 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) + 10144 SCTP_MED_OVERHEAD); 10145 10146 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) && 10147 (stcb->asoc.total_flight > 0) && 10148 (un_sent < (int)stcb->asoc.smallest_mtu)) { 10149 10150 /* Ok, Nagle is set on and we have data outstanding. Don't 10151 * send anything and let SACKs drive out the data unless we 10152 * have a "full" segment to send. 10153 */ 10154 sctp_pegs[SCTP_NAGLE_NOQ]++; 10155 queue_only = 1; 10156 } else { 10157 sctp_pegs[SCTP_NAGLE_OFF]++; 10158 } 10159 } 10160 if (queue_only_for_init) { 10161 /* It is possible to have a turn around of the 10162 * INIT/INIT-ACK/COOKIE before I have a chance to 10163 * copy in the data. In such a case I DO want to 10164 * send it out by reversing the queue only flag. 10165 */ 10166 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) || 10167 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) { 10168 /* yep, reverse it */ 10169 queue_only = 0; 10170 } 10171 } 10172 10173 #ifdef SCTP_DEBUG 10174 printf("sctp_sosend: before sending chunk\n"); 10175 #endif 10176 if ((queue_only == 0) && (stcb->asoc.peers_rwnd && un_sent)) { 10177 /* we can attempt to send too.*/ 10178 #ifdef SCTP_DEBUG 10179 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 10180 printf("USR Send calls sctp_chunk_output\n"); 10181 } 10182 #endif 10183 solock(so); 10184 sctp_pegs[SCTP_OUTPUT_FRM_SND]++; 10185 sctp_chunk_output(inp, stcb, 0); 10186 sounlock(so); 10187 } else if ((queue_only == 0) && 10188 (stcb->asoc.peers_rwnd == 0) && 10189 (stcb->asoc.total_flight == 0)) { 10190 /* We get to have a probe outstanding */ 10191 solock(so); 10192 sctp_from_user_send = 1; 10193 sctp_chunk_output(inp, stcb, 0); 10194 sctp_from_user_send = 0; 10195 sounlock(so); 10196 10197 } else if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) { 10198 int num_out, reason, cwnd_full; 10199 /* Here we do control only */ 10200 solock(so); 10201 sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out, 10202 &reason, 1, &cwnd_full, 1, &now, &now_filled); 10203 sounlock(so); 10204 } 10205 #ifdef SCTP_DEBUG 10206 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) { 10207 printf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n", 10208 queue_only, stcb->asoc.peers_rwnd, un_sent, 10209 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue, 10210 stcb->asoc.total_output_queue_size); 10211 } 10212 #endif 10213 out: 10214 if (create_lock_applied) { 10215 SCTP_ASOC_CREATE_UNLOCK(inp); 10216 create_lock_applied = 0; 10217 } 10218 if (stcb) { 10219 SCTP_TCB_UNLOCK(stcb); 10220 } 10221 if (top) 10222 sctp_m_freem(top); 10223 if (control) 10224 sctp_m_freem(control); 10225 return (error); 10226 } 10227