1 /* $KAME: sctp_pcb.c,v 1.39 2005/06/16 18:29:25 jinmei Exp $ */ 2 /* $NetBSD: sctp_pcb.c,v 1.20 2020/01/19 20:51:13 riastradh Exp $ */ 3 4 /* 5 * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. All advertising materials mentioning features or use of this software 17 * must display the following acknowledgement: 18 * This product includes software developed by Cisco Systems, Inc. 19 * 4. Neither the name of the project nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY CISCO SYSTEMS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL CISCO SYSTEMS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 #include <sys/cdefs.h> 36 __KERNEL_RCSID(0, "$NetBSD: sctp_pcb.c,v 1.20 2020/01/19 20:51:13 riastradh Exp $"); 37 38 #ifdef _KERNEL_OPT 39 #include "opt_inet.h" 40 #include "opt_ipsec.h" 41 #include "opt_sctp.h" 42 #endif /* _KERNEL_OPT */ 43 44 #include <sys/param.h> 45 #include <sys/systm.h> 46 #include <sys/malloc.h> 47 #include <sys/mbuf.h> 48 #include <sys/domain.h> 49 #include <sys/protosw.h> 50 #include <sys/socket.h> 51 #include <sys/socketvar.h> 52 #include <sys/proc.h> 53 #include <sys/kauth.h> 54 #include <sys/kernel.h> 55 #include <sys/sysctl.h> 56 #include <sys/rnd.h> 57 #include <sys/callout.h> 58 59 #include <machine/limits.h> 60 #include <machine/cpu.h> 61 62 #include <net/if.h> 63 #include <net/if_types.h> 64 #include <net/route.h> 65 #include <netinet/in.h> 66 #include <netinet/in_systm.h> 67 #include <netinet/ip.h> 68 #include <netinet/in_pcb.h> 69 #include <netinet/in_var.h> 70 #include <netinet/ip_var.h> 71 72 #ifdef INET6 73 #include <netinet/ip6.h> 74 #include <netinet6/ip6_var.h> 75 #include <netinet6/scope6_var.h> 76 #include <netinet6/in6_pcb.h> 77 #endif /* INET6 */ 78 79 #ifdef IPSEC 80 #include <netipsec/ipsec.h> 81 #include <netipsec/key.h> 82 #endif /* IPSEC */ 83 84 #include <netinet/sctp_var.h> 85 #include <netinet/sctp_pcb.h> 86 #include <netinet/sctputil.h> 87 #include <netinet/sctp.h> 88 #include <netinet/sctp_header.h> 89 #include <netinet/sctp_asconf.h> 90 #include <netinet/sctp_output.h> 91 #include <netinet/sctp_timer.h> 92 93 #ifndef SCTP_PCBHASHSIZE 94 /* default number of association hash buckets in each endpoint */ 95 #define SCTP_PCBHASHSIZE 256 96 #endif 97 98 #ifdef SCTP_DEBUG 99 u_int32_t sctp_debug_on = SCTP_DEBUG_ALL; 100 #endif /* SCTP_DEBUG */ 101 102 u_int32_t sctp_pegs[SCTP_NUMBER_OF_PEGS]; 103 104 int sctp_pcbtblsize = SCTP_PCBHASHSIZE; 105 106 struct sctp_epinfo sctppcbinfo; 107 108 /* FIX: we don't handle multiple link local scopes */ 109 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */ 110 int 111 SCTP6_ARE_ADDR_EQUAL(const struct in6_addr *a, const struct in6_addr *b) 112 { 113 struct in6_addr tmp_a, tmp_b; 114 /* use a copy of a and b */ 115 tmp_a = *a; 116 tmp_b = *b; 117 in6_clearscope(&tmp_a); 118 in6_clearscope(&tmp_b); 119 return (IN6_ARE_ADDR_EQUAL(&tmp_a, &tmp_b)); 120 } 121 122 #if defined(__FreeBSD__) && __FreeBSD_version > 500000 123 124 #ifndef xyzzy 125 void sctp_validate_no_locks(void); 126 127 void 128 SCTP_INP_RLOCK(struct sctp_inpcb *inp) 129 { 130 struct sctp_tcb *stcb; 131 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 132 if (mtx_owned(&(stcb)->tcb_mtx)) 133 panic("I own TCB lock?"); 134 } 135 if (mtx_owned(&(inp)->inp_mtx)) 136 panic("INP Recursive Lock-R"); 137 mtx_lock(&(inp)->inp_mtx); 138 } 139 140 void 141 SCTP_INP_WLOCK(struct sctp_inpcb *inp) 142 { 143 SCTP_INP_RLOCK(inp); 144 } 145 146 void 147 SCTP_INP_INFO_RLOCK() 148 { 149 struct sctp_inpcb *inp; 150 struct sctp_tcb *stcb; 151 LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) { 152 if (mtx_owned(&(inp)->inp_mtx)) 153 panic("info-lock and own inp lock?"); 154 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 155 if (mtx_owned(&(stcb)->tcb_mtx)) 156 panic("Info lock and own a tcb lock?"); 157 } 158 } 159 if (mtx_owned(&sctppcbinfo.ipi_ep_mtx)) 160 panic("INP INFO Recursive Lock-R"); 161 mtx_lock(&sctppcbinfo.ipi_ep_mtx); 162 } 163 164 void 165 SCTP_INP_INFO_WLOCK() 166 { 167 SCTP_INP_INFO_RLOCK(); 168 } 169 170 171 void sctp_validate_no_locks() 172 { 173 struct sctp_inpcb *inp; 174 struct sctp_tcb *stcb; 175 176 if (mtx_owned(&sctppcbinfo.ipi_ep_mtx)) 177 panic("INP INFO lock is owned?"); 178 179 LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) { 180 if (mtx_owned(&(inp)->inp_mtx)) 181 panic("You own an INP lock?"); 182 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 183 if (mtx_owned(&(stcb)->tcb_mtx)) 184 panic("You own a TCB lock?"); 185 } 186 } 187 } 188 189 #endif 190 #endif 191 192 void 193 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb) 194 { 195 /* We really don't need 196 * to lock this, but I will 197 * just because it does not hurt. 198 */ 199 SCTP_INP_INFO_RLOCK(); 200 spcb->ep_count = sctppcbinfo.ipi_count_ep; 201 spcb->asoc_count = sctppcbinfo.ipi_count_asoc; 202 spcb->laddr_count = sctppcbinfo.ipi_count_laddr; 203 spcb->raddr_count = sctppcbinfo.ipi_count_raddr; 204 spcb->chk_count = sctppcbinfo.ipi_count_chunk; 205 spcb->sockq_count = sctppcbinfo.ipi_count_sockq; 206 spcb->mbuf_track = sctppcbinfo.mbuf_track; 207 SCTP_INP_INFO_RUNLOCK(); 208 } 209 210 211 /* 212 * Notes on locks for FreeBSD 5 and up. All association 213 * lookups that have a definte ep, the INP structure is 214 * assumed to be locked for reading. If we need to go 215 * find the INP (usually when a **inp is passed) then 216 * we must lock the INFO structure first and if needed 217 * lock the INP too. Note that if we lock it we must 218 * 219 */ 220 221 222 /* 223 * Given a endpoint, look and find in its association list any association 224 * with the "to" address given. This can be a "from" address, too, for 225 * inbound packets. For outbound packets it is a true "to" address. 226 */ 227 static struct sctp_tcb * 228 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from, 229 struct sockaddr *to, struct sctp_nets **netp) 230 { 231 /**** ASSUMSES THE CALLER holds the INP_INFO_RLOCK */ 232 233 /* 234 * Note for this module care must be taken when observing what to is 235 * for. In most of the rest of the code the TO field represents my 236 * peer and the FROM field represents my address. For this module it 237 * is reversed of that. 238 */ 239 /* 240 * If we support the TCP model, then we must now dig through to 241 * see if we can find our endpoint in the list of tcp ep's. 242 */ 243 uint16_t lport, rport; 244 struct sctppcbhead *ephead; 245 struct sctp_inpcb *inp; 246 struct sctp_laddr *laddr; 247 struct sctp_tcb *stcb; 248 struct sctp_nets *net; 249 250 if ((to == NULL) || (from == NULL)) { 251 return (NULL); 252 } 253 254 if (to->sa_family == AF_INET && from->sa_family == AF_INET) { 255 lport = ((struct sockaddr_in *)to)->sin_port; 256 rport = ((struct sockaddr_in *)from)->sin_port; 257 } else if (to->sa_family == AF_INET6 && from->sa_family == AF_INET6) { 258 lport = ((struct sockaddr_in6 *)to)->sin6_port; 259 rport = ((struct sockaddr_in6 *)from)->sin6_port; 260 } else { 261 return NULL; 262 } 263 ephead = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR( 264 (lport + rport), sctppcbinfo.hashtcpmark)]; 265 /* 266 * Ok now for each of the guys in this bucket we must look 267 * and see: 268 * - Does the remote port match. 269 * - Does there single association's addresses match this 270 * address (to). 271 * If so we update p_ep to point to this ep and return the 272 * tcb from it. 273 */ 274 LIST_FOREACH(inp, ephead, sctp_hash) { 275 if (lport != inp->sctp_lport) { 276 continue; 277 } 278 SCTP_INP_RLOCK(inp); 279 /* check to see if the ep has one of the addresses */ 280 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 281 /* We are NOT bound all, so look further */ 282 int match = 0; 283 284 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 285 if (laddr->ifa == NULL) { 286 #ifdef SCTP_DEBUG 287 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 288 printf("An ounce of prevention is worth a pound of cure\n"); 289 } 290 #endif 291 continue; 292 } 293 if (laddr->ifa->ifa_addr == NULL) { 294 #ifdef SCTP_DEBUG 295 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 296 printf("ifa with a NULL address\n"); 297 } 298 #endif 299 continue; 300 } 301 if (laddr->ifa->ifa_addr->sa_family == 302 to->sa_family) { 303 /* see if it matches */ 304 struct sockaddr_in *intf_addr, *sin; 305 intf_addr = (struct sockaddr_in *) 306 laddr->ifa->ifa_addr; 307 sin = (struct sockaddr_in *)to; 308 if (from->sa_family == AF_INET) { 309 if (sin->sin_addr.s_addr == 310 intf_addr->sin_addr.s_addr) { 311 match = 1; 312 SCTP_INP_RUNLOCK(inp); 313 break; 314 } 315 } else { 316 struct sockaddr_in6 *intf_addr6; 317 struct sockaddr_in6 *sin6; 318 sin6 = (struct sockaddr_in6 *) 319 to; 320 intf_addr6 = (struct sockaddr_in6 *) 321 laddr->ifa->ifa_addr; 322 323 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 324 &intf_addr6->sin6_addr)) { 325 match = 1; 326 SCTP_INP_RUNLOCK(inp); 327 break; 328 } 329 } 330 } 331 } 332 if (match == 0) { 333 /* This endpoint does not have this address */ 334 SCTP_INP_RUNLOCK(inp); 335 continue; 336 } 337 } 338 /* 339 * Ok if we hit here the ep has the address, does it hold the 340 * tcb? 341 */ 342 343 stcb = LIST_FIRST(&inp->sctp_asoc_list); 344 if (stcb == NULL) { 345 SCTP_INP_RUNLOCK(inp); 346 continue; 347 } 348 SCTP_TCB_LOCK(stcb); 349 if (stcb->rport != rport) { 350 /* remote port does not match. */ 351 SCTP_TCB_UNLOCK(stcb); 352 SCTP_INP_RUNLOCK(inp); 353 continue; 354 } 355 /* Does this TCB have a matching address? */ 356 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 357 if (sctp_cmpaddr(from, rtcache_getdst(&net->ro))) { 358 /* found it */ 359 if (netp != NULL) { 360 *netp = net; 361 } 362 /* Update the endpoint pointer */ 363 *inp_p = inp; 364 SCTP_INP_RUNLOCK(inp); 365 return (stcb); 366 } 367 } 368 SCTP_TCB_UNLOCK(stcb); 369 370 SCTP_INP_RUNLOCK(inp); 371 } 372 return (NULL); 373 } 374 375 struct sctp_tcb * 376 sctp_findassociation_ep_asconf(struct mbuf *m, int iphlen, int offset, 377 struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp) 378 { 379 struct sctp_tcb *stcb; 380 struct sockaddr_in *sin; 381 struct sockaddr_in6 *sin6; 382 struct sockaddr_storage local_store, remote_store; 383 struct ip *iph; 384 struct sctp_paramhdr parm_buf, *phdr; 385 int ptype; 386 387 memset(&local_store, 0, sizeof(local_store)); 388 memset(&remote_store, 0, sizeof(remote_store)); 389 390 /* First get the destination address setup too. */ 391 iph = mtod(m, struct ip *); 392 if (iph->ip_v == IPVERSION) { 393 /* its IPv4 */ 394 sin = (struct sockaddr_in *)&local_store; 395 sin->sin_family = AF_INET; 396 sin->sin_len = sizeof(*sin); 397 sin->sin_port = sh->dest_port; 398 sin->sin_addr.s_addr = iph->ip_dst.s_addr ; 399 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 400 /* its IPv6 */ 401 struct ip6_hdr *ip6; 402 ip6 = mtod(m, struct ip6_hdr *); 403 sin6 = (struct sockaddr_in6 *)&local_store; 404 sin6->sin6_family = AF_INET6; 405 sin6->sin6_len = sizeof(*sin6); 406 sin6->sin6_port = sh->dest_port; 407 sin6->sin6_addr = ip6->ip6_dst; 408 } else { 409 return NULL; 410 } 411 412 phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk), 413 &parm_buf, sizeof(struct sctp_paramhdr)); 414 if (phdr == NULL) { 415 #ifdef SCTP_DEBUG 416 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 417 printf("sctp_process_control: failed to get asconf lookup addr\n"); 418 } 419 #endif /* SCTP_DEBUG */ 420 return NULL; 421 } 422 ptype = (int)((u_int)ntohs(phdr->param_type)); 423 /* get the correlation address */ 424 if (ptype == SCTP_IPV6_ADDRESS) { 425 /* ipv6 address param */ 426 struct sctp_ipv6addr_param *p6, p6_buf; 427 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) { 428 return NULL; 429 } 430 431 p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m, 432 offset + sizeof(struct sctp_asconf_chunk), 433 &p6_buf.ph, sizeof(*p6)); 434 if (p6 == NULL) { 435 #ifdef SCTP_DEBUG 436 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 437 printf("sctp_process_control: failed to get asconf v6 lookup addr\n"); 438 } 439 #endif /* SCTP_DEBUG */ 440 return (NULL); 441 } 442 sin6 = (struct sockaddr_in6 *)&remote_store; 443 sin6->sin6_family = AF_INET6; 444 sin6->sin6_len = sizeof(*sin6); 445 sin6->sin6_port = sh->src_port; 446 memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr)); 447 } else if (ptype == SCTP_IPV4_ADDRESS) { 448 /* ipv4 address param */ 449 struct sctp_ipv4addr_param *p4, p4_buf; 450 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) { 451 return NULL; 452 } 453 454 p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m, 455 offset + sizeof(struct sctp_asconf_chunk), 456 &p4_buf.ph, sizeof(*p4)); 457 if (p4 == NULL) { 458 #ifdef SCTP_DEBUG 459 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 460 printf("sctp_process_control: failed to get asconf v4 lookup addr\n"); 461 } 462 #endif /* SCTP_DEBUG */ 463 return (NULL); 464 } 465 sin = (struct sockaddr_in *)&remote_store; 466 sin->sin_family = AF_INET; 467 sin->sin_len = sizeof(*sin); 468 sin->sin_port = sh->src_port; 469 memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr)); 470 } else { 471 /* invalid address param type */ 472 return NULL; 473 } 474 475 stcb = sctp_findassociation_ep_addr(inp_p, 476 (struct sockaddr *)&remote_store, netp, 477 (struct sockaddr *)&local_store, NULL); 478 return (stcb); 479 } 480 481 struct sctp_tcb * 482 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote, 483 struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb) 484 { 485 struct sctpasochead *head; 486 struct sctp_inpcb *inp; 487 struct sctp_tcb *stcb; 488 struct sctp_nets *net; 489 uint16_t rport; 490 491 inp = *inp_p; 492 if (remote->sa_family == AF_INET) { 493 rport = (((struct sockaddr_in *)remote)->sin_port); 494 } else if (remote->sa_family == AF_INET6) { 495 rport = (((struct sockaddr_in6 *)remote)->sin6_port); 496 } else { 497 return (NULL); 498 } 499 if (locked_tcb) { 500 /* UN-lock so we can do proper locking here 501 * this occurs when called from load_addresses_from_init. 502 */ 503 SCTP_TCB_UNLOCK(locked_tcb); 504 } 505 SCTP_INP_INFO_RLOCK(); 506 if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 507 /* 508 * Now either this guy is our listner or it's the connector. 509 * If it is the one that issued the connect, then it's only 510 * chance is to be the first TCB in the list. If it is the 511 * acceptor, then do the special_lookup to hash and find the 512 * real inp. 513 */ 514 if (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING) { 515 /* to is peer addr, from is my addr */ 516 stcb = sctp_tcb_special_locate(inp_p, remote, local, 517 netp); 518 if ((stcb != NULL) && (locked_tcb == NULL)){ 519 /* we have a locked tcb, lower refcount */ 520 SCTP_INP_WLOCK(inp); 521 SCTP_INP_DECR_REF(inp); 522 SCTP_INP_WUNLOCK(inp); 523 } 524 if (locked_tcb != NULL) { 525 SCTP_INP_RLOCK(locked_tcb->sctp_ep); 526 SCTP_TCB_LOCK(locked_tcb); 527 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep); 528 if (stcb != NULL) { 529 SCTP_TCB_UNLOCK(stcb); 530 } 531 } 532 SCTP_INP_INFO_RUNLOCK(); 533 return (stcb); 534 } else { 535 SCTP_INP_WLOCK(inp); 536 stcb = LIST_FIRST(&inp->sctp_asoc_list); 537 if (stcb == NULL) { 538 goto null_return; 539 } 540 SCTP_TCB_LOCK(stcb); 541 if (stcb->rport != rport) { 542 /* remote port does not match. */ 543 SCTP_TCB_UNLOCK(stcb); 544 goto null_return; 545 } 546 /* now look at the list of remote addresses */ 547 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 548 if (sctp_cmpaddr(remote, rtcache_getdst(&net->ro))) { 549 /* found it */ 550 if (netp != NULL) { 551 *netp = net; 552 } 553 if (locked_tcb == NULL) { 554 SCTP_INP_DECR_REF(inp); 555 } 556 SCTP_INP_WUNLOCK(inp); 557 SCTP_INP_INFO_RUNLOCK(); 558 return (stcb); 559 } 560 } 561 SCTP_TCB_UNLOCK(stcb); 562 } 563 } else { 564 SCTP_INP_WLOCK(inp); 565 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport, 566 inp->sctp_hashmark)]; 567 if (head == NULL) { 568 goto null_return; 569 } 570 LIST_FOREACH(stcb, head, sctp_tcbhash) { 571 if (stcb->rport != rport) { 572 /* remote port does not match */ 573 continue; 574 } 575 /* now look at the list of remote addresses */ 576 SCTP_TCB_LOCK(stcb); 577 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 578 if (sctp_cmpaddr(remote, rtcache_getdst(&net->ro))) { 579 /* found it */ 580 if (netp != NULL) { 581 *netp = net; 582 } 583 if (locked_tcb == NULL) { 584 SCTP_INP_DECR_REF(inp); 585 } 586 SCTP_INP_WUNLOCK(inp); 587 SCTP_INP_INFO_RUNLOCK(); 588 return (stcb); 589 } 590 } 591 SCTP_TCB_UNLOCK(stcb); 592 } 593 } 594 null_return: 595 /* clean up for returning null */ 596 if (locked_tcb){ 597 if (locked_tcb->sctp_ep != inp) { 598 SCTP_INP_RLOCK(locked_tcb->sctp_ep); 599 SCTP_TCB_LOCK(locked_tcb); 600 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep); 601 } else { 602 SCTP_TCB_LOCK(locked_tcb); 603 } 604 } 605 SCTP_INP_WUNLOCK(inp); 606 SCTP_INP_INFO_RUNLOCK(); 607 /* not found */ 608 return (NULL); 609 } 610 611 /* 612 * Find an association for a specific endpoint using the association id 613 * given out in the COMM_UP notification 614 */ 615 struct sctp_tcb * 616 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, vaddr_t asoc_id) 617 { 618 /* 619 * Use my the assoc_id to find a endpoint 620 */ 621 struct sctpasochead *head; 622 struct sctp_tcb *stcb; 623 u_int32_t vtag; 624 625 if (asoc_id == 0 || inp == NULL) { 626 return (NULL); 627 } 628 SCTP_INP_INFO_RLOCK(); 629 vtag = (u_int32_t)asoc_id; 630 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag, 631 sctppcbinfo.hashasocmark)]; 632 if (head == NULL) { 633 /* invalid vtag */ 634 SCTP_INP_INFO_RUNLOCK(); 635 return (NULL); 636 } 637 LIST_FOREACH(stcb, head, sctp_asocs) { 638 SCTP_INP_RLOCK(stcb->sctp_ep); 639 SCTP_TCB_LOCK(stcb); 640 SCTP_INP_RUNLOCK(stcb->sctp_ep); 641 if (stcb->asoc.my_vtag == vtag) { 642 /* candidate */ 643 if (inp != stcb->sctp_ep) { 644 /* some other guy has the 645 * same vtag active (vtag collision). 646 */ 647 sctp_pegs[SCTP_VTAG_BOGUS]++; 648 SCTP_TCB_UNLOCK(stcb); 649 continue; 650 } 651 sctp_pegs[SCTP_VTAG_EXPR]++; 652 SCTP_INP_INFO_RUNLOCK(); 653 return (stcb); 654 } 655 SCTP_TCB_UNLOCK(stcb); 656 } 657 SCTP_INP_INFO_RUNLOCK(); 658 return (NULL); 659 } 660 661 static struct sctp_inpcb * 662 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head, 663 uint16_t lport) 664 { 665 struct sctp_inpcb *inp; 666 struct sockaddr_in *sin; 667 struct sockaddr_in6 *sin6; 668 struct sctp_laddr *laddr; 669 670 /* Endpoing probe expects 671 * that the INP_INFO is locked. 672 */ 673 if (nam->sa_family == AF_INET) { 674 sin = (struct sockaddr_in *)nam; 675 sin6 = NULL; 676 } else if (nam->sa_family == AF_INET6) { 677 sin6 = (struct sockaddr_in6 *)nam; 678 sin = NULL; 679 } else { 680 /* unsupported family */ 681 return (NULL); 682 } 683 if (head == NULL) 684 return (NULL); 685 686 LIST_FOREACH(inp, head, sctp_hash) { 687 SCTP_INP_RLOCK(inp); 688 689 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) && 690 (inp->sctp_lport == lport)) { 691 /* got it */ 692 if ((nam->sa_family == AF_INET) && 693 (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 694 (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY) 695 ) { 696 /* IPv4 on a IPv6 socket with ONLY IPv6 set */ 697 SCTP_INP_RUNLOCK(inp); 698 continue; 699 } 700 /* A V6 address and the endpoint is NOT bound V6 */ 701 if (nam->sa_family == AF_INET6 && 702 (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) { 703 SCTP_INP_RUNLOCK(inp); 704 continue; 705 } 706 SCTP_INP_RUNLOCK(inp); 707 return (inp); 708 } 709 SCTP_INP_RUNLOCK(inp); 710 } 711 712 if ((nam->sa_family == AF_INET) && 713 (sin->sin_addr.s_addr == INADDR_ANY)) { 714 /* Can't hunt for one that has no address specified */ 715 return (NULL); 716 } else if ((nam->sa_family == AF_INET6) && 717 (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) { 718 /* Can't hunt for one that has no address specified */ 719 return (NULL); 720 } 721 /* 722 * ok, not bound to all so see if we can find a EP bound to this 723 * address. 724 */ 725 #ifdef SCTP_DEBUG 726 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 727 printf("Ok, there is NO bound-all available for port:%x\n", ntohs(lport)); 728 } 729 #endif 730 LIST_FOREACH(inp, head, sctp_hash) { 731 SCTP_INP_RLOCK(inp); 732 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) { 733 SCTP_INP_RUNLOCK(inp); 734 continue; 735 } 736 /* 737 * Ok this could be a likely candidate, look at all of 738 * its addresses 739 */ 740 if (inp->sctp_lport != lport) { 741 SCTP_INP_RUNLOCK(inp); 742 continue; 743 } 744 #ifdef SCTP_DEBUG 745 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 746 printf("Ok, found maching local port\n"); 747 } 748 #endif 749 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 750 if (laddr->ifa == NULL) { 751 #ifdef SCTP_DEBUG 752 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 753 printf("An ounce of prevention is worth a pound of cure\n"); 754 } 755 #endif 756 continue; 757 } 758 #ifdef SCTP_DEBUG 759 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 760 printf("Ok laddr->ifa:%p is possible, ", 761 laddr->ifa); 762 } 763 #endif 764 if (laddr->ifa->ifa_addr == NULL) { 765 #ifdef SCTP_DEBUG 766 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 767 printf("Huh IFA as an ifa_addr=NULL, "); 768 } 769 #endif 770 continue; 771 } 772 #ifdef SCTP_DEBUG 773 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 774 printf("Ok laddr->ifa:%p is possible, ", 775 laddr->ifa->ifa_addr); 776 sctp_print_address(laddr->ifa->ifa_addr); 777 printf("looking for "); 778 sctp_print_address(nam); 779 } 780 #endif 781 if (laddr->ifa->ifa_addr->sa_family == nam->sa_family) { 782 /* possible, see if it matches */ 783 struct sockaddr_in *intf_addr; 784 intf_addr = (struct sockaddr_in *) 785 laddr->ifa->ifa_addr; 786 if (nam->sa_family == AF_INET) { 787 if (sin->sin_addr.s_addr == 788 intf_addr->sin_addr.s_addr) { 789 #ifdef SCTP_DEBUG 790 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 791 printf("YES, return ep:%p\n", inp); 792 } 793 #endif 794 SCTP_INP_RUNLOCK(inp); 795 return (inp); 796 } 797 } else if (nam->sa_family == AF_INET6) { 798 struct sockaddr_in6 *intf_addr6; 799 intf_addr6 = (struct sockaddr_in6 *) 800 laddr->ifa->ifa_addr; 801 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 802 &intf_addr6->sin6_addr)) { 803 #ifdef SCTP_DEBUG 804 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 805 printf("YES, return ep:%p\n", inp); 806 } 807 #endif 808 SCTP_INP_RUNLOCK(inp); 809 return (inp); 810 } 811 } 812 } 813 SCTP_INP_RUNLOCK(inp); 814 } 815 } 816 #ifdef SCTP_DEBUG 817 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 818 printf("NO, Falls out to NULL\n"); 819 } 820 #endif 821 return (NULL); 822 } 823 824 825 struct sctp_inpcb * 826 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock) 827 { 828 /* 829 * First we check the hash table to see if someone has this port 830 * bound with just the port. 831 */ 832 struct sctp_inpcb *inp; 833 struct sctppcbhead *head; 834 int lport; 835 #ifdef SCTP_DEBUG 836 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 837 printf("Looking for endpoint %d :", 838 ntohs(((struct sockaddr_in *)nam)->sin_port)); 839 sctp_print_address(nam); 840 } 841 #endif 842 if (nam->sa_family == AF_INET) { 843 lport = ((struct sockaddr_in *)nam)->sin_port; 844 } else if (nam->sa_family == AF_INET6) { 845 lport = ((struct sockaddr_in6 *)nam)->sin6_port; 846 } else { 847 /* unsupported family */ 848 return (NULL); 849 } 850 /* 851 * I could cheat here and just cast to one of the types but we will 852 * do it right. It also provides the check against an Unsupported 853 * type too. 854 */ 855 /* Find the head of the ALLADDR chain */ 856 if (have_lock == 0) { 857 SCTP_INP_INFO_RLOCK(); 858 } 859 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 860 sctppcbinfo.hashmark)]; 861 #ifdef SCTP_DEBUG 862 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 863 printf("Main hash to lookup at head:%p\n", head); 864 } 865 #endif 866 inp = sctp_endpoint_probe(nam, head, lport); 867 868 /* 869 * If the TCP model exists it could be that the main listening 870 * endpoint is gone but there exists a connected socket for this 871 * guy yet. If so we can return the first one that we find. This 872 * may NOT be the correct one but the sctp_findassociation_ep_addr 873 * has further code to look at all TCP models. 874 */ 875 if (inp == NULL && find_tcp_pool) { 876 unsigned int i; 877 #ifdef SCTP_DEBUG 878 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 879 printf("EP was NULL and TCP model is supported\n"); 880 } 881 #endif 882 for (i = 0; i < sctppcbinfo.hashtblsize; i++) { 883 /* 884 * This is real gross, but we do NOT have a remote 885 * port at this point depending on who is calling. We 886 * must therefore look for ANY one that matches our 887 * local port :/ 888 */ 889 head = &sctppcbinfo.sctp_tcpephash[i]; 890 if (LIST_FIRST(head)) { 891 inp = sctp_endpoint_probe(nam, head, lport); 892 if (inp) { 893 /* Found one */ 894 break; 895 } 896 } 897 } 898 } 899 #ifdef SCTP_DEBUG 900 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 901 printf("EP to return is %p\n", inp); 902 } 903 #endif 904 if (have_lock == 0) { 905 if (inp) { 906 SCTP_INP_WLOCK(inp); 907 SCTP_INP_INCR_REF(inp); 908 SCTP_INP_WUNLOCK(inp); 909 } 910 SCTP_INP_INFO_RUNLOCK(); 911 } else { 912 if (inp) { 913 SCTP_INP_WLOCK(inp); 914 SCTP_INP_INCR_REF(inp); 915 SCTP_INP_WUNLOCK(inp); 916 } 917 } 918 return (inp); 919 } 920 921 /* 922 * Find an association for an endpoint with the pointer to whom you want 923 * to send to and the endpoint pointer. The address can be IPv4 or IPv6. 924 * We may need to change the *to to some other struct like a mbuf... 925 */ 926 struct sctp_tcb * 927 sctp_findassociation_addr_sa(struct sockaddr *to, struct sockaddr *from, 928 struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool) 929 { 930 struct sctp_inpcb *inp; 931 struct sctp_tcb *retval; 932 933 SCTP_INP_INFO_RLOCK(); 934 if (find_tcp_pool) { 935 if (inp_p != NULL) { 936 retval = sctp_tcb_special_locate(inp_p, from, to, netp); 937 } else { 938 retval = sctp_tcb_special_locate(&inp, from, to, netp); 939 } 940 if (retval != NULL) { 941 SCTP_INP_INFO_RUNLOCK(); 942 return (retval); 943 } 944 } 945 inp = sctp_pcb_findep(to, 0, 1); 946 if (inp_p != NULL) { 947 *inp_p = inp; 948 } 949 SCTP_INP_INFO_RUNLOCK(); 950 951 if (inp == NULL) { 952 return (NULL); 953 } 954 955 /* 956 * ok, we have an endpoint, now lets find the assoc for it (if any) 957 * we now place the source address or from in the to of the find 958 * endpoint call. Since in reality this chain is used from the 959 * inbound packet side. 960 */ 961 if (inp_p != NULL) { 962 return (sctp_findassociation_ep_addr(inp_p, from, netp, to, NULL)); 963 } else { 964 return (sctp_findassociation_ep_addr(&inp, from, netp, to, NULL)); 965 } 966 } 967 968 969 /* 970 * This routine will grub through the mbuf that is a INIT or INIT-ACK and 971 * find all addresses that the sender has specified in any address list. 972 * Each address will be used to lookup the TCB and see if one exits. 973 */ 974 static struct sctp_tcb * 975 sctp_findassociation_special_addr(struct mbuf *m, int iphlen, int offset, 976 struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp, 977 struct sockaddr *dest) 978 { 979 struct sockaddr_in sin4; 980 struct sockaddr_in6 sin6; 981 struct sctp_paramhdr *phdr, parm_buf; 982 struct sctp_tcb *retval; 983 u_int32_t ptype, plen; 984 985 memset(&sin4, 0, sizeof(sin4)); 986 memset(&sin6, 0, sizeof(sin6)); 987 sin4.sin_len = sizeof(sin4); 988 sin4.sin_family = AF_INET; 989 sin4.sin_port = sh->src_port; 990 sin6.sin6_len = sizeof(sin6); 991 sin6.sin6_family = AF_INET6; 992 sin6.sin6_port = sh->src_port; 993 994 retval = NULL; 995 offset += sizeof(struct sctp_init_chunk); 996 997 phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf)); 998 while (phdr != NULL) { 999 /* now we must see if we want the parameter */ 1000 ptype = ntohs(phdr->param_type); 1001 plen = ntohs(phdr->param_length); 1002 if (plen == 0) { 1003 #ifdef SCTP_DEBUG 1004 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1005 printf("sctp_findassociation_special_addr: Impossible length in parameter\n"); 1006 } 1007 #endif /* SCTP_DEBUG */ 1008 break; 1009 } 1010 if (ptype == SCTP_IPV4_ADDRESS && 1011 plen == sizeof(struct sctp_ipv4addr_param)) { 1012 /* Get the rest of the address */ 1013 struct sctp_ipv4addr_param ip4_parm, *p4; 1014 1015 phdr = sctp_get_next_param(m, offset, 1016 (struct sctp_paramhdr *)&ip4_parm, plen); 1017 if (phdr == NULL) { 1018 return (NULL); 1019 } 1020 p4 = (struct sctp_ipv4addr_param *)phdr; 1021 memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr)); 1022 /* look it up */ 1023 retval = sctp_findassociation_ep_addr(inp_p, 1024 (struct sockaddr *)&sin4, netp, dest, NULL); 1025 if (retval != NULL) { 1026 return (retval); 1027 } 1028 } else if (ptype == SCTP_IPV6_ADDRESS && 1029 plen == sizeof(struct sctp_ipv6addr_param)) { 1030 /* Get the rest of the address */ 1031 struct sctp_ipv6addr_param ip6_parm, *p6; 1032 1033 phdr = sctp_get_next_param(m, offset, 1034 (struct sctp_paramhdr *)&ip6_parm, plen); 1035 if (phdr == NULL) { 1036 return (NULL); 1037 } 1038 p6 = (struct sctp_ipv6addr_param *)phdr; 1039 memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr)); 1040 /* look it up */ 1041 retval = sctp_findassociation_ep_addr(inp_p, 1042 (struct sockaddr *)&sin6, netp, dest, NULL); 1043 if (retval != NULL) { 1044 return (retval); 1045 } 1046 } 1047 offset += SCTP_SIZE32(plen); 1048 phdr = sctp_get_next_param(m, offset, &parm_buf, 1049 sizeof(parm_buf)); 1050 } 1051 return (NULL); 1052 } 1053 1054 static struct sctp_tcb * 1055 sctp_findassoc_by_vtag(struct sockaddr *from, uint32_t vtag, 1056 struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport, 1057 uint16_t lport) 1058 { 1059 /* 1060 * Use my vtag to hash. If we find it we then verify the source addr 1061 * is in the assoc. If all goes well we save a bit on rec of a packet. 1062 */ 1063 struct sctpasochead *head; 1064 struct sctp_nets *net; 1065 struct sctp_tcb *stcb; 1066 1067 SCTP_INP_INFO_RLOCK(); 1068 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag, 1069 sctppcbinfo.hashasocmark)]; 1070 if (head == NULL) { 1071 /* invalid vtag */ 1072 SCTP_INP_INFO_RUNLOCK(); 1073 return (NULL); 1074 } 1075 LIST_FOREACH(stcb, head, sctp_asocs) { 1076 SCTP_INP_RLOCK(stcb->sctp_ep); 1077 SCTP_TCB_LOCK(stcb); 1078 SCTP_INP_RUNLOCK(stcb->sctp_ep); 1079 if (stcb->asoc.my_vtag == vtag) { 1080 /* candidate */ 1081 if (stcb->rport != rport) { 1082 /* 1083 * we could remove this if vtags are unique 1084 * across the system. 1085 */ 1086 SCTP_TCB_UNLOCK(stcb); 1087 continue; 1088 } 1089 if (stcb->sctp_ep->sctp_lport != lport) { 1090 /* 1091 * we could remove this if vtags are unique 1092 * across the system. 1093 */ 1094 SCTP_TCB_UNLOCK(stcb); 1095 continue; 1096 } 1097 net = sctp_findnet(stcb, from); 1098 if (net) { 1099 /* yep its him. */ 1100 *netp = net; 1101 sctp_pegs[SCTP_VTAG_EXPR]++; 1102 *inp_p = stcb->sctp_ep; 1103 SCTP_INP_INFO_RUNLOCK(); 1104 return (stcb); 1105 } else { 1106 /* not him, this should only 1107 * happen in rare cases so 1108 * I peg it. 1109 */ 1110 sctp_pegs[SCTP_VTAG_BOGUS]++; 1111 } 1112 } 1113 SCTP_TCB_UNLOCK(stcb); 1114 } 1115 SCTP_INP_INFO_RUNLOCK(); 1116 return (NULL); 1117 } 1118 1119 /* 1120 * Find an association with the pointer to the inbound IP packet. This 1121 * can be a IPv4 or IPv6 packet. 1122 */ 1123 struct sctp_tcb * 1124 sctp_findassociation_addr(struct mbuf *m, int iphlen, int offset, 1125 struct sctphdr *sh, struct sctp_chunkhdr *ch, 1126 struct sctp_inpcb **inp_p, struct sctp_nets **netp) 1127 { 1128 int find_tcp_pool; 1129 struct ip *iph; 1130 struct sctp_tcb *retval; 1131 struct sockaddr_storage to_store, from_store; 1132 struct sockaddr *to = (struct sockaddr *)&to_store; 1133 struct sockaddr *from = (struct sockaddr *)&from_store; 1134 struct sctp_inpcb *inp; 1135 1136 1137 iph = mtod(m, struct ip *); 1138 if (iph->ip_v == IPVERSION) { 1139 /* its IPv4 */ 1140 struct sockaddr_in *to4, *from4; 1141 1142 to4 = (struct sockaddr_in *)&to_store; 1143 from4 = (struct sockaddr_in *)&from_store; 1144 memset(to4, 0, sizeof(*to4)); 1145 memset(from4, 0, sizeof(*from4)); 1146 from4->sin_family = to4->sin_family = AF_INET; 1147 from4->sin_len = to4->sin_len = sizeof(struct sockaddr_in); 1148 from4->sin_addr.s_addr = iph->ip_src.s_addr; 1149 to4->sin_addr.s_addr = iph->ip_dst.s_addr ; 1150 from4->sin_port = sh->src_port; 1151 to4->sin_port = sh->dest_port; 1152 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1153 /* its IPv6 */ 1154 struct ip6_hdr *ip6; 1155 struct sockaddr_in6 *to6, *from6; 1156 1157 ip6 = mtod(m, struct ip6_hdr *); 1158 to6 = (struct sockaddr_in6 *)&to_store; 1159 from6 = (struct sockaddr_in6 *)&from_store; 1160 memset(to6, 0, sizeof(*to6)); 1161 memset(from6, 0, sizeof(*from6)); 1162 from6->sin6_family = to6->sin6_family = AF_INET6; 1163 from6->sin6_len = to6->sin6_len = sizeof(struct sockaddr_in6); 1164 from6->sin6_addr = ip6->ip6_src; 1165 to6->sin6_addr = ip6->ip6_dst; 1166 from6->sin6_port = sh->src_port; 1167 to6->sin6_port = sh->dest_port; 1168 /* Get the scopes in properly to the sin6 addr's */ 1169 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) 1170 /* We probably don't need this operation (jinmei@kame) */ 1171 (void)in6_recoverscope(to6, &to6->sin6_addr, NULL); 1172 (void)in6_embedscope(&to6->sin6_addr, to6, NULL, NULL); 1173 1174 (void)in6_recoverscope(from6, &from6->sin6_addr, NULL); 1175 (void)in6_embedscope(&from6->sin6_addr, from6, NULL, NULL); 1176 #endif 1177 } else { 1178 /* Currently not supported. */ 1179 return (NULL); 1180 } 1181 #ifdef SCTP_DEBUG 1182 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1183 printf("Looking for port %d address :", 1184 ntohs(((struct sockaddr_in *)to)->sin_port)); 1185 sctp_print_address(to); 1186 printf("From for port %d address :", 1187 ntohs(((struct sockaddr_in *)from)->sin_port)); 1188 sctp_print_address(from); 1189 } 1190 #endif 1191 1192 if (sh->v_tag) { 1193 /* we only go down this path if vtag is non-zero */ 1194 retval = sctp_findassoc_by_vtag(from, ntohl(sh->v_tag), 1195 inp_p, netp, sh->src_port, sh->dest_port); 1196 if (retval) { 1197 return (retval); 1198 } 1199 } 1200 find_tcp_pool = 0; 1201 if ((ch->chunk_type != SCTP_INITIATION) && 1202 (ch->chunk_type != SCTP_INITIATION_ACK) && 1203 (ch->chunk_type != SCTP_COOKIE_ACK) && 1204 (ch->chunk_type != SCTP_COOKIE_ECHO)) { 1205 /* Other chunk types go to the tcp pool. */ 1206 find_tcp_pool = 1; 1207 } 1208 if (inp_p) { 1209 retval = sctp_findassociation_addr_sa(to, from, inp_p, netp, 1210 find_tcp_pool); 1211 inp = *inp_p; 1212 } else { 1213 retval = sctp_findassociation_addr_sa(to, from, &inp, netp, 1214 find_tcp_pool); 1215 } 1216 #ifdef SCTP_DEBUG 1217 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1218 printf("retval:%p inp:%p\n", retval, inp); 1219 } 1220 #endif 1221 if (retval == NULL && inp) { 1222 /* Found a EP but not this address */ 1223 #ifdef SCTP_DEBUG 1224 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1225 printf("Found endpoint %p but no asoc - ep state:%x\n", 1226 inp, inp->sctp_flags); 1227 } 1228 #endif 1229 if ((ch->chunk_type == SCTP_INITIATION) || 1230 (ch->chunk_type == SCTP_INITIATION_ACK)) { 1231 /* 1232 * special hook, we do NOT return linp or an 1233 * association that is linked to an existing 1234 * association that is under the TCP pool (i.e. no 1235 * listener exists). The endpoint finding routine 1236 * will always find a listner before examining the 1237 * TCP pool. 1238 */ 1239 if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) { 1240 #ifdef SCTP_DEBUG 1241 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1242 printf("Gak, its in the TCP pool... return NULL"); 1243 } 1244 #endif 1245 if (inp_p) { 1246 *inp_p = NULL; 1247 } 1248 return (NULL); 1249 } 1250 #ifdef SCTP_DEBUG 1251 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1252 printf("Now doing SPECIAL find\n"); 1253 } 1254 #endif 1255 retval = sctp_findassociation_special_addr(m, iphlen, 1256 offset, sh, inp_p, netp, to); 1257 } 1258 } 1259 #ifdef SCTP_DEBUG 1260 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1261 printf("retval is %p\n", retval); 1262 } 1263 #endif 1264 return (retval); 1265 } 1266 1267 extern int sctp_max_burst_default; 1268 1269 extern unsigned int sctp_delayed_sack_time_default; 1270 extern unsigned int sctp_heartbeat_interval_default; 1271 extern unsigned int sctp_pmtu_raise_time_default; 1272 extern unsigned int sctp_shutdown_guard_time_default; 1273 extern unsigned int sctp_secret_lifetime_default; 1274 1275 extern unsigned int sctp_rto_max_default; 1276 extern unsigned int sctp_rto_min_default; 1277 extern unsigned int sctp_rto_initial_default; 1278 extern unsigned int sctp_init_rto_max_default; 1279 extern unsigned int sctp_valid_cookie_life_default; 1280 extern unsigned int sctp_init_rtx_max_default; 1281 extern unsigned int sctp_assoc_rtx_max_default; 1282 extern unsigned int sctp_path_rtx_max_default; 1283 extern unsigned int sctp_nr_outgoing_streams_default; 1284 1285 /* 1286 * allocate a sctp_inpcb and setup a temporary binding to a port/all 1287 * addresses. This way if we don't get a bind we by default pick a ephemeral 1288 * port with all addresses bound. 1289 */ 1290 int 1291 sctp_inpcb_alloc(struct socket *so) 1292 { 1293 /* 1294 * we get called when a new endpoint starts up. We need to allocate 1295 * the sctp_inpcb structure from the zone and init it. Mark it as 1296 * unbound and find a port that we can use as an ephemeral with 1297 * INADDR_ANY. If the user binds later no problem we can then add 1298 * in the specific addresses. And setup the default parameters for 1299 * the EP. 1300 */ 1301 int i, error; 1302 struct sctp_inpcb *inp; 1303 #ifdef DEBUG 1304 struct sctp_inpcb *n_inp; 1305 #endif 1306 #ifdef IPSEC 1307 struct inpcbpolicy *pcb_sp = NULL; 1308 #endif 1309 struct sctp_pcb *m; 1310 struct timeval time; 1311 1312 error = 0; 1313 1314 /* Hack alert: 1315 * 1316 * This code audits the entire INP list to see if 1317 * any ep's that are in the GONE state are now 1318 * all free. This should not happen really since when 1319 * the last association if freed we should end up deleting 1320 * the inpcb. This code including the locks should 1321 * be taken out ... since the last set of fixes I 1322 * have not seen the "Found a GONE on list" has not 1323 * came out. But i am paranoid and we will leave this 1324 * in at the cost of efficency on allocation of PCB's. 1325 * Probably we should move this to the invariant 1326 * compile options 1327 */ 1328 #ifdef DEBUG 1329 SCTP_INP_INFO_RLOCK(); 1330 inp = LIST_FIRST(&sctppcbinfo.listhead); 1331 while (inp) { 1332 n_inp = LIST_NEXT(inp, sctp_list); 1333 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 1334 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) { 1335 /* finish the job now */ 1336 printf("Found a GONE on list\n"); 1337 SCTP_INP_INFO_RUNLOCK(); 1338 sctp_inpcb_free(inp, 1); 1339 SCTP_INP_INFO_RLOCK(); 1340 } 1341 } 1342 inp = n_inp; 1343 } 1344 SCTP_INP_INFO_RUNLOCK(); 1345 #endif /* DEBUG */ 1346 1347 SCTP_INP_INFO_WLOCK(); 1348 inp = (struct sctp_inpcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_ep); 1349 if (inp == NULL) { 1350 printf("Out of SCTP-INPCB structures - no resources\n"); 1351 SCTP_INP_INFO_WUNLOCK(); 1352 return (ENOBUFS); 1353 } 1354 1355 /* zap it */ 1356 memset(inp, 0, sizeof(*inp)); 1357 1358 /* setup socket pointers */ 1359 inp->sctp_socket = so; 1360 1361 /* setup inpcb socket too */ 1362 inp->ip_inp.inp.inp_socket = so; 1363 inp->sctp_frag_point = SCTP_DEFAULT_MAXSEGMENT; 1364 #ifdef IPSEC 1365 if (ipsec_enabled) { 1366 error = ipsec_init_pcbpolicy(so, &pcb_sp); 1367 if (error != 0) { 1368 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1369 SCTP_INP_INFO_WUNLOCK(); 1370 return error; 1371 } 1372 /* Arrange to share the policy */ 1373 inp->ip_inp.inp.inp_sp = pcb_sp; 1374 pcb_sp->sp_inph = (struct inpcb_hdr *)inp; 1375 } 1376 #endif /* IPSEC */ 1377 sctppcbinfo.ipi_count_ep++; 1378 inp->inp_ip_ttl = ip_defttl; 1379 inp->inp_ip_tos = 0; 1380 1381 so->so_pcb = (void *)inp; 1382 1383 if ((so->so_type == SOCK_DGRAM) || 1384 (so->so_type == SOCK_SEQPACKET)) { 1385 /* UDP style socket */ 1386 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE | 1387 SCTP_PCB_FLAGS_UNBOUND); 1388 inp->sctp_flags |= (SCTP_PCB_FLAGS_RECVDATAIOEVNT); 1389 /* Be sure it is NON-BLOCKING IO for UDP */ 1390 /*so->so_state |= SS_NBIO;*/ 1391 } else if (so->so_type == SOCK_STREAM) { 1392 /* TCP style socket */ 1393 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 1394 SCTP_PCB_FLAGS_UNBOUND); 1395 inp->sctp_flags |= (SCTP_PCB_FLAGS_RECVDATAIOEVNT); 1396 /* Be sure we have blocking IO bu default */ 1397 so->so_state &= ~SS_NBIO; 1398 } else { 1399 /* 1400 * unsupported socket type (RAW, etc)- in case we missed 1401 * it in protosw 1402 */ 1403 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1404 SCTP_INP_INFO_WUNLOCK(); 1405 return (EOPNOTSUPP); 1406 } 1407 inp->sctp_tcbhash = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_hash); 1408 if (inp->sctp_tcbhash == NULL) { 1409 printf("Out of SCTP-INPCB->hashinit - no resources\n"); 1410 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1411 SCTP_INP_INFO_WUNLOCK(); 1412 return (ENOBUFS); 1413 } else { 1414 for (i = 0; i < sctp_pcbtblsize; i++) 1415 LIST_INIT(&inp->sctp_tcbhash[i]); 1416 for (i = 1; i < sctp_pcbtblsize; i <<= 1) 1417 continue; 1418 inp->sctp_hashmark = i - 1; 1419 } 1420 /* LOCK init's */ 1421 SCTP_INP_LOCK_INIT(inp); 1422 SCTP_ASOC_CREATE_LOCK_INIT(inp); 1423 /* lock the new ep */ 1424 SCTP_INP_WLOCK(inp); 1425 1426 /* add it to the info area */ 1427 LIST_INSERT_HEAD(&sctppcbinfo.listhead, inp, sctp_list); 1428 SCTP_INP_INFO_WUNLOCK(); 1429 1430 LIST_INIT(&inp->sctp_addr_list); 1431 LIST_INIT(&inp->sctp_asoc_list); 1432 TAILQ_INIT(&inp->sctp_queue_list); 1433 /* Init the timer structure for signature change */ 1434 callout_init(&inp->sctp_ep.signature_change.timer, 0); 1435 inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE; 1436 1437 /* now init the actual endpoint default data */ 1438 m = &inp->sctp_ep; 1439 1440 /* setup the base timeout information */ 1441 m->sctp_timeoutticks[SCTP_TIMER_SEND] = SEC_TO_TICKS(SCTP_SEND_SEC); /* needed ? */ 1442 m->sctp_timeoutticks[SCTP_TIMER_INIT] = SEC_TO_TICKS(SCTP_INIT_SEC); /* needed ? */ 1443 m->sctp_timeoutticks[SCTP_TIMER_RECV] = MSEC_TO_TICKS(sctp_delayed_sack_time_default); 1444 m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = sctp_heartbeat_interval_default; /* this is in MSEC */ 1445 m->sctp_timeoutticks[SCTP_TIMER_PMTU] = SEC_TO_TICKS(sctp_pmtu_raise_time_default); 1446 m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = SEC_TO_TICKS(sctp_shutdown_guard_time_default); 1447 m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = SEC_TO_TICKS(sctp_secret_lifetime_default); 1448 /* all max/min max are in ms */ 1449 m->sctp_maxrto = sctp_rto_max_default; 1450 m->sctp_minrto = sctp_rto_min_default; 1451 m->initial_rto = sctp_rto_initial_default; 1452 m->initial_init_rto_max = sctp_init_rto_max_default; 1453 1454 m->max_open_streams_intome = MAX_SCTP_STREAMS; 1455 1456 m->max_init_times = sctp_init_rtx_max_default; 1457 m->max_send_times = sctp_assoc_rtx_max_default; 1458 m->def_net_failure = sctp_path_rtx_max_default; 1459 m->sctp_sws_sender = SCTP_SWS_SENDER_DEF; 1460 m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF; 1461 m->max_burst = sctp_max_burst_default; 1462 /* number of streams to pre-open on a association */ 1463 m->pre_open_stream_count = sctp_nr_outgoing_streams_default; 1464 1465 /* Add adaption cookie */ 1466 m->adaption_layer_indicator = 0x504C5253; 1467 1468 /* Minimum cookie size */ 1469 m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) + 1470 sizeof(struct sctp_state_cookie); 1471 m->size_of_a_cookie += SCTP_SIGNATURE_SIZE; 1472 1473 /* Setup the initial secret */ 1474 SCTP_GETTIME_TIMEVAL(&time); 1475 m->time_of_secret_change = time.tv_sec; 1476 1477 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) { 1478 m->secret_key[0][i] = sctp_select_initial_TSN(m); 1479 } 1480 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL); 1481 1482 /* How long is a cookie good for ? */ 1483 m->def_cookie_life = sctp_valid_cookie_life_default; 1484 SCTP_INP_WUNLOCK(inp); 1485 return (error); 1486 } 1487 1488 1489 void 1490 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp, 1491 struct sctp_tcb *stcb) 1492 { 1493 uint16_t lport, rport; 1494 struct sctppcbhead *head; 1495 struct sctp_laddr *laddr, *oladdr; 1496 1497 SCTP_TCB_UNLOCK(stcb); 1498 SCTP_INP_INFO_WLOCK(); 1499 SCTP_INP_WLOCK(old_inp); 1500 SCTP_INP_WLOCK(new_inp); 1501 SCTP_TCB_LOCK(stcb); 1502 1503 new_inp->sctp_ep.time_of_secret_change = 1504 old_inp->sctp_ep.time_of_secret_change; 1505 memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key, 1506 sizeof(old_inp->sctp_ep.secret_key)); 1507 new_inp->sctp_ep.current_secret_number = 1508 old_inp->sctp_ep.current_secret_number; 1509 new_inp->sctp_ep.last_secret_number = 1510 old_inp->sctp_ep.last_secret_number; 1511 new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie; 1512 1513 /* Copy the port across */ 1514 lport = new_inp->sctp_lport = old_inp->sctp_lport; 1515 rport = stcb->rport; 1516 /* Pull the tcb from the old association */ 1517 LIST_REMOVE(stcb, sctp_tcbhash); 1518 LIST_REMOVE(stcb, sctp_tcblist); 1519 1520 /* Now insert the new_inp into the TCP connected hash */ 1521 head = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR((lport + rport), 1522 sctppcbinfo.hashtcpmark)]; 1523 1524 LIST_INSERT_HEAD(head, new_inp, sctp_hash); 1525 1526 /* Now move the tcb into the endpoint list */ 1527 LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist); 1528 /* 1529 * Question, do we even need to worry about the ep-hash since 1530 * we only have one connection? Probably not :> so lets 1531 * get rid of it and not suck up any kernel memory in that. 1532 */ 1533 SCTP_INP_INFO_WUNLOCK(); 1534 stcb->sctp_socket = new_inp->sctp_socket; 1535 stcb->sctp_ep = new_inp; 1536 if (new_inp->sctp_tcbhash != NULL) { 1537 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_hash, 1538 new_inp->sctp_tcbhash); 1539 new_inp->sctp_tcbhash = NULL; 1540 } 1541 if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 1542 /* Subset bound, so copy in the laddr list from the old_inp */ 1543 LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) { 1544 laddr = (struct sctp_laddr *)SCTP_ZONE_GET( 1545 sctppcbinfo.ipi_zone_laddr); 1546 if (laddr == NULL) { 1547 /* 1548 * Gak, what can we do? This assoc is really 1549 * HOSED. We probably should send an abort 1550 * here. 1551 */ 1552 #ifdef SCTP_DEBUG 1553 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1554 printf("Association hosed in TCP model, out of laddr memory\n"); 1555 } 1556 #endif /* SCTP_DEBUG */ 1557 continue; 1558 } 1559 sctppcbinfo.ipi_count_laddr++; 1560 sctppcbinfo.ipi_gencnt_laddr++; 1561 memset(laddr, 0, sizeof(*laddr)); 1562 laddr->ifa = oladdr->ifa; 1563 LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr, 1564 sctp_nxt_addr); 1565 new_inp->laddr_count++; 1566 } 1567 } 1568 SCTP_INP_WUNLOCK(new_inp); 1569 SCTP_INP_WUNLOCK(old_inp); 1570 } 1571 1572 static int 1573 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport) 1574 { 1575 struct sctppcbhead *head; 1576 struct sctp_inpcb *t_inp; 1577 1578 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 1579 sctppcbinfo.hashmark)]; 1580 LIST_FOREACH(t_inp, head, sctp_hash) { 1581 if (t_inp->sctp_lport != lport) { 1582 continue; 1583 } 1584 /* This one is in use. */ 1585 /* check the v6/v4 binding issue */ 1586 if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 1587 (((struct in6pcb *)t_inp)->in6p_flags & IN6P_IPV6_V6ONLY)) { 1588 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 1589 /* collision in V6 space */ 1590 return (1); 1591 } else { 1592 /* inp is BOUND_V4 no conflict */ 1593 continue; 1594 } 1595 } else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 1596 /* t_inp is bound v4 and v6, conflict always */ 1597 return (1); 1598 } else { 1599 /* t_inp is bound only V4 */ 1600 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 1601 (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY) 1602 ) { 1603 /* no conflict */ 1604 continue; 1605 } 1606 /* else fall through to conflict */ 1607 } 1608 return (1); 1609 } 1610 return (0); 1611 } 1612 1613 int 1614 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct lwp *l) 1615 { 1616 /* bind a ep to a socket address */ 1617 struct sctppcbhead *head; 1618 struct sctp_inpcb *inp, *inp_tmp; 1619 int bindall; 1620 uint16_t lport; 1621 int error; 1622 1623 lport = 0; 1624 error = 0; 1625 bindall = 1; 1626 inp = (struct sctp_inpcb *)so->so_pcb; 1627 #ifdef SCTP_DEBUG 1628 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1629 if (addr) { 1630 printf("Bind called port:%d\n", 1631 ntohs(((struct sockaddr_in *)addr)->sin_port)); 1632 printf("Addr :"); 1633 sctp_print_address(addr); 1634 } 1635 } 1636 #endif /* SCTP_DEBUG */ 1637 if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) { 1638 /* already did a bind, subsequent binds NOT allowed ! */ 1639 return (EINVAL); 1640 } 1641 1642 if (addr != NULL) { 1643 if (addr->sa_family == AF_INET) { 1644 struct sockaddr_in *sin; 1645 1646 /* IPV6_V6ONLY socket? */ 1647 if (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY) { 1648 return (EINVAL); 1649 } 1650 1651 if (addr->sa_len != sizeof(*sin)) 1652 return (EINVAL); 1653 1654 sin = (struct sockaddr_in *)addr; 1655 lport = sin->sin_port; 1656 1657 if (sin->sin_addr.s_addr != INADDR_ANY) { 1658 bindall = 0; 1659 } 1660 #ifdef IPSEC 1661 inp->ip_inp.inp.inp_af = AF_INET; 1662 #endif 1663 } else if (addr->sa_family == AF_INET6) { 1664 /* Only for pure IPv6 Address. (No IPv4 Mapped!) */ 1665 struct sockaddr_in6 *sin6; 1666 1667 sin6 = (struct sockaddr_in6 *)addr; 1668 1669 if (addr->sa_len != sizeof(*sin6)) 1670 return (EINVAL); 1671 1672 lport = sin6->sin6_port; 1673 if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1674 bindall = 0; 1675 /* KAME hack: embed scopeid */ 1676 error = sa6_embedscope(sin6, ip6_use_defzone); 1677 if (error != 0) 1678 return (error); 1679 } 1680 #ifndef SCOPEDROUTING 1681 /* this must be cleared for ifa_ifwithaddr() */ 1682 sin6->sin6_scope_id = 0; 1683 #endif /* SCOPEDROUTING */ 1684 #ifdef IPSEC 1685 inp->ip_inp.inp.inp_af = AF_INET6; 1686 #endif 1687 } else { 1688 return (EAFNOSUPPORT); 1689 } 1690 #ifdef IPSEC 1691 if (ipsec_enabled) { 1692 inp->ip_inp.inp.inp_socket = so; 1693 error = ipsec_init_pcbpolicy(so, &inp->ip_inp.inp.inp_sp); 1694 if (error != 0) 1695 return (error); 1696 inp->ip_inp.inp.inp_sp->sp_inph = (struct inpcb_hdr *)inp; 1697 } 1698 #endif 1699 } 1700 SCTP_INP_INFO_WLOCK(); 1701 #ifdef SCTP_DEBUG 1702 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1703 printf("sctp_inpcb_bind: after SCTP_INP_INFO_WLOCK\n"); 1704 } 1705 #endif /* SCTP_DEBUG */ 1706 SCTP_INP_WLOCK(inp); 1707 /* increase our count due to the unlock we do */ 1708 SCTP_INP_INCR_REF(inp); 1709 if (lport) { 1710 enum kauth_network_req req; 1711 /* 1712 * Did the caller specify a port? if so we must see if a 1713 * ep already has this one bound. 1714 */ 1715 if (ntohs(lport) < IPPORT_RESERVED) 1716 req = KAUTH_REQ_NETWORK_BIND_PRIVPORT; 1717 else 1718 req = KAUTH_REQ_NETWORK_BIND_PORT; 1719 1720 error = kauth_authorize_network(l->l_cred, KAUTH_NETWORK_BIND, 1721 req, so, addr, NULL); 1722 if (error) { 1723 SCTP_INP_DECR_REF(inp); 1724 SCTP_INP_WUNLOCK(inp); 1725 SCTP_INP_INFO_WUNLOCK(); 1726 return (EACCES); 1727 } 1728 SCTP_INP_WUNLOCK(inp); 1729 inp_tmp = sctp_pcb_findep(addr, 0, 1); 1730 if (inp_tmp != NULL) { 1731 /* lock guy returned and lower count 1732 * note that we are not bound so inp_tmp 1733 * should NEVER be inp. And it is this 1734 * inp (inp_tmp) that gets the reference 1735 * bump, so we must lower it. 1736 */ 1737 SCTP_INP_WLOCK(inp_tmp); 1738 SCTP_INP_DECR_REF(inp_tmp); 1739 SCTP_INP_WUNLOCK(inp_tmp); 1740 1741 /* unlock info */ 1742 SCTP_INP_INFO_WUNLOCK(); 1743 return EADDRINUSE; 1744 } 1745 SCTP_INP_WLOCK(inp); 1746 if (bindall) { 1747 /* verify that no lport is not used by a singleton */ 1748 if (sctp_isport_inuse(inp, lport)) { 1749 /* Sorry someone already has this one bound */ 1750 SCTP_INP_DECR_REF(inp); 1751 SCTP_INP_WUNLOCK(inp); 1752 SCTP_INP_INFO_WUNLOCK(); 1753 return EADDRINUSE; 1754 } 1755 } 1756 } else { 1757 /* 1758 * get any port but lets make sure no one has any address 1759 * with this port bound 1760 */ 1761 1762 /* 1763 * setup the inp to the top (I could use the union but this 1764 * is just as easy 1765 */ 1766 uint32_t port_guess; 1767 uint16_t port_attempt; 1768 int not_done=1; 1769 1770 while (not_done) { 1771 port_guess = sctp_select_initial_TSN(&inp->sctp_ep); 1772 port_attempt = (port_guess & 0x0000ffff); 1773 if (port_attempt == 0) { 1774 goto next_half; 1775 } 1776 if (port_attempt < IPPORT_RESERVED) { 1777 port_attempt += IPPORT_RESERVED; 1778 } 1779 1780 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1781 /* got a port we can use */ 1782 not_done = 0; 1783 continue; 1784 } 1785 /* try upper half */ 1786 next_half: 1787 port_attempt = ((port_guess >> 16) & 0x0000ffff); 1788 if (port_attempt == 0) { 1789 goto last_try; 1790 } 1791 if (port_attempt < IPPORT_RESERVED) { 1792 port_attempt += IPPORT_RESERVED; 1793 } 1794 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1795 /* got a port we can use */ 1796 not_done = 0; 1797 continue; 1798 } 1799 /* try two half's added together */ 1800 last_try: 1801 port_attempt = (((port_guess >> 16) & 0x0000ffff) + (port_guess & 0x0000ffff)); 1802 if (port_attempt == 0) { 1803 /* get a new random number */ 1804 continue; 1805 } 1806 if (port_attempt < IPPORT_RESERVED) { 1807 port_attempt += IPPORT_RESERVED; 1808 } 1809 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1810 /* got a port we can use */ 1811 not_done = 0; 1812 continue; 1813 } 1814 } 1815 /* we don't get out of the loop until we have a port */ 1816 lport = htons(port_attempt); 1817 } 1818 SCTP_INP_DECR_REF(inp); 1819 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 1820 /* this really should not happen. The guy 1821 * did a non-blocking bind and then did a close 1822 * at the same time. 1823 */ 1824 SCTP_INP_WUNLOCK(inp); 1825 SCTP_INP_INFO_WUNLOCK(); 1826 return (EINVAL); 1827 } 1828 /* ok we look clear to give out this port, so lets setup the binding */ 1829 if (bindall) { 1830 /* binding to all addresses, so just set in the proper flags */ 1831 inp->sctp_flags |= (SCTP_PCB_FLAGS_BOUNDALL | 1832 SCTP_PCB_FLAGS_DO_ASCONF); 1833 /* set the automatic addr changes from kernel flag */ 1834 if (sctp_auto_asconf == 0) { 1835 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF; 1836 } else { 1837 inp->sctp_flags |= SCTP_PCB_FLAGS_AUTO_ASCONF; 1838 } 1839 } else { 1840 /* 1841 * bind specific, make sure flags is off and add a new address 1842 * structure to the sctp_addr_list inside the ep structure. 1843 * 1844 * We will need to allocate one and insert it at the head. 1845 * The socketopt call can just insert new addresses in there 1846 * as well. It will also have to do the embed scope kame hack 1847 * too (before adding). 1848 */ 1849 struct ifaddr *ifa; 1850 struct sockaddr_storage store_sa; 1851 1852 memset(&store_sa, 0, sizeof(store_sa)); 1853 if (addr->sa_family == AF_INET) { 1854 struct sockaddr_in *sin; 1855 1856 sin = (struct sockaddr_in *)&store_sa; 1857 memcpy(sin, addr, sizeof(struct sockaddr_in)); 1858 sin->sin_port = 0; 1859 } else if (addr->sa_family == AF_INET6) { 1860 struct sockaddr_in6 *sin6; 1861 1862 sin6 = (struct sockaddr_in6 *)&store_sa; 1863 memcpy(sin6, addr, sizeof(struct sockaddr_in6)); 1864 sin6->sin6_port = 0; 1865 } 1866 /* 1867 * first find the interface with the bound address 1868 * need to zero out the port to find the address! yuck! 1869 * can't do this earlier since need port for sctp_pcb_findep() 1870 */ 1871 ifa = sctp_find_ifa_by_addr((struct sockaddr *)&store_sa); 1872 if (ifa == NULL) { 1873 /* Can't find an interface with that address */ 1874 SCTP_INP_WUNLOCK(inp); 1875 SCTP_INP_INFO_WUNLOCK(); 1876 return (EADDRNOTAVAIL); 1877 } 1878 if (addr->sa_family == AF_INET6) { 1879 struct in6_ifaddr *ifa6; 1880 ifa6 = (struct in6_ifaddr *)ifa; 1881 /* 1882 * allow binding of deprecated addresses as per 1883 * RFC 2462 and ipng discussion 1884 */ 1885 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 1886 IN6_IFF_ANYCAST | 1887 IN6_IFF_NOTREADY)) { 1888 /* Can't bind a non-existent addr. */ 1889 SCTP_INP_WUNLOCK(inp); 1890 SCTP_INP_INFO_WUNLOCK(); 1891 return (EINVAL); 1892 } 1893 } 1894 /* we're not bound all */ 1895 inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL; 1896 #if 0 /* use sysctl now */ 1897 /* don't allow automatic addr changes from kernel */ 1898 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF; 1899 #endif 1900 /* set the automatic addr changes from kernel flag */ 1901 if (sctp_auto_asconf == 0) { 1902 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF; 1903 } else { 1904 inp->sctp_flags |= SCTP_PCB_FLAGS_AUTO_ASCONF; 1905 } 1906 /* allow bindx() to send ASCONF's for binding changes */ 1907 inp->sctp_flags |= SCTP_PCB_FLAGS_DO_ASCONF; 1908 /* add this address to the endpoint list */ 1909 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa); 1910 if (error != 0) { 1911 SCTP_INP_WUNLOCK(inp); 1912 SCTP_INP_INFO_WUNLOCK(); 1913 return (error); 1914 } 1915 inp->laddr_count++; 1916 } 1917 /* find the bucket */ 1918 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 1919 sctppcbinfo.hashmark)]; 1920 /* put it in the bucket */ 1921 LIST_INSERT_HEAD(head, inp, sctp_hash); 1922 #ifdef SCTP_DEBUG 1923 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1924 printf("Main hash to bind at head:%p, bound port:%d\n", head, ntohs(lport)); 1925 } 1926 #endif 1927 /* set in the port */ 1928 inp->sctp_lport = lport; 1929 1930 /* turn off just the unbound flag */ 1931 inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND; 1932 SCTP_INP_WUNLOCK(inp); 1933 SCTP_INP_INFO_WUNLOCK(); 1934 return (0); 1935 } 1936 1937 1938 static void 1939 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp, struct sctp_inpcb *inp_next) 1940 { 1941 struct sctp_iterator *it; 1942 /* We enter with the only the ITERATOR_LOCK in place and 1943 * A write lock on the inp_info stuff. 1944 */ 1945 1946 /* Go through all iterators, we must do this since 1947 * it is possible that some iterator does NOT have 1948 * the lock, but is waiting for it. And the one that 1949 * had the lock has either moved in the last iteration 1950 * or we just cleared it above. We need to find all 1951 * of those guys. The list of iterators should never 1952 * be very big though. 1953 */ 1954 LIST_FOREACH(it, &sctppcbinfo.iteratorhead, sctp_nxt_itr) { 1955 if (it == inp->inp_starting_point_for_iterator) 1956 /* skip this guy, he's special */ 1957 continue; 1958 if (it->inp == inp) { 1959 /* This is tricky and we DON'T lock the iterator. 1960 * Reason is he's running but waiting for me since 1961 * inp->inp_starting_point_for_iterator has the lock 1962 * on me (the guy above we skipped). This tells us 1963 * its is not running but waiting for inp->inp_starting_point_for_iterator 1964 * to be released by the guy that does have our INP in a lock. 1965 */ 1966 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 1967 it->inp = NULL; 1968 it->stcb = NULL; 1969 } else { 1970 /* set him up to do the next guy not me */ 1971 it->inp = inp_next; 1972 it->stcb = NULL; 1973 } 1974 } 1975 } 1976 it = inp->inp_starting_point_for_iterator; 1977 if (it) { 1978 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 1979 it->inp = NULL; 1980 } else { 1981 it->inp = inp_next; 1982 } 1983 it->stcb = NULL; 1984 } 1985 } 1986 1987 /* release sctp_inpcb unbind the port */ 1988 void 1989 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate) 1990 { 1991 /* 1992 * Here we free a endpoint. We must find it (if it is in the Hash 1993 * table) and remove it from there. Then we must also find it in 1994 * the overall list and remove it from there. After all removals are 1995 * complete then any timer has to be stopped. Then start the actual 1996 * freeing. 1997 * a) Any local lists. 1998 * b) Any associations. 1999 * c) The hash of all associations. 2000 * d) finally the ep itself. 2001 */ 2002 struct sctp_inpcb *inp_save; 2003 struct sctp_tcb *asoc, *nasoc; 2004 struct sctp_laddr *laddr, *nladdr; 2005 struct inpcb *ip_pcb; 2006 struct socket *so; 2007 struct sctp_socket_q_list *sq; 2008 int s, cnt; 2009 struct rtentry *rt; 2010 2011 s = splsoftnet(); 2012 SCTP_ASOC_CREATE_LOCK(inp); 2013 SCTP_INP_WLOCK(inp); 2014 2015 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 2016 /* been here before */ 2017 splx(s); 2018 printf("Endpoint was all gone (dup free)?\n"); 2019 SCTP_INP_WUNLOCK(inp); 2020 SCTP_ASOC_CREATE_UNLOCK(inp); 2021 return; 2022 } 2023 sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL); 2024 2025 if (inp->control) { 2026 sctp_m_freem(inp->control); 2027 inp->control = NULL; 2028 } 2029 if (inp->pkt) { 2030 sctp_m_freem(inp->pkt); 2031 inp->pkt = NULL; 2032 } 2033 so = inp->sctp_socket; 2034 ip_pcb = &inp->ip_inp.inp; /* we could just cast the main 2035 * pointer here but I will 2036 * be nice :> (i.e. ip_pcb = ep;) 2037 */ 2038 2039 if (immediate == 0) { 2040 int cnt_in_sd; 2041 cnt_in_sd = 0; 2042 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL; 2043 asoc = nasoc) { 2044 nasoc = LIST_NEXT(asoc, sctp_tcblist); 2045 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_WAIT) || 2046 (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 2047 /* Just abandon things in the front states */ 2048 SCTP_TCB_LOCK(asoc); 2049 SCTP_INP_WUNLOCK(inp); 2050 sctp_free_assoc(inp, asoc); 2051 SCTP_INP_WLOCK(inp); 2052 continue; 2053 } else { 2054 asoc->asoc.state |= SCTP_STATE_CLOSED_SOCKET; 2055 } 2056 if ((asoc->asoc.size_on_delivery_queue > 0) || 2057 (asoc->asoc.size_on_reasm_queue > 0) || 2058 (asoc->asoc.size_on_all_streams > 0) || 2059 (so && (so->so_rcv.sb_cc > 0)) 2060 ) { 2061 /* Left with Data unread */ 2062 struct mbuf *op_err; 2063 MGET(op_err, M_DONTWAIT, MT_DATA); 2064 if (op_err) { 2065 /* Fill in the user initiated abort */ 2066 struct sctp_paramhdr *ph; 2067 op_err->m_len = 2068 sizeof(struct sctp_paramhdr); 2069 ph = mtod(op_err, 2070 struct sctp_paramhdr *); 2071 ph->param_type = htons( 2072 SCTP_CAUSE_USER_INITIATED_ABT); 2073 ph->param_length = htons(op_err->m_len); 2074 } 2075 SCTP_TCB_LOCK(asoc); 2076 sctp_send_abort_tcb(asoc, op_err); 2077 2078 SCTP_INP_WUNLOCK(inp); 2079 sctp_free_assoc(inp, asoc); 2080 SCTP_INP_WLOCK(inp); 2081 continue; 2082 } else if (TAILQ_EMPTY(&asoc->asoc.send_queue) && 2083 TAILQ_EMPTY(&asoc->asoc.sent_queue)) { 2084 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_SENT) && 2085 (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 2086 /* there is nothing queued to send, so I send shutdown */ 2087 SCTP_TCB_LOCK(asoc); 2088 sctp_send_shutdown(asoc, asoc->asoc.primary_destination); 2089 asoc->asoc.state = SCTP_STATE_SHUTDOWN_SENT; 2090 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, asoc->sctp_ep, asoc, 2091 asoc->asoc.primary_destination); 2092 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc, 2093 asoc->asoc.primary_destination); 2094 sctp_chunk_output(inp, asoc, 1); 2095 SCTP_TCB_UNLOCK(asoc); 2096 } 2097 } else { 2098 /* mark into shutdown pending */ 2099 asoc->asoc.state |= SCTP_STATE_SHUTDOWN_PENDING; 2100 } 2101 cnt_in_sd++; 2102 } 2103 /* now is there some left in our SHUTDOWN state? */ 2104 if (cnt_in_sd) { 2105 inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_GONE; 2106 splx(s); 2107 SCTP_INP_WUNLOCK(inp); 2108 SCTP_ASOC_CREATE_UNLOCK(inp); 2109 return; 2110 } 2111 } 2112 #if defined(__FreeBSD__) && __FreeBSD_version >= 503000 2113 if (inp->refcount) { 2114 sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL); 2115 SCTP_INP_WUNLOCK(inp); 2116 SCTP_ASOC_CREATE_UNLOCK(inp); 2117 return; 2118 } 2119 #endif 2120 inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE; 2121 2122 /* XXX */ 2123 rt = rtcache_validate(&ip_pcb->inp_route); 2124 rtcache_unref(rt, &ip_pcb->inp_route); 2125 2126 callout_stop(&inp->sctp_ep.signature_change.timer); 2127 callout_destroy(&inp->sctp_ep.signature_change.timer); 2128 2129 if (so) { 2130 /* First take care of socket level things */ 2131 #ifdef IPSEC 2132 if (ipsec_enabled) 2133 ipsec_delete_pcbpolicy(ip_pcb); 2134 #endif /*IPSEC*/ 2135 so->so_pcb = 0; 2136 } 2137 2138 if (ip_pcb->inp_options) { 2139 (void)m_free(ip_pcb->inp_options); 2140 ip_pcb->inp_options = 0; 2141 } 2142 rtcache_free(&ip_pcb->inp_route); 2143 if (ip_pcb->inp_moptions) { 2144 ip_freemoptions(ip_pcb->inp_moptions); 2145 ip_pcb->inp_moptions = 0; 2146 } 2147 inp->inp_vflag = 0; 2148 2149 /* Now the sctp_pcb things */ 2150 /* 2151 * free each asoc if it is not already closed/free. we can't use 2152 * the macro here since le_next will get freed as part of the 2153 * sctp_free_assoc() call. 2154 */ 2155 cnt = 0; 2156 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL; 2157 asoc = nasoc) { 2158 nasoc = LIST_NEXT(asoc, sctp_tcblist); 2159 SCTP_TCB_LOCK(asoc); 2160 if (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_COOKIE_WAIT) { 2161 struct mbuf *op_err; 2162 MGET(op_err, M_DONTWAIT, MT_DATA); 2163 if (op_err) { 2164 /* Fill in the user initiated abort */ 2165 struct sctp_paramhdr *ph; 2166 op_err->m_len = sizeof(struct sctp_paramhdr); 2167 ph = mtod(op_err, struct sctp_paramhdr *); 2168 ph->param_type = htons( 2169 SCTP_CAUSE_USER_INITIATED_ABT); 2170 ph->param_length = htons(op_err->m_len); 2171 } 2172 sctp_send_abort_tcb(asoc, op_err); 2173 } 2174 cnt++; 2175 /* 2176 * sctp_free_assoc() will call sctp_inpcb_free(), 2177 * if SCTP_PCB_FLAGS_SOCKET_GONE set. 2178 * So, we clear it before sctp_free_assoc() making sure 2179 * no double sctp_inpcb_free(). 2180 */ 2181 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SOCKET_GONE; 2182 SCTP_INP_WUNLOCK(inp); 2183 sctp_free_assoc(inp, asoc); 2184 SCTP_INP_WLOCK(inp); 2185 } 2186 while ((sq = TAILQ_FIRST(&inp->sctp_queue_list)) != NULL) { 2187 TAILQ_REMOVE(&inp->sctp_queue_list, sq, next_sq); 2188 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_sockq, sq); 2189 sctppcbinfo.ipi_count_sockq--; 2190 sctppcbinfo.ipi_gencnt_sockq++; 2191 } 2192 inp->sctp_socket = 0; 2193 /* Now first we remove ourselves from the overall list of all EP's */ 2194 2195 /* Unlock inp first, need correct order */ 2196 SCTP_INP_WUNLOCK(inp); 2197 /* now iterator lock */ 2198 SCTP_ITERATOR_LOCK(); 2199 /* now info lock */ 2200 SCTP_INP_INFO_WLOCK(); 2201 /* now reget the inp lock */ 2202 SCTP_INP_WLOCK(inp); 2203 2204 inp_save = LIST_NEXT(inp, sctp_list); 2205 LIST_REMOVE(inp, sctp_list); 2206 /* 2207 * Now the question comes as to if this EP was ever bound at all. 2208 * If it was, then we must pull it out of the EP hash list. 2209 */ 2210 if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) != 2211 SCTP_PCB_FLAGS_UNBOUND) { 2212 /* 2213 * ok, this guy has been bound. It's port is somewhere 2214 * in the sctppcbinfo hash table. Remove it! 2215 */ 2216 LIST_REMOVE(inp, sctp_hash); 2217 } 2218 /* fix any iterators only after out of the list */ 2219 sctp_iterator_inp_being_freed(inp, inp_save); 2220 SCTP_ITERATOR_UNLOCK(); 2221 /* 2222 * if we have an address list the following will free the list of 2223 * ifaddr's that are set into this ep. Again macro limitations here, 2224 * since the LIST_FOREACH could be a bad idea. 2225 */ 2226 for ((laddr = LIST_FIRST(&inp->sctp_addr_list)); laddr != NULL; 2227 laddr = nladdr) { 2228 nladdr = LIST_NEXT(laddr, sctp_nxt_addr); 2229 LIST_REMOVE(laddr, sctp_nxt_addr); 2230 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 2231 sctppcbinfo.ipi_gencnt_laddr++; 2232 sctppcbinfo.ipi_count_laddr--; 2233 } 2234 2235 /* Now lets see about freeing the EP hash table. */ 2236 if (inp->sctp_tcbhash != NULL) { 2237 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_hash, inp->sctp_tcbhash); 2238 inp->sctp_tcbhash = NULL; 2239 } 2240 SCTP_INP_WUNLOCK(inp); 2241 SCTP_ASOC_CREATE_UNLOCK(inp); 2242 SCTP_INP_LOCK_DESTROY(inp); 2243 SCTP_ASOC_CREATE_LOCK_DESTROY(inp); 2244 2245 /* Now we must put the ep memory back into the zone pool */ 2246 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 2247 sctppcbinfo.ipi_count_ep--; 2248 2249 SCTP_INP_INFO_WUNLOCK(); 2250 splx(s); 2251 2252 sofree(so); 2253 mutex_enter(softnet_lock); 2254 } 2255 2256 2257 struct sctp_nets * 2258 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr) 2259 { 2260 struct sctp_nets *net; 2261 2262 /* use the peer's/remote port for lookup if unspecified */ 2263 #if 0 /* why do we need to check the port for a nets list on an assoc? */ 2264 if (stcb->rport != sin->sin_port) { 2265 /* we cheat and just a sin for this test */ 2266 return (NULL); 2267 } 2268 #endif 2269 /* locate the address */ 2270 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 2271 if (sctp_cmpaddr(addr, rtcache_getdst(&net->ro))) 2272 return (net); 2273 } 2274 return (NULL); 2275 } 2276 2277 2278 /* 2279 * add's a remote endpoint address, done with the INIT/INIT-ACK 2280 * as well as when a ASCONF arrives that adds it. It will also 2281 * initialize all the cwnd stats of stuff. 2282 */ 2283 int 2284 sctp_is_address_on_local_host(struct sockaddr *addr) 2285 { 2286 struct ifnet *ifn; 2287 struct ifaddr *ifa; 2288 int s; 2289 2290 s = pserialize_read_enter(); 2291 IFNET_READER_FOREACH(ifn) { 2292 IFADDR_READER_FOREACH(ifa, ifn) { 2293 if (addr->sa_family == ifa->ifa_addr->sa_family) { 2294 /* same family */ 2295 if (addr->sa_family == AF_INET) { 2296 struct sockaddr_in *sin, *sin_c; 2297 sin = (struct sockaddr_in *)addr; 2298 sin_c = (struct sockaddr_in *) 2299 ifa->ifa_addr; 2300 if (sin->sin_addr.s_addr == 2301 sin_c->sin_addr.s_addr) { 2302 /* we are on the same machine */ 2303 pserialize_read_exit(s); 2304 return (1); 2305 } 2306 } else if (addr->sa_family == AF_INET6) { 2307 struct sockaddr_in6 *sin6, *sin_c6; 2308 sin6 = (struct sockaddr_in6 *)addr; 2309 sin_c6 = (struct sockaddr_in6 *) 2310 ifa->ifa_addr; 2311 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 2312 &sin_c6->sin6_addr)) { 2313 /* we are on the same machine */ 2314 pserialize_read_exit(s); 2315 return (1); 2316 } 2317 } 2318 } 2319 } 2320 } 2321 pserialize_read_exit(s); 2322 2323 return (0); 2324 } 2325 2326 int 2327 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr, 2328 int set_scope, int from) 2329 { 2330 /* 2331 * The following is redundant to the same lines in the 2332 * sctp_aloc_assoc() but is needed since other's call the add 2333 * address function 2334 */ 2335 struct sctp_nets *net, *netfirst; 2336 struct rtentry *rt, *netfirst_rt; 2337 int addr_inscope; 2338 2339 #ifdef SCTP_DEBUG 2340 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 2341 printf("Adding an address (from:%d) to the peer: ", from); 2342 sctp_print_address(newaddr); 2343 } 2344 #endif 2345 netfirst = sctp_findnet(stcb, newaddr); 2346 if (netfirst) { 2347 /* 2348 * Lie and return ok, we don't want to make the association 2349 * go away for this behavior. It will happen in the TCP model 2350 * in a connected socket. It does not reach the hash table 2351 * until after the association is built so it can't be found. 2352 * Mark as reachable, since the initial creation will have 2353 * been cleared and the NOT_IN_ASSOC flag will have been 2354 * added... and we don't want to end up removing it back out. 2355 */ 2356 if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) { 2357 netfirst->dest_state = (SCTP_ADDR_REACHABLE| 2358 SCTP_ADDR_UNCONFIRMED); 2359 } else { 2360 netfirst->dest_state = SCTP_ADDR_REACHABLE; 2361 } 2362 2363 return (0); 2364 } 2365 addr_inscope = 1; 2366 if (newaddr->sa_family == AF_INET) { 2367 struct sockaddr_in *sin; 2368 sin = (struct sockaddr_in *)newaddr; 2369 if (sin->sin_addr.s_addr == 0) { 2370 /* Invalid address */ 2371 return (-1); 2372 } 2373 /* zero out the bzero area */ 2374 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero)); 2375 2376 /* assure len is set */ 2377 sin->sin_len = sizeof(struct sockaddr_in); 2378 if (set_scope) { 2379 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE 2380 stcb->ipv4_local_scope = 1; 2381 #else 2382 if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) { 2383 stcb->asoc.ipv4_local_scope = 1; 2384 } 2385 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */ 2386 2387 if (sctp_is_address_on_local_host(newaddr)) { 2388 stcb->asoc.loopback_scope = 1; 2389 stcb->asoc.ipv4_local_scope = 1; 2390 stcb->asoc.local_scope = 1; 2391 stcb->asoc.site_scope = 1; 2392 } 2393 } else { 2394 if (from == 8) { 2395 /* From connectx */ 2396 if (sctp_is_address_on_local_host(newaddr)) { 2397 stcb->asoc.loopback_scope = 1; 2398 stcb->asoc.ipv4_local_scope = 1; 2399 stcb->asoc.local_scope = 1; 2400 stcb->asoc.site_scope = 1; 2401 } 2402 } 2403 /* Validate the address is in scope */ 2404 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) && 2405 (stcb->asoc.ipv4_local_scope == 0)) { 2406 addr_inscope = 0; 2407 } 2408 } 2409 } else if (newaddr->sa_family == AF_INET6) { 2410 struct sockaddr_in6 *sin6; 2411 sin6 = (struct sockaddr_in6 *)newaddr; 2412 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 2413 /* Invalid address */ 2414 return (-1); 2415 } 2416 /* assure len is set */ 2417 sin6->sin6_len = sizeof(struct sockaddr_in6); 2418 if (set_scope) { 2419 if (sctp_is_address_on_local_host(newaddr)) { 2420 stcb->asoc.loopback_scope = 1; 2421 stcb->asoc.local_scope = 1; 2422 stcb->asoc.ipv4_local_scope = 1; 2423 stcb->asoc.site_scope = 1; 2424 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 2425 /* 2426 * If the new destination is a LINK_LOCAL 2427 * we must have common site scope. Don't set 2428 * the local scope since we may not share all 2429 * links, only loopback can do this. 2430 * Links on the local network would also 2431 * be on our private network for v4 too. 2432 */ 2433 stcb->asoc.ipv4_local_scope = 1; 2434 stcb->asoc.site_scope = 1; 2435 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) { 2436 /* 2437 * If the new destination is SITE_LOCAL 2438 * then we must have site scope in common. 2439 */ 2440 stcb->asoc.site_scope = 1; 2441 } 2442 } else { 2443 if (from == 8) { 2444 /* From connectx */ 2445 if (sctp_is_address_on_local_host(newaddr)) { 2446 stcb->asoc.loopback_scope = 1; 2447 stcb->asoc.ipv4_local_scope = 1; 2448 stcb->asoc.local_scope = 1; 2449 stcb->asoc.site_scope = 1; 2450 } 2451 } 2452 /* Validate the address is in scope */ 2453 if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) && 2454 (stcb->asoc.loopback_scope == 0)) { 2455 addr_inscope = 0; 2456 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) && 2457 (stcb->asoc.local_scope == 0)) { 2458 addr_inscope = 0; 2459 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) && 2460 (stcb->asoc.site_scope == 0)) { 2461 addr_inscope = 0; 2462 } 2463 } 2464 } else { 2465 /* not supported family type */ 2466 return (-1); 2467 } 2468 net = (struct sctp_nets *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_net); 2469 if (net == NULL) { 2470 return (-1); 2471 } 2472 sctppcbinfo.ipi_count_raddr++; 2473 sctppcbinfo.ipi_gencnt_raddr++; 2474 memset(net, 0, sizeof(*net)); 2475 if (newaddr->sa_family == AF_INET) { 2476 ((struct sockaddr_in *)newaddr)->sin_port = stcb->rport; 2477 } else if (newaddr->sa_family == AF_INET6) { 2478 ((struct sockaddr_in6 *)newaddr)->sin6_port = stcb->rport; 2479 } 2480 net->addr_is_local = sctp_is_address_on_local_host(newaddr); 2481 net->failure_threshold = stcb->asoc.def_net_failure; 2482 if (addr_inscope == 0) { 2483 #ifdef SCTP_DEBUG 2484 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 2485 printf("Adding an address which is OUT OF SCOPE\n"); 2486 } 2487 #endif /* SCTP_DEBUG */ 2488 net->dest_state = (SCTP_ADDR_REACHABLE | 2489 SCTP_ADDR_OUT_OF_SCOPE); 2490 } else { 2491 if (from == 8) 2492 /* 8 is passed by connect_x */ 2493 net->dest_state = SCTP_ADDR_REACHABLE; 2494 else 2495 net->dest_state = SCTP_ADDR_REACHABLE | 2496 SCTP_ADDR_UNCONFIRMED; 2497 } 2498 net->RTO = stcb->asoc.initial_rto; 2499 stcb->asoc.numnets++; 2500 net->ref_count = 1; 2501 2502 /* Init the timer structure */ 2503 callout_init(&net->rxt_timer.timer, 0); 2504 callout_init(&net->pmtu_timer.timer, 0); 2505 2506 /* Now generate a route for this guy */ 2507 /* KAME hack: embed scope zone ID */ 2508 if (newaddr->sa_family == AF_INET6) { 2509 struct sockaddr_in6 *sin6; 2510 sin6 = (struct sockaddr_in6 *)newaddr; 2511 if (sa6_embedscope(sin6, ip6_use_defzone) != 0) 2512 return (-1); 2513 } 2514 rt = rtcache_lookup(&net->ro, newaddr); 2515 if (rt) { 2516 net->mtu = rt->rt_ifp->if_mtu; 2517 if (from == 1) { 2518 stcb->asoc.smallest_mtu = net->mtu; 2519 } 2520 /* start things off to match mtu of interface please. */ 2521 rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu; 2522 } else { 2523 net->mtu = stcb->asoc.smallest_mtu; 2524 } 2525 #ifdef SCTP_DEBUG 2526 printf("After lookup\n"); 2527 #endif 2528 if (stcb->asoc.smallest_mtu > net->mtu) { 2529 stcb->asoc.smallest_mtu = net->mtu; 2530 } 2531 /* We take the max of the burst limit times a MTU or the INITIAL_CWND. 2532 * We then limit this to 4 MTU's of sending. 2533 */ 2534 net->cwnd = uimin((net->mtu * 4), uimax((stcb->asoc.max_burst * net->mtu), SCTP_INITIAL_CWND)); 2535 2536 /* we always get at LEAST 2 MTU's */ 2537 if (net->cwnd < (2 * net->mtu)) { 2538 net->cwnd = 2 * net->mtu; 2539 } 2540 2541 net->ssthresh = stcb->asoc.peers_rwnd; 2542 2543 net->src_addr_selected = 0; 2544 netfirst = TAILQ_FIRST(&stcb->asoc.nets); 2545 if (rt == NULL) { 2546 /* Since we have no route put it at the back */ 2547 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next); 2548 } else if (netfirst == NULL) { 2549 /* We are the first one in the pool. */ 2550 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2551 } else if ((netfirst_rt = rtcache_validate(&netfirst->ro)) == NULL) { 2552 /* 2553 * First one has NO route. Place this one ahead of the 2554 * first one. 2555 */ 2556 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2557 } else if (rt->rt_ifp != netfirst_rt->rt_ifp) { 2558 rtcache_unref(netfirst_rt, &netfirst->ro); 2559 /* 2560 * This one has a different interface than the one at the 2561 * top of the list. Place it ahead. 2562 */ 2563 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2564 } else { 2565 /* 2566 * Ok we have the same interface as the first one. Move 2567 * forward until we find either 2568 * a) one with a NULL route... insert ahead of that 2569 * b) one with a different ifp.. insert after that. 2570 * c) end of the list.. insert at the tail. 2571 */ 2572 struct sctp_nets *netlook; 2573 struct rtentry *netlook_rt; 2574 do { 2575 netlook = TAILQ_NEXT(netfirst, sctp_next); 2576 if (netlook == NULL) { 2577 /* End of the list */ 2578 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, 2579 sctp_next); 2580 break; 2581 } else if ((netlook_rt = rtcache_validate(&netlook->ro)) == NULL) { 2582 /* next one has NO route */ 2583 TAILQ_INSERT_BEFORE(netfirst, net, sctp_next); 2584 break; 2585 } else if (netlook_rt->rt_ifp != rt->rt_ifp) { 2586 rtcache_unref(netlook_rt, &netlook->ro); 2587 TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook, 2588 net, sctp_next); 2589 break; 2590 } 2591 rtcache_unref(netlook_rt, &netlook->ro); 2592 /* Shift forward */ 2593 netfirst = netlook; 2594 } while (netlook != NULL); 2595 rtcache_unref(netfirst_rt, &netfirst->ro); 2596 } 2597 /* got to have a primary set */ 2598 if (stcb->asoc.primary_destination == 0) { 2599 stcb->asoc.primary_destination = net; 2600 } else if (!rtcache_validate(&stcb->asoc.primary_destination->ro)) { 2601 /* No route to current primary adopt new primary */ 2602 stcb->asoc.primary_destination = net; 2603 } 2604 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, 2605 net); 2606 2607 return (0); 2608 } 2609 2610 2611 /* 2612 * allocate an association and add it to the endpoint. The caller must 2613 * be careful to add all additional addresses once they are know right 2614 * away or else the assoc will be may experience a blackout scenario. 2615 */ 2616 struct sctp_tcb * 2617 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr, 2618 int for_a_init, int *error, uint32_t override_tag) 2619 { 2620 struct sctp_tcb *stcb; 2621 struct sctp_association *asoc; 2622 struct sctpasochead *head; 2623 uint16_t rport; 2624 int err; 2625 2626 /* 2627 * Assumption made here: 2628 * Caller has done a sctp_findassociation_ep_addr(ep, addr's); 2629 * to make sure the address does not exist already. 2630 */ 2631 if (sctppcbinfo.ipi_count_asoc >= SCTP_MAX_NUM_OF_ASOC) { 2632 /* Hit max assoc, sorry no more */ 2633 *error = ENOBUFS; 2634 return (NULL); 2635 } 2636 SCTP_INP_RLOCK(inp); 2637 if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) { 2638 /* 2639 * If its in the TCP pool, its NOT allowed to create an 2640 * association. The parent listener needs to call 2641 * sctp_aloc_assoc.. or the one-2-many socket. If a 2642 * peeled off, or connected one does this.. its an error. 2643 */ 2644 SCTP_INP_RUNLOCK(inp); 2645 *error = EINVAL; 2646 return (NULL); 2647 } 2648 2649 #ifdef SCTP_DEBUG 2650 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2651 printf("Allocate an association for peer:"); 2652 if (firstaddr) 2653 sctp_print_address(firstaddr); 2654 else 2655 printf("None\n"); 2656 printf("Port:%d\n", 2657 ntohs(((struct sockaddr_in *)firstaddr)->sin_port)); 2658 } 2659 #endif /* SCTP_DEBUG */ 2660 if (firstaddr->sa_family == AF_INET) { 2661 struct sockaddr_in *sin; 2662 sin = (struct sockaddr_in *)firstaddr; 2663 if ((sin->sin_port == 0) || (sin->sin_addr.s_addr == 0)) { 2664 /* Invalid address */ 2665 #ifdef SCTP_DEBUG 2666 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2667 printf("peer address invalid\n"); 2668 } 2669 #endif 2670 SCTP_INP_RUNLOCK(inp); 2671 *error = EINVAL; 2672 return (NULL); 2673 } 2674 rport = sin->sin_port; 2675 } else if (firstaddr->sa_family == AF_INET6) { 2676 struct sockaddr_in6 *sin6; 2677 sin6 = (struct sockaddr_in6 *)firstaddr; 2678 if ((sin6->sin6_port == 0) || 2679 (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) { 2680 /* Invalid address */ 2681 #ifdef SCTP_DEBUG 2682 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2683 printf("peer address invalid\n"); 2684 } 2685 #endif 2686 SCTP_INP_RUNLOCK(inp); 2687 *error = EINVAL; 2688 return (NULL); 2689 } 2690 rport = sin6->sin6_port; 2691 } else { 2692 /* not supported family type */ 2693 #ifdef SCTP_DEBUG 2694 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2695 printf("BAD family %d\n", firstaddr->sa_family); 2696 } 2697 #endif 2698 SCTP_INP_RUNLOCK(inp); 2699 *error = EINVAL; 2700 return (NULL); 2701 } 2702 SCTP_INP_RUNLOCK(inp); 2703 if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) { 2704 /* 2705 * If you have not performed a bind, then we need to do 2706 * the ephemerial bind for you. 2707 */ 2708 #ifdef SCTP_DEBUG 2709 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2710 printf("Doing implicit BIND\n"); 2711 } 2712 #endif 2713 2714 if ((err = sctp_inpcb_bind(inp->sctp_socket, 2715 (struct sockaddr *)NULL, (struct lwp *)NULL))){ 2716 /* bind error, probably perm */ 2717 #ifdef SCTP_DEBUG 2718 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2719 printf("BIND FAILS ret:%d\n", err); 2720 } 2721 #endif 2722 2723 *error = err; 2724 return (NULL); 2725 } 2726 } 2727 stcb = (struct sctp_tcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asoc); 2728 if (stcb == NULL) { 2729 /* out of memory? */ 2730 #ifdef SCTP_DEBUG 2731 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2732 printf("aloc_assoc: no assoc mem left, stcb=NULL\n"); 2733 } 2734 #endif 2735 *error = ENOMEM; 2736 return (NULL); 2737 } 2738 sctppcbinfo.ipi_count_asoc++; 2739 sctppcbinfo.ipi_gencnt_asoc++; 2740 2741 memset(stcb, 0, sizeof(*stcb)); 2742 asoc = &stcb->asoc; 2743 SCTP_TCB_LOCK_INIT(stcb); 2744 /* setup back pointers */ 2745 #ifdef SCTP_DEBUG 2746 printf("Before back pointers\n"); 2747 #endif 2748 stcb->sctp_ep = inp; 2749 stcb->sctp_socket = inp->sctp_socket; 2750 if ((err = sctp_init_asoc(inp, asoc, for_a_init, override_tag))) { 2751 /* failed */ 2752 SCTP_TCB_LOCK_DESTROY (stcb); 2753 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2754 sctppcbinfo.ipi_count_asoc--; 2755 #ifdef SCTP_DEBUG 2756 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2757 printf("aloc_assoc: couldn't init asoc, out of mem?!\n"); 2758 } 2759 #endif 2760 *error = err; 2761 return (NULL); 2762 } 2763 /* and the port */ 2764 stcb->rport = rport; 2765 SCTP_INP_INFO_WLOCK(); 2766 SCTP_INP_WLOCK(inp); 2767 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 2768 /* inpcb freed while alloc going on */ 2769 SCTP_TCB_LOCK_DESTROY (stcb); 2770 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2771 SCTP_INP_WUNLOCK(inp); 2772 SCTP_INP_INFO_WUNLOCK(); 2773 sctppcbinfo.ipi_count_asoc--; 2774 #ifdef SCTP_DEBUG 2775 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2776 printf("aloc_assoc: couldn't init asoc, out of mem?!\n"); 2777 } 2778 #endif 2779 *error = EINVAL; 2780 return (NULL); 2781 } 2782 SCTP_TCB_LOCK(stcb); 2783 2784 /* now that my_vtag is set, add it to the hash */ 2785 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, 2786 sctppcbinfo.hashasocmark)]; 2787 /* put it in the bucket in the vtag hash of assoc's for the system */ 2788 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 2789 SCTP_INP_INFO_WUNLOCK(); 2790 2791 2792 if ((err = sctp_add_remote_addr(stcb, firstaddr, 1, 1))) { 2793 /* failure.. memory error? */ 2794 if (asoc->strmout) 2795 free(asoc->strmout, M_PCB); 2796 if (asoc->mapping_array) 2797 free(asoc->mapping_array, M_PCB); 2798 2799 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2800 sctppcbinfo.ipi_count_asoc--; 2801 #ifdef SCTP_DEBUG 2802 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2803 printf("aloc_assoc: couldn't add remote addr!\n"); 2804 } 2805 #endif 2806 SCTP_TCB_LOCK_DESTROY (stcb); 2807 *error = ENOBUFS; 2808 return (NULL); 2809 } 2810 /* Init all the timers */ 2811 callout_init(&asoc->hb_timer.timer, 0); 2812 callout_init(&asoc->dack_timer.timer, 0); 2813 callout_init(&asoc->asconf_timer.timer, 0); 2814 callout_init(&asoc->shut_guard_timer.timer, 0); 2815 callout_init(&asoc->autoclose_timer.timer, 0); 2816 callout_init(&asoc->delayed_event_timer.timer, 0); 2817 LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist); 2818 /* now file the port under the hash as well */ 2819 #ifdef SCTP_DEBUG 2820 printf("Before hashing %ld size %d\n", 2821 inp->sctp_hashmark, sctp_pcbtblsize); 2822 #endif 2823 if (inp->sctp_tcbhash != NULL) { 2824 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport, 2825 inp->sctp_hashmark)]; 2826 LIST_INSERT_HEAD(head, stcb, sctp_tcbhash); 2827 } 2828 #ifdef SCTP_DEBUG 2829 printf("After hashing\n"); 2830 #endif 2831 SCTP_INP_WUNLOCK(inp); 2832 #ifdef SCTP_DEBUG 2833 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 2834 printf("Association %p now allocated\n", stcb); 2835 } 2836 #endif 2837 return (stcb); 2838 } 2839 2840 void 2841 sctp_free_remote_addr(struct sctp_nets *net) 2842 { 2843 if (net == NULL) 2844 return; 2845 net->ref_count--; 2846 if (net->ref_count <= 0) { 2847 /* stop timer if running */ 2848 callout_stop(&net->rxt_timer.timer); 2849 callout_stop(&net->pmtu_timer.timer); 2850 callout_destroy(&net->rxt_timer.timer); 2851 callout_destroy(&net->pmtu_timer.timer); 2852 net->dest_state = SCTP_ADDR_NOT_REACHABLE; 2853 rtcache_free(&net->ro); 2854 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_net, net); 2855 sctppcbinfo.ipi_count_raddr--; 2856 } 2857 } 2858 2859 /* 2860 * remove a remote endpoint address from an association, it 2861 * will fail if the address does not exist. 2862 */ 2863 int 2864 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr) 2865 { 2866 /* 2867 * Here we need to remove a remote address. This is quite simple, we 2868 * first find it in the list of address for the association 2869 * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE on 2870 * that item. 2871 * Note we do not allow it to be removed if there are no other 2872 * addresses. 2873 */ 2874 struct sctp_association *asoc; 2875 struct sctp_nets *net, *net_tmp; 2876 asoc = &stcb->asoc; 2877 if (asoc->numnets < 2) { 2878 /* Must have at LEAST two remote addresses */ 2879 return (-1); 2880 } 2881 /* locate the address */ 2882 for (net = TAILQ_FIRST(&asoc->nets); net != NULL; net = net_tmp) { 2883 net_tmp = TAILQ_NEXT(net, sctp_next); 2884 if (rtcache_getdst(&net->ro)->sa_family != remaddr->sa_family) { 2885 continue; 2886 } 2887 if (sctp_cmpaddr(rtcache_getdst(&net->ro), remaddr)) { 2888 /* we found the guy */ 2889 asoc->numnets--; 2890 TAILQ_REMOVE(&asoc->nets, net, sctp_next); 2891 sctp_free_remote_addr(net); 2892 if (net == asoc->primary_destination) { 2893 /* Reset primary */ 2894 struct sctp_nets *lnet; 2895 lnet = TAILQ_FIRST(&asoc->nets); 2896 /* Try to find a confirmed primary */ 2897 asoc->primary_destination = 2898 sctp_find_alternate_net(stcb, lnet); 2899 } 2900 if (net == asoc->last_data_chunk_from) { 2901 /* Reset primary */ 2902 asoc->last_data_chunk_from = 2903 TAILQ_FIRST(&asoc->nets); 2904 } 2905 if (net == asoc->last_control_chunk_from) { 2906 /* Reset primary */ 2907 asoc->last_control_chunk_from = 2908 TAILQ_FIRST(&asoc->nets); 2909 } 2910 if (net == asoc->asconf_last_sent_to) { 2911 /* Reset primary */ 2912 asoc->asconf_last_sent_to = 2913 TAILQ_FIRST(&asoc->nets); 2914 } 2915 return (0); 2916 } 2917 } 2918 /* not found. */ 2919 return (-2); 2920 } 2921 2922 2923 static void 2924 sctp_add_vtag_to_timewait(struct sctp_inpcb *inp, u_int32_t tag) 2925 { 2926 struct sctpvtaghead *chain; 2927 struct sctp_tagblock *twait_block; 2928 struct timeval now; 2929 int set, i; 2930 SCTP_GETTIME_TIMEVAL(&now); 2931 chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)]; 2932 set = 0; 2933 if (!LIST_EMPTY(chain)) { 2934 /* Block(s) present, lets find space, and expire on the fly */ 2935 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) { 2936 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) { 2937 if ((twait_block->vtag_block[i].v_tag == 0) && 2938 !set) { 2939 twait_block->vtag_block[0].tv_sec_at_expire = 2940 now.tv_sec + SCTP_TIME_WAIT; 2941 twait_block->vtag_block[0].v_tag = tag; 2942 set = 1; 2943 } else if ((twait_block->vtag_block[i].v_tag) && 2944 ((long)twait_block->vtag_block[i].tv_sec_at_expire > 2945 now.tv_sec)) { 2946 /* Audit expires this guy */ 2947 twait_block->vtag_block[i].tv_sec_at_expire = 0; 2948 twait_block->vtag_block[i].v_tag = 0; 2949 if (set == 0) { 2950 /* Reuse it for my new tag */ 2951 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + SCTP_TIME_WAIT; 2952 twait_block->vtag_block[0].v_tag = tag; 2953 set = 1; 2954 } 2955 } 2956 } 2957 if (set) { 2958 /* 2959 * We only do up to the block where we can 2960 * place our tag for audits 2961 */ 2962 break; 2963 } 2964 } 2965 } 2966 /* Need to add a new block to chain */ 2967 if (!set) { 2968 twait_block = malloc(sizeof(struct sctp_tagblock), M_PCB, M_NOWAIT); 2969 if (twait_block == NULL) { 2970 return; 2971 } 2972 memset(twait_block, 0, sizeof(struct sctp_timewait)); 2973 LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock); 2974 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + 2975 SCTP_TIME_WAIT; 2976 twait_block->vtag_block[0].v_tag = tag; 2977 } 2978 } 2979 2980 2981 static void 2982 sctp_iterator_asoc_being_freed(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 2983 { 2984 struct sctp_iterator *it; 2985 2986 2987 2988 /* Unlock the tcb lock we do this so 2989 * we avoid a dead lock scenario where 2990 * the iterator is waiting on the TCB lock 2991 * and the TCB lock is waiting on the iterator 2992 * lock. 2993 */ 2994 SCTP_ITERATOR_LOCK(); 2995 SCTP_INP_INFO_WLOCK(); 2996 SCTP_INP_WLOCK(inp); 2997 SCTP_TCB_LOCK(stcb); 2998 2999 it = stcb->asoc.stcb_starting_point_for_iterator; 3000 if (it == NULL) { 3001 return; 3002 } 3003 if (it->inp != stcb->sctp_ep) { 3004 /* hm, focused on the wrong one? */ 3005 return; 3006 } 3007 if (it->stcb != stcb) { 3008 return; 3009 } 3010 it->stcb = LIST_NEXT(stcb, sctp_tcblist); 3011 if (it->stcb == NULL) { 3012 /* done with all asoc's in this assoc */ 3013 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 3014 it->inp = NULL; 3015 } else { 3016 3017 it->inp = LIST_NEXT(inp, sctp_list); 3018 } 3019 } 3020 } 3021 3022 /* 3023 * Free the association after un-hashing the remote port. 3024 */ 3025 void 3026 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 3027 { 3028 struct sctp_association *asoc; 3029 struct sctp_nets *net, *prev; 3030 struct sctp_laddr *laddr; 3031 struct sctp_tmit_chunk *chk; 3032 struct sctp_asconf_addr *aparam; 3033 struct sctp_socket_q_list *sq; 3034 int s; 3035 3036 /* first, lets purge the entry from the hash table. */ 3037 s = splsoftnet(); 3038 if (stcb->asoc.state == 0) { 3039 printf("Freeing already free association:%p - huh??\n", 3040 stcb); 3041 splx(s); 3042 return; 3043 } 3044 asoc = &stcb->asoc; 3045 asoc->state = 0; 3046 /* now clean up any other timers */ 3047 callout_stop(&asoc->hb_timer.timer); 3048 callout_destroy(&asoc->hb_timer.timer); 3049 callout_stop(&asoc->dack_timer.timer); 3050 callout_destroy(&asoc->dack_timer.timer); 3051 callout_stop(&asoc->asconf_timer.timer); 3052 callout_destroy(&asoc->asconf_timer.timer); 3053 callout_stop(&asoc->shut_guard_timer.timer); 3054 callout_destroy(&asoc->shut_guard_timer.timer); 3055 callout_stop(&asoc->autoclose_timer.timer); 3056 callout_destroy(&asoc->autoclose_timer.timer); 3057 callout_stop(&asoc->delayed_event_timer.timer); 3058 callout_destroy(&asoc->delayed_event_timer.timer); 3059 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3060 callout_stop(&net->rxt_timer.timer); 3061 callout_stop(&net->pmtu_timer.timer); 3062 callout_destroy(&net->rxt_timer.timer); 3063 callout_destroy(&net->pmtu_timer.timer); 3064 } 3065 3066 /* Iterator asoc being freed we send an 3067 * unlocked TCB. It returns with INP_INFO 3068 * and INP write locked and the TCB locked 3069 * too and of course the iterator lock 3070 * in place as well.. 3071 */ 3072 SCTP_TCB_UNLOCK(stcb); 3073 sctp_iterator_asoc_being_freed(inp, stcb); 3074 3075 /* Null all of my entry's on the socket q */ 3076 TAILQ_FOREACH(sq, &inp->sctp_queue_list, next_sq) { 3077 if (sq->tcb == stcb) { 3078 sq->tcb = NULL; 3079 } 3080 } 3081 3082 if (inp->sctp_tcb_at_block == (void *)stcb) { 3083 inp->error_on_block = ECONNRESET; 3084 } 3085 3086 if (inp->sctp_tcbhash) { 3087 LIST_REMOVE(stcb, sctp_tcbhash); 3088 } 3089 /* Now lets remove it from the list of ALL associations in the EP */ 3090 LIST_REMOVE(stcb, sctp_tcblist); 3091 SCTP_INP_WUNLOCK(inp); 3092 SCTP_ITERATOR_UNLOCK(); 3093 3094 3095 /* pull from vtag hash */ 3096 LIST_REMOVE(stcb, sctp_asocs); 3097 3098 /* 3099 * Now before we can free the assoc, we must remove all of the 3100 * networks and any other allocated space.. i.e. add removes here 3101 * before the SCTP_ZONE_FREE() of the tasoc entry. 3102 */ 3103 3104 sctp_add_vtag_to_timewait(inp, asoc->my_vtag); 3105 SCTP_INP_INFO_WUNLOCK(); 3106 prev = NULL; 3107 while (!TAILQ_EMPTY(&asoc->nets)) { 3108 net = TAILQ_FIRST(&asoc->nets); 3109 /* pull from list */ 3110 if ((sctppcbinfo.ipi_count_raddr == 0) || (prev == net)) { 3111 break; 3112 } 3113 prev = net; 3114 TAILQ_REMOVE(&asoc->nets, net, sctp_next); 3115 rtcache_free(&net->ro); 3116 /* free it */ 3117 net->ref_count = 0; 3118 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_net, net); 3119 sctppcbinfo.ipi_count_raddr--; 3120 } 3121 /* 3122 * The chunk lists and such SHOULD be empty but we check them 3123 * just in case. 3124 */ 3125 /* anything on the wheel needs to be removed */ 3126 while (!TAILQ_EMPTY(&asoc->out_wheel)) { 3127 struct sctp_stream_out *outs; 3128 outs = TAILQ_FIRST(&asoc->out_wheel); 3129 TAILQ_REMOVE(&asoc->out_wheel, outs, next_spoke); 3130 /* now clean up any chunks here */ 3131 chk = TAILQ_FIRST(&outs->outqueue); 3132 while (chk) { 3133 TAILQ_REMOVE(&outs->outqueue, chk, sctp_next); 3134 if (chk->data) { 3135 sctp_m_freem(chk->data); 3136 chk->data = NULL; 3137 } 3138 chk->whoTo = NULL; 3139 chk->asoc = NULL; 3140 /* Free the chunk */ 3141 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3142 sctppcbinfo.ipi_count_chunk--; 3143 sctppcbinfo.ipi_gencnt_chunk++; 3144 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3145 panic("Chunk count is negative"); 3146 } 3147 chk = TAILQ_FIRST(&outs->outqueue); 3148 } 3149 outs = TAILQ_FIRST(&asoc->out_wheel); 3150 } 3151 3152 if (asoc->pending_reply) { 3153 free(asoc->pending_reply, M_PCB); 3154 asoc->pending_reply = NULL; 3155 } 3156 chk = TAILQ_FIRST(&asoc->pending_reply_queue); 3157 while (chk) { 3158 TAILQ_REMOVE(&asoc->pending_reply_queue, chk, sctp_next); 3159 if (chk->data) { 3160 sctp_m_freem(chk->data); 3161 chk->data = NULL; 3162 } 3163 chk->whoTo = NULL; 3164 chk->asoc = NULL; 3165 /* Free the chunk */ 3166 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3167 sctppcbinfo.ipi_count_chunk--; 3168 sctppcbinfo.ipi_gencnt_chunk++; 3169 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3170 panic("Chunk count is negative"); 3171 } 3172 chk = TAILQ_FIRST(&asoc->pending_reply_queue); 3173 } 3174 /* pending send queue SHOULD be empty */ 3175 if (!TAILQ_EMPTY(&asoc->send_queue)) { 3176 chk = TAILQ_FIRST(&asoc->send_queue); 3177 while (chk) { 3178 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next); 3179 if (chk->data) { 3180 sctp_m_freem(chk->data); 3181 chk->data = NULL; 3182 } 3183 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3184 sctppcbinfo.ipi_count_chunk--; 3185 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3186 panic("Chunk count is negative"); 3187 } 3188 sctppcbinfo.ipi_gencnt_chunk++; 3189 chk = TAILQ_FIRST(&asoc->send_queue); 3190 } 3191 } 3192 /* sent queue SHOULD be empty */ 3193 if (!TAILQ_EMPTY(&asoc->sent_queue)) { 3194 chk = TAILQ_FIRST(&asoc->sent_queue); 3195 while (chk) { 3196 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next); 3197 if (chk->data) { 3198 sctp_m_freem(chk->data); 3199 chk->data = NULL; 3200 } 3201 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3202 sctppcbinfo.ipi_count_chunk--; 3203 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3204 panic("Chunk count is negative"); 3205 } 3206 sctppcbinfo.ipi_gencnt_chunk++; 3207 chk = TAILQ_FIRST(&asoc->sent_queue); 3208 } 3209 } 3210 /* control queue MAY not be empty */ 3211 if (!TAILQ_EMPTY(&asoc->control_send_queue)) { 3212 chk = TAILQ_FIRST(&asoc->control_send_queue); 3213 while (chk) { 3214 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 3215 if (chk->data) { 3216 sctp_m_freem(chk->data); 3217 chk->data = NULL; 3218 } 3219 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3220 sctppcbinfo.ipi_count_chunk--; 3221 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3222 panic("Chunk count is negative"); 3223 } 3224 sctppcbinfo.ipi_gencnt_chunk++; 3225 chk = TAILQ_FIRST(&asoc->control_send_queue); 3226 } 3227 } 3228 if (!TAILQ_EMPTY(&asoc->reasmqueue)) { 3229 chk = TAILQ_FIRST(&asoc->reasmqueue); 3230 while (chk) { 3231 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next); 3232 if (chk->data) { 3233 sctp_m_freem(chk->data); 3234 chk->data = NULL; 3235 } 3236 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3237 sctppcbinfo.ipi_count_chunk--; 3238 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3239 panic("Chunk count is negative"); 3240 } 3241 sctppcbinfo.ipi_gencnt_chunk++; 3242 chk = TAILQ_FIRST(&asoc->reasmqueue); 3243 } 3244 } 3245 if (!TAILQ_EMPTY(&asoc->delivery_queue)) { 3246 chk = TAILQ_FIRST(&asoc->delivery_queue); 3247 while (chk) { 3248 TAILQ_REMOVE(&asoc->delivery_queue, chk, sctp_next); 3249 if (chk->data) { 3250 sctp_m_freem(chk->data); 3251 chk->data = NULL; 3252 } 3253 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3254 sctppcbinfo.ipi_count_chunk--; 3255 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3256 panic("Chunk count is negative"); 3257 } 3258 sctppcbinfo.ipi_gencnt_chunk++; 3259 chk = TAILQ_FIRST(&asoc->delivery_queue); 3260 } 3261 } 3262 if (asoc->mapping_array) { 3263 free(asoc->mapping_array, M_PCB); 3264 asoc->mapping_array = NULL; 3265 } 3266 3267 /* the stream outs */ 3268 if (asoc->strmout) { 3269 free(asoc->strmout, M_PCB); 3270 asoc->strmout = NULL; 3271 } 3272 asoc->streamoutcnt = 0; 3273 if (asoc->strmin) { 3274 int i; 3275 for (i = 0; i < asoc->streamincnt; i++) { 3276 if (!TAILQ_EMPTY(&asoc->strmin[i].inqueue)) { 3277 /* We have somethings on the streamin queue */ 3278 chk = TAILQ_FIRST(&asoc->strmin[i].inqueue); 3279 while (chk) { 3280 TAILQ_REMOVE(&asoc->strmin[i].inqueue, 3281 chk, sctp_next); 3282 if (chk->data) { 3283 sctp_m_freem(chk->data); 3284 chk->data = NULL; 3285 } 3286 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, 3287 chk); 3288 sctppcbinfo.ipi_count_chunk--; 3289 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3290 panic("Chunk count is negative"); 3291 } 3292 sctppcbinfo.ipi_gencnt_chunk++; 3293 chk = TAILQ_FIRST(&asoc->strmin[i].inqueue); 3294 } 3295 } 3296 } 3297 free(asoc->strmin, M_PCB); 3298 asoc->strmin = NULL; 3299 } 3300 asoc->streamincnt = 0; 3301 /* local addresses, if any */ 3302 while (!LIST_EMPTY(&asoc->sctp_local_addr_list)) { 3303 laddr = LIST_FIRST(&asoc->sctp_local_addr_list); 3304 LIST_REMOVE(laddr, sctp_nxt_addr); 3305 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 3306 sctppcbinfo.ipi_count_laddr--; 3307 } 3308 /* pending asconf (address) parameters */ 3309 while (!TAILQ_EMPTY(&asoc->asconf_queue)) { 3310 aparam = TAILQ_FIRST(&asoc->asconf_queue); 3311 TAILQ_REMOVE(&asoc->asconf_queue, aparam, next); 3312 free(aparam, M_PCB); 3313 } 3314 if (asoc->last_asconf_ack_sent != NULL) { 3315 sctp_m_freem(asoc->last_asconf_ack_sent); 3316 asoc->last_asconf_ack_sent = NULL; 3317 } 3318 /* Insert new items here :> */ 3319 3320 /* Get rid of LOCK */ 3321 SCTP_TCB_LOCK_DESTROY(stcb); 3322 3323 /* now clean up the tasoc itself */ 3324 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 3325 sctppcbinfo.ipi_count_asoc--; 3326 if ((inp->sctp_socket->so_snd.sb_cc) || 3327 (inp->sctp_socket->so_snd.sb_mbcnt)) { 3328 /* This will happen when a abort is done */ 3329 inp->sctp_socket->so_snd.sb_cc = 0; 3330 inp->sctp_socket->so_snd.sb_mbcnt = 0; 3331 } 3332 if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 3333 if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) { 3334 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 3335 /* 3336 * For the base fd, that is NOT in TCP pool we 3337 * turn off the connected flag. This allows 3338 * non-listening endpoints to connect/shutdown/ 3339 * connect. 3340 */ 3341 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED; 3342 soisdisconnected(inp->sctp_socket); 3343 } 3344 /* 3345 * For those that are in the TCP pool we just leave 3346 * so it cannot be used. When they close the fd we 3347 * will free it all. 3348 */ 3349 } 3350 } 3351 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3352 sctp_inpcb_free(inp, 0); 3353 } 3354 splx(s); 3355 } 3356 3357 3358 /* 3359 * determine if a destination is "reachable" based upon the addresses 3360 * bound to the current endpoint (e.g. only v4 or v6 currently bound) 3361 */ 3362 /* 3363 * FIX: if we allow assoc-level bindx(), then this needs to be fixed 3364 * to use assoc level v4/v6 flags, as the assoc *may* not have the 3365 * same address types bound as its endpoint 3366 */ 3367 int 3368 sctp_destination_is_reachable(struct sctp_tcb *stcb, const struct sockaddr *destaddr) 3369 { 3370 struct sctp_inpcb *inp; 3371 int answer; 3372 3373 /* No locks here, the TCB, in all cases is already 3374 * locked and an assoc is up. There is either a 3375 * INP lock by the caller applied (in asconf case when 3376 * deleting an address) or NOT in the HB case, however 3377 * if HB then the INP increment is up and the INP 3378 * will not be removed (on top of the fact that 3379 * we have a TCB lock). So we only want to 3380 * read the sctp_flags, which is either bound-all 3381 * or not.. no protection needed since once an 3382 * assoc is up you can't be changing your binding. 3383 */ 3384 inp = stcb->sctp_ep; 3385 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3386 /* if bound all, destination is not restricted */ 3387 /* RRS: Question during lock work: Is this 3388 * correct? If you are bound-all you still 3389 * might need to obey the V4--V6 flags??? 3390 * IMO this bound-all stuff needs to be removed! 3391 */ 3392 return (1); 3393 } 3394 /* NOTE: all "scope" checks are done when local addresses are added */ 3395 if (destaddr->sa_family == AF_INET6) { 3396 answer = inp->inp_vflag & INP_IPV6; 3397 } else if (destaddr->sa_family == AF_INET) { 3398 answer = inp->inp_vflag & INP_IPV4; 3399 } else { 3400 /* invalid family, so it's unreachable */ 3401 answer = 0; 3402 } 3403 return (answer); 3404 } 3405 3406 /* 3407 * update the inp_vflags on an endpoint 3408 */ 3409 static void 3410 sctp_update_ep_vflag(struct sctp_inpcb *inp) { 3411 struct sctp_laddr *laddr; 3412 3413 /* first clear the flag */ 3414 inp->inp_vflag = 0; 3415 3416 /* set the flag based on addresses on the ep list */ 3417 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3418 if (laddr->ifa == NULL) { 3419 #ifdef SCTP_DEBUG 3420 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 3421 printf("An ounce of prevention is worth a pound of cure\n"); 3422 } 3423 #endif /* SCTP_DEBUG */ 3424 continue; 3425 } 3426 if (laddr->ifa->ifa_addr) { 3427 continue; 3428 } 3429 if (laddr->ifa->ifa_addr->sa_family == AF_INET6) { 3430 inp->inp_vflag |= INP_IPV6; 3431 } else if (laddr->ifa->ifa_addr->sa_family == AF_INET) { 3432 inp->inp_vflag |= INP_IPV4; 3433 } 3434 } 3435 } 3436 3437 /* 3438 * Add the address to the endpoint local address list 3439 * There is nothing to be done if we are bound to all addresses 3440 */ 3441 int 3442 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa) 3443 { 3444 struct sctp_laddr *laddr; 3445 int fnd, error; 3446 fnd = 0; 3447 3448 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3449 /* You are already bound to all. You have it already */ 3450 return (0); 3451 } 3452 if (ifa->ifa_addr->sa_family == AF_INET6) { 3453 struct in6_ifaddr *ifa6; 3454 ifa6 = (struct in6_ifaddr *)ifa; 3455 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 3456 IN6_IFF_DEPRECATED | IN6_IFF_ANYCAST | IN6_IFF_NOTREADY)) 3457 /* Can't bind a non-existent addr. */ 3458 return (-1); 3459 } 3460 /* first, is it already present? */ 3461 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3462 if (laddr->ifa == ifa) { 3463 fnd = 1; 3464 break; 3465 } 3466 } 3467 3468 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd == 0)) { 3469 /* Not bound to all */ 3470 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa); 3471 if (error != 0) 3472 return (error); 3473 inp->laddr_count++; 3474 /* update inp_vflag flags */ 3475 if (ifa->ifa_addr->sa_family == AF_INET6) { 3476 inp->inp_vflag |= INP_IPV6; 3477 } else if (ifa->ifa_addr->sa_family == AF_INET) { 3478 inp->inp_vflag |= INP_IPV4; 3479 } 3480 } 3481 return (0); 3482 } 3483 3484 3485 /* 3486 * select a new (hopefully reachable) destination net 3487 * (should only be used when we deleted an ep addr that is the 3488 * only usable source address to reach the destination net) 3489 */ 3490 static void 3491 sctp_select_primary_destination(struct sctp_tcb *stcb) 3492 { 3493 struct sctp_nets *net; 3494 3495 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 3496 /* for now, we'll just pick the first reachable one we find */ 3497 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) 3498 continue; 3499 if (sctp_destination_is_reachable(stcb, 3500 rtcache_getdst(&net->ro))) { 3501 /* found a reachable destination */ 3502 stcb->asoc.primary_destination = net; 3503 } 3504 } 3505 /* I can't there from here! ...we're gonna die shortly... */ 3506 } 3507 3508 3509 /* 3510 * Delete the address from the endpoint local address list 3511 * There is nothing to be done if we are bound to all addresses 3512 */ 3513 int 3514 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa) 3515 { 3516 struct sctp_laddr *laddr; 3517 int fnd; 3518 fnd = 0; 3519 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3520 /* You are already bound to all. You have it already */ 3521 return (EINVAL); 3522 } 3523 3524 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3525 if (laddr->ifa == ifa) { 3526 fnd = 1; 3527 break; 3528 } 3529 } 3530 if (fnd && (inp->laddr_count < 2)) { 3531 /* can't delete unless there are at LEAST 2 addresses */ 3532 return (-1); 3533 } 3534 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd)) { 3535 /* 3536 * clean up any use of this address 3537 * go through our associations and clear any 3538 * last_used_address that match this one 3539 * for each assoc, see if a new primary_destination is needed 3540 */ 3541 struct sctp_tcb *stcb; 3542 3543 /* clean up "next_addr_touse" */ 3544 if (inp->next_addr_touse == laddr) 3545 /* delete this address */ 3546 inp->next_addr_touse = NULL; 3547 3548 /* clean up "last_used_address" */ 3549 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 3550 if (stcb->asoc.last_used_address == laddr) 3551 /* delete this address */ 3552 stcb->asoc.last_used_address = NULL; 3553 } /* for each tcb */ 3554 3555 /* remove it from the ep list */ 3556 sctp_remove_laddr(laddr); 3557 inp->laddr_count--; 3558 /* update inp_vflag flags */ 3559 sctp_update_ep_vflag(inp); 3560 /* select a new primary destination if needed */ 3561 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 3562 /* presume caller (sctp_asconf.c) already owns INP lock */ 3563 SCTP_TCB_LOCK(stcb); 3564 if (sctp_destination_is_reachable(stcb, 3565 rtcache_getdst(&stcb->asoc.primary_destination->ro)) == 0) { 3566 sctp_select_primary_destination(stcb); 3567 } 3568 SCTP_TCB_UNLOCK(stcb); 3569 } /* for each tcb */ 3570 } 3571 return (0); 3572 } 3573 3574 /* 3575 * Add the addr to the TCB local address list 3576 * For the BOUNDALL or dynamic case, this is a "pending" address list 3577 * (eg. addresses waiting for an ASCONF-ACK response) 3578 * For the subset binding, static case, this is a "valid" address list 3579 */ 3580 int 3581 sctp_add_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa) 3582 { 3583 struct sctp_laddr *laddr; 3584 int error; 3585 3586 /* Assumes TCP is locked.. and possiblye 3587 * the INP. May need to confirm/fix that if 3588 * we need it and is not the case. 3589 */ 3590 if (ifa->ifa_addr->sa_family == AF_INET6) { 3591 struct in6_ifaddr *ifa6; 3592 ifa6 = (struct in6_ifaddr *)ifa; 3593 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 3594 /* IN6_IFF_DEPRECATED | */ 3595 IN6_IFF_ANYCAST | 3596 IN6_IFF_NOTREADY)) 3597 /* Can't bind a non-existent addr. */ 3598 return (-1); 3599 } 3600 /* does the address already exist? */ 3601 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 3602 if (laddr->ifa == ifa) { 3603 return (-1); 3604 } 3605 } 3606 3607 /* add to the list */ 3608 error = sctp_insert_laddr(&stcb->asoc.sctp_local_addr_list, ifa); 3609 if (error != 0) 3610 return (error); 3611 return (0); 3612 } 3613 3614 /* 3615 * insert an laddr entry with the given ifa for the desired list 3616 */ 3617 int 3618 sctp_insert_laddr(struct sctpladdr *list, struct ifaddr *ifa) { 3619 struct sctp_laddr *laddr; 3620 int s; 3621 3622 s = splsoftnet(); 3623 3624 laddr = (struct sctp_laddr *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr); 3625 if (laddr == NULL) { 3626 /* out of memory? */ 3627 splx(s); 3628 return (EINVAL); 3629 } 3630 sctppcbinfo.ipi_count_laddr++; 3631 sctppcbinfo.ipi_gencnt_laddr++; 3632 memset(laddr, 0, sizeof(*laddr)); 3633 laddr->ifa = ifa; 3634 /* insert it */ 3635 LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr); 3636 3637 splx(s); 3638 return (0); 3639 } 3640 3641 /* 3642 * Remove an laddr entry from the local address list (on an assoc) 3643 */ 3644 void 3645 sctp_remove_laddr(struct sctp_laddr *laddr) 3646 { 3647 int s; 3648 s = splsoftnet(); 3649 /* remove from the list */ 3650 LIST_REMOVE(laddr, sctp_nxt_addr); 3651 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 3652 sctppcbinfo.ipi_count_laddr--; 3653 sctppcbinfo.ipi_gencnt_laddr++; 3654 3655 splx(s); 3656 } 3657 3658 /* 3659 * Remove an address from the TCB local address list 3660 */ 3661 int 3662 sctp_del_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa) 3663 { 3664 struct sctp_inpcb *inp; 3665 struct sctp_laddr *laddr; 3666 3667 /* This is called by asconf work. It is assumed that 3668 * a) The TCB is locked 3669 * and 3670 * b) The INP is locked. 3671 * This is true in as much as I can trace through 3672 * the entry asconf code where I did these locks. 3673 * Again, the ASCONF code is a bit different in 3674 * that it does lock the INP during its work often 3675 * times. This must be since we don't want other 3676 * proc's looking up things while what they are 3677 * looking up is changing :-D 3678 */ 3679 3680 inp = stcb->sctp_ep; 3681 /* if subset bound and don't allow ASCONF's, can't delete last */ 3682 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && 3683 ((inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) == 0)) { 3684 if (stcb->asoc.numnets < 2) { 3685 /* can't delete last address */ 3686 return (-1); 3687 } 3688 } 3689 3690 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 3691 /* remove the address if it exists */ 3692 if (laddr->ifa == NULL) 3693 continue; 3694 if (laddr->ifa == ifa) { 3695 sctp_remove_laddr(laddr); 3696 return (0); 3697 } 3698 } 3699 3700 /* address not found! */ 3701 return (-1); 3702 } 3703 3704 /* 3705 * Remove an address from the TCB local address list 3706 * lookup using a sockaddr addr 3707 */ 3708 int 3709 sctp_del_local_addr_assoc_sa(struct sctp_tcb *stcb, struct sockaddr *sa) 3710 { 3711 struct sctp_inpcb *inp; 3712 struct sctp_laddr *laddr; 3713 struct sockaddr *l_sa; 3714 3715 /* 3716 * This function I find does not seem to have a caller. 3717 * As such we NEED TO DELETE this code. If we do 3718 * find a caller, the caller MUST have locked the TCB 3719 * at the least and probably the INP as well. 3720 */ 3721 inp = stcb->sctp_ep; 3722 /* if subset bound and don't allow ASCONF's, can't delete last */ 3723 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && 3724 ((inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) == 0)) { 3725 if (stcb->asoc.numnets < 2) { 3726 /* can't delete last address */ 3727 return (-1); 3728 } 3729 } 3730 3731 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 3732 /* make sure the address exists */ 3733 if (laddr->ifa == NULL) 3734 continue; 3735 if (laddr->ifa->ifa_addr == NULL) 3736 continue; 3737 3738 l_sa = laddr->ifa->ifa_addr; 3739 if (l_sa->sa_family == AF_INET6) { 3740 /* IPv6 address */ 3741 struct sockaddr_in6 *sin1, *sin2; 3742 sin1 = (struct sockaddr_in6 *)l_sa; 3743 sin2 = (struct sockaddr_in6 *)sa; 3744 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr, 3745 sizeof(struct in6_addr)) == 0) { 3746 /* matched */ 3747 sctp_remove_laddr(laddr); 3748 return (0); 3749 } 3750 } else if (l_sa->sa_family == AF_INET) { 3751 /* IPv4 address */ 3752 struct sockaddr_in *sin1, *sin2; 3753 sin1 = (struct sockaddr_in *)l_sa; 3754 sin2 = (struct sockaddr_in *)sa; 3755 if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) { 3756 /* matched */ 3757 sctp_remove_laddr(laddr); 3758 return (0); 3759 } 3760 } else { 3761 /* invalid family */ 3762 return (-1); 3763 } 3764 } /* end foreach */ 3765 /* address not found! */ 3766 return (-1); 3767 } 3768 3769 static char sctp_pcb_initialized = 0; 3770 3771 #if defined(__FreeBSD__) || defined(__APPLE__) 3772 /* sysctl */ 3773 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC; 3774 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR; 3775 3776 #endif /* FreeBSD || APPLE */ 3777 3778 #ifndef SCTP_TCBHASHSIZE 3779 #define SCTP_TCBHASHSIZE 1024 3780 #endif 3781 3782 #ifndef SCTP_CHUNKQUEUE_SCALE 3783 #define SCTP_CHUNKQUEUE_SCALE 10 3784 #endif 3785 3786 void 3787 sctp_pcb_init(void) 3788 { 3789 /* 3790 * SCTP initialization for the PCB structures 3791 * should be called by the sctp_init() funciton. 3792 */ 3793 int i; 3794 int hashtblsize = SCTP_TCBHASHSIZE; 3795 3796 #if defined(__FreeBSD__) || defined(__APPLE__) 3797 int sctp_chunkscale = SCTP_CHUNKQUEUE_SCALE; 3798 #endif 3799 3800 if (sctp_pcb_initialized != 0) { 3801 /* error I was called twice */ 3802 return; 3803 } 3804 sctp_pcb_initialized = 1; 3805 3806 /* Init all peg counts */ 3807 for (i = 0; i < SCTP_NUMBER_OF_PEGS; i++) { 3808 sctp_pegs[i] = 0; 3809 } 3810 3811 /* init the empty list of (All) Endpoints */ 3812 LIST_INIT(&sctppcbinfo.listhead); 3813 3814 /* init the iterator head */ 3815 LIST_INIT(&sctppcbinfo.iteratorhead); 3816 3817 /* init the hash table of endpoints */ 3818 #if defined(__FreeBSD__) 3819 #if defined(__FreeBSD_cc_version) && __FreeBSD_cc_version >= 440000 3820 TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &hashtblsize); 3821 TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &sctp_pcbtblsize); 3822 TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &sctp_chunkscale); 3823 #else 3824 TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", SCTP_TCBHASHSIZE, 3825 hashtblsize); 3826 TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", SCTP_PCBHASHSIZE, 3827 sctp_pcbtblsize); 3828 TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", SCTP_CHUNKQUEUE_SCALE, 3829 sctp_chunkscale); 3830 #endif 3831 #endif 3832 3833 sctppcbinfo.sctp_asochash = hashinit((hashtblsize * 31), HASH_LIST, 3834 M_WAITOK, &sctppcbinfo.hashasocmark); 3835 3836 sctppcbinfo.sctp_ephash = hashinit(hashtblsize, HASH_LIST, 3837 M_WAITOK, &sctppcbinfo.hashmark); 3838 3839 sctppcbinfo.sctp_tcpephash = hashinit(hashtblsize, HASH_LIST, 3840 M_WAITOK, &sctppcbinfo.hashtcpmark); 3841 3842 sctppcbinfo.hashtblsize = hashtblsize; 3843 3844 /* init the zones */ 3845 /* 3846 * FIX ME: Should check for NULL returns, but if it does fail we 3847 * are doomed to panic anyways... add later maybe. 3848 */ 3849 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_ep, "sctp_ep", 3850 sizeof(struct sctp_inpcb), maxsockets); 3851 3852 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_asoc, "sctp_asoc", 3853 sizeof(struct sctp_tcb), sctp_max_number_of_assoc); 3854 3855 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_laddr, "sctp_laddr", 3856 sizeof(struct sctp_laddr), 3857 (sctp_max_number_of_assoc * sctp_scale_up_for_address)); 3858 3859 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_net, "sctp_raddr", 3860 sizeof(struct sctp_nets), 3861 (sctp_max_number_of_assoc * sctp_scale_up_for_address)); 3862 3863 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_chunk, "sctp_chunk", 3864 sizeof(struct sctp_tmit_chunk), 3865 (sctp_max_number_of_assoc * sctp_scale_up_for_address * 3866 sctp_chunkscale)); 3867 3868 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_sockq, "sctp_sockq", 3869 sizeof(struct sctp_socket_q_list), 3870 (sctp_max_number_of_assoc * sctp_scale_up_for_address * 3871 sctp_chunkscale)); 3872 3873 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_hash, "sctp_hash", 3874 sizeof(void *) * sctp_pcbtblsize, maxsockets); 3875 3876 /* Master Lock INIT for info structure */ 3877 SCTP_INP_INFO_LOCK_INIT(); 3878 SCTP_ITERATOR_LOCK_INIT(); 3879 /* not sure if we need all the counts */ 3880 sctppcbinfo.ipi_count_ep = 0; 3881 sctppcbinfo.ipi_gencnt_ep = 0; 3882 /* assoc/tcb zone info */ 3883 sctppcbinfo.ipi_count_asoc = 0; 3884 sctppcbinfo.ipi_gencnt_asoc = 0; 3885 /* local addrlist zone info */ 3886 sctppcbinfo.ipi_count_laddr = 0; 3887 sctppcbinfo.ipi_gencnt_laddr = 0; 3888 /* remote addrlist zone info */ 3889 sctppcbinfo.ipi_count_raddr = 0; 3890 sctppcbinfo.ipi_gencnt_raddr = 0; 3891 /* chunk info */ 3892 sctppcbinfo.ipi_count_chunk = 0; 3893 sctppcbinfo.ipi_gencnt_chunk = 0; 3894 3895 /* socket queue zone info */ 3896 sctppcbinfo.ipi_count_sockq = 0; 3897 sctppcbinfo.ipi_gencnt_sockq = 0; 3898 3899 /* mbuf tracker */ 3900 sctppcbinfo.mbuf_track = 0; 3901 /* port stuff */ 3902 sctppcbinfo.lastlow = anonportmin; 3903 3904 /* Init the TIMEWAIT list */ 3905 for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) { 3906 LIST_INIT(&sctppcbinfo.vtag_timewait[i]); 3907 } 3908 3909 #if defined(_SCTP_NEEDS_CALLOUT_) && !defined(__APPLE__) 3910 TAILQ_INIT(&sctppcbinfo.callqueue); 3911 #endif 3912 3913 } 3914 3915 int 3916 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m, 3917 int iphlen, int offset, int limit, struct sctphdr *sh, 3918 struct sockaddr *altsa) 3919 { 3920 /* 3921 * grub through the INIT pulling addresses and 3922 * loading them to the nets structure in the asoc. 3923 * The from address in the mbuf should also be loaded 3924 * (if it is not already). This routine can be called 3925 * with either INIT or INIT-ACK's as long as the 3926 * m points to the IP packet and the offset points 3927 * to the beginning of the parameters. 3928 */ 3929 struct sctp_inpcb *inp, *l_inp; 3930 struct sctp_nets *net, *net_tmp; 3931 struct ip *iph; 3932 struct sctp_paramhdr *phdr, parm_buf; 3933 struct sctp_tcb *stcb_tmp; 3934 u_int16_t ptype, plen; 3935 struct sockaddr *sa; 3936 struct sockaddr_storage dest_store; 3937 struct sockaddr *local_sa = (struct sockaddr *)&dest_store; 3938 struct sockaddr_in sin; 3939 struct sockaddr_in6 sin6; 3940 3941 /* First get the destination address setup too. */ 3942 memset(&sin, 0, sizeof(sin)); 3943 memset(&sin6, 0, sizeof(sin6)); 3944 3945 sin.sin_family = AF_INET; 3946 sin.sin_len = sizeof(sin); 3947 sin.sin_port = stcb->rport; 3948 3949 sin6.sin6_family = AF_INET6; 3950 sin6.sin6_len = sizeof(struct sockaddr_in6); 3951 sin6.sin6_port = stcb->rport; 3952 if (altsa == NULL) { 3953 iph = mtod(m, struct ip *); 3954 if (iph->ip_v == IPVERSION) { 3955 /* its IPv4 */ 3956 struct sockaddr_in *sin_2; 3957 sin_2 = (struct sockaddr_in *)(local_sa); 3958 memset(sin_2, 0, sizeof(sin)); 3959 sin_2->sin_family = AF_INET; 3960 sin_2->sin_len = sizeof(sin); 3961 sin_2->sin_port = sh->dest_port; 3962 sin_2->sin_addr.s_addr = iph->ip_dst.s_addr ; 3963 sin.sin_addr = iph->ip_src; 3964 sa = (struct sockaddr *)&sin; 3965 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 3966 /* its IPv6 */ 3967 struct ip6_hdr *ip6; 3968 struct sockaddr_in6 *sin6_2; 3969 3970 ip6 = mtod(m, struct ip6_hdr *); 3971 sin6_2 = (struct sockaddr_in6 *)(local_sa); 3972 memset(sin6_2, 0, sizeof(sin6)); 3973 sin6_2->sin6_family = AF_INET6; 3974 sin6_2->sin6_len = sizeof(struct sockaddr_in6); 3975 sin6_2->sin6_port = sh->dest_port; 3976 sin6.sin6_addr = ip6->ip6_src; 3977 sa = (struct sockaddr *)&sin6; 3978 } else { 3979 sa = NULL; 3980 } 3981 } else { 3982 /* 3983 * For cookies we use the src address NOT from the packet 3984 * but from the original INIT 3985 */ 3986 sa = altsa; 3987 } 3988 /* Turn off ECN until we get through all params */ 3989 stcb->asoc.ecn_allowed = 0; 3990 3991 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 3992 /* mark all addresses that we have currently on the list */ 3993 net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC; 3994 } 3995 /* does the source address already exist? if so skip it */ 3996 l_inp = inp = stcb->sctp_ep; 3997 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, local_sa, stcb); 3998 if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) { 3999 /* we must add the source address */ 4000 /* no scope set here since we have a tcb already. */ 4001 if ((sa->sa_family == AF_INET) && 4002 (stcb->asoc.ipv4_addr_legal)) { 4003 if (sctp_add_remote_addr(stcb, sa, 0, 2)) { 4004 return (-1); 4005 } 4006 } else if ((sa->sa_family == AF_INET6) && 4007 (stcb->asoc.ipv6_addr_legal)) { 4008 if (sctp_add_remote_addr(stcb, sa, 0, 3)) { 4009 return (-1); 4010 } 4011 } 4012 } else { 4013 if (net_tmp != NULL && stcb_tmp == stcb) { 4014 net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC; 4015 } else if (stcb_tmp != stcb) { 4016 /* It belongs to another association? */ 4017 return (-1); 4018 } 4019 } 4020 /* since a unlock occured we must check the 4021 * TCB's state and the pcb's gone flags. 4022 */ 4023 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4024 /* the user freed the ep */ 4025 return (-1); 4026 } 4027 if (stcb->asoc.state == 0) { 4028 /* the assoc was freed? */ 4029 return (-1); 4030 } 4031 4032 /* now we must go through each of the params. */ 4033 phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf)); 4034 while (phdr) { 4035 ptype = ntohs(phdr->param_type); 4036 plen = ntohs(phdr->param_length); 4037 /*printf("ptype => %d, plen => %d\n", ptype, plen);*/ 4038 if (offset + plen > limit) { 4039 break; 4040 } 4041 if (plen == 0) { 4042 break; 4043 } 4044 if ((ptype == SCTP_IPV4_ADDRESS) && 4045 (stcb->asoc.ipv4_addr_legal)) { 4046 struct sctp_ipv4addr_param *p4, p4_buf; 4047 /* ok get the v4 address and check/add */ 4048 phdr = sctp_get_next_param(m, offset, 4049 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 4050 if (plen != sizeof(struct sctp_ipv4addr_param) || 4051 phdr == NULL) { 4052 return (-1); 4053 } 4054 p4 = (struct sctp_ipv4addr_param *)phdr; 4055 sin.sin_addr.s_addr = p4->addr; 4056 sa = (struct sockaddr *)&sin; 4057 inp = stcb->sctp_ep; 4058 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net, 4059 local_sa, stcb); 4060 4061 if ((stcb_tmp== NULL && inp == stcb->sctp_ep) || 4062 inp == NULL) { 4063 /* we must add the source address */ 4064 /* no scope set since we have a tcb already */ 4065 4066 /* we must validate the state again here */ 4067 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4068 /* the user freed the ep */ 4069 return (-1); 4070 } 4071 if (stcb->asoc.state == 0) { 4072 /* the assoc was freed? */ 4073 return (-1); 4074 } 4075 if (sctp_add_remote_addr(stcb, sa, 0, 4)) { 4076 return (-1); 4077 } 4078 } else if (stcb_tmp == stcb) { 4079 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4080 /* the user freed the ep */ 4081 return (-1); 4082 } 4083 if (stcb->asoc.state == 0) { 4084 /* the assoc was freed? */ 4085 return (-1); 4086 } 4087 if (net != NULL) { 4088 /* clear flag */ 4089 net->dest_state &= 4090 ~SCTP_ADDR_NOT_IN_ASSOC; 4091 } 4092 } else { 4093 /* strange, address is in another assoc? 4094 * straighten out locks. 4095 */ 4096 SCTP_TCB_UNLOCK(stcb_tmp); 4097 SCTP_INP_RLOCK(inp); 4098 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4099 /* the user freed the ep */ 4100 SCTP_INP_RUNLOCK(l_inp); 4101 return (-1); 4102 } 4103 if (stcb->asoc.state == 0) { 4104 /* the assoc was freed? */ 4105 SCTP_INP_RUNLOCK(l_inp); 4106 return (-1); 4107 } 4108 SCTP_TCB_LOCK(stcb); 4109 SCTP_INP_RUNLOCK(stcb->sctp_ep); 4110 return (-1); 4111 } 4112 } else if ((ptype == SCTP_IPV6_ADDRESS) && 4113 (stcb->asoc.ipv6_addr_legal)) { 4114 /* ok get the v6 address and check/add */ 4115 struct sctp_ipv6addr_param *p6, p6_buf; 4116 phdr = sctp_get_next_param(m, offset, 4117 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 4118 if (plen != sizeof(struct sctp_ipv6addr_param) || 4119 phdr == NULL) { 4120 return (-1); 4121 } 4122 p6 = (struct sctp_ipv6addr_param *)phdr; 4123 memcpy((void *)&sin6.sin6_addr, p6->addr, 4124 sizeof(p6->addr)); 4125 sa = (struct sockaddr *)&sin6; 4126 inp = stcb->sctp_ep; 4127 stcb_tmp= sctp_findassociation_ep_addr(&inp, sa, &net, 4128 local_sa, stcb); 4129 if (stcb_tmp == NULL && (inp == stcb->sctp_ep || 4130 inp == NULL)) { 4131 /* we must validate the state again here */ 4132 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4133 /* the user freed the ep */ 4134 return (-1); 4135 } 4136 if (stcb->asoc.state == 0) { 4137 /* the assoc was freed? */ 4138 return (-1); 4139 } 4140 /* we must add the address, no scope set */ 4141 if (sctp_add_remote_addr(stcb, sa, 0, 5)) { 4142 return (-1); 4143 } 4144 } else if (stcb_tmp == stcb) { 4145 /* we must validate the state again here */ 4146 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4147 /* the user freed the ep */ 4148 return (-1); 4149 } 4150 if (stcb->asoc.state == 0) { 4151 /* the assoc was freed? */ 4152 return (-1); 4153 } 4154 if (net != NULL) { 4155 /* clear flag */ 4156 net->dest_state &= 4157 ~SCTP_ADDR_NOT_IN_ASSOC; 4158 } 4159 } else { 4160 /* strange, address is in another assoc? 4161 * straighten out locks. 4162 */ 4163 SCTP_TCB_UNLOCK(stcb_tmp); 4164 SCTP_INP_RLOCK(l_inp); 4165 /* we must validate the state again here */ 4166 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4167 /* the user freed the ep */ 4168 SCTP_INP_RUNLOCK(l_inp); 4169 return (-1); 4170 } 4171 if (stcb->asoc.state == 0) { 4172 /* the assoc was freed? */ 4173 SCTP_INP_RUNLOCK(l_inp); 4174 return (-1); 4175 } 4176 SCTP_TCB_LOCK(stcb); 4177 SCTP_INP_RUNLOCK(l_inp); 4178 return (-1); 4179 } 4180 } else if (ptype == SCTP_ECN_CAPABLE) { 4181 stcb->asoc.ecn_allowed = 1; 4182 } else if (ptype == SCTP_ULP_ADAPTION) { 4183 if (stcb->asoc.state != SCTP_STATE_OPEN) { 4184 struct sctp_adaption_layer_indication ai, *aip; 4185 4186 phdr = sctp_get_next_param(m, offset, 4187 (struct sctp_paramhdr *)&ai, sizeof(ai)); 4188 aip = (struct sctp_adaption_layer_indication *)phdr; 4189 sctp_ulp_notify(SCTP_NOTIFY_ADAPTION_INDICATION, 4190 stcb, ntohl(aip->indication), NULL); 4191 } 4192 } else if (ptype == SCTP_SET_PRIM_ADDR) { 4193 struct sctp_asconf_addr_param lstore, *fee; 4194 struct sctp_asconf_addrv4_param *fii; 4195 int lptype; 4196 struct sockaddr *lsa = NULL; 4197 4198 stcb->asoc.peer_supports_asconf = 1; 4199 stcb->asoc.peer_supports_asconf_setprim = 1; 4200 if (plen > sizeof(lstore)) { 4201 return (-1); 4202 } 4203 phdr = sctp_get_next_param(m, offset, 4204 (struct sctp_paramhdr *)&lstore, plen); 4205 if (phdr == NULL) { 4206 return (-1); 4207 } 4208 4209 fee = (struct sctp_asconf_addr_param *)phdr; 4210 lptype = ntohs(fee->addrp.ph.param_type); 4211 if (lptype == SCTP_IPV4_ADDRESS) { 4212 if (plen != 4213 sizeof(struct sctp_asconf_addrv4_param)) { 4214 printf("Sizeof setprim in init/init ack not %d but %d - ignored\n", 4215 (int)sizeof(struct sctp_asconf_addrv4_param), 4216 plen); 4217 } else { 4218 fii = (struct sctp_asconf_addrv4_param *)fee; 4219 sin.sin_addr.s_addr = fii->addrp.addr; 4220 lsa = (struct sockaddr *)&sin; 4221 } 4222 } else if (lptype == SCTP_IPV6_ADDRESS) { 4223 if (plen != 4224 sizeof(struct sctp_asconf_addr_param)) { 4225 printf("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n", 4226 (int)sizeof(struct sctp_asconf_addr_param), 4227 plen); 4228 } else { 4229 memcpy(sin6.sin6_addr.s6_addr, 4230 fee->addrp.addr, 4231 sizeof(fee->addrp.addr)); 4232 lsa = (struct sockaddr *)&sin6; 4233 } 4234 } 4235 if (lsa) { 4236 sctp_set_primary_addr(stcb, sa, NULL); 4237 } 4238 4239 } else if (ptype == SCTP_PRSCTP_SUPPORTED) { 4240 /* Peer supports pr-sctp */ 4241 stcb->asoc.peer_supports_prsctp = 1; 4242 } else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) { 4243 /* A supported extension chunk */ 4244 struct sctp_supported_chunk_types_param *pr_supported; 4245 uint8_t local_store[128]; 4246 int num_ent, i; 4247 4248 phdr = sctp_get_next_param(m, offset, 4249 (struct sctp_paramhdr *)&local_store, plen); 4250 if (phdr == NULL) { 4251 return (-1); 4252 } 4253 stcb->asoc.peer_supports_asconf = 0; 4254 stcb->asoc.peer_supports_asconf_setprim = 0; 4255 stcb->asoc.peer_supports_prsctp = 0; 4256 stcb->asoc.peer_supports_pktdrop = 0; 4257 stcb->asoc.peer_supports_strreset = 0; 4258 pr_supported = (struct sctp_supported_chunk_types_param *)phdr; 4259 num_ent = plen - sizeof(struct sctp_paramhdr); 4260 for (i=0; i<num_ent; i++) { 4261 switch (pr_supported->chunk_types[i]) { 4262 case SCTP_ASCONF: 4263 stcb->asoc.peer_supports_asconf = 1; 4264 stcb->asoc.peer_supports_asconf_setprim = 1; 4265 break; 4266 case SCTP_ASCONF_ACK: 4267 stcb->asoc.peer_supports_asconf = 1; 4268 stcb->asoc.peer_supports_asconf_setprim = 1; 4269 break; 4270 case SCTP_FORWARD_CUM_TSN: 4271 stcb->asoc.peer_supports_prsctp = 1; 4272 break; 4273 case SCTP_PACKET_DROPPED: 4274 stcb->asoc.peer_supports_pktdrop = 1; 4275 break; 4276 case SCTP_STREAM_RESET: 4277 stcb->asoc.peer_supports_strreset = 1; 4278 break; 4279 default: 4280 /* one I have not learned yet */ 4281 break; 4282 4283 } 4284 } 4285 } else if (ptype == SCTP_ECN_NONCE_SUPPORTED) { 4286 /* Peer supports ECN-nonce */ 4287 stcb->asoc.peer_supports_ecn_nonce = 1; 4288 stcb->asoc.ecn_nonce_allowed = 1; 4289 } else if ((ptype == SCTP_HEARTBEAT_INFO) || 4290 (ptype == SCTP_STATE_COOKIE) || 4291 (ptype == SCTP_UNRECOG_PARAM) || 4292 (ptype == SCTP_COOKIE_PRESERVE) || 4293 (ptype == SCTP_SUPPORTED_ADDRTYPE) || 4294 (ptype == SCTP_ADD_IP_ADDRESS) || 4295 (ptype == SCTP_DEL_IP_ADDRESS) || 4296 (ptype == SCTP_ERROR_CAUSE_IND) || 4297 (ptype == SCTP_SUCCESS_REPORT)) { 4298 /* don't care */; 4299 } else { 4300 if ((ptype & 0x8000) == 0x0000) { 4301 /* must stop processing the rest of 4302 * the param's. Any report bits were 4303 * handled with the call to sctp_arethere_unrecognized_parameters() 4304 * when the INIT or INIT-ACK was first seen. 4305 */ 4306 break; 4307 } 4308 } 4309 offset += SCTP_SIZE32(plen); 4310 if (offset >= limit) { 4311 break; 4312 } 4313 phdr = sctp_get_next_param(m, offset, &parm_buf, 4314 sizeof(parm_buf)); 4315 } 4316 /* Now check to see if we need to purge any addresses */ 4317 for (net = TAILQ_FIRST(&stcb->asoc.nets); net != NULL; net = net_tmp) { 4318 net_tmp = TAILQ_NEXT(net, sctp_next); 4319 if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) == 4320 SCTP_ADDR_NOT_IN_ASSOC) { 4321 /* This address has been removed from the asoc */ 4322 /* remove and free it */ 4323 stcb->asoc.numnets--; 4324 TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next); 4325 sctp_free_remote_addr(net); 4326 if (net == stcb->asoc.primary_destination) { 4327 stcb->asoc.primary_destination = NULL; 4328 sctp_select_primary_destination(stcb); 4329 } 4330 } 4331 } 4332 return (0); 4333 } 4334 4335 int 4336 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa, 4337 struct sctp_nets *net) 4338 { 4339 /* make sure the requested primary address exists in the assoc */ 4340 if (net == NULL && sa) 4341 net = sctp_findnet(stcb, sa); 4342 4343 if (net == NULL) { 4344 /* didn't find the requested primary address! */ 4345 return (-1); 4346 } else { 4347 /* set the primary address */ 4348 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 4349 /* Must be confirmed */ 4350 return (-1); 4351 } 4352 stcb->asoc.primary_destination = net; 4353 net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY; 4354 return (0); 4355 } 4356 } 4357 4358 4359 int 4360 sctp_is_vtag_good(struct sctp_inpcb *inp, u_int32_t tag, struct timeval *now) 4361 { 4362 /* 4363 * This function serves two purposes. It will see if a TAG can be 4364 * re-used and return 1 for yes it is ok and 0 for don't use that 4365 * tag. 4366 * A secondary function it will do is purge out old tags that can 4367 * be removed. 4368 */ 4369 struct sctpasochead *head; 4370 struct sctpvtaghead *chain; 4371 struct sctp_tagblock *twait_block; 4372 struct sctp_tcb *stcb; 4373 4374 int i; 4375 SCTP_INP_INFO_WLOCK(); 4376 chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)]; 4377 /* First is the vtag in use ? */ 4378 4379 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(tag, 4380 sctppcbinfo.hashasocmark)]; 4381 if (head == NULL) { 4382 SCTP_INP_INFO_WUNLOCK(); 4383 return (0); 4384 } 4385 LIST_FOREACH(stcb, head, sctp_asocs) { 4386 if (stcb->asoc.my_vtag == tag) { 4387 /* We should remove this if and 4388 * return 0 always if we want vtags 4389 * unique across all endpoints. For 4390 * now within a endpoint is ok. 4391 */ 4392 if (inp == stcb->sctp_ep) { 4393 /* bad tag, in use */ 4394 SCTP_INP_INFO_WUNLOCK(); 4395 return (0); 4396 } 4397 } 4398 } 4399 if (!LIST_EMPTY(chain)) { 4400 /* 4401 * Block(s) are present, lets see if we have this tag in 4402 * the list 4403 */ 4404 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) { 4405 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) { 4406 if (twait_block->vtag_block[i].v_tag == 0) { 4407 /* not used */ 4408 continue; 4409 } else if ((long)twait_block->vtag_block[i].tv_sec_at_expire > 4410 now->tv_sec) { 4411 /* Audit expires this guy */ 4412 twait_block->vtag_block[i].tv_sec_at_expire = 0; 4413 twait_block->vtag_block[i].v_tag = 0; 4414 } else if (twait_block->vtag_block[i].v_tag == 4415 tag) { 4416 /* Bad tag, sorry :< */ 4417 SCTP_INP_INFO_WUNLOCK(); 4418 return (0); 4419 } 4420 } 4421 } 4422 } 4423 /* Not found, ok to use the tag */ 4424 SCTP_INP_INFO_WUNLOCK(); 4425 return (1); 4426 } 4427 4428 4429 /* 4430 * Delete the address from the endpoint local address list 4431 * Lookup using a sockaddr address (ie. not an ifaddr) 4432 */ 4433 int 4434 sctp_del_local_addr_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa) 4435 { 4436 struct sctp_laddr *laddr; 4437 struct sockaddr *l_sa; 4438 int found = 0; 4439 /* Here is another function I cannot find a 4440 * caller for. As such we SHOULD delete it 4441 * if we have no users. If we find a user that 4442 * user MUST have the INP locked. 4443 * 4444 */ 4445 4446 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 4447 /* You are already bound to all. You have it already */ 4448 return (EINVAL); 4449 } 4450 4451 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 4452 /* make sure the address exists */ 4453 if (laddr->ifa == NULL) 4454 continue; 4455 if (laddr->ifa->ifa_addr == NULL) 4456 continue; 4457 4458 l_sa = laddr->ifa->ifa_addr; 4459 if (l_sa->sa_family == AF_INET6) { 4460 /* IPv6 address */ 4461 struct sockaddr_in6 *sin1, *sin2; 4462 sin1 = (struct sockaddr_in6 *)l_sa; 4463 sin2 = (struct sockaddr_in6 *)sa; 4464 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr, 4465 sizeof(struct in6_addr)) == 0) { 4466 /* matched */ 4467 found = 1; 4468 break; 4469 } 4470 } else if (l_sa->sa_family == AF_INET) { 4471 /* IPv4 address */ 4472 struct sockaddr_in *sin1, *sin2; 4473 sin1 = (struct sockaddr_in *)l_sa; 4474 sin2 = (struct sockaddr_in *)sa; 4475 if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) { 4476 /* matched */ 4477 found = 1; 4478 break; 4479 } 4480 } else { 4481 /* invalid family */ 4482 return (-1); 4483 } 4484 } 4485 4486 if (found && inp->laddr_count < 2) { 4487 /* can't delete unless there are at LEAST 2 addresses */ 4488 return (-1); 4489 } 4490 4491 if (found && (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 4492 /* 4493 * remove it from the ep list, this should NOT be 4494 * done until its really gone from the interface list and 4495 * we won't be receiving more of these. Probably right 4496 * away. If we do allow a removal of an address from 4497 * an association (sub-set bind) than this should NOT 4498 * be called until the all ASCONF come back from this 4499 * association. 4500 */ 4501 sctp_remove_laddr(laddr); 4502 return (0); 4503 } else { 4504 return (-1); 4505 } 4506 } 4507 4508 static void 4509 sctp_drain_mbufs(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 4510 { 4511 /* 4512 * We must hunt this association for MBUF's past the cumack 4513 * (i.e. out of order data that we can renege on). 4514 */ 4515 struct sctp_association *asoc; 4516 struct sctp_tmit_chunk *chk, *nchk; 4517 u_int32_t cumulative_tsn_p1, tsn; 4518 int cnt, strmat, gap; 4519 /* We look for anything larger than the cum-ack + 1 */ 4520 4521 asoc = &stcb->asoc; 4522 cumulative_tsn_p1 = asoc->cumulative_tsn + 1; 4523 cnt = 0; 4524 /* First look in the re-assembly queue */ 4525 chk = TAILQ_FIRST(&asoc->reasmqueue); 4526 while (chk) { 4527 /* Get the next one */ 4528 nchk = TAILQ_NEXT(chk, sctp_next); 4529 if (compare_with_wrap(chk->rec.data.TSN_seq, 4530 cumulative_tsn_p1, MAX_TSN)) { 4531 /* Yep it is above cum-ack */ 4532 cnt++; 4533 tsn = chk->rec.data.TSN_seq; 4534 if (tsn >= asoc->mapping_array_base_tsn) { 4535 gap = tsn - asoc->mapping_array_base_tsn; 4536 } else { 4537 gap = (MAX_TSN - asoc->mapping_array_base_tsn) + 4538 tsn + 1; 4539 } 4540 asoc->size_on_reasm_queue -= chk->send_size; 4541 asoc->cnt_on_reasm_queue--; 4542 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap); 4543 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next); 4544 if (chk->data) { 4545 sctp_m_freem(chk->data); 4546 chk->data = NULL; 4547 } 4548 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4549 sctppcbinfo.ipi_count_chunk--; 4550 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4551 panic("Chunk count is negative"); 4552 } 4553 sctppcbinfo.ipi_gencnt_chunk++; 4554 } 4555 chk = nchk; 4556 } 4557 /* Ok that was fun, now we will drain all the inbound streams? */ 4558 for (strmat = 0; strmat < asoc->streamincnt; strmat++) { 4559 chk = TAILQ_FIRST(&asoc->strmin[strmat].inqueue); 4560 while (chk) { 4561 nchk = TAILQ_NEXT(chk, sctp_next); 4562 if (compare_with_wrap(chk->rec.data.TSN_seq, 4563 cumulative_tsn_p1, MAX_TSN)) { 4564 /* Yep it is above cum-ack */ 4565 cnt++; 4566 tsn = chk->rec.data.TSN_seq; 4567 if (tsn >= asoc->mapping_array_base_tsn) { 4568 gap = tsn - 4569 asoc->mapping_array_base_tsn; 4570 } else { 4571 gap = (MAX_TSN - 4572 asoc->mapping_array_base_tsn) + 4573 tsn + 1; 4574 } 4575 asoc->size_on_all_streams -= chk->send_size; 4576 asoc->cnt_on_all_streams--; 4577 4578 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, 4579 gap); 4580 TAILQ_REMOVE(&asoc->strmin[strmat].inqueue, 4581 chk, sctp_next); 4582 if (chk->data) { 4583 sctp_m_freem(chk->data); 4584 chk->data = NULL; 4585 } 4586 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4587 sctppcbinfo.ipi_count_chunk--; 4588 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4589 panic("Chunk count is negative"); 4590 } 4591 sctppcbinfo.ipi_gencnt_chunk++; 4592 } 4593 chk = nchk; 4594 } 4595 } 4596 /* 4597 * Question, should we go through the delivery queue? 4598 * The only reason things are on here is the app not reading OR a 4599 * p-d-api up. An attacker COULD send enough in to initiate the 4600 * PD-API and then send a bunch of stuff to other streams... these 4601 * would wind up on the delivery queue.. and then we would not get 4602 * to them. But in order to do this I then have to back-track and 4603 * un-deliver sequence numbers in streams.. el-yucko. I think for 4604 * now we will NOT look at the delivery queue and leave it to be 4605 * something to consider later. An alternative would be to abort 4606 * the P-D-API with a notification and then deliver the data.... 4607 * Or another method might be to keep track of how many times the 4608 * situation occurs and if we see a possible attack underway just 4609 * abort the association. 4610 */ 4611 #ifdef SCTP_DEBUG 4612 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 4613 if (cnt) { 4614 printf("Freed %d chunks from reneg harvest\n", cnt); 4615 } 4616 } 4617 #endif /* SCTP_DEBUG */ 4618 4619 /* 4620 * Another issue, in un-setting the TSN's in the mapping array we 4621 * DID NOT adjust the higest_tsn marker. This will cause one of 4622 * two things to occur. It may cause us to do extra work in checking 4623 * for our mapping array movement. More importantly it may cause us 4624 * to SACK every datagram. This may not be a bad thing though since 4625 * we will recover once we get our cum-ack above and all this stuff 4626 * we dumped recovered. 4627 */ 4628 } 4629 4630 void 4631 sctp_drain(void) 4632 { 4633 /* 4634 * We must walk the PCB lists for ALL associations here. The system 4635 * is LOW on MBUF's and needs help. This is where reneging will 4636 * occur. We really hope this does NOT happen! 4637 */ 4638 struct sctp_inpcb *inp; 4639 struct sctp_tcb *stcb; 4640 4641 SCTP_INP_INFO_RLOCK(); 4642 LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) { 4643 /* For each endpoint */ 4644 SCTP_INP_RLOCK(inp); 4645 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 4646 /* For each association */ 4647 SCTP_TCB_LOCK(stcb); 4648 sctp_drain_mbufs(inp, stcb); 4649 SCTP_TCB_UNLOCK(stcb); 4650 } 4651 SCTP_INP_RUNLOCK(inp); 4652 } 4653 SCTP_INP_INFO_RUNLOCK(); 4654 } 4655 4656 int 4657 sctp_add_to_socket_q(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 4658 { 4659 struct sctp_socket_q_list *sq; 4660 4661 /* write lock on INP assumed */ 4662 if ((inp == NULL) || (stcb == NULL)) { 4663 /* I am paranoid */ 4664 return (0); 4665 } 4666 sq = (struct sctp_socket_q_list *)SCTP_ZONE_GET( 4667 sctppcbinfo.ipi_zone_sockq); 4668 if (sq == NULL) { 4669 /* out of sq structs */ 4670 return (0); 4671 } 4672 sctppcbinfo.ipi_count_sockq++; 4673 sctppcbinfo.ipi_gencnt_sockq++; 4674 if (stcb) 4675 stcb->asoc.cnt_msg_on_sb++; 4676 sq->tcb = stcb; 4677 TAILQ_INSERT_TAIL(&inp->sctp_queue_list, sq, next_sq); 4678 return (1); 4679 } 4680 4681 4682 struct sctp_tcb * 4683 sctp_remove_from_socket_q(struct sctp_inpcb *inp) 4684 { 4685 struct sctp_tcb *stcb = NULL; 4686 struct sctp_socket_q_list *sq; 4687 4688 /* W-Lock on INP assumed held */ 4689 sq = TAILQ_FIRST(&inp->sctp_queue_list); 4690 if (sq == NULL) 4691 return (NULL); 4692 4693 stcb = sq->tcb; 4694 TAILQ_REMOVE(&inp->sctp_queue_list, sq, next_sq); 4695 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_sockq, sq); 4696 sctppcbinfo.ipi_count_sockq--; 4697 sctppcbinfo.ipi_gencnt_sockq++; 4698 if (stcb) { 4699 stcb->asoc.cnt_msg_on_sb--; 4700 } 4701 return (stcb); 4702 } 4703 4704 int 4705 sctp_initiate_iterator(asoc_func af, uint32_t pcb_state, uint32_t asoc_state, 4706 void *argp, uint32_t argi, end_func ef, 4707 struct sctp_inpcb *s_inp) 4708 { 4709 struct sctp_iterator *it=NULL; 4710 int s; 4711 if (af == NULL) { 4712 return (-1); 4713 } 4714 it = malloc(sizeof(struct sctp_iterator), M_PCB, M_WAITOK); 4715 if (it == NULL) { 4716 return (ENOMEM); 4717 } 4718 memset(it, 0, sizeof(*it)); 4719 it->function_toapply = af; 4720 it->function_atend = ef; 4721 it->pointer = argp; 4722 it->val = argi; 4723 it->pcb_flags = pcb_state; 4724 it->asoc_state = asoc_state; 4725 if (s_inp) { 4726 it->inp = s_inp; 4727 it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP; 4728 } else { 4729 SCTP_INP_INFO_RLOCK(); 4730 it->inp = LIST_FIRST(&sctppcbinfo.listhead); 4731 SCTP_INP_INFO_RUNLOCK(); 4732 it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP; 4733 4734 } 4735 /* Init the timer */ 4736 callout_init(&it->tmr.timer, 0); 4737 /* add to the list of all iterators */ 4738 SCTP_INP_INFO_WLOCK(); 4739 LIST_INSERT_HEAD(&sctppcbinfo.iteratorhead, it, sctp_nxt_itr); 4740 SCTP_INP_INFO_WUNLOCK(); 4741 s = splsoftnet(); 4742 sctp_iterator_timer(it); 4743 splx(s); 4744 return (0); 4745 } 4746 4747 4748