1 /* $KAME: sctp_pcb.c,v 1.39 2005/06/16 18:29:25 jinmei Exp $ */ 2 /* $NetBSD: sctp_pcb.c,v 1.7 2016/07/07 09:32:02 ozaki-r Exp $ */ 3 4 /* 5 * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. All advertising materials mentioning features or use of this software 17 * must display the following acknowledgement: 18 * This product includes software developed by Cisco Systems, Inc. 19 * 4. Neither the name of the project nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY CISCO SYSTEMS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL CISCO SYSTEMS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 #include <sys/cdefs.h> 36 __KERNEL_RCSID(0, "$NetBSD: sctp_pcb.c,v 1.7 2016/07/07 09:32:02 ozaki-r Exp $"); 37 38 #ifdef _KERNEL_OPT 39 #include "opt_inet.h" 40 #include "opt_sctp.h" 41 #endif /* _KERNEL_OPT */ 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/malloc.h> 46 #include <sys/mbuf.h> 47 #include <sys/domain.h> 48 #include <sys/protosw.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/proc.h> 52 #include <sys/kauth.h> 53 #include <sys/kernel.h> 54 #include <sys/sysctl.h> 55 #include <sys/rnd.h> 56 #include <sys/callout.h> 57 58 #include <machine/limits.h> 59 #include <machine/cpu.h> 60 61 #include <net/if.h> 62 #include <net/if_types.h> 63 #include <net/route.h> 64 #include <netinet/in.h> 65 #include <netinet/in_systm.h> 66 #include <netinet/ip.h> 67 #include <netinet/in_pcb.h> 68 #include <netinet/in_var.h> 69 #include <netinet/ip_var.h> 70 71 #ifdef INET6 72 #include <netinet/ip6.h> 73 #include <netinet6/ip6_var.h> 74 #include <netinet6/scope6_var.h> 75 #include <netinet6/in6_pcb.h> 76 #endif /* INET6 */ 77 78 #ifdef IPSEC 79 #include <netipsec/ipsec.h> 80 #include <netipsec/key.h> 81 #endif /* IPSEC */ 82 83 #include <netinet/sctp_var.h> 84 #include <netinet/sctp_pcb.h> 85 #include <netinet/sctputil.h> 86 #include <netinet/sctp.h> 87 #include <netinet/sctp_header.h> 88 #include <netinet/sctp_asconf.h> 89 #include <netinet/sctp_output.h> 90 #include <netinet/sctp_timer.h> 91 92 #ifndef SCTP_PCBHASHSIZE 93 /* default number of association hash buckets in each endpoint */ 94 #define SCTP_PCBHASHSIZE 256 95 #endif 96 97 #ifdef SCTP_DEBUG 98 u_int32_t sctp_debug_on = SCTP_DEBUG_ALL; 99 #endif /* SCTP_DEBUG */ 100 101 u_int32_t sctp_pegs[SCTP_NUMBER_OF_PEGS]; 102 103 int sctp_pcbtblsize = SCTP_PCBHASHSIZE; 104 105 struct sctp_epinfo sctppcbinfo; 106 107 /* FIX: we don't handle multiple link local scopes */ 108 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */ 109 int 110 SCTP6_ARE_ADDR_EQUAL(const struct in6_addr *a, const struct in6_addr *b) 111 { 112 struct in6_addr tmp_a, tmp_b; 113 /* use a copy of a and b */ 114 tmp_a = *a; 115 tmp_b = *b; 116 in6_clearscope(&tmp_a); 117 in6_clearscope(&tmp_b); 118 return (IN6_ARE_ADDR_EQUAL(&tmp_a, &tmp_b)); 119 } 120 121 #if defined(__FreeBSD__) && __FreeBSD_version > 500000 122 123 #ifndef xyzzy 124 void sctp_validate_no_locks(void); 125 126 void 127 SCTP_INP_RLOCK(struct sctp_inpcb *inp) 128 { 129 struct sctp_tcb *stcb; 130 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 131 if (mtx_owned(&(stcb)->tcb_mtx)) 132 panic("I own TCB lock?"); 133 } 134 if (mtx_owned(&(inp)->inp_mtx)) 135 panic("INP Recursive Lock-R"); 136 mtx_lock(&(inp)->inp_mtx); 137 } 138 139 void 140 SCTP_INP_WLOCK(struct sctp_inpcb *inp) 141 { 142 SCTP_INP_RLOCK(inp); 143 } 144 145 void 146 SCTP_INP_INFO_RLOCK() 147 { 148 struct sctp_inpcb *inp; 149 struct sctp_tcb *stcb; 150 LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) { 151 if (mtx_owned(&(inp)->inp_mtx)) 152 panic("info-lock and own inp lock?"); 153 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 154 if (mtx_owned(&(stcb)->tcb_mtx)) 155 panic("Info lock and own a tcb lock?"); 156 } 157 } 158 if (mtx_owned(&sctppcbinfo.ipi_ep_mtx)) 159 panic("INP INFO Recursive Lock-R"); 160 mtx_lock(&sctppcbinfo.ipi_ep_mtx); 161 } 162 163 void 164 SCTP_INP_INFO_WLOCK() 165 { 166 SCTP_INP_INFO_RLOCK(); 167 } 168 169 170 void sctp_validate_no_locks() 171 { 172 struct sctp_inpcb *inp; 173 struct sctp_tcb *stcb; 174 175 if (mtx_owned(&sctppcbinfo.ipi_ep_mtx)) 176 panic("INP INFO lock is owned?"); 177 178 LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) { 179 if (mtx_owned(&(inp)->inp_mtx)) 180 panic("You own an INP lock?"); 181 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 182 if (mtx_owned(&(stcb)->tcb_mtx)) 183 panic("You own a TCB lock?"); 184 } 185 } 186 } 187 188 #endif 189 #endif 190 191 void 192 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb) 193 { 194 /* We really don't need 195 * to lock this, but I will 196 * just because it does not hurt. 197 */ 198 SCTP_INP_INFO_RLOCK(); 199 spcb->ep_count = sctppcbinfo.ipi_count_ep; 200 spcb->asoc_count = sctppcbinfo.ipi_count_asoc; 201 spcb->laddr_count = sctppcbinfo.ipi_count_laddr; 202 spcb->raddr_count = sctppcbinfo.ipi_count_raddr; 203 spcb->chk_count = sctppcbinfo.ipi_count_chunk; 204 spcb->sockq_count = sctppcbinfo.ipi_count_sockq; 205 spcb->mbuf_track = sctppcbinfo.mbuf_track; 206 SCTP_INP_INFO_RUNLOCK(); 207 } 208 209 210 /* 211 * Notes on locks for FreeBSD 5 and up. All association 212 * lookups that have a definte ep, the INP structure is 213 * assumed to be locked for reading. If we need to go 214 * find the INP (ususally when a **inp is passed) then 215 * we must lock the INFO structure first and if needed 216 * lock the INP too. Note that if we lock it we must 217 * 218 */ 219 220 221 /* 222 * Given a endpoint, look and find in its association list any association 223 * with the "to" address given. This can be a "from" address, too, for 224 * inbound packets. For outbound packets it is a true "to" address. 225 */ 226 static struct sctp_tcb * 227 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from, 228 struct sockaddr *to, struct sctp_nets **netp) 229 { 230 /**** ASSUMSES THE CALLER holds the INP_INFO_RLOCK */ 231 232 /* 233 * Note for this module care must be taken when observing what to is 234 * for. In most of the rest of the code the TO field represents my 235 * peer and the FROM field represents my address. For this module it 236 * is reversed of that. 237 */ 238 /* 239 * If we support the TCP model, then we must now dig through to 240 * see if we can find our endpoint in the list of tcp ep's. 241 */ 242 uint16_t lport, rport; 243 struct sctppcbhead *ephead; 244 struct sctp_inpcb *inp; 245 struct sctp_laddr *laddr; 246 struct sctp_tcb *stcb; 247 struct sctp_nets *net; 248 249 if ((to == NULL) || (from == NULL)) { 250 return (NULL); 251 } 252 253 if (to->sa_family == AF_INET && from->sa_family == AF_INET) { 254 lport = ((struct sockaddr_in *)to)->sin_port; 255 rport = ((struct sockaddr_in *)from)->sin_port; 256 } else if (to->sa_family == AF_INET6 && from->sa_family == AF_INET6) { 257 lport = ((struct sockaddr_in6 *)to)->sin6_port; 258 rport = ((struct sockaddr_in6 *)from)->sin6_port; 259 } else { 260 return NULL; 261 } 262 ephead = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR( 263 (lport + rport), sctppcbinfo.hashtcpmark)]; 264 /* 265 * Ok now for each of the guys in this bucket we must look 266 * and see: 267 * - Does the remote port match. 268 * - Does there single association's addresses match this 269 * address (to). 270 * If so we update p_ep to point to this ep and return the 271 * tcb from it. 272 */ 273 LIST_FOREACH(inp, ephead, sctp_hash) { 274 if (lport != inp->sctp_lport) { 275 continue; 276 } 277 SCTP_INP_RLOCK(inp); 278 /* check to see if the ep has one of the addresses */ 279 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 280 /* We are NOT bound all, so look further */ 281 int match = 0; 282 283 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 284 if (laddr->ifa == NULL) { 285 #ifdef SCTP_DEBUG 286 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 287 printf("An ounce of prevention is worth a pound of cure\n"); 288 } 289 #endif 290 continue; 291 } 292 if (laddr->ifa->ifa_addr == NULL) { 293 #ifdef SCTP_DEBUG 294 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 295 printf("ifa with a NULL address\n"); 296 } 297 #endif 298 continue; 299 } 300 if (laddr->ifa->ifa_addr->sa_family == 301 to->sa_family) { 302 /* see if it matches */ 303 struct sockaddr_in *intf_addr, *sin; 304 intf_addr = (struct sockaddr_in *) 305 laddr->ifa->ifa_addr; 306 sin = (struct sockaddr_in *)to; 307 if (from->sa_family == AF_INET) { 308 if (sin->sin_addr.s_addr == 309 intf_addr->sin_addr.s_addr) { 310 match = 1; 311 SCTP_INP_RUNLOCK(inp); 312 break; 313 } 314 } else { 315 struct sockaddr_in6 *intf_addr6; 316 struct sockaddr_in6 *sin6; 317 sin6 = (struct sockaddr_in6 *) 318 to; 319 intf_addr6 = (struct sockaddr_in6 *) 320 laddr->ifa->ifa_addr; 321 322 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 323 &intf_addr6->sin6_addr)) { 324 match = 1; 325 SCTP_INP_RUNLOCK(inp); 326 break; 327 } 328 } 329 } 330 } 331 if (match == 0) { 332 /* This endpoint does not have this address */ 333 SCTP_INP_RUNLOCK(inp); 334 continue; 335 } 336 } 337 /* 338 * Ok if we hit here the ep has the address, does it hold the 339 * tcb? 340 */ 341 342 stcb = LIST_FIRST(&inp->sctp_asoc_list); 343 if (stcb == NULL) { 344 SCTP_INP_RUNLOCK(inp); 345 continue; 346 } 347 SCTP_TCB_LOCK(stcb); 348 if (stcb->rport != rport) { 349 /* remote port does not match. */ 350 SCTP_TCB_UNLOCK(stcb); 351 SCTP_INP_RUNLOCK(inp); 352 continue; 353 } 354 /* Does this TCB have a matching address? */ 355 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 356 if (sctp_cmpaddr(from, rtcache_getdst(&net->ro))) { 357 /* found it */ 358 if (netp != NULL) { 359 *netp = net; 360 } 361 /* Update the endpoint pointer */ 362 *inp_p = inp; 363 SCTP_INP_RUNLOCK(inp); 364 return (stcb); 365 } 366 } 367 SCTP_TCB_UNLOCK(stcb); 368 369 SCTP_INP_RUNLOCK(inp); 370 } 371 return (NULL); 372 } 373 374 struct sctp_tcb * 375 sctp_findassociation_ep_asconf(struct mbuf *m, int iphlen, int offset, 376 struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp) 377 { 378 struct sctp_tcb *stcb; 379 struct sockaddr_in *sin; 380 struct sockaddr_in6 *sin6; 381 struct sockaddr_storage local_store, remote_store; 382 struct ip *iph; 383 struct sctp_paramhdr parm_buf, *phdr; 384 int ptype; 385 386 memset(&local_store, 0, sizeof(local_store)); 387 memset(&remote_store, 0, sizeof(remote_store)); 388 389 /* First get the destination address setup too. */ 390 iph = mtod(m, struct ip *); 391 if (iph->ip_v == IPVERSION) { 392 /* its IPv4 */ 393 sin = (struct sockaddr_in *)&local_store; 394 sin->sin_family = AF_INET; 395 sin->sin_len = sizeof(*sin); 396 sin->sin_port = sh->dest_port; 397 sin->sin_addr.s_addr = iph->ip_dst.s_addr ; 398 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 399 /* its IPv6 */ 400 struct ip6_hdr *ip6; 401 ip6 = mtod(m, struct ip6_hdr *); 402 sin6 = (struct sockaddr_in6 *)&local_store; 403 sin6->sin6_family = AF_INET6; 404 sin6->sin6_len = sizeof(*sin6); 405 sin6->sin6_port = sh->dest_port; 406 sin6->sin6_addr = ip6->ip6_dst; 407 } else { 408 return NULL; 409 } 410 411 phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk), 412 &parm_buf, sizeof(struct sctp_paramhdr)); 413 if (phdr == NULL) { 414 #ifdef SCTP_DEBUG 415 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 416 printf("sctp_process_control: failed to get asconf lookup addr\n"); 417 } 418 #endif /* SCTP_DEBUG */ 419 return NULL; 420 } 421 ptype = (int)((u_int)ntohs(phdr->param_type)); 422 /* get the correlation address */ 423 if (ptype == SCTP_IPV6_ADDRESS) { 424 /* ipv6 address param */ 425 struct sctp_ipv6addr_param *p6, p6_buf; 426 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) { 427 return NULL; 428 } 429 430 p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m, 431 offset + sizeof(struct sctp_asconf_chunk), 432 &p6_buf.ph, sizeof(*p6)); 433 if (p6 == NULL) { 434 #ifdef SCTP_DEBUG 435 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 436 printf("sctp_process_control: failed to get asconf v6 lookup addr\n"); 437 } 438 #endif /* SCTP_DEBUG */ 439 return (NULL); 440 } 441 sin6 = (struct sockaddr_in6 *)&remote_store; 442 sin6->sin6_family = AF_INET6; 443 sin6->sin6_len = sizeof(*sin6); 444 sin6->sin6_port = sh->src_port; 445 memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr)); 446 } else if (ptype == SCTP_IPV4_ADDRESS) { 447 /* ipv4 address param */ 448 struct sctp_ipv4addr_param *p4, p4_buf; 449 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) { 450 return NULL; 451 } 452 453 p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m, 454 offset + sizeof(struct sctp_asconf_chunk), 455 &p4_buf.ph, sizeof(*p4)); 456 if (p4 == NULL) { 457 #ifdef SCTP_DEBUG 458 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 459 printf("sctp_process_control: failed to get asconf v4 lookup addr\n"); 460 } 461 #endif /* SCTP_DEBUG */ 462 return (NULL); 463 } 464 sin = (struct sockaddr_in *)&remote_store; 465 sin->sin_family = AF_INET; 466 sin->sin_len = sizeof(*sin); 467 sin->sin_port = sh->src_port; 468 memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr)); 469 } else { 470 /* invalid address param type */ 471 return NULL; 472 } 473 474 stcb = sctp_findassociation_ep_addr(inp_p, 475 (struct sockaddr *)&remote_store, netp, 476 (struct sockaddr *)&local_store, NULL); 477 return (stcb); 478 } 479 480 struct sctp_tcb * 481 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote, 482 struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb) 483 { 484 struct sctpasochead *head; 485 struct sctp_inpcb *inp; 486 struct sctp_tcb *stcb; 487 struct sctp_nets *net; 488 uint16_t rport; 489 490 inp = *inp_p; 491 if (remote->sa_family == AF_INET) { 492 rport = (((struct sockaddr_in *)remote)->sin_port); 493 } else if (remote->sa_family == AF_INET6) { 494 rport = (((struct sockaddr_in6 *)remote)->sin6_port); 495 } else { 496 return (NULL); 497 } 498 if (locked_tcb) { 499 /* UN-lock so we can do proper locking here 500 * this occurs when called from load_addresses_from_init. 501 */ 502 SCTP_TCB_UNLOCK(locked_tcb); 503 } 504 SCTP_INP_INFO_RLOCK(); 505 if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 506 /* 507 * Now either this guy is our listner or it's the connector. 508 * If it is the one that issued the connect, then it's only 509 * chance is to be the first TCB in the list. If it is the 510 * acceptor, then do the special_lookup to hash and find the 511 * real inp. 512 */ 513 if (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING) { 514 /* to is peer addr, from is my addr */ 515 stcb = sctp_tcb_special_locate(inp_p, remote, local, 516 netp); 517 if ((stcb != NULL) && (locked_tcb == NULL)){ 518 /* we have a locked tcb, lower refcount */ 519 SCTP_INP_WLOCK(inp); 520 SCTP_INP_DECR_REF(inp); 521 SCTP_INP_WUNLOCK(inp); 522 } 523 if (locked_tcb != NULL) { 524 SCTP_INP_RLOCK(locked_tcb->sctp_ep); 525 SCTP_TCB_LOCK(locked_tcb); 526 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep); 527 if (stcb != NULL) { 528 SCTP_TCB_UNLOCK(stcb); 529 } 530 } 531 SCTP_INP_INFO_RUNLOCK(); 532 return (stcb); 533 } else { 534 SCTP_INP_WLOCK(inp); 535 stcb = LIST_FIRST(&inp->sctp_asoc_list); 536 if (stcb == NULL) { 537 goto null_return; 538 } 539 SCTP_TCB_LOCK(stcb); 540 if (stcb->rport != rport) { 541 /* remote port does not match. */ 542 SCTP_TCB_UNLOCK(stcb); 543 goto null_return; 544 } 545 /* now look at the list of remote addresses */ 546 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 547 if (sctp_cmpaddr(remote, rtcache_getdst(&net->ro))) { 548 /* found it */ 549 if (netp != NULL) { 550 *netp = net; 551 } 552 if (locked_tcb == NULL) { 553 SCTP_INP_DECR_REF(inp); 554 } 555 SCTP_INP_WUNLOCK(inp); 556 SCTP_INP_INFO_RUNLOCK(); 557 return (stcb); 558 } 559 } 560 SCTP_TCB_UNLOCK(stcb); 561 } 562 } else { 563 SCTP_INP_WLOCK(inp); 564 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport, 565 inp->sctp_hashmark)]; 566 if (head == NULL) { 567 goto null_return; 568 } 569 LIST_FOREACH(stcb, head, sctp_tcbhash) { 570 if (stcb->rport != rport) { 571 /* remote port does not match */ 572 continue; 573 } 574 /* now look at the list of remote addresses */ 575 SCTP_TCB_LOCK(stcb); 576 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 577 if (sctp_cmpaddr(remote, rtcache_getdst(&net->ro))) { 578 /* found it */ 579 if (netp != NULL) { 580 *netp = net; 581 } 582 if (locked_tcb == NULL) { 583 SCTP_INP_DECR_REF(inp); 584 } 585 SCTP_INP_WUNLOCK(inp); 586 SCTP_INP_INFO_RUNLOCK(); 587 return (stcb); 588 } 589 } 590 SCTP_TCB_UNLOCK(stcb); 591 } 592 } 593 null_return: 594 /* clean up for returning null */ 595 if (locked_tcb){ 596 if (locked_tcb->sctp_ep != inp) { 597 SCTP_INP_RLOCK(locked_tcb->sctp_ep); 598 SCTP_TCB_LOCK(locked_tcb); 599 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep); 600 } else { 601 SCTP_TCB_LOCK(locked_tcb); 602 } 603 } 604 SCTP_INP_WUNLOCK(inp); 605 SCTP_INP_INFO_RUNLOCK(); 606 /* not found */ 607 return (NULL); 608 } 609 610 /* 611 * Find an association for a specific endpoint using the association id 612 * given out in the COMM_UP notification 613 */ 614 struct sctp_tcb * 615 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, vaddr_t asoc_id) 616 { 617 /* 618 * Use my the assoc_id to find a endpoint 619 */ 620 struct sctpasochead *head; 621 struct sctp_tcb *stcb; 622 u_int32_t vtag; 623 624 if (asoc_id == 0 || inp == NULL) { 625 return (NULL); 626 } 627 SCTP_INP_INFO_RLOCK(); 628 vtag = (u_int32_t)asoc_id; 629 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag, 630 sctppcbinfo.hashasocmark)]; 631 if (head == NULL) { 632 /* invalid vtag */ 633 SCTP_INP_INFO_RUNLOCK(); 634 return (NULL); 635 } 636 LIST_FOREACH(stcb, head, sctp_asocs) { 637 SCTP_INP_RLOCK(stcb->sctp_ep); 638 SCTP_TCB_LOCK(stcb); 639 SCTP_INP_RUNLOCK(stcb->sctp_ep); 640 if (stcb->asoc.my_vtag == vtag) { 641 /* candidate */ 642 if (inp != stcb->sctp_ep) { 643 /* some other guy has the 644 * same vtag active (vtag collision). 645 */ 646 sctp_pegs[SCTP_VTAG_BOGUS]++; 647 SCTP_TCB_UNLOCK(stcb); 648 continue; 649 } 650 sctp_pegs[SCTP_VTAG_EXPR]++; 651 SCTP_INP_INFO_RUNLOCK(); 652 return (stcb); 653 } 654 SCTP_TCB_UNLOCK(stcb); 655 } 656 SCTP_INP_INFO_RUNLOCK(); 657 return (NULL); 658 } 659 660 static struct sctp_inpcb * 661 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head, 662 uint16_t lport) 663 { 664 struct sctp_inpcb *inp; 665 struct sockaddr_in *sin; 666 struct sockaddr_in6 *sin6; 667 struct sctp_laddr *laddr; 668 669 /* Endpoing probe expects 670 * that the INP_INFO is locked. 671 */ 672 if (nam->sa_family == AF_INET) { 673 sin = (struct sockaddr_in *)nam; 674 sin6 = NULL; 675 } else if (nam->sa_family == AF_INET6) { 676 sin6 = (struct sockaddr_in6 *)nam; 677 sin = NULL; 678 } else { 679 /* unsupported family */ 680 return (NULL); 681 } 682 if (head == NULL) 683 return (NULL); 684 685 LIST_FOREACH(inp, head, sctp_hash) { 686 SCTP_INP_RLOCK(inp); 687 688 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) && 689 (inp->sctp_lport == lport)) { 690 /* got it */ 691 if ((nam->sa_family == AF_INET) && 692 (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 693 #if defined(__FreeBSD__) || defined(__APPLE__) 694 (((struct inpcb *)inp)->inp_flags & IN6P_IPV6_V6ONLY) 695 #else 696 #if defined(__OpenBSD__) 697 (0) /* For open bsd we do dual bind only */ 698 #else 699 (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY) 700 #endif 701 #endif 702 ) { 703 /* IPv4 on a IPv6 socket with ONLY IPv6 set */ 704 SCTP_INP_RUNLOCK(inp); 705 continue; 706 } 707 /* A V6 address and the endpoint is NOT bound V6 */ 708 if (nam->sa_family == AF_INET6 && 709 (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) { 710 SCTP_INP_RUNLOCK(inp); 711 continue; 712 } 713 SCTP_INP_RUNLOCK(inp); 714 return (inp); 715 } 716 SCTP_INP_RUNLOCK(inp); 717 } 718 719 if ((nam->sa_family == AF_INET) && 720 (sin->sin_addr.s_addr == INADDR_ANY)) { 721 /* Can't hunt for one that has no address specified */ 722 return (NULL); 723 } else if ((nam->sa_family == AF_INET6) && 724 (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) { 725 /* Can't hunt for one that has no address specified */ 726 return (NULL); 727 } 728 /* 729 * ok, not bound to all so see if we can find a EP bound to this 730 * address. 731 */ 732 #ifdef SCTP_DEBUG 733 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 734 printf("Ok, there is NO bound-all available for port:%x\n", ntohs(lport)); 735 } 736 #endif 737 LIST_FOREACH(inp, head, sctp_hash) { 738 SCTP_INP_RLOCK(inp); 739 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) { 740 SCTP_INP_RUNLOCK(inp); 741 continue; 742 } 743 /* 744 * Ok this could be a likely candidate, look at all of 745 * its addresses 746 */ 747 if (inp->sctp_lport != lport) { 748 SCTP_INP_RUNLOCK(inp); 749 continue; 750 } 751 #ifdef SCTP_DEBUG 752 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 753 printf("Ok, found maching local port\n"); 754 } 755 #endif 756 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 757 if (laddr->ifa == NULL) { 758 #ifdef SCTP_DEBUG 759 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 760 printf("An ounce of prevention is worth a pound of cure\n"); 761 } 762 #endif 763 continue; 764 } 765 #ifdef SCTP_DEBUG 766 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 767 printf("Ok laddr->ifa:%p is possible, ", 768 laddr->ifa); 769 } 770 #endif 771 if (laddr->ifa->ifa_addr == NULL) { 772 #ifdef SCTP_DEBUG 773 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 774 printf("Huh IFA as an ifa_addr=NULL, "); 775 } 776 #endif 777 continue; 778 } 779 #ifdef SCTP_DEBUG 780 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 781 printf("Ok laddr->ifa:%p is possible, ", 782 laddr->ifa->ifa_addr); 783 sctp_print_address(laddr->ifa->ifa_addr); 784 printf("looking for "); 785 sctp_print_address(nam); 786 } 787 #endif 788 if (laddr->ifa->ifa_addr->sa_family == nam->sa_family) { 789 /* possible, see if it matches */ 790 struct sockaddr_in *intf_addr; 791 intf_addr = (struct sockaddr_in *) 792 laddr->ifa->ifa_addr; 793 if (nam->sa_family == AF_INET) { 794 if (sin->sin_addr.s_addr == 795 intf_addr->sin_addr.s_addr) { 796 #ifdef SCTP_DEBUG 797 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 798 printf("YES, return ep:%p\n", inp); 799 } 800 #endif 801 SCTP_INP_RUNLOCK(inp); 802 return (inp); 803 } 804 } else if (nam->sa_family == AF_INET6) { 805 struct sockaddr_in6 *intf_addr6; 806 intf_addr6 = (struct sockaddr_in6 *) 807 laddr->ifa->ifa_addr; 808 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 809 &intf_addr6->sin6_addr)) { 810 #ifdef SCTP_DEBUG 811 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 812 printf("YES, return ep:%p\n", inp); 813 } 814 #endif 815 SCTP_INP_RUNLOCK(inp); 816 return (inp); 817 } 818 } 819 } 820 SCTP_INP_RUNLOCK(inp); 821 } 822 } 823 #ifdef SCTP_DEBUG 824 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 825 printf("NO, Falls out to NULL\n"); 826 } 827 #endif 828 return (NULL); 829 } 830 831 832 struct sctp_inpcb * 833 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock) 834 { 835 /* 836 * First we check the hash table to see if someone has this port 837 * bound with just the port. 838 */ 839 struct sctp_inpcb *inp; 840 struct sctppcbhead *head; 841 int lport; 842 #ifdef SCTP_DEBUG 843 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 844 printf("Looking for endpoint %d :", 845 ntohs(((struct sockaddr_in *)nam)->sin_port)); 846 sctp_print_address(nam); 847 } 848 #endif 849 if (nam->sa_family == AF_INET) { 850 lport = ((struct sockaddr_in *)nam)->sin_port; 851 } else if (nam->sa_family == AF_INET6) { 852 lport = ((struct sockaddr_in6 *)nam)->sin6_port; 853 } else { 854 /* unsupported family */ 855 return (NULL); 856 } 857 /* 858 * I could cheat here and just cast to one of the types but we will 859 * do it right. It also provides the check against an Unsupported 860 * type too. 861 */ 862 /* Find the head of the ALLADDR chain */ 863 if (have_lock == 0) { 864 SCTP_INP_INFO_RLOCK(); 865 } 866 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 867 sctppcbinfo.hashmark)]; 868 #ifdef SCTP_DEBUG 869 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 870 printf("Main hash to lookup at head:%p\n", head); 871 } 872 #endif 873 inp = sctp_endpoint_probe(nam, head, lport); 874 875 /* 876 * If the TCP model exists it could be that the main listening 877 * endpoint is gone but there exists a connected socket for this 878 * guy yet. If so we can return the first one that we find. This 879 * may NOT be the correct one but the sctp_findassociation_ep_addr 880 * has further code to look at all TCP models. 881 */ 882 if (inp == NULL && find_tcp_pool) { 883 unsigned int i; 884 #ifdef SCTP_DEBUG 885 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 886 printf("EP was NULL and TCP model is supported\n"); 887 } 888 #endif 889 for (i = 0; i < sctppcbinfo.hashtblsize; i++) { 890 /* 891 * This is real gross, but we do NOT have a remote 892 * port at this point depending on who is calling. We 893 * must therefore look for ANY one that matches our 894 * local port :/ 895 */ 896 head = &sctppcbinfo.sctp_tcpephash[i]; 897 if (LIST_FIRST(head)) { 898 inp = sctp_endpoint_probe(nam, head, lport); 899 if (inp) { 900 /* Found one */ 901 break; 902 } 903 } 904 } 905 } 906 #ifdef SCTP_DEBUG 907 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 908 printf("EP to return is %p\n", inp); 909 } 910 #endif 911 if (have_lock == 0) { 912 if (inp) { 913 SCTP_INP_WLOCK(inp); 914 SCTP_INP_INCR_REF(inp); 915 SCTP_INP_WUNLOCK(inp); 916 } 917 SCTP_INP_INFO_RUNLOCK(); 918 } else { 919 if (inp) { 920 SCTP_INP_WLOCK(inp); 921 SCTP_INP_INCR_REF(inp); 922 SCTP_INP_WUNLOCK(inp); 923 } 924 } 925 return (inp); 926 } 927 928 /* 929 * Find an association for an endpoint with the pointer to whom you want 930 * to send to and the endpoint pointer. The address can be IPv4 or IPv6. 931 * We may need to change the *to to some other struct like a mbuf... 932 */ 933 struct sctp_tcb * 934 sctp_findassociation_addr_sa(struct sockaddr *to, struct sockaddr *from, 935 struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool) 936 { 937 struct sctp_inpcb *inp; 938 struct sctp_tcb *retval; 939 940 SCTP_INP_INFO_RLOCK(); 941 if (find_tcp_pool) { 942 if (inp_p != NULL) { 943 retval = sctp_tcb_special_locate(inp_p, from, to, netp); 944 } else { 945 retval = sctp_tcb_special_locate(&inp, from, to, netp); 946 } 947 if (retval != NULL) { 948 SCTP_INP_INFO_RUNLOCK(); 949 return (retval); 950 } 951 } 952 inp = sctp_pcb_findep(to, 0, 1); 953 if (inp_p != NULL) { 954 *inp_p = inp; 955 } 956 SCTP_INP_INFO_RUNLOCK(); 957 958 if (inp == NULL) { 959 return (NULL); 960 } 961 962 /* 963 * ok, we have an endpoint, now lets find the assoc for it (if any) 964 * we now place the source address or from in the to of the find 965 * endpoint call. Since in reality this chain is used from the 966 * inbound packet side. 967 */ 968 if (inp_p != NULL) { 969 return (sctp_findassociation_ep_addr(inp_p, from, netp, to, NULL)); 970 } else { 971 return (sctp_findassociation_ep_addr(&inp, from, netp, to, NULL)); 972 } 973 } 974 975 976 /* 977 * This routine will grub through the mbuf that is a INIT or INIT-ACK and 978 * find all addresses that the sender has specified in any address list. 979 * Each address will be used to lookup the TCB and see if one exits. 980 */ 981 static struct sctp_tcb * 982 sctp_findassociation_special_addr(struct mbuf *m, int iphlen, int offset, 983 struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp, 984 struct sockaddr *dest) 985 { 986 struct sockaddr_in sin4; 987 struct sockaddr_in6 sin6; 988 struct sctp_paramhdr *phdr, parm_buf; 989 struct sctp_tcb *retval; 990 u_int32_t ptype, plen; 991 992 memset(&sin4, 0, sizeof(sin4)); 993 memset(&sin6, 0, sizeof(sin6)); 994 sin4.sin_len = sizeof(sin4); 995 sin4.sin_family = AF_INET; 996 sin4.sin_port = sh->src_port; 997 sin6.sin6_len = sizeof(sin6); 998 sin6.sin6_family = AF_INET6; 999 sin6.sin6_port = sh->src_port; 1000 1001 retval = NULL; 1002 offset += sizeof(struct sctp_init_chunk); 1003 1004 phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf)); 1005 while (phdr != NULL) { 1006 /* now we must see if we want the parameter */ 1007 ptype = ntohs(phdr->param_type); 1008 plen = ntohs(phdr->param_length); 1009 if (plen == 0) { 1010 #ifdef SCTP_DEBUG 1011 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1012 printf("sctp_findassociation_special_addr: Impossible length in parameter\n"); 1013 } 1014 #endif /* SCTP_DEBUG */ 1015 break; 1016 } 1017 if (ptype == SCTP_IPV4_ADDRESS && 1018 plen == sizeof(struct sctp_ipv4addr_param)) { 1019 /* Get the rest of the address */ 1020 struct sctp_ipv4addr_param ip4_parm, *p4; 1021 1022 phdr = sctp_get_next_param(m, offset, 1023 (struct sctp_paramhdr *)&ip4_parm, plen); 1024 if (phdr == NULL) { 1025 return (NULL); 1026 } 1027 p4 = (struct sctp_ipv4addr_param *)phdr; 1028 memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr)); 1029 /* look it up */ 1030 retval = sctp_findassociation_ep_addr(inp_p, 1031 (struct sockaddr *)&sin4, netp, dest, NULL); 1032 if (retval != NULL) { 1033 return (retval); 1034 } 1035 } else if (ptype == SCTP_IPV6_ADDRESS && 1036 plen == sizeof(struct sctp_ipv6addr_param)) { 1037 /* Get the rest of the address */ 1038 struct sctp_ipv6addr_param ip6_parm, *p6; 1039 1040 phdr = sctp_get_next_param(m, offset, 1041 (struct sctp_paramhdr *)&ip6_parm, plen); 1042 if (phdr == NULL) { 1043 return (NULL); 1044 } 1045 p6 = (struct sctp_ipv6addr_param *)phdr; 1046 memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr)); 1047 /* look it up */ 1048 retval = sctp_findassociation_ep_addr(inp_p, 1049 (struct sockaddr *)&sin6, netp, dest, NULL); 1050 if (retval != NULL) { 1051 return (retval); 1052 } 1053 } 1054 offset += SCTP_SIZE32(plen); 1055 phdr = sctp_get_next_param(m, offset, &parm_buf, 1056 sizeof(parm_buf)); 1057 } 1058 return (NULL); 1059 } 1060 1061 static struct sctp_tcb * 1062 sctp_findassoc_by_vtag(struct sockaddr *from, uint32_t vtag, 1063 struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport, 1064 uint16_t lport) 1065 { 1066 /* 1067 * Use my vtag to hash. If we find it we then verify the source addr 1068 * is in the assoc. If all goes well we save a bit on rec of a packet. 1069 */ 1070 struct sctpasochead *head; 1071 struct sctp_nets *net; 1072 struct sctp_tcb *stcb; 1073 1074 SCTP_INP_INFO_RLOCK(); 1075 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag, 1076 sctppcbinfo.hashasocmark)]; 1077 if (head == NULL) { 1078 /* invalid vtag */ 1079 SCTP_INP_INFO_RUNLOCK(); 1080 return (NULL); 1081 } 1082 LIST_FOREACH(stcb, head, sctp_asocs) { 1083 SCTP_INP_RLOCK(stcb->sctp_ep); 1084 SCTP_TCB_LOCK(stcb); 1085 SCTP_INP_RUNLOCK(stcb->sctp_ep); 1086 if (stcb->asoc.my_vtag == vtag) { 1087 /* candidate */ 1088 if (stcb->rport != rport) { 1089 /* 1090 * we could remove this if vtags are unique 1091 * across the system. 1092 */ 1093 SCTP_TCB_UNLOCK(stcb); 1094 continue; 1095 } 1096 if (stcb->sctp_ep->sctp_lport != lport) { 1097 /* 1098 * we could remove this if vtags are unique 1099 * across the system. 1100 */ 1101 SCTP_TCB_UNLOCK(stcb); 1102 continue; 1103 } 1104 net = sctp_findnet(stcb, from); 1105 if (net) { 1106 /* yep its him. */ 1107 *netp = net; 1108 sctp_pegs[SCTP_VTAG_EXPR]++; 1109 *inp_p = stcb->sctp_ep; 1110 SCTP_INP_INFO_RUNLOCK(); 1111 return (stcb); 1112 } else { 1113 /* not him, this should only 1114 * happen in rare cases so 1115 * I peg it. 1116 */ 1117 sctp_pegs[SCTP_VTAG_BOGUS]++; 1118 } 1119 } 1120 SCTP_TCB_UNLOCK(stcb); 1121 } 1122 SCTP_INP_INFO_RUNLOCK(); 1123 return (NULL); 1124 } 1125 1126 /* 1127 * Find an association with the pointer to the inbound IP packet. This 1128 * can be a IPv4 or IPv6 packet. 1129 */ 1130 struct sctp_tcb * 1131 sctp_findassociation_addr(struct mbuf *m, int iphlen, int offset, 1132 struct sctphdr *sh, struct sctp_chunkhdr *ch, 1133 struct sctp_inpcb **inp_p, struct sctp_nets **netp) 1134 { 1135 int find_tcp_pool; 1136 struct ip *iph; 1137 struct sctp_tcb *retval; 1138 struct sockaddr_storage to_store, from_store; 1139 struct sockaddr *to = (struct sockaddr *)&to_store; 1140 struct sockaddr *from = (struct sockaddr *)&from_store; 1141 struct sctp_inpcb *inp; 1142 1143 1144 iph = mtod(m, struct ip *); 1145 if (iph->ip_v == IPVERSION) { 1146 /* its IPv4 */ 1147 struct sockaddr_in *to4, *from4; 1148 1149 to4 = (struct sockaddr_in *)&to_store; 1150 from4 = (struct sockaddr_in *)&from_store; 1151 memset(to4, 0, sizeof(*to4)); 1152 memset(from4, 0, sizeof(*from4)); 1153 from4->sin_family = to4->sin_family = AF_INET; 1154 from4->sin_len = to4->sin_len = sizeof(struct sockaddr_in); 1155 from4->sin_addr.s_addr = iph->ip_src.s_addr; 1156 to4->sin_addr.s_addr = iph->ip_dst.s_addr ; 1157 from4->sin_port = sh->src_port; 1158 to4->sin_port = sh->dest_port; 1159 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1160 /* its IPv6 */ 1161 struct ip6_hdr *ip6; 1162 struct sockaddr_in6 *to6, *from6; 1163 1164 ip6 = mtod(m, struct ip6_hdr *); 1165 to6 = (struct sockaddr_in6 *)&to_store; 1166 from6 = (struct sockaddr_in6 *)&from_store; 1167 memset(to6, 0, sizeof(*to6)); 1168 memset(from6, 0, sizeof(*from6)); 1169 from6->sin6_family = to6->sin6_family = AF_INET6; 1170 from6->sin6_len = to6->sin6_len = sizeof(struct sockaddr_in6); 1171 from6->sin6_addr = ip6->ip6_src; 1172 to6->sin6_addr = ip6->ip6_dst; 1173 from6->sin6_port = sh->src_port; 1174 to6->sin6_port = sh->dest_port; 1175 /* Get the scopes in properly to the sin6 addr's */ 1176 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) 1177 /* We probably don't need this operation (jinmei@kame) */ 1178 (void)in6_recoverscope(to6, &to6->sin6_addr, NULL); 1179 (void)in6_embedscope(&to6->sin6_addr, to6, NULL, NULL); 1180 1181 (void)in6_recoverscope(from6, &from6->sin6_addr, NULL); 1182 (void)in6_embedscope(&from6->sin6_addr, from6, NULL, NULL); 1183 #endif 1184 } else { 1185 /* Currently not supported. */ 1186 return (NULL); 1187 } 1188 #ifdef SCTP_DEBUG 1189 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1190 printf("Looking for port %d address :", 1191 ntohs(((struct sockaddr_in *)to)->sin_port)); 1192 sctp_print_address(to); 1193 printf("From for port %d address :", 1194 ntohs(((struct sockaddr_in *)from)->sin_port)); 1195 sctp_print_address(from); 1196 } 1197 #endif 1198 1199 if (sh->v_tag) { 1200 /* we only go down this path if vtag is non-zero */ 1201 retval = sctp_findassoc_by_vtag(from, ntohl(sh->v_tag), 1202 inp_p, netp, sh->src_port, sh->dest_port); 1203 if (retval) { 1204 return (retval); 1205 } 1206 } 1207 find_tcp_pool = 0; 1208 if ((ch->chunk_type != SCTP_INITIATION) && 1209 (ch->chunk_type != SCTP_INITIATION_ACK) && 1210 (ch->chunk_type != SCTP_COOKIE_ACK) && 1211 (ch->chunk_type != SCTP_COOKIE_ECHO)) { 1212 /* Other chunk types go to the tcp pool. */ 1213 find_tcp_pool = 1; 1214 } 1215 if (inp_p) { 1216 retval = sctp_findassociation_addr_sa(to, from, inp_p, netp, 1217 find_tcp_pool); 1218 inp = *inp_p; 1219 } else { 1220 retval = sctp_findassociation_addr_sa(to, from, &inp, netp, 1221 find_tcp_pool); 1222 } 1223 #ifdef SCTP_DEBUG 1224 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1225 printf("retval:%p inp:%p\n", retval, inp); 1226 } 1227 #endif 1228 if (retval == NULL && inp) { 1229 /* Found a EP but not this address */ 1230 #ifdef SCTP_DEBUG 1231 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1232 printf("Found endpoint %p but no asoc - ep state:%x\n", 1233 inp, inp->sctp_flags); 1234 } 1235 #endif 1236 if ((ch->chunk_type == SCTP_INITIATION) || 1237 (ch->chunk_type == SCTP_INITIATION_ACK)) { 1238 /* 1239 * special hook, we do NOT return linp or an 1240 * association that is linked to an existing 1241 * association that is under the TCP pool (i.e. no 1242 * listener exists). The endpoint finding routine 1243 * will always find a listner before examining the 1244 * TCP pool. 1245 */ 1246 if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) { 1247 #ifdef SCTP_DEBUG 1248 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1249 printf("Gak, its in the TCP pool... return NULL"); 1250 } 1251 #endif 1252 if (inp_p) { 1253 *inp_p = NULL; 1254 } 1255 return (NULL); 1256 } 1257 #ifdef SCTP_DEBUG 1258 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1259 printf("Now doing SPECIAL find\n"); 1260 } 1261 #endif 1262 retval = sctp_findassociation_special_addr(m, iphlen, 1263 offset, sh, inp_p, netp, to); 1264 } 1265 } 1266 #ifdef SCTP_DEBUG 1267 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1268 printf("retval is %p\n", retval); 1269 } 1270 #endif 1271 return (retval); 1272 } 1273 1274 extern int sctp_max_burst_default; 1275 1276 extern unsigned int sctp_delayed_sack_time_default; 1277 extern unsigned int sctp_heartbeat_interval_default; 1278 extern unsigned int sctp_pmtu_raise_time_default; 1279 extern unsigned int sctp_shutdown_guard_time_default; 1280 extern unsigned int sctp_secret_lifetime_default; 1281 1282 extern unsigned int sctp_rto_max_default; 1283 extern unsigned int sctp_rto_min_default; 1284 extern unsigned int sctp_rto_initial_default; 1285 extern unsigned int sctp_init_rto_max_default; 1286 extern unsigned int sctp_valid_cookie_life_default; 1287 extern unsigned int sctp_init_rtx_max_default; 1288 extern unsigned int sctp_assoc_rtx_max_default; 1289 extern unsigned int sctp_path_rtx_max_default; 1290 extern unsigned int sctp_nr_outgoing_streams_default; 1291 1292 /* 1293 * allocate a sctp_inpcb and setup a temporary binding to a port/all 1294 * addresses. This way if we don't get a bind we by default pick a ephemeral 1295 * port with all addresses bound. 1296 */ 1297 int 1298 sctp_inpcb_alloc(struct socket *so) 1299 { 1300 /* 1301 * we get called when a new endpoint starts up. We need to allocate 1302 * the sctp_inpcb structure from the zone and init it. Mark it as 1303 * unbound and find a port that we can use as an ephemeral with 1304 * INADDR_ANY. If the user binds later no problem we can then add 1305 * in the specific addresses. And setup the default parameters for 1306 * the EP. 1307 */ 1308 int i, error; 1309 struct sctp_inpcb *inp, *n_inp; 1310 struct sctp_pcb *m; 1311 struct timeval time; 1312 1313 error = 0; 1314 1315 /* Hack alert: 1316 * 1317 * This code audits the entire INP list to see if 1318 * any ep's that are in the GONE state are now 1319 * all free. This should not happen really since when 1320 * the last association if freed we should end up deleting 1321 * the inpcb. This code including the locks should 1322 * be taken out ... since the last set of fixes I 1323 * have not seen the "Found a GONE on list" has not 1324 * came out. But i am paranoid and we will leave this 1325 * in at the cost of efficency on allocation of PCB's. 1326 * Probably we should move this to the invariant 1327 * compile options 1328 */ 1329 /* #ifdef INVARIANTS*/ 1330 SCTP_INP_INFO_RLOCK(); 1331 inp = LIST_FIRST(&sctppcbinfo.listhead); 1332 while (inp) { 1333 n_inp = LIST_NEXT(inp, sctp_list); 1334 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 1335 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) { 1336 /* finish the job now */ 1337 printf("Found a GONE on list\n"); 1338 SCTP_INP_INFO_RUNLOCK(); 1339 sctp_inpcb_free(inp, 1); 1340 SCTP_INP_INFO_RLOCK(); 1341 } 1342 } 1343 inp = n_inp; 1344 } 1345 SCTP_INP_INFO_RUNLOCK(); 1346 /* #endif INVARIANTS*/ 1347 1348 SCTP_INP_INFO_WLOCK(); 1349 inp = (struct sctp_inpcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_ep); 1350 if (inp == NULL) { 1351 printf("Out of SCTP-INPCB structures - no resources\n"); 1352 SCTP_INP_INFO_WUNLOCK(); 1353 return (ENOBUFS); 1354 } 1355 1356 /* zap it */ 1357 memset(inp, 0, sizeof(*inp)); 1358 1359 /* bump generations */ 1360 inp->ip_inp.inp.inp_socket = so; 1361 1362 /* setup socket pointers */ 1363 inp->sctp_socket = so; 1364 1365 /* setup inpcb socket too */ 1366 inp->ip_inp.inp.inp_socket = so; 1367 inp->sctp_frag_point = SCTP_DEFAULT_MAXSEGMENT; 1368 #ifdef IPSEC 1369 #if !(defined(__OpenBSD__) || defined(__APPLE__)) 1370 { 1371 struct inpcbpolicy *pcb_sp = NULL; 1372 error = ipsec_init_pcbpolicy(so, &pcb_sp); 1373 /* Arrange to share the policy */ 1374 inp->ip_inp.inp.inp_sp = pcb_sp; 1375 ((struct in6pcb *)(&inp->ip_inp.inp))->in6p_sp = pcb_sp; 1376 } 1377 #else 1378 /* not sure what to do for openbsd here */ 1379 error = 0; 1380 #endif 1381 if (error != 0) { 1382 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1383 SCTP_INP_INFO_WUNLOCK(); 1384 return error; 1385 } 1386 #endif /* IPSEC */ 1387 sctppcbinfo.ipi_count_ep++; 1388 #if defined(__FreeBSD__) || defined(__APPLE__) 1389 inp->ip_inp.inp.inp_gencnt = ++sctppcbinfo.ipi_gencnt_ep; 1390 inp->ip_inp.inp.inp_ip_ttl = ip_defttl; 1391 #else 1392 inp->inp_ip_ttl = ip_defttl; 1393 inp->inp_ip_tos = 0; 1394 #endif 1395 1396 so->so_pcb = (void *)inp; 1397 1398 if ((so->so_type == SOCK_DGRAM) || 1399 (so->so_type == SOCK_SEQPACKET)) { 1400 /* UDP style socket */ 1401 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE | 1402 SCTP_PCB_FLAGS_UNBOUND); 1403 inp->sctp_flags |= (SCTP_PCB_FLAGS_RECVDATAIOEVNT); 1404 /* Be sure it is NON-BLOCKING IO for UDP */ 1405 /*so->so_state |= SS_NBIO;*/ 1406 } else if (so->so_type == SOCK_STREAM) { 1407 /* TCP style socket */ 1408 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 1409 SCTP_PCB_FLAGS_UNBOUND); 1410 inp->sctp_flags |= (SCTP_PCB_FLAGS_RECVDATAIOEVNT); 1411 /* Be sure we have blocking IO bu default */ 1412 so->so_state &= ~SS_NBIO; 1413 } else { 1414 /* 1415 * unsupported socket type (RAW, etc)- in case we missed 1416 * it in protosw 1417 */ 1418 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1419 SCTP_INP_INFO_WUNLOCK(); 1420 return (EOPNOTSUPP); 1421 } 1422 inp->sctp_tcbhash = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_hash); 1423 if (inp->sctp_tcbhash == NULL) { 1424 printf("Out of SCTP-INPCB->hashinit - no resources\n"); 1425 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1426 SCTP_INP_INFO_WUNLOCK(); 1427 return (ENOBUFS); 1428 } else { 1429 for (i = 0; i < sctp_pcbtblsize; i++) 1430 LIST_INIT(&inp->sctp_tcbhash[i]); 1431 for (i = 1; i < sctp_pcbtblsize; i <<= 1) 1432 continue; 1433 inp->sctp_hashmark = i - 1; 1434 } 1435 /* LOCK init's */ 1436 SCTP_INP_LOCK_INIT(inp); 1437 SCTP_ASOC_CREATE_LOCK_INIT(inp); 1438 /* lock the new ep */ 1439 SCTP_INP_WLOCK(inp); 1440 1441 /* add it to the info area */ 1442 LIST_INSERT_HEAD(&sctppcbinfo.listhead, inp, sctp_list); 1443 SCTP_INP_INFO_WUNLOCK(); 1444 1445 LIST_INIT(&inp->sctp_addr_list); 1446 LIST_INIT(&inp->sctp_asoc_list); 1447 TAILQ_INIT(&inp->sctp_queue_list); 1448 /* Init the timer structure for signature change */ 1449 callout_init(&inp->sctp_ep.signature_change.timer, 0); 1450 inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE; 1451 1452 /* now init the actual endpoint default data */ 1453 m = &inp->sctp_ep; 1454 1455 /* setup the base timeout information */ 1456 m->sctp_timeoutticks[SCTP_TIMER_SEND] = SEC_TO_TICKS(SCTP_SEND_SEC); /* needed ? */ 1457 m->sctp_timeoutticks[SCTP_TIMER_INIT] = SEC_TO_TICKS(SCTP_INIT_SEC); /* needed ? */ 1458 m->sctp_timeoutticks[SCTP_TIMER_RECV] = MSEC_TO_TICKS(sctp_delayed_sack_time_default); 1459 m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = sctp_heartbeat_interval_default; /* this is in MSEC */ 1460 m->sctp_timeoutticks[SCTP_TIMER_PMTU] = SEC_TO_TICKS(sctp_pmtu_raise_time_default); 1461 m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = SEC_TO_TICKS(sctp_shutdown_guard_time_default); 1462 m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = SEC_TO_TICKS(sctp_secret_lifetime_default); 1463 /* all max/min max are in ms */ 1464 m->sctp_maxrto = sctp_rto_max_default; 1465 m->sctp_minrto = sctp_rto_min_default; 1466 m->initial_rto = sctp_rto_initial_default; 1467 m->initial_init_rto_max = sctp_init_rto_max_default; 1468 1469 m->max_open_streams_intome = MAX_SCTP_STREAMS; 1470 1471 m->max_init_times = sctp_init_rtx_max_default; 1472 m->max_send_times = sctp_assoc_rtx_max_default; 1473 m->def_net_failure = sctp_path_rtx_max_default; 1474 m->sctp_sws_sender = SCTP_SWS_SENDER_DEF; 1475 m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF; 1476 m->max_burst = sctp_max_burst_default; 1477 /* number of streams to pre-open on a association */ 1478 m->pre_open_stream_count = sctp_nr_outgoing_streams_default; 1479 1480 /* Add adaption cookie */ 1481 m->adaption_layer_indicator = 0x504C5253; 1482 1483 /* seed random number generator */ 1484 m->random_counter = 1; 1485 m->store_at = SCTP_SIGNATURE_SIZE; 1486 #if defined(__FreeBSD__) && (__FreeBSD_version < 500000) 1487 read_random_unlimited(m->random_numbers, sizeof(m->random_numbers)); 1488 #elif defined(__APPLE__) || (__FreeBSD_version > 500000) 1489 read_random(m->random_numbers, sizeof(m->random_numbers)); 1490 #elif defined(__OpenBSD__) 1491 get_random_bytes(m->random_numbers, sizeof(m->random_numbers)); 1492 #elif defined(__NetBSD__) && NRND > 0 1493 rnd_extract_data(m->random_numbers, sizeof(m->random_numbers), 1494 RND_EXTRACT_ANY); 1495 #else 1496 { 1497 u_int32_t *ranm, *ranp; 1498 ranp = (u_int32_t *)&m->random_numbers; 1499 ranm = ranp + (SCTP_SIGNATURE_ALOC_SIZE/sizeof(u_int32_t)); 1500 if ((u_long)ranp % 4) { 1501 /* not a even boundary? */ 1502 ranp = (u_int32_t *)SCTP_SIZE32((u_long)ranp); 1503 } 1504 while (ranp < ranm) { 1505 *ranp = random(); 1506 ranp++; 1507 } 1508 } 1509 #endif 1510 sctp_fill_random_store(m); 1511 1512 /* Minimum cookie size */ 1513 m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) + 1514 sizeof(struct sctp_state_cookie); 1515 m->size_of_a_cookie += SCTP_SIGNATURE_SIZE; 1516 1517 /* Setup the initial secret */ 1518 SCTP_GETTIME_TIMEVAL(&time); 1519 m->time_of_secret_change = time.tv_sec; 1520 1521 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) { 1522 m->secret_key[0][i] = sctp_select_initial_TSN(m); 1523 } 1524 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL); 1525 1526 /* How long is a cookie good for ? */ 1527 m->def_cookie_life = sctp_valid_cookie_life_default; 1528 SCTP_INP_WUNLOCK(inp); 1529 return (error); 1530 } 1531 1532 1533 void 1534 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp, 1535 struct sctp_tcb *stcb) 1536 { 1537 uint16_t lport, rport; 1538 struct sctppcbhead *head; 1539 struct sctp_laddr *laddr, *oladdr; 1540 1541 SCTP_TCB_UNLOCK(stcb); 1542 SCTP_INP_INFO_WLOCK(); 1543 SCTP_INP_WLOCK(old_inp); 1544 SCTP_INP_WLOCK(new_inp); 1545 SCTP_TCB_LOCK(stcb); 1546 1547 new_inp->sctp_ep.time_of_secret_change = 1548 old_inp->sctp_ep.time_of_secret_change; 1549 memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key, 1550 sizeof(old_inp->sctp_ep.secret_key)); 1551 new_inp->sctp_ep.current_secret_number = 1552 old_inp->sctp_ep.current_secret_number; 1553 new_inp->sctp_ep.last_secret_number = 1554 old_inp->sctp_ep.last_secret_number; 1555 new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie; 1556 1557 /* Copy the port across */ 1558 lport = new_inp->sctp_lport = old_inp->sctp_lport; 1559 rport = stcb->rport; 1560 /* Pull the tcb from the old association */ 1561 LIST_REMOVE(stcb, sctp_tcbhash); 1562 LIST_REMOVE(stcb, sctp_tcblist); 1563 1564 /* Now insert the new_inp into the TCP connected hash */ 1565 head = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR((lport + rport), 1566 sctppcbinfo.hashtcpmark)]; 1567 1568 LIST_INSERT_HEAD(head, new_inp, sctp_hash); 1569 1570 /* Now move the tcb into the endpoint list */ 1571 LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist); 1572 /* 1573 * Question, do we even need to worry about the ep-hash since 1574 * we only have one connection? Probably not :> so lets 1575 * get rid of it and not suck up any kernel memory in that. 1576 */ 1577 SCTP_INP_INFO_WUNLOCK(); 1578 stcb->sctp_socket = new_inp->sctp_socket; 1579 stcb->sctp_ep = new_inp; 1580 if (new_inp->sctp_tcbhash != NULL) { 1581 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_hash, 1582 new_inp->sctp_tcbhash); 1583 new_inp->sctp_tcbhash = NULL; 1584 } 1585 if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 1586 /* Subset bound, so copy in the laddr list from the old_inp */ 1587 LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) { 1588 laddr = (struct sctp_laddr *)SCTP_ZONE_GET( 1589 sctppcbinfo.ipi_zone_laddr); 1590 if (laddr == NULL) { 1591 /* 1592 * Gak, what can we do? This assoc is really 1593 * HOSED. We probably should send an abort 1594 * here. 1595 */ 1596 #ifdef SCTP_DEBUG 1597 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1598 printf("Association hosed in TCP model, out of laddr memory\n"); 1599 } 1600 #endif /* SCTP_DEBUG */ 1601 continue; 1602 } 1603 sctppcbinfo.ipi_count_laddr++; 1604 sctppcbinfo.ipi_gencnt_laddr++; 1605 memset(laddr, 0, sizeof(*laddr)); 1606 laddr->ifa = oladdr->ifa; 1607 LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr, 1608 sctp_nxt_addr); 1609 new_inp->laddr_count++; 1610 } 1611 } 1612 SCTP_INP_WUNLOCK(new_inp); 1613 SCTP_INP_WUNLOCK(old_inp); 1614 } 1615 1616 static int 1617 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport) 1618 { 1619 struct sctppcbhead *head; 1620 struct sctp_inpcb *t_inp; 1621 1622 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 1623 sctppcbinfo.hashmark)]; 1624 LIST_FOREACH(t_inp, head, sctp_hash) { 1625 if (t_inp->sctp_lport != lport) { 1626 continue; 1627 } 1628 /* This one is in use. */ 1629 /* check the v6/v4 binding issue */ 1630 if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 1631 #if defined(__FreeBSD__) 1632 (((struct inpcb *)t_inp)->inp_flags & IN6P_IPV6_V6ONLY) 1633 #else 1634 #if defined(__OpenBSD__) 1635 (0) /* For open bsd we do dual bind only */ 1636 #else 1637 (((struct in6pcb *)t_inp)->in6p_flags & IN6P_IPV6_V6ONLY) 1638 #endif 1639 #endif 1640 ) { 1641 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 1642 /* collision in V6 space */ 1643 return (1); 1644 } else { 1645 /* inp is BOUND_V4 no conflict */ 1646 continue; 1647 } 1648 } else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 1649 /* t_inp is bound v4 and v6, conflict always */ 1650 return (1); 1651 } else { 1652 /* t_inp is bound only V4 */ 1653 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 1654 #if defined(__FreeBSD__) 1655 (((struct inpcb *)inp)->inp_flags & IN6P_IPV6_V6ONLY) 1656 #else 1657 #if defined(__OpenBSD__) 1658 (0) /* For open bsd we do dual bind only */ 1659 #else 1660 (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY) 1661 #endif 1662 #endif 1663 ) { 1664 /* no conflict */ 1665 continue; 1666 } 1667 /* else fall through to conflict */ 1668 } 1669 return (1); 1670 } 1671 return (0); 1672 } 1673 1674 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 1675 /* 1676 * Don't know why, but without this there is an unknown reference when 1677 * compiling NetBSD... hmm 1678 */ 1679 extern void in6_sin6_2_sin (struct sockaddr_in *, struct sockaddr_in6 *sin6); 1680 #endif 1681 1682 1683 int 1684 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct lwp *l) 1685 { 1686 /* bind a ep to a socket address */ 1687 struct sctppcbhead *head; 1688 struct sctp_inpcb *inp, *inp_tmp; 1689 int bindall; 1690 uint16_t lport; 1691 int error; 1692 1693 lport = 0; 1694 error = 0; 1695 bindall = 1; 1696 inp = (struct sctp_inpcb *)so->so_pcb; 1697 #ifdef SCTP_DEBUG 1698 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1699 if (addr) { 1700 printf("Bind called port:%d\n", 1701 ntohs(((struct sockaddr_in *)addr)->sin_port)); 1702 printf("Addr :"); 1703 sctp_print_address(addr); 1704 } 1705 } 1706 #endif /* SCTP_DEBUG */ 1707 if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) { 1708 /* already did a bind, subsequent binds NOT allowed ! */ 1709 return (EINVAL); 1710 } 1711 1712 if (addr != NULL) { 1713 if (addr->sa_family == AF_INET) { 1714 struct sockaddr_in *sin; 1715 1716 /* IPV6_V6ONLY socket? */ 1717 if (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY) { 1718 return (EINVAL); 1719 } 1720 1721 if (addr->sa_len != sizeof(*sin)) 1722 return (EINVAL); 1723 1724 sin = (struct sockaddr_in *)addr; 1725 lport = sin->sin_port; 1726 1727 if (sin->sin_addr.s_addr != INADDR_ANY) { 1728 bindall = 0; 1729 } 1730 } else if (addr->sa_family == AF_INET6) { 1731 /* Only for pure IPv6 Address. (No IPv4 Mapped!) */ 1732 struct sockaddr_in6 *sin6; 1733 1734 sin6 = (struct sockaddr_in6 *)addr; 1735 1736 if (addr->sa_len != sizeof(*sin6)) 1737 return (EINVAL); 1738 1739 lport = sin6->sin6_port; 1740 if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1741 bindall = 0; 1742 /* KAME hack: embed scopeid */ 1743 error = sa6_embedscope(sin6, ip6_use_defzone); 1744 if (error != 0) 1745 return (error); 1746 } 1747 #ifndef SCOPEDROUTING 1748 /* this must be cleared for ifa_ifwithaddr() */ 1749 sin6->sin6_scope_id = 0; 1750 #endif /* SCOPEDROUTING */ 1751 } else { 1752 return (EAFNOSUPPORT); 1753 } 1754 } 1755 SCTP_INP_INFO_WLOCK(); 1756 #ifdef SCTP_DEBUG 1757 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1758 printf("sctp_inpcb_bind: after SCTP_INP_INFO_WLOCK\n"); 1759 } 1760 #endif /* SCTP_DEBUG */ 1761 SCTP_INP_WLOCK(inp); 1762 /* increase our count due to the unlock we do */ 1763 SCTP_INP_INCR_REF(inp); 1764 if (lport) { 1765 enum kauth_network_req req; 1766 /* 1767 * Did the caller specify a port? if so we must see if a 1768 * ep already has this one bound. 1769 */ 1770 if (ntohs(lport) < IPPORT_RESERVED) 1771 req = KAUTH_REQ_NETWORK_BIND_PRIVPORT; 1772 else 1773 req = KAUTH_REQ_NETWORK_BIND_PORT; 1774 1775 error = kauth_authorize_network(l->l_cred, KAUTH_NETWORK_BIND, 1776 req, so, addr, NULL); 1777 if (error) { 1778 SCTP_INP_DECR_REF(inp); 1779 SCTP_INP_WUNLOCK(inp); 1780 SCTP_INP_INFO_WUNLOCK(); 1781 return (EACCES); 1782 } 1783 SCTP_INP_WUNLOCK(inp); 1784 inp_tmp = sctp_pcb_findep(addr, 0, 1); 1785 if (inp_tmp != NULL) { 1786 /* lock guy returned and lower count 1787 * note that we are not bound so inp_tmp 1788 * should NEVER be inp. And it is this 1789 * inp (inp_tmp) that gets the reference 1790 * bump, so we must lower it. 1791 */ 1792 SCTP_INP_WLOCK(inp_tmp); 1793 SCTP_INP_DECR_REF(inp_tmp); 1794 SCTP_INP_WUNLOCK(inp_tmp); 1795 1796 /* unlock info */ 1797 SCTP_INP_INFO_WUNLOCK(); 1798 return (EADDRNOTAVAIL); 1799 } 1800 SCTP_INP_WLOCK(inp); 1801 if (bindall) { 1802 /* verify that no lport is not used by a singleton */ 1803 if (sctp_isport_inuse(inp, lport)) { 1804 /* Sorry someone already has this one bound */ 1805 SCTP_INP_DECR_REF(inp); 1806 SCTP_INP_WUNLOCK(inp); 1807 SCTP_INP_INFO_WUNLOCK(); 1808 return (EADDRNOTAVAIL); 1809 } 1810 } 1811 } else { 1812 /* 1813 * get any port but lets make sure no one has any address 1814 * with this port bound 1815 */ 1816 1817 /* 1818 * setup the inp to the top (I could use the union but this 1819 * is just as easy 1820 */ 1821 uint32_t port_guess; 1822 uint16_t port_attempt; 1823 int not_done=1; 1824 1825 while (not_done) { 1826 port_guess = sctp_select_initial_TSN(&inp->sctp_ep); 1827 port_attempt = (port_guess & 0x0000ffff); 1828 if (port_attempt == 0) { 1829 goto next_half; 1830 } 1831 if (port_attempt < IPPORT_RESERVED) { 1832 port_attempt += IPPORT_RESERVED; 1833 } 1834 1835 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1836 /* got a port we can use */ 1837 not_done = 0; 1838 continue; 1839 } 1840 /* try upper half */ 1841 next_half: 1842 port_attempt = ((port_guess >> 16) & 0x0000ffff); 1843 if (port_attempt == 0) { 1844 goto last_try; 1845 } 1846 if (port_attempt < IPPORT_RESERVED) { 1847 port_attempt += IPPORT_RESERVED; 1848 } 1849 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1850 /* got a port we can use */ 1851 not_done = 0; 1852 continue; 1853 } 1854 /* try two half's added together */ 1855 last_try: 1856 port_attempt = (((port_guess >> 16) & 0x0000ffff) + (port_guess & 0x0000ffff)); 1857 if (port_attempt == 0) { 1858 /* get a new random number */ 1859 continue; 1860 } 1861 if (port_attempt < IPPORT_RESERVED) { 1862 port_attempt += IPPORT_RESERVED; 1863 } 1864 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1865 /* got a port we can use */ 1866 not_done = 0; 1867 continue; 1868 } 1869 } 1870 /* we don't get out of the loop until we have a port */ 1871 lport = htons(port_attempt); 1872 } 1873 SCTP_INP_DECR_REF(inp); 1874 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 1875 /* this really should not happen. The guy 1876 * did a non-blocking bind and then did a close 1877 * at the same time. 1878 */ 1879 SCTP_INP_WUNLOCK(inp); 1880 SCTP_INP_INFO_WUNLOCK(); 1881 return (EINVAL); 1882 } 1883 /* ok we look clear to give out this port, so lets setup the binding */ 1884 if (bindall) { 1885 /* binding to all addresses, so just set in the proper flags */ 1886 inp->sctp_flags |= (SCTP_PCB_FLAGS_BOUNDALL | 1887 SCTP_PCB_FLAGS_DO_ASCONF); 1888 /* set the automatic addr changes from kernel flag */ 1889 if (sctp_auto_asconf == 0) { 1890 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF; 1891 } else { 1892 inp->sctp_flags |= SCTP_PCB_FLAGS_AUTO_ASCONF; 1893 } 1894 } else { 1895 /* 1896 * bind specific, make sure flags is off and add a new address 1897 * structure to the sctp_addr_list inside the ep structure. 1898 * 1899 * We will need to allocate one and insert it at the head. 1900 * The socketopt call can just insert new addresses in there 1901 * as well. It will also have to do the embed scope kame hack 1902 * too (before adding). 1903 */ 1904 struct ifaddr *ifa; 1905 struct sockaddr_storage store_sa; 1906 1907 memset(&store_sa, 0, sizeof(store_sa)); 1908 if (addr->sa_family == AF_INET) { 1909 struct sockaddr_in *sin; 1910 1911 sin = (struct sockaddr_in *)&store_sa; 1912 memcpy(sin, addr, sizeof(struct sockaddr_in)); 1913 sin->sin_port = 0; 1914 } else if (addr->sa_family == AF_INET6) { 1915 struct sockaddr_in6 *sin6; 1916 1917 sin6 = (struct sockaddr_in6 *)&store_sa; 1918 memcpy(sin6, addr, sizeof(struct sockaddr_in6)); 1919 sin6->sin6_port = 0; 1920 } 1921 /* 1922 * first find the interface with the bound address 1923 * need to zero out the port to find the address! yuck! 1924 * can't do this earlier since need port for sctp_pcb_findep() 1925 */ 1926 ifa = sctp_find_ifa_by_addr((struct sockaddr *)&store_sa); 1927 if (ifa == NULL) { 1928 /* Can't find an interface with that address */ 1929 SCTP_INP_WUNLOCK(inp); 1930 SCTP_INP_INFO_WUNLOCK(); 1931 return (EADDRNOTAVAIL); 1932 } 1933 if (addr->sa_family == AF_INET6) { 1934 struct in6_ifaddr *ifa6; 1935 ifa6 = (struct in6_ifaddr *)ifa; 1936 /* 1937 * allow binding of deprecated addresses as per 1938 * RFC 2462 and ipng discussion 1939 */ 1940 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 1941 IN6_IFF_ANYCAST | 1942 IN6_IFF_NOTREADY)) { 1943 /* Can't bind a non-existent addr. */ 1944 SCTP_INP_WUNLOCK(inp); 1945 SCTP_INP_INFO_WUNLOCK(); 1946 return (EINVAL); 1947 } 1948 } 1949 /* we're not bound all */ 1950 inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL; 1951 #if 0 /* use sysctl now */ 1952 /* don't allow automatic addr changes from kernel */ 1953 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF; 1954 #endif 1955 /* set the automatic addr changes from kernel flag */ 1956 if (sctp_auto_asconf == 0) { 1957 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF; 1958 } else { 1959 inp->sctp_flags |= SCTP_PCB_FLAGS_AUTO_ASCONF; 1960 } 1961 /* allow bindx() to send ASCONF's for binding changes */ 1962 inp->sctp_flags |= SCTP_PCB_FLAGS_DO_ASCONF; 1963 /* add this address to the endpoint list */ 1964 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa); 1965 if (error != 0) { 1966 SCTP_INP_WUNLOCK(inp); 1967 SCTP_INP_INFO_WUNLOCK(); 1968 return (error); 1969 } 1970 inp->laddr_count++; 1971 } 1972 /* find the bucket */ 1973 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 1974 sctppcbinfo.hashmark)]; 1975 /* put it in the bucket */ 1976 LIST_INSERT_HEAD(head, inp, sctp_hash); 1977 #ifdef SCTP_DEBUG 1978 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1979 printf("Main hash to bind at head:%p, bound port:%d\n", head, ntohs(lport)); 1980 } 1981 #endif 1982 /* set in the port */ 1983 inp->sctp_lport = lport; 1984 1985 /* turn off just the unbound flag */ 1986 inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND; 1987 SCTP_INP_WUNLOCK(inp); 1988 SCTP_INP_INFO_WUNLOCK(); 1989 return (0); 1990 } 1991 1992 1993 static void 1994 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp, struct sctp_inpcb *inp_next) 1995 { 1996 struct sctp_iterator *it; 1997 /* We enter with the only the ITERATOR_LOCK in place and 1998 * A write lock on the inp_info stuff. 1999 */ 2000 2001 /* Go through all iterators, we must do this since 2002 * it is possible that some iterator does NOT have 2003 * the lock, but is waiting for it. And the one that 2004 * had the lock has either moved in the last iteration 2005 * or we just cleared it above. We need to find all 2006 * of those guys. The list of iterators should never 2007 * be very big though. 2008 */ 2009 LIST_FOREACH(it, &sctppcbinfo.iteratorhead, sctp_nxt_itr) { 2010 if (it == inp->inp_starting_point_for_iterator) 2011 /* skip this guy, he's special */ 2012 continue; 2013 if (it->inp == inp) { 2014 /* This is tricky and we DON'T lock the iterator. 2015 * Reason is he's running but waiting for me since 2016 * inp->inp_starting_point_for_iterator has the lock 2017 * on me (the guy above we skipped). This tells us 2018 * its is not running but waiting for inp->inp_starting_point_for_iterator 2019 * to be released by the guy that does have our INP in a lock. 2020 */ 2021 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 2022 it->inp = NULL; 2023 it->stcb = NULL; 2024 } else { 2025 /* set him up to do the next guy not me */ 2026 it->inp = inp_next; 2027 it->stcb = NULL; 2028 } 2029 } 2030 } 2031 it = inp->inp_starting_point_for_iterator; 2032 if (it) { 2033 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 2034 it->inp = NULL; 2035 } else { 2036 it->inp = inp_next; 2037 } 2038 it->stcb = NULL; 2039 } 2040 } 2041 2042 /* release sctp_inpcb unbind the port */ 2043 void 2044 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate) 2045 { 2046 /* 2047 * Here we free a endpoint. We must find it (if it is in the Hash 2048 * table) and remove it from there. Then we must also find it in 2049 * the overall list and remove it from there. After all removals are 2050 * complete then any timer has to be stopped. Then start the actual 2051 * freeing. 2052 * a) Any local lists. 2053 * b) Any associations. 2054 * c) The hash of all associations. 2055 * d) finally the ep itself. 2056 */ 2057 struct sctp_inpcb *inp_save; 2058 struct sctp_tcb *asoc, *nasoc; 2059 struct sctp_laddr *laddr, *nladdr; 2060 struct inpcb *ip_pcb; 2061 struct socket *so; 2062 struct sctp_socket_q_list *sq; 2063 int s, cnt; 2064 2065 s = splsoftnet(); 2066 SCTP_ASOC_CREATE_LOCK(inp); 2067 SCTP_INP_WLOCK(inp); 2068 2069 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 2070 /* been here before */ 2071 splx(s); 2072 printf("Endpoint was all gone (dup free)?\n"); 2073 SCTP_INP_WUNLOCK(inp); 2074 SCTP_ASOC_CREATE_UNLOCK(inp); 2075 return; 2076 } 2077 sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL); 2078 2079 if (inp->control) { 2080 sctp_m_freem(inp->control); 2081 inp->control = NULL; 2082 } 2083 if (inp->pkt) { 2084 sctp_m_freem(inp->pkt); 2085 inp->pkt = NULL; 2086 } 2087 so = inp->sctp_socket; 2088 ip_pcb = &inp->ip_inp.inp; /* we could just cast the main 2089 * pointer here but I will 2090 * be nice :> (i.e. ip_pcb = ep;) 2091 */ 2092 2093 if (immediate == 0) { 2094 int cnt_in_sd; 2095 cnt_in_sd = 0; 2096 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL; 2097 asoc = nasoc) { 2098 nasoc = LIST_NEXT(asoc, sctp_tcblist); 2099 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_WAIT) || 2100 (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 2101 /* Just abandon things in the front states */ 2102 SCTP_TCB_LOCK(asoc); 2103 SCTP_INP_WUNLOCK(inp); 2104 sctp_free_assoc(inp, asoc); 2105 SCTP_INP_WLOCK(inp); 2106 continue; 2107 } else { 2108 asoc->asoc.state |= SCTP_STATE_CLOSED_SOCKET; 2109 } 2110 if ((asoc->asoc.size_on_delivery_queue > 0) || 2111 (asoc->asoc.size_on_reasm_queue > 0) || 2112 (asoc->asoc.size_on_all_streams > 0) || 2113 (so && (so->so_rcv.sb_cc > 0)) 2114 ) { 2115 /* Left with Data unread */ 2116 struct mbuf *op_err; 2117 MGET(op_err, M_DONTWAIT, MT_DATA); 2118 if (op_err) { 2119 /* Fill in the user initiated abort */ 2120 struct sctp_paramhdr *ph; 2121 op_err->m_len = 2122 sizeof(struct sctp_paramhdr); 2123 ph = mtod(op_err, 2124 struct sctp_paramhdr *); 2125 ph->param_type = htons( 2126 SCTP_CAUSE_USER_INITIATED_ABT); 2127 ph->param_length = htons(op_err->m_len); 2128 } 2129 SCTP_TCB_LOCK(asoc); 2130 sctp_send_abort_tcb(asoc, op_err); 2131 2132 SCTP_INP_WUNLOCK(inp); 2133 sctp_free_assoc(inp, asoc); 2134 SCTP_INP_WLOCK(inp); 2135 continue; 2136 } else if (TAILQ_EMPTY(&asoc->asoc.send_queue) && 2137 TAILQ_EMPTY(&asoc->asoc.sent_queue)) { 2138 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_SENT) && 2139 (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 2140 /* there is nothing queued to send, so I send shutdown */ 2141 SCTP_TCB_LOCK(asoc); 2142 sctp_send_shutdown(asoc, asoc->asoc.primary_destination); 2143 asoc->asoc.state = SCTP_STATE_SHUTDOWN_SENT; 2144 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, asoc->sctp_ep, asoc, 2145 asoc->asoc.primary_destination); 2146 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc, 2147 asoc->asoc.primary_destination); 2148 sctp_chunk_output(inp, asoc, 1); 2149 SCTP_TCB_UNLOCK(asoc); 2150 } 2151 } else { 2152 /* mark into shutdown pending */ 2153 asoc->asoc.state |= SCTP_STATE_SHUTDOWN_PENDING; 2154 } 2155 cnt_in_sd++; 2156 } 2157 /* now is there some left in our SHUTDOWN state? */ 2158 if (cnt_in_sd) { 2159 inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_GONE; 2160 splx(s); 2161 SCTP_INP_WUNLOCK(inp); 2162 SCTP_ASOC_CREATE_UNLOCK(inp); 2163 return; 2164 } 2165 } 2166 #if defined(__FreeBSD__) && __FreeBSD_version >= 503000 2167 if (inp->refcount) { 2168 sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL); 2169 SCTP_INP_WUNLOCK(inp); 2170 SCTP_ASOC_CREATE_UNLOCK(inp); 2171 return; 2172 } 2173 #endif 2174 inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE; 2175 2176 rtcache_validate(&ip_pcb->inp_route); 2177 2178 callout_stop(&inp->sctp_ep.signature_change.timer); 2179 callout_destroy(&inp->sctp_ep.signature_change.timer); 2180 2181 if (so) { 2182 /* First take care of socket level things */ 2183 #ifdef IPSEC 2184 ipsec4_delete_pcbpolicy(ip_pcb); 2185 #endif /*IPSEC*/ 2186 so->so_pcb = 0; 2187 sofree(so); 2188 } 2189 2190 if (ip_pcb->inp_options) { 2191 (void)m_free(ip_pcb->inp_options); 2192 ip_pcb->inp_options = 0; 2193 } 2194 rtcache_free(&ip_pcb->inp_route); 2195 if (ip_pcb->inp_moptions) { 2196 ip_freemoptions(ip_pcb->inp_moptions); 2197 ip_pcb->inp_moptions = 0; 2198 } 2199 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 2200 inp->inp_vflag = 0; 2201 #else 2202 ip_pcb->inp_vflag = 0; 2203 #endif 2204 2205 /* Now the sctp_pcb things */ 2206 /* 2207 * free each asoc if it is not already closed/free. we can't use 2208 * the macro here since le_next will get freed as part of the 2209 * sctp_free_assoc() call. 2210 */ 2211 cnt = 0; 2212 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL; 2213 asoc = nasoc) { 2214 nasoc = LIST_NEXT(asoc, sctp_tcblist); 2215 SCTP_TCB_LOCK(asoc); 2216 if (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_COOKIE_WAIT) { 2217 struct mbuf *op_err; 2218 MGET(op_err, M_DONTWAIT, MT_DATA); 2219 if (op_err) { 2220 /* Fill in the user initiated abort */ 2221 struct sctp_paramhdr *ph; 2222 op_err->m_len = sizeof(struct sctp_paramhdr); 2223 ph = mtod(op_err, struct sctp_paramhdr *); 2224 ph->param_type = htons( 2225 SCTP_CAUSE_USER_INITIATED_ABT); 2226 ph->param_length = htons(op_err->m_len); 2227 } 2228 sctp_send_abort_tcb(asoc, op_err); 2229 } 2230 cnt++; 2231 /* 2232 * sctp_free_assoc() will call sctp_inpcb_free(), 2233 * if SCTP_PCB_FLAGS_SOCKET_GONE set. 2234 * So, we clear it before sctp_free_assoc() making sure 2235 * no double sctp_inpcb_free(). 2236 */ 2237 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SOCKET_GONE; 2238 SCTP_INP_WUNLOCK(inp); 2239 sctp_free_assoc(inp, asoc); 2240 SCTP_INP_WLOCK(inp); 2241 } 2242 while ((sq = TAILQ_FIRST(&inp->sctp_queue_list)) != NULL) { 2243 TAILQ_REMOVE(&inp->sctp_queue_list, sq, next_sq); 2244 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_sockq, sq); 2245 sctppcbinfo.ipi_count_sockq--; 2246 sctppcbinfo.ipi_gencnt_sockq++; 2247 } 2248 inp->sctp_socket = 0; 2249 /* Now first we remove ourselves from the overall list of all EP's */ 2250 2251 /* Unlock inp first, need correct order */ 2252 SCTP_INP_WUNLOCK(inp); 2253 /* now iterator lock */ 2254 SCTP_ITERATOR_LOCK(); 2255 /* now info lock */ 2256 SCTP_INP_INFO_WLOCK(); 2257 /* now reget the inp lock */ 2258 SCTP_INP_WLOCK(inp); 2259 2260 inp_save = LIST_NEXT(inp, sctp_list); 2261 LIST_REMOVE(inp, sctp_list); 2262 /* 2263 * Now the question comes as to if this EP was ever bound at all. 2264 * If it was, then we must pull it out of the EP hash list. 2265 */ 2266 if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) != 2267 SCTP_PCB_FLAGS_UNBOUND) { 2268 /* 2269 * ok, this guy has been bound. It's port is somewhere 2270 * in the sctppcbinfo hash table. Remove it! 2271 */ 2272 LIST_REMOVE(inp, sctp_hash); 2273 } 2274 /* fix any iterators only after out of the list */ 2275 sctp_iterator_inp_being_freed(inp, inp_save); 2276 SCTP_ITERATOR_UNLOCK(); 2277 /* 2278 * if we have an address list the following will free the list of 2279 * ifaddr's that are set into this ep. Again macro limitations here, 2280 * since the LIST_FOREACH could be a bad idea. 2281 */ 2282 for ((laddr = LIST_FIRST(&inp->sctp_addr_list)); laddr != NULL; 2283 laddr = nladdr) { 2284 nladdr = LIST_NEXT(laddr, sctp_nxt_addr); 2285 LIST_REMOVE(laddr, sctp_nxt_addr); 2286 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 2287 sctppcbinfo.ipi_gencnt_laddr++; 2288 sctppcbinfo.ipi_count_laddr--; 2289 } 2290 2291 /* Now lets see about freeing the EP hash table. */ 2292 if (inp->sctp_tcbhash != NULL) { 2293 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_hash, inp->sctp_tcbhash); 2294 inp->sctp_tcbhash = NULL; 2295 } 2296 SCTP_INP_WUNLOCK(inp); 2297 SCTP_ASOC_CREATE_UNLOCK(inp); 2298 SCTP_INP_LOCK_DESTROY(inp); 2299 SCTP_ASOC_CREATE_LOCK_DESTROY(inp); 2300 2301 /* Now we must put the ep memory back into the zone pool */ 2302 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 2303 sctppcbinfo.ipi_count_ep--; 2304 2305 SCTP_INP_INFO_WUNLOCK(); 2306 splx(s); 2307 } 2308 2309 2310 struct sctp_nets * 2311 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr) 2312 { 2313 struct sctp_nets *net; 2314 2315 /* use the peer's/remote port for lookup if unspecified */ 2316 #if 0 /* why do we need to check the port for a nets list on an assoc? */ 2317 if (stcb->rport != sin->sin_port) { 2318 /* we cheat and just a sin for this test */ 2319 return (NULL); 2320 } 2321 #endif 2322 /* locate the address */ 2323 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 2324 if (sctp_cmpaddr(addr, rtcache_getdst(&net->ro))) 2325 return (net); 2326 } 2327 return (NULL); 2328 } 2329 2330 2331 /* 2332 * add's a remote endpoint address, done with the INIT/INIT-ACK 2333 * as well as when a ASCONF arrives that adds it. It will also 2334 * initialize all the cwnd stats of stuff. 2335 */ 2336 int 2337 sctp_is_address_on_local_host(struct sockaddr *addr) 2338 { 2339 struct ifnet *ifn; 2340 struct ifaddr *ifa; 2341 int s; 2342 2343 s = pserialize_read_enter(); 2344 IFNET_READER_FOREACH(ifn) { 2345 IFADDR_READER_FOREACH(ifa, ifn) { 2346 if (addr->sa_family == ifa->ifa_addr->sa_family) { 2347 /* same family */ 2348 if (addr->sa_family == AF_INET) { 2349 struct sockaddr_in *sin, *sin_c; 2350 sin = (struct sockaddr_in *)addr; 2351 sin_c = (struct sockaddr_in *) 2352 ifa->ifa_addr; 2353 if (sin->sin_addr.s_addr == 2354 sin_c->sin_addr.s_addr) { 2355 /* we are on the same machine */ 2356 pserialize_read_exit(s); 2357 return (1); 2358 } 2359 } else if (addr->sa_family == AF_INET6) { 2360 struct sockaddr_in6 *sin6, *sin_c6; 2361 sin6 = (struct sockaddr_in6 *)addr; 2362 sin_c6 = (struct sockaddr_in6 *) 2363 ifa->ifa_addr; 2364 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 2365 &sin_c6->sin6_addr)) { 2366 /* we are on the same machine */ 2367 pserialize_read_exit(s); 2368 return (1); 2369 } 2370 } 2371 } 2372 } 2373 } 2374 pserialize_read_exit(s); 2375 2376 return (0); 2377 } 2378 2379 int 2380 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr, 2381 int set_scope, int from) 2382 { 2383 /* 2384 * The following is redundant to the same lines in the 2385 * sctp_aloc_assoc() but is needed since other's call the add 2386 * address function 2387 */ 2388 struct sctp_nets *net, *netfirst; 2389 struct rtentry *rt, *netfirst_rt; 2390 int addr_inscope; 2391 2392 #ifdef SCTP_DEBUG 2393 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 2394 printf("Adding an address (from:%d) to the peer: ", from); 2395 sctp_print_address(newaddr); 2396 } 2397 #endif 2398 netfirst = sctp_findnet(stcb, newaddr); 2399 if (netfirst) { 2400 /* 2401 * Lie and return ok, we don't want to make the association 2402 * go away for this behavior. It will happen in the TCP model 2403 * in a connected socket. It does not reach the hash table 2404 * until after the association is built so it can't be found. 2405 * Mark as reachable, since the initial creation will have 2406 * been cleared and the NOT_IN_ASSOC flag will have been 2407 * added... and we don't want to end up removing it back out. 2408 */ 2409 if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) { 2410 netfirst->dest_state = (SCTP_ADDR_REACHABLE| 2411 SCTP_ADDR_UNCONFIRMED); 2412 } else { 2413 netfirst->dest_state = SCTP_ADDR_REACHABLE; 2414 } 2415 2416 return (0); 2417 } 2418 addr_inscope = 1; 2419 if (newaddr->sa_family == AF_INET) { 2420 struct sockaddr_in *sin; 2421 sin = (struct sockaddr_in *)newaddr; 2422 if (sin->sin_addr.s_addr == 0) { 2423 /* Invalid address */ 2424 return (-1); 2425 } 2426 /* zero out the bzero area */ 2427 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero)); 2428 2429 /* assure len is set */ 2430 sin->sin_len = sizeof(struct sockaddr_in); 2431 if (set_scope) { 2432 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE 2433 stcb->ipv4_local_scope = 1; 2434 #else 2435 if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) { 2436 stcb->asoc.ipv4_local_scope = 1; 2437 } 2438 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */ 2439 2440 if (sctp_is_address_on_local_host(newaddr)) { 2441 stcb->asoc.loopback_scope = 1; 2442 stcb->asoc.ipv4_local_scope = 1; 2443 stcb->asoc.local_scope = 1; 2444 stcb->asoc.site_scope = 1; 2445 } 2446 } else { 2447 if (from == 8) { 2448 /* From connectx */ 2449 if (sctp_is_address_on_local_host(newaddr)) { 2450 stcb->asoc.loopback_scope = 1; 2451 stcb->asoc.ipv4_local_scope = 1; 2452 stcb->asoc.local_scope = 1; 2453 stcb->asoc.site_scope = 1; 2454 } 2455 } 2456 /* Validate the address is in scope */ 2457 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) && 2458 (stcb->asoc.ipv4_local_scope == 0)) { 2459 addr_inscope = 0; 2460 } 2461 } 2462 } else if (newaddr->sa_family == AF_INET6) { 2463 struct sockaddr_in6 *sin6; 2464 sin6 = (struct sockaddr_in6 *)newaddr; 2465 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 2466 /* Invalid address */ 2467 return (-1); 2468 } 2469 /* assure len is set */ 2470 sin6->sin6_len = sizeof(struct sockaddr_in6); 2471 if (set_scope) { 2472 if (sctp_is_address_on_local_host(newaddr)) { 2473 stcb->asoc.loopback_scope = 1; 2474 stcb->asoc.local_scope = 1; 2475 stcb->asoc.ipv4_local_scope = 1; 2476 stcb->asoc.site_scope = 1; 2477 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 2478 /* 2479 * If the new destination is a LINK_LOCAL 2480 * we must have common site scope. Don't set 2481 * the local scope since we may not share all 2482 * links, only loopback can do this. 2483 * Links on the local network would also 2484 * be on our private network for v4 too. 2485 */ 2486 stcb->asoc.ipv4_local_scope = 1; 2487 stcb->asoc.site_scope = 1; 2488 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) { 2489 /* 2490 * If the new destination is SITE_LOCAL 2491 * then we must have site scope in common. 2492 */ 2493 stcb->asoc.site_scope = 1; 2494 } 2495 } else { 2496 if (from == 8) { 2497 /* From connectx */ 2498 if (sctp_is_address_on_local_host(newaddr)) { 2499 stcb->asoc.loopback_scope = 1; 2500 stcb->asoc.ipv4_local_scope = 1; 2501 stcb->asoc.local_scope = 1; 2502 stcb->asoc.site_scope = 1; 2503 } 2504 } 2505 /* Validate the address is in scope */ 2506 if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) && 2507 (stcb->asoc.loopback_scope == 0)) { 2508 addr_inscope = 0; 2509 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) && 2510 (stcb->asoc.local_scope == 0)) { 2511 addr_inscope = 0; 2512 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) && 2513 (stcb->asoc.site_scope == 0)) { 2514 addr_inscope = 0; 2515 } 2516 } 2517 } else { 2518 /* not supported family type */ 2519 return (-1); 2520 } 2521 net = (struct sctp_nets *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_net); 2522 if (net == NULL) { 2523 return (-1); 2524 } 2525 sctppcbinfo.ipi_count_raddr++; 2526 sctppcbinfo.ipi_gencnt_raddr++; 2527 memset(net, 0, sizeof(*net)); 2528 if (newaddr->sa_family == AF_INET) { 2529 ((struct sockaddr_in *)newaddr)->sin_port = stcb->rport; 2530 } else if (newaddr->sa_family == AF_INET6) { 2531 ((struct sockaddr_in6 *)newaddr)->sin6_port = stcb->rport; 2532 } 2533 net->addr_is_local = sctp_is_address_on_local_host(newaddr); 2534 net->failure_threshold = stcb->asoc.def_net_failure; 2535 if (addr_inscope == 0) { 2536 #ifdef SCTP_DEBUG 2537 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 2538 printf("Adding an address which is OUT OF SCOPE\n"); 2539 } 2540 #endif /* SCTP_DEBUG */ 2541 net->dest_state = (SCTP_ADDR_REACHABLE | 2542 SCTP_ADDR_OUT_OF_SCOPE); 2543 } else { 2544 if (from == 8) 2545 /* 8 is passed by connect_x */ 2546 net->dest_state = SCTP_ADDR_REACHABLE; 2547 else 2548 net->dest_state = SCTP_ADDR_REACHABLE | 2549 SCTP_ADDR_UNCONFIRMED; 2550 } 2551 net->RTO = stcb->asoc.initial_rto; 2552 stcb->asoc.numnets++; 2553 net->ref_count = 1; 2554 2555 /* Init the timer structure */ 2556 callout_init(&net->rxt_timer.timer, 0); 2557 callout_init(&net->pmtu_timer.timer, 0); 2558 2559 /* Now generate a route for this guy */ 2560 /* KAME hack: embed scope zone ID */ 2561 if (newaddr->sa_family == AF_INET6) { 2562 struct sockaddr_in6 *sin6; 2563 sin6 = (struct sockaddr_in6 *)newaddr; 2564 if (sa6_embedscope(sin6, ip6_use_defzone) != 0) 2565 return (-1); 2566 } 2567 rt = rtcache_lookup(&net->ro, newaddr); 2568 if (rt) { 2569 net->mtu = rt->rt_ifp->if_mtu; 2570 if (from == 1) { 2571 stcb->asoc.smallest_mtu = net->mtu; 2572 } 2573 /* start things off to match mtu of interface please. */ 2574 rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu; 2575 } else { 2576 net->mtu = stcb->asoc.smallest_mtu; 2577 } 2578 #ifdef SCTP_DEBUG 2579 printf("After lookup\n"); 2580 #endif 2581 if (stcb->asoc.smallest_mtu > net->mtu) { 2582 stcb->asoc.smallest_mtu = net->mtu; 2583 } 2584 /* We take the max of the burst limit times a MTU or the INITIAL_CWND. 2585 * We then limit this to 4 MTU's of sending. 2586 */ 2587 net->cwnd = min((net->mtu * 4), max((stcb->asoc.max_burst * net->mtu), SCTP_INITIAL_CWND)); 2588 2589 /* we always get at LEAST 2 MTU's */ 2590 if (net->cwnd < (2 * net->mtu)) { 2591 net->cwnd = 2 * net->mtu; 2592 } 2593 2594 net->ssthresh = stcb->asoc.peers_rwnd; 2595 2596 net->src_addr_selected = 0; 2597 netfirst = TAILQ_FIRST(&stcb->asoc.nets); 2598 if (rt == NULL) { 2599 /* Since we have no route put it at the back */ 2600 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next); 2601 } else if (netfirst == NULL) { 2602 /* We are the first one in the pool. */ 2603 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2604 } else if ((netfirst_rt = rtcache_validate(&netfirst->ro)) == NULL) { 2605 /* 2606 * First one has NO route. Place this one ahead of the 2607 * first one. 2608 */ 2609 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2610 } else if (rt->rt_ifp != netfirst_rt->rt_ifp) { 2611 /* 2612 * This one has a different interface than the one at the 2613 * top of the list. Place it ahead. 2614 */ 2615 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2616 } else { 2617 /* 2618 * Ok we have the same interface as the first one. Move 2619 * forward until we find either 2620 * a) one with a NULL route... insert ahead of that 2621 * b) one with a different ifp.. insert after that. 2622 * c) end of the list.. insert at the tail. 2623 */ 2624 struct sctp_nets *netlook; 2625 struct rtentry *netlook_rt; 2626 do { 2627 netlook = TAILQ_NEXT(netfirst, sctp_next); 2628 if (netlook == NULL) { 2629 /* End of the list */ 2630 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, 2631 sctp_next); 2632 break; 2633 } else if ((netlook_rt = rtcache_validate(&netlook->ro)) == NULL) { 2634 /* next one has NO route */ 2635 TAILQ_INSERT_BEFORE(netfirst, net, sctp_next); 2636 break; 2637 } else if (netlook_rt->rt_ifp != rt->rt_ifp) { 2638 TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook, 2639 net, sctp_next); 2640 break; 2641 } 2642 /* Shift forward */ 2643 netfirst = netlook; 2644 } while (netlook != NULL); 2645 } 2646 /* got to have a primary set */ 2647 if (stcb->asoc.primary_destination == 0) { 2648 stcb->asoc.primary_destination = net; 2649 } else if (!rtcache_validate(&stcb->asoc.primary_destination->ro)) { 2650 /* No route to current primary adopt new primary */ 2651 stcb->asoc.primary_destination = net; 2652 } 2653 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, 2654 net); 2655 2656 return (0); 2657 } 2658 2659 2660 /* 2661 * allocate an association and add it to the endpoint. The caller must 2662 * be careful to add all additional addresses once they are know right 2663 * away or else the assoc will be may experience a blackout scenario. 2664 */ 2665 struct sctp_tcb * 2666 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr, 2667 int for_a_init, int *error, uint32_t override_tag) 2668 { 2669 struct sctp_tcb *stcb; 2670 struct sctp_association *asoc; 2671 struct sctpasochead *head; 2672 uint16_t rport; 2673 int err; 2674 2675 /* 2676 * Assumption made here: 2677 * Caller has done a sctp_findassociation_ep_addr(ep, addr's); 2678 * to make sure the address does not exist already. 2679 */ 2680 if (sctppcbinfo.ipi_count_asoc >= SCTP_MAX_NUM_OF_ASOC) { 2681 /* Hit max assoc, sorry no more */ 2682 *error = ENOBUFS; 2683 return (NULL); 2684 } 2685 SCTP_INP_RLOCK(inp); 2686 if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) { 2687 /* 2688 * If its in the TCP pool, its NOT allowed to create an 2689 * association. The parent listener needs to call 2690 * sctp_aloc_assoc.. or the one-2-many socket. If a 2691 * peeled off, or connected one does this.. its an error. 2692 */ 2693 SCTP_INP_RUNLOCK(inp); 2694 *error = EINVAL; 2695 return (NULL); 2696 } 2697 2698 #ifdef SCTP_DEBUG 2699 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2700 printf("Allocate an association for peer:"); 2701 if (firstaddr) 2702 sctp_print_address(firstaddr); 2703 else 2704 printf("None\n"); 2705 printf("Port:%d\n", 2706 ntohs(((struct sockaddr_in *)firstaddr)->sin_port)); 2707 } 2708 #endif /* SCTP_DEBUG */ 2709 if (firstaddr->sa_family == AF_INET) { 2710 struct sockaddr_in *sin; 2711 sin = (struct sockaddr_in *)firstaddr; 2712 if ((sin->sin_port == 0) || (sin->sin_addr.s_addr == 0)) { 2713 /* Invalid address */ 2714 #ifdef SCTP_DEBUG 2715 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2716 printf("peer address invalid\n"); 2717 } 2718 #endif 2719 SCTP_INP_RUNLOCK(inp); 2720 *error = EINVAL; 2721 return (NULL); 2722 } 2723 rport = sin->sin_port; 2724 } else if (firstaddr->sa_family == AF_INET6) { 2725 struct sockaddr_in6 *sin6; 2726 sin6 = (struct sockaddr_in6 *)firstaddr; 2727 if ((sin6->sin6_port == 0) || 2728 (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) { 2729 /* Invalid address */ 2730 #ifdef SCTP_DEBUG 2731 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2732 printf("peer address invalid\n"); 2733 } 2734 #endif 2735 SCTP_INP_RUNLOCK(inp); 2736 *error = EINVAL; 2737 return (NULL); 2738 } 2739 rport = sin6->sin6_port; 2740 } else { 2741 /* not supported family type */ 2742 #ifdef SCTP_DEBUG 2743 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2744 printf("BAD family %d\n", firstaddr->sa_family); 2745 } 2746 #endif 2747 SCTP_INP_RUNLOCK(inp); 2748 *error = EINVAL; 2749 return (NULL); 2750 } 2751 SCTP_INP_RUNLOCK(inp); 2752 if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) { 2753 /* 2754 * If you have not performed a bind, then we need to do 2755 * the ephemerial bind for you. 2756 */ 2757 #ifdef SCTP_DEBUG 2758 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2759 printf("Doing implicit BIND\n"); 2760 } 2761 #endif 2762 2763 if ((err = sctp_inpcb_bind(inp->sctp_socket, 2764 (struct sockaddr *)NULL, (struct lwp *)NULL))){ 2765 /* bind error, probably perm */ 2766 #ifdef SCTP_DEBUG 2767 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2768 printf("BIND FAILS ret:%d\n", err); 2769 } 2770 #endif 2771 2772 *error = err; 2773 return (NULL); 2774 } 2775 } 2776 stcb = (struct sctp_tcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asoc); 2777 if (stcb == NULL) { 2778 /* out of memory? */ 2779 #ifdef SCTP_DEBUG 2780 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2781 printf("aloc_assoc: no assoc mem left, stcb=NULL\n"); 2782 } 2783 #endif 2784 *error = ENOMEM; 2785 return (NULL); 2786 } 2787 sctppcbinfo.ipi_count_asoc++; 2788 sctppcbinfo.ipi_gencnt_asoc++; 2789 2790 memset(stcb, 0, sizeof(*stcb)); 2791 asoc = &stcb->asoc; 2792 SCTP_TCB_LOCK_INIT(stcb); 2793 /* setup back pointers */ 2794 #ifdef SCTP_DEBUG 2795 printf("Before back pointers\n"); 2796 #endif 2797 stcb->sctp_ep = inp; 2798 stcb->sctp_socket = inp->sctp_socket; 2799 if ((err = sctp_init_asoc(inp, asoc, for_a_init, override_tag))) { 2800 /* failed */ 2801 SCTP_TCB_LOCK_DESTROY (stcb); 2802 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2803 sctppcbinfo.ipi_count_asoc--; 2804 #ifdef SCTP_DEBUG 2805 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2806 printf("aloc_assoc: couldn't init asoc, out of mem?!\n"); 2807 } 2808 #endif 2809 *error = err; 2810 return (NULL); 2811 } 2812 /* and the port */ 2813 stcb->rport = rport; 2814 SCTP_INP_INFO_WLOCK(); 2815 SCTP_INP_WLOCK(inp); 2816 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 2817 /* inpcb freed while alloc going on */ 2818 SCTP_TCB_LOCK_DESTROY (stcb); 2819 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2820 SCTP_INP_WUNLOCK(inp); 2821 SCTP_INP_INFO_WUNLOCK(); 2822 sctppcbinfo.ipi_count_asoc--; 2823 #ifdef SCTP_DEBUG 2824 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2825 printf("aloc_assoc: couldn't init asoc, out of mem?!\n"); 2826 } 2827 #endif 2828 *error = EINVAL; 2829 return (NULL); 2830 } 2831 SCTP_TCB_LOCK(stcb); 2832 2833 /* now that my_vtag is set, add it to the hash */ 2834 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, 2835 sctppcbinfo.hashasocmark)]; 2836 /* put it in the bucket in the vtag hash of assoc's for the system */ 2837 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 2838 SCTP_INP_INFO_WUNLOCK(); 2839 2840 2841 if ((err = sctp_add_remote_addr(stcb, firstaddr, 1, 1))) { 2842 /* failure.. memory error? */ 2843 if (asoc->strmout) 2844 free(asoc->strmout, M_PCB); 2845 if (asoc->mapping_array) 2846 free(asoc->mapping_array, M_PCB); 2847 2848 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2849 sctppcbinfo.ipi_count_asoc--; 2850 #ifdef SCTP_DEBUG 2851 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2852 printf("aloc_assoc: couldn't add remote addr!\n"); 2853 } 2854 #endif 2855 SCTP_TCB_LOCK_DESTROY (stcb); 2856 *error = ENOBUFS; 2857 return (NULL); 2858 } 2859 /* Init all the timers */ 2860 callout_init(&asoc->hb_timer.timer, 0); 2861 callout_init(&asoc->dack_timer.timer, 0); 2862 callout_init(&asoc->asconf_timer.timer, 0); 2863 callout_init(&asoc->shut_guard_timer.timer, 0); 2864 callout_init(&asoc->autoclose_timer.timer, 0); 2865 callout_init(&asoc->delayed_event_timer.timer, 0); 2866 LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist); 2867 /* now file the port under the hash as well */ 2868 #ifdef SCTP_DEBUG 2869 printf("Before hashing %ld size %d\n", 2870 inp->sctp_hashmark, sctp_pcbtblsize); 2871 #endif 2872 if (inp->sctp_tcbhash != NULL) { 2873 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport, 2874 inp->sctp_hashmark)]; 2875 LIST_INSERT_HEAD(head, stcb, sctp_tcbhash); 2876 } 2877 #ifdef SCTP_DEBUG 2878 printf("After hashing\n"); 2879 #endif 2880 SCTP_INP_WUNLOCK(inp); 2881 #ifdef SCTP_DEBUG 2882 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 2883 printf("Association %p now allocated\n", stcb); 2884 } 2885 #endif 2886 return (stcb); 2887 } 2888 2889 void 2890 sctp_free_remote_addr(struct sctp_nets *net) 2891 { 2892 if (net == NULL) 2893 return; 2894 net->ref_count--; 2895 if (net->ref_count <= 0) { 2896 /* stop timer if running */ 2897 callout_stop(&net->rxt_timer.timer); 2898 callout_stop(&net->pmtu_timer.timer); 2899 callout_destroy(&net->rxt_timer.timer); 2900 callout_destroy(&net->pmtu_timer.timer); 2901 net->dest_state = SCTP_ADDR_NOT_REACHABLE; 2902 rtcache_free(&net->ro); 2903 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_net, net); 2904 sctppcbinfo.ipi_count_raddr--; 2905 } 2906 } 2907 2908 /* 2909 * remove a remote endpoint address from an association, it 2910 * will fail if the address does not exist. 2911 */ 2912 int 2913 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr) 2914 { 2915 /* 2916 * Here we need to remove a remote address. This is quite simple, we 2917 * first find it in the list of address for the association 2918 * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE on 2919 * that item. 2920 * Note we do not allow it to be removed if there are no other 2921 * addresses. 2922 */ 2923 struct sctp_association *asoc; 2924 struct sctp_nets *net, *net_tmp; 2925 asoc = &stcb->asoc; 2926 if (asoc->numnets < 2) { 2927 /* Must have at LEAST two remote addresses */ 2928 return (-1); 2929 } 2930 /* locate the address */ 2931 for (net = TAILQ_FIRST(&asoc->nets); net != NULL; net = net_tmp) { 2932 net_tmp = TAILQ_NEXT(net, sctp_next); 2933 if (rtcache_getdst(&net->ro)->sa_family != remaddr->sa_family) { 2934 continue; 2935 } 2936 if (sctp_cmpaddr(rtcache_getdst(&net->ro), remaddr)) { 2937 /* we found the guy */ 2938 asoc->numnets--; 2939 TAILQ_REMOVE(&asoc->nets, net, sctp_next); 2940 sctp_free_remote_addr(net); 2941 if (net == asoc->primary_destination) { 2942 /* Reset primary */ 2943 struct sctp_nets *lnet; 2944 lnet = TAILQ_FIRST(&asoc->nets); 2945 /* Try to find a confirmed primary */ 2946 asoc->primary_destination = 2947 sctp_find_alternate_net(stcb, lnet); 2948 } 2949 if (net == asoc->last_data_chunk_from) { 2950 /* Reset primary */ 2951 asoc->last_data_chunk_from = 2952 TAILQ_FIRST(&asoc->nets); 2953 } 2954 if (net == asoc->last_control_chunk_from) { 2955 /* Reset primary */ 2956 asoc->last_control_chunk_from = 2957 TAILQ_FIRST(&asoc->nets); 2958 } 2959 if (net == asoc->asconf_last_sent_to) { 2960 /* Reset primary */ 2961 asoc->asconf_last_sent_to = 2962 TAILQ_FIRST(&asoc->nets); 2963 } 2964 return (0); 2965 } 2966 } 2967 /* not found. */ 2968 return (-2); 2969 } 2970 2971 2972 static void 2973 sctp_add_vtag_to_timewait(struct sctp_inpcb *inp, u_int32_t tag) 2974 { 2975 struct sctpvtaghead *chain; 2976 struct sctp_tagblock *twait_block; 2977 struct timeval now; 2978 int set, i; 2979 SCTP_GETTIME_TIMEVAL(&now); 2980 chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)]; 2981 set = 0; 2982 if (!LIST_EMPTY(chain)) { 2983 /* Block(s) present, lets find space, and expire on the fly */ 2984 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) { 2985 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) { 2986 if ((twait_block->vtag_block[i].v_tag == 0) && 2987 !set) { 2988 twait_block->vtag_block[0].tv_sec_at_expire = 2989 now.tv_sec + SCTP_TIME_WAIT; 2990 twait_block->vtag_block[0].v_tag = tag; 2991 set = 1; 2992 } else if ((twait_block->vtag_block[i].v_tag) && 2993 ((long)twait_block->vtag_block[i].tv_sec_at_expire > 2994 now.tv_sec)) { 2995 /* Audit expires this guy */ 2996 twait_block->vtag_block[i].tv_sec_at_expire = 0; 2997 twait_block->vtag_block[i].v_tag = 0; 2998 if (set == 0) { 2999 /* Reuse it for my new tag */ 3000 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + SCTP_TIME_WAIT; 3001 twait_block->vtag_block[0].v_tag = tag; 3002 set = 1; 3003 } 3004 } 3005 } 3006 if (set) { 3007 /* 3008 * We only do up to the block where we can 3009 * place our tag for audits 3010 */ 3011 break; 3012 } 3013 } 3014 } 3015 /* Need to add a new block to chain */ 3016 if (!set) { 3017 twait_block = malloc(sizeof(struct sctp_tagblock), M_PCB, M_NOWAIT); 3018 if (twait_block == NULL) { 3019 return; 3020 } 3021 memset(twait_block, 0, sizeof(struct sctp_timewait)); 3022 LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock); 3023 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + 3024 SCTP_TIME_WAIT; 3025 twait_block->vtag_block[0].v_tag = tag; 3026 } 3027 } 3028 3029 3030 static void 3031 sctp_iterator_asoc_being_freed(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 3032 { 3033 struct sctp_iterator *it; 3034 3035 3036 3037 /* Unlock the tcb lock we do this so 3038 * we avoid a dead lock scenario where 3039 * the iterator is waiting on the TCB lock 3040 * and the TCB lock is waiting on the iterator 3041 * lock. 3042 */ 3043 SCTP_ITERATOR_LOCK(); 3044 SCTP_INP_INFO_WLOCK(); 3045 SCTP_INP_WLOCK(inp); 3046 SCTP_TCB_LOCK(stcb); 3047 3048 it = stcb->asoc.stcb_starting_point_for_iterator; 3049 if (it == NULL) { 3050 return; 3051 } 3052 if (it->inp != stcb->sctp_ep) { 3053 /* hm, focused on the wrong one? */ 3054 return; 3055 } 3056 if (it->stcb != stcb) { 3057 return; 3058 } 3059 it->stcb = LIST_NEXT(stcb, sctp_tcblist); 3060 if (it->stcb == NULL) { 3061 /* done with all asoc's in this assoc */ 3062 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 3063 it->inp = NULL; 3064 } else { 3065 3066 it->inp = LIST_NEXT(inp, sctp_list); 3067 } 3068 } 3069 } 3070 3071 /* 3072 * Free the association after un-hashing the remote port. 3073 */ 3074 void 3075 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 3076 { 3077 struct sctp_association *asoc; 3078 struct sctp_nets *net, *prev; 3079 struct sctp_laddr *laddr; 3080 struct sctp_tmit_chunk *chk; 3081 struct sctp_asconf_addr *aparam; 3082 struct sctp_socket_q_list *sq; 3083 int s; 3084 3085 /* first, lets purge the entry from the hash table. */ 3086 s = splsoftnet(); 3087 if (stcb->asoc.state == 0) { 3088 printf("Freeing already free association:%p - huh??\n", 3089 stcb); 3090 splx(s); 3091 return; 3092 } 3093 asoc = &stcb->asoc; 3094 asoc->state = 0; 3095 /* now clean up any other timers */ 3096 callout_stop(&asoc->hb_timer.timer); 3097 callout_destroy(&asoc->hb_timer.timer); 3098 callout_stop(&asoc->dack_timer.timer); 3099 callout_destroy(&asoc->dack_timer.timer); 3100 callout_stop(&asoc->asconf_timer.timer); 3101 callout_destroy(&asoc->asconf_timer.timer); 3102 callout_stop(&asoc->shut_guard_timer.timer); 3103 callout_destroy(&asoc->shut_guard_timer.timer); 3104 callout_stop(&asoc->autoclose_timer.timer); 3105 callout_destroy(&asoc->autoclose_timer.timer); 3106 callout_stop(&asoc->delayed_event_timer.timer); 3107 callout_destroy(&asoc->delayed_event_timer.timer); 3108 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3109 callout_stop(&net->rxt_timer.timer); 3110 callout_stop(&net->pmtu_timer.timer); 3111 callout_destroy(&net->rxt_timer.timer); 3112 callout_destroy(&net->pmtu_timer.timer); 3113 } 3114 3115 /* Iterator asoc being freed we send an 3116 * unlocked TCB. It returns with INP_INFO 3117 * and INP write locked and the TCB locked 3118 * too and of course the iterator lock 3119 * in place as well.. 3120 */ 3121 SCTP_TCB_UNLOCK(stcb); 3122 sctp_iterator_asoc_being_freed(inp, stcb); 3123 3124 /* Null all of my entry's on the socket q */ 3125 TAILQ_FOREACH(sq, &inp->sctp_queue_list, next_sq) { 3126 if (sq->tcb == stcb) { 3127 sq->tcb = NULL; 3128 } 3129 } 3130 3131 if (inp->sctp_tcb_at_block == (void *)stcb) { 3132 inp->error_on_block = ECONNRESET; 3133 } 3134 3135 if (inp->sctp_tcbhash) { 3136 LIST_REMOVE(stcb, sctp_tcbhash); 3137 } 3138 /* Now lets remove it from the list of ALL associations in the EP */ 3139 LIST_REMOVE(stcb, sctp_tcblist); 3140 SCTP_INP_WUNLOCK(inp); 3141 SCTP_ITERATOR_UNLOCK(); 3142 3143 3144 /* pull from vtag hash */ 3145 LIST_REMOVE(stcb, sctp_asocs); 3146 3147 /* 3148 * Now before we can free the assoc, we must remove all of the 3149 * networks and any other allocated space.. i.e. add removes here 3150 * before the SCTP_ZONE_FREE() of the tasoc entry. 3151 */ 3152 3153 sctp_add_vtag_to_timewait(inp, asoc->my_vtag); 3154 SCTP_INP_INFO_WUNLOCK(); 3155 prev = NULL; 3156 while (!TAILQ_EMPTY(&asoc->nets)) { 3157 net = TAILQ_FIRST(&asoc->nets); 3158 /* pull from list */ 3159 if ((sctppcbinfo.ipi_count_raddr == 0) || (prev == net)) { 3160 break; 3161 } 3162 prev = net; 3163 TAILQ_REMOVE(&asoc->nets, net, sctp_next); 3164 rtcache_free(&net->ro); 3165 /* free it */ 3166 net->ref_count = 0; 3167 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_net, net); 3168 sctppcbinfo.ipi_count_raddr--; 3169 } 3170 /* 3171 * The chunk lists and such SHOULD be empty but we check them 3172 * just in case. 3173 */ 3174 /* anything on the wheel needs to be removed */ 3175 while (!TAILQ_EMPTY(&asoc->out_wheel)) { 3176 struct sctp_stream_out *outs; 3177 outs = TAILQ_FIRST(&asoc->out_wheel); 3178 TAILQ_REMOVE(&asoc->out_wheel, outs, next_spoke); 3179 /* now clean up any chunks here */ 3180 chk = TAILQ_FIRST(&outs->outqueue); 3181 while (chk) { 3182 TAILQ_REMOVE(&outs->outqueue, chk, sctp_next); 3183 if (chk->data) { 3184 sctp_m_freem(chk->data); 3185 chk->data = NULL; 3186 } 3187 chk->whoTo = NULL; 3188 chk->asoc = NULL; 3189 /* Free the chunk */ 3190 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3191 sctppcbinfo.ipi_count_chunk--; 3192 sctppcbinfo.ipi_gencnt_chunk++; 3193 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3194 panic("Chunk count is negative"); 3195 } 3196 chk = TAILQ_FIRST(&outs->outqueue); 3197 } 3198 outs = TAILQ_FIRST(&asoc->out_wheel); 3199 } 3200 3201 if (asoc->pending_reply) { 3202 free(asoc->pending_reply, M_PCB); 3203 asoc->pending_reply = NULL; 3204 } 3205 chk = TAILQ_FIRST(&asoc->pending_reply_queue); 3206 while (chk) { 3207 TAILQ_REMOVE(&asoc->pending_reply_queue, chk, sctp_next); 3208 if (chk->data) { 3209 sctp_m_freem(chk->data); 3210 chk->data = NULL; 3211 } 3212 chk->whoTo = NULL; 3213 chk->asoc = NULL; 3214 /* Free the chunk */ 3215 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3216 sctppcbinfo.ipi_count_chunk--; 3217 sctppcbinfo.ipi_gencnt_chunk++; 3218 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3219 panic("Chunk count is negative"); 3220 } 3221 chk = TAILQ_FIRST(&asoc->pending_reply_queue); 3222 } 3223 /* pending send queue SHOULD be empty */ 3224 if (!TAILQ_EMPTY(&asoc->send_queue)) { 3225 chk = TAILQ_FIRST(&asoc->send_queue); 3226 while (chk) { 3227 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next); 3228 if (chk->data) { 3229 sctp_m_freem(chk->data); 3230 chk->data = NULL; 3231 } 3232 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3233 sctppcbinfo.ipi_count_chunk--; 3234 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3235 panic("Chunk count is negative"); 3236 } 3237 sctppcbinfo.ipi_gencnt_chunk++; 3238 chk = TAILQ_FIRST(&asoc->send_queue); 3239 } 3240 } 3241 /* sent queue SHOULD be empty */ 3242 if (!TAILQ_EMPTY(&asoc->sent_queue)) { 3243 chk = TAILQ_FIRST(&asoc->sent_queue); 3244 while (chk) { 3245 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next); 3246 if (chk->data) { 3247 sctp_m_freem(chk->data); 3248 chk->data = NULL; 3249 } 3250 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3251 sctppcbinfo.ipi_count_chunk--; 3252 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3253 panic("Chunk count is negative"); 3254 } 3255 sctppcbinfo.ipi_gencnt_chunk++; 3256 chk = TAILQ_FIRST(&asoc->sent_queue); 3257 } 3258 } 3259 /* control queue MAY not be empty */ 3260 if (!TAILQ_EMPTY(&asoc->control_send_queue)) { 3261 chk = TAILQ_FIRST(&asoc->control_send_queue); 3262 while (chk) { 3263 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 3264 if (chk->data) { 3265 sctp_m_freem(chk->data); 3266 chk->data = NULL; 3267 } 3268 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3269 sctppcbinfo.ipi_count_chunk--; 3270 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3271 panic("Chunk count is negative"); 3272 } 3273 sctppcbinfo.ipi_gencnt_chunk++; 3274 chk = TAILQ_FIRST(&asoc->control_send_queue); 3275 } 3276 } 3277 if (!TAILQ_EMPTY(&asoc->reasmqueue)) { 3278 chk = TAILQ_FIRST(&asoc->reasmqueue); 3279 while (chk) { 3280 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next); 3281 if (chk->data) { 3282 sctp_m_freem(chk->data); 3283 chk->data = NULL; 3284 } 3285 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3286 sctppcbinfo.ipi_count_chunk--; 3287 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3288 panic("Chunk count is negative"); 3289 } 3290 sctppcbinfo.ipi_gencnt_chunk++; 3291 chk = TAILQ_FIRST(&asoc->reasmqueue); 3292 } 3293 } 3294 if (!TAILQ_EMPTY(&asoc->delivery_queue)) { 3295 chk = TAILQ_FIRST(&asoc->delivery_queue); 3296 while (chk) { 3297 TAILQ_REMOVE(&asoc->delivery_queue, chk, sctp_next); 3298 if (chk->data) { 3299 sctp_m_freem(chk->data); 3300 chk->data = NULL; 3301 } 3302 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3303 sctppcbinfo.ipi_count_chunk--; 3304 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3305 panic("Chunk count is negative"); 3306 } 3307 sctppcbinfo.ipi_gencnt_chunk++; 3308 chk = TAILQ_FIRST(&asoc->delivery_queue); 3309 } 3310 } 3311 if (asoc->mapping_array) { 3312 free(asoc->mapping_array, M_PCB); 3313 asoc->mapping_array = NULL; 3314 } 3315 3316 /* the stream outs */ 3317 if (asoc->strmout) { 3318 free(asoc->strmout, M_PCB); 3319 asoc->strmout = NULL; 3320 } 3321 asoc->streamoutcnt = 0; 3322 if (asoc->strmin) { 3323 int i; 3324 for (i = 0; i < asoc->streamincnt; i++) { 3325 if (!TAILQ_EMPTY(&asoc->strmin[i].inqueue)) { 3326 /* We have somethings on the streamin queue */ 3327 chk = TAILQ_FIRST(&asoc->strmin[i].inqueue); 3328 while (chk) { 3329 TAILQ_REMOVE(&asoc->strmin[i].inqueue, 3330 chk, sctp_next); 3331 if (chk->data) { 3332 sctp_m_freem(chk->data); 3333 chk->data = NULL; 3334 } 3335 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, 3336 chk); 3337 sctppcbinfo.ipi_count_chunk--; 3338 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3339 panic("Chunk count is negative"); 3340 } 3341 sctppcbinfo.ipi_gencnt_chunk++; 3342 chk = TAILQ_FIRST(&asoc->strmin[i].inqueue); 3343 } 3344 } 3345 } 3346 free(asoc->strmin, M_PCB); 3347 asoc->strmin = NULL; 3348 } 3349 asoc->streamincnt = 0; 3350 /* local addresses, if any */ 3351 while (!LIST_EMPTY(&asoc->sctp_local_addr_list)) { 3352 laddr = LIST_FIRST(&asoc->sctp_local_addr_list); 3353 LIST_REMOVE(laddr, sctp_nxt_addr); 3354 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 3355 sctppcbinfo.ipi_count_laddr--; 3356 } 3357 /* pending asconf (address) parameters */ 3358 while (!TAILQ_EMPTY(&asoc->asconf_queue)) { 3359 aparam = TAILQ_FIRST(&asoc->asconf_queue); 3360 TAILQ_REMOVE(&asoc->asconf_queue, aparam, next); 3361 free(aparam, M_PCB); 3362 } 3363 if (asoc->last_asconf_ack_sent != NULL) { 3364 sctp_m_freem(asoc->last_asconf_ack_sent); 3365 asoc->last_asconf_ack_sent = NULL; 3366 } 3367 /* Insert new items here :> */ 3368 3369 /* Get rid of LOCK */ 3370 SCTP_TCB_LOCK_DESTROY(stcb); 3371 3372 /* now clean up the tasoc itself */ 3373 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 3374 sctppcbinfo.ipi_count_asoc--; 3375 if ((inp->sctp_socket->so_snd.sb_cc) || 3376 (inp->sctp_socket->so_snd.sb_mbcnt)) { 3377 /* This will happen when a abort is done */ 3378 inp->sctp_socket->so_snd.sb_cc = 0; 3379 inp->sctp_socket->so_snd.sb_mbcnt = 0; 3380 } 3381 if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 3382 if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) { 3383 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 3384 /* 3385 * For the base fd, that is NOT in TCP pool we 3386 * turn off the connected flag. This allows 3387 * non-listening endpoints to connect/shutdown/ 3388 * connect. 3389 */ 3390 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED; 3391 soisdisconnected(inp->sctp_socket); 3392 } 3393 /* 3394 * For those that are in the TCP pool we just leave 3395 * so it cannot be used. When they close the fd we 3396 * will free it all. 3397 */ 3398 } 3399 } 3400 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3401 sctp_inpcb_free(inp, 0); 3402 } 3403 splx(s); 3404 } 3405 3406 3407 /* 3408 * determine if a destination is "reachable" based upon the addresses 3409 * bound to the current endpoint (e.g. only v4 or v6 currently bound) 3410 */ 3411 /* 3412 * FIX: if we allow assoc-level bindx(), then this needs to be fixed 3413 * to use assoc level v4/v6 flags, as the assoc *may* not have the 3414 * same address types bound as its endpoint 3415 */ 3416 int 3417 sctp_destination_is_reachable(struct sctp_tcb *stcb, const struct sockaddr *destaddr) 3418 { 3419 struct sctp_inpcb *inp; 3420 int answer; 3421 3422 /* No locks here, the TCB, in all cases is already 3423 * locked and an assoc is up. There is either a 3424 * INP lock by the caller applied (in asconf case when 3425 * deleting an address) or NOT in the HB case, however 3426 * if HB then the INP increment is up and the INP 3427 * will not be removed (on top of the fact that 3428 * we have a TCB lock). So we only want to 3429 * read the sctp_flags, which is either bound-all 3430 * or not.. no protection needed since once an 3431 * assoc is up you can't be changing your binding. 3432 */ 3433 inp = stcb->sctp_ep; 3434 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3435 /* if bound all, destination is not restricted */ 3436 /* RRS: Question during lock work: Is this 3437 * correct? If you are bound-all you still 3438 * might need to obey the V4--V6 flags??? 3439 * IMO this bound-all stuff needs to be removed! 3440 */ 3441 return (1); 3442 } 3443 /* NOTE: all "scope" checks are done when local addresses are added */ 3444 if (destaddr->sa_family == AF_INET6) { 3445 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3446 answer = inp->inp_vflag & INP_IPV6; 3447 #else 3448 answer = inp->ip_inp.inp.inp_vflag & INP_IPV6; 3449 #endif 3450 } else if (destaddr->sa_family == AF_INET) { 3451 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3452 answer = inp->inp_vflag & INP_IPV4; 3453 #else 3454 answer = inp->ip_inp.inp.inp_vflag & INP_IPV4; 3455 #endif 3456 } else { 3457 /* invalid family, so it's unreachable */ 3458 answer = 0; 3459 } 3460 return (answer); 3461 } 3462 3463 /* 3464 * update the inp_vflags on an endpoint 3465 */ 3466 static void 3467 sctp_update_ep_vflag(struct sctp_inpcb *inp) { 3468 struct sctp_laddr *laddr; 3469 3470 /* first clear the flag */ 3471 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3472 inp->inp_vflag = 0; 3473 #else 3474 inp->ip_inp.inp.inp_vflag = 0; 3475 #endif 3476 /* set the flag based on addresses on the ep list */ 3477 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3478 if (laddr->ifa == NULL) { 3479 #ifdef SCTP_DEBUG 3480 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 3481 printf("An ounce of prevention is worth a pound of cure\n"); 3482 } 3483 #endif /* SCTP_DEBUG */ 3484 continue; 3485 } 3486 if (laddr->ifa->ifa_addr) { 3487 continue; 3488 } 3489 if (laddr->ifa->ifa_addr->sa_family == AF_INET6) { 3490 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3491 inp->inp_vflag |= INP_IPV6; 3492 #else 3493 inp->ip_inp.inp.inp_vflag |= INP_IPV6; 3494 #endif 3495 } else if (laddr->ifa->ifa_addr->sa_family == AF_INET) { 3496 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3497 inp->inp_vflag |= INP_IPV4; 3498 #else 3499 inp->ip_inp.inp.inp_vflag |= INP_IPV4; 3500 #endif 3501 } 3502 } 3503 } 3504 3505 /* 3506 * Add the address to the endpoint local address list 3507 * There is nothing to be done if we are bound to all addresses 3508 */ 3509 int 3510 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa) 3511 { 3512 struct sctp_laddr *laddr; 3513 int fnd, error; 3514 fnd = 0; 3515 3516 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3517 /* You are already bound to all. You have it already */ 3518 return (0); 3519 } 3520 if (ifa->ifa_addr->sa_family == AF_INET6) { 3521 struct in6_ifaddr *ifa6; 3522 ifa6 = (struct in6_ifaddr *)ifa; 3523 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 3524 IN6_IFF_DEPRECATED | IN6_IFF_ANYCAST | IN6_IFF_NOTREADY)) 3525 /* Can't bind a non-existent addr. */ 3526 return (-1); 3527 } 3528 /* first, is it already present? */ 3529 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3530 if (laddr->ifa == ifa) { 3531 fnd = 1; 3532 break; 3533 } 3534 } 3535 3536 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd == 0)) { 3537 /* Not bound to all */ 3538 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa); 3539 if (error != 0) 3540 return (error); 3541 inp->laddr_count++; 3542 /* update inp_vflag flags */ 3543 if (ifa->ifa_addr->sa_family == AF_INET6) { 3544 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3545 inp->inp_vflag |= INP_IPV6; 3546 #else 3547 inp->ip_inp.inp.inp_vflag |= INP_IPV6; 3548 #endif 3549 } else if (ifa->ifa_addr->sa_family == AF_INET) { 3550 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3551 inp->inp_vflag |= INP_IPV4; 3552 #else 3553 inp->ip_inp.inp.inp_vflag |= INP_IPV4; 3554 #endif 3555 } 3556 } 3557 return (0); 3558 } 3559 3560 3561 /* 3562 * select a new (hopefully reachable) destination net 3563 * (should only be used when we deleted an ep addr that is the 3564 * only usable source address to reach the destination net) 3565 */ 3566 static void 3567 sctp_select_primary_destination(struct sctp_tcb *stcb) 3568 { 3569 struct sctp_nets *net; 3570 3571 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 3572 /* for now, we'll just pick the first reachable one we find */ 3573 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) 3574 continue; 3575 if (sctp_destination_is_reachable(stcb, 3576 rtcache_getdst(&net->ro))) { 3577 /* found a reachable destination */ 3578 stcb->asoc.primary_destination = net; 3579 } 3580 } 3581 /* I can't there from here! ...we're gonna die shortly... */ 3582 } 3583 3584 3585 /* 3586 * Delete the address from the endpoint local address list 3587 * There is nothing to be done if we are bound to all addresses 3588 */ 3589 int 3590 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa) 3591 { 3592 struct sctp_laddr *laddr; 3593 int fnd; 3594 fnd = 0; 3595 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3596 /* You are already bound to all. You have it already */ 3597 return (EINVAL); 3598 } 3599 3600 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3601 if (laddr->ifa == ifa) { 3602 fnd = 1; 3603 break; 3604 } 3605 } 3606 if (fnd && (inp->laddr_count < 2)) { 3607 /* can't delete unless there are at LEAST 2 addresses */ 3608 return (-1); 3609 } 3610 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd)) { 3611 /* 3612 * clean up any use of this address 3613 * go through our associations and clear any 3614 * last_used_address that match this one 3615 * for each assoc, see if a new primary_destination is needed 3616 */ 3617 struct sctp_tcb *stcb; 3618 3619 /* clean up "next_addr_touse" */ 3620 if (inp->next_addr_touse == laddr) 3621 /* delete this address */ 3622 inp->next_addr_touse = NULL; 3623 3624 /* clean up "last_used_address" */ 3625 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 3626 if (stcb->asoc.last_used_address == laddr) 3627 /* delete this address */ 3628 stcb->asoc.last_used_address = NULL; 3629 } /* for each tcb */ 3630 3631 /* remove it from the ep list */ 3632 sctp_remove_laddr(laddr); 3633 inp->laddr_count--; 3634 /* update inp_vflag flags */ 3635 sctp_update_ep_vflag(inp); 3636 /* select a new primary destination if needed */ 3637 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 3638 /* presume caller (sctp_asconf.c) already owns INP lock */ 3639 SCTP_TCB_LOCK(stcb); 3640 if (sctp_destination_is_reachable(stcb, 3641 rtcache_getdst(&stcb->asoc.primary_destination->ro)) == 0) { 3642 sctp_select_primary_destination(stcb); 3643 } 3644 SCTP_TCB_UNLOCK(stcb); 3645 } /* for each tcb */ 3646 } 3647 return (0); 3648 } 3649 3650 /* 3651 * Add the addr to the TCB local address list 3652 * For the BOUNDALL or dynamic case, this is a "pending" address list 3653 * (eg. addresses waiting for an ASCONF-ACK response) 3654 * For the subset binding, static case, this is a "valid" address list 3655 */ 3656 int 3657 sctp_add_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa) 3658 { 3659 struct sctp_laddr *laddr; 3660 int error; 3661 3662 /* Assumes TCP is locked.. and possiblye 3663 * the INP. May need to confirm/fix that if 3664 * we need it and is not the case. 3665 */ 3666 if (ifa->ifa_addr->sa_family == AF_INET6) { 3667 struct in6_ifaddr *ifa6; 3668 ifa6 = (struct in6_ifaddr *)ifa; 3669 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 3670 /* IN6_IFF_DEPRECATED | */ 3671 IN6_IFF_ANYCAST | 3672 IN6_IFF_NOTREADY)) 3673 /* Can't bind a non-existent addr. */ 3674 return (-1); 3675 } 3676 /* does the address already exist? */ 3677 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 3678 if (laddr->ifa == ifa) { 3679 return (-1); 3680 } 3681 } 3682 3683 /* add to the list */ 3684 error = sctp_insert_laddr(&stcb->asoc.sctp_local_addr_list, ifa); 3685 if (error != 0) 3686 return (error); 3687 return (0); 3688 } 3689 3690 /* 3691 * insert an laddr entry with the given ifa for the desired list 3692 */ 3693 int 3694 sctp_insert_laddr(struct sctpladdr *list, struct ifaddr *ifa) { 3695 struct sctp_laddr *laddr; 3696 int s; 3697 3698 s = splsoftnet(); 3699 3700 laddr = (struct sctp_laddr *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr); 3701 if (laddr == NULL) { 3702 /* out of memory? */ 3703 splx(s); 3704 return (EINVAL); 3705 } 3706 sctppcbinfo.ipi_count_laddr++; 3707 sctppcbinfo.ipi_gencnt_laddr++; 3708 memset(laddr, 0, sizeof(*laddr)); 3709 laddr->ifa = ifa; 3710 /* insert it */ 3711 LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr); 3712 3713 splx(s); 3714 return (0); 3715 } 3716 3717 /* 3718 * Remove an laddr entry from the local address list (on an assoc) 3719 */ 3720 void 3721 sctp_remove_laddr(struct sctp_laddr *laddr) 3722 { 3723 int s; 3724 s = splsoftnet(); 3725 /* remove from the list */ 3726 LIST_REMOVE(laddr, sctp_nxt_addr); 3727 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 3728 sctppcbinfo.ipi_count_laddr--; 3729 sctppcbinfo.ipi_gencnt_laddr++; 3730 3731 splx(s); 3732 } 3733 3734 /* 3735 * Remove an address from the TCB local address list 3736 */ 3737 int 3738 sctp_del_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa) 3739 { 3740 struct sctp_inpcb *inp; 3741 struct sctp_laddr *laddr; 3742 3743 /* This is called by asconf work. It is assumed that 3744 * a) The TCB is locked 3745 * and 3746 * b) The INP is locked. 3747 * This is true in as much as I can trace through 3748 * the entry asconf code where I did these locks. 3749 * Again, the ASCONF code is a bit different in 3750 * that it does lock the INP during its work often 3751 * times. This must be since we don't want other 3752 * proc's looking up things while what they are 3753 * looking up is changing :-D 3754 */ 3755 3756 inp = stcb->sctp_ep; 3757 /* if subset bound and don't allow ASCONF's, can't delete last */ 3758 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && 3759 ((inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) == 0)) { 3760 if (stcb->asoc.numnets < 2) { 3761 /* can't delete last address */ 3762 return (-1); 3763 } 3764 } 3765 3766 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 3767 /* remove the address if it exists */ 3768 if (laddr->ifa == NULL) 3769 continue; 3770 if (laddr->ifa == ifa) { 3771 sctp_remove_laddr(laddr); 3772 return (0); 3773 } 3774 } 3775 3776 /* address not found! */ 3777 return (-1); 3778 } 3779 3780 /* 3781 * Remove an address from the TCB local address list 3782 * lookup using a sockaddr addr 3783 */ 3784 int 3785 sctp_del_local_addr_assoc_sa(struct sctp_tcb *stcb, struct sockaddr *sa) 3786 { 3787 struct sctp_inpcb *inp; 3788 struct sctp_laddr *laddr; 3789 struct sockaddr *l_sa; 3790 3791 /* 3792 * This function I find does not seem to have a caller. 3793 * As such we NEED TO DELETE this code. If we do 3794 * find a caller, the caller MUST have locked the TCB 3795 * at the least and probably the INP as well. 3796 */ 3797 inp = stcb->sctp_ep; 3798 /* if subset bound and don't allow ASCONF's, can't delete last */ 3799 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && 3800 ((inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) == 0)) { 3801 if (stcb->asoc.numnets < 2) { 3802 /* can't delete last address */ 3803 return (-1); 3804 } 3805 } 3806 3807 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 3808 /* make sure the address exists */ 3809 if (laddr->ifa == NULL) 3810 continue; 3811 if (laddr->ifa->ifa_addr == NULL) 3812 continue; 3813 3814 l_sa = laddr->ifa->ifa_addr; 3815 if (l_sa->sa_family == AF_INET6) { 3816 /* IPv6 address */ 3817 struct sockaddr_in6 *sin1, *sin2; 3818 sin1 = (struct sockaddr_in6 *)l_sa; 3819 sin2 = (struct sockaddr_in6 *)sa; 3820 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr, 3821 sizeof(struct in6_addr)) == 0) { 3822 /* matched */ 3823 sctp_remove_laddr(laddr); 3824 return (0); 3825 } 3826 } else if (l_sa->sa_family == AF_INET) { 3827 /* IPv4 address */ 3828 struct sockaddr_in *sin1, *sin2; 3829 sin1 = (struct sockaddr_in *)l_sa; 3830 sin2 = (struct sockaddr_in *)sa; 3831 if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) { 3832 /* matched */ 3833 sctp_remove_laddr(laddr); 3834 return (0); 3835 } 3836 } else { 3837 /* invalid family */ 3838 return (-1); 3839 } 3840 } /* end foreach */ 3841 /* address not found! */ 3842 return (-1); 3843 } 3844 3845 static char sctp_pcb_initialized = 0; 3846 3847 #if defined(__FreeBSD__) || defined(__APPLE__) 3848 /* sysctl */ 3849 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC; 3850 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR; 3851 3852 #endif /* FreeBSD || APPLE */ 3853 3854 #ifndef SCTP_TCBHASHSIZE 3855 #define SCTP_TCBHASHSIZE 1024 3856 #endif 3857 3858 #ifndef SCTP_CHUNKQUEUE_SCALE 3859 #define SCTP_CHUNKQUEUE_SCALE 10 3860 #endif 3861 3862 void 3863 sctp_pcb_init(void) 3864 { 3865 /* 3866 * SCTP initialization for the PCB structures 3867 * should be called by the sctp_init() funciton. 3868 */ 3869 int i; 3870 int hashtblsize = SCTP_TCBHASHSIZE; 3871 3872 #if defined(__FreeBSD__) || defined(__APPLE__) 3873 int sctp_chunkscale = SCTP_CHUNKQUEUE_SCALE; 3874 #endif 3875 3876 if (sctp_pcb_initialized != 0) { 3877 /* error I was called twice */ 3878 return; 3879 } 3880 sctp_pcb_initialized = 1; 3881 3882 /* Init all peg counts */ 3883 for (i = 0; i < SCTP_NUMBER_OF_PEGS; i++) { 3884 sctp_pegs[i] = 0; 3885 } 3886 3887 /* init the empty list of (All) Endpoints */ 3888 LIST_INIT(&sctppcbinfo.listhead); 3889 3890 /* init the iterator head */ 3891 LIST_INIT(&sctppcbinfo.iteratorhead); 3892 3893 /* init the hash table of endpoints */ 3894 #if defined(__FreeBSD__) 3895 #if defined(__FreeBSD_cc_version) && __FreeBSD_cc_version >= 440000 3896 TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &hashtblsize); 3897 TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &sctp_pcbtblsize); 3898 TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &sctp_chunkscale); 3899 #else 3900 TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", SCTP_TCBHASHSIZE, 3901 hashtblsize); 3902 TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", SCTP_PCBHASHSIZE, 3903 sctp_pcbtblsize); 3904 TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", SCTP_CHUNKQUEUE_SCALE, 3905 sctp_chunkscale); 3906 #endif 3907 #endif 3908 3909 sctppcbinfo.sctp_asochash = hashinit((hashtblsize * 31), HASH_LIST, 3910 M_WAITOK, &sctppcbinfo.hashasocmark); 3911 3912 sctppcbinfo.sctp_ephash = hashinit(hashtblsize, HASH_LIST, 3913 M_WAITOK, &sctppcbinfo.hashmark); 3914 3915 sctppcbinfo.sctp_tcpephash = hashinit(hashtblsize, HASH_LIST, 3916 M_WAITOK, &sctppcbinfo.hashtcpmark); 3917 3918 sctppcbinfo.hashtblsize = hashtblsize; 3919 3920 /* init the zones */ 3921 /* 3922 * FIX ME: Should check for NULL returns, but if it does fail we 3923 * are doomed to panic anyways... add later maybe. 3924 */ 3925 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_ep, "sctp_ep", 3926 sizeof(struct sctp_inpcb), maxsockets); 3927 3928 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_asoc, "sctp_asoc", 3929 sizeof(struct sctp_tcb), sctp_max_number_of_assoc); 3930 3931 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_laddr, "sctp_laddr", 3932 sizeof(struct sctp_laddr), 3933 (sctp_max_number_of_assoc * sctp_scale_up_for_address)); 3934 3935 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_net, "sctp_raddr", 3936 sizeof(struct sctp_nets), 3937 (sctp_max_number_of_assoc * sctp_scale_up_for_address)); 3938 3939 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_chunk, "sctp_chunk", 3940 sizeof(struct sctp_tmit_chunk), 3941 (sctp_max_number_of_assoc * sctp_scale_up_for_address * 3942 sctp_chunkscale)); 3943 3944 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_sockq, "sctp_sockq", 3945 sizeof(struct sctp_socket_q_list), 3946 (sctp_max_number_of_assoc * sctp_scale_up_for_address * 3947 sctp_chunkscale)); 3948 3949 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_hash, "sctp_hash", 3950 sizeof(void *) * sctp_pcbtblsize, maxsockets); 3951 3952 /* Master Lock INIT for info structure */ 3953 SCTP_INP_INFO_LOCK_INIT(); 3954 SCTP_ITERATOR_LOCK_INIT(); 3955 /* not sure if we need all the counts */ 3956 sctppcbinfo.ipi_count_ep = 0; 3957 sctppcbinfo.ipi_gencnt_ep = 0; 3958 /* assoc/tcb zone info */ 3959 sctppcbinfo.ipi_count_asoc = 0; 3960 sctppcbinfo.ipi_gencnt_asoc = 0; 3961 /* local addrlist zone info */ 3962 sctppcbinfo.ipi_count_laddr = 0; 3963 sctppcbinfo.ipi_gencnt_laddr = 0; 3964 /* remote addrlist zone info */ 3965 sctppcbinfo.ipi_count_raddr = 0; 3966 sctppcbinfo.ipi_gencnt_raddr = 0; 3967 /* chunk info */ 3968 sctppcbinfo.ipi_count_chunk = 0; 3969 sctppcbinfo.ipi_gencnt_chunk = 0; 3970 3971 /* socket queue zone info */ 3972 sctppcbinfo.ipi_count_sockq = 0; 3973 sctppcbinfo.ipi_gencnt_sockq = 0; 3974 3975 /* mbuf tracker */ 3976 sctppcbinfo.mbuf_track = 0; 3977 /* port stuff */ 3978 #if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__APPLE__) 3979 sctppcbinfo.lastlow = ipport_firstauto; 3980 #else 3981 sctppcbinfo.lastlow = anonportmin; 3982 #endif 3983 /* Init the TIMEWAIT list */ 3984 for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) { 3985 LIST_INIT(&sctppcbinfo.vtag_timewait[i]); 3986 } 3987 3988 #if defined(_SCTP_NEEDS_CALLOUT_) && !defined(__APPLE__) 3989 TAILQ_INIT(&sctppcbinfo.callqueue); 3990 #endif 3991 3992 } 3993 3994 int 3995 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m, 3996 int iphlen, int offset, int limit, struct sctphdr *sh, 3997 struct sockaddr *altsa) 3998 { 3999 /* 4000 * grub through the INIT pulling addresses and 4001 * loading them to the nets structure in the asoc. 4002 * The from address in the mbuf should also be loaded 4003 * (if it is not already). This routine can be called 4004 * with either INIT or INIT-ACK's as long as the 4005 * m points to the IP packet and the offset points 4006 * to the beginning of the parameters. 4007 */ 4008 struct sctp_inpcb *inp, *l_inp; 4009 struct sctp_nets *net, *net_tmp; 4010 struct ip *iph; 4011 struct sctp_paramhdr *phdr, parm_buf; 4012 struct sctp_tcb *stcb_tmp; 4013 u_int16_t ptype, plen; 4014 struct sockaddr *sa; 4015 struct sockaddr_storage dest_store; 4016 struct sockaddr *local_sa = (struct sockaddr *)&dest_store; 4017 struct sockaddr_in sin; 4018 struct sockaddr_in6 sin6; 4019 4020 /* First get the destination address setup too. */ 4021 memset(&sin, 0, sizeof(sin)); 4022 memset(&sin6, 0, sizeof(sin6)); 4023 4024 sin.sin_family = AF_INET; 4025 sin.sin_len = sizeof(sin); 4026 sin.sin_port = stcb->rport; 4027 4028 sin6.sin6_family = AF_INET6; 4029 sin6.sin6_len = sizeof(struct sockaddr_in6); 4030 sin6.sin6_port = stcb->rport; 4031 if (altsa == NULL) { 4032 iph = mtod(m, struct ip *); 4033 if (iph->ip_v == IPVERSION) { 4034 /* its IPv4 */ 4035 struct sockaddr_in *sin_2; 4036 sin_2 = (struct sockaddr_in *)(local_sa); 4037 memset(sin_2, 0, sizeof(sin)); 4038 sin_2->sin_family = AF_INET; 4039 sin_2->sin_len = sizeof(sin); 4040 sin_2->sin_port = sh->dest_port; 4041 sin_2->sin_addr.s_addr = iph->ip_dst.s_addr ; 4042 sin.sin_addr = iph->ip_src; 4043 sa = (struct sockaddr *)&sin; 4044 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 4045 /* its IPv6 */ 4046 struct ip6_hdr *ip6; 4047 struct sockaddr_in6 *sin6_2; 4048 4049 ip6 = mtod(m, struct ip6_hdr *); 4050 sin6_2 = (struct sockaddr_in6 *)(local_sa); 4051 memset(sin6_2, 0, sizeof(sin6)); 4052 sin6_2->sin6_family = AF_INET6; 4053 sin6_2->sin6_len = sizeof(struct sockaddr_in6); 4054 sin6_2->sin6_port = sh->dest_port; 4055 sin6.sin6_addr = ip6->ip6_src; 4056 sa = (struct sockaddr *)&sin6; 4057 } else { 4058 sa = NULL; 4059 } 4060 } else { 4061 /* 4062 * For cookies we use the src address NOT from the packet 4063 * but from the original INIT 4064 */ 4065 sa = altsa; 4066 } 4067 /* Turn off ECN until we get through all params */ 4068 stcb->asoc.ecn_allowed = 0; 4069 4070 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 4071 /* mark all addresses that we have currently on the list */ 4072 net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC; 4073 } 4074 /* does the source address already exist? if so skip it */ 4075 l_inp = inp = stcb->sctp_ep; 4076 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, local_sa, stcb); 4077 if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) { 4078 /* we must add the source address */ 4079 /* no scope set here since we have a tcb already. */ 4080 if ((sa->sa_family == AF_INET) && 4081 (stcb->asoc.ipv4_addr_legal)) { 4082 if (sctp_add_remote_addr(stcb, sa, 0, 2)) { 4083 return (-1); 4084 } 4085 } else if ((sa->sa_family == AF_INET6) && 4086 (stcb->asoc.ipv6_addr_legal)) { 4087 if (sctp_add_remote_addr(stcb, sa, 0, 3)) { 4088 return (-1); 4089 } 4090 } 4091 } else { 4092 if (net_tmp != NULL && stcb_tmp == stcb) { 4093 net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC; 4094 } else if (stcb_tmp != stcb) { 4095 /* It belongs to another association? */ 4096 return (-1); 4097 } 4098 } 4099 /* since a unlock occured we must check the 4100 * TCB's state and the pcb's gone flags. 4101 */ 4102 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4103 /* the user freed the ep */ 4104 return (-1); 4105 } 4106 if (stcb->asoc.state == 0) { 4107 /* the assoc was freed? */ 4108 return (-1); 4109 } 4110 4111 /* now we must go through each of the params. */ 4112 phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf)); 4113 while (phdr) { 4114 ptype = ntohs(phdr->param_type); 4115 plen = ntohs(phdr->param_length); 4116 /*printf("ptype => %d, plen => %d\n", ptype, plen);*/ 4117 if (offset + plen > limit) { 4118 break; 4119 } 4120 if (plen == 0) { 4121 break; 4122 } 4123 if ((ptype == SCTP_IPV4_ADDRESS) && 4124 (stcb->asoc.ipv4_addr_legal)) { 4125 struct sctp_ipv4addr_param *p4, p4_buf; 4126 /* ok get the v4 address and check/add */ 4127 phdr = sctp_get_next_param(m, offset, 4128 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 4129 if (plen != sizeof(struct sctp_ipv4addr_param) || 4130 phdr == NULL) { 4131 return (-1); 4132 } 4133 p4 = (struct sctp_ipv4addr_param *)phdr; 4134 sin.sin_addr.s_addr = p4->addr; 4135 sa = (struct sockaddr *)&sin; 4136 inp = stcb->sctp_ep; 4137 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net, 4138 local_sa, stcb); 4139 4140 if ((stcb_tmp== NULL && inp == stcb->sctp_ep) || 4141 inp == NULL) { 4142 /* we must add the source address */ 4143 /* no scope set since we have a tcb already */ 4144 4145 /* we must validate the state again here */ 4146 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4147 /* the user freed the ep */ 4148 return (-1); 4149 } 4150 if (stcb->asoc.state == 0) { 4151 /* the assoc was freed? */ 4152 return (-1); 4153 } 4154 if (sctp_add_remote_addr(stcb, sa, 0, 4)) { 4155 return (-1); 4156 } 4157 } else if (stcb_tmp == stcb) { 4158 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4159 /* the user freed the ep */ 4160 return (-1); 4161 } 4162 if (stcb->asoc.state == 0) { 4163 /* the assoc was freed? */ 4164 return (-1); 4165 } 4166 if (net != NULL) { 4167 /* clear flag */ 4168 net->dest_state &= 4169 ~SCTP_ADDR_NOT_IN_ASSOC; 4170 } 4171 } else { 4172 /* strange, address is in another assoc? 4173 * straighten out locks. 4174 */ 4175 SCTP_TCB_UNLOCK(stcb_tmp); 4176 SCTP_INP_RLOCK(inp); 4177 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4178 /* the user freed the ep */ 4179 SCTP_INP_RUNLOCK(l_inp); 4180 return (-1); 4181 } 4182 if (stcb->asoc.state == 0) { 4183 /* the assoc was freed? */ 4184 SCTP_INP_RUNLOCK(l_inp); 4185 return (-1); 4186 } 4187 SCTP_TCB_LOCK(stcb); 4188 SCTP_INP_RUNLOCK(stcb->sctp_ep); 4189 return (-1); 4190 } 4191 } else if ((ptype == SCTP_IPV6_ADDRESS) && 4192 (stcb->asoc.ipv6_addr_legal)) { 4193 /* ok get the v6 address and check/add */ 4194 struct sctp_ipv6addr_param *p6, p6_buf; 4195 phdr = sctp_get_next_param(m, offset, 4196 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 4197 if (plen != sizeof(struct sctp_ipv6addr_param) || 4198 phdr == NULL) { 4199 return (-1); 4200 } 4201 p6 = (struct sctp_ipv6addr_param *)phdr; 4202 memcpy((void *)&sin6.sin6_addr, p6->addr, 4203 sizeof(p6->addr)); 4204 sa = (struct sockaddr *)&sin6; 4205 inp = stcb->sctp_ep; 4206 stcb_tmp= sctp_findassociation_ep_addr(&inp, sa, &net, 4207 local_sa, stcb); 4208 if (stcb_tmp == NULL && (inp == stcb->sctp_ep || 4209 inp == NULL)) { 4210 /* we must validate the state again here */ 4211 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4212 /* the user freed the ep */ 4213 return (-1); 4214 } 4215 if (stcb->asoc.state == 0) { 4216 /* the assoc was freed? */ 4217 return (-1); 4218 } 4219 /* we must add the address, no scope set */ 4220 if (sctp_add_remote_addr(stcb, sa, 0, 5)) { 4221 return (-1); 4222 } 4223 } else if (stcb_tmp == stcb) { 4224 /* we must validate the state again here */ 4225 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4226 /* the user freed the ep */ 4227 return (-1); 4228 } 4229 if (stcb->asoc.state == 0) { 4230 /* the assoc was freed? */ 4231 return (-1); 4232 } 4233 if (net != NULL) { 4234 /* clear flag */ 4235 net->dest_state &= 4236 ~SCTP_ADDR_NOT_IN_ASSOC; 4237 } 4238 } else { 4239 /* strange, address is in another assoc? 4240 * straighten out locks. 4241 */ 4242 SCTP_TCB_UNLOCK(stcb_tmp); 4243 SCTP_INP_RLOCK(l_inp); 4244 /* we must validate the state again here */ 4245 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4246 /* the user freed the ep */ 4247 SCTP_INP_RUNLOCK(l_inp); 4248 return (-1); 4249 } 4250 if (stcb->asoc.state == 0) { 4251 /* the assoc was freed? */ 4252 SCTP_INP_RUNLOCK(l_inp); 4253 return (-1); 4254 } 4255 SCTP_TCB_LOCK(stcb); 4256 SCTP_INP_RUNLOCK(l_inp); 4257 return (-1); 4258 } 4259 } else if (ptype == SCTP_ECN_CAPABLE) { 4260 stcb->asoc.ecn_allowed = 1; 4261 } else if (ptype == SCTP_ULP_ADAPTION) { 4262 if (stcb->asoc.state != SCTP_STATE_OPEN) { 4263 struct sctp_adaption_layer_indication ai, *aip; 4264 4265 phdr = sctp_get_next_param(m, offset, 4266 (struct sctp_paramhdr *)&ai, sizeof(ai)); 4267 aip = (struct sctp_adaption_layer_indication *)phdr; 4268 sctp_ulp_notify(SCTP_NOTIFY_ADAPTION_INDICATION, 4269 stcb, ntohl(aip->indication), NULL); 4270 } 4271 } else if (ptype == SCTP_SET_PRIM_ADDR) { 4272 struct sctp_asconf_addr_param lstore, *fee; 4273 struct sctp_asconf_addrv4_param *fii; 4274 int lptype; 4275 struct sockaddr *lsa = NULL; 4276 4277 stcb->asoc.peer_supports_asconf = 1; 4278 stcb->asoc.peer_supports_asconf_setprim = 1; 4279 if (plen > sizeof(lstore)) { 4280 return (-1); 4281 } 4282 phdr = sctp_get_next_param(m, offset, 4283 (struct sctp_paramhdr *)&lstore, plen); 4284 if (phdr == NULL) { 4285 return (-1); 4286 } 4287 4288 fee = (struct sctp_asconf_addr_param *)phdr; 4289 lptype = ntohs(fee->addrp.ph.param_type); 4290 if (lptype == SCTP_IPV4_ADDRESS) { 4291 if (plen != 4292 sizeof(struct sctp_asconf_addrv4_param)) { 4293 printf("Sizeof setprim in init/init ack not %d but %d - ignored\n", 4294 (int)sizeof(struct sctp_asconf_addrv4_param), 4295 plen); 4296 } else { 4297 fii = (struct sctp_asconf_addrv4_param *)fee; 4298 sin.sin_addr.s_addr = fii->addrp.addr; 4299 lsa = (struct sockaddr *)&sin; 4300 } 4301 } else if (lptype == SCTP_IPV6_ADDRESS) { 4302 if (plen != 4303 sizeof(struct sctp_asconf_addr_param)) { 4304 printf("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n", 4305 (int)sizeof(struct sctp_asconf_addr_param), 4306 plen); 4307 } else { 4308 memcpy(sin6.sin6_addr.s6_addr, 4309 fee->addrp.addr, 4310 sizeof(fee->addrp.addr)); 4311 lsa = (struct sockaddr *)&sin6; 4312 } 4313 } 4314 if (lsa) { 4315 sctp_set_primary_addr(stcb, sa, NULL); 4316 } 4317 4318 } else if (ptype == SCTP_PRSCTP_SUPPORTED) { 4319 /* Peer supports pr-sctp */ 4320 stcb->asoc.peer_supports_prsctp = 1; 4321 } else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) { 4322 /* A supported extension chunk */ 4323 struct sctp_supported_chunk_types_param *pr_supported; 4324 uint8_t local_store[128]; 4325 int num_ent, i; 4326 4327 phdr = sctp_get_next_param(m, offset, 4328 (struct sctp_paramhdr *)&local_store, plen); 4329 if (phdr == NULL) { 4330 return (-1); 4331 } 4332 stcb->asoc.peer_supports_asconf = 0; 4333 stcb->asoc.peer_supports_asconf_setprim = 0; 4334 stcb->asoc.peer_supports_prsctp = 0; 4335 stcb->asoc.peer_supports_pktdrop = 0; 4336 stcb->asoc.peer_supports_strreset = 0; 4337 pr_supported = (struct sctp_supported_chunk_types_param *)phdr; 4338 num_ent = plen - sizeof(struct sctp_paramhdr); 4339 for (i=0; i<num_ent; i++) { 4340 switch (pr_supported->chunk_types[i]) { 4341 case SCTP_ASCONF: 4342 stcb->asoc.peer_supports_asconf = 1; 4343 stcb->asoc.peer_supports_asconf_setprim = 1; 4344 break; 4345 case SCTP_ASCONF_ACK: 4346 stcb->asoc.peer_supports_asconf = 1; 4347 stcb->asoc.peer_supports_asconf_setprim = 1; 4348 break; 4349 case SCTP_FORWARD_CUM_TSN: 4350 stcb->asoc.peer_supports_prsctp = 1; 4351 break; 4352 case SCTP_PACKET_DROPPED: 4353 stcb->asoc.peer_supports_pktdrop = 1; 4354 break; 4355 case SCTP_STREAM_RESET: 4356 stcb->asoc.peer_supports_strreset = 1; 4357 break; 4358 default: 4359 /* one I have not learned yet */ 4360 break; 4361 4362 } 4363 } 4364 } else if (ptype == SCTP_ECN_NONCE_SUPPORTED) { 4365 /* Peer supports ECN-nonce */ 4366 stcb->asoc.peer_supports_ecn_nonce = 1; 4367 stcb->asoc.ecn_nonce_allowed = 1; 4368 } else if ((ptype == SCTP_HEARTBEAT_INFO) || 4369 (ptype == SCTP_STATE_COOKIE) || 4370 (ptype == SCTP_UNRECOG_PARAM) || 4371 (ptype == SCTP_COOKIE_PRESERVE) || 4372 (ptype == SCTP_SUPPORTED_ADDRTYPE) || 4373 (ptype == SCTP_ADD_IP_ADDRESS) || 4374 (ptype == SCTP_DEL_IP_ADDRESS) || 4375 (ptype == SCTP_ERROR_CAUSE_IND) || 4376 (ptype == SCTP_SUCCESS_REPORT)) { 4377 /* don't care */; 4378 } else { 4379 if ((ptype & 0x8000) == 0x0000) { 4380 /* must stop processing the rest of 4381 * the param's. Any report bits were 4382 * handled with the call to sctp_arethere_unrecognized_parameters() 4383 * when the INIT or INIT-ACK was first seen. 4384 */ 4385 break; 4386 } 4387 } 4388 offset += SCTP_SIZE32(plen); 4389 if (offset >= limit) { 4390 break; 4391 } 4392 phdr = sctp_get_next_param(m, offset, &parm_buf, 4393 sizeof(parm_buf)); 4394 } 4395 /* Now check to see if we need to purge any addresses */ 4396 for (net = TAILQ_FIRST(&stcb->asoc.nets); net != NULL; net = net_tmp) { 4397 net_tmp = TAILQ_NEXT(net, sctp_next); 4398 if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) == 4399 SCTP_ADDR_NOT_IN_ASSOC) { 4400 /* This address has been removed from the asoc */ 4401 /* remove and free it */ 4402 stcb->asoc.numnets--; 4403 TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next); 4404 sctp_free_remote_addr(net); 4405 if (net == stcb->asoc.primary_destination) { 4406 stcb->asoc.primary_destination = NULL; 4407 sctp_select_primary_destination(stcb); 4408 } 4409 } 4410 } 4411 return (0); 4412 } 4413 4414 int 4415 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa, 4416 struct sctp_nets *net) 4417 { 4418 /* make sure the requested primary address exists in the assoc */ 4419 if (net == NULL && sa) 4420 net = sctp_findnet(stcb, sa); 4421 4422 if (net == NULL) { 4423 /* didn't find the requested primary address! */ 4424 return (-1); 4425 } else { 4426 /* set the primary address */ 4427 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 4428 /* Must be confirmed */ 4429 return (-1); 4430 } 4431 stcb->asoc.primary_destination = net; 4432 net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY; 4433 return (0); 4434 } 4435 } 4436 4437 4438 int 4439 sctp_is_vtag_good(struct sctp_inpcb *inp, u_int32_t tag, struct timeval *now) 4440 { 4441 /* 4442 * This function serves two purposes. It will see if a TAG can be 4443 * re-used and return 1 for yes it is ok and 0 for don't use that 4444 * tag. 4445 * A secondary function it will do is purge out old tags that can 4446 * be removed. 4447 */ 4448 struct sctpasochead *head; 4449 struct sctpvtaghead *chain; 4450 struct sctp_tagblock *twait_block; 4451 struct sctp_tcb *stcb; 4452 4453 int i; 4454 SCTP_INP_INFO_WLOCK(); 4455 chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)]; 4456 /* First is the vtag in use ? */ 4457 4458 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(tag, 4459 sctppcbinfo.hashasocmark)]; 4460 if (head == NULL) { 4461 SCTP_INP_INFO_WUNLOCK(); 4462 return (0); 4463 } 4464 LIST_FOREACH(stcb, head, sctp_asocs) { 4465 if (stcb->asoc.my_vtag == tag) { 4466 /* We should remove this if and 4467 * return 0 always if we want vtags 4468 * unique across all endpoints. For 4469 * now within a endpoint is ok. 4470 */ 4471 if (inp == stcb->sctp_ep) { 4472 /* bad tag, in use */ 4473 SCTP_INP_INFO_WUNLOCK(); 4474 return (0); 4475 } 4476 } 4477 } 4478 if (!LIST_EMPTY(chain)) { 4479 /* 4480 * Block(s) are present, lets see if we have this tag in 4481 * the list 4482 */ 4483 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) { 4484 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) { 4485 if (twait_block->vtag_block[i].v_tag == 0) { 4486 /* not used */ 4487 continue; 4488 } else if ((long)twait_block->vtag_block[i].tv_sec_at_expire > 4489 now->tv_sec) { 4490 /* Audit expires this guy */ 4491 twait_block->vtag_block[i].tv_sec_at_expire = 0; 4492 twait_block->vtag_block[i].v_tag = 0; 4493 } else if (twait_block->vtag_block[i].v_tag == 4494 tag) { 4495 /* Bad tag, sorry :< */ 4496 SCTP_INP_INFO_WUNLOCK(); 4497 return (0); 4498 } 4499 } 4500 } 4501 } 4502 /* Not found, ok to use the tag */ 4503 SCTP_INP_INFO_WUNLOCK(); 4504 return (1); 4505 } 4506 4507 4508 /* 4509 * Delete the address from the endpoint local address list 4510 * Lookup using a sockaddr address (ie. not an ifaddr) 4511 */ 4512 int 4513 sctp_del_local_addr_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa) 4514 { 4515 struct sctp_laddr *laddr; 4516 struct sockaddr *l_sa; 4517 int found = 0; 4518 /* Here is another function I cannot find a 4519 * caller for. As such we SHOULD delete it 4520 * if we have no users. If we find a user that 4521 * user MUST have the INP locked. 4522 * 4523 */ 4524 4525 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 4526 /* You are already bound to all. You have it already */ 4527 return (EINVAL); 4528 } 4529 4530 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 4531 /* make sure the address exists */ 4532 if (laddr->ifa == NULL) 4533 continue; 4534 if (laddr->ifa->ifa_addr == NULL) 4535 continue; 4536 4537 l_sa = laddr->ifa->ifa_addr; 4538 if (l_sa->sa_family == AF_INET6) { 4539 /* IPv6 address */ 4540 struct sockaddr_in6 *sin1, *sin2; 4541 sin1 = (struct sockaddr_in6 *)l_sa; 4542 sin2 = (struct sockaddr_in6 *)sa; 4543 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr, 4544 sizeof(struct in6_addr)) == 0) { 4545 /* matched */ 4546 found = 1; 4547 break; 4548 } 4549 } else if (l_sa->sa_family == AF_INET) { 4550 /* IPv4 address */ 4551 struct sockaddr_in *sin1, *sin2; 4552 sin1 = (struct sockaddr_in *)l_sa; 4553 sin2 = (struct sockaddr_in *)sa; 4554 if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) { 4555 /* matched */ 4556 found = 1; 4557 break; 4558 } 4559 } else { 4560 /* invalid family */ 4561 return (-1); 4562 } 4563 } 4564 4565 if (found && inp->laddr_count < 2) { 4566 /* can't delete unless there are at LEAST 2 addresses */ 4567 return (-1); 4568 } 4569 4570 if (found && (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 4571 /* 4572 * remove it from the ep list, this should NOT be 4573 * done until its really gone from the interface list and 4574 * we won't be receiving more of these. Probably right 4575 * away. If we do allow a removal of an address from 4576 * an association (sub-set bind) than this should NOT 4577 * be called until the all ASCONF come back from this 4578 * association. 4579 */ 4580 sctp_remove_laddr(laddr); 4581 return (0); 4582 } else { 4583 return (-1); 4584 } 4585 } 4586 4587 static void 4588 sctp_drain_mbufs(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 4589 { 4590 /* 4591 * We must hunt this association for MBUF's past the cumack 4592 * (i.e. out of order data that we can renege on). 4593 */ 4594 struct sctp_association *asoc; 4595 struct sctp_tmit_chunk *chk, *nchk; 4596 u_int32_t cumulative_tsn_p1, tsn; 4597 int cnt, strmat, gap; 4598 /* We look for anything larger than the cum-ack + 1 */ 4599 4600 asoc = &stcb->asoc; 4601 cumulative_tsn_p1 = asoc->cumulative_tsn + 1; 4602 cnt = 0; 4603 /* First look in the re-assembly queue */ 4604 chk = TAILQ_FIRST(&asoc->reasmqueue); 4605 while (chk) { 4606 /* Get the next one */ 4607 nchk = TAILQ_NEXT(chk, sctp_next); 4608 if (compare_with_wrap(chk->rec.data.TSN_seq, 4609 cumulative_tsn_p1, MAX_TSN)) { 4610 /* Yep it is above cum-ack */ 4611 cnt++; 4612 tsn = chk->rec.data.TSN_seq; 4613 if (tsn >= asoc->mapping_array_base_tsn) { 4614 gap = tsn - asoc->mapping_array_base_tsn; 4615 } else { 4616 gap = (MAX_TSN - asoc->mapping_array_base_tsn) + 4617 tsn + 1; 4618 } 4619 asoc->size_on_reasm_queue -= chk->send_size; 4620 asoc->cnt_on_reasm_queue--; 4621 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap); 4622 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next); 4623 if (chk->data) { 4624 sctp_m_freem(chk->data); 4625 chk->data = NULL; 4626 } 4627 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4628 sctppcbinfo.ipi_count_chunk--; 4629 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4630 panic("Chunk count is negative"); 4631 } 4632 sctppcbinfo.ipi_gencnt_chunk++; 4633 } 4634 chk = nchk; 4635 } 4636 /* Ok that was fun, now we will drain all the inbound streams? */ 4637 for (strmat = 0; strmat < asoc->streamincnt; strmat++) { 4638 chk = TAILQ_FIRST(&asoc->strmin[strmat].inqueue); 4639 while (chk) { 4640 nchk = TAILQ_NEXT(chk, sctp_next); 4641 if (compare_with_wrap(chk->rec.data.TSN_seq, 4642 cumulative_tsn_p1, MAX_TSN)) { 4643 /* Yep it is above cum-ack */ 4644 cnt++; 4645 tsn = chk->rec.data.TSN_seq; 4646 if (tsn >= asoc->mapping_array_base_tsn) { 4647 gap = tsn - 4648 asoc->mapping_array_base_tsn; 4649 } else { 4650 gap = (MAX_TSN - 4651 asoc->mapping_array_base_tsn) + 4652 tsn + 1; 4653 } 4654 asoc->size_on_all_streams -= chk->send_size; 4655 asoc->cnt_on_all_streams--; 4656 4657 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, 4658 gap); 4659 TAILQ_REMOVE(&asoc->strmin[strmat].inqueue, 4660 chk, sctp_next); 4661 if (chk->data) { 4662 sctp_m_freem(chk->data); 4663 chk->data = NULL; 4664 } 4665 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4666 sctppcbinfo.ipi_count_chunk--; 4667 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4668 panic("Chunk count is negative"); 4669 } 4670 sctppcbinfo.ipi_gencnt_chunk++; 4671 } 4672 chk = nchk; 4673 } 4674 } 4675 /* 4676 * Question, should we go through the delivery queue? 4677 * The only reason things are on here is the app not reading OR a 4678 * p-d-api up. An attacker COULD send enough in to initiate the 4679 * PD-API and then send a bunch of stuff to other streams... these 4680 * would wind up on the delivery queue.. and then we would not get 4681 * to them. But in order to do this I then have to back-track and 4682 * un-deliver sequence numbers in streams.. el-yucko. I think for 4683 * now we will NOT look at the delivery queue and leave it to be 4684 * something to consider later. An alternative would be to abort 4685 * the P-D-API with a notification and then deliver the data.... 4686 * Or another method might be to keep track of how many times the 4687 * situation occurs and if we see a possible attack underway just 4688 * abort the association. 4689 */ 4690 #ifdef SCTP_DEBUG 4691 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 4692 if (cnt) { 4693 printf("Freed %d chunks from reneg harvest\n", cnt); 4694 } 4695 } 4696 #endif /* SCTP_DEBUG */ 4697 4698 /* 4699 * Another issue, in un-setting the TSN's in the mapping array we 4700 * DID NOT adjust the higest_tsn marker. This will cause one of 4701 * two things to occur. It may cause us to do extra work in checking 4702 * for our mapping array movement. More importantly it may cause us 4703 * to SACK every datagram. This may not be a bad thing though since 4704 * we will recover once we get our cum-ack above and all this stuff 4705 * we dumped recovered. 4706 */ 4707 } 4708 4709 void 4710 sctp_drain(void) 4711 { 4712 /* 4713 * We must walk the PCB lists for ALL associations here. The system 4714 * is LOW on MBUF's and needs help. This is where reneging will 4715 * occur. We really hope this does NOT happen! 4716 */ 4717 struct sctp_inpcb *inp; 4718 struct sctp_tcb *stcb; 4719 4720 SCTP_INP_INFO_RLOCK(); 4721 LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) { 4722 /* For each endpoint */ 4723 SCTP_INP_RLOCK(inp); 4724 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 4725 /* For each association */ 4726 SCTP_TCB_LOCK(stcb); 4727 sctp_drain_mbufs(inp, stcb); 4728 SCTP_TCB_UNLOCK(stcb); 4729 } 4730 SCTP_INP_RUNLOCK(inp); 4731 } 4732 SCTP_INP_INFO_RUNLOCK(); 4733 } 4734 4735 int 4736 sctp_add_to_socket_q(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 4737 { 4738 struct sctp_socket_q_list *sq; 4739 4740 /* write lock on INP assumed */ 4741 if ((inp == NULL) || (stcb == NULL)) { 4742 /* I am paranoid */ 4743 return (0); 4744 } 4745 sq = (struct sctp_socket_q_list *)SCTP_ZONE_GET( 4746 sctppcbinfo.ipi_zone_sockq); 4747 if (sq == NULL) { 4748 /* out of sq structs */ 4749 return (0); 4750 } 4751 sctppcbinfo.ipi_count_sockq++; 4752 sctppcbinfo.ipi_gencnt_sockq++; 4753 if (stcb) 4754 stcb->asoc.cnt_msg_on_sb++; 4755 sq->tcb = stcb; 4756 TAILQ_INSERT_TAIL(&inp->sctp_queue_list, sq, next_sq); 4757 return (1); 4758 } 4759 4760 4761 struct sctp_tcb * 4762 sctp_remove_from_socket_q(struct sctp_inpcb *inp) 4763 { 4764 struct sctp_tcb *stcb = NULL; 4765 struct sctp_socket_q_list *sq; 4766 4767 /* W-Lock on INP assumed held */ 4768 sq = TAILQ_FIRST(&inp->sctp_queue_list); 4769 if (sq == NULL) 4770 return (NULL); 4771 4772 stcb = sq->tcb; 4773 TAILQ_REMOVE(&inp->sctp_queue_list, sq, next_sq); 4774 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_sockq, sq); 4775 sctppcbinfo.ipi_count_sockq--; 4776 sctppcbinfo.ipi_gencnt_sockq++; 4777 if (stcb) { 4778 stcb->asoc.cnt_msg_on_sb--; 4779 } 4780 return (stcb); 4781 } 4782 4783 int 4784 sctp_initiate_iterator(asoc_func af, uint32_t pcb_state, uint32_t asoc_state, 4785 void *argp, uint32_t argi, end_func ef, 4786 struct sctp_inpcb *s_inp) 4787 { 4788 struct sctp_iterator *it=NULL; 4789 int s; 4790 if (af == NULL) { 4791 return (-1); 4792 } 4793 it = malloc(sizeof(struct sctp_iterator), M_PCB, M_WAITOK); 4794 if (it == NULL) { 4795 return (ENOMEM); 4796 } 4797 memset(it, 0, sizeof(*it)); 4798 it->function_toapply = af; 4799 it->function_atend = ef; 4800 it->pointer = argp; 4801 it->val = argi; 4802 it->pcb_flags = pcb_state; 4803 it->asoc_state = asoc_state; 4804 if (s_inp) { 4805 it->inp = s_inp; 4806 it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP; 4807 } else { 4808 SCTP_INP_INFO_RLOCK(); 4809 it->inp = LIST_FIRST(&sctppcbinfo.listhead); 4810 SCTP_INP_INFO_RUNLOCK(); 4811 it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP; 4812 4813 } 4814 /* Init the timer */ 4815 callout_init(&it->tmr.timer, 0); 4816 /* add to the list of all iterators */ 4817 SCTP_INP_INFO_WLOCK(); 4818 LIST_INSERT_HEAD(&sctppcbinfo.iteratorhead, it, sctp_nxt_itr); 4819 SCTP_INP_INFO_WUNLOCK(); 4820 s = splsoftnet(); 4821 sctp_iterator_timer(it); 4822 splx(s); 4823 return (0); 4824 } 4825 4826 4827