1 /* $KAME: sctp_pcb.c,v 1.39 2005/06/16 18:29:25 jinmei Exp $ */ 2 /* $NetBSD: sctp_pcb.c,v 1.8 2016/12/08 05:16:33 ozaki-r Exp $ */ 3 4 /* 5 * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. All advertising materials mentioning features or use of this software 17 * must display the following acknowledgement: 18 * This product includes software developed by Cisco Systems, Inc. 19 * 4. Neither the name of the project nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY CISCO SYSTEMS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL CISCO SYSTEMS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 #include <sys/cdefs.h> 36 __KERNEL_RCSID(0, "$NetBSD: sctp_pcb.c,v 1.8 2016/12/08 05:16:33 ozaki-r Exp $"); 37 38 #ifdef _KERNEL_OPT 39 #include "opt_inet.h" 40 #include "opt_sctp.h" 41 #endif /* _KERNEL_OPT */ 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/malloc.h> 46 #include <sys/mbuf.h> 47 #include <sys/domain.h> 48 #include <sys/protosw.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/proc.h> 52 #include <sys/kauth.h> 53 #include <sys/kernel.h> 54 #include <sys/sysctl.h> 55 #include <sys/rnd.h> 56 #include <sys/callout.h> 57 58 #include <machine/limits.h> 59 #include <machine/cpu.h> 60 61 #include <net/if.h> 62 #include <net/if_types.h> 63 #include <net/route.h> 64 #include <netinet/in.h> 65 #include <netinet/in_systm.h> 66 #include <netinet/ip.h> 67 #include <netinet/in_pcb.h> 68 #include <netinet/in_var.h> 69 #include <netinet/ip_var.h> 70 71 #ifdef INET6 72 #include <netinet/ip6.h> 73 #include <netinet6/ip6_var.h> 74 #include <netinet6/scope6_var.h> 75 #include <netinet6/in6_pcb.h> 76 #endif /* INET6 */ 77 78 #ifdef IPSEC 79 #include <netipsec/ipsec.h> 80 #include <netipsec/key.h> 81 #endif /* IPSEC */ 82 83 #include <netinet/sctp_var.h> 84 #include <netinet/sctp_pcb.h> 85 #include <netinet/sctputil.h> 86 #include <netinet/sctp.h> 87 #include <netinet/sctp_header.h> 88 #include <netinet/sctp_asconf.h> 89 #include <netinet/sctp_output.h> 90 #include <netinet/sctp_timer.h> 91 92 #ifndef SCTP_PCBHASHSIZE 93 /* default number of association hash buckets in each endpoint */ 94 #define SCTP_PCBHASHSIZE 256 95 #endif 96 97 #ifdef SCTP_DEBUG 98 u_int32_t sctp_debug_on = SCTP_DEBUG_ALL; 99 #endif /* SCTP_DEBUG */ 100 101 u_int32_t sctp_pegs[SCTP_NUMBER_OF_PEGS]; 102 103 int sctp_pcbtblsize = SCTP_PCBHASHSIZE; 104 105 struct sctp_epinfo sctppcbinfo; 106 107 /* FIX: we don't handle multiple link local scopes */ 108 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */ 109 int 110 SCTP6_ARE_ADDR_EQUAL(const struct in6_addr *a, const struct in6_addr *b) 111 { 112 struct in6_addr tmp_a, tmp_b; 113 /* use a copy of a and b */ 114 tmp_a = *a; 115 tmp_b = *b; 116 in6_clearscope(&tmp_a); 117 in6_clearscope(&tmp_b); 118 return (IN6_ARE_ADDR_EQUAL(&tmp_a, &tmp_b)); 119 } 120 121 #if defined(__FreeBSD__) && __FreeBSD_version > 500000 122 123 #ifndef xyzzy 124 void sctp_validate_no_locks(void); 125 126 void 127 SCTP_INP_RLOCK(struct sctp_inpcb *inp) 128 { 129 struct sctp_tcb *stcb; 130 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 131 if (mtx_owned(&(stcb)->tcb_mtx)) 132 panic("I own TCB lock?"); 133 } 134 if (mtx_owned(&(inp)->inp_mtx)) 135 panic("INP Recursive Lock-R"); 136 mtx_lock(&(inp)->inp_mtx); 137 } 138 139 void 140 SCTP_INP_WLOCK(struct sctp_inpcb *inp) 141 { 142 SCTP_INP_RLOCK(inp); 143 } 144 145 void 146 SCTP_INP_INFO_RLOCK() 147 { 148 struct sctp_inpcb *inp; 149 struct sctp_tcb *stcb; 150 LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) { 151 if (mtx_owned(&(inp)->inp_mtx)) 152 panic("info-lock and own inp lock?"); 153 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 154 if (mtx_owned(&(stcb)->tcb_mtx)) 155 panic("Info lock and own a tcb lock?"); 156 } 157 } 158 if (mtx_owned(&sctppcbinfo.ipi_ep_mtx)) 159 panic("INP INFO Recursive Lock-R"); 160 mtx_lock(&sctppcbinfo.ipi_ep_mtx); 161 } 162 163 void 164 SCTP_INP_INFO_WLOCK() 165 { 166 SCTP_INP_INFO_RLOCK(); 167 } 168 169 170 void sctp_validate_no_locks() 171 { 172 struct sctp_inpcb *inp; 173 struct sctp_tcb *stcb; 174 175 if (mtx_owned(&sctppcbinfo.ipi_ep_mtx)) 176 panic("INP INFO lock is owned?"); 177 178 LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) { 179 if (mtx_owned(&(inp)->inp_mtx)) 180 panic("You own an INP lock?"); 181 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 182 if (mtx_owned(&(stcb)->tcb_mtx)) 183 panic("You own a TCB lock?"); 184 } 185 } 186 } 187 188 #endif 189 #endif 190 191 void 192 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb) 193 { 194 /* We really don't need 195 * to lock this, but I will 196 * just because it does not hurt. 197 */ 198 SCTP_INP_INFO_RLOCK(); 199 spcb->ep_count = sctppcbinfo.ipi_count_ep; 200 spcb->asoc_count = sctppcbinfo.ipi_count_asoc; 201 spcb->laddr_count = sctppcbinfo.ipi_count_laddr; 202 spcb->raddr_count = sctppcbinfo.ipi_count_raddr; 203 spcb->chk_count = sctppcbinfo.ipi_count_chunk; 204 spcb->sockq_count = sctppcbinfo.ipi_count_sockq; 205 spcb->mbuf_track = sctppcbinfo.mbuf_track; 206 SCTP_INP_INFO_RUNLOCK(); 207 } 208 209 210 /* 211 * Notes on locks for FreeBSD 5 and up. All association 212 * lookups that have a definte ep, the INP structure is 213 * assumed to be locked for reading. If we need to go 214 * find the INP (ususally when a **inp is passed) then 215 * we must lock the INFO structure first and if needed 216 * lock the INP too. Note that if we lock it we must 217 * 218 */ 219 220 221 /* 222 * Given a endpoint, look and find in its association list any association 223 * with the "to" address given. This can be a "from" address, too, for 224 * inbound packets. For outbound packets it is a true "to" address. 225 */ 226 static struct sctp_tcb * 227 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from, 228 struct sockaddr *to, struct sctp_nets **netp) 229 { 230 /**** ASSUMSES THE CALLER holds the INP_INFO_RLOCK */ 231 232 /* 233 * Note for this module care must be taken when observing what to is 234 * for. In most of the rest of the code the TO field represents my 235 * peer and the FROM field represents my address. For this module it 236 * is reversed of that. 237 */ 238 /* 239 * If we support the TCP model, then we must now dig through to 240 * see if we can find our endpoint in the list of tcp ep's. 241 */ 242 uint16_t lport, rport; 243 struct sctppcbhead *ephead; 244 struct sctp_inpcb *inp; 245 struct sctp_laddr *laddr; 246 struct sctp_tcb *stcb; 247 struct sctp_nets *net; 248 249 if ((to == NULL) || (from == NULL)) { 250 return (NULL); 251 } 252 253 if (to->sa_family == AF_INET && from->sa_family == AF_INET) { 254 lport = ((struct sockaddr_in *)to)->sin_port; 255 rport = ((struct sockaddr_in *)from)->sin_port; 256 } else if (to->sa_family == AF_INET6 && from->sa_family == AF_INET6) { 257 lport = ((struct sockaddr_in6 *)to)->sin6_port; 258 rport = ((struct sockaddr_in6 *)from)->sin6_port; 259 } else { 260 return NULL; 261 } 262 ephead = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR( 263 (lport + rport), sctppcbinfo.hashtcpmark)]; 264 /* 265 * Ok now for each of the guys in this bucket we must look 266 * and see: 267 * - Does the remote port match. 268 * - Does there single association's addresses match this 269 * address (to). 270 * If so we update p_ep to point to this ep and return the 271 * tcb from it. 272 */ 273 LIST_FOREACH(inp, ephead, sctp_hash) { 274 if (lport != inp->sctp_lport) { 275 continue; 276 } 277 SCTP_INP_RLOCK(inp); 278 /* check to see if the ep has one of the addresses */ 279 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 280 /* We are NOT bound all, so look further */ 281 int match = 0; 282 283 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 284 if (laddr->ifa == NULL) { 285 #ifdef SCTP_DEBUG 286 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 287 printf("An ounce of prevention is worth a pound of cure\n"); 288 } 289 #endif 290 continue; 291 } 292 if (laddr->ifa->ifa_addr == NULL) { 293 #ifdef SCTP_DEBUG 294 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 295 printf("ifa with a NULL address\n"); 296 } 297 #endif 298 continue; 299 } 300 if (laddr->ifa->ifa_addr->sa_family == 301 to->sa_family) { 302 /* see if it matches */ 303 struct sockaddr_in *intf_addr, *sin; 304 intf_addr = (struct sockaddr_in *) 305 laddr->ifa->ifa_addr; 306 sin = (struct sockaddr_in *)to; 307 if (from->sa_family == AF_INET) { 308 if (sin->sin_addr.s_addr == 309 intf_addr->sin_addr.s_addr) { 310 match = 1; 311 SCTP_INP_RUNLOCK(inp); 312 break; 313 } 314 } else { 315 struct sockaddr_in6 *intf_addr6; 316 struct sockaddr_in6 *sin6; 317 sin6 = (struct sockaddr_in6 *) 318 to; 319 intf_addr6 = (struct sockaddr_in6 *) 320 laddr->ifa->ifa_addr; 321 322 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 323 &intf_addr6->sin6_addr)) { 324 match = 1; 325 SCTP_INP_RUNLOCK(inp); 326 break; 327 } 328 } 329 } 330 } 331 if (match == 0) { 332 /* This endpoint does not have this address */ 333 SCTP_INP_RUNLOCK(inp); 334 continue; 335 } 336 } 337 /* 338 * Ok if we hit here the ep has the address, does it hold the 339 * tcb? 340 */ 341 342 stcb = LIST_FIRST(&inp->sctp_asoc_list); 343 if (stcb == NULL) { 344 SCTP_INP_RUNLOCK(inp); 345 continue; 346 } 347 SCTP_TCB_LOCK(stcb); 348 if (stcb->rport != rport) { 349 /* remote port does not match. */ 350 SCTP_TCB_UNLOCK(stcb); 351 SCTP_INP_RUNLOCK(inp); 352 continue; 353 } 354 /* Does this TCB have a matching address? */ 355 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 356 if (sctp_cmpaddr(from, rtcache_getdst(&net->ro))) { 357 /* found it */ 358 if (netp != NULL) { 359 *netp = net; 360 } 361 /* Update the endpoint pointer */ 362 *inp_p = inp; 363 SCTP_INP_RUNLOCK(inp); 364 return (stcb); 365 } 366 } 367 SCTP_TCB_UNLOCK(stcb); 368 369 SCTP_INP_RUNLOCK(inp); 370 } 371 return (NULL); 372 } 373 374 struct sctp_tcb * 375 sctp_findassociation_ep_asconf(struct mbuf *m, int iphlen, int offset, 376 struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp) 377 { 378 struct sctp_tcb *stcb; 379 struct sockaddr_in *sin; 380 struct sockaddr_in6 *sin6; 381 struct sockaddr_storage local_store, remote_store; 382 struct ip *iph; 383 struct sctp_paramhdr parm_buf, *phdr; 384 int ptype; 385 386 memset(&local_store, 0, sizeof(local_store)); 387 memset(&remote_store, 0, sizeof(remote_store)); 388 389 /* First get the destination address setup too. */ 390 iph = mtod(m, struct ip *); 391 if (iph->ip_v == IPVERSION) { 392 /* its IPv4 */ 393 sin = (struct sockaddr_in *)&local_store; 394 sin->sin_family = AF_INET; 395 sin->sin_len = sizeof(*sin); 396 sin->sin_port = sh->dest_port; 397 sin->sin_addr.s_addr = iph->ip_dst.s_addr ; 398 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 399 /* its IPv6 */ 400 struct ip6_hdr *ip6; 401 ip6 = mtod(m, struct ip6_hdr *); 402 sin6 = (struct sockaddr_in6 *)&local_store; 403 sin6->sin6_family = AF_INET6; 404 sin6->sin6_len = sizeof(*sin6); 405 sin6->sin6_port = sh->dest_port; 406 sin6->sin6_addr = ip6->ip6_dst; 407 } else { 408 return NULL; 409 } 410 411 phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk), 412 &parm_buf, sizeof(struct sctp_paramhdr)); 413 if (phdr == NULL) { 414 #ifdef SCTP_DEBUG 415 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 416 printf("sctp_process_control: failed to get asconf lookup addr\n"); 417 } 418 #endif /* SCTP_DEBUG */ 419 return NULL; 420 } 421 ptype = (int)((u_int)ntohs(phdr->param_type)); 422 /* get the correlation address */ 423 if (ptype == SCTP_IPV6_ADDRESS) { 424 /* ipv6 address param */ 425 struct sctp_ipv6addr_param *p6, p6_buf; 426 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) { 427 return NULL; 428 } 429 430 p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m, 431 offset + sizeof(struct sctp_asconf_chunk), 432 &p6_buf.ph, sizeof(*p6)); 433 if (p6 == NULL) { 434 #ifdef SCTP_DEBUG 435 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 436 printf("sctp_process_control: failed to get asconf v6 lookup addr\n"); 437 } 438 #endif /* SCTP_DEBUG */ 439 return (NULL); 440 } 441 sin6 = (struct sockaddr_in6 *)&remote_store; 442 sin6->sin6_family = AF_INET6; 443 sin6->sin6_len = sizeof(*sin6); 444 sin6->sin6_port = sh->src_port; 445 memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr)); 446 } else if (ptype == SCTP_IPV4_ADDRESS) { 447 /* ipv4 address param */ 448 struct sctp_ipv4addr_param *p4, p4_buf; 449 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) { 450 return NULL; 451 } 452 453 p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m, 454 offset + sizeof(struct sctp_asconf_chunk), 455 &p4_buf.ph, sizeof(*p4)); 456 if (p4 == NULL) { 457 #ifdef SCTP_DEBUG 458 if (sctp_debug_on & SCTP_DEBUG_INPUT3) { 459 printf("sctp_process_control: failed to get asconf v4 lookup addr\n"); 460 } 461 #endif /* SCTP_DEBUG */ 462 return (NULL); 463 } 464 sin = (struct sockaddr_in *)&remote_store; 465 sin->sin_family = AF_INET; 466 sin->sin_len = sizeof(*sin); 467 sin->sin_port = sh->src_port; 468 memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr)); 469 } else { 470 /* invalid address param type */ 471 return NULL; 472 } 473 474 stcb = sctp_findassociation_ep_addr(inp_p, 475 (struct sockaddr *)&remote_store, netp, 476 (struct sockaddr *)&local_store, NULL); 477 return (stcb); 478 } 479 480 struct sctp_tcb * 481 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote, 482 struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb) 483 { 484 struct sctpasochead *head; 485 struct sctp_inpcb *inp; 486 struct sctp_tcb *stcb; 487 struct sctp_nets *net; 488 uint16_t rport; 489 490 inp = *inp_p; 491 if (remote->sa_family == AF_INET) { 492 rport = (((struct sockaddr_in *)remote)->sin_port); 493 } else if (remote->sa_family == AF_INET6) { 494 rport = (((struct sockaddr_in6 *)remote)->sin6_port); 495 } else { 496 return (NULL); 497 } 498 if (locked_tcb) { 499 /* UN-lock so we can do proper locking here 500 * this occurs when called from load_addresses_from_init. 501 */ 502 SCTP_TCB_UNLOCK(locked_tcb); 503 } 504 SCTP_INP_INFO_RLOCK(); 505 if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 506 /* 507 * Now either this guy is our listner or it's the connector. 508 * If it is the one that issued the connect, then it's only 509 * chance is to be the first TCB in the list. If it is the 510 * acceptor, then do the special_lookup to hash and find the 511 * real inp. 512 */ 513 if (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING) { 514 /* to is peer addr, from is my addr */ 515 stcb = sctp_tcb_special_locate(inp_p, remote, local, 516 netp); 517 if ((stcb != NULL) && (locked_tcb == NULL)){ 518 /* we have a locked tcb, lower refcount */ 519 SCTP_INP_WLOCK(inp); 520 SCTP_INP_DECR_REF(inp); 521 SCTP_INP_WUNLOCK(inp); 522 } 523 if (locked_tcb != NULL) { 524 SCTP_INP_RLOCK(locked_tcb->sctp_ep); 525 SCTP_TCB_LOCK(locked_tcb); 526 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep); 527 if (stcb != NULL) { 528 SCTP_TCB_UNLOCK(stcb); 529 } 530 } 531 SCTP_INP_INFO_RUNLOCK(); 532 return (stcb); 533 } else { 534 SCTP_INP_WLOCK(inp); 535 stcb = LIST_FIRST(&inp->sctp_asoc_list); 536 if (stcb == NULL) { 537 goto null_return; 538 } 539 SCTP_TCB_LOCK(stcb); 540 if (stcb->rport != rport) { 541 /* remote port does not match. */ 542 SCTP_TCB_UNLOCK(stcb); 543 goto null_return; 544 } 545 /* now look at the list of remote addresses */ 546 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 547 if (sctp_cmpaddr(remote, rtcache_getdst(&net->ro))) { 548 /* found it */ 549 if (netp != NULL) { 550 *netp = net; 551 } 552 if (locked_tcb == NULL) { 553 SCTP_INP_DECR_REF(inp); 554 } 555 SCTP_INP_WUNLOCK(inp); 556 SCTP_INP_INFO_RUNLOCK(); 557 return (stcb); 558 } 559 } 560 SCTP_TCB_UNLOCK(stcb); 561 } 562 } else { 563 SCTP_INP_WLOCK(inp); 564 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport, 565 inp->sctp_hashmark)]; 566 if (head == NULL) { 567 goto null_return; 568 } 569 LIST_FOREACH(stcb, head, sctp_tcbhash) { 570 if (stcb->rport != rport) { 571 /* remote port does not match */ 572 continue; 573 } 574 /* now look at the list of remote addresses */ 575 SCTP_TCB_LOCK(stcb); 576 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 577 if (sctp_cmpaddr(remote, rtcache_getdst(&net->ro))) { 578 /* found it */ 579 if (netp != NULL) { 580 *netp = net; 581 } 582 if (locked_tcb == NULL) { 583 SCTP_INP_DECR_REF(inp); 584 } 585 SCTP_INP_WUNLOCK(inp); 586 SCTP_INP_INFO_RUNLOCK(); 587 return (stcb); 588 } 589 } 590 SCTP_TCB_UNLOCK(stcb); 591 } 592 } 593 null_return: 594 /* clean up for returning null */ 595 if (locked_tcb){ 596 if (locked_tcb->sctp_ep != inp) { 597 SCTP_INP_RLOCK(locked_tcb->sctp_ep); 598 SCTP_TCB_LOCK(locked_tcb); 599 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep); 600 } else { 601 SCTP_TCB_LOCK(locked_tcb); 602 } 603 } 604 SCTP_INP_WUNLOCK(inp); 605 SCTP_INP_INFO_RUNLOCK(); 606 /* not found */ 607 return (NULL); 608 } 609 610 /* 611 * Find an association for a specific endpoint using the association id 612 * given out in the COMM_UP notification 613 */ 614 struct sctp_tcb * 615 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, vaddr_t asoc_id) 616 { 617 /* 618 * Use my the assoc_id to find a endpoint 619 */ 620 struct sctpasochead *head; 621 struct sctp_tcb *stcb; 622 u_int32_t vtag; 623 624 if (asoc_id == 0 || inp == NULL) { 625 return (NULL); 626 } 627 SCTP_INP_INFO_RLOCK(); 628 vtag = (u_int32_t)asoc_id; 629 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag, 630 sctppcbinfo.hashasocmark)]; 631 if (head == NULL) { 632 /* invalid vtag */ 633 SCTP_INP_INFO_RUNLOCK(); 634 return (NULL); 635 } 636 LIST_FOREACH(stcb, head, sctp_asocs) { 637 SCTP_INP_RLOCK(stcb->sctp_ep); 638 SCTP_TCB_LOCK(stcb); 639 SCTP_INP_RUNLOCK(stcb->sctp_ep); 640 if (stcb->asoc.my_vtag == vtag) { 641 /* candidate */ 642 if (inp != stcb->sctp_ep) { 643 /* some other guy has the 644 * same vtag active (vtag collision). 645 */ 646 sctp_pegs[SCTP_VTAG_BOGUS]++; 647 SCTP_TCB_UNLOCK(stcb); 648 continue; 649 } 650 sctp_pegs[SCTP_VTAG_EXPR]++; 651 SCTP_INP_INFO_RUNLOCK(); 652 return (stcb); 653 } 654 SCTP_TCB_UNLOCK(stcb); 655 } 656 SCTP_INP_INFO_RUNLOCK(); 657 return (NULL); 658 } 659 660 static struct sctp_inpcb * 661 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head, 662 uint16_t lport) 663 { 664 struct sctp_inpcb *inp; 665 struct sockaddr_in *sin; 666 struct sockaddr_in6 *sin6; 667 struct sctp_laddr *laddr; 668 669 /* Endpoing probe expects 670 * that the INP_INFO is locked. 671 */ 672 if (nam->sa_family == AF_INET) { 673 sin = (struct sockaddr_in *)nam; 674 sin6 = NULL; 675 } else if (nam->sa_family == AF_INET6) { 676 sin6 = (struct sockaddr_in6 *)nam; 677 sin = NULL; 678 } else { 679 /* unsupported family */ 680 return (NULL); 681 } 682 if (head == NULL) 683 return (NULL); 684 685 LIST_FOREACH(inp, head, sctp_hash) { 686 SCTP_INP_RLOCK(inp); 687 688 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) && 689 (inp->sctp_lport == lport)) { 690 /* got it */ 691 if ((nam->sa_family == AF_INET) && 692 (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 693 #if defined(__FreeBSD__) || defined(__APPLE__) 694 (((struct inpcb *)inp)->inp_flags & IN6P_IPV6_V6ONLY) 695 #else 696 #if defined(__OpenBSD__) 697 (0) /* For open bsd we do dual bind only */ 698 #else 699 (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY) 700 #endif 701 #endif 702 ) { 703 /* IPv4 on a IPv6 socket with ONLY IPv6 set */ 704 SCTP_INP_RUNLOCK(inp); 705 continue; 706 } 707 /* A V6 address and the endpoint is NOT bound V6 */ 708 if (nam->sa_family == AF_INET6 && 709 (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) { 710 SCTP_INP_RUNLOCK(inp); 711 continue; 712 } 713 SCTP_INP_RUNLOCK(inp); 714 return (inp); 715 } 716 SCTP_INP_RUNLOCK(inp); 717 } 718 719 if ((nam->sa_family == AF_INET) && 720 (sin->sin_addr.s_addr == INADDR_ANY)) { 721 /* Can't hunt for one that has no address specified */ 722 return (NULL); 723 } else if ((nam->sa_family == AF_INET6) && 724 (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) { 725 /* Can't hunt for one that has no address specified */ 726 return (NULL); 727 } 728 /* 729 * ok, not bound to all so see if we can find a EP bound to this 730 * address. 731 */ 732 #ifdef SCTP_DEBUG 733 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 734 printf("Ok, there is NO bound-all available for port:%x\n", ntohs(lport)); 735 } 736 #endif 737 LIST_FOREACH(inp, head, sctp_hash) { 738 SCTP_INP_RLOCK(inp); 739 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) { 740 SCTP_INP_RUNLOCK(inp); 741 continue; 742 } 743 /* 744 * Ok this could be a likely candidate, look at all of 745 * its addresses 746 */ 747 if (inp->sctp_lport != lport) { 748 SCTP_INP_RUNLOCK(inp); 749 continue; 750 } 751 #ifdef SCTP_DEBUG 752 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 753 printf("Ok, found maching local port\n"); 754 } 755 #endif 756 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 757 if (laddr->ifa == NULL) { 758 #ifdef SCTP_DEBUG 759 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 760 printf("An ounce of prevention is worth a pound of cure\n"); 761 } 762 #endif 763 continue; 764 } 765 #ifdef SCTP_DEBUG 766 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 767 printf("Ok laddr->ifa:%p is possible, ", 768 laddr->ifa); 769 } 770 #endif 771 if (laddr->ifa->ifa_addr == NULL) { 772 #ifdef SCTP_DEBUG 773 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 774 printf("Huh IFA as an ifa_addr=NULL, "); 775 } 776 #endif 777 continue; 778 } 779 #ifdef SCTP_DEBUG 780 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 781 printf("Ok laddr->ifa:%p is possible, ", 782 laddr->ifa->ifa_addr); 783 sctp_print_address(laddr->ifa->ifa_addr); 784 printf("looking for "); 785 sctp_print_address(nam); 786 } 787 #endif 788 if (laddr->ifa->ifa_addr->sa_family == nam->sa_family) { 789 /* possible, see if it matches */ 790 struct sockaddr_in *intf_addr; 791 intf_addr = (struct sockaddr_in *) 792 laddr->ifa->ifa_addr; 793 if (nam->sa_family == AF_INET) { 794 if (sin->sin_addr.s_addr == 795 intf_addr->sin_addr.s_addr) { 796 #ifdef SCTP_DEBUG 797 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 798 printf("YES, return ep:%p\n", inp); 799 } 800 #endif 801 SCTP_INP_RUNLOCK(inp); 802 return (inp); 803 } 804 } else if (nam->sa_family == AF_INET6) { 805 struct sockaddr_in6 *intf_addr6; 806 intf_addr6 = (struct sockaddr_in6 *) 807 laddr->ifa->ifa_addr; 808 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 809 &intf_addr6->sin6_addr)) { 810 #ifdef SCTP_DEBUG 811 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 812 printf("YES, return ep:%p\n", inp); 813 } 814 #endif 815 SCTP_INP_RUNLOCK(inp); 816 return (inp); 817 } 818 } 819 } 820 SCTP_INP_RUNLOCK(inp); 821 } 822 } 823 #ifdef SCTP_DEBUG 824 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 825 printf("NO, Falls out to NULL\n"); 826 } 827 #endif 828 return (NULL); 829 } 830 831 832 struct sctp_inpcb * 833 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock) 834 { 835 /* 836 * First we check the hash table to see if someone has this port 837 * bound with just the port. 838 */ 839 struct sctp_inpcb *inp; 840 struct sctppcbhead *head; 841 int lport; 842 #ifdef SCTP_DEBUG 843 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 844 printf("Looking for endpoint %d :", 845 ntohs(((struct sockaddr_in *)nam)->sin_port)); 846 sctp_print_address(nam); 847 } 848 #endif 849 if (nam->sa_family == AF_INET) { 850 lport = ((struct sockaddr_in *)nam)->sin_port; 851 } else if (nam->sa_family == AF_INET6) { 852 lport = ((struct sockaddr_in6 *)nam)->sin6_port; 853 } else { 854 /* unsupported family */ 855 return (NULL); 856 } 857 /* 858 * I could cheat here and just cast to one of the types but we will 859 * do it right. It also provides the check against an Unsupported 860 * type too. 861 */ 862 /* Find the head of the ALLADDR chain */ 863 if (have_lock == 0) { 864 SCTP_INP_INFO_RLOCK(); 865 } 866 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 867 sctppcbinfo.hashmark)]; 868 #ifdef SCTP_DEBUG 869 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 870 printf("Main hash to lookup at head:%p\n", head); 871 } 872 #endif 873 inp = sctp_endpoint_probe(nam, head, lport); 874 875 /* 876 * If the TCP model exists it could be that the main listening 877 * endpoint is gone but there exists a connected socket for this 878 * guy yet. If so we can return the first one that we find. This 879 * may NOT be the correct one but the sctp_findassociation_ep_addr 880 * has further code to look at all TCP models. 881 */ 882 if (inp == NULL && find_tcp_pool) { 883 unsigned int i; 884 #ifdef SCTP_DEBUG 885 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 886 printf("EP was NULL and TCP model is supported\n"); 887 } 888 #endif 889 for (i = 0; i < sctppcbinfo.hashtblsize; i++) { 890 /* 891 * This is real gross, but we do NOT have a remote 892 * port at this point depending on who is calling. We 893 * must therefore look for ANY one that matches our 894 * local port :/ 895 */ 896 head = &sctppcbinfo.sctp_tcpephash[i]; 897 if (LIST_FIRST(head)) { 898 inp = sctp_endpoint_probe(nam, head, lport); 899 if (inp) { 900 /* Found one */ 901 break; 902 } 903 } 904 } 905 } 906 #ifdef SCTP_DEBUG 907 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 908 printf("EP to return is %p\n", inp); 909 } 910 #endif 911 if (have_lock == 0) { 912 if (inp) { 913 SCTP_INP_WLOCK(inp); 914 SCTP_INP_INCR_REF(inp); 915 SCTP_INP_WUNLOCK(inp); 916 } 917 SCTP_INP_INFO_RUNLOCK(); 918 } else { 919 if (inp) { 920 SCTP_INP_WLOCK(inp); 921 SCTP_INP_INCR_REF(inp); 922 SCTP_INP_WUNLOCK(inp); 923 } 924 } 925 return (inp); 926 } 927 928 /* 929 * Find an association for an endpoint with the pointer to whom you want 930 * to send to and the endpoint pointer. The address can be IPv4 or IPv6. 931 * We may need to change the *to to some other struct like a mbuf... 932 */ 933 struct sctp_tcb * 934 sctp_findassociation_addr_sa(struct sockaddr *to, struct sockaddr *from, 935 struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool) 936 { 937 struct sctp_inpcb *inp; 938 struct sctp_tcb *retval; 939 940 SCTP_INP_INFO_RLOCK(); 941 if (find_tcp_pool) { 942 if (inp_p != NULL) { 943 retval = sctp_tcb_special_locate(inp_p, from, to, netp); 944 } else { 945 retval = sctp_tcb_special_locate(&inp, from, to, netp); 946 } 947 if (retval != NULL) { 948 SCTP_INP_INFO_RUNLOCK(); 949 return (retval); 950 } 951 } 952 inp = sctp_pcb_findep(to, 0, 1); 953 if (inp_p != NULL) { 954 *inp_p = inp; 955 } 956 SCTP_INP_INFO_RUNLOCK(); 957 958 if (inp == NULL) { 959 return (NULL); 960 } 961 962 /* 963 * ok, we have an endpoint, now lets find the assoc for it (if any) 964 * we now place the source address or from in the to of the find 965 * endpoint call. Since in reality this chain is used from the 966 * inbound packet side. 967 */ 968 if (inp_p != NULL) { 969 return (sctp_findassociation_ep_addr(inp_p, from, netp, to, NULL)); 970 } else { 971 return (sctp_findassociation_ep_addr(&inp, from, netp, to, NULL)); 972 } 973 } 974 975 976 /* 977 * This routine will grub through the mbuf that is a INIT or INIT-ACK and 978 * find all addresses that the sender has specified in any address list. 979 * Each address will be used to lookup the TCB and see if one exits. 980 */ 981 static struct sctp_tcb * 982 sctp_findassociation_special_addr(struct mbuf *m, int iphlen, int offset, 983 struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp, 984 struct sockaddr *dest) 985 { 986 struct sockaddr_in sin4; 987 struct sockaddr_in6 sin6; 988 struct sctp_paramhdr *phdr, parm_buf; 989 struct sctp_tcb *retval; 990 u_int32_t ptype, plen; 991 992 memset(&sin4, 0, sizeof(sin4)); 993 memset(&sin6, 0, sizeof(sin6)); 994 sin4.sin_len = sizeof(sin4); 995 sin4.sin_family = AF_INET; 996 sin4.sin_port = sh->src_port; 997 sin6.sin6_len = sizeof(sin6); 998 sin6.sin6_family = AF_INET6; 999 sin6.sin6_port = sh->src_port; 1000 1001 retval = NULL; 1002 offset += sizeof(struct sctp_init_chunk); 1003 1004 phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf)); 1005 while (phdr != NULL) { 1006 /* now we must see if we want the parameter */ 1007 ptype = ntohs(phdr->param_type); 1008 plen = ntohs(phdr->param_length); 1009 if (plen == 0) { 1010 #ifdef SCTP_DEBUG 1011 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1012 printf("sctp_findassociation_special_addr: Impossible length in parameter\n"); 1013 } 1014 #endif /* SCTP_DEBUG */ 1015 break; 1016 } 1017 if (ptype == SCTP_IPV4_ADDRESS && 1018 plen == sizeof(struct sctp_ipv4addr_param)) { 1019 /* Get the rest of the address */ 1020 struct sctp_ipv4addr_param ip4_parm, *p4; 1021 1022 phdr = sctp_get_next_param(m, offset, 1023 (struct sctp_paramhdr *)&ip4_parm, plen); 1024 if (phdr == NULL) { 1025 return (NULL); 1026 } 1027 p4 = (struct sctp_ipv4addr_param *)phdr; 1028 memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr)); 1029 /* look it up */ 1030 retval = sctp_findassociation_ep_addr(inp_p, 1031 (struct sockaddr *)&sin4, netp, dest, NULL); 1032 if (retval != NULL) { 1033 return (retval); 1034 } 1035 } else if (ptype == SCTP_IPV6_ADDRESS && 1036 plen == sizeof(struct sctp_ipv6addr_param)) { 1037 /* Get the rest of the address */ 1038 struct sctp_ipv6addr_param ip6_parm, *p6; 1039 1040 phdr = sctp_get_next_param(m, offset, 1041 (struct sctp_paramhdr *)&ip6_parm, plen); 1042 if (phdr == NULL) { 1043 return (NULL); 1044 } 1045 p6 = (struct sctp_ipv6addr_param *)phdr; 1046 memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr)); 1047 /* look it up */ 1048 retval = sctp_findassociation_ep_addr(inp_p, 1049 (struct sockaddr *)&sin6, netp, dest, NULL); 1050 if (retval != NULL) { 1051 return (retval); 1052 } 1053 } 1054 offset += SCTP_SIZE32(plen); 1055 phdr = sctp_get_next_param(m, offset, &parm_buf, 1056 sizeof(parm_buf)); 1057 } 1058 return (NULL); 1059 } 1060 1061 static struct sctp_tcb * 1062 sctp_findassoc_by_vtag(struct sockaddr *from, uint32_t vtag, 1063 struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport, 1064 uint16_t lport) 1065 { 1066 /* 1067 * Use my vtag to hash. If we find it we then verify the source addr 1068 * is in the assoc. If all goes well we save a bit on rec of a packet. 1069 */ 1070 struct sctpasochead *head; 1071 struct sctp_nets *net; 1072 struct sctp_tcb *stcb; 1073 1074 SCTP_INP_INFO_RLOCK(); 1075 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag, 1076 sctppcbinfo.hashasocmark)]; 1077 if (head == NULL) { 1078 /* invalid vtag */ 1079 SCTP_INP_INFO_RUNLOCK(); 1080 return (NULL); 1081 } 1082 LIST_FOREACH(stcb, head, sctp_asocs) { 1083 SCTP_INP_RLOCK(stcb->sctp_ep); 1084 SCTP_TCB_LOCK(stcb); 1085 SCTP_INP_RUNLOCK(stcb->sctp_ep); 1086 if (stcb->asoc.my_vtag == vtag) { 1087 /* candidate */ 1088 if (stcb->rport != rport) { 1089 /* 1090 * we could remove this if vtags are unique 1091 * across the system. 1092 */ 1093 SCTP_TCB_UNLOCK(stcb); 1094 continue; 1095 } 1096 if (stcb->sctp_ep->sctp_lport != lport) { 1097 /* 1098 * we could remove this if vtags are unique 1099 * across the system. 1100 */ 1101 SCTP_TCB_UNLOCK(stcb); 1102 continue; 1103 } 1104 net = sctp_findnet(stcb, from); 1105 if (net) { 1106 /* yep its him. */ 1107 *netp = net; 1108 sctp_pegs[SCTP_VTAG_EXPR]++; 1109 *inp_p = stcb->sctp_ep; 1110 SCTP_INP_INFO_RUNLOCK(); 1111 return (stcb); 1112 } else { 1113 /* not him, this should only 1114 * happen in rare cases so 1115 * I peg it. 1116 */ 1117 sctp_pegs[SCTP_VTAG_BOGUS]++; 1118 } 1119 } 1120 SCTP_TCB_UNLOCK(stcb); 1121 } 1122 SCTP_INP_INFO_RUNLOCK(); 1123 return (NULL); 1124 } 1125 1126 /* 1127 * Find an association with the pointer to the inbound IP packet. This 1128 * can be a IPv4 or IPv6 packet. 1129 */ 1130 struct sctp_tcb * 1131 sctp_findassociation_addr(struct mbuf *m, int iphlen, int offset, 1132 struct sctphdr *sh, struct sctp_chunkhdr *ch, 1133 struct sctp_inpcb **inp_p, struct sctp_nets **netp) 1134 { 1135 int find_tcp_pool; 1136 struct ip *iph; 1137 struct sctp_tcb *retval; 1138 struct sockaddr_storage to_store, from_store; 1139 struct sockaddr *to = (struct sockaddr *)&to_store; 1140 struct sockaddr *from = (struct sockaddr *)&from_store; 1141 struct sctp_inpcb *inp; 1142 1143 1144 iph = mtod(m, struct ip *); 1145 if (iph->ip_v == IPVERSION) { 1146 /* its IPv4 */ 1147 struct sockaddr_in *to4, *from4; 1148 1149 to4 = (struct sockaddr_in *)&to_store; 1150 from4 = (struct sockaddr_in *)&from_store; 1151 memset(to4, 0, sizeof(*to4)); 1152 memset(from4, 0, sizeof(*from4)); 1153 from4->sin_family = to4->sin_family = AF_INET; 1154 from4->sin_len = to4->sin_len = sizeof(struct sockaddr_in); 1155 from4->sin_addr.s_addr = iph->ip_src.s_addr; 1156 to4->sin_addr.s_addr = iph->ip_dst.s_addr ; 1157 from4->sin_port = sh->src_port; 1158 to4->sin_port = sh->dest_port; 1159 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 1160 /* its IPv6 */ 1161 struct ip6_hdr *ip6; 1162 struct sockaddr_in6 *to6, *from6; 1163 1164 ip6 = mtod(m, struct ip6_hdr *); 1165 to6 = (struct sockaddr_in6 *)&to_store; 1166 from6 = (struct sockaddr_in6 *)&from_store; 1167 memset(to6, 0, sizeof(*to6)); 1168 memset(from6, 0, sizeof(*from6)); 1169 from6->sin6_family = to6->sin6_family = AF_INET6; 1170 from6->sin6_len = to6->sin6_len = sizeof(struct sockaddr_in6); 1171 from6->sin6_addr = ip6->ip6_src; 1172 to6->sin6_addr = ip6->ip6_dst; 1173 from6->sin6_port = sh->src_port; 1174 to6->sin6_port = sh->dest_port; 1175 /* Get the scopes in properly to the sin6 addr's */ 1176 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) 1177 /* We probably don't need this operation (jinmei@kame) */ 1178 (void)in6_recoverscope(to6, &to6->sin6_addr, NULL); 1179 (void)in6_embedscope(&to6->sin6_addr, to6, NULL, NULL); 1180 1181 (void)in6_recoverscope(from6, &from6->sin6_addr, NULL); 1182 (void)in6_embedscope(&from6->sin6_addr, from6, NULL, NULL); 1183 #endif 1184 } else { 1185 /* Currently not supported. */ 1186 return (NULL); 1187 } 1188 #ifdef SCTP_DEBUG 1189 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1190 printf("Looking for port %d address :", 1191 ntohs(((struct sockaddr_in *)to)->sin_port)); 1192 sctp_print_address(to); 1193 printf("From for port %d address :", 1194 ntohs(((struct sockaddr_in *)from)->sin_port)); 1195 sctp_print_address(from); 1196 } 1197 #endif 1198 1199 if (sh->v_tag) { 1200 /* we only go down this path if vtag is non-zero */ 1201 retval = sctp_findassoc_by_vtag(from, ntohl(sh->v_tag), 1202 inp_p, netp, sh->src_port, sh->dest_port); 1203 if (retval) { 1204 return (retval); 1205 } 1206 } 1207 find_tcp_pool = 0; 1208 if ((ch->chunk_type != SCTP_INITIATION) && 1209 (ch->chunk_type != SCTP_INITIATION_ACK) && 1210 (ch->chunk_type != SCTP_COOKIE_ACK) && 1211 (ch->chunk_type != SCTP_COOKIE_ECHO)) { 1212 /* Other chunk types go to the tcp pool. */ 1213 find_tcp_pool = 1; 1214 } 1215 if (inp_p) { 1216 retval = sctp_findassociation_addr_sa(to, from, inp_p, netp, 1217 find_tcp_pool); 1218 inp = *inp_p; 1219 } else { 1220 retval = sctp_findassociation_addr_sa(to, from, &inp, netp, 1221 find_tcp_pool); 1222 } 1223 #ifdef SCTP_DEBUG 1224 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1225 printf("retval:%p inp:%p\n", retval, inp); 1226 } 1227 #endif 1228 if (retval == NULL && inp) { 1229 /* Found a EP but not this address */ 1230 #ifdef SCTP_DEBUG 1231 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1232 printf("Found endpoint %p but no asoc - ep state:%x\n", 1233 inp, inp->sctp_flags); 1234 } 1235 #endif 1236 if ((ch->chunk_type == SCTP_INITIATION) || 1237 (ch->chunk_type == SCTP_INITIATION_ACK)) { 1238 /* 1239 * special hook, we do NOT return linp or an 1240 * association that is linked to an existing 1241 * association that is under the TCP pool (i.e. no 1242 * listener exists). The endpoint finding routine 1243 * will always find a listner before examining the 1244 * TCP pool. 1245 */ 1246 if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) { 1247 #ifdef SCTP_DEBUG 1248 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1249 printf("Gak, its in the TCP pool... return NULL"); 1250 } 1251 #endif 1252 if (inp_p) { 1253 *inp_p = NULL; 1254 } 1255 return (NULL); 1256 } 1257 #ifdef SCTP_DEBUG 1258 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1259 printf("Now doing SPECIAL find\n"); 1260 } 1261 #endif 1262 retval = sctp_findassociation_special_addr(m, iphlen, 1263 offset, sh, inp_p, netp, to); 1264 } 1265 } 1266 #ifdef SCTP_DEBUG 1267 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1268 printf("retval is %p\n", retval); 1269 } 1270 #endif 1271 return (retval); 1272 } 1273 1274 extern int sctp_max_burst_default; 1275 1276 extern unsigned int sctp_delayed_sack_time_default; 1277 extern unsigned int sctp_heartbeat_interval_default; 1278 extern unsigned int sctp_pmtu_raise_time_default; 1279 extern unsigned int sctp_shutdown_guard_time_default; 1280 extern unsigned int sctp_secret_lifetime_default; 1281 1282 extern unsigned int sctp_rto_max_default; 1283 extern unsigned int sctp_rto_min_default; 1284 extern unsigned int sctp_rto_initial_default; 1285 extern unsigned int sctp_init_rto_max_default; 1286 extern unsigned int sctp_valid_cookie_life_default; 1287 extern unsigned int sctp_init_rtx_max_default; 1288 extern unsigned int sctp_assoc_rtx_max_default; 1289 extern unsigned int sctp_path_rtx_max_default; 1290 extern unsigned int sctp_nr_outgoing_streams_default; 1291 1292 /* 1293 * allocate a sctp_inpcb and setup a temporary binding to a port/all 1294 * addresses. This way if we don't get a bind we by default pick a ephemeral 1295 * port with all addresses bound. 1296 */ 1297 int 1298 sctp_inpcb_alloc(struct socket *so) 1299 { 1300 /* 1301 * we get called when a new endpoint starts up. We need to allocate 1302 * the sctp_inpcb structure from the zone and init it. Mark it as 1303 * unbound and find a port that we can use as an ephemeral with 1304 * INADDR_ANY. If the user binds later no problem we can then add 1305 * in the specific addresses. And setup the default parameters for 1306 * the EP. 1307 */ 1308 int i, error; 1309 struct sctp_inpcb *inp, *n_inp; 1310 struct sctp_pcb *m; 1311 struct timeval time; 1312 1313 error = 0; 1314 1315 /* Hack alert: 1316 * 1317 * This code audits the entire INP list to see if 1318 * any ep's that are in the GONE state are now 1319 * all free. This should not happen really since when 1320 * the last association if freed we should end up deleting 1321 * the inpcb. This code including the locks should 1322 * be taken out ... since the last set of fixes I 1323 * have not seen the "Found a GONE on list" has not 1324 * came out. But i am paranoid and we will leave this 1325 * in at the cost of efficency on allocation of PCB's. 1326 * Probably we should move this to the invariant 1327 * compile options 1328 */ 1329 /* #ifdef INVARIANTS*/ 1330 SCTP_INP_INFO_RLOCK(); 1331 inp = LIST_FIRST(&sctppcbinfo.listhead); 1332 while (inp) { 1333 n_inp = LIST_NEXT(inp, sctp_list); 1334 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 1335 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) { 1336 /* finish the job now */ 1337 printf("Found a GONE on list\n"); 1338 SCTP_INP_INFO_RUNLOCK(); 1339 sctp_inpcb_free(inp, 1); 1340 SCTP_INP_INFO_RLOCK(); 1341 } 1342 } 1343 inp = n_inp; 1344 } 1345 SCTP_INP_INFO_RUNLOCK(); 1346 /* #endif INVARIANTS*/ 1347 1348 SCTP_INP_INFO_WLOCK(); 1349 inp = (struct sctp_inpcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_ep); 1350 if (inp == NULL) { 1351 printf("Out of SCTP-INPCB structures - no resources\n"); 1352 SCTP_INP_INFO_WUNLOCK(); 1353 return (ENOBUFS); 1354 } 1355 1356 /* zap it */ 1357 memset(inp, 0, sizeof(*inp)); 1358 1359 /* bump generations */ 1360 inp->ip_inp.inp.inp_socket = so; 1361 1362 /* setup socket pointers */ 1363 inp->sctp_socket = so; 1364 1365 /* setup inpcb socket too */ 1366 inp->ip_inp.inp.inp_socket = so; 1367 inp->sctp_frag_point = SCTP_DEFAULT_MAXSEGMENT; 1368 #ifdef IPSEC 1369 #if !(defined(__OpenBSD__) || defined(__APPLE__)) 1370 { 1371 struct inpcbpolicy *pcb_sp = NULL; 1372 error = ipsec_init_pcbpolicy(so, &pcb_sp); 1373 /* Arrange to share the policy */ 1374 inp->ip_inp.inp.inp_sp = pcb_sp; 1375 ((struct in6pcb *)(&inp->ip_inp.inp))->in6p_sp = pcb_sp; 1376 } 1377 #else 1378 /* not sure what to do for openbsd here */ 1379 error = 0; 1380 #endif 1381 if (error != 0) { 1382 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1383 SCTP_INP_INFO_WUNLOCK(); 1384 return error; 1385 } 1386 #endif /* IPSEC */ 1387 sctppcbinfo.ipi_count_ep++; 1388 #if defined(__FreeBSD__) || defined(__APPLE__) 1389 inp->ip_inp.inp.inp_gencnt = ++sctppcbinfo.ipi_gencnt_ep; 1390 inp->ip_inp.inp.inp_ip_ttl = ip_defttl; 1391 #else 1392 inp->inp_ip_ttl = ip_defttl; 1393 inp->inp_ip_tos = 0; 1394 #endif 1395 1396 so->so_pcb = (void *)inp; 1397 1398 if ((so->so_type == SOCK_DGRAM) || 1399 (so->so_type == SOCK_SEQPACKET)) { 1400 /* UDP style socket */ 1401 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE | 1402 SCTP_PCB_FLAGS_UNBOUND); 1403 inp->sctp_flags |= (SCTP_PCB_FLAGS_RECVDATAIOEVNT); 1404 /* Be sure it is NON-BLOCKING IO for UDP */ 1405 /*so->so_state |= SS_NBIO;*/ 1406 } else if (so->so_type == SOCK_STREAM) { 1407 /* TCP style socket */ 1408 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE | 1409 SCTP_PCB_FLAGS_UNBOUND); 1410 inp->sctp_flags |= (SCTP_PCB_FLAGS_RECVDATAIOEVNT); 1411 /* Be sure we have blocking IO bu default */ 1412 so->so_state &= ~SS_NBIO; 1413 } else { 1414 /* 1415 * unsupported socket type (RAW, etc)- in case we missed 1416 * it in protosw 1417 */ 1418 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1419 SCTP_INP_INFO_WUNLOCK(); 1420 return (EOPNOTSUPP); 1421 } 1422 inp->sctp_tcbhash = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_hash); 1423 if (inp->sctp_tcbhash == NULL) { 1424 printf("Out of SCTP-INPCB->hashinit - no resources\n"); 1425 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 1426 SCTP_INP_INFO_WUNLOCK(); 1427 return (ENOBUFS); 1428 } else { 1429 for (i = 0; i < sctp_pcbtblsize; i++) 1430 LIST_INIT(&inp->sctp_tcbhash[i]); 1431 for (i = 1; i < sctp_pcbtblsize; i <<= 1) 1432 continue; 1433 inp->sctp_hashmark = i - 1; 1434 } 1435 /* LOCK init's */ 1436 SCTP_INP_LOCK_INIT(inp); 1437 SCTP_ASOC_CREATE_LOCK_INIT(inp); 1438 /* lock the new ep */ 1439 SCTP_INP_WLOCK(inp); 1440 1441 /* add it to the info area */ 1442 LIST_INSERT_HEAD(&sctppcbinfo.listhead, inp, sctp_list); 1443 SCTP_INP_INFO_WUNLOCK(); 1444 1445 LIST_INIT(&inp->sctp_addr_list); 1446 LIST_INIT(&inp->sctp_asoc_list); 1447 TAILQ_INIT(&inp->sctp_queue_list); 1448 /* Init the timer structure for signature change */ 1449 callout_init(&inp->sctp_ep.signature_change.timer, 0); 1450 inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE; 1451 1452 /* now init the actual endpoint default data */ 1453 m = &inp->sctp_ep; 1454 1455 /* setup the base timeout information */ 1456 m->sctp_timeoutticks[SCTP_TIMER_SEND] = SEC_TO_TICKS(SCTP_SEND_SEC); /* needed ? */ 1457 m->sctp_timeoutticks[SCTP_TIMER_INIT] = SEC_TO_TICKS(SCTP_INIT_SEC); /* needed ? */ 1458 m->sctp_timeoutticks[SCTP_TIMER_RECV] = MSEC_TO_TICKS(sctp_delayed_sack_time_default); 1459 m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = sctp_heartbeat_interval_default; /* this is in MSEC */ 1460 m->sctp_timeoutticks[SCTP_TIMER_PMTU] = SEC_TO_TICKS(sctp_pmtu_raise_time_default); 1461 m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = SEC_TO_TICKS(sctp_shutdown_guard_time_default); 1462 m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = SEC_TO_TICKS(sctp_secret_lifetime_default); 1463 /* all max/min max are in ms */ 1464 m->sctp_maxrto = sctp_rto_max_default; 1465 m->sctp_minrto = sctp_rto_min_default; 1466 m->initial_rto = sctp_rto_initial_default; 1467 m->initial_init_rto_max = sctp_init_rto_max_default; 1468 1469 m->max_open_streams_intome = MAX_SCTP_STREAMS; 1470 1471 m->max_init_times = sctp_init_rtx_max_default; 1472 m->max_send_times = sctp_assoc_rtx_max_default; 1473 m->def_net_failure = sctp_path_rtx_max_default; 1474 m->sctp_sws_sender = SCTP_SWS_SENDER_DEF; 1475 m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF; 1476 m->max_burst = sctp_max_burst_default; 1477 /* number of streams to pre-open on a association */ 1478 m->pre_open_stream_count = sctp_nr_outgoing_streams_default; 1479 1480 /* Add adaption cookie */ 1481 m->adaption_layer_indicator = 0x504C5253; 1482 1483 /* seed random number generator */ 1484 m->random_counter = 1; 1485 m->store_at = SCTP_SIGNATURE_SIZE; 1486 #if defined(__FreeBSD__) && (__FreeBSD_version < 500000) 1487 read_random_unlimited(m->random_numbers, sizeof(m->random_numbers)); 1488 #elif defined(__APPLE__) || (__FreeBSD_version > 500000) 1489 read_random(m->random_numbers, sizeof(m->random_numbers)); 1490 #elif defined(__OpenBSD__) 1491 get_random_bytes(m->random_numbers, sizeof(m->random_numbers)); 1492 #elif defined(__NetBSD__) && NRND > 0 1493 rnd_extract_data(m->random_numbers, sizeof(m->random_numbers), 1494 RND_EXTRACT_ANY); 1495 #else 1496 { 1497 u_int32_t *ranm, *ranp; 1498 ranp = (u_int32_t *)&m->random_numbers; 1499 ranm = ranp + (SCTP_SIGNATURE_ALOC_SIZE/sizeof(u_int32_t)); 1500 if ((u_long)ranp % 4) { 1501 /* not a even boundary? */ 1502 ranp = (u_int32_t *)SCTP_SIZE32((u_long)ranp); 1503 } 1504 while (ranp < ranm) { 1505 *ranp = random(); 1506 ranp++; 1507 } 1508 } 1509 #endif 1510 sctp_fill_random_store(m); 1511 1512 /* Minimum cookie size */ 1513 m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) + 1514 sizeof(struct sctp_state_cookie); 1515 m->size_of_a_cookie += SCTP_SIGNATURE_SIZE; 1516 1517 /* Setup the initial secret */ 1518 SCTP_GETTIME_TIMEVAL(&time); 1519 m->time_of_secret_change = time.tv_sec; 1520 1521 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) { 1522 m->secret_key[0][i] = sctp_select_initial_TSN(m); 1523 } 1524 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL); 1525 1526 /* How long is a cookie good for ? */ 1527 m->def_cookie_life = sctp_valid_cookie_life_default; 1528 SCTP_INP_WUNLOCK(inp); 1529 return (error); 1530 } 1531 1532 1533 void 1534 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp, 1535 struct sctp_tcb *stcb) 1536 { 1537 uint16_t lport, rport; 1538 struct sctppcbhead *head; 1539 struct sctp_laddr *laddr, *oladdr; 1540 1541 SCTP_TCB_UNLOCK(stcb); 1542 SCTP_INP_INFO_WLOCK(); 1543 SCTP_INP_WLOCK(old_inp); 1544 SCTP_INP_WLOCK(new_inp); 1545 SCTP_TCB_LOCK(stcb); 1546 1547 new_inp->sctp_ep.time_of_secret_change = 1548 old_inp->sctp_ep.time_of_secret_change; 1549 memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key, 1550 sizeof(old_inp->sctp_ep.secret_key)); 1551 new_inp->sctp_ep.current_secret_number = 1552 old_inp->sctp_ep.current_secret_number; 1553 new_inp->sctp_ep.last_secret_number = 1554 old_inp->sctp_ep.last_secret_number; 1555 new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie; 1556 1557 /* Copy the port across */ 1558 lport = new_inp->sctp_lport = old_inp->sctp_lport; 1559 rport = stcb->rport; 1560 /* Pull the tcb from the old association */ 1561 LIST_REMOVE(stcb, sctp_tcbhash); 1562 LIST_REMOVE(stcb, sctp_tcblist); 1563 1564 /* Now insert the new_inp into the TCP connected hash */ 1565 head = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR((lport + rport), 1566 sctppcbinfo.hashtcpmark)]; 1567 1568 LIST_INSERT_HEAD(head, new_inp, sctp_hash); 1569 1570 /* Now move the tcb into the endpoint list */ 1571 LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist); 1572 /* 1573 * Question, do we even need to worry about the ep-hash since 1574 * we only have one connection? Probably not :> so lets 1575 * get rid of it and not suck up any kernel memory in that. 1576 */ 1577 SCTP_INP_INFO_WUNLOCK(); 1578 stcb->sctp_socket = new_inp->sctp_socket; 1579 stcb->sctp_ep = new_inp; 1580 if (new_inp->sctp_tcbhash != NULL) { 1581 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_hash, 1582 new_inp->sctp_tcbhash); 1583 new_inp->sctp_tcbhash = NULL; 1584 } 1585 if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 1586 /* Subset bound, so copy in the laddr list from the old_inp */ 1587 LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) { 1588 laddr = (struct sctp_laddr *)SCTP_ZONE_GET( 1589 sctppcbinfo.ipi_zone_laddr); 1590 if (laddr == NULL) { 1591 /* 1592 * Gak, what can we do? This assoc is really 1593 * HOSED. We probably should send an abort 1594 * here. 1595 */ 1596 #ifdef SCTP_DEBUG 1597 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1598 printf("Association hosed in TCP model, out of laddr memory\n"); 1599 } 1600 #endif /* SCTP_DEBUG */ 1601 continue; 1602 } 1603 sctppcbinfo.ipi_count_laddr++; 1604 sctppcbinfo.ipi_gencnt_laddr++; 1605 memset(laddr, 0, sizeof(*laddr)); 1606 laddr->ifa = oladdr->ifa; 1607 LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr, 1608 sctp_nxt_addr); 1609 new_inp->laddr_count++; 1610 } 1611 } 1612 SCTP_INP_WUNLOCK(new_inp); 1613 SCTP_INP_WUNLOCK(old_inp); 1614 } 1615 1616 static int 1617 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport) 1618 { 1619 struct sctppcbhead *head; 1620 struct sctp_inpcb *t_inp; 1621 1622 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 1623 sctppcbinfo.hashmark)]; 1624 LIST_FOREACH(t_inp, head, sctp_hash) { 1625 if (t_inp->sctp_lport != lport) { 1626 continue; 1627 } 1628 /* This one is in use. */ 1629 /* check the v6/v4 binding issue */ 1630 if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 1631 #if defined(__FreeBSD__) 1632 (((struct inpcb *)t_inp)->inp_flags & IN6P_IPV6_V6ONLY) 1633 #else 1634 #if defined(__OpenBSD__) 1635 (0) /* For open bsd we do dual bind only */ 1636 #else 1637 (((struct in6pcb *)t_inp)->in6p_flags & IN6P_IPV6_V6ONLY) 1638 #endif 1639 #endif 1640 ) { 1641 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 1642 /* collision in V6 space */ 1643 return (1); 1644 } else { 1645 /* inp is BOUND_V4 no conflict */ 1646 continue; 1647 } 1648 } else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) { 1649 /* t_inp is bound v4 and v6, conflict always */ 1650 return (1); 1651 } else { 1652 /* t_inp is bound only V4 */ 1653 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) && 1654 #if defined(__FreeBSD__) 1655 (((struct inpcb *)inp)->inp_flags & IN6P_IPV6_V6ONLY) 1656 #else 1657 #if defined(__OpenBSD__) 1658 (0) /* For open bsd we do dual bind only */ 1659 #else 1660 (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY) 1661 #endif 1662 #endif 1663 ) { 1664 /* no conflict */ 1665 continue; 1666 } 1667 /* else fall through to conflict */ 1668 } 1669 return (1); 1670 } 1671 return (0); 1672 } 1673 1674 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 1675 /* 1676 * Don't know why, but without this there is an unknown reference when 1677 * compiling NetBSD... hmm 1678 */ 1679 extern void in6_sin6_2_sin (struct sockaddr_in *, struct sockaddr_in6 *sin6); 1680 #endif 1681 1682 1683 int 1684 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct lwp *l) 1685 { 1686 /* bind a ep to a socket address */ 1687 struct sctppcbhead *head; 1688 struct sctp_inpcb *inp, *inp_tmp; 1689 int bindall; 1690 uint16_t lport; 1691 int error; 1692 1693 lport = 0; 1694 error = 0; 1695 bindall = 1; 1696 inp = (struct sctp_inpcb *)so->so_pcb; 1697 #ifdef SCTP_DEBUG 1698 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1699 if (addr) { 1700 printf("Bind called port:%d\n", 1701 ntohs(((struct sockaddr_in *)addr)->sin_port)); 1702 printf("Addr :"); 1703 sctp_print_address(addr); 1704 } 1705 } 1706 #endif /* SCTP_DEBUG */ 1707 if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) { 1708 /* already did a bind, subsequent binds NOT allowed ! */ 1709 return (EINVAL); 1710 } 1711 1712 if (addr != NULL) { 1713 if (addr->sa_family == AF_INET) { 1714 struct sockaddr_in *sin; 1715 1716 /* IPV6_V6ONLY socket? */ 1717 if (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY) { 1718 return (EINVAL); 1719 } 1720 1721 if (addr->sa_len != sizeof(*sin)) 1722 return (EINVAL); 1723 1724 sin = (struct sockaddr_in *)addr; 1725 lport = sin->sin_port; 1726 1727 if (sin->sin_addr.s_addr != INADDR_ANY) { 1728 bindall = 0; 1729 } 1730 } else if (addr->sa_family == AF_INET6) { 1731 /* Only for pure IPv6 Address. (No IPv4 Mapped!) */ 1732 struct sockaddr_in6 *sin6; 1733 1734 sin6 = (struct sockaddr_in6 *)addr; 1735 1736 if (addr->sa_len != sizeof(*sin6)) 1737 return (EINVAL); 1738 1739 lport = sin6->sin6_port; 1740 if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 1741 bindall = 0; 1742 /* KAME hack: embed scopeid */ 1743 error = sa6_embedscope(sin6, ip6_use_defzone); 1744 if (error != 0) 1745 return (error); 1746 } 1747 #ifndef SCOPEDROUTING 1748 /* this must be cleared for ifa_ifwithaddr() */ 1749 sin6->sin6_scope_id = 0; 1750 #endif /* SCOPEDROUTING */ 1751 } else { 1752 return (EAFNOSUPPORT); 1753 } 1754 } 1755 SCTP_INP_INFO_WLOCK(); 1756 #ifdef SCTP_DEBUG 1757 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1758 printf("sctp_inpcb_bind: after SCTP_INP_INFO_WLOCK\n"); 1759 } 1760 #endif /* SCTP_DEBUG */ 1761 SCTP_INP_WLOCK(inp); 1762 /* increase our count due to the unlock we do */ 1763 SCTP_INP_INCR_REF(inp); 1764 if (lport) { 1765 enum kauth_network_req req; 1766 /* 1767 * Did the caller specify a port? if so we must see if a 1768 * ep already has this one bound. 1769 */ 1770 if (ntohs(lport) < IPPORT_RESERVED) 1771 req = KAUTH_REQ_NETWORK_BIND_PRIVPORT; 1772 else 1773 req = KAUTH_REQ_NETWORK_BIND_PORT; 1774 1775 error = kauth_authorize_network(l->l_cred, KAUTH_NETWORK_BIND, 1776 req, so, addr, NULL); 1777 if (error) { 1778 SCTP_INP_DECR_REF(inp); 1779 SCTP_INP_WUNLOCK(inp); 1780 SCTP_INP_INFO_WUNLOCK(); 1781 return (EACCES); 1782 } 1783 SCTP_INP_WUNLOCK(inp); 1784 inp_tmp = sctp_pcb_findep(addr, 0, 1); 1785 if (inp_tmp != NULL) { 1786 /* lock guy returned and lower count 1787 * note that we are not bound so inp_tmp 1788 * should NEVER be inp. And it is this 1789 * inp (inp_tmp) that gets the reference 1790 * bump, so we must lower it. 1791 */ 1792 SCTP_INP_WLOCK(inp_tmp); 1793 SCTP_INP_DECR_REF(inp_tmp); 1794 SCTP_INP_WUNLOCK(inp_tmp); 1795 1796 /* unlock info */ 1797 SCTP_INP_INFO_WUNLOCK(); 1798 return (EADDRNOTAVAIL); 1799 } 1800 SCTP_INP_WLOCK(inp); 1801 if (bindall) { 1802 /* verify that no lport is not used by a singleton */ 1803 if (sctp_isport_inuse(inp, lport)) { 1804 /* Sorry someone already has this one bound */ 1805 SCTP_INP_DECR_REF(inp); 1806 SCTP_INP_WUNLOCK(inp); 1807 SCTP_INP_INFO_WUNLOCK(); 1808 return (EADDRNOTAVAIL); 1809 } 1810 } 1811 } else { 1812 /* 1813 * get any port but lets make sure no one has any address 1814 * with this port bound 1815 */ 1816 1817 /* 1818 * setup the inp to the top (I could use the union but this 1819 * is just as easy 1820 */ 1821 uint32_t port_guess; 1822 uint16_t port_attempt; 1823 int not_done=1; 1824 1825 while (not_done) { 1826 port_guess = sctp_select_initial_TSN(&inp->sctp_ep); 1827 port_attempt = (port_guess & 0x0000ffff); 1828 if (port_attempt == 0) { 1829 goto next_half; 1830 } 1831 if (port_attempt < IPPORT_RESERVED) { 1832 port_attempt += IPPORT_RESERVED; 1833 } 1834 1835 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1836 /* got a port we can use */ 1837 not_done = 0; 1838 continue; 1839 } 1840 /* try upper half */ 1841 next_half: 1842 port_attempt = ((port_guess >> 16) & 0x0000ffff); 1843 if (port_attempt == 0) { 1844 goto last_try; 1845 } 1846 if (port_attempt < IPPORT_RESERVED) { 1847 port_attempt += IPPORT_RESERVED; 1848 } 1849 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1850 /* got a port we can use */ 1851 not_done = 0; 1852 continue; 1853 } 1854 /* try two half's added together */ 1855 last_try: 1856 port_attempt = (((port_guess >> 16) & 0x0000ffff) + (port_guess & 0x0000ffff)); 1857 if (port_attempt == 0) { 1858 /* get a new random number */ 1859 continue; 1860 } 1861 if (port_attempt < IPPORT_RESERVED) { 1862 port_attempt += IPPORT_RESERVED; 1863 } 1864 if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) { 1865 /* got a port we can use */ 1866 not_done = 0; 1867 continue; 1868 } 1869 } 1870 /* we don't get out of the loop until we have a port */ 1871 lport = htons(port_attempt); 1872 } 1873 SCTP_INP_DECR_REF(inp); 1874 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 1875 /* this really should not happen. The guy 1876 * did a non-blocking bind and then did a close 1877 * at the same time. 1878 */ 1879 SCTP_INP_WUNLOCK(inp); 1880 SCTP_INP_INFO_WUNLOCK(); 1881 return (EINVAL); 1882 } 1883 /* ok we look clear to give out this port, so lets setup the binding */ 1884 if (bindall) { 1885 /* binding to all addresses, so just set in the proper flags */ 1886 inp->sctp_flags |= (SCTP_PCB_FLAGS_BOUNDALL | 1887 SCTP_PCB_FLAGS_DO_ASCONF); 1888 /* set the automatic addr changes from kernel flag */ 1889 if (sctp_auto_asconf == 0) { 1890 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF; 1891 } else { 1892 inp->sctp_flags |= SCTP_PCB_FLAGS_AUTO_ASCONF; 1893 } 1894 } else { 1895 /* 1896 * bind specific, make sure flags is off and add a new address 1897 * structure to the sctp_addr_list inside the ep structure. 1898 * 1899 * We will need to allocate one and insert it at the head. 1900 * The socketopt call can just insert new addresses in there 1901 * as well. It will also have to do the embed scope kame hack 1902 * too (before adding). 1903 */ 1904 struct ifaddr *ifa; 1905 struct sockaddr_storage store_sa; 1906 1907 memset(&store_sa, 0, sizeof(store_sa)); 1908 if (addr->sa_family == AF_INET) { 1909 struct sockaddr_in *sin; 1910 1911 sin = (struct sockaddr_in *)&store_sa; 1912 memcpy(sin, addr, sizeof(struct sockaddr_in)); 1913 sin->sin_port = 0; 1914 } else if (addr->sa_family == AF_INET6) { 1915 struct sockaddr_in6 *sin6; 1916 1917 sin6 = (struct sockaddr_in6 *)&store_sa; 1918 memcpy(sin6, addr, sizeof(struct sockaddr_in6)); 1919 sin6->sin6_port = 0; 1920 } 1921 /* 1922 * first find the interface with the bound address 1923 * need to zero out the port to find the address! yuck! 1924 * can't do this earlier since need port for sctp_pcb_findep() 1925 */ 1926 ifa = sctp_find_ifa_by_addr((struct sockaddr *)&store_sa); 1927 if (ifa == NULL) { 1928 /* Can't find an interface with that address */ 1929 SCTP_INP_WUNLOCK(inp); 1930 SCTP_INP_INFO_WUNLOCK(); 1931 return (EADDRNOTAVAIL); 1932 } 1933 if (addr->sa_family == AF_INET6) { 1934 struct in6_ifaddr *ifa6; 1935 ifa6 = (struct in6_ifaddr *)ifa; 1936 /* 1937 * allow binding of deprecated addresses as per 1938 * RFC 2462 and ipng discussion 1939 */ 1940 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 1941 IN6_IFF_ANYCAST | 1942 IN6_IFF_NOTREADY)) { 1943 /* Can't bind a non-existent addr. */ 1944 SCTP_INP_WUNLOCK(inp); 1945 SCTP_INP_INFO_WUNLOCK(); 1946 return (EINVAL); 1947 } 1948 } 1949 /* we're not bound all */ 1950 inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL; 1951 #if 0 /* use sysctl now */ 1952 /* don't allow automatic addr changes from kernel */ 1953 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF; 1954 #endif 1955 /* set the automatic addr changes from kernel flag */ 1956 if (sctp_auto_asconf == 0) { 1957 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF; 1958 } else { 1959 inp->sctp_flags |= SCTP_PCB_FLAGS_AUTO_ASCONF; 1960 } 1961 /* allow bindx() to send ASCONF's for binding changes */ 1962 inp->sctp_flags |= SCTP_PCB_FLAGS_DO_ASCONF; 1963 /* add this address to the endpoint list */ 1964 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa); 1965 if (error != 0) { 1966 SCTP_INP_WUNLOCK(inp); 1967 SCTP_INP_INFO_WUNLOCK(); 1968 return (error); 1969 } 1970 inp->laddr_count++; 1971 } 1972 /* find the bucket */ 1973 head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport, 1974 sctppcbinfo.hashmark)]; 1975 /* put it in the bucket */ 1976 LIST_INSERT_HEAD(head, inp, sctp_hash); 1977 #ifdef SCTP_DEBUG 1978 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 1979 printf("Main hash to bind at head:%p, bound port:%d\n", head, ntohs(lport)); 1980 } 1981 #endif 1982 /* set in the port */ 1983 inp->sctp_lport = lport; 1984 1985 /* turn off just the unbound flag */ 1986 inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND; 1987 SCTP_INP_WUNLOCK(inp); 1988 SCTP_INP_INFO_WUNLOCK(); 1989 return (0); 1990 } 1991 1992 1993 static void 1994 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp, struct sctp_inpcb *inp_next) 1995 { 1996 struct sctp_iterator *it; 1997 /* We enter with the only the ITERATOR_LOCK in place and 1998 * A write lock on the inp_info stuff. 1999 */ 2000 2001 /* Go through all iterators, we must do this since 2002 * it is possible that some iterator does NOT have 2003 * the lock, but is waiting for it. And the one that 2004 * had the lock has either moved in the last iteration 2005 * or we just cleared it above. We need to find all 2006 * of those guys. The list of iterators should never 2007 * be very big though. 2008 */ 2009 LIST_FOREACH(it, &sctppcbinfo.iteratorhead, sctp_nxt_itr) { 2010 if (it == inp->inp_starting_point_for_iterator) 2011 /* skip this guy, he's special */ 2012 continue; 2013 if (it->inp == inp) { 2014 /* This is tricky and we DON'T lock the iterator. 2015 * Reason is he's running but waiting for me since 2016 * inp->inp_starting_point_for_iterator has the lock 2017 * on me (the guy above we skipped). This tells us 2018 * its is not running but waiting for inp->inp_starting_point_for_iterator 2019 * to be released by the guy that does have our INP in a lock. 2020 */ 2021 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 2022 it->inp = NULL; 2023 it->stcb = NULL; 2024 } else { 2025 /* set him up to do the next guy not me */ 2026 it->inp = inp_next; 2027 it->stcb = NULL; 2028 } 2029 } 2030 } 2031 it = inp->inp_starting_point_for_iterator; 2032 if (it) { 2033 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 2034 it->inp = NULL; 2035 } else { 2036 it->inp = inp_next; 2037 } 2038 it->stcb = NULL; 2039 } 2040 } 2041 2042 /* release sctp_inpcb unbind the port */ 2043 void 2044 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate) 2045 { 2046 /* 2047 * Here we free a endpoint. We must find it (if it is in the Hash 2048 * table) and remove it from there. Then we must also find it in 2049 * the overall list and remove it from there. After all removals are 2050 * complete then any timer has to be stopped. Then start the actual 2051 * freeing. 2052 * a) Any local lists. 2053 * b) Any associations. 2054 * c) The hash of all associations. 2055 * d) finally the ep itself. 2056 */ 2057 struct sctp_inpcb *inp_save; 2058 struct sctp_tcb *asoc, *nasoc; 2059 struct sctp_laddr *laddr, *nladdr; 2060 struct inpcb *ip_pcb; 2061 struct socket *so; 2062 struct sctp_socket_q_list *sq; 2063 int s, cnt; 2064 struct rtentry *rt; 2065 2066 s = splsoftnet(); 2067 SCTP_ASOC_CREATE_LOCK(inp); 2068 SCTP_INP_WLOCK(inp); 2069 2070 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) { 2071 /* been here before */ 2072 splx(s); 2073 printf("Endpoint was all gone (dup free)?\n"); 2074 SCTP_INP_WUNLOCK(inp); 2075 SCTP_ASOC_CREATE_UNLOCK(inp); 2076 return; 2077 } 2078 sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL); 2079 2080 if (inp->control) { 2081 sctp_m_freem(inp->control); 2082 inp->control = NULL; 2083 } 2084 if (inp->pkt) { 2085 sctp_m_freem(inp->pkt); 2086 inp->pkt = NULL; 2087 } 2088 so = inp->sctp_socket; 2089 ip_pcb = &inp->ip_inp.inp; /* we could just cast the main 2090 * pointer here but I will 2091 * be nice :> (i.e. ip_pcb = ep;) 2092 */ 2093 2094 if (immediate == 0) { 2095 int cnt_in_sd; 2096 cnt_in_sd = 0; 2097 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL; 2098 asoc = nasoc) { 2099 nasoc = LIST_NEXT(asoc, sctp_tcblist); 2100 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_WAIT) || 2101 (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_ECHOED)) { 2102 /* Just abandon things in the front states */ 2103 SCTP_TCB_LOCK(asoc); 2104 SCTP_INP_WUNLOCK(inp); 2105 sctp_free_assoc(inp, asoc); 2106 SCTP_INP_WLOCK(inp); 2107 continue; 2108 } else { 2109 asoc->asoc.state |= SCTP_STATE_CLOSED_SOCKET; 2110 } 2111 if ((asoc->asoc.size_on_delivery_queue > 0) || 2112 (asoc->asoc.size_on_reasm_queue > 0) || 2113 (asoc->asoc.size_on_all_streams > 0) || 2114 (so && (so->so_rcv.sb_cc > 0)) 2115 ) { 2116 /* Left with Data unread */ 2117 struct mbuf *op_err; 2118 MGET(op_err, M_DONTWAIT, MT_DATA); 2119 if (op_err) { 2120 /* Fill in the user initiated abort */ 2121 struct sctp_paramhdr *ph; 2122 op_err->m_len = 2123 sizeof(struct sctp_paramhdr); 2124 ph = mtod(op_err, 2125 struct sctp_paramhdr *); 2126 ph->param_type = htons( 2127 SCTP_CAUSE_USER_INITIATED_ABT); 2128 ph->param_length = htons(op_err->m_len); 2129 } 2130 SCTP_TCB_LOCK(asoc); 2131 sctp_send_abort_tcb(asoc, op_err); 2132 2133 SCTP_INP_WUNLOCK(inp); 2134 sctp_free_assoc(inp, asoc); 2135 SCTP_INP_WLOCK(inp); 2136 continue; 2137 } else if (TAILQ_EMPTY(&asoc->asoc.send_queue) && 2138 TAILQ_EMPTY(&asoc->asoc.sent_queue)) { 2139 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_SENT) && 2140 (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) { 2141 /* there is nothing queued to send, so I send shutdown */ 2142 SCTP_TCB_LOCK(asoc); 2143 sctp_send_shutdown(asoc, asoc->asoc.primary_destination); 2144 asoc->asoc.state = SCTP_STATE_SHUTDOWN_SENT; 2145 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, asoc->sctp_ep, asoc, 2146 asoc->asoc.primary_destination); 2147 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc, 2148 asoc->asoc.primary_destination); 2149 sctp_chunk_output(inp, asoc, 1); 2150 SCTP_TCB_UNLOCK(asoc); 2151 } 2152 } else { 2153 /* mark into shutdown pending */ 2154 asoc->asoc.state |= SCTP_STATE_SHUTDOWN_PENDING; 2155 } 2156 cnt_in_sd++; 2157 } 2158 /* now is there some left in our SHUTDOWN state? */ 2159 if (cnt_in_sd) { 2160 inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_GONE; 2161 splx(s); 2162 SCTP_INP_WUNLOCK(inp); 2163 SCTP_ASOC_CREATE_UNLOCK(inp); 2164 return; 2165 } 2166 } 2167 #if defined(__FreeBSD__) && __FreeBSD_version >= 503000 2168 if (inp->refcount) { 2169 sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL); 2170 SCTP_INP_WUNLOCK(inp); 2171 SCTP_ASOC_CREATE_UNLOCK(inp); 2172 return; 2173 } 2174 #endif 2175 inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE; 2176 2177 /* XXX */ 2178 rt = rtcache_validate(&ip_pcb->inp_route); 2179 rtcache_unref(rt, &ip_pcb->inp_route); 2180 2181 callout_stop(&inp->sctp_ep.signature_change.timer); 2182 callout_destroy(&inp->sctp_ep.signature_change.timer); 2183 2184 if (so) { 2185 /* First take care of socket level things */ 2186 #ifdef IPSEC 2187 ipsec4_delete_pcbpolicy(ip_pcb); 2188 #endif /*IPSEC*/ 2189 so->so_pcb = 0; 2190 sofree(so); 2191 } 2192 2193 if (ip_pcb->inp_options) { 2194 (void)m_free(ip_pcb->inp_options); 2195 ip_pcb->inp_options = 0; 2196 } 2197 rtcache_free(&ip_pcb->inp_route); 2198 if (ip_pcb->inp_moptions) { 2199 ip_freemoptions(ip_pcb->inp_moptions); 2200 ip_pcb->inp_moptions = 0; 2201 } 2202 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 2203 inp->inp_vflag = 0; 2204 #else 2205 ip_pcb->inp_vflag = 0; 2206 #endif 2207 2208 /* Now the sctp_pcb things */ 2209 /* 2210 * free each asoc if it is not already closed/free. we can't use 2211 * the macro here since le_next will get freed as part of the 2212 * sctp_free_assoc() call. 2213 */ 2214 cnt = 0; 2215 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL; 2216 asoc = nasoc) { 2217 nasoc = LIST_NEXT(asoc, sctp_tcblist); 2218 SCTP_TCB_LOCK(asoc); 2219 if (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_COOKIE_WAIT) { 2220 struct mbuf *op_err; 2221 MGET(op_err, M_DONTWAIT, MT_DATA); 2222 if (op_err) { 2223 /* Fill in the user initiated abort */ 2224 struct sctp_paramhdr *ph; 2225 op_err->m_len = sizeof(struct sctp_paramhdr); 2226 ph = mtod(op_err, struct sctp_paramhdr *); 2227 ph->param_type = htons( 2228 SCTP_CAUSE_USER_INITIATED_ABT); 2229 ph->param_length = htons(op_err->m_len); 2230 } 2231 sctp_send_abort_tcb(asoc, op_err); 2232 } 2233 cnt++; 2234 /* 2235 * sctp_free_assoc() will call sctp_inpcb_free(), 2236 * if SCTP_PCB_FLAGS_SOCKET_GONE set. 2237 * So, we clear it before sctp_free_assoc() making sure 2238 * no double sctp_inpcb_free(). 2239 */ 2240 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SOCKET_GONE; 2241 SCTP_INP_WUNLOCK(inp); 2242 sctp_free_assoc(inp, asoc); 2243 SCTP_INP_WLOCK(inp); 2244 } 2245 while ((sq = TAILQ_FIRST(&inp->sctp_queue_list)) != NULL) { 2246 TAILQ_REMOVE(&inp->sctp_queue_list, sq, next_sq); 2247 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_sockq, sq); 2248 sctppcbinfo.ipi_count_sockq--; 2249 sctppcbinfo.ipi_gencnt_sockq++; 2250 } 2251 inp->sctp_socket = 0; 2252 /* Now first we remove ourselves from the overall list of all EP's */ 2253 2254 /* Unlock inp first, need correct order */ 2255 SCTP_INP_WUNLOCK(inp); 2256 /* now iterator lock */ 2257 SCTP_ITERATOR_LOCK(); 2258 /* now info lock */ 2259 SCTP_INP_INFO_WLOCK(); 2260 /* now reget the inp lock */ 2261 SCTP_INP_WLOCK(inp); 2262 2263 inp_save = LIST_NEXT(inp, sctp_list); 2264 LIST_REMOVE(inp, sctp_list); 2265 /* 2266 * Now the question comes as to if this EP was ever bound at all. 2267 * If it was, then we must pull it out of the EP hash list. 2268 */ 2269 if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) != 2270 SCTP_PCB_FLAGS_UNBOUND) { 2271 /* 2272 * ok, this guy has been bound. It's port is somewhere 2273 * in the sctppcbinfo hash table. Remove it! 2274 */ 2275 LIST_REMOVE(inp, sctp_hash); 2276 } 2277 /* fix any iterators only after out of the list */ 2278 sctp_iterator_inp_being_freed(inp, inp_save); 2279 SCTP_ITERATOR_UNLOCK(); 2280 /* 2281 * if we have an address list the following will free the list of 2282 * ifaddr's that are set into this ep. Again macro limitations here, 2283 * since the LIST_FOREACH could be a bad idea. 2284 */ 2285 for ((laddr = LIST_FIRST(&inp->sctp_addr_list)); laddr != NULL; 2286 laddr = nladdr) { 2287 nladdr = LIST_NEXT(laddr, sctp_nxt_addr); 2288 LIST_REMOVE(laddr, sctp_nxt_addr); 2289 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 2290 sctppcbinfo.ipi_gencnt_laddr++; 2291 sctppcbinfo.ipi_count_laddr--; 2292 } 2293 2294 /* Now lets see about freeing the EP hash table. */ 2295 if (inp->sctp_tcbhash != NULL) { 2296 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_hash, inp->sctp_tcbhash); 2297 inp->sctp_tcbhash = NULL; 2298 } 2299 SCTP_INP_WUNLOCK(inp); 2300 SCTP_ASOC_CREATE_UNLOCK(inp); 2301 SCTP_INP_LOCK_DESTROY(inp); 2302 SCTP_ASOC_CREATE_LOCK_DESTROY(inp); 2303 2304 /* Now we must put the ep memory back into the zone pool */ 2305 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp); 2306 sctppcbinfo.ipi_count_ep--; 2307 2308 SCTP_INP_INFO_WUNLOCK(); 2309 splx(s); 2310 } 2311 2312 2313 struct sctp_nets * 2314 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr) 2315 { 2316 struct sctp_nets *net; 2317 2318 /* use the peer's/remote port for lookup if unspecified */ 2319 #if 0 /* why do we need to check the port for a nets list on an assoc? */ 2320 if (stcb->rport != sin->sin_port) { 2321 /* we cheat and just a sin for this test */ 2322 return (NULL); 2323 } 2324 #endif 2325 /* locate the address */ 2326 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 2327 if (sctp_cmpaddr(addr, rtcache_getdst(&net->ro))) 2328 return (net); 2329 } 2330 return (NULL); 2331 } 2332 2333 2334 /* 2335 * add's a remote endpoint address, done with the INIT/INIT-ACK 2336 * as well as when a ASCONF arrives that adds it. It will also 2337 * initialize all the cwnd stats of stuff. 2338 */ 2339 int 2340 sctp_is_address_on_local_host(struct sockaddr *addr) 2341 { 2342 struct ifnet *ifn; 2343 struct ifaddr *ifa; 2344 int s; 2345 2346 s = pserialize_read_enter(); 2347 IFNET_READER_FOREACH(ifn) { 2348 IFADDR_READER_FOREACH(ifa, ifn) { 2349 if (addr->sa_family == ifa->ifa_addr->sa_family) { 2350 /* same family */ 2351 if (addr->sa_family == AF_INET) { 2352 struct sockaddr_in *sin, *sin_c; 2353 sin = (struct sockaddr_in *)addr; 2354 sin_c = (struct sockaddr_in *) 2355 ifa->ifa_addr; 2356 if (sin->sin_addr.s_addr == 2357 sin_c->sin_addr.s_addr) { 2358 /* we are on the same machine */ 2359 pserialize_read_exit(s); 2360 return (1); 2361 } 2362 } else if (addr->sa_family == AF_INET6) { 2363 struct sockaddr_in6 *sin6, *sin_c6; 2364 sin6 = (struct sockaddr_in6 *)addr; 2365 sin_c6 = (struct sockaddr_in6 *) 2366 ifa->ifa_addr; 2367 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 2368 &sin_c6->sin6_addr)) { 2369 /* we are on the same machine */ 2370 pserialize_read_exit(s); 2371 return (1); 2372 } 2373 } 2374 } 2375 } 2376 } 2377 pserialize_read_exit(s); 2378 2379 return (0); 2380 } 2381 2382 int 2383 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr, 2384 int set_scope, int from) 2385 { 2386 /* 2387 * The following is redundant to the same lines in the 2388 * sctp_aloc_assoc() but is needed since other's call the add 2389 * address function 2390 */ 2391 struct sctp_nets *net, *netfirst; 2392 struct rtentry *rt, *netfirst_rt; 2393 int addr_inscope; 2394 2395 #ifdef SCTP_DEBUG 2396 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 2397 printf("Adding an address (from:%d) to the peer: ", from); 2398 sctp_print_address(newaddr); 2399 } 2400 #endif 2401 netfirst = sctp_findnet(stcb, newaddr); 2402 if (netfirst) { 2403 /* 2404 * Lie and return ok, we don't want to make the association 2405 * go away for this behavior. It will happen in the TCP model 2406 * in a connected socket. It does not reach the hash table 2407 * until after the association is built so it can't be found. 2408 * Mark as reachable, since the initial creation will have 2409 * been cleared and the NOT_IN_ASSOC flag will have been 2410 * added... and we don't want to end up removing it back out. 2411 */ 2412 if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) { 2413 netfirst->dest_state = (SCTP_ADDR_REACHABLE| 2414 SCTP_ADDR_UNCONFIRMED); 2415 } else { 2416 netfirst->dest_state = SCTP_ADDR_REACHABLE; 2417 } 2418 2419 return (0); 2420 } 2421 addr_inscope = 1; 2422 if (newaddr->sa_family == AF_INET) { 2423 struct sockaddr_in *sin; 2424 sin = (struct sockaddr_in *)newaddr; 2425 if (sin->sin_addr.s_addr == 0) { 2426 /* Invalid address */ 2427 return (-1); 2428 } 2429 /* zero out the bzero area */ 2430 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero)); 2431 2432 /* assure len is set */ 2433 sin->sin_len = sizeof(struct sockaddr_in); 2434 if (set_scope) { 2435 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE 2436 stcb->ipv4_local_scope = 1; 2437 #else 2438 if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) { 2439 stcb->asoc.ipv4_local_scope = 1; 2440 } 2441 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */ 2442 2443 if (sctp_is_address_on_local_host(newaddr)) { 2444 stcb->asoc.loopback_scope = 1; 2445 stcb->asoc.ipv4_local_scope = 1; 2446 stcb->asoc.local_scope = 1; 2447 stcb->asoc.site_scope = 1; 2448 } 2449 } else { 2450 if (from == 8) { 2451 /* From connectx */ 2452 if (sctp_is_address_on_local_host(newaddr)) { 2453 stcb->asoc.loopback_scope = 1; 2454 stcb->asoc.ipv4_local_scope = 1; 2455 stcb->asoc.local_scope = 1; 2456 stcb->asoc.site_scope = 1; 2457 } 2458 } 2459 /* Validate the address is in scope */ 2460 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) && 2461 (stcb->asoc.ipv4_local_scope == 0)) { 2462 addr_inscope = 0; 2463 } 2464 } 2465 } else if (newaddr->sa_family == AF_INET6) { 2466 struct sockaddr_in6 *sin6; 2467 sin6 = (struct sockaddr_in6 *)newaddr; 2468 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 2469 /* Invalid address */ 2470 return (-1); 2471 } 2472 /* assure len is set */ 2473 sin6->sin6_len = sizeof(struct sockaddr_in6); 2474 if (set_scope) { 2475 if (sctp_is_address_on_local_host(newaddr)) { 2476 stcb->asoc.loopback_scope = 1; 2477 stcb->asoc.local_scope = 1; 2478 stcb->asoc.ipv4_local_scope = 1; 2479 stcb->asoc.site_scope = 1; 2480 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 2481 /* 2482 * If the new destination is a LINK_LOCAL 2483 * we must have common site scope. Don't set 2484 * the local scope since we may not share all 2485 * links, only loopback can do this. 2486 * Links on the local network would also 2487 * be on our private network for v4 too. 2488 */ 2489 stcb->asoc.ipv4_local_scope = 1; 2490 stcb->asoc.site_scope = 1; 2491 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) { 2492 /* 2493 * If the new destination is SITE_LOCAL 2494 * then we must have site scope in common. 2495 */ 2496 stcb->asoc.site_scope = 1; 2497 } 2498 } else { 2499 if (from == 8) { 2500 /* From connectx */ 2501 if (sctp_is_address_on_local_host(newaddr)) { 2502 stcb->asoc.loopback_scope = 1; 2503 stcb->asoc.ipv4_local_scope = 1; 2504 stcb->asoc.local_scope = 1; 2505 stcb->asoc.site_scope = 1; 2506 } 2507 } 2508 /* Validate the address is in scope */ 2509 if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) && 2510 (stcb->asoc.loopback_scope == 0)) { 2511 addr_inscope = 0; 2512 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) && 2513 (stcb->asoc.local_scope == 0)) { 2514 addr_inscope = 0; 2515 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) && 2516 (stcb->asoc.site_scope == 0)) { 2517 addr_inscope = 0; 2518 } 2519 } 2520 } else { 2521 /* not supported family type */ 2522 return (-1); 2523 } 2524 net = (struct sctp_nets *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_net); 2525 if (net == NULL) { 2526 return (-1); 2527 } 2528 sctppcbinfo.ipi_count_raddr++; 2529 sctppcbinfo.ipi_gencnt_raddr++; 2530 memset(net, 0, sizeof(*net)); 2531 if (newaddr->sa_family == AF_INET) { 2532 ((struct sockaddr_in *)newaddr)->sin_port = stcb->rport; 2533 } else if (newaddr->sa_family == AF_INET6) { 2534 ((struct sockaddr_in6 *)newaddr)->sin6_port = stcb->rport; 2535 } 2536 net->addr_is_local = sctp_is_address_on_local_host(newaddr); 2537 net->failure_threshold = stcb->asoc.def_net_failure; 2538 if (addr_inscope == 0) { 2539 #ifdef SCTP_DEBUG 2540 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 2541 printf("Adding an address which is OUT OF SCOPE\n"); 2542 } 2543 #endif /* SCTP_DEBUG */ 2544 net->dest_state = (SCTP_ADDR_REACHABLE | 2545 SCTP_ADDR_OUT_OF_SCOPE); 2546 } else { 2547 if (from == 8) 2548 /* 8 is passed by connect_x */ 2549 net->dest_state = SCTP_ADDR_REACHABLE; 2550 else 2551 net->dest_state = SCTP_ADDR_REACHABLE | 2552 SCTP_ADDR_UNCONFIRMED; 2553 } 2554 net->RTO = stcb->asoc.initial_rto; 2555 stcb->asoc.numnets++; 2556 net->ref_count = 1; 2557 2558 /* Init the timer structure */ 2559 callout_init(&net->rxt_timer.timer, 0); 2560 callout_init(&net->pmtu_timer.timer, 0); 2561 2562 /* Now generate a route for this guy */ 2563 /* KAME hack: embed scope zone ID */ 2564 if (newaddr->sa_family == AF_INET6) { 2565 struct sockaddr_in6 *sin6; 2566 sin6 = (struct sockaddr_in6 *)newaddr; 2567 if (sa6_embedscope(sin6, ip6_use_defzone) != 0) 2568 return (-1); 2569 } 2570 rt = rtcache_lookup(&net->ro, newaddr); 2571 if (rt) { 2572 net->mtu = rt->rt_ifp->if_mtu; 2573 if (from == 1) { 2574 stcb->asoc.smallest_mtu = net->mtu; 2575 } 2576 /* start things off to match mtu of interface please. */ 2577 rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu; 2578 } else { 2579 net->mtu = stcb->asoc.smallest_mtu; 2580 } 2581 #ifdef SCTP_DEBUG 2582 printf("After lookup\n"); 2583 #endif 2584 if (stcb->asoc.smallest_mtu > net->mtu) { 2585 stcb->asoc.smallest_mtu = net->mtu; 2586 } 2587 /* We take the max of the burst limit times a MTU or the INITIAL_CWND. 2588 * We then limit this to 4 MTU's of sending. 2589 */ 2590 net->cwnd = min((net->mtu * 4), max((stcb->asoc.max_burst * net->mtu), SCTP_INITIAL_CWND)); 2591 2592 /* we always get at LEAST 2 MTU's */ 2593 if (net->cwnd < (2 * net->mtu)) { 2594 net->cwnd = 2 * net->mtu; 2595 } 2596 2597 net->ssthresh = stcb->asoc.peers_rwnd; 2598 2599 net->src_addr_selected = 0; 2600 netfirst = TAILQ_FIRST(&stcb->asoc.nets); 2601 if (rt == NULL) { 2602 /* Since we have no route put it at the back */ 2603 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next); 2604 } else if (netfirst == NULL) { 2605 /* We are the first one in the pool. */ 2606 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2607 } else if ((netfirst_rt = rtcache_validate(&netfirst->ro)) == NULL) { 2608 /* 2609 * First one has NO route. Place this one ahead of the 2610 * first one. 2611 */ 2612 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2613 } else if (rt->rt_ifp != netfirst_rt->rt_ifp) { 2614 rtcache_unref(netfirst_rt, &netfirst->ro); 2615 /* 2616 * This one has a different interface than the one at the 2617 * top of the list. Place it ahead. 2618 */ 2619 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next); 2620 } else { 2621 /* 2622 * Ok we have the same interface as the first one. Move 2623 * forward until we find either 2624 * a) one with a NULL route... insert ahead of that 2625 * b) one with a different ifp.. insert after that. 2626 * c) end of the list.. insert at the tail. 2627 */ 2628 struct sctp_nets *netlook; 2629 struct rtentry *netlook_rt; 2630 do { 2631 netlook = TAILQ_NEXT(netfirst, sctp_next); 2632 if (netlook == NULL) { 2633 /* End of the list */ 2634 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, 2635 sctp_next); 2636 break; 2637 } else if ((netlook_rt = rtcache_validate(&netlook->ro)) == NULL) { 2638 /* next one has NO route */ 2639 TAILQ_INSERT_BEFORE(netfirst, net, sctp_next); 2640 break; 2641 } else if (netlook_rt->rt_ifp != rt->rt_ifp) { 2642 rtcache_unref(netlook_rt, &netlook->ro); 2643 TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook, 2644 net, sctp_next); 2645 break; 2646 } 2647 rtcache_unref(netlook_rt, &netlook->ro); 2648 /* Shift forward */ 2649 netfirst = netlook; 2650 } while (netlook != NULL); 2651 rtcache_unref(netfirst_rt, &netfirst->ro); 2652 } 2653 /* got to have a primary set */ 2654 if (stcb->asoc.primary_destination == 0) { 2655 stcb->asoc.primary_destination = net; 2656 } else if (!rtcache_validate(&stcb->asoc.primary_destination->ro)) { 2657 /* No route to current primary adopt new primary */ 2658 stcb->asoc.primary_destination = net; 2659 } 2660 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, 2661 net); 2662 2663 return (0); 2664 } 2665 2666 2667 /* 2668 * allocate an association and add it to the endpoint. The caller must 2669 * be careful to add all additional addresses once they are know right 2670 * away or else the assoc will be may experience a blackout scenario. 2671 */ 2672 struct sctp_tcb * 2673 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr, 2674 int for_a_init, int *error, uint32_t override_tag) 2675 { 2676 struct sctp_tcb *stcb; 2677 struct sctp_association *asoc; 2678 struct sctpasochead *head; 2679 uint16_t rport; 2680 int err; 2681 2682 /* 2683 * Assumption made here: 2684 * Caller has done a sctp_findassociation_ep_addr(ep, addr's); 2685 * to make sure the address does not exist already. 2686 */ 2687 if (sctppcbinfo.ipi_count_asoc >= SCTP_MAX_NUM_OF_ASOC) { 2688 /* Hit max assoc, sorry no more */ 2689 *error = ENOBUFS; 2690 return (NULL); 2691 } 2692 SCTP_INP_RLOCK(inp); 2693 if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) { 2694 /* 2695 * If its in the TCP pool, its NOT allowed to create an 2696 * association. The parent listener needs to call 2697 * sctp_aloc_assoc.. or the one-2-many socket. If a 2698 * peeled off, or connected one does this.. its an error. 2699 */ 2700 SCTP_INP_RUNLOCK(inp); 2701 *error = EINVAL; 2702 return (NULL); 2703 } 2704 2705 #ifdef SCTP_DEBUG 2706 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2707 printf("Allocate an association for peer:"); 2708 if (firstaddr) 2709 sctp_print_address(firstaddr); 2710 else 2711 printf("None\n"); 2712 printf("Port:%d\n", 2713 ntohs(((struct sockaddr_in *)firstaddr)->sin_port)); 2714 } 2715 #endif /* SCTP_DEBUG */ 2716 if (firstaddr->sa_family == AF_INET) { 2717 struct sockaddr_in *sin; 2718 sin = (struct sockaddr_in *)firstaddr; 2719 if ((sin->sin_port == 0) || (sin->sin_addr.s_addr == 0)) { 2720 /* Invalid address */ 2721 #ifdef SCTP_DEBUG 2722 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2723 printf("peer address invalid\n"); 2724 } 2725 #endif 2726 SCTP_INP_RUNLOCK(inp); 2727 *error = EINVAL; 2728 return (NULL); 2729 } 2730 rport = sin->sin_port; 2731 } else if (firstaddr->sa_family == AF_INET6) { 2732 struct sockaddr_in6 *sin6; 2733 sin6 = (struct sockaddr_in6 *)firstaddr; 2734 if ((sin6->sin6_port == 0) || 2735 (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) { 2736 /* Invalid address */ 2737 #ifdef SCTP_DEBUG 2738 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2739 printf("peer address invalid\n"); 2740 } 2741 #endif 2742 SCTP_INP_RUNLOCK(inp); 2743 *error = EINVAL; 2744 return (NULL); 2745 } 2746 rport = sin6->sin6_port; 2747 } else { 2748 /* not supported family type */ 2749 #ifdef SCTP_DEBUG 2750 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2751 printf("BAD family %d\n", firstaddr->sa_family); 2752 } 2753 #endif 2754 SCTP_INP_RUNLOCK(inp); 2755 *error = EINVAL; 2756 return (NULL); 2757 } 2758 SCTP_INP_RUNLOCK(inp); 2759 if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) { 2760 /* 2761 * If you have not performed a bind, then we need to do 2762 * the ephemerial bind for you. 2763 */ 2764 #ifdef SCTP_DEBUG 2765 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2766 printf("Doing implicit BIND\n"); 2767 } 2768 #endif 2769 2770 if ((err = sctp_inpcb_bind(inp->sctp_socket, 2771 (struct sockaddr *)NULL, (struct lwp *)NULL))){ 2772 /* bind error, probably perm */ 2773 #ifdef SCTP_DEBUG 2774 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2775 printf("BIND FAILS ret:%d\n", err); 2776 } 2777 #endif 2778 2779 *error = err; 2780 return (NULL); 2781 } 2782 } 2783 stcb = (struct sctp_tcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asoc); 2784 if (stcb == NULL) { 2785 /* out of memory? */ 2786 #ifdef SCTP_DEBUG 2787 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2788 printf("aloc_assoc: no assoc mem left, stcb=NULL\n"); 2789 } 2790 #endif 2791 *error = ENOMEM; 2792 return (NULL); 2793 } 2794 sctppcbinfo.ipi_count_asoc++; 2795 sctppcbinfo.ipi_gencnt_asoc++; 2796 2797 memset(stcb, 0, sizeof(*stcb)); 2798 asoc = &stcb->asoc; 2799 SCTP_TCB_LOCK_INIT(stcb); 2800 /* setup back pointers */ 2801 #ifdef SCTP_DEBUG 2802 printf("Before back pointers\n"); 2803 #endif 2804 stcb->sctp_ep = inp; 2805 stcb->sctp_socket = inp->sctp_socket; 2806 if ((err = sctp_init_asoc(inp, asoc, for_a_init, override_tag))) { 2807 /* failed */ 2808 SCTP_TCB_LOCK_DESTROY (stcb); 2809 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2810 sctppcbinfo.ipi_count_asoc--; 2811 #ifdef SCTP_DEBUG 2812 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2813 printf("aloc_assoc: couldn't init asoc, out of mem?!\n"); 2814 } 2815 #endif 2816 *error = err; 2817 return (NULL); 2818 } 2819 /* and the port */ 2820 stcb->rport = rport; 2821 SCTP_INP_INFO_WLOCK(); 2822 SCTP_INP_WLOCK(inp); 2823 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 2824 /* inpcb freed while alloc going on */ 2825 SCTP_TCB_LOCK_DESTROY (stcb); 2826 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2827 SCTP_INP_WUNLOCK(inp); 2828 SCTP_INP_INFO_WUNLOCK(); 2829 sctppcbinfo.ipi_count_asoc--; 2830 #ifdef SCTP_DEBUG 2831 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2832 printf("aloc_assoc: couldn't init asoc, out of mem?!\n"); 2833 } 2834 #endif 2835 *error = EINVAL; 2836 return (NULL); 2837 } 2838 SCTP_TCB_LOCK(stcb); 2839 2840 /* now that my_vtag is set, add it to the hash */ 2841 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, 2842 sctppcbinfo.hashasocmark)]; 2843 /* put it in the bucket in the vtag hash of assoc's for the system */ 2844 LIST_INSERT_HEAD(head, stcb, sctp_asocs); 2845 SCTP_INP_INFO_WUNLOCK(); 2846 2847 2848 if ((err = sctp_add_remote_addr(stcb, firstaddr, 1, 1))) { 2849 /* failure.. memory error? */ 2850 if (asoc->strmout) 2851 free(asoc->strmout, M_PCB); 2852 if (asoc->mapping_array) 2853 free(asoc->mapping_array, M_PCB); 2854 2855 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 2856 sctppcbinfo.ipi_count_asoc--; 2857 #ifdef SCTP_DEBUG 2858 if (sctp_debug_on & SCTP_DEBUG_PCB3) { 2859 printf("aloc_assoc: couldn't add remote addr!\n"); 2860 } 2861 #endif 2862 SCTP_TCB_LOCK_DESTROY (stcb); 2863 *error = ENOBUFS; 2864 return (NULL); 2865 } 2866 /* Init all the timers */ 2867 callout_init(&asoc->hb_timer.timer, 0); 2868 callout_init(&asoc->dack_timer.timer, 0); 2869 callout_init(&asoc->asconf_timer.timer, 0); 2870 callout_init(&asoc->shut_guard_timer.timer, 0); 2871 callout_init(&asoc->autoclose_timer.timer, 0); 2872 callout_init(&asoc->delayed_event_timer.timer, 0); 2873 LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist); 2874 /* now file the port under the hash as well */ 2875 #ifdef SCTP_DEBUG 2876 printf("Before hashing %ld size %d\n", 2877 inp->sctp_hashmark, sctp_pcbtblsize); 2878 #endif 2879 if (inp->sctp_tcbhash != NULL) { 2880 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport, 2881 inp->sctp_hashmark)]; 2882 LIST_INSERT_HEAD(head, stcb, sctp_tcbhash); 2883 } 2884 #ifdef SCTP_DEBUG 2885 printf("After hashing\n"); 2886 #endif 2887 SCTP_INP_WUNLOCK(inp); 2888 #ifdef SCTP_DEBUG 2889 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 2890 printf("Association %p now allocated\n", stcb); 2891 } 2892 #endif 2893 return (stcb); 2894 } 2895 2896 void 2897 sctp_free_remote_addr(struct sctp_nets *net) 2898 { 2899 if (net == NULL) 2900 return; 2901 net->ref_count--; 2902 if (net->ref_count <= 0) { 2903 /* stop timer if running */ 2904 callout_stop(&net->rxt_timer.timer); 2905 callout_stop(&net->pmtu_timer.timer); 2906 callout_destroy(&net->rxt_timer.timer); 2907 callout_destroy(&net->pmtu_timer.timer); 2908 net->dest_state = SCTP_ADDR_NOT_REACHABLE; 2909 rtcache_free(&net->ro); 2910 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_net, net); 2911 sctppcbinfo.ipi_count_raddr--; 2912 } 2913 } 2914 2915 /* 2916 * remove a remote endpoint address from an association, it 2917 * will fail if the address does not exist. 2918 */ 2919 int 2920 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr) 2921 { 2922 /* 2923 * Here we need to remove a remote address. This is quite simple, we 2924 * first find it in the list of address for the association 2925 * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE on 2926 * that item. 2927 * Note we do not allow it to be removed if there are no other 2928 * addresses. 2929 */ 2930 struct sctp_association *asoc; 2931 struct sctp_nets *net, *net_tmp; 2932 asoc = &stcb->asoc; 2933 if (asoc->numnets < 2) { 2934 /* Must have at LEAST two remote addresses */ 2935 return (-1); 2936 } 2937 /* locate the address */ 2938 for (net = TAILQ_FIRST(&asoc->nets); net != NULL; net = net_tmp) { 2939 net_tmp = TAILQ_NEXT(net, sctp_next); 2940 if (rtcache_getdst(&net->ro)->sa_family != remaddr->sa_family) { 2941 continue; 2942 } 2943 if (sctp_cmpaddr(rtcache_getdst(&net->ro), remaddr)) { 2944 /* we found the guy */ 2945 asoc->numnets--; 2946 TAILQ_REMOVE(&asoc->nets, net, sctp_next); 2947 sctp_free_remote_addr(net); 2948 if (net == asoc->primary_destination) { 2949 /* Reset primary */ 2950 struct sctp_nets *lnet; 2951 lnet = TAILQ_FIRST(&asoc->nets); 2952 /* Try to find a confirmed primary */ 2953 asoc->primary_destination = 2954 sctp_find_alternate_net(stcb, lnet); 2955 } 2956 if (net == asoc->last_data_chunk_from) { 2957 /* Reset primary */ 2958 asoc->last_data_chunk_from = 2959 TAILQ_FIRST(&asoc->nets); 2960 } 2961 if (net == asoc->last_control_chunk_from) { 2962 /* Reset primary */ 2963 asoc->last_control_chunk_from = 2964 TAILQ_FIRST(&asoc->nets); 2965 } 2966 if (net == asoc->asconf_last_sent_to) { 2967 /* Reset primary */ 2968 asoc->asconf_last_sent_to = 2969 TAILQ_FIRST(&asoc->nets); 2970 } 2971 return (0); 2972 } 2973 } 2974 /* not found. */ 2975 return (-2); 2976 } 2977 2978 2979 static void 2980 sctp_add_vtag_to_timewait(struct sctp_inpcb *inp, u_int32_t tag) 2981 { 2982 struct sctpvtaghead *chain; 2983 struct sctp_tagblock *twait_block; 2984 struct timeval now; 2985 int set, i; 2986 SCTP_GETTIME_TIMEVAL(&now); 2987 chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)]; 2988 set = 0; 2989 if (!LIST_EMPTY(chain)) { 2990 /* Block(s) present, lets find space, and expire on the fly */ 2991 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) { 2992 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) { 2993 if ((twait_block->vtag_block[i].v_tag == 0) && 2994 !set) { 2995 twait_block->vtag_block[0].tv_sec_at_expire = 2996 now.tv_sec + SCTP_TIME_WAIT; 2997 twait_block->vtag_block[0].v_tag = tag; 2998 set = 1; 2999 } else if ((twait_block->vtag_block[i].v_tag) && 3000 ((long)twait_block->vtag_block[i].tv_sec_at_expire > 3001 now.tv_sec)) { 3002 /* Audit expires this guy */ 3003 twait_block->vtag_block[i].tv_sec_at_expire = 0; 3004 twait_block->vtag_block[i].v_tag = 0; 3005 if (set == 0) { 3006 /* Reuse it for my new tag */ 3007 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + SCTP_TIME_WAIT; 3008 twait_block->vtag_block[0].v_tag = tag; 3009 set = 1; 3010 } 3011 } 3012 } 3013 if (set) { 3014 /* 3015 * We only do up to the block where we can 3016 * place our tag for audits 3017 */ 3018 break; 3019 } 3020 } 3021 } 3022 /* Need to add a new block to chain */ 3023 if (!set) { 3024 twait_block = malloc(sizeof(struct sctp_tagblock), M_PCB, M_NOWAIT); 3025 if (twait_block == NULL) { 3026 return; 3027 } 3028 memset(twait_block, 0, sizeof(struct sctp_timewait)); 3029 LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock); 3030 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + 3031 SCTP_TIME_WAIT; 3032 twait_block->vtag_block[0].v_tag = tag; 3033 } 3034 } 3035 3036 3037 static void 3038 sctp_iterator_asoc_being_freed(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 3039 { 3040 struct sctp_iterator *it; 3041 3042 3043 3044 /* Unlock the tcb lock we do this so 3045 * we avoid a dead lock scenario where 3046 * the iterator is waiting on the TCB lock 3047 * and the TCB lock is waiting on the iterator 3048 * lock. 3049 */ 3050 SCTP_ITERATOR_LOCK(); 3051 SCTP_INP_INFO_WLOCK(); 3052 SCTP_INP_WLOCK(inp); 3053 SCTP_TCB_LOCK(stcb); 3054 3055 it = stcb->asoc.stcb_starting_point_for_iterator; 3056 if (it == NULL) { 3057 return; 3058 } 3059 if (it->inp != stcb->sctp_ep) { 3060 /* hm, focused on the wrong one? */ 3061 return; 3062 } 3063 if (it->stcb != stcb) { 3064 return; 3065 } 3066 it->stcb = LIST_NEXT(stcb, sctp_tcblist); 3067 if (it->stcb == NULL) { 3068 /* done with all asoc's in this assoc */ 3069 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) { 3070 it->inp = NULL; 3071 } else { 3072 3073 it->inp = LIST_NEXT(inp, sctp_list); 3074 } 3075 } 3076 } 3077 3078 /* 3079 * Free the association after un-hashing the remote port. 3080 */ 3081 void 3082 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 3083 { 3084 struct sctp_association *asoc; 3085 struct sctp_nets *net, *prev; 3086 struct sctp_laddr *laddr; 3087 struct sctp_tmit_chunk *chk; 3088 struct sctp_asconf_addr *aparam; 3089 struct sctp_socket_q_list *sq; 3090 int s; 3091 3092 /* first, lets purge the entry from the hash table. */ 3093 s = splsoftnet(); 3094 if (stcb->asoc.state == 0) { 3095 printf("Freeing already free association:%p - huh??\n", 3096 stcb); 3097 splx(s); 3098 return; 3099 } 3100 asoc = &stcb->asoc; 3101 asoc->state = 0; 3102 /* now clean up any other timers */ 3103 callout_stop(&asoc->hb_timer.timer); 3104 callout_destroy(&asoc->hb_timer.timer); 3105 callout_stop(&asoc->dack_timer.timer); 3106 callout_destroy(&asoc->dack_timer.timer); 3107 callout_stop(&asoc->asconf_timer.timer); 3108 callout_destroy(&asoc->asconf_timer.timer); 3109 callout_stop(&asoc->shut_guard_timer.timer); 3110 callout_destroy(&asoc->shut_guard_timer.timer); 3111 callout_stop(&asoc->autoclose_timer.timer); 3112 callout_destroy(&asoc->autoclose_timer.timer); 3113 callout_stop(&asoc->delayed_event_timer.timer); 3114 callout_destroy(&asoc->delayed_event_timer.timer); 3115 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3116 callout_stop(&net->rxt_timer.timer); 3117 callout_stop(&net->pmtu_timer.timer); 3118 callout_destroy(&net->rxt_timer.timer); 3119 callout_destroy(&net->pmtu_timer.timer); 3120 } 3121 3122 /* Iterator asoc being freed we send an 3123 * unlocked TCB. It returns with INP_INFO 3124 * and INP write locked and the TCB locked 3125 * too and of course the iterator lock 3126 * in place as well.. 3127 */ 3128 SCTP_TCB_UNLOCK(stcb); 3129 sctp_iterator_asoc_being_freed(inp, stcb); 3130 3131 /* Null all of my entry's on the socket q */ 3132 TAILQ_FOREACH(sq, &inp->sctp_queue_list, next_sq) { 3133 if (sq->tcb == stcb) { 3134 sq->tcb = NULL; 3135 } 3136 } 3137 3138 if (inp->sctp_tcb_at_block == (void *)stcb) { 3139 inp->error_on_block = ECONNRESET; 3140 } 3141 3142 if (inp->sctp_tcbhash) { 3143 LIST_REMOVE(stcb, sctp_tcbhash); 3144 } 3145 /* Now lets remove it from the list of ALL associations in the EP */ 3146 LIST_REMOVE(stcb, sctp_tcblist); 3147 SCTP_INP_WUNLOCK(inp); 3148 SCTP_ITERATOR_UNLOCK(); 3149 3150 3151 /* pull from vtag hash */ 3152 LIST_REMOVE(stcb, sctp_asocs); 3153 3154 /* 3155 * Now before we can free the assoc, we must remove all of the 3156 * networks and any other allocated space.. i.e. add removes here 3157 * before the SCTP_ZONE_FREE() of the tasoc entry. 3158 */ 3159 3160 sctp_add_vtag_to_timewait(inp, asoc->my_vtag); 3161 SCTP_INP_INFO_WUNLOCK(); 3162 prev = NULL; 3163 while (!TAILQ_EMPTY(&asoc->nets)) { 3164 net = TAILQ_FIRST(&asoc->nets); 3165 /* pull from list */ 3166 if ((sctppcbinfo.ipi_count_raddr == 0) || (prev == net)) { 3167 break; 3168 } 3169 prev = net; 3170 TAILQ_REMOVE(&asoc->nets, net, sctp_next); 3171 rtcache_free(&net->ro); 3172 /* free it */ 3173 net->ref_count = 0; 3174 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_net, net); 3175 sctppcbinfo.ipi_count_raddr--; 3176 } 3177 /* 3178 * The chunk lists and such SHOULD be empty but we check them 3179 * just in case. 3180 */ 3181 /* anything on the wheel needs to be removed */ 3182 while (!TAILQ_EMPTY(&asoc->out_wheel)) { 3183 struct sctp_stream_out *outs; 3184 outs = TAILQ_FIRST(&asoc->out_wheel); 3185 TAILQ_REMOVE(&asoc->out_wheel, outs, next_spoke); 3186 /* now clean up any chunks here */ 3187 chk = TAILQ_FIRST(&outs->outqueue); 3188 while (chk) { 3189 TAILQ_REMOVE(&outs->outqueue, chk, sctp_next); 3190 if (chk->data) { 3191 sctp_m_freem(chk->data); 3192 chk->data = NULL; 3193 } 3194 chk->whoTo = NULL; 3195 chk->asoc = NULL; 3196 /* Free the chunk */ 3197 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3198 sctppcbinfo.ipi_count_chunk--; 3199 sctppcbinfo.ipi_gencnt_chunk++; 3200 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3201 panic("Chunk count is negative"); 3202 } 3203 chk = TAILQ_FIRST(&outs->outqueue); 3204 } 3205 outs = TAILQ_FIRST(&asoc->out_wheel); 3206 } 3207 3208 if (asoc->pending_reply) { 3209 free(asoc->pending_reply, M_PCB); 3210 asoc->pending_reply = NULL; 3211 } 3212 chk = TAILQ_FIRST(&asoc->pending_reply_queue); 3213 while (chk) { 3214 TAILQ_REMOVE(&asoc->pending_reply_queue, chk, sctp_next); 3215 if (chk->data) { 3216 sctp_m_freem(chk->data); 3217 chk->data = NULL; 3218 } 3219 chk->whoTo = NULL; 3220 chk->asoc = NULL; 3221 /* Free the chunk */ 3222 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3223 sctppcbinfo.ipi_count_chunk--; 3224 sctppcbinfo.ipi_gencnt_chunk++; 3225 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3226 panic("Chunk count is negative"); 3227 } 3228 chk = TAILQ_FIRST(&asoc->pending_reply_queue); 3229 } 3230 /* pending send queue SHOULD be empty */ 3231 if (!TAILQ_EMPTY(&asoc->send_queue)) { 3232 chk = TAILQ_FIRST(&asoc->send_queue); 3233 while (chk) { 3234 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next); 3235 if (chk->data) { 3236 sctp_m_freem(chk->data); 3237 chk->data = NULL; 3238 } 3239 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3240 sctppcbinfo.ipi_count_chunk--; 3241 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3242 panic("Chunk count is negative"); 3243 } 3244 sctppcbinfo.ipi_gencnt_chunk++; 3245 chk = TAILQ_FIRST(&asoc->send_queue); 3246 } 3247 } 3248 /* sent queue SHOULD be empty */ 3249 if (!TAILQ_EMPTY(&asoc->sent_queue)) { 3250 chk = TAILQ_FIRST(&asoc->sent_queue); 3251 while (chk) { 3252 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next); 3253 if (chk->data) { 3254 sctp_m_freem(chk->data); 3255 chk->data = NULL; 3256 } 3257 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3258 sctppcbinfo.ipi_count_chunk--; 3259 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3260 panic("Chunk count is negative"); 3261 } 3262 sctppcbinfo.ipi_gencnt_chunk++; 3263 chk = TAILQ_FIRST(&asoc->sent_queue); 3264 } 3265 } 3266 /* control queue MAY not be empty */ 3267 if (!TAILQ_EMPTY(&asoc->control_send_queue)) { 3268 chk = TAILQ_FIRST(&asoc->control_send_queue); 3269 while (chk) { 3270 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next); 3271 if (chk->data) { 3272 sctp_m_freem(chk->data); 3273 chk->data = NULL; 3274 } 3275 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3276 sctppcbinfo.ipi_count_chunk--; 3277 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3278 panic("Chunk count is negative"); 3279 } 3280 sctppcbinfo.ipi_gencnt_chunk++; 3281 chk = TAILQ_FIRST(&asoc->control_send_queue); 3282 } 3283 } 3284 if (!TAILQ_EMPTY(&asoc->reasmqueue)) { 3285 chk = TAILQ_FIRST(&asoc->reasmqueue); 3286 while (chk) { 3287 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next); 3288 if (chk->data) { 3289 sctp_m_freem(chk->data); 3290 chk->data = NULL; 3291 } 3292 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3293 sctppcbinfo.ipi_count_chunk--; 3294 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3295 panic("Chunk count is negative"); 3296 } 3297 sctppcbinfo.ipi_gencnt_chunk++; 3298 chk = TAILQ_FIRST(&asoc->reasmqueue); 3299 } 3300 } 3301 if (!TAILQ_EMPTY(&asoc->delivery_queue)) { 3302 chk = TAILQ_FIRST(&asoc->delivery_queue); 3303 while (chk) { 3304 TAILQ_REMOVE(&asoc->delivery_queue, chk, sctp_next); 3305 if (chk->data) { 3306 sctp_m_freem(chk->data); 3307 chk->data = NULL; 3308 } 3309 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 3310 sctppcbinfo.ipi_count_chunk--; 3311 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3312 panic("Chunk count is negative"); 3313 } 3314 sctppcbinfo.ipi_gencnt_chunk++; 3315 chk = TAILQ_FIRST(&asoc->delivery_queue); 3316 } 3317 } 3318 if (asoc->mapping_array) { 3319 free(asoc->mapping_array, M_PCB); 3320 asoc->mapping_array = NULL; 3321 } 3322 3323 /* the stream outs */ 3324 if (asoc->strmout) { 3325 free(asoc->strmout, M_PCB); 3326 asoc->strmout = NULL; 3327 } 3328 asoc->streamoutcnt = 0; 3329 if (asoc->strmin) { 3330 int i; 3331 for (i = 0; i < asoc->streamincnt; i++) { 3332 if (!TAILQ_EMPTY(&asoc->strmin[i].inqueue)) { 3333 /* We have somethings on the streamin queue */ 3334 chk = TAILQ_FIRST(&asoc->strmin[i].inqueue); 3335 while (chk) { 3336 TAILQ_REMOVE(&asoc->strmin[i].inqueue, 3337 chk, sctp_next); 3338 if (chk->data) { 3339 sctp_m_freem(chk->data); 3340 chk->data = NULL; 3341 } 3342 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, 3343 chk); 3344 sctppcbinfo.ipi_count_chunk--; 3345 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3346 panic("Chunk count is negative"); 3347 } 3348 sctppcbinfo.ipi_gencnt_chunk++; 3349 chk = TAILQ_FIRST(&asoc->strmin[i].inqueue); 3350 } 3351 } 3352 } 3353 free(asoc->strmin, M_PCB); 3354 asoc->strmin = NULL; 3355 } 3356 asoc->streamincnt = 0; 3357 /* local addresses, if any */ 3358 while (!LIST_EMPTY(&asoc->sctp_local_addr_list)) { 3359 laddr = LIST_FIRST(&asoc->sctp_local_addr_list); 3360 LIST_REMOVE(laddr, sctp_nxt_addr); 3361 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 3362 sctppcbinfo.ipi_count_laddr--; 3363 } 3364 /* pending asconf (address) parameters */ 3365 while (!TAILQ_EMPTY(&asoc->asconf_queue)) { 3366 aparam = TAILQ_FIRST(&asoc->asconf_queue); 3367 TAILQ_REMOVE(&asoc->asconf_queue, aparam, next); 3368 free(aparam, M_PCB); 3369 } 3370 if (asoc->last_asconf_ack_sent != NULL) { 3371 sctp_m_freem(asoc->last_asconf_ack_sent); 3372 asoc->last_asconf_ack_sent = NULL; 3373 } 3374 /* Insert new items here :> */ 3375 3376 /* Get rid of LOCK */ 3377 SCTP_TCB_LOCK_DESTROY(stcb); 3378 3379 /* now clean up the tasoc itself */ 3380 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb); 3381 sctppcbinfo.ipi_count_asoc--; 3382 if ((inp->sctp_socket->so_snd.sb_cc) || 3383 (inp->sctp_socket->so_snd.sb_mbcnt)) { 3384 /* This will happen when a abort is done */ 3385 inp->sctp_socket->so_snd.sb_cc = 0; 3386 inp->sctp_socket->so_snd.sb_mbcnt = 0; 3387 } 3388 if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) { 3389 if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) { 3390 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) { 3391 /* 3392 * For the base fd, that is NOT in TCP pool we 3393 * turn off the connected flag. This allows 3394 * non-listening endpoints to connect/shutdown/ 3395 * connect. 3396 */ 3397 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED; 3398 soisdisconnected(inp->sctp_socket); 3399 } 3400 /* 3401 * For those that are in the TCP pool we just leave 3402 * so it cannot be used. When they close the fd we 3403 * will free it all. 3404 */ 3405 } 3406 } 3407 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) { 3408 sctp_inpcb_free(inp, 0); 3409 } 3410 splx(s); 3411 } 3412 3413 3414 /* 3415 * determine if a destination is "reachable" based upon the addresses 3416 * bound to the current endpoint (e.g. only v4 or v6 currently bound) 3417 */ 3418 /* 3419 * FIX: if we allow assoc-level bindx(), then this needs to be fixed 3420 * to use assoc level v4/v6 flags, as the assoc *may* not have the 3421 * same address types bound as its endpoint 3422 */ 3423 int 3424 sctp_destination_is_reachable(struct sctp_tcb *stcb, const struct sockaddr *destaddr) 3425 { 3426 struct sctp_inpcb *inp; 3427 int answer; 3428 3429 /* No locks here, the TCB, in all cases is already 3430 * locked and an assoc is up. There is either a 3431 * INP lock by the caller applied (in asconf case when 3432 * deleting an address) or NOT in the HB case, however 3433 * if HB then the INP increment is up and the INP 3434 * will not be removed (on top of the fact that 3435 * we have a TCB lock). So we only want to 3436 * read the sctp_flags, which is either bound-all 3437 * or not.. no protection needed since once an 3438 * assoc is up you can't be changing your binding. 3439 */ 3440 inp = stcb->sctp_ep; 3441 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3442 /* if bound all, destination is not restricted */ 3443 /* RRS: Question during lock work: Is this 3444 * correct? If you are bound-all you still 3445 * might need to obey the V4--V6 flags??? 3446 * IMO this bound-all stuff needs to be removed! 3447 */ 3448 return (1); 3449 } 3450 /* NOTE: all "scope" checks are done when local addresses are added */ 3451 if (destaddr->sa_family == AF_INET6) { 3452 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3453 answer = inp->inp_vflag & INP_IPV6; 3454 #else 3455 answer = inp->ip_inp.inp.inp_vflag & INP_IPV6; 3456 #endif 3457 } else if (destaddr->sa_family == AF_INET) { 3458 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3459 answer = inp->inp_vflag & INP_IPV4; 3460 #else 3461 answer = inp->ip_inp.inp.inp_vflag & INP_IPV4; 3462 #endif 3463 } else { 3464 /* invalid family, so it's unreachable */ 3465 answer = 0; 3466 } 3467 return (answer); 3468 } 3469 3470 /* 3471 * update the inp_vflags on an endpoint 3472 */ 3473 static void 3474 sctp_update_ep_vflag(struct sctp_inpcb *inp) { 3475 struct sctp_laddr *laddr; 3476 3477 /* first clear the flag */ 3478 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3479 inp->inp_vflag = 0; 3480 #else 3481 inp->ip_inp.inp.inp_vflag = 0; 3482 #endif 3483 /* set the flag based on addresses on the ep list */ 3484 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3485 if (laddr->ifa == NULL) { 3486 #ifdef SCTP_DEBUG 3487 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 3488 printf("An ounce of prevention is worth a pound of cure\n"); 3489 } 3490 #endif /* SCTP_DEBUG */ 3491 continue; 3492 } 3493 if (laddr->ifa->ifa_addr) { 3494 continue; 3495 } 3496 if (laddr->ifa->ifa_addr->sa_family == AF_INET6) { 3497 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3498 inp->inp_vflag |= INP_IPV6; 3499 #else 3500 inp->ip_inp.inp.inp_vflag |= INP_IPV6; 3501 #endif 3502 } else if (laddr->ifa->ifa_addr->sa_family == AF_INET) { 3503 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3504 inp->inp_vflag |= INP_IPV4; 3505 #else 3506 inp->ip_inp.inp.inp_vflag |= INP_IPV4; 3507 #endif 3508 } 3509 } 3510 } 3511 3512 /* 3513 * Add the address to the endpoint local address list 3514 * There is nothing to be done if we are bound to all addresses 3515 */ 3516 int 3517 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa) 3518 { 3519 struct sctp_laddr *laddr; 3520 int fnd, error; 3521 fnd = 0; 3522 3523 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3524 /* You are already bound to all. You have it already */ 3525 return (0); 3526 } 3527 if (ifa->ifa_addr->sa_family == AF_INET6) { 3528 struct in6_ifaddr *ifa6; 3529 ifa6 = (struct in6_ifaddr *)ifa; 3530 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 3531 IN6_IFF_DEPRECATED | IN6_IFF_ANYCAST | IN6_IFF_NOTREADY)) 3532 /* Can't bind a non-existent addr. */ 3533 return (-1); 3534 } 3535 /* first, is it already present? */ 3536 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3537 if (laddr->ifa == ifa) { 3538 fnd = 1; 3539 break; 3540 } 3541 } 3542 3543 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd == 0)) { 3544 /* Not bound to all */ 3545 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa); 3546 if (error != 0) 3547 return (error); 3548 inp->laddr_count++; 3549 /* update inp_vflag flags */ 3550 if (ifa->ifa_addr->sa_family == AF_INET6) { 3551 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3552 inp->inp_vflag |= INP_IPV6; 3553 #else 3554 inp->ip_inp.inp.inp_vflag |= INP_IPV6; 3555 #endif 3556 } else if (ifa->ifa_addr->sa_family == AF_INET) { 3557 #if !(defined(__FreeBSD__) || defined(__APPLE__)) 3558 inp->inp_vflag |= INP_IPV4; 3559 #else 3560 inp->ip_inp.inp.inp_vflag |= INP_IPV4; 3561 #endif 3562 } 3563 } 3564 return (0); 3565 } 3566 3567 3568 /* 3569 * select a new (hopefully reachable) destination net 3570 * (should only be used when we deleted an ep addr that is the 3571 * only usable source address to reach the destination net) 3572 */ 3573 static void 3574 sctp_select_primary_destination(struct sctp_tcb *stcb) 3575 { 3576 struct sctp_nets *net; 3577 3578 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 3579 /* for now, we'll just pick the first reachable one we find */ 3580 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) 3581 continue; 3582 if (sctp_destination_is_reachable(stcb, 3583 rtcache_getdst(&net->ro))) { 3584 /* found a reachable destination */ 3585 stcb->asoc.primary_destination = net; 3586 } 3587 } 3588 /* I can't there from here! ...we're gonna die shortly... */ 3589 } 3590 3591 3592 /* 3593 * Delete the address from the endpoint local address list 3594 * There is nothing to be done if we are bound to all addresses 3595 */ 3596 int 3597 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa) 3598 { 3599 struct sctp_laddr *laddr; 3600 int fnd; 3601 fnd = 0; 3602 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 3603 /* You are already bound to all. You have it already */ 3604 return (EINVAL); 3605 } 3606 3607 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 3608 if (laddr->ifa == ifa) { 3609 fnd = 1; 3610 break; 3611 } 3612 } 3613 if (fnd && (inp->laddr_count < 2)) { 3614 /* can't delete unless there are at LEAST 2 addresses */ 3615 return (-1); 3616 } 3617 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd)) { 3618 /* 3619 * clean up any use of this address 3620 * go through our associations and clear any 3621 * last_used_address that match this one 3622 * for each assoc, see if a new primary_destination is needed 3623 */ 3624 struct sctp_tcb *stcb; 3625 3626 /* clean up "next_addr_touse" */ 3627 if (inp->next_addr_touse == laddr) 3628 /* delete this address */ 3629 inp->next_addr_touse = NULL; 3630 3631 /* clean up "last_used_address" */ 3632 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 3633 if (stcb->asoc.last_used_address == laddr) 3634 /* delete this address */ 3635 stcb->asoc.last_used_address = NULL; 3636 } /* for each tcb */ 3637 3638 /* remove it from the ep list */ 3639 sctp_remove_laddr(laddr); 3640 inp->laddr_count--; 3641 /* update inp_vflag flags */ 3642 sctp_update_ep_vflag(inp); 3643 /* select a new primary destination if needed */ 3644 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 3645 /* presume caller (sctp_asconf.c) already owns INP lock */ 3646 SCTP_TCB_LOCK(stcb); 3647 if (sctp_destination_is_reachable(stcb, 3648 rtcache_getdst(&stcb->asoc.primary_destination->ro)) == 0) { 3649 sctp_select_primary_destination(stcb); 3650 } 3651 SCTP_TCB_UNLOCK(stcb); 3652 } /* for each tcb */ 3653 } 3654 return (0); 3655 } 3656 3657 /* 3658 * Add the addr to the TCB local address list 3659 * For the BOUNDALL or dynamic case, this is a "pending" address list 3660 * (eg. addresses waiting for an ASCONF-ACK response) 3661 * For the subset binding, static case, this is a "valid" address list 3662 */ 3663 int 3664 sctp_add_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa) 3665 { 3666 struct sctp_laddr *laddr; 3667 int error; 3668 3669 /* Assumes TCP is locked.. and possiblye 3670 * the INP. May need to confirm/fix that if 3671 * we need it and is not the case. 3672 */ 3673 if (ifa->ifa_addr->sa_family == AF_INET6) { 3674 struct in6_ifaddr *ifa6; 3675 ifa6 = (struct in6_ifaddr *)ifa; 3676 if (ifa6->ia6_flags & (IN6_IFF_DETACHED | 3677 /* IN6_IFF_DEPRECATED | */ 3678 IN6_IFF_ANYCAST | 3679 IN6_IFF_NOTREADY)) 3680 /* Can't bind a non-existent addr. */ 3681 return (-1); 3682 } 3683 /* does the address already exist? */ 3684 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 3685 if (laddr->ifa == ifa) { 3686 return (-1); 3687 } 3688 } 3689 3690 /* add to the list */ 3691 error = sctp_insert_laddr(&stcb->asoc.sctp_local_addr_list, ifa); 3692 if (error != 0) 3693 return (error); 3694 return (0); 3695 } 3696 3697 /* 3698 * insert an laddr entry with the given ifa for the desired list 3699 */ 3700 int 3701 sctp_insert_laddr(struct sctpladdr *list, struct ifaddr *ifa) { 3702 struct sctp_laddr *laddr; 3703 int s; 3704 3705 s = splsoftnet(); 3706 3707 laddr = (struct sctp_laddr *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr); 3708 if (laddr == NULL) { 3709 /* out of memory? */ 3710 splx(s); 3711 return (EINVAL); 3712 } 3713 sctppcbinfo.ipi_count_laddr++; 3714 sctppcbinfo.ipi_gencnt_laddr++; 3715 memset(laddr, 0, sizeof(*laddr)); 3716 laddr->ifa = ifa; 3717 /* insert it */ 3718 LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr); 3719 3720 splx(s); 3721 return (0); 3722 } 3723 3724 /* 3725 * Remove an laddr entry from the local address list (on an assoc) 3726 */ 3727 void 3728 sctp_remove_laddr(struct sctp_laddr *laddr) 3729 { 3730 int s; 3731 s = splsoftnet(); 3732 /* remove from the list */ 3733 LIST_REMOVE(laddr, sctp_nxt_addr); 3734 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr); 3735 sctppcbinfo.ipi_count_laddr--; 3736 sctppcbinfo.ipi_gencnt_laddr++; 3737 3738 splx(s); 3739 } 3740 3741 /* 3742 * Remove an address from the TCB local address list 3743 */ 3744 int 3745 sctp_del_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa) 3746 { 3747 struct sctp_inpcb *inp; 3748 struct sctp_laddr *laddr; 3749 3750 /* This is called by asconf work. It is assumed that 3751 * a) The TCB is locked 3752 * and 3753 * b) The INP is locked. 3754 * This is true in as much as I can trace through 3755 * the entry asconf code where I did these locks. 3756 * Again, the ASCONF code is a bit different in 3757 * that it does lock the INP during its work often 3758 * times. This must be since we don't want other 3759 * proc's looking up things while what they are 3760 * looking up is changing :-D 3761 */ 3762 3763 inp = stcb->sctp_ep; 3764 /* if subset bound and don't allow ASCONF's, can't delete last */ 3765 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && 3766 ((inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) == 0)) { 3767 if (stcb->asoc.numnets < 2) { 3768 /* can't delete last address */ 3769 return (-1); 3770 } 3771 } 3772 3773 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 3774 /* remove the address if it exists */ 3775 if (laddr->ifa == NULL) 3776 continue; 3777 if (laddr->ifa == ifa) { 3778 sctp_remove_laddr(laddr); 3779 return (0); 3780 } 3781 } 3782 3783 /* address not found! */ 3784 return (-1); 3785 } 3786 3787 /* 3788 * Remove an address from the TCB local address list 3789 * lookup using a sockaddr addr 3790 */ 3791 int 3792 sctp_del_local_addr_assoc_sa(struct sctp_tcb *stcb, struct sockaddr *sa) 3793 { 3794 struct sctp_inpcb *inp; 3795 struct sctp_laddr *laddr; 3796 struct sockaddr *l_sa; 3797 3798 /* 3799 * This function I find does not seem to have a caller. 3800 * As such we NEED TO DELETE this code. If we do 3801 * find a caller, the caller MUST have locked the TCB 3802 * at the least and probably the INP as well. 3803 */ 3804 inp = stcb->sctp_ep; 3805 /* if subset bound and don't allow ASCONF's, can't delete last */ 3806 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && 3807 ((inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) == 0)) { 3808 if (stcb->asoc.numnets < 2) { 3809 /* can't delete last address */ 3810 return (-1); 3811 } 3812 } 3813 3814 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) { 3815 /* make sure the address exists */ 3816 if (laddr->ifa == NULL) 3817 continue; 3818 if (laddr->ifa->ifa_addr == NULL) 3819 continue; 3820 3821 l_sa = laddr->ifa->ifa_addr; 3822 if (l_sa->sa_family == AF_INET6) { 3823 /* IPv6 address */ 3824 struct sockaddr_in6 *sin1, *sin2; 3825 sin1 = (struct sockaddr_in6 *)l_sa; 3826 sin2 = (struct sockaddr_in6 *)sa; 3827 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr, 3828 sizeof(struct in6_addr)) == 0) { 3829 /* matched */ 3830 sctp_remove_laddr(laddr); 3831 return (0); 3832 } 3833 } else if (l_sa->sa_family == AF_INET) { 3834 /* IPv4 address */ 3835 struct sockaddr_in *sin1, *sin2; 3836 sin1 = (struct sockaddr_in *)l_sa; 3837 sin2 = (struct sockaddr_in *)sa; 3838 if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) { 3839 /* matched */ 3840 sctp_remove_laddr(laddr); 3841 return (0); 3842 } 3843 } else { 3844 /* invalid family */ 3845 return (-1); 3846 } 3847 } /* end foreach */ 3848 /* address not found! */ 3849 return (-1); 3850 } 3851 3852 static char sctp_pcb_initialized = 0; 3853 3854 #if defined(__FreeBSD__) || defined(__APPLE__) 3855 /* sysctl */ 3856 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC; 3857 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR; 3858 3859 #endif /* FreeBSD || APPLE */ 3860 3861 #ifndef SCTP_TCBHASHSIZE 3862 #define SCTP_TCBHASHSIZE 1024 3863 #endif 3864 3865 #ifndef SCTP_CHUNKQUEUE_SCALE 3866 #define SCTP_CHUNKQUEUE_SCALE 10 3867 #endif 3868 3869 void 3870 sctp_pcb_init(void) 3871 { 3872 /* 3873 * SCTP initialization for the PCB structures 3874 * should be called by the sctp_init() funciton. 3875 */ 3876 int i; 3877 int hashtblsize = SCTP_TCBHASHSIZE; 3878 3879 #if defined(__FreeBSD__) || defined(__APPLE__) 3880 int sctp_chunkscale = SCTP_CHUNKQUEUE_SCALE; 3881 #endif 3882 3883 if (sctp_pcb_initialized != 0) { 3884 /* error I was called twice */ 3885 return; 3886 } 3887 sctp_pcb_initialized = 1; 3888 3889 /* Init all peg counts */ 3890 for (i = 0; i < SCTP_NUMBER_OF_PEGS; i++) { 3891 sctp_pegs[i] = 0; 3892 } 3893 3894 /* init the empty list of (All) Endpoints */ 3895 LIST_INIT(&sctppcbinfo.listhead); 3896 3897 /* init the iterator head */ 3898 LIST_INIT(&sctppcbinfo.iteratorhead); 3899 3900 /* init the hash table of endpoints */ 3901 #if defined(__FreeBSD__) 3902 #if defined(__FreeBSD_cc_version) && __FreeBSD_cc_version >= 440000 3903 TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &hashtblsize); 3904 TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &sctp_pcbtblsize); 3905 TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &sctp_chunkscale); 3906 #else 3907 TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", SCTP_TCBHASHSIZE, 3908 hashtblsize); 3909 TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", SCTP_PCBHASHSIZE, 3910 sctp_pcbtblsize); 3911 TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", SCTP_CHUNKQUEUE_SCALE, 3912 sctp_chunkscale); 3913 #endif 3914 #endif 3915 3916 sctppcbinfo.sctp_asochash = hashinit((hashtblsize * 31), HASH_LIST, 3917 M_WAITOK, &sctppcbinfo.hashasocmark); 3918 3919 sctppcbinfo.sctp_ephash = hashinit(hashtblsize, HASH_LIST, 3920 M_WAITOK, &sctppcbinfo.hashmark); 3921 3922 sctppcbinfo.sctp_tcpephash = hashinit(hashtblsize, HASH_LIST, 3923 M_WAITOK, &sctppcbinfo.hashtcpmark); 3924 3925 sctppcbinfo.hashtblsize = hashtblsize; 3926 3927 /* init the zones */ 3928 /* 3929 * FIX ME: Should check for NULL returns, but if it does fail we 3930 * are doomed to panic anyways... add later maybe. 3931 */ 3932 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_ep, "sctp_ep", 3933 sizeof(struct sctp_inpcb), maxsockets); 3934 3935 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_asoc, "sctp_asoc", 3936 sizeof(struct sctp_tcb), sctp_max_number_of_assoc); 3937 3938 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_laddr, "sctp_laddr", 3939 sizeof(struct sctp_laddr), 3940 (sctp_max_number_of_assoc * sctp_scale_up_for_address)); 3941 3942 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_net, "sctp_raddr", 3943 sizeof(struct sctp_nets), 3944 (sctp_max_number_of_assoc * sctp_scale_up_for_address)); 3945 3946 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_chunk, "sctp_chunk", 3947 sizeof(struct sctp_tmit_chunk), 3948 (sctp_max_number_of_assoc * sctp_scale_up_for_address * 3949 sctp_chunkscale)); 3950 3951 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_sockq, "sctp_sockq", 3952 sizeof(struct sctp_socket_q_list), 3953 (sctp_max_number_of_assoc * sctp_scale_up_for_address * 3954 sctp_chunkscale)); 3955 3956 SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_hash, "sctp_hash", 3957 sizeof(void *) * sctp_pcbtblsize, maxsockets); 3958 3959 /* Master Lock INIT for info structure */ 3960 SCTP_INP_INFO_LOCK_INIT(); 3961 SCTP_ITERATOR_LOCK_INIT(); 3962 /* not sure if we need all the counts */ 3963 sctppcbinfo.ipi_count_ep = 0; 3964 sctppcbinfo.ipi_gencnt_ep = 0; 3965 /* assoc/tcb zone info */ 3966 sctppcbinfo.ipi_count_asoc = 0; 3967 sctppcbinfo.ipi_gencnt_asoc = 0; 3968 /* local addrlist zone info */ 3969 sctppcbinfo.ipi_count_laddr = 0; 3970 sctppcbinfo.ipi_gencnt_laddr = 0; 3971 /* remote addrlist zone info */ 3972 sctppcbinfo.ipi_count_raddr = 0; 3973 sctppcbinfo.ipi_gencnt_raddr = 0; 3974 /* chunk info */ 3975 sctppcbinfo.ipi_count_chunk = 0; 3976 sctppcbinfo.ipi_gencnt_chunk = 0; 3977 3978 /* socket queue zone info */ 3979 sctppcbinfo.ipi_count_sockq = 0; 3980 sctppcbinfo.ipi_gencnt_sockq = 0; 3981 3982 /* mbuf tracker */ 3983 sctppcbinfo.mbuf_track = 0; 3984 /* port stuff */ 3985 #if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__APPLE__) 3986 sctppcbinfo.lastlow = ipport_firstauto; 3987 #else 3988 sctppcbinfo.lastlow = anonportmin; 3989 #endif 3990 /* Init the TIMEWAIT list */ 3991 for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) { 3992 LIST_INIT(&sctppcbinfo.vtag_timewait[i]); 3993 } 3994 3995 #if defined(_SCTP_NEEDS_CALLOUT_) && !defined(__APPLE__) 3996 TAILQ_INIT(&sctppcbinfo.callqueue); 3997 #endif 3998 3999 } 4000 4001 int 4002 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m, 4003 int iphlen, int offset, int limit, struct sctphdr *sh, 4004 struct sockaddr *altsa) 4005 { 4006 /* 4007 * grub through the INIT pulling addresses and 4008 * loading them to the nets structure in the asoc. 4009 * The from address in the mbuf should also be loaded 4010 * (if it is not already). This routine can be called 4011 * with either INIT or INIT-ACK's as long as the 4012 * m points to the IP packet and the offset points 4013 * to the beginning of the parameters. 4014 */ 4015 struct sctp_inpcb *inp, *l_inp; 4016 struct sctp_nets *net, *net_tmp; 4017 struct ip *iph; 4018 struct sctp_paramhdr *phdr, parm_buf; 4019 struct sctp_tcb *stcb_tmp; 4020 u_int16_t ptype, plen; 4021 struct sockaddr *sa; 4022 struct sockaddr_storage dest_store; 4023 struct sockaddr *local_sa = (struct sockaddr *)&dest_store; 4024 struct sockaddr_in sin; 4025 struct sockaddr_in6 sin6; 4026 4027 /* First get the destination address setup too. */ 4028 memset(&sin, 0, sizeof(sin)); 4029 memset(&sin6, 0, sizeof(sin6)); 4030 4031 sin.sin_family = AF_INET; 4032 sin.sin_len = sizeof(sin); 4033 sin.sin_port = stcb->rport; 4034 4035 sin6.sin6_family = AF_INET6; 4036 sin6.sin6_len = sizeof(struct sockaddr_in6); 4037 sin6.sin6_port = stcb->rport; 4038 if (altsa == NULL) { 4039 iph = mtod(m, struct ip *); 4040 if (iph->ip_v == IPVERSION) { 4041 /* its IPv4 */ 4042 struct sockaddr_in *sin_2; 4043 sin_2 = (struct sockaddr_in *)(local_sa); 4044 memset(sin_2, 0, sizeof(sin)); 4045 sin_2->sin_family = AF_INET; 4046 sin_2->sin_len = sizeof(sin); 4047 sin_2->sin_port = sh->dest_port; 4048 sin_2->sin_addr.s_addr = iph->ip_dst.s_addr ; 4049 sin.sin_addr = iph->ip_src; 4050 sa = (struct sockaddr *)&sin; 4051 } else if (iph->ip_v == (IPV6_VERSION >> 4)) { 4052 /* its IPv6 */ 4053 struct ip6_hdr *ip6; 4054 struct sockaddr_in6 *sin6_2; 4055 4056 ip6 = mtod(m, struct ip6_hdr *); 4057 sin6_2 = (struct sockaddr_in6 *)(local_sa); 4058 memset(sin6_2, 0, sizeof(sin6)); 4059 sin6_2->sin6_family = AF_INET6; 4060 sin6_2->sin6_len = sizeof(struct sockaddr_in6); 4061 sin6_2->sin6_port = sh->dest_port; 4062 sin6.sin6_addr = ip6->ip6_src; 4063 sa = (struct sockaddr *)&sin6; 4064 } else { 4065 sa = NULL; 4066 } 4067 } else { 4068 /* 4069 * For cookies we use the src address NOT from the packet 4070 * but from the original INIT 4071 */ 4072 sa = altsa; 4073 } 4074 /* Turn off ECN until we get through all params */ 4075 stcb->asoc.ecn_allowed = 0; 4076 4077 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { 4078 /* mark all addresses that we have currently on the list */ 4079 net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC; 4080 } 4081 /* does the source address already exist? if so skip it */ 4082 l_inp = inp = stcb->sctp_ep; 4083 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, local_sa, stcb); 4084 if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) { 4085 /* we must add the source address */ 4086 /* no scope set here since we have a tcb already. */ 4087 if ((sa->sa_family == AF_INET) && 4088 (stcb->asoc.ipv4_addr_legal)) { 4089 if (sctp_add_remote_addr(stcb, sa, 0, 2)) { 4090 return (-1); 4091 } 4092 } else if ((sa->sa_family == AF_INET6) && 4093 (stcb->asoc.ipv6_addr_legal)) { 4094 if (sctp_add_remote_addr(stcb, sa, 0, 3)) { 4095 return (-1); 4096 } 4097 } 4098 } else { 4099 if (net_tmp != NULL && stcb_tmp == stcb) { 4100 net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC; 4101 } else if (stcb_tmp != stcb) { 4102 /* It belongs to another association? */ 4103 return (-1); 4104 } 4105 } 4106 /* since a unlock occured we must check the 4107 * TCB's state and the pcb's gone flags. 4108 */ 4109 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4110 /* the user freed the ep */ 4111 return (-1); 4112 } 4113 if (stcb->asoc.state == 0) { 4114 /* the assoc was freed? */ 4115 return (-1); 4116 } 4117 4118 /* now we must go through each of the params. */ 4119 phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf)); 4120 while (phdr) { 4121 ptype = ntohs(phdr->param_type); 4122 plen = ntohs(phdr->param_length); 4123 /*printf("ptype => %d, plen => %d\n", ptype, plen);*/ 4124 if (offset + plen > limit) { 4125 break; 4126 } 4127 if (plen == 0) { 4128 break; 4129 } 4130 if ((ptype == SCTP_IPV4_ADDRESS) && 4131 (stcb->asoc.ipv4_addr_legal)) { 4132 struct sctp_ipv4addr_param *p4, p4_buf; 4133 /* ok get the v4 address and check/add */ 4134 phdr = sctp_get_next_param(m, offset, 4135 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf)); 4136 if (plen != sizeof(struct sctp_ipv4addr_param) || 4137 phdr == NULL) { 4138 return (-1); 4139 } 4140 p4 = (struct sctp_ipv4addr_param *)phdr; 4141 sin.sin_addr.s_addr = p4->addr; 4142 sa = (struct sockaddr *)&sin; 4143 inp = stcb->sctp_ep; 4144 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net, 4145 local_sa, stcb); 4146 4147 if ((stcb_tmp== NULL && inp == stcb->sctp_ep) || 4148 inp == NULL) { 4149 /* we must add the source address */ 4150 /* no scope set since we have a tcb already */ 4151 4152 /* we must validate the state again here */ 4153 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4154 /* the user freed the ep */ 4155 return (-1); 4156 } 4157 if (stcb->asoc.state == 0) { 4158 /* the assoc was freed? */ 4159 return (-1); 4160 } 4161 if (sctp_add_remote_addr(stcb, sa, 0, 4)) { 4162 return (-1); 4163 } 4164 } else if (stcb_tmp == stcb) { 4165 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4166 /* the user freed the ep */ 4167 return (-1); 4168 } 4169 if (stcb->asoc.state == 0) { 4170 /* the assoc was freed? */ 4171 return (-1); 4172 } 4173 if (net != NULL) { 4174 /* clear flag */ 4175 net->dest_state &= 4176 ~SCTP_ADDR_NOT_IN_ASSOC; 4177 } 4178 } else { 4179 /* strange, address is in another assoc? 4180 * straighten out locks. 4181 */ 4182 SCTP_TCB_UNLOCK(stcb_tmp); 4183 SCTP_INP_RLOCK(inp); 4184 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4185 /* the user freed the ep */ 4186 SCTP_INP_RUNLOCK(l_inp); 4187 return (-1); 4188 } 4189 if (stcb->asoc.state == 0) { 4190 /* the assoc was freed? */ 4191 SCTP_INP_RUNLOCK(l_inp); 4192 return (-1); 4193 } 4194 SCTP_TCB_LOCK(stcb); 4195 SCTP_INP_RUNLOCK(stcb->sctp_ep); 4196 return (-1); 4197 } 4198 } else if ((ptype == SCTP_IPV6_ADDRESS) && 4199 (stcb->asoc.ipv6_addr_legal)) { 4200 /* ok get the v6 address and check/add */ 4201 struct sctp_ipv6addr_param *p6, p6_buf; 4202 phdr = sctp_get_next_param(m, offset, 4203 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf)); 4204 if (plen != sizeof(struct sctp_ipv6addr_param) || 4205 phdr == NULL) { 4206 return (-1); 4207 } 4208 p6 = (struct sctp_ipv6addr_param *)phdr; 4209 memcpy((void *)&sin6.sin6_addr, p6->addr, 4210 sizeof(p6->addr)); 4211 sa = (struct sockaddr *)&sin6; 4212 inp = stcb->sctp_ep; 4213 stcb_tmp= sctp_findassociation_ep_addr(&inp, sa, &net, 4214 local_sa, stcb); 4215 if (stcb_tmp == NULL && (inp == stcb->sctp_ep || 4216 inp == NULL)) { 4217 /* we must validate the state again here */ 4218 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4219 /* the user freed the ep */ 4220 return (-1); 4221 } 4222 if (stcb->asoc.state == 0) { 4223 /* the assoc was freed? */ 4224 return (-1); 4225 } 4226 /* we must add the address, no scope set */ 4227 if (sctp_add_remote_addr(stcb, sa, 0, 5)) { 4228 return (-1); 4229 } 4230 } else if (stcb_tmp == stcb) { 4231 /* we must validate the state again here */ 4232 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4233 /* the user freed the ep */ 4234 return (-1); 4235 } 4236 if (stcb->asoc.state == 0) { 4237 /* the assoc was freed? */ 4238 return (-1); 4239 } 4240 if (net != NULL) { 4241 /* clear flag */ 4242 net->dest_state &= 4243 ~SCTP_ADDR_NOT_IN_ASSOC; 4244 } 4245 } else { 4246 /* strange, address is in another assoc? 4247 * straighten out locks. 4248 */ 4249 SCTP_TCB_UNLOCK(stcb_tmp); 4250 SCTP_INP_RLOCK(l_inp); 4251 /* we must validate the state again here */ 4252 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) { 4253 /* the user freed the ep */ 4254 SCTP_INP_RUNLOCK(l_inp); 4255 return (-1); 4256 } 4257 if (stcb->asoc.state == 0) { 4258 /* the assoc was freed? */ 4259 SCTP_INP_RUNLOCK(l_inp); 4260 return (-1); 4261 } 4262 SCTP_TCB_LOCK(stcb); 4263 SCTP_INP_RUNLOCK(l_inp); 4264 return (-1); 4265 } 4266 } else if (ptype == SCTP_ECN_CAPABLE) { 4267 stcb->asoc.ecn_allowed = 1; 4268 } else if (ptype == SCTP_ULP_ADAPTION) { 4269 if (stcb->asoc.state != SCTP_STATE_OPEN) { 4270 struct sctp_adaption_layer_indication ai, *aip; 4271 4272 phdr = sctp_get_next_param(m, offset, 4273 (struct sctp_paramhdr *)&ai, sizeof(ai)); 4274 aip = (struct sctp_adaption_layer_indication *)phdr; 4275 sctp_ulp_notify(SCTP_NOTIFY_ADAPTION_INDICATION, 4276 stcb, ntohl(aip->indication), NULL); 4277 } 4278 } else if (ptype == SCTP_SET_PRIM_ADDR) { 4279 struct sctp_asconf_addr_param lstore, *fee; 4280 struct sctp_asconf_addrv4_param *fii; 4281 int lptype; 4282 struct sockaddr *lsa = NULL; 4283 4284 stcb->asoc.peer_supports_asconf = 1; 4285 stcb->asoc.peer_supports_asconf_setprim = 1; 4286 if (plen > sizeof(lstore)) { 4287 return (-1); 4288 } 4289 phdr = sctp_get_next_param(m, offset, 4290 (struct sctp_paramhdr *)&lstore, plen); 4291 if (phdr == NULL) { 4292 return (-1); 4293 } 4294 4295 fee = (struct sctp_asconf_addr_param *)phdr; 4296 lptype = ntohs(fee->addrp.ph.param_type); 4297 if (lptype == SCTP_IPV4_ADDRESS) { 4298 if (plen != 4299 sizeof(struct sctp_asconf_addrv4_param)) { 4300 printf("Sizeof setprim in init/init ack not %d but %d - ignored\n", 4301 (int)sizeof(struct sctp_asconf_addrv4_param), 4302 plen); 4303 } else { 4304 fii = (struct sctp_asconf_addrv4_param *)fee; 4305 sin.sin_addr.s_addr = fii->addrp.addr; 4306 lsa = (struct sockaddr *)&sin; 4307 } 4308 } else if (lptype == SCTP_IPV6_ADDRESS) { 4309 if (plen != 4310 sizeof(struct sctp_asconf_addr_param)) { 4311 printf("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n", 4312 (int)sizeof(struct sctp_asconf_addr_param), 4313 plen); 4314 } else { 4315 memcpy(sin6.sin6_addr.s6_addr, 4316 fee->addrp.addr, 4317 sizeof(fee->addrp.addr)); 4318 lsa = (struct sockaddr *)&sin6; 4319 } 4320 } 4321 if (lsa) { 4322 sctp_set_primary_addr(stcb, sa, NULL); 4323 } 4324 4325 } else if (ptype == SCTP_PRSCTP_SUPPORTED) { 4326 /* Peer supports pr-sctp */ 4327 stcb->asoc.peer_supports_prsctp = 1; 4328 } else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) { 4329 /* A supported extension chunk */ 4330 struct sctp_supported_chunk_types_param *pr_supported; 4331 uint8_t local_store[128]; 4332 int num_ent, i; 4333 4334 phdr = sctp_get_next_param(m, offset, 4335 (struct sctp_paramhdr *)&local_store, plen); 4336 if (phdr == NULL) { 4337 return (-1); 4338 } 4339 stcb->asoc.peer_supports_asconf = 0; 4340 stcb->asoc.peer_supports_asconf_setprim = 0; 4341 stcb->asoc.peer_supports_prsctp = 0; 4342 stcb->asoc.peer_supports_pktdrop = 0; 4343 stcb->asoc.peer_supports_strreset = 0; 4344 pr_supported = (struct sctp_supported_chunk_types_param *)phdr; 4345 num_ent = plen - sizeof(struct sctp_paramhdr); 4346 for (i=0; i<num_ent; i++) { 4347 switch (pr_supported->chunk_types[i]) { 4348 case SCTP_ASCONF: 4349 stcb->asoc.peer_supports_asconf = 1; 4350 stcb->asoc.peer_supports_asconf_setprim = 1; 4351 break; 4352 case SCTP_ASCONF_ACK: 4353 stcb->asoc.peer_supports_asconf = 1; 4354 stcb->asoc.peer_supports_asconf_setprim = 1; 4355 break; 4356 case SCTP_FORWARD_CUM_TSN: 4357 stcb->asoc.peer_supports_prsctp = 1; 4358 break; 4359 case SCTP_PACKET_DROPPED: 4360 stcb->asoc.peer_supports_pktdrop = 1; 4361 break; 4362 case SCTP_STREAM_RESET: 4363 stcb->asoc.peer_supports_strreset = 1; 4364 break; 4365 default: 4366 /* one I have not learned yet */ 4367 break; 4368 4369 } 4370 } 4371 } else if (ptype == SCTP_ECN_NONCE_SUPPORTED) { 4372 /* Peer supports ECN-nonce */ 4373 stcb->asoc.peer_supports_ecn_nonce = 1; 4374 stcb->asoc.ecn_nonce_allowed = 1; 4375 } else if ((ptype == SCTP_HEARTBEAT_INFO) || 4376 (ptype == SCTP_STATE_COOKIE) || 4377 (ptype == SCTP_UNRECOG_PARAM) || 4378 (ptype == SCTP_COOKIE_PRESERVE) || 4379 (ptype == SCTP_SUPPORTED_ADDRTYPE) || 4380 (ptype == SCTP_ADD_IP_ADDRESS) || 4381 (ptype == SCTP_DEL_IP_ADDRESS) || 4382 (ptype == SCTP_ERROR_CAUSE_IND) || 4383 (ptype == SCTP_SUCCESS_REPORT)) { 4384 /* don't care */; 4385 } else { 4386 if ((ptype & 0x8000) == 0x0000) { 4387 /* must stop processing the rest of 4388 * the param's. Any report bits were 4389 * handled with the call to sctp_arethere_unrecognized_parameters() 4390 * when the INIT or INIT-ACK was first seen. 4391 */ 4392 break; 4393 } 4394 } 4395 offset += SCTP_SIZE32(plen); 4396 if (offset >= limit) { 4397 break; 4398 } 4399 phdr = sctp_get_next_param(m, offset, &parm_buf, 4400 sizeof(parm_buf)); 4401 } 4402 /* Now check to see if we need to purge any addresses */ 4403 for (net = TAILQ_FIRST(&stcb->asoc.nets); net != NULL; net = net_tmp) { 4404 net_tmp = TAILQ_NEXT(net, sctp_next); 4405 if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) == 4406 SCTP_ADDR_NOT_IN_ASSOC) { 4407 /* This address has been removed from the asoc */ 4408 /* remove and free it */ 4409 stcb->asoc.numnets--; 4410 TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next); 4411 sctp_free_remote_addr(net); 4412 if (net == stcb->asoc.primary_destination) { 4413 stcb->asoc.primary_destination = NULL; 4414 sctp_select_primary_destination(stcb); 4415 } 4416 } 4417 } 4418 return (0); 4419 } 4420 4421 int 4422 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa, 4423 struct sctp_nets *net) 4424 { 4425 /* make sure the requested primary address exists in the assoc */ 4426 if (net == NULL && sa) 4427 net = sctp_findnet(stcb, sa); 4428 4429 if (net == NULL) { 4430 /* didn't find the requested primary address! */ 4431 return (-1); 4432 } else { 4433 /* set the primary address */ 4434 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) { 4435 /* Must be confirmed */ 4436 return (-1); 4437 } 4438 stcb->asoc.primary_destination = net; 4439 net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY; 4440 return (0); 4441 } 4442 } 4443 4444 4445 int 4446 sctp_is_vtag_good(struct sctp_inpcb *inp, u_int32_t tag, struct timeval *now) 4447 { 4448 /* 4449 * This function serves two purposes. It will see if a TAG can be 4450 * re-used and return 1 for yes it is ok and 0 for don't use that 4451 * tag. 4452 * A secondary function it will do is purge out old tags that can 4453 * be removed. 4454 */ 4455 struct sctpasochead *head; 4456 struct sctpvtaghead *chain; 4457 struct sctp_tagblock *twait_block; 4458 struct sctp_tcb *stcb; 4459 4460 int i; 4461 SCTP_INP_INFO_WLOCK(); 4462 chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)]; 4463 /* First is the vtag in use ? */ 4464 4465 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(tag, 4466 sctppcbinfo.hashasocmark)]; 4467 if (head == NULL) { 4468 SCTP_INP_INFO_WUNLOCK(); 4469 return (0); 4470 } 4471 LIST_FOREACH(stcb, head, sctp_asocs) { 4472 if (stcb->asoc.my_vtag == tag) { 4473 /* We should remove this if and 4474 * return 0 always if we want vtags 4475 * unique across all endpoints. For 4476 * now within a endpoint is ok. 4477 */ 4478 if (inp == stcb->sctp_ep) { 4479 /* bad tag, in use */ 4480 SCTP_INP_INFO_WUNLOCK(); 4481 return (0); 4482 } 4483 } 4484 } 4485 if (!LIST_EMPTY(chain)) { 4486 /* 4487 * Block(s) are present, lets see if we have this tag in 4488 * the list 4489 */ 4490 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) { 4491 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) { 4492 if (twait_block->vtag_block[i].v_tag == 0) { 4493 /* not used */ 4494 continue; 4495 } else if ((long)twait_block->vtag_block[i].tv_sec_at_expire > 4496 now->tv_sec) { 4497 /* Audit expires this guy */ 4498 twait_block->vtag_block[i].tv_sec_at_expire = 0; 4499 twait_block->vtag_block[i].v_tag = 0; 4500 } else if (twait_block->vtag_block[i].v_tag == 4501 tag) { 4502 /* Bad tag, sorry :< */ 4503 SCTP_INP_INFO_WUNLOCK(); 4504 return (0); 4505 } 4506 } 4507 } 4508 } 4509 /* Not found, ok to use the tag */ 4510 SCTP_INP_INFO_WUNLOCK(); 4511 return (1); 4512 } 4513 4514 4515 /* 4516 * Delete the address from the endpoint local address list 4517 * Lookup using a sockaddr address (ie. not an ifaddr) 4518 */ 4519 int 4520 sctp_del_local_addr_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa) 4521 { 4522 struct sctp_laddr *laddr; 4523 struct sockaddr *l_sa; 4524 int found = 0; 4525 /* Here is another function I cannot find a 4526 * caller for. As such we SHOULD delete it 4527 * if we have no users. If we find a user that 4528 * user MUST have the INP locked. 4529 * 4530 */ 4531 4532 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) { 4533 /* You are already bound to all. You have it already */ 4534 return (EINVAL); 4535 } 4536 4537 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) { 4538 /* make sure the address exists */ 4539 if (laddr->ifa == NULL) 4540 continue; 4541 if (laddr->ifa->ifa_addr == NULL) 4542 continue; 4543 4544 l_sa = laddr->ifa->ifa_addr; 4545 if (l_sa->sa_family == AF_INET6) { 4546 /* IPv6 address */ 4547 struct sockaddr_in6 *sin1, *sin2; 4548 sin1 = (struct sockaddr_in6 *)l_sa; 4549 sin2 = (struct sockaddr_in6 *)sa; 4550 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr, 4551 sizeof(struct in6_addr)) == 0) { 4552 /* matched */ 4553 found = 1; 4554 break; 4555 } 4556 } else if (l_sa->sa_family == AF_INET) { 4557 /* IPv4 address */ 4558 struct sockaddr_in *sin1, *sin2; 4559 sin1 = (struct sockaddr_in *)l_sa; 4560 sin2 = (struct sockaddr_in *)sa; 4561 if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) { 4562 /* matched */ 4563 found = 1; 4564 break; 4565 } 4566 } else { 4567 /* invalid family */ 4568 return (-1); 4569 } 4570 } 4571 4572 if (found && inp->laddr_count < 2) { 4573 /* can't delete unless there are at LEAST 2 addresses */ 4574 return (-1); 4575 } 4576 4577 if (found && (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) { 4578 /* 4579 * remove it from the ep list, this should NOT be 4580 * done until its really gone from the interface list and 4581 * we won't be receiving more of these. Probably right 4582 * away. If we do allow a removal of an address from 4583 * an association (sub-set bind) than this should NOT 4584 * be called until the all ASCONF come back from this 4585 * association. 4586 */ 4587 sctp_remove_laddr(laddr); 4588 return (0); 4589 } else { 4590 return (-1); 4591 } 4592 } 4593 4594 static void 4595 sctp_drain_mbufs(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 4596 { 4597 /* 4598 * We must hunt this association for MBUF's past the cumack 4599 * (i.e. out of order data that we can renege on). 4600 */ 4601 struct sctp_association *asoc; 4602 struct sctp_tmit_chunk *chk, *nchk; 4603 u_int32_t cumulative_tsn_p1, tsn; 4604 int cnt, strmat, gap; 4605 /* We look for anything larger than the cum-ack + 1 */ 4606 4607 asoc = &stcb->asoc; 4608 cumulative_tsn_p1 = asoc->cumulative_tsn + 1; 4609 cnt = 0; 4610 /* First look in the re-assembly queue */ 4611 chk = TAILQ_FIRST(&asoc->reasmqueue); 4612 while (chk) { 4613 /* Get the next one */ 4614 nchk = TAILQ_NEXT(chk, sctp_next); 4615 if (compare_with_wrap(chk->rec.data.TSN_seq, 4616 cumulative_tsn_p1, MAX_TSN)) { 4617 /* Yep it is above cum-ack */ 4618 cnt++; 4619 tsn = chk->rec.data.TSN_seq; 4620 if (tsn >= asoc->mapping_array_base_tsn) { 4621 gap = tsn - asoc->mapping_array_base_tsn; 4622 } else { 4623 gap = (MAX_TSN - asoc->mapping_array_base_tsn) + 4624 tsn + 1; 4625 } 4626 asoc->size_on_reasm_queue -= chk->send_size; 4627 asoc->cnt_on_reasm_queue--; 4628 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap); 4629 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next); 4630 if (chk->data) { 4631 sctp_m_freem(chk->data); 4632 chk->data = NULL; 4633 } 4634 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4635 sctppcbinfo.ipi_count_chunk--; 4636 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4637 panic("Chunk count is negative"); 4638 } 4639 sctppcbinfo.ipi_gencnt_chunk++; 4640 } 4641 chk = nchk; 4642 } 4643 /* Ok that was fun, now we will drain all the inbound streams? */ 4644 for (strmat = 0; strmat < asoc->streamincnt; strmat++) { 4645 chk = TAILQ_FIRST(&asoc->strmin[strmat].inqueue); 4646 while (chk) { 4647 nchk = TAILQ_NEXT(chk, sctp_next); 4648 if (compare_with_wrap(chk->rec.data.TSN_seq, 4649 cumulative_tsn_p1, MAX_TSN)) { 4650 /* Yep it is above cum-ack */ 4651 cnt++; 4652 tsn = chk->rec.data.TSN_seq; 4653 if (tsn >= asoc->mapping_array_base_tsn) { 4654 gap = tsn - 4655 asoc->mapping_array_base_tsn; 4656 } else { 4657 gap = (MAX_TSN - 4658 asoc->mapping_array_base_tsn) + 4659 tsn + 1; 4660 } 4661 asoc->size_on_all_streams -= chk->send_size; 4662 asoc->cnt_on_all_streams--; 4663 4664 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, 4665 gap); 4666 TAILQ_REMOVE(&asoc->strmin[strmat].inqueue, 4667 chk, sctp_next); 4668 if (chk->data) { 4669 sctp_m_freem(chk->data); 4670 chk->data = NULL; 4671 } 4672 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4673 sctppcbinfo.ipi_count_chunk--; 4674 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4675 panic("Chunk count is negative"); 4676 } 4677 sctppcbinfo.ipi_gencnt_chunk++; 4678 } 4679 chk = nchk; 4680 } 4681 } 4682 /* 4683 * Question, should we go through the delivery queue? 4684 * The only reason things are on here is the app not reading OR a 4685 * p-d-api up. An attacker COULD send enough in to initiate the 4686 * PD-API and then send a bunch of stuff to other streams... these 4687 * would wind up on the delivery queue.. and then we would not get 4688 * to them. But in order to do this I then have to back-track and 4689 * un-deliver sequence numbers in streams.. el-yucko. I think for 4690 * now we will NOT look at the delivery queue and leave it to be 4691 * something to consider later. An alternative would be to abort 4692 * the P-D-API with a notification and then deliver the data.... 4693 * Or another method might be to keep track of how many times the 4694 * situation occurs and if we see a possible attack underway just 4695 * abort the association. 4696 */ 4697 #ifdef SCTP_DEBUG 4698 if (sctp_debug_on & SCTP_DEBUG_PCB1) { 4699 if (cnt) { 4700 printf("Freed %d chunks from reneg harvest\n", cnt); 4701 } 4702 } 4703 #endif /* SCTP_DEBUG */ 4704 4705 /* 4706 * Another issue, in un-setting the TSN's in the mapping array we 4707 * DID NOT adjust the higest_tsn marker. This will cause one of 4708 * two things to occur. It may cause us to do extra work in checking 4709 * for our mapping array movement. More importantly it may cause us 4710 * to SACK every datagram. This may not be a bad thing though since 4711 * we will recover once we get our cum-ack above and all this stuff 4712 * we dumped recovered. 4713 */ 4714 } 4715 4716 void 4717 sctp_drain(void) 4718 { 4719 /* 4720 * We must walk the PCB lists for ALL associations here. The system 4721 * is LOW on MBUF's and needs help. This is where reneging will 4722 * occur. We really hope this does NOT happen! 4723 */ 4724 struct sctp_inpcb *inp; 4725 struct sctp_tcb *stcb; 4726 4727 SCTP_INP_INFO_RLOCK(); 4728 LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) { 4729 /* For each endpoint */ 4730 SCTP_INP_RLOCK(inp); 4731 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) { 4732 /* For each association */ 4733 SCTP_TCB_LOCK(stcb); 4734 sctp_drain_mbufs(inp, stcb); 4735 SCTP_TCB_UNLOCK(stcb); 4736 } 4737 SCTP_INP_RUNLOCK(inp); 4738 } 4739 SCTP_INP_INFO_RUNLOCK(); 4740 } 4741 4742 int 4743 sctp_add_to_socket_q(struct sctp_inpcb *inp, struct sctp_tcb *stcb) 4744 { 4745 struct sctp_socket_q_list *sq; 4746 4747 /* write lock on INP assumed */ 4748 if ((inp == NULL) || (stcb == NULL)) { 4749 /* I am paranoid */ 4750 return (0); 4751 } 4752 sq = (struct sctp_socket_q_list *)SCTP_ZONE_GET( 4753 sctppcbinfo.ipi_zone_sockq); 4754 if (sq == NULL) { 4755 /* out of sq structs */ 4756 return (0); 4757 } 4758 sctppcbinfo.ipi_count_sockq++; 4759 sctppcbinfo.ipi_gencnt_sockq++; 4760 if (stcb) 4761 stcb->asoc.cnt_msg_on_sb++; 4762 sq->tcb = stcb; 4763 TAILQ_INSERT_TAIL(&inp->sctp_queue_list, sq, next_sq); 4764 return (1); 4765 } 4766 4767 4768 struct sctp_tcb * 4769 sctp_remove_from_socket_q(struct sctp_inpcb *inp) 4770 { 4771 struct sctp_tcb *stcb = NULL; 4772 struct sctp_socket_q_list *sq; 4773 4774 /* W-Lock on INP assumed held */ 4775 sq = TAILQ_FIRST(&inp->sctp_queue_list); 4776 if (sq == NULL) 4777 return (NULL); 4778 4779 stcb = sq->tcb; 4780 TAILQ_REMOVE(&inp->sctp_queue_list, sq, next_sq); 4781 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_sockq, sq); 4782 sctppcbinfo.ipi_count_sockq--; 4783 sctppcbinfo.ipi_gencnt_sockq++; 4784 if (stcb) { 4785 stcb->asoc.cnt_msg_on_sb--; 4786 } 4787 return (stcb); 4788 } 4789 4790 int 4791 sctp_initiate_iterator(asoc_func af, uint32_t pcb_state, uint32_t asoc_state, 4792 void *argp, uint32_t argi, end_func ef, 4793 struct sctp_inpcb *s_inp) 4794 { 4795 struct sctp_iterator *it=NULL; 4796 int s; 4797 if (af == NULL) { 4798 return (-1); 4799 } 4800 it = malloc(sizeof(struct sctp_iterator), M_PCB, M_WAITOK); 4801 if (it == NULL) { 4802 return (ENOMEM); 4803 } 4804 memset(it, 0, sizeof(*it)); 4805 it->function_toapply = af; 4806 it->function_atend = ef; 4807 it->pointer = argp; 4808 it->val = argi; 4809 it->pcb_flags = pcb_state; 4810 it->asoc_state = asoc_state; 4811 if (s_inp) { 4812 it->inp = s_inp; 4813 it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP; 4814 } else { 4815 SCTP_INP_INFO_RLOCK(); 4816 it->inp = LIST_FIRST(&sctppcbinfo.listhead); 4817 SCTP_INP_INFO_RUNLOCK(); 4818 it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP; 4819 4820 } 4821 /* Init the timer */ 4822 callout_init(&it->tmr.timer, 0); 4823 /* add to the list of all iterators */ 4824 SCTP_INP_INFO_WLOCK(); 4825 LIST_INSERT_HEAD(&sctppcbinfo.iteratorhead, it, sctp_nxt_itr); 4826 SCTP_INP_INFO_WUNLOCK(); 4827 s = splsoftnet(); 4828 sctp_iterator_timer(it); 4829 splx(s); 4830 return (0); 4831 } 4832 4833 4834