1 /*-
2 * SPDX-License-Identifier: BSD-3-Clause
3 *
4 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
5 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
6 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions are met:
10 *
11 * a) Redistributions of source code must retain the above copyright notice,
12 * this list of conditions and the following disclaimer.
13 *
14 * b) Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the distribution.
17 *
18 * c) Neither the name of Cisco Systems, Inc. nor the names of its
19 * contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
26 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32 * THE POSSIBILITY OF SUCH DAMAGE.
33 */
34
35 #ifdef __FreeBSD__
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD: head/sys/netinet/sctp_input.c 355135 2019-11-27 19:32:29Z tuexen $");
38 #endif
39
40 #include <netinet/sctp_os.h>
41 #include <netinet/sctp_var.h>
42 #include <netinet/sctp_sysctl.h>
43 #include <netinet/sctp_pcb.h>
44 #include <netinet/sctp_header.h>
45 #include <netinet/sctputil.h>
46 #include <netinet/sctp_output.h>
47 #include <netinet/sctp_input.h>
48 #include <netinet/sctp_auth.h>
49 #include <netinet/sctp_indata.h>
50 #include <netinet/sctp_asconf.h>
51 #include <netinet/sctp_bsd_addr.h>
52 #include <netinet/sctp_timer.h>
53 #include <netinet/sctp_crc32.h>
54 #if defined(__FreeBSD__)
55 #include <netinet/sctp_kdtrace.h>
56 #endif
57 #if defined(INET) || defined(INET6)
58 #if !defined(__Userspace_os_Windows)
59 #include <netinet/udp.h>
60 #endif
61 #endif
62 #if defined(__FreeBSD__)
63 #include <sys/smp.h>
64 #endif
65
66 #if defined(__APPLE__)
67 #define APPLE_FILE_NO 2
68 #endif
69
70
71 static void
sctp_stop_all_cookie_timers(struct sctp_tcb * stcb)72 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
73 {
74 struct sctp_nets *net;
75
76 /* This now not only stops all cookie timers
77 * it also stops any INIT timers as well. This
78 * will make sure that the timers are stopped in
79 * all collision cases.
80 */
81 SCTP_TCB_LOCK_ASSERT(stcb);
82 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
83 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
84 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
85 stcb->sctp_ep,
86 stcb,
87 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
88 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
89 sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
90 stcb->sctp_ep,
91 stcb,
92 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
93 }
94 }
95 }
96
97 /* INIT handler */
98 static void
sctp_handle_init(struct mbuf * m,int iphlen,int offset,struct sockaddr * src,struct sockaddr * dst,struct sctphdr * sh,struct sctp_init_chunk * cp,struct sctp_inpcb * inp,struct sctp_tcb * stcb,struct sctp_nets * net,int * abort_no_unlock,uint8_t mflowtype,uint32_t mflowid,uint32_t vrf_id,uint16_t port)99 sctp_handle_init(struct mbuf *m, int iphlen, int offset,
100 struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
101 struct sctp_init_chunk *cp, struct sctp_inpcb *inp,
102 struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_no_unlock,
103 #if defined(__FreeBSD__)
104 uint8_t mflowtype, uint32_t mflowid,
105 #endif
106 uint32_t vrf_id, uint16_t port)
107 {
108 struct sctp_init *init;
109 struct mbuf *op_err;
110
111 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
112 (void *)stcb);
113 if (stcb == NULL) {
114 SCTP_INP_RLOCK(inp);
115 }
116 /* validate length */
117 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
118 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
119 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
120 #if defined(__FreeBSD__)
121 mflowtype, mflowid,
122 #endif
123 vrf_id, port);
124 if (stcb)
125 *abort_no_unlock = 1;
126 goto outnow;
127 }
128 /* validate parameters */
129 init = &cp->init;
130 if (init->initiate_tag == 0) {
131 /* protocol error... send abort */
132 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
133 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
134 #if defined(__FreeBSD__)
135 mflowtype, mflowid,
136 #endif
137 vrf_id, port);
138 if (stcb)
139 *abort_no_unlock = 1;
140 goto outnow;
141 }
142 if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
143 /* invalid parameter... send abort */
144 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
145 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
146 #if defined(__FreeBSD__)
147 mflowtype, mflowid,
148 #endif
149 vrf_id, port);
150 if (stcb)
151 *abort_no_unlock = 1;
152 goto outnow;
153 }
154 if (init->num_inbound_streams == 0) {
155 /* protocol error... send abort */
156 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
157 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
158 #if defined(__FreeBSD__)
159 mflowtype, mflowid,
160 #endif
161 vrf_id, port);
162 if (stcb)
163 *abort_no_unlock = 1;
164 goto outnow;
165 }
166 if (init->num_outbound_streams == 0) {
167 /* protocol error... send abort */
168 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
169 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
170 #if defined(__FreeBSD__)
171 mflowtype, mflowid,
172 #endif
173 vrf_id, port);
174 if (stcb)
175 *abort_no_unlock = 1;
176 goto outnow;
177 }
178 if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
179 offset + ntohs(cp->ch.chunk_length))) {
180 /* auth parameter(s) error... send abort */
181 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
182 "Problem with AUTH parameters");
183 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
184 #if defined(__FreeBSD__)
185 mflowtype, mflowid,
186 #endif
187 vrf_id, port);
188 if (stcb)
189 *abort_no_unlock = 1;
190 goto outnow;
191 }
192 /* We are only accepting if we have a listening socket.*/
193 if ((stcb == NULL) &&
194 ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
195 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
196 (!SCTP_IS_LISTENING(inp)))) {
197 /*
198 * FIX ME ?? What about TCP model and we have a
199 * match/restart case? Actually no fix is needed.
200 * the lookup will always find the existing assoc so stcb
201 * would not be NULL. It may be questionable to do this
202 * since we COULD just send back the INIT-ACK and hope that
203 * the app did accept()'s by the time the COOKIE was sent. But
204 * there is a price to pay for COOKIE generation and I don't
205 * want to pay it on the chance that the app will actually do
206 * some accepts(). The App just looses and should NOT be in
207 * this state :-)
208 */
209 if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0) {
210 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
211 "No listener");
212 sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
213 #if defined(__FreeBSD__)
214 mflowtype, mflowid, inp->fibnum,
215 #endif
216 vrf_id, port);
217 }
218 goto outnow;
219 }
220 if ((stcb != NULL) &&
221 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
222 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending SHUTDOWN-ACK\n");
223 sctp_send_shutdown_ack(stcb, NULL);
224 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
225 } else {
226 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
227 sctp_send_initiate_ack(inp, stcb, net, m, iphlen, offset,
228 src, dst, sh, cp,
229 #if defined(__FreeBSD__)
230 mflowtype, mflowid,
231 #endif
232 vrf_id, port);
233 }
234 outnow:
235 if (stcb == NULL) {
236 SCTP_INP_RUNLOCK(inp);
237 }
238 }
239
240 /*
241 * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
242 */
243
244 int
sctp_is_there_unsent_data(struct sctp_tcb * stcb,int so_locked SCTP_UNUSED)245 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked
246 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
247 SCTP_UNUSED
248 #endif
249 )
250 {
251 int unsent_data;
252 unsigned int i;
253 struct sctp_stream_queue_pending *sp;
254 struct sctp_association *asoc;
255
256 /* This function returns if any stream has true unsent data on it.
257 * Note that as it looks through it will clean up any places that
258 * have old data that has been sent but left at top of stream queue.
259 */
260 asoc = &stcb->asoc;
261 unsent_data = 0;
262 SCTP_TCB_SEND_LOCK(stcb);
263 if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
264 /* Check to see if some data queued */
265 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
266 /*sa_ignore FREED_MEMORY*/
267 sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue);
268 if (sp == NULL) {
269 continue;
270 }
271 if ((sp->msg_is_complete) &&
272 (sp->length == 0) &&
273 (sp->sender_all_done)) {
274 /* We are doing differed cleanup. Last
275 * time through when we took all the data
276 * the sender_all_done was not set.
277 */
278 if (sp->put_last_out == 0) {
279 SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
280 SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",
281 sp->sender_all_done,
282 sp->length,
283 sp->msg_is_complete,
284 sp->put_last_out);
285 }
286 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
287 TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next);
288 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, &asoc->strmout[i], sp, 1);
289 if (sp->net) {
290 sctp_free_remote_addr(sp->net);
291 sp->net = NULL;
292 }
293 if (sp->data) {
294 sctp_m_freem(sp->data);
295 sp->data = NULL;
296 }
297 sctp_free_a_strmoq(stcb, sp, so_locked);
298 if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) {
299 unsent_data++;
300 }
301 } else {
302 unsent_data++;
303 }
304 if (unsent_data > 0) {
305 break;
306 }
307 }
308 }
309 SCTP_TCB_SEND_UNLOCK(stcb);
310 return (unsent_data);
311 }
312
313 static int
sctp_process_init(struct sctp_init_chunk * cp,struct sctp_tcb * stcb)314 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb)
315 {
316 struct sctp_init *init;
317 struct sctp_association *asoc;
318 struct sctp_nets *lnet;
319 unsigned int i;
320
321 init = &cp->init;
322 asoc = &stcb->asoc;
323 /* save off parameters */
324 asoc->peer_vtag = ntohl(init->initiate_tag);
325 asoc->peers_rwnd = ntohl(init->a_rwnd);
326 /* init tsn's */
327 asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
328
329 if (!TAILQ_EMPTY(&asoc->nets)) {
330 /* update any ssthresh's that may have a default */
331 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
332 lnet->ssthresh = asoc->peers_rwnd;
333 if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE|SCTP_CWND_LOGGING_ENABLE)) {
334 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
335 }
336
337 }
338 }
339 SCTP_TCB_SEND_LOCK(stcb);
340 if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
341 unsigned int newcnt;
342 struct sctp_stream_out *outs;
343 struct sctp_stream_queue_pending *sp, *nsp;
344 struct sctp_tmit_chunk *chk, *nchk;
345
346 /* abandon the upper streams */
347 newcnt = ntohs(init->num_inbound_streams);
348 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
349 if (chk->rec.data.sid >= newcnt) {
350 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
351 asoc->send_queue_cnt--;
352 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
353 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
354 #ifdef INVARIANTS
355 } else {
356 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
357 #endif
358 }
359 if (chk->data != NULL) {
360 sctp_free_bufspace(stcb, asoc, chk, 1);
361 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
362 0, chk, SCTP_SO_NOT_LOCKED);
363 if (chk->data) {
364 sctp_m_freem(chk->data);
365 chk->data = NULL;
366 }
367 }
368 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
369 /*sa_ignore FREED_MEMORY*/
370 }
371 }
372 if (asoc->strmout) {
373 for (i = newcnt; i < asoc->pre_open_streams; i++) {
374 outs = &asoc->strmout[i];
375 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
376 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
377 TAILQ_REMOVE(&outs->outqueue, sp, next);
378 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
379 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
380 stcb, 0, sp, SCTP_SO_NOT_LOCKED);
381 if (sp->data) {
382 sctp_m_freem(sp->data);
383 sp->data = NULL;
384 }
385 if (sp->net) {
386 sctp_free_remote_addr(sp->net);
387 sp->net = NULL;
388 }
389 /* Free the chunk */
390 sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED);
391 /*sa_ignore FREED_MEMORY*/
392 }
393 outs->state = SCTP_STREAM_CLOSED;
394 }
395 }
396 /* cut back the count */
397 asoc->pre_open_streams = newcnt;
398 }
399 SCTP_TCB_SEND_UNLOCK(stcb);
400 asoc->streamoutcnt = asoc->pre_open_streams;
401 if (asoc->strmout) {
402 for (i = 0; i < asoc->streamoutcnt; i++) {
403 asoc->strmout[i].state = SCTP_STREAM_OPEN;
404 }
405 }
406 /* EY - nr_sack: initialize highest tsn in nr_mapping_array */
407 asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
408 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
409 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
410 }
411 /* This is the next one we expect */
412 asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
413
414 asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
415 asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in;
416
417 asoc->advanced_peer_ack_point = asoc->last_acked_seq;
418 /* open the requested streams */
419
420 if (asoc->strmin != NULL) {
421 /* Free the old ones */
422 for (i = 0; i < asoc->streamincnt; i++) {
423 sctp_clean_up_stream(stcb, &asoc->strmin[i].inqueue);
424 sctp_clean_up_stream(stcb, &asoc->strmin[i].uno_inqueue);
425 }
426 SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
427 }
428 if (asoc->max_inbound_streams > ntohs(init->num_outbound_streams)) {
429 asoc->streamincnt = ntohs(init->num_outbound_streams);
430 } else {
431 asoc->streamincnt = asoc->max_inbound_streams;
432 }
433 SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
434 sizeof(struct sctp_stream_in), SCTP_M_STRMI);
435 if (asoc->strmin == NULL) {
436 /* we didn't get memory for the streams! */
437 SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
438 return (-1);
439 }
440 for (i = 0; i < asoc->streamincnt; i++) {
441 asoc->strmin[i].sid = i;
442 asoc->strmin[i].last_mid_delivered = 0xffffffff;
443 TAILQ_INIT(&asoc->strmin[i].inqueue);
444 TAILQ_INIT(&asoc->strmin[i].uno_inqueue);
445 asoc->strmin[i].pd_api_started = 0;
446 asoc->strmin[i].delivery_started = 0;
447 }
448 /*
449 * load_address_from_init will put the addresses into the
450 * association when the COOKIE is processed or the INIT-ACK is
451 * processed. Both types of COOKIE's existing and new call this
452 * routine. It will remove addresses that are no longer in the
453 * association (for the restarting case where addresses are
454 * removed). Up front when the INIT arrives we will discard it if it
455 * is a restart and new addresses have been added.
456 */
457 /* sa_ignore MEMLEAK */
458 return (0);
459 }
460
461 /*
462 * INIT-ACK message processing/consumption returns value < 0 on error
463 */
464 static int
sctp_process_init_ack(struct mbuf * m,int iphlen,int offset,struct sockaddr * src,struct sockaddr * dst,struct sctphdr * sh,struct sctp_init_ack_chunk * cp,struct sctp_tcb * stcb,struct sctp_nets * net,int * abort_no_unlock,uint8_t mflowtype,uint32_t mflowid,uint32_t vrf_id)465 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
466 struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
467 struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
468 struct sctp_nets *net, int *abort_no_unlock,
469 #if defined(__FreeBSD__)
470 uint8_t mflowtype, uint32_t mflowid,
471 #endif
472 uint32_t vrf_id)
473 {
474 struct sctp_association *asoc;
475 struct mbuf *op_err;
476 int retval, abort_flag, cookie_found;
477 int initack_limit;
478 int nat_friendly = 0;
479
480 /* First verify that we have no illegal param's */
481 abort_flag = 0;
482 cookie_found = 0;
483
484 op_err = sctp_arethere_unrecognized_parameters(m,
485 (offset + sizeof(struct sctp_init_chunk)),
486 &abort_flag, (struct sctp_chunkhdr *)cp,
487 &nat_friendly, &cookie_found);
488 if (abort_flag) {
489 /* Send an abort and notify peer */
490 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
491 *abort_no_unlock = 1;
492 return (-1);
493 }
494 if (!cookie_found) {
495 uint16_t len;
496
497 /* Only report the missing cookie parameter */
498 if (op_err != NULL) {
499 sctp_m_freem(op_err);
500 }
501 len = (uint16_t)(sizeof(struct sctp_error_missing_param) + sizeof(uint16_t));
502 /* We abort with an error of missing mandatory param */
503 op_err = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
504 if (op_err != NULL) {
505 struct sctp_error_missing_param *cause;
506
507 SCTP_BUF_LEN(op_err) = len;
508 cause = mtod(op_err, struct sctp_error_missing_param *);
509 /* Subtract the reserved param */
510 cause->cause.code = htons(SCTP_CAUSE_MISSING_PARAM);
511 cause->cause.length = htons(len);
512 cause->num_missing_params = htonl(1);
513 cause->type[0] = htons(SCTP_STATE_COOKIE);
514 }
515 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
516 src, dst, sh, op_err,
517 #if defined(__FreeBSD__)
518 mflowtype, mflowid,
519 #endif
520 vrf_id, net->port);
521 *abort_no_unlock = 1;
522 return (-3);
523 }
524 asoc = &stcb->asoc;
525 asoc->peer_supports_nat = (uint8_t)nat_friendly;
526 /* process the peer's parameters in the INIT-ACK */
527 retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb);
528 if (retval < 0) {
529 if (op_err != NULL) {
530 sctp_m_freem(op_err);
531 }
532 return (retval);
533 }
534 initack_limit = offset + ntohs(cp->ch.chunk_length);
535 /* load all addresses */
536 if ((retval = sctp_load_addresses_from_init(stcb, m,
537 (offset + sizeof(struct sctp_init_chunk)), initack_limit,
538 src, dst, NULL, stcb->asoc.port))) {
539 if (op_err != NULL) {
540 sctp_m_freem(op_err);
541 }
542 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
543 "Problem with address parameters");
544 SCTPDBG(SCTP_DEBUG_INPUT1,
545 "Load addresses from INIT causes an abort %d\n",
546 retval);
547 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
548 src, dst, sh, op_err,
549 #if defined(__FreeBSD__)
550 mflowtype, mflowid,
551 #endif
552 vrf_id, net->port);
553 *abort_no_unlock = 1;
554 return (-1);
555 }
556 /* if the peer doesn't support asconf, flush the asconf queue */
557 if (asoc->asconf_supported == 0) {
558 struct sctp_asconf_addr *param, *nparam;
559
560 TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) {
561 TAILQ_REMOVE(&asoc->asconf_queue, param, next);
562 SCTP_FREE(param, SCTP_M_ASC_ADDR);
563 }
564 }
565
566 stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
567 stcb->asoc.local_hmacs);
568 if (op_err) {
569 sctp_queue_op_err(stcb, op_err);
570 /* queuing will steal away the mbuf chain to the out queue */
571 op_err = NULL;
572 }
573 /* extract the cookie and queue it to "echo" it back... */
574 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
575 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
576 stcb->asoc.overall_error_count,
577 0,
578 SCTP_FROM_SCTP_INPUT,
579 __LINE__);
580 }
581 stcb->asoc.overall_error_count = 0;
582 net->error_count = 0;
583
584 /*
585 * Cancel the INIT timer, We do this first before queueing the
586 * cookie. We always cancel at the primary to assue that we are
587 * canceling the timer started by the INIT which always goes to the
588 * primary.
589 */
590 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
591 asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
592
593 /* calculate the RTO */
594 sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered,
595 SCTP_RTT_FROM_NON_DATA);
596 #if defined(__Userspace__)
597 if (stcb->sctp_ep->recv_callback) {
598 if (stcb->sctp_socket) {
599 uint32_t inqueue_bytes, sb_free_now;
600 struct sctp_inpcb *inp;
601
602 inp = stcb->sctp_ep;
603 inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
604 sb_free_now = SCTP_SB_LIMIT_SND(stcb->sctp_socket) - (inqueue_bytes + stcb->asoc.sb_send_resv);
605
606 /* check if the amount free in the send socket buffer crossed the threshold */
607 if (inp->send_callback &&
608 (((inp->send_sb_threshold > 0) &&
609 (sb_free_now >= inp->send_sb_threshold) &&
610 (stcb->asoc.chunks_on_out_queue <= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) ||
611 (inp->send_sb_threshold == 0))) {
612 atomic_add_int(&stcb->asoc.refcnt, 1);
613 SCTP_TCB_UNLOCK(stcb);
614 inp->send_callback(stcb->sctp_socket, sb_free_now);
615 SCTP_TCB_LOCK(stcb);
616 atomic_subtract_int(&stcb->asoc.refcnt, 1);
617 }
618 }
619 }
620 #endif
621 retval = sctp_send_cookie_echo(m, offset, initack_limit, stcb, net);
622 return (retval);
623 }
624
625 static void
sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk * cp,struct sctp_tcb * stcb,struct sctp_nets * net)626 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
627 struct sctp_tcb *stcb, struct sctp_nets *net)
628 {
629 union sctp_sockstore store;
630 struct sctp_nets *r_net, *f_net;
631 struct timeval tv;
632 int req_prim = 0;
633 uint16_t old_error_counter;
634
635 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
636 /* Invalid length */
637 return;
638 }
639
640 memset(&store, 0, sizeof(store));
641 switch (cp->heartbeat.hb_info.addr_family) {
642 #ifdef INET
643 case AF_INET:
644 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
645 store.sin.sin_family = cp->heartbeat.hb_info.addr_family;
646 #ifdef HAVE_SIN_LEN
647 store.sin.sin_len = cp->heartbeat.hb_info.addr_len;
648 #endif
649 store.sin.sin_port = stcb->rport;
650 memcpy(&store.sin.sin_addr, cp->heartbeat.hb_info.address,
651 sizeof(store.sin.sin_addr));
652 } else {
653 return;
654 }
655 break;
656 #endif
657 #ifdef INET6
658 case AF_INET6:
659 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
660 store.sin6.sin6_family = cp->heartbeat.hb_info.addr_family;
661 #ifdef HAVE_SIN6_LEN
662 store.sin6.sin6_len = cp->heartbeat.hb_info.addr_len;
663 #endif
664 store.sin6.sin6_port = stcb->rport;
665 memcpy(&store.sin6.sin6_addr, cp->heartbeat.hb_info.address, sizeof(struct in6_addr));
666 } else {
667 return;
668 }
669 break;
670 #endif
671 #if defined(__Userspace__)
672 case AF_CONN:
673 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_conn)) {
674 store.sconn.sconn_family = cp->heartbeat.hb_info.addr_family;
675 #ifdef HAVE_SCONN_LEN
676 store.sconn.sconn_len = cp->heartbeat.hb_info.addr_len;
677 #endif
678 store.sconn.sconn_port = stcb->rport;
679 memcpy(&store.sconn.sconn_addr, cp->heartbeat.hb_info.address, sizeof(void *));
680 } else {
681 return;
682 }
683 break;
684 #endif
685 default:
686 return;
687 }
688 r_net = sctp_findnet(stcb, &store.sa);
689 if (r_net == NULL) {
690 SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
691 return;
692 }
693 if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
694 (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
695 (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
696 /*
697 * If the its a HB and it's random value is correct when can
698 * confirm the destination.
699 */
700 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
701 if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
702 stcb->asoc.primary_destination = r_net;
703 r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
704 f_net = TAILQ_FIRST(&stcb->asoc.nets);
705 if (f_net != r_net) {
706 /* first one on the list is NOT the primary
707 * sctp_cmpaddr() is much more efficient if
708 * the primary is the first on the list, make it
709 * so.
710 */
711 TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next);
712 TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next);
713 }
714 req_prim = 1;
715 }
716 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
717 stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
718 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb,
719 r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
720 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
721 }
722 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
723 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
724 stcb->asoc.overall_error_count,
725 0,
726 SCTP_FROM_SCTP_INPUT,
727 __LINE__);
728 }
729 stcb->asoc.overall_error_count = 0;
730 old_error_counter = r_net->error_count;
731 r_net->error_count = 0;
732 r_net->hb_responded = 1;
733 tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
734 tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
735 /* Now lets do a RTO with this */
736 sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv,
737 SCTP_RTT_FROM_NON_DATA);
738 if (!(r_net->dest_state & SCTP_ADDR_REACHABLE)) {
739 r_net->dest_state |= SCTP_ADDR_REACHABLE;
740 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
741 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
742 }
743 if (r_net->dest_state & SCTP_ADDR_PF) {
744 r_net->dest_state &= ~SCTP_ADDR_PF;
745 stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
746 }
747 if (old_error_counter > 0) {
748 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
749 stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5);
750 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
751 }
752 if (r_net == stcb->asoc.primary_destination) {
753 if (stcb->asoc.alternate) {
754 /* release the alternate, primary is good */
755 sctp_free_remote_addr(stcb->asoc.alternate);
756 stcb->asoc.alternate = NULL;
757 }
758 }
759 /* Mobility adaptation */
760 if (req_prim) {
761 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
762 SCTP_MOBILITY_BASE) ||
763 sctp_is_mobility_feature_on(stcb->sctp_ep,
764 SCTP_MOBILITY_FASTHANDOFF)) &&
765 sctp_is_mobility_feature_on(stcb->sctp_ep,
766 SCTP_MOBILITY_PRIM_DELETED)) {
767
768 sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
769 stcb->sctp_ep, stcb, NULL,
770 SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
771 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
772 SCTP_MOBILITY_FASTHANDOFF)) {
773 sctp_assoc_immediate_retrans(stcb,
774 stcb->asoc.primary_destination);
775 }
776 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
777 SCTP_MOBILITY_BASE)) {
778 sctp_move_chunks_from_net(stcb,
779 stcb->asoc.deleted_primary);
780 }
781 sctp_delete_prim_timer(stcb->sctp_ep, stcb,
782 stcb->asoc.deleted_primary);
783 }
784 }
785 }
786
787 static int
sctp_handle_nat_colliding_state(struct sctp_tcb * stcb)788 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb)
789 {
790 /*
791 * Return 0 means we want you to proceed with the abort
792 * non-zero means no abort processing.
793 */
794 uint32_t new_vtag;
795 struct sctpasochead *head;
796
797 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
798 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
799 new_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
800 atomic_add_int(&stcb->asoc.refcnt, 1);
801 SCTP_TCB_UNLOCK(stcb);
802 SCTP_INP_INFO_WLOCK();
803 SCTP_TCB_LOCK(stcb);
804 atomic_subtract_int(&stcb->asoc.refcnt, 1);
805 } else {
806 return (0);
807 }
808 if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {
809 /* generate a new vtag and send init */
810 LIST_REMOVE(stcb, sctp_asocs);
811 stcb->asoc.my_vtag = new_vtag;
812 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
813 /* put it in the bucket in the vtag hash of assoc's for the system */
814 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
815 SCTP_INP_INFO_WUNLOCK();
816 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
817 return (1);
818 } else {
819 /* treat like a case where the cookie expired i.e.:
820 * - dump current cookie.
821 * - generate a new vtag.
822 * - resend init.
823 */
824 /* generate a new vtag and send init */
825 LIST_REMOVE(stcb, sctp_asocs);
826 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT);
827 sctp_stop_all_cookie_timers(stcb);
828 sctp_toss_old_cookies(stcb, &stcb->asoc);
829 stcb->asoc.my_vtag = new_vtag;
830 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
831 /* put it in the bucket in the vtag hash of assoc's for the system */
832 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
833 SCTP_INP_INFO_WUNLOCK();
834 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
835 return (1);
836 }
837 return (0);
838 }
839
840 static int
sctp_handle_nat_missing_state(struct sctp_tcb * stcb,struct sctp_nets * net)841 sctp_handle_nat_missing_state(struct sctp_tcb *stcb,
842 struct sctp_nets *net)
843 {
844 /* return 0 means we want you to proceed with the abort
845 * non-zero means no abort processing
846 */
847 if (stcb->asoc.auth_supported == 0) {
848 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n");
849 return (0);
850 }
851 sctp_asconf_send_nat_state_update(stcb, net);
852 return (1);
853 }
854
855
856 /* Returns 1 if the stcb was aborted, 0 otherwise */
857 static int
sctp_handle_abort(struct sctp_abort_chunk * abort,struct sctp_tcb * stcb,struct sctp_nets * net)858 sctp_handle_abort(struct sctp_abort_chunk *abort,
859 struct sctp_tcb *stcb, struct sctp_nets *net)
860 {
861 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
862 struct socket *so;
863 #endif
864 uint16_t len;
865 uint16_t error;
866
867 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
868 if (stcb == NULL)
869 return (0);
870
871 len = ntohs(abort->ch.chunk_length);
872 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_error_cause)) {
873 /* Need to check the cause codes for our
874 * two magic nat aborts which don't kill the assoc
875 * necessarily.
876 */
877 struct sctp_error_cause *cause;
878
879 cause = (struct sctp_error_cause *)(abort + 1);
880 error = ntohs(cause->code);
881 if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) {
882 SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
883 abort->ch.chunk_flags);
884 if (sctp_handle_nat_colliding_state(stcb)) {
885 return (0);
886 }
887 } else if (error == SCTP_CAUSE_NAT_MISSING_STATE) {
888 SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
889 abort->ch.chunk_flags);
890 if (sctp_handle_nat_missing_state(stcb, net)) {
891 return (0);
892 }
893 }
894 } else {
895 error = 0;
896 }
897 /* stop any receive timers */
898 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net,
899 SCTP_FROM_SCTP_INPUT + SCTP_LOC_7);
900 /* notify user of the abort and clean up... */
901 sctp_abort_notification(stcb, 1, error, abort, SCTP_SO_NOT_LOCKED);
902 /* free the tcb */
903 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
904 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
905 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
906 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
907 }
908 #ifdef SCTP_ASOCLOG_OF_TSNS
909 sctp_print_out_track_log(stcb);
910 #endif
911 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
912 so = SCTP_INP_SO(stcb->sctp_ep);
913 atomic_add_int(&stcb->asoc.refcnt, 1);
914 SCTP_TCB_UNLOCK(stcb);
915 SCTP_SOCKET_LOCK(so, 1);
916 SCTP_TCB_LOCK(stcb);
917 atomic_subtract_int(&stcb->asoc.refcnt, 1);
918 #endif
919 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED);
920 (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
921 SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
922 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
923 SCTP_SOCKET_UNLOCK(so, 1);
924 #endif
925 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
926 return (1);
927 }
928
929 static void
sctp_start_net_timers(struct sctp_tcb * stcb)930 sctp_start_net_timers(struct sctp_tcb *stcb)
931 {
932 uint32_t cnt_hb_sent;
933 struct sctp_nets *net;
934
935 cnt_hb_sent = 0;
936 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
937 /* For each network start:
938 * 1) A pmtu timer.
939 * 2) A HB timer
940 * 3) If the dest in unconfirmed send
941 * a hb as well if under max_hb_burst have
942 * been sent.
943 */
944 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
945 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
946 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
947 (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) {
948 sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
949 cnt_hb_sent++;
950 }
951 }
952 if (cnt_hb_sent) {
953 sctp_chunk_output(stcb->sctp_ep, stcb,
954 SCTP_OUTPUT_FROM_COOKIE_ACK,
955 SCTP_SO_NOT_LOCKED);
956 }
957 }
958
959
960 static void
sctp_handle_shutdown(struct sctp_shutdown_chunk * cp,struct sctp_tcb * stcb,struct sctp_nets * net,int * abort_flag)961 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
962 struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
963 {
964 struct sctp_association *asoc;
965 int some_on_streamwheel;
966 int old_state;
967 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
968 struct socket *so;
969 #endif
970
971 SCTPDBG(SCTP_DEBUG_INPUT2,
972 "sctp_handle_shutdown: handling SHUTDOWN\n");
973 if (stcb == NULL)
974 return;
975 asoc = &stcb->asoc;
976 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
977 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
978 return;
979 }
980 if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
981 /* Shutdown NOT the expected size */
982 return;
983 }
984 old_state = SCTP_GET_STATE(stcb);
985 sctp_update_acked(stcb, cp, abort_flag);
986 if (*abort_flag) {
987 return;
988 }
989 if (asoc->control_pdapi) {
990 /* With a normal shutdown
991 * we assume the end of last record.
992 */
993 SCTP_INP_READ_LOCK(stcb->sctp_ep);
994 if (asoc->control_pdapi->on_strm_q) {
995 struct sctp_stream_in *strm;
996
997 strm = &asoc->strmin[asoc->control_pdapi->sinfo_stream];
998 if (asoc->control_pdapi->on_strm_q == SCTP_ON_UNORDERED) {
999 /* Unordered */
1000 TAILQ_REMOVE(&strm->uno_inqueue, asoc->control_pdapi, next_instrm);
1001 asoc->control_pdapi->on_strm_q = 0;
1002 } else if (asoc->control_pdapi->on_strm_q == SCTP_ON_ORDERED) {
1003 /* Ordered */
1004 TAILQ_REMOVE(&strm->inqueue, asoc->control_pdapi, next_instrm);
1005 asoc->control_pdapi->on_strm_q = 0;
1006 #ifdef INVARIANTS
1007 } else {
1008 panic("Unknown state on ctrl:%p on_strm_q:%d",
1009 asoc->control_pdapi,
1010 asoc->control_pdapi->on_strm_q);
1011 #endif
1012 }
1013 }
1014 asoc->control_pdapi->end_added = 1;
1015 asoc->control_pdapi->pdapi_aborted = 1;
1016 asoc->control_pdapi = NULL;
1017 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
1018 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1019 so = SCTP_INP_SO(stcb->sctp_ep);
1020 atomic_add_int(&stcb->asoc.refcnt, 1);
1021 SCTP_TCB_UNLOCK(stcb);
1022 SCTP_SOCKET_LOCK(so, 1);
1023 SCTP_TCB_LOCK(stcb);
1024 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1025 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1026 /* assoc was freed while we were unlocked */
1027 SCTP_SOCKET_UNLOCK(so, 1);
1028 return;
1029 }
1030 #endif
1031 if (stcb->sctp_socket) {
1032 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1033 }
1034 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1035 SCTP_SOCKET_UNLOCK(so, 1);
1036 #endif
1037 }
1038 /* goto SHUTDOWN_RECEIVED state to block new requests */
1039 if (stcb->sctp_socket) {
1040 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
1041 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
1042 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT)) {
1043 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_RECEIVED);
1044 /* notify upper layer that peer has initiated a shutdown */
1045 sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
1046
1047 /* reset time */
1048 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
1049 }
1050 }
1051 if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) {
1052 /*
1053 * stop the shutdown timer, since we WILL move to
1054 * SHUTDOWN-ACK-SENT.
1055 */
1056 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
1057 net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
1058 }
1059 /* Now is there unsent data on a stream somewhere? */
1060 some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED);
1061
1062 if (!TAILQ_EMPTY(&asoc->send_queue) ||
1063 !TAILQ_EMPTY(&asoc->sent_queue) ||
1064 some_on_streamwheel) {
1065 /* By returning we will push more data out */
1066 return;
1067 } else {
1068 /* no outstanding data to send, so move on... */
1069 /* send SHUTDOWN-ACK */
1070 /* move to SHUTDOWN-ACK-SENT state */
1071 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
1072 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
1073 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
1074 }
1075 if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
1076 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_ACK_SENT);
1077 sctp_stop_timers_for_shutdown(stcb);
1078 sctp_send_shutdown_ack(stcb, net);
1079 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
1080 stcb->sctp_ep, stcb, net);
1081 } else if (old_state == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1082 sctp_send_shutdown_ack(stcb, net);
1083 }
1084 }
1085 }
1086
1087 static void
sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk * cp SCTP_UNUSED,struct sctp_tcb * stcb,struct sctp_nets * net)1088 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED,
1089 struct sctp_tcb *stcb,
1090 struct sctp_nets *net)
1091 {
1092 struct sctp_association *asoc;
1093 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1094 struct socket *so;
1095
1096 so = SCTP_INP_SO(stcb->sctp_ep);
1097 #endif
1098 SCTPDBG(SCTP_DEBUG_INPUT2,
1099 "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
1100 if (stcb == NULL)
1101 return;
1102
1103 asoc = &stcb->asoc;
1104 /* process according to association state */
1105 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
1106 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
1107 /* unexpected SHUTDOWN-ACK... do OOTB handling... */
1108 sctp_send_shutdown_complete(stcb, net, 1);
1109 SCTP_TCB_UNLOCK(stcb);
1110 return;
1111 }
1112 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) &&
1113 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
1114 /* unexpected SHUTDOWN-ACK... so ignore... */
1115 SCTP_TCB_UNLOCK(stcb);
1116 return;
1117 }
1118 if (asoc->control_pdapi) {
1119 /* With a normal shutdown
1120 * we assume the end of last record.
1121 */
1122 SCTP_INP_READ_LOCK(stcb->sctp_ep);
1123 asoc->control_pdapi->end_added = 1;
1124 asoc->control_pdapi->pdapi_aborted = 1;
1125 asoc->control_pdapi = NULL;
1126 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
1127 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1128 atomic_add_int(&stcb->asoc.refcnt, 1);
1129 SCTP_TCB_UNLOCK(stcb);
1130 SCTP_SOCKET_LOCK(so, 1);
1131 SCTP_TCB_LOCK(stcb);
1132 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1133 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1134 /* assoc was freed while we were unlocked */
1135 SCTP_SOCKET_UNLOCK(so, 1);
1136 return;
1137 }
1138 #endif
1139 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1140 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1141 SCTP_SOCKET_UNLOCK(so, 1);
1142 #endif
1143 }
1144 #ifdef INVARIANTS
1145 if (!TAILQ_EMPTY(&asoc->send_queue) ||
1146 !TAILQ_EMPTY(&asoc->sent_queue) ||
1147 sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
1148 panic("Queues are not empty when handling SHUTDOWN-ACK");
1149 }
1150 #endif
1151 /* stop the timer */
1152 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net,
1153 SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
1154 /* send SHUTDOWN-COMPLETE */
1155 sctp_send_shutdown_complete(stcb, net, 0);
1156 /* notify upper layer protocol */
1157 if (stcb->sctp_socket) {
1158 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1159 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
1160 stcb->sctp_socket->so_snd.sb_cc = 0;
1161 }
1162 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
1163 }
1164 SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
1165 /* free the TCB but first save off the ep */
1166 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1167 atomic_add_int(&stcb->asoc.refcnt, 1);
1168 SCTP_TCB_UNLOCK(stcb);
1169 SCTP_SOCKET_LOCK(so, 1);
1170 SCTP_TCB_LOCK(stcb);
1171 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1172 #endif
1173 (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1174 SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
1175 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1176 SCTP_SOCKET_UNLOCK(so, 1);
1177 #endif
1178 }
1179
1180 static void
sctp_process_unrecog_chunk(struct sctp_tcb * stcb,uint8_t chunk_type,struct sctp_nets * net)1181 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, uint8_t chunk_type,
1182 struct sctp_nets *net)
1183 {
1184 switch (chunk_type) {
1185 case SCTP_ASCONF_ACK:
1186 case SCTP_ASCONF:
1187 sctp_asconf_cleanup(stcb, net);
1188 break;
1189 case SCTP_IFORWARD_CUM_TSN:
1190 case SCTP_FORWARD_CUM_TSN:
1191 stcb->asoc.prsctp_supported = 0;
1192 break;
1193 default:
1194 SCTPDBG(SCTP_DEBUG_INPUT2,
1195 "Peer does not support chunk type %d (0x%x).\n",
1196 chunk_type, chunk_type);
1197 break;
1198 }
1199 }
1200
1201 /*
1202 * Skip past the param header and then we will find the param that caused the
1203 * problem. There are a number of param's in a ASCONF OR the prsctp param
1204 * these will turn of specific features.
1205 * XXX: Is this the right thing to do?
1206 */
1207 static void
sctp_process_unrecog_param(struct sctp_tcb * stcb,uint16_t parameter_type)1208 sctp_process_unrecog_param(struct sctp_tcb *stcb, uint16_t parameter_type)
1209 {
1210 switch (parameter_type) {
1211 /* pr-sctp draft */
1212 case SCTP_PRSCTP_SUPPORTED:
1213 stcb->asoc.prsctp_supported = 0;
1214 break;
1215 case SCTP_SUPPORTED_CHUNK_EXT:
1216 break;
1217 /* draft-ietf-tsvwg-addip-sctp */
1218 case SCTP_HAS_NAT_SUPPORT:
1219 stcb->asoc.peer_supports_nat = 0;
1220 break;
1221 case SCTP_ADD_IP_ADDRESS:
1222 case SCTP_DEL_IP_ADDRESS:
1223 case SCTP_SET_PRIM_ADDR:
1224 stcb->asoc.asconf_supported = 0;
1225 break;
1226 case SCTP_SUCCESS_REPORT:
1227 case SCTP_ERROR_CAUSE_IND:
1228 SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
1229 SCTPDBG(SCTP_DEBUG_INPUT2,
1230 "Turning off ASCONF to this strange peer\n");
1231 stcb->asoc.asconf_supported = 0;
1232 break;
1233 default:
1234 SCTPDBG(SCTP_DEBUG_INPUT2,
1235 "Peer does not support param type %d (0x%x)??\n",
1236 parameter_type, parameter_type);
1237 break;
1238 }
1239 }
1240
1241 static int
sctp_handle_error(struct sctp_chunkhdr * ch,struct sctp_tcb * stcb,struct sctp_nets * net,uint32_t limit)1242 sctp_handle_error(struct sctp_chunkhdr *ch,
1243 struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
1244 {
1245 struct sctp_error_cause *cause;
1246 struct sctp_association *asoc;
1247 uint32_t remaining_length, adjust;
1248 uint16_t code, cause_code, cause_length;
1249 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1250 struct socket *so;
1251 #endif
1252
1253 /* parse through all of the errors and process */
1254 asoc = &stcb->asoc;
1255 cause = (struct sctp_error_cause *)((caddr_t)ch +
1256 sizeof(struct sctp_chunkhdr));
1257 remaining_length = ntohs(ch->chunk_length);
1258 if (remaining_length > limit) {
1259 remaining_length = limit;
1260 }
1261 if (remaining_length >= sizeof(struct sctp_chunkhdr)) {
1262 remaining_length -= sizeof(struct sctp_chunkhdr);
1263 } else {
1264 remaining_length = 0;
1265 }
1266 code = 0;
1267 while (remaining_length >= sizeof(struct sctp_error_cause)) {
1268 /* Process an Error Cause */
1269 cause_code = ntohs(cause->code);
1270 cause_length = ntohs(cause->length);
1271 if ((cause_length > remaining_length) || (cause_length == 0)) {
1272 /* Invalid cause length, possibly due to truncation. */
1273 SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in cause - bytes left: %u cause length: %u\n",
1274 remaining_length, cause_length);
1275 return (0);
1276 }
1277 if (code == 0) {
1278 /* report the first error cause */
1279 code = cause_code;
1280 }
1281 switch (cause_code) {
1282 case SCTP_CAUSE_INVALID_STREAM:
1283 case SCTP_CAUSE_MISSING_PARAM:
1284 case SCTP_CAUSE_INVALID_PARAM:
1285 case SCTP_CAUSE_NO_USER_DATA:
1286 SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %u back? We have a bug :/ (or do they?)\n",
1287 cause_code);
1288 break;
1289 case SCTP_CAUSE_NAT_COLLIDING_STATE:
1290 SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags: %x\n",
1291 ch->chunk_flags);
1292 if (sctp_handle_nat_colliding_state(stcb)) {
1293 return (0);
1294 }
1295 break;
1296 case SCTP_CAUSE_NAT_MISSING_STATE:
1297 SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags: %x\n",
1298 ch->chunk_flags);
1299 if (sctp_handle_nat_missing_state(stcb, net)) {
1300 return (0);
1301 }
1302 break;
1303 case SCTP_CAUSE_STALE_COOKIE:
1304 /*
1305 * We only act if we have echoed a cookie and are
1306 * waiting.
1307 */
1308 if ((cause_length >= sizeof(struct sctp_error_stale_cookie)) &&
1309 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
1310 struct sctp_error_stale_cookie *stale_cookie;
1311
1312 stale_cookie = (struct sctp_error_stale_cookie *)cause;
1313 asoc->cookie_preserve_req = ntohl(stale_cookie->stale_time);
1314 /* Double it to be more robust on RTX */
1315 if (asoc->cookie_preserve_req <= UINT32_MAX / 2) {
1316 asoc->cookie_preserve_req *= 2;
1317 } else {
1318 asoc->cookie_preserve_req = UINT32_MAX;
1319 }
1320 asoc->stale_cookie_count++;
1321 if (asoc->stale_cookie_count >
1322 asoc->max_init_times) {
1323 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
1324 /* now free the asoc */
1325 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1326 so = SCTP_INP_SO(stcb->sctp_ep);
1327 atomic_add_int(&stcb->asoc.refcnt, 1);
1328 SCTP_TCB_UNLOCK(stcb);
1329 SCTP_SOCKET_LOCK(so, 1);
1330 SCTP_TCB_LOCK(stcb);
1331 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1332 #endif
1333 (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1334 SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
1335 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1336 SCTP_SOCKET_UNLOCK(so, 1);
1337 #endif
1338 return (-1);
1339 }
1340 /* blast back to INIT state */
1341 sctp_toss_old_cookies(stcb, &stcb->asoc);
1342 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_WAIT);
1343 sctp_stop_all_cookie_timers(stcb);
1344 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
1345 }
1346 break;
1347 case SCTP_CAUSE_UNRESOLVABLE_ADDR:
1348 /*
1349 * Nothing we can do here, we don't do hostname
1350 * addresses so if the peer does not like my IPv6
1351 * (or IPv4 for that matter) it does not matter. If
1352 * they don't support that type of address, they can
1353 * NOT possibly get that packet type... i.e. with no
1354 * IPv6 you can't receive a IPv6 packet. so we can
1355 * safely ignore this one. If we ever added support
1356 * for HOSTNAME Addresses, then we would need to do
1357 * something here.
1358 */
1359 break;
1360 case SCTP_CAUSE_UNRECOG_CHUNK:
1361 if (cause_length >= sizeof(struct sctp_error_unrecognized_chunk)) {
1362 struct sctp_error_unrecognized_chunk *unrec_chunk;
1363
1364 unrec_chunk = (struct sctp_error_unrecognized_chunk *)cause;
1365 sctp_process_unrecog_chunk(stcb, unrec_chunk->ch.chunk_type, net);
1366 }
1367 break;
1368 case SCTP_CAUSE_UNRECOG_PARAM:
1369 /* XXX: We only consider the first parameter */
1370 if (cause_length >= sizeof(struct sctp_error_cause) + sizeof(struct sctp_paramhdr)) {
1371 struct sctp_paramhdr *unrec_parameter;
1372
1373 unrec_parameter = (struct sctp_paramhdr *)(cause + 1);
1374 sctp_process_unrecog_param(stcb, ntohs(unrec_parameter->param_type));
1375 }
1376 break;
1377 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
1378 /*
1379 * We ignore this since the timer will drive out a
1380 * new cookie anyway and there timer will drive us
1381 * to send a SHUTDOWN_COMPLETE. We can't send one
1382 * here since we don't have their tag.
1383 */
1384 break;
1385 case SCTP_CAUSE_DELETING_LAST_ADDR:
1386 case SCTP_CAUSE_RESOURCE_SHORTAGE:
1387 case SCTP_CAUSE_DELETING_SRC_ADDR:
1388 /*
1389 * We should NOT get these here, but in a
1390 * ASCONF-ACK.
1391 */
1392 SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a error cause with code %u.\n",
1393 cause_code);
1394 break;
1395 case SCTP_CAUSE_OUT_OF_RESC:
1396 /*
1397 * And what, pray tell do we do with the fact that
1398 * the peer is out of resources? Not really sure we
1399 * could do anything but abort. I suspect this
1400 * should have came WITH an abort instead of in a
1401 * OP-ERROR.
1402 */
1403 break;
1404 default:
1405 SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown code 0x%x\n",
1406 cause_code);
1407 break;
1408 }
1409 adjust = SCTP_SIZE32(cause_length);
1410 if (remaining_length >= adjust) {
1411 remaining_length -= adjust;
1412 } else {
1413 remaining_length = 0;
1414 }
1415 cause = (struct sctp_error_cause *)((caddr_t)cause + adjust);
1416 }
1417 sctp_ulp_notify(SCTP_NOTIFY_REMOTE_ERROR, stcb, code, ch, SCTP_SO_NOT_LOCKED);
1418 return (0);
1419 }
1420
1421 static int
sctp_handle_init_ack(struct mbuf * m,int iphlen,int offset,struct sockaddr * src,struct sockaddr * dst,struct sctphdr * sh,struct sctp_init_ack_chunk * cp,struct sctp_tcb * stcb,struct sctp_nets * net,int * abort_no_unlock,uint8_t mflowtype,uint32_t mflowid,uint32_t vrf_id)1422 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
1423 struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
1424 struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
1425 struct sctp_nets *net, int *abort_no_unlock,
1426 #if defined(__FreeBSD__)
1427 uint8_t mflowtype, uint32_t mflowid,
1428 #endif
1429 uint32_t vrf_id)
1430 {
1431 struct sctp_init_ack *init_ack;
1432 struct mbuf *op_err;
1433
1434 SCTPDBG(SCTP_DEBUG_INPUT2,
1435 "sctp_handle_init_ack: handling INIT-ACK\n");
1436
1437 if (stcb == NULL) {
1438 SCTPDBG(SCTP_DEBUG_INPUT2,
1439 "sctp_handle_init_ack: TCB is null\n");
1440 return (-1);
1441 }
1442 if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
1443 /* Invalid length */
1444 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1445 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1446 src, dst, sh, op_err,
1447 #if defined(__FreeBSD__)
1448 mflowtype, mflowid,
1449 #endif
1450 vrf_id, net->port);
1451 *abort_no_unlock = 1;
1452 return (-1);
1453 }
1454 init_ack = &cp->init;
1455 /* validate parameters */
1456 if (init_ack->initiate_tag == 0) {
1457 /* protocol error... send an abort */
1458 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1459 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1460 src, dst, sh, op_err,
1461 #if defined(__FreeBSD__)
1462 mflowtype, mflowid,
1463 #endif
1464 vrf_id, net->port);
1465 *abort_no_unlock = 1;
1466 return (-1);
1467 }
1468 if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
1469 /* protocol error... send an abort */
1470 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1471 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1472 src, dst, sh, op_err,
1473 #if defined(__FreeBSD__)
1474 mflowtype, mflowid,
1475 #endif
1476 vrf_id, net->port);
1477 *abort_no_unlock = 1;
1478 return (-1);
1479 }
1480 if (init_ack->num_inbound_streams == 0) {
1481 /* protocol error... send an abort */
1482 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1483 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1484 src, dst, sh, op_err,
1485 #if defined(__FreeBSD__)
1486 mflowtype, mflowid,
1487 #endif
1488 vrf_id, net->port);
1489 *abort_no_unlock = 1;
1490 return (-1);
1491 }
1492 if (init_ack->num_outbound_streams == 0) {
1493 /* protocol error... send an abort */
1494 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1495 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1496 src, dst, sh, op_err,
1497 #if defined(__FreeBSD__)
1498 mflowtype, mflowid,
1499 #endif
1500 vrf_id, net->port);
1501 *abort_no_unlock = 1;
1502 return (-1);
1503 }
1504 /* process according to association state... */
1505 switch (SCTP_GET_STATE(stcb)) {
1506 case SCTP_STATE_COOKIE_WAIT:
1507 /* this is the expected state for this chunk */
1508 /* process the INIT-ACK parameters */
1509 if (stcb->asoc.primary_destination->dest_state &
1510 SCTP_ADDR_UNCONFIRMED) {
1511 /*
1512 * The primary is where we sent the INIT, we can
1513 * always consider it confirmed when the INIT-ACK is
1514 * returned. Do this before we load addresses
1515 * though.
1516 */
1517 stcb->asoc.primary_destination->dest_state &=
1518 ~SCTP_ADDR_UNCONFIRMED;
1519 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
1520 stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);
1521 }
1522 if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb,
1523 net, abort_no_unlock,
1524 #if defined(__FreeBSD__)
1525 mflowtype, mflowid,
1526 #endif
1527 vrf_id) < 0) {
1528 /* error in parsing parameters */
1529 return (-1);
1530 }
1531 /* update our state */
1532 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
1533 SCTP_SET_STATE(stcb, SCTP_STATE_COOKIE_ECHOED);
1534
1535 /* reset the RTO calc */
1536 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1537 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1538 stcb->asoc.overall_error_count,
1539 0,
1540 SCTP_FROM_SCTP_INPUT,
1541 __LINE__);
1542 }
1543 stcb->asoc.overall_error_count = 0;
1544 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
1545 /*
1546 * collapse the init timer back in case of a exponential
1547 * backoff
1548 */
1549 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
1550 stcb, net);
1551 /*
1552 * the send at the end of the inbound data processing will
1553 * cause the cookie to be sent
1554 */
1555 break;
1556 case SCTP_STATE_SHUTDOWN_SENT:
1557 /* incorrect state... discard */
1558 break;
1559 case SCTP_STATE_COOKIE_ECHOED:
1560 /* incorrect state... discard */
1561 break;
1562 case SCTP_STATE_OPEN:
1563 /* incorrect state... discard */
1564 break;
1565 case SCTP_STATE_EMPTY:
1566 case SCTP_STATE_INUSE:
1567 default:
1568 /* incorrect state... discard */
1569 return (-1);
1570 break;
1571 }
1572 SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
1573 return (0);
1574 }
1575
1576 static struct sctp_tcb *
1577 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1578 struct sockaddr *src, struct sockaddr *dst,
1579 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1580 struct sctp_inpcb *inp, struct sctp_nets **netp,
1581 struct sockaddr *init_src, int *notification,
1582 int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1583 #if defined(__FreeBSD__)
1584 uint8_t mflowtype, uint32_t mflowid,
1585 #endif
1586 uint32_t vrf_id, uint16_t port);
1587
1588
1589 /*
1590 * handle a state cookie for an existing association m: input packet mbuf
1591 * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
1592 * "split" mbuf and the cookie signature does not exist offset: offset into
1593 * mbuf to the cookie-echo chunk
1594 */
1595 static struct sctp_tcb *
sctp_process_cookie_existing(struct mbuf * m,int iphlen,int offset,struct sockaddr * src,struct sockaddr * dst,struct sctphdr * sh,struct sctp_state_cookie * cookie,int cookie_len,struct sctp_inpcb * inp,struct sctp_tcb * stcb,struct sctp_nets ** netp,struct sockaddr * init_src,int * notification,int auth_skipped,uint32_t auth_offset,uint32_t auth_len,uint8_t mflowtype,uint32_t mflowid,uint32_t vrf_id,uint16_t port)1596 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
1597 struct sockaddr *src, struct sockaddr *dst,
1598 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1599 struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,
1600 struct sockaddr *init_src, int *notification,
1601 int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1602 #if defined(__FreeBSD__)
1603 uint8_t mflowtype, uint32_t mflowid,
1604 #endif
1605 uint32_t vrf_id, uint16_t port)
1606 {
1607 struct sctp_association *asoc;
1608 struct sctp_init_chunk *init_cp, init_buf;
1609 struct sctp_init_ack_chunk *initack_cp, initack_buf;
1610 struct sctp_nets *net;
1611 struct mbuf *op_err;
1612 struct timeval old;
1613 int init_offset, initack_offset, i;
1614 int retval;
1615 int spec_flag = 0;
1616 uint32_t how_indx;
1617 #if defined(SCTP_DETAILED_STR_STATS)
1618 int j;
1619 #endif
1620
1621 net = *netp;
1622 /* I know that the TCB is non-NULL from the caller */
1623 asoc = &stcb->asoc;
1624 for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
1625 if (asoc->cookie_how[how_indx] == 0)
1626 break;
1627 }
1628 if (how_indx < sizeof(asoc->cookie_how)) {
1629 asoc->cookie_how[how_indx] = 1;
1630 }
1631 if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1632 /* SHUTDOWN came in after sending INIT-ACK */
1633 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
1634 op_err = sctp_generate_cause(SCTP_CAUSE_COOKIE_IN_SHUTDOWN, "");
1635 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
1636 #if defined(__FreeBSD__)
1637 mflowtype, mflowid, inp->fibnum,
1638 #endif
1639 vrf_id, net->port);
1640 if (how_indx < sizeof(asoc->cookie_how))
1641 asoc->cookie_how[how_indx] = 2;
1642 return (NULL);
1643 }
1644 /*
1645 * find and validate the INIT chunk in the cookie (peer's info) the
1646 * INIT should start after the cookie-echo header struct (chunk
1647 * header, state cookie header struct)
1648 */
1649 init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
1650
1651 init_cp = (struct sctp_init_chunk *)
1652 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1653 (uint8_t *) & init_buf);
1654 if (init_cp == NULL) {
1655 /* could not pull a INIT chunk in cookie */
1656 return (NULL);
1657 }
1658 if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1659 return (NULL);
1660 }
1661 /*
1662 * find and validate the INIT-ACK chunk in the cookie (my info) the
1663 * INIT-ACK follows the INIT chunk
1664 */
1665 initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
1666 initack_cp = (struct sctp_init_ack_chunk *)
1667 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1668 (uint8_t *) & initack_buf);
1669 if (initack_cp == NULL) {
1670 /* could not pull INIT-ACK chunk in cookie */
1671 return (NULL);
1672 }
1673 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1674 return (NULL);
1675 }
1676 if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1677 (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
1678 /*
1679 * case D in Section 5.2.4 Table 2: MMAA process accordingly
1680 * to get into the OPEN state
1681 */
1682 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1683 /*-
1684 * Opps, this means that we somehow generated two vtag's
1685 * the same. I.e. we did:
1686 * Us Peer
1687 * <---INIT(tag=a)------
1688 * ----INIT-ACK(tag=t)-->
1689 * ----INIT(tag=t)------> *1
1690 * <---INIT-ACK(tag=a)---
1691 * <----CE(tag=t)------------- *2
1692 *
1693 * At point *1 we should be generating a different
1694 * tag t'. Which means we would throw away the CE and send
1695 * ours instead. Basically this is case C (throw away side).
1696 */
1697 if (how_indx < sizeof(asoc->cookie_how))
1698 asoc->cookie_how[how_indx] = 17;
1699 return (NULL);
1700
1701 }
1702 switch (SCTP_GET_STATE(stcb)) {
1703 case SCTP_STATE_COOKIE_WAIT:
1704 case SCTP_STATE_COOKIE_ECHOED:
1705 /*
1706 * INIT was sent but got a COOKIE_ECHO with the
1707 * correct tags... just accept it...but we must
1708 * process the init so that we can make sure we
1709 * have the right seq no's.
1710 */
1711 /* First we must process the INIT !! */
1712 retval = sctp_process_init(init_cp, stcb);
1713 if (retval < 0) {
1714 if (how_indx < sizeof(asoc->cookie_how))
1715 asoc->cookie_how[how_indx] = 3;
1716 return (NULL);
1717 }
1718 /* we have already processed the INIT so no problem */
1719 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp,
1720 stcb, net,
1721 SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
1722 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp,
1723 stcb, net,
1724 SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
1725 /* update current state */
1726 if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)
1727 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1728 else
1729 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1730
1731 SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
1732 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1733 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1734 stcb->sctp_ep, stcb, asoc->primary_destination);
1735 }
1736 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1737 sctp_stop_all_cookie_timers(stcb);
1738 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1739 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1740 (!SCTP_IS_LISTENING(inp))) {
1741 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1742 struct socket *so;
1743 #endif
1744 /*
1745 * Here is where collision would go if we
1746 * did a connect() and instead got a
1747 * init/init-ack/cookie done before the
1748 * init-ack came back..
1749 */
1750 stcb->sctp_ep->sctp_flags |=
1751 SCTP_PCB_FLAGS_CONNECTED;
1752 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1753 so = SCTP_INP_SO(stcb->sctp_ep);
1754 atomic_add_int(&stcb->asoc.refcnt, 1);
1755 SCTP_TCB_UNLOCK(stcb);
1756 SCTP_SOCKET_LOCK(so, 1);
1757 SCTP_TCB_LOCK(stcb);
1758 atomic_add_int(&stcb->asoc.refcnt, -1);
1759 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1760 SCTP_SOCKET_UNLOCK(so, 1);
1761 return (NULL);
1762 }
1763 #endif
1764 soisconnected(stcb->sctp_socket);
1765 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1766 SCTP_SOCKET_UNLOCK(so, 1);
1767 #endif
1768 }
1769 /* notify upper layer */
1770 *notification = SCTP_NOTIFY_ASSOC_UP;
1771 /*
1772 * since we did not send a HB make sure we
1773 * don't double things
1774 */
1775 old.tv_sec = cookie->time_entered.tv_sec;
1776 old.tv_usec = cookie->time_entered.tv_usec;
1777 net->hb_responded = 1;
1778 sctp_calculate_rto(stcb, asoc, net, &old,
1779 SCTP_RTT_FROM_NON_DATA);
1780
1781 if (stcb->asoc.sctp_autoclose_ticks &&
1782 (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
1783 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
1784 inp, stcb, NULL);
1785 }
1786 break;
1787 default:
1788 /*
1789 * we're in the OPEN state (or beyond), so
1790 * peer must have simply lost the COOKIE-ACK
1791 */
1792 break;
1793 } /* end switch */
1794 sctp_stop_all_cookie_timers(stcb);
1795 /*
1796 * We ignore the return code here.. not sure if we should
1797 * somehow abort.. but we do have an existing asoc. This
1798 * really should not fail.
1799 */
1800 if (sctp_load_addresses_from_init(stcb, m,
1801 init_offset + sizeof(struct sctp_init_chunk),
1802 initack_offset, src, dst, init_src, stcb->asoc.port)) {
1803 if (how_indx < sizeof(asoc->cookie_how))
1804 asoc->cookie_how[how_indx] = 4;
1805 return (NULL);
1806 }
1807 /* respond with a COOKIE-ACK */
1808 sctp_toss_old_cookies(stcb, asoc);
1809 sctp_send_cookie_ack(stcb);
1810 if (how_indx < sizeof(asoc->cookie_how))
1811 asoc->cookie_how[how_indx] = 5;
1812 return (stcb);
1813 }
1814
1815 if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1816 ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
1817 cookie->tie_tag_my_vtag == 0 &&
1818 cookie->tie_tag_peer_vtag == 0) {
1819 /*
1820 * case C in Section 5.2.4 Table 2: XMOO silently discard
1821 */
1822 if (how_indx < sizeof(asoc->cookie_how))
1823 asoc->cookie_how[how_indx] = 6;
1824 return (NULL);
1825 }
1826 /* If nat support, and the below and stcb is established,
1827 * send back a ABORT(colliding state) if we are established.
1828 */
1829 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) &&
1830 (asoc->peer_supports_nat) &&
1831 ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1832 ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1833 (asoc->peer_vtag == 0)))) {
1834 /* Special case - Peer's support nat. We may have
1835 * two init's that we gave out the same tag on since
1836 * one was not established.. i.e. we get INIT from host-1
1837 * behind the nat and we respond tag-a, we get a INIT from
1838 * host-2 behind the nat and we get tag-a again. Then we
1839 * bring up host-1 (or 2's) assoc, Then comes the cookie
1840 * from hsot-2 (or 1). Now we have colliding state. We must
1841 * send an abort here with colliding state indication.
1842 */
1843 op_err = sctp_generate_cause(SCTP_CAUSE_NAT_COLLIDING_STATE, "");
1844 sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
1845 #if defined(__FreeBSD__)
1846 mflowtype, mflowid, inp->fibnum,
1847 #endif
1848 vrf_id, port);
1849 return (NULL);
1850 }
1851 if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1852 ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1853 (asoc->peer_vtag == 0))) {
1854 /*
1855 * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
1856 * should be ok, re-accept peer info
1857 */
1858 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1859 /* Extension of case C.
1860 * If we hit this, then the random number
1861 * generator returned the same vtag when we
1862 * first sent our INIT-ACK and when we later sent
1863 * our INIT. The side with the seq numbers that are
1864 * different will be the one that normnally would
1865 * have hit case C. This in effect "extends" our vtags
1866 * in this collision case to be 64 bits. The same collision
1867 * could occur aka you get both vtag and seq number the
1868 * same twice in a row.. but is much less likely. If it
1869 * did happen then we would proceed through and bring
1870 * up the assoc.. we may end up with the wrong stream
1871 * setup however.. which would be bad.. but there is
1872 * no way to tell.. until we send on a stream that does
1873 * not exist :-)
1874 */
1875 if (how_indx < sizeof(asoc->cookie_how))
1876 asoc->cookie_how[how_indx] = 7;
1877
1878 return (NULL);
1879 }
1880 if (how_indx < sizeof(asoc->cookie_how))
1881 asoc->cookie_how[how_indx] = 8;
1882 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
1883 SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
1884 sctp_stop_all_cookie_timers(stcb);
1885 /*
1886 * since we did not send a HB make sure we don't double
1887 * things
1888 */
1889 net->hb_responded = 1;
1890 if (stcb->asoc.sctp_autoclose_ticks &&
1891 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1892 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1893 NULL);
1894 }
1895 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1896 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1897
1898 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
1899 /* Ok the peer probably discarded our
1900 * data (if we echoed a cookie+data). So anything
1901 * on the sent_queue should be marked for
1902 * retransmit, we may not get something to
1903 * kick us so it COULD still take a timeout
1904 * to move these.. but it can't hurt to mark them.
1905 */
1906 struct sctp_tmit_chunk *chk;
1907 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1908 if (chk->sent < SCTP_DATAGRAM_RESEND) {
1909 chk->sent = SCTP_DATAGRAM_RESEND;
1910 sctp_flight_size_decrease(chk);
1911 sctp_total_flight_decrease(stcb, chk);
1912 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1913 spec_flag++;
1914 }
1915 }
1916
1917 }
1918 /* process the INIT info (peer's info) */
1919 retval = sctp_process_init(init_cp, stcb);
1920 if (retval < 0) {
1921 if (how_indx < sizeof(asoc->cookie_how))
1922 asoc->cookie_how[how_indx] = 9;
1923 return (NULL);
1924 }
1925 if (sctp_load_addresses_from_init(stcb, m,
1926 init_offset + sizeof(struct sctp_init_chunk),
1927 initack_offset, src, dst, init_src, stcb->asoc.port)) {
1928 if (how_indx < sizeof(asoc->cookie_how))
1929 asoc->cookie_how[how_indx] = 10;
1930 return (NULL);
1931 }
1932 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
1933 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
1934 *notification = SCTP_NOTIFY_ASSOC_UP;
1935
1936 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1937 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1938 (!SCTP_IS_LISTENING(inp))) {
1939 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1940 struct socket *so;
1941 #endif
1942 stcb->sctp_ep->sctp_flags |=
1943 SCTP_PCB_FLAGS_CONNECTED;
1944 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1945 so = SCTP_INP_SO(stcb->sctp_ep);
1946 atomic_add_int(&stcb->asoc.refcnt, 1);
1947 SCTP_TCB_UNLOCK(stcb);
1948 SCTP_SOCKET_LOCK(so, 1);
1949 SCTP_TCB_LOCK(stcb);
1950 atomic_add_int(&stcb->asoc.refcnt, -1);
1951 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1952 SCTP_SOCKET_UNLOCK(so, 1);
1953 return (NULL);
1954 }
1955 #endif
1956 soisconnected(stcb->sctp_socket);
1957 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1958 SCTP_SOCKET_UNLOCK(so, 1);
1959 #endif
1960 }
1961 if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)
1962 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1963 else
1964 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1965 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1966 } else if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) {
1967 SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
1968 } else {
1969 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1970 }
1971 SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
1972 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1973 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1974 stcb->sctp_ep, stcb, asoc->primary_destination);
1975 }
1976 sctp_stop_all_cookie_timers(stcb);
1977 sctp_toss_old_cookies(stcb, asoc);
1978 sctp_send_cookie_ack(stcb);
1979 if (spec_flag) {
1980 /* only if we have retrans set do we do this. What
1981 * this call does is get only the COOKIE-ACK out
1982 * and then when we return the normal call to
1983 * sctp_chunk_output will get the retrans out
1984 * behind this.
1985 */
1986 sctp_chunk_output(inp,stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);
1987 }
1988 if (how_indx < sizeof(asoc->cookie_how))
1989 asoc->cookie_how[how_indx] = 11;
1990
1991 return (stcb);
1992 }
1993 if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1994 ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
1995 cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
1996 cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
1997 cookie->tie_tag_peer_vtag != 0) {
1998 struct sctpasochead *head;
1999 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2000 struct socket *so;
2001 #endif
2002
2003 if (asoc->peer_supports_nat) {
2004 /* This is a gross gross hack.
2005 * Just call the cookie_new code since we
2006 * are allowing a duplicate association.
2007 * I hope this works...
2008 */
2009 return (sctp_process_cookie_new(m, iphlen, offset, src, dst,
2010 sh, cookie, cookie_len,
2011 inp, netp, init_src,notification,
2012 auth_skipped, auth_offset, auth_len,
2013 #if defined(__FreeBSD__)
2014 mflowtype, mflowid,
2015 #endif
2016 vrf_id, port));
2017 }
2018 /*
2019 * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
2020 */
2021 /* temp code */
2022 if (how_indx < sizeof(asoc->cookie_how))
2023 asoc->cookie_how[how_indx] = 12;
2024 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net,
2025 SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
2026 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
2027 SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
2028
2029 /* notify upper layer */
2030 *notification = SCTP_NOTIFY_ASSOC_RESTART;
2031 atomic_add_int(&stcb->asoc.refcnt, 1);
2032 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_OPEN) &&
2033 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
2034 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT)) {
2035 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2036 }
2037 if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) {
2038 SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
2039 } else if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) {
2040 SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
2041 }
2042 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2043 SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
2044 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2045 stcb->sctp_ep, stcb, asoc->primary_destination);
2046
2047 } else if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) {
2048 /* move to OPEN state, if not in SHUTDOWN_SENT */
2049 SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
2050 }
2051 asoc->pre_open_streams =
2052 ntohs(initack_cp->init.num_outbound_streams);
2053 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
2054 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
2055 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
2056
2057 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
2058
2059 asoc->str_reset_seq_in = asoc->init_seq_number;
2060
2061 asoc->advanced_peer_ack_point = asoc->last_acked_seq;
2062 if (asoc->mapping_array) {
2063 memset(asoc->mapping_array, 0,
2064 asoc->mapping_array_size);
2065 }
2066 if (asoc->nr_mapping_array) {
2067 memset(asoc->nr_mapping_array, 0,
2068 asoc->mapping_array_size);
2069 }
2070 SCTP_TCB_UNLOCK(stcb);
2071 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2072 so = SCTP_INP_SO(stcb->sctp_ep);
2073 SCTP_SOCKET_LOCK(so, 1);
2074 #endif
2075 SCTP_INP_INFO_WLOCK();
2076 SCTP_INP_WLOCK(stcb->sctp_ep);
2077 SCTP_TCB_LOCK(stcb);
2078 atomic_add_int(&stcb->asoc.refcnt, -1);
2079 /* send up all the data */
2080 SCTP_TCB_SEND_LOCK(stcb);
2081
2082 sctp_report_all_outbound(stcb, 0, 1, SCTP_SO_LOCKED);
2083 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
2084 stcb->asoc.strmout[i].chunks_on_queues = 0;
2085 #if defined(SCTP_DETAILED_STR_STATS)
2086 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
2087 asoc->strmout[i].abandoned_sent[j] = 0;
2088 asoc->strmout[i].abandoned_unsent[j] = 0;
2089 }
2090 #else
2091 asoc->strmout[i].abandoned_sent[0] = 0;
2092 asoc->strmout[i].abandoned_unsent[0] = 0;
2093 #endif
2094 stcb->asoc.strmout[i].sid = i;
2095 stcb->asoc.strmout[i].next_mid_ordered = 0;
2096 stcb->asoc.strmout[i].next_mid_unordered = 0;
2097 stcb->asoc.strmout[i].last_msg_incomplete = 0;
2098 }
2099 /* process the INIT-ACK info (my info) */
2100 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
2101 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
2102
2103 /* pull from vtag hash */
2104 LIST_REMOVE(stcb, sctp_asocs);
2105 /* re-insert to new vtag position */
2106 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
2107 SCTP_BASE_INFO(hashasocmark))];
2108 /*
2109 * put it in the bucket in the vtag hash of assoc's for the
2110 * system
2111 */
2112 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
2113
2114 SCTP_TCB_SEND_UNLOCK(stcb);
2115 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2116 SCTP_INP_INFO_WUNLOCK();
2117 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2118 SCTP_SOCKET_UNLOCK(so, 1);
2119 #endif
2120 asoc->total_flight = 0;
2121 asoc->total_flight_count = 0;
2122 /* process the INIT info (peer's info) */
2123 retval = sctp_process_init(init_cp, stcb);
2124 if (retval < 0) {
2125 if (how_indx < sizeof(asoc->cookie_how))
2126 asoc->cookie_how[how_indx] = 13;
2127
2128 return (NULL);
2129 }
2130 /*
2131 * since we did not send a HB make sure we don't double
2132 * things
2133 */
2134 net->hb_responded = 1;
2135
2136 if (sctp_load_addresses_from_init(stcb, m,
2137 init_offset + sizeof(struct sctp_init_chunk),
2138 initack_offset, src, dst, init_src, stcb->asoc.port)) {
2139 if (how_indx < sizeof(asoc->cookie_how))
2140 asoc->cookie_how[how_indx] = 14;
2141
2142 return (NULL);
2143 }
2144 /* respond with a COOKIE-ACK */
2145 sctp_stop_all_cookie_timers(stcb);
2146 sctp_toss_old_cookies(stcb, asoc);
2147 sctp_send_cookie_ack(stcb);
2148 if (how_indx < sizeof(asoc->cookie_how))
2149 asoc->cookie_how[how_indx] = 15;
2150
2151 return (stcb);
2152 }
2153 if (how_indx < sizeof(asoc->cookie_how))
2154 asoc->cookie_how[how_indx] = 16;
2155 /* all other cases... */
2156 return (NULL);
2157 }
2158
2159
2160 /*
2161 * handle a state cookie for a new association m: input packet mbuf chain--
2162 * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
2163 * and the cookie signature does not exist offset: offset into mbuf to the
2164 * cookie-echo chunk length: length of the cookie chunk to: where the init
2165 * was from returns a new TCB
2166 */
2167 static struct sctp_tcb *
sctp_process_cookie_new(struct mbuf * m,int iphlen,int offset,struct sockaddr * src,struct sockaddr * dst,struct sctphdr * sh,struct sctp_state_cookie * cookie,int cookie_len,struct sctp_inpcb * inp,struct sctp_nets ** netp,struct sockaddr * init_src,int * notification,int auth_skipped,uint32_t auth_offset,uint32_t auth_len,uint8_t mflowtype,uint32_t mflowid,uint32_t vrf_id,uint16_t port)2168 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
2169 struct sockaddr *src, struct sockaddr *dst,
2170 struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
2171 struct sctp_inpcb *inp, struct sctp_nets **netp,
2172 struct sockaddr *init_src, int *notification,
2173 int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2174 #if defined(__FreeBSD__)
2175 uint8_t mflowtype, uint32_t mflowid,
2176 #endif
2177 uint32_t vrf_id, uint16_t port)
2178 {
2179 struct sctp_tcb *stcb;
2180 struct sctp_init_chunk *init_cp, init_buf;
2181 struct sctp_init_ack_chunk *initack_cp, initack_buf;
2182 union sctp_sockstore store;
2183 struct sctp_association *asoc;
2184 int init_offset, initack_offset, initack_limit;
2185 int retval;
2186 int error = 0;
2187 uint8_t auth_chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
2188 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2189 struct socket *so;
2190
2191 so = SCTP_INP_SO(inp);
2192 #endif
2193
2194 /*
2195 * find and validate the INIT chunk in the cookie (peer's info) the
2196 * INIT should start after the cookie-echo header struct (chunk
2197 * header, state cookie header struct)
2198 */
2199 init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
2200 init_cp = (struct sctp_init_chunk *)
2201 sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
2202 (uint8_t *) & init_buf);
2203 if (init_cp == NULL) {
2204 /* could not pull a INIT chunk in cookie */
2205 SCTPDBG(SCTP_DEBUG_INPUT1,
2206 "process_cookie_new: could not pull INIT chunk hdr\n");
2207 return (NULL);
2208 }
2209 if (init_cp->ch.chunk_type != SCTP_INITIATION) {
2210 SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
2211 return (NULL);
2212 }
2213 initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
2214 /*
2215 * find and validate the INIT-ACK chunk in the cookie (my info) the
2216 * INIT-ACK follows the INIT chunk
2217 */
2218 initack_cp = (struct sctp_init_ack_chunk *)
2219 sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
2220 (uint8_t *) & initack_buf);
2221 if (initack_cp == NULL) {
2222 /* could not pull INIT-ACK chunk in cookie */
2223 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
2224 return (NULL);
2225 }
2226 if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
2227 return (NULL);
2228 }
2229 /*
2230 * NOTE: We can't use the INIT_ACK's chk_length to determine the
2231 * "initack_limit" value. This is because the chk_length field
2232 * includes the length of the cookie, but the cookie is omitted when
2233 * the INIT and INIT_ACK are tacked onto the cookie...
2234 */
2235 initack_limit = offset + cookie_len;
2236
2237 /*
2238 * now that we know the INIT/INIT-ACK are in place, create a new TCB
2239 * and popluate
2240 */
2241
2242 /*
2243 * Here we do a trick, we set in NULL for the proc/thread argument. We
2244 * do this since in effect we only use the p argument when
2245 * the socket is unbound and we must do an implicit bind.
2246 * Since we are getting a cookie, we cannot be unbound.
2247 */
2248 stcb = sctp_aloc_assoc(inp, init_src, &error,
2249 ntohl(initack_cp->init.initiate_tag), vrf_id,
2250 ntohs(initack_cp->init.num_outbound_streams),
2251 port,
2252 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
2253 (struct thread *)NULL,
2254 #elif defined(__Windows__)
2255 (PKTHREAD)NULL,
2256 #else
2257 (struct proc *)NULL,
2258 #endif
2259 SCTP_DONT_INITIALIZE_AUTH_PARAMS);
2260 if (stcb == NULL) {
2261 struct mbuf *op_err;
2262
2263 /* memory problem? */
2264 SCTPDBG(SCTP_DEBUG_INPUT1,
2265 "process_cookie_new: no room for another TCB!\n");
2266 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2267 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2268 src, dst, sh, op_err,
2269 #if defined(__FreeBSD__)
2270 mflowtype, mflowid,
2271 #endif
2272 vrf_id, port);
2273 return (NULL);
2274 }
2275 /* get the correct sctp_nets */
2276 if (netp)
2277 *netp = sctp_findnet(stcb, init_src);
2278
2279 asoc = &stcb->asoc;
2280 /* get scope variables out of cookie */
2281 asoc->scope.ipv4_local_scope = cookie->ipv4_scope;
2282 asoc->scope.site_scope = cookie->site_scope;
2283 asoc->scope.local_scope = cookie->local_scope;
2284 asoc->scope.loopback_scope = cookie->loopback_scope;
2285
2286 #if defined(__Userspace__)
2287 if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||
2288 (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal) ||
2289 (asoc->scope.conn_addr_legal != cookie->conn_addr_legal)) {
2290 #else
2291 if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||
2292 (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal)) {
2293 #endif
2294 struct mbuf *op_err;
2295
2296 /*
2297 * Houston we have a problem. The EP changed while the
2298 * cookie was in flight. Only recourse is to abort the
2299 * association.
2300 */
2301 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2302 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2303 src, dst, sh, op_err,
2304 #if defined(__FreeBSD__)
2305 mflowtype, mflowid,
2306 #endif
2307 vrf_id, port);
2308 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2309 atomic_add_int(&stcb->asoc.refcnt, 1);
2310 SCTP_TCB_UNLOCK(stcb);
2311 SCTP_SOCKET_LOCK(so, 1);
2312 SCTP_TCB_LOCK(stcb);
2313 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2314 #endif
2315 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2316 SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
2317 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2318 SCTP_SOCKET_UNLOCK(so, 1);
2319 #endif
2320 return (NULL);
2321 }
2322 /* process the INIT-ACK info (my info) */
2323 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
2324 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
2325 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
2326 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
2327 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
2328 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
2329 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
2330 asoc->str_reset_seq_in = asoc->init_seq_number;
2331
2332 asoc->advanced_peer_ack_point = asoc->last_acked_seq;
2333
2334 /* process the INIT info (peer's info) */
2335 if (netp)
2336 retval = sctp_process_init(init_cp, stcb);
2337 else
2338 retval = 0;
2339 if (retval < 0) {
2340 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2341 atomic_add_int(&stcb->asoc.refcnt, 1);
2342 SCTP_TCB_UNLOCK(stcb);
2343 SCTP_SOCKET_LOCK(so, 1);
2344 SCTP_TCB_LOCK(stcb);
2345 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2346 #endif
2347 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2348 SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
2349 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2350 SCTP_SOCKET_UNLOCK(so, 1);
2351 #endif
2352 return (NULL);
2353 }
2354 /* load all addresses */
2355 if (sctp_load_addresses_from_init(stcb, m,
2356 init_offset + sizeof(struct sctp_init_chunk), initack_offset,
2357 src, dst, init_src, port)) {
2358 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2359 atomic_add_int(&stcb->asoc.refcnt, 1);
2360 SCTP_TCB_UNLOCK(stcb);
2361 SCTP_SOCKET_LOCK(so, 1);
2362 SCTP_TCB_LOCK(stcb);
2363 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2364 #endif
2365 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2366 SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
2367 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2368 SCTP_SOCKET_UNLOCK(so, 1);
2369 #endif
2370 return (NULL);
2371 }
2372 /*
2373 * verify any preceding AUTH chunk that was skipped
2374 */
2375 /* pull the local authentication parameters from the cookie/init-ack */
2376 sctp_auth_get_cookie_params(stcb, m,
2377 initack_offset + sizeof(struct sctp_init_ack_chunk),
2378 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
2379 if (auth_skipped) {
2380 struct sctp_auth_chunk *auth;
2381
2382 if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
2383 auth = (struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
2384 } else {
2385 auth = NULL;
2386 }
2387 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
2388 /* auth HMAC failed, dump the assoc and packet */
2389 SCTPDBG(SCTP_DEBUG_AUTH1,
2390 "COOKIE-ECHO: AUTH failed\n");
2391 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2392 atomic_add_int(&stcb->asoc.refcnt, 1);
2393 SCTP_TCB_UNLOCK(stcb);
2394 SCTP_SOCKET_LOCK(so, 1);
2395 SCTP_TCB_LOCK(stcb);
2396 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2397 #endif
2398 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2399 SCTP_FROM_SCTP_INPUT + SCTP_LOC_21);
2400 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2401 SCTP_SOCKET_UNLOCK(so, 1);
2402 #endif
2403 return (NULL);
2404 } else {
2405 /* remaining chunks checked... good to go */
2406 stcb->asoc.authenticated = 1;
2407 }
2408 }
2409
2410 /*
2411 * if we're doing ASCONFs, check to see if we have any new local
2412 * addresses that need to get added to the peer (eg. addresses
2413 * changed while cookie echo in flight). This needs to be done
2414 * after we go to the OPEN state to do the correct asconf
2415 * processing. else, make sure we have the correct addresses in our
2416 * lists
2417 */
2418
2419 /* warning, we re-use sin, sin6, sa_store here! */
2420 /* pull in local_address (our "from" address) */
2421 switch (cookie->laddr_type) {
2422 #ifdef INET
2423 case SCTP_IPV4_ADDRESS:
2424 /* source addr is IPv4 */
2425 memset(&store.sin, 0, sizeof(struct sockaddr_in));
2426 store.sin.sin_family = AF_INET;
2427 #ifdef HAVE_SIN_LEN
2428 store.sin.sin_len = sizeof(struct sockaddr_in);
2429 #endif
2430 store.sin.sin_addr.s_addr = cookie->laddress[0];
2431 break;
2432 #endif
2433 #ifdef INET6
2434 case SCTP_IPV6_ADDRESS:
2435 /* source addr is IPv6 */
2436 memset(&store.sin6, 0, sizeof(struct sockaddr_in6));
2437 store.sin6.sin6_family = AF_INET6;
2438 #ifdef HAVE_SIN6_LEN
2439 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2440 #endif
2441 store.sin6.sin6_scope_id = cookie->scope_id;
2442 memcpy(&store.sin6.sin6_addr, cookie->laddress, sizeof(struct in6_addr));
2443 break;
2444 #endif
2445 #if defined(__Userspace__)
2446 case SCTP_CONN_ADDRESS:
2447 /* source addr is conn */
2448 memset(&store.sconn, 0, sizeof(struct sockaddr_conn));
2449 store.sconn.sconn_family = AF_CONN;
2450 #ifdef HAVE_SCONN_LEN
2451 store.sconn.sconn_len = sizeof(struct sockaddr_conn);
2452 #endif
2453 memcpy(&store.sconn.sconn_addr, cookie->laddress, sizeof(void *));
2454 break;
2455 #endif
2456 default:
2457 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2458 atomic_add_int(&stcb->asoc.refcnt, 1);
2459 SCTP_TCB_UNLOCK(stcb);
2460 SCTP_SOCKET_LOCK(so, 1);
2461 SCTP_TCB_LOCK(stcb);
2462 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2463 #endif
2464 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2465 SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
2466 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2467 SCTP_SOCKET_UNLOCK(so, 1);
2468 #endif
2469 return (NULL);
2470 }
2471
2472 /* update current state */
2473 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2474 SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
2475 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2476 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2477 stcb->sctp_ep, stcb, asoc->primary_destination);
2478 }
2479 sctp_stop_all_cookie_timers(stcb);
2480 SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
2481 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2482
2483 /* set up to notify upper layer */
2484 *notification = SCTP_NOTIFY_ASSOC_UP;
2485 if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2486 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2487 (!SCTP_IS_LISTENING(inp))) {
2488 /*
2489 * This is an endpoint that called connect() how it got a
2490 * cookie that is NEW is a bit of a mystery. It must be that
2491 * the INIT was sent, but before it got there.. a complete
2492 * INIT/INIT-ACK/COOKIE arrived. But of course then it
2493 * should have went to the other code.. not here.. oh well..
2494 * a bit of protection is worth having..
2495 */
2496 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2497 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2498 atomic_add_int(&stcb->asoc.refcnt, 1);
2499 SCTP_TCB_UNLOCK(stcb);
2500 SCTP_SOCKET_LOCK(so, 1);
2501 SCTP_TCB_LOCK(stcb);
2502 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2503 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2504 SCTP_SOCKET_UNLOCK(so, 1);
2505 return (NULL);
2506 }
2507 #endif
2508 soisconnected(stcb->sctp_socket);
2509 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2510 SCTP_SOCKET_UNLOCK(so, 1);
2511 #endif
2512 } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
2513 (SCTP_IS_LISTENING(inp))) {
2514 /*
2515 * We don't want to do anything with this one. Since it is
2516 * the listening guy. The timer will get started for
2517 * accepted connections in the caller.
2518 */
2519 ;
2520 }
2521 /* since we did not send a HB make sure we don't double things */
2522 if ((netp) && (*netp))
2523 (*netp)->hb_responded = 1;
2524
2525 if (stcb->asoc.sctp_autoclose_ticks &&
2526 sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2527 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
2528 }
2529 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
2530 if ((netp != NULL) && (*netp != NULL)) {
2531 struct timeval old;
2532
2533 /* calculate the RTT and set the encaps port */
2534 old.tv_sec = cookie->time_entered.tv_sec;
2535 old.tv_usec = cookie->time_entered.tv_usec;
2536 sctp_calculate_rto(stcb, asoc, *netp, &old, SCTP_RTT_FROM_NON_DATA);
2537 }
2538 /* respond with a COOKIE-ACK */
2539 sctp_send_cookie_ack(stcb);
2540
2541 /*
2542 * check the address lists for any ASCONFs that need to be sent
2543 * AFTER the cookie-ack is sent
2544 */
2545 sctp_check_address_list(stcb, m,
2546 initack_offset + sizeof(struct sctp_init_ack_chunk),
2547 initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
2548 &store.sa, cookie->local_scope, cookie->site_scope,
2549 cookie->ipv4_scope, cookie->loopback_scope);
2550
2551
2552 return (stcb);
2553 }
2554
2555 /*
2556 * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e
2557 * we NEED to make sure we are not already using the vtag. If so we
2558 * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit!
2559 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,
2560 SCTP_BASE_INFO(hashasocmark))];
2561 LIST_FOREACH(stcb, head, sctp_asocs) {
2562 if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep)) {
2563 -- SEND ABORT - TRY AGAIN --
2564 }
2565 }
2566 */
2567
2568 /*
2569 * handles a COOKIE-ECHO message stcb: modified to either a new or left as
2570 * existing (non-NULL) TCB
2571 */
2572 static struct mbuf *
2573 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
2574 struct sockaddr *src, struct sockaddr *dst,
2575 struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
2576 struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
2577 int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2578 struct sctp_tcb **locked_tcb,
2579 #if defined(__FreeBSD__)
2580 uint8_t mflowtype, uint32_t mflowid,
2581 #endif
2582 uint32_t vrf_id, uint16_t port)
2583 {
2584 struct sctp_state_cookie *cookie;
2585 struct sctp_tcb *l_stcb = *stcb;
2586 struct sctp_inpcb *l_inp;
2587 struct sockaddr *to;
2588 struct sctp_pcb *ep;
2589 struct mbuf *m_sig;
2590 uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
2591 uint8_t *sig;
2592 uint8_t cookie_ok = 0;
2593 unsigned int sig_offset, cookie_offset;
2594 unsigned int cookie_len;
2595 struct timeval now;
2596 struct timeval time_expires;
2597 int notification = 0;
2598 struct sctp_nets *netl;
2599 int had_a_existing_tcb = 0;
2600 int send_int_conf = 0;
2601 #ifdef INET
2602 struct sockaddr_in sin;
2603 #endif
2604 #ifdef INET6
2605 struct sockaddr_in6 sin6;
2606 #endif
2607 #if defined(__Userspace__)
2608 struct sockaddr_conn sconn;
2609 #endif
2610
2611 SCTPDBG(SCTP_DEBUG_INPUT2,
2612 "sctp_handle_cookie: handling COOKIE-ECHO\n");
2613
2614 if (inp_p == NULL) {
2615 return (NULL);
2616 }
2617 cookie = &cp->cookie;
2618 cookie_offset = offset + sizeof(struct sctp_chunkhdr);
2619 cookie_len = ntohs(cp->ch.chunk_length);
2620
2621 if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
2622 sizeof(struct sctp_init_chunk) +
2623 sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
2624 /* cookie too small */
2625 return (NULL);
2626 }
2627 if ((cookie->peerport != sh->src_port) ||
2628 (cookie->myport != sh->dest_port) ||
2629 (cookie->my_vtag != sh->v_tag)) {
2630 /*
2631 * invalid ports or bad tag. Note that we always leave the
2632 * v_tag in the header in network order and when we stored
2633 * it in the my_vtag slot we also left it in network order.
2634 * This maintains the match even though it may be in the
2635 * opposite byte order of the machine :->
2636 */
2637 return (NULL);
2638 }
2639 /*
2640 * split off the signature into its own mbuf (since it should not be
2641 * calculated in the sctp_hmac_m() call).
2642 */
2643 sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
2644 m_sig = m_split(m, sig_offset, M_NOWAIT);
2645 if (m_sig == NULL) {
2646 /* out of memory or ?? */
2647 return (NULL);
2648 }
2649 #ifdef SCTP_MBUF_LOGGING
2650 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
2651 sctp_log_mbc(m_sig, SCTP_MBUF_SPLIT);
2652 }
2653 #endif
2654
2655 /*
2656 * compute the signature/digest for the cookie
2657 */
2658 ep = &(*inp_p)->sctp_ep;
2659 l_inp = *inp_p;
2660 if (l_stcb) {
2661 SCTP_TCB_UNLOCK(l_stcb);
2662 }
2663 SCTP_INP_RLOCK(l_inp);
2664 if (l_stcb) {
2665 SCTP_TCB_LOCK(l_stcb);
2666 }
2667 /* which cookie is it? */
2668 if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
2669 (ep->current_secret_number != ep->last_secret_number)) {
2670 /* it's the old cookie */
2671 (void)sctp_hmac_m(SCTP_HMAC,
2672 (uint8_t *)ep->secret_key[(int)ep->last_secret_number],
2673 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2674 } else {
2675 /* it's the current cookie */
2676 (void)sctp_hmac_m(SCTP_HMAC,
2677 (uint8_t *)ep->secret_key[(int)ep->current_secret_number],
2678 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2679 }
2680 /* get the signature */
2681 SCTP_INP_RUNLOCK(l_inp);
2682 sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
2683 if (sig == NULL) {
2684 /* couldn't find signature */
2685 sctp_m_freem(m_sig);
2686 return (NULL);
2687 }
2688 /* compare the received digest with the computed digest */
2689 if (timingsafe_bcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
2690 /* try the old cookie? */
2691 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
2692 (ep->current_secret_number != ep->last_secret_number)) {
2693 /* compute digest with old */
2694 (void)sctp_hmac_m(SCTP_HMAC,
2695 (uint8_t *)ep->secret_key[(int)ep->last_secret_number],
2696 SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2697 /* compare */
2698 if (timingsafe_bcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
2699 cookie_ok = 1;
2700 }
2701 } else {
2702 cookie_ok = 1;
2703 }
2704
2705 /*
2706 * Now before we continue we must reconstruct our mbuf so that
2707 * normal processing of any other chunks will work.
2708 */
2709 {
2710 struct mbuf *m_at;
2711
2712 m_at = m;
2713 while (SCTP_BUF_NEXT(m_at) != NULL) {
2714 m_at = SCTP_BUF_NEXT(m_at);
2715 }
2716 SCTP_BUF_NEXT(m_at) = m_sig;
2717 }
2718
2719 if (cookie_ok == 0) {
2720 SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
2721 SCTPDBG(SCTP_DEBUG_INPUT2,
2722 "offset = %u, cookie_offset = %u, sig_offset = %u\n",
2723 (uint32_t) offset, cookie_offset, sig_offset);
2724 return (NULL);
2725 }
2726
2727 /*
2728 * check the cookie timestamps to be sure it's not stale
2729 */
2730 (void)SCTP_GETTIME_TIMEVAL(&now);
2731 /* Expire time is in Ticks, so we convert to seconds */
2732 time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life);
2733 time_expires.tv_usec = cookie->time_entered.tv_usec;
2734 #ifndef __FreeBSD__
2735 if (timercmp(&now, &time_expires, >))
2736 #else
2737 if (timevalcmp(&now, &time_expires, >))
2738 #endif
2739 {
2740 /* cookie is stale! */
2741 struct mbuf *op_err;
2742 struct sctp_error_stale_cookie *cause;
2743 struct timeval diff;
2744 uint32_t staleness;
2745
2746 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_error_stale_cookie),
2747 0, M_NOWAIT, 1, MT_DATA);
2748 if (op_err == NULL) {
2749 /* FOOBAR */
2750 return (NULL);
2751 }
2752 /* Set the len */
2753 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_error_stale_cookie);
2754 cause = mtod(op_err, struct sctp_error_stale_cookie *);
2755 cause->cause.code = htons(SCTP_CAUSE_STALE_COOKIE);
2756 cause->cause.length = htons((sizeof(struct sctp_paramhdr) +
2757 (sizeof(uint32_t))));
2758 #ifndef __FreeBSD__
2759 timersub(&now, &time_expires, &diff);
2760 #else
2761 diff = now;
2762 timevalsub(&diff, &time_expires);
2763 #endif
2764 if ((uint32_t)diff.tv_sec > UINT32_MAX / 1000000) {
2765 staleness = UINT32_MAX;
2766 } else {
2767 staleness = diff.tv_sec * 1000000;
2768 }
2769 if (UINT32_MAX - staleness >= (uint32_t)diff.tv_usec) {
2770 staleness += diff.tv_usec;
2771 } else {
2772 staleness = UINT32_MAX;
2773 }
2774 cause->stale_time = htonl(staleness);
2775 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
2776 #if defined(__FreeBSD__)
2777 mflowtype, mflowid, l_inp->fibnum,
2778 #endif
2779 vrf_id, port);
2780 return (NULL);
2781 }
2782 /*
2783 * Now we must see with the lookup address if we have an existing
2784 * asoc. This will only happen if we were in the COOKIE-WAIT state
2785 * and a INIT collided with us and somewhere the peer sent the
2786 * cookie on another address besides the single address our assoc
2787 * had for him. In this case we will have one of the tie-tags set at
2788 * least AND the address field in the cookie can be used to look it
2789 * up.
2790 */
2791 to = NULL;
2792 switch (cookie->addr_type) {
2793 #ifdef INET6
2794 case SCTP_IPV6_ADDRESS:
2795 memset(&sin6, 0, sizeof(sin6));
2796 sin6.sin6_family = AF_INET6;
2797 #ifdef HAVE_SIN6_LEN
2798 sin6.sin6_len = sizeof(sin6);
2799 #endif
2800 sin6.sin6_port = sh->src_port;
2801 sin6.sin6_scope_id = cookie->scope_id;
2802 memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
2803 sizeof(sin6.sin6_addr.s6_addr));
2804 to = (struct sockaddr *)&sin6;
2805 break;
2806 #endif
2807 #ifdef INET
2808 case SCTP_IPV4_ADDRESS:
2809 memset(&sin, 0, sizeof(sin));
2810 sin.sin_family = AF_INET;
2811 #ifdef HAVE_SIN_LEN
2812 sin.sin_len = sizeof(sin);
2813 #endif
2814 sin.sin_port = sh->src_port;
2815 sin.sin_addr.s_addr = cookie->address[0];
2816 to = (struct sockaddr *)&sin;
2817 break;
2818 #endif
2819 #if defined(__Userspace__)
2820 case SCTP_CONN_ADDRESS:
2821 memset(&sconn, 0, sizeof(struct sockaddr_conn));
2822 sconn.sconn_family = AF_CONN;
2823 #ifdef HAVE_SCONN_LEN
2824 sconn.sconn_len = sizeof(struct sockaddr_conn);
2825 #endif
2826 sconn.sconn_port = sh->src_port;
2827 memcpy(&sconn.sconn_addr, cookie->address, sizeof(void *));
2828 to = (struct sockaddr *)&sconn;
2829 break;
2830 #endif
2831 default:
2832 /* This should not happen */
2833 return (NULL);
2834 }
2835 if (*stcb == NULL) {
2836 /* Yep, lets check */
2837 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, dst, NULL);
2838 if (*stcb == NULL) {
2839 /*
2840 * We should have only got back the same inp. If we
2841 * got back a different ep we have a problem. The
2842 * original findep got back l_inp and now
2843 */
2844 if (l_inp != *inp_p) {
2845 SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
2846 }
2847 } else {
2848 if (*locked_tcb == NULL) {
2849 /* In this case we found the assoc only
2850 * after we locked the create lock. This means
2851 * we are in a colliding case and we must make
2852 * sure that we unlock the tcb if its one of the
2853 * cases where we throw away the incoming packets.
2854 */
2855 *locked_tcb = *stcb;
2856
2857 /* We must also increment the inp ref count
2858 * since the ref_count flags was set when we
2859 * did not find the TCB, now we found it which
2860 * reduces the refcount.. we must raise it back
2861 * out to balance it all :-)
2862 */
2863 SCTP_INP_INCR_REF((*stcb)->sctp_ep);
2864 if ((*stcb)->sctp_ep != l_inp) {
2865 SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
2866 (void *)(*stcb)->sctp_ep, (void *)l_inp);
2867 }
2868 }
2869 }
2870 }
2871
2872 cookie_len -= SCTP_SIGNATURE_SIZE;
2873 if (*stcb == NULL) {
2874 /* this is the "normal" case... get a new TCB */
2875 *stcb = sctp_process_cookie_new(m, iphlen, offset, src, dst, sh,
2876 cookie, cookie_len, *inp_p,
2877 netp, to, ¬ification,
2878 auth_skipped, auth_offset, auth_len,
2879 #if defined(__FreeBSD__)
2880 mflowtype, mflowid,
2881 #endif
2882 vrf_id, port);
2883 } else {
2884 /* this is abnormal... cookie-echo on existing TCB */
2885 had_a_existing_tcb = 1;
2886 *stcb = sctp_process_cookie_existing(m, iphlen, offset,
2887 src, dst, sh,
2888 cookie, cookie_len, *inp_p, *stcb, netp, to,
2889 ¬ification, auth_skipped, auth_offset, auth_len,
2890 #if defined(__FreeBSD__)
2891 mflowtype, mflowid,
2892 #endif
2893 vrf_id, port);
2894 }
2895
2896 if (*stcb == NULL) {
2897 /* still no TCB... must be bad cookie-echo */
2898 return (NULL);
2899 }
2900 #if defined(__FreeBSD__)
2901 if (*netp != NULL) {
2902 (*netp)->flowtype = mflowtype;
2903 (*netp)->flowid = mflowid;
2904 }
2905 #endif
2906 /*
2907 * Ok, we built an association so confirm the address we sent the
2908 * INIT-ACK to.
2909 */
2910 netl = sctp_findnet(*stcb, to);
2911 /*
2912 * This code should in theory NOT run but
2913 */
2914 if (netl == NULL) {
2915 /* TSNH! Huh, why do I need to add this address here? */
2916 if (sctp_add_remote_addr(*stcb, to, NULL, port,
2917 SCTP_DONOT_SETSCOPE, SCTP_IN_COOKIE_PROC)) {
2918 return (NULL);
2919 }
2920 netl = sctp_findnet(*stcb, to);
2921 }
2922 if (netl) {
2923 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
2924 netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2925 (void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
2926 netl);
2927 send_int_conf = 1;
2928 }
2929 }
2930 sctp_start_net_timers(*stcb);
2931 if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
2932 if (!had_a_existing_tcb ||
2933 (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
2934 /*
2935 * If we have a NEW cookie or the connect never
2936 * reached the connected state during collision we
2937 * must do the TCP accept thing.
2938 */
2939 struct socket *so, *oso;
2940 struct sctp_inpcb *inp;
2941
2942 if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
2943 /*
2944 * For a restart we will keep the same
2945 * socket, no need to do anything. I THINK!!
2946 */
2947 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2948 if (send_int_conf) {
2949 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2950 (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2951 }
2952 return (m);
2953 }
2954 oso = (*inp_p)->sctp_socket;
2955 #if (defined(__FreeBSD__) && __FreeBSD_version < 700000)
2956 /*
2957 * We do this to keep the sockets side happy during
2958 * the sonewcon ONLY.
2959 */
2960 NET_LOCK_GIANT();
2961 #endif
2962 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2963 SCTP_TCB_UNLOCK((*stcb));
2964 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
2965 CURVNET_SET(oso->so_vnet);
2966 #endif
2967 #if defined(__APPLE__)
2968 SCTP_SOCKET_LOCK(oso, 1);
2969 #endif
2970 so = sonewconn(oso, 0
2971 #if defined(__APPLE__)
2972 ,NULL
2973 #endif
2974 #ifdef __Panda__
2975 ,NULL , (*inp_p)->def_vrf_id
2976 #endif
2977 );
2978 #if (defined(__FreeBSD__) && __FreeBSD_version < 700000)
2979 NET_UNLOCK_GIANT();
2980 #endif
2981 #if defined(__APPLE__)
2982 SCTP_SOCKET_UNLOCK(oso, 1);
2983 #endif
2984 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
2985 CURVNET_RESTORE();
2986 #endif
2987 SCTP_TCB_LOCK((*stcb));
2988 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2989
2990 if (so == NULL) {
2991 struct mbuf *op_err;
2992 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2993 struct socket *pcb_so;
2994 #endif
2995 /* Too many sockets */
2996 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
2997 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2998 sctp_abort_association(*inp_p, NULL, m, iphlen,
2999 src, dst, sh, op_err,
3000 #if defined(__FreeBSD__)
3001 mflowtype, mflowid,
3002 #endif
3003 vrf_id, port);
3004 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3005 pcb_so = SCTP_INP_SO(*inp_p);
3006 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
3007 SCTP_TCB_UNLOCK((*stcb));
3008 SCTP_SOCKET_LOCK(pcb_so, 1);
3009 SCTP_TCB_LOCK((*stcb));
3010 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
3011 #endif
3012 (void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC,
3013 SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
3014 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3015 SCTP_SOCKET_UNLOCK(pcb_so, 1);
3016 #endif
3017 return (NULL);
3018 }
3019 inp = (struct sctp_inpcb *)so->so_pcb;
3020 SCTP_INP_INCR_REF(inp);
3021 /*
3022 * We add the unbound flag here so that
3023 * if we get an soabort() before we get the
3024 * move_pcb done, we will properly cleanup.
3025 */
3026 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
3027 SCTP_PCB_FLAGS_CONNECTED |
3028 SCTP_PCB_FLAGS_IN_TCPPOOL |
3029 SCTP_PCB_FLAGS_UNBOUND |
3030 (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
3031 SCTP_PCB_FLAGS_DONT_WAKE);
3032 inp->sctp_features = (*inp_p)->sctp_features;
3033 inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features;
3034 inp->sctp_socket = so;
3035 inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
3036 inp->max_cwnd = (*inp_p)->max_cwnd;
3037 inp->sctp_cmt_on_off = (*inp_p)->sctp_cmt_on_off;
3038 inp->ecn_supported = (*inp_p)->ecn_supported;
3039 inp->prsctp_supported = (*inp_p)->prsctp_supported;
3040 inp->auth_supported = (*inp_p)->auth_supported;
3041 inp->asconf_supported = (*inp_p)->asconf_supported;
3042 inp->reconfig_supported = (*inp_p)->reconfig_supported;
3043 inp->nrsack_supported = (*inp_p)->nrsack_supported;
3044 inp->pktdrop_supported = (*inp_p)->pktdrop_supported;
3045 inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
3046 inp->sctp_context = (*inp_p)->sctp_context;
3047 inp->local_strreset_support = (*inp_p)->local_strreset_support;
3048 inp->fibnum = (*inp_p)->fibnum;
3049 inp->inp_starting_point_for_iterator = NULL;
3050 #if defined(__Userspace__)
3051 inp->ulp_info = (*inp_p)->ulp_info;
3052 inp->recv_callback = (*inp_p)->recv_callback;
3053 inp->send_callback = (*inp_p)->send_callback;
3054 inp->send_sb_threshold = (*inp_p)->send_sb_threshold;
3055 #endif
3056 /*
3057 * copy in the authentication parameters from the
3058 * original endpoint
3059 */
3060 if (inp->sctp_ep.local_hmacs)
3061 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
3062 inp->sctp_ep.local_hmacs =
3063 sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
3064 if (inp->sctp_ep.local_auth_chunks)
3065 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
3066 inp->sctp_ep.local_auth_chunks =
3067 sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
3068
3069 /*
3070 * Now we must move it from one hash table to
3071 * another and get the tcb in the right place.
3072 */
3073
3074 /* This is where the one-2-one socket is put into
3075 * the accept state waiting for the accept!
3076 */
3077 if (*stcb) {
3078 SCTP_ADD_SUBSTATE(*stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
3079 }
3080 sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
3081
3082 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
3083 SCTP_TCB_UNLOCK((*stcb));
3084
3085 #if defined(__FreeBSD__)
3086 sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb,
3087 0);
3088 #else
3089 sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb, M_NOWAIT);
3090 #endif
3091 SCTP_TCB_LOCK((*stcb));
3092 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
3093
3094
3095 /* now we must check to see if we were aborted while
3096 * the move was going on and the lock/unlock happened.
3097 */
3098 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3099 /* yep it was, we leave the
3100 * assoc attached to the socket since
3101 * the sctp_inpcb_free() call will send
3102 * an abort for us.
3103 */
3104 SCTP_INP_DECR_REF(inp);
3105 return (NULL);
3106 }
3107 SCTP_INP_DECR_REF(inp);
3108 /* Switch over to the new guy */
3109 *inp_p = inp;
3110 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
3111 if (send_int_conf) {
3112 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
3113 (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
3114 }
3115
3116 /* Pull it from the incomplete queue and wake the guy */
3117 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3118 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
3119 SCTP_TCB_UNLOCK((*stcb));
3120 SCTP_SOCKET_LOCK(so, 1);
3121 #endif
3122 soisconnected(so);
3123 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3124 SCTP_TCB_LOCK((*stcb));
3125 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
3126 SCTP_SOCKET_UNLOCK(so, 1);
3127 #endif
3128 return (m);
3129 }
3130 }
3131 if (notification) {
3132 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
3133 }
3134 if (send_int_conf) {
3135 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
3136 (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
3137 }
3138 return (m);
3139 }
3140
3141 static void
3142 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp SCTP_UNUSED,
3143 struct sctp_tcb *stcb, struct sctp_nets *net)
3144 {
3145 /* cp must not be used, others call this without a c-ack :-) */
3146 struct sctp_association *asoc;
3147
3148 SCTPDBG(SCTP_DEBUG_INPUT2,
3149 "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
3150 if ((stcb == NULL) || (net == NULL)) {
3151 return;
3152 }
3153
3154 asoc = &stcb->asoc;
3155 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
3156 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
3157 asoc->overall_error_count,
3158 0,
3159 SCTP_FROM_SCTP_INPUT,
3160 __LINE__);
3161 }
3162 asoc->overall_error_count = 0;
3163 sctp_stop_all_cookie_timers(stcb);
3164 /* process according to association state */
3165 if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED) {
3166 /* state change only needed when I am in right state */
3167 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
3168 SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
3169 sctp_start_net_timers(stcb);
3170 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
3171 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
3172 stcb->sctp_ep, stcb, asoc->primary_destination);
3173
3174 }
3175 /* update RTO */
3176 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
3177 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
3178 if (asoc->overall_error_count == 0) {
3179 sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered,
3180 SCTP_RTT_FROM_NON_DATA);
3181 }
3182 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
3183 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
3184 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3185 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3186 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3187 struct socket *so;
3188
3189 #endif
3190 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
3191 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3192 so = SCTP_INP_SO(stcb->sctp_ep);
3193 atomic_add_int(&stcb->asoc.refcnt, 1);
3194 SCTP_TCB_UNLOCK(stcb);
3195 SCTP_SOCKET_LOCK(so, 1);
3196 SCTP_TCB_LOCK(stcb);
3197 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3198 #endif
3199 if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0) {
3200 soisconnected(stcb->sctp_socket);
3201 }
3202 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3203 SCTP_SOCKET_UNLOCK(so, 1);
3204 #endif
3205 }
3206 /*
3207 * since we did not send a HB make sure we don't double
3208 * things
3209 */
3210 net->hb_responded = 1;
3211
3212 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3213 /* We don't need to do the asconf thing,
3214 * nor hb or autoclose if the socket is closed.
3215 */
3216 goto closed_socket;
3217 }
3218
3219 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
3220 stcb, net);
3221
3222
3223 if (stcb->asoc.sctp_autoclose_ticks &&
3224 sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
3225 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
3226 stcb->sctp_ep, stcb, NULL);
3227 }
3228 /*
3229 * send ASCONF if parameters are pending and ASCONFs are
3230 * allowed (eg. addresses changed when init/cookie echo were
3231 * in flight)
3232 */
3233 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
3234 (stcb->asoc.asconf_supported == 1) &&
3235 (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
3236 #ifdef SCTP_TIMER_BASED_ASCONF
3237 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
3238 stcb->sctp_ep, stcb,
3239 stcb->asoc.primary_destination);
3240 #else
3241 sctp_send_asconf(stcb, stcb->asoc.primary_destination,
3242 SCTP_ADDR_NOT_LOCKED);
3243 #endif
3244 }
3245 }
3246 closed_socket:
3247 /* Toss the cookie if I can */
3248 sctp_toss_old_cookies(stcb, asoc);
3249 if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3250 /* Restart the timer if we have pending data */
3251 struct sctp_tmit_chunk *chk;
3252
3253 chk = TAILQ_FIRST(&asoc->sent_queue);
3254 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
3255 }
3256 }
3257
3258 static void
3259 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
3260 struct sctp_tcb *stcb)
3261 {
3262 struct sctp_nets *net;
3263 struct sctp_tmit_chunk *lchk;
3264 struct sctp_ecne_chunk bkup;
3265 uint8_t override_bit;
3266 uint32_t tsn, window_data_tsn;
3267 int len;
3268 unsigned int pkt_cnt;
3269
3270 len = ntohs(cp->ch.chunk_length);
3271 if ((len != sizeof(struct sctp_ecne_chunk)) &&
3272 (len != sizeof(struct old_sctp_ecne_chunk))) {
3273 return;
3274 }
3275 if (len == sizeof(struct old_sctp_ecne_chunk)) {
3276 /* Its the old format */
3277 memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
3278 bkup.num_pkts_since_cwr = htonl(1);
3279 cp = &bkup;
3280 }
3281 SCTP_STAT_INCR(sctps_recvecne);
3282 tsn = ntohl(cp->tsn);
3283 pkt_cnt = ntohl(cp->num_pkts_since_cwr);
3284 lchk = TAILQ_LAST(&stcb->asoc.send_queue, sctpchunk_listhead);
3285 if (lchk == NULL) {
3286 window_data_tsn = stcb->asoc.sending_seq - 1;
3287 } else {
3288 window_data_tsn = lchk->rec.data.tsn;
3289 }
3290
3291 /* Find where it was sent to if possible. */
3292 net = NULL;
3293 TAILQ_FOREACH(lchk, &stcb->asoc.sent_queue, sctp_next) {
3294 if (lchk->rec.data.tsn == tsn) {
3295 net = lchk->whoTo;
3296 net->ecn_prev_cwnd = lchk->rec.data.cwnd_at_send;
3297 break;
3298 }
3299 if (SCTP_TSN_GT(lchk->rec.data.tsn, tsn)) {
3300 break;
3301 }
3302 }
3303 if (net == NULL) {
3304 /*
3305 * What to do. A previous send of a
3306 * CWR was possibly lost. See how old it is, we
3307 * may have it marked on the actual net.
3308 */
3309 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3310 if (tsn == net->last_cwr_tsn) {
3311 /* Found him, send it off */
3312 break;
3313 }
3314 }
3315 if (net == NULL) {
3316 /*
3317 * If we reach here, we need to send a special
3318 * CWR that says hey, we did this a long time
3319 * ago and you lost the response.
3320 */
3321 net = TAILQ_FIRST(&stcb->asoc.nets);
3322 if (net == NULL) {
3323 /* TSNH */
3324 return;
3325 }
3326 override_bit = SCTP_CWR_REDUCE_OVERRIDE;
3327 } else {
3328 override_bit = 0;
3329 }
3330 } else {
3331 override_bit = 0;
3332 }
3333 if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) &&
3334 ((override_bit&SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
3335 /* JRS - Use the congestion control given in the pluggable CC module */
3336 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 0, pkt_cnt);
3337 /*
3338 * We reduce once every RTT. So we will only lower cwnd at
3339 * the next sending seq i.e. the window_data_tsn
3340 */
3341 net->cwr_window_tsn = window_data_tsn;
3342 net->ecn_ce_pkt_cnt += pkt_cnt;
3343 net->lost_cnt = pkt_cnt;
3344 net->last_cwr_tsn = tsn;
3345 } else {
3346 override_bit |= SCTP_CWR_IN_SAME_WINDOW;
3347 if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) &&
3348 ((override_bit&SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
3349 /*
3350 * Another loss in the same window update how
3351 * many marks/packets lost we have had.
3352 */
3353 int cnt = 1;
3354 if (pkt_cnt > net->lost_cnt) {
3355 /* Should be the case */
3356 cnt = (pkt_cnt - net->lost_cnt);
3357 net->ecn_ce_pkt_cnt += cnt;
3358 }
3359 net->lost_cnt = pkt_cnt;
3360 net->last_cwr_tsn = tsn;
3361 /*
3362 * Most CC functions will ignore this call, since we are in-window
3363 * yet of the initial CE the peer saw.
3364 */
3365 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 1, cnt);
3366 }
3367 }
3368 /*
3369 * We always send a CWR this way if our previous one was lost our
3370 * peer will get an update, or if it is not time again to reduce we
3371 * still get the cwr to the peer. Note we set the override when we
3372 * could not find the TSN on the chunk or the destination network.
3373 */
3374 sctp_send_cwr(stcb, net, net->last_cwr_tsn, override_bit);
3375 }
3376
3377 static void
3378 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net)
3379 {
3380 /*
3381 * Here we get a CWR from the peer. We must look in the outqueue and
3382 * make sure that we have a covered ECNE in the control chunk part.
3383 * If so remove it.
3384 */
3385 struct sctp_tmit_chunk *chk, *nchk;
3386 struct sctp_ecne_chunk *ecne;
3387 int override;
3388 uint32_t cwr_tsn;
3389
3390 cwr_tsn = ntohl(cp->tsn);
3391 override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE;
3392 TAILQ_FOREACH_SAFE(chk, &stcb->asoc.control_send_queue, sctp_next, nchk) {
3393 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
3394 continue;
3395 }
3396 if ((override == 0) && (chk->whoTo != net)) {
3397 /* Must be from the right src unless override is set */
3398 continue;
3399 }
3400 ecne = mtod(chk->data, struct sctp_ecne_chunk *);
3401 if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) {
3402 /* this covers this ECNE, we can remove it */
3403 stcb->asoc.ecn_echo_cnt_onq--;
3404 TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
3405 sctp_next);
3406 stcb->asoc.ctrl_queue_cnt--;
3407 sctp_m_freem(chk->data);
3408 chk->data = NULL;
3409 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3410 if (override == 0) {
3411 break;
3412 }
3413 }
3414 }
3415 }
3416
3417 static void
3418 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp SCTP_UNUSED,
3419 struct sctp_tcb *stcb, struct sctp_nets *net)
3420 {
3421 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3422 struct socket *so;
3423 #endif
3424
3425 SCTPDBG(SCTP_DEBUG_INPUT2,
3426 "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
3427 if (stcb == NULL)
3428 return;
3429
3430 /* process according to association state */
3431 if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
3432 /* unexpected SHUTDOWN-COMPLETE... so ignore... */
3433 SCTPDBG(SCTP_DEBUG_INPUT2,
3434 "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n");
3435 SCTP_TCB_UNLOCK(stcb);
3436 return;
3437 }
3438 /* notify upper layer protocol */
3439 if (stcb->sctp_socket) {
3440 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
3441 }
3442 #ifdef INVARIANTS
3443 if (!TAILQ_EMPTY(&stcb->asoc.send_queue) ||
3444 !TAILQ_EMPTY(&stcb->asoc.sent_queue) ||
3445 sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
3446 panic("Queues are not empty when handling SHUTDOWN-COMPLETE");
3447 }
3448 #endif
3449 /* stop the timer */
3450 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net,
3451 SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
3452 SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
3453 /* free the TCB */
3454 SCTPDBG(SCTP_DEBUG_INPUT2,
3455 "sctp_handle_shutdown_complete: calls free-asoc\n");
3456 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3457 so = SCTP_INP_SO(stcb->sctp_ep);
3458 atomic_add_int(&stcb->asoc.refcnt, 1);
3459 SCTP_TCB_UNLOCK(stcb);
3460 SCTP_SOCKET_LOCK(so, 1);
3461 SCTP_TCB_LOCK(stcb);
3462 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3463 #endif
3464 (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
3465 SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
3466 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3467 SCTP_SOCKET_UNLOCK(so, 1);
3468 #endif
3469 return;
3470 }
3471
3472 static int
3473 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
3474 struct sctp_nets *net, uint8_t flg)
3475 {
3476 switch (desc->chunk_type) {
3477 case SCTP_DATA:
3478 /* find the tsn to resend (possibly */
3479 {
3480 uint32_t tsn;
3481 struct sctp_tmit_chunk *tp1;
3482
3483 tsn = ntohl(desc->tsn_ifany);
3484 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3485 if (tp1->rec.data.tsn == tsn) {
3486 /* found it */
3487 break;
3488 }
3489 if (SCTP_TSN_GT(tp1->rec.data.tsn, tsn)) {
3490 /* not found */
3491 tp1 = NULL;
3492 break;
3493 }
3494 }
3495 if (tp1 == NULL) {
3496 /*
3497 * Do it the other way , aka without paying
3498 * attention to queue seq order.
3499 */
3500 SCTP_STAT_INCR(sctps_pdrpdnfnd);
3501 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3502 if (tp1->rec.data.tsn == tsn) {
3503 /* found it */
3504 break;
3505 }
3506 }
3507 }
3508 if (tp1 == NULL) {
3509 SCTP_STAT_INCR(sctps_pdrptsnnf);
3510 }
3511 if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
3512 uint8_t *ddp;
3513
3514 if (((flg & SCTP_BADCRC) == 0) &&
3515 ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3516 return (0);
3517 }
3518 if ((stcb->asoc.peers_rwnd == 0) &&
3519 ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3520 SCTP_STAT_INCR(sctps_pdrpdiwnp);
3521 return (0);
3522 }
3523 if (stcb->asoc.peers_rwnd == 0 &&
3524 (flg & SCTP_FROM_MIDDLE_BOX)) {
3525 SCTP_STAT_INCR(sctps_pdrpdizrw);
3526 return (0);
3527 }
3528 ddp = (uint8_t *) (mtod(tp1->data, caddr_t) +
3529 sizeof(struct sctp_data_chunk));
3530 {
3531 unsigned int iii;
3532
3533 for (iii = 0; iii < sizeof(desc->data_bytes);
3534 iii++) {
3535 if (ddp[iii] != desc->data_bytes[iii]) {
3536 SCTP_STAT_INCR(sctps_pdrpbadd);
3537 return (-1);
3538 }
3539 }
3540 }
3541
3542 if (tp1->do_rtt) {
3543 /*
3544 * this guy had a RTO calculation
3545 * pending on it, cancel it
3546 */
3547 if (tp1->whoTo->rto_needed == 0) {
3548 tp1->whoTo->rto_needed = 1;
3549 }
3550 tp1->do_rtt = 0;
3551 }
3552 SCTP_STAT_INCR(sctps_pdrpmark);
3553 if (tp1->sent != SCTP_DATAGRAM_RESEND)
3554 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3555 /*
3556 * mark it as if we were doing a FR, since
3557 * we will be getting gap ack reports behind
3558 * the info from the router.
3559 */
3560 tp1->rec.data.doing_fast_retransmit = 1;
3561 /*
3562 * mark the tsn with what sequences can
3563 * cause a new FR.
3564 */
3565 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
3566 tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
3567 } else {
3568 tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.tsn;
3569 }
3570
3571 /* restart the timer */
3572 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3573 stcb, tp1->whoTo,
3574 SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
3575 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3576 stcb, tp1->whoTo);
3577
3578 /* fix counts and things */
3579 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3580 sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
3581 tp1->whoTo->flight_size,
3582 tp1->book_size,
3583 (uint32_t)(uintptr_t)stcb,
3584 tp1->rec.data.tsn);
3585 }
3586 if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3587 sctp_flight_size_decrease(tp1);
3588 sctp_total_flight_decrease(stcb, tp1);
3589 }
3590 tp1->sent = SCTP_DATAGRAM_RESEND;
3591 } {
3592 /* audit code */
3593 unsigned int audit;
3594
3595 audit = 0;
3596 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3597 if (tp1->sent == SCTP_DATAGRAM_RESEND)
3598 audit++;
3599 }
3600 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
3601 sctp_next) {
3602 if (tp1->sent == SCTP_DATAGRAM_RESEND)
3603 audit++;
3604 }
3605 if (audit != stcb->asoc.sent_queue_retran_cnt) {
3606 SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
3607 audit, stcb->asoc.sent_queue_retran_cnt);
3608 #ifndef SCTP_AUDITING_ENABLED
3609 stcb->asoc.sent_queue_retran_cnt = audit;
3610 #endif
3611 }
3612 }
3613 }
3614 break;
3615 case SCTP_ASCONF:
3616 {
3617 struct sctp_tmit_chunk *asconf;
3618
3619 TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
3620 sctp_next) {
3621 if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
3622 break;
3623 }
3624 }
3625 if (asconf) {
3626 if (asconf->sent != SCTP_DATAGRAM_RESEND)
3627 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3628 asconf->sent = SCTP_DATAGRAM_RESEND;
3629 asconf->snd_count--;
3630 }
3631 }
3632 break;
3633 case SCTP_INITIATION:
3634 /* resend the INIT */
3635 stcb->asoc.dropped_special_cnt++;
3636 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
3637 /*
3638 * If we can get it in, in a few attempts we do
3639 * this, otherwise we let the timer fire.
3640 */
3641 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
3642 stcb, net,
3643 SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
3644 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
3645 }
3646 break;
3647 case SCTP_SELECTIVE_ACK:
3648 case SCTP_NR_SELECTIVE_ACK:
3649 /* resend the sack */
3650 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
3651 break;
3652 case SCTP_HEARTBEAT_REQUEST:
3653 /* resend a demand HB */
3654 if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) {
3655 /* Only retransmit if we KNOW we wont destroy the tcb */
3656 sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
3657 }
3658 break;
3659 case SCTP_SHUTDOWN:
3660 sctp_send_shutdown(stcb, net);
3661 break;
3662 case SCTP_SHUTDOWN_ACK:
3663 sctp_send_shutdown_ack(stcb, net);
3664 break;
3665 case SCTP_COOKIE_ECHO:
3666 {
3667 struct sctp_tmit_chunk *cookie;
3668
3669 cookie = NULL;
3670 TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
3671 sctp_next) {
3672 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
3673 break;
3674 }
3675 }
3676 if (cookie) {
3677 if (cookie->sent != SCTP_DATAGRAM_RESEND)
3678 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3679 cookie->sent = SCTP_DATAGRAM_RESEND;
3680 sctp_stop_all_cookie_timers(stcb);
3681 }
3682 }
3683 break;
3684 case SCTP_COOKIE_ACK:
3685 sctp_send_cookie_ack(stcb);
3686 break;
3687 case SCTP_ASCONF_ACK:
3688 /* resend last asconf ack */
3689 sctp_send_asconf_ack(stcb);
3690 break;
3691 case SCTP_IFORWARD_CUM_TSN:
3692 case SCTP_FORWARD_CUM_TSN:
3693 send_forward_tsn(stcb, &stcb->asoc);
3694 break;
3695 /* can't do anything with these */
3696 case SCTP_PACKET_DROPPED:
3697 case SCTP_INITIATION_ACK: /* this should not happen */
3698 case SCTP_HEARTBEAT_ACK:
3699 case SCTP_ABORT_ASSOCIATION:
3700 case SCTP_OPERATION_ERROR:
3701 case SCTP_SHUTDOWN_COMPLETE:
3702 case SCTP_ECN_ECHO:
3703 case SCTP_ECN_CWR:
3704 default:
3705 break;
3706 }
3707 return (0);
3708 }
3709
3710 void
3711 sctp_reset_in_stream(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
3712 {
3713 uint32_t i;
3714 uint16_t temp;
3715
3716 /*
3717 * We set things to 0xffffffff since this is the last delivered sequence
3718 * and we will be sending in 0 after the reset.
3719 */
3720
3721 if (number_entries) {
3722 for (i = 0; i < number_entries; i++) {
3723 temp = ntohs(list[i]);
3724 if (temp >= stcb->asoc.streamincnt) {
3725 continue;
3726 }
3727 stcb->asoc.strmin[temp].last_mid_delivered = 0xffffffff;
3728 }
3729 } else {
3730 list = NULL;
3731 for (i = 0; i < stcb->asoc.streamincnt; i++) {
3732 stcb->asoc.strmin[i].last_mid_delivered = 0xffffffff;
3733 }
3734 }
3735 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3736 }
3737
3738 static void
3739 sctp_reset_out_streams(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
3740 {
3741 uint32_t i;
3742 uint16_t temp;
3743
3744 if (number_entries > 0) {
3745 for (i = 0; i < number_entries; i++) {
3746 temp = ntohs(list[i]);
3747 if (temp >= stcb->asoc.streamoutcnt) {
3748 /* no such stream */
3749 continue;
3750 }
3751 stcb->asoc.strmout[temp].next_mid_ordered = 0;
3752 stcb->asoc.strmout[temp].next_mid_unordered = 0;
3753 }
3754 } else {
3755 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3756 stcb->asoc.strmout[i].next_mid_ordered = 0;
3757 stcb->asoc.strmout[i].next_mid_unordered = 0;
3758 }
3759 }
3760 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3761 }
3762
3763 static void
3764 sctp_reset_clear_pending(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
3765 {
3766 uint32_t i;
3767 uint16_t temp;
3768
3769 if (number_entries > 0) {
3770 for (i = 0; i < number_entries; i++) {
3771 temp = ntohs(list[i]);
3772 if (temp >= stcb->asoc.streamoutcnt) {
3773 /* no such stream */
3774 continue;
3775 }
3776 stcb->asoc.strmout[temp].state = SCTP_STREAM_OPEN;
3777 }
3778 } else {
3779 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3780 stcb->asoc.strmout[i].state = SCTP_STREAM_OPEN;
3781 }
3782 }
3783 }
3784
3785
3786 struct sctp_stream_reset_request *
3787 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
3788 {
3789 struct sctp_association *asoc;
3790 struct sctp_chunkhdr *ch;
3791 struct sctp_stream_reset_request *r;
3792 struct sctp_tmit_chunk *chk;
3793 int len, clen;
3794
3795 asoc = &stcb->asoc;
3796 if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
3797 asoc->stream_reset_outstanding = 0;
3798 return (NULL);
3799 }
3800 if (stcb->asoc.str_reset == NULL) {
3801 asoc->stream_reset_outstanding = 0;
3802 return (NULL);
3803 }
3804 chk = stcb->asoc.str_reset;
3805 if (chk->data == NULL) {
3806 return (NULL);
3807 }
3808 if (bchk) {
3809 /* he wants a copy of the chk pointer */
3810 *bchk = chk;
3811 }
3812 clen = chk->send_size;
3813 ch = mtod(chk->data, struct sctp_chunkhdr *);
3814 r = (struct sctp_stream_reset_request *)(ch + 1);
3815 if (ntohl(r->request_seq) == seq) {
3816 /* found it */
3817 return (r);
3818 }
3819 len = SCTP_SIZE32(ntohs(r->ph.param_length));
3820 if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
3821 /* move to the next one, there can only be a max of two */
3822 r = (struct sctp_stream_reset_request *)((caddr_t)r + len);
3823 if (ntohl(r->request_seq) == seq) {
3824 return (r);
3825 }
3826 }
3827 /* that seq is not here */
3828 return (NULL);
3829 }
3830
3831 static void
3832 sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
3833 {
3834 struct sctp_association *asoc;
3835 struct sctp_tmit_chunk *chk;
3836
3837 asoc = &stcb->asoc;
3838 chk = asoc->str_reset;
3839 if (chk == NULL) {
3840 return;
3841 }
3842 asoc->str_reset = NULL;
3843 sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb,
3844 chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28);
3845 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
3846 asoc->ctrl_queue_cnt--;
3847 if (chk->data) {
3848 sctp_m_freem(chk->data);
3849 chk->data = NULL;
3850 }
3851 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3852 }
3853
3854
3855 static int
3856 sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
3857 uint32_t seq, uint32_t action,
3858 struct sctp_stream_reset_response *respin)
3859 {
3860 uint16_t type;
3861 int lparam_len;
3862 struct sctp_association *asoc = &stcb->asoc;
3863 struct sctp_tmit_chunk *chk;
3864 struct sctp_stream_reset_request *req_param;
3865 struct sctp_stream_reset_out_request *req_out_param;
3866 struct sctp_stream_reset_in_request *req_in_param;
3867 uint32_t number_entries;
3868
3869 if (asoc->stream_reset_outstanding == 0) {
3870 /* duplicate */
3871 return (0);
3872 }
3873 if (seq == stcb->asoc.str_reset_seq_out) {
3874 req_param = sctp_find_stream_reset(stcb, seq, &chk);
3875 if (req_param != NULL) {
3876 stcb->asoc.str_reset_seq_out++;
3877 type = ntohs(req_param->ph.param_type);
3878 lparam_len = ntohs(req_param->ph.param_length);
3879 if (type == SCTP_STR_RESET_OUT_REQUEST) {
3880 int no_clear = 0;
3881
3882 req_out_param = (struct sctp_stream_reset_out_request *)req_param;
3883 number_entries = (lparam_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
3884 asoc->stream_reset_out_is_outstanding = 0;
3885 if (asoc->stream_reset_outstanding)
3886 asoc->stream_reset_outstanding--;
3887 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3888 /* do it */
3889 sctp_reset_out_streams(stcb, number_entries, req_out_param->list_of_streams);
3890 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3891 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3892 } else if (action == SCTP_STREAM_RESET_RESULT_IN_PROGRESS) {
3893 /* Set it up so we don't stop retransmitting */
3894 asoc->stream_reset_outstanding++;
3895 stcb->asoc.str_reset_seq_out--;
3896 asoc->stream_reset_out_is_outstanding = 1;
3897 no_clear = 1;
3898 } else {
3899 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3900 }
3901 if (no_clear == 0) {
3902 sctp_reset_clear_pending(stcb, number_entries, req_out_param->list_of_streams);
3903 }
3904 } else if (type == SCTP_STR_RESET_IN_REQUEST) {
3905 req_in_param = (struct sctp_stream_reset_in_request *)req_param;
3906 number_entries = (lparam_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
3907 if (asoc->stream_reset_outstanding)
3908 asoc->stream_reset_outstanding--;
3909 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3910 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_IN, stcb,
3911 number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3912 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3913 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb,
3914 number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3915 }
3916 } else if (type == SCTP_STR_RESET_ADD_OUT_STREAMS) {
3917 /* Ok we now may have more streams */
3918 int num_stream;
3919
3920 num_stream = stcb->asoc.strm_pending_add_size;
3921 if (num_stream > (stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt)) {
3922 /* TSNH */
3923 num_stream = stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt;
3924 }
3925 stcb->asoc.strm_pending_add_size = 0;
3926 if (asoc->stream_reset_outstanding)
3927 asoc->stream_reset_outstanding--;
3928 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3929 /* Put the new streams into effect */
3930 int i;
3931 for ( i = asoc->streamoutcnt; i< (asoc->streamoutcnt + num_stream); i++) {
3932 asoc->strmout[i].state = SCTP_STREAM_OPEN;
3933 }
3934 asoc->streamoutcnt += num_stream;
3935 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
3936 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3937 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3938 SCTP_STREAM_CHANGE_DENIED);
3939 } else {
3940 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3941 SCTP_STREAM_CHANGE_FAILED);
3942 }
3943 } else if (type == SCTP_STR_RESET_ADD_IN_STREAMS) {
3944 if (asoc->stream_reset_outstanding)
3945 asoc->stream_reset_outstanding--;
3946 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3947 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3948 SCTP_STREAM_CHANGE_DENIED);
3949 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3950 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3951 SCTP_STREAM_CHANGE_FAILED);
3952 }
3953 } else if (type == SCTP_STR_RESET_TSN_REQUEST) {
3954 /**
3955 * a) Adopt the new in tsn.
3956 * b) reset the map
3957 * c) Adopt the new out-tsn
3958 */
3959 struct sctp_stream_reset_response_tsn *resp;
3960 struct sctp_forward_tsn_chunk fwdtsn;
3961 int abort_flag = 0;
3962 if (respin == NULL) {
3963 /* huh ? */
3964 return (0);
3965 }
3966 if (ntohs(respin->ph.param_length) < sizeof(struct sctp_stream_reset_response_tsn)) {
3967 return (0);
3968 }
3969 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3970 resp = (struct sctp_stream_reset_response_tsn *)respin;
3971 asoc->stream_reset_outstanding--;
3972 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3973 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3974 fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
3975 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3976 if (abort_flag) {
3977 return (1);
3978 }
3979 stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
3980 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3981 sctp_log_map(0, 7, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3982 }
3983
3984 stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
3985 stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
3986 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
3987
3988 stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map;
3989 memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
3990
3991 stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
3992 stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
3993
3994 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3995 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3996 sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 0);
3997 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3998 sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3999 SCTP_ASSOC_RESET_DENIED);
4000 } else {
4001 sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
4002 SCTP_ASSOC_RESET_FAILED);
4003 }
4004 }
4005 /* get rid of the request and get the request flags */
4006 if (asoc->stream_reset_outstanding == 0) {
4007 sctp_clean_up_stream_reset(stcb);
4008 }
4009 }
4010 }
4011 if (asoc->stream_reset_outstanding == 0) {
4012 sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
4013 }
4014 return (0);
4015 }
4016
4017 static void
4018 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
4019 struct sctp_tmit_chunk *chk,
4020 struct sctp_stream_reset_in_request *req, int trunc)
4021 {
4022 uint32_t seq;
4023 int len, i;
4024 int number_entries;
4025 uint16_t temp;
4026
4027 /*
4028 * peer wants me to send a str-reset to him for my outgoing seq's if
4029 * seq_in is right.
4030 */
4031 struct sctp_association *asoc = &stcb->asoc;
4032
4033 seq = ntohl(req->request_seq);
4034 if (asoc->str_reset_seq_in == seq) {
4035 asoc->last_reset_action[1] = asoc->last_reset_action[0];
4036 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
4037 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4038 } else if (trunc) {
4039 /* Can't do it, since they exceeded our buffer size */
4040 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4041 } else if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
4042 len = ntohs(req->ph.param_length);
4043 number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
4044 if (number_entries) {
4045 for (i = 0; i < number_entries; i++) {
4046 temp = ntohs(req->list_of_streams[i]);
4047 if (temp >= stcb->asoc.streamoutcnt) {
4048 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4049 goto bad_boy;
4050 }
4051 req->list_of_streams[i] = temp;
4052 }
4053 for (i = 0; i < number_entries; i++) {
4054 if (stcb->asoc.strmout[req->list_of_streams[i]].state == SCTP_STREAM_OPEN) {
4055 stcb->asoc.strmout[req->list_of_streams[i]].state = SCTP_STREAM_RESET_PENDING;
4056 }
4057 }
4058 } else {
4059 /* Its all */
4060 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
4061 if (stcb->asoc.strmout[i].state == SCTP_STREAM_OPEN)
4062 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_PENDING;
4063 }
4064 }
4065 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4066 } else {
4067 /* Can't do it, since we have sent one out */
4068 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
4069 }
4070 bad_boy:
4071 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4072 asoc->str_reset_seq_in++;
4073 } else if (asoc->str_reset_seq_in - 1 == seq) {
4074 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4075 } else if (asoc->str_reset_seq_in - 2 == seq) {
4076 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4077 } else {
4078 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4079 }
4080 sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
4081 }
4082
4083 static int
4084 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
4085 struct sctp_tmit_chunk *chk,
4086 struct sctp_stream_reset_tsn_request *req)
4087 {
4088 /* reset all in and out and update the tsn */
4089 /*
4090 * A) reset my str-seq's on in and out. B) Select a receive next,
4091 * and set cum-ack to it. Also process this selected number as a
4092 * fwd-tsn as well. C) set in the response my next sending seq.
4093 */
4094 struct sctp_forward_tsn_chunk fwdtsn;
4095 struct sctp_association *asoc = &stcb->asoc;
4096 int abort_flag = 0;
4097 uint32_t seq;
4098
4099 seq = ntohl(req->request_seq);
4100 if (asoc->str_reset_seq_in == seq) {
4101 asoc->last_reset_action[1] = stcb->asoc.last_reset_action[0];
4102 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
4103 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4104 } else {
4105 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
4106 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
4107 fwdtsn.ch.chunk_flags = 0;
4108 fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
4109 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
4110 if (abort_flag) {
4111 return (1);
4112 }
4113 asoc->highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
4114 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
4115 sctp_log_map(0, 10, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
4116 }
4117 asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
4118 asoc->mapping_array_base_tsn = asoc->highest_tsn_inside_map + 1;
4119 memset(asoc->mapping_array, 0, asoc->mapping_array_size);
4120 asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
4121 memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
4122 atomic_add_int(&asoc->sending_seq, 1);
4123 /* save off historical data for retrans */
4124 asoc->last_sending_seq[1] = asoc->last_sending_seq[0];
4125 asoc->last_sending_seq[0] = asoc->sending_seq;
4126 asoc->last_base_tsnsent[1] = asoc->last_base_tsnsent[0];
4127 asoc->last_base_tsnsent[0] = asoc->mapping_array_base_tsn;
4128 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
4129 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
4130 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4131 sctp_notify_stream_reset_tsn(stcb, asoc->sending_seq, (asoc->mapping_array_base_tsn + 1), 0);
4132 }
4133 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
4134 asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
4135 asoc->str_reset_seq_in++;
4136 } else if (asoc->str_reset_seq_in - 1 == seq) {
4137 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
4138 asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
4139 } else if (asoc->str_reset_seq_in - 2 == seq) {
4140 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
4141 asoc->last_sending_seq[1], asoc->last_base_tsnsent[1]);
4142 } else {
4143 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4144 }
4145 return (0);
4146 }
4147
4148 static void
4149 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
4150 struct sctp_tmit_chunk *chk,
4151 struct sctp_stream_reset_out_request *req, int trunc)
4152 {
4153 uint32_t seq, tsn;
4154 int number_entries, len;
4155 struct sctp_association *asoc = &stcb->asoc;
4156
4157 seq = ntohl(req->request_seq);
4158
4159 /* now if its not a duplicate we process it */
4160 if (asoc->str_reset_seq_in == seq) {
4161 len = ntohs(req->ph.param_length);
4162 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
4163 /*
4164 * the sender is resetting, handle the list issue.. we must
4165 * a) verify if we can do the reset, if so no problem b) If
4166 * we can't do the reset we must copy the request. c) queue
4167 * it, and setup the data in processor to trigger it off
4168 * when needed and dequeue all the queued data.
4169 */
4170 tsn = ntohl(req->send_reset_at_tsn);
4171
4172 /* move the reset action back one */
4173 asoc->last_reset_action[1] = asoc->last_reset_action[0];
4174 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
4175 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4176 } else if (trunc) {
4177 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4178 } else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
4179 /* we can do it now */
4180 sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
4181 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4182 } else {
4183 /*
4184 * we must queue it up and thus wait for the TSN's
4185 * to arrive that are at or before tsn
4186 */
4187 struct sctp_stream_reset_list *liste;
4188 int siz;
4189
4190 siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
4191 SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
4192 siz, SCTP_M_STRESET);
4193 if (liste == NULL) {
4194 /* gak out of memory */
4195 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4196 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4197 return;
4198 }
4199 liste->seq = seq;
4200 liste->tsn = tsn;
4201 liste->number_entries = number_entries;
4202 memcpy(&liste->list_of_streams, req->list_of_streams, number_entries * sizeof(uint16_t));
4203 TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
4204 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_IN_PROGRESS;
4205 }
4206 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4207 asoc->str_reset_seq_in++;
4208 } else if ((asoc->str_reset_seq_in - 1) == seq) {
4209 /*
4210 * one seq back, just echo back last action since my
4211 * response was lost.
4212 */
4213 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4214 } else if ((asoc->str_reset_seq_in - 2) == seq) {
4215 /*
4216 * two seq back, just echo back last action since my
4217 * response was lost.
4218 */
4219 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4220 } else {
4221 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4222 }
4223 }
4224
4225 static void
4226 sctp_handle_str_reset_add_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
4227 struct sctp_stream_reset_add_strm *str_add)
4228 {
4229 /*
4230 * Peer is requesting to add more streams.
4231 * If its within our max-streams we will
4232 * allow it.
4233 */
4234 uint32_t num_stream, i;
4235 uint32_t seq;
4236 struct sctp_association *asoc = &stcb->asoc;
4237 struct sctp_queued_to_read *ctl, *nctl;
4238
4239 /* Get the number. */
4240 seq = ntohl(str_add->request_seq);
4241 num_stream = ntohs(str_add->number_of_streams);
4242 /* Now what would be the new total? */
4243 if (asoc->str_reset_seq_in == seq) {
4244 num_stream += stcb->asoc.streamincnt;
4245 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
4246 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
4247 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4248 } else if ((num_stream > stcb->asoc.max_inbound_streams) ||
4249 (num_stream > 0xffff)) {
4250 /* We must reject it they ask for to many */
4251 denied:
4252 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4253 } else {
4254 /* Ok, we can do that :-) */
4255 struct sctp_stream_in *oldstrm;
4256
4257 /* save off the old */
4258 oldstrm = stcb->asoc.strmin;
4259 SCTP_MALLOC(stcb->asoc.strmin, struct sctp_stream_in *,
4260 (num_stream * sizeof(struct sctp_stream_in)),
4261 SCTP_M_STRMI);
4262 if (stcb->asoc.strmin == NULL) {
4263 stcb->asoc.strmin = oldstrm;
4264 goto denied;
4265 }
4266 /* copy off the old data */
4267 for (i = 0; i < stcb->asoc.streamincnt; i++) {
4268 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
4269 TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
4270 stcb->asoc.strmin[i].sid = i;
4271 stcb->asoc.strmin[i].last_mid_delivered = oldstrm[i].last_mid_delivered;
4272 stcb->asoc.strmin[i].delivery_started = oldstrm[i].delivery_started;
4273 stcb->asoc.strmin[i].pd_api_started = oldstrm[i].pd_api_started;
4274 /* now anything on those queues? */
4275 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].inqueue, next_instrm, nctl) {
4276 TAILQ_REMOVE(&oldstrm[i].inqueue, ctl, next_instrm);
4277 TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].inqueue, ctl, next_instrm);
4278 }
4279 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].uno_inqueue, next_instrm, nctl) {
4280 TAILQ_REMOVE(&oldstrm[i].uno_inqueue, ctl, next_instrm);
4281 TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].uno_inqueue, ctl, next_instrm);
4282 }
4283 }
4284 /* Init the new streams */
4285 for (i = stcb->asoc.streamincnt; i < num_stream; i++) {
4286 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
4287 TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
4288 stcb->asoc.strmin[i].sid = i;
4289 stcb->asoc.strmin[i].last_mid_delivered = 0xffffffff;
4290 stcb->asoc.strmin[i].pd_api_started = 0;
4291 stcb->asoc.strmin[i].delivery_started = 0;
4292 }
4293 SCTP_FREE(oldstrm, SCTP_M_STRMI);
4294 /* update the size */
4295 stcb->asoc.streamincnt = num_stream;
4296 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4297 sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
4298 }
4299 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4300 asoc->str_reset_seq_in++;
4301 } else if ((asoc->str_reset_seq_in - 1) == seq) {
4302 /*
4303 * one seq back, just echo back last action since my
4304 * response was lost.
4305 */
4306 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4307 } else if ((asoc->str_reset_seq_in - 2) == seq) {
4308 /*
4309 * two seq back, just echo back last action since my
4310 * response was lost.
4311 */
4312 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4313 } else {
4314 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4315
4316 }
4317 }
4318
4319 static void
4320 sctp_handle_str_reset_add_out_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
4321 struct sctp_stream_reset_add_strm *str_add)
4322 {
4323 /*
4324 * Peer is requesting to add more streams.
4325 * If its within our max-streams we will
4326 * allow it.
4327 */
4328 uint16_t num_stream;
4329 uint32_t seq;
4330 struct sctp_association *asoc = &stcb->asoc;
4331
4332 /* Get the number. */
4333 seq = ntohl(str_add->request_seq);
4334 num_stream = ntohs(str_add->number_of_streams);
4335 /* Now what would be the new total? */
4336 if (asoc->str_reset_seq_in == seq) {
4337 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
4338 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
4339 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4340 } else if (stcb->asoc.stream_reset_outstanding) {
4341 /* We must reject it we have something pending */
4342 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
4343 } else {
4344 /* Ok, we can do that :-) */
4345 int mychk;
4346 mychk = stcb->asoc.streamoutcnt;
4347 mychk += num_stream;
4348 if (mychk < 0x10000) {
4349 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4350 if (sctp_send_str_reset_req(stcb, 0, NULL, 0, 0, 1, num_stream, 0, 1)) {
4351 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4352 }
4353 } else {
4354 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4355 }
4356 }
4357 sctp_add_stream_reset_result(chk, seq, stcb->asoc.last_reset_action[0]);
4358 asoc->str_reset_seq_in++;
4359 } else if ((asoc->str_reset_seq_in - 1) == seq) {
4360 /*
4361 * one seq back, just echo back last action since my
4362 * response was lost.
4363 */
4364 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4365 } else if ((asoc->str_reset_seq_in - 2) == seq) {
4366 /*
4367 * two seq back, just echo back last action since my
4368 * response was lost.
4369 */
4370 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4371 } else {
4372 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4373 }
4374 }
4375
4376 #if !defined(__Panda__)
4377 #ifdef __GNUC__
4378 __attribute__ ((noinline))
4379 #endif
4380 #endif
4381 static int
4382 sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset,
4383 struct sctp_chunkhdr *ch_req)
4384 {
4385 uint16_t remaining_length, param_len, ptype;
4386 struct sctp_paramhdr pstore;
4387 uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE];
4388 uint32_t seq = 0;
4389 int num_req = 0;
4390 int trunc = 0;
4391 struct sctp_tmit_chunk *chk;
4392 struct sctp_chunkhdr *ch;
4393 struct sctp_paramhdr *ph;
4394 int ret_code = 0;
4395 int num_param = 0;
4396
4397 /* now it may be a reset or a reset-response */
4398 remaining_length = ntohs(ch_req->chunk_length) - sizeof(struct sctp_chunkhdr);
4399
4400 /* setup for adding the response */
4401 sctp_alloc_a_chunk(stcb, chk);
4402 if (chk == NULL) {
4403 return (ret_code);
4404 }
4405 chk->copy_by_ref = 0;
4406 chk->rec.chunk_id.id = SCTP_STREAM_RESET;
4407 chk->rec.chunk_id.can_take_data = 0;
4408 chk->flags = 0;
4409 chk->asoc = &stcb->asoc;
4410 chk->no_fr_allowed = 0;
4411 chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
4412 chk->book_size_scale = 0;
4413 chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
4414 if (chk->data == NULL) {
4415 strres_nochunk:
4416 if (chk->data) {
4417 sctp_m_freem(chk->data);
4418 chk->data = NULL;
4419 }
4420 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
4421 return (ret_code);
4422 }
4423 SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
4424
4425 /* setup chunk parameters */
4426 chk->sent = SCTP_DATAGRAM_UNSENT;
4427 chk->snd_count = 0;
4428 chk->whoTo = NULL;
4429
4430 ch = mtod(chk->data, struct sctp_chunkhdr *);
4431 ch->chunk_type = SCTP_STREAM_RESET;
4432 ch->chunk_flags = 0;
4433 ch->chunk_length = htons(chk->send_size);
4434 SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
4435 offset += sizeof(struct sctp_chunkhdr);
4436 while (remaining_length >= sizeof(struct sctp_paramhdr)) {
4437 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *)&pstore);
4438 if (ph == NULL) {
4439 /* TSNH */
4440 break;
4441 }
4442 param_len = ntohs(ph->param_length);
4443 if ((param_len > remaining_length) ||
4444 (param_len < (sizeof(struct sctp_paramhdr) + sizeof(uint32_t)))) {
4445 /* bad parameter length */
4446 break;
4447 }
4448 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, sizeof(cstore)),
4449 (uint8_t *)&cstore);
4450 if (ph == NULL) {
4451 /* TSNH */
4452 break;
4453 }
4454 ptype = ntohs(ph->param_type);
4455 num_param++;
4456 if (param_len > sizeof(cstore)) {
4457 trunc = 1;
4458 } else {
4459 trunc = 0;
4460 }
4461 if (num_param > SCTP_MAX_RESET_PARAMS) {
4462 /* hit the max of parameters already sorry.. */
4463 break;
4464 }
4465 if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
4466 struct sctp_stream_reset_out_request *req_out;
4467
4468 if (param_len < sizeof(struct sctp_stream_reset_out_request)) {
4469 break;
4470 }
4471 req_out = (struct sctp_stream_reset_out_request *)ph;
4472 num_req++;
4473 if (stcb->asoc.stream_reset_outstanding) {
4474 seq = ntohl(req_out->response_seq);
4475 if (seq == stcb->asoc.str_reset_seq_out) {
4476 /* implicit ack */
4477 (void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_RESULT_PERFORMED, NULL);
4478 }
4479 }
4480 sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc);
4481 } else if (ptype == SCTP_STR_RESET_ADD_OUT_STREAMS) {
4482 struct sctp_stream_reset_add_strm *str_add;
4483
4484 if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
4485 break;
4486 }
4487 str_add = (struct sctp_stream_reset_add_strm *)ph;
4488 num_req++;
4489 sctp_handle_str_reset_add_strm(stcb, chk, str_add);
4490 } else if (ptype == SCTP_STR_RESET_ADD_IN_STREAMS) {
4491 struct sctp_stream_reset_add_strm *str_add;
4492
4493 if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
4494 break;
4495 }
4496 str_add = (struct sctp_stream_reset_add_strm *)ph;
4497 num_req++;
4498 sctp_handle_str_reset_add_out_strm(stcb, chk, str_add);
4499 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
4500 struct sctp_stream_reset_in_request *req_in;
4501
4502 num_req++;
4503 req_in = (struct sctp_stream_reset_in_request *)ph;
4504 sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc);
4505 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
4506 struct sctp_stream_reset_tsn_request *req_tsn;
4507
4508 num_req++;
4509 req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
4510 if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
4511 ret_code = 1;
4512 goto strres_nochunk;
4513 }
4514 /* no more */
4515 break;
4516 } else if (ptype == SCTP_STR_RESET_RESPONSE) {
4517 struct sctp_stream_reset_response *resp;
4518 uint32_t result;
4519
4520 if (param_len < sizeof(struct sctp_stream_reset_response)) {
4521 break;
4522 }
4523 resp = (struct sctp_stream_reset_response *)ph;
4524 seq = ntohl(resp->response_seq);
4525 result = ntohl(resp->result);
4526 if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
4527 ret_code = 1;
4528 goto strres_nochunk;
4529 }
4530 } else {
4531 break;
4532 }
4533 offset += SCTP_SIZE32(param_len);
4534 if (remaining_length >= SCTP_SIZE32(param_len)) {
4535 remaining_length -= SCTP_SIZE32(param_len);
4536 } else {
4537 remaining_length = 0;
4538 }
4539 }
4540 if (num_req == 0) {
4541 /* we have no response free the stuff */
4542 goto strres_nochunk;
4543 }
4544 /* ok we have a chunk to link in */
4545 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
4546 chk,
4547 sctp_next);
4548 stcb->asoc.ctrl_queue_cnt++;
4549 return (ret_code);
4550 }
4551
4552 /*
4553 * Handle a router or endpoints report of a packet loss, there are two ways
4554 * to handle this, either we get the whole packet and must disect it
4555 * ourselves (possibly with truncation and or corruption) or it is a summary
4556 * from a middle box that did the disectting for us.
4557 */
4558 static void
4559 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
4560 struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
4561 {
4562 uint32_t bottle_bw, on_queue;
4563 uint16_t trunc_len;
4564 unsigned int chlen;
4565 unsigned int at;
4566 struct sctp_chunk_desc desc;
4567 struct sctp_chunkhdr *ch;
4568
4569 chlen = ntohs(cp->ch.chunk_length);
4570 chlen -= sizeof(struct sctp_pktdrop_chunk);
4571 /* XXX possible chlen underflow */
4572 if (chlen == 0) {
4573 ch = NULL;
4574 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
4575 SCTP_STAT_INCR(sctps_pdrpbwrpt);
4576 } else {
4577 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
4578 chlen -= sizeof(struct sctphdr);
4579 /* XXX possible chlen underflow */
4580 memset(&desc, 0, sizeof(desc));
4581 }
4582 trunc_len = (uint16_t) ntohs(cp->trunc_len);
4583 if (trunc_len > limit) {
4584 trunc_len = limit;
4585 }
4586
4587 /* now the chunks themselves */
4588 while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
4589 desc.chunk_type = ch->chunk_type;
4590 /* get amount we need to move */
4591 at = ntohs(ch->chunk_length);
4592 if (at < sizeof(struct sctp_chunkhdr)) {
4593 /* corrupt chunk, maybe at the end? */
4594 SCTP_STAT_INCR(sctps_pdrpcrupt);
4595 break;
4596 }
4597 if (trunc_len == 0) {
4598 /* we are supposed to have all of it */
4599 if (at > chlen) {
4600 /* corrupt skip it */
4601 SCTP_STAT_INCR(sctps_pdrpcrupt);
4602 break;
4603 }
4604 } else {
4605 /* is there enough of it left ? */
4606 if (desc.chunk_type == SCTP_DATA) {
4607 if (chlen < (sizeof(struct sctp_data_chunk) +
4608 sizeof(desc.data_bytes))) {
4609 break;
4610 }
4611 } else {
4612 if (chlen < sizeof(struct sctp_chunkhdr)) {
4613 break;
4614 }
4615 }
4616 }
4617 if (desc.chunk_type == SCTP_DATA) {
4618 /* can we get out the tsn? */
4619 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
4620 SCTP_STAT_INCR(sctps_pdrpmbda);
4621
4622 if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
4623 /* yep */
4624 struct sctp_data_chunk *dcp;
4625 uint8_t *ddp;
4626 unsigned int iii;
4627
4628 dcp = (struct sctp_data_chunk *)ch;
4629 ddp = (uint8_t *) (dcp + 1);
4630 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
4631 desc.data_bytes[iii] = ddp[iii];
4632 }
4633 desc.tsn_ifany = dcp->dp.tsn;
4634 } else {
4635 /* nope we are done. */
4636 SCTP_STAT_INCR(sctps_pdrpnedat);
4637 break;
4638 }
4639 } else {
4640 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
4641 SCTP_STAT_INCR(sctps_pdrpmbct);
4642 }
4643
4644 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
4645 SCTP_STAT_INCR(sctps_pdrppdbrk);
4646 break;
4647 }
4648 if (SCTP_SIZE32(at) > chlen) {
4649 break;
4650 }
4651 chlen -= SCTP_SIZE32(at);
4652 if (chlen < sizeof(struct sctp_chunkhdr)) {
4653 /* done, none left */
4654 break;
4655 }
4656 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
4657 }
4658 /* Now update any rwnd --- possibly */
4659 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
4660 /* From a peer, we get a rwnd report */
4661 uint32_t a_rwnd;
4662
4663 SCTP_STAT_INCR(sctps_pdrpfehos);
4664
4665 bottle_bw = ntohl(cp->bottle_bw);
4666 on_queue = ntohl(cp->current_onq);
4667 if (bottle_bw && on_queue) {
4668 /* a rwnd report is in here */
4669 if (bottle_bw > on_queue)
4670 a_rwnd = bottle_bw - on_queue;
4671 else
4672 a_rwnd = 0;
4673
4674 if (a_rwnd == 0)
4675 stcb->asoc.peers_rwnd = 0;
4676 else {
4677 if (a_rwnd > stcb->asoc.total_flight) {
4678 stcb->asoc.peers_rwnd =
4679 a_rwnd - stcb->asoc.total_flight;
4680 } else {
4681 stcb->asoc.peers_rwnd = 0;
4682 }
4683 if (stcb->asoc.peers_rwnd <
4684 stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4685 /* SWS sender side engages */
4686 stcb->asoc.peers_rwnd = 0;
4687 }
4688 }
4689 }
4690 } else {
4691 SCTP_STAT_INCR(sctps_pdrpfmbox);
4692 }
4693
4694 /* now middle boxes in sat networks get a cwnd bump */
4695 if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
4696 (stcb->asoc.sat_t3_loss_recovery == 0) &&
4697 (stcb->asoc.sat_network)) {
4698 /*
4699 * This is debatable but for sat networks it makes sense
4700 * Note if a T3 timer has went off, we will prohibit any
4701 * changes to cwnd until we exit the t3 loss recovery.
4702 */
4703 stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb,
4704 net, cp, &bottle_bw, &on_queue);
4705 }
4706 }
4707
4708 /*
4709 * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
4710 * still contain IP/SCTP header - stcb: is the tcb found for this packet -
4711 * offset: offset into the mbuf chain to first chunkhdr - length: is the
4712 * length of the complete packet outputs: - length: modified to remaining
4713 * length after control processing - netp: modified to new sctp_nets after
4714 * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
4715 * bad packet,...) otherwise return the tcb for this packet
4716 */
4717 #if !defined(__Panda__)
4718 #ifdef __GNUC__
4719 __attribute__ ((noinline))
4720 #endif
4721 #endif
4722 static struct sctp_tcb *
4723 sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
4724 struct sockaddr *src, struct sockaddr *dst,
4725 struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
4726 struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
4727 #if defined(__FreeBSD__)
4728 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4729 #endif
4730 uint32_t vrf_id, uint16_t port)
4731 {
4732 struct sctp_association *asoc;
4733 struct mbuf *op_err;
4734 char msg[SCTP_DIAG_INFO_LEN];
4735 uint32_t vtag_in;
4736 int num_chunks = 0; /* number of control chunks processed */
4737 uint32_t chk_length, contiguous;
4738 int ret;
4739 int abort_no_unlock = 0;
4740 int ecne_seen = 0;
4741 /*
4742 * How big should this be, and should it be alloc'd? Lets try the
4743 * d-mtu-ceiling for now (2k) and that should hopefully work ...
4744 * until we get into jumbo grams and such..
4745 */
4746 uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
4747 int got_auth = 0;
4748 uint32_t auth_offset = 0, auth_len = 0;
4749 int auth_skipped = 0;
4750 int asconf_cnt = 0;
4751 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4752 struct socket *so;
4753 #endif
4754
4755 SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
4756 iphlen, *offset, length, (void *)stcb);
4757
4758 if (stcb) {
4759 SCTP_TCB_LOCK_ASSERT(stcb);
4760 }
4761 /* validate chunk header length... */
4762 if (ntohs(ch->chunk_length) < sizeof(*ch)) {
4763 SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
4764 ntohs(ch->chunk_length));
4765 *offset = length;
4766 return (stcb);
4767 }
4768 /*
4769 * validate the verification tag
4770 */
4771 vtag_in = ntohl(sh->v_tag);
4772
4773 if (ch->chunk_type == SCTP_INITIATION) {
4774 SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
4775 ntohs(ch->chunk_length), vtag_in);
4776 if (vtag_in != 0) {
4777 /* protocol error- silently discard... */
4778 SCTP_STAT_INCR(sctps_badvtag);
4779 if (stcb != NULL) {
4780 SCTP_TCB_UNLOCK(stcb);
4781 }
4782 return (NULL);
4783 }
4784 } else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
4785 /*
4786 * If there is no stcb, skip the AUTH chunk and process
4787 * later after a stcb is found (to validate the lookup was
4788 * valid.
4789 */
4790 if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
4791 (stcb == NULL) &&
4792 (inp->auth_supported == 1)) {
4793 /* save this chunk for later processing */
4794 auth_skipped = 1;
4795 auth_offset = *offset;
4796 auth_len = ntohs(ch->chunk_length);
4797
4798 /* (temporarily) move past this chunk */
4799 *offset += SCTP_SIZE32(auth_len);
4800 if (*offset >= length) {
4801 /* no more data left in the mbuf chain */
4802 *offset = length;
4803 return (NULL);
4804 }
4805 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4806 sizeof(struct sctp_chunkhdr), chunk_buf);
4807 }
4808 if (ch == NULL) {
4809 /* Help */
4810 *offset = length;
4811 return (stcb);
4812 }
4813 if (ch->chunk_type == SCTP_COOKIE_ECHO) {
4814 goto process_control_chunks;
4815 }
4816 /*
4817 * first check if it's an ASCONF with an unknown src addr we
4818 * need to look inside to find the association
4819 */
4820 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
4821 struct sctp_chunkhdr *asconf_ch = ch;
4822 uint32_t asconf_offset = 0, asconf_len = 0;
4823
4824 /* inp's refcount may be reduced */
4825 SCTP_INP_INCR_REF(inp);
4826
4827 asconf_offset = *offset;
4828 do {
4829 asconf_len = ntohs(asconf_ch->chunk_length);
4830 if (asconf_len < sizeof(struct sctp_asconf_paramhdr))
4831 break;
4832 stcb = sctp_findassociation_ep_asconf(m,
4833 *offset,
4834 dst,
4835 sh, &inp, netp, vrf_id);
4836 if (stcb != NULL)
4837 break;
4838 asconf_offset += SCTP_SIZE32(asconf_len);
4839 asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,
4840 sizeof(struct sctp_chunkhdr), chunk_buf);
4841 } while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);
4842 if (stcb == NULL) {
4843 /*
4844 * reduce inp's refcount if not reduced in
4845 * sctp_findassociation_ep_asconf().
4846 */
4847 SCTP_INP_DECR_REF(inp);
4848 }
4849
4850 /* now go back and verify any auth chunk to be sure */
4851 if (auth_skipped && (stcb != NULL)) {
4852 struct sctp_auth_chunk *auth;
4853
4854 if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
4855 auth = (struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, chunk_buf);
4856 got_auth = 1;
4857 auth_skipped = 0;
4858 } else {
4859 auth = NULL;
4860 }
4861 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
4862 auth_offset)) {
4863 /* auth HMAC failed so dump it */
4864 *offset = length;
4865 return (stcb);
4866 } else {
4867 /* remaining chunks are HMAC checked */
4868 stcb->asoc.authenticated = 1;
4869 }
4870 }
4871 }
4872 if (stcb == NULL) {
4873 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
4874 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
4875 msg);
4876 /* no association, so it's out of the blue... */
4877 sctp_handle_ootb(m, iphlen, *offset, src, dst, sh, inp, op_err,
4878 #if defined(__FreeBSD__)
4879 mflowtype, mflowid, inp->fibnum,
4880 #endif
4881 vrf_id, port);
4882 *offset = length;
4883 return (NULL);
4884 }
4885 asoc = &stcb->asoc;
4886 /* ABORT and SHUTDOWN can use either v_tag... */
4887 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
4888 (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
4889 (ch->chunk_type == SCTP_PACKET_DROPPED)) {
4890 /* Take the T-bit always into account. */
4891 if ((((ch->chunk_flags & SCTP_HAD_NO_TCB) == 0) &&
4892 (vtag_in == asoc->my_vtag)) ||
4893 (((ch->chunk_flags & SCTP_HAD_NO_TCB) == SCTP_HAD_NO_TCB) &&
4894 (asoc->peer_vtag != htonl(0)) &&
4895 (vtag_in == asoc->peer_vtag))) {
4896 /* this is valid */
4897 } else {
4898 /* drop this packet... */
4899 SCTP_STAT_INCR(sctps_badvtag);
4900 if (stcb != NULL) {
4901 SCTP_TCB_UNLOCK(stcb);
4902 }
4903 return (NULL);
4904 }
4905 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
4906 if (vtag_in != asoc->my_vtag) {
4907 /*
4908 * this could be a stale SHUTDOWN-ACK or the
4909 * peer never got the SHUTDOWN-COMPLETE and
4910 * is still hung; we have started a new asoc
4911 * but it won't complete until the shutdown
4912 * is completed
4913 */
4914 if (stcb != NULL) {
4915 SCTP_TCB_UNLOCK(stcb);
4916 }
4917 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
4918 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
4919 msg);
4920 sctp_handle_ootb(m, iphlen, *offset, src, dst,
4921 sh, inp, op_err,
4922 #if defined(__FreeBSD__)
4923 mflowtype, mflowid, fibnum,
4924 #endif
4925 vrf_id, port);
4926 return (NULL);
4927 }
4928 } else {
4929 /* for all other chunks, vtag must match */
4930 if (vtag_in != asoc->my_vtag) {
4931 /* invalid vtag... */
4932 SCTPDBG(SCTP_DEBUG_INPUT3,
4933 "invalid vtag: %xh, expect %xh\n",
4934 vtag_in, asoc->my_vtag);
4935 SCTP_STAT_INCR(sctps_badvtag);
4936 if (stcb != NULL) {
4937 SCTP_TCB_UNLOCK(stcb);
4938 }
4939 *offset = length;
4940 return (NULL);
4941 }
4942 }
4943 } /* end if !SCTP_COOKIE_ECHO */
4944 /*
4945 * process all control chunks...
4946 */
4947 if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
4948 (ch->chunk_type == SCTP_NR_SELECTIVE_ACK) ||
4949 (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
4950 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4951 /* implied cookie-ack.. we must have lost the ack */
4952 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
4953 *netp);
4954 }
4955
4956 process_control_chunks:
4957 while (IS_SCTP_CONTROL(ch)) {
4958 /* validate chunk length */
4959 chk_length = ntohs(ch->chunk_length);
4960 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
4961 ch->chunk_type, chk_length);
4962 SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
4963 if (chk_length < sizeof(*ch) ||
4964 (*offset + (int)chk_length) > length) {
4965 *offset = length;
4966 return (stcb);
4967 }
4968 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
4969 /*
4970 * INIT and INIT-ACK only gets the init ack "header" portion
4971 * only because we don't have to process the peer's COOKIE.
4972 * All others get a complete chunk.
4973 */
4974 switch (ch->chunk_type) {
4975 case SCTP_INITIATION:
4976 contiguous = sizeof(struct sctp_init_chunk);
4977 break;
4978 case SCTP_INITIATION_ACK:
4979 contiguous = sizeof(struct sctp_init_ack_chunk);
4980 break;
4981 default:
4982 contiguous = min(chk_length, sizeof(chunk_buf));
4983 break;
4984 }
4985 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4986 contiguous,
4987 chunk_buf);
4988 if (ch == NULL) {
4989 *offset = length;
4990 if (stcb != NULL) {
4991 SCTP_TCB_UNLOCK(stcb);
4992 }
4993 return (NULL);
4994 }
4995
4996 num_chunks++;
4997 /* Save off the last place we got a control from */
4998 if (stcb != NULL) {
4999 if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
5000 /*
5001 * allow last_control to be NULL if
5002 * ASCONF... ASCONF processing will find the
5003 * right net later
5004 */
5005 if ((netp != NULL) && (*netp != NULL))
5006 stcb->asoc.last_control_chunk_from = *netp;
5007 }
5008 }
5009 #ifdef SCTP_AUDITING_ENABLED
5010 sctp_audit_log(0xB0, ch->chunk_type);
5011 #endif
5012
5013 /* check to see if this chunk required auth, but isn't */
5014 if ((stcb != NULL) &&
5015 sctp_auth_is_required_chunk(ch->chunk_type, stcb->asoc.local_auth_chunks) &&
5016 !stcb->asoc.authenticated) {
5017 /* "silently" ignore */
5018 SCTP_STAT_INCR(sctps_recvauthmissing);
5019 goto next_chunk;
5020 }
5021 switch (ch->chunk_type) {
5022 case SCTP_INITIATION:
5023 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
5024 /* The INIT chunk must be the only chunk. */
5025 if ((num_chunks > 1) ||
5026 (length - *offset > (int)SCTP_SIZE32(chk_length))) {
5027 /* RFC 4960 requires that no ABORT is sent */
5028 *offset = length;
5029 if (stcb != NULL) {
5030 SCTP_TCB_UNLOCK(stcb);
5031 }
5032 return (NULL);
5033 }
5034 /* Honor our resource limit. */
5035 if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {
5036 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
5037 sctp_abort_association(inp, stcb, m, iphlen,
5038 src, dst, sh, op_err,
5039 #if defined(__FreeBSD__)
5040 mflowtype, mflowid,
5041 #endif
5042 vrf_id, port);
5043 *offset = length;
5044 return (NULL);
5045 }
5046 sctp_handle_init(m, iphlen, *offset, src, dst, sh,
5047 (struct sctp_init_chunk *)ch, inp,
5048 stcb, *netp, &abort_no_unlock,
5049 #if defined(__FreeBSD__)
5050 mflowtype, mflowid,
5051 #endif
5052 vrf_id, port);
5053 *offset = length;
5054 if ((!abort_no_unlock) && (stcb != NULL)) {
5055 SCTP_TCB_UNLOCK(stcb);
5056 }
5057 return (NULL);
5058 break;
5059 case SCTP_PAD_CHUNK:
5060 break;
5061 case SCTP_INITIATION_ACK:
5062 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT_ACK\n");
5063 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5064 /* We are not interested anymore */
5065 if ((stcb != NULL) && (stcb->asoc.total_output_queue_size)) {
5066 ;
5067 } else {
5068 *offset = length;
5069 if (stcb != NULL) {
5070 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5071 so = SCTP_INP_SO(inp);
5072 atomic_add_int(&stcb->asoc.refcnt, 1);
5073 SCTP_TCB_UNLOCK(stcb);
5074 SCTP_SOCKET_LOCK(so, 1);
5075 SCTP_TCB_LOCK(stcb);
5076 atomic_subtract_int(&stcb->asoc.refcnt, 1);
5077 #endif
5078 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
5079 SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
5080 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5081 SCTP_SOCKET_UNLOCK(so, 1);
5082 #endif
5083 }
5084 return (NULL);
5085 }
5086 }
5087 /* The INIT-ACK chunk must be the only chunk. */
5088 if ((num_chunks > 1) ||
5089 (length - *offset > (int)SCTP_SIZE32(chk_length))) {
5090 *offset = length;
5091 return (stcb);
5092 }
5093 if ((netp != NULL) && (*netp != NULL)) {
5094 ret = sctp_handle_init_ack(m, iphlen, *offset,
5095 src, dst, sh,
5096 (struct sctp_init_ack_chunk *)ch,
5097 stcb, *netp,
5098 &abort_no_unlock,
5099 #if defined(__FreeBSD__)
5100 mflowtype, mflowid,
5101 #endif
5102 vrf_id);
5103 } else {
5104 ret = -1;
5105 }
5106 *offset = length;
5107 if (abort_no_unlock) {
5108 return (NULL);
5109 }
5110 /*
5111 * Special case, I must call the output routine to
5112 * get the cookie echoed
5113 */
5114 if ((stcb != NULL) && (ret == 0)) {
5115 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
5116 }
5117 return (stcb);
5118 break;
5119 case SCTP_SELECTIVE_ACK:
5120 case SCTP_NR_SELECTIVE_ACK:
5121 {
5122 int abort_now = 0;
5123 uint32_t a_rwnd, cum_ack;
5124 uint16_t num_seg, num_nr_seg, num_dup;
5125 uint8_t flags;
5126 int offset_seg, offset_dup;
5127
5128 SCTPDBG(SCTP_DEBUG_INPUT3, "%s\n",
5129 ch->chunk_type == SCTP_SELECTIVE_ACK ? "SCTP_SACK" : "SCTP_NR_SACK");
5130 SCTP_STAT_INCR(sctps_recvsacks);
5131 if (stcb == NULL) {
5132 SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing %s chunk\n",
5133 (ch->chunk_type == SCTP_SELECTIVE_ACK) ? "SCTP_SACK" : "SCTP_NR_SACK");
5134 break;
5135 }
5136 if (ch->chunk_type == SCTP_SELECTIVE_ACK) {
5137 if (chk_length < sizeof(struct sctp_sack_chunk)) {
5138 SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on SACK chunk, too small\n");
5139 break;
5140 }
5141 } else {
5142 if (stcb->asoc.nrsack_supported == 0) {
5143 goto unknown_chunk;
5144 }
5145 if (chk_length < sizeof(struct sctp_nr_sack_chunk)) {
5146 SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on NR_SACK chunk, too small\n");
5147 break;
5148 }
5149 }
5150 if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
5151 /*-
5152 * If we have sent a shutdown-ack, we will pay no
5153 * attention to a sack sent in to us since
5154 * we don't care anymore.
5155 */
5156 break;
5157 }
5158 flags = ch->chunk_flags;
5159 if (ch->chunk_type == SCTP_SELECTIVE_ACK) {
5160 struct sctp_sack_chunk *sack;
5161
5162 sack = (struct sctp_sack_chunk *)ch;
5163 cum_ack = ntohl(sack->sack.cum_tsn_ack);
5164 num_seg = ntohs(sack->sack.num_gap_ack_blks);
5165 num_nr_seg = 0;
5166 num_dup = ntohs(sack->sack.num_dup_tsns);
5167 a_rwnd = ntohl(sack->sack.a_rwnd);
5168 if (sizeof(struct sctp_sack_chunk) +
5169 num_seg * sizeof(struct sctp_gap_ack_block) +
5170 num_dup * sizeof(uint32_t) != chk_length) {
5171 SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of SACK chunk\n");
5172 break;
5173 }
5174 offset_seg = *offset + sizeof(struct sctp_sack_chunk);
5175 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
5176 } else {
5177 struct sctp_nr_sack_chunk *nr_sack;
5178
5179 nr_sack = (struct sctp_nr_sack_chunk *)ch;
5180 cum_ack = ntohl(nr_sack->nr_sack.cum_tsn_ack);
5181 num_seg = ntohs(nr_sack->nr_sack.num_gap_ack_blks);
5182 num_nr_seg = ntohs(nr_sack->nr_sack.num_nr_gap_ack_blks);
5183 num_dup = ntohs(nr_sack->nr_sack.num_dup_tsns);
5184 a_rwnd = ntohl(nr_sack->nr_sack.a_rwnd);
5185 if (sizeof(struct sctp_nr_sack_chunk) +
5186 (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block) +
5187 num_dup * sizeof(uint32_t) != chk_length) {
5188 SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of NR_SACK chunk\n");
5189 break;
5190 }
5191 offset_seg = *offset + sizeof(struct sctp_nr_sack_chunk);
5192 offset_dup = offset_seg + (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block);
5193 }
5194 SCTPDBG(SCTP_DEBUG_INPUT3, "%s process cum_ack:%x num_seg:%d a_rwnd:%d\n",
5195 (ch->chunk_type == SCTP_SELECTIVE_ACK) ? "SCTP_SACK" : "SCTP_NR_SACK",
5196 cum_ack, num_seg, a_rwnd);
5197 stcb->asoc.seen_a_sack_this_pkt = 1;
5198 if ((stcb->asoc.pr_sctp_cnt == 0) &&
5199 (num_seg == 0) && (num_nr_seg == 0) &&
5200 SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
5201 (stcb->asoc.saw_sack_with_frags == 0) &&
5202 (stcb->asoc.saw_sack_with_nr_frags == 0) &&
5203 (!TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
5204 /*
5205 * We have a SIMPLE sack having no
5206 * prior segments and data on sent
5207 * queue to be acked. Use the
5208 * faster path sack processing. We
5209 * also allow window update sacks
5210 * with no missing segments to go
5211 * this way too.
5212 */
5213 sctp_express_handle_sack(stcb, cum_ack, a_rwnd,
5214 &abort_now, ecne_seen);
5215 } else {
5216 if ((netp != NULL) && (*netp != NULL)) {
5217 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
5218 num_seg, num_nr_seg, num_dup, &abort_now, flags,
5219 cum_ack, a_rwnd, ecne_seen);
5220 }
5221 }
5222 if (abort_now) {
5223 /* ABORT signal from sack processing */
5224 *offset = length;
5225 return (NULL);
5226 }
5227 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
5228 TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
5229 (stcb->asoc.stream_queue_cnt == 0)) {
5230 sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
5231 }
5232 break;
5233 }
5234 case SCTP_HEARTBEAT_REQUEST:
5235 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
5236 if ((stcb != NULL) && (netp != NULL) && (*netp != NULL)) {
5237 SCTP_STAT_INCR(sctps_recvheartbeat);
5238 sctp_send_heartbeat_ack(stcb, m, *offset,
5239 chk_length, *netp);
5240 }
5241 break;
5242 case SCTP_HEARTBEAT_ACK:
5243 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT_ACK\n");
5244 if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
5245 /* Its not ours */
5246 *offset = length;
5247 return (stcb);
5248 }
5249 SCTP_STAT_INCR(sctps_recvheartbeatack);
5250 if ((netp != NULL) && (*netp != NULL)) {
5251 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
5252 stcb, *netp);
5253 }
5254 break;
5255 case SCTP_ABORT_ASSOCIATION:
5256 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
5257 (void *)stcb);
5258 *offset = length;
5259 if ((stcb != NULL) && (netp != NULL) && (*netp != NULL)) {
5260 if (sctp_handle_abort((struct sctp_abort_chunk *)ch, stcb, *netp)) {
5261 return (NULL);
5262 } else {
5263 return (stcb);
5264 }
5265 } else {
5266 return (NULL);
5267 }
5268 break;
5269 case SCTP_SHUTDOWN:
5270 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
5271 (void *)stcb);
5272 if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
5273 *offset = length;
5274 return (stcb);
5275 }
5276 if ((netp != NULL) && (*netp != NULL)) {
5277 int abort_flag = 0;
5278
5279 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
5280 stcb, *netp, &abort_flag);
5281 if (abort_flag) {
5282 *offset = length;
5283 return (NULL);
5284 }
5285 }
5286 break;
5287 case SCTP_SHUTDOWN_ACK:
5288 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN_ACK, stcb %p\n", (void *)stcb);
5289 if ((stcb != NULL) && (netp != NULL) && (*netp != NULL)) {
5290 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
5291 }
5292 *offset = length;
5293 return (NULL);
5294 break;
5295 case SCTP_OPERATION_ERROR:
5296 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP_ERR\n");
5297 if ((stcb != NULL) && (netp != NULL) && (*netp != NULL) &&
5298 sctp_handle_error(ch, stcb, *netp, contiguous) < 0) {
5299 *offset = length;
5300 return (NULL);
5301 }
5302 break;
5303 case SCTP_COOKIE_ECHO:
5304 SCTPDBG(SCTP_DEBUG_INPUT3,
5305 "SCTP_COOKIE_ECHO, stcb %p\n", (void *)stcb);
5306 if ((stcb != NULL) && (stcb->asoc.total_output_queue_size > 0)) {
5307 ;
5308 } else {
5309 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5310 /* We are not interested anymore */
5311 abend:
5312 if (stcb != NULL) {
5313 SCTP_TCB_UNLOCK(stcb);
5314 }
5315 *offset = length;
5316 return (NULL);
5317 }
5318 }
5319 /*-
5320 * First are we accepting? We do this again here
5321 * since it is possible that a previous endpoint WAS
5322 * listening responded to a INIT-ACK and then
5323 * closed. We opened and bound.. and are now no
5324 * longer listening.
5325 *
5326 * XXXGL: notes on checking listen queue length.
5327 * 1) SCTP_IS_LISTENING() doesn't necessarily mean
5328 * SOLISTENING(), because a listening "UDP type"
5329 * socket isn't listening in terms of the socket
5330 * layer. It is a normal data flow socket, that
5331 * can fork off new connections. Thus, we should
5332 * look into sol_qlen only in case we are !UDP.
5333 * 2) Checking sol_qlen in general requires locking
5334 * the socket, and this code lacks that.
5335 */
5336 if ((stcb == NULL) &&
5337 (!SCTP_IS_LISTENING(inp) ||
5338 (!(inp->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
5339 #if defined(__FreeBSD__) && __FreeBSD_version >= 1200034
5340 inp->sctp_socket->sol_qlen >= inp->sctp_socket->sol_qlimit))) {
5341 #else
5342 inp->sctp_socket->so_qlen >= inp->sctp_socket->so_qlimit))) {
5343 #endif
5344 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
5345 (SCTP_BASE_SYSCTL(sctp_abort_if_one_2_one_hits_limit))) {
5346 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
5347 sctp_abort_association(inp, stcb, m, iphlen,
5348 src, dst, sh, op_err,
5349 #if defined(__FreeBSD__)
5350 mflowtype, mflowid,
5351 #endif
5352 vrf_id, port);
5353 }
5354 *offset = length;
5355 return (NULL);
5356 } else {
5357 struct mbuf *ret_buf;
5358 struct sctp_inpcb *linp;
5359 if (stcb) {
5360 linp = NULL;
5361 } else {
5362 linp = inp;
5363 }
5364
5365 if (linp != NULL) {
5366 SCTP_ASOC_CREATE_LOCK(linp);
5367 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5368 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5369 SCTP_ASOC_CREATE_UNLOCK(linp);
5370 goto abend;
5371 }
5372 }
5373
5374 if (netp != NULL) {
5375 struct sctp_tcb *locked_stcb;
5376
5377 locked_stcb = stcb;
5378 ret_buf =
5379 sctp_handle_cookie_echo(m, iphlen,
5380 *offset,
5381 src, dst,
5382 sh,
5383 (struct sctp_cookie_echo_chunk *)ch,
5384 &inp, &stcb, netp,
5385 auth_skipped,
5386 auth_offset,
5387 auth_len,
5388 &locked_stcb,
5389 #if defined(__FreeBSD__)
5390 mflowtype,
5391 mflowid,
5392 #endif
5393 vrf_id,
5394 port);
5395 if ((locked_stcb != NULL) && (locked_stcb != stcb)) {
5396 SCTP_TCB_UNLOCK(locked_stcb);
5397 }
5398 if (stcb != NULL) {
5399 SCTP_TCB_LOCK_ASSERT(stcb);
5400 }
5401 } else {
5402 ret_buf = NULL;
5403 }
5404 if (linp != NULL) {
5405 SCTP_ASOC_CREATE_UNLOCK(linp);
5406 }
5407 if (ret_buf == NULL) {
5408 if (stcb != NULL) {
5409 SCTP_TCB_UNLOCK(stcb);
5410 }
5411 SCTPDBG(SCTP_DEBUG_INPUT3,
5412 "GAK, null buffer\n");
5413 *offset = length;
5414 return (NULL);
5415 }
5416 /* if AUTH skipped, see if it verified... */
5417 if (auth_skipped) {
5418 got_auth = 1;
5419 auth_skipped = 0;
5420 }
5421 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
5422 /*
5423 * Restart the timer if we have
5424 * pending data
5425 */
5426 struct sctp_tmit_chunk *chk;
5427
5428 chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
5429 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
5430 }
5431 }
5432 break;
5433 case SCTP_COOKIE_ACK:
5434 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE_ACK, stcb %p\n", (void *)stcb);
5435 if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
5436 return (stcb);
5437 }
5438 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5439 /* We are not interested anymore */
5440 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
5441 ;
5442 } else if (stcb) {
5443 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5444 so = SCTP_INP_SO(inp);
5445 atomic_add_int(&stcb->asoc.refcnt, 1);
5446 SCTP_TCB_UNLOCK(stcb);
5447 SCTP_SOCKET_LOCK(so, 1);
5448 SCTP_TCB_LOCK(stcb);
5449 atomic_subtract_int(&stcb->asoc.refcnt, 1);
5450 #endif
5451 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
5452 SCTP_FROM_SCTP_INPUT + SCTP_LOC_30);
5453 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5454 SCTP_SOCKET_UNLOCK(so, 1);
5455 #endif
5456 *offset = length;
5457 return (NULL);
5458 }
5459 }
5460 if ((netp != NULL) && (*netp != NULL)) {
5461 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
5462 }
5463 break;
5464 case SCTP_ECN_ECHO:
5465 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN_ECHO\n");
5466 if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
5467 /* Its not ours */
5468 *offset = length;
5469 return (stcb);
5470 }
5471 if (stcb->asoc.ecn_supported == 0) {
5472 goto unknown_chunk;
5473 }
5474 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, stcb);
5475 ecne_seen = 1;
5476 break;
5477 case SCTP_ECN_CWR:
5478 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN_CWR\n");
5479 if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
5480 *offset = length;
5481 return (stcb);
5482 }
5483 if (stcb->asoc.ecn_supported == 0) {
5484 goto unknown_chunk;
5485 }
5486 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb, *netp);
5487 break;
5488 case SCTP_SHUTDOWN_COMPLETE:
5489 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN_COMPLETE, stcb %p\n", (void *)stcb);
5490 /* must be first and only chunk */
5491 if ((num_chunks > 1) ||
5492 (length - *offset > (int)SCTP_SIZE32(chk_length))) {
5493 *offset = length;
5494 return (stcb);
5495 }
5496 if ((stcb != NULL) && (netp != NULL) && (*netp != NULL)) {
5497 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
5498 stcb, *netp);
5499 }
5500 *offset = length;
5501 return (NULL);
5502 break;
5503 case SCTP_ASCONF:
5504 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
5505 if (stcb != NULL) {
5506 if (stcb->asoc.asconf_supported == 0) {
5507 goto unknown_chunk;
5508 }
5509 sctp_handle_asconf(m, *offset, src,
5510 (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0);
5511 asconf_cnt++;
5512 }
5513 break;
5514 case SCTP_ASCONF_ACK:
5515 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF_ACK\n");
5516 if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
5517 /* Its not ours */
5518 *offset = length;
5519 return (stcb);
5520 }
5521 if ((stcb != NULL) && (netp != NULL) && (*netp != NULL)) {
5522 if (stcb->asoc.asconf_supported == 0) {
5523 goto unknown_chunk;
5524 }
5525 /* He's alive so give him credit */
5526 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5527 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5528 stcb->asoc.overall_error_count,
5529 0,
5530 SCTP_FROM_SCTP_INPUT,
5531 __LINE__);
5532 }
5533 stcb->asoc.overall_error_count = 0;
5534 sctp_handle_asconf_ack(m, *offset,
5535 (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);
5536 if (abort_no_unlock)
5537 return (NULL);
5538 }
5539 break;
5540 case SCTP_FORWARD_CUM_TSN:
5541 case SCTP_IFORWARD_CUM_TSN:
5542 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD_TSN\n");
5543 if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
5544 /* Its not ours */
5545 *offset = length;
5546 return (stcb);
5547 }
5548
5549 if (stcb != NULL) {
5550 int abort_flag = 0;
5551
5552 if (stcb->asoc.prsctp_supported == 0) {
5553 goto unknown_chunk;
5554 }
5555 *fwd_tsn_seen = 1;
5556 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5557 /* We are not interested anymore */
5558 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5559 so = SCTP_INP_SO(inp);
5560 atomic_add_int(&stcb->asoc.refcnt, 1);
5561 SCTP_TCB_UNLOCK(stcb);
5562 SCTP_SOCKET_LOCK(so, 1);
5563 SCTP_TCB_LOCK(stcb);
5564 atomic_subtract_int(&stcb->asoc.refcnt, 1);
5565 #endif
5566 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
5567 SCTP_FROM_SCTP_INPUT + SCTP_LOC_31);
5568 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5569 SCTP_SOCKET_UNLOCK(so, 1);
5570 #endif
5571 *offset = length;
5572 return (NULL);
5573 }
5574 /*
5575 * For sending a SACK this looks like DATA
5576 * chunks.
5577 */
5578 stcb->asoc.last_data_chunk_from = stcb->asoc.last_control_chunk_from;
5579 sctp_handle_forward_tsn(stcb,
5580 (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);
5581 if (abort_flag) {
5582 *offset = length;
5583 return (NULL);
5584 }
5585 }
5586 break;
5587 case SCTP_STREAM_RESET:
5588 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
5589 if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
5590 /* Its not ours */
5591 *offset = length;
5592 return (stcb);
5593 }
5594 if (stcb->asoc.reconfig_supported == 0) {
5595 goto unknown_chunk;
5596 }
5597 if (sctp_handle_stream_reset(stcb, m, *offset, ch)) {
5598 /* stop processing */
5599 *offset = length;
5600 return (NULL);
5601 }
5602 break;
5603 case SCTP_PACKET_DROPPED:
5604 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
5605 /* re-get it all please */
5606 if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
5607 /* Its not ours */
5608 *offset = length;
5609 return (stcb);
5610 }
5611
5612 if ((ch != NULL) && (stcb != NULL) && (netp != NULL) && (*netp != NULL)) {
5613 if (stcb->asoc.pktdrop_supported == 0) {
5614 goto unknown_chunk;
5615 }
5616 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
5617 stcb, *netp,
5618 min(chk_length, contiguous));
5619 }
5620 break;
5621 case SCTP_AUTHENTICATION:
5622 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
5623 if (stcb == NULL) {
5624 /* save the first AUTH for later processing */
5625 if (auth_skipped == 0) {
5626 auth_offset = *offset;
5627 auth_len = chk_length;
5628 auth_skipped = 1;
5629 }
5630 /* skip this chunk (temporarily) */
5631 goto next_chunk;
5632 }
5633 if (stcb->asoc.auth_supported == 0) {
5634 goto unknown_chunk;
5635 }
5636 if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
5637 (chk_length > (sizeof(struct sctp_auth_chunk) +
5638 SCTP_AUTH_DIGEST_LEN_MAX))) {
5639 /* Its not ours */
5640 *offset = length;
5641 return (stcb);
5642 }
5643 if (got_auth == 1) {
5644 /* skip this chunk... it's already auth'd */
5645 goto next_chunk;
5646 }
5647 got_auth = 1;
5648 if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
5649 m, *offset)) {
5650 /* auth HMAC failed so dump the packet */
5651 *offset = length;
5652 return (stcb);
5653 } else {
5654 /* remaining chunks are HMAC checked */
5655 stcb->asoc.authenticated = 1;
5656 }
5657 break;
5658
5659 default:
5660 unknown_chunk:
5661 /* it's an unknown chunk! */
5662 if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
5663 struct sctp_gen_error_cause *cause;
5664 int len;
5665
5666 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_gen_error_cause),
5667 0, M_NOWAIT, 1, MT_DATA);
5668 if (op_err != NULL) {
5669 len = min(SCTP_SIZE32(chk_length), (uint32_t)(length - *offset));
5670 cause = mtod(op_err, struct sctp_gen_error_cause *);
5671 cause->code = htons(SCTP_CAUSE_UNRECOG_CHUNK);
5672 cause->length = htons((uint16_t)(len + sizeof(struct sctp_gen_error_cause)));
5673 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause);
5674 SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(m, *offset, len, M_NOWAIT);
5675 if (SCTP_BUF_NEXT(op_err) != NULL) {
5676 #ifdef SCTP_MBUF_LOGGING
5677 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
5678 sctp_log_mbc(SCTP_BUF_NEXT(op_err), SCTP_MBUF_ICOPY);
5679 }
5680 #endif
5681 sctp_queue_op_err(stcb, op_err);
5682 } else {
5683 sctp_m_freem(op_err);
5684 }
5685 }
5686 }
5687 if ((ch->chunk_type & 0x80) == 0) {
5688 /* discard this packet */
5689 *offset = length;
5690 return (stcb);
5691 } /* else skip this bad chunk and continue... */
5692 break;
5693 } /* switch (ch->chunk_type) */
5694
5695
5696 next_chunk:
5697 /* get the next chunk */
5698 *offset += SCTP_SIZE32(chk_length);
5699 if (*offset >= length) {
5700 /* no more data left in the mbuf chain */
5701 break;
5702 }
5703 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
5704 sizeof(struct sctp_chunkhdr), chunk_buf);
5705 if (ch == NULL) {
5706 *offset = length;
5707 return (stcb);
5708 }
5709 } /* while */
5710
5711 if ((asconf_cnt > 0) && (stcb != NULL)) {
5712 sctp_send_asconf_ack(stcb);
5713 }
5714 return (stcb);
5715 }
5716
5717
5718 /*
5719 * common input chunk processing (v4 and v6)
5720 */
5721 void
5722 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int length,
5723 struct sockaddr *src, struct sockaddr *dst,
5724 struct sctphdr *sh, struct sctp_chunkhdr *ch,
5725 uint8_t compute_crc,
5726 uint8_t ecn_bits,
5727 #if defined(__FreeBSD__)
5728 uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
5729 #endif
5730 uint32_t vrf_id, uint16_t port)
5731 {
5732 uint32_t high_tsn;
5733 int fwd_tsn_seen = 0, data_processed = 0;
5734 struct mbuf *m = *mm, *op_err;
5735 char msg[SCTP_DIAG_INFO_LEN];
5736 int un_sent;
5737 int cnt_ctrl_ready = 0;
5738 struct sctp_inpcb *inp = NULL, *inp_decr = NULL;
5739 struct sctp_tcb *stcb = NULL;
5740 struct sctp_nets *net = NULL;
5741 #if defined(__Userspace__)
5742 struct socket *upcall_socket = NULL;
5743 #endif
5744
5745 SCTP_STAT_INCR(sctps_recvdatagrams);
5746 #ifdef SCTP_AUDITING_ENABLED
5747 sctp_audit_log(0xE0, 1);
5748 sctp_auditing(0, inp, stcb, net);
5749 #endif
5750 if (compute_crc != 0) {
5751 uint32_t check, calc_check;
5752
5753 check = sh->checksum;
5754 sh->checksum = 0;
5755 calc_check = sctp_calculate_cksum(m, iphlen);
5756 sh->checksum = check;
5757 if (calc_check != check) {
5758 SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x m:%p mlen:%d iphlen:%d\n",
5759 calc_check, check, (void *)m, length, iphlen);
5760 stcb = sctp_findassociation_addr(m, offset, src, dst,
5761 sh, ch, &inp, &net, vrf_id);
5762 #if defined(INET) || defined(INET6)
5763 if ((ch->chunk_type != SCTP_INITIATION) &&
5764 (net != NULL) && (net->port != port)) {
5765 if (net->port == 0) {
5766 /* UDP encapsulation turned on. */
5767 net->mtu -= sizeof(struct udphdr);
5768 if (stcb->asoc.smallest_mtu > net->mtu) {
5769 sctp_pathmtu_adjustment(stcb, net->mtu);
5770 }
5771 } else if (port == 0) {
5772 /* UDP encapsulation turned off. */
5773 net->mtu += sizeof(struct udphdr);
5774 /* XXX Update smallest_mtu */
5775 }
5776 net->port = port;
5777 }
5778 #endif
5779 #if defined(__FreeBSD__)
5780 if (net != NULL) {
5781 net->flowtype = mflowtype;
5782 net->flowid = mflowid;
5783 }
5784 SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5785 #endif
5786 if ((inp != NULL) && (stcb != NULL)) {
5787 sctp_send_packet_dropped(stcb, net, m, length, iphlen, 1);
5788 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED);
5789 } else if ((inp != NULL) && (stcb == NULL)) {
5790 inp_decr = inp;
5791 }
5792 SCTP_STAT_INCR(sctps_badsum);
5793 SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
5794 goto out;
5795 }
5796 }
5797 /* Destination port of 0 is illegal, based on RFC4960. */
5798 if (sh->dest_port == 0) {
5799 SCTP_STAT_INCR(sctps_hdrops);
5800 goto out;
5801 }
5802 stcb = sctp_findassociation_addr(m, offset, src, dst,
5803 sh, ch, &inp, &net, vrf_id);
5804 #if defined(INET) || defined(INET6)
5805 if ((ch->chunk_type != SCTP_INITIATION) &&
5806 (net != NULL) && (net->port != port)) {
5807 if (net->port == 0) {
5808 /* UDP encapsulation turned on. */
5809 net->mtu -= sizeof(struct udphdr);
5810 if (stcb->asoc.smallest_mtu > net->mtu) {
5811 sctp_pathmtu_adjustment(stcb, net->mtu);
5812 }
5813 } else if (port == 0) {
5814 /* UDP encapsulation turned off. */
5815 net->mtu += sizeof(struct udphdr);
5816 /* XXX Update smallest_mtu */
5817 }
5818 net->port = port;
5819 }
5820 #endif
5821 #if defined(__FreeBSD__)
5822 if (net != NULL) {
5823 net->flowtype = mflowtype;
5824 net->flowid = mflowid;
5825 }
5826 #endif
5827 if (inp == NULL) {
5828 #if defined(__FreeBSD__)
5829 SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5830 #endif
5831 SCTP_STAT_INCR(sctps_noport);
5832 #if defined(__FreeBSD__) && (((__FreeBSD_version < 900000) && (__FreeBSD_version >= 804000)) || (__FreeBSD_version > 900000))
5833 if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0) {
5834 goto out;
5835 }
5836 #endif
5837 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
5838 sctp_send_shutdown_complete2(src, dst, sh,
5839 #if defined(__FreeBSD__)
5840 mflowtype, mflowid, fibnum,
5841 #endif
5842 vrf_id, port);
5843 goto out;
5844 }
5845 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
5846 goto out;
5847 }
5848 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) {
5849 if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
5850 ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
5851 (ch->chunk_type != SCTP_INIT))) {
5852 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5853 "Out of the blue");
5854 sctp_send_abort(m, iphlen, src, dst,
5855 sh, 0, op_err,
5856 #if defined(__FreeBSD__)
5857 mflowtype, mflowid, fibnum,
5858 #endif
5859 vrf_id, port);
5860 }
5861 }
5862 goto out;
5863 } else if (stcb == NULL) {
5864 inp_decr = inp;
5865 }
5866 SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n",
5867 (void *)m, iphlen, offset, length, (void *)stcb);
5868 if (stcb) {
5869 /* always clear this before beginning a packet */
5870 stcb->asoc.authenticated = 0;
5871 stcb->asoc.seen_a_sack_this_pkt = 0;
5872 SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n",
5873 (void *)stcb, stcb->asoc.state);
5874
5875 if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||
5876 (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5877 /*-
5878 * If we hit here, we had a ref count
5879 * up when the assoc was aborted and the
5880 * timer is clearing out the assoc, we should
5881 * NOT respond to any packet.. its OOTB.
5882 */
5883 SCTP_TCB_UNLOCK(stcb);
5884 stcb = NULL;
5885 #if defined(__FreeBSD__)
5886 SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5887 #endif
5888 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5889 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5890 msg);
5891 sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5892 #if defined(__FreeBSD__)
5893 mflowtype, mflowid, inp->fibnum,
5894 #endif
5895 vrf_id, port);
5896 goto out;
5897 }
5898 }
5899 #if defined(__Userspace__)
5900 if ((stcb != NULL) &&
5901 !(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) &&
5902 (stcb->sctp_socket != NULL)) {
5903 if (stcb->sctp_socket->so_head != NULL) {
5904 upcall_socket = stcb->sctp_socket->so_head;
5905 } else {
5906 upcall_socket = stcb->sctp_socket;
5907 }
5908 SOCK_LOCK(upcall_socket);
5909 soref(upcall_socket);
5910 SOCK_UNLOCK(upcall_socket);
5911 }
5912 #endif
5913 if (IS_SCTP_CONTROL(ch)) {
5914 /* process the control portion of the SCTP packet */
5915 /* sa_ignore NO_NULL_CHK */
5916 stcb = sctp_process_control(m, iphlen, &offset, length,
5917 src, dst, sh, ch,
5918 inp, stcb, &net, &fwd_tsn_seen,
5919 #if defined(__FreeBSD__)
5920 mflowtype, mflowid, fibnum,
5921 #endif
5922 vrf_id, port);
5923 if (stcb) {
5924 /* This covers us if the cookie-echo was there
5925 * and it changes our INP.
5926 */
5927 inp = stcb->sctp_ep;
5928 #if defined(INET) || defined(INET6)
5929 if ((ch->chunk_type != SCTP_INITIATION) &&
5930 (net != NULL) && (net->port != port)) {
5931 if (net->port == 0) {
5932 /* UDP encapsulation turned on. */
5933 net->mtu -= sizeof(struct udphdr);
5934 if (stcb->asoc.smallest_mtu > net->mtu) {
5935 sctp_pathmtu_adjustment(stcb, net->mtu);
5936 }
5937 } else if (port == 0) {
5938 /* UDP encapsulation turned off. */
5939 net->mtu += sizeof(struct udphdr);
5940 /* XXX Update smallest_mtu */
5941 }
5942 net->port = port;
5943 }
5944 #endif
5945 }
5946 } else {
5947 /*
5948 * no control chunks, so pre-process DATA chunks (these
5949 * checks are taken care of by control processing)
5950 */
5951
5952 /*
5953 * if DATA only packet, and auth is required, then punt...
5954 * can't have authenticated without any AUTH (control)
5955 * chunks
5956 */
5957 if ((stcb != NULL) &&
5958 sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks)) {
5959 /* "silently" ignore */
5960 #if defined(__FreeBSD__)
5961 SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5962 #endif
5963 SCTP_STAT_INCR(sctps_recvauthmissing);
5964 goto out;
5965 }
5966 if (stcb == NULL) {
5967 /* out of the blue DATA chunk */
5968 #if defined(__FreeBSD__)
5969 SCTP_PROBE5(receive, NULL, NULL, m, NULL, sh);
5970 #endif
5971 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5972 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5973 msg);
5974 sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5975 #if defined(__FreeBSD__)
5976 mflowtype, mflowid, fibnum,
5977 #endif
5978 vrf_id, port);
5979 goto out;
5980 }
5981 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
5982 /* v_tag mismatch! */
5983 #if defined(__FreeBSD__)
5984 SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5985 #endif
5986 SCTP_STAT_INCR(sctps_badvtag);
5987 goto out;
5988 }
5989 }
5990
5991 #if defined(__FreeBSD__)
5992 SCTP_PROBE5(receive, NULL, stcb, m, stcb, sh);
5993 #endif
5994 if (stcb == NULL) {
5995 /*
5996 * no valid TCB for this packet, or we found it's a bad
5997 * packet while processing control, or we're done with this
5998 * packet (done or skip rest of data), so we drop it...
5999 */
6000 goto out;
6001 }
6002 #if defined(__Userspace__)
6003 if ((upcall_socket == NULL) &&
6004 !(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) &&
6005 (stcb->sctp_socket != NULL)) {
6006 if (stcb->sctp_socket->so_head != NULL) {
6007 upcall_socket = stcb->sctp_socket->so_head;
6008 } else {
6009 upcall_socket = stcb->sctp_socket;
6010 }
6011 SOCK_LOCK(upcall_socket);
6012 soref(upcall_socket);
6013 SOCK_UNLOCK(upcall_socket);
6014 }
6015 #endif
6016
6017 /*
6018 * DATA chunk processing
6019 */
6020 /* plow through the data chunks while length > offset */
6021
6022 /*
6023 * Rest should be DATA only. Check authentication state if AUTH for
6024 * DATA is required.
6025 */
6026 if ((length > offset) &&
6027 (stcb != NULL) &&
6028 sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks) &&
6029 !stcb->asoc.authenticated) {
6030 /* "silently" ignore */
6031 SCTP_STAT_INCR(sctps_recvauthmissing);
6032 SCTPDBG(SCTP_DEBUG_AUTH1,
6033 "Data chunk requires AUTH, skipped\n");
6034 goto trigger_send;
6035 }
6036 if (length > offset) {
6037 int retval;
6038
6039 /*
6040 * First check to make sure our state is correct. We would
6041 * not get here unless we really did have a tag, so we don't
6042 * abort if this happens, just dump the chunk silently.
6043 */
6044 switch (SCTP_GET_STATE(stcb)) {
6045 case SCTP_STATE_COOKIE_ECHOED:
6046 /*
6047 * we consider data with valid tags in this state
6048 * shows us the cookie-ack was lost. Imply it was
6049 * there.
6050 */
6051 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
6052 break;
6053 case SCTP_STATE_COOKIE_WAIT:
6054 /*
6055 * We consider OOTB any data sent during asoc setup.
6056 */
6057 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
6058 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
6059 msg);
6060 sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
6061 #if defined(__FreeBSD__)
6062 mflowtype, mflowid, inp->fibnum,
6063 #endif
6064 vrf_id, port);
6065 goto out;
6066 /*sa_ignore NOTREACHED*/
6067 break;
6068 case SCTP_STATE_EMPTY: /* should not happen */
6069 case SCTP_STATE_INUSE: /* should not happen */
6070 case SCTP_STATE_SHUTDOWN_RECEIVED: /* This is a peer error */
6071 case SCTP_STATE_SHUTDOWN_ACK_SENT:
6072 default:
6073 goto out;
6074 /*sa_ignore NOTREACHED*/
6075 break;
6076 case SCTP_STATE_OPEN:
6077 case SCTP_STATE_SHUTDOWN_SENT:
6078 break;
6079 }
6080 /* plow through the data chunks while length > offset */
6081 retval = sctp_process_data(mm, iphlen, &offset, length,
6082 inp, stcb, net, &high_tsn);
6083 if (retval == 2) {
6084 /*
6085 * The association aborted, NO UNLOCK needed since
6086 * the association is destroyed.
6087 */
6088 stcb = NULL;
6089 goto out;
6090 }
6091 data_processed = 1;
6092 /*
6093 * Anything important needs to have been m_copy'ed in
6094 * process_data
6095 */
6096 }
6097
6098 /* take care of ecn */
6099 if ((data_processed == 1) &&
6100 (stcb->asoc.ecn_supported == 1) &&
6101 ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS)) {
6102 /* Yep, we need to add a ECNE */
6103 sctp_send_ecn_echo(stcb, net, high_tsn);
6104 }
6105
6106 if ((data_processed == 0) && (fwd_tsn_seen)) {
6107 int was_a_gap;
6108 uint32_t highest_tsn;
6109
6110 if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) {
6111 highest_tsn = stcb->asoc.highest_tsn_inside_nr_map;
6112 } else {
6113 highest_tsn = stcb->asoc.highest_tsn_inside_map;
6114 }
6115 was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
6116 stcb->asoc.send_sack = 1;
6117 sctp_sack_check(stcb, was_a_gap);
6118 } else if (fwd_tsn_seen) {
6119 stcb->asoc.send_sack = 1;
6120 }
6121 /* trigger send of any chunks in queue... */
6122 trigger_send:
6123 #ifdef SCTP_AUDITING_ENABLED
6124 sctp_audit_log(0xE0, 2);
6125 sctp_auditing(1, inp, stcb, net);
6126 #endif
6127 SCTPDBG(SCTP_DEBUG_INPUT1,
6128 "Check for chunk output prw:%d tqe:%d tf=%d\n",
6129 stcb->asoc.peers_rwnd,
6130 TAILQ_EMPTY(&stcb->asoc.control_send_queue),
6131 stcb->asoc.total_flight);
6132 un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
6133 if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
6134 cnt_ctrl_ready = stcb->asoc.ctrl_queue_cnt - stcb->asoc.ecn_echo_cnt_onq;
6135 }
6136 if (!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue) ||
6137 cnt_ctrl_ready ||
6138 stcb->asoc.trigger_reset ||
6139 ((un_sent) &&
6140 (stcb->asoc.peers_rwnd > 0 ||
6141 (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
6142 SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
6143 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
6144 SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
6145 }
6146 #ifdef SCTP_AUDITING_ENABLED
6147 sctp_audit_log(0xE0, 3);
6148 sctp_auditing(2, inp, stcb, net);
6149 #endif
6150 out:
6151 if (stcb != NULL) {
6152 SCTP_TCB_UNLOCK(stcb);
6153 }
6154 #if defined(__Userspace__)
6155 if (upcall_socket != NULL) {
6156 if (upcall_socket->so_upcall != NULL) {
6157 if (soreadable(upcall_socket) ||
6158 sowriteable(upcall_socket) ||
6159 upcall_socket->so_error) {
6160 (*upcall_socket->so_upcall)(upcall_socket, upcall_socket->so_upcallarg, M_NOWAIT);
6161 }
6162 }
6163 ACCEPT_LOCK();
6164 SOCK_LOCK(upcall_socket);
6165 sorele(upcall_socket);
6166 }
6167 #endif
6168 if (inp_decr != NULL) {
6169 /* reduce ref-count */
6170 SCTP_INP_WLOCK(inp_decr);
6171 SCTP_INP_DECR_REF(inp_decr);
6172 SCTP_INP_WUNLOCK(inp_decr);
6173 }
6174 return;
6175 }
6176
6177 #ifdef INET
6178 #if !defined(__Userspace__)
6179 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__Windows__)
6180 void
6181 sctp_input_with_port(struct mbuf *i_pak, int off, uint16_t port)
6182 #elif defined(__Panda__)
6183 void
6184 sctp_input(pakhandle_type i_pak)
6185 #else
6186 void
6187 #if __STDC__
6188 sctp_input(struct mbuf *i_pak,...)
6189 #else
6190 sctp_input(i_pak, va_alist)
6191 struct mbuf *i_pak;
6192 #endif
6193 #endif
6194 {
6195 struct mbuf *m;
6196 int iphlen;
6197 uint32_t vrf_id = 0;
6198 uint8_t ecn_bits;
6199 struct sockaddr_in src, dst;
6200 struct ip *ip;
6201 struct sctphdr *sh;
6202 struct sctp_chunkhdr *ch;
6203 int length, offset;
6204 uint8_t compute_crc;
6205 #if defined(__FreeBSD__)
6206 uint32_t mflowid;
6207 uint8_t mflowtype;
6208 uint16_t fibnum;
6209 #endif
6210 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__Windows__))
6211 uint16_t port = 0;
6212 #endif
6213
6214 #if defined(__Panda__)
6215 /* This is Evil, but its the only way to make panda work right. */
6216 iphlen = sizeof(struct ip);
6217 #else
6218 iphlen = off;
6219 #endif
6220 if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
6221 SCTP_RELEASE_PKT(i_pak);
6222 return;
6223 }
6224 m = SCTP_HEADER_TO_CHAIN(i_pak);
6225 #ifdef __Panda__
6226 SCTP_DETACH_HEADER_FROM_CHAIN(i_pak);
6227 (void)SCTP_RELEASE_HEADER(i_pak);
6228 #endif
6229 #ifdef SCTP_MBUF_LOGGING
6230 /* Log in any input mbufs */
6231 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6232 sctp_log_mbc(m, SCTP_MBUF_INPUT);
6233 }
6234 #endif
6235 #ifdef SCTP_PACKET_LOGGING
6236 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) {
6237 sctp_packet_log(m);
6238 }
6239 #endif
6240 #if defined(__FreeBSD__)
6241 #if __FreeBSD_version > 1000049
6242 SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6243 "sctp_input(): Packet of length %d received on %s with csum_flags 0x%b.\n",
6244 m->m_pkthdr.len,
6245 if_name(m->m_pkthdr.rcvif),
6246 (int)m->m_pkthdr.csum_flags, CSUM_BITS);
6247 #elif __FreeBSD_version >= 800000
6248 SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6249 "sctp_input(): Packet of length %d received on %s with csum_flags 0x%x.\n",
6250 m->m_pkthdr.len,
6251 if_name(m->m_pkthdr.rcvif),
6252 m->m_pkthdr.csum_flags);
6253 #else
6254 SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6255 "sctp_input(): Packet of length %d received on %s with csum_flags 0x%x.\n",
6256 m->m_pkthdr.len,
6257 m->m_pkthdr.rcvif->if_xname,
6258 m->m_pkthdr.csum_flags);
6259 #endif
6260 #endif
6261 #if defined(__APPLE__)
6262 SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6263 "sctp_input(): Packet of length %d received on %s%d with csum_flags 0x%x.\n",
6264 m->m_pkthdr.len,
6265 m->m_pkthdr.rcvif->if_name,
6266 m->m_pkthdr.rcvif->if_unit,
6267 m->m_pkthdr.csum_flags);
6268 #endif
6269 #if defined(__Windows__)
6270 SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6271 "sctp_input(): Packet of length %d received on %s with csum_flags 0x%x.\n",
6272 m->m_pkthdr.len,
6273 m->m_pkthdr.rcvif->if_xname,
6274 m->m_pkthdr.csum_flags);
6275 #endif
6276 #if defined(__FreeBSD__)
6277 mflowid = m->m_pkthdr.flowid;
6278 mflowtype = M_HASHTYPE_GET(m);
6279 fibnum = M_GETFIB(m);
6280 #endif
6281 SCTP_STAT_INCR(sctps_recvpackets);
6282 SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
6283 /* Get IP, SCTP, and first chunk header together in the first mbuf. */
6284 offset = iphlen + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6285 if (SCTP_BUF_LEN(m) < offset) {
6286 if ((m = m_pullup(m, offset)) == NULL) {
6287 SCTP_STAT_INCR(sctps_hdrops);
6288 return;
6289 }
6290 }
6291 ip = mtod(m, struct ip *);
6292 sh = (struct sctphdr *)((caddr_t)ip + iphlen);
6293 ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(struct sctphdr));
6294 offset -= sizeof(struct sctp_chunkhdr);
6295 memset(&src, 0, sizeof(struct sockaddr_in));
6296 src.sin_family = AF_INET;
6297 #ifdef HAVE_SIN_LEN
6298 src.sin_len = sizeof(struct sockaddr_in);
6299 #endif
6300 src.sin_port = sh->src_port;
6301 src.sin_addr = ip->ip_src;
6302 memset(&dst, 0, sizeof(struct sockaddr_in));
6303 dst.sin_family = AF_INET;
6304 #ifdef HAVE_SIN_LEN
6305 dst.sin_len = sizeof(struct sockaddr_in);
6306 #endif
6307 dst.sin_port = sh->dest_port;
6308 dst.sin_addr = ip->ip_dst;
6309 #if defined(__Windows__)
6310 NTOHS(ip->ip_len);
6311 #endif
6312 #if defined(__Userspace_os_Linux) || defined(__Userspace_os_Windows)
6313 ip->ip_len = ntohs(ip->ip_len);
6314 #endif
6315 #if defined(__FreeBSD__)
6316 #if __FreeBSD_version >= 1000000
6317 length = ntohs(ip->ip_len);
6318 #else
6319 length = ip->ip_len + iphlen;
6320 #endif
6321 #elif defined(__APPLE__)
6322 length = ip->ip_len + iphlen;
6323 #elif defined(__Userspace__)
6324 #if defined(__Userspace_os_Linux) || defined(__Userspace_os_Windows)
6325 length = ip->ip_len;
6326 #else
6327 length = ip->ip_len + iphlen;
6328 #endif
6329 #else
6330 length = ip->ip_len;
6331 #endif
6332 /* Validate mbuf chain length with IP payload length. */
6333 if (SCTP_HEADER_LEN(m) != length) {
6334 SCTPDBG(SCTP_DEBUG_INPUT1,
6335 "sctp_input() length:%d reported length:%d\n", length, SCTP_HEADER_LEN(m));
6336 SCTP_STAT_INCR(sctps_hdrops);
6337 goto out;
6338 }
6339 /* SCTP does not allow broadcasts or multicasts */
6340 if (IN_MULTICAST(ntohl(dst.sin_addr.s_addr))) {
6341 goto out;
6342 }
6343 if (SCTP_IS_IT_BROADCAST(dst.sin_addr, m)) {
6344 goto out;
6345 }
6346 ecn_bits = ip->ip_tos;
6347 #if defined(__FreeBSD__) && __FreeBSD_version >= 800000
6348 if (m->m_pkthdr.csum_flags & CSUM_SCTP_VALID) {
6349 SCTP_STAT_INCR(sctps_recvhwcrc);
6350 compute_crc = 0;
6351 } else {
6352 #else
6353 if (SCTP_BASE_SYSCTL(sctp_no_csum_on_loopback) &&
6354 ((src.sin_addr.s_addr == dst.sin_addr.s_addr) ||
6355 (SCTP_IS_IT_LOOPBACK(m)))) {
6356 SCTP_STAT_INCR(sctps_recvhwcrc);
6357 compute_crc = 0;
6358 } else {
6359 #endif
6360 SCTP_STAT_INCR(sctps_recvswcrc);
6361 compute_crc = 1;
6362 }
6363 sctp_common_input_processing(&m, iphlen, offset, length,
6364 (struct sockaddr *)&src,
6365 (struct sockaddr *)&dst,
6366 sh, ch,
6367 compute_crc,
6368 ecn_bits,
6369 #if defined(__FreeBSD__)
6370 mflowtype, mflowid, fibnum,
6371 #endif
6372 vrf_id, port);
6373 out:
6374 if (m) {
6375 sctp_m_freem(m);
6376 }
6377 return;
6378 }
6379
6380 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6381 extern int *sctp_cpuarry;
6382 #endif
6383
6384 #if defined(__FreeBSD__) && __FreeBSD_version >= 1100020
6385 int
6386 sctp_input(struct mbuf **mp, int *offp, int proto SCTP_UNUSED)
6387 {
6388 struct mbuf *m;
6389 int off;
6390
6391 m = *mp;
6392 off = *offp;
6393 #else
6394 void
6395 sctp_input(struct mbuf *m, int off)
6396 {
6397 #endif
6398 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6399 if (mp_ncpus > 1) {
6400 struct ip *ip;
6401 struct sctphdr *sh;
6402 int offset;
6403 int cpu_to_use;
6404 uint32_t flowid, tag;
6405
6406 if (M_HASHTYPE_GET(m) != M_HASHTYPE_NONE) {
6407 flowid = m->m_pkthdr.flowid;
6408 } else {
6409 /* No flow id built by lower layers
6410 * fix it so we create one.
6411 */
6412 offset = off + sizeof(struct sctphdr);
6413 if (SCTP_BUF_LEN(m) < offset) {
6414 if ((m = m_pullup(m, offset)) == NULL) {
6415 SCTP_STAT_INCR(sctps_hdrops);
6416 #if defined(__FreeBSD__) && __FreeBSD_version >= 1100020
6417 return (IPPROTO_DONE);
6418 #else
6419 return;
6420 #endif
6421 }
6422 }
6423 ip = mtod(m, struct ip *);
6424 sh = (struct sctphdr *)((caddr_t)ip + off);
6425 tag = htonl(sh->v_tag);
6426 flowid = tag ^ ntohs(sh->dest_port) ^ ntohs(sh->src_port);
6427 m->m_pkthdr.flowid = flowid;
6428 M_HASHTYPE_SET(m, M_HASHTYPE_OPAQUE_HASH);
6429 }
6430 cpu_to_use = sctp_cpuarry[flowid % mp_ncpus];
6431 sctp_queue_to_mcore(m, off, cpu_to_use);
6432 #if defined(__FreeBSD__) && __FreeBSD_version >= 1100020
6433 return (IPPROTO_DONE);
6434 #else
6435 return;
6436 #endif
6437 }
6438 #endif
6439 sctp_input_with_port(m, off, 0);
6440 #if defined(__FreeBSD__) && __FreeBSD_version >= 1100020
6441 return (IPPROTO_DONE);
6442 #endif
6443 }
6444 #endif
6445 #endif
6446