1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #include <sys/types.h>
28 #include <sys/systm.h>
29 #include <sys/stream.h>
30 #include <sys/ddi.h>
31 #include <sys/sunddi.h>
32 #include <sys/strsubr.h>
33 #include <sys/strsun.h>
34 
35 #include <netinet/in.h>
36 #include <netinet/ip6.h>
37 
38 #include <inet/ipsec_impl.h>
39 #include <inet/common.h>
40 #include <inet/ip.h>
41 #include <inet/ip6.h>
42 #include <inet/mib2.h>
43 #include <inet/nd.h>
44 #include <inet/optcom.h>
45 #include <inet/sctp_ip.h>
46 #include <inet/ipclassifier.h>
47 #include "sctp_impl.h"
48 
49 void
50 sctp_send_shutdown(sctp_t *sctp, int rexmit)
51 {
52 	mblk_t *smp;
53 	mblk_t *sendmp;
54 	sctp_chunk_hdr_t *sch;
55 	uint32_t *ctsn;
56 	sctp_faddr_t *fp;
57 	sctp_stack_t	*sctps = sctp->sctp_sctps;
58 
59 	if (sctp->sctp_state != SCTPS_ESTABLISHED &&
60 	    sctp->sctp_state != SCTPS_SHUTDOWN_PENDING &&
61 	    sctp->sctp_state != SCTPS_SHUTDOWN_SENT) {
62 		return;
63 	}
64 
65 	if (sctp->sctp_state == SCTPS_ESTABLISHED) {
66 		sctp->sctp_state = SCTPS_SHUTDOWN_PENDING;
67 		/*
68 		 * We set an upper bound on how long we will
69 		 * wait for a shutdown-ack from the peer. This
70 		 * is to prevent the receiver from attempting
71 		 * to create a half-closed state indefinately.
72 		 * See archive from IETF TSVWG mailing list
73 		 * for June 2001 for more information.
74 		 * Since we will not be calculating RTTs after
75 		 * sending the shutdown, we can overload out_time
76 		 * to track how long we have waited.
77 		 */
78 		sctp->sctp_out_time = ddi_get_lbolt64();
79 	}
80 
81 	/*
82 	 * If there is unsent (or unacked) data, wait for it to get ack'd
83 	 */
84 	if (sctp->sctp_xmit_head != NULL || sctp->sctp_xmit_unsent != NULL) {
85 		return;
86 	}
87 
88 	/* rotate faddrs if we are retransmitting */
89 	if (!rexmit) {
90 		fp = sctp->sctp_current;
91 	} else {
92 		fp = sctp_rotate_faddr(sctp, sctp->sctp_shutdown_faddr);
93 	}
94 
95 	sctp->sctp_shutdown_faddr = fp;
96 
97 	/* Link in a SACK if resending the shutdown */
98 	if (sctp->sctp_state > SCTPS_SHUTDOWN_PENDING &&
99 	    (sendmp = sctp_make_sack(sctp, fp, NULL)) != NULL) {
100 
101 		smp = allocb(sizeof (*sch) + sizeof (*ctsn), BPRI_MED);
102 		if (smp == NULL) {
103 			freemsg(sendmp);
104 			goto done;
105 		}
106 		linkb(sendmp, smp);
107 
108 		sch = (sctp_chunk_hdr_t *)smp->b_rptr;
109 		smp->b_wptr = smp->b_rptr + sizeof (*sch) + sizeof (*ctsn);
110 	} else {
111 		sendmp = sctp_make_mp(sctp, fp,
112 		    sizeof (*sch) + sizeof (*ctsn));
113 		if (sendmp == NULL) {
114 			SCTP_KSTAT(sctps, sctp_send_shutdown_failed);
115 			goto done;
116 		}
117 		sch = (sctp_chunk_hdr_t *)sendmp->b_wptr;
118 		sendmp->b_wptr += sizeof (*sch) + sizeof (*ctsn);
119 
120 		/* shutdown w/o sack, update lastacked */
121 		sctp->sctp_lastacked = sctp->sctp_ftsn - 1;
122 	}
123 
124 	sch->sch_id = CHUNK_SHUTDOWN;
125 	sch->sch_flags = 0;
126 	sch->sch_len = htons(sizeof (*sch) + sizeof (*ctsn));
127 
128 	ctsn = (uint32_t *)(sch + 1);
129 	*ctsn = htonl(sctp->sctp_lastacked);
130 
131 	/* Link the shutdown chunk in after the IP/SCTP header */
132 
133 	BUMP_LOCAL(sctp->sctp_obchunks);
134 
135 	/* Send the shutdown and restart the timer */
136 	sctp_set_iplen(sctp, sendmp, fp->ixa);
137 	(void) conn_ip_output(sendmp, fp->ixa);
138 	BUMP_LOCAL(sctp->sctp_opkts);
139 
140 done:
141 	sctp->sctp_state = SCTPS_SHUTDOWN_SENT;
142 	SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
143 	    sctp->sctp_current->rto);
144 }
145 
146 int
147 sctp_shutdown_received(sctp_t *sctp, sctp_chunk_hdr_t *sch, boolean_t crwsd,
148     boolean_t rexmit, sctp_faddr_t *fp)
149 {
150 	mblk_t *samp;
151 	sctp_chunk_hdr_t *sach;
152 	uint32_t *tsn;
153 	int trysend = 0;
154 	sctp_stack_t	*sctps = sctp->sctp_sctps;
155 
156 	if (sctp->sctp_state != SCTPS_SHUTDOWN_ACK_SENT)
157 		sctp->sctp_state = SCTPS_SHUTDOWN_RECEIVED;
158 
159 	/* Extract and process the TSN in the shutdown chunk */
160 	if (sch != NULL) {
161 		tsn = (uint32_t *)(sch + 1);
162 		/* not already acked */
163 		if (!SEQ_LT(ntohl(*tsn), sctp->sctp_lastack_rxd))
164 			trysend = sctp_cumack(sctp, ntohl(*tsn), &samp);
165 	}
166 
167 	/* Don't allow sending new data */
168 	if (!SCTP_IS_DETACHED(sctp) && !sctp->sctp_ulp_discon_done) {
169 		sctp->sctp_ulp_opctl(sctp->sctp_ulpd, SOCK_OPCTL_SHUT_SEND, 0);
170 		sctp->sctp_ulp_discon_done = B_TRUE;
171 	}
172 
173 	/*
174 	 * If there is unsent or unacked data, try sending them out now.
175 	 * The other side should acknowledge them.  After we have flushed
176 	 * the transmit queue, we can complete the shutdown sequence.
177 	 */
178 	if (sctp->sctp_xmit_head != NULL || sctp->sctp_xmit_unsent != NULL)
179 		return (1);
180 
181 	if (fp == NULL) {
182 		/* rotate faddrs if we are retransmitting */
183 		if (!rexmit)
184 			fp = sctp->sctp_current;
185 		else
186 			fp = sctp_rotate_faddr(sctp, sctp->sctp_shutdown_faddr);
187 	}
188 	sctp->sctp_shutdown_faddr = fp;
189 
190 	samp = sctp_make_mp(sctp, fp, sizeof (*sach));
191 	if (samp == NULL) {
192 		SCTP_KSTAT(sctps, sctp_send_shutdown_ack_failed);
193 		goto dotimer;
194 	}
195 
196 	sach = (sctp_chunk_hdr_t *)samp->b_wptr;
197 	sach->sch_id = CHUNK_SHUTDOWN_ACK;
198 	sach->sch_flags = 0;
199 	sach->sch_len = htons(sizeof (*sach));
200 
201 	samp->b_wptr += sizeof (*sach);
202 
203 	/*
204 	 * bundle a "cookie received while shutting down" error if
205 	 * the caller asks for it.
206 	 */
207 	if (crwsd) {
208 		mblk_t *errmp;
209 
210 		errmp = sctp_make_err(sctp, SCTP_ERR_COOKIE_SHUT, NULL, 0);
211 		if (errmp != NULL) {
212 			linkb(samp, errmp);
213 			BUMP_LOCAL(sctp->sctp_obchunks);
214 		}
215 	}
216 
217 	BUMP_LOCAL(sctp->sctp_obchunks);
218 
219 	sctp_set_iplen(sctp, samp, fp->ixa);
220 	(void) conn_ip_output(samp, fp->ixa);
221 	BUMP_LOCAL(sctp->sctp_opkts);
222 
223 dotimer:
224 	sctp->sctp_state = SCTPS_SHUTDOWN_ACK_SENT;
225 	SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
226 	    sctp->sctp_current->rto);
227 
228 	return (trysend);
229 }
230 
231 void
232 sctp_shutdown_complete(sctp_t *sctp)
233 {
234 	mblk_t *scmp;
235 	sctp_chunk_hdr_t *scch;
236 	sctp_stack_t	*sctps = sctp->sctp_sctps;
237 
238 	scmp = sctp_make_mp(sctp, sctp->sctp_current, sizeof (*scch));
239 	if (scmp == NULL) {
240 		/* XXX use timer approach */
241 		SCTP_KSTAT(sctps, sctp_send_shutdown_comp_failed);
242 		return;
243 	}
244 
245 	scch = (sctp_chunk_hdr_t *)scmp->b_wptr;
246 	scch->sch_id = CHUNK_SHUTDOWN_COMPLETE;
247 	scch->sch_flags = 0;
248 	scch->sch_len = htons(sizeof (*scch));
249 
250 	scmp->b_wptr += sizeof (*scch);
251 
252 	BUMP_LOCAL(sctp->sctp_obchunks);
253 
254 	sctp_set_iplen(sctp, scmp, sctp->sctp_current->ixa);
255 	(void) conn_ip_output(scmp, sctp->sctp_current->ixa);
256 	BUMP_LOCAL(sctp->sctp_opkts);
257 }
258 
259 /*
260  * Similar to sctp_shutdown_complete(), except that since this
261  * is out-of-the-blue, we can't use an sctp's association information,
262  * and instead must draw all necessary info from the incoming packet.
263  */
264 void
265 sctp_ootb_shutdown_ack(mblk_t *mp, uint_t ip_hdr_len, ip_recv_attr_t *ira,
266     ip_stack_t *ipst)
267 {
268 	boolean_t		isv4;
269 	ipha_t			*ipha = NULL;
270 	ip6_t			*ip6h = NULL;
271 	sctp_hdr_t		*insctph;
272 	sctp_chunk_hdr_t	*scch;
273 	int			i;
274 	uint16_t		port;
275 	mblk_t			*mp1;
276 	netstack_t		*ns = ipst->ips_netstack;
277 	sctp_stack_t		*sctps = ns->netstack_sctp;
278 	ip_xmit_attr_t		ixas;
279 
280 	bzero(&ixas, sizeof (ixas));
281 
282 	isv4 = (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
283 
284 	ASSERT(MBLKL(mp) >= sizeof (*insctph) + sizeof (*scch) +
285 	    (isv4 ? sizeof (ipha_t) : sizeof (ip6_t)));
286 
287 	/*
288 	 * Check to see if we can reuse the incoming mblk.  There should
289 	 * not be other reference. Since this packet comes from below,
290 	 * there should be enough header space to fill in what the lower
291 	 * layers want to add.
292 	 */
293 	if (DB_REF(mp) != 1) {
294 		mp1 = allocb(MBLKL(mp) + sctps->sctps_wroff_xtra, BPRI_MED);
295 		if (mp1 == NULL) {
296 			freeb(mp);
297 			return;
298 		}
299 		mp1->b_rptr += sctps->sctps_wroff_xtra;
300 		mp1->b_wptr = mp1->b_rptr + MBLKL(mp);
301 		bcopy(mp->b_rptr, mp1->b_rptr, MBLKL(mp));
302 		freeb(mp);
303 		mp = mp1;
304 	} else {
305 		DB_CKSUMFLAGS(mp) = 0;
306 	}
307 
308 	ixas.ixa_pktlen = ip_hdr_len + sizeof (*insctph) + sizeof (*scch);
309 	ixas.ixa_ip_hdr_length = ip_hdr_len;
310 	/*
311 	 * We follow the logic in tcp_xmit_early_reset() in that we skip
312 	 * reversing source route (i.e. replace all IP options with EOL).
313 	 */
314 	if (isv4) {
315 		ipaddr_t	v4addr;
316 
317 		ipha = (ipha_t *)mp->b_rptr;
318 		for (i = IP_SIMPLE_HDR_LENGTH; i < (int)ip_hdr_len; i++)
319 			mp->b_rptr[i] = IPOPT_EOL;
320 		/* Swap addresses */
321 		ipha->ipha_length = htons(ixas.ixa_pktlen);
322 		v4addr = ipha->ipha_src;
323 		ipha->ipha_src = ipha->ipha_dst;
324 		ipha->ipha_dst = v4addr;
325 		ipha->ipha_ident = 0;
326 		ipha->ipha_ttl = (uchar_t)sctps->sctps_ipv4_ttl;
327 
328 		ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
329 	} else {
330 		in6_addr_t	v6addr;
331 
332 		ip6h = (ip6_t *)mp->b_rptr;
333 		/* Remove any extension headers assuming partial overlay */
334 		if (ip_hdr_len > IPV6_HDR_LEN) {
335 			uint8_t	*to;
336 
337 			to = mp->b_rptr + ip_hdr_len - IPV6_HDR_LEN;
338 			ovbcopy(ip6h, to, IPV6_HDR_LEN);
339 			mp->b_rptr += ip_hdr_len - IPV6_HDR_LEN;
340 			ip_hdr_len = IPV6_HDR_LEN;
341 			ip6h = (ip6_t *)mp->b_rptr;
342 			ip6h->ip6_nxt = IPPROTO_SCTP;
343 		}
344 		ip6h->ip6_plen = htons(ixas.ixa_pktlen - IPV6_HDR_LEN);
345 		v6addr = ip6h->ip6_src;
346 		ip6h->ip6_src = ip6h->ip6_dst;
347 		ip6h->ip6_dst = v6addr;
348 		ip6h->ip6_hops = (uchar_t)sctps->sctps_ipv6_hoplimit;
349 
350 		ixas.ixa_flags = IXAF_BASIC_SIMPLE_V6;
351 		if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_dst)) {
352 			ixas.ixa_flags |= IXAF_SCOPEID_SET;
353 			ixas.ixa_scopeid = ira->ira_ruifindex;
354 		}
355 	}
356 
357 	insctph = (sctp_hdr_t *)(mp->b_rptr + ip_hdr_len);
358 
359 	/* Swap ports.  Verification tag is reused. */
360 	port = insctph->sh_sport;
361 	insctph->sh_sport = insctph->sh_dport;
362 	insctph->sh_dport = port;
363 
364 	/* Lay in the shutdown complete chunk */
365 	scch = (sctp_chunk_hdr_t *)(insctph + 1);
366 	scch->sch_id = CHUNK_SHUTDOWN_COMPLETE;
367 	scch->sch_len = htons(sizeof (*scch));
368 	scch->sch_flags = 0;
369 
370 	/* Set the T-bit */
371 	SCTP_SET_TBIT(scch);
372 
373 	ixas.ixa_protocol = IPPROTO_SCTP;
374 	ixas.ixa_zoneid = ira->ira_zoneid;
375 	ixas.ixa_ipst = ipst;
376 	ixas.ixa_ifindex = 0;
377 
378 	if (ira->ira_flags & IRAF_IPSEC_SECURE) {
379 		/*
380 		 * Apply IPsec based on how IPsec was applied to
381 		 * the packet that was out of the blue.
382 		 */
383 		if (!ipsec_in_to_out(ira, &ixas, mp, ipha, ip6h)) {
384 			BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
385 			/* Note: mp already consumed and ip_drop_packet done */
386 			return;
387 		}
388 	} else {
389 		/*
390 		 * This is in clear. The message we are building
391 		 * here should go out in clear, independent of our policy.
392 		 */
393 		ixas.ixa_flags |= IXAF_NO_IPSEC;
394 	}
395 
396 	(void) ip_output_simple(mp, &ixas);
397 	ixa_cleanup(&ixas);
398 }
399